From 98262d8fb29c05b202b229dd4479ae7ffe038da4 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 1 Oct 2025 13:38:25 +0100
Subject: [PATCH 001/298] ci: allow dispatching workflow triage via label
 (#20042)

Allows creating a task for an issue if a label 'traiage' is set.
Requires membership of the `coder` org to run.

Manual workflow_dispatch:
https://github.com/coder/coder/actions/runs/18158719999/job/51684512634

---------

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/traiage.yaml | 85 ++++++++++++++++++++++++++++------
 1 file changed, 72 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 615c5bec19e7f..dc45f242dbb87 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -1,6 +1,9 @@
 name: AI Triage Automation
 
 on:
+  issues:
+    types:
+      - labeled
   workflow_dispatch:
     inputs:
       issue_url:
@@ -32,6 +35,7 @@ jobs:
   traiage:
     name: Triage GitHub Issue with Claude Code
     runs-on: ubuntu-latest
+    if: github.event.label.name == 'traiage' || github.event_name == 'workflow_dispatch'
     timeout-minutes: 30
     env:
       CODER_URL: ${{ secrets.TRAIAGE_CODER_URL }}
@@ -43,17 +47,58 @@ jobs:
       actions: write
 
     steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          persist-credentials: false
-          fetch-depth: 0
+      - name: Get GitHub user ID
+        id: github-user-id
+        if: always()
+        env:
+          GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+          GITHUB_EVENT_USER_ID: ${{ github.event.sender.id }}
+          GITHUB_EVENT_USER_LOGIN: ${{ github.event.sender.login }}
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          # For workflow_dispatch, use the actor who triggered it
+          # For issues events, use the issue author
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            if ! GITHUB_USER_ID=$(gh api "users/${GITHUB_ACTOR}" --jq '.id'); then
+              echo "::error::Failed to get GitHub user ID for actor ${GITHUB_ACTOR}"
+              exit 1
+            fi
+            echo "Using workflow_dispatch actor: ${GITHUB_ACTOR} (ID: ${GITHUB_USER_ID})"
+            echo "github_user_id=${GITHUB_USER_ID}" >> "${GITHUB_OUTPUT}"
+            echo "github_username=${GITHUB_ACTOR}" >> "${GITHUB_OUTPUT}"
+            exit 0
+          elif [[ "${GITHUB_EVENT_NAME}" == "issues" ]]; then
+            GITHUB_USER_ID=${GITHUB_EVENT_USER_ID}
+            echo "Using issue author: ${GITHUB_EVENT_USER_LOGIN} (ID: ${GITHUB_USER_ID})"
+            echo "github_user_id=${GITHUB_USER_ID}" >> "${GITHUB_OUTPUT}"
+            echo "github_username=${GITHUB_EVENT_USER_LOGIN}" >> "${GITHUB_OUTPUT}"
+            exit 0
+          else
+            echo "::error::Unsupported event type: ${GITHUB_EVENT_NAME}"
+            exit 1
+          fi
+
+      - name: Verify organization membership
+        env:
+          GITHUB_ORG: ${{ github.repository_owner }}
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_USERNAME: ${{ steps.github-user-id.outputs.github_username }}
+          GITHUB_USER_ID: ${{ steps.github-user-id.outputs.github_user_id }}
+        run: |
+          # Check if the actor is a member of the organization
+          if ! gh api "orgs/${GITHUB_ORG}/members/${GITHUB_USERNAME}" --silent 2>/dev/null; then
+            echo "::error title=Access Denied::User ${GITHUB_USERNAME} is not a member of the ${GITHUB_ORG} organization"
+            echo "::error::You must be a member of the ${GITHUB_ORG} GitHub organization to run this workflow."
+            exit 1
+          fi
+          echo "::notice::User ${GITHUB_USERNAME} verified as member of ${GITHUB_ORG} organization"
 
       - name: Extract context key from issue
         id: extract-context
         env:
           ISSUE_URL: ${{ inputs.issue_url }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
         run: |
           issue_number="$(gh issue view "${ISSUE_URL}" --json number --jq '.number')"
           context_key="gh-${issue_number}"
@@ -82,11 +127,9 @@ jobs:
         id: get-coder-username
         env:
           CODER_SESSION_TOKEN: ${{ secrets.TRAIAGE_CODER_SESSION_TOKEN }}
-          GITHUB_USER_ID: ${{
-            (github.event_name == 'workflow_dispatch' && github.actor_id)
-            }}
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_USER_ID: ${{ steps.github-user-id.outputs.github_user_id }}
         run: |
-          [[ -z "${GITHUB_USER_ID}" || "${GITHUB_USER_ID}" == "null" ]] && echo "No GitHub actor ID found" && exit 1
           user_json=$(
             coder users list --github-user-id="${GITHUB_USER_ID}" --output=json
           )
@@ -94,13 +137,20 @@ jobs:
           [[ -z "${coder_username}" || "${coder_username}" == "null" ]] && echo "No Coder user with GitHub user ID ${GITHUB_USER_ID} found" && exit 1
           echo "coder_username=${coder_username}" >> "${GITHUB_OUTPUT}"
 
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
       # TODO(Cian): this is a good use-case for 'recipes'
       - name: Create Coder task
         id: create-task
         env:
           CODER_USERNAME: ${{ steps.get-coder-username.outputs.coder_username }}
           CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
           ISSUE_URL: ${{ inputs.issue_url }}
           PREFIX: ${{ inputs.prefix }}
           RUN_ID: ${{ github.run_id }}
@@ -125,7 +175,11 @@ jobs:
           export TASK_NAME="${PREFIX}-${CONTEXT_KEY}-${RUN_ID}"
           echo "Creating task: $TASK_NAME"
           ./scripts/traiage.sh create
-          coder exp task status "${CODER_USERNAME}/$TASK_NAME" --watch
+          if [[ "${ISSUE_URL}" == "https://github.com/${GITHUB_REPOSITORY}"* ]]; then
+            gh issue comment "${ISSUE_URL}" --body "Task created: ${TASK_NAME}" --create-if-none --edit-last
+          else
+            echo "Skipping comment on other repo."
+          fi
           echo "TASK_NAME=${CODER_USERNAME}/${TASK_NAME}" >> "${GITHUB_OUTPUT}"
           echo "TASK_NAME=${CODER_USERNAME}/${TASK_NAME}" >> "${GITHUB_ENV}"
 
@@ -134,7 +188,11 @@ jobs:
         if: inputs.cleanup
         env:
           BUCKET_PREFIX: "gs://coder-traiage-outputs/traiage"
+          CODER_USERNAME: ${{ steps.get-coder-username.outputs.coder_username }}
+          TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}
         run: |
+          echo "Waiting for task to complete..."
+          coder exp task status "${CODER_USERNAME}/$TASK_NAME" --watch
           echo "Creating archive for workspace: $TASK_NAME"
           ./scripts/traiage.sh archive
           echo "archive_url=${BUCKET_PREFIX%%/}/$TASK_NAME.tar.gz" >> "${GITHUB_OUTPUT}"
@@ -145,8 +203,9 @@ jobs:
         env:
           ARCHIVE_URL: ${{ steps.create-archive.outputs.archive_url }}
           BUCKET_PREFIX: "gs://coder-traiage-outputs/traiage"
+          CODER_USERNAME: ${{ steps.get-coder-username.outputs.coder_username }}
           CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
-          GITHUB_TOKEN: ${{ github.token }}
+          GH_TOKEN: ${{ github.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
           ISSUE_URL: ${{ inputs.issue_url }}
           TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}

From 257fb768828e991df3715da69f6a67d10256ee3b Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 1 Oct 2025 15:50:40 +0100
Subject: [PATCH 002/298] ci: automatically determine issue URL when invoked
 via issue label assignment (#20089)

Silly me forgot that `inputs.*` will likely be empty when invoked
outside of `workflow_dispatch`.

Sample run:
https://github.com/coder/coder/actions/runs/18165531528/job/51706661391
---
 .github/workflows/traiage.yaml | 24 +++++++++++++++++++++---
 1 file changed, 21 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index dc45f242dbb87..24192fc2d1812 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -94,10 +94,28 @@ jobs:
           fi
           echo "::notice::User ${GITHUB_USERNAME} verified as member of ${GITHUB_ORG} organization"
 
+      - name: Determine issue URL
+        id: determine-issue-url
+        env:
+          INPUTS_ISSUE_URL: ${{ inputs.issue_url }}
+          GITHUB_EVENT_ISSUE_HTML_URL: ${{ github.event.issue.html_url }}
+          GITHUB_EVENT_NAME: ${{ github.event_name }}
+        run: |
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+            echo "issue_url=${INPUTS_ISSUE_URL}" >> "${GITHUB_OUTPUT}"
+            exit 0
+          elif [[ "${GITHUB_EVENT_NAME}" == "issues" ]]; then
+            echo "issue_url=${GITHUB_EVENT_ISSUE_HTML_URL}" >> "${GITHUB_OUTPUT}"
+            exit 0
+          else
+            echo "::error::Unsupported event type: ${GITHUB_EVENT_NAME}"
+            exit 1
+          fi
+
       - name: Extract context key from issue
         id: extract-context
         env:
-          ISSUE_URL: ${{ inputs.issue_url }}
+          ISSUE_URL: ${{ steps.determine-issue-url.outputs.issue_url }}
           GH_TOKEN: ${{ github.token }}
         run: |
           issue_number="$(gh issue view "${ISSUE_URL}" --json number --jq '.number')"
@@ -151,7 +169,7 @@ jobs:
           CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
           GH_TOKEN: ${{ github.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-          ISSUE_URL: ${{ inputs.issue_url }}
+          ISSUE_URL: ${{ steps.determine-issue-url.outputs.issue_url }}
           PREFIX: ${{ inputs.prefix }}
           RUN_ID: ${{ github.run_id }}
           TEMPLATE_PARAMETERS: ${{ secrets.TRAIAGE_TEMPLATE_PARAMETERS }}
@@ -207,7 +225,7 @@ jobs:
           CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
           GH_TOKEN: ${{ github.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-          ISSUE_URL: ${{ inputs.issue_url }}
+          ISSUE_URL: ${{ steps.determine-issue-url.outputs.issue_url }}
           TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}
         run: |
           SUMMARY_FILE=$(mktemp)

From 3a56ea56a7f5357902ca4ed5c1aff54bf40b899f Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Wed, 1 Oct 2025 13:23:51 -0500
Subject: [PATCH 003/298] test: fix rbac benchmark to test performance instead
 of cache (#20097)

The benchmark should be testing the performance of `authorize`, not a
cache lookup
---
 coderd/rbac/authz_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/coderd/rbac/authz_test.go b/coderd/rbac/authz_test.go
index cd2bbb808add9..25955131242a8 100644
--- a/coderd/rbac/authz_test.go
+++ b/coderd/rbac/authz_test.go
@@ -187,7 +187,7 @@ func BenchmarkRBACAuthorizeGroups(b *testing.B) {
 		uuid.MustParse("0632b012-49e0-4d70-a5b3-f4398f1dcd52"),
 		uuid.MustParse("70dbaa7a-ea9c-4f68-a781-97b08af8461d"),
 	)
-	authorizer := rbac.NewStrictCachingAuthorizer(prometheus.NewRegistry())
+	authorizer := rbac.NewAuthorizer(prometheus.NewRegistry())
 
 	// Same benchmark cases, but this time groups will be used to match.
 	// Some '*' permissions will still match, but using a fake action reduces

From 0fbe21e574dc27b5f9cc2bb50aec29c84c40926c Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 1 Oct 2025 15:24:20 -0300
Subject: [PATCH 004/298] chore: downgrade msw and @radix-ui/dialog (#20098)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The upgrade caused the following error:

```
node: ../deps/uv/src/unix/stream.c:456: uv__stream_destroy: Assertion `!uv__io_active(&stream->io_watcher, POLLIN | POLLOUT)' failed.
```

After downgrading `msw`, a new error appeared only in
`WorkspacesPage.test.tsx`:

```
<--- Last few GCs --->

[2799:0x292c2000]    16790 ms: Scavenge 336.1 (443.3) -> 322.8 (443.3) MB, pooled: 32 MB, 6.45 / 0.00 ms  (average mu = 0.997, current mu = 0.996) allocation failure;
[2799:0x292c2000]    16883 ms: Scavenge 336.7 (443.3) -> 326.8 (443.3) MB, pooled: 32 MB, 8.29 / 0.00 ms  (average mu = 0.997, current mu = 0.996) allocation failure;
[2799:0x292c2000]    16989 ms: Scavenge 339.6 (443.3) -> 329.1 (443.3) MB, pooled: 32 MB, 9.87 / 0.00 ms  (average mu = 0.997, current mu = 0.996) allocation failure;
```

After some debugging, I traced it to `@radix-ui/dialog`. I didn’t find
any open issues about memory leaks there, so my guess is it’s just using
more memory than our default allocation. Jest has an option to increase
the memory limit, but we should be fine for now.

Related issue:
[https://github.com/mswjs/msw/issues/2537](https://github.com/mswjs/msw/issues/2537)
---
 site/package.json   |   4 +-
 site/pnpm-lock.yaml | 308 ++++++++++++++++++++------------------------
 2 files changed, 139 insertions(+), 173 deletions(-)

diff --git a/site/package.json b/site/package.json
index 7a52d5545eb8d..11ed58a05838a 100644
--- a/site/package.json
+++ b/site/package.json
@@ -55,7 +55,7 @@
 		"@radix-ui/react-avatar": "1.1.2",
 		"@radix-ui/react-checkbox": "1.1.4",
 		"@radix-ui/react-collapsible": "1.1.2",
-		"@radix-ui/react-dialog": "1.1.15",
+		"@radix-ui/react-dialog": "1.1.4",
 		"@radix-ui/react-dropdown-menu": "2.1.4",
 		"@radix-ui/react-label": "2.1.0",
 		"@radix-ui/react-popover": "1.1.5",
@@ -169,7 +169,7 @@
 		"jest-websocket-mock": "2.5.0",
 		"jest_workaround": "0.1.14",
 		"knip": "5.64.1",
-		"msw": "2.11.3",
+		"msw": "2.4.8",
 		"postcss": "8.5.1",
 		"protobufjs": "7.4.0",
 		"rollup-plugin-visualizer": "5.14.0",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index c77df41bc3ede..676011c935c76 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -80,8 +80,8 @@ importers:
         specifier: 1.1.2
         version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-dialog':
-        specifier: 1.1.15
-        version: 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: 1.1.4
+        version: 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-dropdown-menu':
         specifier: 2.1.4
         version: 2.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -283,7 +283,7 @@ importers:
         version: 2.2.0
       '@chromatic-com/storybook':
         specifier: 4.1.0
-        version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@octokit/types':
         specifier: 12.3.0
         version: 12.3.0
@@ -292,16 +292,16 @@ importers:
         version: 1.55.1
       '@storybook/addon-docs':
         specifier: 9.1.2
-        version: 9.1.2(@types/react@19.1.13)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(@types/react@19.1.13)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@storybook/addon-links':
         specifier: 9.1.2
-        version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@storybook/addon-themes':
         specifier: 9.1.2
-        version: 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@storybook/react-vite':
         specifier: 9.1.2
-        version: 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+        version: 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       '@swc/core':
         specifier: 1.3.38
         version: 1.3.38
@@ -417,8 +417,8 @@ importers:
         specifier: 5.64.1
         version: 5.64.1(@types/node@20.17.16)(typescript@5.6.3)
       msw:
-        specifier: 2.11.3
-        version: 2.11.3(@types/node@20.17.16)(typescript@5.6.3)
+        specifier: 2.4.8
+        version: 2.4.8(typescript@5.6.3)
       postcss:
         specifier: 8.5.1
         version: 8.5.1
@@ -436,10 +436,10 @@ importers:
         version: 1.17.0
       storybook:
         specifier: 9.1.2
-        version: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+        version: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       storybook-addon-remix-react-router:
         specifier: 5.0.0
-        version: 5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       tailwindcss:
         specifier: 3.4.17
         version: 3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3))
@@ -717,6 +717,9 @@ packages:
   '@bundled-es-modules/statuses@1.0.1':
     resolution: {integrity: sha512-yn7BklA5acgcBr+7w064fGV+SGIFySjCKpqjcWgBAIfrAkY+4GQTJJHQMeT3V/sgz23VTEVV8TtOmkvJAhFVfg==, tarball: https://registry.npmjs.org/@bundled-es-modules/statuses/-/statuses-1.0.1.tgz}
 
+  '@bundled-es-modules/tough-cookie@0.1.6':
+    resolution: {integrity: sha512-dvMHbL464C0zI+Yqxbz6kZ5TOEp7GLW+pry/RWndAR8MJQAXZ2rPmIs8tziTZjeIyhSNZgZbCePtfSbdWqStJw==, tarball: https://registry.npmjs.org/@bundled-es-modules/tough-cookie/-/tough-cookie-0.1.6.tgz}
+
   '@chromatic-com/storybook@4.1.0':
     resolution: {integrity: sha512-B9XesFX5lQUdP81/QBTtkiYOFqEsJwQpzkZlcYPm2n/L1S/8ZabSPbz6NoY8hOJTXWZ2p7grygUlxyGy+gAvfQ==, tarball: https://registry.npmjs.org/@chromatic-com/storybook/-/storybook-4.1.0.tgz}
     engines: {node: '>=20.0.0', yarn: '>=1.22.18'}
@@ -1189,40 +1192,25 @@ packages:
     peerDependencies:
       react: '*'
 
-  '@inquirer/ansi@1.0.0':
-    resolution: {integrity: sha512-JWaTfCxI1eTmJ1BIv86vUfjVatOdxwD0DAVKYevY8SazeUUZtW+tNbsdejVO1GYE0GXJW1N1ahmiC3TFd+7wZA==, tarball: https://registry.npmjs.org/@inquirer/ansi/-/ansi-1.0.0.tgz}
+  '@inquirer/confirm@3.2.0':
+    resolution: {integrity: sha512-oOIwPs0Dvq5220Z8lGL/6LHRTEr9TgLHmiI99Rj1PJ1p1czTys+olrgBqZk4E2qC0YTzeHprxSQmoHioVdJ7Lw==, tarball: https://registry.npmjs.org/@inquirer/confirm/-/confirm-3.2.0.tgz}
     engines: {node: '>=18'}
 
-  '@inquirer/confirm@5.1.18':
-    resolution: {integrity: sha512-MilmWOzHa3Ks11tzvuAmFoAd/wRuaP3SwlT1IZhyMke31FKLxPiuDWcGXhU+PKveNOpAc4axzAgrgxuIJJRmLw==, tarball: https://registry.npmjs.org/@inquirer/confirm/-/confirm-5.1.18.tgz}
+  '@inquirer/core@9.2.1':
+    resolution: {integrity: sha512-F2VBt7W/mwqEU4bL0RnHNZmC/OxzNx9cOYxHqnXX3MP6ruYvZUZAW9imgN9+h/uBT/oP8Gh888J2OZSbjSeWcg==, tarball: https://registry.npmjs.org/@inquirer/core/-/core-9.2.1.tgz}
     engines: {node: '>=18'}
-    peerDependencies:
-      '@types/node': '>=18'
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
-
-  '@inquirer/core@10.2.2':
-    resolution: {integrity: sha512-yXq/4QUnk4sHMtmbd7irwiepjB8jXU0kkFRL4nr/aDBA2mDz13cMakEWdDwX3eSCTkk03kwcndD1zfRAIlELxA==, tarball: https://registry.npmjs.org/@inquirer/core/-/core-10.2.2.tgz}
-    engines: {node: '>=18'}
-    peerDependencies:
-      '@types/node': '>=18'
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
 
   '@inquirer/figures@1.0.13':
     resolution: {integrity: sha512-lGPVU3yO9ZNqA7vTYz26jny41lE7yoQansmqdMLBEfqaGsmdg7V3W9mK9Pvb5IL4EVZ9GnSDGMO/cJXud5dMaw==, tarball: https://registry.npmjs.org/@inquirer/figures/-/figures-1.0.13.tgz}
     engines: {node: '>=18'}
 
-  '@inquirer/type@3.0.8':
-    resolution: {integrity: sha512-lg9Whz8onIHRthWaN1Q9EGLa/0LFJjyM8mEUbL1eTi6yMGvBf8gvyDLtxSXztQsxMvhxxNpJYrwa1YHdq+w4Jw==, tarball: https://registry.npmjs.org/@inquirer/type/-/type-3.0.8.tgz}
+  '@inquirer/type@1.5.5':
+    resolution: {integrity: sha512-MzICLu4yS7V8AA61sANROZ9vT1H3ooca5dSmI1FjZkzq7o/koMsRfQSzRtFo+F3Ao4Sf1C0bpLKejpKB/+j6MA==, tarball: https://registry.npmjs.org/@inquirer/type/-/type-1.5.5.tgz}
+    engines: {node: '>=18'}
+
+  '@inquirer/type@2.0.0':
+    resolution: {integrity: sha512-XvJRx+2KR3YXyYtPUUy+qd9i7p+GO9Ko6VIIpWlBrpWwXDv8WLFeHTxz35CfQFUiBMLXlGHhGzys7lqit9gWag==, tarball: https://registry.npmjs.org/@inquirer/type/-/type-2.0.0.tgz}
     engines: {node: '>=18'}
-    peerDependencies:
-      '@types/node': '>=18'
-    peerDependenciesMeta:
-      '@types/node':
-        optional: true
 
   '@isaacs/cliui@8.0.2':
     resolution: {integrity: sha512-O8jcjabXaleOG9DQ0+ARXWZBTfnP4WNAqzuiJK7ll44AmxGKv/J2M4TPjxjY3znBCfvBXFzucm1twdyFybFqEA==, tarball: https://registry.npmjs.org/@isaacs/cliui/-/cliui-8.0.2.tgz}
@@ -1391,8 +1379,8 @@ packages:
       react: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
       react-dom: ^16.8.0 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
-  '@mswjs/interceptors@0.39.7':
-    resolution: {integrity: sha512-sURvQbbKsq5f8INV54YJgJEdk8oxBanqkTiXXd33rKmofFCwZLhLRszPduMZ9TA9b8/1CHc/IJmOlBHJk2Q5AQ==, tarball: https://registry.npmjs.org/@mswjs/interceptors/-/interceptors-0.39.7.tgz}
+  '@mswjs/interceptors@0.35.9':
+    resolution: {integrity: sha512-SSnyl/4ni/2ViHKkiZb8eajA/eN1DNFaHjhGiLUdZvDz6PKF4COSf/17xqSz64nOo2Ia29SA6B2KNCsyCbVmaQ==, tarball: https://registry.npmjs.org/@mswjs/interceptors/-/interceptors-0.35.9.tgz}
     engines: {node: '>=18'}
 
   '@mui/core-downloads-tracker@5.18.0':
@@ -1839,8 +1827,8 @@ packages:
       '@types/react':
         optional: true
 
-  '@radix-ui/react-dialog@1.1.15':
-    resolution: {integrity: sha512-TCglVRtzlffRNxRMEyR36DGBLJpeusFcgMVD9PZEzAKnUs1lKCgX5u9BmC2Yg+LL9MgZDugFFs1Vl+Jp4t/PGw==, tarball: https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.15.tgz}
+  '@radix-ui/react-dialog@1.1.4':
+    resolution: {integrity: sha512-Ur7EV1IwQGCyaAuyDRiOLA5JIUZxELJljF+MbM/2NC0BYwfuRrbpS30BiQBJrVruscgUkieKkqXYDOoByaxIoA==, tarball: https://registry.npmjs.org/@radix-ui/react-dialog/-/react-dialog-1.1.4.tgz}
     peerDependencies:
       '@types/react': '*'
       '@types/react-dom': '*'
@@ -2088,19 +2076,6 @@ packages:
       '@types/react-dom':
         optional: true
 
-  '@radix-ui/react-presence@1.1.5':
-    resolution: {integrity: sha512-/jfEwNDdQVBCNvjkGit4h6pMOzq8bHkopq458dPt2lMjx+eBQUohZNG9A7DtO/O5ukSbxuaNGXMjHicgwy6rQQ==, tarball: https://registry.npmjs.org/@radix-ui/react-presence/-/react-presence-1.1.5.tgz}
-    peerDependencies:
-      '@types/react': '*'
-      '@types/react-dom': '*'
-      react: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-      react-dom: ^16.8 || ^17.0 || ^18.0 || ^19.0 || ^19.0.0-rc
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-      '@types/react-dom':
-        optional: true
-
   '@radix-ui/react-primitive@2.0.0':
     resolution: {integrity: sha512-ZSpFm0/uHa8zTvKBDjLFWLo8dkr4MBsiDLz0g3gMUwqgLHz9rTaRRGYDgvZPtBJgYCBKXkS9fzmoySgr8CO6Cw==, tarball: https://registry.npmjs.org/@radix-ui/react-primitive/-/react-primitive-2.0.0.tgz}
     peerDependencies:
@@ -2970,12 +2945,18 @@ packages:
   '@types/ms@2.1.0':
     resolution: {integrity: sha512-GsCCIZDE/p3i96vtEqx+7dBUGXrc7zeSK3wwPHIaRThS+9OhWIXRqzs4d6k1SVU8g91DrNRWxWUGhp5KXQb2VA==, tarball: https://registry.npmjs.org/@types/ms/-/ms-2.1.0.tgz}
 
+  '@types/mute-stream@0.0.4':
+    resolution: {integrity: sha512-CPM9nzrCPPJHQNA9keH9CVkVI+WR5kMa+7XEs5jcGQ0VoAGnLv242w8lIVgwAEfmE4oufJRaTc9PNLQl0ioAow==, tarball: https://registry.npmjs.org/@types/mute-stream/-/mute-stream-0.0.4.tgz}
+
   '@types/node@18.19.129':
     resolution: {integrity: sha512-hrmi5jWt2w60ayox3iIXwpMEnfUvOLJCRtrOPbHtH15nTjvO7uhnelvrdAs0dO0/zl5DZ3ZbahiaXEVb54ca/A==, tarball: https://registry.npmjs.org/@types/node/-/node-18.19.129.tgz}
 
   '@types/node@20.17.16':
     resolution: {integrity: sha512-vOTpLduLkZXePLxHiHsBLp98mHGnl8RptV4YAO3HfKO5UHjDvySGbxKtpYfy8Sx5+WKcgc45qNreJJRVM3L6mw==, tarball: https://registry.npmjs.org/@types/node/-/node-20.17.16.tgz}
 
+  '@types/node@22.18.8':
+    resolution: {integrity: sha512-pAZSHMiagDR7cARo/cch1f3rXy0AEXwsVsVH09FcyeJVAzCnGgmYis7P3JidtTUjyadhTeSo8TgRPswstghDaw==, tarball: https://registry.npmjs.org/@types/node/-/node-22.18.8.tgz}
+
   '@types/parse-json@4.0.2':
     resolution: {integrity: sha512-dISoDXWWQwUquiKsyZ4Ng+HX2KsPL7LyHKHQwgGFEA3IaKac4Obd+h2a/a6waisAoepJlBcx9paWqjA8/HVjCw==, tarball: https://registry.npmjs.org/@types/parse-json/-/parse-json-4.0.2.tgz}
 
@@ -3053,6 +3034,9 @@ packages:
   '@types/tough-cookie@4.0.2':
     resolution: {integrity: sha512-Q5vtl1W5ue16D+nIaW8JWebSSraJVlK+EthKn7e7UcD4KWsaSJ8BqGPXNaPghgtcn/fhvrN17Tv8ksUsQpiplw==, tarball: https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.2.tgz}
 
+  '@types/tough-cookie@4.0.5':
+    resolution: {integrity: sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==, tarball: https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.5.tgz}
+
   '@types/ua-parser-js@0.7.36':
     resolution: {integrity: sha512-N1rW+njavs70y2cApeIw1vLMYXRwfBy+7trgavGuuTfOd7j1Yh7QTRc/yqsPl6ncokt72ZXuxEU0PiCp9bSwNQ==, tarball: https://registry.npmjs.org/@types/ua-parser-js/-/ua-parser-js-0.7.36.tgz}
 
@@ -3068,6 +3052,9 @@ packages:
   '@types/uuid@9.0.2':
     resolution: {integrity: sha512-kNnC1GFBLuhImSnV7w4njQkUiJi0ZXUycu1rUaouPqiKlXkh77JKgdRnTAp1x5eBwcIwbtI+3otwzuIDEuDoxQ==, tarball: https://registry.npmjs.org/@types/uuid/-/uuid-9.0.2.tgz}
 
+  '@types/wrap-ansi@3.0.0':
+    resolution: {integrity: sha512-ltIpx+kM7g/MLRZfkbL7EsCEjfzCcScLpkg37eXEtx5kmrAKBkTJwd1GIAjDSL8wTpM6Hzn5YO4pSb91BEwu1g==, tarball: https://registry.npmjs.org/@types/wrap-ansi/-/wrap-ansi-3.0.0.tgz}
+
   '@types/yargs-parser@21.0.2':
     resolution: {integrity: sha512-5qcvofLPbfjmBfKaLfj/+f+Sbd6pN4zl7w7VSVI5uz7m9QZTuB2aZAa2uo1wHFBNN2x6g/SoTkXmd8mQnQF2Cw==, tarball: https://registry.npmjs.org/@types/yargs-parser/-/yargs-parser-21.0.2.tgz}
 
@@ -5224,8 +5211,8 @@ packages:
   ms@2.1.3:
     resolution: {integrity: sha512-6FlzubTLZG3J2a/NVCAleEhjzq5oxgHyaCU9yYXvcLsvoVaHJq/s5xXI6/XXP6tz7R9xAOtHnSO/tXtF3WRTlA==, tarball: https://registry.npmjs.org/ms/-/ms-2.1.3.tgz}
 
-  msw@2.11.3:
-    resolution: {integrity: sha512-878imp8jxIpfzuzxYfX0qqTq1IFQz/1/RBHs/PyirSjzi+xKM/RRfIpIqHSCWjH0GxidrjhgiiXC+DWXNDvT9w==, tarball: https://registry.npmjs.org/msw/-/msw-2.11.3.tgz}
+  msw@2.4.8:
+    resolution: {integrity: sha512-a+FUW1m5yT8cV9GBy0L/cbNg0EA4//SKEzgu3qFrpITrWYeZmqfo7dqtM74T2lAl69jjUjjCaEhZKaxG2Ns8DA==, tarball: https://registry.npmjs.org/msw/-/msw-2.4.8.tgz}
     engines: {node: '>=18'}
     hasBin: true
     peerDependencies:
@@ -5234,9 +5221,9 @@ packages:
       typescript:
         optional: true
 
-  mute-stream@2.0.0:
-    resolution: {integrity: sha512-WWdIxpyjEn+FhQJQQv9aQAYlHoNVdzIzUySNV1gHUPDSdZJ3yZn7pAAbQcV7B56Mvu881q9FZV+0Vx2xC44VWA==, tarball: https://registry.npmjs.org/mute-stream/-/mute-stream-2.0.0.tgz}
-    engines: {node: ^18.17.0 || >=20.5.0}
+  mute-stream@1.0.0:
+    resolution: {integrity: sha512-avsJQhyd+680gKXyG/sQc0nXaC6rBkPOfyHYcFb9+hdkqQkR9bdnkJ0AMZhke0oesPqIO+mFFJ+IdBc7mst4IA==, tarball: https://registry.npmjs.org/mute-stream/-/mute-stream-1.0.0.tgz}
+    engines: {node: ^14.17.0 || ^16.13.0 || >=18.0.0}
 
   mz@2.7.0:
     resolution: {integrity: sha512-z81GNO7nnYMEhrGh9LeymoE4+Yr0Wn5McHIZMK5cfQCl+NDX08sCZgUc9/6MHni9IWuFLm1Z3HTCXu2z9fN62Q==, tarball: https://registry.npmjs.org/mz/-/mz-2.7.0.tgz}
@@ -5876,9 +5863,6 @@ packages:
     resolution: {integrity: sha512-l+sSefzHpj5qimhFSE5a8nufZYAM3sBSVMAPtYkmC+4EH2anSGaEMXSD0izRQbu9nfyQ9y5JrVmp7E8oZrUjvA==, tarball: https://registry.npmjs.org/restore-cursor/-/restore-cursor-3.1.0.tgz}
     engines: {node: '>=8'}
 
-  rettime@0.7.0:
-    resolution: {integrity: sha512-LPRKoHnLKd/r3dVxcwO7vhCW+orkOGj9ViueosEBK6ie89CijnfRlhaDhHq/3Hxu4CkWQtxwlBG0mzTQY6uQjw==, tarball: https://registry.npmjs.org/rettime/-/rettime-0.7.0.tgz}
-
   reusify@1.1.0:
     resolution: {integrity: sha512-g6QUff04oZpHs0eG5p83rFLhHeV00ug/Yf9nZM6fLeUrPguBTkTQOdpAWWspMh55TZfVQDPaN3NQJfbVRAxdIw==, tarball: https://registry.npmjs.org/reusify/-/reusify-1.1.0.tgz}
     engines: {iojs: '>=1.0.0', node: '>=0.10.0'}
@@ -6220,13 +6204,6 @@ packages:
     resolution: {integrity: sha512-t2T/WLB2WRgZ9EpE4jgPJ9w+i66UZfDc8wHh0xrwiRNN+UwH98GIJkTeZqX9rg0i0ptwzqW+uYeIF0T4F8LR7A==, tarball: https://registry.npmjs.org/tinyspy/-/tinyspy-4.0.3.tgz}
     engines: {node: '>=14.0.0'}
 
-  tldts-core@7.0.16:
-    resolution: {integrity: sha512-XHhPmHxphLi+LGbH0G/O7dmUH9V65OY20R7vH8gETHsp5AZCjBk9l8sqmRKLaGOxnETU7XNSDUPtewAy/K6jbA==, tarball: https://registry.npmjs.org/tldts-core/-/tldts-core-7.0.16.tgz}
-
-  tldts@7.0.16:
-    resolution: {integrity: sha512-5bdPHSwbKTeHmXrgecID4Ljff8rQjv7g8zKQPkCozRo2HWWni+p310FSn5ImI+9kWw9kK4lzOB5q/a6iv0IJsw==, tarball: https://registry.npmjs.org/tldts/-/tldts-7.0.16.tgz}
-    hasBin: true
-
   tmpl@1.0.5:
     resolution: {integrity: sha512-3f0uOEAQwIqGuWW2MVzYg8fV/QNnc/IpuJNG837rLuczAaLVHslWHZQj4IGiEl5Hs3kkbhwL9Ab7Hrsmuj+Smw==, tarball: https://registry.npmjs.org/tmpl/-/tmpl-1.0.5.tgz}
 
@@ -6245,10 +6222,6 @@ packages:
     resolution: {integrity: sha512-Loo5UUvLD9ScZ6jh8beX1T6sO1w2/MpCRpEP7V280GKMVUQ0Jzar2U3UJPsrdbziLEMMhu3Ujnq//rhiFuIeag==, tarball: https://registry.npmjs.org/tough-cookie/-/tough-cookie-4.1.4.tgz}
     engines: {node: '>=6'}
 
-  tough-cookie@6.0.0:
-    resolution: {integrity: sha512-kXuRi1mtaKMrsLUxz3sQYvVl37B0Ns6MzfrtV5DvJceE9bPyspOqk9xxv7XbZWcfLWbFmm997vl83qUWVJA64w==, tarball: https://registry.npmjs.org/tough-cookie/-/tough-cookie-6.0.0.tgz}
-    engines: {node: '>=16'}
-
   tr46@3.0.0:
     resolution: {integrity: sha512-l7FvfAHlcmulp8kr+flpQZmVwtu7nfRV7NZujtN0OqES8EL4O4e0qqzL0DC5gAvx/ZC/9lk6rhcUwYvkBnBnYA==, tarball: https://registry.npmjs.org/tr46/-/tr46-3.0.0.tgz}
     engines: {node: '>=12'}
@@ -6355,6 +6328,9 @@ packages:
   undici-types@6.19.8:
     resolution: {integrity: sha512-ve2KP6f/JnbPBFyobGHuerC9g1FYGn/F8n1LWTwNxCEzd6IfqTwUQcNXgEtmmQ6DlRrC1hrSrBnCZPokRrDHjw==, tarball: https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz}
 
+  undici-types@6.21.0:
+    resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==, tarball: https://registry.npmjs.org/undici-types/-/undici-types-6.21.0.tgz}
+
   undici@6.21.3:
     resolution: {integrity: sha512-gBLkYIlEnSp8pFbT64yFgGE6UIB9tAkhukC23PmMDCe5Nd+cRqKxSjw5y54MK2AZMgZfJWMaNE4nYUHgi1XEOw==, tarball: https://registry.npmjs.org/undici/-/undici-6.21.3.tgz}
     engines: {node: '>=18.17'}
@@ -6407,9 +6383,6 @@ packages:
   unplugin@1.5.0:
     resolution: {integrity: sha512-9ZdRwbh/4gcm1JTOkp9lAkIDrtOyOxgHmY7cjuwI8L/2RTikMcVG25GsZwNAgRuap3iDw2jeq7eoqtAsz5rW3A==, tarball: https://registry.npmjs.org/unplugin/-/unplugin-1.5.0.tgz}
 
-  until-async@3.0.2:
-    resolution: {integrity: sha512-IiSk4HlzAMqTUseHHe3VhIGyuFmN90zMTpD3Z3y8jeQbzLIq500MVM7Jq2vUAnTKAFPJrqwkzr6PoTcPhGcOiw==, tarball: https://registry.npmjs.org/until-async/-/until-async-3.0.2.tgz}
-
   update-browserslist-db@1.1.1:
     resolution: {integrity: sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==, tarball: https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz}
     hasBin: true
@@ -7021,13 +6994,18 @@ snapshots:
     dependencies:
       statuses: 2.0.2
 
-  '@chromatic-com/storybook@4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@bundled-es-modules/tough-cookie@0.1.6':
+    dependencies:
+      '@types/tough-cookie': 4.0.5
+      tough-cookie: 4.1.4
+
+  '@chromatic-com/storybook@4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.2
       jsonfile: 6.1.0
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       strip-ansi: 7.1.0
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -7397,33 +7375,35 @@ snapshots:
     dependencies:
       react: 19.1.1
 
-  '@inquirer/ansi@1.0.0': {}
-
-  '@inquirer/confirm@5.1.18(@types/node@20.17.16)':
+  '@inquirer/confirm@3.2.0':
     dependencies:
-      '@inquirer/core': 10.2.2(@types/node@20.17.16)
-      '@inquirer/type': 3.0.8(@types/node@20.17.16)
-    optionalDependencies:
-      '@types/node': 20.17.16
+      '@inquirer/core': 9.2.1
+      '@inquirer/type': 1.5.5
 
-  '@inquirer/core@10.2.2(@types/node@20.17.16)':
+  '@inquirer/core@9.2.1':
     dependencies:
-      '@inquirer/ansi': 1.0.0
       '@inquirer/figures': 1.0.13
-      '@inquirer/type': 3.0.8(@types/node@20.17.16)
+      '@inquirer/type': 2.0.0
+      '@types/mute-stream': 0.0.4
+      '@types/node': 22.18.8
+      '@types/wrap-ansi': 3.0.0
+      ansi-escapes: 4.3.2
       cli-width: 4.1.0
-      mute-stream: 2.0.0
+      mute-stream: 1.0.0
       signal-exit: 4.1.0
+      strip-ansi: 6.0.1
       wrap-ansi: 6.2.0
       yoctocolors-cjs: 2.1.3
-    optionalDependencies:
-      '@types/node': 20.17.16
 
   '@inquirer/figures@1.0.13': {}
 
-  '@inquirer/type@3.0.8(@types/node@20.17.16)':
-    optionalDependencies:
-      '@types/node': 20.17.16
+  '@inquirer/type@1.5.5':
+    dependencies:
+      mute-stream: 1.0.0
+
+  '@inquirer/type@2.0.0':
+    dependencies:
+      mute-stream: 1.0.0
 
   '@isaacs/cliui@8.0.2':
     dependencies:
@@ -7715,7 +7695,7 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@mswjs/interceptors@0.39.7':
+  '@mswjs/interceptors@0.35.9':
     dependencies:
       '@open-draft/deferred-promise': 2.2.0
       '@open-draft/logger': 0.3.0
@@ -8100,20 +8080,20 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.13
 
-  '@radix-ui/react-dialog@1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dialog@1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/primitive': 1.1.1
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
@@ -8360,16 +8340,6 @@ snapshots:
       '@types/react': 19.1.13
       '@types/react-dom': 19.1.9(@types/react@19.1.13)
 
-  '@radix-ui/react-presence@1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
-    dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      react: 19.1.1
-      react-dom: 19.1.1(react@19.1.1)
-    optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
-
   '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
@@ -8803,41 +8773,41 @@ snapshots:
     dependencies:
       '@sinonjs/commons': 3.0.0
 
-  '@storybook/addon-docs@9.1.2(@types/react@19.1.13)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-docs@9.1.2(@types/react@19.1.13)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
       '@mdx-js/react': 3.0.1(@types/react@19.1.13)(react@19.1.1)
-      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@storybook/icons': 1.4.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-links@9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-links@9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
       '@storybook/global': 5.0.0
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
     optionalDependencies:
       react: 19.1.1
 
-  '@storybook/addon-themes@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-themes@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       ts-dedent: 2.2.0
 
-  '@storybook/builder-vite@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@storybook/builder-vite@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       ts-dedent: 2.2.0
       vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
 
-  '@storybook/csf-plugin@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/csf-plugin@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       unplugin: 1.5.0
 
   '@storybook/global@5.0.0': {}
@@ -8847,25 +8817,25 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@storybook/react-dom-shim@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/react-dom-shim@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
 
-  '@storybook/react-vite@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@storybook/react-vite@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
     dependencies:
       '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       '@rollup/pluginutils': 5.0.5(rollup@4.52.3)
-      '@storybook/builder-vite': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
-      '@storybook/react': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)
+      '@storybook/builder-vite': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      '@storybook/react': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)
       find-up: 7.0.0
       magic-string: 0.30.17
       react: 19.1.1
       react-docgen: 8.0.0
       react-dom: 19.1.1(react@19.1.1)
       resolve: 1.22.10
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       tsconfig-paths: 4.2.0
       vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
     transitivePeerDependencies:
@@ -8873,13 +8843,13 @@ snapshots:
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)':
+  '@storybook/react@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
     optionalDependencies:
       typescript: 5.6.3
 
@@ -9199,6 +9169,10 @@ snapshots:
 
   '@types/ms@2.1.0': {}
 
+  '@types/mute-stream@0.0.4':
+    dependencies:
+      '@types/node': 20.17.16
+
   '@types/node@18.19.129':
     dependencies:
       undici-types: 5.26.5
@@ -9207,6 +9181,10 @@ snapshots:
     dependencies:
       undici-types: 6.19.8
 
+  '@types/node@22.18.8':
+    dependencies:
+      undici-types: 6.21.0
+
   '@types/parse-json@4.0.2': {}
 
   '@types/prop-types@15.7.15': {}
@@ -9284,6 +9262,8 @@ snapshots:
 
   '@types/tough-cookie@4.0.2': {}
 
+  '@types/tough-cookie@4.0.5': {}
+
   '@types/ua-parser-js@0.7.36': {}
 
   '@types/unist@2.0.11': {}
@@ -9294,6 +9274,8 @@ snapshots:
 
   '@types/uuid@9.0.2': {}
 
+  '@types/wrap-ansi@3.0.0': {}
+
   '@types/yargs-parser@21.0.2': {}
 
   '@types/yargs-parser@21.0.3': {}
@@ -9328,13 +9310,13 @@ snapshots:
       chai: 5.2.1
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@vitest/mocker@3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.17
     optionalDependencies:
-      msw: 2.11.3(@types/node@20.17.16)(typescript@5.6.3)
+      msw: 2.4.8(typescript@5.6.3)
       vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
 
   '@vitest/pretty-format@3.2.4':
@@ -9787,7 +9769,7 @@ snapshots:
 
   cmdk@1.0.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
-      '@radix-ui/react-dialog': 1.1.15(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-dialog': 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
       '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
@@ -12078,33 +12060,29 @@ snapshots:
 
   ms@2.1.3: {}
 
-  msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3):
+  msw@2.4.8(typescript@5.6.3):
     dependencies:
       '@bundled-es-modules/cookie': 2.0.1
       '@bundled-es-modules/statuses': 1.0.1
-      '@inquirer/confirm': 5.1.18(@types/node@20.17.16)
-      '@mswjs/interceptors': 0.39.7
-      '@open-draft/deferred-promise': 2.2.0
+      '@bundled-es-modules/tough-cookie': 0.1.6
+      '@inquirer/confirm': 3.2.0
+      '@mswjs/interceptors': 0.35.9
+      '@open-draft/until': 2.1.0
       '@types/cookie': 0.6.0
       '@types/statuses': 2.0.6
+      chalk: 4.1.2
       graphql: 16.11.0
       headers-polyfill: 4.0.3
       is-node-process: 1.2.0
       outvariant: 1.4.3
       path-to-regexp: 6.3.0
-      picocolors: 1.1.1
-      rettime: 0.7.0
       strict-event-emitter: 0.5.1
-      tough-cookie: 6.0.0
       type-fest: 4.41.0
-      until-async: 3.0.2
       yargs: 17.7.2
     optionalDependencies:
       typescript: 5.6.3
-    transitivePeerDependencies:
-      - '@types/node'
 
-  mute-stream@2.0.0: {}
+  mute-stream@1.0.0: {}
 
   mz@2.7.0:
     dependencies:
@@ -12812,8 +12790,6 @@ snapshots:
       onetime: 5.1.2
       signal-exit: 3.0.7
 
-  rettime@0.7.0: {}
-
   reusify@1.1.0: {}
 
   rimraf@3.0.2:
@@ -13015,24 +12991,24 @@ snapshots:
     dependencies:
       internal-slot: 1.0.6
 
-  storybook-addon-remix-react-router@5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))):
+  storybook-addon-remix-react-router@5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))):
     dependencies:
       '@mjackson/form-data-parser': 0.4.0
       compare-versions: 6.1.0
       react-inspector: 6.0.2(react@19.1.1)
       react-router: 7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
     optionalDependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)):
+  storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)):
     dependencies:
       '@storybook/global': 5.0.0
       '@testing-library/jest-dom': 6.6.3
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.0)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(msw@2.11.3(@types/node@20.17.16)(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      '@vitest/mocker': 3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.3
@@ -13211,12 +13187,6 @@ snapshots:
 
   tinyspy@4.0.3: {}
 
-  tldts-core@7.0.16: {}
-
-  tldts@7.0.16:
-    dependencies:
-      tldts-core: 7.0.16
-
   tmpl@1.0.5: {}
 
   to-regex-range@5.0.1:
@@ -13234,10 +13204,6 @@ snapshots:
       universalify: 0.2.0
       url-parse: 1.5.10
 
-  tough-cookie@6.0.0:
-    dependencies:
-      tldts: 7.0.16
-
   tr46@3.0.0:
     dependencies:
       punycode: 2.3.1
@@ -13334,6 +13300,8 @@ snapshots:
 
   undici-types@6.19.8: {}
 
+  undici-types@6.21.0: {}
+
   undici@6.21.3: {}
 
   unicorn-magic@0.1.0: {}
@@ -13398,8 +13366,6 @@ snapshots:
       webpack-sources: 3.2.3
       webpack-virtual-modules: 0.5.0
 
-  until-async@3.0.2: {}
-
   update-browserslist-db@1.1.1(browserslist@4.24.2):
     dependencies:
       browserslist: 4.24.2

From f23a6a1140157b20c3b4ba1198e01c8d67c8f7f6 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 1 Oct 2025 15:37:11 -0300
Subject: [PATCH 005/298] feat: add remove task button into the tasks list
 (#20036)

**Demo:**


https://github.com/user-attachments/assets/eca91a46-41fb-412c-b476-0cf91c0b69b8

Closes https://github.com/coder/coder/issues/19525
---
 .../TaskDeleteDialog.stories.tsx              | 50 +++++++++++++
 .../TaskDeleteDialog/TaskDeleteDialog.tsx     | 58 ++++++++++++++
 .../TasksSidebar/TasksSidebar.stories.tsx     | 52 +------------
 .../tasks/TasksSidebar/TasksSidebar.tsx       | 46 +++---------
 .../src/pages/TasksPage/TasksPage.stories.tsx | 14 ++++
 site/src/pages/TasksPage/TasksTable.tsx       | 75 ++++++++++++++-----
 6 files changed, 189 insertions(+), 106 deletions(-)
 create mode 100644 site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx
 create mode 100644 site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx

diff --git a/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx
new file mode 100644
index 0000000000000..e595c26a7884e
--- /dev/null
+++ b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx
@@ -0,0 +1,50 @@
+import { MockTasks, MockWorkspace } from "testHelpers/entities";
+import { withGlobalSnackbar } from "testHelpers/storybook";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { API } from "api/api";
+import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
+import { TaskDeleteDialog } from "./TaskDeleteDialog";
+
+const meta: Meta<typeof TaskDeleteDialog> = {
+	title: "modules/tasks/TaskDeleteDialog",
+	component: TaskDeleteDialog,
+	decorators: [withGlobalSnackbar],
+};
+
+export default meta;
+type Story = StoryObj<typeof TaskDeleteDialog>;
+
+export const DeleteTaskSuccess: Story = {
+	decorators: [withGlobalSnackbar],
+	args: {
+		open: true,
+		task: { prompt: "My Task", workspace: MockWorkspace },
+		onClose: () => {},
+	},
+	parameters: {
+		chromatic: {
+			disableSnapshot: false,
+		},
+	},
+	beforeEach: () => {
+		spyOn(API.experimental, "deleteTask").mockResolvedValue();
+	},
+	play: async ({ canvasElement, step }) => {
+		const body = within(canvasElement.ownerDocument.body);
+
+		await step("Confirm delete", async () => {
+			const confirmButton = await body.findByRole("button", {
+				name: /delete/i,
+			});
+			await userEvent.click(confirmButton);
+			await step("Confirm delete", async () => {
+				await waitFor(() => {
+					expect(API.experimental.deleteTask).toHaveBeenCalledWith(
+						MockTasks[0].workspace.owner_name,
+						MockTasks[0].workspace.id,
+					);
+				});
+			});
+		});
+	},
+};
diff --git a/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx
new file mode 100644
index 0000000000000..b5bac134a66e4
--- /dev/null
+++ b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx
@@ -0,0 +1,58 @@
+import { API } from "api/api";
+import { getErrorDetail, getErrorMessage } from "api/errors";
+import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
+import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
+import type { FC } from "react";
+import { QueryClient, useMutation } from "react-query";
+import type { Task } from "../tasks";
+
+type TaskDeleteDialogProps = {
+	open: boolean;
+	task: Task;
+	onClose: () => void;
+	onSuccess?: () => void;
+};
+
+export const TaskDeleteDialog: FC<TaskDeleteDialogProps> = ({
+	task,
+	onSuccess,
+	...props
+}) => {
+	const queryClient = new QueryClient();
+	const deleteTaskMutation = useMutation({
+		mutationFn: () =>
+			API.experimental.deleteTask(task.workspace.owner_name, task.workspace.id),
+		onSuccess: async () => {
+			await queryClient.invalidateQueries({ queryKey: ["tasks"] });
+		},
+	});
+
+	return (
+		<ConfirmDialog
+			{...props}
+			type="delete"
+			confirmLoading={deleteTaskMutation.isPending}
+			title="Delete task"
+			onConfirm={async () => {
+				try {
+					await deleteTaskMutation.mutateAsync();
+					displaySuccess("Task deleted successfully");
+					onSuccess?.();
+				} catch (error) {
+					displayError(
+						getErrorMessage(error, "Failed to delete task"),
+						getErrorDetail(error),
+					);
+				} finally {
+					props.onClose();
+				}
+			}}
+			description={
+				<p>
+					This action is irreversible and removes all workspace resources and
+					data.
+				</p>
+			}
+		/>
+	);
+};
diff --git a/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx b/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx
index 333b3db13cbf4..11fb2c54bbbb1 100644
--- a/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx
+++ b/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx
@@ -1,9 +1,9 @@
 import { MockTasks, MockUserOwner, mockApiError } from "testHelpers/entities";
-import { withAuthProvider, withGlobalSnackbar } from "testHelpers/storybook";
+import { withAuthProvider } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { API } from "api/api";
 import { MockUsers } from "pages/UsersPage/storybookData/users";
-import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
+import { spyOn, userEvent, within } from "storybook/test";
 import { reactRouterParameters } from "storybook-addon-remix-react-router";
 import { TasksSidebar } from "./TasksSidebar";
 
@@ -93,7 +93,7 @@ export const OpenOptionsMenu: Story = {
 	},
 };
 
-export const DeleteTaskDialog: Story = {
+export const OpenDeleteDialog: Story = {
 	beforeEach: () => {
 		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
 	},
@@ -114,49 +114,3 @@ export const DeleteTaskDialog: Story = {
 		});
 	},
 };
-
-export const DeleteTaskSuccess: Story = {
-	decorators: [withGlobalSnackbar],
-	parameters: {
-		chromatic: {
-			disableSnapshot: false,
-		},
-	},
-	beforeEach: () => {
-		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
-		spyOn(API.experimental, "deleteTask").mockResolvedValue();
-	},
-	play: async ({ canvasElement, step }) => {
-		const body = within(canvasElement.ownerDocument.body);
-		const canvas = within(canvasElement);
-
-		await step("Open menu", async () => {
-			const optionButtons = await canvas.findAllByRole("button", {
-				name: /task options/i,
-			});
-			await userEvent.click(optionButtons[0]);
-		});
-
-		await step("Open delete dialog", async () => {
-			const deleteButton = await body.findByRole("menuitem", {
-				name: /delete/i,
-			});
-			await userEvent.click(deleteButton);
-		});
-
-		await step("Confirm delete", async () => {
-			const confirmButton = await body.findByRole("button", {
-				name: /delete/i,
-			});
-			await userEvent.click(confirmButton);
-			await step("Confirm delete", async () => {
-				await waitFor(() => {
-					expect(API.experimental.deleteTask).toHaveBeenCalledWith(
-						MockTasks[0].workspace.owner_name,
-						MockTasks[0].workspace.id,
-					);
-				});
-			});
-		});
-	},
-};
diff --git a/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx b/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx
index 0c440e6432aa5..b63366e1b98cc 100644
--- a/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx
+++ b/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx
@@ -1,8 +1,7 @@
 import { API } from "api/api";
-import { getErrorDetail, getErrorMessage } from "api/errors";
+import { getErrorMessage } from "api/errors";
 import { cva } from "class-variance-authority";
 import { Button } from "components/Button/Button";
-import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
 import {
 	DropdownMenu,
 	DropdownMenuContent,
@@ -10,7 +9,6 @@ import {
 	DropdownMenuItem,
 	DropdownMenuTrigger,
 } from "components/DropdownMenu/DropdownMenu";
-import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 import { CoderIcon } from "components/Icons/CoderIcon";
 import { ScrollArea } from "components/ScrollArea/ScrollArea";
 import { Skeleton } from "components/Skeleton/Skeleton";
@@ -25,9 +23,10 @@ import { useSearchParamsKey } from "hooks/useSearchParamsKey";
 import { EditIcon, EllipsisIcon, PanelLeftIcon, TrashIcon } from "lucide-react";
 import type { Task } from "modules/tasks/tasks";
 import { type FC, useState } from "react";
-import { QueryClient, useMutation, useQuery } from "react-query";
+import { useQuery } from "react-query";
 import { Link as RouterLink, useNavigate, useParams } from "react-router";
 import { cn } from "utils/cn";
+import { TaskDeleteDialog } from "../TaskDeleteDialog/TaskDeleteDialog";
 import { UserCombobox } from "./UserCombobox";
 
 export const TasksSidebar: FC = () => {
@@ -180,14 +179,6 @@ const TaskSidebarMenuItem: FC<TaskSidebarMenuItemProps> = ({ task }) => {
 	const isActive = task.workspace.name === workspace;
 	const [isDeleteDialogOpen, setIsDeleteDialogOpen] = useState(false);
 	const navigate = useNavigate();
-	const queryClient = new QueryClient();
-	const deleteTaskMutation = useMutation({
-		mutationFn: () =>
-			API.experimental.deleteTask(task.workspace.owner_name, task.workspace.id),
-		onSuccess: async () => {
-			await queryClient.invalidateQueries({ queryKey: ["tasks"] });
-		},
-	});
 
 	return (
 		<>
@@ -249,36 +240,17 @@ const TaskSidebarMenuItem: FC<TaskSidebarMenuItemProps> = ({ task }) => {
 				</RouterLink>
 			</Button>
 
-			<ConfirmDialog
-				type="delete"
-				confirmLoading={deleteTaskMutation.isPending}
+			<TaskDeleteDialog
 				open={isDeleteDialogOpen}
-				title="Delete task"
-				onClose={(): void => {
+				task={task}
+				onClose={() => {
 					setIsDeleteDialogOpen(false);
 				}}
-				onConfirm={async () => {
-					try {
-						await deleteTaskMutation.mutateAsync();
-						displaySuccess("Task deleted successfully");
-						if (isActive) {
-							navigate("/tasks");
-						}
-					} catch (error) {
-						displayError(
-							getErrorMessage(error, "Failed to delete task"),
-							getErrorDetail(error),
-						);
-					} finally {
-						setIsDeleteDialogOpen(false);
+				onSuccess={() => {
+					if (isActive) {
+						navigate("/tasks");
 					}
 				}}
-				description={
-					<p>
-						This action is irreversible and removes all workspace resources and
-						data.
-					</p>
-				}
 			/>
 		</>
 	);
diff --git a/site/src/pages/TasksPage/TasksPage.stories.tsx b/site/src/pages/TasksPage/TasksPage.stories.tsx
index b0510bb6f4cab..7f4818bf00f4f 100644
--- a/site/src/pages/TasksPage/TasksPage.stories.tsx
+++ b/site/src/pages/TasksPage/TasksPage.stories.tsx
@@ -424,3 +424,17 @@ export const NonAdmin: Story = {
 		});
 	},
 };
+
+export const OpenDeleteDialog: Story = {
+	beforeEach: () => {
+		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
+		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+		const deleteButtons = await canvas.findAllByRole("button", {
+			name: /delete task/i,
+		});
+		await userEvent.click(deleteButtons[0]);
+	},
+};
diff --git a/site/src/pages/TasksPage/TasksTable.tsx b/site/src/pages/TasksPage/TasksTable.tsx
index 883f3dd84cb5e..c1cddb75a8e8f 100644
--- a/site/src/pages/TasksPage/TasksTable.tsx
+++ b/site/src/pages/TasksPage/TasksTable.tsx
@@ -16,10 +16,17 @@ import {
 	TableLoaderSkeleton,
 	TableRowSkeleton,
 } from "components/TableLoader/TableLoader";
-import { RotateCcwIcon } from "lucide-react";
+import {
+	Tooltip,
+	TooltipContent,
+	TooltipProvider,
+	TooltipTrigger,
+} from "components/Tooltip/Tooltip";
+import { RotateCcwIcon, TrashIcon } from "lucide-react";
+import { TaskDeleteDialog } from "modules/tasks/TaskDeleteDialog/TaskDeleteDialog";
 import type { Task } from "modules/tasks/tasks";
 import { WorkspaceAppStatus } from "modules/workspaces/WorkspaceAppStatus/WorkspaceAppStatus";
-import type { FC, ReactNode } from "react";
+import { type FC, type ReactNode, useState } from "react";
 import { Link as RouterLink } from "react-router";
 import { relativeTime } from "utils/time";
 
@@ -39,7 +46,7 @@ export const TasksTable: FC<TasksTableProps> = ({ tasks, error, onRetry }) => {
 	} else if (tasks.length === 0) {
 		body = <TasksEmpty />;
 	} else {
-		body = <Tasks tasks={tasks} />;
+		body = tasks.map((task) => <TaskRow key={task.workspace.id} task={task} />);
 	}
 
 	return (
@@ -49,6 +56,7 @@ export const TasksTable: FC<TasksTableProps> = ({ tasks, error, onRetry }) => {
 					<TableHead>Task</TableHead>
 					<TableHead>Status</TableHead>
 					<TableHead>Created by</TableHead>
+					<TableHead />
 				</TableRow>
 			</TableHeader>
 			<TableBody>{body}</TableBody>
@@ -103,24 +111,25 @@ const TasksEmpty: FC = () => {
 	);
 };
 
-type TasksProps = { tasks: Task[] };
+type TaskRowProps = { task: Task };
 
-const Tasks: FC<TasksProps> = ({ tasks }) => {
-	return tasks.map(({ workspace, prompt }) => {
-		const templateDisplayName =
-			workspace.template_display_name ?? workspace.template_name;
+const TaskRow: FC<TaskRowProps> = ({ task }) => {
+	const [isDeleteDialogOpen, setIsDeleteDialogOpen] = useState(false);
+	const templateDisplayName =
+		task.workspace.template_display_name ?? task.workspace.template_name;
 
-		return (
-			<TableRow key={workspace.id} className="relative" hover>
+	return (
+		<>
+			<TableRow key={task.workspace.id} className="relative" hover>
 				<TableCell>
 					<AvatarData
 						title={
 							<>
 								<span className="block max-w-[520px] overflow-hidden text-ellipsis whitespace-nowrap">
-									{prompt}
+									{task.prompt}
 								</span>
 								<RouterLink
-									to={`/tasks/${workspace.owner_name}/${workspace.name}`}
+									to={`/tasks/${task.workspace.owner_name}/${task.workspace.name}`}
 									className="absolute inset-0"
 								>
 									<span className="sr-only">Access task</span>
@@ -132,7 +141,7 @@ const Tasks: FC<TasksProps> = ({ tasks }) => {
 							<Avatar
 								size="lg"
 								variant="icon"
-								src={workspace.template_icon}
+								src={task.workspace.template_icon}
 								fallback={templateDisplayName}
 							/>
 						}
@@ -140,24 +149,50 @@ const Tasks: FC<TasksProps> = ({ tasks }) => {
 				</TableCell>
 				<TableCell>
 					<WorkspaceAppStatus
-						disabled={workspace.latest_build.status !== "running"}
-						status={workspace.latest_app_status}
+						disabled={task.workspace.latest_build.status !== "running"}
+						status={task.workspace.latest_app_status}
 					/>
 				</TableCell>
 				<TableCell>
 					<AvatarData
-						title={workspace.owner_name}
+						title={task.workspace.owner_name}
 						subtitle={
 							<span className="block first-letter:uppercase">
-								{relativeTime(new Date(workspace.created_at))}
+								{relativeTime(new Date(task.workspace.created_at))}
 							</span>
 						}
-						src={workspace.owner_avatar_url}
+						src={task.workspace.owner_avatar_url}
 					/>
 				</TableCell>
+				<TableCell className="text-right">
+					<TooltipProvider>
+						<Tooltip>
+							<TooltipTrigger asChild>
+								<Button
+									size="icon"
+									variant="outline"
+									className="relative z-50"
+									onClick={() => setIsDeleteDialogOpen(true)}
+								>
+									<span className="sr-only">Delete task</span>
+									<TrashIcon />
+								</Button>
+							</TooltipTrigger>
+							<TooltipContent>Delete task</TooltipContent>
+						</Tooltip>
+					</TooltipProvider>
+				</TableCell>
 			</TableRow>
-		);
-	});
+
+			<TaskDeleteDialog
+				task={task}
+				open={isDeleteDialogOpen}
+				onClose={() => {
+					setIsDeleteDialogOpen(false);
+				}}
+			/>
+		</>
+	);
 };
 
 const TasksSkeleton: FC = () => {

From 718f712c1818dc86646665c7d4b0e1d446d94264 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 18:38:25 +0000
Subject: [PATCH 006/298] chore: bump the react group across 1 directory with 2
 updates (#20102)

Bumps the react group with 2 updates in the /site directory:
[@types/react](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react)
and
[@types/react-dom](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-dom).

Updates `@types/react` from 19.1.13 to 19.1.17
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/react-dom` from 19.1.9 to 19.1.11
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-dom">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |    4 +-
 site/pnpm-lock.yaml | 1072 ++++++++++++++++++++++---------------------
 2 files changed, 540 insertions(+), 536 deletions(-)

diff --git a/site/package.json b/site/package.json
index 11ed58a05838a..14e3365fc6d54 100644
--- a/site/package.json
+++ b/site/package.json
@@ -145,10 +145,10 @@
 		"@types/jest": "29.5.14",
 		"@types/lodash": "4.17.15",
 		"@types/node": "20.17.16",
-		"@types/react": "19.1.13",
+		"@types/react": "19.1.17",
 		"@types/react-color": "3.0.13",
 		"@types/react-date-range": "1.4.4",
-		"@types/react-dom": "19.1.9",
+		"@types/react-dom": "19.1.11",
 		"@types/react-syntax-highlighter": "15.5.13",
 		"@types/react-virtualized-auto-sizer": "1.0.4",
 		"@types/react-window": "1.8.8",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 676011c935c76..f36ffa639e6d9 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -33,10 +33,10 @@ importers:
         version: 11.13.5
       '@emotion/react':
         specifier: 11.14.0
-        version: 11.14.0(@types/react@19.1.13)(react@19.1.1)
+        version: 11.14.0(@types/react@19.1.17)(react@19.1.1)
       '@emotion/styled':
         specifier: 11.14.1
-        version: 11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
+        version: 11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
       '@fontsource-variable/inter':
         specifier: 5.1.1
         version: 5.1.1
@@ -57,64 +57,64 @@ importers:
         version: 4.7.0(monaco-editor@0.52.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@mui/icons-material':
         specifier: 5.18.0
-        version: 5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
+        version: 5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
       '@mui/material':
         specifier: 5.18.0
-        version: 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@mui/system':
         specifier: 5.18.0
-        version: 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
+        version: 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
       '@mui/utils':
         specifier: 5.17.1
-        version: 5.17.1(@types/react@19.1.13)(react@19.1.1)
+        version: 5.17.1(@types/react@19.1.17)(react@19.1.1)
       '@mui/x-tree-view':
         specifier: 7.29.10
-        version: 7.29.10(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@mui/system@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 7.29.10(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@mui/system@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-avatar':
         specifier: 1.1.2
-        version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-checkbox':
         specifier: 1.1.4
-        version: 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-collapsible':
         specifier: 1.1.2
-        version: 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-dialog':
         specifier: 1.1.4
-        version: 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-dropdown-menu':
         specifier: 2.1.4
-        version: 2.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-label':
         specifier: 2.1.0
-        version: 2.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.1.0(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-popover':
         specifier: 1.1.5
-        version: 1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.5(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-radio-group':
         specifier: 1.2.3
-        version: 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-scroll-area':
         specifier: 1.2.3
-        version: 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-select':
         specifier: 2.2.6
-        version: 2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 2.2.6(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-separator':
         specifier: 1.1.7
-        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slider':
         specifier: 1.2.2
-        version: 1.2.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.2.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-slot':
         specifier: 1.2.3
-        version: 1.2.3(@types/react@19.1.13)(react@19.1.1)
+        version: 1.2.3(@types/react@19.1.17)(react@19.1.1)
       '@radix-ui/react-switch':
         specifier: 1.1.1
-        version: 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@radix-ui/react-tooltip':
         specifier: 1.1.7
-        version: 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@tanstack/react-query-devtools':
         specifier: 5.77.0
         version: 5.77.0(@tanstack/react-query@5.77.0(react@19.1.1))(react@19.1.1)
@@ -153,7 +153,7 @@ importers:
         version: 2.1.1
       cmdk:
         specifier: 1.0.4
-        version: 1.0.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 1.0.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       color-convert:
         specifier: 2.0.1
         version: 2.0.1
@@ -213,7 +213,7 @@ importers:
         version: 19.1.1(react@19.1.1)
       react-markdown:
         specifier: 9.1.0
-        version: 9.1.0(@types/react@19.1.13)(react@19.1.1)
+        version: 9.1.0(@types/react@19.1.17)(react@19.1.1)
       react-query:
         specifier: npm:@tanstack/react-query@5.77.0
         version: '@tanstack/react-query@5.77.0(react@19.1.1)'
@@ -228,7 +228,7 @@ importers:
         version: 15.6.1(react@19.1.1)
       react-textarea-autosize:
         specifier: 8.5.9
-        version: 8.5.9(@types/react@19.1.13)(react@19.1.1)
+        version: 8.5.9(@types/react@19.1.17)(react@19.1.1)
       react-virtualized-auto-sizer:
         specifier: 1.0.24
         version: 1.0.24(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -292,7 +292,7 @@ importers:
         version: 1.55.1
       '@storybook/addon-docs':
         specifier: 9.1.2
-        version: 9.1.2(@types/react@19.1.13)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@storybook/addon-links':
         specifier: 9.1.2
         version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
@@ -316,7 +316,7 @@ importers:
         version: 6.6.3
       '@testing-library/react':
         specifier: 14.3.1
-        version: 14.3.1(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 14.3.1(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@testing-library/user-event':
         specifier: 14.6.1
         version: 14.6.1(@testing-library/dom@10.4.0)
@@ -345,17 +345,17 @@ importers:
         specifier: 20.17.16
         version: 20.17.16
       '@types/react':
-        specifier: 19.1.13
-        version: 19.1.13
+        specifier: 19.1.17
+        version: 19.1.17
       '@types/react-color':
         specifier: 3.0.13
-        version: 3.0.13(@types/react@19.1.13)
+        version: 3.0.13(@types/react@19.1.17)
       '@types/react-date-range':
         specifier: 1.4.4
         version: 1.4.4
       '@types/react-dom':
-        specifier: 19.1.9
-        version: 19.1.9(@types/react@19.1.13)
+        specifier: 19.1.11
+        version: 19.1.11(@types/react@19.1.17)
       '@types/react-syntax-highlighter':
         specifier: 15.5.13
         version: 15.5.13
@@ -2977,11 +2977,13 @@ packages:
   '@types/react-date-range@1.4.4':
     resolution: {integrity: sha512-9Y9NyNgaCsEVN/+O4HKuxzPbVjRVBGdOKRxMDcsTRWVG62lpYgnxefNckTXDWup8FvczoqPW0+ESZR6R1yymDg==, tarball: https://registry.npmjs.org/@types/react-date-range/-/react-date-range-1.4.4.tgz}
 
-  '@types/react-dom@18.3.1':
-    resolution: {integrity: sha512-qW1Mfv8taImTthu4KoXgDfLuk4bydU6Q/TkADnDWWHwi4NX4BR+LWfTp2sVmTqRrsHvyDDTelgelxJ+SsejKKQ==, tarball: https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.1.tgz}
+  '@types/react-dom@18.3.7':
+    resolution: {integrity: sha512-MEe3UeoENYVFXzoXEWsvcpg6ZvlrFNlOQ7EOsvhI3CfAXwzPfO8Qwuxd40nepsYKqyyVQnTdEfv68q91yLcKrQ==, tarball: https://registry.npmjs.org/@types/react-dom/-/react-dom-18.3.7.tgz}
+    peerDependencies:
+      '@types/react': ^18.0.0
 
-  '@types/react-dom@19.1.9':
-    resolution: {integrity: sha512-qXRuZaOsAdXKFyOhRBg6Lqqc0yay13vN7KrIg4L7N4aaHN68ma9OK3NE1BoDFgFOTfM7zg+3/8+2n8rLUH3OKQ==, tarball: https://registry.npmjs.org/@types/react-dom/-/react-dom-19.1.9.tgz}
+  '@types/react-dom@19.1.11':
+    resolution: {integrity: sha512-3BKc/yGdNTYQVVw4idqHtSOcFsgGuBbMveKCOgF8wQ5QtrYOc3jDIlzg3jef04zcXFIHLelyGlj0T+BJ8+KN+w==, tarball: https://registry.npmjs.org/@types/react-dom/-/react-dom-19.1.11.tgz}
     peerDependencies:
       '@types/react': ^19.0.0
 
@@ -2999,8 +3001,8 @@ packages:
   '@types/react-window@1.8.8':
     resolution: {integrity: sha512-8Ls660bHR1AUA2kuRvVG9D/4XpRC6wjAaPT9dil7Ckc76eP9TKWZwwmgfq8Q1LANX3QNDnoU4Zp48A3w+zK69Q==, tarball: https://registry.npmjs.org/@types/react-window/-/react-window-1.8.8.tgz}
 
-  '@types/react@19.1.13':
-    resolution: {integrity: sha512-hHkbU/eoO3EG5/MZkuFSKmYqPbSVk5byPFa3e7y/8TybHiLMACgI8seVYlicwk7H5K/rI2px9xrQp/C+AUDTiQ==, tarball: https://registry.npmjs.org/@types/react/-/react-19.1.13.tgz}
+  '@types/react@19.1.17':
+    resolution: {integrity: sha512-Qec1E3mhALmaspIrhWt9jkQMNdw6bReVu64mjvhbhq2NFPftLPVr+l1SZgmw/66WwBNpDh7ao5AT6gF5v41PFA==, tarball: https://registry.npmjs.org/@types/react/-/react-19.1.17.tgz}
 
   '@types/reactcss@1.2.13':
     resolution: {integrity: sha512-gi3S+aUi6kpkF5vdhUsnkwbiSEIU/BEJyD7kBy2SudWBUuKmJk8AQKE0OVcQQeEy40Azh0lV6uynxlikYIJuwg==, tarball: https://registry.npmjs.org/@types/reactcss/-/reactcss-1.2.13.tgz}
@@ -7081,7 +7083,7 @@ snapshots:
 
   '@emotion/memoize@0.9.0': {}
 
-  '@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1)':
+  '@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
       '@emotion/babel-plugin': 11.13.5
@@ -7093,7 +7095,7 @@ snapshots:
       hoist-non-react-statics: 3.3.2
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
     transitivePeerDependencies:
       - supports-color
 
@@ -7107,18 +7109,18 @@ snapshots:
 
   '@emotion/sheet@1.4.0': {}
 
-  '@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)':
+  '@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
       '@emotion/babel-plugin': 11.13.5
       '@emotion/is-prop-valid': 1.4.0
-      '@emotion/react': 11.14.0(@types/react@19.1.13)(react@19.1.1)
+      '@emotion/react': 11.14.0(@types/react@19.1.17)(react@19.1.1)
       '@emotion/serialize': 1.3.3
       '@emotion/use-insertion-effect-with-fallbacks': 1.2.0(react@19.1.1)
       '@emotion/utils': 1.4.2
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
     transitivePeerDependencies:
       - supports-color
 
@@ -7668,10 +7670,10 @@ snapshots:
 
   '@leeoniya/ufuzzy@1.0.10': {}
 
-  '@mdx-js/react@3.0.1(@types/react@19.1.13)(react@19.1.1)':
+  '@mdx-js/react@3.0.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@types/mdx': 2.0.9
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
       react: 19.1.1
 
   '@mjackson/form-data-parser@0.4.0':
@@ -7706,23 +7708,23 @@ snapshots:
 
   '@mui/core-downloads-tracker@5.18.0': {}
 
-  '@mui/icons-material@5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)':
+  '@mui/icons-material@5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
-      '@mui/material': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@mui/material': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
       '@mui/core-downloads-tracker': 5.18.0
-      '@mui/system': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
-      '@mui/types': 7.2.24(@types/react@19.1.13)
-      '@mui/utils': 5.17.1(@types/react@19.1.13)(react@19.1.1)
+      '@mui/system': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
+      '@mui/types': 7.2.24(@types/react@19.1.17)
+      '@mui/utils': 5.17.1(@types/react@19.1.17)(react@19.1.1)
       '@popperjs/core': 2.11.8
-      '@types/react-transition-group': 4.4.12(@types/react@19.1.13)
+      '@types/react-transition-group': 4.4.12(@types/react@19.1.17)
       clsx: 2.1.1
       csstype: 3.1.3
       prop-types: 15.8.1
@@ -7731,20 +7733,20 @@ snapshots:
       react-is: 19.1.1
       react-transition-group: 4.4.5(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
     optionalDependencies:
-      '@emotion/react': 11.14.0(@types/react@19.1.13)(react@19.1.1)
-      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
-      '@types/react': 19.1.13
+      '@emotion/react': 11.14.0(@types/react@19.1.17)(react@19.1.1)
+      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
+      '@types/react': 19.1.17
 
-  '@mui/private-theming@5.17.1(@types/react@19.1.13)(react@19.1.1)':
+  '@mui/private-theming@5.17.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
-      '@mui/utils': 5.17.1(@types/react@19.1.13)(react@19.1.1)
+      '@mui/utils': 5.17.1(@types/react@19.1.17)(react@19.1.1)
       prop-types: 15.8.1
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@mui/styled-engine@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(react@19.1.1)':
+  '@mui/styled-engine@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
       '@emotion/cache': 11.14.0
@@ -7753,65 +7755,65 @@ snapshots:
       prop-types: 15.8.1
       react: 19.1.1
     optionalDependencies:
-      '@emotion/react': 11.14.0(@types/react@19.1.13)(react@19.1.1)
-      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
+      '@emotion/react': 11.14.0(@types/react@19.1.17)(react@19.1.1)
+      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
 
-  '@mui/system@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)':
+  '@mui/system@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
-      '@mui/private-theming': 5.17.1(@types/react@19.1.13)(react@19.1.1)
-      '@mui/styled-engine': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(react@19.1.1)
-      '@mui/types': 7.2.24(@types/react@19.1.13)
-      '@mui/utils': 5.17.1(@types/react@19.1.13)(react@19.1.1)
+      '@mui/private-theming': 5.17.1(@types/react@19.1.17)(react@19.1.1)
+      '@mui/styled-engine': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(react@19.1.1)
+      '@mui/types': 7.2.24(@types/react@19.1.17)
+      '@mui/utils': 5.17.1(@types/react@19.1.17)(react@19.1.1)
       clsx: 2.1.1
       csstype: 3.1.3
       prop-types: 15.8.1
       react: 19.1.1
     optionalDependencies:
-      '@emotion/react': 11.14.0(@types/react@19.1.13)(react@19.1.1)
-      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
-      '@types/react': 19.1.13
+      '@emotion/react': 11.14.0(@types/react@19.1.17)(react@19.1.1)
+      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
+      '@types/react': 19.1.17
 
-  '@mui/types@7.2.24(@types/react@19.1.13)':
+  '@mui/types@7.2.24(@types/react@19.1.17)':
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@mui/utils@5.17.1(@types/react@19.1.13)(react@19.1.1)':
+  '@mui/utils@5.17.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
-      '@mui/types': 7.2.24(@types/react@19.1.13)
+      '@mui/types': 7.2.24(@types/react@19.1.17)
       '@types/prop-types': 15.7.15
       clsx: 2.1.1
       prop-types: 15.8.1
       react: 19.1.1
       react-is: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@mui/x-internals@7.29.0(@types/react@19.1.13)(react@19.1.1)':
+  '@mui/x-internals@7.29.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
-      '@mui/utils': 5.17.1(@types/react@19.1.13)(react@19.1.1)
+      '@mui/utils': 5.17.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     transitivePeerDependencies:
       - '@types/react'
 
-  '@mui/x-tree-view@7.29.10(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@mui/system@5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@mui/x-tree-view@7.29.10(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@mui/system@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
-      '@mui/material': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@mui/system': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
-      '@mui/utils': 5.17.1(@types/react@19.1.13)(react@19.1.1)
-      '@mui/x-internals': 7.29.0(@types/react@19.1.13)(react@19.1.1)
-      '@types/react-transition-group': 4.4.12(@types/react@19.1.13)
+      '@mui/material': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@mui/system': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
+      '@mui/utils': 5.17.1(@types/react@19.1.17)(react@19.1.1)
+      '@mui/x-internals': 7.29.0(@types/react@19.1.17)(react@19.1.1)
+      '@types/react-transition-group': 4.4.12(@types/react@19.1.17)
       clsx: 2.1.1
       prop-types: 15.8.1
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       react-transition-group: 4.4.5(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
     optionalDependencies:
-      '@emotion/react': 11.14.0(@types/react@19.1.13)(react@19.1.1)
-      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.13)(react@19.1.1))(@types/react@19.1.13)(react@19.1.1)
+      '@emotion/react': 11.14.0(@types/react@19.1.17)(react@19.1.1)
+      '@emotion/styled': 11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
     transitivePeerDependencies:
       - '@types/react'
 
@@ -7952,736 +7954,736 @@ snapshots:
 
   '@radix-ui/primitive@1.1.3': {}
 
-  '@radix-ui/react-arrow@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-arrow@1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-avatar@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-avatar@1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-checkbox@1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-checkbox@1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-collapsible@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collapsible@1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-collection@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-collection@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.2(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-collection@1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-compose-refs@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-compose-refs@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-compose-refs@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-compose-refs@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-compose-refs@1.1.2(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-context@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-context@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-context@1.1.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-context@1.1.2(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-dialog@1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dialog@1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-direction@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-direction@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-direction@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-direction@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.11(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-escape-keydown': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-dismissable-layer@1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-dismissable-layer@1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dismissable-layer@1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-escape-keydown': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-dropdown-menu@2.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-dropdown-menu@2.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-menu': 2.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-menu': 2.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-focus-guards@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-focus-guards@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-focus-guards@1.1.3(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-focus-scope@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-focus-scope@1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-id@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-id@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-id@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-id@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-label@2.1.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-label@2.1.0(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-menu@2.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-menu@2.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-collection': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-popover@1.1.5(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popover@1.1.5(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       aria-hidden: 1.2.4
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.6.3(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.6.3(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-popper@1.2.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popper@1.2.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@floating-ui/react-dom': 2.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-rect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-arrow': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-rect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       '@radix-ui/rect': 1.1.0
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-popper@1.2.8(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@floating-ui/react-dom': 2.1.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-arrow': 1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-rect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       '@radix-ui/rect': 1.1.1
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-portal@1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-portal@1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-portal@1.1.9(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-presence@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-presence@1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.0.0(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-slot': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-primitive@2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-primitive@2.0.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.0.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-slot': 1.1.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.2(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-primitive@2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-radio-group@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-radio-group@1.2.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-roving-focus': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-roving-focus': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-roving-focus@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-roving-focus@1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-collection': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-roving-focus@1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-roving-focus@1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-collection': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-scroll-area@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-scroll-area@1.2.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/number': 1.1.0
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-select@2.2.6(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-select@2.2.6(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/number': 1.1.1
       '@radix-ui/primitive': 1.1.3
-      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.11(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-focus-guards': 1.1.3(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-focus-scope': 1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.8(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.9(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.2.3(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.2.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-visually-hidden': 1.2.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       aria-hidden: 1.2.6
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      react-remove-scroll: 2.7.1(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll: 2.7.1(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-separator@1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-slider@1.2.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-slider@1.2.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/number': 1.1.0
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-collection': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-collection': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-direction': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-slot@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-slot@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-slot@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-slot@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-slot@1.1.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-slot@1.1.2(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-slot@1.2.3(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-slot@1.2.3(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.2(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-switch@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-switch@1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.0
-      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.0(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-previous': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-size': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-tooltip@1.1.7(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-tooltip@1.1.7(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@radix-ui/primitive': 1.1.1
-      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-context': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-dismissable-layer': 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-popper': 1.2.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-visually-hidden': 1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-compose-refs': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-context': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-dismissable-layer': 1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-popper': 1.2.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-portal': 1.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-presence': 1.1.2(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-slot': 1.1.1(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-controllable-state': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-visually-hidden': 1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-use-callback-ref@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-callback-ref@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-callback-ref@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-controllable-state@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-controllable-state@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-controllable-state@1.2.2(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-effect-event': 0.0.2(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-effect-event@0.0.2(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-escape-keydown@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-escape-keydown@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-escape-keydown@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-callback-ref': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-layout-effect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-layout-effect@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-layout-effect@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-previous@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-previous@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-previous@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-rect@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-rect@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@radix-ui/rect': 1.1.0
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-rect@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-rect@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
       '@radix-ui/rect': 1.1.1
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-size@1.1.0(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-size@1.1.0(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.0(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-use-size@1.1.1(@types/react@19.1.13)(react@19.1.1)':
+  '@radix-ui/react-use-size@1.1.1(@types/react@19.1.17)(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.13)(react@19.1.1)
+      '@radix-ui/react-use-layout-effect': 1.1.1(@types/react@19.1.17)(react@19.1.1)
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@radix-ui/react-visually-hidden@1.1.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-visually-hidden@1.1.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
-  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@radix-ui/react-visually-hidden@1.2.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-primitive': 2.1.3(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
-      '@types/react-dom': 19.1.9(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/react-dom': 19.1.11(@types/react@19.1.17)
 
   '@radix-ui/rect@1.1.0': {}
 
@@ -8773,9 +8775,9 @@ snapshots:
     dependencies:
       '@sinonjs/commons': 3.0.0
 
-  '@storybook/addon-docs@9.1.2(@types/react@19.1.13)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-docs@9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
     dependencies:
-      '@mdx-js/react': 3.0.1(@types/react@19.1.13)(react@19.1.1)
+      '@mdx-js/react': 3.0.1(@types/react@19.1.17)(react@19.1.1)
       '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
       '@storybook/icons': 1.4.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
@@ -8960,13 +8962,15 @@ snapshots:
       lodash: 4.17.21
       redent: 3.0.0
 
-  '@testing-library/react@14.3.1(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@testing-library/react@14.3.1(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
       '@testing-library/dom': 9.3.3
-      '@types/react-dom': 18.3.1
+      '@types/react-dom': 18.3.7(@types/react@19.1.17)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
+    transitivePeerDependencies:
+      - '@types/react'
 
   '@testing-library/user-event@14.6.1(@testing-library/dom@10.4.0)':
     dependencies:
@@ -9113,7 +9117,7 @@ snapshots:
 
   '@types/hoist-non-react-statics@3.3.5':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
       hoist-non-react-statics: 3.3.2
 
   '@types/http-errors@2.0.1': {}
@@ -9193,47 +9197,47 @@ snapshots:
 
   '@types/range-parser@1.2.4': {}
 
-  '@types/react-color@3.0.13(@types/react@19.1.13)':
+  '@types/react-color@3.0.13(@types/react@19.1.17)':
     dependencies:
-      '@types/react': 19.1.13
-      '@types/reactcss': 1.2.13(@types/react@19.1.13)
+      '@types/react': 19.1.17
+      '@types/reactcss': 1.2.13(@types/react@19.1.17)
 
   '@types/react-date-range@1.4.4':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
       date-fns: 2.30.0
 
-  '@types/react-dom@18.3.1':
+  '@types/react-dom@18.3.7(@types/react@19.1.17)':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@types/react-dom@19.1.9(@types/react@19.1.13)':
+  '@types/react-dom@19.1.11(@types/react@19.1.17)':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   '@types/react-syntax-highlighter@15.5.13':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@types/react-transition-group@4.4.12(@types/react@19.1.13)':
+  '@types/react-transition-group@4.4.12(@types/react@19.1.17)':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   '@types/react-virtualized-auto-sizer@1.0.4':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   '@types/react-window@1.8.8':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  '@types/react@19.1.13':
+  '@types/react@19.1.17':
     dependencies:
       csstype: 3.1.3
 
-  '@types/reactcss@1.2.13(@types/react@19.1.13)':
+  '@types/reactcss@1.2.13(@types/react@19.1.17)':
     dependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   '@types/resolve@1.20.4': {}
 
@@ -9767,11 +9771,11 @@ snapshots:
 
   clsx@2.1.1: {}
 
-  cmdk@1.0.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  cmdk@1.0.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
-      '@radix-ui/react-dialog': 1.1.4(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@radix-ui/react-id': 1.1.0(@types/react@19.1.13)(react@19.1.1)
-      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.9(@types/react@19.1.13))(@types/react@19.1.13)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-dialog': 1.1.4(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+      '@radix-ui/react-id': 1.1.0(@types/react@19.1.17)(react@19.1.1)
+      '@radix-ui/react-primitive': 2.0.1(@types/react-dom@19.1.11(@types/react@19.1.17))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
       use-sync-external-store: 1.4.0(react@19.1.1)
@@ -12533,11 +12537,11 @@ snapshots:
       prop-types: 15.8.1
       react: 19.1.1
 
-  react-markdown@9.1.0(@types/react@19.1.13)(react@19.1.1):
+  react-markdown@9.1.0(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       '@types/hast': 3.0.4
       '@types/mdast': 4.0.4
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
       devlop: 1.1.0
       hast-util-to-jsx-runtime: 2.3.6
       html-url-attributes: 3.0.1
@@ -12553,35 +12557,35 @@ snapshots:
 
   react-refresh@0.17.0: {}
 
-  react-remove-scroll-bar@2.3.8(@types/react@19.1.13)(react@19.1.1):
+  react-remove-scroll-bar@2.3.8(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
-      react-style-singleton: 2.2.3(@types/react@19.1.13)(react@19.1.1)
+      react-style-singleton: 2.2.3(@types/react@19.1.17)(react@19.1.1)
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  react-remove-scroll@2.6.3(@types/react@19.1.13)(react@19.1.1):
+  react-remove-scroll@2.6.3(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
-      react-remove-scroll-bar: 2.3.8(@types/react@19.1.13)(react@19.1.1)
-      react-style-singleton: 2.2.3(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll-bar: 2.3.8(@types/react@19.1.17)(react@19.1.1)
+      react-style-singleton: 2.2.3(@types/react@19.1.17)(react@19.1.1)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.1.13)(react@19.1.1)
-      use-sidecar: 1.1.3(@types/react@19.1.13)(react@19.1.1)
+      use-callback-ref: 1.3.3(@types/react@19.1.17)(react@19.1.1)
+      use-sidecar: 1.1.3(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  react-remove-scroll@2.7.1(@types/react@19.1.13)(react@19.1.1):
+  react-remove-scroll@2.7.1(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
-      react-remove-scroll-bar: 2.3.8(@types/react@19.1.13)(react@19.1.1)
-      react-style-singleton: 2.2.3(@types/react@19.1.13)(react@19.1.1)
+      react-remove-scroll-bar: 2.3.8(@types/react@19.1.17)(react@19.1.1)
+      react-style-singleton: 2.2.3(@types/react@19.1.17)(react@19.1.1)
       tslib: 2.8.1
-      use-callback-ref: 1.3.3(@types/react@19.1.13)(react@19.1.1)
-      use-sidecar: 1.1.3(@types/react@19.1.13)(react@19.1.1)
+      use-callback-ref: 1.3.3(@types/react@19.1.17)(react@19.1.1)
+      use-sidecar: 1.1.3(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   react-resizable-panels@3.0.3(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
@@ -12604,13 +12608,13 @@ snapshots:
       react-dom: 19.1.1(react@19.1.1)
       react-transition-group: 4.4.5(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
 
-  react-style-singleton@2.2.3(@types/react@19.1.13)(react@19.1.1):
+  react-style-singleton@2.2.3(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       get-nonce: 1.0.1
       react: 19.1.1
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   react-syntax-highlighter@15.6.1(react@19.1.1):
     dependencies:
@@ -12622,12 +12626,12 @@ snapshots:
       react: 19.1.1
       refractor: 3.6.0
 
-  react-textarea-autosize@8.5.9(@types/react@19.1.13)(react@19.1.1):
+  react-textarea-autosize@8.5.9(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       '@babel/runtime': 7.26.10
       react: 19.1.1
-      use-composed-ref: 1.4.0(@types/react@19.1.13)(react@19.1.1)
-      use-latest: 1.3.0(@types/react@19.1.13)(react@19.1.1)
+      use-composed-ref: 1.4.0(@types/react@19.1.17)(react@19.1.1)
+      use-latest: 1.3.0(@types/react@19.1.17)(react@19.1.1)
     transitivePeerDependencies:
       - '@types/react'
 
@@ -13388,39 +13392,39 @@ snapshots:
       querystringify: 2.2.0
       requires-port: 1.0.0
 
-  use-callback-ref@1.3.3(@types/react@19.1.13)(react@19.1.1):
+  use-callback-ref@1.3.3(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  use-composed-ref@1.4.0(@types/react@19.1.13)(react@19.1.1):
+  use-composed-ref@1.4.0(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  use-isomorphic-layout-effect@1.2.1(@types/react@19.1.13)(react@19.1.1):
+  use-isomorphic-layout-effect@1.2.1(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  use-latest@1.3.0(@types/react@19.1.13)(react@19.1.1):
+  use-latest@1.3.0(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       react: 19.1.1
-      use-isomorphic-layout-effect: 1.2.1(@types/react@19.1.13)(react@19.1.1)
+      use-isomorphic-layout-effect: 1.2.1(@types/react@19.1.17)(react@19.1.1)
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
-  use-sidecar@1.1.3(@types/react@19.1.13)(react@19.1.1):
+  use-sidecar@1.1.3(@types/react@19.1.17)(react@19.1.1):
     dependencies:
       detect-node-es: 1.1.0
       react: 19.1.1
       tslib: 2.8.1
     optionalDependencies:
-      '@types/react': 19.1.13
+      '@types/react': 19.1.17
 
   use-sync-external-store@1.4.0(react@19.1.1):
     dependencies:

From 6b61c8a32a8778bf2e5a65161ee2362d8aae0183 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 1 Oct 2025 15:49:52 -0300
Subject: [PATCH 007/298] feat: add workspace status on tasks (#20037)

<img width="1206" height="722" alt="Screenshot 2025-09-30 at 11 29 31"
src="https://github.com/user-attachments/assets/f109552d-af5e-41e1-a0e8-fdfcb3f973b7"
/>


Closes https://github.com/coder/coder/issues/19988
---
 .../WorkspaceStatus.stories.tsx               | 22 +++++++++++++
 .../WorkspaceStatus/WorkspaceStatus.tsx       | 27 +++++++++++++++
 site/src/pages/TasksPage/TasksTable.tsx       | 10 +++++-
 .../pages/WorkspacesPage/WorkspacesTable.tsx  | 33 +++----------------
 4 files changed, 63 insertions(+), 29 deletions(-)
 create mode 100644 site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.stories.tsx
 create mode 100644 site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.tsx

diff --git a/site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.stories.tsx b/site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.stories.tsx
new file mode 100644
index 0000000000000..60313bf116efd
--- /dev/null
+++ b/site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.stories.tsx
@@ -0,0 +1,22 @@
+import { MockDormantWorkspace, MockWorkspace } from "testHelpers/entities";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { WorkspaceStatus } from "./WorkspaceStatus";
+
+const meta: Meta<typeof WorkspaceStatus> = {
+	title: "modules/workspaces/WorkspaceStatus",
+	component: WorkspaceStatus,
+	args: {
+		workspace: MockWorkspace,
+	},
+};
+
+export default meta;
+type Story = StoryObj<typeof WorkspaceStatus>;
+
+export const Running: Story = {};
+
+export const Dormant: Story = {
+	args: {
+		workspace: MockDormantWorkspace,
+	},
+};
diff --git a/site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.tsx b/site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.tsx
new file mode 100644
index 0000000000000..7888b1c77ef3e
--- /dev/null
+++ b/site/src/modules/workspaces/WorkspaceStatus/WorkspaceStatus.tsx
@@ -0,0 +1,27 @@
+import type { Workspace } from "api/typesGenerated";
+import type { FC } from "react";
+import { lastUsedMessage } from "utils/workspace";
+import { WorkspaceDormantBadge } from "../WorkspaceDormantBadge/WorkspaceDormantBadge";
+import { WorkspaceStatusIndicator } from "../WorkspaceStatusIndicator/WorkspaceStatusIndicator";
+
+type WorkspaceStatusProps = {
+	workspace: Workspace;
+};
+
+export const WorkspaceStatus: FC<WorkspaceStatusProps> = ({ workspace }) => {
+	return (
+		<div className="flex flex-col">
+			<WorkspaceStatusIndicator workspace={workspace}>
+				{workspace.dormant_at && (
+					<WorkspaceDormantBadge workspace={workspace} />
+				)}
+			</WorkspaceStatusIndicator>
+			<time
+				dateTime={workspace.last_used_at}
+				className="text-xs font-medium text-content-secondary ml-6 whitespace-nowrap"
+			>
+				{lastUsedMessage(workspace.last_used_at)}
+			</time>
+		</div>
+	);
+};
diff --git a/site/src/pages/TasksPage/TasksTable.tsx b/site/src/pages/TasksPage/TasksTable.tsx
index c1cddb75a8e8f..c9ff75bb36ddc 100644
--- a/site/src/pages/TasksPage/TasksTable.tsx
+++ b/site/src/pages/TasksPage/TasksTable.tsx
@@ -26,6 +26,7 @@ import { RotateCcwIcon, TrashIcon } from "lucide-react";
 import { TaskDeleteDialog } from "modules/tasks/TaskDeleteDialog/TaskDeleteDialog";
 import type { Task } from "modules/tasks/tasks";
 import { WorkspaceAppStatus } from "modules/workspaces/WorkspaceAppStatus/WorkspaceAppStatus";
+import { WorkspaceStatus } from "modules/workspaces/WorkspaceStatus/WorkspaceStatus";
 import { type FC, type ReactNode, useState } from "react";
 import { Link as RouterLink } from "react-router";
 import { relativeTime } from "utils/time";
@@ -54,7 +55,8 @@ export const TasksTable: FC<TasksTableProps> = ({ tasks, error, onRetry }) => {
 			<TableHeader>
 				<TableRow>
 					<TableHead>Task</TableHead>
-					<TableHead>Status</TableHead>
+					<TableHead>Agent status</TableHead>
+					<TableHead>Workspace status</TableHead>
 					<TableHead>Created by</TableHead>
 					<TableHead />
 				</TableRow>
@@ -153,6 +155,9 @@ const TaskRow: FC<TaskRowProps> = ({ task }) => {
 						status={task.workspace.latest_app_status}
 					/>
 				</TableCell>
+				<TableCell>
+					<WorkspaceStatus workspace={task.workspace} />
+				</TableCell>
 				<TableCell>
 					<AvatarData
 						title={task.workspace.owner_name}
@@ -205,6 +210,9 @@ const TasksSkeleton: FC = () => {
 				<TableCell>
 					<Skeleton className="w-[100px] h-6" />
 				</TableCell>
+				<TableCell>
+					<Skeleton className="w-[100px] h-6" />
+				</TableCell>
 				<TableCell>
 					<AvatarDataSkeleton />
 				</TableCell>
diff --git a/site/src/pages/WorkspacesPage/WorkspacesTable.tsx b/site/src/pages/WorkspacesPage/WorkspacesTable.tsx
index a6ba1e4a43dad..7ab941821d7b1 100644
--- a/site/src/pages/WorkspacesPage/WorkspacesTable.tsx
+++ b/site/src/pages/WorkspacesPage/WorkspacesTable.tsx
@@ -65,10 +65,9 @@ import { useAppLink } from "modules/apps/useAppLink";
 import { useDashboard } from "modules/dashboard/useDashboard";
 import { abilitiesByWorkspaceStatus } from "modules/workspaces/actions";
 import { WorkspaceBuildCancelDialog } from "modules/workspaces/WorkspaceBuildCancelDialog/WorkspaceBuildCancelDialog";
-import { WorkspaceDormantBadge } from "modules/workspaces/WorkspaceDormantBadge/WorkspaceDormantBadge";
 import { WorkspaceMoreActions } from "modules/workspaces/WorkspaceMoreActions/WorkspaceMoreActions";
 import { WorkspaceOutdatedTooltip } from "modules/workspaces/WorkspaceOutdatedTooltip/WorkspaceOutdatedTooltip";
-import { WorkspaceStatusIndicator } from "modules/workspaces/WorkspaceStatusIndicator/WorkspaceStatusIndicator";
+import { WorkspaceStatus } from "modules/workspaces/WorkspaceStatus/WorkspaceStatus";
 import {
 	useWorkspaceUpdate,
 	WorkspaceUpdateDialogs,
@@ -83,10 +82,7 @@ import {
 import { useMutation, useQuery, useQueryClient } from "react-query";
 import { useNavigate } from "react-router";
 import { cn } from "utils/cn";
-import {
-	getDisplayWorkspaceTemplateName,
-	lastUsedMessage,
-} from "utils/workspace";
+import { getDisplayWorkspaceTemplateName } from "utils/workspace";
 import { WorkspacesEmpty } from "./WorkspacesEmpty";
 
 interface WorkspacesTableProps {
@@ -256,7 +252,9 @@ export const WorkspacesTable: FC<WorkspacesTableProps> = ({
 								/>
 							</TableCell>
 
-							<WorkspaceStatusCell workspace={workspace} />
+							<TableCell>
+								<WorkspaceStatus workspace={workspace} />
+							</TableCell>
 
 							<WorkspaceActionsCell
 								workspace={workspace}
@@ -354,27 +352,6 @@ const cantBeChecked = (workspace: Workspace) => {
 	return ["deleting", "pending"].includes(workspace.latest_build.status);
 };
 
-type WorkspaceStatusCellProps = {
-	workspace: Workspace;
-};
-
-const WorkspaceStatusCell: FC<WorkspaceStatusCellProps> = ({ workspace }) => {
-	return (
-		<TableCell>
-			<div className="flex flex-col">
-				<WorkspaceStatusIndicator workspace={workspace}>
-					{workspace.dormant_at && (
-						<WorkspaceDormantBadge workspace={workspace} />
-					)}
-				</WorkspaceStatusIndicator>
-				<span className="text-xs font-medium text-content-secondary ml-6 whitespace-nowrap">
-					{lastUsedMessage(workspace.last_used_at)}
-				</span>
-			</div>
-		</TableCell>
-	);
-};
-
 type WorkspaceActionsCellProps = {
 	workspace: Workspace;
 	onActionSuccess: () => Promise<void>;

From b3f1492f146c4f487034fba088b37ff848b76fda Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 1 Oct 2025 19:53:58 +0100
Subject: [PATCH 008/298] ci(.github/workflows/traiage.yaml): set default
 inputs on trigger by label assignment (#20100)

When not triggering via `workflow_dispatch`, it looks like the default
values are simply empty.
This PR creates an intermediate step to conditionally set defaults based
on `github.event_name`.

I'm also adding a commented-out step for installing `gh` that's required
for local testing via `nektos/act`. It's not required in a 'real'
runner.
---
 .github/workflows/traiage.yaml | 93 +++++++++++++++++++++-------------
 1 file changed, 58 insertions(+), 35 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 24192fc2d1812..09881ff2ee46a 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -40,25 +40,57 @@ jobs:
     env:
       CODER_URL: ${{ secrets.TRAIAGE_CODER_URL }}
       CODER_SESSION_TOKEN: ${{ secrets.TRAIAGE_CODER_SESSION_TOKEN }}
-      TEMPLATE_NAME: ${{ inputs.template_name }}
     permissions:
       contents: read
       issues: write
       actions: write
 
     steps:
-      - name: Get GitHub user ID
-        id: github-user-id
+      # This is only required for testing locally using nektos/act, so leaving commented out.
+      # An alternative is to use a larger or custom image.
+      # - name: Install Github CLI
+      #   id: install-gh
+      #   run: |
+      #     (type -p wget >/dev/null || (sudo apt update && sudo apt install wget -y)) \
+      #     && sudo mkdir -p -m 755 /etc/apt/keyrings \
+      #     && out=$(mktemp) && wget -nv -O$out https://cli.github.com/packages/githubcli-archive-keyring.gpg \
+      #     && cat $out | sudo tee /etc/apt/keyrings/githubcli-archive-keyring.gpg > /dev/null \
+      #     && sudo chmod go+r /etc/apt/keyrings/githubcli-archive-keyring.gpg \
+      #     && sudo mkdir -p -m 755 /etc/apt/sources.list.d \
+      #     && echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null \
+      #     && sudo apt update \
+      #     && sudo apt install gh -y
+
+      - name: Determine Inputs
+        id: determine-inputs
         if: always()
         env:
           GITHUB_ACTOR: ${{ github.actor }}
+          GITHUB_EVENT_ISSUE_HTML_URL: ${{ github.event.issue.html_url }}
           GITHUB_EVENT_NAME: ${{ github.event_name }}
           GITHUB_EVENT_USER_ID: ${{ github.event.sender.id }}
           GITHUB_EVENT_USER_LOGIN: ${{ github.event.sender.login }}
+          INPUTS_CLEANUP: ${{ inputs.cleanup || false }}
+          INPUTS_ISSUE_URL: ${{ inputs.issue_url }}
+          INPUTS_TEMPLATE_NAME: ${{ inputs.template_name || 'traiage' }}
+          INPUTS_TEMPLATE_PRESET: ${{ inputs.template_preset || 'Default'}}
+          INPUTS_PREFIX: ${{ inputs.prefix || 'traiage' }}
           GH_TOKEN: ${{ github.token }}
         run: |
+          echo "Using template name: ${INPUTS_TEMPLATE_NAME}"
+          echo "template_name=${INPUTS_TEMPLATE_NAME}" >> "${GITHUB_OUTPUT}"
+
+          echo "Using template preset: ${INPUTS_TEMPLATE_PRESET}"
+          echo "template_preset=${INPUTS_TEMPLATE_PRESET}" >> "${GITHUB_OUTPUT}"
+
+          echo "Using prefix: ${INPUTS_PREFIX}"
+          echo "prefix=${INPUTS_PREFIX}" >> "${GITHUB_OUTPUT}"
+
+          echo "Using cleanup: ${INPUTS_CLEANUP}"
+          echo "cleanup=${INPUTS_CLEANUP}" >> "${GITHUB_OUTPUT}"
+
           # For workflow_dispatch, use the actor who triggered it
-          # For issues events, use the issue author
+          # For issues events, use the issue author.
           if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
             if ! GITHUB_USER_ID=$(gh api "users/${GITHUB_ACTOR}" --jq '.id'); then
               echo "::error::Failed to get GitHub user ID for actor ${GITHUB_ACTOR}"
@@ -67,12 +99,20 @@ jobs:
             echo "Using workflow_dispatch actor: ${GITHUB_ACTOR} (ID: ${GITHUB_USER_ID})"
             echo "github_user_id=${GITHUB_USER_ID}" >> "${GITHUB_OUTPUT}"
             echo "github_username=${GITHUB_ACTOR}" >> "${GITHUB_OUTPUT}"
+
+            echo "Using issue URL: ${INPUTS_ISSUE_URL}"
+            echo "issue_url=${INPUTS_ISSUE_URL}" >> "${GITHUB_OUTPUT}"
+
             exit 0
           elif [[ "${GITHUB_EVENT_NAME}" == "issues" ]]; then
             GITHUB_USER_ID=${GITHUB_EVENT_USER_ID}
             echo "Using issue author: ${GITHUB_EVENT_USER_LOGIN} (ID: ${GITHUB_USER_ID})"
             echo "github_user_id=${GITHUB_USER_ID}" >> "${GITHUB_OUTPUT}"
             echo "github_username=${GITHUB_EVENT_USER_LOGIN}" >> "${GITHUB_OUTPUT}"
+
+            echo "Using issue URL: ${GITHUB_EVENT_ISSUE_HTML_URL}"
+            echo "issue_url=${GITHUB_EVENT_ISSUE_HTML_URL}" >> "${GITHUB_OUTPUT}"
+
             exit 0
           else
             echo "::error::Unsupported event type: ${GITHUB_EVENT_NAME}"
@@ -83,8 +123,8 @@ jobs:
         env:
           GITHUB_ORG: ${{ github.repository_owner }}
           GH_TOKEN: ${{ github.token }}
-          GITHUB_USERNAME: ${{ steps.github-user-id.outputs.github_username }}
-          GITHUB_USER_ID: ${{ steps.github-user-id.outputs.github_user_id }}
+          GITHUB_USERNAME: ${{ steps.determine-inputs.outputs.github_username }}
+          GITHUB_USER_ID: ${{ steps.determine-inputs.outputs.github_user_id }}
         run: |
           # Check if the actor is a member of the organization
           if ! gh api "orgs/${GITHUB_ORG}/members/${GITHUB_USERNAME}" --silent 2>/dev/null; then
@@ -94,28 +134,10 @@ jobs:
           fi
           echo "::notice::User ${GITHUB_USERNAME} verified as member of ${GITHUB_ORG} organization"
 
-      - name: Determine issue URL
-        id: determine-issue-url
-        env:
-          INPUTS_ISSUE_URL: ${{ inputs.issue_url }}
-          GITHUB_EVENT_ISSUE_HTML_URL: ${{ github.event.issue.html_url }}
-          GITHUB_EVENT_NAME: ${{ github.event_name }}
-        run: |
-          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
-            echo "issue_url=${INPUTS_ISSUE_URL}" >> "${GITHUB_OUTPUT}"
-            exit 0
-          elif [[ "${GITHUB_EVENT_NAME}" == "issues" ]]; then
-            echo "issue_url=${GITHUB_EVENT_ISSUE_HTML_URL}" >> "${GITHUB_OUTPUT}"
-            exit 0
-          else
-            echo "::error::Unsupported event type: ${GITHUB_EVENT_NAME}"
-            exit 1
-          fi
-
       - name: Extract context key from issue
         id: extract-context
         env:
-          ISSUE_URL: ${{ steps.determine-issue-url.outputs.issue_url }}
+          ISSUE_URL: ${{ steps.determine-inputs.outputs.issue_url }}
           GH_TOKEN: ${{ github.token }}
         run: |
           issue_number="$(gh issue view "${ISSUE_URL}" --json number --jq '.number')"
@@ -146,7 +168,7 @@ jobs:
         env:
           CODER_SESSION_TOKEN: ${{ secrets.TRAIAGE_CODER_SESSION_TOKEN }}
           GH_TOKEN: ${{ github.token }}
-          GITHUB_USER_ID: ${{ steps.github-user-id.outputs.github_user_id }}
+          GITHUB_USER_ID: ${{ steps.determine-inputs.outputs.github_user_id }}
         run: |
           user_json=$(
             coder users list --github-user-id="${GITHUB_USER_ID}" --output=json
@@ -169,11 +191,12 @@ jobs:
           CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
           GH_TOKEN: ${{ github.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-          ISSUE_URL: ${{ steps.determine-issue-url.outputs.issue_url }}
-          PREFIX: ${{ inputs.prefix }}
+          ISSUE_URL: ${{ steps.determine-inputs.outputs.issue_url }}
+          PREFIX: ${{ steps.determine-inputs.outputs.prefix }}
           RUN_ID: ${{ github.run_id }}
+          TEMPLATE_NAME: ${{ steps.determine-inputs.outputs.template_name }}
           TEMPLATE_PARAMETERS: ${{ secrets.TRAIAGE_TEMPLATE_PARAMETERS }}
-          TEMPLATE_PRESET: ${{ inputs.template_preset }}
+          TEMPLATE_PRESET: ${{ steps.determine-inputs.outputs.template_preset }}
         run: |
           # Fetch issue description using `gh` CLI
           issue_description=$(gh issue view "${ISSUE_URL}")
@@ -203,21 +226,21 @@ jobs:
 
       - name: Create and upload archive
         id: create-archive
-        if: inputs.cleanup
+        if: steps.determine-inputs.outputs.cleanup == 'true'
         env:
           BUCKET_PREFIX: "gs://coder-traiage-outputs/traiage"
           CODER_USERNAME: ${{ steps.get-coder-username.outputs.coder_username }}
           TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}
         run: |
           echo "Waiting for task to complete..."
-          coder exp task status "${CODER_USERNAME}/$TASK_NAME" --watch
-          echo "Creating archive for workspace: $TASK_NAME"
+          coder exp task status "${TASK_NAME}" --watch
+          echo "Creating archive for workspace: ${TASK_NAME}"
           ./scripts/traiage.sh archive
           echo "archive_url=${BUCKET_PREFIX%%/}/$TASK_NAME.tar.gz" >> "${GITHUB_OUTPUT}"
 
       - name: Generate a summary of the changes and post a comment on GitHub.
         id: generate-summary
-        if: inputs.cleanup
+        if: steps.determine-inputs.outputs.cleanup == 'true'
         env:
           ARCHIVE_URL: ${{ steps.create-archive.outputs.archive_url }}
           BUCKET_PREFIX: "gs://coder-traiage-outputs/traiage"
@@ -225,7 +248,7 @@ jobs:
           CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
           GH_TOKEN: ${{ github.token }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-          ISSUE_URL: ${{ steps.determine-issue-url.outputs.issue_url }}
+          ISSUE_URL: ${{ steps.determine-inputs.outputs.issue_url }}
           TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}
         run: |
           SUMMARY_FILE=$(mktemp)
@@ -256,7 +279,7 @@ jobs:
           cat "${SUMMARY_FILE}" >> "${GITHUB_STEP_SUMMARY}"
 
       - name: Cleanup task
-        if: inputs.cleanup && steps.create-task.outputs.TASK_NAME != '' && steps.create-archive.outputs.archive_url != ''
+        if: steps.determine-inputs.outputs.cleanup == 'true' && steps.create-task.outputs.TASK_NAME != '' && steps.create-archive.outputs.archive_url != ''
         run: |
           echo "Cleaning up task: $TASK_NAME"
           ./scripts/traiage.sh delete || true

From 3afab824f5ce227543788ad65474fb39c63b740a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Wed, 1 Oct 2025 13:26:49 -0600
Subject: [PATCH 009/298] fix: revert playwright update and update dependabot
 config (#20103)

---
 .github/dependabot.yaml |  4 ++++
 site/package.json       |  2 +-
 site/pnpm-lock.yaml     | 26 +++++++++++++-------------
 3 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/.github/dependabot.yaml b/.github/dependabot.yaml
index 67d1f1342dcaf..fbf713d16b5bd 100644
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -80,6 +80,9 @@ updates:
       mui:
         patterns:
           - "@mui*"
+      radix:
+        patterns:
+          - "@radix-ui/*"
       react:
         patterns:
           - "react"
@@ -104,6 +107,7 @@ updates:
       - dependency-name: "*"
         update-types:
           - version-update:semver-major
+      - dependency-name: "@playwright/test"
     open-pull-requests-limit: 15
 
   - package-ecosystem: "terraform"
diff --git a/site/package.json b/site/package.json
index 14e3365fc6d54..d18b8f1d5a0d4 100644
--- a/site/package.json
+++ b/site/package.json
@@ -126,7 +126,7 @@
 		"@biomejs/biome": "2.2.0",
 		"@chromatic-com/storybook": "4.1.0",
 		"@octokit/types": "12.3.0",
-		"@playwright/test": "1.55.1",
+		"@playwright/test": "1.50.1",
 		"@storybook/addon-docs": "9.1.2",
 		"@storybook/addon-links": "9.1.2",
 		"@storybook/addon-themes": "9.1.2",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index f36ffa639e6d9..e49af3a101ba3 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -288,8 +288,8 @@ importers:
         specifier: 12.3.0
         version: 12.3.0
       '@playwright/test':
-        specifier: 1.55.1
-        version: 1.55.1
+        specifier: 1.50.1
+        version: 1.50.1
       '@storybook/addon-docs':
         specifier: 9.1.2
         version: 9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
@@ -1625,8 +1625,8 @@ packages:
     resolution: {integrity: sha512-+1VkjdD0QBLPodGrJUeqarH8VAIvQODIbwh9XpP5Syisf7YoQgsJKPNFoqqLQlu+VQ/tVSshMR6loPMn8U+dPg==, tarball: https://registry.npmjs.org/@pkgjs/parseargs/-/parseargs-0.11.0.tgz}
     engines: {node: '>=14'}
 
-  '@playwright/test@1.55.1':
-    resolution: {integrity: sha512-IVAh/nOJaw6W9g+RJVlIQJ6gSiER+ae6mKQ5CX1bERzQgbC1VSeBlwdvczT7pxb0GWiyrxH4TGKbMfDb4Sq/ig==, tarball: https://registry.npmjs.org/@playwright/test/-/test-1.55.1.tgz}
+  '@playwright/test@1.50.1':
+    resolution: {integrity: sha512-Jii3aBg+CEDpgnuDxEp/h7BimHcUTDlpEtce89xEumlJ5ef2hqepZ+PWp1DDpYC/VO9fmWVI1IlEaoI5fK9FXQ==, tarball: https://registry.npmjs.org/@playwright/test/-/test-1.50.1.tgz}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -5459,13 +5459,13 @@ packages:
     resolution: {integrity: sha512-HRDzbaKjC+AOWVXxAU/x54COGeIv9eb+6CkDSQoNTt4XyWoIJvuPsXizxu/Fr23EiekbtZwmh1IcIG/l/a10GQ==, tarball: https://registry.npmjs.org/pkg-dir/-/pkg-dir-4.2.0.tgz}
     engines: {node: '>=8'}
 
-  playwright-core@1.55.1:
-    resolution: {integrity: sha512-Z6Mh9mkwX+zxSlHqdr5AOcJnfp+xUWLCt9uKV18fhzA8eyxUd8NUWzAjxUh55RZKSYwDGX0cfaySdhZJGMoJ+w==, tarball: https://registry.npmjs.org/playwright-core/-/playwright-core-1.55.1.tgz}
+  playwright-core@1.50.1:
+    resolution: {integrity: sha512-ra9fsNWayuYumt+NiM069M6OkcRb1FZSK8bgi66AtpFoWkg2+y0bJSNmkFrWhMbEBbVKC/EruAHH3g0zmtwGmQ==, tarball: https://registry.npmjs.org/playwright-core/-/playwright-core-1.50.1.tgz}
     engines: {node: '>=18'}
     hasBin: true
 
-  playwright@1.55.1:
-    resolution: {integrity: sha512-cJW4Xd/G3v5ovXtJJ52MAOclqeac9S/aGGgRzLabuF8TnIb6xHvMzKIa6JmrRzUkeXJgfL1MhukP0NK6l39h3A==, tarball: https://registry.npmjs.org/playwright/-/playwright-1.55.1.tgz}
+  playwright@1.50.1:
+    resolution: {integrity: sha512-G8rwsOQJ63XG6BbKj2w5rHeavFjy5zynBA9zsJMMtBoe/Uf757oG12NXz6e6OirF7RCrTVAKFXbLmn1RbL7Qaw==, tarball: https://registry.npmjs.org/playwright/-/playwright-1.50.1.tgz}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -7915,9 +7915,9 @@ snapshots:
   '@pkgjs/parseargs@0.11.0':
     optional: true
 
-  '@playwright/test@1.55.1':
+  '@playwright/test@1.50.1':
     dependencies:
-      playwright: 1.55.1
+      playwright: 1.50.1
 
   '@popperjs/core@2.11.8': {}
 
@@ -12322,11 +12322,11 @@ snapshots:
     dependencies:
       find-up: 4.1.0
 
-  playwright-core@1.55.1: {}
+  playwright-core@1.50.1: {}
 
-  playwright@1.55.1:
+  playwright@1.50.1:
     dependencies:
-      playwright-core: 1.55.1
+      playwright-core: 1.50.1
     optionalDependencies:
       fsevents: 2.3.2
 

From 7c3e24f3be4519f6a33fa10ac61ee7576722e693 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:33:42 +0000
Subject: [PATCH 010/298] chore: bump ubuntu from `0e5e4a5` to `4e0171b` in
 /dogfood/coder (#20105)

Bumps ubuntu from `0e5e4a5` to `4e0171b`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ubuntu&package-manager=docker&previous-version=jammy&new-version=jammy)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/Dockerfile | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dogfood/coder/Dockerfile b/dogfood/coder/Dockerfile
index 90bdcb71aaacb..f64c47819d799 100644
--- a/dogfood/coder/Dockerfile
+++ b/dogfood/coder/Dockerfile
@@ -8,7 +8,7 @@ RUN sed -i 's|http://deb.debian.org/debian|http://mirrors.edge.kernel.org/debian
 RUN apt-get update && apt-get install -y libssl-dev openssl pkg-config build-essential
 RUN cargo install jj-cli typos-cli watchexec-cli
 
-FROM ubuntu:jammy@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97 AS go
+FROM ubuntu:jammy@sha256:4e0171b9275e12d375863f2b3ae9ce00a4c53ddda176bd55868df97ac6f21a6e AS go
 
 # Install Go manually, so that we can control the version
 ARG GO_VERSION=1.24.6
@@ -97,7 +97,7 @@ RUN curl -L -o protoc.zip https://github.com/protocolbuffers/protobuf/releases/d
 	unzip protoc.zip && \
 	rm protoc.zip
 
-FROM ubuntu:jammy@sha256:0e5e4a57c2499249aafc3b40fcd541e9a456aab7296681a3994d631587203f97
+FROM ubuntu:jammy@sha256:4e0171b9275e12d375863f2b3ae9ce00a4c53ddda176bd55868df97ac6f21a6e
 
 SHELL ["/bin/bash", "-c"]
 

From b05033897aa32ee2620adc7b940a28f56d5724e6 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:33:54 +0000
Subject: [PATCH 011/298] chore: bump rust from `3f391b0` to `1219c0b` in
 /dogfood/coder (#20108)

Bumps rust from `3f391b0` to `1219c0b`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rust&package-manager=docker&previous-version=slim&new-version=slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/Dockerfile b/dogfood/coder/Dockerfile
index f64c47819d799..7f1eda55a6c58 100644
--- a/dogfood/coder/Dockerfile
+++ b/dogfood/coder/Dockerfile
@@ -1,5 +1,5 @@
 # 1.86.0
-FROM rust:slim@sha256:3f391b0678a6e0c88fd26f13e399c9c515ac47354e3cadfee7daee3b21651a4f AS rust-utils
+FROM rust:slim@sha256:1219c0b5980e8310eb8e08a7fec9e2159ffc9f166cc9999ddb13604c43cd0eb6 AS rust-utils
 # Install rust helper programs
 ENV CARGO_INSTALL_ROOT=/tmp/
 # Use more reliable mirrors for Debian packages

From 3eb6e1cc9771e7fea2313b2d4c78cd4730148d0b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:34:11 +0000
Subject: [PATCH 012/298] chore: bump coder/claude-code/coder from 3.0.0 to
 3.0.1 in /dogfood/coder (#20104)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/claude-code/coder&package-manager=terraform&previous-version=3.0.0&new-version=3.0.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 6762f2bcbee27..614b25cdb9ec8 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -866,7 +866,7 @@ locals {
 module "claude-code" {
   count               = local.has_ai_prompt ? data.coder_workspace.me.start_count : 0
   source              = "dev.registry.coder.com/coder/claude-code/coder"
-  version             = "3.0.0"
+  version             = "3.0.1"
   agent_id            = coder_agent.dev.id
   workdir             = local.repo_dir
   claude_code_version = "latest"

From c6c9fa1e3972b8ea19fa73c9179137ff47b3cafd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:34:28 +0000
Subject: [PATCH 013/298] chore: bump alpine from 3.21.3 to 3.22.1 in /scripts
 (#20107)

Bumps alpine from 3.21.3 to 3.22.1.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=alpine&package-manager=docker&previous-version=3.21.3&new-version=3.22.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 scripts/Dockerfile.base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Dockerfile.base b/scripts/Dockerfile.base
index 53c999301e410..e13b5ffa666e0 100644
--- a/scripts/Dockerfile.base
+++ b/scripts/Dockerfile.base
@@ -1,7 +1,7 @@
 # This is the base image used for Coder images. It's a multi-arch image that is
 # built in depot.dev for all supported architectures. Since it's built on real
 # hardware and not cross-compiled, it can have "RUN" commands.
-FROM alpine:3.21.3@sha256:a8560b36e8b8210634f77d9f7f9efd7ffa463e380b75e2e74aff4511df3ef88c
+FROM alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
 
 # We use a single RUN command to reduce the number of layers in the image.
 # NOTE: Keep the Terraform version in sync with minTerraformVersion and

From 7328fa5c0866ca46587b5e39a50ea9a241330a03 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:37:23 +0000
Subject: [PATCH 014/298] chore: bump typescript from 5.7.3 to 5.9.3 in
 /offlinedocs (#20112)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [typescript](https://github.com/microsoft/TypeScript) from 5.7.3
to 5.9.3.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/TypeScript/releases">typescript's
releases</a>.</em></p>
<blockquote>
<h2>TypeScript 5.9.3</h2>
<p>Note: this tag was recreated to point at the correct commit. The npm
package contained the correct content.</p>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-9/">release
announcement</a></p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.0%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.1%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.1 (RC)</a>.</li>
<li><em>No specific changes for TypeScript 5.9.2 (Stable)</em></li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.3%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.3 (Stable)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript">npm</a></li>
</ul>
<h2>TypeScript 5.9</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-9/">release
announcement</a></p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.0%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.1%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.1 (RC)</a>.</li>
<li><em>No specific changes for TypeScript 5.9.2 (Stable)</em></li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript">npm</a></li>
</ul>
<h2>TypeScript 5.9 RC</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-9-rc/">release
announcement</a></p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.0%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.1%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.1 (RC)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript">npm</a></li>
</ul>
<h2>TypeScript 5.9 Beta</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-9-beta/">release
announcement</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.9.0%22+is%3Aclosed+">fixed
issues query for Typescript 5.9.0 (Beta)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<ul>
<li><a href="https://www.npmjs.com/package/typescript">npm</a></li>
</ul>
<h2>TypeScript 5.8.3</h2>
<p>For release notes, check out the <a
href="https://devblogs.microsoft.com/typescript/announcing-typescript-5-8/">release
announcement</a>.</p>
<ul>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.8.0%22+is%3Aclosed+">fixed
issues query for Typescript 5.8.0 (Beta)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.8.1%22+is%3Aclosed+">fixed
issues query for Typescript 5.8.1 (RC)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.8.2%22+is%3Aclosed+">fixed
issues query for Typescript 5.8.2 (Stable)</a>.</li>
<li><a
href="https://github.com/Microsoft/TypeScript/issues?utf8=%E2%9C%93&amp;q=milestone%3A%22TypeScript+5.8.3%22+is%3Aclosed+">fixed
issues query for Typescript 5.8.3 (Stable)</a>.</li>
</ul>
<p>Downloads are available on:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/TypeScript/commit/c63de15a992d37f0d6cec03ac7631872838602cb"><code>c63de15</code></a>
Bump version to 5.9.3 and LKG</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/8428ca4cc8a7ecc9ac18dd0258016228814f5eaf"><code>8428ca4</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/62438">#62438</a>
(Fix incorrectly ignored dts file fr...) into release-5.9 (#...</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/a131cac6831aa6532ea963d0cb3131b957cad980"><code>a131cac</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/62351">#62351</a>
(Add missing Float16Array constructo...) into release-5.9 (#...</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/04243333584a5bfaeb3434c0982c6280fe87b8d5"><code>0424333</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/62423">#62423</a>
(Revert PR 61928) into release-5.9 (<a
href="https://redirect.github.com/microsoft/TypeScript/issues/62425">#62425</a>)</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/bdb641a4347af822916fb8cdb9894c9c2d2421dd"><code>bdb641a</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/62311">#62311</a>
(Fix parenthesizer rules for manuall...) into release-5.9 (#...</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/0d9b9b92e2aca2f75c979a801abbc21bff473748"><code>0d9b9b9</code></a>
🤖 Pick PR <a
href="https://redirect.github.com/microsoft/TypeScript/issues/61978">#61978</a>
(Restructure CI to prepare for requi...) into release-5.9 (#...</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/2dce0c58af51cf9a9068365dc2f756c61b82b597"><code>2dce0c5</code></a>
Intentionally regress one buggy declaration output to an older version
(<a
href="https://redirect.github.com/microsoft/TypeScript/issues/62163">#62163</a>)</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/5be33469d551655d878876faa9e30aa3b49f8ee9"><code>5be3346</code></a>
Bump version to 5.9.2 and LKG</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/ad825f2bee3362886d642c48cb97c82df82b3ddb"><code>ad825f2</code></a>
Bump version to 5.9.1-rc and LKG</li>
<li><a
href="https://github.com/microsoft/TypeScript/commit/463a5bf92c3597dc14f252517c10a1bef7ac2f4c"><code>463a5bf</code></a>
Update LKG</li>
<li>Additional commits viewable in <a
href="https://github.com/microsoft/TypeScript/compare/v5.7.3...v5.9.3">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=typescript&package-manager=npm_and_yarn&previous-version=5.7.3&new-version=5.9.3)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 offlinedocs/package.json   |  2 +-
 offlinedocs/pnpm-lock.yaml | 92 +++++++++++++++++++-------------------
 2 files changed, 47 insertions(+), 47 deletions(-)

diff --git a/offlinedocs/package.json b/offlinedocs/package.json
index 15c5ce793b135..26073286ddb65 100644
--- a/offlinedocs/package.json
+++ b/offlinedocs/package.json
@@ -38,7 +38,7 @@
 		"eslint": "8.57.1",
 		"eslint-config-next": "14.2.33",
 		"prettier": "3.6.2",
-		"typescript": "5.7.3"
+		"typescript": "5.9.3"
 	},
 	"engines": {
 		"npm": ">=9.0.0 <10.0.0",
diff --git a/offlinedocs/pnpm-lock.yaml b/offlinedocs/pnpm-lock.yaml
index 368b8515c6b54..7c4466814364c 100644
--- a/offlinedocs/pnpm-lock.yaml
+++ b/offlinedocs/pnpm-lock.yaml
@@ -78,13 +78,13 @@ importers:
         version: 8.57.1
       eslint-config-next:
         specifier: 14.2.33
-        version: 14.2.33(eslint@8.57.1)(typescript@5.7.3)
+        version: 14.2.33(eslint@8.57.1)(typescript@5.9.3)
       prettier:
         specifier: 3.6.2
         version: 3.6.2
       typescript:
-        specifier: 5.7.3
-        version: 5.7.3
+        specifier: 5.9.3
+        version: 5.9.3
 
 packages:
 
@@ -2465,8 +2465,8 @@ packages:
     resolution: {integrity: sha512-3KS2b+kL7fsuk/eJZ7EQdnEmQoaho/r6KUef7hxvltNA5DR8NAUM+8wJMbJyZ4G9/7i3v5zPBIMN5aybAh2/Jg==}
     engines: {node: '>= 0.4'}
 
-  typescript@5.7.3:
-    resolution: {integrity: sha512-84MVSjMEHP+FQRPy3pX9sTVV/INIex71s9TL2Gm5FG/WG1SqXeKyZ0k7/blY/4FdOzI12CBy1vGc4og/eus0fw==}
+  typescript@5.9.3:
+    resolution: {integrity: sha512-jl1vZzPDinLr9eUt3J/t7V6FgNEw9QjvBPdysz9KfQDD41fQrC2Y4vKQdiaUpFT4bXlb1RHhLpp8wtm6M5TgSw==}
     engines: {node: '>=14.17'}
     hasBin: true
 
@@ -3101,41 +3101,41 @@ snapshots:
 
   '@types/unist@3.0.3': {}
 
-  '@typescript-eslint/eslint-plugin@8.45.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint@8.57.1)(typescript@5.7.3)':
+  '@typescript-eslint/eslint-plugin@8.45.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1)(typescript@5.9.3)':
     dependencies:
       '@eslint-community/regexpp': 4.12.1
-      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
+      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
       '@typescript-eslint/scope-manager': 8.45.0
-      '@typescript-eslint/type-utils': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
-      '@typescript-eslint/utils': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
+      '@typescript-eslint/type-utils': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
       '@typescript-eslint/visitor-keys': 8.45.0
       eslint: 8.57.1
       graphemer: 1.4.0
       ignore: 7.0.5
       natural-compare: 1.4.0
-      ts-api-utils: 2.1.0(typescript@5.7.3)
-      typescript: 5.7.3
+      ts-api-utils: 2.1.0(typescript@5.9.3)
+      typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3)':
+  '@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3)':
     dependencies:
       '@typescript-eslint/scope-manager': 8.45.0
       '@typescript-eslint/types': 8.45.0
-      '@typescript-eslint/typescript-estree': 8.45.0(typescript@5.7.3)
+      '@typescript-eslint/typescript-estree': 8.45.0(typescript@5.9.3)
       '@typescript-eslint/visitor-keys': 8.45.0
       debug: 4.4.3
       eslint: 8.57.1
-      typescript: 5.7.3
+      typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/project-service@8.45.0(typescript@5.7.3)':
+  '@typescript-eslint/project-service@8.45.0(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/tsconfig-utils': 8.45.0(typescript@5.7.3)
+      '@typescript-eslint/tsconfig-utils': 8.45.0(typescript@5.9.3)
       '@typescript-eslint/types': 8.45.0
       debug: 4.4.3
-      typescript: 5.7.3
+      typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
@@ -3144,28 +3144,28 @@ snapshots:
       '@typescript-eslint/types': 8.45.0
       '@typescript-eslint/visitor-keys': 8.45.0
 
-  '@typescript-eslint/tsconfig-utils@8.45.0(typescript@5.7.3)':
+  '@typescript-eslint/tsconfig-utils@8.45.0(typescript@5.9.3)':
     dependencies:
-      typescript: 5.7.3
+      typescript: 5.9.3
 
-  '@typescript-eslint/type-utils@8.45.0(eslint@8.57.1)(typescript@5.7.3)':
+  '@typescript-eslint/type-utils@8.45.0(eslint@8.57.1)(typescript@5.9.3)':
     dependencies:
       '@typescript-eslint/types': 8.45.0
-      '@typescript-eslint/typescript-estree': 8.45.0(typescript@5.7.3)
-      '@typescript-eslint/utils': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
+      '@typescript-eslint/typescript-estree': 8.45.0(typescript@5.9.3)
+      '@typescript-eslint/utils': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
       debug: 4.4.3
       eslint: 8.57.1
-      ts-api-utils: 2.1.0(typescript@5.7.3)
-      typescript: 5.7.3
+      ts-api-utils: 2.1.0(typescript@5.9.3)
+      typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
   '@typescript-eslint/types@8.45.0': {}
 
-  '@typescript-eslint/typescript-estree@8.45.0(typescript@5.7.3)':
+  '@typescript-eslint/typescript-estree@8.45.0(typescript@5.9.3)':
     dependencies:
-      '@typescript-eslint/project-service': 8.45.0(typescript@5.7.3)
-      '@typescript-eslint/tsconfig-utils': 8.45.0(typescript@5.7.3)
+      '@typescript-eslint/project-service': 8.45.0(typescript@5.9.3)
+      '@typescript-eslint/tsconfig-utils': 8.45.0(typescript@5.9.3)
       '@typescript-eslint/types': 8.45.0
       '@typescript-eslint/visitor-keys': 8.45.0
       debug: 4.4.3
@@ -3173,19 +3173,19 @@ snapshots:
       is-glob: 4.0.3
       minimatch: 9.0.5
       semver: 7.7.2
-      ts-api-utils: 2.1.0(typescript@5.7.3)
-      typescript: 5.7.3
+      ts-api-utils: 2.1.0(typescript@5.9.3)
+      typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
-  '@typescript-eslint/utils@8.45.0(eslint@8.57.1)(typescript@5.7.3)':
+  '@typescript-eslint/utils@8.45.0(eslint@8.57.1)(typescript@5.9.3)':
     dependencies:
       '@eslint-community/eslint-utils': 4.9.0(eslint@8.57.1)
       '@typescript-eslint/scope-manager': 8.45.0
       '@typescript-eslint/types': 8.45.0
-      '@typescript-eslint/typescript-estree': 8.45.0(typescript@5.7.3)
+      '@typescript-eslint/typescript-estree': 8.45.0(typescript@5.9.3)
       eslint: 8.57.1
-      typescript: 5.7.3
+      typescript: 5.9.3
     transitivePeerDependencies:
       - supports-color
 
@@ -3732,21 +3732,21 @@ snapshots:
 
   escape-string-regexp@5.0.0: {}
 
-  eslint-config-next@14.2.33(eslint@8.57.1)(typescript@5.7.3):
+  eslint-config-next@14.2.33(eslint@8.57.1)(typescript@5.9.3):
     dependencies:
       '@next/eslint-plugin-next': 14.2.33
       '@rushstack/eslint-patch': 1.12.0
-      '@typescript-eslint/eslint-plugin': 8.45.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint@8.57.1)(typescript@5.7.3)
-      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
+      '@typescript-eslint/eslint-plugin': 8.45.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint@8.57.1)(typescript@5.9.3)
+      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.9
       eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
       eslint-plugin-jsx-a11y: 6.10.2(eslint@8.57.1)
       eslint-plugin-react: 7.37.5(eslint@8.57.1)
       eslint-plugin-react-hooks: 5.0.0-canary-7118f5dd7-20230705(eslint@8.57.1)
     optionalDependencies:
-      typescript: 5.7.3
+      typescript: 5.9.3
     transitivePeerDependencies:
       - eslint-import-resolver-webpack
       - eslint-plugin-import-x
@@ -3771,22 +3771,22 @@ snapshots:
       tinyglobby: 0.2.15
       unrs-resolver: 1.11.1
     optionalDependencies:
-      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-plugin-import: 2.32.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
+  eslint-module-utils@2.12.1(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
     dependencies:
       debug: 3.2.7
     optionalDependencies:
-      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
+      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.9
       eslint-import-resolver-typescript: 3.10.1(eslint-plugin-import@2.32.0)(eslint@8.57.1)
     transitivePeerDependencies:
       - supports-color
 
-  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
+  eslint-plugin-import@2.32.0(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1):
     dependencies:
       '@rtsao/scc': 1.1.0
       array-includes: 3.1.9
@@ -3797,7 +3797,7 @@ snapshots:
       doctrine: 2.1.0
       eslint: 8.57.1
       eslint-import-resolver-node: 0.3.9
-      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.7.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
+      eslint-module-utils: 2.12.1(@typescript-eslint/parser@8.45.0(eslint@8.57.1)(typescript@5.9.3))(eslint-import-resolver-node@0.3.9)(eslint-import-resolver-typescript@3.10.1)(eslint@8.57.1)
       hasown: 2.0.2
       is-core-module: 2.16.1
       is-glob: 4.0.3
@@ -3809,7 +3809,7 @@ snapshots:
       string.prototype.trimend: 1.0.9
       tsconfig-paths: 3.15.0
     optionalDependencies:
-      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.7.3)
+      '@typescript-eslint/parser': 8.45.0(eslint@8.57.1)(typescript@5.9.3)
     transitivePeerDependencies:
       - eslint-import-resolver-typescript
       - eslint-import-resolver-webpack
@@ -5506,9 +5506,9 @@ snapshots:
 
   trough@2.2.0: {}
 
-  ts-api-utils@2.1.0(typescript@5.7.3):
+  ts-api-utils@2.1.0(typescript@5.9.3):
     dependencies:
-      typescript: 5.7.3
+      typescript: 5.9.3
 
   tsconfig-paths@3.15.0:
     dependencies:
@@ -5562,7 +5562,7 @@ snapshots:
       possible-typed-array-names: 1.1.0
       reflect.getprototypeof: 1.0.10
 
-  typescript@5.7.3: {}
+  typescript@5.9.3: {}
 
   unbox-primitive@1.1.0:
     dependencies:

From f7388f3dfc5d346831dde385a14b3e0351dbf11e Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:41:20 +0000
Subject: [PATCH 015/298] chore: bump github.com/anthropics/anthropic-sdk-go
 from 1.12.0 to 1.13.0 (#20109)

Bumps
[github.com/anthropics/anthropic-sdk-go](https://github.com/anthropics/anthropic-sdk-go)
from 1.12.0 to 1.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/releases">github.com/anthropics/anthropic-sdk-go's
releases</a>.</em></p>
<blockquote>
<h2>v1.13.0</h2>
<h2>1.13.0 (2025-09-29)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.12.0...v1.13.0">v1.12.0...v1.13.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> adds support for Claude Sonnet 4.5 and context
management features (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/3d5d51ad6ee64b34c7cc361a9dfd6f45966987dd">3d5d51a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>bugfix for setting JSON keys with special characters (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/c868b921190f8d371cc93d12e019daf5a7463306">c868b92</a>)</li>
<li><strong>internal:</strong> unmarshal correctly when there are
multiple discriminators (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/ecc3ce31a9ed98b8f2b66b5e1489fce510528f77">ecc3ce3</a>)</li>
<li>use slices.Concat instead of sometimes modifying r.Options (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/88e7186cad944290498a3381c829df36d26a1cce">88e7186</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>bump minimum go version to 1.22 (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/87af8f397ae68ce72a76a07a735d21495aad8799">87af8f3</a>)</li>
<li>do not install brew dependencies in ./scripts/bootstrap by default
(<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/c689348cc4b5ec7ab3512261e4e3cc50d208a02c">c689348</a>)</li>
<li><strong>internal:</strong> fix tests (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/bfc6eafeff58664f0d6f155f96286f3993e60f89">bfc6eaf</a>)</li>
<li>update more docs for 1.22 (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/d67c50d49082b4b28bdabc44943853431cd5205c">d67c50d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/anthropics/anthropic-sdk-go/blob/main/CHANGELOG.md">github.com/anthropics/anthropic-sdk-go's
changelog</a>.</em></p>
<blockquote>
<h2>1.13.0 (2025-09-29)</h2>
<p>Full Changelog: <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.12.0...v1.13.0">v1.12.0...v1.13.0</a></p>
<h3>Features</h3>
<ul>
<li><strong>api:</strong> adds support for Claude Sonnet 4.5 and context
management features (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/3d5d51ad6ee64b34c7cc361a9dfd6f45966987dd">3d5d51a</a>)</li>
</ul>
<h3>Bug Fixes</h3>
<ul>
<li>bugfix for setting JSON keys with special characters (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/c868b921190f8d371cc93d12e019daf5a7463306">c868b92</a>)</li>
<li><strong>internal:</strong> unmarshal correctly when there are
multiple discriminators (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/ecc3ce31a9ed98b8f2b66b5e1489fce510528f77">ecc3ce3</a>)</li>
<li>use slices.Concat instead of sometimes modifying r.Options (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/88e7186cad944290498a3381c829df36d26a1cce">88e7186</a>)</li>
</ul>
<h3>Chores</h3>
<ul>
<li>bump minimum go version to 1.22 (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/87af8f397ae68ce72a76a07a735d21495aad8799">87af8f3</a>)</li>
<li>do not install brew dependencies in ./scripts/bootstrap by default
(<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/c689348cc4b5ec7ab3512261e4e3cc50d208a02c">c689348</a>)</li>
<li><strong>internal:</strong> fix tests (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/bfc6eafeff58664f0d6f155f96286f3993e60f89">bfc6eaf</a>)</li>
<li>update more docs for 1.22 (<a
href="https://github.com/anthropics/anthropic-sdk-go/commit/d67c50d49082b4b28bdabc44943853431cd5205c">d67c50d</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/e8befdc7fdceba33c9000b0b50061b8a42cb6c04"><code>e8befdc</code></a>
release: 1.13.0</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/1de6d4717bf8d4e6ff30e64bbdb9974dc1f36dae"><code>1de6d47</code></a>
feat(api): adds support for Claude Sonnet 4.5 and context management
features</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/a9aab31ae626c91a70c7893e0ff583d522930435"><code>a9aab31</code></a>
fix: bugfix for setting JSON keys with special characters</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/41a745429cf31fa0ec05d9a3638e92fdb42e4f3b"><code>41a7454</code></a>
codegen metadata</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/31633bdc1a055d8e85a09c76f1cfe40f5dbaab8a"><code>31633bd</code></a>
chore: do not install brew dependencies in ./scripts/bootstrap by
default</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/2deaed6d70652c9b51966235a283ec02102e72b5"><code>2deaed6</code></a>
fix: use slices.Concat instead of sometimes modifying r.Options</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/9f35b6866932b7a21547b73a41adb531f7f30fd7"><code>9f35b68</code></a>
chore: update more docs for 1.22</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/287a399aa194714f394d1b65a726573eb34d769a"><code>287a399</code></a>
chore: bump minimum go version to 1.22</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/aa4540a9c37d7a3584cc158e0a24fa5377979629"><code>aa4540a</code></a>
chore(internal): fix tests</li>
<li><a
href="https://github.com/anthropics/anthropic-sdk-go/commit/73e5532c81d4cdfa082e0b7b4ae3244d54ef2469"><code>73e5532</code></a>
codegen metadata</li>
<li>Additional commits viewable in <a
href="https://github.com/anthropics/anthropic-sdk-go/compare/v1.12.0...v1.13.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/anthropics/anthropic-sdk-go&package-manager=go_modules&previous-version=1.12.0&new-version=1.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index b0c3360913ceb..581f1beaeecff 100644
--- a/go.mod
+++ b/go.mod
@@ -475,7 +475,7 @@ require (
 )
 
 require (
-	github.com/anthropics/anthropic-sdk-go v1.12.0
+	github.com/anthropics/anthropic-sdk-go v1.13.0
 	github.com/brianvoe/gofakeit/v7 v7.7.1
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
 	github.com/coder/aibridge v0.1.3
diff --git a/go.sum b/go.sum
index 2842cbcc7baa2..c1151e853041d 100644
--- a/go.sum
+++ b/go.sum
@@ -722,8 +722,8 @@ github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwTo
 github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
-github.com/anthropics/anthropic-sdk-go v1.12.0 h1:xPqlGnq7rWrTiHazIvCiumA0u7mGQnwDQtvA1M82h9U=
-github.com/anthropics/anthropic-sdk-go v1.12.0/go.mod h1:WTz31rIUHUHqai2UslPpw5CwXrQP3geYBioRV4WOLvE=
+github.com/anthropics/anthropic-sdk-go v1.13.0 h1:Bhbe8sRoDPtipttg8bQYrMCKe2b79+q6rFW1vOKEUKI=
+github.com/anthropics/anthropic-sdk-go v1.13.0/go.mod h1:WTz31rIUHUHqai2UslPpw5CwXrQP3geYBioRV4WOLvE=
 github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
 github.com/apache/arrow/go/v10 v10.0.1/go.mod h1:YvhnlEePVnBS4+0z3fhPfUy7W1Ikj0Ih0vcRo/gZ1M0=
 github.com/apache/arrow/go/v11 v11.0.0/go.mod h1:Eg5OsL5H+e299f7u5ssuXsuHQVEGC4xei5aX110hRiI=

From 0765970d4905e4a7b6b3b9a39a4efc1cfe28d11c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:42:04 +0000
Subject: [PATCH 016/298] chore: bump jest-fixed-jsdom from 0.0.9 to 0.0.10 in
 /site (#20114)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [jest-fixed-jsdom](https://github.com/mswjs/jest-fixed-jsdom) from
0.0.9 to 0.0.10.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mswjs/jest-fixed-jsdom/releases">jest-fixed-jsdom's
releases</a>.</em></p>
<blockquote>
<h2>v0.0.10 (2025-08-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>using node's global AbortController and AbortSignal (<a
href="https://redirect.github.com/mswjs/jest-fixed-jsdom/issues/35">#35</a>)
(1e63cde866d5575f42ec5fc4520ebb9c487101e2) <a
href="https://github.com/stevematney"><code>@​stevematney</code></a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/mswjs/jest-fixed-jsdom/commit/d31545fc0c56c1ccb0c6a54644c37f54ed25605e"><code>d31545f</code></a>
chore(release): v0.0.10</li>
<li><a
href="https://github.com/mswjs/jest-fixed-jsdom/commit/1e63cde866d5575f42ec5fc4520ebb9c487101e2"><code>1e63cde</code></a>
fix: using node's global AbortController and AbortSignal (<a
href="https://redirect.github.com/mswjs/jest-fixed-jsdom/issues/35">#35</a>)</li>
<li>See full diff in <a
href="https://github.com/mswjs/jest-fixed-jsdom/compare/v0.0.9...v0.0.10">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=jest-fixed-jsdom&package-manager=npm_and_yarn&previous-version=0.0.9&new-version=0.0.10)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index d18b8f1d5a0d4..eb3ff1a828ee4 100644
--- a/site/package.json
+++ b/site/package.json
@@ -164,7 +164,7 @@
 		"jest": "29.7.0",
 		"jest-canvas-mock": "2.5.2",
 		"jest-environment-jsdom": "29.5.0",
-		"jest-fixed-jsdom": "0.0.9",
+		"jest-fixed-jsdom": "0.0.10",
 		"jest-location-mock": "2.0.0",
 		"jest-websocket-mock": "2.5.0",
 		"jest_workaround": "0.1.14",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index e49af3a101ba3..85ab5b0469cd2 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -402,8 +402,8 @@ importers:
         specifier: 29.5.0
         version: 29.5.0
       jest-fixed-jsdom:
-        specifier: 0.0.9
-        version: 0.0.9(jest-environment-jsdom@29.5.0)
+        specifier: 0.0.10
+        version: 0.0.10(jest-environment-jsdom@29.5.0)
       jest-location-mock:
         specifier: 2.0.0
         version: 2.0.0
@@ -4643,8 +4643,8 @@ packages:
     resolution: {integrity: sha512-DOSwCRqXirTOyheM+4d5YZOrWcdu0LNZ87ewUoywbcb2XR4wKgqiG8vNeYwhjFMbEkfju7wx2GYH0P2gevGvFw==, tarball: https://registry.npmjs.org/jest-environment-node/-/jest-environment-node-29.7.0.tgz}
     engines: {node: ^14.15.0 || ^16.10.0 || >=18.0.0}
 
-  jest-fixed-jsdom@0.0.9:
-    resolution: {integrity: sha512-KPfqh2+sn5q2B+7LZktwDcwhCpOpUSue8a1I+BcixWLOQoEVyAjAGfH+IYZGoxZsziNojoHGRTC8xRbB1wDD4g==, tarball: https://registry.npmjs.org/jest-fixed-jsdom/-/jest-fixed-jsdom-0.0.9.tgz}
+  jest-fixed-jsdom@0.0.10:
+    resolution: {integrity: sha512-WaEVX+FripJh+Hn/7dysIgqP66h0KT1NNC22NGmNYANExtCoYNk1q2yjwwcdSboBMkkhn0NtmvKad/cmisnCLg==, tarball: https://registry.npmjs.org/jest-fixed-jsdom/-/jest-fixed-jsdom-0.0.10.tgz}
     engines: {node: '>=18.0.0'}
     peerDependencies:
       jest-environment-jsdom: '>=28.0.0'
@@ -11066,7 +11066,7 @@ snapshots:
       jest-mock: 29.7.0
       jest-util: 29.7.0
 
-  jest-fixed-jsdom@0.0.9(jest-environment-jsdom@29.5.0):
+  jest-fixed-jsdom@0.0.10(jest-environment-jsdom@29.5.0):
     dependencies:
       jest-environment-jsdom: 29.5.0
 

From f68495aa6eca9282a83e83c6bcb63d03def3395f Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:42:17 +0000
Subject: [PATCH 017/298] chore: bump ua-parser-js from 1.0.40 to 1.0.41 in
 /site (#20116)

Bumps [ua-parser-js](https://github.com/faisalman/ua-parser-js) from
1.0.40 to 1.0.41.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/faisalman/ua-parser-js/releases">ua-parser-js's
releases</a>.</em></p>
<blockquote>
<h2>v1.0.41</h2>
<h2>Version 0.7.41 / 1.0.41</h2>
<ul>
<li>Add new browser: Daum, Ladybird</li>
<li>Add new device vendor: HMD</li>
<li>Add new engine: LibWeb</li>
<li>Add new os: Windows IoT, Ubuntu Touch</li>
<li>Improve cpu detection: ARM, x86</li>
<li>Improve device vendor detection: Apple, Archos, Generic, Google,
Honor, Huawei, Infinix, Nvidia, Lenovo, Nokia, OnePlus, Xiaomi</li>
<li>Improve device type detection: smarttv, wearables</li>
<li>Improve os detection: Linux, Symbian</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/faisalman/ua-parser-js/compare/1.0.40...1.0.41">https://github.com/faisalman/ua-parser-js/compare/1.0.40...1.0.41</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/faisalman/ua-parser-js/blob/master/CHANGELOG.md">ua-parser-js's
changelog</a>.</em></p>
<blockquote>
<h2>Version 0.7.41 / 1.0.41</h2>
<ul>
<li>Add new browser: Daum, Ladybird</li>
<li>Add new device vendor: HMD</li>
<li>Add new engine: LibWeb</li>
<li>Add new os: Windows IoT, Ubuntu Touch</li>
<li>Improve cpu detection: ARM, x86</li>
<li>Improve device vendor detection: Apple, Archos, Generic, Google,
Honor, Huawei, Infinix, Nvidia, Lenovo, Nokia, OnePlus, Xiaomi</li>
<li>Improve device type detection: smarttv, wearables</li>
<li>Improve os detection: Linux, Symbian</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/90017c98d341788570435b7587ce1f0725022c7a"><code>90017c9</code></a>
Bump version <code>1.0.41</code> (mirror of <code>0.7.41</code>)</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/af825ff5574d63122dec5a3261f7933044001a1c"><code>af825ff</code></a>
Bump version <code>0.7.41</code></li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/592595445144f06efc32325399c575d9cef964ab"><code>5925954</code></a>
Backport - Improve detection for Nokia device &amp; Symbian OS</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/fc668ef0c09b5a4663077757b8fe73bc850ff8ea"><code>fc668ef</code></a>
Backport - Improve device detection for Generic device: capture its
device mo...</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/0543fb2e95e55be28fc14fa68936bf790407b057"><code>0543fb2</code></a>
Backport - Improve CPU detection: ARM</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/98f1c00fd35cbb321228318fcf5e2f7671d75dfa"><code>98f1c00</code></a>
Backport - Improve device detection for unidentified SmartTV
vendors</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/d66c971090281558706a48118c4db570ebf0ed73"><code>d66c971</code></a>
Backport - Improve detection for Nvidia devices</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/cbe60388ea25b60c10321d964296cb8b53e74bbb"><code>cbe6038</code></a>
Backport - Add Daum app user agent (<a
href="https://redirect.github.com/faisalman/ua-parser-js/issues/773">#773</a>)</li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/e665bd56bef61ee147c359f93c7896f17332db36"><code>e665bd5</code></a>
Backport - Add new OS: <code>Ubuntu Touch</code></li>
<li><a
href="https://github.com/faisalman/ua-parser-js/commit/20c30407207b30638c0f10c4884541115a41c56f"><code>20c3040</code></a>
Backport - Add new device: Apple HomePod</li>
<li>Additional commits viewable in <a
href="https://github.com/faisalman/ua-parser-js/compare/1.0.40...1.0.41">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ua-parser-js&package-manager=npm_and_yarn&previous-version=1.0.40&new-version=1.0.41)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index eb3ff1a828ee4..d44089b0624d6 100644
--- a/site/package.json
+++ b/site/package.json
@@ -114,7 +114,7 @@
 		"tailwind-merge": "2.6.0",
 		"tailwindcss-animate": "1.0.7",
 		"tzdata": "1.0.46",
-		"ua-parser-js": "1.0.40",
+		"ua-parser-js": "1.0.41",
 		"ufuzzy": "npm:@leeoniya/ufuzzy@1.0.10",
 		"undici": "6.21.3",
 		"unique-names-generator": "4.7.1",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 85ab5b0469cd2..6d8a1395f0962 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -257,8 +257,8 @@ importers:
         specifier: 1.0.46
         version: 1.0.46
       ua-parser-js:
-        specifier: 1.0.40
-        version: 1.0.40
+        specifier: 1.0.41
+        version: 1.0.41
       ufuzzy:
         specifier: npm:@leeoniya/ufuzzy@1.0.10
         version: '@leeoniya/ufuzzy@1.0.10'
@@ -6320,8 +6320,8 @@ packages:
   tzdata@1.0.46:
     resolution: {integrity: sha512-zJ4Jv3KCgN3dFeSADpIfHKt9bdIY7TjK3ELaij6oFvyyQBuIZ9LwMlR51vJvMQvRWQ9cS2v92xeZ0sQW4hXCWA==, tarball: https://registry.npmjs.org/tzdata/-/tzdata-1.0.46.tgz}
 
-  ua-parser-js@1.0.40:
-    resolution: {integrity: sha512-z6PJ8Lml+v3ichVojCiB8toQJBuwR42ySM4ezjXIqXK3M0HczmKQ3LF4rhU55PfD99KEEXQG6yb7iOMyvYuHew==, tarball: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.40.tgz}
+  ua-parser-js@1.0.41:
+    resolution: {integrity: sha512-LbBDqdIC5s8iROCUjMbW1f5dJQTEFB1+KO9ogbvlb3nm9n4YHa5p4KTvFPWvh2Hs8gZMBuiB1/8+pdfe/tDPug==, tarball: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-1.0.41.tgz}
     hasBin: true
 
   undici-types@5.26.5:
@@ -13298,7 +13298,7 @@ snapshots:
 
   tzdata@1.0.46: {}
 
-  ua-parser-js@1.0.40: {}
+  ua-parser-js@1.0.41: {}
 
   undici-types@5.26.5: {}
 

From a191ff9aa29e2a36d0eb8a920432a925433986fa Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:42:26 +0000
Subject: [PATCH 018/298] chore: bump dayjs from 1.11.13 to 1.11.18 in /site
 (#20115)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [dayjs](https://github.com/iamkun/dayjs) from 1.11.13 to 1.11.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/iamkun/dayjs/releases">dayjs's
releases</a>.</em></p>
<blockquote>
<h2>v1.11.18</h2>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.17...v1.11.18">1.11.18</a>
(2025-08-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>error semantic-release dependency (<a
href="https://github.com/iamkun/dayjs/commit/8cfb31386d840d31e9655870f4d8c01592eb753a">8cfb313</a>)</li>
</ul>
<h2>v1.11.17</h2>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.16...v1.11.17">1.11.17</a>
(2025-08-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[en-AU] locale use the same ordinal as moment (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2878">#2878</a>)
(<a
href="https://github.com/iamkun/dayjs/commit/1b95ecd21d4feafe7ab113a2d48d7d8d93bb95c9">1b95ecd</a>)</li>
</ul>
<h2>v1.11.16</h2>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.15...v1.11.16">1.11.16</a>
(2025-08-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>test release workflow (no code changes) (<a
href="https://github.com/iamkun/dayjs/commit/c38c428a78c344699eff373adfc8c007bb3a514f">c38c428</a>)</li>
</ul>
<h2>v1.11.15</h2>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.14...v1.11.15">1.11.15</a>
(2025-08-28)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fix misspellings in Irish or Irish Gaelic [ga] (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2861">#2861</a>)
(<a
href="https://github.com/iamkun/dayjs/commit/9c14a4245a8e764ee3260ff17a7ff48dfd09d279">9c14a42</a>)</li>
</ul>
<h2>v1.11.14</h2>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.13...v1.11.14">1.11.14</a>
(2025-08-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>.utcOffset(0, true) result and its clone are different bug (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2505">#2505</a>)
(<a
href="https://github.com/iamkun/dayjs/commit/fefdcd4b6b807786f65139b6dd801e0014d7dc6f">fefdcd4</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/iamkun/dayjs/blob/v1.11.18/CHANGELOG.md">dayjs's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.17...v1.11.18">1.11.18</a>
(2025-08-30)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>error semantic-release dependency (<a
href="https://github.com/iamkun/dayjs/commit/8cfb31386d840d31e9655870f4d8c01592eb753a">8cfb313</a>)</li>
</ul>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.16...v1.11.17">1.11.17</a>
(2025-08-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>[en-AU] locale use the same ordinal as moment (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2878">#2878</a>)
(<a
href="https://github.com/iamkun/dayjs/commit/1b95ecd21d4feafe7ab113a2d48d7d8d93bb95c9">1b95ecd</a>)</li>
</ul>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.15...v1.11.16">1.11.16</a>
(2025-08-29)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>test release workflow (no code changes) (<a
href="https://github.com/iamkun/dayjs/commit/c38c428a78c344699eff373adfc8c007bb3a514f">c38c428</a>)</li>
</ul>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.14...v1.11.15">1.11.15</a>
(2025-08-28)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Fix misspellings in Irish or Irish Gaelic [ga] (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2861">#2861</a>)
(<a
href="https://github.com/iamkun/dayjs/commit/9c14a4245a8e764ee3260ff17a7ff48dfd09d279">9c14a42</a>)</li>
</ul>
<h2><a
href="https://github.com/iamkun/dayjs/compare/v1.11.13...v1.11.14">1.11.14</a>
(2025-08-27)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>.utcOffset(0, true) result and its clone are different bug (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2505">#2505</a>)
(<a
href="https://github.com/iamkun/dayjs/commit/fefdcd4b6b807786f65139b6dd801e0014d7dc6f">fefdcd4</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/iamkun/dayjs/commit/9beb3f3ea595c6046cbe863ee6d15d63e6fb2b07"><code>9beb3f3</code></a>
chore(release): 1.11.18 [skip ci]</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/d72d0cfb58595259e5b634da54f66b355e306f29"><code>d72d0cf</code></a>
Merge pull request <a
href="https://redirect.github.com/iamkun/dayjs/issues/2925">#2925</a>
from iamkun/dev</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/9be50d5b504afd619efe970b3a40b11d95b98a8b"><code>9be50d5</code></a>
chore: update workflow</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/8cfb31386d840d31e9655870f4d8c01592eb753a"><code>8cfb313</code></a>
fix: error semantic-release dependency</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/b9815f988447425dfb6cd63c42cf0487953ddb5e"><code>b9815f9</code></a>
chore: update workflow</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/7fcf939982437e50c08d33b6e1e53ab46f53c1f4"><code>7fcf939</code></a>
chore(release): 1.11.17 [skip ci]</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/b832bab7b95f9756bba31a1c12d0f0c1678828d0"><code>b832bab</code></a>
d2m (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2922">#2922</a>)</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/1b95ecd21d4feafe7ab113a2d48d7d8d93bb95c9"><code>1b95ecd</code></a>
fix: [en-AU] locale use the same ordinal as moment (<a
href="https://redirect.github.com/iamkun/dayjs/issues/2878">#2878</a>)</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/5465380fbc16ca1bd36cfd2f3e2295d2f447602c"><code>5465380</code></a>
chore: update .npmignore</li>
<li><a
href="https://github.com/iamkun/dayjs/commit/fcdbc82d6fa299a4ddb2040e1ed20c3917c1e615"><code>fcdbc82</code></a>
chore: update workflow debug <code>@​semantic-release/github</code></li>
<li>Additional commits viewable in <a
href="https://github.com/iamkun/dayjs/compare/v1.11.13...v1.11.18">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=dayjs&package-manager=npm_and_yarn&previous-version=1.11.13&new-version=1.11.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index d44089b0624d6..3a974c5b0348e 100644
--- a/site/package.json
+++ b/site/package.json
@@ -83,7 +83,7 @@
 		"color-convert": "2.0.1",
 		"cron-parser": "4.9.0",
 		"cronstrue": "2.50.0",
-		"dayjs": "1.11.13",
+		"dayjs": "1.11.18",
 		"emoji-mart": "5.6.0",
 		"file-saver": "2.0.5",
 		"formik": "2.4.6",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 6d8a1395f0962..6fdcf50cfd5b3 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -164,8 +164,8 @@ importers:
         specifier: 2.50.0
         version: 2.50.0
       dayjs:
-        specifier: 1.11.13
-        version: 1.11.13
+        specifier: 1.11.18
+        version: 1.11.18
       emoji-mart:
         specifier: 5.6.0
         version: 5.6.0
@@ -3707,8 +3707,8 @@ packages:
     resolution: {integrity: sha512-fnULvOpxnC5/Vg3NCiWelDsLiUc9bRwAPs/+LfTLNvetFCtCTN+yQz15C/fs4AwX1R9K5GLtLfn8QW+dWisaAw==, tarball: https://registry.npmjs.org/date-fns/-/date-fns-2.30.0.tgz}
     engines: {node: '>=0.11'}
 
-  dayjs@1.11.13:
-    resolution: {integrity: sha512-oaMBel6gjolK862uaPQOVTA7q3TZhuSvuMQAAglQDOWYO9A91IrAOUJEyKVlqJlHE0vq5p5UXxzdPfMH/x6xNg==, tarball: https://registry.npmjs.org/dayjs/-/dayjs-1.11.13.tgz}
+  dayjs@1.11.18:
+    resolution: {integrity: sha512-zFBQ7WFRvVRhKcWoUh+ZA1g2HVgUbsZm9sbddh8EC5iv93sui8DVVz1Npvz+r6meo9VKfa8NyLWBsQK1VvIKPA==, tarball: https://registry.npmjs.org/dayjs/-/dayjs-1.11.18.tgz}
 
   debug@2.6.9:
     resolution: {integrity: sha512-bC7ElrdJaJnPbAP+1EotYvqZsb3ecl5wi6Bfi6BJTUcNowp6cvspg0jXznRTKDjm/E7AdgFBVeAPVMNcKGsHMA==, tarball: https://registry.npmjs.org/debug/-/debug-2.6.9.tgz}
@@ -9935,7 +9935,7 @@ snapshots:
     dependencies:
       '@babel/runtime': 7.26.10
 
-  dayjs@1.11.13: {}
+  dayjs@1.11.18: {}
 
   debug@2.6.9:
     dependencies:

From 30f81edbceabe11261989fae6509ff76c245f95d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:42:34 +0000
Subject: [PATCH 019/298] chore: bump google.golang.org/api from 0.250.0 to
 0.251.0 (#20110)

Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.250.0 to 0.251.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.251.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.250.0...v0.251.0">0.251.0</a>
(2025-09-30)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3319">#3319</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/7ef0f9bc31e15c6998e4b26b511bf1d5d50a6970">7ef0f9b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3321">#3321</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/2cb519b1a2d45c30fe1dfde10b47a83424d30231">2cb519b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3322">#3322</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3e4bc6062699a1710d50f68b694bbe3a50132e82">3e4bc60</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3324">#3324</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b41b5a5c9ef21d7499b6f206c214c4a16933e3b7">b41b5a5</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3325">#3325</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/8c5ef06788b235fcfb78e7226cf9905e88c96628">8c5ef06</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.250.0...v0.251.0">0.251.0</a>
(2025-09-30)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3319">#3319</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/7ef0f9bc31e15c6998e4b26b511bf1d5d50a6970">7ef0f9b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3321">#3321</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/2cb519b1a2d45c30fe1dfde10b47a83424d30231">2cb519b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3322">#3322</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3e4bc6062699a1710d50f68b694bbe3a50132e82">3e4bc60</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3324">#3324</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b41b5a5c9ef21d7499b6f206c214c4a16933e3b7">b41b5a5</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3325">#3325</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/8c5ef06788b235fcfb78e7226cf9905e88c96628">8c5ef06</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/bce8b63a2760d6bb50b56bc120bc79c5a5a4f53a"><code>bce8b63</code></a>
chore(main): release 0.251.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3320">#3320</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/65e7830d404c48623fbd05f4bebdb3c8cc8b8ea9"><code>65e7830</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3323">#3323</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8c5ef06788b235fcfb78e7226cf9905e88c96628"><code>8c5ef06</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3325">#3325</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b41b5a5c9ef21d7499b6f206c214c4a16933e3b7"><code>b41b5a5</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3324">#3324</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3e4bc6062699a1710d50f68b694bbe3a50132e82"><code>3e4bc60</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3322">#3322</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/2cb519b1a2d45c30fe1dfde10b47a83424d30231"><code>2cb519b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3321">#3321</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/7ef0f9bc31e15c6998e4b26b511bf1d5d50a6970"><code>7ef0f9b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3319">#3319</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.250.0...v0.251.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.250.0&new-version=0.251.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod |  6 +++---
 go.sum | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/go.mod b/go.mod
index 581f1beaeecff..34967b03a7060 100644
--- a/go.mod
+++ b/go.mod
@@ -74,7 +74,7 @@ replace github.com/spf13/afero => github.com/aslilac/afero v0.0.0-20250403163713
 
 require (
 	cdr.dev/slog v1.6.2-0.20250703074222-9df5e0a6c145
-	cloud.google.com/go/compute/metadata v0.8.4
+	cloud.google.com/go/compute/metadata v0.9.0
 	github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
 	github.com/adrg/xdg v0.5.0
 	github.com/ammario/tlru v0.4.0
@@ -206,7 +206,7 @@ require (
 	golang.org/x/text v0.29.0
 	golang.org/x/tools v0.37.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
-	google.golang.org/api v0.250.0
+	google.golang.org/api v0.251.0
 	google.golang.org/grpc v1.75.1
 	google.golang.org/protobuf v1.36.9
 	gopkg.in/DataDog/dd-trace-go.v1 v1.74.0
@@ -454,7 +454,7 @@ require (
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250715232539-7130f93afb79 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	howett.net/plist v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index c1151e853041d..ecc9506cbe700 100644
--- a/go.sum
+++ b/go.sum
@@ -184,8 +184,8 @@ cloud.google.com/go/compute/metadata v0.1.0/go.mod h1:Z1VN+bulIf6bt4P/C37K4DyZYZ
 cloud.google.com/go/compute/metadata v0.2.0/go.mod h1:zFmK7XCadkQkj6TtorcaGlCW1hT1fIilQDwofLpJ20k=
 cloud.google.com/go/compute/metadata v0.2.1/go.mod h1:jgHgmJd2RKBGzXqF5LR2EZMGxBkeanZ9wwa75XHJgOM=
 cloud.google.com/go/compute/metadata v0.2.3/go.mod h1:VAV5nSsACxMJvgaAuX6Pk2AawlZn8kiOGuCv6gTkwuA=
-cloud.google.com/go/compute/metadata v0.8.4 h1:oXMa1VMQBVCyewMIOm3WQsnVd9FbKBtm8reqWRaXnHQ=
-cloud.google.com/go/compute/metadata v0.8.4/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
+cloud.google.com/go/compute/metadata v0.9.0 h1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=
+cloud.google.com/go/compute/metadata v0.9.0/go.mod h1:E0bWwX5wTnLPedCKqk3pJmVgCBSM6qQI1yTBdEb3C10=
 cloud.google.com/go/contactcenterinsights v1.3.0/go.mod h1:Eu2oemoePuEFc/xKFPjbTuPSj0fYJcPls9TFlPNnHHY=
 cloud.google.com/go/contactcenterinsights v1.4.0/go.mod h1:L2YzkGbPsv+vMQMCADxJoT9YiTTnSEd6fEvCeHTYVck=
 cloud.google.com/go/contactcenterinsights v1.6.0/go.mod h1:IIDlT6CLcDoyv79kDv8iWxMSTZhLxSCofVV5W6YFM/w=
@@ -2534,8 +2534,8 @@ google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/
 google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
 google.golang.org/api v0.111.0/go.mod h1:qtFHvU9mhgTJegR31csQ+rwxyUTHOKFqCKWp1J0fdw0=
 google.golang.org/api v0.114.0/go.mod h1:ifYI2ZsFK6/uGddGfAD5BMxlnkBqCmqHSDUVi45N5Yg=
-google.golang.org/api v0.250.0 h1:qvkwrf/raASj82UegU2RSDGWi/89WkLckn4LuO4lVXM=
-google.golang.org/api v0.250.0/go.mod h1:Y9Uup8bDLJJtMzJyQnu+rLRJLA0wn+wTtc6vTlOvfXo=
+google.golang.org/api v0.251.0 h1:6lea5nHRT8RUmpy9kkC2PJYnhnDAB13LqrLSVQlMIE8=
+google.golang.org/api v0.251.0/go.mod h1:Rwy0lPf/TD7+T2VhYcffCHhyyInyuxGjICxdfLqT7KI=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2680,8 +2680,8 @@ google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 h1:Nt6z9UHqSlIdIGJ
 google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79/go.mod h1:kTmlBHMPqR5uCZPBvwa2B18mvubkjyY3CRLI0c6fj0s=
 google.golang.org/genproto/googleapis/api v0.0.0-20250715232539-7130f93afb79 h1:iOye66xuaAK0WnkPuhQPUFy8eJcmwUXqGGP3om6IxX8=
 google.golang.org/genproto/googleapis/api v0.0.0-20250715232539-7130f93afb79/go.mod h1:HKJDgKsFUnv5VAGeQjz8kxcgDP0HoE0iZNp0OdZNlhE=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090 h1:/OQuEa4YWtDt7uQWHd3q3sUMb+QOLQUg1xa8CEsRv5w=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250908214217-97024824d090/go.mod h1:GmFNa4BdJZ2a8G+wCe9Bg3wwThLrJun751XstdJt5Og=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=

From 29aa1cc57254adf3afb2a77fc8ed2ee7076ff6fd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:42:53 +0000
Subject: [PATCH 020/298] chore: bump tailwindcss from 3.4.17 to 3.4.18 in
 /site (#20117)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps
[tailwindcss](https://github.com/tailwindlabs/tailwindcss/tree/HEAD/packages/tailwindcss)
from 3.4.17 to 3.4.18.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/releases">tailwindcss's
releases</a>.</em></p>
<blockquote>
<h2>v3.4.18</h2>
<h3>Fixed</h3>
<ul>
<li>Improve support for raw <code>supports-[…]</code> queries in
arbitrary values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13605">#13605</a>)</li>
<li>Fix <code>require.cache</code> error when loaded through a
TypeScript file in Node 22.18+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18665">#18665</a>)</li>
<li>Support <code>import.meta.resolve(…)</code> in configs for new
enough Node.js versions (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Allow using newer versions of <code>postcss-load-config</code> for
better ESM and TypeScript PostCSS config support with the CLI (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Remove irrelevant utility rules when matching important classes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19030">#19030</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tailwindlabs/tailwindcss/blob/main/CHANGELOG.md">tailwindcss's
changelog</a>.</em></p>
<blockquote>
<h2>[3.4.18] - 2024-10-01</h2>
<h3>Fixed</h3>
<ul>
<li>Improve support for raw <code>supports-[…]</code> queries in
arbitrary values (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/13605">#13605</a>)</li>
<li>Fix <code>require.cache</code> error when loaded through a
TypeScript file in Node 22.18+ (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18665">#18665</a>)</li>
<li>Support <code>import.meta.resolve(…)</code> in configs for new
enough Node.js versions (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Allow using newer versions of <code>postcss-load-config</code> for
better ESM and TypeScript PostCSS config support with the CLI (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/18938">#18938</a>)</li>
<li>Remove irrelevant utility rules when matching important classes (<a
href="https://redirect.github.com/tailwindlabs/tailwindcss/pull/19030">#19030</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/tailwindlabs/tailwindcss/commits/v3.4.18/packages/tailwindcss">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=tailwindcss&package-manager=npm_and_yarn&previous-version=3.4.17&new-version=3.4.18)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |   2 +-
 site/pnpm-lock.yaml | 192 +++++++++++++++++++++-----------------------
 2 files changed, 93 insertions(+), 101 deletions(-)

diff --git a/site/package.json b/site/package.json
index 3a974c5b0348e..e90e860dd6a17 100644
--- a/site/package.json
+++ b/site/package.json
@@ -177,7 +177,7 @@
 		"ssh2": "1.17.0",
 		"storybook": "9.1.2",
 		"storybook-addon-remix-react-router": "5.0.0",
-		"tailwindcss": "3.4.17",
+		"tailwindcss": "3.4.18",
 		"ts-proto": "1.164.0",
 		"typescript": "5.6.3",
 		"vite": "7.1.7",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 6fdcf50cfd5b3..e2fdf68962550 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -252,7 +252,7 @@ importers:
         version: 2.6.0
       tailwindcss-animate:
         specifier: 1.0.7
-        version: 1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3)))
+        version: 1.0.7(tailwindcss@3.4.18(yaml@2.7.0))
       tzdata:
         specifier: 1.0.46
         version: 1.0.46
@@ -283,7 +283,7 @@ importers:
         version: 2.2.0
       '@chromatic-com/storybook':
         specifier: 4.1.0
-        version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@octokit/types':
         specifier: 12.3.0
         version: 12.3.0
@@ -292,16 +292,16 @@ importers:
         version: 1.50.1
       '@storybook/addon-docs':
         specifier: 9.1.2
-        version: 9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/addon-links':
         specifier: 9.1.2
-        version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/addon-themes':
         specifier: 9.1.2
-        version: 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/react-vite':
         specifier: 9.1.2
-        version: 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+        version: 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       '@swc/core':
         specifier: 1.3.38
         version: 1.3.38
@@ -310,7 +310,7 @@ importers:
         version: 0.2.37(@swc/core@1.3.38)
       '@tailwindcss/typography':
         specifier: 0.5.16
-        version: 0.5.16(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3)))
+        version: 0.5.16(tailwindcss@3.4.18(yaml@2.7.0))
       '@testing-library/jest-dom':
         specifier: 6.6.3
         version: 6.6.3
@@ -379,7 +379,7 @@ importers:
         version: 9.0.2
       '@vitejs/plugin-react':
         specifier: 5.0.4
-        version: 5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+        version: 5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       autoprefixer:
         specifier: 10.4.20
         version: 10.4.20(postcss@8.5.1)
@@ -436,13 +436,13 @@ importers:
         version: 1.17.0
       storybook:
         specifier: 9.1.2
-        version: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+        version: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       storybook-addon-remix-react-router:
         specifier: 5.0.0
-        version: 5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+        version: 5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       tailwindcss:
-        specifier: 3.4.17
-        version: 3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3))
+        specifier: 3.4.18
+        version: 3.4.18(yaml@2.7.0)
       ts-proto:
         specifier: 1.164.0
         version: 1.164.0
@@ -451,10 +451,10 @@ importers:
         version: 5.6.3
       vite:
         specifier: 7.1.7
-        version: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+        version: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
       vite-plugin-checker:
         specifier: 0.11.0
-        version: 0.11.0(@biomejs/biome@2.2.0)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+        version: 0.11.0(@biomejs/biome@2.2.0)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
 
 packages:
 
@@ -1321,10 +1321,6 @@ packages:
   '@jridgewell/gen-mapping@0.3.13':
     resolution: {integrity: sha512-2kkt/7niJ6MgEPxF0bYdQ6etZaA+fQvDcLKckhy1yIQOzaoKjBBjSj63/aLVjYE3qhRt5dvM+uUyfCg6UKCBbA==, tarball: https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.13.tgz}
 
-  '@jridgewell/gen-mapping@0.3.8':
-    resolution: {integrity: sha512-imAbBGkb+ebQyxKgzv5Hu2nmROxoDOXHh80evxdoXNOrvAnVx7zimzc1Oo5h9RlfV4vPXaE2iM5pOFbvOCClWA==, tarball: https://registry.npmjs.org/@jridgewell/gen-mapping/-/gen-mapping-0.3.8.tgz}
-    engines: {node: '>=6.0.0'}
-
   '@jridgewell/remapping@2.3.5':
     resolution: {integrity: sha512-LI9u/+laYG4Ds1TDKSJW2YPrIlcVYOwi2fUC6xB43lueCjgxV4lffOCZCtYFiH6TNOX+tQKXx97T4IKHbhyHEQ==, tarball: https://registry.npmjs.org/@jridgewell/remapping/-/remapping-2.3.5.tgz}
 
@@ -1332,10 +1328,6 @@ packages:
     resolution: {integrity: sha512-bRISgCIjP20/tbWSPWMEi54QVPRZExkuD9lJL+UIxUKtwVJA8wW1Trb1jMs1RFXo1CBTNZ/5hpC9QvmKWdopKw==, tarball: https://registry.npmjs.org/@jridgewell/resolve-uri/-/resolve-uri-3.1.2.tgz}
     engines: {node: '>=6.0.0'}
 
-  '@jridgewell/set-array@1.2.1':
-    resolution: {integrity: sha512-R8gLRTZeyp03ymzP/6Lil/28tGeGEzhx1q2k703KGWRAI1VdvPIXdG70VJc2pAMw3NA6JKL5hhFu1sJX0Mnn/A==, tarball: https://registry.npmjs.org/@jridgewell/set-array/-/set-array-1.2.1.tgz}
-    engines: {node: '>=6.0.0'}
-
   '@jridgewell/sourcemap-codec@1.5.0':
     resolution: {integrity: sha512-gv3ZRaISU3fjPAgNsriBRqGWQL6quFx04YMPW/zD8XMLsU32mhCCbfbO6KZFLjvYpCZ8zyDEgqsgf+PwPaM7GQ==, tarball: https://registry.npmjs.org/@jridgewell/sourcemap-codec/-/sourcemap-codec-1.5.0.tgz}
 
@@ -5451,8 +5443,8 @@ packages:
     resolution: {integrity: sha512-udgsAY+fTnvv7kI7aaxbqwWNb0AHiB0qBO89PZKPkoTmGOgdbrHDKD+0B2X4uTfJ/FT1R09r9gTsjUjNJotuog==, tarball: https://registry.npmjs.org/pify/-/pify-2.3.0.tgz}
     engines: {node: '>=0.10.0'}
 
-  pirates@4.0.6:
-    resolution: {integrity: sha512-saLsH7WeYYPiD25LDuLRRY/i+6HaPYr6G1OUlN39otzkSTxKnubR9RTxS3/Kk50s1g2JTgFwWQDQyplC5/SHZg==, tarball: https://registry.npmjs.org/pirates/-/pirates-4.0.6.tgz}
+  pirates@4.0.7:
+    resolution: {integrity: sha512-TfySrs/5nm8fQJDcBDuUng3VOUKsd7S+zqvbOTiGXHfxX4wK31ard+hoNuvkicM/2YFzlpDgABOevKSsB4G/FA==, tarball: https://registry.npmjs.org/pirates/-/pirates-4.0.7.tgz}
     engines: {node: '>= 6'}
 
   pkg-dir@4.2.0:
@@ -5479,22 +5471,28 @@ packages:
     peerDependencies:
       postcss: ^8.0.0
 
-  postcss-js@4.0.1:
-    resolution: {integrity: sha512-dDLF8pEO191hJMtlHFPRa8xsizHaM82MLfNkUHdUtVEV3tgTp5oj+8qbEqYM57SLfc74KSbw//4SeJma2LRVIw==, tarball: https://registry.npmjs.org/postcss-js/-/postcss-js-4.0.1.tgz}
+  postcss-js@4.1.0:
+    resolution: {integrity: sha512-oIAOTqgIo7q2EOwbhb8UalYePMvYoIeRY2YKntdpFQXNosSu3vLrniGgmH9OKs/qAkfoj5oB3le/7mINW1LCfw==, tarball: https://registry.npmjs.org/postcss-js/-/postcss-js-4.1.0.tgz}
     engines: {node: ^12 || ^14 || >= 16}
     peerDependencies:
       postcss: ^8.4.21
 
-  postcss-load-config@4.0.2:
-    resolution: {integrity: sha512-bSVhyJGL00wMVoPUzAVAnbEoWyqRxkjv64tUl427SKnPrENtq6hJwUojroMz2VB+Q1edmi4IfrAPpami5VVgMQ==, tarball: https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-4.0.2.tgz}
-    engines: {node: '>= 14'}
+  postcss-load-config@6.0.1:
+    resolution: {integrity: sha512-oPtTM4oerL+UXmx+93ytZVN82RrlY/wPUV8IeDxFrzIjXOLF1pN+EmKPLbubvKHT2HC20xXsCAH2Z+CKV6Oz/g==, tarball: https://registry.npmjs.org/postcss-load-config/-/postcss-load-config-6.0.1.tgz}
+    engines: {node: '>= 18'}
     peerDependencies:
+      jiti: '>=1.21.0'
       postcss: '>=8.0.9'
-      ts-node: '>=9.0.0'
+      tsx: ^4.8.1
+      yaml: ^2.4.2
     peerDependenciesMeta:
+      jiti:
+        optional: true
       postcss:
         optional: true
-      ts-node:
+      tsx:
+        optional: true
+      yaml:
         optional: true
 
   postcss-nested@6.2.0:
@@ -6163,8 +6161,8 @@ packages:
     peerDependencies:
       tailwindcss: '>=3.0.0 || insiders'
 
-  tailwindcss@3.4.17:
-    resolution: {integrity: sha512-w33E2aCvSDP0tW9RZuNXadXlkHXqFzSkQew/aIa2i/Sj8fThxwovwlXHSPXTbAHwEIhBFXAedUhP2tueAKP8Og==, tarball: https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.17.tgz}
+  tailwindcss@3.4.18:
+    resolution: {integrity: sha512-6A2rnmW5xZMdw11LYjhcI5846rt9pbLSabY5XPxo+XWdxwZaFEn47Go4NzFiHu9sNNmr/kXivP1vStfvMaK1GQ==, tarball: https://registry.npmjs.org/tailwindcss/-/tailwindcss-3.4.18.tgz}
     engines: {node: '>=14.0.0'}
     hasBin: true
 
@@ -7001,13 +6999,13 @@ snapshots:
       '@types/tough-cookie': 4.0.5
       tough-cookie: 4.1.4
 
-  '@chromatic-com/storybook@4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@chromatic-com/storybook@4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.2
       jsonfile: 6.1.0
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       strip-ansi: 7.1.0
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -7595,7 +7593,7 @@ snapshots:
       jest-regex-util: 29.6.3
       jest-util: 29.7.0
       micromatch: 4.0.8
-      pirates: 4.0.6
+      pirates: 4.0.7
       slash: 3.0.0
       write-file-atomic: 4.0.2
     transitivePeerDependencies:
@@ -7619,12 +7617,12 @@ snapshots:
       '@types/yargs': 17.0.33
       chalk: 4.1.2
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
       glob: 10.4.5
       magic-string: 0.30.17
       react-docgen-typescript: 2.2.2(typescript@5.6.3)
-      vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
     optionalDependencies:
       typescript: 5.6.3
 
@@ -7633,12 +7631,6 @@ snapshots:
       '@jridgewell/sourcemap-codec': 1.5.5
       '@jridgewell/trace-mapping': 0.3.31
 
-  '@jridgewell/gen-mapping@0.3.8':
-    dependencies:
-      '@jridgewell/set-array': 1.2.1
-      '@jridgewell/sourcemap-codec': 1.5.0
-      '@jridgewell/trace-mapping': 0.3.25
-
   '@jridgewell/remapping@2.3.5':
     dependencies:
       '@jridgewell/gen-mapping': 0.3.13
@@ -7646,8 +7638,6 @@ snapshots:
 
   '@jridgewell/resolve-uri@3.1.2': {}
 
-  '@jridgewell/set-array@1.2.1': {}
-
   '@jridgewell/sourcemap-codec@1.5.0': {}
 
   '@jridgewell/sourcemap-codec@1.5.5': {}
@@ -7655,7 +7645,7 @@ snapshots:
   '@jridgewell/trace-mapping@0.3.25':
     dependencies:
       '@jridgewell/resolve-uri': 3.1.2
-      '@jridgewell/sourcemap-codec': 1.5.0
+      '@jridgewell/sourcemap-codec': 1.5.5
 
   '@jridgewell/trace-mapping@0.3.31':
     dependencies:
@@ -8775,41 +8765,41 @@ snapshots:
     dependencies:
       '@sinonjs/commons': 3.0.0
 
-  '@storybook/addon-docs@9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-docs@9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       '@mdx-js/react': 3.0.1(@types/react@19.1.17)(react@19.1.1)
-      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/icons': 1.4.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-links@9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-links@9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       '@storybook/global': 5.0.0
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
     optionalDependencies:
       react: 19.1.1
 
-  '@storybook/addon-themes@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/addon-themes@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       ts-dedent: 2.2.0
 
-  '@storybook/builder-vite@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@storybook/builder-vite@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       ts-dedent: 2.2.0
-      vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
 
-  '@storybook/csf-plugin@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/csf-plugin@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       unplugin: 1.5.0
 
   '@storybook/global@5.0.0': {}
@@ -8819,39 +8809,39 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@storybook/react-dom-shim@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))':
+  '@storybook/react-dom-shim@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
 
-  '@storybook/react-vite@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@storybook/react-vite@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       '@rollup/pluginutils': 5.0.5(rollup@4.52.3)
-      '@storybook/builder-vite': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
-      '@storybook/react': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)
+      '@storybook/builder-vite': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      '@storybook/react': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)
       find-up: 7.0.0
       magic-string: 0.30.17
       react: 19.1.1
       react-docgen: 8.0.0
       react-dom: 19.1.1(react@19.1.1)
       resolve: 1.22.10
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       tsconfig-paths: 4.2.0
-      vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))(typescript@5.6.3)':
+  '@storybook/react@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)))
+      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
     optionalDependencies:
       typescript: 5.6.3
 
@@ -8907,13 +8897,13 @@ snapshots:
       '@swc/counter': 0.1.3
       jsonc-parser: 3.2.0
 
-  '@tailwindcss/typography@0.5.16(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3)))':
+  '@tailwindcss/typography@0.5.16(tailwindcss@3.4.18(yaml@2.7.0))':
     dependencies:
       lodash.castarray: 4.4.0
       lodash.isplainobject: 4.0.6
       lodash.merge: 4.6.2
       postcss-selector-parser: 6.0.10
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3))
+      tailwindcss: 3.4.18(yaml@2.7.0)
 
   '@tanstack/query-core@5.77.0': {}
 
@@ -9294,7 +9284,7 @@ snapshots:
 
   '@ungap/structured-clone@1.3.0': {}
 
-  '@vitejs/plugin-react@5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@vitejs/plugin-react@5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
@@ -9302,7 +9292,7 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.38
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -9314,14 +9304,14 @@ snapshots:
       chai: 5.2.1
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))':
+  '@vitest/mocker@3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.17
     optionalDependencies:
       msw: 2.4.8(typescript@5.6.3)
-      vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
@@ -12316,7 +12306,7 @@ snapshots:
 
   pify@2.3.0: {}
 
-  pirates@4.0.6: {}
+  pirates@4.0.7: {}
 
   pkg-dir@4.2.0:
     dependencies:
@@ -12339,18 +12329,18 @@ snapshots:
       read-cache: 1.0.0
       resolve: 1.22.10
 
-  postcss-js@4.0.1(postcss@8.5.1):
+  postcss-js@4.1.0(postcss@8.5.1):
     dependencies:
       camelcase-css: 2.0.1
       postcss: 8.5.1
 
-  postcss-load-config@4.0.2(postcss@8.5.1)(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3)):
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.1)(yaml@2.7.0):
     dependencies:
       lilconfig: 3.1.3
-      yaml: 2.7.0
     optionalDependencies:
+      jiti: 1.21.7
       postcss: 8.5.1
-      ts-node: 10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3)
+      yaml: 2.7.0
 
   postcss-nested@6.2.0(postcss@8.5.1):
     dependencies:
@@ -12995,24 +12985,24 @@ snapshots:
     dependencies:
       internal-slot: 1.0.6
 
-  storybook-addon-remix-react-router@5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))):
+  storybook-addon-remix-react-router@5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))):
     dependencies:
       '@mjackson/form-data-parser': 0.4.0
       compare-versions: 6.1.0
       react-inspector: 6.0.2(react@19.1.1)
       react-router: 7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
     optionalDependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)):
+  storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
     dependencies:
       '@storybook/global': 5.0.0
       '@testing-library/jest-dom': 6.6.3
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.0)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0))
+      '@vitest/mocker': 3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.3
@@ -13104,12 +13094,12 @@ snapshots:
 
   sucrase@3.35.0:
     dependencies:
-      '@jridgewell/gen-mapping': 0.3.8
+      '@jridgewell/gen-mapping': 0.3.13
       commander: 4.1.1
       glob: 10.4.5
       lines-and-columns: 1.2.4
       mz: 2.7.0
-      pirates: 4.0.6
+      pirates: 4.0.7
       ts-interface-checker: 0.1.13
 
   supports-color@7.2.0:
@@ -13126,11 +13116,11 @@ snapshots:
 
   tailwind-merge@2.6.0: {}
 
-  tailwindcss-animate@1.0.7(tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3))):
+  tailwindcss-animate@1.0.7(tailwindcss@3.4.18(yaml@2.7.0)):
     dependencies:
-      tailwindcss: 3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3))
+      tailwindcss: 3.4.18(yaml@2.7.0)
 
-  tailwindcss@3.4.17(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3)):
+  tailwindcss@3.4.18(yaml@2.7.0):
     dependencies:
       '@alloc/quick-lru': 5.2.0
       arg: 5.0.2
@@ -13148,14 +13138,15 @@ snapshots:
       picocolors: 1.1.1
       postcss: 8.5.1
       postcss-import: 15.1.0(postcss@8.5.1)
-      postcss-js: 4.0.1(postcss@8.5.1)
-      postcss-load-config: 4.0.2(postcss@8.5.1)(ts-node@10.9.2(@swc/core@1.3.38)(@types/node@20.17.16)(typescript@5.6.3))
+      postcss-js: 4.1.0(postcss@8.5.1)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.1)(yaml@2.7.0)
       postcss-nested: 6.2.0(postcss@8.5.1)
       postcss-selector-parser: 6.1.2
       resolve: 1.22.10
       sucrase: 3.35.0
     transitivePeerDependencies:
-      - ts-node
+      - tsx
+      - yaml
 
   test-exclude@6.0.0:
     dependencies:
@@ -13474,7 +13465,7 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  vite-plugin-checker@0.11.0(@biomejs/biome@2.2.0)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)):
+  vite-plugin-checker@0.11.0(@biomejs/biome@2.2.0)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
     dependencies:
       '@babel/code-frame': 7.27.1
       chokidar: 4.0.3
@@ -13483,7 +13474,7 @@ snapshots:
       picomatch: 4.0.3
       tiny-invariant: 1.3.3
       tinyglobby: 0.2.15
-      vite: 7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0)
+      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
       vscode-uri: 3.1.0
     optionalDependencies:
       '@biomejs/biome': 2.2.0
@@ -13491,7 +13482,7 @@ snapshots:
       optionator: 0.9.3
       typescript: 5.6.3
 
-  vite@7.1.7(@types/node@20.17.16)(jiti@2.6.1)(yaml@2.7.0):
+  vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0):
     dependencies:
       esbuild: 0.25.10
       fdir: 6.5.0(picomatch@4.0.3)
@@ -13502,7 +13493,7 @@ snapshots:
     optionalDependencies:
       '@types/node': 20.17.16
       fsevents: 2.3.3
-      jiti: 2.6.1
+      jiti: 1.21.7
       yaml: 2.7.0
 
   vscode-uri@3.1.0: {}
@@ -13609,7 +13600,8 @@ snapshots:
 
   yaml@1.10.2: {}
 
-  yaml@2.7.0: {}
+  yaml@2.7.0:
+    optional: true
 
   yargs-parser@21.1.1: {}
 

From 4cabb9528ecd5ef5493b7f8b53185cb79afc18fe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:46:34 +0000
Subject: [PATCH 021/298] chore: bump @types/lodash from 4.17.15 to 4.17.20 in
 /site (#20122)

Bumps
[@types/lodash](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/lodash)
from 4.17.15 to 4.17.20.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/lodash">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@types/lodash&package-manager=npm_and_yarn&previous-version=4.17.15&new-version=4.17.20)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index e90e860dd6a17..bb2257d277c85 100644
--- a/site/package.json
+++ b/site/package.json
@@ -143,7 +143,7 @@
 		"@types/file-saver": "2.0.7",
 		"@types/humanize-duration": "3.27.4",
 		"@types/jest": "29.5.14",
-		"@types/lodash": "4.17.15",
+		"@types/lodash": "4.17.20",
 		"@types/node": "20.17.16",
 		"@types/react": "19.1.17",
 		"@types/react-color": "3.0.13",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index e2fdf68962550..20a93530895b6 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -339,8 +339,8 @@ importers:
         specifier: 29.5.14
         version: 29.5.14
       '@types/lodash':
-        specifier: 4.17.15
-        version: 4.17.15
+        specifier: 4.17.20
+        version: 4.17.20
       '@types/node':
         specifier: 20.17.16
         version: 20.17.16
@@ -2916,8 +2916,8 @@ packages:
   '@types/jsdom@20.0.1':
     resolution: {integrity: sha512-d0r18sZPmMQr1eG35u12FZfhIXNrnsPU/g5wvRKCUf/tOGilKKwYMYGqh33BNR6ba+2gkHw1EUiHoN3mn7E5IQ==, tarball: https://registry.npmjs.org/@types/jsdom/-/jsdom-20.0.1.tgz}
 
-  '@types/lodash@4.17.15':
-    resolution: {integrity: sha512-w/P33JFeySuhN6JLkysYUK2gEmy9kHHFN7E8ro0tkfmlDOgxBDzWEZ/J8cWA+fHqFevpswDTFZnDx+R9lbL6xw==, tarball: https://registry.npmjs.org/@types/lodash/-/lodash-4.17.15.tgz}
+  '@types/lodash@4.17.20':
+    resolution: {integrity: sha512-H3MHACvFUEiujabxhaI/ImO6gUrd8oOurg7LQtS7mbwIXA/cUqWrvBsaeJ23aZEPk1TAYkurjfMbSELfoCXlGA==, tarball: https://registry.npmjs.org/@types/lodash/-/lodash-4.17.20.tgz}
 
   '@types/mdast@4.0.3':
     resolution: {integrity: sha512-LsjtqsyF+d2/yFOYaN22dHZI1Cpwkrj+g06G8+qtUKlhovPW89YhqSnfKtMbkgmEtYpH2gydRNULd6y8mciAFg==, tarball: https://registry.npmjs.org/@types/mdast/-/mdast-4.0.3.tgz}
@@ -9145,7 +9145,7 @@ snapshots:
       '@types/tough-cookie': 4.0.2
       parse5: 7.1.2
 
-  '@types/lodash@4.17.15': {}
+  '@types/lodash@4.17.20': {}
 
   '@types/mdast@4.0.3':
     dependencies:

From cf8d7665e3feeae41082d7004466be182692ae35 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:50:53 +0000
Subject: [PATCH 022/298] chore: bump chroma-js from 2.4.2 to 2.6.0 in /site
 (#20123)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [chroma-js](https://github.com/gka/chroma.js) from 2.4.2 to 2.6.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gka/chroma.js/releases">chroma-js's
releases</a>.</em></p>
<blockquote>
<h2>v2.6.0</h2>
<h2>What's Changed</h2>
<ul>
<li>🎉 NEW: color.tint + color.shade (thanks to <a
href="https://github.com/tremby"><code>@​tremby</code></a> in <a
href="https://redirect.github.com/gka/chroma.js/pull/246">gka/chroma.js#246</a>)</li>
<li>fix: remove false w3c color cornflower (thanks to <a
href="https://github.com/friedPotat0"><code>@​friedPotat0</code></a> in
<a
href="https://redirect.github.com/gka/chroma.js/pull/298">gka/chroma.js#298</a>)</li>
<li>docs: replace website with archive by <a
href="https://github.com/Artoria2e5"><code>@​Artoria2e5</code></a> in <a
href="https://redirect.github.com/gka/chroma.js/pull/264">gka/chroma.js#264</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gka/chroma.js/compare/v2.5.0...v2.6.0">https://github.com/gka/chroma.js/compare/v2.5.0...v2.6.0</a></p>
<h2>v2.5.0</h2>
<h2>What's Changed</h2>
<ul>
<li>🎉 Big code refactoring to ES modules plus dependency and build setup
updates by <a href="https://github.com/gka"><code>@​gka</code></a> &amp;
<a href="https://github.com/zyyv"><code>@​zyyv</code></a> in <a
href="https://redirect.github.com/gka/chroma.js/pull/336">gka/chroma.js#336</a></li>
<li>Update 404 links in readme.md by <a
href="https://github.com/rdela"><code>@​rdela</code></a> in <a
href="https://redirect.github.com/gka/chroma.js/pull/326">gka/chroma.js#326</a></li>
<li>Update readme.md by <a
href="https://github.com/JiatLn"><code>@​JiatLn</code></a> in <a
href="https://redirect.github.com/gka/chroma.js/pull/307a.js/pull/336">gka/chroma.js#307</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/zyyv"><code>@​zyyv</code></a> made their
first contribution in <a
href="https://redirect.github.com/gka/chroma.js/pull/336">gka/chroma.js#336</a></li>
<li><a href="https://github.com/rdela"><code>@​rdela</code></a> made
their first contribution in <a
href="https://redirect.github.com/gka/chroma.js/pull/326">gka/chroma.js#326</a></li>
<li><a href="https://github.com/JiatLn"><code>@​JiatLn</code></a> made
their first contribution in <a
href="https://redirect.github.com/gka/chroma.js/pull/307">gka/chroma.js#307</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gka/chroma.js/compare/v2.3.0...v2.5.0">https://github.com/gka/chroma.js/compare/v2.3.0...v2.5.0</a></p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/gka/chroma.js/blob/main/CHANGELOG.md">chroma-js's
changelog</a>.</em></p>
<blockquote>
<h3>2.6.0</h3>
<ul>
<li>🎉 NEW: add <a
href="https://github.com/gka/chroma.js/blob/main%5Bhttps://github.com/gka/chroma.js/blob/main%60https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main.https://github.com/gka/chroma.js/blob/mainshttps://github.com/gka/chroma.js/blob/mainhhttps://github.com/gka/chroma.js/blob/mainahttps://github.com/gka/chroma.js/blob/maindhttps://github.com/gka/chroma.js/blob/mainehttps://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main%60https://github.com/gka/chroma.js/blob/main%5Dhttps://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main#https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main-https://github.com/gka/chroma.js/blob/mainshttps://github.com/gka/chroma.js/blob/mainhhttps://github.com/gka/chroma.js/blob/mainahttps://github.com/gka/chroma.js/blob/maindhttps://github.com/gka/chroma.js/blob/mainehttps://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main">https://github.com/gka/chroma.js/blob/main[https://github.com/gka/chroma.js/blob/main`https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main.https://github.com/gka/chroma.js/blob/mainshttps://github.com/gka/chroma.js/blob/mainhhttps://github.com/gka/chroma.js/blob/mainahttps://github.com/gka/chroma.js/blob/maindhttps://github.com/gka/chroma.js/blob/mainehttps://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main`https://github.com/gka/chroma.js/blob/main]https://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main#https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main-https://github.com/gka/chroma.js/blob/mainshttps://github.com/gka/chroma.js/blob/mainhhttps://github.com/gka/chroma.js/blob/mainahttps://github.com/gka/chroma.js/blob/maindhttps://github.com/gka/chroma.js/blob/mainehttps://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main</a>,
<a
href="https://github.com/gka/chroma.js/blob/main%5Bhttps://github.com/gka/chroma.js/blob/main%60https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main.https://github.com/gka/chroma.js/blob/mainthttps://github.com/gka/chroma.js/blob/mainihttps://github.com/gka/chroma.js/blob/mainnhttps://github.com/gka/chroma.js/blob/mainthttps://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main%60https://github.com/gka/chroma.js/blob/main%5Dhttps://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main#https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main-https://github.com/gka/chroma.js/blob/mainshttps://github.com/gka/chroma.js/blob/mainhhttps://github.com/gka/chroma.js/blob/mainahttps://github.com/gka/chroma.js/blob/maindhttps://github.com/gka/chroma.js/blob/mainehttps://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main">https://github.com/gka/chroma.js/blob/main[https://github.com/gka/chroma.js/blob/main`https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main.https://github.com/gka/chroma.js/blob/mainthttps://github.com/gka/chroma.js/blob/mainihttps://github.com/gka/chroma.js/blob/mainnhttps://github.com/gka/chroma.js/blob/mainthttps://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main`https://github.com/gka/chroma.js/blob/main]https://github.com/gka/chroma.js/blob/main(https://github.com/gka/chroma.js/blob/main#https://github.com/gka/chroma.js/blob/mainchttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainlhttps://github.com/gka/chroma.js/blob/mainohttps://github.com/gka/chroma.js/blob/mainrhttps://github.com/gka/chroma.js/blob/main-https://github.com/gka/chroma.js/blob/mainshttps://github.com/gka/chroma.js/blob/mainhhttps://github.com/gka/chroma.js/blob/mainahttps://github.com/gka/chroma.js/blob/maindhttps://github.com/gka/chroma.js/blob/mainehttps://github.com/gka/chroma.js/blob/main)https://github.com/gka/chroma.js/blob/main</a>.</li>
<li>fix: remove false w3c color cornflower</li>
</ul>
<h3>2.5.0</h3>
<ul>
<li>refactored code base to ES6 modules</li>
</ul>
<h3>2.4.0</h3>
<ul>
<li>add support for Oklab and Oklch color spaces</li>
</ul>
<h3>2.3.0</h3>
<ul>
<li>use binom of degree n in chroma.bezier</li>
</ul>
<h3>2.2.0</h3>
<ul>
<li>use Delta e2000 for chroma.deltaE <a
href="https://redirect.github.com/gka/chroma.js/issues/269">#269</a></li>
</ul>
<h3>2.0.3</h3>
<ul>
<li>hsl2rgb will, like other x2rgb conversions now set the default alpha
to 1</li>
</ul>
<h3>2.0.2</h3>
<ul>
<li>use a more mangle-safe check for Color class constructor to fix
issues with uglifyjs and terser</li>
</ul>
<h3>2.0.1</h3>
<ul>
<li>added <code>chroma.valid()</code> for checking if a color can be
parsed by chroma.js</li>
</ul>
<h3>2.0.0</h3>
<ul>
<li>chroma.js has been ported from CoffeeScript to ES6! This means you
can now import parts of chroma in your projects!</li>
<li>changed HCG input space from [0..360,0..100,0..100] to
[0..360,0..1,0..1] (to be in line with HSL)</li>
<li>added new object unpacking (e.g. <code>hsl2rgb({h,s,l})</code>)</li>
<li>changed default interpolation to <code>lrgb</code> in
mix/interpolate and average.</li>
<li>if colors can't be parsed correctly, chroma will now throw Errors
instead of silently failing with console.errors</li>
</ul>
<h3>1.4.1</h3>
<ul>
<li>chroma.scale() now interprets <code>null</code> as NaN and returns
the fallback color. Before it had interpreted <code>null</code> as
<code>0</code></li>
<li>added <code>scale.nodata()</code> to allow customizing the
previously hard-coded fallback (aka &quot;no data&quot;) color
#cccccc</li>
</ul>
<h3>1.4.0</h3>
<ul>
<li>color.hex() now automatically sets the mode to 'rgba' if the colors
alpha channel is &lt; 1. so
<code>chroma('rgba(255,0,0,.5)').hex()</code> will now return
<code>&quot;#ff000080&quot;</code> instead of
<code>&quot;#ff0000&quot;</code>. if this is not what you want, you must
explicitly set the mode to <code>rgb</code> using
<code>.hex(&quot;rgb&quot;)</code>.</li>
<li>bugfix in chroma.average in LRGB mode (<a
href="https://redirect.github.com/gka/chroma.js/issues/187">#187</a>)</li>
<li>chroma.scale now also works with just one color (<a
href="https://redirect.github.com/gka/chroma.js/issues/180">#180</a>)</li>
</ul>
<h3>1.3.5</h3>
<ul>
<li>added LRGB interpolation</li>
</ul>
<h3>1.3.4</h3>
<ul>
<li>passing <em>null</em> as mode in scale.colors will return chroma
objects</li>
</ul>
<h3>1.3.3</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/gka/chroma.js/commits/v2.6.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=chroma-js&package-manager=npm_and_yarn&previous-version=2.4.2&new-version=2.6.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index bb2257d277c85..71b790967dcfe 100644
--- a/site/package.json
+++ b/site/package.json
@@ -76,7 +76,7 @@
 		"@xterm/xterm": "5.5.0",
 		"ansi-to-html": "0.7.2",
 		"axios": "1.12.0",
-		"chroma-js": "2.4.2",
+		"chroma-js": "2.6.0",
 		"class-variance-authority": "0.7.1",
 		"clsx": "2.1.1",
 		"cmdk": "1.0.4",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 20a93530895b6..1b81ecdeb3be7 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -143,8 +143,8 @@ importers:
         specifier: 1.12.0
         version: 1.12.0
       chroma-js:
-        specifier: 2.4.2
-        version: 2.4.2
+        specifier: 2.6.0
+        version: 2.6.0
       class-variance-authority:
         specifier: 0.7.1
         version: 0.7.1
@@ -3459,8 +3459,8 @@ packages:
     resolution: {integrity: sha512-Qgzu8kfBvo+cA4962jnP1KkS6Dop5NS6g7R5LFYJr4b8Ub94PPQXUksCw9PvXoeXPRRddRNC5C1JQUR2SMGtnA==, tarball: https://registry.npmjs.org/chokidar/-/chokidar-4.0.3.tgz}
     engines: {node: '>= 14.16.0'}
 
-  chroma-js@2.4.2:
-    resolution: {integrity: sha512-U9eDw6+wt7V8z5NncY2jJfZa+hUH8XEj8FQHgFJTrUFnJfXYf4Ml4adI2vXZOjqRDpFWtYVWypDfZwnJ+HIR4A==, tarball: https://registry.npmjs.org/chroma-js/-/chroma-js-2.4.2.tgz}
+  chroma-js@2.6.0:
+    resolution: {integrity: sha512-BLHvCB9s8Z1EV4ethr6xnkl/P2YRFOGqfgvuMG/MyCbZPrTA+NeiByY6XvgF0zP4/2deU2CXnWyMa3zu1LqQ3A==, tarball: https://registry.npmjs.org/chroma-js/-/chroma-js-2.6.0.tgz}
 
   chromatic@11.29.0:
     resolution: {integrity: sha512-yisBlntp9hHVj19lIQdpTlcYIXuU9H/DbFuu6tyWHmj6hWT2EtukCCcxYXL78XdQt1vm2GfIrtgtKpj/Rzmo4A==, tarball: https://registry.npmjs.org/chromatic/-/chromatic-11.29.0.tgz}
@@ -9727,7 +9727,7 @@ snapshots:
     dependencies:
       readdirp: 4.1.2
 
-  chroma-js@2.4.2: {}
+  chroma-js@2.6.0: {}
 
   chromatic@11.29.0: {}
 

From b92a0f428c7574781e8c90f658b1dcc6d7728f05 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:51:24 +0000
Subject: [PATCH 023/298] chore: bump autoprefixer from 10.4.20 to 10.4.21 in
 /site (#20124)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [autoprefixer](https://github.com/postcss/autoprefixer) from
10.4.20 to 10.4.21.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/autoprefixer/releases">autoprefixer's
releases</a>.</em></p>
<blockquote>
<h2>10.4.21</h2>
<ul>
<li>Fixed old <code>-moz-</code> prefix for
<code>:placeholder-shown</code> (by <a
href="https://github.com/Marukome0743"><code>@​Marukome0743</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/autoprefixer/blob/main/CHANGELOG.md">autoprefixer's
changelog</a>.</em></p>
<blockquote>
<h2>10.4.21</h2>
<ul>
<li>Fixed old <code>-moz-</code> prefix for
<code>:placeholder-shown</code> (by <a
href="https://github.com/Marukome0743"><code>@​Marukome0743</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/autoprefixer/commit/541295c0e6dd348db2d3f52772b59cd403c59d29"><code>541295c</code></a>
Release 10.4.21 version</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/8d555f7e5e665d6a70e1d08db6e0bc9c4262db66"><code>8d555f7</code></a>
Update dependencies and sort imports</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/5c2421e82af45ee085d0806110fcef66bbebe59b"><code>5c2421e</code></a>
Update Node.js and pnpm on CI</li>
<li><a
href="https://github.com/postcss/autoprefixer/commit/af9cb5f365f66bf5169f1f42e08036651453b1a6"><code>af9cb5f</code></a>
fix: replace <code>:-moz-placeholder-shown</code> with
<code>:-moz-placeholder</code> (<a
href="https://redirect.github.com/postcss/autoprefixer/issues/1532">#1532</a>)</li>
<li>See full diff in <a
href="https://github.com/postcss/autoprefixer/compare/10.4.20...10.4.21">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=autoprefixer&package-manager=npm_and_yarn&previous-version=10.4.20&new-version=10.4.21)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 75 +++++++++++----------------------------------
 2 files changed, 19 insertions(+), 58 deletions(-)

diff --git a/site/package.json b/site/package.json
index 71b790967dcfe..bba60a5ada644 100644
--- a/site/package.json
+++ b/site/package.json
@@ -157,7 +157,7 @@
 		"@types/ua-parser-js": "0.7.36",
 		"@types/uuid": "9.0.2",
 		"@vitejs/plugin-react": "5.0.4",
-		"autoprefixer": "10.4.20",
+		"autoprefixer": "10.4.21",
 		"chromatic": "11.29.0",
 		"dpdm": "3.14.0",
 		"express": "4.21.2",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 1b81ecdeb3be7..3a9307d25701b 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -381,8 +381,8 @@ importers:
         specifier: 5.0.4
         version: 5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       autoprefixer:
-        specifier: 10.4.20
-        version: 10.4.20(postcss@8.5.1)
+        specifier: 10.4.21
+        version: 10.4.21(postcss@8.5.1)
       chromatic:
         specifier: 11.29.0
         version: 11.29.0
@@ -3257,8 +3257,8 @@ packages:
   asynckit@0.4.0:
     resolution: {integrity: sha512-Oei9OH4tRh0YqU3GxhX79dM/mwVgvbZJaSNaRk+bshkj0S5cfHcgYakreBjrHwatXKbz+IoIdYLxrKim2MjW0Q==, tarball: https://registry.npmjs.org/asynckit/-/asynckit-0.4.0.tgz}
 
-  autoprefixer@10.4.20:
-    resolution: {integrity: sha512-XY25y5xSv/wEoqzDyXXME4AFfkZI0P23z6Fs3YgymDnKJkCGOnkL0iTxCa85UTqaSgfcqyf3UA6+c7wUvx/16g==, tarball: https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.20.tgz}
+  autoprefixer@10.4.21:
+    resolution: {integrity: sha512-O+A6LWV5LDHSJD3LjHYoNi4VLsj/Whi7k6zG12xTYaU4cQ8oxQGckXNX8cRHK5yOZ/ppVHe0ZBXGzSV9jXdVbQ==, tarball: https://registry.npmjs.org/autoprefixer/-/autoprefixer-10.4.21.tgz}
     engines: {node: ^10 || ^12 || >=14}
     hasBin: true
     peerDependencies:
@@ -3309,8 +3309,8 @@ packages:
   base64-js@1.5.1:
     resolution: {integrity: sha512-AKpaYlHn8t4SVbOHCy+b5+KKgvR4vrsD8vbvrbiQJps7fKDTkjkDry6ji0rUJjC0kzbNePLwzxq8iypo41qeWA==, tarball: https://registry.npmjs.org/base64-js/-/base64-js-1.5.1.tgz}
 
-  baseline-browser-mapping@2.8.9:
-    resolution: {integrity: sha512-hY/u2lxLrbecMEWSB0IpGzGyDyeoMFQhCvZd2jGFSE5I17Fh01sYUBPCJtkWERw7zrac9+cIghxm/ytJa2X8iA==, tarball: https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.9.tgz}
+  baseline-browser-mapping@2.8.10:
+    resolution: {integrity: sha512-uLfgBi+7IBNay8ECBO2mVMGZAc1VgZWEChxm4lv+TobGdG82LnXMjuNGo/BSSZZL4UmkWhxEHP2f5ziLNwGWMA==, tarball: https://registry.npmjs.org/baseline-browser-mapping/-/baseline-browser-mapping-2.8.10.tgz}
     hasBin: true
 
   bcrypt-pbkdf@1.0.2:
@@ -3338,13 +3338,8 @@ packages:
     resolution: {integrity: sha512-yQbXgO/OSZVD2IsiLlro+7Hf6Q18EJrKSEsdoMzKePKXct3gvD8oLcOQdIzGupr5Fj+EDe8gO/lxc1BzfMpxvA==, tarball: https://registry.npmjs.org/braces/-/braces-3.0.3.tgz}
     engines: {node: '>=8'}
 
-  browserslist@4.24.2:
-    resolution: {integrity: sha512-ZIc+Q62revdMcqC6aChtW4jz3My3klmCO1fEmINZY/8J3EpBg5/A/D0AKmBveUh6pgoeycoMkVMko84tuYS+Gg==, tarball: https://registry.npmjs.org/browserslist/-/browserslist-4.24.2.tgz}
-    engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
-    hasBin: true
-
-  browserslist@4.26.2:
-    resolution: {integrity: sha512-ECFzp6uFOSB+dcZ5BK/IBaGWssbSYBHvuMeMt3MMFyhI0Z8SqGgEkBLARgpRH3hutIgPVsALcMwbDrJqPxQ65A==, tarball: https://registry.npmjs.org/browserslist/-/browserslist-4.26.2.tgz}
+  browserslist@4.26.3:
+    resolution: {integrity: sha512-lAUU+02RFBuCKQPj/P6NgjlbCnLBMp4UtgTx7vNHd3XSIJF87s9a5rA3aH2yw3GS9DqZAUbOtZdCCiZeVRqt0w==, tarball: https://registry.npmjs.org/browserslist/-/browserslist-4.26.3.tgz}
     engines: {node: ^6 || ^7 || ^8 || ^9 || ^10 || ^11 || ^12 || >=13.7}
     hasBin: true
 
@@ -3397,9 +3392,6 @@ packages:
     resolution: {integrity: sha512-Gmy6FhYlCY7uOElZUSbxo2UCDH8owEk996gkbrpsgGtrJLM3J7jGxl9Ic7Qwwj4ivOE5AWZWRMecDdF7hqGjFA==, tarball: https://registry.npmjs.org/camelcase/-/camelcase-6.3.0.tgz}
     engines: {node: '>=10'}
 
-  caniuse-lite@1.0.30001717:
-    resolution: {integrity: sha512-auPpttCq6BDEG8ZAuHJIplGw6GODhjw+/11e7IjpnYCxZcW/ONgPs0KVBJ0d1bY3e2+7PRe5RCLyP+PfwVgkYw==, tarball: https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001717.tgz}
-
   caniuse-lite@1.0.30001746:
     resolution: {integrity: sha512-eA7Ys/DGw+pnkWWSE/id29f2IcPHVoE8wxtvE5JdvD2V28VTDPy1yEeo11Guz0sJ4ZeGRcm3uaTcAqK1LXaphA==, tarball: https://registry.npmjs.org/caniuse-lite/-/caniuse-lite-1.0.30001746.tgz}
 
@@ -3868,9 +3860,6 @@ packages:
   electron-to-chromium@1.5.228:
     resolution: {integrity: sha512-nxkiyuqAn4MJ1QbobwqJILiDtu/jk14hEAWaMiJmNPh1Z+jqoFlBFZjdXwLWGeVSeu9hGLg6+2G9yJaW8rBIFA==, tarball: https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.228.tgz}
 
-  electron-to-chromium@1.5.50:
-    resolution: {integrity: sha512-eMVObiUQ2LdgeO1F/ySTXsvqvxb6ZH2zPGaMYsWzRDdOddUa77tdmI0ltg+L16UpbWdhPmuF3wIQYyQq65WfZw==, tarball: https://registry.npmjs.org/electron-to-chromium/-/electron-to-chromium-1.5.50.tgz}
-
   emittery@0.13.1:
     resolution: {integrity: sha512-DeWwawk6r5yR9jFgnDKYt4sLS0LmHJJi3ZOnb5/JdbYwj3nW+FxQnHIjhBKz8YLC7oRNPVM9NQ47I3CVx34eqQ==, tarball: https://registry.npmjs.org/emittery/-/emittery-0.13.1.tgz}
     engines: {node: '>=12'}
@@ -5250,9 +5239,6 @@ packages:
   node-int64@0.4.0:
     resolution: {integrity: sha512-O5lz91xSOeoXP6DulyHfllpq+Eg00MWitZIbtPfoSEvqIHdl5gfcY6hYzDWnj0qD5tz52PI08u9qUvSVeUBeHw==, tarball: https://registry.npmjs.org/node-int64/-/node-int64-0.4.0.tgz}
 
-  node-releases@2.0.18:
-    resolution: {integrity: sha512-d9VeXT4SJ7ZeOqGX6R5EM022wpL+eWPooLI+5UpWn2jCT1aosUQEhQP214x33Wkwx3JQMvIm+tIoVOdodFS40g==, tarball: https://registry.npmjs.org/node-releases/-/node-releases-2.0.18.tgz}
-
   node-releases@2.0.21:
     resolution: {integrity: sha512-5b0pgg78U3hwXkCM8Z9b2FJdPZlr9Psr9V2gQPESdGHqbntyFJKFW4r5TeWGFzafGY3hzs1JC62VEQMbl1JFkw==, tarball: https://registry.npmjs.org/node-releases/-/node-releases-2.0.21.tgz}
 
@@ -6383,12 +6369,6 @@ packages:
   unplugin@1.5.0:
     resolution: {integrity: sha512-9ZdRwbh/4gcm1JTOkp9lAkIDrtOyOxgHmY7cjuwI8L/2RTikMcVG25GsZwNAgRuap3iDw2jeq7eoqtAsz5rW3A==, tarball: https://registry.npmjs.org/unplugin/-/unplugin-1.5.0.tgz}
 
-  update-browserslist-db@1.1.1:
-    resolution: {integrity: sha512-R8UzCaa9Az+38REPiJ1tXlImTJXlVfgHZsglwBD/k6nj76ctsH1E3q4doGrukiLQd3sGQYu56r5+lo5r94l29A==, tarball: https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.1.tgz}
-    hasBin: true
-    peerDependencies:
-      browserslist: '>= 4.21.0'
-
   update-browserslist-db@1.1.3:
     resolution: {integrity: sha512-UxhIZQ+QInVdunkDAaiazvvT/+fXL5Osr0JZlJulepYu6Jd7qJtDZjlur0emRlT71EN3ScPoE7gvsuIKKNavKw==, tarball: https://registry.npmjs.org/update-browserslist-db/-/update-browserslist-db-1.1.3.tgz}
     hasBin: true
@@ -6771,7 +6751,7 @@ snapshots:
     dependencies:
       '@babel/compat-data': 7.28.4
       '@babel/helper-validator-option': 7.27.1
-      browserslist: 4.26.2
+      browserslist: 4.26.3
       lru-cache: 5.1.1
       semver: 7.7.2
 
@@ -9470,10 +9450,10 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  autoprefixer@10.4.20(postcss@8.5.1):
+  autoprefixer@10.4.21(postcss@8.5.1):
     dependencies:
-      browserslist: 4.24.2
-      caniuse-lite: 1.0.30001717
+      browserslist: 4.26.3
+      caniuse-lite: 1.0.30001746
       fraction.js: 4.3.7
       normalize-range: 0.1.2
       picocolors: 1.1.1
@@ -9559,7 +9539,7 @@ snapshots:
 
   base64-js@1.5.1: {}
 
-  baseline-browser-mapping@2.8.9: {}
+  baseline-browser-mapping@2.8.10: {}
 
   bcrypt-pbkdf@1.0.2:
     dependencies:
@@ -9603,20 +9583,13 @@ snapshots:
     dependencies:
       fill-range: 7.1.1
 
-  browserslist@4.24.2:
-    dependencies:
-      caniuse-lite: 1.0.30001717
-      electron-to-chromium: 1.5.50
-      node-releases: 2.0.18
-      update-browserslist-db: 1.1.1(browserslist@4.24.2)
-
-  browserslist@4.26.2:
+  browserslist@4.26.3:
     dependencies:
-      baseline-browser-mapping: 2.8.9
+      baseline-browser-mapping: 2.8.10
       caniuse-lite: 1.0.30001746
       electron-to-chromium: 1.5.228
       node-releases: 2.0.21
-      update-browserslist-db: 1.1.3(browserslist@4.26.2)
+      update-browserslist-db: 1.1.3(browserslist@4.26.3)
 
   bser@2.1.1:
     dependencies:
@@ -9667,8 +9640,6 @@ snapshots:
 
   camelcase@6.3.0: {}
 
-  caniuse-lite@1.0.30001717: {}
-
   caniuse-lite@1.0.30001746: {}
 
   case-anything@2.1.13: {}
@@ -10079,8 +10050,6 @@ snapshots:
 
   electron-to-chromium@1.5.228: {}
 
-  electron-to-chromium@1.5.50: {}
-
   emittery@0.13.1: {}
 
   emoji-mart@5.6.0: {}
@@ -12099,8 +12068,6 @@ snapshots:
 
   node-int64@0.4.0: {}
 
-  node-releases@2.0.18: {}
-
   node-releases@2.0.21: {}
 
   normalize-path@3.0.0: {}
@@ -13361,15 +13328,9 @@ snapshots:
       webpack-sources: 3.2.3
       webpack-virtual-modules: 0.5.0
 
-  update-browserslist-db@1.1.1(browserslist@4.24.2):
-    dependencies:
-      browserslist: 4.24.2
-      escalade: 3.2.0
-      picocolors: 1.1.1
-
-  update-browserslist-db@1.1.3(browserslist@4.26.2):
+  update-browserslist-db@1.1.3(browserslist@4.26.3):
     dependencies:
-      browserslist: 4.26.2
+      browserslist: 4.26.3
       escalade: 3.2.0
       picocolors: 1.1.1
 

From e89c7cdcef17e1437e96b5c11b67e04177301b21 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:51:43 +0000
Subject: [PATCH 024/298] chore: bump @fontsource/ibm-plex-mono from 5.1.1 to
 5.2.7 in /site (#20127)

Bumps
[@fontsource/ibm-plex-mono](https://github.com/fontsource/font-files/tree/HEAD/fonts/google/ibm-plex-mono)
from 5.1.1 to 5.2.7.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/fontsource/font-files/commits/HEAD/fonts/google/ibm-plex-mono">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@fontsource/ibm-plex-mono&package-manager=npm_and_yarn&previous-version=5.1.1&new-version=5.2.7)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index bba60a5ada644..cfa5718b11637 100644
--- a/site/package.json
+++ b/site/package.json
@@ -43,7 +43,7 @@
 		"@emotion/styled": "11.14.1",
 		"@fontsource-variable/inter": "5.1.1",
 		"@fontsource/fira-code": "5.2.7",
-		"@fontsource/ibm-plex-mono": "5.1.1",
+		"@fontsource/ibm-plex-mono": "5.2.7",
 		"@fontsource/jetbrains-mono": "5.2.5",
 		"@fontsource/source-code-pro": "5.2.5",
 		"@monaco-editor/react": "4.7.0",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 3a9307d25701b..acc08688be6eb 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -44,8 +44,8 @@ importers:
         specifier: 5.2.7
         version: 5.2.7
       '@fontsource/ibm-plex-mono':
-        specifier: 5.1.1
-        version: 5.1.1
+        specifier: 5.2.7
+        version: 5.2.7
       '@fontsource/jetbrains-mono':
         specifier: 5.2.5
         version: 5.2.5
@@ -1165,8 +1165,8 @@ packages:
   '@fontsource/fira-code@5.2.7':
     resolution: {integrity: sha512-tnB9NNund9TwIym8/7DMJe573nlPEQb+fKUV5GL8TBYXjIhDvL0D7mgmNVNQUPhXp+R7RylQeiBdkA4EbOHPGQ==, tarball: https://registry.npmjs.org/@fontsource/fira-code/-/fira-code-5.2.7.tgz}
 
-  '@fontsource/ibm-plex-mono@5.1.1':
-    resolution: {integrity: sha512-1aayqPe/ZkD3MlvqpmOHecfA3f2B8g+fAEkgvcCd3lkPP0pS1T0xG5Zmn2EsJQqr1JURtugPUH+5NqvKyfFZMQ==, tarball: https://registry.npmjs.org/@fontsource/ibm-plex-mono/-/ibm-plex-mono-5.1.1.tgz}
+  '@fontsource/ibm-plex-mono@5.2.7':
+    resolution: {integrity: sha512-MKAb8qV+CaiMQn2B0dIi1OV3565NYzp3WN5b4oT6LTkk+F0jR6j0ZN+5BKJiIhffDC3rtBULsYZE65+0018z9w==, tarball: https://registry.npmjs.org/@fontsource/ibm-plex-mono/-/ibm-plex-mono-5.2.7.tgz}
 
   '@fontsource/jetbrains-mono@5.2.5':
     resolution: {integrity: sha512-TPZ9b/uq38RMdrlZZkl0RwN8Ju9JxuqMETrw76pUQFbGtE1QbwQaNsLlnUrACNNBNbd0NZRXiJJSkC8ajPgbew==, tarball: https://registry.npmjs.org/@fontsource/jetbrains-mono/-/jetbrains-mono-5.2.5.tgz}
@@ -7330,7 +7330,7 @@ snapshots:
 
   '@fontsource/fira-code@5.2.7': {}
 
-  '@fontsource/ibm-plex-mono@5.1.1': {}
+  '@fontsource/ibm-plex-mono@5.2.7': {}
 
   '@fontsource/jetbrains-mono@5.2.5': {}
 

From b68c648476f623ef5935865a0bcb1067a782239a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:51:57 +0000
Subject: [PATCH 025/298] chore: bump react-resizable-panels from 3.0.3 to
 3.0.6 in /site (#20125)

Bumps
[react-resizable-panels](https://github.com/bvaughn/react-resizable-panels)
from 3.0.3 to 3.0.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-resizable-panels/releases">react-resizable-panels's
releases</a>.</em></p>
<blockquote>
<h2>3.0.6</h2>
<ul>
<li><a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/517">#517</a>:
Fixed Firefox bug that caused resizing to be interrupted unexpected</li>
</ul>
<h2>3.0.5</h2>
<ul>
<li><a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/512">#512</a>:
Fixed size precision regression from 2.0.17</li>
</ul>
<h2>3.0.4</h2>
<ul>
<li><a
href="https://redirect.github.com/bvaughn/react-resizable-panels/pull/503">#503</a>:
Support custom cursors</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/43a071df6bb96d54e8b81a6be0e2d453af45cc4b"><code>43a071d</code></a>
3.0.5 -&gt; 3.0.6</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/2bb5e969431581f57f6507726ca26998f5d25663"><code>2bb5e96</code></a>
Fix Firefox drag bug (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/517">#517</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/f65a4815c73d43ae884c0465d59da76991f4d14e"><code>f65a481</code></a>
3.0.4 -&gt; 3.0.5</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/0bfe50b08535970513c1b4d91d23f3d223fb24f0"><code>0bfe50b</code></a>
Prettier</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/25c91ac9d77db5c6e00f3d19690cd3780e431289"><code>25c91ac</code></a>
reintroduce toFixed changes from 2.0.16 removed in 2.0.17 (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/512">#512</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/97b6d482f5d83da1f561874619eff95026efee6f"><code>97b6d48</code></a>
Update Code Sandbox link</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/45300ec4463da75caa2147243e16de19c4183d33"><code>45300ec</code></a>
Remove duplication in Panel component's Imperative API docs. (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/511">#511</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/8d426e7fbddf2a6fe1c5e9e6c91f23ea30107ce0"><code>8d426e7</code></a>
Fix typo in README.md (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/509">#509</a>)</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/5af2d8d030a034e9295bc31d8229f70004dd2e25"><code>5af2d8d</code></a>
3.0.3 -&gt; 3.0.4</li>
<li><a
href="https://github.com/bvaughn/react-resizable-panels/commit/9b69a44a1f32657a9c6e2d41b73153814909e9a7"><code>9b69a44</code></a>
Support custom cursors (<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/503">#503</a>)
(<a
href="https://redirect.github.com/bvaughn/react-resizable-panels/issues/504">#504</a>)</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-resizable-panels/compare/3.0.3...3.0.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-resizable-panels&package-manager=npm_and_yarn&previous-version=3.0.3&new-version=3.0.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index cfa5718b11637..d3c30a7a4dce7 100644
--- a/site/package.json
+++ b/site/package.json
@@ -101,7 +101,7 @@
 		"react-dom": "19.1.1",
 		"react-markdown": "9.1.0",
 		"react-query": "npm:@tanstack/react-query@5.77.0",
-		"react-resizable-panels": "3.0.3",
+		"react-resizable-panels": "3.0.6",
 		"react-router": "7.8.0",
 		"react-syntax-highlighter": "15.6.1",
 		"react-textarea-autosize": "8.5.9",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index acc08688be6eb..7d88aef2ab9b7 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -218,8 +218,8 @@ importers:
         specifier: npm:@tanstack/react-query@5.77.0
         version: '@tanstack/react-query@5.77.0(react@19.1.1)'
       react-resizable-panels:
-        specifier: 3.0.3
-        version: 3.0.3(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: 3.0.6
+        version: 3.0.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react-router:
         specifier: 7.8.0
         version: 7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -5685,8 +5685,8 @@ packages:
       '@types/react':
         optional: true
 
-  react-resizable-panels@3.0.3:
-    resolution: {integrity: sha512-7HA8THVBHTzhDK4ON0tvlGXyMAJN1zBeRpuyyremSikgYh2ku6ltD7tsGQOcXx4NKPrZtYCm/5CBr+dkruTGQw==, tarball: https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-3.0.3.tgz}
+  react-resizable-panels@3.0.6:
+    resolution: {integrity: sha512-b3qKHQ3MLqOgSS+FRYKapNkJZf5EQzuf6+RLiq1/IlTHw99YrZ2NJZLk4hQIzTnnIkRg2LUqyVinu6YWWpUYew==, tarball: https://registry.npmjs.org/react-resizable-panels/-/react-resizable-panels-3.0.6.tgz}
     peerDependencies:
       react: ^16.14.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
       react-dom: ^16.14.0 || ^17.0.0 || ^18.0.0 || ^19.0.0 || ^19.0.0-rc
@@ -12544,7 +12544,7 @@ snapshots:
     optionalDependencies:
       '@types/react': 19.1.17
 
-  react-resizable-panels@3.0.3(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-resizable-panels@3.0.6(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)

From f05ccfe525763e8abbd3baf64375c6cc60cd9b56 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:57:46 +0000
Subject: [PATCH 026/298] chore: bump postcss from 8.5.1 to 8.5.6 in /site
 (#20113)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [postcss](https://github.com/postcss/postcss) from 8.5.1 to 8.5.6.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/releases">postcss's
releases</a>.</em></p>
<blockquote>
<h2>8.5.6</h2>
<ul>
<li>Fixed <code>ContainerWithChildren</code> type discriminating (by <a
href="https://github.com/Goodwine"><code>@​Goodwine</code></a>).</li>
</ul>
<h2>8.5.5</h2>
<ul>
<li>Fixed <code>package.json</code>→<code>exports</code> compatibility
with some tools (by <a
href="https://github.com/JounQin"><code>@​JounQin</code></a>).</li>
</ul>
<h2>8.5.4</h2>
<ul>
<li>Fixed Parcel compatibility issue (by <a
href="https://github.com/git-sumitchaudhary"><code>@​git-sumitchaudhary</code></a>).</li>
</ul>
<h2>8.5.3</h2>
<ul>
<li>Added more details to <code>Unknown word</code> error (by <a
href="https://github.com/hiepxanh"><code>@​hiepxanh</code></a>).</li>
<li>Fixed types (by <a
href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
<li>Fixed docs (by <a
href="https://github.com/catnipan"><code>@​catnipan</code></a>).</li>
</ul>
<h2>8.5.2</h2>
<ul>
<li>Fixed end position of rules with semicolon (by <a
href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/postcss/postcss/blob/main/CHANGELOG.md">postcss's
changelog</a>.</em></p>
<blockquote>
<h2>8.5.6</h2>
<ul>
<li>Fixed <code>ContainerWithChildren</code> type discriminating (by <a
href="https://github.com/Goodwine"><code>@​Goodwine</code></a>).</li>
</ul>
<h2>8.5.5</h2>
<ul>
<li>Fixed <code>package.json</code>→<code>exports</code> compatibility
with some tools (by <a
href="https://github.com/JounQin"><code>@​JounQin</code></a>).</li>
</ul>
<h2>8.5.4</h2>
<ul>
<li>Fixed Parcel compatibility issue (by <a
href="https://github.com/git-sumitchaudhary"><code>@​git-sumitchaudhary</code></a>).</li>
</ul>
<h2>8.5.3</h2>
<ul>
<li>Added more details to <code>Unknown word</code> error (by <a
href="https://github.com/hiepxanh"><code>@​hiepxanh</code></a>).</li>
<li>Fixed types (by <a
href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
<li>Fixed docs (by <a
href="https://github.com/catnipan"><code>@​catnipan</code></a>).</li>
</ul>
<h2>8.5.2</h2>
<ul>
<li>Fixed end position of rules with semicolon (by <a
href="https://github.com/romainmenke"><code>@​romainmenke</code></a>).</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/postcss/postcss/commit/91d6eb5c3d1ca8acb4e8e3926005acf2b066c211"><code>91d6eb5</code></a>
Release 8.5.6 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/65ffc55117bf4289b1f977986ed76fad402641b1"><code>65ffc55</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/ecd20eb7f9587d63e3f3348b768aec0e9fb000d3"><code>ecd20eb</code></a>
Fix ContainerWithChildren to allow discriminating the node type by
comparing ...</li>
<li><a
href="https://github.com/postcss/postcss/commit/c18159719e4a6d65ad7085edf1dc42e07814f683"><code>c181597</code></a>
Release 8.5.5 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/c5523fbec5f32622e77103c643e1258007c2609d"><code>c5523fb</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/2e3450c55f41e378e086f4f189e5243a573c3390"><code>2e3450c</code></a>
refactor: <code>import</code> should be listed before
<code>require</code> (<a
href="https://redirect.github.com/postcss/postcss/issues/2052">#2052</a>)</li>
<li><a
href="https://github.com/postcss/postcss/commit/4d720bd01adec2e8645bf91e725825bebb712e1b"><code>4d720bd</code></a>
Update EM text</li>
<li><a
href="https://github.com/postcss/postcss/commit/6cb4a6673fb6d8b23eb1ebe66a22b6267ab141de"><code>6cb4a66</code></a>
Release 8.5.4 version</li>
<li><a
href="https://github.com/postcss/postcss/commit/ec5c1e031083664bed1cf91eaac72f8c61068110"><code>ec5c1e0</code></a>
Update dependencies</li>
<li><a
href="https://github.com/postcss/postcss/commit/e85e9385c87499bc7e274c6ce332cf59e3988994"><code>e85e938</code></a>
Fix code format</li>
<li>Additional commits viewable in <a
href="https://github.com/postcss/postcss/compare/8.5.1...8.5.6">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=postcss&package-manager=npm_and_yarn&previous-version=8.5.1&new-version=8.5.6)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 53 +++++++++++++++------------------------------
 2 files changed, 19 insertions(+), 36 deletions(-)

diff --git a/site/package.json b/site/package.json
index d3c30a7a4dce7..500bc7d41d539 100644
--- a/site/package.json
+++ b/site/package.json
@@ -170,7 +170,7 @@
 		"jest_workaround": "0.1.14",
 		"knip": "5.64.1",
 		"msw": "2.4.8",
-		"postcss": "8.5.1",
+		"postcss": "8.5.6",
 		"protobufjs": "7.4.0",
 		"rollup-plugin-visualizer": "5.14.0",
 		"rxjs": "7.8.1",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 7d88aef2ab9b7..072598486cbab 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -382,7 +382,7 @@ importers:
         version: 5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       autoprefixer:
         specifier: 10.4.21
-        version: 10.4.21(postcss@8.5.1)
+        version: 10.4.21(postcss@8.5.6)
       chromatic:
         specifier: 11.29.0
         version: 11.29.0
@@ -420,8 +420,8 @@ importers:
         specifier: 2.4.8
         version: 2.4.8(typescript@5.6.3)
       postcss:
-        specifier: 8.5.1
-        version: 8.5.1
+        specifier: 8.5.6
+        version: 8.5.6
       protobufjs:
         specifier: 7.4.0
         version: 7.4.0
@@ -5219,11 +5219,6 @@ packages:
     engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
     hasBin: true
 
-  nanoid@3.3.8:
-    resolution: {integrity: sha512-WNLf5Sd8oZxOm+TzppcYk8gVOgP+l58xNy58D0nbUnOxOWRWvlcCV4kUF7ltmI6PsrLl/BgKEyS4mqsGChFN0w==, tarball: https://registry.npmjs.org/nanoid/-/nanoid-3.3.8.tgz}
-    engines: {node: ^10 || ^12 || ^13.7 || ^14 || >=15.0.1}
-    hasBin: true
-
   napi-postinstall@0.3.3:
     resolution: {integrity: sha512-uTp172LLXSxuSYHv/kou+f6KW3SMppU9ivthaVTXian9sOt3XM/zHYHpRZiLgQoxeWfYUnslNWQHF1+G71xcow==, tarball: https://registry.npmjs.org/napi-postinstall/-/napi-postinstall-0.3.3.tgz}
     engines: {node: ^12.20.0 || ^14.18.0 || >=16.0.0}
@@ -5498,10 +5493,6 @@ packages:
   postcss-value-parser@4.2.0:
     resolution: {integrity: sha512-1NNCs6uurfkVbeXG4S8JFT9t19m45ICnif8zWLd5oPSZ50QnwMfK+H3jv408d4jw/7Bttv5axS5IiHoLaVNHeQ==, tarball: https://registry.npmjs.org/postcss-value-parser/-/postcss-value-parser-4.2.0.tgz}
 
-  postcss@8.5.1:
-    resolution: {integrity: sha512-6oz2beyjc5VMn/KV1pPw8fliQkhBXrVn1Z3TVyqZxU8kZpzEKhBdmCFqI6ZbmGtamQvQGuU1sgPTk8ZrXDD7jQ==, tarball: https://registry.npmjs.org/postcss/-/postcss-8.5.1.tgz}
-    engines: {node: ^10 || ^12 || >=14}
-
   postcss@8.5.6:
     resolution: {integrity: sha512-3Ybi1tAuwAP9s0r1UQ2J4n5Y0G05bJkpUIO0/bI9MhwmD70S5aTWbXGBwxHrelT+XM1k6dM0pk+SwNkpTRN7Pg==, tarball: https://registry.npmjs.org/postcss/-/postcss-8.5.6.tgz}
     engines: {node: ^10 || ^12 || >=14}
@@ -9450,14 +9441,14 @@ snapshots:
 
   asynckit@0.4.0: {}
 
-  autoprefixer@10.4.21(postcss@8.5.1):
+  autoprefixer@10.4.21(postcss@8.5.6):
     dependencies:
       browserslist: 4.26.3
       caniuse-lite: 1.0.30001746
       fraction.js: 4.3.7
       normalize-range: 0.1.2
       picocolors: 1.1.1
-      postcss: 8.5.1
+      postcss: 8.5.6
       postcss-value-parser: 4.2.0
 
   available-typed-arrays@1.0.7:
@@ -12058,8 +12049,6 @@ snapshots:
 
   nanoid@3.3.11: {}
 
-  nanoid@3.3.8: {}
-
   napi-postinstall@0.3.3: {}
 
   natural-compare@1.4.0: {}
@@ -12289,29 +12278,29 @@ snapshots:
 
   possible-typed-array-names@1.0.0: {}
 
-  postcss-import@15.1.0(postcss@8.5.1):
+  postcss-import@15.1.0(postcss@8.5.6):
     dependencies:
-      postcss: 8.5.1
+      postcss: 8.5.6
       postcss-value-parser: 4.2.0
       read-cache: 1.0.0
       resolve: 1.22.10
 
-  postcss-js@4.1.0(postcss@8.5.1):
+  postcss-js@4.1.0(postcss@8.5.6):
     dependencies:
       camelcase-css: 2.0.1
-      postcss: 8.5.1
+      postcss: 8.5.6
 
-  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.1)(yaml@2.7.0):
+  postcss-load-config@6.0.1(jiti@1.21.7)(postcss@8.5.6)(yaml@2.7.0):
     dependencies:
       lilconfig: 3.1.3
     optionalDependencies:
       jiti: 1.21.7
-      postcss: 8.5.1
+      postcss: 8.5.6
       yaml: 2.7.0
 
-  postcss-nested@6.2.0(postcss@8.5.1):
+  postcss-nested@6.2.0(postcss@8.5.6):
     dependencies:
-      postcss: 8.5.1
+      postcss: 8.5.6
       postcss-selector-parser: 6.1.2
 
   postcss-selector-parser@6.0.10:
@@ -12326,12 +12315,6 @@ snapshots:
 
   postcss-value-parser@4.2.0: {}
 
-  postcss@8.5.1:
-    dependencies:
-      nanoid: 3.3.8
-      picocolors: 1.1.1
-      source-map-js: 1.2.1
-
   postcss@8.5.6:
     dependencies:
       nanoid: 3.3.11
@@ -13103,11 +13086,11 @@ snapshots:
       normalize-path: 3.0.0
       object-hash: 3.0.0
       picocolors: 1.1.1
-      postcss: 8.5.1
-      postcss-import: 15.1.0(postcss@8.5.1)
-      postcss-js: 4.1.0(postcss@8.5.1)
-      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.1)(yaml@2.7.0)
-      postcss-nested: 6.2.0(postcss@8.5.1)
+      postcss: 8.5.6
+      postcss-import: 15.1.0(postcss@8.5.6)
+      postcss-js: 4.1.0(postcss@8.5.6)
+      postcss-load-config: 6.0.1(jiti@1.21.7)(postcss@8.5.6)(yaml@2.7.0)
+      postcss-nested: 6.2.0(postcss@8.5.6)
       postcss-selector-parser: 6.1.2
       resolve: 1.22.10
       sucrase: 3.35.0

From 0993dcfef7e80d442aa2f76aaedaf97187e5e594 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 19:57:55 +0000
Subject: [PATCH 027/298] chore: bump monaco-editor from 0.52.2 to 0.53.0 in
 /site (#20120)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [monaco-editor](https://github.com/microsoft/monaco-editor) from
0.52.2 to 0.53.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/monaco-editor/releases">monaco-editor's
releases</a>.</em></p>
<blockquote>
<h2>v0.53.0</h2>
<h2>Changes:</h2>
<ul>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4980">#4980</a>:
sets node version</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4979">#4979</a>:
v0.53.0</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4978">#4978</a>:
updates changelog</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4975">#4975</a>:
Fixes worker sandbox problems</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4969">#4969</a>:
Implements language selection</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4967">#4967</a>:
adds amd and firefox/webkit to smoke tests</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4966">#4966</a>:
Fixes AMD web worker loading</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4965">#4965</a>:
Updates monaco-editor-core dependency &amp; fixes basic-languages amd
file</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4964">#4964</a>:
Run npm run playwright-install</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4963">#4963</a>:
Hediet/b/successful mosquito</li>
</ul>
<!-- raw HTML omitted -->
<ul>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4962">#4962</a>:
Fixes node version</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4950">#4950</a>:
ESM Progress</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4913">#4913</a>:
Bump webpack-dev-server from 4.10.0 to 5.2.1 in /samples</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4915">#4915</a>:
Add snowflake sql keywords</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4895">#4895</a>:
Fixes <a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4799">microsoft/monaco-editor#4799</a></li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4742">#4742</a>:
Update webpack plugin to support module workers</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4824">#4824</a>:
Fix CI and website workflows</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4747">#4747</a>:
Engineering - add dependsOn field</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4734">#4734</a>:
Bump express from 4.19.2 to 4.21.1 in /website</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4616">#4616</a>:
Bump requirejs from 2.3.6 to 2.3.7</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4668">#4668</a>:
Bump micromatch from 4.0.5 to 4.0.8 in /website</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4726">#4726</a>:
Bump http-proxy-middleware from 2.0.6 to 2.0.7 in /website</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4595">#4595</a>:
Bump ws from 8.8.1 to 8.18.0 in /samples</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4697">#4697</a>:
Bump body-parser and express in /samples</li>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4696">#4696</a>:
Bump rollup from 2.79.1 to 2.79.2</li>
</ul>
<p>This list of changes was <a
href="https://dev.azure.com/monacotools/Monaco/_build/results?buildId=356772&amp;view=logs">auto
generated</a>.<!-- raw HTML omitted --></p>
<h2>v0.53.0-rc2</h2>
<p>No release notes provided.</p>
<h2>v0.53.0-dev-20250908</h2>
<p>No release notes provided.</p>
<h2>v0.53.0-dev-20250907</h2>
<p>No release notes provided.</p>
<h2>v0.53.0-dev-20250906</h2>
<h2>Changes:</h2>
<ul>
<li><a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4978">#4978</a>:
updates changelog</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/microsoft/monaco-editor/blob/main/CHANGELOG.md">monaco-editor's
changelog</a>.</em></p>
<blockquote>
<h2>[0.53.0]</h2>
<ul>
<li>:warning: This release deprecates the AMD build and ships with
significant changes of the AMD build. The AMD build will still be
shipped for a while, but we don't offer support for it anymore. Please
migrate to the ESM build.</li>
</ul>
<h3>New Features</h3>
<ul>
<li>Next Edit Suggestion support.</li>
<li>Scroll On Middle Click</li>
<li>Edit Context Support</li>
</ul>
<h3>Breaking Changes</h3>
<ul>
<li>Internal AMD modules are no longer accessible. Accessing internal
AMD modules was never supported. While this is still possible in the ESM
build, we don't encourage this usage pattern.</li>
<li>The <a
href="https://github.com/microsoft/monaco-editor/blob/a4d7907bd439b06b24e334bdf2ab597bcae658b5/samples/browser-script-editor/index.html">browser-script-editor
scenario</a> for unbundled synchronous script import and editor creation
no longer works. Instead, a the ESM build should be used with a bundler,
such as vite or webpack.</li>
<li>Custom AMD workers don't work anymore out of the box.</li>
</ul>
<h2>[0.52.0]</h2>
<ul>
<li>Comment added inside of <code>IModelContentChangedEvent</code></li>
</ul>
<h2>[0.51.0]</h2>
<ul>
<li>New fields <code>IEditorOptions.placeholder</code> and
<code>IEditorOptions.compactMode</code></li>
<li>New fields <code>IGotoLocationOptions.multipleTests</code> and
<code>IGotoLocationOptions.alternativeTestsCommand</code></li>
<li>New field <code>IInlineEditOptions.backgroundColoring</code></li>
<li>New experimental field
<code>IEditorOptions.experimental.useTrueInlineView</code></li>
<li>New options <code>CommentThreadRevealOptions</code> for
comments</li>
</ul>
<p>Contributions to <code>monaco-editor</code>:</p>
<ul>
<li><a href="https://github.com/ScottCarda-MS"><code>@​ScottCarda-MS
(Scott Carda)</code></a>: Update Q# Keywords [PR <a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4586">#4586</a>](<a
href="https://redirect.github.com/microsoft/monaco-editor/pull/4586">microsoft/monaco-editor#4586</a>)</li>
</ul>
<h2>[0.50.0]</h2>
<ul>
<li>New field
<code>IEditorMinimapOptions.sectionHeaderLetterSpacing</code></li>
<li>New field <code>IOverlayWidgetPosition.stackOridinal</code></li>
<li>New field <code>EmitOutput.diagnostics</code></li>
<li>New event <code>IOverlayWidget.onDidLayout</code></li>
<li>New events <code>ICodeEditor.onBeginUpdate</code> and
<code>ICodeEditor.onEndUpdate</code></li>
<li><code>HoverVerbosityRequest.action</code> -&gt;
<code>HoverVerbosityRequest.verbosityDelta</code></li>
<li><code>MultiDocumentHighlightProvider.selector</code> changed from
<code>LanguageFilter</code> to <code>LanguageSelector</code></li>
<li>New optional parameters in <code>getEmitOutput</code>:
<code>emitOnlyDtsFiles</code> and <code>forceDtsEmit</code></li>
</ul>
<p>Contributions to <code>monaco-editor</code>:</p>
<ul>
<li><a href="https://github.com/htcfreek"><code>@​htcfreek
(Heiko)</code></a>: Add extension to <code>csp.contribution.ts</code>
[PR <a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4504">#4504</a>](<a
href="https://redirect.github.com/microsoft/monaco-editor/pull/4504">microsoft/monaco-editor#4504</a>)</li>
<li><a href="https://github.com/jakebailey"><code>@​jakebailey (Jake
Bailey)</code></a>: Call clearFiles on internal EmitOutput diagnostics,
pass args down [PR <a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4482">#4482</a>](<a
href="https://redirect.github.com/microsoft/monaco-editor/pull/4482">microsoft/monaco-editor#4482</a>)</li>
<li><a href="https://github.com/johnyanarella"><code>@​johnyanarella
(John Yanarella)</code></a>: Update TypeScript to TS 5.4.5 in all
projects, vendored files [PR <a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4305">#4305</a>](<a
href="https://redirect.github.com/microsoft/monaco-editor/pull/4305">microsoft/monaco-editor#4305</a>)</li>
<li><a
href="https://github.com/samstrohkorbatt"><code>@​samstrohkorbatt</code></a>:
Adding Python f-string syntax support [PR <a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4401">#4401</a>](<a
href="https://redirect.github.com/microsoft/monaco-editor/pull/4401">microsoft/monaco-editor#4401</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/4e45ba0c5ff45fc61c0ccac61c0987369df04a6e"><code>4e45ba0</code></a>
sets node version (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4980">#4980</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/c7f027ed9e925e7704f24eb93d99defa867cda7c"><code>c7f027e</code></a>
v0.53.0 (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4979">#4979</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/c41951a02b7e9497484ed259a4af7197c4b0c123"><code>c41951a</code></a>
updates changelog (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4978">#4978</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/759c442daedd192c1b61abacb624b68665dbd1b6"><code>759c442</code></a>
Fixes css and amd output</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/6f3fbe8c3a8e14adff806a554cebe97aa8f4a2a3"><code>6f3fbe8</code></a>
Fixes worker sandbox problems (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4975">#4975</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/a4d7907bd439b06b24e334bdf2ab597bcae658b5"><code>a4d7907</code></a>
Implements language selection (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4969">#4969</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/9e4368a8e92e9035d9bdc719a90f908a01067c41"><code>9e4368a</code></a>
adds amd and firefox/webkit to smoke tests (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4967">#4967</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/d2c20a1ad77b3aa406aad09f9576e91619fa5dcb"><code>d2c20a1</code></a>
Fixes AMD web worker loading (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4966">#4966</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/3bfde9adce4057c11fcb56ffa39fa5ab9a463875"><code>3bfde9a</code></a>
Updates monaco-editor-core dependency &amp; fixes basic-languages amd
file (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4965">#4965</a>)</li>
<li><a
href="https://github.com/microsoft/monaco-editor/commit/15e0a937777d0b7639d4c987e00ad5fcf4d1d47e"><code>15e0a93</code></a>
Run npm run playwright-install (<a
href="https://redirect.github.com/microsoft/monaco-editor/issues/4964">#4964</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/microsoft/monaco-editor/compare/v0.52.2...v0.53.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=monaco-editor&package-manager=npm_and_yarn&previous-version=0.52.2&new-version=0.53.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 23 +++++++++++++++--------
 2 files changed, 16 insertions(+), 9 deletions(-)

diff --git a/site/package.json b/site/package.json
index 500bc7d41d539..660227b1373a1 100644
--- a/site/package.json
+++ b/site/package.json
@@ -92,7 +92,7 @@
 		"jszip": "3.10.1",
 		"lodash": "4.17.21",
 		"lucide-react": "0.474.0",
-		"monaco-editor": "0.52.2",
+		"monaco-editor": "0.53.0",
 		"pretty-bytes": "6.1.1",
 		"react": "19.1.1",
 		"react-color": "2.19.3",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 072598486cbab..068bc1959648e 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -54,7 +54,7 @@ importers:
         version: 5.2.5
       '@monaco-editor/react':
         specifier: 4.7.0
-        version: 4.7.0(monaco-editor@0.52.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        version: 4.7.0(monaco-editor@0.53.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@mui/icons-material':
         specifier: 5.18.0
         version: 5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
@@ -191,8 +191,8 @@ importers:
         specifier: 0.474.0
         version: 0.474.0(react@19.1.1)
       monaco-editor:
-        specifier: 0.52.2
-        version: 0.52.2
+        specifier: 0.53.0
+        version: 0.53.0
       pretty-bytes:
         specifier: 6.1.1
         version: 6.1.1
@@ -3031,6 +3031,9 @@ packages:
   '@types/tough-cookie@4.0.5':
     resolution: {integrity: sha512-/Ad8+nIOV7Rl++6f1BdKxFSMgmoqEoYbHRpPcx3JEfv8VRsQe9Z4mCXeJBzxs7mbHY/XOZZuXlRNfhpVPbs6ZA==, tarball: https://registry.npmjs.org/@types/tough-cookie/-/tough-cookie-4.0.5.tgz}
 
+  '@types/trusted-types@1.0.6':
+    resolution: {integrity: sha512-230RC8sFeHoT6sSUlRO6a8cAnclO06eeiq1QDfiv2FGCLWFvvERWgwIQD4FWqD9A69BN7Lzee4OXwoMVnnsWDw==, tarball: https://registry.npmjs.org/@types/trusted-types/-/trusted-types-1.0.6.tgz}
+
   '@types/ua-parser-js@0.7.36':
     resolution: {integrity: sha512-N1rW+njavs70y2cApeIw1vLMYXRwfBy+7trgavGuuTfOd7j1Yh7QTRc/yqsPl6ncokt72ZXuxEU0PiCp9bSwNQ==, tarball: https://registry.npmjs.org/@types/ua-parser-js/-/ua-parser-js-0.7.36.tgz}
 
@@ -5182,8 +5185,8 @@ packages:
     resolution: {integrity: sha512-qxBgB7Qa2sEQgHFjj0dSigq7fX4k6Saisd5Nelwp2q8mlbAFh5dHV9JTTlF8viYJLSSWgMCZFUom8PJcMNBoJw==, tarball: https://registry.npmjs.org/mock-socket/-/mock-socket-9.3.1.tgz}
     engines: {node: '>= 8'}
 
-  monaco-editor@0.52.2:
-    resolution: {integrity: sha512-GEQWEZmfkOGLdd3XK8ryrfWz3AIP8YymVXiPHEdewrUq7mh0qrKrfHLNCXcbB6sTnMLnOZ3ztSiKcciFUkIJwQ==, tarball: https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.52.2.tgz}
+  monaco-editor@0.53.0:
+    resolution: {integrity: sha512-0WNThgC6CMWNXXBxTbaYYcunj08iB5rnx4/G56UOPeL9UVIUGGHA1GR0EWIh9Ebabj7NpCRawQ5b0hfN1jQmYQ==, tarball: https://registry.npmjs.org/monaco-editor/-/monaco-editor-0.53.0.tgz}
 
   moo-color@1.0.3:
     resolution: {integrity: sha512-i/+ZKXMDf6aqYtBhuOcej71YSlbjT3wCO/4H1j8rPvxDJEifdwgg5MaFyu6iYAT8GBZJg2z0dkgK4YMzvURALQ==, tarball: https://registry.npmjs.org/moo-color/-/moo-color-1.0.3.tgz}
@@ -7651,10 +7654,10 @@ snapshots:
     dependencies:
       state-local: 1.0.7
 
-  '@monaco-editor/react@4.7.0(monaco-editor@0.52.2)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
+  '@monaco-editor/react@4.7.0(monaco-editor@0.53.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@monaco-editor/loader': 1.5.0
-      monaco-editor: 0.52.2
+      monaco-editor: 0.53.0
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
@@ -9229,6 +9232,8 @@ snapshots:
 
   '@types/tough-cookie@4.0.5': {}
 
+  '@types/trusted-types@1.0.6': {}
+
   '@types/ua-parser-js@0.7.36': {}
 
   '@types/unist@2.0.11': {}
@@ -12004,7 +12009,9 @@ snapshots:
 
   mock-socket@9.3.1: {}
 
-  monaco-editor@0.52.2: {}
+  monaco-editor@0.53.0:
+    dependencies:
+      '@types/trusted-types': 1.0.6
 
   moo-color@1.0.3:
     dependencies:

From ebcfae27a2b6cca88a10d37a21f0e1b5b8f90b78 Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Wed, 1 Oct 2025 13:39:45 -0800
Subject: [PATCH 028/298] feat: add task create, list, status, and delete MCP
 tools (#19901)

---
 coderd/database/dbfake/dbfake.go |  27 +++
 codersdk/toolsdk/toolsdk.go      | 253 +++++++++++++++++++++-
 codersdk/toolsdk/toolsdk_test.go | 356 +++++++++++++++++++++++++++++++
 3 files changed, 633 insertions(+), 3 deletions(-)

diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
index 6d99005fb3334..a4742a09fff6c 100644
--- a/coderd/database/dbfake/dbfake.go
+++ b/coderd/database/dbfake/dbfake.go
@@ -24,6 +24,7 @@ import (
 	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/coderd/telemetry"
 	"github.com/coder/coder/v2/coderd/wspubsub"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/provisionersdk"
 	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
 )
@@ -55,6 +56,7 @@ type WorkspaceBuildBuilder struct {
 	params     []database.WorkspaceBuildParameter
 	agentToken string
 	dispo      workspaceBuildDisposition
+	taskAppID  uuid.UUID
 }
 
 type workspaceBuildDisposition struct {
@@ -117,6 +119,23 @@ func (b WorkspaceBuildBuilder) WithAgent(mutations ...func([]*sdkproto.Agent) []
 	return b
 }
 
+func (b WorkspaceBuildBuilder) WithTask() WorkspaceBuildBuilder {
+	//nolint: revive // returns modified struct
+	b.taskAppID = uuid.New()
+	return b.Params(database.WorkspaceBuildParameter{
+		Name:  codersdk.AITaskPromptParameterName,
+		Value: "list me",
+	}).WithAgent(func(a []*sdkproto.Agent) []*sdkproto.Agent {
+		a[0].Apps = []*sdkproto.App{
+			{
+				Id:   b.taskAppID.String(),
+				Slug: "vcode",
+			},
+		}
+		return a
+	})
+}
+
 func (b WorkspaceBuildBuilder) Starting() WorkspaceBuildBuilder {
 	//nolint: revive // returns modified struct
 	b.dispo.starting = true
@@ -134,6 +153,14 @@ func (b WorkspaceBuildBuilder) Do() WorkspaceResponse {
 	b.seed.ID = uuid.New()
 	b.seed.JobID = jobID
 
+	if b.taskAppID != uuid.Nil {
+		b.seed.HasAITask = sql.NullBool{
+			Bool:  true,
+			Valid: true,
+		}
+		b.seed.AITaskSidebarAppID = uuid.NullUUID{UUID: b.taskAppID, Valid: true}
+	}
+
 	resp := WorkspaceResponse{
 		AgentToken: b.agentToken,
 	}
diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index acc7a9b10292a..63e17c2f039cd 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -50,6 +50,10 @@ const (
 	ToolNameWorkspaceEditFile           = "coder_workspace_edit_file"
 	ToolNameWorkspaceEditFiles          = "coder_workspace_edit_files"
 	ToolNameWorkspacePortForward        = "coder_workspace_port_forward"
+	ToolNameCreateTask                  = "coder_create_task"
+	ToolNameDeleteTask                  = "coder_delete_task"
+	ToolNameListTasks                   = "coder_list_tasks"
+	ToolNameGetTaskStatus               = "coder_get_task_status"
 )
 
 func NewDeps(client *codersdk.Client, opts ...func(*Deps)) (Deps, error) {
@@ -223,6 +227,10 @@ var All = []GenericTool{
 	WorkspaceEditFile.Generic(),
 	WorkspaceEditFiles.Generic(),
 	WorkspacePortForward.Generic(),
+	CreateTask.Generic(),
+	DeleteTask.Generic(),
+	ListTasks.Generic(),
+	GetTaskStatus.Generic(),
 }
 
 type ReportTaskArgs struct {
@@ -344,7 +352,7 @@ is provisioned correctly and the agent can connect to the control plane.
 			Properties: map[string]any{
 				"user": map[string]any{
 					"type":        "string",
-					"description": "Username or ID of the user to create the workspace for. Use the `me` keyword to create a workspace for the authenticated user.",
+					"description": userDescription("create a workspace"),
 				},
 				"template_version_id": map[string]any{
 					"type":        "string",
@@ -1393,8 +1401,6 @@ type WorkspaceLSResponse struct {
 	Contents []WorkspaceLSFile `json:"contents"`
 }
 
-const workspaceDescription = "The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used."
-
 var WorkspaceLS = Tool[WorkspaceLSArgs, WorkspaceLSResponse]{
 	Tool: aisdk.Tool{
 		Name:        ToolNameWorkspaceLS,
@@ -1750,6 +1756,237 @@ var WorkspacePortForward = Tool[WorkspacePortForwardArgs, WorkspacePortForwardRe
 	},
 }
 
+type CreateTaskArgs struct {
+	Input                   string `json:"input"`
+	TemplateVersionID       string `json:"template_version_id"`
+	TemplateVersionPresetID string `json:"template_version_preset_id"`
+	User                    string `json:"user"`
+}
+
+var CreateTask = Tool[CreateTaskArgs, codersdk.Task]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameCreateTask,
+		Description: `Create a task.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"input": map[string]any{
+					"type":        "string",
+					"description": "Input/prompt for the task.",
+				},
+				"template_version_id": map[string]any{
+					"type":        "string",
+					"description": "ID of the template version to create the task from.",
+				},
+				"template_version_preset_id": map[string]any{
+					"type":        "string",
+					"description": "Optional ID of the template version preset to create the task from.",
+				},
+				"user": map[string]any{
+					"type":        "string",
+					"description": userDescription("create a task"),
+				},
+			},
+			Required: []string{"input", "template_version_id"},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args CreateTaskArgs) (codersdk.Task, error) {
+		if args.Input == "" {
+			return codersdk.Task{}, xerrors.New("input is required")
+		}
+
+		tvID, err := uuid.Parse(args.TemplateVersionID)
+		if err != nil {
+			return codersdk.Task{}, xerrors.New("template_version_id must be a valid UUID")
+		}
+
+		var tvPresetID uuid.UUID
+		if args.TemplateVersionPresetID != "" {
+			tvPresetID, err = uuid.Parse(args.TemplateVersionPresetID)
+			if err != nil {
+				return codersdk.Task{}, xerrors.New("template_version_preset_id must be a valid UUID")
+			}
+		}
+
+		if args.User == "" {
+			args.User = codersdk.Me
+		}
+
+		expClient := codersdk.NewExperimentalClient(deps.coderClient)
+		task, err := expClient.CreateTask(ctx, args.User, codersdk.CreateTaskRequest{
+			Input:                   args.Input,
+			TemplateVersionID:       tvID,
+			TemplateVersionPresetID: tvPresetID,
+		})
+		if err != nil {
+			return codersdk.Task{}, xerrors.Errorf("create task: %w", err)
+		}
+
+		return task, nil
+	},
+}
+
+type DeleteTaskArgs struct {
+	TaskID string `json:"task_id"`
+}
+
+var DeleteTask = Tool[DeleteTaskArgs, codersdk.Response]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameDeleteTask,
+		Description: `Delete a task.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"task_id": map[string]any{
+					"type":        "string",
+					"description": taskIDDescription("delete"),
+				},
+			},
+			Required: []string{"task_id"},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args DeleteTaskArgs) (codersdk.Response, error) {
+		if args.TaskID == "" {
+			return codersdk.Response{}, xerrors.New("task_id is required")
+		}
+
+		expClient := codersdk.NewExperimentalClient(deps.coderClient)
+
+		var owner string
+		id, err := uuid.Parse(args.TaskID)
+		if err == nil {
+			task, err := expClient.TaskByID(ctx, id)
+			if err != nil {
+				return codersdk.Response{}, xerrors.Errorf("get task %q: %w", args.TaskID, err)
+			}
+			owner = task.OwnerName
+		} else {
+			ws, err := normalizedNamedWorkspace(ctx, deps.coderClient, args.TaskID)
+			if err != nil {
+				return codersdk.Response{}, xerrors.Errorf("get task workspace %q: %w", args.TaskID, err)
+			}
+			owner = ws.OwnerName
+			id = ws.ID
+		}
+
+		err = expClient.DeleteTask(ctx, owner, id)
+		if err != nil {
+			return codersdk.Response{}, xerrors.Errorf("delete task: %w", err)
+		}
+
+		return codersdk.Response{
+			Message: "Task deleted successfully",
+		}, nil
+	},
+}
+
+type ListTasksArgs struct {
+	Status string `json:"status"`
+	User   string `json:"user"`
+}
+
+type ListTasksResponse struct {
+	Tasks []codersdk.Task `json:"tasks"`
+}
+
+var ListTasks = Tool[ListTasksArgs, ListTasksResponse]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameListTasks,
+		Description: `List tasks.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"status": map[string]any{
+					"type":        "string",
+					"description": "Optional filter by task status.",
+				},
+				"user": map[string]any{
+					"type":        "string",
+					"description": userDescription("list tasks"),
+				},
+			},
+			Required: []string{},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args ListTasksArgs) (ListTasksResponse, error) {
+		if args.User == "" {
+			args.User = codersdk.Me
+		}
+
+		expClient := codersdk.NewExperimentalClient(deps.coderClient)
+		tasks, err := expClient.Tasks(ctx, &codersdk.TasksFilter{
+			Owner:  args.User,
+			Status: args.Status,
+		})
+		if err != nil {
+			return ListTasksResponse{}, xerrors.Errorf("list tasks: %w", err)
+		}
+
+		return ListTasksResponse{
+			Tasks: tasks,
+		}, nil
+	},
+}
+
+type GetTaskStatusArgs struct {
+	TaskID string `json:"task_id"`
+}
+
+type GetTaskStatusResponse struct {
+	Status codersdk.WorkspaceStatus `json:"status"`
+	State  *codersdk.TaskStateEntry `json:"state"`
+}
+
+var GetTaskStatus = Tool[GetTaskStatusArgs, GetTaskStatusResponse]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameGetTaskStatus,
+		Description: `Get the status of a task.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"task_id": map[string]any{
+					"type":        "string",
+					"description": taskIDDescription("get"),
+				},
+			},
+			Required: []string{"task_id"},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args GetTaskStatusArgs) (GetTaskStatusResponse, error) {
+		if args.TaskID == "" {
+			return GetTaskStatusResponse{}, xerrors.New("task_id is required")
+		}
+
+		expClient := codersdk.NewExperimentalClient(deps.coderClient)
+
+		id, err := uuid.Parse(args.TaskID)
+		if err != nil {
+			ws, err := normalizedNamedWorkspace(ctx, deps.coderClient, args.TaskID)
+			if err != nil {
+				return GetTaskStatusResponse{}, xerrors.Errorf("get task workspace %q: %w", args.TaskID, err)
+			}
+			id = ws.ID
+		}
+
+		task, err := expClient.TaskByID(ctx, id)
+		if err != nil {
+			return GetTaskStatusResponse{}, xerrors.Errorf("get task %q: %w", args.TaskID, err)
+		}
+
+		return GetTaskStatusResponse{
+			Status: task.Status,
+			State:  task.CurrentState,
+		}, nil
+	},
+}
+
+// normalizedNamedWorkspace normalizes the workspace name before getting the
+// workspace by name.
+func normalizedNamedWorkspace(ctx context.Context, client *codersdk.Client, name string) (codersdk.Workspace, error) {
+	// Maybe namedWorkspace should itself call NormalizeWorkspaceInput?
+	return namedWorkspace(ctx, client, NormalizeWorkspaceInput(name))
+}
+
 // NormalizeWorkspaceInput converts workspace name input to standard format.
 // Handles the following input formats:
 //   - workspace                    → workspace
@@ -1810,3 +2047,13 @@ func newAgentConn(ctx context.Context, client *codersdk.Client, workspace string
 	}
 	return conn, nil
 }
+
+const workspaceDescription = "The workspace name in the format [owner/]workspace[.agent]. If an owner is not specified, the authenticated user is used."
+
+func taskIDDescription(action string) string {
+	return fmt.Sprintf("ID or workspace identifier in the format [owner/]workspace[.agent] for the task to %s. If an owner is not specified, the authenticated user is used.", action)
+}
+
+func userDescription(action string) string {
+	return fmt.Sprintf("Username or ID of the user for which to %s. Omit or use the `me` keyword to %s for the authenticated user.", action, action)
+}
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index f89f22e0089d7..8e0cc09fff25d 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -2,6 +2,7 @@ package toolsdk_test
 
 import (
 	"context"
+	"database/sql"
 	"encoding/json"
 	"fmt"
 	"os"
@@ -791,6 +792,361 @@ func TestTools(t *testing.T) {
 			})
 		}
 	})
+
+	t.Run("WorkspaceCreateTask", func(t *testing.T) {
+		t.Parallel()
+
+		presetID := uuid.New()
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      member.ID,
+			HasAITask: sql.NullBool{
+				Bool:  true,
+				Valid: true,
+			},
+		}).Preset(database.TemplateVersionPreset{
+			ID: presetID,
+			DesiredInstances: sql.NullInt32{
+				Int32: 1,
+				Valid: true,
+			},
+		}).Do()
+
+		tests := []struct {
+			name  string
+			args  toolsdk.CreateTaskArgs
+			error string
+		}{
+			{
+				name: "OK",
+				args: toolsdk.CreateTaskArgs{
+					TemplateVersionID: aiTV.TemplateVersion.ID.String(),
+					Input:             "do a barrel roll",
+					User:              "me",
+				},
+			},
+			{
+				name: "NoUser",
+				args: toolsdk.CreateTaskArgs{
+					TemplateVersionID: aiTV.TemplateVersion.ID.String(),
+					Input:             "do another barrel roll",
+				},
+			},
+			{
+				name: "NoInput",
+				args: toolsdk.CreateTaskArgs{
+					TemplateVersionID: aiTV.TemplateVersion.ID.String(),
+				},
+				error: "input is required",
+			},
+			{
+				name: "NotTaskTemplate",
+				args: toolsdk.CreateTaskArgs{
+					TemplateVersionID: r.TemplateVersion.ID.String(),
+					Input:             "do yet another barrel roll",
+				},
+				error: "Template does not have required parameter \"AI Prompt\"",
+			},
+			{
+				name: "WithPreset",
+				args: toolsdk.CreateTaskArgs{
+					TemplateVersionID:       r.TemplateVersion.ID.String(),
+					TemplateVersionPresetID: presetID.String(),
+					Input:                   "not enough barrel rolls",
+				},
+				error: "Template does not have required parameter \"AI Prompt\"",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(memberClient)
+				require.NoError(t, err)
+
+				_, err = testTool(t, toolsdk.CreateTask, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("WorkspaceDeleteTask", func(t *testing.T) {
+		t.Parallel()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      member.ID,
+			HasAITask: sql.NullBool{
+				Bool:  true,
+				Valid: true,
+			},
+		}).Do()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		ws1 := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "delete-task-workspace-1",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+			TemplateID:     aiTV.Template.ID,
+		}).WithTask().Do()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "delete-task-workspace-2",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+			TemplateID:     aiTV.Template.ID,
+		}).WithTask().Do()
+
+		tests := []struct {
+			name  string
+			args  toolsdk.DeleteTaskArgs
+			error string
+		}{
+			{
+				name: "ByUUID",
+				args: toolsdk.DeleteTaskArgs{
+					TaskID: ws1.Workspace.ID.String(),
+				},
+			},
+			{
+				name: "ByWorkspaceIdentifier",
+				args: toolsdk.DeleteTaskArgs{
+					TaskID: "delete-task-workspace-2",
+				},
+			},
+			{
+				name:  "NoID",
+				args:  toolsdk.DeleteTaskArgs{},
+				error: "task_id is required",
+			},
+			{
+				name: "NoTaskByID",
+				args: toolsdk.DeleteTaskArgs{
+					TaskID: uuid.New().String(),
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "NoTaskByWorkspaceIdentifier",
+				args: toolsdk.DeleteTaskArgs{
+					TaskID: "non-existent",
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "ExistsButNotATask",
+				args: toolsdk.DeleteTaskArgs{
+					TaskID: r.Workspace.ID.String(),
+				},
+				error: "Resource not found",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(memberClient)
+				require.NoError(t, err)
+
+				_, err = testTool(t, toolsdk.DeleteTask, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("WorkspaceListTasks", func(t *testing.T) {
+		t.Parallel()
+
+		taskClient, taskUser := coderdtest.CreateAnotherUserMutators(t, client, owner.OrganizationID, nil)
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      owner.UserID,
+			HasAITask: sql.NullBool{
+				Bool:  true,
+				Valid: true,
+			},
+		}).Do()
+
+		// This task should not show up since listing is user-scoped.
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "list-task-workspace-member",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+			TemplateID:     aiTV.Template.ID,
+		}).WithTask().Do()
+
+		// These tasks should show up.
+		for i := range 5 {
+			// nolint:gocritic // This is in a test package and does not end up in the build
+			var transition database.WorkspaceTransition
+			if i == 0 {
+				// nolint:gocritic // This is in a test package and does not end up in the build
+				transition = database.WorkspaceTransitionStop
+			}
+			// nolint:gocritic // This is in a test package and does not end up in the build
+			_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+				Name:           fmt.Sprintf("list-task-workspace-%d", i),
+				OrganizationID: owner.OrganizationID,
+				OwnerID:        taskUser.ID,
+				TemplateID:     aiTV.Template.ID,
+			}).Seed(database.WorkspaceBuild{Transition: transition}).WithTask().Do()
+		}
+
+		tests := []struct {
+			name     string
+			args     toolsdk.ListTasksArgs
+			expected []string
+			error    string
+		}{
+			{
+				name: "ListAllOwned",
+				args: toolsdk.ListTasksArgs{},
+				expected: []string{
+					"list-task-workspace-0",
+					"list-task-workspace-1",
+					"list-task-workspace-2",
+					"list-task-workspace-3",
+					"list-task-workspace-4",
+				},
+			},
+			{
+				name: "ListFiltered",
+				args: toolsdk.ListTasksArgs{
+					Status: "stopped",
+				},
+				expected: []string{
+					"list-task-workspace-0",
+				},
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(taskClient)
+				require.NoError(t, err)
+
+				res, err := testTool(t, toolsdk.ListTasks, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+					require.Len(t, res.Tasks, len(tt.expected))
+					for _, task := range res.Tasks {
+						require.Contains(t, tt.expected, task.Name)
+					}
+				}
+			})
+		}
+	})
+
+	t.Run("WorkspaceGetTask", func(t *testing.T) {
+		t.Parallel()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      member.ID,
+			HasAITask: sql.NullBool{
+				Bool:  true,
+				Valid: true,
+			},
+		}).Do()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		ws1 := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "get-task-workspace-1",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+			TemplateID:     aiTV.Template.ID,
+		}).WithTask().Do()
+
+		tests := []struct {
+			name     string
+			args     toolsdk.GetTaskStatusArgs
+			expected codersdk.WorkspaceStatus
+			error    string
+		}{
+			{
+				name: "ByUUID",
+				args: toolsdk.GetTaskStatusArgs{
+					TaskID: ws1.Workspace.ID.String(),
+				},
+				expected: codersdk.WorkspaceStatusRunning,
+			},
+			{
+				name: "ByWorkspaceIdentifier",
+				args: toolsdk.GetTaskStatusArgs{
+					TaskID: "get-task-workspace-1",
+				},
+				expected: codersdk.WorkspaceStatusRunning,
+			},
+			{
+				name:  "NoID",
+				args:  toolsdk.GetTaskStatusArgs{},
+				error: "task_id is required",
+			},
+			{
+				name: "NoTaskByID",
+				args: toolsdk.GetTaskStatusArgs{
+					TaskID: uuid.New().String(),
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "NoTaskByWorkspaceIdentifier",
+				args: toolsdk.GetTaskStatusArgs{
+					TaskID: "non-existent",
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "ExistsButNotATask",
+				args: toolsdk.GetTaskStatusArgs{
+					TaskID: r.Workspace.ID.String(),
+				},
+				error: "Resource not found",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(memberClient)
+				require.NoError(t, err)
+
+				res, err := testTool(t, toolsdk.GetTaskStatus, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+					require.Equal(t, tt.expected, res.Status)
+				}
+			})
+		}
+	})
 }
 
 // TestedTools keeps track of which tools have been tested.

From 94c76b97bd7f1dab0b5ea485e23cc5c5beaa9b99 Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Wed, 1 Oct 2025 13:57:11 -0800
Subject: [PATCH 029/298] feat: add list_apps MCP tool (#19952)

---
 codersdk/toolsdk/toolsdk.go      |  53 ++++++++++++
 codersdk/toolsdk/toolsdk_test.go | 140 +++++++++++++++++++++++++++++++
 2 files changed, 193 insertions(+)

diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index 63e17c2f039cd..c8228e51049d9 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -50,6 +50,7 @@ const (
 	ToolNameWorkspaceEditFile           = "coder_workspace_edit_file"
 	ToolNameWorkspaceEditFiles          = "coder_workspace_edit_files"
 	ToolNameWorkspacePortForward        = "coder_workspace_port_forward"
+	ToolNameWorkspaceListApps           = "coder_workspace_list_apps"
 	ToolNameCreateTask                  = "coder_create_task"
 	ToolNameDeleteTask                  = "coder_delete_task"
 	ToolNameListTasks                   = "coder_list_tasks"
@@ -227,6 +228,7 @@ var All = []GenericTool{
 	WorkspaceEditFile.Generic(),
 	WorkspaceEditFiles.Generic(),
 	WorkspacePortForward.Generic(),
+	WorkspaceListApps.Generic(),
 	CreateTask.Generic(),
 	DeleteTask.Generic(),
 	ListTasks.Generic(),
@@ -1756,6 +1758,57 @@ var WorkspacePortForward = Tool[WorkspacePortForwardArgs, WorkspacePortForwardRe
 	},
 }
 
+type WorkspaceListAppsArgs struct {
+	Workspace string `json:"workspace"`
+}
+
+type WorkspaceListApp struct {
+	Name string `json:"name"`
+	URL  string `json:"url"`
+}
+
+type WorkspaceListAppsResponse struct {
+	Apps []WorkspaceListApp `json:"apps"`
+}
+
+var WorkspaceListApps = Tool[WorkspaceListAppsArgs, WorkspaceListAppsResponse]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameWorkspaceListApps,
+		Description: `List the URLs of Coder apps running in a workspace for a single agent.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"workspace": map[string]any{
+					"type":        "string",
+					"description": workspaceDescription,
+				},
+			},
+			Required: []string{"workspace"},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args WorkspaceListAppsArgs) (WorkspaceListAppsResponse, error) {
+		workspaceName := NormalizeWorkspaceInput(args.Workspace)
+		_, workspaceAgent, err := findWorkspaceAndAgent(ctx, deps.coderClient, workspaceName)
+		if err != nil {
+			return WorkspaceListAppsResponse{}, xerrors.Errorf("failed to find workspace: %w", err)
+		}
+
+		var res WorkspaceListAppsResponse
+		for _, app := range workspaceAgent.Apps {
+			name := app.DisplayName
+			if name == "" {
+				name = app.Slug
+			}
+			res.Apps = append(res.Apps, WorkspaceListApp{
+				Name: name,
+				URL:  app.URL,
+			})
+		}
+
+		return res, nil
+	},
+}
+
 type CreateTaskArgs struct {
 	Input                   string `json:"input"`
 	TemplateVersionID       string `json:"template_version_id"`
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index 8e0cc09fff25d..1bc17fabb31e2 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -1147,6 +1147,146 @@ func TestTools(t *testing.T) {
 			})
 		}
 	})
+
+	t.Run("WorkspaceListApps", func(t *testing.T) {
+		t.Parallel()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "list-app-workspace-one-agent",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+		}).WithAgent(func(agents []*proto.Agent) []*proto.Agent {
+			agents[0].Apps = []*proto.App{
+				{
+					Slug: "zero",
+					Url:  "http://zero.dev.coder.com",
+				},
+			}
+			return agents
+		}).Do()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "list-app-workspace-multi-agent",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+		}).WithAgent(func(agents []*proto.Agent) []*proto.Agent {
+			agents[0].Apps = []*proto.App{
+				{
+					Slug: "one",
+					Url:  "http://one.dev.coder.com",
+				},
+				{
+					Slug: "two",
+					Url:  "http://two.dev.coder.com",
+				},
+				{
+					Slug: "three",
+					Url:  "http://three.dev.coder.com",
+				},
+			}
+			agents = append(agents, &proto.Agent{
+				Id:   uuid.NewString(),
+				Name: "dev2",
+				Auth: &proto.Agent_Token{
+					Token: uuid.NewString(),
+				},
+				Env: map[string]string{},
+				Apps: []*proto.App{
+					{
+						Slug: "four",
+						Url:  "http://four.dev.coder.com",
+					},
+				},
+			})
+			return agents
+		}).Do()
+
+		tests := []struct {
+			name     string
+			args     toolsdk.WorkspaceListAppsArgs
+			expected []toolsdk.WorkspaceListApp
+			error    string
+		}{
+			{
+				name: "NonExistentWorkspace",
+				args: toolsdk.WorkspaceListAppsArgs{
+					Workspace: "list-appp-workspace-does-not-exist",
+				},
+				error: "failed to find workspace",
+			},
+			{
+				name: "OneAgentOneApp",
+				args: toolsdk.WorkspaceListAppsArgs{
+					Workspace: "list-app-workspace-one-agent",
+				},
+				expected: []toolsdk.WorkspaceListApp{
+					{
+						Name: "zero",
+						URL:  "http://zero.dev.coder.com",
+					},
+				},
+			},
+			{
+				name: "MultiAgent",
+				args: toolsdk.WorkspaceListAppsArgs{
+					Workspace: "list-app-workspace-multi-agent",
+				},
+				error: "multiple agents found, please specify the agent name",
+			},
+			{
+				name: "MultiAgentOneApp",
+				args: toolsdk.WorkspaceListAppsArgs{
+					Workspace: "list-app-workspace-multi-agent.dev2",
+				},
+				expected: []toolsdk.WorkspaceListApp{
+					{
+						Name: "four",
+						URL:  "http://four.dev.coder.com",
+					},
+				},
+			},
+			{
+				name: "MultiAgentMultiApp",
+				args: toolsdk.WorkspaceListAppsArgs{
+					Workspace: "list-app-workspace-multi-agent.dev",
+				},
+				expected: []toolsdk.WorkspaceListApp{
+					{
+						Name: "one",
+						URL:  "http://one.dev.coder.com",
+					},
+					{
+						Name: "three",
+						URL:  "http://three.dev.coder.com",
+					},
+					{
+						Name: "two",
+						URL:  "http://two.dev.coder.com",
+					},
+				},
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(memberClient)
+				require.NoError(t, err)
+
+				res, err := testTool(t, toolsdk.WorkspaceListApps, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+					require.Equal(t, tt.expected, res.Apps)
+				}
+			})
+		}
+	})
 }
 
 // TestedTools keeps track of which tools have been tested.

From 230df3eadf344606cc2b99b3689431bd9760cfc2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 22:11:37 +0000
Subject: [PATCH 030/298] chore: bump react-confetti from 6.2.2 to 6.4.0 in
 /site (#20126)

Bumps [react-confetti](https://github.com/alampros/react-confetti) from
6.2.2 to 6.4.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/alampros/react-confetti/releases">react-confetti's
releases</a>.</em></p>
<blockquote>
<h2>v6.4.0</h2>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.3.0...v6.4.0">6.4.0</a>
(2025-03-04)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>clamp tweenProgress between 0 and tweenDuration (<a
href="https://github.com/alampros/react-confetti/commit/f988305151150522111c7b846303ba2263fa85e9">f988305</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>adding tweenFrom property to allow smooth transition when parameters
change (<a
href="https://github.com/alampros/react-confetti/commit/dde31e0e28da164f7b9f3909e73baa6ffe24cf68">dde31e0</a>)</li>
</ul>
<h2>v6.3.0</h2>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.2.3...v6.3.0">6.3.0</a>
(2025-03-01)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>prevent particle flicker on removal (<a
href="https://github.com/alampros/react-confetti/commit/5cb5bd87032705b90a8d85588d931b985a4127e5">5cb5bd8</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>using elapsed time in physics updates (<a
href="https://github.com/alampros/react-confetti/commit/d1626dcd16758f627749a30794075663c5fce15f">d1626dc</a>)</li>
</ul>
<h2>v6.2.3</h2>
<h2><a
href="https://github.com/alampros/react-confetti/compare/v6.2.2...v6.2.3">6.2.3</a>
(2025-02-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>export IConfettiOptions (<a
href="https://github.com/alampros/react-confetti/commit/73dffe8f87cb87ed7aed42effdc056ac6fe8ffde">73dffe8</a>),
closes <a
href="https://redirect.github.com/alampros/react-confetti/issues/165">#165</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/alampros/react-confetti/blob/develop/CHANGELOG.md">react-confetti's
changelog</a>.</em></p>
<blockquote>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.3.0...v6.4.0">6.4.0</a>
(2025-03-04)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>clamp tweenProgress between 0 and tweenDuration (<a
href="https://github.com/alampros/react-confetti/commit/f988305151150522111c7b846303ba2263fa85e9">f988305</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>adding tweenFrom property to allow smooth transition when parameters
change (<a
href="https://github.com/alampros/react-confetti/commit/dde31e0e28da164f7b9f3909e73baa6ffe24cf68">dde31e0</a>)</li>
</ul>
<h1><a
href="https://github.com/alampros/react-confetti/compare/v6.2.3...v6.3.0">6.3.0</a>
(2025-03-01)</h1>
<h3>Bug Fixes</h3>
<ul>
<li>prevent particle flicker on removal (<a
href="https://github.com/alampros/react-confetti/commit/5cb5bd87032705b90a8d85588d931b985a4127e5">5cb5bd8</a>)</li>
</ul>
<h3>Features</h3>
<ul>
<li>using elapsed time in physics updates (<a
href="https://github.com/alampros/react-confetti/commit/d1626dcd16758f627749a30794075663c5fce15f">d1626dc</a>)</li>
</ul>
<h2><a
href="https://github.com/alampros/react-confetti/compare/v6.2.2...v6.2.3">6.2.3</a>
(2025-02-22)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>export IConfettiOptions (<a
href="https://github.com/alampros/react-confetti/commit/73dffe8f87cb87ed7aed42effdc056ac6fe8ffde">73dffe8</a>),
closes <a
href="https://redirect.github.com/alampros/react-confetti/issues/165">#165</a></li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/alampros/react-confetti/commit/0d535377bc449b9515e19975315620a13ca20dba"><code>0d53537</code></a>
chore(release): 6.4.0 [skip ci]</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/641b3519007b53699b876c4b7d6e32473633366c"><code>641b351</code></a>
Merge branch 'develop'</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/6ac61ed2d39743845efe23f2c25783b1f763c165"><code>6ac61ed</code></a>
lint fix</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/90f5a594883b95cc6f6ee4e291a8878e2222a77e"><code>90f5a59</code></a>
Merge pull request <a
href="https://redirect.github.com/alampros/react-confetti/issues/172">#172</a>
from AlexJDG/bugfix/fix-tweening</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/f988305151150522111c7b846303ba2263fa85e9"><code>f988305</code></a>
fix: clamp tweenProgress between 0 and tweenDuration</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/dde31e0e28da164f7b9f3909e73baa6ffe24cf68"><code>dde31e0</code></a>
feat: adding tweenFrom property to allow smooth transition when
parameters ch...</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/5dd9f7b4ea29c9460b0fd7ffb1864d178b1aa2ac"><code>5dd9f7b</code></a>
chore: renaming property for clarity</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/31eb46d24be1398cb81d501670dec96aba518cb6"><code>31eb46d</code></a>
chore(release): 6.3.0 [skip ci]</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/e44738908b515237443cbb865cd1e61fdcc2a938"><code>e447389</code></a>
Merge branch 'develop'</li>
<li><a
href="https://github.com/alampros/react-confetti/commit/b1779918cf790752a4095df4ecb794a97b025994"><code>b177991</code></a>
fix lint action name</li>
<li>Additional commits viewable in <a
href="https://github.com/alampros/react-confetti/compare/v6.2.2...v6.4.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=react-confetti&package-manager=npm_and_yarn&previous-version=6.2.2&new-version=6.4.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 10 +++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/site/package.json b/site/package.json
index 660227b1373a1..38617dce23a99 100644
--- a/site/package.json
+++ b/site/package.json
@@ -96,7 +96,7 @@
 		"pretty-bytes": "6.1.1",
 		"react": "19.1.1",
 		"react-color": "2.19.3",
-		"react-confetti": "6.2.2",
+		"react-confetti": "6.4.0",
 		"react-date-range": "1.4.0",
 		"react-dom": "19.1.1",
 		"react-markdown": "9.1.0",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 068bc1959648e..eebed5b445afc 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -203,8 +203,8 @@ importers:
         specifier: 2.19.3
         version: 2.19.3(react@19.1.1)
       react-confetti:
-        specifier: 6.2.2
-        version: 6.2.2(react@19.1.1)
+        specifier: 6.4.0
+        version: 6.4.0(react@19.1.1)
       react-date-range:
         specifier: 1.4.0
         version: 1.4.0(date-fns@2.30.0)(react@19.1.1)
@@ -5588,8 +5588,8 @@ packages:
     peerDependencies:
       react: '*'
 
-  react-confetti@6.2.2:
-    resolution: {integrity: sha512-K+kTyOPgX+ZujMZ+Rmb7pZdHBvg+DzinG/w4Eh52WOB8/pfO38efnnrtEZNJmjTvLxc16RBYO+tPM68Fg8viBA==, tarball: https://registry.npmjs.org/react-confetti/-/react-confetti-6.2.2.tgz}
+  react-confetti@6.4.0:
+    resolution: {integrity: sha512-5MdGUcqxrTU26I2EU7ltkWPwxvucQTuqMm8dUz72z2YMqTD6s9vMcDUysk7n9jnC+lXuCPeJJ7Knf98VEYE9Rg==, tarball: https://registry.npmjs.org/react-confetti/-/react-confetti-6.4.0.tgz}
     engines: {node: '>=16'}
     peerDependencies:
       react: ^16.3.0 || ^17.0.1 || ^18.0.0 || ^19.0.0
@@ -12427,7 +12427,7 @@ snapshots:
       reactcss: 1.2.3(react@19.1.1)
       tinycolor2: 1.6.0
 
-  react-confetti@6.2.2(react@19.1.1):
+  react-confetti@6.4.0(react@19.1.1):
     dependencies:
       react: 19.1.1
       tween-functions: 1.2.0

From 4e53d8b9c257b96b9360c8e2f73d461cef4ea57d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 22:12:40 +0000
Subject: [PATCH 031/298] chore: bump @biomejs/biome from 2.2.0 to 2.2.4 in
 /site (#20118)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[@biomejs/biome](https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome)
from 2.2.0 to 2.2.4.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/biomejs/biome/releases"><code>@​biomejs/biome</code>'s
releases</a>.</em></p>
<blockquote>
<h2>Biome CLI v2.2.4</h2>
<h2>2.2.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7453">#7453</a> <a
href="https://github.com/biomejs/biome/commit/aa8cea31af675699e18988fe79242ae5d5215af1">
<code>aa8cea3</code></a> Thanks <a
href="https://github.com/arendjr"><code>@​arendjr</code></a>! - Fixed <a
href="https://redirect.github.com/biomejs/biome/issues/7242">#7242</a>:
Aliases specified in
<code>package.json</code>'s <code>imports</code> section now support
having multiple targets as part of an array.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7454">#7454</a> <a
href="https://github.com/biomejs/biome/commit/ac171839a31600225e3b759470eaa026746e9cf4">
<code>ac17183</code></a> Thanks <a
href="https://github.com/arendjr"><code>@​arendjr</code></a>! - Greatly
improved performance of
<code>noImportCycles</code> by eliminating allocations.</p>
<p>In one repository, the total runtime of Biome with only
<code>noImportCycles</code> enabled went from ~23s down to ~4s.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7447">#7447</a> <a
href="https://github.com/biomejs/biome/commit/7139aad75b6e8045be6eb09425fb82eb035fb704">
<code>7139aad</code></a> Thanks <a
href="https://github.com/rriski"><code>@​rriski</code></a>! - Fixes <a
href="https://redirect.github.com/biomejs/biome/issues/7446">#7446</a>.
The GritQL
<code>$...</code> spread metavariable now correctly matches members in
object literals, aligning its behavior with arrays and function
calls.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/6710">#6710</a> <a
href="https://github.com/biomejs/biome/commit/98cf9af0a4e02434983899ce49d92209a6abab02">
<code>98cf9af</code></a> Thanks <a
href="https://github.com/arendjr"><code>@​arendjr</code></a>! - Fixed <a
href="https://redirect.github.com/biomejs/biome/issues/7423">#4723</a>:
Type inference now recognises
<em>index signatures</em> and their accesses when they are being indexed
as a string.</p>
<h4>Example</h4>
<pre lang="ts"><code>type BagOfPromises = {
// This is an index signature definition. It declares that instances of
type
  // `BagOfPromises` can be indexed using arbitrary strings.
  [property: string]: Promise&lt;void&gt;;
};
<p>let bag: BagOfPromises = {};
// Because <code>bag.iAmAPromise</code> is equivalent to
<code>bag[&amp;quot;iAmAPromise&amp;quot;]</code>, this is
// considered an access to the string index, and a Promise is expected.
bag.iAmAPromise;
</code></pre></p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7415">#7415</a> <a
href="https://github.com/biomejs/biome/commit/d042f18f556edfd4fecff562c8f197dbec81a5e7">
<code>d042f18</code></a> Thanks <a
href="https://github.com/qraqras"><code>@​qraqras</code></a>! - Fixed <a
href="https://redirect.github.com/biomejs/biome/issues/7212">#7212</a>,
now the <a href="https://biomejs.dev/linter/rules/use-optional-chain/">
<code>useOptionalChain</code></a> rule recognizes optional chaining
using
<code>typeof</code> (e.g., <code>typeof foo !== 'undefined' &amp;&amp;
foo.bar</code>).</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7419">#7419</a> <a
href="https://github.com/biomejs/biome/commit/576baf4faf568e8b6a295f457f70894235ffdb59">
<code>576baf4</code></a> Thanks <a
href="https://github.com/Conaclos"><code>@​Conaclos</code></a>! - Fixed
<a
href="https://redirect.github.com/biomejs/biome/issues/7323">#7323</a>.
<a
href="https://biomejs.dev/linter/rules/no-unused-private-class-members/">
<code>noUnusedPrivateClassMembers</code></a> no longer reports as unused
TypeScript
<code>private</code> members if the rule encounters a computed access on
<code>this</code>.</p>
<p>In the following example, <code>member</code> as previously reported
as unused. It is no longer reported.</p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/biomejs/biome/blob/main/packages/@biomejs/biome/CHANGELOG.md"><code>@​biomejs/biome</code>'s
changelog</a>.</em></p>
<blockquote>
<h2>2.2.4</h2>
<h3>Patch Changes</h3>
<ul>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7453">#7453</a> <a
href="https://github.com/biomejs/biome/commit/aa8cea31af675699e18988fe79242ae5d5215af1"><code>aa8cea3</code></a>
Thanks <a href="https://github.com/arendjr"><code>@​arendjr</code></a>!
- Fixed <a
href="https://redirect.github.com/biomejs/biome/issues/7242">#7242</a>:
Aliases specified in
<code>package.json</code>'s <code>imports</code> section now support
having multiple targets as part of an array.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7454">#7454</a> <a
href="https://github.com/biomejs/biome/commit/ac171839a31600225e3b759470eaa026746e9cf4"><code>ac17183</code></a>
Thanks <a href="https://github.com/arendjr"><code>@​arendjr</code></a>!
- Greatly improved performance of
<code>noImportCycles</code> by eliminating allocations.</p>
<p>In one repository, the total runtime of Biome with only
<code>noImportCycles</code> enabled went from ~23s down to ~4s.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7447">#7447</a> <a
href="https://github.com/biomejs/biome/commit/7139aad75b6e8045be6eb09425fb82eb035fb704"><code>7139aad</code></a>
Thanks <a href="https://github.com/rriski"><code>@​rriski</code></a>! -
Fixes <a
href="https://redirect.github.com/biomejs/biome/issues/7446">#7446</a>.
The GritQL
<code>$...</code> spread metavariable now correctly matches members in
object literals, aligning its behavior with arrays and function
calls.</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/6710">#6710</a> <a
href="https://github.com/biomejs/biome/commit/98cf9af0a4e02434983899ce49d92209a6abab02"><code>98cf9af</code></a>
Thanks <a href="https://github.com/arendjr"><code>@​arendjr</code></a>!
- Fixed <a
href="https://redirect.github.com/biomejs/biome/issues/7423">#4723</a>:
Type inference now recognises
<em>index signatures</em> and their accesses when they are being indexed
as a string.</p>
<h4>Example</h4>
<pre lang="ts"><code>type BagOfPromises = {
// This is an index signature definition. It declares that instances of
type
  // `BagOfPromises` can be indexed using arbitrary strings.
  [property: string]: Promise&lt;void&gt;;
};
<p>let bag: BagOfPromises = {};
// Because <code>bag.iAmAPromise</code> is equivalent to
<code>bag[&amp;quot;iAmAPromise&amp;quot;]</code>, this is
// considered an access to the string index, and a Promise is expected.
bag.iAmAPromise;
</code></pre></p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7415">#7415</a> <a
href="https://github.com/biomejs/biome/commit/d042f18f556edfd4fecff562c8f197dbec81a5e7"><code>d042f18</code></a>
Thanks <a href="https://github.com/qraqras"><code>@​qraqras</code></a>!
- Fixed <a
href="https://redirect.github.com/biomejs/biome/issues/7212">#7212</a>,
now the <a
href="https://biomejs.dev/linter/rules/use-optional-chain/"><code>useOptionalChain</code></a>
rule recognizes optional chaining using
<code>typeof</code> (e.g., <code>typeof foo !== 'undefined' &amp;&amp;
foo.bar</code>).</p>
</li>
<li>
<p><a
href="https://redirect.github.com/biomejs/biome/pull/7419">#7419</a> <a
href="https://github.com/biomejs/biome/commit/576baf4faf568e8b6a295f457f70894235ffdb59"><code>576baf4</code></a>
Thanks <a
href="https://github.com/Conaclos"><code>@​Conaclos</code></a>! - Fixed
<a
href="https://redirect.github.com/biomejs/biome/issues/7323">#7323</a>.
<a
href="https://biomejs.dev/linter/rules/no-unused-private-class-members/"><code>noUnusedPrivateClassMembers</code></a>
no longer reports as unused TypeScript
<code>private</code> members if the rule encounters a computed access on
<code>this</code>.</p>
<p>In the following example, <code>member</code> as previously reported
as unused. It is no longer reported.</p>
<pre lang="ts"><code>class TsBioo {
  private member: number;
<p>set_with_name(name: string, value: number) {
this[name] = value;
}
}
</code></pre></p>
</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/biomejs/biome/commit/5d212c5ab940ba83cc72d4aa9936ebbb1964ae7a"><code>5d212c5</code></a>
ci: release (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7450">#7450</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/351bccdfe49a6173cb1446ef2a8a9171c8d78c26"><code>351bccd</code></a>
chore: restore release files</li>
<li><a
href="https://github.com/biomejs/biome/commit/32dbfa156b3d097813ff96e53a65b4004adb3591"><code>32dbfa1</code></a>
ci: release (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7413">#7413</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/75b6a0d12f3aa30647f743d607b0d60c0470fff3"><code>75b6a0d</code></a>
feat(linter): add rule <code>noJsxLiterals</code> (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7248">#7248</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/53ff5ae34428f042bb5b80c19862c9cf69fc6359"><code>53ff5ae</code></a>
feat(analyse/json): add <code>noDuplicateDependencies</code> rule (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7142">#7142</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/daa4a66e7971800a5e15024f5b5535d072087ac9"><code>daa4a66</code></a>
ci: release (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7306">#7306</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/0f38ea689acf6c64b0e749d34da48a03a9708067"><code>0f38ea6</code></a>
chore: add new bronze sponsor (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7397">#7397</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/7f532745900936039e77cc0b4254562ec9a7376d"><code>7f53274</code></a>
docs: safety of useSortedKeys (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/6112">#6112</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/fad34b9db9778fe964ff7dbc489de0bfad2d3ece"><code>fad34b9</code></a>
feat(biome_js_analyze): add UseConsistentArrowReturn rule (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7245">#7245</a>)</li>
<li><a
href="https://github.com/biomejs/biome/commit/4416573f4d709047a28407d99381810b7bc7dcc7"><code>4416573</code></a>
feat(lint/vue): implement <code>useVueMultiWordComponentNames</code> (<a
href="https://github.com/biomejs/biome/tree/HEAD/packages/@biomejs/biome/issues/7373">#7373</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/biomejs/biome/commits/@biomejs/biome@2.2.4/packages/@biomejs/biome">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=@biomejs/biome&package-manager=npm_and_yarn&previous-version=2.2.0&new-version=2.2.4)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  2 +-
 site/pnpm-lock.yaml | 80 ++++++++++++++++++++++-----------------------
 2 files changed, 41 insertions(+), 41 deletions(-)

diff --git a/site/package.json b/site/package.json
index 38617dce23a99..8a6c06c110dfb 100644
--- a/site/package.json
+++ b/site/package.json
@@ -123,7 +123,7 @@
 		"yup": "1.6.1"
 	},
 	"devDependencies": {
-		"@biomejs/biome": "2.2.0",
+		"@biomejs/biome": "2.2.4",
 		"@chromatic-com/storybook": "4.1.0",
 		"@octokit/types": "12.3.0",
 		"@playwright/test": "1.50.1",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index eebed5b445afc..35ed3e0545012 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -279,8 +279,8 @@ importers:
         version: 1.6.1
     devDependencies:
       '@biomejs/biome':
-        specifier: 2.2.0
-        version: 2.2.0
+        specifier: 2.2.4
+        version: 2.2.4
       '@chromatic-com/storybook':
         specifier: 4.1.0
         version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
@@ -454,7 +454,7 @@ importers:
         version: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
       vite-plugin-checker:
         specifier: 0.11.0
-        version: 0.11.0(@biomejs/biome@2.2.0)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+        version: 0.11.0(@biomejs/biome@2.2.4)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
 
 packages:
 
@@ -658,55 +658,55 @@ packages:
   '@bcoe/v8-coverage@0.2.3':
     resolution: {integrity: sha512-0hYQ8SB4Db5zvZB4axdMHGwEaQjkZzFjQiN9LVYvIFB2nSUHW9tYpxWriPrWDASIxiaXax83REcLxuSdnGPZtw==, tarball: https://registry.npmjs.org/@bcoe/v8-coverage/-/v8-coverage-0.2.3.tgz}
 
-  '@biomejs/biome@2.2.0':
-    resolution: {integrity: sha512-3On3RSYLsX+n9KnoSgfoYlckYBoU6VRM22cw1gB4Y0OuUVSYd/O/2saOJMrA4HFfA1Ff0eacOvMN1yAAvHtzIw==, tarball: https://registry.npmjs.org/@biomejs/biome/-/biome-2.2.0.tgz}
+  '@biomejs/biome@2.2.4':
+    resolution: {integrity: sha512-TBHU5bUy/Ok6m8c0y3pZiuO/BZoY/OcGxoLlrfQof5s8ISVwbVBdFINPQZyFfKwil8XibYWb7JMwnT8wT4WVPg==, tarball: https://registry.npmjs.org/@biomejs/biome/-/biome-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     hasBin: true
 
-  '@biomejs/cli-darwin-arm64@2.2.0':
-    resolution: {integrity: sha512-zKbwUUh+9uFmWfS8IFxmVD6XwqFcENjZvEyfOxHs1epjdH3wyyMQG80FGDsmauPwS2r5kXdEM0v/+dTIA9FXAg==, tarball: https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.2.0.tgz}
+  '@biomejs/cli-darwin-arm64@2.2.4':
+    resolution: {integrity: sha512-RJe2uiyaloN4hne4d2+qVj3d3gFJFbmrr5PYtkkjei1O9c+BjGXgpUPVbi8Pl8syumhzJjFsSIYkcLt2VlVLMA==, tarball: https://registry.npmjs.org/@biomejs/cli-darwin-arm64/-/cli-darwin-arm64-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [darwin]
 
-  '@biomejs/cli-darwin-x64@2.2.0':
-    resolution: {integrity: sha512-+OmT4dsX2eTfhD5crUOPw3RPhaR+SKVspvGVmSdZ9y9O/AgL8pla6T4hOn1q+VAFBHuHhsdxDRJgFCSC7RaMOw==, tarball: https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.2.0.tgz}
+  '@biomejs/cli-darwin-x64@2.2.4':
+    resolution: {integrity: sha512-cFsdB4ePanVWfTnPVaUX+yr8qV8ifxjBKMkZwN7gKb20qXPxd/PmwqUH8mY5wnM9+U0QwM76CxFyBRJhC9tQwg==, tarball: https://registry.npmjs.org/@biomejs/cli-darwin-x64/-/cli-darwin-x64-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [darwin]
 
-  '@biomejs/cli-linux-arm64-musl@2.2.0':
-    resolution: {integrity: sha512-egKpOa+4FL9YO+SMUMLUvf543cprjevNc3CAgDNFLcjknuNMcZ0GLJYa3EGTCR2xIkIUJDVneBV3O9OcIlCEZQ==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.2.0.tgz}
+  '@biomejs/cli-linux-arm64-musl@2.2.4':
+    resolution: {integrity: sha512-7TNPkMQEWfjvJDaZRSkDCPT/2r5ESFPKx+TEev+I2BXDGIjfCZk2+b88FOhnJNHtksbOZv8ZWnxrA5gyTYhSsQ==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-arm64-musl/-/cli-linux-arm64-musl-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
 
-  '@biomejs/cli-linux-arm64@2.2.0':
-    resolution: {integrity: sha512-6eoRdF2yW5FnW9Lpeivh7Mayhq0KDdaDMYOJnH9aT02KuSIX5V1HmWJCQQPwIQbhDh68Zrcpl8inRlTEan0SXw==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.2.0.tgz}
+  '@biomejs/cli-linux-arm64@2.2.4':
+    resolution: {integrity: sha512-M/Iz48p4NAzMXOuH+tsn5BvG/Jb07KOMTdSVwJpicmhN309BeEyRyQX+n1XDF0JVSlu28+hiTQ2L4rZPvu7nMw==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-arm64/-/cli-linux-arm64-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [linux]
 
-  '@biomejs/cli-linux-x64-musl@2.2.0':
-    resolution: {integrity: sha512-I5J85yWwUWpgJyC1CcytNSGusu2p9HjDnOPAFG4Y515hwRD0jpR9sT9/T1cKHtuCvEQ/sBvx+6zhz9l9wEJGAg==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.2.0.tgz}
+  '@biomejs/cli-linux-x64-musl@2.2.4':
+    resolution: {integrity: sha512-m41nFDS0ksXK2gwXL6W6yZTYPMH0LughqbsxInSKetoH6morVj43szqKx79Iudkp8WRT5SxSh7qVb8KCUiewGg==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-x64-musl/-/cli-linux-x64-musl-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
 
-  '@biomejs/cli-linux-x64@2.2.0':
-    resolution: {integrity: sha512-5UmQx/OZAfJfi25zAnAGHUMuOd+LOsliIt119x2soA2gLggQYrVPA+2kMUxR6Mw5M1deUF/AWWP2qpxgH7Nyfw==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.2.0.tgz}
+  '@biomejs/cli-linux-x64@2.2.4':
+    resolution: {integrity: sha512-orr3nnf2Dpb2ssl6aihQtvcKtLySLta4E2UcXdp7+RTa7mfJjBgIsbS0B9GC8gVu0hjOu021aU8b3/I1tn+pVQ==, tarball: https://registry.npmjs.org/@biomejs/cli-linux-x64/-/cli-linux-x64-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [linux]
 
-  '@biomejs/cli-win32-arm64@2.2.0':
-    resolution: {integrity: sha512-n9a1/f2CwIDmNMNkFs+JI0ZjFnMO0jdOyGNtihgUNFnlmd84yIYY2KMTBmMV58ZlVHjgmY5Y6E1hVTnSRieggA==, tarball: https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.2.0.tgz}
+  '@biomejs/cli-win32-arm64@2.2.4':
+    resolution: {integrity: sha512-NXnfTeKHDFUWfxAefa57DiGmu9VyKi0cDqFpdI+1hJWQjGJhJutHPX0b5m+eXvTKOaf+brU+P0JrQAZMb5yYaQ==, tarball: https://registry.npmjs.org/@biomejs/cli-win32-arm64/-/cli-win32-arm64-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [arm64]
     os: [win32]
 
-  '@biomejs/cli-win32-x64@2.2.0':
-    resolution: {integrity: sha512-Nawu5nHjP/zPKTIryh2AavzTc/KEg4um/MxWdXW0A6P/RZOyIpa7+QSjeXwAwX/utJGaCoXRPWtF3m5U/bB3Ww==, tarball: https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.2.0.tgz}
+  '@biomejs/cli-win32-x64@2.2.4':
+    resolution: {integrity: sha512-3Y4V4zVRarVh/B/eSHczR4LYoSVyv3Dfuvm3cWs5w/HScccS0+Wt/lHOcDTRYeHjQmMYVC3rIRWqyN2EI52+zg==, tarball: https://registry.npmjs.org/@biomejs/cli-win32-x64/-/cli-win32-x64-2.2.4.tgz}
     engines: {node: '>=14.21.3'}
     cpu: [x64]
     os: [win32]
@@ -6925,39 +6925,39 @@ snapshots:
 
   '@bcoe/v8-coverage@0.2.3': {}
 
-  '@biomejs/biome@2.2.0':
+  '@biomejs/biome@2.2.4':
     optionalDependencies:
-      '@biomejs/cli-darwin-arm64': 2.2.0
-      '@biomejs/cli-darwin-x64': 2.2.0
-      '@biomejs/cli-linux-arm64': 2.2.0
-      '@biomejs/cli-linux-arm64-musl': 2.2.0
-      '@biomejs/cli-linux-x64': 2.2.0
-      '@biomejs/cli-linux-x64-musl': 2.2.0
-      '@biomejs/cli-win32-arm64': 2.2.0
-      '@biomejs/cli-win32-x64': 2.2.0
+      '@biomejs/cli-darwin-arm64': 2.2.4
+      '@biomejs/cli-darwin-x64': 2.2.4
+      '@biomejs/cli-linux-arm64': 2.2.4
+      '@biomejs/cli-linux-arm64-musl': 2.2.4
+      '@biomejs/cli-linux-x64': 2.2.4
+      '@biomejs/cli-linux-x64-musl': 2.2.4
+      '@biomejs/cli-win32-arm64': 2.2.4
+      '@biomejs/cli-win32-x64': 2.2.4
 
-  '@biomejs/cli-darwin-arm64@2.2.0':
+  '@biomejs/cli-darwin-arm64@2.2.4':
     optional: true
 
-  '@biomejs/cli-darwin-x64@2.2.0':
+  '@biomejs/cli-darwin-x64@2.2.4':
     optional: true
 
-  '@biomejs/cli-linux-arm64-musl@2.2.0':
+  '@biomejs/cli-linux-arm64-musl@2.2.4':
     optional: true
 
-  '@biomejs/cli-linux-arm64@2.2.0':
+  '@biomejs/cli-linux-arm64@2.2.4':
     optional: true
 
-  '@biomejs/cli-linux-x64-musl@2.2.0':
+  '@biomejs/cli-linux-x64-musl@2.2.4':
     optional: true
 
-  '@biomejs/cli-linux-x64@2.2.0':
+  '@biomejs/cli-linux-x64@2.2.4':
     optional: true
 
-  '@biomejs/cli-win32-arm64@2.2.0':
+  '@biomejs/cli-win32-arm64@2.2.4':
     optional: true
 
-  '@biomejs/cli-win32-x64@2.2.0':
+  '@biomejs/cli-win32-x64@2.2.4':
     optional: true
 
   '@bundled-es-modules/cookie@2.0.1':
@@ -13416,7 +13416,7 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  vite-plugin-checker@0.11.0(@biomejs/biome@2.2.0)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
+  vite-plugin-checker@0.11.0(@biomejs/biome@2.2.4)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
     dependencies:
       '@babel/code-frame': 7.27.1
       chokidar: 4.0.3
@@ -13428,7 +13428,7 @@ snapshots:
       vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
       vscode-uri: 3.1.0
     optionalDependencies:
-      '@biomejs/biome': 2.2.0
+      '@biomejs/biome': 2.2.4
       eslint: 8.52.0
       optionator: 0.9.3
       typescript: 5.6.3

From 79f5cb8b9ae314f0d8be6b3b78108ee17ac6041b Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 22:46:31 +0000
Subject: [PATCH 032/298] chore: bump react-virtualized-auto-sizer and
 @types/react-virtualized-auto-sizer (#20078)

Bumps
[react-virtualized-auto-sizer](https://github.com/bvaughn/react-virtualized-auto-sizer)
and
[@types/react-virtualized-auto-sizer](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/react-virtualized-auto-sizer).
These dependencies needed to be updated together.
Updates `react-virtualized-auto-sizer` from 1.0.24 to 1.0.26
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/releases">react-virtualized-auto-sizer's
releases</a>.</em></p>
<blockquote>
<h2>1.0.26</h2>
<ul>
<li>Changed <code>width</code> and <code>height</code> values to be
based om <code>getBoundingClientRect</code> rather than
<code>offsetWidth</code> and <code>offsetHeight</code> (<a
href="https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/offsetWidth#value">which
are integers</a> and can cause rounding/flickering problems in some
cases).</li>
</ul>
<h2>1.0.25</h2>
<ul>
<li>Dependencies updated to include React 19</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/blob/master/CHANGELOG.md">react-virtualized-auto-sizer's
changelog</a>.</em></p>
<blockquote>
<h2>1.0.26</h2>
<ul>
<li>Changed <code>width</code> and <code>height</code> values to be
based om <code>getBoundingClientRect</code> rather than
<code>offsetWidth</code> and <code>offsetHeight</code> (<a
href="https://developer.mozilla.org/en-US/docs/Web/API/HTMLElement/offsetWidth#value">which
are integers</a> and can cause rounding/flickering problems in some
cases).</li>
</ul>
<h2>1.0.25</h2>
<ul>
<li>Dependencies updated to include React 19</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/45b1270b631829c29746de23ad8d60b9a19f0960"><code>45b1270</code></a>
Add deprecation warning for scaledWidth/scaledHeight accessors</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/e9c8ef003f09b13d4afa1a2dcb13f93d910dd937"><code>e9c8ef0</code></a>
Merge pull request <a
href="https://redirect.github.com/bvaughn/react-virtualized-auto-sizer/issues/97">#97</a>
from bvaughn/issues/96</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/fdf25d4075f3bb6ecc1062d2ad119459c8877f57"><code>fdf25d4</code></a>
Change width and height to come from getBoundingClientRect rather than
offset...</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/1898b073c15d4c62587cd2cab186a1b69f1131e4"><code>1898b07</code></a>
Tweaked README format</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/2dc8808e2654e4b2753a6f330dc87bb72c2958ee"><code>2dc8808</code></a>
1.0.24 -&gt; 1.0.25</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/801cc5239defabf2b0d53cfe236ea4cc447774e1"><code>801cc52</code></a>
Merge pull request <a
href="https://redirect.github.com/bvaughn/react-virtualized-auto-sizer/issues/93">#93</a>
from olafbuitelaar/patch-1</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/0b8b1811ffe82658f0330a5ae2726a105e71f9ce"><code>0b8b181</code></a>
updated deps to react 19</li>
<li><a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/commit/9f970c99fd53d7cb0908ad7d4de9982fdf63bd6e"><code>9f970c9</code></a>
Update README</li>
<li>See full diff in <a
href="https://github.com/bvaughn/react-virtualized-auto-sizer/compare/1.0.24...1.0.26">compare
view</a></li>
</ul>
</details>
<br />

Updates `@types/react-virtualized-auto-sizer` from 1.0.4 to 1.0.8
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/react-virtualized-auto-sizer">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |  4 ++--
 site/pnpm-lock.yaml | 30 +++++++++++++++++-------------
 2 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/site/package.json b/site/package.json
index 8a6c06c110dfb..9183fed149d2e 100644
--- a/site/package.json
+++ b/site/package.json
@@ -105,7 +105,7 @@
 		"react-router": "7.8.0",
 		"react-syntax-highlighter": "15.6.1",
 		"react-textarea-autosize": "8.5.9",
-		"react-virtualized-auto-sizer": "1.0.24",
+		"react-virtualized-auto-sizer": "1.0.26",
 		"react-window": "1.8.11",
 		"recharts": "2.15.0",
 		"remark-gfm": "4.0.0",
@@ -150,7 +150,7 @@
 		"@types/react-date-range": "1.4.4",
 		"@types/react-dom": "19.1.11",
 		"@types/react-syntax-highlighter": "15.5.13",
-		"@types/react-virtualized-auto-sizer": "1.0.4",
+		"@types/react-virtualized-auto-sizer": "1.0.8",
 		"@types/react-window": "1.8.8",
 		"@types/semver": "7.7.1",
 		"@types/ssh2": "1.15.5",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 35ed3e0545012..4570da4575185 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -230,8 +230,8 @@ importers:
         specifier: 8.5.9
         version: 8.5.9(@types/react@19.1.17)(react@19.1.1)
       react-virtualized-auto-sizer:
-        specifier: 1.0.24
-        version: 1.0.24(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+        specifier: 1.0.26
+        version: 1.0.26(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       react-window:
         specifier: 1.8.11
         version: 1.8.11(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -360,8 +360,8 @@ importers:
         specifier: 15.5.13
         version: 15.5.13
       '@types/react-virtualized-auto-sizer':
-        specifier: 1.0.4
-        version: 1.0.4
+        specifier: 1.0.8
+        version: 1.0.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       '@types/react-window':
         specifier: 1.8.8
         version: 1.8.8
@@ -2987,8 +2987,9 @@ packages:
     peerDependencies:
       '@types/react': '*'
 
-  '@types/react-virtualized-auto-sizer@1.0.4':
-    resolution: {integrity: sha512-nhYwlFiYa8M3S+O2T9QO/e1FQUYMr/wJENUdf/O0dhRi1RS/93rjrYQFYdbUqtdFySuhrtnEDX29P6eKOttY+A==, tarball: https://registry.npmjs.org/@types/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.4.tgz}
+  '@types/react-virtualized-auto-sizer@1.0.8':
+    resolution: {integrity: sha512-keJpNyhiwfl2+N12G1ocCVA5ZDBArbPLe/S90X3kt7fam9naeHdaYYWbpe2sHczp70JWJ+2QLhBE8kLvLuVNjA==, tarball: https://registry.npmjs.org/@types/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.8.tgz}
+    deprecated: This is a stub types definition. react-virtualized-auto-sizer provides its own type definitions, so you do not need this installed.
 
   '@types/react-window@1.8.8':
     resolution: {integrity: sha512-8Ls660bHR1AUA2kuRvVG9D/4XpRC6wjAaPT9dil7Ckc76eP9TKWZwwmgfq8Q1LANX3QNDnoU4Zp48A3w+zK69Q==, tarball: https://registry.npmjs.org/@types/react-window/-/react-window-1.8.8.tgz}
@@ -5728,11 +5729,11 @@ packages:
       react: '>=16.6.0'
       react-dom: '>=16.6.0'
 
-  react-virtualized-auto-sizer@1.0.24:
-    resolution: {integrity: sha512-3kCn7N9NEb3FlvJrSHWGQ4iVl+ydQObq2fHMn12i5wbtm74zHOPhz/i64OL3c1S1vi9i2GXtZqNqUJTQ+BnNfg==, tarball: https://registry.npmjs.org/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.24.tgz}
+  react-virtualized-auto-sizer@1.0.26:
+    resolution: {integrity: sha512-CblNyiNVw2o+hsa5/49NH2ogGxZ+t+3aweRvNSq7TVjDIlwk7ir4lencEg5HxHeSzwNarSkNkiu0qJSOXtxm5A==, tarball: https://registry.npmjs.org/react-virtualized-auto-sizer/-/react-virtualized-auto-sizer-1.0.26.tgz}
     peerDependencies:
-      react: ^15.3.0 || ^16.0.0-alpha || ^17.0.0 || ^18.0.0
-      react-dom: ^15.3.0 || ^16.0.0-alpha || ^17.0.0 || ^18.0.0
+      react: ^15.3.0 || ^16.0.0-alpha || ^17.0.0 || ^18.0.0 || ^19.0.0
+      react-dom: ^15.3.0 || ^16.0.0-alpha || ^17.0.0 || ^18.0.0 || ^19.0.0
 
   react-window@1.8.11:
     resolution: {integrity: sha512-+SRbUVT2scadgFSWx+R1P754xHPEqvcfSfVX10QYg6POOz+WNgkN48pS+BtZNIMGiL1HYrSEiCkwsMS15QogEQ==, tarball: https://registry.npmjs.org/react-window/-/react-window-1.8.11.tgz}
@@ -9187,9 +9188,12 @@ snapshots:
     dependencies:
       '@types/react': 19.1.17
 
-  '@types/react-virtualized-auto-sizer@1.0.4':
+  '@types/react-virtualized-auto-sizer@1.0.8(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
-      '@types/react': 19.1.17
+      react-virtualized-auto-sizer: 1.0.26(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
+    transitivePeerDependencies:
+      - react
+      - react-dom
 
   '@types/react-window@1.8.8':
     dependencies:
@@ -12591,7 +12595,7 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  react-virtualized-auto-sizer@1.0.24(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
+  react-virtualized-auto-sizer@1.0.26(react-dom@19.1.1(react@19.1.1))(react@19.1.1):
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)

From 29b4cfc55b9d7a712866b013da11bac006bd746d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 17:08:26 -0600
Subject: [PATCH 033/298] chore: bump remark-gfm from 4.0.0 to 4.0.1 in /site
 (#20081)

---
 site/package.json   |   2 +-
 site/pnpm-lock.yaml | 409 ++++++++------------------------------------
 2 files changed, 75 insertions(+), 336 deletions(-)

diff --git a/site/package.json b/site/package.json
index 9183fed149d2e..7ba86b7881665 100644
--- a/site/package.json
+++ b/site/package.json
@@ -108,7 +108,7 @@
 		"react-virtualized-auto-sizer": "1.0.26",
 		"react-window": "1.8.11",
 		"recharts": "2.15.0",
-		"remark-gfm": "4.0.0",
+		"remark-gfm": "4.0.1",
 		"resize-observer-polyfill": "1.5.1",
 		"semver": "7.7.2",
 		"tailwind-merge": "2.6.0",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 4570da4575185..49f5c686087b8 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -239,8 +239,8 @@ importers:
         specifier: 2.15.0
         version: 2.15.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
       remark-gfm:
-        specifier: 4.0.0
-        version: 4.0.0
+        specifier: 4.0.1
+        version: 4.0.1
       resize-observer-polyfill:
         specifier: 1.5.1
         version: 1.5.1
@@ -2919,9 +2919,6 @@ packages:
   '@types/lodash@4.17.20':
     resolution: {integrity: sha512-H3MHACvFUEiujabxhaI/ImO6gUrd8oOurg7LQtS7mbwIXA/cUqWrvBsaeJ23aZEPk1TAYkurjfMbSELfoCXlGA==, tarball: https://registry.npmjs.org/@types/lodash/-/lodash-4.17.20.tgz}
 
-  '@types/mdast@4.0.3':
-    resolution: {integrity: sha512-LsjtqsyF+d2/yFOYaN22dHZI1Cpwkrj+g06G8+qtUKlhovPW89YhqSnfKtMbkgmEtYpH2gydRNULd6y8mciAFg==, tarball: https://registry.npmjs.org/@types/mdast/-/mdast-4.0.3.tgz}
-
   '@types/mdast@4.0.4':
     resolution: {integrity: sha512-kGaNbPh1k7AFzgpud/gMdvIm5xuECykRR+JnWKQno9TAXVa6WIVCGTPvYGekIDL4uwCZQSYbUxNBSb1aUo79oA==, tarball: https://registry.npmjs.org/@types/mdast/-/mdast-4.0.4.tgz}
 
@@ -3041,9 +3038,6 @@ packages:
   '@types/unist@2.0.11':
     resolution: {integrity: sha512-CmBKiL6NNo/OqgmMn95Fk9Whlp2mtvIv+KNpQKN2F4SjvrEesubTRWGYSg+BnWZOnlCaSTU1sMpsBOzgbYhnsA==, tarball: https://registry.npmjs.org/@types/unist/-/unist-2.0.11.tgz}
 
-  '@types/unist@3.0.2':
-    resolution: {integrity: sha512-dqId9J8K/vGi5Zr7oo212BGii5m3q5Hxlkwy3WpYuKPklmBEvsbMYYyLxAQpSffdLl/gdW0XUpKWFvYmyoWCoQ==, tarball: https://registry.npmjs.org/@types/unist/-/unist-3.0.2.tgz}
-
   '@types/unist@3.0.3':
     resolution: {integrity: sha512-ko/gIFJRv177XgZsZcBwnqJN5x/Gien8qNOn0D5bQU/zAzVf9Zt3BlcUiLqhV9y4ARk0GbT3tnUiPNgnTXzc/Q==, tarball: https://registry.npmjs.org/@types/unist/-/unist-3.0.3.tgz}
 
@@ -3730,9 +3724,6 @@ packages:
   decimal.js@10.4.3:
     resolution: {integrity: sha512-VBBaLc1MgL5XpzgIP7ny5Z6Nx3UrRkIViUkPUdtl9aya5amy3De1gsUUSB1g3+3sExYNjCAsAznmukyxCb1GRA==, tarball: https://registry.npmjs.org/decimal.js/-/decimal.js-10.4.3.tgz}
 
-  decode-named-character-reference@1.0.2:
-    resolution: {integrity: sha512-O8x12RzrUF8xyVcY0KJowWsmaJxQbmy0/EtnNtHRpsOcT7dFk5W598coHqBVpmWo1oQQfsCqfCmkZN5DJrZVdg==, tarball: https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.0.2.tgz}
-
   decode-named-character-reference@1.2.0:
     resolution: {integrity: sha512-c6fcElNV6ShtZXmsgNgFFV5tVX2PaV4g+MOAkb8eXHvn6sryJBrZa9r0zV6+dtTyoCKxtDy5tyQ5ZwQuidtd+Q==, tarball: https://registry.npmjs.org/decode-named-character-reference/-/decode-named-character-reference-1.2.0.tgz}
 
@@ -4917,8 +4908,8 @@ packages:
   makeerror@1.0.12:
     resolution: {integrity: sha512-JmqCvUhmt43madlpFzG4BQzG2Z3m6tvQDNKdClZnO3VbIudJYmxsT0FNJMeiB2+JTSlTQTSbU8QdesVmwJcmLg==, tarball: https://registry.npmjs.org/makeerror/-/makeerror-1.0.12.tgz}
 
-  markdown-table@3.0.3:
-    resolution: {integrity: sha512-Z1NL3Tb1M9wH4XESsCDEksWoKTdlUafKc4pt0GRwjUyXaCFZ+dc3g2erqB6zm3szA2IUSi7VnPI+o/9jnxh9hw==, tarball: https://registry.npmjs.org/markdown-table/-/markdown-table-3.0.3.tgz}
+  markdown-table@3.0.4:
+    resolution: {integrity: sha512-wiYz4+JrLyb/DqW2hkFJxP7Vd7JuTDm77fvbM8VfEQdmSMqcImWeeRbHwZjBjIFki/VaMK2BhFi7oUUZeM5bqw==, tarball: https://registry.npmjs.org/markdown-table/-/markdown-table-3.0.4.tgz}
 
   material-colors@1.2.6:
     resolution: {integrity: sha512-6qE4B9deFBIa9YSpOc9O0Sgc43zTeVYbgDT5veRKSlB2+ZuHNoVVxA1L/ckMUayV9Ay9y7Z/SZCLcGteW9i7bg==, tarball: https://registry.npmjs.org/material-colors/-/material-colors-1.2.6.tgz}
@@ -4927,20 +4918,17 @@ packages:
     resolution: {integrity: sha512-/IXtbwEk5HTPyEwyKX6hGkYXxM9nbj64B+ilVJnC/R6B0pH5G4V3b0pVbL7DBj4tkhBAppbQUlf6F6Xl9LHu1g==, tarball: https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz}
     engines: {node: '>= 0.4'}
 
-  mdast-util-find-and-replace@3.0.1:
-    resolution: {integrity: sha512-SG21kZHGC3XRTSUhtofZkBzZTJNM5ecCi0SK2IMKmSXR8vO3peL+kb1O0z7Zl83jKtutG4k5Wv/W7V3/YHvzPA==, tarball: https://registry.npmjs.org/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.1.tgz}
-
-  mdast-util-from-markdown@2.0.0:
-    resolution: {integrity: sha512-n7MTOr/z+8NAX/wmhhDji8O3bRvPTV/U0oTCaZJkjhPSKTPhS3xufVhKGF8s1pJ7Ox4QgoIU7KHseh09S+9rTA==, tarball: https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.0.tgz}
+  mdast-util-find-and-replace@3.0.2:
+    resolution: {integrity: sha512-Tmd1Vg/m3Xz43afeNxDIhWRtFZgM2VLyaf4vSTYwudTyeuTneoL3qtWMA5jeLyz/O1vDJmmV4QuScFCA2tBPwg==, tarball: https://registry.npmjs.org/mdast-util-find-and-replace/-/mdast-util-find-and-replace-3.0.2.tgz}
 
   mdast-util-from-markdown@2.0.2:
     resolution: {integrity: sha512-uZhTV/8NBuw0WHkPTrCqDOl0zVe1BIng5ZtHoDk49ME1qqcjYmmLmOf0gELgcRMxN4w2iuIeVso5/6QymSrgmA==, tarball: https://registry.npmjs.org/mdast-util-from-markdown/-/mdast-util-from-markdown-2.0.2.tgz}
 
-  mdast-util-gfm-autolink-literal@2.0.0:
-    resolution: {integrity: sha512-FyzMsduZZHSc3i0Px3PQcBT4WJY/X/RCtEJKuybiC6sjPqLv7h1yqAkmILZtuxMSsUyaLUWNp71+vQH2zqp5cg==, tarball: https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.0.tgz}
+  mdast-util-gfm-autolink-literal@2.0.1:
+    resolution: {integrity: sha512-5HVP2MKaP6L+G6YaxPNjuL0BPrq9orG3TsrZ9YXbA3vDw/ACI4MEsnoDpn6ZNm7GnZgtAcONJyPhOP8tNJQavQ==, tarball: https://registry.npmjs.org/mdast-util-gfm-autolink-literal/-/mdast-util-gfm-autolink-literal-2.0.1.tgz}
 
-  mdast-util-gfm-footnote@2.0.0:
-    resolution: {integrity: sha512-5jOT2boTSVkMnQ7LTrd6n/18kqwjmuYqo7JUPe+tRCY6O7dAuTFMtTPauYYrMPpox9hlN0uOx/FL8XvEfG9/mQ==, tarball: https://registry.npmjs.org/mdast-util-gfm-footnote/-/mdast-util-gfm-footnote-2.0.0.tgz}
+  mdast-util-gfm-footnote@2.1.0:
+    resolution: {integrity: sha512-sqpDWlsHn7Ac9GNZQMeUzPQSMzR6Wv0WKRNvQRg0KqHh02fpTz69Qc1QSseNX29bhz1ROIyNyxExfawVKTm1GQ==, tarball: https://registry.npmjs.org/mdast-util-gfm-footnote/-/mdast-util-gfm-footnote-2.1.0.tgz}
 
   mdast-util-gfm-strikethrough@2.0.0:
     resolution: {integrity: sha512-mKKb915TF+OC5ptj5bJ7WFRPdYtuHv0yTRxK2tJvi+BDqbkiG7h7u/9SI89nRAYcmap2xHQL9D+QG/6wSrTtXg==, tarball: https://registry.npmjs.org/mdast-util-gfm-strikethrough/-/mdast-util-gfm-strikethrough-2.0.0.tgz}
@@ -4951,8 +4939,8 @@ packages:
   mdast-util-gfm-task-list-item@2.0.0:
     resolution: {integrity: sha512-IrtvNvjxC1o06taBAVJznEnkiHxLFTzgonUdy8hzFVeDun0uTjxxrRGVaNFqkU1wJR3RBPEfsxmU6jDWPofrTQ==, tarball: https://registry.npmjs.org/mdast-util-gfm-task-list-item/-/mdast-util-gfm-task-list-item-2.0.0.tgz}
 
-  mdast-util-gfm@3.0.0:
-    resolution: {integrity: sha512-dgQEX5Amaq+DuUqf26jJqSK9qgixgd6rYDHAv4aTBuA92cTknZlKpPfa86Z/s8Dj8xsAQpFfBmPUHWJBWqS4Bw==, tarball: https://registry.npmjs.org/mdast-util-gfm/-/mdast-util-gfm-3.0.0.tgz}
+  mdast-util-gfm@3.1.0:
+    resolution: {integrity: sha512-0ulfdQOM3ysHhCJ1p06l0b0VKlhU0wuQs3thxZQagjcjPrlFRqY215uZGHHJan9GEAXd9MbfPjFJz+qMkVR6zQ==, tarball: https://registry.npmjs.org/mdast-util-gfm/-/mdast-util-gfm-3.1.0.tgz}
 
   mdast-util-mdx-expression@2.0.1:
     resolution: {integrity: sha512-J6f+9hUp+ldTZqKRSg7Vw5V6MqjATc+3E4gf3CFNcuZNWD8XdyI6zQ8GqH7f8169MM6P7hMBRDVGnn7oHB9kXQ==, tarball: https://registry.npmjs.org/mdast-util-mdx-expression/-/mdast-util-mdx-expression-2.0.1.tgz}
@@ -4963,18 +4951,12 @@ packages:
   mdast-util-mdxjs-esm@2.0.1:
     resolution: {integrity: sha512-EcmOpxsZ96CvlP03NghtH1EsLtr0n9Tm4lPUJUBccV9RwUOneqSycg19n5HGzCf+10LozMRSObtVr3ee1WoHtg==, tarball: https://registry.npmjs.org/mdast-util-mdxjs-esm/-/mdast-util-mdxjs-esm-2.0.1.tgz}
 
-  mdast-util-phrasing@4.0.0:
-    resolution: {integrity: sha512-xadSsJayQIucJ9n053dfQwVu1kuXg7jCTdYsMK8rqzKZh52nLfSH/k0sAxE0u+pj/zKZX+o5wB+ML5mRayOxFA==, tarball: https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.0.0.tgz}
-
   mdast-util-phrasing@4.1.0:
     resolution: {integrity: sha512-TqICwyvJJpBwvGAMZjj4J2n0X8QWp21b9l0o7eXyVJ25YNWYbJDVIyD1bZXE6WtV6RmKJVYmQAKWa0zWOABz2w==, tarball: https://registry.npmjs.org/mdast-util-phrasing/-/mdast-util-phrasing-4.1.0.tgz}
 
   mdast-util-to-hast@13.2.0:
     resolution: {integrity: sha512-QGYKEuUsYT9ykKBCMOEDLsU5JRObWQusAolFMeko/tYPufNkRffBAQjIE+99jbA87xv6FgmjLtwjh9wBWajwAA==, tarball: https://registry.npmjs.org/mdast-util-to-hast/-/mdast-util-to-hast-13.2.0.tgz}
 
-  mdast-util-to-markdown@2.1.0:
-    resolution: {integrity: sha512-SR2VnIEdVNCJbP6y7kVTJgPLifdr8WEU440fQec7qHoHOUz/oJ2jmNRqdDQ3rbiStOXb2mCDGTuwsK5OPUgYlQ==, tarball: https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.0.tgz}
-
   mdast-util-to-markdown@2.1.2:
     resolution: {integrity: sha512-xj68wMTvGXVOKonmog6LwyJKrYXZPvlwabaryTjLh9LuvovB/KAH+kvi8Gjj+7rJjsFi23nkUxRQv1KqSroMqA==, tarball: https://registry.npmjs.org/mdast-util-to-markdown/-/mdast-util-to-markdown-2.1.2.tgz}
 
@@ -5002,144 +4984,87 @@ packages:
     resolution: {integrity: sha512-iclAHeNqNm68zFtnZ0e+1L2yUIdvzNoauKU4WBA3VvH/vPFieF7qfRlwUZU+DA9P9bPXIS90ulxoUoCH23sV2w==, tarball: https://registry.npmjs.org/methods/-/methods-1.1.2.tgz}
     engines: {node: '>= 0.6'}
 
-  micromark-core-commonmark@2.0.0:
-    resolution: {integrity: sha512-jThOz/pVmAYUtkroV3D5c1osFXAMv9e0ypGDOIZuCeAe91/sD6BoE2Sjzt30yuXtwOYUmySOhMas/PVyh02itA==, tarball: https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.0.tgz}
-
   micromark-core-commonmark@2.0.3:
     resolution: {integrity: sha512-RDBrHEMSxVFLg6xvnXmb1Ayr2WzLAWjeSATAoxwKYJV94TeNavgoIdA0a9ytzDSVzBy2YKFK+emCPOEibLeCrg==, tarball: https://registry.npmjs.org/micromark-core-commonmark/-/micromark-core-commonmark-2.0.3.tgz}
 
-  micromark-extension-gfm-autolink-literal@2.0.0:
-    resolution: {integrity: sha512-rTHfnpt/Q7dEAK1Y5ii0W8bhfJlVJFnJMHIPisfPK3gpVNuOP0VnRl96+YJ3RYWV/P4gFeQoGKNlT3RhuvpqAg==, tarball: https://registry.npmjs.org/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-2.0.0.tgz}
+  micromark-extension-gfm-autolink-literal@2.1.0:
+    resolution: {integrity: sha512-oOg7knzhicgQ3t4QCjCWgTmfNhvQbDDnJeVu9v81r7NltNCVmhPy1fJRX27pISafdjL+SVc4d3l48Gb6pbRypw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-autolink-literal/-/micromark-extension-gfm-autolink-literal-2.1.0.tgz}
 
-  micromark-extension-gfm-footnote@2.0.0:
-    resolution: {integrity: sha512-6Rzu0CYRKDv3BfLAUnZsSlzx3ak6HAoI85KTiijuKIz5UxZxbUI+pD6oHgw+6UtQuiRwnGRhzMmPRv4smcz0fg==, tarball: https://registry.npmjs.org/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-2.0.0.tgz}
+  micromark-extension-gfm-footnote@2.1.0:
+    resolution: {integrity: sha512-/yPhxI1ntnDNsiHtzLKYnE3vf9JZ6cAisqVDauhp4CEHxlb4uoOTxOCJ+9s51bIB8U1N1FJ1RXOKTIlD5B/gqw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-footnote/-/micromark-extension-gfm-footnote-2.1.0.tgz}
 
-  micromark-extension-gfm-strikethrough@2.0.0:
-    resolution: {integrity: sha512-c3BR1ClMp5fxxmwP6AoOY2fXO9U8uFMKs4ADD66ahLTNcwzSCyRVU4k7LPV5Nxo/VJiR4TdzxRQY2v3qIUceCw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-strikethrough/-/micromark-extension-gfm-strikethrough-2.0.0.tgz}
+  micromark-extension-gfm-strikethrough@2.1.0:
+    resolution: {integrity: sha512-ADVjpOOkjz1hhkZLlBiYA9cR2Anf8F4HqZUO6e5eDcPQd0Txw5fxLzzxnEkSkfnD0wziSGiv7sYhk/ktvbf1uw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-strikethrough/-/micromark-extension-gfm-strikethrough-2.1.0.tgz}
 
-  micromark-extension-gfm-table@2.0.0:
-    resolution: {integrity: sha512-PoHlhypg1ItIucOaHmKE8fbin3vTLpDOUg8KAr8gRCF1MOZI9Nquq2i/44wFvviM4WuxJzc3demT8Y3dkfvYrw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.0.0.tgz}
+  micromark-extension-gfm-table@2.1.1:
+    resolution: {integrity: sha512-t2OU/dXXioARrC6yWfJ4hqB7rct14e8f7m0cbI5hUmDyyIlwv5vEtooptH8INkbLzOatzKuVbQmAYcbWoyz6Dg==, tarball: https://registry.npmjs.org/micromark-extension-gfm-table/-/micromark-extension-gfm-table-2.1.1.tgz}
 
   micromark-extension-gfm-tagfilter@2.0.0:
     resolution: {integrity: sha512-xHlTOmuCSotIA8TW1mDIM6X2O1SiX5P9IuDtqGonFhEK0qgRI4yeC6vMxEV2dgyr2TiD+2PQ10o+cOhdVAcwfg==, tarball: https://registry.npmjs.org/micromark-extension-gfm-tagfilter/-/micromark-extension-gfm-tagfilter-2.0.0.tgz}
 
-  micromark-extension-gfm-task-list-item@2.0.1:
-    resolution: {integrity: sha512-cY5PzGcnULaN5O7T+cOzfMoHjBW7j+T9D2sucA5d/KbsBTPcYdebm9zUd9zzdgJGCwahV+/W78Z3nbulBYVbTw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-task-list-item/-/micromark-extension-gfm-task-list-item-2.0.1.tgz}
+  micromark-extension-gfm-task-list-item@2.1.0:
+    resolution: {integrity: sha512-qIBZhqxqI6fjLDYFTBIa4eivDMnP+OZqsNwmQ3xNLE4Cxwc+zfQEfbs6tzAo2Hjq+bh6q5F+Z8/cksrLFYWQQw==, tarball: https://registry.npmjs.org/micromark-extension-gfm-task-list-item/-/micromark-extension-gfm-task-list-item-2.1.0.tgz}
 
   micromark-extension-gfm@3.0.0:
     resolution: {integrity: sha512-vsKArQsicm7t0z2GugkCKtZehqUm31oeGBV/KVSorWSy8ZlNAv7ytjFhvaryUiCUJYqs+NoE6AFhpQvBTM6Q4w==, tarball: https://registry.npmjs.org/micromark-extension-gfm/-/micromark-extension-gfm-3.0.0.tgz}
 
-  micromark-factory-destination@2.0.0:
-    resolution: {integrity: sha512-j9DGrQLm/Uhl2tCzcbLhy5kXsgkHUrjJHg4fFAeoMRwJmJerT9aw4FEhIbZStWN8A3qMwOp1uzHr4UL8AInxtA==, tarball: https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.0.tgz}
-
   micromark-factory-destination@2.0.1:
     resolution: {integrity: sha512-Xe6rDdJlkmbFRExpTOmRj9N3MaWmbAgdpSrBQvCFqhezUn4AHqJHbaEnfbVYYiexVSs//tqOdY/DxhjdCiJnIA==, tarball: https://registry.npmjs.org/micromark-factory-destination/-/micromark-factory-destination-2.0.1.tgz}
 
-  micromark-factory-label@2.0.0:
-    resolution: {integrity: sha512-RR3i96ohZGde//4WSe/dJsxOX6vxIg9TimLAS3i4EhBAFx8Sm5SmqVfR8E87DPSR31nEAjZfbt91OMZWcNgdZw==, tarball: https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.0.tgz}
-
   micromark-factory-label@2.0.1:
     resolution: {integrity: sha512-VFMekyQExqIW7xIChcXn4ok29YE3rnuyveW3wZQWWqF4Nv9Wk5rgJ99KzPvHjkmPXF93FXIbBp6YdW3t71/7Vg==, tarball: https://registry.npmjs.org/micromark-factory-label/-/micromark-factory-label-2.0.1.tgz}
 
-  micromark-factory-space@2.0.0:
-    resolution: {integrity: sha512-TKr+LIDX2pkBJXFLzpyPyljzYK3MtmllMUMODTQJIUfDGncESaqB90db9IAUcz4AZAJFdd8U9zOp9ty1458rxg==, tarball: https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.0.0.tgz}
-
   micromark-factory-space@2.0.1:
     resolution: {integrity: sha512-zRkxjtBxxLd2Sc0d+fbnEunsTj46SWXgXciZmHq0kDYGnck/ZSGj9/wULTV95uoeYiK5hRXP2mJ98Uo4cq/LQg==, tarball: https://registry.npmjs.org/micromark-factory-space/-/micromark-factory-space-2.0.1.tgz}
 
-  micromark-factory-title@2.0.0:
-    resolution: {integrity: sha512-jY8CSxmpWLOxS+t8W+FG3Xigc0RDQA9bKMY/EwILvsesiRniiVMejYTE4wumNc2f4UbAa4WsHqe3J1QS1sli+A==, tarball: https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.0.tgz}
-
   micromark-factory-title@2.0.1:
     resolution: {integrity: sha512-5bZ+3CjhAd9eChYTHsjy6TGxpOFSKgKKJPJxr293jTbfry2KDoWkhBb6TcPVB4NmzaPhMs1Frm9AZH7OD4Cjzw==, tarball: https://registry.npmjs.org/micromark-factory-title/-/micromark-factory-title-2.0.1.tgz}
 
-  micromark-factory-whitespace@2.0.0:
-    resolution: {integrity: sha512-28kbwaBjc5yAI1XadbdPYHX/eDnqaUFVikLwrO7FDnKG7lpgxnvk/XGRhX/PN0mOZ+dBSZ+LgunHS+6tYQAzhA==, tarball: https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.0.tgz}
-
   micromark-factory-whitespace@2.0.1:
     resolution: {integrity: sha512-Ob0nuZ3PKt/n0hORHyvoD9uZhr+Za8sFoP+OnMcnWK5lngSzALgQYKMr9RJVOWLqQYuyn6ulqGWSXdwf6F80lQ==, tarball: https://registry.npmjs.org/micromark-factory-whitespace/-/micromark-factory-whitespace-2.0.1.tgz}
 
-  micromark-util-character@2.0.1:
-    resolution: {integrity: sha512-3wgnrmEAJ4T+mGXAUfMvMAbxU9RDG43XmGce4j6CwPtVxB3vfwXSZ6KhFwDzZ3mZHhmPimMAXg71veiBGzeAZw==, tarball: https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.0.1.tgz}
-
   micromark-util-character@2.1.1:
     resolution: {integrity: sha512-wv8tdUTJ3thSFFFJKtpYKOYiGP2+v96Hvk4Tu8KpCAsTMs6yi+nVmGh1syvSCsaxz45J6Jbw+9DD6g97+NV67Q==, tarball: https://registry.npmjs.org/micromark-util-character/-/micromark-util-character-2.1.1.tgz}
 
-  micromark-util-chunked@2.0.0:
-    resolution: {integrity: sha512-anK8SWmNphkXdaKgz5hJvGa7l00qmcaUQoMYsBwDlSKFKjc6gjGXPDw3FNL3Nbwq5L8gE+RCbGqTw49FK5Qyvg==, tarball: https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.0.tgz}
-
   micromark-util-chunked@2.0.1:
     resolution: {integrity: sha512-QUNFEOPELfmvv+4xiNg2sRYeS/P84pTW0TCgP5zc9FpXetHY0ab7SxKyAQCNCc1eK0459uoLI1y5oO5Vc1dbhA==, tarball: https://registry.npmjs.org/micromark-util-chunked/-/micromark-util-chunked-2.0.1.tgz}
 
-  micromark-util-classify-character@2.0.0:
-    resolution: {integrity: sha512-S0ze2R9GH+fu41FA7pbSqNWObo/kzwf8rN/+IGlW/4tC6oACOs8B++bh+i9bVyNnwCcuksbFwsBme5OCKXCwIw==, tarball: https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.0.tgz}
-
   micromark-util-classify-character@2.0.1:
     resolution: {integrity: sha512-K0kHzM6afW/MbeWYWLjoHQv1sgg2Q9EccHEDzSkxiP/EaagNzCm7T/WMKZ3rjMbvIpvBiZgwR3dKMygtA4mG1Q==, tarball: https://registry.npmjs.org/micromark-util-classify-character/-/micromark-util-classify-character-2.0.1.tgz}
 
-  micromark-util-combine-extensions@2.0.0:
-    resolution: {integrity: sha512-vZZio48k7ON0fVS3CUgFatWHoKbbLTK/rT7pzpJ4Bjp5JjkZeasRfrS9wsBdDJK2cJLHMckXZdzPSSr1B8a4oQ==, tarball: https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.0.tgz}
-
   micromark-util-combine-extensions@2.0.1:
     resolution: {integrity: sha512-OnAnH8Ujmy59JcyZw8JSbK9cGpdVY44NKgSM7E9Eh7DiLS2E9RNQf0dONaGDzEG9yjEl5hcqeIsj4hfRkLH/Bg==, tarball: https://registry.npmjs.org/micromark-util-combine-extensions/-/micromark-util-combine-extensions-2.0.1.tgz}
 
-  micromark-util-decode-numeric-character-reference@2.0.1:
-    resolution: {integrity: sha512-bmkNc7z8Wn6kgjZmVHOX3SowGmVdhYS7yBpMnuMnPzDq/6xwVA604DuOXMZTO1lvq01g+Adfa0pE2UKGlxL1XQ==, tarball: https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.1.tgz}
-
   micromark-util-decode-numeric-character-reference@2.0.2:
     resolution: {integrity: sha512-ccUbYk6CwVdkmCQMyr64dXz42EfHGkPQlBj5p7YVGzq8I7CtjXZJrubAYezf7Rp+bjPseiROqe7G6foFd+lEuw==, tarball: https://registry.npmjs.org/micromark-util-decode-numeric-character-reference/-/micromark-util-decode-numeric-character-reference-2.0.2.tgz}
 
-  micromark-util-decode-string@2.0.0:
-    resolution: {integrity: sha512-r4Sc6leeUTn3P6gk20aFMj2ntPwn6qpDZqWvYmAG6NgvFTIlj4WtrAudLi65qYoaGdXYViXYw2pkmn7QnIFasA==, tarball: https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.0.tgz}
-
   micromark-util-decode-string@2.0.1:
     resolution: {integrity: sha512-nDV/77Fj6eH1ynwscYTOsbK7rR//Uj0bZXBwJZRfaLEJ1iGBR6kIfNmlNqaqJf649EP0F3NWNdeJi03elllNUQ==, tarball: https://registry.npmjs.org/micromark-util-decode-string/-/micromark-util-decode-string-2.0.1.tgz}
 
   micromark-util-encode@2.0.1:
     resolution: {integrity: sha512-c3cVx2y4KqUnwopcO9b/SCdo2O67LwJJ/UyqGfbigahfegL9myoEFoDYZgkT7f36T0bLrM9hZTAaAyH+PCAXjw==, tarball: https://registry.npmjs.org/micromark-util-encode/-/micromark-util-encode-2.0.1.tgz}
 
-  micromark-util-html-tag-name@2.0.0:
-    resolution: {integrity: sha512-xNn4Pqkj2puRhKdKTm8t1YHC/BAjx6CEwRFXntTaRf/x16aqka6ouVoutm+QdkISTlT7e2zU7U4ZdlDLJd2Mcw==, tarball: https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.0.tgz}
-
   micromark-util-html-tag-name@2.0.1:
     resolution: {integrity: sha512-2cNEiYDhCWKI+Gs9T0Tiysk136SnR13hhO8yW6BGNyhOC4qYFnwF1nKfD3HFAIXA5c45RrIG1ub11GiXeYd1xA==, tarball: https://registry.npmjs.org/micromark-util-html-tag-name/-/micromark-util-html-tag-name-2.0.1.tgz}
 
-  micromark-util-normalize-identifier@2.0.0:
-    resolution: {integrity: sha512-2xhYT0sfo85FMrUPtHcPo2rrp1lwbDEEzpx7jiH2xXJLqBuy4H0GgXk5ToU8IEwoROtXuL8ND0ttVa4rNqYK3w==, tarball: https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.0.tgz}
-
   micromark-util-normalize-identifier@2.0.1:
     resolution: {integrity: sha512-sxPqmo70LyARJs0w2UclACPUUEqltCkJ6PhKdMIDuJ3gSf/Q+/GIe3WKl0Ijb/GyH9lOpUkRAO2wp0GVkLvS9Q==, tarball: https://registry.npmjs.org/micromark-util-normalize-identifier/-/micromark-util-normalize-identifier-2.0.1.tgz}
 
-  micromark-util-resolve-all@2.0.0:
-    resolution: {integrity: sha512-6KU6qO7DZ7GJkaCgwBNtplXCvGkJToU86ybBAUdavvgsCiG8lSSvYxr9MhwmQ+udpzywHsl4RpGJsYWG1pDOcA==, tarball: https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.0.tgz}
-
   micromark-util-resolve-all@2.0.1:
     resolution: {integrity: sha512-VdQyxFWFT2/FGJgwQnJYbe1jjQoNTS4RjglmSjTUlpUMa95Htx9NHeYW4rGDJzbjvCsl9eLjMQwGeElsqmzcHg==, tarball: https://registry.npmjs.org/micromark-util-resolve-all/-/micromark-util-resolve-all-2.0.1.tgz}
 
   micromark-util-sanitize-uri@2.0.1:
     resolution: {integrity: sha512-9N9IomZ/YuGGZZmQec1MbgxtlgougxTodVwDzzEouPKo3qFWvymFHWcnDi2vzV1ff6kas9ucW+o3yzJK9YB1AQ==, tarball: https://registry.npmjs.org/micromark-util-sanitize-uri/-/micromark-util-sanitize-uri-2.0.1.tgz}
 
-  micromark-util-subtokenize@2.0.0:
-    resolution: {integrity: sha512-vc93L1t+gpR3p8jxeVdaYlbV2jTYteDje19rNSS/H5dlhxUYll5Fy6vJ2cDwP8RnsXi818yGty1ayP55y3W6fg==, tarball: https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.0.0.tgz}
-
   micromark-util-subtokenize@2.1.0:
     resolution: {integrity: sha512-XQLu552iSctvnEcgXw6+Sx75GflAPNED1qx7eBJ+wydBb2KCbRZe+NwvIEEMM83uml1+2WSXpBAcp9IUCgCYWA==, tarball: https://registry.npmjs.org/micromark-util-subtokenize/-/micromark-util-subtokenize-2.1.0.tgz}
 
-  micromark-util-symbol@2.0.0:
-    resolution: {integrity: sha512-8JZt9ElZ5kyTnO94muPxIGS8oyElRJaiJO8EzV6ZSyGQ1Is8xwl4Q45qU5UOg+bGH4AikWziz0iN4sFLWs8PGw==, tarball: https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.0.tgz}
-
   micromark-util-symbol@2.0.1:
     resolution: {integrity: sha512-vs5t8Apaud9N28kgCrRUdEed4UJ+wWNvicHLPxCa9ENlYuAY31M0ETy5y1vA33YoNPDFTghEbnh6efaE8h4x0Q==, tarball: https://registry.npmjs.org/micromark-util-symbol/-/micromark-util-symbol-2.0.1.tgz}
 
-  micromark-util-types@2.0.0:
-    resolution: {integrity: sha512-oNh6S2WMHWRZrmutsRmDDfkzKtxF+bc2VxLC9dvtrDIRFln627VsFP6fLMgTryGDljgLPjkrzQSDcPrjPyDJ5w==, tarball: https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.0.tgz}
-
   micromark-util-types@2.0.2:
     resolution: {integrity: sha512-Yw0ECSpJoViF1qTU4DC6NwtC4aWGt1EkzaQB8KPPyCRR8z9TWeV0HbEFGTO+ZY1wB22zmxnJqhPyTpOVCpeHTA==, tarball: https://registry.npmjs.org/micromark-util-types/-/micromark-util-types-2.0.2.tgz}
 
-  micromark@4.0.0:
-    resolution: {integrity: sha512-o/sd0nMof8kYff+TqcDx3VSrgBTcZpSvYcAHIfHhv5VAuNmisCxjhx6YmxS8PFEpb9z5WKWKPdzf0jM23ro3RQ==, tarball: https://registry.npmjs.org/micromark/-/micromark-4.0.0.tgz}
-
   micromark@4.0.2:
     resolution: {integrity: sha512-zpe98Q6kvavpCr1NPVSCMebCKfD7CA2NqZ+rykeNhONIJBpc1tFKt9hucLGwha3jNTNI8lHpctWJWoimVF4PfA==, tarball: https://registry.npmjs.org/micromark/-/micromark-4.0.2.tgz}
 
@@ -5797,8 +5722,8 @@ packages:
     resolution: {integrity: sha512-sy6TXMN+hnP/wMy+ISxg3krXx7BAtWVO4UouuCN/ziM9UEne0euamVNafDfvC83bRNr95y0V5iijeDQFUNpvrg==, tarball: https://registry.npmjs.org/regexp.prototype.flags/-/regexp.prototype.flags-1.5.1.tgz}
     engines: {node: '>= 0.4'}
 
-  remark-gfm@4.0.0:
-    resolution: {integrity: sha512-U92vJgBPkbw4Zfu/IiW2oTZLSL3Zpv+uI7My2eq8JxKgqraFdU8YUGicEJCEgSbeaG+QDFqIcwwfMTOEelPxuA==, tarball: https://registry.npmjs.org/remark-gfm/-/remark-gfm-4.0.0.tgz}
+  remark-gfm@4.0.1:
+    resolution: {integrity: sha512-1quofZ2RQ9EWdeN34S79+KExV1764+wCUGop5CPL1WGdD0ocPpu91lzPGbwWMECpEpd42kJGQwzRfyov9j4yNg==, tarball: https://registry.npmjs.org/remark-gfm/-/remark-gfm-4.0.1.tgz}
 
   remark-parse@11.0.0:
     resolution: {integrity: sha512-FCxlKLNGknS5ba/1lmpYijMUzX2esxW5xQqjWxw2eHFfS2MSdaHVINFmhjo+qN1WhZhNimq0dZATN9pH0IDrpA==, tarball: https://registry.npmjs.org/remark-parse/-/remark-parse-11.0.0.tgz}
@@ -6210,9 +6135,6 @@ packages:
   trim-lines@3.0.1:
     resolution: {integrity: sha512-kRj8B+YHZCc9kQYdWfJB2/oUl9rA99qbowYYBtr4ui4mZyAQ2JpvVBd/6U2YloATfqBhBTSMhTpgBHtU0Mf3Rg==, tarball: https://registry.npmjs.org/trim-lines/-/trim-lines-3.0.1.tgz}
 
-  trough@2.1.0:
-    resolution: {integrity: sha512-AqTiAOLcj85xS7vQ8QkAV41hPDIJ71XJB4RCUrzo/1GM2CQwhkJGaf9Hgr7BOugMRpgGUrqRg/DrBDl4H40+8g==, tarball: https://registry.npmjs.org/trough/-/trough-2.1.0.tgz}
-
   trough@2.2.0:
     resolution: {integrity: sha512-tmMpK00BjZiUyVyvrBK7knerNgmgvcV/KLVyuma/SC+TQN167GrMRciANTz09+k3zW8L8t60jWO1GpfkZdjTaw==, tarball: https://registry.npmjs.org/trough/-/trough-2.2.0.tgz}
 
@@ -6324,9 +6246,6 @@ packages:
     resolution: {integrity: sha512-+QBBXBCvifc56fsbuxZQ6Sic3wqqc3WWaqxs58gvJrcOuN83HGTCwz3oS5phzU9LthRNE9VrJCFCLUgHeeFnfA==, tarball: https://registry.npmjs.org/unicorn-magic/-/unicorn-magic-0.3.0.tgz}
     engines: {node: '>=18'}
 
-  unified@11.0.4:
-    resolution: {integrity: sha512-apMPnyLjAX+ty4OrNap7yumyVAMlKx5IWU2wlzzUdYJO9A8f1p9m/gywF/GM2ZDFcjQPrx59Mc90KwmxsoklxQ==, tarball: https://registry.npmjs.org/unified/-/unified-11.0.4.tgz}
-
   unified@11.0.5:
     resolution: {integrity: sha512-xKvGhPWw3k84Qjh8bI3ZeJjqnyadK+GEFtazSfZv/rKeTkTjOJho6mFqh2SM96iIcZokxiOpg78GazTSg8+KHA==, tarball: https://registry.npmjs.org/unified/-/unified-11.0.5.tgz}
 
@@ -9122,10 +9041,6 @@ snapshots:
 
   '@types/lodash@4.17.20': {}
 
-  '@types/mdast@4.0.3':
-    dependencies:
-      '@types/unist': 3.0.2
-
   '@types/mdast@4.0.4':
     dependencies:
       '@types/unist': 3.0.3
@@ -9242,8 +9157,6 @@ snapshots:
 
   '@types/unist@2.0.11': {}
 
-  '@types/unist@3.0.2': {}
-
   '@types/unist@3.0.3': {}
 
   '@types/uuid@9.0.2': {}
@@ -9914,10 +9827,6 @@ snapshots:
 
   decimal.js@10.4.3: {}
 
-  decode-named-character-reference@1.0.2:
-    dependencies:
-      character-entities: 2.0.2
-
   decode-named-character-reference@1.2.0:
     dependencies:
       character-entities: 2.0.2
@@ -11462,36 +11371,19 @@ snapshots:
     dependencies:
       tmpl: 1.0.5
 
-  markdown-table@3.0.3: {}
+  markdown-table@3.0.4: {}
 
   material-colors@1.2.6: {}
 
   math-intrinsics@1.1.0: {}
 
-  mdast-util-find-and-replace@3.0.1:
+  mdast-util-find-and-replace@3.0.2:
     dependencies:
       '@types/mdast': 4.0.4
       escape-string-regexp: 5.0.0
       unist-util-is: 6.0.0
       unist-util-visit-parents: 6.0.1
 
-  mdast-util-from-markdown@2.0.0:
-    dependencies:
-      '@types/mdast': 4.0.4
-      '@types/unist': 3.0.3
-      decode-named-character-reference: 1.0.2
-      devlop: 1.1.0
-      mdast-util-to-string: 4.0.0
-      micromark: 4.0.0
-      micromark-util-decode-numeric-character-reference: 2.0.1
-      micromark-util-decode-string: 2.0.0
-      micromark-util-normalize-identifier: 2.0.0
-      micromark-util-symbol: 2.0.0
-      micromark-util-types: 2.0.2
-      unist-util-stringify-position: 4.0.0
-    transitivePeerDependencies:
-      - supports-color
-
   mdast-util-from-markdown@2.0.2:
     dependencies:
       '@types/mdast': 4.0.4
@@ -11509,21 +11401,21 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-gfm-autolink-literal@2.0.0:
+  mdast-util-gfm-autolink-literal@2.0.1:
     dependencies:
       '@types/mdast': 4.0.4
       ccount: 2.0.1
       devlop: 1.1.0
-      mdast-util-find-and-replace: 3.0.1
-      micromark-util-character: 2.0.1
+      mdast-util-find-and-replace: 3.0.2
+      micromark-util-character: 2.1.1
 
-  mdast-util-gfm-footnote@2.0.0:
+  mdast-util-gfm-footnote@2.1.0:
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.0
-      micromark-util-normalize-identifier: 2.0.0
+      mdast-util-to-markdown: 2.1.2
+      micromark-util-normalize-identifier: 2.0.1
     transitivePeerDependencies:
       - supports-color
 
@@ -11531,7 +11423,7 @@ snapshots:
     dependencies:
       '@types/mdast': 4.0.4
       mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.0
+      mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
@@ -11539,9 +11431,9 @@ snapshots:
     dependencies:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
-      markdown-table: 3.0.3
+      markdown-table: 3.0.4
       mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.0
+      mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
@@ -11550,19 +11442,19 @@ snapshots:
       '@types/mdast': 4.0.4
       devlop: 1.1.0
       mdast-util-from-markdown: 2.0.2
-      mdast-util-to-markdown: 2.1.0
+      mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-gfm@3.0.0:
+  mdast-util-gfm@3.1.0:
     dependencies:
-      mdast-util-from-markdown: 2.0.0
-      mdast-util-gfm-autolink-literal: 2.0.0
-      mdast-util-gfm-footnote: 2.0.0
+      mdast-util-from-markdown: 2.0.2
+      mdast-util-gfm-autolink-literal: 2.0.1
+      mdast-util-gfm-footnote: 2.1.0
       mdast-util-gfm-strikethrough: 2.0.0
       mdast-util-gfm-table: 2.0.0
       mdast-util-gfm-task-list-item: 2.0.0
-      mdast-util-to-markdown: 2.1.0
+      mdast-util-to-markdown: 2.1.2
     transitivePeerDependencies:
       - supports-color
 
@@ -11605,11 +11497,6 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  mdast-util-phrasing@4.0.0:
-    dependencies:
-      '@types/mdast': 4.0.4
-      unist-util-is: 6.0.0
-
   mdast-util-phrasing@4.1.0:
     dependencies:
       '@types/mdast': 4.0.4
@@ -11627,17 +11514,6 @@ snapshots:
       unist-util-visit: 5.0.0
       vfile: 6.0.3
 
-  mdast-util-to-markdown@2.1.0:
-    dependencies:
-      '@types/mdast': 4.0.4
-      '@types/unist': 3.0.3
-      longest-streak: 3.1.0
-      mdast-util-phrasing: 4.0.0
-      mdast-util-to-string: 4.0.0
-      micromark-util-decode-string: 2.0.0
-      unist-util-visit: 5.0.0
-      zwitch: 2.0.4
-
   mdast-util-to-markdown@2.1.2:
     dependencies:
       '@types/mdast': 4.0.4
@@ -11666,25 +11542,6 @@ snapshots:
 
   methods@1.1.2: {}
 
-  micromark-core-commonmark@2.0.0:
-    dependencies:
-      decode-named-character-reference: 1.2.0
-      devlop: 1.1.0
-      micromark-factory-destination: 2.0.0
-      micromark-factory-label: 2.0.0
-      micromark-factory-space: 2.0.0
-      micromark-factory-title: 2.0.0
-      micromark-factory-whitespace: 2.0.0
-      micromark-util-character: 2.1.1
-      micromark-util-chunked: 2.0.0
-      micromark-util-classify-character: 2.0.0
-      micromark-util-html-tag-name: 2.0.0
-      micromark-util-normalize-identifier: 2.0.1
-      micromark-util-resolve-all: 2.0.0
-      micromark-util-subtokenize: 2.0.0
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-core-commonmark@2.0.3:
     dependencies:
       decode-named-character-reference: 1.2.0
@@ -11704,68 +11561,62 @@ snapshots:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-extension-gfm-autolink-literal@2.0.0:
+  micromark-extension-gfm-autolink-literal@2.1.0:
     dependencies:
-      micromark-util-character: 2.0.1
+      micromark-util-character: 2.1.1
       micromark-util-sanitize-uri: 2.0.1
-      micromark-util-symbol: 2.0.0
+      micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-extension-gfm-footnote@2.0.0:
+  micromark-extension-gfm-footnote@2.1.0:
     dependencies:
       devlop: 1.1.0
-      micromark-core-commonmark: 2.0.0
-      micromark-factory-space: 2.0.0
-      micromark-util-character: 2.0.1
-      micromark-util-normalize-identifier: 2.0.0
+      micromark-core-commonmark: 2.0.3
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-normalize-identifier: 2.0.1
       micromark-util-sanitize-uri: 2.0.1
-      micromark-util-symbol: 2.0.0
+      micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-extension-gfm-strikethrough@2.0.0:
+  micromark-extension-gfm-strikethrough@2.1.0:
     dependencies:
       devlop: 1.1.0
-      micromark-util-chunked: 2.0.0
-      micromark-util-classify-character: 2.0.0
-      micromark-util-resolve-all: 2.0.0
-      micromark-util-symbol: 2.0.0
+      micromark-util-chunked: 2.0.1
+      micromark-util-classify-character: 2.0.1
+      micromark-util-resolve-all: 2.0.1
+      micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-extension-gfm-table@2.0.0:
+  micromark-extension-gfm-table@2.1.1:
     dependencies:
       devlop: 1.1.0
-      micromark-factory-space: 2.0.0
-      micromark-util-character: 2.0.1
-      micromark-util-symbol: 2.0.0
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
   micromark-extension-gfm-tagfilter@2.0.0:
     dependencies:
       micromark-util-types: 2.0.2
 
-  micromark-extension-gfm-task-list-item@2.0.1:
+  micromark-extension-gfm-task-list-item@2.1.0:
     dependencies:
       devlop: 1.1.0
-      micromark-factory-space: 2.0.0
-      micromark-util-character: 2.0.1
-      micromark-util-symbol: 2.0.0
+      micromark-factory-space: 2.0.1
+      micromark-util-character: 2.1.1
+      micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
   micromark-extension-gfm@3.0.0:
     dependencies:
-      micromark-extension-gfm-autolink-literal: 2.0.0
-      micromark-extension-gfm-footnote: 2.0.0
-      micromark-extension-gfm-strikethrough: 2.0.0
-      micromark-extension-gfm-table: 2.0.0
+      micromark-extension-gfm-autolink-literal: 2.1.0
+      micromark-extension-gfm-footnote: 2.1.0
+      micromark-extension-gfm-strikethrough: 2.1.0
+      micromark-extension-gfm-table: 2.1.1
       micromark-extension-gfm-tagfilter: 2.0.0
-      micromark-extension-gfm-task-list-item: 2.0.1
-      micromark-util-combine-extensions: 2.0.0
-      micromark-util-types: 2.0.0
-
-  micromark-factory-destination@2.0.0:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
+      micromark-extension-gfm-task-list-item: 2.1.0
+      micromark-util-combine-extensions: 2.0.1
       micromark-util-types: 2.0.2
 
   micromark-factory-destination@2.0.1:
@@ -11774,13 +11625,6 @@ snapshots:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-factory-label@2.0.0:
-    dependencies:
-      devlop: 1.1.0
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-factory-label@2.0.1:
     dependencies:
       devlop: 1.1.0
@@ -11788,23 +11632,11 @@ snapshots:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-factory-space@2.0.0:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-types: 2.0.2
-
   micromark-factory-space@2.0.1:
     dependencies:
       micromark-util-character: 2.1.1
       micromark-util-types: 2.0.2
 
-  micromark-factory-title@2.0.0:
-    dependencies:
-      micromark-factory-space: 2.0.1
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-factory-title@2.0.1:
     dependencies:
       micromark-factory-space: 2.0.1
@@ -11812,13 +11644,6 @@ snapshots:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-factory-whitespace@2.0.0:
-    dependencies:
-      micromark-factory-space: 2.0.1
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-factory-whitespace@2.0.1:
     dependencies:
       micromark-factory-space: 2.0.1
@@ -11826,61 +11651,30 @@ snapshots:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-util-character@2.0.1:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-util-character@2.1.1:
     dependencies:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-util-chunked@2.0.0:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-
   micromark-util-chunked@2.0.1:
     dependencies:
       micromark-util-symbol: 2.0.1
 
-  micromark-util-classify-character@2.0.0:
-    dependencies:
-      micromark-util-character: 2.1.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-util-classify-character@2.0.1:
     dependencies:
       micromark-util-character: 2.1.1
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-util-combine-extensions@2.0.0:
-    dependencies:
-      micromark-util-chunked: 2.0.0
-      micromark-util-types: 2.0.2
-
   micromark-util-combine-extensions@2.0.1:
     dependencies:
       micromark-util-chunked: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-util-decode-numeric-character-reference@2.0.1:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-
   micromark-util-decode-numeric-character-reference@2.0.2:
     dependencies:
       micromark-util-symbol: 2.0.1
 
-  micromark-util-decode-string@2.0.0:
-    dependencies:
-      decode-named-character-reference: 1.2.0
-      micromark-util-character: 2.1.1
-      micromark-util-decode-numeric-character-reference: 2.0.2
-      micromark-util-symbol: 2.0.1
-
   micromark-util-decode-string@2.0.1:
     dependencies:
       decode-named-character-reference: 1.2.0
@@ -11890,22 +11684,12 @@ snapshots:
 
   micromark-util-encode@2.0.1: {}
 
-  micromark-util-html-tag-name@2.0.0: {}
-
   micromark-util-html-tag-name@2.0.1: {}
 
-  micromark-util-normalize-identifier@2.0.0:
-    dependencies:
-      micromark-util-symbol: 2.0.1
-
   micromark-util-normalize-identifier@2.0.1:
     dependencies:
       micromark-util-symbol: 2.0.1
 
-  micromark-util-resolve-all@2.0.0:
-    dependencies:
-      micromark-util-types: 2.0.2
-
   micromark-util-resolve-all@2.0.1:
     dependencies:
       micromark-util-types: 2.0.2
@@ -11916,13 +11700,6 @@ snapshots:
       micromark-util-encode: 2.0.1
       micromark-util-symbol: 2.0.1
 
-  micromark-util-subtokenize@2.0.0:
-    dependencies:
-      devlop: 1.1.0
-      micromark-util-chunked: 2.0.1
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-
   micromark-util-subtokenize@2.1.0:
     dependencies:
       devlop: 1.1.0
@@ -11930,36 +11707,10 @@ snapshots:
       micromark-util-symbol: 2.0.1
       micromark-util-types: 2.0.2
 
-  micromark-util-symbol@2.0.0: {}
-
   micromark-util-symbol@2.0.1: {}
 
-  micromark-util-types@2.0.0: {}
-
   micromark-util-types@2.0.2: {}
 
-  micromark@4.0.0:
-    dependencies:
-      '@types/debug': 4.1.12
-      debug: 4.4.3
-      decode-named-character-reference: 1.2.0
-      devlop: 1.1.0
-      micromark-core-commonmark: 2.0.0
-      micromark-factory-space: 2.0.0
-      micromark-util-character: 2.1.1
-      micromark-util-chunked: 2.0.0
-      micromark-util-combine-extensions: 2.0.0
-      micromark-util-decode-numeric-character-reference: 2.0.2
-      micromark-util-encode: 2.0.1
-      micromark-util-normalize-identifier: 2.0.1
-      micromark-util-resolve-all: 2.0.0
-      micromark-util-sanitize-uri: 2.0.1
-      micromark-util-subtokenize: 2.0.0
-      micromark-util-symbol: 2.0.1
-      micromark-util-types: 2.0.2
-    transitivePeerDependencies:
-      - supports-color
-
   micromark@4.0.2:
     dependencies:
       '@types/debug': 4.1.12
@@ -12684,14 +12435,14 @@ snapshots:
       define-properties: 1.2.1
       set-function-name: 2.0.1
 
-  remark-gfm@4.0.0:
+  remark-gfm@4.0.1:
     dependencies:
-      '@types/mdast': 4.0.3
-      mdast-util-gfm: 3.0.0
+      '@types/mdast': 4.0.4
+      mdast-util-gfm: 3.1.0
       micromark-extension-gfm: 3.0.0
       remark-parse: 11.0.0
       remark-stringify: 11.0.0
-      unified: 11.0.4
+      unified: 11.0.5
     transitivePeerDependencies:
       - supports-color
 
@@ -12715,7 +12466,7 @@ snapshots:
   remark-stringify@11.0.0:
     dependencies:
       '@types/mdast': 4.0.4
-      mdast-util-to-markdown: 2.1.0
+      mdast-util-to-markdown: 2.1.2
       unified: 11.0.5
 
   require-directory@2.1.1: {}
@@ -13166,8 +12917,6 @@ snapshots:
 
   trim-lines@3.0.1: {}
 
-  trough@2.1.0: {}
-
   trough@2.2.0: {}
 
   ts-dedent@2.2.0: {}
@@ -13264,16 +13013,6 @@ snapshots:
 
   unicorn-magic@0.3.0: {}
 
-  unified@11.0.4:
-    dependencies:
-      '@types/unist': 3.0.2
-      bail: 2.0.2
-      devlop: 1.1.0
-      extend: 3.0.2
-      is-plain-obj: 4.1.0
-      trough: 2.1.0
-      vfile: 6.0.3
-
   unified@11.0.5:
     dependencies:
       '@types/unist': 3.0.3

From 41420aea3c1636e86d92d99b9b41bf68f4fe5b60 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Wed, 1 Oct 2025 23:11:11 +0000
Subject: [PATCH 034/298] chore: bump ts-proto from 1.164.0 to 1.181.2 in /site
 (#20080)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [ts-proto](https://github.com/stephenh/ts-proto) from 1.164.0 to
1.181.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/stephenh/ts-proto/releases">ts-proto's
releases</a>.</em></p>
<blockquote>
<h2>v1.181.2</h2>
<h2><a
href="https://github.com/stephenh/ts-proto/compare/v1.181.1...v1.181.2">1.181.2</a>
(2024-08-15)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>toJSON Function with <code>removeEnumPrefix=true</code> and
<code>unrecognizedEnumValue=0</code> Options (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1089">#1089</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/24014908f814e2720b9c2b9bd2ae1773be880a16">2401490</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1086">#1086</a>
<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1086">#1086</a></li>
</ul>
<h2>v1.181.1</h2>
<h2><a
href="https://github.com/stephenh/ts-proto/compare/v1.181.0...v1.181.1">1.181.1</a>
(2024-07-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Incorrect message names in the generated code for repeated fields
(<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1073">#1073</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/8a95d8e0983a38e604b6990461e726db566ff311">8a95d8e</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1072">#1072</a></li>
</ul>
<h2>v1.181.0</h2>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.180.0...v1.181.0">1.181.0</a>
(2024-07-01)</h1>
<h3>Features</h3>
<ul>
<li>added the &quot;typePrefix&quot; and &quot;typeSuffix&quot; options.
(<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1069">#1069</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/ab515cda322baeb94c7588117e4bb5bee6281874">ab515cd</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1033">#1033</a></li>
</ul>
<h2>v1.180.0</h2>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.179.0...v1.180.0">1.180.0</a>
(2024-06-15)</h1>
<h3>Features</h3>
<ul>
<li>oneof=unions-value to use the same field name for oneof cases (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1062">#1062</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/74930908cc8e5292577a793b7ae06c3721225ac3">7493090</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1060">#1060</a></li>
</ul>
<h2>v1.179.0</h2>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.178.0...v1.179.0">1.179.0</a>
(2024-06-15)</h1>
<h3>Features</h3>
<ul>
<li>bigIntLiteral option for using BigInt literals (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1063">#1063</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/b89fbcb1f99ccfcd1f06551286c2459e44a3bac2">b89fbcb</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/928">#928</a>
<a
href="https://redirect.github.com/stephenh/ts-proto/issues/932">#932</a></li>
</ul>
<h2>v1.178.0</h2>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.177.0...v1.178.0">1.178.0</a>
(2024-06-07)</h1>
<h3>Features</h3>
<ul>
<li><code>no-file-descriptor</code> setting for outputSchema option (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1047">#1047</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/c54f06c4a7dd766abf3f91932b1e4cdf38b7f346">c54f06c</a>)</li>
</ul>
<h2>v1.177.0</h2>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.176.3...v1.177.0">1.177.0</a>
(2024-06-07)</h1>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/stephenh/ts-proto/blob/main/CHANGELOG.md">ts-proto's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/stephenh/ts-proto/compare/v1.181.1...v1.181.2">1.181.2</a>
(2024-08-15)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>toJSON Function with <code>removeEnumPrefix=true</code> and
<code>unrecognizedEnumValue=0</code> Options (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1089">#1089</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/24014908f814e2720b9c2b9bd2ae1773be880a16">2401490</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1086">#1086</a>
<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1086">#1086</a></li>
</ul>
<h2><a
href="https://github.com/stephenh/ts-proto/compare/v1.181.0...v1.181.1">1.181.1</a>
(2024-07-13)</h2>
<h3>Bug Fixes</h3>
<ul>
<li>Incorrect message names in the generated code for repeated fields
(<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1073">#1073</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/8a95d8e0983a38e604b6990461e726db566ff311">8a95d8e</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1072">#1072</a></li>
</ul>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.180.0...v1.181.0">1.181.0</a>
(2024-07-01)</h1>
<h3>Features</h3>
<ul>
<li>added the &quot;typePrefix&quot; and &quot;typeSuffix&quot; options.
(<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1069">#1069</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/ab515cda322baeb94c7588117e4bb5bee6281874">ab515cd</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1033">#1033</a></li>
</ul>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.179.0...v1.180.0">1.180.0</a>
(2024-06-15)</h1>
<h3>Features</h3>
<ul>
<li>oneof=unions-value to use the same field name for oneof cases (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1062">#1062</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/74930908cc8e5292577a793b7ae06c3721225ac3">7493090</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/1060">#1060</a></li>
</ul>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.178.0...v1.179.0">1.179.0</a>
(2024-06-15)</h1>
<h3>Features</h3>
<ul>
<li>bigIntLiteral option for using BigInt literals (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1063">#1063</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/b89fbcb1f99ccfcd1f06551286c2459e44a3bac2">b89fbcb</a>),
closes <a
href="https://redirect.github.com/stephenh/ts-proto/issues/928">#928</a>
<a
href="https://redirect.github.com/stephenh/ts-proto/issues/932">#932</a></li>
</ul>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.177.0...v1.178.0">1.178.0</a>
(2024-06-07)</h1>
<h3>Features</h3>
<ul>
<li><code>no-file-descriptor</code> setting for outputSchema option (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1047">#1047</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/c54f06c4a7dd766abf3f91932b1e4cdf38b7f346">c54f06c</a>)</li>
</ul>
<h1><a
href="https://github.com/stephenh/ts-proto/compare/v1.176.3...v1.177.0">1.177.0</a>
(2024-06-07)</h1>
<h3>Features</h3>
<ul>
<li>add option <code>noDefaultsForOptionals</code> (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1051">#1051</a>)
(<a
href="https://github.com/stephenh/ts-proto/commit/41d10205bf68468c37cf69e58dc4c4fdbfffcf5b">41d1020</a>)</li>
</ul>
<h2><a
href="https://github.com/stephenh/ts-proto/compare/v1.176.2...v1.176.3">1.176.3</a>
(2024-06-07)</h2>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/stephenh/ts-proto/commit/290d0c51e7bea305f4759c138c43aef8a22af19b"><code>290d0c5</code></a>
chore(release): 1.181.2 [skip ci]</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/24014908f814e2720b9c2b9bd2ae1773be880a16"><code>2401490</code></a>
fix: toJSON Function with <code>removeEnumPrefix=true</code> and
`unrecognizedEnumValue=...</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/76243a860bdcadb16086379abebb60ff9cc3d363"><code>76243a8</code></a>
chore(release): 1.181.1 [skip ci]</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/8a95d8e0983a38e604b6990461e726db566ff311"><code>8a95d8e</code></a>
fix: Incorrect message names in the generated code for repeated fields
(<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1073">#1073</a>)</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/2078d1a905ad7961e168971c51b852deae930b6d"><code>2078d1a</code></a>
Remove .DS_Store (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1071">#1071</a>)</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/c5546fba41ed248ffa750172aae3544e70ffddb8"><code>c5546fb</code></a>
chore(release): 1.181.0 [skip ci]</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/ab515cda322baeb94c7588117e4bb5bee6281874"><code>ab515cd</code></a>
feat: added the &quot;typePrefix&quot; and &quot;typeSuffix&quot;
options. (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1069">#1069</a>)</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/14e7e0f6a94a9309d16fb8d62467c95b3d001529"><code>14e7e0f</code></a>
docs: Describe <code>oneof=unions-value</code> output as Algebraic Data
Type (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1065">#1065</a>)</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/84ccaf2badc2def72b03f11d6faac645d1677f97"><code>84ccaf2</code></a>
chore(release): 1.180.0 [skip ci]</li>
<li><a
href="https://github.com/stephenh/ts-proto/commit/74930908cc8e5292577a793b7ae06c3721225ac3"><code>7493090</code></a>
feat: oneof=unions-value to use the same field name for oneof cases (<a
href="https://redirect.github.com/stephenh/ts-proto/issues/1062">#1062</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/stephenh/ts-proto/compare/v1.164.0...v1.181.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=ts-proto&package-manager=npm_and_yarn&previous-version=1.164.0&new-version=1.181.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: ケイラ <kayla@tree.camp>
---
 .../e2e/google/protobuf/timestampGenerated.ts |  6 ++
 site/e2e/provisionerGenerated.ts              | 62 ++++++++++---------
 site/package.json                             |  2 +-
 site/pnpm-lock.yaml                           | 33 +++++-----
 4 files changed, 60 insertions(+), 43 deletions(-)

diff --git a/site/e2e/google/protobuf/timestampGenerated.ts b/site/e2e/google/protobuf/timestampGenerated.ts
index 6dd4b08e96087..6cddbb0b0b781 100644
--- a/site/e2e/google/protobuf/timestampGenerated.ts
+++ b/site/e2e/google/protobuf/timestampGenerated.ts
@@ -1,3 +1,9 @@
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v1.181.2
+//   protoc               v4.23.4
+// source: google/protobuf/timestamp.proto
+
 /* eslint-disable */
 import * as _m0 from "protobufjs/minimal";
 
diff --git a/site/e2e/provisionerGenerated.ts b/site/e2e/provisionerGenerated.ts
index 82fd25db9258d..65e0557c1b779 100644
--- a/site/e2e/provisionerGenerated.ts
+++ b/site/e2e/provisionerGenerated.ts
@@ -1,3 +1,9 @@
+// Code generated by protoc-gen-ts_proto. DO NOT EDIT.
+// versions:
+//   protoc-gen-ts_proto  v1.181.2
+//   protoc               v4.23.4
+// source: provisioner.proto
+
 /* eslint-disable */
 import * as _m0 from "protobufjs/minimal";
 import { Observable } from "rxjs";
@@ -560,10 +566,10 @@ export const TemplateVariable = {
     if (message.defaultValue !== "") {
       writer.uint32(34).string(message.defaultValue);
     }
-    if (message.required === true) {
+    if (message.required !== false) {
       writer.uint32(40).bool(message.required);
     }
-    if (message.sensitive === true) {
+    if (message.sensitive !== false) {
       writer.uint32(48).bool(message.sensitive);
     }
     return writer;
@@ -599,7 +605,7 @@ export const RichParameter = {
     if (message.type !== "") {
       writer.uint32(26).string(message.type);
     }
-    if (message.mutable === true) {
+    if (message.mutable !== false) {
       writer.uint32(32).bool(message.mutable);
     }
     if (message.defaultValue !== "") {
@@ -626,7 +632,7 @@ export const RichParameter = {
     if (message.validationMonotonic !== "") {
       writer.uint32(98).string(message.validationMonotonic);
     }
-    if (message.required === true) {
+    if (message.required !== false) {
       writer.uint32(104).bool(message.required);
     }
     if (message.displayName !== "") {
@@ -635,7 +641,7 @@ export const RichParameter = {
     if (message.order !== 0) {
       writer.uint32(128).int32(message.order);
     }
-    if (message.ephemeral === true) {
+    if (message.ephemeral !== false) {
       writer.uint32(136).bool(message.ephemeral);
     }
     if (message.formType !== 0) {
@@ -716,7 +722,7 @@ export const Preset = {
     if (message.prebuild !== undefined) {
       Prebuild.encode(message.prebuild, writer.uint32(26).fork()).ldelim();
     }
-    if (message.default === true) {
+    if (message.default !== false) {
       writer.uint32(32).bool(message.default);
     }
     if (message.description !== "") {
@@ -761,7 +767,7 @@ export const VariableValue = {
     if (message.value !== "") {
       writer.uint32(18).string(message.value);
     }
-    if (message.sensitive === true) {
+    if (message.sensitive !== false) {
       writer.uint32(24).bool(message.sensitive);
     }
     return writer;
@@ -794,7 +800,7 @@ export const ExternalAuthProviderResource = {
     if (message.id !== "") {
       writer.uint32(10).string(message.id);
     }
-    if (message.optional === true) {
+    if (message.optional !== false) {
       writer.uint32(16).bool(message.optional);
     }
     return writer;
@@ -929,7 +935,7 @@ export const ResourcesMonitoring = {
 
 export const MemoryResourceMonitor = {
   encode(message: MemoryResourceMonitor, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
-    if (message.enabled === true) {
+    if (message.enabled !== false) {
       writer.uint32(8).bool(message.enabled);
     }
     if (message.threshold !== 0) {
@@ -944,7 +950,7 @@ export const VolumeResourceMonitor = {
     if (message.path !== "") {
       writer.uint32(10).string(message.path);
     }
-    if (message.enabled === true) {
+    if (message.enabled !== false) {
       writer.uint32(16).bool(message.enabled);
     }
     if (message.threshold !== 0) {
@@ -956,19 +962,19 @@ export const VolumeResourceMonitor = {
 
 export const DisplayApps = {
   encode(message: DisplayApps, writer: _m0.Writer = _m0.Writer.create()): _m0.Writer {
-    if (message.vscode === true) {
+    if (message.vscode !== false) {
       writer.uint32(8).bool(message.vscode);
     }
-    if (message.vscodeInsiders === true) {
+    if (message.vscodeInsiders !== false) {
       writer.uint32(16).bool(message.vscodeInsiders);
     }
-    if (message.webTerminal === true) {
+    if (message.webTerminal !== false) {
       writer.uint32(24).bool(message.webTerminal);
     }
-    if (message.sshHelper === true) {
+    if (message.sshHelper !== false) {
       writer.uint32(32).bool(message.sshHelper);
     }
-    if (message.portForwardingHelper === true) {
+    if (message.portForwardingHelper !== false) {
       writer.uint32(40).bool(message.portForwardingHelper);
     }
     return writer;
@@ -1001,13 +1007,13 @@ export const Script = {
     if (message.cron !== "") {
       writer.uint32(34).string(message.cron);
     }
-    if (message.startBlocksLogin === true) {
+    if (message.startBlocksLogin !== false) {
       writer.uint32(40).bool(message.startBlocksLogin);
     }
-    if (message.runOnStart === true) {
+    if (message.runOnStart !== false) {
       writer.uint32(48).bool(message.runOnStart);
     }
-    if (message.runOnStop === true) {
+    if (message.runOnStop !== false) {
       writer.uint32(56).bool(message.runOnStop);
     }
     if (message.timeoutSeconds !== 0) {
@@ -1052,7 +1058,7 @@ export const App = {
     if (message.icon !== "") {
       writer.uint32(42).string(message.icon);
     }
-    if (message.subdomain === true) {
+    if (message.subdomain !== false) {
       writer.uint32(48).bool(message.subdomain);
     }
     if (message.healthcheck !== undefined) {
@@ -1061,13 +1067,13 @@ export const App = {
     if (message.sharingLevel !== 0) {
       writer.uint32(64).int32(message.sharingLevel);
     }
-    if (message.external === true) {
+    if (message.external !== false) {
       writer.uint32(72).bool(message.external);
     }
     if (message.order !== 0) {
       writer.uint32(80).int64(message.order);
     }
-    if (message.hidden === true) {
+    if (message.hidden !== false) {
       writer.uint32(88).bool(message.hidden);
     }
     if (message.openIn !== 0) {
@@ -1115,7 +1121,7 @@ export const Resource = {
     for (const v of message.metadata) {
       Resource_Metadata.encode(v!, writer.uint32(34).fork()).ldelim();
     }
-    if (message.hide === true) {
+    if (message.hide !== false) {
       writer.uint32(40).bool(message.hide);
     }
     if (message.icon !== "") {
@@ -1142,10 +1148,10 @@ export const Resource_Metadata = {
     if (message.value !== "") {
       writer.uint32(18).string(message.value);
     }
-    if (message.sensitive === true) {
+    if (message.sensitive !== false) {
       writer.uint32(24).bool(message.sensitive);
     }
-    if (message.isNull === true) {
+    if (message.isNull !== false) {
       writer.uint32(32).bool(message.isNull);
     }
     return writer;
@@ -1352,7 +1358,7 @@ export const PlanRequest = {
     for (const v of message.previousParameterValues) {
       RichParameterValue.encode(v!, writer.uint32(42).fork()).ldelim();
     }
-    if (message.omitModuleFiles === true) {
+    if (message.omitModuleFiles !== false) {
       writer.uint32(48).bool(message.omitModuleFiles);
     }
     return writer;
@@ -1394,13 +1400,13 @@ export const PlanComplete = {
     if (message.moduleFilesHash.length !== 0) {
       writer.uint32(98).bytes(message.moduleFilesHash);
     }
-    if (message.hasAiTasks === true) {
+    if (message.hasAiTasks !== false) {
       writer.uint32(104).bool(message.hasAiTasks);
     }
     for (const v of message.aiTasks) {
       AITask.encode(v!, writer.uint32(114).fork()).ldelim();
     }
-    if (message.hasExternalAgents === true) {
+    if (message.hasExternalAgents !== false) {
       writer.uint32(120).bool(message.hasExternalAgents);
     }
     return writer;
@@ -1571,7 +1577,7 @@ export interface Provisioner {
 }
 
 function toTimestamp(date: Date): Timestamp {
-  const seconds = date.getTime() / 1_000;
+  const seconds = Math.trunc(date.getTime() / 1_000);
   const nanos = (date.getTime() % 1_000) * 1_000_000;
   return { seconds, nanos };
 }
diff --git a/site/package.json b/site/package.json
index 7ba86b7881665..ddb04c084ce01 100644
--- a/site/package.json
+++ b/site/package.json
@@ -178,7 +178,7 @@
 		"storybook": "9.1.2",
 		"storybook-addon-remix-react-router": "5.0.0",
 		"tailwindcss": "3.4.18",
-		"ts-proto": "1.164.0",
+		"ts-proto": "1.181.2",
 		"typescript": "5.6.3",
 		"vite": "7.1.7",
 		"vite-plugin-checker": "0.11.0"
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 49f5c686087b8..396028241502c 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -444,8 +444,8 @@ importers:
         specifier: 3.4.18
         version: 3.4.18(yaml@2.7.0)
       ts-proto:
-        specifier: 1.164.0
-        version: 1.164.0
+        specifier: 1.181.2
+        version: 1.181.2
       typescript:
         specifier: 5.6.3
         version: 5.6.3
@@ -4863,6 +4863,9 @@ packages:
   long@5.2.3:
     resolution: {integrity: sha512-lcHwpNoggQTObv5apGNCTdJrO69eHOZMi4BNC+rTLER8iHAqGrUVeLh/irVIM7zTw2bOXA8T6uNPeujwOLg/2Q==, tarball: https://registry.npmjs.org/long/-/long-5.2.3.tgz}
 
+  long@5.3.2:
+    resolution: {integrity: sha512-mNAgZ1GmyNhD7AuqnTG3/VQ26o760+ZYBPKjPvugO8+nLbYfX6TVpJPseBvopbdY+qpZ/lKUnmEc1LeZYS3QAA==, tarball: https://registry.npmjs.org/long/-/long-5.3.2.tgz}
+
   longest-streak@3.1.0:
     resolution: {integrity: sha512-9Ri+o0JYgehTaVBBDoMqIl8GXtbWg711O3srftcHhZ0dqnETqLaoIK0x17fUw9rFSlK/0NlsKe0Ahhyl5pXE2g==, tarball: https://registry.npmjs.org/longest-streak/-/longest-streak-3.1.0.tgz}
 
@@ -6159,14 +6162,14 @@ packages:
       '@swc/wasm':
         optional: true
 
-  ts-poet@6.11.0:
-    resolution: {integrity: sha512-r5AGF8vvb+GjBsnqiTqbLhN1/U2FJt6BI+k0dfCrkKzWvUhNlwMmq9nDHuucHs45LomgHjZPvYj96dD3JawjJA==, tarball: https://registry.npmjs.org/ts-poet/-/ts-poet-6.11.0.tgz}
+  ts-poet@6.12.0:
+    resolution: {integrity: sha512-xo+iRNMWqyvXpFTaOAvLPA5QAWO6TZrSUs5s4Odaya3epqofBu/fMLHEWl8jPmjhA0s9sgj9sNvF1BmaQlmQkA==, tarball: https://registry.npmjs.org/ts-poet/-/ts-poet-6.12.0.tgz}
 
-  ts-proto-descriptors@1.15.0:
-    resolution: {integrity: sha512-TYyJ7+H+7Jsqawdv+mfsEpZPTIj9siDHS6EMCzG/z3b/PZiphsX+mWtqFfFVe5/N0Th6V3elK9lQqjnrgTOfrg==, tarball: https://registry.npmjs.org/ts-proto-descriptors/-/ts-proto-descriptors-1.15.0.tgz}
+  ts-proto-descriptors@1.16.0:
+    resolution: {integrity: sha512-3yKuzMLpltdpcyQji1PJZRfoo4OJjNieKTYkQY8pF7xGKsYz/RHe3aEe4KiRxcinoBmnEhmuI+yJTxLb922ULA==, tarball: https://registry.npmjs.org/ts-proto-descriptors/-/ts-proto-descriptors-1.16.0.tgz}
 
-  ts-proto@1.164.0:
-    resolution: {integrity: sha512-yIyMucjcozS7Vxtyy5mH6C8ltbY4gEBVNW4ymZ0kWiKlyMxsvhyUZ63CbxcF7dCKQVjHR+fLJ3SiorfgyhQ+AQ==, tarball: https://registry.npmjs.org/ts-proto/-/ts-proto-1.164.0.tgz}
+  ts-proto@1.181.2:
+    resolution: {integrity: sha512-knJ8dtjn2Pd0c5ZGZG8z9DMiD4PUY8iGI9T9tb8DvGdWRMkLpf0WcPO7G+7cmbZyxvNTAG6ci3fybEaFgMZIvg==, tarball: https://registry.npmjs.org/ts-proto/-/ts-proto-1.181.2.tgz}
     hasBin: true
 
   tsconfig-paths@4.2.0:
@@ -11329,6 +11332,8 @@ snapshots:
 
   long@5.2.3: {}
 
+  long@5.3.2: {}
+
   longest-streak@3.1.0: {}
 
   loose-envify@1.4.0:
@@ -12944,21 +12949,21 @@ snapshots:
       '@swc/core': 1.3.38
     optional: true
 
-  ts-poet@6.11.0:
+  ts-poet@6.12.0:
     dependencies:
       dprint-node: 1.0.8
 
-  ts-proto-descriptors@1.15.0:
+  ts-proto-descriptors@1.16.0:
     dependencies:
-      long: 5.2.3
+      long: 5.3.2
       protobufjs: 7.4.0
 
-  ts-proto@1.164.0:
+  ts-proto@1.181.2:
     dependencies:
       case-anything: 2.1.13
       protobufjs: 7.4.0
-      ts-poet: 6.11.0
-      ts-proto-descriptors: 1.15.0
+      ts-poet: 6.12.0
+      ts-proto-descriptors: 1.16.0
 
   tsconfig-paths@4.2.0:
     dependencies:

From f84a789b40284e8c7f9192ac0cf2b6764a197b36 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Thu, 2 Oct 2025 10:45:52 +1000
Subject: [PATCH 035/298] feat(scaletest): add runner for thundering herd
 autostart (#19998)

Relates to https://github.com/coder/internal/issues/911

This PR adds a scaletest runner that simulates a user with a workspace configured to autostart at a specific time.

An instance of this autostart runner does the following:
1. Creates a user.
2. Creates a workspace.
3. Listens on `/api/v2/workspaces/<ws-id>/watch` to wait for build completions throughout the run.
4. Stops the workspace, waits for the build to finish.
4. Waits for all other concurrently executing runners (per the `SetupBarrier` `WaitGroup`) to also have a stopped workspace.
5. Sets the workspace autostart time to `time.Now().Add(cfg.AutoStartDelay)`
6. Waits for the autostart workspace build to begin, enter the `pending` status, and then `running`.
7. Waits for the autostart workspace build to end.

Exposes four prometheus metrics:
- `autostart_job_creation_latency_seconds` - HistogramVec. Labels = {username, workspace_name}
- `autostart_job_acquired_latency_seconds` - HistogramVec. Labels = {username, workspace_name}
- `autostart_total_latency_seconds` - `HistogramVec`. Labels = `{username, workspace_name}`.
- `autostart_errors_total` - `CounterVec`. Labels = `{username, action}`.
---
 scaletest/autostart/config.go      |  75 +++++++++
 scaletest/autostart/metrics.go     |  65 ++++++++
 scaletest/autostart/run.go         | 245 +++++++++++++++++++++++++++++
 scaletest/autostart/run_test.go    | 158 +++++++++++++++++++
 scaletest/workspacebuild/config.go |   3 +
 scaletest/workspacebuild/run.go    |  40 ++---
 6 files changed, 568 insertions(+), 18 deletions(-)
 create mode 100644 scaletest/autostart/config.go
 create mode 100644 scaletest/autostart/metrics.go
 create mode 100644 scaletest/autostart/run.go
 create mode 100644 scaletest/autostart/run_test.go

diff --git a/scaletest/autostart/config.go b/scaletest/autostart/config.go
new file mode 100644
index 0000000000000..ad804a0b89666
--- /dev/null
+++ b/scaletest/autostart/config.go
@@ -0,0 +1,75 @@
+package autostart
+
+import (
+	"sync"
+	"time"
+
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/createusers"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
+)
+
+type Config struct {
+	// User is the configuration for the user to create.
+	User createusers.Config `json:"user"`
+
+	// Workspace is the configuration for the workspace to create. The workspace
+	// will be built using the new user.
+	//
+	// OrganizationID is ignored and set to the new user's organization ID.
+	Workspace workspacebuild.Config `json:"workspace"`
+
+	// WorkspaceJobTimeout is how long to wait for any one workspace job
+	// (start or stop) to complete.
+	WorkspaceJobTimeout time.Duration `json:"workspace_job_timeout"`
+
+	// AutostartDelay is how long after all the workspaces have been stopped
+	// to schedule them to be started again.
+	AutostartDelay time.Duration `json:"autostart_delay"`
+
+	// AutostartTimeout is how long to wait for the autostart build to be
+	// initiated after the scheduled time.
+	AutostartTimeout time.Duration `json:"autostart_timeout"`
+
+	Metrics *Metrics `json:"-"`
+
+	// SetupBarrier is used to ensure all runners own stopped workspaces
+	// before setting the autostart schedule on each.
+	SetupBarrier *sync.WaitGroup `json:"-"`
+}
+
+func (c Config) Validate() error {
+	if err := c.User.Validate(); err != nil {
+		return xerrors.Errorf("user config: %w", err)
+	}
+	c.Workspace.OrganizationID = c.User.OrganizationID
+	// This value will be overwritten during the test.
+	c.Workspace.UserID = codersdk.Me
+	if err := c.Workspace.Validate(); err != nil {
+		return xerrors.Errorf("workspace config: %w", err)
+	}
+
+	if c.SetupBarrier == nil {
+		return xerrors.New("setup barrier must be set")
+	}
+
+	if c.WorkspaceJobTimeout <= 0 {
+		return xerrors.New("workspace_job_timeout must be greater than 0")
+	}
+
+	if c.AutostartDelay < time.Minute*2 {
+		return xerrors.New("autostart_delay must be at least 2 minutes")
+	}
+
+	if c.AutostartTimeout <= 0 {
+		return xerrors.New("autostart_timeout must be greater than 0")
+	}
+
+	if c.Metrics == nil {
+		return xerrors.New("metrics must be set")
+	}
+
+	return nil
+}
diff --git a/scaletest/autostart/metrics.go b/scaletest/autostart/metrics.go
new file mode 100644
index 0000000000000..d1ff94e7898c4
--- /dev/null
+++ b/scaletest/autostart/metrics.go
@@ -0,0 +1,65 @@
+package autostart
+
+import (
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+type Metrics struct {
+	AutostartJobCreationLatencySeconds prometheus.HistogramVec
+	AutostartJobAcquiredLatencySeconds prometheus.HistogramVec
+	AutostartTotalLatencySeconds       prometheus.HistogramVec
+	AutostartErrorsTotal               prometheus.CounterVec
+}
+
+func NewMetrics(reg prometheus.Registerer) *Metrics {
+	m := &Metrics{
+		AutostartJobCreationLatencySeconds: *prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Namespace: "coderd",
+			Subsystem: "scaletest",
+			Name:      "autostart_job_creation_latency_seconds",
+			Help:      "Time from when the workspace is scheduled to be autostarted to when the autostart job has been created.",
+		}, []string{"username", "workspace_name"}),
+		AutostartJobAcquiredLatencySeconds: *prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Namespace: "coderd",
+			Subsystem: "scaletest",
+			Name:      "autostart_job_acquired_latency_seconds",
+			Help:      "Time from when the workspace is scheduled to be autostarted to when the job has been acquired by a provisioner daemon.",
+		}, []string{"username", "workspace_name"}),
+		AutostartTotalLatencySeconds: *prometheus.NewHistogramVec(prometheus.HistogramOpts{
+			Namespace: "coderd",
+			Subsystem: "scaletest",
+			Name:      "autostart_total_latency_seconds",
+			Help:      "Time from when the workspace is scheduled to be autostarted to when the autostart build has finished.",
+		}, []string{"username", "workspace_name"}),
+		AutostartErrorsTotal: *prometheus.NewCounterVec(prometheus.CounterOpts{
+			Namespace: "coderd",
+			Subsystem: "scaletest",
+			Name:      "autostart_errors_total",
+			Help:      "Total number of autostart errors",
+		}, []string{"username", "action"}),
+	}
+
+	reg.MustRegister(m.AutostartTotalLatencySeconds)
+	reg.MustRegister(m.AutostartJobCreationLatencySeconds)
+	reg.MustRegister(m.AutostartJobAcquiredLatencySeconds)
+	reg.MustRegister(m.AutostartErrorsTotal)
+	return m
+}
+
+func (m *Metrics) RecordCompletion(elapsed time.Duration, username string, workspace string) {
+	m.AutostartTotalLatencySeconds.WithLabelValues(username, workspace).Observe(elapsed.Seconds())
+}
+
+func (m *Metrics) RecordJobCreation(elapsed time.Duration, username string, workspace string) {
+	m.AutostartJobCreationLatencySeconds.WithLabelValues(username, workspace).Observe(elapsed.Seconds())
+}
+
+func (m *Metrics) RecordJobAcquired(elapsed time.Duration, username string, workspace string) {
+	m.AutostartJobAcquiredLatencySeconds.WithLabelValues(username, workspace).Observe(elapsed.Seconds())
+}
+
+func (m *Metrics) AddError(username string, action string) {
+	m.AutostartErrorsTotal.WithLabelValues(username, action).Inc()
+}
diff --git a/scaletest/autostart/run.go b/scaletest/autostart/run.go
new file mode 100644
index 0000000000000..59f50a04dd837
--- /dev/null
+++ b/scaletest/autostart/run.go
@@ -0,0 +1,245 @@
+package autostart
+
+import (
+	"context"
+	"fmt"
+	"io"
+	"time"
+
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/createusers"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
+)
+
+type Runner struct {
+	client *codersdk.Client
+	cfg    Config
+
+	createUserRunner     *createusers.Runner
+	workspacebuildRunner *workspacebuild.Runner
+
+	autostartTotalLatency       time.Duration
+	autostartJobCreationLatency time.Duration
+	autostartJobAcquiredLatency time.Duration
+}
+
+func NewRunner(client *codersdk.Client, cfg Config) *Runner {
+	return &Runner{
+		client: client,
+		cfg:    cfg,
+	}
+}
+
+var (
+	_ harness.Runnable    = &Runner{}
+	_ harness.Cleanable   = &Runner{}
+	_ harness.Collectable = &Runner{}
+)
+
+func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
+	reachedBarrier := false
+	defer func() {
+		if !reachedBarrier {
+			r.cfg.SetupBarrier.Done()
+		}
+	}()
+
+	logs = loadtestutil.NewSyncWriter(logs)
+	logger := slog.Make(sloghuman.Sink(logs)).Leveled(slog.LevelDebug)
+	r.client.SetLogger(logger)
+	r.client.SetLogBodies(true)
+
+	r.createUserRunner = createusers.NewRunner(r.client, r.cfg.User)
+	newUserAndToken, err := r.createUserRunner.RunReturningUser(ctx, id, logs)
+	if err != nil {
+		r.cfg.Metrics.AddError("", "create_user")
+		return xerrors.Errorf("create user: %w", err)
+	}
+	newUser := newUserAndToken.User
+
+	newUserClient := codersdk.New(r.client.URL,
+		codersdk.WithSessionToken(newUserAndToken.SessionToken),
+		codersdk.WithLogger(logger),
+		codersdk.WithLogBodies())
+
+	//nolint:gocritic // short log is fine
+	logger.Info(ctx, "user created", slog.F("username", newUser.Username), slog.F("user_id", newUser.ID.String()))
+
+	workspaceBuildConfig := r.cfg.Workspace
+	workspaceBuildConfig.OrganizationID = r.cfg.User.OrganizationID
+	workspaceBuildConfig.UserID = newUser.ID.String()
+	// We'll wait for the build ourselves to avoid multiple API requests
+	workspaceBuildConfig.NoWaitForBuild = true
+
+	r.workspacebuildRunner = workspacebuild.NewRunner(newUserClient, workspaceBuildConfig)
+	workspace, err := r.workspacebuildRunner.RunReturningWorkspace(ctx, id, logs)
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "create_workspace")
+		return xerrors.Errorf("create workspace: %w", err)
+	}
+
+	watchCtx, cancel := context.WithCancel(ctx)
+	defer cancel()
+	workspaceUpdates, err := newUserClient.WatchWorkspace(watchCtx, workspace.ID)
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "watch_workspace")
+		return xerrors.Errorf("watch workspace: %w", err)
+	}
+
+	createWorkspaceCtx, cancel2 := context.WithTimeout(ctx, r.cfg.WorkspaceJobTimeout)
+	defer cancel2()
+
+	err = waitForWorkspaceUpdate(createWorkspaceCtx, logger, workspaceUpdates, func(ws codersdk.Workspace) bool {
+		return ws.LatestBuild.Transition == codersdk.WorkspaceTransitionStart &&
+			ws.LatestBuild.Job.Status == codersdk.ProvisionerJobSucceeded
+	})
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "wait_for_initial_build")
+		return xerrors.Errorf("timeout waiting for initial workspace build to complete: %w", err)
+	}
+
+	logger.Info(ctx, "stopping workspace", slog.F("workspace_name", workspace.Name))
+
+	_, err = newUserClient.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+		Transition: codersdk.WorkspaceTransitionStop,
+	})
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "create_stop_build")
+		return xerrors.Errorf("create stop build: %w", err)
+	}
+
+	stopBuildCtx, cancel3 := context.WithTimeout(ctx, r.cfg.WorkspaceJobTimeout)
+	defer cancel3()
+
+	err = waitForWorkspaceUpdate(stopBuildCtx, logger, workspaceUpdates, func(ws codersdk.Workspace) bool {
+		return ws.LatestBuild.Transition == codersdk.WorkspaceTransitionStop &&
+			ws.LatestBuild.Job.Status == codersdk.ProvisionerJobSucceeded
+	})
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "wait_for_stop_build")
+		return xerrors.Errorf("timeout waiting for stop build to complete: %w", err)
+	}
+
+	logger.Info(ctx, "workspace stopped successfully", slog.F("workspace_name", workspace.Name))
+
+	logger.Info(ctx, "waiting for all runners to reach barrier")
+	reachedBarrier = true
+	r.cfg.SetupBarrier.Done()
+	r.cfg.SetupBarrier.Wait()
+	logger.Info(ctx, "all runners reached barrier, proceeding with autostart schedule")
+
+	testStartTime := time.Now().UTC()
+	autostartTime := testStartTime.Add(r.cfg.AutostartDelay).Round(time.Minute)
+	schedule := fmt.Sprintf("CRON_TZ=UTC %d %d * * *", autostartTime.Minute(), autostartTime.Hour())
+
+	logger.Info(ctx, "setting autostart schedule for workspace", slog.F("workspace_name", workspace.Name), slog.F("schedule", schedule))
+
+	err = newUserClient.UpdateWorkspaceAutostart(ctx, workspace.ID, codersdk.UpdateWorkspaceAutostartRequest{
+		Schedule: &schedule,
+	})
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "update_workspace_autostart")
+		return xerrors.Errorf("update workspace autostart: %w", err)
+	}
+
+	logger.Info(ctx, "waiting for workspace to autostart", slog.F("workspace_name", workspace.Name))
+
+	autostartInitiateCtx, cancel4 := context.WithDeadline(ctx, autostartTime.Add(r.cfg.AutostartDelay))
+	defer cancel4()
+
+	logger.Info(ctx, "listening for workspace updates to detect autostart build")
+
+	err = waitForWorkspaceUpdate(autostartInitiateCtx, logger, workspaceUpdates, func(ws codersdk.Workspace) bool {
+		if ws.LatestBuild.Transition != codersdk.WorkspaceTransitionStart {
+			return false
+		}
+
+		// The job has been created, but it might be pending
+		if r.autostartJobCreationLatency == 0 {
+			r.autostartJobCreationLatency = time.Since(autostartTime)
+			r.cfg.Metrics.RecordJobCreation(r.autostartJobCreationLatency, newUser.Username, workspace.Name)
+		}
+
+		if ws.LatestBuild.Job.Status == codersdk.ProvisionerJobRunning ||
+			ws.LatestBuild.Job.Status == codersdk.ProvisionerJobSucceeded {
+			// Job is no longer pending, but it might not have finished
+			if r.autostartJobAcquiredLatency == 0 {
+				r.autostartJobAcquiredLatency = time.Since(autostartTime)
+				r.cfg.Metrics.RecordJobAcquired(r.autostartJobAcquiredLatency, newUser.Username, workspace.Name)
+			}
+			return ws.LatestBuild.Job.Status == codersdk.ProvisionerJobSucceeded
+		}
+
+		return false
+	})
+	if err != nil {
+		r.cfg.Metrics.AddError(newUser.Username, "wait_for_autostart_build")
+		return xerrors.Errorf("timeout waiting for autostart build to be created: %w", err)
+	}
+
+	r.autostartTotalLatency = time.Since(autostartTime)
+
+	logger.Info(ctx, "autostart workspace build complete", slog.F("duration", r.autostartTotalLatency))
+	r.cfg.Metrics.RecordCompletion(r.autostartTotalLatency, newUser.Username, workspace.Name)
+
+	return nil
+}
+
+func waitForWorkspaceUpdate(ctx context.Context, logger slog.Logger, updates <-chan codersdk.Workspace, shouldBreak func(codersdk.Workspace) bool) error {
+	for {
+		select {
+		case <-ctx.Done():
+			return ctx.Err()
+		case updatedWorkspace, ok := <-updates:
+			if !ok {
+				return xerrors.New("workspace updates channel closed")
+			}
+			logger.Debug(ctx, "received workspace update", slog.F("update", updatedWorkspace))
+			if shouldBreak(updatedWorkspace) {
+				return nil
+			}
+		}
+	}
+}
+
+func (r *Runner) Cleanup(ctx context.Context, id string, logs io.Writer) error {
+	if r.workspacebuildRunner != nil {
+		_, _ = fmt.Fprintln(logs, "Cleaning up workspace...")
+		if err := r.workspacebuildRunner.Cleanup(ctx, id, logs); err != nil {
+			return xerrors.Errorf("cleanup workspace: %w", err)
+		}
+	}
+
+	if r.createUserRunner != nil {
+		_, _ = fmt.Fprintln(logs, "Cleaning up user...")
+		if err := r.createUserRunner.Cleanup(ctx, id, logs); err != nil {
+			return xerrors.Errorf("cleanup user: %w", err)
+		}
+	}
+
+	return nil
+}
+
+const (
+	AutostartTotalLatencyMetric       = "autostart_total_latency_seconds"
+	AutostartJobCreationLatencyMetric = "autostart_job_creation_latency_seconds"
+	AutostartJobAcquiredLatencyMetric = "autostart_job_acquired_latency_seconds"
+)
+
+func (r *Runner) GetMetrics() map[string]any {
+	return map[string]any{
+		AutostartTotalLatencyMetric:       r.autostartTotalLatency.Seconds(),
+		AutostartJobCreationLatencyMetric: r.autostartJobCreationLatency.Seconds(),
+		AutostartJobAcquiredLatencyMetric: r.autostartJobAcquiredLatency.Seconds(),
+	}
+}
diff --git a/scaletest/autostart/run_test.go b/scaletest/autostart/run_test.go
new file mode 100644
index 0000000000000..dc0fb9fea018e
--- /dev/null
+++ b/scaletest/autostart/run_test.go
@@ -0,0 +1,158 @@
+package autostart_test
+
+import (
+	"io"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/scaletest/autostart"
+	"github.com/coder/coder/v2/scaletest/createusers"
+	"github.com/coder/coder/v2/scaletest/workspacebuild"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestRun(t *testing.T) {
+	t.Parallel()
+	numUsers := 2
+	autoStartDelay := 2 * time.Minute
+
+	// Faking a workspace autostart schedule start time at the coderd level
+	// is difficult and error-prone.
+	t.Skip("This test takes several minutes to run, and is intended as a manual regression test")
+
+	ctx := testutil.Context(t, time.Minute*3)
+
+	client := coderdtest.New(t, &coderdtest.Options{
+		IncludeProvisionerDaemon: true,
+		AutobuildTicker:          time.NewTicker(time.Second * 1).C,
+	})
+	user := coderdtest.CreateFirstUser(t, client)
+
+	authToken := uuid.NewString()
+	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+		Parse:         echo.ParseComplete,
+		ProvisionPlan: echo.PlanComplete,
+		ProvisionApply: []*proto.Response{
+			{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{
+							{
+								Name: "example",
+								Type: "aws_instance",
+								Agents: []*proto.Agent{
+									{
+										Id:   uuid.NewString(),
+										Name: "agent",
+										Auth: &proto.Agent_Token{
+											Token: authToken,
+										},
+										Apps: []*proto.App{},
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+
+	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+
+	barrier := new(sync.WaitGroup)
+	barrier.Add(numUsers)
+	metrics := autostart.NewMetrics(prometheus.NewRegistry())
+
+	eg, runCtx := errgroup.WithContext(ctx)
+
+	runners := make([]*autostart.Runner, 0, numUsers)
+	for i := range numUsers {
+		cfg := autostart.Config{
+			User: createusers.Config{
+				OrganizationID: user.OrganizationID,
+			},
+			Workspace: workspacebuild.Config{
+				OrganizationID: user.OrganizationID,
+				Request: codersdk.CreateWorkspaceRequest{
+					TemplateID: template.ID,
+				},
+				NoWaitForAgents: true,
+			},
+			WorkspaceJobTimeout: testutil.WaitMedium,
+			AutostartDelay:      autoStartDelay,
+			AutostartTimeout:    testutil.WaitShort,
+			Metrics:             metrics,
+			SetupBarrier:        barrier,
+		}
+		err := cfg.Validate()
+		require.NoError(t, err)
+
+		runner := autostart.NewRunner(client, cfg)
+		runners = append(runners, runner)
+		eg.Go(func() error {
+			return runner.Run(runCtx, strconv.Itoa(i), io.Discard)
+		})
+	}
+
+	err := eg.Wait()
+	require.NoError(t, err)
+
+	users, err := client.Users(ctx, codersdk.UsersRequest{})
+	require.NoError(t, err)
+	require.Len(t, users.Users, 1+numUsers) // owner + created users
+
+	workspaces, err := client.Workspaces(ctx, codersdk.WorkspaceFilter{})
+	require.NoError(t, err)
+	require.Len(t, workspaces.Workspaces, numUsers) // one workspace per user
+
+	// Verify that workspaces have autostart schedules set and are running
+	for _, workspace := range workspaces.Workspaces {
+		require.NotNil(t, workspace.AutostartSchedule)
+		require.Equal(t, codersdk.WorkspaceTransitionStart, workspace.LatestBuild.Transition)
+		require.Equal(t, codersdk.ProvisionerJobSucceeded, workspace.LatestBuild.Job.Status)
+	}
+
+	cleanupEg, cleanupCtx := errgroup.WithContext(ctx)
+	for i, runner := range runners {
+		cleanupEg.Go(func() error {
+			return runner.Cleanup(cleanupCtx, strconv.Itoa(i), io.Discard)
+		})
+	}
+	err = cleanupEg.Wait()
+	require.NoError(t, err)
+
+	workspaces, err = client.Workspaces(ctx, codersdk.WorkspaceFilter{})
+	require.NoError(t, err)
+	require.Len(t, workspaces.Workspaces, 0)
+
+	users, err = client.Users(ctx, codersdk.UsersRequest{})
+	require.NoError(t, err)
+	require.Len(t, users.Users, 1) // owner
+
+	for _, runner := range runners {
+		metrics := runner.GetMetrics()
+		require.Contains(t, metrics, autostart.AutostartTotalLatencyMetric)
+		latency, ok := metrics[autostart.AutostartTotalLatencyMetric].(float64)
+		require.True(t, ok)
+		jobCreationLatency, ok := metrics[autostart.AutostartJobCreationLatencyMetric].(float64)
+		require.True(t, ok)
+		jobAcquiredLatency, ok := metrics[autostart.AutostartJobAcquiredLatencyMetric].(float64)
+		require.True(t, ok)
+		require.Greater(t, latency, float64(0))
+		require.Greater(t, jobCreationLatency, float64(0))
+		require.Greater(t, jobAcquiredLatency, float64(0))
+	}
+}
diff --git a/scaletest/workspacebuild/config.go b/scaletest/workspacebuild/config.go
index 90184dacf84e8..105883ba3b7a8 100644
--- a/scaletest/workspacebuild/config.go
+++ b/scaletest/workspacebuild/config.go
@@ -19,6 +19,9 @@ type Config struct {
 	// NoWaitForAgents determines whether the test should wait for the workspace
 	// agents to connect before returning.
 	NoWaitForAgents bool `json:"no_wait_for_agents"`
+	// NoWaitForBuild determines whether the test should wait for the workspace
+	// build to complete before returning.
+	NoWaitForBuild bool `json:"no_wait_for_build"`
 	// Retry determines how many times to retry starting a workspace build if it
 	// fails.
 	Retry int `json:"retry"`
diff --git a/scaletest/workspacebuild/run.go b/scaletest/workspacebuild/run.go
index c9a59a18d69cb..308c18f0b6a03 100644
--- a/scaletest/workspacebuild/run.go
+++ b/scaletest/workspacebuild/run.go
@@ -58,27 +58,31 @@ func (r *Runner) RunReturningWorkspace(ctx context.Context, id string, logs io.W
 	}
 	r.workspaceID = workspace.ID
 
-	err = waitForBuild(ctx, logs, r.client, workspace.LatestBuild.ID)
-	if err != nil {
-		for i := 0; i < r.cfg.Retry; i++ {
-			_, _ = fmt.Fprintf(logs, "Retrying build %d/%d...\n", i+1, r.cfg.Retry)
-
-			workspace.LatestBuild, err = r.client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
-				Transition:          codersdk.WorkspaceTransitionStart,
-				RichParameterValues: req.RichParameterValues,
-				TemplateVersionID:   req.TemplateVersionID,
-			})
-			if err != nil {
-				return codersdk.Workspace{}, xerrors.Errorf("create workspace build: %w", err)
+	if r.cfg.NoWaitForBuild {
+		_, _ = fmt.Fprintln(logs, "Skipping waiting for build")
+	} else {
+		err = waitForBuild(ctx, logs, r.client, workspace.LatestBuild.ID)
+		if err != nil {
+			for i := 0; i < r.cfg.Retry; i++ {
+				_, _ = fmt.Fprintf(logs, "Retrying build %d/%d...\n", i+1, r.cfg.Retry)
+
+				workspace.LatestBuild, err = r.client.CreateWorkspaceBuild(ctx, workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+					Transition:          codersdk.WorkspaceTransitionStart,
+					RichParameterValues: req.RichParameterValues,
+					TemplateVersionID:   req.TemplateVersionID,
+				})
+				if err != nil {
+					return codersdk.Workspace{}, xerrors.Errorf("create workspace build: %w", err)
+				}
+				err = waitForBuild(ctx, logs, r.client, workspace.LatestBuild.ID)
+				if err == nil {
+					break
+				}
 			}
-			err = waitForBuild(ctx, logs, r.client, workspace.LatestBuild.ID)
-			if err == nil {
-				break
+			if err != nil {
+				return codersdk.Workspace{}, xerrors.Errorf("wait for build: %w", err)
 			}
 		}
-		if err != nil {
-			return codersdk.Workspace{}, xerrors.Errorf("wait for build: %w", err)
-		}
 	}
 
 	if r.cfg.NoWaitForAgents {

From 76d6e13185b2acd8d0fd23e43e0d9c3eb8bcccc0 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Thu, 2 Oct 2025 11:22:05 +1000
Subject: [PATCH 036/298] ci: make `changes` required (#20131)

Earlier today, a dependabot PR was merged despite CI not having been run. https://github.com/coder/coder/pull/20068

This was because the `changes` job failed due to a github ratelimit, which caused all the tests to be skipped, which caused `required` to pass as it passes if tests are skipped.

<img width="725" height="872" alt="image" src="https://github.com/user-attachments/assets/3a13d19b-819a-48df-ad8c-e9ff903a0496" />

This PR makes `changes` required so this can't happen again (assuming we keep around the dependabot automerge around, it might).
---
 .github/workflows/ci.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 2d41883287e54..6fbba7883afbd 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -919,6 +919,7 @@ jobs:
   required:
     runs-on: ubuntu-latest
     needs:
+      - changes
       - fmt
       - lint
       - gen
@@ -942,6 +943,7 @@ jobs:
       - name: Ensure required checks
         run: | # zizmor: ignore[template-injection] We're just reading needs.x.result here, no risk of injection
           echo "Checking required checks"
+          echo "- changes: ${{ needs.changes.result }}"
           echo "- fmt: ${{ needs.fmt.result }}"
           echo "- lint: ${{ needs.lint.result }}"
           echo "- gen: ${{ needs.gen.result }}"

From e5c8c9bdaf770828ded482262add1c8ef68bfee5 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Thu, 2 Oct 2025 12:12:29 +1000
Subject: [PATCH 037/298] chore: pin dogfood to release branch during release
 freeze (#20028)

Relates to https://github.com/coder/dogfood/pull/189
Closes https://github.com/coder/internal/issues/1021

- Adds new script `scripts/should_deploy.sh` which implements the
algorithm in the linked issue
- Changes the `ci.yaml` workflow to run on release branches
- Moves the deployment steps out of `ci.yaml` into a new workflow
`deploy.yaml` for concurrency limiting purposes
- Changes the behavior of image tag pushing slightly:
    - Versioned tags will no longer have a `main-` prefix
    - `main` branch will still push the `main` and `latest` tags
    - `release/x.y` branches will now push `release-x.y` tags
- The deploy job will exit early if `should_deploy.sh` returns false
- The deploy job will now retag whatever image it's about to deploy as
`dogfood`
---
 .github/workflows/ci.yaml     | 152 ++++++++----------------------
 .github/workflows/deploy.yaml | 170 ++++++++++++++++++++++++++++++++++
 .github/zizmor.yml            |   4 +
 scripts/image_tag.sh          |   5 +-
 scripts/should_deploy.sh      |  68 ++++++++++++++
 5 files changed, 280 insertions(+), 119 deletions(-)
 create mode 100644 .github/workflows/deploy.yaml
 create mode 100644 .github/zizmor.yml
 create mode 100755 scripts/should_deploy.sh

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 6fbba7883afbd..eb2ba62e6b764 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -4,6 +4,7 @@ on:
   push:
     branches:
       - main
+      - release/*
 
   pull_request:
   workflow_dispatch:
@@ -969,7 +970,7 @@ jobs:
     needs: changes
     # We always build the dylibs on Go changes to verify we're not merging unbuildable code,
     # but they need only be signed and uploaded on coder/coder main.
-    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main'
+    if: needs.changes.outputs.go == 'true' || needs.changes.outputs.ci == 'true' || github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-macos-latest' || 'macos-latest' }}
     steps:
       # Harden Runner doesn't work on macOS
@@ -997,7 +998,7 @@ jobs:
         uses: ./.github/actions/setup-go
 
       - name: Install rcodesign
-        if: ${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
+        if: ${{ github.repository_owner == 'coder' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
         run: |
           set -euo pipefail
           wget -O /tmp/rcodesign.tar.gz https://github.com/indygreg/apple-platform-rs/releases/download/apple-codesign%2F0.22.0/apple-codesign-0.22.0-macos-universal.tar.gz
@@ -1008,7 +1009,7 @@ jobs:
           rm /tmp/rcodesign.tar.gz
 
       - name: Setup Apple Developer certificate and API key
-        if: ${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
+        if: ${{ github.repository_owner == 'coder' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
         run: |
           set -euo pipefail
           touch /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
@@ -1029,12 +1030,12 @@ jobs:
           make gen/mark-fresh
           make build/coder-dylib
         env:
-          CODER_SIGN_DARWIN: ${{ github.ref == 'refs/heads/main' && '1' || '0' }}
+          CODER_SIGN_DARWIN: ${{ (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && '1' || '0' }}
           AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
           AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
 
       - name: Upload build artifacts
-        if: ${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
+        if: ${{ github.repository_owner == 'coder' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
         uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dylibs
@@ -1044,7 +1045,7 @@ jobs:
           retention-days: 7
 
       - name: Delete Apple Developer certificate and API key
-        if: ${{ github.repository_owner == 'coder' && github.ref == 'refs/heads/main' }}
+        if: ${{ github.repository_owner == 'coder' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
         run: rm -f /tmp/{apple_cert.p12,apple_cert_password.txt,apple_apikey.p8}
 
   check-build:
@@ -1094,7 +1095,7 @@ jobs:
     needs:
       - changes
       - build-dylib
-    if: github.ref == 'refs/heads/main' && needs.changes.outputs.docs-only == 'false' && !github.event.pull_request.head.repo.fork
+    if: (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) && needs.changes.outputs.docs-only == 'false' && !github.event.pull_request.head.repo.fork
     runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-22.04' }}
     permissions:
       # Necessary to push docker images to ghcr.io.
@@ -1247,40 +1248,45 @@ jobs:
         id: build-docker
         env:
           CODER_IMAGE_BASE: ghcr.io/coder/coder-preview
-          CODER_IMAGE_TAG_PREFIX: main
           DOCKER_CLI_EXPERIMENTAL: "enabled"
         run: |
           set -euxo pipefail
 
           # build Docker images for each architecture
           version="$(./scripts/version.sh)"
-          tag="main-${version//+/-}"
+          tag="${version//+/-}"
           echo "tag=$tag" >> "$GITHUB_OUTPUT"
 
           # build images for each architecture
           # note: omitting the -j argument to avoid race conditions when pushing
           make build/coder_"$version"_linux_{amd64,arm64,armv7}.tag
 
-          # only push if we are on main branch
-          if [ "${GITHUB_REF}" == "refs/heads/main" ]; then
+          # only push if we are on main branch or release branch
+          if [[ "${GITHUB_REF}" == "refs/heads/main" || "${GITHUB_REF}" == refs/heads/release/* ]]; then
             # build and push multi-arch manifest, this depends on the other images
             # being pushed so will automatically push them
             # note: omitting the -j argument to avoid race conditions when pushing
             make push/build/coder_"$version"_linux_{amd64,arm64,armv7}.tag
 
             # Define specific tags
-            tags=("$tag" "main" "latest")
+            tags=("$tag")
+            if [ "${GITHUB_REF}" == "refs/heads/main" ]; then
+              tags+=("main" "latest")
+            elif [[ "${GITHUB_REF}" == refs/heads/release/* ]]; then
+              tags+=("release-${GITHUB_REF#refs/heads/release/}")
+            fi
 
             # Create and push a multi-arch manifest for each tag
             # we are adding `latest` tag and keeping `main` for backward
             # compatibality
             for t in "${tags[@]}"; do
-                # shellcheck disable=SC2046
-                ./scripts/build_docker_multiarch.sh \
-                    --push \
-                    --target "ghcr.io/coder/coder-preview:$t" \
-                    --version "$version" \
-                    $(cat build/coder_"$version"_linux_{amd64,arm64,armv7}.tag)
+              echo "Pushing multi-arch manifest for tag: $t"
+              # shellcheck disable=SC2046
+              ./scripts/build_docker_multiarch.sh \
+                  --push \
+                  --target "ghcr.io/coder/coder-preview:$t" \
+                  --version "$version" \
+                  $(cat build/coder_"$version"_linux_{amd64,arm64,armv7}.tag)
             done
           fi
 
@@ -1471,112 +1477,28 @@ jobs:
             ./build/*.deb
           retention-days: 7
 
+  # Deploy is handled in deploy.yaml so we can apply concurrency limits.
   deploy:
-    name: "deploy"
-    runs-on: ubuntu-latest
-    timeout-minutes: 30
     needs:
       - changes
       - build
     if: |
-      github.ref == 'refs/heads/main' && !github.event.pull_request.head.repo.fork
+      (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/'))
       && needs.changes.outputs.docs-only == 'false'
+      && !github.event.pull_request.head.repo.fork
+    uses: ./.github/workflows/deploy.yaml
+    with:
+      image: ${{ needs.build.outputs.IMAGE }}
     permissions:
       contents: read
       id-token: write
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Authenticate to Google Cloud
-        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
-        with:
-          workload_identity_provider: ${{ vars.GCP_WORKLOAD_ID_PROVIDER }}
-          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
-
-      - name: Set up Google Cloud SDK
-        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
-
-      - name: Set up Flux CLI
-        uses: fluxcd/flux2/action@6bf37f6a560fd84982d67f853162e4b3c2235edb # v2.6.4
-        with:
-          # Keep this and the github action up to date with the version of flux installed in dogfood cluster
-          version: "2.5.1"
-
-      - name: Get Cluster Credentials
-        uses: google-github-actions/get-gke-credentials@3da1e46a907576cefaa90c484278bb5b259dd395 # v3.0.0
-        with:
-          cluster_name: dogfood-v2
-          location: us-central1-a
-          project_id: coder-dogfood-v2
-
-      - name: Reconcile Flux
-        run: |
-          set -euxo pipefail
-          flux --namespace flux-system reconcile source git flux-system
-          flux --namespace flux-system reconcile source git coder-main
-          flux --namespace flux-system reconcile kustomization flux-system
-          flux --namespace flux-system reconcile kustomization coder
-          flux --namespace flux-system reconcile source chart coder-coder
-          flux --namespace flux-system reconcile source chart coder-coder-provisioner
-          flux --namespace coder reconcile helmrelease coder
-          flux --namespace coder reconcile helmrelease coder-provisioner
-
-      # Just updating Flux is usually not enough. The Helm release may get
-      # redeployed, but unless something causes the Deployment to update the
-      # pods won't be recreated. It's important that the pods get recreated,
-      # since we use `imagePullPolicy: Always` to ensure we're running the
-      # latest image.
-      - name: Rollout Deployment
-        run: |
-          set -euxo pipefail
-          kubectl --namespace coder rollout restart deployment/coder
-          kubectl --namespace coder rollout status deployment/coder
-          kubectl --namespace coder rollout restart deployment/coder-provisioner
-          kubectl --namespace coder rollout status deployment/coder-provisioner
-          kubectl --namespace coder rollout restart deployment/coder-provisioner-tagged
-          kubectl --namespace coder rollout status deployment/coder-provisioner-tagged
-
-  deploy-wsproxies:
-    runs-on: ubuntu-latest
-    needs: build
-    if: github.ref == 'refs/heads/main' && !github.event.pull_request.head.repo.fork
-    steps:
-      - name: Harden Runner
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
-        with:
-          egress-policy: audit
-
-      - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
-        with:
-          fetch-depth: 0
-          persist-credentials: false
-
-      - name: Setup flyctl
-        uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5
-
-      - name: Deploy workspace proxies
-        run: |
-          flyctl deploy --image "$IMAGE" --app paris-coder --config ./.github/fly-wsproxies/paris-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_PARIS" --yes
-          flyctl deploy --image "$IMAGE" --app sydney-coder --config ./.github/fly-wsproxies/sydney-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SYDNEY" --yes
-          flyctl deploy --image "$IMAGE" --app sao-paulo-coder --config ./.github/fly-wsproxies/sao-paulo-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SAO_PAULO" --yes
-          flyctl deploy --image "$IMAGE" --app jnb-coder --config ./.github/fly-wsproxies/jnb-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_JNB" --yes
-        env:
-          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
-          IMAGE: ${{ needs.build.outputs.IMAGE }}
-          TOKEN_PARIS: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }}
-          TOKEN_SYDNEY: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }}
-          TOKEN_SAO_PAULO: ${{ secrets.FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN }}
-          TOKEN_JNB: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}
+      packages: write # to retag image as dogfood
+    secrets:
+      FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+      FLY_PARIS_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }}
+      FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }}
+      FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN }}
+      FLY_JNB_CODER_PROXY_SESSION_TOKEN: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}
 
   # sqlc-vet runs a postgres docker container, runs Coder migrations, and then
   # runs sqlc-vet to ensure all queries are valid. This catches any mistakes
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
new file mode 100644
index 0000000000000..7983591246363
--- /dev/null
+++ b/.github/workflows/deploy.yaml
@@ -0,0 +1,170 @@
+name: deploy
+
+on:
+  # Via workflow_call, called from ci.yaml
+  workflow_call:
+    inputs:
+      image:
+        description: "Image and tag to potentially deploy. Current branch will be validated against should-deploy check."
+        required: true
+        type: string
+    secrets:
+      FLY_API_TOKEN:
+        required: true
+      FLY_PARIS_CODER_PROXY_SESSION_TOKEN:
+        required: true
+      FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN:
+        required: true
+      FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN:
+        required: true
+      FLY_JNB_CODER_PROXY_SESSION_TOKEN:
+        required: true
+
+permissions:
+  contents: read
+
+concurrency:
+  group: ${{ github.workflow }} # no per-branch concurrency
+  cancel-in-progress: false
+
+jobs:
+  # Determines if the given branch should be deployed to dogfood.
+  should-deploy:
+    name: should-deploy
+    runs-on: ubuntu-latest
+    outputs:
+      verdict: ${{ steps.check.outputs.verdict }} # DEPLOY or NOOP
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Check if deploy is enabled
+        id: check
+        run: |
+          set -euo pipefail
+          verdict="$(./scripts/should_deploy.sh)"
+          echo "verdict=$verdict" >> "$GITHUB_OUTPUT"
+
+  deploy:
+    name: "deploy"
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    needs: should-deploy
+    if: needs.should-deploy.outputs.verdict == 'DEPLOY'
+    permissions:
+      contents: read
+      id-token: write
+      packages: write # to retag image as dogfood
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: GHCR Login
+        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Authenticate to Google Cloud
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          workload_identity_provider: ${{ vars.GCP_WORKLOAD_ID_PROVIDER }}
+          service_account: ${{ vars.GCP_SERVICE_ACCOUNT }}
+
+      - name: Set up Google Cloud SDK
+        uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
+
+      - name: Set up Flux CLI
+        uses: fluxcd/flux2/action@6bf37f6a560fd84982d67f853162e4b3c2235edb # v2.6.4
+        with:
+          # Keep this and the github action up to date with the version of flux installed in dogfood cluster
+          version: "2.7.0"
+
+      - name: Get Cluster Credentials
+        uses: google-github-actions/get-gke-credentials@3da1e46a907576cefaa90c484278bb5b259dd395 # v3.0.0
+        with:
+          cluster_name: dogfood-v2
+          location: us-central1-a
+          project_id: coder-dogfood-v2
+
+      - name: Tag image as dogfood
+        run: |
+          set -euxo pipefail
+          # Retag image as dogfood while maintaining the multi-arch manifest
+          docker buildx imagetools create --tag "ghcr.io/coder/coder-preview:dogfood" "$IMAGE"
+
+      - name: Reconcile Flux
+        run: |
+          set -euxo pipefail
+          flux --namespace flux-system reconcile source git flux-system
+          flux --namespace flux-system reconcile source git coder-main
+          flux --namespace flux-system reconcile kustomization flux-system
+          flux --namespace flux-system reconcile kustomization coder
+          flux --namespace flux-system reconcile source chart coder-coder
+          flux --namespace flux-system reconcile source chart coder-coder-provisioner
+          flux --namespace coder reconcile helmrelease coder
+          flux --namespace coder reconcile helmrelease coder-provisioner
+
+      # Just updating Flux is usually not enough. The Helm release may get
+      # redeployed, but unless something causes the Deployment to update the
+      # pods won't be recreated. It's important that the pods get recreated,
+      # since we use `imagePullPolicy: Always` to ensure we're running the
+      # latest image.
+      - name: Rollout Deployment
+        run: |
+          set -euxo pipefail
+          kubectl --namespace coder rollout restart deployment/coder
+          kubectl --namespace coder rollout status deployment/coder
+          kubectl --namespace coder rollout restart deployment/coder-provisioner
+          kubectl --namespace coder rollout status deployment/coder-provisioner
+          kubectl --namespace coder rollout restart deployment/coder-provisioner-tagged
+          kubectl --namespace coder rollout status deployment/coder-provisioner-tagged
+
+  deploy-wsproxies:
+    runs-on: ubuntu-latest
+    needs: deploy
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - name: Setup flyctl
+        uses: superfly/flyctl-actions/setup-flyctl@fc53c09e1bc3be6f54706524e3b82c4f462f77be # v1.5
+
+      - name: Deploy workspace proxies
+        run: |
+          flyctl deploy --image "$IMAGE" --app paris-coder --config ./.github/fly-wsproxies/paris-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_PARIS" --yes
+          flyctl deploy --image "$IMAGE" --app sydney-coder --config ./.github/fly-wsproxies/sydney-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SYDNEY" --yes
+          flyctl deploy --image "$IMAGE" --app sao-paulo-coder --config ./.github/fly-wsproxies/sao-paulo-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SAO_PAULO" --yes
+          flyctl deploy --image "$IMAGE" --app jnb-coder --config ./.github/fly-wsproxies/jnb-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_JNB" --yes
+        env:
+          FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
+          IMAGE: ${{ inputs.image }}
+          TOKEN_PARIS: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }}
+          TOKEN_SYDNEY: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }}
+          TOKEN_SAO_PAULO: ${{ secrets.FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN }}
+          TOKEN_JNB: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}
diff --git a/.github/zizmor.yml b/.github/zizmor.yml
new file mode 100644
index 0000000000000..e125592cfdc6a
--- /dev/null
+++ b/.github/zizmor.yml
@@ -0,0 +1,4 @@
+rules:
+  cache-poisoning:
+    ignore:
+      - "ci.yaml:184"
diff --git a/scripts/image_tag.sh b/scripts/image_tag.sh
index 68dfbcebf99cb..8767a22cb199c 100755
--- a/scripts/image_tag.sh
+++ b/scripts/image_tag.sh
@@ -51,10 +51,7 @@ fi
 
 image="${CODER_IMAGE_BASE:-ghcr.io/coder/coder}"
 
-# use CODER_IMAGE_TAG_PREFIX if set as a prefix for the tag
-tag_prefix="${CODER_IMAGE_TAG_PREFIX:-}"
-
-tag="${tag_prefix:+$tag_prefix-}v$version"
+tag="v$version"
 
 if [[ "$version" == "latest" ]]; then
 	tag="latest"
diff --git a/scripts/should_deploy.sh b/scripts/should_deploy.sh
new file mode 100755
index 0000000000000..3122192956b8d
--- /dev/null
+++ b/scripts/should_deploy.sh
@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# This script determines if a commit in either the main branch or a
+# `release/x.y` branch should be deployed to dogfood.
+#
+# To avoid masking unrelated failures, this script will return 0 in either case,
+# and will print `DEPLOY` or `NOOP` to stdout.
+
+set -euo pipefail
+# shellcheck source=scripts/lib.sh
+source "$(dirname "${BASH_SOURCE[0]}")/lib.sh"
+cdroot
+
+deploy_branch=main
+
+# Determine the current branch name and check that it is one of the supported
+# branch names.
+branch_name=$(git branch --show-current)
+if [[ "$branch_name" != "main" && ! "$branch_name" =~ ^release/[0-9]+\.[0-9]+$ ]]; then
+	error "Current branch '$branch_name' is not a supported branch name for dogfood, must be 'main' or 'release/x.y'"
+fi
+log "Current branch '$branch_name'"
+
+# Determine the remote name
+remote=$(git remote -v | grep coder/coder | awk '{print $1}' | head -n1)
+if [[ -z "${remote}" ]]; then
+	error "Could not find remote for coder/coder"
+fi
+log "Using remote '$remote'"
+
+# Step 1: List all release branches and sort them by major/minor so we can find
+# the latest release branch.
+release_branches=$(
+	git branch -r --format='%(refname:short)' |
+		grep -E "${remote}/release/[0-9]+\.[0-9]+$" |
+		sed "s|${remote}/||" |
+		sort -V
+)
+
+# As a sanity check, release/2.26 should exist.
+if ! echo "$release_branches" | grep "release/2.26" >/dev/null; then
+	error "Could not find existing release branches. Did you run 'git fetch -ap ${remote}'?"
+fi
+
+latest_release_branch=$(echo "$release_branches" | tail -n 1)
+latest_release_branch_version=${latest_release_branch#release/}
+log "Latest release branch: $latest_release_branch"
+log "Latest release branch version: $latest_release_branch_version"
+
+# Step 2: check if a matching tag `v<x.y>.0` exists. If it does not, we will
+# use the release branch as the deploy branch.
+if ! git rev-parse "refs/tags/v${latest_release_branch_version}.0" >/dev/null 2>&1; then
+	log "Tag 'v${latest_release_branch_version}.0' does not exist, using release branch as deploy branch"
+	deploy_branch=$latest_release_branch
+else
+	log "Matching tag 'v${latest_release_branch_version}.0' exists, using main as deploy branch"
+fi
+log "Deploy branch: $deploy_branch"
+
+# Finally, check if the current branch is the deploy branch.
+log
+if [[ "$branch_name" != "$deploy_branch" ]]; then
+	log "VERDICT: DO NOT DEPLOY"
+	echo "NOOP" # stdout
+else
+	log "VERDICT: DEPLOY"
+	echo "DEPLOY" # stdout
+fi

From d2c286d9b0eac6d5f04b33d10323c677d5e940d4 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Thu, 2 Oct 2025 16:08:29 +1000
Subject: [PATCH 038/298] chore: fix missing variable in deploy workflow
 (#20136)

already in release branch and tested working
---
 .github/workflows/deploy.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 7983591246363..895fd32ec9851 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -104,11 +104,11 @@ jobs:
           location: us-central1-a
           project_id: coder-dogfood-v2
 
+      # Retag image as dogfood while maintaining the multi-arch manifest
       - name: Tag image as dogfood
-        run: |
-          set -euxo pipefail
-          # Retag image as dogfood while maintaining the multi-arch manifest
-          docker buildx imagetools create --tag "ghcr.io/coder/coder-preview:dogfood" "$IMAGE"
+        run: docker buildx imagetools create --tag "ghcr.io/coder/coder-preview:dogfood" "$IMAGE"
+        env:
+          IMAGE: ${{ inputs.image }}
 
       - name: Reconcile Flux
         run: |

From d63bb2ce2fd33acf0d4b158437dad6219ba60749 Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Thu, 2 Oct 2025 11:10:51 +0200
Subject: [PATCH 039/298] chore: add Audit Log purge advice (#20052)

Audit Log entries can be deleted safely (with appropriate caveats), but
we don't specifically call this out in the docs.

---------

Signed-off-by: Danny Kopping <danny@coder.com>
---
 docs/admin/security/audit-logs.md | 52 ++++++++++++++++++++++++++++++-
 1 file changed, 51 insertions(+), 1 deletion(-)

diff --git a/docs/admin/security/audit-logs.md b/docs/admin/security/audit-logs.md
index 37ed2a1c00694..2c72528f38ea3 100644
--- a/docs/admin/security/audit-logs.md
+++ b/docs/admin/security/audit-logs.md
@@ -125,6 +125,56 @@ log entry:
 2023-06-13 03:43:29.233 [info]  coderd: audit_log  ID=95f7c392-da3e-480c-a579-8909f145fbe2  Time="2023-06-13T03:43:29.230422Z"  UserID=6c405053-27e3-484a-9ad7-bcb64e7bfde6  OrganizationID=00000000-0000-0000-0000-000000000000  Ip=<nil>  UserAgent=<nil>  ResourceType=workspace_build  ResourceID=988ae133-5b73-41e3-a55e-e1e9d3ef0b66  ResourceTarget=""  Action=start  Diff="{}"  StatusCode=200  AdditionalFields="{\"workspace_name\":\"linux-container\",\"build_number\":\"7\",\"build_reason\":\"initiator\",\"workspace_owner\":\"\"}"  RequestID=9682b1b5-7b9f-4bf2-9a39-9463f8e41cd6  ResourceIcon=""
 ```
 
+## Purging Old Audit Logs
+
+> [!WARNING]
+> Audit Logs provide critical security and compliance information. Purging Audit Logs may impact your organization's ability
+> to investigate security incidents or meet compliance requirements. Consult your security and compliance teams before purging any audit data.
+
+Audit Logs are not automatically purged from the database, though they can account for a large amount of disk usage.
+Use the following query to determine the amount of disk space used by the `audit_logs` table.
+
+```sql
+SELECT
+    relname AS table_name,
+    pg_size_pretty(pg_total_relation_size(relid)) AS total_size,
+    pg_size_pretty(pg_relation_size(relid)) AS table_size,
+    pg_size_pretty(pg_indexes_size(relid)) AS indexes_size,
+    (SELECT COUNT(*) FROM audit_logs) AS total_records
+FROM pg_catalog.pg_statio_user_tables
+WHERE relname = 'audit_logs'
+ORDER BY pg_total_relation_size(relid) DESC;
+```
+
+Should you wish to purge these records, it is safe to do so. This can only be done by running SQL queries
+directly against the `audit_logs` table in the database. We advise users to only purge old records (>1yr)
+and in accordance with your compliance requirements.
+
+### Backup/Archive
+
+Consider exporting or archiving these records before deletion:
+
+```sql
+-- Export to CSV
+COPY (SELECT * FROM audit_logs WHERE time < CURRENT_TIMESTAMP - INTERVAL '1 year')
+TO '/path/to/audit_logs_archive.csv' DELIMITER ',' CSV HEADER;
+
+-- Copy to archive table
+CREATE TABLE audit_logs_archive AS
+SELECT * FROM audit_logs WHERE time < CURRENT_TIMESTAMP - INTERVAL '1 year';
+```
+
+### Permanent Deletion
+
+> [!NOTE]
+> For large `audit_logs` tables, consider running the `DELETE` operation during maintenance windows as it may impact
+> database performance. You can also batch the deletions to reduce lock time.
+
+```sql
+DELETE FROM audit_logs WHERE time < CURRENT_TIMESTAMP - INTERVAL '1 year';
+-- Consider running `VACUUM VERBOSE audit_logs` afterwards for large datasets to reclaim disk space.
+```
+
 ## How to Enable Audit Logs
 
-This feature is only available with a [Premium license](../licensing/index.md).
+This feature is only available with a [Premium license](../licensing/index.md), and is automatically enabled.

From d93629bcdef67be9547b1f061c887c05dbd532e6 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Thu, 2 Oct 2025 15:07:49 +0200
Subject: [PATCH 040/298] fix: check permission to update username (#20139)

---
 coderd/users.go      |  8 ++++++
 coderd/users_test.go | 63 ++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 66 insertions(+), 5 deletions(-)

diff --git a/coderd/users.go b/coderd/users.go
index 1e592d010c077..e24790e7455e7 100644
--- a/coderd/users.go
+++ b/coderd/users.go
@@ -753,6 +753,14 @@ func (api *API) putUserProfile(rw http.ResponseWriter, r *http.Request) {
 	if !httpapi.Read(ctx, rw, r, &params) {
 		return
 	}
+
+	// If caller wants to update user's username, they need "update_users" permission.
+	// This is restricted to user admins only.
+	if params.Username != user.Username && !api.Authorize(r, policy.ActionUpdate, user) {
+		httpapi.ResourceNotFound(rw)
+		return
+	}
+
 	existentUser, err := api.Database.GetUserByEmailOrUsername(ctx, database.GetUserByEmailOrUsernameParams{
 		Username: params.Username,
 	})
diff --git a/coderd/users_test.go b/coderd/users_test.go
index 22c9fad5eebea..283b607e89df9 100644
--- a/coderd/users_test.go
+++ b/coderd/users_test.go
@@ -1051,7 +1051,7 @@ func TestUpdateUserProfile(t *testing.T) {
 		require.Equal(t, database.AuditActionWrite, auditor.AuditLogs()[numLogs-1].Action)
 	})
 
-	t.Run("UpdateSelfAsMember", func(t *testing.T) {
+	t.Run("UpdateSelfAsMember_Name", func(t *testing.T) {
 		t.Parallel()
 		auditor := audit.NewMock()
 		client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
@@ -1060,29 +1060,82 @@ func TestUpdateUserProfile(t *testing.T) {
 		firstUser := coderdtest.CreateFirstUser(t, client)
 		numLogs++ // add an audit log for login
 
-		memberClient, _ := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
+		memberClient, memberUser := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
 		numLogs++ // add an audit log for user creation
 
 		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 		defer cancel()
 
-		newUsername := coderdtest.RandomUsername(t)
 		newName := coderdtest.RandomName(t)
 		userProfile, err := memberClient.UpdateUserProfile(ctx, codersdk.Me, codersdk.UpdateUserProfileRequest{
-			Username: newUsername,
 			Name:     newName,
+			Username: memberUser.Username,
 		})
 		numLogs++ // add an audit log for user update
 		numLogs++ // add an audit log for API key creation
 
 		require.NoError(t, err)
-		require.Equal(t, newUsername, userProfile.Username)
+		require.Equal(t, memberUser.Username, userProfile.Username)
 		require.Equal(t, newName, userProfile.Name)
 
 		require.Len(t, auditor.AuditLogs(), numLogs)
 		require.Equal(t, database.AuditActionWrite, auditor.AuditLogs()[numLogs-1].Action)
 	})
 
+	t.Run("UpdateSelfAsMember_Username", func(t *testing.T) {
+		t.Parallel()
+		auditor := audit.NewMock()
+		client := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
+
+		firstUser := coderdtest.CreateFirstUser(t, client)
+		memberClient, memberUser := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		newUsername := coderdtest.RandomUsername(t)
+		_, err := memberClient.UpdateUserProfile(ctx, codersdk.Me, codersdk.UpdateUserProfileRequest{
+			Name:     memberUser.Name,
+			Username: newUsername,
+		})
+
+		var apiErr *codersdk.Error
+		require.ErrorAs(t, err, &apiErr)
+		require.Equal(t, http.StatusNotFound, apiErr.StatusCode())
+	})
+
+	t.Run("UpdateMemberAsAdmin_Username", func(t *testing.T) {
+		t.Parallel()
+		auditor := audit.NewMock()
+		adminClient := coderdtest.New(t, &coderdtest.Options{Auditor: auditor})
+		numLogs := len(auditor.AuditLogs())
+
+		adminUser := coderdtest.CreateFirstUser(t, adminClient)
+		numLogs++ // add an audit log for login
+
+		_, memberUser := coderdtest.CreateAnotherUser(t, adminClient, adminUser.OrganizationID)
+		numLogs++ // add an audit log for user creation
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		newUsername := coderdtest.RandomUsername(t)
+		userProfile, err := adminClient.UpdateUserProfile(ctx, codersdk.Me, codersdk.UpdateUserProfileRequest{
+			Name:     memberUser.Name,
+			Username: newUsername,
+		})
+
+		numLogs++ // add an audit log for user update
+		numLogs++ // add an audit log for API key creation
+
+		require.NoError(t, err)
+		require.Equal(t, newUsername, userProfile.Username)
+		require.Equal(t, memberUser.Name, userProfile.Name)
+
+		require.Len(t, auditor.AuditLogs(), numLogs)
+		require.Equal(t, database.AuditActionWrite, auditor.AuditLogs()[numLogs-1].Action)
+	})
+
 	t.Run("InvalidRealUserName", func(t *testing.T) {
 		t.Parallel()
 		client := coderdtest.New(t, nil)

From 1f71c2c12957218dcde03ed087d3fea50d312308 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Thu, 2 Oct 2025 14:59:22 +0100
Subject: [PATCH 041/298] ci(.github/workflows/traiage.yaml): fix task URL in
 github comment (#20142)

---
 .github/workflows/traiage.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 09881ff2ee46a..30eeb5cb8bb48 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -217,7 +217,7 @@ jobs:
           echo "Creating task: $TASK_NAME"
           ./scripts/traiage.sh create
           if [[ "${ISSUE_URL}" == "https://github.com/${GITHUB_REPOSITORY}"* ]]; then
-            gh issue comment "${ISSUE_URL}" --body "Task created: ${TASK_NAME}" --create-if-none --edit-last
+            gh issue comment "${ISSUE_URL}" --body "Task created: https://dev.coder.com/tasks/${CODER_USERNAME}/${TASK_NAME}" --create-if-none --edit-last
           else
             echo "Skipping comment on other repo."
           fi

From c517aabe43add821ee8c39b760a6740b548600d2 Mon Sep 17 00:00:00 2001
From: Rafael Rodriguez <rafael@coder.com>
Date: Thu, 2 Oct 2025 09:32:40 -0500
Subject: [PATCH 042/298] fix: add heartbeat to keep dynamic params websocket
 open (#20026)

## Summary

In this pull request we're adding a heartbeat to the
`handleParameterWebsocket` function to ensure that the connection stays
open until the 30 min timeout has been reached.

Closes: https://github.com/coder/coder/issues/19805

### Testing

- Reproduced the problem mentioned in the issue (websocket connection
closes after ~10 minutes of inactivity on the create workspace page)

<img width="1870" height="357" alt="Screenshot 2025-09-26 at 15 58 51"
src="https://github.com/user-attachments/assets/a9e2e89e-87c5-4afa-9644-afe246a15f79"
/>

- Confirmed that adding the heartbeat kept the connection open until the
30 min timeout was reached

<img width="1636" height="387" alt="Screenshot 2025-09-29 at 15 51 43"
src="https://github.com/user-attachments/assets/0a8c5cda-29a6-493d-a6c0-4a2629da8838"
/>
---
 coderd/parameters.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/coderd/parameters.go b/coderd/parameters.go
index 4b8b13486934f..cb24dcd4312ec 100644
--- a/coderd/parameters.go
+++ b/coderd/parameters.go
@@ -139,6 +139,8 @@ func (api *API) handleParameterWebsocket(rw http.ResponseWriter, r *http.Request
 		})
 		return
 	}
+	go httpapi.Heartbeat(ctx, conn)
+
 	stream := wsjson.NewStream[codersdk.DynamicParametersRequest, codersdk.DynamicParametersResponse](
 		conn,
 		websocket.MessageText,

From 0d2ccacacdec7f00cb76808af89cc570b18ef3f1 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Thu, 2 Oct 2025 15:39:11 +0100
Subject: [PATCH 043/298] chore: update to coder/clistat v1.0.1 (#20143)

Update https://github.com/coder/clistat to v1.0.1. This release has two
bug fixes.
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 34967b03a7060..c375c113f143b 100644
--- a/go.mod
+++ b/go.mod
@@ -462,7 +462,7 @@ require (
 	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
-require github.com/coder/clistat v1.0.0
+require github.com/coder/clistat v1.0.1
 
 require github.com/SherClockHolmes/webpush-go v1.4.0
 
diff --git a/go.sum b/go.sum
index ecc9506cbe700..03c0c1bc96e8b 100644
--- a/go.sum
+++ b/go.sum
@@ -919,8 +919,8 @@ github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945/go.mod h1:d1AMFw81rUgrGHuZzWdPNhkY0G8w7pvLNLYF0e3ceC4=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41 h1:SBN/DA63+ZHwuWwPHPYoCZ/KLAjHv5g4h2MS4f2/MTI=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41/go.mod h1:I9ULxr64UaOSUv7hcb3nX4kowodJCVS7vt7VVJk/kW4=
-github.com/coder/clistat v1.0.0 h1:MjiS7qQ1IobuSSgDnxcCSyBPESs44hExnh2TEqMcGnA=
-github.com/coder/clistat v1.0.0/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
+github.com/coder/clistat v1.0.1 h1:0ZgnKr1C4Z0ukG1z1+RUa8Z4OoIgWIH2hdxWSXQTubE=
+github.com/coder/clistat v1.0.1/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
 github.com/coder/flog v1.1.0 h1:kbAes1ai8fIS5OeV+QAnKBQE22ty1jRF/mcAwHpLBa4=
 github.com/coder/flog v1.1.0/go.mod h1:UQlQvrkJBvnRGo69Le8E24Tcl5SJleAAR7gYEHzAmdQ=
 github.com/coder/glog v1.0.1-0.20220322161911-7365fe7f2cd1/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=

From 4d1003eace5f0604ac61786137db813e9a2ac01f Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Thu, 2 Oct 2025 11:43:13 -0600
Subject: [PATCH 044/298] fix: remove initial global HTTP client usage (#20128)

This PR makes the initial steps at removing usage of the global Go HTTP
client, which was seen to have impacts on test flakiness in
https://github.com/coder/internal/issues/1020. The first commit removes
uses from tests, with the exception of one test that is tightly coupled
to the default client. The second commit makes easy/low-risk removals
from application code. This should have some impact to reduce test flakiness.
---
 agent/agent_test.go                           |  3 ++-
 agent/apphealth.go                            |  3 ++-
 cli/server_test.go                            |  6 ++++--
 cli/ssh_test.go                               |  3 ++-
 coderd/healthcheck/accessurl_test.go          |  2 +-
 coderd/healthcheck/derphealth/derp_test.go    |  3 ++-
 coderd/mcp/mcp_e2e_test.go                    | 18 ++++++++++--------
 coderd/oauth2_metadata_test.go                |  6 ++++--
 coderd/promoauth/oauth2_test.go               |  3 ++-
 coderd/telemetry/telemetry.go                 |  4 +++-
 codersdk/agentsdk/agentsdk_test.go            |  9 ++++++---
 enterprise/cli/provisionerdaemonstart_test.go |  3 ++-
 enterprise/cli/proxyserver_test.go            |  3 ++-
 enterprise/cli/server_test.go                 |  3 ++-
 enterprise/coderd/coderd_test.go              |  3 ++-
 enterprise/wsproxy/wsproxy_test.go            | 11 +++++++----
 enterprise/x/aibridged/aibridged_test.go      |  3 ++-
 site/site_test.go                             |  6 ++++--
 18 files changed, 59 insertions(+), 33 deletions(-)

diff --git a/agent/agent_test.go b/agent/agent_test.go
index e8b3b99a95387..d4c857dc39637 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -2027,7 +2027,8 @@ func runSubAgentMain() int {
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
 	defer cancel()
 	req = req.WithContext(ctx)
-	resp, err := http.DefaultClient.Do(req)
+	client := &http.Client{}
+	resp, err := client.Do(req)
 	if err != nil {
 		_, _ = fmt.Fprintf(os.Stderr, "agent connection failed: %v\n", err)
 		return 11
diff --git a/agent/apphealth.go b/agent/apphealth.go
index 1c4e1d126902c..4fb551077a30f 100644
--- a/agent/apphealth.go
+++ b/agent/apphealth.go
@@ -63,6 +63,7 @@ func NewAppHealthReporterWithClock(
 		// run a ticker for each app health check.
 		var mu sync.RWMutex
 		failures := make(map[uuid.UUID]int, 0)
+		client := &http.Client{}
 		for _, nextApp := range apps {
 			if !shouldStartTicker(nextApp) {
 				continue
@@ -91,7 +92,7 @@ func NewAppHealthReporterWithClock(
 						if err != nil {
 							return err
 						}
-						res, err := http.DefaultClient.Do(req)
+						res, err := client.Do(req)
 						if err != nil {
 							return err
 						}
diff --git a/cli/server_test.go b/cli/server_test.go
index 18d59f7811fc3..0748786765cb8 100644
--- a/cli/server_test.go
+++ b/cli/server_test.go
@@ -1254,8 +1254,9 @@ func TestServer(t *testing.T) {
 					t.Logf("error creating request: %s", err.Error())
 					return false
 				}
+				client := &http.Client{}
 				// nolint:bodyclose
-				res, err := http.DefaultClient.Do(req)
+				res, err := client.Do(req)
 				if err != nil {
 					t.Logf("error hitting prometheus endpoint: %s", err.Error())
 					return false
@@ -1316,8 +1317,9 @@ func TestServer(t *testing.T) {
 					t.Logf("error creating request: %s", err.Error())
 					return false
 				}
+				client := &http.Client{}
 				// nolint:bodyclose
-				res, err := http.DefaultClient.Do(req)
+				res, err := client.Do(req)
 				if err != nil {
 					t.Logf("error hitting prometheus endpoint: %s", err.Error())
 					return false
diff --git a/cli/ssh_test.go b/cli/ssh_test.go
index be3166cc4d32a..652e0e9c01996 100644
--- a/cli/ssh_test.go
+++ b/cli/ssh_test.go
@@ -1242,7 +1242,8 @@ func TestSSH(t *testing.T) {
 				// true exits the loop.
 				return true
 			}
-			resp, err := http.DefaultClient.Do(req)
+			client := &http.Client{}
+			resp, err := client.Do(req)
 			if err != nil {
 				t.Logf("HTTP GET http://localhost:8222/ %s", err)
 				return false
diff --git a/coderd/healthcheck/accessurl_test.go b/coderd/healthcheck/accessurl_test.go
index 29bf008346b37..85f362959718e 100644
--- a/coderd/healthcheck/accessurl_test.go
+++ b/coderd/healthcheck/accessurl_test.go
@@ -55,7 +55,7 @@ func TestAccessURL(t *testing.T) {
 		defer cancel()
 
 		report.Run(ctx, &healthcheck.AccessURLReportOptions{
-			Client:    nil, // defaults to http.DefaultClient
+			Client:    &http.Client{},
 			AccessURL: nil,
 		})
 
diff --git a/coderd/healthcheck/derphealth/derp_test.go b/coderd/healthcheck/derphealth/derp_test.go
index c009ea982d620..08dc7db97f982 100644
--- a/coderd/healthcheck/derphealth/derp_test.go
+++ b/coderd/healthcheck/derphealth/derp_test.go
@@ -511,7 +511,8 @@ func tsDERPMap(ctx context.Context, t testing.TB) *tailcfg.DERPMap {
 	req, err := http.NewRequestWithContext(ctx, "GET", ipn.DefaultControlURL+"/derpmap/default", nil)
 	require.NoError(t, err)
 
-	res, err := http.DefaultClient.Do(req)
+	client := &http.Client{}
+	res, err := client.Do(req)
 	require.NoError(t, err)
 	defer res.Body.Close()
 	require.Equal(t, http.StatusOK, res.StatusCode)
diff --git a/coderd/mcp/mcp_e2e_test.go b/coderd/mcp/mcp_e2e_test.go
index 2813757a50310..f101cfbdd5b65 100644
--- a/coderd/mcp/mcp_e2e_test.go
+++ b/coderd/mcp/mcp_e2e_test.go
@@ -141,7 +141,8 @@ func TestMCPHTTP_E2E_UnauthenticatedAccess(t *testing.T) {
 	require.NoError(t, err, "Should be able to create HTTP request")
 	req.Header.Set("Content-Type", "application/json")
 
-	resp, err := http.DefaultClient.Do(req)
+	client := &http.Client{}
+	resp, err := client.Do(req)
 	require.NoError(t, err, "Should be able to make HTTP request")
 	defer resp.Body.Close()
 
@@ -613,7 +614,7 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		require.NoError(t, err)
 		tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-		tokenResp, err := http.DefaultClient.Do(tokenReq)
+		tokenResp, err := client.Do(tokenReq)
 		require.NoError(t, err)
 		defer tokenResp.Body.Close()
 
@@ -711,7 +712,7 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		require.NoError(t, err)
 		refreshReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-		refreshResp, err := http.DefaultClient.Do(refreshReq)
+		refreshResp, err := client.Do(refreshReq)
 		require.NoError(t, err)
 		defer refreshResp.Body.Close()
 
@@ -846,7 +847,7 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		regReq.Header.Set("Content-Type", "application/json")
 
 		// Dynamic client registration should not require authentication (public endpoint)
-		regResp, err := http.DefaultClient.Do(regReq)
+		regResp, err := client.Do(regReq)
 		require.NoError(t, err)
 		defer regResp.Body.Close()
 
@@ -936,7 +937,7 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		require.NoError(t, err)
 		tokenReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-		tokenResp, err := http.DefaultClient.Do(tokenReq)
+		tokenResp, err := client.Do(tokenReq)
 		require.NoError(t, err)
 		defer tokenResp.Body.Close()
 
@@ -1037,7 +1038,7 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		require.NoError(t, err)
 		refreshReq.Header.Set("Content-Type", "application/x-www-form-urlencoded")
 
-		refreshResp, err := http.DefaultClient.Do(refreshReq)
+		refreshResp, err := client.Do(refreshReq)
 		require.NoError(t, err)
 		defer refreshResp.Body.Close()
 
@@ -1151,7 +1152,8 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		require.NoError(t, err)
 		regReq1.Header.Set("Content-Type", "application/json")
 
-		regResp1, err := http.DefaultClient.Do(regReq1)
+		client := &http.Client{}
+		regResp1, err := client.Do(regReq1)
 		require.NoError(t, err)
 		defer regResp1.Body.Close()
 
@@ -1181,7 +1183,7 @@ func TestMCPHTTP_E2E_OAuth2_EndToEnd(t *testing.T) {
 		require.NoError(t, err)
 		regReq2.Header.Set("Content-Type", "application/json")
 
-		regResp2, err := http.DefaultClient.Do(regReq2)
+		regResp2, err := client.Do(regReq2)
 		require.NoError(t, err)
 		defer regResp2.Body.Close()
 
diff --git a/coderd/oauth2_metadata_test.go b/coderd/oauth2_metadata_test.go
index a3e8ec1f50571..0e7ff4b1a8743 100644
--- a/coderd/oauth2_metadata_test.go
+++ b/coderd/oauth2_metadata_test.go
@@ -29,7 +29,8 @@ func TestOAuth2AuthorizationServerMetadata(t *testing.T) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	require.NoError(t, err)
 
-	resp, err := http.DefaultClient.Do(req)
+	httpClient := &http.Client{}
+	resp, err := httpClient.Do(req)
 	require.NoError(t, err)
 	defer resp.Body.Close()
 
@@ -65,7 +66,8 @@ func TestOAuth2ProtectedResourceMetadata(t *testing.T) {
 	req, err := http.NewRequestWithContext(ctx, http.MethodGet, endpoint, nil)
 	require.NoError(t, err)
 
-	resp, err := http.DefaultClient.Do(req)
+	httpClient := &http.Client{}
+	resp, err := httpClient.Do(req)
 	require.NoError(t, err)
 	defer resp.Body.Close()
 
diff --git a/coderd/promoauth/oauth2_test.go b/coderd/promoauth/oauth2_test.go
index 5aeec4f0fb949..ab8e7c33146f7 100644
--- a/coderd/promoauth/oauth2_test.go
+++ b/coderd/promoauth/oauth2_test.go
@@ -94,7 +94,8 @@ func TestInstrument(t *testing.T) {
 		must[*url.URL](t)(idp.IssuerURL().Parse("/.well-known/openid-configuration")).String(), nil)
 	require.NoError(t, err)
 
-	resp, err := http.DefaultClient.Do(req)
+	client := &http.Client{}
+	resp, err := client.Do(req)
 	require.NoError(t, err)
 	_ = resp.Body.Close()
 
diff --git a/coderd/telemetry/telemetry.go b/coderd/telemetry/telemetry.go
index 8f203126c99ba..075083adaa96d 100644
--- a/coderd/telemetry/telemetry.go
+++ b/coderd/telemetry/telemetry.go
@@ -87,6 +87,7 @@ func New(options Options) (Reporter, error) {
 		deploymentURL: deploymentURL,
 		snapshotURL:   snapshotURL,
 		startedAt:     dbtime.Now(),
+		client:        &http.Client{},
 	}
 	go reporter.runSnapshotter()
 	return reporter, nil
@@ -119,6 +120,7 @@ type remoteReporter struct {
 	snapshotURL *url.URL
 	startedAt  time.Time
 	shutdownAt *time.Time
+	client     *http.Client
 }
 
 func (r *remoteReporter) Enabled() bool {
@@ -142,7 +144,7 @@ func (r *remoteReporter) reportSync(snapshot *Snapshot) {
 		return
 	}
 	req.Header.Set(VersionHeader, buildinfo.Version())
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := r.client.Do(req)
 	if err != nil {
 		// If the request fails it's not necessarily an error.
 		// In an airgapped environment, it's fine if this fails!
diff --git a/codersdk/agentsdk/agentsdk_test.go b/codersdk/agentsdk/agentsdk_test.go
index 4f3d7d838b524..b6646662a4536 100644
--- a/codersdk/agentsdk/agentsdk_test.go
+++ b/codersdk/agentsdk/agentsdk_test.go
@@ -42,7 +42,8 @@ func TestStreamAgentReinitEvents(t *testing.T) {
 		requestCtx := testutil.Context(t, testutil.WaitShort)
 		req, err := http.NewRequestWithContext(requestCtx, "GET", srv.URL, nil)
 		require.NoError(t, err)
-		resp, err := http.DefaultClient.Do(req)
+		client := &http.Client{}
+		resp, err := client.Do(req)
 		require.NoError(t, err)
 		defer resp.Body.Close()
 
@@ -77,7 +78,8 @@ func TestStreamAgentReinitEvents(t *testing.T) {
 		requestCtx := testutil.Context(t, testutil.WaitShort)
 		req, err := http.NewRequestWithContext(requestCtx, "GET", srv.URL, nil)
 		require.NoError(t, err)
-		resp, err := http.DefaultClient.Do(req)
+		client := &http.Client{}
+		resp, err := client.Do(req)
 		require.NoError(t, err)
 		defer resp.Body.Close()
 
@@ -110,7 +112,8 @@ func TestStreamAgentReinitEvents(t *testing.T) {
 		requestCtx := testutil.Context(t, testutil.WaitShort)
 		req, err := http.NewRequestWithContext(requestCtx, "GET", srv.URL, nil)
 		require.NoError(t, err)
-		resp, err := http.DefaultClient.Do(req)
+		client := &http.Client{}
+		resp, err := client.Do(req)
 		require.NoError(t, err)
 		defer resp.Body.Close()
 
diff --git a/enterprise/cli/provisionerdaemonstart_test.go b/enterprise/cli/provisionerdaemonstart_test.go
index 58603715f8184..884c3e6436e9e 100644
--- a/enterprise/cli/provisionerdaemonstart_test.go
+++ b/enterprise/cli/provisionerdaemonstart_test.go
@@ -495,6 +495,7 @@ func TestProvisionerDaemon_PrometheusEnabled(t *testing.T) {
 	// Fetch metrics from Prometheus endpoint
 	var req *http.Request
 	var res *http.Response
+	httpClient := &http.Client{}
 	require.Eventually(t, func() bool {
 		req, err = http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("http://127.0.0.1:%d", prometheusPort), nil)
 		if err != nil {
@@ -503,7 +504,7 @@ func TestProvisionerDaemon_PrometheusEnabled(t *testing.T) {
 		}
 
 		// nolint:bodyclose
-		res, err = http.DefaultClient.Do(req)
+		res, err = httpClient.Do(req)
 		if err != nil {
 			t.Logf("unable to call Prometheus endpoint: %s", err.Error())
 			return false
diff --git a/enterprise/cli/proxyserver_test.go b/enterprise/cli/proxyserver_test.go
index ae01f6ac9dda6..b8df3d2c6a072 100644
--- a/enterprise/cli/proxyserver_test.go
+++ b/enterprise/cli/proxyserver_test.go
@@ -114,11 +114,12 @@ func TestWorkspaceProxy_Server_PrometheusEnabled(t *testing.T) {
 
 	// Fetch metrics from Prometheus endpoint
 	var res *http.Response
+	client := &http.Client{}
 	require.Eventually(t, func() bool {
 		req, err := http.NewRequestWithContext(ctx, "GET", fmt.Sprintf("http://127.0.0.1:%d", prometheusPort), nil)
 		assert.NoError(t, err)
 		// nolint:bodyclose
-		res, err = http.DefaultClient.Do(req)
+		res, err = client.Do(req)
 		return err == nil
 	}, testutil.WaitShort, testutil.IntervalFast)
 	defer res.Body.Close()
diff --git a/enterprise/cli/server_test.go b/enterprise/cli/server_test.go
index 7489699a6f3dd..38001b701a9c1 100644
--- a/enterprise/cli/server_test.go
+++ b/enterprise/cli/server_test.go
@@ -43,13 +43,14 @@ func TestServer_Single(t *testing.T) {
 	)
 	clitest.Start(t, inv.WithContext(ctx))
 	accessURL := waitAccessURL(t, cfg)
+	client := &http.Client{}
 	require.Eventually(t, func() bool {
 		reqCtx := testutil.Context(t, testutil.IntervalMedium)
 		req, err := http.NewRequestWithContext(reqCtx, http.MethodGet, accessURL.String()+"/healthz", nil)
 		if err != nil {
 			panic(err)
 		}
-		resp, err := http.DefaultClient.Do(req)
+		resp, err := client.Do(req)
 		if err != nil {
 			t.Log("/healthz not ready yet")
 			return false
diff --git a/enterprise/coderd/coderd_test.go b/enterprise/coderd/coderd_test.go
index 302b367c304cd..860c4135e0c1e 100644
--- a/enterprise/coderd/coderd_test.go
+++ b/enterprise/coderd/coderd_test.go
@@ -595,6 +595,7 @@ func TestSCIMDisabled(t *testing.T) {
 		"/scim/v2/random/path/that/is/long.txt",
 	}
 
+	client := &http.Client{}
 	for _, p := range checkPaths {
 		t.Run(p, func(t *testing.T) {
 			t.Parallel()
@@ -605,7 +606,7 @@ func TestSCIMDisabled(t *testing.T) {
 			req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, u.String(), nil)
 			require.NoError(t, err)
 
-			resp, err := http.DefaultClient.Do(req)
+			resp, err := client.Do(req)
 			require.NoError(t, err)
 			defer resp.Body.Close()
 			require.Equal(t, http.StatusNotFound, resp.StatusCode)
diff --git a/enterprise/wsproxy/wsproxy_test.go b/enterprise/wsproxy/wsproxy_test.go
index 5d7eaada7f990..03245999350cd 100644
--- a/enterprise/wsproxy/wsproxy_test.go
+++ b/enterprise/wsproxy/wsproxy_test.go
@@ -689,12 +689,13 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		t.Log("all replicas have pinged")
 
 		// Check they're all healthy according to /healthz-report.
+		httpClient := &http.Client{}
 		for _, proxy := range proxies {
 			// GET /healthz-report
 			u := proxy.ServerURL.ResolveReference(&url.URL{Path: "/healthz-report"})
 			req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 			require.NoError(t, err)
-			resp, err := http.DefaultClient.Do(req)
+			resp, err := httpClient.Do(req)
 			require.NoError(t, err)
 
 			var respJSON codersdk.ProxyHealthReport
@@ -781,7 +782,8 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		u := proxy.ServerURL.ResolveReference(&url.URL{Path: "/healthz-report"})
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 		require.NoError(t, err)
-		resp, err := http.DefaultClient.Do(req)
+		httpClient := &http.Client{}
+		resp, err := httpClient.Do(req)
 		require.NoError(t, err)
 
 		var respJSON codersdk.ProxyHealthReport
@@ -869,7 +871,8 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		u := proxy.ServerURL.ResolveReference(&url.URL{Path: "/healthz-report"})
 		req, err := http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 		require.NoError(t, err)
-		resp, err := http.DefaultClient.Do(req)
+		httpClient := &http.Client{}
+		resp, err := httpClient.Do(req)
 		require.NoError(t, err)
 		var respJSON codersdk.ProxyHealthReport
 		err = json.NewDecoder(resp.Body).Decode(&respJSON)
@@ -903,7 +906,7 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		// GET /healthz-report
 		req, err = http.NewRequestWithContext(ctx, http.MethodGet, u.String(), nil)
 		require.NoError(t, err)
-		resp, err = http.DefaultClient.Do(req)
+		resp, err = httpClient.Do(req)
 		require.NoError(t, err)
 		err = json.NewDecoder(resp.Body).Decode(&respJSON)
 		resp.Body.Close()
diff --git a/enterprise/x/aibridged/aibridged_test.go b/enterprise/x/aibridged/aibridged_test.go
index 22210a00f34f3..32ef4870623ee 100644
--- a/enterprise/x/aibridged/aibridged_test.go
+++ b/enterprise/x/aibridged/aibridged_test.go
@@ -70,6 +70,7 @@ func TestServeHTTP_FailureModes(t *testing.T) {
 	t.Parallel()
 
 	defaultHeaders := map[string]string{"Authorization": "Bearer key"}
+	httpClient := &http.Client{}
 
 	cases := []struct {
 		name           string
@@ -155,7 +156,7 @@ func TestServeHTTP_FailureModes(t *testing.T) {
 				req.Header.Set(k, v)
 			}
 
-			resp, err := http.DefaultClient.Do(req)
+			resp, err := httpClient.Do(req)
 			t.Cleanup(func() {
 				if resp == nil || resp.Body == nil {
 					return
diff --git a/site/site_test.go b/site/site_test.go
index fa3c0809f22a7..36ec124ef8bc8 100644
--- a/site/site_test.go
+++ b/site/site_test.go
@@ -232,6 +232,7 @@ func TestServingFiles(t *testing.T) {
 		Database:  db,
 	}))
 	defer srv.Close()
+	client := &http.Client{}
 
 	// Create a context
 	ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitShort)
@@ -275,7 +276,7 @@ func TestServingFiles(t *testing.T) {
 
 		req, err := http.NewRequestWithContext(ctx, "GET", path, nil)
 		require.NoError(t, err)
-		resp, err := http.DefaultClient.Do(req)
+		resp, err := client.Do(req)
 		require.NoError(t, err, "get file")
 		data, _ := io.ReadAll(resp.Body)
 		require.Equal(t, string(data), testCase.expected, "Verify file: "+testCase.path)
@@ -521,6 +522,7 @@ func TestServingBin(t *testing.T) {
 			compressor := middleware.NewCompressor(1, "text/*", "application/*")
 			srv := httptest.NewServer(compressor.Handler(site))
 			defer srv.Close()
+			client := &http.Client{}
 
 			// Create a context
 			ctx, cancelFunc := context.WithTimeout(context.Background(), testutil.WaitShort)
@@ -538,7 +540,7 @@ func TestServingBin(t *testing.T) {
 						req.Header.Set("Accept-Encoding", "gzip")
 					}
 
-					resp, err := http.DefaultClient.Do(req)
+					resp, err := client.Do(req)
 					require.NoError(t, err, "http do failed")
 					defer resp.Body.Close()
 

From ffcb7a169379ea9d8b83fa39bd4a7f727b82ad0d Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Thu, 2 Oct 2025 19:54:07 +0100
Subject: [PATCH 045/298] fix(coderd): truncate task prompt to 160 characters
 in notifications (#20147)

Truncates the task prompt used in notifications to a maximum of 160
characters. The length of 160 characters was chosen arbitrarily.
---
 coderd/aitasks_test.go              | 29 +++++++++++++--
 coderd/util/strings/strings.go      | 55 +++++++++++++++++++++++++++--
 coderd/util/strings/strings_test.go | 47 +++++++++++++++++++-----
 coderd/workspaceagents.go           |  5 +++
 4 files changed, 123 insertions(+), 13 deletions(-)

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 20b33e9314da4..6425e06c771db 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -6,8 +6,10 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"strings"
 	"testing"
 	"time"
+	"unicode/utf8"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
@@ -977,6 +979,7 @@ func TestTasksNotification(t *testing.T) {
 		isAITask             bool
 		isNotificationSent   bool
 		notificationTemplate uuid.UUID
+		taskPrompt           string
 	}{
 		// Should not send a notification when the agent app is not an AI task.
 		{
@@ -985,6 +988,7 @@ func TestTasksNotification(t *testing.T) {
 			newAppStatus:       codersdk.WorkspaceAppStatusStateWorking,
 			isAITask:           false,
 			isNotificationSent: false,
+			taskPrompt:         "NoAITask",
 		},
 		// Should not send a notification when the new app status is neither 'Working' nor 'Idle'.
 		{
@@ -993,6 +997,7 @@ func TestTasksNotification(t *testing.T) {
 			newAppStatus:       codersdk.WorkspaceAppStatusStateComplete,
 			isAITask:           true,
 			isNotificationSent: false,
+			taskPrompt:         "NonNotifiedState",
 		},
 		// Should not send a notification when the new app status equals the latest status (Working).
 		{
@@ -1001,6 +1006,7 @@ func TestTasksNotification(t *testing.T) {
 			newAppStatus:       codersdk.WorkspaceAppStatusStateWorking,
 			isAITask:           true,
 			isNotificationSent: false,
+			taskPrompt:         "NonNotifiedTransition",
 		},
 		// Should send TemplateTaskWorking when the AI task transitions to 'Working'.
 		{
@@ -1010,6 +1016,7 @@ func TestTasksNotification(t *testing.T) {
 			isAITask:             true,
 			isNotificationSent:   true,
 			notificationTemplate: notifications.TemplateTaskWorking,
+			taskPrompt:           "TemplateTaskWorking",
 		},
 		// Should send TemplateTaskWorking when the AI task transitions to 'Working' from 'Idle'.
 		{
@@ -1022,6 +1029,7 @@ func TestTasksNotification(t *testing.T) {
 			isAITask:             true,
 			isNotificationSent:   true,
 			notificationTemplate: notifications.TemplateTaskWorking,
+			taskPrompt:           "TemplateTaskWorkingFromIdle",
 		},
 		// Should send TemplateTaskIdle when the AI task transitions to 'Idle'.
 		{
@@ -1031,6 +1039,17 @@ func TestTasksNotification(t *testing.T) {
 			isAITask:             true,
 			isNotificationSent:   true,
 			notificationTemplate: notifications.TemplateTaskIdle,
+			taskPrompt:           "TemplateTaskIdle",
+		},
+		// Long task prompts should be truncated to 160 characters.
+		{
+			name:                 "LongTaskPrompt",
+			latestAppStatuses:    []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateWorking},
+			newAppStatus:         codersdk.WorkspaceAppStatusStateIdle,
+			isAITask:             true,
+			isNotificationSent:   true,
+			notificationTemplate: notifications.TemplateTaskIdle,
+			taskPrompt:           "This is a very long task prompt that should be truncated to 160 characters. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.",
 		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
@@ -1067,7 +1086,7 @@ func TestTasksNotification(t *testing.T) {
 			}).Seed(workspaceBuildSeed).Params(database.WorkspaceBuildParameter{
 				WorkspaceBuildID: workspaceBuildID,
 				Name:             codersdk.AITaskPromptParameterName,
-				Value:            "task prompt",
+				Value:            tc.taskPrompt,
 			}).WithAgent(func(agent []*proto.Agent) []*proto.Agent {
 				agent[0].Apps = []*proto.App{{
 					Id:   workspaceAgentAppID.String(),
@@ -1115,7 +1134,13 @@ func TestTasksNotification(t *testing.T) {
 				require.Len(t, sent, 1)
 				require.Equal(t, memberUser.ID, sent[0].UserID)
 				require.Len(t, sent[0].Labels, 2)
-				require.Equal(t, "task prompt", sent[0].Labels["task"])
+				// NOTE: len(string) is the number of bytes in the string, not the number of runes.
+				require.LessOrEqual(t, utf8.RuneCountInString(sent[0].Labels["task"]), 160)
+				if len(tc.taskPrompt) > 160 {
+					require.Contains(t, tc.taskPrompt, strings.TrimSuffix(sent[0].Labels["task"], "…"))
+				} else {
+					require.Equal(t, tc.taskPrompt, sent[0].Labels["task"])
+				}
 				require.Equal(t, workspace.Name, sent[0].Labels["workspace"])
 			} else {
 				// Then: No notification is sent
diff --git a/coderd/util/strings/strings.go b/coderd/util/strings/strings.go
index 49aad579e83f5..e21908d488cd8 100644
--- a/coderd/util/strings/strings.go
+++ b/coderd/util/strings/strings.go
@@ -23,15 +23,64 @@ func JoinWithConjunction(s []string) string {
 	)
 }
 
-// Truncate returns the first n characters of s.
-func Truncate(s string, n int) string {
+type TruncateOption int
+
+func (o TruncateOption) String() string {
+	switch o {
+	case TruncateWithEllipsis:
+		return "TruncateWithEllipsis"
+	case TruncateWithFullWords:
+		return "TruncateWithFullWords"
+	default:
+		return fmt.Sprintf("TruncateOption(%d)", o)
+	}
+}
+
+const (
+	// TruncateWithEllipsis adds a Unicode ellipsis character to the end of the string.
+	TruncateWithEllipsis TruncateOption = 1 << 0
+	// TruncateWithFullWords ensures that words are not split in the middle.
+	// As a special case, if there is no word boundary, the string is truncated.
+	TruncateWithFullWords TruncateOption = 1 << 1
+)
+
+// Truncate truncates s to n characters.
+// Additional behaviors can be specified using TruncateOptions.
+func Truncate(s string, n int, opts ...TruncateOption) string {
+	var options TruncateOption
+	for _, opt := range opts {
+		options |= opt
+	}
 	if n < 1 {
 		return ""
 	}
 	if len(s) <= n {
 		return s
 	}
-	return s[:n]
+
+	maxLen := n
+	if options&TruncateWithEllipsis != 0 {
+		maxLen--
+	}
+	var sb strings.Builder
+	// If we need to truncate to full words, find the last word boundary before n.
+	if options&TruncateWithFullWords != 0 {
+		lastWordBoundary := strings.LastIndexFunc(s[:maxLen], unicode.IsSpace)
+		if lastWordBoundary < 0 {
+			// We cannot find a word boundary. At this point, we'll truncate the string.
+			// It's better than nothing.
+			_, _ = sb.WriteString(s[:maxLen])
+		} else { // lastWordBoundary <= maxLen
+			_, _ = sb.WriteString(s[:lastWordBoundary])
+		}
+	} else {
+		_, _ = sb.WriteString(s[:maxLen])
+	}
+
+	if options&TruncateWithEllipsis != 0 {
+		_, _ = sb.WriteString("…")
+	}
+	return sb.String()
 }
 
 var bmPolicy = bluemonday.StrictPolicy()
diff --git a/coderd/util/strings/strings_test.go b/coderd/util/strings/strings_test.go
index 7a20a06a25f28..000fa9efa11e5 100644
--- a/coderd/util/strings/strings_test.go
+++ b/coderd/util/strings/strings_test.go
@@ -1,6 +1,7 @@
 package strings_test
 
 import (
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
@@ -23,17 +24,47 @@ func TestTruncate(t *testing.T) {
 		s        string
 		n        int
 		expected string
+		options  []strings.TruncateOption
 	}{
-		{"foo", 4, "foo"},
-		{"foo", 3, "foo"},
-		{"foo", 2, "fo"},
-		{"foo", 1, "f"},
-		{"foo", 0, ""},
-		{"foo", -1, ""},
+		{"foo", 4, "foo", nil},
+		{"foo", 3, "foo", nil},
+		{"foo", 2, "fo", nil},
+		{"foo", 1, "f", nil},
+		{"foo", 0, "", nil},
+		{"foo", -1, "", nil},
+		{"foo bar", 7, "foo bar", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 6, "foo b…", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 5, "foo …", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 4, "foo…", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 3, "fo…", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 2, "f…", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 1, "…", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 0, "", []strings.TruncateOption{strings.TruncateWithEllipsis}},
+		{"foo bar", 7, "foo bar", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 6, "foo", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 5, "foo", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 4, "foo", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 3, "foo", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 2, "fo", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 1, "f", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 0, "", []strings.TruncateOption{strings.TruncateWithFullWords}},
+		{"foo bar", 7, "foo bar", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 6, "foo…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 5, "foo…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 4, "foo…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 3, "fo…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 2, "f…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 1, "…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"foo bar", 0, "", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
+		{"This is a very long task prompt that should be truncated to 160 characters. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.", 160, "This is a very long task prompt that should be truncated to 160 characters. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor…", []strings.TruncateOption{strings.TruncateWithFullWords, strings.TruncateWithEllipsis}},
 	} {
-		t.Run(tt.expected, func(t *testing.T) {
+		tName := fmt.Sprintf("%s_%d", tt.s, tt.n)
+		for _, opt := range tt.options {
+			tName += fmt.Sprintf("_%v", opt)
+		}
+		t.Run(tName, func(t *testing.T) {
 			t.Parallel()
-			actual := strings.Truncate(tt.s, tt.n)
+			actual := strings.Truncate(tt.s, tt.n, tt.options...)
 			require.Equal(t, tt.expected, actual)
 		})
 	}
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
index eddd6510b634b..0e6d0430e3642 100644
--- a/coderd/workspaceagents.go
+++ b/coderd/workspaceagents.go
@@ -484,6 +484,11 @@ func (api *API) enqueueAITaskStateNotification(
 			}
 		}
 
+		// As task prompt may be particularly long, truncate it to 160 characters for notifications.
+		if len(taskName) > 160 {
+			taskName = strutil.Truncate(taskName, 160, strutil.TruncateWithEllipsis, strutil.TruncateWithFullWords)
+		}
+
 		if _, err := api.NotificationsEnqueuer.EnqueueWithData(
 			// nolint:gocritic // Need notifier actor to enqueue notifications
 			dbauthz.AsNotifier(ctx),

From 039fa894814fd95923e44988a4e6fb7c820390d6 Mon Sep 17 00:00:00 2001
From: yyefimov <m4euge@gmail.com>
Date: Thu, 2 Oct 2025 22:08:15 -0400
Subject: [PATCH 046/298] fix(coderd): correct the name of the unmarshall error
 variable (#20150)

Incorrect error variable is used during reporting of the issue during
unmarshall operations and this makes it hard to understand the
underlying reason for OIDC failure: use `unmarshalError` instead of
`err`.
---
 coderd/oauthpki/oidcpki.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/coderd/oauthpki/oidcpki.go b/coderd/oauthpki/oidcpki.go
index d761c43e446ff..fa1c3854af1dd 100644
--- a/coderd/oauthpki/oidcpki.go
+++ b/coderd/oauthpki/oidcpki.go
@@ -247,7 +247,7 @@ func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
 	}
 
 	if unmarshalError != nil {
-		return nil, xerrors.Errorf("oauth2: cannot unmarshal token: %w", err)
+		return nil, xerrors.Errorf("oauth2: cannot unmarshal token: %w", unmarshalError)
 	}
 
 	newToken := &oauth2.Token{

From 091b5c88d66d4e111209d39c79e005bfda4532db Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 3 Oct 2025 09:24:55 +0100
Subject: [PATCH 047/298] =?UTF-8?q?ci(.github/workflows/traiage.yaml):=20a?=
 =?UTF-8?q?djust=20prompt=20for=20legibility=20when=E2=80=A6=20(#20144)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

… truncated, just like this
---
 .github/workflows/traiage.yaml | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 30eeb5cb8bb48..483673d2ba798 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -203,11 +203,10 @@ jobs:
 
           # Write a prompt to PROMPT_FILE
           PROMPT=$(cat <<EOF
-          Analyze the below GitHub issue description, understand the root cause, and make appropriate changes to resolve the issue.
-
-          ISSUE URL: ${ISSUE_URL}
-          ISSUE DESCRIPTION BELOW:
+          Fix ${ISSUE_URL}
 
+          Analyze the below GitHub issue description, understand the root cause, and make appropriate changes to resolve the issue.
+          ---
           ${issue_description}
           EOF
           )

From 2880582cc921c27f192f37607eb737cbfbb2eb75 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 3 Oct 2025 10:01:08 +0100
Subject: [PATCH 048/298] ci(.github/workflows/traiage.yaml): remove extraneous
 cleanup steps (#20154)

---
 .github/workflows/traiage.yaml | 69 ----------------------------------
 1 file changed, 69 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 483673d2ba798..15adf78242686 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -25,11 +25,6 @@ on:
         required: false
         default: "traiage"
         type: string
-      cleanup:
-        description: "Cleanup workspace after triage."
-        required: false
-        default: false
-        type: boolean
 
 jobs:
   traiage:
@@ -70,7 +65,6 @@ jobs:
           GITHUB_EVENT_NAME: ${{ github.event_name }}
           GITHUB_EVENT_USER_ID: ${{ github.event.sender.id }}
           GITHUB_EVENT_USER_LOGIN: ${{ github.event.sender.login }}
-          INPUTS_CLEANUP: ${{ inputs.cleanup || false }}
           INPUTS_ISSUE_URL: ${{ inputs.issue_url }}
           INPUTS_TEMPLATE_NAME: ${{ inputs.template_name || 'traiage' }}
           INPUTS_TEMPLATE_PRESET: ${{ inputs.template_preset || 'Default'}}
@@ -86,9 +80,6 @@ jobs:
           echo "Using prefix: ${INPUTS_PREFIX}"
           echo "prefix=${INPUTS_PREFIX}" >> "${GITHUB_OUTPUT}"
 
-          echo "Using cleanup: ${INPUTS_CLEANUP}"
-          echo "cleanup=${INPUTS_CLEANUP}" >> "${GITHUB_OUTPUT}"
-
           # For workflow_dispatch, use the actor who triggered it
           # For issues events, use the issue author.
           if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
@@ -222,63 +213,3 @@ jobs:
           fi
           echo "TASK_NAME=${CODER_USERNAME}/${TASK_NAME}" >> "${GITHUB_OUTPUT}"
           echo "TASK_NAME=${CODER_USERNAME}/${TASK_NAME}" >> "${GITHUB_ENV}"
-
-      - name: Create and upload archive
-        id: create-archive
-        if: steps.determine-inputs.outputs.cleanup == 'true'
-        env:
-          BUCKET_PREFIX: "gs://coder-traiage-outputs/traiage"
-          CODER_USERNAME: ${{ steps.get-coder-username.outputs.coder_username }}
-          TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}
-        run: |
-          echo "Waiting for task to complete..."
-          coder exp task status "${TASK_NAME}" --watch
-          echo "Creating archive for workspace: ${TASK_NAME}"
-          ./scripts/traiage.sh archive
-          echo "archive_url=${BUCKET_PREFIX%%/}/$TASK_NAME.tar.gz" >> "${GITHUB_OUTPUT}"
-
-      - name: Generate a summary of the changes and post a comment on GitHub.
-        id: generate-summary
-        if: steps.determine-inputs.outputs.cleanup == 'true'
-        env:
-          ARCHIVE_URL: ${{ steps.create-archive.outputs.archive_url }}
-          BUCKET_PREFIX: "gs://coder-traiage-outputs/traiage"
-          CODER_USERNAME: ${{ steps.get-coder-username.outputs.coder_username }}
-          CONTEXT_KEY: ${{ steps.extract-context.outputs.context_key }}
-          GH_TOKEN: ${{ github.token }}
-          GITHUB_REPOSITORY: ${{ github.repository }}
-          ISSUE_URL: ${{ steps.determine-inputs.outputs.issue_url }}
-          TASK_NAME: ${{ steps.create-task.outputs.TASK_NAME }}
-        run: |
-          SUMMARY_FILE=$(mktemp)
-          trap 'rm -f "${SUMMARY_FILE}"' EXIT
-          AUTO_SUMMARY=$(./scripts/traiage.sh summary)
-          {
-            echo "## TrAIage Results"
-            echo "- **Issue URL:** ${ISSUE_URL}"
-            echo "- **Context Key:** ${CONTEXT_KEY}"
-            echo "- **Workspace:** ${TASK_NAME}"
-            echo "- **Archive URL:** ${ARCHIVE_URL}"
-            echo
-            echo "${AUTO_SUMMARY}"
-            echo
-            echo "To fetch the output to your own workspace:"
-            echo
-            echo '```bash'
-            echo "BUCKET_PREFIX=${BUCKET_PREFIX} TASK_NAME=${TASK_NAME} ./scripts/traiage.sh resume"
-            echo '```'
-            echo
-          } >> "${SUMMARY_FILE}"
-
-          if [[ "${ISSUE_URL}" == "https://github.com/${GITHUB_REPOSITORY}"* ]]; then
-            gh issue comment "${ISSUE_URL}" --body-file "${SUMMARY_FILE}" --create-if-none --edit-last
-          else
-            echo "Skipping comment on other repo."
-          fi
-          cat "${SUMMARY_FILE}" >> "${GITHUB_STEP_SUMMARY}"
-
-      - name: Cleanup task
-        if: steps.determine-inputs.outputs.cleanup == 'true' && steps.create-task.outputs.TASK_NAME != '' && steps.create-archive.outputs.archive_url != ''
-        run: |
-          echo "Cleaning up task: $TASK_NAME"
-          ./scripts/traiage.sh delete || true

From e1619daacc95f00b8bd181f993f62fbc4fa3a27a Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 3 Oct 2025 10:17:43 +0100
Subject: [PATCH 049/298] chore(coderd): update aitasks.go to leverage
 agentapi-sdk-go (#20159)

I only recently became aware of the existence of `agentapi-sdk-go`.
Updates `aitasks.go` to make use of it.
---
 coderd/aitasks.go | 168 ++++++++--------------------------------------
 1 file changed, 27 insertions(+), 141 deletions(-)

diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 31600c69443b4..275cfe855621e 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -1,17 +1,13 @@
 package coderd
 
 import (
-	"bytes"
 	"context"
 	"database/sql"
-	"encoding/json"
 	"errors"
 	"fmt"
-	"io"
 	"net"
 	"net/http"
 	"net/url"
-	"path"
 	"slices"
 	"strings"
 	"time"
@@ -31,6 +27,8 @@ import (
 	"github.com/coder/coder/v2/coderd/taskname"
 	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
+
+	aiagentapi "github.com/coder/agentapi-sdk-go"
 )
 
 // This endpoint is experimental and not guaranteed to be stable, so we're not
@@ -629,61 +627,37 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 	}
 
 	if err = api.authAndDoWithTaskSidebarAppClient(r, taskID, func(ctx context.Context, client *http.Client, appURL *url.URL) error {
-		status, err := agentapiDoStatusRequest(ctx, client, appURL)
+		agentAPIClient, err := aiagentapi.NewClient(appURL.String(), aiagentapi.WithHTTPClient(client))
 		if err != nil {
-			return err
-		}
-
-		if status != "stable" {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Task app is not ready to accept input.",
-				Detail:  fmt.Sprintf("Status: %s", status),
+				Message: "Failed to create agentapi client.",
+				Detail:  err.Error(),
 			})
 		}
 
-		var reqBody struct {
-			Content string `json:"content"`
-			Type    string `json:"type"`
-		}
-		reqBody.Content = req.Input
-		reqBody.Type = "user"
-
-		req, err := agentapiNewRequest(ctx, http.MethodPost, appURL, "message", reqBody)
-		if err != nil {
-			return err
-		}
-
-		resp, err := client.Do(req)
+		statusResp, err := agentAPIClient.GetStatus(ctx)
 		if err != nil {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Failed to reach task app endpoint.",
+				Message: "Failed to get status from task app.",
 				Detail:  err.Error(),
 			})
 		}
-		defer resp.Body.Close()
-
-		if resp.StatusCode != http.StatusOK {
-			body, _ := io.ReadAll(io.LimitReader(resp.Body, 128))
-			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Task app rejected the message.",
-				Detail:  fmt.Sprintf("Upstream status: %d; Body: %s", resp.StatusCode, body),
-			})
-		}
 
-		// {"$schema":"http://localhost:3284/schemas/MessageResponseBody.json","ok":true}
-		// {"$schema":"http://localhost:3284/schemas/ErrorModel.json","title":"Unprocessable Entity","status":422,"detail":"validation failed","errors":[{"location":"body.type","value":"oof"}]}
-		var respBody map[string]any
-		if err := json.NewDecoder(resp.Body).Decode(&respBody); err != nil {
+		if statusResp.Status != aiagentapi.StatusStable {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Failed to decode task app response body.",
-				Detail:  err.Error(),
+				Message: "Task app is not ready to accept input.",
+				Detail:  fmt.Sprintf("Status: %s", statusResp.Status),
 			})
 		}
 
-		if v, ok := respBody["ok"].(bool); !ok || !v {
+		_, err = agentAPIClient.PostMessage(ctx, aiagentapi.PostMessageParams{
+			Content: req.Input,
+			Type:    aiagentapi.MessageTypeUser,
+		})
+		if err != nil {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
 				Message: "Task app rejected the message.",
-				Detail:  fmt.Sprintf("Upstream response: %v", respBody),
+				Detail:  err.Error(),
 			})
 		}
 
@@ -710,51 +684,29 @@ func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 
 	var out codersdk.TaskLogsResponse
 	if err := api.authAndDoWithTaskSidebarAppClient(r, taskID, func(ctx context.Context, client *http.Client, appURL *url.URL) error {
-		req, err := agentapiNewRequest(ctx, http.MethodGet, appURL, "messages", nil)
-		if err != nil {
-			return err
-		}
-
-		resp, err := client.Do(req)
+		agentAPIClient, err := aiagentapi.NewClient(appURL.String(), aiagentapi.WithHTTPClient(client))
 		if err != nil {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Failed to reach task app endpoint.",
+				Message: "Failed to create agentapi client.",
 				Detail:  err.Error(),
 			})
 		}
-		defer resp.Body.Close()
-
-		if resp.StatusCode != http.StatusOK {
-			body, _ := io.ReadAll(io.LimitReader(resp.Body, 128))
-			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Task app rejected the request.",
-				Detail:  fmt.Sprintf("Upstream status: %d; Body: %s", resp.StatusCode, body),
-			})
-		}
 
-		// {"$schema":"http://localhost:3284/schemas/MessagesResponseBody.json","messages":[]}
-		var respBody struct {
-			Messages []struct {
-				ID      int       `json:"id"`
-				Content string    `json:"content"`
-				Role    string    `json:"role"`
-				Time    time.Time `json:"time"`
-			} `json:"messages"`
-		}
-		if err := json.NewDecoder(resp.Body).Decode(&respBody); err != nil {
+		messagesResp, err := agentAPIClient.GetMessages(ctx)
+		if err != nil {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-				Message: "Failed to decode task app response body.",
+				Message: "Failed to get messages from task app.",
 				Detail:  err.Error(),
 			})
 		}
 
-		logs := make([]codersdk.TaskLogEntry, 0, len(respBody.Messages))
-		for _, m := range respBody.Messages {
+		logs := make([]codersdk.TaskLogEntry, 0, len(messagesResp.Messages))
+		for _, m := range messagesResp.Messages {
 			var typ codersdk.TaskLogType
-			switch strings.ToLower(m.Role) {
-			case "user":
+			switch m.Role {
+			case aiagentapi.RoleUser:
 				typ = codersdk.TaskLogTypeInput
-			case "agent":
+			case aiagentapi.RoleAgent:
 				typ = codersdk.TaskLogTypeOutput
 			default:
 				return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
@@ -763,7 +715,7 @@ func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 				})
 			}
 			logs = append(logs, codersdk.TaskLogEntry{
-				ID:      m.ID,
+				ID:      int(m.Id),
 				Content: m.Content,
 				Type:    typ,
 				Time:    m.Time,
@@ -903,69 +855,3 @@ func (api *API) authAndDoWithTaskSidebarAppClient(
 	}
 	return do(ctx, client, parsedURL)
 }
-
-func agentapiNewRequest(ctx context.Context, method string, appURL *url.URL, appURLPath string, body any) (*http.Request, error) {
-	u := *appURL
-	u.Path = path.Join(appURL.Path, appURLPath)
-
-	var bodyReader io.Reader
-	if body != nil {
-		b, err := json.Marshal(body)
-		if err != nil {
-			return nil, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
-				Message: "Failed to marshal task app request body.",
-				Detail:  err.Error(),
-			})
-		}
-		bodyReader = bytes.NewReader(b)
-	}
-
-	req, err := http.NewRequestWithContext(ctx, method, u.String(), bodyReader)
-	if err != nil {
-		return nil, httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
-			Message: "Failed to create task app request.",
-			Detail:  err.Error(),
-		})
-	}
-	req.Header.Set("Content-Type", "application/json")
-	req.Header.Set("Accept", "application/json")
-
-	return req, nil
-}
-
-func agentapiDoStatusRequest(ctx context.Context, client *http.Client, appURL *url.URL) (string, error) {
-	req, err := agentapiNewRequest(ctx, http.MethodGet, appURL, "status", nil)
-	if err != nil {
-		return "", err
-	}
-
-	resp, err := client.Do(req)
-	if err != nil {
-		return "", httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-			Message: "Failed to reach task app endpoint.",
-			Detail:  err.Error(),
-		})
-	}
-	defer resp.Body.Close()
-
-	if resp.StatusCode != http.StatusOK {
-		return "", httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-			Message: "Task app status returned an error.",
-			Detail:  fmt.Sprintf("Status code: %d", resp.StatusCode),
-		})
-	}
-
-	// {"$schema":"http://localhost:3284/schemas/StatusResponseBody.json","status":"stable"}
-	var respBody struct {
-		Status string `json:"status"`
-	}
-
-	if err := json.NewDecoder(resp.Body).Decode(&respBody); err != nil {
-		return "", httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
-			Message: "Failed to decode task app status response body.",
-			Detail:  err.Error(),
-		})
-	}
-
-	return respBody.Status, nil
-}

From 2b4485575c1c095430a4f2a877cc6a37e5c25cf3 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Fri, 3 Oct 2025 20:50:21 +1000
Subject: [PATCH 050/298] feat(scaletest): add `autostart` scaletest command
 (#20161)

Closes https://github.com/coder/internal/issues/911
---
 cli/exp_scaletest.go       | 235 +++++++++++++++++++++++++++++++++++++
 scaletest/autostart/run.go |   1 +
 2 files changed, 236 insertions(+)

diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index 4a8852cf8a4fc..e6a3993035512 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -33,6 +33,7 @@ import (
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
 	"github.com/coder/coder/v2/scaletest/agentconn"
+	"github.com/coder/coder/v2/scaletest/autostart"
 	"github.com/coder/coder/v2/scaletest/createusers"
 	"github.com/coder/coder/v2/scaletest/createworkspaces"
 	"github.com/coder/coder/v2/scaletest/dashboard"
@@ -60,6 +61,7 @@ func (r *RootCmd) scaletestCmd() *serpent.Command {
 			r.scaletestCreateWorkspaces(),
 			r.scaletestWorkspaceUpdates(),
 			r.scaletestWorkspaceTraffic(),
+			r.scaletestAutostart(),
 		},
 	}
 
@@ -1682,6 +1684,239 @@ func (r *RootCmd) scaletestDashboard() *serpent.Command {
 	return cmd
 }
 
+const (
+	autostartTestName = "autostart"
+)
+
+func (r *RootCmd) scaletestAutostart() *serpent.Command {
+	var (
+		workspaceCount      int64
+		workspaceJobTimeout time.Duration
+		autostartDelay      time.Duration
+		autostartTimeout    time.Duration
+		template            string
+		noCleanup           bool
+
+		parameterFlags  workspaceParameterFlags
+		tracingFlags    = &scaletestTracingFlags{}
+		timeoutStrategy = &timeoutFlags{}
+		cleanupStrategy = newScaletestCleanupStrategy()
+		output          = &scaletestOutputFlags{}
+		prometheusFlags = &scaletestPrometheusFlags{}
+	)
+
+	cmd := &serpent.Command{
+		Use:   "autostart",
+		Short: "Replicate a thundering herd of autostarting workspaces",
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return err
+			}
+
+			notifyCtx, stop := signal.NotifyContext(ctx, StopSignals...) // Checked later.
+			defer stop()
+			ctx = notifyCtx
+
+			me, err := requireAdmin(ctx, client)
+			if err != nil {
+				return err
+			}
+
+			client.HTTPClient = &http.Client{
+				Transport: &codersdk.HeaderTransport{
+					Transport: http.DefaultTransport,
+					Header: map[string][]string{
+						codersdk.BypassRatelimitHeader: {"true"},
+					},
+				},
+			}
+
+			if workspaceCount <= 0 {
+				return xerrors.Errorf("--workspace-count must be greater than zero")
+			}
+
+			outputs, err := output.parse()
+			if err != nil {
+				return xerrors.Errorf("could not parse --output flags")
+			}
+
+			tpl, err := parseTemplate(ctx, client, me.OrganizationIDs, template)
+			if err != nil {
+				return xerrors.Errorf("parse template: %w", err)
+			}
+
+			cliRichParameters, err := asWorkspaceBuildParameters(parameterFlags.richParameters)
+			if err != nil {
+				return xerrors.Errorf("can't parse given parameter values: %w", err)
+			}
+
+			richParameters, err := prepWorkspaceBuild(inv, client, prepWorkspaceBuildArgs{
+				Action:            WorkspaceCreate,
+				TemplateVersionID: tpl.ActiveVersionID,
+
+				RichParameterFile: parameterFlags.richParameterFile,
+				RichParameters:    cliRichParameters,
+			})
+			if err != nil {
+				return xerrors.Errorf("prepare build: %w", err)
+			}
+
+			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
+			if err != nil {
+				return xerrors.Errorf("create tracer provider: %w", err)
+			}
+			tracer := tracerProvider.Tracer(scaletestTracerName)
+
+			reg := prometheus.NewRegistry()
+			metrics := autostart.NewMetrics(reg)
+
+			setupBarrier := new(sync.WaitGroup)
+			setupBarrier.Add(int(workspaceCount))
+
+			th := harness.NewTestHarness(timeoutStrategy.wrapStrategy(harness.ConcurrentExecutionStrategy{}), cleanupStrategy.toStrategy())
+			for i := range workspaceCount {
+				id := strconv.Itoa(int(i))
+				config := autostart.Config{
+					User: createusers.Config{
+						OrganizationID: me.OrganizationIDs[0],
+					},
+					Workspace: workspacebuild.Config{
+						OrganizationID: me.OrganizationIDs[0],
+						Request: codersdk.CreateWorkspaceRequest{
+							TemplateID:          tpl.ID,
+							RichParameterValues: richParameters,
+						},
+					},
+					WorkspaceJobTimeout: workspaceJobTimeout,
+					AutostartDelay:      autostartDelay,
+					AutostartTimeout:    autostartTimeout,
+					Metrics:             metrics,
+					SetupBarrier:        setupBarrier,
+				}
+				if err := config.Validate(); err != nil {
+					return xerrors.Errorf("validate config: %w", err)
+				}
+				var runner harness.Runnable = autostart.NewRunner(client, config)
+				if tracingEnabled {
+					runner = &runnableTraceWrapper{
+						tracer:   tracer,
+						spanName: fmt.Sprintf("%s/%s", autostartTestName, id),
+						runner:   runner,
+					}
+				}
+				th.AddRun(autostartTestName, id, runner)
+			}
+
+			logger := inv.Logger
+			prometheusSrvClose := ServeHandler(ctx, logger, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}), prometheusFlags.Address, "prometheus")
+			defer prometheusSrvClose()
+
+			defer func() {
+				_, _ = fmt.Fprintln(inv.Stderr, "\nUploading traces...")
+				if err := closeTracing(ctx); err != nil {
+					_, _ = fmt.Fprintf(inv.Stderr, "\nError uploading traces: %+v\n", err)
+				}
+				// Wait for prometheus metrics to be scraped
+				_, _ = fmt.Fprintf(inv.Stderr, "Waiting %s for prometheus metrics to be scraped\n", prometheusFlags.Wait)
+				<-time.After(prometheusFlags.Wait)
+			}()
+
+			_, _ = fmt.Fprintln(inv.Stderr, "Running autostart load test...")
+			testCtx, testCancel := timeoutStrategy.toContext(ctx)
+			defer testCancel()
+			err = th.Run(testCtx)
+			if err != nil {
+				return xerrors.Errorf("run test harness (harness failure, not a test failure): %w", err)
+			}
+
+			// If the command was interrupted, skip stats.
+			if notifyCtx.Err() != nil {
+				return notifyCtx.Err()
+			}
+
+			res := th.Results()
+			for _, o := range outputs {
+				err = o.write(res, inv.Stdout)
+				if err != nil {
+					return xerrors.Errorf("write output %q to %q: %w", o.format, o.path, err)
+				}
+			}
+
+			if !noCleanup {
+				_, _ = fmt.Fprintln(inv.Stderr, "\nCleaning up...")
+				cleanupCtx, cleanupCancel := cleanupStrategy.toContext(ctx)
+				defer cleanupCancel()
+				err = th.Cleanup(cleanupCtx)
+				if err != nil {
+					return xerrors.Errorf("cleanup tests: %w", err)
+				}
+			}
+
+			if res.TotalFail > 0 {
+				return xerrors.New("load test failed, see above for more details")
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Options = serpent.OptionSet{
+		{
+			Flag:          "workspace-count",
+			FlagShorthand: "c",
+			Env:           "CODER_SCALETEST_WORKSPACE_COUNT",
+			Description:   "Required: Total number of workspaces to create.",
+			Value:         serpent.Int64Of(&workspaceCount),
+			Required:      true,
+		},
+		{
+			Flag:        "workspace-job-timeout",
+			Env:         "CODER_SCALETEST_WORKSPACE_JOB_TIMEOUT",
+			Default:     "5m",
+			Description: "Timeout for workspace jobs (e.g. build, start).",
+			Value:       serpent.DurationOf(&workspaceJobTimeout),
+		},
+		{
+			Flag:        "autostart-delay",
+			Env:         "CODER_SCALETEST_AUTOSTART_DELAY",
+			Default:     "2m",
+			Description: "How long after all the workspaces have been stopped to schedule them to be started again.",
+			Value:       serpent.DurationOf(&autostartDelay),
+		},
+		{
+			Flag:        "autostart-timeout",
+			Env:         "CODER_SCALETEST_AUTOSTART_TIMEOUT",
+			Default:     "5m",
+			Description: "Timeout for the autostart build to be initiated after the scheduled start time.",
+			Value:       serpent.DurationOf(&autostartTimeout),
+		},
+		{
+			Flag:          "template",
+			FlagShorthand: "t",
+			Env:           "CODER_SCALETEST_TEMPLATE",
+			Description:   "Required: Name or ID of the template to use for workspaces.",
+			Value:         serpent.StringOf(&template),
+			Required:      true,
+		},
+		{
+			Flag:        "no-cleanup",
+			Env:         "CODER_SCALETEST_NO_CLEANUP",
+			Description: "Do not clean up resources after the test completes.",
+			Value:       serpent.BoolOf(&noCleanup),
+		},
+	}
+
+	cmd.Options = append(cmd.Options, parameterFlags.cliParameters()...)
+	tracingFlags.attach(&cmd.Options)
+	timeoutStrategy.attach(&cmd.Options)
+	cleanupStrategy.attach(&cmd.Options)
+	output.attach(&cmd.Options)
+	prometheusFlags.attach(&cmd.Options)
+	return cmd
+}
+
 type runnableTraceWrapper struct {
 	tracer   trace.Tracer
 	spanName string
diff --git a/scaletest/autostart/run.go b/scaletest/autostart/run.go
index 59f50a04dd837..c37d843ad95c2 100644
--- a/scaletest/autostart/run.go
+++ b/scaletest/autostart/run.go
@@ -80,6 +80,7 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 	workspaceBuildConfig.UserID = newUser.ID.String()
 	// We'll wait for the build ourselves to avoid multiple API requests
 	workspaceBuildConfig.NoWaitForBuild = true
+	workspaceBuildConfig.NoWaitForAgents = true
 
 	r.workspacebuildRunner = workspacebuild.NewRunner(newUserClient, workspaceBuildConfig)
 	workspace, err := r.workspacebuildRunner.RunReturningWorkspace(ctx, id, logs)

From a36078519952e4fcf20dfd0ca9d8e2777e9e3650 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 3 Oct 2025 15:04:20 +0100
Subject: [PATCH 051/298] ci(.github/workflows/traiage.yaml): check instead for
 push access to repo (#20163)

---
 .github/workflows/traiage.yaml | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 15adf78242686..566cfc78419bc 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -110,20 +110,19 @@ jobs:
             exit 1
           fi
 
-      - name: Verify organization membership
+      - name: Verify push access
         env:
-          GITHUB_ORG: ${{ github.repository_owner }}
+          GITHUB_REPOSITORY: ${{ github.repository }}
           GH_TOKEN: ${{ github.token }}
           GITHUB_USERNAME: ${{ steps.determine-inputs.outputs.github_username }}
           GITHUB_USER_ID: ${{ steps.determine-inputs.outputs.github_user_id }}
         run: |
-          # Check if the actor is a member of the organization
-          if ! gh api "orgs/${GITHUB_ORG}/members/${GITHUB_USERNAME}" --silent 2>/dev/null; then
-            echo "::error title=Access Denied::User ${GITHUB_USERNAME} is not a member of the ${GITHUB_ORG} organization"
-            echo "::error::You must be a member of the ${GITHUB_ORG} GitHub organization to run this workflow."
+          # Query the actor’s permission on this repo
+          can_push="$(gh api "/repos/${GITHUB_REPOSITORY}/collaborators/${GITHUB_USERNAME}/permission" --jq '.user.permissions.push')"
+          if [[ "${can_push}" != "true" ]]; then
+            echo "::error title=Access Denied::${GITHUB_USERNAME} does not have push access to ${GITHUB_REPOSITORY}"
             exit 1
           fi
-          echo "::notice::User ${GITHUB_USERNAME} verified as member of ${GITHUB_ORG} organization"
 
       - name: Extract context key from issue
         id: extract-context

From bb5884467d7cc441945a8fa9f5334c9b3f9620fd Mon Sep 17 00:00:00 2001
From: Rafael Rodriguez <rafael@coder.com>
Date: Fri, 3 Oct 2025 10:20:06 -0500
Subject: [PATCH 052/298] feat(cli): prompt for missing required template
 variables on template creation (#19973)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

In this pull request we're adding support in the CLI for prompting the
user for any missing required template variables in the `coder templates
push` command and automatically retrying the template build once a user
has provided any missing variable values.

Closes: https://github.com/coder/coder/issues/19782

### Demo

In the following recording I created a simple template terraform file
that used different variable types (string, number, boolean, and
sensitive) and prompted the user to enter a value for each variable.

<details>
<summary>See example template terraform file</summary>

```tf
...

# Required variables for testing interactive prompting
variable "docker_image" {
  description = "Docker image to use for the workspace"
  type        = string
}

variable "workspace_name" {
  description = "Name of the workspace"
  type        = string
}

variable "cpu_limit" {
  description = "CPU limit for the container (number of cores)"
  type        = number
}

variable "enable_gpu" {
  description = "Enable GPU access for the container"
  type        = bool
}

variable "api_key" {
  description = "API key for external services (sensitive)"
  type        = string
  sensitive   = true
}

# Optional variable with default
variable "docker_socket" {
  default     = "/var/run/docker.sock"
  description = "Docker socket path"
  type        = string
}

...
```

</details>

Once the user entered a valid value for each variable, the template
build would be retried.


https://github.com/user-attachments/assets/770cf954-3cbc-4464-925e-2be4e32a97de

<details>
<summary>See output from recording</summary>

```shell
$ ./scripts/coder-dev.sh templates push test-required-params -d examples/templates/test-required-params/
INFO : Overriding codersdk.SessionTokenCookie as we are developing inside a Coder workspace.
/home/coder/coder/build/coder-slim_2.26.0-devel+a68122ca3_linux_amd64
Provisioner tags:  <none>
WARN: No .terraform.lock.hcl file found
  | When provisioning, Coder will be unable to cache providers without a lockfile and must download them from the internet each time.
  | Create one by running  terraform init  in your template directory.
> Upload "examples/templates/test-required-params"? (yes/no) yes
=== ✔ Queued [0ms]
==> ⧗ Running
==> ⧗ Running
=== ✔ Running [4ms]
==> ⧗ Setting up
=== ✔ Setting up [0ms]
==> ⧗ Parsing template parameters
=== ✔ Parsing template parameters [8ms]
==> ⧗ Cleaning Up
=== ✘ Cleaning Up [4ms]
=== ✘ Cleaning Up [8ms]
Found 5 missing required variables:
  - docker_image (string): Docker image to use for the workspace
  - workspace_name (string): Name of the workspace
  - cpu_limit (number): CPU limit for the container (number of cores)
  - enable_gpu (bool): Enable GPU access for the container
  - api_key (string): API key for external services (sensitive)

The template requires values for the following variables:
var.docker_image (required)
  Description: Docker image to use for the workspace
  Type: string
  Current value: <empty>
> Enter value: image-name
var.workspace_name (required)
  Description: Name of the workspace
  Type: string
  Current value: <empty>
> Enter value: workspace-name
var.cpu_limit (required)
  Description: CPU limit for the container (number of cores)
  Type: number
  Current value: <empty>
> Enter value: 1
var.enable_gpu (required)
  Description: Enable GPU access for the container
  Type: bool
  Current value: <empty>
? Select value: false
var.api_key (required), sensitive
  Description: API key for external services (sensitive)
  Type: string
  Current value: <empty>
> Enter value: (*redacted*) ******

Retrying template build with provided variables...
=== ✔ Queued [0ms]
==> ⧗ Running
==> ⧗ Running
=== ✔ Running [2ms]
==> ⧗ Setting up
=== ✔ Setting up [0ms]
==> ⧗ Parsing template parameters
=== ✔ Parsing template parameters [7ms]
==> ⧗ Detecting persistent resources
2025-09-25 22:34:14.731Z Terraform 1.13.0
2025-09-25 22:34:15.140Z data.coder_provisioner.me: Refreshing...
2025-09-25 22:34:15.140Z data.coder_workspace.me: Refreshing...
2025-09-25 22:34:15.140Z data.coder_workspace_owner.me: Refreshing...
2025-09-25 22:34:15.141Z data.coder_provisioner.me: Refresh complete after 0s [id=2bd73098-d127-4362-b3a5-628e5bce6998]
2025-09-25 22:34:15.141Z data.coder_workspace_owner.me: Refresh complete after 0s [id=c2006933-4f3e-4c45-9e04-79612c3a5eca]
2025-09-25 22:34:15.141Z data.coder_workspace.me: Refresh complete after 0s [id=36f2dc6f-0bf2-43bd-bc4d-b29768334e02]
2025-09-25 22:34:15.186Z coder_agent.main: Plan to create
2025-09-25 22:34:15.186Z module.code-server[0].coder_app.code-server: Plan to create
2025-09-25 22:34:15.186Z docker_volume.home_volume: Plan to create
2025-09-25 22:34:15.186Z module.code-server[0].coder_script.code-server: Plan to create
2025-09-25 22:34:15.187Z docker_container.workspace[0]: Plan to create
2025-09-25 22:34:15.187Z Plan: 5 to add, 0 to change, 0 to destroy.
=== ✔ Detecting persistent resources [3104ms]
==> ⧗ Detecting ephemeral resources
2025-09-25 22:34:16.033Z Terraform 1.13.0
2025-09-25 22:34:16.428Z data.coder_workspace.me: Refreshing...
2025-09-25 22:34:16.428Z data.coder_provisioner.me: Refreshing...
2025-09-25 22:34:16.429Z data.coder_workspace_owner.me: Refreshing...
2025-09-25 22:34:16.429Z data.coder_provisioner.me: Refresh complete after 0s [id=2d2f7083-88e6-425c-9df3-856a3bf4cc73]
2025-09-25 22:34:16.429Z data.coder_workspace.me: Refresh complete after 0s [id=c723575e-c7d3-43d7-bf54-0e34d0959dc3]
2025-09-25 22:34:16.431Z data.coder_workspace_owner.me: Refresh complete after 0s [id=d43470c2-236e-4ae9-a977-6b53688c2cb1]
2025-09-25 22:34:16.453Z coder_agent.main: Plan to create
2025-09-25 22:34:16.453Z docker_volume.home_volume: Plan to create
2025-09-25 22:34:16.454Z Plan: 2 to add, 0 to change, 0 to destroy.
=== ✔ Detecting ephemeral resources [1278ms]
==> ⧗ Cleaning Up
=== ✔ Cleaning Up [6ms]
┌──────────────────────────────────┐
│ Template Preview                 │
├──────────────────────────────────┤
│ RESOURCE                         │
├──────────────────────────────────┤
│ docker_container.workspace       │
│ └─ main (linux, amd64)           │
├──────────────────────────────────┤
│ docker_volume.home_volume        │
└──────────────────────────────────┘

The test-required-params template has been created at Sep 25
22:34:16! Developers can provision a workspace with this template using:

Updated version at Sep 25 22:34:16!
```

</details>

### Changes

- Added a new function to check if the provisioner failed due to a
template missing required variables
- Added a handler function that is called when a provisioner fails due
to the "missing required variables" error. The handler function will:
- Check for provided template variables and identify any missing
variables
- Prompt the user for any missing variables (prompt is adapted based on
the variable type)
  - Validate user input for missing variables
- Retry the template build when all variables have been provided by the
user

### Testing

Added tests for the following scenarios:

- Ensure validation based on variable type
- Ensure users are not prompted for variables with a default value
- Ensure variables provided via a variables files (`--variables-file`)
or a variable flag (`--variable`) take precedence over a template
---
 cli/templatepush.go            | 161 ++++++++++++++++++-
 cli/templatepush_test.go       | 282 +++++++++++++++++++++++++++------
 codersdk/provisionerdaemons.go |   6 +
 codersdk/templatevariables.go  |   4 +-
 4 files changed, 400 insertions(+), 53 deletions(-)

diff --git a/cli/templatepush.go b/cli/templatepush.go
index 7a21a0f8defad..03e1ca1cee88c 100644
--- a/cli/templatepush.go
+++ b/cli/templatepush.go
@@ -9,6 +9,7 @@ import (
 	"os"
 	"path/filepath"
 	"slices"
+	"strconv"
 	"strings"
 	"time"
 
@@ -461,10 +462,14 @@ func createValidTemplateVersion(inv *serpent.Invocation, args createValidTemplat
 	})
 	if err != nil {
 		var jobErr *cliui.ProvisionerJobError
-		if errors.As(err, &jobErr) && !codersdk.JobIsMissingParameterErrorCode(jobErr.Code) {
-			return nil, err
+		if errors.As(err, &jobErr) {
+			if codersdk.JobIsMissingRequiredTemplateVariableErrorCode(jobErr.Code) {
+				return handleMissingTemplateVariables(inv, args, version.ID)
+			}
+			if !codersdk.JobIsMissingParameterErrorCode(jobErr.Code) {
+				return nil, err
+			}
 		}
-
 		return nil, err
 	}
 	version, err = client.TemplateVersion(inv.Context(), version.ID)
@@ -528,3 +533,153 @@ func prettyDirectoryPath(dir string) string {
 	}
 	return prettyDir
 }
+
+func handleMissingTemplateVariables(inv *serpent.Invocation, args createValidTemplateVersionArgs, failedVersionID uuid.UUID) (*codersdk.TemplateVersion, error) {
+	client := args.Client
+
+	templateVariables, err := client.TemplateVersionVariables(inv.Context(), failedVersionID)
+	if err != nil {
+		return nil, xerrors.Errorf("fetch template variables: %w", err)
+	}
+
+	existingValues := make(map[string]string)
+	for _, v := range args.UserVariableValues {
+		existingValues[v.Name] = v.Value
+	}
+
+	var missingVariables []codersdk.TemplateVersionVariable
+	for _, variable := range templateVariables {
+		if !variable.Required {
+			continue
+		}
+
+		if existingValue, exists := existingValues[variable.Name]; exists && existingValue != "" {
+			continue
+		}
+
+		// Only prompt for variables that don't have a default value or have a redacted default
+		// Sensitive variables have a default value of "*redacted*"
+		// See: https://github.com/coder/coder/blob/a78790c632974e04babfef6de0e2ddf044787a7a/coderd/provisionerdserver/provisionerdserver.go#L3206
+		if variable.DefaultValue == "" || (variable.Sensitive && variable.DefaultValue == "*redacted*") {
+			missingVariables = append(missingVariables, variable)
+		}
+	}
+
+	if len(missingVariables) == 0 {
+		return nil, xerrors.New("no missing required variables found")
+	}
+
+	_, _ = fmt.Fprintf(inv.Stderr, "Found %d missing required variables:\n", len(missingVariables))
+	for _, v := range missingVariables {
+		_, _ = fmt.Fprintf(inv.Stderr, "  - %s (%s): %s\n", v.Name, v.Type, v.Description)
+	}
+
+	_, _ = fmt.Fprintln(inv.Stderr, "\nThe template requires values for the following variables:")
+
+	var promptedValues []codersdk.VariableValue
+	for _, variable := range missingVariables {
+		value, err := promptForTemplateVariable(inv, variable)
+		if err != nil {
+			return nil, xerrors.Errorf("prompt for variable %q: %w", variable.Name, err)
+		}
+		promptedValues = append(promptedValues, codersdk.VariableValue{
+			Name:  variable.Name,
+			Value: value,
+		})
+	}
+
+	combinedValues := codersdk.CombineVariableValues(args.UserVariableValues, promptedValues)
+
+	_, _ = fmt.Fprintln(inv.Stderr, "\nRetrying template build with provided variables...")
+
+	retryArgs := args
+	retryArgs.UserVariableValues = combinedValues
+
+	return createValidTemplateVersion(inv, retryArgs)
+}
+
+func promptForTemplateVariable(inv *serpent.Invocation, variable codersdk.TemplateVersionVariable) (string, error) {
+	displayVariableInfo(inv, variable)
+
+	switch variable.Type {
+	case "bool":
+		return promptForBoolVariable(inv, variable)
+	case "number":
+		return promptForNumberVariable(inv, variable)
+	default:
+		return promptForStringVariable(inv, variable)
+	}
+}
+
+func displayVariableInfo(inv *serpent.Invocation, variable codersdk.TemplateVersionVariable) {
+	_, _ = fmt.Fprintf(inv.Stderr, "var.%s", cliui.Bold(variable.Name))
+	if variable.Required {
+		_, _ = fmt.Fprint(inv.Stderr, pretty.Sprint(cliui.DefaultStyles.Error, " (required)"))
+	}
+	if variable.Sensitive {
+		_, _ = fmt.Fprint(inv.Stderr, pretty.Sprint(cliui.DefaultStyles.Warn, ", sensitive"))
+	}
+	_, _ = fmt.Fprintln(inv.Stderr, "")
+
+	if variable.Description != "" {
+		_, _ = fmt.Fprintf(inv.Stderr, "  Description: %s\n", variable.Description)
+	}
+	_, _ = fmt.Fprintf(inv.Stderr, "  Type: %s\n", variable.Type)
+	_, _ = fmt.Fprintf(inv.Stderr, "  Current value: %s\n", pretty.Sprint(cliui.DefaultStyles.Placeholder, "<empty>"))
+}
+
+func promptForBoolVariable(inv *serpent.Invocation, variable codersdk.TemplateVersionVariable) (string, error) {
+	defaultValue := variable.DefaultValue
+	if defaultValue == "" {
+		defaultValue = "false"
+	}
+
+	return cliui.Select(inv, cliui.SelectOptions{
+		Options: []string{"true", "false"},
+		Default: defaultValue,
+		Message: "Select value:",
+	})
+}
+
+func promptForNumberVariable(inv *serpent.Invocation, variable codersdk.TemplateVersionVariable) (string, error) {
+	prompt := "Enter value:"
+	if !variable.Required && variable.DefaultValue != "" {
+		prompt = fmt.Sprintf("Enter value (default: %q):", variable.DefaultValue)
+	}
+
+	return cliui.Prompt(inv, cliui.PromptOptions{
+		Text:     prompt,
+		Default:  variable.DefaultValue,
+		Validate: createVariableValidator(variable),
+	})
+}
+
+func promptForStringVariable(inv *serpent.Invocation, variable codersdk.TemplateVersionVariable) (string, error) {
+	prompt := "Enter value:"
+	if !variable.Sensitive {
+		if !variable.Required && variable.DefaultValue != "" {
+			prompt = fmt.Sprintf("Enter value (default: %q):", variable.DefaultValue)
+		}
+	}
+
+	return cliui.Prompt(inv, cliui.PromptOptions{
+		Text:     prompt,
+		Default:  variable.DefaultValue,
+		Secret:   variable.Sensitive,
+		Validate: createVariableValidator(variable),
+	})
+}
+
+func createVariableValidator(variable codersdk.TemplateVersionVariable) func(string) error {
+	return func(s string) error {
+		if variable.Required && s == "" && variable.DefaultValue == "" {
+			return xerrors.New("value is required")
+		}
+		if variable.Type == "number" && s != "" {
+			if _, err := strconv.ParseFloat(s, 64); err != nil {
+				return xerrors.Errorf("must be a valid number, got: %q", s)
+			}
+		}
+		return nil
+	}
+}
diff --git a/cli/templatepush_test.go b/cli/templatepush_test.go
index 7c8007c96a210..28c5adc20f213 100644
--- a/cli/templatepush_test.go
+++ b/cli/templatepush_test.go
@@ -852,54 +852,6 @@ func TestTemplatePush(t *testing.T) {
 			require.Equal(t, "foobar", templateVariables[1].Value)
 		})
 
-		t.Run("VariableIsRequiredButNotProvided", func(t *testing.T) {
-			t.Parallel()
-			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			owner := coderdtest.CreateFirstUser(t, client)
-			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
-
-			templateVersion := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, createEchoResponsesWithTemplateVariables(initialTemplateVariables))
-			_ = coderdtest.AwaitTemplateVersionJobCompleted(t, client, templateVersion.ID)
-			template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, templateVersion.ID)
-
-			// Test the cli command.
-			//nolint:gocritic
-			modifiedTemplateVariables := append(initialTemplateVariables,
-				&proto.TemplateVariable{
-					Name:        "second_variable",
-					Description: "This is the second variable.",
-					Type:        "string",
-					Required:    true,
-				},
-			)
-			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(modifiedTemplateVariables))
-			inv, root := clitest.New(t, "templates", "push", template.Name, "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho), "--name", "example")
-			clitest.SetupConfig(t, templateAdmin, root)
-			pty := ptytest.New(t)
-			inv.Stdin = pty.Input()
-			inv.Stdout = pty.Output()
-
-			execDone := make(chan error)
-			go func() {
-				execDone <- inv.Run()
-			}()
-
-			matches := []struct {
-				match string
-				write string
-			}{
-				{match: "Upload", write: "yes"},
-			}
-			for _, m := range matches {
-				pty.ExpectMatch(m.match)
-				pty.WriteLine(m.write)
-			}
-
-			wantErr := <-execDone
-			require.Error(t, wantErr)
-			require.Contains(t, wantErr.Error(), "required template variables need values")
-		})
-
 		t.Run("VariableIsOptionalButNotProvided", func(t *testing.T) {
 			t.Parallel()
 			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
@@ -1115,6 +1067,240 @@ func TestTemplatePush(t *testing.T) {
 			require.Len(t, templateVersions, 2)
 			require.Equal(t, "example", templateVersions[1].Name)
 		})
+
+		t.Run("PromptForDifferentRequiredTypes", func(t *testing.T) {
+			t.Parallel()
+			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+			templateVariables := []*proto.TemplateVariable{
+				{
+					Name:        "string_var",
+					Description: "A string variable",
+					Type:        "string",
+					Required:    true,
+				},
+				{
+					Name:        "number_var",
+					Description: "A number variable",
+					Type:        "number",
+					Required:    true,
+				},
+				{
+					Name:        "bool_var",
+					Description: "A boolean variable",
+					Type:        "bool",
+					Required:    true,
+				},
+				{
+					Name:        "sensitive_var",
+					Description: "A sensitive variable",
+					Type:        "string",
+					Required:    true,
+					Sensitive:   true,
+				},
+			}
+
+			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(templateVariables))
+			inv, root := clitest.New(t, "templates", "push", "test-template", "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho))
+			clitest.SetupConfig(t, templateAdmin, root)
+			pty := ptytest.New(t).Attach(inv)
+
+			execDone := make(chan error)
+			go func() {
+				execDone <- inv.Run()
+			}()
+
+			// Select "Yes" for the "Upload <template_path>" prompt
+			pty.ExpectMatch("Upload")
+			pty.WriteLine("yes")
+
+			pty.ExpectMatch("var.string_var")
+			pty.ExpectMatch("Enter value:")
+			pty.WriteLine("test-string")
+
+			pty.ExpectMatch("var.number_var")
+			pty.ExpectMatch("Enter value:")
+			pty.WriteLine("42")
+
+			// Boolean variable automatically selects the first option ("true")
+			pty.ExpectMatch("var.bool_var")
+
+			pty.ExpectMatch("var.sensitive_var")
+			pty.ExpectMatch("Enter value:")
+			pty.WriteLine("secret-value")
+
+			require.NoError(t, <-execDone)
+		})
+
+		t.Run("ValidateNumberInput", func(t *testing.T) {
+			t.Parallel()
+			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+			templateVariables := []*proto.TemplateVariable{
+				{
+					Name:        "number_var",
+					Description: "A number that requires validation",
+					Type:        "number",
+					Required:    true,
+				},
+			}
+
+			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(templateVariables))
+			inv, root := clitest.New(t, "templates", "push", "test-template", "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho))
+			clitest.SetupConfig(t, templateAdmin, root)
+			pty := ptytest.New(t).Attach(inv)
+
+			execDone := make(chan error)
+			go func() {
+				execDone <- inv.Run()
+			}()
+
+			// Select "Yes" for the "Upload <template_path>" prompt
+			pty.ExpectMatch("Upload")
+			pty.WriteLine("yes")
+
+			pty.ExpectMatch("var.number_var")
+
+			pty.WriteLine("not-a-number")
+			pty.ExpectMatch("must be a valid number")
+
+			pty.WriteLine("123.45")
+
+			require.NoError(t, <-execDone)
+		})
+
+		t.Run("DontPromptForDefaultValues", func(t *testing.T) {
+			t.Parallel()
+			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+			templateVariables := []*proto.TemplateVariable{
+				{
+					Name:         "with_default",
+					Type:         "string",
+					Required:     true,
+					DefaultValue: "default-value",
+				},
+				{
+					Name:     "without_default",
+					Type:     "string",
+					Required: true,
+				},
+			}
+
+			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(templateVariables))
+			inv, root := clitest.New(t, "templates", "push", "test-template", "--directory", source, "--test.provisioner", string(database.ProvisionerTypeEcho))
+			clitest.SetupConfig(t, templateAdmin, root)
+			pty := ptytest.New(t).Attach(inv)
+
+			execDone := make(chan error)
+			go func() {
+				execDone <- inv.Run()
+			}()
+
+			// Select "Yes" for the "Upload <template_path>" prompt
+			pty.ExpectMatch("Upload")
+			pty.WriteLine("yes")
+
+			pty.ExpectMatch("var.without_default")
+			pty.WriteLine("test-value")
+
+			require.NoError(t, <-execDone)
+		})
+
+		t.Run("VariableSourcesPriority", func(t *testing.T) {
+			t.Parallel()
+			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			owner := coderdtest.CreateFirstUser(t, client)
+			templateAdmin, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.RoleTemplateAdmin())
+
+			templateVariables := []*proto.TemplateVariable{
+				{
+					Name:        "cli_flag_var",
+					Description: "Variable provided via CLI flag",
+					Type:        "string",
+					Required:    true,
+				},
+				{
+					Name:        "file_var",
+					Description: "Variable provided via file",
+					Type:        "string",
+					Required:    true,
+				},
+				{
+					Name:        "prompt_var",
+					Description: "Variable provided via prompt",
+					Type:        "string",
+					Required:    true,
+				},
+				{
+					Name:        "cli_overrides_file_var",
+					Description: "Variable in both CLI and file",
+					Type:        "string",
+					Required:    true,
+				},
+			}
+
+			source := clitest.CreateTemplateVersionSource(t, createEchoResponsesWithTemplateVariables(templateVariables))
+
+			// Create a temporary variables file.
+			tempDir := t.TempDir()
+			removeTmpDirUntilSuccessAfterTest(t, tempDir)
+			variablesFile, err := os.CreateTemp(tempDir, "variables*.yaml")
+			require.NoError(t, err)
+			_, err = variablesFile.WriteString(`file_var: from-file
+cli_overrides_file_var: from-file`)
+			require.NoError(t, err)
+			require.NoError(t, variablesFile.Close())
+
+			inv, root := clitest.New(t, "templates", "push", "test-template",
+				"--directory", source,
+				"--test.provisioner", string(database.ProvisionerTypeEcho),
+				"--variables-file", variablesFile.Name(),
+				"--variable", "cli_flag_var=from-cli-flag",
+				"--variable", "cli_overrides_file_var=from-cli-override",
+			)
+			clitest.SetupConfig(t, templateAdmin, root)
+			pty := ptytest.New(t).Attach(inv)
+
+			execDone := make(chan error)
+			go func() {
+				execDone <- inv.Run()
+			}()
+
+			// Select "Yes" for the "Upload <template_path>" prompt
+			pty.ExpectMatch("Upload")
+			pty.WriteLine("yes")
+
+			// Only check for prompt_var, other variables should not prompt
+			pty.ExpectMatch("var.prompt_var")
+			pty.ExpectMatch("Enter value:")
+			pty.WriteLine("from-prompt")
+
+			require.NoError(t, <-execDone)
+
+			template, err := client.TemplateByName(context.Background(), owner.OrganizationID, "test-template")
+			require.NoError(t, err)
+
+			templateVersionVars, err := client.TemplateVersionVariables(context.Background(), template.ActiveVersionID)
+			require.NoError(t, err)
+			require.Len(t, templateVersionVars, 4)
+
+			varMap := make(map[string]string)
+			for _, tv := range templateVersionVars {
+				varMap[tv.Name] = tv.Value
+			}
+
+			require.Equal(t, "from-cli-flag", varMap["cli_flag_var"])
+			require.Equal(t, "from-file", varMap["file_var"])
+			require.Equal(t, "from-prompt", varMap["prompt_var"])
+			require.Equal(t, "from-cli-override", varMap["cli_overrides_file_var"])
+		})
 	})
 }
 
diff --git a/codersdk/provisionerdaemons.go b/codersdk/provisionerdaemons.go
index 4bff7d7827aa1..b3cefa09110ec 100644
--- a/codersdk/provisionerdaemons.go
+++ b/codersdk/provisionerdaemons.go
@@ -175,6 +175,12 @@ func JobIsMissingParameterErrorCode(code JobErrorCode) bool {
 	return string(code) == runner.MissingParameterErrorCode
 }
 
+// JobIsMissingRequiredTemplateVariableErrorCode returns whether the error is a missing a required template
+// variable error. This can indicate to consumers that they need to provide required template variables.
+func JobIsMissingRequiredTemplateVariableErrorCode(code JobErrorCode) bool {
+	return string(code) == runner.RequiredTemplateVariablesErrorCode
+}
+
 // ProvisionerJob describes the job executed by the provisioning daemon.
 type ProvisionerJob struct {
 	ID               uuid.UUID              `json:"id" format:"uuid" table:"id"`
diff --git a/codersdk/templatevariables.go b/codersdk/templatevariables.go
index 3e02f6910642f..19c614e796e1e 100644
--- a/codersdk/templatevariables.go
+++ b/codersdk/templatevariables.go
@@ -68,7 +68,7 @@ func ParseUserVariableValues(varsFiles []string, variablesFile string, commandLi
 		return nil, err
 	}
 
-	return combineVariableValues(fromVars, fromFile, fromCommandLine), nil
+	return CombineVariableValues(fromVars, fromFile, fromCommandLine), nil
 }
 
 func parseVariableValuesFromVarsFiles(varsFiles []string) ([]VariableValue, error) {
@@ -252,7 +252,7 @@ func parseVariableValuesFromCommandLine(variables []string) ([]VariableValue, er
 	return values, nil
 }
 
-func combineVariableValues(valuesSets ...[]VariableValue) []VariableValue {
+func CombineVariableValues(valuesSets ...[]VariableValue) []VariableValue {
 	combinedValues := make(map[string]string)
 
 	for _, values := range valuesSets {

From b48e367c58a5552e08fa2049e7433b3cea0359d3 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Fri, 3 Oct 2025 09:42:34 -0600
Subject: [PATCH 053/298] chore: remove dead randtz package (#20156)

This package was added in 65db7a71 a couple years back and was seemingly
never used (backed up by `git log -S randtz`).
---
 coderd/database/dbtestutil/randtz/randtz.go | 1034 -------------------
 1 file changed, 1034 deletions(-)
 delete mode 100644 coderd/database/dbtestutil/randtz/randtz.go

diff --git a/coderd/database/dbtestutil/randtz/randtz.go b/coderd/database/dbtestutil/randtz/randtz.go
deleted file mode 100644
index 1a53bfaf725fd..0000000000000
--- a/coderd/database/dbtestutil/randtz/randtz.go
+++ /dev/null
@@ -1,1034 +0,0 @@
-package randtz
-
-import (
-	"math/rand"
-	"sync"
-	"testing"
-	"time"
-)
-
-var (
-	randTZName     string
-	randTZNameOnce sync.Once
-)
-
-// Name returns a random timezone name from the list of all
-// timezones known to PostgreSQL.
-func Name(t testing.TB) string {
-	t.Helper()
-
-	randTZNameOnce.Do(func() {
-		// nolint: gosec // not used for cryptography
-		rnd := rand.New(rand.NewSource(time.Now().Unix()))
-		idx := rnd.Intn(len(tznames))
-		randTZName = tznames[idx]
-		t.Logf("Random db timezone is %q\nIf you need a specific timezone, use dbtestutil.WithTimezone()", randTZName)
-	})
-
-	return randTZName
-}
-
-// tznames is a list of all timezone names known to postgresql.
-// The below list was generated with the query
-// select name from pg_timezone_names order by name asc;
-var tznames = []string{
-	"Africa/Abidjan",
-	"Africa/Accra",
-	"Africa/Addis_Ababa",
-	"Africa/Algiers",
-	"Africa/Asmara",
-	"Africa/Asmera",
-	"Africa/Bamako",
-	"Africa/Bangui",
-	"Africa/Banjul",
-	"Africa/Bissau",
-	"Africa/Blantyre",
-	"Africa/Brazzaville",
-	"Africa/Bujumbura",
-	"Africa/Cairo",
-	"Africa/Casablanca",
-	"Africa/Ceuta",
-	"Africa/Conakry",
-	"Africa/Dakar",
-	"Africa/Dar_es_Salaam",
-	"Africa/Djibouti",
-	"Africa/Douala",
-	"Africa/El_Aaiun",
-	"Africa/Freetown",
-	"Africa/Gaborone",
-	"Africa/Harare",
-	"Africa/Johannesburg",
-	"Africa/Juba",
-	"Africa/Kampala",
-	"Africa/Khartoum",
-	"Africa/Kigali",
-	"Africa/Kinshasa",
-	"Africa/Lagos",
-	"Africa/Libreville",
-	"Africa/Lome",
-	"Africa/Luanda",
-	"Africa/Lubumbashi",
-	"Africa/Lusaka",
-	"Africa/Malabo",
-	"Africa/Maputo",
-	"Africa/Maseru",
-	"Africa/Mbabane",
-	"Africa/Mogadishu",
-	"Africa/Monrovia",
-	"Africa/Nairobi",
-	"Africa/Ndjamena",
-	"Africa/Niamey",
-	"Africa/Nouakchott",
-	"Africa/Ouagadougou",
-	"Africa/Porto-Novo",
-	"Africa/Sao_Tome",
-	"Africa/Timbuktu",
-	"Africa/Tripoli",
-	"Africa/Tunis",
-	"Africa/Windhoek",
-	"America/Adak",
-	"America/Anchorage",
-	"America/Anguilla",
-	"America/Antigua",
-	"America/Araguaina",
-	"America/Argentina/Buenos_Aires",
-	"America/Argentina/Catamarca",
-	"America/Argentina/ComodRivadavia",
-	"America/Argentina/Cordoba",
-	"America/Argentina/Jujuy",
-	"America/Argentina/La_Rioja",
-	"America/Argentina/Mendoza",
-	"America/Argentina/Rio_Gallegos",
-	"America/Argentina/Salta",
-	"America/Argentina/San_Juan",
-	"America/Argentina/San_Luis",
-	"America/Argentina/Tucuman",
-	"America/Argentina/Ushuaia",
-	"America/Aruba",
-	"America/Asuncion",
-	"America/Atikokan",
-	"America/Atka",
-	"America/Bahia",
-	"America/Bahia_Banderas",
-	"America/Barbados",
-	"America/Belem",
-	"America/Belize",
-	"America/Blanc-Sablon",
-	"America/Boa_Vista",
-	"America/Bogota",
-	"America/Boise",
-	"America/Buenos_Aires",
-	"America/Cambridge_Bay",
-	"America/Campo_Grande",
-	"America/Cancun",
-	"America/Caracas",
-	"America/Catamarca",
-	"America/Cayenne",
-	"America/Cayman",
-	"America/Chicago",
-	"America/Chihuahua",
-	"America/Ciudad_Juarez",
-	"America/Coral_Harbor",
-	"America/Cordoba",
-	"America/Costa_Rica",
-	"America/Creston",
-	"America/Cuiaba",
-	"America/Curacao",
-	"America/Danmarkshavn",
-	"America/Dawson",
-	"America/Dawson_Creek",
-	"America/Denver",
-	"America/Detroit",
-	"America/Dominica",
-	"America/Edmonton",
-	"America/Eirunepe",
-	"America/El_Salvador",
-	"America/Ensenada",
-	"America/Fortaleza",
-	"America/Fort_Nelson",
-	"America/Fort_Wayne",
-	"America/Glace_Bay",
-	"America/Godthab",
-	"America/Goose_Bay",
-	"America/Grand_Turk",
-	"America/Grenada",
-	"America/Guadeloupe",
-	"America/Guatemala",
-	"America/Guayaquil",
-	"America/Guyana",
-	"America/Halifax",
-	"America/Havana",
-	"America/Hermosillo",
-	"America/Indiana/Indianapolis",
-	"America/Indiana/Knox",
-	"America/Indiana/Marengo",
-	"America/Indiana/Petersburg",
-	"America/Indianapolis",
-	"America/Indiana/Tell_City",
-	"America/Indiana/Vevay",
-	"America/Indiana/Vincennes",
-	"America/Indiana/Winamac",
-	"America/Inuvik",
-	"America/Iqaluit",
-	"America/Jamaica",
-	"America/Jujuy",
-	"America/Juneau",
-	"America/Kentucky/Louisville",
-	"America/Kentucky/Monticello",
-	"America/Knox_IN",
-	"America/Kralendijk",
-	"America/La_Paz",
-	"America/Lima",
-	"America/Los_Angeles",
-	"America/Louisville",
-	"America/Lower_Princes",
-	"America/Maceio",
-	"America/Managua",
-	"America/Manaus",
-	"America/Marigot",
-	"America/Martinique",
-	"America/Matamoros",
-	"America/Mazatlan",
-	"America/Mendoza",
-	"America/Menominee",
-	"America/Merida",
-	"America/Metlakatla",
-	"America/Mexico_City",
-	"America/Miquelon",
-	"America/Moncton",
-	"America/Monterrey",
-	"America/Montevideo",
-	"America/Montreal",
-	"America/Montserrat",
-	"America/Nassau",
-	"America/New_York",
-	"America/Nipigon",
-	"America/Nome",
-	"America/Noronha",
-	"America/North_Dakota/Beulah",
-	"America/North_Dakota/Center",
-	"America/North_Dakota/New_Salem",
-	"America/Nuuk",
-	"America/Ojinaga",
-	"America/Panama",
-	"America/Pangnirtung",
-	"America/Paramaribo",
-	"America/Phoenix",
-	"America/Port-au-Prince",
-	"America/Porto_Acre",
-	"America/Port_of_Spain",
-	"America/Porto_Velho",
-	"America/Puerto_Rico",
-	"America/Punta_Arenas",
-	"America/Rainy_River",
-	"America/Rankin_Inlet",
-	"America/Recife",
-	"America/Regina",
-	"America/Resolute",
-	"America/Rio_Branco",
-	"America/Rosario",
-	"America/Santa_Isabel",
-	"America/Santarem",
-	"America/Santiago",
-	"America/Santo_Domingo",
-	"America/Sao_Paulo",
-	"America/Scoresbysund",
-	"America/Shiprock",
-	"America/Sitka",
-	"America/St_Barthelemy",
-	"America/St_Johns",
-	"America/St_Kitts",
-	"America/St_Lucia",
-	"America/St_Thomas",
-	"America/St_Vincent",
-	"America/Swift_Current",
-	"America/Tegucigalpa",
-	"America/Thule",
-	"America/Thunder_Bay",
-	"America/Tijuana",
-	"America/Toronto",
-	"America/Tortola",
-	"America/Vancouver",
-	"America/Virgin",
-	"America/Whitehorse",
-	"America/Winnipeg",
-	"America/Yakutat",
-	"America/Yellowknife",
-	"Antarctica/Casey",
-	"Antarctica/Davis",
-	"Antarctica/DumontDUrville",
-	"Antarctica/Macquarie",
-	"Antarctica/Mawson",
-	"Antarctica/McMurdo",
-	"Antarctica/Palmer",
-	"Antarctica/Rothera",
-	"Antarctica/South_Pole",
-	"Antarctica/Syowa",
-	"Antarctica/Troll",
-	"Antarctica/Vostok",
-	"Arctic/Longyearbyen",
-	"Asia/Aden",
-	"Asia/Almaty",
-	"Asia/Amman",
-	"Asia/Anadyr",
-	"Asia/Aqtau",
-	"Asia/Aqtobe",
-	"Asia/Ashgabat",
-	"Asia/Ashkhabad",
-	"Asia/Atyrau",
-	"Asia/Baghdad",
-	"Asia/Bahrain",
-	"Asia/Baku",
-	"Asia/Bangkok",
-	"Asia/Barnaul",
-	"Asia/Beirut",
-	"Asia/Bishkek",
-	"Asia/Brunei",
-	"Asia/Calcutta",
-	"Asia/Chita",
-	"Asia/Choibalsan",
-	"Asia/Chongqing",
-	"Asia/Chungking",
-	"Asia/Colombo",
-	"Asia/Dacca",
-	"Asia/Damascus",
-	"Asia/Dhaka",
-	"Asia/Dili",
-	"Asia/Dubai",
-	"Asia/Dushanbe",
-	"Asia/Famagusta",
-	"Asia/Gaza",
-	"Asia/Harbin",
-	"Asia/Hebron",
-	"Asia/Ho_Chi_Minh",
-	"Asia/Hong_Kong",
-	"Asia/Hovd",
-	"Asia/Irkutsk",
-	"Asia/Istanbul",
-	"Asia/Jakarta",
-	"Asia/Jayapura",
-	"Asia/Jerusalem",
-	"Asia/Kabul",
-	"Asia/Kamchatka",
-	"Asia/Karachi",
-	"Asia/Kashgar",
-	"Asia/Kathmandu",
-	"Asia/Katmandu",
-	"Asia/Khandyga",
-	"Asia/Kolkata",
-	"Asia/Krasnoyarsk",
-	"Asia/Kuala_Lumpur",
-	"Asia/Kuching",
-	"Asia/Kuwait",
-	"Asia/Macao",
-	"Asia/Macau",
-	"Asia/Magadan",
-	"Asia/Makassar",
-	"Asia/Manila",
-	"Asia/Muscat",
-	"Asia/Nicosia",
-	"Asia/Novokuznetsk",
-	"Asia/Novosibirsk",
-	"Asia/Omsk",
-	"Asia/Oral",
-	"Asia/Phnom_Penh",
-	"Asia/Pontianak",
-	"Asia/Pyongyang",
-	"Asia/Qatar",
-	"Asia/Qostanay",
-	"Asia/Qyzylorda",
-	"Asia/Rangoon",
-	"Asia/Riyadh",
-	"Asia/Saigon",
-	"Asia/Sakhalin",
-	"Asia/Samarkand",
-	"Asia/Seoul",
-	"Asia/Shanghai",
-	"Asia/Singapore",
-	"Asia/Srednekolymsk",
-	"Asia/Taipei",
-	"Asia/Tashkent",
-	"Asia/Tbilisi",
-	"Asia/Tehran",
-	"Asia/Tel_Aviv",
-	"Asia/Thimbu",
-	"Asia/Thimphu",
-	"Asia/Tokyo",
-	"Asia/Tomsk",
-	"Asia/Ujung_Pandang",
-	"Asia/Ulaanbaatar",
-	"Asia/Ulan_Bator",
-	"Asia/Urumqi",
-	"Asia/Ust-Nera",
-	"Asia/Vientiane",
-	"Asia/Vladivostok",
-	"Asia/Yakutsk",
-	"Asia/Yangon",
-	"Asia/Yekaterinburg",
-	"Asia/Yerevan",
-	"Atlantic/Azores",
-	"Atlantic/Bermuda",
-	"Atlantic/Canary",
-	"Atlantic/Cape_Verde",
-	"Atlantic/Faeroe",
-	"Atlantic/Faroe",
-	"Atlantic/Jan_Mayen",
-	"Atlantic/Madeira",
-	"Atlantic/Reykjavik",
-	"Atlantic/South_Georgia",
-	"Atlantic/Stanley",
-	"Atlantic/St_Helena",
-	"Australia/ACT",
-	"Australia/Adelaide",
-	"Australia/Brisbane",
-	"Australia/Broken_Hill",
-	"Australia/Canberra",
-	"Australia/Currie",
-	"Australia/Darwin",
-	"Australia/Eucla",
-	"Australia/Hobart",
-	"Australia/LHI",
-	"Australia/Lindeman",
-	"Australia/Lord_Howe",
-	"Australia/Melbourne",
-	"Australia/North",
-	"Australia/NSW",
-	"Australia/Perth",
-	"Australia/Queensland",
-	"Australia/South",
-	"Australia/Sydney",
-	"Australia/Tasmania",
-	"Australia/Victoria",
-	"Australia/West",
-	"Australia/Yancowinna",
-	"Brazil/Acre",
-	"Brazil/DeNoronha",
-	"Brazil/East",
-	"Brazil/West",
-	"Canada/Atlantic",
-	"Canada/Central",
-	"Canada/Eastern",
-	"Canada/Mountain",
-	"Canada/Newfoundland",
-	"Canada/Pacific",
-	"Canada/Saskatchewan",
-	"Canada/Yukon",
-	"CET",
-	"Chile/Continental",
-	"Chile/EasterIsland",
-	"CST6CDT",
-	"Cuba",
-	"EET",
-	"Egypt",
-	"Eire",
-	"EST",
-	"EST5EDT",
-	"Etc/GMT",
-	"Etc/GMT+0",
-	"Etc/GMT-0",
-	"Etc/GMT0",
-	"Etc/GMT+1",
-	"Etc/GMT-1",
-	"Etc/GMT+10",
-	"Etc/GMT-10",
-	"Etc/GMT+11",
-	"Etc/GMT-11",
-	"Etc/GMT+12",
-	"Etc/GMT-12",
-	"Etc/GMT-13",
-	"Etc/GMT-14",
-	"Etc/GMT+2",
-	"Etc/GMT-2",
-	"Etc/GMT+3",
-	"Etc/GMT-3",
-	"Etc/GMT+4",
-	"Etc/GMT-4",
-	"Etc/GMT+5",
-	"Etc/GMT-5",
-	"Etc/GMT+6",
-	"Etc/GMT-6",
-	"Etc/GMT+7",
-	"Etc/GMT-7",
-	"Etc/GMT+8",
-	"Etc/GMT-8",
-	"Etc/GMT+9",
-	"Etc/GMT-9",
-	"Etc/Greenwich",
-	"Etc/UCT",
-	"Etc/Universal",
-	"Etc/UTC",
-	"Etc/Zulu",
-	"Europe/Amsterdam",
-	"Europe/Andorra",
-	"Europe/Astrakhan",
-	"Europe/Athens",
-	"Europe/Belfast",
-	"Europe/Belgrade",
-	"Europe/Berlin",
-	"Europe/Bratislava",
-	"Europe/Brussels",
-	"Europe/Bucharest",
-	"Europe/Budapest",
-	"Europe/Busingen",
-	"Europe/Chisinau",
-	"Europe/Copenhagen",
-	"Europe/Dublin",
-	"Europe/Gibraltar",
-	"Europe/Guernsey",
-	"Europe/Helsinki",
-	"Europe/Isle_of_Man",
-	"Europe/Istanbul",
-	"Europe/Jersey",
-	"Europe/Kaliningrad",
-	"Europe/Kiev",
-	"Europe/Kirov",
-	"Europe/Lisbon",
-	"Europe/Ljubljana",
-	"Europe/London",
-	"Europe/Luxembourg",
-	"Europe/Madrid",
-	"Europe/Malta",
-	"Europe/Mariehamn",
-	"Europe/Minsk",
-	"Europe/Monaco",
-	"Europe/Moscow",
-	"Europe/Nicosia",
-	"Europe/Oslo",
-	"Europe/Paris",
-	"Europe/Podgorica",
-	"Europe/Prague",
-	"Europe/Riga",
-	"Europe/Rome",
-	"Europe/Samara",
-	"Europe/San_Marino",
-	"Europe/Sarajevo",
-	"Europe/Saratov",
-	"Europe/Simferopol",
-	"Europe/Skopje",
-	"Europe/Sofia",
-	"Europe/Stockholm",
-	"Europe/Tallinn",
-	"Europe/Tirane",
-	"Europe/Tiraspol",
-	"Europe/Ulyanovsk",
-	"Europe/Uzhgorod",
-	"Europe/Vaduz",
-	"Europe/Vatican",
-	"Europe/Vienna",
-	"Europe/Vilnius",
-	"Europe/Volgograd",
-	"Europe/Warsaw",
-	"Europe/Zagreb",
-	"Europe/Zaporozhye",
-	"Europe/Zurich",
-	"Factory",
-	"GB",
-	"GB-Eire",
-	"GMT",
-	"GMT+0",
-	"GMT-0",
-	"GMT0",
-	"Greenwich",
-	"Hongkong",
-	"HST",
-	"Iceland",
-	"Indian/Antananarivo",
-	"Indian/Chagos",
-	"Indian/Christmas",
-	"Indian/Cocos",
-	"Indian/Comoro",
-	"Indian/Kerguelen",
-	"Indian/Mahe",
-	"Indian/Maldives",
-	"Indian/Mauritius",
-	"Indian/Mayotte",
-	"Indian/Reunion",
-	"Iran",
-	"Israel",
-	"Jamaica",
-	"Japan",
-	"Kwajalein",
-	"Libya",
-	"localtime",
-	"MET",
-	"Mexico/BajaNorte",
-	"Mexico/BajaSur",
-	"Mexico/General",
-	"MST",
-	"MST7MDT",
-	"Navajo",
-	"NZ",
-	"NZ-CHAT",
-	"Pacific/Apia",
-	"Pacific/Auckland",
-	"Pacific/Bougainville",
-	"Pacific/Chatham",
-	"Pacific/Chuuk",
-	"Pacific/Easter",
-	"Pacific/Efate",
-	"Pacific/Enderbury",
-	"Pacific/Fakaofo",
-	"Pacific/Fiji",
-	"Pacific/Funafuti",
-	"Pacific/Galapagos",
-	"Pacific/Gambier",
-	"Pacific/Guadalcanal",
-	"Pacific/Guam",
-	"Pacific/Honolulu",
-	"Pacific/Johnston",
-	"Pacific/Kiritimati",
-	"Pacific/Kosrae",
-	"Pacific/Kwajalein",
-	"Pacific/Majuro",
-	"Pacific/Marquesas",
-	"Pacific/Midway",
-	"Pacific/Nauru",
-	"Pacific/Niue",
-	"Pacific/Norfolk",
-	"Pacific/Noumea",
-	"Pacific/Pago_Pago",
-	"Pacific/Palau",
-	"Pacific/Pitcairn",
-	"Pacific/Pohnpei",
-	"Pacific/Ponape",
-	"Pacific/Port_Moresby",
-	"Pacific/Rarotonga",
-	"Pacific/Saipan",
-	"Pacific/Samoa",
-	"Pacific/Tahiti",
-	"Pacific/Tarawa",
-	"Pacific/Tongatapu",
-	"Pacific/Truk",
-	"Pacific/Wake",
-	"Pacific/Wallis",
-	"Pacific/Yap",
-	"Poland",
-	"Portugal",
-	"posix/Africa/Abidjan",
-	"posix/Africa/Accra",
-	"posix/Africa/Addis_Ababa",
-	"posix/Africa/Algiers",
-	"posix/Africa/Asmara",
-	"posix/Africa/Asmera",
-	"posix/Africa/Bamako",
-	"posix/Africa/Bangui",
-	"posix/Africa/Banjul",
-	"posix/Africa/Bissau",
-	"posix/Africa/Blantyre",
-	"posix/Africa/Brazzaville",
-	"posix/Africa/Bujumbura",
-	"posix/Africa/Cairo",
-	"posix/Africa/Casablanca",
-	"posix/Africa/Ceuta",
-	"posix/Africa/Conakry",
-	"posix/Africa/Dakar",
-	"posix/Africa/Dar_es_Salaam",
-	"posix/Africa/Djibouti",
-	"posix/Africa/Douala",
-	"posix/Africa/El_Aaiun",
-	"posix/Africa/Freetown",
-	"posix/Africa/Gaborone",
-	"posix/Africa/Harare",
-	"posix/Africa/Johannesburg",
-	"posix/Africa/Juba",
-	"posix/Africa/Kampala",
-	"posix/Africa/Khartoum",
-	"posix/Africa/Kigali",
-	"posix/Africa/Kinshasa",
-	"posix/Africa/Lagos",
-	"posix/Africa/Libreville",
-	"posix/Africa/Lome",
-	"posix/Africa/Luanda",
-	"posix/Africa/Lubumbashi",
-	"posix/Africa/Lusaka",
-	"posix/Africa/Malabo",
-	"posix/Africa/Maputo",
-	"posix/Africa/Maseru",
-	"posix/Africa/Mbabane",
-	"posix/Africa/Mogadishu",
-	"posix/Africa/Monrovia",
-	"posix/Africa/Nairobi",
-	"posix/Africa/Ndjamena",
-	"posix/Africa/Niamey",
-	"posix/Africa/Nouakchott",
-	"posix/Africa/Ouagadougou",
-	"posix/Africa/Porto-Novo",
-	"posix/Africa/Sao_Tome",
-	"posix/Africa/Timbuktu",
-	"posix/Africa/Tripoli",
-	"posix/Africa/Tunis",
-	"posix/Africa/Windhoek",
-	"posix/America/Adak",
-	"posix/America/Anchorage",
-	"posix/America/Anguilla",
-	"posix/America/Antigua",
-	"posix/America/Araguaina",
-	"posix/America/Argentina/Buenos_Aires",
-	"posix/America/Argentina/Catamarca",
-	"posix/America/Argentina/ComodRivadavia",
-	"posix/America/Argentina/Cordoba",
-	"posix/America/Argentina/Jujuy",
-	"posix/America/Argentina/La_Rioja",
-	"posix/America/Argentina/Mendoza",
-	"posix/America/Argentina/Rio_Gallegos",
-	"posix/America/Argentina/Salta",
-	"posix/America/Argentina/San_Juan",
-	"posix/America/Argentina/San_Luis",
-	"posix/America/Argentina/Tucuman",
-	"posix/America/Argentina/Ushuaia",
-	"posix/America/Aruba",
-	"posix/America/Asuncion",
-	"posix/America/Atikokan",
-	"posix/America/Atka",
-	"posix/America/Bahia",
-	"posix/America/Bahia_Banderas",
-	"posix/America/Barbados",
-	"posix/America/Belem",
-	"posix/America/Belize",
-	"posix/America/Blanc-Sablon",
-	"posix/America/Boa_Vista",
-	"posix/America/Bogota",
-	"posix/America/Boise",
-	"posix/America/Buenos_Aires",
-	"posix/America/Cambridge_Bay",
-	"posix/America/Campo_Grande",
-	"posix/America/Cancun",
-	"posix/America/Caracas",
-	"posix/America/Catamarca",
-	"posix/America/Cayenne",
-	"posix/America/Cayman",
-	"posix/America/Chicago",
-	"posix/America/Chihuahua",
-	"posix/America/Ciudad_Juarez",
-	"posix/America/Coral_Harbor",
-	"posix/America/Cordoba",
-	"posix/America/Costa_Rica",
-	"posix/America/Creston",
-	"posix/America/Cuiaba",
-	"posix/America/Curacao",
-	"posix/America/Danmarkshavn",
-	"posix/America/Dawson",
-	"posix/America/Dawson_Creek",
-	"posix/America/Denver",
-	"posix/America/Detroit",
-	"posix/America/Dominica",
-	"posix/America/Edmonton",
-	"posix/America/Eirunepe",
-	"posix/America/El_Salvador",
-	"posix/America/Ensenada",
-	"posix/America/Fortaleza",
-	"posix/America/Fort_Nelson",
-	"posix/America/Fort_Wayne",
-	"posix/America/Glace_Bay",
-	"posix/America/Godthab",
-	"posix/America/Goose_Bay",
-	"posix/America/Grand_Turk",
-	"posix/America/Grenada",
-	"posix/America/Guadeloupe",
-	"posix/America/Guatemala",
-	"posix/America/Guayaquil",
-	"posix/America/Guyana",
-	"posix/America/Halifax",
-	"posix/America/Havana",
-	"posix/America/Hermosillo",
-	"posix/America/Indiana/Indianapolis",
-	"posix/America/Indiana/Knox",
-	"posix/America/Indiana/Marengo",
-	"posix/America/Indiana/Petersburg",
-	"posix/America/Indianapolis",
-	"posix/America/Indiana/Tell_City",
-	"posix/America/Indiana/Vevay",
-	"posix/America/Indiana/Vincennes",
-	"posix/America/Indiana/Winamac",
-	"posix/America/Inuvik",
-	"posix/America/Iqaluit",
-	"posix/America/Jamaica",
-	"posix/America/Jujuy",
-	"posix/America/Juneau",
-	"posix/America/Kentucky/Louisville",
-	"posix/America/Kentucky/Monticello",
-	"posix/America/Knox_IN",
-	"posix/America/Kralendijk",
-	"posix/America/La_Paz",
-	"posix/America/Lima",
-	"posix/America/Los_Angeles",
-	"posix/America/Louisville",
-	"posix/America/Lower_Princes",
-	"posix/America/Maceio",
-	"posix/America/Managua",
-	"posix/America/Manaus",
-	"posix/America/Marigot",
-	"posix/America/Martinique",
-	"posix/America/Matamoros",
-	"posix/America/Mazatlan",
-	"posix/America/Mendoza",
-	"posix/America/Menominee",
-	"posix/America/Merida",
-	"posix/America/Metlakatla",
-	"posix/America/Mexico_City",
-	"posix/America/Miquelon",
-	"posix/America/Moncton",
-	"posix/America/Monterrey",
-	"posix/America/Montevideo",
-	"posix/America/Montreal",
-	"posix/America/Montserrat",
-	"posix/America/Nassau",
-	"posix/America/New_York",
-	"posix/America/Nipigon",
-	"posix/America/Nome",
-	"posix/America/Noronha",
-	"posix/America/North_Dakota/Beulah",
-	"posix/America/North_Dakota/Center",
-	"posix/America/North_Dakota/New_Salem",
-	"posix/America/Nuuk",
-	"posix/America/Ojinaga",
-	"posix/America/Panama",
-	"posix/America/Pangnirtung",
-	"posix/America/Paramaribo",
-	"posix/America/Phoenix",
-	"posix/America/Port-au-Prince",
-	"posix/America/Porto_Acre",
-	"posix/America/Port_of_Spain",
-	"posix/America/Porto_Velho",
-	"posix/America/Puerto_Rico",
-	"posix/America/Punta_Arenas",
-	"posix/America/Rainy_River",
-	"posix/America/Rankin_Inlet",
-	"posix/America/Recife",
-	"posix/America/Regina",
-	"posix/America/Resolute",
-	"posix/America/Rio_Branco",
-	"posix/America/Rosario",
-	"posix/America/Santa_Isabel",
-	"posix/America/Santarem",
-	"posix/America/Santiago",
-	"posix/America/Santo_Domingo",
-	"posix/America/Sao_Paulo",
-	"posix/America/Scoresbysund",
-	"posix/America/Shiprock",
-	"posix/America/Sitka",
-	"posix/America/St_Barthelemy",
-	"posix/America/St_Johns",
-	"posix/America/St_Kitts",
-	"posix/America/St_Lucia",
-	"posix/America/St_Thomas",
-	"posix/America/St_Vincent",
-	"posix/America/Swift_Current",
-	"posix/America/Tegucigalpa",
-	"posix/America/Thule",
-	"posix/America/Thunder_Bay",
-	"posix/America/Tijuana",
-	"posix/America/Toronto",
-	"posix/America/Tortola",
-	"posix/America/Vancouver",
-	"posix/America/Virgin",
-	"posix/America/Whitehorse",
-	"posix/America/Winnipeg",
-	"posix/America/Yakutat",
-	"posix/America/Yellowknife",
-	"posix/Antarctica/Casey",
-	"posix/Antarctica/Davis",
-	"posix/Antarctica/DumontDUrville",
-	"posix/Antarctica/Macquarie",
-	"posix/Antarctica/Mawson",
-	"posix/Antarctica/McMurdo",
-	"posix/Antarctica/Palmer",
-	"posix/Antarctica/Rothera",
-	"posix/Antarctica/South_Pole",
-	"posix/Antarctica/Syowa",
-	"posix/Antarctica/Troll",
-	"posix/Antarctica/Vostok",
-	"posix/Arctic/Longyearbyen",
-	"posix/Asia/Aden",
-	"posix/Asia/Almaty",
-	"posix/Asia/Amman",
-	"posix/Asia/Anadyr",
-	"posix/Asia/Aqtau",
-	"posix/Asia/Aqtobe",
-	"posix/Asia/Ashgabat",
-	"posix/Asia/Ashkhabad",
-	"posix/Asia/Atyrau",
-	"posix/Asia/Baghdad",
-	"posix/Asia/Bahrain",
-	"posix/Asia/Baku",
-	"posix/Asia/Bangkok",
-	"posix/Asia/Barnaul",
-	"posix/Asia/Beirut",
-	"posix/Asia/Bishkek",
-	"posix/Asia/Brunei",
-	"posix/Asia/Calcutta",
-	"posix/Asia/Chita",
-	"posix/Asia/Choibalsan",
-	"posix/Asia/Chongqing",
-	"posix/Asia/Chungking",
-	"posix/Asia/Colombo",
-	"posix/Asia/Dacca",
-	"posix/Asia/Damascus",
-	"posix/Asia/Dhaka",
-	"posix/Asia/Dili",
-	"posix/Asia/Dubai",
-	"posix/Asia/Dushanbe",
-	"posix/Asia/Famagusta",
-	"posix/Asia/Gaza",
-	"posix/Asia/Harbin",
-	"posix/Asia/Hebron",
-	"posix/Asia/Ho_Chi_Minh",
-	"posix/Asia/Hong_Kong",
-	"posix/Asia/Hovd",
-	"posix/Asia/Irkutsk",
-	"posix/Asia/Istanbul",
-	"posix/Asia/Jakarta",
-	"posix/Asia/Jayapura",
-	"posix/Asia/Jerusalem",
-	"posix/Asia/Kabul",
-	"posix/Asia/Kamchatka",
-	"posix/Asia/Karachi",
-	"posix/Asia/Kashgar",
-	"posix/Asia/Kathmandu",
-	"posix/Asia/Katmandu",
-	"posix/Asia/Khandyga",
-	"posix/Asia/Kolkata",
-	"posix/Asia/Krasnoyarsk",
-	"posix/Asia/Kuala_Lumpur",
-	"posix/Asia/Kuching",
-	"posix/Asia/Kuwait",
-	"posix/Asia/Macao",
-	"posix/Asia/Macau",
-	"posix/Asia/Magadan",
-	"posix/Asia/Makassar",
-	"posix/Asia/Manila",
-	"posix/Asia/Muscat",
-	"posix/Asia/Nicosia",
-	"posix/Asia/Novokuznetsk",
-	"posix/Asia/Novosibirsk",
-	"posix/Asia/Omsk",
-	"posix/Asia/Oral",
-	"posix/Asia/Phnom_Penh",
-	"posix/Asia/Pontianak",
-	"posix/Asia/Pyongyang",
-	"posix/Asia/Qatar",
-	"posix/Asia/Qostanay",
-	"posix/Asia/Qyzylorda",
-	"posix/Asia/Rangoon",
-	"posix/Asia/Riyadh",
-	"posix/Asia/Saigon",
-	"posix/Asia/Sakhalin",
-	"posix/Asia/Samarkand",
-	"posix/Asia/Seoul",
-	"posix/Asia/Shanghai",
-	"posix/Asia/Singapore",
-	"posix/Asia/Srednekolymsk",
-	"posix/Asia/Taipei",
-	"posix/Asia/Tashkent",
-	"posix/Asia/Tbilisi",
-	"posix/Asia/Tehran",
-	"posix/Asia/Tel_Aviv",
-	"posix/Asia/Thimbu",
-	"posix/Asia/Thimphu",
-	"posix/Asia/Tokyo",
-	"posix/Asia/Tomsk",
-	"posix/Asia/Ujung_Pandang",
-	"posix/Asia/Ulaanbaatar",
-	"posix/Asia/Ulan_Bator",
-	"posix/Asia/Urumqi",
-	"posix/Asia/Ust-Nera",
-	"posix/Asia/Vientiane",
-	"posix/Asia/Vladivostok",
-	"posix/Asia/Yakutsk",
-	"posix/Asia/Yangon",
-	"posix/Asia/Yekaterinburg",
-	"posix/Asia/Yerevan",
-	"posix/Atlantic/Azores",
-	"posix/Atlantic/Bermuda",
-	"posix/Atlantic/Canary",
-	"posix/Atlantic/Cape_Verde",
-	"posix/Atlantic/Faeroe",
-	"posix/Atlantic/Faroe",
-	"posix/Atlantic/Jan_Mayen",
-	"posix/Atlantic/Madeira",
-	"posix/Atlantic/Reykjavik",
-	"posix/Atlantic/South_Georgia",
-	"posix/Atlantic/Stanley",
-	"posix/Atlantic/St_Helena",
-	"posix/Australia/ACT",
-	"posix/Australia/Adelaide",
-	"posix/Australia/Brisbane",
-	"posix/Australia/Broken_Hill",
-	"posix/Australia/Canberra",
-	"posix/Australia/Currie",
-	"posix/Australia/Darwin",
-	"posix/Australia/Eucla",
-	"posix/Australia/Hobart",
-	"posix/Australia/LHI",
-	"posix/Australia/Lindeman",
-	"posix/Australia/Lord_Howe",
-	"posix/Australia/Melbourne",
-	"posix/Australia/North",
-	"posix/Australia/NSW",
-	"posix/Australia/Perth",
-	"posix/Australia/Queensland",
-	"posix/Australia/South",
-	"posix/Australia/Sydney",
-	"posix/Australia/Tasmania",
-	"posix/Australia/Victoria",
-	"posix/Australia/West",
-	"posix/Australia/Yancowinna",
-	"posix/Brazil/Acre",
-	"posix/Brazil/DeNoronha",
-	"posix/Brazil/East",
-	"posix/Brazil/West",
-	"posix/Canada/Atlantic",
-	"posix/Canada/Central",
-	"posix/Canada/Eastern",
-	"posix/Canada/Mountain",
-	"posix/Canada/Newfoundland",
-	"posix/Canada/Pacific",
-	"posix/Canada/Saskatchewan",
-	"posix/Canada/Yukon",
-	"posix/CET",
-	"posix/Chile/Continental",
-	"posix/Chile/EasterIsland",
-	"posix/CST6CDT",
-	"posix/Cuba",
-	"posix/EET",
-	"posix/Egypt",
-	"posix/Eire",
-	"posix/EST",
-	"posix/EST5EDT",
-	"posix/Etc/GMT",
-	"posix/Etc/GMT+0",
-	"posix/Etc/GMT-0",
-	"posix/Etc/GMT0",
-	"posix/Etc/GMT+1",
-	"posix/Etc/GMT-1",
-	"posix/Etc/GMT+10",
-	"posix/Etc/GMT-10",
-	"posix/Etc/GMT+11",
-	"posix/Etc/GMT-11",
-	"posix/Etc/GMT+12",
-	"posix/Etc/GMT-12",
-	"posix/Etc/GMT-13",
-	"posix/Etc/GMT-14",
-	"posix/Etc/GMT+2",
-	"posix/Etc/GMT-2",
-	"posix/Etc/GMT+3",
-	"posix/Etc/GMT-3",
-	"posix/Etc/GMT+4",
-	"posix/Etc/GMT-4",
-	"posix/Etc/GMT+5",
-	"posix/Etc/GMT-5",
-	"posix/Etc/GMT+6",
-	"posix/Etc/GMT-6",
-	"posix/Etc/GMT+7",
-	"posix/Etc/GMT-7",
-	"posix/Etc/GMT+8",
-	"posix/Etc/GMT-8",
-	"posix/Etc/GMT+9",
-	"posix/Etc/GMT-9",
-	"posix/Etc/Greenwich",
-	"posix/Etc/UCT",
-	"posix/Etc/Universal",
-	"posix/Etc/UTC",
-	"posix/Etc/Zulu",
-	"posix/Europe/Amsterdam",
-}

From 2ec9be2203e559016955d6280d39c2d193599610 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Fri, 3 Oct 2025 14:11:08 -0600
Subject: [PATCH 054/298] fix: only show error once when failing to update org
 member roles (#20155)

---
 .../OrganizationMembersPageView.tsx                       | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/site/src/pages/OrganizationSettingsPage/OrganizationMembersPageView.tsx b/site/src/pages/OrganizationSettingsPage/OrganizationMembersPageView.tsx
index f720ba692d0ca..106f2d17d4914 100644
--- a/site/src/pages/OrganizationSettingsPage/OrganizationMembersPageView.tsx
+++ b/site/src/pages/OrganizationSettingsPage/OrganizationMembersPageView.tsx
@@ -149,14 +149,12 @@ export const OrganizationMembersPageView: FC<
 											isLoading={isUpdatingMemberRoles}
 											canEditUsers={canEditMembers}
 											onEditRoles={async (roles) => {
+												// React doesn't mind uncaught errors in event handlers,
+												// but testing-library does.
 												try {
 													await updateMemberRoles(member, roles);
 													displaySuccess("Roles updated successfully.");
-												} catch (error) {
-													displayError(
-														getErrorMessage(error, "Failed to update roles."),
-													);
-												}
+												} catch {}
 											}}
 										/>
 										<UserGroupsCell userGroups={member.groups} />

From c1357d4e275559221007a6efaef7a647af5217d0 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Sat, 4 Oct 2025 15:58:17 +0500
Subject: [PATCH 055/298] chore(dogfood): dogfood latest version of agentAPI
 (#20165)

---
 dogfood/coder/main.tf | 1 +
 1 file changed, 1 insertion(+)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 614b25cdb9ec8..cc223996ba7e9 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -872,6 +872,7 @@ module "claude-code" {
   claude_code_version = "latest"
   order               = 999
   claude_api_key      = data.coder_workspace_owner.me.session_token
+  agentapi_version    = "latest"
 
   system_prompt       = local.claude_system_prompt
   ai_prompt           = data.coder_parameter.ai_prompt.value

From d17dd5d7879f44518f9f0ce1ff2bd462e25d5ddc Mon Sep 17 00:00:00 2001
From: Sas Swart <sas.swart.cdk@gmail.com>
Date: Mon, 6 Oct 2025 10:56:43 +0200
Subject: [PATCH 056/298] feat: add filtering by initiator to provisioner job
 listing in the CLI (#20137)

Relates to https://github.com/coder/internal/issues/934

This PR provides a mechanism to filter provisioner jobs according to who
initiated the job.
This will be used to find pending prebuild jobs when prebuilds have
overwhelmed the provisioner job queue. They can then be canceled.

If prebuilds are overwhelming provisioners, the following steps will be
taken:

```bash
# pause prebuild reconciliation to limit provisioner queue pollution:
coder prebuilds pause
# cancel pending provisioner jobs to clear the queue
coder provisioner jobs list --initiator="prebuilds" --status="pending" | jq ... | xargs -n1 -I{} coder provisioner jobs cancel {}
# push a fixed template and wait for the import to complete
coder templates push ... # push a fixed template
# resume prebuild reconciliation
coder prebuilds resume
```

This interface differs somewhat from what was specified in the issue,
but still provides a mechanism that addresses the issue. The original
proposal was made by myself and this simpler implementation makes sense.
I might add a `--search` parameter in a follow-up if there is appetite
for it.

Potential follow ups:
* Support for this usage: `coder provisioner jobs list --search
"initiator:prebuilds status:pending"`
* Adding the same parameters to `coder provisioner jobs cancel` as a
convenience feature so that operators don't have to pipe through `jq`
and `xargs`
---
 cli/provisionerjobs.go                        |  27 ++-
 cli/provisionerjobs_test.go                   | 192 +++++++++++++++---
 cli/testdata/coder_list_--output_json.golden  |   1 +
 .../coder_provisioner_jobs_list_--help.golden |   5 +-
 ...provisioner_jobs_list_--output_json.golden |   2 +
 coderd/apidoc/docs.go                         |  11 +
 coderd/apidoc/swagger.json                    |  11 +
 coderd/database/dbauthz/dbauthz_test.go       |   2 +
 coderd/database/queries.sql.go                |   5 +-
 coderd/database/queries/provisionerjobs.sql   |   1 +
 coderd/provisionerjobs.go                     |   4 +
 coderd/provisionerjobs_test.go                | 102 ++++++++++
 codersdk/organizations.go                     |  12 +-
 codersdk/provisionerdaemons.go                |   1 +
 docs/reference/api/builds.md                  |   6 +
 docs/reference/api/organizations.md           |   4 +
 docs/reference/api/schemas.md                 |   6 +
 docs/reference/api/templates.md               |  11 +
 docs/reference/api/workspaces.md              |   6 +
 docs/reference/cli/provisioner_jobs_list.md   |  17 +-
 .../coder_provisioner_jobs_list_--help.golden |   5 +-
 site/src/api/typesGenerated.ts                |   2 +
 site/src/testHelpers/entities.ts              |   1 +
 23 files changed, 395 insertions(+), 39 deletions(-)

diff --git a/cli/provisionerjobs.go b/cli/provisionerjobs.go
index 3ce7da20b7dcb..3f441a1758045 100644
--- a/cli/provisionerjobs.go
+++ b/cli/provisionerjobs.go
@@ -43,8 +43,9 @@ func (r *RootCmd) provisionerJobsList() *serpent.Command {
 			cliui.TableFormat([]provisionerJobRow{}, []string{"created at", "id", "type", "template display name", "status", "queue", "tags"}),
 			cliui.JSONFormat(),
 		)
-		status []string
-		limit  int64
+		status    []string
+		limit     int64
+		initiator string
 	)
 
 	cmd := &serpent.Command{
@@ -65,9 +66,20 @@ func (r *RootCmd) provisionerJobsList() *serpent.Command {
 				return xerrors.Errorf("current organization: %w", err)
 			}
 
+			var initiatorID *uuid.UUID
+
+			if initiator != "" {
+				user, err := client.User(ctx, initiator)
+				if err != nil {
+					return xerrors.Errorf("initiator not found: %s", initiator)
+				}
+				initiatorID = &user.ID
+			}
+
 			jobs, err := client.OrganizationProvisionerJobs(ctx, org.ID, &codersdk.OrganizationProvisionerJobsOptions{
-				Status: slice.StringEnums[codersdk.ProvisionerJobStatus](status),
-				Limit:  int(limit),
+				Status:      slice.StringEnums[codersdk.ProvisionerJobStatus](status),
+				Limit:       int(limit),
+				InitiatorID: initiatorID,
 			})
 			if err != nil {
 				return xerrors.Errorf("list provisioner jobs: %w", err)
@@ -122,6 +134,13 @@ func (r *RootCmd) provisionerJobsList() *serpent.Command {
 			Default:       "50",
 			Value:         serpent.Int64Of(&limit),
 		},
+		{
+			Flag:          "initiator",
+			FlagShorthand: "i",
+			Env:           "CODER_PROVISIONER_JOB_LIST_INITIATOR",
+			Description:   "Filter by initiator (user ID or username).",
+			Value:         serpent.StringOf(&initiator),
+		},
 	}...)
 
 	orgContext.AttachOptions(cmd)
diff --git a/cli/provisionerjobs_test.go b/cli/provisionerjobs_test.go
index 4db42e8e3c9e7..57072a6156738 100644
--- a/cli/provisionerjobs_test.go
+++ b/cli/provisionerjobs_test.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"strings"
 	"testing"
 	"time"
 
@@ -26,33 +27,32 @@ import (
 func TestProvisionerJobs(t *testing.T) {
 	t.Parallel()
 
-	db, ps := dbtestutil.NewDB(t)
-	client, _, coderdAPI := coderdtest.NewWithAPI(t, &coderdtest.Options{
-		IncludeProvisionerDaemon: false,
-		Database:                 db,
-		Pubsub:                   ps,
-	})
-	owner := coderdtest.CreateFirstUser(t, client)
-	templateAdminClient, templateAdmin := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgTemplateAdmin(owner.OrganizationID))
-	memberClient, member := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
-
-	// These CLI tests are related to provisioner job CRUD operations and as such
-	// do not require the overhead of starting a provisioner. Other provisioner job
-	// functionalities (acquisition etc.) are tested elsewhere.
-	template := dbgen.Template(t, db, database.Template{
-		OrganizationID:               owner.OrganizationID,
-		CreatedBy:                    owner.UserID,
-		AllowUserCancelWorkspaceJobs: true,
-	})
-	version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
-		OrganizationID: owner.OrganizationID,
-		CreatedBy:      owner.UserID,
-		TemplateID:     uuid.NullUUID{UUID: template.ID, Valid: true},
-	})
-
 	t.Run("Cancel", func(t *testing.T) {
 		t.Parallel()
 
+		db, ps := dbtestutil.NewDB(t)
+		client, _, coderdAPI := coderdtest.NewWithAPI(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: false,
+			Database:                 db,
+			Pubsub:                   ps,
+		})
+		owner := coderdtest.CreateFirstUser(t, client)
+		templateAdminClient, templateAdmin := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID, rbac.ScopedRoleOrgTemplateAdmin(owner.OrganizationID))
+		memberClient, member := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		// These CLI tests are related to provisioner job CRUD operations and as such
+		// do not require the overhead of starting a provisioner. Other provisioner job
+		// functionalities (acquisition etc.) are tested elsewhere.
+		template := dbgen.Template(t, db, database.Template{
+			OrganizationID:               owner.OrganizationID,
+			CreatedBy:                    owner.UserID,
+			AllowUserCancelWorkspaceJobs: true,
+		})
+		version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      owner.UserID,
+			TemplateID:     uuid.NullUUID{UUID: template.ID, Valid: true},
+		})
 		// Test helper to create a provisioner job of a given type with a given input.
 		prepareJob := func(t *testing.T, jobType database.ProvisionerJobType, input json.RawMessage) database.ProvisionerJob {
 			t.Helper()
@@ -178,4 +178,148 @@ func TestProvisionerJobs(t *testing.T) {
 			})
 		}
 	})
+
+	t.Run("List", func(t *testing.T) {
+		t.Parallel()
+
+		db, ps := dbtestutil.NewDB(t)
+		client, _, coderdAPI := coderdtest.NewWithAPI(t, &coderdtest.Options{
+			IncludeProvisionerDaemon: false,
+			Database:                 db,
+			Pubsub:                   ps,
+		})
+		owner := coderdtest.CreateFirstUser(t, client)
+		_, member := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		// These CLI tests are related to provisioner job CRUD operations and as such
+		// do not require the overhead of starting a provisioner. Other provisioner job
+		// functionalities (acquisition etc.) are tested elsewhere.
+		template := dbgen.Template(t, db, database.Template{
+			OrganizationID:               owner.OrganizationID,
+			CreatedBy:                    owner.UserID,
+			AllowUserCancelWorkspaceJobs: true,
+		})
+		version := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      owner.UserID,
+			TemplateID:     uuid.NullUUID{UUID: template.ID, Valid: true},
+		})
+		// Create some test jobs
+		job1 := dbgen.ProvisionerJob(t, db, coderdAPI.Pubsub, database.ProvisionerJob{
+			OrganizationID: owner.OrganizationID,
+			InitiatorID:    owner.UserID,
+			Type:           database.ProvisionerJobTypeTemplateVersionImport,
+			Input:          []byte(`{"template_version_id":"` + version.ID.String() + `"}`),
+			Tags:           database.StringMap{provisionersdk.TagScope: provisionersdk.ScopeOrganization},
+		})
+
+		job2 := dbgen.ProvisionerJob(t, db, coderdAPI.Pubsub, database.ProvisionerJob{
+			OrganizationID: owner.OrganizationID,
+			InitiatorID:    member.ID,
+			Type:           database.ProvisionerJobTypeWorkspaceBuild,
+			Input:          []byte(`{"workspace_build_id":"` + uuid.New().String() + `"}`),
+			Tags:           database.StringMap{provisionersdk.TagScope: provisionersdk.ScopeOrganization},
+		})
+		// Test basic list command
+		t.Run("Basic", func(t *testing.T) {
+			t.Parallel()
+
+			inv, root := clitest.New(t, "provisioner", "jobs", "list")
+			clitest.SetupConfig(t, client, root)
+			var buf bytes.Buffer
+			inv.Stdout = &buf
+			err := inv.Run()
+			require.NoError(t, err)
+
+			// Should contain both jobs
+			output := buf.String()
+			assert.Contains(t, output, job1.ID.String())
+			assert.Contains(t, output, job2.ID.String())
+		})
+
+		// Test list with JSON output
+		t.Run("JSON", func(t *testing.T) {
+			t.Parallel()
+
+			inv, root := clitest.New(t, "provisioner", "jobs", "list", "--output", "json")
+			clitest.SetupConfig(t, client, root)
+			var buf bytes.Buffer
+			inv.Stdout = &buf
+			err := inv.Run()
+			require.NoError(t, err)
+
+			// Parse JSON output
+			var jobs []codersdk.ProvisionerJob
+			err = json.Unmarshal(buf.Bytes(), &jobs)
+			require.NoError(t, err)
+
+			// Should contain both jobs
+			jobIDs := make([]uuid.UUID, len(jobs))
+			for i, job := range jobs {
+				jobIDs[i] = job.ID
+			}
+			assert.Contains(t, jobIDs, job1.ID)
+			assert.Contains(t, jobIDs, job2.ID)
+		})
+
+		// Test list with limit
+		t.Run("Limit", func(t *testing.T) {
+			t.Parallel()
+
+			inv, root := clitest.New(t, "provisioner", "jobs", "list", "--limit", "1")
+			clitest.SetupConfig(t, client, root)
+			var buf bytes.Buffer
+			inv.Stdout = &buf
+			err := inv.Run()
+			require.NoError(t, err)
+
+			// Should contain at most 1 job
+			output := buf.String()
+			jobCount := 0
+			if strings.Contains(output, job1.ID.String()) {
+				jobCount++
+			}
+			if strings.Contains(output, job2.ID.String()) {
+				jobCount++
+			}
+			assert.LessOrEqual(t, jobCount, 1)
+		})
+
+		// Test list with initiator filter
+		t.Run("InitiatorFilter", func(t *testing.T) {
+			t.Parallel()
+
+			// Get owner user details to access username
+			ctx := testutil.Context(t, testutil.WaitShort)
+			ownerUser, err := client.User(ctx, owner.UserID.String())
+			require.NoError(t, err)
+
+			// Test filtering by initiator (using username)
+			inv, root := clitest.New(t, "provisioner", "jobs", "list", "--initiator", ownerUser.Username)
+			clitest.SetupConfig(t, client, root)
+			var buf bytes.Buffer
+			inv.Stdout = &buf
+			err = inv.Run()
+			require.NoError(t, err)
+
+			// Should only contain job1 (initiated by owner)
+			output := buf.String()
+			assert.Contains(t, output, job1.ID.String())
+			assert.NotContains(t, output, job2.ID.String())
+		})
+
+		// Test list with invalid user
+		t.Run("InvalidUser", func(t *testing.T) {
+			t.Parallel()
+
+			// Test with non-existent user
+			inv, root := clitest.New(t, "provisioner", "jobs", "list", "--initiator", "nonexistent-user")
+			clitest.SetupConfig(t, client, root)
+			var buf bytes.Buffer
+			inv.Stdout = &buf
+			err := inv.Run()
+			require.Error(t, err)
+			assert.Contains(t, err.Error(), "initiator not found: nonexistent-user")
+		})
+	})
 }
diff --git a/cli/testdata/coder_list_--output_json.golden b/cli/testdata/coder_list_--output_json.golden
index 82b73f7b24989..66afcf563dfbd 100644
--- a/cli/testdata/coder_list_--output_json.golden
+++ b/cli/testdata/coder_list_--output_json.golden
@@ -45,6 +45,7 @@
         "queue_position": 0,
         "queue_size": 0,
         "organization_id": "===========[first org ID]===========",
+        "initiator_id": "==========[first user ID]===========",
         "input": {
           "workspace_build_id": "========[workspace build ID]========"
         },
diff --git a/cli/testdata/coder_provisioner_jobs_list_--help.golden b/cli/testdata/coder_provisioner_jobs_list_--help.golden
index 8e22f78e978f2..3a581bd880829 100644
--- a/cli/testdata/coder_provisioner_jobs_list_--help.golden
+++ b/cli/testdata/coder_provisioner_jobs_list_--help.golden
@@ -11,9 +11,12 @@ OPTIONS:
   -O, --org string, $CODER_ORGANIZATION
           Select which organization (uuid or name) to use.
 
-  -c, --column [id|created at|started at|completed at|canceled at|error|error code|status|worker id|worker name|file id|tags|queue position|queue size|organization id|template version id|workspace build id|type|available workers|template version name|template id|template name|template display name|template icon|workspace id|workspace name|logs overflowed|organization|queue] (default: created at,id,type,template display name,status,queue,tags)
+  -c, --column [id|created at|started at|completed at|canceled at|error|error code|status|worker id|worker name|file id|tags|queue position|queue size|organization id|initiator id|template version id|workspace build id|type|available workers|template version name|template id|template name|template display name|template icon|workspace id|workspace name|logs overflowed|organization|queue] (default: created at,id,type,template display name,status,queue,tags)
           Columns to display in table output.
 
+  -i, --initiator string, $CODER_PROVISIONER_JOB_LIST_INITIATOR
+          Filter by initiator (user ID or username).
+
   -l, --limit int, $CODER_PROVISIONER_JOB_LIST_LIMIT (default: 50)
           Limit the number of jobs returned.
 
diff --git a/cli/testdata/coder_provisioner_jobs_list_--output_json.golden b/cli/testdata/coder_provisioner_jobs_list_--output_json.golden
index 6ccf672360a55..3ee6c25e34082 100644
--- a/cli/testdata/coder_provisioner_jobs_list_--output_json.golden
+++ b/cli/testdata/coder_provisioner_jobs_list_--output_json.golden
@@ -15,6 +15,7 @@
     "queue_position": 0,
     "queue_size": 0,
     "organization_id": "===========[first org ID]===========",
+    "initiator_id": "==========[first user ID]===========",
     "input": {
       "template_version_id": "============[version ID]============"
     },
@@ -45,6 +46,7 @@
     "queue_position": 0,
     "queue_size": 0,
     "organization_id": "===========[first org ID]===========",
+    "initiator_id": "==========[first user ID]===========",
     "input": {
       "workspace_build_id": "========[workspace build ID]========"
     },
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index b93c647dad689..289e4c9a3fee9 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -3744,6 +3744,13 @@ const docTemplate = `{
                         "description": "Provisioner tags to filter by (JSON of the form {'tag1':'value1','tag2':'value2'})",
                         "name": "tags",
                         "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Filter results by initiator",
+                        "name": "initiator",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -15974,6 +15981,10 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
+                "initiator_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
                 "input": {
                     "$ref": "#/definitions/codersdk.ProvisionerJobInput"
                 },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 731e1720c09bc..4b3d4c86aaf34 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -3299,6 +3299,13 @@
 						"description": "Provisioner tags to filter by (JSON of the form {'tag1':'value1','tag2':'value2'})",
 						"name": "tags",
 						"in": "query"
+					},
+					{
+						"type": "string",
+						"format": "uuid",
+						"description": "Filter results by initiator",
+						"name": "initiator",
+						"in": "query"
 					}
 				],
 				"responses": {
@@ -14532,6 +14539,10 @@
 					"type": "string",
 					"format": "uuid"
 				},
+				"initiator_id": {
+					"type": "string",
+					"format": "uuid"
+				},
 				"input": {
 					"$ref": "#/definitions/codersdk.ProvisionerJobInput"
 				},
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 730d5f3198478..39350ad948ff0 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -2484,10 +2484,12 @@ func (s *MethodTestSuite) TestExtraMethods() {
 
 		ds, err := db.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisioner(context.Background(), database.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams{
 			OrganizationID: org.ID,
+			InitiatorID:    uuid.Nil,
 		})
 		s.NoError(err, "get provisioner jobs by org")
 		check.Args(database.GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams{
 			OrganizationID: org.ID,
+			InitiatorID:    uuid.Nil,
 		}).Asserts(j1, policy.ActionRead, j2, policy.ActionRead).Returns(ds)
 	}))
 }
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 6bf1a3e25d8a0..3612375b8b26c 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -9834,6 +9834,7 @@ WHERE
 	AND (COALESCE(array_length($2::uuid[], 1), 0) = 0 OR pj.id = ANY($2::uuid[]))
 	AND (COALESCE(array_length($3::provisioner_job_status[], 1), 0) = 0 OR pj.job_status = ANY($3::provisioner_job_status[]))
 	AND ($4::tagset = 'null'::tagset OR provisioner_tagset_contains(pj.tags::tagset, $4::tagset))
+	AND ($5::uuid = '00000000-0000-0000-0000-000000000000'::uuid OR pj.initiator_id = $5::uuid)
 GROUP BY
 	pj.id,
 	qp.queue_position,
@@ -9849,7 +9850,7 @@ GROUP BY
 ORDER BY
 	pj.created_at DESC
 LIMIT
-	$5::int
+	$6::int
 `
 
 type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerParams struct {
@@ -9857,6 +9858,7 @@ type GetProvisionerJobsByOrganizationAndStatusWithQueuePositionAndProvisionerPar
 	IDs            []uuid.UUID            `db:"ids" json:"ids"`
 	Status         []ProvisionerJobStatus `db:"status" json:"status"`
 	Tags           StringMap              `db:"tags" json:"tags"`
+	InitiatorID    uuid.UUID              `db:"initiator_id" json:"initiator_id"`
 	Limit          sql.NullInt32          `db:"limit" json:"limit"`
 }
 
@@ -9881,6 +9883,7 @@ func (q *sqlQuerier) GetProvisionerJobsByOrganizationAndStatusWithQueuePositionA
 		pq.Array(arg.IDs),
 		pq.Array(arg.Status),
 		arg.Tags,
+		arg.InitiatorID,
 		arg.Limit,
 	)
 	if err != nil {
diff --git a/coderd/database/queries/provisionerjobs.sql b/coderd/database/queries/provisionerjobs.sql
index dfc95a0bb4570..02d67d628a861 100644
--- a/coderd/database/queries/provisionerjobs.sql
+++ b/coderd/database/queries/provisionerjobs.sql
@@ -224,6 +224,7 @@ WHERE
 	AND (COALESCE(array_length(@ids::uuid[], 1), 0) = 0 OR pj.id = ANY(@ids::uuid[]))
 	AND (COALESCE(array_length(@status::provisioner_job_status[], 1), 0) = 0 OR pj.job_status = ANY(@status::provisioner_job_status[]))
 	AND (@tags::tagset = 'null'::tagset OR provisioner_tagset_contains(pj.tags::tagset, @tags::tagset))
+	AND (@initiator_id::uuid = '00000000-0000-0000-0000-000000000000'::uuid OR pj.initiator_id = @initiator_id::uuid)
 GROUP BY
 	pj.id,
 	qp.queue_position,
diff --git a/coderd/provisionerjobs.go b/coderd/provisionerjobs.go
index e9ab5260988d4..4ba923dae2477 100644
--- a/coderd/provisionerjobs.go
+++ b/coderd/provisionerjobs.go
@@ -76,6 +76,7 @@ func (api *API) provisionerJob(rw http.ResponseWriter, r *http.Request) {
 // @Param ids query []string false "Filter results by job IDs" format(uuid)
 // @Param status query codersdk.ProvisionerJobStatus false "Filter results by status" enums(pending,running,succeeded,canceling,canceled,failed)
 // @Param tags query object false "Provisioner tags to filter by (JSON of the form {'tag1':'value1','tag2':'value2'})"
+// @Param initiator query string false "Filter results by initiator" format(uuid)
 // @Success 200 {array} codersdk.ProvisionerJob
 // @Router /organizations/{organization}/provisionerjobs [get]
 func (api *API) provisionerJobs(rw http.ResponseWriter, r *http.Request) {
@@ -110,6 +111,7 @@ func (api *API) handleAuthAndFetchProvisionerJobs(rw http.ResponseWriter, r *htt
 		ids = p.UUIDs(qp, nil, "ids")
 	}
 	tags := p.JSONStringMap(qp, database.StringMap{}, "tags")
+	initiatorID := p.UUID(qp, uuid.Nil, "initiator_id")
 	p.ErrorExcessParams(qp)
 	if len(p.Errors) > 0 {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -125,6 +127,7 @@ func (api *API) handleAuthAndFetchProvisionerJobs(rw http.ResponseWriter, r *htt
 		Limit:          sql.NullInt32{Int32: limit, Valid: limit > 0},
 		IDs:            ids,
 		Tags:           tags,
+		InitiatorID:    initiatorID,
 	})
 	if err != nil {
 		if httpapi.Is404Error(err) {
@@ -355,6 +358,7 @@ func convertProvisionerJob(pj database.GetProvisionerJobsByIDsWithQueuePositionR
 	job := codersdk.ProvisionerJob{
 		ID:             provisionerJob.ID,
 		OrganizationID: provisionerJob.OrganizationID,
+		InitiatorID:    provisionerJob.InitiatorID,
 		CreatedAt:      provisionerJob.CreatedAt,
 		Type:           codersdk.ProvisionerJobType(provisionerJob.Type),
 		Error:          provisionerJob.Error.String,
diff --git a/coderd/provisionerjobs_test.go b/coderd/provisionerjobs_test.go
index 98da3ae5584e6..829c72aa4dbd0 100644
--- a/coderd/provisionerjobs_test.go
+++ b/coderd/provisionerjobs_test.go
@@ -58,6 +58,8 @@ func TestProvisionerJobs(t *testing.T) {
 			StartedAt:      sql.NullTime{Time: dbtime.Now(), Valid: true},
 			Type:           database.ProvisionerJobTypeWorkspaceBuild,
 			Input:          json.RawMessage(`{"workspace_build_id":"` + wbID.String() + `"}`),
+			InitiatorID:    member.ID,
+			Tags:           database.StringMap{"initiatorTest": "true"},
 		})
 		dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
 			ID:                wbID,
@@ -71,6 +73,7 @@ func TestProvisionerJobs(t *testing.T) {
 			dbgen.ProvisionerJob(t, db, nil, database.ProvisionerJob{
 				OrganizationID: owner.OrganizationID,
 				Tags:           database.StringMap{"count": strconv.Itoa(i)},
+				InitiatorID:    owner.UserID,
 			})
 		}
 
@@ -165,6 +168,94 @@ func TestProvisionerJobs(t *testing.T) {
 			require.Len(t, jobs, 1)
 		})
 
+		t.Run("Initiator", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+
+			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: &member.ID,
+			})
+			require.NoError(t, err)
+			require.GreaterOrEqual(t, len(jobs), 1)
+			require.Equal(t, member.ID, jobs[0].InitiatorID)
+		})
+
+		t.Run("InitiatorWithOtherFilters", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+
+			// Test filtering by initiator ID combined with status filter
+			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: &owner.UserID,
+				Status:      []codersdk.ProvisionerJobStatus{codersdk.ProvisionerJobSucceeded},
+			})
+			require.NoError(t, err)
+
+			// Verify all returned jobs have the correct initiator and status
+			for _, job := range jobs {
+				require.Equal(t, owner.UserID, job.InitiatorID)
+				require.Equal(t, codersdk.ProvisionerJobSucceeded, job.Status)
+			}
+		})
+
+		t.Run("InitiatorWithLimit", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+
+			// Test filtering by initiator ID with limit
+			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: &owner.UserID,
+				Limit:       1,
+			})
+			require.NoError(t, err)
+			require.Len(t, jobs, 1)
+
+			// Verify the returned job has the correct initiator
+			require.Equal(t, owner.UserID, jobs[0].InitiatorID)
+		})
+
+		t.Run("InitiatorWithTags", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+
+			// Test filtering by initiator ID combined with tags
+			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: &member.ID,
+				Tags:        map[string]string{"initiatorTest": "true"},
+			})
+			require.NoError(t, err)
+			require.Len(t, jobs, 1)
+
+			// Verify the returned job has the correct initiator and tags
+			require.Equal(t, member.ID, jobs[0].InitiatorID)
+			require.Equal(t, "true", jobs[0].Tags["initiatorTest"])
+		})
+
+		t.Run("InitiatorNotFound", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+
+			// Test with non-existent initiator ID
+			nonExistentID := uuid.New()
+			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: &nonExistentID,
+			})
+			require.NoError(t, err)
+			require.Len(t, jobs, 0)
+		})
+
+		t.Run("InitiatorNil", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+
+			// Test with nil initiator ID (should return all jobs)
+			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: nil,
+			})
+			require.NoError(t, err)
+			require.GreaterOrEqual(t, len(jobs), 50) // Should return all jobs (up to default limit)
+		})
+
 		t.Run("Limit", func(t *testing.T) {
 			t.Parallel()
 			ctx := testutil.Context(t, testutil.WaitMedium)
@@ -185,6 +276,17 @@ func TestProvisionerJobs(t *testing.T) {
 			require.Error(t, err)
 			require.Len(t, jobs, 0)
 		})
+
+		t.Run("MemberDeniedWithInitiator", func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitMedium)
+			// Member should not be able to access jobs even with initiator filter
+			jobs, err := memberClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
+				InitiatorID: &member.ID,
+			})
+			require.Error(t, err)
+			require.Len(t, jobs, 0)
+		})
 	})
 
 	// Ensures that when a provisioner job is in the succeeded state,
diff --git a/codersdk/organizations.go b/codersdk/organizations.go
index bca87c7bd4591..291bb9ac1baf7 100644
--- a/codersdk/organizations.go
+++ b/codersdk/organizations.go
@@ -397,10 +397,11 @@ func (c *Client) OrganizationProvisionerDaemons(ctx context.Context, organizatio
 }
 
 type OrganizationProvisionerJobsOptions struct {
-	Limit  int
-	IDs    []uuid.UUID
-	Status []ProvisionerJobStatus
-	Tags   map[string]string
+	Limit       int
+	IDs         []uuid.UUID
+	Status      []ProvisionerJobStatus
+	Tags        map[string]string
+	InitiatorID *uuid.UUID
 }
 
 func (c *Client) OrganizationProvisionerJobs(ctx context.Context, organizationID uuid.UUID, opts *OrganizationProvisionerJobsOptions) ([]ProvisionerJob, error) {
@@ -422,6 +423,9 @@ func (c *Client) OrganizationProvisionerJobs(ctx context.Context, organizationID
 			}
 			qp.Add("tags", string(tagsRaw))
 		}
+		if opts.InitiatorID != nil {
+			qp.Add("initiator_id", opts.InitiatorID.String())
+		}
 	}
 
 	res, err := c.Request(ctx, http.MethodGet,
diff --git a/codersdk/provisionerdaemons.go b/codersdk/provisionerdaemons.go
index b3cefa09110ec..19f8cae546118 100644
--- a/codersdk/provisionerdaemons.go
+++ b/codersdk/provisionerdaemons.go
@@ -198,6 +198,7 @@ type ProvisionerJob struct {
 	QueuePosition    int                    `json:"queue_position" table:"queue position"`
 	QueueSize        int                    `json:"queue_size" table:"queue size"`
 	OrganizationID   uuid.UUID              `json:"organization_id" format:"uuid" table:"organization id"`
+	InitiatorID      uuid.UUID              `json:"initiator_id" format:"uuid" table:"initiator id"`
 	Input            ProvisionerJobInput    `json:"input" table:"input,recursive_inline"`
 	Type             ProvisionerJobType     `json:"type" table:"type"`
 	AvailableWorkers []uuid.UUID            `json:"available_workers,omitempty" format:"uuid" table:"available workers"`
diff --git a/docs/reference/api/builds.md b/docs/reference/api/builds.md
index 232509052b7b0..41df0b9efaf30 100644
--- a/docs/reference/api/builds.md
+++ b/docs/reference/api/builds.md
@@ -48,6 +48,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -288,6 +289,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1019,6 +1021,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1332,6 +1335,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1551,6 +1555,7 @@ Status Code **200**
 | `»» error_code`                  | [codersdk.JobErrorCode](schemas.md#codersdkjoberrorcode)                                               | false    |              |                                                                                                                                                                                                                                                |
 | `»» file_id`                     | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
 | `»» id`                          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `»» initiator_id`                | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
 | `»» input`                       | [codersdk.ProvisionerJobInput](schemas.md#codersdkprovisionerjobinput)                                 | false    |              |                                                                                                                                                                                                                                                |
 | `»»» error`                      | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
 | `»»» template_version_id`        | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
@@ -1829,6 +1834,7 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
diff --git a/docs/reference/api/organizations.md b/docs/reference/api/organizations.md
index d418a1fcba106..ffd6f78405fb1 100644
--- a/docs/reference/api/organizations.md
+++ b/docs/reference/api/organizations.md
@@ -366,6 +366,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/provisi
 | `ids`          | query | array(uuid)  | false    | Filter results by job IDs                                                          |
 | `status`       | query | string       | false    | Filter results by status                                                           |
 | `tags`         | query | object       | false    | Provisioner tags to filter by (JSON of the form {'tag1':'value1','tag2':'value2'}) |
+| `initiator`    | query | string(uuid) | false    | Filter results by initiator                                                        |
 
 #### Enumerated Values
 
@@ -402,6 +403,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/provisi
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -454,6 +456,7 @@ Status Code **200**
 | `» error_code`             | [codersdk.JobErrorCode](schemas.md#codersdkjoberrorcode)                     | false    |              |             |
 | `» file_id`                | string(uuid)                                                                 | false    |              |             |
 | `» id`                     | string(uuid)                                                                 | false    |              |             |
+| `» initiator_id`           | string(uuid)                                                                 | false    |              |             |
 | `» input`                  | [codersdk.ProvisionerJobInput](schemas.md#codersdkprovisionerjobinput)       | false    |              |             |
 | `»» error`                 | string                                                                       | false    |              |             |
 | `»» template_version_id`   | string(uuid)                                                                 | false    |              |             |
@@ -531,6 +534,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/provisi
   "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
   "input": {
     "error": "string",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 98324941a1c70..33cb280ae15c0 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -6390,6 +6390,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
   "input": {
     "error": "string",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -6432,6 +6433,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `error_code`        | [codersdk.JobErrorCode](#codersdkjoberrorcode)                     | false    |              |             |
 | `file_id`           | string                                                             | false    |              |             |
 | `id`                | string                                                             | false    |              |             |
+| `initiator_id`      | string                                                             | false    |              |             |
 | `input`             | [codersdk.ProvisionerJobInput](#codersdkprovisionerjobinput)       | false    |              |             |
 | `logs_overflowed`   | boolean                                                            | false    |              |             |
 | `metadata`          | [codersdk.ProvisionerJobMetadata](#codersdkprovisionerjobmetadata) | false    |              |             |
@@ -8118,6 +8120,7 @@ Restarts will only happen on weekdays in this list on weeks which line up with W
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -9386,6 +9389,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -10553,6 +10557,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -11389,6 +11394,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           "error_code": "REQUIRED_TEMPLATE_VARIABLES",
           "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
           "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+          "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
           "input": {
             "error": "string",
             "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
diff --git a/docs/reference/api/templates.md b/docs/reference/api/templates.md
index efc59cf7b5743..9d69949ac7cf9 100644
--- a/docs/reference/api/templates.md
+++ b/docs/reference/api/templates.md
@@ -475,6 +475,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -575,6 +576,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -699,6 +701,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1306,6 +1309,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions \
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1382,6 +1386,7 @@ Status Code **200**
 | `»» error_code`             | [codersdk.JobErrorCode](schemas.md#codersdkjoberrorcode)                     | false    |              |                                                                                                                                                                     |
 | `»» file_id`                | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
 | `»» id`                     | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
+| `»» initiator_id`           | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
 | `»» input`                  | [codersdk.ProvisionerJobInput](schemas.md#codersdkprovisionerjobinput)       | false    |              |                                                                                                                                                                     |
 | `»»» error`                 | string                                                                       | false    |              |                                                                                                                                                                     |
 | `»»» template_version_id`   | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
@@ -1589,6 +1594,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions/{templ
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1665,6 +1671,7 @@ Status Code **200**
 | `»» error_code`             | [codersdk.JobErrorCode](schemas.md#codersdkjoberrorcode)                     | false    |              |                                                                                                                                                                     |
 | `»» file_id`                | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
 | `»» id`                     | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
+| `»» initiator_id`           | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
 | `»» input`                  | [codersdk.ProvisionerJobInput](schemas.md#codersdkprovisionerjobinput)       | false    |              |                                                                                                                                                                     |
 | `»»» error`                 | string                                                                       | false    |              |                                                                                                                                                                     |
 | `»»» template_version_id`   | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
@@ -1762,6 +1769,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion} \
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1871,6 +1879,7 @@ curl -X PATCH http://coder-server:8080/api/v2/templateversions/{templateversion}
     "error_code": "REQUIRED_TEMPLATE_VARIABLES",
     "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
     "input": {
       "error": "string",
       "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -2069,6 +2078,7 @@ curl -X POST http://coder-server:8080/api/v2/templateversions/{templateversion}/
   "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
   "input": {
     "error": "string",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -2143,6 +2153,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion}/d
   "error_code": "REQUIRED_TEMPLATE_VARIABLES",
   "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
   "input": {
     "error": "string",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
diff --git a/docs/reference/api/workspaces.md b/docs/reference/api/workspaces.md
index 455fefcb57749..e2a95613ed263 100644
--- a/docs/reference/api/workspaces.md
+++ b/docs/reference/api/workspaces.md
@@ -103,6 +103,7 @@ of the template will be used.
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -393,6 +394,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -708,6 +710,7 @@ of the template will be used.
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1001,6 +1004,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
           "error_code": "REQUIRED_TEMPLATE_VARIABLES",
           "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
           "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+          "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
           "input": {
             "error": "string",
             "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1275,6 +1279,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
@@ -1824,6 +1829,7 @@ curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/dormant \
       "error_code": "REQUIRED_TEMPLATE_VARIABLES",
       "file_id": "8a0cfb4f-ddc9-436d-91bb-75133c583767",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
       "input": {
         "error": "string",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
diff --git a/docs/reference/cli/provisioner_jobs_list.md b/docs/reference/cli/provisioner_jobs_list.md
index a0bff8554d610..0167dd467d60a 100644
--- a/docs/reference/cli/provisioner_jobs_list.md
+++ b/docs/reference/cli/provisioner_jobs_list.md
@@ -34,6 +34,15 @@ Filter by job status.
 
 Limit the number of jobs returned.
 
+### -i, --initiator
+
+|             |                                                    |
+|-------------|----------------------------------------------------|
+| Type        | <code>string</code>                                |
+| Environment | <code>$CODER_PROVISIONER_JOB_LIST_INITIATOR</code> |
+
+Filter by initiator (user ID or username).
+
 ### -O, --org
 
 |             |                                  |
@@ -45,10 +54,10 @@ Select which organization (uuid or name) to use.
 
 ### -c, --column
 
-|         |                                                                                                                                                                                                                                                                                                                                                                                                                    |
-|---------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Type    | <code>[id\|created at\|started at\|completed at\|canceled at\|error\|error code\|status\|worker id\|worker name\|file id\|tags\|queue position\|queue size\|organization id\|template version id\|workspace build id\|type\|available workers\|template version name\|template id\|template name\|template display name\|template icon\|workspace id\|workspace name\|logs overflowed\|organization\|queue]</code> |
-| Default | <code>created at,id,type,template display name,status,queue,tags</code>                                                                                                                                                                                                                                                                                                                                            |
+|         |                                                                                                                                                                                                                                                                                                                                                                                                                                  |
+|---------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Type    | <code>[id\|created at\|started at\|completed at\|canceled at\|error\|error code\|status\|worker id\|worker name\|file id\|tags\|queue position\|queue size\|organization id\|initiator id\|template version id\|workspace build id\|type\|available workers\|template version name\|template id\|template name\|template display name\|template icon\|workspace id\|workspace name\|logs overflowed\|organization\|queue]</code> |
+| Default | <code>created at,id,type,template display name,status,queue,tags</code>                                                                                                                                                                                                                                                                                                                                                          |
 
 Columns to display in table output.
 
diff --git a/enterprise/cli/testdata/coder_provisioner_jobs_list_--help.golden b/enterprise/cli/testdata/coder_provisioner_jobs_list_--help.golden
index 8e22f78e978f2..3a581bd880829 100644
--- a/enterprise/cli/testdata/coder_provisioner_jobs_list_--help.golden
+++ b/enterprise/cli/testdata/coder_provisioner_jobs_list_--help.golden
@@ -11,9 +11,12 @@ OPTIONS:
   -O, --org string, $CODER_ORGANIZATION
           Select which organization (uuid or name) to use.
 
-  -c, --column [id|created at|started at|completed at|canceled at|error|error code|status|worker id|worker name|file id|tags|queue position|queue size|organization id|template version id|workspace build id|type|available workers|template version name|template id|template name|template display name|template icon|workspace id|workspace name|logs overflowed|organization|queue] (default: created at,id,type,template display name,status,queue,tags)
+  -c, --column [id|created at|started at|completed at|canceled at|error|error code|status|worker id|worker name|file id|tags|queue position|queue size|organization id|initiator id|template version id|workspace build id|type|available workers|template version name|template id|template name|template display name|template icon|workspace id|workspace name|logs overflowed|organization|queue] (default: created at,id,type,template display name,status,queue,tags)
           Columns to display in table output.
 
+  -i, --initiator string, $CODER_PROVISIONER_JOB_LIST_INITIATOR
+          Filter by initiator (user ID or username).
+
   -l, --limit int, $CODER_PROVISIONER_JOB_LIST_LIMIT (default: 50)
           Limit the number of jobs returned.
 
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 0519c9c136cec..e7c612078b6f3 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -2060,6 +2060,7 @@ export interface OrganizationProvisionerJobsOptions {
 	readonly IDs: readonly string[];
 	readonly Status: readonly ProvisionerJobStatus[];
 	readonly Tags: Record<string, string>;
+	readonly InitiatorID: string | null;
 }
 
 // From codersdk/idpsync.go
@@ -2379,6 +2380,7 @@ export interface ProvisionerJob {
 	readonly queue_position: number;
 	readonly queue_size: number;
 	readonly organization_id: string;
+	readonly initiator_id: string;
 	readonly input: ProvisionerJobInput;
 	readonly type: ProvisionerJobType;
 	readonly available_workers?: readonly string[];
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 19c414bdd3158..0b8d87f8111ef 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -679,6 +679,7 @@ export const MockProvisionerJob: TypesGen.ProvisionerJob = {
 	status: "succeeded",
 	file_id: MockOrganization.id,
 	completed_at: "2022-05-17T17:39:01.382927298Z",
+	initiator_id: MockUserMember.id,
 	tags: {
 		scope: "organization",
 		owner: "",

From b60ae0a0c44457c7c655faa3fd4b5f13d1d0af15 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Mon, 6 Oct 2025 12:08:17 +0200
Subject: [PATCH 057/298] refactor: add wildcard scope entries for API key
 scopes (#20032)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

# Add API Key Scope Wildcards

This PR adds wildcard API key scopes (`resource:*`) for all RBAC resources to ensure every resource has a matching wildcard value. It also adds all individual `resource:action`​ scopes to the API documentation and TypeScript definitions.

The changes include:

- Adding a new database migration (000377) that adds wildcard API key scopes
- Updating the API documentation to include all available scopes
- Enhancing the scope generation scripts to include all resource wildcards
- Updating the TypeScript definitions to match the expanded scope list

These changes make creating API keys with comprehensive permissions for specific resource types easier.
---
 coderd/apidoc/docs.go                         | 300 +++++++++++++++++-
 coderd/apidoc/swagger.json                    | 300 +++++++++++++++++-
 coderd/database/dump.sql                      |  42 ++-
 ...00377_add_api_key_scope_wildcards.down.sql |   2 +
 .../000377_add_api_key_scope_wildcards.up.sql |  42 +++
 coderd/database/models.go                     | 122 ++++++-
 codersdk/apikey_scopes_gen.go                 | 228 ++++++++++---
 docs/reference/api/schemas.md                 | 234 +++++++++++---
 scripts/apikeyscopesgen/main.go               |  70 +++-
 scripts/check-scopes/main.go                  |  24 +-
 scripts/generate_api_key_scope_enum/main.go   |  32 --
 site/src/api/typesGenerated.ts                | 296 +++++++++++++++++
 12 files changed, 1551 insertions(+), 141 deletions(-)
 create mode 100644 coderd/database/migrations/000377_add_api_key_scope_wildcards.down.sql
 create mode 100644 coderd/database/migrations/000377_add_api_key_scope_wildcards.up.sql
 delete mode 100644 scripts/generate_api_key_scope_enum/main.go

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 289e4c9a3fee9..b444d50a8c63b 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11530,11 +11530,29 @@ const docTemplate = `{
             "enum": [
                 "all",
                 "application_connect",
+                "aibridge_interception:*",
+                "aibridge_interception:create",
+                "aibridge_interception:read",
+                "aibridge_interception:update",
                 "api_key:*",
                 "api_key:create",
                 "api_key:delete",
                 "api_key:read",
                 "api_key:update",
+                "assign_org_role:*",
+                "assign_org_role:assign",
+                "assign_org_role:create",
+                "assign_org_role:delete",
+                "assign_org_role:read",
+                "assign_org_role:unassign",
+                "assign_org_role:update",
+                "assign_role:*",
+                "assign_role:assign",
+                "assign_role:read",
+                "assign_role:unassign",
+                "audit_log:*",
+                "audit_log:create",
+                "audit_log:read",
                 "coder:all",
                 "coder:apikeys.manage_self",
                 "coder:application_connect",
@@ -11544,40 +11562,188 @@ const docTemplate = `{
                 "coder:workspaces.create",
                 "coder:workspaces.delete",
                 "coder:workspaces.operate",
+                "connection_log:*",
+                "connection_log:read",
+                "connection_log:update",
+                "crypto_key:*",
+                "crypto_key:create",
+                "crypto_key:delete",
+                "crypto_key:read",
+                "crypto_key:update",
+                "debug_info:*",
+                "debug_info:read",
+                "deployment_config:*",
+                "deployment_config:read",
+                "deployment_config:update",
+                "deployment_stats:*",
+                "deployment_stats:read",
                 "file:*",
                 "file:create",
                 "file:read",
+                "group:*",
+                "group:create",
+                "group:delete",
+                "group:read",
+                "group:update",
+                "group_member:*",
+                "group_member:read",
+                "idpsync_settings:*",
+                "idpsync_settings:read",
+                "idpsync_settings:update",
+                "inbox_notification:*",
+                "inbox_notification:create",
+                "inbox_notification:read",
+                "inbox_notification:update",
+                "license:*",
+                "license:create",
+                "license:delete",
+                "license:read",
+                "notification_message:*",
+                "notification_message:create",
+                "notification_message:delete",
+                "notification_message:read",
+                "notification_message:update",
+                "notification_preference:*",
+                "notification_preference:read",
+                "notification_preference:update",
+                "notification_template:*",
+                "notification_template:read",
+                "notification_template:update",
+                "oauth2_app:*",
+                "oauth2_app:create",
+                "oauth2_app:delete",
+                "oauth2_app:read",
+                "oauth2_app:update",
+                "oauth2_app_code_token:*",
+                "oauth2_app_code_token:create",
+                "oauth2_app_code_token:delete",
+                "oauth2_app_code_token:read",
+                "oauth2_app_secret:*",
+                "oauth2_app_secret:create",
+                "oauth2_app_secret:delete",
+                "oauth2_app_secret:read",
+                "oauth2_app_secret:update",
+                "organization:*",
+                "organization:create",
+                "organization:delete",
+                "organization:read",
+                "organization:update",
+                "organization_member:*",
+                "organization_member:create",
+                "organization_member:delete",
+                "organization_member:read",
+                "organization_member:update",
+                "prebuilt_workspace:*",
+                "prebuilt_workspace:delete",
+                "prebuilt_workspace:update",
+                "provisioner_daemon:*",
+                "provisioner_daemon:create",
+                "provisioner_daemon:delete",
+                "provisioner_daemon:read",
+                "provisioner_daemon:update",
+                "provisioner_jobs:*",
+                "provisioner_jobs:create",
+                "provisioner_jobs:read",
+                "provisioner_jobs:update",
+                "replicas:*",
+                "replicas:read",
+                "system:*",
+                "system:create",
+                "system:delete",
+                "system:read",
+                "system:update",
+                "tailnet_coordinator:*",
+                "tailnet_coordinator:create",
+                "tailnet_coordinator:delete",
+                "tailnet_coordinator:read",
+                "tailnet_coordinator:update",
                 "template:*",
                 "template:create",
                 "template:delete",
                 "template:read",
                 "template:update",
                 "template:use",
+                "template:view_insights",
+                "usage_event:*",
+                "usage_event:create",
+                "usage_event:read",
+                "usage_event:update",
+                "user:*",
+                "user:create",
+                "user:delete",
+                "user:read",
                 "user:read_personal",
+                "user:update",
                 "user:update_personal",
                 "user_secret:*",
                 "user_secret:create",
                 "user_secret:delete",
                 "user_secret:read",
                 "user_secret:update",
+                "webpush_subscription:*",
+                "webpush_subscription:create",
+                "webpush_subscription:delete",
+                "webpush_subscription:read",
                 "workspace:*",
                 "workspace:application_connect",
                 "workspace:create",
+                "workspace:create_agent",
                 "workspace:delete",
+                "workspace:delete_agent",
                 "workspace:read",
                 "workspace:ssh",
                 "workspace:start",
                 "workspace:stop",
-                "workspace:update"
+                "workspace:update",
+                "workspace_agent_devcontainers:*",
+                "workspace_agent_devcontainers:create",
+                "workspace_agent_resource_monitor:*",
+                "workspace_agent_resource_monitor:create",
+                "workspace_agent_resource_monitor:read",
+                "workspace_agent_resource_monitor:update",
+                "workspace_dormant:*",
+                "workspace_dormant:application_connect",
+                "workspace_dormant:create",
+                "workspace_dormant:create_agent",
+                "workspace_dormant:delete",
+                "workspace_dormant:delete_agent",
+                "workspace_dormant:read",
+                "workspace_dormant:ssh",
+                "workspace_dormant:start",
+                "workspace_dormant:stop",
+                "workspace_dormant:update",
+                "workspace_proxy:*",
+                "workspace_proxy:create",
+                "workspace_proxy:delete",
+                "workspace_proxy:read",
+                "workspace_proxy:update"
             ],
             "x-enum-varnames": [
                 "APIKeyScopeAll",
                 "APIKeyScopeApplicationConnect",
+                "APIKeyScopeAibridgeInterceptionAll",
+                "APIKeyScopeAibridgeInterceptionCreate",
+                "APIKeyScopeAibridgeInterceptionRead",
+                "APIKeyScopeAibridgeInterceptionUpdate",
                 "APIKeyScopeApiKeyAll",
                 "APIKeyScopeApiKeyCreate",
                 "APIKeyScopeApiKeyDelete",
                 "APIKeyScopeApiKeyRead",
                 "APIKeyScopeApiKeyUpdate",
+                "APIKeyScopeAssignOrgRoleAll",
+                "APIKeyScopeAssignOrgRoleAssign",
+                "APIKeyScopeAssignOrgRoleCreate",
+                "APIKeyScopeAssignOrgRoleDelete",
+                "APIKeyScopeAssignOrgRoleRead",
+                "APIKeyScopeAssignOrgRoleUnassign",
+                "APIKeyScopeAssignOrgRoleUpdate",
+                "APIKeyScopeAssignRoleAll",
+                "APIKeyScopeAssignRoleAssign",
+                "APIKeyScopeAssignRoleRead",
+                "APIKeyScopeAssignRoleUnassign",
+                "APIKeyScopeAuditLogAll",
+                "APIKeyScopeAuditLogCreate",
+                "APIKeyScopeAuditLogRead",
                 "APIKeyScopeCoderAll",
                 "APIKeyScopeCoderApikeysManageSelf",
                 "APIKeyScopeCoderApplicationConnect",
@@ -11587,31 +11753,161 @@ const docTemplate = `{
                 "APIKeyScopeCoderWorkspacesCreate",
                 "APIKeyScopeCoderWorkspacesDelete",
                 "APIKeyScopeCoderWorkspacesOperate",
+                "APIKeyScopeConnectionLogAll",
+                "APIKeyScopeConnectionLogRead",
+                "APIKeyScopeConnectionLogUpdate",
+                "APIKeyScopeCryptoKeyAll",
+                "APIKeyScopeCryptoKeyCreate",
+                "APIKeyScopeCryptoKeyDelete",
+                "APIKeyScopeCryptoKeyRead",
+                "APIKeyScopeCryptoKeyUpdate",
+                "APIKeyScopeDebugInfoAll",
+                "APIKeyScopeDebugInfoRead",
+                "APIKeyScopeDeploymentConfigAll",
+                "APIKeyScopeDeploymentConfigRead",
+                "APIKeyScopeDeploymentConfigUpdate",
+                "APIKeyScopeDeploymentStatsAll",
+                "APIKeyScopeDeploymentStatsRead",
                 "APIKeyScopeFileAll",
                 "APIKeyScopeFileCreate",
                 "APIKeyScopeFileRead",
+                "APIKeyScopeGroupAll",
+                "APIKeyScopeGroupCreate",
+                "APIKeyScopeGroupDelete",
+                "APIKeyScopeGroupRead",
+                "APIKeyScopeGroupUpdate",
+                "APIKeyScopeGroupMemberAll",
+                "APIKeyScopeGroupMemberRead",
+                "APIKeyScopeIdpsyncSettingsAll",
+                "APIKeyScopeIdpsyncSettingsRead",
+                "APIKeyScopeIdpsyncSettingsUpdate",
+                "APIKeyScopeInboxNotificationAll",
+                "APIKeyScopeInboxNotificationCreate",
+                "APIKeyScopeInboxNotificationRead",
+                "APIKeyScopeInboxNotificationUpdate",
+                "APIKeyScopeLicenseAll",
+                "APIKeyScopeLicenseCreate",
+                "APIKeyScopeLicenseDelete",
+                "APIKeyScopeLicenseRead",
+                "APIKeyScopeNotificationMessageAll",
+                "APIKeyScopeNotificationMessageCreate",
+                "APIKeyScopeNotificationMessageDelete",
+                "APIKeyScopeNotificationMessageRead",
+                "APIKeyScopeNotificationMessageUpdate",
+                "APIKeyScopeNotificationPreferenceAll",
+                "APIKeyScopeNotificationPreferenceRead",
+                "APIKeyScopeNotificationPreferenceUpdate",
+                "APIKeyScopeNotificationTemplateAll",
+                "APIKeyScopeNotificationTemplateRead",
+                "APIKeyScopeNotificationTemplateUpdate",
+                "APIKeyScopeOauth2AppAll",
+                "APIKeyScopeOauth2AppCreate",
+                "APIKeyScopeOauth2AppDelete",
+                "APIKeyScopeOauth2AppRead",
+                "APIKeyScopeOauth2AppUpdate",
+                "APIKeyScopeOauth2AppCodeTokenAll",
+                "APIKeyScopeOauth2AppCodeTokenCreate",
+                "APIKeyScopeOauth2AppCodeTokenDelete",
+                "APIKeyScopeOauth2AppCodeTokenRead",
+                "APIKeyScopeOauth2AppSecretAll",
+                "APIKeyScopeOauth2AppSecretCreate",
+                "APIKeyScopeOauth2AppSecretDelete",
+                "APIKeyScopeOauth2AppSecretRead",
+                "APIKeyScopeOauth2AppSecretUpdate",
+                "APIKeyScopeOrganizationAll",
+                "APIKeyScopeOrganizationCreate",
+                "APIKeyScopeOrganizationDelete",
+                "APIKeyScopeOrganizationRead",
+                "APIKeyScopeOrganizationUpdate",
+                "APIKeyScopeOrganizationMemberAll",
+                "APIKeyScopeOrganizationMemberCreate",
+                "APIKeyScopeOrganizationMemberDelete",
+                "APIKeyScopeOrganizationMemberRead",
+                "APIKeyScopeOrganizationMemberUpdate",
+                "APIKeyScopePrebuiltWorkspaceAll",
+                "APIKeyScopePrebuiltWorkspaceDelete",
+                "APIKeyScopePrebuiltWorkspaceUpdate",
+                "APIKeyScopeProvisionerDaemonAll",
+                "APIKeyScopeProvisionerDaemonCreate",
+                "APIKeyScopeProvisionerDaemonDelete",
+                "APIKeyScopeProvisionerDaemonRead",
+                "APIKeyScopeProvisionerDaemonUpdate",
+                "APIKeyScopeProvisionerJobsAll",
+                "APIKeyScopeProvisionerJobsCreate",
+                "APIKeyScopeProvisionerJobsRead",
+                "APIKeyScopeProvisionerJobsUpdate",
+                "APIKeyScopeReplicasAll",
+                "APIKeyScopeReplicasRead",
+                "APIKeyScopeSystemAll",
+                "APIKeyScopeSystemCreate",
+                "APIKeyScopeSystemDelete",
+                "APIKeyScopeSystemRead",
+                "APIKeyScopeSystemUpdate",
+                "APIKeyScopeTailnetCoordinatorAll",
+                "APIKeyScopeTailnetCoordinatorCreate",
+                "APIKeyScopeTailnetCoordinatorDelete",
+                "APIKeyScopeTailnetCoordinatorRead",
+                "APIKeyScopeTailnetCoordinatorUpdate",
                 "APIKeyScopeTemplateAll",
                 "APIKeyScopeTemplateCreate",
                 "APIKeyScopeTemplateDelete",
                 "APIKeyScopeTemplateRead",
                 "APIKeyScopeTemplateUpdate",
                 "APIKeyScopeTemplateUse",
+                "APIKeyScopeTemplateViewInsights",
+                "APIKeyScopeUsageEventAll",
+                "APIKeyScopeUsageEventCreate",
+                "APIKeyScopeUsageEventRead",
+                "APIKeyScopeUsageEventUpdate",
+                "APIKeyScopeUserAll",
+                "APIKeyScopeUserCreate",
+                "APIKeyScopeUserDelete",
+                "APIKeyScopeUserRead",
                 "APIKeyScopeUserReadPersonal",
+                "APIKeyScopeUserUpdate",
                 "APIKeyScopeUserUpdatePersonal",
                 "APIKeyScopeUserSecretAll",
                 "APIKeyScopeUserSecretCreate",
                 "APIKeyScopeUserSecretDelete",
                 "APIKeyScopeUserSecretRead",
                 "APIKeyScopeUserSecretUpdate",
+                "APIKeyScopeWebpushSubscriptionAll",
+                "APIKeyScopeWebpushSubscriptionCreate",
+                "APIKeyScopeWebpushSubscriptionDelete",
+                "APIKeyScopeWebpushSubscriptionRead",
                 "APIKeyScopeWorkspaceAll",
                 "APIKeyScopeWorkspaceApplicationConnect",
                 "APIKeyScopeWorkspaceCreate",
+                "APIKeyScopeWorkspaceCreateAgent",
                 "APIKeyScopeWorkspaceDelete",
+                "APIKeyScopeWorkspaceDeleteAgent",
                 "APIKeyScopeWorkspaceRead",
                 "APIKeyScopeWorkspaceSsh",
                 "APIKeyScopeWorkspaceStart",
                 "APIKeyScopeWorkspaceStop",
-                "APIKeyScopeWorkspaceUpdate"
+                "APIKeyScopeWorkspaceUpdate",
+                "APIKeyScopeWorkspaceAgentDevcontainersAll",
+                "APIKeyScopeWorkspaceAgentDevcontainersCreate",
+                "APIKeyScopeWorkspaceAgentResourceMonitorAll",
+                "APIKeyScopeWorkspaceAgentResourceMonitorCreate",
+                "APIKeyScopeWorkspaceAgentResourceMonitorRead",
+                "APIKeyScopeWorkspaceAgentResourceMonitorUpdate",
+                "APIKeyScopeWorkspaceDormantAll",
+                "APIKeyScopeWorkspaceDormantApplicationConnect",
+                "APIKeyScopeWorkspaceDormantCreate",
+                "APIKeyScopeWorkspaceDormantCreateAgent",
+                "APIKeyScopeWorkspaceDormantDelete",
+                "APIKeyScopeWorkspaceDormantDeleteAgent",
+                "APIKeyScopeWorkspaceDormantRead",
+                "APIKeyScopeWorkspaceDormantSsh",
+                "APIKeyScopeWorkspaceDormantStart",
+                "APIKeyScopeWorkspaceDormantStop",
+                "APIKeyScopeWorkspaceDormantUpdate",
+                "APIKeyScopeWorkspaceProxyAll",
+                "APIKeyScopeWorkspaceProxyCreate",
+                "APIKeyScopeWorkspaceProxyDelete",
+                "APIKeyScopeWorkspaceProxyRead",
+                "APIKeyScopeWorkspaceProxyUpdate"
             ]
         },
         "codersdk.AddLicenseRequest": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 4b3d4c86aaf34..1a222932de75a 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10246,11 +10246,29 @@
 			"enum": [
 				"all",
 				"application_connect",
+				"aibridge_interception:*",
+				"aibridge_interception:create",
+				"aibridge_interception:read",
+				"aibridge_interception:update",
 				"api_key:*",
 				"api_key:create",
 				"api_key:delete",
 				"api_key:read",
 				"api_key:update",
+				"assign_org_role:*",
+				"assign_org_role:assign",
+				"assign_org_role:create",
+				"assign_org_role:delete",
+				"assign_org_role:read",
+				"assign_org_role:unassign",
+				"assign_org_role:update",
+				"assign_role:*",
+				"assign_role:assign",
+				"assign_role:read",
+				"assign_role:unassign",
+				"audit_log:*",
+				"audit_log:create",
+				"audit_log:read",
 				"coder:all",
 				"coder:apikeys.manage_self",
 				"coder:application_connect",
@@ -10260,40 +10278,188 @@
 				"coder:workspaces.create",
 				"coder:workspaces.delete",
 				"coder:workspaces.operate",
+				"connection_log:*",
+				"connection_log:read",
+				"connection_log:update",
+				"crypto_key:*",
+				"crypto_key:create",
+				"crypto_key:delete",
+				"crypto_key:read",
+				"crypto_key:update",
+				"debug_info:*",
+				"debug_info:read",
+				"deployment_config:*",
+				"deployment_config:read",
+				"deployment_config:update",
+				"deployment_stats:*",
+				"deployment_stats:read",
 				"file:*",
 				"file:create",
 				"file:read",
+				"group:*",
+				"group:create",
+				"group:delete",
+				"group:read",
+				"group:update",
+				"group_member:*",
+				"group_member:read",
+				"idpsync_settings:*",
+				"idpsync_settings:read",
+				"idpsync_settings:update",
+				"inbox_notification:*",
+				"inbox_notification:create",
+				"inbox_notification:read",
+				"inbox_notification:update",
+				"license:*",
+				"license:create",
+				"license:delete",
+				"license:read",
+				"notification_message:*",
+				"notification_message:create",
+				"notification_message:delete",
+				"notification_message:read",
+				"notification_message:update",
+				"notification_preference:*",
+				"notification_preference:read",
+				"notification_preference:update",
+				"notification_template:*",
+				"notification_template:read",
+				"notification_template:update",
+				"oauth2_app:*",
+				"oauth2_app:create",
+				"oauth2_app:delete",
+				"oauth2_app:read",
+				"oauth2_app:update",
+				"oauth2_app_code_token:*",
+				"oauth2_app_code_token:create",
+				"oauth2_app_code_token:delete",
+				"oauth2_app_code_token:read",
+				"oauth2_app_secret:*",
+				"oauth2_app_secret:create",
+				"oauth2_app_secret:delete",
+				"oauth2_app_secret:read",
+				"oauth2_app_secret:update",
+				"organization:*",
+				"organization:create",
+				"organization:delete",
+				"organization:read",
+				"organization:update",
+				"organization_member:*",
+				"organization_member:create",
+				"organization_member:delete",
+				"organization_member:read",
+				"organization_member:update",
+				"prebuilt_workspace:*",
+				"prebuilt_workspace:delete",
+				"prebuilt_workspace:update",
+				"provisioner_daemon:*",
+				"provisioner_daemon:create",
+				"provisioner_daemon:delete",
+				"provisioner_daemon:read",
+				"provisioner_daemon:update",
+				"provisioner_jobs:*",
+				"provisioner_jobs:create",
+				"provisioner_jobs:read",
+				"provisioner_jobs:update",
+				"replicas:*",
+				"replicas:read",
+				"system:*",
+				"system:create",
+				"system:delete",
+				"system:read",
+				"system:update",
+				"tailnet_coordinator:*",
+				"tailnet_coordinator:create",
+				"tailnet_coordinator:delete",
+				"tailnet_coordinator:read",
+				"tailnet_coordinator:update",
 				"template:*",
 				"template:create",
 				"template:delete",
 				"template:read",
 				"template:update",
 				"template:use",
+				"template:view_insights",
+				"usage_event:*",
+				"usage_event:create",
+				"usage_event:read",
+				"usage_event:update",
+				"user:*",
+				"user:create",
+				"user:delete",
+				"user:read",
 				"user:read_personal",
+				"user:update",
 				"user:update_personal",
 				"user_secret:*",
 				"user_secret:create",
 				"user_secret:delete",
 				"user_secret:read",
 				"user_secret:update",
+				"webpush_subscription:*",
+				"webpush_subscription:create",
+				"webpush_subscription:delete",
+				"webpush_subscription:read",
 				"workspace:*",
 				"workspace:application_connect",
 				"workspace:create",
+				"workspace:create_agent",
 				"workspace:delete",
+				"workspace:delete_agent",
 				"workspace:read",
 				"workspace:ssh",
 				"workspace:start",
 				"workspace:stop",
-				"workspace:update"
+				"workspace:update",
+				"workspace_agent_devcontainers:*",
+				"workspace_agent_devcontainers:create",
+				"workspace_agent_resource_monitor:*",
+				"workspace_agent_resource_monitor:create",
+				"workspace_agent_resource_monitor:read",
+				"workspace_agent_resource_monitor:update",
+				"workspace_dormant:*",
+				"workspace_dormant:application_connect",
+				"workspace_dormant:create",
+				"workspace_dormant:create_agent",
+				"workspace_dormant:delete",
+				"workspace_dormant:delete_agent",
+				"workspace_dormant:read",
+				"workspace_dormant:ssh",
+				"workspace_dormant:start",
+				"workspace_dormant:stop",
+				"workspace_dormant:update",
+				"workspace_proxy:*",
+				"workspace_proxy:create",
+				"workspace_proxy:delete",
+				"workspace_proxy:read",
+				"workspace_proxy:update"
 			],
 			"x-enum-varnames": [
 				"APIKeyScopeAll",
 				"APIKeyScopeApplicationConnect",
+				"APIKeyScopeAibridgeInterceptionAll",
+				"APIKeyScopeAibridgeInterceptionCreate",
+				"APIKeyScopeAibridgeInterceptionRead",
+				"APIKeyScopeAibridgeInterceptionUpdate",
 				"APIKeyScopeApiKeyAll",
 				"APIKeyScopeApiKeyCreate",
 				"APIKeyScopeApiKeyDelete",
 				"APIKeyScopeApiKeyRead",
 				"APIKeyScopeApiKeyUpdate",
+				"APIKeyScopeAssignOrgRoleAll",
+				"APIKeyScopeAssignOrgRoleAssign",
+				"APIKeyScopeAssignOrgRoleCreate",
+				"APIKeyScopeAssignOrgRoleDelete",
+				"APIKeyScopeAssignOrgRoleRead",
+				"APIKeyScopeAssignOrgRoleUnassign",
+				"APIKeyScopeAssignOrgRoleUpdate",
+				"APIKeyScopeAssignRoleAll",
+				"APIKeyScopeAssignRoleAssign",
+				"APIKeyScopeAssignRoleRead",
+				"APIKeyScopeAssignRoleUnassign",
+				"APIKeyScopeAuditLogAll",
+				"APIKeyScopeAuditLogCreate",
+				"APIKeyScopeAuditLogRead",
 				"APIKeyScopeCoderAll",
 				"APIKeyScopeCoderApikeysManageSelf",
 				"APIKeyScopeCoderApplicationConnect",
@@ -10303,31 +10469,161 @@
 				"APIKeyScopeCoderWorkspacesCreate",
 				"APIKeyScopeCoderWorkspacesDelete",
 				"APIKeyScopeCoderWorkspacesOperate",
+				"APIKeyScopeConnectionLogAll",
+				"APIKeyScopeConnectionLogRead",
+				"APIKeyScopeConnectionLogUpdate",
+				"APIKeyScopeCryptoKeyAll",
+				"APIKeyScopeCryptoKeyCreate",
+				"APIKeyScopeCryptoKeyDelete",
+				"APIKeyScopeCryptoKeyRead",
+				"APIKeyScopeCryptoKeyUpdate",
+				"APIKeyScopeDebugInfoAll",
+				"APIKeyScopeDebugInfoRead",
+				"APIKeyScopeDeploymentConfigAll",
+				"APIKeyScopeDeploymentConfigRead",
+				"APIKeyScopeDeploymentConfigUpdate",
+				"APIKeyScopeDeploymentStatsAll",
+				"APIKeyScopeDeploymentStatsRead",
 				"APIKeyScopeFileAll",
 				"APIKeyScopeFileCreate",
 				"APIKeyScopeFileRead",
+				"APIKeyScopeGroupAll",
+				"APIKeyScopeGroupCreate",
+				"APIKeyScopeGroupDelete",
+				"APIKeyScopeGroupRead",
+				"APIKeyScopeGroupUpdate",
+				"APIKeyScopeGroupMemberAll",
+				"APIKeyScopeGroupMemberRead",
+				"APIKeyScopeIdpsyncSettingsAll",
+				"APIKeyScopeIdpsyncSettingsRead",
+				"APIKeyScopeIdpsyncSettingsUpdate",
+				"APIKeyScopeInboxNotificationAll",
+				"APIKeyScopeInboxNotificationCreate",
+				"APIKeyScopeInboxNotificationRead",
+				"APIKeyScopeInboxNotificationUpdate",
+				"APIKeyScopeLicenseAll",
+				"APIKeyScopeLicenseCreate",
+				"APIKeyScopeLicenseDelete",
+				"APIKeyScopeLicenseRead",
+				"APIKeyScopeNotificationMessageAll",
+				"APIKeyScopeNotificationMessageCreate",
+				"APIKeyScopeNotificationMessageDelete",
+				"APIKeyScopeNotificationMessageRead",
+				"APIKeyScopeNotificationMessageUpdate",
+				"APIKeyScopeNotificationPreferenceAll",
+				"APIKeyScopeNotificationPreferenceRead",
+				"APIKeyScopeNotificationPreferenceUpdate",
+				"APIKeyScopeNotificationTemplateAll",
+				"APIKeyScopeNotificationTemplateRead",
+				"APIKeyScopeNotificationTemplateUpdate",
+				"APIKeyScopeOauth2AppAll",
+				"APIKeyScopeOauth2AppCreate",
+				"APIKeyScopeOauth2AppDelete",
+				"APIKeyScopeOauth2AppRead",
+				"APIKeyScopeOauth2AppUpdate",
+				"APIKeyScopeOauth2AppCodeTokenAll",
+				"APIKeyScopeOauth2AppCodeTokenCreate",
+				"APIKeyScopeOauth2AppCodeTokenDelete",
+				"APIKeyScopeOauth2AppCodeTokenRead",
+				"APIKeyScopeOauth2AppSecretAll",
+				"APIKeyScopeOauth2AppSecretCreate",
+				"APIKeyScopeOauth2AppSecretDelete",
+				"APIKeyScopeOauth2AppSecretRead",
+				"APIKeyScopeOauth2AppSecretUpdate",
+				"APIKeyScopeOrganizationAll",
+				"APIKeyScopeOrganizationCreate",
+				"APIKeyScopeOrganizationDelete",
+				"APIKeyScopeOrganizationRead",
+				"APIKeyScopeOrganizationUpdate",
+				"APIKeyScopeOrganizationMemberAll",
+				"APIKeyScopeOrganizationMemberCreate",
+				"APIKeyScopeOrganizationMemberDelete",
+				"APIKeyScopeOrganizationMemberRead",
+				"APIKeyScopeOrganizationMemberUpdate",
+				"APIKeyScopePrebuiltWorkspaceAll",
+				"APIKeyScopePrebuiltWorkspaceDelete",
+				"APIKeyScopePrebuiltWorkspaceUpdate",
+				"APIKeyScopeProvisionerDaemonAll",
+				"APIKeyScopeProvisionerDaemonCreate",
+				"APIKeyScopeProvisionerDaemonDelete",
+				"APIKeyScopeProvisionerDaemonRead",
+				"APIKeyScopeProvisionerDaemonUpdate",
+				"APIKeyScopeProvisionerJobsAll",
+				"APIKeyScopeProvisionerJobsCreate",
+				"APIKeyScopeProvisionerJobsRead",
+				"APIKeyScopeProvisionerJobsUpdate",
+				"APIKeyScopeReplicasAll",
+				"APIKeyScopeReplicasRead",
+				"APIKeyScopeSystemAll",
+				"APIKeyScopeSystemCreate",
+				"APIKeyScopeSystemDelete",
+				"APIKeyScopeSystemRead",
+				"APIKeyScopeSystemUpdate",
+				"APIKeyScopeTailnetCoordinatorAll",
+				"APIKeyScopeTailnetCoordinatorCreate",
+				"APIKeyScopeTailnetCoordinatorDelete",
+				"APIKeyScopeTailnetCoordinatorRead",
+				"APIKeyScopeTailnetCoordinatorUpdate",
 				"APIKeyScopeTemplateAll",
 				"APIKeyScopeTemplateCreate",
 				"APIKeyScopeTemplateDelete",
 				"APIKeyScopeTemplateRead",
 				"APIKeyScopeTemplateUpdate",
 				"APIKeyScopeTemplateUse",
+				"APIKeyScopeTemplateViewInsights",
+				"APIKeyScopeUsageEventAll",
+				"APIKeyScopeUsageEventCreate",
+				"APIKeyScopeUsageEventRead",
+				"APIKeyScopeUsageEventUpdate",
+				"APIKeyScopeUserAll",
+				"APIKeyScopeUserCreate",
+				"APIKeyScopeUserDelete",
+				"APIKeyScopeUserRead",
 				"APIKeyScopeUserReadPersonal",
+				"APIKeyScopeUserUpdate",
 				"APIKeyScopeUserUpdatePersonal",
 				"APIKeyScopeUserSecretAll",
 				"APIKeyScopeUserSecretCreate",
 				"APIKeyScopeUserSecretDelete",
 				"APIKeyScopeUserSecretRead",
 				"APIKeyScopeUserSecretUpdate",
+				"APIKeyScopeWebpushSubscriptionAll",
+				"APIKeyScopeWebpushSubscriptionCreate",
+				"APIKeyScopeWebpushSubscriptionDelete",
+				"APIKeyScopeWebpushSubscriptionRead",
 				"APIKeyScopeWorkspaceAll",
 				"APIKeyScopeWorkspaceApplicationConnect",
 				"APIKeyScopeWorkspaceCreate",
+				"APIKeyScopeWorkspaceCreateAgent",
 				"APIKeyScopeWorkspaceDelete",
+				"APIKeyScopeWorkspaceDeleteAgent",
 				"APIKeyScopeWorkspaceRead",
 				"APIKeyScopeWorkspaceSsh",
 				"APIKeyScopeWorkspaceStart",
 				"APIKeyScopeWorkspaceStop",
-				"APIKeyScopeWorkspaceUpdate"
+				"APIKeyScopeWorkspaceUpdate",
+				"APIKeyScopeWorkspaceAgentDevcontainersAll",
+				"APIKeyScopeWorkspaceAgentDevcontainersCreate",
+				"APIKeyScopeWorkspaceAgentResourceMonitorAll",
+				"APIKeyScopeWorkspaceAgentResourceMonitorCreate",
+				"APIKeyScopeWorkspaceAgentResourceMonitorRead",
+				"APIKeyScopeWorkspaceAgentResourceMonitorUpdate",
+				"APIKeyScopeWorkspaceDormantAll",
+				"APIKeyScopeWorkspaceDormantApplicationConnect",
+				"APIKeyScopeWorkspaceDormantCreate",
+				"APIKeyScopeWorkspaceDormantCreateAgent",
+				"APIKeyScopeWorkspaceDormantDelete",
+				"APIKeyScopeWorkspaceDormantDeleteAgent",
+				"APIKeyScopeWorkspaceDormantRead",
+				"APIKeyScopeWorkspaceDormantSsh",
+				"APIKeyScopeWorkspaceDormantStart",
+				"APIKeyScopeWorkspaceDormantStop",
+				"APIKeyScopeWorkspaceDormantUpdate",
+				"APIKeyScopeWorkspaceProxyAll",
+				"APIKeyScopeWorkspaceProxyCreate",
+				"APIKeyScopeWorkspaceProxyDelete",
+				"APIKeyScopeWorkspaceProxyRead",
+				"APIKeyScopeWorkspaceProxyUpdate"
 			]
 		},
 		"codersdk.AddLicenseRequest": {
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 7a4be98b95045..b2cac7185bfcf 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -157,7 +157,47 @@ CREATE TYPE api_key_scope AS ENUM (
     'coder:workspaces.access',
     'coder:templates.build',
     'coder:templates.author',
-    'coder:apikeys.manage_self'
+    'coder:apikeys.manage_self',
+    'aibridge_interception:*',
+    'api_key:*',
+    'assign_org_role:*',
+    'assign_role:*',
+    'audit_log:*',
+    'connection_log:*',
+    'crypto_key:*',
+    'debug_info:*',
+    'deployment_config:*',
+    'deployment_stats:*',
+    'file:*',
+    'group:*',
+    'group_member:*',
+    'idpsync_settings:*',
+    'inbox_notification:*',
+    'license:*',
+    'notification_message:*',
+    'notification_preference:*',
+    'notification_template:*',
+    'oauth2_app:*',
+    'oauth2_app_code_token:*',
+    'oauth2_app_secret:*',
+    'organization:*',
+    'organization_member:*',
+    'prebuilt_workspace:*',
+    'provisioner_daemon:*',
+    'provisioner_jobs:*',
+    'replicas:*',
+    'system:*',
+    'tailnet_coordinator:*',
+    'template:*',
+    'usage_event:*',
+    'user:*',
+    'user_secret:*',
+    'webpush_subscription:*',
+    'workspace:*',
+    'workspace_agent_devcontainers:*',
+    'workspace_agent_resource_monitor:*',
+    'workspace_dormant:*',
+    'workspace_proxy:*'
 );
 
 CREATE TYPE app_sharing_level AS ENUM (
diff --git a/coderd/database/migrations/000377_add_api_key_scope_wildcards.down.sql b/coderd/database/migrations/000377_add_api_key_scope_wildcards.down.sql
new file mode 100644
index 0000000000000..a414b39a912ee
--- /dev/null
+++ b/coderd/database/migrations/000377_add_api_key_scope_wildcards.down.sql
@@ -0,0 +1,2 @@
+-- No-op: enum values remain to avoid churn. Removing enum values requires
+-- doing a create/cast/drop cycle which is intentionally omitted here.
diff --git a/coderd/database/migrations/000377_add_api_key_scope_wildcards.up.sql b/coderd/database/migrations/000377_add_api_key_scope_wildcards.up.sql
new file mode 100644
index 0000000000000..aed5a18a3e31d
--- /dev/null
+++ b/coderd/database/migrations/000377_add_api_key_scope_wildcards.up.sql
@@ -0,0 +1,42 @@
+-- Add wildcard api_key_scope entries so every RBAC resource has a matching resource:* value.
+-- Generated via: CGO_ENABLED=0 go run ./scripts/generate_api_key_scope_enum
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'aibridge_interception:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'api_key:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'assign_org_role:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'assign_role:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'audit_log:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'connection_log:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'crypto_key:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'debug_info:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'deployment_config:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'deployment_stats:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'file:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'group:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'group_member:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'idpsync_settings:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'inbox_notification:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'license:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'notification_message:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'notification_preference:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'notification_template:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'oauth2_app:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'oauth2_app_code_token:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'oauth2_app_secret:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'organization:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'organization_member:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'prebuilt_workspace:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'provisioner_daemon:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'provisioner_jobs:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'replicas:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'system:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'tailnet_coordinator:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'template:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'usage_event:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'user:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'user_secret:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'webpush_subscription:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_agent_devcontainers:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_agent_resource_monitor:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_dormant:*';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_proxy:*';
diff --git a/coderd/database/models.go b/coderd/database/models.go
index eecb657edb15d..06c0e98fe4f64 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -166,6 +166,46 @@ const (
 	ApiKeyScopeCoderTemplatesbuild                 APIKeyScope = "coder:templates.build"
 	ApiKeyScopeCoderTemplatesauthor                APIKeyScope = "coder:templates.author"
 	ApiKeyScopeCoderApikeysmanageSelf              APIKeyScope = "coder:apikeys.manage_self"
+	ApiKeyScopeAibridgeInterception                APIKeyScope = "aibridge_interception:*"
+	ApiKeyScopeApiKey                              APIKeyScope = "api_key:*"
+	ApiKeyScopeAssignOrgRole                       APIKeyScope = "assign_org_role:*"
+	ApiKeyScopeAssignRole                          APIKeyScope = "assign_role:*"
+	ApiKeyScopeAuditLog                            APIKeyScope = "audit_log:*"
+	ApiKeyScopeConnectionLog                       APIKeyScope = "connection_log:*"
+	ApiKeyScopeCryptoKey                           APIKeyScope = "crypto_key:*"
+	ApiKeyScopeDebugInfo                           APIKeyScope = "debug_info:*"
+	ApiKeyScopeDeploymentConfig                    APIKeyScope = "deployment_config:*"
+	ApiKeyScopeDeploymentStats                     APIKeyScope = "deployment_stats:*"
+	ApiKeyScopeFile                                APIKeyScope = "file:*"
+	ApiKeyScopeGroup                               APIKeyScope = "group:*"
+	ApiKeyScopeGroupMember                         APIKeyScope = "group_member:*"
+	ApiKeyScopeIdpsyncSettings                     APIKeyScope = "idpsync_settings:*"
+	ApiKeyScopeInboxNotification                   APIKeyScope = "inbox_notification:*"
+	ApiKeyScopeLicense                             APIKeyScope = "license:*"
+	ApiKeyScopeNotificationMessage                 APIKeyScope = "notification_message:*"
+	ApiKeyScopeNotificationPreference              APIKeyScope = "notification_preference:*"
+	ApiKeyScopeNotificationTemplate                APIKeyScope = "notification_template:*"
+	ApiKeyScopeOauth2App                           APIKeyScope = "oauth2_app:*"
+	ApiKeyScopeOauth2AppCodeToken                  APIKeyScope = "oauth2_app_code_token:*"
+	ApiKeyScopeOauth2AppSecret                     APIKeyScope = "oauth2_app_secret:*"
+	ApiKeyScopeOrganization                        APIKeyScope = "organization:*"
+	ApiKeyScopeOrganizationMember                  APIKeyScope = "organization_member:*"
+	ApiKeyScopePrebuiltWorkspace                   APIKeyScope = "prebuilt_workspace:*"
+	ApiKeyScopeProvisionerDaemon                   APIKeyScope = "provisioner_daemon:*"
+	ApiKeyScopeProvisionerJobs                     APIKeyScope = "provisioner_jobs:*"
+	ApiKeyScopeReplicas                            APIKeyScope = "replicas:*"
+	ApiKeyScopeSystem                              APIKeyScope = "system:*"
+	ApiKeyScopeTailnetCoordinator                  APIKeyScope = "tailnet_coordinator:*"
+	ApiKeyScopeTemplate                            APIKeyScope = "template:*"
+	ApiKeyScopeUsageEvent                          APIKeyScope = "usage_event:*"
+	ApiKeyScopeUser                                APIKeyScope = "user:*"
+	ApiKeyScopeUserSecret                          APIKeyScope = "user_secret:*"
+	ApiKeyScopeWebpushSubscription                 APIKeyScope = "webpush_subscription:*"
+	ApiKeyScopeWorkspace                           APIKeyScope = "workspace:*"
+	ApiKeyScopeWorkspaceAgentDevcontainers         APIKeyScope = "workspace_agent_devcontainers:*"
+	ApiKeyScopeWorkspaceAgentResourceMonitor       APIKeyScope = "workspace_agent_resource_monitor:*"
+	ApiKeyScopeWorkspaceDormant                    APIKeyScope = "workspace_dormant:*"
+	ApiKeyScopeWorkspaceProxy                      APIKeyScope = "workspace_proxy:*"
 )
 
 func (e *APIKeyScope) Scan(src interface{}) error {
@@ -351,7 +391,47 @@ func (e APIKeyScope) Valid() bool {
 		ApiKeyScopeCoderWorkspacesaccess,
 		ApiKeyScopeCoderTemplatesbuild,
 		ApiKeyScopeCoderTemplatesauthor,
-		ApiKeyScopeCoderApikeysmanageSelf:
+		ApiKeyScopeCoderApikeysmanageSelf,
+		ApiKeyScopeAibridgeInterception,
+		ApiKeyScopeApiKey,
+		ApiKeyScopeAssignOrgRole,
+		ApiKeyScopeAssignRole,
+		ApiKeyScopeAuditLog,
+		ApiKeyScopeConnectionLog,
+		ApiKeyScopeCryptoKey,
+		ApiKeyScopeDebugInfo,
+		ApiKeyScopeDeploymentConfig,
+		ApiKeyScopeDeploymentStats,
+		ApiKeyScopeFile,
+		ApiKeyScopeGroup,
+		ApiKeyScopeGroupMember,
+		ApiKeyScopeIdpsyncSettings,
+		ApiKeyScopeInboxNotification,
+		ApiKeyScopeLicense,
+		ApiKeyScopeNotificationMessage,
+		ApiKeyScopeNotificationPreference,
+		ApiKeyScopeNotificationTemplate,
+		ApiKeyScopeOauth2App,
+		ApiKeyScopeOauth2AppCodeToken,
+		ApiKeyScopeOauth2AppSecret,
+		ApiKeyScopeOrganization,
+		ApiKeyScopeOrganizationMember,
+		ApiKeyScopePrebuiltWorkspace,
+		ApiKeyScopeProvisionerDaemon,
+		ApiKeyScopeProvisionerJobs,
+		ApiKeyScopeReplicas,
+		ApiKeyScopeSystem,
+		ApiKeyScopeTailnetCoordinator,
+		ApiKeyScopeTemplate,
+		ApiKeyScopeUsageEvent,
+		ApiKeyScopeUser,
+		ApiKeyScopeUserSecret,
+		ApiKeyScopeWebpushSubscription,
+		ApiKeyScopeWorkspace,
+		ApiKeyScopeWorkspaceAgentDevcontainers,
+		ApiKeyScopeWorkspaceAgentResourceMonitor,
+		ApiKeyScopeWorkspaceDormant,
+		ApiKeyScopeWorkspaceProxy:
 		return true
 	}
 	return false
@@ -506,6 +586,46 @@ func AllAPIKeyScopeValues() []APIKeyScope {
 		ApiKeyScopeCoderTemplatesbuild,
 		ApiKeyScopeCoderTemplatesauthor,
 		ApiKeyScopeCoderApikeysmanageSelf,
+		ApiKeyScopeAibridgeInterception,
+		ApiKeyScopeApiKey,
+		ApiKeyScopeAssignOrgRole,
+		ApiKeyScopeAssignRole,
+		ApiKeyScopeAuditLog,
+		ApiKeyScopeConnectionLog,
+		ApiKeyScopeCryptoKey,
+		ApiKeyScopeDebugInfo,
+		ApiKeyScopeDeploymentConfig,
+		ApiKeyScopeDeploymentStats,
+		ApiKeyScopeFile,
+		ApiKeyScopeGroup,
+		ApiKeyScopeGroupMember,
+		ApiKeyScopeIdpsyncSettings,
+		ApiKeyScopeInboxNotification,
+		ApiKeyScopeLicense,
+		ApiKeyScopeNotificationMessage,
+		ApiKeyScopeNotificationPreference,
+		ApiKeyScopeNotificationTemplate,
+		ApiKeyScopeOauth2App,
+		ApiKeyScopeOauth2AppCodeToken,
+		ApiKeyScopeOauth2AppSecret,
+		ApiKeyScopeOrganization,
+		ApiKeyScopeOrganizationMember,
+		ApiKeyScopePrebuiltWorkspace,
+		ApiKeyScopeProvisionerDaemon,
+		ApiKeyScopeProvisionerJobs,
+		ApiKeyScopeReplicas,
+		ApiKeyScopeSystem,
+		ApiKeyScopeTailnetCoordinator,
+		ApiKeyScopeTemplate,
+		ApiKeyScopeUsageEvent,
+		ApiKeyScopeUser,
+		ApiKeyScopeUserSecret,
+		ApiKeyScopeWebpushSubscription,
+		ApiKeyScopeWorkspace,
+		ApiKeyScopeWorkspaceAgentDevcontainers,
+		ApiKeyScopeWorkspaceAgentResourceMonitor,
+		ApiKeyScopeWorkspaceDormant,
+		ApiKeyScopeWorkspaceProxy,
 	}
 }
 
diff --git a/codersdk/apikey_scopes_gen.go b/codersdk/apikey_scopes_gen.go
index a399a014b42d5..606a704ae4bdc 100644
--- a/codersdk/apikey_scopes_gen.go
+++ b/codersdk/apikey_scopes_gen.go
@@ -5,46 +5,194 @@ const (
 	// Deprecated: use codersdk.APIKeyScopeCoderAll instead.
 	APIKeyScopeAll APIKeyScope = "all"
 	// Deprecated: use codersdk.APIKeyScopeCoderApplicationConnect instead.
-	APIKeyScopeApplicationConnect          APIKeyScope = "application_connect"
-	APIKeyScopeApiKeyAll                   APIKeyScope = "api_key:*"
-	APIKeyScopeApiKeyCreate                APIKeyScope = "api_key:create"
-	APIKeyScopeApiKeyDelete                APIKeyScope = "api_key:delete"
-	APIKeyScopeApiKeyRead                  APIKeyScope = "api_key:read"
-	APIKeyScopeApiKeyUpdate                APIKeyScope = "api_key:update"
-	APIKeyScopeCoderAll                    APIKeyScope = "coder:all"
-	APIKeyScopeCoderApikeysManageSelf      APIKeyScope = "coder:apikeys.manage_self"
-	APIKeyScopeCoderApplicationConnect     APIKeyScope = "coder:application_connect"
-	APIKeyScopeCoderTemplatesAuthor        APIKeyScope = "coder:templates.author"
-	APIKeyScopeCoderTemplatesBuild         APIKeyScope = "coder:templates.build"
-	APIKeyScopeCoderWorkspacesAccess       APIKeyScope = "coder:workspaces.access"
-	APIKeyScopeCoderWorkspacesCreate       APIKeyScope = "coder:workspaces.create"
-	APIKeyScopeCoderWorkspacesDelete       APIKeyScope = "coder:workspaces.delete"
-	APIKeyScopeCoderWorkspacesOperate      APIKeyScope = "coder:workspaces.operate"
-	APIKeyScopeFileAll                     APIKeyScope = "file:*"
-	APIKeyScopeFileCreate                  APIKeyScope = "file:create"
-	APIKeyScopeFileRead                    APIKeyScope = "file:read"
-	APIKeyScopeTemplateAll                 APIKeyScope = "template:*"
-	APIKeyScopeTemplateCreate              APIKeyScope = "template:create"
-	APIKeyScopeTemplateDelete              APIKeyScope = "template:delete"
-	APIKeyScopeTemplateRead                APIKeyScope = "template:read"
-	APIKeyScopeTemplateUpdate              APIKeyScope = "template:update"
-	APIKeyScopeTemplateUse                 APIKeyScope = "template:use"
-	APIKeyScopeUserReadPersonal            APIKeyScope = "user:read_personal"
-	APIKeyScopeUserUpdatePersonal          APIKeyScope = "user:update_personal"
-	APIKeyScopeUserSecretAll               APIKeyScope = "user_secret:*"
-	APIKeyScopeUserSecretCreate            APIKeyScope = "user_secret:create"
-	APIKeyScopeUserSecretDelete            APIKeyScope = "user_secret:delete"
-	APIKeyScopeUserSecretRead              APIKeyScope = "user_secret:read"
-	APIKeyScopeUserSecretUpdate            APIKeyScope = "user_secret:update"
-	APIKeyScopeWorkspaceAll                APIKeyScope = "workspace:*"
-	APIKeyScopeWorkspaceApplicationConnect APIKeyScope = "workspace:application_connect"
-	APIKeyScopeWorkspaceCreate             APIKeyScope = "workspace:create"
-	APIKeyScopeWorkspaceDelete             APIKeyScope = "workspace:delete"
-	APIKeyScopeWorkspaceRead               APIKeyScope = "workspace:read"
-	APIKeyScopeWorkspaceSsh                APIKeyScope = "workspace:ssh"
-	APIKeyScopeWorkspaceStart              APIKeyScope = "workspace:start"
-	APIKeyScopeWorkspaceStop               APIKeyScope = "workspace:stop"
-	APIKeyScopeWorkspaceUpdate             APIKeyScope = "workspace:update"
+	APIKeyScopeApplicationConnect                  APIKeyScope = "application_connect"
+	APIKeyScopeAibridgeInterceptionAll             APIKeyScope = "aibridge_interception:*"
+	APIKeyScopeAibridgeInterceptionCreate          APIKeyScope = "aibridge_interception:create"
+	APIKeyScopeAibridgeInterceptionRead            APIKeyScope = "aibridge_interception:read"
+	APIKeyScopeAibridgeInterceptionUpdate          APIKeyScope = "aibridge_interception:update"
+	APIKeyScopeApiKeyAll                           APIKeyScope = "api_key:*"
+	APIKeyScopeApiKeyCreate                        APIKeyScope = "api_key:create"
+	APIKeyScopeApiKeyDelete                        APIKeyScope = "api_key:delete"
+	APIKeyScopeApiKeyRead                          APIKeyScope = "api_key:read"
+	APIKeyScopeApiKeyUpdate                        APIKeyScope = "api_key:update"
+	APIKeyScopeAssignOrgRoleAll                    APIKeyScope = "assign_org_role:*"
+	APIKeyScopeAssignOrgRoleAssign                 APIKeyScope = "assign_org_role:assign"
+	APIKeyScopeAssignOrgRoleCreate                 APIKeyScope = "assign_org_role:create"
+	APIKeyScopeAssignOrgRoleDelete                 APIKeyScope = "assign_org_role:delete"
+	APIKeyScopeAssignOrgRoleRead                   APIKeyScope = "assign_org_role:read"
+	APIKeyScopeAssignOrgRoleUnassign               APIKeyScope = "assign_org_role:unassign"
+	APIKeyScopeAssignOrgRoleUpdate                 APIKeyScope = "assign_org_role:update"
+	APIKeyScopeAssignRoleAll                       APIKeyScope = "assign_role:*"
+	APIKeyScopeAssignRoleAssign                    APIKeyScope = "assign_role:assign"
+	APIKeyScopeAssignRoleRead                      APIKeyScope = "assign_role:read"
+	APIKeyScopeAssignRoleUnassign                  APIKeyScope = "assign_role:unassign"
+	APIKeyScopeAuditLogAll                         APIKeyScope = "audit_log:*"
+	APIKeyScopeAuditLogCreate                      APIKeyScope = "audit_log:create"
+	APIKeyScopeAuditLogRead                        APIKeyScope = "audit_log:read"
+	APIKeyScopeCoderAll                            APIKeyScope = "coder:all"
+	APIKeyScopeCoderApikeysManageSelf              APIKeyScope = "coder:apikeys.manage_self"
+	APIKeyScopeCoderApplicationConnect             APIKeyScope = "coder:application_connect"
+	APIKeyScopeCoderTemplatesAuthor                APIKeyScope = "coder:templates.author"
+	APIKeyScopeCoderTemplatesBuild                 APIKeyScope = "coder:templates.build"
+	APIKeyScopeCoderWorkspacesAccess               APIKeyScope = "coder:workspaces.access"
+	APIKeyScopeCoderWorkspacesCreate               APIKeyScope = "coder:workspaces.create"
+	APIKeyScopeCoderWorkspacesDelete               APIKeyScope = "coder:workspaces.delete"
+	APIKeyScopeCoderWorkspacesOperate              APIKeyScope = "coder:workspaces.operate"
+	APIKeyScopeConnectionLogAll                    APIKeyScope = "connection_log:*"
+	APIKeyScopeConnectionLogRead                   APIKeyScope = "connection_log:read"
+	APIKeyScopeConnectionLogUpdate                 APIKeyScope = "connection_log:update"
+	APIKeyScopeCryptoKeyAll                        APIKeyScope = "crypto_key:*"
+	APIKeyScopeCryptoKeyCreate                     APIKeyScope = "crypto_key:create"
+	APIKeyScopeCryptoKeyDelete                     APIKeyScope = "crypto_key:delete"
+	APIKeyScopeCryptoKeyRead                       APIKeyScope = "crypto_key:read"
+	APIKeyScopeCryptoKeyUpdate                     APIKeyScope = "crypto_key:update"
+	APIKeyScopeDebugInfoAll                        APIKeyScope = "debug_info:*"
+	APIKeyScopeDebugInfoRead                       APIKeyScope = "debug_info:read"
+	APIKeyScopeDeploymentConfigAll                 APIKeyScope = "deployment_config:*"
+	APIKeyScopeDeploymentConfigRead                APIKeyScope = "deployment_config:read"
+	APIKeyScopeDeploymentConfigUpdate              APIKeyScope = "deployment_config:update"
+	APIKeyScopeDeploymentStatsAll                  APIKeyScope = "deployment_stats:*"
+	APIKeyScopeDeploymentStatsRead                 APIKeyScope = "deployment_stats:read"
+	APIKeyScopeFileAll                             APIKeyScope = "file:*"
+	APIKeyScopeFileCreate                          APIKeyScope = "file:create"
+	APIKeyScopeFileRead                            APIKeyScope = "file:read"
+	APIKeyScopeGroupAll                            APIKeyScope = "group:*"
+	APIKeyScopeGroupCreate                         APIKeyScope = "group:create"
+	APIKeyScopeGroupDelete                         APIKeyScope = "group:delete"
+	APIKeyScopeGroupRead                           APIKeyScope = "group:read"
+	APIKeyScopeGroupUpdate                         APIKeyScope = "group:update"
+	APIKeyScopeGroupMemberAll                      APIKeyScope = "group_member:*"
+	APIKeyScopeGroupMemberRead                     APIKeyScope = "group_member:read"
+	APIKeyScopeIdpsyncSettingsAll                  APIKeyScope = "idpsync_settings:*"
+	APIKeyScopeIdpsyncSettingsRead                 APIKeyScope = "idpsync_settings:read"
+	APIKeyScopeIdpsyncSettingsUpdate               APIKeyScope = "idpsync_settings:update"
+	APIKeyScopeInboxNotificationAll                APIKeyScope = "inbox_notification:*"
+	APIKeyScopeInboxNotificationCreate             APIKeyScope = "inbox_notification:create"
+	APIKeyScopeInboxNotificationRead               APIKeyScope = "inbox_notification:read"
+	APIKeyScopeInboxNotificationUpdate             APIKeyScope = "inbox_notification:update"
+	APIKeyScopeLicenseAll                          APIKeyScope = "license:*"
+	APIKeyScopeLicenseCreate                       APIKeyScope = "license:create"
+	APIKeyScopeLicenseDelete                       APIKeyScope = "license:delete"
+	APIKeyScopeLicenseRead                         APIKeyScope = "license:read"
+	APIKeyScopeNotificationMessageAll              APIKeyScope = "notification_message:*"
+	APIKeyScopeNotificationMessageCreate           APIKeyScope = "notification_message:create"
+	APIKeyScopeNotificationMessageDelete           APIKeyScope = "notification_message:delete"
+	APIKeyScopeNotificationMessageRead             APIKeyScope = "notification_message:read"
+	APIKeyScopeNotificationMessageUpdate           APIKeyScope = "notification_message:update"
+	APIKeyScopeNotificationPreferenceAll           APIKeyScope = "notification_preference:*"
+	APIKeyScopeNotificationPreferenceRead          APIKeyScope = "notification_preference:read"
+	APIKeyScopeNotificationPreferenceUpdate        APIKeyScope = "notification_preference:update"
+	APIKeyScopeNotificationTemplateAll             APIKeyScope = "notification_template:*"
+	APIKeyScopeNotificationTemplateRead            APIKeyScope = "notification_template:read"
+	APIKeyScopeNotificationTemplateUpdate          APIKeyScope = "notification_template:update"
+	APIKeyScopeOauth2AppAll                        APIKeyScope = "oauth2_app:*"
+	APIKeyScopeOauth2AppCreate                     APIKeyScope = "oauth2_app:create"
+	APIKeyScopeOauth2AppDelete                     APIKeyScope = "oauth2_app:delete"
+	APIKeyScopeOauth2AppRead                       APIKeyScope = "oauth2_app:read"
+	APIKeyScopeOauth2AppUpdate                     APIKeyScope = "oauth2_app:update"
+	APIKeyScopeOauth2AppCodeTokenAll               APIKeyScope = "oauth2_app_code_token:*"
+	APIKeyScopeOauth2AppCodeTokenCreate            APIKeyScope = "oauth2_app_code_token:create"
+	APIKeyScopeOauth2AppCodeTokenDelete            APIKeyScope = "oauth2_app_code_token:delete"
+	APIKeyScopeOauth2AppCodeTokenRead              APIKeyScope = "oauth2_app_code_token:read"
+	APIKeyScopeOauth2AppSecretAll                  APIKeyScope = "oauth2_app_secret:*"
+	APIKeyScopeOauth2AppSecretCreate               APIKeyScope = "oauth2_app_secret:create"
+	APIKeyScopeOauth2AppSecretDelete               APIKeyScope = "oauth2_app_secret:delete"
+	APIKeyScopeOauth2AppSecretRead                 APIKeyScope = "oauth2_app_secret:read"
+	APIKeyScopeOauth2AppSecretUpdate               APIKeyScope = "oauth2_app_secret:update"
+	APIKeyScopeOrganizationAll                     APIKeyScope = "organization:*"
+	APIKeyScopeOrganizationCreate                  APIKeyScope = "organization:create"
+	APIKeyScopeOrganizationDelete                  APIKeyScope = "organization:delete"
+	APIKeyScopeOrganizationRead                    APIKeyScope = "organization:read"
+	APIKeyScopeOrganizationUpdate                  APIKeyScope = "organization:update"
+	APIKeyScopeOrganizationMemberAll               APIKeyScope = "organization_member:*"
+	APIKeyScopeOrganizationMemberCreate            APIKeyScope = "organization_member:create"
+	APIKeyScopeOrganizationMemberDelete            APIKeyScope = "organization_member:delete"
+	APIKeyScopeOrganizationMemberRead              APIKeyScope = "organization_member:read"
+	APIKeyScopeOrganizationMemberUpdate            APIKeyScope = "organization_member:update"
+	APIKeyScopePrebuiltWorkspaceAll                APIKeyScope = "prebuilt_workspace:*"
+	APIKeyScopePrebuiltWorkspaceDelete             APIKeyScope = "prebuilt_workspace:delete"
+	APIKeyScopePrebuiltWorkspaceUpdate             APIKeyScope = "prebuilt_workspace:update"
+	APIKeyScopeProvisionerDaemonAll                APIKeyScope = "provisioner_daemon:*"
+	APIKeyScopeProvisionerDaemonCreate             APIKeyScope = "provisioner_daemon:create"
+	APIKeyScopeProvisionerDaemonDelete             APIKeyScope = "provisioner_daemon:delete"
+	APIKeyScopeProvisionerDaemonRead               APIKeyScope = "provisioner_daemon:read"
+	APIKeyScopeProvisionerDaemonUpdate             APIKeyScope = "provisioner_daemon:update"
+	APIKeyScopeProvisionerJobsAll                  APIKeyScope = "provisioner_jobs:*"
+	APIKeyScopeProvisionerJobsCreate               APIKeyScope = "provisioner_jobs:create"
+	APIKeyScopeProvisionerJobsRead                 APIKeyScope = "provisioner_jobs:read"
+	APIKeyScopeProvisionerJobsUpdate               APIKeyScope = "provisioner_jobs:update"
+	APIKeyScopeReplicasAll                         APIKeyScope = "replicas:*"
+	APIKeyScopeReplicasRead                        APIKeyScope = "replicas:read"
+	APIKeyScopeSystemAll                           APIKeyScope = "system:*"
+	APIKeyScopeSystemCreate                        APIKeyScope = "system:create"
+	APIKeyScopeSystemDelete                        APIKeyScope = "system:delete"
+	APIKeyScopeSystemRead                          APIKeyScope = "system:read"
+	APIKeyScopeSystemUpdate                        APIKeyScope = "system:update"
+	APIKeyScopeTailnetCoordinatorAll               APIKeyScope = "tailnet_coordinator:*"
+	APIKeyScopeTailnetCoordinatorCreate            APIKeyScope = "tailnet_coordinator:create"
+	APIKeyScopeTailnetCoordinatorDelete            APIKeyScope = "tailnet_coordinator:delete"
+	APIKeyScopeTailnetCoordinatorRead              APIKeyScope = "tailnet_coordinator:read"
+	APIKeyScopeTailnetCoordinatorUpdate            APIKeyScope = "tailnet_coordinator:update"
+	APIKeyScopeTemplateAll                         APIKeyScope = "template:*"
+	APIKeyScopeTemplateCreate                      APIKeyScope = "template:create"
+	APIKeyScopeTemplateDelete                      APIKeyScope = "template:delete"
+	APIKeyScopeTemplateRead                        APIKeyScope = "template:read"
+	APIKeyScopeTemplateUpdate                      APIKeyScope = "template:update"
+	APIKeyScopeTemplateUse                         APIKeyScope = "template:use"
+	APIKeyScopeTemplateViewInsights                APIKeyScope = "template:view_insights"
+	APIKeyScopeUsageEventAll                       APIKeyScope = "usage_event:*"
+	APIKeyScopeUsageEventCreate                    APIKeyScope = "usage_event:create"
+	APIKeyScopeUsageEventRead                      APIKeyScope = "usage_event:read"
+	APIKeyScopeUsageEventUpdate                    APIKeyScope = "usage_event:update"
+	APIKeyScopeUserAll                             APIKeyScope = "user:*"
+	APIKeyScopeUserCreate                          APIKeyScope = "user:create"
+	APIKeyScopeUserDelete                          APIKeyScope = "user:delete"
+	APIKeyScopeUserRead                            APIKeyScope = "user:read"
+	APIKeyScopeUserReadPersonal                    APIKeyScope = "user:read_personal"
+	APIKeyScopeUserUpdate                          APIKeyScope = "user:update"
+	APIKeyScopeUserUpdatePersonal                  APIKeyScope = "user:update_personal"
+	APIKeyScopeUserSecretAll                       APIKeyScope = "user_secret:*"
+	APIKeyScopeUserSecretCreate                    APIKeyScope = "user_secret:create"
+	APIKeyScopeUserSecretDelete                    APIKeyScope = "user_secret:delete"
+	APIKeyScopeUserSecretRead                      APIKeyScope = "user_secret:read"
+	APIKeyScopeUserSecretUpdate                    APIKeyScope = "user_secret:update"
+	APIKeyScopeWebpushSubscriptionAll              APIKeyScope = "webpush_subscription:*"
+	APIKeyScopeWebpushSubscriptionCreate           APIKeyScope = "webpush_subscription:create"
+	APIKeyScopeWebpushSubscriptionDelete           APIKeyScope = "webpush_subscription:delete"
+	APIKeyScopeWebpushSubscriptionRead             APIKeyScope = "webpush_subscription:read"
+	APIKeyScopeWorkspaceAll                        APIKeyScope = "workspace:*"
+	APIKeyScopeWorkspaceApplicationConnect         APIKeyScope = "workspace:application_connect"
+	APIKeyScopeWorkspaceCreate                     APIKeyScope = "workspace:create"
+	APIKeyScopeWorkspaceCreateAgent                APIKeyScope = "workspace:create_agent"
+	APIKeyScopeWorkspaceDelete                     APIKeyScope = "workspace:delete"
+	APIKeyScopeWorkspaceDeleteAgent                APIKeyScope = "workspace:delete_agent"
+	APIKeyScopeWorkspaceRead                       APIKeyScope = "workspace:read"
+	APIKeyScopeWorkspaceSsh                        APIKeyScope = "workspace:ssh"
+	APIKeyScopeWorkspaceStart                      APIKeyScope = "workspace:start"
+	APIKeyScopeWorkspaceStop                       APIKeyScope = "workspace:stop"
+	APIKeyScopeWorkspaceUpdate                     APIKeyScope = "workspace:update"
+	APIKeyScopeWorkspaceAgentDevcontainersAll      APIKeyScope = "workspace_agent_devcontainers:*"
+	APIKeyScopeWorkspaceAgentDevcontainersCreate   APIKeyScope = "workspace_agent_devcontainers:create"
+	APIKeyScopeWorkspaceAgentResourceMonitorAll    APIKeyScope = "workspace_agent_resource_monitor:*"
+	APIKeyScopeWorkspaceAgentResourceMonitorCreate APIKeyScope = "workspace_agent_resource_monitor:create"
+	APIKeyScopeWorkspaceAgentResourceMonitorRead   APIKeyScope = "workspace_agent_resource_monitor:read"
+	APIKeyScopeWorkspaceAgentResourceMonitorUpdate APIKeyScope = "workspace_agent_resource_monitor:update"
+	APIKeyScopeWorkspaceDormantAll                 APIKeyScope = "workspace_dormant:*"
+	APIKeyScopeWorkspaceDormantApplicationConnect  APIKeyScope = "workspace_dormant:application_connect"
+	APIKeyScopeWorkspaceDormantCreate              APIKeyScope = "workspace_dormant:create"
+	APIKeyScopeWorkspaceDormantCreateAgent         APIKeyScope = "workspace_dormant:create_agent"
+	APIKeyScopeWorkspaceDormantDelete              APIKeyScope = "workspace_dormant:delete"
+	APIKeyScopeWorkspaceDormantDeleteAgent         APIKeyScope = "workspace_dormant:delete_agent"
+	APIKeyScopeWorkspaceDormantRead                APIKeyScope = "workspace_dormant:read"
+	APIKeyScopeWorkspaceDormantSsh                 APIKeyScope = "workspace_dormant:ssh"
+	APIKeyScopeWorkspaceDormantStart               APIKeyScope = "workspace_dormant:start"
+	APIKeyScopeWorkspaceDormantStop                APIKeyScope = "workspace_dormant:stop"
+	APIKeyScopeWorkspaceDormantUpdate              APIKeyScope = "workspace_dormant:update"
+	APIKeyScopeWorkspaceProxyAll                   APIKeyScope = "workspace_proxy:*"
+	APIKeyScopeWorkspaceProxyCreate                APIKeyScope = "workspace_proxy:create"
+	APIKeyScopeWorkspaceProxyDelete                APIKeyScope = "workspace_proxy:delete"
+	APIKeyScopeWorkspaceProxyRead                  APIKeyScope = "workspace_proxy:read"
+	APIKeyScopeWorkspaceProxyUpdate                APIKeyScope = "workspace_proxy:update"
 )
 
 // PublicAPIKeyScopes lists all public low-level API key scopes.
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 33cb280ae15c0..c121096b094d6 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -711,49 +711,197 @@
 
 #### Enumerated Values
 
-| Value                           |
-|---------------------------------|
-| `all`                           |
-| `application_connect`           |
-| `api_key:*`                     |
-| `api_key:create`                |
-| `api_key:delete`                |
-| `api_key:read`                  |
-| `api_key:update`                |
-| `coder:all`                     |
-| `coder:apikeys.manage_self`     |
-| `coder:application_connect`     |
-| `coder:templates.author`        |
-| `coder:templates.build`         |
-| `coder:workspaces.access`       |
-| `coder:workspaces.create`       |
-| `coder:workspaces.delete`       |
-| `coder:workspaces.operate`      |
-| `file:*`                        |
-| `file:create`                   |
-| `file:read`                     |
-| `template:*`                    |
-| `template:create`               |
-| `template:delete`               |
-| `template:read`                 |
-| `template:update`               |
-| `template:use`                  |
-| `user:read_personal`            |
-| `user:update_personal`          |
-| `user_secret:*`                 |
-| `user_secret:create`            |
-| `user_secret:delete`            |
-| `user_secret:read`              |
-| `user_secret:update`            |
-| `workspace:*`                   |
-| `workspace:application_connect` |
-| `workspace:create`              |
-| `workspace:delete`              |
-| `workspace:read`                |
-| `workspace:ssh`                 |
-| `workspace:start`               |
-| `workspace:stop`                |
-| `workspace:update`              |
+| Value                                     |
+|-------------------------------------------|
+| `all`                                     |
+| `application_connect`                     |
+| `aibridge_interception:*`                 |
+| `aibridge_interception:create`            |
+| `aibridge_interception:read`              |
+| `aibridge_interception:update`            |
+| `api_key:*`                               |
+| `api_key:create`                          |
+| `api_key:delete`                          |
+| `api_key:read`                            |
+| `api_key:update`                          |
+| `assign_org_role:*`                       |
+| `assign_org_role:assign`                  |
+| `assign_org_role:create`                  |
+| `assign_org_role:delete`                  |
+| `assign_org_role:read`                    |
+| `assign_org_role:unassign`                |
+| `assign_org_role:update`                  |
+| `assign_role:*`                           |
+| `assign_role:assign`                      |
+| `assign_role:read`                        |
+| `assign_role:unassign`                    |
+| `audit_log:*`                             |
+| `audit_log:create`                        |
+| `audit_log:read`                          |
+| `coder:all`                               |
+| `coder:apikeys.manage_self`               |
+| `coder:application_connect`               |
+| `coder:templates.author`                  |
+| `coder:templates.build`                   |
+| `coder:workspaces.access`                 |
+| `coder:workspaces.create`                 |
+| `coder:workspaces.delete`                 |
+| `coder:workspaces.operate`                |
+| `connection_log:*`                        |
+| `connection_log:read`                     |
+| `connection_log:update`                   |
+| `crypto_key:*`                            |
+| `crypto_key:create`                       |
+| `crypto_key:delete`                       |
+| `crypto_key:read`                         |
+| `crypto_key:update`                       |
+| `debug_info:*`                            |
+| `debug_info:read`                         |
+| `deployment_config:*`                     |
+| `deployment_config:read`                  |
+| `deployment_config:update`                |
+| `deployment_stats:*`                      |
+| `deployment_stats:read`                   |
+| `file:*`                                  |
+| `file:create`                             |
+| `file:read`                               |
+| `group:*`                                 |
+| `group:create`                            |
+| `group:delete`                            |
+| `group:read`                              |
+| `group:update`                            |
+| `group_member:*`                          |
+| `group_member:read`                       |
+| `idpsync_settings:*`                      |
+| `idpsync_settings:read`                   |
+| `idpsync_settings:update`                 |
+| `inbox_notification:*`                    |
+| `inbox_notification:create`               |
+| `inbox_notification:read`                 |
+| `inbox_notification:update`               |
+| `license:*`                               |
+| `license:create`                          |
+| `license:delete`                          |
+| `license:read`                            |
+| `notification_message:*`                  |
+| `notification_message:create`             |
+| `notification_message:delete`             |
+| `notification_message:read`               |
+| `notification_message:update`             |
+| `notification_preference:*`               |
+| `notification_preference:read`            |
+| `notification_preference:update`          |
+| `notification_template:*`                 |
+| `notification_template:read`              |
+| `notification_template:update`            |
+| `oauth2_app:*`                            |
+| `oauth2_app:create`                       |
+| `oauth2_app:delete`                       |
+| `oauth2_app:read`                         |
+| `oauth2_app:update`                       |
+| `oauth2_app_code_token:*`                 |
+| `oauth2_app_code_token:create`            |
+| `oauth2_app_code_token:delete`            |
+| `oauth2_app_code_token:read`              |
+| `oauth2_app_secret:*`                     |
+| `oauth2_app_secret:create`                |
+| `oauth2_app_secret:delete`                |
+| `oauth2_app_secret:read`                  |
+| `oauth2_app_secret:update`                |
+| `organization:*`                          |
+| `organization:create`                     |
+| `organization:delete`                     |
+| `organization:read`                       |
+| `organization:update`                     |
+| `organization_member:*`                   |
+| `organization_member:create`              |
+| `organization_member:delete`              |
+| `organization_member:read`                |
+| `organization_member:update`              |
+| `prebuilt_workspace:*`                    |
+| `prebuilt_workspace:delete`               |
+| `prebuilt_workspace:update`               |
+| `provisioner_daemon:*`                    |
+| `provisioner_daemon:create`               |
+| `provisioner_daemon:delete`               |
+| `provisioner_daemon:read`                 |
+| `provisioner_daemon:update`               |
+| `provisioner_jobs:*`                      |
+| `provisioner_jobs:create`                 |
+| `provisioner_jobs:read`                   |
+| `provisioner_jobs:update`                 |
+| `replicas:*`                              |
+| `replicas:read`                           |
+| `system:*`                                |
+| `system:create`                           |
+| `system:delete`                           |
+| `system:read`                             |
+| `system:update`                           |
+| `tailnet_coordinator:*`                   |
+| `tailnet_coordinator:create`              |
+| `tailnet_coordinator:delete`              |
+| `tailnet_coordinator:read`                |
+| `tailnet_coordinator:update`              |
+| `template:*`                              |
+| `template:create`                         |
+| `template:delete`                         |
+| `template:read`                           |
+| `template:update`                         |
+| `template:use`                            |
+| `template:view_insights`                  |
+| `usage_event:*`                           |
+| `usage_event:create`                      |
+| `usage_event:read`                        |
+| `usage_event:update`                      |
+| `user:*`                                  |
+| `user:create`                             |
+| `user:delete`                             |
+| `user:read`                               |
+| `user:read_personal`                      |
+| `user:update`                             |
+| `user:update_personal`                    |
+| `user_secret:*`                           |
+| `user_secret:create`                      |
+| `user_secret:delete`                      |
+| `user_secret:read`                        |
+| `user_secret:update`                      |
+| `webpush_subscription:*`                  |
+| `webpush_subscription:create`             |
+| `webpush_subscription:delete`             |
+| `webpush_subscription:read`               |
+| `workspace:*`                             |
+| `workspace:application_connect`           |
+| `workspace:create`                        |
+| `workspace:create_agent`                  |
+| `workspace:delete`                        |
+| `workspace:delete_agent`                  |
+| `workspace:read`                          |
+| `workspace:ssh`                           |
+| `workspace:start`                         |
+| `workspace:stop`                          |
+| `workspace:update`                        |
+| `workspace_agent_devcontainers:*`         |
+| `workspace_agent_devcontainers:create`    |
+| `workspace_agent_resource_monitor:*`      |
+| `workspace_agent_resource_monitor:create` |
+| `workspace_agent_resource_monitor:read`   |
+| `workspace_agent_resource_monitor:update` |
+| `workspace_dormant:*`                     |
+| `workspace_dormant:application_connect`   |
+| `workspace_dormant:create`                |
+| `workspace_dormant:create_agent`          |
+| `workspace_dormant:delete`                |
+| `workspace_dormant:delete_agent`          |
+| `workspace_dormant:read`                  |
+| `workspace_dormant:ssh`                   |
+| `workspace_dormant:start`                 |
+| `workspace_dormant:stop`                  |
+| `workspace_dormant:update`                |
+| `workspace_proxy:*`                       |
+| `workspace_proxy:create`                  |
+| `workspace_proxy:delete`                  |
+| `workspace_proxy:read`                    |
+| `workspace_proxy:update`                  |
 
 ## codersdk.AddLicenseRequest
 
diff --git a/scripts/apikeyscopesgen/main.go b/scripts/apikeyscopesgen/main.go
index 988c4cb2f0e10..b2c74c72c0adf 100644
--- a/scripts/apikeyscopesgen/main.go
+++ b/scripts/apikeyscopesgen/main.go
@@ -25,8 +25,8 @@ func main() {
 }
 
 func generate() ([]byte, error) {
-	names := rbac.ExternalScopeNames()
-	slices.Sort(names)
+	allNames := collectAllScopeNames()
+	publicNames := rbac.ExternalScopeNames()
 
 	var b bytes.Buffer
 	if _, err := b.WriteString("// Code generated by scripts/apikeyscopesgen. DO NOT EDIT.\n"); err != nil {
@@ -61,13 +61,9 @@ func generate() ([]byte, error) {
 	if _, err := b.WriteString("\tAPIKeyScopeApplicationConnect APIKeyScope = \"application_connect\"\n"); err != nil {
 		return nil, err
 	}
-	for _, n := range names {
-		res, act := splitRA(n)
-		if act == policy.WildcardSymbol {
-			act = "All"
-		}
-		constName := fmt.Sprintf("APIKeyScope%s%s", pascal(res), pascal(act))
-		if _, err := fmt.Fprintf(&b, "\t%s APIKeyScope = \"%s\"\n", constName, n); err != nil {
+	for _, name := range allNames {
+		constName := constNameForScope(name)
+		if _, err := fmt.Fprintf(&b, "\t%s APIKeyScope = \"%s\"\n", constName, name); err != nil {
 			return nil, err
 		}
 	}
@@ -82,12 +78,8 @@ func generate() ([]byte, error) {
 	if _, err := b.WriteString("var PublicAPIKeyScopes = []APIKeyScope{\n"); err != nil {
 		return nil, err
 	}
-	for _, n := range names {
-		res, act := splitRA(n)
-		if act == policy.WildcardSymbol {
-			act = "All"
-		}
-		constName := fmt.Sprintf("APIKeyScope%s%s", pascal(res), pascal(act))
+	for _, name := range publicNames {
+		constName := constNameForScope(name)
 		if _, err := fmt.Fprintf(&b, "\t%s,\n", constName); err != nil {
 			return nil, err
 		}
@@ -99,6 +91,54 @@ func generate() ([]byte, error) {
 	return format.Source(b.Bytes())
 }
 
+func collectAllScopeNames() []string {
+	seen := make(map[string]struct{})
+	var names []string
+	add := func(name string) {
+		if name == "" {
+			return
+		}
+		if _, ok := seen[name]; ok {
+			return
+		}
+		seen[name] = struct{}{}
+		names = append(names, name)
+	}
+
+	for resource, def := range policy.RBACPermissions {
+		if resource == policy.WildcardSymbol {
+			continue
+		}
+		add(resource + ":" + policy.WildcardSymbol)
+		for action := range def.Actions {
+			add(resource + ":" + string(action))
+		}
+	}
+
+	for _, name := range rbac.CompositeScopeNames() {
+		add(name)
+	}
+
+	for _, name := range rbac.BuiltinScopeNames() {
+		s := string(name)
+		if !strings.Contains(s, ":") {
+			continue
+		}
+		add(s)
+	}
+
+	slices.Sort(names)
+	return names
+}
+
+func constNameForScope(name string) string {
+	resource, action := splitRA(name)
+	if action == policy.WildcardSymbol {
+		action = "All"
+	}
+	return fmt.Sprintf("APIKeyScope%s%s", pascal(resource), pascal(action))
+}
+
 func splitRA(name string) (resource string, action string) {
 	parts := strings.SplitN(name, ":", 2)
 	if len(parts) != 2 {
diff --git a/scripts/check-scopes/main.go b/scripts/check-scopes/main.go
index e79be506ae804..56ba0d4657e31 100644
--- a/scripts/check-scopes/main.go
+++ b/scripts/check-scopes/main.go
@@ -58,23 +58,37 @@ func main() {
 	os.Exit(1)
 }
 
-// expectedFromRBAC returns the set of <resource>:<action> pairs derived from RBACPermissions.
+// expectedFromRBAC returns the set of scope names the DB enum must support.
 func expectedFromRBAC() map[string]struct{} {
 	want := make(map[string]struct{})
-	// Low-level <resource>:<action>
+	add := func(name string) {
+		if name == "" {
+			return
+		}
+		want[name] = struct{}{}
+	}
+	// Low-level <resource>:<action> and synthesized <resource>:* wildcards
 	for resource, def := range policy.RBACPermissions {
 		if resource == policy.WildcardSymbol {
 			// Ignore wildcard entry; it has no concrete <resource>:<action> pairs.
 			continue
 		}
+		add(resource + ":" + policy.WildcardSymbol)
 		for action := range def.Actions {
-			key := resource + ":" + string(action)
-			want[key] = struct{}{}
+			add(resource + ":" + string(action))
 		}
 	}
 	// Composite coder:* names
 	for _, n := range rbac.CompositeScopeNames() {
-		want[n] = struct{}{}
+		add(n)
+	}
+	// Built-in coder-prefixed scopes such as coder:all
+	for _, n := range rbac.BuiltinScopeNames() {
+		s := string(n)
+		if !strings.Contains(s, ":") {
+			continue
+		}
+		add(s)
 	}
 	return want
 }
diff --git a/scripts/generate_api_key_scope_enum/main.go b/scripts/generate_api_key_scope_enum/main.go
deleted file mode 100644
index 130dd865334b8..0000000000000
--- a/scripts/generate_api_key_scope_enum/main.go
+++ /dev/null
@@ -1,32 +0,0 @@
-package main
-
-import (
-	"fmt"
-	"sort"
-
-	"github.com/coder/coder/v2/coderd/rbac"
-	"github.com/coder/coder/v2/coderd/rbac/policy"
-)
-
-func main() {
-	seen := map[string]struct{}{}
-	var vals []string
-	for resource, def := range policy.RBACPermissions {
-		if resource == policy.WildcardSymbol {
-			continue
-		}
-		for action := range def.Actions {
-			vals = append(vals, fmt.Sprintf("%s:%s", resource, action))
-		}
-	}
-	// Include composite coder:* scopes as first-class enum values
-	vals = append(vals, rbac.CompositeScopeNames()...)
-	sort.Strings(vals)
-	for _, v := range vals {
-		if _, ok := seen[v]; ok {
-			continue
-		}
-		seen[v] = struct{}{}
-		_, _ = fmt.Printf("ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS '%s';\n", v)
-	}
-}
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index e7c612078b6f3..0352ce1c97d9a 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -112,6 +112,10 @@ export interface APIKey {
 
 // From codersdk/apikey.go
 export type APIKeyScope =
+	| "aibridge_interception:*"
+	| "aibridge_interception:create"
+	| "aibridge_interception:read"
+	| "aibridge_interception:update"
 	| "all"
 	| "api_key:*"
 	| "api_key:create"
@@ -119,6 +123,20 @@ export type APIKeyScope =
 	| "api_key:read"
 	| "api_key:update"
 	| "application_connect"
+	| "assign_org_role:*"
+	| "assign_org_role:assign"
+	| "assign_org_role:create"
+	| "assign_org_role:delete"
+	| "assign_org_role:read"
+	| "assign_org_role:unassign"
+	| "assign_org_role:update"
+	| "assign_role:*"
+	| "assign_role:assign"
+	| "assign_role:read"
+	| "assign_role:unassign"
+	| "audit_log:*"
+	| "audit_log:create"
+	| "audit_log:read"
 	| "coder:all"
 	| "coder:apikeys.manage_self"
 	| "coder:application_connect"
@@ -128,26 +146,156 @@ export type APIKeyScope =
 	| "coder:workspaces.create"
 	| "coder:workspaces.delete"
 	| "coder:workspaces.operate"
+	| "connection_log:*"
+	| "connection_log:read"
+	| "connection_log:update"
+	| "crypto_key:*"
+	| "crypto_key:create"
+	| "crypto_key:delete"
+	| "crypto_key:read"
+	| "crypto_key:update"
+	| "debug_info:*"
+	| "debug_info:read"
+	| "deployment_config:*"
+	| "deployment_config:read"
+	| "deployment_config:update"
+	| "deployment_stats:*"
+	| "deployment_stats:read"
 	| "file:*"
 	| "file:create"
 	| "file:read"
+	| "group:*"
+	| "group:create"
+	| "group:delete"
+	| "group_member:*"
+	| "group_member:read"
+	| "group:read"
+	| "group:update"
+	| "idpsync_settings:*"
+	| "idpsync_settings:read"
+	| "idpsync_settings:update"
+	| "inbox_notification:*"
+	| "inbox_notification:create"
+	| "inbox_notification:read"
+	| "inbox_notification:update"
+	| "license:*"
+	| "license:create"
+	| "license:delete"
+	| "license:read"
+	| "notification_message:*"
+	| "notification_message:create"
+	| "notification_message:delete"
+	| "notification_message:read"
+	| "notification_message:update"
+	| "notification_preference:*"
+	| "notification_preference:read"
+	| "notification_preference:update"
+	| "notification_template:*"
+	| "notification_template:read"
+	| "notification_template:update"
+	| "oauth2_app:*"
+	| "oauth2_app_code_token:*"
+	| "oauth2_app_code_token:create"
+	| "oauth2_app_code_token:delete"
+	| "oauth2_app_code_token:read"
+	| "oauth2_app:create"
+	| "oauth2_app:delete"
+	| "oauth2_app:read"
+	| "oauth2_app_secret:*"
+	| "oauth2_app_secret:create"
+	| "oauth2_app_secret:delete"
+	| "oauth2_app_secret:read"
+	| "oauth2_app_secret:update"
+	| "oauth2_app:update"
+	| "organization:*"
+	| "organization:create"
+	| "organization:delete"
+	| "organization_member:*"
+	| "organization_member:create"
+	| "organization_member:delete"
+	| "organization_member:read"
+	| "organization_member:update"
+	| "organization:read"
+	| "organization:update"
+	| "prebuilt_workspace:*"
+	| "prebuilt_workspace:delete"
+	| "prebuilt_workspace:update"
+	| "provisioner_daemon:*"
+	| "provisioner_daemon:create"
+	| "provisioner_daemon:delete"
+	| "provisioner_daemon:read"
+	| "provisioner_daemon:update"
+	| "provisioner_jobs:*"
+	| "provisioner_jobs:create"
+	| "provisioner_jobs:read"
+	| "provisioner_jobs:update"
+	| "replicas:*"
+	| "replicas:read"
+	| "system:*"
+	| "system:create"
+	| "system:delete"
+	| "system:read"
+	| "system:update"
+	| "tailnet_coordinator:*"
+	| "tailnet_coordinator:create"
+	| "tailnet_coordinator:delete"
+	| "tailnet_coordinator:read"
+	| "tailnet_coordinator:update"
 	| "template:*"
 	| "template:create"
 	| "template:delete"
 	| "template:read"
 	| "template:update"
 	| "template:use"
+	| "template:view_insights"
+	| "usage_event:*"
+	| "usage_event:create"
+	| "usage_event:read"
+	| "usage_event:update"
+	| "user:*"
+	| "user:create"
+	| "user:delete"
+	| "user:read"
 	| "user:read_personal"
 	| "user_secret:*"
 	| "user_secret:create"
 	| "user_secret:delete"
 	| "user_secret:read"
 	| "user_secret:update"
+	| "user:update"
 	| "user:update_personal"
+	| "webpush_subscription:*"
+	| "webpush_subscription:create"
+	| "webpush_subscription:delete"
+	| "webpush_subscription:read"
+	| "workspace_agent_devcontainers:*"
+	| "workspace_agent_devcontainers:create"
+	| "workspace_agent_resource_monitor:*"
+	| "workspace_agent_resource_monitor:create"
+	| "workspace_agent_resource_monitor:read"
+	| "workspace_agent_resource_monitor:update"
 	| "workspace:*"
 	| "workspace:application_connect"
 	| "workspace:create"
+	| "workspace:create_agent"
 	| "workspace:delete"
+	| "workspace:delete_agent"
+	| "workspace_dormant:*"
+	| "workspace_dormant:application_connect"
+	| "workspace_dormant:create"
+	| "workspace_dormant:create_agent"
+	| "workspace_dormant:delete"
+	| "workspace_dormant:delete_agent"
+	| "workspace_dormant:read"
+	| "workspace_dormant:ssh"
+	| "workspace_dormant:start"
+	| "workspace_dormant:stop"
+	| "workspace_dormant:update"
+	| "workspace_proxy:*"
+	| "workspace_proxy:create"
+	| "workspace_proxy:delete"
+	| "workspace_proxy:read"
+	| "workspace_proxy:update"
 	| "workspace:read"
 	| "workspace:ssh"
 	| "workspace:start"
@@ -155,6 +303,10 @@ export type APIKeyScope =
 	| "workspace:update";
 
 export const APIKeyScopes: APIKeyScope[] = [
+	"aibridge_interception:*",
+	"aibridge_interception:create",
+	"aibridge_interception:read",
+	"aibridge_interception:update",
 	"all",
 	"api_key:*",
 	"api_key:create",
@@ -162,6 +314,20 @@ export const APIKeyScopes: APIKeyScope[] = [
 	"api_key:read",
 	"api_key:update",
 	"application_connect",
+	"assign_org_role:*",
+	"assign_org_role:assign",
+	"assign_org_role:create",
+	"assign_org_role:delete",
+	"assign_org_role:read",
+	"assign_org_role:unassign",
+	"assign_org_role:update",
+	"assign_role:*",
+	"assign_role:assign",
+	"assign_role:read",
+	"assign_role:unassign",
+	"audit_log:*",
+	"audit_log:create",
+	"audit_log:read",
 	"coder:all",
 	"coder:apikeys.manage_self",
 	"coder:application_connect",
@@ -171,26 +337,156 @@ export const APIKeyScopes: APIKeyScope[] = [
 	"coder:workspaces.create",
 	"coder:workspaces.delete",
 	"coder:workspaces.operate",
+	"connection_log:*",
+	"connection_log:read",
+	"connection_log:update",
+	"crypto_key:*",
+	"crypto_key:create",
+	"crypto_key:delete",
+	"crypto_key:read",
+	"crypto_key:update",
+	"debug_info:*",
+	"debug_info:read",
+	"deployment_config:*",
+	"deployment_config:read",
+	"deployment_config:update",
+	"deployment_stats:*",
+	"deployment_stats:read",
 	"file:*",
 	"file:create",
 	"file:read",
+	"group:*",
+	"group:create",
+	"group:delete",
+	"group_member:*",
+	"group_member:read",
+	"group:read",
+	"group:update",
+	"idpsync_settings:*",
+	"idpsync_settings:read",
+	"idpsync_settings:update",
+	"inbox_notification:*",
+	"inbox_notification:create",
+	"inbox_notification:read",
+	"inbox_notification:update",
+	"license:*",
+	"license:create",
+	"license:delete",
+	"license:read",
+	"notification_message:*",
+	"notification_message:create",
+	"notification_message:delete",
+	"notification_message:read",
+	"notification_message:update",
+	"notification_preference:*",
+	"notification_preference:read",
+	"notification_preference:update",
+	"notification_template:*",
+	"notification_template:read",
+	"notification_template:update",
+	"oauth2_app:*",
+	"oauth2_app_code_token:*",
+	"oauth2_app_code_token:create",
+	"oauth2_app_code_token:delete",
+	"oauth2_app_code_token:read",
+	"oauth2_app:create",
+	"oauth2_app:delete",
+	"oauth2_app:read",
+	"oauth2_app_secret:*",
+	"oauth2_app_secret:create",
+	"oauth2_app_secret:delete",
+	"oauth2_app_secret:read",
+	"oauth2_app_secret:update",
+	"oauth2_app:update",
+	"organization:*",
+	"organization:create",
+	"organization:delete",
+	"organization_member:*",
+	"organization_member:create",
+	"organization_member:delete",
+	"organization_member:read",
+	"organization_member:update",
+	"organization:read",
+	"organization:update",
+	"prebuilt_workspace:*",
+	"prebuilt_workspace:delete",
+	"prebuilt_workspace:update",
+	"provisioner_daemon:*",
+	"provisioner_daemon:create",
+	"provisioner_daemon:delete",
+	"provisioner_daemon:read",
+	"provisioner_daemon:update",
+	"provisioner_jobs:*",
+	"provisioner_jobs:create",
+	"provisioner_jobs:read",
+	"provisioner_jobs:update",
+	"replicas:*",
+	"replicas:read",
+	"system:*",
+	"system:create",
+	"system:delete",
+	"system:read",
+	"system:update",
+	"tailnet_coordinator:*",
+	"tailnet_coordinator:create",
+	"tailnet_coordinator:delete",
+	"tailnet_coordinator:read",
+	"tailnet_coordinator:update",
 	"template:*",
 	"template:create",
 	"template:delete",
 	"template:read",
 	"template:update",
 	"template:use",
+	"template:view_insights",
+	"usage_event:*",
+	"usage_event:create",
+	"usage_event:read",
+	"usage_event:update",
+	"user:*",
+	"user:create",
+	"user:delete",
+	"user:read",
 	"user:read_personal",
 	"user_secret:*",
 	"user_secret:create",
 	"user_secret:delete",
 	"user_secret:read",
 	"user_secret:update",
+	"user:update",
 	"user:update_personal",
+	"webpush_subscription:*",
+	"webpush_subscription:create",
+	"webpush_subscription:delete",
+	"webpush_subscription:read",
+	"workspace_agent_devcontainers:*",
+	"workspace_agent_devcontainers:create",
+	"workspace_agent_resource_monitor:*",
+	"workspace_agent_resource_monitor:create",
+	"workspace_agent_resource_monitor:read",
+	"workspace_agent_resource_monitor:update",
 	"workspace:*",
 	"workspace:application_connect",
 	"workspace:create",
+	"workspace:create_agent",
 	"workspace:delete",
+	"workspace:delete_agent",
+	"workspace_dormant:*",
+	"workspace_dormant:application_connect",
+	"workspace_dormant:create",
+	"workspace_dormant:create_agent",
+	"workspace_dormant:delete",
+	"workspace_dormant:delete_agent",
+	"workspace_dormant:read",
+	"workspace_dormant:ssh",
+	"workspace_dormant:start",
+	"workspace_dormant:stop",
+	"workspace_dormant:update",
+	"workspace_proxy:*",
+	"workspace_proxy:create",
+	"workspace_proxy:delete",
+	"workspace_proxy:read",
+	"workspace_proxy:update",
 	"workspace:read",
 	"workspace:ssh",
 	"workspace:start",

From 815e58e872d936616b9110fba86a021f6290cd71 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Mon, 6 Oct 2025 12:21:21 +0100
Subject: [PATCH 058/298] chore: upgrade clistat to v1.0.2 (#20173)

clistat@v1.0.2 contains a bug fix for when `cpu.max` cgroup file is
missing
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index c375c113f143b..17addc97e8524 100644
--- a/go.mod
+++ b/go.mod
@@ -462,7 +462,7 @@ require (
 	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
-require github.com/coder/clistat v1.0.1
+require github.com/coder/clistat v1.0.2
 
 require github.com/SherClockHolmes/webpush-go v1.4.0
 
diff --git a/go.sum b/go.sum
index 03c0c1bc96e8b..2c18dc1f5adf6 100644
--- a/go.sum
+++ b/go.sum
@@ -919,8 +919,8 @@ github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945/go.mod h1:d1AMFw81rUgrGHuZzWdPNhkY0G8w7pvLNLYF0e3ceC4=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41 h1:SBN/DA63+ZHwuWwPHPYoCZ/KLAjHv5g4h2MS4f2/MTI=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41/go.mod h1:I9ULxr64UaOSUv7hcb3nX4kowodJCVS7vt7VVJk/kW4=
-github.com/coder/clistat v1.0.1 h1:0ZgnKr1C4Z0ukG1z1+RUa8Z4OoIgWIH2hdxWSXQTubE=
-github.com/coder/clistat v1.0.1/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
+github.com/coder/clistat v1.0.2 h1:9SjtcTVMGfM5LbdhjnkyxO3RCngrLvVu1+NXBs9QUy0=
+github.com/coder/clistat v1.0.2/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
 github.com/coder/flog v1.1.0 h1:kbAes1ai8fIS5OeV+QAnKBQE22ty1jRF/mcAwHpLBa4=
 github.com/coder/flog v1.1.0/go.mod h1:UQlQvrkJBvnRGo69Le8E24Tcl5SJleAAR7gYEHzAmdQ=
 github.com/coder/glog v1.0.1-0.20220322161911-7365fe7f2cd1/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=

From dd99d40ad69df231a1ff241c72c3a3110c7c76cc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Oct 2025 11:57:20 +0000
Subject: [PATCH 059/298] chore: bump github.com/go-playground/validator/v10
 from 10.27.0 to 10.28.0 (#20176)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps
[github.com/go-playground/validator/v10](https://github.com/go-playground/validator)
from 10.27.0 to 10.28.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/go-playground/validator/releases">github.com/go-playground/validator/v10's
releases</a>.</em></p>
<blockquote>
<h2>Release 10.28.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update workflow.yml to support 2 most recent major versions by <a
href="https://github.com/nodivbyzero"><code>@​nodivbyzero</code></a> in
<a
href="https://redirect.github.com/go-playground/validator/pull/1417">go-playground/validator#1417</a></li>
<li>Bump actions/checkout from 4 to 5 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/go-playground/validator/pull/1456">go-playground/validator#1456</a></li>
<li>Go 1.25 support by <a
href="https://github.com/nodivbyzero"><code>@​nodivbyzero</code></a> in
<a
href="https://redirect.github.com/go-playground/validator/pull/1459">go-playground/validator#1459</a></li>
<li>Bump github.com/gabriel-vasile/mimetype from 1.4.8 to 1.4.10 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/go-playground/validator/pull/1463">go-playground/validator#1463</a></li>
<li>Bump golang.org/x/text from 0.22.0 to 0.29.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/go-playground/validator/pull/1464">go-playground/validator#1464</a></li>
<li>Bump actions/setup-go from 5 to 6 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/go-playground/validator/pull/1465">go-playground/validator#1465</a></li>
<li>Bump golang.org/x/crypto from 0.33.0 to 0.42.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/go-playground/validator/pull/1467">go-playground/validator#1467</a></li>
<li>fix: should panic when define duplicate field param in
<code>required_if</code> by <a
href="https://github.com/duyquang6"><code>@​duyquang6</code></a> in <a
href="https://redirect.github.com/go-playground/validator/pull/1468">go-playground/validator#1468</a></li>
<li>Fixed missing keys from returned errors in map validation by <a
href="https://github.com/gelozr"><code>@​gelozr</code></a> in <a
href="https://redirect.github.com/go-playground/validator/pull/1284">go-playground/validator#1284</a></li>
<li>Added https_url tag by <a
href="https://github.com/ahmedkamalio"><code>@​ahmedkamalio</code></a>
in <a
href="https://redirect.github.com/go-playground/validator/pull/1461">go-playground/validator#1461</a></li>
<li>docs: add description for 'port' validator by <a
href="https://github.com/nodivbyzero"><code>@​nodivbyzero</code></a> in
<a
href="https://redirect.github.com/go-playground/validator/pull/1435">go-playground/validator#1435</a></li>
<li>Add alphaspace validator by <a
href="https://github.com/takaaa220"><code>@​takaaa220</code></a> in <a
href="https://redirect.github.com/go-playground/validator/pull/1343">go-playground/validator#1343</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/duyquang6"><code>@​duyquang6</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-playground/validator/pull/1468">go-playground/validator#1468</a></li>
<li><a href="https://github.com/gelozr"><code>@​gelozr</code></a> made
their first contribution in <a
href="https://redirect.github.com/go-playground/validator/pull/1284">go-playground/validator#1284</a></li>
<li><a
href="https://github.com/ahmedkamalio"><code>@​ahmedkamalio</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-playground/validator/pull/1461">go-playground/validator#1461</a></li>
<li><a href="https://github.com/takaaa220"><code>@​takaaa220</code></a>
made their first contribution in <a
href="https://redirect.github.com/go-playground/validator/pull/1343">go-playground/validator#1343</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/go-playground/validator/compare/v10.27.0...v10.28.0">https://github.com/go-playground/validator/compare/v10.27.0...v10.28.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/go-playground/validator/commit/bdc3a7d31bd8269baa07904324e8fb22fb2f9372"><code>bdc3a7d</code></a>
Add alphaspace validator (<a
href="https://redirect.github.com/go-playground/validator/issues/1343">#1343</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/63594a0fbee5293ac7bc6c80286c3277cd2ddb45"><code>63594a0</code></a>
docs: add description for 'port' validator (<a
href="https://redirect.github.com/go-playground/validator/issues/1435">#1435</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/45f3a8e09a4d0b995829fe0613289db4fb69b850"><code>45f3a8e</code></a>
Added https_url tag (<a
href="https://redirect.github.com/go-playground/validator/issues/1461">#1461</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/7a23bca81c8bc72c578252b524665ea173b489da"><code>7a23bca</code></a>
Remove Go version 1.23 from CI workflow</li>
<li><a
href="https://github.com/go-playground/validator/commit/13130d2e78838bec6b9e4dbce756c183844590e7"><code>13130d2</code></a>
Fixed missing keys from returned errors in map validation (<a
href="https://redirect.github.com/go-playground/validator/issues/1284">#1284</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/94e89f0942028ebfb17426b8d3c2005a46557621"><code>94e89f0</code></a>
fix: should panic when define duplicate field param in
<code>required_if</code> (<a
href="https://redirect.github.com/go-playground/validator/issues/1468">#1468</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/6905468e4559e0937518de42c92cb6b5c023342d"><code>6905468</code></a>
Bump golang.org/x/crypto from 0.33.0 to 0.42.0 (<a
href="https://redirect.github.com/go-playground/validator/issues/1467">#1467</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/77ef70e2d1287e50641c096ca1c3d09497e7197c"><code>77ef70e</code></a>
Bump actions/setup-go from 5 to 6 (<a
href="https://redirect.github.com/go-playground/validator/issues/1465">#1465</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/78d05ae554de682d121e78a6a62d7de01be8e863"><code>78d05ae</code></a>
Bump golang.org/x/text from 0.22.0 to 0.29.0 (<a
href="https://redirect.github.com/go-playground/validator/issues/1464">#1464</a>)</li>
<li><a
href="https://github.com/go-playground/validator/commit/34aea1f62ca76abe2999265d25c8dcf8507cb3ed"><code>34aea1f</code></a>
Bump github.com/gabriel-vasile/mimetype from 1.4.8 to 1.4.10 (<a
href="https://redirect.github.com/go-playground/validator/issues/1463">#1463</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/go-playground/validator/compare/v10.27.0...v10.28.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/go-playground/validator/v10&package-manager=go_modules&previous-version=10.27.0&new-version=10.28.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 17addc97e8524..655dde3efe426 100644
--- a/go.mod
+++ b/go.mod
@@ -125,7 +125,7 @@ require (
 	github.com/go-chi/httprate v0.15.0
 	github.com/go-jose/go-jose/v4 v4.1.1
 	github.com/go-logr/logr v1.4.3
-	github.com/go-playground/validator/v10 v10.27.0
+	github.com/go-playground/validator/v10 v10.28.0
 	github.com/gofrs/flock v0.12.1
 	github.com/gohugoio/hugo v0.150.0
 	github.com/golang-jwt/jwt/v4 v4.5.2
@@ -296,7 +296,7 @@ require (
 	github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
 	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/gabriel-vasile/mimetype v1.4.8 // indirect
+	github.com/gabriel-vasile/mimetype v1.4.10 // indirect
 	github.com/go-chi/hostrouter v0.3.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
diff --git a/go.sum b/go.sum
index 2c18dc1f5adf6..d441935a07652 100644
--- a/go.sum
+++ b/go.sum
@@ -1094,8 +1094,8 @@ github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa h1:RDBNVkRviHZtvD
 github.com/fullsailor/pkcs7 v0.0.0-20190404230743-d7302db945fa/go.mod h1:KnogPXtdwXqoenmZCw6S+25EAm2MkxbG0deNDu4cbSA=
 github.com/fxamacker/cbor/v2 v2.7.0 h1:iM5WgngdRBanHcxugY4JySA0nk1wZorNOpTgCMedv5E=
 github.com/fxamacker/cbor/v2 v2.7.0/go.mod h1:pxXPTn3joSm21Gbwsv0w9OSA2y1HFR9qXEeXQVeNoDQ=
-github.com/gabriel-vasile/mimetype v1.4.8 h1:FfZ3gj38NjllZIeJAmMhr+qKL8Wu+nOoI3GqacKw1NM=
-github.com/gabriel-vasile/mimetype v1.4.8/go.mod h1:ByKUIKGjh1ODkGM1asKUbQZOLGrPjydw3hYPU2YU9t8=
+github.com/gabriel-vasile/mimetype v1.4.10 h1:zyueNbySn/z8mJZHLt6IPw0KoZsiQNszIpU+bX4+ZK0=
+github.com/gabriel-vasile/mimetype v1.4.10/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s=
 github.com/gen2brain/beeep v0.11.1 h1:EbSIhrQZFDj1K2fzlMpAYlFOzV8YuNe721A58XcCTYI=
 github.com/gen2brain/beeep v0.11.1/go.mod h1:jQVvuwnLuwOcdctHn/uyh8horSBNJ8uGb9Cn2W4tvoc=
 github.com/getkin/kin-openapi v0.133.0 h1:pJdmNohVIJ97r4AUFtEXRXwESr8b0bD721u/Tz6k8PQ=
@@ -1163,8 +1163,8 @@ github.com/go-playground/locales v0.14.1 h1:EWaQ/wswjilfKLTECiXz7Rh+3BjFhfDFKv/o
 github.com/go-playground/locales v0.14.1/go.mod h1:hxrqLVvrK65+Rwrd5Fc6F2O76J/NuW9t0sjnWqG1slY=
 github.com/go-playground/universal-translator v0.18.1 h1:Bcnm0ZwsGyWbCzImXv+pAJnYK9S473LQFuzCbDbfSFY=
 github.com/go-playground/universal-translator v0.18.1/go.mod h1:xekY+UJKNuX9WP91TpwSH2VMlDf28Uj24BCp08ZFTUY=
-github.com/go-playground/validator/v10 v10.27.0 h1:w8+XrWVMhGkxOaaowyKH35gFydVHOvC0/uWoy2Fzwn4=
-github.com/go-playground/validator/v10 v10.27.0/go.mod h1:I5QpIEbmr8On7W0TktmJAumgzX4CA1XNl4ZmDuVHKKo=
+github.com/go-playground/validator/v10 v10.28.0 h1:Q7ibns33JjyW48gHkuFT91qX48KG0ktULL6FgHdG688=
+github.com/go-playground/validator/v10 v10.28.0/go.mod h1:GoI6I1SjPBh9p7ykNE/yj3fFYbyDOpwMn5KXd+m2hUU=
 github.com/go-sourcemap/sourcemap v2.1.3+incompatible h1:W1iEw64niKVGogNgBN3ePyLFfuisuzeidWPMPWmECqU=
 github.com/go-sourcemap/sourcemap v2.1.3+incompatible/go.mod h1:F8jJfvm2KbVjc5NqelyYJmf/v5J0dwNLS2mL4sNA1Jg=
 github.com/go-sql-driver/mysql v1.8.1/go.mod h1:wEBSXgmK//2ZFJyE+qWnIsVGmvmEKlqwuVSjsCm7DZg=

From a7c9e623fe7b57145498efd512dfdc809c4ef0b6 Mon Sep 17 00:00:00 2001
From: Sas Swart <sas.swart.cdk@gmail.com>
Date: Mon, 6 Oct 2025 13:58:37 +0200
Subject: [PATCH 060/298] chore: fix api param name (#20172)

In https://github.com/coder/coder/pull/20137, we added a new flag to
`coder provisioner jobs list`, namely `--initiator`.

To make some follow-up worth it, I need to rename an API param used in
the process before it becomes part of our released and tagged API.

Instead of only accepting UUIDs, we accept an arbitrary string.
We still validate it as a UUID now, but we will expand its validation to
allow any string and then resolve that string the same way that we
resolve the user parameter elsewhere in the API.
---
 cli/provisionerjobs.go         | 10 ++++------
 coderd/provisionerjobs.go      |  2 +-
 coderd/provisionerjobs_test.go | 20 ++++++++++----------
 codersdk/organizations.go      | 14 +++++++-------
 site/src/api/typesGenerated.ts |  2 +-
 5 files changed, 23 insertions(+), 25 deletions(-)

diff --git a/cli/provisionerjobs.go b/cli/provisionerjobs.go
index 3f441a1758045..ee29476ef09dd 100644
--- a/cli/provisionerjobs.go
+++ b/cli/provisionerjobs.go
@@ -66,20 +66,18 @@ func (r *RootCmd) provisionerJobsList() *serpent.Command {
 				return xerrors.Errorf("current organization: %w", err)
 			}
 
-			var initiatorID *uuid.UUID
-
 			if initiator != "" {
 				user, err := client.User(ctx, initiator)
 				if err != nil {
 					return xerrors.Errorf("initiator not found: %s", initiator)
 				}
-				initiatorID = &user.ID
+				initiator = user.ID.String()
 			}
 
 			jobs, err := client.OrganizationProvisionerJobs(ctx, org.ID, &codersdk.OrganizationProvisionerJobsOptions{
-				Status:      slice.StringEnums[codersdk.ProvisionerJobStatus](status),
-				Limit:       int(limit),
-				InitiatorID: initiatorID,
+				Status:    slice.StringEnums[codersdk.ProvisionerJobStatus](status),
+				Limit:     int(limit),
+				Initiator: initiator,
 			})
 			if err != nil {
 				return xerrors.Errorf("list provisioner jobs: %w", err)
diff --git a/coderd/provisionerjobs.go b/coderd/provisionerjobs.go
index 4ba923dae2477..68f2207f2f90c 100644
--- a/coderd/provisionerjobs.go
+++ b/coderd/provisionerjobs.go
@@ -111,7 +111,7 @@ func (api *API) handleAuthAndFetchProvisionerJobs(rw http.ResponseWriter, r *htt
 		ids = p.UUIDs(qp, nil, "ids")
 	}
 	tags := p.JSONStringMap(qp, database.StringMap{}, "tags")
-	initiatorID := p.UUID(qp, uuid.Nil, "initiator_id")
+	initiatorID := p.UUID(qp, uuid.Nil, "initiator")
 	p.ErrorExcessParams(qp)
 	if len(p.Errors) > 0 {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
diff --git a/coderd/provisionerjobs_test.go b/coderd/provisionerjobs_test.go
index 829c72aa4dbd0..91096e3b64905 100644
--- a/coderd/provisionerjobs_test.go
+++ b/coderd/provisionerjobs_test.go
@@ -173,7 +173,7 @@ func TestProvisionerJobs(t *testing.T) {
 			ctx := testutil.Context(t, testutil.WaitMedium)
 
 			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: &member.ID,
+				Initiator: member.ID.String(),
 			})
 			require.NoError(t, err)
 			require.GreaterOrEqual(t, len(jobs), 1)
@@ -186,8 +186,8 @@ func TestProvisionerJobs(t *testing.T) {
 
 			// Test filtering by initiator ID combined with status filter
 			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: &owner.UserID,
-				Status:      []codersdk.ProvisionerJobStatus{codersdk.ProvisionerJobSucceeded},
+				Initiator: owner.UserID.String(),
+				Status:    []codersdk.ProvisionerJobStatus{codersdk.ProvisionerJobSucceeded},
 			})
 			require.NoError(t, err)
 
@@ -204,8 +204,8 @@ func TestProvisionerJobs(t *testing.T) {
 
 			// Test filtering by initiator ID with limit
 			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: &owner.UserID,
-				Limit:       1,
+				Initiator: owner.UserID.String(),
+				Limit:     1,
 			})
 			require.NoError(t, err)
 			require.Len(t, jobs, 1)
@@ -220,8 +220,8 @@ func TestProvisionerJobs(t *testing.T) {
 
 			// Test filtering by initiator ID combined with tags
 			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: &member.ID,
-				Tags:        map[string]string{"initiatorTest": "true"},
+				Initiator: member.ID.String(),
+				Tags:      map[string]string{"initiatorTest": "true"},
 			})
 			require.NoError(t, err)
 			require.Len(t, jobs, 1)
@@ -238,7 +238,7 @@ func TestProvisionerJobs(t *testing.T) {
 			// Test with non-existent initiator ID
 			nonExistentID := uuid.New()
 			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: &nonExistentID,
+				Initiator: nonExistentID.String(),
 			})
 			require.NoError(t, err)
 			require.Len(t, jobs, 0)
@@ -250,7 +250,7 @@ func TestProvisionerJobs(t *testing.T) {
 
 			// Test with nil initiator ID (should return all jobs)
 			jobs, err := templateAdminClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: nil,
+				Initiator: "",
 			})
 			require.NoError(t, err)
 			require.GreaterOrEqual(t, len(jobs), 50) // Should return all jobs (up to default limit)
@@ -282,7 +282,7 @@ func TestProvisionerJobs(t *testing.T) {
 			ctx := testutil.Context(t, testutil.WaitMedium)
 			// Member should not be able to access jobs even with initiator filter
 			jobs, err := memberClient.OrganizationProvisionerJobs(ctx, owner.OrganizationID, &codersdk.OrganizationProvisionerJobsOptions{
-				InitiatorID: &member.ID,
+				Initiator: member.ID.String(),
 			})
 			require.Error(t, err)
 			require.Len(t, jobs, 0)
diff --git a/codersdk/organizations.go b/codersdk/organizations.go
index 291bb9ac1baf7..823169d385b22 100644
--- a/codersdk/organizations.go
+++ b/codersdk/organizations.go
@@ -397,11 +397,11 @@ func (c *Client) OrganizationProvisionerDaemons(ctx context.Context, organizatio
 }
 
 type OrganizationProvisionerJobsOptions struct {
-	Limit       int
-	IDs         []uuid.UUID
-	Status      []ProvisionerJobStatus
-	Tags        map[string]string
-	InitiatorID *uuid.UUID
+	Limit     int
+	IDs       []uuid.UUID
+	Status    []ProvisionerJobStatus
+	Tags      map[string]string
+	Initiator string
 }
 
 func (c *Client) OrganizationProvisionerJobs(ctx context.Context, organizationID uuid.UUID, opts *OrganizationProvisionerJobsOptions) ([]ProvisionerJob, error) {
@@ -423,8 +423,8 @@ func (c *Client) OrganizationProvisionerJobs(ctx context.Context, organizationID
 			}
 			qp.Add("tags", string(tagsRaw))
 		}
-		if opts.InitiatorID != nil {
-			qp.Add("initiator_id", opts.InitiatorID.String())
+		if opts.Initiator != "" {
+			qp.Add("initiator", opts.Initiator)
 		}
 	}
 
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 0352ce1c97d9a..1e07cf1aa2895 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -2356,7 +2356,7 @@ export interface OrganizationProvisionerJobsOptions {
 	readonly IDs: readonly string[];
 	readonly Status: readonly ProvisionerJobStatus[];
 	readonly Tags: Record<string, string>;
-	readonly InitiatorID: string | null;
+	readonly Initiator: string;
 }
 
 // From codersdk/idpsync.go

From 5fdc4185c75affca050851fb7ce42201d49a4e28 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Oct 2025 11:58:57 +0000
Subject: [PATCH 061/298] chore: bump github.com/moby/moby from
 28.4.0+incompatible to 28.5.0+incompatible (#20177)

Bumps [github.com/moby/moby](https://github.com/moby/moby) from
28.4.0+incompatible to 28.5.0+incompatible.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/moby/moby/releases">github.com/moby/moby's
releases</a>.</em></p>
<blockquote>
<h2>v28.5.0</h2>
<h1>28.5.0</h1>
<p>For a full list of pull requests and changes in this release, refer
to the relevant GitHub milestones:</p>
<ul>
<li><a
href="https://github.com/docker/cli/issues?q=is%3Aclosed+milestone%3A28.5.0">docker/cli,
28.5.0 milestone</a></li>
<li><a
href="https://github.com/moby/moby/issues?q=is%3Aclosed+milestone%3A28.5.0">moby/moby,
28.5.0 milestone</a></li>
<li>Deprecated and removed features, see <a
href="https://github.com/docker/cli/blob/v28.5.0/docs/deprecated.md">Deprecated
Features</a>.</li>
<li>Changes to the Engine API, see <a
href="https://github.com/moby/moby/blob/v28.5.0/docs/api/version-history.md">API
version history</a>.</li>
</ul>
<h3>Bug fixes and enhancements</h3>
<ul>
<li>Don't print warnings in <code>docker info</code> for broken symlinks
in CLI-plugin directories. <a
href="https://redirect.github.com/docker/cli/pull/6476">docker/cli#6476</a></li>
<li>Fix a panic during <code>stats</code> on empty event
<code>Actor.ID</code>. <a
href="https://redirect.github.com/docker/cli/pull/6471">docker/cli#6471</a></li>
</ul>
<h3>Packaging updates</h3>
<ul>
<li>Remove support for legacy CBC cipher suites. <a
href="https://redirect.github.com/docker/cli/pull/6474">docker/cli#6474</a></li>
<li>Update Buildkit to <a
href="https://github.com/moby/buildkit/releases/tag/v0.25.0">v0.25.0</a>.
<a
href="https://redirect.github.com/moby/moby/pull/51075">moby/moby#51075</a></li>
<li>Update Dockerfile syntax to <a
href="https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.19.0">v1.19.0</a>.
<a
href="https://redirect.github.com/moby/moby/pull/51075">moby/moby#51075</a></li>
</ul>
<h3>Networking</h3>
<ul>
<li>Eliminated harmless warning about deletion of
<code>endpoint_count</code> from the data store. <a
href="https://redirect.github.com/moby/moby/pull/51064">moby/moby#51064</a></li>
<li>Fix a bug causing IPAM plugins to not be loaded on Windows. <a
href="https://redirect.github.com/moby/moby/pull/51035">moby/moby#51035</a></li>
</ul>
<h3>API</h3>
<ul>
<li>Deprecate support for kernel memory TCP accounting
(<code>KernelMemoryTCP</code>). <a
href="https://redirect.github.com/moby/moby/pull/51067">moby/moby#51067</a></li>
<li>Fix <code>GET containers/{name}/checkpoints</code> returning
<code>null</code> instead of empty JSON array when there are no
checkpoints. <a
href="https://redirect.github.com/moby/moby/pull/51052">moby/moby#51052</a></li>
</ul>
<h3>Go SDK</h3>
<ul>
<li>cli-plugins/plugin: Run: allow customizing the CLI. <a
href="https://redirect.github.com/docker/cli/pull/6481">docker/cli#6481</a></li>
<li>cli/command: add <code>WithUserAgent</code> option. <a
href="https://redirect.github.com/docker/cli/pull/6477">docker/cli#6477</a></li>
</ul>
<h3>Deprecations</h3>
<ul>
<li>Go-SDK: cli/command: deprecate <code>DockerCli.Apply</code>. This
method is no longer used and will be removed in the next release if
there are no remaining uses. <a
href="https://redirect.github.com/docker/cli/pull/6497">docker/cli#6497</a></li>
<li>Go-SDK: cli/command: deprecate
<code>DockerCli.ContentTrustEnabled</code>. This method is no longer
used and will be removed in the next release. <a
href="https://redirect.github.com/docker/cli/pull/6495">docker/cli#6495</a></li>
<li>Go-SDK: cli/command: deprecate
<code>DockerCli.DefaultVersion</code>. This method is no longer used and
will be removed in the next release. <a
href="https://redirect.github.com/docker/cli/pull/6491">docker/cli#6491</a></li>
<li>Go-SDK: cli/command: deprecate <code>ResolveDefaultContext</code>
utility. <a
href="https://redirect.github.com/docker/cli/pull/6529">docker/cli#6529</a></li>
<li>Go-SDK: cli/command: deprecate <code>WithContentTrustFromEnv</code>,
<code>WithContentTrust</code> options. These options were used
internally, and will be removed in the next release.. <a
href="https://redirect.github.com/docker/cli/pull/6489">docker/cli#6489</a></li>
<li>Go-SDK: cli/manifest/store: deprecate <code>IsNotFound()</code>. <a
href="https://redirect.github.com/docker/cli/pull/6514">docker/cli#6514</a></li>
<li>Go-SDK: templates: deprecate NewParse() function. <a
href="https://redirect.github.com/docker/cli/pull/6469">docker/cli#6469</a></li>
</ul>
<h2>v28.5.0-rc.1</h2>
<h2>28.5.0-rc.1</h2>
<p>For a full list of pull requests and changes in this release, refer
to the relevant GitHub milestones:</p>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/moby/moby/commit/cd048300a48700294339c9c91d2dcc691cb8f63b"><code>cd04830</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51075">#51075</a>
from vvoland/51074-28.x</li>
<li><a
href="https://github.com/moby/moby/commit/e29d6be7a5126c4677a974cac3b9610e5157c780"><code>e29d6be</code></a>
vendor: github.com/moby/buildkit v0.25.0</li>
<li><a
href="https://github.com/moby/moby/commit/9b4369035bed7dfdc3799484159ca4ed09e04e8e"><code>9b43690</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51069">#51069</a>
from thaJeztah/28.x_backport_docs_rm_deprecated_vir...</li>
<li><a
href="https://github.com/moby/moby/commit/4f3572596b4db81e89aa69cbee8741591d77ad47"><code>4f35725</code></a>
api: swagger: remove VirtualSize fields for API &gt; v1.43</li>
<li><a
href="https://github.com/moby/moby/commit/79f310d4bc0272183fdd9fed87b0a6881c185ca2"><code>79f310d</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51067">#51067</a>
from austinvazquez/cherry-pick-deprecate-kernel-mem...</li>
<li><a
href="https://github.com/moby/moby/commit/deb4bbbfe09dfea5289d6a410d3c73d8a49a13ac"><code>deb4bbb</code></a>
api: deprecate <code>KernelMemoryTCP</code> support</li>
<li><a
href="https://github.com/moby/moby/commit/423a7fd6af43765bb80d5ab94fcd60c7daa64033"><code>423a7fd</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51064">#51064</a>
from thaJeztah/28.x_backport_fix_epcnt_warning</li>
<li><a
href="https://github.com/moby/moby/commit/fbf2fe8b7dc2cc532ef7de136f95016f7f56b267"><code>fbf2fe8</code></a>
Eliminate warning about endpoint count store delete</li>
<li><a
href="https://github.com/moby/moby/commit/252a1ebe7effbc4e7e2272154332111d1fc916b2"><code>252a1eb</code></a>
Merge pull request <a
href="https://redirect.github.com/moby/moby/issues/51061">#51061</a>
from thaJeztah/28.x_backport_rm_email_example</li>
<li><a
href="https://github.com/moby/moby/commit/2c15eb6617efb30cb828ce1a7133df6aa1689314"><code>2c15eb6</code></a>
api/docs: remove email field from example auth</li>
<li>Additional commits viewable in <a
href="https://github.com/moby/moby/compare/v28.4.0...v28.5.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/moby/moby&package-manager=go_modules&previous-version=28.4.0+incompatible&new-version=28.5.0+incompatible)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 655dde3efe426..584cc4595e339 100644
--- a/go.mod
+++ b/go.mod
@@ -154,7 +154,7 @@ require (
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mitchellh/go-wordwrap v1.0.1
 	github.com/mitchellh/mapstructure v1.5.1-0.20231216201459-8508981c8b6c
-	github.com/moby/moby v28.4.0+incompatible
+	github.com/moby/moby v28.5.0+incompatible
 	github.com/mocktools/go-smtp-mock/v2 v2.5.0
 	github.com/muesli/termenv v0.16.0
 	github.com/natefinch/atomic v1.0.1
diff --git a/go.sum b/go.sum
index d441935a07652..cdd3ae49e5e69 100644
--- a/go.sum
+++ b/go.sum
@@ -1586,8 +1586,8 @@ github.com/moby/docker-image-spec v1.3.1 h1:jMKff3w6PgbfSa69GfNg+zN/XLhfXJGnEx3N
 github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo=
 github.com/moby/go-archive v0.1.0 h1:Kk/5rdW/g+H8NHdJW2gsXyZ7UnzvJNOy6VKJqueWdcQ=
 github.com/moby/go-archive v0.1.0/go.mod h1:G9B+YoujNohJmrIYFBpSd54GTUB4lt9S+xVQvsJyFuo=
-github.com/moby/moby v28.4.0+incompatible h1:Rhu/o+7EaHGx0MV3KOouThtr3hY33m3aKyA6GDR2QmQ=
-github.com/moby/moby v28.4.0+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
+github.com/moby/moby v28.5.0+incompatible h1:eN6ksRE7BojoGW18USJGfyqhx/FWJPLs0jqaTNlfSsM=
+github.com/moby/moby v28.5.0+incompatible/go.mod h1:fDXVQ6+S340veQPv35CzDahGBmHsiclFwfEygB/TWMc=
 github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk=
 github.com/moby/patternmatcher v0.6.0/go.mod h1:hDPoyOpDY7OrrMDLaYoY3hf52gNCR/YOUYxkhApJIxc=
 github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU=

From 3f49e283086ae17cecc6d9b0d917e0bc50882ebd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 6 Oct 2025 11:59:26 +0000
Subject: [PATCH 062/298] chore: bump github.com/coreos/go-oidc/v3 from 3.15.0
 to 3.16.0 (#20178)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/coreos/go-oidc/v3](https://github.com/coreos/go-oidc)
from 3.15.0 to 3.16.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/coreos/go-oidc/releases">github.com/coreos/go-oidc/v3's
releases</a>.</em></p>
<blockquote>
<h2>v3.16.0</h2>
<h2>What's Changed</h2>
<ul>
<li>refactor: Remove unused time injection from RemoteKeySet by <a
href="https://github.com/ponimas"><code>@​ponimas</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/466">coreos/go-oidc#466</a></li>
<li>bump go to 1.24, remove 1.23 support, bump go-jose dependency,
remove x/net dependency by <a
href="https://github.com/wardviaene"><code>@​wardviaene</code></a> in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/wardviaene"><code>@​wardviaene</code></a> made
their first contribution in <a
href="https://redirect.github.com/coreos/go-oidc/pull/467">coreos/go-oidc#467</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/coreos/go-oidc/commit/e9584733f8bb6c4683d1e98b4fb22eee121f7dff"><code>e958473</code></a>
bump go to 1.24, remove 1.23 support, bump go-jose dependency, remove
x/net d...</li>
<li><a
href="https://github.com/coreos/go-oidc/commit/69b167061fdb7270ef965f150ea6aabe11678728"><code>69b1670</code></a>
refactor: Remove unused time injection from RemoteKeySet</li>
<li>See full diff in <a
href="https://github.com/coreos/go-oidc/compare/v3.15.0...v3.16.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/coreos/go-oidc/v3&package-manager=go_modules&previous-version=3.15.0&new-version=3.16.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 584cc4595e339..f5d8227f9a9c1 100644
--- a/go.mod
+++ b/go.mod
@@ -104,7 +104,7 @@ require (
 	github.com/coder/terraform-provider-coder/v2 v2.11.0
 	github.com/coder/websocket v1.8.13
 	github.com/coder/wgtunnel v0.1.13-0.20240522110300-ade90dfb2da0
-	github.com/coreos/go-oidc/v3 v3.15.0
+	github.com/coreos/go-oidc/v3 v3.16.0
 	github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf
 	github.com/creack/pty v1.1.21
 	github.com/dave/dst v0.27.2
@@ -123,7 +123,7 @@ require (
 	github.com/go-chi/chi/v5 v5.2.2
 	github.com/go-chi/cors v1.2.1
 	github.com/go-chi/httprate v0.15.0
-	github.com/go-jose/go-jose/v4 v4.1.1
+	github.com/go-jose/go-jose/v4 v4.1.3
 	github.com/go-logr/logr v1.4.3
 	github.com/go-playground/validator/v10 v10.28.0
 	github.com/gofrs/flock v0.12.1
diff --git a/go.sum b/go.sum
index cdd3ae49e5e69..193bb9536325b 100644
--- a/go.sum
+++ b/go.sum
@@ -970,8 +970,8 @@ github.com/containerd/platforms v1.0.0-rc.1 h1:83KIq4yy1erSRgOVHNk1HYdPvzdJ5CnsW
 github.com/containerd/platforms v1.0.0-rc.1/go.mod h1:J71L7B+aiM5SdIEqmd9wp6THLVRzJGXfNuWCZCllLA4=
 github.com/coreos/go-iptables v0.6.0 h1:is9qnZMPYjLd8LYqmm/qlE+wwEgJIkTYdhV3rfZo4jk=
 github.com/coreos/go-iptables v0.6.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q=
-github.com/coreos/go-oidc/v3 v3.15.0 h1:R6Oz8Z4bqWR7VFQ+sPSvZPQv4x8M+sJkDO5ojgwlyAg=
-github.com/coreos/go-oidc/v3 v3.15.0/go.mod h1:HaZ3szPaZ0e4r6ebqvsLWlk2Tn+aejfmrfah6hnSYEU=
+github.com/coreos/go-oidc/v3 v3.16.0 h1:qRQUCFstKpXwmEjDQTIbyY/5jF00+asXzSkmkoa/mow=
+github.com/coreos/go-oidc/v3 v3.16.0/go.mod h1:wqPbKFrVnE90vty060SB40FCJ8fTHTxSwyXJqZH+sI8=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf h1:iW4rZ826su+pqaw19uhpSCzhj44qo35pNgKFGqzDKkU=
 github.com/coreos/go-systemd v0.0.0-20191104093116-d3cd4ed1dbcf/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
 github.com/cpuguy83/dockercfg v0.3.2 h1:DlJTyZGBDlXqUZ2Dk2Q3xHs/FtnooJJVaad2S9GKorA=
@@ -1130,8 +1130,8 @@ github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2
 github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8=
 github.com/go-ini/ini v1.67.0 h1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=
 github.com/go-ini/ini v1.67.0/go.mod h1:ByCAeIL28uOIIG0E3PJtZPDL8WnHpFKFOtgjp+3Ies8=
-github.com/go-jose/go-jose/v4 v4.1.1 h1:JYhSgy4mXXzAdF3nUx3ygx347LRXJRrpgyU3adRmkAI=
-github.com/go-jose/go-jose/v4 v4.1.1/go.mod h1:BdsZGqgdO3b6tTc6LSE56wcDbMMLuPsw5d4ZD5f94kA=
+github.com/go-jose/go-jose/v4 v4.1.3 h1:CVLmWDhDVRa6Mi/IgCgaopNosCaHz7zrMeF9MlZRkrs=
+github.com/go-jose/go-jose/v4 v4.1.3/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08=
 github.com/go-json-experiment/json v0.0.0-20250725192818-e39067aee2d2 h1:iizUGZ9pEquQS5jTGkh4AqeeHCMbfbjeb0zMt0aEFzs=
 github.com/go-json-experiment/json v0.0.0-20250725192818-e39067aee2d2/go.mod h1:TiCD2a1pcmjd7YnhGH0f/zKNcCD06B029pHhzV23c2M=
 github.com/go-latex/latex v0.0.0-20210118124228-b3d85cf34e07/go.mod h1:CO1AlKB2CSIqUrmQPqA0gdRIlnLEY0gK5JGjh37zN5U=

From 840afb225b8050eae32a1eca8910f356e203a8e9 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Mon, 6 Oct 2025 10:23:53 -0300
Subject: [PATCH 063/298] feat: select template version for tasks (#20146)

Allows users with `updateTemplates` permission to select a specific
template version when creating a task.

One of the biggest changes was moving `TaskPrompt` into `modules/task`
and adding a Storybook entry for it. I also moved some stories from
`TasksPage` to simplify its story.

<img width="1208" height="197" alt="Screenshot 2025-10-02 at 12 09 06"
src="https://github.com/user-attachments/assets/b85d2723-bb52-442b-b8eb-36721944a653"
/>

Closes https://github.com/coder/coder/issues/19986
---
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   | 296 ++++++++++++++++++
 .../tasks/TaskPrompt}/TaskPrompt.tsx          | 112 +++++--
 .../src/pages/TasksPage/TasksPage.stories.tsx | 256 +--------------
 site/src/pages/TasksPage/TasksPage.tsx        |   2 +-
 4 files changed, 386 insertions(+), 280 deletions(-)
 create mode 100644 site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
 rename site/src/{pages/TasksPage => modules/tasks/TaskPrompt}/TaskPrompt.tsx (82%)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
new file mode 100644
index 0000000000000..1710bb3c347f4
--- /dev/null
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -0,0 +1,296 @@
+import {
+	MockAIPromptPresets,
+	MockNewTaskData,
+	MockPresets,
+	MockTask,
+	MockTasks,
+	MockTemplate,
+	MockTemplateVersion,
+	MockTemplateVersionExternalAuthGithub,
+	MockTemplateVersionExternalAuthGithubAuthenticated,
+	MockUserOwner,
+	mockApiError,
+} from "testHelpers/entities";
+import { withAuthProvider, withGlobalSnackbar } from "testHelpers/storybook";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { API } from "api/api";
+import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
+import type TasksPage from "../../../pages/TasksPage/TasksPage";
+import { TaskPrompt } from "./TaskPrompt";
+
+const meta: Meta<typeof TasksPage> = {
+	title: "modules/tasks/TaskPrompt",
+	component: TaskPrompt,
+	decorators: [withAuthProvider],
+	parameters: {
+		user: MockUserOwner,
+		permissions: {
+			updateTemplates: true,
+		},
+	},
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersionExternalAuth").mockResolvedValue([]);
+		spyOn(API, "getTemplates").mockResolvedValue([
+			MockTemplate,
+			{
+				...MockTemplate,
+				id: "test-template-2",
+				name: "template 2",
+				display_name: "Template 2",
+			},
+		]);
+		spyOn(API, "getTemplateVersions").mockResolvedValue([
+			{
+				...MockTemplateVersion,
+				name: "v1.0.0",
+			},
+		]);
+		spyOn(API, "getTemplateVersionPresets").mockResolvedValue(null);
+	},
+	args: {
+		templates: [MockTemplate],
+	},
+};
+
+export default meta;
+type Story = StoryObj<typeof TasksPage>;
+
+export const LoadingTemplates: Story = {
+	args: {
+		templates: undefined,
+	},
+};
+
+export const EmptyTemplates: Story = {
+	args: {
+		templates: [],
+	},
+};
+
+export const WithPresets: Story = {
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersionPresets").mockResolvedValue(MockPresets);
+	},
+};
+
+export const ReadOnlyPresetPrompt: Story = {
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersionPresets").mockResolvedValue(
+			MockAIPromptPresets,
+		);
+	},
+};
+
+export const OnSuccess: Story = {
+	decorators: [withGlobalSnackbar],
+	parameters: {
+		permissions: {
+			updateTemplates: false,
+		},
+	},
+	beforeEach: () => {
+		const activeVersionId = `${MockTemplate.active_version_id}-latest`;
+		spyOn(API, "getTemplate").mockResolvedValue({
+			...MockTemplate,
+			active_version_id: activeVersionId,
+		});
+		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Run task", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			await userEvent.type(prompt, MockNewTaskData.prompt);
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			await waitFor(() => expect(submitButton).toBeEnabled());
+			await userEvent.click(submitButton);
+		});
+
+		await step("Uses latest template version", () => {
+			expect(API.experimental.createTask).toHaveBeenCalledWith(
+				MockUserOwner.id,
+				{
+					input: MockNewTaskData.prompt,
+					template_version_id: `${MockTemplate.active_version_id}-latest`,
+					template_version_preset_id: undefined,
+				},
+			);
+		});
+
+		await step("Displays success message", async () => {
+			const body = within(canvasElement.ownerDocument.body);
+			const successMessage = await body.findByText(/task created/i);
+			expect(successMessage).toBeInTheDocument();
+		});
+	},
+};
+
+export const SelectTemplateVersion: Story = {
+	decorators: [withGlobalSnackbar],
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersions").mockResolvedValue([
+			{
+				...MockTemplateVersion,
+				id: "test-template-version-2",
+				name: "v2.0.0",
+			},
+			{
+				...MockTemplateVersion,
+				name: "v1.0.0",
+			},
+		]);
+		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Fill prompt", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			await userEvent.type(prompt, MockNewTaskData.prompt);
+		});
+
+		await step("Select version", async () => {
+			const body = within(canvasElement.ownerDocument.body);
+			const versionSelect = await canvas.findByLabelText(/template version/i);
+			await userEvent.click(versionSelect);
+			const versionOption = await body.findByRole("option", {
+				name: /v2.0.0/i,
+			});
+			await userEvent.click(versionOption);
+		});
+
+		await step("Submit form", async () => {
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			await waitFor(() => expect(submitButton).toBeEnabled());
+			await userEvent.click(submitButton);
+		});
+
+		await step("Uses selected version", () => {
+			expect(API.experimental.createTask).toHaveBeenCalledWith(
+				MockUserOwner.id,
+				{
+					input: MockNewTaskData.prompt,
+					template_version_id: "test-template-version-2",
+					template_version_preset_id: undefined,
+				},
+			);
+		});
+
+		await step("Displays success message", async () => {
+			const body = within(canvasElement.ownerDocument.body);
+			const successMessage = await body.findByText(/task created/i);
+			expect(successMessage).toBeInTheDocument();
+		});
+	},
+};
+
+export const OnError: Story = {
+	decorators: [withGlobalSnackbar],
+	beforeEach: () => {
+		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
+		spyOn(API, "getTemplate").mockResolvedValue(MockTemplate);
+		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
+		spyOn(API.experimental, "createTask").mockRejectedValue(
+			mockApiError({
+				message: "Failed to create task",
+				detail: "You don't have permission to create tasks.",
+			}),
+		);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Run task", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			await userEvent.type(prompt, "Create a new task");
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			await waitFor(() => expect(submitButton).toBeEnabled());
+			await userEvent.click(submitButton);
+		});
+
+		await step("Verify error", async () => {
+			await canvas.findByText(/failed to create task/i);
+		});
+	},
+};
+
+export const AuthenticatedExternalAuth: Story = {
+	beforeEach: () => {
+		spyOn(API.experimental, "getTasks")
+			.mockResolvedValueOnce(MockTasks)
+			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
+		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
+		spyOn(API, "getTemplateVersionExternalAuth").mockResolvedValue([
+			MockTemplateVersionExternalAuthGithubAuthenticated,
+		]);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Does not render external auth", async () => {
+			expect(
+				canvas.queryByText(/external authentication/),
+			).not.toBeInTheDocument();
+		});
+	},
+	parameters: {
+		chromatic: {
+			disableSnapshot: true,
+		},
+	},
+};
+
+export const MissingExternalAuth: Story = {
+	beforeEach: () => {
+		spyOn(API.experimental, "getTasks")
+			.mockResolvedValueOnce(MockTasks)
+			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
+		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
+		spyOn(API, "getTemplateVersionExternalAuth").mockResolvedValue([
+			MockTemplateVersionExternalAuthGithub,
+		]);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Submit is disabled", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			await userEvent.type(prompt, MockNewTaskData.prompt);
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			expect(submitButton).toBeDisabled();
+		});
+
+		await step("Renders external authentication", async () => {
+			await canvas.findByRole("button", { name: /connect to github/i });
+		});
+	},
+};
+
+export const ExternalAuthError: Story = {
+	beforeEach: () => {
+		spyOn(API.experimental, "getTasks")
+			.mockResolvedValueOnce(MockTasks)
+			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
+		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
+		spyOn(API, "getTemplateVersionExternalAuth").mockRejectedValue(
+			mockApiError({
+				message: "Failed to load external auth",
+			}),
+		);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Submit is disabled", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			await userEvent.type(prompt, MockNewTaskData.prompt);
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			expect(submitButton).toBeDisabled();
+		});
+
+		await step("Renders error", async () => {
+			await canvas.findByText(/failed to load external auth/i);
+		});
+	},
+};
diff --git a/site/src/pages/TasksPage/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
similarity index 82%
rename from site/src/pages/TasksPage/TaskPrompt.tsx
rename to site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index c08f0ee8a7775..2f399ac3e4d87 100644
--- a/site/src/pages/TasksPage/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -1,7 +1,10 @@
 import type { SelectTriggerProps } from "@radix-ui/react-select";
 import { API } from "api/api";
 import { getErrorDetail, getErrorMessage } from "api/errors";
-import { templateVersionPresets } from "api/queries/templates";
+import {
+	templateVersionPresets,
+	templateVersions,
+} from "api/queries/templates";
 import type {
 	Preset,
 	Task,
@@ -135,12 +138,14 @@ type CreateTaskFormProps = {
 };
 
 const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
-	const { user } = useAuthenticated();
+	const { user, permissions } = useAuthenticated();
 	const queryClient = useQueryClient();
+	const [prompt, setPrompt] = useState("");
+
+	// Template
 	const [selectedTemplateId, setSelectedTemplateId] = useState<string>(
 		templates[0].id,
 	);
-	const [selectedPresetId, setSelectedPresetId] = useState<string>();
 	const selectedTemplate = templates.find(
 		(t) => t.id === selectedTemplateId,
 	) as Template;
@@ -152,24 +157,38 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 		isLoadingExternalAuth,
 	} = useExternalAuth(selectedTemplate.active_version_id);
 
-	// Fetch presets when template changes
-	const { data: presets, isLoading: isLoadingPresets } = useQuery(
-		templateVersionPresets(selectedTemplate.active_version_id),
+	// Template versions
+	const [selectedVersionId, setSelectedVersionId] = useState(
+		selectedTemplate.active_version_id,
 	);
-	const defaultPreset = presets?.find((p) => p.Default);
+	const versionsQuery = useQuery({
+		...templateVersions(selectedTemplate.id),
+		enabled: permissions.updateTemplates,
+	});
 
-	// Handle preset selection when data changes
+	// Presets
+	const { data: presets, isLoading: isLoadingPresets } = useQuery(
+		templateVersionPresets(selectedVersionId),
+	);
+	const [selectedPresetId, setSelectedPresetId] = useState<string>();
 	useEffect(() => {
-		setSelectedPresetId(defaultPreset?.ID);
-	}, [defaultPreset?.ID]);
-
-	// Extract AI prompt from selected preset
+		const defaultPreset = presets?.find((p) => p.Default);
+		setSelectedPresetId(defaultPreset?.ID ?? presets?.[0]?.ID);
+	}, [presets]);
 	const selectedPreset = presets?.find((p) => p.ID === selectedPresetId);
-	const presetAIPrompt = selectedPreset?.Parameters?.find(
+
+	// Read-only prompt if defined in preset
+	const presetPrompt = selectedPreset?.Parameters?.find(
 		(param) => param.Name === AI_PROMPT_PARAMETER_NAME,
 	)?.Value;
-	const isPromptReadOnly = !!presetAIPrompt;
+	const isPromptReadOnly = !!presetPrompt;
+	useEffect(() => {
+		if (presetPrompt) {
+			setPrompt(presetPrompt);
+		}
+	}, [presetPrompt]);
 
+	// External Auth
 	const missedExternalAuth = externalAuth?.filter(
 		(auth) => !auth.optional && !auth.authenticated,
 	);
@@ -178,13 +197,26 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 		: true;
 
 	const createTaskMutation = useMutation({
-		mutationFn: async ({ prompt }: CreateTaskMutationFnProps) =>
-			createTaskWithLatestTemplateVersion(
+		mutationFn: async ({ prompt }: CreateTaskMutationFnProps) => {
+			// Users with updateTemplates permission can select the version to use.
+			if (permissions.updateTemplates) {
+				return API.experimental.createTask(user.id, {
+					input: prompt,
+					template_version_id: selectedVersionId,
+					template_version_preset_id: selectedPresetId,
+				});
+			}
+
+			// For regular users we want to enforce task creation to always use the latest
+			// active template version, to avoid issues when the active version changes
+			// between template load and user action.
+			return createTaskWithLatestTemplateVersion(
 				prompt,
 				user.id,
 				selectedTemplate.id,
 				selectedPresetId,
-			),
+			);
+		},
 		onSuccess: async (task) => {
 			await queryClient.invalidateQueries({ queryKey: ["tasks"] });
 			onSuccess(task);
@@ -194,10 +226,6 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 	const onSubmit = async (e: React.FormEvent<HTMLFormElement>) => {
 		e.preventDefault();
 
-		const form = e.currentTarget;
-		const formData = new FormData(form);
-		const prompt = presetAIPrompt || (formData.get("prompt") as string);
-
 		try {
 			await createTaskMutation.mutateAsync({
 				prompt,
@@ -225,7 +253,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 					htmlFor="prompt"
 					className={
 						isPromptReadOnly
-							? "text-xs font-medium text-content-primary mb-2 block"
+							? "text-xs font-medium text-content-primary block px-3 pt-2"
 							: "sr-only"
 					}
 				>
@@ -233,12 +261,13 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 				</label>
 				<PromptTextarea
 					required
-					value={presetAIPrompt || undefined}
+					value={prompt}
+					onChange={(e) => setPrompt(e.target.value)}
 					readOnly={isPromptReadOnly}
 				/>
 				<div className="flex items-center justify-between pt-2">
 					<div className="flex items-center gap-1">
-						<div className="flex flex-col gap-1">
+						<div>
 							<label htmlFor="templateID" className="sr-only">
 								Template
 							</label>
@@ -265,7 +294,34 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 							</Select>
 						</div>
 
-						<div className="flex flex-col gap-1">
+						{versionsQuery.data && (
+							<div>
+								<label htmlFor="versionId" className="sr-only">
+									Template version
+								</label>
+								<Select
+									name="versionId"
+									onValueChange={(value) => setSelectedVersionId(value)}
+									value={selectedVersionId}
+									required
+								>
+									<PromptSelectTrigger id="versionId">
+										<SelectValue placeholder="Select a version" />
+									</PromptSelectTrigger>
+									<SelectContent>
+										{versionsQuery.data.map((version) => {
+											return (
+												<SelectItem value={version.id} key={version.id}>
+													{version.name}
+												</SelectItem>
+											);
+										})}
+									</SelectContent>
+								</Select>
+							</div>
+						)}
+
+						<div>
 							<label htmlFor="presetID" className="sr-only">
 								Preset
 							</label>
@@ -273,11 +329,12 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 								<Skeleton className="w-[320px] h-8" />
 							) : (
 								presets &&
-								presets.length > 0 && (
+								presets.length > 0 &&
+								selectedPresetId && (
 									<Select
 										key={`preset-select-${selectedTemplate.active_version_id}`}
 										name="presetID"
-										value={selectedPresetId || undefined}
+										value={selectedPresetId}
 										onValueChange={setSelectedPresetId}
 									>
 										<PromptSelectTrigger id="presetID">
@@ -438,6 +495,7 @@ async function createTaskWithLatestTemplateVersion(
 const PromptTextarea: FC<TextareaAutosizeProps> = (props) => {
 	return (
 		<TextareaAutosize
+			{...props}
 			required
 			id="prompt"
 			name="prompt"
diff --git a/site/src/pages/TasksPage/TasksPage.stories.tsx b/site/src/pages/TasksPage/TasksPage.stories.tsx
index 7f4818bf00f4f..fed841e0e6c6d 100644
--- a/site/src/pages/TasksPage/TasksPage.stories.tsx
+++ b/site/src/pages/TasksPage/TasksPage.stories.tsx
@@ -1,25 +1,14 @@
 import {
-	MockAIPromptPresets,
-	MockNewTaskData,
-	MockPresets,
-	MockTask,
 	MockTasks,
 	MockTemplate,
-	MockTemplateVersionExternalAuthGithub,
-	MockTemplateVersionExternalAuthGithubAuthenticated,
 	MockUserOwner,
 	mockApiError,
 } from "testHelpers/entities";
-import {
-	withAuthProvider,
-	withGlobalSnackbar,
-	withProxyProvider,
-} from "testHelpers/storybook";
+import { withAuthProvider, withProxyProvider } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { API } from "api/api";
 import { MockUsers } from "pages/UsersPage/storybookData/users";
-import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
-import { reactRouterParameters } from "storybook-addon-remix-react-router";
+import { expect, spyOn, userEvent, within } from "storybook/test";
 import TasksPage from "./TasksPage";
 
 const meta: Meta<typeof TasksPage> = {
@@ -54,7 +43,7 @@ const meta: Meta<typeof TasksPage> = {
 export default meta;
 type Story = StoryObj<typeof TasksPage>;
 
-export const LoadingAITemplates: Story = {
+export const LoadingTemplates: Story = {
 	beforeEach: () => {
 		spyOn(API, "getTemplates").mockImplementation(
 			() => new Promise(() => 1000 * 60 * 60),
@@ -62,7 +51,7 @@ export const LoadingAITemplates: Story = {
 	},
 };
 
-export const LoadingAITemplatesError: Story = {
+export const LoadingTemplatesError: Story = {
 	beforeEach: () => {
 		spyOn(API, "getTemplates").mockRejectedValue(
 			mockApiError({
@@ -73,13 +62,6 @@ export const LoadingAITemplatesError: Story = {
 	},
 };
 
-export const EmptyAITemplates: Story = {
-	beforeEach: () => {
-		spyOn(API, "getTemplates").mockResolvedValue([]);
-		spyOn(API.experimental, "getTasks").mockResolvedValue([]);
-	},
-};
-
 export const LoadingTasks: Story = {
 	beforeEach: () => {
 		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
@@ -123,58 +105,6 @@ export const LoadedTasks: Story = {
 	},
 };
 
-export const LoadedTasksWithPresets: Story = {
-	beforeEach: () => {
-		const mockTemplateWithPresets = {
-			...MockTemplate,
-			id: "test-template-2",
-			name: "template-with-presets",
-			display_name: "Template with Presets",
-		};
-
-		spyOn(API, "getTemplates").mockResolvedValue([
-			MockTemplate,
-			mockTemplateWithPresets,
-		]);
-		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
-		spyOn(API, "getTemplateVersionPresets").mockImplementation(
-			async (versionId) => {
-				// Return presets only for the second template
-				if (versionId === mockTemplateWithPresets.active_version_id) {
-					return MockPresets;
-				}
-				return null;
-			},
-		);
-	},
-};
-
-export const LoadedTasksWithAIPromptPresets: Story = {
-	beforeEach: () => {
-		const mockTemplateWithPresets = {
-			...MockTemplate,
-			id: "test-template-2",
-			name: "template-with-presets",
-			display_name: "Template with AI Prompt Presets",
-		};
-
-		spyOn(API, "getTemplates").mockResolvedValue([
-			MockTemplate,
-			mockTemplateWithPresets,
-		]);
-		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
-		spyOn(API, "getTemplateVersionPresets").mockImplementation(
-			async (versionId) => {
-				// Return presets only for the second template
-				if (versionId === mockTemplateWithPresets.active_version_id) {
-					return MockAIPromptPresets;
-				}
-				return null;
-			},
-		);
-	},
-};
-
 export const LoadedTasksWaitingForInput: Story = {
 	beforeEach: () => {
 		const [firstTask, ...otherTasks] = MockTasks;
@@ -225,184 +155,6 @@ export const LoadedTasksWaitingForInputTab: Story = {
 	},
 };
 
-export const CreateTaskSuccessfully: Story = {
-	decorators: [withGlobalSnackbar],
-	parameters: {
-		reactRouter: reactRouterParameters({
-			location: {
-				path: "/tasks",
-			},
-			routing: [
-				{
-					path: "/tasks",
-					useStoryElement: true,
-				},
-				{
-					path: "/tasks/:ownerName/:workspaceName",
-					element: <h1>Task page</h1>,
-				},
-			],
-		}),
-	},
-	beforeEach: () => {
-		const activeVersionId = `${MockTemplate.active_version_id}-latest`;
-		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
-		spyOn(API, "getTemplate").mockResolvedValue({
-			...MockTemplate,
-			active_version_id: activeVersionId,
-		});
-		spyOn(API.experimental, "getTasks")
-			.mockResolvedValueOnce(MockTasks)
-			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
-		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
-	},
-	play: async ({ canvasElement, step }) => {
-		const canvas = within(canvasElement);
-
-		await step("Run task", async () => {
-			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
-			const submitButton = canvas.getByRole("button", { name: /run task/i });
-			await waitFor(() => expect(submitButton).toBeEnabled());
-			await userEvent.click(submitButton);
-		});
-
-		await step("Uses latest template version", () => {
-			expect(API.experimental.createTask).toHaveBeenCalledWith(
-				MockUserOwner.id,
-				{
-					input: MockNewTaskData.prompt,
-					template_version_id: `${MockTemplate.active_version_id}-latest`,
-					template_version_preset_id: undefined,
-				},
-			);
-		});
-
-		await step("Displays success message", async () => {
-			const body = within(canvasElement.ownerDocument.body);
-			const successMessage = await body.findByText(/task created/i);
-			expect(successMessage).toBeInTheDocument();
-		});
-
-		await step("Find task in the table", async () => {
-			const table = canvasElement.querySelector("table");
-			await waitFor(() => {
-				expect(table).toHaveTextContent(MockNewTaskData.prompt);
-			});
-		});
-	},
-};
-
-export const CreateTaskError: Story = {
-	decorators: [withGlobalSnackbar],
-	beforeEach: () => {
-		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
-		spyOn(API, "getTemplate").mockResolvedValue(MockTemplate);
-		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
-		spyOn(API.experimental, "createTask").mockRejectedValue(
-			mockApiError({
-				message: "Failed to create task",
-				detail: "You don't have permission to create tasks.",
-			}),
-		);
-	},
-	play: async ({ canvasElement, step }) => {
-		const canvas = within(canvasElement);
-
-		await step("Run task", async () => {
-			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, "Create a new task");
-			const submitButton = canvas.getByRole("button", { name: /run task/i });
-			await waitFor(() => expect(submitButton).toBeEnabled());
-			await userEvent.click(submitButton);
-		});
-
-		await step("Verify error", async () => {
-			await canvas.findByText(/failed to create task/i);
-		});
-	},
-};
-
-export const WithAuthenticatedExternalAuth: Story = {
-	beforeEach: () => {
-		spyOn(API.experimental, "getTasks")
-			.mockResolvedValueOnce(MockTasks)
-			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
-		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
-		spyOn(API, "getTemplateVersionExternalAuth").mockResolvedValue([
-			MockTemplateVersionExternalAuthGithubAuthenticated,
-		]);
-	},
-	play: async ({ canvasElement, step }) => {
-		const canvas = within(canvasElement);
-
-		await step("Does not render external auth", async () => {
-			expect(
-				canvas.queryByText(/external authentication/),
-			).not.toBeInTheDocument();
-		});
-	},
-	parameters: {
-		chromatic: {
-			disableSnapshot: true,
-		},
-	},
-};
-
-export const MissingExternalAuth: Story = {
-	beforeEach: () => {
-		spyOn(API.experimental, "getTasks")
-			.mockResolvedValueOnce(MockTasks)
-			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
-		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
-		spyOn(API, "getTemplateVersionExternalAuth").mockResolvedValue([
-			MockTemplateVersionExternalAuthGithub,
-		]);
-	},
-	play: async ({ canvasElement, step }) => {
-		const canvas = within(canvasElement);
-
-		await step("Submit is disabled", async () => {
-			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
-			const submitButton = canvas.getByRole("button", { name: /run task/i });
-			expect(submitButton).toBeDisabled();
-		});
-
-		await step("Renders external authentication", async () => {
-			await canvas.findByRole("button", { name: /connect to github/i });
-		});
-	},
-};
-
-export const ExternalAuthError: Story = {
-	beforeEach: () => {
-		spyOn(API.experimental, "getTasks")
-			.mockResolvedValueOnce(MockTasks)
-			.mockResolvedValue([MockNewTaskData, ...MockTasks]);
-		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
-		spyOn(API, "getTemplateVersionExternalAuth").mockRejectedValue(
-			mockApiError({
-				message: "Failed to load external auth",
-			}),
-		);
-	},
-	play: async ({ canvasElement, step }) => {
-		const canvas = within(canvasElement);
-
-		await step("Submit is disabled", async () => {
-			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
-			const submitButton = canvas.getByRole("button", { name: /run task/i });
-			expect(submitButton).toBeDisabled();
-		});
-
-		await step("Renders error", async () => {
-			await canvas.findByText(/failed to load external auth/i);
-		});
-	},
-};
-
 export const NonAdmin: Story = {
 	parameters: {
 		permissions: {
diff --git a/site/src/pages/TasksPage/TasksPage.tsx b/site/src/pages/TasksPage/TasksPage.tsx
index 451a0f0709cc1..06da02a278953 100644
--- a/site/src/pages/TasksPage/TasksPage.tsx
+++ b/site/src/pages/TasksPage/TasksPage.tsx
@@ -11,11 +11,11 @@ import {
 } from "components/PageHeader/PageHeader";
 import { useAuthenticated } from "hooks";
 import { useSearchParamsKey } from "hooks/useSearchParamsKey";
+import { TaskPrompt } from "modules/tasks/TaskPrompt/TaskPrompt";
 import type { FC } from "react";
 import { useQuery } from "react-query";
 import { cn } from "utils/cn";
 import { pageTitle } from "utils/page";
-import { TaskPrompt } from "./TaskPrompt";
 import { TasksTable } from "./TasksTable";
 import { UsersCombobox } from "./UsersCombobox";
 

From 33fbb174d536fa0254fb20eeb82bab840d1b542f Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Mon, 6 Oct 2025 11:51:44 -0300
Subject: [PATCH 064/298] chore: set biome lsp bin path for vscode (#20180)

---
 .vscode/settings.json | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.vscode/settings.json b/.vscode/settings.json
index 6057824039b6d..762ed91595ded 100644
--- a/.vscode/settings.json
+++ b/.vscode/settings.json
@@ -61,5 +61,6 @@
 	"typos.config": ".github/workflows/typos.toml",
 	"[markdown]": {
 		"editor.defaultFormatter": "DavidAnson.vscode-markdownlint"
-	}
+	},
+	"biome.lsp.bin": "site/node_modules/.bin/biome"
 }

From 1783ee13ab3d69b7f0cc5c0169f3e9b257c47b44 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Mon, 6 Oct 2025 11:51:56 -0300
Subject: [PATCH 065/298] chore: fix biome error when running make lint
 (#20182)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Fixes a Biome lint error when running `make lint`.

```
> biome check --error-on-warnings --fix .

biome.jsonc:6:13 deserialize ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

  ℹ The configuration schema version does not match the CLI version 2.2.4

    4 │                 "includes": ["!e2e/**/*Generated.ts"]
    5 │         },
  > 6 │         "$schema": "https://biomejs.dev/schemas/2.2.0/schema.json"
      │                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    7 │ }
    8 │

  ℹ   Expected:                     2.2.4
      Found:                        2.2.0


  ℹ Run the command biome migrate to migrate the configuration file.


Checked 1165 files in 796ms. No fixes applied.
```
---
 biome.jsonc      | 13 +++----------
 site/biome.jsonc |  2 +-
 2 files changed, 4 insertions(+), 11 deletions(-)

diff --git a/biome.jsonc b/biome.jsonc
index ae81184cdca0c..daa99a8b90ce4 100644
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -6,10 +6,7 @@
 		"defaultBranch": "main"
 	},
 	"files": {
-		"includes": [
-			"**",
-			"!**/pnpm-lock.yaml"
-		],
+		"includes": ["**", "!**/pnpm-lock.yaml"],
 		"ignoreUnknown": true
 	},
 	"linter": {
@@ -69,11 +66,7 @@
 				"noConsole": {
 					"level": "error",
 					"options": {
-						"allow": [
-							"error",
-							"info",
-							"warn"
-						]
+						"allow": ["error", "info", "warn"]
 					}
 				}
 			},
@@ -82,5 +75,5 @@
 			}
 		}
 	},
-	"$schema": "https://biomejs.dev/schemas/2.2.0/schema.json"
+	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json"
 }
diff --git a/site/biome.jsonc b/site/biome.jsonc
index 4c9cb18aa482b..be24c66617a6e 100644
--- a/site/biome.jsonc
+++ b/site/biome.jsonc
@@ -3,5 +3,5 @@
 	"files": {
 		"includes": ["!e2e/**/*Generated.ts"]
 	},
-	"$schema": "https://biomejs.dev/schemas/2.2.0/schema.json"
+	"$schema": "./node_modules/@biomejs/biome/configuration_schema.json"
 }

From 23a44d10ac7d11c5ff0d54c3dca41aad5de1985c Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Mon, 6 Oct 2025 13:12:56 -0300
Subject: [PATCH 066/298] feat: include latest build id in task responses
 (#20181)

Adding the latest build ID is necessary to locate the logs associated
with the tasks in the UI.
---
 cli/exp_task_status_test.go      | 1 +
 coderd/aitasks.go                | 1 +
 coderd/aitasks_test.go           | 2 ++
 codersdk/aitasks.go              | 1 +
 site/src/api/typesGenerated.ts   | 1 +
 site/src/testHelpers/entities.ts | 1 +
 6 files changed, 7 insertions(+)

diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index be62a76476d35..24a0c82b70a73 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -193,6 +193,7 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "workspace_agent_id": null,
   "workspace_agent_lifecycle": null,
   "workspace_agent_health": null,
+  "latest_build_id": null,
   "initial_prompt": "",
   "status": "running",
   "current_state": {
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 275cfe855621e..fa6bc1dbd5cf7 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -272,6 +272,7 @@ func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Tas
 		WorkspaceAgentID:        taskAgentID,
 		WorkspaceAgentLifecycle: taskAgentLifecycle,
 		WorkspaceAgentHealth:    taskAgentHealth,
+		LatestBuildID:           uuid.NullUUID{Valid: true, UUID: ws.LatestBuild.ID},
 		CreatedAt:               ws.CreatedAt,
 		UpdatedAt:               ws.UpdatedAt,
 		InitialPrompt:           initialPrompt,
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 6425e06c771db..5ec6f49a5f34c 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -270,6 +270,7 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, wantPrompt, got.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, workspace.Name, got.Name, "task name should map from workspace name")
 		assert.Equal(t, workspace.ID, got.WorkspaceID.UUID, "workspace id should match")
+		assert.Equal(t, workspace.LatestBuild.ID, got.LatestBuildID.UUID, "latest build id should match")
 		// Status should be populated via app status or workspace status mapping.
 		assert.NotEmpty(t, got.Status, "task status should not be empty")
 	})
@@ -320,6 +321,7 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, workspace.Name, task.Name, "task name should map from workspace name")
 		assert.Equal(t, wantPrompt, task.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, workspace.ID, task.WorkspaceID.UUID, "workspace id should match")
+		assert.Equal(t, workspace.LatestBuild.ID, task.LatestBuildID.UUID, "latest build id should match")
 		assert.NotEmpty(t, task.Status, "task status should not be empty")
 
 		// Stop the workspace
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index 21efb15b5313e..e62f65ce95c49 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -119,6 +119,7 @@ type Task struct {
 	WorkspaceAgentID        uuid.NullUUID            `json:"workspace_agent_id" format:"uuid" table:"workspace agent id"`
 	WorkspaceAgentLifecycle *WorkspaceAgentLifecycle `json:"workspace_agent_lifecycle" table:"workspace agent lifecycle"`
 	WorkspaceAgentHealth    *WorkspaceAgentHealth    `json:"workspace_agent_health" table:"workspace agent health"`
+	LatestBuildID           uuid.NullUUID            `json:"latest_build_id" format:"uuid" table:"latest build id"`
 	InitialPrompt           string                   `json:"initial_prompt" table:"initial prompt"`
 	Status                  WorkspaceStatus          `json:"status" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"status"`
 	CurrentState            *TaskStateEntry          `json:"current_state" table:"cs,recursive_inline"`
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 1e07cf1aa2895..da2c6806a22ee 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -3330,6 +3330,7 @@ export interface Task {
 	readonly workspace_agent_id: string | null;
 	readonly workspace_agent_lifecycle: WorkspaceAgentLifecycle | null;
 	readonly workspace_agent_health: WorkspaceAgentHealth | null;
+	readonly latest_build_id: string | null;
 	readonly initial_prompt: string;
 	readonly status: WorkspaceStatus;
 	readonly current_state: TaskStateEntry | null;
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 0b8d87f8111ef..d9a73bc16326d 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -5031,6 +5031,7 @@ export const MockTask: TypesGen.Task = {
 	workspace_agent_id: MockWorkspaceAgent.id,
 	workspace_agent_lifecycle: MockWorkspaceAgent.lifecycle_state,
 	workspace_agent_health: MockWorkspaceAgent.health,
+	latest_build_id: MockWorkspace.latest_build.id,
 	initial_prompt: "Perform some task",
 	status: "running",
 	current_state: {

From 83c4611293919035ff40e33b6b4d84c0dacfb6eb Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Mon, 6 Oct 2025 14:44:11 -0300
Subject: [PATCH 067/298] chore: revert "feat: include latest build id in task
 responses" (#20184)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Reverts coder/coder#20181

I realized we don’t need this in the task response. When loading a task,
we already need much more workspace information, so it makes more sense
to fetch the workspace data separately instead of trying to embed all
its details into the response.

I think we can keep the task response clean and focused on the essential
information needed to list tasks. For more specific details, we can
fetch the related resources as needed. So, I’m reverting this PR.
---
 cli/exp_task_status_test.go      | 1 -
 coderd/aitasks.go                | 1 -
 coderd/aitasks_test.go           | 2 --
 codersdk/aitasks.go              | 1 -
 site/src/api/typesGenerated.ts   | 1 -
 site/src/testHelpers/entities.ts | 1 -
 6 files changed, 7 deletions(-)

diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index 24a0c82b70a73..be62a76476d35 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -193,7 +193,6 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "workspace_agent_id": null,
   "workspace_agent_lifecycle": null,
   "workspace_agent_health": null,
-  "latest_build_id": null,
   "initial_prompt": "",
   "status": "running",
   "current_state": {
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index fa6bc1dbd5cf7..275cfe855621e 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -272,7 +272,6 @@ func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Tas
 		WorkspaceAgentID:        taskAgentID,
 		WorkspaceAgentLifecycle: taskAgentLifecycle,
 		WorkspaceAgentHealth:    taskAgentHealth,
-		LatestBuildID:           uuid.NullUUID{Valid: true, UUID: ws.LatestBuild.ID},
 		CreatedAt:               ws.CreatedAt,
 		UpdatedAt:               ws.UpdatedAt,
 		InitialPrompt:           initialPrompt,
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 5ec6f49a5f34c..6425e06c771db 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -270,7 +270,6 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, wantPrompt, got.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, workspace.Name, got.Name, "task name should map from workspace name")
 		assert.Equal(t, workspace.ID, got.WorkspaceID.UUID, "workspace id should match")
-		assert.Equal(t, workspace.LatestBuild.ID, got.LatestBuildID.UUID, "latest build id should match")
 		// Status should be populated via app status or workspace status mapping.
 		assert.NotEmpty(t, got.Status, "task status should not be empty")
 	})
@@ -321,7 +320,6 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, workspace.Name, task.Name, "task name should map from workspace name")
 		assert.Equal(t, wantPrompt, task.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, workspace.ID, task.WorkspaceID.UUID, "workspace id should match")
-		assert.Equal(t, workspace.LatestBuild.ID, task.LatestBuildID.UUID, "latest build id should match")
 		assert.NotEmpty(t, task.Status, "task status should not be empty")
 
 		// Stop the workspace
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index e62f65ce95c49..21efb15b5313e 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -119,7 +119,6 @@ type Task struct {
 	WorkspaceAgentID        uuid.NullUUID            `json:"workspace_agent_id" format:"uuid" table:"workspace agent id"`
 	WorkspaceAgentLifecycle *WorkspaceAgentLifecycle `json:"workspace_agent_lifecycle" table:"workspace agent lifecycle"`
 	WorkspaceAgentHealth    *WorkspaceAgentHealth    `json:"workspace_agent_health" table:"workspace agent health"`
-	LatestBuildID           uuid.NullUUID            `json:"latest_build_id" format:"uuid" table:"latest build id"`
 	InitialPrompt           string                   `json:"initial_prompt" table:"initial prompt"`
 	Status                  WorkspaceStatus          `json:"status" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"status"`
 	CurrentState            *TaskStateEntry          `json:"current_state" table:"cs,recursive_inline"`
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index da2c6806a22ee..1e07cf1aa2895 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -3330,7 +3330,6 @@ export interface Task {
 	readonly workspace_agent_id: string | null;
 	readonly workspace_agent_lifecycle: WorkspaceAgentLifecycle | null;
 	readonly workspace_agent_health: WorkspaceAgentHealth | null;
-	readonly latest_build_id: string | null;
 	readonly initial_prompt: string;
 	readonly status: WorkspaceStatus;
 	readonly current_state: TaskStateEntry | null;
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index d9a73bc16326d..0b8d87f8111ef 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -5031,7 +5031,6 @@ export const MockTask: TypesGen.Task = {
 	workspace_agent_id: MockWorkspaceAgent.id,
 	workspace_agent_lifecycle: MockWorkspaceAgent.lifecycle_state,
 	workspace_agent_health: MockWorkspaceAgent.health,
-	latest_build_id: MockWorkspace.latest_build.id,
 	initial_prompt: "Perform some task",
 	status: "running",
 	current_state: {

From 09f69ef74f50f63308fb2366fdbb634143db5eb6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Mon, 6 Oct 2025 12:14:35 -0600
Subject: [PATCH 068/298] chore: update logo on error page (#20185)

---
 site/static/error.html       | 44 +-----------------------------------
 site/static/logo.svg         |  4 ----
 site/static/oauth2allow.html |  2 +-
 3 files changed, 2 insertions(+), 48 deletions(-)
 delete mode 100644 site/static/logo.svg

diff --git a/site/static/error.html b/site/static/error.html
index d0eee1bb4a402..d5ea5ab9dd790 100644
--- a/site/static/error.html
+++ b/site/static/error.html
@@ -119,49 +119,7 @@
   </head>
   <body>
     <div class="container">
-      <svg
-        class="coder-svg"
-        viewBox="0 0 36 36"
-        fill="none"
-        xmlns="http://www.w3.org/2000/svg"
-      >
-        <g clip-path="url(#clip0_1094_2915)">
-          <path
-            d="M32.9812 15.9039C32.326 15.9039 31.8894 15.5197 31.8894 14.7311V10.202C31.8894 7.31059 30.6982 5.71326 27.6211 5.71326H26.1917V8.76638H26.6285C27.8394 8.76638 28.4152 9.43363 28.4152 10.6266V14.63C28.4152 16.3689 28.9313 17.0766 30.0629 17.4405C28.9313 17.7843 28.4152 18.5122 28.4152 20.251C28.4152 21.2418 28.4152 22.2325 28.4152 23.2233C28.4152 24.0523 28.4152 24.8611 28.1968 25.69C27.9784 26.4584 27.6211 27.1863 27.1248 27.8131C26.8468 28.1771 26.5292 28.4803 26.1719 28.7635V29.1678H27.6012C30.6784 29.1678 31.8696 27.5705 31.8696 24.6791V20.1499C31.8696 19.3411 32.2863 18.9772 32.9614 18.9772H33.7754V15.924H32.9812V15.9039Z"
-            fill="white"
-          />
-          <path
-            d="M23.2539 10.3239H18.8466C18.7473 10.3239 18.668 10.243 18.668 10.1419V9.79819C18.668 9.69707 18.7473 9.61621 18.8466 9.61621H23.2737C23.373 9.61621 23.4524 9.69707 23.4524 9.79819V10.1419C23.4524 10.243 23.3531 10.3239 23.2539 10.3239Z"
-            fill="white"
-          />
-          <path
-            d="M24.0081 14.6911H20.792C20.6927 14.6911 20.6133 14.6102 20.6133 14.5091V14.1654C20.6133 14.0643 20.6927 13.9834 20.792 13.9834H24.0081C24.1074 13.9834 24.1867 14.0643 24.1867 14.1654V14.5091C24.1867 14.59 24.1074 14.6911 24.0081 14.6911Z"
-            fill="white"
-          />
-          <path
-            d="M25.2788 12.5075H18.8466C18.7473 12.5075 18.668 12.4266 18.668 12.3255V11.9818C18.668 11.8807 18.7473 11.7998 18.8466 11.7998H25.2589C25.3582 11.7998 25.4376 11.8807 25.4376 11.9818V12.3255C25.4376 12.4064 25.3781 12.5075 25.2788 12.5075Z"
-            fill="white"
-          />
-          <path
-            d="M13.7463 11.3141C14.183 11.3141 14.6198 11.3545 15.0367 11.4556V10.6266C15.0367 9.45384 15.6323 8.76638 16.8234 8.76638H17.2602V5.71326H15.8308C12.7536 5.71326 11.5625 7.31059 11.5625 10.202V11.6982C12.2573 11.4556 12.9919 11.3141 13.7463 11.3141Z"
-            fill="white"
-          />
-          <path
-            d="M26.6312 22.313C26.3135 19.7451 24.368 17.6018 21.8666 17.1166C21.1718 16.9751 20.4769 16.9548 19.8019 17.0761C19.7821 17.0761 19.7821 17.0559 19.7622 17.0559C18.6703 14.7307 16.3278 13.194 13.7866 13.194C11.2455 13.194 8.92278 14.6902 7.811 17.0155C7.79115 17.0155 7.79115 17.0357 7.77131 17.0357C7.05664 16.9548 6.34193 16.9952 5.62723 17.1772C3.16553 17.7838 1.29939 19.8866 0.961901 22.4342C0.922196 22.6971 0.902344 22.9599 0.902344 23.2026C0.902344 23.9709 1.41851 24.6786 2.1729 24.7797C3.10597 24.9213 3.91992 24.1933 3.90007 23.2633C3.90007 23.1217 3.90007 22.9599 3.91992 22.8184C4.07875 21.5244 5.05151 20.4326 6.32206 20.1292C6.71913 20.0281 7.11618 20.0079 7.49337 20.0686C8.70438 20.2304 9.89551 19.6035 10.4117 18.5117C10.7889 17.7029 11.3845 16.9952 12.1786 16.611C13.052 16.1864 14.0447 16.1258 14.958 16.4493C15.9108 16.793 16.6255 17.5209 17.0623 18.4308C17.5189 19.3205 17.7372 19.9473 18.7101 20.0686C19.1071 20.1292 20.2188 20.109 20.6357 20.0888C21.4497 20.0888 22.2637 20.3719 22.8394 20.9582C23.2165 21.3626 23.4945 21.8681 23.6136 22.4342C23.7923 23.3441 23.5739 24.254 23.0379 24.9414C22.6606 25.4267 22.1445 25.7907 21.5688 25.9524C21.2908 26.0333 21.0129 26.0535 20.735 26.0535C20.5762 26.0535 20.3578 26.0535 20.0997 26.0535C19.3057 26.0535 17.6182 26.0535 16.3476 26.0535C15.4741 26.0535 14.7792 25.3459 14.7792 24.4562V21.4637V18.5319C14.7792 18.2893 14.5807 18.0871 14.3425 18.0871H13.727C12.516 18.1073 11.5433 19.4823 11.5433 20.938C11.5433 22.3938 11.5433 26.2558 11.5433 26.2558C11.5433 27.8329 12.794 29.1067 14.3425 29.1067C14.3425 29.1067 21.2313 29.0864 21.3306 29.0864C22.9187 28.9247 24.3879 28.0957 25.3804 26.8219C26.3731 25.5885 26.8297 23.9709 26.6312 22.313Z"
-            fill="white"
-          />
-        </g>
-        <defs>
-          <clipPath id="clip0_1094_2915">
-            <rect
-              width="33.0769"
-              height="23.4545"
-              fill="white"
-              transform="translate(0.902344 5.71326)"
-            />
-          </clipPath>
-        </defs>
-      </svg>
+      <img class="coder-svg" src="/icon/coder.svg" alt="Coder" />
 
       <h1>
         {{- if not .Error.HideStatus }}{{ .Error.Status }} - {{end}}{{
diff --git a/site/static/logo.svg b/site/static/logo.svg
deleted file mode 100644
index adf9f2e910090..0000000000000
--- a/site/static/logo.svg
+++ /dev/null
@@ -1,4 +0,0 @@
-<svg viewBox="0 0 120 60" fill="none" xmlns="http://www.w3.org/2000/svg">
-	<title>Coder logo</title>
-	<path d="M34.5381 0C54.5335 6.29882e-05 65.7432 10.1355 66.122 25.0544L48.853 25.6216C48.3984 17.3514 41.544 11.9189 34.5381 12.0809C24.919 12.2836 17.7989 19.1351 17.7988 29.9999C17.7988 40.8648 24.919 47.5951 34.5381 47.5951C41.544 47.5945 48.2468 42.4055 49.0043 34.1352L66.2733 34.5408C65.8189 49.7027 53.9276 60 34.5381 60C15.1484 60 0 48.2433 0 29.9999C7.1014e-05 11.6757 14.5426 0 34.5381 0ZM120 1.7728V58.5299H74.5559V1.7728H120Z" fill="white" />
-</svg>
\ No newline at end of file
diff --git a/site/static/oauth2allow.html b/site/static/oauth2allow.html
index d1aa84ecd031d..313cac30dd05d 100644
--- a/site/static/oauth2allow.html
+++ b/site/static/oauth2allow.html
@@ -110,7 +110,7 @@
         <img class="app-icon" src="{{ .AppIcon }}" />
         <div class="connect-symbol">+</div>
         {{end}}
-        <img class="coder-svg" src="/logo.svg" alt="Coder" />
+        <img class="coder-svg" src="/icon/coder.svg" alt="Coder" />
       </div>
       <h1>Authorize {{ .AppName }}</h1>
       <p>

From 156f985fb0908f9e6d99ae5cc5f0c1d1360603e4 Mon Sep 17 00:00:00 2001
From: Michael Smith <throwawayclover@gmail.com>
Date: Mon, 6 Oct 2025 15:41:57 -0400
Subject: [PATCH 069/298] fix(site): update `useClipboard` to work better with
 effect logic (#20183)

## Changes made
- Updated `useClipboard` API to require passing the text in via the
`copyToClipboard` function, rather than requiring that the text gets
specified in render logic
- Ensured that the `copyToClipboard` function always stays stable across
all React lifecycles
- Updated all existing uses to use the new function signatures
- Updated all tests and added new cases
---
 site/src/components/CopyButton/CopyButton.tsx |   6 +-
 .../CopyableValue/CopyableValue.tsx           |   6 +-
 site/src/hooks/useClickable.ts                |   4 +-
 site/src/hooks/useClipboard.test.tsx          | 110 +++++++++++++++---
 site/src/hooks/useClipboard.ts                |  77 ++++++------
 .../src/pages/CliAuthPage/CliAuthPageView.tsx |  15 +--
 site/src/pages/TaskPage/TaskTopbar.tsx        |   7 +-
 .../TemplateEmbedPage/TemplateEmbedPage.tsx   |  17 +--
 .../TemplateEmbedPageExperimental.tsx         |  18 +--
 9 files changed, 173 insertions(+), 87 deletions(-)

diff --git a/site/src/components/CopyButton/CopyButton.tsx b/site/src/components/CopyButton/CopyButton.tsx
index 9110bb4cd68d0..c00b9360e4206 100644
--- a/site/src/components/CopyButton/CopyButton.tsx
+++ b/site/src/components/CopyButton/CopyButton.tsx
@@ -19,9 +19,7 @@ export const CopyButton: FC<CopyButtonProps> = ({
 	label,
 	...buttonProps
 }) => {
-	const { showCopiedSuccess, copyToClipboard } = useClipboard({
-		textToCopy: text,
-	});
+	const { showCopiedSuccess, copyToClipboard } = useClipboard();
 
 	return (
 		<TooltipProvider>
@@ -30,7 +28,7 @@ export const CopyButton: FC<CopyButtonProps> = ({
 					<Button
 						size="icon"
 						variant="subtle"
-						onClick={copyToClipboard}
+						onClick={() => copyToClipboard(text)}
 						{...buttonProps}
 					>
 						{showCopiedSuccess ? <CheckIcon /> : <CopyIcon />}
diff --git a/site/src/components/CopyableValue/CopyableValue.tsx b/site/src/components/CopyableValue/CopyableValue.tsx
index 1cd3ea4a15a49..92cb6ec3c4e42 100644
--- a/site/src/components/CopyableValue/CopyableValue.tsx
+++ b/site/src/components/CopyableValue/CopyableValue.tsx
@@ -16,10 +16,10 @@ export const CopyableValue: FC<CopyableValueProps> = ({
 	children,
 	...attrs
 }) => {
-	const { showCopiedSuccess, copyToClipboard } = useClipboard({
-		textToCopy: value,
+	const { showCopiedSuccess, copyToClipboard } = useClipboard();
+	const clickableProps = useClickable<HTMLSpanElement>(() => {
+		copyToClipboard(value);
 	});
-	const clickableProps = useClickable<HTMLSpanElement>(copyToClipboard);
 
 	return (
 		<Tooltip
diff --git a/site/src/hooks/useClickable.ts b/site/src/hooks/useClickable.ts
index 3f59851b8fc3b..6f5e0afff7ff7 100644
--- a/site/src/hooks/useClickable.ts
+++ b/site/src/hooks/useClickable.ts
@@ -4,6 +4,7 @@ import {
 	type RefObject,
 	useRef,
 } from "react";
+import { useEffectEvent } from "./hookPolyfills";
 
 // Literally any object (ideally an HTMLElement) that has a .click method
 type ClickableElement = {
@@ -43,10 +44,11 @@ export const useClickable = <
 	role?: TRole,
 ): UseClickableResult<TElement, TRole> => {
 	const ref = useRef<TElement>(null);
+	const stableOnClick = useEffectEvent(onClick);
 
 	return {
 		ref,
-		onClick,
+		onClick: stableOnClick,
 		tabIndex: 0,
 		role: (role ?? "button") as TRole,
 
diff --git a/site/src/hooks/useClipboard.test.tsx b/site/src/hooks/useClipboard.test.tsx
index 1d4d2eb702a81..156d70ab31593 100644
--- a/site/src/hooks/useClipboard.test.tsx
+++ b/site/src/hooks/useClipboard.test.tsx
@@ -9,9 +9,11 @@
  * immediately pollutes the tests with false negatives. Even if something should
  * fail, it won't.
  */
-import { act, renderHook, screen } from "@testing-library/react";
+
+import { renderHook, screen } from "@testing-library/react";
 import { GlobalSnackbar } from "components/GlobalSnackbar/GlobalSnackbar";
 import { ThemeOverride } from "contexts/ThemeProvider";
+import { act } from "react";
 import themes, { DEFAULT_THEME } from "theme";
 import {
 	COPY_FAILED_MESSAGE,
@@ -115,8 +117,8 @@ function setupMockClipboard(isSecure: boolean): SetupMockClipboardResult {
 	};
 }
 
-function renderUseClipboard<TInput extends UseClipboardInput>(inputs: TInput) {
-	return renderHook<UseClipboardResult, TInput>(
+function renderUseClipboard(inputs?: UseClipboardInput) {
+	return renderHook<UseClipboardResult, UseClipboardInput>(
 		(props) => useClipboard(props),
 		{
 			initialProps: inputs,
@@ -188,9 +190,9 @@ describe.each(secureContextValues)("useClipboard - secure: %j", (isSecure) => {
 
 	const assertClipboardUpdateLifecycle = async (
 		result: RenderResult,
-		textToCheck: string,
+		textToCopy: string,
 	): Promise<void> => {
-		await act(() => result.current.copyToClipboard());
+		await act(() => result.current.copyToClipboard(textToCopy));
 		expect(result.current.showCopiedSuccess).toBe(true);
 
 		// Because of timing trickery, any timeouts for flipping the copy status
@@ -203,18 +205,18 @@ describe.each(secureContextValues)("useClipboard - secure: %j", (isSecure) => {
 		await act(() => jest.runAllTimersAsync());
 
 		const clipboardText = getClipboardText();
-		expect(clipboardText).toEqual(textToCheck);
+		expect(clipboardText).toEqual(textToCopy);
 	};
 
 	it("Copies the current text to the user's clipboard", async () => {
 		const textToCopy = "dogs";
-		const { result } = renderUseClipboard({ textToCopy });
+		const { result } = renderUseClipboard();
 		await assertClipboardUpdateLifecycle(result, textToCopy);
 	});
 
 	it("Should indicate to components not to show successful copy after a set period of time", async () => {
 		const textToCopy = "cats";
-		const { result } = renderUseClipboard({ textToCopy });
+		const { result } = renderUseClipboard();
 		await assertClipboardUpdateLifecycle(result, textToCopy);
 		expect(result.current.showCopiedSuccess).toBe(false);
 	});
@@ -222,16 +224,16 @@ describe.each(secureContextValues)("useClipboard - secure: %j", (isSecure) => {
 	it("Should notify the user of an error using the provided callback", async () => {
 		const textToCopy = "birds";
 		const onError = jest.fn();
-		const { result } = renderUseClipboard({ textToCopy, onError });
+		const { result } = renderUseClipboard({ onError });
 
 		setSimulateFailure(true);
-		await act(() => result.current.copyToClipboard());
+		await act(() => result.current.copyToClipboard(textToCopy));
 		expect(onError).toBeCalled();
 	});
 
 	it("Should dispatch a new toast message to the global snackbar when errors happen while no error callback is provided to the hook", async () => {
 		const textToCopy = "crow";
-		const { result } = renderUseClipboard({ textToCopy });
+		const { result } = renderUseClipboard();
 
 		/**
 		 * @todo Look into why deferring error-based state updates to the global
@@ -241,7 +243,7 @@ describe.each(secureContextValues)("useClipboard - secure: %j", (isSecure) => {
 		 * flushed through the GlobalSnackbar component afterwards
 		 */
 		setSimulateFailure(true);
-		await act(() => result.current.copyToClipboard());
+		await act(() => result.current.copyToClipboard(textToCopy));
 
 		const errorMessageNode = screen.queryByText(COPY_FAILED_MESSAGE);
 		expect(errorMessageNode).not.toBeNull();
@@ -252,11 +254,91 @@ describe.each(secureContextValues)("useClipboard - secure: %j", (isSecure) => {
 		// Snackbar state transitions that you might get if the hook uses the
 		// default
 		const textToCopy = "hamster";
-		const { result } = renderUseClipboard({ textToCopy, onError: jest.fn() });
+		const { result } = renderUseClipboard({ onError: jest.fn() });
+
+		setSimulateFailure(true);
+		await act(() => result.current.copyToClipboard(textToCopy));
+
+		expect(result.current.error).toBeInstanceOf(Error);
+	});
 
+	it("Clears out existing errors if a new copy operation succeeds", async () => {
+		const text = "dummy-text";
+		const { result } = renderUseClipboard();
 		setSimulateFailure(true);
-		await act(() => result.current.copyToClipboard());
 
+		await act(() => result.current.copyToClipboard(text));
 		expect(result.current.error).toBeInstanceOf(Error);
+
+		setSimulateFailure(false);
+		await assertClipboardUpdateLifecycle(result, text);
+		expect(result.current.error).toBeUndefined();
+	});
+
+	// This test case is really important to ensure that it's easy to plop this
+	// inside of useEffect calls without having to think about dependencies too
+	// much
+	it("Ensures that the copyToClipboard function always maintains a stable reference across all re-renders", async () => {
+		const initialOnError = jest.fn();
+		const { result, rerender } = renderUseClipboard({
+			onError: initialOnError,
+			clearErrorOnSuccess: true,
+		});
+		const initialCopy = result.current.copyToClipboard;
+
+		// Re-render arbitrarily with no clipboard state transitions to make
+		// sure that a parent re-rendering doesn't break anything
+		rerender({ onError: initialOnError });
+		expect(result.current.copyToClipboard).toBe(initialCopy);
+
+		// Re-render with new onError prop and then swap back to simplify
+		// testing
+		rerender({ onError: jest.fn() });
+		expect(result.current.copyToClipboard).toBe(initialCopy);
+		rerender({ onError: initialOnError });
+
+		// Re-render with a new clear value then swap back to simplify testing
+		rerender({ onError: initialOnError, clearErrorOnSuccess: false });
+		expect(result.current.copyToClipboard).toBe(initialCopy);
+		rerender({ onError: initialOnError, clearErrorOnSuccess: true });
+
+		// Trigger a failed clipboard interaction
+		setSimulateFailure(true);
+		await act(() => result.current.copyToClipboard("dummy-text-2"));
+		expect(result.current.copyToClipboard).toBe(initialCopy);
+
+		/**
+		 * Trigger a successful clipboard interaction
+		 *
+		 * @todo For some reason, using the assertClipboardUpdateLifecycle
+		 * helper triggers Jest errors with it thinking that values are being
+		 * accessed after teardown, even though the problem doesn't exist for
+		 * any other test case.
+		 *
+		 * It's not a huge deal, because we only need to inspect React after the
+		 * interaction, instead of the full DOM, but for correctness, it would
+		 * be nice if we could get this issue figured out.
+		 */
+		setSimulateFailure(false);
+		await act(() => result.current.copyToClipboard("dummy-text-2"));
+		expect(result.current.copyToClipboard).toBe(initialCopy);
+	});
+
+	it("Always uses the most up-to-date onError prop", async () => {
+		const initialOnError = jest.fn();
+		const { result, rerender } = renderUseClipboard({
+			onError: initialOnError,
+		});
+		setSimulateFailure(true);
+
+		const secondOnError = jest.fn();
+		rerender({ onError: secondOnError });
+		await act(() => result.current.copyToClipboard("dummy-text"));
+
+		expect(initialOnError).not.toHaveBeenCalled();
+		expect(secondOnError).toHaveBeenCalledTimes(1);
+		expect(secondOnError).toHaveBeenCalledWith(
+			"Failed to copy text to clipboard",
+		);
 	});
 });
diff --git a/site/src/hooks/useClipboard.ts b/site/src/hooks/useClipboard.ts
index 1eb91cc356155..88a57a61fc05a 100644
--- a/site/src/hooks/useClipboard.ts
+++ b/site/src/hooks/useClipboard.ts
@@ -1,22 +1,18 @@
 import { displayError } from "components/GlobalSnackbar/utils";
-import { useEffect, useRef, useState } from "react";
+import { useCallback, useEffect, useRef, useState } from "react";
+import { useEffectEvent } from "./hookPolyfills";
 
 const CLIPBOARD_TIMEOUT_MS = 1_000;
 export const COPY_FAILED_MESSAGE = "Failed to copy text to clipboard";
 export const HTTP_FALLBACK_DATA_ID = "http-fallback";
 
 export type UseClipboardInput = Readonly<{
-	textToCopy: string;
-
-	/**
-	 * Optional callback to call when an error happens. If not specified, the hook
-	 * will dispatch an error message to the GlobalSnackbar
-	 */
 	onError?: (errorMessage: string) => void;
+	clearErrorOnSuccess?: boolean;
 }>;
 
 export type UseClipboardResult = Readonly<{
-	copyToClipboard: () => Promise<void>;
+	copyToClipboard: (textToCopy: string) => Promise<void>;
 	error: Error | undefined;
 
 	/**
@@ -40,47 +36,56 @@ export type UseClipboardResult = Readonly<{
 	showCopiedSuccess: boolean;
 }>;
 
-export const useClipboard = (input: UseClipboardInput): UseClipboardResult => {
-	const { textToCopy, onError: errorCallback } = input;
+export const useClipboard = (input?: UseClipboardInput): UseClipboardResult => {
+	const { onError = displayError, clearErrorOnSuccess = true } = input ?? {};
+
 	const [showCopiedSuccess, setShowCopiedSuccess] = useState(false);
 	const [error, setError] = useState<Error>();
 	const timeoutIdRef = useRef<number | undefined>(undefined);
 
 	useEffect(() => {
-		const clearIdOnUnmount = () => window.clearTimeout(timeoutIdRef.current);
-		return clearIdOnUnmount;
+		const clearTimeoutOnUnmount = () => {
+			window.clearTimeout(timeoutIdRef.current);
+		};
+		return clearTimeoutOnUnmount;
 	}, []);
 
-	const handleSuccessfulCopy = () => {
+	const stableOnError = useEffectEvent(() => onError(COPY_FAILED_MESSAGE));
+	const handleSuccessfulCopy = useEffectEvent(() => {
 		setShowCopiedSuccess(true);
+		if (clearErrorOnSuccess) {
+			setError(undefined);
+		}
+
 		timeoutIdRef.current = window.setTimeout(() => {
 			setShowCopiedSuccess(false);
 		}, CLIPBOARD_TIMEOUT_MS);
-	};
-
-	const copyToClipboard = async () => {
-		try {
-			await window.navigator.clipboard.writeText(textToCopy);
-			handleSuccessfulCopy();
-		} catch (err) {
-			const fallbackCopySuccessful = simulateClipboardWrite(textToCopy);
-			if (fallbackCopySuccessful) {
-				handleSuccessfulCopy();
-				return;
-			}
+	});
 
-			const wrappedErr = new Error(COPY_FAILED_MESSAGE);
-			if (err instanceof Error) {
-				wrappedErr.stack = err.stack;
+	const copyToClipboard = useCallback(
+		async (textToCopy: string) => {
+			try {
+				await window.navigator.clipboard.writeText(textToCopy);
+				handleSuccessfulCopy();
+			} catch (err) {
+				const fallbackCopySuccessful = simulateClipboardWrite(textToCopy);
+				if (fallbackCopySuccessful) {
+					handleSuccessfulCopy();
+					return;
+				}
+
+				const wrappedErr = new Error(COPY_FAILED_MESSAGE);
+				if (err instanceof Error) {
+					wrappedErr.stack = err.stack;
+				}
+
+				console.error(wrappedErr);
+				setError(wrappedErr);
+				stableOnError();
 			}
-
-			console.error(wrappedErr);
-			setError(wrappedErr);
-
-			const notifyUser = errorCallback ?? displayError;
-			notifyUser(COPY_FAILED_MESSAGE);
-		}
-	};
+		},
+		[stableOnError, handleSuccessfulCopy],
+	);
 
 	return { showCopiedSuccess, error, copyToClipboard };
 };
diff --git a/site/src/pages/CliAuthPage/CliAuthPageView.tsx b/site/src/pages/CliAuthPage/CliAuthPageView.tsx
index e836127f61fc8..10df8b225ddbc 100644
--- a/site/src/pages/CliAuthPage/CliAuthPageView.tsx
+++ b/site/src/pages/CliAuthPage/CliAuthPageView.tsx
@@ -12,10 +12,7 @@ interface CliAuthPageViewProps {
 }
 
 export const CliAuthPageView: FC<CliAuthPageViewProps> = ({ sessionToken }) => {
-	const clipboard = useClipboard({
-		textToCopy: sessionToken ?? "",
-	});
-
+	const clipboardState = useClipboard();
 	return (
 		<SignInLayout>
 			<Welcome>Session token</Welcome>
@@ -30,16 +27,20 @@ export const CliAuthPageView: FC<CliAuthPageViewProps> = ({ sessionToken }) => {
 					className="w-full"
 					size="lg"
 					disabled={!sessionToken}
-					onClick={clipboard.copyToClipboard}
+					onClick={() => {
+						if (sessionToken) {
+							clipboardState.copyToClipboard(sessionToken);
+						}
+					}}
 				>
-					{clipboard.showCopiedSuccess ? (
+					{clipboardState.showCopiedSuccess ? (
 						<CheckIcon />
 					) : (
 						<Spinner loading={!sessionToken}>
 							<CopyIcon />
 						</Spinner>
 					)}
-					{clipboard.showCopiedSuccess
+					{clipboardState.showCopiedSuccess
 						? "Session token copied!"
 						: "Copy session token"}
 				</Button>
diff --git a/site/src/pages/TaskPage/TaskTopbar.tsx b/site/src/pages/TaskPage/TaskTopbar.tsx
index 1ad9ca5f0ff4c..989e1b6473416 100644
--- a/site/src/pages/TaskPage/TaskTopbar.tsx
+++ b/site/src/pages/TaskPage/TaskTopbar.tsx
@@ -81,14 +81,11 @@ export const TaskTopbar: FC<TaskTopbarProps> = ({ task }) => {
 type CopyPromptButtonProps = { prompt: string };
 
 const CopyPromptButton: FC<CopyPromptButtonProps> = ({ prompt }) => {
-	const { copyToClipboard, showCopiedSuccess } = useClipboard({
-		textToCopy: prompt,
-	});
-
+	const { copyToClipboard, showCopiedSuccess } = useClipboard();
 	return (
 		<Button
 			disabled={showCopiedSuccess}
-			onClick={copyToClipboard}
+			onClick={() => copyToClipboard(prompt)}
 			size="sm"
 			variant="subtle"
 			className="p-0 min-w-0"
diff --git a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx
index ee92303b5df23..8b50ef2447652 100644
--- a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx
+++ b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPage.tsx
@@ -74,13 +74,7 @@ export const TemplateEmbedPageView: FC<TemplateEmbedPageViewProps> = ({
 	templateParameters,
 }) => {
 	const [buttonValues, setButtonValues] = useState<ButtonValues | undefined>();
-	const clipboard = useClipboard({
-		textToCopy: getClipboardCopyContent(
-			template.name,
-			template.organization_name,
-			buttonValues,
-		),
-	});
+	const clipboard = useClipboard();
 
 	// template parameters is async so we need to initialize the values after it
 	// is loaded
@@ -237,8 +231,15 @@ export const TemplateEmbedPageView: FC<TemplateEmbedPageViewProps> = ({
 						>
 							<Button
 								className="rounded-full"
-								onClick={clipboard.copyToClipboard}
 								disabled={clipboard.showCopiedSuccess}
+								onClick={() => {
+									const textToCopy = getClipboardCopyContent(
+										template.name,
+										template.organization_name,
+										buttonValues,
+									);
+									clipboard.copyToClipboard(textToCopy);
+								}}
 							>
 								{clipboard.showCopiedSuccess ? <CheckIcon /> : <CopyIcon />}
 								Copy button code
diff --git a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx
index a34d719f4c052..c9b63f1422478 100644
--- a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx
+++ b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx
@@ -289,14 +289,7 @@ interface ButtonPreviewProps {
 }
 
 const ButtonPreview: FC<ButtonPreviewProps> = ({ template, buttonValues }) => {
-	const clipboard = useClipboard({
-		textToCopy: getClipboardCopyContent(
-			template.name,
-			template.organization_name,
-			buttonValues,
-		),
-	});
-
+	const clipboard = useClipboard();
 	return (
 		<div
 			className="sticky top-10 flex gap-16 h-96 flex-1 flex-col items-center justify-center
@@ -305,8 +298,15 @@ const ButtonPreview: FC<ButtonPreviewProps> = ({ template, buttonValues }) => {
 			<img src="/open-in-coder.svg" alt="Open in Coder button" />
 			<Button
 				variant="default"
-				onClick={clipboard.copyToClipboard}
 				disabled={clipboard.showCopiedSuccess}
+				onClick={() => {
+					const textToCopy = getClipboardCopyContent(
+						template.name,
+						template.organization_name,
+						buttonValues,
+					);
+					clipboard.copyToClipboard(textToCopy);
+				}}
 			>
 				{clipboard.showCopiedSuccess ? <CheckOutlined /> : <FileCopyOutlined />}{" "}
 				Copy button code

From 05f8f67ced1468fed312757a9f3f8243511d609c Mon Sep 17 00:00:00 2001
From: Kacper Sawicki <kacper@coder.com>
Date: Tue, 7 Oct 2025 09:59:15 +0200
Subject: [PATCH 070/298] feat(scaletest): add runner for notifications
 delivery (#20091)

Relates to https://github.com/coder/internal/issues/910

This PR adds a scaletest runner that simulates users receiving notifications through WebSocket connections.

An instance of this notification runner does the following:

1. Creates a user (optionally with specific roles like owner).
2. Connects to /api/v2/notifications/inbox/watch via WebSocket to receive notifications in real-time.
3. Waits for all other concurrently executing runners (per the DialBarrier WaitGroup) to also connect their websockets.
4. For receiving users: Watches the WebSocket for expected notifications and records delivery latency for each notification type.
5. For regular users: Maintains WebSocket connections to simulate concurrent load while receiving users wait for notifications.
6. Waits on the ReceivingWatchBarrier to coordinate between receiving and regular users.
7. Cleans up the created user after the test completes.


Exposes three prometheus metrics:

1. notification_delivery_latency_seconds - HistogramVec. Labels = {username, notification_type}
2. notification_delivery_errors_total - CounterVec. Labels = {username, action}
3. notification_delivery_missed_total - CounterVec. Labels = {username}

The runner measures end-to-end notification latency from when a notification-triggering event occurs (e.g., user creation/deletion) to when the notification is received by a WebSocket client.
---
 scaletest/notifications/config.go   |  71 ++++++++
 scaletest/notifications/metrics.go  |  58 ++++++
 scaletest/notifications/run.go      | 263 ++++++++++++++++++++++++++++
 scaletest/notifications/run_test.go | 221 +++++++++++++++++++++++
 4 files changed, 613 insertions(+)
 create mode 100644 scaletest/notifications/config.go
 create mode 100644 scaletest/notifications/metrics.go
 create mode 100644 scaletest/notifications/run.go
 create mode 100644 scaletest/notifications/run_test.go

diff --git a/scaletest/notifications/config.go b/scaletest/notifications/config.go
new file mode 100644
index 0000000000000..ac1c6da49a01b
--- /dev/null
+++ b/scaletest/notifications/config.go
@@ -0,0 +1,71 @@
+package notifications
+
+import (
+	"sync"
+	"time"
+
+	"golang.org/x/xerrors"
+
+	"github.com/google/uuid"
+
+	"github.com/coder/coder/v2/scaletest/createusers"
+)
+
+type Config struct {
+	// User is the configuration for the user to create.
+	User createusers.Config `json:"user"`
+
+	// Roles are the roles to assign to the user.
+	Roles []string `json:"roles"`
+
+	// NotificationTimeout is how long to wait for notifications after triggering.
+	NotificationTimeout time.Duration `json:"notification_timeout"`
+
+	// DialTimeout is how long to wait for websocket connection.
+	DialTimeout time.Duration `json:"dial_timeout"`
+
+	// ExpectedNotifications maps notification template IDs to channels
+	// that receive the trigger time for each notification.
+	ExpectedNotifications map[uuid.UUID]chan time.Time `json:"-"`
+
+	Metrics *Metrics `json:"-"`
+
+	// DialBarrier ensures all runners are connected before notifications are triggered.
+	DialBarrier *sync.WaitGroup `json:"-"`
+
+	// ReceivingWatchBarrier is the barrier for receiving users. Regular users wait on this to disconnect after receiving users complete.
+	ReceivingWatchBarrier *sync.WaitGroup `json:"-"`
+}
+
+func (c Config) Validate() error {
+	// The runner always needs an org; ensure we propagate it into the user config.
+	if c.User.OrganizationID == uuid.Nil {
+		return xerrors.New("user organization_id must be set")
+	}
+
+	if err := c.User.Validate(); err != nil {
+		return xerrors.Errorf("user config: %w", err)
+	}
+
+	if c.DialBarrier == nil {
+		return xerrors.New("dial barrier must be set")
+	}
+
+	if c.ReceivingWatchBarrier == nil {
+		return xerrors.New("receiving_watch_barrier must be set")
+	}
+
+	if c.NotificationTimeout <= 0 {
+		return xerrors.New("notification_timeout must be greater than 0")
+	}
+
+	if c.DialTimeout <= 0 {
+		return xerrors.New("dial_timeout must be greater than 0")
+	}
+
+	if c.Metrics == nil {
+		return xerrors.New("metrics must be set")
+	}
+
+	return nil
+}
diff --git a/scaletest/notifications/metrics.go b/scaletest/notifications/metrics.go
new file mode 100644
index 0000000000000..c9e7374250b24
--- /dev/null
+++ b/scaletest/notifications/metrics.go
@@ -0,0 +1,58 @@
+package notifications
+
+import (
+	"time"
+
+	"github.com/prometheus/client_golang/prometheus"
+)
+
+type Metrics struct {
+	notificationLatency *prometheus.HistogramVec
+	notificationErrors  *prometheus.CounterVec
+	missedNotifications *prometheus.CounterVec
+}
+
+func NewMetrics(reg prometheus.Registerer) *Metrics {
+	if reg == nil {
+		reg = prometheus.DefaultRegisterer
+	}
+
+	latency := prometheus.NewHistogramVec(prometheus.HistogramOpts{
+		Namespace: "coderd",
+		Subsystem: "scaletest",
+		Name:      "notification_delivery_latency_seconds",
+		Help:      "Time between notification-creating action and receipt of notification by client",
+	}, []string{"username", "notification_type"})
+	errors := prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: "coderd",
+		Subsystem: "scaletest",
+		Name:      "notification_delivery_errors_total",
+		Help:      "Total number of notification delivery errors",
+	}, []string{"username", "action"})
+	missed := prometheus.NewCounterVec(prometheus.CounterOpts{
+		Namespace: "coderd",
+		Subsystem: "scaletest",
+		Name:      "notification_delivery_missed_total",
+		Help:      "Total number of missed notifications",
+	}, []string{"username"})
+
+	reg.MustRegister(latency, errors, missed)
+
+	return &Metrics{
+		notificationLatency: latency,
+		notificationErrors:  errors,
+		missedNotifications: missed,
+	}
+}
+
+func (m *Metrics) RecordLatency(latency time.Duration, username, notificationType string) {
+	m.notificationLatency.WithLabelValues(username, notificationType).Observe(latency.Seconds())
+}
+
+func (m *Metrics) AddError(username, action string) {
+	m.notificationErrors.WithLabelValues(username, action).Inc()
+}
+
+func (m *Metrics) RecordMissed(username string) {
+	m.missedNotifications.WithLabelValues(username).Inc()
+}
diff --git a/scaletest/notifications/run.go b/scaletest/notifications/run.go
new file mode 100644
index 0000000000000..d3d68e78acb42
--- /dev/null
+++ b/scaletest/notifications/run.go
@@ -0,0 +1,263 @@
+package notifications
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"io"
+	"net/http"
+	"time"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+
+	"github.com/coder/coder/v2/coderd/tracing"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/createusers"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/loadtestutil"
+	"github.com/coder/websocket"
+)
+
+type Runner struct {
+	client *codersdk.Client
+	cfg    Config
+
+	createUserRunner *createusers.Runner
+
+	// notificationLatencies stores the latency for each notification type
+	notificationLatencies map[uuid.UUID]time.Duration
+}
+
+func NewRunner(client *codersdk.Client, cfg Config) *Runner {
+	return &Runner{
+		client:                client,
+		cfg:                   cfg,
+		notificationLatencies: make(map[uuid.UUID]time.Duration),
+	}
+}
+
+var (
+	_ harness.Runnable    = &Runner{}
+	_ harness.Cleanable   = &Runner{}
+	_ harness.Collectable = &Runner{}
+)
+
+func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
+	ctx, span := tracing.StartSpan(ctx)
+	defer span.End()
+
+	reachedBarrier := false
+	defer func() {
+		if !reachedBarrier {
+			r.cfg.DialBarrier.Done()
+		}
+	}()
+
+	reachedReceivingWatchBarrier := false
+	defer func() {
+		if len(r.cfg.ExpectedNotifications) > 0 && !reachedReceivingWatchBarrier {
+			r.cfg.ReceivingWatchBarrier.Done()
+		}
+	}()
+
+	logs = loadtestutil.NewSyncWriter(logs)
+	logger := slog.Make(sloghuman.Sink(logs)).Leveled(slog.LevelDebug)
+	r.client.SetLogger(logger)
+	r.client.SetLogBodies(true)
+
+	r.createUserRunner = createusers.NewRunner(r.client, r.cfg.User)
+	newUserAndToken, err := r.createUserRunner.RunReturningUser(ctx, id, logs)
+	if err != nil {
+		r.cfg.Metrics.AddError("", "create_user")
+		return xerrors.Errorf("create user: %w", err)
+	}
+	newUser := newUserAndToken.User
+	newUserClient := codersdk.New(r.client.URL,
+		codersdk.WithSessionToken(newUserAndToken.SessionToken),
+		codersdk.WithLogger(logger),
+		codersdk.WithLogBodies())
+
+	logger.Info(ctx, "runner user created", slog.F("username", newUser.Username), slog.F("user_id", newUser.ID.String()))
+
+	if len(r.cfg.Roles) > 0 {
+		logger.Info(ctx, "assigning roles to user", slog.F("roles", r.cfg.Roles))
+
+		_, err := r.client.UpdateUserRoles(ctx, newUser.ID.String(), codersdk.UpdateRoles{
+			Roles: r.cfg.Roles,
+		})
+		if err != nil {
+			r.cfg.Metrics.AddError(newUser.Username, "assign_roles")
+			return xerrors.Errorf("assign roles: %w", err)
+		}
+	}
+
+	logger.Info(ctx, "notification runner is ready")
+
+	dialCtx, cancel := context.WithTimeout(ctx, r.cfg.DialTimeout)
+	defer cancel()
+
+	logger.Info(ctx, "connecting to notification websocket")
+	conn, err := r.dialNotificationWebsocket(dialCtx, newUserClient, newUser, logger)
+	if err != nil {
+		return xerrors.Errorf("dial notification websocket: %w", err)
+	}
+	defer conn.Close(websocket.StatusNormalClosure, "done")
+	logger.Info(ctx, "connected to notification websocket")
+
+	reachedBarrier = true
+	r.cfg.DialBarrier.Done()
+	r.cfg.DialBarrier.Wait()
+
+	if len(r.cfg.ExpectedNotifications) == 0 {
+		logger.Info(ctx, "maintaining websocket connection, waiting for receiving users to complete")
+
+		// Wait for receiving users to complete
+		done := make(chan struct{})
+		go func() {
+			r.cfg.ReceivingWatchBarrier.Wait()
+			close(done)
+		}()
+
+		select {
+		case <-done:
+			logger.Info(ctx, "receiving users complete, closing connection")
+		case <-ctx.Done():
+			logger.Info(ctx, "context canceled, closing connection")
+		}
+		return nil
+	}
+
+	logger.Info(ctx, "waiting for notifications", slog.F("timeout", r.cfg.NotificationTimeout))
+
+	watchCtx, cancel := context.WithTimeout(ctx, r.cfg.NotificationTimeout)
+	defer cancel()
+
+	if err := r.watchNotifications(watchCtx, conn, newUser, logger, r.cfg.ExpectedNotifications); err != nil {
+		return xerrors.Errorf("notification watch failed: %w", err)
+	}
+
+	reachedReceivingWatchBarrier = true
+	r.cfg.ReceivingWatchBarrier.Done()
+
+	return nil
+}
+
+func (r *Runner) Cleanup(ctx context.Context, id string, logs io.Writer) error {
+	if r.createUserRunner != nil {
+		_, _ = fmt.Fprintln(logs, "Cleaning up user...")
+		if err := r.createUserRunner.Cleanup(ctx, id, logs); err != nil {
+			return xerrors.Errorf("cleanup user: %w", err)
+		}
+	}
+
+	return nil
+}
+
+const NotificationDeliveryLatencyMetric = "notification_delivery_latency_seconds"
+
+func (r *Runner) GetMetrics() map[string]any {
+	return map[string]any{
+		NotificationDeliveryLatencyMetric: r.notificationLatencies,
+	}
+}
+
+func (r *Runner) dialNotificationWebsocket(ctx context.Context, client *codersdk.Client, user codersdk.User, logger slog.Logger) (*websocket.Conn, error) {
+	u, err := client.URL.Parse("/api/v2/notifications/inbox/watch")
+	if err != nil {
+		logger.Error(ctx, "parse notification URL", slog.Error(err))
+		r.cfg.Metrics.AddError(user.Username, "parse_url")
+		return nil, xerrors.Errorf("parse notification URL: %w", err)
+	}
+
+	conn, resp, err := websocket.Dial(ctx, u.String(), &websocket.DialOptions{
+		HTTPHeader: http.Header{
+			"Coder-Session-Token": []string{client.SessionToken()},
+		},
+	})
+	if err != nil {
+		if resp != nil {
+			defer resp.Body.Close()
+			if resp.StatusCode != http.StatusSwitchingProtocols {
+				err = codersdk.ReadBodyAsError(resp)
+			}
+		}
+		logger.Error(ctx, "dial notification websocket", slog.Error(err))
+		r.cfg.Metrics.AddError(user.Username, "dial")
+		return nil, xerrors.Errorf("dial notification websocket: %w", err)
+	}
+
+	return conn, nil
+}
+
+// watchNotifications reads notifications from the websocket and returns error or nil
+// once all expected notifications are received.
+func (r *Runner) watchNotifications(ctx context.Context, conn *websocket.Conn, user codersdk.User, logger slog.Logger, expectedNotifications map[uuid.UUID]chan time.Time) error {
+	logger.Info(ctx, "waiting for notifications",
+		slog.F("username", user.Username),
+		slog.F("expected_count", len(expectedNotifications)))
+
+	receivedNotifications := make(map[uuid.UUID]struct{})
+
+	for {
+		select {
+		case <-ctx.Done():
+			return xerrors.Errorf("context canceled while waiting for notifications: %w", ctx.Err())
+		default:
+		}
+
+		if len(receivedNotifications) == len(expectedNotifications) {
+			logger.Info(ctx, "received all expected notifications")
+			return nil
+		}
+
+		notif, err := readNotification(ctx, conn)
+		if err != nil {
+			logger.Error(ctx, "read notification", slog.Error(err))
+			r.cfg.Metrics.AddError(user.Username, "read_notification")
+			return xerrors.Errorf("read notification: %w", err)
+		}
+
+		templateID := notif.Notification.TemplateID
+		if triggerTimeChan, exists := expectedNotifications[templateID]; exists {
+			if _, exists := receivedNotifications[templateID]; !exists {
+				receiptTime := time.Now()
+				select {
+				case triggerTime := <-triggerTimeChan:
+					latency := receiptTime.Sub(triggerTime)
+					r.notificationLatencies[templateID] = latency
+					r.cfg.Metrics.RecordLatency(latency, user.Username, templateID.String())
+					receivedNotifications[templateID] = struct{}{}
+
+					logger.Info(ctx, "received expected notification",
+						slog.F("template_id", templateID),
+						slog.F("title", notif.Notification.Title),
+						slog.F("latency", latency))
+				case <-ctx.Done():
+					return xerrors.Errorf("context canceled while waiting for trigger time: %w", ctx.Err())
+				}
+			}
+		} else {
+			logger.Debug(ctx, "received notification not being tested",
+				slog.F("template_id", templateID),
+				slog.F("title", notif.Notification.Title))
+		}
+	}
+}
+
+func readNotification(ctx context.Context, conn *websocket.Conn) (codersdk.GetInboxNotificationResponse, error) {
+	_, message, err := conn.Read(ctx)
+	if err != nil {
+		return codersdk.GetInboxNotificationResponse{}, err
+	}
+
+	var notif codersdk.GetInboxNotificationResponse
+	if err := json.Unmarshal(message, &notif); err != nil {
+		return codersdk.GetInboxNotificationResponse{}, xerrors.Errorf("unmarshal notification: %w", err)
+	}
+
+	return notif, nil
+}
diff --git a/scaletest/notifications/run_test.go b/scaletest/notifications/run_test.go
new file mode 100644
index 0000000000000..e94e6d82eab56
--- /dev/null
+++ b/scaletest/notifications/run_test.go
@@ -0,0 +1,221 @@
+package notifications_test
+
+import (
+	"io"
+	"strconv"
+	"sync"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/serpent"
+
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	notificationsLib "github.com/coder/coder/v2/coderd/notifications"
+	"github.com/coder/coder/v2/coderd/notifications/dispatch"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/createusers"
+	"github.com/coder/coder/v2/scaletest/notifications"
+	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/quartz"
+)
+
+func TestRun(t *testing.T) {
+	t.Parallel()
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+	logger := testutil.Logger(t)
+	db, ps := dbtestutil.NewDB(t)
+
+	// Setup notifications manager with inbox handler
+	cfg := defaultNotificationsConfig(database.NotificationMethodSmtp)
+	mgr, err := notificationsLib.NewManager(
+		cfg,
+		db,
+		ps,
+		defaultHelpers(),
+		notificationsLib.NewMetrics(prometheus.NewRegistry()),
+		logger.Named("manager"),
+	)
+	require.NoError(t, err)
+
+	mgr.WithHandlers(map[database.NotificationMethod]notificationsLib.Handler{
+		database.NotificationMethodInbox: dispatch.NewInboxHandler(logger.Named("inbox"), db, ps),
+	})
+	t.Cleanup(func() {
+		assert.NoError(t, mgr.Stop(dbauthz.AsNotifier(ctx)))
+	})
+	mgr.Run(dbauthz.AsNotifier(ctx))
+
+	enqueuer, err := notificationsLib.NewStoreEnqueuer(
+		cfg,
+		db,
+		defaultHelpers(),
+		logger.Named("enqueuer"),
+		quartz.NewReal(),
+	)
+	require.NoError(t, err)
+
+	client := coderdtest.New(t, &coderdtest.Options{
+		Database:              db,
+		Pubsub:                ps,
+		NotificationsEnqueuer: enqueuer,
+	})
+	firstUser := coderdtest.CreateFirstUser(t, client)
+
+	const numReceivingUsers = 2
+	const numRegularUsers = 2
+	dialBarrier := new(sync.WaitGroup)
+	receivingWatchBarrier := new(sync.WaitGroup)
+	dialBarrier.Add(numReceivingUsers + numRegularUsers)
+	receivingWatchBarrier.Add(numReceivingUsers)
+	metrics := notifications.NewMetrics(prometheus.NewRegistry())
+
+	eg, runCtx := errgroup.WithContext(ctx)
+
+	expectedNotifications := map[uuid.UUID]chan time.Time{
+		notificationsLib.TemplateUserAccountCreated: make(chan time.Time, 1),
+		notificationsLib.TemplateUserAccountDeleted: make(chan time.Time, 1),
+	}
+
+	// Start receiving runners who will receive notifications
+	receivingRunners := make([]*notifications.Runner, 0, numReceivingUsers)
+	for i := range numReceivingUsers {
+		runnerCfg := notifications.Config{
+			User: createusers.Config{
+				OrganizationID: firstUser.OrganizationID,
+			},
+			Roles:                 []string{codersdk.RoleOwner},
+			NotificationTimeout:   testutil.WaitLong,
+			DialTimeout:           testutil.WaitLong,
+			Metrics:               metrics,
+			DialBarrier:           dialBarrier,
+			ReceivingWatchBarrier: receivingWatchBarrier,
+			ExpectedNotifications: expectedNotifications,
+		}
+		err := runnerCfg.Validate()
+		require.NoError(t, err)
+
+		runner := notifications.NewRunner(client, runnerCfg)
+		receivingRunners = append(receivingRunners, runner)
+		eg.Go(func() error {
+			return runner.Run(runCtx, "receiving-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+
+	// Start regular user runners who will maintain websocket connections
+	regularRunners := make([]*notifications.Runner, 0, numRegularUsers)
+	for i := range numRegularUsers {
+		runnerCfg := notifications.Config{
+			User: createusers.Config{
+				OrganizationID: firstUser.OrganizationID,
+			},
+			Roles:                 []string{},
+			NotificationTimeout:   testutil.WaitLong,
+			DialTimeout:           testutil.WaitLong,
+			Metrics:               metrics,
+			DialBarrier:           dialBarrier,
+			ReceivingWatchBarrier: receivingWatchBarrier,
+		}
+		err := runnerCfg.Validate()
+		require.NoError(t, err)
+
+		runner := notifications.NewRunner(client, runnerCfg)
+		regularRunners = append(regularRunners, runner)
+		eg.Go(func() error {
+			return runner.Run(runCtx, "regular-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+
+	// Trigger notifications by creating and deleting a user
+	eg.Go(func() error {
+		// Wait for all runners to connect
+		dialBarrier.Wait()
+
+		createTime := time.Now()
+		newUser, err := client.CreateUserWithOrgs(runCtx, codersdk.CreateUserRequestWithOrgs{
+			OrganizationIDs: []uuid.UUID{firstUser.OrganizationID},
+			Email:           "test-user@coder.com",
+			Username:        "test-user",
+			Password:        "SomeSecurePassword!",
+		})
+		if err != nil {
+			return xerrors.Errorf("create test user: %w", err)
+		}
+		expectedNotifications[notificationsLib.TemplateUserAccountCreated] <- createTime
+
+		deleteTime := time.Now()
+		if err := client.DeleteUser(runCtx, newUser.ID); err != nil {
+			return xerrors.Errorf("delete test user: %w", err)
+		}
+		expectedNotifications[notificationsLib.TemplateUserAccountDeleted] <- deleteTime
+
+		close(expectedNotifications[notificationsLib.TemplateUserAccountCreated])
+		close(expectedNotifications[notificationsLib.TemplateUserAccountDeleted])
+
+		return nil
+	})
+
+	err = eg.Wait()
+	require.NoError(t, err, "runner execution should complete successfully")
+
+	cleanupEg, cleanupCtx := errgroup.WithContext(ctx)
+	for i, runner := range receivingRunners {
+		cleanupEg.Go(func() error {
+			return runner.Cleanup(cleanupCtx, "receiving-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+	for i, runner := range regularRunners {
+		cleanupEg.Go(func() error {
+			return runner.Cleanup(cleanupCtx, "regular-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+	err = cleanupEg.Wait()
+	require.NoError(t, err)
+
+	users, err := client.Users(ctx, codersdk.UsersRequest{})
+	require.NoError(t, err)
+	require.Len(t, users.Users, 1)
+	require.Equal(t, firstUser.UserID, users.Users[0].ID)
+
+	for _, runner := range receivingRunners {
+		runnerMetrics := runner.GetMetrics()[notifications.NotificationDeliveryLatencyMetric].(map[uuid.UUID]time.Duration)
+		require.Contains(t, runnerMetrics, notificationsLib.TemplateUserAccountCreated)
+		require.Contains(t, runnerMetrics, notificationsLib.TemplateUserAccountDeleted)
+	}
+}
+
+func defaultNotificationsConfig(method database.NotificationMethod) codersdk.NotificationsConfig {
+	return codersdk.NotificationsConfig{
+		Method:              serpent.String(method),
+		MaxSendAttempts:     5,
+		FetchInterval:       serpent.Duration(time.Millisecond * 100),
+		StoreSyncInterval:   serpent.Duration(time.Millisecond * 200),
+		LeasePeriod:         serpent.Duration(time.Second * 10),
+		DispatchTimeout:     serpent.Duration(time.Second * 5),
+		RetryInterval:       serpent.Duration(time.Millisecond * 50),
+		LeaseCount:          10,
+		StoreSyncBufferSize: 50,
+		Inbox: codersdk.NotificationsInboxConfig{
+			Enabled: serpent.Bool(true),
+		},
+	}
+}
+
+func defaultHelpers() map[string]any {
+	return map[string]any{
+		"base_url":     func() string { return "http://test.com" },
+		"current_year": func() string { return "2024" },
+		"logo_url":     func() string { return "https://coder.com/coder-logo-horizontal.png" },
+		"app_name":     func() string { return "Coder" },
+	}
+}

From 0c2eca94f5983b66eef9758775059c5c1fdaf829 Mon Sep 17 00:00:00 2001
From: Kacper Sawicki <kacper@coder.com>
Date: Tue, 7 Oct 2025 10:33:52 +0200
Subject: [PATCH 071/298] feat(cli): add `notifications` scaletest command
 (#20092)

Closes https://github.com/coder/internal/issues/984
---
 cli/exp_scaletest.go | 323 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 323 insertions(+)

diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index e6a3993035512..126a0527dfa01 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -29,6 +29,7 @@ import (
 
 	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/coder/v2/coderd/httpapi"
+	notificationsLib "github.com/coder/coder/v2/coderd/notifications"
 	"github.com/coder/coder/v2/coderd/tracing"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
@@ -39,6 +40,7 @@ import (
 	"github.com/coder/coder/v2/scaletest/dashboard"
 	"github.com/coder/coder/v2/scaletest/harness"
 	"github.com/coder/coder/v2/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/scaletest/notifications"
 	"github.com/coder/coder/v2/scaletest/reconnectingpty"
 	"github.com/coder/coder/v2/scaletest/workspacebuild"
 	"github.com/coder/coder/v2/scaletest/workspacetraffic"
@@ -62,6 +64,7 @@ func (r *RootCmd) scaletestCmd() *serpent.Command {
 			r.scaletestWorkspaceUpdates(),
 			r.scaletestWorkspaceTraffic(),
 			r.scaletestAutostart(),
+			r.scaletestNotifications(),
 		},
 	}
 
@@ -1917,6 +1920,259 @@ func (r *RootCmd) scaletestAutostart() *serpent.Command {
 	return cmd
 }
 
+func (r *RootCmd) scaletestNotifications() *serpent.Command {
+	var (
+		userCount           int64
+		ownerUserPercentage float64
+		notificationTimeout time.Duration
+		dialTimeout         time.Duration
+		noCleanup           bool
+
+		tracingFlags = &scaletestTracingFlags{}
+
+		// This test requires unlimited concurrency.
+		timeoutStrategy = &timeoutFlags{}
+		cleanupStrategy = newScaletestCleanupStrategy()
+		output          = &scaletestOutputFlags{}
+		prometheusFlags = &scaletestPrometheusFlags{}
+	)
+
+	cmd := &serpent.Command{
+		Use:   "notifications",
+		Short: "Simulate notification delivery by creating many users listening to notifications.",
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return err
+			}
+
+			notifyCtx, stop := signal.NotifyContext(ctx, StopSignals...)
+			defer stop()
+			ctx = notifyCtx
+
+			me, err := requireAdmin(ctx, client)
+			if err != nil {
+				return err
+			}
+
+			client.HTTPClient = &http.Client{
+				Transport: &codersdk.HeaderTransport{
+					Transport: http.DefaultTransport,
+					Header: map[string][]string{
+						codersdk.BypassRatelimitHeader: {"true"},
+					},
+				},
+			}
+
+			if userCount <= 0 {
+				return xerrors.Errorf("--user-count must be greater than 0")
+			}
+
+			if ownerUserPercentage < 0 || ownerUserPercentage > 100 {
+				return xerrors.Errorf("--owner-user-percentage must be between 0 and 100")
+			}
+
+			ownerUserCount := int64(float64(userCount) * ownerUserPercentage / 100)
+			if ownerUserCount == 0 && ownerUserPercentage > 0 {
+				ownerUserCount = 1
+			}
+			regularUserCount := userCount - ownerUserCount
+
+			_, _ = fmt.Fprintf(inv.Stderr, "Distribution plan:\n")
+			_, _ = fmt.Fprintf(inv.Stderr, "  Total users: %d\n", userCount)
+			_, _ = fmt.Fprintf(inv.Stderr, "  Owner users: %d (%.1f%%)\n", ownerUserCount, ownerUserPercentage)
+			_, _ = fmt.Fprintf(inv.Stderr, "  Regular users: %d (%.1f%%)\n", regularUserCount, 100.0-ownerUserPercentage)
+
+			outputs, err := output.parse()
+			if err != nil {
+				return xerrors.Errorf("could not parse --output flags")
+			}
+
+			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
+			if err != nil {
+				return xerrors.Errorf("create tracer provider: %w", err)
+			}
+			tracer := tracerProvider.Tracer(scaletestTracerName)
+
+			reg := prometheus.NewRegistry()
+			metrics := notifications.NewMetrics(reg)
+
+			logger := inv.Logger
+			prometheusSrvClose := ServeHandler(ctx, logger, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}), prometheusFlags.Address, "prometheus")
+			defer prometheusSrvClose()
+
+			defer func() {
+				_, _ = fmt.Fprintln(inv.Stderr, "\nUploading traces...")
+				if err := closeTracing(ctx); err != nil {
+					_, _ = fmt.Fprintf(inv.Stderr, "\nError uploading traces: %+v\n", err)
+				}
+				// Wait for prometheus metrics to be scraped
+				_, _ = fmt.Fprintf(inv.Stderr, "Waiting %s for prometheus metrics to be scraped\n", prometheusFlags.Wait)
+				<-time.After(prometheusFlags.Wait)
+			}()
+
+			_, _ = fmt.Fprintln(inv.Stderr, "Creating users...")
+
+			dialBarrier := &sync.WaitGroup{}
+			ownerWatchBarrier := &sync.WaitGroup{}
+			dialBarrier.Add(int(userCount))
+			ownerWatchBarrier.Add(int(ownerUserCount))
+
+			expectedNotifications := map[uuid.UUID]chan time.Time{
+				notificationsLib.TemplateUserAccountCreated: make(chan time.Time, 1),
+				notificationsLib.TemplateUserAccountDeleted: make(chan time.Time, 1),
+			}
+
+			configs := make([]notifications.Config, 0, userCount)
+			for range ownerUserCount {
+				config := notifications.Config{
+					User: createusers.Config{
+						OrganizationID: me.OrganizationIDs[0],
+					},
+					Roles:                 []string{codersdk.RoleOwner},
+					NotificationTimeout:   notificationTimeout,
+					DialTimeout:           dialTimeout,
+					DialBarrier:           dialBarrier,
+					ReceivingWatchBarrier: ownerWatchBarrier,
+					ExpectedNotifications: expectedNotifications,
+					Metrics:               metrics,
+				}
+				if err := config.Validate(); err != nil {
+					return xerrors.Errorf("validate config: %w", err)
+				}
+				configs = append(configs, config)
+			}
+			for range regularUserCount {
+				config := notifications.Config{
+					User: createusers.Config{
+						OrganizationID: me.OrganizationIDs[0],
+					},
+					Roles:                 []string{},
+					NotificationTimeout:   notificationTimeout,
+					DialTimeout:           dialTimeout,
+					DialBarrier:           dialBarrier,
+					ReceivingWatchBarrier: ownerWatchBarrier,
+					Metrics:               metrics,
+				}
+				if err := config.Validate(); err != nil {
+					return xerrors.Errorf("validate config: %w", err)
+				}
+				configs = append(configs, config)
+			}
+
+			go triggerUserNotifications(
+				ctx,
+				logger,
+				client,
+				me.OrganizationIDs[0],
+				dialBarrier,
+				dialTimeout,
+				expectedNotifications,
+			)
+
+			th := harness.NewTestHarness(timeoutStrategy.wrapStrategy(harness.ConcurrentExecutionStrategy{}), cleanupStrategy.toStrategy())
+
+			for i, config := range configs {
+				id := strconv.Itoa(i)
+				name := fmt.Sprintf("notifications-%s", id)
+				var runner harness.Runnable = notifications.NewRunner(client, config)
+				if tracingEnabled {
+					runner = &runnableTraceWrapper{
+						tracer:   tracer,
+						spanName: name,
+						runner:   runner,
+					}
+				}
+
+				th.AddRun(name, id, runner)
+			}
+
+			_, _ = fmt.Fprintln(inv.Stderr, "Running notification delivery scaletest...")
+			testCtx, testCancel := timeoutStrategy.toContext(ctx)
+			defer testCancel()
+			err = th.Run(testCtx)
+			if err != nil {
+				return xerrors.Errorf("run test harness (harness failure, not a test failure): %w", err)
+			}
+
+			// If the command was interrupted, skip stats.
+			if notifyCtx.Err() != nil {
+				return notifyCtx.Err()
+			}
+
+			res := th.Results()
+			for _, o := range outputs {
+				err = o.write(res, inv.Stdout)
+				if err != nil {
+					return xerrors.Errorf("write output %q to %q: %w", o.format, o.path, err)
+				}
+			}
+
+			if !noCleanup {
+				_, _ = fmt.Fprintln(inv.Stderr, "\nCleaning up...")
+				cleanupCtx, cleanupCancel := cleanupStrategy.toContext(ctx)
+				defer cleanupCancel()
+				err = th.Cleanup(cleanupCtx)
+				if err != nil {
+					return xerrors.Errorf("cleanup tests: %w", err)
+				}
+			}
+
+			if res.TotalFail > 0 {
+				return xerrors.New("load test failed, see above for more details")
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Options = serpent.OptionSet{
+		{
+			Flag:          "user-count",
+			FlagShorthand: "c",
+			Env:           "CODER_SCALETEST_NOTIFICATION_USER_COUNT",
+			Description:   "Required: Total number of users to create.",
+			Value:         serpent.Int64Of(&userCount),
+			Required:      true,
+		},
+		{
+			Flag:        "owner-user-percentage",
+			Env:         "CODER_SCALETEST_NOTIFICATION_OWNER_USER_PERCENTAGE",
+			Default:     "20.0",
+			Description: "Percentage of users to assign Owner role to (0-100).",
+			Value:       serpent.Float64Of(&ownerUserPercentage),
+		},
+		{
+			Flag:        "notification-timeout",
+			Env:         "CODER_SCALETEST_NOTIFICATION_TIMEOUT",
+			Default:     "5m",
+			Description: "How long to wait for notifications after triggering.",
+			Value:       serpent.DurationOf(&notificationTimeout),
+		},
+		{
+			Flag:        "dial-timeout",
+			Env:         "CODER_SCALETEST_DIAL_TIMEOUT",
+			Default:     "2m",
+			Description: "Timeout for dialing the notification websocket endpoint.",
+			Value:       serpent.DurationOf(&dialTimeout),
+		},
+		{
+			Flag:        "no-cleanup",
+			Env:         "CODER_SCALETEST_NO_CLEANUP",
+			Description: "Do not clean up resources after the test completes.",
+			Value:       serpent.BoolOf(&noCleanup),
+		},
+	}
+
+	tracingFlags.attach(&cmd.Options)
+	timeoutStrategy.attach(&cmd.Options)
+	cleanupStrategy.attach(&cmd.Options)
+	output.attach(&cmd.Options)
+	prometheusFlags.attach(&cmd.Options)
+	return cmd
+}
+
 type runnableTraceWrapper struct {
 	tracer   trace.Tracer
 	spanName string
@@ -2117,6 +2373,73 @@ func parseTargetRange(name, targets string) (start, end int, err error) {
 	return start, end, nil
 }
 
+// triggerUserNotifications waits for all test users to connect,
+// then creates and deletes a test user to trigger notification events for testing.
+func triggerUserNotifications(
+	ctx context.Context,
+	logger slog.Logger,
+	client *codersdk.Client,
+	orgID uuid.UUID,
+	dialBarrier *sync.WaitGroup,
+	dialTimeout time.Duration,
+	expectedNotifications map[uuid.UUID]chan time.Time,
+) {
+	logger.Info(ctx, "waiting for all users to connect")
+
+	// Wait for all users to connect
+	waitCtx, cancel := context.WithTimeout(ctx, dialTimeout+30*time.Second)
+	defer cancel()
+
+	done := make(chan struct{})
+	go func() {
+		dialBarrier.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		logger.Info(ctx, "all users connected")
+	case <-waitCtx.Done():
+		if waitCtx.Err() == context.DeadlineExceeded {
+			logger.Error(ctx, "timeout waiting for users to connect")
+		} else {
+			logger.Info(ctx, "context canceled while waiting for users")
+		}
+		return
+	}
+
+	const (
+		triggerUsername = "scaletest-trigger-user"
+		triggerEmail    = "scaletest-trigger@example.com"
+	)
+
+	logger.Info(ctx, "creating test user to test notifications",
+		slog.F("username", triggerUsername),
+		slog.F("email", triggerEmail),
+		slog.F("org_id", orgID))
+
+	testUser, err := client.CreateUserWithOrgs(ctx, codersdk.CreateUserRequestWithOrgs{
+		OrganizationIDs: []uuid.UUID{orgID},
+		Username:        triggerUsername,
+		Email:           triggerEmail,
+		Password:        "test-password-123",
+	})
+	if err != nil {
+		logger.Error(ctx, "create test user", slog.Error(err))
+		return
+	}
+	expectedNotifications[notificationsLib.TemplateUserAccountCreated] <- time.Now()
+
+	err = client.DeleteUser(ctx, testUser.ID)
+	if err != nil {
+		logger.Error(ctx, "delete test user", slog.Error(err))
+		return
+	}
+	expectedNotifications[notificationsLib.TemplateUserAccountDeleted] <- time.Now()
+	close(expectedNotifications[notificationsLib.TemplateUserAccountCreated])
+	close(expectedNotifications[notificationsLib.TemplateUserAccountDeleted])
+}
+
 func createWorkspaceAppConfig(client *codersdk.Client, appHost, app string, workspace codersdk.Workspace, agent codersdk.WorkspaceAgent) (workspacetraffic.AppConfig, error) {
 	if app == "" {
 		return workspacetraffic.AppConfig{}, nil

From 6b72ef8b1806777db8768cba0b8e10b9119799fd Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Tue, 7 Oct 2025 11:32:44 +0100
Subject: [PATCH 072/298] chore(docs): update notifications documentation to
 include task events (#20190)

## Description

Update notifications documentation to include Task Events introduced in
PR: https://github.com/coder/coder/pull/19965
---
 docs/admin/monitoring/notifications/index.md | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/admin/monitoring/notifications/index.md b/docs/admin/monitoring/notifications/index.md
index e87a4dd1ac27d..b1461cfec58a6 100644
--- a/docs/admin/monitoring/notifications/index.md
+++ b/docs/admin/monitoring/notifications/index.md
@@ -14,6 +14,13 @@ user(s) of the event.
 
 Coder supports the following list of events:
 
+### Task Events
+
+These notifications are sent to the owner of the workspace where the task is running:
+
+- Task Idle
+- Task Working
+
 ### Template Events
 
 These notifications are sent to users with **template admin** roles:

From 057d7dacdc36cede265865c0282bfaf80e83f755 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Tue, 7 Oct 2025 16:10:38 +0300
Subject: [PATCH 073/298] chore(coderd/database/queries): remove trailing
 whitespace (#20192)

---
 coderd/database/queries.sql.go                | 32 +++++++++----------
 .../database/queries/provisionerdaemons.sql   |  2 +-
 .../database/queries/provisionerjoblogs.sql   | 16 +++++-----
 coderd/database/queries/provisionerkeys.sql   |  6 ++--
 coderd/database/queries/testadmin.sql         | 10 +++---
 .../database/queries/workspaceagentstats.sql  |  2 +-
 6 files changed, 34 insertions(+), 34 deletions(-)

diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 3612375b8b26c..605db1cffe777 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -8966,7 +8966,7 @@ WHERE
 	-- Filter by max age if provided
 	AND (
 		$7::bigint IS NULL
-		OR pd.last_seen_at IS NULL 
+		OR pd.last_seen_at IS NULL
 		OR pd.last_seen_at >= (NOW() - ($7::bigint || ' ms')::interval)
 	)
 	AND (
@@ -9291,11 +9291,11 @@ func (q *sqlQuerier) InsertProvisionerJobLogs(ctx context.Context, arg InsertPro
 }
 
 const updateProvisionerJobLogsLength = `-- name: UpdateProvisionerJobLogsLength :exec
-UPDATE 
+UPDATE
 	provisioner_jobs
-SET 
+SET
 	logs_length = logs_length + $2
-WHERE 
+WHERE
 	id = $1
 `
 
@@ -9310,11 +9310,11 @@ func (q *sqlQuerier) UpdateProvisionerJobLogsLength(ctx context.Context, arg Upd
 }
 
 const updateProvisionerJobLogsOverflowed = `-- name: UpdateProvisionerJobLogsOverflowed :exec
-UPDATE 
+UPDATE
 	provisioner_jobs
-SET 
+SET
 	logs_overflowed = $2
-WHERE 
+WHERE
 	id = $1
 `
 
@@ -10376,7 +10376,7 @@ FROM
     provisioner_keys
 WHERE
     organization_id = $1
-AND 
+AND
     lower(name) = lower($2)
 `
 
@@ -10492,10 +10492,10 @@ WHERE
 AND
     -- exclude reserved built-in key
     id != '00000000-0000-0000-0000-000000000001'::uuid
-AND 
+AND
     -- exclude reserved user-auth key
     id != '00000000-0000-0000-0000-000000000002'::uuid
-AND 
+AND
     -- exclude reserved psk key
     id != '00000000-0000-0000-0000-000000000003'::uuid
 `
@@ -14289,14 +14289,14 @@ DO $$
 DECLARE
     table_record record;
 BEGIN
-    FOR table_record IN 
-        SELECT table_schema, table_name 
-        FROM information_schema.tables 
+    FOR table_record IN
+        SELECT table_schema, table_name
+        FROM information_schema.tables
         WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
         AND table_type = 'BASE TABLE'
     LOOP
-        EXECUTE format('ALTER TABLE %I.%I DISABLE TRIGGER ALL', 
-                    table_record.table_schema, 
+        EXECUTE format('ALTER TABLE %I.%I DISABLE TRIGGER ALL',
+                    table_record.table_schema,
                     table_record.table_name);
     END LOOP;
 END;
@@ -18281,7 +18281,7 @@ WITH agent_stats AS (
 		coalesce((PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY connection_median_latency_ms)), -1)::FLOAT AS workspace_connection_latency_95
 	 FROM workspace_agent_stats
 	-- The greater than 0 is to support legacy agents that don't report connection_median_latency_ms.
-	WHERE workspace_agent_stats.created_at > $1 AND connection_median_latency_ms > 0 
+	WHERE workspace_agent_stats.created_at > $1 AND connection_median_latency_ms > 0
 	GROUP BY user_id, agent_id, workspace_id, template_id
 ), latest_agent_stats AS (
 	SELECT
diff --git a/coderd/database/queries/provisionerdaemons.sql b/coderd/database/queries/provisionerdaemons.sql
index ad6c0948eb448..03997c504cb1a 100644
--- a/coderd/database/queries/provisionerdaemons.sql
+++ b/coderd/database/queries/provisionerdaemons.sql
@@ -113,7 +113,7 @@ WHERE
 	-- Filter by max age if provided
 	AND (
 		sqlc.narg('max_age_ms')::bigint IS NULL
-		OR pd.last_seen_at IS NULL 
+		OR pd.last_seen_at IS NULL
 		OR pd.last_seen_at >= (NOW() - (sqlc.narg('max_age_ms')::bigint || ' ms')::interval)
 	)
 	AND (
diff --git a/coderd/database/queries/provisionerjoblogs.sql b/coderd/database/queries/provisionerjoblogs.sql
index c0ef188bdd382..14b9ccda9b1ff 100644
--- a/coderd/database/queries/provisionerjoblogs.sql
+++ b/coderd/database/queries/provisionerjoblogs.sql
@@ -19,19 +19,19 @@ SELECT
 	unnest(@level :: log_level [ ]) AS LEVEL,
 	unnest(@stage :: VARCHAR(128) [ ]) AS stage,
 	unnest(@output :: VARCHAR(1024) [ ]) AS output RETURNING *;
-	
+
 -- name: UpdateProvisionerJobLogsOverflowed :exec
-UPDATE 
+UPDATE
 	provisioner_jobs
-SET 
+SET
 	logs_overflowed = $2
-WHERE 
+WHERE
 	id = $1;
-	
+
 -- name: UpdateProvisionerJobLogsLength :exec
-UPDATE 
+UPDATE
 	provisioner_jobs
-SET 
+SET
 	logs_length = logs_length + $2
-WHERE 
+WHERE
 	id = $1;
diff --git a/coderd/database/queries/provisionerkeys.sql b/coderd/database/queries/provisionerkeys.sql
index 3fb05a8d0f613..0bf95069ddfe6 100644
--- a/coderd/database/queries/provisionerkeys.sql
+++ b/coderd/database/queries/provisionerkeys.sql
@@ -34,7 +34,7 @@ FROM
     provisioner_keys
 WHERE
     organization_id = $1
-AND 
+AND
     lower(name) = lower(@name);
 
 -- name: ListProvisionerKeysByOrganizationExcludeReserved :many
@@ -47,10 +47,10 @@ WHERE
 AND
     -- exclude reserved built-in key
     id != '00000000-0000-0000-0000-000000000001'::uuid
-AND 
+AND
     -- exclude reserved user-auth key
     id != '00000000-0000-0000-0000-000000000002'::uuid
-AND 
+AND
     -- exclude reserved psk key
     id != '00000000-0000-0000-0000-000000000003'::uuid;
 
diff --git a/coderd/database/queries/testadmin.sql b/coderd/database/queries/testadmin.sql
index 77d39ce52768c..9cbaf67d2273c 100644
--- a/coderd/database/queries/testadmin.sql
+++ b/coderd/database/queries/testadmin.sql
@@ -6,14 +6,14 @@ DO $$
 DECLARE
     table_record record;
 BEGIN
-    FOR table_record IN 
-        SELECT table_schema, table_name 
-        FROM information_schema.tables 
+    FOR table_record IN
+        SELECT table_schema, table_name
+        FROM information_schema.tables
         WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
         AND table_type = 'BASE TABLE'
     LOOP
-        EXECUTE format('ALTER TABLE %I.%I DISABLE TRIGGER ALL', 
-                    table_record.table_schema, 
+        EXECUTE format('ALTER TABLE %I.%I DISABLE TRIGGER ALL',
+                    table_record.table_schema,
                     table_record.table_name);
     END LOOP;
 END;
diff --git a/coderd/database/queries/workspaceagentstats.sql b/coderd/database/queries/workspaceagentstats.sql
index f2f2bdbe2824e..9c49b281f6e87 100644
--- a/coderd/database/queries/workspaceagentstats.sql
+++ b/coderd/database/queries/workspaceagentstats.sql
@@ -189,7 +189,7 @@ WITH agent_stats AS (
 		coalesce((PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY connection_median_latency_ms)), -1)::FLOAT AS workspace_connection_latency_95
 	 FROM workspace_agent_stats
 	-- The greater than 0 is to support legacy agents that don't report connection_median_latency_ms.
-	WHERE workspace_agent_stats.created_at > $1 AND connection_median_latency_ms > 0 
+	WHERE workspace_agent_stats.created_at > $1 AND connection_median_latency_ms > 0
 	GROUP BY user_id, agent_id, workspace_id, template_id
 ), latest_agent_stats AS (
 	SELECT

From 0e0f0925e410a4e700d5eb6f3aaeffda656569b3 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Wed, 8 Oct 2025 00:48:17 +1100
Subject: [PATCH 074/298] fix: use raw SVG for logo on static error page
 (#20189)

Relates to #20185, #20029, #18878
---
 site/static/error.html | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/site/static/error.html b/site/static/error.html
index d5ea5ab9dd790..405ee59d48b60 100644
--- a/site/static/error.html
+++ b/site/static/error.html
@@ -1,6 +1,12 @@
-{{/* This template is used by application handlers to render friendly error
-pages when there is a proxy error (for example, when the target app isn't
-running). */}}
+{{/*
+  This template is used by application handlers to render friendly error pages
+  when there is a proxy error (for example, when the target app isn't running).
+
+  Since it is served from subdomains, both on proxies and the primary, it MUST
+  NOT access any external resources. It must be entirely self-contained. This
+  includes anything in `/static` or `/icon`, as these are not served from
+  subdomains.
+*/}}
 <!doctype html>
 <html lang="en">
   <head>
@@ -119,7 +125,18 @@
   </head>
   <body>
     <div class="container">
-      <img class="coder-svg" src="/icon/coder.svg" alt="Coder" />
+      {{/*
+        DO NOT LOAD AN EXTERNAL IMAGE HERE. See the comment at the top of
+        this file for more details.
+      */}}
+      <svg
+        class="coder-svg"
+        viewBox="0 0 66 48"
+        fill="none"
+        xmlns="http://www.w3.org/2000/svg"
+      >
+        <path d="M18.996 7C29.9934 7.00003 36.1588 12.5745 36.3671 20.7799L26.8691 21.0919C26.6191 16.5433 22.8492 13.5554 18.996 13.6445C13.7055 13.756 9.78938 17.5243 9.78934 23.5C9.78934 29.4757 13.7054 33.1773 18.996 33.1773C22.8492 33.177 26.5357 30.323 26.9524 25.7743L36.4503 25.9974C36.2004 34.3365 29.6602 40 18.996 40C8.33164 40 0 33.5338 0 23.5C3.90577e-05 13.4216 7.9984 7 18.996 7ZM66 7.97504V39.1914H41.0058V7.97504H66Z" fill="white" />
+      </svg>
 
       <h1>
         {{- if not .Error.HideStatus }}{{ .Error.Status }} - {{end}}{{

From 65335bc7d437ba54bd1d48d71bdfd850eb9b470f Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Tue, 7 Oct 2025 21:53:59 +0400
Subject: [PATCH 075/298] feat: add cli command scaletest dynamic-parameters
 (#20034)

part of https://github.com/coder/internal/issues/912

Adds CLI command `coder exp scaletest dynamic-parameters`

I've left out the configuration of tracing and timeouts for now. I think I want to do some refactoring of the scaletest CLI to make handling those flags take up less boiler plate.

I will add tracing and timeout flags in a follow up PR.
---
 cli/exp_scaletest.go                          |   1 +
 cli/exp_scaletest_dynamicparameters.go        | 110 +++++++
 codersdk/client.go                            |  10 +
 scaletest/dynamicparameters/config.go         |   1 -
 scaletest/dynamicparameters/run.go            |   6 +-
 scaletest/dynamicparameters/run_test.go       |   1 -
 scaletest/dynamicparameters/template.go       | 285 +++++++++++++++++
 .../template_internal_test.go                 | 293 ++++++++++++++++++
 8 files changed, 700 insertions(+), 7 deletions(-)
 create mode 100644 cli/exp_scaletest_dynamicparameters.go
 create mode 100644 scaletest/dynamicparameters/template_internal_test.go

diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index 126a0527dfa01..fc21d47fdb7c7 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -60,6 +60,7 @@ func (r *RootCmd) scaletestCmd() *serpent.Command {
 		Children: []*serpent.Command{
 			r.scaletestCleanup(),
 			r.scaletestDashboard(),
+			r.scaletestDynamicParameters(),
 			r.scaletestCreateWorkspaces(),
 			r.scaletestWorkspaceUpdates(),
 			r.scaletestWorkspaceTraffic(),
diff --git a/cli/exp_scaletest_dynamicparameters.go b/cli/exp_scaletest_dynamicparameters.go
new file mode 100644
index 0000000000000..fc0b949c9106e
--- /dev/null
+++ b/cli/exp_scaletest_dynamicparameters.go
@@ -0,0 +1,110 @@
+//go:build !slim
+
+package cli
+
+import (
+	"fmt"
+
+	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+
+	"github.com/coder/coder/v2/scaletest/dynamicparameters"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/serpent"
+)
+
+const (
+	dynamicParametersTestName = "dynamic-parameters"
+)
+
+func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
+	var templateName string
+	var numEvals int64
+	orgContext := NewOrganizationContext()
+	output := &scaletestOutputFlags{}
+
+	cmd := &serpent.Command{
+		Use:   "dynamic-parameters",
+		Short: "Generates load on the Coder server evaluating dynamic parameters",
+		Long:  `It is recommended that all rate limits are disabled on the server before running this scaletest. This test generates many login events which will be rate limited against the (most likely single) IP.`,
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+
+			outputs, err := output.parse()
+			if err != nil {
+				return xerrors.Errorf("could not parse --output flags")
+			}
+
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return err
+			}
+			if templateName == "" {
+				return xerrors.Errorf("template cannot be empty")
+			}
+
+			org, err := orgContext.Selected(inv, client)
+			if err != nil {
+				return err
+			}
+
+			logger := slog.Make(sloghuman.Sink(inv.Stdout)).Leveled(slog.LevelDebug)
+			partitions, err := dynamicparameters.SetupPartitions(ctx, client, org.ID, templateName, numEvals, logger)
+			if err != nil {
+				return xerrors.Errorf("setup dynamic parameters partitions: %w", err)
+			}
+
+			th := harness.NewTestHarness(harness.ConcurrentExecutionStrategy{}, harness.ConcurrentExecutionStrategy{})
+			reg := prometheus.NewRegistry()
+			metrics := dynamicparameters.NewMetrics(reg, "concurrent_evaluations")
+
+			for i, part := range partitions {
+				for j := range part.ConcurrentEvaluations {
+					cfg := dynamicparameters.Config{
+						TemplateVersion:   part.TemplateVersion.ID,
+						Metrics:           metrics,
+						MetricLabelValues: []string{fmt.Sprintf("%d", part.ConcurrentEvaluations)},
+					}
+					runner := dynamicparameters.NewRunner(client, cfg)
+					th.AddRun(dynamicParametersTestName, fmt.Sprintf("%d/%d", j, i), runner)
+				}
+			}
+
+			err = th.Run(ctx)
+			if err != nil {
+				return xerrors.Errorf("run test harness: %w", err)
+			}
+
+			res := th.Results()
+			for _, o := range outputs {
+				err = o.write(res, inv.Stdout)
+				if err != nil {
+					return xerrors.Errorf("write output %q to %q: %w", o.format, o.path, err)
+				}
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Options = serpent.OptionSet{
+		{
+			Flag:        "template",
+			Description: "Name of the template to use. If it does not exist, it will be created.",
+			Default:     "scaletest-dynamic-parameters",
+			Value:       serpent.StringOf(&templateName),
+		},
+		{
+			Flag:        "concurrent-evaluations",
+			Description: "Number of concurrent dynamic parameter evaluations to perform.",
+			Default:     "100",
+			Value:       serpent.Int64Of(&numEvals),
+		},
+	}
+	orgContext.AttachOptions(cmd)
+	output.attach(&cmd.Options)
+	return cmd
+}
diff --git a/codersdk/client.go b/codersdk/client.go
index e71703c751963..42ad51286f181 100644
--- a/codersdk/client.go
+++ b/codersdk/client.go
@@ -519,6 +519,16 @@ func (e *Error) Error() string {
 	return builder.String()
 }
 
+// NewTestError is a helper function to create a Error, setting the internal fields. It's generally only useful for
+// testing.
+func NewTestError(statusCode int, method string, u string) *Error {
+	return &Error{
+		statusCode: statusCode,
+		method:     method,
+		url:        u,
+	}
+}
+
 type closeFunc func() error
 
 func (c closeFunc) Close() error {
diff --git a/scaletest/dynamicparameters/config.go b/scaletest/dynamicparameters/config.go
index 176b1245b23b1..5bd10f1b25a70 100644
--- a/scaletest/dynamicparameters/config.go
+++ b/scaletest/dynamicparameters/config.go
@@ -4,7 +4,6 @@ import "github.com/google/uuid"
 
 type Config struct {
 	TemplateVersion   uuid.UUID `json:"template_version"`
-	SessionToken      string    `json:"session_token"`
 	Metrics           *Metrics  `json:"-"`
 	MetricLabelValues []string  `json:"metric_label_values"`
 }
diff --git a/scaletest/dynamicparameters/run.go b/scaletest/dynamicparameters/run.go
index cec482bb4129d..12dd4099817e6 100644
--- a/scaletest/dynamicparameters/run.go
+++ b/scaletest/dynamicparameters/run.go
@@ -22,12 +22,8 @@ type Runner struct {
 var _ harness.Runnable = &Runner{}
 
 func NewRunner(client *codersdk.Client, cfg Config) *Runner {
-	clone := codersdk.New(client.URL)
-	clone.HTTPClient = client.HTTPClient
-	clone.SetLogger(client.Logger())
-	clone.SetSessionToken(cfg.SessionToken)
 	return &Runner{
-		client: clone,
+		client: client,
 		cfg:    cfg,
 	}
 }
diff --git a/scaletest/dynamicparameters/run_test.go b/scaletest/dynamicparameters/run_test.go
index 57577d27434d7..2c280e5f960e3 100644
--- a/scaletest/dynamicparameters/run_test.go
+++ b/scaletest/dynamicparameters/run_test.go
@@ -37,7 +37,6 @@ func TestRun(t *testing.T) {
 	reg := prometheus.NewRegistry()
 	cfg := dynamicparameters.Config{
 		TemplateVersion:   version.ID,
-		SessionToken:      userClient.SessionToken(),
 		Metrics:           dynamicparameters.NewMetrics(reg, "template", "test_label_name"),
 		MetricLabelValues: []string{template.Name, "test_label_value"},
 	}
diff --git a/scaletest/dynamicparameters/template.go b/scaletest/dynamicparameters/template.go
index 464fba2f7f7cd..9e7d8bc97f867 100644
--- a/scaletest/dynamicparameters/template.go
+++ b/scaletest/dynamicparameters/template.go
@@ -1,14 +1,30 @@
 package dynamicparameters
 
 import (
+	"archive/tar"
+	"bytes"
+	"context"
 	_ "embed"
 	"encoding/json"
+	"fmt"
+	"io"
+	"path/filepath"
+	"slices"
 	"strings"
 	"text/template"
+	"time"
 
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/quartz"
 )
 
+var ErrNoProvisionersMatched = xerrors.New("no provisioners matched")
+
 //go:embed tf/main.tf
 var templateContent string
 
@@ -72,3 +88,272 @@ func GetModuleFiles() map[string][]byte {
 		".terraform/modules/modules.json": modulesJSONBytes,
 	}
 }
+
+func createTarFromFiles(files map[string][]byte) ([]byte, error) {
+	buf := new(bytes.Buffer)
+	writer := tar.NewWriter(buf)
+	dirs := []string{}
+	for name, content := range files {
+		// We need to add directories before any files that use them. But, we only need to do this
+		// once.
+		dir := filepath.Dir(name)
+		if dir != "." && !slices.Contains(dirs, dir) {
+			dirs = append(dirs, dir)
+			err := writer.WriteHeader(&tar.Header{
+				Name:     dir,
+				Mode:     0o755,
+				Typeflag: tar.TypeDir,
+			})
+			if err != nil {
+				return nil, err
+			}
+		}
+
+		err := writer.WriteHeader(&tar.Header{
+			Name: name,
+			Size: int64(len(content)),
+			Mode: 0o644,
+		})
+		if err != nil {
+			return nil, err
+		}
+
+		_, err = writer.Write(content)
+		if err != nil {
+			return nil, err
+		}
+	}
+	// `writer.Close()` function flushes the writer buffer, and adds extra padding to create a legal tarball.
+	err := writer.Close()
+	if err != nil {
+		return nil, err
+	}
+	return buf.Bytes(), nil
+}
+
+func TemplateTarData() ([]byte, error) {
+	mainTF, err := TemplateContent()
+	if err != nil {
+		return nil, xerrors.Errorf("failed to generate main.tf: %w", err)
+	}
+	moduleFiles := GetModuleFiles()
+
+	files := map[string][]byte{
+		"main.tf": []byte(mainTF),
+	}
+	for k, v := range moduleFiles {
+		files[k] = v
+	}
+	tarData, err := createTarFromFiles(files)
+	if err != nil {
+		return nil, xerrors.Errorf("failed to create tarball: %w", err)
+	}
+
+	return tarData, nil
+}
+
+type Partition struct {
+	TemplateVersion       codersdk.TemplateVersion
+	ConcurrentEvaluations int
+}
+
+type SDKForDynamicParametersSetup interface {
+	TemplateByName(ctx context.Context, orgID uuid.UUID, templateName string) (codersdk.Template, error)
+	CreateTemplate(ctx context.Context, orgID uuid.UUID, createReq codersdk.CreateTemplateRequest) (codersdk.Template, error)
+	CreateTemplateVersion(ctx context.Context, orgID uuid.UUID, createReq codersdk.CreateTemplateVersionRequest) (codersdk.TemplateVersion, error)
+	Upload(ctx context.Context, contentType string, reader io.Reader) (codersdk.UploadResponse, error)
+	TemplateVersion(ctx context.Context, versionID uuid.UUID) (codersdk.TemplateVersion, error)
+}
+
+// partitioner is an internal struct to hold context and arguments for partition setup
+// and to provide methods for all sub-steps.
+type partitioner struct {
+	ctx          context.Context
+	client       SDKForDynamicParametersSetup
+	orgID        uuid.UUID
+	templateName string
+	numEvals     int64
+	logger       slog.Logger
+
+	// for testing
+	clock quartz.Clock
+}
+
+func SetupPartitions(
+	ctx context.Context, client SDKForDynamicParametersSetup,
+	orgID uuid.UUID, templateName string, numEvals int64,
+	logger slog.Logger,
+) ([]Partition, error) {
+	p := &partitioner{
+		ctx:          ctx,
+		client:       client,
+		orgID:        orgID,
+		templateName: templateName,
+		numEvals:     numEvals,
+		logger:       logger,
+		clock:        quartz.NewReal(),
+	}
+	return p.run()
+}
+
+func (p *partitioner) run() ([]Partition, error) {
+	var (
+		err         error
+		coderError  *codersdk.Error
+		templ       codersdk.Template
+		tempVersion codersdk.TemplateVersion
+	)
+	templ, err = p.client.TemplateByName(p.ctx, p.orgID, p.templateName)
+	if xerrors.As(err, &coderError) && coderError.StatusCode() == 404 {
+		tempVersion, err = p.createTemplateVersion(uuid.Nil)
+		if err != nil {
+			return nil, xerrors.Errorf("failed to create template version: %w", err)
+		}
+		p.logger.Info(p.ctx, "created template version", slog.F("version_id", tempVersion.ID))
+		createReq := codersdk.CreateTemplateRequest{
+			Name:        p.templateName,
+			DisplayName: "Scaletest Dynamic Parameters",
+			Description: "`coder exp scaletest dynamic parameters test` template",
+			VersionID:   tempVersion.ID,
+		}
+		templ, err = p.client.CreateTemplate(p.ctx, p.orgID, createReq)
+		if err != nil {
+			return nil, xerrors.Errorf("failed to create template: %w", err)
+		}
+		p.logger.Info(p.ctx, "created template", slog.F("template_id", templ.ID), slog.F("name", p.templateName))
+	} else if err != nil {
+		return nil, xerrors.Errorf("failed to get template: %w", err)
+	}
+
+	// Partition the number into a list decreasing by half each time
+	evalParts := partitionEvaluations(int(p.numEvals))
+	p.logger.Info(p.ctx, "partitioned evaluations", slog.F("num_evals", p.numEvals), slog.F("eval_parts", evalParts))
+
+	// If tempVersion is not empty (i.e. we created it above), use it as the first version.
+	partitions := make([]Partition, 0, len(evalParts))
+	if tempVersion.ID != uuid.Nil {
+		partitions = append(partitions, Partition{
+			TemplateVersion:       tempVersion,
+			ConcurrentEvaluations: evalParts[0],
+		})
+		evalParts = evalParts[1:]
+	}
+
+	for _, num := range evalParts {
+		version, err := p.createTemplateVersion(templ.ID)
+		if err != nil {
+			return nil, xerrors.Errorf("failed to create template version: %w", err)
+		}
+		partitions = append(partitions, Partition{
+			TemplateVersion:       version,
+			ConcurrentEvaluations: num,
+		})
+		p.logger.Info(p.ctx, "created template version", slog.F("version_id", version.ID))
+	}
+
+	err = p.waitForTemplateVersionJobs(partitions)
+	if err != nil {
+		return nil, xerrors.Errorf("one or more template version jobs did not succeed: %w", err)
+	}
+	return partitions, nil
+}
+
+func (p *partitioner) createTemplateVersion(templateID uuid.UUID) (codersdk.TemplateVersion, error) {
+	tarData, err := TemplateTarData()
+	if err != nil {
+		return codersdk.TemplateVersion{}, xerrors.Errorf("failed to create template tarball: %w", err)
+	}
+
+	// Upload tarball
+	uploadResp, err := p.client.Upload(p.ctx, codersdk.ContentTypeTar, bytes.NewReader(tarData))
+	if err != nil {
+		return codersdk.TemplateVersion{}, xerrors.Errorf("failed to upload template tar: %w", err)
+	}
+
+	// Create template version
+	versionReq := codersdk.CreateTemplateVersionRequest{
+		TemplateID:    templateID,
+		FileID:        uploadResp.ID,
+		Message:       "Initial version for scaletest dynamic parameters",
+		StorageMethod: codersdk.ProvisionerStorageMethodFile,
+		Provisioner:   codersdk.ProvisionerTypeTerraform,
+	}
+	version, err := p.client.CreateTemplateVersion(p.ctx, p.orgID, versionReq)
+	if err != nil {
+		return codersdk.TemplateVersion{}, xerrors.Errorf("failed to create template version: %w", err)
+	}
+	if version.MatchedProvisioners != nil && version.MatchedProvisioners.Count == 0 {
+		return codersdk.TemplateVersion{}, ErrNoProvisionersMatched
+	}
+	return version, nil
+}
+
+func (p *partitioner) waitForTemplateVersionJobs(partitions []Partition) error {
+	const pollInterval = 2 * time.Second
+	done := xerrors.New("done")
+
+	pending := make(map[uuid.UUID]int)
+	for i, part := range partitions {
+		pending[part.TemplateVersion.ID] = i
+	}
+
+	tkr := p.clock.TickerFunc(p.ctx, pollInterval, func() error {
+		for versionID := range pending {
+			version, err := p.client.TemplateVersion(p.ctx, versionID)
+			if err != nil {
+				return xerrors.Errorf("failed to fetch template version %s: %w", versionID, err)
+			}
+			status := version.Job.Status
+			p.logger.Info(p.ctx, "polled template version job", slog.F("version_id", versionID), slog.F("status", status))
+			switch status {
+			case codersdk.ProvisionerJobSucceeded:
+				delete(pending, versionID)
+			case codersdk.ProvisionerJobPending, codersdk.ProvisionerJobRunning:
+				continue
+			default:
+				return ProvisionerJobUnexpectedStatusError{
+					TemplateVersionID: versionID,
+					Status:            status,
+					JobError:          version.Job.Error,
+				}
+			}
+		}
+		if len(pending) == 0 {
+			return done
+		}
+		return nil
+	}, "waitForTemplateVersionJobs")
+	err := tkr.Wait()
+	if xerrors.Is(err, done) {
+		return nil
+	}
+	return err
+}
+
+func partitionEvaluations(total int) []int {
+	var parts []int
+	remaining := total
+	for remaining > 0 {
+		next := remaining / 2
+		// round up
+		if next*2 != remaining {
+			next++
+		}
+		if next > remaining {
+			next = remaining
+		}
+		parts = append(parts, next)
+		remaining -= next
+	}
+	return parts
+}
+
+type ProvisionerJobUnexpectedStatusError struct {
+	TemplateVersionID uuid.UUID
+	Status            codersdk.ProvisionerJobStatus
+	JobError          string
+}
+
+func (e ProvisionerJobUnexpectedStatusError) Error() string {
+	return fmt.Sprintf("template version %s job in unexpected status %q, error '%s'", e.TemplateVersionID, e.Status, e.JobError)
+}
diff --git a/scaletest/dynamicparameters/template_internal_test.go b/scaletest/dynamicparameters/template_internal_test.go
new file mode 100644
index 0000000000000..0b000a4c74981
--- /dev/null
+++ b/scaletest/dynamicparameters/template_internal_test.go
@@ -0,0 +1,293 @@
+package dynamicparameters
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/quartz"
+)
+
+func TestPartitionEvaluations(t *testing.T) {
+	t.Parallel()
+	tests := []struct {
+		name     string
+		input    int
+		expected []int
+	}{
+		{
+			name:     "10",
+			input:    10,
+			expected: []int{5, 3, 1, 1},
+		},
+		{
+			name:     "11",
+			input:    11,
+			expected: []int{6, 3, 1, 1},
+		},
+		{
+			name:     "12",
+			input:    12,
+			expected: []int{6, 3, 2, 1},
+		},
+		{
+			name:     "600",
+			input:    600,
+			expected: []int{300, 150, 75, 38, 19, 9, 5, 2, 1, 1},
+		},
+	}
+
+	for _, tc := range tests {
+		tc := tc
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			got := partitionEvaluations(tc.input)
+			require.Equal(t, tc.expected, got)
+			total := 0
+			for _, v := range got {
+				total += v
+			}
+			require.Equal(t, tc.input, total)
+		})
+	}
+}
+
+func TestSetupPartitions_TemplateExists(t *testing.T) {
+	t.Parallel()
+	logger := testutil.Logger(t).Leveled(slog.LevelDebug)
+	ctx := testutil.Context(t, testutil.WaitShort)
+
+	orgID := uuid.New()
+	fClient := &fakeClient{
+		t:                        t,
+		expectedTemplateName:     "test-template",
+		expectedOrgID:            orgID,
+		matchedProvisioners:      1,
+		templateVersionJobStatus: codersdk.ProvisionerJobSucceeded,
+	}
+	mClock := quartz.NewMock(t)
+	trap := mClock.Trap().TickerFunc("waitForTemplateVersionJobs")
+	defer trap.Close()
+	uut := partitioner{
+		ctx:          ctx,
+		client:       fClient,
+		orgID:        orgID,
+		templateName: "test-template",
+		numEvals:     600,
+		logger:       logger,
+		clock:        mClock,
+	}
+	var partitions []Partition
+	errCh := make(chan error, 1)
+	go func() {
+		var err error
+		partitions, err = uut.run()
+		errCh <- err
+	}()
+	trap.MustWait(ctx).MustRelease(ctx)
+	mClock.Advance(time.Second * 2).MustWait(ctx)
+	err := testutil.RequireReceive(ctx, t, errCh)
+	require.NoError(t, err)
+	// 600 evaluations should be partitioned into 10 parts: []int{300, 150, 75, 38, 19, 9, 5, 2, 1, 1}
+	// c.f. TestPartitionEvaluations. That's 10 template versions and associated uploads.
+	require.Equal(t, 10, len(partitions))
+	require.Equal(t, 10, fClient.templateVersionsCount)
+	require.Equal(t, 10, fClient.uploadsCount)
+	require.Equal(t, 1, fClient.templateByNameCount)
+	require.Equal(t, 0, fClient.createTemplateCount)
+}
+
+func TestSetupPartitions_TemplateDoesntExist(t *testing.T) {
+	t.Parallel()
+	logger := testutil.Logger(t).Leveled(slog.LevelDebug)
+	ctx := testutil.Context(t, testutil.WaitShort)
+
+	orgID := uuid.New()
+	fClient := &fakeClient{
+		t:                        t,
+		expectedTemplateName:     "test-template",
+		expectedOrgID:            orgID,
+		templateByNameError:      codersdk.NewTestError(http.StatusNotFound, "", ""),
+		matchedProvisioners:      1,
+		templateVersionJobStatus: codersdk.ProvisionerJobSucceeded,
+	}
+	mClock := quartz.NewMock(t)
+	trap := mClock.Trap().TickerFunc("waitForTemplateVersionJobs")
+	defer trap.Close()
+	uut := partitioner{
+		ctx:          ctx,
+		client:       fClient,
+		orgID:        orgID,
+		templateName: "test-template",
+		numEvals:     600,
+		logger:       logger,
+		clock:        mClock,
+	}
+	var partitions []Partition
+	errCh := make(chan error, 1)
+	go func() {
+		var err error
+		partitions, err = uut.run()
+		errCh <- err
+	}()
+	trap.MustWait(ctx).MustRelease(ctx)
+	mClock.Advance(time.Second * 2).MustWait(ctx)
+	err := testutil.RequireReceive(ctx, t, errCh)
+	require.NoError(t, err)
+	// 600 evaluations should be partitioned into 10 parts: []int{300, 150, 75, 38, 19, 9, 5, 2, 1, 1}
+	// c.f. TestPartitionEvaluations. That's 10 template versions and associated uploads.
+	require.Equal(t, 10, len(partitions))
+	require.Equal(t, 10, fClient.templateVersionsCount)
+	require.Equal(t, 10, fClient.uploadsCount)
+	require.Equal(t, 1, fClient.templateByNameCount)
+	require.Equal(t, 1, fClient.createTemplateCount)
+}
+
+func TestSetupPartitions_NoMatchedProvisioners(t *testing.T) {
+	t.Parallel()
+	logger := testutil.Logger(t).Leveled(slog.LevelDebug)
+	ctx := testutil.Context(t, testutil.WaitShort)
+
+	orgID := uuid.New()
+	fClient := &fakeClient{
+		t:                        t,
+		expectedTemplateName:     "test-template",
+		expectedOrgID:            orgID,
+		matchedProvisioners:      0,
+		templateVersionJobStatus: codersdk.ProvisionerJobSucceeded,
+	}
+	mClock := quartz.NewMock(t)
+	uut := partitioner{
+		ctx:          ctx,
+		client:       fClient,
+		orgID:        orgID,
+		templateName: "test-template",
+		numEvals:     600,
+		logger:       logger,
+		clock:        mClock,
+	}
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := uut.run()
+		errCh <- err
+	}()
+	err := testutil.RequireReceive(ctx, t, errCh)
+	require.ErrorIs(t, err, ErrNoProvisionersMatched)
+	require.Equal(t, 1, fClient.templateVersionsCount)
+	require.Equal(t, 1, fClient.uploadsCount)
+	require.Equal(t, 1, fClient.templateByNameCount)
+	require.Equal(t, 0, fClient.createTemplateCount)
+}
+
+func TestSetupPartitions_JobFailed(t *testing.T) {
+	t.Parallel()
+	logger := testutil.Logger(t).Leveled(slog.LevelDebug)
+	ctx := testutil.Context(t, testutil.WaitShort)
+
+	orgID := uuid.New()
+	fClient := &fakeClient{
+		t:                        t,
+		expectedTemplateName:     "test-template",
+		expectedOrgID:            orgID,
+		matchedProvisioners:      1,
+		templateVersionJobStatus: codersdk.ProvisionerJobFailed,
+	}
+	mClock := quartz.NewMock(t)
+	trap := mClock.Trap().TickerFunc("waitForTemplateVersionJobs")
+	defer trap.Close()
+	uut := partitioner{
+		ctx:          ctx,
+		client:       fClient,
+		orgID:        orgID,
+		templateName: "test-template",
+		numEvals:     600,
+		logger:       logger,
+		clock:        mClock,
+	}
+	errCh := make(chan error, 1)
+	go func() {
+		_, err := uut.run()
+		errCh <- err
+	}()
+	trap.MustWait(ctx).MustRelease(ctx)
+	mClock.Advance(time.Second * 2).MustWait(ctx)
+	err := testutil.RequireReceive(ctx, t, errCh)
+	require.ErrorAs(t, err, &ProvisionerJobUnexpectedStatusError{})
+	require.Equal(t, 10, fClient.templateVersionsCount)
+	require.Equal(t, 10, fClient.uploadsCount)
+	require.Equal(t, 1, fClient.templateByNameCount)
+	require.Equal(t, 0, fClient.createTemplateCount)
+}
+
+type fakeClient struct {
+	t testing.TB
+
+	expectedTemplateName string
+	expectedOrgID        uuid.UUID
+	templateByNameError  error
+
+	matchedProvisioners      int
+	templateVersionJobStatus codersdk.ProvisionerJobStatus
+
+	createTemplateCount   int
+	templateVersionsCount int
+	uploadsCount          int
+	templateByNameCount   int
+}
+
+func (f *fakeClient) TemplateByName(ctx context.Context, orgID uuid.UUID, templateName string) (codersdk.Template, error) {
+	f.templateByNameCount++
+	require.Equal(f.t, f.expectedOrgID, orgID)
+	require.Equal(f.t, f.expectedTemplateName, templateName)
+
+	if f.templateByNameError != nil {
+		return codersdk.Template{}, f.templateByNameError
+	}
+	return codersdk.Template{
+		ID:   uuid.New(),
+		Name: f.expectedTemplateName,
+	}, nil
+}
+
+func (f *fakeClient) CreateTemplate(ctx context.Context, orgID uuid.UUID, createReq codersdk.CreateTemplateRequest) (codersdk.Template, error) {
+	f.createTemplateCount++
+	require.Equal(f.t, f.expectedOrgID, orgID)
+	require.Equal(f.t, f.expectedTemplateName, createReq.Name)
+
+	return codersdk.Template{
+		ID:   uuid.New(),
+		Name: f.expectedTemplateName,
+	}, nil
+}
+
+func (f *fakeClient) CreateTemplateVersion(ctx context.Context, orgID uuid.UUID, createReq codersdk.CreateTemplateVersionRequest) (codersdk.TemplateVersion, error) {
+	f.templateVersionsCount++
+	return codersdk.TemplateVersion{
+		ID:                  uuid.New(),
+		Name:                f.expectedTemplateName,
+		MatchedProvisioners: &codersdk.MatchedProvisioners{Count: f.matchedProvisioners},
+	}, nil
+}
+
+func (f *fakeClient) Upload(ctx context.Context, contentType string, reader io.Reader) (codersdk.UploadResponse, error) {
+	f.uploadsCount++
+	return codersdk.UploadResponse{
+		ID: uuid.New(),
+	}, nil
+}
+
+func (f *fakeClient) TemplateVersion(ctx context.Context, versionID uuid.UUID) (codersdk.TemplateVersion, error) {
+	return codersdk.TemplateVersion{
+		ID:                  versionID,
+		Job:                 codersdk.ProvisionerJob{Status: f.templateVersionJobStatus},
+		MatchedProvisioners: &codersdk.MatchedProvisioners{Count: f.matchedProvisioners},
+	}, nil
+}

From be22c38161698f3269172179f9ee5cc6ea918b44 Mon Sep 17 00:00:00 2001
From: david-fraley <67079030+david-fraley@users.noreply.github.com>
Date: Tue, 7 Oct 2025 15:46:47 -0500
Subject: [PATCH 076/298] docs: update release versions in docs (#20196)

---
 docs/install/kubernetes.md     |  8 ++++----
 docs/install/rancher.md        |  4 ++--
 docs/install/releases/index.md | 12 ++++++------
 3 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md
index 5cab1a2350e2d..61ccf0a668dda 100644
--- a/docs/install/kubernetes.md
+++ b/docs/install/kubernetes.md
@@ -136,7 +136,7 @@ We support two release channels: mainline and stable - read the
     helm install coder coder-v2/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.26.0
+        --version 2.27.0
     ```
 
   - **OCI Registry**
@@ -147,7 +147,7 @@ We support two release channels: mainline and stable - read the
     helm install coder oci://ghcr.io/coder/chart/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.26.0
+        --version 2.27.0
     ```
 
 - **Stable** Coder release:
@@ -160,7 +160,7 @@ We support two release channels: mainline and stable - read the
     helm install coder coder-v2/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.25.2
+        --version 2.26.1
     ```
 
   - **OCI Registry**
@@ -171,7 +171,7 @@ We support two release channels: mainline and stable - read the
     helm install coder oci://ghcr.io/coder/chart/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.25.2
+        --version 2.26.1
     ```
 
 You can watch Coder start up by running `kubectl get pods -n coder`. Once Coder
diff --git a/docs/install/rancher.md b/docs/install/rancher.md
index 7a5c95f017a94..20e73f0a86940 100644
--- a/docs/install/rancher.md
+++ b/docs/install/rancher.md
@@ -134,8 +134,8 @@ kubectl create secret generic coder-db-url -n coder \
 
 1. Select a Coder version:
 
-   - **Mainline**: `2.20.x`
-   - **Stable**: `2.19.x`
+   - **Mainline**: `2.27.0`
+   - **Stable**: `2.26.1`
 
    Learn more about release channels in the [Releases documentation](./releases/index.md).
 
diff --git a/docs/install/releases/index.md b/docs/install/releases/index.md
index 2a8ef1d704273..2b7b985076562 100644
--- a/docs/install/releases/index.md
+++ b/docs/install/releases/index.md
@@ -57,13 +57,13 @@ pages.
 <!-- RELEASE_CALENDAR_START -->
 | Release name                                   | Release Date       | Status           | Latest Release                                                 |
 |------------------------------------------------|--------------------|------------------|----------------------------------------------------------------|
-| [2.21](https://coder.com/changelog/coder-2-21) | April 02, 2025     | Not Supported    | [v2.21.3](https://github.com/coder/coder/releases/tag/v2.21.3) |
 | [2.22](https://coder.com/changelog/coder-2-22) | May 16, 2025       | Not Supported    | [v2.22.1](https://github.com/coder/coder/releases/tag/v2.22.1) |
-| [2.23](https://coder.com/changelog/coder-2-23) | June 03, 2025      | Security Support | [v2.23.2](https://github.com/coder/coder/releases/tag/v2.23.4) |
-| [2.24](https://coder.com/changelog/coder-2-24) | August 07, 2025    | Security Support | [v2.24.3](https://github.com/coder/coder/releases/tag/v2.24.3) |
-| [2.25](https://coder.com/changelog/coder-2-25) | September 04, 2025 | Stable           | [v2.25.2](https://github.com/coder/coder/releases/tag/v2.25.2) |
-| [2.26](https://coder.com/changelog/coder-2-26) | September 02, 2025 | Mainline         | [v2.26.0](https://github.com/coder/coder/releases/tag/v2.26.0) |
-| 2.27                                           | October 07, 2025   | Not Released     | N/A                                                            |
+| [2.23](https://coder.com/changelog/coder-2-23) | June 03, 2025      | Not Supported    | [v2.23.5](https://github.com/coder/coder/releases/tag/v2.23.5) |
+| [2.24](https://coder.com/changelog/coder-2-24) | July 01, 2025      | Not Supported    | [v2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4) |
+| [2.25](https://coder.com/changelog/coder-2-25) | August 05, 2025    | Security Support | [v2.25.3](https://github.com/coder/coder/releases/tag/v2.25.3) |
+| [2.26](https://coder.com/changelog/coder-2-26) | September 03, 2025 | Stable           | [v2.26.1](https://github.com/coder/coder/releases/tag/v2.26.1) |
+| [2.27](https://coder.com/changelog/coder-2-27) | October 02, 2025   | Mainline         | [v2.27.0](https://github.com/coder/coder/releases/tag/v2.27.0) |
+| 2.28                                           |                    | Not Released     | N/A                                                            |
 <!-- RELEASE_CALENDAR_END -->
 
 > [!TIP]

From d0f434b6723d8bf35ba98c691abdc1db282f237b Mon Sep 17 00:00:00 2001
From: Stephen Kirby <58410745+stirby@users.noreply.github.com>
Date: Tue, 7 Oct 2025 22:36:05 -0500
Subject: [PATCH 077/298] feat(docs): add bridge documentation for early access
 (#20188)

---
 docs/ai-coder/ai-bridge.md                    |  268 ++++
 docs/images/aibridge/aibridge_diagram.png     |  Bin 0 -> 183745 bytes
 .../aibridge/grafana_user_leaderboard.png     |  Bin 0 -> 51915 bytes
 .../aibridge/grafana_user_prompts_logging.png |  Bin 0 -> 222102 bytes
 docs/manifest.json                            |    7 +
 .../dashboards/grafana/aibridge/README.md     |   39 +
 .../grafana/aibridge/dashboard.json           | 1411 +++++++++++++++++
 .../grafana/aibridge/grafana_dashboard.png    |  Bin 0 -> 474367 bytes
 8 files changed, 1725 insertions(+)
 create mode 100644 docs/ai-coder/ai-bridge.md
 create mode 100644 docs/images/aibridge/aibridge_diagram.png
 create mode 100644 docs/images/aibridge/grafana_user_leaderboard.png
 create mode 100644 docs/images/aibridge/grafana_user_prompts_logging.png
 create mode 100644 examples/monitoring/dashboards/grafana/aibridge/README.md
 create mode 100644 examples/monitoring/dashboards/grafana/aibridge/dashboard.json
 create mode 100644 examples/monitoring/dashboards/grafana/aibridge/grafana_dashboard.png

diff --git a/docs/ai-coder/ai-bridge.md b/docs/ai-coder/ai-bridge.md
new file mode 100644
index 0000000000000..5d62d2b3833d9
--- /dev/null
+++ b/docs/ai-coder/ai-bridge.md
@@ -0,0 +1,268 @@
+# AI Bridge
+
+> [!NOTE]
+> AI Bridge is currently an _experimental_ feature.
+
+![AI bridge diagram](../images/aibridge/aibridge_diagram.png)
+
+Bridge is a smart proxy for AI. It acts as a man-in-the-middle between your users' coding agents / IDEs
+and providers like OpenAI and Anthropic. By intercepting all the AI traffic between these clients and
+the upstream APIs, Bridge can record user prompts, token usage, and tool invocations.
+
+Bridge solves 3 key problems:
+
+1. **Centralized authn/z management**: no more issuing & managing API tokens for OpenAI/Anthropic usage.
+   Users use their Coder session or API tokens to authenticate with `coderd` (Coder control plane), and
+   `coderd` securely communicates with the upstream APIs on their behalf. Use a single key for all users.
+2. **Auditing and attribution**: all interactions with AI services, whether autonomous or human-initiated,
+   will be audited and attributed back to a user.
+3. **Centralized MCP administration**: define a set of approved MCP servers and tools which your users may
+   use, and prevent users from using their own.
+
+## When to use AI Bridge
+
+As the library of LLMs and their associated tools grow, administrators are pressured to provide auditing, measure adoption, provide tools through MCP, and track token spend. Disparate SAAS platforms provide _some_ of these for _some_ tools, but there is no centralized, secure solution for these challenges.
+
+If you are an administrator or devops leader looking to:
+
+- Measure AI tooling adoption across teams or projects
+- Provide an LLM audit trail to security administrators
+- Manage token spend in a central dashboard
+- Investigate opportunities for AI automation
+- Uncover the high-leverage use cases from experienced engineers
+
+We advise trying Bridge as self-hosted proxy to monitor LLM usage agnostically across AI powered IDEs like Cursor and headless agents like Claude Code.
+
+## Setup
+
+Bridge runs inside the Coder control plane, requiring no separate compute to deploy or scale. Once enabled, `coderd` hosts the bridge in-memory and brokers traffic to your configured AI providers on behalf of authenticated users.
+
+**Required**:
+
+1. A **premium** licensed Coder deployment
+1. Feature must be [enabled](#activation) using the server flag
+1. One or more [provider](#providers) API keys must be configured
+
+### Activation
+
+To enable this feature, activate the `aibridge` experiment using an environment variable or a CLI flag.
+Additionally, you will need to enable Bridge explicitly:
+
+```sh
+CODER_EXPERIMENTS="aibridge" CODER_AIBRIDGE_ENABLED=true coder server
+# or
+coder server --experiments=aibridge --aibridge-enabled=true
+```
+
+_If you have other experiments enabled, separate them by commas._
+
+### Providers
+
+Bridge currently supports OpenAI and Anthropic APIs.
+
+**API Key**:
+
+The single key used to authenticate all requests from Bridge to OpenAI/Anthropic APIs.
+
+- `CODER_AIBRIDGE_OPENAI_KEY` or `--aibridge-openai-key`
+- `CODER_AIBRIDGE_ANTHROPIC_KEY` or `--aibridge-anthropic-key`
+
+**Base URL**:
+
+The API to which Bridge will relay requests.
+
+- `CODER_AIBRIDGE_OPENAI_BASE_URL` or `--aibridge-openai-base-url`, defaults to `https://api.openai.com/v1/`
+- `CODER_AIBRIDGE_ANTHROPIC_BASE_URL` or `--aibridge-anthropic-base-url`, defaults to `https://api.anthropic.com/`
+
+Bridge is compatible with _[Google Vertex AI](https://cloud.google.com/vertex-ai?hl=en)_, _[AWS Bedrock](https://aws.amazon.com/bedrock/)_, and other LLM brokers. You may specify the base URL(s) above to the appropriate API endpoint for your provider.
+
+---
+
+> [!NOTE]
+> See [Supported APIs](#supported-apis) section below for a comprehensive list.
+
+## Collected Data
+
+Bridge collects:
+
+- The last `user` prompt of each request
+- All token usage (associated with each prompt)
+- Every tool invocation
+
+All of these records are associated to an "interception" record, which maps 1:1 with requests received from clients but may involve several interactions with upstream providers. Interceptions are associated with a Coder identity, allowing you to map consumption and cost with teams or individuals in your organization:
+
+![User Prompt logging](../images/aibridge/grafana_user_prompts_logging.png)
+
+These logs can be used to determine usage patterns, track costs, and evaluate tooling adoption.
+
+This data is currently accessible through the API and CLI (experimental), which we advise administrators export to their observability platform of choice. We've configured a Grafana dashboard to display Claude Code usage internally which can be imported as a starting point for your tooling adoption metrics.
+
+![User Leaderboard](../images/aibridge/grafana_user_leaderboard.png)
+
+We provide an example Grafana dashboard that you can import as a starting point for your tooling adoption metrics. See [here](../examples/monitoring/dashboards/grafana/aibridge/README.md).
+
+## Implementation Details
+
+`coderd` runs an in-memory instance of `aibridged`, whose logic is mostly contained in https://github.com/coder/aibridge. In future releases we will support running external instances for higher throughput and complete memory isolation from `coderd`.
+
+<details>
+<summary>See a diagram of how Bridge interception works</summary>
+
+```mermaid
+
+sequenceDiagram
+    actor User
+    participant Client
+    participant Bridge
+
+    User->>Client: Issues prompt
+    activate Client
+
+    Note over User, Client: Coder session key used<br>as AI token
+    Client-->>Bridge: Sends request
+
+    activate Bridge
+    Note over Client, Bridge: Coder session key <br>passed along
+
+    Note over Bridge: Authenticate
+    Note over Bridge: Parse request
+
+    alt Rejected
+        Bridge-->>Client: Send response
+        Client->>User: Display response
+    end
+
+    Note over Bridge: If first request, establish <br>connection(s) with MCP server(s)<br>and list tools
+
+    Note over Bridge: Inject MCP tools
+
+    Bridge-->>AIProvider: Send modified request
+
+    activate AIProvider
+
+    AIProvider-->>Bridge: Send response
+
+    Note over Client: Client is unaware of injected<br>tools and invocations,<br>just receives one long response
+
+    alt Has injected tool calls
+        loop
+            Note over Bridge: Invoke injected tool
+            Bridge-->>AIProvider: Send tool result
+            AIProvider-->>Bridge: Send response
+        end
+    end
+
+    deactivate AIProvider
+
+    Bridge-->>Client: Relay response
+    deactivate Bridge
+
+    Client->>User: Display response
+    deactivate Client
+```
+
+</details>
+
+## MCP
+
+[Model Context Protocol (MCP)](https://modelcontextprotocol.io/docs/getting-started/intro) is a mechanism for connecting AI applications to external systems.
+
+Bridge can connect to MCP servers and inject tools automatically, enabling you to centrally manage the list of tools you wish to grant your users.
+
+> [!NOTE]
+> Only MCP servers which support OAuth2 Authorization are supported currently. In future releases we will support [optional authorization](https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization#protocol-requirements).
+>
+> [_Streamable HTTP_](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#streamable-http) is the only supported transport currently. In future releases we will support the (now deprecated) [_Server-Sent Events_](https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#backwards-compatibility) transport.
+
+Bridge makes use of [External Auth](../admin/external-auth/index.md) applications, as they define OAuth2 connections to upstream services. If your External Auth application hosts a remote MCP server, you can configure Bridge to connect to it, retrieve its tools and inject them into requests automatically - all while using each individual user's access token.
+
+For example, GitHub has a [remote MCP server](https://github.com/github/github-mcp-server?tab=readme-ov-file#remote-github-mcp-server) and we can use it as follows.
+
+```bash
+CODER_EXTERNAL_AUTH_0_TYPE=github
+CODER_EXTERNAL_AUTH_0_CLIENT_ID=...
+CODER_EXTERNAL_AUTH_0_CLIENT_SECRET=...
+# Tell Bridge where it can find this service's remote MCP server.
+CODER_EXTERNAL_AUTH_0_MCP_URL=https://api.githubcopilot.com/mcp/
+```
+
+See the diagram in [Implementation Details](#implementation-details) for more information.
+
+You can also control which tools are injected by using an allow and/or a deny regular expression on the tool names:
+
+```bash
+CODER_EXTERNAL_AUTH_0_MCP_TOOL_ALLOW_REGEX=(.+_gist.*)
+CODER_EXTERNAL_AUTH_0_MCP_TOOL_DENY_REGEX=(create_gist)
+```
+
+In the above example, all tools containing `_gist` in their name will be allowed, but `create_gist` is denied.
+
+The logic works as follows:
+
+- If neither the allow/deny patterns are defined, all tools will be injected.
+- The deny pattern takes precedence.
+- If only a deny pattern is defined, all tools are injected except those explicitly denied.
+
+In the above example, if you prompted your AI model with "list your available github tools by name", it would reply something like:
+
+> Certainly! Here are the GitHub-related tools that I have available:
+>
+> 1. `bmcp_github_update_gist`
+> 2. `bmcp_github_list_gists`
+
+Bridge marks automatically injected tools with a prefix `bmcp_` ("bridged MCP"). It also namespaces all tool names by the ID of their associated External Auth application (in this case `github`).
+
+## Tool Injection
+
+If a model decides to invoke a tool and it has a `bmcp_` suffix and Bridge has a connection with the related MCP server, it will invoke the tool. The tool result will be passed back to the upstream AI provider, and this will loop until the model has all of its required data. These inner loops are not relayed back to the client; all it seems is the result of this loop. See [Implementation Details](#implementation-details).
+
+In contrast, tools which are defined by the client (i.e. the [`Bash` tool](https://docs.claude.com/en/docs/claude-code/settings#tools-available-to-claude) defined by _Claude Code_) cannot be invoked by Bridge, and the tool call from the model will be relayed to the client, after which it will invoke the tool.
+
+If you have the `oauth2` and `mcp-server-http` experiments enabled, Coder's own [internal MCP tools](mcp-server.md) will be injected automatically.
+
+### Troubleshooting
+
+- **Too many tools**: should you receive an error like `Invalid 'tools': array too long. Expected an array with maximum length 128, but got an array with length 132 instead`, you can reduce the number by filtering out tools using the allow/deny patterns documented in the [MCP](#mcp) section.
+
+- **Coder MCP tools not being injected**: in order for Coder MCP tools to be injected, the internal MCP server needs to be active. Follow the instructions in the [MCP Server](mcp-server.md) page to enable it.
+
+- **External Auth tools not being injected**: this is generally due to the requesting user not being authenticated against the External Auth app; when this is the case, no attempt is made to connect to the MCP server.
+
+## Known Issues / Limitations
+
+- Codex CLI currently does not work with Bridge due to a JSON marshaling issue: https://github.com/coder/aibridge/issues/19
+- Claude Code web searches do not report correctly: https://github.com/coder/aibridge/issues/11
+
+## Supported APIs
+
+API support is broken down into two categories:
+
+- **Intercepted**: requests are intercepted, audited, and augmented - full Bridge functionality
+- **Passthrough**: requests are proxied directly to the upstream, no auditing or augmentation takes place
+
+Where relevant, both streaming and non-streaming requests are supported.
+
+### OpenAI
+
+**Intercepted**:
+
+- [`/v1/chat/completions`](https://platform.openai.com/docs/api-reference/chat/create)
+
+**Passthrough**:
+
+- [`/v1/models(/*)`](https://platform.openai.com/docs/api-reference/models/list)
+- [`/v1/responses`](https://platform.openai.com/docs/api-reference/responses/create) _(Interception support coming in **Beta**)_
+
+### Anthropic
+
+**Intercepted**:
+
+- [`/v1/messages`](https://docs.claude.com/en/api/messages)
+
+**Passthrough**:
+
+- [`/v1/models(/*)`](https://docs.claude.com/en/api/models-list)
+
+## Troubleshooting
+
+To report a bug, file a feature request, or view a list of known issues, please visit our [GitHub repository for Bridge](https://github.com/coder/aibridge). If you encounter issues with Bridge during early access, please reach out to us via [Discord](https://discord.gg/coder).
diff --git a/docs/images/aibridge/aibridge_diagram.png b/docs/images/aibridge/aibridge_diagram.png
new file mode 100644
index 0000000000000000000000000000000000000000..fe9d39b766d1f0b80e5589241bbfa7d5c3344b7a
GIT binary patch
literal 183745
zcmeFYRajilvOWwUgpdRX?hxD|xVyW%26uwH1%kT`?l24*+#$i;-5myJaQ{#C-oJgG
zbFRP3uOBX^hc&CaS5>`L^;WHLB?U>O4|pG7U|^7>rNmTVU=Yw?VBYM!e*^uduzSA}
z1||STT1;5YBlCC_K}%Kh72%v1=gY`1#4n<1KYp;N303^iAt<SzY1FW*m_@c(_CL9*
zXqZ)~aO2YPB~(AMoYk>WCkTW44ofTh>r-!lP#5KAk@qA|#Ap-r7^v^-*T=WFMHLiI
z?^iQ2SG@hXZ}mc|K{T+?#s58o=zR4N{+YnQOw@j{`@7eFkK8v_s{ee3fx(o@_`B(U
zj}oCJjDJ4E2*FPk|91jI8^;0v-<eWi9nF6y0UrwG|7U5n|9`1}p3MLE5Af4psqznJ
zueQ1pz7dL5($#I<xSn?<{Fh|-#=gJI!uH1!zuKJ{=u5)Bet?QLAYyQHQ$j+bCFYIL
zt=rjR!O`cx+uLB?p9IF{<m6Nq+=X)cJvCK|2Kax}D@6Hc?=b&IOPZvJVTcmyqACr@
zL1ais<i#qUu2}lgRCNB3%il~a`uXH(m6ui%iKY${h_Z>{)SPLj=hCG9mfMQ3)((1b
zt6_O8=y*H{ay)r|6e!V^W!REsq}PK9_y!_HL-1UkOsIivo{AQ`GT8#Ai@3{3f47kv
zIXFZk7=BoExcd-dN-Rdtx+(^L&J+w)JwEaf#M#2>A{^tEDJ3@>P#EJ`kq4|ilBcb6
zF{!|XxapaQInPkX1v*%SaxwZixDFJoh@de!+Tu;2K*_csN^wbDRuE;`0+xb<8!X(X
zATXOv@=5=Ir$eOkZYq=8w1U6_ZZ#s$!*95NnuGtA$W!Owi`w5k1%#5&74bSUbmOai
z9WdGu1<D_NkftYdwlKarXJx0E#Yh+l)^cl!d7Fy~HJ<Zda+Xp!MRvg8NVe}@!(2TP
zrZU@!zBrzXhdgbJs^2qj41geF)!%~tgtBPVjWIrZ6Fc#=q9Ms({6u#g?$oQEOsmV&
zNO`8$g{RQEbhJig7napeK%oW|B)AWcQC&Ot(;59%uZS{Zg?@ptb~?m=w@8Hj$sLam
zP{=~cyh~Uhqq-GEW%9g7riY#ps+W=!5j)Ai4BsZ9VMlm>`&ndYQMBFw14B53%Q7?@
zHb)G`!(;9RV?)FYo4Qu+MN4enSjtqcTa>MG&px-5w}*)=`lDQnKAieR23dUlMO%5`
z(5aHP>%0UBy7C}l>1S6vIu!C!$~5L?$EA_91illluTc_$OPCM&EVNsRcc>{}K*jkh
zd$&auoH5^oPYrr3zX<E<&IV+*4g8Rzwsa=>djJ@IghZ|9fxbjrzJZ0ft2EOhj|Jd;
z9uMv;rmFls8R4N!87M?@N|M(mQ6oNpYW&8{j1FcMu|OU+7w*%5V5SO(stCQOJe4C)
z(F(~8`D|V>lFRmcaY@zWr}z#Actzmn*SX=};w~=mMavUq4)JzJMtyaoF4T#|{t5yR
zI?%AO<z+{TPg$B^^tb8c$Q}TYUD999L~jYz0#08?v|3E{ndadO4NLw576w;j-~IaI
z3sm93U$R=IBI+{25u!81VHt0?<Y-$P2MTf~lzR>P*iK9!ta&DM2egxyvY;GmKjkFx
z<+;y4r-oSv#r&eaTQTX&**7orjRf_LkO~6k46D@e@t8x!!d=M9nrp%Z8MK6S7#SUM
z>sDQ;<1@P~=UlAEi+H+Bm)g>TD^Oy6Mf!DKiJq|JFRhS^@AaiRZqa<P(;HL0=#aSV
z_8(Q^6{v0|<$LjP<1D!3y;KBROG?^x<+^~Zt<=no>}a~_zXIMY`>mh3XIf6QSr4TB
zbqK$=g(bwjY047by+yypnWaS@lOM1`b9~y7>?lgAi+?MFI8<1r`&v_wSA|;U`V_oF
zX_j3$Wqc3kTZ1Q@$!xlmp2;96Lle&6pCKr0%Zyp5tbZx}!Lw7^_G4+Ykmk5@j+Gjw
z{4N8~uLn<fZF@kAX454{<8X@lB4Fxk1_n>g6a@GU2422<Ky`uw>R@t3>3uCz5we<v
z76a9Y<VioK=lV3e!%^4)3kFALDeur##r*rHibmC#LyKc=&#+^q4e?MV65b6d=H|;q
zjFEdY;aSUmdUySeU#vuhD2s*+_!VzkBww$EK=c9uq_{q3#VGEwNyP(@y?J39%DFn5
zNXFrLfRlca{bNfCw-p?h$48|VFSls6BapBFG0o`+e?mcbGM}EMFGXX2)lU{5OxxiI
z;iH$*lMo@*#AZoS?D4c^FG`B{rbdETB7>K}dm24wlkdfee$|s8#;Q!w?4lSiB<xGE
zu#%{voS29>5aktwoAM@P`<Ci+Pw#CbOX3NHTNfT4iF|T0X(a!?7|7P8k^L>n!P75v
z4Nxk!)SgvJPi=(PtTmA(Cc`6#`6ivW)-!skwzqKBWsB+_3tt+JuY@CV3mx3UQKK(M
z#DD%y{a^OADo>fa;%v&2<i(p9B?*6_=JG>}amQ5jp?C*FWY1NMrBs?MFzNVdK+2D_
z?-yzJ94m`72gS2Yy_|7qLNexTq3R!anbP7sR0e6q#Fw3+FKNL;i6tE2_N)Udk+vi0
z00+NYa&Z}P3#m@dYhuw)sF?cXf8e)TCSj`F>Ww#q>=l*TeI$M)kSAy*CTb3Y!sB&g
zb7C=x+@bzTs2^uy<9o{ude))@ngF*vnPO31ahFSkJY}s=I&TjBE=5q#!MSFVTdF-W
zY1PeYN`H^IfJ=4Ymc8;M;RiiA6Fwd^P<f1=VIe4DvnX)KRH(IpW*h7J(qRoBKrywe
zXRMgdJ-wq@fH1Wo^x(>_&nIW_abPNd52|M!nYOTI^HaIfht3&GEpdK4$tmcIXq@R=
zQ=lA%=9ofj0qO9Cn9&ob0-B;IKJ%&aiIg*aVy30)kg;LiYL2+r{v=MdEV)Inm;sxE
z@Nn^TDRnxsIH$wrzPUgT(iYMpn{m32zSz?I&#>cXni0bnO}MO9aSFVTp68FG`NNVW
zL#f3Kl!Et=X9<;@6PK?cm2WvT?Z>g`TBN{cY~KaM-wrh{NI9|PK4a4yA$xvbYVG)!
zJY$)e(}LM^Iu1CAof4C2^rMRt_?&9uWBHJh=i|{D<K7xOAx@_*tBJUesW1dRbc$8R
zK+pthqVtnvd#;OMA&Fm1m=4dx)#R<x)Fjz9)QxSj3kOOjlb?X~raC8C;6o<06k#;Q
zd!b2$`mXO^ZV@36+R}F69T{ILqhOjVj63o-LXz6wsl!A?1f=OL3lFn?MofXy2dJ(L
zwiMTYguIRSV}H(C&$B7A8;oAv6dG(jYbOr3<u(;oo8%d^^5Y4Qwo0A)lr6{M=^ghq
z@xv15IH<_x(uQtGiZoy3eq*FY4~<g^KGw8v$4GWYh<iSx8wcw<(<gKk$nBR4hOG~E
z6^#3Sa8h(=;NQYiw|V<}D;ZltoOSI?#sa%3@h9lCi5yJ`9R4^pRf&cCx=~OZ^KA>y
zMzUQsMlv;CesX8uqxx3_6=#yrzTaLK<4DXhN9Abc9SbnqRWpzafeSyG&?!`;CuW%i
z4$(7k0w)^DE;$rb%G=NM6UKj$rNB!MgM{beHDJ6j2%|V$P12gRQ>|0_S7|i-EC<;L
zY%Pkk8QRNB^D7OSP3t0q%<FmC^Ox1xhba7z=deN!@8JUrN$Q(KntQsZ${X*4x@(y^
zAPuuDX!P}kB1-G$zt5Xy>+j#>ISqc6#8(Y@SXL%UDFkTH0<Ica+}Tt+h3cz8VB^4{
zxUb%-#en*hved-;U3R3~4nS&@L12u|DWYFlY4I<K-96es1-B7{L+P6-o{M!eT3li#
z{FL_ahuxlpzP`JBmR&SS*6kM!oj!bnT|i_~7c0Bbr*AgR@<wiE?1oxEJ(iWlF(E_#
zwymX>@(;;%^Fq3^x+Y}x)~?afnrhugcHa*FOx18IJ$_2X|N2z_^VYpNSFO+qA(P5$
z`RE7?Ql~?Uu-7Q{5kpwi)y4&lpE20RQC<uu%PuVjX-T~6xS30zC0Yn#6Sd2LMfy|}
zscniTMl|GL38xM~#ZAmQY_%onylc_PuJT#PvAx12d~KQHY<9<#xt!0IzRWkR$oueC
z%vFXpWz9@zmUN1vsD!7OOdC%LGe>N<r;4KCqxwZjOU%%4*rrrNA9+~;Eh@9^;FOlx
zeM5{`GkM8$jhtu@2WR{N58;BOx|m;{Y1NVUijA)!`5QFU@O&%vx(8LPS#qm>tkyDG
zz!W-oj)Asm+DVGS=3q;`CDhKk{2qR7%vVWR-p)RG2+&p)#4c+>tj1s^rM!x8UCrjs
zJkRnmPzRxrg9G9j?5kwpYL|T|KpkLbVxIeApfM*~2`D)ZdeBbewK@(mm6yj>yA^h$
z9D(IPSwpDDG^iBPQqnKeV;LEoYtm$@w>ERV<{T<blI5DiLN4yJp2ah*8U9%`L}ANn
zqG<P+Yx4xrDLR+?gd<w-JGif=aS6TKABBbxyv^jWp0r)s)&bZCdR~)j{lX^Y6s<zE
z?Am5&Ls{ohH*`-kW2^1eP`i^L7P_|-^|X(<@$DzxRzB62!TAKUzHzZx$?U4W#A<ZO
z2HT+HAU$pK)7W1qL)2xoXMgyqE9z=w=sk@*vX+C=OTbTr$wa0$#%vQ3vK}<On6n88
z?&o7C!YXOU3Dzi1U)lGx1e*|WS#i1vTH6q2hfNVnH@VX?u52VxSXhnT@`<2q&Ci*Y
z5t&+_2$NcEt7i`h7f1fI%5ftw)xp8L<92C7z?=)S2W2Bzod~ldO_|OH$+^q2&bwtI
zXfq=rSn<l+SfC75fp#_cn-J7zWvA4<m7s^Th(=xm^B*(_c>oFdOZ4<|luM_A_$n9{
zAVh_pj1zv8@63G(pV)^l=~&=NlVe+AFQxeTuY-D>z9}ouGVCS@xCM<w%`}E+(GG1I
zsxmqnH7{ngS~qyNZ?r)~RmoC9SB*xkS8Ag0s)rgca@Pvj%97_W&fy!AWgnIv({M`N
zwc-o+G^8V(!pX{FD?HB-LM+DW+#0Xv%2RaHHFTLgj68a0Jt=1IhbW#GMN>ar$7cTO
zICKNM?xI-?`^}lhSkI=Xn}UC0C(CM4x>e2@q@S$OD$LRQybmeN6t@)Mn5U9%MZg`f
zmZqf$pVG^BXD$T^7yAXab)Z^hy3u8S34wTW1mV0RbSUEY(sh1!O;mJ)>(N7`MzVvc
zv8u-C*m%usQR=^Hb@Rphqb9;f&QUksMug;9jB_>bxX|`0P~HQPb}d4+w(l`f9>OYP
zJ7am3myrhr`+e^ZzTE^rWZ1rUhmRPeL_4O7^L-=I73p(CJI1?ds+np`vu+P7$u4mm
zS=-yyF2O0|5#39^Ll&yA$aC?m*)!!F&*Q1+jUP@0Oj*3LGI5KwPacD#6t~qn0_H;D
zk!Ph)`>>OvpRWs@25nw48$*#N^l}Fqy_1Mz4(vK#!JkL1(Qn1+h_x1Q@U4)}B0qxG
z^)&9wZPVC9F3B(10Jk%NtV0x$AxN2L%Z3%{CBoLNZaGeaT%7%OiIUb0k3Fa8L)=^l
zswNei3<BQQK%2B7idLY&X1-&(3)lWwd8cu*><h2YgfraAY-w^tk3Ig25@XuRxS6k3
zu6gUratt*U&#IQWPPaE1?F)b{xvEw$8`q@BvE;!<;<T)vi3Z>!Fy!tec>OrIQdxSj
z=B3rVBS_GQnFpJGa<hH~bmCZ?PAOt<YnB`*9#FgQ;9|FFGp}c$Sv(V?q6PS%^O#2U
z{cgXS8v1P*Lj!2rIJvlxV&ETeeD>RQ3C{_-4&Sc}2F?YAN%=CcLAGxTq=Z@MUpCSG
zaN_2rqGeZccV;@c*>JIX%$0d!X(6DYfFEzbGHjR^C2~UMzJpx>CFq@tM+YPJ#!Yc$
z0aG`q7LMK)d<TB!1b7Ff*-z}(U%GE>neU%-W9;(T1aOyB9I){YMT=cs1d4g*zm&(S
zrb-aMj_0LrbDk{+?ab-ldrL<RZO)`q!3AZ_+zM+(42eKdi0Sdhn@MT-B4SB^dSLK$
zgEcRGmhvPvX0)>r#TXaY66x$H(#p_KMwM}qjd?+Go8V55$RBbBOqN~4<Jn*r97hPj
zK0N&8T$<7iQubD$-rvX^m9GnFWTUh?NyZ<d=#(Q`lq5qzOLMjeITSbuGRoO+p9Mln
zFl00RpY)qe^FuHD5dWl~Ag`i=GR2*&$l4kU(ESw#H5eC(QLTX&iJLE-&6lK1)Bt+#
zE(aa|Yu|~iL!Gfb(IE=d?8>r!<XKzy-zl9*s;<v=b!R~a0&b3HNXepy-LJSd`SGy}
z+3A;aptrjTP^l`ml;vDM>oeli=<jkCEy6uQ@2FX;56D5Lws7`2si+URT`{bdbUvj9
zSXMN=9Ig{*d4ES~8KT2)mn=dUC0;pu{sNV+*Qmj6lD00t<<J>$d~Y>la&aXfkG%~O
zFxAm=w?TxFIF7PjH5If*z+x2m8st4;i5<$X7(G{x^<b0al#pdt{7ikiy->&=PRnoE
zzeB}GKdb86Z@=bw6DNb>B{;ATPkc?JroaB%pwqC~^hfA)ad<cTvigzm*xpjNE=JZb
zb_&U6)Ai}Rn_`qx;hdN&-z8Q43RN|-!$z>;Zi3abeg`q9T&;dR(aijkh>b@TLFbjO
zM5WW9;dFmGUg>SF;go#`DrS{l4QbEopunMp?;_@`AJkX?BLoZkm&$(WCoT3|N|Y`0
zLGKoIt&kk{Hk-&6X{`t=W;yhRpU#ifcN2*Fknm4!ff@{Hh5}Bvh`R}Zch|ZE#|6zo
z8SIaTNvGcYBZD_pU=#K-dH(Nvp8)Q+dD{5=mb1G@Ifhc|jQ8uo8^Sk-{0C2235bsh
zGyr;nt!s&ZlyEO-=+XCtRg`J!aKvY+tp{;O#2up0@tzpe{W<>RsnEQ$`a94W;d=U^
zqcNuz$)dNGify=)SAdD*D8OlO2v<3MHU?<_yuRq3ENej2J~glYe8kxKbjIlpa!IU)
z%g*8V0qwo9uy@f=;JT^5eSQ$^XD{>h^pG&Flxd!;=kjnJW!e{1XVm6$L+V#<?>4`v
z^!eow<upjXu1OZsR?++$WTUnQfK~XDqwuI-yVUO=3|tLweViB>P_gmoG<dN#eBvCU
zIEz}}u`bBQl^Tt`-`T*}O#p^It@r$468y?12$(?Wa<|m*cBo1z7vVJFLf0h&_kYhF
zBg~y_uHeJJ`$OH0viE$fuHk$(urj!Gsq8f|SZ9YnMz6w{#`$mr)97eDTX&TkSerxq
z5)M6!-El?c_p4v{<?L;4H@Twoa}KepU|?13^S1z#IGuXim)YCf(yNE?pnXN+hswP-
zvjX`B3ea?jaH9MM{0BsHf7@{?7p<k!{dfY2XuqIKlEsQ%Kd>+BP?T;*e;g!EOqMN%
zZ^Jx&JcR4MbVa=X`UE(*(myI#pD14`a)~<}sH#+dlvc`9zW!$B8#HH)X`Gy+)jK6o
zF>7BI^G50Ew-%N9>!SFHg&XNmMfqfl5c@7^^_;c(HLYMZ2is7c#<1oyQes%;#ZYo=
z3dT%GI;~&+yq;0Jny-<!H2x-{y1%iV%@GKRUHwUH9J8d~N0h9s+$nJHO<B+3Q7`(O
zm7ONJotiK8tWLCHS$1%Xo|17Tvx2G}M!*x5SK!b12TRp#C110T)^+}3NBHVp=nWUB
z46`1@<9iqE2;FNl@6WufC`1c%?32CfIlSY_rSHF~KYGP&m8jis4ipzlX18?*(A$RB
zl+>k5f$19`kflrRX~f|kAi4|dN6bj%D*j9@*|61GVrD&_HD*|2F<(g}If{~$4X_4n
z2kV*42!U;Sr3nf3J^>XS%-ZR3by1~<VZOJ&a|4Gw#QJ(vh?g$EFtR<r4hZD9y@*l0
ze0k)CK!FrZG{vV6P7{w+|8caOsHr!-(-2t|FGr$HcAJZVI5i^DrCN8sps9gTw*Xz;
zGKzR|X_C#`-r7-IwBSKN%8owSXTPXDs4SGE(!qqd5JIs|tx6nJkZVTV!&HS)7Q544
zc|qY{D>5ulB3#^IP(*qHebU`!4l^Anv?a<YXCJECawVQK1Vv3yvMU(c@MfQDjH#yj
z1f)tIl)OEx;daBQJATb1fI6H9r#ze;k~DN|)aXz_OclQ*3hVW&4;fXcCtoNG^Dj`_
z)s&129l2!{iXJ4{+UusIOt{pu`zF<NAHUScx~sQ~+0;YaZobUM|FXNzEqA&e|7{oe
zi(j{@f=CTC7qs-gs-3??tN<E3M%dV@7*^GAc*QM+YEShEn+HmGXnL5Xhq~dK9THC-
ze_)VwtVg@PwzfbiwJAfGE%kr5^-;E*EhOF=ENrIEfj2vJI0Mj_=^#>D)<Bu!8fa6~
z>avwYX)(|#TAVypE4$6*JvkEo!4b0sMIn2uo7{vCpu<4pOC7Zm2UB}|{t|`j(FzQk
zvyJ3ZQF;7~x=;YH0s(Z=8Ae@EC{nSL(m+IR1KnYRmr}hK%G3*L`*a6Ul0mU!y2hjr
z7WYtZw%yIIP`BHe+4(|jy$SlNQaW`y=|RE%2~EK_^rdYe4X4&)FDBn>MM}fp>U1;}
zgY!$3a>bCjk4Nx2WwSHMWyzKm#f$d#R@P7%HxFh-$kn46s8`OxTZiP;rz^RZfaEA=
zb>!_zKzz?G6*?xf_5giNI-2q}Q1kB)iR<pz(iWA9leyV4_l46!2boXr*m;z4Dl=v4
z=yYgG2FB>Al^>tNC{9j<2R$v2yg*c+Kd^g!ZlquR1$g+Au}9Th*uv}exr$b^g1nKu
zzFPTt_)?+S3uWtL)5)RmRs>WoLz^19{3Ue~?FhT)iNVI#qU`n{FBICTxu8Nk08Rvc
zdS_^bT)iH}#Ozg+e7#=Sr0b6?+x})=ac56!Kq0IUin6wWePO(weIj*aLnTQfn2kwp
zS2Oj{bg3ncI?lkpog%4R$4{0ze_tRTCC)atY1TzSXj+hj_})XBCg-LqKSOL<(1FH^
zqzZRg$Qe8FsC!MMJ&>^?kCimNHg!eUkZ!EVu59oZ`(6#sQbX**w3UXIY?p$L1j0O8
zj(javi5|SaGx4)me3w8mDqgK87C~_qaBwb_9G2~jCPH6$v5&k%R1{k^)n`ZHRCtN7
z!bz4|8S6w#RD{^eHBe?vwHlncH{nb+8){u_S1by~XlUBqd*r;GT*Eo!Ow2~|J;?c8
z<37Dcp8imsqANn<(C%CYMq_ulUrSG0d~9PP<*ELG7H-Z!IX>5z;2npo_az5l^+WN}
zi{B`6Fe3(iqBdtjC^BWQ(!SUPyaTcu#>mPg49zg)&5O<m33svzoyu4fXuUnwK7Tkm
zsrXy9dG+dzG)If?Zt*4bsEA~@*j}-rx!)Jy=c@lG5|n*3_4A{jpH5$1<L9aMjBp2q
zz{^3kdoB$q(+oZ%#jA@u)(zbq^hm1vNgjy7Ck^({mbq`G1|~dV#YHa-SRt-1Dd@o>
zd5HUA(=?}lOu~?DP#x60N9(tic_dc9DgLc(TJA+{;2c;fkvJ{e1D@6)FV198`)wP2
zpQp1ZlzfVDm+3`kZQyx5yMA-pZiwX3*0kvL%0@*Jj^F;IB*w|Px>_I~lyxFV#I2>o
zB)o*N;b^`oYVriOBt5}UjuT`SzjCKH(@dNvI0O#-z>Nz<>CMhv5Da@G?G&mqj@lU`
z1-|v1B$SaNmxkK~#LLMbN**}CO>yQ4ll1s4JXtN<!dZEcX7Nh#o=to~1_LIqBh{4T
z4H9Q09d%mcq~Y|}#FHWTax{|0n=&Kswm9Q}ADQI`(&RO#Gv<5q*lEB-5`Ke8HL-rX
z(_c^$AO}lUw5-LytSTzll-xe8R#GCyiitgmMQm{rA8Xw!!AOG3(uK_{YCS#p!~+|t
zU%pb@*hv?<MXcZq(KsN|bVe150Z<zBxXxG--qkE$bfiw4gOl3Rkjp7M<9BR@e-0+4
zD6n8}dDId7fhq)UToBnLVT(uRm9JE1AcRrH$Lo?+92=Z~2>*~s4yYt=jMBhbvyMr`
zmsf@WGQ8L{CzuM#u%*AeMr-Ow%!);sMpW7(2YeHL$>X<AV*E>824t3JLJ~_1WXMSZ
z<4n=EBv3_ju8;-=!s_G`Ryf|J@uIC3XLhSm=5VBa6IT%3b^p#n4yaappnGo5dfOdl
zCS1?0mZYF!Q)83mUB#IA!JZT03r2ihSQC|$p`jJx$z+U%&ey@N5E)kRS$AP-NAEzi
z9>SK!Uasux@%?+)Tp&wsz<m#&$mApj#kd=Ic`6JZW6S?c7wFC<PYXm3cTp1PFY71&
zKnFyZ3Azz)JW#o6_oiD@8nLmGbL-||wUeQ|>d`fIiW}1}ESXz0=Lb&D#2*^Q%>`m8
z%kPg(&gxxD$?e>7p>cd(uD@5m@s$?L8n{_ojlN>Agc#Q>$zq#?(HWw$qNMXgKAjfx
z;#1S5B<MI0C})X>Ym;}X@+0k8zLw5$<|)@w`y=(9Qp`7&xC3ny-?d<hUic)};8(Cl
zeBd95T&=wAoyys36IXsbIQ*tEQfYo5GL01{Y4a1oo_YLL={s(3|AgN?<eK3i9G*Nn
zPgdK7BJ1fXgLCqyWpZmUBvBf*DO?cghDw54pIdlH^G@1{M)_iGQ6(q--|YcH<K%zq
zo-&td(&1I9%4x#y;D}l5WK7vZ-VKChh`>icF?nFFiUMqPAPvi;yvIz-BPtG|x;_cJ
zq+e__V5J<&dunamDJjnPxTdJ<htsvHkgP<V`5qCWQljFQ=|D|MRmGSo1hWy?@<{sZ
z9)hHYikIuzPXcp5LUc;{j9`;XD-a$%IH%!#s;DAw_NK-tF>TCQ3rVdHXpPEDI0za(
zttCfS*5+om9cV#k?c`5wN|*5<XaCZG;A#|IcB=F<>`HzB<T^HO9~^lF?N->xBS;qr
z2_r?$KKgCr82{2a2gf*d#>hf4o0OoIGm<5}t>D35iK$ok>Tt=_0xf>On0*?6bj-)%
z>$rT2fo$T$ReW^4>rgr=bP&0DjR^+5nf{?iy!l-3VwHxE4OQ*j{v)j}j9jV-PVWQZ
za{dO)0ENGm>wk>^Ms{{~)cA7g;v*p#7_UrYSa)!s^z2r|sRQ1Bdo%Q>rl-kBefj0K
z-oxZ7tSJ3umlV?b04)F9BfKd8>c_|CBC8hUw=giL;8R@@s7K>;8^O^Jg_%&z<PXIi
z`g?8e$IYiQlkd66t8o9^JV5fA+I<QECV=R@^FQq$e5I)Egf4_{V1Ao~Ss5*@ljQ2?
z#cQTaj>?<Z|4+ZjK{$cdDP1-{v;U0d>N?y1>JVw+wOd;5a)A=uP%e?P@#DWYI^mjL
z0t!#(xzXYM2uL2!&V=R^W5^$1Hi)Z0p!+iQIr5{I;#OX}2jZCJ!L)DC6nk~$U*G@(
zBQ!rr#?L=>v|y9=2|Z^`(PIJW^f(s==H=q*D!o(Z`r74tFCQcH9RG~})0Yxb3HP7>
z-1R$aH7d@NusOT9T-{!p)Gqq@`L)Erw;;y$%gW2kD@bo%co6FT=*(H~2}dU+B;@5~
z3oxglp;>l6o^Zt={BOTY03(gPNB-Tb^4;Tog<)f5;*THxpZo<o&!rPR_|^tXN|4Ec
zT~zWqkV#2>bUc{)on0!qRAy)Meggvv+WQm82ZPy)v6!Pj|Lvxkpy)+X#CUaISlt0c
zM@Kg|H|OQ$#m6h}_rB-Xl$VbdBPGfAWNP2p-@m=d7e~2<0QSbzeQYx`Gh65-?liZZ
znj_9iwy6|cHg?}AgV*jb^*_%Ck^Ix{b3VRzwhtUg^YZda&&W99Avn<B;NXaOt*xnf
zdVbm)&zKKn2A-at>Z23FaP#oY&CL8-wADv|Oh9G%AgN)1*7>BNF8@EWWL*Ufq_^}P
zE2n&QSmWD~d)@tngv3oSc6~HYrI7l4YiAI7-1)<VH~|5H3t^Y&(P^EPu&W*PkCXF1
z4M-D30-tV3@*TFPU8h<)b8?z96?8(0x+W%+m?23g8v%7RzYC`4UH_5js|WGhd!Nrc
z1&PJoRPri?BQ8@sSJV-8pw7<DN;p^#f+y8|j_aEnH}I<Nyz<{){qB}-b1KTu7x_Eo
z)4*VTXIw(_IetsP=&#6;-{wyLAD{oMD4!97h;%aFSXEi@_YMJ}ZY;E=CQMIWqo=u4
zT|B%5FaeL;7xPu?{?8r%x`gl!SS*jp$IlOK!}<G*I;akf7L3>S8R597a6vm5!hTkd
zny$n5{#dqnT`N1%f?9b>adC0$t9$LKLPiIx?MB2zK(9sBiwnc$Bp}4*UrjkLG}hME
ze=Sf5rI)24i{Hme=7sxjZ`I5J7`*!2nX#Fo^mny?kN@3}bupg3{GZmXT&l3U?Wjso
z7#Pc{^z`(mrY2bc<7$U*Ye&c0*x1<oy!%Kh^Yi2F*=!l0vfzm3zpCh=2KXS$`=rxb
zp<pUsqY(WbM(AU_RGryy%50e?000;^t)b-R=jZqJ^?etFiiLHv3o!KZ_P)*B0X5}u
zv~P&mgRlP=f~l+=iW#CzAHWJ>Lr>P?yg&AlsVy!pZen7>$kz6FdwaUk!H|rMj3^e6
zp01;!;&i-F4c#ug&D<wqfv33&-Jd^yvZRgt`SWe#cOX<tLqbAUiQTFLT6cc;oH}6t
zgJw{P_3NpsqUVg~@VHt_NQ6{ZU+6ltU%xz_>FVel9zjb_;6YQCa52bHRcEDMb4^K!
z<!0B<cCYJ%K^niMZ(niN*4ED2E)_gHnxHFI&KGC6xG%AF{MvyMk>PC+d;7nD4js7`
zw4mnNtKWrqjzv)A3+UIdvpcb=YIoc2L-O{1ghN37M94GqSCwb<{|pRR{tkfE(9jSU
z7dNifGBnKTHP+VB8ZfOH8j^{Za=AX7y}#U#CFH$XcIdo@Kveurwo8|%i^a_@#LZS$
zsQ<mB5CCt}c779A;Rs)B{^OXtFjNCZ@$m4rwzd?qc+6~VpP*-Yhk#HfukUp<SD{{}
z@eDn-NZ!Qn-$qY&7qThzP^?r_v$3`1^S(J&6nu8s9ZFUODqvz^oi0>&kB=+5)6K|#
zb^eca{x0CT%5e;RVO98RJ(kLvnvGu9)}-m&&U+=w1xe1uZvr=3&pJLLBd;|(TR`C{
zCubd`3cNX9M90CgG%+!uu`n^YyqZ=d=5{jejlhH+9}EVcwci@}`E@AFgLwa^I}nBD
z>^uQ?yX)1#qFCwW7uU_Dc49ZSy)<TnJ8UnoBlY&rnB0Z$5rH-yDu?|D>m}egjG@C}
z6l-d$n^>Nh)omrUdb`VF)DSYgIf6Wny3kf~FB|in_rWV5J0Ap+{_?r7un-3iZ!C)!
z@W-<GN{==f+6MRV_{gN&P~O&-Ico0z`h2UbtV|{m_3PI!CHxp`BctEO)mZde=e^j5
zzqHDS0Za~SZQ7*qE}~D!^tXRq*JBU%>O>0OfBPLbHp7l0RhcMzo;=Arq~yeYM0JP8
z_Vwv)Ys@veBf9pcfk3_2Q;)OX;76Yirp<`On}C&`XSJ%mC<Y~U5#D6t8_!#kIrIjf
zx5l2IqnS}<O_nZNIIxmab=20gZ5f2dXBHMxb8=q6z?^sQ-a*khH9Z}A1UfX3r>Ez3
ze{2rFHwR$Y>?_VkY(_aLDXpgOdG+=6q*b&SA54sm$1=H9)zw|y1N-{=#sy!WuE5hp
zD&Rjs2(1>sX{LYA0B_NW+=5#27}%Q<1^%sW0gSk~sUAF^K&YBd!&9z=!=hhVoWFB!
zQJTItfRNj(q%2Hlxia;CVN{R}lOD+LAju=+LLQkj1_fkbpeJg{Weda2pcSjY-pa_y
zc_nYhg_8skrb5J-3Au!k3D8;{QJ(#{GMI|JWvw%qTdNEQv<&wa5YhW;EaX>xxVAg<
zkm=FBqpMsVrsv#1>OsRT$(qu(uP`yB=8oU2j~Cx&<5GFJgaM)(ias=h<|7AZ=jYQF
zHR{N*Oeulq_+cX}Py7|MwXDq|PPa%-7OpPnaC|?OmX@Z0ik&YHM{fdiD=QTg6=Qpi
z(^6BZr$9FImHhrMZE}?Ooc1dz47$fBC-QP~81A0dwzhH#3fZg{$T{Owq)^j7S#ErU
zK6e8fYwL$8StfA_2`o&^EN<sw!%jc_c2Z~rAx3VK;OZ)x-r`*c_HSFsH;;)ucRAT}
z`%h<Vivl`3yRvG(fsMmy&DJ71Q)v0|ac&Dv(8-ZankR$mmmMl#1h?o)ImT|+%&2n+
za+ubGrtwq9co)Lku@?$?0n=K(Z?mkhu+DRm`jJa*Uw!t{-x`=4<$owhi6X{1pL!_i
zDRJ0)`*y@2hgQj<q7n{OCOnFM(Og1|e1NA0oWYbrpZR>{pN)va2LU&x_;r~3*91t>
zO5NE*0s{6sxs&l)AKRIOLh1Q_s}p~tmD0aGOagXBm70D%!>;&Z_WHn-;`8-2Eewnv
z^njdmxwgM<E8z37TU{6-SY#6l)%#;vx+*HhMn)T(n|VN>`z^#rTt%HWc`TKA`*z*m
z-QAs&on3uL?(*^ysF)+*xYd)v>7b#h`SI<Km6a7JhKyzN^Kx=((k35*!O(DGe0jOG
zq2Xq!-bMxND;eefPTc6hi>JxBqc!8$&YowecWrT{Fk|^YJ;?_=UWGtOua=m6?`z|h
z$A_tCHG5_2H|r#+-70#ML;Q8t`Vt$jW7&(Xu8(=D7B8IScGr!PO)8FiIc1!fax0F9
z3u}Z3<5{aOb!oZRAAB9VVrDzl_*b81=GMouRt55mhAlcRT)(bTS3Et=q>KydKAg4<
z!m7^C3)bEh{gERzhVN+KzDsK-{`nO?<s<THQ<lfY%9>do2YE;J<z<CBt9uT2qjz_V
zAXB#97SZF$gVyfR1H5);+vU?z4baV2AM5b@x+S4V${D}&>Av_MwcVFLz00`R<Am!S
z)VYLkrm#HfzP``kX`tZaacxTrkAuS*)Kx-p*|Ne4io4&w<qgPcsHr`jccUosT|k3a
zDq1?a$15;8CZ_A@3O8~n8CtkPHXpb3ObOIUBqt@MrlmnaWYDxGA|m49!A)`G0wuWl
zpGNLnvQ%H+cIzz@#y<1($NNR<N&_Z^_N3lV=~$&rsaaqmJX8_fYVF=1<vsLexfg#R
zPQ|(dvaCOJ7!R@ci^!cSe7Hw+5t$vUnQ@I}ms`qZK|dt%diqS$t5>qLU9}NuN;wl*
zPVq5Dn!Oj>QvDfHjy|)H3<zJ)juisA>JcxRD}wZYrtu1<wv)4)o{SHRWGxdi4AXH9
zAc0jTlAoTQZr8jO$<aK$y>s|HYy4kdB94yOY0!#|tM3jb3koEnbsB87g@pru{_K6Y
zK7wMQL@W`%&)qo`3957($JW+53JXo4p3tN}hTmyN%EY8#t5_w1?toY`^`9_mLs|UE
zQDUCt0A{*xeB5ogV;w?m37?Th!&HX;@o4Z5#C|Hy%Dg8@LtXmlu%}RO%$PYE)BP|d
zqAd80-`v<Z<W%5j4A*kzPb!WETwh1S6QN<TPfLJnZH{&gCG}k^VmSwdcuU8TuzRZX
zI(t*Dn7J0vB*RP=P{-moia%(sA!lVSWAMx-PFm+XNow(-g*09Y3Sw11e!PJKlA-_e
z?BwKy0Gx;!i?)u=QYf)sYG$UMx;jPTAcpK$Xnx7c%KG)|#Pl>Y*J0|o+iG&$hFWQ(
z!+J+~dHKAdzka*}^dk1JUk}!<k2L<B<wJb{U#aZRq84Of>{MGp2d`WF7iWj2YK(3M
zT#Zv-?Jaz5KC3W3Rhm7s{ct<qRfdYgOzo|eIVUTA&LG`IoI<TIZ$nOn4HT+Q#Q4}Z
zm>(f`#`x}`lH*!m7Y*!Fww#11l<^zQjCDMlbk)tA;CF21p0t!w2dUhsb>rVv06Umo
zY92dN5cb9&P1Vl>G0_QHSabr$lvGt~EylAA+P$KQ1v{W8h<GyBjUnK6x;y_SkmF!!
z$>nyukS7{yzuZufpTD*0zP?&*(x1+5^X?Ol5&b;$%vDhMzu(V!JuIt&22Rje^y>P$
zqM`ybZLS~lzxiW8%(oVVcb?pj@ZPo2x-wcFiv0W8Eq;SbB_my1BV=XkkIcQ#X;vNd
zDgJkFHM$<g{Udfi^z=F&39M($I(_5qCSfBje7SotWc(Ob!e#$lUQK4WK0Vni4~p@p
zqqu>(6g}ISQ`aK}bw`QEn&mMop0}f^Mp)PPR7WN?k&%ghuY22By&bHS9s`n*EDL{X
zv4fkq-?q0H2kypG7!oq3xOvsZf*`@8#B#)^b~alZtmbo5h6!w^=d;{BX}oKnP;#E{
z7rhfFv55a2Gc9<(k_v>=`ke=(=wMMu=?OCFb;SJ|M0H-%tD%XYQ{#(oxt|>zl8^GV
ze%Y(bhM-b2Ffh>4vaqsd2>N&A<!wIGVPj!I?tKIWJOAbjtF7*X2^7$fiPd5(Y0wnF
zWSGrjHq`a=qr++oMZDD2)fGKGeFzeMgXkC(yfv!~LXio19Jj<Y*D-0U=uHmsYIj3P
zTk0??{+n?G#4tPIyo##K{ejQEt(38N*LKrwLGr{t4aemRXYNq>Nw@g|(~uI?<|<#F
z7+K-j8X{z|Ebt20c##X!JSsXt-Uhs$liFqP*czM9?Su3ss_YFf(L!l<PjhDVjE#>j
zPigGCEXXQGN8}#H)(kz?!wP?l5IRWkv2*kJJRIrP`UpPQP4giqN_{^Z4Kz20!zS9K
ztR&jDH8<vlT#9*S4^!?G)DLrm41*D_PFTHO1cLVGd|2o8Pw>1`&VE!GIP*SUNJ27>
zZDLcxKKSSCnw#?*TgllUw+1#)nm24_yd;CwnB89`nf%?tucy)@Imdio>$GPQG*gJi
zj(&s$Yb%E;y!g`Hoaf!OhAV4Kti%fFH$1&k;$S;5bgvt{EY`%DKi0F0cRyo`tFO%P
z4Trxr+TOQ1i>@AS&GQkzoSu#5z^L9Le#B;aHNDU~E0wE0TZv6!cr}^~CSpyiP#T+=
znOR)C4@^EeKK6UM=obw|mQQCJoSU2L>gpOFKkFy<=kqw<$Q2G68XmqqTPG$Wdg(?H
z#K6XeW_wVJTU=a}Ph&AVTWg2L$x!{!@9?=F&ERY`8+FNTMTp0qnaS={Rna0l{7<Bl
z9xme{{`3KHdUADI=W!J^H!_T_rqa1=7x66_f}(?BtwBr7``rG|Gs(|xp5oOT4V7@7
z@8!nlk&D`k^|sEBZ}7((_`vKo-Mbc=-<|LKkO@M)0sXZ;>klV=biFGg#;x36lhM&W
zX&fLRIJ8k%`i0Z=|B+KZd|6rR+9zV9AIsl1i>%}C#_QY+`5rWfUH!&jIpZq-3sY>r
z%cYain(j>eRcoX%vfrap-|}sA%7ACzS{p73=9!6frmyL~b^)NFQu}L)c#rlKrX#SU
z`rdLbxRL965u~RY)5^xaXKP&)<Zy8C#htYX8w=Q%Ex*CSMPd@vrgQq0a&K*b)WUsR
zmzfIf@-QoiGI-THoJ)`-<m~q0wfgmefuqQ0>FvE;dn$6~7X)O?$lDAZ7KG4{7<&`1
zclD|D45ewP%MM~vC2&7O##6bsMy1bAV`+R2i#q6U13tT>0gJ0EAS*$Vp&r*sNmjKI
z+#xG)bc)%0o@;HMa(nHVP^^d2I(V$+BhWOD&1$Of@bC~y6D8AWLK7dq^FIhCeNolF
zetl(O!TW0TyHvd_+yCVrdcj%8qkVS>l7s|dR%{ajl(GR6r+NCDy7el4`d3l_Enq2d
zJzeI6zDhNLT(WYDfbQor=lceTm$m-C*=<qE1iW8gqwm)-JtN{SUqUKm+edjD0~^>=
zdVIMZ7gv?}`wG?;>(9V`*89#|nXmF*uCh9pIqmPp7yY(&|12ro9oD{jS&S@sjK-_T
zu_7Qy_6x%*c3!Xae49JrlPw*O)qQjsp0a(t?9Co6AUsvocE|rLgk5?xblX=2<>s=Y
z|2W;wq*NR8G~L>5Q^=(}{&u5iZh=YM?elDEaK*KY?Hdo<Pk&%Mw_oMr@XPDyQ=V6W
zHy%!P*!R!wEffiS3=<mCdXRX&iw<q*+!-WC1KMW^+DOwoU%fR1?~Mx>jp;oe4ZU|a
zw>unjHzz*bwKv_^*w@SX1&JITx8<!iPxqnJX1+C6BjVkuy|7==FEe3zi%!7v<W^^+
zEJv4u>bTs|s-pPqizX9LZ*69V94)-Gtc-!4{uHahRS^g^vb6N{o5R`Rp&{#)CP!vw
z=J4?Fs`i_uRA!SDM*YK+lTo9u?@)-^jQ;$9axuMqeOTDott~BX!w;@>|9NFAmU}bW
zZrB|8_3U<8&8b*SEjh~(^60RSl==wHZtLH(E~yD_@+kWD!BumM(Oj0N8L9dg7ZVkQ
z)2ju##hAVi&+EDeJZ(VnmN;u9_UMc&2F$2!dBuE{F7W2;<n>Xo-Z}yT-6%9*a5dOA
z7Ou`6n;TxOs}J~N+**A&R7P7QHbrYs;yoD{+3)Tk=yy5->9ET1m$h5t+$Yp-<(PXe
z5FCGQ_U(_4+)w#c(6NeU$mrj!_QlQrv5Kto+2QDqGp_+##42$?YLW0rtYAhj9%`54
zHPSU!f2KV6?g@mVm!uYld;7>qck8S#`XkGGYCy$Ki#`QP*C<iTNlPmy9UL8HWMrVD
zLP;P_hqWSE0C~a<5gs(iWzcWAYFzir`1(x*8bCwirh1=y$l;+iDGLV&^2d+0jg3q+
zG}6$QDTiFAaQ~gzZ&YhwJzqk49mQoR`fg$vX}e`T<6rgLFC&x?{<sRPB@YxD@4j*L
zl5?4-_(`F?tl?iz0^}dI;PO!Pa~ONN&3GNn+6tM3l8O2ue~hl&+%z67Y;4Lj<drLd
zz<H3BDnn}2oElm80^L(R5Mj9AsfKI1uN4su-9rS;v=<oB?vquPux)Izg$D7ePU}TP
zY}^qXW?twh@ZIf}9W1G0%7|c%+}-UBSJp1yKs}YC<h5jz{7%DB+wD2cfvwIowuU=7
zKhiVB{l(|yTi=SIpWkw0f9%(W+S*G9q_m=9wZ+xO&aPtX@~i9N%wQrFD^3)dWXuRO
zVggSU`3Q9K%c`y*T0_aW<p#URurNz&>!I;+>~I~oCn$di_wLi@a4~LfZv93Hdh}N9
zKeD3jMD~3#3X`kY;9IS(<%@V_$Hn`$51_RA_5zEI9U8J#BD)rfZwe#Tsd^9sR_?-B
z?R{}tLzg|UAd}<K;DGu04vlC9dnFC}UM4qIqONEN2kbT#isSK)%~(rxAsY?EBVmHa
zXebyaIyvdQvQK}ksu7m}ZR(7KqbeBScW*6WV1=ZO5d0J2$)xdb5xP#%M7k@*%zw3A
zIq)&*C$SGI^HjzC=iCnR?S=U=&9lKWDpJS3)2i6$)ms7}5QW4u;GwOsb`rDHEa52r
zg3}NzcsDtAsb^qNZ{r$Q<WoX(>!tD(_zaC*X9fWNyRp-_Rae9}xx2T<*EtZsSIG}h
z7I>+su+HUTtJnHxG)tP!;3ZR=kXWnR>CE)>QCnXcJ$_1coT0X2A(u8_?($x}k0V9n
z6DbP|i`iPn++31$7p*Xv_N<0_iUrY&qpQ!6Uuv&otu4shrBNX9n~%Goex?VD0Ppqp
zrpuO;{Rk8L@Srz5HN+0y$`W#oh{K&;ykT}=fr<I{ekwUkIXO84@00qTo*pO#24#k#
zhy@J{4c8|p9s6Sl<KyF@JmK)bz(SK_!Pb&bS|4zWao4n^qobp}-M7>4d1g<RorT58
z)z!|{7UM(f`MiZJ`r~3ZfYPzRgyq&<pH7FwPKJD|*Z%b|0}ecN_Wf$|**nPK{$ZP2
zfbbMEntf%u)h!Dcw^qQ*Yex$j3}0(yHIOpp3VVl?Ic<1i|E_5M#(ouNl#G;faO0Q%
z_obv9jAmc=7;N~cNvRBu548mx<=hkmkd*OrKl2kkQG=1CUPFQ{jv?Z!cn`rv3ajae
zvQX0L;JKGX;GM4f%arT9hWC3`1<AEslEmy||64Mqkw|`2fW@Jp*^gM)<xbJ}4%sns
z8ongZqO!kjcd<u?#p`4KE17Lo#MMB_r^|R$l1h|GB$qn{b#mg!5jH#l^#UtYrk5Qs
zX($!&Q$gXt^t|{SEIK7hwW@c0FuptWLvfGe!VXQ4mzV`?fIV5WuMyN;4#O?e5LYhp
z-Jh<;M<2K6XkSaquVvVb%Z8PlK7niJshmSr+sDPkWp=8!{d)|hM>kWXqO@Xs5xfx;
zk#cT)0?Hm}($4oLMZNu_TRjATspZ_=Z+^U@Gn4%qO|`DsMn2;v#Lh}g8!aPY1^&r~
zEs#+3;ns^EQ4jWY9$z}!y?lq$9PMZ0ibM9WU?`c`{N^Unu#MH^+_$5NqV3Xgkb%r}
zrMS(=`J18&rm~5So~>KY#<#4i-BC7YVvZ%>xD2+(*|Xh@m<UgCb+OU@(Y6CK8-H1h
zp)gyC&Zl)wJC+-QSb-c>`<>Um2kxN5#0H-xhK?rBWnOt-PjH4ikj^(1iMp~0(*GiO
z+tY72SoV$E3*jNO?P<ky_^#ftA2U2WHO55H&!TcFy}`r=4u;PUTAeuTLCF>tR|bMW
zAl2#Oo;{E1p#tMt_`L328cbmsIpgGRRRS#0Y?0B?QjE}F>9<AKPxJzd3g5qyrqlvj
z%ZyH$I*0bTDbTQ-;pN;dDC^k+)N}~^X(zdS7T4y3(y{6Gh+d8(7n;h&VLMQ=IPJWZ
z3tePO{69kr7-(oLwhO<YwGjrLx`SB37aXqdMpXvwwsv-g9-BXv3nWgU<P((Ey1%~{
z`)k;#si~-B5?|9sT8ZI6YUuz#qt$dVl!@t`eYUf*wpJlG;JqcAasFF6SQvE6Y*l3g
z0JPMWM&)g&HpTsJPfJ<(Slm7mv3d>UzQm}-XZi3z)V##I#tol#nohf^yq)Hhoycw=
zC;JcHWx)foF|B>m`f~g!!R{v>Y>n{*qK2OAE6eG-1I(uh<`I=dOD&vLg7C4o^91jo
z#_h@o@#v-$pW0aWrE{bi;L!}8=BhfQY~Mc~sE$AG$b|=MQ@NkC2|S#BY|RM9ZZ$J0
zH|z1Pee;6ac*UR?8!L@H=5-yvb{TOc+Ui&3LCLlC&7iQ`T}H+C@oFs#4MM!SF6-G#
zv65(``9hl6!Sdrn?8!3ZvYtos+iM(&8*Liw;HZg>rd=DQOXf%#U(urp0*pS|Wx|-n
zd_CXyj60dI$fZGyX}cY@oYDQn9aqTI)X-6A8ZPQAfZW#qWSC+9?77^4X=9aZyw&mL
zs>-`daPesjW4zT+0`r1S!1wGiYEFZ;W-MonhZtM1x6@$wzVy7Wp`MsQz*iDfNX-DE
zW}tCeu1?G7@USQ?c)F26`{t+cgn2(}@5yno-v3-9T<yadBP23&gDf->`AXI-^I}o;
zry$2GP2ZahtapiPp|CP}47E6V-d{+|-2)S1j(QX+7(fc3Ui{~HZr1zpIul(CQNxo(
z%xf`MOzwTwsU3^o$(j3y;X72uD7CP?p8kvv2g8CoD6a5rb(RJ?E>24yD{=Q(hjy6G
zG%2je6V4`<o9kh{-eB8|^)=6{K*oK&zL!>-z<Q|3jnx79IjX$;X&%cOseavu&bKu-
zPuO^JNoK#TpcCkLxr8IJA){{&)nHg0-uFT4GDmaX2nIf$EVW%o9dNR)6lp&SW<HPA
z#~H@Fe9fyMxAYtuw85w|?W?Okh4lON0UAblGk*K7&g;h|r}tLTDUOy^u*gJ)f78KR
z_PR%Qv1H9!y2&S4_6k?~Eib#N5#HQ*mu$9j*Q6ydJ+<11fFxO8Tl)wtR9TFqIzHZ<
z;If*R>ov2mu_g5yGvh>c_&ze~x43NeglBNrMMOo($;x_f{>0Aqy;;;W^iA&G{E8C=
z<z3eOUwxszr_p{DO_2JY5i1f(<v>GQt#YDTNY>xd*VqklECGE9;3^9G!oIuLb_mpB
zK6*G`16bR26>3Gh$cm%%+AZ&y*V26B72!L1q`+6Yq&t|9!?c*wm?i%TfZ7fw;%JuM
z^4K?a8QKq*L)UgI1Qkfc{KC_z=*~2cxDLduMXoJa*oKoDzTe;hhHFNa+XD^uHetnL
z19V%m^b7WLOB%{5e}?H$@qQ6x5!5r}Dr+fg893}6EZn?{d+#A$ghtkoaU;J#y|W8Q
z)Q2Xku{Y{*AL!nSkT%8v$-0(UB@{`^sdth&(-*n8buuiyJAME(Nva*4rXOsnZ2Y#Z
z>09zDB=3FZF!f(s`{tJW_5Ie!NBFL~=kcfY4eoC`$N7zB8o~ha+V;a%o_WacYfPBP
z)#dz)&|6F!zkhm#e82mDRDE-NT;IBP+&F14Nn;yrFtHokXl&a~8r!yQyRmJfvF+rY
z-#Pc(d)|L%=Ck*jS^HTJz8F#lAy+Q?;z93*=#9R=+D^|h-!zsraDm1N2+Fh2asEfy
zKC;cJFZ;~e#``9-^=Y!L7GV<RWCeH7<Re`7V^tP{Br2c81lZ>ASB!INQ{AZ>X)lhq
z1fw%=ZsRpuV|<$K>Wxwv4%=4y8Kt?u)1|!#WMiW$WVt?8ARN}-5q_Vi69PmpHJljt
zMf)3^?Q-fm!YYQLCS1d!t>2!s0aG(JVcod<TA|}qacpfiGpoEAj3%yS-mJ-F_{$U(
z7F#c2H+xgsW~~E|lyu8ubDV|=E3Lx^n62NwC0~2@49jp9nqeFcRH=3DdrJOd*z1E?
zD_<%V=W6;jeIRhG1q!u5Gu%Zl7dDeoM}(|hE85`})J&{)(XkZ2C`&6aup>mettC}@
z+0@(3cG>d;K4+hcAxs1qW^o##pxW1?KkL;&><kHfUu*S-=$_x$jk^%K)RUe^+aawE
z*%*mzFGi)uDB0zH<x4}C%ER4fG(#@Cq~GD-_j03RX7l~lPnL0KD<fZfT)CD1S#gca
z@CjV%jO;L53wN)b_(9>H;8ZQOxo*!YxrjSuNxVzP>FvCKloiLx^8GtDi|Mq>mKPfc
zhXsvbLD;Y8&z~Kji7qcMuN1}H@GuoS`|{e_YiV)TDri^>>R^D@>#m@f0)4W*z5Vm;
zb_xy-4lT5QeZ2z&aDO1#wXS!6eyq*UJA!cLjYj*8lP#~<t^k*3sg9VE&%5Me*YdwJ
zc%tKOc1mYuw;aiPt@SV?@p1kc!#Y4~o(!ejr*U?e@r=*Gb-VXpC|%_1%zV}FTOSr-
zmNlurh9eHS7cL|zN?V+5`+|6i9W<i;RC@L5cwXLzeB4+MaNQrjRqt6A(?@-e;ButN
zvH(7>Wdpu!eL`(b$B@Nkgxjezdj>T;NW<~*0@asqG8DA*4r;T#U!Irm+lQ)*d8Zh(
zfqeZlKTGdT0HUyu)f|N__hq@SC0JW-Hj}6pg_!HkM;dyk3X!j}-nZR0(pH_?Dk<o#
zX6Hfq^bYtbZaf?=aTBFTuMXVWD_uoKIN&=Ib6lT~w_WA*!Hq#xf0%WAOfH5OcRKv<
zy!a|Mzr`1;`RDuekIR|6Zl^Dwe3TPOZMIxxzONtjc6eP%ZHgKK8eCsh<Ecf~jEf7r
zKG#}ql_odh$xm}QBzZl5sKx4<V;tapJ_nx%&;DvIY+O1zzTHas_E!vgh*!IYQ~RSX
zBeObUO?<xmvz*V`b4C)a`yvqqWht26ec;Ev+}}bx_!q~yy6ui^?dL1o=a^=1?RU#D
zBmIuO>`5I=6YQ7cC?i>#AQK7e?9Dc(rEIKQjJ1unts`oOtrV`d^QQH>=C03!s__rT
zkA^1ly)Ct`-3O5<(Mc%kcef`d>xhBJ6PWP+I$m?Z9&c)A_csDzU>C2?mMCz1r1|qT
z-PP&pjN-z*RngrXN_;2Xr`kRW*Wb#;o}PpEFlvtylVlUVdo8uS@Bgvs;Fyf1sjI$4
z+8A6MI#W+i7%11{M1J;pxPY!It@8nUy0o-~aXqlz19n)ZLB{(r-5VME7plQ`g=$Sd
z-YaNtO3^lkYiQF*E4KS4E~aagCMv+asLn$nTq%o;e#a(H9}yXa+R(SQ=cvj247MW5
zp>owL=>`d#UXh)hv$otO?K0jUJhDudOJ+!`5Ko#DsF>?8$`m=nn|}hiIh|`l441ND
z7ark87KgF*#8r|;xpfc1Kc}rW3NRuGan&k@pQH_H6m~;e%nS-6KgI6d)Ke)F%Ji96
zBym`226<^2DmT(oT4=dcZE_V<CdV+K1}3t(6vVVW4B92UE_UWCxFaV8VeVpu`Mxn9
z!K8|6=)@#?X%=!;e(@=#v!6e*eP#7geyf%;<#<_lrMZ=Jk1G4ABNQq~x<?U#x?m$$
zD*j<u-}afIIv6@EA$>Dw^-}XhRrme2M8X0>pt~e=Dguq|Vz^{vd|2tDh#FczuD@h@
ztn_u1<nV)1Ld``PV!lA$kh<=6p|F97g@nmHK+07)Dyyr6fn7B0W99p0{X!m3Y?AZO
zQikHzjY9b!c9Ys=(dNa(+!Vtl!{c+|`0;QJ0JxPGYU`*o3XGb>AbW>CMDhD2=ZEGs
z2cEnwcLfnY`NZm6H^DApo9`NF_dbJ7R+Ri_lG<m)R<HLFsBNP2%9?c5w!9B_=+KT<
zW8p_}UTe)o99t3{!Bc9F0|~_5U<+w~-Nx{pq88s0KCKBcAIka>?!s(l8z-^i^c+;X
z9*uwId{L7gl^yJ^W9@#9k{-R}TfJOgX0%_)DnviyXqRw0S(EL^RzcPseKr=_%s(Yf
zt6tV?9ggMZHJFe2ZkNN?t-9>g^;+2I0jdqM(aBLnC0htk3FvP(la;r=v}I)bu#V<e
zbA9Z!eXQ0U#nP*Ork#Awj|<b1RQ+(DF>HVqmhqMV;E~;-z{Wg*A60FZ;NzRpt5W!s
zJ5s2*eYH8$K2E9b@$`J{eWDKo5LVdKHGdU^-2iZ}_&EQK_^9N6bg2|={sM#8Quo3g
z{21-l-Yq)~$aqO7g-1cZ#W|!$azCiAFhQHdG&_apC&{{n?g(l2p6smCnPKL-$*$#l
z5mR687!XzE@<DGHV=w2)jp~}L;#G+1TC{+Yhm(*L<ifE7M-HB=H<2CM8yy`5VRHoB
zuC@o`sftBX#~bZz;R7eDji>Rlyc{6h62w2SS+3a`Ph|%2l#tUWs!B_*@9#6e>-8E$
z^8k%T6HZz5faxxmn^xbkUmnhJ0f0q$(Z$@0%Z5^c{Q2pgB*aKqb2mr{c!MqJPNt-}
zg7v$>JgY#KD{}c8qS1m$?y~h(^R6P#^Y-{c3^1*Xv?qCmD(Ev@u~Lc5n{=mC7M6F{
z?C0yZLJueYP?*RV7+;yxe1&sa&E5l_E~2vQ4`mNm1OEX*c;Q*^JY1P&@xY%bG_n(P
zlcSuhPI3YH#BFy!lV%~5O#c!ox*LZ&NNQw%%&eWx-t}Bk5|VxO)lT#hEPmP9z})n|
zk1vcoPas(7DuplTGx%B1b(NyvVd#)o{kI-#9|JdnBR#oNVpfA%{HLKD7<O1fm}1&I
zii&+8?jdr~N%Y07k;UT)IMv8^H!4C$nt`Bb`su$GaATzfh1J&Mjmri{La7T917-tF
ziKi{uRhi4lQ04NqMjJth_+Zooc;85%`UuV7;Lfw;TN;IkS_Q>hjuf&cVfpXlLR#_4
zqJ8^<(#qR6$|Pmfns!P8F(mSP$?uDqL`$buK4kp2>znub$<(~Jp0x$T1~mwaE1G>P
z77Z^ZRvY9@)G}N6aai0HxF6NbHF5*tBSZ0fD0u>jy~%t@56#9u+%pG$-gt-$y<V*`
zQAF@2HW==R1j3bc-IRQxz9oboIIgf7b4*GMMSy8oR9RC?;6lRy(2}1~CO*X(u2oH)
zGM6Y15JjE!&75hq?>ZRu6eM1<MY%O=%!gHI3f(mXbteKcNk~PpUa*s)zGtbFF=EsI
zLUTeh6GH)ii*4Gm)u?jYE4wB^Gd<7kHzF+5I$^-Y_^IwKDY2Yh<!!RJ`_;2#*4Tuq
zZX$36YkZw|wnVffZHt+i3Bxg0f|G=TMl)}@(d#hu*8dCo3FCK-?B{`Yiw9G$UPEF}
zjZPnfRoPMDQ`NzTyg!n|htvGxLA+#G?smV)AnFz(#oO4OCT{vI6@YgF#9IYYYq5#y
zg5D3#5iN~T#gSo*$(^^Ii<FuKyP_vimfG!%ijUg*@7-zTyEYFDhO7tHTCI-B+IS2I
zXmaMlqeXoZx54+H>qkt=NrFSsC6{e4L*0g$cng1nqQmg%en%8!{z^>pjd2-*$A|8=
z*xXE+h(k^cZP_pT8!+xgw&5g&m<;vOQDz3w;5~+kTW=*$C--$IXSoeXz9-c?#MqEg
z*JCeI3VHoAH0L82VN}{eg(4dP4}%8H^(65XSd2f@^*T~VmCI8`CtRvfJ2#AZA3xGD
za{3cuiDO_QmRmrzX+XC_!P=a=*2)3!vy)eO@=Hy^!G|6)9v&%2VjicCd96go(s|%n
z<r?PvRZ5RP#$ya>HgXA)D6A6$YhxnoWU%$7QhL~aITEF}lD6XqDwCP`8>%RNVKCXj
z#K@<l#}@BFCc|>FlY0?afr!KIQqXH+PVJ`~E6MananwZoATRkVug*$?L<0#QWjQg*
zvX6wPqflnPs@(jXtWS26z!xwd{1H03=n!+2){$uK+THUJD{L9<%8_-|BX&(^wZApf
zFYm7?(XfX`D+Y_S-bz{#Q5~7}_19$4Q+R~0N=jF(-HA6boljeZ@#*9J?oNNg8awdu
zpB`-_jD&U@FaJKxAbA`hhq}41dkf$C&!wMR1y~P!;h<3s_LVac4E=(LsdM`cd7n@B
zsPU7?%@O6oC3vq*cG<G&=Egp)$c=kblCiVF<Iy@&q~87hBq1RI8UYZ2&$T#J{lS>S
zPlU~EEamL%EG{k%VkkB@yC^BmgIJmr$z!ZI(&5lKX=NbdIf%R3_3>iC#?}nt3cNh6
zr*8>uE}1F5)cxUyloPy0Dhe!M^=Lk$E68<Of4!WlO~#v@V?sOZOiXJx7|YeOpu8(W
z@Rpcp1iOp!c<kheI-%a1>36d!V)1lAPI}8se>};t@!WlN$N(80jI$yn6&GFdvUnf$
zcOikR{WkV$vo|+ggDFvrEAfsS$4@&WEi?PQ?+N5Dl!-0O^W(dl$?cuL8+<~doUOa(
zN6M=AHtJZG*LHW^Kf^pOBZa?rHQR&rS*20G+A^x;IYE*0G2K5?R$t{diWTM!VFDBs
zn^h8}Ha+YeKTK2t28tcDWfzT%ON#=>M&cS09C>Pl(U-_4@h$nd!;RNwInr-%Boxo@
zwOauaT|Kb~^^YfP;l?%!6ql0(okU@?CYPhr;Bq%u=v(fq+77CvYps@(LFngW8BOl6
zUVBN^N!Gu<JIqnbpV5Xo;KCfAR-ZV(%s(Iv(f34aX4KHFdea>5CIm849MIG!9P0OX
z?(CKdW@47;-7a<FD}Ht?Fb#Kh(J~>^7LSMu%L3r&!x{v`<p69JZT)WAxV&U)o_kwc
zOrjTR6@%{iLizW>O;(C2{Os;KZO}g+&`spMT8{!N%e+R+YJcxlZ>ap@ia3bUc-V(H
zobOEPh_q_st?n~d!ZM}vOx^iR>ddGB$jZ7}*vGe$n%|v}{FeQU34#!L(U;HNlw^|r
z39c5Vj6-^rZ%oeMqKR81kE^X7laWh>PkT}(ruk4R@o>=88v7tdUxsuGIFp>p0&<Jk
z3MjfJJ%nbo+E;b9%$mzrEMfEfHl|lURiiQssFv?kF#0~HTj<c-)qbGXv(AX7@3A&@
zd|VKC3oIsBh`b>Gib6>KPR+rlyIX-J0(UN4(W=u_XXhgD;IdZVxx4jgYy4izG3qKy
z<&=bd&5F=hnY3Oxw)q^I@gN@OfQ;((GRr~BjB+RgADySszqNa3s=#)+h@94L_q_Z9
z>C&IWSy=o<6469yfCy(H*xvJA(K6TYR;4OUw;Qat^@YO%KUA1K9h8o7oj%oGCc@>T
z5EkTbxTz|-So1{+VXj#`AQBkFwQe7b`-U6&q>>l9BiW-)eU8g~M$#}le$fwfn~i(N
z3UnF1Z+1yaRfV`)?0F6WU*5-zZP=@sXNbto<zsWFsx;pM67(UxfL;^0m7;MAC)5C-
z>}niF_7t@A`?tnoY3VYpUvuUp04a}<ODg9@&25RSgwQd?y0J*sDE0FSkpY)qOe-_h
zh`;fNpak9_?M8kCT=3z!Fe3YQg4I{83N|0J4mub`hH{&^#tW?D`5g204(pte&Q%`X
z8?mBl=JI)rJXiRnRER&s+<gWYU{Qsqoi*1<t;IwJ?h>NwjJMT+DHT=`<Cn}~WEQ7W
z-UPh&LRmexEokNpTZ&=8h>p3h-A3cZR@h~Do2jT|G2Gb6r@Qaqxb}Vsc)k{YX)6MG
zj@A2$J6!cWqIkFPy597%T8K8{y)R3mdFC4>pRCUKIU1#Q<vONpaY-#3`oWjUrc9&X
zNjp@WA6wxSM_VU9Vx|CvkJ{GX_Sp6Z+d0EtgAHma7#XV%vwgflbs-29Zg)PXp`*(H
z@o$D>Ne?H|DPzTu3AmsBd?C!>a0ntB0TG$i>y4!|*kgzGYSk(hRowKk4`vG`L8=lE
zpq%zc7aK(O0G*wG)sjCq9dwGNbEB$q!MVk6UN+=P$5cwpa`Li5U6AKs6rSYX`a{M8
z@RU`uco(x7#+Q7(ewPG&J$wVtCwVP0mF4oT!`P>40E^R$Rb8}wK)}agklLtL_<Kxw
z=d{@kdUfUxQub+NnpEKG`kjSa6On65#|V+40u!A?n`Ay`tcq@e=re>?#V}og0982h
zUb$kmB?Vsd1Al$!fEhA5M$I47Y1}kVZz5rZ(%Y_BjJx>zhjAvHdl4MpiD->DdqeSf
zd^Nut^q3rG9hP~~5_wEz@NYQibKN^vRN{B0&ruz8L&eB#nyICAV0`wDKle76spH0e
zH_<4M;x$s!95pCdK^);TTS@h?8!^hy8`M=&)~zP8S>2;neU?#d$ULOqsB7HPIJ$U)
z5$5#gROf(GAxD#d(-q=0`T^j@bro++maL=qo}jL5TGC?3m^2pc{Vr8FxF!@iiFq~7
z#(@g6*Nk+B7CovoEek&Fy}6|ONUEoi)l;}W86`Bz@43a{ip^T6@H}Qt+PNQQr3JZl
z(Oo4p(+=cQECpXG0g)1t4`CSBXLCj$RmCI+<9Hj>Va0M}IXSagSZk@y)Sff_gJR-U
zz6f%{OKRuegcLZ>Q^gKt%0Z2f@lMHeEz)nSiR1~^0{$cES@P1gNAussba)%>dTiX_
z!oB1}!L;!j%7TyH3M97UVRCVcCxfgo8yt{G4S!6*!yte<AFGq3l`i6aRX`cj49EaV
zwC7l8*2c*Qlewq#`i!L{4SqSRnrT5^IK!={{&`o?rDN~8>E0t<!n%)I38BZxRN!hV
zOL6%Gs6xHU7b_R8wfI%!aaU%7yBWW1$S+GgKx(89Uy-Dr7-TKxOXDLo>Kv_oUofto
zHBv-HAiS6|L2vGFeitZ=wD+=-;JMiZIl0GTj(|{i;|Nd~F2<8THWeT5pLsa`S^?O1
zBB|B9#1IPikt^U|hPDUQ1ejF7%9VEVR!vTqTGBOhMrY%2lHURAcwxL2-=~Sl{={X!
z4d`*6B(h%z{_HF^M3b=$oAw%>SR0yJ<6zWKPQBJgy6ZI8XD%1lNvQ6&^jR-dmD8~a
zZ`EsI3m&>$WzjqSbN^5bc6NI=pYmCiV-{anrdJA8<x~HcVr0+5ot?SK*|D&+Dfb4m
z%rWiFB0{a15nt1|7N~VM@>{6MOj>uWv{M~PTx7Ov?8UvYcc$vkd`+|c{*>rlbcnS*
zenFP(#8wSMo}D~(x%lI4@MTw{fFiWx3|nZZkl<nyRp>pD%@cST4?e7;v{mLU@lg0&
z1vOx(^SM&K-Tn1|l7SzVIDnHD5WWwRzFb^rtE#H1tAE45XmCDX1)=@b8jUm{awse7
zz0c=sc64;KOmV$NC5Sl-QW<2i*<@vB6Q)l%7idlx-?AP8S+NoSp~>5B^9u_PK%#Kh
z7*C`T@VKwf7|dwV;U#aU;iSBBS)B}Ex%wB4nwGR(#1%Bc{Eme|h4%nHE2LwDv>|{w
z2H7)fSy5MlfeC~o1wg>#nJLm*&8MF`$W7w6Htt^_8NuM-%odR~|4`JODYVi~FR*H(
zrp{atT_m#_-MI^kfL|-(%pD(J5{>*@7Hw2!iuysyIiIYg<Aj%lW;DpC9>%RKkUN+v
z-T=g<7goS1&UKoNU$ajFqph5plHf|Kq@$u^FLWs)IX!yuP>T<Q$$|1O%BE}ahOjm`
z&lk6;0aL42k&4imA)$-k(Jv(5_Md^^zej~ji^$r0f%jU~=2=M+GCfz8Zrkt!nkT5I
zextmBzg5;a6s1gSdQ7ynT@R4kZ}LwlM4#(__lIZ;7yJThHOQ@mei^D(KPWM?b56+4
zSKy>EMiMYu4asN-%STd{BP|^w?G;U7l}$q4MX7%*O6|-T-F8W>Bw}^CrZ7tyapceX
znVM$@HFJck6y`#TibIO$OqC<t&F84w+wC14bB1sJL~w_8)f`qdH#OK9HDOW#T1m3Y
z96<sSB}5VOh2ArBXRufT_cf0T2FYLP3w@4Ew}y#yzQ5&BF{#sK%iuqo)f0rA=uP=%
z)6XlxlfJ^?2~Wc)pW=GJkr?FH^T}#(l8a-LBnOU(a--2-uC01Bd#R$bSk+ufTq@%t
z8lyfz$LPwlMR!Aci;c(M^j4l8^41EoPzf@`kL43K$pSSB>8Y5W0#;9*=~w+p>SbFx
zeq5V#<kP@hlZArOm7Sr#^!&LkjC2z$7cO2DicZlbL@S#g-NHr70XSKAMKR2D5+u*k
z`FGjt-R4#}rb?7jlFM=q-p>v8R(SCl(I6;87e_Ww3eNzJu<*xiLTb9lza<KLWr`ie
zEy`XmWb2Ci^`tjoBeJscCl`9xO5(m%JLP+D7~=uU5Lg<%Q?T&cjwB-lx(i`~mBcj{
zsKGF%08_@b@}XlLoWTR8-vcL(7Z^hzhQ^Q0mAlfCP|U6;C9!;NKgRc?{%jX`4ixo&
z!)V?yE*~_kC<8Yg*HB4kOvSm7Vqdr3Bx_HzlsZoxLqwA7`|UMDhOl9Itv(xmI0<g+
zX+{}EK!`cmsnQe$U+PnA^-IeVT}5$c$}F-}pzUa=AkV_mh`UQx{Xt2p8n~}#<2!-Q
z!%50}9_%tVdb)M#BdLf(F$C4*LYd+0NR%w<WapfdTd}U`LcSrcnt)B4e%_+h83}TW
z-|&F-zq-HQzjj?%SfG^6LWGAW5m%syx7zCR0?|1^SOQ3D0g?oP;D>1Ln_;fY4s;BR
zzhWs6pg<24%yqqAP^G1%_44$@@tInFzhBY;k%2(;A$Sy&Pmsodl!OFCzmkl;M{cX0
zD<ab&dw>?MRdE_*%2f@gA$t}4!FOCj%nXQb|FAx>u~>V`<ngf`Kk}wGfkM5*(q^_3
z49zoP_?mi}_BJX_bUwo_4>G=x<JD}s4<LEPD&&<)aZ`dM3JXiPS(%uv)K#*6)!it{
zcfZ1rFd`<+3I)i&c<B_GYBa5!*r~}BdNvpvX#9|dC$Iasf$J0Q4XcpmqdL!xnS_w~
zy`zA{!f<cR&|JKmMj|X<8=D7kKyZg2IG3Q<?3qZEWf8!|)T#2c37&;bVAljNxl2e9
ziDuSuRO;oaZI2mOu5q()(K6Fo=>#cwNR+Z?)R_&HKuZFoj$B-#!K|0=SNwNS3X|wF
z+a0|fZO}?g@*e1?q+~ppxHq+J&8bz)#(Rf#vx80+(Tx1WQE?QyP4>POwn?DUw%sH`
zYURmg75ZnvlH98oX3e%{lWQ6zfrS@sH~gV&v77HEH8{d+LyltI3P)W3Qm7xtz?onC
zI_T5n9d(Cu7`%uD&@S*7Z0Aav%9E^a{t+_7@Md}DX;6Ejrec0l)xXp&n|&|dJMX=8
zLOfLE$|N37!1|FZhZ88&H=vZ*CHzMJJX%z>$+3{9N{yNN8V9VDSY>q|Pz}$g$}g(P
zpp6Zq_OS21uFXdQHAEVwI(XfqrZv9pY>%V9{c+<7c%4(jsKj56(4=#-61dToK5N$t
z=CGgT!-1SdLY>IJMbr^@#Xu91bGy&gKtftbQP~JLyAzU7G1wF7TY%9DrC!OFn_K*-
z{)>C8+N9Ypo&i+@2Pkh%xnm@X%#%|x<wv;7XtR{`yfURi;A=oIERVR0A6Qw0d%S#n
zm(h^hafK>rV1t5F5FiR3u3sPpb|ab_N^eGBou%--sNkvx#SJ}(<rl=TxkBN&GArT*
zAn;vi7+lE3XY_f%Dpf^G1m!R5c$>qqXKdRJFCG8U7&vnDR;3=AZ{1t3zG8u_(CEE>
zS5<=>o%V;m&9EIJ^CJ%0ZMG_TrEJSOh$6eyZA{SlB6(Y`gg2s)@bj?^a%^ZR#hkW$
z?Y+#|iHMD=pjmWr;3e{SFa7b5=iYz4%TBtL=~+}d+&tys4k(!ES9-GRvQj=KHBf~N
zMeKNa1X5>we!PS9piQ6*JCiT!;o*S}H3NbHpPrs#NkzRso)7;Kv7N2d=jZ2(&$?O2
zsjHXHn4+PfIbUviJ>TqGZ?r{zV;)>vTZ?68O_c(sN9Ix0s&N~SrzGombA11PMKGD#
zMr4)d`u5nr*X?4PUwMNu)+fvr?zG}D$MP9s<IHHJP<$>q!6S@}Gf2+E-$S{RA@G^}
z4aWq(5UI@p225d_l8DC?91ASXMt8<+QX@lBuvWY)20{0)V{`^kYjg3k;W@5kCJxuK
zj{@?GDDo~f(=BLf5|BCo=0%#XL2+q1@j?G9`Xn$vxzcBYBbnTbllpuN=p1hlH!)#0
zP~f>Ka)=QI_VPX|jWmVuA~s-{bmEwl$0Bnk<}=;4{#jau5q1NrA6OdrAErvt-F5av
zHii!s!9+SI<)C|m9LEOqrOna}I<)AXx!BI+a6E=OKR-MV$qE1qL7x_$SwKK}I4wUa
z0h^2A+qy)4Q3;X9qe(i`ESqKA=w`TulUa_+3~OR!c7$p8h-=}^%8VH%XJu>>Tfyd0
z+?}+JNm}3yCFMYart^m1z8Kywx=6^moP)etBbfHo^mg9#I-G^>)109a0q_TQuV5K$
z(uwu7Iz~qKKi_$$VJ6HVN3b|ge^m~yzaQf;8O9mt&uy`Yq(S}atD<pw?Gjgc4AEwj
zQgcWsI>u?c=C1%qi<nojk~tS7u#~~yYmUULioCBe2hBvLs=qdX8BV)?9Vnt-V3~dp
z*g^(q9r)3KfWny_&p05)ySBu`H(Gmd5eu(9-M%haAT8uBmTc0s$C$pyn8@9pl#is5
zb)!nBx2hw(mDzftc<bp}1J25Li(FXOGWW+pgeaR&f_dyz7W$ebRb)i`sF8o5LsJ?Z
z>jT`6FaZp+Ddb;i+(Cm<wfRBwqgZl|4|aj>9Y04Q+sGW|f^i+B-%LwW^nYvT(;0`8
z;$z9Z|CyDO)=@VpCAy!cmf)o*Q@4$R0}uF-%S)D$K)q%1rzCOgaHUuYM#IO|M*~h3
zIKg3I?xhr|O6j&CX0E|Au+)OQlHe=rC#;iFYo$ZLx|7*Ld&`u~sH9b660<^fK2&TP
z3FKpSNd~feYgyXND&#1nx8xF^e=dchwo%4(4h`_tsy|2a6qannwP-ZlO?)HfeXt+H
z(VAQow&-TRc#}Ls=kk`Kf+K)XHz-<2xa~XWD8c;taliHpzL}C0;P`+~@BxOhj8|Hr
z*Q6*{On!-v%cTAnT9=jj(KElqlmMPhiULJqc9rz`eXSrnTLb$PdrH3Y*?!kwHfnm)
z8zLJ#AMoKa7-LaY<H$4EL5S(YL5L7M5rX(&{ZOQ;Ua(v*tEjxCqV1l>3oO}RT4u{t
zNUnEy26&X3@esyNw?C)6H0i!J=R<b-|BXgo@qQC~$1hUOY_RQkUintXKmFdZGwNpM
zNa=x_%eAABs28l?Sf0-hyP??TeBS1GJloR39w~Br-n=D~&AS0o3DlxGt<)I-(<^@*
ztN;4tak1VC8lgI!E^4*d`sGozYIcE6psOoe#_E^Xpt7<ukaT#?xSr>6-60%6fAjd*
zJ?St17~$~=TOBMN$O~XTnjTz7$K6_^QsXsAa7eK&WU!iRvnmFAx=Gm~nMDX1{oMp8
zVd|DuK(u3kE96URU><@<pkvY$bDtsJL1Ql*dE=#KUauv?sN~3SJkm6fRI&}w><}vE
ziL<AYIT**)mLu!vqH0xRnd#zukS2tp#=~Jv$#zp~Jq~{%ER4M&DtjJwE*B`LF7(3)
z`3Z4|81gc%MP1gE{6o#ryb_w9>|#UC)l`Y>QeF*A%tImsF+nugMsdFc=+zMW;!+SJ
zbSg_`#qLfHJ1YwyFT@Z{d{sy!)wV6tU>O<H)~@!|L*Vn^qWG=`7?qsj&TPBqZ*UMV
zK^RTIFlv{iw@zeMm4ueSxiwwAD-crcx+@I-wApww#P{j%ol5S9?R<*6qVnS~(Ge-z
z%wbdVOM!|q@uFNvn^?+x0r!=Le}e*hnPujLq%XZxkEhuaGeD9wC@zhQuge2O)FqQ^
z%pY^P5G=;*%!WR=G+8w4i@>>J_zI|6=6qQz_hnT-rWtcGXx%@pmneVf+eT-wz+RM=
z5FHZ6S97D{U}oT!L1fVq#dS(kK%b~o!e4DQn)BviW!K(KS#A(RQQ@?Doy<8#7wl{Z
z?$U0iX0+XHSNwAAdx1_CRN=*?Aozj4k*-3x+Ua#FpVGh`q_2~hUOqz`t^vsAT=F#e
zO{MnpLUyf-R`WXphT}@<mgS~Nl)FVF52iHkoe?0dTrpD)CqQ6UTj>-x-K>-8mWm$D
zE*mjl;&wK^dyM5VH2g&9(7V;rgV<#r;npBMNve)o-sfv0pVgtu*E}Dj-6PDAY;rQ(
zeFVTzNM}`8H+lYxX;~B{noQV<m9j|z#X0)`{!5rtPZP#+eP8ZFsB}0kAs53$_(_n|
z4=`DrM=8U>FX=iVYt(m;UV;1!=<?iE4PC;Lr5YxB;ijFF*hD+85(S=;H=pF^@lxM*
z45-;V9Bx7NjmeU<=~s<NZLd`@Lus>6d9h<j#%bNk+Nm48@r`C;JIS_9nq7V*FJ+~r
zNGPbv>|G0;(k_VElI6Bg#0aftLp6hthR$Vm467-kcuxUU3-=R~^wRCr2YaQqJEh!B
zMW)iF4K2hd)HXNE?hv!n-RNi+M2)4-I#27x;`_@7$JUF6s*%hfoxc^T`RCy{u{=YO
z(VG=gO(yFyHtH<TuKhK{{-bXl+0mz&IziVYSs8Tu5Wc~3yfULayCue~1Q~3Pcf4+}
zQ)($i+*WNgXxhUqBX#rp50OsCV}^n4`lJOUEl(DUfA;R1r7`#2tGWwRU+Y~LK@$jd
zks*UA;yoRWuY_ka`jGMi)t3Zx)jo6MTjfs{K~yapkv%%U06cYtjg;gwvVo2kpS)`e
ze%r)h>R&%^pXi6qLA0w!A10gby>Crl)Y45XFEwpQ=i3q}3Bi3^w7Oe3Q3FuR4lgcv
zL7KDS;bD+ukX$m!@qCq)f}-eGvvs5e4~KmbVxMM<Eio;v1xRf;Ffd?kZH*Rc2r}%j
zv$NwSsJ7b!Q3*RbxEYeUK&8#aMtl3+Fz4iZCJ>tFbzs6v<@u%<equ9G(R+o$M+^W9
z<0OzIfdbZhq|Ti0KJW9C9FhLxdKrX$Q&)eAVv?ieNu7-6;~>cWrkJRy#uW-0l!=&B
zOI69JbBv-fw?)kuo1|ljlOCK?)I&Gn%~fj?jr|U4#&UB>rm3S#?^IBuvN(y)7J0|(
zpMQ%WViL$K%z<UimguQQw&^<r3WEE}-%qTvF0y}<t>#WhQ!(vs1kxxt8^K6Nw+WyV
z2-Xt99XfLHX-M)?W2M2*p%fgfV&xViD7qLAA4CBL7}ShcYV77>6B=z+O~lBAXV6KM
zN7N?^PsDdZKzwOsTn8VuyG!(&Toi>tK8)4@z*WLz8U{H9xcg6OPkWz-WSW1VAGx24
zTl9pA=4Lk(gC!d{br!l_Cdbj%n%A{Iiug*$#MhE@Ybky2S4OB~y@~<``$teHX_yvy
z6kGVr#X_e0az@3LAYlvZHWLgM*NBKs8%Dy54!^*4kfR?=gmyi=!cpU)GU%1Fe1nr*
zE)z%)a3Yg5B2MS!b3d7vS`Zn?O`Mx55DpAw7unB6MDnF__BV(vv1nY7B*I1ec|hgR
zt=6>5*xHjf!kfpkepF*~{ZcSxp(G-~#P3PIMxMY0FQW*b2lyG1mmMblE0&3m0opeq
zBI4V;qy=p3G9^%%dMt2eZvP-VE{V4r|IC3%N~_B<&5PPo0gc(JLw_VH@;2JC0;O)N
z#BA(P2C=v*@rR{+hgmkDr}pnx-=|pW_$a#72B+tQ%6kt?l<b$qJXaIy+F~`}&jtt4
z*{}|>kvpVp+4!ceTB?VE=ha6xYY&S9;H%^S>0t*Sqc;3#fKHvgg~6_dj17MnVJgS@
za4!-cUG~lI&Um3+KsOs@+Y&2N7X4N5xTjItPQDG=;iYWFXDVfS3%lMTEU|hiwWDD$
zM<fCZ>jVaEW~#pE>0Xl8MKb77DbaHnVEWeTlUgR4&?(IHU5dbw-K-Bw@Yo$Ln=<pt
zGD2V3yf?fQ4s4q?^Si}HMQvPCtX%-{SEh@_bKD0pULSP;mq^<|@V@LaUm1MxRL1LQ
zLguB-)Q2*gG==Hc1t(IocMKiel?7FP2sMa26PY+2^{zg1`OhjyQF1!4V|t93oI-MR
z<K;2=N|*&34OHoYQ0cF2)z668wHFqy7TUAo9&HmERj-{L&j9bQx6SmPOykcNLl5De
z$9vz56r1rHZJdAbnaFy_NAi%NFHJ=|Y}&<oeZKel%mO@94xZYU?K$Z;el+s1Ni8ZC
zzjdl#M4#{(Yzp4rG<VOe%vHa{zdC1I-mp;8eJqg2ew_35)KyfVPm+>+iHLvfFh5af
z%08PB`}jk6diiM{Wnu*AhXyJ5QdL6rml!jDyd6-$S*d=3V6z-Osl2-Apih+^mGsIp
z8ON>CXyz`~bBx@ZUoYJhDRDx%?~#Njo^QQ!?EpzzhXx1Bl*(4>O+c-fGl=#NQawLj
zUFp`Uf$F8QGKum92JH^DT)FRvdmu}$esoznt+oa`E2=N?BMs&YWj8lBASL>!VI49r
zJjx>jn$Jq1dH#jI-WN8nZqT2F@ip;v-i-AWNN-UTW1e6H<6QIv+>|m-WCJU5TjD6w
z?>9wumT=k5<&7_zr(kIkq%(L;R>e#ju~!V{cOQM*y@l+vC~jk5xP@;<nDZmnmM&~s
zybNyhwL!Ke*2^`dT25rjMxXe6`UiPfB8_GT!>7BFq`?mo(hT5Ch6x=@3+?#@Q{$-?
z%PsdY6z5}3W?<XYVcIp84dlo9m0_B~ddGiDaHX~`$-^>vbUvRC{&rMY!KvSO9}{p`
zXyGMx+07A4J7+nsihb3g%6_Tx6s%=>Ws6+-MS_s*%+qM+%*5XZU#8Uk<g$d&<lW|W
z2q&DD?>eW5c01Y|I%$SPb^JH+bQmf0*IXmzY~usD9UubB*sFo#QKh}u>q)4ngK48f
zPc+H=(s)7JLl-@10xxIt!%U${A@|21$_eh{AkEWmx40Q}+4y@DGu&>h13=p4!0riU
zLi3Kqax<}rvvRiHBB+U%H|vD&Iud#ild#wvx!4pe;HzR%bd9A(`YgL)>KRtId8h7N
zk=2MOW@$0zJ>xMhhsA0}XzXOEYxM$vIx4lh#c?CeQ2BrWAIxWZ4#A|guwvQn9NI9`
z`uv3qG=X{Wxu!>!;k4@8F`Fa|AU&{wi(X1RvTy~JIv72khv=QVXg(3;KHsg1YJX~(
z??UksnPm`QEqgwnA$bgzg-PKFJW@y+)RqcFj<s+>9APG>pe;4r3ors#d?_>A7^pS!
z85-f;9|70t$dZPNzm08px!Xr<G`3PsaO<DCe^g^Toj8E}Wz=>vWJsu9YQ^eR*Qd*|
z%!<j-x7G*><&#ywgJ}^@=*d==qCU%z_s5E>-@Vg>bt+irZ6V1?4s$)ki>#$G;Z=E>
z_M+7u-eF%!HM%d~h1c$4$Ck!3aKQO-m5<Z;UIy^Eg)Xq;s3S6N)&FJ;4hE27S;K`Z
zW>@Y!g$eU$sINsxBc(Mxyau7;-0ueED&DoBK|(=^pS2#B#4_W{vWB0C#5TBx{rW@L
zWGj2nTduz+O24}Dw2!jF#c-_~AMQsV;l)P&@bW4QyYXdMdrx~A6;Nv<sc^%_AuP>g
zhbJ#)c(y#kI2iEE>f!eoLrqA4xcV$VTSb`YqeX4-H+W!B%AJ*$vqC&<T8Qbm8*W`W
z+pAW1g}q&FY8fl3lZN}ra;$>THAH{O=7`nsHTjnU^KCWaxL&xS?085v6NjKD`atx8
z`#|()_~d&qADY)hX#KNZZCwxH-1%3)M@CU9hI_b6PJwI;8JX1VCn3`_mD_TpYP6+R
zJ11(7$y35lBh3*zqs{6z1$0M*L_Pv~nvEP&I+d$y=Z`;~r2n46N`uCv-QAyAJRTG>
z86YpGZV;LRG719?UPb8ux31jrBaVYrWo4ri6IT5pUr(2+lf}qDR%ekOwo+y<*F%Jt
zTish@V-_E8&!9mqz9+^9_w`9J3RR<-4eRUn)>qgm1})B(k+t1{R)<&Ks~(V$-}+F7
zmi|S-sx;L)Y1`DV>1gWMf;&Ker|~q`G{0)T7wK%_rPznoio2MWHD!mha-BF)#7ew$
zV3iDEPNqS;n)b)MoS#5v`sKDi$xdbCtE2xi+Y-GkU6wT~4R7YBdz}os^T1)X@O3&K
zh1E>*$sJ4@#vL5mZB<yG`Ajl)kLtX{7Z;2nGbX>B<e$r{_>BvBjEhNW0@I{oXC4TI
z0Mq=ge!0GG>&apL`7AaUB-HD*b@~Qz9e2MAoMmoFS0RQD-b)!r@e@%UTmzj{`w8*_
z&49%-wY!@`iB(myJX5dQO$Z{qR@)7WAG=Z7Ncp!v{ZUUaBqSy8-QWLYdviX`$+9&E
zE5oe?M`C+~>rERymv!u=NpjaZin-Pt1^JwrI<$7(aZen;d4!dmR`G}@mpZ*LF^}<4
zksS>dCNG-rwW0|LvmP^|y<A<{SmSa|D?ROxg|>Syd}>+OLPzR!ntbFx7&bR@AO3z4
z=EBGPlUGYfp!rmyGnTAxlmDycaj2S4^WOYd6J0u6?Z@8xOQs8NNm3CXsDqy31>thg
z5P13y-T7v1IXOg^e@BuJCoJ|PyS7>tsW3JVpb$=^@JgquyIxK}<j?2V%kJ{>atjNK
zZ$WysYIw*)wP+a0V;ijwhoG&d3bU_3RR-aEii!r`v6JZ3<I>XL!9bGF3^p5r<S{E7
zFynglN|j4K+wD$P3u_YZSlQuXMSIOS;Q5jH9D!E*-HyDEO3G9!EmzAi?rmOxS0S64
zR9ZnmXLYj_`UqBNH3O$bm^6r%_|$35(En?10PC^c+m?<0CLnIw;vSXH)YM17K9}No
zf_n6ied<pz@-Qz^r)^x0`_$aG1GXYEa*SZufy%}|MFE{$0v{uGY1TE;xC|*xM9;ll
zY@Cc3I-Y%28fS@=9jR#WSlZbxl;NQ`FV!WJ3CxXHGqM`5R%(m6cW3Je83Or&Fh~S6
zr!Ed#iR;X<L;=&71wJWf*ELPi45Y2zdE4c)wo981G5vfcm9It~S02ziTkA#E^M2g&
zrr$klr@Af*-5<+$IJ|y8Y2&@<`xVWrf0aT?|4P}tIMTZ*g6|K0P^5FZ)_6!8ZKaUB
z@15BAw+SW?RgfPwpt<?6!|k?6I^7v0#sGzG2D@DzNcKlWq&r_C4_0HoK$Aa%jfI7U
zhxaz+^KrWqOn6|+PLoIj0$4#dOce2@Ac^5W_G{~{4mKnv?x)yA9~%pU%bZ=uQ8MYg
zm~<LEf=yS4=-CHZC)-6c`27cCI%0294Q{v1rLCYWNlB#_!s2f4dG=&_T$!LpGJkw6
zlyA+#RwEhn79)=?BqHtTgqKN;7Jw?~!Xp86`9OFcLz_E`zf(PxJv>e4rj2mFy)Sei
zXU_p|MF#Je?q2MhkX+r{;rw-O6$t{0t3aiVC$CRKCMniR%lcdlu@H!BlD}a7`Lq`e
z@){CNLjwaDbb-7sAt538-mdzF2s|S4G!=jR4T%@7;p{TYSi{($u$17m_TFuIu8M*r
z1}y}3BY(Lg#*C|Z<gtiAO!Xs6CvRj)6>Nc-&XoUdIK@X4rS&=i0d#Xzd(-h$h#nyn
z9>=?*8IYqLB{}*2;o;KaA}7#w+wV)3`$_3eUoZj`#8BPqBd%0B$v;;o4!FQkx@vja
zw!5xEhRiL;=lXSUf{H45MB#KiYZQ=K4tcEk-74%~pZsSrW&dhD16~s*22p>`jdBE_
zw(<Pe`>k;ZSlq4U3+lN|00wM0MwFvbXcxAgztn<{SxoT{6NH1BWk6@oIS@PNpC$iu
zf6b9Vgsk;KY#8&?Z5w7ho<9Wy#-46c>wA`FeA_WS#?4Y$Oo+>t_uY<f!KiKRN=w=d
z>>mB((gv#-|8oUY`@)kpiG`KV%+{F86aEVbMBfGYMyH$)1R(j^iTU<QaVTG7f6`@z
zpLhS68J!>4Iu27YqJeD9teol>IzY{auj7}VacaR5D^5<U7lT+Cx6Lb)z}DYu|GP%c
zVua)m_r2gDE&Ks3U+|JjgF7E|@oy0)EZm&F*jx!$_d&s51p4`%CCaQeC>LX6D~3eT
zEP>0#Jc0EZ2f>w1^_)etC<Nd7yj{t54x(6#VRM1UN5o(zj9QZ~<!2eKb^mp<i;SiH
z*`<92RZ%;}@<#tZh-T1Nqbdg}I51Fs1*W~t=?+I;wuEX|+~qbpD%ySqWy|i1oXd@K
zFi_(<lOIF2iyvAl8`%-zD3HXCk3Ff1|Jl3TU-udTca5-8>6_F}D$_W+=dv-5ctugZ
z+uGX)$d-$V;E!~GmR3I#tQue`S>unZB@PO2POcit>uJ&eRjj<HyTk$-L0B!qB54r6
z|KGp;yxR{j6&T(T2mtQp8|C#AfA3tpuG-H%ds!eZdt5GJ`A7GlAx${+x^;i(9#9cF
z0RvJCvg-pXYFhN@g5(BnrM>4yMpI&lEmBhOKf5VdqG*6!13vu9AH%0+#a{!ih6o7-
zX<G_k;j}%`Xd~iVDei`yj$|iW+w`{dplF_n3yH!ze8Sfg_{9&kZA`b3`ai4tE1|^$
z9sk#c_hp+*^~-E&YpvgaJ~j+27^CdAEi6O|C+*p!aTmMV=e9(n86*%F2AND-qvvL~
zx21T6S(`!(StXrhe#SJdD-kpxS+pH_!@<u4X7UyI?4QQ#;LTV6*QRk&W))9$2X#G*
zefqR=#>hl~u>opAUOt!U)KHN=zkyo<|9saaJ^6G%9Jh%DIvp(_taFF>5=3x?ew(vk
z*HM81gZceu!7s-nY43!lUdN2>&$U*tWY=|%z{`IE1@)xk3_XP@z-v|k7t#{YQd`Y!
zK@J;qPA6mlb^=>c3SEwg#{mceFHfwgI}^tmPtzU)QB?ZAAkUjO78Vv(ML}=;#*vf;
z0neKFlI?o`7e0cSUk#=_W>u(4i5QkvWweM0(0+rovmr0V=9O~BL4rK6tx(}5TdN}c
zsi997sC`W)YU)5D?3x9p1t+LK`c)N}fobfvS43clc<kRjxA|3v{4WF!r?O434?wB%
zMkdSAiS9heO!43G4mw*@o~yTxPf#yd5g}Dz7?hbQCG>2F_k_L{ChOkotwq495Q5KZ
z<jSECej;XBy6zD682c^210fie{$#t`LI%}<>p>=AssZynWYen|%WGE?YW*tp(tZLE
zE^cX*I<-IdRdrf9;R85H|M!qX6|DN(3oXl8uYvnFv$@dBGT9>J5T;%b0#*^zp(I2t
z)7oP?nu<-RG!&aM&_}}W5E{xi5v(^7^-)(viei0vB0d*!jh8L&w)h0+iFHlI899hg
z;t3ixg+sW6xx9q#lfk30Yj-Nj24}A5Kl>F!+iLqKelnt|x3=5z{aro!-pFlvE{9hu
z#018_AFFE&8i=4W;GcqWaYk!!i7zS0ffdq5gD~;^{!^<9@pNg8W+H+OdT7h&gC`S{
z$=8;W>+K3v(8{2!qeiH9_5V8n1v8@z?u)^}p+;bsCzKZab+CFfk#;shNe2*vr9+<i
z>(aZSQpTKqUPJ4CMFOc}KAIy#m4f`XK6OVwjFY<mJlyFzpBo}yG>Q`#wze89;t<a(
zh!#s@9*(NwPkbud9Bn)QC**S{j~NYSTA)T3<Q+Mo!0CYVKdw$W)~Zduxd50QP}hD7
z*TCAE{Kie!(@H#Us14DFyj^_k(f75=UQVc4#R@7b|CD}@c9K)=<DQNu61Sy<>jo=&
zlC9A=Pb^7c6NY77+A*7(4G)_Q$6u%VPar#r^31m)kAjSReZj<k3Mg%0fkkDuZ-dTy
zYAA3%i%Lx8?>*71WhiTzR*VEjzC_r7@R}d0MqKKs^S@o$kk{272-BnID9=`AW^XG{
zfEv+M*x)GkGT(VT>cx=#EY3&+s)Bys{p%}E^OPfuxW)oiMg2gPuqmy)IC|qES0aI=
zn>krkv5&`BsG60CFX1Wk*&B&M>>?|3z^Cja4yRZ<(wuQYDCa=qzPlAL>mIv$S=STp
zg^5Y_KHnC~HwQ#oBSM2pJ;U6eZ{4tQ{St}+)2!>=W{SY{jeJp*e{R-xiH!&oK45?P
zdOVZ=MW#Cd^~BZZ{XV%|$n;BWP8CAvm;z{-Ij8(K_U%%8((_t<bD6FMl<9{8?C`?U
ztTAux_p+o?F?FL8<H4zmq6E5;r?NFTGSp+dq10B;zvh~KUJd-gfC%f$J;r@UV!JbX
zPzKpti4%hv)Pk95e6rj=cZbDy-PZ40H^|m6AJU*dyay55%7sASmkVOh8nCq<WKev*
ziYW-&7`S5T>;!w>bKBrV{LP<eeZwvlB|wg+d;wmL^6x@s*Y?GUnp`?+&obqABRrua
zIEaq*++w!thJ^hc7!};F1jBDy3v|aL`hSkYug=(d>cI7^GS(7^POxR!T<^tq{d!&|
zmg$JpQ|N_{F1B|zg;)3V+N#R-(z`(Xn14mrk@ms>FEE=-+{I-)nke9;wY^<cSvgks
zT#zZVaywz~0`o85u;zR7L*D2@ts?`SO1%K&g{7;~xV|s3udRVl4dWjc#9kBZl6t>L
zy`K>JC#bqBK02Q)Li2n>s9}65(Q&D*dm(&bso-94@?d>-lxlRU_}>IeDnSLOSI=OJ
z?rPyb1?Pe+i-qph;iw|@NgT2@&c71a2H*PmW2+?)G|MLn;QR_qw`$bbSVmm;gZ9O4
zc~%#AYvEDl^V&8XVH|UgY_Am9*novtU+1@Ia&v%XWb>~%<TJy)eHAXLG75UIjhZky
z)B1G5jL(PM=YZX2`t6QpT~YK(j1ALv8!Cujzl&Sc%!tQs9PS$9>Wt@Vuj%Rusx0gf
zarM74JSFAl&lT~sXazmqt(E@)?ef15rd*FNRRi8@v2-!7twsrpWzxXb>@`U4q`;<g
znmU|vT~`#K!KG~wI4)!xyz%>|C2L~<rFe~c#KOUNJ-ZBCdX0(himrjc+4tSl;M{Ss
zie-IV`e0rj+X7y}5@mKV!v9U<naJtFQ0`yt^c75M@foYR-2A@Jp$;3pEB4;plc@E~
zuY@omILH}rIf3U9=pvm$d-wz!Xt;i2)vRKdBUJz)EU$WPk1mh^IOe`bYxrU=SC=qa
z?Px)gKS3H(w|}&iy8oBL+LZ112td!|BMyWw^!C08)V112RzI(mRtbtl3}Lt-IwE9}
z#%^?YQ=f??Z&v@UkQ$HMef4(B4{fq1dq2G%bLh4x4rds|#DJJDU0MP?2D3^%6tEK<
zMWdr3kUtE<P}>OpE0;8%EVm-Cy=!1GxXzAzeP~5dgZe`nT7|c54;v>926;#~?#H|s
zMnmxe?i_*=?g$C+O#}y|A73EN!Ju10`1+n`P)&2WV|9qBu|&CAU{&z-@Z*oWWenW+
z4%~fhLjaYyDw*$FsR+>cTP*)oY^mDs_*1%|1Pws+)?NU>_Y<WEZS-|f+tY)2gih9>
zmg#H_eskfjtLfHPSIVN=HbJ~RLk=N%wqE_|&e>&hjqABD*+L_pe@;wouz9;`kxUzG
z_|HQDY6BpmcI6<5*0Z4zYpTjHjp}_T^v}L2v76}gjvHbVb&VL^C5Ma%^^D=S+4h8!
z;kX3i1qkZ-c6ZBBIXV#?Z5Aw@-u{#6G1&fj>`W$-qu-RhCpB08oc~Xsfhw4(*!o<}
z=7Vie^#O_wNAsV1pUa=oHOW~_<B5csW{S?Byr8mNWGDy`GV~ix66sbR=2jQ%I;O=N
zQYxhhmDhHA=ya)_6W)=r-S&DH<do6%c0voP>#RXl+52_E#gJkfvi1Kq1t$&W=ClZt
z1a=@_I~)O2OF(Y5{u_@K1adf0&!BH%5_O9yZTmR)%o4|T)&NA4R~aNskJ1G94cN{U
z^cKTU7aI{T@Srd)FYL_Oy=XpUFf#F%r>7Q9fFlY>^91gDnB@gz{C`xvV|1Ti^zHkN
z*`P5Rt3hMiHXGZv-LOg8*tTsujcwbu?(;kUbM8HNjJ{~!bTr-jS$pld=AIw=%gQp&
zf&Z^Xo2sBrV@CzOEnWiuCyzuS1{wm0_a=mNO&{98X3@XTU;Cl5%rpV$2w^7|3mo6e
z^H$~*{r+7F?PVIhJbz7KaoQN`zw1&ek4S|l<Uj!h1_epR0^QTmM*qHJgQktUJIDXE
zAA)W1dOJ<k*pW`B1$M^B({=(?RTaHj7BJVMzU`eaBtYu>*L<3pV6(IB4rj@Iq3j$p
z*%+->ona_v=Q&z5zNT`<7)#0J9&&Jbetq3s8}-obH0m=wrui7-NN{cwZUg(jwtR7&
z5$e=0*<fd*$6O6gtdk#$UoWf!jTvc)u)z^k$EKaw&dCc2vxvf8qTavn%!h{8QH1nC
z`~48Cbx>0dzL46`_5H+sDO5`PzxqJf94jJNea5K-GBL>J1XX77$;Hf0kzt?p33VpQ
zQ5#4BZ$I{cP-fnLB;9>qUY6>LA%A4VpjdVRrS~6%k5~l6Z2gO#G`+L^?Eh4@b@;S#
zAO_p4Zdv;qY_$e0zHInZM?NLL`)>VO9C;V*D(eJr8n{N|Q;kr7^M*6>uFWS|r<k~q
z`D+hfj2gAng$;(wWmugWHKG$c*KzUKtgPFOR5K`l@v+O7wMca>hYit=9Nph|k-M_a
zZQQlzcpMB>Z9n4<TD?IEF+*z@J#Rg^5O#5KVUY!PslCjto823^5NuAGFsQjEn`Q)e
znDWJbnGB(Q4UR29nvXcxmJ&bTFAfnpNUhAp1${W2O!7w(9yYf7Y!)HVvoBkBt~=y-
z{nXdb{_h(@XAdtto|#b!>H+$mKWLJ%0RaI3Lf}BxmMv}G^8OqNetlFTwtwEy4oWiC
zdWdWMhmxx50K;zt2m#m}xj<3S2n8f9NG6#i_yPo60TIO`qR2+P3U|&b#b)c5t=X^<
z0fCDab5jH=YPTVJ?KC4Cb=?XPTG+zkyJReT#-U@*AUa-WxXagQcE$=d>DjyS{he=m
zyW45lmZU@E>MAPexVR@L8W(Dig3Um54a!M6->_l}SMV#koF-5|g&AyCY@^ZB1c*=~
z2Y|Z>=QPW?gpozVO4<|3Q89Bzf)c%R7b+~IWy6X-!&=nhZ`~>w5Fn?pL;F=Z=F3V;
zOMj1O4WBDA8fGZ$R#@fi1hJ(7VP4{}IjcuLQ2%`uN11^Zv#w6)_xcm{%EXdNROnoM
zU>nX92v!#gs}3Capk}<ozjLSergb=7WJlJ`+Lao#YGw26*XuE)W)UOwb3dZ_Ju-}=
zCte}@7*w4rN=i%b>}EHUXgDuyd7n1cTb;K(JW({r0VxZXc#dm*pw|H|{=Xt>@yhY<
zE93eUCnr;pn*|t=(6_$7Cj)+@87PYr)@-vZQJXtN&M_@2sudhM>E3U~563$<(g$2=
zQKBfiWH>9#_GA8kD2)xkczyuwpG)%p+RVi`GHH!5c|ZCT%|p1-+L}NpIY_%t7cg~>
z8F8dGn##&Sl(0Eo(0vSMQ5b{-9B=D2yMv<%YH1b6bzDJ=viCz1XJ~fvVICY$U~cL3
z7&))W|38x?p!oqsQ<mq$Yv+2CyIIjWt6Ky@=!n37w-B{8DgAYo<+-lPk2kNZr0mw&
z?eWmT3+_pW!?<GJv&Z^7Blc&fc8aR=%Vw6({e1cNm^);W_3A>foY%Pm>OQ0a%m3P0
zp<<kNX5s(o)*hJERVUZpWGAv#xYEX}Xznj_gmrOwdt-*~?cJJItPB5@p3M%}`F0(u
zSfq6B%#6`(e%u`J)Wme3M=zu=q%iThZ)XUbsQdOkU~~BNdByb;j5jjxlXX5f4EcRE
zMZRi=P)x2}7~kAx^co*UZC~xWJ$b9JYk$AK$m4<~;PtZT&7J;e>iQC_`S)gz6ok@r
zilq({2;4*;x+UZPM;~b&#}47lf7wkgOm5VC)@kodc|SWb%S3sFZ<mM_MY*tUL{5sp
zp&Hky)$b4b$`<LepuuP~+mvK=Vc*e$NAKO+-n601=NIUgf+W^n{Z?TzniYj;o`P3V
zR{5mtaN|5cH|DKU@qRM$VYK*e+A`>r?yuiMyVND>yY%N-Y%d$@qw4HnwLGTXTE6#{
zn}$Got;4E@ir-<}&q=1Ko<DeHKZoE07_Z9k0xFy-!G(^H7b4bku(S89#{ZV*rfk$y
zwc0o=Cihcuqw!vMOXQJ}FGd~gJa)%PV12QwZ0d@>{OnZIb2wgPUisR$Nt{Vg&fU_;
zM^9xaf|9&Nsf%^=s4y3HA)8qj|DNcgpa>2I0o~}X>auK?!hdMK9+*cEbwp`z`cu~L
zqtFE{@>K5I8|PtrngriVP1pqiXny5wvmOIuB{!lpvbDW@tn2&L-7$N1SC@FhvC78C
zZ3AfQ8xK*omQn43LcFqjXKC(-YT+gZ&c+64V+RbPzx||k(~o=dn0+fCq*NvDp@~FU
zU<vfO5TSocJ&~juPMU?yXzcH+Vc&FV>vT!%>{rHjKVMe$cIDP@1!u>*Qc~AfsK=lA
z`9NU9>L1#~VJ<Kid`KzQ_|oX`B{8=usgf@3Pc_wzYhr(z@4Nf8Is>p*AT9)Qc!eI>
z{4(9|XJO)3>YJ2yxSB2g&%x)MmNAz>*Ja$uDD!#ID^7suxF=(SD7-j7uUSDGIN)H^
zR<jH#2;1RN74@xw!$RK0W<BI?44FbUn@79)#oXlsYf{!znK%r0`rUi*-)-i`Jb_XA
z<XfY~OFlajF9{)@!sBL>-feR7)47*}VGLK?PTVnq@BM*?`yIjqJ$LI)M%71Ldab7j
zmd;=jP2+*ON)`<@&8%<x0s7>Zc0$dk=hYaGWH}0-c9J~AQW`l79pAIEtS;}~%z9Rg
z3rX$g+2_;<WwU>lom!6*#K_qqXq)R#-q`7zp9fD_1gr16LSBhE!29Bs-7dmvC%aP%
z<rt7hzWcb_=Q^jp{veiU&uo&BCwR{4pwgZ4zaIXNa=xtG<ZsWxer6NoD&~H(9z$KP
zj*#MjB>CzR*Z6UF@llnDU~6>%$Ty>(vfSmkTaBGTD&|hULDwz}Tdo(t!D{Amr==59
zsq=DG%uh3RIF|5jjpcu?Cf|hb)h#OK;X#u~NnTzaoW2&N<(?Oj=U(y8;HA<Bu~5Xk
z!O@%i1empVLmjLxf1X1NBPv}4SL!RRCn*U(F(0-AWM^L#_5W!y`p$429=Wc6l2e#Q
zU{PMW(*?rJ7x8^Q20wPWlQ`bP5`gB?t0I@4`c6>6LF<o`0~PCW%y#`tTV`m=S-&jL
z)jtVdh5OYv>G1_v>vst67oz*@z>;e>yuCl32M0a=BDm$#K?)z>IaH~%C%!H7SE<xM
z#Y7P{+nio(W)U*P!(gt<hdS>}kG|^A$MoPau<^acsbk7K--ol}@pUmf)sf8MLMNyB
zR@g0OR`E1S>Lk9ZF2t_l&e<sI#Kt-JZk;88yZR-0%v|*weSlmFm7g_{{gBUVlrxce
z*}5x^ii9b7p?~|)jy+e^YbM>!=A_>e^xRB;PHwaeu{snWf9`?f5GC7}gwLc>>7Y%2
zjnD~fB}Z=(Iks#s*Iv61tXNd5S<rNNCvL6`Yz@>bSfP`!5p|{s#DMb=?ZuR_7d3=J
zYctQy4Tm@0V+)Wxc>fa+hFPr%MSu9Z9W$1~*@Vb>JLZ%b+26Sya6E6>QL?Yw2kVxv
zaWw5P<F2ckKLc(jd8HvJ{$;GVgsH`&?n~)guC!@ojIq!k|9b^l=%7<}wXb7;Awy+R
zNr|VI;dSB#!u&JG4sG@|O>%^y97ISU>ymQ05;Ql#{n6B^Zp^3EPEWxeWj~|A^jXhk
z*Nx%9gUB+JkMNyJgcMB-k<nma!a2rlp~G~QEM%;6KC6-uAa6v7VRH)#$Z2R0h8(<z
zqr`yR;@+*Epb=qo(HMMA!!CcKFo52`OGOp7A>Tp+7g%k>ul3q_+L?Kk1=Swa^HB!>
z`TG1*meB1>0MNC-LV^d}eR)~oDr?Z`|9of2Bz-6TnHkc#BbcWI29iBcE3c@i8eD=>
zQC5T#i6j?VZR52%JL41#b^T*jFU3j`@0l`zK?4Gr;$ktDs?2Lt^Mm|*u%yNQoS-5H
z{IOEgWi{AR<S`(GW};Q0SgD~bGJM8{+f|BgPh}?VRDYdLO<xkViYFl9o66xx6NNEP
zXg`V;!0iuxQI;SS0E;0sfXLyF@w`WFZs1q**Mlmg`Fq+D`=pS0aXK!VP#oU}-XJRJ
zlvK>~4%sY*I+^57Y8qE4k(Kt=*MtxXG5$f$to|=RgT#D|0PnKt$LlJ#o)&)0%<o_p
zm&kzy^E^2%C}S9@SxP5?JkQCUuKvW@d}45GzZt_g_f>WaCm+-^$BBraUYZ=RTd+@<
zHoo3U_BSJUKf7MUqac`((s`C_?=r^^!3w$GM(Sgt109qEg?}3I*h2_dmql4RbxDj(
zAF*=bZdRx*?hG7yNiX^kV2uf>erG0aI(p9e>N}gc6w@6ae;I359|O<Z<)%27N|I<C
z2vQ!X(s;k9L_2m0eneJJYNI$YYGL>gu<VZOQbm!t1PlX&zE8x&#5om_!`nwkVY^Rn
z&$r(jB?OU>kYJGTr_5Q@${Kte@)Ur%9N_3a-`NrJNX-fM3_OdMIu3o4VIW5bmK|7q
z2|pnXx?m_6H5wv<O&PeGas!|EHpvs2b33SaP;?4|KapI<kesbGw8c#XYs!fgD<?NQ
zWq*}?m|j+Li2<DZ8PY65upq>@QV>_*RF9nm@jL{q-wtAU3x~LcNCT8(Mw4~#m97f8
zx#Gz|kiP3dc$~*~WkhauGK>=zk2E7?4Cu4)7({T7k#59)LUdN;A`BwvJYQ+3%a3H5
z4k&cf6I=Y^(2xEU>xe(tMd%+pLjxH$CdQ>u;lB!6V3-i3W`$i~kpJMUpcu?GwiC)_
zQuBCFyFCh_sxw&4wkjZj1d=l9JD7+Xu8a?oES8}tmBq6*+sW0%S6W$9mlQ21nPz8@
zGk98KtN7B(PJgUxV~uH4IBq81!<F%;<L-48tDx7Z{L9&7&f<3=qvLJbQ=wJwG^wh^
z^w*q!pnG1EUma!kqZ;{CnF@4G?yCh)EI7;<)20(tc<4PVr7<BdV%iPl1*s+cy(;+b
z_&K8d>Q+GbeI#a|rtwSx8?4)TInA|r=z>q@Nyqc$`X(@nbmDTH>NGYTY3Mi9X&(Os
zMkVhbu2c1)Fa83VD3F4{y1%`7;}2Enm|I!VP*c}x(B|tD<>l=H76ADih2c8P$N^)f
zcVH}wnMOG-4W*JMMD*tn!twj%r6RD{!*PR_B{XAfA71i4l9}^sKCq;{mJKY)*-H1%
zhGC)H2~xyC>5V(c9z)HVTH>WYGw{Fprf`<h+i%~r&~f<`xuP<g*F!78{JZ&j6AD?m
z;`XLOTynti=fmVi=(E#n_V71C(i8>^LPT^X3w&>W;DxsiclW8w{82W@f(T|?em$9s
zaJlL2Jy=-mqgmj`oQ%Lr@XYBT@auzMV75ntVzCx{=ms^I2I*^d0sNN|xP0a%0@%Rn
zr61NmhQ1ioF3IRyLUs$+e!sLftp{N@lm>d6M2%!G&hP5r_B(T4-@0a_>XC)qqJr%6
zT2&&$OnP)1vuJveGpWH6;B6|-4HFqO#!fl5NkuM>5W5_cLMHTqXyBPB3^Nz14Ff*<
z+LTEwjIz6ogWF_X)oHT$kl4X9+Ueg=Xd#@uQ?YSP918mEu0x1s7+ldJ)D%GxM1kRP
zP_oqfCg|Cgzc3{Vr6jC0`rQOQH~!8Wonwr%N3x64PuOd|sQ#;pX@C#l;Vf6P0s`h^
z_&+34|GLtBUiy7{0mkOqbg2S>-G+qA61LJ(XH}!|-y4kis!wt-v1xw+qDdIDiS%i6
zmO9h%TKYAhUf+P*H|5rU4DG5hi#;E+{1P*Zf-B(J@)JQB6mG+9z)1goo1E8=j*GsL
ziR=ySbleEDu*hFp`1vuej-L$j2a_9Kj6Be{v0<T}Z;%GfDr3<%EUT0m=@Oot9X+YQ
zgy<?|FzX+Ad|NS|i>Hp@2uo{{*dtFyp?D+lke#`*85M3$^{bHoF1-G>S|#qCudMs&
zIeD?R)o;&NIsW2&a8noSGt?-_>v;*|U|8Gztpf=vR~J1)$Dn!{vF@dITaeukxoa53
zbuaP0n?wVv_f&RN;IQ-i&K%)ita%Azo<#SB+V7!-mnDBMkj@)0A#e7QU)D=L2zqCG
zH4>}Z^C#eLSL6st2XifD&gN(LvAYAfm<>F37E5tMt{ww;m_e{0_abO;c1-e4LaiT?
z8+P(En}MvUV4*gj4J0zqfoU@N5g|w@ud|a6+XkA-&^xFckFy*lvSk)yul74bR!GsW
zwo*mU?X`7yGu|84gFp>@=sbo^8)3Lx0b2-em|C{YAl5+Xhs!Z2!~`)go0?Xi+f1X%
zC1JppO+@HS*c*`wRJ4SL|FpLWyyMId_0`e&=J4sugLCB!L`4G;9W1y}QU$<jn*-($
zfGS6XQ35H5&+p4aLGd37Ak9g}57dB+0=xH21kh!HA`h^2x?ujR*7C6-5rhDg=scGy
zn!Q+>PWH=V21Qumr;d3skCBZ<CC$H@RIL}A>_6grvL9s->FLGj|DLT_OD%QE#<_yT
z3XtrDppoqF^;<bsVyRIe4J>V!ljAl`YZ#913UYenqLJhsG@2O!D}QzMW3Jla$?wwq
zqsQLfLHfx#LlEltdgG6|YM+B6LG7wx?S=SixiacPa|6S4z2_mmOc}F_qy3d`S-tW&
zM}iFuO5+Lqi)kvb*_07{7CPZjuyX5L?8b8j>(G}O;+yzSP1VqF8fBt1O2+;eCo`su
zlsu!zbG`~%MfYI6ILs$GB!Zc?XfV|A&E_yY6xJEwuW`nd;fEzNMBb04YvDS|NA@^4
z9tx&JhGC~h_?O<h!{iimxc_aEyVh#kJ|kCSbrczayUWZYm&?9yBrPQMhH%C(u=%l^
z-9aUx)>x9jZXU})sck3WV(`(_K)r#TTV}aBE$J?qGV7D(QOEPweW^c!Oo*71{K4(-
z0G=NVN0n|=Mm3rhg@bceabc?rooSMJr`p9+xKUvCzqFzCZ=VQEbsE;)H#O@0#MMIM
zI&m~KdOnlfsNK@?9i`7YH#!Ai_bdcZM3j}44Gl@AGmzuvE&t<io_i{Ziw^;iHV!VX
zm4tk;yla5db%e$5Lt3ik<Zig)xA5SzIHeB;9>4>m-R`cKqcFF)_+QXp!=kR&ZWQ~A
zm&ku5!Pp-2sX=>MqXJV)?WSxzi5mJz`pgWjcg1rT-k=AJ2=wbEo0xhJXAnbhr|1{m
z=fUQ9g^hF<-`)65OV`*JQ529(52p8h#l}JYC&lNy0R*pw{Cr8^M7Ts%w8Z5Fx-tX%
zz4ab+M&-2Za2x&US0)~w1`eJUv9i7vZ`~q5iYAx+{&%BI0wvCixX_9fdBm)RHOqw#
zPQzuTzVxt%xVKnmU$L!~bGv8P>FI1FHnhn98pY4`Na(j>S%-BmPjK$`R3gI7+Efgj
zJb|2z=*Lf@=r2jXu55;U<qEv=5L8<&cx`i%@no?>hzZsn2o0i`iUhPK$rECeO+R;z
zoUIK!SJqyIFzQ6&NS{);4VB%~OrHblywuLhx9FqMYCy#v<&0@xFbd#9U_i-=2`LT}
z!mSZQLfW1TS&y;9Z%zG!lutGMaUN+%wkyQ!fnmC7hhcpMV<~V}Zq<gQVl323ABhI&
z1CpV{AXHJg1KH(PlJGhk52~sU5v4Qe`}lVR>jdm!`{gwplITz>Uz?u(B@8ccr2ePJ
z#C;@i58$Lu{Cqp)r;1paFWmblOb`oQ1eg~93m*`C^}L{E7lqBZ1K7XzpfDrJIXOLg
zgW&**#*tBwa(TsZ(dp;$D8V^TTqG0FwXID8ydElactI4Y0;ccZk6-RjyE?{U0$cuT
z=eo8??ur<&yA!>aS1fJY?FS>)BkiTYx-D&qm6^F6b)n|Gq}Z*rtVR<e*&l355(vq3
zJFng*`Ox7_R<wNcLXjM@6{{8(CpY41>avf-cvogtEE~SsU`p#4Dfh^$&MG||#D5ys
zeAQm?|5n$Vf++Thgm=BgpUvFi_D`B<@4f}|EBn8sXvc?4-*|2>MXFDAH6af0Y3v&8
z6B*)34D1c>?U$G&yR6I00B4BO#IiB)aQ>z`e{#fFqIpLX*_dz`jSr^-XzbWtu@}hS
zcy$~}+%`AaI~bR=<BW#Ijc4t0RbgMQ9Zi{R{4x!)tQbKkpHQni<RN><AK-SMDPAX=
z>-Db?)4LxL<H@?245uAHDeFC`nk*7OTgAc}J6`rC*cP{a5+~!O;Tm3Dr!hvR`1@ST
zeV}`lgB*8U$Dyv?`23B&kl9OHC}mt?PPmrKBtxKsZ*0@ce5ySN33Vjg$y$p$%zV1B
zUt#tkB@f2K^QC+qx^lho2<tkV)4(BZgSEiBQAhPPnK@X100MugO^lVC_qwCKU4p!X
zR|`EwIanx%gOl_9dD5?NmK*U0TwpUmJq8{V=#{D;cQ&%UH>v5_7FV#b-Z^yrcL)?z
zREz^a=ILBfZr3w&fMn-<^apTzYHP0n?oNU#!9XJ0wdNcJDsXUcU0|+G$*T+8=sY0t
z0YBa+$FAB&lL!qoY_6!^h;{QxKUS<69Qan0+sHTHMby0St~Cu64aYmnS}iyW2O*g6
zqC-8xI-4kur#wXKTNBRDCqZ2kYYDC&D^WB}R%o@ioga$#gH}Q7I@+2mn)I8kPTMcz
z++U*90<k%|U7YsNHy7KFSj=bb`JJPk4}TqGyz?T$?j1Y5UNkKAp}lyaulK>PtLb|9
zNe+wE8rwc+*+9+AG0nVar)o?2ZqbgFr#tHU)WG3fhlKS(W>v_Mp8iv!XDM=BMJD;Z
z;^H|dwr&!HCf<F#)+6YRxtBm+t=A8?s!H%M1$J3#c{b?WA%5!tLdm3UQNYy8s}Ohh
zM&4Uw8Mx8=^OFy6{?v|y$6zseOh&MOA~sA`EDH6?1K&$!;h~DL{uY-@JXOhYpZM1O
zqX%dtv(8$`G?MWtz0Rm+IZ9u=$N7?=Ms5kUqCU!coPSy^s{f8$Ww~Fpox7j=L-8Jm
z5qdg66Sw%w8QUb!ggbHQ@Q49q4x2WL6`j_8Ri(s-rk{i~P`Rc&?Os(Im*lMTkNR5J
zFpQrmKeSW(M^jqrj5$k<#v1@`q@<)=g-E7OkjjvwM1d_<q5dTV<mmq{Dmsk9W9Om>
zF(4-=_j~Fi90pt%VUuJ&bSXMrt18~(8naVAxf;N_Ka=0z-veC($REIf0+HZN4Gn;l
ztxo83r|9AFY*ZhTdvv`!qz(|Sflx#sFqZ$<wGdD>CQ%@#7c2)-&mVHosiTg$2d@(Z
z(bLFFFsw>H87EgvCtU>V=hwlrby{8U`yuk_KpP9rl0Jv8?}=jZ)tX_AY-ca~zUgTB
zSnV*LzHMZlFPHCY=^1HST9bNZ&y9Cu6NC{Tsw$cqF2}CIc@R+#6qobsPNXE@n<rWL
zFTf@rxwhCUmWL3(f27L%h7w)H;r=`9R^nRnnD*n!i)*$>1UQCi=>^p@j;k!f2hd<S
z*HsN1gEt<X3+X8}qIR}wA|g-Lf(AOwmQIukyl=TbW*=2I)lH|UX-Z|0M<E`_vbnEC
zeSLLpyBadYDtNd*4I4-(wJhq*GTD#kJRgD!077FX+L)Ch#V7gMt}quOQ4qwz;9!MT
z2Lp=v@Aj~Ht6ep^1h}kTc>w?H{rUa~48!(_e+dCx@LRwT#%h%q8XBqtv$D4KR^|6T
zn#q_ov<vr3$V=0-Y~FKk_%A>uPa4{~+y6in2JT~Eh<$()ecqBav`-KvSgN40p~1w=
z46tbX-HcEIY__A=ha2L({e5yWvSb+wLc%N{;o;@wg>Sz`7+5PT*xs2LckWC70#p~=
z8!qX$ALGB^K)(+5cCKxkudi&Sl_3mj^k1ZH+z@{Y^3+Oct<wpBQkmlp_Jnd2;K~Yq
z7IkDi%C4>>l_X`)q(2AxX5!|<P@(_3Y=+>^LL=taODK7}9KaiVDKuR(%uy;q<chjH
zM%^KG=XXb(oDF($OtuyvqGzKS0N7Pp@mMcjz`c?=AV(%=U$p!|_53^StmySK+dG<O
z#lrNnw|1OfG1HVsK#o!kmQZ3=8DmO=CpxRe=$<GmtU$Bfi`xMuq=rudNtcF=VK|w=
zSEaJB<9VqLI8g8@9X=#tswIRzf@o(xE*^8HIz~x-x7Jr4wW*xtK}DSeq$@}{&jGlE
z9-DZwr$=wh4l8BQRlm?g5SY`HrK)0$6pVYWLr+g1VdZpxWoZPWZ)Bol41t2m+`o%`
zMPvK-L8(AaA`V&}$Fop0{t4>R6rRO2dfYykX1Sz`!5d6Tp?>+k;zXh_0F7<4+PI9y
zrC6f!S7L8>S2%C_<7tTB)Wqa(sZ!)Xt^!r1UKgMB5(5+C+`j}GX(=g9EiE`a0AleU
z+7g&;M~QjCllmO^TPg#cTKVqQmO$QgYFb*AcFW<g5K6FSg)gwB5D*YPfit1Ct&P7v
zBQP+~<Mse2N(|I}>HF9g76yxjl~lyz3Vh-%FkoS7MzX>KG2MaepWYkZ%9qy{h%hmN
z=(yt+#Z%As?6~ytsF-UrYwoX4>_La+`CRqV=ZO^Ppuh{ZKSFsBf!(LJ^9N=-_umF@
z&{Km(FE{LQ*>bxmVUEABV;zQdPshFaoZ_Zcu2pu-P8~@UAs-^$*}FJ6x#sfC<174+
zUWm}Fs9J0aHTD-ez^CkXe$c)X3&c^n#(BBR#D*Xk3?5x$>?8CNNV<#{#LKXbyvj~E
zv&eqJB8I-&@-y7|rL+#v3w1VLEC#H5BoZs_Wp}o1C_8nDj160RJJKH2k4hW5Bh~e6
zaLKlA2Y<ZwiihZ*@J4=q)%q730$cqq87aGCvzb4BFACDE@tF>l3N~P<g@9OU{X+QT
z>%jh{9=YLPSqn{&Y5ANZAD@Szi<tmujY^N($+q=+d<qo8_x(ZHckFMwtYC+g9HUOS
z_GChT=#8_U-H%d{g7p-6Qd?T+sg&2=5X?Vnxl#o;zzbqmWFHuqP+%RH6h8<*pN0S^
z;^1Jk1Q<{V0PgHJE@vtr5J{;7Jm5da|3kk5q+otQLC52U7a+*_928C7;y*vrs<vE&
zx-2Wd7K(E#*uVz}WV$5F8~|>5Z5<svTmr<%wS|R70C)mKeFHBFyPglyI?mkQ0jL9z
zQVVP*5~JqkmKMer?sI71fM3oA!6$I~3%OPA*Z><rn~E8)%Bj%Tzx_nkNn~v^WhQra
z$DGcfXPn)oqREaZD0D^XxCvnn7#mNStCb%w)F9SvQyVz_&YdzxB7o3)p0%d#D*-lv
z2P``Lz_0D2UVHEHUG}yQ!T%KE85#ilT3K1?m&w;*mGf~j55!A4(|K$KQvO!_nJ@O1
z`}RayBk+>?RwtH%W#MAMwzab!$`0)X%H~JsW&JJ=V0s5p>7+)rAggc2(fAd{mp|9F
zFDG0j%pBw`EM3!+p{8o@m2;i;lFSf%Pz~-X+kc8Z5A7b77Ni`qL%ZR+oYclOszc{v
zUPNyZgJw<WK9qYC*S7BLJ7o(>jH>?8Mk73cmI{6!@n1gW8p~N?7j=}FgY4HkfBOA9
zVuGu8_VQ-a@U7pgW2E)RbK*mal;v$@@R#|Vhe#IuS!@y&g@$MV71OT-Pcwxw;^V1|
zKOg^(xzY4EgckAcBy#VUab;0#>{q5mG`OTupVNvaiH<{nA-%r7o|c*_F#u?Br$8Ey
z2@_5Uwu`efz`X^A{RE$PC-Y^vQ3sD*pB=nfa|noQYaxJ`!zDv;Yv=d6y7~F>I6N$&
zr>Cc`z6itCFp<uQhJ%xmlw=mueFLJ1`_9VRP+uQU1PlL*<ZC$a-h$bFtGhE547dO+
zWh>xAH-EWGQpm6_ynvkcEGs-Xt#G69txrw+w#Hf6X+*`+O4n;qcfIKa*FGM|y1J7J
zK1f7RtzmoUv+CUv(Y-pnVE&_Akl6@-P51aRT#z7t+)yx0>m)5zcAO6RjaNZ}z?IJ0
z!luquGf;r&Pf{qD9D!nhm5`Xo{UcEP!N<qP%fTQ_#YA1+@zAiJx=kLG<&6-<Tms;q
zWU)uU34D7<vZ>1jxHsmpy=#miOT_O`U|USrRnZ>)3}Od)4+y2*_1}EG#-Zr*`74JL
zBod4I04de1s8cH1U#qV~8h#a2BqdNFq=mqRlxGUF`a>*4GM~grv;_LRMo&h)kjZ`2
z*lsCA`f!+SZ{LStI&Grf=fK2~j>evrP_TK22u!o|=&bv<&cEc7ac5Jn=g{%doXO?K
zDwEtI{K2Gt!<uB7LICUi*Ha$;mr&lc*l%n`_bdGya3JaVyK>=D)Sq&-(-dYi09YiV
zD_@|r>HBI!S>*M>2>jSU*nmz#wLD&1j#bvZc~KQc->BbZ9pjRp>b4(0f7$VFB{9md
z6MRe0{Xd$jr<WH)Y}eBTy0%yUjL{_eDxJ24kr9ixr)y*?RR{b{fUzhh1|4F64!;kS
z3at)L7Xg88>DVV^;Igl*fFoDc{)lye2L`Bm*KIDr1BNyhtu8DT*FrdEE8c1X63X)_
z3!0<`HCrxXXD5^XQlz(njN+a1-us5TznF3>611^P5Gmy?AcJl#{U+gNzWn<<<{Rgk
zS-{~N`*9Q(L*R&9Wo58fcNvX~%I=a|muJ*90Rm=0thAJqDMkw_+PtdnjCEZ@;2sx1
ztU`<D`3mrCxfK&Y$=(KxKAf#f`?~vWv{Ukc<9BEj&#71xdAhCGA|+)B7xd7AK)u-k
zNCTwb1dp~BpGuff@`ZgwFXduP?5Z;`%cl`Jti9lRjft8^g5xl7U`H?VcK1RU#;8KJ
z{pW*h5v}?`fosy|13Nq{1D!RrdLEJ)Xa@i((#uGZmEu8srR_j+(ME&fp!S)M#5W6o
zd(vW#0&Oi&I&IXsXO8cHH*x(vJpnxV)8>}||0Vze2FR}w{znNEF$)We|D(WpdU@SG
zdq;^Gv2(m1q}c(VSP+rKX1iKk$K5E+Tcn*lLV$oS=;ZViz*O5XrP$+B8Y%MIg9)M}
zBqRVq6hO@{ZfaW3gJ5B0rPFR^;O1^?X#rTs&z~Qcp9hm!mlqdEE`=zt`CZvlM{?dh
zR*^e)eqCLP%5wD$UoqRCV_PZcriF1CiMC=IpkUx42WBGHCnk+MFs#dji8aRu{Vr<^
z$G=r5Sd1xx$!s$EgY$-Fa>51*q-o8mTU8I$_F_+b3)9MUb=8!K`xuGnyWdF|IThlN
zZ>ib@6|OgViVmty-|TUuj88L}ol|~K@`(J(E{1rCP$l-?{ZLL2CBLLZQdeQ>)#L#o
zvwa1<;!jd)pn73NEw9NKYefGSM-Osbo(H(c*)PuQo$Lr@GaLQnY$jB$x3L7b=+`N1
zetv7&ZN}aHbmHiyQ*+50f@_)1g&-n)yG-Q(u|-G;1m$vS$~?%w6R{8G_7QjqP$qH)
z4k?lS=i`R0=}-3&hBm*uV4Wr5=97TS$JErH%uHLq@Is{$05ggY9H+<a@|dlytsmRS
zejJ{6R2~w8LLET<5HRN~QK8O|`#j|T{2n)QhFJ()csx8j0Q$S{_WPaQ)iG~Z_W!<v
zZS|u@^nX3hAL-eUSK;c9x_KfGFDQJKM%^yA8JP|gKZk2`rgGiSgioi#$76K!ZGOVR
z?0WsWDjOeE-5ej&@6#N2XSj2D$qyuv08eu79is*ezf)0h0DmmX@;x~^GH=iXXn-%k
zbG}Rthd?4&ppyH&?GgfyE1iQMxc^)F9ED=%#G&kz(Thx)mW;=!g5w{8D5krtyE*HX
zxr{7Wn7&O&8Wjh4>eZ>ljqr16DXSH9Q5iQsptip}{t;97=G&6ppa<?2@)G&5h)g30
z>Xp*4P=U`7JEw(t@Vc?$(<)b6Gb~X0E>F|po2QnU;a7vpY)pd%HNr7@h5#0gGm25_
zI6i%Yje`u<aFRE)SE_j(4C5o0>11y-u~RKF(fIb|D-|O!B*KEISJDlB8PDM4OkUgX
zZB88%7LR0I(%2TZWLmaf%dQd(cr>aCqn+M^^*xAQLf<I-2@LZyF}P`-B6me-L6%_M
zimE3szq9K(H=v&<SoKtHum&CvoF<VY{*cj!>(I#j<kjj|x%~Os#7p3yoa<Gop!L@e
zGt8*ZggF0aX_oTw#*t8h?O$^Rc~#)J&$_$+B34mDAUYQz^t)%T^O*kVXUePj7KiT7
zpB}q|U)ojxBOw4mqG4i+70X+G*P+EkNP+G59S82oK={J&w!OrrH=vlK!%t@M%Ufzz
zs9DL$P0W=jFIzuE(s}UJDa}a7NER*Bk?vr@I#k?Ty;yM9Eqs%Uy!La<MbFr0cbaci
zK-3rW*csw%cNwXJMC7vHy(SRmjzmOC#v3i^su*9!X~W+YNSTE8{J~yUyaGbnH#ZH>
ziruIu)qmLj0amA{V9v4v;35A*+M$a|S}C_l8>zzvE_HZ4uG)3+TFw<mL`3|zUEqHK
zTL)<GftVYBuM0fweT7|1u5*=?N`WJ??u?;gkif*D@Ki$f{d)GcF<@2ajNH!YCADz=
z+iUM#3!iSKl_RJ7s2@!-FOd$>N1{GA2}&jj?Q<kkI`CKiUo1d$&Oy5R47xqd`|tF3
z7Zep^Vl9CW(1{7ry2yO3d5@b9WZ!65%wyEy6)K!gIjfBN`|)v*<_Uw0lyNQ@FtYp#
zQ4e*i-5wzXW{~@LP$yiX=n_v-eZZU^{|C+Ehw=J4rgeq2&|Cdu<{(E+St&`-W^Tb+
z9t=801CvFP30j3321c2)KP4^}KF?d`Q{cR1!T@~3-yST<K)=bZru^OF3mL^}sM+jk
zG_uZgFWcY6mBk7<3wf~OWN-<v=fsB$D$3OAYB&m5nZURAlw&vGjA@n}Cs!a?<mj(f
zU;x{iPdfN}{|2qVlR<=sQDux6iyD7c)gl0Ev!wM%BxU1_Jh7AJfcY{?P1#+=VPx$7
zOG5NM>D?=(ZZQ)BR4fs{K1=f#EQevuC@~j@&Y9r{1bEE2JW&@*-YpVO6LOSaVe6LY
z%Vss~!uh!q^#sX^6;vw6N8plS8b<+lY}8}LoJEZF$<)6o(3P<;z%jo$++v2mkO>2F
zfA_L)byp}TfCoW8)i5D|@(cc2ODb{u7Li<pcFy||v8A$cn6;vYm`bwxS5P+%PaTKs
z!L$*5>C^S4wdyLLJmDQZD1>g9uR-<%?0@N;4b!7VuXfcIiu@82Z`sVue7&d$)#o|7
zguCZOfx9uZH)ddK$*g|XcLqk{eM5sScA#$IRNXfnNO{bxT%CIN0q$4zdUjS;3Qk`~
z`qijn%}OSO#AhdN1dU!II7f}jcCNM}$SaNc9Dw~$Hqu>XLQ_a^k^Y3nB;Mzsouk0Q
z&b}%Q8(3UY(&Df?2%*k*<-5MHkeHeI0dODV!gG$CJtZV0Oiaj2*vMgbfavH=K&gIv
zd&^!ypOI&1_7zn6E>4}swQP5trDiuAOQ1nS=6BkKzQvGt(2j%}b`Hi=joZ+gNPg2I
zPjUv{dtLMM*AACXE8eIU864^+Wwt?ap-kme;}s!FAebpn6}6H@KogmJdA6{S$&IMd
z6DVxGw06%@hnK>DSf`R+9X(?ncZ}B8Uj+AR=7>}wO6V69eRL1f-kz1BLpLwZC+gnK
zL*zUcS5}PG4T35(7d?Xtb))2rdBcl#)JXY!Ua_PW1%0U?=!UE*KT|MY$->c*sb#-F
zg_>Tcb<PI77?0i7`)NDWuH$|I=oWz#yx{`Bm%HQ9L^`9o<#)!bq_1oFWu*e*gEpzd
z3mKEkP0nwfy;ae+KC#fUu=LK)Qi8moqi5clk-@Nj4mcPP%thGHQf_wLMmlEQk8Wey
zQ3=hKkc14j#}Um({w#ggh@c_rABHPI0|>@-1i1ajHU7|Q=L$y<OKZmnxFN3#A6=I#
zC$?Y${$3<Bg7qIH8(6=3Jx{+;ZrB5Y|7u2BMN?%{ie*|o#z7jFenYGxbH{=20nb=b
zRS|fNL5-#jo|nH^!3=@AhfR$po!Y6gG(e1#+ViX=<BKnP^>k7srzU6p+pO5>da&la
zo0bEH=%aL2^p;HOkrt?NzG&vlWb>>@lo)Yz(w~skj^lSTEVcS-7RBSb(9X*$WPvjD
zr}kj?Z<dL##i*@fSy%>_Pg^487qpal$?FoQhi@BH`%Av}Ss|hYcp?T$zPlU2U)m=-
zIj@$Jb%8WdJimJS=KPr)LxoB)5fa~)4K_HVi4}{;hdjHGm%xrwBex&io(ytlU;=Sm
zM$cpTxLMoX*SAb%Y!#c#=VfRkjWB-{|Dy0Zc{M2D`kS*?NG4yOhgZxzIO40?WZ<Nf
zABI9#m&NU{+oS$&<9Thv)`R5j;5?~1o%E2TysAF8Qnx=S`ld}IIOl~m{tt>2Doi)$
z79~cXlx{u(<G4(2zw#?1<9*U?t|5lRAC=(CaJ_JmLhm*UYQkd+6)_XB8>IbjV;UB7
z#5m!s*1;i9<EstdPYO_ziFJ;EAtqqVfJUw2_1ORTI{hzBU9HjYYeBrkB?f|_BYppx
z8?kt*hEmc}Ll~(vFU_fAyzYVnSv0*x^rbHd7^@YTS<mUPaX7SIG=YJZdVg9_D#=(@
zfZ4x`^hwS`QId3Uk#xL{*axbasQ(ZyyT8v24232$`DIH})!s#BY$QH%WwW2N9>uCZ
zZ!udMTL0RN0;#C3?gprqFbkNygTkkY2?>CmoqfYS$WoX(0nkDKQ8}R<B&yh=&1X4B
zrBwA2UnpQ`+3B)%H<(s<QnVu7Bp@Ap2o}sw?8&5_me>5d;nON}1E1n1^G|Xa?Hb;<
zy-&IJUh~K);+QO)4(0j3xnE|#X}>28=vjKn!7bux+~*7kZd{g+DJ71g<%vbZZkChO
zO|X_ej(J-3&#{V+#>4FPi9wF7xqV=LzodO^$Y18CXE1*`kueb+SsbN|iuq7_t;YAD
zht+7vg~gB%Dp0bEE7e$Jw8B><?>uCGc#q$Sc+0rmfcuihVKm;eVM_x@SM=1DE5XmF
zx1%(BBbV~OHT6`i+Isk{H}SjpK1RKx6f^3aoP^$hd54pyB-j)9*47q-%ZZA(xOkM9
zvX&O$+VE_>>HUQOpl{2{%gM4JcL$?Zs||v9rHS&Z>~}n0C3}q#)Qk2BwL|c=vNV=j
z{16!KVo7Lx?9>8QmRd;kJsVEiuQy)&^HLoX3L6ihf(EdlBm;xUdOE!m5yUwb9z0|Y
zb)#)gB|7~sJFR~eK72$J%O#}MQ1XfwbUg+ce8GYVl^``04LkC*iFyt=jjUyEEIM0?
zdyXvBHAggor=vH#M~rT)mRWQO1!pcrV0!TW``1a+tX!?E>|D=?y$M5KOtxhqtWkaW
z<9VZ8$VMDm6*$`}sHoM{uw{#NbySLh-<DYE#vb<3=P2Og>xdfZX`x?I!{>7`5je6&
z*;?4Px4wQ>lKHyZ$Omq>bu{qf+fG|lXhb&5TiaL_C|DSC`NHOVF$C2rjN;OuBBBD4
zO9VX4a2BIxD=!}&Ex%@L6F*&BH4iiVs3h;okDj^VxW>KPuQyUovokUA=~7?jzb(;J
z)ucS<+ijSo#_HPh+>SyN!O!L|J`NIECf!X*N91Z=7b=r4A6t0v<Nxee!>6qt5o*AA
zrmj01jhzjhVRDi;l^eLJi}<~M7O)YDHW{<2;7}>%Cl_@s>P@MYs#i{JrT5+IxhA&#
z9p*;PhkY^qR@C888Csn2qc*PvMyc!VLgmFegrsbkO;c7^%y%`Nbbylik&vFZF+!{T
zF<2J5Z^Dc$KaJ!ui>CqjVVbF(pz+AnNoBn3XEP(g+T`|qk~%-1j?aE=U3n_qv68m8
zeBUIHiMB5VtL?Xop_n{KW8p#v`PfQD1a`d)mylW<w~!YZw%pKpB{cBHL{P3eAMKR{
zlBQ80h}1RiV`cK(_gxzoGyDAf&kcbx90`{(K=|Q5Q4bMJiUK3q-}kf2vqMy419>rp
zFKCP7<Na|nE<BR}1CXkL(2Vl~DL}CVKJ^Fh7qzl`pf3g7CFHjvysA?Nt117YL{rO)
z)~D$MEN2fP5|jK95OITA#KEG!|B-uO#@tJ<lk8kl6_w+Z=3>2aux_)@^R|i&?7CLj
zb~`SCk;Cxi9;l`yuG4{CFrl=mLX@E6NqIKWbnO|Ln?7W>8=1c+IopAD>G5bn?o`Ia
zmzd=7wJZ~Hqm_PEI{L<7lhZqljD$ak5P#(|0ADel@Wi<12pWUdZa==dzMHFWH)=D9
zy1`FC1&P#C(N$gTmC$2Ggi5QO^LvzD8E<^3?hw3V>7rmG4gzCRK*=#?!6jV6cXD$p
znl|q$XEGlC(-(@|^{`^)!yz*qRK1bTOW9pcRV?5DV$fNbaS-18V93+(u<v8(s=0ko
zU3NtRD*q=doA{<86mK1`=Yr>|)pK4@UTMW;)YYf7VSr|h-vD=K9v0!nQY*tjg~yPa
z_FWe`#(-De&`W!r+Q*;8dri@^{H9*ab1EhEJ?oU`i8)rsU866@EfDOb@bl%M5*C%Q
z;xTo%iIv6@Hb)`v%G$ltCH@#cGfNHUh?%8Zn}HvP<;kqfjwki|#}N@bzxTHdBAIL+
zdyB^;bhD}roD%;P(@aRLRr76Mo<3sW>FRfs6rgr^=(pLfMp$_*;(fmVIv#2-j5O1#
ze4n&#-|&1DJI%mLY@>irc=?y#l75U}F}9KK*c-UXt7XilUB|+%IZh{{MPtwaeC_ya
z&`i3w2NN2-dYuEu^9DW~oWr*vH8PbZP(U{gtBy}5AdS&zqyGQOb06<V_{$;f?USTW
zumWYO7^eKoZTViLB<X)s-K_KG5I{0|iiJ*SaDV=r)#Mg`HS%gSm!79W!iMnB)+XgA
zTf}DEBGygPisc(Egm>P)0W{Q>7SSYy-xGgrc|EB2x1(VZ8>#+SsU%RLL(63&r>$uS
zyd{|=5q#462dI_pdr)VL7|*#?5<6E?Nr<qGUST=})c9b7P{oQeJ`9YiVM@8HhQBXh
zD+DzzAc9O4Xq@rG<A0CKn?cFNLB)b6DC($uc@wb~ZpkgyaG3D7x8O2K*+2yK{pxcO
zL{UeI95ARu={BviN9+SDRV`)A86I`6)KF9@pP6kAQ!FSQ^d!Le&tm(6f-LEHygXN(
zM2>?Xhyw68d0o#m)Z<9GGA`C=bd-7ihUZvXamRB2g93nj4(J$^uz@Tb=L7l2P}x;c
zsPU{#ABv8hX9v<boL;e087n5T?aKaX^FO+AK%hb-Fr-_otIZ7Bl@4`Z%r8g=NAOM!
z_{S&HF%5WumhlOuiq6G<?(iSs<Dndq;;Ft6R?in`ir{0(glGvp^(d3WUBlbhaC8-!
zgkB78*Vtkjf8!+$d*jXGr#ZhX-@GE{5obAxjJSV8VI&mn)`0VC()Mr(7>4=d_*`1)
z_>9U4;@wo!`vF4i)R@_JJ0nJM9RF8V7~StjPpCreGLtWvM6V|&B~@BgMd>7hgwJsm
z#lAsBLv!j{0|+K0p|`a>SXnwKO{g2?FVsG~NCMZ<`P#+?rW=JQ(XxvVMZw0;{VF(S
zYsPRlBh!XD{j_|bqZWKlF30G*ny=(WsyJ|ZsX(D!L;nW`Qug~uDyHK`7hKH`BOzxT
zwYdH}TQ)!on%cQnKB)TK>F9RheGPTRmGQya4e|%bMt2cGP+TMBN!>`p#k5MKzKXtY
ze>I4FWIul9jYT@yDbv{m{DG^M#+i=eBg>P_;ayvJuxp&|*Ue1g)bj_)Bs}TfZELU3
znFwWC&k`?7@8{bMtd0#@0qlDJRcIN%aG^Xf_ynPXulWY3z-Vatdo=792k78?;t;XM
za$$6Faoimt!Y#J$Pa9}ASSW|wwpPV&_}`JD(W%eXMW=$>%dtmq5|ZXP4RlvWjQTZH
zqQc+77Qz4z{5d@gt(>?!5+duYhV8>IWP|GtYeM_6xiH*%oNG_lL&?tW&}rXrH<24T
zmgC#|OV|&?hp%B`QV0EZ>8C-ULi6bb8zPU(Shs~Eklx-dx54q?Bn7{<qG+=(iLtyX
zroI%G2g$RsLEaC_>$oNQeJ(CNT1*f#^o30j<5``61Zrw}sBWjveQLasCbK*`M{LwK
zw)yEyWCvGB!xAJsqFoPe)IZ@gS*Q#fclcjF))A*{NuvLcb)1IVsv44qt)od%kjS-i
z-hz^x`PB;@Z~zSSST?AwRwr?AaEzs~+W~s*x+y&Iz*wGm3<Y3{U_Q|6^!`~i3w$iV
zsJhyq5BRh+D=5meDi(nIrNwOF^s(~^0<K2a<a{Cf1(h97w8xb+l3E!vs4<H&4+{)w
zTQ-?wBR0NFn=h4Sa@Miex?~41=P(<947gkfnA4Lbq~n$s8gT5F9{WuxAbMmAH>?{p
zdI&E!AY*}7dZ)X%AybR;EFP*mjw5wx)%S1#>k7k@ClT;NEmh<Q8o$53;}hx*9gD|}
zqC$Uhj-Of8GxbH?zt{&C`~%23_4W1EtBvCTxg7{tcXe=h2CN={SiOFJ5C1E-y4rp$
zneoSu^^PNf7g({^S!fvSZWfc$G+keC8D*7nFp$;t)*Ke~k6fl`@od`ohCPh{(?M|J
z(y{L%qJ*LFgwj@)9IGaN;Qz~wT;i3Gq!=D4^^+$3>p~4n?VAZ&2)<G=;!-lfx|21u
zGR}>#<FR4MA5x&Q-r#ixAHwCe3P8QFMHz!3cj==_P?Zbx<<qL<sicYCa<k3<F+d{`
zhSbz|@;TpbgkIU%f{FC_)@H*eM5b=W0I@y#s3u`n+suq<r2c8f+N6<svEz11C+k*W
zI<~SPwN=q=X@kW}XX8#PrD1<cznkI;SP)P)><<k{k1rr_))vj>WFkm|PKL9mz6rF^
zz8XrE{h@@jRl$ts{54?m<7?fK@lDhJD8*sB<4)95N2#Eaf&NlQCMlF-+V4p;Tbhn6
ztjWLEII2|5zEy6?M8F={KX32|b~nC>I37X>-$RcDP3AzzRH^0VP9mktLW#Nj{OFWD
zWxtG<S^K`L-|Ccbu=RAwCk@ql3;&#SiiY+mMTQsTh4s?{c2nJd;8K(?Vwc&b45`~W
zls}wqtCCCY8&0<%?!4so><uBC!*d8L&K+k;0z#k%tXc*tt4HWL<PHUT%^fGFnNgrH
z=lQ0*ZS+ciCOD|~;I;$uOg<)GzJXW4eoiB(rk&$phJf3^1MXRPiu1KIL)!M071xET
z_fe=D;hPxTOhS!r6$m6{)tV$t3`oh7M6kVvHGnIGm4#&q0TmJlFbrpH8f}0F5*afs
ztLymy8Gqu`Vp>{SadB~vmz$SIM-n*-=@}V8fq}j+$CSBoS-vkL`V5HQxX?>wiQi#M
z$Hu2UB!W6nAuo0Pg{?1Cdg90=uYXd)Ka0Dxe-95FS{riRMrheGZ>a3cM`b@Mjk4`?
z4?<y|OZ%m2VYl;DYlHagfSmW>`_3aEqvWO5X*OAu6tPwR=e>A%2%fu#5sn#p>Ri$~
zOU@DT{fn0QwvP{n2Ew1c(5vfEut+9%S82hQT3+8dIcas=|ChrC{40xqaNSQPxa@BL
zivS=N%4G4q2O;xeGa8C)Mx)QbMdMm3P$CUQ*|M=19#{@!R^Yx;6Wvju$<}V9)9!lz
zA??E7e(2JMBB=gx#5jv$Agh6palU|42PT+~f@^9CX6nC8Tf$Y9M`~S^m^irMP3Fat
z>{-(@9r;U2Ho>*jO-y{m{+Uw+*ZMVV`D3^W)Hlw?*}FEgYh#1Oa)DE|%-5do#gE<!
z(PxEibfo}qKwgg7Ye-z4=sGf&*k8i@1>L~L%BqZcV`6>L^U$>E90ihLvppj3o&}2n
z!vPu{aC7A_p_JCqBy5Z1OqYZ)pVGn2kNgrkr?7>C1h=HQnFM#RZl(>^HhNE&dKAMd
zb&eG2&4!h{iCt>wji0X*mATJs@LSzQWhcia>MPjpTt!o>+O~U_VZ*0#tJKgTlFJGJ
zaed`cjji__;!DvR!%nPm7k9pM9W45l5(#PQBex^o(p#}vF!41^M5r?jt+%?OvzY7j
zQd))hH)%LiXG~T%0+?q1vHEXZRLBT-s9|&BNV!s3u!z(Xu*Il8A&|hR)6HbAhC-F>
z7TtX@9D{~7G9*aGi$vXm<<^FKxt!gM9+9)2%-ee)A7pEja>JEp#5~?7kNHox)~k(&
zNbVnF*({d)vc9(S({Qft;4x{&&C8;f>mf8{$gP9TLJ@OPR>B!~qwLD7Q&4oZ256rD
zk1EEEcI^A%HA5C3Ft!5T>Qyu}H2nPe^PxLWg*u^cJ8WP_*HV!x9&kgS14C49`z;X8
z%$#9OI<MCQK*fBxz6QLJEVwo&b0vB{_o_}#%q46UWo6u+cSivA@*6(>i>0H_zsM3q
zUqJ>uYAFoSUpM9b1Ja%S6y7}l4^>|omDjce`2`3NJV0=FcXubaLvYvN?(XgccMCy+
zyGw9)cX#(Wx%a&{Ge2N0U@eY(d-v|HuCCG?IYQb{ZfO|)&fuGWbkpZ2$lQ?PLNU*=
z-Ax*5aNP{I4G?~-2EMfX;5k&*HGE17?6JsK(7bs}3p9wf)F6l$Lzao&D0As8`oqd9
zCUds;w_P%A)V5f=bvtykAWGeUj`;xqH?hX7Qc`tYwRue_s3w|&L_~s@>}LYM7LUXd
zB-tm$B@T~zbPseef7hAWxtwhJrq<M2yu5@h&4$f>@Lh-Nlqz8m@cWbnCQJIGuz`lu
z(sQ4CoA-Q$b_6>88=yBi4b}CNumfUxAD`x99@6KKu?_d@rhHSMIFBo3{pa<tk;*B4
zT{O!GqJgV8+0EnKCQ<TeN<n#%4MRvZftBFP)ju;hZ2x7t8xq9GF#~LPi&Oc`y=av6
zmIgKDmadu6<Jn?oy6dv>#nx;6O?h3=1dLlLrK_=q&e~;b>-M5<1#-H|l_YAFtM?l1
zmjM_@qpCfrM{(G}oZoG$s-d_*BR*I0LzJwYp8RLiv>NJBW6)}n4E}}~{)Vh!H7IE5
zrQ^E6{=RN@os8OX8afJ~vQ9u%+0`PnsIDq%FFH!BUL?S%ymmZo89IrIfA`^VBsPSN
zp1bXVBOC|+2j?bv%f!b157Bs61@6M=l9F)+AQng7IPS}EA24xqdNYL}fQUk+S8yeU
z!w{~V_ua+OuT|ffgJ1j{gyyZ%;qRnx0OoOs>{}WmKdoB@=z}loT}>i9@@nwpnRF4e
zji+VddAFM%4HrnK`XP}+;Sm{MuBfKi<y*LU_e-emHg4ZWkg2N9*KB<s1_FNx*y0UL
zg}k^o!vUGa7-?v9Gxk8y!ejRp7~uyL{!qOyo(KH)H$Q%#ldi>$z?ZC}@X?my0Mm8W
zM}tbGuw>8=-U;t^7uTG`-*&tasUNnj7%PYJA+p9SD;dMgcIH+YKeQpFP-^_Z*jIbA
zdxmJrPx%hc?)6*t>0$u$cr+DObQiyV-hgR+@n^809B{-yTw(wIMg#c3!o$NCOago+
zJ4Z(?fRivkQMf8pJl)gN)57(=zP{f3e${2Cj3r3u^6m}+8v4LO^J$cQ{buL&v0$U>
zA>CwW{ITchFACUtf%R)2ow+E5e5Cqg`%Qdr0nRt}Bo>&ePqt5P3jVmK$X~>fr&WBf
zFA{=m?+Y-De#fsPc_4lkBej_t(?aF7ZjqsjT1dQ8M;b=+^69E~wYs@Fe8XN6Cwd~_
zyaxXa#xS}+Jy4<QDCtUtKaTiegMNfo0s)|RFBIvv@C|v?$OQO>@;|X%{r3ODCx<bN
znk0a;J8<;kW+#ID`PJrew?DM>)c!Ga;#Zyp%0(jW{UkX}%6h`EkDKOY$boPiVYR3}
zrh>kX#OXWvW@?{#bqZOesf^4hK!7+p@=mhov}B`34exlntpr-un7r;c)A+a$pb3ML
z3VGBtjHsoI#6Th)Y42~(ME!_iNX2A@ILSp~5dzOt?DPZNoae)~e7K+@0WOKyYNuBd
zoVY@MRWWXC9J|IuPG<d61Xau4P%+V=b*9KXjzb2BT)EK1lW%w(VjDMyy?*`qn)CR*
zq|fek=BJZ-M?sL~iRiiB4yLjQWGUYx%LaKIYrh423?m=OzV3_savu1HJk+<SwmY(l
ztM%NYv3zCC!yi(W1VZ23oJqH`T`6|fqSd-?gQYk1jIZi8xFY?B5-Qc~V4s5!YLFQF
z`UI<LRu{H3hsJkvbD|4X;LN*VtJ$>Be6@mVP<t}vqGwlz>B~F>gZ2+&D2c&l{$OXT
z$IU%ms@%Id2z&Hv!fH3^J|)nyHs$|8q3?HL#ayRk_?0V}j~pA*C(4FDaZ$VOx~Smi
zHV;D<6M`XJ>omE(RVZD*o3|Fsu~rB1fj!$~pj6ZF8mU`Esd|0ceh9^jPx?XmbP@uq
z4I8@&TRl!+<pn24o79^zpW~P{kusiF`D97%_Q^+kbJ63A>t^bH4|g-ds%x`_-%rID
z*T=9{br8+6NY(^?cve~<t?aWwU1$(?gyNl!2t?T*hAW!M?wcA|B}Xh`43<c_aObZR
z{nNYk;W~DAh{a>e;uu*PI9XcxvzuCcl@4n(c5?Yg9OoSbHTHs)>mUEt{sb|d0Fm$d
z`uen+1YmLl#>xP~_A0ODuE@w`&<kCtD3ScFd=Bs``9iJQ*w`p<MWfr^`s>%P($X-?
zj*1G|LPdB?rkz6>C_7us+ar99%jDvDQ8|ISLuMFiM>Uo03cN8V;?BkKk2VzMYZnx}
zlaCI}^dnw5NSl9<<%Z_4SlKns&cQy5opSLS8n)Pue760T8HA5p`CRh6_t|E#S$dI6
zxp)rCFXijbEpjX7b@%i+dXQfVO`8@Zo;DqnV=_yjh=mQ*=iVKi(8DFB?l`jK8PdDa
z-YmkSqoX3Z>^EwsBIgR7HZHHHo0F3h_I1zeQh0bEPqUcf&q!N)v!MzP=Wf==G?xo>
z4I#HK3Dx2n^P)_R<D}!AEMopxaA#$|5sc{IT2{nkVrhbn7e7mR?1=yC)3vVQG#Je@
zkzKSEc^I)~i%iW!59#@m=eXOH(|a{(0NW6H2RHAwy{VIC8Y+pA=3(x~?%&ykmI7)v
z7^m$E&f)BwZdL@xAARf%{?~WaBK}X`Rhtg&V;?RrDc_G`CcRJ+izLmvcnHml-7M?l
z9=IY)NYxs?TC4gGcAkS_NqH$7gm(C<4pP8U-;Sdn4K5QYOWoQycnD7!z<<}$jQ#kR
zcx}MifTTUL^QpD`k~|6MjSxqeJV7>x_anQO6_)1Ky*Y0`PLHOPfugzF_`<u~%5{rx
zulzYUPINg!KoF+B)KO1A!kWDKBkwB_-=@O1D;=Ih@1v?(Kd#bsL5I+v<U+0&hhX*e
zt)A@@>45#7x4|wdchm1Awnq23=<8Ua-Imd5=ion@whP$e#HpG5gEZjzxaf6vMbm!q
z8DBCqCFl7Z2J8?sIN;iL>;UqYj?2D~Ps~SvVs;Nql8pnd-~dijV3GigBw{l40{o@<
z8DpkYMn=ZFW>lCU+2VxXGK0c?0v7;}G4p1cTuMVDt3s%T82rm5;#j`d>(#v}p-p@C
zMuff0U17+>tPoyzKCEpFTmmu9nl|TOFgnz$<{{5_08Z&a=n{43Dg~)*HZ3hpLsj(-
z!wHaM2S%5DHab7#BDIh4$RG(yuVwzgleO<=%Yunw)|qRla`hbZ(qQWKkS+2aBL<-0
zCD*4HdYD&qqvUb1+oyDBxrI8|=$#s3bc0AP?fhlld(UW=TTep^#L;^rhTARw(D|%Z
zd!I0~-9c*V51<l@o?5dYjz?WPST|@5C$qYtk@RuX1(7go8|tkZg36byS5$IKHMa#X
znT}eZy&9iAYhiBP2r%ZAW_`*{m~#}(#-#7Qm6omJpZ%#>vWP+z@26H;V+WG!+$m6!
z<OT-_B4-LjkXE;EjVAy#8kyTvO^E=<l`d%N!G(w`_{|o~CZCIlA;H^c^J{U?W7JDj
zlxx%Pwv`1rGm%(baH6zq)h~F(6;t!zZ11^jRlsaUY}`-$7{7{2s|>rmt)tTSXX_~x
zTwr|P4f8QGYM@N2csjt!(IZ(X7Y>7gfQjj<0sdl=fVDp6bm&_1;CtO+Sp}U<2iwKM
zxV$Nh8>gTBBg)3r?l5p<9rnB2&f5XD0R;sGiHWFau-?zFP`I0L=sdf8NNAO&0j1(K
za!0`NLK;9CtwX9blFnsMKM<k+OYo7o-Z<Drf`0+M;kM70;9{;nV%J3$r|QQU67ckg
z(E*R(<fC>wt>IaemQ#sJW{&p_?>hjk6{70`>xk&0Olb#+L)OU%?gG)G<l%FRj&_X=
zvx`Y&KGZ<gD*&7+nb9|LvOrwb>RpN&Zs76nGzfjLoreJ;st!etCA{Aar##)e6)GB<
zPLuua?=nrA<kr?!fB^V@Tj}GKx9u;W1J+uQ?p>mzQ`qhb<#2@>?#V&letW9aX~DM6
zc?qxK9A2dX3KDX%zw>knF7rW(+MN03RCH&==C}PPc3$1j=hr)948XG0!Q5f9?p}3x
zH!o{3?n?uZ4Jg?(k79yh%T{LxU1WB^rx*)n^lyFsPq>dIM;IwU1bE%#XKQVm8X6k9
zy6*y<K|+tK=icmAODrxf_aSWd0Ln|>{;&n~3S+FQVf<Qq32^Z3Y-2^>oQh&XW-Z!F
znJMLvRbfG$#*Jow;^9vi6|uHf0IYs>kXS@2KY%<1yD3q~#gbJk9|V&*m`5~LDV-)|
zT<fzNrSe{<VQW3Zw4-u9r(rnS-n(}+^p^Dx484^4be^E}?p56({sB0cV#y)@)dmR5
z_IYc{%iHo3LW^Lv+v=^f0?cY=W@nRVisdPIKeo})(ymq;M|A1AJ_!T#<ybm-3WPJ9
zq8R?^ecG{`pn$ih-}&U|@)UD>{mTPPBf({;<mls<(>M!RAS9s1zQaO@h5*s^cxASU
zE0{Tg*_2W92o+93iP9NIUo^0>uRgHto;^;#@-qH?gT7N~%Z02B_?6cDWITWG(i8`n
ze(b)*r(b_7J#Pt?{W~kv^cN{qQTfY@ze9F$aRD3;(9qB@F%J(9KY_meHu#t%x!UUH
zprnM7GVJ8yQu*^|HTgqLdI~Z`TxzOB@iYoDvJNm4^_GqTY@xv%c{6D=b_?}qaVlK-
zQePp$i~8lqR9Y^0V5+|D7QrF$2aRQ$itqwaa=e`slx(UCs}rtu^R!8`lJ3i^fI5q5
zfBe&yR>IZ$D%TY$u%d9kfZA@KA#0-E@PHJ+E%%@HK9E{R8j3jm4k5phn*W#ij}6R!
zBuN?r<>+BNzxh-FuzH^#9$KG{%2+hS#S#I9Do<b-2ypoTsJDjwk>&ud@bf2;96UDL
z2~gw#MAibmrMbB~z;hWJE*K!ag^T2QXJP_Z49k%(MWyQT{)#jgJj4vYFNcD*GU$=$
zabX0rn%h=eJ~}lelB;+qjh1Q{*l*NE6xEuPU}A1=F_p}ofnE(J#M3Y5f=9=M_lP|G
zJ(bu;4(R<A!;J>dF1_#RMMp=!@<RM)t)pkOtETJNm_3cxX|lqPdacj{SO1WsSPD1=
zboqabivwt6Z_xh0So52r_{P>&wO*IMU;v~#O)@a<2v|JbgFwJU#U~UpBU96c+FC%e
zgf7M7{%jSPl>#7L00S;6C}@4XTb5r10bLZl>$+i=Xk(;ulL56>oxjrxTVNmp8V=`O
zA_8a-1p*trcY1r$-WKyx)0OmgUkw_ws&3jjlL1TS?pZHN>s^<IfQxU$H++HT_mkC6
zo+!pkpo{&?)D?+@tix5?dfzE9NzO!~GxG4}Q1)h>ma?tpvIF<Z7QB|@y5^1FWxvWo
z&*-+g2!}R5pnlN^6rvP|r7aLxhDc*GpTbE<y?^zVnNq9@g0Y(JzJ3>#CQnFZA9aj2
z&ARt;)yba}Y54-3%RHff-$l;XK61+M4dDZ5hAYf0>rcxKmGM(np6w<P1&+aKl-~hd
z(z78z58^8Ad&Q^u(U_<xD@)6nLq~KS*Ue;FO^ff}jn!qPq_BZmPyq7-oV)9-SKaqB
zUD~h5xY4z21;>4$1ChAGKZ1v(v=Kk^2w56jIo(sB#D5wH>M5!yKPF7Xu8d@F7#*ja
z{gg6_ihW{Gu5#DtKjz+rA?_;3Kq_)=NC5l;E5DqElZl2&>yLoWqoE$TSKvgdCBSV;
zoC4tN1<QIMTgA3+%q=N_1_9G5CcyB5<w8{uEPDUIK(@=8n?C_VKZ6=9;Y@l731dI%
z<>27_s3MtZU<l(!5Sc{$^k?rebHk;WZ$BAGNnTExiK*X&AwCu#HXh*umn*4S_aO%T
z(0yfCf)@l733(YT!;!cW{z@v^v_FPZS5VN?j}HxD0jQw4dFk?LG6^LH9N*JH{>P6W
zO={c@CUO@J0Xf)b*E+V_<aKbv&4S7LLzay~9k~b2Vh(3$spxq)KJwG(0S(!00|Sqi
zzJFCVZ|U;c?3Vs;A7`i>524>){bc-m*=x+GeqcFXT&wB0iK2@3{}9TZIKEBMvX`jU
z3_;?G_?#CibE3yIfFcMIf@r%OsI-S6MNgTbKK)lBkYY%BsUW?dU%}uNrU%e?o~Z${
z{k&BO;1z$;K~G>fML(N@XEcNXK_LQ<3M>i=EO%~8E;`mt1F0jmxn`L<ad)@bfBy0c
zra%EtJb*109pfwvX#3s9M>d}LtkoMY`_=ip+zgpDd?XB%hnOEe#!gAT2?-+}DC)hx
za{sTsIpK^P<J=V>nYk92`L81QKXQ*QkD_x6(v$%lyb9Ef)0mz8i_-V_xjaydl&z9}
z#G3?xvJijo8@RIrIMhT?BEc}zz^(H;RiJz}=`a)Mt9=Z_unyhYBua#6Bx8Dn>dc@Y
zLFC8=6Ed{VPdlal1(z>Vd3glmT|H_gVg-g@cPJW`tr#%!R$&}XkVQX(PMkezv9A&~
z`M~~>SI+cH6CEo^0?!MLQwo&-fiq?Qf&Tu_)w^n-{&d#Vj_HT6KX7R;1WFrnhQ;jz
zVz_wF5b84ExN&QlQ70Xi&K{DI;lNlW1{`3mvNS4anzOXDluSEn65%ZD%>?(aF-R_R
z?C=1kTe4YBJc(!vEp%?XP-4y)DTD{vGU{#k^vl_w-rQDx=)le@mUe(;yw3aH4O=;u
znh+nqWy_JbissnA)NHjJo<uEo+BSR3U73-8eun1sDfnOSh>6t0&=8j=j&kJhp#*^h
zE9@QWy}pO30Zd|)&@W-_N|LD*0iB{I#1LcH6upOGI-(<DC!t7x`Bv}Xh$QKw!07Iz
zH7pnS?Ck8~$sNFdH)G#X)?4^j{5SKrKa<@fgCt;Obgb3>^ls%jcD96n8hnGD*GqM3
zPXJx|yVvrB!-j>TCjNCQ`IUt?S{jF{7n=jLpiPXPEJfv~<<L%~8Uqy?+8kTHTrb)}
z2z^W2hRc@u+*8rSe{%FU3jM1ZDdeS^F#fyhpvkNu?_BY+(}7@EnzYK6lOiQWWwBHw
zjQ>x(0mqa=TnQv1^$M*|o024>J?5oWtDj+{SDVt4eai?2c2>U(M);><=v<U8%m3?<
z;7HrFM+EwDdAI~T+K6zx432T)R5Cf3I7ncF5S7xHDt9_kffUh#)E1(aO1>VF|AdZA
zA(pb#WgCeOIya%S>VMMCj?H8R>D(TN?~nz~#-DUgD^KUpG6|vmFyIv~a0qiyiQEby
zSuw3P!3DoE#3Crkd>{~$s=z43i0kh==9Dt{F8(&BN7++CDfAksk&A7Bx4L6fQn9``
zT-N{h8ks~%l3z~A2v7m-)_*pv5VRAON~PQN)FpY=e#nwLT)J~nSI@6o<swTnCYu>#
zA>aMZ0@5|mbSbo<05k(6UmUA@sf4hj1p>%5+AJw&BTV%p3{85Be1|ccMplcpaoBBH
zaq`H)u8JY>`7&U@A%yf;)M3Fv!Ug75lvDyLv4x75r@;iMiwL3$aOb^wt2i@=p?L?k
z9Ni%u|7><7F3$cRqoUt4rHg1(rEV>VE_$h}N1u%p{3BhHGrPf&Qc@}?;Lm<fW}sSY
zWD$w=u(}_Zl1?>iE4t&{4-dvBPz5@u^^_K67L*VLPAC8iK_+Grp5>@4;|!~zAw?}p
z-W1UARV=k^i4-ZJPLwpZut?$3B%GP1L5rBRa0(P@p)FYtjfolX;0GdG8%Bmjr46J2
z0Wsfxv;_K??t6%}^&F;PIS5!3{u-E{T)5KJ4VeuEEM>7^(*4zpxDhAa5zSCXHcc3@
zY#$dsK-IDPu?t|Q6Gw2d2dvwLB7Yo~=yR8czD1;ADS|Yvy;oZW4$SX0HCgFAPjRg2
z>kEo&!)0P6%zz9AH#abD5lT2|jc^17+^DCgXRW56yoje~YnPsF%W5N(uy!CLun3Pn
zLC8{jDU`9mN#iVfjdCW$j<~KB>_UGCz<Q9EDB<8`JPZZ$*lprTxwh~f6Z`agB`G2a
zruq?KO8wg1un{8SRAix|7zN-@Sfmm$J-|wN6?T0wh!)wjLE}CohS;RQ&=DXCe4>Zj
zB?k5quhrLIgrb$aU2vWU-QJ2~P(iuD{e3q^(_@}IP%wBLU^wVuGG$+kUiADJ<)PzZ
z!v%X}@bfd02T*wwoRN?8;FMuvDFlY|+;52q0-uQg6T|+-O7hFIU6g?Wk_^Xs74|n>
z@r2(N&xd-mw^w-BUq~?wH{)eIIb7WvC9JQyd_`pQA%sGu7vsp9t{8A*{}}hXsD22i
zU83-AmAHahgk>*rs9_-SN8<XtA`YDX|EgA!e~wPA;5XwBx+goH5#EmEohYdZ8isl!
zh@*6PB$$N8@$HdmI4Mr_D@%>W{|WMSXV<*2s#@x*R%%Qqv!x{KzV5Vx0|m+#S$vz-
z-$Nm!5G>5xGZB4sAPjus_<tTm+x{>_H?zCNn%iX}Jtdm|&{BcYb&9^=N9eGWF^mMG
z2(+j`Th|}gkTpG$gcK&SA%crQM(9AYqO?D5;EzjUY3Y5Yq+(k|YLQ!rEhQR)Fu_jA
zaez#-<_X;~3cl{#j?KaAKU?fS4;J2Dg35FF3{5D(sFe{7i)b&&RoeQca=$1BtscLi
zXZj&hK9eFyplFxMn@tGGH4pWxt3s1{w-oco=zy_)eo^RK);B$e#ax^GYKs-Q|GloZ
zylY0;wmgsZxYM?!AKw0qd+=3U<fIUa(ivhBT#*@6AMIs>8CZfSUAu$!VvXus#NPBf
zGBD-(5s)J_q8XhRL}6WqxxPr_(H+cY2I_qlq9|zSDauw>PFcWFk#(W3ME~c61ipn=
zkM%f0;qG3~kDt!=-{8+8G@moTOVW09jEE4$=DRgnbxaDxp8blWJ~}{RW@l28rwr}s
z;ajHyBC{l0JO?kkiNJ6=-zw^hK{^gJQvf7PFlGK-9FowhpiPJjA}cGtg~dM!>3<di
z@6o2+KB#j&+}ZJgN(VX{!4LeS9JIcbTam_>Ns1pNDEVwmrIWD34U%<HC-UG@O!n%Z
zc*Hw%{J!yq%_h{-J;L~zspP04^)t)@GO5T5692PO;L=9ib-`lOmRGII`9*~l#f5?-
zG_}PMEkE?NIu0=<Fnl&nzf{WsG__3>R?K9)CNMlAi0NrCoCpD)%BA>~%?|T&rL*9V
z<@6Oq5=im`V6;h^8~wD4>#}0^d<x{QT+Fz9p5KyppYdIDDk|uftR4sd=92$4jNl7l
zLQC{TnxGgYaNrnPOeT_y)Q~NMC<NigIAMi1kYO}_KGd5*BE_ftl!P|C>YmHQVnoG}
zo~rmkV|Ovj`RTzhMyBP22_#QtHv=~F8Xq4I+Nf)CI8Wz&o*^n$|3tjjSlHP6G^-?K
zaw7mP_cxKM1A-ASGH%Tt-5en+TdEA$$O6bqKo`<!J;96+s%S{hrgICppFr)h|5Hd{
zU|?cmqFKY=+=%Nl<c5WblkCvvuaTS58r|38+v%epn#;uQ!ef&JAW7p8h>J(P>#b92
zts4@PI<?a)|4451!~u#35w&^IXBCBvSU(bp4`#K_y&Kz&m38ny86Ia%7;K`vf~b8<
zOB$fYlPRh7On&~Q(MNM21x>@t$2OZ$<6LF6wxO@Y${lN5Jp($bKqXVMjwB3}>U{=X
ze<+V&f2mTh-3szcSXo)QlA{5~Rp10>P-c$w+hDKR7X5hJ^4U^{$$huAm9kHN=bFg<
z5+#U(hlbftDtt3hh(zG%6GKY`qwkU!Mj}M6D+Ptnr&6us1Ty|*72<Oa5i2@2O7TCE
zp)?DdMWm|cUQM10qo_P^GJBBZ*|Yl743VjMczMcH+uPf?2qBA>e08K%$sM<UI@*2#
zTW8+Hl$YJ@hWI;M$M3?{e@-(T1Sn8JQIWwB{86~Ai7s%@fHYgMjDjvwbgF?r=!i%G
z6%bX#K@j)!<T>jFq`tA^P!b3EG4shbi!S9XxvS86icZZ{M9N6AKseT5*%TfxG{n)<
zrJo2zDv1WkkfDV%EO+KBl;T#TE2hSRNgOVplEWZbIoShT9tn7(e?$c`ieaAcOGi)@
zjy{*t|G^Nbj+_2Db|?D;eQUSbLYfIbFqvPKz$f(Cy^U{4M&MQWK}VfKje5yS5L!gR
zvWbcTgTW-c`D>{%7F_TJtuPSLO2&yGfK*IU-HF%1J#`sTC8U(Rljf6WE8dNTwJQ|_
z34=K??+v^KlX2r#hGUvuXyW{QnM4-@A$JnH#a9Ek%W%u*4{qB!O-Br{Ly`L%D{yE2
zg#L@6b-74@-21=D*2E$Ojsrh7g=>+DSgsnnPzhqZ(G-n=g?>k_YU~Y%PFVpI&di>H
zVCoEuKRbbGzr&$jhM=&)l5zGRDpuRCxj|RFEqEk6sM&(;NDYvlGdgueJllD~F)x7<
zT0R*{@YQ3$!^}56EKE!2+_w+^EjJ>QzR({6kBekctWGi;jn{<4*72k-M{`F*enG+*
zJWUa%BU5&qs%8W~+KZo<?&(;SI{!2JZrSSU_pGtt@#o}(?$p|hMT}HBrTPIe_LDg0
zc||!8hG8-U6R@a8ci^#brhs@v1nhx->KoG{<@^FACZSNF+)!stB%w)h$|Pg;Vxv;A
z(z)4&ilF>&7X|0Uffy`Cz5;L-8s;h3Z6nn2NA4F8J6$Gpl)<nevZR<;>FNnFO`g(4
zaq9&Ga#DB0*i^g1@Y0Dt{6i+uytm}N<&i6q7=}@E-?|QYUpk`3XF1E<eP+Fm<pE`R
z=v!{S?DL6SVebxpLc%UfHV2#{T7nt1z~{a1ELbl+BG5q!l5IMbs<Zof2?{i>Q@SOn
zB#VE{6ZLq75ZM?~<A`N8P|U@6uz&Qz;$YM<(5n4@hX#&&Al>cn+>7rhi<SH}bNDfp
zDIr;UXmcF9lf2)SC#1t7@CiQU{!e$_eqOc3KL_)X$*<kCKvq|<I@xvol<`v((XgRJ
zFhd@3WiZnj%2BZ>Qbw^d)th@})yjEIW#!iI^K=TRqb3gCZwp-kP~t5L(7DjY2g>M%
zMSyD$&cG#4C4_ocP0q@?obVVIkDP&1tA?OKt)m?7EmYSjd6M(d-R~1r9sHl^{4A+z
zl)j*4ZQ{yBQWabiozK3%{lZofKfhEd>s0PBa77^<<*gy4qs`*H9p5jr&+1>Q0<n>q
z5fs9G(dF{Yu7Z2{(LY|ARNW+zsh=WAQ&xj=+t&_)M&e1l67RbN3({1K12qrc_}*wb
zHWn7B6JQPAHjj)*(^$j+?>{$tM^Csf$>C<wT9jV^+Dt`Dm50&dPqeVTAu|f8;&I@f
zFAqto6hm!>qC0q1odz9EN;He0ya^267<MN*9Lm%-2dVRjIP@!O8y;JEIXyrQ|EHun
z!iDRk9~!4$S5P=s{3L=Ds+&kzm|F#WZBXVb!|<-FoHjn=mt{9vYjuU*@L{nUqn1Ea
z_xgSyN7DJQ^N_)+o}8YZ-ZLK1l`}9cO&KMo`M0V^HAb02{-7s38uz!7Dn|O+nuX0B
zdQzVMd|XPBKx|!KM%H+Z<m8^J2=apxf(8$rjUViJ_#NPyfWW;+JVV)^6QdI+itRkb
zkAmY2#WwGL>n^NAgrDC_i%W>gnpn-+a+1W>AWO>QAX6b&{_wnSY&?6Lt4C>Q_5S^J
z{y1e_r_Jgl)+n?2{%0Kk-U5E7J_NDJX%-9^(LSk+do~8q7ELBlb?5qL#54y`dLp@C
z+C14Dfx{drBybzGWWLF-<%*>&>7#&NF$mPAlbx0pURvZeN13wNneY_|ZQ8$gmLh&<
zc~@?7<SE5%9+Iev4<QV(M%@fEQHsd~7uzMVIsXydzGdKvN>3}p$Qmj|EqK4P5-LG=
z6)jTQT>lEiV7YXT>kMVmrh9VpAPqhyAr;x?US(h})`3rr^cN8EwV^&?Dpboh#Y{sM
zhEDbN-m3^e;G_W0KQ$~udW)G77Ei<CY1e^G56^4#dcGU)co0h7efe$Zb61mX&XP7a
zr*!ly!NrU6R2z{F`<6?+6FeST8R6qsP9h59q%5<joCuU)REnz#2*dD6v*wd(DJjW%
zcb+T&293tyL>5;#slfmz;OBIe6td~MLH!%f5fx!bc(bNUHu%>Eu|78Kn+~<ocwh59
zX6r^QQm)XVQz=RRFbba-T-53kl<;DI?6IsJY2PWoYL<a*e^vrc>Yk!k48y8jf$ePm
z^~H%DDD^A0x#ij-pX6}elawNpOJbBS5*n?!!AM6ck&M|Cj6-ba+)S^naD|<x<xUdH
zCb>C>lRVS%F<xlyU*R&c1l)O!Gf_bu>$+YWoq+xWDCg%-DtdZ)V&eS5U7h0E*K57Q
z{a@br*PMdM(XV<Sfm8~=1LLzEfyNxK%36mc+cTEFM|L9<695?;uKtB^7$oQCjSNXJ
zII>BYe*Zhz#0*>5FR)|5cFA`Cd>49$MA(|_v+D*UN%Y@%$jBoOXAzIuV}~<a8Y(F`
zBPmZ!NSZ7avCA-snp;7^eQ-RiuT&@GBK!0)Z|C@LnqQ0mY<(W5*1qP@OA8hl@k^f5
z@k3*!gttdX#;=6_VrVsZMT-k5G1Dkp9@%)3R7I-cP0BzdIuRs@=pN=`JamNMGmeRi
z3#dM>FC9+rpVh5X!8YNhzy3)C%csHl3V+(^UhZa5$3@AgP^dUqo$=!b20s3JwYz4}
z!)uFupT?dOSdv^js+hV1_%&BR6jZ5G!c}~TVSGpy!$WYMMEu5a=Ea-K%qC}&_0y)T
z7xB~rFF$cWg1aX=@>6=~%W^xs)jNQ}a1ocHF6HhqTKnYJd5hOBPra9*YFVSbUlwho
zuZJ4aXe|ng`NA=7ugV5C7p&1*RamxLL^3YHA1Xhr{J7gPHcVfOE*a(Xd2mP&=dU)o
z#?~D2aGNznPOVnqw(`;b&26tPipdZfh%e+1htPZ|*w9#@_%h4+GlKccHwL84MGQkg
z>g0>ZU2@VX&2rQC@wFkq;AH;TIFb@I{GoB-*RPSy9{VeMaRmJ2gskN7$q+o`r@rcB
zT;xIzi_FMDro!Av-Z?5{A**37-q}eqxi~=b@VxbU3g|s3NK44fmdsAI=jm<oSiJgu
z^cwK`@s)(7wvM6yYvWgCY~bDH*Y0aBohZLrvhf=ciOD__Kvv}kx80G#I}_rqT_OuX
z%~uOwte<ZpPKWuQ@1fO~@BWE<YD-dCmK?56Nm4mo_Idc)MiGuPaOk)+lbEQ_xtM<?
z7LCC-5}#B$eP~M_j3i|GgG9LBVZMCDS??5|zl~|h>d=P+EFiv7_X`EOH5?sv-1hCo
z^<;Nr7Y`oY=c90$q|s+fKA+gq=cCY=%?{%;@m)8M4`f7lQm{T87jI%^EA8Ky!Li(N
z$O(F$TY3q}ymLO=)a6?5!Mm&Yhm-T72pup<mX7Z~Kc&~%w7piWdN1HZPt5sh?IfcX
z);Y1IzuI0FjY<XqL@ODLY@c_Vb3pV74dTOip)3mQtd>!tC|EEY8G;N}8V<@&GJJ$^
zu{S4HsP;7-T!fV1_WVEc#kF<$EI89{Prbawa=3&dWwQuCJ6KCXV6B6)@eY2m8FNQ(
z$5>D_a**U!i|{)tI=`=(OeeJ_Up@{fJAw;g3Y_$+OL6a~aXfUSKTbi2B)D$-FR%?L
zx!x^7uPBNxQ&Q#l&4XZPNsIveJ3$4~7KRq?4uk$5G{bai)9LR|_e)O4*qO4~<M?Y~
zbv|{agWA7M&#&lJv2LDfYiE|d?WV`Qo#P}+cOEIu{ea^umrtl{iw?iAkwMee^;<?(
z?@<*bs*rYF;ShM@S;KR1;rIO2WIiY$oQ)5c4fC%l3NO2?=WkY2;*Otxs&>cktD-#8
zxz!oS$W!C>9#=wtWt2t1PGSoLFIxXasdY10T)6B45g;hZ{dEcP-Re&+-!q^39TZr0
z<+nP0!^_CBiVU~cIsk6viQ&DM`)nwkXkNIgq;Px{p~#^H4;P6gS^(~SFkmb0DUqCO
zr9AE2cSHPG+VzU`D_nVvkWAhfobg5rnn|lJY-uO}doAVO#z2`&GK%2=tZxCkY34IQ
zi7yItB`7*zf>s8yGYG761q72{K_qRW7>iqq%HB?&R2h_$J$HgM-<~_ucUjuwQ8Idf
z%HSK$Me&no7x`%biS+IY{fhIjRY9t`us)Dv7(u+JSSq=#VS``B+C{VWhQo^8&q&>w
zg@uJHGv@vB5Rw0FCtA}cmBIU$Sbi6k5s=i%yT(rcEyBfHaG`Ih`QkK=TXFJ5cdg;l
z-!Ot@o>3I?Y<`u$H15QDt{AJ3WR}fyx8&6%4WFjok3wZ@q_~xu4#Z`iYu(aEFqWk(
z6AaIs+I8IZr^BLq5e?fH-@|*8;P{rfaIB@izlmqlyv_6La+~&ETvQeFuIw<w8;|T=
zjccpxC;)jS&KQny<WOR~ymaCa?Yn$xuvo7CW@Q*7%qfg8Zre8Tndzu*!dE_mkMcq*
zG)Pmq16&4Gd%+uXg;N#uVQi|YJ~a$`8hJ5@LBQv^9#PPNjKBdB#LN<M{CyP3bL2E+
zOx?>`ISEd>wZyK>oV8tBglED0Bta1%hUl>iE0OHu{`eBj0P;cNTbDGA-sfJD_8!U;
zGB5bzLG5$B40RHM7;=8>__<ISwGW>y#gcyc@|v2?=PFE`;S_-0pF%OSJy8HGIB-Jl
zx(_irhvK@ko%(y@nLk7u);Lv+pT56$4@&HrZtba0`cKi+LAYo)P=YYy^mcIrA46Jr
zv)bX>YD9R7Ybg|n3j3#b-A%=pq_UL{E|sjljLsJmx$CR%6FzSZU*iiZ2Beqs6WLgs
zOjo&|^X1SY462~g+{p417q#BdQ_fdZwiAui^OUXK{@5S*C=S<5pr!`@bWo5$7?AJz
zJv(PPos8bI`k-!xp#US`Cm|3Zu)6UA+6kUM`L;?awmWoQIJFx-srKE(>sQ8=CLLQ8
z#SCu0G`A=RlCoB$I)+c#or~@Tigj_w&`x|G@08xnv;rh`Lk$=C#F+#eJZ(a^DJctq
z3j@`d98vhzlyUaD*SMDx+p=7EYCSr1Xf}<G`?!s%+UfGTeg*FlVSM&&SV-u;3-m1~
zwnemM38%fqd6YpHO5lXLRME*Zu59$67RC7Pb9KL2Ly6&=-gUI_`YE^K+;dsK<urxE
zLxEa5ua?5O#{<}P2}@@9dE>lpo4BXRV|0|tEiQc!Q%<KHgj}`)eNH0X>m7B>+~>DA
z#`<}M$B@c*N8`I)HH0=EdQP=2YWLa?)zW2%IE@Z-Hs3A2%hBpB1vBnBHoZM{5BvGL
zUXNhUSg72yUc-rF(k$DXt?Roq(s*kYKj(uFE5fiSQu8abzc*qM1!N&3OD>a?gXc3f
z-3kiwKpSvEqj(g&!b2U#QO%0pL+@)NwqCKMh;iUam;RK(i)R)e_UI_QeQpZ;usWmY
z7>?mP3|l5;3_X8!#79T(whMbWNewYudUo{k)|sN~bA94K|MdDcy&m@E%lpNjZJ&($
z7&R2+Eyn#?ba_l8%B3i?K3LwAxEQ1(E1>!V;M(uB>#n`KXq<WlyBVpp&-K<XwuX@v
zrj-YBeyhe_FWXW8L<yHJrc_9L;hB3HB0LJZSl)%Q!NKIF=2xiXc}pw4s@i`{YVoOJ
z%g|HUFG#nypJI1plDgkrB!CFPg<n6VjE90;l5=#$#ZP?Oe+I`UH;PPWyO~lLbh8j#
zMfsj$w0L^Q^Egw(T31&sy)4TpM|dLu{b}IdNZtGR)FnP)H08w-1}*F;uYa#|Nt;b_
zc|h8nB&xQ2PU*WUWi9qN>Qa=&(p{k)1V#dMf}bRaNuD#&Su)p+*=!($OU&^&r5ghR
zTx-wF`=U2HS;t*SL>{K+Jtm?-J_Wv~NP&FtV$FT=?C1@g!0?wDJ@xOYm#!7cNL!$Z
z(xFpxH$L8WaQ)b=)cu^7-JDVHq9Ey#qPB9sK}_HAFh7%M6q#{{5Dle+IT{c|!{i=r
zKJ*U`K+D5-cuXtKL5AXMyP%xBV7flH%EJmyAHIC!yl@lS^0*uj@_l7ZN5=+V1e2%s
zO5RwQ<ZdTr(Z3vi9pB7*|L7OT=;XPvZky>{p4D9N9tw@cOJ{FN#i+KEFQDW;iW}vn
zqB7R)wAwO~O|_fS5pE4WVJA6XF==jr!PyQTCw-_hu=X1DtahTEni<P$^`}q?>RmUF
z?KigCD8@CLhwj^RnWkiYkVk<%4m%Y+J0D&B<l&OG&e`pg?21y-Hb>U}sDy-YFq}c8
z73Jcda|@;+a6;$Hy-+S%j*arFb>;}8D=+e{3B(2+Pu3xP$9k;vQZ?tukX*KxJ)E?h
zp5urU+ECoS6|sgO3&OiG>n^o{`op*3w7TLBrZpun#`EAfRf}PWn;~t>V~W@P!MQSm
zX-H3#_0_~wE=rMD;p$P<Z3HCyh$5FyQ8){Q(Eik)PN$~i8ZKGLb)WGW^sB!9>>}<d
zA$n%S4j?)VjeLz^O~rwSf4<Wc7B-x)DqLPq?bz6aI-j?wb4^=@g+A=}peqIwE`rW<
zLuf(dySy~E_Q5|Tj6mY*Vd!7eQpJV-iUST7DS|AkZ+IBz0EJ~AB369jfdBu|EAC`u
zKDg-`=Df~+247G*@6g|DU)R-ZcPxoxTu@xSNTGK=t-N=vkLAd;-&+`Ip~E4$fFQ6<
z^Lph{exB1rlKp<T!$gyD3^b%CAA>a1_Bh{YBf$c8G_5&zlk?9+C=*BqRgd2cQmtoA
zWemAj$w;Yi%`5n)wBEIE@8v4Ij=EQ1`^hrdS6EgIsz^#vgfv0=k&i|`buI424)g6r
zuL+8DtsJ*`6}3X~1+%)|uZQu*R=*XJByS&x5wn;L8rRR)HPvrJ_<38_u@-wSc+e|0
zWjW|F6k$LBSETFN$76CwqLh--K>p=+_5Q7@iNtdR8ZyA9mGd0G@-<Vbw2Eg&Lj9Px
zR{JYUqL`#6tTk?e%F>)U{?hFPR6lfB;wZn(*Pp7NA?Dd~%Jr3~zyrIBlmXZEmCiG|
zQaNAl@*Z6RBtU%ptAxbi25U4_=O2&6Fk~9~-1wD3Lj$uPp?@6E@Tj+pZ1f|OPE4`y
zCj9la<{M-rOZkx=j<0=ysT{orR~hIq*3`Avd43hDUGML=d$goJ&(GiSVnUFRmtgDI
zNNbnj&hM*35Zn&Bp2sj5SBzNjewH@b_ur0=u3dEVtGC`{eD0}C^Cn$;76gz&3Z$E4
z+$XlBaslW}+GNk~Wjq^u!sHoR6qYb?{wOD}#wtFI$15Df2>MV968vcf$}dj)z21#&
zmyOjAQ0e|YPtDHLgy#nwkA+{1L(&VABQB!phNZFkq~>>`aghc>+&@*1DIv<T{}{4s
z&d?Xq(lV1MSiKU${k|$Qy4-*gJ)P-5XTyMVZSlZqXplMDP#J#Fs()jar|iTqZbxx@
zvO>wunrYIbF#m}7O%TQ&i?(<UNzklGGR0pSPO(GIxuq~b)$UpK{S5bmT#X7YN8Z^~
zqqV=-!kT=28zGY=vz%*G&L%Xu;w1g!vI*>z9(qrab;Ev748Ik1wh;8>VJ!d>--xhZ
ztvDomH6KKLp@wH<+>gO5pDbC<yGfi{T55I*TG!#Tve44P30r}b@9piaJwIp$vR`y+
z)%Tb1VPz^Fp$rkP1bQ5%pu4c5Q%Fv$$MRq<_rUONaesw4_Zv`d4y7#)Nvh+$41W0?
z9oQgdSgKIVri`D^28g1isi%b^yh~5MY&Jaa4~A0NY~qvv0Rc4FfF1D5coGFvx2*Z&
zTbzNW)w2tf{%=Z330-;=l$7c%&ZmF?s%D!GB1or_{V!QV67XH6gog~+ELSd6`~-$)
z>Va)|(ZknV{zPJ)9v3JGX6J5i4Vhv=ln1fvR68{0NyKg5N1ocv-+@-6q+&vRXrSh$
zo~-ukrP^#7(Td$0+OI1Bk_wd;d#&?B@~@GR%SS{0C!@hHDY{&p@qO2xK&OH(^Zm7d
zt1T(XWyLu{qYy?;PEuN#Qf0Hs+^h%T?RoX%<9>EZR#q^;Um!&Na`$Wl0lF^37Xug*
z0A!p#jNL(1Z5MZ3_Z9JV0!0#3(!1BLcK5LAhQ+Egthd18&H>iZ(McoecxavCYAF^;
zE%2_nbfKFKo93D8NJGf9=W{F?+Zh)YfTG(%C|Ayrrhpu-;8<OKk^gN01o8z*hzKfA
zN2DW1OFiCJ8eUy<L)$aWwK|ygt-5>|Fy?v4F}c{lAMc?k*KK{+$mjqcP|tD`3uSah
zqv3r*Q?JPI>hL(8o3>y-s@C@Sd9Yk*;fY5`rxVJETnFhZKRMp2Gq{LRyWDv`9XOTJ
zTCJ6KaJ<El0CUPnEHNy72f_VSDN4nK@?AH+;7gh6`I7b;TM$y7G6iaRew;myICRU_
z)$rG{dQP{j@sW{-zESr2JzLR|*#WrDAq<aKd>fgJ*lbHS!|ubd#{m0+pD51?BP=Wm
zm1s;T(p*WPxWH-oH%izTq2cbXY5mks9ZwyWLFd#Lmf&bSMIPQepTIBmTw=ZtQBhId
zoi4j98mA;BCrie&=yyY;4A%jw*pZQu0R1eJ+l5PrBf8~bD?&+8@$EYMeZ}*76tGYE
z6GtqSLI-GaY0g*b`dn;u&6cUjWpd4KU!tO;b7#udEb;&X4E+lg+ATN;Av%@#%qG$R
zU%;gvFB1;j_IZ(-+W&1sA{yw=1FP;HReuGk{gqI{<Yct6pxb_tKI`CXU(PO4+fU{8
zU9ep0%sR?Ko$T|3KB;9y5+Prb-T~1p6e4I(clV`}=d;~L!#ic3aae!bOVN+$y2?mP
zleoAO>bdf@tIzt8xE!t}7cJ*Dt!HWVvDE)|B~Ps=Z9H8T-)u2Ul8+DmB-rx5ehu*g
zY?j<~276p$RPUqylq#fiSnXswjs0}mjR4qTUR&4Mb+s^OF-nTekwXpMB`#3jiBvzM
zKj?gt2@$kJ_$c=%zmrJu@yrDszWws$*B#?@)mV4Y>V#7^vB>97evIlSd4DK&m8rU~
zNmejpW0Uu-uD>F~7TVci$t?5iG`jf<qQTWmtCeY1JduQj6AfI8l)@E)^e2AaC#oo8
z-DyGz$k)y~ae#k{`ts-V#qd?df?>GeXCaOurC3ep->1b6A`_10hzUOrONy_5V;BO3
z?90b@b17DMxtqt=H-Q|h#K8%&IXh5(PYS?_jnS1779O0NlJaH~E#+A~Ix?;Qnnzi9
zddwH}P6|SYlWKF`$~i$TO#ALT0V>J$Al>wSL>lBb79={`O`8+Ufib&yP*%e79ushG
zcv<$k#P9zxeORkeUQIJUGZUJJF~-jeIB0a~O<2?cV!i=Ti0wP^QfyXBwU&$3x-VPk
z0QG894V_*mBR(EbcDKL2YSlUK4MPF!sR6<zFd0E6lU56e2LoE9nLcli#>U1x<NLe2
zm~g??-`S6_)Pv=GVqb{32cdHz`VqFgS=Cbwh(gj2*tv~dD8RkHQDO2cKb$J}Ep)AP
z%tIb$kZZsdR#~(-y5XfDIb1CPar1Olv(9jT>`q?^Qr_!gf)Re3tKE2d6EBhx4GDap
zeAfq-zujP|kP#9*SSDWxwXi%L@sHxOO_LLj5t?i>xwwm2oFE3*Q(RrfO&>W%@ZJxP
znpc3H<MlH4rIPo0E>8uU3atOc|M-n%fAA2^YZ$gd8^7)1rPcU2!YWqVcGW9}*HhDb
zxMEBf@D)Y$mOq0nWFsjyj%m3%Yw^iiHIGvtY=1h0N-pB(GF7c;b{eWK#{ZUddyv8H
z;8DOr`&5ckc>a3Y_i?y`rb0noOs?&@(%}r>hNt}F+%NB!!SQN*@7=pi?U&%!LYr4_
z>(^U)9#y@wsUUMR;+ICo_gqdnnJ^q5?R1^=*BhoXd|$Qncv?;rAMbnmqI%20iYYfl
z-b?-2NxsCK@#ahV_f`)h-SsC`n_92>_9E7C7N#t74$GmS%9(FQ%>%Trx3hVRE}7`~
z*sqAjQ)H_wZ(+#CY8Y(1#}sZ?$JZ!HV2{@tno#tx7NMgcHCh&KK_p+4_{e4#YkY1V
z(!GIerh`H%lDDHH-j1e_u&vm6op}WOwN0KgE6scUM-r62xNIN68Qk|M)(TCJi`|ru
z`HcIkj~QYP7qe>Esul8ug}bfX9U=T5xO9F^R_PLf%Qo`oL^2Twij^4<4L}NoR<9LQ
zun5=qmy%M}bfr6EXap3uhVM74+L-E%47TVo_dB1gI6Zvzdd7ex6iGIcIGPImz>fwe
z*`;^Uh&7i-QSpBE905buTXh)ri3dG8RfuC5wR^EBk=$0+WTl3Ae77wdMNa*ABhsqN
zS00O!A;*gMvPYuG>ag&Nu}eu$U}lxK>QKUrB@Ga?2T126q@=vpBh20%@72R}noahF
zfZ{D3o%d<oJV&%tXw1ABOKE8-TY5P#q?VJD)7-pteEa0dClL<^+0z-jX2}M#&TVOF
zqMJN)6A0*-L5xZ4zi|kY4qEojZM3q+OB3JYrl3qv1dOld;PC(0|MX&9igDrz)dRv>
zu^b!Pn4bTsOwOGhPjc7+i~bSJ;5iH;XUv3q*KQDK*2Pf!4`3`e`1nW+)=Qwv_9i}-
zm|3Ig`s{wsZormw1k}6V`~`&_=nkWu0p!cZ!OHzKdVO?y#MApQ<M)wF<*54!dxu0l
zO;%=EeWmx)9h9o+`uj_~OLb;8?{&-i`Zttsk9XRf?zSp6%cJP67Z=J(4x*DO!+Wco
zR@$fGK{Z@q88H1u30||sWu~u0?ChvfL22EH{ACQUq>qW<Ja6$Sbk9zgR`@>d&pAr(
z8x%s-^zK)C15yKgZ2QlTXv@{bXI^`2<TS(YjJ&5T$)&Pm!}#CdD09`eJ6G&Xl+>n4
zdB2pU{94l9ZJ?!0V>NdtnL4UXR!z5l81{Ok@;D4uk=kErwH)SGYxQmuHBEINCtj58
za2iC3v7vN*J3K_I8;t+*da?Bhg7j$!YB%IW2Z4f91M;UAZ^^bd1eK(ZkJt9C8a%d}
z^_9AZczc6fY31mkhSxSJbFj(XmHRVObZ2?~*1NO0d$rEzGc%tNaA@WtCPOMht*(hc
z7j7W+qcB<OS|)})R8=k-9kq90PS}-2(b}DJ<LbaN5|p@eEt$u*CWU>7d0VJ_q+Uz+
zdK6XT|NV;#Rp&-Ch1YQu_^Ht>hTqfS_EM7$FRL(S7>jv3_haAPgeJ*z^*}|F*-#&C
zOt!AWz)1>PQlop#U~=RQ)zYC(Y;eF;q(maumzlCqWhTsuKOXigC^oz=DIwPH#@0ui
z%~x<eYj9@T(Gzv~N_k|Af|<5cixh>Vg@v2Fooqbga!n<Ae>Mb*(QxI<RAP8v^rRy<
z8yjqBmUhf>sga!ek>0$CAB$L&Njr8CIjJWvwye;hN3)UN>*pqlah5_Ust6`7gdxa+
z!HT-%UzEAtK9|CiHt;AI-$>KmeD&j!i0=kZhYW~g5MRDS0(QbUedC5dK#K<yL4hrG
z;MjcO(X;u}wvO>Hd;F`M96r0X)^I;P^pUJJ`Ymk5E&XVQ^CPZ9L{Cd@@^F@U%D89K
z1nGx|)8n;9m;OLOyQ08NCGW>AQ`PrLHzALz_ZH87+IzmYIg9VbPTTIWBAewlA|d3S
zE5|pvs2j<!5UJfB#{o88C~#hWaVZprI&rT~sg19`Jl4=Y>U84{<Qk};Ws|~mDmfj`
zp~;DF52yF1#YjTZWYhdQug|6MzEaQ<vTVA{hEH}jrjh094ScTtw)97s)zYM4LyE&4
z@hk9%O;+Z}r+aDH(Np($Er)rZKWQi}T~Ky-IvG}G+24r9d#w(4w3>-%XwCgFuR%}D
zy6r%8<dWTAq9&&Ecm&Vl*R5%7!Ttgt-*ylnI=3SJ{<d@b7(mm+ob7S!;-<O&I)8*!
z<=v!L>T`5W&%@+ZOKLjg<&fP$=-iWM+#*Dd3TB2}eO-(yooP3(Wb<b8#yhyor>#19
zh#AD?F{LbJwb|?ymx$nDu1~q6!&Ss8v2IAO{abJC#kf!9^zEni+}3T-@f<qZ`R`}k
zxha{TV>XpW5?hs|3QgT_jfG3Q_NtZ|ZPs2!PoL0sE9q$Iem`mM+u=SFU!AMhZb;2W
z$&EL?$6F3h_&@8u9m7vex#6dXwbKq7uQr~vHK6~Z``z$1^>U|OxH~&H^##99`eq>_
zh2~o=*$eH%>2ic-dt#>S^#xDF+kts~+0WYArQM%YIyZOUE5~$IwWiaaF(30H%8yQ3
zPj={%%P;ULbWDfSZ(GWgHDMY!m)de9$I|5)+?H<d-*;CL_g8XsI?S}A@FDVz9lLfY
zKjuS{4v>B8m!bN>Lpg8nzF5l}!uX&cvVC8fIJ3mdli=3xn!^LjZ<M7#ccq6@%V*=&
z4X)klIB;y^d436z_sW@<-%ukn4c`pQ9G`s7J28BGy3HX}F~Uf<Slb|`C=j9@Sw|*V
z)={UoQ6+0oq)$$(KgrvjkCJ6ZGwXbvVWcpSrFL`gYyM-WAq5pJC6S)C$;Ukz3kNVU
zs-$z?(LMTbaI*JvqxNiR59_jc-}KwdY~OJ*eHyP}-EB`_OqL0KFx{}E6lc!N{{bLD
z-@Y>tNxSbu1mYsRq>rhmWSF;6047m(L>&n&5g=S_@Q|@0)}S0YF>}<IAs;MU@%6Vw
zs`#cryb}m0REn;w+M>_WEA%IwO$-Ki?b_Xb3L(Ux*FW^&eF{aFR`g?pkimln{$l10
z^Zq@*ea2ROy~A2vZB9x&wZ)z#(&KbT%jk#x*eRogu?vQ!YPcg1C~vJG*IN1Qm_bWv
zB&C$LOD{cIJzs9kHl;1gP!EM}9o#hB;Ltddf?lt$si`R|E3@0}4Gj(9Kx%Vyv(;+V
zYPFS>l@^OdtJMmEke8RYbm`J-ue~;07)q<vI-Sny>S~=%H)O~Vg+h^*md5jZOiYZ+
z<vK2fx!>{I%Zt_*y8MN+f1RJJ_gmL2TeiN~n0A*R{B`gB=8ieetDb!K`6;H-*B_jH
z=gm(2;^(KBJG~Fzi_v2S@I#fnVUK*`-#sBPAd!sB<oDR<=OvOH`qSq*FltFq0=K{A
ztE+Efe_0Y(@Egq?1&VLW<;La{Em5ZI^OE4$!TgC6POa8zulJbyF&sxG7hIS<bnq$n
zrsp{B`fIOVymYzCb@VEZF}Am|vf10L(e&fkeZNB~E7@G_^@u@99y@M8c*BZ}OVX<C
z$M6%55X#t(r?>sc5fYc6+pvBw;mDvNNvUb3?rCdJr2q7D{*ndHyuK;<;s3pmw)(Nz
z&(6&+m_O4J?M9*gigfRY?EP1>wW!o-`FVcpnSeTX*1H>Ls*}yG!c7&Bb6;-j*ze|P
z&;2jC96HGERH;oS2>AV-RXqk!XBSM4e}7$Z_1z=0)sk!5nj*-3G&dAAb!~iU<}aSz
znl|;)EdQ%dK4`x4-4CBEFbm+S`0TA0mX%kRTX{>Y!|F@3SO!gf>WxQYzk2nhkE$Cz
z)^fYc|N2WsYS5%jeQNF_`SG1D3S7l6+&(Y)nNQzrxq@5v*mZxf{qnyHNB7L{vmdgR
z7Fl(<caLbjo=uzn!pdB~F|<Y0tbY8KU(Tz^nL5dAoBPBABOYD&_I<f3+sdb}ex}lr
zm+mjx^5Up5$pFr+>z}=J{)YKiLec+Tn!Cx_a*|r5x^dx}Ia5N5m0U%y|MG!NCZk%N
zlWn$t|LimK?^?X%xykX7FWTz&yQ(Yda-ZAyzq`6{QtG#Uzq&fP;OR@Utna_HZl`N%
zM|rL4SfdK8f&LReWQ=X!>s+v`QkEFk)&c)$4XAd{+sgU27S<0x4?l4_Jb!<AU22M9
z<}b$RbZ1xnWbCBhC)k?&fB1B3;r0W-D<Ccl6dm*q_JeTS;sbxYDCOqdIE|u%+&acO
z?W7-t%Xb2V5O&t4aSKNCK#jGy+%>}t6~*PM?C>r(d~<c~3y*{@PVSrge8pwITeNJ~
ztvMqBK$AQuuV6~98VaV*oNl>(+Ja@<W{ofCow%t=sW9gZbL`%b5b9!I%PHJR>6*+e
zL)HL&TKe`cR*u-)KmjC1UCPLr3uUy-zN5^(L&+;GrmVs7gZM#exyr3@>H_gjUf>BI
z8On`oQW2Y)i5%#HEY;7Bt-?PzW{^QR`S_2rB=6f_eOwRykt5HEkBd8<56*GisJvXI
zQYlGN+rlZOd-qo5pMT!zEcuK#I5~zy%0bb#_$dd>pb<#(>SOjgER=0Z+x>e?(I>g1
zN>FlSU{hr#D3ZIk<>CC$aM(0EJG;KVe)HzdCX;EvfB~_wvEeM{>gsC0-|up{rcRw|
zGMNBi!h{L$z4zXL0RzI@UPeYnT3T9JS=p2+Q!c*v;_truuBoX>uh$P5G9)%OHZwCb
z?)0|IsMEw-G|p{XYyG*IwwBADfyPj_eCdMsw^{C7{QMocYJi-l|8CoJ^}G)XXHU9b
z-F6?|43no_f8&IEFMD9ox|*NgKB)I1cVZA$YzxXK%lqUAOdBN-0&lMoC7Fc=MFyon
z{y0Nfw3jX_62tc({Xw$1N}e!O7@EQrSDq+!gaMQtlz*s_F33L7In|+>+T-?M9LJ9y
zm3wNbrfsq^GqN(%ckFbxzxU&CG`L(%30RJ-7fC_+-M79wSlwWX)y#YUwr;tc2nOX1
z>nmUU^Gc;sxbxmg-4!;Cr2o7*=l)BK0NMAy{MYi!elzdmyQa<#4F%|Tm2X;ISmCpb
zxwK%UIn=MfZ{J>OGv?;Dbv$%gODkN-BXiB+2_Adt`c*}CQ{JS>`GX>-E&l4#qG~6A
zI(bk|3fRi4Y+%aC9cczfMTOmDF*~<@Sy<{)<xIG0>d3Y;9lyO~^~w#^kePqkCHdyI
zwN;f`1&c*0U$v&#CS;AfWNLm|`#huKb?b|*kd-@e^5mgMPn!Jp(!w>xRw27!N`6lK
zNp?g5XSH2Fa@Lgv`D(~Z`^<*PVhEi+ztiT?ShCvnm)DyudH~5<S09MYw8XX@{RCsq
z*!=K&B2y%QW^3`9kLJF+EqU4_Il9i*V$3O+U|h7O$aYJ%rFq-BO@Z7y$65pcf5nH-
z&)YrrA8X&fEk_ToO)p(_$FuMK{EJ6NtBqsto4?{d>jyVo^rY+VCA;n)+q&PF_3nyU
zt)28gXxB-<^F^sg-a6;;qN|^Oc2V}DFz4Cg5f3lE9miB{<9FFzzJ#3i*_Xz&@K65Y
z`7gcaylVcJuT0NUgMIY_Gk*W{M^hKx(sJmGo$|<gPg~x*Y1)E;&#nB6W$CTgd{|}k
z3%S!@_;fk|*jL|k<+I2Bk^?p=|DPW}H#r`l`lCB$ytu6R{>jtK;V&A%Upn`inH##;
zWLwdi3gd)7WoH^EkMPf3v&}W-*o$$=RlZ^Mf|nOrGw&Xk)(^hw%7dOI-&EJwy^K=A
z7)RQNN1-iF3hhIvKQ63)bg0vo=Z9;ZufOyS$HD0HGba=b(ViXgQw*C%-@!)jqn~bH
zUvUID1xP`tw?b?>C^a3<{6e8^^P%QHPDxFRIX=TK)V;7*THF<cBMJp+E!1<?;bSdh
zM#7$At1BN$O4Yf!mXd0an<~0^b5&3obsF&dTTU8!>u>bJ@#pW_xoHwF0zjNrJ80%j
zhT-QJbXsw5IkQ)Bq1+dVG7o?JMkdPQ9>?B2j=cgW&>@6`I_dLDKHR%m-w;2-b)Jf9
zcUM`DG}UvdL2_OrHAQaEsd&}km_b^h<E_0tnaT|fjqQUDJkOth-ssaGye}~^L9J5x
ze7^Pzud{VD)-Y-(BSD`Wt2uDE>1gqMN*MtKPk_2x!=~(L%(N}f6xzi`X}e)eJBXh$
zFkK3qDs;&19+Xmt!%<&fpOBEy@+mShrca;l_xrV4ZKxCvS6f@F)9J>KAD@wtq0{Nq
zp@MZbo2{t0`0~pySE(Xr20ESYSHJp|D2i&eddQF=85tQamrJEm#l*yL95;6C*nU5(
zWPEmhy1lsEb)&9yn>{%<2TB0~wZ)~5<Z%;P@7C*c?|yypIET>)aNHgDsN9G51laDH
zlXtq{2n<W(d_lImMsE3_1|muzQ>IoBMZ5hiWvsfMUXTNcT`21%$?UT&CkdOnT(0B7
zrh*`h9+h{Rn+hRZ{`u$c+*RH_$Jy=i_<X+8Su8q(ogn?kU-i)gGk>!b3N9U^`tar7
z&l>T_hi^ZUA0OEL(SyI)e%s=Y?#c-TR!cv)_o|QbKU|(`R(F<!<+rZ+*GnI4vsP6=
zT2^C~GbP)SHQ~OuhEMl>`QpsytIZ}bW#_1^tDbrOqo<aCdjCi@`0dM{yn5CLu2Gka
zgnvEz`0MvA{qRru@h8e80?EGm$(wGUZy$BZSXK3lk3Vd=fANavCmCB>`1UVnK3=Gv
zG&NV6_w+;R8|VJ_`57llGcslu<ns@_HUA^<&sz$Yyfp<=P0^`)xp+sko6zUjKf8C_
zO$$OJljT0T>aDEs)DDlC5?GhtJ3Qgu&=2PPS##z;SztWT(bYI=O1}EB!eYk_u?Gs*
zd9rVx7`okVFI`s!dAFEsC50{L^iFj$Z!OwX?H_$~m{iT6{BhY`NKiS^qSTh_o`0(N
z>e<&_1IB{63vcVqPBwjC=%hLH8}XFBIAh{78(W?luY7mo+qv5|Sz~jjtE-CFRRc(V
zQ-ZHzL#b=#SOASNAz3A;jK-EHM!{q<g5Tpm@p>%z1;fJMWPEl`a-isd(+}oT`6}$2
zR#zCu-D6R!Rr!;$T^|&dy9)AKmK^Z!SukVJg793HOCEXe-}mMA$<FveiQ4M@)wbpe
zt83?;Mp=$TLb*_^h%oq3RP@Jj(nxqTGJkjgzP4a%Yv2_mDA~BLbmP7lqk8Cw)HF++
zIW<-vqd8M!KNvQRvU*S8x_KK9G<cz98{~llkb`h!ADD-L&_T|rSE8R)xHcW~&cD`@
zn|w^L=|tJ4y`FBW&&?gN=p&%CvwBcxJWW=f`TK2KYpS8tZ^^aTORE7IJH5Hu?pWZj
zDJ@*`>T4Sy_vO43o+Wg%DHF&2@n8Q6hfUQUm;dz_S$d{Zl7hB6trQH$<z-+Z*J*5C
zq7t-jv%HcgT+257z=iir8$4Cbse`igum61V?+-ualrdyn0}ExXCTo%h7%W|?9L3mi
z1Dg^;j4?5%8J8!7=yY0M;M*^TG1laEpUz^>1_DQJx?spFOG^Sl8QS&M4|UiN-<YKB
ziaXICb<&q35mnaOJ)gGgs!u}$>Iw;<8y(JF@2+MC0)d*E8jj<}j2RQ&0JI@(GpJN5
zv)ODinZj|^@b>V-4?hSzKViazwg?v?M6W+OxWsV_ITPxM3CVdQ{i`>X+w{fdru?ho
zmz7EoaM>CKlcnA8Q0lDQ{Lt0U(Ew@m?!z+%qSW~y&8-N4N`TPFpN!|=#hIGoDtY1e
z;oVEii6GBK4w}JG;;O&{=|Z24X8%d<TLy!{W5T8YJjcbvbRj5v;*UchJw3Jko{%vX
z2#BKC4JC=tnW*#hAIZM@<rfPr&#is;t{go;&FTlP`^_^8r!W3(_NbpvH!oSXde5yn
zBh}!kShb?u^7H3ft{6K{!pgbhA1iLLuYTa-+e@b|-2U9;){zFS;P*M;(tj_0bgU8l
z74vSo=EKFMw~x$M?OOES2Gi{2D_W*I3Ll^G;9KkO&Yux}TgRD1t_`m~y#!`2{r=JM
zMv&~w9+>v{n@jH=dz;1n+1$B>md6$^d??=t{_?kOzWQ(fnm#G?_Rgdg+&Cq9#>>Af
zAAjH6fB$LfSv+0=I(>gD!mw$G+LUba6+4`MFq<dd_u-1`efGkao?Z=LN=Z=p9d^G2
zkt-d^Z{1$%GUw)o{`Ab_?|b3lspf>_QNy#1T{w?0=1$EQo>;fVX4zBdvP>_?4Bg(5
ze14C;=%bgMU$!nHA?HL{tDQT^q6G7}DS4WIFMwPAI<D{SI+79-7cE?P+{B%`c0K#&
zKewL}o<|UbZXIJvtu`Aq9-FNha?RPdzw%9fy|ZHB6R-MPzHz6=Wvf{5bhWAVcWTKV
zeoWHh$#ZJjtw_Z~WI2LbEgXL@zw7LqRu%0jT{bQ4)yRVF>#F?uqtyT^b=K6U{&HV_
zvdJ>M?~Yyy01AQ2NY-W~YcI%4WQ>VHT6@_0;pdeOhxfSHXt?WrYoC2ME`$olhER{b
zi-zZfQTdkf1w++ZCC~TsOp&g^uxT`H+TZZ|kGECVH@8j*M@|`&rPM%8R_3tc8h?ko
zt~yWf){m{TCnQ~aj>(`pIu>dVj;6<e$*tqcv?aAN2BB&&Kc1aaDoMDHYIvU3hA~Qy
zE+_KFP?B2fa>9Lnj~@@LA5xie$0e^W{=U#}Gmo2TTGjrwj&H8o);&2f?#a;e_}tr`
zeCLH3=3Z)Rh%rW=GIHdhU7ONL%NN8X$#30v+&qz@DJMgC!YR0LLjPZO{q>*w-aId1
z^!TK4Q?AUb^VY3g|1C5sz$_CW0}NRMW4c;x{KuQO&wt{3k6jW7i0ntjHsn*S&VTmc
zIC9~z)bDoHtlwF4G}|<M+$8MS?)LPUz-WhE@{fzCwj9YhFkKF+fk%f(?G8N8o6Y95
z)YPO{1M_=``uK5mjYi|x{QPil{Wgh-i5FdTQCF)x1$`iipy|V>R9zvcl5=x?3k%l?
zrJCV)C3{vw<Zq(0UqbZn!>bgKY~-rz<r8l)48Z21BQtoNlK6s5tpJq}iOds#SRHxi
zZteTuip#eI<Mo6w@N|3}J_gUhxtS+9p*nsqLx3{cEx}Ev^Z5ETG+d<(p^kK#{xjEH
zv@?)<$0a%8{bJg<>64Ow^L>$RR<>pM)T^@IU%H~=?vc5HUCUNg=Ug={l(BX4d@fZ=
zZo#l);+5*y?1IVR3@>$Z_Hd)Uy4o-08%N)_WW#*`epgj#(S~BH)9I?VwWbSom`P-`
zZYs77nm+y9&<lcj`d?P$N=AzsTopy7{+y|4&aLYUTlP(Svf5r;T;-qKX;*!J>07^<
z^&e->aI@9nQtQ;<w-<l8O`ShAw^vWZ5IVEyEP2_QMTJGS+p{h4+4+;QUF%mjdI0#C
z?6KMKdeJt=^;1KCV*Y*aKXA)D%bYcH(o}6Fp)6gGQpD$7nhVdY{4BZJZkbXL&i7QC
zES9uv)5DABhp(q3m%YYsOgohf#1k*dU%l+<7m9KpdIVNH`}FeMH)r&%Ty@5n|3{Zg
z;*WX*g?p%+a=D1kB#+25yOyo1a7{HE%_H;8eyjCur%!0v`CA5MWsm*)su#jt;QcK-
z{CJC5uy$_)ej3SM^yMbav_CDJm2VV6Rh^%Hws3vL{iAcC-B48h2q8qJ<Oif19-lR;
z*&F=g>-{C$ZO7%7LI;)fBfauFil~A@!Ci6Pd0B&#6pD`O@$|6j`khzKIeAT#o`7M~
zs0m2)p8syCar%CADaB71n)uqx(OQk_;Z-$Xly_Xt)8-bR{ObSNyBD}7>-7QP&+py4
z?Hz0k7&>4g6O>I<hFajIM6E<ECGDtLr{m>RUXH1im3quu=B-X@{VT1LW_40CGqqH#
zyj2F43SI$4hg>HN7`NTu_y1u-L~a5C1AV@SPiMY+FTXK(+55cD?|Cxf(o5bM5#S-L
zi1D}7MH0*A#~v)Zc+vSUt3J;e@yy$|ujtQ{7M-r<7Us;%{6n$e?6tvhB^NF@W2U;V
zzT$~0a<Yt9E^{nvD=pQ1`2`UOjF&G1fW5dlXUi5KV9v^Fp;yyN7~gOWvuWE75Jyk<
zVH{youR3q8${d-eQ~tARoYK=rtqGAgtP6c}q6m55p@A1KB={3!UH6PkK+4$LMn)VF
zvg*6yQ9QchOv(YLH|b+Deu~Zb$wT1b(@9Q+mU05HJ7(yI%QRks1{G^_)B&XI_FFaK
z?RI-wS~|;eJYLg-Y8=NE8VqK$x!SK`vwv>5_fUk0g!CI@9|)3rT)3WRG+UjuO?^B>
zj?kyAmZ|qd0D>S#BRIR`r=~LJl&hGM&pF>;4u}xM{lIH95W0E$K?wu`g+ft&GRjNi
z3NnbIC*^)ygp^^JfKHvNE+K?C`{OqRXEbm*DIgG0igq401@H_GSLSWldI;37DLow>
z;Du6OFNn`6ytR%=mz<a>REH_s!hLuVpA1y-()D(>-n(ur2PabOn$Gm7zVyyG%ei#N
z`ZqUm7UjNSVEH_*yMkw9x$AlMJKisniK!<axWiey+GKo=D?f>4W@h^P`QByL{H5e%
zj=k;X4@Hst<mNwWyn54rOu&dMQ+$LXF=H$>n`{7LRrF}prf>EnzMwSjjn(y-6dlyy
zd@f#{H(SaNQTcmQqTRFl)dio%YH4L;qzcR?xOMxo_DmvEiK+aQUAYIT+!?Mgl@=E0
zllC||x>P))3iPb|7u1xxWA(=g;VbrkKCW=%lxG$!+NyffbK{D&zVG(a)Yc3HA=DtW
zyx*A7%yY|Ut`IGmF<N6gw)(BDiKWWn0Lo#LqCc3rV4g25m=>kbZe8_$g8%sWeWka}
zziZ5aG(%Md^VV#n)pM8Lyk{c|j~V7U^P>&15sRbc=EN;Co?M}uzSEKCUO%y?r!6Nf
z(*QRsHP^Q*lXm;k<?%h<_-_7aP-(}$wR}g|M-y7Hs{0+~=H<<vGv|)0O`bXx0KVD2
zy?M*)F+nj;_t>;x-pjr#-k3bdSNrAiwLj@#MEP4bcudrq`R{)o6F#TERCoOSDN{BG
zUpu^QvP-LE>Jtv0g2)BqV=C&jgo{pmGUaf*cDlx|u1#zP?b!rvp-G#XQ;?^PJAN#O
z@l<NsVmhk38-M)hkdcolw|;##JG-b_FqCkW@zWZar#B<2z;Ta`3hUKZ$)oSbPnZ}s
zb(vDL?MAW5etR7@k%0GPxMInu9x`_U0Q`4M;QZLkuM_jlwe`5Lu<+f5!jwGI`o{x$
z$VK%uuD{E~O^#*rV`D2%quk9s>i7Rh>bROTXJ+Pn{yFEERb9D0XS3<P{+iqxm81K1
zSy|3kUsaCMW-w%bz6EaOqPAN+Mj56uE&YU<wOA=mb}Xs;=IWrEEujXvtd2M#MAcoL
z7|=zZk<@`y|K_tm46=@Kz?`;R1GrJSoXPcuQrhNO#!8HKUd1I2MN?F5=hGrfQ4thD
zuZkX{o&sr<-=Kz%k70zRrMLP}a~yX%A%SJ>cM~1pI4(cGpyu>{@7t3NQLQLKBqG6-
zM|)bVc8jedqRsFL6xwfwP1#%h@i`WFQt<f~RMcds+B1p+!Y^O$Of2O%paeh!%^NVi
z4WS5MVACZ*<~h1YH07fN>aK5@ax7bzX}@rYGZypvj%}WCx|C3+>F1fe<5binm9Nkl
zHuaCx$Tq~EOfy9|E=z2NxOLA=Ntt%w>lgjnz<qd{2aosWA4ss)-}s(o;qZCu!~y&<
z4+>6Pwrx0I>KjDgti=m<7XEwKbn2RIaCg4ipLh1UO`Cg%KSqSW(4KTh=^ai)d_KQw
z`B6t}GWP7b3lH?YtDd_yn=Lu{3VVCiR1w463zZ`7Gd3H0CFMq^08g=`Wj_einf~Lh
zRQtmBsoIJhPg{;QRp%8H=vRKNz$hOZt@-Ga?+>d@hYgyShN+u5pUb4(`Ram0zOU~~
zeL6zUlq9YhKlb1qHeuw!fuci6+EQ>Pmzgf^+4?&Z{am!KLapp<nDqJoCWknaYIRxz
zqpZ7Ti1|jE7Sxjm1xjVAIqOy>jax8fuF^n9u4_oqLxh@@!I<~;A1if+Ypxzh^N<gH
z<Kx$opI$n3$a(;fM$erVV>sq`B6{h6SI(dQ>X?Y-<xljVy>a8~k$2I>&^IDFoZcI&
zh#GvWa;bFi%kRxen>tbTzN!3(QFGq?$l3kLaOhwC$8L3`HSQgvSPQh~jYGdIiMZMC
zzjMs=ky|H@RIC92#rSQ<H^<29+LbBk^H<j<YL@IAtz;M&v-pkUPc2*Yh33;2)vn2h
zYkS11N$;#mm^gF6*l!j9K<K0;e~;XuFMmcpY{`2Ur_LOqSYQL7mC^GzubZr5pzdr_
z{jrxHdwf&M&3}$oYye>TuRO7PQXLzZl0JQQz{{~WBk{*VeO>{OPx|J>$0KY1sA@=z
zjW?@i_o-|}D^(AQVs^&HUH`|Jx<+M4*zkPisFG)n{RBWYXa8YGmF>1j>@Jx3`~&AN
z<b1dL0>`qo^oDXI!Bm-~U-6W;k9geFfntxw)K0j!w078Z{ht@t|9P>M585_)x$$QY
z?Y7~U%SLNOxFNtx^zV_Oqcr}^&75b7kVS+2WN!4@<F#aTI-SiiJ+nP^PJbUt>|Iwc
zj3!4-DUnFrr*Azg5CD5=Nm+6-ux#n2i?)(tXV}AdIfb*?IF=QMhgZfU$j!kJ#~gg;
zs45><gk>upJ67j7p`ue$$L@NJs-GtC5YtyJrIVdY>b|+!CK?d=`*!H~V8qpot1>WE
z3ji>EBjis{I``YjqC>e=m)jYO_*{UUvVp*E_bRjc6xn3OJU)+5^-q#5fAb%b4-6D{
zZs6D`LUr)*DJx5_+V4IiBTIK9x0AxZv9I*jNI34#zfRfg_G;OtojSGSAG}sZ0EB#=
zuyUqGMXx8@ZK<ZtdHR-gNc)!~$<&!=YP;DX3Lx-Z5QVm2oU|rMM@pu&o!DyCCGmPh
z^Md*lH&19tncbQ=jx!ar*H2l`{>T-i(|w*Io^7wXRTD72;Snl%Nn~#YQ{Y@8)l7OO
ze8f95mq}O79ixF08<y=f4_+}$$uzx;RP&NasJSDU<-5x4^@cjj%-sGn*75y?vxW)Z
z-ffJ#Y^4Z%aolvHh%G8(4<)jX^x{u{OjuCLZ8%`E+iRxO-$pDV!!`Un{_J{sN~?uU
zS(d$$devsL@pw&-+Fwu4(ChWp&R`M`4|n$_m2g8YVzaS79XS8hmbj>)Art@6PvX&n
zk<&WUf5d^&W5PDAUbrmyy}5&!OWT$$J1(EFrJr+t3==r~$;fx+zqK6bi1mYR&O&W+
zK35F}Ltz2<ddZ~>fZ_C>gQpCpJKa}R4w?|PZsvkT>h<&gp%Eu;TJ-Ntvc*qM0VXv1
z$*x~)`e^Uq)#H`6<Q=a)Gxt=~=lkA^uH&YTw6jLd+j{U&^3x$2Y4GT|Q@0M8e@r=R
zaldvo857+bij4YgaVuRtisnO0Bj@c(7?XG=vryz4t_hJcD=MCmhE4kT#DvwUY1!bb
z46ZC;%0w>uy$O*5CV0~Bv>M?vsb<=iQ`6RKlXT!0q^#^1AszPN#gY%}-j_Uj_3!zs
z8?q}#J$={3>6IHQCwzQrLgNR2Z)1YTe|$V@`kABx@KpBFD8=wb#WT{u^LAaFWzb&D
z5p`C{D+0~R$={rx?07Wc%k$1}=7cR357wP7Sy$U3)a!qbzI8m+oW19r>9y(?cICg&
zh@nb{y?6S;?MsHPtXLBA-sxerZ6k}SYgBC(A<(O*ufpHsvrpqpMoYD@>Fw#I;0U2|
zYE7p{pX}q3S@~@TW}CVUA>`FzDjr3xK5)s-aUCV1|2^NohrdU))jSy98-slPB>Yzo
zq}%Ga4$LaDyz#@8kj}oWTQh&e6ZraeTfe@(H8`&H;)RqMGdPyLzIH9SdF{v9?amse
z!E4r1qPw^+aTgbpE+-5ezwN?!05DbF8LR8&YBQARYz9Jspnt!JZGZi#PQN6rl5om&
z?xK8kA>s4om##?6Zh1i2ZWe^FNQ$Sv@kl^f$dTXwOuUp*mTk0w9pok|*u-@%vkNRh
zm7jWRM#E@APY!vGM;iM6^7;I(U4yTuXH<<2m`tV*KmKIJvNxL+bl^BHGc#+?z8|X<
z0p#=PkZ!?E*dcP@9DVcaC|X*%1h|S6RL)w_KdN;R9-kN3ht0ld{o_k}P70OsE3Zo=
zFQ^~o(E+Fi|7B$DTv?&*YMedw1e<vt3Nv|OPtfY2&5*m=7SPhjMZaHL1OSGk6^j`4
z<c~Jy&73~tkqtA-Ki$Tx{%rj?B~zo5zN-)bO(3st5dGIxTRk%t>@0lqhgt2<3+=?)
z_`Lg;qvqr+dxoAR1cK$%QxSpzD!zawd>+@O19ii|TI#5EObAc}ra#KarPLj#wRP?s
zP;KrT$8o=(h`W)S+ex8l+O#;1<6?jM#Z;q6SqC4PhvaUXO`%p}v$02hy0qn!-^)rZ
zM}AKB@8tD(Ojz^Il)O!y=|7Bm;<{DI&rF{(aD(IGbHb|4Z&aqt(DK2fqD0%a!t?*B
zl2l%25?1`uM~1wc=ve0|zyAURy}0|xd(m}flQF7M)1Lfd>O{>!b*QhjN6hf?sx>P{
zPL%(??YX)qe+0%XU7tLC#w$a<d<8(N88c_y($R7nK&+XzdU4Y8FNgX}EgxdUq*WW2
z)D<%=r-*)ILClnS1N|0Nyi&~|P0r5c8)LqEqkkLC7(#8??x%(Tz?fY}Ts@GsLK>_Y
zT>HmrMjG7mN!?PVy19<gjJvw8Fmg@*I!?iiR2hojQy1{|cAGw9z~)WAmlc~TikVig
za9S~WU(+vW(8w?>{e)ptSE2}c`O%ONxj3WHIH7NVmwTO4>L!MH6M%UKGtAc7l3q9t
zILI=XJ)1i_fl$;PTH$jX<*WkfZ0lsL-ra%-1l0Z3Okb>d<EPttXfh!$?mqjX^KtDr
zSF79^bFGjdW$;6Te%+Zd+-9JimuwW}J!YIaJ<XDn)#cpDIkx=I^voIAt;zDAoc(m=
zqi?MmI>%gUJ$otT)VWKSu3WuwMW27Vu*|)P^D_}&GwWmKMApjSDMhGfyG;xb2Q++O
zG@tI(BlO78<5d^hY_^{dA9-Tr@P3gGHX(9qFc=mtURG38TrF%G(5X|WPWME%psP5u
zO)J{s-`)TUZpKVK9s$|kq4+rHJ_cyjG}B7N&71D^IGdMdJNpBhn`*yyl6UbC@${$U
zDqbfI@$LkChEUXPnTF090yZmGlx<5p&1GF+i*ML-lDWKVK=J6{f%Jn<6S0pAUQDx+
zkK254T-62A!SDWl+WC-{M=#oSZLTiqYN1z9Wp;q$7JaSv;ae9Wzz9gp1A^1nY#gbx
zOCraC(E@MpE*lden9yH1V;EzyK&hGIQ6OfBfF^0V_8-q!o_kpM%HyI>elZ<7YpE-J
zHC#zYb?4WcUSFY0V4&FD-B46iWf)v;UfwIOE&OcLhfQdy&vBeK?fU0md}Y1;FE2%r
z?rN30yIW&-h+M*M=YBeH;qy;_D=W1KguJ1{x<@^tYQdPPL!IeAv^-|@FENXBNm<6K
z$yrYF(Y2*$)sci1x%Bt4rL`PdIdSvpiMIw4x%6gcS@8IePejc*n`EE^)nQ60{rVdp
zRIC(TM<!AEkOsZJ`@(EPYFdGhs%kAcCS?4_$H%YBOxD_bm4SEc#m%TEzW2wtCEAoE
zt$}fVLlA1R0i7^W86nixNj#V-FAm)D;W4w(QkiE8j^6r?Ql~(G4ecEm^|*#=$j97P
z!SLO?$@>(U^3(DzwDO@bZ0cf!z!PD2o?^`Bk!LjCz2wZuFH%b^HLl*cip(t+R0Ac%
zP2IicuJ7u4o_9B?ruVE?xw+aT6h%f48?x?7>ThvJqWCt#afG6ZjvujPXIgIPcy^n&
z)!IMDt!mh`$XxXHu~n)0S4XR#i0c19RKEv`OUtfZ&$xW;`W5Z<%h%H`U%p%-%(9Da
zUD$W^2!1B0akE$`LVAa57=|e=Ev;P0vTRXN@q#y(zB>1%5z&u1O9wV&Z!F6e78+h#
zu;}c$^VMRegph|H8i-{9?+W47XbE+5s=o7|ln6XWg1{HNMnmpbz?K0KG;hcJhK-X@
zK3(_&CUKThd(vS}ueIs5gfAqLj&|?PoSPR#3pk1<d?E1Y^5L;Iuvs{pwfupxkkwyj
z3$ws(apta4ox=H1(<$GO)_n~wB9^Pe+UR8=MWAmG9o3zG<f5hiy51!w?tj0T4<%a0
z_ZN0o(9Zkl`6cZBGnU_ytY#~enz-2`MAIH+N=)o;$+nt%<53XvfRLu3AtxRWsmJi>
z$9C-8RdpfDvKKEUEndE2`I1FqclT;-qw2zOoXuv7i~sY@rEis#lvWE5Qxxyfp+oLw
z;y-Ev4#3%;uu;|I?RIYe-o!6A|KW_8jvN*Cw}}sk#T8LLLWsp;uYBChBd#a?M=V!2
z_Dt3+Nmz_r9npjnOP!yo7==pR@ZHc-WoTsE>Vb_ALI|}O4=FS5xriN~{l?nZs_pfi
zGxy~R&ml2=+D^<A0OV5T%5euyYkyj@yUu#EEd;}+?FNq`;r{O1pYAeaPg+{x?Ma=^
z-b!^Q)-=7gX+sc!Kp4=7v_aIyd3s2uP5JwK`T6wa#DTO8Y_^g!e>$Jy5keE9(TjXc
zbRKhS+G=)5&L@9;didIr$W9Rt2Mz4%)itP_LJ=hM(@P32rCrR{v7)ldh?s;g`A4^B
zJBT_oYE*;}wK^oAlOj3gG9jdck571bSYDp~-1!SS-HpY|-cCumJaAzD9--ZZ0wJGI
zQxsM0B9moVn?rg==DG71KKbvKjLa-+jr?e#Q25Y*enJeJHW{Hn5)EY+DoU4Do2Tzg
zLFE7}xxm=KUI=U{5I5laH7N4b>?j^j(L*?NmW9vQF8vG^BWE>p`RQzaIuK&#9Cs2Z
z9_Ori%5lKjfMqLkPAkz2uj@d;;OSIAcoVCmqGm+^CJz=SXW26H?e(w8v5;HDef*P=
z&m%Oi{9U!$Ih!4vg~ESJvXolbIm6xhhtR(#SD))a5$M-V(5DNpfj_x?nw~h}Z+rIr
zXfl~7iV6<uB9qCkUDM{~<sJIz@QFW8E_-u9&mN&N9~sT#(KJmQZVlDZLdtHpn=NLo
z_WDo19Nzln*JiW1+KnHIqC&f?d-dwkzz8gAE`$&v!v_GX)n4t>nAvQzS?zA_f@*)2
zY&LfP-m_nA`NLRd5eRw1pXfF2nFl?jqRO>cmMtxD7V+VPLj1&z5JCu{=HwsX^+5li
zQ@<uxWSHKpa7y#25zh{w@9%o1RkikquzvnNk0||r(q^B`%5CLC-x~%gC0~vUn!e}y
zd7bgrQqIwErS9hQ0=#-cjo~lvFmK+R|NQ3zQ*y#!+DcamybF1h$Vx?Jx$g=xRNbW1
zT9%k|_QH*e`*MF|ghE0nj^k{c&1^SY-EV~^36RGWk3{(mYIs%CiVX>oh{Z3@{@1Lz
z^H|o-a_qF{r}+E%9gO|ytyOD{M&qZOw|=$l8-G7vp-}kX1ASh5Wlq(MQI6xTr>DQU
zbVWgdA-^DBug_;|`)whF1a=PS)w2gCYTX3_B2D>M>7O^J>a#bS>DzAwPjw$c=}9nM
zF5kjC1}N91rBgKJ7b+O~66F(QJ^dY5kY2Ie8TnxC99tvwRwX7v+`Raa&(gg{QobP=
zGi@UX0hyQ#?Irl?xUsHIiB6m|7;Xofy_WTC9GtmkTd=L<MiE<cKQak5dpIMY8yfEC
z@pzpB0(yss#h?6(rs;0og5O&5W_m`(j9GJaH*yOK3g)~zU*YfP=O_2{^qezmMo71=
zRX4ZW?O%Sq{m9YdWo5>z*R&-iCAHov<<s<Y&pa&@3NdWj$_N3mSO~zGj8;eFlye42
zO-Aca2QQrdGi~w<4|P_0S4K`P7Tcly7rxwl!dPbE3+Ts&_n7!xq*%gKjjXaPcSBd~
zteE8HE_B&zLkP8&4juuoM1Pv1JGJHbzg;~RgwTEAp<$ugiy4Kv#kczD12^c2J`&G1
zSMJIA(U)!YmKf#Ni>-XTeu|F&9vBwkS7%LlbVq&s-F814+}lsYa&YSlIF_rJ3S0Gy
z15WKtf~9!*gc`@UqtCo~vkg(vJB1yxfG!2f%z>3Fzj(6(3Drq_i)*PBW+!$d7z-_i
z0&_v3rLe?WVr6fOnTGpl{@(2w4}SI5XAMEqbY#Q>{rg4O?QCA2e)97(e*68zm?uY#
z96rq1pSrB9?CLe`_4JIV#>DWQC3h<iO-MkePChbO>eZ{cxp}q5OaXvlm_-X-7mM9n
zx~|+kjR2vc!%PqlbW{)FD%$9Cwu<)p&R~`G1{C}VmUQr)1sx}sZ{k7}kLnoA@Ar4+
z$+ze}W5CU`L0j>KblBs9r`GTXOrm^M7&C2CXdW36F6byF6;*7S`en0o>3X}Ps`zbR
z6a~Y>1rkvs-gJth7)Cg8!Z;p}XSG@n{d9QxtT{e1*|x8?bnMW<@mY|~%*r~GaJHbJ
zu#>{S+F6LAs9rsKoIaCy?)-(iVy1);l`14M@<ATPOj{iRkokxm0d6)cqoDHri92z1
z$5$s$|C#pwe|}C+%XiES;w)y{&j&Al{^@VVGAmy|4}DDikADuR7Bem1m5oika>KcE
zFYh*Y^@0#;b`0&-v(rOC9l~5a5QNbEf)FxzR5%Y<ieo9qf4ybys=i%ZJ+4|fKO0l7
zxaPtS*6otQgTHyKa#%M>MK5ZOy%{{c^~C`MN~nMK5UhRJt)m;h(Wuen9c1%n{By{^
zX2tc7{-ay(bDh;GokP+>!VCHhIl%dsrukCl>NDB-qWY?fsystp3Y{4&32O3?ghJue
z$<Oime2(KvOG?(hx4~+)Eno6)O<1prIjsN>^y%G28CY`|6h%GwK%aX00P=Xem{B9c
zHDQ=)de;c>Bp{yy0q=m<Qy`82CJ-nw@ED-nfZqW`-9b7Od}lz=XW%^+h`=R1p)3|l
zMn=Y&GiOp#Qi_X9h*-u89w2z^6=uRZ!O)j@oq7>IQ%mUp9*>fD6%3v!diEn>^y_?8
z6cNi@Q(*wr%gde28t(4M25tUAHC}G;ST8|i+lumdyupJW9uqT)5MsC66B5sD-uk7N
zr{~<+GaX6##Cd<{@e#vBHOhih6xAcNdvK7F+`QRd6HU{v%$eomBf}d%t&dPd5#Z%K
z6<oTIZFe*g<2cUOPb!fx9LHTw*8OKyY*uEW$!I<LOY)XYj+iN*8uFO>pVJ4qxeIH)
zX(p33*O6_?<53;ujcyu-5JCtcbVmVQ<sJQ`6vt8=%LBIm$lg2}FNbe~m6F;kRR`wF
zzjc|lFMY?ke2%+$6?OAUN+KXL!h}x-^L<2Zs*EpcXBb8}WWa-i`t{AZk!L6_0giKb
zck3wg&iVS=>wEWb*VwY4Y*uh9pOi1+*Sa49B+Mi170v8$ndWZB!{hOKhihifnz7-7
zkL-54!C?4s<0r4b`trvATmRE9hjVlD1Oma3s6jMc%bAT3(m5c2qH6yeKv9%J;XnBw
ze|OeJy_-Rzn<x-=17R?5R$z_5nadw=02Bk15Qq?nz!73_%^9k!tnBjT%U7;ku~;k=
zMP+4W_2|)~Lx&EOr-Jg3bDhHIuqW7(JSfd)%L>3;MhFn0J1|n>?oGrp%A+GN5}@#J
zXxl{q!aDQ%cHzZcsi*XJQ&1F{Gt#|-N25;^6h#Szf@#lBNj!V*@|9G(-Tuqrqf;k8
z_r%EI-Mg!P+#hQ;n}fP^8U4h_TH~HH%?s<*Gdbl-tvjb_`o(`v>C-!$#v4DbKvASy
zNJnRoKJoPR$47_p`8+~Mh+019^<n>6bx@aGbnR;1(uI4T{9EtOKl$Bgv<d{gA&+%`
z@n2CwAzkwg=QysU*j!R<CWOd3h&{b9+Z3Vp;Y5bc)k8oCp~mSwNPYP0-w1H-9-;u%
zojaD_Z}5_@9g{M=_n!y=!hLgEXX7}+6YvNqCDbq_e{!f$Cc<zjY92g_QuuaM_;##Z
z^30PXi%Lqr|K%4_Dln<Ct>RK=t_@vV&kADWMTq*n5<W{U>voqTA%rkO;Xj^zIwj@u
z{)30CR@=TG4-6mnXphkDPmO(&++3%wOsl$D?Gr-0y}kas@&7spbi$Zvb0QP~1%!5G
z>C)P89G91umz<nzG#Z@&wTz4mZ*OleFE5&=fuf0<7ZG_<9fBOSO>N*PZ%Qa0P&AbP
z7sFER03jftNz8+y)7Pw4d*k|>*T36{Ai8f5ziGE5op)&7UcTh-lb<)6&6!!*3l=T?
zaKn2c-MXpfbgMjr)pe$Fb91Zt6d{D7D77kN@}y^lLTqQ}8iWv4s4pYp8_TTeX$2OG
zoe^=4w}ynM<*)sF#L6W<<m*ebG73N1aD)Ki^Qpm)si(g*m@nYf`gXH+?&_7?(lRrj
z=Jk!JWeNpCsBIdv>xip|fDl5B6BHJBa^IiEqOx8Occ&UVo$5Y-Vbk`_OT_!+No8+2
zvo)bGz~A@To}z~pw8EXjPuHkL`FMN1{QPqgvHMrMf1pmdv7HU3z#E*Gjqs}f<O%eW
zA^gYY4td_+r(?4m+EE{nS@6cIguoB`WApP1ru}Qq@L`Yj?Gvt0_?wI-vDjS`)~nVl
z%(|)py19woUbZ-(lLDvb-zRJ~TXAu5Wz5vM#9%O#m6dsT+$_9H2oN4nJOUVpYOfp#
zr*yQ2`SG-|xx%J21*0EecvRC1Gw^u4(C(@Y@2#D`aB-o*aN>{n7pBj8^pU}8RfwCL
zTb@3@cX*hWXYB=c>pF=I=ok6UniUeU7;pTz5TDQM^Puv?@yofn#g{H*JrLQ2c61D*
zDAF~g<ASA+zrEy#0(~jR0bjs-B)a>H{~9b1)cHrJwAB3L-bCQacN@{a>BVgjLhXnP
z8=fG9?q`I6UzZNrglmd!ey$!%opc86!kr_EO!=*UXbhXSdm@^=G{E<t4|e2Hl!#w5
zY=uyZaCZ~Unfh%1zM3y~?YnaAdeIqwlUoUNG=qnYqgeq6JXlX3v)@zwM?CS!AV%1n
zEr2PC@{!5j{P%o{;vI-RWH1zc^X+##ckOnjT>br-3B7vus5N%L)hKaDQB**uPV3%X
z)m^Q^m}&Fk9Gu;^s`cRFIF52~Mz`xp5N;t9Mb)h2z~}R8E$@KZFG7Gv!LtuDXRetu
z^v!S;N(c;4343?p-{sFMP16q#?7#8D^|R*A%h%`sb^6SyGYQV$0ujS}we`QAQfciO
zh&9^T357yUSg&{2ye*Y_;7QEY$U{+G<9|<Ot@fQ?{}tNH-@~IK(Vn76H<kR&w?@6S
zXm3fed1!R^7iUJ*6EkI5PJ1;k?W&#-a1#r=g*4B7#|k#xo<%d)pDZkYEcR3eMGpVR
zv<ZEr^=zTryKwpk@r9DWexoMMofsvr*%C4{cEO^(s@MKAIkc8`k+m@;ZhUop-uTt?
zqvUwrMd&6MHatNH-RHXW3e+W~OFP#0dBC+y*3xqszq;hm_)+Cvz~>PuUMwM3h|u)x
z)3f`f%U92*T)Cc^Z73?X+3k!#(9uVx?%E|n)6+vDZi(X(LOdjrHy6GU8S%h>)_+h?
zP++&)o#8N+t+S3{)u#v{d_I3f^st%JpYI&diN~vbnj~th%4jLevd%Zf`CsSq%5SnW
zW=aTge&;EQYR!lbkH_=&_Lj@#IXOAbB_feXCX?0d!-Lv8LO{ZhVPV40kCoL3IX0S~
zCvV0ux4WOZL<pg2S`*gmvrQj<@X^L&$A7a}DvCtYG+i?`TFGv|brN%?-p_ey#<;O#
z+}+(U&(!58ibV7a^7e7h)fJ~+zL9oK-=mkJvcSAE=k)D&pE~k$($jyB5Y$%Frczm{
zW&hrDWn~tjkRClYT;$fQIq$YY?ZpH`kHxFTC{1bcNB8ZRJ0@1U{ku2%*LkHRjhr;!
zGrBPC*oJprSt{HA@o0JVH5lLU$Ow63F14gVntpOm1}{Vqs={O|JD>5})!ehL9tc9{
zzT>Y__;vNg8Tz$q?N2M;Ca0aw(We#`xAJijLM?>m@p`Gd^-_0ZS=MZ^+F3iFrUi9W
z5p6~kMM)&$m{E`S>=C;0)6e4K{wy>YoUysOHgP67@_3YhFX-Aec*3}`kB^9UcX!8t
zY4hT4s+Jt*TvF}3?Tn?i{#ziE$$IzheevQ&y<RU8iBu|8=gyt+C*ht%^GI}W=HwOY
z#SE*Xfnrm3LI4DOGA2SKX{Ng2&U*%`kZ$j;S^3@WJ==DCd;NO4)n+Ax*d4WWYsIpx
zb3=(l9Igp_b?!?+U6gfIZAPt6$k5{^KKRLp$1G;srym|)vU0S{=hnSLLP$WM_j6PG
z*Z+QT9Gv=7`)AxW01!)rQIDuvV5B17;P9xS8U~_bCdMeokKDQ^VS4{4DFB!ZNhf2E
zB^#A}hew6UoncKzu8Neaz!a$6{mq_~91~RLo0@cI6E78-06-oZt`y&%YHBm-&K^5(
zGTAIs^&1qWac*SL#wVs3%Xg{@@8nx;DvC*$c<gYzmR3a#ja18S?ah=Hf9!Z-k{+ZX
zkt2p`YDsrR=$?>Ul)hl+a9584A#^|D3;CUU2D*9_ZB%QAO*4v0Gm1)E`Jf1)RzOjd
zh-uEr_;=*Y7*(r6R<Br|os;w3?ma*3j}7b`P}dcyzn`DKudlztZ{mb;eZn;!9ul0>
z+U%S$9g3nV(@vfLt@fr=_Pwc0J8k80QWPbZ%R6-FP<1@5JO<QiJVeyOv64N18h<`#
zEH!bCC}<;4gamfvjq4}s-9<n*YbhLxqTEEHi4(>>_Q=pb;^TMh+?|`3C-e5MYkjq<
zn~zKuHRz$SPmWfFbgi{R6mqRWLqqoNI+K3A;96?#q5T)ejPJuR{HiP5@h!Warr+_^
zNwe9;i1=g1_m#<7WYWehv{33U0+R`BU`qSu<%u)Dhp6Fwh1=hKb$XB2w}1M2r0llU
zjaC0)GsJzpcKyjhFzJ#~g->rgyl&{tj8lF5nkmn$NmfP=lII*>__A=)wgVr=D8P`s
zcjM|kT9e6;mYl6w`N!8UDl1~3ro>ODPF!$|85FItZCW~yd3yc-R*flt(scU$v7;8o
z$)ckBGTL<u-yiwWck9M0F>;F9s@MAU1b}zq&bxXb2qDxsK7q|z6zCp;b7K%f?H<Dj
zyC?%+eR=k)FVC)LwV*D_{rh&c;<)Z#l~G6@k5@CvwAQp!m%w?=_X&!COhQc^>OOU-
zyQ{}i3m%Urmv?+}^r$CCkE&-inx-dC7&mdkxK<n*YBV=D!Hl^>RxJ9VwA8$7$0>h>
z=fFW-X?{a*(G?byeYyEW#`OY1Ah=t{;g9!h(KDqfGx6B&4ey@-&AZ`J(CvA5%`xT5
zBb#4TivcoYUmiDe*|wPPW~u57QPT35)w^N<Ko>h>)bc8;nG(NTzA-Om+u`@36#)8U
z3&u>{v@J1uo<<rmd&~aW<twazYT}71yGq-;e*H1!{O`8Si<E*XY2&kF-}xkF(8|Fw
zllDaHrQp{O>|0#^#M$>J&f2jjW%QgdjGLl1YF;FUO%X!vlE|Yieok%+@QM*3gis5r
znaGK$od}_O6(J<FhyTc!FoxlqjFykzKk{ds)@H4<@IqBZMW+9LeEd|r)^2Az%01@H
zdz2A1YgN-qww$Aj26~Id-l~CP-bs#J^x66`axf&tT`+4#3{yMPTNV9c2Kj1#kIS(&
ze*dPNGbhq~hfe6HaQssiHGkVLTc&I3iF6v0;}T73jiT_(@nc7i$EWdp8C`sQstJJc
z>Z}xH#%|xAs4D>`Z1(QsyD(;o5JCtwJD#9TXH^FJ^w{@u$+9uKTmR5)`ul<qLI@#*
zP&-2Nd4HSuK=P%Wqzl<4#pVy*`}xILQ3D?8T7Mg;f`YR5-~Bo9bh^c2mwJk(y%Z()
z^=PRZOte%z<v**&DLsAEnvjYDreHG_nt%~kcE%Hm#Eh}jY_c`sa=~mc85!}d!aY)j
zvi^QirqaR!ebSx}*2dk8h)Pv~o{r<nhb{hS{+bORjP3G*K_05<-gm;16)#pR9e@x*
z2qDx$T03mo$-_NJDo!md&MYo#<wGNc5JCtc)Y9DD1+Om}{-0H`7tUrD8BCi#ICeQ%
zH{sa`52>i;$}G#Jr|H+N{YiT@&uXztJeYs{bD*YoK*Oi@H=d&<)S%nbKi!pTU-&*%
zThZ~!mZMG8c?AXfHQ`!;_EZOY>Qa*pHjN`DYtkP2BDOSY(wI8u`%4vSWoN^r&;K_$
z#IZ_=PHSM4it@+0i*Y)|w9k*fC)6j$9p15F#hUf|hi!XK*|b-VP)p;WNu38BJVdg`
zHPdv4YlkmwYt}&_giyQZtn*e+|L2y|+LQGErV2dx^kZW}I=Aw15kd$dgb->4gb+_J
z_qneRd$50yP)HXSnGXJNe$}%57tUpwOxCJv7UY-i`0C`6`FpNi$+cPS-ZJ+WW)6ya
zL?yhvkyL9C2S$$x(`{L}Y-gfQmwfd97A`w3j~Uxf+LW-Vyx*8;>7nIw|1VZ+Fd5G7
zST_ItgL(CB!GuOX*)@67M|-s<fRf}LuZ`?KW?8JxG2#FCCv#tV<@3`9My~3u3G@_-
zaIzd~%LowC$i{<}q#~bZ`Y#+3`b^U{KXc{`09Y)RrfrVyCB?<X0Fa%X?dpLb)NGtZ
z-ds}Z4L^4vgb+dqA=I1*0hy2cj5$O0eV4F*@7a=K(}lB{Z!g~WVE-<UMu#f9_*g8q
zxZhHb{G5FC$_<OfM)9aF!5yYdd#FcGg^+Q{=W|9qaowuqXQodXxS{-CstKz$zcEM(
zHtmk*22R;$s95XJK<}jh^3hw4e?5UY_VQzoZ%VnjgVBl&08IatC-%)&4}D|ff}AOf
zo(f$A;I52*;q7%3RScMtK7Dq;%dw`44UUESyaFJf^vzVgV{~O*ur(ZZtd5;@Y}@YG
zwryJ-+qP}nM#r{o<30V{d%rQhKN(5RIOptLYwfC9HLK<fixIOZuF}bT_?XD!RRre8
zVlZDECi#1JXK$A6YwJBtH6cog#?G36pxx<>QJnruDFP>J8j}v7NALKk78}7)a17|s
z|CjSTgZ!T!*TN(up^lD?uV=fh+%kMe^LJ5KF&he242}e+`<})#UiVw)+(V;R#Ly2Q
z0|sOcdb9opBwTMEv-Y5p0ETi7&zYIBPYU<RGhG9;)A;&GAA#|3Zbc0aea)jkYtN`n
zS59N?YdP^2#kRbkADowqAT`qx=0gWwqM!ZMALwTos-rJ4F)_L+X_ZZ{l%Pc|#rF})
z$SU9L`auGotl}f&EO`!AkU?_VfP<=fG7T+l@^9j5JQ#<f%1UY=_Jr6Sz_L2g{eKdH
zH2qWBE4F%ep&H$$%V{sj%MWcsB0mg2!YrpFmDpVM?ONbtM$F!LF-Akds#D!n0@bSF
z&5O1FDj5I%?8+@SM4@!n?l?mZQ!g&POt4+KDi<;}HT`~Wm_eJ&sadp8rcB}|uv`2c
zYgtrS2-N!p3Sk$|D>w!6zXCRpO(^NboZ~#CJvVZbie0Y0jz?C49^KuEGsmy5k|8l?
zk9s|{S63h@3ugcri^6sL#^~E06f4T)AQWkAY>bzemoW`Cu;dvbVn{(tD>Es{xK6FU
zp+U7u=kg4Ra3K?V!p7@!Wc;FkVTq6Vf8{3;E!4euYYH~@gM8sAX;@6P=wc;AcyUR*
zc!Piy|HLXbFmu0povQ$dCXDY6s3Bl8w#dqxLAVlP={;pGo74~;@;a>4OvxuU(OT+X
zgXbatPaCI{MGhtIcj^^Stv-xksR%%^*LJJ^u(vNTflT`D{{9>n@9GRGPbEGp%bS#N
zcc(8<n#w%AVE*;>)!5WDVrUNy16MG2`F!2Hq<#rLW7v4h?ftodtl_cBOY1-X3HVWJ
zEiogD*HrEPONCtwn`H?gB;y$p!sRJWxZv=F&%Sd;$gEKjBHeJeSAVAg$m<qm$x&3c
zKJ9o#OMRweP*#dins7}TFu9KNe>f!b4J52+@2$K)pFrldcP`bC0d*p~ZY_cel-dJ6
z%Z`+=FRk$6tS;A6QBbh|h(=S3C%m{<{0-7yigaRpe2%NtgSwO_Zp^3}50D=qLK-oq
z>D0Kg%7~Qu6aR!->a=9+fV*feZUM+LZB`tK7_6W)siqc2%2oYS7lQ-~(CPBvSch*1
ze2BN*k8*l>m?k8E7P4SoZENd_6>G=8|KHr+_Bq8D=eZr~S`)4&>;dO#@c@*20a#Qr
zSqkMb{CaAlx5K$@gy!q)zeUKDr!P`CJ(DN+Bc}+^U*>~QMF7it2hsi0b^V{fs|Lb=
z>-Fj>VZ_wRTgY(6!hcN0fFH3`P_H&!oII5er>B62<BwbhKuZItwmS8CeocSA4IwzW
z>*-nDd-4Cb5NG62Y8+R+d<80P|D|h3h=M?V4kF&aCjVC|>3=>wZ~gy-NdfWUU-Y&K
zqyeZ#K{m-QF_KGwnxm7?1Iq&0bo1BB!u)$#%Ve^pr_}=z@M}8qe;c-mtrG4*JobUc
zXk_3<+D@P9fGp61+X)L+u&e?i<exF#7s4htNNvyigUJ9<b~vrF=$Of;Bi*z55g|(d
zpQz|%cp2ifH!%7aL|YhvJkW@L8>E7Z;1PqIXrKwH(*;~LIodyjk8r_=)(SwGEohxN
zovU5z*eVJCzwZZ!z`RA|f^nDuwgiXvQ=+C-jR!|>>0i9gyXJ<>f%9@jM?m}E`;+rr
z0vIiFZ%%jK)(9=7>ED46vdNH@>42n97k^;2syE$#<HGC&HdRH1`B04>y%+yGctTfb
zP(e=E|F_Da`G4!ndM0ZB_OBQt4gSyfLgr}#vWhorg|!xO^C~a7KUbp$btjJ=K=c_?
z0N-W-LHsjJiq!Fu{0adF=C#bu23u<d_>GuAD=<Iz4aUxm(#ah}FdKLXF?Ul#zpz@_
z{io1LG#LEPutC6f2c(8mKq4Wes_ZP96Vt{YYaoIDY~jQ%j-TgnJl&StNN>^e;Nh*J
zk}Og56B4W%Z-Qq^4XA`KM6!c`2(K4Dit@>rB6wn*;9V6G1G>v3Pzv<VvICJb4M2u!
z(L$RCdLbLI9r5w;`S|z%ZFWOR8lfG20OA|&EgsJw{E#eY6ZJrPO>Ey@iJQKjU_b}h
z&1~=40IRiu0X9Iu#l^+=hd^XNUhwGjG%YRd^!T^}WfI^by21k^6>s)&Mma!TkYm@1
z*VqmWN~l3;eZesy2rp1i7|wO1xtxckK0iNiVS};y4eE@HjSmkGH~D-YrAU!;W?Y*!
z0ng?Pdo<u$a7NUvs_~!!mj00-ndBH^Ej7;D_SiC1<pn5(ZHci1VNa-YOiu%!lSBRn
zf&@<Y^ZV5)sw26A`(Ed`^MOy;OZ12Ik3~od@pRZLBZO)UcoTwP-pxjvBU;4JB4``>
z>SU}hoQxL`85_v1&7-#kV>I|a+>0Y`p%*kLFGx-|!9#lrbT+3iJUB?-XDml(x@2A8
zs#W*#K(TsIC%<im-_cEE6k<8$x*vK!U~z2dy`HnP@ak700kyghOM6{Cj#1WCT9mYy
zZSqfLTPcd>lPVV~2v}gK9Q55G?kh69xjvfT)QB4tXXeIjI0=^?X)I+c4t;tuR1Iiq
z7t|2hAe6$tF3w3{6Bq>y{A+PVWv^c)#TG7Vf7&qZvyb-t2;<tRp^=M)wku&Q*6NyB
z+Gr+6^}z)7FUUJ5zQG1r;CZB?LxI-j0b9ss|3276h!d{JDm<LG3Anot@>Bg*2PJgU
ztz8N0TPbbls}de{g^7EnVMR5&2b}h(0XNiahjR>RU03CM0`UD`(zq{ztrq*Ig_{)1
z0O$5hlQs4vlCH1oA|BAEWz}&RGCAl!X7DYq>LI7PCQXg8EzZcZG7(euS<*jk4+UOK
zHxEk&BP~9Z3}P9Tvz)2G>tAiqH^7^Js@=()EyWd?_3Mw;@g!^LI@sxLuZBfV(ze<l
zl15cKz9y#DCVZQ(p8>|hw$m~MKV%cA3Ks*$Ei#l~DT|$JYnf(Fbi7~EK0L7&-`!EQ
zy!6)C0)=A#z(7VPM>`uJ<dKn*Uh&!G%4<HtBjEFTu}|v=(hw68>fa~RNN;VZTZH|h
zZ9QECcnF!F&mo|kR~?ZI^Gm(JnG4t@Inx}vR(1A|pHMBJ#7Sx@r02eiDVL#2PKYYs
zedJAbwz}i*FBbZ7QB`D}wud_kbtGjgcZM#f9s0Q0@Ug7RmVnLtuHX|~(F5Wi9`@?W
z#nvM_*{EQSW!CafJQ(0trXpG!p=SeL@5Q1qcKd;IS@T`pUPh6Kyu7`!@rtlG3<d$O
zX}W2hbT4snd$~D1yp-g)Jo00~k)3WgSm8Wdd;Fy`wKdAPgxdm(KETR(VeuCGmXUDn
zb|i$b8`JaI|A@kOkic%mhbNdf%D6Lqf=l=uBA^Qnp}+$?S9%qhm6>cF8dnGM*IC5>
zxjB~+OeR2v^v@3&3REj;X;m&-gouf;aa(b^&k>vY%3nPBYlJq0Tmmi<D+A)v0fV)R
zZI#1DNaAZx(%tw;G~|a2*5v)n_R7l0a>C3$(AOwcMpiDDv6&N`7&65D^d^vBTAvQH
z%(58dCS3RrdkA{;fG&OIUMOH!-5qMZzb!8-|3xL7tteM}b%ikD0DU^*gt3RWyO~}e
zAD`9LRk&?L)02Ya{o`X*Ev<|5^Yb%*W(`g1;HayumeV1s_y_6GG|tad?K>eCC?F$D
zYZ$tNY#Xo1g|YFzU@GtuXldzn973m@vi(Goy8uE-{oab5rJD&LkgS5;U4&j=dc;oa
zz<)t(=|*Pb)pbt`nPbQgpq_Y{FmYIoCs?50Z2lgrWYjHZRK^EMc@PJ@^(!qlMa4op
zu8^*AQ6X?4OAPPE07S$|jIfGrooTXJ5xn>VYbs0Pa$|<0sNiF;BH=Fja4{Z$%Psu$
zpNo1zorR6rs9l+lYVLuSwu&Oup=tP{o4UzOfxHJ44_xJ{7=GCkr&(kNhv<OgvuJ&z
zVkv`Yoxo|22$kg7eL}ogGGH{Mdw2d%bSL}+AQsvRl0P4$<p89Y>%iC(-Z}D4!+J-Q
z>6v!ZGGvtniUm>oYRw-4eq21gfR<s~%r5)9*5r@bkj}KWO{196%|fs2hMva1!*~-^
zp6?1<*RQ0eSN6G~c$ain6vj#heSpU6m>SfjjhKMlE|d$Naor7R>Rbvz9HKGS)$SQ;
zk9z~1Dfsse#)y>1lO2+srWIEJR6DZ^)k}tfrwyIQa2S&jEJtt#NvPQC3;FQ~=t6{S
z&gXR0_%9{;XL(9MXib;bdb50sn%t{b;kD@yRXljS!nL5SaXFO*A_p0<P4r1n)?%W(
zF%xT<!M{-rJt;r$_`3k9Yj29wb)t1;=<popW6%~#cYp*<Fk|KWWTY~s{^bDN#H8?7
z_DIEfjY@={FyGYW(Pdx0;ivOrIH*yYmA%J4B;WD|Ccwuqar2HY&NBV@W$Gv9D8)tu
zMy#zjYa08=r1b`Qx7QcH4cqab{G<i%55uix-^vBd>i?3iKQ`u<wWolTV4Jk4=}urB
z7keU$j?py33U0eFC8Rb1dwbYHlJ0OZGR?)gfNyrRVpyu;jL^6n8$*r-cHE)%vz>5R
zp$ojn?-%y_%hR)cg)<-6j(Cufs>y9k`?}{9@|~s*=D#G&^=J$DjTfdX=Z6S>?$r?;
z3PhW)z*5Z)TdjcwpDZMBOrWgp?{DC0FZdtmu2%g2Hb;5+Xz4au%iLlC;7=#)%))In
zbIGb};#0aLwM^p=NFZ<=!ol0zkMB$*8N4#LWQbZ(qU(cUS#sv0WQ~gJ=zW#vv(h_6
z6<YQ(wlAlG#0t;+@~nNIQHm<{GN*I}tb&_T(*qrlE&4Xk$6AWsLj%b`9S*@0AG8O0
z*i_&zeFDU7YkackzzgJ?`-a&=akm|5#7(Ic^jE=U@mx39>T8>1!vE?r%5zihSpSla
z|H_Vk(jfr*IKTR5-}f6udhIU$>#&vLBg$WXHlN6zLPn4{)8_AY!K<0JsOkiQ+|fpY
z8ZJ@Be9ndVh;-8`UP{1ySARE(+A7RYgf$3=|Im8jYwd=>(*o8W2HK9hm$~iZL2RGt
zs>lQAxBW|Z5iL*^THuKWbVg~Vc+wjSk^mX&ybI}sS%-!~S5dcAFH9Vy8wy38eKVGL
zVZrC1QxfY_&tXy)Ei=pREDte=Y+u&88jOWy+6-XekOA=R%0g>gNreNp^L=(uZ?xd$
zWt&C+^F@GkDxgGj1W@tduKI);C@$rt9;s@L^<<toIVqgsz&>{b8aTAEeU9%yB5zns
zRYjOxjnaKx8Ma@akFa3vu!U?2krUi*!}d{-r;+~f4thxlMs&c<K!Q&2YtsLp@B+9W
zInX8-`ih*M86t`AoW@nM28Vy)8z?;XvCCV1haFx`?2<QnUkwO2Ce$r4s)}TBL4B`A
zq51EVkc+s`T!Y2BY+y52wrOQsZ3#p$C88irZnyYb3*Ur68R9>KHE9EHmB)}~NwoSL
zOlcQr0UE6k1yMD4tjbSbuKo3YG=L8jOB3zHweNwUlz9hud3Dz@de~JB&Ph@>ZsUDZ
z*RR$jYFxTPhiB8$qpDrteY_o=>e4pj%v9*GB$3h!M_WHs)M7?=a~ZA@ZdQ?SlX{(n
zRFG1paaozqebyQ7A9dZ91&L;R-B_L{!zQ#m=pk9ul;^-_xC}rp_9xy=1-NJYl(3;e
zqR3CF^yN`-DWQQI^K7<S^I>Nw0Tbr=y4@-lxA@rqS18PThdP(j(gL*1D3~y>S+Pd%
zLlQDeM_`C*O=lIG3uf}<Aqmn3E0$d2q7eSlc};85u-e&)Qm_syickXr0`=N(5vDAc
z{_6{HnMn!*xX->#lj(A1&`!t8O#w-Vyj?18-J<g!S3d<1%4+TDj<!T4J!7&OjQqyz
zT;>Cu+o3AZ#l|pe^tQQ%q<|l8D|Efd+-EHvNhyPv_bcLAzgMi<d6-12lY3n4M3i7I
zHpc*}78j#gaqHdg+JQ*O3l5M7kPtYUx}ua8KZp4Y?m*lH>S$daCp<w?Dm`ULP~OY0
zy~gQDtTkJAEKeK3Yb=dmLqV_IN=l)mN|vMDczx!kwG#p}e2-BdM$jVNi|n?(V#M~N
zsQ#@o3(7>jOY-M^jp9hmcd`Qq3lWoIj;@@F%5Xiki2SeMxYtpXFCPG&g#dT5T_W2W
zs!x74JtczJF6n|6sY1Vs)kO%rbKffs^uY7!7_L9>8J;+UEH~)o=|8W)_3Y%eG!w`v
z`GO)HH?6#v?GnA7qFzrjC1-s{83Tlnt8q+$4Kb5F+0Oc_6;yE|CMxZaw?pM7hw62)
zyg~tJ9~BQ4VIQp}E?5{I9vE~`VpD*Jz@m2V2$@uSZb-03Zzl64P)u>MJ5PQ9qO7pd
z@HMTlk*dy~Q{Sz&L5X^RUg{OiJj~ua2q@CFb`8NHUcs?fu?i}IDY|i~a9|r>lHolV
zE&?yN@~%70sU!xMCn?h~nUW|!p9rT8W`xioG6<?&Fp%Q*L_c;eQngmJK(9A9N>+*q
zB-CpWD~*AJr3%Q)^I2ZpJmJd9z+b9Bg*^bDWNi?ofpL;y=dK{b$utI+J<Te)><un_
zE-_}bkSC**hI)Y%9qWE>8i!AX;744H1~R3oRB&O02B~m?6PSW@T3FbR?YqOr9)5aE
zg*}9?Y}oM8zCh+XG|0YOmk7UYe!aq2A4qo7zQf`LC($NkDwfYAy?KikH}OCgc_AVy
z-&feOFb$2eMiN|ZoE#yDCu}s_Q+7U#xt}wI7RUfh(EB?tF_{jDA^&cMfK+HM?GFx>
zAA7B9sH%WOd^1>L`tKqlNK1)`7#@_Ifzmg)i1tgija(j&7d3-)|2WJ1V39Io)DYeT
zbu$?mCJg8V*<rjXBfmE1;&vr7knR#jC5k!oCJs_kxdJF^zBZEL07j`(cFQy;iZKpB
z<yQxY1YVA-mpb7rxw0^<k6c4sZ-<W{97FwA_end3tI`rOzY>K4d5MV`r7@Et(m@8B
z3;|CSn7+e_b6<bCd`WH}dYNNPUNbu*yNJz-e<x=R8KV;|z(EMj9!FKp?B#M0|9tzK
zo=a?`o*HO`vpO@Y=myYS3>XNYppll9jREw*N7OWfyTGS@?eXDbt>_+IMwyqCil|@K
z?qax#tH%8~&aBjW-A-?K3EdwbZ=;`$$Y4r!>)4!#15nUyDdu}^pul=JO=?)bQUspn
zl+^1Y++JOhI85&!v$rZ3d{I`JIfr+f^!1Ezwu+mbtyi8Y%SozNf5$bt4si0W{oTyc
zl}G9wcK{?L5M|)oCMfnSGADUI`x2m`vX8Jwot$T=W~>><F=HzdpAG^gmtl3DCz6j7
zBYE}D+ndCi){L@fkLM4?4So#z%htS@X<(Qk_|`v7fLU8Gl7qk~z<er=_X0Pt1rO7|
z8BP>)HxMf0;`R~OXtY{we8YEQ)42Zm5#OE3X)vr4iov5+t@*ul=R@^m>n<>Kve#Vg
z$wxa=*pWNWsHtk|!N?{Fk(%&qqt!)5K_fn)=yBR48l-@U({=EThTtN*-hGl&N95|w
zrac6NG40Lpsk_$p&MGShbh5uJ<!&Nf&*%}$ef-j&5|q%4`$8|8?BaBPS7iz#oi@gq
z_4K(Yu7Jf2(b;Wp&Rh_q{q#ZlIE<en%${G-fiA;=bHBMvSB|NeMK@c#dAp{_)XngW
zjY%k_&D26{v8akK4L>w{>Rnu&_WXxGq<i)qwe^;4a4Im~vR8kl@o*K^9$(7)wXh^n
ze}S^?>iKY@x$|Z7Dk;#I^fFI&$wqQieCcc_Vv))Kv-P#Z_V>!|*Ii&4z_cY2nZ@8q
zoN|u`(101c*oVVO)1x6lqr`Hffq<f2NtbV1nbduBEnlm?)Dl)=0DQ8Lio8ty={9%F
zr7Aihy_UmT`AJ%pE1Xftl*+4yJ+eWKOTh9UzzbEy+BQpt*vJ`2$xiPz?s=ZAn6|&2
zQ;(u@=}D*YLvMoPZK(lU`J1cu_kf>x$K_(3V^7Ga8C+JY$5usG%Gcc{chqZt_M`34
zQ7TMA_1UCujke3lQW^X0L>iOAG0uyV*Q>b-ev8SQpvmK|vrv)TF^mzcZ)MiY^Pwrq
z-vLl*Y_zUlzWVo1BJvI&T7VYI%hmrT-M|)_YpE?8R-<v=AA2(RWF;i()T*LW&1o`k
z72l`U+?N~8ZE4*rG?#bA6287xh=hU!fladWlN}2%WJ(5bso0hPBiNC!hi_nruo?MJ
z0+)m*v`7oE8EYIXN$OtZvkM}FDYq2i{MAF**3G)KbsCl*25$Fd&&+p@Kkk9G)x)~p
zICz>S-)0m!Hc7m|h29w&`^JmYDpMpY(?m6=QYm&@IkdYLRuIbNC7^kZueP58!hsb(
z&PGZuHY#wLG^;{&9;F*84imzB*O>q;x|9YG@MjeGSH3dn?{`EA$OSD~+8nJ0)1?&V
z-%Ei@;@h}%x(1wGE*JMXIIUPL9Djf{W%lwKbY`v{gyp5z=uBlc+K6l}_WJx8D!RkU
zoa1?s|HF&d=yEXYN9nDfhd7Yfau^mLv82LuX}43+8!m4=|3aHa8lDwfhyA^0PFVhC
ze?21pq=8E>oLRU9>9c$JWbsThUw^8>qJ&6r8IhEw)<oyp+sA<A%*}vorOJ%};p71+
z*$&vNsK%S|?$0!g_%J&Lz|Ve-w#AX^4P-vkJ8=$EFo1jNvvb-SRh7{F{tBe*DY+{p
zS@&_@zj!wkvyPp9{~Se89$J<5wK{JWUOXGnEH1^!u$hr0QuW2<<EZ@TH2TfqqJ-ae
zHd@V*2Ya%gBJFPcPH4U0C^7Xg^<J`_S@><dDE{^ziVk}_AsV@v_j>Zso;tn<bkwdR
zY;uwA3jc$4y~nye*nYzTtK%wRB@BNU*28;Uw&vfPwUfl(oU`H1z5I(0E-P5I!(VPj
zOA;0g=rgt64-yY^V!m#pc-^ic2>)CuqN<0u6+Gh^v^0PRf$Q47n*fF;0HikB!1Ee)
z)Rv4HGrFCPH&aD`)>!YSG$_V2wyFK51Gm54;l(@t({|LTk&8s)t|rF>HHoz}+aiLd
zv$Pu=`J;*3dtv~3f7oY~@K|YYuMXUHi%R<pKk!x!i!Ke1kZn*Tk#3LKo{o^(2rk{M
z$?pld2@&J&#V^mVEKh}buxx}xnae%#-OK>dxN-<F&f`$VaXFR-)eOVnA5PLpZ|3>!
z+h-&Fr6pEhhT)FYW`ZBLg*ZYo^;@vLK$j#4i6;1Kx1TxXCHP8|IqM%Ij&Qi?<m~mj
zLeS;u4%3;x?{V8(a~fX!s4c#lb*1Jys14OF!PDbqhE1vZm5U1tMiPLeMAJHVZt5h1
zF<!qLT*>UDGf($>bHslz`mcZqAPY|^X(Sj(B5DS%VU;J5Z-$R}G&O~5p8s7cXwo^S
ztgp^(3SaYRd`G{`%hyER)Tq-0*F?Q27p@?=K!B^_S12NOFai-j`W6rHgB<mK^-3uk
z)4Ima>`ZgN>%4xS6*reFk!KLn+02=@(dKW%3wQL32&8TS!K(rQ`4(iI#tva5kE%qV
zj~IeN<OuQ-RBZPuLpVJr7aTRx9jWQ*h6~uv;3`S6U^=d4gY9Ie{P7;q8ni0aoF2{H
z$_1S$La2}CVN&Ymr^&hML@3q8YP|aIxB3LP6}B8K6;B{==?B!1>6CN25`RJc;^OU`
z%h2o7^e~43=i!sT2WO#Egq*hHOGLvqE!a`R&wOgxPxHRk%^};o%b~{V5k*cTrr+0q
zQ5CWCWfvq!`ePIpE?V?{BSc^SDVCp?E@;}tl`m&i_-loL0<#ON51vgO@Mf}ZkM_n5
zm}MNcY1`yGNnOc4Yuto5<Sn-6*HTi)Vu@Qh0s<{V)v}@eCkbF&g8nBZ1fer;DGPo%
z7Ohg(s!4qUE1fo;tCVFNrQll_1{LTbgQNaQzcoXx%}mA&?d0wlXdp@f`UtJrR(2j5
zvSBfpl1QY)i5S~JuJ>~ne?(hool()nMy!0D+!dX<2Vp5unb`rJl?k5K-s)g3dO2CR
z>a7Y1MR=tv%#Y_LJv|olrz#!9cXthV*)Ofoh1VhkwJe&#??P!!>2uy_ANi;BA=%=S
zl617DW*<<en=|Y<BPq1%*$M+oiQjA^r;fVF)+|gS!3&`0QDoONPjM4G8F~K{?r~8J
zX<lEKV%ThS&CkPgk8a<uTT(upjn9H|uo8_lh?0$cUv4)lIRKP(pPn^3J{TM#QxQOj
z?ufq7dagwR>O@2zS?ZQO+j~CkSGT(<__~v3hYt7@wy&NvZuwM0=4zesFtu+KIUHX)
z&%@L~ydclA0mKdhfgLN3Kxn*wAFpLyU2XMn<r?a+;+Lqmg=E%UFQ@UBr}4tm$SX!w
zo6;F+ExLxS`MfV>wuXc%L}6Ig3!Zgrx<bse$bU|XJU_8u)2JL9DiEiH!>Vg2z8ZN&
zULBNhAy}T%2G%peD&pxeU}D}2k>2f#f0&Q?vAN)Uemzi(%(T3J>3)pd3o<M|$SbZd
z3tc{WDk$+yCS}1Gun<~y&&(fdz1b{(<o)y+Dz}OnE>x?3HrT4FoYy=CM<uS_PB$`p
zS;*OWvj}HMmc_Pc!jLvuHpmtxtur<~*syH8V}as&B0gSN43_6-7&^KOp0F^$TPjxg
zmHw0v^|4N<3ghy2koS4p!7AOS1i;NaoHo1P*Xsj`_Gdnts;C0e0fTnvDT$R|Vi!R<
zwEt#l6p7%K>rystWP2PQ3tDL+hvpvGsRb8X9d{p135CZEAddx7t=FLBwG5Q~5MqR^
zK6Jas#(9}N_<w>;k@4XYKwVy`U-B>(W{g~!lEk4urim0ij_EiPLF(eUYStPh4kF)6
zo$HNDbyS*4sX7%K2o1L-8r^nroM%KVYUwe8$dca{17TdYh$+IMwSV|@6R`NKG71IT
zZI8?O2IbfM5lf@g1d0C%-IrKJrKi*%q7s54KFB=~<b+!gtI7PnFMCGqKYh3tTW6tf
z^bime#1KbWbMa?UvIXO~v^eQn^cGyOHKB@0;BciFq)fPQS!<R-2sPH-=~*6*C{4+9
z6@|wt-r>EyHSp{*4ti8ZgU4Ak|GRiUN4l_1*|SiOX`VFPDZOG9Jm^PNUazpZf(!$<
zzvJ}V5mldpkr77lT{1gXe&)hp!WxM9>oR5X#o&r-^f;SWmv^~TUhKS%SGbrmt13v`
zX!*=Eg8&a{@$u_y{NA4h%VJ0dSyzjhuLx3;TtkjURUQVr`?I2nQ#i?AZ-Qq_&&k<J
z!?LZakg~*k>db5p%0KXP|0vYG%7v5qV$raY0N9-}Ein~cSGNR^^z#9<x@2%#WoVkr
zw~oV=43oTWW@G%BvOOZL_Ug+tz=DvdDa|{J1G~3$dxLT@?8(NGk`pf1uaq2z5EYAO
z(B8ZxDM4M#m4jAaN9)9ayRI2i!%IFHGKc^rzRO)I`H(JRM9ArnoBhKFDwmRkZ;r(d
z*BXw7t%sd^dk^o0NJx-Qp0HB+i*VZ&s<uCEup0WUbI~B6uvrP%Aus2OymT)&t{e2(
z?b;3<jYm?Jcp+|Y4A1fgeb|jRQ2w4#pIS*<cx1XKO_$%$UsZJNI%<|Ti8CYtK}xAB
z_f1<duWZ}`kADqVGDF>2?sEGct+Wp&&Vdr;O?$Kp&0gwK8%uZTY-ZW<W1c_B_;Xs|
zbGAyKip9D(%#RmZ0^hCWU&2mmLr*~!*<^9ZI9{jX^*rv<qgJW%OI~W&IG*wouf15>
zY(*voR=yY2!vQL|FP(7D7RDT}Pr3G<PSH(bx(}KNg$83|*Q#)Zekc{klU$76ucdvO
zFKBX+7-~o?Nbs8VhH1PGLoa@)K-rBRM||Zb@?jy;8BaqMibkF|n!(-<KG)0|rKyiL
zgNa4^0SKYJl=2j)I>GI_1ae=<hRcPrKCZu)U9|%dsv~2DQcnvY_@>uE96x(6<o{wV
zvoWA=VS6I>+U|8Tb^OALyUKFZ8{feUdyNhm1NBA&L2ci?$XjL9ziB)LMMevLmV}Ij
zA`vhgj(Upnz8-QNDqANS3``lUVxZAx%00(9Mk*{|tAa$@^1N2;A~FfNPWyS)0)MqA
zQM$=(Gg{9y{V@Y0OEw91yP{ooi#$Xu2b^#uE1r(aK|F?yVVk5uA?=DA5-%OSS?uj-
zb1*B5E4|bkCdrqsn>I-sD>5lZGKo3o3=TAUgwKb{r1U#vCdd1Nt|0_YZK~ns$Dg1F
zhNVvs3dCUA4R$`yVU$(0VGhTI54iOs!^uWtC*+lO=e|LlKXOIuL7D3!G<PE7JK1~5
z?9^xcR;=sSJ>PiWuPLbeX+Obkt?a(lnM{EYZD+DyhqnIsUae`Xm>k}2h|`KA@&oN=
zLPyrFRTdQ$Y0+}%f26t|bsoOytki^DCsiz8xNrgLQyrfb-cWR~n9KyNeBygq2o^G0
z@DGSTHHQbbA})I7@@56qDwFyYlff&xXbj5|GmaDXb~+~US6!={9R7lBHwZ-+K2ERO
z^6g&p>Gk@F;`>h={s0GOajN<F@XC@|E)YY|)!i0F-?UKk>o8`u)<1O(-aA+y!VD@B
znLbbqm*hU(WgQLSTNojd6BZ}G%j-IwxVW%As=s%g{ANJO`5wp|SqZ;%;SD(vba?Y<
zuV{CNy*#>IFzmG9uGY*jan|j0`@6aMnP!@8KC8o-Ma#$6W4qn0-R@*wSKbulrM=c<
zHBR?i-f$^NyyP!dZ_Su`wMxQOaQ3zksgK<j<w!Y5&DO&JvZ{7CEN0uzx)^okH;Z2q
z!^S8pOpy~$ai+N_z<R1RI@W_@KY%o<noCPdPn}Oz8%oqRb|mjBRBMuxlUa*yt(e%p
zKu5Ozbo3<8fDPHh4cxO!ae$|^^dHjnYEY#(vLiMEWpB?eCE28Qc6M%TXr&i-bzvj=
zIb}rwuJv@i#a42u`jH`+DqT0ctR!20VYU;<aCG4$T=))1-CHwNBjWEV23=cYu*+QC
z_!-G_g(-6agRwC>B-RQ}niJ-an@b_K+)YdPYJ~3KY%3r+HMP{VwAB+p@0jEL-JJ|E
zN!D)(iw&f&y3+{4yxqs`?q4Qn5?kh4d60S2gGoSU)PxSwkJj!npO(*J-){Io61;A>
zK-|0^_02SJ_hg^|;rOqk3R~~jw>P|%o*pJ01SfjeYqV)!-?13enYQeoV12uG$zHWL
zQOi1q4jk1^3)?;&NhNGx+$4a3=F*d%nSYECf9ckw;^bDI$H=rg)~%Z7$4t>^HOAE_
zLn81QyjDW$e4i_s;uF%+)Ya730rC+5L%k`z_kMkLcX#97;Q=qkOu-wwlw$1Uaeuk{
zE-{^d=%&Fv1YJaN-Sn*MQ3Inv#=}tCMQaECl7x$!e=OJ~!F1!LcAa*HbN^VkH8e29
zmiH}_?TINV)}HfjIlEaAz1Tu|0T(e91%ljc1?{+laFdTP-g*jWgV<FYBJoqap7ddZ
z|2s0D^<<Z`aL%Cl`VOVlwgJb3V!^Z3=s>Q0u0dFZq4vJ^Mik_<tziJ|Tv;B+Pi=c*
zj3*xUK91FjAXqAtJLo^Y)`OWl=zXrXo@-#{KA^hT+BVy>ON0t(&T*95OiZ|K|2lAd
z&j9EccBosw1PpoOU9A{`v+z|cdfYmASgZw=!$1Y(Zn&e`Qw9)tJe~nIpKcSdEK~rX
z{b~jdvf4$8HbwJNh3j<^;kzr5*GLXhd`}F!oX!!`>lRsaFY_h?Tu+_LvW3fM^@7^c
z5gugM!>VQ7x-zS&EqPT99wOkA=La7N_a|R|YoZ&N=X;aOO5?F%w)dX^YD0Y)eQ_%E
zPxAerU@aU0={TltD2A8+0G~6&jVx6f3?>ms<sCbAE!t&VD;urm$)(9Kd@JN%(3^PY
zkJ)bxQUfBHsO9^VG&G-IN)95=Ug#a0*$Ek%EEP4)nE4i3W_4;-&ojWr4XfQR7P@w^
z`I0GEZ~FvFL>0JCx**<p=QxI!F8wB;9ROZ44O~9f5zvk)izbar<rK9lF#cuQjRO{7
z>eeRxPwfF<u8;;Z>nfgvuN>n!<OH$E%k_?=2>{->P}k-TL{ffDET@Ghr$eJd@~<|Z
zM;UrI?G_~vhbQ~&)h*l7dsGcrRTC!1-I8yWtgA2r$arFK5P|(SlXj3YVsQudq&#fE
zq^Iw9N|I*J)-z<=&2P6g^wz^;q}?}=Frj#@_=EO1Er7;DJPz$C`>Ga<w&d@4aC+2r
zhi`Jv7pr}mu}7U9#46kYtH4@{f5lad_%B2(@Op+FmE+hAFbFRY!WYokt}PE|q5rHK
znR*VPA_k8T3(Y<F6<Ay;JFb7FTP3N+Y`ChwDHKz{)yeJf7g&2}>(%_+q`T|&r{V~0
zF^uNX<Z3<x%O!YYb!7&d?csrnwjkmkt)~O*8d-C#9*6*fV0iB@sPB=AU}@kTnJ;{G
zHe1%V?y8V6?pnK}yTOa{h%?W-T$4T`eTUk8S8(_cAx^^rt!gF*iDbTRbPnf=&`eHN
z62JKqx*$&W|N3apAU9rS*+BaF{NptH=)gkLX?b|s0}b#ZSHNdzLult%ONsvhgmNYN
zztumF`oTnT9bb;m#ga!GmS%L)b1SgUh+i9jk&o7BpyP|8^YIdRbrn0nD+Q1JE!194
zt9(XNd&ERnbQYD=F2Z&;$I9AT%cLtU((ZIywdtt|;T5?}rq=i^AC=h?PXNg)BJyd?
z@%=@Vs6J7xJ7K0_tf?AD%OhRUqQv28!Rsz3xr>NMK=|fjSTVgT&F&~OK~z$R-NHSS
zNGz_3vN+YYahvJ@(T%-ceDB+WiBtR&aNQ6Bhy<~{Op19kkgc7_K5Kvny@&9|3pO+d
zyxttS;y>t>MIvJ|Z`;9%%=L<`%+L^B>^JaERjb<O=%}o#4hAxl(x{Q8LPJz^RG~y$
zs;e!6sH;c;6PB|^!K=*EArl2S$j<vHDzNjU&nQN<8FVMA1K;tZW}Hldc^;^7zo$Pm
zDH+Xesi>@kP;eQF&*dl9HM(_i*SPS$7HvsJOpN7Ii70*o0i^minYUMGgrvlU@{z!@
z$yW`g#Ri%MhdU64;_#u9H>Mx|T2GCtfJtyQq*+irTKkiPBxhQ2i4mbbWl(EZ4%Fqm
zAxb9~%GaAMJ&FqafRr8khQ%@2E*5$ed5%;j5WHloBUBN}9dzEp5}LBD;(zV33wd^}
zvqK2Mq63P^yKkyHqW-Qxe?E~968t7C&&U7u>OistTk=aaTZbT2j$6#>EC}|vOW41H
z?9P&iO;475`~ix*S|~a18Knm`Y%NBm`}kTff*!|QmDob<Iu4H;`-=tJPE&^|_)|C#
z{W?@(Q3E=m%XdgOzQ2c;SyL1^wc3aG-Fh>?u!HoKL-i<Ai-$0;R~Gdw0k>(CneplT
zGOqp!hyI=DJLdfx910)bHtzQVpas8ziG?P~<oiu?=x4IA<KtT~PQ&Gb!yS+x1&_Yu
zLl|||5<xsvy)!|Aq_N==`4NQBFuJ3zb|RQWQl;5_eQB<8NKZQcO1A7Dm+%8YJ6QvL
z@{TJ{`ZTEZF2y7QNLq0ac|0m_`hkprpI`#Q!M&&7hBPYuOF!lr{p${%yN;KSFdH;_
z0QC|8dVZGL&I4DDF%oEM(&(%Vuos|VbP!eD(!i@q9rXZ{TBpmrCOj3G0!32Wy&#eM
zE@3|oNM-Y?%y&((4uT{D?|I5e&*`=%2w!O!U#*fn=QN7~h<sFH6=~wPmKfFe?19i_
zpAtGuDm3vm9%mOn1#w#Bj1G2-v!uienT35s=bDMUhKj}`g#e<Bjg3)(C`-^g!U4ri
zrHc&;8XC)Et#v_i0tC=tx$=9ru7mMJt12rDdKQm1(ytlW)dpFj2p&{?ih|1ELDvDp
z=VECDrNy{`NDE=0n@#>tlwB$#woC)tBjh61+SRPI66!vZR#uSlaU9LH@+;6@`^<?y
zF=Tnk1It+CltD}1J|jvFp1NmiOSFqnBdj8&M73ByQ=)zCS8mV;M#N~tx7?Ks%a6(V
zR1%JM-Z&I>TrRk-x&|vL3&swJX(9k{;bZ#`gC6{X)mxW?bQGaa2#kLFZX`h&fM5JI
z5YoeL<@S=;k}`z*d%E0qVgOJe(&99{2;HTF_vB!ttr~AcgtLvq+Boq)oqQYR(46C3
zFhcp~xtNH6>z^VYk=-D{@IZ2IVw&Jy$g3#%h%Tih>d%iiP_^x|KmpvdUCQ&M<XN~+
z6do&PX(T+aq8(pK)ydS8^;YU>ix!r_I#WSGL5m1Bwh@UvON5Cb<V8uVg<ItS)Z<xX
zyf;^x%l#M2Na@THs#B?et!7jfcm?jb70XwxG3%0rVH+6s3TU&mUr*WPes&!|i@?9z
zB`BxMm(Fc1X8%Zqqu=~>rPwCA1WcgSez&TRz7XMj_eabEK}l7X^&6e_6N$G^a$PMT
z9F`h3U^y?(OMj{iNB%smCcg4<eYsNnz8(#RydBu;n=HzL$^UtHO{;@S0K)cHQCZAC
zk62*be=pceoa~|i5-Fn8BIu}u8v8xl{_pK&0shO;GRHLA4*NDFVS!8nO*+bB@<zEd
z4+f8oWq)~K#}NcyC2&2~&*jdpHn+WUgyJxYo%gYdD>=sqrI2*&uDi%o?<7oyBz`NO
zULYVpAaP*<CAXjIzv)SA9HIgJ!h{cUJ)e2r#`B=~BGzLQs*{GWKZc<Nd*T?r-%Nb+
zXziy$)<p4bb}Gj|6om{9N>4&A`#{GfovxpP@?TI=^e3Zex|NkOXmgC!6ULO3lm<&m
ziw}?*Ts(Dj9%)~>vpowCR-jXHqK1j(!I&LT=H8#`)0y8@=t4iaX+p?+X@xE9tD6nB
zPtVl+;uU_+=v%w!sjDJxzv3r1apiR2b!7jfKA)}!9jxpRX<GL``04E_H^kb4>DlJ8
zl;*3!3y`R&m)6#P>G1gJi`!>Iyn6i&am3iKELRef+x!&fa&B{5)iG41MJ|{HqPvG*
z2(4N=Ktx)RKhlYZi;Y)LF^O5$nC`?!LiTO-fJ?7{N=}RL>%elp`qbG}!Aa{h74O%`
z&uU9(v0*!r`-nJTAbWm9n$nNojK=0p#L}8fGMN(d33IXZO>-<4?cyoLW2{{7n_!QL
zO7M86)csZqCy}D_j|)a|ko>|_D2=sG_T7ET{*4FBG%po`5EJ8kzcGb|oeNTWe&@LS
z;+X#hB^L!?&HKqMSjw~`9uQo<Xy81!@>js|tI<h1z~fre!4#$!gPEda&Z$s}MT+9N
zdzoD8?}vkAg4Yx^9;xdVqddx?m6U~LoQ1Whh2?`qMzf%l^5k!zUulAS%9kG7g_4ru
z;xp*ra4^cr&&riupTb#jN#^K=2tUE>HlaW~qX`$Xy%6u1fxJ@R95q!7Ibylf0$6RO
z#aW~xZ;&S-!VWox!3+f&QiS64XxmeIEm$=wQO7FLhGXOO^%kbFe~^lmw1^85UwROD
z%F4<H5K!_Gt0i|O<k&K&dv$hY{A6uXqjtSIP<_8RU79Kxd$bmKQ#}90SFj&brOa8A
zMD6-Ox)a8Y?dUwHwc19Yf?R*}PE>#*IG)(~%ge^(UbPijPrX%pu=|~*FOegA<)RXh
ztFBwIW-Qt`e>AUJxnwMwG;yG9X&N`Isbx$>5ode$-xu_7kJ(RG=`x&|zxuA+-KPMZ
zYz2k-V3Hoz;rq;Njgnzd*>PlXJA~^){o%yZ|7I(O<E}k4YBx{SF#D~+>O4G+)8<jC
zhTr0)-$U}wn^A%oK*7X7%PO8y#b9**WJM1tzVlwDIz*!aEnVihJfckxVmLawC%xrr
zF;9OimbRGK?mXNN^NUbq%-CRH^<?qZ7MHV=bpcyyt$@n_*%{VweCdc{DSP`J?J~Sr
zM>6u=Gk(ipvQ@wKLc8Y;kRzWSu&kSa3s&uWp_{u*yIZev<awk<z8Y-e6gcdsbQD7<
zOhyep7hf?)P#{j2WjqNlw9iU!kH{7=ocYO-3I8P`5*wKkmukBW<_2QUnM$pv4#Fx|
zQF9fg$tNB0MrBGa#_+y7{>w#s;+*zF@%Cs12F0!{7c*y2DvzeA@pls|(UJyMmqtmI
zoZ>VlR6JZS22<nE*^6SwuaEI_8}@FmyG))RK^lkFE1d?_><-Ic<V_eB)_n5EhAsY8
zn@+F?t<HDYsDC&!MaE@NSi!^bSSg$aHjH74Y7NpgETlf{y!+uKfAhE;!2Gcz(=-i$
z@N`fT3nw<n-W6<*mLH`_|GXu0PVOCVdNsFa$O-ZJ_+kA!JZi1%yhV7kM0*?mx98*A
z?N_b2xVU)xQMhjoZxk=-M14p!4pYXI@<1_|0JqHil>A}xFHA&1F>fqaGX<~007i3{
z?|b6;Yf$3?+9+xf(O`XY+pt)WQE_SRGMZR!uRkGT2`Lb}L#B=skZ6zu>|iNiXpm@r
zFoy^i{C1f!ZIzBtl6Jk*g63(LYc(c@VW_=XfV?C{QYqR_!tQE@*Lh!155Zu$;zkS#
zMI*NZ$SsSrex*zoM=%TZ@G-HccE`iTKWQvfw`ZN5^y@$jNdX#G9A=~&-<iM5wpfbY
z?6!M90uI77a*cA;&C1%$xJSue_+l9;y5qZ$qegh!cT@kbX3{!5r|n|{f^f8UN-8TK
zvlcZDJKfg{H;^bYo6k5vg)~SA{rcVJwoB$Mq}*k$#yZn>bJsbe25!U0Vx5=*Jd##_
zI!DFVjhWde9}FlwG9P^8c`8x9w{WN%$Ni?%=7QV3<E#|WdPpkBmj)Kk_<(jJ1)y!p
zOTk-f`Aq>vYB*xK&-=k_aIz+6>oFH>ONwf~6y;6x8CCNnUDe5uYhfOjyJS+BELyW<
zPBm^ytOl;f+2C~$K<T|FMPXkD^}!J`O{WZvYgsTd8M$@qFj{^L*f*MQbYW}IAuw9c
z&5>$r6Dv>1T_TXq8gpTF_{Fl>m^{XI%s{h-=rdTuW|;*i#FIEU?z3{;t969h%Rp`w
z`!ilV;%90Ec&yfI=ruBN99N)!^m8(|xyqJ){jT$v?j)K|iNWd&vIQOr^{*daN5ey<
z*AThFr0|{r;|G^n$9oR$)E1K#Kze!D`V;u?6x>|3?h>sK11JSV{bn~-Z_e#~Io$Ft
zs!sE`+O=c<1UdM(w*()vnk~v)%r9cAuLI7f?Vq2-nU#;ngz!=s-9!z#4ejsvbAtGT
zY}h@`nx!zft>1e81nqwQ1Thj6pG~zd@HX7`yw$cpdkTqBfBsDfxzo{COQyd~Qd`fD
z2o^E`9PjkF4WYWw_3LRG<QzvKz}aQ2rJ=IRf#|rq8i`Cxy!gVqVG#*PD|%n-4kHw|
zA{Vu|KH=@*-OXZ+WYe_*KF0dC|0={3QxF$v=60(IWWcCIch;TaS7~MAffW!H(H(>3
zjJZ@?{g23J)x+9Gg~!Bmi6KqW6g3537RK4pTQdti7PDz{io<a^)otZ)c-#sN+@$;|
z*I?<OyV<+A9tuu=8QjHF8b81k6(?EzwOfN`U!n9Oy+c#Z?OhrQP^}$FA|VY;1k|IA
z(!hNG6l6kHaylJ8a<v^xLjO)^To*!N;c412G0m1wzDqEH-+Xc4*4o5cz0;rB0wJ94
zr**1%=H&+y|3+T|8e-M<WZCeUbQIlpo2_yZF~?*j?Yn8V<?S+$jnEfKr0Ni*oyHd!
zLnpR}4?ITuBw1_ym0?N!Xoz*`cG!Xxtu<g$8C7x+9v+_StuD>FL7SHEulGw927CaS
z)x!KhK^_D(71jFdjCPB|9iVhVMS|$Y`+9&prF5Pw0G-6d$H8+?q^RP8N0C?5e;4sf
zLF;{t$zJzq5DN{)sNqQ)+fn3RlHqZI3Azp_nR;`vKIu9Y(iHDxv}9*gncV4UUnMG2
zWq(||8td{PmS6{oc*H(#pkDb`2|uDsDZ|MO;g0;tQ@}qv5>$xi816+3>GWbmNO@dl
zmtKVboikVGFA)34bKCG7uuVV_5p;C*p=T07LsV5lB?peF$BL@<!u&}o)HMyU@(7YQ
z9X_^vDu8k@U|1go{)!o<xm>bkiT;PNtn}|PDa}TtS~%tptw7<9@LXZ9`>x#;jrLDr
zK<Q+RXZYDionb<+-Tf@Z+gdy2U2co<P)>aUV1d)_CV+TtV<+ezDcp7scW~bM>yd_I
zs^nIWCEt5%1$lY-i#0QU$D8>#oPQ`FdJ479R|^wgW|PMCxh_BApH|Q3tuBwIUMe$}
z#97@XoNtdrcDb-FH@t8m{_QK_L8gm7r~W-|%W_c}s_9NFF|%WbzI9|Te8Yx2sAaV3
zt+(j!+F2~9B4>xLq%|X_SHKhytsAYLwb{*{;`ir^fhZMvlw3)lQO=4lJPH+x0dUS!
z%J>f(Zlnr_s72H9C8jMWuFEQZkH24nNA0XL<qlKx@hNFjFXU#xeq~kX!H5<-#R~;t
zoVL!Td?bzIr(4D59X;t=%a{(-j3-hkn>u8Qd(J6y8^oJ5Fb_02v~>IMIZx=#^Jn?+
zp)?>nAObu;+pr<?EdF@qs6x=lem^>S!er#X?cZ*Mz(RAl(k@QdYl8(q?T^IU9PAQ}
z+<m|7JB=gM$i7d^qG#h5;r;DU1z^gq@x&aN??;b-fisngrp88UHafb~j%!5#JSHh>
zVs38UqyQNp7t*z`D7ny12k#6Ef;WjH{Gl^iY=l&#qPOe6^@d>gIDH&ni47Q=5AN{>
zb@4QI^^SHl&99=9*4k!cHnwOI9av>UIwPNat9(dQq!<(9(`I#auYZUt+GUR2o2{dq
z01$-CWB~QrnM@?=3z_(q8EZ7?aL0w3j&<kNh~)_morpJ@Ow_j)M&bw!1F&#w>5>r<
za?a6~5y(8!x|8{tBH|ngiBJHCE|bYYKU<<;F35sm_UzS$i_!=Xia9bbBtEl?b9^34
zg))cr&;VOfbY`W&lNimmw~pzk#5yKw*LHb2ccZrKsNWhA+6p6(XVv+oDETY=<Th7e
z$)#Sg51{-3cX)Kfx>tnG0}i74?SUX0!$wqs%Xy=$N=KJ5^&}~JRPr5}^RVW$cq2c*
zooUUQQE{mwr{`t8mLU`p^KpMrhHtxG)^>Lv$e;*>=z7iSzURiq*0SWGUP`o!I4cb_
zF`#$WV1*t|!Vyh^6R_jJ4k$#%YmL}e@3WQcv85cuYK>UH-v;mzJ{q(s{|Y)}66WdG
zJpl~y=E3({jEDMqUYw*1=xS%5^&I^EFi>rj$7#0M$F6lu%n9MYc{!PJXL7Ypr>&rR
zq~J5wuk95gxVgdaIc_((Hyer87PA^FWjPx&@?!0-;NKy<!EF2`;`-4Agzq2H>pOkx
z=?~{mZ4fMh&obCH<!5XvrN=@n{KgfI$iwrTN^2eEnB?Ro$ST)oYaOX@$`*x?{0h<2
z-k>Ku+02HTS{gJ<)Z1@FR+atc@N#k+cUv6V+LbZPSr7#>RJoEQkb=gEg*N5~z80H`
zTe0Bm+~=Vd@sJzB;<2YcUo0Li701zhi`ybL0_3RwNf38${(>fb1iW0ngK7>-5v>Lo
zM35cdK$7LF#^}C@H0nEQvgkSbQp}SXgMaGK`}#3%vw*|Vl+pWvtL6)SF0DuV-}Emh
zF?<LSl4P>?4W0mE<WT*6gEm$E*VXQB9jQlANl6HR@=!l@Zf@?cugB`Xf1XTNr*MPG
zbgde-NyDm5&8sIXZ3;Gr_nDz~d!zUo?ipe$POKB*mXH6-vC)enpUPHN68EqNOs*!n
zObe}69z@DHY~~g^pEK<*NJROYmbh8%UWc2H_7ZQGLlMZ$nD{9^A5)*Gir@Mt`2ap2
z!@14bd(UmQNKT+ovWs@+-LK0o<qTR>>+;jzcdZR)<s^8YtIGLaN6WsGl@$(m6ggVy
zcj8GT{c9tyE>>PX{TgD{LyWgw+=`StRr@Jh<&`ckWGVgU<be76KF9&yHk}9YsEX2V
z<d&SYRtm9-29-40UXfh2yUm$J)|xJn@+!=-roU9rJB_HI=s9e()$WFM7Grri$JkEo
zziP&>UJK>4CEvqhBf7vQw*w#9YL7rl`z~+a70_2Y^mu_)c>HifX{VbY^P<f!db(}T
zDRWtmjzpuCVqT7f=Ux|JR4N_;p8VVMb}m+6e3Y#i?`4^A;JODH>~BNKb_3`eAI9^6
z9ebYuwEeS9&*pg9?GBj0gZCVtml1#tBEKC8>}GQ}4Q~(&O080_DP<<rw!txhDXa(2
zFstCE0mx_wy-AB!lAYg97N9Jo{Yq2OBe`<xsRgLfEr`nra^~(oIM;a2x&k78$X&wN
zdOQ51SeQA-|6}Vd!}934wc!gWu5EF5r%>FXw79z$cXuo9?(XjH?ykk%wYV35hx>k>
zz4vi^-~5<?xiV`q$x5<Ta;`HIVqVyOkX4*dN9tW^9~eHZ8XN7#LAnve;X(j={OJjR
zo-w>vS|Oi&lPAhD@lpl+%fr;OP{EVFn5&}1_aUga>3NG8vyi?qxn8e-rdp7U+5A0&
zUY5p}QZUjeI{Ou*Ax4_L_g!exRZ|k)l+LI5>L?8jwk78&@v%tBLKACwiY;O;u1#m+
zPb^f2LUsnDl@jJ!9zOMh30H286Tal=XX=5rdRE5<xgaNjqUQ9`=Cwn2P5Jc2rRBjZ
zemt<iUVz2$e!r9JbVR+spA0?J;ANnR1p0nF1q+MUwy&~tZQGgyptd_%D>VvlZEbFT
z`1^Mjla&l6$F0$lVBod4)oj7kH;4F!um_8qtZDO)&3TG=@tDxX8V6}2?M{npg9@0&
z%w8?7rAtuUC>WXKiAVg)HpSf{OHNaOH}Nt^Ug`O|oWN?eWBE~Vryu-%_7ez}2_gY?
zV22=kwWFv&jSYG`Lk?whrDX3?E?$GFY&wJUAq@Sb;|f668xrA()zy_lZ!1=S!CWiu
z>tiwz=xoH)zH*!lU)9I0)m0v2h&DWSgE#CjM8yrkB8U2Cj;hWuBgSYdjmt)V#w-}4
z5pRRDx&eip3{kyGL<ywbQe(G7-kY}=PyN*^b+=gPmyQ_RQ)FtVY1VIRoyiu#QU5?E
z$$KmN&A4IqI^H|>vGrHUsoUFHHbH2_Cs!p95~|<wN98l3z%FZ*z`;G+C&(c_HG*1m
z!MNYXV-v3yl4F7A<DP|1=Rf6&QPb>>XVLHNBS=(xfweu#5LeHwR(JfuW(~{HPMBFy
z6g0a{F3%O!O>3{-J=+oAd^DUIT%(5K<6tg~=O2AN7&=#=y8*l*dZ>-Ttb)(Ax0n(w
z2GGI{qQC!#%mT97u_~3uN@|gj@`3H5x62mn#L3IRJIjj?PNZ`_$;s<n@;dw|(GE+{
z%DrSj<o+WgNPGI^fjd3Jg_2zE8`w}T>mR1U(`RCX?x|o@&;{u?U&U-)7{p9=my4BL
zbaK*zunHC*sywub;%SK}(wh$t+KPwn-$6_PG$z9)Y8T4>ND0BE_`UyUaz|{`x2&gQ
zWU2$ixZme}yNnC3KsTEw&KsXI%qpwvPc1=q?=b|=ws-iAl}a~hdO=upu#jP1=neLx
zK+%^9D*FHgxeARA=gX^jfY~+hbEIaQy^BoH)e_hXFn<2DN@6^k1pkKU@>G$x1C1;q
zJ1czrnvMO)EgHjKLS+hvWMh?3_+&JH5Obg35{pZ?mL17PbPJ9HZ;9)yKiLWxYz6zz
zuaULNUv~EzZJYnmNSJ!wc_dbzq)te;Xr=|<4^`l1-Z7qBT>GE-FS@SLHt&ka3`aO4
z_?h)gqZ=ibW}*^wQcj9R*+funr$8#UGt3V$QQh})B9I}f>d5}P@cy8Lr~867Kkg}2
z+HmR?ky^V6v(X9IxnBJ-jN^UGc%05v7M>~Df~~(-!*+L=sHX9aI@cl1+e4a9xwG4x
zX9`#H3E_C1sx*p$G_)xWvMYtByiE-guzQrQRU<UKItSl^cP|bCylF@tb%Afz@}PgV
zc<7e(m-wcx{DB1-KN5pgmpyYb^6^Qnee1pqhppCf_1X5^19W(FfbsQl54*PjExow(
z>NcKMjs3iTDw{Oe#i~dY2E66Ms~60Nko~@p&aR2YPmtq-b<;&qWZufMYD00e)2q$d
zi2v$9<imd$t_Hh&=%B|ax;z$a*2XWvx<70_a_$sX;OIGBI7716_erQ8SQjN+gT~ow
zFsWeS@@nYy59>{^hz+8cL}zrTF`|godP)~VVyNS~nH6u5)=Wp(?Fd=Pzb&YvZ7(Dx
z<(^%%j4wc0^4-34OgiH6KD^w4DbIU4D;PmC<oETHUmW0adfG4C{k57nPlbfeb$Zq>
z*^wz2i`)HWFm_ZMxZ{NPb~a@$JMtRKSuio(KN1Avc{;&i7x~w{%IbT$F9P8#s_#n+
z;@$CllRKROnX=VOR_nE$oibcKRt#xi2gB|$gcc$eZqJ_W5?q(SDbs1y{Xiobj1TEB
zSoh24j%6Ok6S9-k$drihUUf7w6Tw*;(ehtJZAHHfUV47QpZhi4vNc5Y9}R;!w$gq@
zIw1#vv#)P*KsD*2{9v~ery0PmovUGj-;@xedw~skTl*C)A44HaIkq4lGim%63=X!E
z_?L=0?(ZJ`Gpu9!3zP@Qz)2C(!qe9SZb1?#>UwPEgSt3I;#oA?{6oNKZc4}*hbHHu
zW6`QWqUS4NVAs{Rl2=RVh+v?sY*o-57vYSG)6woyZ~k+*^tadnN&xHhOwe;FjZE>c
z_b?2%G{~3y(l{miOom1P(f;pbFY=p<v-$#fJw`=Sq0>S|DsNcu&)Wqf=o`REa0)k7
z(=+;okpQeC1H{j$-qOOAkH-;_Y!26#Hg<Ns9S=oE>>s#=KGO55zSeQuj*zA2rrUz;
z6tHyTTD>nF0!v|9s;o(G5GR_07BI>P_#eA2t=D5@HaW1xB79gH+ZsCtNBPA{511CQ
z2B}x9A_nKVtJcA$8(q$ff4qLXNgsEU@_B|(v!Ac_qlk0<ma?wWjHowdYU_N(kL@Ka
zI#)VBCNK8G-pj}GM^{~1GF6S2iUL*v+686lZ(~UDue~5a#WF&wj~nJ+N@#LKAEcM-
z=IYLN4lxWWRiE`kJW5Pt%?cNI`(w9u6K)Ip#P0}F=(ri(1a928c2~dwNLx})oES?1
zz|x@hDX{lr@DDu_p}<JFxBKmUlHd()@)P1iIXh%`C#Ob?0E9pLJJ$y`dT|iYO|91=
zpJF9s?Q&MN+rT@T2NITpMuw<Bfpzr<Q*A0D^e`*Y(M~#(ku>Vf#{Z?MDN0uLgcv|$
zg4}%c89a3RDsL1(^^GH;$yRDfj*<gO39m|#Tu(c+`xk<FV;atN*R=s5*?0nE&$W_Y
zP@T!rr~I-ub>7NAxvg^X)+kN<lDZT*wsuaJ@nP<THqi>IY$z5oL%4taQe}&WuinF>
zV}`$s)j(}$aw(+?Yb|WrC8CKofznU#$3aGnOW5I})%xfCZR)CpjT7+HA{w16!!pOT
z(h}W>>8d4gh$wIn1^w>q#oEWK&0mEjUleKrB}x4OY6l<E<_vuN5{!(EIwHf{jRZGW
z=h-H#$U(RJ)1^%Fhr|9U3~p|2fL<>p9S0hmv=4zS>b}Rj0xM_vff5CPr_JzWp3j^n
z&(i~a*uO1{1t$U03@Ir#Z6_JP`qC>0C%3SZ6lQpWTRIKiva7?9iE6jPZib~Tp9@^F
zX^%ThU<q>A$-1!}8*q`qVpDz|jeDU9phTlCXve-8Eod(76k$UB8X%vlOi<@11!Fc3
z#_u2UJJxtS!N5ioiz6T`_jqF^MJh5>2F5$)|IcMSNsH)Y{Rbnv{?lD$6s8Z(KkaT?
zp1b63M6SaduJR=AGX^4v5dUtztb1Vh+HlVpEnM?lrnTGd+PUBWzHV~HLi3}ajFAuu
ze>4h~fCP;0TJwF!q{Dt%!;b#Ul?~lVS^I6MB@j`cxi_6RtfTjIXSrwlFHL}{2`zlX
zM)odF6$WR9E!pNrB;0S37;7I;GB&ZmG^_yQ)jK9u#t}m0b5d+q0=zb~4>CSIM5D5u
zR&A`nUPvvQG+hPb4=S?E4h!Kt<F~Y}Nbz6z1Wx=l7jONN#``9*MVpPRLd7?!1JI+-
zzFKRl48(>jsc^y{^VoI!2bOrL?1Z^rnsop6FvUQoE|k205Jc_3A@RYz15fJxB*yox
z`H;P{jt`}oFj0_xergoTS7*w4cP;TcPSiHbu!wq=^|E@puk{LKT7{puBKEIuR+(a^
zyq`a(&XesiAJhDZ<euk<R^PchUC&=whTV7-M4MTSe~(hO=9uz_zE-SqMWs2OXo=lK
zNNU*0DrTxW#!an9l;cx>f}hXO<kmWzds%$*u=wBdy5q~*rK}>8$uQy^!D1?Zk@CCv
zFljSkBZUY;XYho^MXti4xt3`5;Ahrq<hb<HT%b_UBt%%VzKb~~qEf2-`?wGOeE>06
znIQS^dX-yGRd`|#wtRy1;qtX|30>~4JTC{IPC0-_qz9}d#|Mnk1l&iLj&FrDS0yJI
z^h#Epa&_$qy);H1wyyia0TSUABBaPsb94C{vNbC0`>Cnoh*%2_<Z`sgdB;K3#Iwdf
zo+7vi{i5I#A&7aiJ>W88dptc2DtE!<p-?>-=RdqrBkr7?t<Nj+*8`X=NUtw|E9xMK
zV%q7<opGG*vrH7)?-PzGfR~DxbnZ<DrJep&p2fO_n_D*S0`xjMA@$e{LRd`e4YlR=
z;`=1R=cR;iDnXb49irX<BPViS?h>USCNYYm#7=frYTktpUj0iOzLOK^%8N({VJ_?e
zXiX4A&_~9>PY9{=FhE{_Q2~@yRW-G+&{%%#Q$j;aTlSYt0A_CJc1>DGhiG7bnMj!=
zU}KVK)@JF<>y*_Ck3G_RP`v9SFA9?Zn7NEAo`~nB^SZhSs1V-S&-;N-yM1pF#J)*x
zCxtmzQE0>uqu5AvdeBe-cor<6K#<e)rLU>4yZ}pBYpYx07frbI<(4l+EdW#%1Wcg6
zH>+iOfO;M@Gz!31LbCqA!NZG-i)+3Cg!)J$XiN?oU#Y!FN{9?c61?|1yPjo|<J2NR
z6M9_)Nc!}kgJ%STWbLQ=XJf#J-R_;u<df(h0<c~V_?U8*3@HVbKif-Yj(+|6^#L4g
zpS1xRAdGW5TLr>rPk-kMlh__=yafpg3MP35{u#dQ7Zv8#0dS$yxx$gFtE&LabecIF
zcKOu1UzduSdSrau!M%_9k#Jm-em1!o>bPrm-_VGjI?~U!bs>s!B;lJ0Cj%dtO11>_
zZsjJq?}(}y>?VviAHrB+*CP%;Y*HtL>4zqs2p6RH9?~_>V59kNq@ZCqs<+C-x4E^I
z?|O_$t$f}gG;}!<pU0Ki^5VmSyPl=xSvr>!gP-4@-0zVvTO&qe<KyFFW9G*#Sz>2r
zXW^mAO7^}@uD7PpJQT7twJNj~Ra6-a;}N~|lLYlRV6IA$X*KyWk4*f@JK$;e2u*ws
zT?(=lX)_1ehbUEK0G${IEJ{H1JI@(RcEfLgT1ef$pYQq3?Hz%bxY7pDXd5slmzMHM
zRZQ;#|G02xG&VZr)*1qv3ILS^0A0n?Q(AqB?5^(a&a(7yTU%S79v@xZ+*&6d8Y+;e
zrPVD*j(*J4DV6r4Bg|#eNJK6bj7RK1e1KK~jT#W<PgF~meh`9%`<t!(iZ9}s^|R=R
zF%7Z-b)?3Nj>gl}sOuMakoDki2HOys14G7*B{z@qZu?pwoCMHrIe>-vEk63CGVDa@
zOC4Dgpj}+`4uUe*7Y;o^5G93DC}zg?mL#Tu8f%1Akl$|?V6m(3f>9w3zE-_}Ig&68
zcM*VfL2v(TiY4@>fsCx~LYw=<L<cb{Sfv3@X=jeWtv%kA;Pc>y(gx=zT-u56CqvU>
zHnEY|(ok;ZjUsT!y9jWci8<p0qx@+C<QJVr0|NVl0jF64`hp-!Xcgm(w5jX1*hRSk
zfwoxtH@jZJSr<I`JwN3u)Cpu4GNjLjX(brZtaHFaEEs>AiznbF5cw@9Mx<_ex4Zvi
ziJ_R{<HBC_rpZd7mvss(-BQo&EkpoWd>Bb8cJtiy2VG*q40s=45@tGUqs|r#Nv|{?
z&V76N^$&cJR=P>owBvgt>x@5L^cKCaN7}r%7KFe!DLwrp%WH=jjK>Wn4IQ0BI#fk%
z4(|<=uUWw!dIh$tee=W@-)jl8581+vR79iS_hM68e<BAi{dZ(X_5oelY<7MaquRU!
zyZ5*!&M*hUkZ~9evToqK<~Y<97%rgJTSX4Q8ii};BY%_8zKGA(dyBKBuPw+o8Xc{2
zRHhc`5eSMD3*j^H87wW{hlNI15ztwh&V4B-xHVj^^VO2RuROpn7#02;Q+s1g_*Jh&
zj>=s30mi{Oac1TT8q&bfP!~E*IE|+K+}73g#figa`^Q@rVY*b{XRX`>nP^kjhpW8-
zyl=a|U*^7z(jRq*Ply=Lm+;`e)6u-QK2z2YV3x1iZxE~c6Ls=jiyqJsFhSTPv5wjk
z0>w~Wa35gX4!T~N(c1)!7$eU(`cq$*3Lbj>Ks98kN`_$(>+ZH0t_5SVTmx}7L{x%i
z1<+v%kRen?EJ?r0=LvKA2SzF6naKgB4@`$FCV^xips;`qhlMluw>=MwDk(V1Z#c+P
zI4w2Fmduz~Pu52z9)$*>SbBvI(-nmU=8^%|#boMs9D~Nc4O1nAPW|(Cap5RM-?Wpf
z&N_XmNXWur)0r}tQk@0N<dDk3QW+nXXPKz5AtIHE1Tu4JB6~3zC-U<&*g_sDzXwwH
z`Hb*LB%4r7n08M#r<G`=*?gh8ZCT%?Qba&Ryv0z$Ka>-@5-eXQ&Vw$Qg*X}zO8;mo
z^|iV>S11CvSjlP1L|oQxcyzQiEd&2Ej{2MCm%_rq^L0E_)LA~tBC^r|eA$Y=gQUep
zD8cKMV8D$JxVgZRy8kPc=tOky2rRq&qsB6!df7MBDqnoYL9;SdYv6W_*6!UT&)!4D
zOopbS&{bg8-fSq&lMN?(&97=D6HNL_omUqGdwf)9SsIhEG9Zb0Z-4oH0E<2Z*7kz4
zp1Edq`8tVC)BerVb}cT+yc*^QBS$`0HRpa;iJsOZa-PJ(r=8b~yhcnWOH5j~g-Tvg
zZ+^h4Zcz0`1wd=5oO(tP8axVRk?I{)8!_&g<MJ?I5+>C%PGU-)?e4VW`V?Q%FO*-x
zD(@hfTFzN3`Jyys@<thwlFE<e0VEZG>);TpgourgF^`dim;b(;0byi6#_xY!IeK{4
z&S%;EQKkefkKFP1(@Sm#U)@mki2dHol6(RMydsH#gxai|xbUwli)Utzy|Jzr?dLRz
zgs2PewlW9!5QVQ=mZ|vs-g8lZzx|DKZYS1|#BgtM4YwaobW23|1kQk^HHOJ@K#72h
zN6p&z!o#UQe(9{dij_@%IH%ZPvD|;7CH;1Ktc>mC2f+9>FE3lScT!tTi>~d`xh*u|
z{g!i;kW(KW-j1XAWAjn}W2zU`>SW&lBNs>=Za%fky4w&m4?e$<wY#x-X&XPBZr+s!
zJ!)Vy76%dc$r%FFM5o3vpwE!(?qfU|LKer)PXz@kB{J!4L3KSn(zF_e1aXMMQ;cc0
z({E34F@grtkV)QLfRHdEhUN6ihz(B>CLS3o+!p5zr_ghUX+DMgSl(FlPLD<#iDyxx
z4bSh>J=N#JcrxdyRJq_Ai*>XP8WQ$C=CI}=Qpfk**++12{9oM`E|=~(k33~3r5?lX
z6hgcsV2(&2(b`{~LmV3fw#pt_kflYG2{zc&zj5rO?y$P2Fz>~}05FFnx|Hsf39EDw
z`7VuRM$12iZePNJv8b8Tmuk)^S<E&rlXP^o?P1SfO>PVFWP#A7ha-w<+K-v(Yi$0G
z&+Z8w*r`$6FU>Gt4_PQGo!cL78*yfJV}84TbsFjRo3)|&evEMSPR&$A(nIx5Q~KV~
zAkoIXf=e(~<xhN*dhwP6V?l+H2H~jKWl@5S)O0!G0NwhfY?X%X-S`1G8u(c^$a0+X
zR^B&>QLa)IHMeKC!sFP3=;L>?mfB)h8j#FSM#ZAB<Sa2!eK3LVj;wm+FESF2kC5q!
z0zwA)WSOF(9RoqX#+L1{W3Ody{E`%X>%}R;v|Q=*6=&-PoGj@_q<CW`k(H)V1(B70
zx8%)gVGSM+iHSFU5Dc?6$dJ2&U5O-6FTI0cFp;av!Y;Lq7lG_R^L(C~?w*+a4R7M&
z@r{wZS9S$nt+ug=KlUmVwo6{%DTzfmlH4c-Q?6|N;^n9b<|{0}YjA!~n;opM$8>TT
zDv!g$L+*Rf0ucZNz+L%=O%PZOwA)MO)GOczJ$#U%2M<K{L;Y*YkO^w|Z~`e~iwpC`
zYmEaeZjA#PP`ei}H9aT{F-r8S&>Ki}FSlOTlp1C%Ry891Fa#N&5Cs){E&k+Cx-hge
zWb>=P$n9=bj0426KU*oN)$Ogc)X=+VJVipj2S8rFHA5G?lJr$xR{9M~inbJq^Rna}
z!!3Xlotxj)fv_0J;gt^s6+3j772))BXt_T+SV4*gj~aE?B!yy%D~(JbVxe&jzmP?|
z!JyW%nfpm*PPp4NBN+?wZw@&ve8G~GCq&R}qJx@0b-7;h=iqkHj?%r^UWBCnx~@#*
zg=oUp=zs?31q;Qqv+%oi2o#y9P`)&`S@EK5-jT{=Pee<=5{g(K!}b|7WPX_cV4l1)
z=nay>$odJI-bglDrY3z6INbJ&laN0oG`cg6HXJ;$p-^z^)Z`x}vnCZE^s?h6E&Z8j
zaPf!amMl9f+d$^ivKBQ?)8&t{5mhJvQ^vGj*Yr!NsIO>Ip+BeJnw#@alJ1jAi)^Lu
z?@Y-@L2jEFqZxg05KZoj?!&%(@nbP#Fc1JtX1L4n(PM(rxPyF4yX9}ZXf`p`sm1Wn
zG*hqN#Be3TF!X1H8k1P4E7I3GeJ|TV?|wKV%H*$yH+g<{P?Xb}9fq*skFLXxQ<|cp
zkF=buck=P37Da_rJ2~@at9LVIegy#Jq&HRBDsr9RZv2@acMY{Wu=ss4JzENr>*yb}
zKhf+5N6L1%u}Bd50rTSox4aMXkA8nv*t`$iZwSwc-fW=N-OUP+2c~lvL?eZ_aX&Lu
z$@!s)uO!#HR>yVRL|@Xh<B#*dEXG&HkYrIMgHYJpiIu!XUoq>33Fx)lg>b)q*(I`D
zf&jfoz1CPACWnyavD=r8*!~(lyCw%Qq%AQTEJiJ9nPMH-OFrf1%skQstG2KkW)q*D
z|AtkKfAZ!ht@%@HCxPsV6~_CJH*dBG%mS25WtU9p{Q3G>VYWVx8A8T=?lXh~SHc(R
zCVlM?gkkj!^~Yv(N;toe;oSTqoON|41v6dDwZ`Lwa?x2ZWUrh+Nx46tw~<USLF8N}
zw|+!hp%H(|K;)7=8wV2)45CK)hhBuq1dyox&>*vKrq4A?p{x`*{D+k?H}MygaCWkQ
zvSla4x*sglq<(lu{Ji9R1^A=idnOsZr7l~vq}ndViH-+paF*32w$5cmR%mu`>uczB
zlucx4Q_3c2(83A_w1QcLk=XB8-M0<7w^{$(%)8r5HybV{w^q9|x2#=x*8VX6wdn8o
z_XH>%LZuolHp4Poy~vdB@t8-s0rqGx+#etk(!YXvv765guxSHOa%At#%io#ThG)yn
znnGZ))lV<C*!?m2xh5ewgB2P%vt>UoU4(wOm)u4q;UT5=;<>pD8Iod~($88G?O{^}
zLMi@m=!c8<X|vsq0i#^nU9^a84vzl*(kk{$GAWYi!Mwq7L7AV_{*`sC>0u76gO?YK
zrjCe)bpojXm*$ybphEU|p8co5f=4CU1ATC0x=1X@<D;w%4O-$p)L$6xU(dZeVI)RU
zaxi$Fy~Ad#6X+CDml)14zrcUKq`4Zb?{*}azL%kcz=w^QT9#4u3yrSjsm=bv*Qd+=
zumaqJ^u`U3o(<0~FR*Z4@WfF>I5<-=JfN+AtW&c9pfEF$Gqpz2)hesFEI{o%Qq$6o
z0sh?0Su?Odri%+jObie=$Z`hrws_MYHFfc5MX;$31p@cZvgzj;vh-zS8YT12g8^w<
z$Rxmy9bF|At7~NifCZXfiWJ4`SSVTVd`=sfXq&{WTmFT=mROM?t)@RT#PW3KqV1wL
z!f<4H_|R^!ZTNJ}mS^oNWpo?!#Dnrc$Ec6#l@L;FN<TG%X{n#;FQ=x#0~*;iX6a<y
z20?0`YLll6nSuEHdyw@C@WPhN0bK3dQ#x(!+;O|>iB>D$<KPoW=BoP`v<VO<(8-os
zM&7zgzo-^$={_fSHuPNrRyT`)**!(@(~;|{^n!Y`%)7%0%rxVHO>|4759e7*gL|^0
zv^At6b`numOUUjhTY*=%S=q%C<w5+3u3ToM{7P48<Ihi9`87;jZo8u<1$mD`exBVe
zK1vC}e08x5W^VItZ6g5>cWJ)<oimaEHvph!dDnlTE%0*_FUBe?FYL242sok}7%uKt
zK@jHC?NLL;J3IEi_dh(}Kz6W0;oHDKtZijNFx{IO>|URMZ1atbUyIsYXzoXza4o1c
z8>fAO`&TYG;lJCB5Y5W<3Amp6SsAre72Jk;<k4SRuD2}#vpvAOYgA}EUmwkY$@+gD
z0#1L@0LIYe>#vi%0^bs<849cN;zKJ23~OI52MH|Hp=WIYo~55-Zij{+7A7w1>cqlP
zObr{YHY|aqd31dm$I3}VjmhbRN`NFEs;pg7+-L;=#K~Bw7(b_eHkuZO$zHCS5GQa`
z*YE%W3U4MEkN#IRmA+u}n8Haza@(g43O%n<I{@U}0aSAiwa?OW_pE2_*E~KB<%%SJ
zGGwV}=1O52#C|0tUdA^as7IIflLzH@HHPItJvu;r*fQ4S_<@7K{3zlCyz%|RieA|@
z2BqEjQBL#8|GANl_K&NT9TDJ9o>xl<MAw8zTJibGj8CjF*8OJ?{O^ts!1IzUcgMg4
zD<tseI6yD?j|ku-qi)&@D-DQGXG*dkMUH40t?O<(`|m0%kYHI3N9vt({S;ST>DTQ%
zvV|No>&X8;ty@OMxAAy6a7yz&%Y-5jug0}<qqTe@{`d?8S<)ni{-cDzsb0GA{I%g^
zbErhzu)S$Z`dcl*>Q%g?Pl<G<r|n4$pZn#eq4*~ujY%G@%h^%+=LdCFWXrpUr6OMp
zRt3!(rYkXI*-X<^%{CXtKSNC=;`{y<1i!6J>&M3o`akobD{EfKbuJtPo;p{px@aMF
zsFDet(ENIy!BQqzH9t5Ke3R<5x}V&5<fE4stsnPz-q><@>!@TD|M~j-(6Liup(JDO
zyd(csBL13}#A3E6jGVw_rmS6YB-B4M*veD8cYBR&+3>KN_NLK#9+`O&vEC~wV^Mov
z;a<JBn^q#O6#nqIG&ncMI?A%1ghrs^Fr1m`=DB=bN<e!bF8u-@LUTaiRw6v~DEj7N
zUF-0c@woGbq^xOc|1F!Qvbn^w@O;t5Rd$Z->*v^vI~+NS+SJC%i6>i`IkHORpB$pi
zf4gld+-a$(XiA)ywI1benn-}`JP!SRTbC$t9<jUryTH}S*R<4~$@};`sHm9O*M67l
zd7lN8*QBIo%!S+>8PoTL$TPnCZitBWS%1ie?W0W!;)M3AIp0(|uB=y%1M_})U^0T<
zXziDEE&Ze*MP7Mji~it^Jzph7iG`!;eP(>%Ab|Kh3zF{1$WXFi5?3A0<U9N6Fnr;)
zfL`Rpt8(U3nKAju^8)Y?(OXN#zd&>mVB$jICYf(z7NsVFji7>kuG4k?CeJK5I{GF_
zH`CVPLS>b&^i!-3oW@Fr+!!_?ii$c1>TgN!hwp(s`vxT1gqDo#HK$#hZ#p}Std`VB
zzc=oCpBk=Dmad;!9mx+G59B-#1&+~{X0cF{+x|?NwIYb;><1sQj}|TGuMBo@z7q7t
zC=$t5wn~33DWIkIFtVcWjX^m_Mi2WtU$+6thde^xtm!#)H1gz8&{em5FB&=tlZzm(
zi-EDI6CpG=vGz<xY}0YnJKno$GSfCK?2;cjwn_#1&v7A9j<8AO*8uN#I<5BFyVBG4
zhJ}{$#X~KJnzcLt#q~!5HolVaFnQ@3{WuHtaI~f@3Z#(#Jw7I1@h|_Ox^E8tm;D{v
zva+!+rXo4NA!rmOm10wW*or6Yix^;{z0!0VD8vA#W$j`$%hgvB)tN1mxqv|G7~`6h
zZP{$u;qkUm1v9tY9za;p?m9%aN&R*WcWjJj>Pe%3I5s}-G-Ya;5|9__=4hvGd!nG{
zz{YT~v-Qazb8|xekYocU_fPrL<WF--W{Ak6vmxZA@hm?J<>Y18_3H)lZECI@bplE*
zpP-3IU7`#Wh~1nEhoKPdfPTY($p|G|7Wg(+J18`&d?7Lpe@{MU7d>VhC?3>QRuQF=
zFfn{yYV#T`v?XJPoPuPgp&LmD@dTmTQ&R;>ck7v=T`iXe6M$JyJd~FZE``Gvo9ClL
zf3BgFb@KaHi7Sl#4GrXuWg1GOH9rlXoRiWS-tKpQy14}QC^_WsvMW(DE9O3%F=ZLl
z&dzTip#2C2>e7=jXg28^AfdumAkp`(%CP0q3Rdj}-#kJ^MIF+wnF$Uq{QNny%%5%x
zS_=_-;qLK86%B?6m+kcl2Xw(GU#y^3uJmi8M8J&uq(XGilkZ|YAreJkk7nZ=%#sD)
ztj2gw{>(>#F}$y**z`a=7ZQY7Dmb7A>5{1xSN~NAZVr)DpTyuxZixTh0j??9XZ4a`
z49M_eiix5}0c80`Pzv#SLjEAo#jhOKp(1=lvloTkuOn|qq7I2mO*oZtAO7?7rYgg|
z@r*&`4ZYUG#3w#!rh9nc7kgrKCB*=~A-TpkUxRuZj{hX~GJ+sK`oHhxCy8Q({O3n{
z@|v3cw|X@TVQ6rWbA*Cow>={8gT-|70xKO2&G8`$e_{69HOx8_$ZMiV%_0(oShNP5
zw-4lui>8Q<Swb%QskbU30upqg0dPbVRa8_oXV)9w4<vKxF1JeplJJV`3MB=JWrYJl
zoZ%U09`iwP=U5<qqumP_hwmA-%^I>`1iB#Z0H05Ajq3SIrHaK0czE!jO%CFCr!#mR
zK*IiS)wlX4_b1195m?H{VrKC6PZQ}8NI+TOr{eS%<3LiOhOG2o5J7RaZ*S|?-YRC-
zqii(R^p>1{O^SsF@jpiTe~RC$#WaNjfj0YRRA&l+`j*wz6&42LjQwVZzBHZYvDjRj
z3jqf58e|<g##=vZtbBgCuT0$fj^H&YpIt9gLK{b|GDYxDnQ`L-p9J}E->A{%AxO?<
z*STrHFmjxZer7PeXc+cyx&D*TUe{1M6`dOem7Bq?aMR#oZ>12*-m^V77f=$Tp`~mi
zcmn(TQQOcsxoe^KiuHo(T}}Haka#uThzk3jrleMC8ahkVs1^w=agWvMJlvB$i47M7
zGM3J5TQ_l0d5K_xpD@H@)cf)NK4X-(d67kFAd^2yf%>J7ORB5Xu0jJo*^cDAN2fb+
z0*NQJlp*WsxawW}KSv#j$UnL|*-D&$voNaFAhY!r;K4|;`I+gTEWIb9XJ1r6{Wtl)
zXY8*|%Qtk=j@viCv(Lt*nEtDjAkK7C1<mjhE>57JL8k*i$9RTxS9yQ9zprhy?*aB7
z8D2(%;HoNwp%D>4E8%bT7JdA`!lz)&VgIKLxyz?ECLQcyfCS5*^CbUALZJgyXH)KX
z;PzAop#>agY0z7%w)5eBUp>F^OR6w+y}tX_`fhw9+y}gmc>gQ?u<t!FP2!jKQw!q&
zvN@RQR#yj&e+uv4M4OO0XLTk&mvZ6X)+gy{fVu_lcZKfuZW16MKQTb7s$|LjJil>5
zETUH^*_C~JDkI5xZ&+P=$AejdAD&VZJROc)Z7s8PhJ%Z9%jm)zonGbBTA6rOsz}Y7
zHVDaki<Z}7ru_?XB!^OmkFSv`BTYK9g(nl073K*Zn;06P9+H(-thdzEcIIF|6-Kg_
zqq`lize-f=3_Epy=f>0wD_Q#`Q}cX+)*IvE+hpZ($7o?KF^1LKt7AEl*?y*{X0i9s
zS-Ih<;(4fTar+eav0yI8YW0=uxI$+*QZKODq)E2^rUyEc)Ce=-7kiVI$OgX9oJhH2
zk5xE&3*N9!IUJ_;^10_E%#V=i$L~g5f3n#iBuh`*6Yvsa%~WhJ#ur+bmar9{Hah)N
zzx-sQRpqhof?*vkQY#j^cKj8hBMJy4Ksqy8K3|Q+c%ySy@LY@y5RSkzRHNHIPc1y#
z#Y%X_$KKWU#Zu&=p<4Wcf}QZ|F6F-JOd{7*FjAp5f-ObuF@eHuoe+7(<L%mL#Mf5x
zB^!F}vh_Du!Cb@7j@QJxTc*P%_WQsAqpA5V4_<Pks2{4VZ?k(sI?lHlELoK%o$?VG
z6bKW9R^;w07u^MOyyD~UO_0{)3V}0*?%{|aT4y*y+fy29yhyD<qnVj%ylVI5+nGEM
zM*$*s`Zur&%}$sbmhy%_m8HpoA&=izm;V^AOk}m|1=<=T3C&fY4KF;$TdLIbP1=Ds
z7Rs{BFd4J27$|mm5lq*9wtO>Nequ7vF|)GT{{m)=@ip`+Tqrd~4UG%#y$}8=LbJZe
z*0ynzaQysw&-UI-lm0X8{FVh8?w9}1@NyHznezH4>ZNy8a`bKRCTepcfb4wrA=9KD
zS9pG7BD^Lu7tXS&C{Ab&U)K?q2b)Y7irN;McZ|h?p<!VPPF(DTNL-PzhTmB2ls@tG
z;qFGMcl6Kn3wEyTnW4D{`FBl2h4Q37Nr$XcRejQ5j+A4JmN&C`E3xqJoJkKb))~ta
zb~&?#8n$XamX@TsRtD4bNw`kpNQK+7eSRI!iXPZ$*LRdUPzfhzf5h0>Pe5<L{#jY`
zRJo3kti(0v9<^FP#9^jfoJ{+&Qm5v+u-<4~5kQtb-FZsGA~a`vidFmt_<~CGy&K}N
z#ML<!wU_x)S=Zm~b=D%67JvqvY^jGV%@IsfD}1({kt~Hxds=t2|4N%oE!ta$CNy`(
zY2P|q{+la}zI7>ALr38>I$o0d31}RzWDgxzZUrv`)ml`IHN|}T#v=p!1}RErJ6NPS
z)fM(EoW6cvN<QV9lFd6(xUzEkLUE7XDgjms-VqwV8Y_aLeu<b*DyMIZ>dW=XvMp4z
zrXKU->t=Y{SOxYD)1h~G@6p+M02%L<+fT9wKyBIuTN7z~^w}g!$(pZ1%yBx_ji0cX
zdD(Ks{V%Z;j92!`XeO)lhkUut#8gYSY=X8ILTshhC){Xwm+G#VAY*U-w`)_Zv*#2D
zY9`qq#`j2+2@Qx~qjTzNy{R=}u3#us$AFJDMN???xC;-6r(A7`SBesvt3xgI(8SJ<
zq8(`sRe+FuIvq7;7K@h4{#c!gSu5m}$ECJ{nGn>16-fl})~sy5oM0pJw4VQ=tz@1k
zGbyk3hyWNcO-9##ln56f-kITMpcSLvn(B^~)sm!JqGpII&zL4SBE6X7gww@0JJOYu
zF_$QrSj<dT%Las=98t^R90Zg|_SBMd<kXPcZquqQSSrnj_t>%Ey9cB6oZvml;)FXt
zE%@uG=CdG81}q~xG15|<cYiWb7}!!(yR$Q$4Xtk}Jd7?h>Evl)SC+-D5lUDVi%z{<
zRP>9&lR7riGg7gg^tY5%G*Bq-8E7C_KWvwsUlaUM5?-RHD)-3Yzyw<vy!Ure$m;h9
zoGkKAbf*QM?@&YfH$^3-7vt~=LUBc8S(nd7GMT_VsR;W(3Qpe;&2+Q^qo{ZXKDAsY
zXNPfEsU%k8Ur>t1Kho9<<}&^wP}`rnb_O#I{rx~eP=AC_<2l4H$bl+8v$4ViZ6XhJ
z`B^h1LPZd-&hG;UKUZyS!<Btqd0m4n%ftvvur_ma3uC@5bB5L`>GXtm9aDz5nV6Y{
z{CtDQib{Ff{Ew^txPb{-y@N&5da<zOjx8S3G;Fho<&1&`D}zs@0!84p<=U8&#a43a
zy=G}D<`LNEIRmLf-B`t0%gQq9nL!$Y)uwvRe)6A(wdARx3mX(jitqGsdS=vA8(G@!
zczn%mrsth`pylzLpg4?|t$mamoSZGVeVOl=C2=OQs7sMXe_~hezvunm!%mlL`5boB
zu@jai46uTN|D*tmR9nRVH530$<Rvtg&WdP#`gm03{as^)Sq0<2kH25XCQnS{8!a<C
zIIUqyC29V5RHbh-eetB#9=8R77?cbQG>vzhbDR2}HJ#?^ve(lXbowr~@bDlHMH(I&
zhMdiK^~Cv}Wx^#{<oQ8$lHa~{dlwZw_4ni90Y*TZMj6!{9v(O-Ye&&IbEZw-LS^nk
z6tETsm>rP{H6AOa*9=}OxXhO8j3zT+h@b=K8zCU*nYg&P%+#G@y$(W4OG|TeN!|^K
zF7q^-^4jla8};CzpV<0jawW8(uwt!^&kiY7Yb$_7Gv&=`wyZF@w$={V8F&G8bjI~a
zmK(hxXZi`&Amh&frOKC6gsVG`)B1(we5xr?7ZsPR`G(jVVC&6`pXLowAmiN5nAqBy
znz4CJ_la5Xf(~$yJwvIfQ6ROPS++v`b&A6Z<a_ygVTc__0lop&{P*?WM4%}h4GoRQ
zyQ7)kvR)CpgoCm!G!AJ1C`R1(9@hD6wZnZS%|t%M0!?6Oem+6K<Sp6&u*^kD=Smc)
zjWkxyOlAsY%jASZ;C<b-$v8oPP0zm!7;l_3=%IUm{w%)>%|@R_Y1y#F!w|=i^5nA<
z{J?(<2L}i2fSAnHZ|`|3Fo6n^i4@3IQBl!Wnp~jHK^|e@3o+=hbm!tk0qPkMu%Up9
zJ+H!g=X+hGLrF|RgP4a?<X%?KP=LzF%8+zfTI@+p1$Un>{K;guurHM=^z6<A7yyQ6
z|JRV5I#N+mYBCmsW_LRBsu<rOdsn0P<H9F6labp4j#dhI6FpK=9`e8UK_KpOowelm
zw}QOxKIHzdK^QR``R&Oq4O!W`=G}}3O@XEh{`<`Pbt<TNreF>46vB;R4fkYh74Xyk
zJuXfZa{rhrti6xEAY-=upDQ<X$ajg~I!Y(BUWj;B#x(!OaheQ*tYJ{sLV$uG(zmd%
zXut;pZJNX-CMG5TRP?Bkr}-P7N;FbpqDZNY{zf2O>gm+`s|lo~MbVO}@)GU1AKp3y
zm-#g@W7#5M@<j+2a(ifrZ3XXu`{U974F{nkG@kZ}^jk!yjchp%a&dn8H+x;;g~E~e
zj*ix%uwA1OV)>5tFo-23B_c8A+2E1~8=i0OJ_CvoH<?Rdp^fw|A)w4D@k~}hk%Uh;
z?hwJo9T4QzX4eINhkf3fHq9`d;`i5Z#p4C0Xg%`KB$1;kpPhFGc|?Wt1b*F3b=$iJ
zxlO^Rvy$ccFu_txz)xF=!NN`a8Q+oCWVX^@GkZFrl5=u*g9_Jbq3n7{u9Md9_h=E_
zY~>6K|3DFwAJ!$~A)QMh95hL$@#P?bpqHi{HPb$E_irGS8`gnJ@QRUio|uf&>)&XN
zXV{vHe?QObU^u^xnCWKw@UUnySr=0%yUYIrh`#dR&*v=QGyR=!L>0NxudZyb1MU=l
zKGqfE`5uf5vGwK9!hZEGC-^QlQuD)KByn*h<`WUXn=h}}9j?ykXMOK|LV;!aXiI1}
zdG<_9d&a8k@_>Xl_?>ZUuhb{$)X!IZkv6t%Yp0Gz{J}<9EO82r>6iL2gDF}LO>ttV
zuw<kA)w-J87oN}Y{0OS7280nc{uD_4Ovc{d-D(i73;M$US~>M?*%24S=Hx;<32q2!
z?DpPovy7B~>gnAG5HyNjbpjvgU3qu14!P^l@bJ7N$RJg_)+<2VMgozq1`QqN=H}V~
zyr9ho9h0T$4Kh@?{Fas!Qc-nvb&*uZFYHEyk^X&*HuF4anH8fa!{=~hkJ0`2f^1j8
zAWbS&+KCb2q4~9iSe?JlH7eAK!~ry^>pvkxL<JJ)Ny=1D&YWvWm|^|%s>Z6DrOeLa
zm9-HP;M<SL?KO>!&5_!RTkG?PwWu5Qt5oezfGu|Vskk~}xb!}^JR~+hpViaROgp-_
zv9cbO8P^z@VNIe_3Q_^w<`T&(uH2}uU4vf_GU_ttqiS{!F_RbC_B!n0h)rmrghtSQ
z<Wlc#e}>j2T~*x(H_XjhOu0u8_)(oUMeJ+NMfJK<m_+-DD8bEBIqA=Pd$vc9*ROBL
ze=yqD)A43-yDrax0Xfg(E1ELx`l%BLm9h}2!+{RNXlXh3Ht3>Q1)Z(%Bk}1+CqH4t
zc({MfQw*{cf%UWI6r#*i)#cy-4Wh(^GTAD?05yGBA`KH$6I#u6KbW^VZ!~UwHgpt<
zA$4sxza|bt!l#Ctj=^B{Roa%3XfNPbSB!fqG>((xy7*#~qk0I!PW$Hug9v&LEtFb2
z<ylCRQ>~o_+Rkbwj82@Me4;$E4_x~d+)4vlRY4B7+GC2U7KOP+<tpsq%8jqo(diex
z$WNavDgR{Ro}Vh>>|fx_e~<~0#$7~nq5Ym+&e4<R@=SG3pS-P}%1efJB<ys?ZLg$}
z3Y&L5Fs@cjSV!)q6kU@?;FKu?S+T^OXvOe1<_wL!PWhKcMV&;ccq(<i&+P0?DzRv@
zZ)>CHg$S?k0(-KPqme$8+cf)vo6oL9wMMAj^LL}joh?*3TW;d*!##T}??EfIlpbqj
z%?4*u_?b^JrJ|x3j6d#0q1o{HNaHpzDlLpA4d%o4X4<V4zC^5`(c!R%M;hd7po+x>
zZ4GDgI-nMQkrv%GBrSyVTawFxU%0>By!2hd%-_#P$A^uafeNUym6!K7ShrJ_*q`Uk
z`D;5HO?ywJ^GFf2^c9mm27MHkuJH?*nAn6M0lJ-`IqcRl(GuMj&kv(5xCeKCp->sk
z<+!%=iyhgIxfGgG)-SFzD;L}EQ)rtU0@VPWq_C^0r~+cD1H^^yu;QodnLal|`tw76
zAOW*iGY`z~HfIgo=ug=q5%#f{{=`@{d*PX=BEq{o*-2Bxd1P>wqOgAKFYWeJB67Bj
z=0_Aya+a}a-MIqfVOMq}{Rek+>K~(tnJ~Ti^>L9l676flwuW~&^@Jd}L{&#7=o|8f
zP>i-)5Nq9!)RvNYbfPixNYe)iFgV=@>a-nIT~`~B*#<&z2IxOiJvH{P_Cp8-287)h
z$iiGEYl^es&l+)vE-hK{Z6sKK|8|c6lY#PyJ1Lw*;P1+QxJ}P;QXE#a8HRtq0j06V
zYf}oGN;QMY<R9r=M*B(G=&Q9F1GkBgk1O<)q@+QEHHt9OLcg$+b0(`B!iGZler1n2
z4bbwI0#v<gh2{~j2J)2f-+wqh5BS^hg?}1~^7R$NtkvtCK81bsZof*U8XgvnR&T(g
zv)+8Lw#YNmb3Eg<iTn}t!;!WHG1&TSN(T(!9PQA6QcC;SY`WibQ7ab?(VKvpvDj!S
z=^XMUmKH#;r3r2#v3!jZ?3wM9+i|pdWvvg}+Zp|~?N@Z+Ui=uwM8#2Su?1a9@)i?=
z#2$@>(_wnsh+%(Z7{6;<vw1bVcHA(a@#O~s=g(B8xlc#J$c798hLI)eh4CZW>{*Qd
z8oA|f=><Xr6WU>Jp0=L2CTP>Cx-mR)=Yqmyj4m%vK5-cwD0KGl_{)eo=J<`bm9b#P
zo_P`|81?j5ji|v}H$k>0BUVqux!aH~0VKsRHn!%wuf8@WH59m7`KTG}b@ZH4gvS!{
zUjZ|P3>_7ori{ds^YP#LCI$jCxjp$9Hh^I4+R5VVcR}ZY2ov0%li0}Es+BmyfR{IJ
z969P*+$TL16`KTh0-^?KFFtYGn=*ddHsP=w_0byJJecY>s6PSJ=vomGyfojPyJCVS
z*XI!h72tB&Dk9oas?J5SHe$S5w!-pyi*BD1Bc~}o4ZA_5Q#0l?m`Ah*s^ltLsAY{Z
zQ|I;ILJFK5;q;(C9YRU1>ro~A$kP&U`9&Xhta{JSZQXl+?CT)E89e1nqkQ)HXDHV%
z7X9xiUpiClRRb=%Lmkai27V*b$EUB<Y450RL3$g1iVTe1-f0QmY8Pm<(n8I`K`U*-
ztiFkL-n#s|Tiuqmo#Z~4Uvyp<bQ=16LqcdkrJiUd!u~XvEc(6h-oi$lf-X9iI%@iX
zpv|=9_Op;twf$%Yx%tblMEi@D?*xCCO8u<gYVw7p3ihGwTmj!xMdz6Je5OjZ<p6)T
z48`Kp$f$^)^~7<mbFj_Pmze`P-2UlsD70skkIFr7<_k3-&9s`>V~i7EnpJc*JkBsg
zRH-V^@<$bbmyGOkPqbWSOjfr$*&$R%C09lv75HJ=_ekK^k@<rjsVv;!V0w>Y;%CN-
zD@?9RTD-6$Vp^+-O>dLJn#lTJ-{GK6&Ny`~WB*#?7S+di7#$cBv_xcKtpOjt)Dj$J
zan!sG>SNBSOyQ3M!F#r70?wz*Z->VfvC0>_eB@ODZVoIfN~$2t=@EJY9!kO{R)_#w
zZnF)4eM{5XGhbc0{lLp#M%Kp-L$PTbO*H$g6Iwi`SDzhjYfb{7f&S_J*u<)mD}AK7
zF1X+6TWvGiuNdc9X0E)E{nIJ<U@$qCMH05R*Z)n#QJhjX+P0cO*k1*oJMxUXa~*R8
z!*E#S%KI<?m56g8Qd}5@$}&HH6y*;Nqno)VQushBH%pRl)NTo3p-#E@{8Tg;?Mxdc
zQN)w0{0(Bv>z^Dt@$WZOQhr+qZhlc3F?2*XOowg(=8JglyZ4&4Z3z2q$oPB83&iVu
z`gfG*0&qG7e*Bnb0*l3Qaq=6p`w}0CEv(UfeWEnjW~((^RSAhdPGoXQW-^tVoW`4s
zD$%RAGy5Iz@8`ji!q{jb;>z%uwXJw%^U~&hf~%-!9g!gWsFC=!?PV=Bb)u4taa)gG
zJ&-m-o(~(%$)MII@3*ljz6VKR7>nutU+;Q)qorI%!~t!G--?PMe$D#y_=(w>yHec{
z2|}5VqKQmoXfb9~q6>K+0%mL^79!e8J$_UrM8WmzZ$vHSn$_~<wS-M=hgq@<!9)&_
z#y^gw{Cpej#>GT}DHaJ=N;L0x&X$J&R;Y?JT=x?{JZvU2L1D+q;kG#1@f$EUtKF-&
zqkoQ<xY|fBklv5+SMAY-u4rtfiS>?#OP0I;1T<$($}Ztfz6|n@R9FyDJv{|kdfIFD
znO15`h&C@vlITJH03w2bkwToblHhy!8~O13S|b5MIMjRn8xN0w)<-};f#n9E*IDaY
zE?}{4sKlUAipeCSj%$VM|B!=x>o{l=cF-@hkjGYI(5=b%<3kVB)1Lx`*nDLD4+89=
z;|z-xcr$onsEn!{0!a0UJFMjC#rj4bDw%Nw{6Q=?;hO>3p-pZVak8R1Mv!jk(%b_M
zPI}eNZCPK5z`~s@Yz<mj&C7mtV_6~~3^T(CCZivX2Cs(gcFI96__5XW!MSt(D19o9
z8a0bhEyG6&`1TYIKQ|{EWMBY8WHY-REjvIo8oEo$h$m#4B|$Au7?5gKo67q!=f;dN
zKpIp@R4JA~jhaUnDmXZ#YcuZ-y^e6-f+i5`qb@hiF{PQfPIgt(w^zn5Eu;y`Bc{3i
zp(`eoa4}#3X%f0a>do!Ta~MQhViGtyL&oh;yjZ~thDejVj<)_i4NC(m*@^YL1a%Fo
zq~y9jCW#q%DGjlo0M#%YewX=;y}?^(M54739kv+TFCWyftuPXS*DPEj2}~zK?+aCC
zH_XyI!OyVplqXT^2v9kCc`84Ji0O#_-WH;YT^P-*vJ68TG^}Fr=;+8#ePckkBE-@B
zEN&$hWMkf9iQ9NnpzxNDY{MpAf}nG>p7CfE6IHkXGV+ZT5U19cb3yYxy-UIwWQin2
zh4i=mVP#m#*<QGcSh*L-cWDXC3&|9g)TB7e<ad^9xy|<EYz1^w4ddJfCbdHv8kxXm
z3V`gT2%fG{1Xdt>{#nf8fAXp;MhZVY@TMRQW%N_6!NuxvchSHl8msT*f)5r{6(IVe
zMA(NjWM?rN_a{LaTv4AipJ+8)aDVg@@jc>cW5{_~C&W&edS|DW^_5n!(Ik1k78-nI
z0Xc5Ootx21z!KQa{Htrj?|R&q+lHY~M*Y$42Ukc*M8ln$&rdu37M^%0Imk#@rzUB2
z+Ba6ZLuEuY;3jn<dXIf*J{M@m^w;z5Y=T5e+9&H}0s23hB?wW7&NT2LK4SRYqqr$p
zwY^r9;WmHg!yi;)E9Id%20P>JlJumf;=pS7(~7Y0d**w>nA*5OZ4{;L(I1617<o<I
zIJ_dWKn2V^88ei7KiwF#A-jPfW>IfCtIM+sawUAiJ~qqIR##`16tOatzCOd|w))_W
zwIbet87xdu$~d^oz03&oD??9IjVCb^v>Y5j!uD^p-Z)xev4FBB2^*fRK|4~<qdJh<
zQm_Q9u5_Tk<hQ|Yb_f?*(uB2<mcs2B8$X3lTXa|g>}v@!s3Dd^K_Jcwg8Fjx`K82s
zzQnqa8(`tlLlWhWQ%0@9bzw)Rv+HSx-ER9|MR*d+n~dgPP1`4#R7d`0svAOMtXT3E
zbvXDfSWmskzeShoA#T4K{k(W<f9w9C<<8is>DWtho*o_+7SXEGx`p3vwfT1`)DU{!
zy@qG}U0t;KuZvvm-h2v8w&IiTK6l#t&|QH!!`|j?xxF-7HcnqXJ~-La0+S<Yzde^$
zKk|HERtW6bbZyle#$t<!g*zkeD_{GPxxTWHo)KlcbAn|?C1AeJ|H8t$zZmaNk{2bq
zN8MMVHK^be<XWSGRDLsn-E2B4x8XCicN{@+^89<jJ>T+j#y0tHMA>W#9<$rrUyjir
zjc5iY7E@{S$LydY@27-?(;oUsdgH}LP4S`YJyL<NvoDzbsF}}He{#ZDTwfyM9ZHMW
zBP5r#7D`!szYWTCXxv$0{XeSSGAxcR*cK*&1b3G}aEIVF0fM``y9aj(?(Q1gA-KD{
zLvV-S?l62!-gCZtZ~uYt^z?N0-es$*R^iHKNuUqBVAGY^?aL6!REB8iZDVq{OMk2J
z6HfcN2_Hz1VoN9Z$d;s$^@BEv{AAtH7e<xOh*Ar$l2|OFL{A4`B6rYaGq{H03lhkK
z!^0#kZ#w&V9tdxr)m!n&FMfZ8w$m-j;OGiVT<<wXk;Qx_F#l1JnTp$)nQEcSnGJej
zzCQPL6=f?Bow`J(&+VL}zDQCqHZO2?wl9aQcj(iBdga9z*JOcYGW!i_v)UrF$0@%g
z0s*#Jsay7)$%xHg3F6k|E5R5ysi;itDq0u`-zlk&4!8TN1+gQ#ej!7WbZvsRKV=Ek
z=$H@-d~TJf7Iv+pf<x-8`B~%XGJa7lP}LZHeH0eM$_|)ro_rnQ9a}Ty$n@)OrU=RS
zFM`3RySdy{wW09@Bl84tB(PyvJ0tx&YDpid<nXLTRZdj38rEP0@;LZ-!amz#E{tRt
zF(1#ku=C{W9;vj%UZSkA>lR_9{Y2@u|MZDlSwf<_VPbR6TQUE5J@AKh=U>@C<<yvT
zV!j#+Go~h!D@l6o7Ch}(_$l5G&yDb;Xxi=67~pzW1FZf?XBTV%L#N}yQm0SxtXk(!
zn??;EeV2=;j`Dj8f_Hy9yjZ&&MM|KI-@<J*eKr$Lm33j>Qh@cGu=6U_QF{mRZH6|Q
ztZ!=w+*&!EQzCAtr)H)1X-EM=o8(p*T?b0LB;MKKGjM*NrzTbpf;06fJb6dwdXl90
zLoMDjsdZ@a3BXs_*uW1le{6!Oa^Z10A>(Pw>L7y4Uj8IkcnC#76<{k83%D9k&@Q#D
znq(HUTLHwHxM3jo#hpx1C*%F`?^Gek58uwWQ+G!&%RwF)-(Y&&FW(D8UAgPQBw(yC
zl*+IVe>7p(ohL+LN6Q%>M%I5q*xOKV`mXtnB)rRbVceL)h)QHT;3lfp014s80CJ2S
zsj{r5M#-RLFeowAK~6F7nD_Yu2h0$CZ&tAd5e8iM`fkT~R^1i#)bNqWHY9>k+ya1|
zc&W%IO2$w~a@AUGmZ{+}FdKU}dw4Lw+wWa!if&f@MO!fR7og_Aujk`QU@}{5?Q+PA
zG1_6l-4I*B5JwT|`23z^x0=M4G_Si9r(4sPHVy+lPPCL?eHEgr@wd`C`Cx4_!gO@t
ziRq1jgzE=f`KlZ|=FyCSeyZT9<qW@G3dDiJeQNXuNT$tF&@*v@!`?>xk|9l{-oeN3
z#uWHGg_|8{!xo1Np;M~xq!N#|I>HT;O=!56C5GCGzp-bc9Q%H7t^PzOTE>W*NCR6l
z0x@N~Y@Q+f`PR32bO+MZ78@J<;_uxptlk+TXNQT7x3Jh;$pZra!tKNMp25=Mp&8E)
z{F+gV&XS>)t~Kq84NqZ87JLX#2SG|6CV8T3Se|P0lguFqT7;hT#KzveC4pzC*OE>>
zrJMwpD0YN(#uk49F~Tqz)avwxD7i=iyfen+aCwlCR?c54PO|7VYKT2vBb#_MzP|-N
zN^(~?avgZuE`I`}RIKjF-Cm)z;IKZD<m|<rOFGnkQ=8d7J?mlfX!UxMscJE~LXOQ0
zmOxE9%8d77Z}po((J52E>Kp$8vVqqlUR(r?uUHr<nE+m!G!}d4I!jB}YtWI`u_Nf7
z=GDwW)ftby^<+bGD4eFlEt#@i%PjKSu9-V1lX<qZlpv1Xqn`qr`8uoh@Ys)LZ8<fE
zMFPf3NzK7>EWOTKJhd`=e5K~TZH!9DQLj`;B(a0j?!J)<j-5!1#{3ZFA;e-`!(*f1
zG36tz%<|JZvW}C=d}j=tx2Su&wj|(3GNe>jSLfyB1qTOfG*}-vC7X#kIywRwl5D}C
zoZMVESXclu9mUwY8eGYhN@|;a9r?Vjv|kC1&a~RA&<J$AyR;YF()35p;Qnp>o4DWZ
zPCvJFE7jt*T^r$vfD<W$)gqqpxNIXx2oCb6HmzcEOlqb~PA0MaO-oTj=XAfYP8X-{
zZLArNg@FQzbH?8WGdl)w{M3anhwXK>S+U;-4|gV(Cf__f((2uZ8w1^<(?hKk+*@nY
zGH)NOib2uwXfqUxm9imij-1b!VLzh<TqrF|*=Cc-M>yi5<MY$1OOShsq-?W#_N86C
zAM@v?)Gla1$d@`dMry+!3+2gRwj<yW^z}F_9#=wq9S1&cp2<kyvc*T_;UxL9o<wD`
zy6RfsVac8QxTdkml8|icv(typB~@u>w7hi8m^*9bT#$F*QUAdvYNut@bf)mu{u7GB
zT8Z({Y3f5^D?>?tq}=kGs(Sany*rW<zvV(5n4vPx`_*G0YS-$;s;4)uSy?-)#iegF
z`2?ClCuaOF@kp#*-HEB8T7U5$c&e?xCVd7g(Ti~(vk2Gfj=L*T*UR>c7V$7;?z)a*
z%e!udl)sBl;D;t5X*YHi9;kflK*Nx?rI<*uPF6_>3xGtwLw-?J3Gd1wCKdEj*gupP
z-SIo7O`&ramidDS>p&U4x!Kb-?VocbFBBbd-Rz}i!q&1^Lr*LOU=JT}n`zKdV6HB9
z9ea>TuJHz{gvZk5?^1kjU^DqP4Trt-9{Xs8WLG!bn{CcZrOE>(gST(7&jN!s5hLqi
zPy$Gbea|EpG8V$_@Y5{>O(rh_S!Doelu&imBp;1O=5H_iq*q9e?WE9xmnqPIN2nGX
zLqZx&XLDJ*(R}fn!)Cf0!GXzckEtwp5BL-Z6}o1e)amk8^*E4sL5G9e8SWvsa;~nf
zGPO4J_rfj-5Zjy+?9IyJo8>7%Ts@r~TYX%FDoO0EaDBZhBhCua!JpBxqkWF6vrmw|
z;HIdKkxxx@rT7*xX<w@@W)!lsmmnD_9D!VyLS4JI_HLAZw)qIJ<S5#Cftd(%AOFeg
zgqii~+PM8<Cc7E_lBk=7x}27){>O^)UW3%EH~isoqm_nC4rB`&)apw8XOHb)C?flJ
zHuOIL3ERMtFP+Qsyj^7Ic+QzJB_Sa}B;@%E>Lsc%yA}ACZFzmUo0$QM{j{~Up%L-_
zuC_D;^ht1if+9ay=;Gudgxei97tx*T=Fo25eMR2e95Z0q5o8)~oZ~i4&v-JBugIM9
zJc_Uv8CP%pk(za7ps7CtJ)zFV3d}d*-#NX1ry~iM++bF-+U_}^K&CPwUU6t~FRjyT
zX{Q5kc4MXx&hDD%?j)(Hu2q=3U!nRdD>mw?fL@(;9m7#Lz1CYJ)_SaKWA{h|t!iEP
z(=?<S<QWhHt-I=+=o7pl&|h{Nt%no<pEUk1Nph;t?ckXV1*I&58z~DzTXd4aK>9AL
z#ci`lS($CF#sHe(6Oy**pdA?`+2B+_j}cA*B$M)Fbrw`$Xr3KHH+I`9XKl08v3sC!
zZxAk+{5kP^RtYF)!wc><Lu2v>yZ6v|_E)26O-?)8{X=al@L<zp3+__Y_V`i)<H&hF
zqPjO}QM;5|r!Qc)KH0~!!L$3lm{2yZ%llQJ#A*dcwvA-eJDS#@Ikp5@%D^zu8B4)%
zD`yRKxnA8CjDB^Y;;;$Ia%)L}ddEl<-gjjuBoLyi`gy=6*l2J*X~0O=fv}Q2(M~Hl
zfkH%}>OJx4w^d(Mb$MbMK^TKZCir&zZq1gK$(ZOy28Ov`OZIE^rz6CIW5<C(O^|_+
z(&8ZUa4_ZdcLr?+6)fx5?A!rJ+_6*d%hmIEX3n3o4gK6wQ?6Zc4lOI@7zZ*nc!U5B
zovWUNYPI>8Gvt09FgM2<Rq1s*;#@4`Eu7Kd%FgTohQSpelwkid<S*nNwI8n5J-=E>
z-J0ogD2`}%gM_=e{@W);KGuVeOra!?x$PnMArlI&t~88UVZ2bRjOYH#GcQgZl|UVf
z!e=`E;KS*GxB%FiGxQw#%(V|@!$&CrEH*Z5b?u9z`1vE>Y{-=s<b}72CFEykypK)2
z3-qe1s!8{sQM$%Zu{x&sD}R_O*F{N<#FrooC`R$GYT>dO_HnKWa>6`tuZByF#`7p%
znK|-fXic;#<p{$tJt1vv%sx^?d(ySYDqYIRg~(^5co0sN6-j%xwyhQ&K95Rrj<tXa
z*(fxMN82+a{;b`|%)~QyAiGMYadc<R&1GHLhvEvS`OeQ~UNczezlS(K)@*S)+34~!
zuUlGN<OG4dfkONJi7aPZ0I6jzCT_4?v^$t46A>8*4Gq1%zW)37Zvu_VmWv4D^YkCi
zbp6})9~=G;ErGRW1h5$$TzlQ-+xjcsi!t#=QoIlbZCv(OrC*2iixoq#g*Cq7nG8E1
z{l&nw<*KzUY+U#C#KN`nwFI|HJ-Y@gisnDqMX-j=EW7A^!!zF43Yan84~1nxtl-6S
z7Qf2?AG9BgV8pJx7dYA&Hae>Q*e<fhR3x|^se{YsMNB-BWM)dvt!&`Xfpc^xqg6hb
zggH18{b8gH>*&HMzF?zFn@9Ppv%Ujc)VNprUaDD8{}!TYMO=Ni`{lEGg&e&UR&4v(
zD8VY)H2FrKf6IegQ=fRA8V<WvH2@?#j&LnAxoBHDNI7j6h{n+g2D9qwy3<lltysHY
zhjlnC#B7R*dFPX7pyjQj73csA{lVO>yN`WeG-TAAj^856$zlxSPo%eNS8a!Zip)@u
zuFK>FCe$<*VD&hyN9+C+)TL67aX$hYWyHth4RF4osc2?3o5OG<{%x}DTI%TU3FisE
z^W`Li<mOM8G4{q~QrS?E7Zoc{4+FCYC><Uc!`UQtJI_(eh~O_xaega*kj~<N^KcyN
z5uF|oIUEg!3N4rn5Il4$BvFj<G`dWqye4n2Nh&&6uI@lWC-CJ$=Mb@1ynuT^`fT?L
z<R(fDw;iv6EBz+^(2o~!kfTUQL`%rM--pvdcb2^5a-|8=_$hZuN!~9$2C1VgD^0cX
zRQHY=y$Ps!^uz52Uti82&QY4NvPF?Gz!@7qn<-001tOMG*8{|}5mRffN^$U|q>rm#
z_ge8@M?CIQ3lhA~Tx_hDu6smy(^l8whH?6xA32@QZ0PAPri299BprgX3w~kL9ms$6
zFab)VQxsKHyzf?>fw_3O!VycgW(uOBgR8(WOzk!<<56sjBl5jEpq4y79vv94X|-I>
z>v8|1ClG;&iRr7!_%Sf)PQ+iQba=Qq`Y>5ZQy*MGZ1q^nXu`J8)V7>g(?pktMTOm_
z@`5-`e*71I!uYK02*TuMtA5r?hQ7^YS>N;LV$}e{>g*Ih#5wKM$_vlIr~U6q6EUbt
zFV*9XrPgttdc$H5R;Zlr4~I#P1-g$B+dB`Jfe{DDYSAi1--6d7Hce;5ZKO^EMKHsJ
zT#bUevg$|-=j8>+F+VZ%f`5o2-wCo*zCLbP*F|{(dd`#<DzcYMKExNkXe2DQ$>a-C
zUVPR2g3%4oKd53dr8q%ITxo$H|Ec*sO)6YkL9_hjZ`5q@JlgDb_w#9$+!Rr|ke9P~
zhVIwo`zuQdIq~Y1*V2wi`V$$U%UXst4HSFf?yR9~@z?NR(ao|D?&m5HLUGOAv&rQx
z5e1YNPVX<b_J*sS(VX7hFY9CY_V<rT{G&^2MK;og{X`PzW0&}%Lf^*^;uh1{JFW|e
z9fgm7N@yh#fSQ`wBwF-k4n1CFS9_=vg#JckO?ZDTN5a4$t3c4IJvs07F<Pr7CIWk0
z3i{8cpePt?n)fI)=u5A-IgkhxQQB_$M<5(X-u6~TN?O{*^3B<7;Z>XwamRgKUQG*)
zUknKmk6JWPAN6N`p^!elGWgRiw07oce}7dhWoXwG29)g;yp<*U2oDbr(`&aD&6xv)
zJ4+qjuT=&EgnS<Nli7klfBt-|HFI=)(RGINmt9JzeY!iVQ7v20b|35R)}P4a1t@Y*
zL-Gt}3J758{SQegVa_&p**lYt!n^)bKzw`pwXyQ^6r02!E8t^}eVaw0?zH>m%0X}=
zF>)#L>8VCT*;nlr+m%H>k;(;YG?6ulP)_>q!KZg6Dl}>1?0~U~!MHl8-i2E@7N?p=
zP`SI_jY23ph@p%Jng5A72yyP|X@0nL<&giht*>CTTZa%l-rt)pAvH`=Mt4!TgaBmj
zf!LrlaD{Nj`}X*oR(0&~r&MGgyNVsk7%BF82_vVinBHR&R{eYL+x@;Q6T2c9D*KNq
z<}x-7u@=QtL&awDp>TDSbSIIU$`Wj}HeMjVs+3x=0eMxvclxN@m%LWj<JwvKX$~Z6
z0mXHsZ3eP3LjBy<xD*#=DS3H$Qo1s$!O%Tk*ZE$)=Fchb4Bl&zn!Tc@np|>^xlezu
z-!arj{2Be61sbQ}?Z4C*_AjwV^mqnGa$DN4=h5=B-NIlP5k7q_|GRk1_m=fz5us1A
zV8O*7c)9@!4Gq4UO_So`r5!C)f;{dSX=p5#>#gD_WC+=<SE`LhV&md=?H>BVutr8k
zbUYoC<Koc#x^$~l0lJ{!kr8(@_CVjMf(*!UcX!W^w85W%GX3OIiU|TV7%~4J&g<=t
zrE`pp?QK=)kRgC;*kds3sp5w;YlBY_4mP#!KWev>%ybm{OpMHHdRmrUUY_=*==rj@
z+vIa=Q0K=+Hy)lYRg;g;NPnVcxAXB}!PgB~yX2aTiKCpNrZ2MWTcdh^UKWnAC07ea
zc7HZpC71h<rO(a-l%Vt$u|SO_QhF5e*GVX-n8U(JSmJ1<mqky*E-o#z9GCkq%hJF}
zP@~jM)SjOu=z%QpPcMif(t;YWfIZY{U(PD=QoNMS^gMpD@@<wR8S`81`^)7w?LtGb
zVlbLU=pKbXl0G2!lA^l9>Mm)s`r^OyXFh6Pm|VP!0}QYV<q9K&$Z1ftN~~JpY2X(V
zn$0HcHT}wV3(q`k13gCJU1=$X43T}<kJ4?3W~Jl0TCKktonx|vGxer*ao-N*&1``p
zTy9o-XzF;y#&&{DwUwyw*xjk)ZP{}K@FbvoPEAeC$S6NIH@B{?E+9Y%7$Lv}A2(zO
zDBf20J8Lnq5b^wyiVA6IY4FX04lrZj>hhABn!2^sMUi?AkkhHDs*)0M`Xm))WqpQS
zO1`&_h|UqXqtiZn!ESe$qrR&mon<tGCiki-C8nI;Z9F&#uWa&vpYu^rcyCXhSoxF7
zmN~`~$Fg3)TL&JAs|F6{wRmgCH))n6cLY+H3-!Qu<5YX>I%xMuKgu-VW$xF~abw5C
zOxa>VerkYZjXJ>Nu({1S_<6lVal_KG2_R{OyIY%LaTEo?@%)00GqCZmq&if3?Fald
z0!662@q6gJ0_mylv(?=4jw&{Yk+ajIlKFRsIy26>Iioa%NFH^z%XiOJ>oR#wu6AzJ
zCPeqUS}(1RIifjvb}Q=A$nu<BHg0E+7g1N4hgaffuaWZ%cGM3ixpgL*$^;!>Jz?U+
z4FjbzJet8M2}op|i^Jkb=2HIRA&LjR#@s1K=7CF35n^8JLiiHbiiMOfiBNU%tV*C(
z8o8<m{ueWrrQ_fe&Ny(3shmy3w1uBYjYalbEyskva%p)*MSXSk^h8$!uvGwqJ}@D3
z{S~|q_;;I|Om;h>(9l5=fWicv!{G#)goFeoB_-e=`LdM2yxGT)XHqd`=fA@vi3u3=
zhw=>j^m{sMvnyr_{NNWltV*4jp|Q8RJ|FUp_AsP8S~mJV7yDbS<QYXz*j1n!$15(0
z>c6awF#8H?MM%WiQZ*hSA)|$0XBh%%3`GKZ5;4?3Tj9m2q)ZbY;XHsZGKkQTqsMkL
zi(s*>nxY@foW13AGmz&Dw({28d-xuEjjn<WG-0CxD*vRNJ)~F{@Cb;y@*ak*8hB|l
zi#nQ}Ey29A-=mhnoi+qc@Q%zxWz=cr!RE=ykZpDTl58=I+*4G_EW6uT1<0>ndRK9;
zx8k|O=-~OoKnE~0lL_J$FYdXaa<LXg4Iu<(=Pz8saBR?EUx-*PN!}=j6PH#oVwtzU
z@a1xS@Tavb$R$|Bas+NcysN9v#w|Kys&Zy5dGWZXt(6QWPyv@ci8jwUs1M#_`?a$S
z39OUL2T$=c2SVU4$)hMlqePf3l!Q{;e=c)@o$|Rg0qPsg%*0|1jf}|nk&y^_{%h_!
zU8r2Iw^|0+-0%qq=;-LM=rt)5#2c(v-5#&ad_M!uy12Ob@$vDjx#JkfQn4i8NQC~<
zOhKEi{x3P%q{;MD$LLDk;!FV~(nm<7f8CNkx8J+|t~QmQ@ZL2twsI#ewDn16*|GDa
zj~^_15c~nm%{jd0W5{PBoJvS#tq5A$aEo@f^{(Omyz7)4R|c4;<E#{##15Q%?mfvT
z@W{i5VwmC>j5+&W(!D0mHa09`f1Y*l?S255#eeem97<Y(1>4gU)*)e+*H;fMh%s2=
z6?gDF!lHfB-5FP5!6tD{$I?{_y-A7mlgG|^<yXhL!r!;Vvrm5a9qk0UL=I+s@Tr{*
zy!ZioUJ4CL=yL|$&tg;d#x7a6$7cdpsrUVgQNPEwjTspTGk+E-(}T19m>1v+)|I~W
z;$J<0S$|6U&o0Ki;?(n0S<g+zgSAvX_ojR9ROUNlA!@|Qt7Oi19O?UWT)nnppT107
zZbY}`G%svQH4wna1$nt1+y^zIRI+5frk(NHS5@#`zCLdiN44D?DD0Ka6x@Wokl4uI
z|Hi!Pf|&}Wdok}%hqSr<G(+^Y)i01zCMbvu@xduvgBuLnWp9$4W<M5^rL!{i6DVG%
zgNBBN4akwDG#*a}RH>Sx;&){K!oq!<j+g#jyCe3QhMF1!Mr=SR)q$-Bz{d8M+vWRv
z7eH9?*sWzL(M?QDV0Xy~RNk+<0D|tKJqNg%oj?HMBYpVHo}VAER6h&vg2e8;gif4#
z1|2jbY_b;3SN4nR=Hj*@Ls{lV$C+Nx*}~aNnmA!hZ#JU2Hs@ht`C*~eCiHs>YEGDm
zchuuWvf^EFi$Y=G{=O)+7RPa*{_6xoqW795#3;M-8mSX*qU@98s%J>YwOjpk=m}@E
zV2yg+<I_^h-YZqQ&egh2=qWl0d5{{nqt7AdSy9fx+-Ed&iB#JCAQR+Gx(-@3A{N^q
zgt#7u3kUD7zvh~5759?IKHbfu8?DDvmM1q;OfLy`!V!bZV}577m2JvtX_d=T0#-zk
zTFK6?Iv~=|PtedXPj6gtqPx3$anbeV@y7f0r9qa`<9vg^E)q~>z{<M1az=K9yMsDG
z8-SQ)YWxPEgJ1SF^)<h{mgC{;YFV7eYca<!2#3v1rAyL86z=3wPQg-<4SCJ3E_|M%
ziUs@8n1S~4DW0ha_lq(3&mGxtuZp*s%`}1Q^Z1l&muT;P#Z)-45&cjLe_pn0X#dwq
z32A#YU(RX2hx~D>T%(~_p%9UX4}S)S#WY%Oyp}Mm@A0583#k9DRWJWevRG%4q)7ep
zd^K@$a<cArM91ASun6Q?ApW&HyuEWs^hAp(%qpp8*wQPpqLy>+lvSuBbiNe-@(*J$
zb=u+-zYkVw4V@$5LjJW5%3G!Vi9ojOXd3(3-dLLF<Mm>jdqY-MR$H5AsYJXyB{~s-
zf3$k}n}fAfXCafpRcF20yyoeKgvV88fW^rQ`ma3^$QntW_b&t0&%irCxZn_gyq+I#
zj^Lrb0KAX`1BFeS`E<YJi{GAKWe_Bg-RN?$b+_)hK2byDH+3k_%7AW95wd=1NFhx`
zaEO>@{q_{Vb4U*?l24cg$AijViW!)mi`mvVU?C<S{;!H~`C>&K@0U99e7Cc<I~Sfc
zv>nMCT3TA5M1Q_qV}EBSJ~q}4Sl-*nYgZGXVr-S*Sm$i&q>*D`^ySUw0a;z+<skHW
zTZy6wdG?Z?5!NFFAFL=yx63&;^O|x@1iD7pC-o!+DGPOVb#p58gn)ph_lxk~{?N#*
zP(W-1BqSwK#0?#voa~RL2<Ee0h)p{Ime3ChVe7($ii&EXQU?hJ=65x-Gd<8t@*{N7
zyXPmG@oB>c;eSn?z^cUpJfn2lONm5)M^k=l@T+-BSIHtF;s9wkhLyUmOj%tqp|;79
z#Qw~C-#>%F{O&g%<=4A$I2=NJW`o6g1NH<N45fT#I{oo(qUmsr7(xwh$DPJkVI#EW
zo}73FWB+iCdjs+*z6oG4#q{*_0CN#H1XT7s&WX;M-vHsU5wn_*P=HsQXNn{_GE8?*
z&l|M!e1GA7cUnAW{sQp(Kb$N#5b=4amOshbIXD>BECMzkSoPN*UrVd2>GQaZF&bVJ
zD&MMR{;ekj58BG6VnTJu!QI?kpx`hv&@I{-Mtpr|f3j}MT4KGoy~)JKT1yr?N)ynd
zc!HTg<vyMqP|8CXZwRipI>DvhUqEWRpokRLN{&l0R`8|9GoqbM%^3|d8!8Ih=$PSI
zEgmj27>F!1yu0%%;xC$Ohj1Axnmar^GzS8MM}l<ebdHN5imVL|uftg?ZtfNxuLq-7
z@JnA`AK*<+PhS>hc~#ffBf`R}cX)XMzRY}umiyjl3K0K!J?tg{PAEETUsqRGceg;k
zypmFz<`FFaTZ0C0`IzX7bF?*=cpa7pcnt;~AowFg`qffFWUS>sZ<$P4#$_R%H2IgP
zr+AVvk%{zOxch;k#aKmADbMoA3Jb)Lm!IZ-eRfuV`4GyCDx(#flL<BudHQ-Y<6Ulw
zufqpTOjH_Q#L5{fQgl;$uwB!Yf{!Pro_ML{Ogc0u*J5v~3^lPOpR-|{J)L<%fQ>#I
zG!I_=FzL#{#RZ&A;M6HAD<4XDz1*l2E1H{_+?{XsoS&Zy1|b5|F+8rPL;yq_xC0>3
zDK0LCMj~vr-ye5g_jCq?1E6xf+MgKNwWFY*h$RgR4F%Fv>FMdCAi)lUE>h3`wl(up
zC@YX6n0%FGoLxbn!GjBn98N7E8<>~GVSk7-kiRkDlTX2{a@ow3><OY$XlQFV=Z*`h
zqjSt^GP!V1QwXIds<DUA=9r!qf%~}C3VvsNs^Ymn*xkw31B%2jB(=`ioU=KsXK6Z(
z9M0)w{lXj6)^Ya?8UiukvRke!DFQwSJ=g8UAin{KH<p~En%;2IKcemiL5Z(MuUwga
zZB46srY7P0W}ReR5YcjR{XmWZjmUj_lZVYA$akGDgXi(Jn;z6pfdavh39!fNVk;{u
zIvmZ@z0^J;fu5rWw&~Ps|E{&U2O$zXPI!aSaBw*Fx<9I@r~n`*5c*r)9L{k&9ly1?
zD=N-DKU@Jz_zZqJ1J+Lpv<u?qP6Jesiwn=iseH!lNCN3wVVO@1kPi$G51*cvpJ^eN
zOxAUwj2o)ZZZlW6I^XD`#T@zFwX<V5V-C>N5)u*yk^u^%;Dw8e>+->)CpJADKSuOA
z-G3iA+57to<}L*jIZfxjzP|YQ_?e$uw+Euql)oY{@bb3(`t@t>Jk>o$17?DSbP}id
zN<lyJ6`-9(i+k+qO-UbcG0bn?iQFJcE5`LdbWZ(kdjWHv&rBuE8Wu^1-;nTdaxmsG
zGo|xiu12wu@*P8SRFF4w?ZOe=LRCXU;rjMG(GpL!=boMtCYcvOV)w&k<qMI^7R)XM
zy|?=mRuDx$-NmHl(uFIJ`t3m9oS+%2$;G9uh4U+u_n>7`S`{?Cqngw6&LJ@isf-$4
z^MB~i-d7~0D1luUcP#DUc=Y%@4CW90ztZuwnx3;}%u+*Qu#hG;{-U<OHn6fitg4VR
zZ`MGzmNh#bvFY~)H#RoTm8!e~gg~p!j(BXAe}>{H-t3|K8Lzwh6A=G@O&JA1n~tk-
z@8RKKI*odGK!J@WGkp;b=WxB;X*p|m-|GG3?(PmWp80-u0_cu0!&;orPWSg!Ku51+
zdZ#imt<@q};I=FsWow`>-jpBk4dNC;IU@12kcSPKXToG&@^hz@jN%ZQo11a9n~y4u
zm#1x{r4jkD864Mc&%^1n)8Hols<B{Y9@PAeK3@WpfLhKapWgraiW>4A5)u*^5mG)6
zL{|wzhE`@ZL*@W4gD{!Zal`N5zv*81j9h>tVfASO2z==_Q@oCA-Cd-B&8`G?nr;*2
z<5c1~eCd!OvuIj71Z-vA&hNr<oaFkuXN)0uL=k7(Ux~(hrW|XJpPCZHha5j0ZjVhB
z@`U7!&d&I1?riZEWn<JaKP`a*FkrIj3D@YQZ_E@O<!<Ya1(b$BLS*8O#+R<&YjWP4
zKc`%hd{R1v5&;-FUMNTBDt;)WCbg~ELJ7U41H+j9e9&vex2Qm|#>@1bE2<PSt=0#R
z$Y$BG>vKcCxzkRF<QYb38nYQ(sHY6o+B3;#a;h3gHQcj1VfRCd*%nAicn38HIoU>^
z^43`8KPFqf@0!1^hjQ9piJgh#28BkS1zjZZm2sY&8N$-%i;0WJPYbXzuNRA+Y@ehg
zCws`no-mrCe&H6^F+b}*C<%SMnlS8Ge0Ms^q?3hbP~igM!UybHxoXwc^})<Sh1L^*
zEhN#Z`RZZE4V6_?V21TclFzKItpV=f_;_T`fg|7%YPY$msjB{2T6%nV&}wyggB?KQ
z=)|O$Vct(C>~-odUC>0=f2VQ<Gb62vw|I*?t%lFVL|&Qywa|ex>0Wp>%=e_<nWl)6
znlpp`Zfxi}@T<zoP8v$(ma6%FP8|uVC$l=tHbBoln6q5&`6~X*ij`SfYN0U=P_yKk
zOc}b+Vjc~3TU0Ee1trDA=%wB>BFK=U?#_B?tj?bUPGC4x%ezS&0Dw#>*h$^l+|)~b
zob|@XAsA0)%B4eyBm%Y5&3QOxI=TqYWxk#--IG8=Le}N0+uMA|^-`lvY+pyCkgg@$
zML=w$P)Sf+oTeS{<j<|i>X4I35Hj2UY9?qL_31nGeEK+T>agvMR63~9bTcErkfe~g
z961)Q8`DEz)s4^Nqm<{%z@4!NiSD`I3TzxZ#*&kq!ocB@92o6swSR{skA7&}m1S@L
z>WQNHU^wif+~)cx!lJP1P}13=@&~OV^uu4A+#RW1Q#;R1CPz#m>gDl!gRLE{&qvVs
zTGK+FcYi`t+?6D$_1%8dau$M+;9x;_SEH%iVbWgAW_t1c?&0jiE6uLCaTu52=ibc$
zTw=IyB5Bp$mT-4=9O)P%Nee{Gr%iGaCs|hC5)M&WbGB}J)U7OSOAcd%wL)h7apj5;
zzI2(5F2zMe<1ar>Ee(DT!5COy|6n#d*cxUji{l67_`<ZOLUs8%9gwP}5$eux|EPfu
z-p<*~5=GvBU3?;HEEun`eeU@1GyU87w`{5SdQLhTG21V}c>FC4{Et*}kCgf<DBNN9
zibBiO^~zJ6kb57?F=my8*r%F9HcEt4Fz(RMGNH*VKUXD?JJeECm|iNfK)>hw`OS*~
z^_$}RoaFO;w~oi9?jg=QPXd3zamUlAW+DErnf3K*C(L&fN}a04jM%i8aA{+iEN1c(
z$Z}AADERoA%F6S9{`}qE-rn84S+b~<N@m<lG0D_p#EyuFz+%vLaCYARaf(UdwR8x2
zeTb4S1XvK9*FJF$oIhPd`Sd_SK}jbwW>0)7K{{Q0x}4f>ZxKffvR~g3NrSdYep)%{
zsuJjU-en-7Xnpzvch+S9`~vOlK6nlow{yl#fSr%m(8aUh>mz*Bz&5Xki(S)m*QPo|
zxGYk^4xznF;W5-E@3^&04!;jF2}XgiRm;Lx`htR|*Hd`7X1f$rI58Mv^6Aadn|*4>
zD)6nzQmUg+i!+rUh|~SE+#tWAS^u%Wl~&z{rdX*5EH>ir2^CqHIc@GRAhsID`U$Z|
z)jy%FUulqY5;$#0HJcm0_^om8N`m#@1)2)YABhdf#MsjKle<bQzpFp)ZBk^4M0P#&
z;|zn%>~#L<GmxXfS$Tz}zhC8b+w>hA)z&~cu`GPnB9q6plIg)W9fy25ndE4=@I$U9
zv25m{b&zPH_csLJQ){TDuvQd{c_?C%-ZUht!*h@0zN>}w!Wi7PKGg1fll?gF1?5@5
zg#dYulG@V!u1D)Wx8dhX&96cQo>fi^zzDi9Btt`^lO)ml@7>L^x@7<%9<YuqQZiY5
zp3`|^Z40)KK+l?lgalyS+5l75dfp8;H8nL;C?f)+)#1g<&VF~fJ3{1jzd0iVTCD*^
z4QNyw4js;wzJl*M7_?hm$~@8i-<(uuAHV}d`nvqs^)552Ce7-6s^^$(4Yu38_B?Y^
zZE*K8$P5#3TCnRKhOc1JV>wYo+KFRG;<e?a`b2Hr@1WyL9&u6W;{K3dZ7Hlvhf}WH
zkal+m#OSxP%K4%23ml^tvl0vBQraMoN1`m+efB3+#&yW_KyCZ5K}u*nIwWKJC!!%@
zJJXGs7u)d=R?Tc;Rwf)d<Wo9B1l;(TdKTgDFJ$kZ*g(8(@pxHSkzY{=Q5c4_+pYZ=
zDQ>J#L{eHdotxV6Oel!y@;m%o_%!hagG;EnRK%uG1PKxxgXug4sc8D#Dn$7_s(zVd
zF;-3Lpz*~FC_52}P{DzJYohdV#b8K$41jrN%InYcFjIvHWXPQY{IR8_r8U=m0+|W-
z{&Kj0?kEuW-nrvx)yC^8ElJyLXn8rUOLvmxWtBw*<{EJ6AjH1&D>|>sp(jK~pD(Y2
z6UW-0;Cc<23x%Z981;OWOXo~k7}~C5(Z&aw?e@?rHKwutCqnk=avkhO)K&eeu$~xS
zYCdcGPOI*nobCmNIPQUkjrWn^T1yB_eH44x4e5J>oR%x!at28)ok?ev6ZS8-nCsBF
zaNg<r?dM6j7Q-EIQ3q`qU4PwQ`BnJx9ji~m442*8$rCfFM<TleJ}sskJ`9Of9@oy}
zMo#cFvUNYY_!6Zh=1ObdcGZ3%`s^RJrEFX{w#Cfku{XV##UPHHfd+MP9#S>44_j{?
zDYlWg3k!<!1gdawzY_mKCMFf9YiZ=4U6*{|%MJbe+(t2BNSfZ%l1o{4e5|=FfywSB
zl2BKlSWyUi{ZorCWxjOzxuYTa<~yqMK$vb36?V_*N|WFW3xH%iOn9%k7n$u>B8RbB
z%+vn-CMz!w;93BrFgG>TWn5!2mU?rf^UB4;gFj%~-<Cv}Rp<c(^&PJ-HW|_;RjSyx
z^pY}>H*Wjq+W(-74U`BX5V$J^3@{f6uc+MN{6S;Mu$p!L-Ou!At;c3jt)%%rme1~{
zi&ak3Ke|{uv#zP}9v1_rs~cIE9WTQ8sLeMe$LvV`A(O|~glD1V7Oq^WxUS&m(IX<l
zs1B*&36HaI3O;FnN-!-QZAIG`JK22*j+x2uif*zLjKER8_3p+hH7tGhzl!YP+d8Cf
zQSAG|Wt^^7kV=J3+Z3Oh6{1x;SK5+DX(~%7$#t+LH%3`4oR`-YT^4`a2Iq7e+<DDZ
z-*uhj#Hl1*gHxaOx>DI&bVSMr!_=!9w98wi?ft%g+>z}1W6Ydl86d?3@6I?fq+jLh
z=NBNb*&P74ytG7%`No+L6a*dCcW9sO0gSg|O9ST3X{h(Fyg!SSP79PdcTY$@N4hlb
zi^#%XVTFKzCsu`r4aa4-Sp#~UJ$}rwLUewqarkVHCjdWECV7?_VLa2h7!`@w`(yBM
z5r+6sy(%15jl)~n@K?DVu}p%_y-{&!B=WXL#f87-VzlTFDmAd)BEpQNKe7lTuW%!S
z`^$VM0hJujTo$t(HDy+iSQ;}EzDRsvtDwZWh;~*0jhHq%Gw;ofS(0%G4{Inj!KHtl
zb|<CCg|%F(29ovN<s~k=b$VJ_T50J~v}6A!>{F(Y&*nSdr?1i2D%i#yh}8;u;P+J>
zHGUAf*uRZHW5)I(B0+7QE9Ha*b%-=jeoXO687SSGW(uz+UU%Y*M&<#vRM^UvBku%<
zfnx%-+Gv|wT`f-%!(&LS3-Rrh7W4b6X(hF(lj9N2irzt{s&N&azD3naL)*~}Qj*k(
zRb=ssP^mbEdOM4Ufb%8FwutZ#`_SD(^eReYqsxO=>B!Xdapo#=k)V#Eh7)4-MuVBU
z2cpreRt#e6KP!t&zUCSl7|R7hCX_8EV-zs3C<5K_a7k=o<>lLPdkh$KF6@J6TK>@-
z<;Tb7?_4*^i%UaWC{{=Op8387r>VM7EuVJZC;x3@pohjl*P8xYb?#bvUp;%Hp3DI)
zTxSgO%vxsBQ3=cnq8XVRvl`t65-dn&D~-1F^z=Xi0Q7Q=7Bz5W4}Z{OVQt;+`NS5e
z$H&JfotzyNjbos)Jwf<XKYF3nV}bw?tx2y^ItS$B-mC?15w4HfsCQ`293E3X28FO|
z-fyna<;-Dusakmsp;Xd6tJr1iAqL6(a7Q@Yfx$d2Pj5&eMc@<gs=P4Kv!Fj(xSqiw
zY$knO;#IH+2<vEUYn<>*N-u71p<v&uq1H$d@#DHXVMlzh868=n+?m`-39ofKTYSH^
zA&vWHh4A_#@a_PZa~*hRz<&pF@@+{jZXbbqS^!fUuzg-M$s%aRhRz<#@SJ;EG++gB
zv>$D%82v|^=7SR4^-U7fZ%DsUFX}0)^lE@j*TrWeGu><guf3O-Q(<5OX3z7Q?d&;c
z(&R;F;|X$%Zi8+u79alVy6e1J>tf8QkA3`&{R}y7NK#x}ze*MQ)#DrhG=V5HYDG~{
zu*W3J)9LB<WO7p0_cu3<VXYmQg86OLAQ-CwQ`+AzTy*I{L>_h_T#w}Ula?THtyIU^
zx=PjLY+2j!)n?&#jaCbqkNqLrJR*YXKAx2#K|)ETw2oyD?KA3w;5a%wH&GJs1A<X=
zG@bJ+!1MR$U14Hm1XMnn08l~H{P-*Q>=iKXQ)6RvOiWYD%kD)z_^1DfKcaG~t7CgM
zztM?8bpCPJ?nls2`!R_Z*O$yQF|#NaZjMb49|w~`00|+}EhGHc>AbW+E@kiZ8Nx@-
z_n@C8Z4AI{Nl3PA6YXGOV9qZu%`Ghr8L^|(zBrQN+Ec(oKnMcQuP!MWUVJ0u04(Cv
zhH{wMt1~;^v-jTdHwcJa|7!Kcm6hYOGY|mx25B;N$h>>^PQR+Ly!>RVFAO-8g1Fl-
z|36^;?;*lbv9Yo9^YdbH<gRXReB+mQmTXUT3))xb=Zy{rs6ukUM|$+@SjHyjpNaKj
zw_BX9Nng^v=XaiK`nxjTfZWbZ00V%Af^q{OeC{_El()Z47L}ARr;VY8?AQjTE<JBy
zb(~*cTbi0S+V4jyV9q!*HC#wWbhs>iN>IwKr-GnlWCU;^TMm2^fNK$A{2iwP1XO<8
z+_avP6EcL)=Kc=e46=Z&j;6!gYE_NvSFJQV0(3P7-Tt4V6#mTi&&<S)8RJC=rxpZJ
zcA|U$2u^-oD0{Z|88WY~uBJ%dOX1{>8ed_TtpQK(Bs{`r2gX{_o=8Xb?%JOD01In#
zSfgnY1iZKwFq{G#URY325CESH*o;_krO4v|HJ_HYj4Z^i|BV?2qQ%40^X2(DodEI&
zfM&9V=HTMuroU0}z<<G~F%jAPSYbWbcQaM$hd>NfCJWK|_p+J+JdrFGv1`%}7iH^2
z3*mzj)umgeR#O0coRRVTLL@B`kDZ>Cb#81dVqzaj&gV;ivUD1AiX{F3a9Uip07nTI
z4-eX1QD!{8OP2?%1Qjle83svg_$1~tN`+mc+xwzw%y!3%<q4pvh*3t3J|6%0Vgfse
zpKEWs;TT$<PFn=$mIk-};$@o*xV8t|A6`q{NJ(ej9d2%3tk_R*vO{e!dU<&PtSK+Q
z5UcWM7cJR#BnKKJBO?<NG4Th^B+}^Bs(W4e-!b;4rlt~>{Qy4LwSCdQA&EbU7Y?wo
z`vjTrWByx0T}n<at4F+d-V%m?Q)9h7)r;+ZEZl8gxWEttHqs)3nlZJmzP`DsDdH_f
zW*}{q@_sPoJr)+$a@5bDpn<=o_Q12>efT8O_D<qjSzU}2_2;+AnwTNOTOLh+noaC|
z;M&_Om^07#x9HCB*MA!lwLYmdasq@w&<>2NwPm(CuMT4uT2ZSlMjG;?z!6yd=|eFN
z;LxTlTO8I5R_Xvep`n3?gX6m1EgLNl&6ayZvDvhr2^{(#PUxK|z=BukbXeQeJ7!sa
zIn~nATC}{4gGYdO=KXSthleM!p8Ew*lzh#6*6O;g)DRFW6FZxZiCEW9)4Y*qZpQ^u
zBDT~YS4=v+O@Shqv|q5Df0(RSI5fu5GYKQy07V9qeX%|8x(|AFz0b8o!qQ`8{$Xot
z>+Eb}Wo1;e_>cJrto10jfBYs+@MMhy?}1Z4nE2JGN>#SWZnh=@6aN^*f=>O8_tE1~
zRZY!|5t|e><SPkqn;!LPSlBos&`#Sa>zn@#;Ng)2Ao?_R8!qlp5fh2frp8X4pHmZk
zeF0s%-@NeQ%a@ka>(oz<DS>><_5F}2(Y>_$Q`5J9a=1a?s0Rh%BSM@s0!-SfdCPwT
zS8i81<_!4En(h8|bP-6BLNvntKZHU)n}g+Z9AdBAt-rAF*XwdE(!f&X#nWuF2YL^0
zgp<0eF!1oeWNtKa$sd3?|9AZWkz2v%c%|Pl+m`J?i#VTbfW0g&!Btg@fRdR65k>_e
zZ~fpHe<L<c?;IJC_>9cK4G<tfbWSZTJ*i%v+Ipaa?foYQcGuypYJk6|Ln=>0LwqU&
zr1b3z0=4aFdS+IqmzDrbcUTwRHuNI|BPwtV)oBwcrY_By-m-DJia-CezYy4U*L3um
zrzhp*<!@if*gAWpl|j(Wn>oPQw3YPSq4a!T-T2BIA^b&P(2@-pgUw0(#wVruZ)@x8
z>qR*KJZ?ON@SNeo{0}o{=LRV$DF?TIkPwcRx;l=G{nF}&0Ru#5$yhjLu7&;4Ij+~~
zkORWaE{i<Ehf_0m#906z1629e`!IkOSJ)>q5^<T)yJqp3azNv2fpn93&%Oxojp%^W
z;NbL@`6Cq9;NFIUByxKPn1MyhcE=;k$ZczD>-s4Tz%o7qH6;LGTbiHWxA+r2G8e>O
z@Jwy`e+wvZlYf5{(HU^$uyKL%65s>b+1awYIKZ>9QE<zWC0#y$guuojw2eMsgji66
z08*3l=5O}^vF$j(ato3EtGIY*k@#)7b$<w3;{vJ{s*mHen8)kBg{Wiyz9JhH7UGSK
zYtG!SYvavc{qNQJ8{&WXsya7TT3u_Zs!(9Lf$Y1@O2$AsaP}d5vi}iUZOE~xalUQ)
z4@4kmmNfEaN+H4t$M$YZ01W2N@!x4W^?ln!p3vv#XCQbv`{zplUlb0tK-DAP=L~A6
zb^1T|A&O8r(QDM+FwecPO6_?^*Jg{}-IJ{%912o})h9aDmvPteoz|%oj;Yns%T(kN
zwd{)UmtL+#grsC?=h%zi{qO$(0{cL7)QYFsc57x$`tMTLOTxnII?+gl@`~k;A02>Y
zsMS^~CiQMk8_7FN2rX^qj>=-QTCk{~R+^`!qL-F@dFh|!5J-99Uvf1erAIj2ira55
zkHgBKCGrjbv2MzI7V#_DN?dge&S!uT$c_B`#t7(>e=_>-4ekuy4D{SH(|-m!R(6-&
zI$^zWcSHIec63q_R#1<v6S|gZhP-yp=alzi@v48rR#z+J(6dxbnfP65zxSThX%*5l
z#L$>ki2C2`=rdJ(8^!pXDw9b|TQWCYwD1mw*iTx`twM9302PG_vD4j|m_exo7nzVU
z6J@RxEi^u1FaZ~KJCt+^byILwGpCZqa4CA{&Q*snL500nylK@Y*=$wmVG$O=O&g!8
zy9g@rb8u&}lT3PvLad}OW9fJTWv!%_OReH@6!G^sm4rNPnUb4+jZ~WaOK$w$TeMK$
zQ(h^EPC;y&-8V%A7*Ly%*BO{>i5t*=E{EV7i?a_Ys+fR)FTgrh^MM~`YWTyIAVq%}
zx3;#|j-Od}Wd)a*`q%8*!@-<lJ^N{yq>;-+nY73G@zVN_R8oZA&gMU6p$A4rqQLaT
zr#(4bGky`cXD_kMt#rcZjJ!vRu0!Cw;7KzxyJb_^X7h#g;!1K4O~ne@ajo0KaHW9y
zb~!(f)lr>((z95q(lEYE5S_K>MQ5&xS#_CePn;wW)-ll-E;Q4iV#hbZc|BaFEr()M
zuP8Ci7`HRMv`r+8-O8*;CY))<M>Co{ZiU+`&Gjw5@_r!}ocBR4k0BTpl^Gf2EuNjr
zTuzvK;5ss8y~zs%2>Jq1UF|%l4^L?%_l1P394}h9O9?wNVe$uEofr9xOa$YZoiC1N
zwB31$jWpyCZvN1L<XJFUV)eCU9u+s!PXRl@u`;yY>UPOq$@Nd83ieOE31h~nx)6B&
znp#5-QC)+7t?Gr|TzYqBFk}|(p|p=9N9k!T_38rrCzviq)RsesYLI$J0#(;oYwC$f
zO#}nZkIcnSe}7=#g=q1%Fg}YuwJqDtr^4)}3ZRSW;cIdE2P*c}FN)y=8GF{Tp~obJ
zb|9$Q-(L5Rw^yEuyHx%va+)934KGO;!R<}K>QKe;&xR6mn}!}3kBf!;?!C=rX5|`!
zo7F6L&O^u<Gfq`pkVDFmGqkPYT+(x!cpS2C5G;SHi5%xux{fx0B0yfQ*1CV6D5~Sn
z5+G))5r$6l#o!~HeY<)vAY0|h+gq*OtT~&^%GeN$pHnMTsLfl?`1TnsloEE=+|UG~
z*tJ(AkB){*)$F<PE=lu7=3%T45(XN|CHjJMY4E)gepRGXN6(qb>BX4;R1F8k@ck{Z
z`no1ZO8Ba;*NJ8Z&`$gG+`IlxY-L$%0Iwr}LH2+b2m#Uj#y@Dnm}af5Fz8VK@tu?z
zB}>&6Mn1jDv_NqOSiBgY*wAiQk1HT2G7>({FtfOJY(PaZF=^qb&h0W%t$UiXBrTvO
zS7`ppR`Yr<_5d1$uiKg^O;svL4A)wxWJf0;8g-#LbP0<<Kz;6-sk?wh#Em8~if-$t
zl1{6o$L)IqpJl?Qsi{h<MUG+DmnNNn;NjaGs?SQ;9^T2A$RY5JAf}Wu<WHQuauL%-
zzo_>prj2Df>78f?1>w>nh&Zv;a)jd^)}Ke=!SUsV6(|7A4auM;36>ujA4x!1%b_$g
z{Ot7#UO<sSw{!l2Mj=4<Q6Mh)vZvU*8fP_*ja6X>WK?Z)y-gvL^wGX5Q%3L>Hg+=p
zP~O%xBJpx3jD+ON2SSoh;>A0#Ty~4%kET<ctYnBS?l4M)(SX9h|4B;n@t~IPCkg$4
zwW5QcdifQ3<0H-fu6QU}I+q4+_%dv=X7NJWEN<v@DNU%+4R*InoB(8FF5jY%urOB<
z#apbKX>1Utv&9N7#C-E%7(M>&NauYGd-@;l5#_TuWovKV?AgZ>HSa=xrCN6lS7&)-
ztn;>%jJxUK=j-^g35*-s&C2eFdSW$WL*^-#?%$d4BxqNAziVG^CDS5m`Bk(VrM%mp
z7(v;SHCL}qQ+RiI)~ikK<8WbA*3o}=hc43C7*L)_Xg~A0v)A3sgq!&`NP^!_eHYVT
zN(|tC*`;&D*dMk?5Mlyzw~VV$l;-wz-3<t&Ne!-?g=iodH#tRpGtkFIyO9g*#37f-
zJbts^0YxLrs9tHdeL7qjGG{C2@0>5X4Dd)b$#Y7a=rp6{A|$$9m&&AYW*S~SD;-C<
zJsrK}yC3az#PT|nZ=vay)B25hCW{`{<jHROjxcG5%dy12G%lszl#*ABfqo14Yrw_!
zwpA&NCG`hO4wsv`qahKjlk5Ub6BwT8anXeseWIUwz}I8Xb>5uKPQwr>3eD2=xgSHO
z<nuT*RmG?ENJdk!l`OMB3>t#pgIpJ^q?Si}OtpuH7?hz5ZgZwH*Hfd5H{HJ2{6zjT
zk#B-&&GphZtot2ouwO4QM)09{TCVnHYv?w~dRXm?SMbt|;QPZ(z)1jvOm1SzY$jd@
z(kcXAOX0FohDHhTbm?J~Yq9WX8VQ|-1-&1`e?qg$z&_^(_5^K#IcyEHeHef*kw&*R
zk=*2dXL3dsp|P7M>P|GI2-8*E=;?V0=)F?h%I=_tuk~66II_E8yu&M&5@Pe=*F82z
za7gfT4e|677ji0We-$M^Px+TU%^;X7wXL<R(=*!mo@2RqJCHDpKTenxINY$DPV^y9
z&&3}-ClOMwcA3j2C7~a$w6g9?I)LB%&Qm7Do1RP!w}}>(aX3?cHCVPD3SX_#bYDQK
zsd)B)<Tf_&s>U`U`5q@^hI1)@Gc5a4m*i|5Op+puOXNc=uH{gzX@PlTzct7sX_x2e
z10Zj#K(Q%Mt*Wd0>)Yoas)f#nJ5SZ7nJ3KpvQ&7{d0EsXUGc|P@2zID7`*T$bZe<?
zrqZ7U99M8r3TT$vBygUG)Rw{dI5lYX2#TWd$~#uvd083G;5b#jK!?84Ej~$__&o;9
z<YNp{vm(Ai#y&#I5t+}?YAWempwe&k=PI|AKj*b)$?OPF@W3QQV!>7>JBNlb!G3>B
zgJ!O-uOc-E!}mzOk}dO?jQ@O>BM{8S_Upi#tBMU?q?XGWj5i=ni3JrVGz2|C>MS!2
zdjG#f(AaLjN#lDa4Z$UOmUZVZeoDi`&q|xl(iJ-OG8gwpIy_X(TeShDq0uZ?JM2l9
zs8uyY;}VON%skhd_3!Op=aJU)R2TpZwydno(%jt6=`##m>^L}u%Xxw-R(S9i{XM0z
zxTaebVhX%lY5|iDVI;Alj<$ogXVB^MygoSgkL;nWx*LB&WWnqJvok`gYMhOzWo?80
z#Q2sQZVHvrTJ?GG19vH<zp2#$IQ|aAp(v!M*+q)7p4L~-tIA{+TD|7Z{*srv_d|$;
zc(bQpRn>d(Jn+yyLG*cV<qxIU|3}ta1=JNaTe<`%5ZnU<cXubj-QC^Y-Q5Z9?(XjH
z?h-7xyVEQGIo<d4Z60}mz1NyG=d7x4j4}))W^{k(FvU~L!#9(}Y&K+7PC<P)@7on(
zsGj7g7*w73koN4c!AuXx*T6<z()hB?fC(4;FTrbDhD^*;q^*B<Ii_5-e0R_*CnUUC
zQg*WL&O5In?AsqYNYL8Cl}K?ao6~QVH(4-mn1q%qJFyT&C935K7%1+_#QX&}LswZ^
zh3_Q@S|L5Vde5@9K3&pPP%zQtPh7U!r=J)t+_fuJJa%I#l)>W`m@Vgal2DP9m#TUE
z0E^-9GM!3jI5Q&7GN8!dr#GMo^9wy$r<jYbUYuhzQPc{7Al3CLW5xCl@Uo$Akwgh0
zmU=5OWe@{TnX$2xy1{_>9oB#4gY5s8Rrb^v++1;ve|yn7MjLkd7Jr93C`m!5Wh7!H
z=^-*^M7ZOTeWkXB1@(0-eju(%gEU-m<nQ9QEdseXeedN3z`9y79XhVkKRuPO`ZxJc
z!R@8YL~J5{%PiS_3&mx#i=1|}$s<T7w^Geg10+JR{p!$mqp7n*`%_rAkE`ScW-<$@
z3O;^QA?YIbp;rhY78}_9iett!c_q~GMd979q8Dm<6E2MZaiQkw5Y7S0Xl08hFes$#
zJ`7&bre;gRi(KXYZ|DSpS2Y6@Ug-szf!rt<!DtoXsj7&?J#GZ`hZES@_q`2|t$#fX
z4y``&8O_|}2fPDqXD3!`d;eyhr;PeTR1;@jOp#{!{4He;Y^lEyj~RO1iz|1oSfCb1
zJj+Ak*Bl)?_fS@kxCq-?jmv+>=Na<JWXYV4T63jNt1%{AI<PE~XOr<ZPi<uRs5tw!
z^PVuBpD_3}URQ{`+5?O>GFEpuV!XPW1}<`vR}0;(uH^;&95)eD`jD1u?lKG^0ef4R
zgcL6|8=rl{P4UhoIfnG1T^`Mrv8{-n$LW+INZq6_Ojk@_{b8--7o5IJ1Ei4k!IXf>
zG?mRxUddB}lf_;DRBc7fg{Sa|+sE2u82?l1S%l2WTzf?8arkdz!#f=zK^HflleJ0+
zB~&(1oW6M%AORK>A%Zh-X&!sHHm-fST#-EemZ0p#F15G02}J;X!aZXB3ptwH?G-+u
z)91P2o|sVZzdQ8GJ{aF$f;(D%CnR><EI_V9W+)Yj!R@*X&(#00viyNx=25$H)e8)A
z5iYHAEFIkamxt=E9P753)!Hq4&vA8GJl&m>OTrDSxl}2sEKmQwVF(0LuB?c9+rBiW
z#Y{Cmn^nC`QOfJZ^NpH}bjK^zw1n}3M3E%Aat*hK9!*-5+~Awa(bL+B-)H0*^4V+2
zN(FNzqAGpGe#|c@g1(OP#ovj%%osoWIVf}pYZV6+jVnKF<=28x$}8vh&w&*fpDM3X
z5@#D!(k_V2W;`yJ^;PW<WX>t5968A+jCh``KHBP&-fcI{0BR}J>y?6DgbIOLT$OB?
zuz=9Pdd=KYdrF6CZ^+g;f@)KP;QXG2RNX7r*y$0&&*3p?YO+ct-WacUxV=jPr+4nn
zqQ084+iFPrBPewImxTg?Gj31JByE^fxyqm3C&6k@M^A4+$P8jTJJ&H*$Wb63GSt07
zRXc?=VB&?=4TM&iBPPMu6K&_Pum}tvXS-{%HgyuSD|AShEAP+it0P>c<%><^#=#~b
zmyZCf^2O_HybaV|p>Jawk5zMD>S1JF$)*MhIgDJo)lzi-mf9#kSg)znJt)4fee`|l
zhb$D8(N-GJNOO9zVkjG#99v1NlXiX4rT(+(cOOOyEC0!LuC8kCtoBjAzq9an+*?Ag
zxDuu0N3>kAJS784<X0THb|pdV{o@}ObCYWdPU@5caTg2i^K%t{#d+Mor(LD<&(%qz
zm&z8@6-+<9u0lb&@GXa1sl)DV@TJTe8t8hB2-_jVOmD_m6b#oeEFKAO$~vBY3M(&p
zhZ#x~Y*KSp(olUQak0Jr%<~P1O;!G()?Htq+5U5z2z4hdFK;X{ZdTK9DKVQ;{-o37
z@jDvF!k>MDg@uLvx8W$@vY9dPe(vA@qR*HLFlX?m@IVnqK|&&;UcePKmemQ9+w*!T
zsIglDnhH^9SUM(YXh<}uNlrO|o2=Zo^K9TRfKgNwuA-ZqdGL77qqY+nU)7+wnJCAK
z9LTKyq~TGkuQT!5dfBb~k-b-(Jt~8)7pjb_#!TknW7lU=`{5i>v?>O&(dst7f6Kiy
ze+$+(5TvJXNTZ?F;Z>foVt>7jOi)}utYkwgGabVdcV^YxlX0LZ9i1V{6W6UCNu=I*
zS;_I^GA3#T`MAW0N|<m$2j5foJKKu2liG$3eW;wR)-YlpZ;alqU`b20SrsOmE&X4s
z*S;v#TIHLix)k3^P1?C*S=-$$fqM68r}NW+Uh-cS`+qt0b{|--^)UGb55CayILzkO
zo14|$^Di7?I)^JR5fH8<Z4^5-n$t+&?;2!s>69)t5e)3ee7$Q`C@1_D3Q!H}F%79p
zT8Y_}vgw`>J4nb#&4-*K3XS0oM&|o;(UC`ut<$C!GPtyQG~BVBj9*1WYgj$<&6S68
zZ>b8jlBLvLln4|`<a~+k%eJi*jKeE_k5W34%f8)s!6<l?_XliMC<!KAuBzcQ$&Im4
z+$K$KRY>r9>(gW}eUAieScZ}E#8$;PR&jzSpzXlt4FX^5mTkUm#32tVyi*Vr``;Y%
zS&i)r4~aDuU2vj)ue1MJMYWlj&=7wwC+1z(qaM4TVEc;UfdPF%A<F;%;1gY3J&gzr
z%Ff#7DEFfsreWu;3*(M<*5<YR$(Ve{=Y?`X<A+`9JWP?xvT`3p<)>J2?<J5=(RLl3
zlj>4DK{y`*iP_nI78V)|N0Fiajm7F;EquwwnUAZkt_G9`1}{JXnP7HlNmveOv<1|I
zVd03TbHbw|rn?ccHWnSt^!n4)Z;8vGRP)%{DxfAWk&k^3tT$*2_TJ5{ozJFAplY~F
z@C(tc1smAuoHJ6)%v(dPyJK0W1Q?~sPLn*u>F#1vb!z3}STjUM7Yr#0<U2m4?wB8l
z;!56=#Ny!>>Jwvp+^qi19Tl3dq;g*0!jkT3=~Y_Boder6#b66RUZ@J~17k-MLyl3y
zIXUf9q!yu~eUYx)$MsdH60tku`qP<bdKP!6`S`N?cYyZY{Hk9h4(9UrxJ4y%O2t4X
zq#Ly2zdAoPPxX(ShiVkUwZzQGZ|~qs>G+K+&k$_RQQq#)Ad!TXFwVx<RYc01wm_qU
z1wjdP=soI9jmU$sQ8nTZY?M&upsSi3-zk;#KUSyp-z)P)_}mTDaw)h;BbAz22JuJV
z#<PNcIs1GxERTszUlpRX)7Gf|^qjKGO&UDq?#Y?ZdRS_cXkixr`D3+Bl5XodIRG}m
z!-;1xeL{NKUB5v`r4{+#QiED4CDe!4Vb@{z=%?xn0PRZ;&0tY+H`Cz9xtv&~iGy{q
zY-9Zlc#dx-9Qc;b#U(6jWfj_%!SLQ_HFn{Q0t)oI^A_qNz6)*~NpYE@(`4^-Pemfe
z#}?sDXp{E<^GDE#uK}-%*@7Y(gc}c7wUAD-i|A%9Eii(D@>m^#-N4wa+BeNO!GX8U
zR!S{ToLbw<pyYg5LnrrrjCAAzF&T=ccY-DirO%o}gLngYvVkX?^S20YKy|KrMqlLt
zl$LUS{9%>t=5#RnlQjr-0dTWc90~x}4Y|M%0TPJ=FuhSjaV%%3)@wL}l5r|Z4c(%c
zsO|P1XJgdjwO$_`2~Gqi2*RxM%zYPCHT?q}tHSv^ap)0w6!BCS^Yf^|C?8E*Kk7`?
z5wfqnsoQ>uq{}U9Wv7x>Q&Lok4m6<u-n)ye*Q@17sa+LJKSNK+PrrA;RupP)PIP&U
zf_>V$%4ZAK^Ne$Kof^lB+^Gp(8S(FA=W<Hq{=26V1T|Q1pkFMJU#L(q$axl}=QI7m
z&Q)co@DbFg;xd`qilU?C%uq_!E=Uz)c-D@Vu2Uy)5+fVnskM=};aTX|IHK5QaY|un
z_K`Y4PMbIC|M*G8)9yN??E(8blMv1L60|}oy3%(D=@ivODr3FrMq_C+n&ry7w7O9D
zDgODSXt+iFGSKA3C*Az*q?l#!6nTr&^1H3MjnmT%((BB&onGH#SD9P&GNiSowvy%Y
zDQ|fwy`9~ON*Q>exWFE0Tx>+{;`eq0bm|Qa4jU#hY|p?q?bZp3?{wc;A2#_=Vl>}{
zCOuG}JCoi!e8*ecH?@BuTQ7unl%RQ>E{>ftvxy4c@zuriv0a{Qcr-n^WakvoQ&>}V
zo^5w2B3Unu+CTV2z$~o<Q>}-Ei?XXG+CFNKNmG@#9(s%>8YgZ}ov;DUFCh65At50&
zZsGUs;#5E*iwfwcKohX0^VH21MQe+F4i_DKK2LuxvPBhK&d$(VM9dvbf2#gky~s;#
zF-^Mr>+IyjGw2>H(_%jQqkTD}Sagww6=}w;KA0fVnibnBB!$8~N0BmuY`f7y@qY7_
zg&g()H)(NROK5)AIfJUzw)VEWx@+R~w(Hvi2B`6_Km8ZLsA`kPJ?-P;RtYxgN1HK!
zR$y$%2<Pt$Ub;Hz!&^e1H+H;Urr+3B%g!2p9H$Z+I-=Y^x(;SkFswSWIn!M5J&so<
zF@RYu40d)mz2nPOUe8@ARbx_F*W;z*@a1ru1}i2TOu?DdRLi`QO0t@mv=>TN2}|0o
z1v^56A?sO~&*Jj8bo;B}Ns8pwFCoyTi4}^p<+9(sT3r%uY)X5xgVc&U3Wf%1<35`7
z-USUaz_sGbof6vk&xxYpo2`eReg`=WYEke3+XF(^Eg4X*wg7;Wspve63`9ueM;e}x
zTcKU(+M4Q{uPJnPGE;YYy6i{`R3>Yu->h>~an^=aU4e5ti&1u}!RJklVq9=6MjLAy
z!F6ZVH)Zp#<D11Lg_;2y(9s0Ri2yhttCG_Cf0O@yxn|5>pAD^xrQOi|NntHO;z1QD
zmijE36OGB_Q}fvDedqi^8mfh#8&fSat|D)InkGSVW1|H@poz05lTDTzQ&`F8n7Xh?
zVL#6pol0^`7&?_s#=HDv(^{A7;PYP;6G$ew_#tHctNb#C;<0Ifbkl3V!t^3^zopQ;
zq=_?bo21iLU-E@`s5>wj`^4LNE$m2;f>O2FUBm91kiuAhYI_;kz*Kr95xfpIM#Z>B
zwzp>Ke5p}(l?>hAp(&W*P6*&I-ru^{kSV1AE383Jsc(#d5HtCd%xphI6(cf~#qdOB
zBBAY6WgGaT3(`X`a=H*s`CH$95SH~Iv+OO`K1Q_GdzF{Os);H1eFt5kjjhor&y;AW
z*L`Si?<0@}%!m=&R3Vew#Y5O#UD$oCsUJ-gv*)x}DI=o(+ZtCVZJT1Iyqv`Bi0F68
zk@?q)8gF=5rtkO0d$`#5ThV)%>+W3h^_(4zr;&FVgq7K`htIMmhnRrDg0!e8CZBf)
za2UhV&+Z1Wq}kAZp6hNM*QKSwrZUi%{);o9^riRJSey$UDLJ!PBe8BL@wzF`ENeIM
zl{fCDvL1!)OqRyO<=G;HtNFGt{i8w19G6mPphA-O{m-ae{Ja|J(*DsE#(h&!$?c_d
zs>4cK+eN9_$2y`y!^2yUlpbau_-)-o$se^W)Y>0v<sF6Ib#ttdMl(Y5EprWgR$@{g
z^t9CZw;w)Z;a;ymQc@XDg;K|~cpD$Dy=o=}HEe>X`Q48wP|*471i}AEi`ACv#V0nJ
z#W*uAPy{M<Idnm?$m1DZR$tQ!i$B|#Yb>}AI#gWC6U@)K2ni6p)I^+Vg13O+GJF3n
zblQGXY#g7(2tNZguQBqtv{*_}KcY_en{?VodxKgma_<%tddu*-tB-~7l$}>y#5|R|
z@1xJLBWy>|!LK7JJVPH>!&LS{BFjPA{_YHt0Lgcr<s{vB-JI`kQvKUG8DWQ4<Oln^
z*Q0ZNScmYI8OCEX=bNmzOK+$@N*;w5O$Ss~N-@Vd9(6=|1kh3iI?O>$@I#fP%Lhxj
z)nCj05zWHphqVMYK>yTN;pf_dUrNhUXF&3w_55<B-``ev24`D-H<ER!l@f^s#8|m|
zW9VG3_4$whr3qUg@zSv5eyPXqH}P`zzb;JuELkrg6047y`Ej}F@uzU(tUmzdQ9FFP
zY<@$q!z1s1kdQ90(*%L+|DJOo#MGt+CtJI=RGJ&O&k7AFIE(@a4hY8ZFdv`EVX&5e
zjEdk5LtEF2W?>dr#Pscf#Gb!H{ZcX1nP^x~*QCt9usICclN5YK>NxPfu~4K=7D~e5
zRTi7odw=NN4;~h~E{IH!xt<^niz&kAaZ2`1B}UQ{RP1oQT*}y+>l7m_ppe$7DIv#y
zo$zZ7%;XDD-L4oYeO2JqoL+yM?I`6f^TK+q3MrUE)`Lcw3@5vBsT|)ip@sgH*!ttF
ziZsazb*F_wIGk=J@uL*qp*BUUmFYb+txn0Lv6<5ov!WQmmuUMey10|`UyENC(@q54
z#pd=K&#joD^pDh#?+!N#IL>=kdo9Hoz|2$-IHslYMg=@yfwhHedh48)>D(mDWW<MS
z$Y3aFNDrIMRmDFx+k!JW*!6$7La5-*PC<0|O-(>B4(N`!C_#EueIr!7n?$-_To_Q8
zEWd}QYTTelFa!ekf?@w%6;f0(vQGK42veOf#fj>s_r)?g$&|K|5p_>B^n>QFdU5OH
z(!{XzfmbDsuS;g}tQ|-VUkGIQ+n!=pVV2_Vzc|#hs!V%)CKhisN2mEX7-%PLW>D0j
z(?m_b)Uz5rm#OjT7-<Ba^z;_?F4@)PN;nsk#>;O(Z(3^g9A%!pxd>wNs}78L{U}9d
z?Z8V2M$|#(6XAbvKb?5h#>MlEqo%K^M)=Y{H=p4gh!`<grvwHL5^0Bvi)&nu)z}n0
zJo))yhN*@Aw8#Az)V-jp@S)`zS#JPr`+7rZ3{GS5wEuDa$Om?zw<~pi6XG6F116b4
zWBGzQVUbtlyq*iWyN96~rq;QJ>Mkwe-*=q`EANK~76)s`;20!7D%{D^0hgKSTfxiT
z^Nkc5jC{6}u4T+?kD<%;zf{_81@@)VmDajQkJK`OFetq3ZwKf%9yIAx+q<1@-j}A6
zT%2`y*H4;}ZZfi774Qf>qO5K=h9)6bH5--PcCkzlAS-|-jXre(V5wY4Q7?eKkRC+j
zPusijhz<_nib^4NL^=N#5aGB~CKFDsK%{YPJrNIsmGf`emry8Vps(0dqXR8|{=XUn
z?I7}a$)HzGLHCfqIIs1=?9|{GxZfU30+f<u3jG)5Akh59y^4*mAedg7nr-O9&JK+Y
zjR=45dv`M^3V?r`g(^~A@L7?3`1!cO^r4Lhe}Uoa&CJ5G2@nnc$OvGQ@I?VmYXE_*
ztF4{=4>|)v^c{==b1GE`fEw~s{~HTUa`apV_+e0bI6&{4$?LVIOV9ql!McBYy-AHK
z=iTQr<)=nSlHj?qiHL(rI@fFXWBstXx2@;0tj@nN#sB$n)m%sW!_EajGp>%f&E5qu
zZ?hF2$>U7ZdN3BL{yK!qwOOn<r-%PW4gs*nII9E^0YUG7s;~4nb{zlE6(S{(J*yWw
zjkT%|1aqdwX68AOj~?y1#l)1*A?GMpU}ew`sB35dkQ{&qIRo;EZ(>~btr`70kvWY8
z08#^u1qWFI1C%xdMCVsBG(R@OS#17&nVysdYwJ$cnTJV|1>;F$N5_Wc<;JY3!L4Va
zeuIqq00+{4e>wp`>qO^Zl)`)aZ}0C(Lc5aeeh>q+(%-)j|E;>edQxATNNoN#WGC~F
z1n5y+m~|{ZpQA7|Z*4E#+)!4yC`(`p(hr6T*@-3yhBar?kfcdE5H_rBd5Zo4tMDZ9
zi3PeX3fxPZt|Nge3;?p+0Z2>lgAF){EC05NWl8{_%zvIvPDEk<+{TLC-fI&T32yUA
z+@Sq*`Xs6s`DW0#38b|1H#nzM#F^{<Wh)ihrcaScTf2MJ=hE>&km0~lbF;ME%4dOr
zf<MXHc9JnXIGL=I&n8k+d=@ysSakRU3xI0qc?TZj_kScI1W5nX{%AZH7+6S|_u#UQ
z4-fIVFWJE6<~v6B6VUGc&&L6Yo|}z6N{UV*T@cO(h;c`Ol;Vhx<ig2?k9W38jOeuP
z${J>c%=S$m-H^c?8@8kM(<(;s8>DmtGc*25$3qQk>iW8cO*u0K42SR23r`Wnow)N_
zHuOM48Wj_BWbc|CC;H#j59AQDETgn?rLeu7D`F7)H)QXOxw*OjP7ffU-_P(gz~(3a
z4{ru6u?hf)uPv=?Tk!nL59L-Fz{(g4(b~p%WwODa&uMM3PMh7-fEin8upKNZY{<B^
zIb+RQ{&~zxbPSX2d;3r5&AbJWt#=`mn@JfY!+C561)+9<CE;2WW`m9kX<ih_8x`^I
z6b6U04ma507@SlLMtfsw;7g4%NMc0$;cmCkJ5=>aAIjo)*;qxd*5WSaUN_c3TM<8a
znHWfZ^$p^&*L1mV1}pf-@Ty_nZF_+DGW@$fi&8=d5Ih0`MS*`(^Q?^0Y5UB7$kB$;
zu_>F6mhr|Tf%zr2*cuDWXYtE}&m+%zX0L5+OB-W~^+;kECM~)IRDLIJss_#Z!Ir`k
z7M$U6rVwtYW(GjI>FPE}D``{GagvaI%hZV@5fUoAv2V;0ZaA5_DX>JVecC4Z8zhyR
zmN95kn0&+;GaD}+^?3KlX04uxIm(t~(v4PM7F+OoI-sr4!p?C2_+4QS+UNnw?9j;z
zC;Xa!Ko9(5rC6=eO8w}2$O&HaKekQ=JER}$Kn4ehJVUotj8Bt^g5<I3{{-Ao@6VAr
z>x<FUhjuEkRs&kz=@!Ia)(YCg2i`~5Thh}Aj~-QTa1yGg=y-cKmiPu4bp4eU;;DoB
zzu<xk3y;IH1L}KC6+na`o9KF%RCHQ@MPw}}QQZ$juty>0C4}%*lcHyjNCJmB%)GOy
z#o<0)T(RK9AR<4t_K2bwF^164L?+w)CRX`Z!~1%4$Q3L^^KJ@S75sy*h?8V8=;({)
zW(!PP2}@c^-sP8Yf!|U2Z7-}=CF4F5M!RNXvbnX8Ck87pzPJ6VTyjIvd{4Z!CmBSR
z&ZPM^#Kl#up#A^$`Pnt|KtP}gq-NV<oGDsuE=MF$?Gfij=M|bLIt-Zjv<Y`-_Di*n
zU%yT%mCS;Vo{?D0ZPmhuvz>;sQcsu8xZq7)lWL>N_;{FkntsN(oG}YgIH*+f2@`G!
zj&_hp7zE&%29m<E8Y*_zF)&%fMb&0<I26?j{8x0o>(gWIWnsJ0v7z^m5A)oxS$Ajk
zUwNnX>i@ZY7@#;>1dk{koU@ImT{HMN_&t~-a(?h&@wccNUbp^_fOWpxpq$7daUa=J
zr?})3lw1AokPQ3<wr|{|3cj~;v8>!Jcj6*vmS|`KbgDIZ!ncmAQbCoz-$d$duY#^%
z(L{!AkERn)CIoYab?e+(HqE757g#|yMPo76<E1l1>cwRSljC%w(I;D-Kt%Wpwchia
zfvcp~doK<&K0_&o+7|G1vk)ls-wSVn5(sBWOjB<-zC<MUhQ19?Sp}tWLCP2AA8oFW
zF%0}y4<2s_)`AA0g8}xBo*AHnfhmx{DlGe2ED+6loM7}7>xR~cPa88-ZaF+$dR*yO
z9v7*gS0~l+yQZ`JL2`S)?D6op{2|#a*^NqsU42$XX%VUQL?n@E6u)yDK1o#yx3m5^
zYI~}}NnK_UH_UMzi@%2Z-)pN=d4}Diud`kdGAWk)sQzzWc#qtZZFxovY8$wRtP*%0
zPrUzm8JM@2v{fjem{pPz?W-5O)U3A{-NtlJJbM(h_I8c)@Bw~qi~vAi>!>kY>Av^j
zbk65##egNH^S*k|;g`-1$$%+yL7XxEf2&$R0{ZuZz~=|iC}~7;Z_uY7Xynu4!sfR0
z+)+B(C8~8j<5K=S?^^pWNS4x~{n*m}$=l7m@yGgn);q242QnM$X@qKEY?bTkM5MOV
ze0Yad$Xz`knMWQU27alu5n>iJ_cjO`XlekK_EC&t(QhkQ?r_*`cNS=`SEHKXc_qo1
zSKc(~DiY_q9}xtv9*qDPngZPEf5bJ=;GibM`WO-YB&r3w*p2jvaZ2W#u|28KsZMp%
zd}L(RJn5V&p#-QkMj=I<xi#D3zuD(d2nG%y0!8x#F@Fz`4j?-iz+)(p$<)TjofT8)
zWI!h(LQCn7ArzO58ZX4N7P5@lM>+kZ(xKkpYW|8YwMaRYSQ^*O&d9&OBA&feYJSK2
zWlMdKL#;9lgE$pW4_8^{R8d7yJ-<u6xY)F?0(?hug6t=8ozE<!H1ky%41BMzyaq@l
ztriKGh|LK=EQ7;A_8Z^?j5lx8D8NqR_Uk9NN}yn+915@;jXCbz@bGf#a>g&eEPerk
z$dx^S0?xpdkEg-!PjSF;kx|s^OR<GaLo#nKoa+Cltif3_T1%nM5;dGi9#0W>o<Yva
z#dPAKt#eVZ%CkTihQMj^`XyM+aaW9%_hpFg+w42Xf3?ADRWtdEevL?aykadTCn){~
zA(#-s4?|Vm>v8qR*DRi$F=mh)f&zi_9YqPFS1Js5kMa=`gC)IPTt+k}D6hr}Q`^0;
zyK&tw>&}YEbw%(#F{rbZVa+?9qB6<G$T$eG7~Ale;E_r?`{OKVB-n6~mezjKx2lM=
z^e){iVna>E95ftQd(u>dNu27lT2Bw1-%a<T`>QH0f}qORR3%$t9Xr*Fz~+nJ@fd>1
zC1tnJY1OglnXPgs+d+5`^$RtVpKr&pt-<lnN*Z(%5kJdPG}56OHgW)I-gPXLpy}WJ
z3I>A7qnSDpwo}RW`M%8sr&6S`z@6ks(8mqANDOv6U`%Uwe{I20w>sxJe7ERr`SC*b
zvM~IAaCez1SPy)aFFm0<xQP54Yi>{6$lijk$xhaKJKR4CW=<|I1Wp&m+>_{2euf5J
z7pAjTBi?p|;m`V>vfR%v<T#`mtJ~x>ob;PvUtWCo=0_ZGuaRNZ1g^>mqi95egy$qA
zZUWUa_WgyTmBJ$h%h)U6*)D9&p(uIurxDsz+q3uL&!d^`v;?yci0v56Yu*aZdVK}c
zQ^W*@qzE)m)%~4YIpQu>JV7**eDPR=Ld<GcA3lX97}G1?*WE~1k2)2m_UX`dLzN9X
zvmD=0v6}fuVkW60gT!8l{AqG~b=lo&iVMNysX*XFlD*F??iB&{7!NXjG_9+q^2{cw
z$pfRS89x~#a3$mMbt+YzQ`Up4u3??mRuvJfwS_TdB1?pOWHR&ll!N-@Q(eYq?S&7b
z;!{0*=$TP?&(%#-9fV%L##3l#>%?DNEYEkiu270BRH%y!4Go)9(swmH%6M9)Ow0Y@
z==XJJQlL9#O7~_FWG3sNt00IDV$+^x()m<&5wrSQ@-`#VGjuU<?^jm!6;;)wrXo_(
zCaCvPa+yzfsFE|TwCtynv8w5MKqIk!a!}s*i7}A-tSVSeiOTja0Nx<3Tn5lLFZP!S
zBi)7i{Yd;R^zswUq$Ui6qM@0Djiki;aAMu?fJ@hZ=?v<@?BFp}1_m<R40MZL%jF<J
zY?E5(XgUAo87&z7gM*i9&7U^T>2F6o>zk@)1AO!=k3MjXs+^eT2hr<n>tiy`3*|JV
z`HeLc!}rhlY}eGm$v^blR<rP!Ha66%>CR`!Cw0cxKJHx}OPVi9l|+zA!ohn+{I2=?
zz%~6`<z*VVG!xkQ_Set;9*dxIf>lzjrh0FnJ{#ZVPn_WN6{T#9u!kK_R0$+g0DG*X
z3jYGtsE^z{7~aVB1FHqg{la#;BWR<#*X@CniO828O#kQLz$ddV?y{f1cB_8nQrqA`
z9Xq|WCu0E2b1w0>rDaLYl)KeYCLOJcl6Ea%T)18L{m&ZjbZngX*`Mhr`>pFtbMuUI
z^G&!_Kl?zmm(wK!?*sL`^n5D2^eUU0lq;3F{*kqqJl>3RP+jv|-n29Sax7t742&Xj
zWCohfPXoxHR%z%KpKs(6A%)jT*DFH@G}Y-{V`k;N79YySRjn(^PH7+Z<pk%SSO`Uq
zrl;<BTZ}0eD;j2S(IL<2u=!4ea6q<($&u3HDzJ(`V&R@hJ{So5cqVbf+jO>w;p$B{
zL9t)?;xLsSqYOJOtzcY--}@(^|N83nx$L%p@I0}Y9Vf>38R8zAWke;&p7YOF*FD=P
z`@@Q<%`A7T<Z$7CEu<~sRwmBo4*FAvrQLv4SO_rTAf6xTI04Q>s_iJ$l-OJG8T<CF
zlB5pKs34Ifm~@7O@|sJ?@y}W?vIvBN1M<lfjhmy=n|w<o9rX&cy02qx#EOA}I0J)_
zIKn5ZJ_-SSyAX&Sqc)dZPCNQyhdw5^pBazG;i7*;Oo7MOqiR<^*znn&4&bvM$Wil+
zLFLAsoHQpFJ`Au;Jad28Lvj*YBXqJK)=pt4*2B#qnezC_WMo`<4&M9AvWl~ewd78|
zYnkwzMinFgD&Zx_$pmT(?@ODJhGlJ?L>YMQDKKB8k-6DfZHHQysf3;2jpELzjf=_x
zV4mYq7u$uDITfF=nT37}!G18NHQau%rHI-ZkQZl}eXuu4Wrc9A#Wh;TjVtVJlH9I+
zIv6z+N$LIO1t9`?oD5*GdD!w5v8F4p>ol}4{ND9MAXNOKeR-SbyUsI!7qcaY#xr7F
z!<$aHdwaU~%KP)TmeI(?D-E~(JqF9A-2S8b!>vm`Au_x&$;P=%hO)AQ4v3mjb3G&$
zD~N7IPw4-V+^e(Ex5nM>wcajOj`5p~8^gdA&+*a@<s%5c5HYVjkH0hDL)!@tMm$<i
za?oz36Z5C--a$l!gVs&sq>O*ZhlCqODkQj^LB>h)2T~w<#~K(t*k!v*=Hu{sWwdKH
zBRa$ycJ7^?pa!%5qNd+~@~X&E{Pq7IiN>pQ$;_)M;dcsAQ|(~a#<YA_FkgyiSzH*1
zO0@&8lpB%8C>TJCAC|7j^p{Dix1U!`YfEdV)xgMZl<OPx1a-YS#E2A!TbTVYKnrkV
zs~iPHUoZ9a`}Q*8Gy0}EF;yos-u<?X_!t<$P!}(6#27N!@S85@Y>FkFl~fFC*7TXH
z!I90I21}~ro$YNh66WvOd}?=WSTa1Xf#|{Z7A(?ppX_u;L4bIbJM7_g=cwWM&q5ld
zl|W|KXzx2H{g_=#-*yO<{>exYeFn6@lN1Q%1t=I82hJ2wqRPM>@m1Xb*p?-?9ZsWV
zQqQsQ&h>j>=3`o2=WQO5`jyz$WufN5_I%MpdLFHbq>q(`O9=V@R`aKfQK@sY9J@aD
zJk3{gH)0X!m}wtlT>oD+z`y@$fJ>VGVUXDU!1L)=Y}nq!?{-1r-)*R?FBh`?gv`RP
zuQKhw$q3gT|E2%7n*LY;hr7k+0^qu=8OWY@qkTC$xMU#xUqcY32x3!-Z#}O-;)umJ
zZeIl!Da1&Br6?VWqpFkgajR243?t@^mW#_*lP$XM(M%@FKjXsdzrqOp(p>jzkfxxM
zi<R^v7N@>D-*Q%ZuFMj)-V#LYU5YD68hRo``jP*A!90_#cTtCfPDP%2XJK`2JIe!H
zT}8?B;Ws1?T^16}g?VNeN-i>Ju9)QWjv~uyBp#)ec~O}}nHtkF?HjL(vsgWIi%C_w
z(}P$7w7~C`KvjL~iJiQYeF|i5SsbiTa>Ymw!X3p?A|7%G-9S^DQ`0B-R;N2lTQ6x}
z&C5yP%$5A?K8yZr4^BCUi>5pMETs2gN#2>daBn^?UYg@;*5WiYv#PbGPy2Y3i8O(3
z))^#%4Dh>6p_4f`U1;O|`x!Wv&S++Uc)!<?95$QH`d(Z6JUnC!<+4@`loZ+6*nl$v
zC%3b6^MTIV1`01``B}}M$uLG1sMP=!n~*XVdPT`1Bz1m7Uoyb^`ai<7@DE)-32AMu
zIS+|yh9`i1puyN%`rSx;gNC?qp+PKJbF;uk1+^-ZEw!V-s?BP7cI*4p(e~8QwZ1!K
z*^1dI_t-fUdh3za=bw~Osy=6tJzb`M!SNMA>$i{9=yo3DcHBL7;NVFcSx>0%7l$}$
zY_BD-y`a$kmMc|sIEf!YpEv|}cF$~6@cX%`r8k=q%1W+#n53w-PDWVAZW7WN8_36{
zfTD!mQ%PpI+=<g(CF!dP;bp1CL!lT0X(e|Jxn3qtL~Qs(t66!i8;8$iBoRH6lDDJA
z6v=PJQ?IAcg<6O&Z?OfqtFYi}w;CvnESfg^G>H29t#=cBQpJE+Ba%Q}r9n^n2FYCB
zk$x?^*7`A=F2)M=kIMXzrRR!6ZrQZbEJ5jPy#?TkyT2CX&r6xipw>e6eU_QAe?o&^
zS(S5*%UaU_zwL3l1NPG7QH8~7!D(R>iLup{uRkrl|82F}<Fe<<J(y*W=wMnW|MMn#
z&~|*Ss`mcuho;X%c*Jx)G($=+Q!LdyBldD2c6;(yjkSi>*406XuN~3$O$}xMXVr-d
zt}L)(5Wk4X3LPBV-roK%d52>ml?D$B)=>a>CDp_HFGnoUr+5NvFL1NiMy<l1pC*^m
zJ!vgVLw?<A_+a3m{@{XAs3b^<CFHsH+Ws$MWi)wBd8U=)D$VADUggV`+Jl8o<rW_0
zOUkGk7;nqr?~44@=(5zkg)queih;67kf5nQ@jpYr5vkKrp~qi6JTFM%QysQ)jVC&8
zvm8L6*<^CL49W2fee-4a`yry_Q~#1*&5Y7%iL+k4g@_9t7?aCiYuF1Tfut}08K>Y<
z%AEt%AwF;zgIxt_*?NCED<g<6TcKiXO(Sk06pIy9r8t+jQiNuSBiUU_Vx=jZrVoA0
zTthvA%ZW~7H6Cvbyy}VbFXi&dQ2$8TxBWXzd~%e@W%PztOq3kT@sk2x61)9eR<x(+
zr-`-b00Mzw-wTp~O!&j*8j?JPh1hZ3c4f6R-QyleAvgQ=CQ9*N1+Re$53(3d7fss_
z{^JMg)iH($_<>2}7_;pbwi|0nZW46@`@Qy1j$s3XdEONDdk(}z(&Wt5##heJrpI!t
zMA5)C<bW>n9owBxD=6c{Fp*>2_PMg?B06vTeo-DMi?;jN)rpIbYEmULW?j|U_B*02
zK0&YBu3GvZJ<x-0LSZ6mb27fd_1Mf`OdW5(zFJAXcB&T?7Xxn_aPUZTFfXz4_;_;z
zbdpSt`)6m7YOUx~fbepTpaHsZK_|ayc%=iS0RtU<H=ig_y;it_7fjsg@63|HXc?6F
z)wU7eh#kh2o6Qv8HqB(THd+&3NWRK31oD?gkH5ne*E%0HK5#!q_T$^xG(B_V&2b<s
z8^40{XX)Mv%eBOm#?mlAkw@)*vEbiN#1$B)lCC$T8U~67qw&$G$A2}J&a>_J7f2~E
zK+MCx<|dU;g?Pzs%<nx07IzLzt}{i@CEYRlWMx3`vw6Mk;e2gj@sbxc>c~JA=dt&W
zi2vf7wIghbjEpDihZaKuO(y4CazYkmi!2HXQN#<)=Eo+IudD#cVAAu(w0sCAyAS5}
zb`P#34PQD{Qh2H!7fuCJa0o?c;x8cjwklUQ5Lue_Hs=C|Ra*|_qH4waYc^r=GtAV~
z7(I7suw)rsn2uInGw^qxO1uwsyUJIAh<R(QDAdW`)Y-l49z&&d{3tykmq+6}Y~vP>
zss=A|#*vu%U|Mjhb(JD9E6*Zbnz{qUSE+PtxL`7wEc#SQN&7~(#)VW?P74bQ6BA8p
ztVU44xeo_kq<EeoRg${RW_^Of{<mjlkm)C0MT-prU?fM43u+D*eD;S9S3O%Ht3Vf4
zL<Sbk4!iax5>a~HL$8k1c&Db+-pp{UsHe^lBJo@7yDZU`kDgD8FMVw7sj#;ryE=ns
zS1gs<cc6(ec2V2g&Mr}<m8s0YMSz5SEdUK-s(%1(Q<4GDfkw4zyOSzD(2u0}RC@0X
zLS(e1#PQF9QF1JY)tI?2bq0)(?DY<#fCGD$E<?^4(;zW4=>l&hT4Hv5W+8jCiG}C$
zVJy)$hw>;@jrpWUoh7C7QrVOcwf3`7WcVmX1Vm0THa&}*kV35;OxXbV?b|j;PbcAW
z<er1no@n4a?>cw%<q;vOn_bvLI_R(Sh+6vYqnnpqKJUC<9s8o9gcGX%V>6*vW?_c@
z)qo-A%0jiY#!RQ}zTH<oe!IBRZAFa?=ZM}<5tNKxsxM%wrjWh|UB-^iHK$X0d?TY0
z;}%_#$~17KNztGL3oqbMP#T<p-Gw~^OH1h0e&@gB<m7G@H-M=e(wUq)+<i1y${YDA
zv13oFW3|-7JN)<GO{CLVo$s+~HiUj_E8Qka^X41JFdGS_W_;L4aLis`r=|9V&pzVh
zcBiOh=P@NwO;6e~lTr$Eics!{FAM9Gy8s&$W4@7jZW`LKz{sVzG{?=RBHg@*Sh-vr
z_@DeQKd8i=%&*5JtjDMLQnrUl8g6KE4d_^zDJfYF^wUh2K3E8f#vxN%JpNuwjH(gH
zOFvr@e`y&bG?x(%k2DJl_K+JYQ%F;${~Z%aLZTGBP_NY!4hhI4sDotk=g%_C9-@US
zhZKF(HE#$TIp&Iz<~PjdAHh4M{J@g5TAzh}=cTp_L+1+bUtCxpBYq@>hkIyfXh;nE
zrzQ33mUJHRjtUaSy}het0Zk>1R}rw>hoIyA&+Fx448=)O%(T20xSYJ+ua+Wto(Ih6
z5%}R^btiqb_Y-!AS$i&L1kIkcdZD_%w*>G{Xj1E}=M`=8wB-mEN=#{-Sx_s*y)`m3
zi{;Gg#Q163`D<6K-=UyS)HS1O^c=QZ)rGn=$Fr`IqA#u|d%b4;ka9f(ZuaNGV1E;f
zO!?4yz587fr^bJ?mez#-@^g#Rg(0i}6x-4HC&iv2C4$)idFhI$IQL|jO_OFq{9M|1
zVg(fM@thG<wA5-j&E!FQ7&4i-5`t%)Ky{paUKJlBG)!1imbY@1n>YALRiiF(VVAI-
z2c&#uqk=lKrpD;;oLN(9iyTRrFieuz?5&d8X7;DSF9fobiGT?%7!>?KyVt@NAY3`1
z;1`6>eHesBg@NQ*Y3pb!;-?XZ%USeo#6`?dZbG)|FPnChK|^cBl&@T(Z+U}U^piJl
z%|NB$%WC++d@~Rs!fLb9Cc>yMBf7UZK(KHk_n2oKvx3itz#y*4e1PgJVrsatOyD%B
z){Dz&G*%m?=bvAgeV5bOjhEeL5@9S<A?MjLvu@;mEZj|zj!=<k|AqW-Rc(OEkX#Y%
zOGd_*4F;XzAMk&dQta`;d+UXLn0O=|<&MsWj&X04OLWJF;`BBwpo0Dc!u_G7`$IRu
z^c6&qstT}-5EvvcjE+%gd8R>8F7Rvh_Tzt#qZ&2z)ws|6&Wyn(li@6G;N57nwyps(
za9Z`=03IPPcWOe-YD^LNe4>)%S5`M3ftvqI#9&QvA!$zQm0q(gk-J+XuS>H2F-L86
zVWSJ_r_K_4Cpb25>yX6^ha>yMZFakrHq+hxSIKlja4amW<72Bg7#MzNg21#eB*)dO
zR}S(yzh&rc$4Zrhh5--`$`&6aXc5GYdCOD<t)T$J)kGZSRh}<9q=+!5qWR3~_gK&L
zl=>o}rkSYLKK0(WYKWItHZzPg?)R;sZnJ&od}rCzh+%=AWZ(UT5Tn#lLS!vOo@icK
zOw^n%Z40=n#dI#npkumFw4c39MsJQ9{#G{}ptbSQI*O#p8`<vNvI`E@Vq}G=EJN{~
zoodjL0j1~Ds!gWPBdoU1Hezm}UyN@2KX^l0EuZmjzgu`OR=H))qfBtV>nbPGys62#
zOlWBH5HXRuyzM~kA#@9qK{sMEb5;gmOcoYjKWC;nGoTw|P)XB!@q!Dlp2#pKbuPwA
z1z{ASZf-~$tTMO<`Zk&wlNm5zMkOkHGV(J(2&whZPqV7)FMPrb2KAWMM?mTUzWjlR
z{Lr0Qz^FCAtht-7R^Yo~8B^yg&pr=T=eX?fuRky#_Y&!4hO$>UU+cCX9cC<;5#gn>
zIap%D`yGZmBynu{A9Nz%9LnBvmP>fSDD^gL2-YWs3@+PzAZEM{Qp>X?q*B$`=qUKE
ziEP;B{hhWH2vuTs8NbZs^=)N%Pc@KBS7eX#<AXNqaPesTG#o{T_j%PdcSFqQcK(8B
zW7+2I-E}qjmy7K;73+(0ih+9soB6Q04?IfFPzj<r<%Sj+H7@@x0XKM`uxSw0U4IM-
ze^i7pQAX(YWq8#To%h3^IUCGHdh|c9X#{YEt1Ss$>p8P#w4Id!4`^fP7$g;RZ7wOt
z*9bKZRI|jhE19Vu7N$k1vQdy_PcietX<eRAK6cmrOu_J36CbcADX5K$eGL@+&@6#&
zxwe{`5CjXngF{0HfB)*O-6;v@*#E?Xc}^|ltH;S1PnVr<(6822{bk}aV+586yBf27
zL2-ogmHM@4B4bGtd&zXsq^PdW--!i$My>8)WjXx^xuU!OAC&>N<tq0;;WB~p)m62+
zy(DLm`)_swOb^<b*QumRRdbwQJ0a-Wt9dB{)$=?Bt}Cf4Lrk>#50Lmvq#a44&aGMA
z5C!f(!>zrnCuG3L-HeidgF4B*VW0X~LQ!$uqGQMBv_`01W>8DVCvtPEyiub=lL<f8
zMppIfNN;E+n27R-dvLt{fzF|7>kQd?x8f`|NuS8j|F=}I2^ksZwzhbwsVC<A@B<Oe
zu_AM(!Jh3#ror=(R4uRYz@j}%>LjfuP2p^jk}fJjgZn&3qyiH5wwYimRx6M3_8ZHm
zRdGH*7`o#)58cDcY1Az;(%1vjRt)61sCGX5C}3%Dq4`Usau`elnfj?B4?c{=ggr<5
z<4N4iM|{l19n%sMxWj0bAB>@k!RkE|bs-~$j;9PgFxx|ZiV@6InkqZ@kb9h&QqLt7
z;C<ONz^*q(ZX#~q@1=P0O{}yue|YKr_xAoRdY_0{=pgl2A1DZ)q^%g$b^dJGZO2lZ
zsfEZX5EHs17VL{m$N=~TEL$#QPg4IxEsL>?B?N+u>;6uxe^&?K%lDfy>((4aYcq#f
z!)-y6PtZoDTYK8Q8XYX8s5qLm&z2Z`HTF;JAGi4qhhFJ9HJ=>rG;~)k)O`tby%twP
zOox!q-^F28heX&=Tjg3ixj47pnTn6yOO+jprS|3-KfP#37<kH4UxlC-hmYq?PV3iK
zYV*^1(F0|fju%SfmCK!MZEGCyp&Rvuo@4EC8j2uDQ(0%&;Mg<$lrLHCsAjOXH&9*x
zA64mJaqu@;y_w`kOn4RNX@utgV!qLfxeaZ_5xj5Ed^<Q#hZO7EbJ60JRCs+j8dsD$
zNxug}=4NGHO#@|qZ7j81CjG`cPI&#;O(?VaF$Qk%x6QS%gKPA8i-S`hDsQO@{|=-y
zk4WE-e4myz$4<p^VARWW)-a#P)<h<uA{k(a4VVWWlT*_v#JlN!=B_<r@p@twNg<g_
zY)Db#Lhx6nv`#TUQh<D`IPW2Y!{JQc<id<HqMDgA{b`bBEgvZ>4|f1p>XwZhP|6#i
z{4)18T*`Ha2j!C2lM{l2w!s18)!!3t8ZYn%(OhBc?g$!WdH$mTcr*le7|ht2-+PWa
zYn~oyhV<XZFHuPhujenLR>SV3iH<Ub=gvDLCAqKz=+WX%a>=JtGBqorsYhG%sV5kw
zSF~RmgL?I$59Tu<XI3}O&Z>GW>yJ@!3StmNiIF8jd=dFaZoEIW^yn4aS4`2oULVYo
zY-LYnOCX-@6sAyn*3e(1K|*NhL|Wrw2uP5_Z+df?;L;$5^j$r1@!m9FlJGG(pFuOf
zbYFl{LRGBJ*f6fRfZlQ!<8n)+w|ODMagKO{Hxo&vDtwp7q5z`XWb6CV*3!HPbR(%F
zX}^WE*n!Z9H2B{5vzVEz>B76*+tttO`FLgx1nl*A;g&B^dcaQaR!XuaBAWm<v>UEO
zd+dn5sWpZ;QLM(Lex{iQ3%mjTd!qqHj6hipHn+KjHJ6&Yy0*AG3x}WpbylLI##s3*
zrbfoUk{nvtCV2ALxEW6~CV<yt)Y7y!xJzEnrK|3){uOki9BorYD$i!-{Kv@6k>0T?
zBEJ>-WcW9d)gI<9oZ?S;0#u7gH*ABg${UT(8!yUfF2VXDrz?ZI%>_LBq7+u4{{&?9
zd8W%&ts^uIf7ll|#nov?s+u~hg(WlHNl5qSC~>)8t4H2}vgr%6!6~!zG>>AG|31Cc
zNGz0)Id=Y3H7ZNRr6AeSlmMm|Z}I9)8h%Ss35<!Q5Ogl<#PaeoP`sLx!w-x#T1i*s
z{3?<ErT0s=nC_nDOBp@J{_wA4Ew>qsek=+6PmTglsG#RUx>f5Ul6$*Y-haErN3=c-
zy|}NL<;;(q)iy>!DAT4*YA@``;?{C047i&uRCe9f#B?2EinLY>U}F&M>gq~@|B^eD
zt4OJ!pwQXT0S@X{Xz;5fF?Y7N2`qFgWZ%YjjP^bL?HgPQJoRhc-z*&N?Wkv9l{?NS
zTVsQ@b$z*bm+&!0{>gT}$2Qym28Ow0G>I*dv&}*L1Hub$##HxEeGOtf*Dm;z2ngnq
zO-4pbUl`fOl?3Is*-_OD8LC+<iLc|$Nz?Nx+OFdHOs4RirqtH;B35GTqCW^kWn_R6
zeyM<U4*C>+;2J@ta(Y%)^x`};i=^6tBQo#=P+=6|H(sz`q#)Db3vFgojbP^MGR=P0
zgC;2@qHANV*--m=ejAAq$Zc};(MX;ff{{iElpaH%Rdd??a&Hft&Zf85rN&$7_@OB7
zt$RInn2SV3tl2U6t5Q}?8}vsEeqb7M)bU8o-=rf&BMv#vU-iy~TrmahpEhE@%*CQ3
zizI?}LDObs<?leh&gT$DsJm1Da`9Ov)H}60_t|x?=D7Jx>$Z54_CqWvDxypr1Cll1
zF0+^i%siPR_;)acnL5@u1o5J5OQXuJ=8Oj?hyo|CGw!&#^y#!JT<i4qBU28U#HG=h
zX08qS3iE6@th48FhLJxG;8MRhMm&1pMBv#MH(kzTB3=qFgY71cgViWGV4c=u9!H|V
zVJtWG8}?O1N#UgLnD*w76WP@#K)txm(TpXc0Y6ZdD9`WIRDDS;N9{|zfXnYWPH9kO
zlbre^%O7p0?YhjE5?{@R^f~WGu7)i~y1xnYq;y{(RyDx)(;z#-%u@!~w!E51-?~KU
zP$8CS%gMz76NK#S7y^209H~e8;2;AE1%5*3qLb0lA^c!d&YA7$-E6pef6Vdt0x`X_
zg#cX8YBsfr9L%YK7EewnEl-9p)Oz#`8LFigWgSIS)aVXE?3Lf|;uen5=Z`PQdTwJ0
zp7<&Z&z=FhyNQ8tq|<z&ln?kI<VxY1iShaJ2S-`uJ`wRo^}Rzv<TnRtG5O5)tBK%f
z3iw!*=$tCz-SXIO8-q_F+oZpr+J9s9V7S@)Dw2#Wa)Nwk%N<cG_RN`rZ2kZP$0<7Y
z)nMS$QV~$O4#l@qJ5?JCY{zQLm;)K{xUP+k28s5J3!U~0FY-maJ3SjJb5BxKH&Z;e
z{B;bIW}FKFR@hbyj?gt3u#%0u=#Eh9*pi}?1zNNKQ^(#)2+OX$izFblp{(v6L2Wqk
zm`sBU$`8Hhw`GLp8aRJMom1~;t#$7K`OQ?BIaujf#@Q>i?^1k0BFb$!YS4{2_*>^K
zXj)@B1W_|IkXk76IIJb)kps0E&dyHiEM<B5M@Dqv{Mwe5PU^oJmiiyBzM~3(h-HXa
zSU?1^IUGnzK+XN0>FEV??}l=b@uP)mz?KyZz{fn>JWb?aK?i#VPvG-^kWqN1#CVAW
z(>Np@PhIN!IdqxYML!!SfXM$v#lfoorJqSAdll8RIQreae>MS!QmS;e#94%#UDDRm
zVb#w`-d}9AI|HvtUKm_dC^+CW2@%EFyV(sc8zcu$kOuDch+5$$$wa!Z_<K((A+gS9
zgMc`BK7wF|LJ1lr<R1!&!rSdzo<fUmRTR@=j%N3>GXuj<{2%NMdVjN?O=K#NxWL>V
zH>P9^81Fd3L$KekD^KZ=&=kJL78NO?3Y8@u=Scw><tW*hG_l^{0L=Qr8$Jx*=k}Nz
zz55{o*U)vC=kqKC$~40hHI+3Vf>+<cH>lx{!(v<lO;Xur=a_HWXqVJ+FUV!M<<2o1
zF76`aKbVS3wyKKX&5jX){R^I%6e<U={&VJtIgcy<kRkt~i{UU5$@DHdp8C3TppV`v
zT=sr$ejb=aW)2K|1O|xUO5B$6FqwA!M9085b!;<+Ee#qO8F4j|Ff=4ipM-~pZ;};+
zW~t1}BfLHAeCKB4XDM}cH$48S4)rQMW5T`hj`uZ7K%28fKliaE*@9;=ZvX_Ln%|pr
z2AHh?zjdijZlW%nt%rEY)krae^%IxHY9h%2X2*{RLc!&Oz0ouFV`nVjZgG~&W$cMc
zT7(wK!B-w9h1q#MH`Z6m4@YX^frjy;s9a|nwa!nRhm*#&>VL8I)=_OW-}f-q0;NEU
z7cK6kxI^*c4#itsin|61l;XwR-MzR&ahKqp;O-Lg-aeo2@4t5~Ru&25-pR~l=A1qI
z?7iZGGGPC_iE*hpK!>HHI4<DKwo-NU9NFS}G3Yw*Vwa8Ob~`y_hvHWnEqN~lg(dvS
zQ|JCYY$gG9KP?R@dq;2`v-SCcwAfn)3`*hLT!4&;txUUjCgc6FZDiSSW<>n@o^j${
z^cZ`SBcQE*uY#7|WJdh&CBxix^15&m%*9V}-zxtIE6x2v|DgD6USN^g+RSf)3f185
zxU1t`A{Gi|5L3?b^pPZ&U`)YwHPL_Hguw2zyK@sgT={`%ABHfTS4JNSGSbo>k91n<
zoI|3>1hu}iFfmcdPKzV*@H(fy2jpa{>>&_{4i!~Us;rn8Vn{E$^8T_Pl&M6y-xua?
zL-Lvq+KH1GRp6RE<$wILeLc`y)IaCVisUtUzB1dY&MndxtPSC%T0kK6>v?~yAylET
z?$cgjG$>s{EE0KM_Wu_F&J6QtHsqrIY$;cbv$~%8Q6szDt30x3!RV|O8cg&NK6-tR
zfOr3i93(835GPT}X}#ZKt|1+((4WA9n}%B+^tF$n`&r@~TegH3VMY<}Jx3L3{{>!i
zfPPMnzYL!%WI4Y-z3EL4Hi4rrG%GX>zO+j9Z_mZFI;r2EX?rrtG%bWQ{IXvI7-~E`
zJjYCo^CI|ocp7OprE%R~2f3|&Wa}1xgL9fLz+abm+#g=wRdool+}wKKwzDU=Kicfm
ziWh6vH8#3CI25-PWM_8?Y0I{jHWe|HinKQLq8J0+sHC9=GE13pRM9|4|DdTgUG<{(
zRg-T31c68C>vH#&$p#t$@-Rn&!jG@w$Am~sqV$6Dj&>9CcNa%=GF{FrqK?B?Mc<#*
z13RJ~u`3Sr`?eB{{uU?u)O<nkdPV%89X(v+q99Xru`7b|P2yv5dMzSnd00XoTA`wp
zQX)yc`Fa>@>rKQlPvDMMxYvD@QLAI&LURBju+NGYt1j$xBo{{AdbkhnQB?9cgU2#>
zV1_x*hB<anr83CI#>PJ&kwL||x}gE$z=usC@?Ts&i*ujaRy(EdII-z4icMHiUe1DN
zP{%>^8b!6BFfx~cIP$NtrjALW0j4%D{UpiFRgG}ol)u54+^Or=F9FWcbfHBhjzU3C
zl{@j&>x$PLzCY@T@nz41(LSC%cpfOFcjf~DYd+}w2p^xjHZhT5uB4xtt(jF2{`Ch%
z(&TVsP*nRuS2kMFiBAz}a2U#^DUxX_74iy_kpV~PtFd;E$boWd$E>>A_;YQglcgrJ
z-QeuOp{JKW{g<+Mg$1@=7okzkCf2WuJpgLh2w!b&$4vjM8;J{kBR4$&r0Zu4))8>^
zv4|RY73ku6O9u2eiW8Wbn5@5)WCJsT!z#5&mx?Z~#vNW6mJ}bA`l#CEO@FJ*TUpUY
zA`&8D8x){XKvU+#Fc%ncv|D<|r}OfgZrWPqO)nY=4{Bx^^K?u>T3bP$w~w=fk;_*}
zhV^WrW|yrWG($0$S@O+KjphpcAMK`o=djy{esUDnQFgGVuv3oZU)+H9v93n8xt<u~
z$iC3<N`veTPLEK`+boD^lQNkp>vwwbT0rg$br;8#qpT%u@>fGs<t<7gnj|o8y21vx
zH~oG*Q)N<*{OlolaV0R`##?@Mx>kw%-_oJ7ZP{srG8)V|KYyK^OVQv2h{e1N?4F<h
zQ<w%)NY1?(nwgoIrpz{1)6j?q3~;eR5~+i%CFo8c&W;01poGKGf60;F1Q|8e-j4}H
zZDVC{Ko<HwcB=wx$z#~{9iE6D7qfBXR&VgyhZ#j1F2zNkuNAWz_9N(ks$S_`UvSXt
zu-`$f&H|THUNdK)i|G~KzvP+;Cpf}=Cd?nDM%WAt4`tAPSVTUXdnNDXPA*5z2<}v<
zbSFkq_cnp4ic$#bEil9j<(0+(rFQOkDUvQVAO8KZV0MW5_rW#;0z`)*NrQD!wOZp{
z-MNr5X{;}r#BN<r$Zyr<^h(%m<$j4g`B?nTy`~n{QiF0DI8&j?E2?tVG#Ed)eO=z^
z0N_g?cmt+PPcj`Fhi>lfO&Sk(WLE82xhfi^DdYI~ICLaCApzg;^)k;T#~$z;NQxpY
zyZjM>Gy-Nj9!u6(FIeg=({h<wzx9IhKhW{I3o>OjQbsQB5quJju^LmT@owd=Ei6`z
z<J<Ov6~}p0)%@tz+nx4ed~~n1*COHQl9OxROYNZJ)U(&CAOoCCKr2%y2Ro}*|BsJy
z!fo(3Z~I_Peigp$5JK*9;qiALIWOi>^K~<n&Vul-OGwX`m}S}Aw}Pb$gA!q*1QF49
zj!)8R3AvMRd}7>@6LZCj13a+YP@lY^YvG-zM#~BWz{e#|;V2|%wy_0U0RfZs$AC{?
z|97PD=*D4T=Kc5UM}SNH93mZA)?kFJiu(`5V<O?(vKkRLof)_i>AU`FHU0UyX@Xkf
zh3gI#dgbKlb<xj?W_~Q?GcWb&kNi)F#^oIUl1CK)F<HmGFu%ejZ7Sf4duaOK83s+v
zXBM)abz`O6seKoD)E}v&8A`lK_~3d8FRzC>iwObOgCJ&FsvzR55SPmdY=V_I_;Y%#
z<6C1Go%M3W7+=t=W&NOoCeU=FR6*ON#kG?x1O18hfpkV|v5Sj~dR^AEvA?oPZ^e%%
zfvW*R;|t$;{!2;&H@w10YJBi=2*T%CBtE+ekRj|{d!@T$QO@cTMM_^9uS!WtVe+kf
zTA*<j$hw2+;s$A<{(}_&-Ea94jhCpXCjW=bQqIN#d&zH_Az+#0M*~{I3V1a+IXja$
ze2r;P3^Uoqy(Q-sQ*rJ3f3Ow+dAQpuH_Zr<nVFjIK%s!lc6uu*aNj+bmiZ=0)_?5-
zdTjELAN1U&RfdUy0a!EuL-pf(xP4)LNwa0y;)6I^jvEFcATpZs^Y@UctgP&RfESBI
z*&G0L>Il37njtvbd|$VHDtdj>`0wpOhCSBmL6h>k<C&d4_tyRLf!zoQqHrG_y2k=z
z6SkbM<10D@uc}|DG9}#H-29gw1M!B6Gc)5$WV0dea``aU1%B~jSv<UVv4)neSY#{!
z42YJK1a$iY7aKf@KE=wDFB>6;fXOHgKAf1_lbhS~v)nD@AC4s}O^rvwLWY9yAv+Ry
zo^#```J0z&d#wl&2FJhE<8)sIPPk6-4}c%@6FkaUh6n_Yz@IA1+cw7g47w-{59dR;
zMNEc?@$m><fLmds-F^9m-AE$aA4!*Dscg=!rNnuhFyZ~z*_+?>fKU3y8g=g{6|b+|
zdQ{ZdIycs|3>qM+4uIzi-~SW<eMV{eO-|~7S?|?#Z~`w!%H3*7d)`z)z`b0MiYwP9
zE`opSVbFj7H_LZcCMv#R2eblc_CH7xcu<iKm>B-Q5&8%6eR^N*f(Hzb+m#b^g=n$U
z;^_r2k>7~#(Ut?SNzTve#>RnAfSY`rC`koiC;z()cLh`_?ZMsY-QUxzIws-s#jLRv
zZUD0e(&LW+YNfJ0I5IM0-SC}f`5zge=HEX4->s)s0<U1g`l9cSws%ifMq&SjIl91s
z*6u{sKfK_-W(O^?<=w+Ax&CVgtJ1%O72@zXkq$j2M%|}I0p{C(6S%YXBVODPpo5(l
zK7#b!*7k5^0FWJDZ1xqtpWJr=j=TQ{q5`cd%-tf0&tt*pxBOpZu(b!|_)eG4+AAHv
zHD?OZG$+Q!D%v3mhYD$_ouf5hSO^J|{>A(6WjUy+d;g(2Z@g^pgSiB4Oul`~0hFBq
zs0FP74bVgXTR5a-2r9J-GY7g<=M^ybOEdWcKJyY=O-7O5Pam9P#=eyPS(C5RW5pO2
zV6Gi4pdYkEP8X+>MRmo~J3d}1(#p@r$K}hy`m6ivolU>5np&(@nJqqs1O#vLxI7#K
z0537b0l1H|>YTou<g#~8+8&oO==Tc%jL10vRM-Qi1}&9=V3ufS+5WeEr+~Z7iEIpO
z1&Y6wnVF4^9={_X@IXdNYM8Qsn8VWx?3REBdSX;=GXx5qYsQY0wh5tl0-PBE+JMGd
zEKqxrlmup)E_@MOFM7H6hb1q=_3?q1j8daQTw)&{EAWt|`?J8LWJ{Us8Ul;hgoS(&
zcms?r+rML;D>b+um3+vg^`I#S0LSVpQ#5Eof5;INSsgP@X-rs%U%By|>xVK%J`d;R
zY2_Cu-xMVx>dFrUyb*8kGRzir5%u+#!T!Iw2jm98b@wy@+fP7CfLL$R_?==j*586~
zD7abAo8;Fg&M{46fb${;j2`9e4M2GShRlsS21~rSfti89<N2w%`>SPFjaG2WGruyu
zhr6KTsVcArrUCQzq|MQOH`04-<v*O>dJ6)X1DuQ9_|BfHf((U&4TV_&ycmsA165gB
z`9BD@Dx`N4FxC_CxvNGT;9$()y>}63^IKL<`$P6}ta*;&SYZ^gC+3v(0vj#mqgtQU
zicwKO#Hxq|j5ZRmz{5-vW&WkiWqpY$Q9znn_W%f3$Jl*{ZSbB)aWbl7Rr7NgD#c}T
zIAl%v=&bdtu|KiG-PzeB?F$n^(3{%#-njBIKo6lccv-BGO~1yFNTHtwJkfwOKye9}
za@>iru{iC9_8mWf0o4^q2m4#i{N&gv253<2;P2#{#d7@aJKNu6DxY?bZr<2YKT88N
z0+U|w1H=+1+D@l7%o%!El9{NSj?<R?LLOxi!F0GgL6B>kdj4}0f|gx7@$bv}ZTVdm
zT%n1WtfdyG7u}*FMy5G!1;DbQFz~;{Am`84*m#xR=jk`lP?uzdwj=;PCUz0X7%~Mi
z=d`M?6=;Uma4Ztu3BTAFs{O&==&_i2>+5gWr$I8m_l@L`OIqHNc+(H8-m->bCo#ad
z)l>02U&_#IB@~IsCg{ty-2ZBVV(LZ;ofx<MtugwPy->%3I&_YM>V=3_9ImRDVC7XD
z%TvI`h+cy(cNUM*!N_1QNvk|}*}gK3YhsH1>3z&gFHJcMEnH12B6O#Q$}7_#DvOMZ
z00EMf2kbYqU-(Bh!;$U^2E<+uU<KLBAqi(k6_48I51DD>OfMqA5ke;y>qGwowGbaT
z&1AG0H1AbtZRJXhs|I(hV>iNR#2_K>gLGfXIeMJun!F+lbl3@hLZ+e2%kTO7;T>4A
zDz%-Sav*b;LdZ-kImqUoUIsx2U60^<Q?j(?;%5h$s%46k+oj!g9OXATUcFRizy=^`
zz<(6Dl}X-7FLX@%=l=q`dA;hv3#4m(PJ+3B8F(P0pVwl6=`_M`f;x^t@2=TZ_E7e>
zaj378oAi{B{GV@&rM^*s@)%mdg*yY#C_^Wu0ybZ<=N8xe!OMzYdw0wsg)d$c)hZR1
z_{Qp2JZ<a*wEry^NFxFnuMQge;YR1j|B+t}*9C;~_HvM=%LU(oARG0(!Xf2}G0?)&
z=vSZ3t^$5xGVdyo!qyfLMFM3e^cwsIhSmpP!U(K?y?SlhbJOUJnT+Qs`$6!J<*(?|
zbakeK1QW~_CN_Yl6^I&@-Y%$>>0`ItM`@zfZ%K@YBVIi8`(S7N-PR(;uJRde?5zUv
z#oEt>a_N&F)S0zgMmAazn<MTly6z=r`Y-r;en%%&7&Mw652&SaC2SAg7l>A&CA}h!
z<+KZ>|D^&8N&!&#e{sZ7as=Y|caqwgP9<RXBl$X<tZQ1a1g+#bKKcsI==J*@my`(p
zLtsLi?&axJds<S58NYQlPtBi)ZS=qrB;yYdpOX6zbMs?3QD8E`4io9&vanBk68>7A
z=RbakTF3oD{=}&KUF5EH9WcsKdRrTyup;2K^piTzPhTYaZwvKY3Tx}h!*OS=y-+lQ
zoU7Bg;9;W_Dmj)ba&~6fw?6lCk^+4s4GU<Lf%n-c*SUuB=VD5xsP(5_LTFi(B57@E
zx+~NWxwPN_s5hLtHi9bfxp_LjA@q+0u`_;Ow$tg_olXs@{#{bLz;X^P6Akjl{hd(l
zx0H*Uq!ByBYV4*RH2Tp9L8035?XSRmpF)=>qVt}O=y?$1ai{qAmR~BS);;|;a%XQ)
zU&e!H<Azaa&wQB<CK<<sJzvT*aDc(u+E~gCFN`Y@7%~qOW}9bUzbcJ4(Nga<^t%3C
zc7);+D0CAhl*at(^_xqh#2Rfvd?_YB`EdrMua^(r{ANW=8oC?deNU;C!3t56%2X%_
zn6A^~F=yznUl-TfG^hqN*BjBvk2@Xla;c0m3+Dg9&HvngoqXs0E}u*p?+wwORn217
zTWikp6s``NRw6(}j7Ow=8(jzp<%n3-F@gbrpoGi4Vc#2RtslL2z{AxR>X$~2k&N&%
zo59s7cUYF@JvmL^-y!2uwWtpQ5LbRHgs4UrE@j`FAF)X9PcvGJ38Kgu8QLZ02TdqG
ziN=`xW!3qfe$@E7Co(5YS))@oTBkcZ#z-4y>-Q(@85nmrHYs&LD@Vb8H_awh=9$>y
zXXWR#yuKig%@63@GMe3g)sNP*txH;Rb2(y7nJOijcr0YmyML+vcnZ1;Y0#{%)%Ub}
zDW#whAubV6=V5!*(3{LD#rnE3SN(-H2e(FX3trxPM25McXjJ#d-IY8*5t1kB_!fFa
zeX9UDo7i^u<720)Y%5fw*5kbfQCC_>j6u#4G)q2LmHb@IZf>&m`m#{X`}6s<oB3R|
zZ2g8nSt!=JC3XG{{_i1rcl$5RrVk73ryaC6J|-8r*KbiLgp1FS^wUzA54j1oFwfr!
z9W(1Vt>jqQdtvL4U4nz8=Wu7!^#okHii1(NW4D!kIe09$5{*cBUS%5s=?E5?K)wc3
zS|vu1E}D#>m-n5?z7Z#Y5Mf$!jl@g*3uSSRw_?1VKmLAam5-Tph@ugdII2Q!P~^s<
ze0lz2t$Z48fsvnwf|@rzWO3#?#h$vRp1&&Zp7UBjt}HYfAefdsp%LaxRwj<S#A{)%
zgxv&utwWPgin^yu7js~WGQ){dXb+nW$bl9UD@LlS-p5Dn@AWaPD=oZv%_O6(rx&z)
zN9H}qYV@6mDmnl5%`Y$c!t!OVxz-Y#BDn$%Zf@6&t^h!`KymhkxGmWxbgc1SIw9u;
z$G6)=OJl8_;4z8jLQ{y~p?hD%0!0s`oqNfBIg#@`H3vYQEi1F)-#zhQLy%Rt6MDf{
zDMi+$-`sgBz)AD=10@)BFCF~j?NfyIHyrPiU5$U0Q8HDU+U`IgjI9GNPq$c_-CT7e
zGv-VF7NaeW|BB;rR)SkI_0w+iL}b=%b}c{KtQX(QYHD5dqxcRcfvI}$zE1X)Clfhx
zxE*9m8@Rstzi?g`IYT0(R|wv`4CMxaJy7TQ7_R$q!D98geP+vN!k$Q-6Kv9-howtP
zIT<WE_6?IZuqkMl-1m;~DP4o{d`W4zz-EAJH#yQkK@oN|qn?snoV25mwIOlPe&6km
z%5D7q%TTLLIwoOF#pYkbFLR+~@dvg2dBrRVKTOeu)BTHSOQqFJG=kLKJJh4Zr4lRd
zBnufix>zSG{^YY3B#y{VU2Mxficu@Kd6-`Qtnj9xzTwgweoswJ4cLFnrb-vDGPLjE
zspF}H^#!>^`yt7_B`HG4b{SteVy;~udQ-{C>kwf&(&Buc`uj~K6OTX)+TCat1_W|O
z*%uh}h1)-;jnpsIzxbKjNUOJ_+zIpXe>f{A!i+SZ6V#GorXY$M4SkEO{rB%m{1|R&
z%{3;OJvJyTGK7;`nzly%*8~pm{pYZd<wq7@J0PZ&AIx6cm|e)oAX%4k=MoT@cMt0%
z)NX;*)^7&<UzfkJ1`cta$yy>%hiaMmSt>48#;<GI&cdnhyMnsdV_BKqDA4x_pI^%0
zHhM4B8<ZDlQ(0i3A^f<Vw><xYpJj(oxUMwgbybl57>vU2S8uN!u};jW%_b^jaV0%=
zq+XN+<{M*>;j$JIb-EqSXd8=r6r1jr@{YZCp8qwBlRF%^>@NFa<Uzd_*`~37Ir0^u
zqyJFJ{|y75#&Bkn-?iQN@OgWEZAKR9+^_j$W?P$F?X2)*Le`b%-sd5tn9qamwUl2_
zfXuS^MIKOk=R%5@G<jGb{~U0%;U?8@p|!Vf{v064ry)Kn{I)3eVQ8GrF<%hYtblOP
zFtTY=@y(*<=vUIcmLO6+zp10Gs^(o9VM=Q5G_n-p`325j8d6&q0o#g8gleg}Mi7=D
zmM@oS!mB$f`>aNhwR#`Cam^pPzyITd=?8pL+0CqvH9l>cfo8q<sb-HMU?~{wW!5-3
zqkU?z%dJ>l6`&9*;6y3GXID5|H;t-P7Ix1gx5<(rAT4Pi>arszeNFMTFwbE&{!Qy$
zU<^7x_bAH&^tL-b#-}G+me1|V_&!J>D34@ahUEsoU7*Y<k>f@!f`yX*o*e>RRVIDI
zVP5PXXteg$y1S`W>5Bjgkak3(cY4AwU#dBJoFw-a7`aP*vl+Kbw^!143Y_=zvwx7G
z7SbX{NcPzet8!OholxRv4(P^78_YY~v<P4$l-xr3@Fb)!EUZwS#-aF@sKeK&i2{|2
z-T7yy_tm$1Luz4wb|xX(NzSd#_Z7N(7(YYMCipdv(dd3NY7kor1>waf2PvGJ=9(WB
z1&WKIz0|$P88+czZCtmJH8Pq7t&-U13$GNWF65KI58OLz=|HsLkXXLZtaZIv8iTBr
zAdT}8{;3a71aYT|WR18()6mZ&*#ZyYmzI8Oi*BE%^Zj__PFQ3I88mrqJ94RJiQ*Jj
zB|J7M$s%)eb~>Q`wXWIdy(xWXN;_Zqcjb<>s=H6K9L@p!1*&ErSMQ*?O1plP68sby
z%`_unF|D5o?@~Xc1})np_JY-Vl>)@F&Q($rWfc<AA6}ciZ2H{HLZB(H5t;Y5_zMep
z*4sR<QdG8?f&>l5Oki=c0W8}fmVT{e*!s7<7qD!(n0}vTN~*2jlC_L)z`^3I(tyn;
z;Ev=wU06VYZL0)Hieh<LO`6J5-$|?I$6;)8VVQNVIbC=^T=&S6e%y_TPGDI{YS3w5
z*gKW}X05ofX$qBkbiKT^JByB-tdG7pV!?#u4^4-c$HtE;?5f06RMMExRsiq|n?m@=
z?^7uPRlAzXAi?sxGcc7z6A>3HRvhNVTOXeG^5B6s;sP@RgiDu890s7s9^{6{dJ0M#
zu@om`)SB3w-&<Za9WmKE$sD&Atv()5l1`QP%GSA+;t@NXj<bzmI~6>t*FW0q84~@u
z1v{q6wQjs>O0dt@X+uxz6sgsD)+6Tg43i|6JXUr5Q5s%E&WD)hr&waIk&ehoZSVW3
zbZ#F-`HKh)VK<Vy(;BR?E)YkZS#x_3F~L>hlrXQl$6CzY?XSx(0gbGKCv6M5c{F-G
zS&Vmro=3?Vv)Kdn)2QopC8ed8mX{k3udgt(y(<-(sMOh=cVbAW$ba$5d~Q<s!RgZG
z0Z+^*%6}{h{X|yhcX8#MDfq$X-7s5wt>Y6A`u4h2#UI{r4qNX84Ee4)dDumAAJO<L
zIe)u-P>;<pA=R|_Qyww;raZCfEy^r`=5{e7(~tXkl%bOshg#_06QdmF(pNh+gT$Qj
zjl0AeKHm>1i^>rV3y{6-xjmsjd;dvxflD_ZE$1b*<jjo$k@Yx|dg&f!I94&u;Z5)(
zf9kp`Zj<A$f)KW#)RFb;+o%uvI4{0souc7ZD`=CDMEgM|g3$IvtY!M}5J|3xHEZ?h
z1aa|OozGvzY@G3lSVCmxZGTNU6dZPld{pkC^=~6=u)C2#?R>EOX8(;<T@)x#sT#<4
z)9QgCs}tz{KU|}J=nZMdt<C%k$GaY|z>lF#Z%ucExQ(;EfXqm|xx-RMruTepV1v@E
z4X@DVNIY!}sa4TGc5^lKzM@fI2v&j-4$kkDMHll9I80!vj>2eaj^>ZMArnTeB>|am
zQehjbJ4yA*-)erXUW=i#(|R009=|qY-&c<<b5nke6{cpi)Zn7G!{*MxsHYtOUr^@x
zfKjO&RjczGjP2v}S_`|vNQmWwBj_9`5>l=pjd(FgP;~ElTVDfcXc+pb^H4DBHAbGj
zj$B9<+T89Y6X6k7eAftd=o>kr*<>YSU1;Hu6|&hGS$;kk*~Bc3i$hfwH0t>ARM1T}
zkLVyn79}XMmiIvH#vr`%lVT%pY46akRC70a(VK5{R#j28Kq|PMAEvLhKVIYa0V4oy
z#qZdqm+oUpPA$1VN$rDke|j?orl@WUiE_(LnW7rD|B}*2(^aMGFjorCRs{~&Jc{~F
z1mU+5MsZezZrm3aqoQiB3P><MKl^ue`449)cQidUqe;;?pdn;_;n2_+)9jB~x38Ae
z_bQeYu#>x!gxB;E8bq|^qh$_(X$FQFjrUT=3e&Cj&E^GNE(1s*XHx7jyYb)5f-nC=
zDvl9XRd%EyHz#`@w-f2+CoRo&SnJGljU2V)J74@xN_j%h^xUo!3j#k?6@00Z?QoOu
zgZo?@ZG1p!YjS?xf{?Jid<j7|HC*GffJ_MQ`glEIuwC?YCYAe%wtw`R&<G&g5s_8>
z_*}#8lWg(~>th!6yFPDficnuysA6}PTjl2fS<yrox;eo`N!2I5ueX7QS}F}ui~jsF
z#y@bpiW%XVZucWQXcV2<%rXh_t=Tw~KYfg{VNY3i3w=}7s#RV2aN9)9Yk;Yn=UF`O
z=<%dI-)ItE$~afmL7FKl!eQ%!xvH(#YuB@N7n~Kjl+#i%Xny|ic*Z<^I41*nOI(6w
z+jWnu-2$I4!{DAH!q={Sy2@~flq+!c;up%&Sw?pX85b3Dd4A?9cw+CrejbSki7Ztw
zQo@IavjnIOWJH-fO*C~^UN;w;(Pf4X?Q?!8z9}**zNQqCG$!v8(KOo$<UbxZ)_V6{
z!Ua2(n>8NwX$k5l{jcv!hb_6FySqh&g><yE1qB7Fc>U&e!a_n`*9WwCuf{INf!Bsi
zYj<{bMn@HhBcVGxecR_J>z!H2$#;8G)BwW8Mf~oy^gt9DDi-P8&9c3Gff^u$EReA#
zRMf>ZNRrb$fVL<45K=ZaV-gHtd?I6GpwzVWf80<(p0r~?n9N+S*eP&-W0+op_cX4%
z@@zn{z*Sj$CdmGPc_6Rk+cG#9)g8%yaTyF_x8C2s3`0j+pT@3?bjI%V?-qh?Y<8Oj
z>aTmlSAu8HH$~j$+&)>wR+R`wtdNPYXCr@#K9eB-X#KE%=}wR4qu6M2pTY=!W@DdG
z<+`H?Y)Me&NqW5ddrS{-mh2`v$ckrWl%2XXX%2?uI-S#8j+cv`*4BQPwWYl>ct8_q
zb5n<!5)`ytz<j}*BVHQq@FETf*tByMj3;pB17}}pv`KjUOWymlRXQ_P82#j@P9Q;q
ztV8<&_x`4Ql>wHK38rB97=F8|L5UY~u9q#hw3Ner54b#wUI@iFS~{%E{De+%P4T)o
zzKRfjhy>vUUD6{~n$2BVaEow?K5`A>8?HPZ)WHV)I#OdH8`SRv?WcY?`pU7fm`(>2
zq_Gt<08)1`Be-|bcMeY<4X+8iF6{6up4;6lX2%{=g0b4x0@sZiJZ1e0EFOx_c7|^%
zEIi=kdJ`C_fykbIiYPAYg3U5%Ehv81H(xVyn#NaKELI(wp0d9gOdc&v+Pd{d*<vld
z)+9hkaxg~RoSrcH)Th7n=K`a#VJ2VvQX>RK)N~t6d2JaQ_uP7R&`*a=l;f6{M`>~w
zw0XVgTmqs%SReou?FRxUH7)NVrDJJKjE!$jRv!TeU&Ib%Pa*Q<HL<ce!*=4wenM|&
zr`pHs!vRwcTwGjVA0Ho7EF3g%d_qDC)BFK?nmbHlF3*ddlT2ZBJw1U8tzz&$W8jAd
zcqX5tG2o$0;di&0FB_MhkzvJ^TA*ByzDcAV)CKM{Ugae91ZY+iymQSRzkSl?8nM~#
z(eZW*>0pS4bw0y39}NQMNg;*ejh*E7V_OcNl=p4g7HPioVV!OHZJnkd1{%m4-Dch#
zFMdRI@2TJFtHd_{9@C1AaUkb=zRv_M@$NJbSV%zMfngY(G-dmwmzuk{`ka3OmoQf?
zSI;dcVc1jL->I)|6}NA<#PcYwEr~j>jX4@o;M!GTrXwIID#%KTX}EYC7a}PX6*gan
zr*f*Slw6F776`Gs&-P?>xd-)KPYCP%34^;HOwP)^Q){gh5f8D)J=y74kL$7_DvcN-
zgPW--UZ)jHF^zgU(4Q>%DxU6NBI)zb#u@oNfE>a8+^M<61H0hy<>E5~oVS;XMFZ=V
z20|d|4{saTn=lY}w&MrVZ=boBqZ3kM&p=b&7U}TgI_KrTXV$}1(6y)A9|^n7Gd$A4
z_hQr9S@!qe@4duk*ET+k`P9zks*RI&Oj(V_dV%4%!qQ47u09hbf_Yk4-{m=ZUpu*%
zfc+i_vpuJ}M2^S~8!1xWG@JPv7i2Vq1z8{n6EE2Ms-y<x9g6U$yzF7e5kc(28#8QF
z;IZv(c0JA18+aR;!eMg}&yIMVaj+_vWKnRRhu$kyoZ*PDH(zixRFpb9U%QLL{_miZ
zHF(O>=jLef8TMFZ)F~qB(~WR0nhC)(HHGYB_Wxliiz00uCnF0hc?vSBDiHQ<aqImn
z{<GpjcK&k3=ViuP5txKBE?rnSozZuS&;q2WA~c0hyudTRx+-vo4*TQB&IF5bS|@C^
zUumjwf(#qBdvWV6T3z<WBa0_m%*=(5WKn@`P)_#leOs*UL=oR})?O)Pct+u8sTKxy
zxo7XwmwpdN%-%T1Tuc!juxow6dRALe;|tEgAc+3bc8(0Ue~d;We-Q1Jd5y7W&QzCs
zlJ#&@-Q(^(ni+~D_&&}pGOZ4h7NaUJi8A1RlXGfOru<|-S=3BHuAIKBXDDzWx|P*O
zzgs0t&YQ#hsq$%H#I!23*ZU2o)i9nI6h^-xG&<KZ%_CtxoY1PI9wlW@3LVa$r6&M6
zKwY+qYq`ooxf@B6<owceP_^5B0@ad^EiMIkymR+~zJrgUDf*erI$o}K+dYkr<wM>)
z6BrH%d(C{tDNaxGCP@~USxdMIGo;~tfynxl?=2OIJ%)-Cinga^6e_=MVI7<|1c|n<
z!QJopjF7Sqi@fzq&Yh!SJ|K_96*|0ondySN$4RT~ov{mDFDC62Cp~qPt`n+*&E!j&
zQeBKTV4-k;|MlItKG89BQZ{2cF|BU%8NI&#sefGo|GPTkcnBATA06x7=mUG&D7a@u
zaF@-@OA$7}%x`osG-gz}s@j2|6df?_FQO@Z%4yKw>-*fkUGFpB<?p3rKTZ5}8V#Pl
zcy+L5ds5l~dm@>CF|$<am!d4^2>rdqrbi+utJqx;=={TslupW8;}y4+F01o1G@2GV
zMU?JuMu;OZPA2Ge6UK5gdJ;W;^gO5|<hNPdKp}VUiWyD0>Ro{S*c7uZRZQ0Up_S<R
zSmbizfR039-*_Z-ab}hOIGQE8&_^!tjWw^6lT&VPE>L1nV|U2|x!j7rc}|WofOJRW
z2d=Hp_;xSkh<sgf7ZG9SuBa}S<4z2zgZ1U)zO#RHb*UAEjkHG)E?p5W+1!!~)`Y4)
z_n6s;2wxv>0?yQxx(%huSt7O#P&{=kG#&ErnSp3;e)i{7!<ng5;qijuQ_aVB-2M+m
zw6GRd_I3v{F5k->vxdrOQ?Rp><kgOuyAm0{)4}Ki+aFtW!~6csePn*nTBtWlE_zhz
zj!o+HGD{-KwxjVhuH02^{Y>HVC&vl7&~dE5A0Yyx@cl5SD-E%e$V<m&5$BLsX#Vt7
z>l!8E83bM3e+!+?6lClOLn4@q^6alkd9#`AdkhzYw8ul<FU)7tJ6|C*V2wzjHN1*4
z@NK_P-$}tc9a6+EipHi<MMw!Fv0fIVcs25YShBHZx$}JZt0Ovs?_94=6c&rh;WfAW
zCl{BX0mci_&#GC|@@A;(b4D@}GBZaMv)k(MR3Ui%8rxvfwdL;gQ+Jl%{h}!)Vsm4s
zXf<RyZ=fWFl&zKCdT(>CVYe7`eLuPRH`5cf87|UbTfD!i4sB50^${Nrdnimp7HWN}
zN^$O#yCr@$ABgZJNxacL8_Qf2!BSCIzf_P%QJt`(GjGN^RX6*K0MO%o_I~zZ1%}*G
z&wBG7VLlw~K$#lqvD#m{%w^s|-r`So8*g8&d+uiZwLLR`xO`l6o$zHdbKP(xNmi*g
zpTArda+jOEhEX$*mE?q`a6YZpVIDTvp~$>X;rMGr`kstaLj_{wY#}!ILy-~#;j`Ij
z&Fb6bs7!sBUC(M2+Yveh{9x2E_*bMcr;|2l(nvVBZadR5wIwNvr!OMYu31@)-8Ssa
z!=s#>oZWhdFYMtOokBrbWmo2JVSGH1(PD^n9_HSnY+PI;ufS%sg$~G;hLzd=@fJKj
zz)aA2JMrN|ly@F(t<z;B!lLd$YZ)W<v|vb^;Q7F5=i>zExz6j_nlR}hlGNJvAITR3
zKv#Uf82N&TkA99h&?#7{N2PIwd&QLS#)A|v;~!4QYE398W=dHr{pxssVs8tyhM@=_
zlGe&RJJRE~U>!_ZtmGbV6No_*Ft<ev+uCpMl?C>TpGNyQ1$hk_?R%PwvZ1A#xTsTu
zjRw20yE^Ogncgfv_B+1|bMSPUj|6fmQ+r5*BZ^1q%sVEdNKz!I-!tP89}k;@RZBy*
zyHQpQ29F<CliD{%DJzVCe#iQ~Tq2y%zSvdj*+f2%P|^?d&(D%~1GXgHA2Wqy(H~Yu
z^)u>}3*O12Yj1XG7g2NXFyVdxwLaFjTyk|PaT~rue-@PAHPoxMiQh}McbHrj>-~v!
z%bdoZ(&o2Ohf$7=o%O)gg<m{Sl=$=6`xJjaDyFhBQ1o8F>pTN_dw^nNG&<C?^9lX;
zCg{iG@$=Es*r<O@rNW>BA1u84cE-OFVK(yAjf{Go-({XF@)HzN5GS(e;kCf4?v2CE
zZI%nV`O>>{UTP}J=-Oi@)p)j73<)IlZ*krTq%E3&vl|;`B|W|&C6CT1@r%XiAdpW>
z)yDn=LPkV3KNjtj);GXsE>QXvs{W=UuK@Zkiyvvftvz-_^{_~B$rZZM94!<4SYMK2
z`;X8v+f-Xu7Z)2Vz}LFa;u<dU_7<GZh;Vf<JyljWa$a_UItNi0i;&LS8oI=Xhw9)H
z@EsnD8A-zBpoj9Ec!WuP%$c>eU+kZp2j}Do?bh1v=k@Hl&-rzvohL-9zy5abp1$3^
zf0fn@RB&?%goBId6I^hEkVl+QUZb+DlV>+kvSoEes%3l;Fga(JqU;)>%|ViM-Bmy=
zp5+W*GxFgp@R5u;?1~XH7>sWv-Z=Bf@OsJmcry(T{{V9aGMd}d)f+>yLl(!NUTIg~
zi_2j6-zOL3m(loX(?pVisYvhjTU{w@GffG!mdpn=>DJvz8@AQ9Bs5nVvm#tR-%lhm
zywJ3Y79XR=oGK|xlbR_+!j+fySD^+NQ2@I}n<;@H+<$JW2>Z~nCo;&?7yN91E}emj
zrv@U$#&>l(pt=ItpLm)tBpHofI2L=l7xrfFdz+!37nx(u(o;O&t#)+<4<y_dj+ji3
zMJS0F&cd2(z+15=>SX%PCr{cjdi!5OGX0QS+uGvU4QRXJ{%N9grbtBOBOhqqLPy?T
zOZr{bm}HUn<>gNo;&}~VX;}AU=u3<#rtCS(hE-Pz==(byjMm9^lDh6InTx#fHJ33E
z(&D$UeiaBA{6WepHFsYoUV-a*o0i}VtrW^s&|3O@MuYnU<&%}hgbicme_7@aLN>!<
zjnXxk&#BPx=nVd|D=PC#m~9O>@QN^cx~@#NL@OaduNpSXrcduy{iVw^o)!nQpVnGY
zsUrp;5}yI8(S>~BiP>XHOJORof}$dNT3Ub|BFt00U+sl;u|GXm1X2#UNV8a*4DH>#
z>eM=Y(20?Utli(#Av@j1<iM<DU(W{ZkqD_?U7f{FurVk$`;RUsnSq>qg7kAG);Ds}
z`>L>>o+6MW?1mdL;P>+(MuX0WmJ^i&XK#h^*KO}vqPT@TRCL~2_NF3j+}vAeUlcy+
z6nKLql(rfVMW0PU`g9I0*XR4)W;I_lnYJ$}=-0-MnNGI-As1-eFaN8uvKvB6=4tcu
zbp<P@drePO6_xD=ppA6Tb<-KesWS>ninKUyN9)h@_oVJ|9K}f#jc2sRm-{3>tzK+a
znNyc#bDXaK7Ntw645VWbbx|w)^*Fi<{TU5+4*4OTp;ZOCTd#7nUu^Om`8(DcMH`^a
zd%_&jIbB}{PX^)07FCKCW<K5e)b^gm6pnnY5uq2=jw5PzEGsFgKsCKLXxBIL{c{Os
z(7_`8!9;_p*-F&%{kA9IAn+8!%Z2duJN(+S!AR}-PaJ#BR~v(L)f?3nTMtpOUID;~
zJhEfL-xuod!dl;ba#&#zTmr;3xQ3?*Y+al_0rjdt_1(zmsLSD~wwXp}VqsliMLVnG
zV+_>OZZ&QMxhu=`**z&P1QXa?7n_Z#HBCPf?YjsV6wPoO9?eZIFTwk+pJ`4S>5dC@
zlU+Zdsi~_c$e9%>Ww7w={GKx#<qb7aD9etwcOv`aHIX`pp&f#?h=f4ex#;co6We<7
zfFj7Dhj4k2)@Jwql+%Kq42b}?yUk06@c!#bp=b22--dVg6(+d*@)?%mIYf6cj5CzK
zeK4H?dWCa@WS&K9ktfPXf+=@KL*2KWn0|^QQfe<n49*c#MC_&@UO7Cw)qeIc`eLXc
z<wAB_r5G)`dJ$lmR5JXNi0g7>lAJ9Ld6psxG;{##$e-sz2e|&5E{7u%LJl1xPO1a&
ziM0%WUd;ku1W+BfRT|yuOgm$|9p3PgmdYoh#duBCZ&%Lmg5SAHlBtr)Sh%>X;JZ(~
z)tA=6d!w4qFi8+VU}=THy1Kts=-pzb+z}E_+k8uaRF63Vza8b|DJr^cL-%w(^>scG
zp7jP<z?086SJQ42-4x{N{l;A=9*=5T-3;OD6xv@12L#(`;;CH*=AT`qu8~PZyt^J`
zsn9c;7<6j3zJv}FmHa|ek08GV<n?8AEgo!0$~45`XU?E$ujph>*_*vTtKNF<kb8wk
zo6|-eWBA#x$>JLL{dsWcyiIAt!GUy!`+{du1um)-V}z*oAL}9WxuU<hy`|ZYB99Q!
zt@+r%{WMVz-?>M@B0pD)g%m7ZS2MFDkocaIPYje4VgjFhlmH5{03{M7rSX__QVUd9
zPxa9+_f-W}@*=+9Zi4DtPg8h>Wf?687cTZ&^)!b2t5)8IkiGBH+|y{Dbz0Lg0<_+X
zX7*cJT7-5C$H-P1&B<~0Y`IbdxuXnwjJZ<e5A`mGNuYEC39~2ML}QXP8<(D@>}g|2
z-S<_5t$5}+#bQ(=_SO`Ws(d-$Uu|fdoGaUnRoniSTx&h=YHt@E*-mPMANC|EY4HB0
z5)yZNppoV9>mSDuT8+O`Hh7+!g)Fti=5br=eD=9YNkbUkqPXKb4gi;i5i@>z=LQv5
zy`SZEK3G3;c77}0F>KWHy}ej5hUWW;!Aysr&1JXX_5=$$YiKg;D0OkdO#_m^rS|pd
z^RgZRG0CmnN<qrQm5YWVVkK3j$ayIHvuDh9PeD=Vr_gj??P)^hOkdUWmAr5q;c!vV
zab4<LX7m2Kq#yyd`=;Q=;Fas{PHma?`tNGRl6oK)i>M`#R<Srk&JYH!sL^$IqSfgt
zzVckFq2Jl2?c1vFz96x?=BQ}X&^r5@PI%mIlvVGk=fiB0j5vJAnXcn{Lb;>EvyVEo
z_OEXlh0mVJ`Gu{~Dk#%C;q#9zTo@QiW|N=Hsi|t)+tI+R6=yxR8y!KG_=e(uG12mP
zd!H}UfHoRL(=$X7n30hY<+EzJiLr!4?FFiA{B_vik}c7hw^Q04Th_?{eYUs+$A)D3
zuw5U5)jLmY<&qmO(m*0Srz?kIi2k^&cYaC#6wk8PXmfy?NfnyuMYbrAv_i6xjfHZO
zG{qKkT(dkN<|(0PArrmU^KkJ~X6NJp=j0SZn^5m+T^Na_<soO2DyT%>8y@Tv-u?CC
zpsDsK_@3~UnY#Z-x+FP!giZ6W@FlIu>T@yu&fmdOx8S0cV0$@{%?UQ%=lRNc91~ef
zorS@gZ=-7h4Lmm;Nkz)>+cOv&)>}MB0hs*QUn~+btz&{%y*82OhC3^os6B&Su^#JA
zL3f{?q!PkSx5+&ZZLjOt#^rq~8Yz9|FSAw!Pj>!L5wu;cOtoq$U<>j8r15%I&uaf#
zkuq<4-<d|fX5OC92>VOP{F!4P5|3GAlO3CE<s8!fxDr!?tsp9hy9PQK24hh8UCk%&
zMo9Klr;)?YB5CKJcUSO+wsuF)j9M;lhxHQE4VjHNE;8Y5IS-E`jr~Fv?c!aa=^1#M
z_2oCq@1sxGzrSDTp%c2o#6UWYb_Ny}yVC{o8SnZKRMy%{p6#^CjQ<XJ8c=ZR(XwOP
zm4eRn_2OtmT(j>Pql`Y|X0EM1U3nVEFc3ajJeEU(J%cgnl+85ir%@ql{v)f;OLP_?
z2ne6r%XTnOkm9D^6F80{L(UnxMtT)l<ifC2J!E0+`2=+k57+H^Sn%=cXxeVLL6CE-
zab-AWTubwr5|vSkxBa5V0Tc9{t5^Hl#Dsly=Hge0O+<ur#XZqyp81uzjwb9hXK-~u
z<N*8Od_|mGfirZ}(d|8gHrHZ)(#%oe#PWFeE&1(Wkrg&qB3@%yFSYG%HJsk$AQ+Q6
zG#z$|SqEQLP0(H_zQiJV>v<FF0pFiEO@GiZk!p}8AoeTdx9rxw$9Pyt_kN;YPZI61
z#2cm)esCS1jv9WIV6*oT<nCmtPV<g`x8r;n?5ACSHWW0I*NUxo)#DzXd00HkW``FN
z`Rlw<&$83y5j;SB>c`j7*`XRZk}CN&uDDCB6aoBWoAuy)Ioju9ioY`w5y2ti3yYh(
z`>95ww|CQ9c6)oKjmv(j?q6uZ{u9iVR&-mzcS8gU5!wx|r$elb8QH_z=ea+836vE-
zk1^U<9x_$f=y15kFB;QPiDd24CVX*W%1|Q2>*E(awDzxMMCj^wI3YGh0Aq#1t7D>8
zd#|2Mzft4rI4>xZW6C~JKkh#gg|Y}ik&0GAlzcBrZmue^SQpvOY2t(FBQPvnPxpRL
zcp5`;KPw0UD#{25fFhk8aCAIY+JbP})$wpN#0Y<Aq&~1)UFD6uiI;OTOInM?b1rVu
zvfyj|9Pd9t!pqXsR(btdN1~}m-JT2m#nXqw=_m3^V-U8Zo@Sg1!)r`TvT_Tag_o`0
zQ&pGmE;`x*uUP|yJ^=S}h?Oe{2nf(V#|-`89eXA#zW@%t?H6?n*v>!%{=7j<lOP9!
z!47T80;OeYKsFqDqXhE6vXG=@&z05*AfQq-XD-e#%X|I5QZNDxtE-n7I%>`%tdi_G
ze#SA`?vy16Y$Zv9$$-BJph*OQaAzwIG~``(3`cC}*{63}P55K=@$8w+v_K<Tpkm~J
z4F|#ljxFGc0{l|xf%^mYVL~w7I-FPJa_1nuvW~T~oAbH(poE6PLVAwg_2hsa-qG;`
z>8Ems^M0+TBi2fybiz%K30q<5FCqLqX*%T;-+>58DN&=OZyL6+0nT^0nIN;uS`hE+
zk8gy8gz#QTDXmShs~3nPu3K^}KhHbipriPRM7v+C+WsMOmCh>}5T9Lk`nhO4#H!7j
z$}z3DHC-`x=^-SNW&bhtUdS-JQNwf(An<2!+stQ+c6JAbUm;r7Cj4jA;vb-?V&dS2
zhTy=x?6k~9rPkKEwixhH_6N?Xuk_S>iJa&4dBrB&XZOUihU-1_Y3{Ra|B~qV^9QTd
zzePCtfjE|I?vRL1A^g>q%*WNkiSl@cPT#AiJQB@d&r<)+HXnNj@9~q!=&^g3;j}c7
z4#5YZ1ob@YLnHIfQV;I|`M3$VG0`&fD=a9Jt1i_F1L_A5Ko_H=qy*}OW6u;{Dc>#;
zwCatXdkTp}7x5-XK<gkH;r-&Hnpes^TD)bhUfX95oq<vf1mXRr9N|Ge&8=Vd57+cT
z3JiErMC``DGZQ$ozXRgT2ngDu?NhnDwc{@l5I$hrQEh&)FR_s+lZLLs^^%xyE7fCb
za*ZpJd@Or*N@Oiwfeva{UgfA+v8>bx)`<~i3i(Q_RR?|6i%HU(S~FCgt+c8Xip`v-
zqt#wd4r)?Y=W8fksb5XO@7Wttk2CgBYJ@<@?ZL5w>hFqNG&ME2ENM5<(Km5y<yB*b
z)k`czYdL|jic0wi`a8&}DObTH2uXq^;3aa|cukj7U_gf1;}RtEf~|}ySxWclLc;za
zH9PIZzl+=9Bv@g0zN6UfJYSlZwK=I?qt@3;NvY+m6T`_6@^unFCDPU0jOlr)=p9vR
zP%);ss_2x{XJaWYUY$Qt?DcLr+|7QJ!4jKD(0AAal5))?YY^YU$=cY@`RyQrQI&`L
zi>uVZN&SjkgJjG{&xakN<^6Vp(v>T+cT5wiafLLP!jJSz!=v?AD?J3UGPGl<sgvt*
z=9{{dIH5q1!^-MvnsphlD7`aNkNG{Z9V2Z~ofbSyjS+34?iI+$UF5Uo>c|hlG_RAg
z|0qlQK~3B7cPni}^+ypA!yJ{@cb7FUq4B+Z9h@&;00ZXFypYUp;*j$a;gjgAq-Id8
z5KI1h6BQZmQqHwb(D_y{CxwrrjGNN1ASkuru78$*%GT^4mC)!89A4JAQyS*pc6%_C
zWd!4qv8AE1J+YAg`#K9Y>i+JXk*MQ#vQ@Nw$>fdQ!7|wBZUFao%&6(CkiCW%c3uN&
zzmxSUNG$%gYZHE|&jIR|I6WC3Te#ZV;+J0=6TBzP*R=I@S}N9=up1p+xQkAc8S`Y1
zYkwK0>byB27yEG+ZvG1Ugzt-3KI_xNGkPe7(L!QO%S{dm{nPpEWN8H3y61UtlHvOA
zlG4xci@792pUrhPznHabVP%cfZJTGV%MS1#^MXo4o)6}U*MATs4~}jL6p}sG1sUH7
zt{eFD_C0p|>3A<W8+$XF?pOzZGPJfEpXW_nY1%ktELA5_qww%`>zPccdQPr+oOz^+
zY(6)#V#>Rw9rCl^46+JeUr3Eft9@XbF&FMQzxsplAvro)*}=i#I&|yTCukBo72>)v
zW#G{Fni9$3RT`hI6rBdy_NnApO%AR>L6MbpQ+5&sI*JrMm+HnpigQa#fM^{ad34#*
zQfIj;=F>+~6`mIeO+-^uQ(|Ib<55TmUHlI6`Uw7I!Ij;~SHte2RWOgS8(WI8L%GG&
z5-QoN_A<Y<I&W}GLR<oFV#R8Q&BTd;o?&Xv8ywB&CTq=9CkRwH4O|X$T+g&XQd_&@
z$_xHnoP2vwD7-Av;$EyJcyoM|Yl7+q_j%y(tSAgN?*Kf*Ehs9N|G*Mz5=6g`YvNjA
z@c7iMU)I<@{sF;`Z-moM=4@d!26LhlvgEk9*(D6>HhLVL`bi|PgA<sjU#s2jbHfbt
zJSeS%F89o{>ibHA#V%AEDowuvyNOzDy?J`L6bw&@b(S&HD6_mMU48sh1#^3>T3=a)
zK@Ja{8l*K3v`L5y{W>ge3tiLPk3C&Yp)HY8^UH&!;WKJ_v4)Fv_9IK&%b?XKi;4Pc
z!3s?k+o=a_Eeho)hlv|So6hI^u0*q|)o`O7tI&G<NA)Od--D!f(JH-GtBF6my_dY-
zS*2I;KB(C**5{V<%_>9b2o|4*zf+P&qX>1_QaVAKzR@4(HF!~*2ohj$|8XxO{m^{<
z;Nc#M@s@3JnR>}6HYrZnbntiCv%f?2NMU1tP|*s%ub9Td`)CY=$xdLvnyhERU<)&|
zIWSo8pSPPob6Rkd9i~S!E^{2+z>OjG2`(9Kc3H8ts7#KML3~VEq%4}9Xl!O;YNie&
z+V5fx&XMoW;#&zH8O5yJt(yCoy)NP{4~b&^_xPGiYt?LMhLU9(kKp(Fk~J+Xyk_3!
zQr@klwK*W`pn03!25HuN1wS+I`Ig6AS<U!nXBlZ*ZwWIgk~#*{U42z_2s#Gbeof`j
zS)FDg8BZl9W#&_uXW0#z2Pkv8m`Oodc0|*Pn2DrC+3oFP2r3bVI!_^9Y5h*z)da<D
zMf>tYPqCBwh^5943kf$}Yp<o4m$LrZRNG$*5@`&-$$^*Rua})Q4QSro?<HO-j>v2=
z`8ItfCnuLHs8z3^i}d<Zy^7=@5LlzL%E>i2vVJ(r`Y{OUIbK!5Pvpz2nE`E<SRU`u
z5G(f8P4XK;=qW^mrfVkOj)9f6{T`YI2rr@@qVo@YU0>$v>xKPPf!oq*0%1-Uzl)n2
z;3q6wpoWc&Z83m^@Nwbb-~h1V%U84d`ZXKyJ0$w_K|C{Ufl=GNyTJOCM-Z^H2sul4
zM&GB6{q>><%!eaKBfiCuvM}k^*w}z)=L^4%n3)subZIIwFc9+@7sy(;R@ki!tEl?_
z+WX3=IGT1_VkCG1K?V;VoFPE)KyY`06WncZ4I#l@gAN|t8FU~xgFC_9Ex5yJ@_y$%
zXWe!G-ha2&tXXTOyQ`{8p5C>er)%HsB@Qalf9uK4HXAYDN_p0gHZ-R&yifSDh&+qO
zWezO@ex+(s{NBXVp?07?CFU^Ydn813ZJYX(?^+}~duzfxESu+KtLLZQOk}ZIJ9QYU
z*(4zc+*l1U#5?b%cRT%@WuD+xT*uC_^$+6wW=HTGc*WLvQ_0xM6YjOKmC(aQ(|Nn<
zgF6bnH(RqjXliC%7OJLTe&f7La_?zw9xX2jXS54@_2TKPSFf6yn&PN0+u95rdWi;Z
zdW>K<-bDt8v2Vj4pSWzq?_lIAeti7Q)7xIQa^B3qw!o!zYoI7v%QkS5NVbKv5$du_
z0=!k0r<jGjQAa>s!hIBZ+I5aGU<WIsdW~dkYKo7G+n>n(+*lbH;Dw)5BD<&F{CYOJ
z$+S1;4(zIq^t0Q~F!uAdN7KdnJe?(?R9ZD7p3aZOKr9=!+|bNl$-bCxZR|orPo+~=
zI@e?;F8C~ex`wTo`X((KsmJ4>TpbdlH+|Yx^t4VS^(tZt3s+BAr4tsMDO}B_NkIiJ
zV4xq@U0TxJu2S{!kmoqh+O=jkSk1mVTp|L(0=$c+duFwrT1OX5ykrVy{dk*P*E%K_
zpnN;GZm9A(;P=yzj`eD^BD5`n@dC|azE5x7DB&9AeNFHJw3%yj=nT*OUG&_o$IrHQ
z_SMct(Vk4Eq^GBsm6a{uH0IaPx=B)7>zHmp@KreW`8C<hzkz2LAd^uQ-zU3rHd4#>
zex(nCya!8V!ZFZ}?Rga=0pcHQF_vcv^-?RHi~z9Je52bFcQjtV5X&^v?yIjjPq;+%
z>}-LSd`MrUPfga#x!5DPc~O~laO<9rD7la^DplwAI*dC1%pqk|g8EqeY*(fKx!!|X
zEvq~mdKo2JD0o#aEIp=L^|@nr2d^>GL9vEPwQy!8u<^A6N)(UBPB>%rnUYCz(ipB=
ze*TvETfO_+CS1Wle10d}Sdq!`l5q=afk(7mdHuiZEAwP6*^|}iqIxBDG=_7XSm|{-
zTuMu)H8S>;a_-I(C!Kpt83}U8tvwR_sUG<{P*{s@$5#d0Y^SCd6wY34Q(`rj<w!87
zQc<<j!L_Lkg1!ZMiuEV&CteOWysg#*7eFTOsNF`QT`I>#ru|Rk$*y;B^o$CrgExm!
zmeLH=Wt{w^m$tS*I5?x@QyG@U(gX%BpA!*QhevjChwiQIb6E4Q1wXsGDp_qpO~Oy@
za3HoJ;sC-I-`_sidxb~naNJ)LO3Kdzyokud!^6wVOHFMYnKqK%;H*5P&l)H~5rd$5
z`2vuRMQ4mbj9s(r?|xVeHipkim3FD%1B$*A#afe7Q+1A8Bgbc}iEc{c`KMaA7QXG|
z4f6|&+|$tEJ%w@Kiue&<6g(vT$i^spjR~2cs%J#^d^;Vp^G6FUw0NH4uRX8pPdJVT
zTuy5Yw)xLJ;YRi+2_jU`yCq-S14SvEc=(m)(vyg;%Xyy)w!<`afy)i_XHl@tx$iho
z$r?OztWI0k$k%8SMn!O)VN-+<HoxiAP3gW~N*N^$^9KRX`M#MfJrDCUgN~+gHog9a
zt<%}jTRf~e2@w>A^Sw*));gMMXH_em%dTQtuA-Fl)uag0WJY}Ku)2-;c8rKY(xx}e
znm}CGU2C0hset{89xjM%uo9Vu3~r>+I)~MDDIg;vc|U#L8-wB{T5ZE7`R$P;n%G(i
z@rF(bwNl^3WKvwrYZ1gbb5P=aL=c;0W?Wj&TZk>R{Qk59?J?~B2>KQ$P4_g~eNEaB
zes2)Q>bcK*FA=ZRm3nkB)5~z6M|?Yvn3QI7yG$lyl8=RYCSf(g3zmZLO`Z#8?Rnio
z^#n<jWtWywo_?*ZeJ?23oH_f^kapgoHX9}lIVy@DT<Is^wNfd&zMt@Rr{eV(&J?Aj
zcw8ZE@iQ!(Pg^O*zOmEHV4hTbn?5a-z$>%Ky7%Cj_r47!&4Lx|kKb#77O;?_y}hh#
zSWMdTmj>tFTz-CjhdS-7;XkhG%NS<A6!CiVlPg>t9kqwZ&Q4Bh>*_!ywOaKbn|W_v
zeSSCXbqlwi;Y^hASIs~|8jx1>+>RY|XQH6SOqOZ;;Z@?}61gAd^u3}gMiMZxhb61h
z9ewm*G>JtI(fQj~`su39j`!SItHVESNCLy8v7tOecdsXHSJ~C}lI>x7Cr4xvOf|Rg
z!PTEWMP5ne)p;|5a?Q7?)0wD-U%=YT+{ZOD$qA6K4DCi5kHe{ExvR;huk&O9^LK}L
zh~8t=@zy^-qNM8n<o{eaxa~N8UZ2)nW=a4I$etPQ>73!-iM7GOUjBKeAd;x`$dOTo
z$>03<Y|@i!Gd|CLo2pdpb{Y1{-JLV3YCL%x8>}q7)g7aDr(OHLrc8+;LM~8IViUpM
z(i=kx04_h<{9p(}J)hxn=9=kt)6q9$%gXrT0y-7N#g{qSuAGa!y0@3%34qc0P9Fq*
zBj@`pV-frNw{M{&yk`k|-a#ZeQsF4KdlI0C&HCR%`E5^>Yizf-ceSg`hTC^+FKC$V
z6N-+$z46WRe`*{zR@s|d!rWSGcOUw-;3SLoweAR8l#n5XA9eQ3$*l{<=_zER&wk{X
z$ZpbR>Om1gpY`JED(!7y%Xp7IYu@;FT3Q;~RbhNQ9>v2Z5@ofE!NBXvNy*8eu+!61
z0A0uh=aHQZG;=2R|FHLAs{O`K5>e8K>$?OVSI^n4a1YRUXY^i}=E-5)Dz-Phi8Sq2
zMD&!zO~xv=XT73J#m|g0qnjIj><Aj)eh%w(hY?k%H#vC|3yNPLOGCFqMo#j(WW;N!
z{oqP1Rw%iSo@LRI#7kM`;1I&l7MV^@a8=qY%|e1mTc8h0O#nxN;<=&&+)tbDnv(NN
zp>#yckMZf8C^rC5ic5aYGQ9fC5d5Rv`?88>gMc!I*(&r{gjx~ZcmOFbfR^g}`J7-u
z1k!2`0k?XCLJ4uqH;vpOmUe?fK;Z^JMVPyib!!9H7-BK=W=T-KqNaB&%*-~k7(RIx
zTs8<xZfzwln@@H>S_|vTQ;+Sw53XDy=1jtfz~<Q_R_|bW+h;cS%#iy78=I2zS;!!e
zC-QwhMtBQz@`R)FL9tEIUSrwgi4UxVVN7ZRm`|CN`PG26jDGsbK<%VOb*M&_-RTxw
zF-WtxDZP0+)!w#I3ICb@ol&`5{iNBug!)wPU{if_37;P_V$0Q0bSGnDa?%`IV7X2f
zJIVxoOKF_bn-86G6t4~$jS8qfzNs4!)WUcd7j;JmnQ63hNR^~GN5kxK{Dw{#9ZJ*G
zuc8dW-KxC0!O6f6dVL!OHvyASdfn!WPv5S(&vfAPKRcxAq1B;5v90iUpvze8goTCI
z`;%*c;NLx>W^LCE9fNY$UVq!O+`Y@|%E55Cz=ZJ{e@AoE(2yf1{CATnLuQUCL`#RR
zsn$%Tx7U~c{(yoU5FZSv7OeNxQFC*113Mq3)20M@@R)MEzVR5@+!%>K-~3?Zr^9*M
zRCaXT+VhtcBXD<j2S%comzRg7g`E>S0s2O*BH|N+Se9n7b7ehPN{96qpqyBJrka@(
zC&RPckajbrVyk{!?HF@r3byDrrjc9@G^JTl+@2Cm(xLhx{gpk2?UJfKN(4;tB#{W=
z`ZY8zdrtnVIldZOm1FeX`$Gx|Bf)2~ksoY6|Mcceh(4o3iIyaGwJ`Jc(Rsl_b!dQ%
z6BQK-L`=$E;ZPBJMG<WvBwkDUKL&@=9^$fR0jkf7Jv6UTyCTTsMf5xmJ8-c0KZpRR
z6ZQM@xVrA)=`j|XI;v>q)pXKP#fWile4=L-H&^S%ai5r%j?UcCS}zdMnyr){5fLGr
zVdvtqfpz1O;hFX3!z5elAWA}^b_4#_layD$PV@wuyC0B{<qtxy=RtwMhEoHW&yj~Z
zR2xFY44s^+73kV$o*@6!=ixC*X<fPDT}H|()jAd>O$yO=eZBNSkTmMKB3B}h#Hy4L
zxw2n%&hgkm|7Er<b<62QQhv4ATVkOSjIkK`dYn~4r~2$}TJM)ZH${Sg_9mY>XJk`s
zsN^a|!<VvtT%%o@&s4`HxqR~2sfn}G79^}+M7;QfLVWv*MU=2lI3~wEEBr(yJO>4&
zGKI0fVe3i64>TEaMCXUOf|t+Bkq;34BG`fn=pC!kyJmZFwwWP!;?FnnGaA!TdWeX(
z>MkepMXKyZ_kFQYkrp4<*4NX}(lW&LBqb5XAOO*3I_#jHo}Q!QW5AWnp+iC`-X7rp
zG(=mQ(R2T{^2;DTnwv?b+xA#KKr4F++!Jchy#R2zaLelw4Y>N|3Xj)j$S|P4{EK7h
zR_lI8K@eluH-z}>flzyjdVko4<c$fKBU<!xG1NJV{6`;rO_&nI5Y)bkZLEB{5@Sb&
zqJ?k>U!xVJI-&MrNNflqW=T#$sEFaQp*&%}Ys$NVXEVI#_#D3>zMOA*Ff@G~iXI^8
z5!i>k^U=j2@k8{IS1Er7$FsQ+nQ8uPK`&nQa7DQlx0nx7{y0XY;*Y!JL_`R6H+`jR
zv*>?OH?$cKkeu^YO-tH(Th;q?d<b}oWS60>tqn{lU}`erN!t#y)6tpTTpaSG4p?!9
zbSwiq4_8-J)doJ@b<g`Ui1o*TYx5M?eGAakPSPZO@~}PuqzhRAM&-7lg|a$;!~b|e
zz)8ZWsPCAfbRVxa>Nz*3`EcCRw28Gef1K)Qgbalb7+=dLhf<k0D)i!Pl+(?3wdo>d
z=A9N=uII9j!XpLKR7rYD-<|I_<K}o6=3FsNK~L?eP${>`KjN8lMY)mI`9p(y%0k?a
zg7Br536_ZvcCjbT(URi(E5uA=n)Q;$l%Q$Jmmf3jGVw+>qR(iT?U`?>XngTOgox}n
zz5yR+xX|*t66(@ee(777TjZ56Lb5m7U;0o?tB-bH0y<Ky74gwcfGbDb+w5#JJams5
zQOWY=6Vew*IXqq0Xl=>f!e{s3Ku<#h^pf6SkOCLwQc5r)I2aWWyeh9f2$3ogqf35_
zq>T=&mh)A%AGr7w!=qIM&_2!H_a8K*x7-@wHv^M6r48L*zlKC^$cN843QK%N0;|Mm
zh^vUN$_c+c9q6d~(Va;fJ^WoK!Gyf+&Cc|dclZRVhX%UQK1~|SA+v>Az-3;w36Jlr
zyxyw=Y@s<KiDszwR|#?oX(sdIpjL#}e107?lVHS#+=~W8L85z=A16c7PA0t{BOgX_
zlDV%Z=@Ke3S!q!!yxbdTftWRfpZY#QFNxpYLB~I7e{?koJE(zIuiJ*7s4z9h1ls6S
zdN2AtM%pw5x|)fJsaz@OixVP9f?VMWAr)cN(cX^UnkvJ>02p3b%%jv?^sDO3JAIu|
zax4s_p$I${f%7VgFAQRU1r`?<S5N>*z@$eXUdpIQ<YH#JQ}`@H-_|4*-$PbkOiNr@
z8@)`sX_>XLeih@2io#+R?4QPnml={g{+a4y;;HvzHdD(4J~9UsO4&Fkhdi=GxfD;%
z%%{sxZ!tb~hag%n9#Dbg*rb;nsE8#zCsAgOs!FaEH<WxTP@v(somTH7+WtM@ow4IS
zJUe54`?hXRj?4E;-90|a<r{(hW;|TkL~w`XFn7N`eo&0xEj0B#m~F^3vg?8Qm2+}(
zGB-B|zJW*YBDnRK`VlmA+{lVnD7`;S;8{E5%?MA^8wxg*fEZU~$pc!+&1ao0H8#FG
z&Y2sg<RSjusTVN(3$&mEStBaxh|{J=BolabI&QHCUPl?1#L|LOE0>Y)qZ#AIZb44B
zAEp_>V=>Rv$De4YD+hU7GnPL_N_dl@@FO*q=~cACFGgI{3r`j<MW8kg4i(A<>}aAG
z22;biXF%u(VBQrpH8m9#hf}yAWt<O=p-3lVD&N?XuAq}u><?pJ1&OrfYHvKciz@Yo
zCB&~Njn2sJcee-&BemBf+Yd%sUuxFmR?FGLtyqF^qI<2d+as5rf`}v%Osr3+5X9J(
z(55NPzBQ<2wbvKR(R_#ewdE$-M@Y3Qk9~hFEG!t5hrT$M-^*i7l=mX8tACL&K%7-j
z2(U;bJdSzF2BURuH`p)FwXeke1mE@K0=4@907L*LinQN7&aX)oqK^YJZ@ZLfnVOoa
ztK&D&8frgpc*95Qzj5IbrWv6uD(=^kKDjflhIv;!`a<I6hj{HB2O03P(@YgZV0cV<
zoCs&3aH6GT1JpH3lCM!PYcVM3K&TTFti{}DK~Is!pvaKO!I^MLgqXD`?yT3aOaNPk
zBr$rM(xxP7A%yYmu+*fVCr$_AOGQiU7(M}2NK`@{uO;3k{NVb)u4SvSXd(C<Z_%Q>
zS!`_=pdgvCBf30}`?=JMJ{|6R9Q4k%Z*|dkPzV{Qbnj-<dCMPv^trqS0QuY3x)9ZN
z%YBq5z#VJF<Gy0jsUL&Eo0`05VAi{LfTQ@c%EbGIu<8nHNm*Ir$wfdpaicHMa3(r6
zRYygoeV&}M5s2BYs;WBn2iDMA`mTbvC(5R@$IGkUSP}M+)uz^DJ~szP#}l`<knnI5
z6;|%H<3E4&LwEFDz2MJ(v!KzUEhw?)mYr_^!75i*S0o<F&e_>1=UAzs@?Z6r*RU^R
zK3FY~ir#pRm_~NrpM*&je-}oBiYSJc2prJ8LU|&oCy^_M?XI`DfGYVe*6}o(g?#v%
zvag1wgr4ZCIK_^G{8zhWGMbOfL2*B61~uPh3yM+EDCV^>Y^f`qmjdQz1c;dsp^_pu
ze6+=juri33Wg-N_aO8y^$I32QROyeBJ~-&@4#mO<sj-97TyM&88PxbZdp}hoK7IOB
zyFaShe0Q}IK;}(AM6|Pul!^pIOenh#qOfchMcd0Y+05}cbDc>Z{DgY<?BkJ;^nZ$T
zeQ4UA$GnZ~ap91F$w|r5%2r4tb6egsJO3_bPvA?S&4snGY5vKsI@Y4pYh2uM-kI3r
z8m0W$V=v}7DG(E;Ga4#tG{R_O5AWs6#SgnwF$iMNWLq1c0ZY8)9JItnKj8Jf%RA$J
zo8j}(=B3k9(oL@o?GD!rDmfZd>Q0A>o0kqC;c16$U2$d<D%O~cFQKySWU|ZN%~M#=
zryqk7<U2JT4x1K}7=51By^a#_tLK$?EjA|P&j@~1CqwQV=nl;?dVjjAe2(W3^rk5a
zT^#XS>Z|0>?Sgn4-~m_XLUL^bCPFBQPS5LPGSr0%)RD};bU38;!aM!bO&!}UypBCm
zgJb*t@L69ZBR$x>NPfElzJc^5=AC&JH16H(yDKr%=Z}#lnMotg`?(ex4?Bs@=Unu}
z#RC-RLc_uyoU;(%rN=$5jD-bVYQTw7)<75q2!IIq?iNN>5?yB}R3`ha=yEJ^{|<w<
zNTWpD8nLkPeJS({2zb5{^1Ra)w2*Yt(PFbf(5qH8?$+>3le?nj&I@l+#WlS7c?p=$
z1zZ08Y2_RoS#%ZbNB6yIEnASkT;_*NNl+2m$n_J!A0qSFEHsd!+c_1IUl3}9@bUq*
z&LeZQA|`LDL@DMLQ<z+)`6><V-kT9sEv;F^8cj61pibr<#jOx{rsQBu<cekotAr}B
zI$m~85}e?gpUo@N+4hr*ShOVOeaR3PUUWyQcI+)b6aHe)<ZRY;RkpW`U3TS@M_()n
zp@TltJyX8g%)osw{wOr-ZHbXT6X|Vw|GPhmfozcI1_b#3Uqtk`{2}(l0;G21!Z&0`
znjNaK-b~?eV(CcoK}BSZw%?=?q3{LKR_w6U2d#3QD$5u+fMoquMkZq{$<PkbI-?sS
z;Gn_Oc6Nku(rJ9I5_WB+`wPifnM{!#CfV=p=T!`5N3T~8e_tA|x<wlaNcI`oa9<|<
zfd{gz(1mIOlTY&NAyvCe6kt{sS)+8>>*4DIwSlM4Xp!AEft6zkk4o9LLJK*7et|U9
zeBtd^RSPHg*A9;o2+@Ab;@WD?lGa@xJ<k0n=)j}=aLQ(txHKp+RKw_qyyn#pi-*hb
zKje+K=UeWFs_NeUgZhwaktm`WX@V-VYE?Y3`>E;xzdeD1mJR$B+Q&yo+OiMsw!f)X
z1xI**zmy1wNnm||MnE%hWYmqWKA6th?}(hj82@KvgGE8I4$h27NC}{wTQ9}|0>D-K
zaCPm~R#^NIa@Ipoz~Vad>(Ij}=RB<xk{3w7*19y=oO<BH&l{`=DIjDN3Gvk~6V7Ma
zR}%m&c}@8c1OcQk(gyYe+Q1J2Islx&nRspll{@*Wum3#P_@2;Iy}Z19_u_B6l%RJx
zVEvWiw&C08`~Dc|i?2hDZnmDL=JsDBFZS`{M?>Y9hl<ov@Lyld4PZV5c_1OjiLJvq
z`7W2ZNI^FlrDGLa;jyo!B<%q$XQTlY+kc`lkQTFVISPb`dJS4IfUA&a<1`<<k@0cy
z@$q6}Jb=pemk?h|f22i=YW>kPAp+5?;g?Z};I207N5E20{~cjaw?6B8-bggRhlrWD
zpH)S>eprHz4`l#7Dp((uyBlA!m?5ySmp{4Vv4aUeRR%m`fEa^d5tiVOf4jmim)>cz
zqAyy0-|eQ6KTOO}RW+`(w6xnoA@d3F@CI1A{{DVAM6Q(lpN;}D*JcCOf*(KnJ=`||
z6$RYH(W5`r{?!he9Qx7F-*t8#xFI8_2oCuNBRy0IC^|%;Fi3fF7F5`H)tk#fG6#J8
z`2N!+zrJWj5zC9%8WBT)z$l>l7X!eG_itJZJ~vXjiIF^faL^)MVf+OL4@U-8cW88Z
z7>9ns#vUZVe`)+%!S^xH!qt|~kLJfa08|E?DLnPJRsQDpYd}9imW+sOvU0gZyt5Pi
zsP^yQf4?wWt^VT_Kr*d3xeMs}Tbl%u)Z{Lf;9Aqs2=u$5|0(4G<a8_pt7Rl+-hV?j
zZ!*672~z!&<u6sS!+rOM=NHl~N~P@IvGMoF?tcP3fB`Jir8TxvL-tlOZSNtcMaJ0w
zId9RSor~~s6-nDIUn=Vfc|^kh5p48NDcTzC{Hc{H&sgLM`7b_Vokc5voce*!|7zT%
zm%HL3*Oti-lLYAmt0)^VOb^K}A2!R0v9t9An4JImLy$}za8SD3rFD2UQ~yq?0GFft
zhw1n49i+U~UcZw(VwGBGHxslQy?+(qvYt^>0OsL}yWO~4F?Du*JHYoERJC$urSDQ0
zOsvCelx^Lcw@_1i=Ez!Kef^Y#%p=CScj)VrJC2S}8xvnv$TXR?*3EVgMa1m@DHqFS
zyiMX@Vt|3{#t(S%)EvD5_D-9DwN_`Y*GA^fXGhCJECy1iEbHE~#&-+;sA61xA*+94
zd9Ab_7lcrRo0fI)gYBCpbiCIywA8g)@5rX+dX`Hp(SraGH4B&1A7iiQc!t3g);tfR
zUhifu%_S7$N-Y#W!$7mv`YK0^#)2@2Nak>h(%p4l&j_f0D*)kb&_Z-e_CI<BV?yvY
zFPEdrVq^@{8pK#@`IE^-Rdce|pGv?TX#1+IQJDC#mD0LM&lkf&WGNEZvDTQJ>@}Jz
z8gRqYCf4yC*552xNnP#v?AkcJI*e=UoQ8#VUr0{3Xp{U@-gjX%hgpYIY%1s*Kl1Pc
zaos{YIQ<9<Ga+YX4Qmm}!%HM~>lq5AB+#BHq4B6J3xBHLu+ZsqKg*h=Vc9(#6@94C
z$D?xw3u%J6K2M=_vi%C{!$Ot_zWN0I{oz%udMkE`8Gf2u59gZT&BN0rdl-}9XtT?(
zGkbmYRRAs<cym*C;mSdbD=TC*(hK=*L5RPdvBE(6CE*PEwvGJnnz*@Q&x@z3e^_VY
z4;v;?ra-UXXFIlIz?j&$8{mY6@{@AUi3Z2#ydncqh;wTNL|V+OHix~_4A0+s8oK`a
zrtfnGZEjp(Rt#`=p9SH!?8BNCMKnBqTK87sh*dP~6`IQwS6qL&7|qK=;zG&NastGP
z#e1!^a<Nbd$rgKOi6eC9P4RV$B0N7kzW10d4UbcGN%1<65^Y^uS@}J8rZU04A9|d?
zHaw5bmZhcPu>pAcU`#dWXtIBf4ID?4`vLP(X${&s;GhM^^6&dVq*dmU*s<VL%vfPT
zpIxN66<uoQ_vNa4ySk)ADa2}4nD&xG3aqs7M80=ig4I9lfC=XL9cN+2+UW<Of#hek
zWXAX~^TFKsW<c}n8=Z5Fb<Vh3m^F-vA$mpUq7O7tCu=Pjr!oVZeN`BG63td$ZQ(>_
zia!ODd2!aj#uv%I-w=RWkKW0S_0eemydBHfWky@Yt+8W&<#Z~Da%v%s*urdHL)Uc1
z!R2O%6~t~m1$sx#sBh4H$!-?-)6stRrE?8NmwYTNRnYHjl5;=5syF=_$NyP<1Gs+N
z@yye$Y7DlP8<^hyK@GXQHRLdAp(jpAZzDlHzhQvS5g&zYr6+x?z~74_494U`O0u`o
z)0cj9HsEvya)cOd()pMmgZkDd_t?$8HBV}npkMKoW@qeJA-hRwldkuqr{X#V>>ixn
zY}S6l!Z$(2h2?SKs!qe~OcZKbYPTcjd|Q8ifF{0b*|irGP#P;3PIddOj(n@47E@S}
zeDKF;#IF3qug&<$F<8GZy2a?WK*eDC&ez*q2jd}+08}1pFx~IAz4=#ByEe%o3=v#2
z#zPCVp+*PdSX@=vv6IuVSzJLXZ5m@o<x{hJOQ=vv1O1uSyVg-dlu3c^7IYqknc5iv
zzkO)}ywwlLw{Ixu5WeWaXYq4*Sw=2~Mv=)97w^@Pb5uEQY@kBDV&a$eV3#P`F`b3=
z84{EJaCFe#LI0*n)hAtEyD=E`{GjDLYdE@QjJlF-jF3b5W>k6ku1&Mr7+F!}jOd+{
zc2Q`YkZAGt0ooqe%v)vCPS51)IYHO~G0-7wj|3|H?Tm(K#e+4iz}<tg6^^gPk%5g;
zVho`|KGKBDpN)rx*U!j8_MD??y66MS!Ff7A?^z3nVAR~*E=kdb_?LG}D<tl1i2+{5
zL-ET6U)P;y;!SBn7c0X>D^-|ydj_CFVf;yh4!Z+SX};6jyjbf_ufbfm49jK5y6#C2
z0|v<ZNFk7uYy<tawbnif2*l`Q=vcV7eMvDW;1}yFDdfG20S43cXu$#*{O%I;bj@Rg
zN`#kif`~z}x^rbU)69PH;lW3SBt{kNW)nk^Y^Wy4iHz~;z`&@5ZrptSylW2vQ9)ka
zIuQdmrltWk_ldmh{!LK#`}=TMs?f3j_s&X8Fo)Ra%=2SwEwSepeZc4$=N9efH)Zdh
zlx?(9dDk#=b~H_i;Y^E=r^0l>1+#B{Ql3$}_8Q9k@rTZqJ1bf9=lw4Mzv!>GcfYE!
z42%>a17^ImK_?$2RlQ?$kc%5_zJ2NHOSe+pVKH|89xaGTmKn>=o|i9voqsE^2?VZ4
zW<1)pUl90|&XzVOO3$C;v&s{ET~d}=J6?j?nJAR#B-^Z`f-I|yOrs}^?4_)rJM7Kr
zM<v{{fE`fTuve^>qh4sG^`1RXc<waJ3%Q?|kWX!?ZPSFNm*IL3OgAtI5du23m|s(K
z(hVjtsgAr?kY`x*`|!_i0{L>lx`{h)hvB<KH5Dqjp7_=Yk@opKuHo91l7?ipP7Efu
z-yJ7U>{apapW5T93swZq?Lj>t1V6uV`y>&q_0JyMIA_}IpEp=*3H(TN^l4=ktFeI(
z58fe|K?1AIm9%AD@cqI)*z@=$hpoe$<Egnj*v`w9l){riw5d`AR)?xIEO!Q01Yf)2
zHAp<D>9i?6qHGu$@yqgudnjXj%tqbMS$M4CZS1&RG->^wBb7qvXMb$Va_MgGGmN+=
zVbHtk^`418z>{f8begcsghMV&opW-!a8`8F`26|zBO|z`(zL0NFLUnfksD_CXU@D$
z?}O$lmzkYw#>Iol?)TEId(U|9SgAuV6Cp+UOot&*Yppvr`_+Xy0h!l@6Emc6c?_(J
ztuw*0hPis~@iR(Aiq};FO+V)Liu-N=_swru_5uflc&C;ttHf=a3wX}!!tHmnw5NKy
z)4AJ(x%!}e`<#&5QW%sQm?9y~8(`-yjq|~v)6e@Z-i3M4>pA8byaDuWHUcm8DdVB#
z+Q32Ev~JS#t5P2XY>LUhdp0D2N#Di8;{0>xU5VM$R|U0GeM`yHWwH?~t%+H_D4kE1
z+r$1oW(h)Ap~3D4xguw^S%UZF-6qXAE0lvxK9~(eynYt<?hOgw+;$ITy)XS{07I~H
zgQ)p5NSG!qc%)_`;L-cUqRcdTAROJzW4o4hVo5l>;1sg{*7BD!;&7LV6%*gz)s2rg
ziqZ*df@>yTHizPkY0V@iv2nbtxLCLWNx_}&Xg6cB*i*rG{ww4WikxAGQIPP4pB3{k
ztL=S?<=tHNL;~Yc!H6Kx`dZ6oypnD&UGhBNy9?3@A>DxaU%$m^E<At>imRr93z%L(
zoGphpfeXaDI*=<cVVt<C;NINfrJ4>_%g?7e{CySXU$8c60ZjipUiNmDDrK&KrygWH
z+DwgM3RU!RtBO_S4Ew<y>z1xJGJ#-B_P>CHUoXr?Ghb(7nbrU{%490mlJ-Q=`Bj#c
zyZX%#k#ORvLJ7JOpV!=rGh~qJ+za`Abe^#xE04`Z`qhE-N%nBIo?IV75I4^kw><ZB
zSdijLBI&D>KcB*-D2~50M4(F*Ta+<f)doLJnL9CIue9Q!Njk2L)Zio`^gNI-L3Y{+
z>#N9z;&0Rn#*MS~<fhDNR`WPd#r{2KttY+HhAGR6N311vktiH$R?Tu{=UlkIYZ52B
z!X1I8VXPdEPH%f)5GxB1yzjei`AXZHthNWH_FScTv#hSLN^A-vUbFY)O8aAdCc`JS
zwz_6Hj#X`O)9%jO7VEBS10E?N-M4sN4D3*#Mr^TO+T8=`f^<)Syjj40S1$&Q%7Hpb
zi;F`@@qu>!_!T$+wB{@Cw3L-QC0#As1fkh$@@lz3x?}+`r~gBxPl8ZQp&A^gW>dz>
z1NO}<MP~NoeijYxK%dcK2R!7{lN(~t$~{>0!+2DG-)jh8TzaoJch+`zS&ajz^KAQ5
z=NfrPFtBPKK<Akl>jZ|w%YsGXbHAb$XX8-;FrC(T4`Z@}lgG8b0MJPbf!&8f#HMOR
zneszNhZ}?G61Jd?T8~0in6Yws<lt0)<6tXYGBXhg$<B@h^0V8ZLcBr7<SU+7p$dUB
zArki|4OTq@A{#yFtY?X;g<@TF$>H0EWL5cjBPCYbJ*h%YbA)PB?*@`jJ05UZQAPd{
z-o!bZ>NazyxsgFS%SNppDMMv{`iFc5)0$`)rr6ZU<qkJ^^EkyoY|0Vw=M9%XJNu?<
zWs)K%yeR_xinT!j;*2k{1O|rD$nSq{<b3FGfw(*UV-b2i8{Z;IiSSQ9(1}M_56p@l
z&(3tH_xgz7p)sbFr+zUeW1_6zaE2&ylI-`wLuTzWCxB`3W?evbhZ7(gMguxU#9iG#
zMG#=@-h~elghfH^WPTZ4l-C9;A}^0+4s(y}8Ns{<*ovd~qEZthcKi5jYiy5uK~VD)
z`f(jh|BY@-hoiac(S!5bcDCNQrOFiSPRtNxAxMMY(zC`cwl`7M!}0IL>*0{HFZS<R
zxAb*l`~bSl`pkcUc<XGWsWIWqzK_%Rx6agJcdcd?qU8_Gt!)71oZ3D@vo64}gt-kC
zy?xi8UTz8F9_epE*HpLrYH!k$pPMz)@+VW>);@dYR`8(Ve#2{H?`$E(pi>g(XDePc
zP<V6maFk8W{h|UgMkK%lk>;7-FxGtIpUIrhm6&9xu4vH*SJvojvGcpp&rblbcRPND
z%-RJMnleW~9XFqZ?@^+y`W&JLk#e(6?$=OeIrG9p)f!7#QFEErF&ir8vU8ppL_Jt3
z5<b(e8{u46#TAU3m~dn*H6BWo35}oaR2#5Yozt8NDApt~t!cyP%Rf3G<rzq0=z7ma
znaLy?C(6|4wwqc+8QO-yl(GV|*weiP=B{bYtk`;(?|k3;&NPMuLp{wsCVJ!YG)=S}
zsE3a%<wkAj$DE{an*p2eMe2(=UT(W}4$t?{MknZ1HQaHJ2~nK^u$Lcd60YU*dqTz|
zL?dM>u6o)yvUAf6*(*(*(99=%4setXR~(DzG{kcgL5uV1QX$%6QfCA*vrAKC);Pno
zQ=%!AvLGhGgz<?A1I{0bPzeC+r>sl^!DxB1ZK*;5+ljW7=a>+qm)FIui9&N{_Z1?s
z<G)fDL%AS&p!U3rl)iMCaP%Ha2Rgs$sy=j{A#r4<tzB>)EQZ&QfMc`?9C*ui+FyR;
zHQsk#Tp-?SCRwVa!AQK~Jl#A%J2tz-29~f~^$sD;GZw3$DSg**myA7tezhl}^K<{k
z)VRZI*N*^{y+zr$paH7lX$a&W4Pf`%ZumhawTsR(-JZI5s^dIZ1CQ_;5>i8k`&_*D
zC?V$c^QJ3cv^L)7ngYenbqVB63HT+s6ZfarfRCpjYrjENhpwXG!Bc=W3)S35-*#m5
zJJJB1EFaVX4UC^E1ek}EmF-=uy{n$|5j7K6Op~GMtQ=nX6hS{{)iEb-g-N<CN<aEN
z_Po-k3tAmL>6DnpLuW_z{x<8<78R`LTV2Gx>6pc7m0Bhw$4D!FMZ)4>GfR6_4I*}v
zuqd}kx9kXXiwd8blQ<#qPY3WCEIhjbPU9+1^-oc~JXOj&KLUsoo%&N&oPU$0j5(dz
zIrC1m^VO~aP;g@7SIy<xZre4DGqP&FE={<7^;s!IlnkWOdZoUz!v9NqFO?mzr$0bd
z4Vk)z`gb7^{}yhW?*Q6$q+xeKE<YF22B~~LCJ`&u>#;}%%*u_){-5n#K{g(z*`Ma1
zqCqHDB`UlK|JlCjEx;C*Xv@_~ko`le0N;xa{&6S&H^K)vrvEpH_rFi&{g+Sz{`oER
zznLn`f4MH;kn_Kk9q^;<f%N<D^o8VqaYji0!z}^F|9?^c-AMnh8*t$MITF(Sy#cU(
UY$COmcqmp<R8FKsSpVyP0WO|7J^%m!

literal 0
HcmV?d00001

diff --git a/docs/images/aibridge/grafana_user_leaderboard.png b/docs/images/aibridge/grafana_user_leaderboard.png
new file mode 100644
index 0000000000000000000000000000000000000000..a336aa262968ed2cde68b379532d577772d6ab63
GIT binary patch
literal 51915
zcmd42bx@n#_b=MMeOoA$0>!=5DDDoSK!M^EcZxf~9nuzUvEmNJHF$6-?oNWcy95#v
zB!{-&-#KUQ+_^J%?wothGx_7m&hxCjvi91awf1MP{Y^zl1`mf4=ia@0c(NbftKPf!
zaOU2<e}LHk+_h{=y`sK%@AEy`_u}fFX$OnA+Hsq$7>u4HZC5g(<vR+6M_q*f^1LVf
zxBDHAr0m4A(S`}gAc9HH$9%u769Sr@6E?t_vt=z#ht#=qxa67Z<bE@LMJu8BibQ1P
zi+FOonY0-}^8IV0C!tnp64c7a(~vSY&kW0>ZDC~i^x3WFGIG)&4?%pV$=y|tN^@|#
z|Mwn=^OgMX9Tt7)-!?~r|FfE$+}$)5_9z1#FTVNvj^uK7PQ}aMj_Q<)GFZ!uW&jw`
zw*WF+<ur(4tHx{hAGs0fV%wFMD~6W1QHeUhvthF(&PhuEDap_4q7zTAVZ7Q++S{G$
ze*BtC!Uf%!H(XwtszWz>VL=5B81}!Gux}8x=sG9ou$TzXW#sNbm6%VbJG+mE%lV2}
z_e^PnE)GB1>7^O)bkfODW+rhgXl?mU9_Nn%PIlrLqm;j&M=v|-u^DFJ*PRhAn6Mer
zM~P(cn5vextsyYKec|4{u{XiBf4h1rLGa+u-OBStpxgcQHNIE7{RMBN&^|?RRdYD&
zrvdZ)ZFPwK01Lgzhqw63>8S*Q>hq%pt1N+qZx^n6Y=H%2x@EQW`(%P{J*MOIlCG3_
z;O32)NZ#W^ij#vuwVF+x!3@1-sOLph?ndvk7cy2FF?kzSw_i%}Y+(m%D5<8x55+&a
zbku0Sk?)m%R40$38(xlW^|lXQnz*KM%U^+F>DKGaKOFS6%xy*4sSLM!U}~hp)1wJ^
z->Wrlp_W^sm(RTu{m0w<9bl3d>~-nPLP>4#ecofBsNwiEY4NYFjSZQez$fExOB2>|
zn(F)-kKo}QXIoPBSfbY@I_olcXGaCjV6jhtdVkci;j-?6cCdx-o*w&qCM7Uxy~%u4
zjh2GDt2Y61xjV(;0?x(pvV+AXh5n?c<TvJ|T};0nL1eO?sXhtEK%0#s@Xl2kUwzcb
zXP<%WP9pgZIA{F(3;tOB^ZMc!@$eyrT@U%p2v;(RnSsF}iK5de-vu$Q1&`BgOh4B&
zPS!~#Dx`)%G7eF~%tD$cku?<o+AT+3=v@y8qwu`G$P9Jll>-(=Z>zx_YYXgF9k^|i
zG%XJ6CeV|DgjNx)ZKlAAlwp$Z{<o_)*PSwWem<wnnbhDN?S_G$yXCDyz`zdwm({aU
z+>U`3E1^3C%iWmc^o3v(A?=e)LqBa7#rDyMajsRLv@!#iTZ=#5H0$>BBRs+$A!0S+
zlUa|L@H59M0a^5|17vD^X*PW-uNLF-<jLO88QDPMaD$LPoT`Jvsi+zb#1ic7Lw(ZX
zvs~1S6cNA~+a6U1je6N)dNo723)TEwJAoyZ&NI)IBC+$ynR0Ia^R7GnZ?~VM--Lpj
z73!~|t}f)~Om<U7jfmh2gX~e0Gq?g;Cb7uLr^>$Go@QgV%IxzBq<>tu9=td<k;||(
zG;P%^<XnNv_)m{Ajt5z`Rp**4QNEH~2Bk2n8;Q%R>Gms>9^v_Jm5z=kml*O|&j=*s
zwbmJ1(DjDhP|b?yJN-A=&c#Ffw*ha4{pvFbYICR(hSNlLS2q|dT@v#2u+T=aw)GJo
zZW9}Xw6d0)?QY{{HmvcLlWI>E{YW}kotM782it}e$KxqnL&FJiJ|?tW@1m&`!_u!0
zY-gqEanr62rU>!s_TROuj&(KQ+m<nU-eyjMTW`$LS+t9amM+FK$wo3Mug27X8~mvr
zIg~pwS0H8O46dS9WzzYa7j=ETbP=k8{LSgT87VYH&qx|D`aBGb?q^do{mLy>tMwY5
zz3fR;IW~pTye13epyUctf7AfCnvC+D30AereGOOwna)lhOOgy1)V)PFY?OQ1pT_nR
z$uM992M;#jj%TJq$pqaL<)T+7fkm-z#L$;?(}^fg=F}GHv+pU-z=Ui1Jyi@n${B*Z
zf{ch{%vHNxtZ#6XW7{x-;?ZvuSrJOdH<38PPv^E=GQymBs~u#Id*<c0a$1gvjJBqf
zm7G|<%G+QG1kb5233PYHAV;{>4(|5~UX@=hd2Wq|Y!4azK$~}(ye>g~>Tzfh_1nq$
zF*|)<D(Z|(VyDe_y#*M?0=bwbuWPCH*3*Gsy}dT=c~VMu(uVZ+UgvrN$KTg1W2||s
z^KOV7So9L|l#+;UkBOye$!mKs073P5aQqwzJFLRaiU_CPfK`4q@Ovo@BePpT-|pE*
zJlwB#$X%%dAG7)J!?FBO7q+E#UbagPEKr+;>f07YnSHU@)#w0kXd6xD$I~nvdZoO!
zI`_oN0mJK}a44Mxd5}s(c+`$*TX#e0v_DDebxATi8&JR8jCmH~29os)qBWcrLG_(=
z?$vm-F1gegD<&&&zYtM*mTiJ8I5y)OTCSw1nr^PFylfmb(phHEAa&7@JcV^YaAO$&
zA|Rc{XcWh98-JeH+fID5d6U#+104uv+3H>vV+ho)v2yCW$to%;-?~Yf&yzCj%*N0!
z3rOXhg3iiILhR?OOf6xxEi%K?5x?w7dY;k4Paabe6A%l$;4$+Ydw1o;kch@KdRvPI
z5|{^JDH){Ws_G@Q9T&dlI~&L)mnGuq%3x@SN<NkNuoypRW>b{k`Y;n9=TuXgu4{f2
z@Q>f2{d>Tz`nySEvUtCYuz_hcw)b9GIPP$$7Y;pB<e`{J+2QxEwu9k433UyOLYDzq
z#k+MlH@9@*lQ+Caw~c@ahcK;^F?5}&NJR<i5&zc9rpRO>UM7r6`q_R=u%7nt>ql9R
z(+}~W51&4!5qja8<VT^6w4G!QYj<3=p<ugt;A;?6D3p?F<bDCKNgEhsmp^lFJ8Od0
zW3X;qL11K@mJxDvDFNaq14GK-)y}yCey2(I?m1xb*T@WEm1ttqQ&uHSRQCiETe$S}
zlrfio8RTtCAJn}?@^`fj(ePIo?OZlwt#1SL^b#^JcK0;2YIEH*_uhzHEree_k4j(w
z_j$i1xlq*9Qa2!y)@I|O!r+oY256l;!^x3-p_z~@^}^T51cyVvcFNS7Wbs@yVy;2A
zwF^)jS!~-oOKF`GOQ<IeB~Y={%R&krb~Rx*lf1npiso-p$NKc+%Gk7)BBAGM-MnN5
zLRz|PfpSG>Dt+($WQ%`L;NF_|2!N29KKbJ55HBny@3{huJ`*#9=Sts(d0>E5Lf?MC
z`Q&E$Rt9x`(Di)yhf}{~&ucN}fhY^0E_})DitZ1LI$kx54|}IpkzY0Dj^uN=k&tL0
zq!?P_r!$>Z3w>lILT$nz)~*gqbr!SSwuW@%6v%f9mwkOFUyj6`lv^kdu6mbSV*HdQ
zx~{J#woTNtCEA$%CP(Pbd!F4;aK70*EC}IgU2rcNa{h?TpQq}ic#^f_Hcb06LB19p
z7FDi%<ycU3)L2!TZ)$#69#B+NR#vXdWzl*%QmZ!2KnEp3uc51H-qv@hvIY)G?Rw`t
ztgHL>Jy+d`$fx0L91a7$9h5`^nw{T4Yaojgv@szP7{f>+dO-KFA@7#-fo1dgS#=hU
zv0%!@1?>1NZ14$#G9#Ve4SPSpez^%9Bbpe^xEUjwX|q!5>e1vbzc%;%nmtjp?G(?x
z?}4ebjC6Q7&cvmRGDvVr=5z=Iwsd>;+j~~rVGorR(Vw8-CsYFnvf(bqYzf2|b^7M`
z#*dr<0MQxWW9{TOT;7GM*v3Mp6+97@28+DTC8w8Vc)cF>+KlQiGYuNef|ZCUsMg}s
zUw`chS9xr_a9tn;8nw~yTj!HlhuPT~`4?BH2R1QE%0#Ig4p`~KUco6zd2?q&+d6XD
zE3xT<)D65HwH&+(mbB9Iv_VS$B3uZA1DZUN_4EPj2TT6#8jo%S3CkR(@h&tD-d6Lp
zIM##6$XEhLe-Ij$$y`K~#J*A-!)CXnXG>$^(+L`Oy}lIW%+1sq!;aW*?_g$5BAz1@
zr=+)&3hE}2_+UsMeR1PyGrR_BtHP_O_Ni&gUewd`7c#GS9G{JP#z0TpN-sV=S{hx{
zys-ZS?YB#JD39sWq2RfIPI<i~?lkFHNWASYGCDVN`fb5`)O*1hDN|;5bB;<k+KhX{
z4%N;QNG`CRN46bosFRgLo>b4V+29yNpn=6*M^k~n_j)m|W|YsjlIddBDvG(hR(%F*
zS#$n%iQ}^f_A+p5%>0MBakU<A{w4!x(SZS$y+omjk?xtgiHcZW_Ht<MGK&GZ*RU`3
z`qBBJG<`FXWjGS(4U4kbP{UmAgw+{(F)idgI4-GWLCznaLnL_Jk8<d>CjPZFA3LAY
zpz}LVe0WNkyra^-DO2r14SAduk$F|oHsz@}q*mS2=;72Z(I;Uca?|%CIB^i&t>EVx
zs(`&-cKkHuFm>vn7$jUpA2m$94;5(Wfnru?zv<H3p>&$U4l^Z@!GgS64+y(|UCO+e
z)60JqcxVQLJs^>&ml;hW+=Hn^Xq|^!GVmPZBu{sOE=|^ZGjl}~3*&hasd)ps2ABY-
z1oq!#sKu>4Jc-SC0kK?;e}q(xX?t^4)b<`=&Yh@jMqAvICuu&5LC!ViL`3y5&Lzeh
z0bVp4tzmq`svI%*V|kvx?UJDnJX|TDIvWU7oNL?uY3`b9(J=^eyE+;ZERkQPH|_8<
zunDS1ubA1c22X1~$^(c_h`!y;1HEc76Vr}vI>cJ8e5tOeb%&iOH05FpMOK@?2lO%k
z6|`;kKspf36hx2^yB!`+<874Scie_(#gxFMhps0X)^Yp=5V0qeltpT@(>NOOGuxMO
zZa-JPUymAHaco>LgoJydp>+YRVtZWAxfYD9Sp;kz+wn2x<Koor;U_%2K_6<YgJ#l=
z@+k@F_UPX`p@r%Al%SQ=+VCZQ{Oh*Un`|S`dB01KUbYW=zp%1z;yc`37ejUtf?S%N
zx9Ppb!T+L049;XS)7JBCg0!sO=O(&fIXE!S)nBKdh_w*_9D7PY7sDc|U>ZWAjgJYS
z8kR!qCW=&JOc~vf>AHrgkuK+X<-+wdr{yt~Wpp(<T)8eWrt6QBJJ^ntl^vE-I0ZH`
z-Lxvs7Bm*|E&+~2(+%RwVyX!=Z(8w6ZqEmVg_ZaZy;MC~KY562EZ={Cb?&CMyzP^j
zUuVWVII4?Uwx**MU=J*WqzS3KfYXkFRz8d024G?BHFswzFQLlV><Xo?<5Dx6DoR@!
zZFT(JVbR4IHbE5{+Wt&)Hy2GH1Gga;eY>C8=qZGvp7LD5vOd#n3tT1M;?v4=qvNYb
zm);ldgc`3KsFp7$si>3;?RE_W8W#AO7?lc|UH6*KX?ocW%GxHCAI{?^`CMIMJv~7n
zPER$Pa8gfK5|D}4o3Q~2gEVaQ=z}kGPu-8nxU{#0-))03eU#ymZI}!B`Ou_y-FfTF
z_SZ_FO38=9NLorU&SvGhs+-hF{50EIO}RZPzT4=ZOJtzyop@yhWN*;Jr(<~MdyGR^
z)0i7&5N1T%=fZTZ>EcuT)#opg4<2DXr9C)aKQbAT2l?zWXKwHV6r0ORe~vBe1D0<e
zJbJWq_XGl7hF-nV5JNnnJ8)o~z0lD7lBe|6_4M1vB~_{RgmMpx)WdW&%qnf!9u+|$
zoThLRh1k`JzPbhZSv~RI@%Jb(p4M81wZWX7jU058#g@PLq0cWS(B2nEj6*Wj)9hFK
zSWODN{F_aWe~<P%t=)W8pQSxY{~oBp{(fFX!tTW|A_yfI)C8NCXJTh!DzZ9dl4_$5
zIC3d^3s9LE$Vn;Bp}abq2Zd@SbKhR3YE_LIxX5j7ZLS}(DS($s9=r<b(b}hHu~ga}
zW}TkQ`nuTc+S)3&Uld>us7CeRB&a_KdFoukmmxBzTXX>|$Sj9}=T!8~95!{NxcD>0
zA6zxW(TRFCKcJ#ALh43fe)tdUWkzn1Y1Mc~4D@aT@-7spr2Z^X9eo;D1Cmmew`jP1
zmKKaRZ4+9Ojhm}<j_aj>ZN&Qy%$}C3ZEednM67@O`khvT0V33irQg<SEqDAD=k#n~
z_1o;#cP2Y6gb?BD<V?#S9e*DDoVrSzPWUn{UOejNO5Vkkrz&4k(?uM%jq$ZyWRtWc
zqx;MJ)NC5!nNZd@?qA<PMS~6xicAZhB*5zQ|NdI<gmnKew&I;qUE?3o_dfeP6o2x!
zmjHsl^X;Ah_W#BvSKz5t6s@QkSO04FAH9xr`BE<?^5pG});Bh$CLxym3~%sOl-wH1
zj!dB4jg5^kHY@s2CzpNjPF}O??!@L`BGB3E_p6_MB<dU%?`CDSe&JhovE?~lB_*W{
zLqj(=2%lbrX~~1ea0Qsb>^yktlND>2HGSyEbJYwnU|G?s5B~4>ceoPSG%k+7HZMbW
zcju~WYilELKMQ|N)jQ586J?E0ARVpcSRCx{|3>_0`8Eczv9U>;(|4JQ7=L?&!^_KS
z&r)u>Nb_6Nz0dz^tos3}XYfb<Jx6RyS+`83{Z-YEt~>9OFEq7WqW07Y)=ROI6S&0m
z2aFOMeM2hu!_cTh+VZx=C8)gEjOCs_)!9!S_7OT}e|=OGzRM8Az`!`9AKfboPc=KP
zrkYFuzAbAsH~-zmFPeTG!s<`6aqT!d@(lJGy<AJOitGmyzF8h!*V~r(WoZA+Gw4II
z#wz39Sg&r;*qCSKU`&In+CT?pxago`+^KwwAw!R#h%mp?c5<no1;Q)rrbs8Z^f-*P
zr#Pyh;P#kr9ZZ$JESH{2__C<^5eiR5y<VP+-p;^qYSe+@n7>b%A$dx5J9TH1Tg4LC
zAsec9`4Ks`^Jw>)*boO6_}k5YvBO%*qehhH_h!Z>HJ)V;KkvyP3;dQwQeHl^|Dj^7
z81WPvr`b$paW_D~@}h4ScMXzV#Q~pGoRxXH>28kmGLY%*QI=!695%3AhHfUQ1z}dL
zyqW@to4R@Q@R3y)@_SkH4NXv<>~D*F7Jh$-g0v}X&!1E)BwiQPWsXsB85;bkou3#d
zHQT$r6%sR6fd~|BvArpB1K7}?Qyk}kMaNc;_MTh1t?XdOb8H^g{u{L46KE?Ytm6r1
zuwN*0(7hY76RLP(F`+3v2Sz|llZW2c(qw||NTkwtI>LiREo)(qx4_<>a8dM@b=r{V
zTlbEfk3vC=V%#^WlB_lC)4|<}p^u?Or9Cgjw(Len0OLvKav7_#-z4L^=lMy!-}m;u
zw^9OL_J+(38<F!KjVBRAXk=Eu_ER(5<<%*=X(h`3$JZ>r_pH|bdhe>kmP?|6kI6wo
zyJDm%k%MgW=-Og3QbMiMLmnpP?W|uRfExD51FWyF|3e%CYi$rZ{z@<sgY3)wR!K-{
zySfDAKPt4#>7AlKjSBXPJ6ue%J|GjlZQuEvk>6Z8T3()Y5or$z-U5#KD@J7l0mBY<
znp?C&{t|(6aq!LQhKR6QeO~%;r|8Z-;K!8A^j5*EE-%|{Z~y+QS#X>2??I>+)aNx`
zr;T_#>4h_Sx-eAE<?{W|l(T_tweocQLA(UE!O&39gVBv#P_mkhEhu#EdylxvZrSK0
zoT_g82i7YQzMg`$U)#G)5fM33$e-ht_`wftHF)!1`tbRo?8_P$v#mU=7KGm-qI<GV
z6M)VN0neTV#CI=)hu=1HwK}+cc2`Va$|>l<zj(aM9H<iVibb2iL7>^(AYo~4>uvpJ
zyW60TpJ!mtLOJPnb=%+sv&_(07<Gv}JByX+wGXgKP&{0pA5}NF6;eXwk4r(CE@0hZ
ziMg5hzKAH#SD?ZiOayTnUWjSwzE@G1nJH3p&&_LIs<;0x@@X%O5x2v8-bjSy1)zxI
z_<)ya)NC$rTaA>LM`ii8FmU5>sw#$=b?_63#Ke<y4zHMeZL+MV6a7Jj2N|q_yh@6(
zJWgRoMjO*5m77WRSkr7iy8+BPKbd^nncGtLw&zatRQd{YWf0~1Xx(+8cga5I*O(8o
z)G9{bz!OZkI1zFm{H>t!@?!nv#1i9T=x9c#iT;(DTk$0>`T-WB{=gsB*<0*BoZ`01
zx{{qeO6h5t?7CqF>BRRd)flkiP`k8vl(3U$gwHZK0L*UvRH@(X4?XM#dG$+9Qx>IC
zJ@iqNn}n2NUd5S9jefRe4RU?W*@t0|UelMxLsa`Jb}mn6t>qIec&-U=f<%{-+5bTH
z!aW^Ky``Zp@p79JF@=B#8z-j^s%q*yR<rx(&bL#-Gjyk+G5(t%imoM~vz(N$<P?ne
z=~tYAI{OjerHr>M4FSKGYN2dGtTDccdgpc?OA5(bvJQ*Neq#DnCnA}0{j)^q!+07h
zN(>0MW8tu_3O@pw0SkN>+VYyJjkRWGj^Zcp-TZwDa&=bde5bm~FVwEAO&r2+zN=^-
z`Bjfrzpj2dWP5Dq$5QrPI@E65vOKHf{~$Z(8b<1hYEEtHR@C0yD#iBlJ-v2>fE_2#
z#D-GfQ<L(`qbv!ov7l;>o|0STuR{#zENpfsdSpOifl@{?52`3`6bD>9UR{7!2V(UO
z8qukLURwA1IQBJerd$eKf8aY^?$7(fq)`ofZ^Z6o4C*%9qhhx6N4(g~y`;0ipbmJO
z?3ufL<A<}S6U1dkjgAf-2W@sXbFV+-<Hc{^Ilz3;<d$f|Mh<ng$XnDhsq}0cjH|rf
z(w`eT3RSIOv_EyJCS}vh$g3+39@Z1!me{nztn<8}cmHh0tY7CU-m#JV*yXl@t6Y_k
z%N$`<UP2%3`|d|vlXJg|Y%D0Yal3hgrtJjvFZjT9>r6~U&~l`d3{yKY!`@e&egwy%
zFq^&J%0{^qjDQ$<C4m>=I`xinKT03a%&X$Hop-AJtC&Pq9zV2Pz?v4zVLw-zXGE-t
zc;f%O>Q>o+!TUCGiS{>AIE0q4of?t$AQOkKrt@xA`%!I1jR>EBlkg0To%7EH-9|?9
zx#m3KQCug0u$!U&+Si(9+(W#Nz|y3Ud}X{iy)%F=kEOKgS+f+~0l%!jY0f`WG&Gb=
z^C3O(nEV@y@$aIlAAYgZP|ibB+;8n|*3Jv2Gl;Wm9S@I*p2fzfdL+$JJ><9Ya`eMX
ze)H;uI$LQ_LqiW-$_Jl3a7<e2(O^2T26LpzZ!8_ob@^pn_hWMP8qj*T04x!jPL&XL
zKa0^+GUqE)=TQ#W@gmHH&lB-1&m7@ddOo)F(mdAfD8tYunS=3BZ^Qw6S3e$I*(l&6
zV_+ZZ00hqPFZy;vm70i8PDS;6HnQ}3|I7`KEVsN0fiI^x6@j;3ou$3(nd~K_J13Jo
z4U(7R)@rWywoE4Is6mFs8$HGKd-3*#MWKadf-E<eu^G^KM9u)+hA7fRyI}<EHCXh>
zNs|fAbd)rUAUrS45l9<IMVw(FNNuYl?PahRy%0MPUzVpkA{Y<Y(%=o0yr!QFmI@vS
zGT*jjp2R2LH;REcH<a+XiA&zjQQEenL8W~a<@v&G*3i9`X!h6tN=HuQZIkuQ?aq+e
zT;`>{_Buw3&1^l(X;2N-T^}J)KGq*65&bj$`7?cg&0J>TWEmx*=bW#k@zD6UhOWDJ
zEF3mD^4+hwuYRmU<5oVQ-jXk=l2sSwpJkU$eX5uV1haS?4ysMNAGC^5QEvO!zEA|q
zr!S0WIW<K^#{3>N!|5Xe<t>WScNG%qn@4lN8mKO=`ypF|^4XKHr~0Xr{n5LNW%~i-
z$stPH^j)u!SFxn$ZD${gu4E<N@*I8dDPWmpA@#Bv+8JvH=tk5jfBKwA(9sPzeV;X6
z7{oy*X3^}L*DcriZIX2S(mr+yAWmsXuOC2U$!d3PA;{Q#$7B?XKx3@JAC&eGNr_>I
zOoe?4>#bY#<8OZ%=U`9Rpo`2$U|#}!%{o+n_>@|=r-FI-k85~YKJd@TM{C$rmVc-U
z{khZiQ{4XsveX*z599)<1!LJLVF73^)ZmOjGsb6da3lFeo#$<sn0TPIG+l8tV#an%
z3%+M#rvrf;@v!QUx9X6|O4g|pd8lqAoq)O^-yCpYLSr4r<LL5@t?gDu2eaCN!_V#C
zY1qn^Ep=@i?Fg$KC8@?PJ~h|(d-h|`BkYWrh5KrS-nVeZONr5Pz4G?zZmaM<pGu>d
z=dSaOHBhlQ{N<-dO-V+>&h@S5wbtR&u{m6mG?K%JuT+r`;jUPo&YXaaJLE*rUQq`P
zbR49kbNlB)liK%MmQ#gh-8>*=_$IHk@`iM<8!T2n^<V87t5q771F`9RLI9_}a%YYZ
z0!_GeOXY^PVV02Gv_Plan}#XS6kpiIUI%wcw+%_Q(?x{Bk;!tU6qUf#z73r0ynFje
zKBCnc#<b6yI5mqDjeflPN>(&C|D~ec1#kU_n5hbpV^k148!g{q!33~pVI3Kc?G380
z^XF!`+P5jTA8xJEw1t4n4k_)2%gK0QX#XFws>r9Vc4QR^7Wr(AxtXL?gwG1YQtm$W
zzkEL}>H*6Ztn0Hfuzq6}mKAwzsO~<mUh>R=WE(A5<h*g1eh;sR_wc$+N`7QWiJF&%
z<M|7Ji}%+G^5Q*bHAp@ZEq6OBeUD*sm`&4dy1V~p*zMbT(@qgBMQyVR1?<_AAZCEh
z%t4@#nQNhqvc+KP)zW+;Aha?eQO8aqZBRik4K|@R`?~EEHzuTn8F?4->Yxv|_oMzD
z@w*zR8`kw|?O+P*Fv$7wZ6KIEIrr$esQ&D=Rr9a2&L&0>@RZ1YUpY*FJtyJ)dK{Bw
z&_K>D6|kt{yHMD!#Erei@ODN+BT`E?8|J)ZLc*nZFf{w|ru*9kBReS0v=$h~gNhor
zf5=(O<&sBmbd<p)o91x+h*`vM&PO_BZeESP?7;e!nl(?EM3O@Op1UxD%qld25|qGP
zrqiHh%eYj_<u)(3dKZ7crHc3&UXK-xikS<vx^_mKi~P3cg0GfzT!wBCOI?-q&bEfw
zId`(&HQ7OJNa5kah^`u_MZP*vW;MUrVo1w;p$Xu2j1DfC1f+=g*?hR}2-=R!^DRXl
z{TkCg%+nCw<N;VosUnekmt*y!hml`}rQMBOr=Is`yry7PoP27A17wHTXuF2WxN9<E
z96&8)%cawr?mNG%>6<&~up6tYqZNpF8O+D8a|x7Xv1NDPkaZM~jxyS5v%Z;*Xf~QW
zcb+`eZ&B<ESeG`O{j3T2bU@x#vTQp!zR<yxMM=tEbsQhiA{m=0ufy>gji&kLuOz(n
z<#SK5ncqv3;36sT=?P~J80PG&tW@;Fb=A~Oi}Y#HBblfJ_CSD-a<r7I*17uIK#r|V
z8XM1vq#@=PLk007koMQ6?H^+a<_gEP5N~6wC8R@&=NLZ{lGCg%USeqx5(~nV-!O$e
zCDE##ucR?)`BXE7lMHnH*;pAgjxTMrC^oaS60<yt>r%(Sb;VbzU71y{*>~k_olCX<
zXF*<%QV6NSWyAJ*=Q<gx3Y)$)+bov!!RI;n$2ik;ZHk9AE1lkEo@I+Gl_2AOdrGi)
znopNxj;oe(Q^*^!I@f+RrwlIo;&3kt=0s42Em2H<W@1M}OV;UX+E+Px+!PL{K);i%
z(vz^{n-A~E@FJ-A@~wP`7wBV<p_N~_J~n{727sBqTMf(@pVdtWL(mQhB~iA6B~yp!
zuCzth2YR){d{I|7o48?TmUZxytKVuJRW%)2(e*l;$E_#7#WK)nBj;2SnyoO`<P=Ll
zx<1}9@Xhdx8X3E$-H?#Qxb$dBX%pJKDt+YE#>07KXY3&cHFwh#m25-uAVj9HG<&yb
zw3a*B$ebalONPbQZFgmOmchoagH{0>9>avByDDBRI9F#f%{0ni^6OJCIiaPs1U199
z@$f(KV@_6kg<p_HW<WMH4kJ6?l$6|M5FOQ;nYZKH591{SsFc$<u+!bo+SsD~(oyRV
z-P9)ze()i^2_gB-Ly8QvNt=lkub|w*qo1PDfsxcKv+qmrD;#*NmSV*IJr*>LM*kc2
zboy}?#y#w&A5mK?Tr0_>ynQ6fJ*Y>8yrv^Y(m^~Q$%LHO8nPCR*c_4&^9iwavG2?S
ztCa=tzlY17xRZ8YIpeS|YLEWr(SHqFa+~>Au(3JbLJ9Nyb}U&hJ<WS$ucpGoq<ZB`
zImHPlNm(d8p9|j%rrk|G`zlJf3$A_EmrhbPl%(U5m(<D$b_5(6!P}L$N83th+!#7_
zpHQ!su5p8gkcx<jC|I-!KiQU5RakO;D2iW%oQwPIX`Y8n2A?bwxHx3B%erK5z@mj8
z@Xpqfc!AJ)G3i4(LBdxW!Je&DJ9W~dS%V~zcVq%W67a*|wMbs~<NC@x*_P&JAKoj7
zW+6!oLBiTl9wS-)NOA@>uajZYO*raTum-axpU6-%kLBifmdqf|xe8g_jzErWpf+6N
zB>bC}s$?qX{xI45*$xzuWX@VZU`57E9HMf+^daW}vj^v)ujTl&&I4=N$EVzqhaoHs
zRS9j7>_y9FT=*A!t@!YCvDf{yS=u;!tf2iI#fb7M3T{JCyDn&X=kk6w{WJ6@sX5E5
z10P(d?is*Kc#-|}N3s+FexAzPNV+msWhL4<*dY^K%oo+hw1u&8A36~L(!bXk!8!(U
zJGVFgsx{2TxI?9-CcbtVYuR{$P?k+p2>z<t#Y!4ydSoV$1?g)n9>@2>kl8Lc4N`&=
z0uU^z%+;M-LMG%w0b&e*no1z^g|L|JEex%HrC&dS`~#-~ffrp`@`jByE6F;K5rlaJ
z@j*Jwx2G^IRK%=A{2eLaX3Rc>Ly@sU^OJ2UK6M;H08y;%aI-%4%oB-U5oKX(_5WP!
z(CvSiCP)}jzzm<xWs7F@6mrtmcUDOgWf(vmTx`-Ea6rU(NE5zB8EHGRSdYYEVKsgm
zc$o?Vp}cl?%o%UW19|y5cv@BcQgc?G{<w;Wn8I;d9UFNteYkDQy3hjt^qr04xzLcU
z8fTPCgC>9c9K2C-2>`GhO>mdp=kfrLNODn}<3;&8C@qP7*rr!tzzGAn7e|-ODR1Z0
z5N~GM*@sxjLXApxjd@9Thuc<M;y30#rRxQqzBjfGqt8@W-OY*D+6%)=*w=H@^xS)7
zoi=#h>%U6V;wq$UED~)r*R#aNWq(!z6eIj}eSkj-eyjfPBhPOxQb7fJ{>S#Nb|C`t
z#aA^<si%Qi@hA(fAWIPVT2(&%xzHl~cg#9+^SkmUB_n~jYZe{6c8O+UZrX5q6(d(N
ziJfyBUUastS2%_5#j|z*{b+n8ImK6B+;XfIR*lv)VxGRd(3+9E=-vjQ#_GRS3vJZ_
z*(sS1ujeP_tHXzt7EbPgBR+BnNwI0o6oW}fSY__<^M|&xkBNi|j+sY^|K_wm&xbq+
zND@vf;j`HKYAp$-V4eU7f2v}Ckb+(Vv0$t1?e~VGT*vLfhtKo(GgJQkt?}JL3u;!&
z#QWgu7DnsbHDF1ddGZ_?^Y~-4^(OjdE{6x7rPlO5-M}WS$-~?n%VSG?dUtDKvEk_J
zt%{+czbr2I_HQXGkqn8<Y;lQo?y&Ce?uMr7;hqOkLG^a5qH!(TuIVLJ1tmi|`mJVw
z<R<gQ<=fL;d@^$OCB!S);u0`Kw?t25aN^Z(IiCY6cpf9a)+W9Y6m0&p5WFLXiT^h;
z-2dNc_P%t&t`9NtqZwy<1`mJ#$9uo<c9$9w8RJ`|gCq79^<KyJvn1eR;ooZKib1cx
zW=Tq1U%QHW*Xy#7Ar9wlITEg$2|bW^Gn8QpHUlugI4RoO!`0f`ks%9o=t<=~y;hVi
zHs@{D;}##JAp~te-&OcAXH#@DS&v&tOYm=x;ECkt`98=awKoh{mspffEWIyOtwpXL
zVJ%{MFwO3#CK{a&Zv!5UCIJfWNc!Tv7+o+7@5$v#Cx$z9cp5U<+iALW&QJ>5qr=}I
zp$1G{PrW3HeIXMe=$!kLK6H1oAWHXe$&txsiX1<x^<U0EovuVq-gO!!v)mWTnOf%y
z@j<d_X*INgewA;tUcQ0v`!)Ck5iB;k`S4g56PR?8Wu^?j0mG2r1mQU^a@yuDrNY2B
z=aaMbPV1>yoV2ulcg0q$th{_Q{j=4B5SdY>7V$sbe4dxGM1)pCX8`jRh}5BBOF1Pn
zTCtc0w`zjL=Bq27w8MEVBEA=EgXg2j?L+2?%z>qhi}k1m{O;E^u({i2zn7gIiwg@W
zk?#X#pi?l?Og0ChwZ&!2pP6Mud4INw?kxa>h`Q2*k&|2D5hNsJJe1}BH|VG^znzJ^
zuwG?qTLIxupN*nu*|45&@fv_uK4p}b-+e7(t*vGED3=(w^|bQrEFT#espQ1p+B$;F
zmMTvF`|uGy6<_xM=)qy9NH$6_gU_XBLH1je{qpHzbWRA>Q}23YgX?Zgx9Yg->};l7
zlgDw{9=P#nGm(87GyUnUpzkX&hXu(yD-uaOIf0_kmwvGgv;Dgxp4miytn&`b?W{-^
zFFfxNeiWd)AZ)|AL227a#Zd)&b!vFGs(xW&b5YkJZ+<hJl`8XQ8U#N&&S3|TP!U;j
zBy5mT%cWiJu!Ch_ElmnBDgF>0@G$6)4=>b*k+CoBJ^L&?gEuUMa=q!L1EW6OSlUA7
z?h_Hc;icxu<ZnPYYP^k8OuRT;*U{3l1OV^UUZjjk9$Z9h9<j2s(^1hdCo;e2$f>m-
zEG?>B{P2e&zIU%KYh);tA{X}r0du%<4<pFVUh7zWiIS3H@bkN&93dr1FD@ye5_)Ae
zjhv^7d_wcggoRhXQ5~uqa5pxsqqDRm6n@uToIw(me!aCLEfji+5#ao-#+T`~e+!|0
z4!T)Lhc`7{h3~p#zsM04L1WW5w?K3cKXY4B(mAV}2)LZjtjav2!+S!Vt&X6i;dS@i
z={q<mt(_mbb`J}YS$>SKEab>B`iW(C%IEhA`i|HJ-^m=RG?jtF@fAOKzOs9N*-+(@
z;V0VkZP3Wl&Q3s2&Gc$x5~L)b!7J*e`E7OR`Ql1W?^8?v)N%LJ0;O~TO-}&<&%P=#
zOr;v|FEX#VZy)Rx*B|}RJ6?*9kGF5mFWy@#Qe&{=<z<VJFE?zFdt&K+G}p@RalAQr
zM-j!5kHp2tKc<hv+0448<F2(6^3%n@-Pyt%G&IQYsTYh43|IpNKuh}GwdYOtdbVYy
z3=?FTLQdIZ{&@m^x}dX-(|!Lxn_~;&8_wN9XJ@dH#`<~z50Bc}(nwaE9g~<>P$*0n
z3}wwYyxaFR^yr)K-9DI|h~!z!39(h4&UoXZ6K0v7p1!!C{${el$dLQDX;#>#>dGyh
zK7O>dj2|%MA}gwzSewcI%=RXc*$xW({vDS!qa~|X%jj+ddq|rh5J>Ky+P{1E6diU>
zp}!^EZSD#DpH(LRe`@*u|4Y4o9R1!|ZX2q(AAlZ=2dB4u0^eS4RO0fLn1=m9KG(a=
zWycUNde8cSyby3%ZFlvEl9KQ!<<oS2!DhDKBlGSG+vKxwc%6ifU8S~-UIzTxPQH7r
zKDFVW^AA5IfBzbF=$sC&J<`<rGgmIVXG+O_zk2VNIJU{3n|suO&;K~y|Ei{q5p0uJ
z{dtzkC~(<dNM8wdJzf}mB}+*{xOucB6Qj>&SVIlacPu^mFge?P|4U~`2!9)Z-$S{5
z^?IMu$>W$C;4fhxaX5KFH$4U86C<Ja1>IGliruI;Zl;z85v<dtjNO5=M#(aXL^vg{
z?vh$Y18<H?{GUptdkakIPfVm`L^%X^IpJRLJo!Ws5%g1h8WcJe#GO3Cn??ih-FQhv
zcVoPKl)oQE{qedv8bC|ST_9!*(ZqN@FJC#y+A5$;P9hex8H#@S5Kmko6W}*xgA7*t
znA79wdH(u8=Se)$M*iiz+c=L>l;xv*vP&h#-llStbCHVKm|T4+<JThCvic7`67V`W
zCJI(+<K2&PcCr0`j<RuoLDTVSXNdN<WCmqg%vs4OV*60o>&z48p{J1V65tw;!gg}9
zqo->lauqvnQ^H3+8b_{V)T}+LYkLJpL_ERuaB;B}dPYdAp{A$j+gQIF>H*69;@_zB
zKg25#sA*}{ZDrEY0w(IW!*n-~wqRH1$&-p?h0r7C24C;9gXGD~4;ez-cJJR)fe!~4
zOH|G&Y3J$-!mF!Y?1lmw8hq^eY$tiezqEG-N9?>W`s-VDQA&?EUk6V@p?8I2K@!P4
z)^Zxq?!_h#UIP_F|E2!^{$WK81A7{7A&aeW2H%<o{!1g9gBKWHa=E8;{ZUj%mAkrx
zK!OLpZmj_SWitnN=SJ>~oxc!0CZ4`fS|>i5AsS2TWvAY?11dA{%iq`wPr@_u-P<^D
zJ>Q8=p`5Si%&N8=4*T}a2NQs?ZHRYByhCSSgb`-AsV%DYQr%7=tzA3D$nmYyT25OH
ztq$^tOV$PrwSe$pNa}rDiR@p+v$3&>`cxJCuElgn_^;Tjy=|G^XExClnCn!DZ|+;o
zDC}bkS8GBZpl`2e?hqK4Y@p8El19kY@v@>Kv+h&o{g+*v4p+{|gv7+Ch{*Us62jGw
z^R?!%sTm=IzekgP9TvrMo1~?uuhV%80Q@^(Kz<+^9hNdTm#=oGf(b2oViP8$+ESh>
zataFVd!<7K)=<~K1X%j0o1LE$^%CQBBWUJ@wBo_}J(_ARi_s&z4;Nr;VZTd1lr*)p
z;J`n?;OMhA6rSX;*ccH(i=5fm?Tw^atmZGMOZ5>ezxBI9*f&1E&H8qiNnGqtx9Qb6
z1i0RB7e|s2Q`<BR4*~1$JU;#8B=-Rp{7FxYlKS7Y+A(#1D4aZR!v4-v0DkD5Fl9w=
zGr3Oj>e-sL#kxZbCCFM20pt8=y0|F%<WWFW6i`YEb(hiE*Lm$teKQRT2?z*bxq{OP
zUr7J;90!l|$0lq>WmiXYipB?nVFRiDOKGPXC=^_m&IqDwpzV3Cy&8QN#WBt4nIq{}
zJDGHGMjZ3=&39)Zq8|M74?gvftw3svXo*Y|EuPr%wSQA{!S%M-e;`4;v1lq|n&u2~
zYCX5KDcxtrl{YbL$JVrPl4f(ypq=Apnt_Q;+YUxLx>SzvwA<IZ!(D2_-^e-E+Uh47
z7WQ3NxI`Th)9@iap0t<rp(|&DzHv#drn<h>=>eW-Yok41>adxR2Yl`iIeo9b+V%Fo
z;_0Q-|6j=ae*^5fSKvRP<KAbb80&S5E}OG9!@9aD?-JVvta_V{9#Kl7e7I{B_2}TW
zjf=a}CYWvaX;=6k_xzPEHxUTn@VEQX<jOsV@OK=KA<KU>0F;>bc;3LqxJg%%C=$=1
zV!?@9KF*!kd?8lU-#Nv<?cm|E&HeIEg!xR`w}AB!{kQ=RE?ajW6E+!v<4O!@vfthe
zG{X@uofkKj*?iWF$kJ}2rb<&eXm;6-d@Z{E_`}gZG03<n4Pd?qCumo%gllpd=xKY}
z%)x%8Kw+tPEx)hHn!$_WFJit;PQD!v0o~N;7-y(XmH-Sho<W-`2}c9-N;KKNovQX;
z`@794q&I^)Vl<M0!}u*!mKLsQ8x$GD`{qNJp7y49l`VxV3YbfHhv7JpjIFsuU%*x#
z*xTb)MXFOa*#Tyx<yX(4KYrezkdY8m>#T-mpjz@a|F||5?8Sq$+9vvszR$kjj^pDI
zc~MPh`nr7x9P##7swpU44bR2N<oB!CY>HBy1kBpg2pxBC$21%00SiZB>e$>+d;y2P
zBUm7L*?G@{r6pXcGuqtvCxXIJIw^FJ^#0kLIvZEOcf=O>?Oo*&XS)n$_^gJ+7FR!q
zj767x9g4Q8YHES&+_4J=rgNXgZ#D;DBZd{4Am6i@hg3d&cPYSvf(Du$Q)y<Or4g#=
zrBTjKMYYE|$^x#)Z2VDevODoa@}@|%Aa80JKrZ}g5(@>sxfrqmB&UKJC-y9bD%lHG
zzDh24+4t(G_8F9JnkVdg584RY*2=XI<1iT8GzIBS)&X1M5Pmlr%SZf7h6a~oABH2@
z!@>G~i5`GED#0~^>}yDgzW2<Yjh@K<!A1?dbaf2neoOZ|((!kAXYHIf^wj*E(6@*u
z#v!9;+8b3T-6Yi)G-n$S^=F(Lm0=wOvf}>YEv>bozp;B77OV21L)Y9MNk;|V#=r5b
zIt6yry7c16b;XGTaJGGF;Ezr2{j~LDj_W23%d6eQP~o_$HOaC)Wxwlhg;s4EU9^9j
zvBhErK7cxLXZ&)tEP;@R4V%pT{9^M_f9{}uq4yXN^t#uo5^|Egk2%tFSv+R-fVYgH
z4hSFIGw5+|7}1<R!#KEE->HujkUiq<yBf$ZXUZJ=!bXxOmTcEy)A9+@$V6Ng@%Zyx
zr$HlC=9G(RX*ZU$yupk7*V2V$?vXDXuMfues+#E{HE@g}>gu@3a!WH2F>~^4O=$0;
z#L-{=T8PsNa^e|fu1sESo8$2jhQA5N!UK_<0<mP`wY(n<Axg=l1%T?CrcP4&z+KNW
zL(;U%PZbL~eORv)sPpV`2$+V=HSb1e-!Lg}{HfmR97*bViYy}|CWbhFvalxW)J07-
z|DjH+53*YFV$q6O*tLGh&rBjMQ$N&DoQRGx-(ks~%YG=$>-4@&a*4(Hx^m=!)6V>1
zP^}N-kHg*l|N4EMVJt2rA_={B7Ie`TzsZ6bjrT$re6nZYFV)`V74zEdjgqgOoXzwD
z^-<4X#!MVf+kZ2tS{YWHtV&=}804#KrdVmog2f<LaT&Ks0o;D8G5=mgGu@0tsV(Vd
znmTAFswZPc>k<aHNBs|T9##!>gr6@41$3qw+OrNXIe!qwu<!5rw84JFC#3jKc#pdK
z|Iak$QnvTKn$G`VyRO&e$c;@@Z>>KBUfRCu_9f~LqJH}QUnxXZ17EE>d^tACT(5B+
z2U*HDep1$v+Ks+mYdVPTi+ovBBNS0BTh6cP{+2qrxqwA6g8#<U$ws_<<%{2Y^YN^&
z6HV7T+0G3en)cvAE7TX|q5q5>l?}_C7kmf0k$4D{=wt$qy7q0rTd@s3%1eRYk9dB&
z*Y9iP`G36twTYk@%(qzBV>;4+tzCrWgWI4Q3rb1<{lWh*KllEpqqhIOsl%e>x3teq
zp(T7aYk^nLm_okmq)Ow0cJD>6WXrLg(2q!bm{-Xw7g=Lt@ez+EXL;tPOE!--g!j9$
zut*w0A?<<-S4cv}&|-u6q*6;>cY;}q+sj^2a*{&0D}<P?f3Zo_WxGG2yjl1^tlbf1
zj8R7i*>>Q-9*8gWL24Nu_N&nouP}dMUKRh%cPds>0cw`7?9siMlT}I{A_~@5Z2UtS
zM5IL92Jxwom&<nh1Hny7siG^TPm>d>taJ<a2EP2tBIJy<*!HX9xyTfpZha}`Ck$V2
zHdoY=?iFiYc`v<Ja%`5clz)69UCHyONZK*+2i}JijAvo#MKvzSQrWop+^0=D1F>}m
zna5!c`e98(%9=tpQ(}AMe3&=aKggE{>{D3&fjX6coFN8^P$0sb1qb5-^!On3Q77Tr
zCu?85;F!a1#`f=MdDrS&^v5mBLAC4!VcpeXm<9d^|5&vIo?MQ+1`4{oJXWJ*r(drE
zUu>MdW>ovSG0YZ^pL(;_Hlvn=8zkJO+u+;17k=|7^~d#^T7n2gmb1elBBCXQPtijW
zuSIgZ&EoiwpRC(c*5J~=iIn^ATFv8OvitSWEWNWa_YT-l7j;qa+F&DqzD!~UXSx;L
zfrWJtX2iv3Csyk^d#!@{%!$7XV40czLc)2tkf(8$<@8dNd$K&;<0bsN|8o_m#rS+8
zL1CN#NtRi!ZiIK5fxb6(vSOn__T8lZspaTvSEztJ9}ShiwKZP~LYq=7o88u*Tu7Nh
zzpT^Y&8D@%eNBZcWgjn%NW_`vvndVRB&or>Lw3~?*ixzXXvB`AkDbK?CRU52%No0u
za}{8+*(^S&yU})7?>6}_uYUMy6l+TnS1S}(knWnhDM*8LBu3vHAMc5vj}p&AHrU$D
zY><WocHZ1N`du!!hqWS@;A{n}12R4GBD%S=_ff;#D4*#hP|nAA?>bTIh;`rbDss{g
ze@c^jsg~^~3<?Bm&;RI{s-}P=sEdgu&d<&cpyY4+MI>H6AePX^<ttls;^nW*xU{&a
zD+v0r`=a+>51#FqqMR)@LxM8W_y)S%{QQ03GI8+VHL@fB4=?G_WD4*zSo5f+MS7XT
z>UZ6ee!JzEX(?79X~+j056G*)LXHeukdVTahjlVUzz9gBy0TN*Xsfxk(-ZzU=COSH
zeLwg+$t~Ix0n7GlYo{feOyK(4L*zSiV_5HCV!3v*Q?3_CjtL)$b|~YC)8xy4rONJM
zj!z$$cUiNWB2qBmh_<`2<-ISSQASgES86Qqdh@Oztb)WJfy}do1CbH_cR}y><?*|6
zcZ0!nA&3>zNs@}IM-i$QRtFp^A@1NdzD@gA%%_JQ{yhT#Dz2-pAaS@k`rz~6^66rp
zd48<moz-{ls_n`~nxgNvim0Ezw;svZw{X0x&s5G3@{&0JMccMP`*f_I_D8eKsL$5v
z^JD^sT89DQWzQ*HjgJPHR+0=ql4%8E=Zn2#^JVIS#HPlZbkA4EGeKb%cNI<a`w@v^
zGxmF3^UfTI|3Kob`pfNM(3t!Tj+h=~^?ja|{fWaQ26M28r>{Q!1%u&!z%4R#!XxtS
ze)zvR?}#g<pFGOpY`^?LU=QUPcP(kVnReG}GEnreZPJ^^!0h-DkhYYg9`_P!Q<I#n
ztT%5o<34mT{A2w7!H0L@pQs<1d!`U33v*u^ex?7{l0dqC=-2kmTKv$0%l3lHX!jSC
z^O4{cAEpW2v}_=_9gU|)H#^p{sC_*r-{u3kc4yW`!rzYYCT0|B|KQ;Tm}(B}n?EG=
z*%pY@!S8uIuANoxKvnRp13ryS`3b);HpBlkh~yi8rfhKbB719%77(=tU@6Kvw@d#(
zS+3;I!Oez*?4{n6D-L*D_$zF8-UBz5n`+Mo2{|C<wqYY-q+8jCss5>2+bF-j&_C(;
z=R{mZqtl_UR`kWoiwKM599`d<@yhk=0H4u^Ie1h={0MiVu5-*=CBY|mTgj{v??;mo
zDd#kd=h7%RC6eTD<XI8-r}>{8Rba*WHzsun7(`KouxiLGjRJ`!c%3d_WJU`oVDqp{
z?UtkEI(x(TH;oQPHg&pJdlV2pL_g@-(0yA~4V?cdRx6j|KXC@Qm7_Rp*dkyUn&MY}
zFo{gIvWjgzy$0SIi>nqw5Id2qVqO-|VoR848*9NpDTNqtcobA^k>bD+x%M5Z9-}w&
z>b)mAt=}||V4M-I+8M+_x{=O#0jf$iURT1`9`x|DbV7V3v2CmNx@tYsH0U^hre-Y9
zm>OH#+8@DKo6aL7LQggX<)_OG;0myflesij_Ji`6K!QUH`OH<hg#)k0_d6!cNM5|z
z*R$Pz?=#S->i6=m^La84cWv6zDie47fTK&K6#b4UGg{4ztK_f;W#;*SeyruCWtDkl
z=&2=eYTX8Tph`Epp%D8>cLc`+f$z4k5_EIa6A3Fdx)0x;lE?BevnqtneO)-yj51s+
z7^FG>3^gefIvs&2rh3HHJtoX(IFIgPZ<=+uI~HYph|lK$VyN3GZG8(ouFdrGxvBNF
z^_+=dcDu;lb@x-dTFQ6BG`=nu58d&y)wGbtKM1Z|ZKwXb&BLA-nUR*^xL)m{0E<Fe
zT(CvxT*Ljsf*7~8mY2}cIwYJ93O@)s^bNID=3UaHVsGCU(KEl1CgEk%eQA@P`{aRu
zoKXZMbs&naWLTFpF)cZzFasdVe89_~tm)n9CmS&KAR*;zwOdJSPgq4EIapaI=Z0Ad
z2xRwcy7F?=-D}~L(6*IhzG_|UI~#`$3&SJqO|~;9)TT#qQ(N4JX9vifZA7kVUrYa8
z6-nQ>^=XpC&Vow$x-rt`IVijzi@<tXvOzxgMw=-rqxt!J$ANRKiCBpsb+^lzhss8_
zUOzi5>=zo?Jus~;`xd?zn&rQe3RkEwb%y-Q)LYL|T95D>u8^A!MyX||yB{Ubn!`Qm
zb5lC1>%OUnYvj4vr{hNgeReCvu?>2PA@Ft4n@9hpOLH8=8|guMeAJ@Bdz!o~(k9g2
zTY(|7ts_}h5X$wwnGJ*GzIW@Gp!2W04LX!5W^t$IIi*<kbbzWKM&QFOFL(`bk^gp$
zqF^qzv||a!KC5+C11yO9)SG-P8ZwaytQ47Pr;hmquozPm#NK1+F&Fte{G^iq#@<^-
zRoSj<!#oBmiXtc=4I&_obW3+gcZYOLx+Y4ODBVbRcOxk^>6(*C!(`Ik@!hD;+H0@9
z_B-}B#{ToY<74mx#<=gRuQQJGIM4eCp}8vaY{D2QCXqRF9NUK1L$Abylu`kk%GP4E
z$*Y}ql6;@&O|S4TT#H*PB);6W2h<Nu#Y3x^!tp^*8-YrUFv=4THTX_q^=39!gU$@U
z*}>w}q4FGr{%o)*Wv1-+UG)CYs&E{81I0Wa#4lgOs_@#qDBOw1PxNKeg0XUSxtMR1
zTu040wuG)1_h*HZ2jmHN89oN_QGwhQa7_yxi3#a1MD6oM1F^3H{ASB$_PxdZXSNzf
z76DQ8R8IFg@^B?0uS^CX+XECOx#iBVeLdv>Qf<iF4T}X)SoH^o^{5>fbXAyy44Ky#
zcW2#Y*y?3}n(K^*=43M$dtR|wYeq9kKV;)p&}(=RqZ#>2TV;H9c<a289p*0UjQSTJ
zv^4Q;Xx(L#41UdKLA6I2Y`i=|N`+L|P}!`=xD=*G#W6PR-8EY0ccjB8v(u_>@yv2|
zx5A3joNG`vt0BHkoR!kadg|0(U~pQWTxfeD)!Jp{wGbjj`)z2|@z@ucmKnD;#(9Vt
z?R1%yZZrmTY=vLz-Ja9Nw`as6arE_**+A%XeIu-Wj0mMh-(~$qsir#a4Pr-9(c!u7
z&3qHq5$ZJTK0P`Bq;H9ch)n7<uH~~(QK_xuRIB-WKwrp6+Z$*Ng~?s96_nLiRwH9{
z7nGoD5372HPPEF_61glrdU?Mkzm?W(KLaU;6}u~9B_^@3iJP;Hjg7Im?P`l$We$JL
za<Z_n2pLtdmidL7htgvUsY}d(Nh142uRlBG6o%m(ir}1A6|5+z4`-3ud<~eNApf<L
zDDi)X&VT-m0llY~ecq8f?)B+Y!h-dmP&lC-s9dK?gO{22H4l(*dfebN;IXacYOE|W
zNJudkoACAP+77WETg?j`oLB4ga~cvZF3XpNeol#ptC|f~PVR&0QBiO66i14+n25M8
z*-1Mt#c=%n{kJ`~j7dBC<11J`CCogtpRxE82e-9j4vdf98;aO0VP|92Y4PGEBQw{4
zUNKysfa9fA8zgs<8Ig%{Mdmg(HWm%Vqe#r1_|x73u%)Htrm}>QaL1?|uSHdLDyOD`
zS8=83@KQ)Qaom}nh={8y2G*-rd82;LFOB;>7|F<j|3oxg2%W8E6sV(hb?Y0Oo3FQ8
zwmm%u3wE||EEajOOlSBj3Y601dE%R-AC~PTvperhpUqxeY&Y0QcHNCHHgB-c@|tZw
zaJLQ$43tieFkzW+w0TR#6MwSsz?$XduZ3;})xPS`s<pj_pUm=UD|jrloi#pt226&M
zTy~8*EEtdZ$^r@Ww}FgU3}H=OA@1V_iQcR=-Y+)i1|GjTd__u13fCMlHJaKyhDuez
zH5U!K;gMh0L=}I>HhBWL1wz{wPWv`WQVOUx-0~kke)i~5)8ScGan4dV<>|#m@>OQ0
z`%Oh^)QqR|=N7Q{C^Yy;M8j&gvhtO-oTrD!D#TT|gdu|5;)Jh9;;mwi*FaeI?=XzZ
zQ+A)YK7XmLtu4WaMQl_TL0MK-lYHlEMyh7QF3SM=JFq&jeYH`7>*?v)F4*oiK00i-
z)PmZ+0(xnDK;#9i-9yr@xn!4<THp4%2hox{YQw+0E|l-7Gf9OtQhIuN$4k1Y@q8Oc
zyd|DqXRCp@S%TA~TuEESwmKo{uMtBRb2qc$z?8?wyx5!}JVNl5^8Jy{kQ9QC?n=$g
z)K&Etc}7*o9%!KiXv1O(NCW~07njP$XZP35!@Xau-M}^@gVGpxks+%@eUyHG`q`i-
z3u5=v<t2mZh?V8L`=<{+Rtdm0flxEyQ!&HHJXQ4IVxw%K4}}co*48P>oT?ea*@Hhh
z+*l?}B4@0B!|>jw_8{TV@Nl__jBsOPy36^WKkkCvyG?4GakLvx<J%YFJapH46uaxI
zrJEV5ARlYJng*1uii+rR(7qV+e06QES11@K;`SPAQjuUwG^#j)F6t<Ii)~;$4QN-^
zcX#IoXW+7F;oTk}PkU40P{Fjg<g?w$SRQ5dGc)}U0w2Xsr{bn^b90MF`uqp^i+D~>
z7bznnwjZORr9?Bi12^XE%++%;-hEkKSa__hJB8yyA}DRUTodtoU+0HsUOmTp@nU~$
zKl<CZZ>&|RynCl3#bIG#*;@=ZIuG?LBy1Yb&VyG5d8#hsfi8f<dS1D&wf!xrdE;`k
zV!byX^!Duu@6Cp8y(8Igfsz7ACdtld-_sA5&<Erhn=?N>E!T=I$99vmLM{E}Y0$Hf
zkPvz>Q?!koYOxOd=$vMNE-cy6sqt)LI|wVXezFO|AA{K0nL9e|$TLiMKTs6@`+zqF
zatlaXSo9UQT-JpXa&d75^U)8b(xW|k#2jB-4=qYtkQ{UiKJx24Z`;l}>uzpLM2_Vx
z$^Nb-g5vW0L{+Aqt^qzPhV~mUVT3->|C7Ayo$@!(ZuEEcF%qo5W7+>sLjDbxy!$(p
z`}NV^>?i4e)70F8H44vI@E(={t3a`&X5m%?gHpA)iYxvv@#^jTI`9){LowU$>`dxu
z!>9sr*1m94T4fKpd&93a-8Hz!WJ@oLuVlfNxCQBMB==hr9P=t?{~hz&5yiM0oB1@r
z$oYvg&9CQiIphAsZr@Y<zZ~iR;-vqtZ))eE!I*hV>-z!Qnm^a+%W3^p@AvQX)A1l7
zK|v|Vnv~SwA#DN+lNq$~6>rVjk>3iU*KHhwh=`NlA`MQ_bT(m~2%oK>dSfiP9#u)B
z8XEBQM&=>Y&9GluS{k>myZS>W&?>FWcZw4qf*Q@Izjl|AcIJseS7$i*@LTuDNOt$^
zON)wWxBE<^+3=gwbV`2u>s)s!5x?UJNwU{uDPHU91yxu5(-HfiEZz_z-KeY9{s%PF
zy$zq^e*P3srf)2uGF<g}{`|wAgVMSI=&AnRpVH#uJi9f{Emi9`Ga7i$iCm{`T_<&&
zoNUa@tsRudqiK!~h*IX51OKzedo@qIrt`N#@=XMFXt8O{R-9CwJZm(pfmzdq1qQyu
z+gL9dQ_pe|f+J$lV~e#bYV+3}B=)XGO?`cR9c(00zv)-NEEvX}Y=S}vo#h16-DQ4T
zA-fpXs7&2*9xnBnQwz2nbmPc2R=felK2^S}v5LM}US2?hdMYUwGK`q}<Yd8<6uY{+
zO}CT84$sLX%AIy1lcL@^u20TbQ2$y+?*Looz;EPv;UlZ76j=(dFfk`)tvzigl5$$k
zHfvA!YPKi-=Q>Q6HSgKQtg9k2<MMD6Em0=Hjoxa7xd720e}YiGUh}XK5rd?iwA?fi
zcXoa$$h)%KPIC3H?=xP>3c=y!99qiv@KiQ;JW=d1-#UA7HygvVL*L5_u)w5en5Ao3
zh(e?QktO=cVzL<B84HDhjXXn^kD3RFhuTFV&84IchA$gOM&z<(lD#&plV9ukuF1dH
z2uVmxG&O~cf2>3@zxzToP&IvyXZHsx4nqYCho+|9Bn1#nq+ZuH&rVf!E|lht<@4!`
zK%w^e^J;)ugD9W@*j8mrVsP$CqY4Q&%@Vq8Wj}l_-vTplz){}Xy0_5oFSS%w%W}J(
z=gX^sak;r`WlUv;h6XPsjlZ&ew3N1VIE>pKDHOw@)7b5pDl0?tGZ0+th+2NTvXbSg
z8uzby$-U_JMcOs8{u0>ZwYWk0gH-S#f0Zt9IZ8_zLpt|Ic50lidrr=WFP{<h#}N_{
z=`-SXg*7x(Rh{WUE<9CFr%lJBl@SUG+wRwsEe<6TzxEo12m)lSe=Mv}qZJI~wb@*U
zj!Yb{xLo*f?y$16c7``-=8P&UdupgF@0qRCY0}gISXA+(u9>yjrj|h7(m;)qTvD9F
zab!gC$fcp{_4T!OxLguf_M@?x^FQ(U5a8A{9&BrRM%`MgJ0FWBv(V7c%q%U})--a?
zvC+|0ovu~};c_AW&`<mI#Hn14Gf2bVBV>3--lyvPjl9RGp3C9r_ddDAlBzfV(*6M5
z4zKMwQ;MEQJ{Q|qx3Za3qM>t8RTlg#S@HM#J{G<Ym^Mrw_}-@?Z#c;96wBkV8&)x|
z?3?`^#bv|`+a;l(S5k)=v1=wjV3PRIOnQwr{aXW}h~_;f>Uc;>ei8P&;HS5Kx6!XS
z01C?gP{sXUFYW)oH^G17#_c&?L<<P~s9;9;`})Qt4adf$AeFh!n#X*7g~2x{6?Iv)
zwLj&Z&nEEN+Fv6~=_+BF>~m173Ya@~R;IK>a)i@L@ZQiu%OlcN{(43h76*g{!(&nt
zNK)3Lv1PBXOHO^iZ8d+tM1g)lh=%j+t7$+Fry2~b0Qo_(I{PTH`D`rz_!vlt+2Bg1
z-%AN9X*}=l>gv*o78Vue0R*{<#YKF@n-zqlJ2r1K)y1dyXDUij&i9!B`;<%DMfF2h
z|AW_L>3@tY?@7CZiA?oZ@sAz_J-9wD9;ZH{R-k$zXTpFbxap1<fV(?2pIkRzY$rzS
zz0WSlFV@OSJ=wiX(Ig`yQ_RVH73K)nL_?EX^*sIbpR^31m`*l5x32E)Ol?)`h<x~9
zm<^`8f?t7o0bi_awE~a=rjRw_<eFAx<s7Ntom9Tp<m8#|Qs<#h65%@TdDZSxTAQ`*
zn3(W?);648i|wOtI-dqCO{DKFVO?HbLA(@3npQR`-#E`D&+ib=SLPddepA8cp|cX5
zR3s)&tpgDaZ-kKdK%3<36?(_=bU`I~e<WJl0EuXX+uXM?Ix?R9^P>$Dki|*NIgO~U
z?p*0msgApo!^~;P58E>>k?F<&Vr8lqf`NO^l(W3_3%1(=StHyk4!>pX8YN&D+l%DM
zI|V*9eS?Nzkat)naJ#vfyZ8W1ApttL3W+z(ZO~HDsdpKUyvtkJJE@wb;>;giIFX31
zP|s0`@k>*!e<J!=DIdtUSPChA991K5dMCEa(9R4%J*aHApj8Xjcjh}$!DAAJk#Af1
z-xr{-&tkrOwPnkJmnhwItmM%7nlRYF^8*NUu-RXS7slo(+BKX}$ClXloc;HFb<B6g
zI<)>fr)peELsL`sB|)DH$$^JsmP!Gy(`BxEK#V0@&xHHF-olzKN79#}=Ymu)7_3CQ
zVdc%*2x*e+-Lb5SjfZUkkNyl51?8}3fP{jY8agTV##f#yS^)YT&}U8oMHWAh|KVUI
zCM42p=f}TuU9YUX;ODT<-9ZC|6ZE<{?EQy_^-r1%m1$begO{8`_~Am%u~c#dHa50N
znVQb|l?tiv07cW@>IO{=|H0V4DLp=4>Q@frXfLQv%>KN1w_-4#rT~(aIdgJZ0!Hfm
z#=cN^k`e_%ht*8W)O<1AXQ#%ivH+6Z-m#xZ4#CszrW0ATNk3x#J$*a7VW4V{b<uL~
zctL{>IIAwJ40J#13viox?F<x7>L<^-_kjc0K$ObiD2<g{ck~-3_QnCA7gq$l=A3G4
zZH?-@_C2_sik!UPsD9nN#^0Z&;d&pjoddX72A=vSqrf$Qhsz~%Z6E&q_Nz<f$olE6
zV?KpH9`dlsL!aM&q8zfE_Nj(z&~(WKj^C@JwkoUMX_lWRQ(v+AMK(j(CAr7sW8&Fc
z$;c1x(RbEZ&rnLqWshQuH?sN7MBRM>JV5c^`9UripW}XzJ93aW7}je3!9-p}9{oP$
z|AcP+{~i%=qy88CT#tYTV3qYyR6<iR3Le=jLk+CvJk!cW%6nl{Ko5sFw;u7V(SN(2
z=YF@?n+;|TdOmC7fD^({CqmGH)SUm9P2zn`283H$`@{*K_H5&Bs{jqQ5=u`z{v{0l
zt#8h0(AX2K<Y<{2UN92F*1e5sA>|&>7}ll-6giQ?dbyTAW*(D&z|aFDyKSRYk1TMH
z;=kHU4$a@+HnuHiot&E~KTSN~<cQ`&TdG6-H71_UfA!!Ys>*j!TpoVLwZX*6FSII8
zEQ0vNWm3&yfc-Xso<~Gc<4UwDv}-u&(8C@dKUV6Q1y*MM?L?0B<AZ}(0?5to>OY@x
zJ(PzAjiE*@dw$Og+b0%E?ZB^4P;ANm-GOKP9ZB<^{K`cT0YB63M?oo>CoG`I`xo5y
zRRq9;prDXRWXnKcH#L`DYN?mN|FdofuXrW?PtaNa^p#($k0N9${yENUbQ|n397&7=
z9&5@<7j)mS{`UO29RE?_IMi#^QsS&`Bt;~gq1Q`q70CBk(H4+4GRl<2nN^NrI`|P7
zNCj9^_6Ejww+;Fj0L=yN{_OMbYq&12aF<d9WfUZr{L$0`(!#<<>rpHjWyS7N0t-DT
z;8@~M^I<BP`G!KCTG7>&oKCT7n$Y+P?3B;ZowwKiNpRXD1G4ncuKIHt$Fwwk!1m_m
zIzQ*|tj}~YaT6667YBhrlQD;{Ua>Va9V=LUJznKVsGYI{d<_v|oF^g{Otce&Pai&(
z7k5I;;qys$28C2BynZbFL$S1+18Cn{fQein6qw8K@E(AhacS3<HE&;@<@3FZGVmOJ
zeL$2L!?q+on}(m->iGv#RX9;|XW)GM=G{BDli5lC^eS9zyR=>?MZ@$uPoPBbKKh>O
z&snPP4286}F8(|Oy(eE{U_eGP>m50HVH5m(zK~N6d@yadw`2n^viKhQPio!TW0wf*
zya->ye2O4aqHZ!2p{$iDZ@By=_Vk4Dfc^j9aZH=`__GA_95}1n1_v1!<#~th)@5RN
zE{i31*Du9ei;f_Fy3z~Lx+`=~k;DQjiSPpQR<r1;U_-R#aC}QJWrt-ZSnBTJ4`)2a
zguSOI&;DT)_>%{o<?b4tEM=Uznkkw}Cvsg)kcbW+y=wdq?Db^J(|y#`h@gMkrb0q!
zm{Bj#GL8_V(5W_Qze`nJi!yqgI~DN@XJ>SK;)St<K=32d0*-R{i%Zy@tn4@}sU3Ak
z)qrAiNz@!Md+%4z)+LKn+&6(zXHV&-EhDyK@>mE7p9U0|5k>)i?PM`$s^=&nVcUZ3
znSR58nsXe%McDVzZzo#*Q&S`@P>O(!w>DAhUpB6Ilkwprsx^-}n@8uL#G<D7?6Byu
zECJQ&8fU)tw?`bUrHedH!R2OCNt2frPl}7+$!ct@+=*Q#;(YP^dDU(iC1C#<<TmiU
zD7xeSLU9(@dw@4?0T?=!HM;x>H$Qw{RkXLieuCOwYv){3%|_hs+OnhSd93beJYE+S
zb&+y&#PFa=0tMCRU);jvBcI!*^jiImzQp}EPA<UQ`ky<wt@3L8+$6N`7wmiSvlcr<
zH1oct@!fX8s3(Nkq4lpWukE#6aoR%fEmC`7R@PjqraN`Ta-*hmvZR>vh1>Iq9#w}Q
zwMF7)aZckN`kr&$%&)!s{tRf#;U6wAE?2+xFF#mF|JH<9gZ-=Y{Tn|O3M4^oEmco_
zN7p~7YtKRKzVy#R71)e03a|4dKTtNM|MWVwEDk~6V2QO|O};nNtH-NI2;r3O>MBEe
z{#5^)gAoTWb|NX0_OtTO5hDqrJ@Dhh>@O+bc=^lM;Vnq~72@`7&MSh1Mi>2rv*qT-
z$E(HY`EmW7>Tee}Q?5F*6O##(lB!&?PhI3>{mu#)CbEm&yxI%>lW&?i5hIM3aA)zD
z5>)T&z)@7z>Y7RImeoTVwXCNfF3_Fv0ns&&WWkEHx-5xhFH*M+@10r0W%fMFE@H4&
z=lif>;^?)MZAu5GQqQrk;ax97hBFMLaP!hR+CvY;RIE=s`?zmvjn9md8;*{Oz4|LR
zMV{sO<vqx2_Btr^ayspVXw)q(Jkq6I$@t=~cUB=4%Nw0Mt!=2b-}X|@sEZRxRnTL*
zciD-jn5cZZ_HM#*wvt+A$$on3M>oJCX_r{H6?f|X1#~{SYpu{V|4>Hv=xRLgh&u(g
ztKmAi7V3T4d2^VkJg2L@SE4DE;GgqBMQR}J=E6s{w_os~vcq`=|McMit6a(z@{4`n
zZlx)Piw3_YeM%nNU~(J*;r9}2EWs=(X}s4O{p)d2?w?Oy;rn7hPorLFE1F3ZoyFj2
zT0FCvcBnl_lPn5JwG9`^!4|9z5&DJT>*3l)zC-olauYqC`B|UDze%&xES6ogI=`(-
zStKbHI26MYFJfyyQ63#)n)AjtU&QBnOSQT=LUq)2Bbdw5{5XG8Y&$h6w`wdZnXeHM
z-Sh^Xy@J0baC*+uYjkEAcUa!ZXh#YL>ZMJd%LfjMO|jbb(Ae@Ciek}qD}=Blg>i<0
zJ}UJ5HKheMLumL!u)P#9Yi@=qy=HXN{Pi+!Sm^{2ylhME!n&H0!*x%Q24_GrWHhdT
zpUc(~S7m&+(W^QU604-4n)N1Nr>NQJ<qxdvP%PuKx^;Ck#l=cWynZsh{*E9nP}Q|Z
z0hcv$bwGW!ab%bC*_(nR&50}1;`6-$&2s6ME9LD&Fg)oco$pjFXad@ZXsK9<lDJ1{
zLZ@EmqM{+_TfZlG-N0S5#mW2AM))36#s|Sw?S$O-fJ0ZIlnj=b#lE%Z#)3vs#}fuj
z8V;V7Nsw|`D~R&vE>Uz8ln`)#xQhPpOkup4j(^U1>6>|fQdNr@d!6+SB#a>mYqX_#
zd-}#EInQkg#;T%haO_W9LZoOnU&Oyz_EGU2k!GD;vST}Vv*@KDRn?;kVrz!W`Dnu}
zyJvjyRjUCqIFl_3CfGmB2ComgXx#-Mvvi_IzDQ6->V@f6$@NW<2)bwWuvkIJP@q#q
zo%Z1e9}3qMxf{Fq?B(&f;=vO9i=PRs1(UqW71o-cMAlX>uNWr02BK=fFjyE=q9XOu
zq+HffKk%Z8U2fBKH0K;|WnbbE^eR?5p|;Zfa{WtE|4C{br>A}6x<mZK<gWyD5aPG2
zFh7-tR?;RhN?$81KtVb-5gl>G)U;VPH-p$4b47_3@S3Zz&-<Wk2zNA_r?WZmaT@Mp
zc5})Bt=)m67L36gBf06KcJmoA3}!qT9k-HHm6cM?7Ghy!24l*`Mc6$+fa2bp$qeOQ
z$(S&|EF3^LQO!`utZ%$IcM9r)PB|Ec*R#(J##LXYa1`a1QSetXPA6To?Nq1K?jb2p
zYIXQeh$_Y@d{Z&nplYWV1DXf;TY^dXiu^6si{#1q{e{VmBtjW;XEuo^y5(qg^Yh*Q
z0|1@WXjNBgwgAccvP7dOI5~<>+X7p#C~Q!RiM{a{4p5PvvyB>~$CMLpOkOKnF{zW2
z(r>zQA1xp-F*C;RS1rVc%RU$31|PxhvVVyHmG_<#C*t%C*YUa-@k^;5zC5BK7Ek%k
zSsX4WJFG*;;a;Yot?%Vv(2J`a&q+!rt6tG^xZ2S)fqezhwSj^`=CcghVRmsAQb(}~
z11eI+3*G0U4f36trZU*wH8&o8K<OMZMDFZ9af_>mz<FBmj6f1zJc$X*zuMLg?mEA4
z{jcH5<~Zxkh$7|i_=Kjz*|^f5b`p`18F%}`s7aOTeT9?jBz3PlmnmW%pItNr#B&rn
zR-u9>AK3I5S>x>CZH2jEQm$PVDV9%mIeFHqA}b}U0&Uqei>N7<H1V06KN=pnYkF0Q
z*_0J5T@;h*was*o8VGfFz#}8LbSUXh&mN@_aqEYcZ|fPu2cD!??MwTad2JFp!Mt4!
z_-n?aqvEmO<a9iEMe$~%KRSyQyQ02wgp2phTe8WxcLJKJ;Nl-{%uZ!-()5OzL<o#n
zOdJBEdhiNVB6%=+oykiOKW&t{lLVEiFo8wVaf*w8zS+M4z*vA}BYr24wpB)8if#CI
z!7G8*xXe5=yC2C|z1OEF43{6z4sjg~#}|^pGn&?C`=hnv$<yE63B=z;dz3Qd%=FwN
z17vkdsu2SurDn04yBFsBkvR@#ttd2AS*58v(@4QAg2;UfZLzxeAf$?xrh+zXAwaBo
z(VFOK%2Sy-z-lTr@VqAyQz0T9I+$8iIptTUp-Y3ABc1d$A(vTs%>tF<uM&;7&G!CJ
zEwqO})r2d@KX6<ldTjs<eD`Ic@!eK;HH*RZusOAA2Rn_0R5V)lZra?X)k0V;^%@+k
zscR|+{-|&<AfX0)(L}d8*8(SC+NDm}*+!$0qNNOUtgdW%e)ZfxqQcX|z9!)bYDFgB
z!FKf(Yx2$~fF1Nbk$tJwAdhR;>H0IGTm^DvJ9>>b$$GjLVZxhRFjICNTcTX^Xd$C7
z?sBUbuU{3N;#)kAerSIFK^MUdQ;>7O$rls<q<~}4lIzvkan&esFTs*#MFZ#>4{2^D
z(WE<Z_aHq(vv01RW61Aoe^-d36|$>MwT5u3*K;gEzN)H+7QHm3nThN+u}Qa#&lm~~
ziky@dcRH`q-=AD$fpje_LCB3}S<g1Gv^-^!z%|rgThi{xiYvQU6XyrH8!TnF0N?b|
z$w3>+qE|ba$!7s=7wl-425*>zyuM6%i`Awi_%fw>d3r@60rLErlcL1zgQ|rC6?)mn
z2hYhkTzmK}J+^mJrAH1OX_vYmpbcQfczEh0i9U>`ckIlzf_b%=*r(bAIVmnQH@zYA
zlyGv33*W%oRFMkFBub3%h*dfLxb#l7IN{|etG@4{>vh0OGRK}?^)hp1m&K$U6@D%q
zx*IJ_BIqDpmMMMkvbq_x?|i=?St3lyxwt>`Lc=7zX}#aitI%n=G$8>xu5Z|O$*t@8
z_GW1M_#(ErKk$Qdv0>Hu*^R5!0Xyb{ns!%qAQ7%rwKQg+RFCt1tBez<C)KMQ*$ZXu
zo3PR--R{Dck{Q01Vc6OtsMY@ozjixctx9yJ#}tg~3&&Q{9I4ka<-Ayb492T4+loo1
zvF5R&g`L3YxPvu(A3Ay#`d@BocJrJJ;_E=G(hlmXE{kMr;MTl^NQLd~B)>$QA`c$b
z8_D=SJjr7l7{Bo-bZ%3V#+UKMaxyEjjmz1rfV0+0s%?<X`gF$?-<rjJXG5$lwcg#9
z%Lav~BK3`;x=3=|H_Jk*D+5eI3mNr1SCRB;m7UG(GR?t0rTy*ZeXw?e<K%w&%{8RN
ze%=0hH<1aS&1xnFt~~4F*1ejP|AX-PFQdkLR;^Fei#7+PcF>yI)%2j=x!Sk0E8vmh
z)*Hp}@PP^F-NcC$S=rFN3OwpQbYA{`O$!iP3Egz0hpPMrB6_@wAvgi8x_IE)z6ATK
zn%LuPOrgwqlz*90h9Kv|V<~Mj*RV*3*8SlaR=JZIJ^Hz`<Tu<lszO3Pj=`?0KQkY3
z4clI8DI11^zJ{J@f-kqOu)5(?`MKtnu;b%ohgcX-VQK?)iPzEtsoB$BiaunKMR|=^
z)?YSOYI`xZRh<e|&Z9NQUg}es;1$FmL3|u$(MyGc&is6?zImBZ7=Zn>idT~<6XLJ$
zKZX9mYq&v5cTso*AJ9;uICnr@^74n(KXuBh7}#Fp^{6Qu5X{>_*L&qA>xP?QlO*x^
zgV;(9E)qvbE`*5vL5i1CB3w&TMV{Me9LTK0?fHif-!gVi^^%evDjDWO_$vVF{TP4%
zMaygDjjbZ#mX1Un<RWMOr!+>ta$dcMLx7<@q@1?#(0{L1hYeg>Tr%K!@7aH#HdwTO
z2pW0(qeHhI%IWPF1K-;eYTd$9Po4w+cw_zgr!iDA_HgL4SWZ@_Ur<-bIhNQ{f|9km
zW_wCvD}{;uP>!vlf*(>8SJx-|Kz=K4D3{y%=T6WlR{Ce*zRq<t&*8mG%q6M@W6ek)
z0pN9{gZZ#E)j6y=olmwU)%_R&4FeEUpi2~#ootEz>ji(uS4_G*a<YADrS@i!7#yeN
ziQ|5i%Oz%Pz6$bL^_QZKJqxh=On>dE&%qk4k7ENQlI!$(*n4NMTlm2%83O1}?{rD0
zGBXs*q&hbi4!7TVG|;iRQ>@8NsRBPM6s6{yr`ACtQm&euoFRs8(YNp&;Iwoq?M)9}
zdB6|#NE3SPpAzvoD<|9Dw4E_8VwJO5D};o#^szdD*N>k)8=X0ADLZ|iwm_5SZ8S1j
zed3Bs3_rBFN~iHNYy8eo!kU*6sYuzC%hDrtjl{`LEdn?6suQIJ>+bi>l}M;OCZ)}(
zE`-^)PSM<v59@)RUO0|cvP0#ot>7(NMbW|z=KulT#9TP682JDum#7>xXnDP|-Vrl{
z<5hnq+)j8rLAX0iK?f~e*m;-XiE1_YmsUebbAN&R-!o~d40=Y_xF^v}>f9$+v+USO
z!})+uYwvP3Co%)@yw>2Cyt=~V`6$|I-vI*d>2|eM=jvaCqO4v&f;smD<D{IfjSgVO
zF%V^RmYxFkD;TrHUp*m+oE0sq(!)Bn9FzUViww|-?zyB+MsSY@l?2Q}PSNqlUVfAk
z$V<Y?^tI>Z<)xpbLcxQvMFE`Xy2ZTykHi*Mv(;PYkN7W#KbLaDK`4`umo}Tqzk`w9
zlL}@_m|YJ^X`}D29Kln&29znoRp_K-6_AUsE7R9k&BNE{ag#M3<_(W=45@2Z_B`W{
zctMg`u3FQgIzd>gMt$6PD8|GtKsR1Jn|-GNBOxllq=UFoY25J8pUb*ybJ-g*LgXWs
znQ&Kgk{DO-@roYn+MJg~A5Hhh7&F@;+~*1kBAJA6?)=AyBG&D_z9obDOdQ{TO;va}
zY+daYe>b<?L4%l-7X4_luuY86N!3HmUAt)5<KmIfovuvTP@Fc6qq1huB4!l@1>fwP
z7AUXyeD}*btY$<*Q-$5c-eaV2I_N<`FP*OC1UcWSUb$pk-(Uh}ju)q67&VX8b=%=b
z3uDOjjD{3Hx53&tqIs9$K_&!JKR^}Xwaxj}0ufqsO#PdmrDwD^Ou-u!KmS@-ak?%9
zUPF>smBzIdHnNMPsVO|w(9lA7Ftz2*wOGI)m-)@sv}go4_@us!_zdxm%qeHv>(Qfz
zTv(_*@`u}fu#*`t4fRpKJ0JrO1p^b&wv_z}_QXtyxT{td($M>UtV@_V$5Y&7bQV43
zz7v-R0laSm%QUn2cAD%>2Q@icoFJ}dCDZ{2^S9Rs<w<qvg=&dwA&4)Q{e)nL=~)3A
znbtUGMPJginVqDf;bhL<T4g7{o84%zQP@VjvGQLUVY;U1&kA9eqvNB7V-Z;ghAq@4
z=Oba7*T(9fSDmcP>3KisW0T!xoDAGO`xt4$i%ThN=+|5?GgF^_ytcd!<wPVmN&e=*
z;WCX4Gf!R_2stH%m%iAUa>_-FkxtYrmNf6nZU-&7*IXJNFXqG)xw-wwPqiE<C__t=
z)i`e#38J^j_+ZiIWBp=1dr(3ZTxmE8y)Tsl(b+E|w(KkT<~t;<-DIM3X~lQI{m<zo
zb#GX#AfdRV(r^5-JO}r=%@6Iiw00pne@bM8V(2rg+&Bn1eU=QAdf?Tt^}dALACJcV
z#B#3jjK5|@d#ygK6RK9dQ`0i5V)R@v`gA^2SXDn**`utoYOhrarbDx?H790H4ZCSb
zwc)qI7EHd>GtqiKCsUCiY5zFU_n}-Wvuh{@8JDq+c`ZiQ=SJr2W*i97oAYKTdKcpo
z%s*)epG)%!z<Y9i)*cZhoTX>6nsT@oRV)!kW3i6(UIf@Liya-E6%y;JD&85|SxXFF
z7-!a(mvfQ&QnQF6oD=V=m#iP~y?dA@<4N*{OHX>Fu#%C~{IPwX=7W0Q(TB^kRR<$F
z#^pMp9{(B?bKP!H_zwFO&**cH)r1l>NEOm;5$?00waQ%9{^h-p6@S_9Ps|^QL6Vu^
z$#8j5eGQJlX*LI^!V2$@vyP9k1u2;t>RehMj1X;R?=N+mSHyI_G0mpP&ygEJb06r5
zj3#n_5N0{k;xs#5aE}T1>>ujwhV+~&nsOaIOUAQU_L+<SQN`W1J1-*Ou49WCN=daJ
zX;|HM2MP3qm%7nWp1dCDFdn>eam*JL$2o4=Z48my|0}2uyti0^H6F8+IC)J`vlqf{
zIj)V2+^OIDKCH*sa4yqpU$$1LZznB%IOZymcAlQiQ2ijss9$_j+Wg5?9afiu>*2DW
zvE7nlHa|%Okl|qmWOy7{;rI|upF3`yFFQ8%7D?cqEmjJIZEZPDmT+F7spJWb)!++1
zbnyqYx?y4lWb=|{O85C<3GO!AoeUg)YZSfO+%8l8lR=A|2ai9DA}G(Q>w`ytB<oAl
zBKWR@i34I6Tluna=i1g-!5hQs7Rj-OJjKW0H{A;1zPa4*%F?CHGGdP=;E|uD5bpm>
z?B%R(ej4`dEPr>o6Wrn@(Fo+u?CX2Atg@6T5prr!JksuJkJoS0a4H0s;MJYGZ=J7N
zHT4GKhN3A12$ggDH@s{m`MSy8jN(G!HG|U1C?6Jo<6Mvv;LP`BaP~A{Q)i_sDQx4q
z;X5eJ9Mp4dWs_s2@lGf9JWK}GqHk@9sh<XgG)ap9SWb&A^L=@EG>|E@%ozRC#Zn*g
zz*u`pH}mm@4)5X5l9a$_iFL=S%#)IICd#&x79vY|gfRZxx+_fnbkIt6_|sU=*PP0)
zg+s2}+v=~Ida-gda4ezqYyfoc(9Ljm;wi;N{OXyF)(QXpWcGVU?zdXA*;W154H4xq
z*#-b3Va0;6tL8^pX?hneMeNsCAPbZ30$;X5(2u3A;F%gHD;O9$c7@cg*HE$VNnq50
zt0`;12=7h}yeTQ18*6my5klte)hE7{7E*`kI&boPx7j=q1NX?=u2sHuj49r8u-3n#
zx<NN0nJku@9S2S;iudy`@!WuA){~h~11_K6y55;nsJ>yJ<2%jiShibObQ6MiQZE&~
zrcXG8rD|653tGL4YsM@U&rWBre$hngD~S`!D5_PIXT|ue*7X<wT(n|NqLT~98(Jz{
zoWpUHH`Qt!0t#~4JIr}X?K(dRz(L<9i^Fl;lz&gVmcvTEXxg%x`vxYi5cqp2R+;|!
z5&rpnCye;$o>2+rG^aFAXM_RaihCAUcWWgQeFh9B#wY(8xk_dj+xjFrg#@0^Tf^u$
zl=?4_oVT;)FYujoI@uKKPdqAPk`{xtP4>2Ch)@7Ywk`!j)1+L1{Z!I33)OR~Pz2ts
zHS1FLw~d>k^|y^1b@5Mqg|NMA^;k*Rsvj^j`>0i_`(5%_^e=DcNZ?$GhCX-V0$RT{
zey_&$H*BYBn}|^u+nDBVGg-d=iq0y!v_%>9I|Gwr%)BM!?7m20eDmr64!ri{EnuSH
zYV+v#-`Cpv`nD%-2QU_I=ZDg|w)n`9e&|6qIq)9tH1M9D!`@e>+X#Q_+U<H}JT<(f
zta&f|qGF5Esw@Goru<5)4OJ`b0=nlxzg6bAWolvgxb(Cm4^WD4lUN#YTh^AUMMunM
zUL$1-zB$m_28*1dw7$GG$8nZ$JVU8{>~o?6I$~dM7BksrX_ko-qtq_m7YJ3sXQ6q`
z43Hd5Dqe;8N9KItB!GYyQ0F;$mVviiF4Mz57|U;0?teYC_l2{vMc8KvJc(Aze1?*=
ze@FswOxZ8?-i&4s<d(4KdniAHxQVC96L4QI*w#F5wQ~8%aE^<9Dnk5jH_7%4vQxRA
zbgEF@(Dh$}=CeJdq6)<<5rS_}cBNB@I%c@_7cb93oOfKS3O6IYy}bhv5U_b?Zv^xC
z#6--3HJ*2~3xweu#TFr|R?7oj>^pip+ID&QCg5PRRV<I^gAJ9{JNUu}(SA$e*Kd{X
zpbRb}1^SZ$R<)blR_1@4SRUi^PfKTa;eanLE)=qpcpNQj6H({cL}5UiqKs|ECD{Kp
zF26D?DxG@|C8cN7Cr$z@vTrcjDT`4skZWnBK(!>3T#h180B7(O%~O=MJpP@*5mrQ<
zzbTp4vH7jUW9}hAX?^YDhJl5LJuzgPg@`FYS9Pr4y`IFt{{HX~#OYOj<^~35C|D@-
z{Y8(UvuL4!bHr#6u5FY{B^GU6@u(16yK~K{&Ew-_IMfLh7<TI<1|&hgYbEqZ?Tm|}
z)>20oOT-3;Y2mRy=^fvT0WFLiE@~qdMRJxz=FG~Q`1`OrLaTQwua(|KK(bo8_ajDM
z>Bn|q$s(#j&u(_ae1;6!!yOx@1Fug;M}BZ&qm-;71wsXxyxrxM|B+wP?52{YT<3vc
zl}Z=b*DX`S!(S<fU{{>>dCi3oPn@CFZWhp3$q-_%6tF65=vMU^YL~G&aNN18eQj0B
ze-7dr{?_Z>Rd*?J12PoT`#yjrYg$S#Bcu)jd3TQURkJ191SCi?%h&KGhf2>C>P@zc
z?v`{R%a*y4Vb|?>xB`ea=Y&W@*YOLG-u%}=7A9!(sOZ!M2uweq%}jRLu05+pu3a(d
zp@yK#X}<vN7@~I}g#+@jGPGJwsvYj3p7UInTFEz$ruztC3OUe+I}UgRAR>743=8{`
z#44+u8{I@X)e!cuF0BTqB7Q5>`6x1J9JqzzOs(C~QJ22CoJ|Ytyd~Ac-ULRhvpEZJ
zadqhVv`<^Wm#Lc0&8&gLX5#{0^vo9%P9g=$JO{p>BQCM%r!!M!TaLQQ-g3lt%}oRJ
zRntBm$^z7}Cjm8prz2zU8h8Cj;l7gbI}{X2e+gj$r4U$(?AL6e0y}k|X)+BuG&zps
z>!ioA**Jro$&^G(BOZQY$q=iX1<N@Ey8*;+hlR3xKmP>5ZDz_J2JG+i<LjAJDbPt0
z6KR=->V+C!u_|Hh@}C899YMOZIYaZ6zP&)cYq@Tm-kb9a{=pRsV_TK|e9K;jhTv#N
zqu#$?a5;t@GQD;Fm)!T;<hp_aWq%&tKv(Ol!LBca7c=4DAy%3GxV181K>}jET3Anf
zl74Urm#W;e&~DDCisROB!NR4`!VB-r+B15MTo26zz0wz*%6cV{!wj6h)SL{oLuCss
zufr-0^1=AvkL23PfV|Q<Ovc{KdHBfIvrkP^3}COQCOsB-BI?uZgDcm<ik#YO1fO?<
z<N3kEJ(1m?KMNA+US@V0&~s)GcL-I+*)+aEH}J!y{Xg{jTD!tkc5I~Pn}eh1NS({D
zvxbzrnAC+86iJ7;6KW4gov5U@*Yn~KAUiLt<$|b)ZLPSh%%-vGVtt&Z9sZk0?ETll
zqlasrU_J4Vxt)vlPQ39F5e`5$o0EmRt-P(F;!;rLnJe)sbjyB5`IgOqf~$oWR-IKh
zt(=#dni^gbPJT=HV*EK~Ue#`0Q?GVDFe(O6kMX2c=iI@%06Rky=BS!;OXL8sg|kMI
zK;+0K7t5av05p1>@!xf_TIX+7(CyFvIrZkZr;PG%^Bn(xC;tt_Icdlb3DijgVxFEK
zsH1^=jCMGhvx`mNg4yTKpMgBLokk)s_~ua%7LXKmcyQ3to{xGp04jy-shC&k>U}q%
zGACl<IS@-Ttwxg#^G<aZI>8<b(3x8{OgB`BpcE4kIXYN*{T&wYK}~JSmi@2Rj|*5B
z-?ysXlCz8%ls!>&_n*@?G>m0%udk|F`L+JolqqVBV}pZ(YPys+X&D*a_fS#!;;+I0
z(q~8~E%>gRWFnX655sV<hHG(CQ&Tt`;N`OJ&1OEvfjrwD#-VrN;oun4JJovl92Xb&
zIguG#%`volJbJxhMQBX#(EjG|@NML1J_NkpG_ZTL=jt?WUc`0^kPvq=O^8!(x@SGR
ztL$dO@A4zb)9BKG&oi-`_=GXdhvBew-6enxd`!re7-a$6E0Y`vn8)aHEQOVcVK<GF
zC8ZO=(x+E!xc!XoJG}SqJo@^6>EtuWNO=hZ*H!^M%W$Lbkb_7;Y^%F%*CB?Mi?~%f
zC~9kKfhu&NG+lJzJ_1hTB|J!n^Dj}AoMSI1CMKS6fjm6=Il|5pw`cs1GzEp)dV6i?
zHJa9!*UIe-6&xM?L<_Ws?hb^w)+IQ9@lCI;K1RzD%=p0Y@vfEa_i2jwK^$vX{cA=>
z4&awWFDS$3b+YKr#!m8_I3%#g$j@KY*I$_S5n5S|^Uy~Y1>_J}w?L{N-O(lXd*CD+
z9~@tQYA!3|E~0soPlAuHdFK-&6BAPa!Dl&sBOmGQ6=VgkYivn4|EKqsmWAv%pS|+w
zc(zVgnLc5wz(Z69=N&2u2nd`l<p_ylBvBt=vpfyy|DJP>g*1PM+y8ArAEa4SSSXLl
z#mQM#`|XZi$_J_!VH&(l`t@x7ubBMhF?)K3<0YF$x!WHb9jsbOeHPsAO{<~E^1UaP
zxixG0y1a?z`B1k>86jcvb0hzY^uF}i5}hiq+3;pkJ1G|z@?$WATxv4+NazWZbJnh5
z^ZVzhs6cUF_QE-j8biCBVGJ1Ou1h2L6LqRmiP>t!cT{-=CCXGUD}r0g*H#Ktibt>V
zbOA9MS~vcZsc%t*qHy>sFICh>##x-|1$1gAcy@8D00N;mYdA?G-xnnQsMFs!-Uy<_
zrlfN$v8HcrV;w?$kYE+zcSiua?a4RmWx!q5)FdQstJZrwmNndm;7#GMwAymAl#|h_
z;iMv&8XvbZJKRs^KJK6m(d_5IEiKJTnY$yNA*0Pb%ww#2Mg7r2K~k?3bMxjvlj=~2
z?dLKL*2L-Qsj^D+Lih$U2ii9J#fAv$qyBi)$D=2*Vj;c}Ny%DX<@|rG0?Ur3Era4k
zwte&o7c&^`o*-uMIv)~=Y>sfu%c~POc@!KWO!lp~@5}QbOWY?E-^7;>?pv~%+8Ksn
zJiM2}I;W?@n=D&V_1sW#`~Dr$Z!Q;$=~UF!Ad<+QDGE5^Mexg1hM_quLt72`DDrBM
z8WGmc(pHF{e>(Z6_u>?a(p@qn7$ZoQt7mqyIMqEy!48E*MVv`D38tEws?qU|b}nkc
zBoAZzR@4uk-vjcUcv4!I3mw^DhZJa?y%VCAj94#2FoT3KgDi8$V2>6K?mKX4gXQQa
zp_A++)}4}N$#<_ERJb+ESSO(zs~$vP>MfqX0uFR@{CbS`Ts`2a_wEQ-BJ^w>H1U}t
zd%8H+W=hp8eJ+_D{ax?CQysYA5S7B4m(<bJnA5n3fVybHNE~Aw;1Lj3b=b4uXgtgy
zX^Kb@vTt64{WBDg8L(to;-q7yAUZgAWWA}Y&h5MWA`(Tg{VgNJjh2?S`t(ZoAMZ;_
zq5)ig2gm!-k`)y%H_HD~5zJ92Qq{y;Ln0x~ZXy)Kq>(n^tW#4{Kq1Nv1Ug@MxG^PW
zaIi4hRk8?KV(C!e&%lqg<L729Q@&erWZ$wa@aqNAfvpLS@D+R>JnNS2Elw^wZsz7g
za>l;@uHv0Eg|MoIqZxbgD6Oe6tMW#AHUwYx=i}jR+*rjVmG;`VV`=hK2HX$)bsS}~
zMxHbmgXQ^jb9GN{w*~E<g)Y^LU@wm;%P;a&>7z&pq<GJ+01oFVRn#Y-0Ywi==Pb66
zS$dEVV)m4t8cN3mHg2ebIl#wjWq0dbImt22OeGWOd(M$<B}zHY)$M#Q&_pPt2x9wK
zf1;4TkeRJ#Cg)(;IUlzf^f)-$YsaC#CW-AEQ8;mPKU;71(~Z=eC9$v5!ZBs1pG+9U
zSx+V4lWSeEcT~M+u|q*gS-Q*|Z%IF?L4skh0Bp;Zzg%n?dcMF?@P|~p+1D5km8f5i
zU)-ZaFvs7#eBeWc%qP)ipdumpIiIen{^82wDqgzU?~2B!5;vf*Zy7i`mWcU<1vnh8
ztfi%-s~Z3kJX9>28>j_wT=7c13+>5=8C}`DsMY6X-g&~M@$j>QqqBBT{n!Y!@Fva9
zj@g>Zj_ZjtJd{_NNKVhf!kIlCwYAB*jM(D}`Tm2$^oW`%r7BT4KMOf>bNy#s0w*V@
zM4H;!#eEf}81!e)BIQ}g4Du2S9wf_VjK-sfIZkt`8kIk{q_8qn^pPhiEvrhDm#wa3
z(}C1}SIEOAT~)%f>RUAudqA0`Fg-k-67Bga5xlXw9{;tJf@Z^BT%03dU~6NiD3_`z
zm$t#NfZTDXYKDMa^%+G7=aKtc%GZo~LE;}xO-*4FvoT%^Ne1WN?nUPK$>!u_ZD);s
z1jN$A&m5d}F76j0zGTQ<c@Su6+(I2nYzlpFANArKbt=%ZyKA|~iVhfOX?z(+jzwSg
zvVWJ`(*VOHGRuUI!Y-A-O~@E_I&oOl8i*1{Ep?suY8F7^c)iCU=Q8Jv?1}1Gwl20N
z$INTW;H9J#dPns`kObr5#)P%4qa9^r&*&%JS4k;$y#{3&WU){fx57`A7ie|m<+KQm
z7>%N?^s(95Uc_TzGS~sq)WW<#D+vzBaLcXDuI?_2jeN&RgXxi}-BPL-Z?dwsi}H&2
zF0RZXV`<+Rm>CHlI-AO(O9VVIfaq6rzeF>oj7@;9hs1idk~O~54+{v0ed#wcJ??tt
zX07VneaPEhgpPg`%RExX=sIy(Ip%5F!mq5#|4vsuq<w*+qvUyzFJ6_CgS3u{js|Bk
zID4sw)9DhUIx(POGCz7_)^o?IkRkeOY1i<NAaP+z3Q7%)gmO@^Ug}`l=Db!Ew;VKh
z%B5`TuQ%ydTSYH|qpc(Bd<?QEm}%Mv8N5vg@QH|ub7`AC#Ffy<Q?M`SQY3wxf^qwz
ziUATLqGvhi(MnjG$7bHEB$TEm4^})GMa8>bKRF_*EuEe01u%@@P;@lEMWEn9S4506
z?<B0R8wx#d2LoTR;oC;wtnJ{pu4s&YJWQG0o@q?_@`cUkyZj67=lDAa{I#W}xyeb`
z_;^s*NAivmeI|7)!Xh>8PbA{@`^7OaK)xt)bGZ%i7&QRZ!aN_%dRc$Z&fbAk@uyjy
zJA<}ti@HXkRK{L*>5w?M1%-xMxk%yU(8*M*E>PJ(lkH7SHS0m)nI)STMJ!^~1jIog
zCuj3*NR%Q{yE$TZbTo`4FvEvAVBjrnFS~f4msw}tD6Ih5H^407;H)p5PD+`z_6f>c
z71RlI>ek}yG-EwX6!iH%Q3CH++LKGU#=Cff)xZOROr-P}9UYy#z<$ZXGIL({Q;#vW
zy8{-|`GlgNq$H=T>@RMZb#aP?3Z=ozpAHWd)wieigtoS<)I5Si9^bw6iINnt>j{&=
zkHomA-b6h-$v!_v4AvWZpD6u;FY@`Z?a4b1jOvQyWY66QdEjRA@Mx(ktJp4a9oN|f
zwesP>rkQb{6f&jDQxz9mdo;_FA=$+z!B0ItE9TYLxpj3H)u*K5H<CyF&^talS;bj4
z==4~}FbMb=m<3n_8b!#h4anf&);3ZQqXQ1NFm6j2Y(70XJFJ*W8K9FnLa(xEJg*7E
zuhtvDh6tFBlW=ixSc}h)%|Fgkc>7HpmoR#cmTr4v2mNuFL#eai*F2&hYjKTPS!N%_
z7ZLbl)6;;YSQTAx<R=Ex&~U|v_O95U<<0~P>c3MTACFdyrcQ45gwbm@<b@Uu=l778
zE9BLFh+}v~z^Kl&h~Rw;x(;jGNZHnLK+R}wF0Rcap|<Bt?MB#g057X^zEbN(E%;0x
z;Z=z90vDrSAH;WYIag1BiHEnay*fNQ%*I#zebkKOiY79eC+6lzC`Bo+RN8uArARyS
zqlF<m8ziMTrbN4MfNfG?ZFI+Eh7?fZsk&e7z=Qiwu<-G1<Q+4p@G30*?5=EV7Y;Y#
zT}_KKvI_J?Mg8r96YYe8(v3h(pBtXG<lGv>uA|kT@$1z39-^p8pKON$MEfjFHk+lr
zQ=t(7qVN`0Gclu%awHJp1yoy69Z#VtV7=Cag~{0H?(7CSjQST1f9NYM5fh<<eXX6I
zp4O(13=vL;bDykdN7J+D65pWQd@n0w!VGFOIRcW<*z{9FI*)0VR7-Sgg8IsczDa0n
z&j2con}cH=^Cb~>nnHm;>VqYf!kIclx!s6e;0B+bx{R!DE$DyX$Pvj>aCUUg8&4Q6
z8_uf~>*AQ=ej5Hn6XXi3*+P5VboBL0K?rPH+Z_&{2@vz2wzOV6r`w}Z8E~mDm7!4V
zFabGjO<~~?04iNR3b%sR`l32{Dw(QmiVrY{EZO;WZ>lUXePZv)$;!%8MHOjQZ^(Uq
zi6$)YiIjSr+)q#f+UR-ITUGM~zs_>hpB&9^WOP)79Mfs5aj>&f8z;+ggAFjsrBENd
zK)WB%K3xTp)0>a@a7G0bD?iuosb~EmKus9Y<6jk6UC?0h@#kU2=?^JE#R%uHFJGQY
zJdo-1SaN`hIkK0Wdi)5Ux<~ejgAb@3j~!j^$(}4bYF_1$qPOHv4i8%y8rogU#jW$;
zBhJzx!m6>_cv>V1;~zq7uf|6-K5i&jLTnHd5M;w-Xq|@M{OIeWbe!a~u+Y)fWeDkk
zHe1E|__QbWJ%xzWVF{BlnSu6$r=suqepjOQ@ezd2@Hl7=5Wb*cwU{JFyDu1TNlrpS
zMdwKD)IK^xaoOjKg?{H#Dc~q<?sEW|bsUadTT6<m2X}1{y{zgV829YDx45>o^@<>=
zH^$SGS9{cgNMAy;$(%5}djp9a{>Vb`l=6*hY<PI864w}P5{vL<h3k^a()V<-SgYwu
zPZ7&Ie~|`mZL*VFi((idN7T}WD7d(~#yimqXg0S9CrjXf+^u1KD?)<tR05C#7g5XF
zKo-23#|z2Mjt*f}XB;-X0;!B26xbojG4*qU47PfD@3T}Wi{~22sSZ`7(_=d6<-W^P
zd0sVnHD7Z(XBX*IrMxG3A`uYNT_}E8=En4M9M@+gSTRSP%tYOCWYq{ek(KA&=Hez$
z;GhWRi?uIU$-UZ(3@t*Pc(INV)S+B3Q6jB2%0I--Moozsl*mR=B&}v@EE3&k+{|~K
z*KoXdCP*t~GxPNYam`3?Fc%Nc=H_xjy?aSWMWO&9$5Eue<RqauZMAN6sflYp8k*l2
z{}4MH-vs|q07;<myCE3N5Q7F3)TU40*7cyxH$VjK9+~zloFL26yx3Jq--?P2C~FXq
zmts)X6wnZhEuhj>@=g}VD~lQ%M%hvFMf2PHjA6hOTvYvky8G&=sJgaq0|`Mvl#W4K
zKpN@pM!H8@3F(dz5NQw)kQNY-?iPmbkQh3Y?rs?7+uqOpyzBk@`|DfZEW|a;tTX4F
z+56hp^^1KK&6NA{zA6vsHQ${nw~|*2k>Ds9`4O1-aZgU(j8hLY0F<-Z`I=L@c|$E?
zFcU|xa}3%U!;tt(d%SWtPfsO7DG%=9<aKcOJ;x@-jl6m7l^#FTt#Gr;Dz$GZh_~^W
zxY?a`n{U7sO&d&*dAa!cEA6v~3EdqGcJd2f>-b;2@|VfZ+gnhS=mojc(9nCuY*X;y
zwV&%+$1byW80#wTBA^+{N!1!UKRSu;wRqYWYA63fP~(hGfUnP-M)wOjMXGDByR$2N
z9-B1&Zx9$~GJ0HIS&fVJI2u~cMCVC_MVGP-O)6Z8l$@|QDnBeQ*(>So#p=B9&~Z;x
zdS%Lr7pO`0tX#0%<y}$lZTc!nmsBxj{eU^L)J$!7Kv4qc>&{z}ady7W!Me<jP4+og
zK4Go$wDyuTZ(<xvRknz>I}Sv1*<7YQ=6ypH`SbG>vQZSoq+bp$0#0psNkwb3)C-SF
zpo9JWn_GJw#w_?01kQ(}p0>>XVmE8!BSS-vF)+HVP!~(18@hqrXoQ$?y;nEkFkbEn
z13f)ErMcKDI=XdhOBf8|cE6?+zCMS$D4(N_fssd)?rUMuHgg|Cw7q!>G4Fdd`xG<F
zqLM%5m7Om#Qj~~rm1_gXo^A1~MY&F?MY7<_?Chg<*=EC9OG!Js_|oVM^?W|RB?le%
zyz1)H>}a8w3gPM>bz+5x5)gsKsK^EV>WYh9uO^q*R#uF_5lq^7`SL*SM#*=P<QOI)
zN$ulvBYHFG&BGJV%_Pk3(3=gvHPUvIu``Nn<v012v`I9CK<GG6P2h^OgoGQo-lSwt
z(KE$+9ggBQC}SNK!bKd3#qpACSJY*^EVVxwvMwKAKz^d$sr`=af)Mehef`SkcH`h}
z5Ux;coK*ITmhWb;*0`XsG)KKSL8klDr;lcht81$Oa%lNL7aZ;L&L^izzqmAd@odEi
ztnv)1z;W@8j7o!XF^zxvmu~5WV~l1x&wkIy{UGTFObDqrVjCK&A}LUZmvE~6rJUno
z;bSW+1|r*0+qtlKEyU_n^!nw}+FGVs1O&Afq6vB#7U))(uLYmk*>(s~?l*GfZIM}n
z%=Y6)#MI6YQ03l)b6Q0`9wNi9^>Mur1^GRgUp_yP={NJ0qnYBi%(vpf!8v&<8N}qV
zXcrjB%}X8dYRO~sKelc4N*5y=J3Bw}^BdA(c1}(e+1b1Ci3=5#mG-u_Wh)KK!4ZQC
z>&N!0EtDiAtxn4z5&wi13<8Yv(YT}S#@(^`G0(G|&AoKiVr|77^}+(C0&Av%Lgr8@
z>UaesxLZ41<QAsiL|~Oy0I;yN1Q}l5^L~;|{LqyV+4PpMmJu@y;W=Sa(k&t3CXJdr
z!o<1Hy)r+We86rmDlm5m>KG7uLEF00TH6_YEv?)6q&N`7SO{n9#7JzHjvr9&rDvel
zm-mN!Bs0~nuDzdy%`%HK#fLp*h>nVmK0iAZx<1KJ_4Qslsa?dwdzsQ18f|denV3Or
zg&&tg09R?3rPole$*Zp6frvOcn43?vwjRa=LniGyu{@v8P&lu;bZIYl$2o6{Ix=e)
z>!p2lTvfjca%QTY>FxDg{`9@{v9F`Bs7}6SL%pXE@|q~&WhB4zSyf=5+34B|P50w9
z!zNAvfwedLU+esyj@&rg3DDwSdfirsg{j+WFN2C;EpnFC;=5VpF^kd{{>P7_)~Icd
z#MC!G`;nX<V{L42OXGFaNts(3wQ0XAuP!G`P#{o{Mu{!{{w6g^3>sNMf+X^PFfy|+
zso7}8iuaaKco)@A#EN5`g>)Ohe5-3pNa?cD(-&Yj?cuzN;h>7aM5FHg{lSrWY;?5B
zV(b+_W#$z8iTlYqF6s~>BDZ#SptG1;aFpNX%Erx9wko)+h{$N8;o(QP(S3DJe{PYu
z(4o5DtE<JR4_v|RyIXq#J|`{hxJa26qV&t#XF;Z*oz&q%Bcwo+G*ZU<=wy<o8sITr
z-bX6=F6_MfTg+@th$&6j+V$8!!L^D#?i*wNH>%p)nlPE{%gZZSX;$w|gq5JcjGbM_
ze$%xH$X9C42#xp}jMY4)UuZwj)59t!ccNpa0gIuwip)}jvKE3sA*an8^)N4%mxMEb
z>d_-t@Y5>(Jk2O=ivFJe8`jSxT!^{1)%tNr;eIY9MVmN3&{LF<r&_D)6khLT`Fzv@
zB%^R#6~}hBU-pc8ENJj{2co2%eCulc7`ZAMIs)kt8d=<$TCyRh2X|Nkyj`ed81cO7
zyeWjw2wwS(OiqFe#ae!^;Ov~Op6}q`aCDAK8zTp5B~<zF%nXxljf0t)uZ<11TdD06
zZtigtjc$Ul!+sssorUVjv34>=On<ST9)~{A#c@<hGAUDGUz;S2tI<~O8v5ypUFuoX
zE3mb1!+y3|c9XC0J^!AgF{kVUFB=1{n)d3soyD6gdBSiWPELGELd59I%AdW>KYO86
zAu`$3M1oT@q2;c(jw(84W=*}%f`X-gXj#Xo(I)%-NSBj(VO{};eLfUZLW%7UjxKE)
zUwcSf=)Dp9T(7Jc5Kum>*dMlQ+X>KG&}5k)NI~j#`suDW{PdKk;dDh(vc1t;pnMws
zu=65*K+*er&b~L^30(TwQO?K)g9;_Zt4dBEDAc|ahHCk&kn<OG=zjDt{3vI%_4n_x
zn}DBTeWSPjw_hzBUltF(dR4Pv?1%C|l_p5FJFTwL8K;YEPugwm?U8@RNxl9f7-aeh
zVX#eREzl^iysQn77)9FqNlA(2?vDnFcYZ^^@E@O^GQ{-gO_NNOegPO>aq(a(1ajFW
z`qt$2-B)JyV0B@IAfW24EA**<Ge+Q~Jk?K_QX#K&2_iuBS$YLwrt`p`y!#vR81TsQ
zTho8GtPrhiQRcGe*VU=<PH+hcr6&1Kw=OtZw2|T~I90iumh(wbzedGyWQuL9t-W4U
z6BN#;EvhW^HN8^C2$H@eh|kHfp!4@{CDCCOy6V~A;MUi2T|N3*mz71<u*x5=kn>(7
zJjlEv<|s@Z3K0#Gcph_-sPko0^d(|snnOe+N-GdREfp0wg;z5(27Gfb>F;yv=^t)$
z`$+iz>YP6Pt&^chi_{Hetk>H>Ek{CAKNDrmbLgm8+47tO1<9~P8XN0tA4y)h>pocB
ze%fMQ79yp|YbBen`4KHRgWr2*lHpfhSV4c>%VK4aHhk&DS!A_RD%OTJB@}B9-~1#{
z$r@-4E$c-->Z=<(;e1H1i01FHEu#X1LFM0Z1P>;C{rc6oxx=z%v+YPyTLoPkN%(AK
zZ{ArngY65B0zh`Wyc!kz70Tw{ClCT00SrCMbwiMCTLy3<>+klHNfjA&8N2SUZYtAe
z(c;VJYu41(0$|O}%~gQE0WVYv7q@g^px?x#mVOz`Tv?1ffK!r@Ze3k@g-D&u;ac^W
zR~WL!^~;jrbh&huK!`V<&W3h(6D%zFwbN+u=arN+z~Pg1rd0>(OXm2++6FqJh{P5d
zTP&%n>}(40&*=-S^*-ZoHu0PvhCjTzYRJ2i<~=eq!<V8ab4D_!DlEj_-(2!p_a6wW
z|0glKGokw>A^vM23dk6P-uyRQh>X}Xa_~`n${;0-t2Xo2*VXOlFBOS4GQHEX)F_K#
zI%WGRMy}(%oym&R(@KK2c50oDl8#&^oahK86&1YDTB||ElZE2~HKw|8e%4h!14%F5
z2B2-=(SLc~?MhdzZ&zxZg^qp|c+XzdS`9Vz{arO_v3BA16KihLr4w5!Y}Nj6##XhZ
zrHP<wBH4+Fc|sVj{M=xAi$^F)FLAuU06yWMl34$&TsL*oJEHdfz)(HUd3Vdj#qQy~
zAk$PS>ZIB41`e!_NK0NF_Z)S84t|bT0s{OTneZQ!XN2-NDV;GmI2#zIy~u-2SsWqR
zRi|gt(<~+R7>N;!1H9B^6RslT)`;J~sDcMO1;Xn+b+WU~qI`YXnM{)mS=-USuDyQk
z_&jaM#r@pD{TS@{TJ6e{2NyPRqK;OPmA#(q#=X3_00V;~X<%U?oy$rUU`)gRna*aF
z{11a9M4wAa;?MIvxD|J`p99?M)29lYK>={Ab<RIhfil^kYzS7d!o$=6JCTgR(?X=i
z`NWcJJ1)Q!cDSOAc6F=SzU_eLj$NY84hplgk88eD=ocr;(aHx0(`&_rjLh=s7UdTN
zs#ux!-{$jd`EODOBG=^M4tw=h#tLwUC@JdcSwSDz-U%pu>BB7wo3yIDuf4jvWU$Zz
zCYH_xRF#y-udfP!{R(OMAVwI@B_NROxEk=jl_=79^%D}k>vr7Q9^u-hl%Rbh@CcGJ
zNRNkkh1mSIpo#gv<|_LXKiK*5c@|?_Z`R00TwFV5fCE2ywSJB$vF2+}n=XvM(0d$V
zv#cK6F4_5?IVq2Bk;>Ur_M;cyKRz@){XJ)r&qYrnC}Y{FE<(Fe-war1j$BLxx6xb6
zpGy~cnN-$aMLs!WA*hLX>+Y`OGsnctT%ev$mHAezCAMU5sJYo#(BKe!i?=Rc^>{*b
z8<q0LUQ=WBw@mXVWj=qxR887Q-KyC31T7R=K5A?$N>wks)oSTn)?L93*7#y|CW5}r
z$*Ol%r1$*4sYPrTh=ae<$CPW3HVTQ;$C2nn5E?7oq?VH9v}Jw2p3wZlV&mn)FO`$r
z;S^GTOQ1q$U+;-!u03#i&N9r7Ue?tHF#D2pJ<K%${VRtsvaUMaKQ6?6)@b)K=R<_C
z=t4hI&*N*}`5^5U4O%xvM7-rD%~S)B{zu=X-@kt#tOW%HPuvv^;YpoKf4`hRCY!%M
zOVK_v#T{NWn((Tn_z2>xSPLORdk8oXW|J7zmtL#p`}t;n-i^R^1LVxX3NF)aK2_Ry
zSAMZGyf*ij2IDhkW@cM(7jxc%1aT(W9n?@#g@W9rP1%T}XGvxj7V$srtV~Q=0bHN2
z$;rn}46%3H41O|QHnn#)dS8=iu+8EI?BO$%m*IQhFYC4^cYQI2JD?oK(PHVS_T{7N
zvf3B(!PV-Tg=8uKO};Z*vgG9*UgdDSd{A$e5Q(9ul9N0z(BN@w8IzLI9sBJws6yl8
zEjsCf6mmxU6zpARH?6*N(BjvxSdI*iQmf)Z*w`|P4Pr4c=!)$Iof!oy8yG7&IXRVb
z^viW^=Z7V1Y;M~q#^)^BLO+F9&UQu0XZW4HmX$R?i9!6urjlZ<Ia>nSgqF9Xo^s|k
zH5E4@59VT@l9Y2(3tcU%iV~BO0&)OIIm{Bf$z(w>Usc83RV>HI!t|rCu%^~sx6%u!
z<?Aa7d>kC8xM`KZ8)|E{v~}KcCtqF7R8$z)C~*?w#OqsJGUC*Ph=I@bl`L*d$!koR
z?0RG{Wm|LD*O<Vir@wBPXM)JrE<}{7oZ6`TcgB<#bJdVe#lK);+JI~<Hm=`BlEs4N
zdAh~gU{;4par2&UZA5SLIq;F&zA<8oSI^g0qBr18-rxN5GUf#L@gt^Z%YZ{XFB?dO
z3Wj7b#yL>i@+&HI92_{bMs90}whydWrz#M1_k?J&+?Il#3D|<UvmF&ju}$amaBgco
zOE>fYs^_gHBd<BEhSDEmhqJtR(I&dFL)x+FR$p4%o!s5c$sXN}eSkY^6jO6H0nEMC
zHPuBSk!;Lt2vpVwSR<ycfdTeK7J3tdsw?7~94(miBs!z+x!+|z%EFGOgS!Z_gA$z{
zCz<>I);S6%=_&fUvp+B27|KIPzYTLf9gz5rotK?Mq*d9u3;UqNDtI^;vtlRczCQ;>
z*x1~tORX7NOVb9WQBf`I8$7d|Rpfnja4^vs-tEwrs+JFL0_SyEqBI3G^|cLkpzY>m
zb9w8Z7hNg$j8&po(eAajwsJTk={L)sc~jrv64oQl8QXl``p2)?U%K-_LU063|I1Sa
z(#WX!GEnW)K07@*0BE0%j!vX99~(>G`N08UsMM&5JQP-1o2csGFcrbOROUTGuc4{w
z6KFMfd~`yg69M?8he2&qtA~|W)s~NA<jgsBjf^Njbuu$MJ2xj(PhQEU2wD<8n+;8T
z8QE!!^Haz&=vJ^eUg1Gl7LGvs#cGtY^63NKqo@o%ay+~$PqT_!AqsNaSAx{k_}=~d
zAXeMh_{qO}UXx#4TwR|7uE)}fXmX&a-&wgy50F)cl>&}pqp(wbZSai)zPpCS(OEH0
z?(O!*MuZCV<WAG6c)J8mZ0%l0$?a;yNv}MQ{Z;KbdEZbGYhRJ3j!uDQ0YFzkSz5k%
zq7pTP?XKpWh{ZtaA`tj7c5AD^K7kPT(IXid7M{lr$c9KDD@aPBFA-GfagS<W`=J?U
zvC7NL)K5>(;CkG9`bZ8vIhpk4=3Xv?BTnB64FF&BD!Vm}GPRXo@$j<h;TIsRE1WpJ
zyuCqPAQ2#$&utCvt&#{n$&=lcjgJp_I5@=f#>ydE=&~b==Jxxa0m3L_ZlI^-_h+=e
z^*Pq?OqMLx0LQ<R>7BEphQy7vySwT$y2HzR^Ug6B&)K9J%}P>DS!{U}`V}}!4C_4j
zeZgs$b2w^{l;%q0lY@(ywC0%?PD7)vFqOU+*qgebS)#@`S*%<|B=~DH;`8T&&Cd6B
zc@T1&$+z5~>Eo23UW6>iiOEw*U8Mxa2jTxrvIu9Y`+Rf(66MK#siqjB@DE^O*zk}#
zKO$7g3Ck{HU!3T2d*@Qb^OrR4U@<VUveD7iWJgXJ8Fa-f%FDm7(Jrm6uH1)gKq;SQ
zBsWBNns38pdsoD*v>uu6a;6MUyd7_FBboi)NIixtN2sb&KoT)~UkUK(0f`?UptFd-
z#t$;Beg}q1#nlz!_h%P59{y0RK*q4-B4S6@oMwJ=eDXdly0})U*U#2p-mZbENBAiM
z(j&n>y_jOxm=AR|iwvs2S~M4~#B&hP7vSsMwd$_R6JY-ZtE{@{83{Ch=s7tgJTZ5<
z`Tp)5%T>y>CtUpeho^@$`Hg#uvrVPh*#P-|!>QMRz;mr|=6qGO7@N>wFTu}o>MUV5
zQaOQLTncv|+;V*wq|V}Y;Be08y!L(XB`#^?C#Br)dkX-*Jv}<wg={pYI<_8tK2%kF
z?dT7O;=RIkvl)F{ti8Op#fpas7dm+H3V!Z$r6()9K0fcgy=}ulueD$-!u!&o$-_a-
zlvBEsj`v}>gnG^X$@y_2s6gKDjh(BnnNZ2(YXZ{Ou)&2t$W&S?)Rxf7(7p}spS5%o
zoAMf9#@dsb3OSNWgo?0RXGt?jC=9B<bqheBz{Go|PwluWS+UWw9)%h-cniF&C!fl`
z3rIR2%Hi&A(S5I|y{;IU?0Oe|q(AfqwAWr9N-X2)`o^`ST~t-GrmUnCw%Y*;rPEUl
z*%vQfL`3P=SZEyegt%OV2F|XB$<eYzhh~qwZKr7m{c!SXuf6>C=KeDmtK6&nV0(>-
z!U;jaMmJYiAVmUabanD$NrL>J)lEjx#@W@i^B>%ao;i%*7!Ff;b9VubN(9INed*sh
zS@NTfO2ArgW)Im;qfQ@aa`WkN(G~#zel=fHis6|f`dq<?2BqoL&pSmWc(c>aQyTmX
zylfb={4ZT$Kn!HJYp2Q7If$q%znmD~s5ruhLg7{O*JPyIN7zoM(OK~P%EI}{$&5kE
z+M4Rv-e>q>#=WW1Mpgsn@6w#pKBdJyT_jhT=ZPOkNU+4mikEvo?9}})@-*J2ec#*s
zgBTSk75v=SKB`eo0s6*WRmWFyx7JF9zN6Tw%pGV@o;;K`Ea5r(paoLuq{_vPV%^=X
zEfJP@0seZ%XUjk~Yuh`@oJ6EUU*zcIRI_$;K(zd&R|bF#I;Do|tE<i%2Z@CAeSk`K
zbAHmr|M_kzzKNBUEbX`a{OdY$*68lilKhjiBOVgWe`abO`*(JjY~Nm2mlw5yi}Ptu
zqhGOyS6jG#v4H2+cGY-O$}8JPSW&;Mc^DNU^ct2F)^d_(m~H}x3P?L<R)JUw;8);o
z>o!K%wUuDL>U5nRT@`McR~|eCtN7H!$;p0N?$OP7?;nSvz<YsgR^PXAH8%^y1qC_c
zS}TYI-)JC|v?KTu)fdS*v7)k;?m-}b?>A>9mkVyDE+#y-mfieDj4+_&@#OygV9h-D
z55yn>wYEjFv$}o!ci{}wnDcXs@Gj7e(=pQUJeksg`y5Of)Yyu;T!>=VGUDE8q5UGm
zRn*OIxVNz(Bzko4bbNjca0Oj|bOGx=G!!+kqu4-DPp?&Q6gIl4gXNYbl{Gb#E@L*%
zJ5H21_twU~J>eZK)yJ8Jt%c^<{d(K|w>IxNn)s%LsHr~A{UooJ+1*?7r<!TY3OL?e
zG~14-YxD*yKk7K!-PiX%A32~pQ0ME-#igY@a?b*&^wCISA8TvQ>C<Qn`iA3s%RF1J
zIypO|(pR?7>O|Ni8J1K}sT8R(g2>(1=tr=vD4!$Q)FiA#572VZQ8^)j;4gt+JRR!X
zP-CmY%KBnwXNz4WMm^s)<tknpY%Z0n#t5o1BDUKP#g*TrKeuLz@0=299PYnuY~m!p
zOG5fZQ#(Foj+O-cpYX1FCThryKJW#8Xb75V?_k^2r<toy0y`sj0;ibb`v9LnAJ=PI
z&iJgbXoop1%?^k#=EveLEh?TQDOpPA^sRCt>4aSUK_ZwiL0ByFGOkzOAmz|h1SxN4
zx2w61m|g7aD=06&ZLDNCO-xWL9G|V(<8!_80I<o=^^%f3)@RaocDB9dPGDXGv|mF5
zd7>^}vA3tf8LE`4CNMKwvc7(XdtxTPvA?gu6z^8!<{}`;`76;IY3=CfFH@K%Io%3p
zbeAYZ)YR}~(|&1RV<#Ty>pNPCB{P~g0t%iB3<Mj`n2xN0fk9;Pm49XL-yFH?;$o^r
z46eqwq<0LA6HX--=eQ^FI&<T~*4%uIBh)>JxuTl0+2br%D|`lX?4ifhka&ROY<ayw
zmnQ?FRS4v1I0c`ro2sh&!l?}y>#GDgQ&LVw=zCjR#1s_qy|QZ5j^^gHZ2S5K-rG5f
z>)>W|xS8g=^h{_2d4k_w@V?)iUf1f;)Y!I&aeqH6V^4d*lTh<FrltWBnI~s%=O-@P
z>x4*US63eOe9aajC;qvS*Pf2@CPN689QAjpt+}xp#!QfS5>4N$7+xKH$1QF}7dKZW
z#&|>4=uXqKvs1&~pWL(*1&r|g5o^bPB^uQ~5x<boOf?sm8XC;Z#zyBiUK7#!IRJC#
zCT(iWW2T`oO5Dy}Jk9}9zYr-?5R`(#*URz@5!S8-28H_BnImr{B_#pu2PppXmeWGn
z2$}4?{e8NaUed^hiURN@Y?zv|zV=8mD&!$DNxhHMRm<)3u!lw`;X6755o&pPb7r{;
zecUPTiH?@m%GxTpQXTDhvOMfOb)G4`aH_btxYbo&P>nOte*r=qZl=ioYWmFYpvI_N
z%$O)%dJc)NuC9)XjE?P@@+k>u6~~J1F8smLZcJvo_pQ<nZ+1qXM?cb#b*#FdGpPvR
zML)AN^EDqnXzR-TRCAUvx6O~xijQse59_OF&1|))pGG2mZ3(??ZL10jsNui$hY-xx
z)yW_5wzjN6Fg4Im2ArXbrm=xeoG(u$?AyNnd&1y$o)VB>(D{F`m`use&R*jTJ(Qm~
z4Jf0XL};0@ogh^G?Co*yKF15`Sj&}3@{vlEEJO9IR?N(7r7uv%A(?L!77TlIZIhG9
za<M4_o`(1pL>|x1DHUio2pGcQyoESshK0-HDEe&@<ntX*|FIF%N<M>E4A8m@Nx<6q
zIdc7gSnd$a8KDbnA=myUA(@&gN{j$UeQ7xB-3&(mljGqXK=x(Qj(a?pzT;;Mw1YCm
zuXvM^-wbm3tOsOQ9;<#|(nY)Hk0<@QR}5aC;zaw5Ak<dN8lk$C3Q#(-n3w)yJKNh6
zoj$wC9kP(i`H9`_Dci?!t)w~;$p%zzGF<6|%*;#~41l0$=;ae&Ax!BsR}97|PhX4>
zxjb*(*@=*pZRS=PiSDjgI{v7TW7@@QIzX7FvhL(zw(OLzDX=^QqS@dQixjsKKIX?~
z74f(4Xk&UbnOrSylD~Wz&&%+fyBHY8=1ih~7UFVV@=}}%&sM62v^W<IS4Ewz{hKVj
zkso_IKGoBCkHV$vF8~Z$50S<{r$~s11f63agG?Yq46xg;7@zF!Zg;{=Glq%OdsgoD
zekeIMw~%&qb8>TY^ZiW(_d*52SB-`{r#)*fgzg4OY(h44=JnZK#RqCsxZc>%(Bp?9
z?>EK8eTv~G`b*4%Jtlruk%Gc%qD!UtH2|%*P$f;}xz_4DFJf>8?9<07X3ST))-eqz
z1A^#GpR46-rdPl5;@I)CJpfU)^}GISj9^+fx3lv8WmYRgV&aVqjwwB@z_poGlF}X*
z6*E)C2T3^7b)+5n#4qc=IQP?HuRLbH^u+0KTD$UgpL)OGiG-~K?V}Psv*l*kqR>^N
zte-PXXR^5Zi51KHH$zg?DQDW1HhVyfSwSET`+@x-g9bg2KR=cIJR!o{mud|bTB7J%
zOT#HRB{tA137y*wxf%ELyz1yKJvx6hz}6!S=%4wh$Lx<-<L(Nixh<w+q>>wTb;+O(
zZ)d}g`|s**Sj|`im)y^Akk~Qo-j2M!%z*k$v{kpXq<!!wc3^9Pgw)GUhFoTh|I&r6
zOtm&rgzE`9uYK7oroPkt-8xnxcg1jUpw3Cw#^l3;2Z_DJF=9o4tTc9bBxB-d?U!2&
zjCKQpNrvg}NNX)Ee!z*}A;bXvH-B4!ijyq%@%(8o;ts@+{yq>vgH}u88I<>c|Dt6W
z6TIjA9_TOIf(iliyOH7nJ6D|&x(l1ue;gWjs4yjd&OZ6at?|#VI-M3V;NbiB(L(L-
z|L+#T;4dGf@7@2;rWXIa9FB%=`rkK#)4{^|k1_k7Ke6Bw|LXzy`&5^f{XbUre_kt-
zdqefl{uKW_dlU2jzz4RVsPMxY_!{STb^kdjaIKjc8)6Z`!IPQy8JdKA2^oC=c&r*7
z^w6i~-u;B1Crf0(xamSZ2P@%hKlk<_=6{GlA_sURcMlhTF=Bjtw_yK)#BVLXiJ%_H
zjZBRUnA63j74$KVt`kEh7Ft{7qVeO0IL&cl#=e)k;7Ql5@9AnNc=JmZ?jx0Z+<1*b
zw>!0o#YI1kiPz>p8J^*BgA4WXTDcghENwbE1L6~R;@=D?kvjKbr1S07tuHQx;8EHw
zL$uJ%#k4(JcX#oG@6y_q-`Q+GkcmaWo9*`{0r?*qm))=WGVZVG6+HGFMMwOJzsRjP
z@G*u~iT&A^lb?m}w?262qpcpRvFNe8FGcOOve61?LG_+5@SnFs3Cg_*KIi!i8H#ec
z&cRPYqV&)5){UFm#nw8bb{nCvQ+rzcE5skRXkTQ!1jlWc4NP^uY5#pU_B-1m*k=5?
zvDa#SyDTmc6(pi=a#sT_M2P_M0vJ$xUY%&{L_ZG@d1|Y;MLke7e=pN0LjCpYyMaT$
zAnd2-xT9~!uV`!(6FvfPVkwq-xfI&R2fNttKZ}~k(4_y5`RLAvOOj39b!DtF>6df$
zS+Z%yf+n87%{l29+3Ol|13usx8qEs`%;u=)-{vMK_sPfi&CgdB7hAY!mRy^Dfc^UY
z?R#P4)9W!rXQWc@IARhFo#l^H@g}#I?pt#kgJX~)1####rmpN;jQrBFNLy>uLPRuP
zUZL+Sp8xL7xH%p;&nr_M@_|`fDQrpNim2-uEllY~)0Nef=(8r82!g}K$f2Xt-uJ(&
z2)Lc%NIP&`X^SNFe9Qw}QsNEZbpc!8LP$vVwzm-!J)P5$5=jbzXABu^E^baBv2}5E
ztgLmX#UCmA)sy*L9_+^(l-Krrplc?{t~Xt>n1({SDIqn?*Bde_O0Y>Z?CRnMtS9H~
zmt5+bcxTUpOjlPorD?MOI`c@PtRf5W-rT&rjL#khDg#%+Ai_v=eZ!%C!mVcM>XUwa
z-_B`luLXd_rci8#Lg&-n!LRJ+^!4;|XIsHrizlk8YXN74WLxS;7+jkQrywQWwi4p%
znwS>E&^>-RU1=&8yD%-V{2ny*0t1Gb^~FX1Y^@BlQ;Fr8G5qQ*1yw6VzqeJ*vLl(g
zf*1OuHW5HJwR;MipXF%Xd2uf{fC{|v&=Ke+Qc_Z6x@98GwDhz@fHIF1Uw=_8FpWcp
zsJ5?<6NVC-7rA?@Xl-3cPyfZIxutg`XT>tJsfi}h#z;>OFg^Mj8u<w8K?^|ZfSG)C
z<xLlR7kh~AKU3h&K(r@uh$mCjSujDRciGbZ^oF3`GU4999|vR4O*Uu-Uu^8pI5{cM
zZv}UK*yp13+$H5PM7ZqbJB&yfu-INc@U%ysYE|n;QuREA`w9pOF8|JCD|4u^UmRS=
zO85SAt}1dEA!i;))x*q&T!lj5u(NCXm!Vy8xN7M?Gi*Ic7m)!Md+S^gymq>9d1{hh
zkA&Z-q+bcV>yPSiO%b^`Fk<l^Ms2>BS6yVt@K{q=>kLmEf**}Sf%rG6%nb;Xf?-W?
z062s$iWsS@6BClYGcyaPl5<uZV=fhre#Av*Kl}XIjL>=8ez_PREGa!N4vS|e?G~E_
z{W_U;G{L&#b8TO$7hBb0KK#vGwO>_wy7%fRjw^!CRu}&6&9}whnm+DpWaw!ogVhNN
z!9_(sqJ^)_ZEXY0zd@<+03y+RwiXVs%_)yL(A$rQfFv;MhfFprGyF2K)_4S2gNq&M
zvl|c3+Rz-5haVs@AkE>v@2!~q_NEi(4d<Vry=LqZMczQy$A*W#62>bae(5scg_MZ`
zl8w@L1#961FuJ3tH3PQE3B;Rhi8WKj>=9#+y?8qDOtgC@E}DLTr|2JE(R9SdL`sVN
zSiMFyWnH9&ncny=nd&&z&jI<?B&w{TVM!E2q%#a(#R(5he!hv#b6W+#PE>N<-m}m}
z&!)@n*2f~yi;UqY$9h9FaWI&mKAW3|hmJe3!pA4!F;8AgEsfJPdTic+^S5D-$U#^$
zGbsWsb~J@(1eM%dxsH{Uj?lPnW3R(U{$e2(wlMey`{C5o=DsJO^yURbImm55E)Ma%
z@dsWRkV2-_D>Z}IZ4jqk#?S_&M8@97!!$JQ2^m`d4$QBWo*vwre;5m;FBCM*Pnb)Q
z@AhvgtcKGTKG$_lcB|IDn@@fO@wtFCj>Z~$9KI7>Y{A$=5%{U$-f+HLw_XEU2W9y}
z7V;o*yp>FfO0ud7a~M#<0rVyi7j!g|UR7q0wMu0>J8`pD(5H*RAs6v_qcO@fueubE
zWdqbYi?yPwyucUoiYepJF#--hUW1GHLGv|j74$9sFyaJIHE$cS%#9r(DagtDnQ_+j
zKvvDxd{bASgC+j?f`GZbof_(m48njcRHFRT#-cfMOdExd4$Su6rw_v~g1;D%WuV3&
z<P=6H$6}x-Wnt-JA3sn-JpAfc5b`mLt?A;E(yODCZb*YYtPhZ=$hArM@!?q-M>;Kj
zZ+m-VUM;pbp0{^*9t`E<b{3C3-@lpHfR_}M_#6gJ=4&$f*}{%D;y@?^sk4uc{wPC+
zZ=Ln(j9%J6aMS%YUl;?!`d)g;5X3oVs8<8JZUhg@NUbAa1{6gTs&&yl_x<hQGOj#2
zM*1xhy8#cVR4<NxGkBlTq2Ra+hesz03k^@NZ-BZBz?e73{lj|-ie8{MgK0u%F6};N
zl<qsd(9%*sGyzwMhx}VtWi6A}w^LKZHA>NW!MJg~Oe{Zn^g?B_pJ0Au$nZKD>4yBm
z?cj?8inB&x&vUSlID=CTXA_pp8TCUoT3Nbk|C_J98S=}r=^z&LTYCH2vGuddL7b{6
zDFkwU)+~(Y{9;)`+pTNk$IqWxKs>NmV$^h3`lYYR)?U_F66bWt;W}qhM63DG^OjFt
zS71$-%aH`s83wNJpFe+2o%IGg=JJ2Z!#!9}o9(1KdGXL<6mlY!T^~PI!3+RJ6j0n|
zT%CDXSR_eg{`kS-y?4m~zc|vECsJNZJqUSAMmDPhMQPX=RB8&GoQBfyR3m^=@2gN%
zTJb#c8q#%(+}%BYt2q;sjqwC+`g2`<e*T}aVbNF|1t5z9Zj@3SbZ4MK_OsPtQRO?`
z4F%R0kVWV8Z#H1S_NdVV=@N%mS7<ORcwVdmWm#%rl9`zqID44)`sw7tMciJv9={H&
zu>f#8r1~8i>Rl>>)ntdZNJ;m20Rz^kr!OSHG~72N2X}bCI}_Q}JvclJP=i~)yJOfL
zXbJI)fOr3^N#x`JnqJOn%(LJ4YpB~pH&F0LY|dA_o6Wb6&Vvf^3NW$N>s@5r&j5;G
zte`Bt^jH6#t>J%X>$1<PEkyZ>56VBAjq`Xxzgs-}b-y_c0BCCSo168|QGEqR<MY>2
z5-DKpO;g@m%<I;w^y1zeTjnZ#!o|tiW}2k?E~wM=5$^D+c&JPhk8D8!vzB#rTz2KH
zHT`kcl}~>WrE-DDBImNmno7`PEa~?4Y!KAb$kXyQlf%OeB$vlk-^*gi;)iK#Cv2aM
z7eD;SF~C2j`V06|@Gv`gjjtQu^BRx|N)>W=zNL=~inN-Z4wE+@HB%M(SPWm@_-$*y
ze{l}?`&L^zF*HOeTJu-@69!N}dg>G_AyEOyr1rqp$oFU)X3IG%508*uoQ~;MLl9FP
z%iR0=hJImN>xynG1f$!dV7h(lSY>e^vNn*{lnZeJp?0Q~)32z3C-=>Pi#h;!?d?_7
z-pD~=8EM6JKQ;j22*|OxSN7c#dx#9RT=jf<dX@rRpgkv1vV0>}#_BqiT6B9WqS*Y8
za~<4ucT-Aq(}iBr(v8<_bEZv|0m#oZc*+AO&#68NVqMM;Gcav)A2;gSJ3C8$fQRyO
z19O<U6_n$WV29%o_7glbY2~!AX*AQK8*`-EcFzs#gw2uWueVjeKw)VCeQ*8VXQNei
zvUJhsaH)PLb>LI()yF!m^mO9}Vbt~c^#EoF5N(t5dx@di%Q@<M)3(XBZco<po}lT~
zaG!xp|Lo|b72UK--_FYFdZZM0bAN7Z7NiI_UD}I+1f2wuv6q0m%q;iwK6=lZXjAs}
z5U6VB=Z%0lk&DjCZL{?Z^&DAr>osZ_r>3{Iyv#=OrDwI49{wzG&SS$L8ZPw;$QYqF
z>&to+`b7RIyx{;8+=5MwkFy7V`*%dXsaabumfx&?y2&MqSElw;$kzp)fA1#nS=eFo
zCZrt<^5AyFE<OHqfo7b$(>H7#EuxYIN0+}a8IW-vZ)t6_8mUbB);)K`PHb<Ab;U|i
z13NC%8QR#!#S>_q!{W+hMcILvpD_#otZ$B$Pk5(QO4qy@1j4*tk{Fj8cEw|dZu5dd
zWGGdI&+<5T<@@(9`$Opxc(jb{w8F?8S(G1SwhGyekeLyj0b@J^DyC@j^i1AmoU>Rv
z1^PMIxo+Z28$A$MTcRRUs4$myR%T`=BO$%O5q9+{8M=eAc)y?(DKkGZO-NE+wPFeQ
zmoB%1lY`Bq^su0(29Yw$`!K;8ps}kI*4a!ePQWSEWrb6zGR5yT?YE-NTLl|%0T_L@
z?|YEuzSt%|q^YuDdwkZ=R1=j_*jQSM!d-_?rad*INTUD>$wI`|g0zL1S)nGA(&LRU
zU!I8^6?OwDZhxO*x$4Y}K3!mJ$7u?Qi_9$yH&+*E1b}j9Giu1ZV#;=CZtdH@(YwVK
zX*&_pT5i3nFDuKy6yM<3o-mkFW89EhlI(|2)bs2;`buzSit#x3xTif@P=If%nL4o_
z&F5}dmQt?tm;j-it1{wGHiqB%tf<Ik2bW1^4ETAMe+}`xC}+d<ixM{fu3iXyhQM|X
zP!?I)yhLLkGpD07-B=$@OPUJ0xEE9XAagu)IFB%*R0XvB>wd~h#ImyTBZ4v2)@Sk0
z_yp^_SPaDJHD0}+!iT_Rh<bW@*prk1{eshFsGXC<2I9JGG=<O7VV>Kr95!}jM3~`O
z<KnI3e)=^Wbz3DhDvDIex@*q{1r}r~yrpIBU|A_MC^<zuwAsgRa_D-ZbhcyFiTC}~
z(TN5dpauRwN)EbCOG=_ZL1-x_M;w;*I!1BP`y4tF!@<>c45Szp)#bB%P00iGkfDPj
zPuT64&HIu)De8v(W{d@|V~Utx=%O{#{3L?zbG7dW(Sg=?wx5C1Y11baF38D|c>^{<
zu{iB>h5PQ{#yn93r1$y!c}qWA^T?EDw6L2wD?esH>g`#_=*B8=#vfh=Z2Yho7C9aT
zZh_R-#5=U+hV>pOHcI10`WThG*>H*lujTosbK$p6>txcGE&?<{EDET!X$uQFU~aFe
zuEmkZcq#u)oF28elMlqk*XP0=>)0DES7WM82W`%5C_}=8zsL-D+{_IQM|^GE{uRRp
zg{|8AG{3pJ^&A1}nGjz;z}S%2oGvc-W%Qa`LI(#L{SXt{5q1K|d0wDZT1@|WFxYDb
z_2Ey<BU|eSD=Iw$y++M`2auO>a^3*pcdCG|VQstU!u573rQb~<n<^Ei)5QkZyyq<9
zYw2U;I;h8ts-1QfOND~x7evq7lYqV?-SbKsO&pN$>9E5Wwh7|$@*^N;x(G+YefE+P
zx3+9l(r&MauKhwE#JUUDR#mNpt45EHYoq=|N6$w(JM?GLKtUvtH&6$_XaJSuXsa0%
z=DN|7I5iP1;)h}@g*%`8dWR+sR(mJs%H5rvGG)}&MIg~dKsTlDQMqhJYHF$wFvA8~
zMMdO~ZxKQL))0vcUc0Ms711x;XREEMT$OCY#JyWvVPrv*W9sKdbtjS_xTe@Q-E`+c
zeNYgH8N<yf{D#CJ6_cR`b+Z8h2tsW)#Cz+oJAG?!Q{V!zt}1kULXq)PP|HyL0+bZO
z2jNg)?F*sm0amx$$hm0IONJT(27Vy0Ju?lSZ#>J*+3TjC{CT}F%SE}D0cq;Dtb|=p
zLHxi!Zc<mviPdP4tKeQ?S=m)(<w#0O<IXX~2WATWVNaKI)>rieL<gzj05e5}KMktz
z@TTj0P=>7PWON&kgRQdud0<Dr8LZ?0-1_u%Y&DtRL$rH;U?PH7HyP>Hb~eDtshv-+
z*pIV_j;s`;&0-y5#SEybs`))k-*VUs$F;Pw0xJ*|JL6Y5F`%~iqR{En?b7-r6hxmC
ziOh{1Tiz+D9Cak}9s@mnAG1Ovd}EtT?0Fmr4+IYtH6pX#s;M2UbeP*24X&(^Prfv*
z<WHwuprN686j^<RJNdgKL5vEG4T}ap6gW_TEZbRd?_PN&fiquf!<9gwPYCP?>|_B_
znXX)PK;s;lU3y%PZk#kU%#6GqD?DZa?!ML`?YWr=A@*PJ3)z3*nL4XbsaLzjmXIo|
z@+ouXKBG;@J@#l~oVD*xZF7bGC|PvV6No{bmC1b$kd`{u()>GD?&P+L;nWfR#_hOa
zD|+%TdIfIaLFK`5`u{xtZG~pp@xl8pz&!tRcfs!qd4RwE&$Itu5X`T{AwXnI`>cs9
z=D(MEAR7KLi!>753ZqyiFzdT?#FIPN_oU_ZkM-uI2os}wz*Y%Prl$Th|3zMZQ<_Sb
z$42)!xDk^<%pCbx2+3eS(LZExQa_=~+?cxfT2FyFAw;&U3Tmk&CB5Hu|NWr4U_jLa
z%;?59M2b31h5^rn<k5k14&rTBSGNQDQ)S%$1p|NZ#K?~LpSyqO{~j^Eg@L1>P@6Mo
V;%`sgpZ`6iytIl`iNu?L{{tez9`gVI

literal 0
HcmV?d00001

diff --git a/docs/images/aibridge/grafana_user_prompts_logging.png b/docs/images/aibridge/grafana_user_prompts_logging.png
new file mode 100644
index 0000000000000000000000000000000000000000..6ac48d189fac4f60cda391f5ba36ed4ec78efc3a
GIT binary patch
literal 222102
zcmdSAWmFt%w=GO|La^Wgg1cLAhXi+mYeNX`?ixH0Jh%n-?%)my?(R<TMjDsKzS{3O
zJNtZp?-+O7acc0VsIKZ~ty(hYTu*=bpe%!qN`#7lfPgM1E2)NnfW(P_@Ygi*U%-E0
zTbok|2!RN4lJ7M<GY?mgG}PzFkxtMk-_t~3B?aPq2pf!Jj6e;dP<Y*=Y0wBQsR?S)
zS`xJG2`H~~tF^2GH#1q2GDPNmXP^rD-v0{qJ&HuoJE|M89pkUV3~y>5{A2nOmp#_}
zu0;%2Z`$sTH7CcXsiLi?iqNx0Erl_G75wM8Cy0>jjEs!zJ!fEIs@JqC|6alXk$>jv
z{W|^C(BJF)uj3tBr#jj{CkO~l;yU<$&fbBsk`e!$#W9DNJ^OREg=(z(=j4CuZ8s--
z)<mS!dM!Brm~v9}!TJbwIyY~3PpCVnkVOtFiQuGKoxF%nWS9}J&U$7`Nor}Zr!A)r
zJ$zI}rI7?1J56gcea4vR?&~>ku~@W#Geg4l#v=|9FLhtz!9;c5qacw!1&ym+3$_XA
zLXs7McvphFzAYnna?*8#f0mr`@WhW7{!w`P>~0wYHo<*F+P#mQCT=?Q5pVg~62tUr
z1`}e)L{pe<ehj_*??nd2PV^BZ+fCIyeR%pz3QePuMFw?j#LoX^%sefx^(uOmT6(D}
zBrQICj25LVT{WS3WXmDA@5=PUS_R3n42H<%(WH`UYp+%g_&|8DOS)3{R8fb&q42rC
zA_z&v!NMGTvREp+iiCzWH4{x5ev`^jw38)9r2j60bIAI8PI3EN(ethSg5;<nW=@~x
z+q)~%f+Xo|<@F(*!#g{}=Cb-+j9{#n#pN-atooAQ7G{HeMO-7_IQ6j?B<vj0{Bg7u
z{HC)SQkb<|`=n(^t7>j-NvzxG)BJ{u^{*iFozW#n=yTo~TVA^;N@~ALNt7n+-3;7h
zGe?8x(wC-jd5sSpw$TjSWIRISQ$H;dR6OrtPSM@ZlUn#+5g+BN7Tlf~427F*Jn%vo
zuBYLl_m3|-g(jRJ?kJ1lm4DXYdoQ~9qvFRmVh<6z4Ah^7!X8ZZmVKE1-b8KT7rP<k
za!;wm!}TxH(+#!#1Syvla>F47sIt)Z#L))=eoOZmlgZ5&<W3qyP}=@TfsC2Oq<@SH
zjO~>nPWIE+w3=K<958fI)VNUOx2DNbnY+e(G>aLCDp*+~r%--0^c$JKMcQFsPG_MA
zDKg*N60?q|0eOfNePU$iIfm{(4`-vpYl|_j771!V6nv}hF}jwpy9a|=+YML9MvD=^
z&vW8~z@nS?;TL>dCgo^|0$(hy?HAoj>9`HJw7vHt*W^LZ?+;(O8RBJUyY3Et1_kut
zeUVj4+JkUTvHm6Th(gn<&b$MTWu*)mttR5INGOhu$B$CRMRiu+gpjNRaJT+y|5P3l
z6e%wrp@)Q@C5>!McsXr?)492gQbwE_YQ?)5AS4Zq60_lFUkb3()r3BVa=8~rNX#>N
z$F!S-zjA#$Wif$xU)w!o(RG#6o^`Di*id>zm)L;DI4IZVbUMGG9<OGnKzO)H-5c%L
zz&&nJ9@S#G-gC5eHM06f*9XT_Q@lfN>H$f2ANp1^qJ%+c|Eei5fHZ2*x^Y)GJ^hQ!
zPuYfc^OZ~P*P&9nP8Jv>mBlkmN+aDP0R`6-%qFBoabrqKU)x+ilFtxInPfDS@|2}%
zzj+!ez%yRBtlVjVVE^;dd<RA2f3Q$eJ<BnAAAzc>Wjsz>%H(Z`He1b8a5hmVLST>L
zI)go?&V*G~<s%q-xPQ24F?B{BQ<$W%ZEL}0-xQstRr)=BoagJ2sD5+Y9?Ei&kUJLY
z3vux`ilB^mwB&R0F_8qO8UBXgu0{%zL=4Ff8cdTPOo)X%iG)&JU!`}56sh$Gq-IuH
zeeW~JQR~^=Mn-MY{q6s1T2UIJPyF$!Y;pTOkMpH^-|#6{jp!_#S?lmCM2u4(egeJa
z&OwksdU6^q6xf-v@Z5_F>i3h`BszSPTlOs_yW5P&Mer>$Hvab3sY3PHpbb=bx5cgf
z<?o2x?;72vgn~CCPH(2!x%ZZWAwGI>el0wC%9KQK-fVSSxc;$06&<%ON!pAf>hetz
zW(GVX`5TTKkKmH|A>Yyh@eZQQ)&Nf0%$|tfk@h3WV!0;UZ<Kw~%L;>H{e{It9ir)X
zT-IS5C3U~lZA(_9KWGeaJHBaoM_(Cvs>OyUGWK)*9lg^w;yqR8ZykOYmdvA9S}*Kk
zS*$(J>wAg*={G-%m8zuVjce+jmR(GLhm=l!Av<2(?SklDR9nYOy%i!psG|<~wsTrw
z^jq6RyZ3PItpk)H<^5Cx9oie)VgYpnw+IFv+lToL36b!-CPf`QB6bR*hawgCx%>`I
zE8@}MOLZA9405PIfR7@!Y7N}hoBUUm1HIR)>+?5l+}ur>Sa@80t8j;rLVMc_rr4nq
zj_lQZItRfNCFG4pm9uG!2<NT_w)EP^i}Kg1ljO|iu~{8E@2Uf_(7D(#xdgH4!bjg6
z3%OqCsKBb2N6k^>WQY~~>cVEV<6J*l=<wze-?5=&Z`vucM=qSMTwAyhV@xJlgxjTZ
zJnf!PiOZ^9T+y0Xu-@;?s9CZIJ%zTve3gLPZWXgjA*KTRB|-4SX1G@MSt7a=wROnd
z=0ldauMu7X3x%T1launItJCuAYR~5f>m%`wEa<+-;M9`C*(|fKxa&&{^1NcIE^*66
ztyNJHBJAa5?wK){i|*X6@R(&+TJ7%f`sxWtN4D*5RhQjf$m<^4EHSP7aAGcpfaaoH
z_)?NbnrN3?IP!0Ic2ejOpKEQ-&@_5+qh<(~>D6l?t>BCX%~|As(o58d6*sw1G4-t!
zPTHm8H3q8Qugz`R<!A@{CT<>yl>MQ<9t60l<V6BFG~pxmk3A~~9x~ld3f-sj&Gioy
z#OUIl1QOSv0elT?HQKEnlABFeUP^1N=UHp0i7210LL-sv%b1j6FamVMkr~_kT>~`0
zaahKxzX!PFAov9f@rC!ZOUF&vEl&}7o%yt-7S|8hnvxNbRav3#!PwmC)n%NN1!^Z1
zwF&Z!5zE{wJwC%<S5VM93c>x~(a@|7AJ}7;s+@1*zg>G5g1VOLIxr{;Rm0u03wg65
z$OF!HCFI1#`P@lA4*Sj>&Bir{Vo|bR{fucVX3G}F@4<86P+eVc2=k656*xG^QWf|;
zh^z)NQ1GowKhjCJGu4TtQdL*QZ^&k2Df~2@*IHvE?R6KU=fqIAT2x9Tf|P27MI|p-
zyKCwE*)uz@v8{tt7Pk%LRot#fr6^i^d16;~{*02(d6)b*Lb+dnOLSQ8zI8OuKNv4i
z1vKRP>F4G)tDdmOCZ?E5>f2DPgq$3i9#eWnlG}DE&I)swn8@8xZC)d&gG4r&>{&<T
z*rps0g(l2?LNhvUGQ0sdYPI#yXt0g6kGQgLwt?fwk%D#C?a{*P)(j%nffadY%gV~)
z3-Ye}z~ITFsjGWi>1m^CeJ}Bt0lDuEsa5M+wT4TB(rOR$ynWs<cwzZ;Oi#QYu|JME
zs!yTLqlOp;kjmI2XKnNIc&6nzjpS+CO2@j#t~f^Ok5r!#8qZa6-d=nzk=7fPH+HY%
zn4l;S=AqOD%AuDBPIW{YN8j+*N}QA;INMSs<)!_7+2oeVLE_pd15^Lz#LRqeuk^|Y
z%dl+)i(M+@N;1q@B6qC8d}pmCk*S(@%2Br^-(@R_IRyfW{xW7q^KoRHcdzU{@<uQ1
zZig<Ss{L|SU-t*2=CfDgA;ZVi=EMGpN=oN5Pl}`>JW^^;<PCWLBgVa0XB%uQ`)$uZ
zRo9_-mJUqN$C3!(8GR7q*O6nQ&DmGPFGr^=c-wJOX`4jb6iU@;USh?WgkoiAk+mJ_
zfc{yNwckfiK7y!?Rb4ke&YRjJuQh^n%_ea_pX7ocLo|`pmkyVbo$|i_b5^m#oX{v<
zmt%LcnSZaVs=LlfHFXeWxz-)AAmYoNtxEp)aCFR*nE_Gf^VF}#y52%cbd&{OjTqua
z*<YXB{3V`x<jPIRTC+mLRN&5A-*uzw5-zyMVOHuV5@J<6i`amfDcl`qcX()XcqkN&
zT>WX3>}hknslc16nA?ml@zI)qiG`u!n_+`mdn3|Dx?btqGzin!`o;Oibd5EsjvY$F
z=hKC)HtB!T|7720fU<)oURPYU#-uv>mHrxqYAFA7QKu>A8qtWHZfK7NjU)pLE5z2Y
z5?OU(+OzzUC9xDtXIT5ax_KjVTl&}#uc;x}iJboW(cSN;;&L8e)Ma>hf!X}95mXGK
z0WFRGN>xU_-YODfGeheiz0}wF_4$}?Q;YQ=u7843GA`pmV-^ovgutU`Nm@xWG>%G+
zGq@C7#DX!08uA}EY_TfVoElXU+YD16$`P<<wwzMLUh~)eIKN;m_vJP<AQz9IxchzO
zMIce91Q*0~b*yjTH8~LaYVgry(q4M}m!QLgwkB#f@w>FrUJWWqPF>w-T1^$zqz@WW
z$Qymfi$uwwU3RtfyALN575{<`xE?19^OxZ>PcK&eiVFGa<88E~X<a&z%e1*02({I#
z`m`qA=(wQni#+pK8;G&3S$DI}NwY+tJ6!9fbqJQfJ@|WkSTr{eI%^mO9}iT=db+C8
zwf?*nHs=l9yY%2(O2Jb1k)|~>dl`(C`#lvJrPbed(lJBo8uWblP&gBXGN`*>NW}~k
zKPZD){X&#T(PRo-QPTt|SF#{Xhfbg{4$6<<){nc}lwjF-D44Hih434q7(=g*9DY*d
z6_7ITlF1Rwn!dGY+x)5ZiY`Oy#%ll@DS;ZpR&(MUbbp@d&yx6TRJvF#@t|7;&BX;#
zGPcyle*QD%e&lDcjmd&8(^L(M{j(|)&i<P2n^fTi>fFlee}ks<@1S9*#80FR`DW2$
zsDy{zd5Uqu?f>B448EJ+Fn1N7{Pc;8_k;}IGVYWmJfJFLz^^o7x<{kUOS$cYtzA>1
zll@`&$2TyzO9Pzt*^1Y1sj4R2AC1hRQo1mLiJ7?vTi7`CN47s^$bD_Cf%qHg=gXCX
z5d<2V>AuIYQv%al%jFv!tzmzKCv|E^S-6k;uDsUhj%rHQkw+ey2?$B@R$@bMk=rDh
zMjmK$(p<*0jk0a<Mw@WTZvCjcuC1?y&gFw!>PtDZ6dcwB2_F$^eS~aay>Z@$iL`W(
zJvMKy5OhwWo~ENRhh9qdhPEzkR3V1ECGCyg)8}$d2^+a#d<>h+Rex{Y-9rQ55@L>e
z%sV$`Jv@;$$Q3!<MCSYTf!WMLYh~5HE*r4fn60i<N_984m=9#7Mz=Nh?daN)SEDp0
z5@^h@#7gk7emZT$xAb7>A2o;jk#bVpdcV@1XzU2)$okd`TO!h$Qd8?6li$WRsc(N;
zG`c%eQ+d3f`n*-KH_sB#mECL7A;$5R@z}UDJ-(1oKQt~O71sjypi~X-34Ur)<+n3W
zcmqKvjU&nER-fj`HTRP0<NByJ9jsJ^csUJDxDM18pNE=r@gAQK$_cibJuFnTMg$|h
z)Kli;z|d)#;HTn%R99xV)u3m@<uT{peY$0BSb@G)qh%|2PT8~(K2{uwjJ@66v-867
zVx*`7gEw-Bt&l@tc2ujvW8ra3E#Kb42MX0yTJq~>Wy@xs=B?s5{7FH>2le#S^YW`X
zq4Idz`B*)ib=2mLCUmciGE^OluAiDdtj=Yupebs*5_2pzw!eFQdHl=@<;(IQ23@_m
ztstf5LXs2@2w|?qOW!Q|pOUtYJ9k!Trmriv98<_upRLTK#^HW(b$;p2H?dwUWed9B
zhL^y9r@{_(mmhOHdc{oAF3wL~-<l^|$Q<caJ?>>-yo>tuH1Ef$`3^a;(qeDjHm`>w
zsGx0)buEBZ|J@r~E+iQwuKLKh6i3^sNQcg9D2(LYH~)_hlb04#p&?+C$uYn0p2@XS
z2Np`{Rbq0o7Y{)@a3>9D1_z(-b+)6u03}qA1b7H8K2ZN~nm=vu$=L7W_#ur^`nQ95
z56=!u{NA7QW_nLS>!s@TE5*YaGh7*zM4S9)?;Y6Go_|Z~K3b~2{3OpdQANnVHKR7n
zMCB0@a&EfzsChpR`h0-db25mczScW2@axBOi8x#rQ@;-<g<<JdXkIC^0q0YtwK$#i
z?$@qW#>|Cew_Y|H$G}@jwg`WC>*1$E0!cTsJi52en37YqzBz_G_vk($UT&?d`8SlU
z)W^rCt&aqK-*EHPw`bFBxHNeMCBNbMa)jN=I{rD$$M*DI=~Q!(t`|NSR1v=Kb?L!4
zWa{LaS}3p}HCaizZ*3dXD6fk?tm%XI#`d`jM$~&lWHcAGDNnbsJnQ~)L@O@Tn#MYK
zh^DdAMI9mS!a`Fax_tuvg1rW1?PRN-{<;#nZWvu}It`xyqkfT+D&|XdnVfvXw3L~j
zRL~45i8UP~^|YKc9iO3AO|P&pa8-R|<Jo0BF4*I|e)M1RLchO8oNQ<15Nf9XJy!3Z
z@IknVh0nQt`g4kK;w16^6W_+a{6l{LInf}uj^)os0}Uuy{uS*gw2}XZpx2MrS^ejO
z2+pBD{@2~c$RnDjTx?@$&D3B;4T1k_%>57#cJj>lbVV81AAT_~l)}EPN&Dw=U_cF>
zAjb#$siF$Sz|?=Oey3p7?4a9i`mZzfu)^;DLB|LP|4(&I`O+rD@l<@1WR*G-8gh(P
z|7d!i&$-*e?3Ssj6Eh<ju{0?>9vs!0UGFmt&p`|f!$Wc{9?Uz6uIcL%>?D6|f9F1e
zF@zHqR<GIs9#+E-R*sOh4zflP=>ms^?pudQ%WBr7P%H58r#s;Ahl#L~u7ux7+oLR!
z4B-0hZ4Z@X&2%?$*$qU;<#^Bv+Z+x4`&=7Kf1Rs*Dn;b9D)<X+NfS%gI`S<(lTTuH
zyQSyHqB^A6^tMOMUnY23-VnP}dl6mCf>Hk5U5j%YW~Moh9|Oin)@m*by5A~M-_7HU
zEX*q`BhlA(uwa%zr-c1lA=b{%<FsB(<g7jP^&6gX24^cDtnVG$j`_c?_j1rsrDk<3
z50SD`4X;O=b`1`9QM8Lr-S7&%V2kMjDaq}G4&8c_9fMcWt}z~}**6F&xr^)_AitEa
zULJ+qVmf4s`Or~5xm9YQulTLFBAyn5Pkoxv4{Y)nJ+Yji8j{jYMLmJW&%HA&QK#&s
zNW?sfi+GL?q%t3OF{&JicWi&*I|I+qRR3O<JBN%Z^PERKBKLgW>t(D%rl1$K5e+yn
zx;(1Q&x2K(@LGCnfosCRwe^n+P9U@$KUhFZPP1p*$0RQ)JFA((LJRX-WTum64mz7U
zwbca-&r^^DZ01bs_cnPJ?-WncS>wF`&B)dTwjr?~5O$SL7giSXjZuo@wb|aATw(Tb
zdJ2-TGNMFf)HD!D_)QZhrxK_+b#D@71MM*vH_v*H%i(fZln3qD${r?cs&kWUwgir#
zt~~k*hkvccOLITxs2a!F{ZR{BkvfNP!qSdOPCc0Q>Dj}_%?@H{Q?S))BDj@dV@E#q
z<pZ!osJrDuwa6FoqWH~^9zHYLrHl3U?e$(;v!TSd@+3Lzvm>tFn$J`Pax?TVFE23G
zYHgS5Vv9Ea9UEAxMxN<mO?CT33Wck>`VF<B7@G8c)%T#Ptf<^aK$6fDkBHnj(LK+s
z3l-3=hhz&`cP?))bxlcvT6e~-W;El!{T$~pE+*CIWB+M$k7;pc_C>eM@}N2`1Ud5N
zFFE%aFx}T1Q28z#BZt(tCe>=A!P1)CE`gxVVrsdxCb*s?iapO|+2W;_;~R%TD~C?y
zr8@6ljb37hEt-nl@R3ZbzNfpsCiUmNtczsvDyjIQT`Y?o17K@QNLs7SN|35ak)mPS
zlXQI9z#jYVr5Vck7z;U<8OW7`vPboox`Cg$y_}~scST>U(<EK&=!>x{BGFNs*;or_
zrg?njE87d_e`A527BXAS9cB&0V*x{owuZDU9=o8aw5#lh<P2DuZG|uosfE{GEK^k)
zxycEtVoZ?ukz9g)DaKe}Io(!juHJTmoKpSWmD^f%mq3VP{wO^`d)haG`lA%ThRB|r
zC4F>9?t-X<>lYBAZ*(*vAuzvG$i?|$uGaAb`q+^QSXV>$e(er(&6|cM&F2ZaV=0u7
zNL~Z`XzENzdCQ^7m~T+GXl>0&C^<<f;V;=g>NnvlF1t~Q+oG(er^H?5!D}HSa|YG;
z_RF?-fJRc|TgsE7Y?-XG=}ATZy1AY8A3JXv2bfv(X=PPfwRg7WM;umio=@dLKoPBP
zoVY4KkX)NuLeqX&g_NYizh-FTE^3%UIZ;$6#wShV(tlLMrNo2gB^8s6Ioz(-)C+NL
zRG0W*@}5_8xh%WJ%DN*K-bfM>O5$g~acQ3iX`)Qx!0^zwEeQ#&CKJy~yCXZr-z$X;
zI)9G9GS)R4xwg(dLDbyfi^39VN}<;MB*1qn8k_1kFPQGC)?oA(C2S*l%b6MNoRQeW
ztFYU!jl>JCM$%9*@JRT_nDxY&PsX~^D+zC22~rlM!>NX2kul2FW1OlQ_N?YTei*O)
z;)=q-bhtCqb|uR#XTlZVV^LOdIpV7k+uV7*g@?LUNhCFZJ;zykS{*Xxb<HLvDHrtP
za#~j^TA98eQbS9jupJ8(#kh>~4Xl2PFJ!y3!5YMREZp!}8AZ}6e6AA5cW2XjX{gqs
zLsjH1Iz8QE^XKS#hXWs8(93@o8K|OO(^ak6nKvmf&dnoa!)0j@Uyw#0Juop#6M~$R
zgj(9o^nNr6^h?_vn@D}G)9uDWeR)J?BquwiovosxQA0L@!v6X!hbj_k#W47-iC5fy
zcr^~!fbe;GCyrBb&C&c}JxzY5yvf_T`ScLvDAdpyPWCIiGFuU)m!<o*pL?hGPRfMe
zTLnMcsYbF8Cj(feMjzVdL)IbvXxgpigrF1O9~ltg#9`{5vg5_FkjELygmZ?_+MIl_
zHLkqHQp~G#Xn|Z=W5aPoaDl7)8p@D1d-kUxoIVSO@X(NuZ4K-h<we_<jEd1J%=ARb
z;5MN)`@F?f>x<=Wt_PCBuzPE-yy8<na#WO|G6-V}om}WjLo8z!GLHS~Pyj6Z1^)w*
z>s*28q|kzpzI6iA>O;5&=F8t<wUG&){1S6^J7;)9G8tSb*!X7Bq^JvSj5%@ci=f3e
z4;#=wenz+{se4ENQtH&_>1*vP=h<UotYr@xzKv%_H7!YCXt|sKc1sLxRLkoUeAK11
z`74*YJ#*)MHI0`e{l69zQly>j*JR5n^7^o!ByaT^m&Wv4z<o_6UztRJ+NN(Oy^t0D
zlxgLUNUW88HTKx`pdIa!O;9l*#9RC=*UECOL8#{N>PieULz=B%PQ{aQd%$A?!_(q$
zs|2wwCRQ)?bxn0IZFsqRgU1)T{fCDsg1bx9=^c=be)ud3T=DR5ei8PIDxS^nNU6cc
zrZwv5@##Az{$tuY?gWnCP^4%4Qc7aARL#qbk}_wO3W49#ogpUr^@p)#``^Booy?M#
zH)xFHtlMvk&O$Zi3HiLAuI&1L_jKvwNyA?0W%2ocg=mjxQ1wSFx3ki)6t^NW%|}#s
zgUZ_(vjqKGYZ4)$jf;#HK@AUHMFK;t3c{}wW-Q8bApG2{vH~@JOOJDi$u3<_g0{r`
zqn(Qi4K3!%ioTv2C(Z7iy7>lnNMp5l4kg;m?RSp7NQO>-7H`RlN|de_tvEX~<#R@3
z)LXrGBtW-PyDuNo$}pm$Fyy6W<f9^}UXCVH7nG4mUjjkW36mzkXo-$X8DUL;MQFR?
z_k9RHA#;gJ$Htu5tMMJ;)RwkAX(gw6u~-xaEo}W-d*5sl)3%6gdnRd(6P=qoVmyUt
zzy>*N6H@uJia?e33bo08N*cpTjU#qUi4<a7O&bH9c`{Z~tUB~*Uv8GaC6jzo(CLj<
zv2-*Jx*x7>P%G23>-hsr-;Jh=Z4vx=9zttyvMnoGkc=vQEMEP9KSPQAQQ4oXKl{pP
z@BYVlK9DXK_xYcz|63>We+>A4ipu|w_ckn;tE#C%?UyA~<7XG~fERlc%gK2N&dZxz
ztotw1Jo)6wOAOrHF1Ho52=MXj=WkY!^t$^fEH};`A6{mPcvv4m#OggaOr)dh>Y;vz
zH@U=B93gRIy^25Ts*35_d~d6NoLKSl32~l@+plio8*wAlCYvd=n^y@|KKbKy#Ia|I
zGJZ@?E8WiVk-$0bZ7@7SNPl<qb9y(0-Dqcbx5%PEN?Q6g9)bUNTKFq6UKjYXt^Lkn
z(-d^%qshwBQ%&GrDs$hX=*4F!0(sC@_3pG-A2qvC36EP`MsauxCgm3V(ncnR)U!jX
zb*kOi((?ZHo9-7m6rby-Q~#*vH?^{B-dN(1QBj<nQ(&Wx^!T*Zvdg~$@rxjHcK3|~
zD=pU_tnw4ml5W@EJI@c~tK^7U9eMMF4cIoo58S-GVtF5K{5AzTbT8Y=n7EjkA0#Ag
z5%jvlQHPiqITV$Aws+4>hsP#na`^c6eg*q<gxcP{)3k2?%yztLD4~)g;B>0SpCnFN
znJqf<gcWtLtUEVdJ6AY_J*`b@mqoVXBX6-cmvR%E=D0QgYh0uwAOaO3@ZRmfykKND
zcZ#rX(ye9ha&NT;By_1&Mi8i2LaK9CXMu^k`^>(}SB4c-PZ67PN13dn(+>fInHU%>
z8G@UerDKmpxH!rDBMQ61shbW}H8e_ylSw%}Jsa%9LgEe&zg`=53mp+FYVxR08PbkL
zuK742<RmvYkog_n#gGZOKZH5hcS|=Iwpr_+A4!Y%Ya6j!A4MYgCM+X)`EeX5(CUpG
zbcpz*UK|?#-VpViNbu4f;qT%F+Z$|yCX&8+yTTTVqMbJvhDTUzD}1yyH3^9cpPC%B
z<>bCxXpo4kQ=jH`R>R8d^pgMwhz1w}k!htEjzQ|<3M2I4l1{*>_VMXIK02%Dnl%a#
z_BnnXEj=}{Z);{O#Q1Ts1pCn}sQTKT2_Vel)kR9=V?$&4Q-noy=Ff18i3qP!h3Fk`
zwLg=8(w*Q?l?ZPMh)CElp}_h^M0~lv2X%3&runkcOyqiC&VVIs!nssueT4A%P@<2C
zh!|?W@+$l;#+7Ux|7N=yB~e;aORLs>#@dzdcwtc!;YQ=K{)o##c|5AD>;XyKp{GaG
zYmkep?&RW)t(7ruqvJv=;*?Rl?=5ArJ|Fn(^D9?EN#rKS)66~!2R>~`ejkRsirvmc
z*YYqG2V?Gn+lx4D9W9xbn((`Iq*6uzFoK`2_*}f*I6Zq5Y=wMZFKwJDPHfA1PARFc
zZ{hs&qV{6Cq&$B5>&utYWWlX&uFVC-Vy*t0dV>!>lZZv4tvMOj^HY9rGb-Dl8D`To
zG2r%wIV=nrF?QJLCGiBG11JTIqL8?KBr-hT&o7pf;>c%MO(7o9F!!NS`A{PKdf$V`
zk$5k+tc=J@fJ%@qGF`CK;cHSMI%W6Zq;y>+bjBuyyh!9neRbWQ87qi`mX?-1mJ+|M
z;`M7h7+r6UfR8*deleqNO)M)b%OtT^#<({2hW5hvVu^{d{5LLYENEeuea`|_)b6f`
z08^EehC{_Sj&3pts5;Bb%W2dzL}y7CV80K|9d;cbI~SN$Q%dp|wwbX9?KDX4FvpKN
zy-p~$*K^z04O`=e=R4LA6wqu)v)FELy*TC|az+ZOX2(KUf<Fg(R>5miLHCLDPopC~
zwi82xRUI{9Vdk!i8r?k&+2K?Buh=ok(a;XgB6l&>$und5&+l)~F*_FC`Abr5WQ8m(
zteJ%#KMoDo5@d~HeF>S)cHf2;VpPPijoP=~FN=u>IBXp*G}VAxGUkA<QGW`NlRuuX
zN{qe!k@vfE(^#g&#YW4$x3E9`WfC{h$k0^ZZ13YlekRwh@{E3izh4#!3A~(RM(vp1
zsGWq;YGA2<2C+8MXF%@C9fR!HaMD2?ooGu6S+0?I4FU_)yDg1+2LiSA#k!1UiDhL!
zYAMX`91<funXwzSE2;#%x$n3H!r6)6I~iY#?~@6Uz{kZUfeSasPgOdYYUG)seg@4(
zMRL!kfQ@%lY+*h=@YM7x?>O%#*k<_P(9nv3NJZtLVJlWxj##2Aj4dfmPg2htdbGrc
zgnm|CT{|!=FGl8G+t?V<tl|oVi5E|yP$oVvN=Z)6%R&u2eEs^h`ADh^^1?}11Mm{m
zzGy>0F-`t%ef8sD_==+9Fl?n|sh_<qR|mZ?mpI&elWDr3SLGM)th+s!jNLE-SdoQ=
z1y55DH&La7QE@fruL+X?uUBX8P#6o!5bx7o)yLIOeA=<4Q+)%ELHzF|wq7UCOiq$*
z@a@2(0rtxt|8;1hV=XYPhCb=rxB10+OjjrR5X%}j>6_>#PsYqhimybcx<9+eN{5s2
zXZ^cmp2(_M54Tk1K07s-jEu0nd1WRiIq9(%QJQGM#KeRn?wzLZ-H0iAId*y^6i`&8
zr@P2z)U2oWOa(Ki9V3RAuQLA=;i&R+CB@;Tdb@*dfsn!RxnHNtw^L#cE0V~$G5pi&
z*e+aAeN6(GQ)H<b`Y|WO>N@?!G4ENFW<Ay(e@@I4n>RGLoDd4zZqG$|-Fhk6hg>iH
zU}Tiz`;>ol1Q!%&&V=vY+&%gstm97Q`;5&PL4YE4igtT6Jq^DmUY}pPJ(y7_wOFhs
zIjF6xyA$Nc7Ps$P^L8`EB_HAD<~GPgVq{?W5UO)gtyk+Rs@Z?v^gejG6`9hj)j%Eh
z{Jp(l3dCT!(TbHPiAh~ueX7R`E9sN5{ljiMXehZN52OFe-H(;kmiM7CJAJXrq?l*z
ze!QvX_+SAfBHWr1fG4?P`Kv=t)yY`Z30ont5DYf_aPn<&il&A9lFpXeVk{`ASTxuV
z4-b!BGPAs-#42-p2Py#6k&DZBu8ObmfK7r$BYZ{>KAs~f<f^(VazRti>6xL)%iIae
zp%id^!vU}hrK<j%m>0gpGn9Bt%j@j+ta5v&@}SM`C=2No>OxzhU=SnIWF{Q5qJ%+3
zxk;Ouh1n0=5=iqUo4xkuxkwntxkbD#YX}J9vZMJd7&0oLHa`g@MWDRXMrmEaw9l7n
zYkv?zx$eW)c@n}n{kx>a{O{*yda|J5-Mx$8=jHkDK0x_=xs!hNc#X3!`3o}pJBqXZ
z29}Vcawo1HEVWI(1$~$)lS)h5_s#@U-}ioSi9R7t>>HBO!GGtToIIN)Xhlm;FaN3f
z8&C;>o=!~kMq68x$JuIHwxa0tKWU(p9VC_m4~30mPg@Y|zOTOU|L8EM0u<Tk`Mu?3
znbv#Z=g+AJhWJLrye+M&))>X!QNP}9dfT#k6%bCEEj$tc^jsiltgVm2FbL(47w*q{
zzxTM5>;=X`4xaoM-#y4br}H0W--4{2j96@jRf0O0_+Y2IQ|)^TU6N|wqw7G2BL`C!
z%J;rIl1?fNMN>t?OzZ*ee!Iyi&+>VnTB{lx=Pgd&TI18Hvs!LA)6y2MiTjfZ{c_kp
zLv(6z5WMmr6Zp-wFE4oE1O(I3o2Oi~VDsW)v5PlbN)M04W2o~r9t4!8W2+$1cJRjT
z*fi)D;(4;8>!m}tG!knzm&dP*{vm?e1;MDG_5`43G_-v2K&Av;w(t~VA>7m|rf~-k
z*k0@RLlTR=5|Y1VdK_gHX#;DJJ93g83@ftwBO7wrhJ;^C41+y#M#LOQ_$C~V;F|a1
z{$ttZK&DTZODo5)0UgTdrT^*eSCmb<7)3wNfWWDDQHENRX4W<yy3O}PO=v}HO08WR
zdx-u`+@{x8PPh;FtZDih27A8`r9mO8Dyc#qvmzdk7vIME{5dSF=f6;sfF458k_T<>
zKHpo`&P`jcwO3c?HSUd+7y-};w(``MTGc*H*b!f2VP+-;1bo)0BiTA#S{o#onsO^=
ziXO^lKl}BzsHhDrDK(nTbz9@qCE*U+o12pp>`GPLJUoIIEvp#Tny%gi#&_7>eNoni
zTi-TJk_yf>HwS8IXwi9|Q0Rg{E4eCSOog$2VgPJUJ<v94#gg0o){gutRXDvFnPit7
z0L~eM<5YJqe+FcN!DN&neM5-_(}Evk$aug39nTh)hwBcsm9lp_p4Q3C%%nf8J4auo
zC+G@#91o8Sq;oK@x6~PlcqPCD$Nd5mhnis>gj}<Ho>PM25l^WolW0eFOS{J_Hv;FP
z<UmODjaEXT&~k0Cx|&+EC*yM8T%Eyi-`wRnA?{WS2ZE>_=n@^7vM#+*Ee|YxjIqKf
zQaa1tcB-Sa$%k>-t4Sn=*wW;EgF*UhWI(Uh^w{!=@_^6R#MpRh3sn&FjVy8#9)SY#
z7u+Y9;E$puW&l3sQ_cOb^_E_Ie4Y!Sb-AX1Sfak!@t;3(hlAVvP$)AR?j2d-k?%eb
zxjaCBbzI?yzvORg;@I5YwVS^I0TiX0^BJY-9+ntT5{w!gL@!lzRGl_%(Jbb`Pw<8~
zBgEgOqt6XyW@fsS$xwuxE*5GM3VgnZ*{{B<(@rux-k`o?H)_(kYGt|HcmM?)#@%OU
z6y#6!3=W13jTi!@@(xptlWQvYsX=u6vF*55q~LBSpg5W$%GXKVfQQEw^74c{uVOh2
zD<LWA^lW<wXnKR13UtauS<Yg*S0<pn>@|oa$oup+qT79eq=9e%<!=KyIl1A>a%^l1
z6iQ(05DFzCqDtS_OLPP74DSJ13Qu>H`$Ih=SS6D99mb(@vj-m+*Ta}!OOKs(b(b;;
zD^Mt!a(s;p_*U3RpmnZ53S5&H+_$<-CDPw6XI89<*KhBLR@eSe(=;1&V(tttEGRIw
zGHyF7hrPzLg1Fb0@nzW>wBtCPK*WXyUznK%(T!#AvS;GKe)3>*+tn*;KiFeV9q;al
zmeolTMbAPYCYqWvS6TYb&W(Tls`-H{1K9IzbaQ`S-O#WdzGTLD4Z|ZK$P)13Jac}L
zxG)O#AeYP5(<T^?d=2!CsHdRdW#Q7-bDx8|ueJF~-5+qKrPk|@^pziQd)c>gIvlS8
z#3~8+a!D70{tocOprD}7pH<gWhWMM|v1Cq#E$S6+KQFF`^fWc=03;0H5>Y?6>C@+N
zlRnJSdd)&OS+0hrro*Gx)aJ4b0GUQ*G7Bdx|3)q`O=?<n5v@1?Wgh<I_Cd}2T$#Qj
z?x`ckzkhJl^QvNNODuqXrDf=o+mEXH#5;3@8*NpGxoj*os->v+b^iO&eb%O}PI0q0
zjH%wl4zPAH0OW}UJl^YFB>CNW@EIDLZS%I--9<>|F>4!U9gKxNNgxyQJC3(F&<A2F
zgC+dsJo4aMa-x(4pq7`xUjU#FS<9;{Qd?}8`)=r$v^6lSm~tGtI6j_=h2!#&PD8u>
zC^8^H#?<&df5prBr>oq{c-i?<6Pf*Od9l~>ip}~UP~pfi%g|z4dMdU!4vvF@_CAoe
z*&>QQSKKX66x$-aK`er<o|;dSlNKY4FAzjoRkhiP-@K`OVB_ERKZ_=w*rirhfQ!eU
z>d*@?$oZUc8=c*j-h7m5E0IO^0zy<t&Z>WX1Jt|+we;ZN;wpxRCuL_DeVFnxFq3L(
zOk2um|HRz$5Hi`_)v6|=ASH#kPlSVrC?!RdQ3)z%m%VxY(Cz}cm=i*2Xn-v<WhKyE
zYTKV3dhwkqld;b&536Y=>1xrv;qK4Caz6cZlzUr>`zeE$X}Yq7hU0SMd09RUQ*hDC
z@*fdm-dj3yFIidb#E~;9S>;OI0MsD+nZcmd)qk>ktg;fA0jU!-WYiEKXM>{K5BE8A
z1nJ$d->_cN?Ht|cQ^ogx@D*85`#YRQGTGZR&wEl5AONvg1A`d-LcWQ9tkxmbO|SU+
zm3#j#YpKB@`r;f0XetR*49s`{L)b-y2E8wH@yh+c(Ejm5!i9ZKQWD#Wk3Yc7%!}Gw
zTlQ2}))9W*<@$$dsK?UHG;>>XYEchG2TLXvf2_Z85%07cm<9+ywDx?@LbP)6T0}G>
zZY)zyTH5Hy!0$b%zMjrnJd=#Oo}TR!2QKD)UGeIuX&)R(*sHSz%jsA|{$-qvjut#+
zc?(@7gV)Zm-FKm;IL-C<0}`X}<5U=`)l^aR&9lR(m#7-KdRA7}?O&7%EDE$cvO4mr
z4bGaHo6D-zWJl%;>Y2(QG4`DehNbz^jArt6Pu@V;LaS7UV5lu;9_|nzB9Nm<Io+rc
z;f+^-!A0$4LjDYVu=s;_n9K?XKv4C5CA%I=+syS52bRFNSp|OF92<gj)mlxN59B5N
zwixaFI{fwCceQOxQh{)ltSm)7qdo*n2_1iCfO<PEH803uZ6gqK>##}P%*<?h_v>&i
zzyYmc4r*(r0zQV#uKpDPf#p$mU)1~H0v7~dB(YPVO(&Y>weid5vfom~AayK2eofwy
zxw%o6Ix1vk<rWGDJPPl?H35W$arIEL%LhcaLaelG={3~{2Aq1k^2PsD5T)g#`HBif
zsEaZ7lfjKxf_*#VB$A@$>6p^R)mY-7$^*_Crkiw$=J&`*#VQ&EOWE8;kJ8bsmi~k$
z`}M+jospJRer_*Ra|SMJQdFkFj5iGP0~4V{;B^h15LfuSl=m=#<fCcTp^=&VRpa(q
z$U{z3nv}n2XZ1<;7E!Vv{aAJq045A-><bU6e}1Uha|gieXo&|C<<?%6MD#Ug<&sqF
zP$h~}y~CQJl#~?Q%YiyF@>T<lXJ3+(6a<|iCe+>l)!7t_zFY1ScU7E5(tCl>uMUVU
zy!tXm5dBJm+S0iv+Ofj2^71^BJmBxmtL<mXY@2<`MEko>C&tjaJ!Sw`tqy#2SX-_4
z`)%L%w+QIsl$Z<vrw$LD`jVR&&5!q4jR4ZJEhXxd+3ueRp4LgJj@v%;I=<f@>-`E_
zS$b6NJQ~e%gGfpNiq6=!r!jVpHJCQ5q<p9}DYu|80y;q^inrUT(!!5fU0a)LkEW6%
zqRXeU67?>bPNA-n$qg^u@A>*ew?T(=bUQ5?)I+k)Ch@z!rIgxAR0s3bk^`GNwBYi+
z0|eob+P=GYI8$`)S37ysjB4{fF{SBBx>DOPYcOAB6i~iltw1GSz3j~$P=8y;Z<jSH
zAYi~Gr2?^`E-#ueoEo0Km(tYK(<`G<eg8hU#VJ<w>LKYH?~GsLQbBh?$OF>#*9Y5A
zz_?MpI5x3B;ZwDk-R%Zw=*4$mmZOA{zOw1{rf=QdFUkU_<RYWazc<wo0J4*1NnC1b
z`Sf!vxxrLblj|b^>1bSMAyM$G28N8o?WAViOJ7Hq%Q)YwGZH3$`9wv(!t{@_9&R+O
zS38$yXU+-=Hc(ojQ*{G8ePW;7A7{|IAy}h`>7-_d{z({XI#ESbN@tF!-x($TGX!UM
zp+`DOQ+O>qKv&fm6^j;wyrSxAYj5v^ro&68srLYg$^yEt%cD|as1Od=I9xN9>2|<b
z==ZPip+B18Dbb!NRbU3t&(6iZJN<^cre=~vPJ0<-X_SGvL6@Y~xge(_@6(Za=Lv*<
zXd!WoT~@Zy#NK{;YflkbfZVBhHSa}`n!R!|P<dnhMr7ONx%Hm>M<)pZ)B~tescGp7
zIP^%0Ij`SF7Y@MVY*0oLTw%wXeF6Y5*GlHKvML3bliT@p8*%}7FApMPyoL~m`T6^W
z{clnL&aT!wc$>Q8U-J;U@tn0q9nH=JLJLEz<Cey9#oSom7iwsJ0Z>9Z$RqHHMD%Gt
zsXXOd(o%&^eR|hKJ`UdN*Y{!>^FzxCV*x}y%tg6g#IZBnUYj47!IN8z{IuI-l-*M+
zGMqDR-({%FcLc`)Ssb4{fXnifWT4}xR1FvB6u|43I$(iwGoB6keE`C|!#t)82{~Mz
zE6vB}iKwEXV_w<k{V8;-qc^m(<;cu52<TX%IagB7&XYhI^~I1oyIkJbUNkC`)*aI<
z^K$WcxLj&zXf#rgg%%lx$B;N4!i0V28I<s&j6Qq^udeniC{bX2$cL>&v?a&Kn*+G(
zs%2dvepkqC`s|8mvAwM~cp7OkbPoz;1>L*(i>gRSba@5Z0G>Mi(KTIw^!uh_=^dt7
z*cspnYqvlhRn=3Ueu&HN3;V^!OF$V1WTM)-Du=apKR{6(Gd+;i#|J2DW0Uu!WhAMf
zYe5)yTZZTE+);*pnJ<DRNG68taBfaDcFGONC_s~pCEJ}}68O+2`q1phHPfIcB^63m
zTn^wZK*S?p5B1m|c5=D&ygj4E>q<D)xmH#?UL#hP_T%*yR!{PJdOt|P7t026U2Cbe
z7?U5(6xrsQzwUdo!|lM(J>C|O1gcX8@1RVKW}8RV$(MxFLqez1%%r3dpb*ikoNe}u
zkwM*r5BpmM-lGw)w0Q3O0<7x#Sfspsb+HtKY_Y|5pe%`bHdE9mVQ9qN+4b0NDcq>P
zIIJu%R;#<m1(#mY=aRs7on7;Q>W7~XI)TMpu}aS2(lt`jv%8mpB!}}&Zd1KE!GEO~
zHM`~lM9xP0IWu!cMgzD{_VVr?e0J`|tX=WtYwP##-#^Z^U?wgc11dm5N+c&I7m#@`
z5!uFu6~(*{A<6o9fdL(MOS~Qj)*o%BO%8U}e#4e`&e6Ott4(dJc6ZO)AI+`W9OzVu
z{wo~$z>_zOH?SYn;O8P?7^mtEYuP|Fl$Kguz*Uvn0JW1M#NbP_2J-`SMgdUw_=Q^3
zDg)Ox_o|-WF;JQwTHw~z&WB)io90USvKZ?E<>DH&WZ^5i<k638l21052NCv4=y04k
zbb5UD9JE|=g<)Xt-hXU2{b3UwuiA6rp51)Z15opLT9y1fpMZCd7-aD~oKka0`{ivc
zp;-UOQeFxkWkF-3r^lXyOf2a)wyilkv5`#C6ryTjW}(gNIJ<<;P6@}ffNHoY+HVuG
zmYPz~eB8*rJDP(ZDVg|}D7mQZ>&v|3zvUD4wQ_fuQbuL|$ZRPX%*OP4Ev5sH6c^9`
z@vAHQ4Z?{WE-K*VS9*;f)9RA!fC<G)GhrmAmJ~pL<-9GU9Of!+KFy{8^3O=O-&-?t
zGh4Wm$c(dOugQu~lRtI3AUv8-<Z*i_1;xXG{NZk#|0(dA?F684XP&Ws;a|T?Kj5G;
zkA*&|+h{P{!2a%7Jn%Du8vK&dy8PZrJK39CE+9on#M~3cJ{my>wm)|~zPfi#qv-;&
zc@2DPJ-m0CFMXr#SGW?{Qf1edtk*`{*|&4C5YQW)b^kkb&$m0xn`^om+4uI$>~JI%
zAe2SD@Sp9^D98bpy={azlF5+*&jlt4nfz|HbKs*9MlO*}V{dP0$f<fMSsuX8Ze7+g
z-p^m(-`+)TuL%k@UBQGX4!b9=J^2XN#mW!8bl39)xI}Z7=6+4|HuEL*12nnG+N#nX
z-P%f6YicW6Vx>`jvv?g)h?4{GZf<MYGqVg(C;?`yd-qV5!)sUGU{4a04Wz7;l-G(h
z96Mz+mYi>4a8j$T(t6>%`dY|ama1l2f*J^?+t=LObwp_u<;B-qa_!63`4!7W`r5%r
zrPqa<U+tFafoe?gB-efj+b^%zJX)Ly%t!<|aB0#KRqFHQ0}6Ad%)+Ff_S26?dR*Ld
z_8rCT?cKDrbb{Bf9bKxSqhK(2bn-Axbq&q+H6kLSh_ZG%4l6Y^dRG_#jwdGe^MH|8
zXT=vekFqkT7d$U7@6-6m+g<F2f-TY*H&}Fj`C6_-_;fhti=fG!6zPeX?YEjUWJMxB
z{a)9uFQ}`=n_GS?$jeJeb#2I{Phn9?u6N%Z9(I+R$9N>|CiuKkU0nkeQTtD~!7rC6
zRz9q)oz{~$YQtq#Sc0`LV3Fe19pBBsy;r7ZX2=VQrv23NN@Nf0mqoakpJS>btj6Y1
zRVrAl#E=SUY9-UJD17tlmHxz|w8}qCtZjAwnx$QAQdwD!iJd*AEg{+ymfxrI6bN(y
zDz<D1Mf`NwChAZ<o19Mls^x$01nm!Z)v2#L0LEA+?|oS${Qped5$<KiH8fJA6}5n}
zU2)iP_7_3cuXX1d+~eMjhyR+!2Wl0Re5ZJg3MizeW@feSfA0tpMRxrkdv__c_qzYg
zt`Yuk{BT~rH0|62S}-Hd^Y6-UR4navt_BkCy{C4^KwG~Lc>$Tu^|wcPz}|Ax5TK*+
zYWxjWkeVBnvP2*Er|2j5N0q_vKMw_<-SQlEtM0p!9*qh$z?yK}_W#yrC6noxU9WS2
zPP|Ckte)Stlam|%Bv^Y5s2jva@%A8e08JY?IZY&NqX84%Li*6d<&2RLxci9q<QF0T
zhfS+riI8?fML!TQ$7E%_+U25?-Bndpt*ZSIue{-0L$)iLCkoh5chK<AA`u|uefXV5
z0_bc$60wIuSl;XF*?K$%b<UM(r9CBMzC=dx%^6NW^#!=saJCR@Muwc(_X*36N0PJF
z*2AHn3kgkMU-`K1jlVyuYi@>0+kV|Ti2K!Lp_p?%l}yeinQ3F1#OPwdPO`PbWAVt%
z#-}g10*KZGT)R)re&_pK^fX_9xmZVLhv^L85P-rlT%C*>KMtHh{({l1#+$z3^1cso
zN-X}biKp7U-Xf@lNH)b6Aj`UGf$-&}`ms!Qd`rt8jRLwr_74n>x)QEmZJ{`vRwIVQ
zWi5%%%q;B+50+}~>O1jaJYE*NM#dXolk+_^Tfo4;{BNcu3xw3np4xB&kG26MI6ytn
zw6Weys!&jkueY;7R{fC5!Tf!;02sSCk?t9KJUKWk-G<(qG2`>rN`A>&x(3i=8s|ty
zS=p6de{~TzkzHIy3a|byZE3sDwX(mc127d*5(9U<_IjVZ0$DYYY9m_2P&(GG8x&}S
zc|yC8j39=STR38I%2~BUg3dVNS5ICn0^6(UZp^fd+(fL0IyZoi{8!r3;L)ZoTth?5
z)+3GPE80ChJ<Qs^7PiYK;y)SW;D9@QykC(CE@ugj+ud62!dmJ{F@>lG#sUA7CE4)V
z-m^iix9*#w43L_OMSVY%JBmIHz|q&#W)zw|JXWsDQ7F5@qtgYwb_iUGoL#C*Y-1j>
zQdsnwoM#elgc_{PifmWT^rfWC#(xVa9shJgOWD3z7c%Vz#PzsrG(7`qp&vNW^(RAS
z4|nLEj|Oq)d#dK<dH}4<LTcn`R}f}r&VSqkbY!E3u=}e!h%vp5|0ep8NkWeM%3lW}
z7k(YbGD_$p`@i!K2JzM|_v{7j^Kx9nl!yaVwakapuDvQb&BWq5@2o66tk2+fsjz-4
zb#p%s57d;5k=aSZ);(qb0W^8V0%YLgB3wGGSHve>p8UGtnt7(aEP#~%J&1w#LR-}L
zWI8%y;#bD3DvuZZ0;MC)s2n340~Xb$>ryy<BlVh6QXxvj`2IClq9Kb`cy;xp*i{Iy
z7o;pValQLgT{@PCkMg62s#7kD%w@BU$IaenV9qh*yl`%@xAE<p&!ku$owmh70_4bB
zXgFO&%GuccVq6TsCHJsm^lAb%$ePD7D;rzUC^k$(mYRU6+MrjRsEMGY+@w#rB|wZ~
zAxd}|X)LSF@%?&5ZLNkJ8NlE_8?k|EUH#?d6KEzD2WRtAcqnQ3U`~?V3vp{#JuB^X
zW;Q26Gm^>TrqlhDew~d2CepED0Qmvt&LMG~;*Uo{d@jz739ponL2j56Ay~lH2jba>
zMl%~n00N+AEwg&-0<zalfS6sQCu8fevLP&+{B`4UyNA(0v|5Wh^zKQR?v`?z)4Skl
zPj%ChTMroW=F7xp;|r6DOm^fBhs2G80t!W2pN8sluENMrR%_XIdV!ziX5JiKS5n1W
zu4aChQrH3Hefu+=i7g(TmF=>Ul2_!si=`c0`Yl|PG{W~eq#bsZWo6c9)<2}!stRU&
zC;$oo-8|59c+|W8qC~a_)hY#VD`;OIS}}pbdm&tA9s7y2?h`kqlD!@Nl`E<6XJLoS
z9{;_Q<Y9)$g-hY-w9By7b7EXN&hmbkHY@k^4g+Y^gO~?=HZ}(paQE9bACE$MU;<Ln
zP`Lt(iaOewf?o2YUl4DznowSr`TR_IxbiB<c`69BdLOmB91us9#kTou4L~Bnxh%JO
z1_r5r%huwnm#a0&-VRbDiX$CH*Xosb%K!=G7r-FlbCRUycwtqitT<9p?D|N~=Md5O
zX7xk%PxcfHN9Rl8{oB0HAOGSmZ8Ba6`*xqxb{-f><wbPE(h@?;Ca}vgA&WypkMdVu
z&@)^p;i&pFSAO27t6_^#i&1PBnlFJA0@MP*k_#symJV<5Q%QfXJajyY<iuv}|9t>(
z6FAC?0Idfn0S|9`?>!?U<AnnXikunk%y32R;-cQgM{B+6wyea2Jk$)`*)_56)n#WJ
z`7O2{j7)45kf#`m0%aLFgVaycoN2G*<QVTK2M7D@7HVs%s+^9(@IZAr&~zg7|Bt!1
z42m-f+BQRQNbumU0RjZK0KqM|ySuwXAR)K~cXxMpcM0we!QEv~UfXwTYkzLlS4CBX
zVVHU5oIc(6eRV(Y>Cl3D^ea11_4H72a2ji_FrF-vlafeD`K}!6T3SMT_5Ye4>LcUg
zVw1ti%gOypXGVxJpPra7H?{m4rVr=$89Q{j#nOS9)>0WKu@EPbXLX>b2Orzh=dm^#
z;qh#BxWXg?iC`gs?ssacgQ6oxvQ*tMCXQ7RP2uI?=H`K`4lApY6`Gm|W-<DJ*l@*;
zg1mZYI8;-W?&@Y-T-<#-6h=ITFBztB-2TE1WoM7`8?Wx^Y5l*yKj@(8yBr<#$q!aW
znim~pWo=g4rB8_T8ZrS?s-%CxKm*s0*w+Dbae+&_(cO0xbMRi=!h)QfoRc^3n!|%r
z?LIm`;>Iw#*G(S5U*C`;t0fB~ln#Q>desqzjD!T~X?y<3+`KvJgH~rDZ20j3Ux48r
zRz7k0G<{&vq|NqjX>rHF3j4e==fGg?--i#eAHF&|*x5m(wh_sEg?oZo{@`~3ae=IF
zvS(>z=CCo9h{yi=)_!ERZ_+*GSvD?HW0H!FLP1^G?*#)Bb9ZOQ!py9XJaTMwm@)y+
z5RSN@9U|{xTv1M0xb#)`dueeo>`NZ=Vqd-HcDS_f(D=ABLtXv1>>&9<MN9F`O}?$A
zmb2K8Q2Y{-k{z;Ynwm_e3kSW3@wvGad)vk?OYjon;(u^LlNQZMBO+whrU{?=aagB*
zCMWMr2T9KVsACHUUmiEsK9?sHQQvZMaz1>BQIKzEV`IB%B!A->8=8R|!G|fUGKYbN
z5&nA7n9uZmE}wnmjYZrHUS5Qg-sBv!?q{`1JH|>oKD?r;-$e}#<QjE%6eJ0QZ!Xq1
zj*n7GtYzK@%4=yUEYv#0Th$9FD=A%3?WILV#ijCENh><`tUfP+RoC%lA}7e3BfiHo
zoC(Lk+Elm4kjX%wueOGTii+yM6d9mWN;9z?8G^FP>-)M|X6EJ(heP-6Whr|*JBSI4
z{oSL@6$R_7&l>o(ovTHvD{cM|h856S^;bn+_BC4TE)-B}-YP>w64AfWr9_f-TAj^$
z&L+#(T8Q<dcjg_gC44t_cNeP6;{8C99%(&N2*f2nKQQ)5VxAg@j*fs0lEs@63Yz!j
zED;V0`ekok=6TTYb6?uxqLqZCgaq1+u82reX;^k#9#YY&?#4XhbzMqJi|2#;FN)k=
ze}95#9G#`LJg{Bw#B=2X{^DX_>;f3&>I9yo;a%JgDdRb!t)@UkC_baQwl?ZBXs52^
z<e0X(cz2}4wb+dUMNLoNLs(N;7atwl?)9i%Z=5|)U>nVthl{JeAC<_wTUYzHhFtgH
z0R!F0oGDHuI};w0UbV^VP#a+<UmOHG{m0o>LngPa-8I_gLyYV!-oT*XB~|VW(Uw-v
zLBoqjWE&41MuG~}lJUyPY|+G_Ve0Q>nwo|#?B%<=c`}T0P|PIqVL;t}`}B5xC_i!#
zz*a^^t#@&&KCTXjH>^kP;G}(cIIXwVF^IN!QFz-RmJ<>`?l?-$Oj}w}&;hiouU}E{
zH}>{!lh&6OAIQj<-}6W2Y?qgomP&_P=d|y@hKW>vCK7E)Iku0Ei%JYPC&^-A#KBR!
zI-1LYf`+Cb19ms69iyF1x%gBo;|Vri*qvAJuacvYNGm*#D&tK9i>(H5#YSob1vfWI
zEeb3k40zmatIFH+1ID{WT^MvY*I3b?sNP3B5z~^f8`t2t_bd*b3}h;pr&5tTKN~x8
z@9}So|8;x_-m#c1Srnp-?nL$W_I7b8KRdfMRT-_k_qw}_lTsEF6HDWBnCV+g)8(<X
zRC(o`o?!)=)?_+BppFGt%Z^{m;YUZM#=^HM|CW{>%^Rzo;h30Fbuhen$%`BeN1_Mc
z#5peNi)T3Rs0)`m-QrPGF;Q(N3L*FxI7lyi2Mz0Fup?nxYEVc618baWPuJQ-cIGSE
zr3{30Nxs!F$`IXQpQlM(B_^qhNk|BbcnL*BijkMY6P&QkDm$|znc82>l{KPb<U~RQ
z1it(tB^4+xE$u~8uc>vKXb%ZS=tRK28c+?9wkPA{j5?<CaFgzdBWGn@7?~DORfXay
z$T!(P*z6o07Ts18Bmcb?gR`Z@(=k3YbOC}n3Y46ztN_aP%Hy16YQ{&Yk?9^%N=k%c
z<SU$TbL8kj0d70L<yN0$DJnxIoJO|=upG$R<oQK4TpVl*vIPUGW8?C|Lu)L}&E?Ax
zy5%UyvicnG5jnWS*P4v5Zo2DnOy*`?<<UCF%f;bYS!blf%a)hFtiy#-a?N(pFf+GS
zUF661TXf}soL#Tf{>A$bE$uL$r>AHOxeyZ$6O2%y^tV8;q<WoCz}lq}jXy{#D%WX$
zCs4Q)1B(`P#mR;{Z-@%T$imXsPX3?(6-H^!IZMeyR@&Bv#2-07k1h4yN-I^bvXYMi
znP1H}`$wgokr_IN3CUe^Zti_KEfy*iM7K!zqOOfnNzc!_gCv?G4dUoQ4;P|D9tU3U
zQ53_kPy`{p<PO&Ys@MM=cAo!IYqxsm<>Y)>m`fMP{NnL~?I96E`70QM?aZUhdM4AF
zBzmwDug=`U?DWw<^eKM64F0?2dD>?j9(_v|c{OoX8k!VWN=S+`P9|b!yzs<#ee=~h
z&lUhD>m-EYLk#i86>n^G6Ef4^R|_XVkFwXlB#(*=JFI_c)91n375p>D429{y@|+j8
z1i9z<sS%LN>`b^(iLpppMvvXPZo_?jy`U6#l{$-!j0}CjAfcl>WbLdkXowVeaqBPG
z4~&^MtUpIrS5HD;+*uFY$UZtw$>I~naAF&NkTPS(<2hNiyqcT2RF0cn61?H{IVb1i
zn_FC5{kpb4b7&G3#RsdKKmO#V`+Dxx9MR_fT+)y;Fx}HN;&_ywAodx(cYK_v$*DXi
zNAW5j&O^h5MT0UVh~A*l;WRHd_qaUdhhdJ<#f3w_`#-mix9}0Juhf)P>9vl#%ja5|
zuyvM;cBe1Li%m&(%5_a#?o=`arG@vLR&Xt-ooiiPEcEnK1E>ZlP-d3qP=}d;id$P$
zw*&+!>{iP!bFr6BPEHsI3!^iV(#kK>i3U9(2)|HNYib-pqTn0wCHUvhoYGPQ!|DFA
zvZ@X=ulsU`V&xLPir4YIaiTvs@2L9E?W-<ekxwCpv%$ql=k?g<U9~tp>1NRJw~HD$
zInh>9`tbB5(G!vsm!{9uH`2S%T2cZO_37@Fz5WQI{e{O{n`Vx%wF>&}-r<U$Jq*js
z7%uEKAB;XY{*A2qO_QJ=6B`T3i<mK1UB%qtF*!Y<-R_L&F96K++w>_t6b5?gF0Qam
zhuaq^5AOb4Nxz<+9-t+3NP<1e<?%wE)YrS<^-#n4{{1x_9bNU?-OT>2_8z}ZssJi4
z+ojn)JEMuF`0}*eJj%a+apqN**xA{!Fr7SgbjP-~3s1C+g1!Kg0&5SN9znhCW~cbG
znHdhOhY1tb{Y9*Usebq<11;^A*}PymeA{ulUQSC(R%+Off&vb%@{USEjyl?mfWm^O
zqnZK3;K)c~*V3I2xhr)uK5<=Heo}aKD@_iqEiKbsBSX{Eq^xv17V;Wc;8@t&*lI>^
zeZD#3dOBGt?#g=W<<$*O$UC0K2OmMqMQ&kky<B_Q0Y1b=F+=cLKsKyVU+!DRLeEP{
z!Mfm*)!xz~V5sP-ps+PxISZm8x3d+_S$~gBhZYGb(f7^GqixI&1m_eaaT)y(h8bcK
z))u*ly9{nm+q}_(Ol*Xm#;;xZH8nBP`N@f@+k1OEyT(ph@M1r~hdjT)RT<QFbTk6~
zo?(`hoV={bV@6t&vn>SaMaHes56(WBG-tAoAUOE}V&C$1J#i^XLPpQ&lJ9QtLFZq-
ze7SL!mj6v4Ld%s(_<_LM$V`yZ!C%z#^8`B+6D~xa?Hgpm6@t@)Mkdph5EU5(`QPu}
zhl)n92_Cb;`DwO#n+@ls!rl`3+&tMSJO9ebsW}yTU0h6}k|9EIL%|GT?Q+dYN`eUz
zqM@e;`#XL6aBV`C2y2bad312_U=f}vvE)yy+?4Hl!3|hb`=*D0tH8p-GKjBRw>_US
zt0PMz<Xu=u1mhWaH#SZ$FE8_CQhW8Q5D?mfLPEw9*x0Gq@rng(e}aima$!^)n1CYD
zsW%?J56Q>H#RWU&iBiVnoatRy!Nk;*=fOxi|FE*nLe18~C6ywLQ%f<df0x(OHVI2N
z?HqkLHm`ekQ)xVXdanFED7r+$SQe@oFs{!i<k3KEqrlg|LfwDYH>e=03{|?){CJkk
z&d@lZxm9Ax%39-cyuc;)<7uQM6igyw7!SI>Uc<w~i;Y#%)cSJ9aR0>FR9HA@7`jk<
z$VZm!FWQEjzzEA9d5Oi%3rkv+)z(%<MG*R4Ny$kDnTRqP=anK(fP{O#nG_CflDBK8
z;QftqZx%ClzRc^wHJy;qRl`ZO%Dcb}T6*fL&qRAi+sd+$ur>Og?lZj2wOYD!FAhf%
z56cQIUbpTiNB$?)tAG-r#%9iKXxN_Y&JPJe@IidYJygQ?pjRYNzdFQEX@;fKu&`ud
zqGHz&)RGiz?Vday`~%y879W-Pz;cvX9gXK#p}(bXXk_R`B~1r*_mDZbB7q&S!_cm7
zg;r#ajdgZSb+ex#ATn>{HcUPz5TG=_@BbDU%CoS}fe{w`psJ{e{n?8i8CgbKo4(=z
z>}gRE|LkMi+i=J#`-_mc5eVKDd~Qn8ou1u=<z>&?RVkv=LA+TjumK>V2Nh*yuWk_w
zN=jTWZ}JViwX}{ev1AAcG~e#ghlYi1?Ce~oawNvbp8}G-)jbx44QBY$uzsaqeF;(m
zp{d1|F6S&Re`NKZjA?;|nT1oy0`fwgxAr=z3YHAfDRo9Xg2zjO6c@-j*Av3N@4fa(
z7018UE&l0-ExB&+-n#IYBq&P~?)A5rWdPdY-<ZKaOU;$DAm@-y;X)Xb2$USG9p?(i
zvHF!NmG$Ru!CRsHKPu(VR=pRs(Nt1o(Svk!qcYuugwL0{uNKsNd^R&lxnK}gGFAgz
z%>`NiOUIBk3IE1uXXd<Q$2cfjQQk&~vF`c|ui#hF>-H@hNvil3Mr3UY)OCnJ_A0i&
zp-1~WrNbj~;dT2`TTwAEg5!`clMJa%q`{I4%=MY+X;(MtC!?1s=bf$YxpH`42P`y(
zZa{mpl_08J4cmMjY;Zap+Lz1QUjR9X5r0UYO!C&j<_Vkk+kMMf8_l4;(S&u*$<8*x
z56%@XFnp8tNPlMbwzA(kkleHd>9nJ;4=XFil&iJtuPzHa?0w3q@hAkvaAj-EMjsg}
z6e<eJ)p=TIYn-$V^sd+wmC<Kxi&<zo?K_RfXm`I4s{JzfePv6%>6gS8Ik!ZsyI3e^
zwwHj4x3;nh3w&zeG^BGLC5YMuf(y~wVS96<^c&2St}YvrCAN%AKaN?*C}$%>7W;b}
z0#r{HR>zKfsJC@!t_Fe<>gx7-avPy$)t$-jJ#O}o?!$FW08m#}P;i#^8GaxvFE0<o
z$FxHdT=n`dZVw$3x*T^s2Zx8C1HkF=#OccNY<DgHThhtVHVnQTu%KT#8W1^Hkw4wN
zZ^)NC+Yz+X90`fnE2Ad_UwG`#;brGP-@O+Xhj%$$Nm=Ja-B0rOUn|pYXK`_6?+&uQ
zKhNIjDJ1iC@Ls^jcfY)eb=dQmERvfSB8nb#ecd<)NWN}uVBT&XAJUO}vpf1e^yVgS
zI+sI9lb6&-Z|fC={|eQO4!2EhX_*nXh7(er!9kw)2Z<pLqMu&2sE{Sa2UQayKw+Yy
zsA#*sesZkAJ)8LNlhJH-94mo7*=k+x_h4mZwL)BJurw2mN5#Xc*84;AO3nQI{C46j
zPc;0P>SVi?)p4slL}dh7Q-Cxo;hVAj(41CtJw$qQSt^imhN4OjW!dY!yX1~J9d7QD
zW;ze&K!~R-eR`gQXr%rZ4f7&dB{5+}lQ@xGzhZsBvR-V#wNPG%LlySV#+5PrB&(>1
zQf1Y>ywDEpNZ4ig>?|_Sk->uCb$KIfaTwv|fCWvb5k@S=&;RleMq6oz%*^~p(8W6K
z!)KfBCY1G|dS@?Lb$9b}i7v+I%%28_qyxz=3~F!|HzRIeD+>!guGLb3lwW(^*#kON
zn$Oem6ug<IHhW0fpWy_2HB6=is}%40;(u}gPJds9PlW{&Xb5q!pu+6+JP8~Z6H;FG
zuw60?b(7)3jzh$faZqT`(pv7k2nS1UN#KXv43-Yw(U0KX8_a_P^Kr0LE^j_`T@U%b
zAT|L@8wV#`wZ&G=!lL+e`y9XYrqw)sWs&~s`dw_S;v~zRmUy~Ha9rH(S>P==V%cr{
z^&&3M&+Vcb?(Ujg>Of_miSX`a<^8*Ns8DiBatcav-Gs0Bcwt;(guG4dnVG9Iy?;7a
z{Ra)ny`|<`U1*h+9Y#PF&+A9rPOnXJd&^}2#XmvPVaONptM8X@)e_3!&#n3B_u+za
zTt6yFTxVJuL!R?T-aO-09HelqWZs-z)Um>|C_+bt2N`fKTzqlaAWvO2w>d>?(ZfrC
zkPv&af7;eNO6GEYA`bcq00qd?i@v_T39aO&_s}pTNaBj$aQAAms+jswChy?j;LOcU
zK^NLhO-YatX<@O&%iZJ@Q93I)&e=!4cN*s9QrvD6Qqa?rP*A5P#!fB<vugxG5)q{r
z1*^M@sISeIZhg%Tk`NQq@0Pp9B%K-P?k+AY)RK)1crWxALEOQRk<DC^S4YXsUA@#6
zERbnxeqd{7hZ=;ndb|UK3qvLfc82C93f&G0ekrBwjL$xB`lg#-Gi7UP13ui;Vhg1y
ze%JY`q(sNgP|t&Mshe3=rY0{RiXM?-a0$uKT2z!Zo@vfeSL_2XBybA3BO>$@fFdwg
zp=Dr<Har5Hv0)CX3l%>*e#7e-m`OyEDm^|Rc6?)xkO&~Xh56~gFml#)6tj*MZGQ%$
zp5C7Of~WZgu}FxY29R;_3XxG!KsS??kUr{;7t59ZupP_H^k`x9CX0caDugZ)r^zO$
zp&=)@O2S$jDXNa0#qa8sL};6Y|5-{yQdCy90Z<c5l@LKf@`|z|VxRC?;d>6p$HtCk
zMUV|cQc?trmECPbe}8xG7384>S7+GQkd~J2Bsra<ve~8lCUVg5z0)WVAAAh`A&`;F
z!|Ui1zuo^vVK1Ohhs^3jL_n}GGoP88%Qw0Dn5`Hy(>6D^0T)*%9UKvC{dSohh8%s9
z3!WD;OEFpul-}>%X;U-iocT~OFlJ|`^ePi{qS1VwOmXH%&W)ghgu3QBD{91H-XB+0
z{Z1nnlv&hWQ~Y#>nea};T6;`)f9e^_k!HvoXk$G0<j#`ii&V4Ds4aTQpn`C2wkOpR
zCvp#_2>Eejm1;b4aokOuYB0`9yv7kopOsq}`$~t*$NP!*mCkpZF}f4m!`?1xW`+eX
z88;Bwki+?#*GDSZ)+uIr4|iv@pq#=?I&$)qq_}UkqD*i|Kdj^YzY?Rs#reudJbaaT
z><}RCxrfC&`##~sZ8pF+;M2;<PyFh%&JO2$C8Sb)q??gda?{^tkZzDISZ9SD`n180
z<ooo9Q$h@b0tfZh_uq5<=O1hhjc#=TN3%d^HZyB`QaQ~k5g?9yrN~gj1P^;@m(|kp
z0-94wZam7s>ldQ#HIpkcLzMsc*~nL9&v!nsYzu_sV8s*{(dx9hJMSzCZ~9Uag9j6S
z4uk-Ydq-`{h`P=9-m)VS0*Z|aZaW>?`v>?o+ZkTK*OzD8=ReTj|L>RcpRX$NRp)E<
zr~k+6{P&G_)Dxc&|JQ5(&j$-4unY_Q&-?kWw>1#?cC_lh-{XJ%9~=}@&i|=TD}eSP
zx{tH8phQzyIXL>O1j4EP|Get|`M4_h|L$GiiD>-$P6Y`C#d`{>?RLcfj|<!J|N5x^
zPk#UZ|9)B|2w{{GnX)f`<-ZdDfV12N3*&<C4Lf^8Sy@}<q!>N@#dpJx)YLOek~z6X
zBH`F{WOUrb(Ac)RKDX_#p7|&PK2e>|rXN1UwtS(&!N!J%N1&vj;_<mBXSyI`gNT(#
z-QTjYWDyXTyVu~?wmizWV1F^UdWIMq8XRKKsoOni#UtWv>unsi-I4<!0~gl=oL^2Z
z#fp#Zo`t+X`4Bbubyka?47#I6>7;bpdeS&uvNAIXd73#nSZKKqyLuIPw8j`A?DD>)
z@tWs|J2?CSnZ=`RV@gWbQ%CRHw|)`n%Rbi+I5#oBvxdqgl^s21lAMMoxlTXq8po|_
zM+4zbz{OgRo3+y+D>gUGuSMQi`5`(V8R*H~abFb#m)2~4`L@Z~iJv#SFxad#b{aBG
zR70xf-i6{=?H)4w_XzX4n##P?Yt~hRU)F}6|BfA(f+{~UHWl@mdh?`J!;}-YLc-0}
z)dXgQfYY-kGSU|4qO@}i#zsb0F|H5OY9b<J2E3wLt<I<(nlY4YUW-R^*?kqNVnRIu
z?PY1@#l=R=$^ruRHzW7%?!UglkeypR)gHzph9J0W{Ei|MkvTh?nVO}hqYe*6dOaL+
z+ms2GSx?casl9F@^m*O5ZhfrpSOY%^beBpB*OyK4`D)R98P85X;(=MZ=KH$>EgQ#^
zr=V4d2ndq_TpuEo+#mvO`=*M5kET1Mq<|q&14dSJSUO4*SwmHk{n^Re`}~TknseLR
z1u#g(%xrLCxw1YC|3XHOb9Qlb#^IER8<-ogWUrA@&GPc?FHYB8x`r=&A~NRiqF+|L
zKG9jtBLVLHjVSa1LgKfZixd{~X>2Ff(ap`SJBG?RYt6o*^Ect{h5n7PsioOv;o4q;
zUJ^rdc=ctTk8u%F6^?@v03A3&<!W`hUNo8~yMsiKT@-Iq=vP||43X^X6V_?==H#X-
zuBRaRJ@`u4I`h%e3Lnr1W22*^x}Tr&JzT8NT6;ll-o%=Gy4vityKG1L*Ujy|&Ss^!
zH1`Mbzz<QE@N|yl@we|dUUhv$ZA1Bbo<w_j>)4N$xRsRTlGpzh=bLoM?8t~qA$Z(y
z0Qpt}H$0o~KP%+*h_xU%Pg2{Fp8}NQNvu9U&rRjz)aC7`{!|2{>yw^e=ExVekGv{L
zOEc2Z{oVd+poJbvXmqg6p)Km6Dk-U8FEKT$p>lcQV9P{4#rR%?GpGextQ=d&MokT;
zk*66+Bcht_<3L1kIB-AJ+l@nji^u}O&OSai0olf@0OY^5HV^SkTbaZ!Ue`rorf+$9
zc?qnv>=@xwnnSCr-Y>K$XjrIvKJA5GDH>$UE!Ce)PR>$jOS39ndwGOo@8kId2Z_nZ
z5OB}Bubp%Q<AcRF?^m5)%UfwAd~_847)s10t2LI_#32cqMfKK?e8H`$e|)`sK+QNe
zISXW4a{Hj)SxmB658vOkclg~)I@UPNOtUOV(`h$Yo*d~Uf%`7BdQ0bCJh$0*LyZT`
zLmB58xSW15HPwBhrYveKwClTS^l&D~k>?&Ugp|*{lO5Q;zr?iBY*!K%))Li-PfuSF
z6D5fjtUtL<`+VOY5$AHM0}l^Bn#Sofm}PXgaFZ!fsCY0o;U$e!=627yfqDuWsa!0V
zY%*-7t@O1Bc-DfvxfYx3tL*2uF6<F}j$Z$)j#Xx?YpAPNMQ0yw{GbAluQVg4$aS`U
z6|_m<2bbz7<r|_y@v}$7;4t-75jorJ4G_tLg1~&Z$Ev2hA)AY<YYRa!a`|$?M2@E?
zMR2*rgOF~als>S6zY<!Xq|tADRBaNL7Z4EDQ2F{*_iM-+)~}57+r+%xJ{xFgHMPG`
ze~>$?#R4S{Ob_iHF2AQ6(DfZJIH{_u8_U`t;E;p33xvoov-<e%LYghd-P=1GcvVbS
zby0#Z)IGfvS6A=u?_i3pOwG*)pEZQfJF4uSXL0`Q-P~WKO`{3S9UPbyR3ApRQrM1l
zB|<m|3-_*qHDWSB<tqJdr72$EWSd}6j)9fETJzH5?6X!YP}+fUH4!^7IAriA6q^zE
z6^9e)<4264x=0>{=eOA3M1;0IfD86`gI`-~ccdg9Xn4UVZo?Y<SHXmpWx8DZamj|i
z{c4RegjmeYP0dV=+V1d2Y1ogtxG}H^E-^<Myr0WourgjN{)+wEV1}V<G7rQHFWLG;
zOL#XMsh~_aS#_ImPtmfLcGi3{A+Tx%CW3l`hTb1r{Abj`e^pWcIX9}W3{-d`SRi3|
zb=;f{-n0WDU{_2}Bdk`uFYa^}){xvg^Nj|V67=g((-b*M=~^3q0O@F5owTOsH*4)O
zfTX2q1z>!LwY}J$|L?74gCk_K0HR5u=XCBc)^?4|hWy7E1JSWDgoMZ4W5mdg6)V4_
zqKA#_$Mj!3P@-}4Y8$$zSw&fK(aBQVnB-_?oh=kVehY~odpysE{-*HicC}2tR;W=|
zMx{FT9mk5)W9C4|mpL57wf#D;Xv%x!^OD`&by+|?q&5qJNOg7H#6Gy8Ys__1ucIRD
z6Ws8+J_h1+6Xn2bT(ka+{t+s!)YVZTt=uH4mqTnSkB9G@_OIIBNXW<xHx0nls*YYt
zZDyBFe@1V~2J7-|-niHG1E=jOaQNZX>zZ1!EJ4(ajr{=UmyncDuGMM=&K1${=gENI
zS7DqE-Z-b5ZqK{1yLrE?o2_VRxmj7m6imWbT3yib)ha#1ezXpUX{dxO@_d6Wl33}N
znV6n{U#KIY;lk%fK}C%M#tO`s+TCH*y(Kj;bAJo-b8;?7NF0$encm~-k!-y0Z1)il
zgp4NT7I;-{^jztpsGej&+@;g2N*Gr81m*1yFcVSa)I?T?m)T=HxHv!un0T*e0VSOE
zFb-H9Q2d@PRO1K<CdOQBUp9HpMNfjt{@4MsT`5w<{brNVT}VQ{>G+3MbxmVq<I=Z4
zxVW;_eNp6e5iw21^z6r1jMr`!cJ}fouR%U7gfBh4zZQdGalX2`!FZ+gMfv!U1$>3U
zl#;UIN?onDu$x9B1->R0rk8<2uDgFlMPPNc2hfG$B5S|W*%6(x`mE}M3*<P7E!v8~
zA4wgZr=+Yzuf^7$mxuf94bl8-K9I&C1Dt<AVKAwEQ#=9=1-?}5)^}3f2Td=YZXiEs
zwYx!=$Sl^_J^mIRMnl`8p&5dY`zc0=0>%IH=TFk??siHFB*k9~oNB(8`RFn-*+Ham
z_Ls9Wzo#~RX$1N7{zSdhKQ_OJ)xFYtx#sh(MuRM4&PFpa5*xXtC4zt#{j=9t|CtLh
zMARfv|2G(+b#$C|bksY1lHWlA0TFF!{AatYK;rw(tAAT2*gm3zOLz{^{1#hSR@U`)
z><8eB`Dw8Nte57Fy-dau6x7sE8+2hRECz>Z33(hBZR|VBct}?AsQ%-W;%tK!Bf=J{
z1`U3ePEJN+Ys2RIj_v{iDbZW5Oo=0=uQ|g*5;m)Ceo4|OP(fiKb`>sQrj9Z5Fra}r
zxtfX!&B@98_}o3QSo>uQr%lGw!9RWLKmZXpv*XwER#7Qr%m(xROM$aA#XOb%r8R<v
zo@uJ8J4_T9IPbNH6MrXRJX3egE^Zt(Mw`}ka89qTx&f?Wt!-z;!?qY8M8}x;=<Ct3
zsg<mb25M@BrD1~g@W58i{!t7Rw}JvyclV)eDr6d3?r8=DfBTE8Nsn6_Gjmh)mMtK{
zG9`L$$m`5v9Ukm+E;gq$+uAprf2>=)xjHigh2hm4=UH^GermIAmtkn);~jkb(j0d}
zDC5>vwsuPm>_4YBC=}uK?7TI#bSs?-$+r$--y{|R0im(U)zsY7&cOk6xc*%Tp#pTr
zua;9Mr;N*l{o}dgoeTR5I6u#a>5Xk7baX48F>P`2#)8W(pBP?6>L4L|yBjfSX{b0^
zD1LJbi&MS^0uGnVvat$alUi;LM(2Sk7Eq;{RR$hZ)BxHj%q;}Bc!Jc87DmZw$k~4g
zlLVi*d4>&CPDM=2Rl=k(&`bH}+*K4~(s>`LCUD{7dRE88Wo7Tmi?ROtwC63klzF({
zHH4*qXC21H3#<8D9}}<gbVGLvEW^+d7E3c~!>a1)CEKmZPnfjl7M>u><iSxjW08aP
zh~Jlq0<EC?{P6IFKx0ay{~N2zUs+Y7EU(Dvw2NJL|6IM!?v3CNTroENyN{S5v8kzU
zr=7>Z%36;BBuhcT{*M3`U;v1`Bbu3?zT2N{jhQC5RR+m&r^9AIgw5e$y9=%2q~VD*
zI`Du%EB$W;G$P)nfV7KS#E<m!p3l3`a32|sWB$$@Vu`*ZvNG2n8)vv<d?L`ei@DMJ
z-Vhy~46fVn-<!pA3<l6xW1<L5?RJO3pd1*)zN|mh_Dv~NENV`!Z%fk?F?OG?4w%Qg
zca>pd!-a?=@OssD*_!=OqfRUc9}abPi#RYmEIuygRN*i?Geb*H-vqj^Q6w;TmB~ay
z`B4m~3mEnFH-S`;Ym$?Nl@!WY|G6Fm1tmBf2^skD$s6@HZeY!FbBCz_zQIH@1_L-s
z%b>Ud8DZKNukTuKEiJY_Qqp)oo?KUA#>E*}0pF`Dji(1e1I!K?F0D9Qy2R204BQVj
zpGfJeoc2oJY%+*OESzi9*q;Dl`152!N#5rZew+{t?08#8+nufKHjh_a?%zU;%mfyC
zdcx?LJ3BkScs!PuC_Dgm1cpGsJcwMszb4{q3kiJs&O`g@(<ZOC9~fH#5(z--R6vuF
z&a8R4O6`(rXe?3Fe9X-u*J`&*Ty5l5P*8GlwpWmqrJ<)rK=!%iyg~OPJ~&8HHn1x2
zRHP8zQG)<p0P||A&q{H?fjAvW;LiqEYwdPrUR)d`fc8YBuZpJMcK6p`?$O1?s|fwE
zotA{YgPxvdIpJx5{*(#lx4mr~AA>QhuNet)Byn<iVd042k5Lf*g@wZ4Nc@~n3U{$3
zIvkb#7(v8+dc;A95g{hdVa!yqUax^~1<_MgUGJo<FjG)i8XowBf_m@UtM9Au6^YO1
z-nAtpKXc;@Oq}|TjPQ(NZe9eWY+g^#5bd`elOJWlDTIg^Wb1HQ@Ua+V1}aKgK`>pL
z^Q?|^Xg7M5zoGWJp>*P$9~Y$nBqSvz1>mlM(c!*>j&GD?^e>myCJ_^POQnlHimcwg
zeLK5#1P-h8c2~4l3S}v!759|ZswxT1r#;}Q>cevID0$R#p-KD9S$)_T$SPY$)`H*(
zI}gGTk&wW}<LI597EsYRJ-SElp}-TZj8J%U_ML4O33E4YW=4rYo0sn6r?czxkU-D$
zq&UAe#6vqI^(1u)ie8yC-VS6oKL-Z<l|ovr57(kHCmYLiU)MfzbE79HphAJL_VOFW
z#AHb?oS5lhD`D_EC~CG`!r!LD2{GB(IfGzEhiya#Ct&h<OoxMY*)=9IQrF6g{YJ+c
zVds9hVv7pN;8@a9OnmUCsOML73`}pZZaVCK?SMo}p7Xy?3rjn@D4;TAWY~In5pZOc
zlqk!|jdhqxTS6GIOxL174UQgT@C&M_*vyW&)z;2v8eR;bW*=Ln&X(vXD=7RR7BevT
zXYE!5flf?7XBcep>LHiGsaseX%`Go0YANt6yG}zPpK5v3K`cdAo&znTY`^_j_WO8x
zHW*#R%32%!63zs|q~p=P8n3pwlhY1(eh_EsEww^Yzwab`Cxb;g?&KUE9Yt@^D+Xc+
zWwe~CD#v91c=w9OpE%ZiI(Ix~e-ZTBdIw`>S5#2)F=#Z=F!1f&q#lB!sWNqDW>QjG
zy6XTI?CJOz%)^6&AL*oBS?k0%MVr4#2?@1Xm82ZO)KHq(c!l{Yvw)f!OG!xwC8wE!
zC`u5_luOkR)RFv%@yTF6V0a6n2q`HMgtZlA6)h@X5So|RDACYSkWo`#W1wSw;Ey~T
zxCQPX5)m)11$AV+%GGru+RYJTax6MO3Zq;l+rr9%s;27vje@8K7ThLkw<sChTP`yI
zvZ11?J4<7-5z<Ee-v5ik!php)+n)ii`e`<vp%Q2$`%!=Y?0&ns7DdS^DEJBps+MA^
z*{uYTY=6tu(xNP7C9T2kQ4ms3{+?8OZw-M7US+X=N<mw#0O&tT5hA6gt!+ih*wrWb
zs9NzY@k=Y<gFCyqc_^^;&+ytmN?BSA&<jK7c6AAmkmyA-?uz{CRw+k(>yQT4Fam-^
z9wlZGjX4NOfPYjrC<THol-y4tVPUTps*u15piDT?D*7T}wRq#Pv*%`1d=>Rb0Ac&*
z&+W!bzBRw(;ynQEO+?nP)Pf&Cgoj^R;>5)8j*eGg!7<1qF1Ov7!nslt`YDWbWD`C0
z4#o={>!8-7Xdi`j=X?RjKzwX0Gmb%8e7s=p1q9aVgw>;=(Kbyn4RHFYTwO&CD5a-o
zY7CcD+<`w*`*dgb+F1&rS_}7=;ts82bcUIl({3<p$B_$?1>S+Vm_ib=*rEsw5N2Ur
z<OO$Ba-&fqrnsg}+5;YQzq)Fc)i-5nq$T3&DkdkV09ID^*qEo9UkzcmDeNwceia~J
zcz5+4j2nv};JX4Rx$SJ%vb?x>@4V|za4zXhvI|2Sd2myGE)UubVzalj_V@Sy1=9!o
zOOO)wvDpu-`)0T6b<Rb7UoI{x5*mg5vb+pZ#-*#)_R@3(N}2RszUV<iPuc+;)S9ur
zMZ#phAR+Zy{nj1TLx9}n<xv`BM}g9}ojzG+nNv<&oYU~q8dWdK2KwII92XES?ABVG
zJ{u;?vokoDpvnS!T29WlEIbVe1jTdXH_w&mDHI=PtgP@QB!Y#6djs&m6ixgWZpxaJ
zN7r&U-w@nnT#zDO|H9#z=M1o1I-{oiO)2o_4|9&~Wnj&#@62-G_v|<n-;j_`G&Go(
zoB(_g71XM3$bqXBM%#N1V7El5`1S~Q^LQIRNh#V|lUdn0`Ufc)-o+zz+ki!h+RW@f
zz+`ABC?&;dfQT*}i3-7B2>1!;M02T81P3GjefLYGd7n)6ANxUkcZ{i{@tL(&wbJrE
z5m9Ybk^B#hKYfe5q!-;c1j*lnCcvdvQ=3^_R92U$%lI4-A0KfnIDu!Z%QFVrk$GG%
zaUJ1t!$o|BwWI)&n<PX!DbxeX^pFsrqJI45UuD8wU6kUsyx-1@f<l5I>$$mpK#1h2
z5+sZWgH!nMXuHmPOJdz;u5=O7nud(bz}i?zQIVJ`Ul&l^M|WTj6sFIs_IR%_E~kFz
zD959cg*PM}e*R+fOqBb<se2JAzFH4Ve<tk<cDk4zNQf$o7f}1M0huzE#>X#PwGrYK
z4h?9*!&ys0=EaiS+{T)co<X}OAbNtw4ADyXsyU~`9#`eI*Vom>#b5yRo|Ci5dWCSA
z)tENQV`E=>#c)PguAhCF{)IL2I4~z?`}ULom*sy|84ehCLhA`Zp*1BXq05CgN@<ET
zN^0U1WXwD-l9m80OuHy4D+FUx7+$<2C4ysOx!?98oFR&di|dJUWiH(e4pM{66>1v!
zKQO|o9r2u$*T%cyS9qAoPagL}jX)o@L_%uy-eO9XCSqPx)R3fd+}kaq2KeiJ;gflh
zIpN7Fpbd<ZQ}8VqPbQ+g^u`IJ#K=L%Q-)D7);}CsG~d&dMb3#;%Gx^kw5QO~{cyp7
zYEl7!_h2bwF{HOTJ<_B~tEkLr*1KOaT>3m?paZC1NXQh<Pf^JQ&78HCHRDt?0vi{*
z-Tm3})mQ5irlgdT*XV&1ZCp8`=4VJH3=YbDDiFFh^?x&H|4IdBf7?qlh)ZL~k9%W)
zkC<Ta8n#V(9pP;rdbl42FqBT4KI+mtwy$7RKwY@jnD?tT?I-egFJ*<L=IKhzeNFVZ
z`#5iQAbF<7X=dh_w|6%<-5&O{`)~Ihn=*av26naD(4S?}xFpUPfdqKGzmCh{g38YB
zqNSDU*OC>Gd<%471P|NTV~top(X!IgPQsFs5~$(w3fOqM=hn(f_)mGd*+ors&!4q;
zrf+<S1LYoL8Y(`&e~O8VD=dHI{iecadqN6CEhzqf=C~HeJxDq>DNs?foV4D^tEdbQ
z5BCob&rMB@^!J+-*d(Myfu^_{0J8A%w#D)v8pDkI1GDbv=rt=8l|?Xn#EGNCfH(tq
z0A_=S6oTe?m#{~(-SBW-W`~dv$=`#Td(t|nSn*IU?VdZ!;B7W5BewlV)gT9|2Jp_?
z`;{=;&lw(e*hxq>bTCI@q$X#24L1C8!DT4ZYKNkakBS=|A5X>nT-n&DrmbxUI`q61
z@(f~)J-GAJe$pT#pB7~}EpR4wCePK>usAqeep0Kk%&ON>bTkBVv$Z6EmC+k?Ma;~C
zzJFiO3(MqPRVZ6~LR3No8~MN3fc4lG^IjODQ*kP3LXx{EngLp9`h;-nztyfAOma#4
zaixd8+J}EP{(-wmu3*ZMj7xe)BO+i(kPOCO$!ufZbljhB=2oXB_iO`^MXUK-Mab|D
zAX`LV8XQhL=`8CG%n#<-c6s!`93d54T)d8jjc(C29-qzGV~h3tq9XV86yeE9R3H3B
z1sxqKQqqgV%?}_~7MFerwoV3g`P}j}i@|J8Q<FMwSe@hG&;s+G&pq0lQ&IpOyIj)z
z#hS9rMe4)uG3|UG44&un`{b&0uHWHxCqUo@$|(}zst$NsddfCB!-x!BQLLkl6DvLI
zS~?c&1_U5gS}$TZIi3%_PgX|tj5B*-c57(NhyDgd)CEw(txs0vTJ6)z%aq1GI*pZO
zW!7K<C`f|9WxkWXx=d#x;~_f+Z9?nz;qoiXBlcT)YXAwAAJ}emz-$Uj*JbMaMAIZC
zZEk7`J*MS)`cew6kMGBycym@-O@>D6erD+gd|u(tj^|HdF)=yE+-#_xm>BrAKjGwm
z%LC$?AXQI=eg!7k762eed=-fO_u+7$^r@?1Y4^Uw=joDTI1Vl!$AEz71baP0G$$97
z=yoo*+HIDsfJTfS6q9(tZE|2P!a&85o%SmKGd&@s^4_l&8Ynr~%$w_~zj+O(Ol%kF
zM6L9;&nB<0ua{gbgTq2dqQs&-^QF_dhC%ny%9EOi`i;TeQbw%g_v0VOg6jZWOJ=gl
zs!xy3rhOn;H^orx@LSWEBkJuF&i;cZ)C5yUYL}CbjP9xS;tlblU~Kt*C2(v_*GYH!
zXOnHGd<oJ>-p!ksSVfc3>*9ispaEm8aVr8Go#QFob^xJ6Nc`e-@JWY=57B|PA`32m
zk@G+dsu)fO(`j4e>!+<yP&DLG1&XnS>!%w)7>_5d<&A6ddOVI@&(0D7WI5SSu(CdZ
z*@NF)ooU_^U>?WIZEHXr*Qov!6>u!>(p4VJn^A6}YsrFE{LAh?gxE+ZZ<Pn)v&TsI
zgbm$FRgz?992^`6yC@CyB%PLbkC#1})}v%lV7Ho{{W_M6FL?r01F(F~lZ5i?wR`R$
zKGJ-gG|d8s@Yf>SqlCbiXgZkzzFuPMdypL2t*={isx`hp6kvl52zR-DIy~^-r{_gF
zR{oWn{6i4Z7;1Odh{w}4{`eohz5b_Pzj9G!fR~*WhnAQ)P|6^~riPQl@p%!&$!U~U
zh2cXyMrM9W>N1$H0v0CJ<}e`5@i}Td#@npE=3`lo!=}bVg0A)N$Y?zB8X6w^1Kty!
z)ecqk+FYOyi_<*@{v2v^6HP*5XrJ%sfQA%Ie|o8Moh5>Gf#@yB%KE}gOThP*1&Jl8
zAhlFM<p-ASpYAv?KPZvT7vRVdb2)nqY0iiEoxQ?&@`Y>7pYY3GSHD~5UA=TKO-=p&
z`^Pvrlo7W34mA8B;Tcajb2eu4+n2~cW&Psu`C_n}1EeV5+q6h*9R&@@Ct7%Le?=ss
z6&)1~^cu_2-Sr6&Q?@n@%C9PhKTF5Hb%8wM<L?a5qaY`L`@mMG!OqGGkKp(bmVWF6
zI3M|A_{YxY-bO~f{b%*N#>!y5$`2UQ(^pkTC(r#9pQiy+U`eCI0E;Ol7MfhI+qWC(
zlxx&0i3y#UtcJ=E^gZM2oE7>(n-8q7sn0JK^;XCGVBwC(+Qvps-ZrZk0Bs^Hf02^<
z)Ro2u^YAgG*Zp;4^aYZe!FkW+=Ff=NJ<HO0!nmB;LSnxRVJg#%g~fhf(ZP_;E<^1>
zRW+4pryrBiMa@u=gyP><_V0i0mJTMS|3$m~tADVy!XNn*e9g(>#)gI)qIviv3B8T_
z`G)Z-rqtQ?bvPx^t7&H!#1}#I)?69TW_&U=&pfL$+4)o2FNa@Ls~09@Uw4lkm=ZsQ
zEToWwLib}7oL`H_YhG0q{z}u&0a5pxCwNC&QVDcC)+zF%1v16LR+m@ICK}ian>RXd
z-+&oI;8q!*)N?F|!Ogqghzs#6=BN6N>3j*ZGSJl2w6`blGF5k{F^`7!CjCaawI0=~
zn=5T)b?htXq5AFDlB<km8qnCFH_P(!b^*Fdj<&hIy?8xq*{C$9NWkr_`xrhdEWGw0
zCxareerTimPzd^B!e0Se*wM+ePN$-*1ensV`M)`ughfR&hU>w_0KyL;uV+q73`-J>
z&Zvd8wee?cDXFmaJx~-I!#+S#Tj?27laRRWKEYQ67t~(&>!^%@Uc6?G=FE79m;(l#
z0Ej&-kb5e7XF%K9IRmR%I4mD{16cH_V4Cb!$&u~B&+OUY@;CsS4eGbOo>5X!SvU+d
z6*9L(ytsW;RW($wEdY#CxrASD=jy_M?Oo$#{zPq}(3LzJfQ=|0zTIQLurU=GjL0i1
zqkSNViixSP?Com2%v)*n5Y!pBJ&aqy7?Od-B83cwMLq%c?Ms_I&jjT4)jJ=JrlQiw
zoRa{9mAIVx#4Feo=V3Vw4*R2sM2EbdzTP)RWM4M5JU+jF&*H$9+IAYDRUj2`ENE(G
z#_O|j1?-u%7Ox;}zic_%pJH<z%H-j;PoFDm4m%9w2(bAh2L>Ya#)*=X)!u%<{jTI8
z3(S7VPm}=q9UKgT^IP_@h4noB>ILmP7pUmLR~&dphK@SSaqzLTtYzF5;}IY6^Vk$U
z8T0YtwPc40DFrLMmII{e^JFkm5~!MsSlcVzVo}>w)*SPBJI2S`Z9A)gVvmT${mU3%
z)JKSk<l`A9F6kKw{n^eAMukhKb(}OgI!c$F_qsl1NTu;}aBn+|h=_lL%XJFTeEC4*
zxsJX}DleGn{V$+xJ(QZ8CjnWacd=Hv^xmqssJFlbuRlCU3_yNApA_C@)qhgOJv+LO
z4v09Zsi~P?;(m0M!UYWgLu)=pl5X4c5aRIgbW&Q(3L(Jpg(_8-SDj~E7neN6=sA`Y
zNC9C0G!D+j^PV5ZkCGh5#Kbt&UIXwNh`n#BV&mgw#KrG{x?#zg;ls|#UK@l=!&isA
zyR~IAC!91vw!n#_N;Nuu{P-4hMP{QaaZn}@HNe&S_?{s~KP`KxWd{N`IWx1e>UVHb
z(y!nu^?JLcpwC_hCD!k?;r!;+xknH+fAXN!*rVQj_@wdR0VXy5B{bek_$DGL$xOuX
z=<V6k@`cU^_9M`zRxzrK4|lcjX8l3(JY~v);C}(CVl0!}qM`7QocP5t26BxJ13-11
zot^+a!+)lxQL)e&dIwm;LCfAeMhh7ao!jw4#*>X3&?6~brN4MzJx%SblxXx6%2QD6
zWCw615-@0Uc^&tS)2aD(V<oT&f%Dzdli*JT=xyt`;sn--t^r?V<!c8$D(WQ8ALB<?
z8SCdsiR?)rPws5&YCYZ}pz=fT^YfE9UaNtD&+_(Nm1KLMrS^>kUes?EHZ}=yiOLmR
z%jbpp`SVs#{Y2n1il~VzX=w>cD&%|henj>o=HlvZXc#y@Pn~rEe1Fm57HIne-NeGe
z0WPc#1~YkJCF`_PKDlil0TH38FRTme(;ExgW}oEZPu^Q|Gcy)zqzW#|9bZ@=62JZa
z{Tp)~>kUI?U0q&fB`S}Gj!u7G2nd{3Rs<DWG;I6^3faN-5em4(nlKq<Wm1_rL5>Zr
z@o}-b=suv6J2h_oE-H)v;p?NBirQucy!@Zv@2@;sMM({1|BAnT)5Hc(!cX$_uDOm;
zZzEi}r_N7FP>YtE3Xi*6QAH&=IleS=vhvl&!2#XbxUwma=2auj-31bK2!8m0<&5VD
z%~WAKz1B2kLLe@sL`KC9d)+RAvTY$x>dwi)ke-z#@73*6G7Y_@XGNzq{oSv8*Pq9S
zX>90Ze}fq{>J(@uK%ku{uu@;-`h<yyH$ccA`SYhLvI~*5HQ@x7ZOj1$1%U^GZ)|1(
zwXA|xh;;sV%4B6%i~z|G(`pVUzgG^SX;Artm2|SaQW-V~4jZ7jyI8NC@^s#wO+G_0
zcW!R%0)u5^$)%j|%K@CYkPt)fTg_F_?7W~K(hCBT0@ga%b##2*cQT23de+d>*#Dwh
z#0mIZJ*3VEnESF?T0rGPPr=$)m)BHR_RCe=Jyx8r)2v>o2AU?;oM};0Nl8me2@*<u
zXLna*+`GKIdsb-<8Hmz)xA5x)a_fRQ7P_=(q8#1{s*6s#^lStiBqXb#p;c4^xpqc>
zhVa`Mfk>q?SL<~@vf|g;y1F`Uy~s(ZyP0svD4K&AG6#%*F)XU<3f8l7yprwi{@#oQ
zcgY&T^h~e=)c$}^T50t1v3%OQx>79J@Ow{+yac;aSPzF7ax~v2BQIcn{6KsZ@YVJz
zARV6Hcihe~0@==&sL3lmp@8Gz(%~q7eY7~pgp~Z_Jnw>Ro!PMZx=6LhDH{X?1lW|o
zS-Ga;g`9`bRuMe~&{p|sOJsDcONEPez47JflFG#TXJDJp>!JOxP!^{aCy;sPDh0%O
z+p{wnqs=FO1@It{NCNe43=``U#g2u<<H-1PK)p<Q!_nc^ZGWfMzFLVJ#>jHrc&_6`
zTxnt93kEv;tnAaxA&m*Rla#d<H3P#|{>2aK<+LGq=Tx-#$PO42h-Bhey_<P6v%fKd
z4$U#B>sZ8T>wTjZ<!g>3w>Ps{G-Pzm<~#0mQmH`Q92yF~yPN;@;I5nTmk#*V&dy^i
zxGlide8G@g<+OH$F#dAHyDBNFaU1cYxnczy5A=^}<&OdFVBWIbYgp&XBBMAY0GRe5
zML{N715+02=iEf&yDKHmL%7^y{%-oW2L%W3`3%!BFnB!Q_>XejB=FyXs;RuRP@Cw9
zdxHOzuY~}xWj*P8tzW3pzN`$=gz4n&>=*%ry;Ahz(t*)LatRVHP!ByYa6*h64R`1{
z{$A46%?%lUIZR=3cX!tbPnl!Bd0=Ru62(|Rz!Q|X`OPx-YnX-^!aP2!l}Kfkm5lWC
zeY1VO0+hgYC#3*$Af{wZ>NO{XO!>TPzQb!HB(``iBvoQ=;o=>(f56z@HjInI)Ogjp
zoW41Y3LH9QcjHR@*5;b%aMcG~JiBv7kW6$a=*ny$Vt#M;>1ZGQSG+?uH&#^z$0+tI
zd%T08Wu@~^4!|>0iB*FO*kR@nh>eIJGGqd&KqWlbWVEy%@2Dc$)nWH6ZTP0FmypA=
zF%9=S<KKMe{d9UTL!n4hd&rATN5|Lmxhw1#9a8kJ8BfDG8H_PlFKE~Mn;$-XO;;Z=
z<gF`7N<u$Ki4C$Rb#<;^Zg=L|^736RI>z79*_IZER{Jd^1iNn?u%scQ(PJahCz05^
zBqb4pgwQZhpcbh`3&S1KA|fIra-HeEEZKXooe>2Ds!zeruv1fK=G3SP3%4RCf(|{H
zF)eJIYtRu&V3{AdpZf;jRZ@8MbBZdZYVGeVJPzVOJpjT)W?m75NIMiPM*jE<4i=Gt
zA;;U1^A^whD{v#!L^YgN8u-p{56IHZI|X##lJ?mLU1$=&f$0qNA3wU@-L2*Xxh8iz
zK9W>Srq6T=HT_!cy6-+x{BG@(z~&Wd_1@HH->TMyo@9@P^kqP(hbf$k3;Priv2A`&
z^^G=R8{2hrHHSVP0mzdmDCh=lE*xcCZ1nV^Kq~}n#E}8>3R)vp247e@9B7<did&KY
zJ=LiJZbBWn!|_1&TU@2-!`)rB2Pq219k^Y<?#4#1rqWFDH{8YEi>2H0%F`X7$YzTq
z6%?E4vmcWq0prlxNmfk_LK#Z>?5x%9(p)8A$6D_&0VX>ol3%}Kq>6^dT#<&AEc?&4
z2&g|3=%9?%1R=LTWjZev25>?k4S&GkqO<KNLj^WSnOCBSaPtkQ%nD0#k`iNot%%XH
z(k%eLT3jx-rKO~<EN;+H%sFv`AHq7qz55*~`X+z4cVF@AO_2S@9(P8$&0lHHOLFxK
z9hnaOwoKD)RP_4ogV7AYQ?eDTKzum@qfBgu-qE8KQvFZ?2m<($nM+DYfb71tX?G6J
zzxkh$B6Ba(tYGv3IU4-)i@(3Hq2cz_l+TF-H9aM`LsVL9s@-#+5euwO```OD`^u1Z
z4rOX@Ijj+l<*6yA*Z4Qnmuqj)6H?%S&SUnsa9#^eQX-_-!kmS*W<h>a#Y{l~eW|Zj
z72IV+^;4Ymqa|B#rY~c{;#)q@s|bcfa5`<Gv4sJHyfkbpt#xUw1(1KTq3=XvRATg3
z5WXz8{Cy|Vwbmxg$(abIhJu%v43C9Xs6tU#R0M82qO7Rcbutfnn}5)tgBS)L0n+|P
zyGw?NHvmJD%l_shrNIQ|9ysQYS$8rzC=^cXHNimp-><l%XBbhEs-i$u5}Ghj(SjpA
zw%6wAt4)L3Ax&EZ8ZU=HZCzPXNQlMZ&9x;hBkYe=@0|68g~f=_ni1W2bOC%%_|GiU
zv$JB3FMb_yzf@(=_4M@WzMD?TPia98-^Bdao&{FL{yQ#>7;+juzNOarRVIKb=gL=7
z1ckhYKHxYain5m1)PVaV91{z;PgKo>V9`rTN{$VV0>Sh@=he*nbI8k2Il^S;)kP4p
zt1b?YYgQJy(9)h01!SuWkfT#mn+Zej#7vjp!N`(6R2LTZPEpXdk@uX;*X9<l#ARzE
zM8-xfRhgLpmvQkuZPU$n;9U#&b)D<*-YUY7LLzwaK*B`(U)#tl%YVR%Hyp-nCx>Fj
z`RHz5f4ArtT61(|=8%;|c5||}Iz0^)ceb?z+x(0IgF>p+oiSC4^v;i0NlEG50NsP^
zu_{bmaNs+w^JzJ0f4$H9hV)D~pU&3E;r?yb?@gyx&wf?E5pFE!T#-Nz+97+H<t^^4
zTD$ZA#oSv)Rk^p}zP5mbfV7kdNGsh42uMqJw{#;ZEv+Ek4bt5q-Klh=ba!)Z-*=xK
zU(Prm_ZoayV~r`xIp^~{|2wYhca6p=5WvW7E9>>G-SVIRjT%y+fztW^_8R*lr|(E!
z?eTTGZ%9+%;jM26iE(MPxBo7B&p0*Zye%b^=(P<FnCU6@QaVf#;Dvzbl+?RTyCE_>
z9D^bvHEYZy_2+Ai`&(jpv3EU5;~fJ=I4Qh<&jOHpaW0RLW!miz#G**CTWbp=Gc(_Z
zZxrCJhw=PzJoo*0P_^QEk+g4{BF9Q}WXHUcizs2nN0BVH`Z=<#cIuTv01gvat|va%
zsJYeD6-^Hattjs4ljtlAl2;mU+nHZo-0>xOudDlf|H1XUcRq@0YC+c|KQ~h6?v440
z2)k{K6-AK2aad!2iGQM{qGIB9eF{eG)Db%B4eywo>X3^2&XHBo46zdKw~KTawEqT2
zS%dtTIX`k@<CM9bXH4R|+!b?+U(=B>5we_q8EMnk*LOKCHh_I2QqQx#QW8896<D5*
z43H*YsASS&Z`zt2ftm8aqjPL==|x@LCl)p~x4?jVB0F<U{fgVL-)CdEgn0#tAzz}D
zR*7qWoI-q;M|4zj^8D;94fhq#ltJUC)4-qFeKEWQ6@5Qm<;BLT8X6hhqm+9=e!jP_
zG5sX*H6C3P?3%$-p3{_`<VnXcr$_PEPlvhqzoZ9B5w>z<AgJu_kd+w?bdCkwe*c`*
zHv{61cvcIvgwc|EU--Xu8NV}B<lLYZ|4>{m{iyE@r?zK_?WXPjK!OyTa&vf*$v3$M
zJZ5z>a|R1;?e^UVkD}my746niQ&TJ1_7_f9i3w}X(qW8U!_ep&@@BZp-XaiVwo=Bs
z_hzX9wmYC4T0@tUdm<{D+m#cxhK>>Nhvg^EwTZcbNO}MTrDIvHhSQ(Nl`{~M6#AUg
zx9QIF5fAnaOXWR#AWaGsM`80Yj-^G+fRahyrB^cvvxFQJ6Rb=X%@(;C{~>@3+ZUZ!
zK<DKyXPEMa4dnX#>_V?q5MJy#)n2Bo^FKd{iOIQZ9d;4-9U!y%`s~knUeHtQY_o`7
z>~hdiL<muwN*UV7i+@Q;F96TLFLX>?4RJXUVO7?OXs+h}gWgh?sQ))7+6$o)WYOdi
z-2h8Mz0#bta(Lck-%G#cZ^<-JSg@aQHKUl+^||GLz&|8q{tN%`v=J))$NqS_H%-@A
z`8Iv{{mYTn31jW&@1C{|4dLE8fXTt&@+lA<29s;1>^-g;`7=y$<uNdqOifKoIFWI1
zCcB3-YqK^s?+A6TDsP{0jx;Nxe@mqa<?JbW4LK|V0xib+vYMK_g5HaX#MsjRUE^uL
z#)V0E2$4ZxpduXJx$bw3bz!o9^(jck@c>RY0Ol~qy>ghP{ON+is?W&b)T(Gsx9#S!
z)od{o)?$4m@-o5`0~CQT_AZk}4HZ>&WIVI$&^9&(1_yV6y-{)eScGjc>6HobQxg;W
z3yJ2zmZnptg_V_`p;jCY67PDtqbUC*>lW7=Y;JCXs@OnpyI6Y;Lwgj+4+$G=Woc<w
z+w)~><AqwPO|1HAT}jXeFf%hFAtIe$_G_2Km??%|T-0iCp>ez0BnQ0%2eP7~EbQL!
zU;lh3Bm&k`@Ew4YKjG`dSY`+=Z_nHS70B)JFSd_j`Ovob8ZA$Um5P#KwhMQ2Ol&A@
z=@1>h{+j{WuMEPfugYv{AGTD~k(_hCy#*F|-4C8tBKrzGjAu2gvtM=o^eNXjHWIW#
zV0|6Wc(;VOcXuvy0g51e92}EBU*3?s$D9~sW}yQip$xbu$X|9G?(Kn9QdHC-PFr44
z_Tix!$y{uH@bfNG8m{{U^AB+A>96f8qjwJ}-;%bbWoANw@(E^&M_q|7Y>=$rq4E4B
z8C^tlGM8CQBUIc@Z7z241Hh%)`{IatLZ4}n3FreL%gtd@xJin+-n>ALx8=)YrsDy(
zLTpf(3&<98a&r9Z2E&LG#{@Pu@%Ac3LcT@bM_=+oEVneny8X-aVUw7rwoc!AXho6>
z6oHc2qrMM(udZM&80;StV{lz0`+$ESfvb_`s5wfKYiG7eLrsZkphpp!vOl@$Ye98R
z0X+Hz+5XZF4iuGBU@m57u#y=ntpJpWsCX~?1Xn~&S9DQ=Am;bzXdaLKw#jaDrJS=M
zr9n_N5N;*L(yrVMzC`N`*VoVDMR8f%`r}8EKT(aVf~PVcAQvPaI7C2RVfn6D`zE|o
zdWR{NR&N=7VwfTEC%fClAQr#r=??GJO20Tg<2XBwnk35hmoKQ6x`>FPYHFSEh_kn^
z7}Vmnx3dB>!)sPnzv$>e$0dD8MDg}NNi#t}!Y0^sP@0sx<y2C+>X`rkf_U70;}tOU
zYi1(iLr74VsHo&g;u-@((NjDuIH}nk@+&GL2_51WJiV4hdSLQ&IBJA8+v&1B>vjh8
z5qgZt*;$ZKcqKQrqT#=yACR&DEjEDQJQMtp@y;+llVxUR+HubIwY}iuV_;*;vmCxp
z#9gmvv<U{~*<PhVS-A*UA)4iHmz6R7<bD5nWrc!GNjeUJj*4UW?R?k3SV`l}B{bx9
zD-O3m&D97*DrZ3L@FYmvX_Ei3mPe~s5!vwiQO=qbjW_{gEDiUPw`b$GZ^H=MNq4xN
z>_DEg+LL0>pvfaCD$2<Gnuuo#xx$nL!RGiPlP=zYXvX7e@~~575-&V_1XiW+^Z{Mr
z+dup;xkOn023n4n7`fHeG0Dju;YA*Tf^O<A-@6kM^0Rf&8Ys@hfb--L2(!TQGHY!{
z6`qItyL6|!^A6VdO*$G~;Fw1Y(5kMX0t5wh4>g?2cM+j>w<|xEkn9Tz3gWP^MkPs$
zvI0({o4fnmQEr*Cgd+bUo3-^m-ssB8A45F_oKO(N7HQS_3Z&{AW?f3J?~S~orxF-P
zv;HN1etr(V5A&ki|Im3bDS{AN_Pr(Ga~v<2w7FTz_49-H62hkLQO$bfpun4&hveVx
zwnv)&Q+zh)%#Mji56b3V8D`yf&T04yl~mlllWY)Om|16v{_q**1O5-+o<6|(8;JWQ
zFef@F#z$<DaC|4!l%_K6JJO@skd#*>R9go;jC0oN+D7k>-FJ8Q(PBY-@8GbKz_gq2
zn#h=0e|g0!-=85i;VH$4277W<g4z@4;VLRBmI*23l{{eOt{@{*fj7O=k_uar;4vJp
zn3#8>Z2f;Fvp%lLNJ^~S+^<uu@*KBBHrdGXd$p*uIwQO>C-}|@;BrLCubI9{6Nfk^
zRP(xS@+r~(8XunuwKp^S*hV=}qfbVAg2-fbw$|9_{3!1p&?<xT^7C<-t&H9I=~)?z
zN^-kLbc1DX`6;Cc3v+X!u482)jEy<U>NmOLvD3Z2S=KVt{0d+oa)R(fFzpVW*79ZQ
z#aZImceR<#l(x50$_o+vG4Ek}3pkW0+LQUpzq@sgmaK1L^@OK;da2CjYrdHun;~<m
z<6iScieX}73+S=z@_kP`tuHAV3=|KXndNqJa)J%YaCMY#je>;PGuA)4tyAVU2S|rF
zeF7p_PZcHf54xi$ba=b3kWw(6t-6Z{>nh=G#>c8cL!CD4!)B?qJ>B#q9_ckJz4NT!
zLN~o!G%f1e<OKsGqe4{8*n?%g2*A3a;F)n-4!kHo<Fz?z&g`9!{)~Wne44;BZ<z00
zHmYyu|D}#?-+Xc@Jnip|$ESV`=E-)HL_D6Qfe^RH4tiYN&aOoz`$5^Au3E_k2wu;y
zS1uo4WM*9t4fD{^)#OwgPyLEDuE4im?O624)}*MpZ`302BG0>JUu}rb_OP@8XW+*9
zw+8RHlJxv!cl%`bLyek)8*i>N1!qD+ir~_Vxz7X!1|c^!7J{$G4pyG;ZP0^0v{&(}
z=Bx;dJ_5Fbzx@0zrqRb8ZyN}k2BXY33GneLIHdv32w!Qv?e5AxrvGHN=k63KkCl~l
zbI-#0;mx~w_x+`H{`>w*j>>BdxJ_rvW@rpYeDrc1sS1W|v+>LpQ|vCQpCf;+oyURz
zo<g78eQw`^BLg(q;!z9-m!{;Lou3pG{uc76iOy~50N3Ir$t!lq>Wt0(q^GB6*H`xY
zC(VR#)OCa9<B0BZJTBDjfY_*{TGP`Ncru{=)nDDAgCQ5I9-**Gh(Sq=CFZ=@#51o7
zz3}ik^+ubY!#ej=y>PIw5;z=N^j5gHw!@NUEQRBYq)yv-m%4`UPmH7?cwN2mCFyH0
z+I2vB2-0xjI(g_2{fe}FiQObhwPP7;GV`|jwF>iS7rQ-<CVrw3^RjbD354lDk{g&I
z!=7(8|F(w9_S*e=nnvDRks*=0yWcsOa0>mn)&E~hAW~Oi$Iuc~-d_dat6;~N&xX95
zD<-;21Y1i&lub>Jd@Y7s?C~Yb_mt?`rG3zx@9H2nPewDKKpa>ckLlb-iq#dyV?x-x
zMi(6&pInR@=7X63eo%X`>xI*4Qo&i2u7=y}nE9p>t(tG8GzNwy5qtTnoDhMWd1<B}
z2|OB0Tu!&QhDu+j*dk0@;<m7k%w2P3W*SHai^SlDfk=I((oImg>r^D1n795^t<rcb
zxaOpCdE2}bhWNgIk1uFd1Gk?h@4e9ejWOOms-eaySfboFQN0G@)~~z$_!vahLoWLX
zlTThfLkemalM+>LB7GJg3E5f&$$5O!lk90>Z)8Vh9end?*SlV1K6m|bwzkYQZ@!Tq
zWjlf1(0PJ(<Z`>~lMMu8jYiro4<ReDkFuKzpIoFcBWkFf&hIhI<BjqR6AiVK3*{*?
zw2BBL91m{?N!9R<UHIEK&rvjXw3Pa6%ZehJl=HJY4ZU{tuK>{?EiND*ai8Nays=G6
z-W4ma(lb*(I!TP*BNlTK{1zKa)M#;x>?mEX1CJv^-=<x(0x=8@Qi%)#YhFu^a%}Jm
zI_%7q!#k60x>KH6Vzi6OHy@e67rHF~=mrE-6zw{)O=d;~L1{hH`yOX|?$;d)l;6T?
zY1~>`2WmooHTZuiR$g%pla7gnEF`i{)attaghk%ElKozg6w%~SQ?R=wmw4KC3oCD7
z8j=95XXgq}PGdImyZn0E(I(r?r(@34rp32Mzc)61d?sl+KXe_6|Hhz&4}JaV*6i>~
z$wdvNQIq?{+K>W^g8kJ=^uG0k>%D~Co3585bPsuBFC7^@5d`!xK4F}Hc=yikf*GwU
zx2%|@zc@$S6vD|ouFtO@jE?B13?~6#B&}D4?M>`mesOM|dJRfx!A%zCLi>e<Q$sWc
z24WoFC-LUq67BC|q$`;b4@Fm$?j*iN$29V=@y*UilRa7fx-IoJTJ9+}_CQyk@h*R1
z%IB20IAOp?xCB*wc=f%}`2wCaczC(yyfPUdUct;ttC892OQ`7k_hRDR`i2JORbD<n
z0xwoKez1xlr~Z=vEhMxK@g>`dRz6&I-$Gdh-@nhOzY>g>Te$vsc6J6Y7-brn%9GEL
z|B>aVXsGzeUp1S?|GRMd@$b=WSrdRRK6eM-vcQWU)YN#fcsy>zQrSVGVq%L%<eLvr
zPzoG(#n}6v(36qn<)nO%k8WLzdAi~g6!fDYGg0g7_zE&V(m`Np=>b6FM7u4g>rFF1
zyn^`)Ed>)BL$<9qGu5*|aJv;3zyGLe<DwN+tbMKm9)Pazc|Md);o+rUQ$7d_<Da`@
zZ+yguc5d23`}Fr_G&{}@W@-gN!Mw^sY`zHjs?8Z8Sl5-8<HG*lyfEQ2@A}_m9JsR9
z#`?T05u~+SFg`N@dsFCPWN=@hFrKQ|o#U+p+Dct&ZG+-U*4BQvG#{VuKLV*&TfWj&
z%+$|pYz%7j;Wm@W5n)u$e@K{q{|re;ROVqSv#s%~G#YGuBcn>Zbdg@{PoLWR@{dC2
zMAIHTc<}2tGq@n8UAa_CBO{}ZhNx}nk_%Oozt1}}ekkXOicCD06UN=!+heq|%axzn
zWJ8>t`->S?tRd$2_3M|)C<mYiIt$ksJX=I*9~TP@Ys#tC6Q4YK_d>sr-|MjQddv%6
z7Rs7l6B`+GbkZBvn_~M}6M>k|eW5t;tx~xX%MpG#%FM5cccr$@BIra8Ev&L^L@!#@
zlv-R|2V&8mJ(X7&?dp1OdKe#0HHi@9b|8{oq}f!VqgG|6=6L&)&@BD?_wo!Md1qnj
zSlw)YDXH*NLLc_|>u*OcSZ6)~2uKKwxNg+cG^J%sb*3t;^z=XcY8A~jP|gYPS^{$^
z4-jjWEPV_h071Jp@6#_tW#yBeiXcAn`wM&vlu6CA_n!3LYz5!>!)L{LcdyRd^yz1*
z*Kb&DW0~!Jn;1@t$4qx#z+;<xwFbxWTu1cO%k=qYEiE*u|1HO1FIh(QL`q80eLg8&
z`UNp7Gc$a{P$mF&Y+H+t;>n#ex)0~)zU=k1V%g)rnvu~V72W*7Ltl5z8Zi?K3-@b^
zyNP3jpQX-nDXrL2hO42H#h8x0d;h3({@U)|g5%?Hk~@ie`+A=ww&X++sSFGh08seA
zq|x<wDIg+I>t5|@GYe{S5gNrCkd0_Q^bTmYM3K@S3R!?Zyy^vS=$5s*<L=q9_4O9=
z|H_-VbEo+h2cZ|TE&k^}Z;QN&|3~u0fB)MN_5Y18Nc$4dYvrUODwLU@|GgCz+V?rs
z|M?!^Up}K01nsUqFMkMcQCL;=k(kupr57fy9T|J#owJ$+{09q7D23K{+}&OW{I6IH
z_;devzT5vlU&-06Q0fPGV1_(G#(w(rZ1U6H&$OHx!NTd+Tk3cAk{?Fn!qpF~89SJK
z;Nx0b%edT*8tCi8%flnTZC;1n)M!2bcRhq9e_H-IILP;N^7oMT=hAR7ejQEMt3yED
zv9P-T+)dB=v9tDCM!F~&wu^9lw<X3~52o*PLE9c5r&^p@Z?s#PpN|auAyd}9{r#$&
zBQlXwa*782Tj|sf9g`d=c)IzSxpD`EXWP?0qejw-N=n~u>AAV<M`wA0FVHZsu|=h%
zxZQTxqdZXopq$KRlv-a8YqXIYZx{A06YjoWCiUXr_&%#;A-q6<fne<D>e~8xSxjG5
zK+!-Fmx{dlL_mJp%uS4rw)WAI!B%Wp=l=910ctssUaR(z(9@TIMA)eCC{C9Y9``^O
z_(8p4s#t`D6Y=)xOSA1CIcx7*s_d?nvWAUKTPsV=`}!nqUFIDsLn1V09^s?p78M<$
z9hoMgu5Jpbh}tiDwVNAipZ7HFMaQJKK46l20>gfI=t3<h#Ou~p*#xu8U%5=k#~~X8
z8=6g_e0KU;l9DX`492`IJp*HJT+Kh6ciPbUA`V0xU#ta*zt`8#;B`Cs<IrZ0N=1Tz
zQUB3R?Bh}{Qz!ebpOGck+{}y^DBQWY$f#G=f15@_$38t%*1&W!Uc&hb5}!6F_V1fF
zQVZkEmu+gxSeF#dUuh2F-)ZRY`=y)EaOfvVnwh!lyo$Mqaj6l5%2rioJyC9N4ijzZ
zjQN1LwOhq(8pRe?ZoGdO%hn9f`;P%E9r^uPgEJwZIJ?Kpv05I51(d`>u3#;4!$#c3
z_wQ{0O~iTjXW3D?yctwG51TS`bFC+lh_A3)6fptI!n_}bo`sEpA-j)gZ8VtJH_*Ld
zECpqYhOla|=IdJq3kwU1i1m$?UxsAG{`A-|W-0zE$vFic?84bIqus{D*?8Vnv)eWX
z)VB;|!Br#(y3E>Nm#YJ&ID<zV$=_JZWJ?im8^4&9T}Xd~hR-_uiP1Nx)~&PS%4=qf
z>nZk`{!<EpbXlXm7^Y^cuQ9khR2=ILZO5w&y6oAaxEt%nar)F*(9-~Ev3F>Fbm&8L
zLb%=HQf&RzbBxD#ASV={im9XR0Q3vEWr1R#pud{bJEWol7c%}NB%Ez8wgL_gPW49~
zY@eGn7yy@e%-1r0jk_i_^=3cfk{SP0AE(Md{NDa0c)ZP(t7ct&3;;LKk{69k*zorD
zDW)FN6>n{=a~!@Z;e|1ksHk6PVM+=~rNO|~!!n-wHM@(5uE+KjEGG`j<Gz-#Qzwmu
z^6|EIuU}7i^3UH@7+?O#HOWVr9Vsf}_qXvSfg@ONweq@EQrOtkgoY~DW<u`6TdSRf
zhscB)_Q$C1j#TURI%>xkM=r-31`bkL0VR`Bk}fb-<BC)GPA_P=<U<9o{KWC;>IB`8
z%v-5wba>}*<99EBJOsTxbw~;DIBWmN?JO|}bhIJLwY9&5!kN*-Q$$_;+2YOY0ZngL
z*Bd)K2*2dmA``|zL!0IPZC@K$`XkhV;BiQw{cs#?n5N3xom|eH`Vy3slujX(*4@1^
z)BSEJD&`*7zn#upb)J@1>ncOq=%}1O8ryumPByMaLTmPWvG?$+OSHuJ`Asgz+zhkG
zg2a*1(_TbAi)?6cg)A+0BL#7BHO<uftAF5A=SZ3ZGaq1ia4@iwczR6>SG`zI&31#Y
zGmT9)URB;6Z*G`AL3&bFI^x16cjxF49^PcgrXwmFo~QY@uV<=ShX;GdszeKLqktA_
zV}1Q_|M*wU@NnGPDb^Y>V}F18sO7F$`&0m{t7)0hCrQWCr<j-?SAX0w%esek1f04k
z@Q?j>LVQq&mUXgvqaPg){|*WXqNk!FvS8F*zDNWt$eG(CWZbrME{w`JNGUPi>)^|(
zW>V=}i+O+l`X-)jhsfkjtsn<!#CtZIOFdyp$>UNikDGO_qK3zZJa#3)<+z#Y{ndol
zv$i|swyRS1E*A-9*O*Q0cNzlv+%jSO@!@Swwa?jd=P93pYr@jfO4ExNfmFL!-z=#1
zOyoD7OYg!3sGxuXm)z&K1a7+sPh1%hFjHl6J@4wk)dj$Q&>O*&`|(4cCAH!LbU$a#
zZxlN1`rLiAuSn!Y{J-sO2w7<E6sJ-UjPHJsm8Gyo{wj)@g-od1H#D3%x_-8OxO&Yo
zZcC~mPkXSQE{&B8efw;=yMM}Ol2~Sb7k5=l6&EfMdzO&Ix+-mrRctzC?w*hNaX*};
zELdw{sNw7HKh8I_3$mRxxltZ2w3@npXYAt#;v!;VSvl3(`xv_?ygBwpt+QNcFP;_R
zFf0%8k&|bdbxgIl3H$myOi|14ocQE&4&WQN<rM|l`Svjx@d)(i_)n)XW-+m_X6toM
zw^THrxUGEUBY_42#K;V^v`5E>sA#i&pH^d;R*{epR{pL+O&orU@PL2CnO>Wv>_&CV
z*TE13i&G8DL&58|#k*2OkzyLJ=h-MJ)l|;?bz!F1cdY(FU45;g>kz*9^4;e7x-f~j
zv(C7u9*k6u*Epnt^73F=`d++Bk)`HtP_E;4)%KI}+cs~78sRf~8k!~x!M*oEGH%CH
z2$vX|IOh**%#<D^(mR|ruTNAP=jY{DVz)X6&+<hN5_4a%UF4k?Avic5I_>RQC@7HE
zhFz8yotlV8(Y?FOU1vOM5oD8&`y<xa+S0e41navX*OfGBMxfUeZa;>JPovX1?Yf@u
zTS-a1ADeJcqp4Th;m<OT+j;^-VEfCavZ&WbxMvz*M0QDM&b5Zzyc-(rAC{U<LrQ;+
zd3Yxp_sk<bGjkM(C^e@JCA#Eht(X|-=pYLVlXfbha1z3d2nbDzU0ydgG(2BeB(x)D
zL`ec_K$Hiq)*q(qv?a``ZPV$fCQ2!**-E|pwf95Buy8P&2(8`5iB8@~<F+V9)WwTv
z@mxbDH~<mw3B4<*Uz`1OO=h#i<aKqDW~9`|SQl<-X@Qd<K-991$3VcY7Iwin^huwT
zR7Wn8Z~l8n>@|i1<YQp#+{A>cSLwzVyKF#;o@s{1AB8X!g>^eB1qH9nu)mCO(`u(>
z{h~IGmH1US)gIzEQT-YARiL<gDKdD(pWzpfvF6Xeu^dRtS<9xyF0+r*7vLe3jF4z&
zcALsSI6x~~l@e@a1Vd?^<8!#>8r}6?uX>YE((E#td=&c_PA`boq#-ES3*R0L23Rdn
zMXCU|dT^{_Xm0MYKY}-4au3y+m6k>rr>e^K*O(#1pOa_Tg98oe1dM>|zT(;Y{3T~T
zIO+Kv)Kt0JKfk-Xp+Lhk+)Kd!6$X0amKd}mp)DRh89whUGzr|sr}Yd!7UpL-FANb;
z98P!BF=RKl3rRX1KcA+g<{X*s6(Jh;|1OXUcgU!cw3dVfHxJL>jsjC<K64~r#xZAg
zn}g{I4;SF!DQZG~NTq)?eY&*RN5<}8>rrFJU6HNXD$E8$_926{kV<@)KNB}Me)plE
zoYc&e$sHSWxJG#ld+R1iS1jvQVK+CPi}3RDz6Ji)%H5eSD6en#7O#J{dZceBh1$e2
z!_azo-16sCF|io7yZa57qh-UV_|I<N95cy%h0e`X6l7&9@l6T}vs7fxsbHjL*C%K8
ziz8Oc2O0dl(3yet7VPa>jjryia|M2W&USV&mDqw(ikd(|@~fltB7vba|8iuH*bi2{
zZJ4_R1|sdu1$A{v2t{lZYN@EI;`2WpNVf*^yg<u+kO7IP27k1D%sBoq9v;ddO3|Zi
z3=49^U7Z>F;IZ@z{b&%*VzSN?6g=*}xv_oy-r{Ef&VskkaAS+zYYtWM%;DO%m2_0%
z$*}9{tE($uwYnW2L2NDAPH|^-gk1O%W|CgIc#OnKd{vQIM<^x+Mq%Mi@b;Ke(fpbW
ztE=l3^pH!NmVL#kt&$RbYiURI^)p|%*!Ei$I=CcWeNqZ;2QyKP-MPA;px`FG{B~kV
z69uS%X=pa@UW1MMk4BBd{`Do}7Wp{U4mr6H8u4svB{C6nU)zL)x;i&G`TE9j@7X%9
zdUiEbZ}57xuo7^83KPrKNLdg5hb=*9U;<%0O0u%9Co_oo%6C$NfYB}yEQ$5(I}*~t
z&TJTbdaasERy(n{@pve>!6aSHp5E>4<Viw2K&EJ)W7jV(2`I@0i>|u5Jj{pB9;hWR
zp0#j;aUG-!XQa(!bizSFqUyD-7S#c{>sCQ9hWo-bzTfV&DW2c(<L=SDd{^<o_f7Vf
zA6+~tQMZ}j)K;gr`ov5aQRRxRVOv-v<ra>DuI!kR7gao!h6NoD9^#NCwmm+cQk!)#
zSw=bhMtZ*}@XME}X-=SZxSj2h9;}nOc0lEcjfq+3aDA{QqxblTSXoWUWw`@ut1e}J
zr+d_2p8iKoO=ftSjhNU-%^_uc4Bt#kZk~y9Sc#mxJpCu7=UB&o46baCR(i~;AMz15
zm4^2qI}YY=1yg=Q<2uT$RW5NTN12cFboaoI1WL2Q)+H45PNCUVUS1fLXgb~^AKre@
z&^UzggYios`XtP3!HnvUmBv?4bpig$AI)I<ua88Y$=Zhqs6v?&0!g}HLR{xyIa#-w
zb8M`}?4oZY5cA&A+Q9}L9UDZv!1;||+&SNuJBR#&;b?X(+UKh9khq7$!(^`tT%V9+
zP)38ixB)oe1IJG;hF8dhO-xOiT$F5JmR(sxh)}ejeA9k+&CTaDQZY);$LF0?B1b4z
zS@aFZ>g$2Yfid(ay(jO6vLuu9ehe+_KFFpr-+B9QS3~iwWb6du!G)Kz5xkh+#6kq^
znkD-OW#ydG(vUNT*bmYoqc8JgRK3tjWrn3o(CDbCVJPyFsn%dvpb6RsK#M;t()4HO
zf%n}mZnV1)x3pFa9O2~G_s={;(fkaKkB+>r1Z!$ce1&|G!JUwW9Ud+#66*d0naAzq
zY`v`W?3#t8932o2*Sx=dPg^F<Od$Ws?dHmj1Vm^G5)xPKz3iaPmP9ECcWhVY%Hn}8
zu7@v5tL_G^GBc<8OS>-BvU7Mk;Z{&!V}ErIAQ+xK)rBl3-8VsjffVf0ct*SBANy^N
z5PyKn7zj2HPPdngfrZI2-J0id%m3%TLozk*&O}Xs6&rr!Mwzjwru#sq$G|b$^R5%H
z_M&Mv0803JIok#ZZK;C6u)My$e+`?erw{OkJf3=ytQBPWRQu$-;^CsCS?WxP$Vf?H
z9{ywlJ+;|3>3@hjaOe8Zzj*nQmWB)`d5@=$(=Ml5H~B9-A^sBgveZ-nt|(0}$*(}e
zSM$)P2_g4+4^5#;g`%)<A@m^2*<trX{6I`VuhIwxG65NW8EI*)_wQr;{Y9jun=<Pj
zE9sHx8f`ADFNTnSFG%R(8ri%fl*{qvPYI@f?Y>gf_wT|_GyZ4<WPtxC1Ez2I5#2Xi
zrqiJz37Dky^b<qtx)6k7J*anZcvu_)P2rzEFPWu6s9$w?D5<99P2*gT4h?;QS(dr8
ze>B5#uz&1Fll7Msea~pAsIZ7?RiqRfuk>mH1LKz2v#VG6Bs@khQe*x6PCBLkp2ciI
z84vfk3auf(&W-MTB;ak%uBo2&gty;hwf6V+&co6I4<A=0Mvd+$)_XSg^f%L&(13TB
zTgImA|ClY2k)?^A34;?_U%!6cOPcjRcRJ^Dqh`Z@ZG7}9o`saAn4Z9a6&1>c;+SFG
z`G2I&<70dHRR7HistAb7ojI@vOUtagdU}5S-j-9+I^CJ&GSibin0|P8`|+bLW2__`
zarkIVYQ@GU*@0nv>jd7ns4#g~r>K2_00z;np<zJRv0E7r{-wbgQsPK(2}BA6(_;Kx
z8ylpnD=(_t0OdHiApPQFu(7dTb<x0aA|a(oWGY_n=69<WgM*EIvYBUTv|Mbo8wwMJ
z)S@`tcxswFe0<ckylgFb^^}YpT>}oo+n=)&A#Bs+9jPDh@SxDl^D4M*Sh5dUCjg{0
zwWMH$aA`&g6BE<c!RGv|<oOeW11sC~(RJ<NLHe<GKHno1yp$}TVxiN$>H{Y_Gg}$A
z$Ntf<-n^8ahH!Gq=MSW$-<FmHH2jhx|Hgo`%xta})$MoNguIN*r?sb;pgD%sJPj39
zJPI2cD$2Xnc)_N`oL6oc?KzISf$eQCF9=YXhjyEuu~j5AY&#839-3}`{D)w;I3h4G
zA$*R%cO`_Z@x3rRTY7l~-TWM_QS_}a4$YWU`J!5o>%|xIM!w0Yy8glBrum;3tWF<4
znr=O(-4C#;dLH3Av;5oyFE*-kBh$-E;Kz>*D3O%2A3uv#j41wUr8|Nq69D^H3JSTh
z%r&xD%$9exL4LKB<>kmwq6Y<TuCGUbcQy5~ZB%Bj+T+kdz&+~w{xte+T>;CR*fq%q
zs}}}7lkby-#36BGzJbPYZ7l@P91{cEr{BMeW4fse=W)s@`kd0n`f*-fp19NTy=l-T
zUR~JN@4uEi2(T0P3?o5UlppYU$cyI_03!JA?jB;}*yo_p(-Kl)A!EA!y?Lfov^*^y
z@%on_MgQJV|G`0Eqx<3T%43~&ACj&*$98J!dCFw0XHUT!-!WfYmKgvUWV1@re9YWy
z;^LhwS3X#=vFow1e0@jl#_Li+VN9Q;)^dw!!E=r=9|@jw{=8^5=3oCj=P|oXKTX8U
z)Fs5kUbstZ%r-)<8K{Amw-R9u+m?FDuhro0_efZ&P@}E#y|}2YwG3V`Z??3$!1ysl
ztjv^}^NbxBLNS?|pHX|eVBt!eUw?J&8<d^cQTM%p0mwDj&z{9B@>0_A91k?TVTUCZ
zqIIszDH$qw#x<^ilKxR+0y`{L)8k@5kf4pujgn@MSYA^zG}L3gh16{NJJsmlKhJJd
zxtsd2Lh4uO!y_UEA5Y1>`o2g(=IRzDZ5v<VaE)&_)d-spH@nM$lbE8cAE6}gVVnF-
z?{ash;rFoF8Lg_Snwr1EmL*yueO78=d%t8n`(jvDR!6JIi5>&qF|oXc24SUxf@{kY
zsBTS`h%G$&a2ea!DOT{Hjtqv))eJZHCE8A-^`V%YT!cGc>%#BNe|-robtVt9fog$O
zYUmvtOv@TB0PWIA{yF3st2vqhy&WSx==ONER21{p>FA8#o!`Rox(7tTwAiK!+E9ny
zcZ)h(>-J8pW38&<#j3IFan~r0-QY|t$TJhK6r#?X$ZH);rV;WH8oCV%96^6@ezxw<
zt|8Qm{uJw+m94NUIt*9CO!5og)P_CoDz{6N(kAkUTzSF!WDofL;)91qerZ-MUZx=W
zh3?3YufstL1vcall9SS-<JZf)U%MnFG}_hIHN(ay@^PTiURx_fLe~1TjZ^#)QMFV2
z{d@Nd`Ni$Odb};+VPVPbx{aSMov%BdR(ewF4@_wJ!{_ktuAi)I1i*oYq~3X{LeQ-$
zhszFgB^G)U5iu7f052dqLaW{`D>qkEMfA7F-?+cx-mojt<2v27v^!hltqdT8;he)&
zn@)LjNo?+Uc>7&wzaFDns~SGNBjD=ldf|3F$|TEXfdt_*OUuiLhZ-ESvxjrn2wOT5
zE~|6!@u%sfIqY&fZBOx;J&g0K?bxar6%(IFL_#V+LUy#V<M6n#lQc)Upq|DXP>g}I
zoBl|XyVI86#^yz3n`c74tDDAbIbOt%AJh<em-f(|DSPnKHRs*!5Z}(4k89^-7ak!6
zu5eVT)|egFb393I`eH!P-&vC=oD&3vrJP3gp_Q$)eKM@HplK9|3FUU#dFOULj(s58
z)C|A0$sh=7Vi^BXNX0C1eu6ZDsbhlZ;i}%AuD`1=n@RqlrB#%YQf_h`N)<7?*ZUb4
zjR{4);^_CL6O;{adV2@Pth*L;O02c=3?(JECy6wb3N_z}J0T)=H%F2NVW0IUaUC06
z9Y*hiDvu{QJp5Uu16KF0*Sc=|)G#ZzDEtNCPKT%poN0lH1rzhMLw$b!RF~5xwlIT?
zzo4P7a=hp@!UO6+P`iYf6tY$ozNy()6BY%x!jX|*X|lN!=3i1h(V_W9H*xIt9OGDj
z_af07)w;oHN7z;1`N`MMd%BA=Evr_f3w-!IOd8qMby7*#7(`zlJwe!vR$*Gr$|6rU
zorMK3Oc(QMMbc5^Tg+}>Xg&X&TzKr3ne)2gc<=Vd4>1sy!i1MKdDWiBc+@2E)gITk
zFY3MJJ^)SrnKwp&i)&*oLx8`rI~#W9G9M~6|0_aNPE;mV3I`J#Ls(p>B@mJS>-A$t
z7)jBoE}R}s>QP5-aJ$Pw0G74-{Jl!%;lk@O!#+2>TW-!3swwXR$(|l+*>J|RG`mw1
zB6wJ`SvpS3N8BbmQ`4Gq_sI(gV1#tPKp2@g`@8GLB@x_jX5LZaYp^<~mhmGEo-e|N
z8^@c`)8ZfAzHK%w9IP7&*XwLb7S1<R{4**dVK_SP;`j&WPaJMo46FUhj}$9nt)itR
zR%b;ihgj8{lINx?y7V`;Qi_W1ewS6N-0khY0B~sI+{iY{7&uJw+`d|Dy@XwXr?B7<
zAGkV(OA(Vvg4*-*@-Q*3QX7>NZ**eo!-)A7JMkk@Q&RqLyN}GeR84QikO<=tbGH4N
z3h6Z#35Q0sD?6;Zy1Mu=K0I@tA(3kv{8NIqju*;)_+XQ`RH@x)X>Ttne{}kd9gJjW
z$3rm^KtQ{D<K3Y;&17fCW{$Wz6SFoxuAQrOXX-xm<qhP!fhEy<m?=Op6%pdIzSQ%p
zjiZ=yAiWam`opxeBYE|99CT6&@`?batB6+PB6y4)RO2>IaU^mszi&M_XAW_h?d=a|
z&uEM?vICGt^^*CXprD0Eg<BKtG8%qI3F`jynhe><TocF1t~Tax*Bf|}o{1<!p9sDG
zU^RVS&c-0i!NL3^76e2jw}$kbGg1r<1qIJBg|&0mA>%ISbBdD?;1+q#*_Lt4XzW_=
zn&;iv&x;9ysXQfylIV`$%Ikwno#~ShW1q|`z4M)>Dqmk$k0@iFDSCQ(e1eV0xF`(k
z)vU6Jpz?AFP`s9ZXO0vjG&LWeI5XHhLCH1g9!oc;l(f^pEO*$)u-x(?{nT;8NlioJ
zxHaW9_7h;KkU6AUI^i+YOgf=V8hngf*VlIh<DV3d6`VgroTcL)=W#lMAtmQQqa$)^
z(kt=N(cb-6doK@$^YLu|x-S|GHSa<~*PP|#i>u@!&2}_Av;4F)KL_m1nHonpMC{b9
zVB(wJ>1dDV_UCV8aqNSM0jtWE`qEMxD87MSTT*7<99=%`Xdw`E1VPaNCn4l<HSEKU
zAHy`VEyRBtrb{zlTFO|tJ<+VsT9Kp^V#^is0mt-(9oZ_YC`@A_y5T|-y5)AYBWC^4
zsvnaJk%aG^NH~8B>n%q^V}?q=>6%|bIHvh`X=$p|oKV#l3k$1_vVO~w{mw1c4qxzF
zu3ymdjThd6=5&HFkPpA$Zr%^-k_D4b=l*(>s0FA<#5#uEI?mS?CP+3?KKcYnuPL3<
z^Yc-TE_Y#YM6fHG^|Mu2LCDSP@Q;y9n4WHvqZ=KK3l0H}hP-_7<!%AX@85a_+X)?Y
zKKYY-<GKuXhMKTb@*){8yk_bgb;(WU!=D-*9lf=c>18q$o2GeP6&n#sG17p*fIUFx
zii&fOwB;gmU!1IxRS9aK@V_46gC|8-(C4z4&nY1xAy#T07j7J`dMJI=DY{pSQI3v*
zfsJ#kW4(@g{PU&O0!<f<tjWBRUp@qEdWGv_@UI#sFiqDLzw)TLU5eY-2*Avmm|}-p
z<Q4>L=g7<7L~Xkd_=J3XOAz@GX(%4>Yc_=PSy>I5p%uv}jv;sf_rrXy7MnOqM;w#?
z>nB_6y@P|Da~FbDWYA4b1rv_T?z?f?Y`x8<%zd1bgw(sS_Ik+Ra*qJ&Wd((aW!<_H
zvxxBTzs5!gS%2vtc4#z;W0zZ427LKah%!w}PSwydk8>-Lm7o7?{%{8(n?Ie`Y_?Q_
zd~K%2<%!x0Xl@GXdeZLSR$0z=n(121Jd4`9@O5vxIjIcgs@z6FK@;G@Pbp`%KRQNH
z_^$B#H;aP8uadfZ<<7#ym)aorBA!PJ3xj6CVfT#G3XbxhWvg73g*k(1nUDwdczS)f
zL;GlPDXr1@Sa9_mup8R9I2g|`FfclV`yt7ToV;nWY_p5FaCA>+lA~;u0PV8TMi;OZ
z8B{0Lt>h~^tefUbrdRbY=FahF&h~p^1_oFfgbi>IA|VCVSx2+M*6S;O2MC8ZKE|zW
z$-pH0*8M@QmX9s(u<UQ+W)eC{a|H!^b2>kt>UUIy$hzsdsfmdZA!zm3fMki_gFq@*
z$VJ)e)`6?@>t6HFLdcljmQ)h&R6y$UZ4DeJC<aqxb33Jo+AQ@;Vn7b$TE7*fbZ~IM
ze8qJv0jj(4xJa!#$&AFwZ^f5OQF-Q7doCWhBEf^AptTghrBG{&i;9|>tjC~MK}B}1
zs#dP<2Y*+N8V=<mwg>ze5p%jYIN&i454W-JH?l+0eun=OsQ7d=G(xR^y}a((t`3Uq
z`a=4ftdbUAt6ODB2^D_yOAmPJl-e@x5$b7G=1b>fX0~ES0j5w+QL*M|kmITYhe3CE
z+1uBk1QB~*tk*qe;mr2fXwjiI<j#-`nE!<DKgxTRXJTxeMt0w+`cttIm-Wt~Q88Ha
zK2lvbo;quDwW{H)K=d={sN&-0$8QV34$e1wCBOfsi9}jZvg}yo-?L=Uq|DXjn!>YH
zZOSwoeM48$$6|4YBB0vE)F<}uPNILB-V3nC>n*311k9D&<HBh^=#g-5tv~+E`eXns
zL&h55%9H_DRfDRAhHsdBWw7j3BL&7(LbHIUD*hBG#zwQ<h;_tFYj6~lMi;CkYBQ<2
zIMBn*omx7G3=<MZ;U0oZO1*C1EsK#6g@{|jZ|+CR-pGh-C0^zdre+(ZD{-sK+1iaC
zgO)m_G}9YaLA5EL0=NfZi7Wzu`}*a!pWc#lO$?C{kr1d*n13d(qQK8fNhp>vZQZE+
z0S0Ez=^uo%|6+g$-{hU05_&W7tGsB4rayZ#u3vf`<Y9fsS=Hq<5`@+xvLj|(>84Jg
z9Q`KYqwmQ#;`)7c>-_A2+x1FzW<=spva2UCQKgEy#J$TysM%6}_jXafpndu40J+-i
zcN~^6TO3Nf0C2B6Ri~37X2kZ8>8og2b@fx?UXuKnp^7$pJm=0(VyC^er22%GS2UZE
zy-HfJm5E0Qrjty+>n$7;!VNs*Mb)5jOU+P^V*x?Q(Jo`Fy$$<#R)0Qcn<h-H=P6L&
z04Qxxw`8K0Cps!BD!Ob?G$A}ZW@N-*W#d@<@o8eh8aJGD$7h7#&=(vx`x+IFs9NS_
zb@3x3gKbw#TwY<?*tE8`wrWygtiw5>I;QRFA<^1i2h<v%N_5<1XP-2n#((fV@|)Vy
zYEeNu=;x^!Zud46TqW%*3U{hl*5T7OkL_9Tf6N8t7m}}+mcZ)uW$Dl!$rbPUIU&KV
zu_aehYI>dhrL$}Nov>uBJA^p%nn=d+H}n=gUQ<(3K0Y`wAs)_=&o^B>e_}+;d*Loq
zQo%8_N;zF=Nz!K})SeA%{2_h^4|;W7o{p2N_R+N-p$H0zSmu2+>d3hGXboj$C!oxW
zVm1y=OP&RN?Osjs6l`b!uYN=qLzmla<JRJ`3pUwQqA(IqKRfNGU$#vL5tL}iN0%Ub
zSR6kk@$R!HrJ^!0F(D+t`F$a(C)7?UBXhEEk(PFJdOLuxsd;mk|0$xV=#^{w+J=<@
z9iMLes#<)5VT=UD#kPfry0n!0W|{H&7xbu8;u({};;LW1^Dn~h(GinUk+v&_XJlo9
zO{v^2@p49%vZ3u%`qR<c4)W<F{>GHCdiWLI<z{o}oga;VNuD4fly3VG5m&~d#Hp@q
z0m*sk3SA?X?f&PJp`2e$u2E=gcyN1Zd{B;wh=65=?v38$bbxJ<pruLKYfIy^7ojxG
zlk{)wf<BX6k_#)dd`=oQJRc((*k%^c$PWMo;Y(3bOYT)k+j!2=nZ6##$Bc^`6bU7K
z$CY<*i1=D<;ndRDIOW4DU}za*%>+NyxVPOj(An8JI5^LFXx6$tX(ulC)%Ha}#iSo)
z>=#gnfObJwH`#ouG-{i?<q?`N^o<JI%I(=<z1MDg)_bf#`tP+rU<NYc(N1*nZy!#l
zvt1u02IQm1DT7Ws^G$A6x80C>iu%__{{@fdVY|S@zux2Ni+nA5b<V`_DCYL|{-1L|
z$0*Oq(Y`F~Hx^NaexnEa4bA4o#)Hx9usHm!!2(d%f{J$H(TxL-G3F_ET!B9QR@VsQ
zpC?!5(`>NUU79;C5e)cM{;W5QjChG42h0yB%=jY#@fQ{n5e2#eMiI?X(yth9KNnK2
zuv;v_RjBId1vYe8_g3ZP+#$$m<9B!0gdd5%GEg#YO@6ZK`EK$wYC90lZ$(A7rKKe#
z#6u&30q@~mqlt;LhfRvG$1{O?GcAqLoefqPEO}!z)YL_&nw}`0ZSTc<Us1vRM}fhb
z)F+}0K_KNj)IkHa3UX@Rk{tfR-)s&`OZ*Q#s-=_^WS$_X2J$#+lsBW{MA7|&GL>^b
zYxm$fvVL5dSy)&YWNLwmryJbCcB_8Ys%|)5G!s^BtJhiBpG@7zilcAvx7gt6BmfoS
zVpSJb%`Dbs#dM~@p2|X2Hfx5=jNj7VZ>v3zHooybXc+E7%b8~<Yu#?5qEuK06@B^4
zSAm{z^1-eEIC1k$3=xsv;L@Q1$HZt<acwQ99Xog9w!nYxICbe=KR-W?!<iDz3ySK1
zZZ$9%eEt6Y<L>XBi%1ldNAlzHW&IJehzUhc`hYD{{p$NN<#f#af}D_VRu-$Tz|TN;
zbaWXNmGknWXGhX@ulzNW-Opw=j@N@Ue<(lfaA@qV3~qY6e{cYLU>G@j?cOF$gsYkH
zQ~}+qvK6$z`-g{mMWxDpaCuejnz`VW!%Q$rrPiI>-{X0wh*L+U<B|J|T;i~RG%uT8
z>5iK<EFNB2KHi^@-Ipnwo3LATca1bEY7ABnol?&^Jr<v-R)X}xd|>~Za+PV>Yv4b&
zpN?RmqwB;!l@wOZI&LfVQMkXxVIF0<y*MLfs>|wTzWt#|3FYeEJ+tKBk#Pv^HIgGE
zEQ_-pk~(zh2bnP60+9k_Q2{bbN!~qe*cetEXTMoNW*isO7uYj!RIM`_?t#r3!7Hj^
zh7>OPuae$tPRpaCQ!PF_jz6o|94`-@hS}%`o6-YQ#R4EoYM>WaANL3O`9&3f?E*98
zbnktgJj4b;!_v6@>v&*hy?mK55&ky;Gd$qv=>X0XohQkyzHiTl^*5s7>3`$tPUp6Y
zcSEB{r-i}(+wGoCrN=(#ucVh<wa)kTYCz}<Ma*4`ZGLm}N7LSc7Kl^zG<2j}8Qpl@
z_io|DD|{LL?b{rq)rr5OwY9woMXXeYsPdcjwY3U6FA3etlyBJSprAS<efSETROKmk
zHtVSFmjb)(Pa1IQYB|8J{v*%iOMqw_C3hz(YEXM$mjn~BjxV2XO1kq$qO|cMt<>d!
zJ%YqUbvw03ykrQBvu+N18^^jwyA4Y4slkt!b@Yo!F%%>OD6l5$?akw#OoMbt>9KDZ
zk%71Q@R%;lV>2t`c&6-o%314rD$ApK9z1-YMzMI|C!7g_s;Fz1CzRA;Mfv${$<=Gm
zP;#Kj2F<<qBUDHLc~@m+EwjDdF+M)dV~Hm@qwyk{w-#g+H~*aB_Q$Ib%92LjJIz)E
zWBBJxQ>ahs!EPf-;LxAI`}q2BIO4Gcg>BrlgxO;StYaN0vC5d@RfY1VZO=EzE6s|P
z`(~i<gkQ0l48g*Ms7T36j3~GCegot44H*Utl!;Q=A6_vmFAw=W@gljn@H<OH^gst>
z>>6I|I{4gz=|Mo!sdJkXlMPpc_hXdS%9wbSohj=(gn!31nhv0l`W#7GU++4BjTwOs
z>yB6zLgn_Dz1p{+nO6yYj){4h-!J+}S1&m*NEEaQ&_RSGL*67=GOzG02;Ssm_D%YX
z33fb0{D;?dTP6GcK`%&KMY{t+LPE|CLm)~VH>?>W<HOgtw_h`Zu4}3r2WLmCGFwp<
zmnkTl47j$yr>1>tR1yQp)vbPU3pk}iqoY+|_Tln-Qz9ey2(6vrEw@`-=Q#eWZ8g%j
zP8~O1a76As@e3^@zCFI@(aY-`-LBgKcxq04_C%@9?W>AkZWmiJ3@bRFEr*0GUw}vZ
z^6O5?#K>Y;J2vm8kJ0cqv&^2MR0<f5yeSzhrhA5DP`~_cOBy(SoEo$o93}Q26Y?Gn
z*(%en9O7*KjUS&8(jkpEW<H^Rm@sY9-Y&HE?D0etOrrNJcbz5M@O%Yg89&7p^s^rg
zg7goaPCO=!5IyM~FIcdD&f!fHYfvw=2TfSiG>A$#L#TvV$~^Hj&|nss-NXBu!emtP
z4XGoiQkm;Ab;;-bR{Msun@8I30;=$5s%OEa=2w%w6s8G3Uo#lWdFDl@U29G%hgG7e
zlo5F>ss$HcIUi)y3*EjnV{zjtdQMsJWSW+a&YOIRv%LT&@^A)qt@=p3;PF2M{+;jO
zIb>AUxTB{B4elRxIQtrbUDg9#JUb|rEQH<Y66bd5&e5xuOR;h@Ya6?tm4F$}eU;a~
zv{Jv*ks^unjcTth={>l$Wvo-Z8_H4^sulwvNMM<el9kn+bc<q!h|vUcq!!YRe6U9A
zqTYY0WW9gOzm_a?Tlnp>^x^fTY-JCj+rY(@P#^4ehtUP#94UgK0PB&9BO5(E*g06I
z0t#&B36HcbC*kQVD;ojRc7+cgf&)T+<mD0aLXX#Hvwgv`h6=*bJuOgf)$jM!=mAi_
zMWCfnE(@}x_P)t!C1b(nf}>_K4u2{Rf4-F-DtN(GP8pehVIa`e85^?TU}J%XPa=Nf
zTSUCu!4bNvA#I;pZ4Z%gdLAujP4}A27}y!55_we>6ok@cw#_<vd#SX8!n3o;(bo8^
z{OVRgqXE9ceA>?U;@t~!>~{LQ7klRLsBN%0mNiglM=1LSo6qaV4vxmU=!n*c`2_!U
zCo<x{KHL1epZW|XFI9m(sghMtRu(CqsWG6N+i7pNy^)61eByj<*o~fg9Dapr9Ov-x
z{DozshnB<X9Np#{hs{=UV7#U0q%imN#QpA@>L|I75D%FLrRLVSs|ksT0S08O^qk}@
zu%R!3WpDrVID!}Q8sAWljl|5Mu^n$Clu%Ge@1tV=$m1Iy8~c%ylQt@(hX4<Zkr6pR
zWFpqFsmA<#c?k(K5C=yyBs`*ld_a?oc4M$VLB$G)gpturBOMC`AoR*#nWO%+IFDpd
z=U(0{b5+pB<<y${f=&hkifV&t&U~XcA;N+pnW^6l=;@K1@qdl|);0Z$u8H$%yn9Fe
zSx<nR|8!qBcuHg9Le<x{X=upeqm!qzrL`Wrtb*j)%wQD+O!xh7PL5S74S!F800<85
z>8arK;p)?!dCzUD%K>|r>HT=tt@>LMuONYnD&pJy<;QnDEerZCE-reN=-Ihy9^|Xr
z9*(hK2W95u{NZeGsK07W@0>SGuX9)~g=nzk-5wV-i|mY->!(c5nT>JBa)h4#>8rtn
zZ*scPU>5?dK>w4Gp-&-YRgj-w4Kn%K)?6l$eu@58FE%JyY54dc@!^M-mN#rfw0k?z
zlS-OWfYqgNHx=iW<MhTYxBGQjs-Pq|;Go^FoI4y^Y^pM!toziu1ApLqJq;1##Dr7K
zIz;c;+LXErcl^Aq%lK1dv_8Y}#A2?tN0)^FA5|NAO+{7JDaao&`yvXprG<s!sv%mn
z!!>d5H@yj@!>z48)A1&0HWe)`BctWFIGL2>O`v&cw)wLL>#-_}sy9jBi(wJGx{ylT
zQ<W+x;fF$ab0s9PX+X|iH3}jd-Q~1C3A!BlLJ+ZCU*O~7A_G--0#&0ZfF0^cB5mW0
z!a_j&fD0RJLllyBfH#veRzW7Aq}&AQ^nNHNAX%1^I$yndrJ@?FTM{>|_C6)OP_u#A
zA=n(OqOkUxt9R?~mn^HYl~s@lalP1H*HD?{@(Z0CBJBXi#F?kqb35^Nu~L-5STI-J
z2C^{Y(=jp4+8>;v-u*XvMqdKi?A^PbdtW8#I{BtPX0Svd<i+~ZcYLPM1v0eFd0cuY
z8Ym8pO_{Q)B^n(0?!~JIK^H;N1&R>39-kF6{%PxOy}G*B>W7cUj9+SP%Rbf`Eg^+~
zxh|9NpXuNLOa}*!#r5POGTU*}Z@gjdqAn*#Lr!jP$jSI-9fk9dV3Fm9=3m?YY|+gC
z76BlJgo)A93=ZB!--P^`Hbf8jLOY^=&tjF6{!%I;w(QL>vN>2o-gSGRhCT0od_j)C
zN=m!eO(Ky|Q*-_&mrNY{(sKIXbheHyKBn(Yx;bDuVNusrDZuXcpA9gIX;pVOO`q25
zCxprT%5T~`cxmXVY#a|478kpFdxcsVLH+<o<iu-K*Ej=%Ota%^cRoSby{*M$JKiKd
zIz0IOL@_EIhi(rG=1f#n!uMGK@&I_w-63hji6ePsZ2qq)zr`t~ZOVxB{2fv*L4P;4
zy$LZ)CtpebcdxVYC&j^@fdO^Gdd7#ReHmJOZV&juRq|W@_dZoqaF}4x9tDN1!rs9{
z%|@mym$U{-kh3TjXm%(LOU2HND4ZA)Xc!Dv^eR0rvP)iBEHg%&Dky>|sOD6j=pyyE
zj%TX}HLz=i{U7|SEqlSnHMpYkGD*OFF8puM)s1SvfDFv~YfJ|f!$a(YJw1oDJm}kR
zet~^4Xnelj-kxn(z$pfjWZ201nX+AUIXG;N?o_U@c#(MQPD5-e$X5g}mohW6ccvO@
zrpefUrrso#txgBqTRFr97fPaApHet@5C8gAZhM;LI~Npv@i3)mXR@w!(2@Map#>Jf
z{||F-0aRuC_KRX6h)9b_DV-wSAPv%@bcld7h;%F6-6^0T-Q6H9-5?Fp-F+_K_g~+)
zzdf_(%sDfA4dWO~c-C6aec#vhyMA%&?(yxM`$_!UvIjhscDo0F8E|g&{x?ak+Y<)O
z)~!D<_R<7>{a&-!@$EZzC^@8&?;(lEo&)@yQk;|O;VIlVL+E}L8y~${yEExP=rMX{
z;*HH>d;g|&q=>7h9_^L-#pu0g35CqpMnXcDaEn!6PY2B`_b)gG25Rx}{ysmW6GH!5
z@O*~9kAZdb{80#8+~3OL=b%2nEdb0P3W~be%{kA_55T`nPZy=lE?hY_HM!XPy}4d{
zZu?GY#T#w=GKxNqRVNSl7qEqbkS}HKGoOE*7Sb*<!%anci$tC&Yd`J@V`{h!Mw95r
z79cHrpy5r|)tO~%Gl#wvk+0>lED?8qYYl3BXi3Rp>U^r9f_|#L`Hw_=@9V_qL}?3&
z{*Tx7Fu9N0nD=tIggFQS|F{hu(Wj)Sh=bpIkto3K?<;#RFW(qzNy+oRhxGIa8uKH<
zF;>Tsnqh&tlO-fBkKE@_7D5ZYJzb1*tzMQ_XSQB;NE?+~RBSDbPWE(e2`rBJ-jpyN
z-qjvPaCo40Ix;r)2qr#tx2n~)CB|eXt6einAUb{*32Oo4&#<k`90}$0>P6K$D@F=n
zzVK-;|I~buBBxBJ`0?fZ8EVQ{juW8jm+F_}J*^n1%-_<#ZQN5)8Mq?(M!1(bpBB9B
z1Z*DF9&ND$qDf$)U)EzK5pmVno)$g1#%Tl=qKhQ1O_z6=0PJKc#8Y)EA9HkaU6t={
z0F+HfCpk778W9p@j)%hfN2qMu{=W*9twQAf5-Ri4Ey<1<b^eq>(<*oHs@8Ald|Tqa
zdCyhr!ieoJvS0ALQz3fUAC^jjMV=N^M>pLre)sMRY}3{|8T$AI{VKM-8*6es4*&>}
z$nUz3|Fcw{A-kH^K*%8F_}!_icV6m(T>o{26rMMq`%_DANgpW^pqv6*QU+EnoAtx8
zbiAXQVpgUUq9zu|t*xL^A3LD-z)`>o$3rjqG1xo__)STka5ED)^O-S73xc3rYpZ^2
zP^YeqjzP6cE*=PXgs4NGMyTG+GZAPizLIYgTul^8d&SC9Vzh3wI~Y0(iv^l3-S^+h
zE0xhDKmi8Q6Pn1QGikvLVq7r60jd}{Bg|2Xw5%8~11qt!i@${PlE6;}H#{O@?d)fY
zhA;@;hFMjl-kWL4#2?>hVk+{x_p;KS)AT{`TC0hHfr0bsK;L^^IdO4evH1R9KVM2Y
zOimkpO#s;!%j4YqB)-U(UEN(2*V1Y-;)kHDjgpX@?4z$Q$_Yqtb9>dnP>{+_Oq>jo
z1P4*oc;^mz(26BzXHRf@u{@TR^lxlwY0-{S1Lqh+>ez#Tp(DOKiD4Yv+{NAPNM`}^
znwpHvw6)!5@h`stUeTsoI4}^VX8ZMQ7;v5tY9-iE|JFX6WM3q5p7w&|c5Z!SmOWLB
zgOoJ#!h;OK>cJdx&Xas9TH2XDx#Wn8GOSy1fY##Ryk=smeysNbW&e*%*!Sm6MMPs`
z=3l=kA=5N7>w8$vJ!EKTICVRPN}RfWcFxw^e6(!y*i#TPEd;2#H+ge69HfQCU%Yss
zAx%mPS6iMIX{cf-ftJfOy0;n!eCyl{TEIR)lmu-F|F@f)Q6LG^ear)Kk-{aVCBSzY
zWS*c;<0y~o!}1OOw-k7BlFWodoz8>a3658Nk3;{zCA*HOGEK$_eZ6P%2v(}gdAlPO
z72hXRCr<C!d-$Jy*!dsyyGX8-1Hc=F=RICiEwyGn!O^Pn5lvfNIiNPmmcPN3($-uA
zQq7&J0iFT970^{(0-N@Ha*YY`1;a|-(Pgijr=F{gD8e4`AF=0DBP&vaE57;y!o``x
z2h3aWKd0Iq0uo1md4iwB*q9Xj#ov#M^e1#E2nhAw0|T~>M_WFAE(4W@ya)(LZan^e
zKTpOjQU56w{UarwEe8oqOK;Cjg!)>j?=Cj}shVw2Qs?LX^JD(?*tx#b^yiBI_2|p~
z>nHu|&j_{m{%?H3zt%1_E$vc)dkITM`G0v`Z-v(9&pGd!!rM|18Wr_94C|t9_BP@a
zk_;t+%d-l^8z<)Of27jHQvacph8O*R=d1lc`AA&o!6MBI@fJ)<U2H@fwuMDSM_~L2
z?EmD%P$IFk{vRvz{M@(*7tw%^usq(>Uj}Wpi#31`{M>MBAvBn8XH40_M7yD_ZN}jo
zLIa^y_;L*v#cZslZzr{ZJOLTpW64HYYj9>B9-JZXpa3E)@~aZ>n5T*s4@I+-kDPUP
zC{|}B8T($#$opR*jja=^0kX+_6cn|b&PT%br;cT|&^-0V7t3jCQq$8LUN`b4o~VOA
z8IaycrRV|to5z|5rEF|s_;9~45Htz4IpoFScdvw0oG$#CmxG{Jv>{>Et+-@tZfIC(
z=^A6!54Kf`+y6~hQfdJ*S#EC2lwN|c?Nm9cg^dKS`-~$4L)7+=(`nkYT1*N1!_GON
z>oT^-&)4|Hm6gdjId=~#7fy<in8#a8zx0QkopD{is2|Dq>u;G#?;+s$@WGN9lkoCj
zC^ijdk%^aiGd~mf#AIanSa^^G(Cs-rVZ@<T_wfqKdxB}f7*r<Q2O#Ng?Hx@PO!4qI
zReJr}ifSKxOuD;s0gwhoOzOKNP^@HvBt&TZiKRG5oIet<%d2_IpXHHJJX;%DO*>J7
zL#;`WZPkDo{dT3zLUQf7%{vBEA{G<iPTj+`J`V~6;T7STQGE_jGhh0>+{bk&d*+F7
zvdzd``bdAfMq5GLaJ72+RG6{qBuV40zn?$M|Bibo-Fg@a&CGzaYq&lEWmJ-QaxN<p
z$BLDEflznk5yZ~!J_tvAK#-G?2bz|HHEZz6qBJ(j8n>~uig^nR%kN(jVk5yDsT3w{
zV>VzyP)xw78l9q~p^z9BW_LBe>gMKj@c<}c)YO@?<t(hM&(!AJXGmyC*{#>^3puBq
zc~y<(FQ5^Qw?$zw<vKSdSas3g!UJtJyfdR7C*`MWA&t$7&$OIRJ6nXrj*fn0+(K};
z8~fqj@+2eEU%XY4nikT(8W#`IZ#^-L`k&^WFfuwoxIEOSy;?u47`y*R!EC~_bVz?)
z;L=mAuR|o?ewoBm>AIV|Pxmlf$gPO!BUS?C`e8qAG^8Sk17Ozy-^}D3eMI3)noG)b
z(W|g9IQ+rH-o!sIFDc#Yp?A6X|3)!eoTn@FN9QSkac+54!@unC?5n>Yh^-GY=Le~>
z3*$$&(Xr8g)QgD47g|nU0d5CJ7AStWcT=FvWU*TyR`?Z5_ufkC>t~niZhYI|l1Ec1
z!iWdNk5-7KGF-cjV15ZQlbw)m-k~M2=oEH~CTx&M)+9LDexs%()i+)U35#Rtb!=^=
z*Iu0A&_8kml7bc2rNp9p)x=}R>fQAwcA%TQ<=)xf&qtZzc^@II=_2#m>T6tF>qH+t
zG~BaTfXI1!n<cGrX^5!25mPHa%mDJY+0<Tn<kCu0lN*%S&>z~E&E%)2_m?sRQc+VI
ze|P2XI6XOe#8rhkA4YIQ8IIb7a@YKGbpEq6G$FBQ(S<F!9?I&9?%e~h0CTxmtP3gF
z0d=D#FRm38zHXiW|4tA3mixa8NmKCuS9PfDCl^R&j`b7~v9@OA=O#t4;{UID*@@?~
zOLOa`JVV2y53wJ<*ZX!n0V^RiBxGoCaCu=p)6zYc^@RB0zm>CpFNdE=ORQ5<LZH(C
zwY2ol^r(?-ipP<DGi{SyZ92beVEzmTD@Y6I4^ci?#eAA+1oUL@n}D;`A%GZ=>E<0D
zFjnD`QIl}fCHclJM2o8+Fk%7e?Aqw)&Z+;(!NJg6b2q#Bm@o0HV0x)+Ot@L4-V?BI
z7Lm-Jnls*>iH?klywWFfytQ-fE5+ftV-q0tM@k-E`R^5gi0BcBr>7tn1H>dyIuc@|
z`<XY|kVr3RzZbZX!o?K;(B;SdkKU-P;}tI6Fc?u9AYijP@v@#gJjVmLRZUBYySrOw
z;cWBbVsrX2EftmNOjYksD_si-?bolrhNTt(zqdHNEBKTwk5NGEvShj_*O3&W>Csa@
z)Y{>Bn}&vkQPVtAuK7`2D-0@U03ty`0tk!eQT$}_en|CXj=sEX6?r&#?EpYQ#9LPm
za7R^3lT$=~FO#wHISdoNs6pk%mNTiTth}<mOh{B!X-T}e^}An5_8JTWmY*evR@(q6
zSnc`Da`&VM8nO7HZ<>6j>t!Vm-<-(U#2YCJtl9!4Iuz){YMhn?mp={@(L`1OuTVy&
ztmvcuyS_~ftmqf$i(o-U=rBeCBXj1FXB2ESWON8qFq-d~?9xA=TE}P4PgUD6B`jsZ
zYfQOOXd#cZ$A8qrM3)6IWBQM{ytmA}vE4(qM9~GF`P`vF#Klm<kS{!+n9@)l^Shb)
zjznA{It<gDX@~D)P20lrp9FFzGmbNdju*28M=JV>V~)ACN7KfnBqX5ZHA9Pk^f@^M
zA2<F9DQUTbX-#5o8qsjUxo4_=H||4BO#*K4>A^*EgE>&{%Q0+bW9=US$n{R^wV!+*
zo6tV+3M_RmER;~RNzZ#ws$}#%E9>svKyEvOZP=^(NEMp&?JCZHiC68V6ny&f*ks$&
z-{0}$Sjq8r@o$EN;pxLS=ckAPXsGPWgrQ+^0Z}P(!Wg%KFs-Zi<_?AZ{Ey77yy=YI
zq%Wmx*DuZYiQ9Xo)UHNp5MH=8Hg~%iWYt3`4x^?11sV>*ryHUQ3e~l>wdTuLsY2qv
zG**$dwJ~sUdjoKLqhL^Sd0X~4G`u-OO=Wzh))tFC4ffyp4GZuu0GGK`$()DuK4_@1
zR)8j(e3qGAnT?x>YyaK>Q=gTReAxQVg6~b#SktS13YU6_g;O1BwUkd7@9>JkYJ=TX
zr>7=%Wy3{-(5T4|HBIcU_PU*q-MI<t>EW~H?bKNzm$Ai=&ov}aEEAT^VUtWTk}$?<
zneX^o?fS5sm^>x<(bXjzoJ9=owxHks9;jUXetoDTlsYpwrbmRF#PZjeFDq+uQ+fc<
zG*JUX%x0?0rCzMWS?@XzDnP-&Wi;I;JG}o;czDQ35dDW$#i^UUBxOMSuW<VK=g$)S
z{b`wu?r|-OQiNYm6phX>?EE@aP{u2>xwmrb@=+9dsJKj!nZxT_^74gX9hW_drIJ%s
zT2uo4&v>;f&}4-}(Qz5*-mxNP=j$uWg?Nv+-WHgcFaX1$f^th;DmIhvv7VKYF)_+A
zW<9{;#;bYAn^hN{hR?t-)4b?-e^(vT*J|q`6U?-<#RjV99g3LvUnzgI_&8k^USfRA
zR&sTKs-WPXI*<0<-Sdxn&(zg)roy=GDK6zPAeZl208Z0L;Kjy{prPqfctyn5Yv*^_
zF)|`AEUY`4WIA?BO2XN0?Wcv8-s(#~8ne740P^(o$ji+rmwxLV3rv3MZ-kiEenw`+
zT;2OZ#m=iuO(aQM;3F{vHn)_knZZQ-D;pb&3kxU&gd`(4QG|Ryr63Yy-TA%hgboQv
zQ93O@glN@V>{7wZB|}UYf-v9GR94y5Ivykb#fR?e`@p&DH1-uqBT+zQe7nybN}(>S
zD3B43k2AUOYZQMZD`m0Hn-Lej<pWWbucMOrEUnfS#hrPDN;oNeKq?m<onMnMzrPHO
zYb_mBQAN?7jt*(*Hw%aH(MtImU;7PeU%8vM2tWn~QZn`~882)7lW0Tbk)Ku`o}M@&
z9<N@%j<MQ*>>~I>d|MtTa!FYV&`WR{DK9OZqkLAV=-yrnb~7mV?h*6bf4$t!KfCZ8
zoYr(9+Tx?m?D&)YO=?nFYK?JwmyolnwDfTLauWP_A>`i7M3~oIzD{S1&)fA$f^Lz&
zzjtAOUr$dDTqea-ji2)^n=%=w)yF_7C-9VAi9s5b9^#yrdy`?qt<BwZl%N@YJBB_O
zo)LVXjmU`WS3<JZjzy<XPW(NDOYhJWU(ZTN26!hS(Z9(pQE9(j$bTmgnV#k>Bs_l8
zU^_KiGWR<bzx9~`NENDxI(2uRgM#Be9t8!(6~~gc%oZ97t5ZxRe2-6`<QyDcV)jto
zh5t@XO+!s>V_^eX?M<Rij5<oMFXqkyg)a<}6LZ63zMq`>XNV~)s|FRAnwiN|+21L?
z^ZlovUlGK)>4>@buiidGG{$}4?s@+7CC2_PQRLC0g`y3G1DK$3a~S+uXJ<&(zlgcl
z(1b6nt&QdTgo+AooveKQv7uiFC%er<C1NM_@22}RWRt^)r`l-W>#vj1(8Sp-rG}@i
zzg>7rpG&Wlui3P9r?wif=1|UdHnt<cV4zsY=p``DxE`X{U3-!GJ|Y-0o#gGE4D4J4
zwqOm_R#88E@Du~7ik9v<%k$r4;rUY)0aM$sIw-tlqob96bb>`lX=(p++p6MXfWW7k
zy<_dG&I#64y=fa5zNDvHQ122<Gz+6I3TX@I>3PzbndOv}(D@3V9b{HfN<&O{V4xQm
z2Hfka2#ZXNy<!>eY2Af{GXvt!x#hCLSZ*3#Gf23&<;CIfB2sd5b4Sg{-d`me=Q(!Y
zM3~jOJNe<>`qm?Xr}f_&DF<3~CTFoe`=Be~_KF1)zpdT2;kxXbt8En(^6<Eg|2XD{
zt8aTmSQrRTJz65biWa_9at7YgTAn;-2Dt;N*k}r)%58yxq^~><2_}%RWqGW~l_+s?
zqM`V{)juP~TPR~ttKNR~_Zm4B)zHvE?3cuwXD<LBh6FktTn2U~merLnpk@r*!(Uih
zt+pD!D33Ldi9)-Nl$n_;QS<QzcT=MPWKcRD@g(~Dt3hCKY7v3s@uNX~FGhmUh=_}e
z(+oP9;xybb<?%s-T<b$?xOCvmkLIX-7FoG@OVG`|)!M2LQX%xk7@)&zNCvigc=Yk$
zOVPx<l{Xd^7&c$?>TCdwt##rF07`ys_eEwRO+J-z#vq`11*Az^q|MFgr6pysL&)D<
z<({bik*^$}_neW1AR+pisJkFNCFO8+uno2+@PeAtbEt6imW>N~lBlPrhj=DxmZu3f
z3%8S%YyRuVXr+T=6sanE)R{q1?ehU^Ys8jknop^y)HO9<5`Hz;*_>UQ$HQk&minFg
z3iaf~PW}{R->8AY;R#WZ(biU0RC6E2zO0kNXV9NK@QMk@H0)-YEy<B#Q3Pz%O=EUc
zBRDWcAoS1n@%6LT$UexBwABz4Q;W7!1~^%Fu7(3Xv7(}|kXdBD>9njYJS>W}wO4Jy
zDCP#=7oLPmBcfRsSSHm|-9ydCl6Mzx5r`$=ON@_q1ZEYSIrm*5)zI=iLlJ?tg2H|w
z7|^u${TON0em|s}!=EF@DkUu`+SUhV1^n0#;k_c{D8UbJP(&p;7W}pbG01gxr}t_5
z#>Y?B-gs5UlDj>@#<&-0^kf>RdvsvPFk_He(<!*;I=lGBE2@Z-ic-k^1#s+_x;m&~
zYk4mp()&{9Q?1|APyyidi?#~%&3ckbV5nVI+7F1Ucg+3cgPmAre#}c%xPnWkTY%?*
zAo*q2%f%&ZZ!~6w5TzB<$h)63F)(=;8~9h^acCKa`$w#8_ow01EHh|s?&jW~iiZfY
z((=L80~?*Rrx5MPOwzozW{d-I<JD40IXOH)kXAfWlY0O5MLQCT<OXw8WH?k#3>44#
z`DK-C<!EzDi}oBX{qU-Ry$jJ6XzbhIz^hpw>T@;xchY#fK>^Y5mz)}5d4ci9Y5U%~
z&FE*z&AN5nPJw{x{cArfJ%36=v$l*cr>5q9C%B@rq7TPj`5?TMy?unDNCc9@`OI>C
z3dAK03n2q8F!B-x4-W{huJ9IWNi_(w+-vuz9NF1TR0IF|u>t}eRu!IEeiLoM#5g#S
zIih251G_nVTAA|ok=rmKq^0c=5ov)f1vnDDElWI`9iN4}sVH&F#YbHW<ayl+J|OwN
z_@$vOu$Ojz-~K?i%E2p{|9S;yeNAqrw(G}?hJ=KL-W$)nJfgGW%5US%lSB+2+3T^`
z3tpCxaDj0f2-%qE=pd=>>g{dxl9Ue!kmBIr7;wGfNamMiXD^0fr>Ib@Nv$(U9QrEL
zg{U|ZHJ@3jR~67qRe}mML($L4cq0w}w_8^(Is{ArL{+PCj=a0OOHG@(_<O0wDROu3
zO=~`tqKZmh&IPG^B|`nDh=|u`gT$vsSc)bg;R-%Mv0hcgCVGBI{;79&<KUo&&h~qz
zQEK@8N4oE5n;3_NOX1Gyi=h+XzH{*T>Rwk?)^}fjiRrrV65H#b^z>d39Azt+C9pi5
z?_J59LQzwhprOv%7%wLzE{+b1n4f*J4(Tfv2Rv1r%J%lF5Qe2Z<^r`=XiCSoAK)0v
zfTo2{dk&7O3EZwlwY3@=8kTc46`A4sV5#sm%{?zI7oULT8TsK{lqr6E9B7VyDE-LC
z!p2^ErXnGs@=8!u*aMTx2J#GgO7Wvz+l0;p7M4Y&QKgw;19)$c3Sr4GsVFPozRXNX
z!C|AGA6T+<Jl=kxkVUUj!Shj6YAj-QWMsrVSW+;ntZbxts?GH^`s43#7*7`%;{2us
zcXn^-gs7yXD#P_E7`@5+jpgt!2OeE7T)9`*#_eL@aF&1jhLcFsi?ANu)6&Ar{$2u%
zj(^s)hlRZ(BARCW+?eLn2DAl@N(YOhgw@wsjcbwky-C~_`y<x#XG23ypfdE>ZvV6v
zJnZRt=jP3e1tH4%-j2FcTLOsHDKYjkx$M;+cCs|}jHxkB9~yC{<rk0k>qXKw;HWV6
zLh<~9uBkb_!jB8zNj0eevQ&VV+$PLGpsn3qpwWSZvYzW|DqdwDDNGU@uOcee?H_|#
z`SA^b04tIr!7XP}ZnX^9tr<7pIM|=5#;E0r`-o)huNbU9(+ET7<bA(8!1-Md5^26?
zXD1V3=;@e(ZOCZ9fa~S&;W+EA!Z(jhhM#<7AQ6n%T9<x|j}LvTy`5dMK96(KE{lPb
zf!yra60#(s-KOR>1|#_^2<z^y6d(x|RaO=g>n6r$vKWrjyH9@j9Z~()FUKR(dWX$d
zj*iuz>*Sq&J-(I~a6B?=>ohQ4_mIX@d-I0+$&(5z3AbePS%3)fxWW;3sv!rNwU4>I
zqg%7wMbBOYkAcBl>Y&LYWv+aiO#A9rLCSlvAfgw`6L3rZjIAB(Wq%7fT98{SD=j%*
zXR7sX{!R_y^>2)<%mscOt>jP4`Z6r#PQ3*tCMF+e`^-$Naoh{BFfd{Pab4WO+n%m%
zDU*gEpS04lAVU7C!otsjDZ)KIvCqx+K#<nAdSvGk4V4%IRAO31N__gZV-D^)rX(0}
z@>*D0-0=<)q-{Fs`(P|t4bm%!nMB+M(}YRap_nfXg`Ab!5Ru@M^o*2V?T^hdm!D`_
zM;C3LR<X6zTO=1_3?KoJOD@+rMK(%M$i_XIo7-Y`iotu#tuqIe*Fk#<GgM==O7!G*
z43Fpt1W67WdnpA!^i`CxO+Z?E0Vx35sDS~O*S*R39-bbKnDg7XR8OARo%f*GzE*wt
zPyk(4c1A^hA2uW|u9evBX^Nbn<{E4ajF-{o3jWawGfPf>7n?te5088e2JSwszv)R5
z7n$gLedKmis9zQZ;nOwIR5Nu>wT@KVeih1U24X$8v%${!6X7!2U?Y8f{fhxsFE3F7
zf<?F<sG5QK(_-#ArPgw^F-cTyr?(go14UOzhi-jn+T>(CQDgTlxz}>3a>5Wf(Pze>
z7JG<Vs$m%$SU})D<MQgT5J|!|mP(gtyuI&spd{G*=W2HG_}_eK`;QF@{Qn{5l<52v
z%8{Cjgr^kEu@4{IM}jz~#v0j(pq`*bvEx<nj;<~P;Sk*Q!Kg_EENo9{xKb~c@ocET
z$_GOsl_s0!0rBbXW)+9y;?hzAmoxTdY;tn7{kkewEur;FV&X3t%TCtl5l&QRXXcLA
zS?+f(Nu}30RGd~+Iyj$Ktgl1r`J^|QI=H~;_7I<=L4@io|K*P#DA3IJ2C8`2Ab)@D
z&QDrBul04?u?Si-Ha0eZTco=)fN9XyLZPfSo~E_{rpmtll8;yLiFsXS`_s;aykfjA
z7@zW)9p;P=_DR?fnN1TC9?-kynj0AjQ=UTNlnO-0)zsWp5K>paS-<o+aavwc(XAdu
z30IcTbm|ZvE5^%Ox!wweSrTTNEF`{pW*k;_T6%g*P?sz7bCszkR)0_x6*Y5OIo7V)
z+Z&))8`WN?18hld;WPiYH23L=2^y*wEOcrL`>Ph6w@@tC`>$LR_+5+Auz+DmxXOGs
z$xU)yVxAN>AX|L^dus|>jqzm~xu@Xx*{H(-a^LDfVEpJK{MhH}>#M~jU-M!<>gz8r
zM0mG~Qb2We^QIfniiC%ryt3fvSd3-<<M5Ht^3At#VSX_*Dant%@TW_1q}6_0vN;@N
zR@T;$5nr)mrEIKsPtFdz(&>$hXX-62J`!&dm(bY^Z*UIwQ}+HTzDS->^*J*ywe}|W
z-)<ZpzHS^#r4spRRUtAz?7w1F0PP{%6r3C!kJ2~O$fl~iw7M_Py1UN29Q4TFIK}F;
zp{1bE#K*^P@mGAyW)@deyb`)L8NZJJaPxajva98;Xgug%Xlb+Gt!w)G@x48jC8C%~
z=5V<;X)Ws=w4rkn0OkjUQa86Pi+1ty9|eFzSo81P^#_~$t8-g{vR_N}CLM<UWHFeJ
zS6%ge4)5tPQ@+=p^p%k{@dbb5glF?0ZE`WUNv*&L8wPLtgc9IKR$R5ErFSmv|Lj!G
z$nLfWAY%sNU~FvA2kYGi0-XmBf&$}}((;s4R3uvcms>^McgsI4YhrRqWF*SS)_iPi
zp2{%Baizhy8%ABff{uwH*w?F{jZ7qV7Z>vKG^)$Bjm0@R+CjOWd`<MQ$>8i49c5e1
zlDxbk{u1s9$CAKAII)6Ob~bJD*NmvhNC<Aotjz2fZfUmFZP?Q@*6$8_!F|W=rkjDI
z8}9H}>5=5hHW8DWd9n{hEzX|5m5mLPlOu(@_d%N{0>VjhGfTq2<klmFr?>H)pe<))
zWUOJic&t~3ZoZ=;{N4u%CXcHV)=mzFD!UgV#qsfR7h-`Hw)<Nf8=!qOPR4OOrP0~0
zBh(HjAs|#ozinu0I#po!MnsQO@omoqD6c*G9?@dNb_5dzAV0##<VjhJN0yvhT1te?
z`-{NY$rhU?1tJ5Qx%$R&Ze*C5rt|5Z{c*gYwo%3>zP@@j7egZhP_9E!^*z%N1ksG$
zt|mHqGtOBi(YIcEqW#pWc7a5P4~LzBb$nOANzp|op`$A@T0)dS&b;HFS}1@|M5GB(
z!27r|3zF}A>8hDb4V|biK6O_Jpf8&K#!r8#S!u(#u*7Wr1{Et@d)Fd+)LgvcdPgRo
zNTjI~^<C=xSno2Ptj@x3ZGNnL&5*D#qSXa{lbDva;5RUL0sQ9i+Im6hMckU|=H})?
z>y`48hVkKu@0YcvwGHgIap_}$I%ZjNg^j&vs$TE>HJE<_V_0sK=0xsOuuPOvL<)vl
zK!^6=&u*8E*fG!)Is{N2g$rV!qQ;*5-lTPEt=&2}7$_~V=Hli~p8q{(YhzQif{8xj
zSEM&+=D_VdbruOJG0c7JM^?w<Rra`Lt@oVkS1Je)eTC<j^!VyVu>cpwz`!8H=V|O^
zpIwj6$G*4pYMzq;Z3gid=6!f$Hq~5J#~l_|>J;>YTwR&sR1*^udz1JZuO>!BX`emA
z#*O}wyvMhkk>d#f-Uo{#kY5Vm1{b`6?hF|@=?OhKv;I}Glw~K3Bxz`9SXo_(h#!Nt
zX@O!wwQ6|yjloy77oS`^OAHOr7FTxNb6F-%`kq@_c6oOkBWE=pX{xHKekJ?%Xh>*q
z6wG6a9CfZ=T3I1l0D@L`VTk<G-P_iYrngam4Ugxwf{>($h&1GWsY}(|)34bb=czjL
z4%Fx%7CslVMK}opK19c?cIV5iwYA4U_th|Ntt_l((ltB%b)e!iPJ+WT#jm41M;wmw
zh$+UF-6k*)6=18!kNJ<TzxAu`cIAO(DWn?>y<x4=it~YT;#S!+bz7g41S#!J)S^<~
z6^xO(mjk)$BZ^0p<(p8*K)#k^Sdt%k@cI_vQ>48!Yp-Zv*5Dq4grX0JpPrt6Obe>!
z-O$dw$Y6f9T45!xcPTH*9*`-x_zShGA_?#(m!k7%64k-Vfo!38yF;;;B|#4y)bInN
zy)8x!iHNq?-a87etjR^UQh-+><6>E--7eiiOE7B<WQQA`?~zk|$nmViF-lW2ocV?6
z!sk+B4qV1yHjWk9vS~gHX$SJfQSGBm<fFe9`b^Vb3td@O5Q*)?hAn7LdvNDwnoc^S
zRiMg?nnrz$*rz1I;&KJX_bVJ$i|(u(jFqk{At51ERM|ngP>G`pqMKh!3k6&c8u7T}
z@s%m3ioMv~XwUrxFmL&+w?)IiK))UM6Y7kClhdw+5jxFBS{fQ)n$5w<nLi_LWxboT
zsmk^936}easDEHQkSM=pW}0#~DJlp#j%@fGnOV3eZD9A^J);FPE_!at_n}egGWH@W
za4bhNFvrEmSy{)L&_d|tgmV_10u!^AlH!~1-=Cj_!afN+w#cxEAdNDFng03Z1+itq
z1G13dV6-X2+iC0P?_bpc*`=a_ihgs~S3%6yWRm^;&#`GQJ$7@Iu5K>r$xSdcN01N}
zc-`%OnUkNdM^&)h(1Xj6jQ9AysH3y()~~VhWo1p5XJ<;9;IYBSM>CAz`ts<U&ZP9U
zF|L8sLvr?QXBGR*wVBJGTkMmG%=)rZ)z=GkkE&P{D0_inI$rawjs6JEem+eX2izR%
zm0U%$XPU6L48E5VRLY>>uSyP!t8rehYxwk*h3<S;=gp|_WwPkBurL)FrtjvhMxnI+
zhtHBWS7vEwNk@IHYFsXhva$vy2e(PhM)uo+hiNh2?ds#;UMnwk!Z~jcP<!*Ib6egd
zs~wfNIx6BLnjpWT331}<>SHrKy;?n0qFfG`b57L*C{mV(Y@A$OMb*1oEC|v-Rz4Of
z4QUkAuA(=90)wdD=sPpwODd8G2Caz#&h~4@lPV&<#vATHe9jQNpr)bGRDX4{t8-X;
zx7;+B@KNVMNdzLo*)16+d&Qv(jE5ui^wQ+tz7g{+g6?SS;zH$UE`DQ}S}IUOZ4#F;
z0cXW*Wpbi!=bB*o-BZ*@2xC<r?0nAux!|aBoFjk!9Gz2W^SUitQ222NA8+i}1^Apg
zue7r$%zVks4HPB;mfMJRrGFw)HBI0C%s5ww)TxMfh)>AY^TU1Qdxhne_u{cbj}~{&
z0<#}oz1GsABx$N>&=U68E1bO202&Ac#pdK^Cj#U|?62FIJ2~opvn?yr2ml@{Ash>2
zU#<ji*%Tiz9J}0Y^Hg>`zs>rTYO%cGYVsDs?2N4JT!f}|n=;bsgF!_8OG6r=E_Kyb
z-B1=3SYkP(%qE^Jwya%fVcT<rLr~-ZMx>-P_``fcLY*S+^v2}cm-OFQRl|P4(buuX
zl-07z6n4er<Sm2my(%jmfSKZSdA8KQ;QcyFGg|xIuW3ZIL>aN|dC`GL+wEy#ksh#t
zt+zbR2uyR-W4uvzprm{h{KbN%Gs|CR`Q2#>ss0Zu+fdUS!bRPsYS~DUj7cgQDt*0r
zy~{WNKBMV1(!PAb#;r$CBlR8V8|&*Ah~8kUac6k)bazl#<eo@G@OE2_dt6r4_wROq
zqAEwOuY6hlU0Ysg^CVQfc8w}Ee)`CR=uPr;zb~<$(qG}JKbmqhjt3YWdk&Jwupi=l
zw?R?1{BWV%H`FKB`=NNMqr0o8dwn+_DD##U7TZ(K*sgs&BON^>hH!`-6HjYj4y@y^
z!Dc~DM&=lQE22~pX0F}z-O8;mN(iaxXc~SiI$bDFjgMyzmTK{PeXhgcY88>YD<dN#
z<lack|7I@Z*unm!Y;ZN-BHR|ts_>2!TL=5v7m>v!7+sQK>~NC&@#Egi>&=hHzTX?m
z=40a3K7I(<+)UWmOxS5d+u~LMn{7s&o2nL?HBNPU`1_ypA-p7S!|rQx&{d5?Q0`;l
zt#4&zqH=P|^76>ZS?ZFK%lri7nc3Gi#z2i6d!J4hgUMH$n`^o^Bxhppf9KgbAHsc}
zqoZevQDuPM^IINq7?Et6B$`wOK0Kh63QR1CxbG5`S5WX=NRY*ldUeZJ4>?Ze3;)~o
zraA3Rmy*FrJf;V`yZg-Q{+@qux7328H&r(NS?bVok7hY_tbDg0Bu$;JcRhwlX{Ie1
zIr)@K#wh!No)|Xb*gqEnx|<8%<X!(KJ`j<(7%-l%sh^`-oa6Wl2*8>`LMYqiC@5gm
z+Fsk+(S!>^Q?)WHYe~s2x0YhOj~G^)_NmllQ~}AC4G3pv-`x*(CA{I+KErqaIAD<O
z0X6LjlK+Q$yIYTpp@6*T%<_XTtx8-sRKE50`)W@sD>*f?&0V=ri0xM0rA#-?Wh50x
zWIJpuEiE@p5)0lG*GB#$XIU%6@$4t#M$Q+;r!C~3Q-LT|JmSGdaw=~=%RW3P0|Sd=
zC4J*RMInQ|PalV~kkGBGTLU8_tD1BMKgW{NJJ$@>TU#h*k9`2m4GoRzZq@Um2=6HL
zk2W?oG#@L;I`6TCeho&$F%O6ZQZB|KsNcO@>|9#s<mAM-ZGXHK2w?(%Ta0OmIRrOJ
z78G0i`Aa`%zQkCaoqYm|^_0-MX&yATfCIc*hb2TOo@WM9;?mu1&^@Q}&%Ccwl#_#?
zzSes_{=Vly1cC3_1lsg}w2<@saxS>p6J%C2leNTsp#O4$)GNNUu;|)&U2`ORY)8Gu
z=?aFcC$4a1O{s1`1W(~kE^t{jc%Wh~%fI2{;jx%<Nr`vFy+uDfJPfvS8k|FQ%@P#Z
zSw^p~r*3U;Y&a!_@>%(00!PEa!`*#jl`%}z7zjYfjoBsT<-JL)u2%`)boY)~SfIB~
zN+MNw73S-WG*e^WvU6Js<bcLO?@SFD8W=uJ`G=>`29Cr{4%cAH!|)K^5Y%QzC-}80
zVNp>jZwo3Dn<H+BU;yv>*IA$Av%!C!;f#4xqH{+({lwI@Eimz*JF2Fa>^owpqd>i@
zRx*N=56tX}!q&pC&GzEh^R-5XN4dD|L$25kA^P@mqMiaq&b4s+le072_3!X|^(VOZ
zuA&yg39{8-yzZ}q&jKF$bT-o9)sj?DUCtvT{r<U4`d=ochO$IDVvx=%PVBmo5g5tq
zNpiMD7=Gt=y&2c%y2cUD=H`h@Dh3821%kI?fO##*>TjZA7W(Eu1g*}^wyJ9T6n<kP
zzEnK$=8dRgqMOm#LG2@3=uP51rO%^KyIYi&hQ<8jw)Q$Y=4YQ|+1sSejh6ZhJq+#s
zT7@2~VL6ntM83X$khc6z%t`Dlykl`ujQ@xY9XDFJ(up@#N)wYEH}SahlYjU*v|~Fs
zGb0mMlWpOLh?l2q`_|6RiN)dgqcfapRM`C(4;Ah0Ih9j!{wmmfkp5av>mTklZaq?a
zTA$shj}nS_J?go*RL?-maCmgk999L)r{II#>$5{i*+Gx-&YX?4K10JxY(^nh2zN`q
z0b@5Rk$?&*K#<f;1P$7Sb3SGH#eo5E_UJQhu^lD}GTn~UC3rdWvnO*nE7rMXjow}3
z6VzYO4n|GJH;%Uv@zL;zA77nyOG0|YT}ORt2}3WYGBynby<?_Wn)6(Sh%iW6!rp5;
z=?Ur?D8hu~$HK;NKJ14C+!pAxScIhw?R_ve{OnZ~<#iT})PIQYyOL3Ce%%9{2vg<i
z%dOgYm^r66)Bltb<8hAiN?(?(ap<4w=B99%+pJ~>S0&VgK(7a^#-^8r9vAaV#Se~T
zLYY%re*B=J>Ez_>ATlF`PYt{e-6I9Wp7vdbcO(c3x<Nk+HTbRq&Mv_)xKTrZpw({E
z5?JQWE-bJ!vl72!a+>nGZSwPaZ)rcTXUiYAb*3)-;H(>392r?OEgZebMX?#&03do8
ze+|Bl*uksf8q)7g{xgTxG1XFj{bA$exXqe#7q~78fOG<m28qwFGSAA`9st)pC&3`7
z<`0}puzR#eOV!?7mizW{V1M7zoJ<36bpdMK$SW3UP0jx45&74zYvxD84m7G=AT3yL
zH7pXmu8d4fgl9q%a(Jp1o_7MiJwj%pS!Ol-t!o+o@p^9VhL!dAKaea_{TF8T{%aHz
z1r84J6-g6A(?-R!WDa{W9urloAvbQ@aFAz17v4^wdokJ`1w59$eM_;k6G?ILbbjf`
zs3^kK1uaeaR*9?3$84;uc`CK16Ng;{WJPK2{;*Cf_cID~pP3B5RkP5n>wH@f{nRyp
zm__{hV0>Zhbs|jVpQ%+jbhT=*n`?A2v`0on91-Kd;qH1VN}@V@(jf%#^Rx@2GgZ#D
z6%~E0tpZxTJMdu}8U`b02`p-Yy#l-&78XY@LVDoJboF#E#V+OLReFvJ*X0lGt6puk
zcc!dfBO+UwZXfLp@AG}_e<VJ!df<F+(-Wjw;IdhEe!Tr5gcCxjSy)RH6k>lixg>|f
zNIy2)UmwsYh}DhGn2BcaczAL11%K!`Yb&$fUV!l^gRPa-V?5ONKCXr7Sy@@NwNoY)
zB9PCct?e@NyM<D-@~!#u&$k=kFo>CdA<iz5R_ah;uOLhXSnSF=-ozv)E30#zi@QYL
zz7~7pi)8K1zfb4#a()R}NI4`A=X~{wcy%2Qd}Fs(RvPXV93qZS2#)~F@_>y=USSaG
zCGhrw?Kkbx9TH_Ut-fJg?>w!qwjJv4uS8pJy|`yW*uJ**lF&43^}{|`r(aBvJ}j_?
zk=GB|xBlr~N2zzZpeowm`{;JF?Ohu!O;=$l2kx`P(vp&RPF_`TMF9Mx?+LHDY<<Mg
zVn%P>@;<mC$|~2@t)FIaja9xC<l^FfKsfD>Tv%$M%;7qoLh1;3T4{+@>+RdH2t0mw
z2^OPmPSrC5FR18SHfSZmePns-cS}b{sc~=crq-ClxiE`1?QQ6iI82(Ug{yQ-JTIaU
zlf`j^P2FX0mk9zm5lqMrY|T_y<I`2vxrs8iHXozIBWJ+cteI`$haR8(UPVnR9g8j|
zJG-sC{8P6l?t$K5@b#5fqA^N6N263lQO0E=!1oX9;-?$hDRm|qA)$J9RyKSr*f^2S
z&Z70*PL}I7nCXu+DFQ{S?N)P=%^T)DyYe(-H&#~U<mB!@#!>}f^vZoZbJ2I~&vpg{
zaZ}465S9365a7$o@)TBWRh8XrR{-)x9F1e3z2dkHm$Tu;1s+EKLYrqAGifJnXH;u<
zGk53N8KS|E)*BI2*RA~ks}f|Ye5&|*1H~T^?G2wo^2qeG!p$^6v&yZy0d6Ra`y`Y>
z$@8mx1B1@G#>VS@9^~?&mW-T`Vv|sBU~}@-Fq}g4gN-!#_wRHw)vj$I*e+!9@}eld
zy0Gv|_j*ue{wM#keEXNwjs@6Hk>v#86F;uA)8^q?ta~fZ!dGvt;cWW)pd@707wAeW
z5o2ItAR_sW?<z4r3k(j}%o;aT_F<QRl>svZK-w-!oo|)B`XrOltM!PNcfR)-@-&Dn
z9Itdow@hm%j{I0nw9d4+*__SJHs*f2+YEJezMNO0>v2gwq{XFwMjha<^$6yAuNMid
z-e%OK2FwwH=&?JN7?0WbX`C>m!Oj7bZKsy{seragxd8TozP5bhLF|leM}^Z8PyMG)
z(QV?ilJWUk_37!nLH=5O*%Ie7)BQ#EDNnU+%7UUuP5NqMScghWN?l$Se4yUF*wOy2
zKq;2`bOJJ<lj=`&da=rk&@(wqI_!2$U=AkmdBLsKBh}I~>1)PSsSYWdWkyw%QOAIN
z@m0d|=92e&a}MX<V{>Wej^7YN#i~rtTmMR9HW#})8uZ`{)a4Le-gBh+UM89T_;}Ia
zwm=hw$d_y6M+=@aLrcjWm)^Eqp*_e8O@+OOvnjP>J%@HjTa$%$+7~66uBm7jzbdhW
zyko8yUL$_m)_q?GnI1X8$5d9jV70QixS9r*NaS{Bz(T7&zQSR%Fj6<U>EiFM+4y!t
z&bY$4jp8CiiZ<7J@HZ>UZ+el<Re#)GP+ZH8(l4Jk#K?T1RIdJDH&#Xbm;GE=;q&sc
z=jG2B7^Z6UHanO2nK1v}Ov>nFm6;$7sY9Dtoa~jDSX*^Yx$#I|L(v|io!Iy`#HQ30
zq!yi15IBF%y;XVLkaxQO4wv2sgr)(p-23I~5lHnd8hBr`y|-4^*7gSZ-kML>H8m9h
zV7dSBg41!t4LEPQOqIETHl(YaM~P|$O_=kqzV|*i`Htr@VCCq@J<>tPz!0caXgA=I
z$=Hw5zeFcHpa9u{!SySbcgyQtE;0EG;RNEjE$~v(AD7;@(XsNcae4s`=rdjr{LNu3
z6LgVum;LJBR@O*)6XPjb_%<?%e*iu=HJKerSq2{4^!VM_O{=r{G0wU0^t*S0L^f3w
z6m$l1jUA6KKRCjKlT(~PIgFgd!R%K}dTws_3`2;wcX>+6-0w|em^L<`Eikr2Lb0sl
zxzgRcqhl?!ec0FeGc^;X`uIobK7Y1^5aE_bl!f#1uN7OH_MKm-Ns7tIRX`6u7-4#Q
z?)Pu-GlAV4%$oa`Q{GxwAX7`M)?BEkPl|!R0S#^DL+nMy&B&Bu>eAA?k&!sZwp;ft
z7%lz~TK0&-)%N%Ivonn%j&gj{y~;j)dTVB8BRfZV!{x@CH>FLfO?d}j>WRx362rq4
z6cjSbjuhVDWWOG)^^A`f0}^UU$@i4cr%!OIzDR*<YVuJw+V^Z@2nKmBT_cTt<Awml
zs83A9C5@bgij(nX2{<}B!nZ$`Mnlfpb)*T3sYpl=)O2~EkS#$Gp6PzDN=UdpQ@_sV
z>|61NKkM!eiEwY!UmeVdQ#~Um?=I5-3MY8|5n4HD_uqZU>k2J2Z`O_2pDN0)5wgWU
zeg3?8myRI=xV@tzqFqkM>1f#nK#s>=jI`W$VeS0%xEeO-`<t!vp1Z25Tu)Q3=I6s8
zD%?|q*k>s5iY@Wl{OJHuk<Hw5<!WLwObK}byr<Sh${jyO@O4eG#s`*~GM8}|8F>j0
zgR-(|&Zwa`yc;G(0WB7Idmid`o=48i=b?WFn%Wx?ddlO={G50UY;4fL7#SILc5D^~
zzLHlw|25Q}s;#}gi8WV_^i=uo4TO{9z3R0S^VOis>c>uHg11lZ0E|4$J_Pw27zcLa
zor|+iva=1#O4t^#YOYeHhB}v*mN8u)e_xLbkH19IGCWI8as5m7hH$Iz&dsagi%I^s
zbadzSinm`}-AcwnxS0IRg@kZz`X%UA1Ap?>#NHpd(SJVPzI0uRf;dEYoMh~BkaHf7
zz8e466D}V9L;loojk`5neOj;hPpumQ!e=tXe?9N--`qm|qk#J_4@B($8WRcsc%KUW
zA3yM4&wM2J-&9rz2+zN~P=5HYC;auBw=X{b*9=M!PJOzmt@2-=_36fcQ`Nyg-@5nz
z`ohFh-wn`R<$TXk*U)H5{S<+nJ^0^VA_5|Z>#oy?fExUuPdBKk4GlOyyE5$DxK)pF
zl7KMliZUdCaAJPTngHSI^u=F7!~eM8|BtWs|L?bP`C9eguYPvM0}Als@Vi&-PzP-P
zxjhDv{=Bv;=LVC1e=1*aLA0}Ount^AIETP#cc_0PG9=_ei}tVE?waY(MPEyblZ8RU
z2a^yeIae^AJu}nL-~}?yg9m&0?WY<C(!{gGlE=@&OG*MdW>c63ifVDlsi_ao4{m;P
zy@%~bMM;@M4x9E{A$@%a_UVz?$}Lf(6dN_)q8fm^_TFEYrFS93O|&3LNll$ar&i}<
z%^2P&<Xm$BW2!6~S};EeO6C}<4M<36S}a(Fv9fT~aC;Z6s7Md5<Cfh-IQGRZ6j8tp
zFf18?GNvk-{3Qkoa?*3%_JST6GS<WX-EeQ9wD?RJ1WP?)S5Z_n6A`3q+^Zc<$>1jU
zfzh+n0STsWiPKW**_p!zN30alDz8I(h&K3v;^62pXz3+zS>{w$`c^DzMK?U;<ExW*
z5fJrqha@}TU@|c!C2?6^tdBCBFoAa_yolIGXgHXdF2`G&zJp@WFBR5LjB^11YaOkw
zs90pNZ!{kVb4PlAHF64?peOB}ZzL67g#(QDUMe0G$|4zq?t)HuW(mS1^a=F=f*8Ec
zzm?AhUypqBF)%P;`Oz{iEhdI05OTcD%s{DW7k~O#tFD^Qq7eD?&Z&3shMu!=ZI<m6
z;8my(h|G203K|<bAJXVR=EVJA!51(3Twi}FoI~g2^n}F4gN#gEhD5+&kB<beXCC2l
zb&OKJU0VAF4Hm}jIq=P^bgC_jdf@iNSBYU`qBd}I)$bn7E^S@uPZ*HXClK524pf4@
zH)_OL!!>sfooOx4<w%~E=9@R1&y}#h`D~sTYpK}VTm3BgTuIW$PA4`7o~HRTC0SKf
zS^SG_3>x8)mq#ZZ&6iIv_(j`^7f?~9lXzV}?hS=%Ca!F*>Kht%efR)GO}k)!`rDVH
z#M|<Kd*0i7X@AN&YEA|-j$XNjreB@YJrYXZ6GOiuA`g$i9R~33lbfN;@1V%v6`Po>
z?@>ed<Zl{rd>Y=7c6nV;RstNTpLU@xYX^mJ>eLQ<_=J4^EKKqgDa>l0hL~ZdTWvIv
zK!Y0tb1>}6<#V%lu()fS!`aWmneQ)L%WvHd4UbI5VZEOJ#tgLm6Klikkod=T=aaG=
zTooK+oaPfnWvN9@v-wx~&&h%B$v1uVI*X5=*j3Ty{Xn<zi5bPc$?qrt#C&TM!($uz
z2^Gf=f$1V^4Nw;y-!#E@B0<M}XZC)Tn+Z76T-t|BBTR5mrpqKzQ)Zl8IsZ;_=8lQd
zcC@wg@D#auaosn{4q32WUA+>HdnX^~?X4Q_3n>V38~jvu=56-t^aC#mAXR%=N2`dc
z+C*qQu@3nhQ(<Rjb_4_wXq~mGnnz@A)GiTosVT|}s3<7JTjQzWdqbh~<3|e-PX%PC
za8o?d?RT>q;&1p+U^`u-z5GOj*R9Lw<n+Y4#F`qLal?m7gigD~Yxavp=Sv!x&`!yQ
zMk|b!SY)`@Di|7eK!=@>_^Zrx9JsmD@soOPsi|RLPTtt$+?R5mc;p9-QWclGRf#nx
zXXQ>?GlggXN+J-}k7nl*Z5*nDkH32Wp4w3xqj$QFsodPsQp=@XT(9+34S%z-nL8mt
z{qv2dAaiYuo?BQ@ODt#{@6Y{yBJ|P-hFND>IQWN$_f;fE`bQutYb}!LDy<br#O9NA
z783yytE<!oGwBdjH0{QJ9gs9ptH9_m^k{JIw+2H{lj;KuRA_(Z7Zi<+Q5}FkU?x)*
zIu{bzHM(kWeGqCpDyAT$CZPHG(D|@zn(<3|R-N{g)|rE-Z1T6?i@L#&w2QSj+2ntf
zcS=xD(rIn4W9=+SPBt%AL-09Pt8@}0eO5W{SuZI)eX&`084R_?AhKmXYppYwIJ-X?
zI+_VpF7~iI4_Q3NvjdB=n>dS+;G)%c?RufC@kXO%L<0d~-s<`tgm=LkXJ27|SIS#a
zRZ_yx(8Z<alLp2L{`@@V>#Q3L=C028adE02Hv*<y-O2r<f>C3KmItk^zr#BL#K6vu
z&cicxjVv!Nd989vpOZiU|0$$nz=FyFBuIRG)0K?=&NX6lC}2s~lZ?+T9(_i}Tbi2c
z<l%W(#X1RNpj|ygG@{NkqH#xtgaq38(Mv{(h-m?sWV5k6pDr+~252jv<td5oCuqEK
za%yfT(syBF`Yx`nW<SZF-CPyBa(;G+P;!g6QO?-T-X89#mKHJ>|D73Yg(+zx^WjHt
zVPS!X*M%$}W`t`UHRu!7s~!9UOP%Mu-C&x!ZlDlNr)s8c=E=~^wk9atZf>~4*|FF$
zHwb^7mzoNEQy}P$*502)Oh)?QiL`?v70V+erlu6Au_CG_sXzIfmy|B2l%*6K=gpao
ztsUUMdljr8Oeq<O^6sz&dMezIQpm}l8Fb!rz1v))2l6|_XQh;u1)#>3m~}tot0N-s
z>Y_CpFPZEd$g4?ZAtzUn7cg`Xjz~5~sJoBhk9-j2x?-YI_QAqJ_Cfs7mGj7jXYs_U
z)op<br(3PwUh%O(;u6xLT`{piCzihxU_*|^VxZG1OE<@bVL?b}s9G)CbkB%<a3|Sw
zTwY@c+ufNTs|4P}3v^*cQL{Hq=`kuOr0=CpO4T;*+{%Hd+kXk+a9q`um4CFfFfX(e
z>+PcSMFX7h@#BdVEv=*5KDn#LO*I}~Cr~z(o6h*4o(uQHz%V!~EA=R)VAc`OmRK4!
z@dU>|*~*hcL>RP)Q$%cx?|>Fx(f~Ycyn{jl?KG_76YafPO=^(vL41iP@h5N(e<>+z
zAAg$es1598XaT2)xfM7~Sjj@gL4+3(9W4`l{~82jgm{ycm$L@f{5!=%Dl3Cn^_ts)
zZ7%y(%Rl3NgL;944Rq#5yj)1}U50vkAgV0{a`GRKMX~q2aoa1i4!?hO0Go|ZeYgG|
z8oLhv=eg!D|JLk@n0w+nwWGxo?43v4L7>puXn<MwyWc%0#57QD2BfFkK(jN`LmuA2
zoG#*eBKPI%kFVYx4<#g4i}u3CEz^%T*Wj?BmnOv34@SZ5-QX_3I&}RHWuCUm|FJU9
zEB6@lF_T2F(T9`vX)ycyf>IpyOodZNbqHiUe9mX$a#$pSh%sJXRc>xIU~wxG{Fd(p
z-<X{bsD!q7T|K>}@ws&EW*)9xrkzBpGQYjRlA_t^ZR=(K1mT$dVKHDRor<z*V=_tn
zm}wVeO(h7S|2$mKb^lYi$V@0lHZWWKO-YbKDu$$iLGJa%=lFPUPbmR`xzg-%2rLq9
zlaf^~Ofk1@`xLv1#L5~75ivU9(aXIW^S{@ufB!-rB0xg%7Z&S2Kgo2McKaR|CyV3;
zk<?nx%~w4v!X1nBuv$G~3M(QiEucRg(y>@ywsClj!ee`dt>~5eM;~+Tr6)rDE{TW_
zT0AhH+%B3{uXONDX@ChCIAy(i_YSPrN6ppW?@)4Zw3E`&(Tk0-v9nW7)r3V}J~$8m
zV`=zhXE$7|Z{)@wZJCUt<Eeec`CHW6l$6U!&XWupd>NVj3qRB_eRcKM4b0xFC@DFf
z_n>msx~IGV5!0RrIgp27Z=I6G#f=^s7^-w3#R&9<IlR1z%h}KV%y3dTEg+vz<U*xG
zyvxD<w6lwv&o#+q|EP4!fs3<hRUTDXq~+tsqC8F6oXpcPTEekuY5`~qn<zziBxJi8
z+Vy<UAgJ9ktYg$ny;ZXl&e(s5qi}V0-=Ie{JQNWjzsrrw`X&%W{~*-LGz>22xPYsI
zu|R_uXpeX-tv>uob!;vo!vyx-I(U!CUM1N~{HMO}BpAInrXd8Rp+9JGk&Fzq&Axrh
zB&8(<b7y`&76O3~fU2OshbkRMZ+JIl4iqPU^ccyQoXqK&m8&Pd&A>=2oLqgj4CJZ%
z$apbE?QLzg`y+>NGky6ZdjhiT%Pzlf-}L&DUFvQ$36k)xk~T2R&dxH8*%^RR?hny_
zL(=W=fdD$W2oAfFtcb`G2yoQO!vT-)Ux4}_)Ji=X9G<zcot-^Wu5m{C3wE=!M6cB#
zruw!(5}$PQS6;^`Go8&ZU%y@uBXuGEt(iLs*`8l~#*iO!#X`UO`wa$$UwGQ&6AdGP
z0wFnl7foGGuDyF$Qb7pP>DEv8Ge81pZk(1f;{}Zg_$cBrNr5cgqO&>Sm&xCvKa^-0
ze}75Uz=GkeID$>?k5&Mr0)ZOE|DLiEF;6NsBNUV{_S4tXf3Sgd^J?`GUYv4_T4xt+
zR0Q@^U3f(NG10j~Urb+WDjL{T1|2;E!KR<z9uU4qhDHt!THaAUAbt;r50Kd-l9Ix#
z)*oxW1+BV-M4^9iHH1e-86X*J`}y&!gIGpORS$%C6f`bi2$4h(@P#o28Vi8!T7wRT
zG;iEOFc!mb_lzH^ErdGY!Gp)gz*k+yTaCH>pE}l)Br-2poBt1YZyi)+*oF@pAP7=Y
z(%mU3Eg&F*pdzJocZakfCEXzc(%mIpQqmwuBi-G-w|?I*c6N7W|J>ObXP9vghx5MY
zd7tOLulovARHguAFid1$TdtTX#KpwHad5C1`ORr&V&Qyws%<hsb*TyIG=kG^cJ?^{
z7{740BP)sn>0x%Z(R_5ETu31R<>lp-YW2?dYw-`aNrh{qmdPi_#+VrCLEn`mZ2RCK
z?bZK{<dxjNrY3U)`Mt1)FpUJ*WX^%gw4OvA{Sit2w{MsvoVp_~mJ?-1pZf>m<6R9!
zpi;W0RmEyTr3MRawI5iyK)u5tGgw~Rw$0CD`hOz}^#8yH(^-i&vH>ebFLKR>@~aBB
zg+dZPwXajJkNk~Vlsb33l9NT6ZbAcoqVyPU^FLI3b6%j`5euR?GZPaykG7?w3JP>>
zZHJ>xW7~aYVFs^<++A9XN-uQA_W(-v&MpRG;Zls9a+n-IPe#h;@U6a{<S3HhFYruQ
zu$uFQy{Tptpfl*;7#SE14I2f(%U^u8vfmsTH7}sXoM$xT-IsR&-a$u_O2DF$@K(@l
zax7`nGPzgiUbM-d#Xmp$`)@!H*};Hub#({4R(3?{KH+LzNkTenuPh6=3fdglvM!js
zEIL)!;Fa`9h?os&NYWM+B_))Tz)UX)K3+dUb*Uw@#-MzS{}1pCCGP|VFxRQTPsazt
z|Lqx4^Th3Ktb{&%2rU`J%*XD<VU_E9?-=2*HREeve_`eL;1K~j@N0h{$pXU{0vI7I
zB^B4{f9f5z3)CheqohJ3fxH3<@h`GCrS*4NnV@t~*epv20?cfko$b*>92^sqbJ+p8
z+iu^;T1(&Nif*Rjs;Pa=(9htX_yqkQ@N6(h&%+~Z91iagF}V;HR1`M!jT!le#_oKv
zXG;1Lqs8{V<^@nNlr&Pazin#m1hqR~;}y<MOq|azapqeAc|1><0HROEuqut8b?WU$
zNOXgOFKzIhi2LR0=A!!w>q1lyG-xGZ<g|>w<j=?Z!@rf5zOie5vR9m6QqtApWDQ=)
zpuMJO#&)ffQdGR@T!5y5r1nE~c#5<XQhk2DS=8(!Hu>3%?&UPwN1s=pF3R2K;B)2Y
z<vj^ePe>%5esmpmxhmYs8M~GXOY7#5lFpSPW_S}G2*k%<AAkuBL>h8^=Q1}Zeltv3
zpjLr%G(;-o-V}B!Ev}9#8rIT+u_|xOKp-uh13cOJ?(}pTzn1~*JfuIlm`(MK)6%m`
z9dFPx3y2gT#y9)zUEoK<P#oxgqG4aYgaYmf^gK#R$qd4`Z!ZtUU}ANceGj;Jjdnh2
zCHhp;OJQBanvJEui!(Bono_1uIUq?9c3c9s1{c9~lXt*Ll05=!bE4$x7HF~5)q??%
z0VaNT3|o`IuZPmJ3v=5f!p8hwcEIu`SS12bB2n0Ob9eA+_CZkieIz6#aYo;j{^8zU
zW@tD#Yv0Vq#6*)Lr{?B{xE(X*<|2DV;oxJrUf<{mPSx2S%qSqO{pS4@82A~3$b^=W
zad~~70*VVwO_3jZ-^<c2rp{hx*GI)Fs8rfTmzSHpCn~5cbnx%8lE+BqJD}Rw*!U|$
z<Zf`AEG^x4b-klHZdvQ=@mJ}%JykD_mGUa*-n`EIYMhloVn~DY=m=6MOk|TSpPHNh
zMKcBAJHC7Q2@`>V?Z2|ec6qZCtAjq*6NC10)vYZc)lb9XtBxND>MX7~f0wDr{NkU=
zu^TuBPJC^1tvz~6i|l!GbIXaz$ys><+0mo#RL`a@bXa7KjdL23JpB@2QM?DL>9ZRX
zZ3{?T($VAkPKN}-$_w*lung=@t-o_lR2f2vV#=H2qTANn=2O_&nwktvX|w18OwMRB
z+CauTG4bTjQsnb=zA}7J|K&jKFfn1GXQX4gz|LvHvDfwa#fzVN)}|8P5-(l^j)0GB
z{$~GI0qfP>lYSLt!&jU0xL#f@OG_Cw{BOa17buq&V~0Xmb)Y-<@`_lqLRG}AfY>qM
zN~;DJf7UEnTr1<++y<s66g$z;OR1^za3I5Ovodd!<XjW_03%^^XaXvB36k_3qn(G1
zI(x&0#@Q5q7U%KS&M}5x;iE1t;lf@814&)vhgd)YVupr%(}^F5AigyQ68cVLsf^Dq
zCDlpRYaQcHYavXuFh6%-WJKJ9r;5wv!{maGmAz1;&XiS1R5_OyIS@4gvSVa4IXmOy
znvf3-^gp4bra$C4$jW{OY+QjvNWPU&!-l;LA1KZclslYxt*WZJ2P}64QOe9~W9}AO
zgKb&g2yl#c+@6M<^@w$}L|#Mw9zhl%P_bMej$=dL4qT?c+`ij*4xSastyUE7?zcS}
zAA^)iMN$T!%Ee-1nhYAF4^i4AtUn=_ZQ!GX{D^moVBov7EJJqf%f;MWlyX8s0`w%#
z8+ouOkLK~NP^_pd4Gj2takTOK=T93Lr<X-e?njrb$t$SF{oUtP@Q$ncmq}SL|B&H4
z6f8+gOG_^|ayS&Dlj22mYCGWrv0}^-(fx!+kk_dEUK#QV{|MNWr+u=0Yxj(dHt2@6
zh{#3l%H+lQr!~&jM<D>lx?f*XMUwunD&E^XMxzo<7z-I?jyf`pas>z1<B7*yIc)Ny
z9KbHGvUuNL^I)=8Mx{hlPL6`#fbhH*#2Zc*eZ8l5jEugg%v~TcP%;NFhO#LDFQT_M
zEi?DC9EVnz)ApsbZ(weo>B#5^RDE9moH%e}Ae}lMtYiL&YnV-4R`L)6_dLk>HK-n;
z!0rBdZt$p1(A7MDGn81sYWuS5_}IbTzSrkq9`LC%_!7A8m(WY(HxycIo(=*R9-{4R
zBzvGa(5!d%>|1$=m1>tPJ~KAf)Y{tJ+A1?pc6hYMOCY$p8(zP{mSk*c`8#dBgH>*I
z#C&vggdCXzw2=gmsr&#9$?>J@H%y$C?rx&16))&Kz}q4!3I|wHajQPiz?VGR0jO<W
zCjz8`z&c3FSt|pY8)!4>UizPMIx~urxL?V=esCBJ{J;?6X{iBs1f*b7)3oVY57eu!
z<2)@UPh{G5@q{m5lnUQ{*_$W${ETqxMhXx~KMY=}lP4{(wii|wlob>Y_7Cf!FyNsF
zh$_Ic?-dM?25_%riyl21sLd%w_5z&v@>l#qcWePrW15SWpE#bIv<KSdbNW)!(+gT(
zMuG4{VVE?fM7h$&-}HHkKO`sESX-Zmo~PAcZFqii8CWnKZ97R1^=ugYt9Q207zTD~
zX0EWu%+Polp6^S7Zo3!@$G3_jt+aA7^77N=_UZ}>Y4j3iqsa%77dO@b^Ug<z0aNR@
zvU;FMM#F}^KXTwV5i-HLmBm#&9%J}Mm34K~yy{Y8{dRy1^z-^kLH{*SFb6;0fyk~@
z#J$^TpCC;Yl-5^A8~AYOA=>H!-zRP385~6akJ3&N`{fTN?|vSeUp&NSQ+pxUVf7iV
z6vU%wgxG{QPaK?D9_CA8=L_Fz!U4YfU7=5qqHe#T3~Cif0%-?{D?Xw7h1|pCel#Kz
zhs9OTvK9GnRFWXfKR!Sk12KCbo09rVA+w)jkV$#_c5{ZzLsz#ueP8)JkJf{OUjlP0
z_$8i}k@mA^&tN7m#OK;x>u4Dm(1_94^|N#E-Fp`s_T6HOqVt>2*NwgfY5vU<FLeS#
zDlI@%8THHWeWf`Ri#Yh$npll;uXg>~PWBHg*sI=!V+P7ugP>l$hML00xo1AZ7I{X-
zYT$_lYvG@P*G3YL$OtXWjUCqyUlVR6uyOtGYGLTUZeHsGyJmT@q0#1u(zzxGO#7|1
ztybv?gK61{zPtC1KK7(I{TN;yzZ8*StJ(1L4|OEn%b;DW69VC$O=)MScY&-7LJn4S
z;VP&YxHK0de7b>x?fvq;BwBO0xFOKmlndXz*wtW9rCb4}ORA~h#YYg(At9+s84i3-
zTY*|-;7=cDwB4<<i)v@-si~(1I>&BqE~`bquZ$-GxDDHK)s9+62taI<$n$G!0!${P
zNJvsrNJ0nGlinlNDu&+vCqt*zuNA~2WodPF7bSgZ!G&da7SaE&bkxmY=Q<JQAck_G
zNyLvWR>S62ty(UKX(L%dQ3*v+_DNZ2fR4U#Yj<~S#D2lH;PVDkzLxg(_UrYE?o$q-
zal}z~^j05>=>}m7Gw4vL@M5@miNHG|sP|d3-@{jY7^E|zTXzCYh9)Kg8c_n@>2iE9
zGMf@~<>n%>@Z=$Mvk)J9Hv+kSdW{}_7D7^#;YvkQt6Doz*IdyR*#2Va!CPI|*8$a1
zbho_`<YiyFl$&2bxXnEj2|J0)cMJ?`utTp_=g;~BCS4Uv#`Ek&$}1krDRXoES)tTt
z-m~-e7(omKw+^$<;kr*PGcjJrZi}7gH1Eif5nc+T5^x%P&CkCC?PeS+(<TNEZWKMv
zYYI_{%#=qkq_^ycK!a)(o%VCziNfk0$+2)tk(_gtA8B;)|53Y&h5_&ko~?Pm+sg)W
zYyVk@n4jre7%;H1me~GQDlc@uI@e#>w!Cq4yl4=p3oMfYU3|{4)Zp!&%gZUKf(s{$
z@9daZj#rYJBd%|3RGF#EQ&RNx%^Dh^AfwpLV&?1}7;^Q~iqep5szYxM$ff7{F3&;l
z66vOrJc!JlzwS3p^_Z03kbTwTKtdXC8`n+mU$vBvxg0J7v%~fqY@Ey2dC;UlhC5IQ
z2U8yKCqmjX;pOzwKUJ>#a13{L;>F>bE>Hz39kH=UkY^ZBX$G-U{)g7{WwfCu3?frJ
z_nO6BhzJ{am&_VbDj&WA9`mj<NBWaf(~eAQ?7M(`h)W#+>CK_QYfuYQ*xW=9n5L^^
z#Vx6qOv<b}9X=pg)&0aaH7IInZjOti^)LobW`#Fz`8?*{p5&C~A5r)H>f!`Khr^{H
zp(HULVQQY-ybd;?b`X&+XuVG#uKt3Ekg)Q)0;}RFBH4Z@@iZF+1)p7~mDf4Uq#W%A
zsxB)Ua&oXp1gA<&4}K~FYl;Th3mFADRgu)=g|4oU3DsaSP^tl><Kg)QiucgKm&ge?
zd-MA3pEWFQUCGnZoe1%F<z-~ha35jO#eW4iB*G&(85cEGMFuLWz!=#Yd-Kijg8;>d
z=N$w32f~Et=(iWH#$F>xx8lV9B9sz+UxW(kQXgEM?JrfK=a%k=T9#(7-kp#Z$6VCj
zzk>F_?6(jJe<_AK{?ycz-AywKIyyREHCgZ4#aFY-JFLEVVB4Y%UId9Gb{LM9b+UNq
z_ee*#a0iMot#Mwf)JmIKJJ<mHYJL!7zxo~&)Y@_G^Z!xeW{`CLM~Pcf@;NGsOUbvQ
zE$e?*rEcHX7G1TI`6o06dQ*ddr)Hx&pZolPU&|e3e2h)I{|Z!>fcM3rAs8EdmNPn4
z9ecR1c+ZO*3UPjfKnC!E86O+_h$s&{X%gWYumS~DblC@5Gm=OD(K7=!!zoKh!<wE}
zMs+rLg+aEzFpq!zc+?T98F0*!(Zya|#Bt8JpS0~xg@hCz8oF~ZYfTxH+20E>C$c`!
zz6bB4x_;fi)i~NvQ?oDaY+|sykv)zT+42cOFw&&BRT|7#=vGedvp%bf1?@I8TeiA*
zDd;@WCcB1<UoBrm#5s1vnGC^nt_9dvrlUoe*w`mW1i1Sh-rx<^5kj)6!OXjJHJl|+
z{UhFT&jj{~p`m^1tH)p5b8~VA+b29z9-!7fo$6n!c>x^uWkJDNUPtiY+YA_-HK2#b
z`mu+FnY8g>Oe0;<QNb7XFo2B2xqlpY(hT{s`xGdGIEQJ}aC39>E9XsrblyBNqilNc
z6?pCmum&uc|8XJS%9h%x55y78xc>&{^_o92R`H2sG4HEQ?&C)?I?_Qx4kb*C63-;o
z>TStUo(ue(z6gKZ?d-U{o%nP{lVdj2qjP(vZ1_0dFe%<?`Tf<7qr(ZQMbg$*54g{H
z%2za8FEl5g=nVU6Qf+M|ztlObEi5Vu{VJ%zo@~bUZn}Ob`mzjoOFi+pioMzVPPv9M
zn2j3vNn+0#U4dGG?uekdMpv}U{foQAvN`G1%QybMzDlo}PN82xt<-$R9#g1N{$Wip
zKNPonQx)~c4<i?h!~Cw7AI{^Nv(b~Ev{__R#VyBkn$CT^ji<tkB_9vH--ZrPQQ)|s
zjrVV;*fkp6&kCsbHnYg@3@GR6zm$~~eM+|37Bh-BZK2OXOAAJtwrl%*o9bL#j3DL0
zo%|^>>Os%K^!RjAU|?t{H9x&)?~PTvj*JXbJWjyp&!$F3*6DNV2K=E{EZ;Y0%3dld
zvFgl6eQOE}IY#GCbcg&=&7G!uJwIK|%@aReG)(M%fSGaGO5;}-3q8FagE9q8+BC=b
zp30#i9iO5tBA`Ub$e5CttGl_0tCP5y#ePn{7s1yiuXmym&A|9GS4NqcvP^OIw}91o
zIbUe9;CF{KLmyiAJaVer?6&7>QhrHgB=5l{*Y8}5?AxG`gE;Zg;e*4Y2hEv`ptnV*
z0Es3z;&JhC*cLlZR4hC_96H0De!tL+!pt7(Czb-6s#8CbZ_rK3wm3;mx=)c^MDwUY
zrxpH*$h9CtQ;MuN1K4i?AAVzA$=GxwE<R2^nMX=o{D3_CrmC18qn7=6sT;@Y{5GK$
zG8w4GTT;dH7ivp$@2J>McYO1>cBe6VI5vcbAA5`c_NB48J~mMq4KJPT()ud2)3MqX
z*X|4GWP&BT9UdRZURe%$KSl(WaLvJtm&V%WYC6hMP=mL3He~7qJqWh9KMD?(h35Ye
zwd=-{urpV3Oya0$MKg0>klYYFdPGPR@32FFFR`N|e)v&4x*TUG7@3}&8RJ_?Nr?;F
z^ZtAaLNT1C0&U=Q1jwMEp}EL)w(+v>W@sPbrtgsJ(%XF0rJYLyufVrz-qVU#tP3pX
zwvQiMv#@MsF3XQKMKx7x>6rOin6>QeE$qw?ZqHj=-R%8H_xAF-T#S0gRr9svGebge
zyQIvG;Do&V!O{JPSXhYl=HlXRGBWaP1HXQCK5oe`+%Cav>U;GI*GNxmYJ8lJA=S_?
zr<ffV!TbjU_T}clnoane!fb;}>((wMTY9Fir}{?-yBUcXnlDIjKsra-5&52wj>#;z
zC5e|8*ky)|zaVJ;PF6Omi>WC&KF7(d$Kc+lW~?8~TZ)Wv#R!+q^T=iOLS|y#k!js9
zn|c0@4W<l0=)1p*LCXItr!pobGdC$Zas1UyNlLh_h_Kv?(}(+4iz_Qhd@d$p&%MLK
z22xkY6YG3$*^{lCnB>OGX0CJ&5?6sjhJ_`6d%E#%J39FFz`BGGG-U}1T(lOMF}AQO
zTOgNl_ZWZot6hN{9DO}Kb8}x|cbnu^XM8+7jarkt(Tv1Z)@XzmipBljcend7zxPS6
zV-j0AkG!uck`MS=X+OMO{+rF#wyZ>;caI`Rcke>ev(`mX@hEkk(rori{2AV4&913;
zbGCc<7aW4e(?7<TnFOeWu12be74=qG@@kc9B0Mm`zLq7y0j%|k)JTG_OiuS}TxF1@
zeRj6_ZQ2j3RXhh}miN_C`my&>JPtC|!KY(2nQd6(NB;Z1*syG$ZlKAB+7~Tv^D;7Z
zJFN?I3AaN*gNm|0upw*k-fSuWZKJY46<1lI_1iGGGqyk`717qxK}sRIlmSs0i@`Js
z4UIk(750j@1(bp!tVyi}H;p6mq6puLrb_2^xbOnoO6I;aYk|D=RvuzLa#MJdp3RIt
z$0W@)k2qkLT1HKLUa8$flaujUz5$p?#zv+zOG8)dbmr!Hqs*jyI^|z-`H8eMvKkH8
zbFW;zOdfBi06jA}LASV(k!5TA@;P?w>iV*2iBNJqxLys><iYd9l*hQfKGW!)I6C!9
z&%i*A1C81?Ao;mE$<?i!Kj6db&NOig55uv4ZFrfQMr0CVrH}dl?KW1|E#rQn&hyQ-
z59-@PQAx-y??%4>mNqbQ8{H3no>~jG7#Ql;cdsYa)jMAem1w$Sprc$F?^JHvXxXuC
z#&!rZGs!@#9kJ&+7J{|?-oWUPkj*B!yfU{te-}9;BaerLorJ{rxNX+i6-zwMoz^`G
zlZRud)ke*4ieBsXYYKh}Ht$F4s2U%gUV8xzj6L|-NG`BS<6zFoh`z=`6GoK$nCx=c
zsDLZTnxAsLupXzcrQ&jQo)Lxrx$)AKvdMBPT=!~1;CkT!ftd&ds{os6sB|7~m|y5l
zwKa>_9BM=|20{zAHseu8Hg4-z->P!1=;&B{+$GLOio~dC2xIGQzvVxeJfbaACrumK
zLwg`*9OnKpD8*mQh<2`3y?Z*X)WPfpRP;~sV<EGFwyfiA>&_l0$B<!92r`^iBl^!?
zHF+;D%Qq$p-jjPXZ;ZeZFN@+sNyC6xBgP|kc;EE`1maKNs^kPa99+<M%kJ{*ZH~)W
zEps#~y^@r4=1zN|{QK!GiYE@bZdX#<H0q_LhwlmxYGJ$A`E8MVbE@68PM=TqmCkWz
z8YKZUrN|I@s#Gr@A3-$a>ii(@cMd3Hv_e*{uO>S}E|WqDBqF8nOH<S%=H)3odzPMC
zQ<@*;xESN>8>*4!N-DIBW!2Md8x)2)V!LRB9=eqsu3L;%V;v=^>Co3*j&BbMz^vP#
z!6D((;fj7yZyRf?x#i_F2yul(RX?<@TD;t7zq(RkQ`;lUBfE^C#`ftg>3RElUz{QQ
z?Cex}8?_}=jQWG4-7h`lN@>K^(2<Rnabk3$WzXupX{dN)vE-<w%GNf|kfB+V)?~`O
z!b+X<(SDZO<bZAPIr8P`7?XMz_-;y0es`}ejd;;>9!=aW(&eIV<!#lfFqc*Ld~u*>
z3HMSWn<{7bWOJI8k<s^T1gXLMGzg8I`|*YG4o^P*H5ss!GWuH80Gjd_8X<nAq{Q#o
zeE2xcjfRF=fPW%c*hR-exVTm~w;gM2WCYP`XEvlUDgKPdWUh3sRp?0w?R;K`H|CJC
z#kg;KDA06>cnX$7I%nLfJloda%zydNOi4x6idFPXLKQLi;&@IxF)Au3CWeQ{7mg%`
zvpMX3uIyZsuuHzDDk@_?hcb_a?p~msIwLta*k|Z26TN@`o-btTil2te2mDfTql;0m
zqM}_M9*d7rLuxwr<L&{50iT1|ZwqKGTwy&7?vx}Xi9X)hq}xgGZ)~HH<f5#+T(9qv
zVHMZKCCldkzfoF#veaD2?<i=NvGe(@#U;a)rGx8&+<<qdKXSSlK7%gh&fvGj)qR!5
zhzuWlDJg;D#lkOy;H4(6aL{ehF)=~NlVE;+)QlK|H#&Vm$;Wb9T>Sj2Pxg~F>d)cf
z_s5_E8d7$)YOZSol>s^`#$w2kIEPO_zzhBf=QBjUv0GT<eDPF*lE$WM^R@cXIF0W*
z3UX4W>!*Uu{v7-II!j2*2uwFED_|}&h=}0V8wqQXXEW?(c{Yg3S@0Z_cbiC#beuaw
z$rNFH`kURfU63}C&(?vO(5>Y@_QzyRWDzoC1TxTr;u}_hOf0!^7wJ)Gb*+=lj`EfQ
zJh-^}ikqb*u6IAZB1|WP6F>D&f^?#KB5_KF(Zh$tJM-E4{OTc+Y1#_=>qp)77khZ0
zFpp0kNFIeGCe-l0Vv>+zN#><vq@yd#{$AYRnT3@-G(Ms@OWygJp4cuc*$3M#iSBfq
zz|546lG6Dwwum-pdRh?vIc`pQCyjk#d#0)?A)`RYbU|`$6%xeYW6A5DU&PDBmHCQ3
zJMy`tq>`c{NwCiSR|<-nWVIDAOJDlZHf50O=@||R?I&jebb9%*p38XZ%sdWr1tFD5
zFfH~|xr_?K8G3JIY<z>sa|Y}-^y9urx?Vw>AkI|Ns!)3~7pV?-aH}oRh?c?n(&}W!
zd{aXCH&)-Y5Mn&SuIb8@ixuw^qdTCKDkf8Ut$Mv}ij;Ap;^D~K-|dmO;vdI0W+?VB
zg5R4?&v_&$=n#hLb~}&Q)$2JN+J-8ysXD@CaivL^R9bdtW?mJgq|nG_q;Bj`(_|D6
z9w3`~_ZrN4SRtK$o>G%~CRGr}tt;GdCrtyXk^A_C@_r~eC1s7ULqcZean1MWDPgw=
z4SZJ$YFu~N=l*P^+=@WC(Vqz1!O}5YLH?Q&i06une|jE$vFB(3^qLKq(k8aytiC;~
z6TyQO>BH4`IEYS&>gu1oTIy_9JfzrseSBkMa1RcFz4sY|t192%t*6kBTi+xqD(p(+
z=T8(cZ?EQ!m0Hf!-Rl$GZ2Q)P$vJ#mYdiabxlh~9xxZS))_`TIT$_$C{j*pK!YNXk
zqq@4_s$F$Y51R}(Yz#wg5sLkiuBJ@yNzCi@hF-I%<QIOOA~qwW$N3pIc)9f$MA2%O
z3jw$?x;bwdzf)3B%q?K=UOL@zLfV_GvcyE#JGd`aG&b>|`CflSbOtN~t*VTVMz^Sk
z2blPJdt6=ihEz8jdwQz0Fj~}QKN^}cCFlqK#=%+cFjwoY7sPH<3=4mX{GXuM;Wq=w
zR}f!3hD0kN7y7>HWynmK8MyOGsH*zxIg&LQlxb#Wz^PZX=U7ZcL6IBk`1JkzjX<y~
zrRV*P1!nrOta~Bj6HLEGIi3WN1UYD=)2i3m#aP+k()rvw_l17S&-a-Y+m|n{h5n4G
zSJn6KNsdL*ySd$|Nq9Un^M<)UGATDF7lUN}qXr!8Pl|Ww$6^mzsp_FOr0;)B>0$XP
zb$H2_uNvyg)c4V*CZ^yk?R{gh+muYtM%RDpQG7Q$IXpZCq!6j2Da7ieXdg%FEk3o8
ztPmo#^dsGAMk02O4BN%z)<X)@D4~BExYSkl0|6aP*K!B!4!=fCaUyr{vKRl^V0u0)
z+WzWUGjAj#6Vp@wyN5s7v*yN<4GkKWvX^c(T8~BP85;7B322AD<>0M?iWMJC`!j}*
z*!@IIPv60!yu9E>+q<He>|~eJa}<79^ir`^Rkkl)zTA#hcs8S-ZfaukUKL%e2x1%%
z?gb&Oa61}?y=*(o(mUN)r$JxvZd+$$WvKhG#(b8xEBmr%w9V|87=}#aW1Vk7LXyyr
zt%bbRzPOkLb*4oj)gY7S?dG?P+;eNXhXGz*^O<M@Id9h|?7Kg(em~eJuGPNc+4S4t
znOd-2=yFEArq-=TI1QbxF~;W!(Ni({psvpH=vSEReF8YYeZ)S$`@X55u<%)-<66*h
zqMsL;_)e>6%dj5-!5RQ~^WO_IG75?ecQ?->HRUh8u1<CbNw^h{Jf}PQFug2StZY}d
z(I_Y=L}slsX$^=)d3t1fv*Z&aqZ6Gjt6GU0DKBN8{MpDmBPH>g&HFjHWY`zySJ=?g
z-4DgLY*x1?iP@<-qb7gMtT$G~*9dAVDgg>=;!8-ET<*WZy13;Y3?vyzse-36J9B9+
z8TxJB*6WRAaD@L>mnIX<c%wUN#{QUR{Ad^tlQ{k^hX%eFMSaHZeTuZ*M$P9f!&1bF
zS})OHJ~Ir0#XXXS+0Xv|^rN3W$)7*Bic7W}I3n`6a$iO`Ie==&{&50TYgVfAq1_RX
z5<sBUqCo58m9Ji}Jw87oCMI-__I1hMJ{J4<-{U`0TBMO>pl^6D6cwgyvM=1h+K$64
zE-x>zBgTBA`EEzZO`YM%ocbh&@P`jsxiv#GeO=A&V}ZY@xqiY#hHmGvyPc}D<nsGK
zPbD~VU%pJXn7%G0=VBANaJaNDdOd^OBIgpFo0*Fzxa|i--P!(2-%L@d_ZU5@x48>4
zb1h6caYVzsS_CooR`xYllvqQjE3W<kq6LCe!6_j=$|+Bu>_0ag9Cj2GC}9Ib6JFa(
zA_pru1j8$EJ0T)f1EM+>k=b%FaT6Yh4QXV6Gz{?+39{xh>YjtoEb1->%vdoq-E$H*
zzse?vexj4=d+u@Z4w7`dJLvT@io`x)XL_<{dDpo|wx{T|dc+B8eQc{n_4u|S5cJ@s
zQjr=PGxOKvWFnrFj#*_z_4`Wu4=Yi`?t3rdFM{kB;WXIP<op+aBxz{^28YTkpA&@~
zosWKg54IM7WmsBWE%ELJKQotCuYvaONYb0F-O65<(GH7h2-FqVy|Ti0<WxAIlEN7E
zs3+&L6MHu8SF^$E#1_4UYhv=KG3gZ1rEREXVx*1g@fyQPC9{Rqo4BtLanXruLZiuD
zW->cTkBSMnK6rOzLxu0HjSY%q-QQ+)AI{XwSz5cA+h%4M1n5u^y6Fz4A@H_qy4P0v
zFc*R-VGjV$mG9LdMy95DtE7CK@#a#YH^d|ru5Oz#Py!7am6zzc0vQUOY}}9bPkV6V
za(|!(e(lkEg$$UI4ZRskNx_1q_jh#*=FLV|S8plNI{QR-R;DinkP0`j5kf?7u|Epx
z>ytwg$bvMu`T097)s+7>GP*RE8jI1MGpL&NOU6b=d5EvsTu;qQ1gjmcO8qYA(a{uC
z;xN#)ZkJb7%s+ahvJ23JJOvld>)qb;zXpX-E3ADMZ*vC@eq`a@h4fl86=uBirV1jD
zV3LI@YUdHKKPoHbU}nkpdtlu}+IYQEJ-ne?wLR^2+Bcnm=;QR_1!MC<3nAgU<#dB2
zEtMJ1Wc!4Y=4_Z)3K)BV(PR(?x~YYQ^U-;kDliJI1g@PwdK5$2$<IJ)G&B~Bs&Hn!
z+A7LX^?GOH!|W1MrMBr>vgGUIV1NJOP{(hDAr>veY;xsazL+Rr+qwvJ<mNJ3F$z&+
z$&oF5pI;$*s}k3*UGnGP(n-wNSo#zra-7-0Ng^J|C_jD}OSJj8#t-Oiws-#x`K@J(
z!!O89efQ>_pjOjUk>qbHpYM~qVypBPJGJ(0@5>X<ZTp~Tm#EUokxKZ$SE*8=a|M=K
zpeKjPp13&e41BJy`%42J9HZUwWm#tTAY0p{b#2xoW00D7lLTpUVr#5|Kz&Yzmd0Dm
zIec$H3|eE|QI?`S7mvN6<YNc9*MTv;i6XecZTHn|-fD*fzBlaQTKELTfUYriMFl~W
z)C!Tj!T#d>d($h7lh@g6{&yP^ThTtfPP{&@IC<p3li+r;{qnFTD(Wy`>G4~}3NYj(
zDmet>TF{|*C*Mc9bmzXafqAJ>kybX`Y96)qjUwyjv;rO(X=xa#T&YX)kEy&I%ZT`0
za!DH$#`K%DrZzMV^C8fFRNuTYv#=N(9}k(v2+^bhhiy1b0FbeqsTmp{=eGKmQ5nN}
z{4`4V4wPB;%0quEuky-L7DiSsE_R^UOBR7O0@{c9&JXIyK8FD<NRx;^YSJ2Vb3PT<
z-KDOTUv$4(riqK8dV8uzj&o;OspJt+0?<U}?7Xz*7*9o_86k`u@m^=e4gt(9sBNp<
zx=Fe1gTb`n&PlfsTk`H_1^61kgqX)*Z-duZE48LL`;XInWH^;1r^zE9pEF?cdR{Ng
z>etn~u#vhwVk#>r*eYVe2P4_h{C6G)|B{_^a&YkoRh3V!2N&4Be3cbJ#QNA^(@lx|
zu*_oIdv8u7tuB$+@6)u9$kz1n;drdHFSz~S=6QStWq2I@#_FnnqwPX$n$UY)VQ#nc
zv)!5KZr%Ehb1LNh^^tC1*lOS9*%J9)3p$P-qel2(Wh&~Hvl*7N)wlC5F0a~yi3f+3
zBtv%Zcvwu6BH5iE{P1R(9F_8xM?($XM9+9<v${JIY%L^!nx3Htr+m8s%B8B>n<tjd
zv7}e)M=}p1A{u6Hv-TB|kdS<q?jLO{STtqfP3R3#Z4~5it*M=SzM@_D$6rJIt}gZh
z+r=u|jlIRUYW-JQ&tGXFt1vj-G?Q#%)q5M0_ZSzkH<^(?VK6QKtt?{=u;3@cj?)6K
zAOu&iI)Lo%YOR@heVNgZx{twF0X6{K^QVw`I=W?zEk?_#UYF^z9-*ib*T`z2h-Xk*
z2+iPHfRBv38lqPS45Wyk9AZnwt}XMwQGdD6IcV8#cGW>4t3A~|!kO7m!a2c4Z*_-0
z@3fY;E9kDR4F?k=6D6(O?X2GR+3LNG&!jA}r_+!!TcCm~WZ9PrJ#*9eY7Sc@#!V^N
z^sCF&z50-lV}jvjNhua7%=EfCyQ2x3aXujz`T3n096YS!qx<j57}4MAh-%NAqvdt_
zdEflDIvh*k&YNHE(?D3CpKs$7zc-oY2;f&Eu@Jl4`X-$1Y-;=mllQ&)B6bfvpYC>b
zKEK)ciRjU2-87n?O@DDPwPvhf5P8Yh$Pz<GOz7LT{^G;=>7SJ3;xEM&1xHyzlU5Ic
zETtDlmBSi74ZM0r!4(Nxd{KV>`r?zRF6$5a`e#Y?lf34uk3DA^i_}Y9=YDmSxwhW}
z$iN8PM87+k|7y`+y=z?b=JyX)v;_A1k6tq?DZ>r-6tC?nGMFxQ0{kP;P%c^iU;3=U
zXe|u>QeU5;6Q8gBs}`=Cioz2k?X_BSb9V&lu$FYM{IXZ8=diOJs<b`W+ab*EKCnkm
zi~N+CLsjcJSeXQLyGjx3_up{XIoP+g7sQFsIq#<vXxVG%D@ttEEEQZ5A3SZhfZ2~)
zgU#SPnX+$C^7D*0FkG12`(4t}0NmV9!%cqZ)=h<W8=ITYkm7;aWli*3Hi5%M`j8RD
z=gy||A+g7;l%t4$#>O>W;hZ0j_F1Xime!5(*Tnv9j;JulxKDxAkBvRhrU}oRgVxR<
zU<qmO+eBZ}GcZD<fY;+wjD_Od4LYk#-)1*@MA!u(40-X1D-cV(mAGJIjJ&{@2f$b}
zv%ZO+a^&qu^L-I2DOcPjki9XpiTLeu&V8IMlGOTJU;Z_O`K-#}=z#O+S9uj@G94{3
z|D`_d$6^_pBHgo>k0?k;wouayLQ%hHnR5Ob7=S3&g-}j9jLi*c3isgj`WMsnhNjO>
z%enJ-KH8iv^n8XvhV=f{olmob7b#3@sLagF&6F>M)ZI3ZVvQMA??{Ukp{9gsygnrl
zNj{&wP{l%s7dA&fm4BYiX0?IM=*n>zfQb%At%usL;YUyvdA?s;F34Lop7gH9#>U1^
zMNSESd{1@K>lS&_X>)qx-D#0>mwq1FNCILmQCZnK@CE3rPsozH2}o>T2s@kXqDo98
zp^^*=Q7yxA&0Vvc1tu|B0RzVs&a+$eHv5cEsw(X48V>ZHYBP>BHDza1AQFWj1bTU;
z0?6eqO4|Qz0R`nn4S!7=jl}Fbau(`m+&mntEKFxf&s)!(@0Hq}1BpeNloeQxchlC_
zbAi|INdpuy0)j8Dr>{C}QR6<B<U~cus!zKl?d?3zOi{Kuzrw5x*m?HiMf;Djs9uBm
z?hliF8|ms+&!Ur(MBPO#-cRyM{kE(5nwt8MM|P|c1I0&2OY7H6-!sGY=c!qFY)mr!
z-Q8GE#+)2+SMg(UbVHxErRJsGz+BwW)*Aq?!VozP_nDiRK)^pT@a5HT@$g8EETl6~
z;KlpQOoYLiIVq8`@(w+c%Lks9u@q)agzH~&bJqc5htm4?J)+CXG0WRrvf8h2`#BXG
zD1I#|G5(;(p5ocef+nRYits5&_y_Ob5{VkcCp9DI)2p#3i6s6t8c=NvOJOM00uLJ$
z{rdtD2r!2PD;?;e4=$^Vi;Kg<jnUF_L*?Q(+-tR+Bp6PHZZk%k7-_wI6(?^HtyV<E
z$Y@}qBbkBHDD5$VFC+XKbWulkN45tx4TfUsaKFYnzvtvI@a`n=2MjpB4pYX&&r*E5
z?-=z`6ZuRofts0%!%XbiWg=10Y&uv>Jd<J(aXNp(<F8%x)M&-(55MaVcx1oj-9Eju
z!a4V}xJZ(nL~JY%k_X_qg$yX$Dsv8XMgUiyww%rnoh8UWB=y9Odu?UnEtX<rx`q;n
zjDI-p<Tw>(9PBn7y(?oGEa2R>vEP`n>mt#4gY>cCCtD{~GS)Y|4<@+JH3wEKRFM(x
zcxtVwS1}_D^<Nh8YW-rlkf%fNx<vhgjj-R?cT%fgq*kl)_U)e)?DQ<d0elP91{f)d
zYza~`FyKDsO9xN&upQ`MEY~6wFEBPG9hvwsY}G6EdSL=QRcC*cEH~YVHr6jjesi<d
zN`4RX@85e${`bdOm5#QBzK-CZWVtp&ygp41JO5AR<%cs@0^j71Z#bcrK=v}5`OY-A
zmWDyL4(?G?(~>b!cu-#6$kU<0yIkM?_8#xwyLEc_7{bKndL+dd-a6f*^FLV0VSl-D
zPQ7~}zb06M8|c^9x*my1N}h|vJwT=af~ZU^+ZT5C)cEnIpi(OA3+Yzw)BJ9Auf5Of
zDf!JyEzG;{A=i}u7*KZJa24Mccg7m~N*?BccZvoVWATR<-ShHBYBgEz*8jYs|6Z8q
zW!1<3+}QtI=zsrvP5FO(-2ZhCJfEK9uEzNMpI!$q4|7MX(Wm&|?$y7yNZ0iI|LEKL
zP|_87*@9;YG(4UMA4@rA`u{JV9-+l^*YTQk))@8g#h}BK_S>@e<<1=<_H=yD-urjX
z3_WMb5%zcPxi4UL-gx}y_W$?R{rAWJkMH3B^Y^{j80hbx4T}_DMGA`bs=}w&`t*#9
z)@rX`zpkhtNX<=!Bo{Eto{_;v*uO#KSC>;!IZc*B{JSch{Teuxzne2YC%av1fQ+!u
zmT6g$kexl2-f3L<$@jTTH<&dD*lxcCjYy-IFS<1{`j@9zsoT?4Y32EG3xz>JX3uvq
z@bE^#j20w1(p~+98nr(R%A5jh?5rR=Atx_yyv|<e_`Kyzro7y)SQ#qNn4+M0rbI46
z^Wz@G_4Rjrd<0S<B=Z|p^<FS;{P8)mfW>?=uE268o#bXK7EYqCE9!osyQCY9PBOC7
ze*CvJP6}EsI|w+&+@n@h6e4fS8kia=wfh8mz@xuM<2jof6gV9deYG7bB9HRbz<tB3
zcpMcK)pGn0yQ2sk5<IT;+0L_S6IL#(MFRZ&;kozmK?3!kwPv$CSl2Esb`lWdgN+5Q
z$I88UwJ^_Op0lA_VbbBlcdo>F%!6OPaP}qlkBd76<n3k9ORT>E!TWQX$Jp0uG77vF
z3nmDno4)+{?@G3zI|;pU_}&<San?UKzq!1DUGBDW?_OGs#|&VEB6fdNB=q$UBdV_s
zB>lCXVAvj!E>s<4v2b$-HH6(<30-*j?UK<#d}C&V?DfGWLxcP33ijgWX1n#?z?_gP
z8eaBWlaI5f&7b@r<pFr_fW|l+U+zrZ3u>Hwf^WzRt~+460E2NFLAM`!A0r`Gwl)if
z{R*}UN~5(0`2A7Q(K=-0oGRp8Z2%#j{vq=fsAZt1&!~R^fs`jLsdwBJ#3VaUbWJ&_
z?Zg(#RzjiUNLo<R`@t3HIf{h7&B(|KvP(+j)FMORl+<nT7Fj7{%LA4?JUXP_sLkD9
z>l)7lFtLba!Rf}&v#fs7NGG<@%z1-}sPUQ_XK-|+3IFWD=ZeeBdy}Sq;J92fJ1{(Q
za)QdkTNU<AT2J5b$82@{K4tg<!TSV?>xSlb+RUK!-1MjwkFR{qMSqL0Tdq5p1U~Zj
z_Qg8k^m;;oY}-*J+al~k)KW)8@WtClQsqH;Zf>FT{^E68_ljyhYfHMA)oSZVDXhMY
zW%V@45C#So=cKrAS%$^>3l;##Ez%$><Zv4HysvfsR9NVl^EuudA$Z|7ichKbG>^#a
zx608Ny89TQr^%F0<TPz}O&X%6p*HOOYH6aAS!DUcy1U)Lzvc`7jp}Cek1@NOBr2E)
z6A=-Z8n3yB(l-zM<{Yb7_}KPz13%|;b@h0wZ}s*>gJuY8=mE9_B8>tzCl=Q0+Zuif
zaW~8%=&X-TdA`KOH8>}}Q+opnrgGg$VHOti{f7wIFQ}+=?a_L7o^yNHi)N1JWoO5K
ziR=3LbH4NbjkXPF(DtJP@g(~1wcguiI$d2`Pxun|Ilw<my7Ct0D6J;p9})k6fb|gb
z3qL+IsUnc%a+u_rnwmBxZ(C5oqPFbNOn%HXKUFP)jA&xA`iOww)6MVEQFfC@dOe89
z-qcepN}{5JzkbNdzO9=b8kiV;qokqnDs0ly(i_<qiq7iljPD;bD}r}+#&48WYMsTO
zopO14SQwa)3bOu!U%Mqf(bF?E@W-XMb4_7IHsC8Q9o@}o*HvGk9JFN#yqh?g?iCA$
zGhefzGXtA%z)@o*u{A68f?;WI-VH(TV~S~ez|JWzC!L?0OT5hG+EIB0D{agW841-p
z^LugeZu@r<5pPL{lA4E+5A&IkwkE6xrh6lcqQbC-n4sDROE}aUZH|sN3fQ{C)}Gje
zgu=(+^2Z1C;%|OVO}!Bn4PQ}z1uCQ5Ra{VKQ&B}i1K6zw@v6Msj}^jJu1wIMm@#h4
zOTT=nuGt?Jl<gt(cNx1)a6`KfOGjMu`E{S#2?oqCC#$yYNw#0By*-5<Ujh4|B9He8
zUyW9>wJix&nL%2e*X2UT36RH-(e7*3bA*Vc?9!ww;|QlX`Ukbp-F2c^tf%yryT?(z
zpiCP-6MVO&PGAgUvcbM6!{;dQ*CH%O|6OB&%B_q+e+AU$6b$9=^PnS01q`12PRqB%
z=S5yxT3TC4_Ep%v&nr8gnnpH}-(}ON(H6h2yn^R|i-2U)Z*7C<dT&MAuHB%mv_e<%
zBB}Ai^3}z=5Wg(hcp3%@)i>`zf#6%uDx2}My9-9y?td^>*2N;8OLv*g)>PHi2|9Px
zfpg-0+C_oSL8ofMP&D0=34mb$ujLfCyX&L5ect9%CGG14*?_or$|vsU`ToZawEsBg
zNGBwyXrHGlsX}`CZ$#eGQ0RRT8mI*1&n05FH(totcnzNR9gdlKwPq<*=_T8|_a()E
z`&{h*AZnRdl(~C}goVAtg#?lV$blp|l;>AR7Y#$jzk#vc9#dU$w$^#i?u-mGLQ7iP
zv52|3xlBxR4oRm6GJK%`v^KlTWV~7F4~8lKuTeZb39pEV7ZUp8^BD&SE&^i^tFaV$
z%xLd6^|P<AaC=aysfXY|O-&FYLB~3OnMR!~H9|bkks*6Zt+T$G-f20|U?7U;qakfj
zvdT${h4!zW^Yc)xQK$ax<WC(wTM%p}_|%~IsZoHGuRM{Fh1348LHHUz3i*_n^7bYZ
zMPDD|nv`Q^dIyDRc=j6XjMwU}9J`en^n^}+zgI78*%t~?lz!+tTWyYeK3;+z!}e~5
zg;ry4r;;K3%0)^_O0({~Q8L+~_Y2{dCl*&8LZY4&si``!%}RS*5Spb6l;3>NJN;`5
z`w<Dm3jjDIL`GKVjD$Yzy@%*48}fBdOJvhY=MGRiQg^#P_;u2|ik&_b8)6b`?|K?1
za9i);F~jAux}+ozzlqb<#g`=}=oDwDkaa9qzS}r$MoDubI%JBT53tCjypnV|GcagC
z6b6YmAt51@1YB+t#4ssU9gkm)6!&`qPe5mP_sa6pOpP0^=^IxQGlb+5z(kWQODapX
z%f`VeNTP^3i<*xQ{r9hddG?pEnuMf+uD2G$MMpoC9OP-KQ}~EE-89@2k%ImefIW~9
z=H)Uai+JpFY#}<!JX1N{zB+Af+(hc5@`U%ax3L=?7=Za+wWEkIn+TGNGH@qMqpEtp
zHJkC&7PH^{tdN00OcM*}+u$#-X$S{e9Q6F`d+rpzy3N1;dp6`-PU@hM@Qml(UY3J>
z+l3u9{3nS|d_E`3ef)IAPDh7d!(5-9{^YvvWyqT8r5HJMtw&Dt3S8Zwy~f2|BF-bS
z(hx0WMEdgnLkKYys~jwF%*oj>zhYMJoVRRjJEEiFV`j&bjztSQQ%}{C^}f`D=E947
zcH)=_=Mg0p3lk+}ZeAKMpG~`8s6DX8h?NV~>c<MUGdhBfxjDG-u&|uY_S+I&s^WS`
zG4fMWZDeFn8|3lmsBRIXJyl6q<Zimb)J_QpxhlklXe8-!b8#tXP`AxiQ!vS#5c3&)
zjCZn@o`c|@!3=^Y_KS<FI{&6jP+fpX9n3eWdD$kXrfgQVE}#d3Dxvy;E$8FM;+WLz
zTCSjVhv+F_M`9ri4h@mcZD#--a(4Ie<27TQA%!GS3gCtSV>2QmSzq7q(DJ_Mb>pWr
z-BvLwNNESHfRyux`1p8bMa3i`M?wV4xpAFAvI#VMI~zMtUdc&2k$RlaDrrF)k*aFW
z?`(){oPafb`!`JF;o9L3!Vz9$e?jO_8&jJAaqle|jeTggHV&lAqf=AF9xME#%=b})
z;hgwzx=QMd7_IdBwZn;qtA@LSW(?UPlhrvgGY(3d?P8qgatv7PS68d@TBzscUF=g=
zl>!$t@evQh)z$`pKG_H@NhGt*6o7dcM6DP>vGB6@CAe-&%Q^?tGf`1(aE{LQ^juzD
zoZOcu)5c!jUS^=9bKE-DOrnySd_XugG-0#Qj?2YH?kJxmoR0DuoXyI)Dq!-`mv}?+
zAnEl7!V(yfv$jqd&2yQvBm%02f^v{VEx5>}K(Rmv@-IoY_(uIma?bGp6qGia*@~r>
zpEhCa(as0Qid>B_uubCAP4e}{I}b{>#EcwwI1im|N;c!UsETYHL$lu{*tl^y`C6Fn
zo!-ze7j25)oQ*3QmO9_EzRt)UR4@8Og<Lmaa#A2V3h%a~NmYM{)1N=vt$uPJoI()0
zs3IT2boIH0dtdN-Ww-Ww4@yZd*X=<!1Wz6ihk+-?c}_E*aCO?NaSIUn`~tHk(n<Mb
z!oU2x2DxX??BISSh>An50eE-DgomRS+8W)u#0Vgwlfu`f8t#zawv`I_Q=Ic%Bm?l@
z;}C~U`A&S~2E;zkFiiXJfs<PA1;D7A*HXjnn)2EK6MJ1!Y^ynTU0hMs?W$uj>Ic-8
zwqs#%_n>}(bx~Tz*`IWi*cu+pc$uFcl=u4v?%p%Yy-Duw!6mo4E132W5fO2g&1f`Q
z`v_D(G1ziyWzItK<%zk?Vh~X6R%3nABC9F#m2TUh4aFozetuC_SxTa3ezDqhmD-pv
zZ^TBXs><(p_-MdL{$}re$M4=yIvA~?pdNS%;EH0>mTkQ}XTmrMU%d;oC28rd%e@tb
za&5I5*S>z<PM3U<^%xqQAtsdMAV>dKbCI5Pn65?0cpP%~TBi1xB4v|XZfnnM`SSY*
z4$CFZ+;#=AACM|N&Y2;4>tIFm*xtVR)xA5wA5#Tt67+SGntpMvNm1->6JJF?`F>kS
zZX09*+R4PkJE$v&^@PS|d95Zxg0tyj+0%am=t6wy)UUj=bxjH*y%Kz%oL|{KGGHzT
z>M!0-XLdhKecWgZBs}pqZ(b-XH-00Jo$OuY<k14^D+D@ob3Zt^jYlO^H_ub(6#fNa
z+dcoL*z!isJ-`nMAZcF&FfxCms%l}P!{ZP%3;7?{H8!`WqSLx9{U<Xsa@4^+nT17{
z_t)T0n}L1BLGl2<ii(1;uvb54m+pNy<7gXf9`Ec#7^8v8DS>zUje=s)#jC8ew3QvA
zxP40Lk9PC;wC?<%5gKaCOZ2NA9T|ZTn0N2TYhaj%$&FpHwTtTcU}PkkpI<1v5i0ZO
z=;#u@HV?%3+^?7qg&&(e3>;BZ(x`dj9G$R%yx(;fa}+W0FZV@VUiqfAga0)amWzNC
z3=V;?^j1kR%<LHA)gi@PQJH}e5H`l8<t43(bkBy8(oz&3v6Swg2?_6&6r&Y#D2bIZ
z5e8rVRwJvGkdO%OGP~H_YlT%yW_gprgg5%z!znx>b^hX{0tZC`Ci$Y6e|`bTCiZu0
zriQH<Z$|fWf8VwTN#z&sFYrrvKr&BGM<+7T{r-(uX+wj1altguv0@AS?-)FmBY{vc
zLIOg^os{8kgVbfEv-a|yUl0&|r#!6uSY>#5tKNnw-#SQ5R981H()hSHGoOt+KVM#h
zVed-`amrK=Ba<v99(HfVM@L4YqC7a;O+g1FNoChQ|Kw3)P*2st%JtazI0QEEbvhTP
zed>nzbXZ1z#&vFEi?#Ui@x>}f8E2c0quIYwP`=sv@%pWnsAxm{_{Y)8(e-t<8O)s$
zch1aSaZCp%r|LE!Z#;H~qNNr#=<gegtN8^5rsn3H15>4`rLr;#hA@VQ1Xr(Wdh!F9
zUGg7`XTStm<(*0>!IsPR<qn-Z*-nSp)sEM!)Hi>B|MvWGEpz>D9ea3D5Gu;i(fuIx
z#ye)$f0UF`DJh}eNoL7tl$tmd5=c1`^RKLwo2uC=<tWu($^d$4AuB0JfBCHUWjJ{_
zNid=I20&Y1zdAnW3_0{Q$p3&!qGa{EYY@EYCc)=VUb(TdQb|T;Qa{dgs=cBK1+h9Z
zI-|BWIKQwkDpKJQJXf%WIb?f=EeT4#QDNd?MQ>eWgbe%9fta#c6nlPWYSHl?2|4vM
zxY6=%@syO5e^FvZ_0J(hU6H$oSW-O#Bin<^S@J@tU!cC><m4=_W@2J0FnAjukB0D1
z-+tkw<>PM`E6rfQ?`Ku~v>hilCc-^-FIqXZG&i*@uX|u1&h-V1V_9LMZC~z~#BF;$
z<)rZA#}6Q7ym=KSW%I#nb`!Dn>8whDi+Egk%Hy*7tM!UN@<lwvlph6?@Ocm#uvWBN
zc`ZVu<)jx!Z=I6iAi<3ikz}d0J;Cc=ttaNeJ<0ktH8eFb<RvWM@D!QFidjczo@msZ
z`!PXNcFy+tCNcky=D|UyrS&#uC47Qu|1_afMK={i1L39?`&0ix4dKTdO5ggLJ@2w)
z$tHDaz4dfdeLv2uUV>b~{@O<qD&?>vEwY`DarR6D_un<t7(l*S+z64xGw*JupD$nD
z`~IXB9=?>AyC~6&Iu;fTOfvX*Slql-m!~Bm0#sA{@poHHaG8HYaa`CsUBHZ#Vxj8M
z_^r9pAyp?;>$Y(8i$o4%+V%TwK$ynGc@z;HxmS?gp|Z>p*Jlk=^R?luBo&9{Wjy$O
zEuDKndYi4225Tf*w!d8%!475$bYapIry5x3|L}z>rv+9JqOa1}HuFBG|GQUHM6&Nd
zmfjyqB{M~P@XCp6NWxP4PR{PO1o7693l1Sb)b|V?`XjHo^Hdo>RH5<48Mp#K34!A(
zFQzC#$hH|cb<H~WWL`W!KSO}1J?m!zC}@f4nVEYF^VNdCU32L3+$vSw?sx>fW2L74
zp<}PF*Dwh=<u#Ji0|OsG;G<lqA?SRGiELQuFyaf`UfE>sl8Oq&k9Iaxpbq96;NWF*
z>F9eItq2>zyiBU{%Yd)eJMMyU2uT7i;pOE$o7D=8jNMoW1e_C&efd7k3u2HoJWWFG
z1&*P9p=8Az8?~sKO3N~KgHE=oi>o#py!rR$s;*o=0SH3%^vxbBwn$=wu%}!ID-mzU
zNA&hzKbRf1mVFLl@;|G;$i(clS{!SR<4ynsfB$e?mob_UhrOY!Y~j~z;^9eS%da11
zI%DZ8pXHCYXQzMt$|f%=er(|f(m)Z3=W6&ssC=uSc=z^GU`PTlZ}2q}WlNUDcso_d
zlYWDu^z<H`5@4}&@NghT#)Kvbj(KR|XLDmB{F$#Nf{|;n<h_n)DC{UxQvqbGvp#rX
zXqW{g<*6ETptOV#3n7z&`+n*hA9n!<Nm0@JqG9drzCgHgSXfq!AfWhl>$F0;l>Qq3
zF`3rwAcOn&KaVgih_%au{nOad@MuT~_`79AckA4_{M0;y{gt2J<vR37`U=tsS*^p?
zJ``De8hadDZNPhn+FKi&lE+LV@ZA^yt6bdN<`WMSjv1rHQi3q9DK7oG92`RQ9ta?N
z2ZfOE|Csx=rU_%~VYk%SjiEMEsHs9oMZAY~&<@cu`vbJtb7^QY;Ih#VG59>LWo>0R
zzY7?JZ57eEiz@eStP#j2^YhZs>}9zLeEC8MMoaiT?*(n!FME0%S3Nxesx>btz>4gE
zX+ET?{#`HeTnD`g%2T#7#6wW4i?F^E7C!Zp3MFf5`ss$|^nXzImQh`<?Y<}~Ac6=e
zp&+4@N_T^Fm$Y<CODm~Jr_v3A(%m85-Cas|ckaviuJx|9&fe#oujkA$$Cw|cIN;Co
z-1l|;l1g4yMVnu1ZT9LER1i=o@kUW`vdZM7<fScOOcV#t|1}pkH5Z7(F%0V7&ltKe
zNB!yDHttKXG&6%PWT1O2^z|1)m(akq2_b*55PM7ew)b>Zx-HP{+QQZ~I5_Y3Z2|Hi
znVCx*ET`}|pFQ0W1`t_`pnCHtj#>AW{p2vmto{|uMF>gQ!B}XV9txDb#)gLGlMf{s
z>0ZdAMS-}?!!`JJa?THGAUIhF-!C7MTU+BtcTLn7PdUmQN#BoaHYnq9vBRr*PD2Cj
zS{&Cmhnf5$Z<o~tJibr>-}yJCp+?}JQJBrml$nt^<xS?QRAp&IE`7u+(u1BbgbIb{
zpT6#V2M}WS+Z9z*8}jL0F#AeMO19)_`#rd|+v65*MEBmQY|HoH;9e}RMelJ!T!BQi
zOjK8AZ@n8SJOd4s_2_@@A{7v<qqr1-u&h;fq@0&LSk7h<&9nb@8>8vsW2WNIVAXL8
zyGG^51pQqUUC<L9*58_~>Wo!bqRzWN&)F4YqN6{odipKg78Ly$%&!!a+w(OVnzeU|
z%585qa$wh%MQ*PvZKzNO#4vD$I(JaIjX|(V8MBj;uDn}!6^_)hF(H?`<#0uP|6=%$
zoE%404r%Ei$URiA<R0zrembKeD?)jolzV%HlVR;FdVm)KZfa{2C4R<Y6y#((TN!eo
z_`=7XHt>!+{ZS%0Zvq#kX+e+Nt(+5(nvW`%sWM3^$M)9P))f{4ovk4y6~E#_RQ{Fs
z&FM5s@-7mt#}3XK8f-snb{r-zO+Gt%*_^z5%6RWUYi{?uvug>9LxqK|<!4TWXC4D8
zqHf~Q=|zX@{H<l()WRYn^iprlDQF)GEFqDZS+zr3?rXX6+%aJ_E2>NI)PMRtU06(#
zp}HNL{(8G+YA&`rKQmKCM!dUSEaWY>F?4lA-Ei{tPunz|Z#6b*yNssRxPZe?uDUpH
z`>JE8ZO!idJsw7FX!>{XF6Vx^R!~$FuqrJrrBSQhZELY@c-07V=U6`9h9w~(4?UiR
z)s7t~uXPSdP;3rHM>gYg<Vo8;@%<$G$?Hz0-IvVDI{HNxP3*C`86L0-PGs{D*?52L
zdfx=V&1#NXT58W;{7F69bM0{dP)1x_i1Mn)wg?7@r_AljpvEr16ieGZiYrNNdl0ny
zxRloDU~+`u@F)msu+@|_#na+D=sRuAow;oLW(jq^hyzIyJQAyox;|wut%{cvFwpz*
zdRw}H#J9(Y@^2Sr->6k3=||R!U(@lhQbCXxrHw>;s3DqGjT49IVl+oFZfG|J$@O-R
zulNGAi=))`AC~8XiM*jv_4Rt!qDSLpljsAP(`PzO%caD;qdke0{YyK7toN7%GH&gf
zg&D|S(uKxF-N9vq>S{6yUYxWy0BRsAo4gq;HWew&%EJE;S`d5+nNmp<(g|OWU*RZD
z95hqTRBQkFjDz{+>p&qnxo|yY07-k8rzrS^*qt*GpcLuOg$F3ah<IwL$jE-=%@zxC
zP_hvabTm5$5(kWwp47`E|AaRYK9U9_`;Q?<O`X%#?v(WM5LR%qJth8~BvmBnj~k0m
zNyrf~$exN#x~e)mi*{a6qP%QZ_pAIkQM@934gMbbS8g}8taT(&mnKP`JY2O$x8Z_l
zKE4>2KK!k|x(-j^RgvZP*rPhB7$RikEtv<su&T7lUfv!}w6iO@v0fIExBl~v&gyUl
zoITYi=16@iis3(NoHEnSM^tQYbT2{OhT;Lr9H>xw^4J`5%0#H$96qTkJSv96b-rSJ
z*Q;PW$1^<yx^zGTcK+=7?(aTl5bEjcvu0<T?MFPMCKdglruN``t9iiN+q*6xSR!?R
z*IK%U&D9hDlf{=pDx&Th{hr2s#FXSG)UM=DsWD^cQ9LxN9n|>wO(sG|-n?Pd;h#(K
zlH{WdZFFXDWg@>sJ#$N>q##S@#@Hp^0UWRuv?_Wp1d55%Cr&ucS>qN6_-V*3-}Aos
ztp)JhOm9!AflJZiGi?$VHAjo?QOmlHsH<zZZ`*v%5tu>)Et?033>1k`eO~D^PRYb`
zm)-o{77f|aKWN#b?WvPhUX(ipL3f)wSI&<gKy0*M(O%|F3^c&^x3|)C@u{sKHT7ym
zoA<_j^RYJLh>!@SyVAAL$gB5xVWCO)?%kU}w-!n$fP4dBnvfPcpMBX<qsGM-L6C&T
z4dqcTGc$F@vlj49Fc>Q<vZSsrW+uv~{|F~L;qMPh;)Re1G1O<7yZ0b!=BvsnyP$oj
z0E(uRYr`N;04`ku<?cRdqARL0Ma(aFS-N!;ePrYH*oLvF+oS*G7f*7R*~+$Dt$VGV
z8;R7VT5o^?s~{HM4P)l>|MG?3(TS8r=$FQY^PLt7wPyX_RzRrxnd%Attwf+7ka$t*
z^C^Srr>2@Hga8cXcH2kb$0WV80CHV%ES`V^FRx4zIXrE@>0c&M(2jS$0wV;&Mx;J5
zn9T}HpJb)x8tdqw;Bxpo5cgOa8O^%(Cr$uyx!R=o3hW!gur*fxtSsHKb*JVJtCvyr
z3y`#P#7VM>iG8r@VB@Ov3k+3&R}`pBYl`+p^Wr&^J9SLQPbZeHo&u!V+nY!GAO7WP
z9cD{Cb7h65dOF0=ml}A*6Wzm?i<zkyL^BF1LytKc%|`s~q0XscTfM;@iTB*eTewAd
z^%V^w|E%G!C8Fo^!z{X*(XkIOAEwm0C3w3cFbh9;AA1Fp(ZI{js;UzL*8G{r<xPO5
z?-<MMmKqC*`I?$BHMjSxs;JC?0|IidKkxbL-OUph@0+cWyg94S2a%$O@7vQS&r)x-
z4^!yEVdJ4$Ju@&daP{oO++*V(|F@m<sXZB#toK;@rY0tSu1$P~!V3uMKF{rEH!QpM
z)Tzta(PK%myyA~6*fTO-h~CVNkB<``<{CHL#;3s0d8ebHs_2`5V`*;wg7zgd^Cri$
zaxnRuiMZ$7$h}q8t2aCUtp3(e2?^gDY0wcxha4Z`Jm0>Bc7t^|Cf8TPk`~%_CZO}J
zLzRvxz0clmmBYRYoLMdz80W^9GwMy6+z+<-5~IWA<h~}whx&?mFtIWi7EjRC1{*@W
zCosii&!3}GECN2GPOttQdYCyxqDMw}+E_ibi0qM2jhg3;ePp5n?kAle&k&f$i@JFY
z57U=f?r;PjfyxY$;MCc+U^Z;!Y~1zI**kg=4}%C8x$|Z!0<{bZtD?JEtr>bBK`Wh5
z%rB3<n3&kMR&yiz$Ii!F^;(qwJ};~x8I8Q2@58EG`s7>h*eoXqmKVHg^A;iE8mfzU
zSnGL+3#&cP{z0a9EAr;3dE=jZGQ~UgA6!Y_TykG7eYx$^h4Gl4o>9*fz+1X=gS{gJ
zw#D4)Hd!KX+4v#`OHpuXAbFjE{Bs~W1i@wIlxB<n&C&Pw*^Hor=DOy*uCCv_E$fvO
z8+(7Y#npwuZOmM6e`5Eyukg^|WQwFE&VwfjfnEh~k$R8f4olL~WLa6ifXDtR<9KaJ
z$s*|I6e#*i2-e@jEI-9BXk$}cYack$RT2)2+4_3y;+^V__I8NVmK2wV<@H?-k(r5!
zyz-mn52_j(zb<fBYX4Z>`#+o${D2wM>;JMkdZ`*?u-|J?1`^Bh0?VmbC2Ii3I1^~8
zsa-aXOJVONUSCI)Cj8MiT~t~cxE;~GKORt2WC!}m2PeR9f4Y~U^>HQzNfK}@$O8Q;
zcyaMxCeu>sc1WRUq!0q-*=<Ql2)-0ajfqp&OX}$Dm><s+Y6r<_A?4x7*vX|vw8RyI
zX$$N|P*-fYv?MHic3&i7W0!8`-mWExnqN_!2!(F1gB{Mm&)1)X24&S12OEb^&%lFe
z)T}B5ImJGTwT<@9_Sys(B1*NBjO2o!+<$}%Fq<$|;r6>ZiD~i<1IBx3pQTV6g6}a4
z>3|5Z0Ci-J?ex-%4{qf4U$=?zgOKs*CCabo&0E?3&K%stzdOofd1Mp0Kk68Aw7;H1
z;d{pu3Fq`mj~W?eI=n*~>gor(dpvB@MG*6OxNg4=<CgBL(&B71K2lHoPX(-n7zaw&
zHx#G2qyqm(-}sM|UO^JFkqQL$n$z=p<&oRULR<Tfzj&&fFvV;={1w@|7mmDk_q6Dt
zlF~2)VOy9Ryj4?@2W|M#M#*v-#c!tPcij3Oyz$VlLFm<Hzt|mc%|YC30_PKx5pcNi
z^XrVyU+4(f9;DC75ZxifmDWhfCfGcXq6icCE+#H<t2#Ic)AjaTEnPHLKvKd4(@KD!
z-_}Ie#Z%)@feMfq=Nl=mt>dGRG&jxI!iEmQ7|1$pw9c-*COrwIRa0}K89UPi>I%5O
z5%<diJ$vj?i?&C>4Y$9)e87IZ(FYczw`!9JqJvi#<spP;JV|DpPx#2mybho5%#8uf
zI9!|GGMVk!^eEnFZUfVu^pcyq+vEd3e<Juk<2J<1UkC1Zx_sU>oMDKuU@{U06PV+Z
z<@GfVT>h_Ij+USvtpmSOxaFmY?pH<E7u-ruC@Xg6<xUf3_*covK2(hDRU26|;0LtK
zi?M!b$jByTpSuWn|B&+unsq5^tQl)u!twggpI$7`gqMSCY*Yi>YEMrWY{?Pvp&8%5
zAN@Yju8Rl&#T_i`=ugbY`uo4e97VE^F;BK0O+gru-e~@!>h;;)!d<~Ty&uhhJgZ6Y
z;|W98Mq%T|;k_11x=)6~+bfq4h}obabwje~%*KeM`hVlIE?#gQXZO7Cx)PZSvq{<v
zRj%Bpx3}7&S(#Z2R5c|uZ0T-;5d0~m6EL|a3iWNgE-bc1q>U3st3~y&z3RL=<zhP~
z97pOE36Bi@c(uG#zUW99;UyA}_4xfZjVw3!FOB#anM7W<>qcUo%eC!gzXyh&(<<KY
z^;zXgAbfufpzU9WB3{qk`-rv*8Hh?sEan>TmGTyDXFpLI3Cyx04=teI8+u75WLQ|G
zRpV9(32V1d;cb$Z;+=Y;rlyUQ3BC9Bjt7vo;(Ejx(M`2$^3J^8(iVZ0EvS_v-BV%A
z(|)h8Hu&O}<@;Dy$7F`Mv}Fo&XUtD(Ov?;0-7&?a0~NPqqJM7#kMSu+7$m7qtMqr_
zf*eNhEcMfBrt^1aJGF17gWN(u=qb|4Ao27bVsB(>mtZ-yC-+>weq9o{s2|Xv2S01c
z8;tn&?GK7?T1rkMq3W^vAjuViw(>lNZkV0@;b=3pVD(>sDLKyvv>L%R_RRP01v~yZ
z+$14qA4Maf<Kv<uru+6U@AGTb<JF9%gJq$mMFU(Myiqn6Y+PJrMa4#Me+6abwaxV`
zE6hb9><5TUdV9r8<D)<m9j?-)7vlZf{(QLF;mRlgGQbjM`=X+`KNwi|&~TqBSH8cV
zXInE-FUwsyp8B^JdKEDwFc4TiCmBoJV+OD(9u=xX!i{pCTDNP#!#_Ho`?2pH^!y)O
z&={BxWZ`qYNej0EO7;Ex@ZJm;26gm_KGdXO<sZ}{elhsGYc^9_R(5T@+)QjN1I}Pk
z5vil22RRwke*^bwEt`FQtPB3h>=bKM_yba$H<^lwkHk(jZ3P!ZpFR7I9;bZ3{VWLc
zmR*s~R=iZ6!kffu_UhP}2N3RZe${P-;_>U_!QhC!=g$_BznSIEmo$H%V-{>Oce=ZQ
zr@A*&^!#}WII>JkP4ffP@AXnP@Bcd#;5eL8Uti%tAA2oks0I_6FO*Lqhzs#6q7u9R
zkVOtfB{t5G5kYx^H*`b1dx8A`<sgqFKRMe>PA=LJ@b%UFMu8^DE`Owpd6G}Hs0a=J
z&GXxg`Cp#j?UplY<uQOMovU^2I0>&t;?>aDEXMs>O`Z$>PdnudY%a7~oB>ymZ}QIc
z{O?wLXm<D?##AHP@;^i<9?7pZHASk@(pd3z2$<XIKkdEJu$2CM>n;)*8MhGMr(4mq
z2V2#L0KVsMpUGlF=9itySaskbs3}sp+k7u;<ilm62$mPYeSqfRXk<_em)zr}HT2`<
zPo(=`@HvPOYiw+mr3@H}NJv=I+41BFuLtV7`<*uA@-zyN2-=r#>6x4R*PvYItUh2p
zyvheLa5e;A+WFpbBCof4s{IgUW8UI?12)A147tqVgeeR_$R4>O*G-V3Fapc=*CgP9
z#Lj_kWoFhx_nY)GDDXZH9UopP%F^oo_-jr0b-}qVoitfIBqSiv*x5-@M^aww?EU0F
z?ly7UmO6q<PCZiU+S^zCYcLY*GtwaObVG7f6~-I%v$6dIu*Kqbg&F(Zd-`^Ac2-<m
zoa1HX%5OAOuZO>h1FzTC=lRpS42^0RB9FP(UivTtuzcqtc%PsJrIF4>%?~`SkUh9*
zM>yV$nvs)(F!f=8swuv<$bHw@L14oR6aE^`XSdPKV9F){K*ECrNc9=4NMcB4TzTZl
zi}AcTJ&od|^W}3-5$b@Jv^SY99hZOI%3r?zzq^%z{Eej1Qjm)#F1M!Xi*V}bkcHrJ
zu=1y<+`i+Hsc70bL=*xlvH!9zv$KA>(|#X!S9-5+tJD2*RJyvrnxjdeX=B|KEb{`q
z<OZIH7^g;jZpAl5U|qxyNDaxz%rvnwww!!A1vRurhVefTcj%in?loP6pT5F$*$BP^
z0?5Nv9Ux*un9^UbN(sz}g%e&Y62HgNQ;JDR8T4Clw?TY#I$Hfk>-{Si?WB6k!g#Fv
zDAmgVh<wSQ7*7H|E!w{A+k$tGk-V4Ft6;i>OP+tdypO7@s&3yAP^DG|ETj*WhFo4r
zxTj$@Go|QP%5A!C*U4<WG>T<!@7B|f<Tsfh;fsD8w|Q=Y=KHzpRzJ<>>u0Mt|6%`^
za(VOLJj?KsDriHt!7I_Il?_TyS5zOV#$R2XgJUh`!S|E=d6Uz#t*ln;7M5{7?<1ZG
z!1gJOxp->jQ*JR^%<Iq<ksXDPzu{9|5f>9n%;AKIZt-#Rw9narcoxjTkcOX?MFrmG
zr<*=CV$!$y^BX)1R2|LHSnM&|jXoKiSnERUI->X3|8U~%_5fCqeD`)NRzP84CVXmt
z@#TCl4K?)GH)r8&$i{O{PEVVgo8v<z$n4dJ!_(eu6}liI7Kfg!3g?rBp}ATJ6Fc5}
zFg!8<*=xf39^!X)-Crres?<4Z^umMWUuHmqPJmX6mDtRdFXPJdid4<b%m_B4zXJqt
z-c#3#<h?y!cGD4d7mma`ci*00AkRR$(9`xNgEB&%Yg@bFeK_dhMiWjQXbs*2mk5W8
z0rA&*gR+@g+ZjlK>D{{6;q%2yk#lvq&Fk`k?pcG6g^(&hZI@vDf-gPU=5<-w?g2YB
zIeElyYh85oBS>T-rAA~VqvXrZ$@0CQ1Uf)SJHIbOYHv&UE&TE+wGxR7lCF|g_1@Sx
zgB$QEGtTe1sHmC-8=cxQ?+*J2BR5v9Zmx4WY_0$k?`S!9vpV4VEUO=^%cO!~&CPUJ
zC->rbRDWR-mOgjbqQESCclzEDa9+oq34bCFe((5c>gw+g0FeYkvyF{SEieDp77u|1
z;FFM#wZ&m`cxYk^{!Q2~0Y-=0XlJH8%s^z91wq#$l=@$ny$(GHtqC{dB_t*N1JF=T
z^q{ozfAd~5XD(ooVAeZkS-YuI%jRj;ZT{gk{lB=KUr=}7T`@-hEkRA&DHMJ`iLs(V
ze*3Y)nU%%0%08}5W)Q?Uf5TG5KtGzD;rYk#;;8@?7C9H?kWv3{(69{7)k5VT;U5MG
zwahk?k%@_z`2FdYi699ar^M4?y<}kM(RViyP@ElH;9!EF7=4TEd@Hf<a?o~7Mn=|p
z*N26Tt!6#AM(h8<T8xEX$igxLuiddjFi4@ve+nBIByze2F8C)|$?59yj#g1Do*j6C
ztr{fN#cG@T{)|XS@X-zV`=d4Z(}zORK#o?WmZ~Z{A0L~!0HRY(R@K89A(yjGBxB<f
zq=OVCB}Gt3+`a!8G}wpS47Ye1Gz0|n4!jd)mXg>TXV7pO^@{uDvOK>a2`E4>3X`$y
z#C`lCqY>|+x*Lg9arSYp2W6#Gg=S1ujZsp68C!yX&NER=12De#_6CDd^x#5^o^6Mv
zlZ%6VPudB;Tws+3NIA!?i6YapDx5BTm3&QsQ|{|@AypF9-CV8*hllqsUB0MNkHSmZ
z*f{)+w3P%Ubleq@uhx>xlWs&s?rU3aC!|<rwF~R>U2mwM&RJ%prhYkqWVMg9O07Gw
z+BGsgoxS&o@F2=FCj9bOX{q5jy$akURxD*%>k^c0e+{!;U6Oy19LaykfJFc?mLS#7
zL6C6virD#t5SL{T8G*ZtmQZ)C#&Jy;8}o-`zQ>Z#W{tj8Mn-(i##*NF$)=NXfr>wh
z|MMD0Y@{EkXmg~MbghORM!Nhv+gCi-&n7kvLZyu;tSFc=t@@t{6%{e@x@F<NGjvVR
z#HMDwj;WiYFAH1n=~D++)wigm?4OybKhJ2qoi~nIN)}9&9nQB_H?{?9uzv8o<dD~r
z;r%d92ZaA=QLM#tjhDL}LO$cTrv?Smo>IPk_hLR^P1Q_YZpeH@YI#yjk*rxcktUud
zqbm`%RSRlF?hx0_^?7J@{}vYqK6(6A;(gYmo`mXw#Sr?{9K5C?FE6Bk$X+#ecMeV)
zTUdF(iL|@)!9=ZN5a$4*FPQW`yc6A;eMo4#@cX;#IBKymZM|$Co5}o~>}{WrL*cvo
z^c&H-a;mCiFW$4e4dv$2EPi49`LpHQhKkHnJ`3Gbn-X<x7lF+@o;eEJ8^tSYt<%8%
zfk)7t^{eJ`VBVx9%WLO`PdVJrujR5bpzx@)^l(&2=zFSKaeP``@$hgsl?vVI1-fAV
z&(P2mzP^Nbb~pU8#=-?3K9^I>RbmgKZU{s+8_R#%5>$P&J1`R&Nf$=hi;`51$p3YI
zz7Z!IH_g~(BhP(x_j-MO9idKlD6M-fBR8qmHO_<Zjpegm<2N?*og)DvL65mi4IZC=
zrRRO-uyeh&S}a<2_j9f?vc6$+O2;GPV0;E-!o94#Jl6Bx9zmZQ-pp}Jk1g4=KTQ{2
zlFLwwInqW|-$n%yi`K5gSs!h2ZSBIxuW>Pm=gdSW+d>ioHMvAX2pgAaDQzeDK70VJ
z<_Fc^?Y<Ek1Bpn09)X6_d&nhEgNQ?aQsZ!3>(>XPPfH}1s9-Kjk;B9@c0BxMBPb|1
zoHlZb_u0?UvjS1)!ptTc@l=%bI;hsgg!jX{ogepx;G-*ye-$JS^2J0~b>lvbf)9Tr
z4nOVi6*%jj?$6F)?9vT1>BSE*MUo?bDYW}|+P!AWm1SO6#@Y%oQO8?zpLayY#)m8P
zSJDh6l~e7VZ1%eZMUNec=<{q%L9$gF$oKv|M$Df&evCp3ay?pY4&!$^PqEpb=Avnl
zwSr0QOA^aP{SILJi;zYMnLaORXl5(T4!rH>w7Lw{iyxJ1wX5Qlnu1M6fubix?gcE_
zJA<>9lfQ@vBCK|<36nN>ot@89Ll_2`29NX9wML6O2pG%>3PrEk3+%+3{SCjFtYt#2
z*m9>x$2&uMWl`D$79N-B@s4*GkfRwoVix)SFr&Jz_SvMs?)w`{q5`Nn($}3B9UUd_
zTBePzGyl;3?o|X_@pfG2=e2VVx>S<loyp|{%6D@1u697oS4f~z#)f7PI}fM2Ji%BX
zTHG(2k7Sb#4io<GFU?sEY#Ld=)e22-QnGJlDrSv*`h3c9-XSR=^UIlTa;Rx+sL63;
zz2!7>yn>c?d*Wx8@t518fkZ6Fizcjlq-9YLtvNoml_3Q?UN-A$;peCOV4UNMK`GRE
z21?13?lN<-R+E7?#qfx5Y+>MD>kv`saZaJ^3pi))ftK-1^Xz3`mH<&t&nk=~kvY-J
z-9J~*x>Dt|bko>UOwqawz$^fM_lUMfI(6PFQiR>8RhN(X(Je?zcZY@59W}UIadr$e
zu>85{^Q;PujU8n0p^tNd47$f#yBT?DpS7<UU)~~+)#<C<Iy$mXByt1UjD<xYo0S5q
zm8K6}_5?*^#O)+0J70^>vdAhAbp<H2njLmd&yYU6;2tNDG#?^UNT>fPZZucEGd&DK
z)u+rJN!n1vNwK`$^N8|h^+NQ^4I{Soy%Zm#&aA8i<F||03A9jvEluD3^T&^H$ar^<
z!7VpJ*dPMS2%$wnRaI3t^=J?TH9bSO&z%o#)WT;Ml;;<hk@;R(`SNHcF7Fk$p&<^I
z?l(|Gj?#K7swj+{YN&J-g*dfQ@j=H74-rvfuYT=&JZoOavBSX*FS2FiifS=<0Oft$
zir^;lZgq;Jb9`_32%2BAUaf<Dg?eYPL+3(W?gchFdM+z6X&p)a)LD2~go>gf?Z)=-
z9{}L{>!T%pF5xXY*uRl~fo(xE<8~!9#5Bv$)9jV|`WI<4Il^B4nJk3=OdZ(ZG##@+
z?~mde#hy+I=RS&mB+p~Bv&XDQ(mT?z_pd9*6YF`X^*MO-tDjSofe!0iTvQYD*NM)h
zZ=9S?-*p>8LkCT>OwW)$YT{TXD0I=a?^JZ$(hyAJCYz9eAryoNxmoA+HqkoZ`OW#^
zFE@ElOJ5J(v=XiM)psJM%Zo<Emz<NYGICyQ{8U>;!7o&N1%<g>lx)=}oJ0?QFD#4=
zjikRZ$yW$<KB|>@{ra`0G$|9+m!2FU&+%F60t^3C%1~%e7k_E2FmWjIeA+Y&llej|
z@ffVh)ecXaLxj3B^Q-Az92S?}@6eEFUPADeLW?(Xg^#7PbH5h}#d<;vSyY(#ZMf^@
z>G$jo%5n4T)cU?oiJf(2ypRghH2F+e)X;;_Px<AmQ_`~b_7s#Xw#vs)IbMZ{U*~B4
zd6&=8l6&!hh$t(#Oa`3KQ%|t&T^6Id<dN-Tv^dNS%+qpFZt#704+fQgs<3q`2qKY^
zL#~Eo|JH@4GTr{_-mr#P&o_fniA=beu+po>Y@~t0i;9e}iZ0i8d-q@?_hsF`d#mAj
zih#sQ-wtS8MyTN`qyGDU>SdQE4k*<$L$VMN5R%Ii*pEb2n!Nx1i5r%GHGbE-w_M$g
zmv;N7B>L}HA|f;V{mTFR=Myi||7`PKRrsG(;r}1~1Msq{d4xnLDS?O&MfvNuXXl*%
z`6K=FUy2eUw<Pv=P`&=iFEEfgJpOkQnv71p@O#c%yZQ|*DD`y&8Vd-Qm*8vt?_c--
zlb`;7{}oMGy}<UbiuLxYgr4vIkY2P?wf4?VwP=j5VG%b2Pi}qUf*iJ(NV^NNsL04a
zTD1tLYW-{T%=lZPEAY6~yQ{2>#`=o!K`0QsAH?CLz5VZ)t*e?tdRy4~4UiBnyU$l!
z1w}+0bWc&io@d$Q59GXgWpeWGf@FC(Mj-`TxCKdEoUS*KZ)R{G=|<C@1>L<)=gu9{
zXZ+tw4u@Bx<L=Sv#SE6y6aU^J$Vtssk=MeF+PyrC(N8$gF*1Gfn>Z&s_2gR6@Xed~
zq!k%v2-{1_$~4W<JjnK}AoCz0aMQfvJ{DiWey(CAA?faX-nX!t1YUx!A;;v1py0CE
zbXnrLw6u5*=c252SBwyxA?023oUPk;yus`sVxbX06VI$0o0rGG5|PC1`u-?Cpe9@?
zl7k=6o)BWLmiqdNpoR|z$0HDKD<KhZFBG58!T;B<M!5eF`4z)QjQZZz+mu4F3RA-4
z=H|7B-&5NF@GLDSEi9Ckz4@3^R)$=6d&)K>Nn59>Dz}Q$>8}RB`mDZzXZ73R(SxV#
z{m@HWp7ZOlCvFiI7Et_#_B|fsxNp68ydQGTlCrLk({b=;BSQ9PFacZ3wB4r)cAg{6
zbr`ql9xk+7A(6j$!EVuMj)b%n7&ttKv9rRw0-em@sbpYeen~~=e0e$xrpu|x$K&ZW
zC8Rgj`b`wb=NNMZ*7h3H#d$I|^Z8U%nQ(P~CTV|7wXq~Q1|6My?E`mQBV2cr^sQD_
z!7%%AqY7#eYbR3JHT7<0o5+9u{DWqE*n`V|GLG)Bdwe)mwE%TV{<C69$qdNRp4W`M
z&CSpE3@?+6W#1nP^CgjRafzmR!C=_k(eXS9B|-vy7p<_QWN^5jmWt}*5$D?GnF3tj
zQrTx0=*8u>aP<Je_RIcaGAtb<M!BH0(9ywWXpAW%J6}@L+4*`Nup@y>)W4cUW#tw+
z6AKHqB6A`)zxbTX)qw@6Aez`%0_{2(PMbp#1sU+?itW+~ZaxLAURda(-bAhlxUNiO
z+Q|lOAp=)%<`)Q4BBPQ5Xi5k+f3I*+FZE<EP(IK_dx<SEd~U(P5mQGzn@^I@4uw2a
zDt&ye$G#hC0+<HULW(k$58O6xB&2d#5c$)jW44yod`QHgYJ2me!gyN$NhxJm#?cf^
zM#kNV(+BDc+iT)sM|?K1x)l%2b>mP}P+h`D5H@}%V__4m=gp|22JCa?*O%2(esOt@
z_!*1BU^`)An=sv^C^xzavfd-<G$qpmlDORc*TxLgWpBwG$y-gR4K*Ddoo}qI554;}
zE}*4V8zj&5<%<Y28yk<4ONht<Ap^HvM~c!ZorJi!)oewVuCJ||mgRnSlv5RQwsKB!
zX<=Lb!s_pbg*G*wKbliTPk5EwpK@^9wG@e=dU<HKO?TUj_=|CBUUm%m9NF7nyEUbZ
zS~NNO+#_OrBcNdeQx}tww3OI~UK_fSQhRLdhyp%isW>kCee<gEF=jp`cN_b?@hX$@
zg0JuYdGY8Q1sWC7y9b9xfQzD#;TIE=15x8!iL|I9iLZ}LOk#ov93CICIUTJVT56T$
z23;NJUf|%UZaxqJIYrp}5XEq%fdZ_L{-_dMWjD+7o5~s*;otTwGvZbfHGxVq)1&&z
zaT5Pj)878jQdB#M+rGQfHhsVg2KQKIYt952_sc~$eZiU#$NJU`3+N4eY8X=egX|{+
zgWTKiKXXZz&&*b~e7wG{rl^6Lgqfb3`>4?7N@wcXQww1gQLDb*xw}&j1_nmum6aEm
zr$)aZ|NTtI+Yg2HTom-1qWk^SS+`(xB0EJ@aaiONR#vv`O5-`b^F~!w71CL+UCGZW
zyTal>g{EYcl|4AWIoY9tV5W9vJOq-=gC|g`_A@=ZuaC0d_~Scs(-*I3dpkNdi)lQz
zzlDc0($nK&uIAdNX19*l^#SVF>M65%JO=%>9zH?CLnA6*ReqmVpCiAGHJ>aomyV@(
zH6ItUw)O+LPbuSDuD7S^CW^1z5@Lo{q@VKT78dSZf8p}*xE+9(cX&eJt=-T%X}LD<
zdwq_)cdyXU@aGo`AM=S4QGP9~y5Pz)gn8Ftxv}Xo!~AdG*8-ZyySon?z7UpK%zoLS
z7fT%&6}3DwG<cjEghg=D+&peR73m5Egin_|rJn!IKF9;altl;A?R#!eO=4bc@sMNO
z&=3<nGkxC9>gID25<pbxUOpSC2}-$uD|>7N6^<{7o6l%rnWYqzR69#+QIUz97Rwbh
zQ*3rxH^vz}F^h`^cv0cZtfMy>_YZ$`NVvq>^G;5;9KZTan}?|0PWE@?7x^g@!)*()
z7*o?&r>b)S0qX6i697ScmGyM-_1>ysim6#(mM+72^!ckU>0R`a0T?NV)=rlUOr`2G
zYgcJD=$l)*yPwnWC~5Ch*IMz;Uc>b0d~8ui=t`)`XgvD21O;xg%?5M1-|u;Oum5iC
zzdm{$Z%x*%h^emr)qSN>?e6bO$1szUl3J|opXJ_1K98{04a>cY-s<#gFk|@4Hj09r
z((=@vB~_o0!0f_M@;LwuAocr{M@m5fio?%Ko;1?Z7AN0lF^FeoifB+Z=U0E@^IG{;
zSNF9@y4x%iFc9#$Wx>nEuS-Ns%;)xTCH*<X>OyCPU!`+#RMDi83?^a>=SO9A=c!Ai
zp#k0qSQ;)Ih@Y@IbXK8Lb^Op!4X@J~kh**buXu={@%$q_j`ddryzZIr_y!`d0<_b~
zNKu~CrSF;z2Ls<Io5Vt-`MJANG(CV6#pcg^(h`p0>O;^@%3|zPoUV*-S700^a=0eO
zWnTovxqs`^%GYz|B|(|rATW5RgI#E}7FV7>fM#%zHUo&pN1_YtIqir~zP_u=LDl{N
z0Zn+lfp6=AhNS%c{k{6s_pb$)LJbeHvfyuEe3#r)M4k<p1XO7T*G_+PXLI9Su1>wc
z(A(zoZMfca2@Q*ii()d7cyYprh7iD1w!^~0LZiXGan}gp6K`5>?i5IxYj)mb4y!RW
z9_-sFDYCn9PVGVM`i~Od%s*{d^70Ihj!8cjn@hiS^;aVh=YM(`W;{8?r5}+1Va*qE
zJK(n@zFuG}x#)w1UibSW=yLc{Bg*pJz;2{1i{l_oQN>-L+I4ICT79=b9)c)ERNydq
zIRCIbHD5nBytlDcN(j?nAavs0jgTwP7q}M$1VnVLQart2prPl5UY$xbV@$+93k%vc
zrcF6d4&Ka?xu5PP8o)i(h?BW93sQCb$I&D!bv&gk^z@xQJz%7LBQH-wP5l}#Hs&pW
zj?s_j4uT{kE`RIH%X+}OL;K8+q`l^XLGwuT;)$s&MIGVvQEKrnx?@~Ujcdup>8sxo
z1z!K4bC8-vuNxcXGY8*8EdGWXuN;}e@8TBuzt<2q<4LdiNglyJ*AP4k^xOt^D=0)U
zPN;T*`96kTUY?Y)@kB|Oaba;ShpEs`p;2LnOngsTLdMR14`gyJ0{YOO09)!RPB4iW
zL?UcJjxVLkCKYY3ASlpbLb^>ufr(gYcNU*y^|d^TPx%cyXBBj{5T3eXEZl4W80d0*
zX=2BYq)y;WXu<Q50}04nc#W_SIX<4hz(<6S&&Ku$8xzyza`9HJDt~?-=%-t!&v2g!
zT#R>iS#$G}HYn4B#>0}92%<tE{y_ZlFi-~1(SA?t1C~!|WJR>ne0+O*`&;ya*-~S)
z<HQRej2(=dJp%mmhW3umi*w{xuU^!-#C*aiEIjOLr+*dUbV+vC>Kh2vL25Pwag0IG
zr3TpxPEe3&qOc4ocJdzAysa!4nA{3d^YVB-NT41RFcEM!L1(zqSCz#--zn;xKD%yw
z+zf*w`6Z^qT_Y%y9dgYm2lKny$F+l%5N(Q@dUsP(JzX>X^o$G*fZb2D?35jluNC<D
z`H6R4LtjhIX7}o2R*Z+7Nf;;|A1W@mU5`<Cuu(ip7$3I<6EiZEZjQ-<f5p37`GZLb
z*GUS-)9HgHNn4dTT&%T~wLjUpKcT1XVt*+hy1E?dGWtW1->RXZpd_+aBK`f59^&0x
zt`$@E%2>jq6Qr50F@ZJz<?InY3u8`31_>Ko+f0w7y!^{Q!Wwqn=nM>1aoNW1u3sSS
zgn;d)ky8%ysWJS@&}^v?`Kf7gfka5+agUFQu+-5pH{@7_s!xCksAX+R?o<baReM({
z+xMi8SELtO%T9s+bwweb_RkI*HSM+9TPM>wqG!9sq!p_oLHDU%w0Ct&INCdmjj_F;
zq5|zX*;~T`Zv8^K2PH*?rG<}hx1+x9a^tHcd>@1F?)!xt9WY98I;V6gg^vJ+3ql4o
z)B|Xs^R9~kKYAEu)GxcGX)p;^Hv}IY9Styy4Gqry8KQ>4ba$7w3{f)o$B)(Cnbn-l
z!&z>(-&_E@Sy*gB?=fRBqt(oHc6R+EF9B=YBX|y>DW|<#s@i%3|9IJarO`hs$_kQJ
zUs`F^NJ-Sc(V2Q&OvDVqv5B-IbT8UNf-5`Ls&4~HEjYss(RAzU8;Ly5PYF)2Z!*EY
z6cSZeTif7+L7d3#>f09`mKs-4aay{eGOfYW-9t@)PhdG+;lG7e<rtF0o4hYa_%t5$
zJU~bFCGd@$yGnN!jeIV1Ktw`R3Ri0LlJ4#3ae~)Fl#7Mipd>W(&1s`ro#pS-TNZ5r
z?4f5!JWflE&EtV0KWBek;g$V0F~>4~OiM{&EDHwa2430@=%C|+-%AJ)AA5i2WLwvb
zVw-aX40B+z14cw>haL;DqpOdGjxMb2C<w?T=n5g`Rdk4W#G&?)Nuetss!wkxF#Tsb
z#V=oIt-e}V-Fc^P(oZr4gdcOfKS_HOU61pL1z*8UbafnFEDs|G49MjW#0yv`0e-Yx
zrecY1+V{MdGEo&aM;_kZk(Cn&IXp)1bS}?qX=<BA`e-RdRd5VP4i6n6S)tMAy4utT
z5$OTMgow@&USC!oU$!vW+b5|lOTQ7YS(USLt+`%WGIUSm@^Y6>Oy2Wj{oI?t_cJAH
zdvjF+?~(iY<z8yrNrA|NDI7V?(mx#<fdCRAo8<xr7J_mwVilze9=6CR1+gx%77^Ch
z_W8#`&RW$NN33kc=2ljHJw3HfTMr%T2kyt$eQ2HSwN8%cfxmBno}ob{8g#}Wc+|TS
zx4SFnGtTw)?R_}AK3s90ZLmxo4Uq)LZd0@xjegmLDv}}_#+yb>t`7-jpYzK(w649q
z(<V67;6@o}X@+O;Z#)7<RUvneZwPDI4x$(9Uc-(H4*g@$>Ine2r)wOL>E{)b+0xW@
zvVYCz<mUq+w2uk7CZ%vB<gITt+*<sv^Z!gkJpkF=2PxQ~^7hp2r2G4RUoi&0RyrD0
zJH`Vwqqp7}KY<3aTA3scqDmvu+WTY*vY#zij|w)!JDAQ+PmhVm*Ou2i4hM#eL!yz1
z1_y`vG0FJ&Fw_}skIB-k#3d!&uP-gw??bL3a36~*e&eCX$H!y&VX%l7kW)}BPjEb0
zUDbzlSz_K_`FYoN^NYHN3gp7%ckbw8eRFehaY06ICB(S-`1b8rtR_Lx5d5jpR+x}A
zFl(m=8jzBLHaELBH+QsbhBr_+7xYC8Fs+b;Q{RBj5%K^Xp(2b)L2@3EtBs*DLaB^{
zfsNo335pXH)yrouDMb2uy8MDGKWn#jck7*nvOq&77$0DZzqmlp&e*i+Cgs!wrZnN@
z!?sA^Fg!@4?o398yId*Ast}|9!Af$rW2pN4xzIqAKulCUKcYcQ!foK2k+`~g9O^dG
ztwYWG%+~uZziv~=#t!t4%c-g9_RqDCOz_xTNtg=_1FhtJH$(vQM@fmQtjb*1&`$ri
zE7fvKXsUz}VQ~pNi&r@_E9>F{nc^1-zC`K483`p79bNkSj8wX;<m6;%|4?>V&K?ub
z*P_(jD46L?Uk?Gd1NnGfipSvONL^=VCmS1^>*e9Vpk8uF`Ay1C+kWF`dMRK;pyxTD
zqoP{^Fja2M=*j--Y%nHqcT!k+y0)@|H@|!8daNlF%w*phou7Y51fofSMt~+Faqsw4
zIniiwVg#YU`3}Dz3y7wNeB_km<o9pSr-BdE*j~Ip{X2CeEPg?rpp7n9eEqs$T|WXh
zzby5Or1|s^dR^Z3(-=tp!9aa_y{C@@2q@8>@XFR&)cJM~3_j}WPwtCk$7KEtD!t0#
z2!n;x;A3lw$bAe#b2Al<H$O6xFOO;!`TwjI3aWZ=a7>(^UlGLNcXi$5NyGF^Asg>U
zvenYkBI4aTo9G6R1LQp8pJ(O<CHVWtW@c7?|7<O8@~tQ|E8w6X(2^$P+~eaz=eSr8
zFT=uN2?>e7ASoUm7dS=jFBiY@a%bFVqBTZwjB~NEu()Mi8yK0c?GRL$be*5dkV-?7
zt#FQpv8mnwJd7`2KEY)k9HV@HH2Kp?VXlBW=k&uz5MPs`cnI_P5$I#18V-2iID8?@
z%9;hsUu>)@J7-0ABAb`XiVzOYNIOehi%<&?;VjH0Pd5`FvcY!qbS}NHR_g{BH<*+p
zB?DmF(}?$(b;m5WXcIY9P$%GmtBwDT#mETrY@It~;p*{?KeM@dRWk8uJ0be<OveEH
zW)w9v2D^s`VJ~B_>>kQ{OZZOs^}^DljZ+NVn&;y3@*M2%gzUO|wt047D)A4HB&(JB
zy|gqmI7~}LXZS?++416<VA|gGBIovfKKE-}^?@;_4=1!Zb&kTqUNHZIrF%8$2>oc*
zt@l*u16Q#4v%HAsq*POTTJBy21-`MdA~G^Y3PX-QUBkm3K0ZDsk4vKH9>Hr5c!7d~
z0w&@b<=~FRx}&@waAC^Gf|8OxE;8d3jlzKL-&K7uIJOa@C4sxFJ#_{<5C-aFOM`d*
zxSPzclvG4_T23?#(b0q2LgHW&_D=i?a3k=-!UPWyd+tl46P^W+=|BucY@N&5#-wm$
z6S2Ra|JJly0qOh8(uXiAB(XT6;xm$3x}->x+`4s37Go}D{x*l&8UGh^i=4Ywu$RR$
zPT}}Y?V8hx%-bMfnB}^fU%k`Op?>iKx-zcL{YHkBnR2IVCSg`7q_qiykXOJA>)cZA
z<eEzb_C!)+h|aMJGLg{b)Ax6#C6i$EAnd6`k57)Tt*(CmEa2w$+1`wGef>B;gW9;H
z493s0!b0^jy<1&$Hp6yF%(_+3kI*Ko1e*+uk9o9$D_*iY8jMUMw+9CqH%QB&$s(nk
z<Ca?!5#Pt(n~S)vD-^hqTkFiE?31UilrKvBLJU^2lh+rFeV)m{m7=OTI!D(&s7FG~
zM?CrGo5asxVlE^!KZiWIR$2U({nhXPMx_w>#~+;b{sp28o<H?^H$KZ1Hc<`75jJ*s
zBVO-oS(`GG(9G!QL7~d33IhDc`62$Ng9A!fd^$+~Yy~^shLFde@N@<oM^e)^BV%mX
z53vX3#&(bHU2dF{dptn#Mixn<z*Wh2joTH?A+E7C-iLA`C~t><4{bufg`S=6rItsz
z!y@(WaY{x8q-JOjI4n*ar1vHA)mUyBsi|?~XakmTy(+Jt)W!=_yR)Wd?hnt!^LCo&
z&#yR*#f62H-byG-1ro6u={Yzo_e?$g)h%N~MJgH`5v3Aer-R(ZYxcptjp31=S}TKd
zs1hT`w}=Qxo0-<0dq3Fx1VYSKF{}?ycNiQkzf+;0pm_FaDk~l7Y7S=s^7tyEir(c6
zP$A8pF$Sk$RhjC}=P3Jo3OF7lS4Zf(N)_U5Uqt2QIfpu_`)Z=Z>9i<n9<wl-5BoA~
zq$ukeTPclP03D2od_UhsJ0>ZKikh04)?7lw$f^6}yRjbJfngLfb?0L(z+$KB^X0y+
zwFEbKSXwanU|>{$6!_k5iMb+sK@&B<PoL@=cb5RtovXnM;uT7O<(pm8WvdEjwSLO2
zmOqR_YR6Qay6<jDk(HHIh(=9Eb91<l&tES2MC;J%uA@F5m8iOI2hf92Av-5c7f`wZ
zi?XS?0e+>C0(|~;#FGGN+V`{tQ)Z`~ek2RLAJ`xHsNBJGtKrh*$swD-9aQkwQAG+r
zz<5GPaA5%XCNwnK$mm6yW$e%E`5wE<dj4jIxu27D`>dA7CttHVkd8?n?gm_=JD_b~
zy{zJV$?;9#yC>q!!}G3+&vz`MtBerpAI1dqntnR+3v-8UGEHCRp^q?{GBVNwK05=x
zh9}vX-#JXyqy7DDbalUtWT)J|@`1#uwAw#ASR38l)Yt3|yYoMbSChb95=PN2CgwX+
z=qw2jNObi0W(-=IRN~S03=E!i#OIw|FPT|bgP-8NQCAmCA6n^t%kH)r4r9r{gM|-L
znSMj$%YB*;A6|Aru#&FM((LjEA(TzK%nuXe(OpeUPC^H4jY~%?#N*Y81sYeysHhBm
z4gXr}Om_~~ILw<s5wls2^IBgXR{j}kH}|#B?;fM<A8mDWRYY`B$w|+yb5a_Pk3oav
z03jP~kr4c@wk|GC^T$rlfW+r+?p@og43n0Y2A~pvx~$w>%?bk<h;E^y)7~xkmMRk1
z(cM|$wt#wW52sdR<K=*EQ*3N3Hcmvj<s^@d&<i&=NdmKKrEI)9rv#zYH<U8b+gnR~
z{hge=&mt>EJ}V<q1}DgZXZmiUSS*{dwV)vBd9X2CyI2>Drbmb8NgN-=U%$o-YBZm#
z%=8I4hwl%<rw$?F&HV2v$5PsTa+Ab2=6n2T>(w`av7xaSy6YMv+dJDyQRWvO0b>3T
z*z7V^k@f0w5GJ^w&HD~;#U>N)ttpNrhorRh^O^CDnVOmCC&&(HS;3ipctiEIL!9m5
zTG{F8%A+<}CK%NIo+jOpK>^oh`mc|MMn+IgGdVRC6exXmhO{f&Jb+-?97}%s$fp0b
z`r-bwcShhuUt4*^Y%+h?qt1qjT>z6K$XL#6AKv3Qz0fKPk{!l$ZaYIWGBQj**xL(1
zIU^@K#nax&FGny?Cb4Wv)uya?e6RC!o<mt)o<l=Q417HSn|a;)z55Q5USl<rwyh<V
zaQMr_F%WIF&#(RAa$S%AtxF174Sueg;_`-r!*ZLfLES2<`0MML`BoJ!OScb&MQoY6
z$OE3AZ`=@Ww=HC><>ll+sfH)di=RVlT;;@1^>(@)0&ABfN5y<4g+NEayLfQCAIJHT
zb%;|l!KgXc?7sDP>Gx!6T1bV~eK4S`+Bw<VvqVU+tXgR(9YM(D{j1^eaYZ>fOzC(-
zF98?kXgj)b(0ypV+U431`8>BJ)b8`HLRd}QO9pR;axi33L6;FnVTBn63(CN_bH+7c
z^J#^WzUPI#N7$?0TJie<B0qZ*OOs*uZM?CHtYXv$y)~A+u092*2sG;4erAt&dU`_e
zgo>8D!)0^1)~m+njR`BE*;kiO2x)Pz6eJ`>q?Jgi?dCyH($wm;Ia{5p%{S1_LU2!n
zf@ppDXi4&*S5v)T{5YFedF#T0vWumL=W0wys3)m9y0gjl@bp<48>5iWIqbsoH`Y}+
z!oo|*pTIO@6}A?*>-h9wSU1l&LP`eGrXi7{b7=$cGTB5<Bk9F`|IQ)+`7Cm7h<2x(
zz7i(L@Bt4rDIMCN^Y=N<&O}(Vvo=ouPA%BotOhy+=v5*G@b&9&?RSc=Ffc}3GaNs;
zw~q}abh<Q#ai7rR(Iq((T^MML|A3!A05`|n<gCc-1UF3u$**|j&$fcP`j?qjMI~2u
zw|!{zBG%ivJSp&&T<+GUhiqQNtAmm3d~_})CHuoaSwCCqSEC8W4SZE@s(fo2=bm&O
z+;VNw>--U8u@wjbMcwf{FKMqUqtfTX#ohVBe%nz|3(r+@7@4<^)X}D-t98byjIfM=
z=wmfqHjy_g;{^sGk6UsC`Xovmuf5F8wFtF)s^t#KUc+UKp^;&-^avP}$H&u|U$Jm5
zQ*ahZ0O7aqZ&P^_@>;+pzFHTwOZt?7ViGb!g0p@4#E!r6(_3m1?%Ws|&{lbPa3AvC
z<^KvgFJ+|~<BQp$!bd&>WBK6YCgQDXYHCVN-rYi93hX`%s4((|r9quQe{44QUCUbq
zg<{*2$YWOT@+e~79!=-6l=3IAIaE7X{gnIqT`*>DZ7qHh))W}cr*}7Ep@4|!DdlT_
zfLLLND_)UFSyGpg8HLK5a&z^$$}dVr%I7693l5u;p0nkEi1Kn#Du5S%(R-Y=b$aI4
zqlbEhi4tp1Oa>U(db+8>pj~JW1$Mhfyw~JThi`T09|r}YuO_)a<zjame8G&XZ)QPB
zPVTxmJ|~?Dy1Vqgr(IorNAFKsYkQlTid|Pk?5;qx_hT_?-)2se<%CEm)w)m_d13OX
z>s=iBm2bt!0M7gjf7r;-2;4=){6c>0-^z~5ARuXZX(`7~<GL%l-nDKE8wW?75UYim
z9(yYOH%v)!kK+h=98d__eSLghy?Ak2sqi{|+qR~Fej~<eM3KcCDd@xTrM$*vIgtpI
zJOBj)$@B-fQc3I|50|J`(9r|Oa%Td2h^U`adqh&6{xId@WIevPNw_REivm^?k51#+
z^XLApuFJh@hb&>(qviV4wv8swdE}L~-onB;Zmll!UGDsZ?ZeOj>CVUoneH=Po|$VD
zk7#^#5)==2u}`cr(K2G@w|^$GG1=G_$GpPY^bVFvU2SZ!T~$}pu4N|X`}iXxqrc_j
ziw>N24QWI?Qhttp$*L@#mbHhl<!M2UgmdNYa&8?+;Jn>#EH{YT9_TTsg=*`<##Km~
zr4(=-6CVGVaWLIhDsm|8B8pC%pmlr%dYA}VX+15Zl$C@vB_%20DLtNVIU-PrNu<I|
zGBUu#o}6J1wchLd@ZkgUgMtQ+zh-j<dF8OsP!UXnPfN*VWvq7Gw<2*+&&(aU;JCvI
zMdF=$kI1l(RGZ@Q(2Z*K+u{qXU;*aoqIYZ4NC8Ik&Ma7@3Jmr#wv*v%mzS3p)xNF_
zx@v!+jF#CV*!jCU+iBi%MlFeb``~=C15UKTfzfgzgKCSe*<Imc35jT{4?@B%ZZiea
zZzYWW%IoxFz~S-4<Vjk@K+H!1{A)MMmzNRk{z?I0F*_^m4Xy+YYmMthE%fu|iEP8F
z-PzUG#JNC%0+LqrE)|-*xnH4&ujCapyBZr`+4QvLPNfj>*7~@vFaGBIIC%f^9Ef%U
zgS4=@&R-k>8yg!K#JY*s8BD;rz!A20udmu^sg6>OJnRvcE*1bK;}`5d4aqZi-W>1n
zoOfj~yvvqUS5L30;n`a%$4dZ=7qao-iQ!7eg=s5KpxeB-3f2Y&hCPPVw!26Vtj-1n
z(ueZ3s#iA%RfpE>?=h|rdCR2lOj>^(=p2WUbALlfpOlH1?gq?RIU)Y9iNAz(B$lPg
zfOvD9VQ%&)c_3p|Olkb#lP78b{3_wtOH0#0#bPiU?HQ*?((2p*zDz4+V&YzJd;bqx
z%W6*Ib3b3Z=~89LCcW=kQT}nmNmo}F!!Zd|vpIR!%>&9PFpAK0--XJAj7*c&cN^jo
zV#?uBDa3%p<pyh1S@xtwbddsWxN654Bm(hfu|Cy(ZCS4@xBfW=|2QL-l$6;qOA!>1
z=hEaVCR#aaBeqpKBO)Q)eNZ5;G6uA!z}=*!rKK%#kKc9Prz!gQ70b3WD{eWnLJdtA
z*l@Z}4UnCV>fYkZBH?^4ZK*|DYb<JEA??PW7dcw~#0E^^dp)bNBgAL{sLX0DNSx`)
zZ<Re}X+5-B`sk8VQk(#Lx)d;P{}5SHY6pRbV1tEZonb|mcG*j@>BkEzc)*clX5R$L
z@O=_UB41r!)n^EJ8D^w|@qJ*_q+N`7vu~BF+<TmBXUdk0bsKbq4lV-JtZ8w<d0NiS
z7Xdq>sIYYIAKjZ@S`s8~9~o9;V|K}gKzGxaZThaRI_W82W%qGHyclIs<K}9?^Z*|(
z84$CuxS<%yJj%?;8L!}YcyR!4E`(gds7ka-{L6UGA=K~pnbTdFSoW)dg$pPhZ^bPu
zWq_v#@ib<oczI>T%!nl?u{N<`-8Tcsx`gWT-%*t0lquhYhKbwUtgiPBVb>{RJq{t7
zgZiMtwGC;XugRF#6vD6n2AB2o<<C@5ladnrCN?)TytsDt`V}wm_PjcFT{b~mlCu4t
zsNdoA)bJSecrpL2QHf5{COI3Cq((8bG>VB#G&L{)KK+w4&Zl)3ffRlNMU1#72~=1v
z^X3G?@Zj&d*M7V(&4|OBJc!ytHOQmz2>6!#bd_9lB=P(l`Q1Hly3q_pfAA<4e5F@@
zthXQ^dV?wnur>-@rLK#Se^2s7Bg)!9V@}=ZujW-Mis3NYqY*HPtBCT^@UW1R$4FJ6
zy6UxI`}A~635wcXMY8`fX~pILJ`+TG#z~%;w_RLWX?U0rcZd2e*kGEcYdGAd!#^vJ
zvRPgm>avoMGND^!6y(T>t&9I<-^kEh%1%z3+wo523ChHMCH35ErJS$|jo?E71opkW
zi3x+~$p?d16lu)x8r&~*<h)w3W*p*oRQh{p<rd_`W{G@q-@Ur)I5?<!zp{~xX3OGj
zTUbV2o;Ih;uHyUtb_nG8qk@Tztx@Mt406@xNkb`FGG5p7jGrAYRKj?v?q`F6$4;kC
zA`Y+hi!yRH149S(j`EUvP*G9!4wS!h(hkrij6v_t3u<cL0B48g&5kSQ2O&>6kcl^>
zK44v3|1b8wDk#gi?bDzUDe00HX+%Owx<Nodq)U*LZV)6yN<cxRK|;Dyx<R_TySrg8
z-*4yJ*@K<g)1BEFjvNr4=eh6yeO<r2Jiq(J29IVk_skg)BF=ZmN&_p(L_<i)Wzv)t
z<2G#Ts}qc1Q0v=ReYkV|6DE?SB{2Z&iN8;D>Y<>au)mnA8y;#-5vQW1-QL=oQT-gl
zlMUJM%ZvmSRnF~Q3?<Z-3=H{CpLRk?`i#@YUhm0N)1m$8cdY0*c5|u=x-HNM0SGW&
ze!2H~K6PJTV_^#wHg+^LjvDN*3E}>=x-S6;?$vxT<|rj9s;y*Wqod;}E*{hLwGO!w
z_t7H}!=G||T^!}w@tDVCLW8OFAUN0Jce&^T#5CRir0W+#XxYH`yHTIsDI_wouxPyb
zc6;No{7KS@EWn-nwXTxVeDHWA@JhghYQC)n3T~{ve$Tx0I>9Ap{=bGXCq1_~UOWy9
zBhVp1XDFBufy%k)&ZZ=-y+*j{YS*%#b{-B&&9~2c!-rPFx>m3_mKd*&WiadzYHXH-
ziQ+IMX8J0E8FoBzbaglbzejzCdDHp$>F?UShc(BvpDNh>SHxtLtL$2)r>=7E+CkYn
zq+rjh)aS?j1R`hRM_>OU*_O7?J&B=FFG1HUwimlky3&>G?4Chn3O4@v>+4d>zR-ed
zgsPjk|2g4Q4{S}fyz4Pu5PJcM%nbQYR8$7HB&dK31aKlO$g9lZGGC5DRo!c2Dos`{
z_@;L7N*e?c+3J>=H%B(>UtG?<qRBe#%n&~}2==eSCyo+tl8aDQUQ_fJS^bmS+&$m|
zeW($-v_A=BQ+u6vrmH>9PE~;10M&>QmDWDTx*srJ;V=gkx@eLtE_Wf=n*eKfbc_K<
zcPVG7^~?t6wZ$mCQEw~}!t;AE64>~`XSa#+AQYB*g;L!>`Nn%_c<8tm_uKuNU)hF!
zwc>eMS#;EgmJw7)sR9DjA<<z3`VKozi;O>3R?<6E+7QkH#xNZ}*d2;s(a^0Rd9qkN
z$dErR-Bbg*=E4~fvM^EQek8<Q*|zP-H?!;7S6!(|pnK|jWMt<A<fq~OXHePR-j?oQ
z1?&qOf&E#bd-O?qVIli7#-^k?X?GC_gFd)c@k%l;%6ZkkrvLBWk1u4}8=qM$7B8xw
ztu%k;N_TauNx>`Qn~K$qDOP0AxVOLG`x9G7S-IKK2uHzOu3pXB&)Cvp%h@>-J_q<Z
zTb9JU)p+xU&11yberX)$*|YU9co;&!_P1}fZo9!iKyGiy%g8)6r;1Ld#$EKddP56x
z?wlN-L_sM@NzB>C9^j+Z4R;>ZH;En<Dau=7)N=E=BB7&sx>=+E-^RiMmZW=(r63>F
z7$<rts<o%61-m#3`E%eJ>b<#8eE!DQnC@)twz5`x9_!fu4ViYU>vogHYFm;~>sX>;
zWrYk+Y#}=PHk<UhlT+Lf37Fkl!vd(No35@fgujAaYVXw(ZNDFZ#Sotapy{kvW<9sP
zd(C}KqTp}0P9>BsJM0iH{o6XTO@dymO~0MBz2$WA@nLFtX{mlH;WHaYN2vLQ;GXt#
z^o;(*){cG*^Ux#*|F}4Qt{k_v?I%I+DNuU?a&rELM)%ihey$^JxAv<a>Uai`85wfu
zjF(>Yh?-ONdl5JhAQa-Q)L89FY{U;GCVKnkTklbVxT2%)ncfW_78uSuIywVF6F?RQ
zV+NA_HxR)h0C(Xc)FiI1qSF1k&@mXDAz=5M3XUqy$3Js|Empmat7R~byhE!ZD5rl1
zJd~{qCI*9ZEr$U+7kvkKw+jm_7*oH$_azmkq)fNO=4|bYqp5SPG{;mj`3iJ%jzx-`
z+UsxD<5kIvx$f(GF0yb0MThURunLt|`5O;Pm3?o>%v<jXej@i-lT4d(hD<id8?d5)
zhn`N8D@$weRc5@2v=uI7L&d>S)G3qoe%(6IdUcHajXnNv$QS#gAbsI5IMHJ>39?hb
z9nbLdfq9OL6OnjF?D^b<*AH3}xHvhPG%G*;X7G9ZIX&G`2wTY=6O(SO*Q5{9M7r{X
zy+lj=0&m`%>NT61w>kY$RaJ`q_U)Za6c0TO?tD~pG^(ZL0}t){WMtQ%QD;Khe?dFm
z(V(h0`Y|Bj=hX&c$B=7vjBvUV#F2d5RbgPw@0*(P4a>#K>8r^`&Cj+?nnZQPoEQT1
zMR5T_Zm!UDAir?^SsM_Mt-Y*RT<?7Ho%E#NvvUp7`46gz!AJz$)9FqdsE$C^C}_P7
zEr27EV9{MtaZqiWE_Ad#D3_JM=cbak-kb>s<)W4KYEu5FuC(;|P)w?Be#0m$8L3uq
z$lt!ooLhxBRli2H-cQUHxRe@mxU*uB!bSC7F=DUH3gtmXw$etW!ao1rd^4pxIXl{5
zuM5meY;G$)O3B`1lZMUzfRq_x&6DYBZV1wEf!OaIj0xlGp4+zj<Rn}Sw%v3#7v&F`
z;FEzbyozjq<Rx;nGO|;vE!*<r13cEB_>)tk;H(LeY8sdsBxj|Nhmp)IfDjY-`x%{^
zv54fngacjHTqlI{=xCJ!V!aS%)V+UNzK(uNd9iQDN!H&5FfqY6v3h+ea}YK<X0;4I
zEEfQ&$tig|htS6yBNM4a-B|U-(3Upa$o61w-vj9rJDoj0evGQhZ~?hdG&Hh?)?Tc1
zn<EHcx%(6t!3bhcPWQm$y#VMk)Kl59AVpZ4&1-!?JR5q_tHh+F+S};o&JXF|Tnn#E
zZRQjeDZh~-Ow=d-4lXoRjgF~?$ok2lN3^tf7C#(0C5Q;Id_uo{3H^JGFnYg4D6dWt
zfI{f|0!?lqwOq!arKP|93|hna*Z4>!<+od_xHMDjQx9C-A?FhwwMm#<9oBvyGoJ`B
z^5L4}2My8|%)jcN*22Zc!+&vCGbJyb-85+%vh*t}sGE@wXT8sO%Bd~2F-E&^{;PRC
z5~m=BF*rotjdFBOH#>lUEW?CJw$~t$O*IFWS{d1{<`%EmGUx(<26;m-s2(3&hyKe#
z=gL)=DV6jgVClfMEOvE|XRQ*<XhF?q!uOE}*JoEY{?&Z=J7^a6^RpWm96|Qy6@Nce
z?Tp<*KxH50!vfk*mUY?vpGgeCsRW9Jkxv%;Do=?B3Ef=J4i3@3juW8yao9E!vMTBx
z^=4(A_LDvHOHuTJCA@x!6DLFV0kLW955nH>8e(wUlkts(mPSie9gNbZbLnf6fcxhZ
z(C?*;#=*g1U0m#Ce-Z^HNlirsHNp5MB0Z=!Ct!UO6B$cZ>511RXt2MpNZU+HMy6Fr
z`=3VhV^DgG;YdsW#@H+awVbLse({#s>ds23)i&Lg-!4z{`DRDt$?4e-YZaBOY#|JX
z!=>xn$r1aiGd<1Att~l=r0;ibzlM;M%?HqsKj$dP+7NJM73H8e!kJIGxTuPovVf#U
z$auecLY1#W8~FLi&es0@`}2saFD)3vvKFyK;I12Mzcc-E>WPSpt2+sT=-aog1C3AN
zk-dawkxzH8dHE%#&0Duxm)L=!p|zQQ8@xrm-M>TqzXEg{#wK|URFHx2ju*7MM>bV_
z_>;7hs-*O&ah18Ha~?(_eEj8NvfLZ_&TRNlbQ51nOEcI9hL({Jo;5bRj;ZOp{R3E0
z0}CG@QM2heYig3bAlHLOcU;b&<HwUQ7h9kR0@z^V`Cn97IhuP}`=c{~|0qhUon6ky
zZj%0u>h3>xXVuxZ2`=J}#SNz5J}cz*9UD<eB5}<w-vX{)Zq#UvbrJBG7f$n>Cr2v)
z@&kjC7dCaUTDf?9jBzb?5kkzHUQ>e+>jFVRdoEpa@=TCRUdrhJ5iAAEV2l?{Ofxdh
zm<_Gn5gZ~Bo&a6@^77KBfNM~peG!xtnfCfX4~bzLOB$ei12bKBHxkbS8+g_WI9!;j
zpVv7qegTjXm?Nj%Sp`|y=Ug0QZ1u$EqV}B9tPu3v9fQY0NeLonnN+13f&1USy}sc&
z;X6-lc4X|2Pd^*&?}w-O&ElBw)xY3OdiwIbg&$fSPh;Z#c<H*V?l6O3H8zE2cP0#k
zsE!Uc*5=le=eG~(q&ot6c{T3dG=K;dEFZ?k%lEH7$#%(@4(;}ca^g5098oM4w=MmJ
z)=<Tt*n-yMHJANGMYbT)e@*`M=G$Yt9S6t55nZdi9T+otJXYRVS~9!R;4R@{+HmCj
z)%DUoAlxXmby=Er>j%x%;lY6WpZmkFhe1F!hK+MQQJeU}c%)m?3-Uu_fBszDC5I8f
zs!i*3A8oA4r5An||D&uh#rn1|3SZw^^8xHcOc>~(1V_6>ucc?ZZo1O0_<IB4#!A}b
z{0j44{3BGtnB1gk?fzSp-z8wDWBQw0n{c1vX<x`YqjZdtqLUA&uwP>l5S$*PiXg8@
zLTLT}(b%jt^-o#1`_erQ>fgc9nTtGukB<*|Mg<-Oe0=oT$;p)U)^D_@R{?B-U?X6v
zXJ%3NcKe%xLctfCW<JWw$A_U!SbH^d{p0B9HF#?zk)t6K!hQqqwTen=c?N}caKgn-
zNO*E!aik{vKbqwlf21!)OJzZ*E%zH3=I`Gc_ljzE_QGc!t%M3J4{JeM+u11#!st?R
z&NFcX(m~&}wYAlicTtOtbil*3w6(1+@V}P0(Co`9EqyLHUs)4R{k`*$|KvCPlE6S-
z*V!P0NkXXg?SLU-XTtOGN>4W=D!hL`KBu2*W|sA@#QdEk5INoQ%z%hIc_gEu5d#eb
zQhS*f7cV$}e2<Q{<Gc7*VO~-q*BHbjE^cfhIa*fcXch8Ca%$rxeeuBHb3)F(^qiar
zw}M#Sxb!h?*QbXVpp1QI7LVh0b0w{>FAVqD#N<Sf>=znZ+P2_?A7Jya&Mi#KO{+E-
ze@h$^6(7%Q)=X&OqT#}D(mAx8O|Z2U_pbLrbmVu&Cx3TmXZw2T*Ic%6Eux-+=rq$o
zlP}aOCn%CHN=nm><b}q)pPwO_{~*mgES~4Ju5Ny6D!1*~TJ>p4A$ty>B@fBYncZh1
zO0&H}D(z%nz3S^4jFwmw*t@i1Y5=Ftk64U1mG09WDqgUxYG4)>mJn7LYd#ujikAB)
zfN)@7=+H^<1UZs)#fK(1HUNj!#3YVO2$%5u_`0k+I3jfX(R6@o8+~)Fg7k)aAuhGm
zqvWM!JZiN(ud}s;FGX2FLCCDE6oZ5#2#f_aKT)uv?+Y})-yR=0Sib0HY`P~2se7yY
zi<b~o=<nZpQ!D(B?H=_0u*^v4;2{66Wv#4CJwMWvGb=lY-sdq8PcQO2lo(TVg|H=&
z36zuyAt$7)jN<`D2q-JT-X$Lw15kOGA@a)Kw-t7i*5FS<K=gw`du5f`pD`L(Uf6?8
zWoVPs9S2WMO-%uXItIg0Im8WwFaNK&0kYBGe#U-)*OK~NeW3k^>E=B;Tid*MMV4CI
z$(Tg_=ac|{XH<!*MvS7Xka@2|FBYW(3xj;p&4k0P{CqV20PPD{QeG~;|7Y!GpC8Q0
z$<doYG^AERc3TB`Df=x&dW4(+VpTFh#+3mh80QyP+OeA?S>G1mcyN9Lu$Io&g?Ohh
zFg%=nB2qzH{{HQBv^44)f>VLZveD5|7uU1OD(8|?_L)EOP^m~(D=<AXLtgl9+~-^t
z)O;9)PG;tYfF79c)><OetO>b0*L~=SLtRXVB@zG<PA;yzu(!{xdkn77WYw8|@Y}RD
zqYl0&t9bx78z$Mf*YXD9f#k<+HK_|@8YR+5Mh)8a@=w)75BxI%@@s1;UkIPfcuXD~
z*!C&b-C&tVgM8f9*1nWv>!ZT{Z-`{bP7O<YNg7DKp1&FG>+9!HbAM}_^zGZX28#)~
zfm;5%dW!$XvVtdGz>^iQ<AOe}xk*$!;Ar7U3e-(JtnLzPYp4n2f~J@|uz-MSwsx0r
zp7#0k<<4PrF#q%^mjWT!Ye!EXn&|Iw-8X*?%nm3}!2C4WpYC#TV%hmCaBx5Nu^>gC
zBt+F17`DkhAQQMt;zu@{Zd8qjiyL%qR~Mf-@z&LxDy6Ue`3vvk<fcn?masT>OO}Z{
zRnGf=?{o>D@&9A$Dl0*ngdkM+5*YBm)3NjlHx2eG{Y_;0Zfv)RpTiD8GK!439nYyh
z@$+*gdUOw|Kx=xD1$2EETW<o-kI$+VsPL-bwtmNNzRS%^sJ>1Nll6r{@0%#X2dx9k
z^I$yReqwmtN9;9wLw06mA0i*Z=V<k|%;@=B6ngqPetV<a3^RODOOCXWeHrU3?@w+&
zBxaFnl1p-+i2WQ~7DVj)C5vihv@cd#8$>T(<hz`A@`5NkseWGAyQ$xb47L#G3O7SW
z(lZapM2pMq#)AGth?(GXvYaW{nf#1kL1GAxL<oxjkYp<}T;KF|{LFW(=CV9;x4VkP
zZ1_K7g`eU;cTY^rq}5E9xCn4PorSOq!BGzotx4X;0^ZAQl$mvNd?|!*K@HjG@&A41
zz#Pe*#qlV&7_!;X|9$8{v9~5hL95eGD@)53D-KYkQIF<By2S)c5^L3Bz*|+HShQFl
z&8Jp_3IwEh@DNA!dEC<C$Ee2KeA@iCrzd!#;+@vm5`gyoo^oAkzKbTsl##e)fgiNN
zlqT#=4LxNu3p#Q)2Wh+l)ZJt4-<+ug>0m5`H_B;O90p`p*R#C0HH1Rl#6%V(i6}l>
zx0a(r48?sRQQscrP8KX0E8pwD8`F_*{@mrAuqLq$@k{fV6oLpB0ZGr8o^x^ORC_Kz
z(SMyrqAN@$Wb-4sb#s0GQ*DN_vT}*w(|fm`_x)4V#2{beB%Y+rS3#@Noy_$GjFVeO
ziEZO6t2;GoDJec*=lVN4%^<0r&(Sg}DvFXKYTHHA?@Y?k0T1FPKy<9AaC2h6bi7F;
zi9Cuhg+R~5_-Ntp|2oYkkI*VSN5;C>_rhz}q^K>>-8m{EP;kpmdyGy(6LmiZG=9P;
z5~KU)PEz@45&k>lCHJdl+Rv@ZN@}Xcyn6^vsOYF*c6+yKWcwl)iyW3bNzIIc%#V-9
zvU1ZvP89L|yMm|lJDAN>@s42(h~l<blS;3ux|WqebK}TCn#}!xs9q%FpOX_8kz(s9
ztfM|X;pZm~426(q4%Kau=BcTfS#)&t@aU*RsmN)MfS{l!+*b<=J|Hi#T9t<?Zc***
zAH%)LnMts?!^-~cVh5wES`g~Mb9398ng(6A$Paw|d_hE_KKdG_hSOFxQ_i2s-t6CH
zAP!)ALk=>z-u|2bz;Bu`j$HH)wFTz8*~swlWrNDj6CQLlw5JSN?~EgBOdu;@c(~u(
z+S)DlBE5VS1?g7ILUE2<$38BhP<#E!%yZjA+aGTc8KWgP*4F&|5oKj$vVUh`zgGQE
z?m#{$x|)LT@^dUF|94o!{sTQQ;eza5Rh8n+LtMG!SKq$B#+Ko05Y;UUVF$@8B4XNB
zoSecgjS|^$?K=f4uCDx42P<Q74c2ZB$-a%3n+veTDDctSB2rM)CFDW1iCcWcl$*9-
z|9J1vFelgoTnCo0;P37qf!^J&zZ*rt%Kr&@kbPAkB_oA~f)e%3mg~E`HBI9&7b+24
z+`3NkuTb1rW2q5BQh+Fgrv<<p$p;>lAj8eddYWG3vyDdRlO4#sV4Fl=rSA5WG5fQ7
z4PTEbt%tV#BBK|9&D$#AjV*$BLf>LTwUM|+NULnudP9yAXoQHKb1+$Gp`0&7Gg{*L
zP>)AufBY>nKk{6GZme-cD7$`DhDrz(uC%j4&o2d#9dPAzbj^%)N9#yY$h)v$E360Q
z<qcv6?wwov+jw)Vpen~<2H$P8xmik!zhboF%OK~KFs$W#>Hx04e+NE&@L9jcCLVk*
z=|`_T3f|9m|Jz0XlHv&~EBZs?O6${bf<POXu3?-6k=CS>)m8ubJ^0N^h=}4Sg7~R}
zo0}cAyO?0nXV%xpexlwWG%9qBklybM3-rv19s*&#`0ddk>PN4t+n(oAX#-~FW;z*v
zw#?=@${0U-1;oYW1pl?iGk%VUNJ~UCo&|Ou@`+3Sla8<+b?fupfA)U6hQ~;E?(}8M
z8B^_rA<?tVQSrpzIV+qaMwpw$$g{cQ>B%qj;(rSO*qgog|ML+3`?I|B|7ae<@TR^7
z$Vbr+@7fj})YMSEyyJ;@=MLz;f4-M4??Qh6o@i$o{bM3xJc~kVzo$LRojY?Bs1ryZ
zX^BJV6r#`iE8&_<RAQZR-aACMcvB84WK7|&=G-h4JQb_E^2)y#Tjklg$sV&PD0)P@
zLS9c$GtU(PoUP!}WqVc#`mD~5ZW(86H>hbU<3cL)fn4>9f)2S@=y_5D7u6MxSDikj
zr^$SI3fb_m=(`;pQJ#d?#HZ#f_O0Y@0=A6m*f7#MGu|N&g%)|WEX>>6=RqdWQsCzJ
zy2{AVl7NuyPgWL(+2Y%SS*T5+Y^ZxsX!i{o9Ay-E+;(1D={)rG%kxA$0Hq9pe}2-d
zC!1V3nR$71hj@rCE$4?(I+d<B>&21?*&u!tkqj#@DKWE_G%!p|xH*J<8{<6K#+VWG
zrddz2bG6HTt{kg{|D}_&Hn+F`O8hLfQ9Z<WYSq#ru*iuCF9Sx#q1VHM&j#{lD=zp?
z*ay)-S$pHzfP^F=;v)jFNTAxm)oHdZ!4np4&=*bxbPD`RL0`}#B6Q*eysFZcWw{+=
zM3R|wtD+PLgq&_336en2Kbk@;ho-PFFE#ZsXjb_$wwBlV`Z^^fHFpOy!T^}+i4)LJ
zJ+38*xxyqS;bQOeI`a?7?tk`m@IW72(Z;l;?Z>*kDZt5gMdwx89xsHaB40ecoD&K#
zGVT^%un)X;!;JnG<<A<|&#j3tZOA>=Fga+w8LA7^iYxVX`*7^Qz%0BU&ek+Hthg6l
zJTTTaNAG(j2sHE)086>GMH+*@BUJE=o<7K(3K&0ldj<w%R79(Da+ZcSe-*DP!jqLf
zSK@=pM}x_g#AoKoMMY0NApxrk46l2#OGe9*VdN%e7X3q0XBQ3w@aM(YHkM5*&;g9L
z&Z|xUWnDAimICEc3;qNIFdULa9jpxR;|3J?Jwl^3yDp21`wQL%6El(=ol;6}Rs!vq
zRP!h!YKo&Y@~A4M&2k1thTb0nM8w<ET%KExTwMH)m9VGeqt5VgjP(WUXSv@<s^_Qt
zVPcs-2dJG#-j@+ku+!|L!-qZ;G)#xl9cDlA^LTYV&ACWnLF@y4(uG*9N0VTuP6W;y
z5W#`L?b)fRGZyCK#ug!9?OY@1I^K}ZNwJ<pf#D7w=hb8$9tT70t3B}&1mJ^KW#oR~
zaLn|S<+I}F!I6=`H<g|R+gMwgpj$JW9(j2?51X%$r)`~Xo#$ekLd^5UYKbriG=WDi
z1uJXA2vq2D+gz1^uLx=$;NoD?sTi2GCOr8Kk9_zZp~O4FXj~(XvILSxqulT-m>C(#
zEclGTnU8kxMSzD!8wVdJ;e~M&c+>s;xz4ToO-qi$H9d)lT1^d`TLswJxhBhu6C+be
zJjtT!?n%Cr#~dBq%+JVHOvNVqzz@a&0c{UyR0bahaBMkR+;+E&=T=lap<bMR#oa4V
z?WwLlN|VT*X93zvRZY$4D~W1h9R+>(?GHucAQW;DccG-jUX4i`4Cj8S{JtSE6{Zbn
zMDHs>i2#K=Oqw|CkeYpk2ACN%F<wx(t&)w39U$&uB>NG&?lKd;$h2RtL8aOV9IMyi
zu^7WrDm?XcjXFHC7(+kt;l#!g|2iWQ$wDULNikk+j8QOt$99=}Hq5L2o#V;&*56oe
z>vuC_as{kUnWSXBB>PjWwCY+Kr-*M=Dk>_R#3=SoV+Z>CZw`i46cq9p?s}W6S&~j@
zDkg9a+yCJemyMO9D|SeYqFdhc)@5R*Gc_{>b=#?8foa3RIi+kzBUS#Q&Jgzy-;0W!
zahK1DVP2-TH|60G5i>Q1Y;PN&CgruNy63qv#%)KQ=htYJfxbT9+uLPX2UQ0=a=W{C
z>ZNaqgEETAH6|uBWxF~L4(%ki13xBH($OiTZR{W1WL707Co?e8-+tn_l`OQmjw155
z3vjRI^4k!4|5RL7Q%xdj+pY9B<k5`P+{fWJng5$q34<T2uE2J>)1|ZGmzkn~NGY+5
z2J%O9CFdc*tp;_eSzjh*rX}qi9?YcEK+b^X+lj4d2f`YDtgz`GWgPyPU=&r=?~j<b
zZ4Bl637G%pGQ6EQahw$ZmSE%6@!PkWmy<}u8;@Knh5XvAisg>6!oqL!^(5w|LN?2<
zrj>&qSiIM+*Z|26wfe!~VW(+HSy>bX1NGzsmAj!FXlP%|Dm)N*bVHW0aC{zXk_3Fl
z&=hYG)2(%XJNt_J`Qs1Q6Ho4W*Q?P{r|j_tHoH&;ap%pZ<m5>753DRwA1gK~&oAEf
zqC1=BVM4BSo(a|F?e5N@=CT+bNcokP@d%F~Cg$zdjEj`8unmvP!hXx$v1R1EDB4Kz
z$0${f*I}JmXiF*4(TNXLxv4m=z&7|{d9w7d&&Q=}0e4~UxL{=DBr9tp!&3lY*ym?a
zctQd2$?DYHNV>QXxkK9tnopAId>3GP$nGWSNG&bni>=++Ah8TEu^G(|K|_nX+&VYB
z+GK|ULLE)@Y9@OfQBeV{+lO0xJ3{X#ydl(Fo9pl21cAiFu)2z0Ut?pDZ?%QJ?Hn>)
zSH1WgmM3UYd@3qkxGbm2jFe1U14@4W6k4T3zCt@IjG5CjHI4fo|64x!;k@I6M$d-?
zIFBZ<3NJh)h_|Yz$ZNcodpGe}Vy^Su(6}P6y{PshqOSSt3Y?hl)6=gOQk%R(?Dp6{
zK<y!I{rThKQeNIOwt)FXO6*N;%wIIL{X>kiALlp2n?m&YSMK-WZy2%GirJ?m(?N9E
z+RKMOai;khYZlo9MNA6lPy@4oKyVGZu11-WU+SmqFGWvXlM%>`ei`4VQ=||n#m2&#
zC|!gmWsR}UmVV9C6Gh0In_t-4Us#Tuc1xXSEaM8*Pd0~+^Zd4}hLPeMin;lB<ipVZ
zyf%I)*`C<cj|p`h4Ttw672e#@`$)`pQBqzGsS!)okM7(dGzKuWs=7MBku_XOtLRBi
zLBUHUn~&IZvQXD#x|{}!IQhgNB?=A>j-$=KoV@HfX(>L}SN>`G9&`-=Pr~dSoskfk
zEIk#dlwOM+>2FO_x1C_p$@K+S&id1vM>S?&mNE>j<+{-;CiriOH5ir`e?w5DqZV1o
z0Jz-pHN<z9T8~7@3^PAzS5Z}k2s$Wi^=Bm}CKSc`77@WoI;qEVyq6gKC+;dt=XSqW
zOzxYD+VNS(C$DU=`-i%@&S(EF{)nI;H=Vtd-o)a@(d!4<8bY%lHH0bOrAO_f=G(mE
zphBbYN#eD`uc&s_t#tfdlWY7k<M6Yy_gE)F21&s3V}jmE4B?)bXDdS^BM7~T{o~_z
zg}=tdHTH{UWFR4IPmw)e;@7xXxFb3jP+>eg#F@iv38}o4C<pO8mASbvPtikU6=V`r
zIk(ohpk5kLqHLrOf+f({RFCS(lRhY^ss5w%&?l+f`m&Mu*Dsn$xeu?PnQW?PVIcwv
zED4Y6Ct+tyy@rIty~GDdi(BWBi)}G3RhL&c*AZ@(mSk?4l0^klT36Z8`3W3^56)f)
zQPgE+UF7nO>SseRdt-`EXD3?B?rI0dQ3#wd5FaZe8<fZ&(%pT@@4GON{wkhS3#ye{
z`sxt`ezzZBr>En$(E1f<APK)RF=-1=y;LCOTU}W4oL|rg&i{z(DR}d>5*<jQ19V&D
zqkK37-oAMg>DSTHB3>A_bE?ZtPtCl!w3MEelCV#CJ#!t~PLGQl**BEL@9d0x5+#E5
zT1mrmdBYF!Flv2cje7V#eUld&GIIX_WU3F8K|=mX|8&ll;@TD7qeo<0TCY`yNQgIa
zaTalK7Qedsz)&4?aWT<YcM|R3<YZ#>i<hqwH&E<Fe5fQ6V;8D`z|s8xM~B<*H-9T5
zxp23%;smhEbMitxg@wtd2t=@k;Q1p+-96J2E=?Gm@mgJ7JE+q43_cSXd089#52~+T
ziBublx2FJV`Sa(ubm*Vapn!np;oI-g%-Z8q1Md3+=b7zf*Ij7T$SevyZHk79ar_TX
zNv|ofP(}?|gk0SzDkI`ZXEl*)gMvDxX{sum35kP^*$62F)7u2APFXj&(&aIpGBdM0
z`Rin38x1Y8p0R|NYY7Ex<G{2BbCqUR%*|X+w%d-*Sn2e256g;bM+OCLPFI&h5$4*O
zX+U%dAxX%m$L-BVahaK8v1jVMmE*6oW_WN1Ny_s+2TDIkr}&`ej9ru&cKWON7q`ZE
zOsb~HN3R!z(<3Fng#kT-?+-m;nV1-Y5UwtDmZ6d1hiZo5ByC~O%Gt^nRte-3Lc_%0
z->Ini78M2bT~`+)%-cA%d6`LDD;vL)l3r^mpMh)V2w#s+lU@nC@JFmVl8XOeI+E(^
zzJ$89SYA=v)P5NXp+G1Pxd~rJJ`1%m>;^syI+X2f?a2B62>e(KeEArpQ0uRb#l*zy
zY>RdTDn4yRZs+H~oRFay3y0ygwi!pnr-!Og-5U}eeYA0Wc-MqeV}gGS#CY(DLmv}&
zIcJ^A;ZsWXhu7I(zZPUvhm~=arl+qsOre+PIhH9vH7_W}>}~Czb8x=5G_P^m#Xn%#
zo2>cbrm*yQVr-1Do$;Nqu}<ZM8+T{@M*`a_9=G-`Mzz;bZEba~(HHpaqtbt9#1Yfr
zs5nQg%-0bz*-Qi9H2_(dnw3VEW!}g!W1oWp@$fLsyZoSxiay-=cHVNyV{ztB96`|=
z1%<oPO}4K-wyi`*M8L%XQP!WNshDXEP4#TATa9TJWT1HIU=o3kr0toBmv=6)MKxIl
z4bw9shBf<(fUsSM%!|)8Sy?G`BKS2fn?JL%s>0{rG&5(54qslBqK=G-7GM-?Cjb2D
zAD^3=;-l<%lF_B^Wn%kGzg)&cK=hdkBMAJauHq&$mHh~$D|p->M+5>8e0=_BIvM<o
zt$Ro}ujh~dCx(D4`zwz%h<VDm9u|h}0w<vmLz<bHB(^{cnoZ!+zqmgSJ`sF8W`>no
zXV~@2w@!O1HoCi87n$_Uu}Oi!(IEy~AGc4rh}ZRm{qaTG%1S=G_n;|Rdqpog;>HF;
z2p2Bt^XHtf?Z8L>3A@wq<uTuz7LqNypg?J77dg3J=jf=DhaE9;bc#m_R}7n?${dGz
zw>P`yW@gE`;sSO%G&ciLQ4!#d{vN3cUg7ip$V<5}!kk4z*HSl3B*GlZ0#Xr>Q$W;+
z_SGV{Sa<7G#lrS7m}x#$81Dy*2ITKiqFhW2A@F(8pDU2D-SuR}Lb9lcV4LPKee=+E
z|Iakm5^S`gil0TvWm3Nnm>LuE3GFR)3=kj_-V<tOmc^%2`R!_uVo=al6RV&o?}l!U
zPxO9VrN)L+iU!;rwpKa{7negvr@z~4j7yZESp4;nsTZ&Qch%RAQJ!9B?}Ft~MC(ub
z3cB~pSISo>DqiZTTz(hpDs%(Jp4BxazlyR%G&PaqEh2P3=7t!)*C;Ic7X16SUuDd4
z*>>z)B20n&f42JrD=RAe{5ohe^H@Gy#ND}lkA(oFrcz1C^z@(pAa|QaX&QePO;s&r
zLc7H;$=;}g`D0;NkFc(OoX0yd<|jD}t^+nksC!rFPz2x3&W?i5rXFssb^3eW1!gU-
zjIyy46Re<?K)Ps!D?wItH5miZ(sCmw29jouNySnM``;k*t?nHs7YtK9rMi%3y*dum
zH!ZRDQZ6YOx9tjThlJdTJkjCQ@6k`&8NuOxYkRSlJ2^U^C@0UX=IeiW5Mj1yHeAVR
zVMz)Hd70&`@9Z;8i1W(LrGESvvT_l0m6Vlpf1iuodbaygeo9K}8_n<D`y;Mf_8kw(
zZQB!rqLH2nsEdd!Y^tw}nGq@mx*bL^e2lJ|DE|WQIDv=1%y7^f=qCy)4px)sCpNS+
z27Rr~$rQtpcIZQv7q4q_`?2F|gx~k`X}wu_HT%kGZI3*-@o!gGN7tp59ebKnV-i9d
zMZ1yh>m?S*{;0ZmYsJDcxW59v|4r^Zru-!RrK{eCrfxp&-DeKLR-%TVeq@eS6uyHM
zAdiLo%KZuh1B0%0F`jH%Js_ab5EJgd?$|O}=?;7QlF{MO7{ajAqdg70+MMKMSlM(^
z)$t%DC|v4FW1PZG)jKNDx*pOlkOnc&82>;kdZP79ZEfZcUHAI*oHWU;W?~WrnKX{<
zoVeo^cDXp&*tv^!ikK>DldbBB(Vx*i?i*;#3RZhcpUvhO7ZaSrl)}kB_2=;Lu%xuD
zq_kXB?PeWg|HJ9Sm}){FLZ}V~$Qu67HU(1Gy}gH5*%0QLl2YXD-LKc#*VKJ!_zr0y
zN*oSxQ^@tR%F|KLyMdmh{M0v@w{<xvn&yU<vokYlv#+d8^%fSF0c#rhH8ak`sRg<N
zk}|?IlGCHU_nZ?nb-#5IYGb(qy#8LXB^52KEF2tSKv2g1JvmgAI6=#IikLOPeu<C0
z&?G^&zj3x8w|Ip2J%#EY9T6S%Ju@q7^39}fjpzE*xlnc?m$6*4f9}0|A`rAP@hIz4
z&0+Cs7<5bDy*1OfqGioDeK8{<u5sKI%?c;ZNEDZnCU+z9vwCZKCb_a=hnyTH0&MJO
zoNN#`pcV4PWn*2CoyJ+oT+`ga0nZ^gFSSN?XavJr1!q3=WASKhn(}eqyJzGuC|zBr
zHw#t?m58H~l8Rwt_kVNhfR_od6BJjN<`XICwAJW+aiO2)o4C3t?KLvseNu0DC@Uj<
zytA1Pk5X`Bboch^6NeKM654(EK;xy$J6j_Qxh}AqcK-dV_r84bo3Ak)b^B#-Ng-YO
z#5eX2DjZzI=)!#vadSn7w6;N5|0O<BYG~lspKa}@e4LYaQptgu=uUW^pOtklZw%=|
zBD*oV2?@1JjfmeQxjb4|+XFh8Q+Jy?LLc@d>!Z)>!Z4$m;s`h8fGMZ2aPt1*UkH8}
z%|REXF!K4RZ<^fw6rL(cNo%VlU-v0%e*X@X8HS=bJ6jt#^^T8AKiu0onW3<F{&{+~
z&{&zOv-zFR^~d{+bZlRg<W*JDxexsPtKLbPtZws-#=5D-q|+hVs63S16~^Lhm|(FV
z-^k0$>+H1sf<HXoVcAvo`L1Fyq1^SuH~VaYPTJZbHSv*<Xf?rXZoLWy);&)Zv)fgU
z8dd~h2_!nW^1P~yZN8NyC+}B15C8LrhB%k=!-WOKuC(f~hs_E53&C{tCdaNKQW53f
zRd9B_UuS5?L;AFT<B?SvgLfk*AvQ0H)yy%+r@-3x*~n+RRo~}7)4aI#G(3$c%51T7
zI``UPbISWQM1U8c7^Vv)szjytY*Ac_j#}>e*JIjr)yjHYvK(*2<OCseV>mU~>yPyj
zyY<*oxVDEzx##8{JKC2Bxe&WuEm0c%y@ePmddc#+${?6yfZT$_l|TIMpiK#N%nJ;Z
z#tI}gQPjo3jr{l+s&4jAWleUc>q2P2O<`tXV6~xJ$AyN9mYg3<Vt#S>r3Kn+r>6K-
z=x#a3Z|PYvXD6Kuk=z-)>KLxB?tx$P<L%P&^6+4PS4a0ujftiUB8*8+#$#16!jy^$
ztp;-CCng(1F&rGWLiuloW;YuSu;q1QIftJ21+l;yz#Aw=NvZ#DnitT%&!?F&%MwSv
zCjk;cbh}MBC->Z`#bw<FTi1+()UC!!(4-CDv(NX1*T8&_je=nJEW4oZIr=K=WSIbt
zPg0f6piwXv-ge8#ZoC>EjsfeV^}R$Y5q!(c{6uzhTNM@R7&)CXqvfrb!<jn8PpZL%
z^J6P3E0&YoY3XTLD83yxLWnn<=2y;kM={!CSDx!RfgKg?pVt^`BCi%(f115lPH_@T
z8Px0Q8yccvV#>)(3eLGVx4H;f=a0jsNJ*RThDecR<$2fc!^X2Ogea`384%W-k(IKs
ze4fku7;|}LMFX!aFNuwnisMgeYCLR%9Vva%wJNZ}6c^ptC&5VB9rOHFdt=hKndhl$
znDkSA-Z?QPC20{YnKwU3ISs9Jbb77>Ji5K+uZ%ecIN)rdp>4xOL68kX)lZ&(c5l^U
zwxd<w)r)nAy{bSP#7yO$maprV)=^ROPj_bfhlio$tI*M*S&YKVSt#|PYFJS0W%QsV
zeEP%F)43VuSa_9#UIQh%3S>3z#|9z>SN%;HyHk}7uW{Lqn)Vp^=WdDk1s361Q>V>i
z$GoDv8>qvTt!A-zh{1Eb$^IW1I6l9Z1azbb)zznm^w$dBRnONkdw=~*FdlB67(4p>
zHZA|#*Gfw03B^x%dG&9Tr@OmnzpW0mFs}G9ogb}J+ctZHoySd+MAmprh#R|Tt+#7b
z?&Nm8rOV`T!9iGSSJP<g#7+5ZuU6Q3YIU`yyu9J`&vsbhYUQO3HqIbPwMC3Jfj>mx
zc(V{@KuG!FgXx9OZT_GD(V1MVe;@%)eD}uePXVW3whIjWVi_{Q{P^)0J?g_)<k<DW
zceZvm@|ZsnxP4*X#?9Gc(XH&8xyfbJs<AZ$vq<OjE@-`hyXu-=KAy{1LSbjM`qZki
zTvoQ@+qXyXgF`bjEc6)#CacN6Rqpk#F8_?xu$(G+aqaPxKAgv?M+97eaPrL!Yr+)N
zU`H@h<#9cf-!`}Qm1NWskQL*-tMw0(dy|#fpc`wiLb&o}(VU)`K-#q<y$51`IQ-F!
z|E8g{!y)9%VlwL;-xRkI3$I90^74=%ES!-C8PW8Ig(r&7FB)TTV;&t{^V(w|BTFh`
z3LFl$t&xSdLm`R2ZT_-GKu<<;;rygx%{yM%e-poGyHPt0ZA))_O?~?Zrmd*q!RJ{y
zS(&-l5&M+WfMC9S%trV?Ti`x9xy}(9iDN@%K&ylyHPvVmW7)bhdIga|xeU;p)~rHC
zXd!ZR6k|@dKBWSrduIJU%RW9L==k0KlF@LI!rgk9$a#G59sRnciLInyHoLMCsz+MP
zM=b_M(y2(w_e-2OVaQkX3Yh)nYg6DvZlTwLAi=&fMYg=XPQdRppC>Shw8a>Zf4cHF
zA@TYg*L{WD`{h`nW#Xrr!H-ts4MV#h@h}(do)HFv$Nj=tF(OhW>6nFj6XVoGSM!qg
zIWuB4#{(pZ_lE}u{>-|XnwrJ5u7=Rn0KgJaS<isMJ=+;#iMF;Qvwwkd;u}J~kML<u
zXDerihT5B&x|*8!=G=8|<vhPO?)G9my7~I7;ltw9<3~$)9Y)x~cZHqj{3UyI6(~Z+
z3M|JXzS~&q-~@`*1x8j^S9^-)G82j<FnQQ~q};n7cC~@|rv&hz1#%<-_v<e$vY&7x
z7hs59MLb0$T3=755Uk4oT}a8q$<IOc!g;3=Ld9igDYkzeurSm;-fd=;%(&vTkv(dy
zx|o2=U*p!HgaR2kT#U+NdzHlUW}>n8cDnNAC?sH)Q#m?1#?|eazkeSH^UB8vNXAw;
zh&`aYF*X=TjEn@vnsJor(xrvU85P`@Zmt*HsSp#6SSkDR<trs6)ax(?O<rC^coCr0
z=9v?@9~D+%x9b1nNAt$_O+*CWIfu_((H_O(JSaIrjFEaD9-_pFEey~ynwAWhdtune
ze6Tr?Qc!qVHfQYB^Toq{wy%#c_jER$rg3$j9is5|^AiNTEMCk+B<kMrNt&4W$-U1C
z_%8kBZL>6u?FTIFI03o~xf?qE@cVUf)W_f8&aJ<e7Zq)45OqUAXdgfCMQoG|-A?2+
zL7ST9APhe9Rj-+>7}`hI(A2b>n`6-+8pqg7p`uQK_m=g>MzC_$fZ_p>)ochXB5#Y$
zsQ)l1iip?_wp!BQpw0*k-EM+Gi8+n}3SDh(xL1y~2o;6jl;~*~iP`rB&!sF}RXbf;
zh}k`31bZ<AYB!L5P*-2wkDR^P-C6PbrNL&6iiz1<xQKiq>-P*f&bi`TOhWATkNflR
zPXL&yw5M|cBC_rrG}d-H?|=X(n!{9(2eRYUN&ef3sK`qq@_Wz)Nk`LcgA)i3Ij7@1
zK?ON?6%AE}YxO>V_#u<OaZmv4P=UZ9_=}s9t6n8q^uD4W@*Sl6ioH-RjPeiGb3MKg
zx7;QmQlm$Vzue~h!&;G+cHYv}MoLOrROG?;O=#6fSJFWhCT~EgK1rU`lRSd@FHF*j
z?zLpM3b)k5=F|t5t1wtQZ8dvaPEvPu$p$DX+|h#V9iH`2(RO#l`uw~S`Qi3Njg$Fp
zM|<4V7GjXewonBwxx?s?J47Zn2=?C#DUNgl+|K(`^?bgTrn=kFrOtz}ZpZ)*Eko#w
zU7Ig^nK3vy@pfLQH;#{&&zbno)Ij5387-}aQ9Jti+%|3PcrchSGClp^u>aC(b#89V
zNe?+LL4r|U-i@C6T07h2f*=1R2o_3!S3WY!ozbfk^rojvG`oP*7|eqCMjS411WCl`
z)jf=37MHyo%9ms>V>d7vXj*e2J54EI6XGzNR($3THrdBCG=CVV-m0l3FiZDAfEg4c
zCkQy9jqCY(z53WUyRwUM^ct-GUt?mhs|@C+zOHjy=?o`tSdRZeXKzAqWmZfV_mh{$
z*n2{76RBP8@lx8~@Tyo=+}Opz;k&{v6QB1>!e{;$$xe~B7niR+1wFrv5Tf`zI11J`
zcW+L7NWv?Jr+JhA>8wE0*kqME67_rsb~xc;x+cMKYyXtrEyq8)+P@@TVp^Ga_1Nx|
zKgSB!N5Ej_-zLK-BW@m?o#$rIXG2mm9b;~#{C2-=W^-f9?ESeNJKd*-H+Z$~FK5}y
zF19gGR%>UgAAn5>@kT{eTppH`j^Z|F9haAEGLwIYzR1ztx}Nk>r3|iLKHL)1aXBNK
z{rG^#cZpz5QivdZeRFhXJ@f9nPe^|eG8#?R`5Tbx8bMDiDI~6?<uff;FwG<M8CVka
zoVO1o37Q#90Etk^2!s7wQbNpHt4>^1b+JBK0JfE;4%|sVG>C=v+VgL~DSKoVvLPQk
z+E|PRD!b*?RS2-XTI@u0W~lbA?N9%_&6_Bct4*P%{MN$q{pO;;dUL;BmnTHq`*20$
z;?BBX{jj-ek72kwIRBXquIA8CM;-E&)J<pS3clK~<?wTc``4=hVe35#J9|^C7gbz-
zRSZ;BK=;%qPs_Q0K!S)QL`C_vl8VacP}0#(@S=ogX|c@%R2^Rhn9KWD<7$7{CwHlV
zULbBqyN->J5RSfG|6jj`#3*iU7MW_@e@BEzb$8wjjlG&3<E&S}<^1wRMiSFwHSJ=%
zalI?^^NshQiLA6tKALV%Nk6%NK!CciaAD>0W=;~;5*2^m$iR>U-F}}n+ODsy%?V)B
z^|6nkFPMReiNo;10tkY<9u|%m_st#$n7k#1LXo0u0pb8Is_&wtHaYKC$s3I20IG1Q
z#kQZ&4f{JQv#F4$@)bR1(IcE0;`6orPcWU>+uQT-RGi7jSs0lX*&Zv$aexGWXQJ5B
z_{~{hs>%BjWetsUK$z9@bqPtrwkZ-Mq@<iL%W7~IBFskv*yZ(#+*N*1w>^~l9As{0
z8Vg+8v<HpFFpjgr8`+?Hi7kN&QxhXuSJ6!^W2RdO=G8%7aTHruPoj9|R(Gyrf3Gu`
zJ>6(+U4)H#Yn<eIVR&%n2a+KV&*$~^+1v@|^9`cv^V^yv^(iL@r(@4*wIvxRb?)#~
z>!X$iVNNdM?BqN!9Ay0##>U0V7C9~zy;I$I{|-~b4pG16-kg5%V>69~kM#{Eda&oX
z;%U!r5#WeClF*hfPAa%lQ<Mr;+sulW+BLhrT5+8p>ZdvxO>d(<Ke;u7@C`h??*>*{
z!n$HqEtsGEtD+JTydzSI0O2f(*!ZX^jU=WjUQ>{XrQwAk+}HLOvwfS#GQp)G=x_Ih
zLOf_i<N1ei&!3&_e?lEO0mtgkuRwSRu`=-9U9Wv!`s4x9eUJ2e2*N}}06%!bvR-id
ztFSP+v^1Z<)XK_$SYJ);#G$%?H>Bd;^C3<c4@`R2CiOczq<zWI2#tNNUl<ihy_$=I
z+Okwpw&GZ62Z!NMZ4b%NDX$OJ6~9c|$~<ZXZvw)0nqp9i;o6w1MAxl#bzGgnSfaWS
zzWY~?%ggL7nyc_sj9s0*y(36Vnt%W=W1pCq1QQ|kezH8Pj*j4)`FgJ+<8n;8j;|rN
z$@}bwHKpIl=)<Lehu+&uPpcD+D}b15fbOfRE@)|6z!D*}uzt<RwH5qs{AqU9Q+SFa
zb)&#V+|$|fw_Qp!RJv~@y|JV36ekb?Tu5-zm5{$A6c$BSbd%KkjkJH{WD)a?30VzA
z^ofLH*ImtB0cU5YcYRZ2lP78EbzL1D?{F|N{4dC`f_t@fbfUgrzxOG<hF4Ip;wm5@
z01rfiIwmB-wA|$64m~#I8CuFZSbL+tJ!;s*#rB`t2OyZz2$~{)`O>Hu=;+MMBu;#I
z=c6)TY@eX_Nq1h-dXn)emH*W_%dw@{5^)(v!(uCuO=njZ*6=5lp7zhCmT1RU))@&k
z&Qy%lt7~&bEc^#=|I*SBk6|4&pTHvCnptJ6>FTiAHQL+n**j{(Di_?A{oAY_yY`A+
z-rOQnm!gn(<VX2#D@~m|kIU7R*sgS49C^hIH@BC(tYVCwWv?_%V__x<@y2EE3<`Q=
zojXMqMPcO4MRB|o%|ZBCpGP1N_30s##2cH9qX8+GND5T@t9>6}zst?-PBVsFau-!q
zJTBbYLvGqSc|BJHA~TEib;0nIw3^$wo`xzG{xEP5Ilp!NQk#IyujYPnG{3Iv+1u4i
z#wO~^s+(0VA(@o_?c0$ho06Jx{MzE}*7;(?$@jzXGuK5&S+;HE-kZ4L{{B&eO9JbB
zUfPdWl~zq?lE~^r?=_HyK**}2s=B_teu{|q?5<`{xT}n$B)v)k8Ckr$m%~*gY(!hP
zxZzSDd4UM)YPZ{wCFxnj`Bwah$jCu!gO?%(Qw>dCZ->E){FIed6E^WPn-wXeCl*AH
zQNAcTmpW@Cf2w(g?7g@-ny;83fD%*vt2QrcodqYb#Nm)d8uj<*Zu86D=|XojIkl0t
zoEcRMc&Fn8&#UWZhaf4!bMvE%6kH{86hK!%69w_ZR|Q5&gdu7#=J44Fw@AlQe*LQW
z^^1pnzdNmqAe2l{z+vOT7_;m~Zrm19`{gOeNVENZ<1!VM0W^H-*1i_<I&VI4!)st+
zV&uQ`@os{ZIf`b@Se2g`)$qw+2)yVIB{oaFH>ekkO%1m9gYOljH7xxieDIzjMwM~Y
z-0T&cG;qJHum5K5?k*U;gLz$NyW9Q?ml;(yc6Fn)3!+fPS3fGm!AMaAN{XX#u91hH
zxEUoS?gDN%obIi3fze?z=r24ZC6T>fV$Bg`T4!F4AUsx+*V~(QadDBRQTCdTDVu!e
zef?su=f{0yCw+9kcxf+=XV0EyKmGQ7*#B!_O}xt9lwY8<^~u&`&k=5q@Lm6Ip~qo~
z{6Dyi{j<Kj*oyMIjxbnQ*rWeM`A;m7B@sUmIB3-tWn|iV+vgm8G14<4t=?PzvNtm$
z;ATgg<EjYw*olePIDx<N(rs=V`lgkc2!9zYzW*Luo>N}zaAcooYQP`r)YDi};&h3*
zos*mE&HV}*KxAc3;(J9io)rn1*x1+!UkhHg6Tfwy;2ShI$Q0(kCac!N%)uICmU!0@
zkb9cfqSbj3$NT(o-{hdWl++IiMgeCdR?_Ae)Cb3t6j6znpce?jXX55$b4d*6YM3|y
zoS1``8-Y#6t)9xvdUw;_e|(?ao831jKVL=NFrl0dJ(7=)@2j24n|A|=cku+v4iPYU
z@NQr*1<k`Nr{TiysIuHWYxT+sJU<a^-9<nU=w1;T7JWNx?scS#(5)60*f;x+g-P9r
z>hA7dpGG{K77yKBT>}-M;HpuoNg=%D8zjV>L#1;<(li5vmeU+>QEi9bd%-^r4L|SS
z)baE6O-nO|!8<t;<WDJKKcd6Kx7SQ1%UOWJ>5g>-!A#zCfzNy0h?<(9((l{n=yf_Z
zj@X`G;&X8a=ZcH63<``tVIhQ2SU(i*J4nlpV!dYJ8lTowG^Cj3vo~Vxl3aV`urBc6
z2%$D2<;#yBVi%WAp9CI(ZarijMUQi3MGc?>H$Hm!Iyx@SxP@F_oeCpILlr|n2AHqO
z7R*So(qD3cFA)o2_~>VDTwL6RtAwsuR$qKdbbvK?e1i8+gw`m#UkOw+G|i8QBxRJ*
zLfM`$)8g`YC@9-DCU{JOonuabPfq8l1?Bhes&IW;?Kl;?k0%N>Y`(xQXYzlrXM#s?
zd!iA(DEwJ0B`;4$dB7<g3!oHk>j`kk6B3m=zN|*LWB{xmM*p?N_U!EJtnBQi<=d%;
zgJZ9I8yX6YCok^azcn{CZ6JAR)xs~Lt6SyV0@zVH;sw|9=LV}EkyY`YV`CQ%m6S^j
z?yM)Tu6UHi%-tzJz3`uyNoW2<igYpi&a-_XG&Ix&-RJA{6a36OS6e<AFi;TAtrK~1
z{!3NsHf2+e7+6!S8teROZ1qv;P8lc7MQ$I_*TnSh*J{e+ScSwIY^4?*GDh|j^1JWQ
zbi@{b0>mFwr;8MylM?<+!(^E-^=E5}pNSHlkWjmfglvqCu3hY`zqZ<&h!%tfP1?M?
zye%!XeaTmlT2-}v<lmYc_qkCl|4Km0R5nhpE;Ml88Cok<=<8zrN{bzeiXA3uOi1`;
zJ2`OSsfy^5ma`Q$_V85{B07ayrA5b=Q=;FXHs9GTZvouD;Cw!^8xhf$?SaMFp;Fsg
z3MO4zXuo$Z!<k~7BVQSfDA!GZL}&F<0(n&#zN(4}A9TwT(bn`z6&Kt5GKJve&+pf_
z$QbzD_ex{{#6B8N&FCd>xGZTDX<7|n8Yd>Zd#QxXQU!|PJJMppuXXdZZ|}S1a^EXU
z7T-;$X6)0)8fJfNQR)=+55#F>A-tcxtK-{kU{vctbENa`UF$^%qnmoL@<{&lqgu1Y
zqa^A3>7;VkCyE^dd7d{5`*9kF;H~53;Xy#~1ssn|j{ikXY`d_SuDAM+l!hnUt?74z
zGV?j~oZKzE1$=X|v+=O7lwZAK5|0<i{4K5j6Q{lhHk3BUgt@yJjb71T(n{aFYa9r9
z7N=g1Da%`0l3Bx;SBpLeE?Gm9%^@#T{vQ7QGZ4+_y*BJxS@uf*9_`|GL5Xd4c6LU0
zapvUUK=thDux>5H65HThmiz!tH1o6Rur3z{SYY8v?X!B6YrVR-I5^4;8EC>&htkqE
zDO3g^c9J5V4ZIPf+IN_8Lhi1vJhA)~@%1YwJ9+eVWqu1Zfmlx#1xV3Y1#3-vSwAG5
zxP5N6yi3S+Jhxdv00NHGTUB-S=iFX3<aR_OkC-Uf`%Ml)E#3OjJSK+ffg%N9sgM>G
zH&M_-4`*vI19Q*uQ(KJ*^fvbu7Yl(DCMk>{N%?q6tH#;+;vyDR?c~bci$!pO1}C0W
z8yXL6-D2&XoKC+aHZ`eRQr#RUL)tyR0DWs)-8(1kfxSeL$5`;{sl6uNOh!VtnV^Sn
z7|LTTlwIXWeF8iLVOLiqi$HY^jqyQIb=BdQx}>SOT_w-ZMUhZ^f<xLQB*Zi|$0<>@
zwE2PbS(DljqhdE`!e^Gx1s52m<KDd!m3K&plHxm$C{N`Jz}q4%Bcpmf%vbA``0%o{
z-{s;Q$yBBFD33VLAd73Se#=s30XE>h1;nlYLET$MWubj-zm%kcB8`B6fOL0Di697w
zlys*c-3SOGEhQ~T3(_qm-6h?Eba(Sk_y2j`C(noT?HmVV4>u0+j&-j!*PPe&yB_T7
znQq__-?KKEG^Mn&y$gu&29Ml;#LmEw!}9<EQ#zcVx(A|?RCfK}sY^}!n$JFX6Fzye
zH2vd2ixVDYaJr#C`<ImK$Y^#VulHz|shmA2kuxNM58vSGbU*D5Bee{8&CXpO5fLFT
zzb;sTtwo$3q!?n@)e9Zxjx?2V(niGQY&Z#dXgVE!(8NzWORoGp>#ne#7#7W`DPpTG
zF1{z+=wrCt7#%k}pPbTx4|Ut>l&I%<<6#V)o8l8W-}dDuAF+q>$sEW*={i~$x3Fo^
z``vyfUjGojia4~5IE;?YxW_NGWM~oq?0L{~yp@uF+2j1%==4Y6ETPfeAjyjTAFhG{
zx$Qe^X@vNMufwZDZXOGLjCC@SEW6Kuo0)|wrTL6DvG=~-?ZePlh2s&r5rpNAi#}<U
zySFimtgmOEW^HTn>`3x@Oko_)F({6ro%V;v6GJRLaCcsNw^~6R0G~dH5{eLGblG%@
z{dD<o(VI<EGvNShpNpFwSV*f|2T;?1f7hu38}@1QH3`ujtak-&9VMz3IV!M8L=v1|
zwnlv#qT=gn3JfO(`5cSF_Udix{H?)ajsZPV&0R;#%))F^-q8o1f_{U3$GycPvl@B-
zDg$ok4-_%ArKFJ42689puM5Kf;73GjhvpjWsFn1xMkVM}{7BHv(A_H%<^Aym9NI@v
zM8*=_2Xz9>K#Alb1oD}<IOQWJfSwkne5X_)2^qTHT@Y5e2RD5ww6V7B)7?t?Sc#|V
zm8a(@57ppxiosJI==M`L;ZVj*rQxd+Ywq#SBwaykYHbZA&nt~CEvclnwD3}6pBFXv
zPL6D}NpbOj4lY~XH)G=4Z99bh-!+S`8|xRtDdu*vhLe-0jg6PE$!A0TTdSRSmOr)X
zM<zN=*WVwWnPGnXkPm83fn=|fLNO&U+CeD>x}ZBLwQStn?*jwJyp<7faCV@t8G$xa
z<=ETR1?gpM=Jad7Kc%x9I=~|NeP4(3Rz_TO#K-ZXqt@<hNQ}eA{tlPRr>Ep1B9QOp
z4uLdLbF_Tp)ekEV+1%#wgX8N`y1)SO_u7~psIRBjV)UmJWgCCM%tE=Pm8LIA5aXtE
z|6Uvm@KO1knroN|y+kFb_Tu9c5{bg+>UiDw^o{2`2ISAVcC$4M+g5d|o$kdKUMzOK
zhpOelwDWI3>47W>7gzZ@DhrH=LaTS)V-HVHm)W<!gNBv;-47soc=nM2wlwPAqalih
z_b9BGSlSnd8u`)DWncZUBK=M;GD|m~30`J%@p>QG9zeCmDe5^eG6)1D3!Cfn`GuL;
zApdCyjt-iQ0>u#6w?TYaTV3MJrwSP^-D>?H<$#mPHSyCgOSH$AT#hEsd*eWY_&XBO
z=|gR;TR)agN0Ydjr6th+Q&u_G){o>?WxI<8%0XlDUh3AmMFM<v905q<VQJX7VztMg
zpXcRDT3?-R?EZMj$$k6cGhdbq;{@_0$zNrM(I5$gr`p-sNk`iXxF$`_$#M0mH*?j*
zI=6jaY7@a66S%wnEmbn%6!V>k<cw5_8XqJT#KjQ}zuMhJ@yyMIN54&msbgQ{tXc6$
z{^iTE^z@{tsMQ4?B^{l6VS6YPn0Dufd-(d6Cz}G7zgtzXsoGI21tE9YABCX%`%R`t
zUnhxZU(ZNuX-&;DNy(P(VH}ZVq%64f)YeW}{g8qaNJ&Ygn?HO(&86{%zj>2*qM#W0
z?aKBYcfpky{f!h6_vqwg+06CHNj^NhrKa}QMv&U-KbGLC+-Vt~5Mci^Iy<Yth_+zt
z&6n*h?4>ssR971&;(nczUNY_Q1F~2COhrpBg~<4C_NPL`kIAj~MjlUBmY1E1oMWR`
z?KMFUNk`KTM*wcngFOtp8iDikbLpaPgyp`v#BG~d#^zCB*JCzDMis>|y-jsaBPY!4
zUOz;?CN>VXSE{OXchT|j@gW-}>MFaujH|gX9~j_)#m;o+rzew1L2ut;9#@133x`C0
zRCm5`3i(!g5#Xo<qh=Eim;Tn)H3)#p&j@k3pZATCUh^gBX5fc)tZj{7IxTPw<G*2T
z00uBECqm-s=@@i0-ih`a9I|zpWf~Y5aAx&0Gco9O;{iTXv%v{`E~YSVEu-g**nqxe
zhXQ@9A5tujXi`u?XmibO?~0e;2w;A5W#dWMt~!UuGnPaZy>?d3M2|N1U@V=;Ywdk_
ziWnsM*7@M~(vrYlH{~OVSSLYpS+9t_aB*qrgxW-2R#tlaKQ>RjQzs`T^i3?{ulTV9
z0cbv65I9}{MNQ*q8)QkIUi)dy%s2pHM(URF>3rb#?|ro=Zxr^EYur~B)CyAuySg15
z4n2Nck_&qwP}p~&RHPk=P#1i!=XvB(oFDR9$Lo7RsPOPTX?PX{%lAQv+ST<@)Wl1#
zvd-|^Kie)ya|~|h-&H4|-aNFkI|g>LOKN0SMrB~`Nli`dmUVLIopzlnm#oZ8)hADe
zCcCx`O{8zg{*13zdbc)TPqRS>y$H(Gvd_EgN1P#d?}I-={%~)OxbCK{z;bJ=VEem>
zt(9(4W^zL8r_@xz!FJu(uc^+geWRm$ppUwbNkX@$xO2y;J<zM%_oqk5Pa}T+p5AUR
zBKNV@31nZQTyuJuc3($%<>fHRY*@s`hkW=MSc$cJC@m5b`QA`Ad|`!fbL8pHyg7f8
z&O@tz>b+r#SijdoZz?S>5Q#OarR0_yMTleH($dt?7k;^Qs}E-JEG#U(hQ3pie2-{b
zsi*kHd+&#{VzZ%0k1%5?hGAe}^e3_N+MYjnbjj(KPJg`TslcMZs@MRdr1{(mNCWHD
z8cp*P2Kicqn9qYv?Rnx1*r8UF69=YnpqV$8uU-Fpr5rIT`+iVMSlBVFUwDx^9`!U)
zyT`F=S94gAdHh_AwZ2$5t*Bf0_-Mh#aax`8@R1P|WvMn3Js|+0ICD|-)xryXb>1F>
zWpBz#)Kp?{_Tk5mB$(os`aYR2IsY7A?Bq#woipA{$<1usoTUoVkR%>%^prlxspETV
zMd223Fq-@s=FNmXTBz=Hz;eg8FJ(2m+Nx#uxV+RMzh6*b1<~%fxO0-y1!O;Gj~7J$
zSRRbQSnIoXX=n2cn(r65$b&NiRfc<gdt1cAp&xEruL`FTR=hV`D64+XuM9+b!u)Xb
zRfX*}R0G5mLyFgLQ9Mx}!*#D^v#o<0F6z1!Mz>%xDa|<JtT%Q*IG20@24aA41IhzT
z1n1|qzl>U#gRi19mi);ecpODux7+}E`VbRypX%$VaatBTHI<rT{DalsoBH}9h_fY?
z(CVt<wUQS#0LIyy%Y*%qrv`T%pBYJVZGH~$3x)v{hHe9u(RO;ZJ;6`Qbw-A6#VfbX
z<pRqNZB`v&W3iA4PKo)?dvN}m_9s74@VW`NTR$v@H<o}|9lJK8P`80=v<2_1ytH(2
zDVMs*o&Y9zU;S!v+CIF5{gm_H_ER7VH;=t%)~TBA9T{$(fy4D$VEfOY;l*J0Dl}Ok
zI*R`@M@z>Y5%1%c&gL6Y#QYm+XbCNBc<b<aPel7P&d!!H9uL+<WrrOrx-Kr`ljWtP
zzVS(YgYZLc5v+=<_v;id->NGsPyY1qeShY^zh44P9_y*0%9HA><!%rnEcYbrtceT`
zdl~@FcXTy0t@~VnT8IaSM=PC|Mf-<=&Mq#}yMf{11Nx0cfYL|ic)*zSX7X~Rxfd;^
zt>Ze$(WtxT;{w_22T&mrl2kkfJ?E^zCUSW3*qhg9e+qrF8&df1)zcbWO#(nw{!l+d
zG{Hu|Q|0C9r}z4$CIO9dH}HfKK>|Sbn~C^q0djklgX7uugCgizQ`>0#Yq#`x{0tOr
zuzb~tE3jw7qN0;*cXyq?4!~^Q!O=0GM;niz2G#dVNy#SwWT&4j6qilyJ>@uW^VU2U
z6rH07-vNaZ>EHGZw2s!+Nc1RL0x6s}D4o9jHF-GewTCoTla5-y+lq&HM3CJIdF)gl
zWP@ba!;`i-;O`5QT+7>^LQ&POZ*I0V)nIQtt_iv=n7e`x2*!(8Sa)P_U)OqR==PiK
z{T%rIo#h7M#6}>w;5e+{Z@YSP9~9=o+RaTcUMmV_=Vk`joI0->E3aB%XyU7{iambB
zVY8MtHekwmJLvnurDtej;$G_R`FM~7GHu(d26=p(3;Sk|o}Qc>rnt!1P)`R6iH_+X
z{SfB{#vx(G$5r3H9Y7%$`ut9mM?>)K0HsNwbQv5Zd}#z#y9~%-XQNOR^S+r|m|HYs
zs5^OdeCx$d3817)p<G({dI5#`%<DSfoVmNLQizyrPL|#(_@?oXl>|F1Fy#zArS|T%
zV&hBJar*FKEdSmQMn6%y#aU7+7Z(=(JhXinsjS{L@jUy@2X%Z7=RG*;=IcwUt6{gh
zQpvuMr*}GNSqw(Ljp+L!2d}Lk^VzfJAVXmykeK3ieGX^~01<anh$bQ;r7=zB^pEK#
zR8bTpaS3f;0zJMs$VQ|lXl8#6f*kv|qBx_Xpqo~1UxhsqyMVT{vrA5{8(R0KUgvC7
z?!5uW=<G`DIy$%oNp%t9)V`l{KIi9q=y>({XvT;=Tzzo_)*pNOQZ%j6?^#(&8XD~5
zge}b<grwx<pJ>Qd=TsHl#InP~V1AD2H+aB)&}{n(1=2b&Ffo^x|6o_7BTAqW;RZco
z&F<g`5a3}-{n_7Mn4S*d*nUnAzAik%1+R?el;&W!<Aedq+xewmLnIPkV{R{ZK_vo{
zLSY9tCA$S2i$n=&Wn~MLBL+IUY>-YpU4lM0(Qe}LE7Htqp&y17k$Jm5Hw;XSyKL^#
zPL`W`hj|<$aGGU_nUIc3nOi6$`CV!-G+$Ta;}fPSmZRRL5ITP$FaKKk2?I1>E>PH*
zpMUi6d0}nc>q9^W3hf9rU-a8X8qd6;N{_}<h20SKaImz@RsCmsJ7~&cbt8D^x1dc&
zLK3~6_mRS(>-Em?NH^*_Z;)hqO@cJwFK%Kwz9R7Q;((#?>5@lk<ndyx$8Tc1d2unZ
zrz#S_bLOXWenFO*pK)GZjUiDS@?l0qx$UN7@=>$C+0osvs<`MVP;e-)^j(VgNvOPd
zfj3Xs(R&qAcM_YKc2uyJXF1em-m$Gn3!sUOb<4qqlBwC^k$Jr<GOe7v9I|Qe{Wukw
zH*=x-{6$avltSh#=!3$g8Ob(h;aZ1*A#2AT1i*>dP!fqN4ppJpR8rqBhJpP9?lpw0
zcTDIh!8%m(QPXDIls1^e+x*}F%Phwds65z2RH(I!e!2zqX<m|(d}wG&@JuqwT=+&d
z=Q4L?9z`knWF|qYlUp@(w1Oa{t>d5D8p7qJu#E<|{7)PHq;jGlAp|rw)FDyZOf+cS
zML49$Q9x*HAR9nMWc%>-uBX$jFQP1c<iUgiDI)flVD*#eGvbmXEwe+IPwh8DWB(6W
zz~A4UR*Ge=_u}XPkV*5kvdhl(R)f|91cco=#46)|F(NJ-c4@C2ZFKtPn8A||ziu8v
z+yn^W+CKCl&M*J|{;lx&v#<t_BPypCWU)R&0B|r9yZaZ?K&0AeLe<zn^5PvLHTvHN
zIfrHDhtTLvI?#sb<1O;QyYio(_h0_AdvgoK+W+NS@IQ??NYf?%{hJ7Ec?gw&#`tf)
zLKqsEvHsil5D>m%{(tqyqTExW4@t$3j)rD28}8F*1~b_I<Iy9~@&&qzRtyvT{S$eJ
zxJB&6I6XmPVADfE9Kk?1bw{+mi*Wh|d6Exdw;v7VzrDxscYKs?{rmg*pMJRBOT>Sc
z)qnaH{FX@7N9&(|=)Zhh8h<|aU+@2a`u6`He(dRe4h{dPsDqu@|5#R+Cua-DI3OE<
zaX91^ZHrc2LEcQ3Zjj_}$(>GG+QnZlxfvMD)^=1_b+76&Gvn#wvo9n`NzuT^<m)?q
z+EO*;Y(R7y)r*)fs70f6nV2{P{~o2OSC<D75CEQ02{e_^FyiAy52(S;Kbn6>N;fk0
zQ@n_0?7I{@cbTb+liY?B;R)S7iokT=eUO@=UebHa^g{vKks5$Xd*Ac2oQocY7m&nv
zUA3=eX~`&17f=JXGfoG`L*Pj3)VaA`wT+~ZpGVx{<SpG#CVHWzMOJ6Xc`gtnnXts$
zD>nC3Nj$eKpO5=!3-Eb^Z^MubpUXpUhhEcAKwwe?{93iwGIp|*(r$?u*yP(HgHzOC
zE3u=!i;IiBdn2nhCMK=P!zxP0zILZJChCuh?+VkvQ2MdrvB35jxKS>2DK>*|i~q`b
zE?8P3ssnY4Ts+j`bwXE8TNBEvs{DFLm-s}zY{9<TlsA+;I2r(&#kfgr(tG(b+Ow<6
z<Lca1&a!)sd6GADYhinFX_bMIdhFM)QxWQ|=`$6-azX^X(-5yxe9B;Q!M6#objU%=
zvMO|sjVqtY8VngHn{zta+DFv;?Q_UTNZtvVg>RDfS=Pe48;TtPtC$)S!#vz-NQVtN
zk>C9&D=&VwyMHQ=Dfp3O0B5papz~k1!81L58|ybK8PC&rD!ELJJ%6}eDT9hqpy|VH
zf)A3vjc!tD)h9j%$!28H=+^JMi|dQjewyzzI)#Jz>H&$!cp*&lMZEU!D%c;4j#Tlo
z%Dncuw}8gI<b55C6Ym{dep%W4cKnnT%oHQ-Q>o8J{!s538=JO?)TCbWyrT~V9}oqr
z_jBfFs>V_VZ!cTrR>pgcB=JOgK%IQ;rGoyT#V^n)E}Gy-vGK2aT<|{9yZP;9Zm*>3
zEY!^Udbq*1!4%lSvO&-2gDIN`O8EWmII<GLV6lh!Sab5U!LO^&1&7BTXawTU2NuRU
z7CDO)otzR`lYNY>sH&2@L4j*Q-|YlODysASkzpIRN-#M>_l++|(jftW0^n_`tl)t?
z{iWCoHkZDifDPE~Zj^mwGhNg>F<1Z#i=JOeLW0wv`PJVZF_*Nop|P<MJBO00(p2rm
zhwoucQ_=oONmg=liFLKu!4Xn>!F$v%UcML_%J>44vIMKw6jHRoKf>Gxho+~sQrri>
zdG*LMJ8$vjWLxg?(13T?5zP5Bf;gX^W~5;>_P2{dXc;{8ygbx%0T^6_ts=vV1S=Ud
zBVC=H+%ykud-FmiJO|VCY)r_C^}odu&@c;U=2Ug`{4zM{lK?LZQRRnV*%xJHVE?kC
zg;9VOm9v}sS$So7z1x+%{L7G;E`Bcd)6=JT%+?roAf>-^EEPbT2id;)NkZiDtt~Bp
z6o94Yf=hi^*eHKH`?2)1jzJk&S&c>3N+vY4_R~EAIC9Cyy`PAQ?e5@*r0VKjjMl-+
zjLZK4lA9Tr8O!7Kybn8wkv+dQsIfJAqe7Z2Jj1VotAlSUthWk49&vWY|Mgh1ap3O#
z``OAzF0S4$XBy{_ucs!eyt?6{AW^TK_~a;+D<(ZN)cProM<I`@_H)CI@PH=HX!Rd#
z4%?exHM52^M%qXhwZiH7MPZEO#_1jg562cFYYXMKPo$)(Gh6-PAB8}jwBg&{MU9=E
z)!Y^*iYk7q!iWAXW9M!G?#>i2vNMqT3svBoo}Qiycx&)mehfzT@B$d5_l(`}Uw#R=
z?Dw`y3UR3vq_*8|JJOO?X!K@bLZiPSfNIZai_eU+sXnLZAq-}vf@|!q2(aue9Z3FP
zf)hv^gPLIJzcZ$VJ9sKZNi-AFzQDGWr$pUXzm1gSz|*r+wC=n8dLHQHbg^%-+k?4X
zhyM1<;0@%652+U^!KOjz!FkPWX<||Bv6i<~iBY*TJznB!dV})h$xjxR6llvNejRlh
zUfazZ2WA6U%p)Dk85k^vvwMZyw||v?mfMYig)cPiN!~UKowY{lfd4{aFr59r6b8L)
z5xU67;OApI-i|c9K<j>F*2e4SIFgXL+mpugo}|ukXQ^`-k~f8Z{niivG?Weu$FGGE
zom8d@+RvUTh`l0tiyI`$ilYdZ!V1s(b(KP(ARhZ3v}=1(?YcqodLGCF^}k*gYLJ39
z6j?lC&E=rnlBYL?A7^of{j;#Uh$w|O?B-A`pVwpuhJy$PE?4lV-xo4zmHZrRQkBxc
zUr{3!;WX{ZEhxZ95&c?PitPK4pa1>WKn2A+=#$lg78&Hw!Gly|uf6bt4uAdA_0YeT
zwL;yz+@=IZ!(h;a8`hNAUURtex5_APpC}5A6B3gtu{Wx`)A;#H>GGSoxw$l9TySao
z@Aqk5^@yO7IVa83tTl;>9sL~D@Sxh07qvb;KcmKLW*K@Fu>pPAgU@cHClGG#xK!O-
zzq0{IeAh^GvNkfpwG@Czp$Ut#r9%~2Wu&C8um28m8t&S}MMR{>#Bs!<S-mrToR%vN
zy}l~DgLR<cEEMlS&l`{rkZL*o>lb=<Jcp~Bwf0uYfGZ4#c1sG8FTySq6P)G;Sor?#
z@V-bZ00!y1aa!*xm#eE+NO?|L$*h5wut#}^y-od@FJ08Vv>(0!9wY#c@VihH@g%sI
z+A)>hz30=Ad~e4Iu+9(&EX}~%_;`MWw6V9h)N8RT1ZQn74+UqZxVZuKR-fzr8%%{p
zU@oz`46gKRENplMjO2qk5rmVFyngCG#>Yu~?>&zAKoURJw02$L>)Kzlqa5@8ROIjb
zabx2lR|(|GKU~g?PG-$c3A9Mtp(hKAcFgdah)q$*&(29$!9~ZZLx%|j7(SiDr6ru@
z^mALPWOjkL2+L?S#xSDy=Jz}t-P#~oN47KtFEePduA8T9u>v1H-tO&&75`@mFM{iS
z9i8gSSZWasbYBA-9mv4d)1+Xx$&Y_uU7nL;27wlSft7<!LEnN+!LMATNZ|X$M&Jq#
zX{b|teUU;#L+cLwIZ%+&va;NY2%*Yh=VGh&TI486q-GT4gdS;f=wf_nL!*u;5rlnX
zVOf^2!4CZRc<>65aKtd~b8u;3WEzHF)8oe-wT^UI)n^-eLEZ@@l8<ovbyw|&$0r3a
zv9MB4|FB&Z?uRJ4IG(Ko6&LliADV(LuCfi<<9B!|(S32FeuG`SqS9UfPUN?Q3T5;!
z>CnbXSG?iT0N6(Q=B2i_Bl9xu@2K|=A9FLe!Y4vp9AhgM9~bx7;bd?$i-+qML?yM<
zxd!R9g<mnsJ)+431W-gFT%^IsEZ_YAEXu%o#a3nIWu*hI!gahJ9r(2k*ogiPhSWZN
zy3gE02eCLs#>Ay~$amtIAm<?AlBYN$<MSF_2&=EkOK?^JtcaC$ZDeC*)eBEtNqnMr
zL`7UYNSe{}@(~X&YoZ3~e??Fjc$8e@yGVY71Lc3=7f_T$+}wqa_#MoouX*XHH}p>k
zj`mXUPL?yl#GhPXC?PS!njNl`>$WH_|7N<zx6Ij?MisVT(BOA>cRxf=;Ni}xs$!$#
zof@2#(n{1+Qt~?Mx|J2G)^WnjLhk{7R=2T?@|e*2lm!U=xtq#_A`bYCdyxw=ILY9D
zeN6TC4waU{P$G2J`2K1M4$V0^MKT)Xo(B{@e*9Qqyc#aiyj-JnkJ@M+wNa)vf)wke
z<mTS+#rF4EH@5)D{`4u&LD%>-+$^IK1<?3I`i<rp_sRhStp5onsK<`$jIku_?PY2Y
zFFjROaXgu2CMj^p56T69chQ&KZ&fS66_7DC{_@5OT&#52FElkTm&~nfW>+FFLT+UA
z@TjGQ%h)P;cu1gc8`Q}Mlw|O2ynTDY)dS;Kg5_72m%g2ydtluE%E<&w31((HJEyof
zwbu=HG#+GMIhse9mY4D6uoxNTrT{HEF5?VkZ`uJ^=!CuZP^y0_A0c`@AVMW4fhuij
zHA`Xy0GYj=oi!)(*d=jy!*zZRBV!M@k;<zyJ>*e*{=6475@t=CR>?qZ*q*LiTUxa+
zG8>v4b=#R`UecbgbjLqQ>JTq0E>??B>*?zH@%HFsdnZ%?#6g6nIIga(AG`KXPt|sm
z=YAr~S;}eQvdSuno4<PT)JvQt>Y0%&IOg{E_w^a$tmZ1>3P|-^T3bGToM4ou-Mvlo
zqwW&QCWunPx&a9);Gy}!=$u{Kzf;$22y$0d)gvwE@69PM(0xJa1Bo?8FQgY?zXbF7
zM>$M=X9g7U<YY3Lux&xR%_Kl>Gm(?as+;Ur0xL(~bOU$?(aBe9`y+Gl53a1r$*eqs
z2bJ}tD=14}UK6o~S#RlaSr7sL6#S7O0&?E@L?K))I@<D5Q}eiMWG)g#f-`jBcEJ=`
zejI3cRcO%|7#>Hu$ilEdQ?s6`9FG!4xZLI3IOMb9x=FZq$0vt;KgSWxIN!`pOm&AV
z?3lPYf4;|yq=BtGPSO!x#U2vSIV#|QA}6}BzDfv#!tIynzVPJdOfx2?_^B`;DFWO-
zEZ2La=_ZCYulJ7k4{T4wr%Qkx@z2IQmPI>$CfMn`?t`Ju;2~7h10FI^EL@_GuzZSI
zbk~mO@cYyGmMv^<(O<WZaw(|DYOQNIb{QJEAPo`2iIo{mLlHZD2c2Xkp?_{1)H9Y&
z9#@mRF=-MbicdZ6D0YAz9iIRn=qbtk&bXdqAB)O)Mvp;p0LksJzl!M8L$d1gb!*Zg
zWe$#^l597^iO8pq0Pi{dBMCSOa6OHjqRGqv<zrsn|8+^5zq#oPH`LSXX=*~`<?)AC
z8EOeGt};+o&bL+nuZ)5P=l-AwsY=PMml0|igJ$4&12E3U2Jv?dLLR*&Yz~c<rrGzM
zlyJ?8j=LeoF3I}-T|?y{GcE195-U3r<>wQsyD03p-~-PDQ&c6@K|RZ)&i{c?0L2eS
ztERHru>ZrHoE+A&Z~xhf4u(&_TY%t(nyPuBJZik*H^BE^%jUA85J4v`Bg1Has{Zp&
za6<x_sq1O?=;#OoeeS8tS-N*?)coomG7PK5bl)YXfdG#0eaitJE$X33$t9JGWHRnu
zKF`UX6mmCnjn0onjsRtlj|TvBV2}1~@!LSg&9<ChUU&SnzO%x5`SH=`B|<&RMRm<r
zOh6d1086|{we>|7;+#PvrqE@2L{!Y&5A)jSXn7eKcWuvPkhv-1q=Ieat|E=rlWY5j
zo_;uI>HtiE`UlcumQ7w68`A)lAR;T^-?#)3aX`ia)<?%_1a_^l@bnLm3aFQ?u53fk
ze%9Jd&%nl{&Pc=7Q-Ums{H)&iKM@9=$eV({7-px}1U#XyNMN6j`GbOpn6|u3t6ou4
zqiN*O)Z6+8yx-4FkHeDxpI{LvCnvDmLG%<4kCXBz4&yQd@I#Ilh5c{9htxT3B_(=>
zw{b-gwh(F#zJk#5tC5YkdE-{w_@}b6;S{E?RJ05QW~V`4<kk}tFK*w>X!Z$L8MsFv
zf&^{9Unypi2wkH$35q!22B0u^=G{?gAor^zLD==v4k0>vp`$>KJx57REkm_uYV0k!
z4<BnYbA455Mqrc>iT24$zaq#*0HfF0nd{`FA<U&17;m@)iWy7)9kmb%t?XAic@GPh
z^mcCdQ&GEm_4J6LdNHX|%(uVOpHEx({X1;Ds8wvPDmxI^p|oeukM<8|%J?r0m(e6m
z4OVGlh39vzg>FA@H99a;$-zGEgZtBDtvA{~GzU;IfjJZ?7ObG4d;C~aYf{pB2Av`b
zp&=PKLw%zV+VfgcvS*-CQn%lhn_)RO`=TXcUaG*lU}QuU)->>ez~ubnx$GmXsN5UF
zo&3f0@p=T2TDj83pF=YXRFuy!m63*gqdyYq5mHr9r5iZ^Fm-k|q{}qGRely&mVtC}
z(Q$NV5vjD)XVtyo;%XO7(EX$@Io`crc%`R$h2yZQ%2jgmdhL|pJ_T4DDc;<Cp5m=J
zK@FDA`tb2%olAU2Z|~RdSxPToe>kTKl4yw@7&HMgmSG_aD{Ey{284|fdgOmAv_C3p
ze)V(4N%1W^rhOq1){~cMC!M0MG;jnYXlV}k?@Ma_toT$fqo(%evPzbQM(WE2@hZ;e
zN?V@Kqx@uor~3rn8HeX$CXAPMEJ+0wew;awwZ_Gz`QzcI@bHE&58oW-*y%KTmWrC>
z<>h>}nXvgLtzN^s<;2~s@_71oK*|U7(BQ<trh#wyn~xUr0HHBv+t3bY@dZszMM1C>
za?x(~o7f3r@rblzh0xIF$pVkv)i8`KGi;4IPHH%Mkb=LDm=i~@aZ0F%0R-FQY$(M&
zx@i@RnlR7DIz*4^^f;jHobLJLLQ_Yzdk;lFkuIU2kq&9<83*SuC#QFpQ|1hT@+7+j
z=KBJ61tZ)bopRY%uSA$UNFp??rY1rK5GA&f9f;k&rBl~eoaq!{FuDz<p)~EAZgC5_
zEsbYowSo4=C)|hwQoIZE^Akk4f4O}iqoD8xbm)}xn^9}^AXF0&@@QyHK%C|7<$D!S
zVOv;`1QSXs#B&{-1^bVV62w;+$;;DnTAT@ZdLnbgLq+6rqSK@6Uh!4On_f14N8nrH
zSkk~PBaZ6wavJ_Wo`;i95Amp|xKP9y7#NG57g&%!q54TBny|2JtZ!4!Ab|8E^w;Q+
zMm>|;=;3Z=_sYE=$L1;~SQr?J@jUfkdINt8^+24hh6pthP_0MTLf2OlqwwPLb8^70
zcu36tiA5R>*<?7DJE!Kgs`lWqKsN$u$z<vvMa~h*6eKwkF;Y|Wnr?GlK9wLN(?;|{
zRK-_y<}G9#WBKwXqq^F4Igs^RZZ3u{8zU<#pq^M8y${g~5oFL-AQff7TdwFm1o?hc
zuW=g<*#&v7(qp`xg?g~khZ#8JuBk{!nWr<pVnHO%7oM(@pp|bOZLC1R@<s9`w`ndd
z;oy7rt8q}n%Z2m)q5!6+uVTixEDOuE5ORJVp6$H~vP4Tu%T<FzRV7kD_^Q7A^@LU)
zvJj_AJSD8HLmxl4>f5|kFY*=gvcpAQEsAH^FDvwS$iqPK=!ERg24~mI2o~w<pdoWK
z=yVPkui72#Zq77poQHP9o91?PC!K2SEQF}qd5)#*_MY^$^yAmBA9^9?BV+F3FtM-*
zc`ox+^dL093y$?q+sO>l6YAJpE%p;TDK9BY;dRcfjGL=Rt`!u~g;?PD;T6borKb5K
zJpNcwL4i_OxIpFW)yxI2M81`(>dPRmwhmjEr){lscSq^e0ippOHIhsyCp&w1xHl^1
zQ@Ku|U{5>(5#*%cK<H_X|K1FbzZZ!G*|+feo5*94E#OB)5Tz!ZlONKM+iVYtQ;R+Q
zS@k7Ig2`Gjl|O)_2bP=O;ci=-^nJqvn&4NbXJMFFsmGMU&tF8;=*=qA$&5v1hsVan
z?d|QYt*vL8W>}9`)d0{wJe*a?YH$1tu>V`<Q3S=*AHF56T@TFePx%lWK2vUZGxCiP
z`sU{MMY&bWBRUPAJ^Og;R&IBkl)LMBvamZY_d0}=fW*)b^<mLgkDl=>Ly6|kcJ)B^
z;v%tz1+iyHSLb@Lu7dsTke2HFVFS9yEgUUnDUBEwT08hmzzb+;+3+D)E?>Kj-{tbx
zgucp$qz_xS$L+~*WR#0ng#h;f%Ub$8T(<wzXI%)2r|RldX|zx?E34=zmGLSYcOUPE
zPA8i7oZZIVD-B*zEmCPHil5ilf14Xv#YPaJ%?<~mDAsxW5sEm52(6M<M$=w&oOq#g
z<Dr8%+5T{H5lAYU4&{wbD_tHN<Mk<znh{fe@<~3+%<@FgbrXq#LUcF4YPKef#w0>T
zT^<8P+~42-o2B~J4Oo~UkhC_hrF}~GMTFbQ?DNB?u-|g)S^!bxF&-v~qS2Q(@MzF)
zRD7Pw)hKlqwwX14`OtA|eB0E*01*{S#t=<+wuFqnPB0<}-8%`3E`7^^J7>*dPwD_{
z&fTx1So?b~BxzM3bKK0>+^;R`=ruQzgW+Ur@*m6PzQlU7rnh8d(rQ>EJF~UMCIaJa
zCXX4WACSHNEWZqqY#0i2NkdxC9%@m)r<SN6i&+TMb7Tg^{%>dbxWPHGIrJ$CNq;l4
zxSO$GF9AOQBXLIy5{LXHLX68W2Z{NU3|uKG8Vo!7d-pU4KF{~`90E!2u8@?BVN%DV
z^oNB{zXo9{z4yV2u@<aVqWe&u%4W0Qov~uKr$~HTIQHEApH0=W^78iw*yo`Y8Hl}u
zTz#t%A?wBC=A_q-#BN#@1r&l!H$4;g-L8(*B=g1X&jk5vOiZ#;MeJ`gk#=@<jRTJ&
z;Q2S7F6`MS@|f|nT~-=ZM%#z+l#qe}L(!-wlcvE#L%%`ZxU^K6W}l6!_`q{-NJBed
zwhMn_Fu5eh_t%bg(R%jXj)VjTHX<*s<|b}-c5H3RPsfzp%g1*lB&hQrL`TH{LG#H?
zk^7gRp%y5$`gHm3Nb>tW1Xs1}MZ`Mauj<9n^g+ojD>A|JW$1{;#Ju!F@`Fnk8CRe4
zMc;GiKPp994u&E@2-Ztw<p+FjKZ1(+i&C={Qbr2rPLw3G%1%%iRMDpt;Ps3}?dYU;
z!8xh3KOvYp{Q#S|l(ZyTD8^ZIl;f6Wt<1>J9%V3{H!cXzKbKQcSzMsLaNeA}+#M9I
zn8USN+TfMFINpKQNJz*BpvPq9<+Y7&kpj$nkW^%#<I(c5qk~#gw_4xVc$N=%s~ypu
zoUX2Cm0QytZnd_lf-<IO3%x@1sYiJJsZZ6OJ382&otK+$RP0#X^?mpU{|^)E;p=2!
zXi8RWO`~JJe5Ja1?Y^<j9r^zK7O@ntIgxcDJppL9G!6-vuiXXP!%TO|kWab_K2+Nq
z_NdRnzl&_Xdpxs|x6VK#g>Oad8+us>rfN{&`!z^mQNi1BKRXPM0AH_ry2>?%I+f{f
z(~@G)#lKyVJT}f-dQ7TBXl{Ldy<m!$O-l>z4`PUvc`th75){4_m}$LZVR-h~^|Eh9
zt4(27(d`InwX4`Je9D04*B}z?=7|;g5-~#doN@x%mxT?Le$;dIo>!LrCpX$jGve=n
zTn$(KfB?7Mz4-;<MG0wxJK-C=EPmmTM28=PKQRGfv0*W!IhpVszkBD@UsruK;3z>p
z0U7<?(Z)_d?59tdGQ4Lu52z~dWm7n{LPxe~|65JXBoxLGokkiH$M{|F6N-X=jyst&
zR*;dti&s)rEw{dq#>KF6*fjb{^Y43~oSXDy^x9&Dl@{9ON=Zq7yvEvTqKARLATsXY
z-l~J$=Id~6$#B+Ob%&HUbM+~FuBVIHoB9ghSNl7S_CYr$eg;aH3^i8c3~v(d6Y>@x
zN4;KVX0<|Xl#hs~7N4U4Lc_f-#LUVn_;wQ^RGQSlIM7~kmlf^hw}Q;lokkV{8JxXm
zn(+ldOS(K|XXLQh%VCH4;UohSQ;E<&)Pb+DdTVCSB0BNByslZvX1|Yk<=)5J^ms#H
zOfzzC_PXDIqLr>phUn;HvF*{ilz_H@*C{T8Dv^H!0JwJCsb!NB4U;SUho7DMd=}(Y
zhY^`*t<^nZ!N;fjv0G2qV&2IYv0JhJtFlDXy1lTnBI@FTvwH(lYO9&+#dHK=wb1dQ
zk+LZXWBNT;58(GOcyt(b-DON%igwm3ple!7q;`|Scx1qX%e&<Lo@4r6{&%Sdh=}iU
zqa+}OEbM`GxDjp!rqgs)!*X{VPoXZ|8$W>p|1XWEmh+1eujdy(uRQ1_`QDcjd2i6(
zq(3{NGcatEIwhy>>)&!QzS8!1+I9GyX!KJ-{(=LUDcauoKYwPfN-rfTS6}$rcBSGn
zZ)~sQ;|d*t*c>|Qk~o+cL1orA%xtccTmz|L$$Y;C#`#ztw@gp(??nYdRxFtC30YE_
zUL7rOeLE(}`Neaq&f)B%)WeUqS8b}kzP`;#(+bJ_sJ<&u7$6wj14-I!R-vxUd3Z5f
zCDMKkfN^R+ED$!<WB*>fZx%Iq=V8)wu<ciDcf;{-hNx$1VZQDYk18IqI+EBTxn}kb
zPBn2J=^}2*#~}spo=}3H1p^a3on73gQE5@&s29U4u*PWO$JiSkuQ7ZZ-TuD5=^u7u
zwu%%HKGnIocCNpE#zbz!vV;MSHEq!B_3PKXZ?wslmtHB&)(^Fex~;ZEn2#qkxl0`y
zuI8UPIyzq96m2*BiiCvvXMa8UtDoaFttN{&t!8f*u|{OY@<72Jrg7C|#4-4~>=ZUJ
zBd~{r@ho->dY(|s#>7ODTI`g$=r2`c(KWrrvEK5s{ywEPPBJ8taX2=Dc2mmib4we)
z+;D6eLg-@O*rmWOc8@R)6u$CLL$-(*<Sv68MqWY&Pk5?`f&1jelC%1-n)Y+f3qzh`
zV{?5a#Ne-N{C}8_7i&)nL7MjT5w0A<n{2YGN}F5p^6VsRkg}tqp`ofGk;o#=de%<Z
zuSD(5>UiY1F?uuJ9;=X@NR-&0SSu+db*C2L&YgsZ3J`>Qycjph`s7A3(!t|zos;^u
zWMstKD*pUvN-frN>4l4H1I3%4y^8+tQ&Z=RBC0=rOvw9K6C10bbt=T0rOK@?`z<r`
zj+0O8C`cU(FT)Y<+OI6%WvtZ}#BOO7g>w&{nPF%2OO;`p&N41uUQcU9|Dnr*>gPih
z{eHj!l12^zm&mVQzqq-}rU(RYHcrO3+;`tlD~N7>^!4>P^xhSF|9%RYU;r;2p(2^M
zXJ$N3Jw_G3+LhmeC>TAvA}k$epHc7IyrU$@;}rYFWR)~jRkbx_%ZD?+Ci{va<Nn&C
zeJ{_+YdPmwQ(r&J+j!^d19h&zx)8eW56{G<?Pb_)k>B!yB@7}KzRrP)u81fQILE6u
zV%1X2EO)qj0c2KeIH~set({Wiq<)gSuQxweg4v6C=wHq0sol5Nlr=Z+oIKj9Et;)z
zrJ*|+o*YT66Y?A|Zna`;8p@>~oScL!Q%8GujRY4ft77(WY#5KBtE7XhY$qIdMeXi3
zOb^lD0$2t@R2Nc2+S&+GMdLc2c4uW}zEo3vHRkZ?GVfcg?MvCYf#M6qIQFJuKVQ~2
z6JgOh#2qN4e%=cR9@c24FJN%$*)T+iv04f8+tjxrX<kz)-=wXYQk`lGnAqcc+)oUD
z1YF3<%7UpsG4W28^83M=vk&r6Rx$otSw%ij+hr@G?!Ziijuo7*Q3r6ew}YS9HYYYV
zHfU%bX<+(Ud#!JfqQ83bV!o7ncaM@~*RIDt%p?@zOla!7(z4QRjEo-OS350ctpeV5
zfwzS5Z+WGx{#m!9v-PbeojM9zOV@ErE_Ex7RB}b?7YU4?^xpnj;Dx4q<YM9Rvothu
zOfP(F#M6A(U&p}n5{F`zm=G^LEAQ;IQvxn>yInco5;i7jf5<43>v^)krvJdq2>y7G
zT~TPhZzhrYsvSCg$j`B=L|1?RHp7+v^2v*kJylLz_f5AUa}(}z@-bz3Zm#E{%}fRP
z##qkJU#PxkG11X9G*iwN7Uud{o=^WQFGx?CZt(<0C#z&*=LYcjC=x_Oo~3<Z)4gSA
zvHa(cLLxETPqkl&?M_t|!t~sP&0&fqL)(c?B>dv?AO-d8bM-{8aaBcZU##_pK(e9w
z)90S4lLR<Gqkn(p9(Lh^W;Ic<eetq|ZeU0{yW!_e>{IHdAq*}xJz(OyWUj4k+aFKo
zLf7oNLZ+=`6X}8^-Wrh!9CxJ;tm>R^SP16W5mu`09byq0#4z8#J>;`|A`zAX1rPvU
zOed~#pO1RC(huBwS^t&rN!kmP(_2M%HuC<~H4uI2aQ<r|J^gU{ha#*n5f_Is6Lj$9
zQH5S^!6(x&b9hUTcPxK)bNRRH`XRf5{f&N;ov`z{M`A+#$E*9uTB@oeswD0a{54fM
z2c3zx=I$ZFweK-rS9a3o<>e(Tf{U<KAyZMG@VJKZ@))Tyh--kREYWpm=Nmc&;`>la
zmdDhc*xuCCu)-m=<M8Nrvs79ShBn{0!BbC9YaOra_V9RU;f#`<<DgJbRTh&Lit(Le
zO!eIsabkKnpt1Vk-XPi;ev#^K5!^6)uyoUN)3nuJzR=M*K6g~swq`Dh3iA2q6W^C2
zcm<V_)t&L5e4p}ElCyz%DM_VtD_88mh-x!HY;5iTZjJ{B&Q?O*dC~+>Q1}m7!J24L
zI*oC7#D8XOCmUH(qRGp!))kF#T@psAO+{7KPj<Yctg56{Z{?_J-1?IyO+8K{+tz{!
z;h5rbV`PKy+zr_$ac8zp>*9pGe{)xwqJaj5aZRvh)eEH^8?*k0v7oY>@x%L8JvcSw
z&M<;V67L1-nGsY96$Ut?hQEG^ya=sHaB~07q}|}!YFPydA{$UKTUiJ2aB)q0?^6Fk
zk6gPTeCMrg6^i#eK<LZgTaay@B|MKp&0-x;yBf4o#kR)9#Ne-6<nI)iQ<W9!CKicL
z!*j||c^Cd>{{Fi!jqU9H{0ZD|?d{>~_hM?Ykf+s2*cBq8;dqU4Ek_%M0@Z`^s9^zD
z7Z+1VyMNrV!F7g;c`p#xU&X6IYxLJIgVB)cH?y<_8kN3M6AVlYW?JFW=WA%6r36N}
zM+yp<amjS%zZe;1RMthGu04#uRPiVWg7sZhqK#f7#7C2Qha2I~w|Z8yv1Tv7^tv3K
z|AF$-_B-CD`xLzxL6V?1rsy_;cm%=?yAf{gR|(9`kKfaKNG^Qp)N6>eH8hwR1(9pR
zS2}zeVG*mhJKM=BsTImVi=Ukx4axYpCzXR;yVipht`0>b(4F#wqSJu40)}Sv%*>H-
zH^u2ic{Pv~Aou!p`Y_W49N^{|u>@ax=`U3(5<)^808{(?&KA@`KBVw>{IpS7m`6ln
zN|=3cIrQ_A3z|DsWCpej)b%c=gOYBwlPSVv#oEI0Ik(dp>fMRU%dMR`P)e#}I!J12
z64W9+k(RE=&5dlGnNUUBj?rRw{e1{5AXydP0V{lh&sK*mq-SWKB8a|q4}b*NNR};p
zXlUBEO$@OpJe)aMM3-LH{LuK~n;I(&#<;l4npo<nk$sUak*KK%e<*sHnr^&!@fqjS
zTb@d5CLitQpR5mku37(51Kgef4g|!tq$DJbC9EFL%W5FNlos+H{EZQ@q4fWKhg7Xn
zia^f)J<Dei?!)Flyf9@UZ{D@7B#^L$JrIPF5#viYIM~E0nX)f2DkH5;QI$lQFa|Ro
zWeU*7(maN~2T}zld8`t3I|E}bQ|RaLZCMUWX})z>d~#N%V!i@8(k7bHv^vzapI#=f
z3&AN5MZN0C%*4I-?<<ZgonqFD8FyJtzeHm2^7hvYi^f~S>;t|?dA>`BDqlW>5jWma
zjPmg8qM+Esth$FvI`f12XWH8LYni0g)#1fGmT+UJ_#9HU`SFh>98QGH$y0W1Yt_XF
zzNng-@#BqJaAOnD_RZA1jJ=z`r06q0Zq6Fc_#bDcB5xTPlj=x}5r@?C=g3oWMezjZ
z^4#lB`%TY=hCV@MPV3jBm@LB6XgdI!yg|n~tL&ZSSQE_mzE{w6DlCpH6`NORYGCm-
zp}r?^Jx1Rw{4O!kv~}NcfB$2oQg9>B3v~$I%6+L1+{R57#e{@OCJ~3rXXuz79>}Ta
zD7QqyTop2KVQ8wP<Tmte#q8baXlzIi&ZxxZUYy=<qD4vCdkRyX=E)=^ntHc&>TOBg
zJ(drvA%K*Oconz;&j->_7NX~p5PphzH(plDfx_bJE9MO@0S*z$(Ux(%+S=7|_9h@z
zdObx&o<9plQHg5eBDurN=D43f!pQ4uq!_P3fr)tlL!Mhx9F{%~bj`w^^_~|W>znP~
z+G<oAkU6o(_1+ak5m#28dl$YFH3#NF0RcYyn^G}9>HB0>`Z4kG*rN)tb7f>^LW!(5
zyv0f6*4I4Uv>asRdU6eXV!tRqtm7}hJaU>LsBsb$S<uLyx)gRjk5C{44w+;)AGTxc
znFxn>m5h|68C+h(-`yWTV(7}tq9qu6<51#ltOlXD(2yP;Z-BRCa*}n0HA(u`^!S&E
zoDRqIvSa5&SXS^wbJH;aZCXn7-wVs3b!E+H3hzdU;e(x4)yoLmeyA|I2tnB&|7QxW
zH(OJ@0Nimf6ekHa(HB8s?x{d%>^IE_tUW2;hzm;<k}tAWM^E`vTXcZ4-t})E?q^+s
zK<HT%H(8BbAg3<6Ww4l9f>%^gGF9zK;WW>OW2vk5n39rzpo4F#SyAPo!ru=%C6j!2
zhkU!q-PrBB^PLru-n4pwd*4lri;!t+?mTXEiQwNmPi+;}cddtU6fW+kJq%GEiYli?
zWgsu+$J=LS*3S*yr^9Jb^b#~Z{>fjuGHjL(vEsK{L2uHiY*3ccM6iVuDg8C_X-1rE
zkk}omyON6i2o3sgW`Cf{sT8Bt)m=JF5=6rv!!~MWQLw+?&t6$bjqY2INQM3M;|)q_
zSvtkS3qkZ}IB%%$n{T;VFhFH}m;}Y=s*EM0Ajxwsn#?Fq&JQ0%ItqOXd;_H<{a*pe
zd4`UJ=?rDQo2G(OuisI~Ll$CKkO`7yqG?Sm4EBCYJt;IAb4|T`rK6*y+kaR13E@}w
zJ0~&c?b!p9T}FEjMSq53u$Vr|z~})gh66%{`*WCzT5@z8RFjBN?%+1i0)u^MGnw9a
z0xrw~S|!(bMkNNRVLAgf2DEzzsG;Mz9z#lx*HzMSmb{F<UR}Ifr|WwDUAqorLzk5J
zuDZ_k*;;9Pi`J8jPogLa?b!c1be$ibNS-=NOr5R$DpvGq3dWWvH2o_%DHCJOlTK2o
zwK8?3Esc3%LahjD>w=t|r4>#%BQ_w=b=9t7_yo`*fHNDUguR=xwbSI)Og&45G^V%&
z`IYq!L$k2|lQc;tZOBqCH}58iV2r=@Q0s@#)c`ecyTP1|@i}SCigAtkT|WU8Qo~Bj
z_#_{A-V)<0WNx4*;mF<FpDJfZYvb{^Q2yE5>*rWhWKEat=ym=2Cr7p4Nq)a>OKO8H
z2@}&QejsiJbpxB`D_IcCPl^8~hjm$0>GH}6wWHx{+V^s!K};5w@6g$dyfz%5AiyU~
z7oVY1Agd@T(;+M0gX$PM&G`je7aQwy-nOJOxwbd&8Y*nA-G|S$Pbj8Y7+AQti`h8I
zE-$5oTn^fdIKor;xZZ4kDoDJkv0st4mka*t7n~n54afCB4>x$sN{cIWf7t%*9YK?e
zi@O~8QhKhA5ZS5dmL<V4*(oEFLlf-IHgnaT{rx+?H~U&!uTEyS%n}uo`6~?0Can{1
z>OEJaUpWQ%`$zYGh=i#mT+M0T7Q#N{w$+w-PY027bj#)P)Jt5y{`>co?AjA3PsIsr
z5p1853ECA6KZ7@mb9&fxzlB&}5`eV#QHiii$PG^D=`K!#B)*6px95*nwM%RT#ze;&
znVLe*n5*k~y`q=%ip}l4cFZg%CfJr?Y!3r6@$e)Od#ld$92m?%^Fmooja3q#gqSU$
z(@Lsx24pT(`1aOS+2Q{FM!yeSV45kIm<DxpdPUN6*l8#!7c}&h#9!#K;ovAL^wAYr
z*M*jQdOTsWwc_UH1`Kg;ukmTyk>K`BIAzph8=GcEhAtEouN)>TET1bDBpJn=Z{Msf
zEPgKIx?Ry?SU&hIw#3w!Xl}VN5F?n<abJJx*S9g&YCd=WK<0Y)n^zVVB~aLi`}MqV
zgpeW#gN7yb_m7-!oHR8#{08URChLofi@y|Ir9pVC6qEK5^joEF(YRme!}Nj49MMj|
zws86*&RQ;Qn+bGl0J;nf0U)?Gco}OWbi;Oq^y9~m@%D_oJQFiEw&lLiFw(U2AFda9
z=_MWp9S$1A)jj#QNi79qADy4Ru5%jf8;$&PW@2jU%gi*nyfy@_lb(2C?~^`1P{Vj$
zEla_@?z-mOk2wH938bOefap_r8UjP7v=<%4c8ahbH#Ts@2!9)!82=g@!#N>R(z*Z{
zxsI&tgsXa7B0hpnomXT+>~BtkjHDzFk0(|V5?Aw0qoc2!EJq6vaJ_uqMdsy!xqyLz
z0r&3R-6LWRHMNU%M>-Npkxu%#=Np|-CeWbGERQkQWAkaXL#BL!^TrUa!Qgs}50bL6
z>C0BsnCT{Otl;!BqW#`S&UH`oZC5QkVxVx8m+RWht{c6h`+M<_nrC!ThfdCIwg-GH
zX1}ML3!zAcv~(JpNoz-sYDpv1&9tyU)?5*<p7orAvI>r%rC_?BF^q%({54G44;*1W
z1S8j~>S{p8M8`y@3VEVqM#mCZTCzimW$?$3=r+z?heR94sN~zT6BF_3t$xhK#fng-
z!(`2{f&(xi5F7J(u!%y{m_pR`gA0wMd=O*^XlPFMC6UuI(<Db-<m!rQ<M8f`SJCN>
zx!*0m2W0K3tMJlF$0v;D#ue%GGw!YGe6HuK2+iVhgoQ#*mk&i7eByJ@#Hge0B&H9d
z>ryf6YjslG`cJbQcdE<Uv@N~Pj!WB>?E;v7OjT}rrd~?FdZi#CAxO>nT>j+)yj7`@
z55wkhTTHqyUz_QRv~&(~i;Avz?$;_Xx*nd2@1Ev@VE6s|v+>Z=357Z6xrR~*nqMUp
zsD0Otj{W3BzO3`AZBH6&rt05z)`5*KTO155Z5TNn?x|GNB+z!qp;ozWFrdHg?U1j<
zx9{y7#25c8Tc`tllG6|(RZtPcjKDsN{|+Y>Yq!E!B_{G#P}&9f6wBkwSeq>QE09vr
ztr)8v{v_2UH|G=U1C&5Y>iz52cxo#PP_)4&u$8A!(Z&}kYXpyrqvY+di9CXSk=5TS
z4Dza&4yts#ku4c(t4^~)tBoS#)|!U0*1_t~?dBFjWHI+$`F6Q862;i}aHJYNQ8Mj_
zkH(*e6+18H>b(8dmEi|;$FhFrbbl9E%lkCdZFzH#x_uJ)4~Q5bVvf^spUJzSk*D~S
zdHMKA_`)ge7P+YFL*SG;$=lAaVwn9je@T4HH4I9;JLIA?LRRc97%&Q~v~E|tSQGVd
zIDtmQeZTDY?^(p|J`xpm?kusjiqIbVMkp88Pr4@RWF&Uig(eaHg8hlf??~*x@J&`m
z#)JLCTS4F9itt^h)&ae=8K+(XQ@;6LWH5~9_*%N0KEznVISr?-)ApplHdB%7Mom^0
zEyWve9i4jE?_nW75OyjW<F1BzRr$u(%PVPUES7EAl)*+IEzR7fPzU<3Gv$lck%{~A
z?ze8aDt(Jhuf)62s^F?DgDV3syUY308}={ZBcr1&)78aqyxrT!E4`he$6y<NPldMk
z$=ydR*J~FiZzO!Paar}u^nO(glZ;Gt?_`(qdQ-2)(!3>r2#H(s)r&!m6}iU7sm+8v
z32ZhciQTrmaSH(X{gxj0zAqs>*2>&mql(W8S|3oKHiqS}>d;=+nW8!2?^Yxyn)Khs
z!O^-+KG8LzRfM5D;WVEz_tEphnN|A%w{@4*09s$FD8JbkdO6}t>1)c}{rxmW5VWnU
zC>+0&@Yb!Fc8$H=I9B)^7=2hcT1#u}zMV#}M=ygdT|W&ABLy}_q_twp69TKH!Dbm}
zxT+vs$_U;jTV``mPvp^kL{HzF-f~mt9GH<&_WtZH)&V7aNVF;obnEupeVd^1NLI_!
zmn7osb*jw9;Cxd@CWQ5XifZNJ0#$&&#<$TQCN3~|L}oui_stK{;jurTmZju;`bZgM
z2G7<n95>X8muje<yxpIIrQqrof>4Nqg}DzW9D$G*X7<r#>TvVa>5=7dil-n*8G=GS
zNIRP?;ZY@5rxojWk2-?60c}GL99`8rjoV#$3d+{F_dFwXQM7L1{P~^9S#w($nDh_%
zQyV@sIN$Kphzi!frs6<8e%;<2_mW9KaWe2%G9w}3)el|c%G~@s^gD?Ja5vSWI7Z<)
z{$#w6deh11JU>5&MJUOnffthy`#{9oq%bKO9qx+VUkUm?lknJVO5R0;4o{H~aIwSN
z2&l3o?d=bIrAk-&G?rEb6P~1T!2$cRx?-cy+DzZB=8;RJxlqS#(%iA>=@0=4*z7ub
z<imAH`C+>rYE^m|X8yOGX~Xl6W=Iq>tPNYsHCR;H?Oz3=;#5<K<HdR9jt;*-RZgA-
z7{Zt}NVa!)NgTV6(=A&54|87`m1VoFt4N20A}QS=N{KW`DG1UaDWRl*beE)rv>@F`
zOLs_0mvpyuH=OCW_TFc$bN-y4XAH+skoV<zpSbTiuX)9KX_s9zL<*PI&v*b4q`~!K
zWpQ<IO8u6zqN2Xp)IFFXTCckAFBT=#L$jTnlOiyt*AYK{02d=9iAV3518VFb#tdfp
zXzOpOx27Fwm*|F-^oKizC<tVbVO-p<Lr0r>hG@4rp{c66!QZW)eFgcM(Eu|4&1PfH
z9akA-Mj+42Y;Q|Q4sB#>e3+iD&%6sae>mI)7%|-mg#4@y%}NF3*~h61&0u`4Q|(fa
z%NuZtH6}|1gBt@pqMjbnCB0|)5vZ<<ug~4RX_$NoE(?>>Kb4r3_d&38klU5U8x0{B
zsdYly+sQ+%w6y7vP0u?`A^KYQwMLDOvaPb6-8)qi&M2n5oD}eY#|Wpl3j{~sm<i%|
zf&O(p8;~t_=h?_+U;=bcrTir>Y%gU90#J$nyz!bfmD*s^r}Gh&R~_o;{?$0ElDi7y
z)bH8ZhVL@$%k1wF5XAWU+Cdckix>2ase28y2(dEqiX&jo2`JQ0<6E&Z+g}m=bUn3G
zEP6!|t*p>!#iKSiyJZFL-|#Dr$URG%*cU7T1$X<}Xaf{5LoC5!YxDVY3k!pWYw`@5
zFxRLd&JwUNzz&OyJQx3XbTO?s%EG|X7?9hF!autis?JlDl&u7U`zWv=frq?t;GT;l
z;$L*5$3&7U3;+onyb?tMe)#YiIXwpDP)bU=nCd=42M8gpK85VtIJ&s7u&}Z?U{ocO
zUIY~M%xtWzlf%Pb<M#_xqp@%3-%ffuJCK~6oh>g%va>t?F<kr30Siq=PR>KZrRQ1F
z49tw~zs~$QvPy=3N3D6=kWlU8=rlba7#s$$9w-#NQCp`U(HiaktIlXVRDGjx_}MPj
zl&^*tXPQOlcG+Y2)yxksVw!*cgaPUE6w5lt3%EMAVEF^B^*Rx`Q|i@mba7*QyUy#5
zaTV@{)Nq~e5xVn6n{!<n<<uGWC?6|)+)qjq3e@n+L^L(^1|umpn`RV(c@pf#d-owj
z4vcPis@H<n--1(+e%qOns=WfT4uSbMT$&-l^yBKpw&QAlLPkWaGo2JndvS|kEB07G
zX=A^|{Iru4BfZu_NHV8|DcqYkSLnRo)SM9}Uwj&}vrCgLKa738e)GxQPvZfCr|>n$
zVKCb8(=Sr#w|%|8n|`mJ_>8$fyEr@JDPOU<^8pp{4BLhtb!ql4skb{Ze7MgK#Gq|B
zpYn;A^Dm9;KF)WBMM<aP?efkCEw*G(_81OrL#qsX(DiotrOvH(9>o3C1B?hlVUXJ`
zHDE<_UfwAY{`&<Yg6AcPv6)$3K>;zz{k%epF9``S4I<Jr>@#2oZqjwlx8I83ZK@)f
z4>`?dCMIGhf}Ve0XwwD8e(>@$_j&cr2u#8$Eco^pp{Q3HzYX4HYJAmTCv>9FIj%aO
zcTOx?sCZ70rm7S@TjPGQw4PR1`4#B-!q;1kG|2ECgISHOVqe_3itapj!W~PX_%e$@
z>W$OkPQueh`9+9)f9Jz3IL!Y#+W$Ui_uJDy{yF@A|NdYWV0i!6&mJ=NvqDnczdr5%
z{N;-N-yh-M{!1ze;s4jSeW4_SzG{j@n=v?u7mpAg?jYp%KcD4)P6URgz@<R_(BFHC
zf(69sBAsYwCkT9x(+NDM(Gbq+8lRwgURHSOlOmiQc)q~=KTZh_YPuYd<p16j|MAxA
zipl@nrvLfl=l9p5eg5O;;8kA)k*W<L8}dKj;{V^bU7nqfjtURwhFS8Pmn-&9mvqpg
zm<*DIgr93|z*n<aPoIW{gg_D#Zmi7NwE5rj(oyIoac_BH;e0wD92o!Wqu#i>rOX$9
zY;_V8ybfu{emHX=c*c6{-=H%Gy+&J`FKt(|Iyw-w^0lkvr4>m;zCe$A4Q1K&3v+YQ
zc)u!pe(l#^DjYZ7Y~sSE@`7>*XnMe5s=ArurdR!q2C?qpVPRVM51R%GPtVS>Wa1c^
zb9d*T@6TM-)Yv}&yiRcDnugtQ@))biF-gsh-Ea^<A8bUCA0-^`ePtK29slwN4v&Jh
zYh`$B&l!#@y}TAIv1hNZj(oC*mm-(=PCm4?3+bOhGJDHuaReb|-S24Fi*<m`Rh#^n
zT*E^&<@7v=SkD;NZJN55K(2H+ZfB9zU|^6sBAU0z7J^(jL1sScJ;y0vxIz?;|7arw
z+;B6Dby$K6rsd0D7ZLA6Ae~ef1N!&wuiSp$zSV$_u|cvbgaS6jRWU?bEz)5<CZu6{
zDJ}b=9^V>Lh8?2WPp3Va`bh{l!<Og3en<a<4!t&-7X=XKp<4wQWTJXvc=!Y?a3J)s
z)wt>i#~G44*0^wi57p8)_#6`p`R>UfY$(^7DshpA3&XK#M@L62hP!<HVY#P2WBIKz
ztE=fwlR6C^;4f#T(+N55Cl}Oj+dtj9@UXSrvmxY_QIP<nnDd@VRp=uw2&OeU8tyVn
zlK^`jOopN(@1OJ#i5u(H*l)8juwY^&{eJrXlMQxP({E_3Nh<PS3Uh{kB+0516L)+K
zbKr*5{To6p#z3<@%Y*XL(znklFLv@-cnJmXLv7@@)9Be|@|{>*9I0@YCPC1-HZ5^w
z{Ymq$K?!ZyCmhUIEBU!F0ybc5RCyK0MXd?4Ip_4Mvq>-Ulrd^xR;EdYa`bbUn3*^n
z(5*v41`8`?>d6oD7ljOcVuU6;1{NEY;Cc+Tl8*e1yEj>{qQ18m{!$dQS!YPEE)p(H
za9`m7*zqg{gH22D0?c|7M;{R3vNA9XudA*T<v1U2Z`$?zeGPu3YTjlo$)y=_>B{P=
z>v^Q>PSX}3*3*L25AY3@A>$i4tpUchCT~7=Z;=G_Evo$@#3Ec;-%iWP&{EL6pG4@q
zu=G~;pYB!H6!QoEsaRv-Co!rjo*E!*fDlJjMFl24&ijYO0Og+A{@}{s8ZMJS4q7kF
zg@*g^bg%A!pbziR81~Cn4Ap+4)c3t)@2d{Hk>hxID~(K#z_dx~#VbMkYbDuj$@uS|
ze8ewZB#w40D5zP##YT}O?QZ@W!H}UVp|=$s8_e3Hz*|_bss5ClOyMLJNyp9R^1@x~
z%GcLd)?Lq(LrGfkLZ!P5gP_kw*_U<V4X*(^nsducua!av=3{Q&UkM+QlasU4vzrIx
zN;%6`d$g#SnA%!fmF2qUn?F8ygl^dUiSfgupU`>2bBlzimM{mG3iyvX#+{RPW`EP(
zxUiGcdUlC$h3OR0F%F8_4bu&u=1qcx<S*qYE{^!l9qN1fC4g5zjML}nurFUUOH4Qj
z2u3$X*>aS=gZd(;bFROLG5dY==g+3gfk)Mtb@5Z7K;;ZViH#%FFq<q6qh@<X;DcB9
zG402XKYrMZp-EGtzqg;dZPFk)wgO)dC(kn}$^GaTRv`K>wg@~peemEEsFyjm{%YNs
zX%Oi`3?WukRjqlaWuWCMASpO*D6M)j^p>X1DJ(JUosp4&Uad(_HNIMphxyaj@+u?0
z2RnOvFVD9$RO$6J0wDFZ`3x5f?7_fMPw%kl!E+fI7SUB1Mi!>E@3L0apUR`}f?Rs9
z<nYUF-#amnLcskPu6>GEZE99Ks;j`yBF7={SQfcm{xGpa`SJ`5$4#?M-x*|5ql(f+
zypmx7(@qJ8i@rpTjEdpHZAu0yt$LfNkdO~<Zrk7z42ukSAjW=G6Dw4|K7Tc6VMe$l
z<Q*Al<1mJocP5tg+0=A>cYpUt9WK$v!Ty1eTlZ!OhiElQ!lPc@wY|No@AWAuDe6}l
ze+ZPXC5z2Ee?jdXLOMNKmt>#8fOnpM_qo<9>Imy^q|zOqata<LLiT(p*(_wcpBxgt
zO%~GaoyzH9-OAiN%t?_ADX^HSufCZJiH`n#xtjq1KdhGh2x7zOx9=cZSzF;huw749
zf}wkr-c`lQ$|~D}gX0-8cKL6^HC8pwtRLSI?o<5tLyZ^~9(kRS7DS<s;2jlJeW-S2
z=foq|*~MsVWMsEf@sPep$WMngwZ=<48HWGHrtAH!EzVbBV7wdrD){utqZauus)PM&
zAKx<n=A2tdRr{)eRc24TvczkD-JSRi8KB~g(GQC&D~{Lv_3Ne)p7mh?#g2y)9q)@n
z2iQRz2bAmO<yAo^8@ZP+c^lbYD~r1-AF>ZCOQwfw<DQBIiTn$Lisd#ehsl0>s5&fO
zK>8*$5i&~->ntU@XW48t7B~1V(|gsA&D_{n)`g5smVo>oq1n54RSxT#RI-nOa*;{5
zVlG{8G`0v5E+~6}*9!I^e|5Os!_C7jda|d(1=WuN#NH59$to)g&@N9e(w_jv>L>FR
zj7%yncFd;>?umZVS&QBxJg+uwcl#vfw#SYufCnoZD{GCNYh-@UYb{^5_LoMS@`xh6
z2||!JEVh&mBZ7AW(kv(%rhaU$mrJ*uTDom^A?^_`sa>ne$!a;!HeN@aO*jL+P^X4f
zNJxmq#p&?-tLa<=c-$ZT<Oeg{@v+xW=^j_=-<E&E>qP;fiQ6+2DX$qgGJRYxzrxg|
zdq1kMj{%bB)vf8=&76h6akR{NwaH4PNv&dYDS!i5o<L$nYO;X~QBzJ%_|$Ij*NC(T
zP#ScBBMlMue+_p<RbtpQ1oYpm0Xhqm>snJ$&_ThiH*2r^l!*ag1D;{GvGIc}boY?%
zE%c`Za#*%o*~-%Q@bqyJadC0SOWjoArX8EpqohnZZ5cc1+(9izpWEKf?^+|rt-^6|
zfPMLBqg*bQlbL&)(P2+KodiI3N>p}>`8;6d%3|Q;w9MMuIEtU;^}kS7j%pmKu|3cc
zq?Y(FU7t8tcK9;1)$_AxEQj-3z~^#DSuBh>GCW%T4n&h!Chy)Pr4$s{ZP%`^NrJ)w
zFb0_9-6dbo9G_xlc~hh*ojaRY#|Lu!TOkb0Igiw9_0|`%V^bn9(0RB!C~+P*IJ!lh
ziN(Wl?4EJB>ED6kQ{wq^4A-kpMxH<_TpF5mnE4hRJj?=m7tgaQ+B&CVDihq@pVd{E
zNt{;IQBe;~?i!gG0dHNq*2eCpsllVC%0OP}weButfS8zk7a=M)!6WdYqGPgSUYP*u
za<z#}|JR+k&RQf6k>T_ZZfd6yI-S|DH3cCmC$`Dx!@&K^9Z}HHwd)_<bSFJFzBWD-
zOD?9R`bc?x6Ocym@uLu{CjTly!e^vBV_~W={;4|eb~!XMA;Yfn#A<e+JwTFB3=4+)
z#Wt5(POWo0Tx+y!$tW1LD|D1%lPdrb^-fD32v>kR3XhHcVj@mnx+<a|uKpMQ#`hSL
zFNcRY<4Lt(pQw4O$axwNeAHjmk0dMm0cOd6N@dG4ON)x6)YiQE3^Onu_`qbJ5>?Mc
z50nV|p!1mT=DP(WHlf)8*qV4JFry3GLSlhy^nl&58z4VaFW|m!PSguEvKdYLX3OTX
zb3Dugi;9I|TuurnND&3J5%hWivQOfFqfv^^ig&$Hf5Xhgu)|kWgLH7t%gm>5c=!W)
z7maTzEX&}NmxnxQWV{XuLR?c7DJk<!KWhN85b4jZ%a8aT=%j3GsChXA=rhaP5jBL%
zJ6+7b3bkwe$v{L1lEBer=GDES{J7Y=<wZrQ0sS983bszwH{nqNA!KoTo0dLzci(Vf
ztL7<B9m$lYru}y7UkG%qN6XVanvIJ~_%e7GUH2>y7@o6FU+49(n(CR+L2YnOS*0I-
z+vU<l63_=fpFXvcIAuF2=`JOeX!pzaJxTz^0rm_U4bX=;)Wa~o&AYpNYs}-3<s;^c
z+M79@#=g6cxym{^uTY0yB8t?znNL)i9?aHY^F6C1<+JkFrCv5z#zAxhlXi~A&jbO$
ze}GAA(Fb)f$6I~-0UaH3FCFc-+YAgcJr`;4jK4-W!#sX2LL4U@Qj?%&p=?sLExmw@
zSqJAcG>iaC>jQW&f-vIL<ki74z|qT`WM%32aGaX+PkB|w@@|-`FY+CqPubvhhgjoT
zS!v+v>Z&TJP8IbRi2D8=9DB&JPf@*GE+e%xHEF1+KeM*M>~iH#Mpr)!^h2v$gNI6P
zRaf`jdixd^)(()XC@UKR*#=U*`@>B2Ih4f2mUim+UZ3HRoSYtx-&0oJYI@1@FmX=#
zQo0J?nw7!Q>w6&aDZ|Tq2Zw|Z|3D4z1D79ihd^@n?(ty|N}P7B3v!)404=bgJhA`a
z;rW=If`NWjA9(h!`RL&{%FEA#sfgM>c5)~i{mEjFhH7!4bskGTBtHL@PMsUzB7*$l
zA#RoB=<yYd1;oW32~R#q+GXKlC5oJ1Ss@bmxCx7+4&9Xlr5|-8bX!2Pw%?w%Bw9(y
zdS7XJqC(*S75s;SL>Q04{E{(er$DPA$ecThX>;vyUPFN!c$bvC4_#bH@>-lrjDKd|
zJY`lCP~5uu12WCnK+KLsY-D0$LP<rlf4Y8WlLS~K-~`Xo%?h3#`}-faXFkI$soyzt
z?*=t~(tik>wL3ounUETl-7>lOE8&&;=Hg+H-EBQRvkz}SFfuSiekCNaUPUf%276u*
zYS2p(I68_Sx;~bDk37BEoWbGE%EF2=IXp4~H+*zlv{!yfcJ^G;&*O@q({QYP=_h0c
z@4$C~jxIVe%<bTJQ~{|R4PNKl?2<>%<&>0I1O$%Gdve#_h*Et-6T#7vaQ92;b#b`_
z_xQ#);S8rHlp59HO1Es>SeTii1fwi}3oND7)Km~Cd?e&G^O$cu_dSQYGi?;1V0&)}
z<vx4s#DuJf_7g6yv+nW5F*SLd4zN&QVk=Zr(j+9gI5ix!RvKD?U}L4%!~~pAnEAZL
zX?`F{%F}r9BwRE4l}vVcK{f$_&&S2z_=iqOg3g@A3pOxtE)DXlv4@!D?`rI^-OnYD
zzY@YY-+|16gD)Wag@OV*4IU)9mF7kRFOrZLliz)hvpQUWi}l%_V|@M*aF~t}rUUY4
zq|<5ZQu$9vF|3(^=B7`7*Y)BUpA?Pw-sQ4%kI(1#jgqk7(Mzh@Ov&en!urKE%vDuY
zrBm<XcCp=)nMoeU`ZW*6_q>gkUvdJfJZ>GSZ|ct}qpSp_df^F?-@qztYpc_bA&ExH
zRghN;zQDO--q&uPN4B=vZC*mufWN#wu=pDHX3gjcXzYff+D1kM)=d%-%Cn##0%ano
z{`mO7bQmK6`B`dKZvNH6++5!G)N4@TfV{=l1ZhqtE_+Po)vNlCTMFjpuT;&qk0Y@f
z9rM(DC-{JBPX4T#+_VTX<spWZRKTqW4qm^S8&RYHw#;}%trw3U>>@#yoiCI);Fecf
z8VL_>325#ZX5=m3QF+uSro`rC#OJw4sGQ?>OT8C)Eo|B1?-3XG2aFT!E~7gQw5we{
z_(uh&%nMtlGhY#Pv%rJXY-|nf(dMSioGh$M5c&<hv0eFAB9SwnB$M)KOHNw$*E-8R
zxPTS8pXvWZ8*02LM0KHRqtNh_LoAPio(-rlvu&6ME!=WmK{hdbl*L>buY!6YB_)(>
z(!=iJ^wSvV7r{OLvh2OHG=?^lw>rm9(+v~3cz!(ms_0f$I!4BaBq#R;j73DWMMUa1
z`($siAfMj>;oKQU)&MnHz}|zE=MYr>8YyUqmr`tvuOhF3JlFZY2u^&|3MVeHcZ#Hi
zHH(Rf(bI}j=wa^CbycNcKxzr>F(Xx6W_eritQTmP)GGFwW!3AJuZv634AxftEe2y^
z+&>r@f!oZF;_@USUbL;xzP=Km9p2yDgM|PogluR1NosmziH#^w_9yMlTG)Obv+ywX
zG2H)v{5&)%3A?rlZ2fWy=FM0W<Kw+TE8L+$PT-{r3`DoJu>t;^O{S`X0xR=H(99|z
z!8nMw-?3^1J)#ory8hZ4eplI_=}_>DeqB>dsefwF>s=qEsGCMmVqhR~9Ek{QA|hXE
zr$|eKazD4X%&ns~voJ99Z&=LncVEG?DH-zc)<y|rI#^sy6^)(J!&ZWYg#ueic8<x*
zmoLH0BF>-CJ4IDVi~)gwVGTSkE+$H!y1BW5$3;;0;iyG;QCD4n%^ftWJ(#~h!0l4u
zEepD$qWtuN`reVBcbz|d`z9&&Df;ukOUNTiRW*k+OV&aL_&9quCof&d`Ucc@cdRwW
zq#FD)a<i4@o10xE8m?gn^m|qXYc?W!UH!F3cOEvyO=NZTJN5C^@85r=wIAzmy#KZs
zx&<4`{7s0k?NKNt3lr0ytz~*@YSRzzVv~|E6l?)8aCAPKu5l-^?E>11lk-`f>j`nC
zp;m%GxZ+IDSMIE;s*H?`@qXRps@Rbrb;`Acmxp`6A3qr#v9>)PyE?HO?kz5}Iz8Sp
zm9)-Irq}_~>}YSlTgJC0ROIDDsxciZtDrQ6%b|_zavRp^ob+@(b8}`|#t5A+KfAh6
zFw6aEbAjowkFj4?cCM~I0g_l!-b-prwSR0I>imnOz&amn8_J@l#}DX5)Sgt*D<}*C
zA;oan5IP(ncR-0oL~<XlECnN_p@~V#=&WvgK~M7Eu?&D0ZUkaJX8=9`a4`1R1y$r9
z!AN9G#Hi7|Yj*aJ;F*(SyfeUib%lVUp|(P>)Y-`dOJ--suhfT)BjeN%kRX|*^IZSA
z)m|tgUIPcf^FSXVA;bh#HU9k-#tvq%VeyJ7GfDvNW9kQWmrmrfjBYFq19QXCv9Z_c
z%EoZh4^5j+`zo)QD&7C^A<;jB8S5|@)Q0Hj=n@Vnl{Jp6I>k77R$z4_Oim*3(ah9T
zTH9@Vs;Ct<_ObKv?>=TtVM;6qX(8M{XL|Rpy(hnwUyk86HBTvMYYz;!fH~vQ!D=74
z1FCrE10;1P=TFl}fPX)*!5<J11O^UbVIlw7AnI*j;<vRX5`1Ft#`U=?m_(-O+@#pa
z!k|OY9T%I^yns6j@WPGZB(FR5sT~j4V*!mhUNEEr6c?O~<*nYTlA)7=)UzXXM7l!V
zSEs&IQheQrLqQ?DSQWJK8k!2}X=xaOc=8c68R<BPjEs!9_tTk}bKe<elsNpt#0=^%
z__)xQaIoA3xy{m8Sourkv2p)<qxnt&6MO97v;Nnk$9s2;%*~++!rDaFH8<bcT0S{l
z_b$glKf~`Dm3q+$lUx-g6--WcE9;~93d;xmYK;c0G&E)ws~*1`9iN>+O6o0Z39(OY
ztvx?=*OXQ4!n?HP<;P7cXBXQ~2FiYZXEI5X3=y!O_iJmmljt8FZmTv#A;h#HTe<$p
zIvLwG!pL(F2@-q5VO{`vz#oi~^6fo+Yk*UbKL6y+3=;DzIl`&=^XDbIj~=J)m%98#
zVEB(cMiN$ypkv~Or4UYdb=BQae@%bao`8%=MefP=Kp6P-xAReOaS`>9O3^8T(5S1c
z@6NV7#TWI;o4LEYa<;ThYQGjyIkmLv_7>@)BJbZuGX@A`rg>cWV6)0WvMDJ*xD6lM
zeg}M${`@g1oUebr_3-)6Ognyg4X3)`g@tfwYBg0d{hWdVl`l78Th)qJL<#D<(?5pZ
z`xcP`_I0|SAz(=EJ<tFx185M|aOon>R$hfy#nSG*bP}Jt_XK$y-G!<spN4}&poBFG
zG0;xqtI4Cbn??i;#W!MV_v2BWi?S=fKzOdQ_#H$<vBC)&W@hpSf>@L0u&1uGAF7B;
zx|o;bsN<=^eaFOD_FkOeJ`M;wT8KMXY`4!%Hwqfc^-RBnhkw|xP;S}yWaBOP5n7!I
z255Dr8!%>vLYM!gO_xMQ3_c_;VRs^$I19o=0p17fDg5gr7<d6o8yrlQ!#wxy9mqZx
z;X6VqX`SxrYMwGtwn6ka?EiPG2u~WWw<QEoF){f;+R(2_r@U_d`2f3|aIl7`$Jrqo
zBF?K0GJ%S0s%imn=MpdmpP37TvhU~!i^8UX8l<_zJpDZEROd327ZTvG@Fs3zz?6Cb
z0Tv(NdY!MY`69|G%B#Re4j^}bSlw9kuuIOs>rvr5W=$9xFzZ!Q`{ck!F5ouzc=#EO
z1M$<R_Mo<^jrXd_{o8}dv*iZ{zUla691vioQEri)pO2dn&=XtNIQoA0r{szCfnY#j
z;15(Voq=dnkp;-G73RD?;~0(5rcLF>!!<BiYOKXCb4jSLza1-MY+_RD%(hY}Flpsg
z!zY?0{hDFv`GwrzI^G;N5QNswgPB`Q*Ze~(z{ccgyYBe?6IYXLhF3PNzi5Tu?pvPR
zjeQ)I#=Ez}0VMm&T|=nl=P}+bFE4`u7ZQ{f^Z0XXb1qxw89T_Kl?FhD%Ke-LJj^*m
z8Ex(DOjc7K_G2eEe0S9Qj~?ONzWw_)(kTku0btxss__mAUvcT?{*ytm$7BX}hhrkT
z*=p)<fB`f-*<~^7IsK44$=|=Dd)=D;ReV_ZKAC}KOoXD8oZQB+k^9MY4-T^icydq$
zzh!RB$S_E36$EpK+r6zYA7L}II&Saw@9=@M3T#CHheCGIrKE!7UR{0g1RITLzi-Yq
z{irw&>_F+jk)9lSACiL15z&cBC{SBmJkT=c(wU0yR-e|~oaHJdckh1sqpuaiodZWO
zWCfcam=rrzJFOELgV5j+3)9@<BCvM&xs4X4ou4#3&Dd$c0MSvdo5T5LK;`L}7T>W>
zozvd_NYVpZ$ba^cAyZUPVEK!tvP^Uh?QD)mWFtZKW3#(UcGxNiDy8O1ViMxEpo9FJ
zoXi2El6Rj%$@$iMzNtQ(b)J_l*KwD;DYUXb`ceLa&*^dwO0&3c-=Ob*z~&#%ZoG0p
zfX1?o3FCt5uPtymkQ82!e?|4^QL)|8%G{pfd%stdAF0e)69%Z;+u8(X%Jr=wOH(VT
zp2_4+)I@zDM*SNpMA8?n>_Q){4^D$n3D<?_1QzdnCHK_r?z!URH4@X;Pm7OlZnK@d
zb9tv&8|^<FCMuTSa6RFcmI}IK!3%sV?fQ>oQqH_uF5?SP@G<;k$gnuK()=I-o~}^4
zBz~?ed5$^IEG+U1O$6h_#FZ>r&8>3OM=ag5wYCrc2<(u-LJWk~e~kLXq@*gVeMhcu
z_A}n7Nmb^)<o*5v+?`OpV20j<rX@@l0kbivN+b(|#Z+4Z{rhncbF%Xqe=Ck;Y6o6|
z2kP^kt+8-z`9$a5lFF>1Oy9etx|o?eB6oseNp2NuMaJTEJv?>$W<8W$T8e14lGfF~
zxH3NukjN2944~vk=Okj{1qVb=KJL_O8Tmk@l-e`cd)!y1&~$tMf@+d}10xfwkmU`E
zhVo*fzz_mS6au;khz(Kp;y}>wH`3%e7%pWjftb-O84_%>d#i6DJ+g0~2-otwyI3~&
zM}_rNy|rTZ)&}&IQ{C)9dmipAQ7H^CVEnzF-buv`<DnQ9?P5ze@aYvX(&Tt4mucn|
ziVtkco??Ab*w3N9ur6s*`o3FtA;cc6J1gPgL?%#=LWUE9sQ;oefVw{j88gsd(<AB&
zXd{FZPc&=O=K92-G60_FnyD6XaJlV4BBhEQi|GuwtEd!=-E#TCqj6>>&+y0O4Y(b2
z7OEe<-|TK4P+ns{Cs`wTJMtKp@=g2l4XAyA7X*J2;*cLQpNS(hP*3BW3gn2%%Y*du
zrP!wjoOC=K99M1m+Zt=iBlzZ4?a1UpWgDqiL|081B)jq=+F=s+@Ke!K5}z<BJ2Y2z
zvPC4ew+b0PKIB!YvA-#R$`<TN+|M_0eMI-jwkM}9w;1Tkll2qS5RniCrhMPS_*0{`
zTvqBS#YvAba0p{mBhwBH<;JR<yT;J2f!=w`nU8zhYSLN$D1_EeZ5&+pbSfR<D%l9<
zmgeHV68aUeNnd;+w!ZL9NeN3&SDIu;ktPlXD^;>x?lc&59Q?L@Sm7D|U#1vfcfn(F
zr>VpSn^%i;l6zButr1Kn;h6%mlx>+^eQmATM)}bX_8-y&l3-*}!{Z#!V~a>aO+iWd
zf+{Tfk@nf~bZ$UIyO;#nP_o87VeOvkMrXDDciVuLmY&2TS9F>Pw?EOR_CLzX454V{
z8c_x|AT@O=JX-Zm2{w2KgOelUY4D$uy}=Yk6%avtGOM9l7=Y-kh>8~Ak>ium3r?aY
z1RCb4uX9Ald>NUpONH1RN;nw}oR~`t=fkUD`){FdspfH(L7!*I==~gn21(-XJJZWT
zCa1sF41uKs6v`ieio$5EAVWgZ;X(-fc#?J(9l;d@nK-s(sy@U-I;JqbecM3-@$$m#
z?K{RtkF4f)L$AT2*5S0{8i<ELEycbBu8xBG3oeGor_HTHB8x6SeubV1M7}EJJvFaB
zX;%dbA&T5?f`sqg3L_Cj<u6VEfJR@9f0(NM6(;vU<V$>fsL^i6B0Y9jmr&XUl{%S@
zt?d!$p1<a^7Ca(L_P|ljUXfn?JjXN<T>_gUuJIj>+cQ&BwZ>h%N}b>!pFY%jbMDN?
zv%fVt+HmZ0Gut};@IKh(0Ik#5C>w<wNah@Z1~e*`S`Ai2E+96~&(7=U?LGaHi2TFm
z_K>`+%C)4#08+_HcLMUZwZ1+?V9$=&)6(`Hf4mg(>o9Lw_tUaEU2`jXR9R4PJfFsA
zz^<-R?mBV)CDB*QthJou4j`JSH10r5E#D$}LDMoYP_>w|M@zC4v#_)l7aQw#-u(ne
zHYzHr7|4TI-&AZdpGfyfePef>0s*iGb4uQ(^*fbn;KMcD170DRESB0%BJW1R@}({+
zzB?j%tNxu2b&lFf`~RCkMi~$ABPkx-Hivt+A}-Ek*zt|Fw%yX$ZQ@|=mS1;Q6Av}z
z4K!XbmmGBt`H>5OBMU1TSDWdmj)sqqc(kNgS9zzw0&5fd@XQOHzTN(LR|@6(r~?bD
zt2cx5TW_{vcsC!ksKFwQ>IK~NzZR+V4Oj_$Tn-Cs0D}C1dayvPul0z!(T7P2X&+HT
z`PJl0t`v6`M=vKfH))>yB?5U3jflAOnZ`y`7f#N{PAA(VS@EF~caS{=M9WHT`i&03
zN24w1=&y$nAruRB1>Xzw#+lAe1AeMKlS_GR;BV{!Bl6tuOas?4bc()e<1|^dcRX1T
z-y^!fVyxApn9BJ?QSmc?CTV+A|7~ki8bO4z3(6HWoel%`$^B<jPq>I!#(p=AHB)gz
z)%B3)u;SCF^w=E7_GW?j9|8O-!T|k>>g9pAjsF6ovr|Q#U{#kwxGaGVj}R4`(ECXt
zE1&5IT^67wH&Ib8FS~URQ7t4;oN^3|7V6+4iWq_)igG`X&M<wKft&l3=KWv$hTwx>
zVCnMXKDxNHqH|L%Dsk}fW)dmF!=v}nu|5<C2ndSweh*^qKYTW^t#=PBJ#0jVUCt2f
z3@FvmL_nRZS>jXK*lxvU$!S{2>kKwCeX#;bqIBfEKMLs`gF!8z^gnhy4yNp&<a4_^
zcelV>_H#)3m&->n*&t)YJK!j9U#lB8?Zard{;Fncixd`~7*=(#&xRYcEp_3zj+yUw
zfZ?yD*xK65NxKhA*|7eueKt}D<(KSp!#%Jtc}iqZkP5o`)Vtw*pg*u@Sy|=#PExO{
ztu2Uz)H+ekHpcl>7kO}S82B6m{rv{)u|TR$o`s<3l@&LHrXYra+@}Eng9D+kA9zoF
zMx=Cz-hRSpK>S<ajgHO^$(*lS`hb`>0)4IXP3EFO07CS|biMV##L?$huU;J=%g+3C
zMIpS4nIv@Yelog3juNF!ur>&6KK_~nfB0bHXUIHy^`_CIYyi_>og6;lE<e4j5`$0(
zF4m0d@8Ptw2-gXm{p3abdaus?BB4(Gc<>R1D-KRUr_Q7E>eg;7Lcl@ozWy3)Tl?Sv
zelppkT{4o|vgedxQZ6nD4Oc()Oa*N8Iyg6RaePp&2~rg%GnWRJnICxWjseF7Bn5Y^
zKl0hG5bpVqs4YGgydDRV`ptx6|EvXP7TVk`VBsv|4$#ulj$KkhaWp}*$!ykHip_Xs
z%Qx;*$h^B#@{f&3OXjV2?6DPk6V?sr|K?$m^zR-f<;K0vdra3jfBtOz&euV^&Kg>$
zYg;*3c_c3{|MSDyk<f83@1wwN)47^WJn2W%(|BGlq_WTlshHHp^xhIsG1=MM+cVqY
zQc(nQO4+|Gsi`He68u?N)7^`3e(F5)k7uLxN%wRt-)f@scHJt4r{C_+`$)^qKkdWZ
zqrHm->(9@tEgYXg(KM&8;Y<SNVH(AkmqH;GddLqYyz?6yo(`w!2xw^u;CNuNrsPz;
z*h+fxb1~bG`}bXx;{^W@$B2Xkd=i45`z1N`^<Cd&vIgEvR;zsOpD<29{-7$vKuyhO
z*@&ZzZ~N*M>qGOp-kx3;9(Mx7+ZWt=r9ZbBnEnKk-66})HX8Lp%4{?zg*m`n2~izh
zLuNT|1BG0~^yQ=ScixwRr)Nk?N=jioQ66%g0fagOzX!RvxgqaisJ~x9aYXlM#?H^T
zT4lRJ)8=@IjWH>#(3%sY3D>L({kdZCaVR1J<+EpRBWtkP*vQr9R8&<lxP9*s6aR@t
z_RGl7a<uaF^sGcE<FYm4oM=fdc$f)%7qi2*O8UB|_n)CNvawCpmN5%-fJ}IQzrlQ_
za%gf0JAn14JZhZ$hZ#lh_jOKJm)lnbuRdZT*Oirtdn7&6cq$}BKKbEueykV;pr4CP
zpQz@bKgl;Y*KbEuf1~D2R1aEX1WyVnTrvB%2nb%n^B$o*TiTm(mb6P1`%fqzF+5fi
z5%~)Vs8-DWGnzF4VP6xTG#MEluLnCew(*=t6M$pj<H$SV6pj~e*bp+We#EaVLn_C`
z%gdW6;J&%F3?dNV6`@DJr9zwCJwzpK(zmi5m0RB+xuxZ)LP3KkFCn2K_1fQj(9VG2
z_Gx7N+Mk8Yw0yrA@!kjJCLDr-50vJPNRCA=orVmpUGh-n<;d@rlv)+pyY23VWM_{x
z-hK|ktv1eKs)$Zgl>+*(4qOry>h1hQ<HvMrTr^)t8gpi<Qfm^k^YRX#yL5j_&Z*`-
zhunkC&Hy7x!Z4}1#bs!;Y8#5z+g_QfyZ%T`)jRnh^jxsKq5^jMvtJ_x!8S6-9FvJi
zBw(5Sio_m9A9-r{fe%K8hiRx;e=4a73nw2aamZ5g;0qql#ZjN)3;H^H=4vm_cx#}&
z*o*t~<_^l;0Myx9SIMQW(LT%H(E&iWFT?E`^|Mf~V^6KE4SJao-nj&xSa<Dh3k%MP
z8Zs&?ajv|uNFR@Ztt`x*2&?vf{-lD*TW`F;@#V52lA}1x?W4MW7EV|Ci>bd25AbL?
z8MD`=A3O2Tp-V>rG5zLP@x61C92QSu!Yz`=6BeWaV&~B@ifU>Oz!@8;Hxm^+86#kk
z!rjDt$=XwTm!DOjtn8>gR|*#=-QG)Za<KU_dV8h>f2$R+g_ZBbJcWZCpy0V&FpT-7
zOI+=t9y9G+-7_FZ7vWlanWjIpJ$^Ez0OUk9E30`(dw%Yx=8<fndx_(Nt_~0x%+@R{
zR>kN5N16v{<fTmDjs^d%AloDXXPe8lvpk(ymrcI)Rlf3q@^{K(3Xhwstal`){MM-b
zWSt#P$*$-Nm=(3DIq~rg^DwSjTC&Bca2GW^DzOLf8|d5_#KsMR6YS?kz7ec_K?0f&
zDW_$2rY|?|HxyM)P8T_uz=~o!;aQ1zh#!MY%;NG)r?c-!Yq!ZVN_sfPB?vck#=KmU
z#>?Mx_9Wa&Vxiz*uFI}`osf{0{tf-Gsqj=fdB|w(!9LBO`OILxX-OxT&4f&jxf?xB
zeP872lAmvmcT-DTR#rCcQ#?92eD-!f+Qt+oxhba+7x9!46WRL(2{>gaD_^-B0os|>
zgNaTmH2!;HpxsnPfAK`|eMp+XH4kNk6b1nc`8(sG;o;Y>)xLiFrmUi(XS&#tAAhqt
zR~4)&ZnfT|%ESF`H>}Kqq9((7EDme`;#M2sMuA3oN9Qj#_1c$`8ikeV+26mjGcu+W
zr`&dUzT0>n$tP)Oz80tZ)#ui~mZ2?jXoDeMuIS5S|M@YIxkGdtcWrwV);h??y7fX#
zL`hf}7^g)liN-Yo_v$$B@1eeh9j2-@PwdsJ5)@JJ3(rFC3k-0ra9yR#R0M8Wo^&-_
z5PX)inre=SF}$P0`LQP=pu>OwGJgAT1qCh!4*aDm*21-F9I~1i{a2RgXVb79(=j}D
z*iB9WBP@P?{uiC(u)>2gCL<F=Y#b&`bwyX?k+IpoahTS_@Z7DbA~0~DpfGWw*rrfm
zjTmQJsCIE{dFRi99hAh*d|9AhT4i&SC~h30K17=yA<w&ft*jgo7WVw^;QB-3^&IFu
z5$*CZ_ZDvsiZh0SI~>bcG|FCV1pT!gS=p%D{ISQc@+lOJ{QGw%v-~Y`{@TSQo_H~;
zVu`VDeDq4spPT;7d`x4Z9m++>F@1>||K}k+sdFlbo&dYA3Oyv|wDfO`R1XLsx8Iuf
z;<<wIH|l=W#N=dK=r_WfCn3gRBBrJoQVx?Mx)8?XF5@qLj9BEe*zviF-{;5MX%z^s
zD6(b#O4TtktYm7;j@_QEH(Xw>l4<slP*m-0?rt&4s6%7UZt*n6sdMn<Wi9;q`qdtU
z(R`IV4#L8(L#KaGc+GBBDN16J)6y^u&&(VjPn+Jk^Rrj>(<?k`;6;BKPXTW0w9j*q
z)E5-%_uykTNhtKmyTNq1dB#t`eH$<LZ8_M7>k=y;NzfsB&u&MTm05ui`ets%kB>k0
zJr}cD+Qcnpt8ft`akE|)Jsg3xLsM0!UAO;UgdmlmWHbU7bTcns5<m2KF5&Bl7hoPD
z_2Ikc29p3a2Qw>2?qrEK@?Ag#`RtZro=(m5j?eTuP96ud=?Ez*4uK#jwgEX*PWlF2
zg$1F)?8Ap>aC1=XHYQ8d5hNxi93XnQhJ^Z^=}&n0pwTR8J6{gyJQBlvx2s=vy)-c~
zEi1EWY6l;qAXGej{N;xaA37ySAL9fC%QT9r25op@yzPEv`0kxYryM6g|CITYwATz*
zhr#Hd_Xm()_I-gBvBJ(8jv{d6^H=V1&jKk~S+Y8DX<3yJ=CiSrs`8Lm&JqW#Y?4~R
zjx*nKCr9WT77A&(x9d_of$)W{=;4US8yu2HaqBfh_fRb%EC@f?KXxz$w6r*YhVh}f
zz!xq(v&K)iZW@br4RsU*`NsGN@Cm$<<2iY;>PA;2xe$@UZuXdW3j#+*cXxO5W-9}^
zyb(p!)z_g36rot@M}mylH(wI3%W8UfrswD8Ow0}KSEd4TM<02J_}3+H*mQmDnzbZ(
z#{I6yKY)=UE-#41R98LZU(3T+&Mx$a<v}ET@~@O#ZO0T0xW-{|?$9OFVDmJ6B4Eg*
zOe&v3+9P_a+|VZ_XY4o>9NRg0>&gr0iR8bo<q4(LRK`yaNI%C7#UUb62P4DbQns<X
zuS1?bpoxel__3z=u{o1<L+z@Z>u-oUFD%PekD<5j>|{)TpPu^p?bjC+!8QIx3=y7z
z$ozudZW3!BCX$mV)##7~7fPLrO}!L5$dj`x9}5W;Ce@3$x?Y7wYie9DJ}dq^G;CCp
ztI!$DaxhqXsy`7Aerf9*^b|Fktn!^+PI8Wp>c2+&o}*}J!lc||eGVQ6DpS^H$EY^E
z!7a~4laRV@U7+hGXxF%*IU7GC&fGcx97~9pFa*EGY$P);54J<Sjh0Qrn4T?t*K__~
zeeW@&UUEGpQBl(Dh!pBEPtU4LH~`K|?2pz%8Si<-ET?ufJGsNYU)%H)sRfWNvgWl6
zps|@h=AHL|{>2o0wJ>4lv1$5&bP%098tqlZ`^EPzJ*lL&5%5TV=TE1mr{j?oQ~A&q
zYT4RG6%}Q}&BIIP6%s-=^a-ULCmx;L*)kXf{+g_7l=t_o&V+SObO9y(mbXY>_sfbh
zD>3)a%rvw#fa8`}vk!buZbwF3A#l;>LmmA68|l~9aWMVbqV+0E9N+taG2xx_b6%}!
z@*Xy>qnKOuv9UzQcD-X5yIHca%ep%*dxJzY4<Ct!8j2R3ZCUxZAtN5mE2uL?y`;et
zqHCcPsRw^?wa??@yi6U;GnGxYO6t3yEOzC3S|Zlo`}FZ+vL`P0QT-3j4(K83V}9E^
z{vnU<W4pXuvfcLu&Cwe6A0RS>=n58xhUMkI|1{u%_Ra9|8ZmK$+0A;E#itpX{rw|r
z-UPDyJVbll-*Zg9ep6pwGN3f&uj7}rn5n#D?h=HB3M4lNAmm+7M5`(R+baBp)`O_{
zyxLEdV&g&*yBA+8_CKOONB%~QWR?$xSpvx14K_A5E;9Zk{2elTN&VdX{50Uk9UZ-b
zy;nRnTl?t8k0G#p6_|4UV)PpPBefIVAZ6loNDVA}^R-H>{zMi`lfw6}F0ea(_0E~(
z<fW$%w;fHspc#zY&B)UzR;YI~wy?0bvU^VUAnIjVX;Bkf(xNLcR`3;_!R<)Ubph|k
zv#XxT7~rRUpcV*2cqB``<bLR`W2KTT=hmu&(XkO&oPa*oLV?Ag+o8*C)l$8vbx4xg
z{{G!NI6?RBT@3NmpUkNM*{!zf^OC_b8e+50=d6Zw8n*Zbm-)*KrSCl9&4e`M!gS)O
zh|Q0?3M4%gJ=4w(8PUvMiIX4h9gpq=sf*Cy-DyLlw0Z}?hA<B|Ep6=+T3q4s=%?As
zTUVBBW!@Br``mUogfiPDWR1m7yrUPF*Zo{d%j}XBS{vN1nwhXPN<`eqF_EvHyX1}c
zzg1$wf5v0lRvWxgK|R2a3wu56*=tR={M`{6e@i1G%x{eL$;gd&{Up%3XIAosdMpn8
z6OHIe=z<bjNlNtIUU8kekpC_%EvPLs8j2Y|iYbT=PMVf(3JpbLN}xd4<V!lq=eXET
z)#vkX!+Nt(zd<JfTaK~jJC7&pLb~gzBjeB1aY=p`ab4)^&%X4Ro*3t)lmyBqa6`UT
z6v8ijr||yPudt0#bCHHqJMOze#BzW7NH=s8!a)zK885keU2;4AB|g+v2~km=h;N$o
zPd?_oNFwZW6^92*K<f@GYr-d4a+F|+i_7JqWRd5PSt;E1%p;qDi-Y-&)l7gQ?Nar)
z`_Jf*yT}o%kx{E`iP_oN=NG}W5uI|WWEAbN=m5!qiYisgL)y*lwm!AurR`$JDqANj
zYfnKh^#F=_{=@#1XJ3noKjPqBRyljiP(9<rvM@I8y&TCw)cwOrgy}Se@~-UJuj!hh
zyYKHcCC6xSSA-tD7<MHiBMX(UhjSw%YvL;4oul|JBhyvD>d)h$3LcZkbd?H5b*ei?
zMb0p<se_#Yx0p>^u!rr`Hza>{a6(f<<6^-O#)0<vzT-}*)hT3+6D2lq%F#9Iv{fbT
z+Y4S%Ah6vNu5fTZr<RmC#|HX)sCaAb3PXC~eL=}xhRYd@;tK1#*q=F{Zp8V`%~KkK
zW$KZ(KyKAnLN0!mkD_z;m;9^ae8*pRU0{EpmV}kAB}Yj0TvaLZiEWFn?B8|^h9gZM
zcLsY$6(uFHT`6~q*OExljAC!OHx!elxol52*j_If|8`mkLtDSyU|+^!8A>M5=9a?}
zD}zj8>G5uLp3-Y+@m0?&idJrBK%N1&(I%_M!kPv5aV6yu2~6_VH!Qj`S!}1bopp-7
z2l9T^xb+<pHEwG@<)gp%=^OYkOjVbCJK5yFr1>LaC!1MXnwPXQ_AduwuU!SOzkqcB
zhO$=VsfLEj5Z)Om9oRwh=mXtX?AtdHQU<uVZ(sWb{`zrw$sex@Nm>g#LC#c#x4h;K
z@BQgkh&o)?xA;w$Bw!!E?%&Rk6d%uG5K;h{Fc5HMS1t=1#I4zk@bLXgj{q>sE4)^x
z0zifA=rASs^JKJCXI5Vl10xgApxJo|YvfD9U=w?&%j<CT>j;wL(qAJ&*b_1qX|=f|
z&9#FiJZjfh8kE+eKSw{*Tc02YOWebK04W5iL+dBk0W5Z_+gQ$gtF0-_5dRh)9j&LU
zYw&(!Y;aKFP;UR%y{x+y0aJA!wlXK}KMaqIPN+>nwhcHd+;TrvEr)e8zQNL@GgZ09
zo-8oXNjPmtD_#;-|LyS#EHtauVj?h15f^Y>+T?UG+0Fa($pP+jAsu%&H%|fQ8UzdL
z`&0}JgjH@erKK`cenyhcs!N}P?jrjuPfSeguXPHXglSJ!Y&#!cKEV!K+TK>y(qd%D
z_PSvjJ9!2)yn#h$xCRL${_;vnc16~B1TidU^kRz#1oH50IE8B)L@n+?aAL-Ox6Ny4
z_rgH)3$N}|2mXcycO>9R*+ep9VZBm}5D85qE20w>2M9q;OOea`4=M03AexI$10|E<
zd~B-Deh4Cb*7sni@oYhz3!ZVe9Bn?6#@-e>TUZ`Sm)m<%yc2|ZfeiuO*9&NR+CxUA
zW0fbs5P}@Gi?s>~->Zug@<!dqjq35}q_6Z8TudfZg=UMvrx;!cHGnTxNm-fQSgGMd
zhc4u=n8W@3RCoc<Ji(rlcGbqs%}qmBT#Q=$;_O`CNI>7|FOowTboXAwZJ7`fR5B+=
zlCEFBj5y=YUUxx-Z!!DB`GJ6kzCN;s*tCSh>(*>W9U&5;WBVfe4@RfgySU%R2uPiA
zI(8Ppg9xtLOz~0U0Rad?KKJ;(iTj3ifkXZ?PJx>BYU9?BNCc!mT*tSxx38|vQBhAX
zmp1>FPH5t_2qv8`=CN5GS`AfDRD^;V8Jk;j^|Xx}<C#}}&PVGK^$SVlv_*&a6MHk(
ztG&VVkn&a-1Vd}9{Z+ZzS_Av17F^0@Pc7W5jem7XAK74a`@R9f#$5NSzJb>*KLM@W
zKR7^WfAvS#2JFj$l!+XS-Fp>neZ9bVDOy@)qnfWKNf!ZO7HuJDq9G9UN`3JN+IP?@
z3faqM$LDEkUst$YVZx3*BiV3<bHnk6N|FN&wYbDqv&v-}{I`fnNNjBm5iZ+>T#pH@
z1i>W^$leT4gxQ)t6$o&WN_j02LMTpm067-~xE%xAt%?zXPZBQz*T(D<$?6vt7TV=5
zyE`Jk;0SR!(0MlrXEDM+<som2OJ%OJqhoAk<tc-GQaQKg-iuqb8LiO|V3_~G$Hx)M
z_!8EGKS!VEI!mUeYd?R+7^s?tT>y^#aQ|=;uWDmu%aoP%6}6vp`Ot*3lh9cI%#7Vm
z6RXaShq=aao!eDyc4dEm|Cn`TUqrT_)DJAWIE}b+vl*}weMm;t**T!BEPe%P8)mBd
zMRsxYve&8Hes_zD9#=T+?#e!@xs->NwaPWm&@iJjDPl^(!Oq4;EJbs*xtXdf#s}Qk
znw$A;Fvr1P0vr#lhjnEvbNiigW(IUm#Hgs6?ZC-6RS%|FnFDLSzHLmuOkxVPb)&3L
zJG9MNr(fL5%*e{hJRUX;*j86dm^Kn6$a}ml^!P+0Bs%l1zcjML>DnW;%DC95<F!2j
zRf4AoDb$otw6$et`s_8q<oS)N_5DG5bn?&>@3iLjJCc+Y+nUxkmWc#-Oq7)J3JNlG
ze-D_EF(;niwUjTG)Nk-v)%Z@D4&Sr8Y|Lz3ot+9QDo4kpSG3F4!$a-<U-G}%bulya
z-i=jISC`k;ZW~@DCW#$;!zb2WD^B&PrLCU%5n~(<VRw6bOw38JFa_r0hp_As-n$@E
z-|&t`3*STvNg5m*>z|kiBnzf<eR)gqu7iQ7Q{#?pmtKve_$P6|)dnOR+W~zB(U0K;
zK1{iH8jq{2AFyiG5}%^Ld8*;Dp{))|$iL^y_Eng|!ReIuncX-qD9Yv*SMqU%TVZwu
z3JHVFuL1gZ=saR!(O3hl)N35%%OOR!U37@DWfj&xh~Htb|1mNCv-W3gv4I1MOidnl
z#(jAWY3$46ztK7O<s1sw?R%+8R}D>eS$0F+8yU(emoC24UD$(QRZU~ub2%95Rk+|F
zfeXF6?6}sU&6^;ocgo=E`W&ax?Z)$=Q3(YzGxbO7({!{UmBOG~Ln+KEJ`16LupCH_
zJi4XHmbdSGdQ2F!8Q%@q1=U9|dD@Rkv3}P>{$%Rml2-5yq4Q~npuvTSo7+tI^1%Z(
zO*GM<(b3T@p~_s8geS~}v$Z(*_}>Wclk&Ks<86|fOIVsA!>$DWw_;RH15Nlc4ltMz
z|DgVP#;i-;KQbNDh#u<mv{8(HBhHpzLUxxx$IFlL+v#3E0BzJ0iw2h$5^wG&=33VF
zU0`pY&+JZ{f1)os15Pd#cb=^D&9k$cv?jkowNlHf;4-i}6Yv&sKR6z_zQfnAp~b`P
z5c01L;5PYAQUtK7%4YXJ%Et4$Y;Yeu!sCQr#b<A>PFmeO^s^!@ZSf#R4pcmMwTehr
z@ngxzD{oNlZi|`@#1tmNK_dqd?QC*RjT<{;`Djs5Q@1bi@wwO}1qH=t_ylM8yaG^j
zTR`J!!Ob%wZ%NM*ya)9*-D|>d_ZJ;k{rI6bn#ihq#pNliMqc%9J6?P!%NHj=4B2~+
z>!>R_pX95a);uLG?b+`wQ&@ExrGNlhX|t@kyA(V1>&#u2%|c&8V*?U%p*tfYdoaE@
zeA|K8+FJUcU|K_kMFXR{sHG*eU6wTOEdfGe+TSq*lqk`KZ~hkLPp&-^q9rasc^68`
z*Z2m44w!wB+dz>nZ0+VB>UezFX{q`&{g$sb!W+ZAAC54pw<KR*797k4{>JmAIHZH>
zYJRg49PF{Uz#MlOX}M{zX49eND#*###^L3&yo~JS-b8B~%l*w#a7sV79uVOd!-k<z
zMn%QNiu7XY93^>R-IO}ouNysq(~4N_ww9(sDYpyJ1Z8iS+qo}=-KyoN&c281^*)+a
z*Pv0UA@d5`o62VQLkGNo;lGu^UfmtPV+x<WuP<6#eE_vbkxQ(ChixqK9tlA(&1aNa
zm!s0UI`cQXn^4@MB8t9!d;Oj3GcF%W==A3-I#)gZ6MRO-&V(1Md>-DR!W6ZkZUU|o
z@obEpYpCAsA>^8M?0U!DXLD6L4Q^Ju6daeTRd!b&-4}0LzhgDBusAs&@BA$?4hJH5
z9-QXgRkjg2@VA(UXo;*|(r-9Cj)R|a;E`j~5y;IgJUVJaFKl7W>LZ1CtHWbbEM#IZ
zbhqD`=C#e7yt_T0R?{Yt*%)bVlr3a?J{GK@Iu>oP#Th&N4%#^&>_N(8=kZ^t(Ro)5
z3N$k_gZ(G-cP4BiV-#<7#>A8QrC|UrWbnV&>%tk_BIndkEvKNqM?pd^)UG1qAIBh&
z)2X!aRlXZ68#-3`Zl~ZUbBteKEI|-%D+WpW`zE_CVj?1MpV&Vp#A}P>5Z>y50Q@fC
zFc3bO`q^p4<1KP?N$a?Ad}O56BQKT2;KJ`M5`s>SP3ohhqQat6W(22tj<KXMaXNf(
z0c0ECDVWa}>mYFj9$Uud=0^uaKl|8TtE!$Xt$UZO%BE&b!AQ)(pZ|1mcwp^t<gIij
zQXdf?9qM5eBo0G4M#|@w%om$UcZbi~3WNIjfcy3fKFh9uihVIFH1(jNU*EsGr%Y<7
zsVS*S7N&Xc!Lm=XeK;!sSwadTB8(tg$^QkTtKYu|^9u@^8}xHgE@N{K31R*L;Zfar
z-P`Zhp=^)59|cf@Uiy=$$S?PClJDbN6AXSsd;3<NOL^q)4@q>1dWrt|Lp-}*Z~Nwp
z8FacC>FG6}r^od_A^IF1o{#(<Sy?hTa?rUGCIx|E__(;Qq;JkI^o%1q4b062pbPu`
zMfkL-zHbh1WF%@@ybFZZ5S!cEEwiyVEShu~I2#xgv}rMzE96!aEh}$@+gAO?tZ}ic
zv!~7fiiU*+CfwR;kvbY0Bs^}vjAlLHL=DJq`HQ9g2xsyfyPfH-UO#gWNtP}Q+%3Pw
zed`a)$3a9w0#Qtf^^Z!fov)A@A0D9ytY)YktK`bT;b(r#!`TrGN&~}FP2Q<k)L~9@
zt&A{J+dwr$e+tnRxjEn8+RModK6b*9>T68Hrlrj=NH+xg-eL}q^*?K97@xst_XpO!
zp!}Fy(ER|o`s|synd>27fg!r4O#O~gF;SP9EY=CCqX^%>t=|t2gCTrxZ>OGCz$FUM
z8ApdkV9=Hne$Ra)T<-Sm+qPW6pjDVLW4!m^!N|aG5JGo!Y^q4+<e2;~>fSo2%f4;*
zRY2)(=@dkzyF<DpL<FR}JCtrgLZk$wK^g&Rqy#BR>6Gq}l3u6x^S*1p?_SS8duFeh
zwPu*Py@_93zw2A)c^sePwf(1?SvUK1l(P~Z)O#GsHWmhow6XAUEj+C&1`CA7xQ1a8
zFC1$qcJu-m&ps;!2ieY{prRENSVO4M&6s0uMa7$aY<%9P1~C(`P``4c;P={YNqfbM
zff;GZ^}@{T-uF+YHiAkSJO{6vc>kW9N5?uHhuT&YBQzWWGFy|@lO?uty<`?9@C%rV
zVm-SjeILkBB`YSx#B9g8r-p{+WS4-O;5$1V?cEz4wDfEoj^yH^=`s|V%5T^fEpX`c
zewU2e(k?mtbI{Jp?%{*YN<PG9$<-V4>-+y8YkoKPrjsIEk%mbv-Wq9jJ^tb?l79Ql
z`b^)xB~0gJz7!>BpUOfRr|U-G=B>M`lBV%^R3MB^SmUm1wuYT?YPNS8o|ENV%YaE4
z{Kf=$cvv5nZ_2*S{PFGeU7`pTyPm$BqyEe5K{&%ke7AZv{pDZylixSE0Lgocs{?Wu
zFa!*uqEh=39!d~lliEC{rL8cZ=UI>Y%ZXw9Pl!y{4e?x)ZyYMIyCl$5d=cbOyEi`+
z0>neN@pZNNFWhTN@Y4YVEE1P$$(L9lE#brY%4(XmuWb<f-zO*b7yk>cS&l~F#TUQM
z_s1j|4sBUQ^1p0oamPV8vqzkFL|NVoU7IicH`t&Xgnxslfrt7x)Surn|Bi)omi_M#
zLzhqg^UeKN^365VzXK2X{#$O2=)c1eby590n$G{Xmy6TEV8X7<QdF3bm}p246We+&
z@ZaG)fB!Fu`t<k3gtE@xSI-6^py=H9mwkyR{Aj#UY~Y@0Mt_Y=6LZ6}|MxcVF~C9m
zukZ371kV3;m*xMTPmvGYKlx?$7Q?>O*pNA2ijFkwoRe#MuFDuJtD!YQ!e<bckztUI
z4wp>`>ZZwx*EQC+|3ZXhiAlWix2vgb&M3@8;ijgz?7gQeFYopH+s56yofraFhlx25
z$pwpX7CIA4k%wm_5631e?ZedH+zgwO?a+CfK{GUh-~Rm@jf}RvMTR4}(Q@f=9*4Fz
zDTGb@+N_B@z=jUAg@VE%Y*y;dY1>+E2MWuaZLDv`$0vOI*3|59;Ns3;YGOhhS_&0{
zE#A_?l9CSQ`S#iGJv~ty;3;jWtmJ(4%n;m@_N+IBg}=LgY$Yi_WqJ>3iD0wJ&(8<X
zVa#zuAaZgYU-ZwBo$;xuOK$F!sbdAtvpPjnAz|oBZ@(wdtf=6GqwmG)j)I*v6FvR*
znqX(u4fUNnxo`x4=6Q{szB$|aItTf5Qd639*LE<_>|6xAZ8F@AjS>CD*tkiTH#sC!
z24cjhbMo_N>Rufx$aB<;N>by6vm};ft96v=3R9iZ+#}a``YeU4BFy#-Qqn;-@hcW)
z_(maV?0Z~N>XHpPIZPYsZ7W4<ttu_ypFSlu&-2mI;d}B27jH)<O}M**xOjctK!+q-
z&LtFVT5#kpnI4ChxtmsqEPWI?yVW`lI*4|_9SJ)-D3KKv7K))Mrg5lijr$!(z@fX=
zd(BIKw$B$`hfJmhz$htgg@r|4bmr?ghai!#pZyA6`Cnh_V?Gpi*6%CfExtoSFkH&}
zvX?!7lwo8&ZqwKOgWvh&IrdldGy6ap(W6I;8sUK#(QpfdKK^)RUW&3o`mEgssxUV5
zUkVx<x81v<pEodY@AL*MnEQn8-;nq(F&^)UvRxZ*=k}V{og1Z3<nry1M=|E+27d``
zs{Hy<92{U)n~8v)A|hDMM(;z{E-o&9BO;Ogg;nSCEpI91XFivI<QO{<bzY>1ddu@U
zZlb6wL4n(%*^vhfNbiPG!yQ3HJJ9`OwVKf*=;)(A;$7s(<o(^NqLi9aj<gRr1U4oX
z6*nzWGxq%6KC{hegoL9lj&a9F=cxPYPEH)ndAT4S#}xiORpn^@!mFoXWE+!YyHdCH
zCvPSp_21zj-go^9+s-f%2G9P{J|`O+UJeQb0}1*3zD4?$*1<*HfnYc^DvT!Z$JOgj
z98cL-Cw9H8e>z`eoQfbtN$_DQPqqz7W|ia$@=$kmmHWzBc0*&JbiT1?xz+$-fR7@2
zJou3f1pyL5YfFpAaFC^9aP~)$*O$v8l%H{`FH?$4K}F4DKVv#Lz{I>^tZbK%8+_cq
zgAAhf7zAkaOjmDLe)-J$urK;;#L)1tHh5P`-qLAFJb(J^+0f5HX_20uo~@0|i16^^
zKcQjj479x4B%*Fvg>OETM)?c`fvGj5WR9AK`CxOj^25|7^kX$yXv3svr`u>MC615J
zA>1>ryYUZeW|@6PZozEj=4V=ZCN5*Iu#cr*L+(~8>QOX#H$;Q*XlQ5*p3?ZLG`P-n
zViU8z-YZ=005+D%DcW|^6<XTbcl6Bqi|@3?ne*`Siu&S0kmW<Y#;K9^#G-re<Z`->
zr<;VYrl(%$H+#Y&%>hvzF_X<CgC0}Q7i#4oy1VyTUpkcle$qJD_i%ruxVoM*FnIU%
z$#QOpS}dL0desZRK7#wV%HD5M6<t`*`$7C0J;(*s)RMt&UWNvNQYsE)upVq4bKXl^
z-S|aT=OdUL<o<&-R#unlYlrcB6$R&!E#3i$S%UK>xA6;<={6E21Vl)<ga`8xxgE&?
z5kTqewvROxFQJzOS@X(K?KSq3Ec8r42ZZ9{Z{UJd5sW=#ui-tMmylO`p`w)zNfn7s
zkVDbi(>w8jRrqU6y1ide?ebSdLGw_g?;TBh+8tG2j@}axzB<wC@<r9wu7ffdW@VLl
z)WQ(9w}P{Ry11dCn_DMU18t5u)CoyRNYGI(ORF<WO0qM;Ock%qpI2IWs~R{&H<y-~
zFRYPe<QJ7um$e+bU$i~$FkW-uVg_@60xRZLzC8{Zv7VZmP~WiGbb>e9?`9W8#Jd=s
z*Kc9#C|JG2%fWSqLzNaA%VU$Y6IF8YtpHE<Hq78OM$@%^s4jPf1y+@OjYlY^u_mVZ
zoi*`=B+i3^zIoifeGQ{2iD(A)&SzfH1w}<?0~aQcZ3&G94vU4s$jGCKTKB?2E4Y9S
z?&Q*<>cX==z*d-*8yp?dQrkXx$RqCGYW=K4Mug*7$>L6z3tAN^T!xQ&iC^fh2SyYq
z{*1Q`Z6iaXxczM7_rG;+J7uF`8DYIZ?xHcB7tgbMVFWJVLS-#okya_4$NWd(v6a;a
z=nMq}5R7p&ozlP$16!G8u*2&n%S%#DNyw64heg|30^0&(uG$nkxNVgeVLx)@z(cP-
zTM#)I+BP3cMW|Sb?U+zxu78YHK%t#YfCQcR2LelFPEHQ?wlKTp;t}Xj0}-Hl{S=Am
zkf^_FCl!e?t{eF@J(Y{*&q`7LpI`^12?6r~3g4@|`}oYDa1?r|rmSpuIEL~{@V;c=
zwQx*JZ!fR+=JwIiPgop=*Il4xytE@~*~aBuX;@q|00=21C1jXr*0(-uQ-=9hRoOgs
zY|UbD_EMF6#;Ed<hMwttVtViQ@6jTUA3m%H14>(4+hB(?jBkUB*>G`n5VPd>qgYv6
zGvJ`SdDDY@LW#YfUT&&`#FUX;vIY{N!?95?1>DZ9w0iO_sAXY|H48ZK4r5Re6ql6T
zng|bsWe`z@=#lR3GT-Iqu|mg9aen7Wr<9bG(c+x1+!=-lUidfC5s5bu=xco`cQ;w@
zv-qyJ6b$(+fmF8R>Mea&FEhB@2F}F}(Z8|_KYXBhx%@fev*Qq-miwDGZ|dsn{}u=%
zp5LB|zmP547+HO;BM96Cq-Z3#0+72x{5VaV@kt`99;eZtPq0Efd&V(<>^4sC6`q$@
z4Sk|sEtQ&`FeI66n=}dHht969%|1(bd~E{rPyiAFH0^yAD!=Ha=H#2(PEM8i%GldF
z$-o>36B@9vwsbzn+@$XxqONajD#*)TMYvi3q`L9_RUbam?{q00okZ#E<Lw4|JZ2L&
zz~x81K}*49l<~4pT>R|3pY+~XI=ZZ|^h1q-7g)eZoOkCuy9V61cbjy?Z*zpx(>y+a
z3eFXBGVcV9A_^KK4vIp;k2^&dAXEH1`wDw)L#UJw5efzm7n_Ll$wa(0F)9)S1K&(>
zlS!Jf%3i02O=yr?2gt~#4-O4|el<|NqjTDyM1=P_(^`Yue5?&*U4fx>)9QajWnfGO
zA0|TQ=826irX6$#vF?d>jI^8gZ$sV4%V^&@_+8e!>gvb8akK4>1Q?iyiZ=S1GwH6|
zkED^We^8q>M@BxBW(P$MsG&5iiSGL<pAX&oa|dfzke$Y%2SN_TZwuL>MM<3Z;If<c
z^u@Ld1Il4yc&2MCdG7w-1#TZhIeB572A7Z!U9Y?t0tzPI+yU$oEN3>KI^LLC-&aYU
z(`ybiPwgMt8m5@#XY#3H+Ms%5)&1KOa963j3`nfa<BwRB;~m@&e+~^5m6hFmI6s@a
zn(ksIC7py-^>lkWWILgxxR}r9H%|P6sQ0mPab*PsJy+(&SZ}2jl$Bi^DZw1Ho+f`g
z8fSr<jJrqYsrcE_cfM~*fra51{$ee2)PUw#wAd@mEY;M}!lyXo5m<fX<>=w2yn5cn
z4L8Jzo3e1j(<rRRZEaa_*WKxf5~GI10$3EHr)5<bYl>qs2CEjd;ntnxPcCLfbra5|
zXJ}q=Ok!^j|N7Cta%msbiXT2;7=4IdVTjBAC@k{Ygv#S=5(=iLBIl3PGCqBRFPx^k
zt+31h)V&TpzvVj=!QrnkD2#SRh7Vt#ex~?a&7j9Yp%VE<Ewi|^1QUR!h6ZlULpQR+
zgA-yx+@+Njb#={jF2fhDN~1f1<B-AvO_J_({Mhrvgm?m?l~a$GUUM@Ym~SzmpbNU%
z89j$vEiil2<8AcS>GMd&cAIDs*WAtv1O>8_Q-$4p)6n2PMe3%#jXYy4rBHofRS~pC
zU=o#i`t*z#mHu5(Q3{a!;Drw8zoQhbi)PY}yGDdR{(BN8h<Y3GxvKoBnub}$HTwso
zmKmF*++1$W$PbC9I|p&d#c?&~=OI{b${OqkHGBHaURM}(gi^Ez(7jQ~s-M#>f1v(S
z`D+8&liWAZ;)uS$iAzuaKKkQQ0aS0hc5_gzP1YujPA@<3_;5sJVQHBA>65N%%<0kO
z67a1ZgdApadJ20$8JvZV9EoaWV^Qn87s96rHEmwT6FsXJX#MDh29|~;*(LW`^QoDb
zP~0j~8ypIontsgnYfI>IY)%Hky&U;g37dQd^P{V~t62nSi;5y3(@0*<^5EjMOqB8U
zx-J>5aL*4G<}+iXMVTD>c=_YsBv;(W&Nk$SJ}h0$cRDL6$=GOES$XL=e{{EM>d$B7
z<ox*^@0@{LQ&mpMXMh4CV=jxZprB<KNt_%bF|1e=MuwJ#4D|GP#HZKn@??>iNvf(b
zTB<R7n;dF#a(7T^bFzwgjA|PyDy)E302+lM9Y1mWCdaKFHU*X<L$|kY-vTUALFwX6
zg0`C4(W2@2GC3{4+o(4;;L23Zd)`ntvze6F!45kpNJ`qQ6CR@8SqL{=$~+$zt}3wG
zNJ$GID)q?;UPYk@)JcG}#R$Vb2`5yRjf>66?H&!anCI2%9WVOume0iPkoWbo!?QNl
z@Ft`)#C`9j3^bS^j)%~hYNMdcUKQA|aEx;4*xpI)=m0ij!wU4m{Wdc4R`a0GN!NVm
zvVPoNKgL70x*DrT{y{+jvsURxnRD-3I=O`f1-8O{QM6)DpFT^2+Zx8>7B6e<`P1v{
z?<~yB!H=;ft75OXgm{{26b>f%$(7`3#A$$V0PrM46()bNuB!y~7cXd|D-@vA39>a)
zQ%`s9*tmFJZc>-4RZ|l&2ra=orJ0%=+gL8hZZYEGtnBL@xU;K);6FGvR)5pd-;S)(
zAP|i-+OCcdQ(R16@zDkLUTyRd2RG^aBmxy`99_McpQGFWBMNE^55w&KN7gCg=|ts8
z#HTOJH8G2<V>?i7TX{!Pp_~KQ|9kUWART>E>jYMXaCHbV?bxwNGcjH9B7N~4cK2P>
zm7vU_rosKG!M$xmK_w&nsi5E<r+_NN*VBq6!zD0Ya^J7jzF<81aXbHY<CW4m_N|Mu
zX5TUxKD46Ew|u5iv+1NY9IdQ+(q7eoMS|TYt+;rG$=x2pl-Q0aLExpV{Htg5Q1&(k
z@$HZ_Kfi;)$?CXWO5qT!Z}X*tXpPm?j69FecN(<TZ&Q4CUxt53NJv!kM8OFc`~%Pj
z1W-g3NL)2F6%^0^><=}KjioPf7_<m^IoSslrTF_h0tX8wA03?!6cnK;ph>o|@xpTz
zeI!iyNC-xrrYnQ=%3F+!wPlmr?hpLMpf-C3&IN<{m64XEyaiCukmJs8ZTTOLj|=+Q
z`imUU!13vy{aN=Q%_;)I`^vTI+vy<A4-5CcIhiFxezgX$rQr=53DO19eCMNj7vzvY
z33>Uvf&$cYlZ%A;^#pD<HY}Yl{)vfzD*2Q@Juuay41!zKGR_tkHh-~OdJ#E6IiSnA
z&zr(b4GFKGzkbauFK5a+*VN>Gz`_#a7A_N3u+b9V+ja+u3Dm&;OZQ)S{Yi+w8IG2B
zwQ~laY3w_YjlApcQZ%<ZH8V?qPzGWgKw@fH9#~CJ3P^u%oUOHdG%N-!kFl*+raxz9
zFdkBh$;f=qS3w0Vup&dgN=p0p@9z8ib}$4L^UJro+a*EF5q3lJ9cneX1$t^PA}3zY
zNHE3{_36AzOn<esN(ibAMRRMbqSM{!s7IO5=hXaStsWhd5fd4yNZ#XHSZ2O|Y>hUI
zii;8y5O6tMfd|db%j1U+A3*JEbMu32u_3qXF;$joslYZ*UO^@u9i0LYs*LcUl*7Ov
zx(uuj$el#;rUCvLzxG*>R54bAAb|QXF(Y}ULcX|`PHsQ8x#Iv{m0FIvdmROMTXfYR
zH6$P;3=a!~Ic#Wt!ez2Y6(?jBjzWr#4$A^x_D}a*nLhsv+b@A8%P6<z>&8Yi$wxvn
z-p@+3!NLko8!YlE?}b6TDx?LclA;TSEOxgzsF)}al|T;|qD_ZpW^9IiGtx?yX6}p(
zWn1f0`3maf2eb+CYkP8XDxe=4lJS<@$*%x=aD~sLYVkNf%@A24%XG?FA~gd8MV(=2
zW2%IvYdk=0)|l*%io~gL5WcG%oRTR}<G>#E*yUIzYF{iNsOZxtfb)Q)ukmvMF2R`U
zI5{!fugznsyG^yVwE#eJbtNRBc5KAqk$)o(mkY!LKrMiOr1j=`OiiOE5IuwZk?QJ`
z3Xb2wPdqO#5hh&CI=pkns|qTiM*&y~jB`?c{#t39=T|f$Kyw~$oty0XB<f}H%V2MF
zY3Ih$RzhWuHz&H)XUvXH2*i_E$xSiR*&`cV@Szi}j?o<Ejs1Ma!u$XLsh4b4D}>Ah
znIJC?>w~6d`@<55tRWzLABx4EsHG}qgIa@2IXS6)etrc?2?YgTw_Q+JLbHhmM*y<w
z-eSCk>I}J1BXM$Rc~!aE)2E#5q>$vItDy@_{>}9Tr=vf&aYFBPUA}u4iQ$cF`Q*uy
zPH9HEkm!1+<I7~{`_~IfS2w*`gM`&%SfJX2LvJ2qppcBG{bV&w0>eu*R#yFq&11$Z
zWDb&}tSnmnbib#&bJpX)gVRmYpz;?357F_#$$cD@Fnfzg--SP)@j=rkZg`zF81Giy
z{Eee+B*HK|E9)NaS4~BYVu<*al<Xawf=>fT7?(Dk=U!KB&+KuCh#ozD{BxYs!Nma-
zNZnC-DXrQH=qwBjgrKB^yA4*Oo}LF|?KX5g#c+xZycA$(FKkLvx3v6RTbonRopIfn
zr|^_rr9r(=gT2t-pFKHIrTCDlYA6`_$rDr2boRfrxsPUBQ6iuJwb1l*=1KEnBUj<f
z^}l)-{h>cLHhxF9{V5|oeQ{o1Y+70?7cDnCX;*uDJ3-$XY&D@EX=^+CzW)f3wvAR_
z&F4U#Adz5b-K9i%G_;bDJoxBud$f|R@&miD$w_KA+%r%aGdDM<eL!I=`Oc$j)vO&>
z8W<=Ty2&0dg}KNZu%Fq^>rI;xMwKum0e=O!7j>`%Z2hi>J!8}B<J9TIU_uI8Ju3Sf
z=u%MIX`7l7!oQaX<bWm)_o|VR2FD)uMPXhZS{>s0S5!<Vd38ydug+wjsuPs0b*9rA
z#_KB5>bJshHFY)hOszP&W`D3ee9iB*Nr36KF6=WyZ(laVU#AUzl`tKm=_h`M_x%ti
zu+zSz83>*4x=>%cb>y^Qo|8^a@qsl98(kmEZRwY%%<}T`!@d&G{eV=oxMUj;bDW@1
z-<v1%@CZXh#`s+6s9W(`<P%x>XWQZ(2(Gl`>I9b>D4s|#Iv2zxBO)T+zt;eorQ7b@
z??qFB^E;7I-Vs9tYkg@we-mBLFHTD{COl>c;EKl61sJ!S{+IP5Jn0i(EzY?CXl<yd
znnUV&p5x%aoDdM8w!S#oa@oSEyteLY_zu!LRAm+9z(oX71Ta1#`0qd36Qvwn9oTP}
zsQ~hzf`r!UvRQC2tG%u5uay<_zw8)6YM#f8+{fq^T%fSL*dSBJ{8&<&2NMjOm?6yP
zoPLvrcKNbHJ@76jDt1Jp)3MN7X)=xpMJ*XtCucr2zii;Q_z#}3z?pnprj(hf>wc_k
zgrpW!&BX7A#UvycvXMZ!_2<wS;)o!4Kjv$Ekr!PlECgyZGyfK3fgdMD>sU2k3$>OI
ztS<&iB4ftiq&^i>_<DO&z_tLsvIsz?279o9kAnSf^nQ9Oq?V+Vl<z*iY>rs7LqSpX
z8>)0ZCHkh(rXtoN<>}cG9ARe6y7O&e{Q%Lhh_@eI`|@O#1vo%U+#jT^MI-L5ya@{%
z8|7r#f-Q~I6R89J6<{0nE7RrO9RS91Nm-eeng->{s`o{|tBW+>HqYIJQ~hQqQ5tqE
zQfeC2g2fN_ra%ZMI`7E!;sP>z>zc6PYy~olKS}#EaQbqvF=X@EmU^bO1O($JQc~vq
zA2ED>hW*Mm`;oM^M&@wVQ@0ybRbA~jcaIHD^FW^p!z?mhn!^wOW|+W}iJpLbM|rX;
zSgHRpYzeX5%K-kD=VvsbWc0qF2I`|BU2NrivMO4>J0H3{oryq&gv88gQa;)C#F?XV
z7`T4lBPn^O>}QyG_aJ5<V+C}}@(SH=!k^wpx&ufIArF_(9sA1-r?(NE>-Q$-`kI6I
zD~ZC?JH|`&?-&)miu|1{U`pilOiZk0VvvuH(-tf{5U36YbNEn|Q`vSvf(JJWz#~oU
zc>4PLH|DO=hps{!>fK#j*h<nnoN1zTzk2-w%p!=hfm>ia6-$4g<pzq@gB>(t?uO&Z
za>WS={XZA9YxZ<S-4?0CK31EpoO{wl<oA=z&&*u@9_3WQ)_?M3C97X9u|MN67644)
zCYhNr?%G2bsHEhWxZJLb8@JQl?prr)Fd4FfxdBuQFTZ-h#lQ0R{thA8o)^2WRnL_$
ze-v;A^z_IBU1hv9{OIJU+3T2=<J7=PV1IdouFL4QtLqP_o__CmvNzRGl9~BZQPJif
zDNpe0tMfZ@j?}FAgTpiAT$V0yFUHHK5m$IX4=7!Pq2fh?;xLpE(brhXc6fK8%`x*h
zA;_VZiPs(w)|G22FPk01rL%#tRHjQL0-I-WBPf!x{T$_@XUKs|_j>zVYe>i*G~rWt
zcQHN+S^KOj3K0*Fj8efBxmX{6b+Th)@hS0r%nZ(FrRUFciWvF4*ljwa)4IO*3i<@F
zdf+lDC7BtU`og`GkU&NBd$_|IhAS~^3Y@kEdVAqEV{=nfl{OQ|>IMkz;bHUJ^o8l+
z;jB-e8ohhx{Mh|1sQiQLMn8N}h!bImk;?)7$BeWWY<{rDS`C>-qfx0u7+>?fI)~OU
z8VBK<bTGJpVk%Jhqi_cHjv807n=-bdJS;8}5^XB!u9$Krrpu^E0SyhOZFhPBt4xC7
z)icf-o6?TErKcDvPmNP(T{z@qCHTG5C`)ui>!)wo_}H-Y$)$fsrU{;$M%DBsQ8D+1
zf6UzA@UYXL^{<4zV_u%;mX;e~VJKyKH3;k{gFN&VVkTpeo;J3!Hv2AAic^%+1_tj2
z;uBQ&bUP0=)M>YXK_GAPXxct2Gt+129Y0G#$>=!mg4_4g1Y2CnT@i3g+s=N)-N@OW
zR<;o|V$>|oDz3I#sb5iO&-;<uat~QiP0gxfcppfJn6cJS);rjbfdZkOt!d~CSJYz!
z48hxLlIGQD^}a_ouGCsPZ{++B57Ci8M7Bk-uqcGU<RG*cR`}*TXTh(h2MtunKT_P3
zQUul@hysd@baApvol3tCQDLhhomBzBf~mspi$I4>qfyH9@H_|j)g7gKdOA8q85sn1
zKCk?4JgN|ui6jx}pe!+DMxxAnr#fanXJ2~*p9;Z;h7UR4<5Nk|uCBXH0HrAzDambY
z!9Smhb0l)#M4&{JAK&>*@%KPc-m|=(5%c~%W2}cVMKhrMG4HjXMda^_uAkY5UUt6M
zhdn$PS3<G&?(A8;dNrL%CwfiAZ$!XE{pgV-J)TyXZu%v^<5XnEeptNe3Ik20<fFcZ
z07)%PO|S`TioY~G?g`s3?~0`pdaNrD_%Upi>Dx@-8~NOiK(^@<8r(R7xK1{PCqMdR
zZ;qG`&LZyPGhVR16yRk)$c`8Z)8<^IxpP7_!|m8ZGUy6OPSA4A*4<T#C?ca}X3ovZ
zdUMIXLraWDWTbRY=jKWfWfnyQx+!%u5NC;2n)$3SyS4N_=!aH!dS_;~;Uz8wG-8ua
zJ$mq<n&+X~ukj-b*x#;u6@FqvF4WS{I61gSaeVZ2fJo-nI}rv@DGd&_GJvB2s_OUd
zO#!2cmHE+Kb59Rh0<;yuh~~Usud-tXS^cY^8#Sm2sWsB+U}pklRdHDnre3)a{3XcZ
zzvTqMucEF_bh5E=Y*SGZ)mc3W%F8?HP*{sOr(>IyGc+{Q6mj-K5f!~@)z7b+fKNzp
zqJiz7g9jYA#_e^b$$x<0R8B#~)lgdw)4|DQ$KJ+k^XPMZef?up$wzRKzEv#&N3N6_
zR%n~Pu1*Oy;56@BS<By^yy?}Y`p)=ka~p1-w>A?X<^y`Zf5C>B%cpGX@iITlmg?#;
z&NXEMf@ML0TDERSvR|M!taG?l!^0jZ;QU@6fp|Q!;&sh8T{%13*No&?_$|X<k_yUU
z%MFd*Yv*gM=`jdU%8W?-p;K$Y^Spls(z4$l8IzY5o*Sd!p3>x1S9f-vue~6{3pe5J
zTZLA!b)HicF@l2zicRK_g`k_QI0pB&04Mv*Xw%oPSfp!k>wM&Q50K9dpgPVNY2Mym
zN9(uxWL;QfDdaupyoEnpv*0=A=~-t`{Dd0kWwWQYrY6mRCF>}xI<0O)5bcv#mIV_G
z0YUxw;87&k(cQ;zNWi%3J#f8afGwq`H@n+3EkNQ@6H954{OZIOxjho>2*R&w@WYXa
ziFrQ6$-PjrJ%(mGuN@le<HzeA-T@13qaBY}SeBr)B{mKF*4?=V*XbzCV(oA!YMJ#X
zS6L4bEqsM4D;UIDl7|AssB8J60k}EaWKQPMqdBUn*sHRCWHe#+Qb7SdP1)Yg4uJ}?
z7dSjOpO?esngNc;IV>6pf5#U%yPTU>Fx*`wzxKDc!>+|l^(&OOXb!R)XISljR1!zS
zbbP7W>~cQ)idTFbL)nmJbhqW2U#$3J>GfxPWVUK{BlK3wM5kiZd(Q-so8`hY@(O=#
zajwo@Xt96R8#D0qw6xK6k(d7sF@^#8Z<{^03N!r=&Ruo7m($U8gMx$nMZ_Zt%gXN1
zz1~0AorQ|vFhsQ?+|Bg&Ke+T%@X>hJ<-^xm%{YU$Aq=hZZ=Fr2zsYUwc($+G1!V~m
zmC2k)j3n_;f<O@gN<Rp(IHr!}__!M=H|;!HT{n!EMf;Nq?MCbV#m(cUs<b2xN3d~&
z4Mjnr7u<g3M3iQhl9{T?A4L#S+u%bxowHpJLnhZlns7t-7~20+xps%T)=Enet?|p3
zm80Y(7;LZ4Hc7ADm*FJdLibEp?dW*R9Kj#xW=a_Y{`SP*RuEy5f&K|QiOb!<>!UL|
zO3LAjBzLhx0%Bq)_{79+7-}^22XzNjnmuHC#KP}fZA~BcU8(h{tUf<&`QN!ztLbik
zD>LO>qc?1u??D}YkcP-0&k9zWt8>z;Pk0;oUiuZUuc0|ruTazFmKwF=YRD3o9Y}j^
zY~!Xp_A471n0zm&>hkLItX7Xa!8sy)y%RHE`vO=W*f~3rR5n(2Y8Uy=ghY5mL`32z
z4upvWxv!N(YHxnleim;@58Gybg?GF^ca>67QW6zaD)KTLISK1UqswDu0K5o*v-yC^
zI934mi_2@ih^5{wI}PKp-Q?w^Zj#@4pyUny54xf)sFx465<zhU4mI^@sHdKFeZtUz
zv#I)CS5RQ-;wN~X9m(a~;}P?+vS4GaQFq}_H&~Vx5(do4bb^e90l?2=zk{}Ox$rBk
z@zNePC9qkV2DF6J%-ope)Xzza<je^3d~=r_HElL~OW<4`;P;Ux)Y3xdPk&&cZ_;=`
zUqmxT%f-n>uTJQ4>TQGpB6^@WoHB41%#{VZ1_s8@t+^7q-U`xxV~CBW!WRh&W|b6y
z>UTMhjk@&tIAM_lBoG&ePI`L%p%iiOnrkb48%jP+ayPyCHCpuZf~>5<GHW(&kA$o&
zJTL0}tSm2sJ=Xpom1|Le)xUkl=g?w6W_^L4*#ABu-l6dsbk&PXrM<loV^#^JPLN_`
zrNGGyyJ-_<QiJy?r?B}fdnwusKmsRKl`<-9Y-Z+-L?uP|o_WcwieTq?|1|K3t*cKc
z1*GeXX=~?Z9thUIYpEX|9g>*|X4a1znm@l}=<e{OkCl~TZEgbpri5B!Uj0~$za(uN
zul+pk+3#b{yk5wGhPfUF(RYWsil$^=R4=b9fmeh2L>4)@zT6y_42c;aA%#<-hUQOh
z?k_DIz9KJ07M}Z_Tz;-e6b<t-<N2xf{P_{^k%hnF$ON|}>|q`k$F0qdCZpOaQ2>&Q
z{gX8(L9!x3Hj05`UY_@t&u);v%;b>AMuK6Ny(r<sJ2CKqIco4UWRLcfX}AsZgUzW$
zRek+=((fhK2@%YE83}oiSApeaD&y@vThmDXsHF6=8EPTxmN}r8xC{_da;q#U9tQ2X
z-}tTHI=|M4Ri8d>ay&#kU&uG%i5SO$<1P4x;pKC2RYBqRc~i}7W@c&p#UtWbOCPzj
z$k!C+tRc3m!ckrp#ybuM^Wp1Byin4CZj)>VFNIzc^k1->J7eUOl}T21|FWHlvLQYJ
zwwg5NWd8}t2|+5?!_}g$R@=eaPM6Gmqk@w9`>gkV^+kar8q9@8=;G~T{jK(D2uH^l
zV<Arx;^W!xFad2+hV_w<=eY$`1OQHvKs453Wo36}Sc<NOG&Gy;=SQu|x3DyO!3&x!
zZ~%s2d@laP6ql$jt90=~OGjNxKcbmY7j=UL&iT$qgOl~=0`$K-MS1A4<1mv`Q<s13
zX6IYC+_OQ#hC+E<^`7{2X8}XY7Blr=BC5^J6E9=I&zc=zgcZA8k=OeyM(Z+jaM734
z%eVI;q>tXw1=nC2)q_%CI;QoHAWG>JVG+XK`nnk2uf^9g_wLoFe%#@D@k)nGt?2}S
zRb}L;%!7WvW2$SuWOFO7wS~D+ezZeeG^B%lj^z@TC37;2o*^%c=#+r$n6FM!1|!hC
zEcL<^3RF*pX`}e<^RFVWdpF~8p&O|2AYPFX(0lG+c5)pZkYxl7eqT|GKr2bU@hiRO
zri+fM8N!t8?0a8d%ZXIoER)<E%!K5JW}NBSY2Wri3v4xbaiaU|*)z>!&gUZKtl6qG
z=zzS(!(ZCjN$sM?d#ijuu3O~g^$@%L>Gp+X6a?QF*Va0`>{`r}eCS8J#1uqJExU)L
z_ckHHPW|cam(4zN^Aj5Cl4MdM_jdjbux2|@(b(a5YK54!VNNZtKO-;ig+iRCm@Hv-
z^_MRJsM6e;n5-(z(A|%@q9}II8F>GG8Op`nz}ijv7bk{`N$PDV;9EfHvo}>4+`aOh
z&_Ev%udA%E5U+UXkbK4cc#46ILQ6-dUEqe1QQEX{8ay9EayQo2zR6=JhZH(mI+YJ>
zn9ECdXBuF?bKaFX0$x;VN70WwA>y{SKSKYIlt(yR&oGoerYn2d{QT)bWe5N%KqNQ_
z$F2sqMu63a_F=)Ebp7$vt$WPOmdMCj&$Q?!5VHykLp~DcjtCA9t9zb#pz6`_1q3!7
z!rTPT!s@-5paii@lmI(FV~W)QJtOWuuwEf5@}Khaptkla$jZrcS_W1f{RGZ2FRrbc
zpC%qXo?HxV7*R@kdSZGyG5+E1;)*l!DFrqPiqXy)WV(Q*ee!TN#Cv<!?3$t6n|A$+
ztO=gwuYi^IhqjP=hK7a?ne}j3wy~`*o`zPD$19+_)TW6z_s#Ve)YT=Iq^B(f-<m+X
zeV=?QQu<%Sm}(*u^L1E(%mz|{gaBlSthZk%roXhr_@WC9)FThs*Pf#VOBnWG4p07^
zhN*v$N*f)eLPy~HvwO?fx6ZM~C@O5Asij}x5g%3k(oqh$ccyA;62_8<Np;^4x72sZ
z<G*BDw?U_l=kVWibONv6m*m104=@J7!9n7D9asqYS{WCI<na%5%6+k(%U8Y{c(yHX
zh;A5MqW4B!*4+)uCl0SxZ>)6kxsH0%>rsR%s?<l&9*UyC&&e#kBcNR_qoXEYc-J%{
zfZ*E-p&qe-&u>-meS(9;AZl&0Qs#T~$ANQKf*+q5`GSvVz~Os*>`E9<Xd#$MCb<~O
zfB$ElTM|nx2jMN<FSeysNU}f<%?X&NI!YWdo(?a0kmnlWO-NvJ_#Pq<1O-Si?jm}Z
zqnh?P!<68DF05)X;|7hnfD(i~f$99cF8g4KOq=I5n!um4nMKRni6);V@CYg&MwCIK
zJpUHz*F4_B$=9JGE`I&*Q81DLt-GBY9*vJJYMoT6|0fvf)-|u44|`6;{7OPeQQ5Cw
zzqFej2}j&0gJxzP0;n(VPwV;y1vfV)TJXCwYp#Q;qcVd{)Y?8iw1T2Cnz(MLTddzA
z=iq2o{F8J<1)jzhf@)H6<!2&b9s(mAaIpjYI6zNHS!>E!Im}U6FRY`d$MEoBVR3N)
z)?smWc4#F2!-vHl9<o>`{qVKU`cc4#Sya^iS(i!F@%z|V&1Y&#N*4jP76}RQ27PZa
zD6DSJU7k7nhUdHOom75T+1;CsX2C8i-Hnc71KNcu$G>P7KoOwM@KCZXNl3u*`kVu@
z)6`T6FX;#8Iun)<n!+{0IXt+5rSLxiGBQH8kzgjW)FeDE-gYsGApet)9T@SZ;@)C{
zt(~1&Pi3UEjt;R+Vy*WQ>iM4;{=f0{Ts(thO?)f{ia6M@U7J=&dR<?(63Y{dl9IKd
z(s;zoZ#a_R+IM*Si|9RgcA<9yagWsV`<%+%zj|z7yu(BGH;(&MRE8KXgFDZwv%E|&
z*l>S&g%Fhdek#u-_0)BBIcN?Lhe@D<0$fi}JB~QL5PCemYqzS8;E|`OBBfm2yR-Y>
zh%obZ_G^)pHSZG>b6;Nxxs-Q6$lcu}EFW-QPh)bEvm&)TL*e`N+?*>7GsGWPai^pA
z6LVZ1IG$I3{o2q)zpPCh4LqXJ72cYM^V1`Bv6TMW7^n47UPz)*ygg)MYBHJk(0~Q=
zH}Wm-(Ek@&hW>u{U$o4p6zTlT(_7ah0%&L)dJ!AU>II7gXm|ARqnb#nlgBsQnP#iK
z=}>xz>J27Swb6%1npb^#3rdWw3wnmvkEZG=^UR*KKP{-ZbFqeTj}P9+-bAc^h%N9-
z;A^_tUg~b{goMLXF1h`~>a@W59Pm&5KLDTS$gGehMBA1nmoDO_g}na<T2z_H1b446
z#G5hx6D1T}^DmT;qS3$jGkztQsK1po-Rrsezj|4C4SG9_R)7A2gfAyYH9b8IY!R?)
zwYgYHsFtUzv;+)J%Cd!i6we=uHBGuDwRVZ+W%GA=uc&aM#|tk>si-au0Y^ze!CN2P
z!Go84^(YQMLj{97N3+*X@N5YA5TF^&3O!u=*{MhJ@(+IDvWWReaQ!oqkHYB?u)P;0
z7nqQ476?RvrUwE)5aP%>34t|$hnlT<f$XF=fL;0flB;;&cX9Dd)$<K9LZX$xeWRGK
zi|!pX=RgA4zAy1F637fc^aEdh^-<0r0RSeQvL-B$&YVR+C|EFsxbS~)EK?S!fI=F4
z^@R`Z?D7oXf8TdI%~h9Rdb-73`(99PgU&sT`UahEyDiJK<3vxlcgL)2#-Ei(;N7vz
zMarQ^q9>a45Os1PcTY^CS)Mz+?mu0k;t)LS<K$cuTH_z!U*iwD)r=z*P&et2*Qha)
zCtdm+5c=rI6BB%@OcYN#_FAsPK`L{c!bRU*6C2y@_qEWz(c>&qj2a0!1c(%oKQ!Nu
zs`=8#L9_9z(=oz1m8`Jy+V0zn*^65Sn*~ML#KaAA6!ESaItp5l7MsDFT%F$R(U#Mh
zukxj&M88zGsb#W0vtXm&EUTm>LImZy_%gNxkT}7$NkMVhWKI$eswCl3USLP}u@xO1
zWo9mP$R6|V>gfuP2p_-Rk3M+M{*3D<_ma`LOi;88)z8thXXQnXWi};6MW$YH8DxhK
zgjXONY#o))K+{KlQ(;Wi*iD%zc=*@GZlK7z#a_V6U2`LwYKvcQ7T;xYTWeKBt(cjc
z`q)_=Ih;PRg1*dDz2_bT4#qgQwM!%a37x6;-s!8uFUAhgreAk?Auj$gJ{QxA6V2P3
z&YsoRCHL^;ypHiHcomY)!UEjqbwteXpVm$sKT8m;xmaGLwY0JrAN4k}I+2e4(89mm
z^UL&Fq3cKQ#^$DkFD@9bjCcG}Z}AX%USG2R-j>uB>XnJc2QVEx_u>Bjj6&mV4H+i2
zhl_Mq_YXA<4IUnjCsDFt3P{Lr-=E=f<f$^rbq_p}em*_LSM{ZaeWw-k%zR_C#w=Jo
zgY)>;MN9AU8em)KLUd?k9zL>#g-%_~cXwEh9xo7~Jw_DFU0o)h8-;ixp1xCi$tLGq
z<v!VPfwFdIA?8{#f8=Fu{)-nA@48Kv4VL@Pwiat>CxvjOo^*r5avkgL^ZV$4wL@Zg
z9!pov(>zfR`0Ttgasr$;V@N72owsRYN!YD~-tm9V%zT_V&B5~EfxEf#>%QfJfU3QX
zjRNnv=Y*JfPjg2|>EGuEg<A8La&TX{2<%8|cgGhI@7o9SQu{FHr3a4WzK4WY;^ufM
z+LB0}Z*G$JRov76jHV0{&Ud%2==|!w`5Nu3Z1+rk#2nk*{v%byZnp`$4%tOk)@j$f
z&5V{<vT<9<&`;7bk=7QU5SwnLeptZe;4?8d1s!-c1?uC+??M~K*YY}3cTu&IG_jSa
zK4AA%{Gd+{j5o+CY1+9Ce3h5CYDkkkSm~?rezZ~es;5Wcf;8?9SutHh4Wcy04TC02
zp!j{q<5DAp7DY{$mKv?E`0A31`6I(G*;9;sn-_NHSjcGP<OYBn^zA?$w`g%`r>rn5
zD%Fpac0sXBMBvup2<K$W%h|<_-h9Qox@u~h-##BwD<GOtobf^`qLJ3OEsHHkt-Za>
zWRAe8=r7YH2B7P^^dWxCNWN<XqFGtXaJ%7mDv3uyOo7ge39uAU@VB+Mvq%%k=y%km
zN8R5HNC>|#*4p0Q0OfQ`b)QvmCJ=D(@UT4a!OrhF37zNG;i2OcZl-2^=u#CBU?gv)
zCL_}TGVkmr^okt=z1e(lf_r)Wv3tRKu<$f1E8ty9(fu^>`7>h<2~ZS5j8-c7teJ8;
zI>%3@2M^wcCq38KKRx=+CzKb%OS%Ck7;%3?sA5}|y)!jg4nSxxEM%#Z6Q#QR9e+6V
zRN+~PF7oeHK0dybWUT40&U8uW+8VkOb90mgI8#&SxlK)aPo6-I%uOP1*AL7DTvzOz
zn7Z1qRWmxV1ad4?<Rqqt4{8$~dO^!CX3*Fzn-~|5j!vPjr|!BsqrVW;S7V=KGgHeB
zy-RMG#vYQSwg2Q~-thGFoP=+ZxO9H+K|_W1m2rN850ki^e<)G{PIPs3DPX1!@Izzh
z3_c-Wrb{hSa!8Rh#?+s`z(H3~^48YW<2Rhqc=>X!qQZW+A$fxhz@P7b(wj)M&X2QB
zPx23>;6Gxa(|LAnxUL#_t2riTd2QW0l)cXTVrqte$gzlLuGTYNJ{Jp@5)YUCqjdJ{
zd8`YD3aK#zgtj$P4~*Y0uZ(*)N^#1|NwK=Q7<=-7)VHlwCEaR>6=(`1q#yXE8i0!}
zE5)!PCh<0ZfYO|Bc=Y&qEX_Kz6<3F6$Ma<Ssp+T;B4W1KP0Y6o_vW={V?VXOx^P2a
z$<v{Wp=_Vd*dpsf=&3w->vpv6A3UT`V>frW+%5SSFA=;kP<3$ned_rYP%lfJ%9hsF
zJKNh*`J=tBFYf-~^?36QS`=DkQ?=F?t?=M)6wq>WOxh%5czJnecjf|aQ9ok9Z!p@4
z%g2t7*U;5#f^u-I&@*TVy16>0i}JqE)orY=f0L53yhQ<9KnxBO8gLiz3pO}o)j4@2
z-{1)dGN0nvpPeDu&Ni<7%0_xj+daVg>GS88s{0pXNOiMI>`-2B0@zMkKN~x{@y_z!
zD#GTntmyp0FgAm531Um*(5(O&^B^+bQZLUx#m}o(Tib(*w`+hj=<~I;@Im4FW2wcf
zhJNK;$n%4g&bGQvQVzbOO`S?L9UX;SwUUQ6u(*l5X4=&`@k^<>c5^%l3x9dC|I|oa
zyc85%aoN^#a<~)7sA8Eef4q=mo^;oFPKMm=eB8eaE8Om!ah%0o=Z_+Ie8piV0(nzH
zMb?Yyzy4UT&eYh>ovu3?xhlm2#2`L*r|5`ajPTZ-z2AL`p-LavgjodR5);QqJ0xFh
znh!#!CNGZxfR^ABk?Up!Z|&Q+KL)LBz+SbwM1h0fwB4Hh>g=peI)t%3R43DYrgP+t
zqhG5*QgTvJku@mfAyi0QyfxM^8@w%?_4rr`2}JV>wS)vDj0_BECl8*8i+6W)zg0Fr
z;tUr>$a{KqR3NP-Ge6u0t&RHPMuO-*_59?xN>~Nozb9bl=Sd~SX(kvMXkAi+oU794
z`KhbxIEWR)rE$4SA(wl8dfclVRoa_SEaJE+tD}=rU2P}zX95`;Uv1>8eahsd9KX}H
zn9I+_(IOuDxn>q>YA_uP{P^Jv;xwrR&?UnqD0@!id*0`G`?ffX!j|DGkxq4qjM<;X
zAtd##4Ds9{EUL-gO-Z{cJZyor|Cp|Yun-Z<Sz3FBmXJYZbw4tFb$$JO{oo4Fgt+Y`
zeLrMW1*Y7#FB!Z;-(_)3N$$=$JrHF+<2PTKH#6n(u}c!MjRNV`Q%Cqz(MRTFKs*Ng
zYCu9zi6*Qpn>i<h+?CP+@1FX|yLq!FaSTS~`S33^B5s$&>Nf0cQ&T;={j+4bxgEuc
z#6(REHwzzAiq>{1LY<xFdwN+Q(G?KmVG(ix_-v9$sT-p*$Ob-MjARo<I#B<vxaYvm
zj>@KvTp4vq78dow%E;#Bc_x_ibfDnE?{hk*#O6r&&y4R!^158tuS{^OC{?IyUqnOJ
zLe_oYh?^vVEQSOj4<|KEohu0!S_O+a%jR~aFTbQ)DagM8HA?`Z49H35efOR1E><xG
zSC$FQ2GS4~MU$>vgq{*tDGJ?w10+6}-0K=Vl~V3Obd&%UmG5&4KJWto=;EN+5QU|g
z<ss}@jh2W2z1~04PTbc5?TP8n*7zjq2;_WKDbm>>XxrK#^|QqXy<iB>0W|9JRhdB6
z{#C@E8YMnH&2xSKrHc_=zXS<}^!8>4ELF~KPL-9eNDcFlItZ&94ITs<QPa~C+#|<r
zFnUB{3<H{^!Xj8c7f@HObE&}*M$i1j=B@)9jI$DH60vcK!XxyeeH`}JLMz_!ALjk?
z)q_@&y|wl637UiRan^_>(CJcYI<sHhNp1ZZC!byNqSD09<R~Y6q*XDlaI;6#G2&nz
z;eKc5s_(<+L6-%&1?Vrk0O=s+WAWf^HSNj3hB}<sxG7C!Y;A4jYJJzbhP>CmYd5;I
zwuvT$M3XDf#{M%&+3g6H7ioQ<pJ{IY(Y~`sTwyeMZ{IXR0Zr>WtK|JRZR(xRwJY7u
zjw~yinh+!cWM}~AhK+`4_UYhTclPn|ajQR_xX%&PSivuNb=>YwRcL-|t~_y#^}^U>
zt?@}ci^@k~6C9Gb`^w08FJ64O5pYDBy!rX_8~L&*8Y-5ILWWwyb7GOBZz+*Sghkin
z!d8pxVW<WR5dG=7cfGUz>zm%Inny{*i1Ie3rcW;GDX1$s*(ekeSW`t@Pku7T8tgiQ
znjau1Wf1ZDwKoYRGKS@2?M|~loy;jOH}{=8LH!@t)5WM^sp;zO{=mbHcL||It~=)|
zEq<zl3BV6eZT9fmT-LTg)o*rVWDtcUYmdvI5uS!rdoI6)A<|#Y>c$#J+m6QhP^|KQ
zq5WK={I#hf#RFb_*s{SC2w|HNi)pvViH51Xj!U%9&c7T&>efhJ-y8UR=b|#S1}&->
zdb8G~9<M)^xDDGwSa>c@_QX`Ow=!I|C+aLW7Bw>>O-&j_oNR8^7<snXlXLv9%&{q_
z0`D{M=A?s8_ObT04D4P3d*q*{f`?}hfeO*bea&ThT!XxD4Uv^bi;muhM&mUJdB@^I
zEt&4oBWvRw1LGZ4&11*4(jQxkzGn2F%E}_Ng?xK*l6^$P;R~8R(7lcPa5ECu3NtRF
z&s7g7efpDl62Tt2anyL3s+2NLt9^E|JAaUS98u;@9VSWG*gH?wjM4Pe$+v~8@Gl6Z
zg3s-2nEUKboyUnF1=HPctQ|{h2KDdX;SE#Mf(oC|YnUru{z(7?1XGO{>#;-TL(;mb
z!J>}Ui{GWf%|{Xt3Nbi(?0Wula_DIUY%jk@uk>nlQY-iZlm%A#W3nX>p<rDOr_L1T
z_GS+$GgB(D1!FKOia_x3EJS<_PK!B~dRd$gzFu%7!C@;w!cR+k9~`j?5s_eayB+S{
z2=qS7-g|ku4ZnZCQB-!4ShVdc-ySbZgDlTC;V<uz;Pe=<RXERm6n3W-utIfe12b9V
z+rCvPX`oRC2VX2iFE(|{`tGx}PWR4F_xi3BK9Q|JPyLE-E!k)CMo>WDv96H!regH<
zN&jpLU@$<h`*ZZmJ+iIDvM^FY5hB#yMO0je3@s`Ozq5^G8v}d$R+APM7M8JMJ%5eY
zeFDFujV&yY7|jX`3bUh|ed0ov@mny|4bVtGiG6G2M;}5Yk*#46YNJ~I`d{ZsJOux8
z@3p-C{{Hfqr=Yom<4idAZmNJcx$tu5_wNHwmL>2$8k~$ANa-b+EE?Xl>H$b;v;)5n
z-`?I{zuA&-TEhV65~t%EKPKUWf=@@zyo7dma*~ooP1zJ_QAlqiBa5>FhC?gVsuf&s
z{iUIXU@$*?ux-giq8=6#Qx1D8Fmi{EYC?Yx4NZP@n@1b^j$mMg!#_~B^e1;_1XLXy
zW2?SYK}ZZ+%{>EjN?}jWGZ)t*S^C`?ZPGx|s;H2N2q=b*&J8`&)*c$+zr4J(D%{*d
zpFe)DNC9Fu+QJ79f}aGF3k)ZjMiSD-e#*=|KDJ(Krs>Pi$$9vYUibN*Qv2*ODcYxc
zdU49x-b^eMF`98Uu{en_iCPaI_zYBIuCA?(Q&~*_5G_u7ZFO~Qi1dZF_FRpN#tkJn
z`q_3K@bcCqBs?Z2CbsrsMDWj`E@NV0nV*#F{?WU;cDndF`*u!^06H2P2nT$&e>v~X
zJEuzLpIEJ<bEp~+E%+q-<&!+Q6MxN$ONd7RpgYiZm|3Z4J=DoADG{`jND2yiU-;&M
z`DvisRA>b@Y^%--NRTioUop|pFh62Y2OzMgTVqspDMYwSN(xU)2g%YuU@pW7!@yGF
z>7vkAQ~Smv9X<KRaM*T?3)*87FR_Xb@~1ZEt9r?iv*l?4>QeRh+pDxUvlt)r1ympB
zRwuYwTW?*oQQE>YpC^tHVTC-A(1iwLMn&Pcjs;dNPO57RXG>^~+tbPZ>Q41zob$2Q
z4sIla4%K)zzZPi$lMemFn(Ar{k3SbWCF4I!iwmXfnf;|TpEMmfOR6+GE$AHJ;FxS0
z{yI&Y;Q7`<Kukn*R9*Jj?FW&ZTmfk%V+OWS2nt`|O*SH*uU9osxmL}syO3-5(Y8&g
z-*wr2<VFB%-8>0l|E71r810NAO<naKuyZf6`SCrn9ybNc(gVp1gOpZn|8cbIDVwbQ
z*^Z(1Uo=GqDbwk?FOdrNJb&y{Ad3IFn9B8ik$Cgux|!I3{^5lR3j)n0@*8j;-cUS8
zzL6mzpASz@_uW{mEiP6x`IS~2IkTG<s-K&0Glh3^v5WreR`C*0Fw*CfzTE;^26fDB
zDgAki)hd3_rkk$hLP*q~{L#Ny2YB)`EzYE`_`wpEc6J~53=2PhhHJ#m%iG;L7vE~2
zTkEk}Ge-=MajlQoUh&WG-`r-!wqIHc`B{|%?c%l{U#Y#9OotEKD6887|32ihXeafB
z^0b=`(*rMiV_U#YAUV}RWL@daB+oxT#!xi61y3G`rmKi_=8O5TCFV8~(S4NV^gCnX
zD9g>5|GajpQr{Q1|5t3sJVJ;m&EJ>tAFuwO|Cp%y|LZ#b>mB{ak4QBPo)i7I-~0Pl
zcL_-n{?c9k+e5^N-}yiFVY8BIF+$VhH8e!L3s)Qhs<`rd|CjfV)Q03PTDC@B_0Jo_
zA0FlybdtEfK|p6Sx#i!1ig0G`@A?mEW{VH$_Z~7M`@cXq|K-~JAAAA+w|!g`B!H6o
zP*`6#i2_G3-xtJiOBhDKe}ClH8#IRfn<`L|XlZrzI{z;=D8^T?xxL^I^3cermez<E
z6|``mz5!C<16{1?sFzKpzGw^#rgV~VzAw-*2Ia56Tam(p_3qgUed}6;6FMc24N{=E
ztg?^e$z^y#g4tzaoNP{pUu=8GTd-6WmX`LtzF39C62R~MVdzUI%Z84Zh(xa2qnGzO
zT&BW)J%b8Ym~M_<L(O}w*9PaB&!iu7nY_PNrE^3LZ)*zxyvM9UZLo;A<`Zw%nY)hc
zsIY|EwHHEF;}5qKr{^LDKmXa6E#o2NtJeYK6nb#%mzPJ2Q+o+MRv6{wO|NH?<Y2SC
zQKmki&lgO-yt+D9ZihUQ{N%|V=mAH082~e3l$8hq>p!l&DIY$xh=Wnxw>jpA&Jy6F
z`E<dM#|_T{C0BvB32AYjzZR2w3ZoU*x_Vh)(<LJ-`v(qT(UkX3#3k{<xj1Yh1JmMy
zf_|n%R-qF^&zUG&1-w20;3J|dhFk(sUps({2)O@pk(8v+u>^Jd<hxOmiir*d^Wm2a
z&b50VG*f<~I{_RnTwk*<3v_Na#XEYbvv9oBnSOD2==@lZU+d{pkp+qUPXcb+^!Rkn
z^5);CYwV-0T*JOF-n|<%HO&vJ0Wo27^Q%3G_Ed>UcSykL>*>1Pr^6>$_v+PIB_;6c
zCZO1LO@=8Fg;feir7hlXJX}0SGEp5UMWzairFzXy+hu`>uGzOg`xHGZWnq5A@3|>U
zRT_L*(`qkp7mdB*&vlawfQ+(?&9M6^XuR9|$A-oQ4Yr~%(?v$FvCh0LMsCavw|p0A
zT3EmJ_lIvRTn7q*J>mepby9m_A?p^KFoTdcnxZ-Ch)hQ|DkTkKKxjjBN)hqaL15?!
zuwe}Z2!&}_^Y>+bzOx=@ZSpvCS$Mz0Dn-lw*sUED)kCZ!vp?>0d1(Bx;F+VtPqO{~
z4OJaJdN}*+rFdO6zIJH2sXxCpZRbRl#IrJu+|$!fPTk~V*b=|({Ai01HZ1<P4Z)@x
zfDizCVAOE;=NFCOMM1o3uX1&<wk}j3e%Jp|a7c#+(P;m6QqvQ~z-Z)t2`@qwF&rG6
zByQu6jg7+%?sZ_pH5V3FP&aq^<{^o=wE1Dve1P)h*#%yj@)EVGloXecO=M<fI2<+p
z2W@X1m31Gkd!hn@AdLYC0s_({U5XNtDka?@-CZIeBHbw=CEeXfcXxMp=egap_daLV
zoHc9KtQpq(hqzwhdA`r@TlalkpX=lPW!O+;cEj(PmOFcGTha;78Y5;omF3^4S+t(q
z%VpRh5s<HTid>!FsnH+REK$Et%Ef9Twgm60xv2?6;i9P@@7)s|Z8ck_4BiuGVkKl?
zr0ShVG{rG!IpU&?Y|Y9v1db>qgfR(teH+Mq<_(sJtV{t)3O?{F#N$52#~}*fr=oi$
zs3M`&Te}UYK1p%$#ynzNF|iJig{_gpC8axxKfR{rc)iHG@$GksSR5{^3zgE*jr9$0
zFJbuM%zSx(zswB)*!h=)5-lxLo#ObN530}jOihWG5<NXras!A-7}NVdf?&#j({>G$
zt*gr!EPguLCUq{Gu0ZHJ;)2{op0a08GW8R)lBuYvhwmRlRQqV|I18oLU4JQYDF;(y
zol28V=wsL&aTV#)M{&6jE6Q$xI5;7ezpBE~WV%=xlA&_ygOjj9wNuIM2nle9IVHu#
z%lLTvSwGXiC@PQBE8_9UN(->j18JdSq(!qcjSr5(_h=Du0ZIp)5dwm!YB6co+uHh(
z5sS$cJ}n)KBQ7hl<TR=H;r@O=7`Oo4Lx`F7?mfX^_5HAaljkXKnTC*pi1hpS6$+8)
z{2@4>;8*kVR$qt7D4b@T$k2O#FT&&?z}f^?W7eNO-@B;id0>LC(j6pLCcM8SI=f-x
zww73|;C%I2<;t~h2W6cQ2Pfp>Lip;cF3b3+RPy$=vtxOGu~l;WaGCEsp*(kZaCE3|
z<1purJvUmMDqdVXj$XpuLB+<!WG%yQP=_a_r^v}l1|Q`NZM`*(<F|wab$ES(DuwB|
z^)j7pZDb-Biemd<d82#zGAjHS*`;r&sd`RTO&V9LkE!HYc3@)4pWmsegZjr84(D@U
zZ*7k6jKFM}TV5U<ei{=R%l2A~nRQO=q#|No1hnsmEvkSCAQ2O1VNu`QSj$r(hVxG#
ze`|X`n{Bg_1?qmfGzs*v{7^{BoYx7+g2!n8O`ZLtN6ZiTiJ82PXyOt2`bVaV4)b&T
zJxU`=LqcdaQRO2_K~2cQ^2#ARUTpmfiGb-wgk%*WqT?3!zvZ}G^3DxuSip&XFUk8K
z;`zwFj)eE?$%_(PY*Cb57mdf)1R{Q*V=H1;t(nLpyT1+!4WG?-73m`BBwLkgv8wp-
z<4=0}ER-jPjUql7ykau5hN*IL!oW%O(K1wYL2Ka@$8>wTmsb@}vm;EAU+oTTHObb+
z1tz<IZU6-?tAHUT(~lQ82D`cBut!1j@M|2%sxH=L=r{42U4N&gG20$B)kzUmI3E*n
zf(u$jJ)zzSwM<MPEU_2Fe^&Y;kr5FuX<0|jKY&?^|6<EQ{ku;Tc=;d?yO*(TcyM@k
zyM#5pH<fkGjm{4dcmD-N>d7`gyTO9rnGJ3Izu`e!xsE=eIdAE%TU0RHi2V-rE4Drk
zZikJw=FZjEfB#t&DvFYU>IDW56vS`ezel8d??Umr)L0pl!NStoH$Z7?ecf((!-3KO
znsM{wttZ<K%ndTd!u~{)ePc`lhQiRjV#27fx^&O)>j$VO@oUm3i6^%?hF2B##8LTa
z=~;EI+oi$eA|$-U_u~?CQa9J<FHcLv;V6%Q>;g3ecu5e0%zuM=5EWjK!0Q;-ro#;$
zZyRlSUZ)%T`rYH*l$2uo2|tT_w1*su0&TaH&ecy`j^9A2R1=++z!j?d6&3KCl0Id)
zR7H5)`rN0ch7I<oms`*J<g|tDqrLK%QSmtO{77j<p6kg_jSUQP*KO_bH`ZUg!AQUR
zoV17c`DntYpSV^<*xTFNyEBiU|H~aXvOczuiq<#e`Ajk|Af2Z+Du6UOcUkwaIHWEw
zg47ey`|#j^Uj6AkJ*>n1eYhbSH<nXFW~4hVbPV(*Vy|~pZ$fn45LgLui1-Z}t!c%T
zb%Ke~g6=S%**p5)8=z{&8_2T1`}*@|9he#<0<L}m(M7J?>?62<iAhd=G&=02RQ)P5
zDJlN-^Uq438C9zd51O9xmGHoa3QAn?F218=WK=93facNwptdK&_}i|gT~2N#T@^md
z3kr%Ui=Xb)#6G8l`X~5f7}U7=j9Q#wkJ*YVn@bD{Da<NLuZ+=?Ib2-|d)!XV7=+CZ
zF%zaZ>peAui8r_?p71dDMDdHfd4uXgj*b0MAmKG1-*sAAZ-zlTL_!F?XlrZ3_G!Af
zkS0318W^}sC;G)4aT537z-m^fS`azo%PS>$+qAOCy8OMMkr75fPfaLQ!V?7OdSJ(c
zuQk2*W_b7*e^ogoJoxYw6I6^KU!~t~c$TK_aaRx;JV8-lW-oW#*3#Ff+MEj73)Tj=
zYO?l<>E~9Jc8JG-qS05nTRa@R7=AVuSgXrZ^3$18<Kx|ZLkVHY7aAyn-V)iYppuea
zlX;e^Q|WWx<ju{^0AhjHl)j{+5DrShU%3lO^hz-<BoBdzO-;*)lnc)Lvx^d|-P&zn
z675-^a=Dx^YJAR9sR^>bU7bXhxq=jx&#B!Bj|V4498ad&*(?YZTU{R>J)EAdK0il-
zd_q4{8}r7BFYb?Xb8~?Pfv+KqiYU159Rh*3Tthnkcd+lO)uwyrLEjD81MuYlT#z&8
zdYPI=`8W5<<qowFoF|~!`0Lqpz^%>M=BU(NcdR**f${fu%zzaRu<bf2;=(7I%d5Ed
zE2BaTeBoHU;lV}m_NEQ*n*LY-!i2-@diqe|LLUwqdxsC%`#5Om920`tC>IR0j7{Or
znV2a1@#D#yrl4j&kNLmD?eW87aNxg704|=hve71hhMU_K-0vh&XD}Y3Sz65exW}g`
z02`_Wvkxfu&g_w%JdNI&tiuiKjknhG1?&^No8P}JZ6xJB4HS)<sk!Sl&vLwE-Lw&I
zF<O#fi6+8hVqp~EVe^*>z;4rMoL3GEi25Kee^HxX-`y-DEnQbxxd92yiK_Vpr5qd(
zQHAyWAt5Oc$5__KFB=o4wSBQi*hg#y1>b@{1m^>?vvrf_&!2@qe_Bdol7N+OnO3{r
z0x%9{i~<xC;e`hSP{jWoY2;4kcswDbOvnRXc;NVZHYuMYIedu*+%A}wUk5xN0EWSi
zfGBie&wlM<9-x8HVEpqWIBDw`o!w4n{NwLRza#6P?w))-D=Hyzb$xj?X=g@egsLbB
zn(p1Peq1Q}sn@-K`$D619VR6^`-#p+OT}?-&nBLlU$wyKU6|j|{h~27F>-ORTm-Xh
zO&!~;w6^vJ4kKTh<9<!S!OV1~a%E>lSC2cpCi(hgd$X<RYr50P0<(|r(%RbZls|C^
z2~Lo$)Z~Di&z1>fr;}2tyH|IC1_E=4k%4+^o0H=HEiPsV4h~7j1sfW=wEmqzp@v0j
z%@gW9PVp#yn*XSp60F5gK$-?IJJ<*ao~CW{vy?6@mdPhlp~8>skurs!hlJz+{GL1R
zqd{}#xZ14w-_ANCBaTKh{&vwviBXpy`$kGDE7z4*Ib~%T=;`Xu)LQuqCM7Nt5=JX2
zPEfbeK6+GF=kAzg+&{|E(bN8p#~(V1Q&Usx>(p(*W@@3*iSF+2KU&P!c*g2{WCk%k
zt(!VRFhR<;hNGvrLJw&V4JKxucU5Hc`W`eCz*)L-6IJRnC}Cj{>}Xi=d7d(um(N8~
z@;mE)u;x9RCM9<77vw_oki%5f$i(E0>s=G0_XY*&Re_)Yn8*r)|Ks;>NR!x2a=akv
z5Hp>v_^5CyZlmF%di@chC>C8UCc!KbI(*{d;%crZ0Edh|(m#Iahb~D#K-kw{hY^f;
zMBcYv?AJBw<5LzbL7Nt0Y{KYDp@{Y!R?cLPSSYtiN*;rarvELaipq=oPU+C@gF>d+
zte!KgA15*^bUUGo6_kwuRcR=DGW3|Xp~Be}s++KK3&vk>%s#$%_14+tZg4)`e{Bk9
zmnlT`|FJ84^^U!~`RfTcnXfBf@qMx7!S|jnWp;;I@veJNNX!w4Zy)QQ-t)E{{9^p+
zY1ETg<|pV!I@v?Tc!Wmxg^(!b=;r<I9f?u)@bjdUUFGIymq&5Bzt-p=Qc^s}&L%+C
zR1_DF_4+6dsBL(|uN;a2U=b>#mOYvO;PYQdBVtP33)*IQtzLUYwAMHHjG#&@2TGN4
z!y?y7-{Haso%I3>@z)x%O2TP8WQw$4?$69rQ@M)IV20vRl(u6wIWd^t{1XUYUuFWp
zDbMT$9j|9(q=NeFAEyNb1%=1C3Oa^{wZ;}i0(Gx-b(_lzLg8{^Byf$x3#St)DF+Nn
z@-If~VXiOFk1|dmjzq!|4==1yP?+Myj3(g<cn)_0d=$jR#NNLbt6_9*EtOx?gtHl-
zSfCwfZFi{WB=|+NJTzIkxs^rnDVMl7p%Lw*4WYby0(5C{Q4sq&!?7Z<@F^f5gzCkN
zu=-3{F{1=JHgQPkrEfFv$x;Tsfa-6q7lb%MLUq|v!`lFjh>T?Rv9vmd){9aV|A~>E
zg<#$g!Z}4tK)h)BAPs*6qo3N!(%OWw9M@y|f1I3|6~ei1{O;b~3bJ7;0Y4ehe_$~e
z+F!*;iv8>W>+;+0KR)~AgC<I~nvP(pkeQizbzwnEDdFbACZ;6(7l=&FU&5vR@W7IX
z$897J;wob%4Egx(9mx@ip~QEzDN6H}z1B8c1z)D)(%23E=#N=X(0yE#Ou`ODNI)nn
zJ9PKj19VV{(oZ;S#q7t{%yg?ZlHvLlXjlJ#w9O=*V}*swd3ZEJXzI|&46>9wU~X}l
z=Lf>gt~r>Q3xekMT3V3jCN*b%u)-EVXvBk$&n6<G|J0x&FkDw-^*#o7(ZVY3E0>9_
zlYkRYcpQ5ZR94vMDpoDXIf`j(*Z3AyB_%O)(`_znJ;foqu^p~+T=;v77gtx3XZPAv
z?PO})?L)>Z0)In8mad5o*PSbagjirw;FVN9EQyQz_Vw!r*EbksR<dWD%7j&c;rI^@
z#GneYw6y%MnTY*aMI|Mjqu68Mqs(E=!{cMrD1I9Z_j)KiB`3KD=h@Xm&oy}d0laKo
zT{&D_)_X3=9hna(gzyy}V=}$`(FS!C!N$TL#UM*3e~SxTTu6zB3=v~2^^IEwwB$(c
zi7F5k!o3k-J!nUmGsU_lG~%^*#KbdW`1_PCE7sgOfK++)qH&hdet3fd`XAY8kQuOd
zu=mwiK(yM!Dpu+R&aF!MRL=+q$#RpE|2B<HwfEbo4WVC!{?o~gG?_fY$IdzX3@3&4
zFT0lO9Tm7#b&s`+IkM8TAd7T=&0?YS*=%V1<mX9h8XAyCfk<lfpRAC2a*`W{`9RL@
z>>ls0KQG6}+jG*=#3UpdhjgL}g4fApdj{kEXcWV;^URv2xAE6D36lsdc+F1)n4#G3
z<KvTFC$%^~KRncznVYdd#HNi_+jIB3@3&T&#x0pSiwGtcS>71vMZM}{%K{D4>(}Nd
z*+^_`!_j7SCH=ugkH#jsTj*j&2bYnNg+r;jA<!4uYouvxtCs@p3HtZ%m8B}Dp9JV7
zw|nx`#Rc$+B0i;zfkpHchuaESa98*DDsCq_MPjclCuS2dov&`9P%#HG-&|s_X)f`{
z{@}!(T=gnRH8o~#J@!vt06Ab|D-Ix<^d2!E%g2To0MRj+`i|Q%^l&S$H+t{@#RWV~
zzC})r*F4YZe2bq+1eyZ~C`cnp^m(q&<e!WrB$~osIe#aP3p74F4U8tkLdjAvS<6_~
z`X)h{=QEj|mN|1);U4MTI?%{n&!}_W5tX?iW`0*o6{eAd<oEM)<mMLoH^OgSYVJMo
zomt0Z1J_*$RwN`Kz=%(E4l0O#034M;RE3v!Z0~Q1k8AzZX`{o^NK94ja6>QX96i`G
zcgw!|lf^nT)ARn*r=LY;2m^FW%ev(53O)a}nxOLX96A#|KIh0hzc-YsS~TOK+s%0|
zWE#x#?E+%z{$yok!KVx2mcP?HuBvpR^Bt|NBqU`YMfAUHrxOr_b8D4{Lt5~_G8&gY
zB~UA^RwT8#$tWm}m&Iu}<Om_mM@J`(Tm)DlQ0N1^$R65LERVqSvL8j#6Vjw-i>N3t
z@9cKRJLc1VlWENfuX%uyq`KO9!%#^>5FvDX!cJoq(5wBc9!=EU-Lu`#<JnWoSoWQf
zL`lw6HOE_eA3{a<PdtC+qRAAW<x8>yK9Tf_^*vCrz@iIXR4N=F^1m&9gskn2jocK=
z6w1-sBGOx1DZH+hBv<Vq?R%-G3tMs5!a2BGpsR_U-0~e+#J=2V7WAviPeURu^&q_Z
z_J>kebF)zTpyi?Eh?(E!aH%!|ID@r}F+L#~7#NyORU;GCnXhjFLm4i+5y8RR!*R~8
zt~YB);$Zh$9L)m{7T`me`#XUU81##_yj&D&C?M+U_VKf{HV6M%;-G=zxEY6ukN$vw
z;mz-p6AY%-_<tIH?q9Wr%iJdPs!aCBOXJC4`8{Ue4Gd25DGI&J7!={M78FJ=yV9PI
zYy5o|z;GYQTm8@p7k3Gr7f0kiB*4iDeV8?h-KI1qlN-oh1_n2qOY@*Ub4o>~q*qre
zepMp+0td&4m6?5&GWgxQsG?08+APuc9Y21CfF?*u_UHy~WozmX1Dqxia}K_KI88oZ
z@&vh)+18p5sAz4s$7d!c$VeIf_2V?>NnJjar~ht_fF3b06flWd>WW<-MDrOn1d);z
z=}99mzMN6J31(e|x*T+|DxJc)E2@M!etW&LiPh^TF|%pI3SN1%(sJAxsTWL2wnh#+
z4l(EE_@uJmgWE`{@L#x3DTE&>KdU1uSA+`7VA?yfI>_Y$P(TeM-B_W`KbDz*fSbfo
zp$~4FfPGZo#Km&MUne*ugCDRS83zTCQCa}mqv4g?qh5ced5voTJg8Cf`3FR!5fSuo
zv-&^|I%Mb^z}-wFVEg_$xdMYPd`x;1T?HUs0Q)mKI*Qzf4`BE}SpB!Gyc&XMY`2@|
z`xV2U^Ck$Vpjd+O=o|2MZz{}%M9t4&yJJ-0j*SZ`HtX$=<+!bNJ&bfs`(D{n9R06G
z@9F8OkfTCE^u%?2fJ<kqVQA<I&Kzy^wJ|X*#neTE10i->GXpTbG&J01J&jKXSApab
z79RP{3btD6XU`U?{EZC^0AqW&+9DCpxwt*)hp9^;A>H&s(vR+@^;<JM{GbX#*)iLz
z+CP10TWrT=vvL-mwVEND`ThGyVY5Y%UYApNe8*6)tc+YFR;1$|(|lXOH8hT)qQjm$
z$!}x1^leSi-qdqE?eY={wu3xX6124Pjg7S&r3%-ZxF}H2G@aAItXf*0f67COC+i8Z
zTRdZ2>gDz^f=NscMNn(hOu|kU@pn@{!zfsS{{8YYNsAOp>W7!m$XDjr4tT=0gKsDg
zXOHO)IbW99S~zs4N%<TdqZU8WL~7(C^4r+t027*n%|=t|)zwt|cP6g-@!O_%N@6k4
z(9hyInp)3-bE*cN{$-D(=;ur`CYwilRWHAM=A-E1M<UiotqbgU6UvYBlqi6RM?=e)
z-AwApug&MLx8m1=`$xs^C}Cr0ZJ`%_tR#*W3lDf~X*TK}S~NSG<>81;eHXvOMUV-#
zjm`d8jh!-xImm*)nCL!!R>Enya%DrfQ191>aEqmb;x9qDJLTHeFoV>k_u-Q)WoYwv
z6wEi=Y<iS`p;A1Xi0o2#to*S1;J^(7i$R%)ih;6LZ~Flg%hDz;lNI-6BI_nO0_e)G
zzNuIX5%U?|y(!_>(%DbzP1rA10T{96iZhoYS0a6|D6sxO_Qv8m74|SzzDP*{qKub2
z<r$%L>@tF=)1Q9x;Vn}+T)WDh*JGe|5gM9cHd#=RwV9Qg+C3mt0IK3On?8xWEP)3a
zwxJ-Axbahy|D=RRSe8<B7>oalhll1BCxjwV+<Ie3)ZRg<&B`!%Zl%Obj=CoDdL>k-
zCk~VNj?DWW40<Vw=qMHky@o2@{K4nJqEqFjRaw3~=8Jq&)yGHZ5jmex<Y_>itbC=v
z^`Rz7!yZQf`QkeqU%qfiSffO<*$)g1K-O6={AbG>DA#7ja+ZD6Fn20~vT84w_r=h3
zD;_W)Qt}3W%us$G&PmHpdI^hucv;W*r@TCfdYXb@ggy0^h4fzI?!-YB<W%Yo$QaRH
z25V}UzkdM=^>lBu4|8p1WiMRn0OrF(DfJYoau6Mvocdhxbc#W;^zO6@pTEBZ9OzOi
z&a0pVP#78(#%;TR^+axMD<zK8!5X>^Fy#@coG)ZUV<O^WWARIvEP-I*re39!Xogqk
z$jV`t=h1)Vd}UFv3C;?r@<R?I2kRkQd=?yU`))nG+(vY0#d%nwowxFKJ0OG+JY-3B
zM&S`55bdBAUyFPp3@nLwPTe8sq5=6$q1E*DuJ+vWdU{r}-O?EUh)@03#?#%I+HU(J
zPK(B+y(pnW78W(9atD!~xIlHe{BPPbQ(j=!i~QJ)3^@iWh~!+LDU0WI$^QL&YPk8{
z)e8y=Ng$rk`Sx}|QO(MEDn_>?A#=4SptQ8G^^mgvWgG2pIo*k;TPxjl6faU9HPhV>
zOw2PY*0?EC!+jiF@#oU<eoJ%it#$($&f`&asz9ck1Lz_#kdVyYsNeU+0`XC;>-JQI
z5!z?d!M?Hl!0G5XIixv8B`_u>ktW09D*0YF{^bw}DfBAf?nkS@_}pr8cdF*&9>eTn
zYup!2(s?sUAsJjHDRFV!FU9p(aQLo&9C4<!8OctXq>htd^^!D7V`Dr^nRASXmNrA}
z`m(XkBs2SoqH|P*5KKp%(*cN`c&?~kOU0<ndmHFg)L?xN9DdQ~IT5lEJO~Kd`0wAn
zkrfAKo$zz40kzauY%aF>xBLtsXMt)jfTlm&(X>`$zy55G5^7O@h$l+}pbW_$$t{Zd
zl-0b~pdbu(b$$Exx_z*<O^3z)56|?zuAPGPUKSLfVlpp0L{9g=AU#Ed4WO{_(+jR%
z;3NU&lQTQ@ZXBl#UN)Mkk&(;65&z@Ik=0kd_#IH@O{{uVI|ITzlhK)+dVUaq!+3bT
zNk6|pOw`?(D8jd91^2P-_6)c`d3nd^5H&+iDl#l?8-8uFH_6G#9WC;`F`r+bSBCBR
zU-`<Nfq~&)qD6#>k>cu2H6vXVoBjY0_g?oE)z;?zIRkP75%Z+AwB2lRvCfO_*9}!y
zP$~k4251u6xZou6MW#K>!dEZ}bb|o_wtK4};ir@)e8|f|X;zxGxjAk{1)Tw)`H)3g
zSy-6NR$#}eD=O|&E|$b?F_x^%FaEO&)JCflJVfUpdtlC<$=7ghv3HgbCAfxu@h`|z
z+;?$=j*yk#9tZ@GEu5t_+Id^~lrD|(%V!?6GgUmq(w#^D(IeUj|F=@lJXjZ~vL&jt
zxh6d@Yi2pozJ+JnbfQvTMTLx$$$BcP9pp0lJw&U|+2?Pbr3q$@bxNLq?dGeO9Xc|o
zUW!Blcj3zNz{c%Io_ZZ@`b$-y%an|Ig`=o>vKoSfb{lsnzV)}SyfQ8GK}m<qyLYnh
z-#?8e{qs8;7^T00?C(eCxNV-;Bnr5KkyS=0V%wpeRoT2$W!6~_E!OjLwnUfdNv}HZ
zc&*i92FWIGRJM^rv$wX}v#^km(!ye4&uT{J`(%z#(r<5PEPtN@gZ=zVY{)@jS}Af4
z@8IS}`rW8$9WbP#qPE|=Z+B0j2nN~x?d;9&;&x!%-zCDYb55s3C%XoSoFX`tBn^)o
z5ch^qPj~+XC;lpC4sX(SVh-2&y=nB=5)G31;2miYEhy6tj`u&~zKTa#kQBaXL#dl-
z(Lq8&BG(rl9+FSsJ+^ueDmtu-3Iuxf+ON+j&4DohzJT4=^=5lq)&ow%hUNiOM?awi
z17~MHLY{FgPqrVIu*wKn{~_geY%#3r>x$tD43yRwogrRbDm0O~pvGnSaMeOz2d3^9
zG&Jn4TT5_l&&^ZSVS$4p?M-b%_aEv_0IWUwn*&Mj0130PKB^SSwf`)1eu*p%y6L0w
z<k&JdDU-pGei+ca4_T&9(UBcjqrv^MMlIVaO|)}$VRQ6nA4>Sr349QC@qwEf%0J-8
zf{-Xc$QQq|x%vF${qmDONU<0%yNnbHNS7k1F<+-UtBZ(W_h=Ax`}Ol`V*EWd<1N5w
zreC5zJ?QR2MMdq2<0IsB_}2$`lOz$t)IBkQu{A41=_~n!gMw$3o*Ri67plo`zGv2d
zota?!r(^Gp<8jY^HkWO9`g^FIWuVZFL9w3edwA?=XKe)d8iB+0jx4xA0|gBg4Gr^6
z#Fm_#!pe&7_Uz?oRR7`|PGSL|#^F8=eSPB$MR(&Vt)<@BvfGG=2-FAYgv^a;xw-OS
zGp>7{SFsLhiMXM0%67Rm?GmFO248WI6i}Kjj+ksF@Lm%4L6v$3Qtu%Q5o$7}+<&qR
zz<(pOVhBvxxGCe205W~KJDk1|fYr$yJBAoZXp3nMrwa%k9UWDbeIL5F{^rgLoR3OM
zu#x`Bsmbv;$ccW8hxHEA``{4G_LQ~m`d#`UXtb}KyJDHZ;%|Es!{_}LRnz6A-g3dw
z)-ZjeNPxi?<JXjA*G_%I&wzl&GOL$}`KY>+^%avaNpM62GY4T3OrxYERLaJ~gT1?i
zXL}#Pn^^AWXKZ2u@ss}f`4AR-df`m2FH*KXsFxi0uC;50=^SY<wZzM2ubS#tbl*T<
z+NTWM)>{?y=5EQm*q@n-<JE&!HFhnpnl!N_k_Ojnx__dbPn+M2NQht67P~(ERx*U3
z^ZIUaak2F&f?L2dGU|7CfM!UMO0gFG47eXqh<(N8wsR|<WDR-bZl;EGc`pYwIB2?P
zaxyD%6g^PSUH10(X=$@mt}n?ho)@a#QHEy=u)VTja>H;Tl^bGKFeNiL9RzcGcvzV7
zWNo4{2~z}wGI*mqg6@})Z(wR>hM%Po^PF}5M)kf^q>EDkMLI8_n8YN-g$p|i9E;!x
zN4x1?r;dV&$%yjp6$eL2Ss8g9v<H}MFpLacD{1Si-U_<M`5Q``yAtu<P^AU^GcNf$
z?Z8$EhN#8L?FM&E(CfESBR-t$x$F8EsV}t3YdpQ)I>K=|*|IN1K@iy!ijYYr8j22q
zXh=VQ&LmWs8_J&9Gce>L^%rs4g?&b&A56iLh^h{T!Z3I>pfC0`dcCBCEpI@E(k~$`
zIVVy*C>Da{F}P*rT(U3Zz_M;IlDE=4&`7Xki|F=ElQ@lY>+<ycxi_8En4FI0Rpg>s
zg|&^hrA06ct6Tr0^{c{?T(BwDr;$3nOCDvl`B+tnf0n^p;w!dr!G%+QRC$qspvR#o
zB2wlQnyOydU2IpJ^}FS3wDY~Y?izaRaA>KnT)AvrC3?T+ipY>A($>*|zK7O7+%GLD
z-YAO`xZNxp;sZ?<$v7q(7!flT^*T58uTpe-z?iqtrpi+-T8176a2-K26^xh4iH(gt
zoo^Z&mU1+(4A`!bnHdIpif(I`v5mBvntSP3amaOM*BFRb$O&($Y7}yiz3m0f*0)l!
zm5N^Qn+`%00_giFLffIA0DUURLpCx#tL4DV+P?cdBjRLhQcXprP2N@7M9fV`5IJb}
zNd(+!I_2rCt&T%N!}YP&6cwXkbnm#5+6YjJ2BP~vdCLC%9U16`&(HQ3b9hEYz8AhH
z+*;V;H!;)^+vv=h<VXxe+d~_uY{(mc*j<r8g1p?c@yUETf8l%4E;|%c;ID$JOj|?4
z@_h0;jL4y37pMq7a!DatZq1jA7d%%So}8$)c5=__zqczLKLx=9F+f%Q!qVW^^Q&ra
zCmqxNWGlEJIOBWeqmZm0MZh-Qfa?H+YxIibNNA!h*xj6k3X%mQA|XyrOn!ZANfKU|
zSX0ACPCh-}?jQSZVXKU}z-m-aO^tu4H!V##4HtTvLBY`=eL=qH#Uz>GaXgd2_GP1H
zg#2Sh@%Ii6JB{ntP65L2{O;?4|J`h7YYiZRM+5ehh=_<mHJu34kK!D%I3(mO9?^rs
zMUHlq&BauukoUoM@53Kh`9bf5gyfWz9#I6rX)(b&(z{Oz!N1ZI>^fmL8hNGC0wLEN
zY%Y4w81eBbMz1TmkiBslFFr_UZ1~(h3OHea&>E0AU6x6PZ!;);OVku5dDknnKpA}V
zLrKeM5pt}R_V=|73_hBelqCO^Zao5adBdA|m>5)2#1^)en~>yXw8LbEDC!j6b%ZS-
z@4B`9R&&GeI|x>Q6GCkz+EC@Jqq~;e>H~ToNEka|r~TV7<Fl=z(I$WtZ#F%N$6Zt7
zIm~bO_&D$RGT#B!ChE7Xw4Q=+<fn*;RVH{ne6qT_OE-RsxjCuIa;oEf9}=R^({f7i
z(O2f(tzt1=1&0M`m5BfPB`{qo9?1ytRao?QTr5pZM~)O1Tm64+ec2_zd6k*7-3jON
zZ#M$U-uXpEp`tGyprLw1M82udyvuhRU?4l*cy3{Skr3yV9}*iYC!?H`nc07zl<z<8
z$o5n8uOwU^@b=)il7trl`U4%0!%S7kjJD}1w|~dqzhDTJ>$f^O;i)lw5T$8zUa4I*
zd+%4)Vk8ew1y~IqvXV3iP_U3M9tTXvjv;3P@&UM<y>aKde}Rmx2{koQUV^hj*$Ku=
z?_y1S9LjuJ77@om%YyxVtT818L%SBcHw|i@KK)EJxvn%{$0b)*aT5pECG>J&VN7x#
z6rODn)?0f?vnncx>1ru*noaF2cG7;rLfzg3Qo4iLWns^M6Xp>%HiV6gmDmxAs!or;
zkA{2BhdEIvWf40&66jk+*<V7gGbaxZ97c?wJ{J+<qgoS2t$McF>mNhV)$dmL@*LXT
zX{r;PD8N%`*mbMBm)@{C^}co1@CZ+OjS${P(W>O($-!eByp4^Ei-l!Y7Z;BmVMOi2
z6QskN;vySfXKND2?_@D*C8nIZg2)lG_z}x1E6`(sv|S-LQMXwQ8h>PAa`?Dg{C|bS
zL{!^catCP$`O)<dM1TY=TEK38GMj^tJx9;7IVMKH3QhrHV#i_IvTxrS{m4fV<(=gK
zUF*XmXjo(g^M0SUdRbUs+ZC6$4bSL=-eXBCG{WW7RJVY4aPY7V{B%>;jW<7vBnC}X
z5QPL1T~Ii#Z7uC=E!FC7a%<oLjX-HqDLUlSshFIR5f5CJp<m)##B*_`F47C_CZV2R
zeni3H;Ua-TkYa9U`{^}jc5!jrOplMjC<Jnm-Oq8nTjNDR3)lHq-1qo0-Uum53JN};
zMh39AmKKf~iyG;*Gxsm~&qqBFrQMY=G%#=n?P;$1HAOZTl(E3{6F~g<A4G6!pero+
ztHdK*EDd70#Y7t5(NWRXIS#h~AS#vi5et0)Ar@)kvr6Y>XK5?7*Vw}(hCdjDF5W(@
zZ=*Upw2}!;OJjHZlnHvN?Ch(m)AKJMp<qZE<+xDSyw;C<^GilIxHSwqUhJ&fr4a(;
z{R|B8;IM;~p(^WhI{Qhmny%%K0$~A+sBlUJm92>$_Z4_&OVJEr-v7zS*)izhbY-#;
z9-JBgb2?YbhU?YRP1t)@W0S3l^76{nyQk&NtU7xD54e$pJ-tBBFE}_tsP|v&uBO-z
zN^<(Y?0h8320?EUC-M4HKI^UJ>vpaAWYQSYYCR^E@m}fmf74hfOMqX4yr(?+@k7wM
z8qtJx;(OthO;x9{Z232!5qL?rkOIlQ-4QvPl?uz^LL&4aiag#?Ra^JQDV>4O1wCBY
z$Z)4K;H88Hfn4c-o*u9a44y)u($zPj9@TeUk2@=hzRn8G&r#2>|96*V4(|Y@bSb=g
zM=3y0$f4V&l#H_gO6{y8kM*PAowdxyGR%GQy@?vvm)Kn&0pRHmRVUDjr5U_LV3o0=
z3BRB`jC^tY_82|nQ#`pFXz12<-hD~pcou#x=YI3mAkA^u@{UQgGcRK4h@7x+1Sp0B
zo>+d}-rOjH`_Ix!M6Zg9%Km0Vk$g}*7-)c4@XoFqZaicBcgNau3JQo5LTXBDvc(Ev
z*(w18-05BH>1A;R`g5!0G1R2Fbm-TE7!-K3-vR^O8qcWV#t|+@;xvJW@epJZ8*;ID
z_~CHxM0%t43bN>+0S<!Ewdp^_B{tFDS-F5Wxpz6cTW_$(Ri`6C8ny4q|Am2+At^KS
zqsk|HkUlKUt^KfA#wX#7JT#CY10i$oFM;vFvX!Z{BS}h~`g2u>AAe*wz}ZN5ZiT-t
zLMHp>%^QI_7|_*3jL>!+vf#4|NrI50iMBS+_dk3J#(#U!f^`N=Snb?HhYQOx|I{^)
zzYzsP(aB<qxA1qv;53!%G3Ali9jg1_?Ffnt<mi47Ec&^E*A)VQRa689D+sIu9ghcf
zboA?VKg~=TbILSkgMHo?J7VpZ992L99LEo4U3&dpwp)gw&XRcBzg`UGV1-<@*En5p
z;i}M5<Q+qQrlGwE4s1O9#c6g9M#k861~Bz&95-C6pT-{ml_Oi?zo{JlqoMkNkc)C=
z5gOc<o%ypeJXQ7m`;U2P9a=beoR*7~CSOEMteeWA@AjCnE?vyr)-upn)lB!?YF88%
zm9+1+s?$^&Z#Op#qvIc2Gr<*IrNZ%!gnxTyXGCZ?3G>v(s>?k=r&Ow*-xQ>z6%4Ml
zKJS#Cmi@5tbbIZov#Rs)<+J$dznLhom$$_<fFTc5V8lB!yaEv*_17w8KLI6ta4JVe
z24hq63xFwLp*FnHgy<yjJANtn&y}FsD>ON)I<9dz>$Wnx@at4{Ty8D{rk#39T2Q+V
zh!&O*^E28GR|A77-ClP3<^P{JBAZfGBi{e7K_cS+0TPio86OxB78B#9I9@gV4KnbT
zOz7u>{WD$?k2*WGi^yJ3FC&G%5^;*GsR}e#L%>)U0K=x7V`i!seYAuyhHy_@9gNE+
z#vLG5tgPrASxV(M;eU{mL;XbbT*TPKwZJBB(i+y<4?+661|Bn?-mA~HO?HxOt5|#$
zeIe{e5cq-*nA`VInep+%t61p-^ej={D78R@U9HV_6j&;)xjj55iV-mFucRfwEVlq<
z%w(J<Bct_>jyC)w%ll7yej&v%JkXa$l}@-D_}@ZCH$*^{u(|a|jzr+52gKLebJq(X
zZV6A`U$f>eT)1q-W=|bz=n)d#yHxpTiqk&b?JKzcaw{PAi@}Dl2>lzwHOR5+pyhw=
z(B)un-`plJDh;Y@8XAUoRE7xs1xH7(mPBpkA#c8@PCeh#^93iQadv8YAdZO4p{GSR
z4qB3ibMw%`4nRK9N**k#%(456*8(};z#uOwC#z1~+-|j!ksp6@beQB{FBHTv-_F&(
zunB(qdtAwCU4Vo*JE(pu8)Eh1j<dxPIoJkyr)u~)*jB7}o4#heNZW2sen9|E0l#&t
zp!G5@AtbmU0U+fA8c5TFemU{*Q0s#s{Hd%{<>R|P?|!Oc=OyP9nY1F8u7|jrpkknl
z1b{Lo>t$Bz?}JdS2Txym1furv8whx5wBTNR{qvHG!S>qILMDhD#QYJD*Z~+X62LUh
z01E;!I}GE}$hMJw&o2$yM@5qB9ujT4a~zb+oOU-uV2Dmmj^K9=drnTixw7$of$SI8
zsf(BBM+;3SC#MguzZh*so}Ad?<AWg0?PyskhPyK|7uwqlG>!s}L-tGdHj?;J?#e1E
z_KfrLA2g!E!mKB<@Q{!w9#etn!e@iz{p?Mx>o^Dnz}Z11^$Z9WgCisUC?uD2ns*&L
z#qYVit=$<SwLEw(Irf1xiFCT%Lv8TOs|Q||;BAK54}PcoY=u*(R61a5`~#x;`aaw)
zQKwToMFC#~uEOXK(4oRE<`hmxPW~A0iM*U@yX3{W5Ew=@%~s1zyGP*m8WHJcZf(u>
ziplkelbK@KY4%`fJy}8v6iZ@aKLZjtJwdX(>})+00#^lhbbbts9=)``P=NYj{Qc|u
zl}QeX6&uhMzV#+ht9Fhsu>PndMrqqT0UJIIZAN*e<Nn?rnSsZ~2LH61`RL$ZyFo{v
z`++z>!k$v$TSvc;8k)kz*JWc;MJksB#VDAGYF*Ys8q+ANafN$SIYBMw++27zs2_la
zf}*6TgvnYqR%pV<;<PZ~-w8&D!&PAr@hK=MSXhNR*LcA8^CnY_DdW!dU4Y0#%Qm@2
z+_J;BiRAqg)Bi1rg7hA`eZ5REA`%j~CAJx6+H-s2+e!cuk+Sv-i&Rxr-E6wz5dl$w
z?qEEaHRR-7UNJE}IKq5i?e;k3dV4E{h|Bglx8XkY-Enqj@j-;Sf3mu=!ewvILAJfS
z8M(a`x7zI!5gtrWd&^|~=gn7j(N70fNBsS9;wXB$O+&c7^k9K*`m+yG&a#~=!t{=B
zWiE{S5ed?LBi&BK{9<!tAy-%5z-WwwRJW@dI?4Bv#j0frN=$w0=%8|uZ-o-Mhzym;
z#W`}M>&tb6G~N||WGr58@~Lu*;m*JM&4p~3#FRR^b<6YfCx;K^<vt2|tK;s@+Spo_
zl~~xHTw(XH^#nB}Da^)%PfRG$gd6H=%BZQG%)hmmExZp+r83_l5$NrL?;P!c<?->u
zUqq^)b*qnHL3oh*7s9FN#Cp0rA)(RM!q&{>+VYe*R!)h-R1JQ<eu!|=2bwGm$MM;o
ze(n3VrUK<AhqbWSgWQ*n-Z-1i1bmwLxd<=qBlY#TjR!o}7007N)dkAAflmS+^0G8+
zZ1nAL0DiY1Cg!U7MZ?(G82K9|LKpk>Rr4T-I;KjlH5RUUnkl?KePYo}N{)?<-LW+j
z{DJDxz{JX|pfCzZH9)|E2$}q^a9K%-p0z$b9X-9?vEI6MOaD%H)g|Wt1|%W@g&<0x
zAOXm@#Xq_!k(FOwUQ|@nkA$b>=q>7iO#MAQ{X2oa-`4-vbDhS6^YkZA36gSB2?@&}
zj^qZy#bBBFi1w&Eo+mY2ca=zjrs`Do=x9$;QrtE6_`6tYA${tzuoFo_yO|0n4_{Fb
zn?VeA6=2GuwwZN)<iig7<Hs5V&}7KQxVr}zhR_t6wEQ<2<CD6&$O{~A3^wP3O))yq
z49e2r*I?3w3-h=x%w1J5gKfq>Jf7_NbIva3cM!~(L4DZ=%}#Sy9SK&XkQ&P`6={+_
zM~4q5@(m<E9kBl2v2~h*TLW&jQ~}+ktUNwl;gpPLSNfpqKUaCEWr5BX#vUIJPv%o7
zH}`~z$uod;u^TH*hlYU4`R7lxy5E)_mH{t57!>~%IVt3COrzgV^wXsAX-#UD#gTj*
zzOk^RY07;C<s=i6ZQwxys1G7_G(INA#0Y<NL-{4u>wNhg7(6Q*lFzY1WYn}=YuEmy
zLQgZ51WJs>Y;3MQ$W>0elu^qvpJmM%=fTv#=w5Fh8q7dN`}h$z$Y39sWHEc8|7d94
zqF>kzwM3Rd(c^W;XL|bRzj#TA+#4H4@PWfzd~aX@1Hu8&An6hc3L!Bu8bDuISr+XI
zoK-MjnN-!6TK+Gfp*nbN$mp_*1~QJcxV;KrkKCam1u2A?i9tbiW<fQ-v|(wo?C30K
z6A$(ogf3TaZO-8eoeEyjT^+tzH*-6QBbKFuBuC`uu_*x4$ha=DnjwoHf!=AYv(fLn
zZ(8#T3$?l@@Y|NkGcyB?MslOL9pvHPFb#ymh1RH-k+8ixwg{`{-du6UtVnbt`IWo>
z<>rzmO-bkQFfDj(u>N**xH|3a#j7>XeTMv;f~?1&5bPdr@9r7FHtx*INP_G~@3_Nt
znQagP+<wmIgfj)5M7jNX7xdm7ZIWB1iBV8dy^uu^uGg(E;O{u~o3~l3PE3`V7?GWu
zIy!!y+3*A%l_1`ouTPqOMbJIjsV?1%u(Uo~Wky(ej){(9V|8u72#b9~0wG6Ug8*sn
zpS9}?e+v*b-zRJa=nK6nv40Pqn!0+K&UxdyjK1_QIJ@xesR0)Yq>kX{TXY+^xTuV3
zK1`R0SzpCnTE&F~)B@Y<jz8zVd*ZNqLlVlHc_QYi2YkNXVyR>i)~`LGmt0(1%g<^4
zLbPzEzu)3;q@>REYU0@n)X@JgAc{nN@RLA0_%Yp;w!v9j0YtzRg<3MskJR3)iXx7-
zLT$+Qi*nSOX>9M8RFj(D3wG0%SM>Z}(Ia(}$&L`X>Q(JOHI)r7`98Aex6<mu!Ub5V
zWT<)t#ldF4N_}3D<=eVQb$SWR0mQ(be>$w>-}-@sJk67xK+?i0_W&x!P?F^#;C$pp
zW!u|3K(PAM+=TS{Ki20wbso%T<2)uE*?>`t%!|L=YzpRId!5{W6IgSJ?n_`Whfv$e
z@Jw^P#t!>k!MB%^NQ4h)+I-f=tB6m&|Lhp=RFvwqJSjSzq5b)Q9ns){sN8ET#IOT?
zoY^Slh!@4j)t9%#0;23Z(Or~-fI;Qrv4?$KE;7hYNa!5ur0k|jZ)-Mv#eV|ggB|Q8
z3t;JYEVj8!t0qXhP5a(5Z%)i#S?ADs5tG*CfgBbe%x=}gs4Xmcbc&WuGsh3&6unM)
z>^vb79@qS6|6h5533-7e`?j4x(W~Kg3gR)o(XIhYQm8f+Rjbtcy4gssa;;8(S$d<N
zuA|P---^R@q%%y6Cs^;$k1I*AYc&TAPdv09d3DD!nRc|zFIK3S3JEp)My+;6FjDF-
z<7RfZ)cTF*f3cMmuN``%omT16x)RMQxYG5&-^V|m+eOfWD9pd`;NU!owKWixn8hBE
z`7SpfxyjA9rzM#hMFw<C@*l^B!p4fJpU{f?*~qdpYoaezF)=Y6of2AeTs=BB+>5d4
zWY3=Dwz$FzK1A;G^>eg8@9;8JtEqH2j^S{F7yUL^VI5xgma#IHO%&LZ1?)`u9Iu`~
zZQLjkzmJ3w%j1N-zg~OIb9!CkdnOAlqHnZsBxJQ9#x?Ud%~5Vm+e|^H0z*m~<>@ZR
z2hdZeq}X>?E^llQu-SCV3qY=FT5sA9d=|Ia>fE#tabfw0&Se}lX1SVl`_vGb^TRpp
zcfTqUpWpWWQpO~imUgBItAcb763%k{)0t;mt|Xddp;`Rc8iNuTicHgWZi)J%#7(hk
z5PGCqWcrjDp_H2;(rB`)_QK=UMLc4XjQ#1(b|HS!Qpgv-U>%txUEKGdG&LKhf-*pf
z6wj{9pg1{Oe7@<C0OsuX2NYEf$1lFirl+PdV4(Rpb~(?FPfTFnV+HxgpGguS;UGqJ
z$j7bx^Cv$x(oP@qpX3?D@(k(~KVlSEkq4eX<&Pa9>tv_qYk9rVm(W*T@s}~Qc9^!S
zJNuERC-yFh*_8`@fyMEJE|`O^ov*=`4WcygDpfi4Vr-Ce7|zJqY;s|RKEn+s5xWw=
z72u0yNiEeZJjYMODDR-L9$Z)>Bp7jH!<Ugc?CSFS{kw64g!<)6C8f`h-M|~@DnFP^
zD(uWZJ2geaajGgGv9=xrTO55CJ;VhrE^Mk90bhFX!>FHcpvf4<GY1DGD^^I3iHlLY
zT-di~mo(|5rBSPOZaB*h{~nQ6nw#q?OwLG3Pfo5qIK)mxC9)(d(saoN@#}e^>ch4+
zZ4;m5K86PeON!@N#F+CZm>G<}qNn$|E`B$hk&!`2@Pvwj;)ii>(a`fqc@M<jd1i^v
z^RP&63)7-0z{bFj_o(m6mW71{G6^mA8I67-FXDf?wP$Z5B?$liol?72OveZZ2WL24
zpG-{*1VGgE^ggcp+3{u-10;X$472xGT3S-J=$RRozval8{iybl-L!G9#fPp>v-<0%
zgG)z8$HqEA3)N6r<Qp}qnX$1K>vF&Q-sxHCdn<kZjD&nFBPYkf@=8mQ7(1y(%2m}n
zSpBt!q^l^NIlu~!k{9Xev+?lotSo1Ix~?iza%<yBy_Mgii(~r~NGQmC1P?6$_Om97
z&NGd>Uolg^SsL}3;^d)C4wjEjZkKi7jgQW7(E23kvJq_qC^!>cgYL!s1YUo`A<_gt
zIXw3NIX?+rU`3qH+3hbQ>Mpk}<Ni^|@F`fYWK+HwtK45&PwqC}f_Jj8sGT*63NORG
z7F#_;y2#J|)>Yv6c%S6SP^7W9WyRFJODR|!!U|$p>fJune@#pzy*8@U_mXnQjy2Ad
zr+6IM$;Ql_^^(!;*Oi!#g~U=WnM|NdoIyxdJhp~0<)H&FJWzqnBpHM8@=zS8(Hg%{
zwE8C0V<SEr`Z`W<e6=t}jZ(w!g^O2&?u!fv%^i{*7Gl4sjq{DxwY8-@jxqk@q$2oD
zU(+-=B&N%<`(?0eHhKbc5c0Y-mf(^NjOgvs$9H{mP5ty}2nZ=|#<*)D^W!D0K!_~c
zKD!><e>=;=a4RHmfh1wu>AL#^VO8Cn>(14hYm-yZRs^3#W^HG`C%xM7`QfSqM0sfy
z6_uzLepwDPSo8$)2*E1}NP}z7JM`HR;twn{Y!((0N^N+1z4_FeL`ky!I1uM-FeskS
z`RcACTbt*!f66}DIr+>Y!Y!LWr_UV(gxB{93knF?oa2In-&=NMvFb~^?yeyqAk<?T
zuWYG%mh!rslzW#s9rLlWvR<5HjGaxM+{fI78CPoD-!V33eLRu6@N->2_TR56blMHz
zmhOMfF7WQfoy6co<wpnzuIQgaK2<nyos#bma~5Ozy1bbN5e{wb_tZTEgt-JpM#kN?
z{(HyKvAGxkY&zVTo}8(<U^g*TE)mvU3HYTvCP4tB_8K$v2?D|od^O5%Bm@i^UtX8T
zA=ENXc_7@Hmbc!yIe$@WhX^nFKfi92`~D5}e||leUyDHcuWt~rXstW%{`Yr3@GEs;
z5dQP4>A`g2fBhK&LCecj@qd0-AXrBC-`{=xob>O#{pZ)~?EmM#PC-#9bVb|c?cc2}
zx|nCLUai$){MU~`KoC4TzT$UDr$<0Q>F?`%*Mlm+pi<xW6`lrX_4507Zl=ux?_C{g
z;@tb6|K$Ipm-YX{D9qL=%ge}gCg~c1&tUgia2_6B%ovB6fvMhk4f)-@@RXFW5*yab
z6$~7l>fL9L5x%-{xxbF?U3J_23{RhcLXOyji(lu?wS})!F)aQZKE8u6M<SH{FfieM
zAmkn>5<L>Uf>p6dr(X;LQ!%`)Ho6MBl}CI@F-(-oc2_rh!{>4?O@zcYjFO~90^|B>
zVmZA3z84dVVsg+q&fDDBkdEiP-V1g)-I>i9wgAnIFa`+~W1cx!Mzcm4<Y$wTi;T>6
zYlXkJ6fkN_C2(1AT<OvGZlSr=)yrd;z<qkPD^|%nPX_7cRf>a^H*`>MZ8SJ4f_qnQ
zD|P();!#m8>dX`sWH<$>S5_ucV-@l?s$k#CRjVqNXU2Q`^C@BU(aDa!wl*zXd2k6`
z<`>3)+@H7MeDDx@X8bePCMK~QA3ywX#dZPLiPP!M2Rn1CZ5G!p#*mPZ<>lo&?)*YR
zUVps<z!#fAJOmCosW{$GE>+r2`U(85TwLRt;*UR-NfQY`bbC-`YWCKlpJM2^NIbKP
zj;`+I1@ga7BGD}Bf|85npuzp^CBNIv3p|X)Y0?+gH-%AStCu$ua@XX+qx1+@iQL>(
zCmZWk&da}n*tAddQ8BU5;BRU1(a~IncC*#HKZL6o41ARic`AoSwzl%xp3*XXUxT<K
zt7rIJe*IGQVmF<rW@l!OcX`fBoEK<!E1xqF6%(belfvhU<1p7Z^ZU18(zK(~>Gs-I
zX1Y;O&=b3zs|@9`Jhbh(rLq3$9N&^~NzIR%5?zOomz|!L_Q6g=#%N$*h?vv-N6oLd
zkZB)E6+C%6MTUn<95`AxEBz}@RZec0JedrGXe#!Irl6Er6Iaw@Z6ei4ACvK*7gP%G
z^Kf>js}8xjGMF(qIKO;mC3FfVak-G?Hj*;GN8C9y<b2fTvy=d42A}u)(($mQ@@X9&
zD~03v@p#j#rRJpz*f#!%iz_>N14+gpjXG}1(0-TYef?O`u)lFW{mxsEqAFGL7Qeac
z+45m^=SNJw!5(+9@pP4f0GfDKc9)+Mw%zIWtm5Qrf){_O`c7B#+xNy3F+Dq%ZFfhq
zObA8Ltg@=Br&jx=Pf5o9+Ec+U7(mSRMnvRxxpPgR)a17-C~IG7!Xb7xhU+qNqg$U;
zg~9Hm%j>TDLBm@oFKByoLA3evNxg1X7FN@lYRjduB=F;=6{VvUnXY0SHE}D+tIyUC
zHN{;Gc9#^TdJUhWrHl9xSnti%w(xT&v=VY@O;vOGg19G#E@yd3$IG^FU}$Hin}?F!
z@u-}XR-O_2>5sVVxbW1H#0Y6hzNxBQ)ng}_O+ERD5ktd`VLRBEj3>gl06kJ>I{QIk
zG>VN}r|XYT3AbnAYYOB2O!qq;5XntPpKWwJy^)<`d~y6tL)QRqwr{6%Gcw@Jkdu<q
z#Q&0=S`Yr1XZ9iM$xqVep`oEjM%C4U_Uq%Uls~P3P>@>bR$N*dE07mSO3z6x(i(S+
zlrlA&Ntp^P*Vofy)?X2flp-E-x$8y%fOAgmk(Boh$ypq%D3+Fm@Jj#Xc?*O@hLW&Z
zR>M0%T^=DXHXc`6JI%pwIf9mx5<zKcLY|v}0mwQO&Ya)F<bOK2g6j3x-cDBE)HEqM
zOTooS^4}!Edc{^EPp3TFkbzqvBq!J1F`%R*CTwi+lHok+VntF*D{d?R#U?p3Q%_r)
zihS_%sIVkbcU><GF)|WH*5T-;%z={fWK{G61t~+Lvp!}IkMGp9S%5f7&92TavzyHq
zqCKy!t5JPr+O?!95C~G%TF32>?Ch?i3@az6)6|{0u^ESzqoA}A_EYjkR+a%CP8+2H
z<C=g{1{;zVrBFCmW#SVW$BqlwKOuhncrwYOGjn+}!{h0>^UXpZzQ98in!J~ob#_@5
zs=jix?3ER^8FCV1hyx#hhM!HBlbVw9Lx7$>76biBwQ08=On83_P8vQ{RjoNGk3VYV
zZJq7Pib}L-h)oG#S*~@tdJEa8Tv|l22u5<BP_|Y0SbTg?%?1X3`uaZc2nh}@C@7GT
zk;~eCtaz|7@m5-)x5C5Mr@-K?S38bHhLNG+aPi;7dQB+17zSy}-J-hE*=z><L5)Su
z%kmXzn`)-Xq~S1CX?IHCsb@6r$^O6)shst1D(P?aYKG1iH9Tn>>kk$7k9z*$Q?1RV
z<IH7s53w3;<TWKDl{9V|Jna`HZr0`-I+~_Q;J>3JfDS#KRpX7z{bHld&o-JUe<ml(
zHuIg=xp|Z?;j|Np=SGCbY1~|BQ&>ng;O`P;!)d2+#HT)pixS2~)H6@+rmLs>W8VC&
zcfiihvdiAyO~?XSF#ZQ!d^y;dmN$fwya$elYE`|#^C85GBH*ww_S>s7bGNTjuFAFc
z9vQJGBPtru4OY!L-+mK5yEx+ubhSKuG^x*nCfEpSy$A+O8>{W9t~3W1vaZGbmcWOu
z$29HruQ}_UZ+KOm8f%j<lPct?;t^o1Pc<|fZcG93wE*)SFZIgiB3wiG^k;?uwSenU
z1$PBvJkFz@=}PoY{0z6c1jzTGx?$On8)mxCpHOG;H-PlbU%2B*><p&74~0c4K}3MO
z424g5(VP>?0z-pr<@V>s$8WE$4qrlY@lu!q6#s^{or$G|6qm2O1_{|wG2Qfhm|YxC
z)=adFD_s{i4j)V5DpLj|42=Kn9BW$|-ppI1d$Nmh@+DUp;fz#Ny#2GHQdZ_4msZZO
zurP^V{5L$p2(P=ky6HRN4s$Z?7*P#04TJRznY4lp6x{b8Kei7R=|gS7E2-$m1I^wY
z7vX>>qXo%4ij&1mWd~ami*TNvw7rr-Ka6Ijef83OY}hFB!Gi-Im#a%mFqB4fIxJnD
zIyB|ym1Mc?j&f*hn|1m;8ykxGhU{XXA`#2%{$$$BL>ITzUhekh&eG=BH|~F9#>ciN
zYL4gTuZb{3pzC{6O|jT2<$6K4F<n(gr`<>y^u0uH`;+CXT$jU$B7FuT-Y=i0g%kQO
ztybj^ZsE=aOTSElkw<1)<MPosF3?%YZt`+cS)E3{?WoOwfLG61AX%QmtFLF6{O#cY
zX$`mA#~1&jy040=df)!tTP#E=MG2)_LO?)CX#p1<($d|XOArMVY3Yz|kQNptARW@(
zNO!ZSJKg7h#yR)pKHM?x!ySW{J@y`JulRlEcg|1E=g%vL^2Z+W>_*9Md2L#0g_m1e
z)YlVb=RDzi55Y1V+}6?0uU}$*`HaMFzMcTa;?`Mxo!Y>d=cf-S<6t@>!GD_KiNbbn
zv@W`xCdBT+b^hFf-9tRkJ32Pj-D$)2y!kglZi9c}_bLbMM83xUlBLj8WWa4jAtBq7
zK1b`RYRp6)7O2y!ylH8*_oW_szi@3CI)~aq<kxOyzH)p(MtGOR((<6<ff-PyK6E`U
zr!4Nxd2P?1Z#{b`gDMXK%haXo_RD6{x3LX*jg=TApU0VV)3YaYqk;>9E>b1%1_Y>J
z@CtgQ$;_Pp{9%x6(#6l8KZgr+Xs7(;?`Q3=_l`F-<b3@)Bi32cZ!B~3{b+`xJ6%f<
zBO{~jj_p!+Qkseow3H5etA<ua6buX}%f0VDMZrqo$dDv2dU|s9PqhLVz73#jIoKl0
zQW#_&FGsjrGABew^){gvG+Bn>-qUwqf@`)zwHv(e16+8=9v5WeT#3(I(=txX5_lbQ
zvgmbA$L%OH;qm8nva(%SSR5^*D+>=5FvJg^d+@%iqr2PAenWGd@Yc?npq#8MtIO)K
zPSj0fB4T3VhuD6##R}v1NM^{Q!{h8%_t_5F?#X@}<uXr<h<Fjf@(??-v~;1ZpWeA*
zjD|I;W23K9gM$RD&|kiPkLFmCk(W3&H#J@Q{ks~CG_1(WTVLtVD$uIhbE)3lwbLOJ
z{7EYXYY(75g_5zb_}f1|^#!@y=K3tb&WyH{RPir~Ar&qyzUqsK0|~5C72%#F*fChC
zxruTf-QVH<#l5;XsHijjgqisOT&X*lMeF@^yu54Mz2^o=On!|4fo>zCjndFNu16YH
z^WN;Tus}I%(o#{m11cL^_0zOqoGhre)>}HW`~Kp6*uMn72W6ZH7nhTzdKs_N+|23G
zRsb_3#{)A2xfKXmq{yWf`eE43lfri>jdGL8g8bC@_y$PDexLYtgxeWpGed)evIs=2
z$8TYe25H;$8)t7!SiZddTd1wAaBfbY7v&E3qk%yhKw)%r+<q?B!^wsu*na&v%Ah+N
z1a__YC$ht4tlSp1P)0^s<Kx*LHKdme{H3TEuBfQUhjJS3=OE8arPwQgss-;hMZgkj
zYD!9;+y3znY?<!vN1Cu$7)H=XcTatYjl{*r%GRbygL@Zze~p-!c`7|k&xc6_ZesVN
zt)?dNyBgs9yMFz)7kYgswe=?Z)n=azIBqgBkFH7iEG!H^U`Zr6nWMgQ?b^=*t!j%n
zPF5zyYWpRl<C^gSSvW9mPFs-v4dX5fI$cF77!kzO)J_Ig=Cyd-%Pe|V^><o0jAcTW
zgySLLWY`6t@4*9SPyTn&(aR7z5k^4m6Ht^5*q@u*b>MTHx28PqoxIKa+|k}jyi9_P
zNgNt|Pbb%S;ege3P)S*bZkUDW{nHBbA4@wxBTFW3fximMW@c`#?B@JrM+Nv@dTIp&
z1R?$Sa-uBVGVYKcbu^`MKw3~8UmXxI8lWiQpD2gzx3}u3U}W@x%g};JKVMQ>5%u0P
zm#PIj<jX?z2&{6QwPHzdK09g2lug$eYutzj;s<XsyXn&j30J{XwP~ht)TZeENRuyH
zi1@*=<N|oPs@)G@OZQ6zLbtkdxp0c-YvK5(>W*cs2MXdw=uLj!#cpiN{+x5zRZNH@
z!3?Ob{6aS+)jWJzA|m1O7{0X|FT~DMf`YV%yC;2}j`y=2SbrPZqhIBvmc*r{DK)*b
zdEAllh_}jWvNpT8IIIdIs>9K7WqskeEZ~TC10gv5_w13?&)Ps;zN?-xzt`rCr>kjp
z#*Y1PuK5M6vof8%_#j!@57|M6h6a9DKhra!Uua+M55H?=Wb0V-R!28Ai9$?v^|x<t
z(eH+oVzMzk#e6dQ8j5YT6x+u~Mru5zxd(Cd-*q?E<ofu`)z&$MkFEo)TH}6lxI7gH
zC#&DA0Qo_7I!WYB=l1BE+tB}$K6jg;Oy?oSv#rQ^T+%!kMtyQ7t;%9CRh&o<;EU-C
z+~Ah+GULbdiFfH<F*7kvR3KHCebNWU%i&jJXD>z_<&mQeped<2b+(?a{JlB!`-r*j
zOH@C?P)_lmz9kh8WvEeV6V0#h4Q>N<b+eiJB<LW!+Aq`<@#rxvEY_8BtAv<4^V{1y
zs8UIBi6mO%e};vfahqD#-oxxJfbM?4I8)KbxYEIam4Tt#J!!b1R(VTX03_YDI*tqw
zB*+|p34VAdQ&UMRZL7zA<^1mZiCp%SqevkRA;Mrf*dR;y__4^V;l8v01+O3OdiUy~
z4}Pd#4!H?lr-zoqER%(rhKa`tH|O^jXc6}WJ?J}oF2^zA13Pak-sRYpZH`bo9sf8c
z{)$>l>)fmM;?H3lT}n|oi1iRR`VbpiRTb-|c_y8FT3OC8)I0j~#k9%VA!7f;2X`lJ
z<U3~L`*LvXBag}5i2n|SV=TPL0*h8)w`pQz<j}D5i^4>Ky$9XYezishX&M^bigI$)
z(r)m;!7;<n)-}^hPEKz7ZFfzI5y~AAk+mpkdInQm&paaW8T0esgYW}uj8x#Gl|&Rv
za{TzEwY7h=wo<dP!O|B|lO)o~8j0H^Ewf4)>FJ}RW6p4-wtr1Q_*KcPq;Y2}Sg-T0
z>Rn9sHNQsJb2LHa`!16|hyx5uj~Uw)r_)|xCT^_G$$OHa*A83yvQx(w0{R7!7x6JM
zR)(hiWzrR5(m<wrGIcV0dY(a`-Af~LH2Qk2fEPG}XsZlOYo(J!@F}=WQ<i6^ek0U#
z3WB`Gxi%oiq&11xW=5{g>+grybo}SAJH+wGYD%NRn#XHy+Zn-lOqWup<mRv!<h5gQ
zHlhRbC{VBJBNcWQ)3#?#v#wkA@EV<6wFY=&V^zh)yKF^0ZBNe6ukb#59<G{E9)uke
zbF{pe5FPyn0v^AoJ>%FjfAp>sHC64ZKi*j&!M%luL-IOb+}p_xPb~rNyvDP`h|3Au
zKD65h(oL;^B@u(@p46nU$>ROz6i*pr)yW7vO>^N=T$_)IixY9W4nZ?$^s();hs8(X
zwO?oLDk10Jc5@~ye6Rfb_mSGlcR=I$wo#4Z$bcH;w$?XINqL3?#K(Yu7-@+kz!kP8
z4i4DM%gu<{or@r%$PEpNG$c4j1<+P&mMyONp2`GuL$Tc$;{o8N+Vd2q=db!VqJI6{
zBju}>NK6O|tM4kaH!^|`ZwA+G*M|D5%ud&_689v$#uhK8i|B*|!~TKt5|r`sTqP`g
zr!t%OkYq^Dxs>x`|0drPrYh`{nU}Y_Ee{zn5dfcy8}W=jXqy6D=RG67x-x$>nSe(w
zrMkvwwF@4CA2l!#(V2JKe9fpSNsR21n+r-2BQ#Gc{GL?LP5u0~sVO00VamC!2TRaq
z1#KjBbup)=CV6GoGCp-BJ+IIX*bgi%-nA>q$qP1oMTlW)(bSVhKJDApC5Aj0y6-tz
zn}G_<u)zaCX~(S10>QnJhe7HJPgGJ`6U4-u+j>VE8a^&-8Cvkl$=7A&r;DUj{|Xj6
zq+~PFV@a4ODJj9npQ9w5upCWMhO<AA6wor?m00-|v38iAP6K)oEtG?x^Mw+4)vc!u
z@!%Kr``VNJ3c*yGJJtG>yM+FHe`O(?YGCnxuZ*e!{x(fIlq6_*M$TSvDhH@(;~1=j
zhsX6p&FLZa6u#d{&1+-I$U!NRTKMvpsyZRb@IHgJu9f68bH~WnlA<DJ7M38lvyce|
zxLy||(*Pek^nUvCzltt31qBP3Ywe?7E8k(r7ZCp#aU^h5aqxJwMTlJP(B|kKu`@wA
zY$y%V-X16#;H@a}Gv**c{nVvM%DFzMKo|AL#7-%D=Q$OJmXy?3(@4Avm)!W1HJi<P
zaeYU)kXx_H#(oLkvyvaF9vHYs8qCe<;&dZZrm6jQFeMq^M-SX5<n;B(Un$>Qo5aXr
zSYvi^>dW;FxyAv38&I5@gA*o(jqA_--Pzc5>^imiJv4c$wx&??t-W<{3|}F-jC)=`
zaa-_(ITeD8xJ!z{Bf`-7<IRBNL+=YU#*gLoP@#1_nMRDx4|*o1Xm-o^&z~pzXmWAL
zMv*&x&-G9+VPG?lufvS9ydz?0Xb9b&$l?c17j@vz=ouJ@mPtZ;$`*bvAP}AKZ)vDq
zK<OXI(EpZJHvVEqpN&ngj>pmQ^T&@LPxc~VD?DCsL&0=)l~*I<E}oR7V&`<>kceTO
z>POC!qB84Eo4E-8og7X!E_Qik`8to^4MQ7ox3B~upoLYd*lnaopY~cXt<wnVvIl@d
zrkj|&E+*D$YHD#q8vqtHM6!?zXq8h&G|oPJ?n2AX=wp$Hc@k?V;j7wn>&9)uy!`yr
zj))@Ro+?amw&}#0@q2p3@QDZu!#Ybo^v}I-=~%5tyn&w)emIXv@bGFED+u1dzt(=`
ziw<qq^7K|FSfoEbq!bMo7#iw=?1)!^2)Bd%=db}PUz|`4q-?hdJ-E*ns}6Fpu&|Vr
zl^*yN$jO;dmXe%1p6U~!_p(N!SpAhnziV#7*9(}~H%;@PMU;izOKIuc+0^Us<-y*b
z&ZGx0mm{~gYs13uiHL|$MozXnMUPcjBzs<lhla)w^SRsn@&^)G&X41-Z<R`8rB-$B
zJwc5UM|WixGY~OrYx5OA;bZt6zMn>+Y|qOTGlMXHQ)kd-3_R}7te8#~IsGKym4GM|
z!}5E?Tk-I@+uLJB`Yi<oh1fr|JKnrbwM%0B?m<jQd8CY_?GDgoShsesUHJhU<dCF%
zyKUiFt7{{`dHP-#)mcm3Y<oS{r_W>pUxcmQ`uAr{zJwk?lkp?9N1ALEp_6Xj)r3Yk
zGA!aD5OUw~K3x60ys+*xGm{t=#;P0v%WmK)dX>P&#>pwBppc_84cWWz=H_$~1?=OG
zt0FU;q}tcKg*?H?;ox|n%5rM?7D-;#(o|HlSAEh?CK#}==hFBgXr;Ht8E&dA36Hk3
zu1=;8I3)IS3!xx!z_Z`&j;k@5JI-#DxI=9=k8&o3s;<4e<`KChoMYUUn_NIa@uQ^J
ztP0s94}0L})Vf#8I#xL%!d|XITp<WQLN#Ka%6GEjT3sTKLkdSki!xrIPtYA5k2P!U
zf+iYXn=2^b+dPY(sIGHtukJzW3_iK2q89n#cg3E=e(p29-X~A{8v?<ZS+D0~?+ofI
z_`M*Gd?zxVbAvFO>BzX+O-(OveApqX_a2MzSed2H;QP?dMVrAvrGS*pM#31LC8J<U
zsw_`5d?{D1U$wln$J(LOr_IR7nCff}YPAP2hDUGYwQ5xNK+?(*1y$X>X?N#`{7&0@
zOR_NF?TK6rHR*@T4n-(3Yv8R;_B$VcV}nO0Te}>8V_%J9QA1-q#M+hP;!o`y)x;4_
z5B9F@jUUA_mcb!n<MH=MsLp5)^q-C>r~L8SRM$dtxXw2vXX>k>8D-W58Yv`HTUr_j
zf2~WdgBYf1x9h5S42};lo9gT3v=EAtlDJPzUJDCPjPB8`5!>owU|d%vb51WbCdZ}c
zmNyZ0N@k>|$9}}VD!=e<+r7flV%_(OYf_R1XXI$2hx|cD5?6Uscv#hYh7b0a)@FG$
zbz>Fw_itVWEMM5+kHMx;8<m%F?bA)T!T`|snm!}3bw^&DtsF7yTuj%%)p*K}I(+%k
zpV!6)hwX-np5EEmbY$V{vgoV?o$n4#zh*ALqDCR$2{YR1*%2fj9z4gwaqc<x9RY9c
zU0s1-FDC`1L(4aBUY=)umHRZF*f<OMV*7hbJscTbRN9pa09y-MW3t`lNa`^TXJ^U=
z*TcM|XXB@t-=qEQeQs-qp9gQq;Lpu#3%KGt9*q6`nslBalY~ofkY&DPHBeUmI)gA-
zQGy$S%~D&imB<*S$&`!I31Q#8RcBUPj2aQj2`e}x<>X*~PG2IJq}XVZJ;mo3C{W*~
zXRC8Y0HuJSrXV$+!`W%sC*<4aWHqQx9;b{wBPZ4=S+5!QEe9U!^l$~avU?KS{LR4F
zcq;g2aF7>|YkRaV)pb%{udJBQlK?daT%}ILfZL&P{971dTilU=bN^zQw3k*$B1;OT
zOt^sZo{y|1F8=+eCdX?FP5qg{C4#(q1T(TpQo{urLZVc3+{W`;=I;-6tF4esNrIlV
zuqwR0-IRll`NUD^ysm@RZvtgaw{vJHFF$)g66L~2%I1=smS(UT7*O|$C@wKn{0zLD
zQH*8Dx;5;tkB@Ziv#IIoC}Y_kVlOS`uRVWmT^6HqYpl|p<e(i4F28zDROqV%Khc~T
z<SuEQoSc{=HRRRgr&1xHpwn?p6~8O+XluIg)RHEuV`WVF_@HNO(f8N4WphuZz;tH*
zW}oH~>0p0<8@n;@ktjBp4lH{cgrI?+@T;AIGN_=f4Pl6($M!AV%z`*L<n2tEhutvN
zj5~YfKY{1VbowHpP@B%x^^m-dg@U5UZ9_rtvb1!dHA`Yl9f>k8&_rz?OH%ta0%S`^
z>KKl<y}Pa^7b5GFxVTUa!x`!Y`SL(-0xe=yN8jLfT1xTU(8gM!HVw<og!6v#q|bGQ
z%1TPHWcV4Wsj9ira*l`F7FNS^p!jKfkV8%FQe0e2mcuW^bS6j5%IfBcPbCr#p`^~6
zQ(p`0x}h3{sFLsAHIuuhyfwvnf|R}($kvC|DE*n;6ssR$A_=FJImMSOSYC{7jUM0%
zL9dNA8o&H?b8Z^0q`1)$ts18ov@kb+b8Zw(a}|G=mdahfNXu5mIDEcbo$0sS)(Q=|
zMn$<IiYXaVO8EmE+`x$RwokKe&!yWhh~5f}c^#F5iR-^a^!_~=w7%0BjvA&b)*LlX
zc22>vF0L~(q$xV=v|Q>YW}I9n)Cd`6jX*&;&zyeYbXlp@wGE_|it4b*ba&{4pQqu6
z+W)CKC6ca@qFl=h1Pi%Gv-doX<qn=nH9=U8_qWb%f_t$y%ks<#kcULI5I}!GKOmNA
zu57lyJmfC)a)dQJV~?8pVxp|9`)(N)-pz=~$to2xXHLt-G=~0W`P0`D!4F~gaZR@R
zTC@$ES71!)y#*^Q=U?7VB;+vD>(40HkqM`huXrN)*<tfi?K7wP(8NRvj4-pQrwfsA
zLqtRj=j3n}lv<gZiskJ~Odb~<r^+ka%c!e2*Vk_^7rh&h1#L^p1p~zody~<ziOz=B
z)~1FDDP=Lv#~d}?ndHpOskynV4owgmajS+*@6DU<I~8?~VjEK>8}-Sa>o^h7gwO_s
zW&Z$7_l$#?Sy@7&5MWO@7ueYO0c{e?iXUo18(VnFFUzUtT7t<=ah4@77;x!9jRv`T
zn2y5y6yQRjAoIWzNrr}GdwooQ>mp%mda39YTbRyelAWD>>ksnvRL1gqRIowyyvpE9
zRcv$K^B=;&S4Yp#i$;-7PKO_^i__8?0bn<9NWC)z*vt}e-YV+qtFR?}JQLY*KOYKP
zJ*^%b69A*PBqs6&l$>^(R>Z`_#zpx{Xhg;N0|U{AT<t*#$Otd=y&1vQwxW4p%>poQ
zglW^rCk15~r{QTaulM_X)9qJx<mAM%Upw50SIHm2<+JoqCmtugb63AawNNLtan67B
zCg+_|%?iOt`z2W%Y~pf<w$;{_V2Iz$X1z1GhYEadpgvX+zz%yNb7<q`X)8=jOaNoo
z2fewOnRsASR9HmLbY(-`-Sc!|8Dr67x#MKXvYjpA9G#etAE!y*Vj`+k`L`J9TagLz
z21bXL=hI<fdaG2q)kl>K*=-rkMuRwA0(8C~er62O`DT=+OX&Q1Dcu1XjrZ<*65>Dg
zneaC8(olbWm(`nXNP|U_XE;0cwE1AXacdIt2EUWx$#k<A>zXRV#4+<@`Z|t)C-G=*
zW?@>|y<Uv4q|1x>mf(d<Xgh^JH+FVfn=j#8e+bj^Ud*@;{o%VCp6-niJxh2cU43bi
z=jMTd-cZ&-Z!2}-3etpyh+*ldyu+1A>+|M8CXD3O!A4`a@j<;$LwEhR%`<4sVaQ_d
zYsiJ1An7k3V`qX1F`~bGp?Nw;pr4=pJuUh*MS?mWFmP1t59fLmjUlJP1YWKXL6TWv
zT~b=+pr@y^P}f6cB%@Chu70hLoX6cI?6NQ`Yox}xWtQr66q&HIY8X&tC2Jow*i`E(
zttX|}(4{e4VWA~Eaq4Iy^-DFyEWNvus7PQBs7XZy9qWnx0|CA8fakoGX~t<afv4!O
zi?X$-aX@MvcgQ3CL&C!$@l{wF8&}c(n;_tD|5S{G+<r>wBtM+3yGz0adJVPgB08a8
z3rnAH6{uzKk#KS@3wWJnL2Fl90u=S2#7`y+-I!Tar2{FO2NP#K2ou^m!thRS3tF@>
z5*RA)_DF={z^s^MNv_;+oiy0v?AO3Z=Z|CrKxdCt-)q&mzBjZmy?XIfbm4pM{yz6W
zWSmIHPy$cY#;Lg~Vr>ax{yT9JDouVASC)vtgnRYM-$^|%#70CJ_e{jcSG|`sOS8Z1
zG0U@3QzNR}WgPfSL*tO18dz!pB8^`!SMu`m;^Qq+QbhP}<*uydYm||28-)Q<02L9w
z^}@;T>tm8l4<ptC`1B-;Y&Q1}Ef43u;jTsk16?=b0u#sgfI_|rl#~sPfXA`T$!aBD
zWAoBEa?S=Fp}X~K7Gt;oiPG?GcbWUqI_B76PO#V&ry4h2_JorSd5`D^`_G#!k0!wt
zeKArlzmQkFFHfNH5wE|KRr|Z9h!%&zY~CuB><ZEobULPrOEAEt8>jtVsCGYlR-E+>
zvH{o3K7g#UB3K8&>$M?dzRlJ|87KdF7t9OrE9MC}Ydd0`U2)}`+N^27P;z(L(gzhC
z^fG2t;l1e{OIOZr#1O{e-MI}@96EaqbALs|Kfsk#QF)Z#6}?=}?0$NJ{TkG(9j}#x
z#g%nWHi&b_9ZzMQj+ZZhtASUpaYsYl`Xinh|MpS+D1Y2}bRmRt2}QohaACOHi4AFj
zUQDk%_ZA0pee?2eN1+YBZ5K8zDrB#)r^@FR`gfwFqy@9-bLB4cYTw0YC0>aH4Cz_(
zKNwPnf9+Qay_Ad`7Nu-|Pa;KibiTT@j&%SuQF{Ad;i^D6>~C+(>nQEd_Gpd!Utot4
zEcW#&utepO7ry9Jdfld5b<ONTQ(Rme6mf0~@3ku)^pSIlH&?}nEH7t5izhCg;drxY
zGQVS6SATP|uEg%3P?)R+nWXCZGAb-=#<J`H1yklykH)S5tMg)f+d!gdsIM8K$%iq=
z%xs{I=GqlQY`^gH!*TEOjbr}RoyJ8c=755j$Ew}dr~1~ydLH?D4eTKw*me7E>gA_}
zQZ*l}PtkF5R;pkLKhddKe=@XTx>+1+F}`zJH1Fr190jx-tfrt^Lgm2~kDadJ2(TSQ
z1ub={DZ#T_<-$_=;;ufek%fiS?N)xzIqMom0CfVcMns0q+C2M>tUJxhza4pEfT4x;
zkV{bRU&pjKN7CT;!oAvrTWd*iwUk0Se<q0%gzNp#ylf%p<IRm2&nDErQUgG*WHP`P
zr$QlV@PTZHT$A3|E1cHN@=Gk-^U!IsKnmN5iq)el6tqeRNy%F0t?mm9cdq<tt~d2x
z(awmR>}(Xu{o_MtF&Y3$yew?se)4|jZsH`3KoIfjx&WlKYqy&uh^&GYjGqxDIX;q2
z_?t|P)K8l$FQYhBDlEK&NRxV06%{jONMGg6%kB}tc5X50#hW#M?_bL90meF*%b!c}
znV78rX!nKXuYs4rmv$+yM71&%acxDJnP)5HLBjApvOk|$1Vf*b^8maSp`Qe|UHCLK
zP^Xtj!vF!pkx#PzpJlUl`avf~Lz7-^bux}vUL5<`Ro3zGi?lzevt2tHK=WjpD9NN4
z2wMP@`sLJ`vpzEa1i0sZw@yZ;@i%gZ$X1{Di{VR#H{U{&cP2ts7VeG(%x8k3kBaK9
zn%d}bUEu}M>8{vd=O}^*WoTNwUT*maVE;7Cep<xwc$#pgtY)RnPNy}A3f>wkD9Jp|
z7UU7LOG|Z`wZACvJ<%hhW6<gbRMonIX3NPbGEtjZ`)50A>w}LUUVMG^>b1}t`^gKN
zl++}AtoFD#wXPUW<YK8S#yhlEHg43HaEyeT18H9`tvu~sIy?6Sbr+xxEd(80$mH(;
ztL9^+mbIB=lMN>i+&)<t8uthY-qVWq5B$m#C}Qe}$0f$l&kz1sTgv>HHMO?zh-N7w
z{4URZgpf!R_394QE>X_Q{e#Gy3!hGc$5Bc(UkXY2T$@2It5fT-v+CG)>Jds{)CE3(
zqZ3CpJh7L`XOCMkiPUnCpF`Pj@7zIn@;8ElZU52NKuo|d$I9$upLw;1XNK0XXuPhO
z=Gr=U=itC%iIR3og|cF5x&o6%@@598hioqTg2@ECV|mlvHbRSrM9(}x7M}gZATFcJ
zza3`>aKG{0k5a4k8t~gID?28?S<#2H*Zj?Sngxfu=WBg3hzV)>Vs;kIURbOia!wis
zdQab}BX~fzHk#f7X>kDoH;Ho?<TdsyiBhwFlsGu--}mjN?e?jU4shI<NFek-57_PO
z8!C4N9+=Xc@pzl&st5+vYDHGK{I^az65KeltPDmr#a2owG6aH|G+5&DX>RjhrjPOW
zzua$bc6^t{=lPC>n;Uk5$U`e%Wf$@O{TDfFc29C9jx&IZn}uTcUmG0*>^MM&dsko4
z&~UId>&5~$Gz~kLtXe#-a&^kw7-u&mZ7K&_v@qGYE2s<N?@C;91$x5n6j%d;d2^qE
zz7-VUob2p~S04pkOjs*L>fhE!3=C6RKjhNoTK#j(hWJE#68WK8fc~$I8Jk(7UzQBE
zzw6HtP_K#uac!QP(X@3AY6>SyURYbV+s~Ft%c52q7Cj8=4%{SMiNj~~SW1vmwPt?{
z-Wuz?wnA|0Z#$H0fR}xaz{7{?tT!>&me<9tc6QgZndB%kvA)X2e6TxP=%tdtk-Jn@
zil~#3;j!EQ>-h;9itb{!wrGNBYg;zJ6}G~29qQ@Pxt~Bcx!IdaY4pWVgpZ+le&-Jb
zRQe5&epNlnv@rmD7M7M2r(-FmzEc<&8L22m#6?Fd*7XgHsVqNAioJS#V=%%HvX8Zv
zGdsJx8JW&(7MA}m#@$`-^XzRf9B?Mo;;poQ7XN@vN7b#yeXAURHo!029szV~eQf#o
z1k`0j51;Zm{9rfyQGsVhOdJb;YGn*o0L{_f`z$bp%#|;yv_g^tG6^L;RJMBlt{xd*
zH7hQCM@QRTY2&apE&Q=kCxeqo^g>9J6m5l-7FEYsMxMsa?IeXBX|R$|3^WwJ<DISW
zW&iB75f7?$xO_ycfEe*~JEFRDSXpMlrLS|L&?9)z4CfK^U*{1aD@&z)i?#x^QKIKO
zo<fT9@}wlEDW1G^t6@?wTTWKH$>)kZ1$^_bOQD58KN#FuHTfE6ZT$TrAQ0zn&XdPj
zN@Hb?ZpYhR@19yGN(c`2bC_5S`%I+dq`-(;myt1aDf=y~Wqy#c^E!hoXbT^JHH1SQ
zpQ$sy^l6#CdF7Qr5YhB!b|PL$-PGcfHOSw+I3H(h&naL@Xk!K_XUC-)XsHklCFQ|L
zCiS-YokiwonLu{}!0Fsb&-c$yt3f0od4cS{@BO0konnix?=!oUF9J2EfG&UJnbn8K
z6@;6xMbv=oE|>SyFtGT9X9g{=uDZKA(Um`$(!AqeYbA?}Dq_$q-xy&6^!whk_^#R2
zcLMBiY-@mR+!%L!X187stpBPL`c)ukHdmKp<9E&WA`d_$LUFk<ih9>L>#(y;c|XAQ
z-pN<TTqgsWl&q}%{<q|jesAuceEfJTIrN4wtT%DNpB6~J^j^+w+7}cO6LW3CnC;6{
z?P0wE7Z^{RJ)ZEto8Gmg-M~9Ml-4^d=awqMAesg+>xjW#8*DdnL;_S?L|*3@w)Pvv
z<kWedC~FK&fDw!`?t`I!xMYSlgTC7NGN?7V81y0r9q5g5revRJ7h3epYz>?kT>bPf
z5m!NI=5xg_jDnCP1~hOEi|YYAexoi+7i7b)Qw@OzrloB@TA2ia2LGJUci?uDrq25~
z`i`rKg9#6gbziN2^76z0{1zTE4b8J6ksA-9f;OSvzFhxidAbE@LfT~>^MmFOIN1Bg
z%N)(73mO4|^T+(4)BLm4vVW?h#2Bui;$pkP#M&f*bIW=p2Z_c?j+$_(qyLFYY<mYc
zloQwrlap<~J+ku-dKevez2A?QK;1eqS@lH5TlEoJX?XmSn1*!AKe~|c=zFr&4E8WG
zfy9c+FE})027FX7w85u1`W1S<K*i7;F}rutl>16_>67o(sAo+rbHSYX_thsi`5XG9
zT#j}TQc@#D_E?p_w?ped-xU7`32Z@R%2+XLl&aS_F;tdb=>T<)AUz%T(*EdJ{)H&M
z?8j@eiH6e?vx95Y9Ew=*x4R4ox!%b`*2CYQBAM0iU=r`_kLm-_4csE}>U2&o%z=Nr
z*N!WEW=+R8lsWFNtgKu<eY1^nwzhuqc}Gc6(b;}YK`|0BAezm@lm`mfY{B0}cm1@q
z_>6iqzuO-TrKC_|Vdehqg~6&*`GRSpbJhmzFsqAWhGyIAkZ;o5EDl<Pswx-I*QKRr
z7QITsxN+1OLs0e1;it|GX95CGi<Do~&|pF2*eb4RGirVyW_}XoDtjl<^JMiTI@$z8
zkVE<74-~bhbfG7BArSSY66NG*((Be!`$$ZT45I%)Ar6v7scMG91ydy}?QZ|sd52QR
zyZG~3S`*nEzx$C<Y<_8Y=X25}_5-aukP4BPl~r0{J?gT-a-2N4r_k2k4yVC<dWeCB
z=Hy_lsj7?A1_V>i6$QesAThjBRCN>J#P1T^*4|;{=${;*YX+R>-hHoU&e~0=f<Wl!
zNzwoG^BO8DPJ(k*62_{evU66)mhfN3aa&6|{EbV96<deBsrC%HQZ*RIs?8G@eXp>f
zV6@Qsh1Ufr^<;~lhXSS<d58@-h$ag+6_tpLOaZd)E%?l`T6D$=0KiMEv#A2E49t9Z
zIGZc0t0<IHK~`2;%%fTrnMA(T!Lrkd(PW4hc0sQPq*2!y<B(B_q-s>u9kRj<4|{mv
zWJQOD0<zbYB_uTkzi@gQ^$qY36sPP07Y`ubSMNsc8ksTFrR<@1bevjuOj$_J5*>9D
zxF{(rj14lvtqaL`ZAV5&EgQbSVMgQw9Ds=9+S^=l2X|v-dv$!g=19sH<rT8cS@9T&
zvSJ^P$DfLZz@=F1c)Il?+?Xl;at)vzumGT(*M2TZTV2d^v)7;BaH_EAb=zDQb3fb+
z`SQhl8p78^#z7v~idSo)*Fg9(mB+=UF3MOIqzFJRKp^M;RwtoJ6c^`TpBdO0vF$ka
zjS55r@T3Oc_OudDjrpuKQ=bfw1Ro};V{9*Im+pHqrL;8xr!}1xFefR6C+Q#P7JVcz
z{PU;&v<}LjW*~O-X_BCITcZTt$;p;Rg;`V>Iu?CJlYg(RH0Pj@4|NCt%f*7J!GVVW
z6~|;-Q8>t;tf#02gT2HrF?v-4hzk8ScrR4YrIz!{BU2~qmEnasMtfPz=#N+R)87}_
zYV|}ITm1S-*95=jScy3fb|yRfYBDSgs;d<=G{{igGi&}wO5C5+82yiwcqiNssJvGX
z$sl(TfRpZ}JvWE7RA|!mm&iEZOWxL`x#*eSiF+zfK2{BkwtU=P)AwBdQz!r11}BB)
zWsVLY_(TJ!500N?_TlcKsq|ELn4}-DCQy}A*GN^9c$Jj+sj4`sC@A>U)+WntU4YU-
ztI8v}TX$%7!uxacY9z$A-Bx=>MQ`&x&fFNp*N_ijWTtDXi`dH#xz>Mvdc)0WV|HOA
zz=gu3tIDuq%fpi;^nWw+#v1+Jd;iI}++y;jN0sAv2EZ6CL5ZSFTP_Q&7oanh$4Gi&
zb*l_ZAHbw0<k|K89MfCfsM!iHt#TW=nO|>nmb@7l+TyqhH6E&?oUejgBV8tPdbBb8
z*nVYKE=5KY;vB4h1Qw;zAsz~f3HtzGQsuT`r^oOrlA&Kz$X4hjp(ApxXShvrp7wU3
zvc-xP%1cdKySA|BZAj&(fE#fzKGfMAjMF=FF)Xh3sYz%Y1?Q(2|I?lsnVU=SDYA31
zCvTq6v-=oUtQXDS03`baeGGqiII(|pE?OEV6?bxhMEqk`0dZCI^W~M27BCXNsIvk+
z<B92CT9IAiZs@pQKkfa_`P|I5Em)#pI@px(E!3zBn@EOj8jI^Qw)(V=d#jR6*U_Ma
z1Upf9;W>Lo&$<70dWXpQ`E{8%_NedbK-)s!9+b@Y0Hl#qHSWBQ%}vQ7;xKq;8XpOO
zi1kzBB8Y)%y6G-(RA0Y-!fmh$a`XVv)BWsytK)n`Tpib{fG49?jnU}9j9N|2sfvn<
zfcu33&<=1$i%(eeu_dW^&?_)8fG~@O5kktck&h-g)|YxehhN{u$X!a`T~S<#%qRJP
z^QeZLdL7;?a&to6@7c}YTF^0r;bP>w>7BAB1{MbG5~tBTqP>7>ZpPJKVA^-5KDj&(
zWux<L76EQokI9nzvPfG*qyx@TxPB%;U*^NiI>pNxUA{$MK?DkUI;DSI{t%taNJ%;K
z5<UKa$Q{MGt#*&g8YTj`R+sE5Vd)>MULvbTZFKw>>&6UDvRi_H&BwU};+?V^HKvRb
z9lS1$WZd%HT$m~H#_&_oYOD$1I*fN!oW4Ld^l$KT^~B?`8>^VSvUu7-AVDIk=6Z7W
zD`vjsDh?5!58>Yl@Ejw51kMo;QR8N3J97M?aPt{fVP|Mk$Ye1frW{6y*xe4Mx(f_f
zK5cMnfRTm!qBdwk4WazbguK*rGLgp!&QIX_ZNofH+h_4>+$?`Mo~Ca_@MQz93yjBN
zXB_eA?s!}Yn6|(-bsLkI&Dn{bt=?%U{>`cx*S|_2BQx`J2ZPIB6saII+L){hhcWN<
zzN33AD$sDYc)q6#x*V{iHvzC7=$FfZZhf+7#935a8X6K35*fL((w|gyJ`kf1avc+P
zHq{5gaM{2<BNd!I^uc53$xA?cboUf?!nh8MP+(yA>>qr-D&+$qI^dETY^Wuuw1*1V
zn&k)A%Q666;3sq4%T!byp?WA__q9^11D;&?Sd~dSN1*J9CG#)hK_K~We);n_-oV}*
zt*Hp=V)^e9*gvCHXX_|0uglH41?C8NY<dy}wQB9~I17#bEf^0Z5+Dimu693iT8w9)
z`tbP?m&5J4Rmbqa&V69s9|_ui&v+8Y?R;$5SK;=)GKQe{<d1z0_$?Z)zF-ukic9#6
zlu}YdP%|*@Qqt0=CunKu4w$TTsy&>J5+4n;xRl)~!Cu0)u=%3AO!{L5?A>OVb*m7M
z+1bSe;f^D9LrqINAaN1Ak4)=+Bb=U-laX8y6GF)P^lz@D9&020miZkWI=TRloy=}P
z(Y{>uS?WnD()3KRf-CO8;f{$>tI;c>qTap%P#5=PxeA%35w`U;NC^qC(Jdvk24G?G
zj8!3Gp9aYKKj?XLgYnumF)aH}4Gj(7U3wkeT%Wt@>xU1w6=Got4s75mQ$*8JH?ui$
z_sc0NazA|{BPE49>bR>9R!xIWRp^4i7Ysyhu3*i~-pQiTebW`w0Yi;ZkBY?SusIpD
zg)$(B-2Y_kBK^BAaOX<FQo6#IB9ebh+TN`wAW3c^47i+~vfjT}ej_Ic_yRN!@IN1!
zz&_}~6r$!j(M6OAQ0%8OM|BJib1c|AHXZu)hRFnEDBxbi$DcPF52J2vYXhv6mX^l<
z3>{THIl=fZS9UH>)o5I4#41Pojtd`$;$Bml?<&<m(+dzRwfDug%nP~_4`!8-gBV4h
zD*XF#lq2c=`i!BbS)2c{sv9unFy?@|)O4jxqdkM|imoe8pT504Cpr2b2C<?cJv0`7
zKUBBhDJ#y+NKXj_L`bb-Bk%?f{LOQ~*A$hjuEN61T$b?&UeIpOE{os|n#@0gr)$xT
zTq^1Kc%<0PfS4NnQ55mzKED2ZRYpYNCBIBa$c$RFMp_yzM}hy#`Ih!=A`Ix*BO?+0
zq6B%D^r8$&A%r?f1Gu}X@u$Hly(n<<zRgL_k@#!+XRz1b;giMFyp;7P4>V=|66Be9
zSN|bgUjnLxaTg{n>RwA=>_}Jcuz#=6%7GWxU!QLsL5hlwK0@!`)>^^Ry!BUL7hsNa
znyPlpFD+GqMVOW(Ez(gvsj~O~`g-w1{l6W+|KAvp|1X`sY|b5am6}CO|8ZH*2zn=L
zl$WN70`{#L`X3YZ@zH!gGCnFUH!lVBy(!=4{^M5OW^GYc={=jW{r8vr*I&mtKf-kW
z^N;^eJlFq+kNh+9@-+wo)WpQp;ZyAV*Qba&{qwdiFE8+W$0Z68qkrC`q?n9of$$rj
F{{`>vly?9C

literal 0
HcmV?d00001

diff --git a/docs/manifest.json b/docs/manifest.json
index 342326c99a760..0cfb2a446fdca 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -907,6 +907,13 @@
 					"description": "Connect to agents Coder with a MCP server",
 					"path": "./ai-coder/mcp-server.md",
 					"state": ["beta"]
+				},
+				{
+					"title": "AI Bridge",
+					"description": "Centralized LLM and MCP proxy for platform teams",
+					"path": "./ai-coder/ai-bridge.md",
+					"icon_path": "./images/icons/api.svg",
+					"state": ["premium", "early access"]
 				}
 			]
 		},
diff --git a/examples/monitoring/dashboards/grafana/aibridge/README.md b/examples/monitoring/dashboards/grafana/aibridge/README.md
new file mode 100644
index 0000000000000..54cca4bed6e54
--- /dev/null
+++ b/examples/monitoring/dashboards/grafana/aibridge/README.md
@@ -0,0 +1,39 @@
+# AI Bridge Grafana Dashboard
+
+![AI Bridge example Grafana Dashboard](./grafana_dashboard.png)A sample Grafana dashboard for monitoring AI Bridge token usage, costs, and cache hit rates in Coder.
+
+The dashboard includes three main sections with multiple visualization panels:
+
+**Usage Leaderboards** - Track token consumption across your organization:
+- Bar chart showing input, output, cache read, and cache write tokens per user
+- Total usage statistics with breakdowns by token type
+
+**Approximate Cost Table** - Estimate AI spending by joining token usage with live pricing data from LiteLLM:
+- Per-provider and per-model cost breakdown
+- Input, output, cache read, and cache write costs
+- Total cost calculations with footer summaries
+
+**Interceptions** - Monitor AI API calls over time:
+- Time-series bar chart of interceptions by user
+- Total interception count
+
+**Prompts & Tool Calls Details** - Inspect actual AI interactions:
+- User Prompts table showing all prompts sent to AI models with timestamps
+- Tool Calls table displaying MCP tool invocations, inputs, and errors (color-coded for failures)
+
+All panels support filtering by time range, username, provider (Anthropic, OpenAI, etc.), and model using regex patterns.
+
+## Setup
+
+1. **Install the Infinity plugin**: `grafana-cli plugins install yesoreyeram-infinity-datasource`
+
+2. **Configure data sources**:
+   - **PostgreSQL datasource** (`coder-observability-ro`): Connect to your Coder database with read access to `aibridge_interceptions`, `aibridge_token_usages`, `aibridge_user_prompts`, `aibridge_tool_usages` and `users`
+   - **Infinity datasource** (`litellm-pricing-data`): Point to `https://raw.githubusercontent.com/BerriAI/litellm/refs/heads/main/model_prices_and_context_window.json` for model pricing data
+
+3. **Import**: Download [`dashboard.json`](https://raw.githubusercontent.com/coder/coder/main/examples/monitoring/dashboards/grafana/aibridge/dashboard.json) from this directory, then in Grafana navigate to **Dashboards** → **Import** → **Upload JSON file**. Map the data sources when prompted.
+
+## Features
+
+- Token usage leaderboards by user, provider, and model
+- Filterable by time range, username, provider, and model (regex supported)
diff --git a/examples/monitoring/dashboards/grafana/aibridge/dashboard.json b/examples/monitoring/dashboards/grafana/aibridge/dashboard.json
new file mode 100644
index 0000000000000..16bb5a201c79a
--- /dev/null
+++ b/examples/monitoring/dashboards/grafana/aibridge/dashboard.json
@@ -0,0 +1,1411 @@
+{
+	"__inputs": [
+		{
+			"name": "DS_CODER-OBSERVABILITY-RO",
+			"label": "coder-observability-ro",
+			"description": "",
+			"type": "datasource",
+			"pluginId": "grafana-postgresql-datasource",
+			"pluginName": "PostgreSQL"
+		},
+		{
+			"name": "DS_LITELLM-PRICING-DATA",
+			"label": "litellm-pricing-data",
+			"description": "",
+			"type": "datasource",
+			"pluginId": "yesoreyeram-infinity-datasource",
+			"pluginName": "Infinity"
+		}
+	],
+	"__elements": {},
+	"__requires": [
+		{
+			"type": "panel",
+			"id": "barchart",
+			"name": "Bar chart",
+			"version": ""
+		},
+		{
+			"type": "grafana",
+			"id": "grafana",
+			"name": "Grafana",
+			"version": "12.1.0"
+		},
+		{
+			"type": "datasource",
+			"id": "grafana-postgresql-datasource",
+			"name": "PostgreSQL",
+			"version": "12.1.0"
+		},
+		{
+			"type": "panel",
+			"id": "stat",
+			"name": "Stat",
+			"version": ""
+		},
+		{
+			"type": "panel",
+			"id": "table",
+			"name": "Table",
+			"version": ""
+		},
+		{
+			"type": "datasource",
+			"id": "yesoreyeram-infinity-datasource",
+			"name": "Infinity",
+			"version": "3.6.0"
+		}
+	],
+	"annotations": {
+		"list": [
+			{
+				"builtIn": 1,
+				"datasource": {
+					"type": "grafana",
+					"uid": "-- Grafana --"
+				},
+				"enable": true,
+				"hide": true,
+				"iconColor": "rgba(0, 211, 255, 1)",
+				"name": "Annotations & Alerts",
+				"type": "dashboard"
+			}
+		]
+	},
+	"editable": true,
+	"fiscalYearStartMonth": 0,
+	"graphTooltip": 0,
+	"id": null,
+	"links": [],
+	"panels": [
+		{
+			"collapsed": false,
+			"gridPos": {
+				"h": 1,
+				"w": 24,
+				"x": 0,
+				"y": 0
+			},
+			"id": 11,
+			"panels": [],
+			"title": "Usage leaderboards",
+			"type": "row"
+		},
+		{
+			"datasource": {
+				"type": "grafana-postgresql-datasource",
+				"uid": "${DS_CODER-OBSERVABILITY-RO}"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "thresholds"
+					},
+					"custom": {
+						"axisBorderShow": false,
+						"axisCenteredZero": false,
+						"axisColorMode": "text",
+						"axisLabel": "",
+						"axisPlacement": "auto",
+						"fillOpacity": 80,
+						"gradientMode": "none",
+						"hideFrom": {
+							"legend": false,
+							"tooltip": false,
+							"viz": false
+						},
+						"lineWidth": 1,
+						"scaleDistribution": {
+							"type": "linear"
+						},
+						"thresholdsStyle": {
+							"mode": "off"
+						}
+					},
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "green",
+								"value": 0
+							}
+						]
+					},
+					"unit": "short"
+				},
+				"overrides": [
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "output"
+						},
+						"properties": [
+							{
+								"id": "color",
+								"value": {
+									"fixedColor": "yellow",
+									"mode": "fixed"
+								}
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Cache Read"
+						},
+						"properties": [
+							{
+								"id": "color",
+								"value": {
+									"fixedColor": "green",
+									"mode": "fixed"
+								}
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Input"
+						},
+						"properties": [
+							{
+								"id": "color",
+								"value": {
+									"fixedColor": "orange",
+									"mode": "fixed"
+								}
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Cache Write"
+						},
+						"properties": [
+							{
+								"id": "color",
+								"value": {
+									"fixedColor": "light-red",
+									"mode": "fixed"
+								}
+							}
+						]
+					}
+				]
+			},
+			"gridPos": {
+				"h": 12,
+				"w": 20,
+				"x": 0,
+				"y": 1
+			},
+			"id": 1,
+			"options": {
+				"barRadius": 0,
+				"barWidth": 0.97,
+				"fullHighlight": false,
+				"groupWidth": 0.7,
+				"legend": {
+					"calcs": [],
+					"displayMode": "list",
+					"placement": "bottom",
+					"showLegend": true
+				},
+				"orientation": "auto",
+				"showValue": "auto",
+				"stacking": "none",
+				"tooltip": {
+					"hideZeros": false,
+					"mode": "single",
+					"sort": "none"
+				},
+				"xTickLabelRotation": 0,
+				"xTickLabelSpacing": 0
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "table",
+					"rawQuery": true,
+					"rawSql": "select u.username, sum(t.input_tokens) as input,\nsum(t.output_tokens) as output,\nsum(\n  COALESCE(\n    t.metadata->>'cache_read_input', -- Anthropic\n    t.metadata->>'prompt_cached'     -- OpenAI\n  )::int\n) AS cache_read_input,\nsum((t.metadata->>'cache_creation_input')::int) AS cache_creation_input -- Anthropic\nfrom aibridge_token_usages t\njoin aibridge_interceptions i on t.interception_id = i.id\njoin users u on i.initiator_id = u.id\nwhere $__timeFilter(i.started_at)\n  AND u.username ~ '${username:regex}'\n  AND i.provider ~ '${provider:regex}'\n  AND i.model ~ '${model:regex}'\ngroup by u.username\norder by input desc",
+					"refId": "A",
+					"sql": {
+						"columns": [
+							{
+								"parameters": [],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					}
+				}
+			],
+			"title": "Leaderboard per user",
+			"transformations": [
+				{
+					"id": "organize",
+					"options": {
+						"excludeByName": {},
+						"includeByName": {},
+						"indexByName": {},
+						"renameByName": {
+							"cache_creation_input": "Cache Write",
+							"cache_read_input": "Cache Read",
+							"input": "Input",
+							"output": "Output",
+							"username": ""
+						}
+					}
+				}
+			],
+			"type": "barchart"
+		},
+		{
+			"datasource": {
+				"type": "grafana-postgresql-datasource",
+				"uid": "${DS_CODER-OBSERVABILITY-RO}"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "thresholds"
+					},
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "text",
+								"value": 0
+							}
+						]
+					},
+					"unit": "short"
+				},
+				"overrides": []
+			},
+			"gridPos": {
+				"h": 12,
+				"w": 4,
+				"x": 20,
+				"y": 1
+			},
+			"id": 3,
+			"options": {
+				"colorMode": "value",
+				"graphMode": "area",
+				"justifyMode": "auto",
+				"orientation": "auto",
+				"percentChangeColorMode": "standard",
+				"reduceOptions": {
+					"calcs": ["lastNotNull"],
+					"fields": "",
+					"values": false
+				},
+				"showPercentChange": false,
+				"textMode": "auto",
+				"wideLayout": true
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "table",
+					"rawQuery": true,
+					"rawSql": "select sum(t.input_tokens) as input,\nsum(t.output_tokens) as output,\nsum(\n  COALESCE(\n    t.metadata->>'cache_read_input', -- Anthropic\n    t.metadata->>'prompt_cached'     -- OpenAI\n  )::int\n) AS cache_read_input,\nsum((t.metadata->>'cache_creation_input')::int) AS cache_creation_input -- Anthropic\nfrom aibridge_token_usages t\njoin aibridge_interceptions i on t.interception_id = i.id\njoin users u on i.initiator_id = u.id\nwhere $__timeFilter(i.started_at)\n  AND u.username ~ '${username:regex}'\n  AND i.provider ~ '${provider:regex}'\n  AND i.model ~ '${model:regex}'\norder by input desc",
+					"refId": "A",
+					"sql": {
+						"columns": [
+							{
+								"parameters": [],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					}
+				}
+			],
+			"title": "Total usage for $username",
+			"transformations": [
+				{
+					"id": "organize",
+					"options": {
+						"excludeByName": {},
+						"includeByName": {},
+						"indexByName": {
+							"cache_creation_input": 3,
+							"cache_read_input": 2,
+							"input": 0,
+							"output": 1
+						},
+						"renameByName": {
+							"cache_creation_input": "Cache Write",
+							"cache_read_input": "Cache Read",
+							"input": "Input",
+							"output": "Output"
+						}
+					}
+				}
+			],
+			"type": "stat"
+		},
+		{
+			"datasource": {
+				"type": "datasource",
+				"uid": "-- Mixed --"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "thresholds"
+					},
+					"custom": {
+						"align": "auto",
+						"cellOptions": {
+							"type": "auto"
+						},
+						"inspect": false
+					},
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "green",
+								"value": 0
+							},
+							{
+								"color": "red",
+								"value": 80
+							}
+						]
+					},
+					"unit": "short"
+				},
+				"overrides": [
+					{
+						"matcher": {
+							"id": "byRegexp",
+							"options": "/.*Cost.*/"
+						},
+						"properties": [
+							{
+								"id": "unit",
+								"value": "currencyUSD"
+							},
+							{
+								"id": "decimals",
+								"value": 2
+							}
+						]
+					}
+				]
+			},
+			"gridPos": {
+				"h": 9,
+				"w": 24,
+				"x": 0,
+				"y": 13
+			},
+			"id": 12,
+			"options": {
+				"cellHeight": "sm",
+				"footer": {
+					"countRows": false,
+					"fields": "",
+					"reducer": ["sum"],
+					"show": true
+				},
+				"frameIndex": 0,
+				"showHeader": true,
+				"sortBy": [
+					{
+						"desc": true,
+						"displayName": "Total Cost"
+					}
+				]
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"columns": [],
+					"computed_columns": [],
+					"datasource": {
+						"type": "yesoreyeram-infinity-datasource",
+						"uid": "${DS_LITELLM-PRICING-DATA}"
+					},
+					"filterExpression": "",
+					"filters": [],
+					"format": "table",
+					"global_query_id": "",
+					"hide": false,
+					"pagination_mode": "none",
+					"parser": "backend",
+					"refId": "A",
+					"root_selector": "$ ~> $each(function($v, $k) {\n  {\n    \"model\": $k,\n    \"input_cost_per_token\": $v.input_cost_per_token ? $v.input_cost_per_token : 0,\n    \"output_cost_per_token\": $v.output_cost_per_token ? $v.output_cost_per_token : 0,\n    \"cache_creation_input_token_cost\": $v.cache_creation_input_token_cost ? $v.cache_creation_input_token_cost : 0,\n    \"cache_read_input_token_cost\": $v.cache_read_input_token_cost ? $v.cache_read_input_token_cost : 0\n  }\n})",
+					"source": "url",
+					"type": "json",
+					"url": "",
+					"url_options": {
+						"data": "",
+						"method": "GET"
+					}
+				},
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "table",
+					"hide": false,
+					"rawQuery": true,
+					"rawSql": "select i.provider, i.model,\nsum(t.input_tokens) as input,\nsum(t.output_tokens) as output,\nsum(\n  COALESCE(\n    t.metadata->>'cache_read_input', -- Anthropic\n    t.metadata->>'prompt_cached'     -- OpenAI\n  )::int\n) AS cache_read_input,\nsum((t.metadata->>'cache_creation_input')::int) AS cache_creation_input -- Anthropic\nfrom aibridge_token_usages t\njoin aibridge_interceptions i on t.interception_id = i.id\njoin users u on i.initiator_id = u.id\nwhere $__timeFilter(i.started_at)\n  AND u.username ~ '${username:regex}'\n  AND i.provider ~ '${provider:regex}'\n  AND i.model ~ '${model:regex}'\ngroup by i.provider, i.model\norder by input desc",
+					"refId": "B",
+					"sql": {
+						"columns": [
+							{
+								"parameters": [],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					}
+				}
+			],
+			"title": "Approximate Cost",
+			"transformations": [
+				{
+					"id": "joinByField",
+					"options": {
+						"byField": "model",
+						"mode": "inner"
+					}
+				},
+				{
+					"id": "calculateField",
+					"options": {
+						"alias": "Input Cost",
+						"binary": {
+							"left": {
+								"matcher": {
+									"id": "byName",
+									"options": "input_cost_per_token A"
+								}
+							},
+							"operator": "*",
+							"right": {
+								"matcher": {
+									"id": "byName",
+									"options": "input"
+								}
+							}
+						},
+						"mode": "binary",
+						"reduce": {
+							"include": ["input_cost_per_token A", "input"],
+							"reducer": "sum"
+						}
+					}
+				},
+				{
+					"id": "calculateField",
+					"options": {
+						"alias": "Output Cost",
+						"binary": {
+							"left": {
+								"matcher": {
+									"id": "byName",
+									"options": "output_cost_per_token A"
+								}
+							},
+							"operator": "*",
+							"right": {
+								"matcher": {
+									"id": "byName",
+									"options": "output"
+								}
+							}
+						},
+						"mode": "binary",
+						"reduce": {
+							"reducer": "sum"
+						}
+					}
+				},
+				{
+					"id": "calculateField",
+					"options": {
+						"alias": "Cache Read Cost",
+						"binary": {
+							"left": {
+								"matcher": {
+									"id": "byName",
+									"options": "cache_read_input_token_cost A"
+								}
+							},
+							"operator": "*",
+							"right": {
+								"matcher": {
+									"id": "byName",
+									"options": "cache_read_input"
+								}
+							}
+						},
+						"mode": "binary",
+						"reduce": {
+							"reducer": "sum"
+						}
+					}
+				},
+				{
+					"id": "calculateField",
+					"options": {
+						"alias": "Cache Write Cost",
+						"binary": {
+							"left": {
+								"matcher": {
+									"id": "byName",
+									"options": "cache_creation_input_token_cost A"
+								}
+							},
+							"operator": "*",
+							"right": {
+								"matcher": {
+									"id": "byName",
+									"options": "cache_creation_input"
+								}
+							}
+						},
+						"mode": "binary",
+						"reduce": {
+							"reducer": "sum"
+						}
+					}
+				},
+				{
+					"id": "calculateField",
+					"options": {
+						"alias": "Total Cost",
+						"binary": {
+							"left": {
+								"matcher": {
+									"id": "byType",
+									"options": "number"
+								}
+							},
+							"right": {
+								"fixed": ""
+							}
+						},
+						"cumulative": {
+							"field": "Input Cost",
+							"reducer": "sum"
+						},
+						"mode": "reduceRow",
+						"reduce": {
+							"include": [
+								"Input Cost",
+								"Output Cost",
+								"Cache Read Cost",
+								"Cache Write Cost"
+							],
+							"reducer": "sum"
+						}
+					}
+				},
+				{
+					"id": "organize",
+					"options": {
+						"excludeByName": {
+							"cache_creation_input": false,
+							"cache_creation_input_token_cost A": true,
+							"cache_read_input": false,
+							"cache_read_input_token_cost A": true,
+							"input": false,
+							"input_cost_per_token A": true,
+							"output": false,
+							"output_cost_per_token A": true
+						},
+						"includeByName": {},
+						"indexByName": {
+							"Cache Read Cost": 12,
+							"Cache Write Cost": 13,
+							"Input Cost": 10,
+							"Output Cost": 11,
+							"Total Cost": 14,
+							"cache_creation_input": 9,
+							"cache_creation_input_token_cost A": 2,
+							"cache_read_input": 8,
+							"cache_read_input_token_cost A": 3,
+							"input": 6,
+							"input_cost_per_token A": 4,
+							"model": 1,
+							"output": 7,
+							"output_cost_per_token A": 5,
+							"provider": 0
+						},
+						"renameByName": {
+							"cache_creation_input": "Cache Write",
+							"cache_read_input": "Cache Read",
+							"input": "Input",
+							"model": "Model",
+							"output": "Output",
+							"provider": "Provider"
+						}
+					}
+				}
+			],
+			"type": "table"
+		},
+		{
+			"collapsed": false,
+			"gridPos": {
+				"h": 1,
+				"w": 24,
+				"x": 0,
+				"y": 22
+			},
+			"id": 10,
+			"panels": [],
+			"title": "Interceptions",
+			"type": "row"
+		},
+		{
+			"datasource": {
+				"type": "grafana-postgresql-datasource",
+				"uid": "${DS_CODER-OBSERVABILITY-RO}"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "palette-classic"
+					},
+					"custom": {
+						"axisBorderShow": false,
+						"axisCenteredZero": false,
+						"axisColorMode": "text",
+						"axisLabel": "",
+						"axisPlacement": "auto",
+						"fillOpacity": 80,
+						"gradientMode": "none",
+						"hideFrom": {
+							"legend": false,
+							"tooltip": false,
+							"viz": false
+						},
+						"lineWidth": 1,
+						"scaleDistribution": {
+							"type": "linear"
+						},
+						"thresholdsStyle": {
+							"mode": "off"
+						}
+					},
+					"fieldMinMax": false,
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "green",
+								"value": 0
+							}
+						]
+					},
+					"unit": "short"
+				},
+				"overrides": [
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "output"
+						},
+						"properties": [
+							{
+								"id": "color",
+								"value": {
+									"fixedColor": "orange",
+									"mode": "fixed"
+								}
+							}
+						]
+					}
+				]
+			},
+			"gridPos": {
+				"h": 12,
+				"w": 20,
+				"x": 0,
+				"y": 23
+			},
+			"id": 4,
+			"maxDataPoints": 30,
+			"options": {
+				"barRadius": 0,
+				"barWidth": 0.97,
+				"fullHighlight": false,
+				"groupWidth": 0.7,
+				"legend": {
+					"calcs": [],
+					"displayMode": "list",
+					"placement": "bottom",
+					"showLegend": true
+				},
+				"orientation": "auto",
+				"showValue": "auto",
+				"stacking": "normal",
+				"text": {
+					"valueSize": 10
+				},
+				"tooltip": {
+					"hideZeros": false,
+					"mode": "single",
+					"sort": "none"
+				},
+				"xTickLabelRotation": -45,
+				"xTickLabelSpacing": 0
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "time_series",
+					"rawQuery": true,
+					"rawSql": "SELECT\n$__timeGroupAlias(i.started_at, $__interval, NULL),\ncount(i.id) AS value,\nu.username AS metric\nFROM aibridge_interceptions i\njoin users u ON i.initiator_id = u.id\nWHERE\n$__timeFilter(i.started_at)\nAND u.username ~ '${username:regex}'\nAND i.provider ~ '${provider:regex}'\nAND i.model ~ '${model:regex}'\nGROUP BY u.username, $__timeGroup(i.started_at, $__interval)\nORDER BY $__timeGroup(i.started_at, $__interval)",
+					"refId": "A",
+					"sql": {
+						"columns": [
+							{
+								"name": "COUNT",
+								"parameters": [
+									{
+										"name": "id",
+										"type": "functionParameter"
+									}
+								],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"name": "started_at",
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					},
+					"table": "aibridge_interceptions"
+				}
+			],
+			"title": "Interceptions over time by user",
+			"type": "barchart"
+		},
+		{
+			"datasource": {
+				"type": "grafana-postgresql-datasource",
+				"uid": "${DS_CODER-OBSERVABILITY-RO}"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "thresholds"
+					},
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "green",
+								"value": 0
+							}
+						]
+					},
+					"unit": "short"
+				},
+				"overrides": [
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "output"
+						},
+						"properties": [
+							{
+								"id": "color",
+								"value": {
+									"fixedColor": "orange",
+									"mode": "fixed"
+								}
+							}
+						]
+					}
+				]
+			},
+			"gridPos": {
+				"h": 12,
+				"w": 4,
+				"x": 20,
+				"y": 23
+			},
+			"id": 5,
+			"interval": "1m",
+			"maxDataPoints": 500,
+			"options": {
+				"colorMode": "value",
+				"graphMode": "area",
+				"justifyMode": "auto",
+				"orientation": "auto",
+				"percentChangeColorMode": "standard",
+				"reduceOptions": {
+					"calcs": ["lastNotNull"],
+					"fields": "",
+					"values": false
+				},
+				"showPercentChange": false,
+				"textMode": "auto",
+				"wideLayout": true
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "table",
+					"rawQuery": true,
+					"rawSql": "select count(*) from aibridge_interceptions\nWHERE started_at > $__timeFrom() AND started_at <= $__timeTo()\nAND provider ~ '${provider:regex}'\nAND model ~ '${model:regex}'",
+					"refId": "A",
+					"sql": {
+						"columns": [
+							{
+								"name": "COUNT",
+								"parameters": [
+									{
+										"name": "id",
+										"type": "functionParameter"
+									}
+								],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"name": "started_at",
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					},
+					"table": "aibridge_interceptions"
+				}
+			],
+			"title": "Total interceptions",
+			"type": "stat"
+		},
+		{
+			"collapsed": false,
+			"gridPos": {
+				"h": 1,
+				"w": 24,
+				"x": 0,
+				"y": 35
+			},
+			"id": 9,
+			"panels": [],
+			"title": "Prompts & tool calls details",
+			"type": "row"
+		},
+		{
+			"datasource": {
+				"type": "grafana-postgresql-datasource",
+				"uid": "${DS_CODER-OBSERVABILITY-RO}"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "thresholds"
+					},
+					"custom": {
+						"align": "auto",
+						"cellOptions": {
+							"type": "auto",
+							"wrapText": false
+						},
+						"inspect": true
+					},
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "green",
+								"value": 0
+							},
+							{
+								"color": "red",
+								"value": 80
+							}
+						]
+					}
+				},
+				"overrides": [
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Interception ID"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 357
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Model"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 240
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Provider"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 157
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Username"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 188
+							}
+						]
+					}
+				]
+			},
+			"gridPos": {
+				"h": 14,
+				"w": 24,
+				"x": 0,
+				"y": 36
+			},
+			"id": 7,
+			"options": {
+				"cellHeight": "sm",
+				"footer": {
+					"countRows": false,
+					"fields": "",
+					"reducer": ["sum"],
+					"show": false
+				},
+				"showHeader": true,
+				"sortBy": [
+					{
+						"desc": true,
+						"displayName": "Created At"
+					}
+				]
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "table",
+					"rawQuery": true,
+					"rawSql": "SELECT i.id,\n       u.username,\n       i.provider,\n       i.model,\n       p.prompt,\n       p.created_at\nFROM aibridge_user_prompts p\nJOIN aibridge_interceptions i ON p.interception_id = i.id\nJOIN users u ON i.initiator_id = u.id\nWHERE $__timeFilter(i.started_at)\n  AND u.username ~ '${username:regex}'\n  AND i.provider ~ '${provider:regex}'\n  AND i.model ~ '${model:regex}'\nORDER BY p.created_at DESC;",
+					"refId": "A",
+					"sql": {
+						"columns": [
+							{
+								"parameters": [],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					}
+				}
+			],
+			"title": "User Prompts",
+			"transformations": [
+				{
+					"id": "organize",
+					"options": {
+						"excludeByName": {},
+						"includeByName": {},
+						"indexByName": {},
+						"renameByName": {
+							"created_at": "Created At",
+							"id": "Interception ID",
+							"input": "Tool Input",
+							"invocation_error": "Tool Error",
+							"model": "Model",
+							"prompt": "Prompt",
+							"provider": "Provider",
+							"server_url": "MCP Server",
+							"tool": "Tool Name",
+							"username": "Username"
+						}
+					}
+				}
+			],
+			"type": "table"
+		},
+		{
+			"datasource": {
+				"type": "grafana-postgresql-datasource",
+				"uid": "${DS_CODER-OBSERVABILITY-RO}"
+			},
+			"fieldConfig": {
+				"defaults": {
+					"color": {
+						"mode": "thresholds"
+					},
+					"custom": {
+						"align": "auto",
+						"cellOptions": {
+							"type": "auto",
+							"wrapText": false
+						},
+						"inspect": true
+					},
+					"mappings": [],
+					"thresholds": {
+						"mode": "absolute",
+						"steps": [
+							{
+								"color": "green",
+								"value": 0
+							},
+							{
+								"color": "red",
+								"value": 80
+							}
+						]
+					}
+				},
+				"overrides": [
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Tool Name"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 342
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "invocation_error"
+						},
+						"properties": [
+							{
+								"id": "custom.cellOptions",
+								"value": {
+									"applyToRow": true,
+									"type": "color-background",
+									"wrapText": false
+								}
+							},
+							{
+								"id": "noValue"
+							},
+							{
+								"id": "mappings",
+								"value": [
+									{
+										"options": {
+											"match": "null",
+											"result": {
+												"color": "green",
+												"index": 0
+											}
+										},
+										"type": "special"
+									},
+									{
+										"options": {
+											"pattern": ".+",
+											"result": {
+												"color": "red",
+												"index": 1
+											}
+										},
+										"type": "regex"
+									}
+								]
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Tool Input"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 309
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Interception ID"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 357
+							}
+						]
+					},
+					{
+						"matcher": {
+							"id": "byName",
+							"options": "Model"
+						},
+						"properties": [
+							{
+								"id": "custom.width",
+								"value": 240
+							}
+						]
+					}
+				]
+			},
+			"gridPos": {
+				"h": 14,
+				"w": 24,
+				"x": 0,
+				"y": 50
+			},
+			"id": 6,
+			"options": {
+				"cellHeight": "sm",
+				"footer": {
+					"countRows": false,
+					"fields": "",
+					"reducer": ["sum"],
+					"show": false
+				},
+				"showHeader": true,
+				"sortBy": [
+					{
+						"desc": true,
+						"displayName": "Created At"
+					}
+				]
+			},
+			"pluginVersion": "12.1.0",
+			"targets": [
+				{
+					"datasource": {
+						"type": "grafana-postgresql-datasource",
+						"uid": "${DS_CODER-OBSERVABILITY-RO}"
+					},
+					"editorMode": "code",
+					"format": "table",
+					"rawQuery": true,
+					"rawSql": "select i.id, u.username, i.provider, i.model, t.server_url, t.tool, t.input, t.invocation_error, t.created_at FROM aibridge_tool_usages t\njoin aibridge_interceptions i ON t.interception_id = i.id\njoin users u on i.initiator_id = u.id\nwhere $__timeFilter(i.started_at)\nAND u.username ~ '${username:regex}'\nAND i.provider ~ '${provider:regex}'\nAND i.model ~ '${model:regex}'\norder by t.created_at desc",
+					"refId": "A",
+					"sql": {
+						"columns": [
+							{
+								"parameters": [],
+								"type": "function"
+							}
+						],
+						"groupBy": [
+							{
+								"property": {
+									"type": "string"
+								},
+								"type": "groupBy"
+							}
+						],
+						"limit": 50
+					}
+				}
+			],
+			"title": "Tool Calls",
+			"transformations": [
+				{
+					"id": "organize",
+					"options": {
+						"excludeByName": {},
+						"includeByName": {},
+						"indexByName": {},
+						"renameByName": {
+							"created_at": "Created At",
+							"id": "Interception ID",
+							"input": "Tool Input",
+							"invocation_error": "Tool Error",
+							"model": "Model",
+							"provider": "Provider",
+							"server_url": "MCP Server",
+							"tool": "Tool Name",
+							"username": "Username"
+						}
+					}
+				}
+			],
+			"type": "table"
+		}
+	],
+	"refresh": "1m",
+	"schemaVersion": 41,
+	"tags": [],
+	"templating": {
+		"list": [
+			{
+				"allValue": ".+",
+				"current": {},
+				"datasource": {
+					"type": "grafana-postgresql-datasource",
+					"uid": "${DS_CODER-OBSERVABILITY-RO}"
+				},
+				"definition": "select username from users where deleted=false;",
+				"description": "",
+				"includeAll": true,
+				"multi": true,
+				"name": "username",
+				"options": [],
+				"query": "select username from users where deleted=false;",
+				"refresh": 1,
+				"regex": "",
+				"sort": 1,
+				"type": "query"
+			},
+			{
+				"allValue": ".+",
+				"current": {},
+				"datasource": {
+					"type": "grafana-postgresql-datasource",
+					"uid": "${DS_CODER-OBSERVABILITY-RO}"
+				},
+				"definition": "SELECT DISTINCT provider FROM aibridge_interceptions WHERE provider IS NOT NULL ORDER BY 1;",
+				"description": "",
+				"includeAll": true,
+				"multi": true,
+				"name": "provider",
+				"options": [],
+				"query": "SELECT DISTINCT provider FROM aibridge_interceptions WHERE provider IS NOT NULL ORDER BY 1;",
+				"refresh": 1,
+				"regex": "",
+				"sort": 1,
+				"type": "query"
+			},
+			{
+				"allValue": ".+",
+				"current": {},
+				"datasource": {
+					"type": "grafana-postgresql-datasource",
+					"uid": "${DS_CODER-OBSERVABILITY-RO}"
+				},
+				"definition": "SELECT DISTINCT model FROM aibridge_interceptions WHERE model IS NOT NULL AND provider ~ '${provider:regex}' ORDER BY 1;",
+				"description": "",
+				"includeAll": true,
+				"multi": true,
+				"name": "model",
+				"options": [],
+				"query": "SELECT DISTINCT model FROM aibridge_interceptions WHERE model IS NOT NULL AND provider ~ '${provider:regex}' ORDER BY 1;",
+				"refresh": 1,
+				"regex": "",
+				"sort": 1,
+				"type": "query"
+			}
+		]
+	},
+	"time": {
+		"from": "now-7d",
+		"to": "now"
+	},
+	"timepicker": {},
+	"timezone": "utc",
+	"title": "aibridge",
+	"uid": "0c61d33f-c809-4184-9e88-cb27e2d9d224",
+	"version": 43,
+	"weekStart": ""
+}
diff --git a/examples/monitoring/dashboards/grafana/aibridge/grafana_dashboard.png b/examples/monitoring/dashboards/grafana/aibridge/grafana_dashboard.png
new file mode 100644
index 0000000000000000000000000000000000000000..c292bb0cf498da72547da42f3e6cc444838d4509
GIT binary patch
literal 474367
zcmeFZcUV*D)(2`wK}AQ3(oqzV5)q^mL{w0!A|1j2(xgeRNh|{>ND%~7ny7$u>76JD
zp$L)Q6RDvD0t5&lklZ)Uc+UCm_ndF$jQ9R`cpgYdvUm1=SNpBsTI+qHr=xy|nTvVH
zjva@tYh1atV+U)@jvf16?B54op*Op;?bxx?)KN`M@4A|rfS!k&oujkujvZ&8xkRgI
zHvD>|DRtoP2M&?(ndrQ820{km6~>B>zY3OwA&&@Y+hmu_I{k7J_2^M-czA5;>w!;K
zzkagNTjt)caA5ZJY3%TO$KF8s6n-=b%gf{yY|zwdwS&F8(1V54H8)fx1U<Fu=<fZh
zw=O28v!B-F2y(KoARno~Ml8b$sxz0{_-ZBlE9CR#J2xzm>Q}<5@}42|BJY0j*kSd;
zc+mGae)qU)c>GD|xbsF(Q{^|$yeX4b+sAHCY)r3<|Dy7XFtdyI+X&Gq<pn3EI{0nb
z1k$_h=W5L-qlE6fdse?^bQ(##)0U{pelYaIheNwh%SF%dzcmWcso8&wtLd3Qd{*L9
z5yS+poaJuW&M#Ws@3F7TBw5Uzy8<Ap;yNT7#gE=$S@D~mH$NR3HoHEEuT%I6ANO|?
zy)U;*nqP@nyXfEUDX_Z7yfXEz-meSC$JH)?#SXJIzHX<jz2h8szJJG_om@Nif@eFy
zFLWpOKb~LPd3ML{@2~ILu_M%R$DThvqXQlpKhfZqam??JyJJFjFoFMm0l$8)cm4P@
zYs~B2Kc4S<0p8o8s;_qaI(XE#@vyaZ^>lFax;2-b4_-KMPs7A>#}1CujNhHtZwW1d
z^A9-QHuf^s)>5!>bCIyR<7RCu;pcLXah@GYehT2Ji>;THfS-%AtEYmW^2zU?Pyo*v
zFGEfWeE*1-lk!PpZ9M@sHxF9@8Hw`}=TAbJ1q1|?Jnq;j+`4k@kHf)#$|oJXyzVJL
zAilo7624LrZXWg!NqKpB$oUJ93m3$}C&WGdUA?UQ#9cj4{eF@k=ec6*Y2)E|&&$!x
zRe*6`D{D7zFXfXb8DI2|pWm<3*3a>u-{k7~$8CWdgfQNLNJ^ZC{Nvo<P$kBz3VM!y
zw$3J399_Vgf$xAy%E-wneLvuTz4gzp{Fg(G|9PmCyqwIx9{MkD{l5=2@U-<%b8`V-
z>IMC$!2US+U*G)WKqUy{-v4DSeqZSCuY#3^GAlv;AvGv7Q^$@IK#)9+S9EWKN1$em
zpWRyE&)MG}!Sh{k^K;y%C3ft%wBz~})!TkM38PFEY`vpQ-&9`j4}1L3!p7}Mt&?;U
zR<Q}ot|?~x@gXyZp4j_=z{beY&&K2S=t!<WVr|;lU30Sb?xCZ#fsVcq^L(Nb>!Q4U
zN774wOs>hwMq;;hNTk#@hs>@$`;Q1*y1!%R-+$sDvrBwWOJciu)zQCyk{{Q=wr5X^
z^8Wu1F3N7#!^w8%%cF;X;?DlKC~!r)|9eIM_d5P}jecnGzc;7<uF-$j=)eBx-v=9q
z|N87djl=(4qd&(g-`D6+(%0H5o+E8y#h0P2=?Tf4kM=3Y^rLSNAW^P`1J;_;79FT>
zPyN;hGgqoEFYMJ>4D|7uIS;q`mWtSvJWQyvU(oH^b4_WjhxBH<WP!!#!X#DDeI|`6
z{UC=6et=ieCk$GPdCVbh%Eo00UrV3y4M^?eecoj9It#NVhkG3PGl1ce_TD`$+|B-m
zbWQ8UN_?Ao<@8Y7#1H{f;mip;FJPDKy<X$QoQCsgTl2R_Ti;cV^{_0td-1B(Hyna0
zE;H!0HkA7Az*9e}3%&jFkT?>Bu`H&Vzdc~yJEQpmN!vTIir}0+WEr$<LMWs5`CC|x
z?0vOq9z{)_x&G&?`|o{t&#g<*H4k1roIJEAsX3G-M)%HAfR3;RjP=VNY4G2US86|j
zH9zuSVw^ozOapuA<CCBY0m_wq1$eKAlWQNfE)@$<_Pmz=?N6=e-(UOIP5?Z)<y!v#
zy?CXphm-oc%Gw9%6#Q{YTl2orPbJ-DQA8Af*K5hHPqP6C%2dJz1#fkTFGucDUVfe&
zY|~jIy2g9Hud~QD=eP_ZvrAC;y?IVymz=(KZ$<}?jF7o`j+1D;*POJ?*7~s9@>;*8
zeJYCM75cPBN=nw9?fHVYks^_@b*bW}B~N`8hI%EraPDE-nJxMAc&;FFm*4D=-7ClG
zjoD0oo91X@SmygplljUNk5-Yl200>kSCouue~tJVW&S9{eniMkfc}{|1|v7|rLZ5y
z^m)Xyott4oA{j4=?oFZYsIIVG;`JkWyAQj_My|QWn|r(*upw_VkM+v94B4snaRl33
zi{v><tR?FlJbuqnX>Ij&VPvd=bII6rXC-M}vf-c<+pfYa@x9iTf!lF%v!89OugFYa
z-0ceat)RQE9Oo}}SlKJ}c5c<SV@IV8MuLhy$wEJETAp$aRd)2$wa+;Pb!`0>zE^9O
z#yt(9c>9}{55#0f6Q>jDr(}k`avX4VY8+KA26EcWYDnrr`SQoz<j?n=BqGKdLZjAJ
zMfTJXp-kv5O$dLtj-m?`>6ptOLOa5$vWlxvDCSSlql33Ns~4)=zDS~zf(7m=_`gE2
zssyR%C@=h0uN0{pU6V$xq)eNkBNYkHxXt~n=*PFVq})G`p_`OQUs5p>D4MrZk}vH<
zFk)?Qi;;!*+5n<@v<UARuc3-BNv9wwQ=H>lEFEGaHfio+bmKFgSVz2sB%a4}YU15_
z>e84B+Nq$HC&4_xwPt%g(dLA0&!U$&6Q7^)7b$X3Fy|Sz)JLo1zZKMNUT{TCWK>K<
zK3Lm_jZ$8pG<NPxXMVKJfogQE-af@){_EHPlI|+Gy~;~+n(5n44aO_EH8Ync&5IO$
z_1pAqwxkvLeUY0G>&(zjyxIR;`H>23!$xVVdAEDZX*_d$g3kR5|92koe|m@)PZ@qu
z&i~jcjk+OR-_u8j6;84q>i2EI1(6KA2Ax8)Rll-bQJJ2BO8Rny@D8uH=Fr0zN69(m
zW~Mu<=`T6a&c*FF-BL?pyrSM7j_lS^h7e;fmsb;p<O>ow)(5MdoIiZBOV>7N1Hs}K
z;S?{e+O*MZra0+Hr|6(Q6Z@!cs>P9Rt?vBEnW{#wR5U+w^7!t>WJR}x;J3c*4HMq#
zCwgNpPpR_^UW5hA25(kfA-keKXXoVKB+{gtuEPTx$3oXy8@97tVzqPl^~0$no|tXx
z*a&sZ{F<ye`+Pz9b&k5!e1Za+LkPJs#$+8XUM8ZLQ4;g;8>dB(k6?+#5X@9(j1;Rw
z;AfGj&~WtZ^$0k63Dr%#J(|F!|B<%T5YTi(bX%OYp}(IJ%3p_pJ^Wzt4%50Y;wcd&
zUz{MsR-RH@b+sS`PNImE8SQIvlJB2AeMmUDM<wuyDs_A|8<D}O&oktL^CPwQ=PdSX
z{7gL1f`T0UP*P6Q;h4<c6yM=enn8^ygigY!M2wQ(b2rsaj?c5?L>sLa6wp4$Ml~G}
zUVUFhU1@VYmm3E2w!c2{)j55kOTY)Nx>Dk?)+$<H=rQ>s98xDI7fI;!{*pX5s3@Vj
zGH9PF)gezUD%?j7&(u&|$Y=7-s;XZL6V3lcIZ`QYz&kfpq&e{8&cM%9{u;APqSa_%
z)47~nSY~aJU_|FRGk8@+FQ-sJFWhinOK8+_zPwCl3ne&BK10BN>LQ-WKqSet!_l3L
zTzp?FycY$jUJY>%kO^nXWM2$im3wb2PF31?eadF7w_n7GTmN)zvml(@#XOg8W*fbQ
zPYt~qa6)a$kV~jw$~-eceN~0@M&Z+1D~WU7(VJ>fY|xDY_Glfe`!mGJuNT-Hx>Q#d
z%0^F@wbRT47pB~`*X^~;3W?$Lw#!X}*&WB6oCpFGZCR`ZhXSvRv+==z@iC1YS&TxP
zbK%fkr^a0@V&*>8!l@q4R>(s4ev9?|;x1COAdcOz6G13svZ-3<edCE=nBQ}+d=tIt
zZ77R#DTiB=+RG#kTWn~FUPW$nQkPe|A6ZYow0n{sZz?fVmRyyqn|+%lrr<-p<-~iw
z+P2M%9h<x9zHT+!ecY009%R_XK4V!0uNQT>n8v}@p7K$IzR7UK?WWTjFmW&X776oN
z3IjcHN<H%F>3Cy>cuUu*B7<z?mb-&<ZF`7q!q*J#;p6AOl@;lEGkc>*i^GyL%b^ps
zWZaXf1WWloWB6!MVG4Y)WoEEAaL^b@BUyKn-xaqG-8vndkQ#7Tuf%!q0wc`K^f+cH
zz~@+E`sbjck0u*gG%$_AsX=V1$Ym3)WM$TJd(zrBH8Q6UMuq-xFpS8_Q5_Gj+wMqQ
z_9#0?UG4T28_}O_+kXqq=7qHiZMSx?gH?Gi1o-7vHU*?>-}H+wibJbx6JlQov)raH
zxH(-jEv@lVB-bF8iAWr5h^@Cq{}Qd&$TCcw&tD*9dsRO-A+IWBGtRa5@?xCoiZ$Jf
zpC7)eDidnSY3QbsM!vax)y`mHWcI~@<ayw~3Y>%2SCy1xH)j22(&$aiVykscujZS6
z35Uei2E8^|?mD?0IQBU<VA^}{PpR0-F@}mk;T?|~IV_4^D`cGam%IX-#QDXdIKv}o
zgD+H9P810&up1rxLKNJ4$#=k=q#?M}l^0lUW8G`ee^xpjN*+b}t`d<R*r|G!eV=oS
zJ5u`R%{r;sqHZEA&Zz-&%l=E{e)k-YD3+%8Cir4)+cs!a!A6PTZ`7BA%+19Z8GCFz
zbMM2+{(}|D8OddEEHOeB76H6___M+6p+@mM>CtjGy78T{tKr(qqrNycv6T>avF9)(
zvw~ZZBZV0^pI?2GK*p$%I%Dh$Y*@qXQ{m^_G=r~lm`JnukRfJMl&4ZUPpNcjY7I`o
z$?Z6GG4LMWS8W^Kpl0mybYcM>e#@#|>@2Qy{;0nhGY7GR#Nn^Z-T|HOdf}As-!>Gm
zHV4~Zo*={LV_aZ7Re*%Jgn41LWq8+u*nE3dpgDV6y6^UlvJMv<5rU)?uNKz{_?L3-
zxgF@Q%8ba|;pgszLsT8Vx8~A#cZ>vlq<HQT*w72ZU8v1$v$xubouUsj?{CDL#TO`H
z#o?Jny*RTHhnsR+z{^9F@C~7?5MGH$g>2v44_lU`GBlGi4}6m+xnDocG+GJH6s5el
zq>&SA<XW0C&+S%GO+e@>&At#jOVb;4G-}(m9?GXMSH%Je*;uL_Ag5M8U%M&z@ALG3
zkD`BYUuPf>&hQFZIv1XPt4oyf=)7yS(t5<d6iV3<q37^LfKo$}IAWjTeiP9v@{JOe
zC;Ptmh99%3TV<onGsAYoM0@`VEj`$0AwxWupiJLlxyr0W-<&T<uV$H&2wddncB`?)
z(k_+7c!J0`xfW-%X~yIJ*&PT&M@f<;9SY;Sp}oL>+2+0rytb<Itpb#hLFUeuf{Jv#
z&9Y$^^NZ$*P2Bg^@+2GC-WtV1Kg{zj1L(}b%AbiT+}lD;^}qf_3KK*zE+6%=F%N2y
z_pdGaz(9DL^KLP+wbVtkLi)~X{F?O`1Zh(9VQ%9aK2^d@q^?2*9ywc;;c)TlND!&k
z|GoSga%PO)B$D|YbM>yS*%Zsp?7b~c{;9yOz3N7Na0+!>E8#aeZ%?HHwZ<ruZ}W5)
zo5f*|a$0)1d{H9hQtDbiZ0A=Kc+KwM9*oE5TVW)I(e{HkCgX+~fD*l~ke*Aa5bN3Q
z>3-BY6hplsTEHcmS8><ed+oG=+A_->Tqa^$qB)8RylK(WW*=CfbB`wD`e8$rlG9bI
zgE#OBX}(c@<4@Ezb<NHe)b{OLZZEe)f5WFp1U^$sj^z43!PuW@!Go5|udg$;#D05G
zKN+iVB_+Q=^3kN@R_hT5W>Ip7p%QJiJF0u}l}nykdE_x_(g_Bhflg~eP)9=f5tm>p
zTOVvD3Xm4!1;~{a^-kM@1yX=*nh~b1@XH0!$#$@W+vItU`P^cwI{GIjVz|DpqF{j$
zM*tbB%wg%ARYS?nk%;7Wtx+h5(oE|q9txW*$F1X(wo=yJss>*Lv)ATCBpcq+70u=>
zw`vG!G^7KY<;7#zq;=ODdkeZB47;GN*R@hxMeTRe8q`CZ^fdyy+xxP~RWhURJPCzp
z1cd?&`gdXaV*N!A%YATt4Mn}q)e{GKSNf`!!7vAG1LEG=GWCF_Eo*iPDR|lTYt72(
z{c$!a?wi4qxFDA4c3tIdKOWzaqyBJn7R7}Ud*@#NRo`!!sR*$eLfYyEP~49X`ae$@
znHvwChR8OVr^5Se2k)+vCh^A=Rzu~o+%U(LHeS|fKlq8v_lN^xmo`)*r8y_KMW0$W
zych#z9{vn_QsajOz>Tc9ux0$~gW&MYHWmHjtD|IWB)<6k46-<`At$dU$yY)|>!LxT
zvFjlF1SDMIrm=rulaAC?>U#IpL>U*&fQWMdRq02|?hObZKBf!h5>ER1);N#!(oj}6
zCyBGXRlwiW1={Z7t|>SIL2cE5x8x_D7T@U~JmZGKr&N#U7PlG2clh?{AJ>l#dQ}p(
z>FpcGO929p?-dpG?2z}x-WLCmO#H&^xOW`@4;c=VJDo3F`Uc;sh0dPJW5b;@qf~i_
z9*Xf@tg#@}=qJ>)0a(+xuIT)#UzDX=yI(NBZmzGUa;54noMD!s#l2m+`Szu&<5vxS
zM}uarl{)Ue$rwQNTw_KhxTb$1ap%*GN?a7Z>#C9T*a<9^76;BnA0dA;cB}2oX+b5x
z6V`{3<*ly%@RrjFPZ$An$s);d+Qb^*DC<{_87-CydIUKDU61K1o#6}IN*fonO$Clw
z+HZ<QHcXgD()vo!#u#<EOB2IsSb?01qqF-`gnq^!zk2ZT&QT%VjyS88Thvp5UJ;y@
zJmy2vovjhPLaDa#gX1Oo7}4Kq(O&u@=0WYH31|!7(Oacv%!`Y)M*a0+6X~LsMhjbk
zHUQIp58fs_swzMhdfL6=kP&;1H?(_h%#nS0-0*~u3UNf#CQ_budqf$Vih+{vtP%#{
zHIdvvd}+=X*Y&05L!1-c>I|Q5+1?pEQcV~+-Dl$a_C=WmwP;<^;Krj#>Z0epToi5Q
zD+#!HE++mW@{7Zm%l)jAqDhQ=<-3@eXhiHxe*yV;LBRzLTDz<zT1U}MvdPA^W(;Qw
zQJU$^2~;8xVuNj5Yo};p(YSLe2(oh769D0)fsg1jw;7!o@?K@0?CnUsOrsKg9mL8<
zS|z8R>l+@vSqcS$nTS+WN(l(i>z!~??w=K!9qK0Edlt-@7tmonfl*-%2QEsWgMcd^
zn2h}y%LDoBnM48q3;7&pQlAU1cxeL_G;^(mO4NFd)Hf$s1gLqn8t#F(Ccu1PBY^B{
zyi1e6T4wEyfx&H_G$wR3e4=!O)lWR)i-f`>C7djz&EQ+VO;F?Zy0j^5!LC1;C|U7z
z=QfM3shbz)OEq+d(ki;cdfy+6u?*@gl_Y&Bo~EM9m+HeYSEKltBKoatm}87!M888@
zf%rUHA>ttSx<0}I7uyl0LiaDMf#vDVrffdn*TO3IIxrVR3rbo+%_eFF3rB(Xq78`>
z9k#a7HGO20aF99`-&{z^uU_wPW?%B5<YVEHVXBY#M0zxdvKJW$et9BFjZ_yG%s}gr
z&}?0-d1Y%La2t&jyahX8QKpxWrq^rNp68L=xj^=`W{&5KXZIPfBG1%J`PgieKLYgj
z3lndRQ4oDQx~n1Xzz^v0H)7U<7Oh{4m}7*8yUtVI9e$QMFF*T^ww#~>NeK&f394@|
z9|>~Pl5Cubi=-xFh57uxrHt!&Lx)Qox##Uf%?beEvPtou4ll9xD9yX@1wr~4IG_7I
zY1an`YW1?!X|gOfNF2}slnv@#Cp3-f+ZLL8FeWviwX*Q*Wn>2#7l=c>0iFcJH>+-K
z1vFpa)5A(eA;H}@=2`4=?sJyYx83dmg#XeSWU{lbEL#_?g32WKw%EUNjIRJ0^vW26
zG^{^I^lva`2KiDmY|lNlci()5e1;q`1KFf?@5mdXwkq3SjxA4f7c_<sDkC>%(eCZ{
zhubc<rT-&uWGi>8qntCV4Q#V6?ZEfw>mKX3^fki5PJqRS_np*$IuCppnB$+H>Nn5R
zt7;7xLIDhft|rzQ%mj2t_@Zy?m$tAf(tbNN(IU*>HXj$<T1nZMV6`cz^=+<B_HVi>
zNvvU+T)V9iNvt6mTCuN|;{r~lAjbwT4{Syb(;>wEuLAygcm>o49Lwy~uAJN=)7<s)
zi!8X>!@PFyH$B40*g(baezl?Z=Y*~CYY|I~?8V{Tta4&~rcT>iMInc`1<M9~-qye@
ztpMLHnhTORBx>6?0(@s?iR06$64Mpe>cwM#CiE$5U1Iacv1wt8+kApI%{|+X*{6D&
z)Iox+bQQ9Ul-4)Y{LKoNqVjwm^ZJgwHI4u=d@Pig8@WAymqLToZHV~{!{=*YCNrbd
zRpX$-^p$B41fx#rK4v#EKaE4uw|&tk>{FiibH6<g7zhPR$Fmg|?km^z>sOirE*JHS
zI=`nwZ(NaE&Df$tx1HCKDrt?nX|DNe{rT#Xne?fIXN7~)PE%{G_2-b=fjl4;si_=-
zgY?7cs1SXj9LJpVfxgs0rg$fCOuv}Wb;nj3#mij9=k<lBBKZs*s#n4iZ8m4^o5`#^
ze%j`U#$f;2qI+BJnN2a85{a@X09f4z#;EwU)&!*ypWz7imUR3S<iJ^<B&*Fx_eS>J
z;k^zH(KV9O3aE;6!SUi|9EKvGOyP2>_WtXNbbC7nhVn!;ZbN@cgc%S44eUqx8=_Rc
zfSFF)w<G@j;_jdJ+Q*j~7)qcB88ZWg`dD+zds4xT36_Yd`Wu7<Kq3pO)wM;5aL5eZ
zBMmqefGZW-qL?`s&CUgHt`8GAhMjBm>xh6&dI~5q{94!LDdsWYkJ&bL#)w@DFH%Ow
zEAc7kT+Ti3uC?%)jj+w(1@Wlg+_QEj;M*9b5Jx{RR5t7y3q)(|)p?rPY7F?hCxBeO
zy~vljIq-0DcYdAtP<g5Z|9q0CPIxulQym5of7hEVJLnf)&)mz8*g(wYU-tj@G4Kt;
z?X7ox^TfVjw|i+@RxwlWbR&^DZ4T54ZaHZ7$L8mFX<{y$`qvG`@9G!vvl#h3uPEIg
zlj+3U%}fS9#6zsMXQk0B%&Gy=YIvT1dspbGC?%+&se5k_lKGt*sv%<;R0a$~F}`<#
z5A$Y3wLz*22~#Wy76=4LUc7@{<4Dh@1@}^OTpZIkO2R;P`dzF6ts<FE84ORniCwUt
zQs9Hn-#%g3AhL8qk7H9k`63{Ll>@y&YMn<Nl~{PI^)vLLw8c)<6|OJZQ+K;Wn&J3l
zS#&UGvVr|78=La_fW9@2!XY+H?&*#~yQ3pu-U<u3=AG2`a#+-(!*jQM%(LI!UwZ<-
z#?-HAl$(F>B?>V6oo~^q-c1^!p{e)k9Zi<1ZR-GhNbwm_TEc34>KTvk=&c6)3P`5H
zw3jpG@savE@|n)T6D7sqQyp=J2-n_h0|Wt33w-#bVMqZdi=*vYNxkp#=B?Ltm?!FJ
zO-QXC;et-84NDBM7^7PFX)|%!CjH~4M72*o*Ebc3L^Ru1?cwHUr;09Zce{@)zr`<A
zIT4>aW;iB98C13U0deanuhkeke7brgvGw7kqk1VPD`C)<x<M$`ZH+XuUpQn#->!};
zH2`!KuxNH6T})Tn=z4@KE~u8U$*2p=VDs!vhGTW19O%@0cd%t2LGp}3a00*U2Z+3h
z&#|phnhW@pz^h;6(dJpk16|}&lHq*Q(pUq_+UiP()4mZJ6?-;U0JSE=J-udaRW+;d
zc`x45LI!>4P)ueapo^2sM<jf({;MddkVD+@dkL~F#8N-VtYR`v*>KZBX%e(!f)bR7
z&+<=|615nu02g0;X#HU4-du8Sg;BoXM{ZeJ*)IA|C#!J4W+1j!?LA~*-cM@Rv1vMI
z{kpZw!<2pK_U;w+_(!Z*PTvv9^RTvEDN-0Er`+20eTAUFl8_gaT;CW-sB}rA{|Iq|
z#~r7p6c>4pTOue|-+guFvPlqgHa+Obsc6Ik@`j|n`o3JeTH@>4IWkD<sBEVMi;nNi
zd9^V_I5musGxQ+7?F?-+b&7zQD3sQ2uXDSDnsQU3TkW&FA*^Jdu}$s3IYl>+4RtTp
z$A7tXo{HuV<w$Ir^>hZ#Wfip&_P{pBAoD&6kbqqDN_@x0SSY{sply8An(TmdyqQmW
zktfy{hno08gOkc^0&Q~~Aj$#k3m{!m>QJOV^_$C59n4-vHKo#Pj0uT*`|+=wuv;&z
z(=K?yD3|Z|K!W2z)JgK2?4-9fy%6rR@O^76Rh<39WiZEN&g+l@0FG}|W2MU$)1Wd~
zhwy<5ENTh+lJu9T_ji*Y`{Lj^1VfApG5ZC4UA}FoYi^Cx(nDvg`Xb<FnxKLFY%GSq
zt>^6R&<9kLY}oL(Pr7J!Bbf32%FM589&LGS7OYB23`%$)eTjh$#qj}6C+s6NA(eFm
zE?gjSp<?<~o6Xl_QCEfuilv)#^H=a4!}hpR9e>p77w0mHsezFfMp5J^5Z=yR+NPj-
ze671X#~x>F_mcgLLrEPxkiGt698)=9f?aEt7mK3(3U!$S4ELeJsga6{OGWJU1$A@r
zFI=l;!>dUcwjuFDGt-I)2q3jHEqV>V<}1nc>VNfR)aQMHL1qSOd|EinI|s8w{2Ev9
zQa)<Df4|Y-#ik6vD0P2wDkxRuxp#>y8L3|>m1kbJ;KPjuiA0-k`u)XEOcAh))fK1q
zrgitdxf*V*pNs*JU@qDamEuw+Kew9K7u|7_2L*UMUi}<u?$ziZXN>i%az=tkQozuG
zbnRe|OdYAFMotUaCi|+D*J*0V$GkoRV%O{-EN4f5P=cC?%u|wZ;;m5AJuTgGpkOD3
zsW>~G?E664dC+k4>GOr=bL0_Eqa^Qjk+}A`pQ`uX5fadVHMA)FN_QQc!*WNG9*YD8
z%{ijcHc`sAiIR@#vr;;!^BFI!TLY+UzE64NPwL2*F8Z-Rwi0H#sZTXTMWP(5sVcso
z1Lj?me6t`LDGEFu8c_`RjE93vn~M7;M}H_aK`55^edUuKy$PT)cU-Dn8kmY!a3GOt
z1eoTP7gasgZsrdsXTOzjZ7o(WB!(8w^PV4;1V~nH=9|RwSSYc7)@Su5+?q0Fl-~^-
ziZ<`c#)GqHV$A`IW7rJE6WXjdXBDTnv)LDG=Hrc>+SiKNM~2ya`Z<Mk6`kBu86nqT
zrrS__$$Vg$s?sIp|M{o|i)d9s8E2bg=`yrdH!3TG%bVD^em4~qDZRZGs_cWd+l{<^
zgy(7YFrH+E_S^QBj%uduLFsXZ?Ur+TISl)#0tNqPhEBRUu~BV4ZF&9Z^n?^y35&I#
zB4uBFxG&%zA#9%})?793O8s2VvYn2Nd!|3&_4T#-_(L%V<yCZ=P3=Rr9i#Td{6a#J
z=;VXmu1B}-Z*8+;!)*e24KK1KZf5kp(gnRTz2_YjXhm(1$NiSb(>n5$q@Wp2Sdc`(
zs@z$SV%s(EYF8wDF#95ld)S$8K|K!L!uwH^Wha)!j?<gp(m6f9EN99As({o0N-vp*
z9c@=Ed<R8AiM8Q{-76o8WO{Iv3hjJ;#Y(;8KB6YoNEGJ*7}c{#t)25;&djHMXFV>7
zReY>B*ge&<0Q}|Sa0#el9UY-j+RZ-XGh#&^0GP8FZxyBh#|9FUXAlF3PQcgOtPkS9
zkll*gLkv<QRxjLVWB`UHwrdI)qpB25h@#43h0U)c_qI`QT!yn)CenNBWQT*=g9xpc
z)rg*;EEXwVHgJZ2y^c!bwO=PD_UEv7vHWtw@<Mb<t=i$y%%z79due5cyhOG>)LI$0
z^~d{~Ifsn;;$d1J=!jA4$|=Kao97A{1{3@sg(Oh>Q5`oX(|4Bw{}ZV~D*>hU)AQ!K
zrtQ>D!U<yFN}>C_I2n(pNK&D0$?X=iK0msF5+i2^#Zv+ovp~9%7VnwdH006`x6Uh-
zX|_DC7l2*0*Z^GlTT2x7SsnSO`n!K!;RKx<@8q=vdjN15`!=ii<w#b_!>_~|s$tM-
zC(|*nKDK?yz9|%&6oM{u8)BW3xeSm>q~vFF|2HB<=SeY|;%58RGtWCSUr<R29@394
z=^JhprHe<(ZB+yfV4zf?^#RXea2sQ~o*lfTFN#Pn!hndW-A<A(E>IEcH_^MXSnW2i
z`0nO#W=g;-X9>>8N}9B;Rr-8E9qj_vAD`zZo7iTF<n=9oX`gb@(0r_*Q^IUvGqC^_
zhTo^cn;NvzxyK?ffP=%tuajW%0umB+JY{ceYNW2pw%^01b9}dRsA7?_X{od6yFjV^
z&KFSQGnt{{>qjzQQ#M>@O)MQi>x7cYW5v<oavUPIeK>KsDX}1es25CJ84riV1%DWB
z5*{RPJQ3y(X8`yb^vmeoca{4^KBqohkh06kqe~Mq{ia_Eb8Qi{n&I*xKf@L|m;*fA
zwB{23w%ke9#cR-$zA-bwIu3-LP3B{T&NLgt*SuG@A+=kVc@P^r{Vjfq6=u-;51Nhw
z1>otoQ=IEmUwbkYZzkE5-RW389>y|}@u0t_5_dYm{7j_cdQYxpcn~f^_RwR|f||1h
zqCXX?8NuhP9Ke4O6GP7GwE!S7`c2vviQy1vxRE7X1dG78JL3)(eje9Eg9O~H51(Lp
ztqD;0D%YMKzuA|6`Dd~Y#-(3c0DUG-ZbP~1Tir>X>U0{XdXAy~QxZJm2!+wb@me+N
zDM?b{mp>_i{As7l`7v;p$6U#w${q|rq^|=NR`4N68$JR|rC1gJI%Z=o2ZA0lV)~id
z?f1pFdkVy4ZnVneSxxa$bLZN%NXg;cVzl%^MuefbSrhm^o>U~wv4+%PwmcsGh{0;F
zg_gK?{|pdd==z!T`vR1AJ-)6#eFyucAA<08>NQu)&)CrK5{m_mib1#L6lMQZLVrrS
zbEyJcc~tMvPh~sb&E>&$5djUT$XasZ&);B#03b;AzYqDTqQQ42_2WCXBSNXqH#@X{
z)~I$oxON11lRdZ9e%fv>{d$Xee~j)8IR4C^3h2-H;7h0W?~jq)l`Z%)jMVRXbY29w
z4dL`U&tpI97%sg&%4kR3*&F?{2Dtyoi|4?}#NNVH{`?Jo-OupK_wQ=_yftgx0Kx2f
z7IEa~Z_r^6IMuaF7lnS_n*Zyr{&M90ue<u|M(|&E_18lha90-(#puf0&c7&wQysc9
z7T(ne|6M<?ckBTmz{7~42LTfw(tk&ZlKAR8*N-`Y^Mm_)Hp!D4BYy3GBv2<jm1<Xl
z;`<W*`o;dMpZ|DAaH$cWdQnbG0x4ypRT};y_)3Re5=ZDp5`%liG@xo|o#43U?%}wQ
z!@NV^_?spIPi_9aa3O8+z%Vc4ahc2TwRvaB28T|sg5rC&sH+Dt7cQJqr^QU!W`wcr
z&=tLo*zQd@RCSM%xNlkh#UJ-}e(=CM+_P>iDeZP}X^=}`0gBt9_G2SpfF$AwWuxOE
z?e93|2X<o7mnXYRQ}bt;nnm#fEYIm1-MW$sCEXnBL0g?namr0OV0B>T3P0}oRq!R|
zSiq;k$6#EWfgVAsclm_q<KdVlGS{l`-wN&yO}iF`w7K)l>_wmHh71F0yEv{VQ^MR|
z?U72OK;>5ZoehDCJAWAOrQLh%lH8~3I}dFu%hx3U09I%HH|6m(;p4$>-=r<WQxL3G
z**X6lk&LrFTwGg6g&=P>f9S$iA&BdAW72}_--^b_;}1^QHG^=z+?O3EK)Is?mq`90
z(G~{yps-c!`0IY@Um)FsCIHU()9+qgY4WRj`UA~6Y=VHVjf^xG{9Cd0;~s#mqAnj3
zO1&S77W_k@9@sI!>A^Fd;(s~T{Esj10ple6wkI`U<iW2$GQAB3h@&618&v*V*phZ1
z+~(Ue7SUU*8=x%oLpRO{Xe>(ptBL=0$KVjpIAexEbd3oV>l*e$Muq^X6#g>%pXha%
zuO;%wUI72Rmh<ue07t#LsJha!JnP;5V`)QJ0G1v3`Zwq2we>(+)bkFU;!|k%>7##q
z+Zm8|QLbF_Vg7r1^#s&vp{?f8LE|cc9Y4ki9GDq;WyN8>`+tb`uPVf)cA)F(&zNKS
zw>mEf{Beq3i+~2Fie<E1{aZS)|7iiZ&$E)ME6Z??f4ClLRv@uy$*9GLe_i(fl+vZw
zm%)m%Jr?k9e3W+M4{O_a#L!jMGea(a>pE!;49&7LkKT$}pRBh0Lnt55?o{>A-SziY
zvlyg!{1@}UehDkfKKeg&sgR*zaT<S*dw9@tlc7tw2V!(1bqkz+q-oOTAX^>_x%Mwh
z^e;Z>&#vC#;de8=8eMY$nk4b$hfy(7CE;B~`hQh>{--3hf*v$6$3Ti#nG3&kwQ;)6
zyaXKp_9^f;H(m3=037oK0>rIDT$a%_szHZS4(<gNxkh96MgyBVe@-y|Y4$lYHHb%c
z#Lv5CZJj%IZ1j)N@}1gY_px8CK0j3IWaI$fc*ZmyCJM=(=?u!I68pvDjf1l457jO=
zIdzhs+X&CLCnJU^AW|-{^xs1#mw$FC$H`qU$jnNv$!a&!C%G&C=kfUUt=EzdC({L2
z#wnnBF}<-78x_|33NF(qKryk0{o*oQmi#SHiSm46d`%XX{B1&b{lR>0t?HId4li>i
zV@`zN`_c6n^_L_!rM-vev7&~?h$#hiivSA69aQ7{9o@nXF^2dU-MivuCCw0Gk*LID
zb$<Byf_|gp`q$b>=BclIfPzX}0wW5m<n@~v?R;~!?eaVw761h#cHSFxQdS24Vlf6F
zkB~arX4}BqHlNtlY1bMWt~1*pr~abS))I1JRZ92OyZ-JT9c<5ZP8Owt??3lMdLriw
zA5Ny;5nNF$I`5xXo^f1=-){n0L};J6H@|@;IcAdiGS3qRnv(BkXMu?YLrk@D%wFfv
zLsXH1{_L-|m~ER{Z&`_h<Y6~dW4u|OSx#C+_x@e!Bm?=a!-}pPDzsG_ThG{BV(-*_
zW8dV6*8GKSGA<&Y$ydZF$MA&ywVWO_$y{5P8|e6}R6t}kCV^hN`&yspULf9SeQt9o
z%KSyhtw?{O{?GV||Eaw|=U+czmcAApR0hV=B4kG15F%6k*IWFi2ZdXQ?%q5qRAA{|
z*ckuRCNL$*S8nmQQ#MQAGD!h>%n!>;W0K@1%>8J+omt&llomjzw{PGyA#5C|nvEFG
zmGul*#duMo^^oImf`uJ3f>=S~V07)Z4T*}{v^w~wh?e#M5c72l_+rs%<LH`QcTO6j
zS5MiVgk6hOjuY^YP3Gdf_8*w{?@mGcHbZG=4P`q3B(;06QgX5H?xZ6D2n=`cQTxff
zeXvRw#@J_C!@=NbHb35b?dfqA%xly|lw!z1O8#8kvLl-iKYyNz4(@?0P1qC+NmPt6
zddChc+#$9sPUBw&*2yjOkg{Q9?cD`WobqdH=IX2`UR*GJIC=GSDzLJR3E-fOzLX01
z?`^)48#$}qdZp&+nZR?ZD`ylhN<95v0{F9AeD(g44X6PxWW=>}uP+PpvqQNj__ZZ9
zU^w`?@@%g0ue4z1Y9z(>j&teSzBTW>>(v7O+Q$<|1!Qqvx(MBJoV)(_Ml868h?nBz
zjIm?70ZW3S$7C~u9R?#;_ToJ#+H}r<4aNoS#}Lhdn5btRIt;_pWEh@fo^5o{v#T5t
zE@fB|yB1n#l|{8<F};&^0Tw_B_9HBZjyG~L86{P^mX1m<SZ5}$KlPt}sREd2HhmpQ
z+k?EDYBh<qhwMMzZySHaipvSqyRO+5FK*K&UiQSm$mCSu+wRri^4XxJPl3y+fs0R>
z_^VW!gkRM3y_#<Xg+?AJEu5rjxhpTDf8!v6Ht09`jA^bm(!j{#RM|k#d_6myv}WW!
zazGu7F6MJFTKXBKz2Ny-_nuG79o25^o42XYVj?YF2ji^E2B#leBDXIxoJGY%N8$vX
zucly9XC9IddIfDBt;t42CfhwNa~W#-${*U4U>U?$J`w<D%nNU_Zox6Xb$kMKVD4~<
zsw-B{K?muD{AyaOF@&VqFGVGIHi4Ss@oHkF_8`Sc-qLoreO%Z438jtMit*NP>qd6N
zC*FNnfoafQQJ;hWogk79U*EbnL>M(bK6>h0=zIOtXneJP=F2zeXXq#{(ZFhB3>Y#x
zQCt=wi@gB6{Vd33wMV3vhK~D@O1(Rb2K8hN%Ze>gP=i!3OKRp;YcsZFiKLu9JX_{A
zr5C*E(Uxy~{-tl--Z%Q_6E>flk1j9B;_hHtCfv6{({&0en~8>fQTMi*&~utm$9DkJ
zLmQ3*y30dO5HzC!=uwKFv=lFFZD}GP`Iqi8H_HLv?KPuDrvemDqHCADp)su>Shlcs
zr8PX5sMGuC;(v@rJ|5r8C8YsvI@a%i=NHs~Zm&vx)=?xJWw~P#JDV}Dw?QPMsEfmw
z_W{k(oCp=u)URSEo$J<8)_&)#>Q24DGMq7@J=6iE_V~>&$c9xjr#i;X<te!FYl;<m
zy}M+fKm&siPeEzI`Kf$t$R4-ETkBSri72*ZUF56k=;RkR9hJ-o98yIH=0AmWA7tme
zv#vHVS!aK>75xqjyiyyvL7#bmA1ozW>jvUp++{}@n|zh_STbm^Ax`9og+DK2E!OG<
zp1+06&T{OP@;PPuJd!~F;fhlkukL2opRQYO$}#Dij2m!hXb(@|p>BEN8I4#gU=GFf
zTFyYGAjZ@EAj4q@ocBM#@EAq_Le)mfi*R5b7OuH~Oxl}gwAhSMDK)4j6jD`ew%24j
z>igazlnmxqd-S8wPvC)u!|a|Nl18h_SxAmAE@s|zMi<U>+pYqUo}@CiuUHTey*D!^
zFv|Fqne(Ho-s|k#F#k0q=pIx543@^+`CL#u?SsarNwy3u*zK!rlV_Cl)o(VPli4L*
z<rW{D@ae^=>M}Nu{4zML(cXPYFwp)1A+6U3{an8+lGIWA=15S%kf4*+I+NGvDMZ_@
z_TI9PFP}`dAx{SFxos04uBfnbb1+&nwxq$Rs*`hNZ-9TTAt{d4_~zN#6fzc>xpYc-
z?{JQb$WqcSnp@pkK<Q|3*#USRr|A;L-8xlj#a&lr;xnU1GB|;mjhk3WwsfcMeM@B<
z7F7{ND`dG9_^o82&s8@b9wx@ue*M+U0U6#g|9tH_QdNGg`It2rp%8b1<O#(thVmaF
z+Ctplm$}pp_Ial)bRlLJbnR1mW%=N%pSq?mSFTp-Lau8-TpWgd=4x<2d3dOc<(e>~
z{}^pPa0i8Ne%p(~M9MQrk<v9Amt#dIDIwg>hQ>+-bxt>4Ms;tlNr=rE6ZBshiIf>2
zGHU7@2FIT?E)a9_*k>y?J!G;hncvVoQ5N%JLPh~~Udm>!rLOJ+g$S8Af|}YQ$}bko
zIq1dv8>7Ggu~udHL?HPwTfT&=eX8f(E%JlFu-+}t%Tgkg9R|$lgHO*@vuKOluIrXC
zo37^muBhT90Z_<u<{7o|`nC;VrI=WTzYkrL<b*tL_8K(y>vVt)>@KH3xwhzJ#PoIl
zgb*bRMS%IcvYIfIRm({H;pF$B70-xH!Lcy?$zHa6tY^W3HP{4VrR?^=Cch#F?fJz%
z{YoMYiLS&a!^&jyLV}iq`<vMGwQlyoOem+#k}C~z41=fds;;bNq<MB!i80z$Th-=!
zx|ye_ydTU=0;gEROQa%9s=$afq_(V!mOjPSgma1N+&MO0=M`Bp6kysI<UBk-$nAev
zW#yy7D3=0L`lkg;#EF;k37D&n(KUu71N@mATsI1Yx8-zIe9$GQ>8n0(7{fw3<snMA
zIONW3JE_7)lbPgdfg3m(1AGY5O#|1T?7P6zP!!jsS^j-IFrfKny7pRpAX)xgN{iup
z$mk7Zk`W0EV)owpk(>P0^x@+MSih*1yJ4y;>_*0?t9S#vl5?+59n3t~bQ8^EYJ3~A
zAljaDdtJOw^U)*;Q~qn2@q~$uvaUke5VFBCpzb=mkekMOS{gakd>xzPlv}*MFUy!1
z&+%R?|4p(2=p>UBioHdAQp^hkzquI)W?r5#ToaJE$WzqJ8_mh`!iLDi#weBT<Gb^#
zE?QPBW#-nw`(QZ302i<uiijhi%|7z0gG9?ZpPNevXHCj0W{*}cs8aTtVRfG};6%3-
z)EFC|R?2Hu2Ei6@ubpGS?=b`QhXW`P;fbjeqq-~HJ-xEJn*^FF9@E>fY_XSXXSFqR
za#zSfNYmL3{^95JBZ`IO6W<3I&|2_)tca@f*SL@q5#{fT>-|avC<oA~97x!m!l0xQ
zE)v+=fR{gL117eaaM~K5ye<}ath>G3oYRQ)__j}C7k_J`Y8UHUV6P{!?M<&-s}2Vn
zw1%s0cJYfe(j3<a^eucx{cw_@B|O<!$gH>8A$D^Ff!21Xu!CW2PAE0$UclfSZWi4M
z%JOWxYQO~K4Y6uM*dS}S3`H`EH9$^Ber=-$7A}AGkSiyX4yK+F9UU*O_2rqN4U8;r
z4H)E5&ZT4y*~9xihZkfU!9*>8PJUH@SoIfX+nuC4$giIQ;|}$I#aCa@fbl57RbXJh
zpZYdd#(+@W4Y)h96w_LG=FZiXtl~ISK?g#Evm7*P|H8-#-^ogefB05k*c(5bpsYzA
z2{bA*-F(@&SP1%Z8?Oteyi|!5xsN1?_oH76^F7JROi_>-t?(T47v+ntpBZ*8zxj^n
z?VhtflF2CrkkiZK3SJKHh||c$%Hn}h;Xg~4|Cif)8p;5o_H9LiZDO^TgSJ}Km%*$C
z2NXR~)Kux@ZdDznviWOLR90VM*4`G*jupY$;*lGYr($S|RK^x6e9eX*bi(o5+eD{0
zajt}wvlhiq8`NK_nSOQ4ubh6em(y6N4CmUv<x^0*xZ<}~n!vIKx-}}JuU>yJ)+SLa
zIHap+fhFdZ<IYa*OF_~GjXm4FZ5BY=((bA({r*SQpQ%JtA{o+-)(R8wS1V#It)N#<
zzmnZd4uHuRz2!{Msthd|5A-laRK|_FA<c@Nk@YzTV`QacV{|p*F1PxYI1ZP6zz?Jd
z<CXc4TVoZ}6h-DWLA8)8t=H1?(gxp3U$dE1jafd_KN<&dcv*DEVjU}(oWIl+9A{`=
zs;5IgYcV3_wpFXgFrzpHMi1o1#P_)FuLc+w8hX=`at?=slU)d%w$&OchMMK!kSZCw
z7j-t+k~UYfshpV1@-0G98%&a@MB=<W^u3qf9pCPcyDhi%0X7(w8%HWzee}A*!)w#s
zuQ#rIQl+kowP!JOfpb>f)jbhxxigVe42ja=wHK3Nug{(}4IfVBG?CVktFtWR!W=@J
zi&RNdhv^32#8=7FJ7Jr4DJ7`YP><})OJpo{kxeAm%tdtjS<E_WslK>#zM`S6D!+WO
zDcC(cBF^n=R?Xt7%v%eed7jzgigeU@^O$zkWr%(jJe5!drEYa!P6+8x<$8CaV!MgE
zfWr_9IdmiwQTnPty6;6<>-=?$ovC|`m-oV;UE(RTmhJH%Xt&?&OAXcOlHPGj{z0U0
z6rVc3`Tl2|Iv4op?|GaqKb%Z-EixDj-rv~G*9G<y5vGRQ&-!$jBwXE8IoxF_L#(DR
zR!~*m(sn)Dd<SpjRC_0zv`|iWU2e(bPvGMV<rz6et6I71KfIT79l{b~1SR+5?isAt
zhvcl#zQ?iughUkpbW8*ofD~N$o+7_t&>`0j#Bvt1wu@`PHgOZe%@1TPId|uusI9QN
zJ4{avy=MCSLq#oZQ#9E5T45d7FYKD5!$!riNHMX`#v`fUhrd8qbMA*`bLLpo2I^C1
zu@SjTqR^D%A#~|}!%EqFKC0-0hDBkTG{2Mx*af8p+A~gzQX1c=9}m77)el3;N6HmB
z6`F2n<+S+{eY8x>K&<0<`Ml^8TCb9l5x7z-d#L72e&zZ~O$u{qGhezp*D2PbYwI<{
z1Z8sLLOyboi?N+gnyLS2uZL0N#Ek;&=$iNAjB!LHqfacX(oG{eXbn}s%OIQh3-N`c
z6Cle2L+e%`Zxauk=wx(jITcjDsZgYAsr21=RM*Jcc1Kj5+>H2*y}aw!IlDwxcEyDX
zdv_zj)qt_9_ET%tX)9=tsjx|PK7@H)jEAYMe`vCdD2ojzTE0-XY?Jcvt&s{HkEoth
z9Rf~03u(Hhm`Ag~8E&3Bz5M~}pCCRF>da1TU3eagc|w`C5O9OeMAwpJcdf~-Y}9kt
zhAD#Zoc-Y!|3cW7Iq0;t#=#Fu7*3=F(&O@^;n!dgjx%=-cNGG7-~}08_;B3-W!i4E
z957E6t4-;_mvjfB-$p@=Gr<Tmfyc}n3w2{OVNSH>NSy0&S`IP_LGc4LESG0V+zOh|
z|6N7r^NVj10A;gP!V2|5CJmz8VEp=4b6J^Ba`H7Gw~nt}%cB-YQ{?dx2+HN<fs*=d
zfBaJ#A~Qk3Yo3M~Uo1k&F}isR(J8~zRJQ+|y0QAMm7>o8{kUSwxqiLu0)^KEWX@)u
z2V=?;Gc3$sZj(0}7f7J-t(H7kXxy&SjV!RNdga$zzGahm=;V}im*LBZEDj+IQya6s
z_C<q({7@y8IxpNuZh9<!_dXT67LV`NQOaUh&=&@;FGP*TUD>@zAKF=N@8iO(7I9qi
zqz|^#6YN4lmy(F2+Y_PR7S1wnKVbb$?=l3^#eXB=@UHs68B0CAkC|O+y6+F1JW}=i
zH@-`kiAMqs2*~L9h3VeDq8G-dTD8jYuDpc)GQxh)vw}QLsEr-*93&#3lO2m49WN=1
zlMN#nVU!fey!~j;8U_5rv~FORZZqqH?%!5Ec2B*m6@kp8Af1gM7tgNE!ePGQ5ci1;
z=OZTy*l|}!HoS6NWM=O{IjLtfVEwBMCGTZyDi%OiJ`h8!#t4py&gZ3;`wdR%@2a2#
zBRRp2W*H#@6kgx0d=7$gU8O0aZev{Yx2Xg(NwKm4WJn{Y*-3yAR??94mn151)T$eU
z7`NsQ)&cs`heZX;7UF_p5P6AEjG4qYUUpyp$|HpOww1HO+orNP({OKLAktR@X7_Tc
zUcnLuaa(^E8+902Hy<_V@1Dj3aaMMSJ;M1knYZ!k4T2{jP+i?~W3xWIgBevdg*WN7
zMhR;@W_c5#c=u$rq4^{j%#5|7?+)=XE&rnUID+jFU>He;1O7|#yk*IAaPI-XG3!DV
z_q2+sKHlojqeBp0PdM$)^6-;eUx?F7<UxGWFRs*uJPJNeM7q2;S-^km^wOLtGKF5m
zsiLyz!H-({)}cZ#T-Uxs{%xkWvv4}0j^}V5eC+b}1`4-b)s1o*c2Si3j3O^P(5elS
z$PADox43a?PJ8o574UxniGK@~mDyf!sIIv6`<$|TUnc6mT!F_{J8_SV8q_?0w`Br?
zH9c@^{ET0_1C;>R+n6&#rC4I^aijH~7`l`qgj=XU_5#=!;WrSFPk+vBwk}QTxTPt6
zZ2Dy&c5`8A3CF)*orltr|Ftnl%WY3fU<|yO$>8jBUZmuUQ3IM?x3(;cnh#cr{?0mD
z>FSx&Zhq&2t&xgD&y)<-&wBH{qbSqoE!}>z@EOjqDruL0_r|@@y3h@<ekT|ezuWo%
zG0)bLg)|VWH-$q1v`^1!%u0o>%&3ihXiypCRfHBUm)9MW8J!FiT(mRCEmsuBgB)NY
zk~cZH!)7!~TnD2<4%18B(LUCflfU8k!li6yGW<?v|HNXi`%eC-B9^J~lT!uc5q1#9
zCoU~q09$xmOTKpv8#)d-*oZ(u7fU}-`G%*~Ua`2#&JH@^tl6Wcm(fn6aHi!!>wDEX
zh<5>&%Tm<}VcWCk2Ka{0)`fy?jk1pT21TidQAY1>C{jOWZFSx?8+MZwa$c|1<>*Ls
zDYQ~+qi%isw$xkT{PkWQ;ureiT0^Q`@y6A?YY?aRII7PAXVRx&%X@SEnd_tmR+aY)
zdi3NP)6Qyt_Y|XBe_is7%o0T82d)RS!UZVxrAH_krRRYHWR-DK!b>e$^!ZbP)ss+Y
zqO(n<10~OmraR!$PsHao9y-#tr^N`68s{Anc^htNN^ozk%_o%i-%J~QI9V7q+79hO
z_m3`Pq%bvBU#{BBxBoWmM%R`DX0t-FwrVt$qt84O#wUac;@Mt4uNli?%is{wjZ?mn
z%rr;{Gz(oQA3n`L$^wCMB1nm5D<orMuV;<*`?!OoQ0rf$bc4s3f_}jk;AXPjY)P;+
znQca;{z09n9_A=&qu#UI`-s#RS^CEo5vcpv5PiqQ(S{U}$do-Ty3kp|he^(OiO~qq
zny$oi?<<VriRRgU`=OrGr~{M8;vPD=3E8y_13WLG;q#MYPKvt79Ln<6R<2ajZ^4`}
zX+^igx1wsNGeRsdq|l686||6?hKv2MSH0(|Kb)1gRW+0j|Mn3ROzNmSNo)}>r=2vv
zH}-PSzYu4!aF<V%6Q%lI-h4FH_sFoszVd1?#`Qxv91;EP7<R_)o|L6+{(~*qY}BDG
zEhBs*Lr1D}*5}BkE>0k0AHZJYcIEOpaX}1sv4(b{F_rE|AdWR3WdgJLX!`^vmty?^
zkMIuE`_~)Jg-VDmwAH+7;&eh72^OtnfAc@pj7z^fa6Bp$#T#z563k&LO+DdzGL=Jc
zWkY^#OGEdON)}1B(5)T)<ZZ`6O-QM;kG!2_*+{^|^tnNX&fw@Dt;S|EQ)fObnmXlk
zAC~vKgCG(-bq<toulEsZdIcyPiEi9wyd|F4Yo3CxmyJgD6!AWqEX0hqKtJOHF3_eA
zV%kw#jun1i<O>INdE4cqzPpGieg1)#V36#DSH4WS6Lkx(+M!G>a#rio3F#f1lJhMe
z9;+5~4KP-!nll@$F)Fn9-Wo8I$S7VD^MqAb8dw!2a_fd(nS?JRKif#imuIa->ZWFk
z`|$furV*wM&0P7*1_RI`VFf7K-3ltiHw3A)uHgr^_NxcU4rhMdioJibb@bNbhA5Vt
zJcV@D!g`%Y<@>>eybrA0xPlPFT@QAji?g_Un3IzTHXc&6B6z3nDGzs%PM~l0tArZC
z;PTbxK2|r)-+lhNn5HsPUP&Qr(cx?JV@!ek&vDgrbDH&0ZZ&5VQL8cY4d$L5$#G!d
zZuCQgP6Tc#PUW`f)7t52Q{y_M&n(!9;b21@%F}Rh_V+ksvA0FPwjg)HV(TUW1Il{G
z_qmW&c>5wzzrs}36DYOgff|yiM5M^foLR$)j@K;**PM+!>qd3!OF^*_s6@-V*k?+p
zo1&jB&-a@Vodg#HP#<^g=0+TSy0%zDVjY{*k8I(i1T1hTg&g8diJRa@Rm?Um&7trJ
zMB$_QM7M3x|A)Od4~K$n<A$FWB@&fTvPB75%9forWXqmC*|P6s8%3yOi9)uiWZ%g;
zm?C7CZS2C>m$8pAV|>?;`@MVa`+1(~yWc;)<Le(s;TYF)p1*VZo#)kWUpt418!4k^
zY0>&==PLBt9c`kzaHlN48{&adOJrR`=V$q?wmes;^_?`<J2@p<S_1uO{uLrMxnck5
z@xDAO1yS3xGW3FXp3z>U3W*Xd*}}v938f6tjSzSM%{i`l6){d<WV;BqwSBSn!DdJ{
z^jLq0KY9=yX*X*ha6)K#$$zN(@@z>htJdos1GM#e2aKMJJ=K$Wb<lhe<Hdf}s+f+~
zps6G~YePc-)wy7(NC3{)N}$*-SY8N#C2)&5sA>K-=|#AXj&6idG~CO49e=e7SjhZ0
zV78v_xmc$WElk1PP|p^zwL`QJqj20HTQWU@LOXLP%4kif(j*dpnY>=$U|rzHQF8J7
z5?Gh$jr>gf1@}*PHpg{rI>r)!U!n;WvYLbp&(M12wQqzd3JKt*nupA+q4vGk4ZmEc
zZmD17E$TH5r+`<dVIGgdae1`M4b|5nN<&gs?<W!Jp`xAG`h#t<Z@QtkO^U<{$wq6+
z@u|HWS;aRmyCdr`tCOd^MwLCGi)A9qFd^JPI3s2v^7f_Jr39sljA7uC9}&bGTg_@$
zU0nLCY&iB(vnAX41WOA?CrN&@u+C%HD_dM93K=;X$v#`WJPt76_6W6fztghPQfVd?
z0fEZY`B#6|-ENHr1P{t&7vK=gYt!e`u7W8q5NbklXv4g!CE-RqC80eY*V}xx@USg>
zQ^RHOW~k>(rVH^Rd_(!LAR@aOYOh-1eh(gX@d^5=+f$9Di;J%|zV!73P>yo<Iu(=*
z+t&skY2Yrp>oxi2o*v(`6Q$v@b+qv}4FTFx_9S%sy>JU<@(u7;5X9(<=Yghe<}$3!
z#H;u2F6`p1$~LL#6~Ni;!Nj`W+V0%hcme9f?K9J|p`MG?k;KVC6^yov^Kcy7r`J}?
z7eVXoqbl$FR`;i;SgXLeo}=?6=y}mu-Tp(kDYN*)SO%W=n8h4TYicB!1&j$n0KEBk
zqSKFfr;954P-Q0$koT~E+RCL4DfjQ}y}cDK5bcY+C<*I97uGQdEoX#RZEemYFmB}p
zclc0@ZK1;bltNW^-C~Kg^@LTOMCy7VMOMg;c4<GF3{LvxW)XwpuVoy|)o!N|0(~~8
zYC;&G>a_2h6ba#G1H%)McMKBKpK)dSmxtHeuN>Zs2mu{mbP&fr&K`4uRK26=pT8%i
zvDL4JN*~lWlL*{=;yho9RRY5cZ$Q#EKo9x}s;DiArI}pC4B8M%AXT0Osd~oSOk-1Q
zQ!f&@>9H}zT8Te+B(NGs!_)V`ZtASyqgSTUY;cXkVcx48w2un9v;{wLo88Af@kYME
zlsRNlz}+rD_GyYnQ-7}3n;TUez3S2<oUVyuhG4rsA7%9q5y$c15(OAg>+N&Hpq$^3
zPB~G|=+^x9r&13De}V;A3{{#wHW_*kzP0F>D_eM8v$z;hHx-&fMDy@VO@sKh9`CIZ
z;7>FQ+<msiB|%Rx0o~>cR9h9;DY`n5-Z@zDahJw;E3wJ&CfXS?{)26*2kJaTu%UNx
z3BeL#7xEjIoU<14p#}_GFkB^0lq!1p;-dCNnfNo|$NH?sqCofX^|kYB%qH~4jnzg~
zqK+*w<k{<fhcMMwhToEAA6jk_@rIbR7>YasIlHr<)f+g*Lg55L5j$ud8eB<>@kKJ<
zpzlyiSbQ(^+6$Bc{ApaW7$hndd+j<qji!?euG?(cK{$!^a8T@SP@)xgJUE>wHZty*
z9lZp8G^Zh}k8jojzpDMfb21(~Ci0{<;HlKoeMsjC39|goz3*2?@$i9gBIB9iPFvej
zEt<0B_|?9imT^W5u!1MJ=p6Ot98DYNm7;i<VlQoUi>jUG<|>@@_WzO`t4ZpNZkWCn
z_z`CH(mP+Z$M3rR^JBEJm+kLf9xtw{+(+IYQ$VmkmM{}2B^7X`W<~LfEoRUoSh68z
z2?m}!Yj)Kp_Q|Vko56x_TUxvqM=$I@4X3kc6%Y}4gdFAGd-0jRcO=`O)WzZf0Do)T
z)!3(VPR^8A)oj7FQjRM)ZhCw4-1^wwt%7;YnWC$n6FS!U_7HkfvA7{N;EG688=M}+
zd~@So*q+r%5l{*io<{oL@yt*K<A7Y}PZ)mn_T<uU4nA&SAWTs;xXRpIlHXFsg7u)y
zF4x8;I)TgSvJKdWmN)~3X95xqs1$O7=ze$@q&@1hHy2usDkHmYi%7sxc=#iuV6h7l
z+|3?ROR?8~x(`rxe-fY!4Es^lZGf<un`O#UI;g|74zlPsAzV7JRNw*zTrB(gUhO}f
z1^F~veN>vB0@Pp=XH^<AKG9`OfXb}<OS@5}EHX{~RoNS6fO|k{77ww9Y=MCV6pG?w
zQ9wQgu!CKO*g2QFY`Tjh4;JjKd8;>$?rUa+-q+w1<T=|xpPhU-tai<vmmuQlnQMu5
zpA3UUY9toEdJPx$`Uj)D7a+HdRtqYD7uy@^{B)G-K;5XD5-(eBkVY_Y=~RtF?n<bP
zNsZ`AY`$0W!8G-}46Z4wT7x}8d7;CbC~UEFoWrw@Hzw3!+s@r!$~Jp$MGGX)k~B3z
ztU55g@E+6mY{X{NEY4mw$|OQ-X@jAI>UwtBk^|VHP!(>Ovo(ju9X;S$87yKOkFY-C
zR%@&N6n?7=GY+qO8+d_!Jl-R|%%&Wq4-B>}Y5h?sXUR<$Jny`sctc};$A*9<Bvb$1
zk+9ks1AQ#K>fyoDUs{KXXO?J3^~v`g<m%3$30XC|vpH#WB&d4!{B~F{ZT$%f#-Q7{
z2m`_bCAZl}u$w+HQ8Z41HY;11bPm4|nn1fjM>pg?(-b{a1}%kreuFiJDI;iQ7mqys
zI7c{{@@)4lkqxa`rA5eLQNo;QLy*6>v3ueS`mIM6Kzl5w200MhR4|O~TbMrBTDzXb
zDjyXU0H?L-QUpq?Ab_{&Hjx?S8ec>q3DFf*+U6ArM69ErD5NSR`-rB2qd9~VlHPMN
z*?<zX-{#_aK@e2gu!XO7{@B8)hJEX&<Z?B{KqIHNm97#DHi}04zmQh-P+VV(Rm3K2
zxw|gXq9nwi-_s}zFCeJ0B{&5IM4r<V<_X-y7eDKX-t}jhAJOZ-b8#?)7EUKL^5Jf0
z25xl5*820+PtUI5im-$!$i)QT4{%@vpOvIsq+P6m*Z5Iee8jEW;ztiSt<ts31SNyX
zh^A{y)$0ijM*|qBHFTVtgp~s%M*aPHn^t7~-wMeLw#(lPVCel=4NiQNS*(e^S^!An
z+Q3BU!pqgJ5Czj(!pLus;LY1G50EfAGTC+!F@e78Vhy9Kh=ICx7Uj8Rmnm;g?VZdg
z1RU8}R-vL?w_Ll;^ZhlFW;?uWu0DAGrV_4n_c8jlFMNpN5&f+`SrA^<c2K23XDtSC
zRyfmFG{`K5CV;VCTf+hTvs`-FI$I}Qhaq@Bvnql|2J27`6&>teprs8ELw6V9ZzoHP
z3W^hwU;c4X4O|zV2EHi1ZD8_}U%Y^Z+vO|p+_Jo4)JE@CKqTh-#jPe62#X)(K9Hbz
z`b*9}=ZvTkI*`EvS-sj8`PGWMI&^f^c%TimJx7rC)Jx65>rJ<qLxhW~`ovxl<ZF?7
zq=CD9SQXCLB|<;6h}v4{^S5Q=I8bL)o?rp%&wf9Wwkj>WiTRvBZgOrBrMNgb1oys-
zj%}#&Ty8cf!=*aRHh|LfDTpezCUZnN7QLIz`HvZ@Z+VLEYG*6DcfeE(#BHxRE9&vP
zC>t<MDY?2C2_0i}TSF~^f@q^=-}~J3QOpFCOrqNraU`7&Wu>3J64M7c(JX}Sm|a<@
z3MNg@?s6j*9^ZdXo(5`mT;(9aI)hLFp+GLSo{}>jJ=38?3#ob5L747keNPMi<upqO
z!Xr#JwMe7@nz_Huh*qqQzIsA+Oe(8%BpK5mI5&U0A+;QfQV<$-GpiLc(>q15TevlH
z@*!?fkcRAW)AZtqLDx%2?zoE?1a~o=10Rw%r4f+aBoc<;;4JURGen^nXsGm@7B>=c
zX8jk1<_EzLmt=pMuQuW%dl!q16c2&9MY>l*h3B1cEA2}D%r{O`fWUMDQyy3wd)x*;
zrW6wc96*8dR=JqhN^_F*zD)smJ17M_*VK<YD^`r!Rc6quWlo~=Mi~Y5jXoQZ%Z;ji
zO)v}%u=sX;wzg!1(e+V$<|<Wl#qEy$i$e4lufZ@8wEX?H;w6w-?&XEeAc+!zen-^6
z@B#yUUk=UFmQQij+@~B}z(WLmF){Zphinc)uzKPJ=}sAx1KjkEHpR;=-uLb&LE73~
z?P|=a$58kJgnpgNo2;UNo)+LiCai&wZyis5+3q%tGj58Ev}RowH^z!zI_1iYnx34;
z>08v9RDuHROF^&x#Q-yu5WF?05;#%Ej%3bB!rPvvci<HpqY8NJM?THc4rG;C$WKZ*
zZh<il0b`tk2kS<I=89;K3E;b2^B#EVFAn*wXUZ@3#X>gnl`2wGOPU|-$q(=)KXp_?
z*Kn+iyjpn6b8X7*qo0{SnDU)+Ux<TxViVN5&c*6utLvox7k}_CagO=^B*1|#rgbZi
zytvQ4rQEesDSUHQ4$Kn`mf-wEHaT*Xmj{fITvVeQkMat(YkkOENy3q_lIk78kiQ2#
zfR5~)AE`BV3kW_H2#Z9OBlZk)81yi<^n7wx5?{T4dEs^WlJo&onOV0}I7-0tMq}x-
zbdw8;H2iNP<Sw)K#fge9fQje<N14g%p`0-xbqp6M-GQiwFH-v-jlfm58MeNTs{+<9
zV$AFAjj_ert)pD<kxCx$8igtCYUhkAB})jpG-gNc0TsD>CJRJZ&B25O3{r~9!1IY+
z?<DEcd^wmkXV{H)ZEk_Fe>&afQc$M3x!xWJ9?lRR>z;j|UXd8pvf8p;4A{Tn4?;UW
z2$&)vq<K4!Dt=Sf`rslBqxbl$<jVFI(VnTjh23$*QJW*wn)Os#A>te8g^*gje%XM7
zkiY9_<w!z^1POWo8@T}Cr0I(@0(rO2jXe1%*Fnsc{wJHDE`P6Ep<Kkea7q5X4xnFJ
z!mr664iUrOyFctVq3w1dJO9>PpL0bHvQ3KuA0$}gR|{R2e*6)m5v+!K{jwzuA-h^J
zJy#6{Ks<o%=7Q0A4{KXyI#+=y(<&a&5Ho>A>Ngr8@r@`Ai3Is_LUOQCg;owH(iLa)
zyqEiu+=WFy9<=VVu_G4c?R_3QR?t~EQuKyX9eeBvp^|~c;+HtM1CrxCGZJlmELM3t
zn14D#=^_F$MR562{lWw-Cm%7o?USAgr+FVtd+A1Bab16Yi`en_lrf1Bf459}`=S{?
zi<a7^gV2;s9ei+bRJN9RwYsHqjUQ~jVpKJT-DO37+OqtWS5(BPfn}3(71P0x#u7zg
z%;drZ3?Bs*r0!)4ZwsGQUM`N^ZUlSiavYR%iUi+E>`!_qX(qK~zMvev+cWhOSZ>YC
z187b5c9t0xE_3jLJbT4-3OB1V?m3xw!}U>KHj1koU}B|fl&HDGWe4O#y5PmHzBl{}
zEMw@pLf%xl90v1D9X30@y~gl55;PWg92%@W78MT+aJy=s*=|qFUsUq%%nD)Mk}zWV
zbVkg|DJb|7wk8yJ$f{s$%`hg@wb52$bLIGOiqR3W?PLRI^OuhzD0%{>EDJMuE<n0%
z0+gDUX}{IFKR5wO8gw2h9{OR0@Gtzh`17A;BD))ari^-#+xMSW=T(A{YHe8V>*O0R
zK7g?g)LfTQX|34?aDPY$gM_$z6pwhL@JxoG|4CD;V!`n+$0`NEt#`xG$9K5*uU!de
zQ#+7+EGmm|HZS`Ee*SD?0MA;<?WhmZ`VtfNo?wKIjUUg*V`W1yTX4!@|M7G3#0g4b
z;y6r}go{>-!p<MQvjHd>N)ndPYp)Ue*ZL+xb4H$~n?kof9p55mjlKL9u`%NN^R0Cs
zR*r!)J;Ny@UT)fNhITyAD8LAwicvHy-@<E0fqBNuboI3%TbG~FqTSag@>?E}a)~nI
zKsCwJ<><2=M)-;p2pq)M+niqg^tBMA>CQAEMeuBYU9z}l$9dLP_*SD~+dEmqkxz%l
z=+(ZBg!uKd-d>YDH&`ND8@MjZ8qDdP^L!xb0S>eXfo-Mz_Klxg{=;j8bu$vx9alKt
zw5zEbQNR^p@GvZu`)S)oP^6ti9Z0WtjR$J)7M5BF**mkjpi|`E`EI*^@_%WhBxvRn
zH#tKbh9%uKxG70smHb06<=tM?|MeN)os9T0VdMI_U{R1XTE=gSdVLif@ewWEU%)P~
z(a9OYXAZt*bTfd~Z76*^yvca5PISNM^<O*8@$GenGP=bmsSWHJ26<+%PV@cgTEBMb
zgP{5j9pRQ4ge|uw?;fAK9H^icA-%YM>4HA+5k9k$Lq=R7`BlxX3R`o4<WphxjoP2O
zn?HWp{S3JE>)?GY*8I=;yOLBv_)OQKxcJ?L|MBZT^baQ{@R>x?p=E)xBUInE`jz(r
zqYVBeq{RQ{8(zS&Qu024c!r_!u$S5$2jWeTw4A{Oa*HAoq=>`Nk6WsCS1wLixtT#+
z@Gq|XEKlueM}NTTEJ<g#_CSq>NF2#;5@4KxGP?CuoTJ+nj`syX;B?^hal7C6Q6<|^
zkjX4bIE2@)WFi`dn!Bmr7lZ?xKa%Ap%|7LF7veBi*8}&1zp2tKYaoUeaPNd)YW4O^
zBDx#pS=eJr%8SmPlNY}lLta3|xOE>_JM2p?PJEnIkvP>yf|NV&w!i{H-y^YUk5kC5
z4l^c7rmY(Hh&S;J;r3a|^~Ez#<%tP){9*?s_Ru>L{O6(fL$FTfZyNPsg+itv{z9Lo
z)KcEv>0i4rwVRCU3qaCT+H3CYYD5WP-Gg@miKLdO-l+ZB4W%SWrhN?o;5QNS2l%OE
zvNqf#35z_T3f(=UpTe8hDtp0U1LkD3z=2)Z|4alvb@_nK1z=%_6HomTE=ckdsStVZ
zuS*y5eir?0WuX>gS{f>$Wf@T$-&Er#Kl<e{nG>KfKfB}o#oN1fkPCe3E5Yu&QlVwn
z&v*V16#PXm(%3@T*O_JXn=nQlyGpAzQ<oR!gEXn`_$48yNO`eyS&2zOA9s6n93FyC
zE&E7C>VxFGlKM-S!+1;Kq1s0VpnlB^3A-HlciKu3FDY5LIg-SG@<exbE19@|`?5Ir
ztq(`+UKT0%)N!)H+rYy=dXxXx42}f}P%zN8;E1Q;|F$y5PWQZwcZ_aY7gu+6<L88d
z{p`+VrJ5V%>|T~G_|!|bIn_RlZh^Pbe%hto-m;qNj@Cvm*QV^QEVV1#<SbEL!_(AV
ztNwEYid$@i%OWRXjoY0CAhmQ;f!6ozw?GfM7yJb`Urwt1bvln!f__bdqjxm8Ggjip
z?zArggmJLR=xfM({o2LdBp@TWIE!AI3%eIb4L-Gz)+!emvokL&e(utC^|F(4M}x<4
z7cF)*7yzS|>~FZ;fm?pg^wk*zcg9u$S(O)h=(xW3W~Vtuxp!C9|AJk+C;PYeasC^y
z9n*LIcG@4zt`Riwg0#-TI?eTwdc*Y0Lh?ZF!fW6$w34bvhmKbgssi)n=y|&_b)zKV
zu9If57iWcyvvcaxEFV4GS}frKueKUX%^hUe(7BAlwO4}rKyvSm+{#|dOj-gZ#Nd?U
zRLL-Sn5&^hgagnvM~1r-q$i5JG3ijhT!h|pDAcui%<$_6qAFxvc-6dz6?IMdqPq*K
z0dO)84;Vo+L~#$qDvRw$m&|^eJ+h-#Ng><Ni&=3q5cm70Q>``xRWqsWER<RT<6s32
z_qr!vzzuwP9S_;4v-|qd!%sH+oU@b23Tj9q)?ulHK&L=0;6b!~Y>lo$XZ@=$xk%a2
zmudnDfacQudypA0+n3y9P7FMqlVP_2a&^6yTbdB8k}F;uH~GS7c{vx+9}61vX`DwM
z+o28S8|S?|+M6oB#-SVQv9m>%_vcH@^7ADA>-GIdut|b`+o6Y<`0hZ3R>hqic0@=K
z=<<A^b&)(T_mf^JgXd($!un{4KcEV+T_~C*VVdWo4>?F*CiqNrIy9pnS39ZNOe%+)
zpw4SRRbUmVn&bJ*@7`XPn|TDDPGE)6S0OzP54^#AQEUO#<lGS(m~9M-aj?f1p@(hY
z0mF#Kioo}2trnVc#>V^nSwTLF=?<4nd^p?B3G27rx-0D9Fhc(g`L5Kjq;0!>Qt!b_
zMk}h^B!QfT_Y3>h$;tZ!MKwsDBSIjX8-8G_D1#}~E11Wy@=;Ew04>6HOky-YH|T!Z
zY8Sk6-eaDk2IK-np!PM8;n;kxL!eX_6~|zY+%r53mk52Cye2IzwX}sD$gX;27S}(O
zK%24El!M3_CPRbmkqMHr`XGr8U;h<6mE_)mQ*;~YO75=B(x)Pzw8*nUP%ot`GrEI&
zE=_+p0O2#(R0|$0IZ?6Ngffl{VBp~cZwZH!sRxUWJj$77w=_nq^?JyFR?!LC`4%xm
z|8ST#jTn81#Nxfn>!EBgsG!>P*LO55;I$C)N>Fg75(gy*o_nyZsn=^S<ji7Sl)*C>
z)%ouEjh8H4a)o3nK)d&&mzw&VpxhHP?9X5jR|H<5Rz3fJ<LW#ue7hY(yea|ViX~m(
z{^y8c5Mfx{H=gAe48U(<&0x>T2Tf-DJyydVTS`PdvkEyd?_|R(sdT*ZAteofh>Fp3
z-C_ez7?o;mGQ>GpJsw^dHv)s)$s%<{1z?^aqwdGAVIaZ*GW{V!)5x4klJpK21qOyf
zdOj1~+_#KwHDlzzbbZ-7ZVY<ba%K3B>pQ-EeGkN`S+;2ifLigW7={LqWF7UNEp1A!
z@f;=FiqXSvqHIZ%<LpP0=W9t}hfh)o^sK{r%8L{3_iK4tNMDo@UrM=J`T1x<p7coY
zq`le7xKYS}HwAd@q<wbDFo2xAmQF;N19TV43H_2E`aXNd4aHU%iS0%m@^S<}G|$Tl
z%jgDHQJ@Z|G^OQX1dVglRR?Bl)%vVG$E{)seLKbA0sB)mqFcD-0MZutIoR4LEvOOe
zd6`#jZpdDwgtRgZkt>NV-rm$mmI!S5^mU!-U=T4NYeXx>iwez(8V4>ki=g;KJ+_%5
zAY=u@2C#;p`-D_b*Hz913}<;*cj#9<*4LRk(M8_||IF!cA8;r75Wx?gyVG~DE>g?A
zga?qOPSx;(QjpzZlw&2}aJ(IM7u9lp$zS<gIyO{Kf?&M1@EeiPwBy_v1>?fQp}ryY
z^Kp<G+2OUJt)wdV>OdfJfSN=GrXy>2n+FW!v%_(nN>$gXq2Zd`Yomfio9u+=y+Pw-
zb{=+@c=OYU{(A1)X7K7WjDKu~czZLtgw1GMys~Rc$rtC(B9{QvrpXrxRpsc-g5g1e
z$vq-|&)6k1{lWc<lU{ftvqw5x=p=s^VPW$lVG`I`UPFR%5o~xFdJxu=HM%+xEHU4a
z)1Sv-ob2n`Q(CBl>GMH4pO)BldH>dr_)mt&OJ)bF$;+Mec70kFN`hkaB^Hv0)$UmZ
z=Jarswd8Gwy2Pq;wBFnqrPGm>hj|+*&MC#8CRkR29bC5O&igzv+}O@t-<(~s)@BFZ
zwU|IZ^&^Al+7l2XUrst$lt*->b?9l4$OWL@P=e9^WLWFhsiDK0E-{kgTM6C{F_=L$
z4o9a$;)xoKhSqv)5!xjnMG}z4wHtr^)YbIr?Ch<4D1UG_qDXqVZHMryPXH<YH9?gP
zBblo58ba`+!wXeaYk+FDuWt)G6I10j0gWHxpepQhnaIJI_L)Wk;@%}NYe=WMk1j$4
zOfJg(6lS;*(%dvHfm;}=Jj#6Ju#Q!Qb+=1vb5FrW)?_tg6Hq%5E~*j&ThEMwg@rP5
zD%lNj>x%?BHxdCapE5OEX!bCj00gJQjT0}0*$#tOK6vhYu!`$<{-s=YtLy$j?=9a2
zya#GkJ3y5XynD=@*toOnrUMWJ>P2@A3hb4XzFyy=N0*i<8E_a}y6q=8Pt|x;ITsnj
z9um434N+b$*2S6<C!H%#8oo-5Y;fTp@@xp2j)dWQ0C7Rw?h6s(5wJHB^0AjMlKMd1
zYNB#leMk{L!wiUK!KU8WL8&FKgCpmD1sWbmHtfVhoZ;!abIaD{x1r&>IgAnGy@f_p
z2KS-Df<`m)r2~K)R8)0Q&ugq@+gc6+{teIl$jnpIv0kQ}pUYd{YRPyK01E{lS`Sj)
z+*l<w$}SNije#%L6z9y$`<{wN&A!VgFxkn|<|M^0d(6%{N(YqtA8D!gE*o9r+2|O}
z%VTsiOUwGDT+)9N!UDZe(E}fhC`9R7M3;?eARk(lg3QZTyU4L~jxsKr<lgJnmseMm
z$(--fc&%3im?FTdTeicWpC1(Hmsohfyxjx^a{(`b`5E*(8C7jID+-f_p@G8cI(BmB
z-Ps^;$4yh`UeJfU@tC6lOtG<y3o`K+*L{B_Ol_UmNiksi(-DTdB6V!r4#k0MaXbCt
zEVThOfp}$g0kD#(@SX^|;liQ8Q>Ix&g@OZ4`3nX!5dKCGeDrKyJ+dhU=HE!?J1mB5
z1dlEDRsl*~|9W_?A@0%Qu*g>abppdIKW(%&gxt3fyUk)){G!+p2Pi%Jn5CbQaAd!C
z$IpUi;ZCoeE;NDwU-cIqo{euw9;o}A@NV`@<{Tl<Re06<B#VK2>R6>Rvl4+GZDNKB
zKEUs`grsmi4xbu_Iys4W;+N(8m206#M{I`a=s@1{FraEu;_;t-=?3N(v_T3IJlS<F
zmTx)(S8_2jwy#wX&;oD#G%b*T=&i}$j=#eav0FTlytIA%bQTTZ_&-_YlMx3nxLDl=
z6blQ(g;&e=)dN*vW>2TxT1i3`Kv$>%Duu`HtIzPHHlx==q67W}tCD_f-=uBXqWk5I
zZUWg|tnZ6aoIbWo5PsaH&pCS*zp#lu+=5$9^)EHzDit6+&&=fCQAGdV+&X#r31$=Y
zP=vVl)8Bx)>q1bV9|-hsffh2lHt-v=ka8N`Axjj~FbK3-P`?&S5X&>{WXq<OD?CZQ
z!O81^{e-M(aJn^kIR4>b8Xk|^HYFzrg;iZ)oSv;&k4YpsZzGQpczR3PVh>7owE^-=
z1_Ts_RCY{=oT=chd4+0iAG)L$n1tza>lYKu6f!$Gu=weqdjY!vZqd%Jw14MUf9F^K
z|CL|;om1Veiu}&0{w`ttE@AyHVTG3c^Chg`5c?Zqf3pOBvjhlPq2DY4!0q`BvA>xC
zzlm7CiCDjhSo;6pA!7aZVt;$FKjFo$$lqCCN`JH&VNhZg^ulwaLz<pAfdQjam#p@K
zwRp*do$7l+I`3}HLw!3<>wf63l-<&^3;m`dPBSI(;_thIG*{jqYWcC6(JlL(B==J#
zma1<HW9J|gA*gQsH5uH>`OrNS_t3liOXfs_`1_@@Ws?x%u*jD`$RB=ay7RY8wI+6%
z5Ek2|>ds?-<)1ncS_^cn=+FF6U)yW4of<{oSCi>oLicOx?c;LM`@4+*61q*U+v6W9
zM?Dmv*k&Hu`bMUb?yg*ahwJV9SMs4`5onZxRgW|M7+<7UawpMGrk}*M%banSA`tDY
z5Pw4-9RO`hD5{u%AFD^-+qZM%0{35)?jGbM(RLX@4~*yjchc|gL;ro~1epIV>EBaX
ze#6V(W7%(b`FjKM8`F1<&3Ejt|7l3uUqj%K&B_gfKAwKpEwSNMghAW^=xf<OOW#Tb
zXjMbO_lbS?(f^U|^V(yF(lfA(rra&!XA}BUBAoBdY)_dw>3^91RD^*|bq*L7wM{Gs
z><&tLPe6DXxi|qvV@k|Bm4UI?I-IfP%E{=_Ai(za({p8@Jf|4jZBo9`RDjSHJWMNG
z202v&=5rTsuJtV~H*fQdFRx90!OR)pr_I0=M@{6!M4Y1=&1JifR-Q0at{x4#W~Qf{
z+uN<2$0@`sZ)suQ8u4gNPy<x?&s&o;0FCk}OIvyG9Uj2Lt(HNrT50vMEru-?mX#xc
zd{gJy_p+~b7LY!EyD})nxWZLVs&WNY?wZ3y)qg$1a^HTD@<TVdWe>|j98JA>he~)I
z&Bh1&<!!<cqVzW7?>(B`2789_%kjSd+Dpv%;J<$PdMt;1{c33c*?NQh6q5hi1HLd?
z9=g3MYOdA<*zsrl0_z)32A<W->W8467DwEszN9Dg7uyfmVms=V-+5x5Li$8GV))W&
zc|zxVisnhPFZ<4AmGYV?-jokn%X&LMB(?8GJ?P|{w%Ni3DjC;z*v~KdJELwoIla#p
zwQrNbpb!R^hv2u1D&AZ6RbwhNp}`I#pX|{zgWoUwqyi9<8!)2`YQhq?*ZDuc=<d}Z
z@+J<0UBd+Ko`Esvp7eOuptPP#GV~`;vZZTUN5%>{2%{Zm*N<X)k7jXcX8EXPyJRyv
z#SLhA<8jcoI(wfYI3n!&%)47}&NPRv@2NdBj@Os1lf7i$cCWS$`6f<go{mKmG22m6
zg57WL?U+&;G~+6xruG8XBO-%eX)k!E>^r`MePh7C$I%CAbLqQ{NuHx%l!-rNb4KR}
z_XMsdkmU9W9Ft7^bqPr;+Ha?kSN1@?CHw{x;2FWu@zIy8CihS1i(`x<<)K2d`Pqx3
zNp*DUX~HwYP8R2;og7dIa0i$7O-Kiy4uk9~br+0b$C8F^VI>&qGkU_Ev(YQ61uRKA
z1`06OP~G-PW$=jV!;d<DKKRcId-vDz;y8`>{VxgoL;j4l_N4nr?61q8m3|z=yz^~I
zD(akRx3=>MU@T|32biM8;H|BqqVi5TTv(jdKk~e?_IRWAbpK56YJ<u0c!4-}FmKB1
z$>YbN*?4S;yt~m0CD<#H7DhKu&sb#RE4gFGMiR9GBb~Sf9XIZ>>6JdqHwfPHt}Jy0
zK@OH7!lHBjxm+Yy-8kn~5w#DpG=uNYLMC~D65Pce+f#Bk{-<dDA%e*d)IT!#AU$92
ze&=BZ+nvtkcgkWq2kO)xl-^jyB5{6j<N31NP_Yvn8oJ{xdQ%zR*tpC*D~zWCl%Qa5
z{kBMrZM_{6GIR@Wx7!qcJ;|cEXZ0Y%{ZDSGY^t?SNCG_IB$Ve_8X~OhG`z6`nhrzd
z<ibN92kUBs<1e@lsOud&emqe&pSnMiNoGFjE7_m5-gxgGALOgA=kkdDe0~2_+VWC%
zHl?+)?^EH?Z=ldXN&p4QHqcOVC+6NjT0)s_c5Z&(%yH?@h#}9^lMdcZ0my=nMzPN6
z8r;t>nbgZ-mQI{y*AeI`+7iLsLnsP4AVW>%&l9yUVp6{Nnsj`A(rhRlLLXMK3ER*e
z>1-Ao!%R#I&jcKq;TWw|aI9dJnZJ6S=)0}#0b9}fdM^L^4{zmC>dsbPt?a8T{Nsuk
z_iBhK9e7ofEL25QM|y(&OdwUp^Ut4Uo`i%%Mr0a1M<Q98YNp|BYTAYOvQwA2a2tIs
zm(~m72RrvP#7jAxIL#nx_b#RViz<**YplP+>a=>(I)8ehT$XOhS+05i_ZF%K0=E5A
zR;)5vhHw8+0D`b-T?05qRr1B^_>bb)L;3S})E5F6-Ol0ca?bAVoN+$^$gW1+Y(IOI
zs4ibfk<x(2wt$jL_fyG}llkZB<_BPWv?_k|0|!5cD~W=aEL=99#!7hWKc(bicUvBJ
zM4+~YJx=nwhr&+J2APGH4L!(G$?O$tOHwzR$e}}7M^?*?mvSp7Y<OL|yFSyrBn=x3
z$B>!|`yf$5VAl75e3{grl;q(B7RgXi(gCZ&r@Kh|XU+P%?@69JzHNC#!@YRAkL+GE
z#ajZ7F)2>WN4x=J6j)orm&Q1Rso}O;MVH(gE$4&oSCp)FT>`=;{qEWml{{>C2=c>2
zuleztFKxn~95)qK;?sO-D}R#108&yrKtCA-G=F_DA<u9C)@-Q<hcvlO7h3{iXs*iG
z8Z5Tjg)aKCA_x3RXun_8ANG&1ug_rs-tv*wX6-)?ZzMbL##>$cP~nf=`x9lj$MXr>
z`yUD;XAss04Jwccd~>W2o0z-v3nbDw0qeY$?Sd}9WP!XkfmM>ghR6rTQM5Ui`62;0
zA8T<AIxTh!vTm4tP1-Ed*>cd~K%-LZWv=oKC#SNO8=;~sCc;dA5->^A69B`sP#3UQ
z{&YS6Rn!=lNq6iCMuKCOV)s`USP3Www>+5EKq0jhWwVK#N{)A(AMIV`Sh9$WI7Us)
zaL+)huS0g^%a<<>1VcI1NhO6%KZ5r`j@7HbFjpNHs$~!@R`L%y%}7Se7dhV4D?DS`
z=vn2)?q2MRELlcA?=Nu_LVVcz<E*xi+J#~rpWEAPg1bNGa67`$Y;bS0+kDTm{_Sz2
zW4prtzqckM@{m?=1X;5>V=gEa%ArFrnDqOjO?N+mF`R?|XD@2kq?RH$d*wDYqlM8Y
zpcLE}2m0!&11Ey!+mpB2s%H}Ke5^diz`)(4Q-N%s&#p8G)m_yovx@_Yb}cL{>>U7I
z<F3X;mACh0W#w^w%2_jIYG8NxE+x8Mk>0+Y(D=QvGV$>njX{5>3xEH;)T28J!teSp
zcUKA}YfcdCWy*t0UnF-|Cih&gi~T&?#f!@BYx9g|E%>8OA^SGSBkNz<L^@93Lk*cX
zuqz?Yp1n|@9Snc`m>9EK1T|T(6!Y3xPj3Z%L{_bh_Iuq#CPIallVs%)70qZUq);cR
zI@px}ze+EJch75ECvFmSqHVx5dv`T|zwST%)R^m=P9P?H2L8C`H-xi4IqjJRDI^P%
zSnF18OGez85bl&6+IPS?GC`WWq>FCBc1Zjx5*i{tJj-i3YnkUdR1}RDD<uyF!$rHa
zid;4wddl1~lk~D*Q?rBw2S)(apgM6&$u2fJo>^LP;%sTndzXVlhr(u3RYLx}Os(qx
ze>F<lXMY@j8(DYocN}Y#!@PSSjFj8>`>G*71h_8fjuf^k|6td6nk*{VX!)GOWUFob
zj0=2g1_uQL<~;^XR+E6Qe93u9)J)I8A#b)1JkS6$f*H5O>sg2yXr>K#W#=mpb%?l{
zvr%)$yGHnKhUkat2GR06yv3HLWhh=nwPhB#&v+hXag|;8&IQg(`<K*GhWkX1;CBM|
zCrtSB_P6imq``-@ujEoo&$hJg9NfLF2Pd~Z<7VpyMhvcmBk^|b2-Doy(pX?y*45+C
z3Lt3Dsb{*-sjliN6qv6}V$S=fvmo)_`-ti|)Jqixqb~OicunQGEj7dX`b~hJOY*&+
zOGUt?>$akOKkQpE9w*+xr9<L}t@iBV5)Tsrm%gO(dWPcK5=q-Cj8x%R$VRGmTdBHq
zU5p?U>$DsrXj`A!&T70C%jSOtY2njbFfE%Le6hJ?V{PV)bO>EnBg|>ho$Yo`PD-eI
zxT*75A)&f~`I9VLEBOPLI9<wM){QB3Dg_qKvhwmy&pbZrp-$?COnuP@usvln`ki;h
z82V*DahTbAks9}Jj?(|eCdm(Hfk3f}`5@_z%U0~p0w5x#3e(^eE-oCwr5{lebyx{a
z3f>E@G_;e5T_fc}i-dvZQ)+JTnx1_ivLVvoZ9=}BZa-Pc{Y9Tx>~aQk_<DL7rppv~
zFb&hXvkZIoAKnHyJMCPP(EiDDKC3MeoH1%8n_MN3&1j`{k?z~Q|F+<aql_{(LCl(e
zw(Gm6{`c<U!v%unkPTtP1Uk>i!3y>G?!jEWS$Iv$-=roG1khOhAz>D9G@s4c>Zd2j
zpD><1tF<<d)rhzd$C|9<c;8Cqo)fTBxr7M7B!W1M_WB!%@1^*`D!`mf!Lg^iV)_?h
z{>u+2=yx!u$`L+$Ne+)AVgbSH{8-AuREeY6fC&&w$qkbJ5#nH_Xg;~6364ANOi-^1
zog_tCTX)fYO{CXu+$i-e$x7EPchIuAtQb1s_keEOh?ffbAa7Jpeg`MSjCXE6U@T!1
zIPhmH{NES(fNXyT37&$b=ws92(PMX$IYaYI>S1Q`H*bdBP_TeC0MF{-%JE|C{HaTx
zllz}MeR^~COfa3qnSBRWLqC0jt9o&AQItyd<egw~nf7dY5Ql<ul2SLdbtp@I;37D-
zrv}KS91`xXNPjPiJZB|C`zdLCcfH{Mez%05emJlbK=*w$^|wE?zpm<WlNvD%#r^Rq
z?Y06r1`vj|(!C4~Wz@{pd%j+Lxz6DA17uyCbe>5&d7MFsyH=^IEh{3+puPMYSr-Y|
zZ&!GFV)=HQs(CZCKZR!V-y~4}5Cw~1bq(V##(uy4zmvh7hdb`QK=CU>-MvyvJa>6d
z>}4XM<kXg@YSft`elET7Oh#5V!nOi)GvY!F$3%17s<}6ExHi!wa80G`zARKgeX-A0
zqTw~deZxAT%^d_7T`>;T@3*b&B>SN-+7k)?E|P5Emy)_^9{u-Q{_{@-D0Y%82LySa
z$uY{%->^!$!g%dr4{zkny0Anqcc=(DU}bJd-KM{IzI|M8vDJ6$#h%Ro3|T_UD-m@U
zFI)whqTZYlxY%U3N{pkoHQVX={<@&2Ux23n`9eRu_?MJ}s@35i_Wu60hjs^MZG2-+
z)|{naA!im)WuowrtUAz?=$2n7F6O;~d2pC^Pzi+Pp1mvV^^w^u$64hgCnsm4xdd$o
zU#!ucYABdN@U2p2Py+-hXVa9|*)}CvVT>ip7dO5|`n%^5bqxH{(;%t8=<R>BSa<dj
z6#68SjDF4?rjq4g82_}vCfZT<X6aN`y4s>Z398~?qVW@zFm3~gklXYl-1;cF!`Bb`
zSBGW29lbW2BEzEAi#)Q})#t+k=sne*QgNOuah!O*?7hiW8_e(=3K3=uII=Z9PhC&z
zy-atxSP4XNr|a#c@9=5QXJc}bP!k58BV1+;RAcwNWzH}&$2nW~Rj^+V#8nN%hlO2G
zO;)gr?2O^i<QC~)GoL;W@THg7>NYx9X#rd52Y+WYF`jg;Y&1CS5@ePSn#-_-^?D^{
zmZnsmJ~9upl&L7g=v^=I91A-wT0Eq8WG(5gU%f*E=h^-N#du+^+7JfkNU@>&EzWDR
zC!1W&f=>$}OUw*HFBL_EU-1jPT;Y9u3|Tkou+q(h!Nao0ZuFD2G!S{A#GsuX9I8pN
zFSyieN`miJ+dS{e6gKaA@4e-^^f5q$&-q5h1phuZ#yh#&`WSirAJj+aGYS^(H_Z)g
zZ@dJ9+#_u=k^Lq4OWC#12!Tuy*^fSc{B!Yss=>D~leyV-2HtVY8Ee?VA>9Fw!pQby
zrJERs6CgPt+x)t8=wom_NY{L>QLr?gz}n6@f9b%+aJ$r8>&c%mQjjRWvIVI^J`Z3(
z@CjO|)Y9eIcI1@sS@vqQ(`UR^l(cD`#M~LUC;hL7Y9t*g%BnXGx8p;7H?|Ch@Ooq2
zxm8Ko;;*;t+}7XJ@{MNe!PqnV1X?@Xs5COW*+FBTv!-6D=NJ2@ZpU4PT4R9g+yfF%
z3XxvH3oDZsefgcUe9*em!8oqX12~jOg=WaZrQ%T!J-zlJxy|+JqF^4($l3h3tpn>b
zqk0pB%g`wrw^kl@W#(R`%dVJlV+tMIf$D?*BvfCr2raWL>Qbpa%Hy4Dvl%+?Pr{I;
z1(Pqd>7&Sj!|xQ4gr&E;c%V-qi3RZ}W7Gp`d%k#KuPeYWN)xK<AENPIK6xlCga%*Q
zkph8^x5Y~>)dXqZY(JODKlg@mTF{g0h0O}EPHM!@PF++^Q-^6f`nAB<uO-RTC8zRg
zKL&m{fBN8yl$7&Lt%F`7Gx5jbqjQ{%jo(=f7OV0`eqjWTWBFLn6W&Ct9+K#p$rEZ{
zAzia|OV9y^DQ9~`^6FsY{yO-&Lx_C*rLOWDgN&j2+oz-_@eiL8Zh)@ux?fIEg}&pX
z6W*9r=>bE$&w%5ELb#0{b~^Zr<*nqwwfS}}fCL$c>XL(~_AU@gIDB~^nRKkX7!vR%
zr|5YTmNfOCFp)@RRad+vI$kbLhW-_2%nMG{!F(MV6e3H9E2b!etQ+AW&deGXa4d{f
zhCUQ}BW62|<`nZ!f_GhtlmklVwPJF)%Us&>{skO{bmI}P-X^#1x}30!%{==CZk3uv
z3HTRQ!J!Ega&dN$#StP|mqwir7ooy?x`$?fI<zGlP<tyh3wtkX0Z$k)sw6j~5!b&w
z(PHqyjN5`CKKmV#WeR6O+QL4_{NO?L-V+>Z5p}kWUvyVDRxR7o6ucDTdMXJITlgLf
zYCBB6vKiTBXxZX-zh$gv93u{rV!9QcvP<JltU$S50)1*RMPu(sP>cZO00T{fvA0uh
z9i4FRU|YZ}jk#twt=3>Y))Mqkb)~Bux=pz2j05`#iIh@cdvE+>KA7<eV+o0qZBMCw
zN9z0dY^<d?ix>9r%hN&*_ccU@xV3~eJDz}KKM;-hO*I<3{`EHw$VsLai_}$IU|W(i
zYptgc|7seKM>8d6eTZSbBb{XX^w9BqF1>r3QsL|@Ln*S>D4Q2YB^iT==sjlHrrIrY
zOe44}x|ze1gF8DClXA?fj?|J%Un}80%D}+dq|@aH;QpO+w{WX&y!CXsu%YKnA=%rm
z8TS)hx@zugG>o0|6}9SP`1H#0IblAR$nv2_j<zNZ8ll~(%lvZP7<^xz-IogrbVU1S
z&um9Zo4}`Hzv2Czm+-GWs=%#Q$h}DXz4!3n94;$HLeRo|u+Da{j16FQxZ_0gMmaP4
zwF=Lvb5J|<!+luePbqsKwd<rVFkyP3CD`H9{i<PMHl=BN-kogk9nH91<6~!fLPIII
zo3zW2T4NBDtvCo2>4BP?6P*&YU{i>B-!*GHurZcrzO1dFXF<{sX&r{ckQ8&jf!t4!
zO3<Fqn~1UV&n%yC$h?|qTi>y`R2}J|t1j*x!*9(TbgFP6)ga&H)u{CKE)2K}6edIb
zdB3BI4>JB#Sqt$F-g5k-Na7IcIf$ED8kQE>I|$wo^i(XZT|uk}xz3YMwJFekb#h*y
zp4G5MWa+)^vZgIAox*c!zmK{QRdn;rnKR%y++h0i61W^q)npR<IJ3-r)it8MuM`<U
z-NkK#%{s-Srco9oIQ1gtoSQRDRNh`=Yg#=ekaf1Mt}a?wo!G3q*Mkdjcbq$li@}p-
zT|{q{?xK|suypPGjTrQ74{sZPQczN}`a*mNV~LzUocJ*z<JIxcI%WJacmzfwaXGyr
zxorc+Khsq<clo7g0IY8E(6GhVdi6kKY)ni)f_TNW^@H-#*L@-PN<BAMsh2k1JqLRL
zWu>cEi1un-xr2QCM5Vm9Ji5F>;9U`JX(lAPw1ZL~%A;okpHpl)TZ*>gPF8|;bfjLn
zT-7z`n2H%49ewB4;682LstH0o<DM|GV20VpPG|*L+2<M{g->fQ*zcSrIJgWlCUqcV
z0!lOo{_H3NQNL6IGAHs7-yZt!W6oVq^^bhj|8Z4c-DXTbSO?#n=Qt^0cwff#b{xh0
zlFB}{uQ^f)6Pv-S)U%56IGtz#?=M2lD8}siJQEI?*$zx}?`7%Y-0SI){LX1#ZN(K?
z(1vgKK9pzu%8eXI&^##QJpIVTgO1-JObv#mZ(3ccoE|=`<I$2xRctcju9feSYMS|w
zB)6SPrsvWazg`4a3@fS(rU1l-ust->+cTu3#qlAEI_m?+Nmzlgd3%lFdwqYXMoPh=
z#Lq<icR|$OfA66ap)wq<ti&?(-Yqjj2QJF8nQN5vS<h9YeI;{fK}exTogm$;`_mT^
zpCcj^P$G&AL3ZS_va&9Z5SAqkS%TX_-8Rg<_m$?Ih1beUA2vho30yYqr|5y9X$krb
z^7}7Ae&3wyONG(#5~r!RNs1>bPZqAl%QX$XQB@@*H{5C4(v`A5E_E9znQuVe&xpMe
z;nw(W=i7PQ(0?@4;Fl3M8fWR*tjh|W|MYk`TP|oCZN6~|yi?q>oSR}-^gPnlPC3ZB
zyEuY{mDQ5#YN&3N)SibIm|JtN3Z|-JO`0IoT+wGmhP-uDBcm%TG3kl-zTAzLoAg4v
zd7CAg0L9IE@q)6J+*&kS%PhwSj%r3#Y-!g7F--GzcvQUa*Vzs3Pj!f?qa&#Ix=<3b
zzLSF>Me>iuqv6WF$W*Zc9d7w4?$}~T)y<w_^MW_9ET2d0w<a;ugZbsL;$Cg}H*rmo
zz2*ECD$)SUEynFn>?SOp218`qfO&I$B}mLjLI1E6<bbds2NVvXBPoqc{kN%d3Lixz
zy_Uxn%=_O556QWs6&i91(7J~X9cs&{4ul{QHMNrDg<gqUze&P;em;~q^uPvy!a_VZ
zC;CQce*l!^|Aw=~B$HMC3Rv{zaivIdiQYGJH1Cio$`!*ZY<-9XUF)+IK?W%YvZF-%
zFC~8PLW`ZhYCxOb(}#j@f&2@)wc`~hvMF3sBda^@Bp5TtZ{C?y0WfwOjI+`;vt?pj
z$n@k6P1$~PdfU;BuT+n<C&U5CE}H-tfA!jRDyr?0H`709iHO52ZIj@4(BqtzCUd1@
zy}?p9^Gz>2S4p(#T$w)Aexo^FECIaF`p4EJ-(2xCse8K`U7q-kMK0l-GmDUrma1)1
z>pOc6<t?`g#duLJF%Q?33<o$l!O&!V`gF~_ZI%eFeZ|dDXN>*Q;_9pDED$!I+jpSm
z-n80B4`9m0uc;XuZioKIj{Sp9M*w5Vn&}3qi}zwR{VP#*4~HC=7q;ee(}HKsnsuZ7
z{evtq`>$;_nX$--TOe6dUC?6DZfX?#Y*R_#W*)~CO4diPq1c5t&I<XY7wjYe*Y`(o
z^)M2VQntxowp=sDpuNRAI$p6g#+B=WBx~x)Qun4~J*C#Z-~(h7x`l;>VT6EwMx_~!
zUGrv5s6E`(Q9=UD(8dNC)R8}61^qHIMkYOij?e3xZ7ANpZ(eW=rA50&fPdC=%UY}W
zUIZbr>vD8kqapvKMgtu3;N2vGttysu2IJr=J2JSu#eN#qAzMXus<W*l)d!CGW<Q#e
zv*9G(hRQxj{JWH^A0T__M4ZBf3k<q0%(h6h)Tiqeus*RAespWWRonIE&8K{}m@pO=
zmi2NU*KT1#jr(4rUd+(L;Ck46+BqX>r7wK6WMQsB=FDa-@n3YAZyB~ec)s-2H^idU
zb7A<%EBKvK0=Soe9I7}@ty}j)+JtOEAB&8Q+B5wBv9H_zN&*@6n7c+4KWvqWyCt^^
z8V++!E5ITpyQKfi^zPlah53r9H($bxD~oR{%z!zn@6=;90KVLx{ODc(VGlFk>NMY7
zXLkGZ*`Rh527G>t(qk+LyIYbU3itYvQopPwMQmi)R@JD##q(md3yl*f&)>Smi~Ce(
z)Rykbst{);1)R{@Rh5s+2ZG{VPwc~6cfT&-v+dGoue}$F^Ccg0e)PfYUe?hR9*=Pq
zHm$t(Nev@s9gS-}Y%QkMm|{H$4xf@=(@ttx;hzj^C|D4K^4?Mooko3YWO){=$E?lb
z+M<-h6D>NYqr0*zHssGK&}XKq`d#rOX#mV7{#EH<`Y^~Q%wigM;^xazb<?H=z2j02
z-r5~Zca$EwIcj|7EPBy;feWPX-G#3VB`e0Yb_A$Qb`^w(E<0I6v%X>JuqrC;zE`DF
z$!4L5-gWTWr>N$hl{?(tMnMPaI?0{+to1e39*A|%MBJ@5$*ST!bEa~DzxBxszAI9L
za2ge7%j&k78K(xg{&8#s4_=FlD{8-Y7rOU(v8&C*q-N!MZ=mqaD(SUI--BpuNBUFF
z7#HEa&!0yZ?%8LAY#kora~|}=IBMR!DE+z(YXU?S*<pxsJJ0+;a+;|A1siLwD)qf9
zU#8P!Wd%)U*A4SPZjDK)t*C_pGm)UQz9Qkg@n~hT=VS6<{#y@u3Abt4xkJcl5g9LP
zBKHAT)V@njpD#nXZulan_gZ#wg>&j4FuDz}N&_BTh=ihC(Y$pzOt@jVKL*Z-Vf7G?
znBqORp-20Y_+8O<#ttp@-!gWzhgQlHN>@q}v~O!tV%s6F*4is_n(K`JP1FA4e=Bwp
z|CZLPKFG94685zzbQ)0pdj~hSRE8_Bn>1%6hJiAx0*vI1pskjY>V($qg1hNpgfAlh
zCYOHMS7JzEB=ErbR<o{zMB$f^;VmUkqu~#Ikj&EZFQz-^J6Fh8jrE%tNkIMNl_b_h
zFA*>Y*L9UPTdQ<zZ6gY1A_9eTbx?_r4{vRuh--dP<p$GE%guV)^_XREH$n4y_aU!k
zYWYZV@fGhdH$uj+a{V?GCF*R*E9Foy<hE=ymY^rXZ@GNIX_kW7*#ZlJW@(pSE3_W^
z+S9oy9_!KYiZ?PtZ!^imW_5h>OI2HuH}#Lk%%5-U&1$hLj&z#oQXh^F!~9!R@gM(N
zwo~;%R8A8e(JRl=FF#{cOZI$-d~-U@0k6)~s=+BD<K*O`P|n^MB_!+Oo!5{&sQv|1
z#@%LflXb774NjcaE47NBwU0GT-#bQNQ+c4=B!yk4nTSXzozTmW<L6}t-@192--4%_
ze(uRPi%mXa0E0AXF#w_?A!Zb(1mr<$A}VfOj_KO-xN^W>K!ORSFKjC|+ZG3wV`8^v
zVqaw6k|mTIl_b>V01|W#@tEnoeo!#+8swBd1E@HwQ)m_6*^EATWIh})gg!5hO2?U;
z(9PD&ej|$c<S5RX3Of*UC=6CpvDvKAlVg}T9>7OPxO=&iM~I}UIXgRUl{-!Oyho*M
z>N^Sw4}#={#UR<tpfgT~Vy<LANQ^)A#G%OhosS+p`qpQ;j6%kC+o72E{d))B&d&}l
z0x97?oo(SqB9hGXi1x@_#>Ios;S76d&)FZdAYYYstVd=R9HfJ=sjX0uB3ts<SYfM+
z7lTn=xZTalH#tpPFZ-U|uGoD{0M6uua8?WLF!-SA*HpeQ5Qw$wpt5>RP~3QF1~$8Q
zbjX{P!2i5<!!*1`!65YAyO?<wLfNsGgiyInQjF(d=dtdbX(|$^d-^i)N<}Q3A$sBT
zEQvT4D^B^O)l&&X8dz+w`f`mBL~?ZHm8yeW?noG`l77>w7=j=0(3WOwB|J1RW#ov#
zj!*ffT+da`dR1+LVvLh#_BkPMO5`%P_;bJ<#AJk%?62h9&I36g|9hA0ksZhb0h#vn
zw|3&aP4Z($Mq#>BV=WMDHVE|uR%Xeeyrz`t#@q>fw$s$o^{Gx+c#3MHZ+W~|Qn1rp
zo5*cJ1&=FNd}cT9CwHXkDXB7?m&p=VjODp%1DiY2M1!iN4X^ziY2Y=jr*Lx5{<d3;
zmoBN?2#R7+PuEcDyf7WWW!e;fW~*oO`S47}?LsZJl!4E3L|q0c%TJdB&g+hXH<vnH
z$Dk9<Hv#uZx9Tb$w&TEEmD#My6)Xq^L1x_x!SVe#!O?Fe8K%q_MdEjf+gOT_`43oH
z$q%ZLw1*Z>7Jg~E!}cH1^1B~MMiFgScM*e^y``4APaYqu37WZd|Eo-G>R097J;I5E
z8V3}j$8vGeHjciclfdH1)Nx+&SSoh4J)wx|g9q|n!`C+`@HKt(LAuegV!5K=+74s&
znI|W-)>rbkKELli6t7+e>KZ(U_{{t3F{38{81RUWo~%7InA>g;2_VJde#WU=#dgXk
z#jVOfMq2#cqE2B}B)?^3ea)(f$_W-!M~UAvIx(#@wGxhZZk=r7`KC$&lo8~$gSvs5
zLu1?sOC(4dtIybWyekADF800hL&?iKo{H&z@Kh+WKoPu0=0QtNkj(+PA0!b}Uf515
z?yqBjOkO<M>Ro)}wjT^Vi@B|utVweb=bWm%DejstoLRJ!{G%;rEQwCPwitHFrIFIC
zwaxL_gokt9d`(cg38)WwXawNIz43c5trX-oAGc0;>v?r%anYWTLd$dN@idds^K0oV
zn0s3S$zd#+&QKJe?@vt@-RxL~_|DV@)43cN=BG{qRY=1V_vd?r+j0y^*|d=idnVL}
z%q32DPps=lv4V0OS+`(EO>cpI7$CIWobPw@RP54VnoI~rJyuVrY8dny66P*3?R04h
zQKb=kUgj0BwaIv+_Q(JdkXxtm_X2un&>rxYeu1X-LbYt;ruyb3f-S54kiNLK?4er&
zScI*lAh=D}7N#<3#@U_X$L0Uv3=tzhHQ$QmgIV_tLEpr`$yR+Qm*28lhE#;C4m~K9
ztDcPJx)s{*%;bDChoor8VA-%Ph8v1ooe(lhS(<>7*W1FkMy4aC;UFO&ndYia&2Ql8
zS;lL3f32S(wIT~m)WKG+ZUa}fDM@^!3v*Fdj1@fx$1NqK<ecZ;Pa)&IXSIra`q2W(
z33gdRIs=4bpQ@|tz9a;UwGJDM;V|$vr{{zs!pPa1H|eEQaO+Quno(~bJ=)*yn5CVo
zzJ#osq0fdqs5-&os-EU0j_(dv$sMs?Dl*CnPgcA<vAG7@st=+?=nbfBBBskRI=2d~
zlvTdiqu4e7ANJlms>y6^8y_njR0O2sfb?decN-v0L7FsC5UD|WN4kO(0VyI)Kzi>r
z3L-{8P<oBQ&_W4>8cOo*pv*XPX1@2V^UnFL_4}6pxk8ptp1t?ouKT*~T{N+CJd%vA
ztDQ=2{u!UH;P#w4GuYL=g6rkqwDd35fR?@)`vKV&(K>qmBmW*QPF((telW~PcP+|L
z%Krqxdp<nwcOBSBk)p}rW5Pmvz8Bnz^_Lj@|I+tHu+{bl5T1Fv5_J9Zuhg;}ocd;@
z;JUEC?2`QFMoK8c-yP=|@VHK(78KBeCVnONz@^vUbO*YCTJo2Cj{l_x^+(>Kx<**j
zJ^~GhcG815VNWkGL;5#$^Z#-i6{8I26iC44m)ruZp1zlcR0meR8R3C{+z1KP`d5J4
z$Z!*=LplJUt-cjIclx&RUTF+&3H$5P81ekh-Kg-xo8%)i_exIw5$657Q_I%zJ)eg#
zDL51o5lG~(tq%Ajb;2BE4tIR(NFMo{j^t@WKqo1C`b(-Q;~06I|NjLX|H0h^>VGfD
z!#&p%B>`CoqGmq-<Z+orSKD(*ko1EWo;s|<Kf+IF_E9xCVP96DyWbj30d8F&$i@IP
zz{mMtd4EHoJCepMeSQ7`z2U>ITV&V|Xj6o?moV4$+RqD`WoDKeU&7)AKj3!ZwR=pg
zr9Cl}Q|o_Wc`(9o@mH7jn{GDW`gIHc4PVjX^)-QV|8$f*-phKbf$HlYw^^!{@Vmc}
zhF^1j>$y?>7i>qmLo8zUw^}QSn9v1qlKQzxKN#V^WCZ)E>Ca92&nupvmh>M-ga7B;
zomnrNJHXgug>-N5YS$S>$HYwb=6-dUKt8DTSi6>hzWimjS5oC!gZ8y}LG~-5xJ!a2
zb=+LcbJDYVkUMwoe0f9PPzf4?4s(U(nU|L}qX9D_TRk-vOsXd&w&yoL>d68QwTqt@
z7Ne4@S$z$5B8$Lfc32!`b=Y}(b{ZZV8{5(3y&fO5$BnrLnr8p7LpO_MbI%H`R&I}D
zW=cm!N6Yytz@D;)m^`3a(o&cNtXfS`TYbK4X2hg@6JVsbhdG-(olfyq2tA1nF>8-g
zbKQ!KH3Q_vGOw*!U$gSNg}O}W^O(6$iuf~Y#x~rOOb76QEH+k{<9QOWUpzN__!z~C
zpWbbwoLkQVl>du#*WqE*?^;8*SV-3yBs|g#8{AIoRi`aD&-KSor{q#sq|z`?OxV4z
zA!+%HB)Vh;WEjpSZdVrTR_p+F6LR_T<rzT<P<gzNaJ)4>R%#@>b3bIIP1Q-N=i$Tu
z0eSz=Q{}cr1&o18{Ie7pqHC?B&(ugv>YNm4g%bHveU~5SE~is!&dq;ngx+*IJbviN
zu|q~0LF05n$#cYdzSKEMg~JY09cLOnD5JL*z1eQNNq4_2Hf-b{sfNTZK<r3+!$l7t
zBmPy`X2z{{BV{{ab<4yt(wG_9n@fFqjiT3bK7l7<$+=SAh~L(r!mX;IdPP8`DEHuo
z3^RO$N_r`W-HX*0^&Ir*9hSbxCW`K^k>l^Oz53-;EMl*4ApJX3`9II&2St>OEAF42
z9kY%ab#EJsd(R?XqQR-kgpei~i6-+f%+&7@{am8p*mJ-kQbhvpvyQcU>>PL^CMKpa
z$ws@0!0q*go7QEwFdEInV%l2sw4%d5s`(y1S0~?>*Jlot8mA#Gc|iBC-%d~jp6*H-
zj?g&*OLeb{b3zTuWcG|)(qHLJ5;O0A!9&PD)19)Z4px2Zz6JmDRfN=0SQt(Hm3wam
ztN7FA>qH(u_HBRk^bojh&DTjg3k4yNRd#ADHS>^#xpfiHHw11FP-(#ckh&|9?K$?)
zr)3fm!dmXdOlT_r)i9wqS+O&0c+9VZ_t^2{r}^S+;~Lyof*P*m`y=ypY@SKGV}hk2
zR#LA-l~M!@VpUTv7<_n^A2pn{$qaQxi=6{}3#jeQUvDdZ15(5P8c1aev<9SX(Gy?J
z+hioY(flp5`o9(!e!>I+NU1?o!}av$m+Cd0iRX2nKg!d(>$$PO5BNH&eQWIO?B<A_
zKFu2YPdAOYy1#(>-o4UVrPg86A<fPdqLP2C)|#D%hv%GK^K~q48)B%vbLAJmUk(<#
zEb?^8>59oy!8yT;CW+1;qxncVz$c>Mu+}KU?(#I2*L*k9*KHA>Uo0D=9HZ!|v&?c}
z<Qp|U;2+NeBa{7+1RSKcJU$ycTSY>$Okh_T);WDzHDWw(Rd%!R*4XOibt2;iHw8%`
z;zDKGNj0Dvd#?{yEWVghxv{;_$F=5%zhJ^m%@+0XAn!>TAW*-N9nI*jf1E?t(Qat9
z>8YjG*nmxxVWIN}WUXeCVe8G})3Ia)#^sj@^xbQ^TWnE9-}33h|9C!qH=fNMR7PI|
z(IT2@@^4C%aLa9$v;B>QxwW@0K!hkzVj>qrLH~>(P#}j*zkk}(J$Q&{9rozPA@XqL
zu#bEAcSNEUcggdF1a88ao*yb#0q7Wccq7moRoIQl_mWIDfU*<%aBDeyqE%%JLVn%)
zN>qax?DIL#sn5TZ>%q-LmF%W^UDg6<!G90~w6QnjoKDctY{BMGp85FKrwF*%-0_-U
z57K_yW#xZ<myP_9$x>@kx4NLGq9<~-xR8J+Yz}XNOh%Sl?1f&%XZ6VS5p*mas$rf#
z#35abGxDhrbn8NF(W2~7*%jDUCFJoI<GeF!m4rZ4^1)6jS{(b-XOjHH0MOeAh46zh
zMct%vxZv0=7|<iFJ#W!0KA6EP&M;3y=Xz;M=migc7i|$86_qwyq^_ak_c6~k$mRKV
z+2qRPf@_skkpc*dIIipHtYAPuwa{YH0obX>QtCPT*TiGkJ}Q@aXD<x{tOvTW8VNep
z!Geh+%aFIBlLk!iks<#GEx0~<agZ}fw0Ied3yt`=xGDB31@x>1Gp}Pc<XEH9TeglS
z$50YyW<Q*hKvsMm;(a0Hk3{s|6a0f8U?U?t*4)`FCKqFq+-1*M`_$&pesTHNWU~Fg
z0`;EuQX8cL2DIDXqn?fU2bT+(G;v%C*?0zEaa3q-luJA9!sMh!I8(NXB5GZW0tGJ9
zxj;GCR$uxcBkpsBvNhUDO+Wcgy+hwb)WPm9SuI6Lmq*8)fAvfo5QBU1P;;V)L=S~m
zzEnH%+M-kM#Hwbh&pK=3*%gW#NBxYewTlS!<Y@mRWJIWYD3&7)Y~jRaCk{AYTnAd;
z03Qg-b|93^Jz%Rd^U8{ght~V=beg&agw+gS?n(o#>Va%6u1Ao;nh*4By68iVy-<B`
zPpYTeXkYQ`VmAhE;NKb6I!N4>V>qs)@y+4-{qqj@QdEPYs;@f+HhqwkW#<9(36scm
z$1>Nn10q(vv4~4;Qq9QYesvNTyJE~XxatqCFWVTF+LY(~Vv#l=tT?#amP&aT_0qC_
z1!z)SI(i>k1JY#Nl)xPJMO1$6bq3mC34V0rH16T~oS2qAl8N-DUY<89ObUZw(~dHo
z!>u7O3)Ln^<}a}y)K|L=*cG{&lY%`XRlh2+%-4_1Y~;^&9;UA`@A;S}$A8XZ@#fIl
z^0q=zrfrI(dr_>AiL$}0_Hd<jc1NOEXMWtT2iL#F;)s7d7N@RKMgzf@B2aXk5JtL!
ztod`6!56L9yUS3F1GQyeSpbyNb*yO@4g-pgu}OIduWp?Yr`ijeoUnb4>VfS|Yn!pW
zn3a>xzP3emk7KUFe4)5eZSpy|8l%f$Y3yLf?4s2nFoHwv-IM1`!k3{S!#E*z_m191
zyBYDI{+DzjJkKGbC&V>xfpYH*;1Sue^7$iC_<GRT8c5DC!50x2<zwsi7e;T@6?7yt
zaeuk_oegkg{%i4BNJ>KlYs=sl`-t^{`2s1I`I6Pyfh*O?M-P8C*u%-T|9PD7vy{>}
z6fW!zWOB}Hc7W~8EGhB~aNB0qNqU8S7q9W?6x7(o&kYnS=Zmg6kH|2h2txD`6wyIy
zFowi@PWSQ=@y>?+f?>g0rfjFVMo}BXGbpG%^yZ-N+6UVM*~~k)GzdcUL+hWc$!V|d
zE^L^Xb$?;;XvtM%Qz0<}I;)-KaFDUjE^dE`+|IiGrkMcCjmZL6XVGQIU?0KRX>9Ms
z%84pE%|s#8>#i?Zfqo_RY)kCbgC5Dcg*OcT$sc?sQRbE-MK?;?yCdZ5zCn10{_%LB
z;XwowD}tZCapOjv$M+5!s*1=uN2@*s5D%zJ3`W+&ksqG5AK1=$2b3l6&ua|yFSyPu
zLC)R2{iW84NQ$A?avIg^*f;<*X1{8^is-RcFZXbsC?WNnYrJXSq+AY|XbN*lKtPL<
zYaD0|qkAF8nKqy<b5LJ7%_Q|SW+p>p#*R?oR9M6HIGbe8-+n(5%7zU!Pda1LwBs`n
z9UIFL{(Q#QWQ#fW=(9Hsy^m*6NT>4ReXcrl(V}7o=Trcyj_%cg17Y7Z7EJ$m_kc?#
z0Qp^{;5>Qa#0fy%j^{XY=1R3jNifiYfJA8eePRz}fN`L>ovqDsIQ@ki%RF*E62IHj
zk#fEdEuDTd?{z(C(_Et_<IRD3yOOOsp@v@<MrMfwx{|jq)j3%+&!4MX0RDY~yb<NB
zWP9BRUDwMF#M!*s4M3cJLF!9cJbyAD2!4WZ)XA!WtC|Us2bH5zn2r#Up|v=}-MaN>
z+pKPSu6b%n{o;)PO0?wG%*^4xRiaZJzqOGM_}$JUmhx<k-x@4b|CJ@O9dU|_H@3;)
z+W;CpGo1e{2t0NPn0HLM*VD@uE368wI`5f)WGsfZb7YoMZeD!3!IxKEdZ5uhD)^q-
z$hC~%PG`@BvF-3D^kSE*W%L3hKj|gg6m0yeRK#`3TZdY&?0(}(-kW-^BOp1CU6dJ-
z8tIW#D)Py^+x}|9c_4b2HKDt)q?2K>AtUbzqm-JfwwLeh=kD9ody&iz^nm_S&-tI1
z4$5E{(5fX_mTICyokOFCYcw@i<ZM+){b|s~C8z~Z>f1xp^@I*O!LB_v82BUQ)?@9e
zztg4jMpEJ^G-Q_xE?>E_ojd`WmakB<V<s!7-EEgnK?ii6p(-{-7gl}k<z3k*h|PZW
z1M8*|u%+hgnyKEj2-4dZGM?{-xWFup>QT*$Q=R(h^(<?R!e)A`W9uECyUVV4=Hf$f
z-q@9{a*Wl0PNI4JJUjJX@);ZaPp<_H?wa-fEPx%ty1b&0;xMS<hB`cWAeITV1G`n`
z{U36*rj!BQ$+;Sw5VWNF{nYf4lpBoxN6vP=kT`QzW>v$gD`)%O7%|{*XDZ#$7x%3M
z7zm1TXnEX4zrn1iUIx4?)hPZEIm?9)GN~I$8tY#CJr=5~MIW6eftu@SC=Ku2;vAT$
zbM8*>FJmqY{}cb_e^E9n7qhufUaM};d|d9-N6F+Ah`zc-1<#GKPu(0iubJ0dNMOBa
z0?F^=M^9qI=svb5%Bi;l1i&1RLn8;^KK+eNV+;ha1Qfx}hv&*?1#KrXZ(!iXas#$q
zITS0?MX`4xwsSUyzY=G@yXPmLH;w}V21w?4466JE-#*Ka&$6w*`h2~DGI~EBxToIL
z92}m1d3V~Q4=6@coV+0MJX-1)WG7cG6WkpPeRBZ9IdB{tU-}47y!LCvtcjV_1rOrT
zJsL7#bj;Qf!|duyuRmV+HHz|E+fec!FV$j<6)@`yb=St|j6Z36PLJ6FZiBR|XC^zh
zakh)hbb@^P-Hl(`lG@{i9@l-WT3`gk?xAv+3)<6(m5pF3i*=fs(OITnhXMWT<p>wM
z=;${tV$DMpR@pKrP$A3RPVMMTkkYkN-rR-&m33lbRjaWoDWG}^%=TA8UVkE_>p(S~
zHXGBgfH~FnJjJCz4J{(#(l9@=UFbA(j2-W_Y7)T;d-QoOFE=u*{xs{tFwb0nan$Cf
zxLQ&&DJn$up1R4&rPxh?23UT|OIg70md5Z|lR)<xQ@ZN^IF6aA8|C%>%UR9xsY`WM
zyn&lT7WK&s+IgdA*n`!MIa^gH#*-rRu1^4wRtLGp%2^-}fAHdJ)0x|B%S#A&CjNE8
z1rwDTE<IpQgwX=7!yuUh^VaI>77}w2RUfo7Jym@P)8^POr*O#ORs&R%MU8=U^hIJ7
z%$S@w2i-u^E~*0R>&2X6DDI+h>V?nQ1VhYFY&`9%TZlMcoPP(%q%y}<C=U7**KTcX
z=le*1-K82Q@I<iI>H~F0*OHWD-W782^4g303}LXCbt!`$=R(y8d0~QU4(R+k1{TdA
z@Z2BiTk_9|k2R}N>j*Mj1;hr^xA%DeP{!?d9{&aGd3}%2FaFG@gxlJjb=Y2TMdi87
z^xg!_PBuVQatJ)mDB1kzc%Anp+d(kgjb6&`(SmwNvZQ$mfWpsy5j{$=cpAEkQ+X{*
zUsy^Qw19v1>OlN%|45QKHZ<tKc7o+ROOFO_ZS%ZOh;ftG4T46sS|IiVn82pr=#a#|
zlQag|5Q7hM<PY$#SsDmKp4H%d7p!*H22#zIqKu1Pu0Vi_-0YKo<?}iyPLj*$?(lsS
zx0%<0wL=V`0_q)mw3QwdS2!28HMe^Wj07#9SGk=0A-TVpUC{^J(7g3Xa!jhx7zIxS
zQ|buPo@-#%!5NK|28DQs+0RET;b)gN47$S(&y+mar7ZTP(;`eGJaF}XQg0-6$BU*x
zG?n`cFtFk6>iukHd7d898r+zKH|nz9hEkMt!KiBRA6n#QMh7m|=x>Z$#3irLf8=+K
z_WqZ)+#kOG+h5-iXk_5r8Xg(!g|&MW1EoO>ZZ{alP9;|~(0a3xG<$<}u#;X>%=thV
zk@FtQb%4yR?`~V9QfgE2(fOE94CvbISLCdcr@xdD5_6!Ii|DC^9G$m#_29c2Ylf2f
zo5`D0%Ur*-a7ze`$r*F5C+HMXwc^4~@}Q_Gb?KCp9>w1iF#c?qZ;yCc=9Vt1<g<pN
zvFs^If5jT~M8JMyOvG&Uz1Ts!U%yN9q28Y*m72VUIAN*958<_iMGXK0BKIiFCJ2g9
zD%M511%m?TTvksKF#3AqWYSdjHvF?OiUZ>W9uYz72O9H~-F(h!24cQn9KpTe_i~B{
zEy*$q*qP9~*REZ2*kPn+2b8UKyO%GN_Y$%X|9mrhZ|zOB+4|vpAX5eSJ+<(YIf!A7
zvu`q9OA<Q#Ywx0EKYG8wbMrR;RP8&UN`vCNnNtEJp0{4Ue0gxuyAO4y42%eT=-nZD
zlq{MRVBc4tFx*CA%I`_4TM6d+YL)}isbs6y?y#$uDsJ;@h11-)PC2DNk|9D>|2o(0
zV#B60Utj|vRQM_K9n^tL=P1MEN6hp177y$5TE)#n03A_|VU4pdoDPx{QVCffGrXeZ
zOC_<`o={r+c<Vt(g;y5mZ@L)Sb}jt)6Nd9jgn@Dzj5LY5do|?6|3YDO1g2X!$RNy-
zd(f6wHBqN{EOkDb{ybM!-(-MswO4H@=3VAcw17d?LvOg3bxeU?E%)uzC%rl9>&bGi
z&w$cG_)A&O*2(qT3J%V^ke(?a2Fk*zE))4Up|O+p5HMrT>UDmy=ZBT9zP=~Sa;6Dh
z+he{W&WB+lOo?UPlYPdR(Q=`gMKy0(sm5VLL8H2y5ki)S^Y5q&E6qV{H=48$KDZ=M
z_Z)4mNzH+u9AGtH9MzL}fJs0H^`yN^_2uS@-gq=Cq#-+tM`8wNi`!E)@X1H>C!<~V
z#9K2g|2T~-b(J(4qPJ0WSy7QuN9(`}xNTYa=CPd(xbM?)Fv*QDP!n|GVC7xCPovMM
zgm`uCLyt(Djx#@y6?Y_7_Lk!34+yz~Q6aMoJ)C<B>T~KgK|I{x27B1v<i7ICX?|3d
zFyExa#EK!{2&}JCx4@7a(o{LrePJK@w0{Cdk5T05rI+<ScoF&nbS3A+3RbPb^cglt
zFoa(lrIRS({opn0=j*BA;Ym6~qt>^8zQc8}8S6LgDnJm4fI(Rc#Coi*KCa-v>*6Hw
z*|B`O3U>KkAzwY~t8%)Wa*Br>U%hX`<Jfu^gSQeXqJ4oVxa>~fuM*x{ndw-~o*~t!
z20~*f$CM1(BWNINGVWuM4;SS<|4sey?7sjOf#n~n=s6zy<U;0p0Q<unbyW%{QgmTf
z`-krIubG2#b|fAP-$9Rn_42Yy<I?Wt<D<_GXx!CZ$rW}UNazP+5KVN{Q;P<ki<<_I
zx{NR@3<!g)$ZLIQF>P0~=X5L^R-!HPq|<EwaQ6j}wNiLM!1%OFiBH(vxv$YzcQr`x
zA>$0L&DhBYl}JHRa^&+8+ydVUXEDx?q?>oy2tA?cZS?!+mF*m|vL78SWzl_9e&qD$
zbVzBrkzjPtQ!tLH^VVTp=~49A^tjHWFrxuo{Hyt~jlzy3IzF)pyPCWnWHA`T;n>yx
zRIqq`y*{pbe4M{smw$ESs`=C&xi07Ae<Nvi@I754ADI5)^&CU7dXtZB_x)V`mD9S<
z7U4JU9&HD7tJx}pp)~c|x~DPCL7|5m3M8Gq!8`%br^G$nJ*W9K%`XG_hKPlv4he=N
zd>D3a4_H^R4FOC`tBCJd`laVZ-{f9{Y2GB!L}xyfF&h^RDBY??W!C$yjdfT1>Pi3r
z&5l*~5;(9%j$qK&wIIy17jnmLG#OqY<ZmZ=wy0{i@PqYeH>ps6-`6pm+J3K9iZyA-
zjc%@LuX3f`NvD=PO%izQ8r!jhJn|0%qkc&bJaG_Q2>y#g9w{mJpm**EzF!4GW4lQn
zpN6655sd=|>b0KdCF(a`Onb??buD%*c1WM!xVQ7QetS_0(NV5mxY-@~%Jagm>Y|88
zZ_QGzK$VrG_WHCtbz88a@2>q2<|8e?T~tHv7>Br=L+@imEmUsAiFd0@6Cb=-I`Hw#
z$WYS~1hLc%eGG$!+sZ{sV{Rw7;f8EAr0m%I^tNFYX8uUa*4{r{QRAmhLX2<;?Yts!
zq9oYy0)5@Zhkrfw{)a0`a!Tb3zG&zYN1J$enj=2e+o=e6eblE5R1@2^X`RDu6#G(U
zKjGeu>kp-S#XtWk!=lCwqfG<9FzVFaUYx+>gXyV%PFcUxby|^%Ov-y9NxN-1L=GqV
z!u#X<ytO+wxoJ2w#yJ}d5#h@Ma#S)-zBNlP9Su@=w`EA)*bP}E=}cxV>I*70ZBwmN
zjM$WW=g$EIg8{cSf4=aeJG(nyM4iNDZ?+Dxu8{;ghcDj;Z=dBaUCmeMG`Mv~QC<T6
z$U=rEPQnkGvrGdniZ_0q#!lmD)la$H%;HVv-CnP5V%=hut<f5&YUC!_)o4UT+oQeZ
z><ms$)?_GP!o`L!Jdv7izWAuYv)%>26VKIR$*ytVb^P(W6OSrWRr5KOQgl?ke;jFl
zY$o>MF}v(R!&vqM*5ZmW>3n~@e&Vmz+mC_lEh)~7h6Cz6<$Wf=)|NiiV{2L1YPF;)
zTgs`SS5qa(`c)^nia@2)(3bKb`eA_2v1qaPg1H))S7T&d&~pWq{gT>A+;r!PJWSR3
zn9eRGl(c`W*IpQt!(kmxIdmYj=UVfw^D5y&<aS<-8O%?2CNXZYEH&nJazeHmvG3|f
zf*z)Npq5KoX$`9Cnnsx-rM8<Vl9CN{nw&ml+T#yxR7%qvh8aBQ?R+C)LC4}%s*EKv
z@!CYZu<t(Y83;6!F84c(M3kE5%i4qTi|cq+QEQLOzN+HvxM&@xyslTN7x*JLY%?gt
zNal+1vnA??@Hs}>CZI=r&fK(nCSIMKYG;Rwxd{F#l$j*DxN4XI@sg~VRK~N)SNu(Z
zzEIHJNY-N~R8rs3?yWlaKfLOe@5X}CZWo7Ih0zL-Z!h2*g?({QzW)51o4e=*8cGSb
z+gZG(&F&V#Citm%nmMN`VUklCFNCvBT`X{kgzw@$3ES-?SoPJZVogI>=$q<CShTmd
zrwqzl(lRLZ3*3u_m6Axa{E=cEHJtPHU49GAU#6ch()gGVC+co-m|{6Dz%eWD<_B5|
z;!Vg6Y%7i0dlaG?XhH(~U(-RCo(a#teM%$nQF6OtsZDOT=uUE65LoJzC#LAebt>--
zsftPaVQ&-70}Cz`&%~cfGfm87s1xTG)p<Pr+@BpC63gVaw8-r9i~L-EJF7NXG?(8F
zpAb}*zr3St!4A`J010M~l+0NYbM>h|$Hkz**6(w!@CBRut+Q+2?kL#5XhG}X#hT<h
zjyEC>7a*9_f{XU=H~PU-{CL#?!L3;FALHAM(T>{Lnyro}uc<Wins_W1bk>3#;?BFa
z!6M@k%m}F|KSsHDV||!j%$WM#xWlC(Oe@bR-;c<W<#$Qijjb^nGPGACC33AAi!@E~
zO(DUJ>!VOBSGYGi+5YC~%d*)^Rg<@Tt{s6{j5~M_mUW3PjFaN#%ew+&G%T4<Kt=|T
zg-~0#IR2{?ghyKbc1!oPqd|3^pwf6~27)S@$jZ>Ov(Pj*D^Ae*X~U3DZ-S|Ly9$ld
zB%3=%6vGJFd@$2r=$V^N(>3PP)?vS}%GVw@@bY#WGn65iMeJpFmmN(~{q*=qOK-kl
zp&pm5X%?IN=Tx5fof5O|-2kd_A?cd0UzU6j*;Ia)_ZIfmKfADA!@Z0xp?vE_IW8X_
zeQn0$*1Ev)%q+Q;u$>;lN=&ED0)J|dmFGA`KONL5H<FDKVJ6|#ZB&ln<v4)hP%>VK
zIm|#rCBfeSLQ-GeRUskZf)*6Tf_-<sP6{Ju`u)bPgwY1=QtcQgh(U~DK3*s-zChrL
zY;^m5zu*v?UxTX+4*4S&au~MWl3dcDkn)+$H>Z%@n#r)g4{dCDA;B73sFjz-M+A#m
zRu$ifE<t3A35rxq)WUJ=PlbJ&XU*HKwM)>lL_tXCwN&t|-~h^TcGRKsyhmVdPgvlK
z2WXY?Q(bsh1jG)y^p3Gu8&y<xl$ziK+6k`LhNM>`rEGOA*@Y6nGRV4Xs&}x-PWg8i
zD=&LE(0=7CmB%Od1J*SwE=3&jzyI-X0-uw!pWd5P;IHD1z0~x)*F^Z#TT(pHC!&v`
zCwwB99W*ylx_FbJ5$TnV9@Dp$ZSewV)i*g$rvnSCMypU+LQSh)r#zaU-gu{9S;}y8
zbJ5N-u!T~l%t~cts#D-71KevRJkL4)a*(D1M#@L}yef1tPk7~(=Wrtl_El1L2okE9
ziVLBlgyZ@*3}_m${qx<v@^Jh9L1o1GB->AUAUmc}yu@nL@adK5PE8mugQ3LQ1R-V>
z>1E$E)uoDNb)8>Yf}3DH2**}tW5c4QB<5(mK(YB7`n#Ng0#$=$cVfQ2izI<=?`F`<
zW%BUTamdZQZfRMR8>}8Hq~+H;rY?z{S=u4%s^oKgS$gEo0#^_3l%x_4rr~pLRm$f2
zGV7AIj(%m0vgbmjZZj}YmZImPS(`V5uN_((Z}gmjL+l3~@@-r4@RherwLTS|>Qyg-
z&SS_fV#pGw%3G$PCnFdxRA8em2UJO@WLD)@9@GlW6_neZ@_d&$HQ~9~n9+A{s!XMr
zg5bj*cpZuqXY0U0)rRPrfG?bRbT@2(LT34qu;=>xl;`G;`HNo>CtKi1-#t}dKn7~D
zy~0HOXNUB!zKTJSO=pQKAEf6NM#n_QR?E$~_}$6SvfJMEHtx^;o3@!xtdGw<EQ{Y+
zNiA>w)V9iJkW!U)Q>nIB2Deu1OFLpzV{e)}A?Rv1VARBTl=75jB^<=bNQo+6x3x-N
z?ZWy@-q`0E^^3S02`+1~_UnTyE%%aa$Ma^Z$34z7$=-(QOh2bAYMkmX*}<gRNb=(v
zb|VrI!?U`<nsbI=ueC3+sx~@YooW31!JHymOkZwomD;?WkH)6dJ=KNk@_l{$kVPtq
zBN>&`{q01THFHEO9e#Y>sWUQvcT9aePiE=;A?xvCO^TulO|*UAGqE^cD_Pf(NIUWY
zBe_DX+XHAUX>=sRdHxr&TcdaGRW9tpeesR<OX;3fG7Aav1WQv%9AU$LXw)T%5qiN8
zr+;rK`mRU*Qf9*GAhiyHh4Z8P@^ur$O|R*BE;y^iL2+C8h??|6%^|E+_(O&m|7O@&
zQ@Q8a!SS284}9gJ8ec6X1vgfZrWq}iQuBj`J2S<sl+$WVBVJxTPwFpyh9l40?aVay
z2>KZ9jAL@;+gRXo4LcZ>))idHk0xt$L!P*r@8fgX>XRkG23DKu|D$CeyU+jKwEHgl
z!`c}(#y1RZaEiF+nnl0i*>J~Up+VHa%-Tibec1H2NMe)mWozwX_q*$Jrc0kfXpOBT
zpjKl=*Aa743rrC#UU&M6IH`!m5pNX`llnqBh4mbKH$fp;-#Oiq%Z`gFw?eg*wo%+4
zK&y$4^FNWYaL{@-(M52lEtGIBg2M%wsTorRO%2HTXj;Z?=LRM=XXWIMUyaDa)i-2r
zf5tCmG*?5{0?Il$s3yeomc%XyrN+5;XnK3hm&yg6e;2{6-J9zO@(S1`NsqOy%R}2T
zODo&WXX0_wlW)!Wc<*!XRRQ;F$)mX-C!ls)3#PLm&_ztQ#-~t0g#z;jOz=IX?Xn{m
z@cx~GHWNorj(;&iowuAYH{D&6HR8XP@+B&;oKDd2SQUIR%ruBbhd)K58L3DvnbSLY
zrmK=7n(Nt7@=++3V&aSt?~4ZPJI{+<DKbf6BS&G-<#3~xanD6o-1?}A!I6$5uq2q*
z>EE4i8YOVdbGJ`0dJ*^A2MGPLe_!Rl8t8AIFx>iXsdaNjtbz$nS6U@TtI@764;L!F
zaJV;UH^Tg(YHb8Ad*Ypjc%zNGBH2+^kqcg5=jwF|aqCi$pp2ue3{xL>O9*>tx*x%j
z2KEN)zHj^^o0VH4NtEs7<}?T)yqdA7o}IsO^;}_{zE$!Q$%XlnKAn-uyp7K)LMM$y
zB}?2sGQtc#iQi|BYGcEu;xT68wn!3Nk6YU<r55Vssk<H1A4GS0dm=+_WQ05uD0Y6+
z8j~F)GGJJ5Qx1~eYo{)3MwLxkl7YNM$|3S;h6cHYD@I_0xfUvEw3mS`ymzGMfZv;2
zXtvBwF=A?Op^`f$m>}KMSM!lUipT3-xj^VNC2O}B2ZRfP)wf7?ZV8&!5J>UJE*WBU
zLn;J?&qKr7#_BhSK@fA+bMEU4YlBfsMRU12A+<mm5Ju!nD_G}tai~3p!m{kFE!L8e
z1ESxLsb_Onp@9F8_syU{)@S5>bPdi>b@aEb`1^l^^L@+sq!Vis#m1;TRyVuCPK<n<
z!qUB<_QB?xRLCT6xuIyp0>>M5c|6A=?Vvn_09ZE3%yUZow$h+;JX)vldBY3L`wU7-
zLgi3tr<+qkh#Be(qIFh}ygt1QLiAn~UrV$|`Pf>LcLYX6#VdU>ZRzF5xK!lAGOUH-
zx$Ib-Ghf5}%A$+)=7h>eGC6#!Mp)lrSW?9f|Cw&>03>{P&C@g{T#Qd7bLj@c@A%nq
z4;fojxM?emXS@x&#L&}f>*CU_=ccKRRQ#TibjDt?qsw0t&D(oU8hR{?n66#)oRoz?
zckj&%_(C08bGuwcm2ij<$L93i^$1K<TyL_Ag5X}*q!f%-z<iC6kl5Mq^<@W09rt`A
zx;hMU0wPf&(yu3F=<umxBA3ywfpgTMokAe2Wj~E@vs;StK|IsFSIKLF04Y~~w)c+W
z^bk~rT3t}uD4RVMT*ZUrxeSZ3oBCeKmBni`-L@il;IOs0EvQ&QH9*#UwuORay{jm}
zk9Db;?8iR=tV{m<gFlq3b!nhjrF(I~$nMN-is}jb-!1fSy(z)1yh-H`K*k$7IqTgG
zul(?FBuq$#HG<XS@(?ECWI_452cns*s6fvdb7eZ1h_w!SC;3_s5$grEoiE#-x_O%X
zDhIt_jFxckjpRJ%`intGwNZ8rnfyzqF+E*O$5Y%UG-~N}DnSbV#SeMlu&o^RN2&8W
zTVhcD6r9y*YZsf-j{TUGPl~KT-s{^gD?AFAd!#1Uh@JY_u!ZM+HJ3MhI_O*I<~ABV
zHx?1E=wX)_JYuhJZ}w6ZH<noud-Ymcgdov3Yr6mykW~K@<Qbp3Gj56zO(NqN=PL|w
zWxT)(;rX1K8wEFOHKU~6?b~?RBglwYrPGiGV=>TH7!&rG(qTeYWHoh8DdliZ4BO_s
z7@Rm>T>?6m5MBM)#AUX!b;Whu*`Q|YdHbzCWt{yQs*jHY!Y((z<ZbXwgjtox5PAzC
zOGYP1?zzyj^;ksBc^GE{X0I-wStwvyUeR3y5Qu|me7(Gxl#ftQ=eli0`fk|{x+F1&
z!hwJ7lJ>qh=(QpcrV)1^o5`ersd^dlquG8Sn63Nzs?70{;KD;cZ1~@puKZV00s=wL
zQM^uzMg~O%9A#xP_FU*w*I0eu^O4j5Qt90~7h}HxZqw5&Rj+OK-jLwtz-w=F2t`P5
zCHR=G&x_@0FPxY(uqibc_g>w+m{8%_isN(?$Bp*1pndT7TRkcT3urkswj7s{mZqH|
z19p9t*(n~<pe0e@wm4rp9nvW}(xB~r?&E{6Z5L9hIUui=vI6CGDWWy-2wT(I$vC02
zFC#T}QBR3lGFQ3;4U7xF44&o+D)w2!YZr(*tUgA}W~b)pO}{?06(r+QyhFPLA|!F7
z%z8-ZMy^iHu$6Tnp)R{q*(ze`x#9rq2eO!Gk$j6u3-fsbtgr-sWv`~K5EZDISXn$a
z{amJ#?@R9mPzMk|bs68jAzBlXmbjmKr_%9VI4Kn00=Z@Mc{L1ckBFc1Zx+(e?LzEE
zkixO+RH0X3jIA*gcPcf&g&GMxAt7fo+GvE_5kb?<-PA;t^*fLJ+5(MS#tYqWy*<If
z<?qyaedstKij#+bxcQKR4dk-F#28LrstBI*@~4RWG57gvNa?x)Awq&@mbDAgMa$o*
zwj28pu^K*99O9?QbiJxU^G(&r;xToZ$&PE<%}GJ=>g%jEzO9mzq^|fkO^CEZR6@F=
zUOu=T-;lczjNP*(9xLGv81o)AS;luM5~UL({xL<Ie(%Txndk_v9GN+dpS`N+kCgIV
z89}^fkJ#?I5(EKLgQ?Vn7WmhWPJGo6Ki9B10Z%Fhm(cF-W~%Gr8AMO&c+J~Kva%ws
ziy?@pmUY3Mrk#45WQQYjg&VWNvkg2ncq1i;cx7DKFqb={J4Od{E!85$UGj<e!sa#Y
zytp%`F&wJKv*&l~@|z>=@S8{8JVQBG6z~)em-%4CTt6SN2vKBl&%v%%jd;nvki28F
z@}MU^Qg$n631R|YTC7K3NXC>a?73)+b1fV88ebt(QNzwwH*gukfGukO<xM@^IB!#$
z`zT-Wi`Xu17P!X<1!9Y_$WqW6n`O?ulZj9af$lC83xuioK-|?%FtPf4o{4H;mceGp
zRltoAjT__E&SPsm5UO_ma+}Si770Y!rFG)!Q7@BHLRKI1qfIhg2AQk^XI(^yCB?up
zl7ZoeWAN8IEuR)jz+^!bFne^D6jHgkQd`Iuv7R2XNJVGtWY;QbOQvi1Aj=*bJ9n|z
zxN(@aQgYFzrr7*db|1wE6NhOdHECjMyhY>St4z@lSW?Rd9Nk?qb;~-$SjIDmBLSZT
z-{I}3DaDL9wy)W>Ty%39m7t@&h?Hs9wv?5dEF){~T7+g}#WhSMPjG0k*xM5l_pX$}
zHV@3w>2wQIqh#l)Hla-$hJg_XlzwXsvb%m)0mI2Gr$Rz5YjywZoNk`YgD&r7GLzg>
z?|kN$<$@&~W$zEDVq6xtSvSQU2aA^Q>Ks&hN-P!EXJd9crK*;G39m@yBbDgX*1;8r
z#*b~pNVU-D8s98c*Bs0r;39>#xM~+}?58z-9$CCkxTOos>YFdA<atLhN(wiuekSY7
zbFOK)86|yI*=E>BT^doblqH079qDPsaqMC&ZT5^k)QDGUJVP;Z;#HX|`dQf5hNYLw
zi1ZMa`yx}Iz88JM;I6(rY94QL%xA0oGh<p81m7yWgY1!O>OwlUT%v-*QL<T-x9lV}
zPKk1_&XzliBhw;%-O;rh>%wb!DoH}tLy_C8HDZP?Smed1o$))hZ0_e{gnroN3sE2<
zA5wEkrtD)V>Uk`}|8F>NqQiHN_?A&d7w?B&$qBBMO)c@=4y{ljlL8%VdFs%wPgq2X
zPW@VN)Af!25mV?cl#!NyGe@)1#XM{L=2(#?;<5uCk<CP%vb|lN6&k-;>vt$P(8v{Q
z2Xis@-R)~O_`DqgZjXD$FXZen<~%?(o$P5@f7>~?uBWJ$f7E%vHY?QOK@qzGCNqOQ
zIQ2O2G-QQaJFmOYd<{_*ii5M(a2sb_oB@OwprEh%Bor_@Oq5pKgo-rynGVXRs`Ydm
z3kz;JGQK@dmsijHnKoJChgq5c6l_gd&wE}!o7Q-^zU1>ls5uOJ1Qu|GcTFO9bD7L-
zL$KlD##r8lDlZ4ViDRQ^9g7w6IU$(r;1ja-eAIfVx!os(Nrr#Eq$Q%yj`?1vNABiE
zl~wCW8jyN#3|db|yDAx{d39DKnqnvAhKju2g%1QKR*!ZsHc*GNAG4NA)G1Io0^?Fo
zI3YTCyJg}OtM5c4V)eYbrPw&LEI!K~qkK1XTBzXIF$n!?(@rQ1!6jFSs|c$C@g?^p
z$j_op7O7<2pqu^6uPBqf`?03wYGOhxEH0Z(t#WbxNHs|x&_deJwYndHupKTww<dDW
zx~6HW=l<VB>mNgb<@dekx|<@7_<T{;A|tN_+%Z|*Oy%o#1u+?3XmW7K$rMA2xkM%L
ztJh?^ls1Jp=YTZkeSql%)<Vo^JU!K98-*upBL^TW0qzS1_$*ZypnUb!S@Lo~#5Me5
z`(#Z95$%Xf(+pl6m1e9ms}x4xv9q!TOD$Bq6}*8oJ`bst<w!>*q;kZ<p9)(kj?CYW
z@@fP{<f#qwLc65ECC`)Nn&X~XktV9oPjWgsyjGAScAWMZ%qwDZ=c6PNIjI*7T-hn*
znfk8jsv^mkNK+bcOe9D35pPZagqvf&avI0HRlgf=kwTiCB3fZpuSO%fv--}oxi<a+
zv(AnLxUV%zntNh+R%>KeP|PTyVbV(;|0ak?d7ddc{-i7N{6xjq47@=U01a2qJ`i`^
zX<c{{<C`DB(;(4QPDL~GezOl&Enl!}HhjY+kq!G^s|(~jjouHuiW|=HkpnOXMghBJ
zUC1a{XKz(HP7%a)VN`R9ghC+o>IJKglBHg)NZm?nMh;&bcKTwwPq^%E<`Oa{k|s6n
z!q+WUx<gY!&>c<j^-WwW7o0d+_l%C;?_206Nqelh@GHzVDqX*Y;@qd;AMnfHzxBtE
zz<rufW`(d}vt=tU)?hG<k|#CQxn+0k)!i0rEn4Kr+*7jRjX76QLwtnRkZH1WzcpPn
zpMtLRv%t^WR5J$W$Zjq^7xG?)wgA|6!Jct)v0Qu_UAL`hI^3s~H$D;CUQCr=uw$Y<
z$L#f<1+m-Q&d=wqW8_?EkHBiRXsQTk=MJ9`@O1AFLkwOVJlmfQnq`@dmRb;Uz9Kzb
z=SSsa5FLG6lv_eLObomUog?v_^w-gp(XOk7NVQAqEM-f@zKxp1{Lqu*UUQuj@VUwX
zW3hspZoeo+vdARmY41ot#z*bl5a@LPG2JW}sIuRYh-rDp2<cyU8v2TSa}12-HCDnU
zyL}BG0HgQoL$vYMl@lYMV|*RKG-93g;i@Al6ShcYM#}&sOk|gm@np2L)kv2?5LVpl
zwGW|3dTh_%8yfwpB)geI-7MDBr1HQ9?Ym?rKJoq#SyFfHnYQ6Z&&ckRgSgqQMap<1
zA5)kI(Y){dLC475F!PYL5vhiiMX57$mD2jWN=>*e#$e@X?}pPr@7&h%{!>e+267OJ
zPH$C78V?;WGl|4)A?(NBmUdRluB?)nu5?zD!?Z4}FKj1It-!}@Bkc#%6=@@5ggs7N
zL(f<YO~#S63)ZVD=I1N!dk5eq{LTn2$(dkvO2g%#CcAjw)|n2Ac$0Luq(WbJ$di#;
zBEQ=d28Vx$CV$hU@tZ$9)qxf6z_J-72;76*J>rW2L&6QK##}<|Q9Ks!ICwpakqiBb
ztUW>vTPQyBxmXYtRg)XiCEGO=1CZw-b=8+3?a6L9{UEV&xtkA^eyi>Z$}`Ez$)nNr
zT?(hM#h<4~Nh|{4JL|d&dBoAx><?aEJ*Xn7ltTVBDu5^u?OQDB%NT9H0SYV%U+?wA
zUVr78UC{W;!?p-Vhoq1*cqzG6ACmY~5r9&SlD7Pc;pw^5gG)D0B9!#at?{Zh?jJUe
z9>0H!3cu6VF2ej^F#t)#(k(P!y4|Lsmtf!)+WIAfiVV^yQvd5`0Wr9)7o!{I?Gt3@
zWR~n#QjMy?%q6ohWaMy)r!SMHkaqE8Edb>+y-+mgFQUi!Ld@<a9eyM9Tw0(2paDU*
zH=$&0^)!$hb8PPIKHERSjegR^Zb^<T_Y_!Z6<;$LGsz76;M9Nf?tl76T@@jPGY0UT
z4LOrA$9!G8Yy9S0L#O4yC6LF&)g>35<Pf4c$1m~)T;a+)x}K4AjYcHZdKJ{goa+Fe
z%GlJIxED)n0uTVYEtcyZW2Dj54>6Um4ptIJa~)#v*m<-x$qcP}+vWn=RxJyz9rI37
z%2gQum15#X5AT;f8%mC*7+2Hxr6F|i`zcd(5&Z&dVm^_LE=3+#tNbDs!A9isXy2}@
z;q<gApf#MgaXr0huk6i3N-B+G!bf2vb&(Q_OU*qYIBn-A@rE~v9g0g`&T{w=TEake
zFZUo1T=EMla96sPDM*uq)GF&>HA*IibkZN`xiBO)58o)6kP%Eg#{($o6`Q-dL0pH`
zc%^x`vBc4I^gC2PxI7AePz=3}G2yyY9Xx0DD@DNHImRDiDG33lkUj#V4vuKpt)(_>
zRf(n(Rd1RZU1~SkeW_JFb4>x0bZ@jT{WWr?M}t&D7OQt9@+ws{m-zGxZ-qgpn65Y{
zkIi^FDmp{)BC|v`cV${GYqsn8Z0_e`&%aY82Bq%g33_eJ=W*+74GPztnw8U-R}qB-
zcl+5ro(3nnZY5cH*@yEqCPrOWvO#*T^^5}^`6?N}rUO2BPfwb0PB~%hFzWn%5!BRC
zqwN<^x7Xqhiv^gwZWCtBey6l0?5nb9L<=djL#ScNFy!6Fq!9XKFpKN8QajAeVB{>h
zfLx0@6MfTWQ1M9(qwgFIYkk9YPmo+<+HBsfxzYyAu8>01OssOV!ZrZ-_+{z~fco@x
zj{M*%E<6H>XMm~`GgS{m(N~zrg?}UQq#>+v!x31FDHnYbQlJ_Z#(39z+-JK}*z0X6
z0=V>rRe^fVD6fe?m6oH7Ha8y>>~+}Zs}1x@zGQ^19fn;Rw8~#-&guCmID26x=c4gk
z<!2#Y8V(`lDKm=0R`eVi!R6B|-Yq`cEKF<Ybt2XVR&_?_J8sLZP(|u(B$phGI`_`@
z=j<-gPm4pCtI*xCj3BxLsf}-22E(WU+F-B<f5ertlPWy58e>2S+mNK&>m9~|BDp`v
zcV0tkt)RQmpn3v?&5iY?QOB-0rV+++6Co@|%02|#YMtV<wQLVsCZsEJ&rQ7iTdGFp
zuS=&kOg5koz$pNT!|#r+;%W!0;BohAB$>DDMylNXVj58nMOsl#HC9mgkjVXj&D_6v
z;PmL#Wb77wwTPjdqb0`=d+>Mey5eA|znnY3@o7`HdPxz42LFg%{Uyf~uEHCd_>4$d
z(mnQ%*K%M~!;s4ZStA~$CRAR25CQSHJ<vEGWijfemf+q_VcwoZdKe}bSK|Y^0g2{u
zws&}NK=G*Cay)?2%DHILZw~;r=D7}>+_@@{m@}(0o~=S%;?I-dpsL;6W%Z%vd?8ka
z3J}a2%QplKOD|D!spX39`VHR6yi7^_R1zd`c{+t9Wp@Pss;;Q~8J!q_$WSpNpUW+}
zT#ORDKGh=Lge*b;gJ$a_VJq@uz*d;Y8#99BVvRC<GTC*UG=#YcQeVetQ(}6`bsZVi
zAkfgu<=&2+Im;C!ho6LLww~$I2A!6QPn?L+2Xta4Vhbo9L{YtOuNOavQV6mi9S1LP
z9BI@hiY-;abNA0t1pUvBBTAEiq7;K|i{MBQFTqC<NHM{aaRyDZPJO8a^nP<WxjJ~;
z$6@*o(fcHZIp9Y!y9{h=ZBKJclo@SGko3YG(aeZE%Xm?W!ig>q@@Oi0uRDX5*~tds
z^|wlJ04gCPU?zn{wJuxF5bIL+sw4+6Y-&+nz3&}E0k*jXAh19Jtt2kHnE>S!)vwFZ
zmu3pPpGCc9r@XJ-rEr(b(Cy7L)8xtlzA*durk+6?<DS(v*ol*S*<R$>23aZ`7nTd?
zH>UGQNKdlsn2uY<#!l<(#gO8$`z>nCuAn0~=mFXb*|N3ZGZkJ=A7Adn<1x?!LR}tb
z`zpf>u>Fa0mTOVZkmxPY{f<UeNiA;nHIEEw*t&Lxuzn;VVp<IV7+H?SUK%B7B&&p5
zAAtn>>~8Q$EOI>Yd6(eW!kb^fQ0I!@d@KtSvcxDZJ}J!(j5qPgMLJKa`&bX4Lk{c`
z(S?Pi*qgZ_TA|f>lHXByx|D`ew)qj)>gJ@6bQj{Q$)oY8ry<P%_p=g|y4w*raa0N$
zP!EBlFQh`~4Oyi#P247*>35np{b)aF`2?z4C4CRP>R`XU!SS|#!_M9ve?+qb^Nebk
zd{R_1am_Tlc!8<k$aS~bz)V-LsnTmPgq1d6qL^l!e7DQ@BWd})#*-;nxEx)%q(HH4
zFB(R67TWN2AoLyq*#!xzkK5{}kmmg2-TWKMPm+G|V<0W49?vGDQX1qe034@Q)yWS*
z&@ttEr3Te@h&3@|KHM0tP0pB-P<>7L#z%Kdua9`AFI}AIYv$#{>+0op517a63wGe|
z`)uYc!IR42+^g8NDCr#JV=mlDW9)#OHFqx0L6xfnu8A$$0k}`8M-jbnr=G5pxG&CB
zzPocKqzBMJ%(a)9|KQypakB+79`7kU2jJrKrUTqRSkT|B8XFzKB>_K^LgtpdA9Z^l
z6H2IC5#Yx2?4TQ|f3UR)QeworHK*!fGQE~cv4LOzjYkL(9svg7Cf?Zn?Fl-2uU32n
z))Shm@k3^O;9&BJW6cXElfoQ0Zc|L(Kj-vsnELg*AbtS{&7kpOYQNN$I8Ja&QUFq~
zxP$rwfj~YR^em-Xr(QCV=(R{ZCpY?`pZSMh^23t#>H%k>7}fBOI$PrVip#6-Wl@xh
zQPPD8TR(jF7+W_F2o36`wcLu}#71yl(%t`2fB4oP^GFd|aAc2j6feKEjQGCbQPg`j
z*>apigYT8>9~Ro_8h{$LYy>|%eJJuG1J+IRhhwn6%0HUXL;3I{09`r^vzC7Foc;T=
zk$Y^W1^dH4x8eI*{oID1*6`CB_WjjQYxrpm{|{Qjxf7?h5(Qe8Q)jh$`n&M$)TW<J
zSc)x^81hX(;ND6exk{fXGRl44_Qn4tV1NIU-}<-gX2CXj|Eyf_moMnQ3JKbu1prbh
zzCWcQ@0HScUhB<G4b<9t6ejfo0p*241lPDnIVbykxhDFKRKLAi4dct>)-|VJ4YB=D
zb^c{&2l>L8Z^2y!Be@Sd=XmaA4?te?2k}VM(}%y@y}I-~obxt?Vun-36F>uh@<l}D
z?=qj?bBOnT0O*QjbEo9gqT6>6^u%w6HC`>${fQ23#=-VF;dsNn43J@c;vVBBNGRCd
zI{ytc&4CRd;_ON(0kGa9`-#@kgQe>+mi2;vQVY<N5DVWsTs(9iBv}`(iG5Id&G3=f
zxcuMPGA3d`k|2(rzJ1PlAHa_SF9*5?MP$+0G+MuByz*BM9(+Ro##;3GLlLI%&*A5Q
z+~&Oh0RJD7vEP^IhuvW#`gSfP5>$=$KQ?0{bfT)}es0O1H_7kkmi)Am??uT^E7|w1
zKdl6WfS<8M{%0)t8Q%AO!q1HB@1U-qR`SzIep<<&bA~@xDnG5{r<MG)lAl)c6HwW=
zf*;SqPmJp)#`P0+{BzFmXKeVVmHhwBN=hYj<(%4Rn!A~G3uf<g%3xd)R^LmB*lOMV
z?*05cP8_>kkUeD6QL5JxE`eUVU}asCa<514ue{_wp8Xy8o+U^ZK%1yGU+w!z$)Vfp
zJ+KgfZd4|&Af~_FjKey0`wr)VRqS_m!*wbEt*;4(h07eZt|^^{vRs8w47Bhw9QvP5
zADeud<2P(QdBv6H`?u5b$q1bYXFz}E)8Sf6@<(bkNEUOlqsoUhTU`L_p}Fw*H^WX-
zKXUlgoYNh~`+EKM|A|27Fih%UA?f~eDfi@OpNT==z~JDT=jzPyrly{c2w#@%y97>q
zoIKeAghy$7{4M>yUl|9_Uy;4ErK|Rup@=h68V&jv;}%Nze`BRp)c0s8Ua-!mQu~}1
z3_qc%;PRxFD%ur2F2m$H&jW@57|^w?k8h)cGD4VioL_`6Nv9qAIG%N<5sY{W#vR%Y
zK0-zd*!VYV_Q!b43ai%NyXH2NPV_vo-Fr`oK6su}gl>-l2j-cGu@dC4rhVGFRDk+P
zx;M<jXC?g3@6$ZsAt`Q`6J$JHRz$+KuS9u0IAXL<?8#{aJ*S1v%2T?p86xIp?JDU?
zf~_G%SN^V&|J~on8-F`nE9Ww{6!s5S;a;o8cp6M79k$93DQ`<*)wyLkIrZQS0*q1`
zs>Ife#y_Th6-XgESYr5K1?#=NNJ|(#v+^KIsNUORqZ?hK(5Y?gZmx3*P|gTrOSq^Q
znOz1=+omQ66Whcg6N6J<0jHSRV-2M(%_8RGv^j?MHQK?Ajja=hFngFSZ<n@hP!Yr+
z|DV0As8Z947?k-ar8p-Cgad+|y&tuc$7gZ!(2TOuPHr{}#64^ZO-3t7{PkTb3oWgW
z3$h2?CS`d3_7_|y<d~3aWD=x-YZct-Q(I#jwZjM>6qyGXgdiYYyOr9nfs`?^gKmF2
z{QMvOl40K6cccJOBpa{=p)fe~V~+GE>)&@E?`ZZ2Ops9#Gvv3=<nQj;q;>~*U|bT~
zn(`@r)xwnyF4(kuHHqdToY|8dt9E{ow_$Rd8iAcoCF3IB?lO4WbFi|&<cHw~?N)_N
zzF_`C@Eb)6TjwI%s0MA*utN$M+EY!xH57@X4GtL@15Q-ChG`4cYX-Z`Gr#<PioScC
zKN7CMZ@ho|8*l8W@#Wy}I)Domd(^kLhD0zrFhU2+ppe;_)qs+HZBwJP^hZ{I+))Oj
zqzpC*3h%F7%rX60X1hSXS?efAt|HW^3dSqh&3L}vxYn<suKv4_|CZJ4okpM~BghQ9
zv%C5c3)OJS>QRqND~({D0nhIfHMoh1g>M}-GJ4Ihh&rEx?=KPgmmmGF%YWbS+iSct
zx^#8_HGn7qw4GZ=kHQpFJalSqV``ShJ<&96v7Aax4ruM>XS!ZY@0)fbl3FTzvR^s#
z=tIq;q)BqnOIRVAxn!{iHcHJ1TRFah63v>eyrj@<{AM;h*tU8oeX|klW=9WKV5b=T
zTt}*$-2BLfRA=>`H262FUK$(Q>-+Rh&R|$mepedKpr!xsw%~`iNqg|Eht23pK`-&m
zy><`owSH+F!B`8as0#|<)|%~$;^v$5tp<c~6D5mvb0NUWg;(c4u}kCLrZ(?Vjnbv~
z;%ckZZpzrvbFeyYEeYRSt(g!ZQ0`B8Or*ICuzsJaN7I$+G2BfU$kd7^jJ|sD+fSK!
z2;3D>)J<3=AlJ>!eyXJ;)@xyw*Zl4E{{CcL&;Ayfoa^Mt!}bH+6~J{YyLNsdbncu|
zQ`_Qp&>^as0lN|bjh(e2i{>S*2ut@o)CM?39OAM&nV)`hvLWju`PhY7HL<$yEN=={
zA8{@wCm`ek=EO%!5-mo8-Ea4^MO~GDcs4w)&K-==SrO;kioN=pK|Lc&@ZSihKo3F)
z;B(eSrzrO0S_Wa|nQe=6jg5}N_N14ql@QVJvkmw+^<YfEkm=-je&A$0-fRWCPs~q>
z%=fmW=a4fUOxru;VEO>9(EeC8+oo0>13Sj6;nLY|USJSmaJyitA#pU^K$?~Vau4&{
z+Oh?K#V6(0cH{x{PlsDhyg^_S4ytJHJEy;Y9r<LEy|(_qP_r=8ey}AXglDNiL&wTG
za-ggISZBJu&~&n2?{48zcgscy7+uid{+iLYLYY8OC+Nl}Y8|`4n2ISesEuIpY8E)`
zK!Har)>%{UR=lqOo$HdF+bJ1(l|)BHCFKQg9{B(VQiuBm-iu*smwy+6W}ZBDTb1OM
z$0DFujH*4R%mO>3<)8bb;^=SQCWrl-MN8f~8N5FkOX)Nr&cB4+>H9zIy=PQYThuOm
z>;)7Rr8fmdM2b}DAPOh~DotuYnurj3fItvAfQt00AW>0Js`M5Jg7gwP(h}*tg%Sva
z+?_x?o_@yo-usR_zTv+R(7o4Mvpn;eWdSSERh(EVvaN`19e&mcTLF4N+t#ggOWxf@
z10zf}mr#CT$qA?O(H<N3)+s$P6P?qvrqwHQ{QDb0u=V%$Gm8W&3>4_li3IRWZim*H
z9YYfdy!6GoA#-}5(xIfqeDc9{K#92mBmRR2@ISWg0iKNB3#E7kSCSab+8K^sRoq`k
z8!@6bRO+#EIL8Xfwx7j8{!~&(AkdcE4f3uejSHwctRY8mW03H;`_%?TsNC|R;Y%p7
z#}-u;yzK^@{fuLSpGAz(*l=*n8m8u`L5ABZ3hb%%R%GiVDx)pOtvx+si({*4AZ$nR
zS~zwSm!iO@l=0&@%*VPXawVIGt6cN9MoUGlH8@uUOpbIDS-Lk4rVo0+O@}Epv42_3
zLDqQeMM10P0Mq6JJr*a(3bTZ$Uk=)N*ryS4Iq>QyQ{R#HBs7DLVHPA-3S#$_SU&Gk
zn+~+A7ui!9(g5)FtJemM+fc+^|E}4JXyxWQk)LH=2LS;lTzBplnSQtOOgq8N#W*kJ
zcKt?LzSg2FT7}K8U2Pj8`s_coaISy<t2Ifcd{IN?h@RJqS^mt<Lr3EN-OAqDKBIzo
z3fc_fA$Lb-^81dEx{t)r_uChGZHR}HgCw(FUB}H0R5r%V9RWu1P?0+O1UDnidOLYs
z-WrB_X3A{Pq2*zB7sFMPZXWhMaD)#=?Bt~JyFL!r-sD%|S22E|CPC?XRN(|Ff|OJT
zq=AWU?(wI*Zg83$Np8Ip^B>+Av~5yX^7x<oQ%?3aDZU8K@75x{w_*tU@iJ1qzM1rJ
zqh^I!2r<hVQ3Y2FW}|b(_lgH%z=ex1?Hl;Sb1w)$ZUHkRft#=dhw)O1CvL$3e|?wK
zO;teZrdpUvC6Y#X&~phCWW-Yj?mBD9KgvqHGc~FW6c|l6PUtEFz$o~}N6ON^`;9+;
z_#n5f$9Mx~rK>w$W8w+PH7oZ%(BlTC3Ry(!NqTzts_Cx^Q!_bx-gOGftElj!ssx&3
zL}R=J$9)$ns8FKp+#pihIxzh<a;WIt*09DVPrnyxc90gnb`_YlG;jruvemq3@X17h
z!EMB6FulN%9+(@a0rZVI4gfad<$N3qH&{^)`@uINvnqrG_`Y3#A%e1*db@U2H`f>O
z3jl$LvE>yxNnVp95S?b1|Df_20_1Wn^h)>R;}pe_B=_6r&l&>b!`6vqr}neDdj?d8
zBX*JctZZ~~pA<u=Nu9E;<8kU-r?G>a!H0nPh7a36rpWQ`s}t|NA7MXN7#KHy>4$b8
z;Ls2Z-(iyT9pFSF?D-pl0N)Vzu_a6$kg8X|Ix+r@IsM^afPrP(zRu(l!)}VNqa~w^
zxMm9g7=tjPq}dh$)j|cwxG>18fZkp%LIFc#Xc`2Fb>t>90%<VjLWp-63xC-NLhCek
zWC%QqCkVbKejD=g-|2#(M~V|rxgW*-PwCFEhKJ(Iydb;?87~FR+xLM1K|6ZVY3N!V
zd&o49FP|D1xFTSP1Dc5We5ZW_mZ^Y-_0*z=4#-AH>(U`Uz!;#1&?$=DI6bvcgyO9W
z$9L9r0RW6T<+nS|0zQWSlA5HR0uWR_N__Gk^lE$us+8TLrVORIMd~=oZk%mM0QLg$
z5G<wF0?g1LdAb0S?=xB}i71%C#vBTVtn-Ncvh8DE?*igkX8X43hqYbyuhj1EIa<SH
zSAJdG{NFuxIdR)#8{DC|i|XxWvhHI*z2y0zTcA+HamyZt?fOR_4_bhtC}6ZjECLjT
z`1p$0J)1(bWrrKZl>LLeveJ`X(|lpkOUk1>$djLK&Hz<~Y3fr{;oWstnf7l>M9VFJ
znm8gl;39F?rjS25@6CRTBjO#-%>SY6?{(C6ktDCq0m_5?$(<-vq&cTQAN2RoS^od$
zTes=GI=9cTJv)tlt+M<f4eK${t9wv7SC72pVRHn<6fcFolhSx7sCm%GM}@JfQu`nS
z*8#?pG$v;X^SEkns(umS<;#vZ^{!Ry=B@_X8m*&)g3$C#oAfU6oGx5b&e#@ur3^)g
z%ShG3c);h~F&hvJOuE}}34V>d<8248zT&p|4Deu8OnL$;Xcf+=9XjP5!28|ooI4jN
zTB(*Vs(st?vUbU-|4<FgK>LJLLmQIiLE&XoIFGp`r0t{S$~<LbUdrLl8KkwNPoXz}
z&_uf=?qV0Ucu$wswHJe0vpWAlnM`hSTmXuJWvi$5?U-tgAo&jWY&u|gu1;Fm%HxqB
zkvojrdM1AX@M2oCcG-7@`^^nBPg(eD<{4!DgGr#M=Ov#HKvnZPLn=Mx8<E|&$LsV3
z6|nkQN?lap;%zDxJHGAX-n|T(c_nrCn(QNN)wClS)jRE~zLO9X2l!`uRK52tsRPa|
z&6x5xKM&;3yR`j{&(8z-sUd*6|J0D58uHVJ{N})Z`jDSa9gv2fDC>u4{`b+uPYwC0
zAwM<bH;?gW{P0slerm{14f&}d|9jL)?H7xO9z$~$?X>fqAIrxY!2EFn$oK8g;%%<}
z?gftWLaoYf#gl@SiZd^*j4zn@$2?ej`S0{~s4AHoO0cohqOetWk3Esp;GZc-L{f#%
zf6y|U-do3PbHBoo&a!a24JSMNG6OsbBOkuWZTUwIVHNayP6<}-v5l`W1|A=Hvg~h>
z#c!7M-8Su&%*?uvQh=pIri;|K=^}w&?K3y=tgp0k2VoHA0p)`Qv~v&C;I))l04K#S
zRr2(vsgTI=uRzA$f%%xg0d5oj1KmP2h@eM|=>1<*|D8COKSL(1+~2;rePM?gGkFRy
zV~%yvQp@i-){kDwD^NLDP?}(wT1#y;UFbn#&`pfxAGNYj8<kVjl=>!MsN;72<?lh%
zZ%ZXnRr1E$4?;8E*(u2gHQ<<%)=NFFV$9oB>j6x_V|r0YEgWCCegnvt$=?G=xGzoM
zch187Dx9=2rv9|zpviyIH}d1;J+_~MzrA}W3(a*3ILa>Uq44f!qS?j=3&NDn@mErF
z+m*EeD+#>|(1{L9%sd0s;%$I{#SVUH(v|$z)r1;vOAIXXmmL=F`o6c#5qX}ENAm6k
zrO{W|z6*QWAXxb{F4Gw}0xmj$813Iwx*=W}BqHR%XnEOTDeB*I_wVS*yl67}*<ZHT
zEq}-7!;(24oWni+F6XqLJ+rm>kWi!j&=~J4K+2y2$rD;}WLR61J!jBOLw`o~e$V$5
z$@=|S{HPO?`^bdir1GJiZ$q_6$I`(4^H}~`4t^fXPi^_BEkBJI$*}+QEq`qzcf8_H
z-}2Mt|3qRxkr;q1|F;41SL&{L;9AI09u1iO`iA$~!=f!bxbfT3J}}R(C8ba2sa1jC
zB^8tqO+vl*fMmQG%WSsmZcDe>nE?r<a_XAPz26Io|30h{yt<w8KUOmTf-+i7N`O?n
z;1!NOP}iMqpliH{?T#XdOFz)+D<~tRV^wR|iWOa&k+_A*V4e**Y^w!|y%5v`RHG^>
z%zAJ3pBhC#%8DNLWLpHR>fLoNH-p~_Mi*KSS`>Yg8IRWRnu-X_)WzR}d$HYBcds0)
zYG5y&sT>_rMHj5$5fDVdOwqWp#dKHt=o3zmmR;c@zBR8#X70MhaF_tQSLvj-ax}AD
zq3NQG)P~=&x#q(jM188*!MwRg8>CR7TpuU`%kV3PDjkj;R8fPb`#oYbrgFjkhf9)|
z70EFXIt1o%cqi<X?<U2wz2kE(p_?#VU+N~F$0|l<wGegB2r}TJ>%K(=&sy_%FVK|<
z0yRr6^=ISIG={Eq;>h(C>@zh1-hu(wjqL82jWHh-zR2<G8)kX|ua#5~PYnz7>(F#m
znOoB$cl4g4ZbL(($hF4ghPY-)i^Y{HdL#WYIAp8aIvIW!ICNQIJl=}N(@tXfy>d_)
zY~3LsW;&z9b=l<$k+ve}R&I?xu-3c|2$=NNcX@%ZGcO#1IloJo<*YS4?}T8b&Dr^~
ze+@i;@yXi`*D}2XWOnU%MH9Zgq_7Z$21fU{!|+!1#|1V<g@~F}F<ZT@9P48_&Ac?Q
z7DZ*?HmrV)OK=)1j7xVkHWu#b+2e(S29?RNpObSO4vevrTb#D_9a#zlxqdkvD5v20
zUL1t&W9KWG&F>o;1%3mFg>XGp0z{<<9|&Tgilqt{2w#6(?z;Q&NMG36e$wl39Rq^U
zmXT^z5uoDjvVyziWrc_+mA@D5o$&eCT?O*FmhJuorUa8r^rVnlXa%Sc_feJ2XE;M#
z<L2k1aj&hc=VaUBbTVC-lne7DNhsQJb)7TNz^>>ci$h0X!z;+v_{2)FOGz{YF<X&6
zo&XIphA-fCqfo^5D5;Tr!_ZBQt!3KLbg-0D6;5u22X(%NrPO)`4>Y`F1*#e!3>Wyk
zaMs6m@7}tCU5nu))x84<Y|?$F_G>Q(lltP`UKWmj+w|-|i0eh(W27O;py+OKisCj=
zkt&<sc(8I|vMp342#pa97{UN3rd>nID!_LnQ*JP5G;Bl8!`z`UD<BHEW{}s6zr>q3
zH(Egjvsy0oF2chbY>YP=%(`_wvP4v18?yybB^UzRXt0!>zyah$4{z!F_@%L>1~gR8
zK6lOzQnGP>09aX#?AW43rN44i9Js8=^BV+%ER5k;KjSBG@F6#cN*U`@FquEu4M^r*
zH9N#r;eIz?+DI#ZS`odc|3NNKZC4EO{<0yqBbKin$UK53*ms0`v;N~~(|Ej2*-AP%
z=t0V%aFA!~dkX@7#bPTtj2$0%fX~KpP6}->CyvvsgN$&;3q1TJqOzsyO`sorR3mHZ
zJgH{&>dsi@VBc1+7fz<$Z@$cJc^0)b0E$v3e%Y0n3EVnL?5(qkCam^(&m|{e^o~ld
z=>_%yM|o%Me?daaY)^|SU}<3Ah7$|C@$K+<szi9%tWIJ#((P;OsGi&sQW=CIUR_*=
zUzDBgZsS<L&W+5EcOJ4%Ebv@!09}kT&T}X!V0Zr_5R)u7Ti%NE9@Q0(($wgY#_NZA
zN?pKk+~VU<F;*KpLOP0;M?lNT9<`gsj~Ufve>oBf_GiBT_Qc<lFW-+Z^(2|=$;{q`
zR@%`?hC)(-TJ#&>HbSpCCpb0(Vl3jgHb7H`-0a%G<fPTL-C9cpZK#e;r6NDg6u-w9
z;uF@tt=WLQ?)5m$CBFm@6z3t9KaC4)Eie1wfPW*aHRliljRvlX$V051Me(s0j+iB?
zJ|3aE0^|PVu}cBl+2_tp5)o=$fK4ncT^b>tHSt%gXxZ1e&>}UlPSKO^Fa75asXI2X
z>;Rh5O~jB*T1MAvU>Te^Z)bPHAux+XJg!+hCd7LvvEilk>ZK5YOs}T8L>sWg_;c(>
z4PtBdbTrJ#I&?Ft27HlOOgaTIQl<Pn+H*OZCTa;o2(B7cg%5|wy6Z{IzZwTFk``b#
zqUQpcWB2)JQymP?eA&!QdR3Ehp!9Z+U4k<Ep;%L2LFZk<(#uCZU^~8PhwP$QxgYu3
z@~Le~EOp)oLaE5}zesZGqWAe#U?h)hyfhV|bTnf3kg6|wely6ao*lNysX3c}Bpd{t
zjcFjcAfUBRw`}PZI0QDeR&fpqo9Y==hPfeI8x*}4Ul+l3w%8w!I59!t4o$nmFo$L$
zA91X!FS-kp_aA5zaCjZG^feH`BR_D<=l<$#f4`8u2d|R)ulBq&rP^6&`7dN@^1V1c
z7x6Q@r-}QtK{LAqf>?mjlwI(_3D{tB;ae{pJHj#<jG%<;H8Ci!xn~yLe1tK;GzoZ3
z29Ev;lE{;ux*fvEC$%`D8{@rM<9&X*n;7EQ3MOowH-Q0n|3$~JL)QAcOAd#lcn*aN
zygCn>e-13DdBR<QydZ60K_6Z%^-}>0QmB|$1jus5+4%AQu%H=)ycRGn-*X&ldVsQ`
zW8@X(0V@JAecdAYp7GKpzJ`~GiO`tnaT#1_Yn~zvRH0~8&Q8yDpbgAV&*i<~%dR7a
zoa}GSMtN^NbF6q;6EiM1AL>~9S%B3GJed4ez$@cBh;Wz&Nv$_#V_+LGQuBx$7UzW=
zIwUdYfNTK^zAaHHbG&k5>CG}L!38zHp5TarqRpyCiS`q?=NW|d6^xOC+K3-}>AYRy
zESviv<V-=H?!8^V@!CE}?>1rOPGWmOGTewW7Pbt9u-h(ukSn=(PYQbMyye$p6k`3i
z;jzCz<elgmP(Oz3^7I0<jvb-7*Wv`3$5l+Yf}&8%cS}jCw|eL$RXA#o=eO{XAQ;mc
zlF*ko`Zb2VEUnHOES<dB!U=o#5HJ<e^ZPVFu1)zELw*%m<k%*r@I(Iw8pmUh|B!Lt
zXN*VlzR@kHj0r!(7ThV5hQ+qsCDgOe3bUFAA48-+=~ko#j&wS9{45}&J_mQn9TLCN
z%4Wl3;@^D-Q_8uw(f-%BGXKF2R&LutnjB&RC3EvBXB$P{7Xt1RDQMnTG>^oc=h_;I
zkp|jcr`M2|^8h#(9Vk%jd{PX#Sj}8NsLX;;v;!JI;6#M)IBfU&n?xBjY;Mf4v05!L
zlemf1h-$KeO9J+L(~dKs6jf-sTtZYfvD&w{4x-btLAD)F0Ne3H7RloYAh=JAmKy(T
z^8WaZ55sl_;-=gTrQeR>CFvaU=g#?#$gOB<@W&Z17Kc@h%R;WX0}2;X#6nD=tsiE`
zy=%qsd!pP&X=JgVv!;1V?*e!BzzBGfo_#(a3#(x*h$$JEolE2sV_TvcodywmCu|ge
zdyAvS>T$Xxs30jmPinsNF{L^vc(lYjq3opa!^8gkCjJ3v1r()){zp^y2e|?ShOBHW
zG7IVyWeX)M+x}AOaLh0pM1aPtmL{k(+hN#YbQg~J*|FOQ5=E=wu`-l5-$=+^6!2aT
z49ui2b0dObh5dv%97E~m=6L3L_RUfN{$WaUq{n+u0wG&Z_b6eIOU+UZp9SzetqD}~
zamyRPtvTyBlIyjo3?Y6Q>O(FDWkw|iZ~0YqKOT8J5?J{y@EG8wjw!{F6rj8u2-*&G
z35Jxs0&-o!U&QyH19D%$&y*bAKdkfMwv-(ZtJ2vyKA&BONZ?O(4rts-CUy%qR3`@a
zz0n`@-o5r&z+=_bh8-Ik5Y-MN#0wGID`GbCEE=M3a}eMe_?l6EfsNAZ3fKU-&47Bw
z<Wk#3FM2~ayY<@l$bvQfP@uidfx+|m84eY;iu<&rU1f-U^viHL)0jg6pfdnGuP)!)
zxIp^(KR8&Q-M2~ClawcYeYSIUf*d3;XIlpx(09Nb@Sw;G@Km)zz>bQ~0|DXa5$;#F
z=b#vw2H+}0r43s^-}~K$S4NK{BQgvj19?);A%53Tp4CqE4M*iHmmS-ALoR^I#z6G^
zK``XEO$<M-xVyB$Q-$!_mnMGW`nUmIrT~EJ)<@wN;!v_Ki@nV1k~y1SLuNr^-dFGn
z2jpxPH&lJ6fk5r<`jjp*+s)Prd8}eUPhlQpvr8D!#cJ<O+KIbVq-g6F1f>E*TOX}6
z^Ns=0)|<J6KkC#DZv7!x@qukSx{X#14NBL*ggz;8wb2jkL^oX)=d|})0FJL@COgA(
zkV>~{A7Z{YtU#nx>0rU+YSQ^;>g4-5XUMwF47`M`Jc1?u5hI&ngY<$JpzA;`^*@}(
z(`{(|)L-c%MUKvrjMZ6#xt189$6xAQ*!{3$c5f}k^-~z_a<l5m+W8c)Ewt{2ERTTa
z$wx>JT?LRySj~SKVbQ*Q`bjlc9VpK`MN&^*w22?p;}PES+%4PF{dQ6aYYd^mVZ&}>
zImrs-V$tK-dFmB9ry=geAb;KfxtSb)hNJvzjJjKJClLI0*1Lm1fQbf44odt78$Ccp
z#uz2@ucRpO2+u)+N9otLn<=go4v0CPe%LZ=q}ns?J3oz&el>uihA7P{k>0w6)5lM^
zDoT9dYn`U;*I{(xMy_Yl#NIYFIsj(^QO|xLaetuqatLJt%s=VzF*0gCAW}(3*^ga^
z$$Ct`-8yp2t{~{7*b|&s<zkX6DJt~YqPncPj8smr&wj+1Ff;ssxUbQk2pu`}A5J^x
z1o>&G6vb7Nmm>+~GC759@Sc*9EwO#~NdZy77%ZO0N&Y>k{KZ?M4EEOuU~T5?x*Gx}
z{u>xhjsFmL$3|`2Vjb3OGKK<d-fIlm6JFT2-Fx$EpDm}~k)hHid&Eap()+(A?ruIw
zm=EKQzi8smy;0cfy-T>C$mV`!$Cm%W+W)w*<!RfZoHG^bMcE1h9VyJ$;h`jg?U;EU
z9-FuIA6A<szdwQAK54=`M0(I15a6Dg&MkmQ+QQY+QiS3kM9K0jIr@fc2h32+^+W;L
zNdiuQ+$%Ha+NWab>joBP0Y6YCz5fLAk?=LrNpS;@sguoE1(j3dfP)PEhgDHbB=0s$
zmnLZr+Sv+uB-yP2m&Was1@tK$X8r<=8+6ko3$;9PUpx;UIH}8e<<uIh4td1gmW8B)
z+>x_CTcq#b_~;!X>xWh6=?%(O;Q7e<apyPvxbu|*-A7#$*Gq0O#|wPB*$SLgMIB&!
zvVn$MdcjK4LH-9KqwxlrpOH;H+Cyo9ZUK{BLKLMMVKzUkV*euA@-n(3n5==`yR4p(
zPD-6lurk8Sa2EN9aSk}h)8E(dw;xP&woQ<pOD%;H^MR3hlhl(xRqm(CQCzg(PnG+r
zazDM?PcQe=%l*dI{0O*yL@hso<xgPw6IlK~3@puXyW<iHp*_oApe`Q6O)(flF%V2O
z8Rsm#d+*TRc%Gq)v$-VJz_x!tR2`@t(CdBrqkjK&%pfST9hJ05&bw1Wu1n+qFB!PJ
zl{EO^chT#Nv59GLN!b$G%CLQfZy@9s9}WP;bEx#Cy#R9b!XDyBfmF3ZXg=lYxPLG^
z)VH=nhVn5eWwZ)Va806$Z*PxvKprzjV5cF@cUt{725g<-X@l2Heb+7tlcMMu<8l@V
zcrJLaKmWIzmq-~E;fMSGXE?^4c*S_;hj?XxDt34d7{pcH0t96K0F4RuZvsC54`ig|
zw}Y{YzyY!E!B`e_ms5Xfk<<x>;zz<&q@-8VCr02iBb&zo8M(iWiYTa8-ehH4iaT-T
zQj{}QB!|&V2e%_lx2zu`O;-Vv;1Y3&@@_>Slx6@Pfn*fhqX@))iu13>DMO?F;ULqt
z>(I;aY;NSl9q^|nwImVJ2Zmab!)SpY!swd0eT@#du{jl!34kXcJwm+F68LQCHo>~Q
z`PV|a!*h_|!KZVZ_|e7enWqG%)OsY&%?8MTl4|$|tA5}JzLq|cm_zro9s<%CFYb{Z
zVfmH%zo#}hK5dusuTMe0z1n#>pVQ<}^T^Kd5yaOY2#^wb!J2`%5>B5t0K-GQ-If4+
zjvaghX<4FFF8l)}p(C(e5a30Fpp3H;G$+N;={`H`4*d`84qy?+3ZYIAE+DUH^^Ek0
zI8)*OnH=M>ZRKCM_XBnHQ|Z2|*q=ZARJz}Yxt~h+503XA68k@u?*FEzYqyrN>xB><
z`^%V<_^3)@tJ=EJO}a+Mi>=^d!Zlt~{#K_2sR27`x?HE30dUv4`3@EgfL~(p!bbiF
zzofUF3$kiug?=Yo$wipJtW5HBryqU1dY^-7aB_NJSsCg8hQ8DSyeeE%YVCL6v>=0z
zA8LpfT$~kQh5l4is*JN<&ncu;5!c&p>0|f+z<~S1(v&KyKO3U&-*Cv20Tx>ewE@L@
z?>|psfccF6>V;ZaG-y+hcEQt42w!>EUGS<NZj-f@xWPf3AatMQ<&C``{=E{Q_9EGR
zp`@=p*Z~eg+rDxqS@46eoXllyS`>MMpB^hjH%c8er(e*E_uB0bLNc<!XmWH-{BtxO
z;VJ0lZ@1s4aU1G1YQA&bCe=A|NEou~*3TvW^(p4wCMJ2|1ZrkW-n8FqE}N>)UQgkb
zEKQE1Okn&wbmDV=yQIL`YKAf?l);~zEz$oo%#*ZLc9K^6uvILPA-;5Uch5dgIxG02
z!EUgB0H$*0RP5jkZHp3t%BkN)bi;GO%Lvm(_`By)@UHv^aw<wXmrsl`+Ll_0g!>FW
z{RWLjDnM;z*d%7DqD6n1IhkUO2Jh>A)DWQ?X5yD>%veqfG&&qiR6F?Y1R!lG18Q_O
z{&5d&Qr<S&r?`q6q)FK2=N+c}=M<g!!+ZHKZsSj@{_}klK<9CRtX3Mo$y^(#Ets6|
zYj+i?Y5#R9Gj7;Jc%CEFsNBk7^$-J$VCl9d(`f9&*etutwgVj8H<5VZ4-cZOo8n4d
zL$~)ISL#GgMFBjHJUh9vH}3~jk5}y_=UAM3gU8%n-Xgd-8G^@H_hwVAT?8IgnTesM
zK?d~j3Rd=TzYfATIWT)^QD)J7HynTX;Jl4V=gS~-6fSkbmwfPaKODUGbt!TxNxko1
z4N2~8q=a2!NXp+aQ52j#w_O1@fNLfv7D=z=MQVxe>N@iq(w`Ktt|4X20PFs8*!s#!
zcauZu3&^or{%<*e&7wxagrzsxEHlfg0r?Y~60fmczJ2O%&B^wjw`>=nAU4oN<oqch
z39o6$F|qy+n4fTVmYf*;Z=ya{7$lqWm~xhX*kOvO6>k?VLNHPgN@%mJKo;@9-$eW!
z@*OKV|Cu~{KREeNCrG?z#S*Q+QSt~iG(#)6iEmn1fX0^Y76!~|?*|M^L94Ph<pF;q
zV)D3cD>?@qC#U8}DQa2rghiVj5`Yv3EXU*ylhVBZ!E(zpufz?D;XhDn@c(Yz6WgI9
z+H1c5`;hAc<g_8*4`KLLxGOoE{VG3EBH^5t_W(<GocjTvnccF1IU3~))8dtt^QNnZ
z8|_yQ-A{x$^((P!Q>rokPQ?DTdVu7te=6}mpn)AF-ZzomO_>GoQ=$JTZa)<osI>Wi
zU7;sp%9FU~jKyRYjbF)j{5H~Kb<$EcaHHc0Dw_$Y7Gn~fpNs%16g0)98y@UyTzoK!
zpiG(mk)Ha|YiDmGg&d9W9U$wIMyAE&{>^PBf_760_pfNqdR2=WVY0<>OM3lrI@EZD
zRcJG3Jq!hNOBVIq!e#Qqi3`Y+!u>oYaZU2&)Tm!NqhA3`WpmxYzty8K9Vb^2i3=U8
zr^u`psb+~6Y(ODjH;aEqzJ3+}JUpzi@sIW&4^-!u%m<)`=9&x;!&DeTqbSdGI0$hw
z)KhI_K;%yOxc$4N(ykljESXV=@1-ceb40J@cE_y_AXy6L{ngngW>PaQ#$^`2{XSC#
zh-37(Bbfol4GK#2KTWP>(b<Mvk3oNDttVoDGb>}44J;7{F9uU7VB<21-bY|p-CE`n
zHx7nFDrV0K(=A9yo0;@M&X@#CnYxmzBPpBm-El7Kn+&3!mB4DfWY@~R&s_oh<gIN~
zcHiLP_m+w0WN>7%bILH6zFI#yH{|b8>4KfV6yy7>xY*%K!J+hHmw#<NXLBCd$r_wq
zf2n&Q<Rlk3EA_$D4Pg6p+vbE-cR5L`8bK+5^LN{4!mxWQ?T08;p155_MVL<Krrd(z
zOx`Xpo!{O`#e0G6&oH7@04Ub-lJlg4fYC#&`|1p4QeGCHSdi$C%H3$ZQ_h0A(~bU1
z^u*x*NRF3H2`+th2Sdqi?+ejm`sw!D`gr)POn1kOOK<EO{Y(S9zupqS&!g+TNVO8j
z1yu%OwrF4yJb4N-=`h(5e}U?jfp$p<h6Y|W5Le))4BVJhl9H6M*Yhak?5u3gNx_<&
zjy&-n74Z8u`JeuVdKS>it+CS&vaA6JRC_nj48pcmIchCONXzafu-}4xD}zSQ6SoE$
z>`KxFApH)|^=3$!kzMh6H8#fE-F^Kl`_@)JZf*kPD+zncP3VYd0J=$*hm4TRqXN+(
zhInXTW{&42_A}B`PhxbVHfD?5@x9$!rJkdh3_cLPJGEic2I;E)&6LLL>iP>SSu2MK
z18_;6q5WVHsaY}*vs4v)XzgPErDQ+t9yuxyKAf{2=QWQLu#Zf4BH~sd4>PtfXs_|D
z66k^g@>3zIf}S0}FdsQx=Gauxz`8|<O%#uEDM>RhB>H);k7EPaiM2!1PXxw@%x)E#
z3Hq*jj_`FNT^UxJnKK{k8bX@m5(*&8e`r%(%PXzBh#aOt54-#c`u$Gz6FJ-ijkGm&
zcgqHpguBA^4#y7bP4)iu4IY)p7Obi&CnAz}P%fSupbaJsLN`BZxO=z{Qo+hDc8IIN
zWMe&mu8zopcqfk+G|w#vF4*f<k?h1Q<=`k{|G1p(jEg@#4l$04#CXm(@0%c3YRlnA
zYU%^LiIDnN5cCTlK14NKW}#@bC5BBje;#Pfe7{*`B`dQkBcMaKpjVjP^o|$UXyUvd
z`*{q`i^$3aFOXab;*LbYRx{6K*+OQ|A{Vk-HCEB972L!%vqTeoJ_f$*A^VMhr$t}R
zA6e}K^9F2gdK1lP&FFR4hiu0UZ?P>rDlLHGu7lldi?H>`zPXLEMZlnsr+X6%rX|l>
zi>b&G<r0#m*C%N&k-CE&*Nz{E;WNm;X;@&t2z0Z(VJUTJuV`@m3~lCv<2$(NL7B@{
zvK!K$;<5fsfiZF(Jpm0>F$nPDiu=49xW@@qszhx2a$LFWL%;p-N}^2&v_GQ0nv*yU
z8tqw5;cPe}-v4PW;T7S^f{oR_Y4kh|dK%$sp2vtj{{E}z*yS!Kn79*A-&kV@6rmQN
zmmq+%`5&=BUWdXl-kAp?+clsz>*#qxnYI}!Knvs8%;+?TAsVi*DSDZ$E{t5koB_JO
zpaWt!&0LKHDvoC2h#_)nZ!}dn+-3FSD7HaPyWn<3rz{mDW0Is4xR((PW^7Aqm%hkt
z<jC<`AxCqw=GCAM&2cCJ=scl(Hri_`4kVy#=eg(#oK=unh`Y8swx34E7(eX<N4`aD
zeHo5{*(4)j^H3P1NBGM=`UC@6$H`S<c`Z<vp1+}NQ?|lh5NR+jyCF<?285e0MVYze
zrW>6a6xpz!KC&HP_55~}{Vt7X7b>dq=s;oNxGoYO<p{K6@|77+26nS}-;?<Eh@0Oy
zLGC<?n95Iu<S(0O%LaNVS{vHc<+3(cFrJpnD{aIl$W7qB!mX+#8+vqhJCX`ED`MKY
zf9qT6Gn)XqxIxx?hmFjG6(yA8UJL^Tp{~4udss<8#%;UW|L^*y7`ho2vRQ}a&4eoU
zxO5M=GU3PKz!#N?ZEt|K%U728C>iOZmg!oK_05DOxy3D`ab&vZ3=Pp_kPe2~<@25~
z*KZU!xf8s^xg2|oIM&i|Le9dW5F&h3J9D%1QU>!ltabrtgArOSwHAPl4>gQ!#UZ9$
z8^+{lLG~@e4VyGt=vL6YG|sDUU%vOS5%>tvP=*jR9;qxnq?`{;(|suU)(~i9E7;ib
zWm|4>T-6&7^77uwfo=5&eLoj(TnYaL=!^sWw#udxyyTu<3?IanC;1f&+fNL2o#74#
zGjqW)%N9<=MB}wXLk(#2xwx3kRb{}!6L5nbKufeH9RD2qc%1c4#?}yh_3klMA}7B}
zS@@h_8K5b{8(atm@b5zWVA!G9!MTmWoI>al-TZkK^gZ3qj;Ked!HjnUR?)l1+@gzD
z|FWg5TyXEE-l8CWglC)9^w}bn=ypk}Y%M3V-VJu^$pYH%UG<Ky2TRSJ$Kbp8MuEOv
zyCR?yP6}5^ORRZjGcM5Y+#cj4_u-OmtTfck(Ue06=yfAHFOI^RP;G6`I~{HE?MhP-
zLxr3TE}$aIqK2}9=jCnGy%iP;*nLk&y>WVl2-R6gjyGL1F>-eO*jgJgsW|`%TJuiO
z&VRT*chq670OOCf;YM0l<ypnA`vY!oWt`U-<Y8Jg{sIZBMagk*vU?WId*Lo7Z}sX0
zzFArK5ZL(29=Q%zDeD(dz!L8~1!mS+Nl!wX_SXrNO>idqPQ{chS7Gaii5tmJG%8|U
zZGk3C_~s;cy#dB`>>1c=N;Bbhu!KkZ*A<|L+>Aa3aTm|-pnyFqxM!0D1H{$bE}?%<
zXAyuRg8^Kn6_7{fL*EWXRAr=m<lP0YG`e1bx(HzNi!QT&S-0<FdT=dgh{W&jF!Th{
z^t&{m+Xe=m(?&0@;u`m%yKE02fW8`Rf%itt=q44~*sgF8pEbQ?Ita89n>8p1csjV3
z?^$Il$zK=(Wo&tmie}2V4q7ZBt!Om(McjbJkwynNj#SeNT<n>{t-l`jWm^lyuGPqW
z1g^|z-edRR46#zK_x8JKpEK9?p1PWacIWm+wdVvrJJ<$2{!Zm~3P;=CcPS?)OI5PE
zb9g;mKR@1gZSV18lh@u6gabE<d(_0hu2$kDbrBnGag)L*Pt4523UMc!SA9W7Zp40s
zaJ*h={A;xm|3MD;(Y<G6?hmFh)KzlblPjXD7P>CtZ}X-$^19Re=Zgd;_rmoJO|<5y
zLY@@b3&-bf-*~LVTyyiRH&V+3$7KGjugIw+*DkJj+S(5rHL~2ET5kYG(m}?ZpO4fe
zU+ea06R9gYxYngo<~bSoMqC1c+maG;?09YX+P?XOH5YNVV9%Wow@fA67R0SPMlAa(
zXoBGUqYb*$qr7)N-8v7-4cnae-bn69bN89)FVc+W1I23Uj>KG6!m?b{bFT=35Ze9S
zZ_8;WGqq;Xp2kg1e3cQtVNSP8Bz|lCn|?fO4EFFiXA!%VsGC`eLj&WT;jt8J)-`&K
z^eB2PfwN=m!SLy8lEE+E-w1g5@zXtH$(M;ikB*th91neJ8GG!}FMBzD*>zC<m)(E(
zICSiru>;FxE(OYOd@k>GX7omggll-1=f`_G7RBDSLnE$x^bcIpEs4s%k5;!U`<P&j
z>$LZ)^vCeBdu_rlPfTkxM${yWALn#`C;03n|Cv1pq&ch-^kjr2oimJYzBay9K6sO(
z&6louwz`&ypEgn>!w+xy(&mlIhO5y?u?<*A!DZOm%NdJ^H!4+&+C2WX$R;4yuD$#M
z&$$e%kgYq@Z4GLR;L??p=W&7+C&#b-!ny7+RooR}H{KGXgr!x5bG0Y2iJQwUj+hBS
z(9Q*h7nhWo>N?qTJQRH;l|mRV)U&X8MV`NX!?Nk_iDz3A!?@=K0!Ak!L&U;qiiipy
zZx2gLI8TI%+;=up7YzdqG1NJIG9Nu8j$YAV9=k@k`Rc*d8uefMlM~HwjpxJk_O{sL
z$9-)a@Gmy9u00=t#dm%S;z=8J4)JWv;r4s^MJ2%wo0}Z*%k-gFA|I*#xaHpuLf-WR
zu=%dd%%%Q2$5Rg7UHn|mn6a+YZfFWQF}#G*t@Fa+!p&-euW|SIqofmG_RCEu@ZA0M
zng^92Q}X^=sz=gg<bFX7Hh7PD&`1hh9_RXI5ihk2E2dmHjd8S!Nz7CJa;+81?l87o
zd$H#urYFXL&9`K$^Dm@(rX@k3cDL`iN?UJK;(8-htRQYEZMXZ<Sk!yf1o6`N(b}-e
zH`Djbx0KZEgv2Ce85k|xWzBl;@vPLGQyQcO?zxK6(Dgcb)MNE&*yd#qqv`7fw3Diw
z>lps6faO`?%U|xHHyQ6_4O!nQay(TB7l5bf6S5GS^;Fq*0}wmC>+ixmTL@m}EnYR4
zFAJ447(X=Pq|qSjY)O4ycgN9dIAlQpHM69cb8wjS%Sd8nzgxFlO)UM2uuIBuR;lBT
z@ZjJ9;l!(!$K@+0;WQallU8#zbd~%2S*IcIE!^H;h&q_JbT@8%-;v~f?i@^uH)<H_
z_M8^L(1hD$%_qn1x<ZloKdFU1S9$3@<*VkuDNQt4CxpTU^p?|3p1)Ntl5g9We`DjQ
znwmq=k$CT|Dxn4R;H4hu%G^a8<i@#kX#Sy-W&z77{+9^Ol{lxVkEcezwkBq;#PDI4
zP;zx8M5wCk%vU?z4sFi_Y4?$SCxOuVWbLrSr!L&EHluA|?emUe7vJQ-coEY*2`e#g
zj+}8au(oTAAQp}gN78aqm`lpx7uKnBUOyOb5QW$2g1iP((%ro7By9;lCtlFHtX3b%
z!`oK?7Ou`#((zt>`mhJ<gm|mp=FCv1t(;LdwSV&Ko4Ah}zy*gfUAD|Ghlch=o-Va)
zS|Y{{x4*mkG(6k7eZQXB!q!ZVh6T>fi)bfgR4kJ?rFSP?|HwzJkJ<5VL!ePerAo@!
zYLK{bbm_+G*tc?(1mB9qUu{lzUr`R@3jKUTHz*E$21#(`u(OTXS^_yjP*62@G!*>a
z(D6E-X8*f7GsT3vn&w*aUNr*7Yd0f#2v0h|_Fh`*VJX_pB4xtr%}<GAeVJF&4|Tk0
zoUNx#Ed$j@%IIMkh#Q2K`M1=Q%0crJwVcHXN0_@B{DY>Qvd@FS?!zTUtW#1c?m4a!
z)>GzrgDYN>NYslVS>iqIjLhySeZx|`M71c^nMZd{YnW-h<U^LHX~&x~rvU_4O~=!d
z`<>Id2V7eLt5RGb7MY}`Ut{rRZ)-BRyU_hDEoab(%-r00FOLCwyzlMD4|<9dfGe46
zw9G#vxZl|io^kwE4zuohn{g33<9AC^$&ofmesAGohWE=$0#jB~TAY%uXGUaMSxc;x
zo;IF&<lipGZW!2(>JQ=buqdxmnNt>Z7eANj{5-6`L?YS3Ywul+3A5{Je=ykJt;a8W
zv!i~&J<D+!n-HfMcVpTXi_OIf6<DjEcgz;S|K+g@0yhihX4U)!H2n?tDpA8pW_ciT
z>6F=0%~StDKJ=TL14o!eVk8SX#2aV5pT=m5*=^oV@O<zQft?C;Sn4@T$E(vXn2{Id
zZL|t!;Pf(o!KoZvOQasg=Q7edS(pS`ae)U?5=|>gF3o*KLy4@6Qg(N*_&Zu)Qy~Us
zx5ox))z33YP`9sVnJJH^7l2{{*ctgA1oUaK6h9w%0NJ=kl_2J_7;0+xuw`OxKRoHz
z5AuscXWwZz9L0L)@rU$Oi3_EsfVUpMz%C2(o=J4_N>Cr@5*y1$+XlUJ%NmYbzw2_R
zRK(=lYh!;sn3)RIGlh}Q!6RWJ!Eh(O5&hT{o59-SG=UzAiX&mnOOSc!T;Qc3$Xu^J
zoBMrBbL}^*RZ(G5XonsP-5a<Pd~EjS+AvL9x-wKVUMQY-7&?;maQ%v2;eFTIiFE1Q
z^`-HUn@3-zPG=Pd`_rU)bU^xQZ~Ip0UFmjl@q#!ZR=QG!>?#(Iyq>M^6w1J<F&9K<
zTWDl8oOnh=3r5HZVrAD?x@{en-V5Ib(1b1A%bIJxZJn)X2%|gx>1zqN;8G8={%LjJ
z<7aey(X^T9a-oSWw1jDLgbJrS3M$D2{#YchFCqmP*Zw7q+GWNF$CS%NM4<V%M+dG9
z#(><7lce#Xrd-~#C#wNn<Pqd1S<KFVvzVnq-|lhY5?>;iBXlLJRptib+p}eNr*SW5
zy*u|8fMG}edTu;|R`p0aEi+TxTjrq&p)EI4t^y$$WGU9AvX-SJv5>jBzP2+5>aBU)
z!p^p@EQ^O<=oYSP{~e^Uri0BzO{qwX*^FzMH?gdCYA7LfYh|LV`|B%FaKC5R(|VIk
zYL`Gd)YIp|5(W2CZn|>%hs4xJrB;s=Ji82ltV(-`cP+>LD7#a-Z#>U3N(`Om(faU7
zJKLgP!Hj-dIaxilJIE-_g&mNy6i^5stl8XH%gMojU^DEhw_YO&nVNhM?0v}<!ER~~
zDzLNdFXp6ef8Tee+COQyTK2-=w3<14T5~7WF(nx{WY)A-QRoX<AsQvD3R4X#eajAj
zmyUNX8B(PeeXT<4C;N!l^j1f1PA0S0e|tl?>Coz<C(IUc;_QvFtEsGwo$6y$<8s!;
z&GUT);<>F3>PmqTWu@~mNWv^UDRPvTuHmttrDkzwpi~Dgq1Ojt*+iu_%DJai$uZRf
zFxePU<0<U7iPK?f<MF9t>?{(u>tp1~8r;>d#M7?ai5dsF-LPzok3TLI8IU<22kSkS
z+>MX$wC2jZ_2%v7?2zhcq^5e5INDQBmguQ{v?xUzB|>LG^VDM_SW=1c?Hw?6ebaGU
zE?uzsEimYo%QfPqqwHepDX+9SwQN(xjyxZzhnR7R-;ZR^lNJBq6%)Wbk54|i^cI$+
zF8bDt`^sE<YZlZpvi9Qc`<DqzpYtvg8VO(D>h3oLfRR=N#0*PvyrpqY`d!M8R(_R@
z?%4Y$hf8s^90rH%GcOxh1;Z3~obxx)T}IXH0?$WU_ZwAVGwf!=dxNB<*$18vXe^C3
z&>yW2X6>^WORJL@tc_5ItcDT|-Hps6Q<rw!vy*nx=h>#KgqVrrrGw_qGCKZRd4m>B
zP6AJwnZ!LOT25P|vop@;6tuq)E1kiBRr-wzhC7d=;^{LD5h4OXBSB30g2p#mxQuZ_
zNool~##<X$Cx@jEUz{gbztC!gFPbG+4_Kg6a_Sd0>Qe=3wTVUONWgsm%6ameK10J7
z9w7XneKR~+6&MrRBOLQmNO?m|?WvM{>E(M{2=1G$An&F3%d_2T{xqV9kDb9#%}Pf7
z{0xB-$o%00X0lc&{R>rrQG!(vL=G^VuDIu<mBlZZT<gS0UR`vgfaJHlFof2}wm0;)
zS3@op!(B~R-o{Buip6Nn-T-&oIU_Pw%$-ZsO+id`ul5@Ob6_k0pjA)+S?UVC&$(Xg
zf~kA7RXOsQYK!gxwrm4hX9f4Vu<!8ZH99`G3+95DPlL)usZfJqX?7(?-xEsMS#@kj
zxN&=-U`k@eGk5)|hA%e+1(LjV+#bDyOGtL1BAMD%e>svIQ}7^Y2N-8k7c$flKAfAc
z9*GLR6b=<1&rJ&fFtOLgkB2Bm<4*=gKA(h%^P5=+-!ZWb2@_9>h3it#sw}rt98XSC
zxmw<I^-L^FhCZVyWUk+Ivp^;{$9a-g<N2jZza?2h<KY*g&>NTUuUqG7dR$KIec?Qh
zE`4)^Gcex%ain0Qx2sgN!R!cAMoqm6n>v+u%D`LP%%z*&?$|H3+~WJe7D5S<7G)No
zQ%C?D|5~k$xO#|3C$}(6K%<a3300*!R&S;{9yb&Yn7!~+)~?Q@h_Ha(tkT;Nah!>c
z%|x$t?Y2DC%y|2er$UEP=$Xzt!6w_dZ<to5S-YIKBj6$Q7X7(WZ6Eu1BF1jK5aKp)
z9c_7o36elFdOVe{3qQ-}a?I!$XVHs;-B*NZGW<L;{hrPB_cXk}-+J#{3!i=`l@})V
z4Dp~LWLB-M%!ppI?QK<##bmbM9l*S{<z8pj?2RvKAE`@jv|O>@pK5d84YFjPu#g-T
zCLK>la9>*(Y{5PCFui$33ENtYPt^KItJpb)f`gu&;$<7SI^n^}xQ^vTHN35II+J*1
zTsT=EI{a)1^jsos=ed@8b5NoEV9U|@b?j(J^NGXWOHE9Z?eqK%xz5+7^fiiS!5l#&
zhr@fXBjkN{W2ZBbDkV~mxK&18&UI@5<z^*@AbBPO1$62jZOnyv6o^Jw2kHBd-K$Vc
zyi)Quxlbj7F6Y{_lSfxRPZ4EpU9OzRH`oTGhv(J2@@iX@D_gRfZ8wI9X|2^+)L^ET
zMvXTLU=u7gJ=a2zG9!-*61w$ll{)<ZaK$=tSI)^f4bCH)6!Qy{x&XM7srw$GQOYnB
zBpDC7<z40QARarZ@B(|?qiaxSpwRKlBE9J>IyNECeGyyZ4Mp^h?-6+@diu-RtL40`
z0YM|1`KtGO&qtmHfSGyi)s`cF65j7YHX9(sSpf^yOgnP!^X}jb##?@MUKNFeW>0<K
zAJ!-i8UgsP_s-(3M?$30?l?6@8O!_TS~pNp-d0=v+*f21Cj7}Xg>$dsrING+m$9C<
z5}ena?5jMQVS5g&szzA4+;j-rWswwTHdCJ>_Vl@Qr1jct0Vtv_ME#gW1{Hh#!>;UW
z(A)lHwXZt0i-owv?evu+pNiw3SaIp@pID?-s)f!Y%`S9(FjcK|>ZolS8Tja=y6(Po
zPIIfayf7=|#`|YcoWS8f@NJqDK3Bb<S(1e@Mq1xAsF&`|UYX6Wu8!T$a>kjlE}gos
zj~b;5r9#CBDO{+uoMB-XZ47X-s2UC&ooG#zkkQ3Y_gQ`Vz&emfV{sYWo?+_jd_G=%
z0PX1HW!;J}x+&M8$_{uiu1w@&HqY$y6sx+@>ah<xNsabOq=>Z!AamHp%ku;q73TA9
zb@rkPn+-h|<$}c*YKW+KQN0BBRR>MO%O)!_ZDop@J^8k&izl8(nBzPA2Gic4GLd4g
zyz`i*lk`Uoy*iJyW%)|X=Ah)FHuhJQ*;m%7Y_%sH5wgW!)yo+Z9^RP0_2JNp5o2jY
zfws&P6g=`lVbJb{EU&htQFYLZd(WVQRmm1pxdCbpI=fb6yq45f?uB;|3!B%<Sb3(q
zy}>t1zC8|nuaT*62}64!LZA4-B~&*cW941n)`2b+HrSreU?jov;#3+&o%Tq3y-Ei5
zCcOCkvOm*G((C;}c98+>FL{#V4f%6#X@T``DFZU{MrnAHUFu1-PsC#`^tTlD3rt<8
zj*m*tGgoW9Bqd!@&riI#2AExM*+RN$E4Hqzt(U{ycVQj)HO4!!Q=RI~Gb#xc*N>QV
z8c$w+$OW>MmR6~`ozt->&aHFzk^pN{tCIY|PYDNWuL|G%duet!2zceAEaBfn4|$dy
zlgumZP`STJjnkm;e*Q%RJFyQhgzg_TgsRyVC3<zo>T_!_3IK+%D0a>MSE0HKM2+R<
zw=(lZn!ubk=4MO$OgH3-p=ayaq{|lZED}>NcjBI$EGZ$)&I?xcdn&oV#MXg4CmG$H
zrxe5V6vuV;%SU~(Xh5~)8T7F%896Ih{K6)2rb|Q|f);Tfx<38NG7~YxG}%8nH<9wi
z8seI_Cx<Dbcb^!xw(00Z*!u9RX~A&%ORm&#85_Nua&lWEdl)6tyl*b)SgMKEC<fqS
zG-THW&v{?2P!DkRw<*~yc1d*&@qW0Nb4gNHDiku)QL#MayKuK7S;!$6W*;7}pK-<9
zxw#0i8$x?$ezkdXu)Cteh^iB=nXVtBikcg<=^C%DuG$k66qp{oZz)00wS_-C;w0g1
z<ixV?0h$|$=fp=xLZlflfAfirvG{6~nnwL?u(%_TH^FP}slDJ_vbM}e!EjzpLas9X
z7X-t#7d0ig8I!)6x7;VA7KfAkZ?1>EaGmStPw&%5%5w>UQkq?W$aNJ3M6S>|HjW3T
zc`nnIMG%vjD?DH{BHOuc>GY!K(yVS<GI-`*$KiLc!VF7~d~itAd2@!AJ0wb-75Zy4
z#(3TTIji_ZfN|Me;}0=rvP>HjF>(OH2o1@Hc>U7R*IV^`57P9+zB1{kv}E}ShCjbj
zbA9)_!f_HKmi)*j3pS?EkwwOS_!Z_6rqZ@cN?4B6W;rt}nL&7wIoIC@vnS4$mkwR6
zyM2^mGGCKo+3N*i2&d!($I(;WFO$IWSq7^H;L-=rR9)oPJ?+Yh5)9owW3E&e=^A?}
zoKt6-{+cHAnpY7#@&*8{-)vnj8et8epN2H|TVqEwyUxwlN~Ya>Bn6ob?XqRMYDx9V
zfJC%m>eotKrlVsw!;b4%;>3g2Z<WLvu<nqzB4<k%$9RPX--IPyPJPs=-W@>09^J=`
zHi;T=G0awS%u}=_midmpi>UvSI{?Iu>x(t)_lDBPE*HFHlQe%GZ$vQEeDy%NZ%$@T
zu*z@GWJ`Ldde4KLc7Symc`&{PM885eNBt^{n%4o+(D#gUMc%DnZA_&i&N~}ZX;+0M
zblNMnjxE?DI)jH(<u<PFAHYb(U)ztCGHjM34#j_xyp6du<#)EV1|h*avbXXwtNZ!(
zA|bdkyUu?5D63H^aBXZ>P3fmri?j-zm3I{?==`Qvj+HAeH;umH8|WrGinJT~CzEa}
zee2NVeS$x#Eim&$+5<gsyNj@3WUkdq7Ae=SfJm_oY}64u@sKA~-%fjtwrjJ$D0H6m
z3^81sPgQiFqGtx*){ibJIN!rqM|JW%M<AUvE8a}bZJ{7u02BP`C9`*IoZ_qr7ft@5
z80PsTIR!o+j+bS*k5u2DaE{+A9rt$P>wfB1Jw=isOCcMwtE^BGC6WO`DrB_svYK(x
zWKV4hyLQoTy--!!{r3UH?cM#n>X9s?6jOCj5{Mt*&dhZOj<B2-wK2Z`vaF0yT-S~9
zw0@>)_4?+EY;1#ofnv$9WS))1oblq?y%$Im%bT}T5zy6{Xu9;Ns*$|F*atHn`h~Yl
z*M}N9vAs3|j3u#1n;s2b&LW|4Ud5dDH`Q_$ZPJ?gc{a#sW3S@aAuV~v6}o2cdh^Fl
zQb~;MbgCckyjOF<O%3RE!Eix5{9%ux!aVyjkqrBh(b1hBVe!W6)FfK1<HK#u=8p~u
z7P5Io_XDKjYTg;)QQma}GV`KUeY1vk^~=hy-4;&>*;JqKwL-^_a4H{FCG2mm#%oP>
z)%S1J^HvAaJ#SKXasr}JCA)OmjqE+oM=U)Isfy^5u=)%-eWX;#%@+}spIfZ@R)Z`y
zR&A3C@heQKiT-?Q4y{s8c!{al&q{2nN7!f1RMIfJpXAjs9Bb64V?5gj*}P!eCn^L8
zF(6wmtccRVplA$a(6JRxmMl9_uv#4E!Uk?Wa4y_pEg@mg2rvq;F*3>3NVg;t>M%jV
zg(W~p6~(I?c8Ny)Xx3$q<qsr6_(L6`0kn0d+sMG+K?2lsR~ovR?8Z$uO-IH)35Ta<
z`_2i|b$NHBR<u&lJs)AHi{jUr|C%9t2iCD^<^wYITMxKa&#Z2?M?u8v{qal-O=<b;
zFX38TlIn-q{e&L@(2vMv&)0>Lej>SA|0pob5DD`&OeAp~Z04QoRx@ebo5C^A_x^oI
z@^){bZv1(PdP<JunDdVNlN0nr!~?)AX>!_8mwA0M`AAaX%_F(s?y7~|1Lji+19oGI
z`$M9cthz-;^MnRo2yrod5(?Ld7f~{HU#T+eECe!1=bYA>fn*lz2j=R?bfc1tT)Upn
zCyC7^;QEP6ifRsvyKVI`JmP2*bkj=FI6QPxI9$9{kFjoe<*c~%11nq!)Fs+wx~tlp
zU3x-6Vw@#s-7xFcO-Jb6*#&f;;G(xp?79o9opXtKYtCCSi6H5n`10BFY#CjP&W8Qi
z(FUt}Um#>vETpSu3T^uJ1eF7yh*L?Tmu}JO%ig3~zrg1~p)qmdSJ*^{Oh4+cT+}R^
zVEsaMaxL(p@mlU=$(7l+>8|a;(rIPfXt!aD7Yhp?Y9C4f-r7E|5)u&H<cJ*^`;x*o
zpo9%St6JAMsd{su$8=4&FE@}-CSvjIpjNtL(sQPDm8;KdtApfjblcggIZPfVi%TXT
zE{Cu1nuR$>WZlh{ihPRDKxSYEAedf@r%ywyxH9!Sk99ne+b8POW$r%KQ{yyMt`Zz(
z_;eSido%oM8#f>iXOHmJ9d>&Z$t52+H1T!!;oEv-v{d|m$H;6fvvGM7``#x_GE3*e
zJ@JzPfIJ-fz?!HbN1*;_Jj+tF_7>Ry#6Xu`OlZl?0tBe|Vubo;s`dFj2L?Fd-evVC
zlQ~T+60}O}i3oSij1-XI{2?C0LKSti*T(9N9J(yo4|9-}um=7TA#S*&gOvA!@%huZ
z5V6idOM0;8=MRtUIM)X&14aj*CSIGJvvawM$`X3jT|)5CEtzmFOpG&h%5y(}y<R<s
z5nwKP#O=YA*mtVISV%OkkF|}HDu`W5`+|-%pU@4#@Hl%Q@XYZ0h@kWD)TvtA^04pt
zVlTM74g?t2=gW)$YatN&NmyAKwA3MrUG*QE?*6tBME|fu5NX1RhQOnC83MFDBrvX$
zbo7pSu-o1xVKp|Hr6=(TPo6tTg36Znnel~*bNB6Ju_Oka6Uc|20|pNLi+2V>{iV1K
z@3la>20f7!xoEhUZK(3|YkthMMJe<6X}d62Td9wlldU<vo1eBeTHM!&mg=C3XH}!=
zEbf3?KIF5=cyPsYg(+bRbjwbg)f{QKPK7)&-ttCKsfgKWh%;#VRdH@K+#4Mm5j}JL
z*b(76A=M;ladgBRD<iri22R&4E=qQ3(6dfk-3XdI3sCh926@$acjcBiroQs-;a74b
z;Ey;48Ba2Bx`%3y!?SV{7Ep#lC;lEoKPAx`Z%57_*zsNREhM`1T_43Ij}3fCR)^j-
zc3ZU8NX~s?`gRM4%#41}`9S6UjVQ(a3s?LOkFR+TximMcu-P{2xSWRvW2Yx%)1HsG
zOdCZ^TaGmwvtgzDsJ;T>n5&+yl39UrndiFNwY29!Nz_Hu6C&Z>%ZpGUyZ$}d#Bx|)
zSNhmjzL5KLDOo#2MqfU&dP{oWo%c5yo?8c2b_U4)ANJldEX#Fk8x<3k5DYpbrMpv+
zl9Fx^=|;Lk6r`maM7pJ=m2Qx3q`SNKbw8l<U31N~*V@NB-*124vG;NCZ#v<5?&}_7
zoZ~#tF|JjF<P=d!H@JPI;JY2?(PWPZOK*Fc0a88f0m|uq?y?ekda+*cK>}a3XGO{+
zXDE3r^>l;i?OS~DOS2f$B)+uu>Ad0MHmwikBdV3x7W;&&j?X&VLlbj-#Ay=E46g(%
z_Tr(KEazdCDEXu@d5yhkZQo7e-`=BZZdThz#^rosaLbkk2@(~Z_KN~J5eU_*9HmyX
zFh4(%{V}(07Wc{N<`3HGS!|1GRURkCtoU?kzlA}skH?mlD{&aa^gdADcl@8p`vW<u
z@=7HuucE3N;}r<D=Q?TYlPS!SH9nL#FG$yWhgxW3mMn$G20AVV%_9cCs)`{<XY@{P
z6*}8^hhYxHK=X#AWv!kRzwT1Q<)q9WZ6ftAW?_`-c};mdKP*-h@WU};+I-WySBLsK
z0~7cfqU;Z6qdI5C;kd-!h`SXVvt!WseytBdyf_e1Km9Pn1VvqPMuWOqsiGytl<QWN
zvIDACg(iKHy*KLsD}|`CdI#4@L6tDh;Y>J^d-@<}J{i)?Q>hsrDxXiYFOE+mNvmjm
z%ZB63H<~FOu}7r~QdS)yIR3a$IxJM??7n=TDo%zCI*VBNcY&i+A^0=MpEVj<?PeRw
zosaYs{*`MXE8gy&)k-KF8eysP>CI9BNZjIV%GmB4RFpW-rN+4ZOSt-{zQFA{L<LKl
zhqzyoD)<YK2HR~+RK4(7B*|ssamu1{`JUloU#brob)Orj-B#0v#`H`UL#KEd83*B^
zw>C}W(s-3qbfNLY;Dc0(kJQ^q!`Vu!O4-MQWmW~2UkmKI`;;)6_t(Y<3v{AwM*NJ@
zoXT@PBYX&K1O++SYQ!T@GHm{bg;6A#Ta&!HgCuSwD@lr0hLv(=|7<s;X_TAhI;uAK
zW0`nc-03aP&SNy`?f!KtGfH}Lb(<e^3^laItW1sZ#i9$nd;x{le)lw$fYdjh<Y9|^
zi!hJ%O4_L0d0C9vPIEVLXQZ{%#Me#1#o=t@C(5zPOCsAktD^j2)XGnQ4#Hf|e{&S`
z8)2(JTzNJr3gIDug`pznhq+BUMKK(71Kl6Qh=C=7xo<>3lc<D$di@<frcOnSq)Ekc
zYJkVTRLzefZ%H<)VVKbcEf1J}G~9vMdiN~$bKltAcP?{5f&Xk7`Gu{8LV)~upIDIX
zSJrzg&Ktf-3etV%*o#oNjPcch);!I|Zu)G%6Ncw$l0^GjSR>-GnJetAjZsve<nvb@
zTKi=kF8QD*X2%9{+LtW3-*O2CW`klw^7I2hERk~2D~ofNsz^B%k!Q7X>T46pTi6IT
z>d3WwOqrCHRu$@*Fmq?TOYgybRK#Fgp?TPi<{P`R-Ow8JG71o#IAz%;D?;3q27+6F
zc6njHzq(|AjkC5uGN9t*o{j+YS)@s&rlPK_57UoT2Wpzie9&kf7wA&^`39L*DH1vz
zjXm`CVfHxR>AAUR9zJA?t7tnqD3~l&-@+z&(Ffw5JK)jV7WT51>xf6O>rW)48;unA
zJwU^N@*5?V-CA+nbKe=cf#N1^B70zCkTe%4wWQGsULfa3y!w=}&6aHwYOe7Rm;aSK
zyvu<6*&im+4dhPX4=g}T`YlDPGYpR9+vjb>gl@k%$3KVA$0u-W4@qD6oB#R`*JF8$
zfhne<Jtpt@i?Ao!Q8k{pxWq8dt;6_}R<jhnRm;`d!DHQK)p8r*5o^CQU)ql0l4StR
z9fHZIv0rjzI-k{(+nt}<%=pmAw<hp;)(9tb0*N!Q`Tl&w)Qay6P`Sw7-+9P9n?3RK
zrsSOEm>^K!YCZjfK_QDMn<zZYh9q+7m=V{UaCoBEMDk9t91f)qsFd1zS0|h~@WrC~
zypG?xFR+c5nC3E?+C`_wJ-;f)*`1)g%fe`Jgeo0wvpz&jrQF9-&vxVH7>g9>7~IIP
zz)AYQbOp|X8a-Ks(^bKFVIpiNKk0#z1~Jn>$XG#_NE)5txRstvue-(wGTkT1+Ayi=
zI6J{Z@mS@S&S;kAw{{XjlQsP2`I+lCt#JHozB0Lv^v%MKucTiezdb5SY_CUGGz5rk
zEjh}i-V%Kk^C@psmzzfmA4YoOG!yDyU*P=UfkBfBI^3hhM2&xC8v5HQlFiqIf)so!
za+(7RNN=qDI@%psO#8)`Mqe{mD6OV&ns(e_n|${<g*+6_wrx;jYcV50bn^!s#dIX7
zPk<s#Q1v8S{%XUEd}!W2A1JBR0m{+(P-1m&*^aq%ydW2=!rA`#ND6E2RWHnDn(~zw
zi_Y@#5hgrmb*PanE&`&Ctgnv>`K8Kwy(V8ZS*oq?El)*tTF{qs3WuA>Q#v&F7Cg6Z
zahgepl*&=DljcHi7Gr$|m-AlbuBL2YRD`pWXA`)&;dMrZ_VSTAaP`fGMYm5x8?cxc
zQIw8Jridy=((A{O+5MOr+N$yCY>H8A72V8~bD`Wv_OC1!&@ulNXSkW`+h}TzN-5$F
ztocekhdk$RB1bLuuSk!!gyyzJyr~s?GxVUVD9(~Y$9KlW>yXF=fIc;G9ANS45v)Cm
zWbgan9}8b9A=tPUDM?TO|7mik^A;o*xTk5tgsk0VmL?|qWKG|hr*g3_4ITD1JQmGD
zzjEO(1@jM25fLPidj%z8|0;1$Nk6q7Our92fs{l20BYaJXWGw|%P5(-NfP;=k5}07
zV;B?KJd+*LX^$h2;3=q)c@5<=)z<B(DfZDJ(PERa*WLwp81+Y$OfpBhLbP;=N`@;P
znl-n9zB!VpkT<n;ynbu;=XduvK1r=YYU{-f-Crd|q}5}5ZBp9EkcbS3<j10p7Ot`_
z)>TK@r&$NcbL5O{;?X(2jj_|Ql8*dMjP#%gg`0#^+6&wPU0!-C&bkq`a<K_>{m>0>
zOd9<N&6SNfQVCpX(2J8`CtQKrguDzPG0_X&^HeO9hkf^P=~2e=>`qT-lb8HJ8A$0Z
zw?|?rW6qNv0Cy7UVP<aCN2sK(tqc;9ipO%&zbQm9b!K}{=8ghoPHH?PScxkQ^*T!x
z!%7kvV4gJ58cT(UbT>^R8<95BLwCK1P4gw-u8HUVzoo?gRwfBjq7BwkMB_-c&y@NZ
z{S4-(J5-fgK>~@Kvbg`UTsTuTIWZumeW~f}+OfrFhzk>W#1(yCj<no*HAK$Xgatgr
zhJaY|hZJ!-FNzt0)X#Fyn^aXDqPNQQMIIuo+g3UqGat?bBhS`{#|0KmIB8}`-{=N)
zk7TmcLxX4QWkc;8m1!`ar*nXBF&B+&hNYhTHp_&)to8c1b~H`kJ1yTCKyy8Dzv=%$
ze~&6Leww7NA=6j>biNFIdZx_EFnONKrlD68O%gb{*h*K(^0#7H5Ij673zDTv+;4F`
znUArEOUGNUERho6wyh@Xpzd1iz}<?c$n_Bhe2F{JgYQLMQ6iR<Ak`AA)j);4@ez-q
z{r6hP)7HVWPSA5#A>?tzMCBL`MZj4H+bhRT=ac4J35E_|Hvkw&(wL6MuEqj5rgm4*
zr3}I`r3TWgWjShFsCGMRJ^WRw$5vW0qua_RIiz?lCvHZAU%5@HEQw&cB87l?Nu6U5
z4=m66|F6!oEkbICh2-={--St}qoaCiJ&{{~COFLkkLIj_cj)(Gm+Ay5AhW;Tayj_n
zK!4%}N4H547HK1RIvY-94p0l-;b%hfkX)kaMlQ^P=u$wyuQp}*I<$O4vlES{lLXkj
zx#>yk_Fd|)3O9G~OkPOqtlso9h@O(cAMQ<^TIw$saGF_)FkHb`E!4}4sW{$S4b`Dq
zntMkmL2`+cv_dXT$@tPSs`%!qdzB9RP2q;z4A%ZGGQjaZlp~Zg9ZVOLDUhZ1;8WYj
z)iphWmNq=6nf7Rwo!4(254R$NNH`g##%;GBO2^3Z>T8{iHu4FG_jTk}pAmqI7lcTF
zqC<{tmn2dm$AOkvl~x@HoE8GsWOFL|PCwqJ61g}R%*g`Lj_&I-6o_^tf4orjNGaX8
zC8<;@rLCDwcqvM*Y)6<)!;0Qw?}6PM#&+v7QH(Qq6^mWO?n!@>l%$2DVvK=;y@sNm
zMUV<gGCPgA<OIxj-v)0o(;(e0$!y4Oz_SAeYE`8YV_-;ia5jv+*`2kx30yWl3RUX+
z*_6svv^)9eBhSc0p?p6A47&d>=KIh<m3H+@m$P@|3vDH*6EEWYnLN8<4#v!9x-wiM
z0LF9|MjL$1huB=7uwBveK+m4Ai|i}HicY_>_q9AROa0tQTxCaiwnbKZ<{GjhrWRn2
zGW>rv=jrTBRSC7njZA)IJx7Cd!J48AG^hJ)ky{J4(oW<b#R(7nSb77Qvo&o-<2X#C
zI5%gyBdYiX(hlXeah-PXy7>CD4msI}tymQSr@iZs!Nr!My8GJQ&3(<wOCCjTrLSYk
zz@O)MMY@%KvdP)$Cb(_soDdtqiF|c@e4_!7AZ3=BZL1*FVI^7>O`8Ggx)ty`VyB3=
zdQEnx8^!$SQapO-f;@%moXx3DXdkuU0qd0UkFVkjW{s*Ia7PVaXQQxa?hP4M2-Ph<
z0X8nm7`$`hE4fvBpFwT#m6o0AzhWYvFk+w802zfv0?IiCnNYlG3?nv4#bWMn6JQq+
z9$zC|yKjY9!jTc<?7>Ov_^fSr_dQyC80Zd)DZ;vKVclz;&{|l8#MUi{Ip}@!-(n6Z
zqmnCr?E?6J&K|1)B#zw?Q>E}CjMA7bw#9e%?0CJUF}{KZ7>MP1sfW;14{X@xW4323
zYX`Hf>*Z49Gc|$HX{)UuK$*DtQl1ynH%MKl)AVdT#;efumWM0ivna`_)D#_?^xgEG
z;lG0xsK^kG*|2+cawS1Ro5baG_q?Td5!q)rkkK&>CnuU&pOB@miYcWMm^y`e=Bz{y
zYiG0C+R}#uRf-Oq_!yE^O1CEGEVx;WhoA6y>;+RPv&`3}2LqPKvuz$S^`_W9JOEzd
z#qQmMwJbU>YQi9<pv*ZBBn(1bc^;OO*)=W>g(@Rnj5OU2TgnFXH1e1BQe{#{-kce7
zY|`vDWy&zVk=@cn_lan#iQzyFMYeK76d5w^N&6s|vv(RA=5yS>%y`26JuHJmDNi$Q
z$PdsT52co+3XoVtRc!?P9P7x*9+WtAQtJ<8R2kb_)&K^JZ(wiXz>Kwo2L6rV732ZD
z(?}t%rDTjB6P*E~*i_)fk`muFh)t*}AVe+?=Sf2|0lKFO_tC*=(@FyK()jR8liZ0q
zg_0Sj<n$u(=@hHiRivVkQt1C1WE9}~f;6E1LAWx@#o$7*^x<ZeQ(c>1F7&YGmaHn-
z$WMsV5%gB^D#a>#B{HpTF3%f)l0pe{oK$B9Xg_T9#|a%PxAC;LqgE<R13FI)?Z^3o
zwoGgNcor8AZ6#nmAdQs~z>Vc(X}E{BHVRl}?fH(?eA9DoGL5#pvDT|HXP1BxgF31=
z6^Zb0Gq2spPWU@;V$TAj9wm^1T62SPRP7a0(uK6YjaQw@vjNHH`{$6DR}r1rNJYV=
z_KL1YzTDl}Bh3x|<=U-rsAGOF6)>jzY(q-(jfR3XEkAWbLPI(w)Zj(HkS2TXd%CN~
zgj0F-or+aE&xorpr*L@8*<I4snRZWgte#j{p5A0pAg-??etjh%z3zihQXDW=JWdVE
zyeA!dgd|O4Drr@<y%tSx-_{kuxv6&cscOV#b(|PrGz8Uk5e%BPykirWspe!bOHvqd
z)blXGkZZBH8ohZ8bzArh#;UOYkFzSJq6A%uM|Rzn_U(n%`lC^O^w#Yeg~h^}uy+2V
zB5WdoIfx>o<qMbP270<&wt&>f&~&Szt@rtQo7j!^9*8&;eVMV-5j5<zM|cDED>`dh
zMDkXEq>@@1>t`)1Q}OIuTQUf@DklV#O<w?nJC1fSunR28RPhq0`y9n$_r6pdbTj-A
zzU^rR1_!1q9T0;=&Ybl{c{~u7N#h;2G(;=Bg{=KU?SL>-t_3bQ3fs+WvRsm@9M!1#
znqHh@Q!Y+^ZFYuidbY!#OH>h36%=lMeWdi7j^CV$ancM2{ZdnEHBZFFraX68H*RIj
zY})QD7rKdL`;A-}=+Ln{73GQAN|ss#H#Zj8Wmp64$>np%69vV5?cNA!oq{2U;Nn%y
z>S_tjO`^mVA~MO(T3Xif^XpZ|VVtZwA2R977?vUJ5$%61cBBr5e`gi5#x1L$QQc!u
zcKpoY;@q4e=`a#V;XQ`kUyFLHHsu;|zSSNQ^01hW6CwM4mFUg+QOdT3&f%XK+XZY#
zTr5L;cD>@Wl}DC=kcG5mra>s@j>?{kyiiHGedEfwQ3fTs*(i2(6K!Ls{|mZXm9#;b
zxM?_<p|?9tJdG`A&JogM)f#<q=2{95boGxJR0Xy^H~3Fl=+O8?X5w%Zi$q%^8gp!P
zx~PzFmF*Xd+4blAta5UgU2|9qq4H>$!ddJ$4y@tV0?Ze&W2M&sOK6JqCJtwzsb1<9
zBt2<23YpZPumE?~BjkY^1ro2iQMr;p(4~^6q)jPTf8RCVS@;oAXp15e&S`2_sk}AF
zDS19SCscREMAr24E+dSqkebM7d8xw5eB;i8j~aXp!%^GD6ilc95#NsF)|9HC)EB<1
zKEZNY_?T+-J=S+2ToRNoov=8Z+CXgWYq-jcBiJsL%-4Q!=s}Dr?iti({7I7m8RxNO
zmOFu!tuXKv#B={0&AbW;3U6a1Bi7ChpceC*!2=0LD=3hY(*dH$@*HdkB{>KhIsCEN
zDAipG1mf)GHs2vOv-IU)4GWjO`u?m~jI3vSir7N?(3}6Ws3yQmhArie^{*Abn5BSL
z>t%)QZGDZ1ermw7G{^H)t1?R(R~=WEAOsIRAF6Z+H?A^!)`@$X+@Boo>7LM8wwpuu
ze)<MbeyAattogHVd%IF^`|U;!$+<Z!KeQ`P2-Oy)NE=$oZz1D`oL8Nwd<bVBaC-1$
z15L4FL%(M&AL3xw76#j_q%T=fK2f%!)|_GEfwh-9dtmsb_2GHdur1l!${ZOxZBg|y
zBe#l;sUGV-#fDVnl8j2oyZO4_TX|2A-{g1~ZP9Qg?QA)BBuT(8>TTfYBiWq$Umx8W
zs8Puzw!shyqa+44Qm<w(Zra(MC+!nqoBF}CK_Yx>mZCvRn!`3Tw!*?f0ppvx^Q>JY
zqn(P0_xy}-N?bt)r?UOt3Jq!O!9dIrfrLFK&5;7|>uZH9o_xN0PVI;2?mXL*5iyl`
z4XSAY-1h1zoiR_8OH91P_lUBf%)R}OnOkA$FZpoz3=hLmbC2Gyr3Ol*(>|&FEoc(X
z6e>Qun*VJEHuCuu9NliCE;NWK|Na>8K*3%DTN{*fpzkWwv<>aad;wG=M7~K4&BkfM
ze7kK4aM|C@+UIB5tcKn3EzhmNe2P$Hby#S{;Z}3PgbQ-t`Qd!#O!;~>;_8<eOG1=~
zPqudt=hYw3$I3oY7v93UX;l=xeY88#I=o&Lm|Lwz=!tZSD@nj1-lx#Po>?Z7W)>Af
zW?`;};IO|I2*#&8+XmE~cKNLlo=eko<~aMuI3K};s%PcJ6p7{C>j6Ax_!ExDp(i0T
zNMArgC^BGrUSy|~-14}c9ET$DY}vE|wL6EzNaj92jD~$8d`}d`4fK;fN)|D11ehdU
zY#;+kywje3j@rWKvLv-f7HaKx5iOjEr_0pU{4qEx&P}pNnT=Fvc(T+<4f`D**(bd4
zE{lIz1WkEjHU0x^ua){s!H@SP6E-tViUTw4WQvFFJuB?~4gcK^Q_;Ssl`_ew2?kwX
zkfM4~NPa>Tx~HydrxD3F({iIYt|O#>=_lev1|0hGq!86ODsSWXR;m?rfKQ2`18f%9
z`qV)+{mZ3(<?15-C+KC%{ZC)EN_v{tHDZ2efM8^d!K9Kjw7+c&(Tj_*x=JF5aLyyi
z9u!6YdPuQ}1X!IqQieX~T3_$V!@-z(49)lAheEi3HYn9REbaGX4!jmM9Mt^~{$uy^
zuOH(|s2v#PHQ2#>j*~dqtLLTEBLW=InnV)ooIOeg@Ear4Oe*OQ|FvO;83l;l%<Yey
ziU?i(SDWr3!ya%t5qNIyft;ZQ&&Pgg61?~pw;|ad=kY(5=diz~(BEcg<hJ>sH%lj;
z<1e8jrV5DkMyXwe$?*2`k^NG9t`pYjlP|J=|N1}p*h?KN-wT?V(=T4g#DTLk67;Zz
ziC03z(3pwuOnMCQ(jO-pDZ&fpv{vEig35{Kf=^(2jn(Lv-oMmq?#UoJXsZDiALc0#
z)bv=Hl(sVZaf@CE1t<~s44({!a%iu#sOlRtl+nRdP<s-1T|#im+S6G-bbl#m|4b*_
z0~u6-M#5m*;|lwp2S+yaLcmOI;L|>pN1gWkC6A_Ehb9-dYX8GX`O^_MXDZcVirXB|
z3T8{#1gGp(0OO{4597TisjDZ&t=(RUBmer5GD2o|fe4vd3^>ab40}xI0p8Pta1I!_
zr6Rm}ar&TMy26f{{{s+^>EdUQqY>py*&@PF`Y4rYd;JG=+zS!<Kcko^DDeu@-$5k3
zP3tzbzzU~_#NU;74L^t>4#fB6r#>Tkdl58tvWEAVvJ@PkxKSgEwYEb2SrRKA)qCTg
zBbt}sy1fjKM45bUq|lFdt-i_yN)0)Rp=Ne>phvoa1p@upSiqeP*AlzUPPZ5Ox)mg_
z7j|?xGRf)p3H?Nb#Zu+3l+<VRvv21Oh$Xwf@F4v0k$=S!c+l=?8ui0aIPJe!EX)kP
zQoU-~okacn5BxEvkNWst6;GhhkXDNfFl$Fng}et(_ERjcpK`}XOcwb*HPeba)wTxN
zj+-+js8x@0$Md+<tc~@VL_(4J>WdVxq{!*vKWS=R{6e*Rz)t&JXsv$b2gxr<;@(D_
zE5xY>zPjYp4VX6!j=pN7$8-J#r;eY7xz|$hA&`^l2vo!$W(I{bve{32zr0?BjrSy5
z4)+Oz_+!_XLi_y({?J9d?)^M_PSE@08XWvVAn$>lU|C~B!Mx@D)JhqYS7L$W`Mq~x
zhqeiUs#in-f{~2BAIVSkt56xZt??gzOeCJRi9Ba{C6Xj4@mt$Q#AA*=?WMyM_Y14Y
zVETY5mjxM<&2vM<%h_*ljEIwpExr9`9Tgwt>S(;sJ4|g5l{}~$OLn(9<4)63Uio`5
z@zc)7N<uSg8&R&*)5zdg=?3k=5-^l-Tv=eTxQ9zvs{ER}8BeCbO}?iQQRH;y$CrPe
zntR$ui@ePs;@P}M@_}8TwmE~Opyifit-(zw2DjR}c`Ai{!8?LFEkO4Bf&B4~?4bNS
zyBw<1Vu8zzvw20-X)@Mz%yauo%0ciAU0B$D<i3c;9v0ogKc?^Ky<mq=_n$u1ISpr>
zMcSe9>ri@A?9-Av#5YiAcZH0Uaf(N&EM6!-OH^NvKKYB_bL9q)va2yD3jd1R3dzsD
zZ6x2Bp=>Psb5gke2QK+P5n#2XTM+mMZV}oY&H0A?&V;-qC@|TM<dVjH*?v<^43C9!
zH~6n)yX&&GoNb+yI3y#{P=O%LjA|ptdybfiu>tuS7(~u@Na#RD6Y<4L{{0vJIQcF?
z*W>#~3R3s4<9{5xUSU7(7RXs{#kYP=^et*i;!zCD0LpuG@rFuF#QZ@0{h~J!!Cuiu
z$Q=VEw~V20nTyjN$<AAU;f`_pWDwzb7@1tF<!~P=v0AdhinAasFkOR{GM&ZvaUuZ_
zN?vagAN>9ce}vKzyqU{0JP`x%&gMtE%6D?m2I-cVES$z)SCBqwe#-!RO@#0+O4?#H
zgVG-_cjR+eNsFMpENM(wwoFb?NyGgM3j!!<+q66dmJvp#uzZ_kK%eOd@~sXG40KYS
z_C(h~V1Ujf<d47byH4=p!L3~mu=85qhr&l-Yo#Bt@;vy8p*N4B*-couFA`pW0w)Ur
zk>CF-elR=?6x_cA1!+3ha#I4Z!j78%N>>M<0C!F|3@Lb3?4FgcN3g7zPAKwck3Iw#
zoQh0#u@6QEg_gL%PwMwyfWq|R+!qMHonDS4Hkn*i<5~xM493b5_FYh4iEWbJ?SQ=|
z_)eFw%Ctl8kJ&{nR9Gp{thubY|E?6Y)t<C<YvfnnhO%dVMswB{$evMfFgQ@KBVme4
z2moo_SIIlSKinVY8>j1Ec@hGMnZPSJB=#+H9tXX-K$&IdOyX)5*_qaN4A^Uu6adRc
zTRZI-RKLv1SKLGiAYf`OdI?NFMIly1ahoVCk^Yq{2y{Vq5%G%bqQxw*j48(yDa#Eq
zCIbvM>xP{zioL#mU>uIl@<JQQ4Y#i|c&*PcrHF63KPxQHP%gPh4D**`>+%`@)CIA>
zvAsgi4A1)w@ghapFo?{wYk`kWZ)d%L1%38&)Qj?@?ng`iJI&n-02xZFf;p?3Hb`0W
zHm?dS_^JMe;HUTGRj6HDlYIYhyL*gi_4mWNzzrKzZX2fMeH_K9+P+XVEvhvwFZ`K;
z0=~eF%P&ADtktdueF1y>1(?J?arp(5y=ZCw_yXb37Z??wgba1Ox1Y&CU!eW(`2trk
zJ7P*dk^Xv*FJBcfMq^rjF-8M04XhsQM+d#-!0mtVJ=Q@0YIVMeTvUU~82;fu!0z}(
zn!WmWr&)T>|Nn!+^vA!gaQ%Phi4N%y0c%Ar7`1yFLZdDz&bgSIZ#a)M1U!;M2R#Ai
zV1S<{mB?fyV<J={lR!2zj#w}NH#FY&%!Kx+Qnz#M>uf$-9uP~U5}pxjR<(!#NA&D`
zybFCpg_`rJl`=E3PZa=haQL5chO}E_u#a-cG#$_OM&O3DRBC(o{o->+;3AYf(D^~l
zq|Z=l#1}9Ze16t;55jW=&HsHom)`c+)q_Eodf`ttSm1pHRrSLAdLnR<>`zmYe)@Yd
z@te)Z1;T)55J>eBDOh0M>cD4I=2)(DZV79)?*6#}deHXJYsgr-GF&M#?tE;eSnQav
z!rW2G4ry*t%*KRZ!c^QFjfU*T-A9EhEx?tbb$;fwHR*XCoGcIzq&~e!8Z3fV43Eu`
zCFY>&^VN8%q^8?J!16O<g2#Cf?O3*?sc7PBw`wynI0vo_xc7nhW$_AGccQX7G^=3r
z`gvOkn1u4gv!f+wi0(03$UVv_T^k-Y-<4%)0^_Yq8>$wRT9oIOeS%wc_XE79+Th%b
zh+#GA<nOOhV1F8$#Z!qtp*`Tv0`Lmv&icu6QT5kYh;P_%W|6(+*!RVTP<%L4^XdD9
z)WCX?#qL9s^w;S5(-=Y1?QZni67g)p+^0LWwnK#}>CQH*!y-U+7I?P128;<Qoe@Oq
z6~{WyW-Fgqu9eP<l;k)ifkh3snW{}E)HK`f&-$^b3#W0u$G=B(bwJ&wpwQSN^^I!V
zGV6-E^ALfJrO{jjO(+I^Wp&HU`0^T@`LMn$>RAq(*{f>K?UnmL-C2?OoMZx@^bUsK
zJN_+xr;J49%7`Z&%N!6*xig^Mn5{^qIgn+pO09h70xv&$KbI2^mHUoZ=6qs#0P*G;
zpa!)wtQz46BLH+CQ$HS4VF6Q|Q3UZ3{6&%cg-7wZ0l2E4=OYJQKla6=#KrbIbV|x1
zJK?VNMFx+OR|hJN&Cdz#z@S+YSlx4<d6&O)u*GKl<C|%`kBNc-0;KwP<1M8y7Omw?
z*~*Vfm6lFUwq@xZ>%Mj6lqivlJ|%AXIgxE>TDp=?QPi8$z`5e)09oCXmJ(6n54>E5
z=^VaQ*3QIW&d=H_0ByY>p*maHDg?_kEpfG62h6$A8y#Fx+^@AMjU%Lg_6@9*0R3d6
z+rI<r1zIoOF~x}Dc!gwxm3jpA`JY8!G65Ku^-(v60|SEYDy@VR^fy7f_8Qi%WgQfJ
z3P!qKvpfaR1IJ8nu*!A-i~6yhYL@4NqM0yI3aQAp{)9G~R3MIJv@`)UYrKF2+^x7q
zXa}RS1YMc<mj<O6VBl^Lnul#BBD4ehk+cT8^2`lN@9bTZpw(U<=Q3aa7PmDWz(b_q
z?vzKb-O}>zO;7Tx?{D`aQH8)_I~xpJb(+JYXqx*^VuuOpy&r-tOi_=)Zjr9xkMx1i
zTq0mzbBol--Fcbsr^#h|AT02R-a(_DGC&8r=ol)imyVb;P8i7)KZj7nl{P!B4AMbK
zC6D7UW>kw5`8p>lEPC<(ZS;zyT*nmmh_f1kH9-CLP5pyVo2HuyT=_W95h+li{-?AE
z$*Z0EYL-udVby{$B^)Dm>pS${km{oK9fI1UA!f}Tw5#`o9$w%ai9TN`(=yQa3bDKy
zz5t>8kRe^#cLv&Nmo7ag0yc0Y8@&w`KJ@n&)81cG9Ugw7UD4}2Ra=nsGNER8$v10Z
zW3m=n05w#ouc=j-Iu9If$nBw+4&?s8o6azo9@%gAf}bb-KA?NMz;=bw^gZL-t5K`(
z137z+Gp%2^ShiGzL^KiZ(i#GL(^2HZK*<<Be8LNk6Z_w`GeKl-9?%F9a~kHHMpY4R
zJ`*#<2@GY(Ejt5F!22E4Y@1~By)N*%vOKjCMPrWzmaa6?Kfd{oEdy^c)QcClqn`rG
zNQ(cWgh(?b_C}ik%-Ss$vj@wEyeQBs^?>m3=TqbsU^WTgY97neEH7N|k^vf4jHR-H
z{D^QsTNv2k6=kWqN&d27$v;-9sUwzSN?SyEIN}y5WJr=8j_a^{p)Z(@eU*#=(y%bN
zEn~or8t%zQ-TFkG9%pmS!Gd7lR!WR{OZsgFD`~SDK0+u5zL9=caZiW?)<og_TRu&Z
zp18}5ekZH-rYz|3OZxeW8*V~OgmRz3*g9Y$0%0wFwv~{PHOed17}aflQ_b6-CKX8P
z{^+7$Z&4F76mP{CiPa$9GT<-bEkh^7zDEqiTbWl6E-c=jTq?DuK&J(gW<sXdDOmBD
z4|Y|3^eP8pUQUbi*&#Uw>jJL4_Gbn(uoZAH)WHobnWSeYBc24xPIGLma!Qg3OX$Vq
z-7aD&wK<5K!_$5D&)jz(QR=N^#IOu#^PJa2q#g%Fr>d|B2*7LIb5km!4lgg;2|GF5
zChf}vV-N+&)vF^`fy+6SWCNnec-)i@U^dwpIP!qiKBzlcJcNK>ylHoBL(m^P5I6$8
zkE*6zc~ekfv<WcG{2TO1EPWM`l&`bQ2+C}ZhFn^PMo=4FAe-HPiuBpz;ceJPIwj9K
z9W=Q9`XMIu9cGZn{I#DUz#h}@hwEkpwXa6ebVq>5OY*+pB~lFp(pkm;FOd|@deLRM
z5`cz(8Vq!)SDobBPD+2~j`fFz`-FoVn+Mcg$N++CZ_crf<jS3U-<`)-f=$il#Y~E`
zW<&xcy*yzne``%4uxAT#YsEsMDMJ>od5(%l1UUDT?29nX`xSLtfz$2w`&i`%7`s1T
z9Zooy&XX9v*b1Rke4!(%974fxkRpbq{UeAi-+UG;r7BHzUb*Ni;Q&X}{)PFpC><;y
z*r0H$u-k6o;=0vD9NybaUnhgrT##P9#GwN`j^^4O6JUVImocXVY_a!?ytV7plcld*
znr^K+?LeU}YHwMWnOpe;*o^Muh@oG_;Da$PuK$*C2@}1|7=ysIoDU-evv)sc=fO&{
zT#?c~2k5|wV4S=m4$1wIM7i6Gk`!E~UP${ED=o3~*0VWgv}W;HKG#@gtFUM>_r^l#
z@&6%X;=6*T9qpU2ZW91D#25LpBnF9~;3FVoC}SAQ5TM5J)}^Tgta(XiH0t79^Th_!
zI&&S-)WDBUV8R`03m}}(2y^W7Rdn3-gN@qr<_(l<)7p7r(j11J@yA~i51j^bV!K^<
zktI_M%K0Kufy0c-$|QYVuS;&X$iSjpRhBFO&vHU2-EQs1n-NKl013$X>N1)B^^m%3
z0d=v*@M9thgS7SQ01kB2$Dh1--AAImj%ZjK-L4&Lx67+Hy+=D~XLiW&n;Ghzm}?(?
zpHoo$#rL|^X%we+476HwGyi=z*kMEs4A5qdWFEtz75dxk<{LksHnKNgfun)(N~;`y
zS0b*}dJSZg6#wTfVPHF2;OnX<wPk~7J?INhKTYyV@VNg{XD+A^$7i5uaYqVyz`?;2
zU6MG#aqQ$x_aGuci(ug<h$uH#C@F6a3vuiA(@T0(*fv&rU>t)jpN*}rUvQKkvC(U7
zpw~vkHa@_^U<D|j(ZpWl*<2NM>{=K_&R3HBvWRV(Dix}I#3k)vHZBtB=XF3Bro489
z>@%Vp>U5cTy`DtI^}Glb4}YVXQfDk0NxP2MEiadQ#%fY!_8M$I)>?^Z_V+mXq3O}W
zv0jBi-9UQXQRHH1MoqJEGkv-B=i}2P$=XM6+JB@o2kA<?=(gL6z6kkH-Q4!}eSsG6
zH~62_V)Xj2fN`qO&-^~`6DfJ-+hR#1xQlw}{e<9c#b8mvdKndyE@_qaBKG4sk_ATJ
z@0ET!<1+>X)p_mHKTT%*r@5-R4it%IT9IPP<teS(QsahK^#+$QKK-HMT%d^N`=Cm0
zA*6#IX5-c+S>ox8{vO`&j?8~iO*XrQoCW#{v}QhdPEQ^Gbhnvx3*4`7*9?t_9@7={
z#U@&J+3=TrGx8PW;g5C}VU1&4j?4Y+-IE;$;C2coGnhkJA1gB{=BuoS@bTGqC-a&`
zc1e!){wzC<(YZK#`^dI91}2lZg*vdmF59xKK-aR6>;!Cz6;7qj7JYLa|EJ(p@dl&a
ztG<y1DNO~PTqu}TJysotgmxsmHekloFI;Y>Ahi9`-ani&LYx+E<cq__wkE<Wmjh-L
zeX&gBZ*1P%2!VABPcP-3L(k#GSRwGB=l%XPANZf*v|um943A)qFeAnO`exLmih=80
zUj`U>kN-qU1(AZvFoPj=4SW;i%Wez#l=hDAjNV0LR6w4H>Eyr)>(#REGVNQ+uAWFZ
zK`HH~p<vRXr2RgP#^r|9V#P2{W{F-G6aR9DaSF(RTFj3GDx&c)QwW!X^~ju8IIVWK
z3Yqkr)(GXLLw-0Vm0Y9wvu-ljMpoQsI#DGyTx>HgJe2VkrIxfQQdh3z#hv=}*p6rn
z_Cc3d)yBA}_&;x51^!uRJ?`25-p6<r(-sT^60BwhPy=q@Z_jhb)wVBbecXKO-`C*7
zj>-mBLlLyRG_fHvkSfUxu!UbBf>{A1F7UAPS%S4aX^`iqBfCG-*Z(2j18K%RV^S-E
zSUJq<P5yPVbtX8*m0g4`?mt!F8HhKq^XLWd?t%M70Y2vA@x4mOhI!GgnL^Tqtv*q8
zfu>FA63@WM)swYj)7dz+Sfid;)LxT$g8_^3=~$bI5D@yq#L5jk#RqJV6-hhFTczrC
z9;E_n5Azt=q{p&pV6pL30JzBIDBoe9IyIv(S>1ASBH5+-Ag003g?HTkxai$*mck|@
z1`qQYSbvGu9;V%jMk2%W9{(fNbucPOF=5BofXShh8BYEjH`0Kpv+yj=Wt^Yh?Ax`#
zh1VU+EMK1j42pd}KKesPtbI$UyozD86;xa@+E<GgiC`=y)Wf-6^l<Zd2B|g#cJLYT
zEPs+NLHDc2iecZc?GEV#%FB<HHDQ*EY=fdT8_?<s!DNDdc2N?5y2U*d^R*SxNJTzw
zsom$TRqMR6`fC;CMMAhI6bIVjAYCCuP)K<$z+)-TPVE!gpu|h^*aI*#0bpm&cX!+n
ziw?HVM?Wv|fM)bs$R~uMmIz}oUYL=IqubX}VBPrL{Z{guo@mXsIP1ggsqL9&LIe4&
zx9{&L61Sc?9VgjL<lJ7jHBn6GoB8BMm;_dX8e8DdTHi74&hj_5H$lCe{fIH{7mH?o
zF`tud+#~GjiU<E3s~LidOT>ulXX{k0liE>%oYKb*KlsCi&a3z+F*1a#R!w?mNJcDE
z-x=nnQ`r=*8$=s-#*KA<mgO3;1Tg?S5x_K}`Rzj8*hVhu;Rxis-q(rsC#mQ^2QFAL
zh@`cYL-|=g!NlmwRf5^5-HCF|gYO<R_^OslH{^&;M0ZHDJ{XWq)EH=ba{0i2^9<9F
z)-;{+4hi(nxF|3|$vl80MyKfhE3pI|vWGCQ3@`QND~`uy@ENi(6(`1mDF{2T1bQfi
zgZR>$*up%r-{3!QQ$Dy^q3yG0zAd(=!`mm{r(2B!b{7%fxT}OU(x>pti6&KBwduj$
zow6HSY?T%pu{`FiDn;Tn(jx52>v8V`V^C%|=}vh``O3KQxv4pQvrt^~DV18qySBK}
zUhA*`Y&L>jEEQ95_GS*JDcxV5T8tPiyQq+kIgDyVi(kE70ZSIv2>*~QfY$XlB@4|~
zPb=)`py7zE#QxM`H-u~)MBRnDE~-D^p<5y9g5)XZqFSYn(g=2mPLZ!_0eQA@cZ3T_
zCmq!mtxcd=w7HN&N5?n=IV?br-E_fMT)BQC3VQ5D5imEhue!CbRNPYtCdwc}v3ODZ
z_So7I;d$B0ixDF{mn}C0oc;-BE_RKR!E|UV{Er`OljUVa!H8I=yC=}9$b7J*hE21O
zT~cQtx9X^doNV9?zjq9jZ*f^%a>rw}0pnQL&PQ-PKazKK*eY4phhrvE7cX3~Ae9xV
z9#li-T^lemNhA?hQ7k%QqenhcY+NK35N<Z{4aFST&5R2wE?nO)|Kk1jJa=1OqPo>X
z|2azguE+2s-d7U|<aJ;wU4_gSRI7GB;4#H{tbp%Z*WZ7a!B3tL(_fG@uMoy$cr6l3
zi`;;^QR%)2h3dCy8vHFV!<1<1=8GG$wVM%1?0!~x&NW~qWsfb>=Sf>jq5mS2!QXM)
zC}SO)-re4ww=6)gchEr09sgdP0AKb9o#*;n@r(Z5J%{t$H=gPJuc>_C0D~?Iz-*Ro
zcW7H^mIA|R#qAY46S{slb)<tSf}~*mS<FmpI1fAf18zVbGV04U(o;nf8e+~hJ@pXo
zUK6q=ooKS3Z&M-xlu&>#eQakei&&g(x3j#4w9Zw?`vWn>&f^ti@|C7PDq=^$zQ&P?
zU#3xJRl#S)I|GYH^rmMBc3`UM_Tx7h4&Q4O^BwCyzgtSVcU=kw@{D;d{Zl8`26n`W
zfOxkp@VCIahA_d#JW(kOcMoad@Uq|T3m}TW2jmD?+i;{Wcm;7J@G&m1OkrNYJLIVD
z6Arch2WPR$0+0ZW9}KNwIRGRtxVj^fMfbhNNrx_nAE5wJ&_0iCBQqEMB(#na><||e
zhy**=UWX!7tmA@ZlMv&*1r0bzOJw5%@c>#q6T}IcM*r1n4}?T4ma`|B@-CFXG%5R4
zsKJrhU{Gplz|d$U{&$uhBVt`$Iv#hR(4KMMFHaAuxVORNCJF#C+={k~!`=c-5q0Hg
zaXGYTpm-Ild2OuRXj_38;)+MjDo;h8`{Qtsta300s=JKo$i}e3+ls>=HSZ;){@?m(
zk0)<)nb%k67RT0rt1Vtsj^v_gZ?(4nD3cXTcbd*FR*VNLJtNr+&Bg82YM(gQ?v}i3
z388D7E@iV`9VW}bEuvWaktk>(O*Cs4(>8XQThv8(l#2CeSSDmTi>YH%tVRUr@e_n5
z3CuV4C!nh=FuJhHJ~m&kVALV4sc$`d#FdcN7Fj8}HPdW3Vznz3kTW(s459|??8C-j
z*D``2cylUV)5iq+oWK-s2G*BZ3U7uAbZu_#f6U>B*cIO_29|knRR~|Rr`^G=oW)p~
zzYk0MQU&;HMkdkUL`)5$w)!s^MC&fZ!q7|a^!Q)FEGFdR1hhNjCGF0bd}vbvXm^eh
zU&v9zO9HzNATh8)DDb}TSW|c-6N2;kX^FW_u6SwO)a4vsE%P}TkJp-QVR^RLm(lmp
zZ667(h{B%0ll~r!5~rXXXBAQ4lv1nc#dR=jBkb`P{YoG6nAqFlqDsSXHGsjf2WiBj
zhSpCEm1#v#JHS09mTQ(JK(zZo8;BQ3GvG*~*??qG$!8vh5N=|C|1+76BXG@OY~t5m
z!O<MBq*7SG7n6wR?0|375v)rI10%pRfPO7#PgRrYPEq9>Dz)%5#^oWl{5nltdZI2b
z46X|DqcaT$OI5<r)a@H2_;zL$AQNN_u(?4~e%r_@0I~pg%ijiBaB&*xg|!hd#feq_
zi%;}k(<6wj)=pVS#erkIFqPu#UHXUgUTm-1DoP*Nm|#FA4L4E9R5&e2co^{`IC)E7
zc1m1*om+Kgq)5H7{eI-Zw=bIziv?wyP(`yw|JCjaMUGk(g-+VMdAej$RE44=O-<4f
z=eRX-*i|gD8HL9Cc=om-6=w~t#fv7W(1h{*28jYHNFCMhS`ZkqWVs#7v5SC#o87W9
zT*NnAY-$u5lF3?xb$U`7AmVn_C9my#Mp{H0T(Ur?A0Qq_I$6DJHpMcL707+Mb_eWp
zf>Ik;Sio2hW_@MZtqnB134gj=Rl_P6L)|N@ULqz0i-as4n?31WT{b4mx8|aATjtfX
z?o_rtRqe?H!<fBkZ{m6@i`>#wOJe<@B@JismD^W>KMS3o-@WUJ@9mm@^PZ$63NkC*
zSc1*?BF4v8SA+@JZfS&Oeee#_@<Nr#4|@9a<<8E7hr7M;8pzjgbn?A@tMyPp_&j}*
z$DxM<CnI%YEo$wkV|&BMrcc>a-erkHOl;pVHO|T8t+ayD?%nxngTwQ-?Vh+zt)C`i
z8H8h!`_w(or+dm(i^%r9Ra=;tjAnW-qHoz-eF7tnSS@(CJ4Ah1Z;}&4Pt>=@k4>>!
zzT8J}t2^fyDKWl1=X!n);QlRd4htj?ny)uG9(~nl?!>~J(_IQdfv)(d!Uc<Y+eGf_
z4c_J2E-o`bN8WDVz1J^=V}*d|DVsfa+AmrA_8mD+t&m9$A5C(Z!QfqnTw^+#y%)4a
zT$V8{b)BesgA!#;h*$Bi{Q9}~=xPL-r*=}81jW^^FAp)mUL^Ph0bbywLvOZ{R<i6w
zv+!Q<r|Lks&U@uLedHCOdl(38?X8wcj*VaqBaO|iS0|3M#Tseek@v?tc63Z$sG0RT
zEyo&rhRk(9d%76lBK{!n<l)?o=aIEvbgv?6nJB$(zZCm!Z+BSs(cZFnbk%7?{<zqC
zS_5juoigqFc`t0HNlKLa%hMMoOyN~6cH=3dIky)03Qbhwv@2EXS4)^aA+44xdqhNv
z01U!Vk4=p_Gmn>|LxqWM9!g=OGl~$ca<JWbD@`_9pqYQL-__MXvsk$<vP*rl7X5ys
zL@L-9C~R|H=QT~&V=cL8i*hhDAK%qQdaKl6n#6W-iiNV)<v;_=YWWBFT<JAyWu{g*
zxO*}yjdIk&r+J~J+dAD-#0_{==x4pGWivqr9wwquF(Rf_MJ+EqVqd|VwS#TBk02tD
z05t$Q#gG3(r-<{wEyjQ;-KGfhDGs%B4Bhhf6Pwd;H{AQTuEE{A0{htrxH4CNmd8K$
z3ZA$2yIF%IbcXS+8S^;6*;mEf#m9CvLb~bAvj_05SHKSq9FYD)d}qMW5!dc2!{DPr
z1%2lE1nNS&Z5N~IJM!MLM(^DQR*22LAHG^`tJPW6YPDWH^8%6k7z^BcuwFka^SO>J
zjIEx0ki+`qmEwAFO$Rm^>qO6iTnU-jbgb`;;efL+xZa7*cv*%O2!HJBqc6fVbOg-v
zyrJ8r(iHMudsy?FeT^-%HZ^_%wnw`1Eys$|>Xc)+iY~4%riLfno=y?YCSRL7LCwpQ
zuNIzuO<{C=m|rgEJzcy$7_+xBG+TBzTvaYM4wJnhKQ=V5LTtH1rh0sgY}JEvJbr77
zn;`^5$F~GWPebm-z2^{NMM<!E@Ye9lH7~5NlZpflV5G%JfUcidP5_s3RTR2<RCY0#
zW@dV9(oU!#Yf$w`Hg=gQ^cjqs;xJJPrFGN!&djmzNM&StRMKt_KiYnsdtG{juQ6Tp
zgwoC9G|6Z5DT>enYuYrizqI~hOdZMDTj)_kKks6AUvmedDPxd*koOxjcs%v~@cF&M
zUDlh7S&gjIluxf*kGY*@KMqG&x;=<bfPI}d6~2)*AsmX`drVhV8sgK?n=@6+Q2emz
z0`v3pjXdp#w)hzh_biI(bV98u3cYPL%pXx09PcWft|>E`oWNIiE6=I2p7%YlurU9k
za6>uEqkUH?UoUjErMgClTEW4I4Ws$JV!r<Nk>$#uq`W8U&A!MUw4q`;h9IAtvFv+E
z%BJbMddD-;$UWyydwB_9)73SkY#aLe2r3Tv$o`2DQ$ybU(Xrkw!Dm{X6euN5$8u4u
z`i#bdU#KN#M$}0O50&%!D&xJfw^sLd7k*C46f}f}wS!fI#4kcVu@$J%pSa{1A3s|9
zQK0&Q8VqB6d_wgzN}`PGHq^rU2ys^Z#9ZN>@*w6h)r$aY`2=8V`Rt+l>}aSyY0&Jn
zjVxtoaJI1w@F|E`_0ln7%N0fKD+?mtMa{58AS^9Kstf`DfTpdYxV~bL;(PC2*BkQt
zJR+Yocoqq4US9t+{Yhw=^)fZyQ@t7?@!ZD9ij6@}Aw00b4jdaR%1fZ33z(+{K6O%n
ze<h9*7Wj+@922-%`}$X39!c7ucsrdN_Bu6|<Z352#qN}H9gisVQn!_8O|>aq-VBJn
zUp$O9?GL7XYdXBcv^sc580&I&!*Y{9ylcWVM`S)uS(1IeNiv{E@Z4UVJ&v%e`ECIn
z@0BZ@6~fP-$_$PzjE^iFY))f)de18q{_GnJfJ2v`6&D{bGuC7`d*xy-sWc)kU><1M
zzoM%@v{j$8WwX-dZc<)UWsC)O3hP<^crTl7GR8s1b57f?PCK%r0xs35&y>|p!6=CR
zsVn7DkL&`}nGa`M^U-PMvv*_5))ZW3noy3Wd?fUnyX|(`8xZ|B)vm?(&HxrQ=@Hes
zr4{;jt;v(n;(=G-53qhb;K_e_DqyJ*>a%#twBF^3SE+072sSh2J)xL^4ifJFjDyr*
z2@2;fVib#Gj28DhEpou&vS-vGsE&tr;h^a#&TFMH8y>6|sdq)>)#^=DRqFI@=D&DI
z(evpkUwVz=P#B$;x4O&ed!^zsjy$ZU31T0$5>@@vHGz^Zd$syEcJ^?hd*Zkj{WQ!4
zwE-EdnR4Etx-MZd_jR?<yi(|uE|Co<FXa^hbBq`Eby`7m${w~UJNv_iXV1ADc9NlG
zx0WMTZQ*wDKhjd;KLPiE)tFqdTX3MtjGg1cx38tD%&7+`2%DPd)-)W1rK;sK?C8zG
z`e_q$&<WiCKjZ|MgM9iV-g{N33~d#=Q^?)G<4i)%Ru0$2(v>IE92PO5kqcJ)y6}F6
zpw&3<&WfvZzz<n@Rb7nWH1sW7mlmJM2k!P%N*hW>R>PF7wM^Byk8!vioASqv-}h`r
zF=h%1`k%}(8^5UV4OC%V8Z9DT9W5nHu2lT49WI-i>fuk9NgwhZlnFN+<m*s&bGQ@P
zHF3)UIf>oMBxKcm_{~(K$V~)C*Q(RbhC+)$rjSD({aOzz#*N8wYkdSO0Fx89JF>N&
zP(Y3w4T8yudGPFsK_XXvjpEgars9qxH2P&`9uaYy!Kwuwx^qw+8Qk7Bmwbb9<$au;
zvMQ6W=i!_^ykWXOyN5?@hTOLEa+=1|XQBQYL@Wad;ZmwhEAJx*iX+e*h$Dt^*~PV|
zbZ;}RkgCogd0(-_exQ$i3xaFl=d;L_ZLbCYY--(`h|BcdtP%hjkY3G*vjOZYBYhh3
zUAQ)~8hWV(Qm7z3_krMDmcUk4)@w#O9sAY}?#4H-Qn@+e)Lb;*YsRR$`s&mCaBgTL
z+iCGm_EKG}u8qSM30Jc(H9i5G&mS_7?&bSUW~tDc-groJ#?cyr!_Fk(5NcD9^fcSm
zM285Cq6$rI$a!~(MSt{NppL2-nS<qqS%%{D3%*iCad3-^stt1jMQ+7#mvcwV{9?2p
z7J|0Ie*pnk`c78|Y~a26n#QUCOYs6sCnpo|dzTrI4<p*MlFo9ikbCi)O`ZpX4o%t%
zH5L7{L=3CASoA=^=|KYuU+GW>1R+34!^mhe2P-;7>g8<kXn(%pI|dC%cSyP>qW0@s
z6hW!@l1ks0;w>FeA<E-XpsnL~ra`wlL=orlE?TgW)VB+|M|HO=&p}5`32^xfktKby
zwYCwaIi6p_meMr!ShEb6)=T^`9}&qcq6?T?;MkLaf1nm&XY6B_C;v8mHDOwY#5s(&
z_QcX+DI_6=U3Y`DxH+O+2X8iK$n-wSD)|EI@U&0CC605$hkwP5a$Os{Rsuluc*{U6
zP;o@B%W$o`26Bp$KUH4^wMawomeob+az^<{fA;Q&5H*6+bOWd0e5`J@dB!VK?O`hp
zYLQ3TLG&m&s{6!<&V>OZJDUgKDzQ30$M@~7&CPX7OH@kZ&1H9N&ChB^Xgcg7Uo;@R
zmCIFQ!&y9DKR1+JEvxv#M$hI(%Rk<8P(1Uwu%z90Cf@l-vL$1qMrbID|61ep2iaM)
z4s{IW%F2kxfK#Da^rkStY{_CIGt2=aEUwbaIDHL9B^$DPC03dKy`P*3)2Z<e?0B*j
zHc_)DzJygB>hQIFI90AteSc@j(ynNtr)WS;VnF4zaq#>$Klb)*2D_0xvBmj#WY&hV
z+fN*`IV~6PPwhA4*$Yk-Js4>^VxNkHbuffPu7YjpeoN!yT`za*!_Nha4EmWvz<TpB
zm2j<GE01fMjVxDHwuMV@pt+j74|UUbbG{=HnJ8>+dw3j1vTMJCmiFa(f{Q@6yRTyI
zJ?pH<&cSS`b+q7mS0p2d!&j>zn`u{V)%yiM;YB0ZKe5~;lAeRPSJP&w+~!k>Dr$_3
zlS;o?a2<0lHM)z|Md#S}p`b}I@&_|2OYF(-_33UGAdr{$I&C~WJR{OH7M$K7OQ8?~
zz;^T(@rg^H@ToiupuR89-S1ogdc50a7%nv+kQyp~B$D*pKvP)|+Mkx-{xnJG!P?M#
zoid_?zL?(T%}7^pW;OE@TAbmV$}-HLq$`b0{P?`5wFy-WWFGrYW{*tshQjwUDZaY_
zZs2xX-lLOk2}LB`VgeKM*BVVmqe&*_lEWi90$ZTnkqUNL7ol@U#^R3P_KIv<RVx{n
z3ShTd(T5)@Iwl=1(`M+)unJ88F0^Y%E4KKbx+7x6OJsLh%4>!g7b6w@8`gmlv%7|$
zrVFenz>%QgIL2NYn3qgH_hB{}<vqQLo{Q{%%MAXB5fK`X{boOpe0|$b8%!nd<(G}(
zR0!HS96;+&=uVbkknuxjdsj!k)=UFcwC9@90K<pfgp5f1MBJOR-zsnp-C`vDR!}#m
z)6UFa?Rv<j+q?T*W1Fvg+D|p{JTpJXXMJvUEcnUZuBl)C?9?FzRqXWg8yS)T*;?|*
z=>`rSrv(5kRR#10{l)FAU=4Opk4Q>!H-!09GUzIu7eN|+0i|IHiB#)s%f2r-_p6s_
zY34`~aJCtWTHz5#ehB9xVTuPths$;4q1o%*{ncngK@5lUF7^r|_8!Xfa{wE^!o$!#
z+W<U4fB|U4(s1Fh@t~x=L-bAi<aTtRW8IfcnW80afA=#8Z6xv?u{Si|WX*1)+M1bl
z65zvKr-|-n6wlJ*a#^FGW3UL*uY3~2;zB~Dv;tU0(Vw5EhRA5TfDrw~=yCaQw)Wd3
zZ=RD$a(k^VX<_1q_LGy7!KI(Oe(&|yA~BlLsGI{0`o9KImnKC$&h)))S@Tuja@;Ny
zVKuBepH+vx@`J(28M22tdNU&HmuWXwa!u<pRk^+ix>D)%twUL(@=BL;Zm5=eE&E1?
zE7U7z&8_ZCoxy#q0qvcEedn#=o*Cf+>9X!@2g9Su##OReueTyJr7<2{Ow4&$=M<v5
zRLW!g+iH&WFOdjK;RK1Szs?1lXh15V!t*JsQ}b6-a}Hg#@C9%@Z&aDuB&4_rO)6Ro
zg8bh3YYT7IJ+0-$4lY>8n5=Vry*_u^%<4Eotz0U~$$~p~?5+Ss?3tdhtQ_ds6f(Q%
zxJNcAROJ!3gF`w$*yV9j3<)hLggubJW^AjaW4p^3BT5)yyugay!FuPiS9>0LW$wNt
zt}0gtB4)p4%o{LAc(nsc!QTpW=kuOEXNB4U|2NNQVC{eb)DCFS2k~qk^vIlUVfyot
zX`Wb#N<DdXw7tFP%OFmjFQ1n2%I4cQwVhoS^@l5|<&#=r>KAR=2g{yv0~Y&Uq712e
zd${`j@ncdy43<$@@ywqB`;4h`?MlkBJyoX;>Bi+GVY?>eZN4)i>QNFvlS%-rC%RND
z>zlVx69eD6Ul|kyfx8&n(`|Ck$fDkZ?2E>M3!g@>lRBdP@U+O@g(SY#>waUpLqKt{
z&hpGb&4|uGa1C8_^|`<Oyd}9x%${>b;0ZjFzV)s4h~keeA#AlDZQ7%3^mfpf@fOif
znrJg*3yS|Q_TD<G>TYWrHjq$4LApdh6r{URq)Vi`L8QAuLEuKZyQEvXLy+$7?v}32
z=35)|_B_us-uFB2Ip-VW`{NyB4+gT``?vRRtvTm4uX(LGle-l*uOynhc}0s2sF|;`
z>qkC>`DdvrIKRTDT0KGL#tLT_Jj9IPf3tF0atBCUT~hMIvt=;Ub9NYt6m329Z7yH5
z_0+hv!132hSDN>8bxD(Tl-_Y!^wFWUF1-ZmO@Ga@<V8)k#pl1XH$7PP=3srq#`<0{
z(4s{Nmc3!XvbWxZ_*VEw^G`mq3$V2y)xrUu<WuH##B3He)wgEEm(d#Oboj=IbU?dm
zH1H$Z`gnYGBE2SKFYjfmOOlYrd8dYH8P|vx%I5pIrdsMvcB(2nry%I@s0y`=Dah)M
zwr86Foh2Z-`^nlR9-lhaJfS>#&kB~AuX-Amy#Jmf3x?D4^J2Y><6lS|7t0lVDNiox
zx;<VUJ7M=;Pztp>?L(wmu&MxE2)?;y>)qR!Eyifm<d~NxgH?>f1$N~o<rES<X{@u#
zdiXjDN~yw+VveV{CW-MMT~U<QT+wjYuO+Ebu2;dV&i%AjV)NZ7P3`(htSRf#qnvP7
zL;2pf5o3>BG}zq8_4F{s9yeco!5kWO2^RuAR2csMuzH$8PcoDxHq^Qu?h#fKm~OV@
z_NGi7X;hhj)*E!>AJ0C&z<TWU7x1EAzrR)h*5*u}1df0va9?ob3KKm6aQ4n;fBu{B
z`uHIX2>~Fle@=ZXxMXiJa5BrOx6B%Hx|jMcp<7ETAWe+6c8Wo%@rMEK+}E#4gYrWa
z(hoYZK=UX6#0<S#I?dgz(^!npRuuKQ9y1D*y?4matBt)+Q49sj3-Mm5*rjJ_db!c*
z^104F;B<z#6bd0fV4tS@K&Hq&l+Q22ucU2o+(j;1b!g}_eL5Q%N&R))DuI-7x<S~K
z&l6-9vN*-u)(Sqs&K;@avdN9(5!2A4QH@MJDyNi6y~Wfou~1too6U30cOn}re$g^(
z;g~I$buuYSqWAIJ0|5jEl&XKc5sO50*m(-JR3MQkvGb{^=)MY6JrYc!)q5@lakFi~
z)iXRlcz|pJ+fr||VaylSuc)a$N{f(Pb%t7e`wCy^mp{bc{qF`=^+9pi`3~Aa=x}R!
zUP?f+7SE;b>u11~R@}JK9QFS<R~nUQB^l2UCbNnR{lS83HM*5D#e8A%^zFSnPeA1i
zeRLt|LebE0BU0FX=WYNt${i$>)#f^3+#flD<Cc3(d`++VMiz1Uz7Z|@6$6Vke|EFv
zoPj7$8(-bB`eN>f;fMqaw9=#?a<*HORt{1Q`&di^c(O54%S^~_NhbZ{e6)SaL@!?~
z1H)v}I@!@~N^ktIdY7f&!=*}j#7bT<8a*_S1bL+K{q{1se6w23&(g5)hEOYIT#`^7
z-Ez<tv$UYb3m%0aCS>E2I^p}yk#4Vjv21n0CU1Y%FrRSm$&%_wP_9BFt^9;+TY&@u
zm-t~bJFQH6NZQN0tk+2Aup~D!kL~i1;YE%ew&?|cI{l2HmJhHqO3n1hu-nrm6Zn1D
zUq7uJzQSK@<&gr-d=n9UuP!0JQfofR9@<p7fV;ef(I5X=zRYYAeGRu!nCSUV7kgB`
z2CA&h0ipg~*X_-0E!U8JT+o6tA>5eE`lZ+x3RJw6`KUMn1(ci^sW~mzqVv--7(3RL
zktp7ln&NfOPL89+fYWvO*GuVXBMiv#kqA3O7JNLs9N3;2fU^UJaK$Ku2Ue16QM|=2
zEni6eHIxej1*s81E$~r8DO;%ET^AAWTTF4N%q8t)clykq`NN;zx$`6`1V%R7ALm*Q
zSr|(KjAK6VhUNy#D!~{`ah4Ff%@}^x%WW1RvWw&0wESu1LC_MAKxYtz?F#bXz41<Q
zS$8Z`wMTOsk9h-zwcNH5b>LBfTVC>`6r$qX)qF+3U*>(k@WjsOABgnJ8L8Ul&r??D
zpYu*EG8xI1AU!`@y<0|K6mAQMF`b<Uooit-qId(*7T7LWE>f;8SC?*C3X-k%kL1au
zo_Uy<-k}TO#IUJy%~L!>mq?@^XAge!!`*=@%YJVmBKQ}3U6^Ypqh$cJZdy83^?C^W
z9D8@MsdwvrQHeMd-<s;V?oJkPnw%fw<Fr2z7I5-_fmHP0AT=%fzkt+t;n}gfbof6z
z#s4kiQ!rBu&t|QNBF>a(vFT*(uhPRuI?%=!Hk4n_USzUxFoj2P5{wD~lS^JLINi4H
z3dG@9G5F&5<e|--3M?U)&na%MeddR)Y#RoMDBzzKuE3OvexaN3N3T`WF&g5Y4hkV&
z!ZOlN@6mx<)y)pB(eWm-p3FNUMA(hga7_m!RtAiX@;k!&2EtrexLg-QH(<!tYENd%
zz`nPKj#tX&Pen(})7I8}T&bb!E=s7@{_Xb+%bVrtxA*usI~}9H2obr4K;LeD=<I_)
znub7L+38r0DJi&bs;14WZ63NOg#6>f$wKQLblSo%=Z$AnGEDS)(HZNBX7!KIKqH`6
z58N)F+#;=H9B%a5Y^1&pwZyHRTL{lX4osm?&W-rN7nRSqw;NY&0MGpaBs*M*r*0ph
zQwrLn=`Z=AX|&xL*y?fWZ%69X6tbNz;_qE(FE;dEWZA^F>@nm5*NriLjc~3t5r802
ztCvmt4<MXr0BeVMNLMh9od@!U<yzPG_a{&jw`*YOBnn6;tKm3q5)A>thktS0R`pHc
zY3%3aeb08TLvY0S*$e!WjTcy#5-foPy>qq@NoWR<G$n)ANk2njA(4*>mOwH9Zb1GW
zCRH{^Eo!s8{PsW|CL!Cm*%x7H&}byawK%Ju;;v>b^jz6O27mmExMlh`&8JAD>+!>8
z6D{WQEJhPCc&r~xV~ap2Eddn&Bu-8Tj73nmMf)x_Qx5TRa}n+Rk2Vs3O{oA?+}K8o
zeCer?lHlsj16ixJ-_w9PV{rEsCz33I8Lrl5gQ5D8(tsMfjb<AKbDGFQh64Mv2RtdQ
zM7z6jZ6vRA-_XdDl{@9BVXFi~`gv?g25ex)yi`a+x_+WC#IQ73Y{y!<+n1YUd|q<T
zS}?i@ESJtrDWv_%Lz9d($!807)OmpV`W%_Ba815O_Pc9$31tn)$6KLzk@$#pW?89S
z@O5iZs{KNe7EwUE63Fec&)|qwC~^YLRABjo^LhJcagGm)<_c*#&Si@V+)M;r{KG}z
zoj(xJ4v<_?eEq66#)xBjl=jAZqJt+9-;Yt#@9y;#+Ie|0^0j*UXoB3X!RJ<fv*hQu
ziR*Al^WwxLhrK?xn6};^9sz@^dI-a(Ctqx&6%TtcK-D#nzULt<9b^cG(Q<=+OA<RK
zA`6LwV!3aryE?%zZ_E37Id;nAmp^<k=yfhGORQD{N&?qQ7|MlTb{&8UT+lK76bsjO
z$)MqgUvpV^-RXjiqw^XcY{AM*s@~Re?i6JQM4~y8d5;um7~wCb53~!@SV|D^#`kcS
ze<j(TD5WP|3kntN1C(fTCryrN=GAE^+WXVLNbc!@nWsq&UTAQjg675Hw1Q5lcFxq<
z0H%q(1^f*4rXJOY(YgqD6#GUN=i$wQzT#eqZ~nn~)(jyEIkxw>&)%4dR@oB949wIz
zt#vU{^%cvg(+&AvH37~%7L^FXtPaZorF89JIpA%W?BY5H{OvC5Ev$#>cty_qD)wl4
zMOn}}BFLLD5Ks=x#e2Tyc*%8B{G{Vma&eyI*ucSC8I*daI{*sf)s%#b#f0@6$yzw=
zXL6X%f`m4zwOVr7Gjj`kS_LX~J|onV!XVQKR1-oukg<*gCHGdbXLuYD$)9n6*V6^A
zl47vI76*y1NsEB_kUbiNJMp`dVC6V|WfnH_Y9&2{R$t!xQ}n>YR<7~&N6^ttL~y@)
z$M`k%uF)zR9AKUWxt(kfhs3El<g$mdm_RX{@?Gj*dc<}&rBp2?GX)ZzH&ew1*rmJg
z>p3c>=?C&+85~gM*r+DUD(Ms-q?E=g*dDVp87}zY$ZQU`H3z~o8TB_vD7Px&lAck!
z6^H>@2E!7E<q|A+6RI(uhbUyhN~`BHXtwFyu~#y0;Yl5C-#0$x162ltOdZRNcgqJk
zWALaxdBO?UD$!G&Mu&r;SsnMV$J3+eEFRZh_V60(=u&|K?$f|%AJ_JQv%`g{b=~y%
zUFZch_vzb6cbW!a^^Z>n@L`-<(66d$m1~yhaJO9)%IPdy)rY9WRA<2{`^f)>E&An}
zvR5!bC#77TIun?X;b5Htg8|Si-_^nc_QnG=j{4~QmLS>pc~Sy6BvrjV(*4;Bd4B-r
zjhAe>c!9|Cck;df?l(G|IkjX^!|XTok6uk2mTPwIV2z%9s)tz@hVYcZWHm0ZuhBa_
zyxahbq_(2uffs>C4J-lF{SvI2D@-k)ZtDmu_?TKx7TFZbWYQk-6A`{*cD+KFoVqSK
zKl3Z`f1&yU*-3_?p062<_EFUvOFU>~a$H}&=fzMRPnDl3(j8ltZq=J3-0X`<p=Euw
zmU3b^15vW=ez&134h71)ukt2%p>*e+bqVq3Pve!KFDHMVjMng1>Le8TTd2Iy0ZbUq
zH_e%j$Hn&bQ0`1c<GA|;$3|sEpxA6G1ixpB7!~~~bP@~@Lfsfj)3Xd7Fu}a+Ugr+V
zFR)74cJL+sYppMfoscbPh8r|z=ajj0w3{U2m$hAY<ONm76rDKnkD&4aNu-3DNw}I!
zpSx^%D^3jl*c)7*vZ8vX(ElrH(|{6u%`JgcR+tr%{GVH)W{k-HGMj(TR*OGxD)iNO
znPKl)lvD*d1$IG7fSj6lvKG5Ul|L|8Q(TMIMWTDG(oX>?_ksal>`8_sZbz1tU=l*N
zT5+J|C>$d(%Ha<(G%uq<vge=mUfzDsrsEAy7)o{vMa=y*4hVNkNOL?YOWrsXYm6W<
zbcXjk1Umsd(qa4zXqL;WayGt|3i2qyON7Hzv#a9%T#lgYQeH)2FFTP~uIa@X#@#jG
zUjqsw6{_8d2)VfQpI*hA<g#6*cW(|B>Ij)EqK6Z59wtqi<|U3XLonfGw4QbK_Ogae
zZvQnrCdFM^qK3FVTOUZYH5mS*W8JnuM)HM7ilAgFtU!c~#W|`olzjvmE%&{eWGfG6
z0D;X)^Qv_{J13tp)on8|C-Z&(%kxctH`Xv(b%scAWX|wf7jc)f3zj?9#<_oi>MO9t
zKI3Ne{ei|mR%_dm@59a>uc~2WS}|`nbnyvlo3&^I656yK?nxMZ*oM<C)|x+BtWQH9
zcLC_1^_lde_wx|U!u_xJyfJuh4Wug7y1Nv@BC^oG?0^6FE041X+H^rCBziKhSDc<g
zQl1EqK6ooBk?PN;QiKCz)u`6S0#G*^`JN=tCtWC8q{f8nxbsLAFU~6)3*OVydU^}R
z+pwfhfe{o$a52LGwpkOtbuw;EU=znk0hXH0@G15+bNBHj(6j`80CNi5Dx)2b*Ea1Z
z8X+u8d(aZCCXQA`*4x^iR=CA>mOX$^mky`IrofIi-JPtD)bDnTkgvZ0j4IuFsp+tf
zX$7<ZJ|)r6Jl9;pSZ}94gvv_8Zu@AcyjL?vcF$7F7F%3TqsU97uxb~aQ(Irw^MzIF
zU#y$et+Sw0okqM=qD;#-|4s!427omFKDN_LBy)&DzB7qGt_fEi-Mj%NmEdwm1nru4
z-&@}ZyAZ{2?z4NO4h$&9VEl_#*RdsP_W8wWkhFC(CNp6*jcdii5v%-<e0CW^w{IyM
z&5`eV6I=-0kV!2-(Y-ynV5C4|%MnTi{0IW><)Lo2<#z$E#XQH$@GxTBv$-a__4R&!
z6pL#<!1kICc=$U(@eHdW+^^SNS{^dejr@yM;nMT59P6wW%g?VwFv;0ioFH9V#a>S@
zF32E0L_WeRO9@qv&&QKzPW)*2j60sA6vmZ*3#Dw7D@gHbM$EeATI+d}{si6J4Gurx
z!q0(N4H^{I`^D+;Z@%HLPFavT{v`D<viR9$@kaelA04ff?t=tC_HbDdJOWiOMwmhC
z2Rv}ZBmxfnvq5g33@n@c3mvw~qNHbu&{G3PI)k7vpNWD(mBM}U7#^LXoWqPnb+3e2
z4%RYvdy6bvZ|xjIw~KAT322i%I+X=Bt$bV$X92ogwye_ml;?|D7jOOa7UN<`F3uwX
zSXoJ5&a3D`Wm=*ha_*blWopo|#4bCZYg`@V&Y?9hTeMtHcAgL}=O^0ix3~}|7RHwL
zq{Wn!_sV=K&O~3Z+=xPk!iWsJGM$%~w~WDzeX=B$#YMv9;zZa7bb-5vbpIt{$@`gz
zjcJQWfjkF`!Z9>FT|K>Mg%;6fGy=%+q*=t#RSw%LAal(K<UN~n6F^nb+AssvF{ZQV
z@qtm5LXMO3sCB2!vfcIit4k?}#`-`;zbCf3IQ9?maqJ(inqRe>4+s%23mi8`cC!o$
zj<2XR$G|j&(X0b($8RT3njU%5+%M>xS^Q*MVls)vPvEx%PY^sk4=UF8;BG3`qel;3
zWSiDC88=+DfOridTV`Bnss0^!f3fDizc;}@1HAq}+yj-0>q@z&x%=T@V(($O?Y5C&
z-$#l&>s5;6V3I>wiB2opK&wj09J7jt;nV&#dZ`w94vqLR8;DAlwq6G~+GvVwhkX3-
ziC=&eiqmK4ZgC*DZlUQ$i}1|SOavKpyjC#4F^=ba^x_2x=!W~`)u(%(h^C3Y)<ci5
ze3h?!73wdr{PB5TpYv&Lnk@=;XDJPi46L?dMkOXnHKx`YjY{T+?Qwwt?~iIUXTFS~
zB|>`kPr<SKuRs)%G1MfS;7%5D4+f&l{{~Sc0{<k4qU$F6U*{^wr0n(C?!CV~?y=A;
z$A>ZEkbNbKz}LT+qWc!nqPOr+U3JZ=Q4`n$+Qe?*tt|T(f5-Uf<zWy&3Mh2lXSb&e
zI=d`h6*Te#+U=(wrsMr<+U+Tz-9Xcm%P&hvgf=&#BUkOw@_LMC0bk2!&%ARWo)TX2
z{u=fcc+@V2pX5pn9sKbW22ui%#gzI-nAo}-S2MWz3+l>Vc8~OQPk|5>_WYHVh9VZ{
z?ALT3Pw5h+2UdiDGyQ_>`3$a6zYA5x?cRRGNofiI*4nRU6Q33qITXwgu6q-g7ZWG_
zWQL9vrVLexs0}V2x+d{Xn>WphZ@!tYIb$^JU#NU>1Y0>D-P^F7kl;oT19C!P>3=dO
z6lZMTSezUIevU5Dm4PG_6#A#+)^QTIPvy{1nuL1_vga6q3_xyFtIOxIALsy%y;Gg#
zr&5A`L0`b90DS5}jH~K<7QH(3f}h={XHLpEl-{nJr$Y^+Yn3wA^m&%MSGZ>DD_oFm
z_|XO52fl9z&ODKNsL8v>;1-B*44M!7?!kOtUl7O+K?}q~|E1Tq3^{TcR8ocLXRw4F
z@GiFTjfVFo-ZTmkZ;D+(Pq1N{4c1v}e4FhMQo`M5=F2&>gC*;sQ%n|wn=QgLA!tq?
zUaC2^FQ>OUoYcAvjDhiXn*b&?yT8V`qs6H2omY>v1X@O<RF$)eZ=D}2M70rb4EmQD
zPj7Y7gH<ao?oDp*?PAz&h1Hb|58%npRZc+|(|X!J1(U#}-TluxlzB~LG(D<FA2gyB
z3<w?;uFX(k_9h(@GRg)2lhfP^q3^w_tw!{`0=lvyU}Gon<TpdQFgR9vjS~wOgx%_p
zb=_o-O8dT@)AOO#JOV<`J$@sQ>8(9%a4B2!Bky^G0&et>d8;(6sK;jq2uos|_FABk
zM7^?~MhP2qdZMSNSJ-YjTgN@*Hh1?r|F#SuV)n_FtsE=MqkA|rSwiF!ZanCq<}z$k
zctG?<yV*1#lCGyWjyW6%4|XF}NF9E$l?>bRk@+Ws0r9*sBcNjO<=)>LJv4YU(}J8E
zr&>SJc4ED~8JzWTJ%6+uKqv?j3GGfLwqSf9?&H+kC&)IJx1DE#RTTR_eyV-fA#mGo
zDP8fYLK_gXJb=HEBq!PjC6<%&1~Fy_yI6)~pTDa6CmG1}Xx*bdlT9FRiIU=t4iW*f
z%AIU$zg}BNwzroS*{Xuv&tLa{<p*>Ps4g$~-|<lGNVoke(UQ=}fW7=Z5E-@z$vUp-
zwz$b!oE(`C?gHG7obs6m_!qcW0K~Z``RTyQt&c&uH4Yz!;y{~m&<xjaX$EX@a#$>{
zvU3T7@e5xbzX&Na4<O<eH5#emU!(~5ia{Zn8lUmnbL;eeiNKe~rCs!9P;uoF`+U7x
zaZkEnG(5Vn{EDyX;uU&bWhN?X{jKNyV4&1X9X6^dy!Pfojkp7b@Rv#*eg28A6R*H1
zZ>BJESmRER=iC1BJKbZmqhG0+jr*duh4_9PX)a~9u1{VWGjS3aMT6yRg7?oHz9f`6
z|M?^I?m9SXFYyBV9uSCV`>2w@{0+`;e}lF!H|^{_{_)B`CC4j=HCJ>Pf9y&Wmv#F$
zfy+8m*}hTvfsj|=%&+eoEZV9SG=p53uDgwLP%REtBb_!R8%zPIFb>8wg%7oZWBNby
z^D73Zf9n=rsexulO<FkQhcKjtc&DNl3#K_TyK~ADJNr5KTA9H2WDpTBh?-=p^dS_7
z(q+c%8)J1sQ;IGdS!o!}0d96%r=Nga;In)!^b5sZhy70<hI1uch#bk9Auo|PfPeQ(
zmq-jF*fCVeb)8w;(YIa>S7?=g&MQC}N!ML)K^ds-=s>c(?DA~bi>j>)Zc{gRcPa~e
zdjF)#i>52#fS|U<I5_#GL#uzV^H0(yVLzpPBfv%-?okkvVM}Md%NTf2ticerJ#mR)
zvo+KR^!VnF=mvFz48EODm%pDneKg>Wtm2jj6chbl4_EP_f~>R7oNDh%@i3|6yC{cB
zoPi}5o~#L#ST2i|=xyo`;_%)F^D3u*rjVbVodF`+rIR02O;gUSH0YyNn!l`f?;5=y
zZ}AVF>b4O%RyG)?m;HtglPqsPzQNP#qX=hzBPX>c$eV4(1>cE(q<1xh_rU3l+H3Fx
z3Mq0P1mxGO)mzDxr9Qw~)!ndG$N#`u{R4P%C###=2uzUG18i}&{bB_KF6mmpZcz`L
zSpHw6(JMEBhOXc+i|JROslA;jNwQtiXFjp^6908m#QV3m@8C)R6J&6-?_(FagG4Ci
zRqQ$MN{=r}cIWy)fw>4Ev{D9yclN{hv1!EZ-D>x+I6$2y6U_74lj}qy=6KBdW!EoH
zwHgq^6IDk}6F-j>>hgZ5)!189)%E!A@euI3#<`v?W1r7?443Gv2G;H6s@KBH)z`r5
z86@%>#4CN0q*jahYzQfz-8TfCv;bfWJlrmyO~pxd*?fo&PN#hQNcIWFv0$s&BgNau
z-=oxkzNEyyum}S7KlmaeEHx30AZgmkwm)Bux4&nM`7l(9Hx&?*qWXe3Fa!gn36sU(
zYynL6wR!%8*J99ecSVz^B_dDtSw7A+Th(X&4X?%D?jJc_&&LLWrldEdaDKBXCMArn
z09=L1XL3;?6yHMWYf{+FfUgNAR`~A-0E-NR<JddfMt*H9#y=8I&1TCJcS0Wvc)ruU
zhD&YNl|Fi2nQCC>gz<+P=y;L^Hs^Vi0m!DMVTVrbv*_Rm(0!m46=<15T08YX^tr%z
z<rax@Lg7AY7Z!*}DCA&mVS2-C=);%|;BNW_aDORRV7ku4TQJx20_J*j0%(;>o|l?U
z`hNiBG0dKhbfBR8;YzMUap|-j$)vZT$YHyMbMQziU5tybV={PG4B99HO9ipBToJQ3
z(#gBvJu&B9i1EC}8>+ty8T5gT*S7fJ1!T$Q7h!&2q^LUtO9FY7--XM8FfnoyCPclx
zV0@n3cLVTjc79V7#zo5Y8H(4f&@~{<QM1YY!Wz&i1yCpKz|)Cu{Qp$o<<EShlru9g
zWPh9}I{Hh}WzaiW-I|etGdS{Bo+hb!ctj7q{G0bu3MfMF5iKa`!7fHX;a@%(H+Orw
z*59%Rd2);J;uR)4ET#i)9d@D#peJ!6y+ah(A8sBHQkVdAlK=XS`O&J^u=x`)M}wJi
zvrL;(yxU1Y61mow+?0N#ejkH%MvLs^b$=zbJei$-m??0<#jmO++EZ<-HWY_(=EUS+
zw}y_$ecwn#4{*-NC^@nOSB1c9CuPE<gZxdZaI%It&s6gtF|G9PDI=rcGe11$2G#Wz
zWDeA7OaIGJxmLmZ;3yYtxAZst_uXPWY_6>yM^t*KGS8!OzLl#CjyO;eJx8OsO=uHW
zfvO|0Z~g(RmPh0khZp+Im$QZy$v*|FvM$d#-`oY*-{;6+mZ6dW6YaF%Byu|5S9^Qb
zXy2mYdKS$CUE=3(h2Q`fL!2cZ&A71KC_a-VCf1UYAfC49Z)dTRZK}LL^1S-<16NNR
zUay8;7IvM5)`yxb!s(6Wd7GtCfl1Zkr|-f!)fxJ4)C8m2xN=p2{jh!F6t8Rf0QP<P
zuNmK~>02m^LXD?46#aj3cGg?}oUa47K<+?$%7F2=RvH)^5x5_)H@h%~uJPV5iTh58
zPy!NWqn#L+u<B<~1}IrVyh?WnRf1o!UmFjfEUa7xW(H)xHdnu~FW65_sgFiHhHha)
z%HWJjG~By)Sp#QGrd<bnI)Lbl<ghgr0VF@xEUhw=?=y+GSD2J>gtKnCKlw{`a=1oZ
z*X<Y8ZpqpVqNBZ1TE>@xM?pBa1!#EJ?Pmr<a;@#i?o%z1*{6n}7=NvYS{?n?29ma9
zEw_?X${dht<ldwj;ixFEYQ}$0=@f%L2VC}tX6J&<hiOI-nRtt-t9R%H=?*qbWDZ=`
z4bo8EB8u?F+Ke#!YSYPr&a`#=tAGqxfw!44*o!=|o)5VngX^QUaj|x1$%i^B<jk`N
z#=_~0tV-{k(@rxX$>j!c$lDOMxUjg*;31)0gido9H3!G$QQgh_6ma*WA3tz9Fx>X|
z2Djld=dL0DaYt~1;Qp<bHC^wt$GoS(TCzF%+xBIq+!F(6yvEGBG**tdG4w9dHO7nS
zC_@EqQv9`}@joQQa#yy(fhYfrgpKxUn>|hD0ZNl`P=F~zo_{`vJTvO)J4{{&m~=h~
zqWmse8dkHT#B6ml24C!XHjIaQbz^E8s7rXSbchHGn)|*<-_@EOly1`QN?QCzH9F>|
zW@DWCv6c>&@)C1T(XJTervzYt>R!w-E-33INL7`B3g9=<HG2>;5_uPSRH{TvO*3-5
z@_bG;LZhTk-N+UnQBue2y!@*#;pQGWHzu+Mz_j4WI&O!bb8og$v>1q^;B3H30KFsp
zZ-wZsJFYk2ffNQF=$mPy%0oaqT}f@`eU|N*DE)XYLogLho}AYe!p2;6!ZH|T{lEgY
zj|PV&(@Q+OJb;&Za+cx@q6?bDYOW8$nS;{_8v^5-q30?z3HQ+UaW$b=kC}_aew6<-
znt0PkpO|l5gSGgI=O43J4fADC*}R7J*CiL&GG8LO9p(X{h{)O)F?Uu+c20oYUW>&U
zfb$UXc!mYnYdJhXEeA*^9PLY3;12nD1K7fYe^veJm#*RLGYr7~w!ornYwQg0h9qla
z@sba3j-x(wy~(ed3hu?-{<B$9`C*&oc<g4g)LZZ2?}>vMd|3X3yp2po)n#hy0abP_
zn=z&D`OeO~B^C!>{E+C>tk3lKPFl|#szYHS$o1O0)vg}6KC+R$Xzk!&;*D^oj+9;o
zG{5$UG1;DUk!vu?e%BX??P{=0kAY-Aar+(fS}7bJP{kDBb$mYN0FK-S=Y#?xUGsY(
zfh~eP*Noq~OmXY_6vtl|psqVL3i6{aim6SqP?fbzEqWpl`7VqhyYRoYix@Df^CnB(
zDQ?dm05Bd8>vNKh9mgxC8<%r><8sjIvCQHBxSSx=YuKU#o5F*`59VJjuUBRrEJR1V
zj28o%cf**{8A3bhNfxyQ8<z{a42jq}dVjHuhpf~dmtR?k+|yIuU9en(n!999-03Pg
zfBS(rnxc}4ykEsnkQ!p~ObUYayY-#_t%}m;{C6-TN)F93@dokg)>oJk(}1eAgfdyn
zxlBxq4R=IXh%l!LbrJfRcVQHuRkB|mTDp~Tw>S%L^*OPE5K0b_6tE;>;D7zj;OYZp
z^@qU!EWh3$^%Ed8!V0-jQm{Pn1{hTIKFblcvj89Cp?kpeI$ZzFeVC`X4qIFh<p$gv
z{{s8T#{mbcP6eXCm<8lLpz}`$Ii{~c41>+f+Py#piDGrDBjPN#`ql-T#g@R-;oUkz
zyhuqBQ)T!I0TV7b38A!Olcae~W<LbsV@L6Fc_BgyBBHd;m(#X==2c5ulQ6|MS@L3S
ztOa$Mf-u{M>w|@;CLPD`0JLGbhBieVVSyfA^oc<VVk?3-%#U-~!KzErKiCX#BY3DW
zl@(Zv%~E{em0u{`9^P)DU5oPITTu3MY9?SBUhO+l&J}H~=xr$gZtPm&yz-yfFp$zw
zh|l>EA$qT_!9yvQI4Kufu3BizeXo>6@!$%>_K3F((!hU{lU^c;O_dx{RNIXF;D5V`
z==K5lvPG!{<hJ`L2%L!RXhH7W43Dh4q*RwnVJ3mMG8)|Wmr)_FYF^RnR(ai;@SK6Y
zK~A^i8IumD&6>^;9sRBJLPk4mt~R^zDJwRnE!<?oJ92nf2R`a~okkfzN5L4Lobfsw
z?|8@}&>x&sN2F_tfpH9MO>fo;Il&fq;t{}opW^zD;dnjY<^$i@0Z}jxTR4X#PQ5$U
z!vu$)7_E$Gzv+ba;jE!=YlYcH^gG3A8Q9hGRXr42QKxF&XK=h)H|}TE7IKaWsETiF
zW^0OX8y;LkK0b;Y?_={0r3dp54ulE;?{ik~XQ@IL(rKaX&#_x`VAxo(y2!rTlPKbg
z-OJqV);YWRZdI~&!3G>`PA)a7X9AW-_p4ONAu(tgdVQ`3Nk5G`M>1P^d~U={RC@OV
zb8gkL*jdz(Ls)f!6l0zB0ROx9V|TeCC19|2Gr}Ylob685iQI~7{6%VQrM4Vy$bC>u
zb9lrdDMcGS0gfRADp03)eSCmokc~IE8A*xa+iT0A?z=Zm!yP|S>h86@_H$&un2@%2
z$(Yh6ZYuCeIej8xNZC~@Ob$V5y;Wc4&gBlGRMz~HR{2OBu+!<wC~f=<h#<Q(*QNMP
zVSrefU)lqi=T7ln4k1A1AHpA<jOVu5(<)@?$n|nT3(E;$fZWcWhJmk%Mza!GE=wy?
zO%FwZIkCa+lcIOwljwX7np+Ql!tY4IArpAtz5VRwPDjJT8UBs8`JU)ro3Ru=jHSX^
z@Wtx>+WbJn*T8X+n98tY$Rb@yg~?0;94_WkA5AyWnE;*OKC5jE$z;i9g`_*kVcXW6
z*bS}E41BWH*=W>Q8~3cg=O|9_vI@v-!09(h19-wsrip$oh4*YRi(iUwlG$6Io*;pP
zRb(avowRrQ3N>_tS)YUY)7w-F0$wD(R@VW69nkEw>DAj7dI+c~Ux;8=dOW>Fh#-L1
zy65{*6h)!(Of}o`z`->>#&BkLW=e3jwsN`z)pMRa>0Rr5npc7WI)Ln<f}~R}>kx14
zp-OolJ}K=E>@(|{57K(GRPyYJYtF868?x+U#E+w^955u#Ty>Ik2$sIf8rpZP3W)$C
zOAGKInEg?RO2qXB!R?Z{5dT!;nhN`bMu>{|2RPuqx{i{%u%dzA3)j6yIoXo;(i3Id
zP8)lCPJ_8XqnZKJs!~YCB{|{Ee!%m1eWSws_kX(G1gsOgxFEtmhQkmJOF6gCE_rX=
zx^;DRe@&w3_e}Gxc!Y}KA0u9oPZdt(4!@vK9b1}Yj?OqW!#_>3e*5ap+f-3GN6gz<
zci!E5U|V}^Ic&7+uGy5I^mVM0ca}gQE<RLuS9dkc<(ReCO0p<agyBG+p;*6LnbF8Z
z)v1`5-1FPA{Nz|QY$U^rsl1I@ZAiuXyNsTZeK4V+!?U|LnAlY@G<f~PaCW=9gI(u@
zQ2}+1d|nvKHl9J;DjNEe+y9Bjr+t!d>*=wR2rm13UuuYiuVQO{?rHyd=jV!d4BJC3
zZs!UJ?N_u7__&?Uw+csgI*rBFLeHrNGBig0@a<~%Kd>*&k!}^@8%#a1o3Sx!ae)43
zKHhEg=frmm*`a;GHO@2GiLdXF@%?&)`|~O9>rOfM2XoOBK3?pNuT}golxeto+Jaxu
zmRC+4q~UfU*ONQTcRaiM#0dgAD~Gp8^ag?MI;71M2l9Wv&%gOgCAx6uo_D}fCAtCE
zpSzZ+3^x!$vG^{T)InAIMa!(~1)*MB(q^jT(Z(mc%gdA5G_(4grS5X|2VA`#|K=z7
z`{jC4PpDgoIYJ^Ys~0eYKf?WbBr%{1izWEQvT}s9l1EsA?!l9<;Scej#Tpky=hhxi
z9PhY6&oXkAkHV2F(!D{)O05p5rR_hj|ND*prC$~v-rOIHOhy`{pj*ElvV_;W%BK&u
zcnp5^oB7q9%0_wAVv%*^Zje18TppkDXaAA?eH*<koKHD`*P5(1oNY1q_Xh~#8-5xT
z!G#-npRj!qUB~&)(*0Ze_S0AJu8U}d?Y`M#bj5$K4B6Zxump#uQH!XA?N)Hj@BcjW
zdprMYe`yxES#oTHGp&4)zZd8UwF3i<2yDGuPXDzx{-3WB5cqW|xk4@dKbLAC1-Eg1
zny!_QBV-lvOaFgr-+T$ZSvA_8{U+7WKg$MeUNyv;EKtmE@6U($`-}fezkK=f>r&a;
zO<f^>U+SX}xQzqVS^=D3?>u^(@@Mb-{a^m2UmjC@Dj{%N6IPE~_OAT1$v>4WwO5d>
z3ll}+EdKev|I!uyHnYc=zb+-)>=jM^$DRU#>rAz4BCuN%P9S|QNc!iQf6ES@Oa5}z
zY@KLU5`SDZEP#j%08^)Lq4-Z-it^W`GQXfOiv7715x9*ayI$-&z_SRw^%MN_%>Ufc
z{|A408wWRF2?5^RB7%4&=C^14c<tmvQejTsPwGE)DcN6_lE%c>kN9&bE||xhL9v<w
zpCTX$$N$eW|CY%mu_2`{pYjXsFTCXKV*cZyQ^}=T$VEWR|ACYEpSn~g;?1SLQnGZt
z{BtRL*ln!EU#S3}g5VWB-k)dw-pK#TFMJliLUXf{Yn0KSjSUNiVj%%b7C!Vm|EWt!
zKe~x>0&>PtN`Ef(6A|1-N7gP201(*SwVD1r^Y2BO1+rgJrWisu`ez$o2Q;$(8_@o_
znEHPM+P@cE{<g_~BA_XV-Wkr83)Kl^msWQ?yLYycLrbZL7yTS&5YP4RAV4o3p6yic
zF6EVL(CQ<1al-5}RrDi+c{ZB^<1ecLnF#*K#9LIJQ$&ZuLIl_xyKLDrMW^l3<<mvU
z2*)GTFcg+CKA!V6e$Y7e3*>YWEu1pGIU%Y;)ysWGB6$;MV`N&oY{pT=VZU9-y{J{^
z9$!*lU37<6*eu_8ZScl$PG`RmVQ*nk5q}rwuMo`l9evLJ^|FhNGi&(CwCtOXqN7NV
zkdad)m{&nIHJsWfj1)pg)!me^sAE)~iBMZ#ibeCyO8{tc-@V}#0ukkGK2#pep!0VZ
zro|AsL-sc6mv`5yb4&k+K(bE`GhSB08)QR8{t5qCR|pKLLqWd_Lpy01rOJ&Q(P+tM
zU*Lq3HXgknO-~`P9h2TaV$E6F@7c~)hnH#VPb17P33Zv1A551Ds@|>S-mON(b&ekz
z*A{cwOIy|5vf)3d({Pwhnv}cL4V*p+L*ucRIzQZ0Ru80JTg|ODMR~=Eh7bmtNq6w0
zO)K=BX)TC6`HOGBGNAxjHPgoMAwN+L7hH=5FaL;!nTx|5?@3!+<sg+*V-z}iTWCY{
z5q=xHK_YGa6*RWwgOzK7-Qu#G51+uO)76RFW_vDfxuSzZcg*f`<I3ufMwJMc$7}(h
z4nMQ8HT8zs%ppJieHVAcG0(+DC5AsGf4H>z%Ljz~J0<&pNTh<!c8CRa$03KCv)wz3
z8hT6H<N=&SpEAw7Yy!PsSW|4^Bi8;!Vfl>i%xk=;{aI|dU%1-T8~J?I=z~(vhlO94
z^IvQJU`iMJc;r~cWmT&ZJF>m}S5qL0U!CI->;7>_`4TxJ%i(MWF`A#uFq(Gmk{@GF
zu#6Os49mn?Vo?vruu1JzQ{Zf8PC?yE)}AQE<&CRssAMOV+gSj`>7bIZjjrCV5xEO%
zl<dzCUygBw!Q~F$)9s4~hPR<TBN`KWtJAu3A0NG|J?E{Na;euZWipy+xFEEn*ixYZ
z8%7n?6N`7N7E_sLA+;RmfWTWy&No&He{{Xb)N&}eRf#M#!!Pt=r@lCQUdvVZi3i_1
zrxd@~pF&S>AQ0ChSM@i4z{fq11p@Ssc!U1KLmB{gfG^-+6I({Yf6;N3;8gW4J=Evv
zZS+h>IQU~?Q+=lyA=k?z1;e4!lI+Ouk1d%jPv4A#gmpVU!G1vtm)ll&#x9=Isc<M$
zT4u)0t<t)3Kcr??L7nwuAt}LJ{pB&f;rMxtU#oh5S|miH`wEP@a^XvG-YE35YKGi}
zpC~q%)_*kRIO!bCoxv85j>f$t%)T=gx<pajxCDmh_*M$bw%1Tluby=@cq&KAx4(Yt
z$xynsa*@lpXw}P03dqW=*X%m-U*a2@Tb>{Mzz|)!w8D#1++vGz^M>uNNmChx7QX~z
zna@aAy_{FFjPu`jCGV%$rJO(SSJ3Bms-z#|*r)ZN{sG;o9&X7z>$F^NDlAC2ynOGM
z$sqe^e_<uojD!wZAd17~tMmD~P>gJ~{{a2t*Y#C~q4JhH?Bp0Bxyq&QCQ6L9mJ6QR
zJE5&g_P~9u!yVx!$H9-cOK$kCbymIGHs!#`Fed177x&Q_>7!4vtFt-;_eTpy)fqF(
zYfcxg(5Ews)MfiE74()Ht;s2ZBz81w6XHyG6j0Y#Rgb5v5_8M#cWajiN>vcfz#O}x
zmORQwW#jrPxE%Izgv1XzG0r^?R(gX3%DW!;HZBT?KAGKv<1KrgO-kjYLA5dc=E$m-
z?UKN7d_nu-18Dw5N+s{S<|YAALqd8}J7|2F_9ApeczYstLN)oaiR`Hq_fds-jI-K8
zoR>?d^m*hDv_;RXM~F^lS=>(o@x#N_`1N|Mh$`$25kEOkR7jJW1yxOMYwkkE7SUpw
zMZ7$@JiSGd%n{$LtAtMAV@mE&nTZZw<KtzQR&m@vs49&7I;}Chfyf#!kO=Ii+6R74
zJu5OkdxuNEA0rwqc<s_YpwDRv9G_GTN>&SdA1k!c)<a%4d7Vh<u^e{r%n=KccZe)T
zc%HyW0=@V)A^$p-Ei3`Mxcj@{Y(nv~Cd92NFA7XG_RI}jN#&k{@J|m)Y4SFfllu;Y
znxL=UJjC5_ZgYfq2hZ<yyxmnB+F=+kn5kceBJ5y^*FC0qb0obmMe%&+FzcZEz5~8W
zYd}OEe#9B&k}2Mpf}Nr6EE*L*CJF6M{ne|19HI6lr6xh-AcF)42GYCI9A2;26h?EE
z_#KaG<XI-nNu%`%mNgvD9BADzzfU@`*=avQywF!X3DX>sD^!SSN1xybC7&}MVtu$t
zPG|Y#6NVI<To3z&v(kAFde)co=8h+J_uN;%yOUq<5Ow;35gRf)y|fR*BN6^rl|IIm
z%Okev{Hdnn`{b5#<sl+}Q9dhOK9OZ>^26cz-pQHZ*IpG-cMxG*=s=hyvuZ}eW;Z%r
z-hPNrp&j`N?&T-vRtyNvgRFquEtkAZJB;Dp?$-96E1t7z2qM@gnNW0jl0@DUNh7JB
z!(i4_^L8wLyvk0fh}SaRmP)`t{pV@l*3Lk_F(<0}$Det#a<}j(trD6He~Q1mb5>%(
zxmyxzz1An-dcID<xbC1)+}AoP68e2pIBDSFUjyaON?Eg+qN(OS-(&%IXyC*-{%n<{
zS1`Y2ioW)b8SqE`j~<w)ewI^tTX&&a&%eeoeTDaL+EGAm&H72>(5c5fr;MzZ`EXxR
zdb#H9=D=(FjOI8&ykqQx$$|-o3{r<-*ZQ-i{JzcFOde4lRrBo{cDuH!&5<B9g&NvO
zFx+N$TU)KS&he#caxm3v^{$mZ%os(huYDK8nBO_SQ1muaG*o4LRtnS7an7!Bhl4(Q
zyJk5$%RaBJNAhcV%sOnycr(8Hq@hda$Wuo%S(I%XX)X*O^zh2LUU9n#RlP&Y)<v-X
zN<(I}+(Dbx8IElrK2mx-VI=0eg5AEJ5pN=c$};U_9by+ztJZGWxFm~t$5U1a%Tj|X
zJ25se6pRb=_KXV5w8INeguwyRD7sF;%7c8B<rZAlHv+w9sw6I*>;~D0Pvuum<mGKq
z!r6NT-Y#`;`x-BH5V8|1wj%)}rRtc;3?Ze8TuQr6^(-CKoDu)rd0CEYGLBL3I@_zC
zLew1Dl99?XGr+t8dNy58dXCzQgy#LDQ7W;t`35)Qr%t<SQgvr5_)6BDQ}0$S=H@&C
zgIvVpIBd#7h}|I45wW-(*s~VCkn>I2w1v&fI>`P541-`zzVl4dz(|)9?glQm@EXXz
zm2LCbJM4YF@F%yH@B0ZI&*UT+SFP*sH)AKZ4@&U{7rqYCm+cf)9G^6AauWr5Rg*)`
zotohpv4UZ0{r%~JnNLNV`A$*$r#a3)zgJscEO@5JL6f9KO)R>#yoty`To_HbI1LTd
zEv(dE&Mpvbp4N{wSx&`}DsRo0wfB(Ck?(dz^NulF=;gf%DxY!X->I~-NDXf0y;4&7
z7SmofITC&}qN4HBgzL1AyGXZPB`rb07y;sesbW%^N8mapT{LOxgmX7wcNw&P3%la7
zH<N#9FGZ1P?WIOP=S@7)#<^QVjmB%~=Jn{W8L~t>NBv9qGS&L?4YB?D)r1J{lPMuo
zo;A90$Ib06Cl`p1w|I=kh>)l0o<D(h{^Ss{qU&Ds>V6p*2*`E*QO&T&EjV_D-6|ut
z=rYuQfhbUg<?=36(PzGmG%%ddc1#2Yd>tTr-rbbQ{Vnt&6Q1B}iPO>fnmwEy9$9f&
zJaJ2O<szND80O?d<=n!_QggyMkf^7S;yw7R_joC_{}i&aQmx!u;$SfDl+@z@^)%Rm
zy2qN`e|Z-dEoXrja(@@JSi>t5igrA>Ra`aCySx~vAgp*<bv!ZbH!sUs{JK@ya@WPK
zJtNUIZfydAxJHTxs_RK$b%<oS^r*EXQa{2j_pm~{*_-Hc+HO)NfEW6B{6mfj!2IgP
zvjt8wzH3`s)xA&_?lnZs<%hWmmVv=GeOT`sT+leTga>H|U&hAnqRb~anUzm2ch1t!
zPP=XKTw$`@c4JTEHgFX5>MM)0v=mXvKYIA|b32Kn>Y~@M610jblI8aD@yENUMe8aR
z@733kXB1!QTvTzwBFxib)0miGV(4?{J9OgQ>#2jw8cti(uq0!~#jJA5?usxy;qpxp
z?s01{)wCl7go~o19d)N|Dxv5qoD(JJ4yXRnG^hWbu{|-pWa7@_!K<l`+z<EIoqMKm
zlWDUJL$UP9o39udTJMMMa`G?kz0pGFi+7sHGQd;&A-@kCti$D%DgkWh<J~N`mdc{|
zV2M%s%Y41gNWAIqq__<H4>1q>`>^?3)SMP2mSfH8gF)|jK_aKE<fOH)4BSh{23IE<
zpHxxe@8x^HgpBE+4Zh_HQr-7hmfl@fM<^}IsjRXIia<K-grTtpzn1kBxS1!d9+dS@
z&)X@6%X5}pj5-cwu3R2_8`ldDM&)#A(=uHx9L_^rY-+u$yN_bKFQ*@yUObfd3TgAD
z(V6ZQ@V<4q>3~A}%`w<f5W)9nM-J^6&#c|73&k2SX+;&>F#V5p1^&7*yF^F9-V3vw
z)$^7$$657#ea+Y%9;21q7yEAMm%L|7=kH+Q7xWKeaa{CNPb56yJ`8G-sNZ{Y*2)Vd
zp{+Zt;X3?TTjY53A=dPAwS#r7H(4X&d#_5Mj!Lbgjp0Cr=QLj86CFC97dp%IDpK+G
zUR!k+3G$J(+RX_2jSqS|Ityy%X3{%$Tl+UZR7!m%9W=T;GA*k@5d0Qvran-va5m!d
z;<;7j2Ez2_li1hrSt@oyS<*UcXFt}ykO;x8w@g{)%?3HqZspWmG(NcM?DH|I`@ZEM
zQwMcv_-@%nPtop$Z~B~62!-MN&?V1wXG}*b0#E;GaH1Qu-5KFzd@^MRp&-+YZ}2t(
z($odmROFi@nT7{evzK<!=W}M<el5!^p$*>=h-sXlM!Q2T9fv!W9XW<;$os+7K{Kio
z1l^GxPc6><9jVL1Bl&3bo+wl{X%z5dTPy{)M(wR!>J4XytGm&Efj>7~W>3Hlk9f@<
z*&R%9W`3~-ph=iP7mlBo@iwNs#qcig&T0N+fT2o4PQK`%cb*Z#-o<YHcpW6(ZW`-7
z!l%<VnFD?DP%ACHW?ve^jrL@=T`!_(gfZL4tvvKPPa|!O*W-JHQ2S!ZhPSo+^oO%)
zm)?`o5<B<JyX8F`7cw&{7txzwEAog49G$iAj=(<*mtwMH(mk!-scP=ni+SE=g7e_>
z48#L%CNd+zk?CDsPigJYg^)?-)A;cY?t#UKZetdXWi_FynuUn)%sQ+cm43bFYtu^u
zy+@qmE_=<`=^Boo3GC;z_A`{SIIuY%MjFXY+iljBoFCKVs7{`%&SXvYWcJLB=}4Ab
z<{phqHmrRNEDrRd(P|%H-GcI?&C>2h)8nzGCi7cWdL9u@8(7vmBb{!}rP_*GbbJ|+
z(^~BPmf>eK8sxi`uY2h*vRKufZq;u;g#~}x4gaK@RRdooeo>cJr?YZI*{Ho*-w&rO
zypQ{gpXMl1Bl39MAhDwfjrSo(SwtQrr#q^{oS^=o9uq1l%D4RSxr-6V)KU!>Y}_zz
z=s`EeWuiZE_c6vbIPSVZJdqDRnW|lMylQ#XPfTZZ%-GBGqN)4iH~g<*o^)I_xr=fw
zQHG=^=+#%P#BOb$eNz02NAKdU9=aNhIMWWA#XTpa-Hx#!;^m=7)l;js`AP6pOknPl
zJJ~J%94d~JqMi{ba?QmKL*;(<F|K!MZo_(k^x_~x&pZNh#<?o@7!fh2>3c8ITgZG`
z$hQ$J-T1}{xJn9`Ppx~0XY4W7r!SPpO((afn`WS}A=^6n_#2lk0XeG8_ccj{#9xNj
z!<wrCDuJ>yg1Wl`%j26`!IlmRWzt_q-cr1m!Zg)2CaD-zS25Yglhk*uR;QnL(-<3t
zkC^hz`wc+{B9eP-YaLO;E>EZ|I;;x#*()68jW1S-dROB&_|7&9>YwsnLQ)7c<76&L
zGINdMVwjEEY;@9b5!NM+g31NrefAOf^;j#`w}&eISA`d0p^=$*x4wRg?bKBlrEtnX
zn;1SjMNngt_vKm11N+EcTm%T|6<%s{_in9Op?EaM3=hI=SCn+9zYer4E#V@So^ITt
zRV}p#OC_f0r+<mDOM-t2s$Cil9fIT0jyC+61{#MPQ>&^cYuu5hFo7&|r|N=bQomYr
z%4n4~ikt#RXg75<!A757$4_mrwl=;7{v@8wH9a~>>%h+{NXaYk^X<t{+}6Dm$0N74
zib9z@tuI$(@{-XugO531-R`M`w}4h;dT?4BFY|WI-V<)1&WTEGup#p<oB-c?!qOvG
zBHFfg%4wI7CDIgsse{CkOC^4JBuyh)&e+lr<J(t>oQTM=)h0#Dfu&907}30FSbOUy
zIRZcvDZ7E(=E@zz9c;GSIK%$9+~XWx6-uvaSq=9U4M&d|E_M=~pt!hPOJ+KKWR__c
zCYm<>=STQ>6q6G>I@@F{gQjtFF4&Im>OI(8I7Z*H=c3H$oYXGGd?MY}nVT8`V{cu^
z%H=*bq-|Ft!Y^FT5BBl|r-{w(BOkfTzu`RSf*;s&A8@%n^#Fs-pTNds?u{)<kBRX!
z;_3zt`18bzQ2LMSj>Bnbap@&c*Q3%%xTCFPZ-Vvup|-|AJSF?LS&Li`6Zss5oh~m>
zLTitwMxW8;qPp*KY*50LqYf~9f=WkHiA@;dw?o7Rg!+v_jZ>BsrqI0d`!Y!0tHn#`
zw`ZVXrx*AfbYt<uqT1AAWry$aGW3Wx0QEM;5HbN>W9`(Ww`=Nm2lAuh9I>~A{P~v~
z0M>?)c;ttouw*VztJo#sS65tm;s(s_6zAg(sW=|tL?s`5f()h@P;lOEI~tXUv>8zn
zGBYU8Y)#&6_-uivde%aFQC%}_hKu@Q)IVPT2&p1aqsP7fy!5URLK%6K=F-IX+Ixa^
za@;?LHz{|?I2dY2G<HAKV#%JUPRxsbnkT;VtkW~UkJ;8ghj{43p`+bEbW=WZ>>Nl%
zk98L9r@M3Cd=a5yu2@#CC*jUexlDi3giO!z0VQUab;iDVgGp6Q_=G4@Btvq#)-ro^
zP5vTKdiK^rnXyITu)(Iy4h!hao3L8fRyyj3F1~>-3m;mNp@}D?-mPE|B)jvPW3hz&
zufU{P<2YBH_Hc*>F4B(|cPl#xl?8uFOw$>P&)L&km*8*?Az6n@I0UY)Tjey4gx7nV
z&$f|1li9Q$mt(1h?u~+I^i0`eHZMm(&Q)u%+LRMZK_TrVpva@)$1I>L`!Z*2f%;|S
zJ2pb&gc)tocr=GYf-xi#6{SjP4fWxE@ZJ64?P=SKI|mRe?&$IGz2LG`1{2lsSDme~
z`mZ(phIeZQP3>#2>E?Ikra43-d$_xQ%nLcS+8`{-0`_b$afU_GX<hAcp$yh~m;6pj
zhdv8_{C*}Wrb0;3SFX!_&K)J(j<<c)($T61+op16ORj@`%}x0!vh_oUHW$a6SQ|L2
zGv(Pk)o}wGlOA$YWjv8~8)b~yjD0>EO*6fX0#>>+kmzG;^l08p$h<yHx#~p1x5GXA
z@rUNKD(IYP&K;srH08>rHeGkf)3#Um8q7u?3fU^Sn<iZDtFXlT&Uj2VlFW^~8Vw{S
z!7kmD6+OY#S3#O28rva(8`hAnVzPrYrll>@=3WOG0)l$0bqikNJJObXH0LAFol=|!
znvKK|GhHE}feK5Wp97X0<`<j)6o%e@yRKB;NxH67YOKIbl&-&*w`Ff~LPg%m#%<+d
zQ!}(*UtZOlW9B|GSkp8E9hH{7kct`O^Z~zTq~vy~JVTEIIjXAiRYT!7%j_V29`}%r
z?)>s3r+cG2MC<(;YwEyeCAIjSd>KT`Tg$}qe+k^nlN{nuOkp1?Lf4J*WYhA3XG1_B
zP?ILmL!p||77((L{Y;{j!?LP}lPF%NRc2h&u3s?)kHhvoO19wpcffPO2H1=poUT$T
zXg&6=7<=lbNKd$oe|uK2bHsnE4q6Q<GQ~wLZlgd(oA$wN49j#3%&r?|_*nI(v%R1m
zs%<b}hZ3swWMXIGfhha52H<?mn(e>6R`dAiD0<gV`rAgSm-9>(Wgfk64Juj6%O~5W
z?2R2>{N6`{LXIk<iuW9#E3tAd!e-o7CMfs_t#p;QkmZ;w)@{NMclIjuWDb(2_E7TF
zFa5hcV$qPFSA=>lP139#1hLXVw#zlTJBA)?*?H^aA0W71)Jvyg%*JgBqayUjT$LxR
z;&|^Gmu5LVJU`lv_&z}NvdC@cW95F6)5m!XeWVdf<d=)xOLS=5vPA=!uGOO-qNOaU
z<Eo`cwJ$npc_&vFpu)ZTc9F{bq;V>x8&sQ_`A3uq!$met$U<<c2o#oG_w(m3m~*;2
zY&V^b=mT_~;^PP>+HNR;p<4c_5f;`Tr7;>siziSTRa*LdP_?lHzF%2&W>Xm@bqhHt
zjpi<S&6%N<pzL>EN0l_2ELRnK!7>(-CXuPIY5i{exgx)ha>{*mBvV$q+YC0!hKsF!
z4^C4w5tF1?Ogg5J+3%U)b<k}*FYh`dj0<TC-zmR6jx&2_<6t<ao|($TbglIE^Cm@~
zcC~2L`nz%beA97xQme-Z5En@oktnkJ3_P#@AHLoyE~-X-164pm2?dodK|s1YMF}NU
zx}~I>5s;RWZje;EhMoZi7`jUuhLG+V=^Qu<zi;pTKj-4yc_aQ7&b;e+pL(MWGt7G9
zphu6P_f%REm1Ccbmr13CC0C3-Ff)gOk0`55p9di4FTAj_yU%`|q+KH&S``W6LG^bD
ze`^{3LWq5}%r=7jlB4wUevsfz=FK2MQFAQ^$6S04eh?SbZ78Hf<8>v|6oJ6P>Z@J|
z93xGKKWy91_VEr$nJ_%9cA67a=zkR>;~FRV&0D(7mleM3oN<L&bs&`AB>j0Q$TEUt
zNE=q}R*UdCyVN;9S-Ns2rlC4b;|M;XFU8+-f)Wleam^-QPQismu}UA0ZEXLj0_)&C
zEa_y(Rz;5uOZ5}kOls#yQMv5cOz^CZmIt$Q`yvf8ul%a^C$zFCn--rg@Z1QkO1`~J
z(7sEIR@)1I`LtNm&W??CX^!Ikjm?a_=lr#l59}b4?Q$jkz<uoQx!3Ndq9H9YTLcl=
z+371m?MDZ}czhD`^*#<GJk}Jgl^*@U`Auik(M55sXq8x*gfUxBgS9f0W_kZ>`TVH{
z)cq-&ruA|!eKhT?r*JGoB*omJa8kI>!+q`<8ncHJipyx(Za_ENS*anY(+by&Y&=CJ
z*`R~@!S)laty0%N&fRzHdRQ%{Up2VF$CaX7e%x+j2g8wX%;?6cjnbavJhX3eYtD$^
z*{1v>wlAIatx-mBbfg-z5m8AcF=U75&n<tDyJw~EAwZiUBk4@)Oj|Jc>)_`idmrmd
zPPAN85~5F@PKCTj13AJQFlRkanydGDp{Fho`?S~Z-NK3oIT6<%+Ir!*Xle<KKQxax
zKe@Yi<-VAiEqTHwiEmf^#9;b%2kM;ASXyXxe>fpNFSR_7E}-*tu@V<%SZBV3hA4l%
z8aZmKZd@@DbF2!fmcU>FcUni{p7-26-#$5_Y<s#(R}E-d&B|KuQU$|yv)5!Vg%yap
z(&l*PfvXZK+Y^^iG?E7ycpbLA8T;F5iiouIaVfpMSJBk#+f_%m;M`mzm!Zyf-6AJ&
z=NO%2P93(v$idb(#s$|(;(dH%@4U6quvn91^+m6cjdxG_I`cObRX9godd*F;!y*m-
z3go!H@jWy{Jwt}H`XTm(&Q40Db?un{wMXQyM7r!u-{r87K{7X=6Q}Ej*0raTpc=g2
z@cZ=H$H9|ug;!wrH|I%DPE*00q;9HUcLFCf(7jTRlVlC80^(ekU%=pI$FQf)wWES8
zdWY~VNAkLwRH(O`-J|$P)f?z)1txfi+@IayN>kJZk0NHulHe5wM0(0ti6X*2mQH_+
z?qhu*RQTyIXyK6X^5EO`(|_!mo8iQF|0fZ@_`B+y{k!VC@L!1%(-GAl?UcmCwnt;T
zR<k`>YO#l*`@s#l*pAwX_b?@Ji%a*}9^epBFu;)Ss%H5jGUcMlcgqfb{hnhQ&2@U<
zg*LT#vQat2I^-#p{`KR=wxrg53ugHi_G8QoBIx}WEFnX7pW`Hke1lZ)$bq<-<Qy%_
zLk@ovkN|gaq*<OXJwBTUJ?Dek=<Fv;<UO+Z<Ts;XIjn2j|A@*7QDgHl^2TX?DTJ26
zfRl>{*ZU%s+3YOT|HOSG-Md+Tq{eJ*CedPI1S!FFm~QUQ%SJ>%Ek3k>Vq1wJ3^6AF
zJ3r~JaAvV!eAQyS10ce~^k+Qp1=4*U{$9o15Wr%&@k+xZJrZkiGwoK2JDw^r#|aKU
z7aQR<mPz$}VBg$(y#y-Lt<BXMwrQN%oqw|8cr9E#Yl2g~P2a}4LN<H;&E0SYa07ei
zsiIml53P3~k>Zx)xv0m(>UjbuCi<d(z8fBF+i)!x2sDtp4w4N|KjzE-SZhZx58h_R
zq5fQm#%nM9(SG3-wQqlZb<jT?$u||`sZ(h3M)$m>&rplpbYh}J3t=f}H~Ml&q9ANO
zq}>kT9@$irJH~m%DjRYN9Gkq#0vYY{e=?p;Jk*;u<$jEsxpd~!-VZ}ZHmntcy(Q#L
z;PfKTis;p*-)x`Ay*?YJ=9WKcMILaH>M*li$)#fHkv+{ZXg;b+qB-R+@5G``;lC4n
zihL9EJ^v(GkS~~ADix%!4BT#Dm8WuISD8t)ra2pyaHqZTbfq;WXsV136As4TG2L+{
zE6#Lw_OAY>?Ui12Ait7t=^4C`G0;IHPwk=qYpVXK%9E>&Bn<(489gzdxyXfA)Y^Ge
z8*|xqF-C;HRzkyFWZa$(J+~v#XNIsf7(PQaX+4Wy$;7qp33K56#2XZ+ePtAi6^!4k
z;y&Xcl;$ejNl3}lLZQ1X9lpModrj`E%Klq4jyaKS-T`y?3^f*wz~g^|k6qjw(`sr~
zKn?1A;W2l#)s;I^kS4J5)Q0N*`Dx>!YVGNyZ(#}P01VM*$^FfCav61HO=bTez9mWw
z38-HB4r_P`<u>5G=Z@pDEybY>!I7uw6ix$fjNMAemF~d`XPVWW%qCGUwyPF8n~n;+
zNk@_?lb=jV)43+dbg|qnqxc|WV)9b);EndMe21)7i~`}WHaJFh=?+;F{k+>K1)b?5
zN`&F~I4nwRA1?valw3nNDmd@(FvEfNxn$)4+j=T5q3PxGw+sC74*HoMqgQ>eEqb9u
z8_Dr;KGlkg%0)_AqnIY<3egNRYk9KMzBhrpeT$!&%pw6%j2LF<=!WMbyI$yX3`83(
zFRbTxy|3aoTFG|)v`1BK$VE15j&R94X5E{)<6Jx0ZKn%Oey@6t2<x6WmkuTu`S{b;
ze)i$le9}oM`t>gGn(Mn3j>>L4)(hU{`FMs^1e+&35!du@Zg5!7WfW4;`(4Y2?0CPK
z_LF1AX4reLHbonYB;vzF%&YQ}##ToA^GTaygBMz5Q*#a7ZYuux9!{6*<U{s~$AR|V
z!Oc^fJb{f>56<sd{qpbDv(I32Ss$wCb?vXcp&b2U=E5l7m?$^2Ilu9(Wdb?zqpdu-
z-A#SbFUhh;7Wqn@+cO>5>J!_S^cNcT78@kz;+GsSOrlm55o3%8*6%W8-qk;-S1pE4
zIy^o7txd=B*j_;wyQ-I3u|HJIFyNx9wEOV>>EOMBIX6aloi`sBv1a{O!|ldH&KOZW
zTdU|xW{FlAyMjvENy9Ce8^X3@>Y-rs4#YGRC_sN=j^oc0QsPB$K-G77j6z1v%Rsr!
zN5#`>K#K-UT80|D!P!;>vorwtKDs|jT))2*f{Nc^PEgWK0%rAFC=SjZy@l-~H!$S~
z?3PMl-ZDc{d3VQt94049KKBahw9dY^m4QA~aY3sDk9~L;&coj+L^$49H>(bcvv0j}
zLVe9+hbo+DH3VHMf5`|g*W@VfD2U51*3W~OJ`PXbsAu||8=$lRDsOk5E=wJ)f0`yY
z$08P!eJucf5&YZvO^HL6sz{V)fxXzu6nS<Q4(vHrsdUq3QXE8P(d1pKROwayT-!y|
zg{^&mmS3}ww=)&6L-pU!Bp0|&9|Y4E?Sehr*Pyndq-*VVOOG6P=yGX1e>Gds6V}XB
ztTg@!m|UnkI<<I5r_@tQKM*VaCRwv!C~5R`o8DdN;c4qnA~NV$_8Jj9rw`so723To
zre>@VF0Jov!+9cSl~<O6%DDi66$}UR{5<|=SoL51yF}&t{k0DIq!N>feEDe$M@LO6
z7RwK-WR4X}KE`wfY(bkjL}s%`VFz7l<+JaLOPvyfg#GX4<V42)9<op)4`jM_JiPMS
z?PE_#tdQ;2T(D}QC9LZTq>#xl{X;obUrlj43!+;RdJlKM$*768Sz+lBkR^y5#V`z5
z+Y>#AnBf0(`_7V}wfOX#qCosl7OZKa?x^8bNWN9tJk};i`9|-`2CPIL?$=N<e<tkq
z9NbioH-p(hq5G8SpemXnZcpzn;e4XYejWpc8f%ZRbf4LolLDI$p_pn3ZS<Q(H<C<_
zPn~5CE$r3?E(rF1d^E(9>%Sx2LQmO6ZSP0YGeAkIBQK5rQ^@*D1IROhhZPJE=wfwI
z6Td5GVU%+-Xak&=S|&8784YiCUW|d0y--c<-nnj`w7j27-G1sozJ%#dl;wa7ca+GK
zjVnfI^Oe4vGV8ZEk-2U|m-DBn&0M3I2XUImChaJCp%&)vgxK{R%c;fxi23LJ;;bX#
ztQ#KJ$Tw;9@<@hcI)!!Zi#gqLbeUC%LYb9_(AOvJ)Z91-cT%B!reA80BZpvWe?oo}
z#^t-&#W*F2y@gzQKO^8ikthG^0$Y^1OBkwMOUl;?wROuBY9#;z6F2vA50uUBWf>Mh
zCNPplN00Ec>7BSTD#V(ry5AlHsCuuN$QaJQ3)~D_^m0tu)71W5m#CcDx7pL*&N8)p
zwjB}3aSDHDPUTT=wO$6f@~vC;u5WY^ql~^O#=h&ua=uV1xA=2yv4p}Jso(B96-%`d
zf4eIA_a?h0KJ%twdLMAeg~7z%(t%AehoV!-8Zz*<JesC=e@@g?VDr^$!vLz=t|`%N
zXF~D`ksp{kvZj<4W;Mp#Gk-dl8B0H9Ou?)#?@U&b?ybo{DOG6nb%KC97QZbnuPYU@
zu{c!2va%U&l1G^ELP%N&gBq{R`*iUIK$9G**q}3%pPoR876|I%`TP&Sr~2LF!nYa{
zT*kH8J0V>r=vBmu0u593Dk9|27e^63Q@kMgHIZH-N=x5R6idtUso5rSn^>P3bChhN
z964HF;Ph0A;@3cjLn<3Z4iRWbWTXFZSb_oN`v)8u=!>kbD8^?Z8@m(uy3{d>10y}%
zn5uB;R!%MfH_l$W!Y#F$_bG$e9MDN21k@YK-%0rCF*TRIW>T~|%!QhcC@zV;x*ox?
z8?BKf)av~^^6&m<<bOz%sYN<5i+xqM35nu(v*jAUjguy5WzO`DU8mD!>8A)UP`IQV
zJl}Rs(Gc!1@a=aDpPJmmIp@8bU|Xz1RfH7WC3BsUH&kq<*suUm7aZxC;nSYwa}wrS
zR}(}7L3m!$7&E<|pWZB@<;r{88>+o3)kf7D4=GSwoyZl%<NzsNq$wUxUJU-6?${D~
z>cLZzFr)f+{yX)B!c{m>`;BkTKN2$m1_C13y{`MfHZoG$ru*zc{l2qR`O&;}+MZ!F
zx?<lzD=ECBq|X9p32eQ$J;A;2dei)z1mpY|^V)UCLCICZ)U&sE9r;!MpJhe!yW*1o
zCRo3GzVb7%Pv?K4X95gh5bCwn_@N3iv?vu-y0tBy;6fcFW0P#9fg-LZ+0$+s!aho_
ziL6e%6=Qm2A@2N<qP$sui7_wp7qTWOY+Hdy8IoAoqAR5G1YvJPCp4HDtoPKwQ6z5y
ziqpYpCjk!scbEe&O;y&zkVL8Ev>Qq}Nix<XV1DO5182NzHorHFKeo24F9-|Ht%9xV
ztU>i%ITeUxO^AU34$rAu|Fjvi(->sHxivD7w#yC7?KDn;DCmfl%;Js_)vJEmOlpm5
zjrHGW8O_h_$DTcuU;JLuq^@hlwtfjXO4^_FhSxvlLH(EY>Qwq`gp>Wp2xtDr7-?Hg
zp%qEtp6665oN1$G9?ANk+5p;$O_`EdKotL$vw4nU^!$m6rxgB6oU)oP>!}2}=Rwa^
zcpUpWv+-q@NYohER<Qy@wIj~~n`-nxN>XA)6{*FiJIpW1(%O0-vMtOxZ9J>@SW15-
z=g56O=#fk}q1I=%hXS^)-=ObmO7sbMTgvtZ%!oqvV{^cf1AGyxplK84>h0Cn3->)7
zt^M|2@?djd_IOR-`M#49prfX~LAQy2oZ|1Bt#dp=JJ%`=`XiJDDt==F53IekbrbZH
zeLMExt>#of+n3pdIGr-)1#aEz!{1HF=kBzG{M>!=js)0qM-35kD^C6S>kOaF8N_b@
zroQQ5OZ4KmzFJSMfnU{PMqz8y6krk5VX%W^Hg~o9%?%!+AbU~1BX^wuugx({XPq0)
z02-TylSn|YGndr+BC)h4cCz+V%2BHb&#K}8E5h<2g@EMXkmzo{Jaw0Wsqd-S0ns&V
z3VY9z(vhGcxch#HpPuHgOd6jv^{Q*nT3hU&ecvE5J|eH8<tKFN>L>G@5Lo(RHtWyQ
z<lwCtVt2%l7fS~{IX5z{!K~7Es%uoKjH+f|Pp@Kgrw3GW1=#$dNJ87*iW6AmeM`-{
zQCelXFYIQ~O}syRaGWk(Z}ofo^yU#JkMjdit__sX@W3FaZ=HkkGj9f|zu3LE#%Ck@
z0UEt%x9@2`_NRvbXo|b6y)|fJuuk-xaKj=`g$<8*A7OIWlW9U^93z|e_4>VatGJQ9
zYTu<_k9%>Sz@27amav7s$FWNN)8Bu7qAq=pL@>kgswnR++HJKN2bu6Xd>uP;cmntU
z4-mT^>R&qgh`iVm(wjhpRPg3@uk?l6FEWD(>C<GBOWr!V;j=KSqphd>9=e?<t+*bI
z$esdMDN!kxK;INBVU$GW`{#IreZXR<`M?ZQXuPPp)@`|y2b9MR%*OtUKFY;|Xel%c
z3<W7@%7aUeY}B!38;tDkz9V`3Y$4l5zTX~p-EWBDjol0_CX3s2O9agw5cqhO!51{h
zAG-~=>8&foAL?n(jZ^}s2^z;=g`OC8&Cs$Lbxja$!;Yt1PW&I;{GEzNyc3mQMdEzz
znUw1~bm%q9$Ly%u<&=gBWSFs997_L)ny#DO8oQ79p&}1Q9O$Q<W6LB6yvzhW1i(Xd
zwDoLRg7Wa0I&>E|r??>x*1-$Rnbjy^^A2hfJO*`u#WC3`-0gO8Vw9($o0{XdEM_;<
zU*;}5A9WWkZW;wqY8nMcq8h67^$ilYv9AsS^C|W09%zZGOxcSZtKuRJcaWyy*1ray
zuYA^S+TU(|Zps7<L?qfxD#{*3U(I`Q2G^9E+Nm6r&(|=lQw0N(HPOvW%sL#V^S${)
zirv|oXM^@?^TyzKesdeHd9TY;fVVMOlT5DKQl<6TK|5Q?j}<Z;z5qCz8?;6eZ!UY_
zc5a~$_)^)D(gtKl5U^mWA-R5wY-zjL^z@>4e%>n6XKvWwz0eX%+_&L0!%Tn2qMr7m
zdRD95ImyUrFmp&#7PnYl#rV3eX4RH+&Mw74?7YBmA)CuY{nxd`ZZ@gAP{R9Z_~xY5
z6_1%j<Xg6vM8kfT;JCx1^<Aw*$zQBeP8$|;YV;dH4$66Px>2mY<ZLyM*NYt@O&vab
z!e=%0{KuAQ{spE)@;~J{LE<kR^CIsbJ-`C1VtF||?TscnpdF7&)tR8U6puo?mEFG}
z(>Y%!^$Kgowt8@{FN$p3RW^meBjr)5*yr^A?Bq*!q?RFu8x$cU_x;JwrMa@ZQCPIz
zH7{v=m+9-fOXngM?L%3;LN}5UD_4U1Ors@M4Hl}q?}!-R1U4<Iz4W=<o9bdYCTPum
z81X8w?ba<{kl_h2p4<a`{3D`y7b`&`aiIF;<%q<@BT)fDd<yA~Z!-jx{5;j4k*t(<
zHI=2+L!zFk&^(57Nn$|-LWK}o_XO81{bd$#iCVoI&2r%Z`KA5H#dc1#WI{iugQ;r$
z{lhxc_<LP3ITqw$Mf8*E3g@Q*NzVsbqEpWvwT*sr`EFRc96CYu2$-91JWoH5e);le
z$!oN}|MiIo5>B{R9<vf9(M#h@?d?dH<xXFi0qjSGf`?st6>KJ5+`=IfTSC*>nng1<
zPMp>wWE<fEb(rhXQr9sN_4c3WzHPnVK#1NyE(Bu%1N7S8lMxVgPm_7lwF;=GfKJ*d
za6P1;@oe-k^!xiz3dg}M?1&FVcy;Da_QLv}nP5hIPvsV2+^qx9NUj|Q*kQi7DOUas
z6Qz^od{-_5HwJDA*YV8UQ<}S_-{*?Wd(DizFO8m;1G)4frR+$9y6g@Gfu2}#u>O`0
zrM9^>V8+SI^l1O8lb;0*(y`)k>2yXD#vN^eDfu*RGZJiv{DN$tpG0ca76hphHkD{e
zG<HZHaVO?I`8y4`JsawB>;FjhVm<4Fc9)ieb+0D@ACs53l8Podd3>l$vpZ(`drCoD
z>&qz0sf7=d=<WtXvF!a@jMUTSscK(MQW)w<R74?R9cK&OJ0W))Y3OQwxF=}#HCt2x
z;d-i1;r%$b0EjAJd4^Uz%#|Ohs~3&4jHevkZC^Va)Lc8EFT`Jx*xpZEE0lGlHV?pG
zGB5}zF_rerxtL&)|9n%363AYVo4;8Ozu{}ByLW3}JWiOGlX&oGJa$g%2f>g@XV?CU
zg|QHXp&r33O~KQ<IBfCS$#)ZBS+QGvdVS&uRYh_Arwafgh#L#u_9<f5gN*y8vF?k7
z846jQV{<o6mVun~&DC~cOW$Rh>_l9mO{8ei*^`z)8(F=+Yj4oCUdZ*3CfMo6_P2Jb
zUiA5i6uVZt9K5;H&g(ey*1Lgfg3hUYypO{Z{0T!HAP;8Wi*tlEQfOKJZoaHTD{C!2
z)g*mJ%Nh^!v_V_MA5l7~2KUL(W$^+A)X?{GSEhd1?}6c&xDvUVb$=@M>f>U^bJ%WU
z3E-Joa-RMn@9DjvZi?L>uPV7LAzYeq@+^hg8*1VmTd_Z%+rSDPjIIjYTy#j;t=(vb
zNEOCYz(^j~lWaAd@1sx<1l$Z*WcExz#QR@X@655&&S%2sr}#G*#v1lQ7P!)OA8JVI
z%O7NSV#(pB88hn<IWww`8d`r3gaGtFwsV%v4E~#(1+L_O@g#9qbyWhrIr#_X*T*jN
z4x$Kcm=T1?vq0lG1(59Ir8DD?_7VYYm1gR76To%vPo)8zK6C7Od!Lb@eV-rV8+|s4
z1Dp|;FF08B^K{%U!9Z5>7Dr~~Ah<KaGdCdIcy(?uHsQb5yE4SLW^T}0!Gt@Osv#nA
z8$aI$qA^`5aJ5eB-z|JT)PR+*aTS(99$jA)+>T9s);ZNcY4C+6$d*2>Nu6Sg^~CER
zlk!I{#Q~}R3{L6Fze)Q3=zkf2M~*oB?V5EDygsK?VMjp#=8lWI?idIEQ>!DEFF*vD
z^wEO;q(rUyR0W|aOGez9maTUpmWT2B@FN}>GnUbp?rwQNOR)%IK28kr?Fiwz4jEny
zAx29;mJa4l1BUp42OK-LdC*e`cTB)D+&&*Hx9iSk07p`g$x;ar9#Q&%8f!{!4VIyC
zkN%VbpSYPz$fiPbG;lAh;9(HtPzBaILjSxvn^T`(etj_Og?&cB{!a+Eh5bClEOGF!
z`f1SZdgFqqv3Fql&EiDZm@CV7eswrpN+N>o=1jo7OT|-VHhEof6if}udZY=sYD|Jl
zfCn?5;H*RO6%)Mg<kVsWEjk}Hiy8Y2H$nTyt)7!SJ}ZA$KnQyNs|I{bG`=#UNY%?j
z9_S;_?RVKG%)UzT6I<V<31>ya5W`;QxPZ4<1utH<E$R|g=4Le~c=yyvOUZj@Zz^(N
z^m)6^I$*Gh`_X=RN!z=4Pl;|yR4Fq13iy(&zBxtU7Ki)ur7?KKNzOZUXRuRqZhc&w
zEKSSr*$XG_15AoBhm-=<-B;LsCv-PY`0pl)Eb5#<Tz7nQj16lzx)i5k^~(twS$=1G
zaa`yoyVs5K`G9h6%rt+NspsTNJYH9z(R%8R8b<G8vHo0;Emq@HvwZf6di?iX7oa}8
z^-^MHu9gBmK6VXyOrx7QzfTl~0k(5PlGF4iR-PuIo5q)WCFNS7Jyv{AQeSe>R>Ph)
zpzq;A4ox&0SHog-Qb=K0iEIyGIL~{lCc<dzrl557E62-s#w}SwJmjS^sjGo@?K<G`
z-uzK2TFcnAu6_`Ca6<fNN=5sU-)GL1A<$tjn&yJi^Lz1bD5Vy_b*>~i+?lkQ_ayDE
z<qGx|$~JJAhs0i;nXZ4mV{fq6MT7ty2kK@8B}P|xz4Dgzj9fsVY>AT`npB|0H}`op
zBQCHVCAR(gxptU#%Am~)Lx`7Ilhvnd2U`VMpS$bg73qL|%*yNg2gAq`K1W0(OGfJC
zp}p@|lVH5uA1>(NF9$(IIL{eUT=&ucfp(asq5F;BjEyvhU8#HLC2KAlF>ky>Gmh@Z
z+ns0d1AA^<Gs1R{Y?Lgw#2InL;?3oX)lK8_bC8vZ<YK>@He&ALbbDFG^erdpyn~}X
z$ykW3iEo2w?Uz-*s?ohQwy~~6>Ysh`?{4M8yyo(3JDps<!nqAy!N5^6S1BRGl#ExS
zx0@_+XEkra50)g>8?0lO!}I)kkj4Zc^}ZQ}s_I6yif(7f)$+{%FQ&dLlQk|%XtAL^
ztJn2W(>-Ow5-Xyr_ignx{of>2p`u9`28eosw@-aXT+Vxt-z}Sx?b}^BJu?w)jDUHA
z3>tXN#$p`cGX3UbWhQuDbeaYDt`wubjpj`tPVdw=oYHyGZib;6cQkM3kCJb;Rd}4p
zL*{`b<?@XrtTx=$VuxcR+KHQ^?lsiezd6A#CqVGvzX|VRjK9E*{a+o8{4R@|>#-=D
z&ju0_{KCfd^(+18M3ai*qkb+pOMepAZG#Mhsl00K{dd5-lR^K>hS1!fEa#(N-M!bx
zgmLqr#W9zW;C6SwhS3YeA2}X#c$x6owa5JMf)X>cPK9=;KK`aKkO>D)`vR#t+w}~e
zgCcqJ@lE1;KppZ?k}Q$PXl7u}>WZp3J6GdbdgI|xT9xzK8`w)mi$OWyvrjeL#`h@u
zw=du&U-KPCYb9}dzt=21Q!`E%`Lg-hD>G{KQkzhln(osC38-t-2Mq%fc1@r96DB=?
zA6Gi(v0-;YV{%i`w;sZ_04*>G@|f$r`@xFZ+?Kdzx%D4)4rP)hWj=d+urE&=^n8Nm
z_U@N$eMj`)k>ybO?Targ`}_~(?slz7-)WUK>6{>YpU1l~>JBOE5$!{b2t82CoB;80
zbsfOdP4<ut%{07G)SYSw*1VWwj9UE%PtNr(JVU<XSH}c@XR?2ge7np>-7YBnu<SB7
z_E(g1fb9+8e&$l>9O~P`yIXg2Q7Edof?bQ}X+N;pTeT<XW`_VRoEN<DTKQZO9A&Z>
zZ`cp8*22r7rg<&}NWmqOsBy=kHd`dFeMZIyuq!+=yMb&Nk9VkZ-*(a8rf0J}o@ZwI
zsvb1cn<;sIWLjTi`W7XE{QCSeq3i^m<4VoF0Lg4$b1xx~ZocDyfLWHLTeEG=uP)6E
z$N9P?<nz1}bsz3??3c&e6Lunjzr-*i^nZ^BOmr@Iqo~Ey6De9oV&|T*p87sfM_Do5
zs!~a@s#2G)MD=H1GO46IPji3-eVve*&4;0L_%B$#XXYaKsd~qd?a$E`t=X(lA{ldB
zz&9)7t(`898%KKhi{8v-^V{h2)!A}6>Mv&|@@W(7MDb0hvqGkc&Qmj@+d4g7#HNQV
z=W-q^3*jhj79dOeJsBc~)Mw<gQ0aQX<+?MgMJT$-%@$2WHa#Xr1F7!VJPObhBnmew
z>~^{J$knY;>L2Ms7doA^47ICPl^=}_m@Z>r!Q&~T>fPM*Z}FG<!Gp{tBKvwmy;?PR
z-Zw|asiTjH=M2%}nsiVH%M%TY`_3v;Hg!+%0KRH8bDg1l*`VVW`6>fwZESs0XlJVA
zlg_toA%Kc!%aoQhr%RiAR1i^T>bEA5skQGwKmT}jSs{wKSf%HNAf$H8p7nUXi+V9K
zZtdv$J0~>K9r5MnbFyK`UW|;Xd9r~!sc(aQx_k96JzKMGn_&m%;62J`lA5hujH?sH
zWelh$xDq#ZnBTr$#L6?*-Eld|>oZwc)(1kCxATU&ymsI!*$?Lm%L<teURFj*E%2JL
zF!@jQAb6^NzlAh0CTgS01@Vi2y9Y3tJyunAd7VfvF10!Tso{fQ0Yg1;7~E~AIlHoi
z(fcyjPU0Qyu}aQtsx9yiHS@`3F1<2e3AQ0;jk+c2=%O-+mkSIu9aV*1%?PYAz+fIj
zuQ!(S!!Cp5Tgn2v429SodG(+}U(S{;S1<5#Y~=t%>+&nFo`lz6p+3X1pkQq{F(;tV
zB3`7;b|wJXY0CJUxCdZCqMBm8e38sRQ_O8OPW=9c#(zmVMzzhqs*3Z!*0g*qi$QJ1
zopPgo@JNx0@iopzxed!q?`NjRQFP`6*iH7CzR?2Q_w_WeR0tj2vl;5Mczt15+;_w`
zzw<2kT_zN*tSwwVMX>y5H$mbMhzdx;>-lX*#xp@U3iFqjr>E22T;#&WUpZj6_?uKv
zs#{LoTrvWO`+)?0&-@5*DQU(Mh2HxCe9B>l9<@}?e;%FqNO-!%0fMMAt)<pPr)?#!
zD<hW^<Ea?^iwb+K<M=>A@$qZd#lh0l{2{&aB$LbhqfNJZx#0%4C+jk6ghD;*egxee
z00%XFF?=KKmV17JD9<zBkvnl6{C>miV&5>29L@mcus4`z-c*e&nrsn>As1NmB(Jbx
zo^~+@P3(w!;-p_%dfm(>kBs$T?sloXMPKz|Vx7mcE4{KlB0xC4`t5AVvV-3R%uY%>
zAq!tld~Xr~jelm$%7AjUF{LAxYAfAkj9So+Na71TB8z);FnC^GWX7u7pbRr#jOX>Z
zpG{HPAL-Udj{U`=p~lWBnjBn}9<6?6uyC%2<NfxyasEz{yLDb1CvJ3n_G#It{$s+L
zy)rG^g?4&SXjLQZO=i~`<PTn*%Cd>u^b6*!7j}q*ffMAv>NrCoC-wy0iayow33Xj?
zgbc6#Fb(FaADRe)-LS`L&HA2cxYMpIhl^@}toZ3&fp_u<MB%>GWEdh#Hlqf++d%$6
zQi}*er~(+l<N2+07kza$9Y6u8UdSece3i7AM^or^pv%TTf6k{4mEE{4F_=yvpA%^h
zaw19n(yq_8)4=x0THm%-`SdjUU@xa`SfMJboWVoqXbBLszuy$k{uME3v<wI2Lt+Mh
zu)Rr+sWI|ix>vTgTm9yU_BMO&)Ust^<S}0TkUp%^BjHO<<HQnKykI1SM<CSm;y1mw
zt&w{FiXw9+CuuEg;Mx`e4lC6^PRv|B;lfY{>{is!FDsM(ux=kR;D4^H-f!rjX~AB<
zr9k}z@m(LM9srWG)@g(0t(Pc6A=~M_Z~}UJ{yiu=TK^i!`<GaYp#tspS{&zao}6+(
zhmwITnAb){_4&G9Pse`sZsj*uMi9w8gWkHzu{^oR?<W=Dk?pP}A3T4$zxFE01J-vW
z@|H2tbBU^HIg7R_^q(O<4E+XcbTO*rJxrhupnRFk7_jhaL<z+jveraLi8Y`dZb)i|
zWc83>ck)RU*c9`>L(Zh3Sbvvp+<ghi>BSLJ>uqs#8Z^B(e=QN#Yol(-APv0&1ZOW%
z1Zt`@2`~+Q8t-tH*4aMkdzl{@cZ=AF<qy6f-lEpd+(%WI?P)a&*4_!a)c$g+UV`LU
zjmMrRB(h}Me|Lk6_dm=eKe2b@1j3MI!{2t?O6R!{EBcjRZPVk9_TnMO#x#HD84K`)
zyi%hin%7lM?X~z%<fRuW-#z5-3R;nIe`Bt$`G@`Ak!F**vZ+7k>IARAt#ebGex-!W
zb*<3&+{WG$_;6hzGn})`Xp!Dx`4_shnINA3)5rm7zSPL)8M7!lJ;A0VJ>t-3F(nKh
zR9-oS8~gh9|6(-zM)L6ggV8AdVl@5#dYx<{4tIgjmR;7P)s*|~!uSvA=Y&_VZ$q4W
zJ~35Y8Wr&K^^#GTYFK=DQ_B^?8!EB4jemCA5~o=GbYr_n?RCAJBTiG><0^_|L>rwS
zIpXq!{Ml^?QQS_`pVDQ1B;qSAD4nN*uf+CQoq738kX;1Efw<RIWjAeH<&c|pk#*Nm
zTAA#VXLXpl8v>2eDkA6jG9pcN-Y)*_iIlD_CqQH`fr&KTO0{U;&r7M?|Hl*Tl47l!
z5Q$Y$Hdx<;uu3=B)H8->8;BqDP3k$=WRV^<S<e<<XztLilE|ex9=XWQH;DE1ERmG{
zx&inuW9GXfht{hBi&}2*4@n$)#Ra=h*(Qu8YNNkcYqse-9x7wt=zIknOH;+86qnb$
z;ilZ_!FL5PG-Y?k%1h?E;q}!hZtOGxEEV2C<%}&MH9LUp5_qWtu?<t=m#gG<mBD@M
zFzw{^%jm|{5h2C>FT|4pAf7GhAAL|z2qjY_Pgm>dC+A&FYQjGZeX&$*lRL$a$c0!&
zX^~!-81N<WsQSfGAQ#<d09p)gheTyal$g=N;|>3vmR2KG599?(v3@S%4bex?3IQFS
zGqZ$Bz_pIP^qUSEP!>q0x_S*rc}}lfX$j!gt<7;b*f&)=uO&PGdQLi9^`m}Lut&<6
z++DwXtSm|XDhk20DZ%YDCc2aI#9={?6X5{Qk%$m{;ES&jeOu9><58VUcnOPosX~9L
zlE%9Tj{3R?X7G4d&%29gK?{5(->|qOtUBIO%akX~`b1l8drmCYi{sN0I%Nd1(XHdq
z$3S8kb2S~M<2ORI<Sg`=$<iGOW()!og2LB(fO}GW;4+PpBz=e3Q`*TZIwGk9zqv+7
zh=lKfqNTR1<5h}?O_h#^yLy+K-M}gp!22di0C8Y^{<Vvo#vO^lIYERi+wCGDmE3#?
z*{wRXcV9G6R9X30V%GroO>m&?^p=Z5e*tzpcRG%F!%+v#LnDoU)Q;Gjx`U7Jr~`Hy
zc>tX5jB0uw@3bWrI{Lhj$6XEHAb)zdY6E_fglg8ab9EX#a(91Vxp?mo3AuD=-2bLO
z4}C>Se9Znz<)bY!$wup>8=U~X<jDHmR^+_@`guIj_4OsnSutci^F6obLYJ8zZhtbI
z!2p)1v}sCobxd?H0IV&n<!N6CXn95?G|W%px7`wjq&v74!^_@RUxFR8=*S;?Upbi;
zc#>e8b(834$Wftx15G9hhZcK(v^~xfNzGbXXxxo%>JPwPG$fCW^FDp0GsvfySZ-XL
zd6jy87+GgO;?ORI3=lS1ywi+^*l{K*TRT|0?#g1ZaW=FnYxQdqtRW^A8w%=gNbho}
zf-_spX$m9;<qaoDiGgYS0ohg^2N983EX}9Z1C%pgn7uesOWZ&A|BE^4{$kE%U=N$=
zz4s$p*Xk(WZjjNB;&zFSLN&M*8zqfxglrX8&B*XOOlktnmm>@7zy#pmTjFlY%OLZ;
z7{8}U6ds8D+HfXeK1#)xx}QH?dtvJ6ABdjll3WJLD66~oxr(UNk{X(TaK*bB`r<Ej
zZf)EQVy3pE1PsB-F+j?=H!6PHEWoNJ8Oi4=wdcCrY~rR1sUq)|lOKyNLqz4P%QJDX
zDZG6+-1jaxrnv$X=%S9Ev-Q^0FE`!unW5SE_S|eG7oDt8qWLDxJ(8~ikhAj0VHqaT
z_3?Ymb~{cvK+=6;=#@wuY^pQ%JT|l9AUTo}Y+fjgaj_5+klpN^lJQO_;fYj`tvi9D
zIcTsNu?Xb#_6s864*-=B$3(xud?#40{4yi??xu^SlF=v9%NChw^h=_k-%)q#+~a0k
zt!{V)`?b$-mH;<B6heLya!&f;`Y0Vn5GOKsC<C!YdLZMa$?hg<EpO^o&rk+Qgm=3z
z|ASmzEQeD54{}YsZTIRjfB8>rUI}j($e{3k9wD>&aPRpDV5u;%7;4tAF4dC-P>bzO
zb{!BPobexiT1N5t{!ec6NYRy#*^gDcqa{ybsEs8q3Q2O^O5TdEaQNbg?fQK80F8uq
zF}%t91LY<Q`uXT?pfsSkCcm(GCQs|u$Zs__DmwC$z15$HuoV~i6^o_Xk?QkRn7mn9
z8I;GowCU4YR2}k85p494CRelloTFGw^ks(Iq{jgYld$VKIiWDPaxRc)-iGS2g^uMo
zP@NQ`lI(V@32Ak+5{}Dqyn5l>+nM1c=5Z4US`#&`@Y_=n+xtjOQ}GduEgFZ)VZma%
zn{9Zu9L}}68n2oxN5FNY*}pF~x!16Rblz+E1>p?f`2$dK+8d^1pQ$`LDk1o-B19(R
zDXj;q@zK-XS|&)=roCSH^;WiH3MQm0h_7F{x?rZt=qAD?vbrx-P=aNr35<N^07nPQ
zC1P&~LKZOyzucg$$xSU>y@4-fq|AYZ`$sGR$5!Y_gEGT#HXnPFNp};@_YB)}Tt0n*
z_sz)~Fh72jWpk&YM0ssIw%=Wg^TtCk0$-J<<UTZ6mQb>-UpI!~d`_fGeX#~4MJbP#
zu}G{0BJ%?j(m!k;yEx+TwcfSm`OyvhnwSxGdRjvw1(j51C|UMrN;SV4>`cp}RCZ?R
z0=YqV#@(34KzUu|Z<88dNO&fap;ywyblSfQEcOF6wA=?n8Tk@3?f9Pr;v`Pli&U>l
z%7uiXVdvMn(+H{a@f=>ei&r`Yx&mNf%dp4SQc$37n_#asmonnf@2*-qCWCH$D%^OT
z_NYt6E$Muk=rN{EfqB^RX|oJfyU@3ZCADOp4-yzL4yt0c9hFbmC^)pa5q+EhIEXYh
z{|WdAx6Efb$`#l8DjeFqLTB*!h6YclS4Rs1O`qaF7AQR;XWDVHe~@)2y@^>lonwbW
z2Y(50e_70Ko*&Fu()RZ<XS^Wgw=*{vA1p$gnBF76Uods%`YKO@jvnBRT3YnJY1*2i
zX0)4iJ=%8C5(H^2_~G+?T$N_i1Ex2VCQ@?$>)4UgOL=Fa*YzmCXu4scrX@IP$`;9E
zqnE`~k~t<gzbMrQjsAJ6+As*%poW!UM9D{KZsZ?2|A|u!`cirD6cPS_=y-hY%k?;k
z%}NP7#wOZg19C~>dkiba37quBMiSN?ulyfzVBl|B4t@XVDwOrT`C=&m@3rygZ+Akd
zg^_fxBpz%`d}fRK2f3pc5B{aEh@&4LJpt_A)~iTj1Ao!T<vEze+7_Tz_I!Ind;e%x
zISs<kwmIJZ!pi{Q$Pnn_Gp;a0Ef2P6;WfSTV|WQS`4MpQBwmI3t!9IKR&RzdXOT~Z
z#UMpKTo^Hi*Z#wHpZdYtn5tyl`^W)8iL5?BBpLQa>hB<po`;!&gzp}Z4%RlH0G|4=
z4}a)9L%Hn$c%6{(ek$Fq>PMc8oQ37AdK?a-_cv(W#hG_0TTa7JkC%YDfLI`5AY|n=
zs`AyZH|PhbV_GdnWzew0H_2}j4{Rc#!f2&>7^`*c1~3|oiLgJVxppekLM2<nd5eWk
z^<~-^iv7}p^$aS&-Re92UgG5+w+e1tf#3dKC?)q&&j|v>h_mY(BQ$g~(tg?x9B6F%
zR9~Z|*bQo*<v}f3Fe}~KPt}31>S~IqN|hb8=1k*Jm8P5~dZ4N7jJZD09yutq$Q@rU
z&Z=iuU&}9wYKu5)AkOgO{`+o`$W=vf?QXD+G5zIkflYva_U$Ty7FYz3z#{NEagb3^
z^gAh(S~(}G!#h6Vi9Tt^t!|XdwL3puBOgI)xl_IDNo{l5e<G~KPET3z53!LVzs31;
zHkC!*c}^&7AbO|mRy3+h`mv0=={5Gaqw@V5Sm`GU*R+4#qbH}J99Pa;J}(-0ZO|W+
z$x{k`@oT)8?Uz&atdkC@T}whtN0{&~ASE~tdC37aAn&c%UQKlwr?5hDFeTt`LjCaF
z!|J87Pv_PX6e2vmZAv5dwh{Eo$=>**EskMLdEML1wrsE&t}O3N`|z6azs0Bi&**Qv
z-bhLR7Byb+GCNi{)xi3M>0bq<3Z+goJiTes)k>-A%1{>H^x>X;8Il^cD&zVMMTR|%
z4&3zt;$84emnQ<i35XQHtpveE-g%J_|DJjH)S_$r4EeMVWj`;byJ1JQc$*L~%KAZ0
zh;RReV^}yTm_Z~VM_b(>F&FUNp(Ftn>ry+UzIF<{t}OR^<4H{w{W6s;eiF>k$!*i?
zbvlsSjYCR^nM`48nPiT~QW2K^6$Yxt1$Q$Hzo;`iW$3;!_(XW7^%4ITjGtzT*6rP#
z#IY{+7aNT5XStl5PySNyh3N@zlmjt2H-!hho}JsDM8m!sZcI{omQF*Eej@k<+zK?0
z)tKFye`W}zOdTR?wcYFk39Pq@BJ3bG2Hl2D+(ir`U<Y4COOflk_eYv}kQDK3E!0rJ
zT`mITeKyZs07nb*aS4rP%{}G53oX6qr^MG~j)M2<*;!mflB|JY4%PJp@&3U4d}L*C
zzdJed##!^UyA@R-cz0vl9vT=y;eqLH_eV7|ySu(j6ieS!!WZnrOM+Ya-i}(&5a1nh
zoz2IgKZXhaPELTj0GmcGkm?B&<=9RA1`Ge}uDktPIWyV%CdYR*7V4u`L-i2CzN%zW
z?ML^nAGsDuV4qW#^t`;uZgsOBH*E;o4ZRccLNtyo@!L$2Wz)v`NO?|*m_sl?{eUSu
z5mSQmsF6_I^CR^}9L71t_Si=D3r9t`PN&+Ff8ca{U$~+x?(Z)vHEGI=9t^MTp^+3>
z_8D(;T=4)Ck?;eP*W{Z4?HC6$K<-hTd9ToNiAFJEFlUu=jrxeAWFT;(`C|6%Xt{6L
zd)|Y<3Gl=tnho?_?*$*shF&0OzbvI;?sK^_kR1`Ul@zzx)3%_IfIquG3U(g&#SFv?
z0_2pw;-I-+5~JzB{dtmy{g3K~1h%^zgpA)+So`)K`B=tRe1T1w-qZn&7=(K;Gpb3i
z*WQ@wp6+w_2fxO*0Cvs`)l(<rd!;PB_7ra7J$k}l)L8uDTM6ID(ateauoPb86jvjn
zzQ~SDdka_38n){sQFw<Pv(55%Ub&tBC18)nl>K)UGWUkG?O>{lCF17<`!06nKW8%l
zRlCq#X{^{e&9_QBeb@r$ZhcunYRV)v<;dm7a6B5l+D1larAPZCnL_ruw6MIF#3I@3
zZe9w;K&)$<dbwHVU#c}~V-;bzOmnUFbSt8GtSV7CmrIM1dNBMi!d-4w?0-Xci*SD~
zD1VR=(#v`>;96?1=0wE?iHUq4*X%tCq1nw@u=*etKNu@sG(dYxORzzlKg=AIpa|@I
z^u_W3K`Bd_6Tq-$0EUIb!#Cu&^sly7P;GR8kfiSZvZBcv<n&&(J9rN8z^v$VHq^|x
z<Rg0X9~l8$@R;y)a4!`FP%8T-08xh(x2>168@ZhCzyFp*4FU9=C0n#J{12x}W6a<I
zK-I$codrIi0v-G=fAjKAwJy}wDa_zryE1WlOTH2%s;sYM!&O>DK_|3TZQ$i51>VPz
zhlIi~)HPRYabHR$Oy>~WQ!K23_L+%Vwl8pI{W>&ust0Hknu8^Y1u5U@>o|;%716xs
zj;Se=3jfVizjtyEX#$I$&=WOU0MOQ^V|hBgWCUNqaEe)^$fI8d>J;$G29vCXz=47D
z=Oy$@WEg!L01aWL8Q45pT5;gk+X}xn&6_opz)o^T`m981m8##>Y<TTR-K#28ZP8YE
z=Lg`OKUp{lIaI}YsGg*rFF+UB9ujq!zI1%{rkY}<L(w!3G#pnaq(ot=l{0?WSu=5g
zAy**bWn^#p(#W?7o}sZXY2<}|PR?CX;MPp^F;D|b7gAT3U@D|Z{rN2Rat*tEmf*bc
zy_S_XVmZh;mFMHclh8l-!W9e6pZy0?#oE2ix_oY(wO?0M2kQtQ{eJ8+wp(<Ng@YOl
zrA=C>SV4B0n7a%qLlI$Q3tkTO`oC&(fv-lZ_LDasu;4kWIyDb~QzcDXeMnC#l=Et#
z&A|4|2127XfXZ*_Gk^9C_pKCs#0!h-DEt-JxY${@0$%4f-~K#f4{Ly2wHCc;2Z$Cr
z;M)2lVUC7Ysp+W1m+I~=^^@L6fE(mER=({HfMMV^@4HZDu1ZcKcfPGUaCx+o`M7bq
z0XGCwa#W9I2_pRxSAbaEs`9g+-IWrzf)u(l*~?CPx_aKG&WH@FDp6?4j{rp-6-vfE
zA=tx(8A5$JHq!7oibcDgSuxGetD(gCKMjXh(aR{-S9h>qVB+AD3Y*s71&Cpq471(M
zUPxx!w@@HiefX0xmaW>GvhKVCuiDIoueWE)sJv!K_@c#jQHIl7RNVKZ6k!XyE4u((
zYUts9HDc+c=Z1URv}Mtj%*N~bs1O8*r%%rTWw<G<`|991Zi`~R7t|+@sj2nYfxP{M
zzWu^dICh0%^92~`U3Tl@IorBt5Jb|Y8uRG3laKtfvMQ=^a#7LD1jRJhn=0)w>1F@Z
zxG)+N>HO{;&IDAY#-3_^Sd%I4ME&Sm5xNan-AOD<N{;Kze}%j~7_{~*{&-s)ar9a8
z;G;e@hOk5RAY>GX_;yv4Lq0;C@2!Tj7`%k|94~n7F;k1V57u$f_&My}V`zWr-r5{o
zXh|O>idV)@xM_zFnC#!36!_C@b;7S&K=yo*1(ki_-L6a7x2ovUgoi)hn;C<;MhEM9
z2Ot(-zm!Dpl92ORgf>?1qQd%kiFJc~fU=179EJy8S~J_V`z!fgDmPs4gMeS8Cw~^C
z0R_wucivf*PsGHo`eg~_h-%};0>T{dd?8I7Xd5ZA7Teg~vs}`8U;V(RnCsrIRtIN#
zpS&O!ZG?lAwVRu8hg5DWQdi@*y*!D~DnFa=)_9Cm(|%;4bnkX?)QeccrxumI_0a%_
zOO8p@<Za=ZclP6I3KZ8ggbbWqu@%=iy$$CCnGr&Nhxnk~8r?%EKHY@6vwS-5GA$-M
zV1Do0#~xLD4R4k;M>TEVTfq0;6|iXrY)a@?+=>Hx7U})8&UWQ-5h%G@)9+E-28o$O
z)qyRq_*THQ>elJ9<zsudVL3Zpw-^KW841%;OgoYE-Wa*Bogj844MG;S`OI~;Fr~Ct
z?xC!-$0rgkn^teSR!4-SZ`ujk2U0|A-`<uKS~<&jqdrjV<$<c<?tMTd(RNKmRcePE
z&Wz)&qNZS;kX!n7zm(maWqY0uZnDxnb5UxXf6HVTdOU3xyv3egj&DbS(xAVzMa#KU
z-)fv9lYs;#vWPzHpSeF~>8!_tb=35{_WhgcQmjWkonU$}kY6I)Mm-}?7fsIQKhR!d
z0;WEPu0X{D)OcB%mC<>9W%A}cEF4e}G~_IR6z(IQH_7go%W397%LMspd$jGEDi?0N
z$kCSsj<l|&TkinlFX*zN$%&lF@Y4R=ZKXTlhyVZOEA;WC@74g7f;!!^paqY&k~de?
z9mCz(tk@^FwQa_EuUMXvE6_#U!T$y=fi;mkhRB}v=iy(sgG=69zCG{MU(tFO+}Z6U
zEQo9z16w>FQC<xsT1+(WPm+5L-QW(~k@P|_+xVO<h?c@iX3d*~Ww3-zky@xbE5iEo
z6gwtNKEaL{DT7YK5~qo@lcljh{~p7}0cK!cgByr9IL@ZGo3=a#2(#Jar}z^2ss-?Y
zV{L(Q7pjUSTusm=^}w4US~BM3sWLtfh+cc41M~axkDVop$`r|5zRZqs0k)?_J%{Eq
zoW^%PL+4Loln0^rP3?qnHYki6YuZo5`W@gmth8VL7zRJ`0-qLc?-y&8b6%o+D@re;
z-PYQlpztDg0|ORgsrYbqYAH+M&Fp&3{719dmwDd!R;}9wdbaBF#-Y__TWJ;(7ZW<P
zfua_NgAjh+LHRr;s$NeXh8XFm7@tTWbJjKtAm8sUY1}ql&lrZsS<R)B*VM%geq#Y8
z(&ibxC20+3KzZO$y(BARJ+bozP?9_?1hiO{zvVKGXi=lWa-X##ow3;28_1>3qV%{v
z);=Jc-J%9fzZRS}mOZ};SB*?>>=6EO^B9ltfHq=PXvXY4gBa(N(pUXz=eUnOo03&&
z^Qsynt2W!8pId}Cc`H2QVw#|rwx0&toPb6-E%J<ZW)ad(TeS7&gxXa3Wi$mOvzt*_
zgTCcAmG^+M(EPv=2b?Efg|k;juH^ptl=y1#l=55o{9$FAv=36Dy$^s~tX2_ZNb~>@
zd^Sqo2fWuV)1~YfHR$YRJE&gpq)a(tA7&-l^8Uf~pGu`Z;FdK<d79z}k<1*|pHNwB
zBg?*4`y{QLu7Z1VDu1<jroVe@%o4D-(y`O9E8H%u@9G&Sa}Q{S`;%xgiI`%{z6hPE
z)YEE+;p*=rVf_Pj#>f?gI&8uUJ#q>A3=RlyJdXEn?OH<>=kn2>Z{h^PM2dwm7PAjX
zo4(2~W3Q5x+%q4!EGjhB736V}Z59-rIfzlEP6fX2c?DGoKPrxv0CmiMyjENbf)$sv
zQuU=k(d@b^uLG8h<If0aN(P!$GXji>^ZkL$S?cGw<E1+75qW#eWNC&CM;v1NK5DF#
z{GXmF53GjaW{5)fSIxXy&NsG3BRCkJUiqVA#Ci)!5@C#LMYmsE&0_oyKRW&~9I}33
zNqO?WI{~48TT#0h>^}UzuDPhSU<E{&JrEWH8dP5q`^k`K#=WjPhMZ%_J7W{m`McuP
zmDGq|{qc52e^uX-^aC;Y-)9{8fqvpVSIIo{7^u-UF!bK*ystz+`_GvUH67dv??QHm
zfGs-zD_k}CBw8s$0};GW^<BULOhKuFHWI}QnIJd@6L4T98yBy|q(l|<qif5RgU@O-
zjn}8G=UHwG`~SUK@|exv20JQ2!hNyd0=^YwnHomm%cA*sKnO2Jn*853H1n&UpS}L~
zsD-(Iod6d9xGN?9HC;aDzAM1g!5Y%=%;T<Qh$6GU0tV2L-q9Y<7?W~G6DG2;D|fKt
z0H2*{tZaK>v0*>4E?#}GwB2#K7R0DVj%!;x0jV--!W?*$nbvPrkonxEtTyQj`uL62
zJjBUdfoANVTLEe^Sksap9)6Zg!s?5;1JrrrCPO(v7~NFf0eb~GO)qb&nVnxxz3r2r
z{!HhF{UjiR=>MEk`Oh=>|75D@AA<D;k=7(hoJ=F4P}dhb<)eU*{d(|gDv%^)(fjvm
ziR~f@O67l@-HE`7BH)(Q)$J{-|K3RP$6%6Xn8EPzQ1Z0Bedfpr(imwKEJCSWmaWlx
zEx9@1RhN)joo`09LPX5+3d5khQI}BU43}%m_xilxh;}5fB-ZOyo$T#D)2ZmUC+pM<
zT5qr>$&M<uhA)2XpHEP9$#vgTZn6dK_@n~J!VU%UK&n})W!9Xt|L2kZ%Uaz2;o;_7
z5sb>Iqmm}#-+rFY@cO?$-|FB0QY$$5LiGQn(EEXZpKI>_b^8T)E^hM!@$(J2n*?AK
zDBm{Fw}_aGD$<Gh-!{7`^Ev!K?7e4LQ)|;Uye(KjK@>qjih?47AiWb%DN0j{bWo5c
z9i)>)U@J=R9ik#2(xmqUm0ks;LxQvb0YWGVAtZShmb*OPe(rad`_KCw`wvGBlC`oj
z*LBUDGjq;N6{E1?V~o>AnMKnX;OUKyiq*Z3NH;<Ny|(c{|GC)16py3{uy%V@;+CZf
zSKw`}y^@|%pr-_&*U6XEQNHRxJAQru4_&{gEgq-(P0)9SfF+I>e}IG??0^AFJlC79
zEg-u;OI0)Wszfn&{yp$TVC-gm6$+9C%p9KU`EvH*zNUeHb))|AI`7oC{`=5fKA=Tq
zm3wF5#vbV;mvRglz4zNqzc2Dcb_e*MV!X`ped5)>E%Coe_n)8r{lh^n|2+ohAKb{l
z^y2^hF*uFXGH(=4N6(w{2{foBh^B7D!O}cJ9&hJZa`CQ}(z4-uD=baHbDGnq*<N1=
z9f^A@oH*ieGE2ouZ`tt9T>(Q&fAq1Q+Nxi?9~2R$6*h>j-W@5TqP^+zve2~*U{3bF
z{RfYn;8Ohg;tp)TH4XG&JEn|W{piPAiblP06}M?)hp*(w{g03T<GTO&LecDK{OMgr
zp5lC)8Ox(TzU_2iX(liK=}K3X==!I3LK*-04FB<7|Ng*Vautm}a4N0uID(2&f4p^P
zXyajFY|v~)D4+JvpY;cBd4lVX!4Da{8?83{DFfw~1?cwMPp_sk^0=IjxBNGu{qDPO
z@!h$%rW#$ZFdmhE>Bm*^TXIJEZ@7F5Ejv#AIT<8;mqG0#3BkmlGGM%n@h#PPKxccf
z-Q-C2nLoE|VA}7?){CEc_jB2-<+X>d@Tr;SC$IlG8F*g&E`y@fh_H)4WT1Dj!!NTy
zZ{*`yrFG`(d@6r#+5X<Te{bEN$Mx^6`{Zw}`@_=wt#$Y9|6A*Rw<-TW1q>Rojp3qR
zk^1+{<yUJ6k$V)LOL>B_e*{oKjs%tlfr4g1O_T1&eyUN@sXZJq#D9vXSl{tNhqm;b
zo*VAzjn_9q=yAj2E)n_9%w-rWMy%bL3?ak>%Q~mpR#T5|b`Y`s%jm@bHlT67Z#{m8
z-)+>IrP-sGYU^GvfS%~spCO~kDZBdKq@aBIo$yNefNE<b`*c}vOVe}4;?{v)IYt8p
zwsRKXEl++}^RM~X5)8a#?2$v$Va|XPB+e15kFw?NFW}%ETU3RhW+YGojA}A*X<*bQ
zlPqvRm!=l}V)&Og8vdqkBd;1}s1W$g`kkdtH%IJ^@fp6#Fb`u~QvS`VLhlYNc*%Bv
z3<26_&j7<oqD)*!x^f#`x=xTxU2S<!(`)x#Dd$|9qt&N->YN?QJY?X6ypqQKbj_`>
zfODkfx(%t`nb&mBZpvWAR=gXXh5a@cY&tU^Pp1fD<u+PWIiXA>{6zMsNQ8mc(igr%
z7G7WtVdaqR%>ix8I(EwE>gU!!#Qg7=_FvHWzW__cx>J|=x4G4jtIma|F8p|7muvqX
z9`h^RL%W(ciS{`u5=E@*tpUBNoc@=0GROQcJhJDkE2v#!E$K1F*gjb3oh}#Ea^&P4
zr0>1(6ssj&1LYWELoLb^zs$IOe4*L`c<!QbOL3<(j~>B3t6}guSn%v)NIh}rc`Dwe
z@S|DPm;$7BWLkK)nZ<HpFsWkb!6lO4urWrmq}TlL{Ju^%v#t<M$cYfn8jJ9AM0|DV
zE*C~yYPH<Z@<n#p9a2)s;1C;?tMwd83Fy8joRd~GupK%(?o7gTyY)4bc@2vS>C(M>
ztoyP%Ct_B;31+pGTZ`p&Gr16aIsAYn(ihE!t(o*0c(3+#r7~T|btkmbrAzzkGq&Q$
z^9J;f$_5rEG4X~=ES+<$C~t(>OoXJlgS()*V2#F`MqlBJh}jXJ+d>^@B{t^^5UCe{
z+pUaP6|=Ll*n9a>h%Dh{J7)1NB>cEbmP1v<6`|I(^ge-<gx`;I6=hF+UnF|x9NnK_
zzC7@o1C?33hw)F{rL;2fpo-BCO6FNHH)$bG@VT8+uW&Oc>kd9y8}82*r$xKPJmxGB
z+tV9o6n1NpAH9P$eWVj&<qI&-urL35fPSpOFnzXHjCSX)YI^jr$C7<(D|eK_wRX?M
zyGpE+UX`QsZ7Q@7A+MDZ&9nNHg{AFD7s;qqSul#ZpRhdXtvb)m@15eGnQV)sv3wV)
zJ3pME!ULi-aZdv!p?0Dncvc>532g;pRH%CHqHMEcSx-zA!g4Odn|$$5I@G3QL=Z&N
z-U>F+;q+^7zG3z3tW5#aZSpdm(5@tWcPZbHi|$IVNT*|hQ?J~{!*c_e=#F&;`GL%!
zSxi9#WVvBjN%}+e^%c^xrz<d}+~tY}z|C`{tcP}lVr_=D2aQXp5Y<_AAh?gNwwscU
z2n+Y{C2+`F)mTH%LL115YUsNfnWD5uVSivz{C}Jr<Z8jj`JX4}+P9OlVOhxivloD0
z<@ZzMtF-<?F)iF%dik??Nq=bmoI&*d!Vu0;QFFh=r-uwSJ5S$x@rePG5jCAEajb4W
zbk`#I`l%W&HH8>gr+O3GQ41f+REOFu11P{E-Pa4&ak*h}v;Rm}L*&Y-Fsftwt|Q8i
z6fxotTXpi9UlCVR@Y_6GvQea|x<(n*rV43EQNov%>Df1u9ypGAe%c16*o}3$TtCdr
z!&&wDYY00FKgB(vzA*`yd%u-SY5^vqjNA_yyk{orx9V*;H%HgHDI=BXJD+#R8uIoj
zo{2|WNUUb(9SDs86~lLQ@E79bQ?D@zQ7%ga08=>noW@b7!xDOzNUm$={hQT=7>XU!
zMgS-5MM4?p@Anx$k9~KTO-NdKupi3ovjWYYPq(#nu-)Nw+Vk}py4YN<2_5yTX;Ct}
ztspa4M3Ic{u3xvORf=_DR3B$OXA~8K#ZBEHNJu{lp=Y<sW%s`sLa*Co;an#TG%1cS
z1XqZck|AeBd*#&YaV-uwbehZa7;cnvDHbSD<zy?Mjt7vV`Gq2Y4OMU}#i`aaYB48G
zf<o+Vowm^4<%YnwPwrWfmi5j;CXb%ci$YM0g>wfe1R*82T7$-4^87Lr%5+F;U%gm%
z-y44*86%|{ZtgM}Vc9E>@9hL;DN6QLjJFuQ-NFRa>`*8xtFoyF`*dH4y<5IccQtkr
z!)U~|t&8-kb*^xFyeQ%#P}fE4E3d7v<%47fD*t9~-)XS(;8u<78f)7U2F`}9lWn)5
zTpeIb*4^Z`z96O}WnH=nF1xuSk~E&hbr8Fm?!Foi^oZp~Nmc}Pv3Iyt78@R3F|?y8
z5F7Ck-ZRGbP-(&b0?kS6&bY-o7|41deej50vAkRkgLJ?M5eWij{(iW|4<W1aTF)r9
z$HO<}wFcm%l~mMB%TpGk+1!$`cZePp8*?sr1m83;5(OY0ERLNKUutMkW)tYmsDK@p
z+y!^Z6Y6oE%%6c4oCed0CN7~2rIfe0FH&lmJDK9chO(G}#3%+Nr+5z~zc!PeU8ZRV
zK{VS%QLm;%36g;@xed7|3)d7!Ef5@fO*|j$(zR2lC0xYi`|crW#p^}41Us7u)^p+&
z4hxlJ?~`u`e=wJDFG_koSriFIXB0$GWLM$n$fM7C42*~dzEEU#ryLGw9?-n@wO4tE
zBY-$ZZSkjcUah;1XW#Yg62UCT1T{p-tt(O*PVl&7UY$&$J7gN;qCs9RX<#^Ot0>nX
z_p-O$cFx+u=WC7B@^f&SUh3G2%h0&gJj^9<L5zG1hpfZSgQoznl6z}(>2%&oQC-io
zlBSc0wjH?9I?#`YH<jA$e2xe4Xu-N<Q>Swd)z>qMvk1TutI7B@t1lz~aO7ag&)9Ya
zv1kyx=q2+r6vsEH=YVkE?tHl<1zLNZzs@+Wdj#Py9Kjl|Eo6K~Vsl8&jzT${Wto^_
z+g*h%!}j3jO}JU(8#ZGf2oGq8+5%<MB9&u)GXW+z*}J<fZ{U~ZJ>Ga|_g-X>e{5my
z9EWn@So}%=<kAlFcm(dbT!yuCz03TsalL;*62FNyX1*IP1^WB>KO;RL_q_<6gZ0Vp
z*e^;*&HSJ+h`bqhMrt8wp{DnPX5^X*^DpwVpTVpL;rTc0_dpw_u<k)u>eCZ!+L9=D
zt7EmByNB|jgz@eyl2#oW<F|@%2tR`}4qmbUy5r!|sj325#xk_>f&H5~>aa<NS5ld}
z?!CEhM4Oy)!Ebq}>|{S6=Irigh4~ru3Tq37o`d4+`UiTjEZ#^@69o$})TJ7?bjE$|
z<<jIjk?zp3o}eNR{p)4w0wsFst`m!z9oeV(-omYikFPtSs%nJYRy=Q5hOGF{27Xv#
z2az9ZEDx0V-y<w64H}VitzWfgv;BG~pH84`bKPxO7`(1;OTe-bklqGN4@Q>Un|CeB
zre>eAYzZ-A@S-#qbY07=TIr2`Ar6d`kmir8TyQy7HXGa7glo|5HURC61osiX%v@2n
z$?&X{+G&fk45VRxSCF4sgQXyvjcj2$4evyt06w+MK5dXMz#__5Kx*SAwA$OI8y0kc
z^2a|tq3dz3q~0cf`Vg`_`I36&%B_6^3cML95hoP%OWv(ZTQ*_bbYNL!Ne}AvjU->C
zBpz(nH57k}ABZ=9CcGBAFX54{1-NJQK-!ABE+=??6uc4bZykcQ=?`P`TlH7tc<WTZ
z0<bJ!cpTmgtHV0)ltw&8^)7k4F~83!#yR5}g9#6X?r+;OpUIR}*j)==fOn3p`Nsu$
zR$Bu0xGaew9DKGT!N81l81;EGn|V+Go#Ai)IK?4zcaCG+kwDtDX14cV2hC1dZNzlv
zCR>IsnXMDQco9JNt85Tqbb{|)H|4XTZ~7Y8wDStjL8oJIyBpL($9Jm(E;}=xxctFk
z$NnB2le0eU#L+M%is5Ln-~3x{t>>Gu!7aK=C|wIkcZHROWxtQVN9Ur^%rJtY3Fm7l
zztB+sI=NqM73hbp2lr`zxv!+N$A4}k0vh%X=49^k6=9@?ur)7QVCl!Ufl8CE7vS<M
z!rpB-)cH&SedQ7iCYT1aWX%*}ca;ufjRrhaM!~9c2fKe8lK<vGI@rSfExs8b*Cz2Z
zrVVNO1~zVs869d*O80mtWw+H+vifmA;%MU#?dR$MS`8$z-`1_=K-SD+jD-YJ?r!Jc
zgZw=RPY1>qebGHwr1L~TQ&*$!Yh8>oqFXgtkd`@c)v`t=K2e1!<K0ZWui7d=u?e*=
zW%M0z7uG)<KT!MPXsk<pU(V=dxJffG_E_&I7*3sR%cJ_@7Z<$e+nc}MCYxH8*iScR
z*uL<*m#I+3SFzN^KV77%@B$KyjIuS~u8;2!g0FSlmU3-fHPLX5ADK%u5vC(Y9!KZI
z)I`bbJlU0dhjp1*Gk1F(5j<;OK8$S5jE&lv%p2JBEn%|T1scxG0Cl7hoBdD3^s8#V
zAp7H0G_<$}dar%bAiD2td{`h@5#%eKPP`Vt7jl3rOK(UFm`2OdoYeJ^jMzzwOd9hO
zuHD*_JjP~gS6YiSM#~Cavl6Ijf8A%DCvBV^<%7xdo?ZmeNA(pCNzkrU7g+&EDdH3T
zN`}iG38<7Yk%8TyuVV*50fLB1A^5fh$Fh)w>EjR4$xfBhq0P%kXlz|>qm8hc|D?X~
z=2B;9^KMyd5vk?Ss9J0DCg2gGmByD|E+aCx0iaFuFf7lG!CrbRgD+gx>*4G(@-T>k
zQ%eu%C~0;k+CE~)JI=BN-5MOm^{H|;9TW8|+O$}l@E)=6bmUnpW?PmmdJ3G-0kxSB
z4iUU*zq&+!r$p%DgvTLe));xsML!kWeXI6muD(m3!aU^(sKO6N*2;QBOwwTykr^s(
zf;nOrb~Xok4ULkPWOkAdY}{=L6ItA-Ubg-P(PmD2M<W8Ozf<%EtKo3CJ!x6a;oSB{
zw&i5ae0QWlx~4QN57w};!q|r$&7EHC%etLcenwMPzmgmYeJ*UJaMq<^5vd`+B}SCj
z1V0d7L7=`KzuuE)q3)T@SQ*AgQ=t2~*6+5HcVkVGt*2H-u@-><Y_^`A-n0D8I@P3?
zH}KDg&HXQ07)<7}5X8w|(A~Ze;T!lm<6WCvCm>%gs1or=O2pUGM?v2(T+tldr7l#*
z#fg&zO&z4@A$)jfhQnOF$F6QE=V{*_uCSIcCVu9pCPTFW|9?(u>g6QAcyZOLN(q{S
zgzgM3uD-0JsGzBghz1I<cNUEiJ1FXOOWHGi^Y{HyYRG<c_|Ssv`YA%lZy(OzG>O;t
zeUE&cdQzG4<FYmG(|duBdztNmYMIw(p`)+VFQ)5ZXsXHsXce8LwhMJW&R#tlo4axQ
z0n*Bk-Slj;7)?VY7HkYDTnvyvxsy8<4MO_+JD9{Y_7z(mTx8lWyBTes049u9`PXmZ
z(}<K)r+9?u>n(aeS$2yLwI8q<MC&>VZHPW?bE&bTEVFhLRM?xHb#k1TsQ|v}M)9sL
zhoJ_c)S;?`dtO3*n&8l{)-`MjR)<e#cq1d_@nh#<#c;&c<FPCiIgAbiZ58%1Tjet|
zF{+%GCFWqtZN-Mt%c=Yq$m+VZvAOpF(llAX0_ghEI#WHv(2E{`S)z=CW}ADI8>Jhb
z+#lu`XUbQnYMfu+iZt3fyvV&O_4O6-7$%O$tCfpG@>SLIwfr+cPe|D1B#>jJC(!7v
zhX~J7X<!TCEU^gRS$)c2e-NdsEzRrgi*4{;fB(oW+H-i63qQ8e7$E#KC29q1X#MN-
z=E*0>QMFCw&*Bm1cGvlZ=B>l<(aet)5jsSr10l-j9;*X&gZoARP^nUEMbg_pM40fm
z-2~Y#FJSBuI88wQzyKWIQ8iT9+@M}abl95XSac9JHxptycae6m2n&}L@j`i!I_%Ta
zBi_QddlTD|2IxRNa+ukU=fi`9EhK3*w2VY3T&|j99{&~)N&=>4&fYz&x3h2>T60@M
z$E!Ht*B!l=;=!|gHz62fHZm7^S;ZS=d^@>*2qK~Cya_bMpYK(LY3J*<5t9WLEW)`m
zgF0+szHWGtCudX1g>?XeOL$MbT7_f^E<Tf7Mcs4{0TZOf7#`&MS@`+-oC|0h>8sBt
zZI-XR3Rw+<7?}_Ohp&`H;&HgHmI6Ps*<(ip3Gj(p&XTomH?P}gR18No5M(aHfZqIf
z-5LYy41#76+sz_wU3bCjNz8AOgqKUlhej(I5aS-ZoWrK%qyU82`i=rAaz(PABgw+g
ziDDAH6FupLlGwp7!pN5dGNGIRvix*AyOm>r7wW5Ke3v{OzXUl?zL)O4<c8axiPFdO
z+pr#P58FEB*JBp}&yuRt{sVEV#_fY0w3H*UQQD&tKQ3#GGT2L|8b7^M$3@Ie>*c^)
zT_?BIR+zh9ox}Rz1{Q#hK^4pWj-!c(+I3w8XxiT8?zt~w{f|?1KJ(MS`}NpwtDoQC
zFdE4}5<X8;3fhZGQIit$KYff-kKT<{@Mx{g4`(;3tIiqPso(gjZJET~a%hEj?#!@-
zzX@~Oax^M;={|CMN#NsSd!7j<M@`)=vQsw~QI`slqdN-aWYTWc;=Y;7_25xe!~vYL
z;(PhS?FQHy(=MP6dr`+2?6=V#gHxoo@)D)|v7Yw}%J7GL<yFtsK;;O#&`Y&F7t0un
zbg%8kDjm4;VBmGBXm9m3X2bih)UqzRjCwBP`YQ*t*-p?2mD_Qo%1^%~UkMzuL|7Ep
zI4`GU%&>8rcQ46<_FVV?-9C=~kH78|XOgh2+$!~n*rc8EFICxm5l1pr4i#tWu+;;e
z{TwP=OvJCs32M>co4%n87|>!uk9p=@jYXQHVKz!TS0zxF5R`I-2(E@tT4^lGmLu;?
zHr@xwv_3A1$PE*!7Xc6|KERU}16lh(A_mazE3TQB!3_x5`F~X=vtjS$Rk;}w(#sC3
z(2C|#{1FGd@<*6Xi_xcgqp}@J^1k#c<rkdBfF)`D^G-|Zj<SzphkF=MlU<2p_fC_S
z*<9cpdqL33jQrc)DGsaKWNcL%#2Xt1)C9bKq~1h7PI#^<IeNju`%B+pJ(aj(`j?WD
z#=c|c8^pLHo@AP<x%T+xqCNEpi}p=B8QxAlpn)(BEsVdjIX=O_BK!cum?%sex|87s
z5vXpw;0sO1vx(YhSevBgaTtNy5`r&~ZOR`$DgvoJ*am#h4sQf$b$nw3^)T+LRqKj(
z=P*0uVef6KYxA7sLxlbSnyf(^%cARv_>7J>#}S}%rjC!+jCS$aEV^%4^q2;=gJuf{
zy_s6^xBfta`V8!QdLG9&{xh$=jiddR_5b{kg$GKG7Q4R1RAG+3nV`K7LDXVn3rK%U
z3m?zBsI=a~9m&$Fu2jinr#@hx3p=qlby~rK{kFq7nNGR@0($I0)m+wCPV@xe-F6Ra
z2`a4{tWxarqhd`Av+uUEm|}>QZm&Vb2z;?Gset2!*Y$+cSqKPzG`D00pElo|k9Bc4
z)SmyTVGvz2UgY2UjLk8&_#H<@&5<LOXf9&n0m*G8(sKvzhQd_m*Yjah56675V6S)K
z8uE7&#LIMPZE|D62<<B3f-3v8x#@Bl!v`J@MuX;s=<UueIOe=Nlpl)!981ZUu``$d
zNWjZF5AmEyqjz7wMJ|njCv`<tHQ!^K<(8C`@)4y|j;>G9Jbo{GL%xp6=Y}F%-RQPI
zxTG$~!3LM729@mvN1W~`Ty?CpA0C0!mAsl;a<JD~t2-^)b<GNx?M)aVKdEOZg514%
zMZ|HTo2btAi~%Z0FCT!qH2CJp&ihwYv!u%T=d;C5m1Kso-X7@8Y0aXFq0^@ZdMh{2
zu**Dt{<Jjd3Q+0If!lyZIYC*>CO~^ZY2VX>EB8&wwjQm3W5O0CWgagSG#C*)-+W{l
z2v>2sP2W;wZsv!1^hg_|Ly=Pf((>GIY@a4-OjaWK`swKU<1-ohJw5`#00pmcPguaD
za07jh1#66XQ#2&Ee-p@{^jIWEj}hjQ%#(`!H%mfZWAhp|h?{5<<ZIeUKquD1@Gjrl
zq=s8V1S#V+$g#-6z7U>;t1<dX9{D|vi5Ty9!iBUM<|q6CLB6^62`70tqYP<<$#<02
zg%Ff0wO*5N+eiQ5|85O_ZC<)F1}0Fi_Q;UpFOhOi2OpyE49*(-Af~jQqi0RiUR<-2
znC#w>H$9-;+T<ncIJBwQUBGueW)BP0S#x*h=Iu}_??u<wM4P+$<rmi4oO?WVmpE-?
zOUOIu9QNcT7tt{9p`l82K$`PpSzl@0T!OjZD9v7I@3M3AO>hyAA1cAAq_qIkQ%>+5
z94oO3xwOTkw7$gn91Dc(7NDzuk00rv+{a<u56zfFxJ>w?%zX75BIPe8nm?)uP>6^`
zPUwMqLe5oc*Kbe%YO(n_mdkgEE^5(J4TvEUgpQ8hC!<uNCjI7faVu4*hp)DBY~$y`
z${M!}fw?gae4Mz3%i?qK>}9{K<`COvJ*;0L?Q=7VbSf|Fvhx(ve?@LpjZfF_BZpcZ
zR|reeI1(#)|HX?%TehJ!a{qNY!B{APxl<(`#^?X4QI9=$7c%4RF{rfudL^=$>Zqes
z`MOpcu^2VnJjE~gNM|`{U$9lA^nB<N3bTZ@9eZ#cmBh$x9+gRo0)JJCJ0NB(+<MNV
zh2}uZA<|yVuguFw<s6Fi#n8RodOb<wjl%2XZ#gCq5X1tyxwHWAh6yq0Q#MjV8oAq~
zEx)quGuwAK^mPIku^Pe~8nlN%cXioMm8w}Ak9of-z4S+{`mf)uy0+Sw*FUVf?l-IM
z`A@4ZVpcdTefJ+W{Zxg^me$p?F#)E5`G7CvLhjVu3sek-6m$_lm{<V~8H>Gu-fM>{
z)I5eaiHmp<JRj+4kOFtVS}5&-{se0hRIQh854ju!%X?i|iIk$70ZSug_ClF%#wd>s
zk-@BFgAjTXezi=MtRi~ad$5H)oV$aU=C$zb_B3c2G_c6*W%=+mv3z)G%5{tgB=4Gl
z7TAnf1l4?b%xd{^wQu%Cs!;>lU6|1Ck!b3$G1x$yZS#3ao#}Qdc(7vZK)!^ZBuxcG
zwNfaq>A=A8<Ni<!u?RWHPzsAmQq4ROGUx5V$3+G*k~Tsz3(3WNKt9zX;Dyv;ljw%$
zr=pq*{fI=ZQ{x;x^0s%nCasZ)9GA4P-j;HkpTVaDEDpAVfO3uMsgGq>=2(nf`$hme
zwK2C8?R=N(X`60xeYUPl(qk?ARG{l%8FtNAc<YO<<fuH&a&Fhj1->Wd>^v@czPJo~
z0Li@69}3-iRL!C(So-X=cfI%pFNn|b<u&o;p*MDgWXCvKxJjP}Ecjd4B(9r}hk~Gz
zi`}*JgJ+e;$w2b>^>`)1p%hzvPs0&rK6$T2-+OC^K?T8Cw_NMF^$yp=@?aGRy@$#Z
zkiwyJ1{PpxdMP_X2VC_W#B|sFss4p6Zu@xL1=q~PsxI@O4b8!EmP=oRm=c&<-&x;W
z|A=^NbsctfMfQ?j)XMMA<NOlH^G%VN`u|LS?j`d9YT}Znm(u!0bov!a>5U|TWJ%@1
zVPjn)6VJHonh9>R4R<)uM8_U*jH#5UkgQ(5?!($4$KdC4(wujE&>2-$Q4L;gKod|k
z$dr<Q(_ZR$RwVRpDO-p!0pn{}P}3q~l)OAHpiv2lBX^jVG+7QbU1jNpO=3hGoQw^;
z_)6TOhNn|l6kKXcTEta3+yV;T?{*N)!P+bAKo5}5J`O-l#wsqPyCw1_cyjB;%)3`f
z^K<z(LS|SS@Y8g~;YPL@4IdUN?9p>c7JQL1)4$edws1G+Bq+BDb-R=d9y-4NiM?5B
zzugef{@FkQI)Mvmjnj@euFgV=bU3)Q=cfRbbZ$h5(`g=TePehDQaGQ&1#V*Jm1D}X
zAYVoxZxQ2G2~(ZUZM`)Yl}KW-YiDyaU{J|b=o+$m?PJ--C(eMWzLKSP4znAJbBu&Z
zYL(9}4$->N3u4PE{RPUZBo)Dvo^wGhGidIcLoxX&YJxL2L!okImjBXPt{p=K+;Hms
z4gcob{6&c&I#HmnZAZ^toJRD@pW>^QeU%3&MHXfuxKLi?(tTHB%HWbi^F9)1jLpn+
zAi5>ZC9)0Ox@Ft+eAvCWoE#fy(At$@+a3m|et26=g(I3zX;Va>A+}AKIXF*|ds&l1
zx`9nPI1h;S{-(U=vUd&+7y8l(fH8YvkBQnL6_6UJu5YrcWgtsc9Nv|h6eTBzu{E&s
z1^IstRBbNp6o74cqFS8mT;i&-H|1}klEku6Wl#l*om}G9FcrKCidn@1`Bvs!n4dYk
zp|%0&6DVBL0Zfz{j>@NYNlNVKPUa4;yGJiouJ=L}Sogx*S*dJ-Ib1}C;)Z_LIiEy7
z!V;T0*>W`CF*d_{g_Z9OEN2OoRbD^#&OyapW8kYQKHMrwK^j_lS><xCWB|eTI{EtD
zN;^~qz}3vhUhZk<{r#yo#rpx@b8oG=j%+_Jn`-6%#(}*aXBI7IcAqwmv)m7D=>64R
zogpkoaWq2+%xo)ntv3FIuMBF49$1}JfylHVW4_0*{oQ;c={cT5<{&&0^D=+}bVO*0
z=5KwLv~hYA2GnGnM8mv&;UkGk>yP*IX+WlW%9>>OwJrQU3)8e={bu79Bp1j!*Jl?4
z@>Qb%HPV~a$}!#w47N{}5Kmz?z5i8e<;%W4z=#Ko<7Fx5IV+^D>V+K6SG`hP^l;>J
z8h3=^<ThpaBo8PHb!#sZc+ViMm($A*E3i=aNWtP@<iK^>x4An5Up%O08;#cRwMkfE
z6;ilz%yK*+uP|tKaf(j^K6@!lB`JH}E<s_sFc<kEmnu~se}d@!_^y2aYPC7Xop||6
zbZ&w`ZjLy83mo}^>6)f4<0CC4>PqFfm`-xN-;(Dt-?zL@{yQuNz-26Z2s4;POAnhg
zKhV}4^-yU;Y|L9&^YXRYuKv!}lGe@kFoUX)E$GJhNP}u`0GJjZ$+~5Jca8@f31m#b
zf{Uz`;}6O@)R_Q<Q+q~aJ7;&qz}(Z`6#D5ibB5|pCOw;<1F}UW+((|IwcP&@!7qq7
zFXNdC|L}Y^?~Ys1pb+sb(s#(nCM-;-_KL+|Dj@qOOqW1wX!Yh=kM8j+<mC*PsOOMg
z1^wI4<ub6nQ24|2$JY^JX-_}4qI!GeHUxy%UcVyB`vH-dQU%|-0K^S?8JT-V*30TF
zky7qdpH(7t783@t|8+-92b}sYcoxXv++D6|r4V;!w52XU?G@p7w$Qd9GGcpvym;m*
zOJ;sS#t4wXyT4{V+zJFGqhVGu!y>sqBRusT;}k!SHyEvfOn>YNZdG_jZ!QRc*x?Q#
z5l)!FIp-gCKf&GJW^d>FSble_(6e!WBxtAbJ!m(hTN&{)XgBjcX!ojJM9mzdT<J*!
zc6TmDojW!+raeD5PD@UdK_b^PSWq4z61%v&A#}!etM0OpF?#_&9%$4Q2apU}pXsq3
zZuejHx7$liZ@eDIRvRfyJD0$EOZKBPJdA+Et~WedC1esD<usFD40mo6oe9sF`M7bo
z^^2}{T(LGcBsT_;pZmbb&Sj5VktN~1Qt1{f11Uqcl(epr=9+=qCz&`m11X_X8&39*
z=MWS4+@(kS=Mm+lH6+C6ps=RJ+~aM*Nic}aC58#+)63Ol=aTkICi7u?nW#6euEL%R
zpU(?6%%;jkrw{2L4jEW~ind_P%gX0SkuH>sIQ<sxV&DB_gVdbiJvsENZJB0Wi`V#S
zIttd3sBA|p>s5$wszQ~2fb(_9U1pP)Z3y7f1R&|DNLl$rL(9AXu&14bMGX1YD=gEL
z#z1zG*%>IDxDx=m9@w|E=H=<XFj3>-B{)3mS-;s&=eG9BAH6XM)nQ8qSB}mA1d{N9
zo-^Z_`BjpV7QdFUL3u+<n-`|+i9m$5`ScAzK8a@i8<b?kCO1u770PX6nS{3nob^#_
zbi;a*>oHD>sj2G&s?SCtqmg30uBjVwgz+^Dh=fSx41YL|&x4fQobgXksng0b&s_|1
zyh#L>C;J0@Fw42hE4uzeAaC5$&C<Bd{y4FSe3<6>b$}w)3gEk#q<rV`K_Pv+RqI3K
z-dY~ETM+mqQZ}4as$@033aBThN$<tfhUh60MZV&NQgBf>X|)^-Bt2$5^{Nt#Rd}>z
z4XBBn?js5~K&PQSnW6pa7wP5S7$7eJv69f;X5r?_qu?CM)KWeroxq#7l8bt?`TD6-
z<@lTSB9>!k&UthR8*m_nAa!`qd(}9`&%6K@IvvHYrT_=R)l0IW9_#<5fI{>Sic!ds
zSSV>l(#UW(NWf<&$?$&Q(`kk@&#*nT0IB5DOAT^|L3Zrn>H84|7M|(~OP<EKwNHd*
z&tZn{>+u6Ohl^yJbP$FTLP-=c`dF6|->Q)u6G8y#00T0PT{PmYytO?ytpUB<+1@VU
z)^y_YRb35XuQxa*HSmM&4cv$o!^3;J&F}Jeugt@sUqhj^*p>2)L?bC|*dYTm_J;v8
z-NQ2<!+P3PIH4d;VXsfeCEA0b_8~2=Mwep3_t-H~HQL2;OtS8?Ccb1Kb}cmm9JO<{
z>ApJkq}8?&*I-n0qKPBRUZxK2Ysh?CgBqGAb0%$ULVVc#ECB`e=BU<C8h_2LK9?W-
z$(|S=*Bc3=Y@+QY7;b^^1l9HE09upO7FwW#8Ls5xI=_LG&SxqPN|w*`nTC}tybiNQ
zEe?uci2UP14a-3SU%)r4Yj!T4$P+r_w>1Zh+~jO29Su8=2c|E@0I`ppB`)Hgn}Go3
zb?=cx0A3_DemL#p>pkB~K(RpyiG-8!<MoBigaSMDya<<ytrq3MgkCqAcHO`w*X1yy
zWVwnxM=$KL;J9;{M>gl92{?a(q^RgCF5*YJtEmW{^DC+5tMAE?Y4_mXY1CIHUK1r?
zlUjHg2^Je6LH1$3o+(f2aXOjiEFy6t9q`x9DkGy5STkTs!m0kHw*uFIcDkZ;811tT
zMJ49TwVjzM<0FulZqafL1v78CwL8q>h}}j~RP9j&y%8~^4tw|PRay3%(Q>)YYqr2-
zztDYX^Lse*dMCActpEm|`rtnU^r3%lv1^%PXgw#+PhRE)_>i*8<-XaGOEJwr+9rD$
z0%I+H2n!Qf9~c2wfy=Pty;rRB4=mVQZ-ue+t8EUOOY)Ek11<xU0F|8xfgsFYU@P5g
z=cuoI+({m7?sQmy4r13>x30mmt#P^efTS&gmwm<{znEPXTWY{zs(n~yqd>updcYgq
z>bM9CWMPOfvdOH_*#$Jvb1Q#NV<SNuuU>QWQV9NJoaOC#v$_cIhnppWV6C?nmpdYX
zllSUdqUevGJREfn6)>}fJDoNqp|pPVB;QYB#rEBAF+Kjs??(_`5j@KY-F+ZIyQ$Hg
zX+(RO!}U&-+)E>~mojhl8x*>86+J@uWamGWw<xVMMXPh$vwUsSgD1YUy<)+jOZzF)
zXZLJEAFS20n{UDgP_oSc_s3D^;RhP#NKq{ih#^&CG`UdiYk!JOYK;+9UFdA0OFmMF
zhN81pe1w=?3B)oiY?V6m-i7JUQxj;CwWSu{cDM`cvL6u|It}C7HvRQ7V26f{{K+H!
z#lfMkiMBKN!TVMjg6G_}-Ef_!Ti^#RO%L*Q1@!omr!)PXUGDHawe{y5_fB`ZG`SJU
z-g+nvK;e0@`u8aMd-(YHl0*Hq?a;949FVzzky&{*kbTZ&G2R6E-{13cZ-XOj`#te8
zt80#W>%6QkkGy=ZE3KF7(#{G}$}Vn@vCt_Oqcwc|ZL^5r(uCvsqQj=%)}|RWn_>1q
zlr~ILVzkuIaos3c5-{gM&=E&Wz+>ViS!;fsYvfN1s;cN7QMy>k!|{dc`!F+6vYtU?
zM?a$$M%5KqRJoa+IN&AQa)((YMKsELmc095>xSy@0HprKt9KE4Ymc#Th@>a<2GtBE
zj7ztKpN%WdjNbz{01v4b0Rt49^40^^u06-x4QL-DZa5tKbcwN1m)J6F@+Af`3`7@l
z4a3oyRPA$avy_B6%Ws&**%a6u^0wtFsJrQL|E+Y%4<;SoTZzpM5ZeD<)Sc9O{|Epv
zW~H(9Nz&Yi!gxM{V;9L<;UOHgLNJ$ex7E3i=Q7^QzhScnDLAdSuv8x@R4xw21evHD
z*Gk}WqwQ$`_;h`_*pfbKL7=Y`wy%{V9G=TDe1BLRQgIJ}f`JLYnA6HR160-H9fr^4
zCQw#Y;636>ad@an^_%w;AP&HoWCnR)eRI~*WXraedYIGa@x9@2;?hI%hr?OZfTyRz
zsw5qeI&K;biZGrejp$k?8rkIQ4HLc~aX?R3{h(RCU4KBew6ybPj^2N>^f(*}A{R?h
ze&wD?bAjhATXbopG(5ad%~XBJeW}>o_mv{;TPkTW_d-N8Sc{onOV@*YW;Hb;z3%HF
zMDa2KXdl~LBwxw*4o}QzOm!$Y^(`Q~fFIO-B<W(C)dlm#^WlJ5>v}Hlx^gMA0I}q4
z04VJE9%WUI`Vndcpr-kJAn7&G@g?Lj%ATMmgm|0T-+ASbxyZ|QwbqJFi|&e$yquj|
z=Y~n~0w?Nk2E+N;Nq{#3P>2aHSj>HjcJx|gK@ZoC3r{{CkR)YX_R`2f!;%1Mjxxs(
z(k~4)CuDfJk}y(eTLAFOG~s1@M-;Y01A&P*Rm{r#u*K$cz!R7B7Y#hyl&>WwvQ4AI
zgi@f|Y*Ek6mg_wT@@3ejO9@Y)#?-lC3uT0;R#(vc<T~S68Yz;6G)zM86$5b8t+Mk=
zEZN3EX{SM(YYo2RPCa=Z=pMHvKJ-0v$lds};!BfKAT~3~0=IUTL3Yf%3t}eG(u0x$
z8IA%{*<Mg)m-h<n1b{pV=$x5f4}I9$qf!98Z9XCYACU}+5uvL<;CoIOoo?1L3i(C^
zSC=pbKbip~Ed(WvTg-f1mgBX#4OZC^WEqeccj}*-2-{lp0FqGrSuhK~(WgMLx40OY
z-m49$X0OZUyKDWOpJt|R;IG_6!+?w<Fagod)s^m#go)gad@EbzJp6v}$7O+>HQypd
zB1eHD)*-D9K#?%ixZmM8LY<@KN57h4u?SGmk;=cQOFN(mB8O|LT!npxm)V@3lb%oK
zrwfQ|3v$Wg)vGV6>XpGbmNf3t%^&(?agKu%te0j$d$mWD5P%!Q2-ym;Z`U>_=4Et&
zP(i-eaD`Q<E`oz|`N(4-U|7Uc0UzRnUGyl_HfsUW|Jn-BJgeIl%ojKT!X<Np5N-BL
z(y`G_26M<<w%Z}*u+pvF6qPW5rl@S0bJjMJsz89L1+FG)+3TUQlZ+)e8HuRT=g6xK
zxp|bQ%%(g*)|eu2jNNxTV79Hw*l*;;m89#HVOMK?m=`kSNzMUGLdT$$nxuFjnQrqH
z+q~Y_j{uq&_y8Q>>Fxqp+UN4Mk73rsxH6xaZblr6st||ZdU&1mW`&QbZhM-VbU4+b
z?IQ)qK@P=E#@qAU*(|ea2}q4foV44JV$lWFboKK;Bs_TMvy+lL-9SK|wH<9?1Dsd|
z2)>LOmQofogX)3vehL9eB9nr}kWkA+U24tR^{`nX!85oP3~s$s$VP~4N5p<?I#*VR
zPx<Vj;*XIX>u7iTNk;s?uYVw?%FBYOC@vy{2jbk*A1>i%<hRPwt=c`^>A*XeMi*NZ
zr|ZGGV*0X%%U2d;ovZo>Qh7fZ{bPFHzQ{KXsdAY2hy5>4`L@B#pX{0cl{fXk&1)Fr
zzS<v&)qW<~&G$zNalR#K6w|)f-ntBoFHHU1#S-7Eap+C}jLd?JcorTPUP((4x#LRf
z?Q1#Gf25k^yLjw$zx&Wmer)XNKP6`Ky`*H{9vQwOZXKYXIsuMY1ab6O!%k`S*OvV8
z_7v#|yr3&UUbK2TXAs$|z;<d6{rQ8;(0@jnraz>Ky8Tm_C+tpr%TLJzRD9#+_<#KS
zXGO*D$$Fi5%m4kyc@8?73jBzSy}Ym&7|Z_1+;b$h>cnl~KalbGAs%4419zCd6?vG$
zR$BFcF6<uHU0)}<{+{sM@87cj8s=NN{ap-Z;%qGHKlbF?BYSD$y!TH<gJ!S(suTXt
zXZY7Ee<t<*mm~5LAmZ;4FotbOZvW7Sd&J%ZCSV(B`2IN=)Smn<1B33C=953x<;vd9
zxp&3!YdDuL-76;UpV0V^Et~fDW!oBsn2P^gwmr7UMH=7;>t_Br85Dg_R}Jfzxt07p
zO`&@yHi6be3Mi_&e!2PoBF6tkO)LRPFF@(|f-5-<G=F^N8*}W|-&^<Zt;?nOEhYN*
z*8N-S?ir51weBy0e{0?EX7T?;z#t(1ty&Q`mqg9qlKYdmjO+92!JO13-oBcRE~0M(
zu>}+N7@{0)O0kJOv!e0CgeDgp><9p=2S2LQ#rBF|9EH2Z2IkMN3tP1ui5vFg{gYp9
zXRx1db0AMQR}BVKrW@6RmKtu!fQV_grprWsK#lvQr!JEK;`ft&AfI^M24>Y`998`1
zx*q)!=q0qaD$C95JEcra^Ma;jaQ(zHg9kf&fL}Lz8z_oAkQ*|3)+Sw;Go^m$)ZIUa
zZ=NXnpHkzF0hsryapx`w6{%BlqSt=r6y7ofmcn=)?(&PPnRf;z{Oq~&yFm1BL$|;o
zMxeTm-Js$p^80hxY456+-3Jf0kB1`z{~T)m*DwAovmZz#&b+(#rx5MGA?orJz>iDo
zlfCwD|NT=EGgeiMuJ<$@y#2ob$bbC>{~0g`N}K|uF6wvqkC6X<`<WFnM*s&XGT->W
zAaxr+>P{-y#{b3r_ya%Nj(wlf`jDGG|6iB-m<AyA?gjSbKjkj`+cOt(bEzR^iXQ#-
zbEBAc6p;Gah66vH#^1m8|5G9_J%M9m(yCwhUy!;eAa#i>@B9CSV-pD+8%*`PgugCz
zr%QJpMF+gggPauYlCshe?JjrnQlkH99)4Rb{ZAqN+cN(2`YM^Wfx@)unJ9%&A;hjl
zT84@}kb$`X14qW2S6}?u3qX2&`TDv4!sc1IH8tt2QfZW2U(Q7oDC<d#x|ykivuX*q
zFQa>;Ejd*4+voES$nTEDe*0grS{X9RI~v?^2*9LC?7MtbO@Sb{F~@QZ=q+%4*2$fp
zJ^l~e@;B8`Af7Aw`fP@5Z#t|a&7~fBDOb-gdKYLXQQ7`f>hkXq{eS+<SXkq7S#Js~
zl*`w@hPx;DuRia-{c)Fpo(wOZc>THX(Z6mnz`6pO*TuVu_?MSU@%~AggYCSG00{c?
zr~k*swsQeg@5)M~6z5+*x*D&aa1nX-k7fLIxvyvfy0>AH5&i$|F8P}~>p$#^z*|fw
zcwjey-Z%fc9DnK&UpDM1-zwSZfWItvu4^v<!N(o3^Zx5{FP8+gFWyTvo#8)-;dj1u
z>8@gQz{!0pTEC_Ee&;>D3nvhN2{3xd)#v}{m-6Q~ej^Vp5Cp&Qa`L}`HIRE?ah%;v
z;jbT_<ePxtZyhX`{X>HJ%@2>I0cOv?j=SfN6rKJrN8zW^axn{B%)u}LleV08XL)s7
z#fRx%^ksqUCJ(&(t4FjkN)b4q&(f;##)ubAwJUm~K#CO+5zH{kuduW5sY6C|j`nAj
z^!n}Aa3W773db<V@iNi@^ZC_{y%HQlm&xN+IVm#e2jnIkz^ZR~dl%bGW|%l7IUywm
z2fB~R+;d<2OKTL^uDkb;Brj*Gk}zRnLt<p6R}yt1$=pjR*ps<~5ojpDH@)LP9eY^{
z6f<68kd`zY?P00y689D;Y0@DYLGVOd+*B~3l6bbb48OC-y;E+D)Qu#V>iAIGvgn@=
ztJcdP-JNRODh7wb?Q>HkKu@W1q{sEd`RA2#?5%$dW0%tbn~NFw?5u4%pCH>~r?`Gj
zh?Gn%wp2fE>s~y!Ym5B>%U4gCyZQa8WP&A7ZX2(QV=(MQ`g5GY6qG4Jnq126E(6SB
zGUwWYCPM{A(7#oM&AI>aC#j(TfY;^LQ<K{Y<lLnrPde4@0F5-l_;MDaVNH|XC=PVG
zx8HbXbk<+fm}7y!mZo$0NI#BcPIE4`F3Tp2L#w>xEj`M3<<A!G?vc3Tb+u9sr|6#W
zcTXGBjoux0C}NW*$d~W?3e*Ffjv|v^`Fwp!wFzA2vn)|&i8^gyn%!<U2iB67pirVz
zS(nE-n1RFm$;_4huWXd>rui#-&Fpl()qIL=yE+0G_9jdXpwm-Pf&k2!nQ#bi#rsRm
zOPVhm4z}lF#lXjE0q$hH#Y8Z$-dL&1;qy3Pt{qeUdT(A%>Xkk2Hc+wA-mwETY`N^U
z3|F?UY3KqhN0RJUxxZpL0`WY6N)4*(vo5NcsrL}dkFWO|nKE>$5VwN+va}6@f3#!L
zuauPZ2*3_l0-L8x(#(G)0SAohYvz=|up&$!BqaN<`fhMxNmv96z{`9VFuO9pv^`in
z)I+#6t`bGzij<|S?VhU~dsJum@N2Ura7I;WNjWjuht0f{0)PU~Zv9h(Xc5Pe)3}KZ
z>I+Q>LK*16_Xvo^2;dx<1r>lcU}?*BKxeWhV85L#>yhx+knJuPo*xk2>x<JAA$i=v
z>&+5ynf30@Fy`J;&3x*4+!{B*ATcauRd$6@{c43{$r<uahUwX_;G_&f=*1*c8I;8C
zQ}lHG21&m|-@iUBqqQ9%USCW!yaH;?hLkvRBy&iwuSmHxp2dA!L$8x{lKooQ{hNR`
zO=mJ>x}(iL@d^h3tioK71&cO_{4jfU-iF!OHD=^d=gMpKB;P$ENrae;-#TOoMGbwm
zSK?!UB~X_qX{t{vvo+!jq8V;RpSXKhkLkp6@4cpvjg4Gy>fY2Ptgfy`pFDM-S&^oB
zs!aJVBO}wz>(}@7xgeV}WNopTY3Pp;R5^z9h|!&u8h<ZabOw&lux6jzd5d?hvaJ04
ze$5aD_ShaXlhH+rV&pk$%p-k=G;qDvI?LrLO=LArmbj2rvEH*J+2DaiYxdY?J-aH$
z22H^tP+aV?Rcop@K)k6~^4WP3Hg`3uB5n(VSX1RzP-jBi0cMt<!LW__cK*W*?3?gl
zmxircqPb8QO94m8`?J!3GMwv??NG<j3C4@|2wWJ|YP;l*UzR|l9a6+?Lw6}8jyknh
z*Pmvq5+KO!8Z=Yc0Cjuji6hlBO%m=tr@sC%tarrs7}t|u_8<AHe~fNDQC#OqU%7Wx
zro*Xf(%M79(NwboMSh}}XZlGCBl)s!7YpSa!%a2zHw)duFON2~cUt%u3yOc}W0hh{
z6gyD~4pE(Za`cOrZd^-YmsixG0_xVVg^10>342s!+RE9<?tG;lQ5&sz77M?jjOF8X
zq}PEM?|6Pr#)aKZA(L$1PCqZ{<BpkPZjnp^uJ1CK&y4`es@!?JjjjlfUc^P5Q)pjC
z9YyjSuP)Xtetk|MV5Ij#wz|cI13S$$Ay{OYI;&X0BXks-?2Vo)I$zjOxbfotH};yc
zy<49>5!?Nu>uWdMI(N=eiD(!5k?PuI6vDzr!{oBBMzqJZyx}!Q@{I$N9%u!lTCY{7
z17pFROFqd}b=U`;3+15+GjIc$q7Nen4u^}N5>9!FnfI?O5Ns3eFLTw{CoV>qvax-h
zO|uI=cr=@>NQgf}M!~tP9zWK}_+gh4zG_D501PWOs)Z!yv!-o7m=m)+QX-F(%ea$g
z>6!N+=rb96`&t|a;fwvu!)E@@1|ycldbLBx&#`wg3&Xuu9-S2_&~6e_IidK=zJq`9
zPhi0XMK0fyJ)1$ky(5Yk6k#>SZ!14JvyQH<YcXu4AE?^PlS7teu`|$De;8-oOc%B7
zxu5tPH(BR>J6L7#LQYNK0IMMhAm)xwZ9Wh0Y1=;fX>Lo>+%4yMHOYOp%>oycIH~A<
ze3@O+=Gk!P<EGo!Rp7*V{>8Bd&8BnSFwd4H@%)EPZTrkQ%m~XV>K9#*S@IPaVb9fm
z9k{5xHL3l0i`M06)1(OIUkfn(VA=B~5<+*zExgxshhKeIV`akToDXijSe>5cz3?8s
zjvVu@zqJal^PPAg8Exu6nt9DRakeeyQ};=k-Stp(L*vrtl=G*8Q3l5soY(CNqtkJ`
z349)5!?M*qeI8|=7;VNB4yUnutF;@*=k^b{Nd#=1O*f`ZVPi3;){`|1Zw`z9Qe`1Y
z+>VR-RdM}|UCiOXyaM|UmX`h!IQt@<e7|w&U6py9uvLhUdUra!?O;61=Ci1C(iime
zQD_?Pki!1sNIcqQ$1SVCuw()#D{RBy>L2HYar?1ASBbpV`1Cx8*U>}Pm}8SghfYKB
zqpj}Erwv}<xmE}=g&P$Ftg$BtzVg*f>PNhCaIm<df&U7!#v^2f=zE`fSEpk+2?n&X
zds0t8%C7g-61pp$*Zp4gq=+Vg#xZ^VBWn;Z)5A7Bh62Qm)9(ky%AEw#pkq8+OA;}M
zujo|{eDbUF3NATC%R?|IeelW8*O@57XY{&!!r3ndM4XkQ2w-)Cn^6H9`bH!QD_~kM
z*<BG;YDK2JqjKu7fa}bHsZOm}I0j-r_NIb;*kf;?Ql~?4arFNA36w4+@Ofs3q|=W1
zSPF7h{4}3?WxC&^^Ld-D;x)^q{0;WCWF)xG=aZlFP%-r*+YmTe!dj_`^5}Cz=J<ib
z^lGDN&Y~ZN5-z|wfu5tW$5D`#tFRHMfhi<mGaw+k8{b!3A#(q|srHPQipb$B2JgOZ
z@vI8v96uGXGfEA|-R8UdI(}l0JS9Jh@y@p|lbQD?B_W=7Wmf2EwWsy64P!S%dj%5`
z_$}hoYuww(1bG4P_`244G7){X|Fu52-G-H>dV9LFezC!yz9iyE0ENg~`gnA|%TD4|
zkT1%*?%ILBtgV3?C^Dbqik6Fsn`|%v0c{~Mj)IatguWan4ec(%sP8~dR8o>Tq$jfO
zz=x?7ZIGGm{?NKwqc^*gr|a*#L0=zo8ZID5gII;4cY*v#Vq}JKTMH+=%vY?@Ybg9;
zWs*yVu<fdzFTRG?DRT-gU@oG)X>rX=Z|CG9%H>T)fqdSu!yO}_{cUb~tTv!U&-CTj
z;AI+|NJ0?inyKBBB9GgA*p^8^&#2o34kv3sMalt&4Jg9%he~3KF0k6I<jfw7h2n{=
z{rTRubv_)YZYtQ~Me58lUMWqp3asX4kq~XGs_zZ9#+@4m4%QjO0@W_9bmsJa7{3Wc
z--<l*vLJ*XwoJJUuTx~|>tYyHtdmg3J&#das}u9>u=AZ8WZ_=7=iZkg(?SDvm_pz`
zXT-nRhmByXC^tfP!_I4i%0?n{A1Wdo!dT$<S01xZ)>b7HBZwlFo^ib0aUXLtoO9(%
zTr1^jmKUTi8@`X$fU$ZjnET+)rU-ky?#@4O)#Pz>T4!S1%Dim0(vog&L|8Jyaj{dP
zkpeWTjd45mOts7Q;D13|oM;Q(e=wHUeMtO{glgnD^P>Cr35!pAqi>x;kBQqod5o!y
zSgw|xI^^PT&27>z;US6wc4l_*8TowFe5wL;!@p|CyhxnJp9e~4sJb{ps+#A&S5O^(
zhM6TCgO4rTm;{g3U?lCoRM%=nCiy+a@*0?(Ww{BuKV@aEJ^LZtJDF>7{*vLCHtR2i
zfuEh-gY!IV@lT56y-0ilzZjt}@<vZ!7bh%oA@q`&=rlzy&Ay;&-ZT%xk#u!U1a^{p
zYsmojESPFv{1upZr0QB)Za=B)TvL;tVP3IAW|VKNYvpj_6x&8&Z$ZW@VcAAuwO-)W
z#*Z|;FHi^S@sUO2w{O2Q%YP-edq+P_JhiGj`qx1BD%91hsow9UvuNB{1OsX{Qm?fh
z@~5tM-m^!RW>%#iBK2l$#G8d23ahdk<a*ueE-TsrDBQdElf(ZTFv%EzNe8t6Xfw%^
zA-h#BJycIhJjU6Fio`UA+lReT3=Be+|GK|va%u&r8BiLlbU9hV0iAtyIA1MeEP{O3
z&0m_~P^|aD7gGu6-JyBU!<os{0=ucQ9P*|64PKL>UX^u1oP{R*2M)DtxjTub1m@{7
ztG&|I-nax*qFb!1RrpViGJfhzEP5{wbzoRzmyrldhJHNCo6OOc)W+w#p{y|+qwmsi
z379(iLeh+vhc~+3a;|Q=FiSV2b?zBkhu=UJjd|UNc@lmlLFQ5$$haeue6!~LL%uz&
z$8^=Ni0GZkgn0Su@z|lcr85pyF;CtcjID#1R5~XD3XgvBsXx|NaThdZr?mKh?$L>w
zLvbYg`o#*8=YYTWBb{*xGfnNURpa^#-o}XW2lk<h2@@#nrx1p;U$#k(l_>)(w<x=+
z)Mt;UW4Kjk<Ftp{Q^oUV8!GbW8Ux7^E+fD?J-DKA<G+D(1gBcPoF_|()pyeGtbO@N
zZL;iC?zys5I6rJr)okgBlsR<#%vFHh9b<;VxD-Tpr$NhSWL`Fiz`%HEud#t%fkfX8
z+YvWt<8dTqEvrJr^^VV)*R4}8<$OLHLWO<jN3%t|kzy`#XVlDzG3)Dlh^T(Gv07Mk
zwg9Rbq%^e(uP5U%B9FT6d*79<zmF7k@4r>kfMZ9HuV|(Ym2U(c*w85M=S@Rqi?2-7
z++Y>YW9+){!D`?b>#TVdWNx8Vc<7vJOcq+AnxROw{N<A2!B_`H$krpzxgnF)=z3r6
z7v82Hj<z4?>CGTLOaT%84}0$w)#TPjjcx%EDIy}c0VzroX-bt23IfsulwJfxnh>Ou
zNFt&l(tDHML`vvAAfi<1B@iGWy@k*NgmM<&xA!>b=8W-=vG?8oU3lk+ukTv#Q|2@0
ze3qvjqr@zbN(=`eAq6d<ejk<%<l9Vmy9|Gg1x0wDa=gZ^2UGGbb5X&<gfiuALOg!b
zy~NCGEH=Y;7orBMK(~^AAHbrTx`=pWWQTs+hrK7-9KH$6ga5GPJd1%G1yq;S*ydT%
z<#dFND`YeCmTwtz^5C&3eP*$*jCZwEC#G@31yeC}S>&x<S@e|G<jr|>KHDv#8fJVG
zrJX-ZrpA18Ks09rw5e~-T!Us|THIs5686h)?r~=*ZvCW+*8pwXW}L>CYo6WHdln}|
ztehSa&QLFhNcULQ08u{j<O?C+|5Ph^I4ofyjH^<0%ijN2J`ET8+vcW?9nYVN#p7N9
z>Cr4|z;4j4Gy9_ZM2q&8YjE7|+@fU_Pg2v;*kWfwzbXq?-><VW$QdJ{?NR$qgqlTK
zN$6hFyZHI`$fjT30?_bXoF;zWHU-<o|FqV0s9Wc!@GU+$c6Kh`t+`#^pTr^j)A-^d
zTM+9w7wFX3nwu&9dFMvKF@5pu?FPH*99+nLl@+JEz$060yGma6p8|J6aSP-%y*f__
z%iSsVehZ{&^~zd!=Ud(v9c6ip&{-FbT5bE$nxr*M<sgVhFS?Cx9&F7Mcvxlk^PV6N
z-lX8xHSYV*mD>r%>TfM<#|@^oIH8N|(RA018aB?;d!)7`9|d20>Ec52c``=OR3cGy
zRejv4RtB;e<(ql>ePHtv7rQkyP}m9@L>L6x8$sqLrzaQiosujgU51u$p6X<_N|qtW
zf?ebsc~n7nw1!1h7f?K+%T|ieYd#g{Xnt61c2Z@aJOTx0Q?o!UQ6F9*1lk5CcmY9M
z#}~Tj?usnb`=*110uh(*uEILu>&J6n`H|%ZPQ!4uOGmH1ff9)GgI0|7&rh)Ep%T5=
zt@W2Og}$KXx2WCE?3xP^{nQ@Bn`*zf{02U?3&Zn}bePk8p!+wPtt^naRS$UV@!go<
za-h;&Rz=*w+O1F2<~(b@?{#PjX%fn6qpq5j2I>3M>aDX=Qu=twP=m2dZI+oC{&$P&
zPP{n2ao(1OJgWDzxO!aEhDXD&J$_V2$hTuJmyNp7lW=zbOSAI2fMM`#k!3&}d%l;Y
zeV<!u^mhA%l+M^Os6%z;H&a=0HJ2*H<@Bc3cGOTdZC-p&zLdnPk_IPN7qTPs98!E6
zNIR|x`B=Cu{948>_Lw)RmoIqEZTxP*)|^_lkay2F!e)Ey+(<h-<<_MRj<$8O?eN+s
zD>i!vM&ak&<`Kx!)j@n1Jn+h+$@;xmAo0Y$V3LF<G+4du5EpkGHCspVuGa)!TII(V
z`L%&twvdQ#>sWwg@@3$g>O(F~!FmJqkS>EC-)yA|`_CzfxBeUN{~R4j$AiZ6weD#G
z%==%@jV0~j#`!&0o>F%BdPI>kE8IPmN<IY^;}Oi2Y$5G<a>~^ZU7kL(fSSoC>558;
z(!Pz)d*Kz=UeI8R4QAmiHP@-RrcieAV)jPE=I<r1Q)A$EyU8MMLyF10lkx9JItmO6
z_@CZJS9JO9|AvXUy6VWR(^50vGZ7N-ja0Zz&l?&Oi~PA;V*YjLr%1`^Et%7LykvVs
zhTrqfY~PWWMCABf|BFgzHpH|Kc@*#~soPgU7|!MAUF$eHFN&*Cxa08sy43NG=yAU?
zj0<_B=G*VSnoHNht6sV-w87)>%r9EisRPo4b1nC2!E7HKEMAL0J;p!qC8nTliF?kQ
zTgu6gGxy(%Jm0t{V@j|ZnA4?O?CcREB}@@qm33BC!;a?tkjILL<vq7=&$j+530@m3
zHwE#T89xe|q#NR2(d7pt$9U3Zh4es4utSyGjp*#H-Vv3<4Xauk_^Q?7({-VVKuRvp
z!(IfND(<D>vUF}-<@}7V>;CaCR9+Mu5kJW&xM-z*H~+DMo-(>I%Ns(`!6fN0x6$DS
z)<2A2L=nAW&pMs9$!X^lpSgCrWxKZy$Fdk1?<wqqdGMW&+DaVP=wd1%j%@+wDy3(;
zkn-Em(~<ONG_RY8#YC0u+I;u;xGkLb)F?m|xUQ<f#nR!4#t@16wa>Ns^R<idzRiuy
z_U0%P*8F`}aT&{i5b^y<+L)d=!Q@|wyV<x<lRQZ$-8QN>F8zh57=A;nQ2koIO4)Q!
zyCQCuNv&9>%C*@&S9Qw_EAMjR5MALgKDv&)<YA9C?~JJxw>BwhTT2pWR?GSH>LKSt
znuy^7Llpu2k)082&kkli4}dV8Ho1m`B2&Z`ukT`&L-dH(Ydm%;$K|-wOO}tcj%G40
zx$)#sBT*7jS16eVE!K!{G+G&PxOwff<@atLt3_27`3+bc`qx>7ne~t+iWG5uBM#NN
z^8#C`f&YkqT)pl*zY1yGS*UjG*L4x~pMyhZLk*u#y!(Cf1>jvrqltU?`vGeOPf&&@
zCqziH-RAdeT%aq#?iZWO<XFw#b4m{SH+mjLj^MMD=Jq{L+nD3Mwp@3Q!&se?vLZ6&
zH}!-ka2T*3tn%tyOheq1gL#+Dx@=UX*pu(!rxrs~U%Rn+mtFffS!GV&KW(e<{(RJ`
zERGL~To#vur0Q!z7RHX(u#1PgmTH7HjEbiFSp;=6U;0{591VavsM5;GBe4WSSXxg!
zQn6v#yuLE>3_!4pl_;uj7nF=IpA|;>SmbKUVEC)ZFFN(&c~fG>laWdb7|u!-Sw9d)
ziF-^u@n)}UClNF;Qx(gw{*xcUseWN|ot{xCi?n2<9mtv)$K?Yfv+#{19at^;8v?hC
zrL99$IIz^N_7IPTeFnYPMumvKytCUA?ULW@efCPdq?ssfV9-z|Yi(l9S=Ze`zxe4i
zFwF>#fR`A;5Kw=T^R_elV-lm-wBjkS4L;3hCg_9<?~XlU+S(Bf##OvMPt~!LuQU3J
z^`6g0`b+Flz~?C8rq3^!jr#od23td?9tCQ5AM4`X%a+F)0Wv=Ba7fqyZVK%nMez*U
zX;us}{R{aJKwnXB*mdeWyB22MMtQHwR+hBR<w`S16?~}<vqVhBef4y}cVfEA(%@6|
zsw>0Dned0lL+ML7!Iol5NL3hq<k^Vo*Gap8cc8mEL*IXXVhE>*pegn_dCRmlH2CUV
zwe%FI>85A#n!>X`gDw9w8wzu}1L3D9L;AP7xDmKZ!BMYY8g%k;AB6ebS0~tQL|AM!
z2ja(G<~%YNASH&E&0577n)?>*EMcb>#{Nc-;ow*`;%;#t6GKC;U3T{FqqZ+W^q2Qm
zM!)r+lja<CuTC=t2=K!TM?*R8klJ+&%W?mgG<7LRKjR4A5uf^CE=psDWG-udcv~7Y
z4QHrImhEPk-`q#_T)Kev^v!7!;l`c9i)*QuKMT+*JbCJfcKj0pb^X3BSFa2covOku
zel$i~dPjS#4~beQg&qC3*|lg`*8F#l<t=Eu{L9Vqyli}znrpzI#llaQM~8{Eok3pO
ze%ijaWKP9v0U+eI-SrUPSpX=-Yv~MxC;s8sB<X^<L35HS@BX&X0@a!JTp_@JE|#57
z*j#J+Y?{nY7gOBabV}TRz$8);4lw(6Av~@9w|e%SddJ~MOrkDd6!=&2$fMCB&5e0;
z-PeSBds1YcxBgP!T8BYYe<jO1XZ&XvFfzNjw>4~-HvS5c4uK4=R?`oy?U~4V?RZFy
z?;I7Wvs|>t6jn7Qh`sDHTdybFfS85X0ze2Si%9pYUw6|_G)3v+mg}J1lqUj2DUbpA
zHX({|qY@&3QZCC?A8cQ%=vw;L9DwLd5{Gm!yHCi~?Urvl{#`+?zS*0YtkhtyXGJUw
z@Lp^GuHt^Ai`VbncCN-UATPM3<TnomU+dNI(wU=U+4r8qIJv|y53hDeEq=ZRse-y-
z8#;(Wb^hy{A}2CR$0pS)0(Qsa=>f?)DXEqxF|q(>l995m(M&YWc1hvUTN)a?nY;QC
z9*8a?Dt@?xcVc-#@nQh41ONmOY)?mx>&!q2JpPLOU+B#K@Gs<2<T$u1J>IOirE5bD
zGaccur6E&reb)54+zRzlJ>6;l8AmPqy&|RGm~!vmXBI)48~8(HQw*r(Ikm#peu4V=
z;95+?(E(+9PfAnA2S`&Kt4vj1N7caiBlme}_2MJExW(iBz}&@M=W&Gkp3q9|ZMc$p
zN3<mJrTF5Z-Jp|K#gnxLs<{dGVD<G0-Y!UP-X6a3R6?t;GH@$XrC0PEQH9&IYHh2l
z*K{sWi{$~!jgM8xlO28S4m)Q3TY^xlgBG&EQ{Z}1wi$>&8ViCuegj}^e8l$`2Owv5
z08fjn!nYJMVy_AqseyK_ruvuURH07)U9JlF!i|4pc*djxP$3(S+|2V)yms6DBpuP^
zm$q*H8^3%8^e$ZEh&cK)#fGFKoK7rR>7Sz`|4q?1z>oS}q~KC`*!PnBU&-3w$-vJU
zOq~Ny8Y?#buRSRgJmZxA-K;!y(APjsO;5fLp5?V@)clsWVZ`lNCukQirFxuH`6YSH
zv*cf?HP6oOIUM{)L{Fs_DE^gh<O~NnD{E4JYTpYC{<oeo(Gpy}Ux+ZN`~P${`1ciP
zw+3yiT`7If?|=0M%WkLHgkApoANi+wt1JPeEaSCz?lu3$EamJlA`Z?|aP=N7CU7eM
zOJA7301p_pGRpkEF7$7pJpa3r|GSd^^c(-*mHek~@b3WjzbN^?DEW_~`u`I5Kc%ew
zmHGddxc^s6{-db=zgqI2R^xvG5&vs%{;m%G=?ne8{7PyMayHC>b<OKCcwjE<`v8z^
z43b=eV>$m1Ae9J<^V;`*lhx)Ok?MgV6~KjqZD(5nW>{Qi`Tx@^Dt;w%1H@mpd_Db>
z?X=Hj&zE11p<sqzN7}ysonydijHtGDubuY%C|;e^zRKg{UIn*jr|_{#SYDyUac;xj
zA>~1vX4lekQUNmF#hi#~NdUx!20&ntNgeVx5R~bdk3U9tHCnZxMV=d_WeYu$2SMu_
z<!4U=-Q_{2kF03_;|qHl$yK48x!htR)}zWD@xln@xZj)?+QGC!SyRS<Gw+)G1M(eq
z2T4hLSK)(oB8`_UBWcz{%{V{@*)-Ta+RB?BTa0V9t}G<|>mruD`Gz9M-eO=cUSZ9b
zCsf%RTV7(9k2xRq`N3J2tH<j)St*%xEx$6m#CM@9c9p9GjIxe)(N<&i5ajE#F(%@K
zdaN2@xgzm>0KAJgbTxojqF3ui!}l7q93|uJB05hd<u>=RwskGma}^t(qj9ah3fGiv
zS^&6z`s6z-Rs^IDSnPa|r{yJ!qJ9^vQAhL|dYyJuHEU?Rxk9zouj({8#^mL5HpT1Y
zQ|)4iZ`!B;PUrKVnD(BR&E930#<1x3^u>DGqbI2bMiLQ;Q<V#XE1gq_Q`V$vqtcmy
zEYk_%nxH8n$^s=5xG)?<EB{#K_QYvPio%PD#|LZW;W!^Xa!keg&FTrWp02N+B!Fup
zRPTk;?97}~`orHtsIOSdu=b3wiJGYM4BlCr<V(T7I-Eec_sUtWpq+0nGSn+-OT>1U
z+bQ(Jv=6{Gg}G!JOW#meuy;Fe*?n=0pX{<)<R9}HeAXI+??n#XHIimZwy62j@g{8W
zFJC8o+vF^c6=+@zX5%g4MCZU|fmJQ{w9?0y*klu2!Z(X$@Vi*{<x4!(*x6FqTh*zG
zqh6<ntHNX3M7FUy+j80CwJQgkZS3F6Y`-{^7PlobH6oc-$jZtcZb$Uv`9;20dao@l
zpEfSi<C8Ge2*Q^|F(bga2DBeU^RF)l^&TtS+>gwby3qvVa0z7e+P%E|=tT`6D?oX!
zN$y^EL>K+(30rn(<;$Ck##AzQ#-5@^f=OjIe_Ve-IEj1^c&THdJ9&;_TN^U(B%GIL
z{=)Kd`wq#^o_a;V7mS~o9cr3d5M0giIhZYdmTZtRKcIo!kYEk=dDLkU-e&yEXq+oT
z_Ti$_*g*XJJNhzi2WOMgM*a9Wrjy?_`fY8fPxdEDi0y8}fl3$)LaZYVjGiwS+2=Sc
z_OLG4LPNQPH6EUQDA#JhM&29<-s<Gb@%6ioZybKu#IlA<fPG(v>b-3jekRKSs+BL`
zjm&B(Fw#E))0%(_p_R$ZA{Etzeuz-k@SkVGg~a&nG1SxLS1X%Qe}m`#*%V@s5$*L`
z-r?OQ1wAcp-^AvkjRzC$u9h;WoZg9Lj&=)AG#0!k1P(dz8$k4V{fN}jfC{7GdY<`Z
z*-Y$wW~fB2ZD*orUJPnkqCUv`S9!SsM!R?U=3s$M<V`zR{r<MF>HAOf%Lgw@A#M7K
zmY4Q$azheqe>z*905JlSj7vfxbhXmnIBa!?O2dLHfIO^<*jEoRJlGlZJo{>t`Qt;X
z5cPz$E#{_)dIG`TSmcLCwb>@?;K!|YT~g5>@bYMi?ASlh*ovsoCTy`ew5t+5VQ)vx
zHeiZ9<v5yD2a=34>hDVn6#9(IFnAejCDYCNr{qXOwUFBms!|&=QSsrL>-2*9OP_@u
zl_&*-QZg>+effNcEtndvI|!a9rFeeNKWNsjizzqc@gO_mdPGtsd#7t##AntpPv0*R
zxp|>qoZk2S7yxTmZbj$)kfY*?J2mPJuk0?xBB}zvm0nSU%x5rdLL^5BVTtp#Dorh=
zRZ<3sYcF}7$vP+D)v}n1P_&}febc__s&zR`PFL$~&!$N`Bf<KjCpoY02f9xzoL{}j
zRmGX+ck=3OXdQReYiI&{7xZ)DJn`#d4j7)yak-}<m%&g!z9{#cg5C&Sy8wZK$>|o^
zxxc*teq&_ZTdh0NkZ%a{16$p<pW=fsB@6qdqBx?5`LpU}igKkaN8P4`_4?F+3#TzF
z;_M%jBww~(<o(P6D3>1-7zFgS!qK1N1f|=-<i~cVN&Dj{VY;1G;kEE2v_id_rvLd5
zX?7)>Ryx=7#dTXI^lI3tl$f>OpJMTk_C&0xt`{^36Hr58Q}9?GEvFAS?aaYjFs+!6
z)TfkS+?|EI??%$$8I74SY3u10^|<4^N%g3+@5XG=Gra(D9Leb=@RzPyT?cXd=H;UA
z3xCaR>CJ5sgZ2F?Il`gw;fh;6T>tM-P}YB%YUUT48aC4y#%H*`)CKjstDoOF`I;Ww
zet#~i37?kkfeb$am!xt&KeogQg|^SKa38qo5M1R4rKv0!iR)50*?%CD%65TAD}fX9
zpfnfP<Pxo#JggmF-ywg))$F{U8_M_qqapHY;LB{?lod;Fq5mAT(8QtgY4V3$lHTHy
z2fddECpuLCr2J98RXaBW+)}Y0G{%*CZrL=cM81rNZoDDM++h1=T-q>Ea|sm=bJlQ(
zu<vH3$=3Us6)RdfgFumoe;oIrAXL!h1<;X+#3&k2afRFZev$8@WtUdcmY33r>OIKS
znu5*WTrNfT8DY4X-i1&+zvCY>!I|gjYya?QJaisq^QcE1DkwUj5NL#XUZNoECCSnE
z#fqw*tt>ieN6L9(|97TbMQ(Kr-CL$%0V5p_zA$JgexS%xuPnDqwv>{qS98ixPS<7a
z2MeU(<}44jPW)nc$|scKi#lXG1sZz^2UAOAft2!!WPA{x+|ok$e;uy0>V5#?6?J1E
z@hBK@rjXiRaJ>r;sgrMk(KVqg(DQa;YB9rDd7Ax9S}S*cq|E7l<>wlwYKi5t8%ZHX
zi!I*s^!|7JcK{Qm@TAe2PEC8vX|$TpbMSCi3Tj#J(;?eG)%Giff-Ag#%md=;1$YBs
zzkH#&`^nLPis@*>PSk1V8MiIZ=}v9c<Lh2FFGO>;{q=POxj-(|#`+PQ`z_w+MNx3+
z1TlAkNz-Ev6OLMg8l-u(^;?w9O2F?Zm97W;JG@UaZq?A1vV}iA2b^T*8JW4BjNQ)g
zyhHnUm65BsasDpA<F{eobUEKB&XByPWQgO7UU(?$zEZvtZ|S$NTUZa7k_U=6Yi!rl
zv-gfTZl7PHH-aEs=cU4iHNvm1nGC6Xx&CMD2PO(1l8fdLdE%PQSTzLcYpAQ~(vVR&
z2gZf>al4WRKyk!*GnW+~`RsgL$N=X-TiR=`wAXGGiypZ4bl2aab8F>2k-@@^0-1IJ
z=Jj5WT3Y*I{`asaLC#Zxh9DE&6<n};ajqEEcCz-OD^6>Nd5*wHZy?n_#ZO>uRKNw$
zVq=vaKo7F^%Ae#1+dez3`S4W!z$0a6d3?A>r{~SdhuGVmkqwT}A-QL_nd^dJCWZl4
zWFm238o>uKa{q7aZ2m}JjAAJELsY(;YV2MW)Z+id$miyzoQfMqM5-pEgA(G{9*S7s
zafG_su$P4?-Y2xDCBX`3pRy&<oqE}L;uHF$IzHMyJVamRPcGb!Pm~JZIb;2f6iKUI
z|2)zKKMfGKut6P87-jnK)$U<fW_Ata?E(FBx`l8vP7ce-bR$7G^zAO0Sj`OJx9#j#
zgdHW?F-B7L2wP$OQrMO17AC8o?|&THy~9-c-R9nvU=T%d#IHv#wN(CdZ5vd+pCx0*
z*3U`{!Wl7!ZSrtTlpU9%SpnU#X``WWR{SaFWqttkYIE}pz2i78yYw}!YTs9Sn8z9=
z8Am%FMN0$u@n+uUi60*f67mYrg<H}Ta`Q2-Gs7@<Q!Gyk6T`0`XsjfYKOiK2$Q;z~
z{OBn^5Y0}EIw9LykW*Q2m`&|tEwCs`t<CFQ?;dO#w@Wp@B0QDR5@>s{l{cfM)A7z`
zm%tFL=+<eW@Ae@}SbsMXlX)uUK*|pYm(`CtKGRdCn%v_tU%7h5EjhN-(h+Optd+di
zZ!+5f=+aDbj$f}z?~2t2^WlDu7jw{4gQ?s_?VEvb6s0eJ-20=je(zVghV6QTgDzpK
z`NCJVN$JoBi}Y%2o!^!JMjAM<RMsRN2YP29)^Cz#i_3(yF|Y?s{x-AXpPH3U;xU2j
zUzzV7Y+A6+2Mf!GCNKs^+UyQ+G7?vi0iFJhWN8%dsA~KLlV%AhShio_i_CLg%}-D!
z=J|THxhaLQ(n%5pf|$oHP<1Bph}R=)9b2#4saDQ-JnvqKa@+No#nr?)yuA14Gkd$-
zZ7`-BJh*5L@+t_fHV;`#GXO&fO5?etd`wfIx65__G{&4;XI$@r`o-yw4$_%T;Xs)Y
zBq?X~%I*6Px-HBq|IEAwj%?jQpTB*J;<~~)LJ|_C>(EA*DE0I9^cIj6&4V(v@`=d-
z^jmuB7N|xs4kvFc>e=ykzZp;tFGur)#~B(nF4?JHODio?zjmQTn<IjpWVupSjPnH7
zx`ORLrWw>v?e7ZN`P14qYxSnBroSxjVq~IdoU+Gy4$Z!!%IWmBRoHc@Y;WWZy}BXp
zy=R2=WAl{}<jc0fmN!JRuX1^YU-jhW)(jf_D9EE!3wT|D+D)UkjT|#CKAoqHdgLX`
zNs}!RAu9^E+&!u-r3V=&8{)CDCtf~j`23v{l3YxoR+(kw*Fs8zJ&jY9J=UUglI^s5
zwk3R|^P5t5o6P2HTTh66U(v&&3tBB4h#y_?n2XEvCcs16!nyPM3_O0PCQkm~oq(B`
z4EDx~3`&=iCz!nQa2dgl;5Y_^Db>NBb`J};BZa0%gQ)pRT${HS<Y3y6DFh(?I!spS
zCb6}Z9uglpb4b}DOHY|={O2(CaVK4xL2Mm19uku*pY8qU>iBSpuR)jTRnW}nf4IlS
z<EtYDZ7KEHls!017M^duaJ$PB9k*$+c-(o_V+S`iDTE|7Y1ggQqZxF>hDIq^o<lxU
zX0JgUZC*%hdY1e0#6e#f&dMa=@m5gLxaou{QN;6QgX{@e(c@g8|M8`pDpHlf^XQt!
ztn|wjduBy)UijdmVfr5Vq%;XsvtI7h=Nm?RB_LQXehXtEOo1LKQ1G`5Er90o?HMuW
zXi?#m&N*Y>X0W_X2H!we=RCPsW($e`M9W_Errv20k~&3$j*qQhuhZH2Z2>8U$&Oe^
zoNP??+sq-zF1JUJ0M<#s1zJq9N>R3D({E1Q@U9})IiWl%K)$p9B;0)cg2<RV=&08R
zTd?<ibw$FBM^6|NRv~&OY=d!<tHaJW?Gnj#wIyi6*2K{en#&1tcAq}`KBQxky|sQQ
z``jKfc$=8iH+ye)=)N9On_g<FVj*8J^Vo`Q0eGfs_)g6sAUH><*ZYr`++5!4K)GnS
zt#AH?>MPT!t(|`bxX&m96VF#T+$t!CQFbLVngx;Z$&~(p_h(vhw}#N&VE<llUAn^h
z_vhNdxx-bLt=nuXelhab)`21!3xiY&7)$p~Y+t`LX-Y6A&c~+_QdI+(cG<p$=PN#A
zyMi)~<_+IW?Kt+k1sZCsJh96e2tFl!_WN!uPgKS#B<g^G!*QR(sB~_+SwV|Cu~Rp#
z-^0r9;p_DKU^lv8`AT1@@eioJyZLrk=MK}8F2Yg8Y_+BBX_KIRIJ<&bBM}}T*)=&b
zkVB;m3+XGXaw=|YhLsjFl<nA7l506q&06v0&wqr5B29Mf3yKl!Qa4$p#luGf%e%|n
z_tto!gJB5=3eE@pEN6sI+lhTEtK=8VB*qUp)}Z=8ZPH&>Y|rPTkcXnShmbaB$4;yy
zJp415fnUgkJa+cSb?oj;pw?8fNQtp-*TUqk{d+2Bfh^@sDrYGSAekp_6(AePIcTqs
z;$ILxw2*W(ovyR+*<tCIWTFA@hrwJMdA{6EM{58cBjgwKq`*YA=iad<(r|AIKK?s)
zez{T$HvLGQGEU<m6&KnwUJ@@^p%<0bs`IB1vT5^^f}?`_+<y32FUD;+7Oj3la=u}i
zMH0@-p4cgWXyHIuH<y4^_>0)OY~H3`E_EE6Z+>vWHr!YnISlQ-WblQiSQQ_>I^rU5
z&D<m35c}m!lptC5qv6)^$ma{yW_S0C`D=t)>DmiP9DH%Zgm}z!+u7R3!~2%_Nilm}
zn6uwu;!pJzaY0c_*d%4@;V~r)G4NGIwH8-Z-+)ZpQ_DkT9`F_FWt+az3m7aI{_+ez
zJ_(!of&EP+jMo(f<f>K`PmcQ}@1i3oV3?T3)6MW$a2Y<PyfHPF7l@cRl|c*2Z~hSI
z|AaaG4BPIW&mMYzE%Af!Nn9FY?6z>jMhM|0Yn2_`IJ-x~!Pnj~t@+sRql)jBlT<<D
zowt5*=-CzPPCd!j#L7z_a-V&R9HDXq99w&A%uqaK@e&rs7Na3t`+X<D_*Xq-#J!;R
zVy~bjPk|xwQ#+eR@<#^Iw~9PhDC$+^vGW-n$K#&JMLt2=P%oW7Wrs}++~#A^&}hU&
zMSnq7Hs^^v7g#P@181d`;Vr!_I<V_xth2ka+fX*s;JXE#r^S3+F@>O9I@#m6O-|CA
zr2rwl#LTFy;xmw9Ve9YFYz$BRs$D=mE77(SaP~M=XEIFJZDGu8nuQ-?8wQs~Yu_s{
zA1-5i9X<g21^OZdR?W5o*&)A?UDA%qlj#(1EHCp>Zc2hf?R52mh2tl_Hmye`mXB7<
zF37!|ZFZYKi@IjQgWr-zXg2hBlNj!I720gBC1bYwjD}}-!iSGFyYK}ri;Ua9G7z+R
zjM7@#fXcfjIlmwSpG=(-;gZ{v!QT@8DO~fo=Z;*booMq{6Iz2Nr*ciXktxKK4Q-nr
z_8#H0wO5^?%Pz$34ZmR{7bwz0QrZ-O1gMKhS&X`f(0OYcZ$;yzohqiYV{8#^%Enw|
zrA3hIU7rN%(kw@8+4@v1->(P@zq)pZTnnZ5l(7v?&|<UNxei+@+cAAA)X~XtRoLtL
z-%g2l9I_2*o5MvPtykV;Y`TaIJAdMC6X#)2!QqCu>!%~(w{qXKxNw(#NKW8q=Ia>%
zR}wlSdw}GRkc`+zwv@rpLfb;q_9$rrD)qD>a!8upiug;6Oe9J15ot#>@mJD76Efx`
zEQcpTwy4X(hK@g$uFK*gm(F;>gSeH*i98SCXC@97u!D_g*n?aK-<=y4{Al9xHGRdA
z23tAAlTRt${?tseJ=pY7rk-z|Xp5+z=!a7J$}bY*_A6#0cm!SV9p02}_>QV?G8wCc
zc3)_ie;ZpvPP^<(^2bfm>wrpKJl0ei)g_zoA*UJ(Hy6626wa)e&u2oVUU&54VmV6j
zpk#Nc0y%;Z@*{c%8@5j~7TZ5=&iv_)qI6n^4t%xa^=6?4O$vsRjQ=GZXtO0;)vG5u
zu3ja^PEX49U+8hrPc4al+oeLq)r7|eDzn40xQm{PS<k)s68ndTRP_~oS2-vu1*m|R
zm&;Kp3<h+M>>MGUhi-f(10?=;XFvRa^%osXPO*}7WL*?t{i{X#PId*Rw8rS>!0B+9
zSq8w07K3>?swzpPsC6o}?xo@fq}5G_EAGPkJTJL1u3-{aa+L&|V`5-zesES%Xp*@{
zrf+HKR%JZrUULsM^^?Na71q#aB3WmUtjFqrYH{rXIsaY99S+}dv5yHxNoN|YI?p>F
zRpPa}J-Y?@gR9ur;dSFCfH{}zwmT309ApH$NZO|0WMo&)d(|;T>4kj(im8{+-VTK~
zrjNWjJzQB2(5B@f{Pc2Vo27Wp;O~P@z8j#@1-<gfWW5pS87*uIk|2MHcIkrc&sW1b
z4e$7tsc3quR`jQX9;!C_<_Dmg3^<IWv94j-Vf}e!@UcqCtBmPNn}tGk3#J5e;|tLi
z{GJEg8jBa~#$MrK4Pf^|;&x27YL-jwyW+b0%id|z#%b_eRV$9we$i{@h~5UQ;I5M2
zuW0sGsQnV<T)%z!_>86g4O5@Z@M@_GuYkihM7*|~vkuD2x1!-Osn6Tk(&L6|tXp7(
z<JjGuhSfb@EjDhg<cd-`l`CrNU7Lx+WCJUh0z?3`ml1dTRoaPDQP5<h+P_DM_zMn#
zdKbpEF3lkMp~S-w=B03Gnm%uDH4X3ispEIME~{8~@+sr`?JF=~J_1=4F9&>M)bT4c
zU1`>7*t^NW+=XMEQHg{Pe~{$UyOM@~C+V1MaxV&b-PK*KisB{C4SEjbLC`)jSA)0u
zru{sO%-JSgE9_jo*=KOmP4q{LyY}11%ZJG$bx-XOLr!AmQ@*@$xjLpxo_8`1jyS$f
zi|`c*&m&b?%$Q{DLky+H(-@B?8jr7?*^3;bLUXiSO+z>%jLBvuIr9Rx`sPk>b?EJw
zxWI??yws_SKsMyNtKeBTE>l)d+idG0yN10hkft5%t!@3}MfU1Cwi0RPOk$DAT|~@A
z_X9d_;ER5@B+v&Yg~iOo@9tCC&mw?4jiAce*@{!P<B*c*v8H~Z=>Lp$=|gA%FJ?c}
zOK~`Vc6QI+QWXDIe6(Autz1@Y3$s~`R!WF#c6g(9XSsg!TmZB)Z=q2{ASbuSbM$b+
zA!wN1b(=iRNi~G|GV+qmo$&gGOT14Ax{Ga@vSJ3i_dF5b^-TOMcMqi;X0F5V*Q=Zb
z@gr<9l_56;o_;klcT6Bx`rc@lWEnq5ZeO{5Ppf&624X$kRGB-Qb))5wELS9n2^@Ii
zTPMiO)Fr>(T-!!CvveVH`S}_v;z`A<Dk^a2G_LYheF3trrw93zcth$Lv-WnhM1yR)
z<pd<1n995FUF>-QQ?(3G^Hm>UGGMzE(~n)5AUX?Hy9`vk_=IH0Ki1j^7v4`C7aNj>
z^yu&XSuq$zP806+gz496n794ZgU$(`;FO^PokbrS{k*Ez_j@O8CW*lkh1Ud^@$f~U
z4vlu0GmVDzUUp`x?oq9f)l}u+yjb%pR2>&7%iUYZcR+m9jW-$<7t3Gd7VNUnXW@^H
z{7(d4k-TGjP-f3@;GP>lVV0Uu)i_%6%4}Y(`tk;lr_MaR3iNy8`?{7-xSvEUq%jsL
z&KrFH>I9|r-SEGC^0J@O$Yg^_vpEhfz5%P?(;T|mpibTRnzHIUy;-$Fanbhk-qcAJ
zn#LG(5cGkJ)r5dlOGRP45v5bmC@O+T`~5_#tVy1v!|$RzU3(2lGi9>L#V=!7&bV_$
z#HkAd2t`_;hO4m0VpkK}*wJrpNczYKM3|X|q3_R6SN^aJJk1xbWM3WYr}Ej#J4h4M
zd{eWR8uQo<8J;985OLJX;u06e%BEp2?uC8hAKsz5ime8+$&+<}h$^-GEu!VR88J#_
zT^*r8RY4E)I^HViohxmVQGO|2yV^(OrGZl#sHu0#(fZHP?SufdD}+o;aS*~aKyy?5
z<*vE(Zq#ZqKUf!*C_Q4(*B6vuTU={v>qY8+j*ydCFNhnvXV>%De<Cu=iedK(zv>S9
za?zFgdRn*zLG)$v`s)vL?UW>ZD6D;=iT}}gxtm2388n3b4nL&@o!~vDk@TX4;m$-8
zuUI3gqy?I)BlZR_dt=l4=Wx&z=ka27``)=`5yeRhqk&d?7Re$yq<>aP!%4-n+UG!e
ziwWo>+qP)aX;yT@%_~g>+V`Fh$|+%++f9Y7ukqq!zPuaBX!}a&IkafiLR+|JdEf@d
zQ?5dciYDDx4DNi2PrOL++}gjQW{<HcJsS;-dL$V``}`nl3mueb3pp%zuth~^(S@nI
z7x=Y%QY5>bVhmw2L)oaKJ<wjVjGVq@;GOcBWnhxDs!73P!+G{DO`)c|(#}nIjxxxQ
zHp4JOji;{+x;aQFeyDLs`Om5Q!c%Ra#(sOXH4i^{NZRPKF*k%?8kyge%9IPJCr&TY
zz<I<Y8W2r%Zo11FxEWG%IU!J!uLW@n7RccnvO-6f{R&K_EaJ7a{P@f*5WE#z4tneL
zlb`ZSEBcQ)ZbUGh*Mo+Cj{9%ji64)0lcUA9E&Kkb_*`te86lgq$dw_&DHo=iTm@Rs
z21y^a%~k?_inlun9qG3)s0DU}CGM=!d-vjcs4h7nt1wJ~JcJ{%?PZ_Q1B$M;iV(pF
z1;n{TDZf%V3O~t-xqcHb*^G0zN)w=t$W9rsPq9&8#cw?(U^0kT1p>ASgQr8Sp&%mM
za-q$U*6F&cr@x4?L{#+tSh-l!^%QBK^Yuxw74Lb{4t?Sp3kdh1uB^Dg^ru<@z97{O
zXI`xqSx#yiqHx$PX{nB0cb@5{Xua~IYg)4}3@d*!m*rDRs?8{)#!;Ko?m_DC%Cfmq
z(!nzNSxWA+mZWBH89~jq*mdG9n!}N4h=RED07%cPaKsQl|FDR@R<qmtlC8c9fbilV
zZ{-pq&V?oqIHjf;pmvi&m}GvihaTo{K8}|Oed5G=M0#Ow{3svnOJfLSmQtCp7{_&z
zlA6ftRl{x1hMqT5B}vBCzL+kyXg~kMpBl6vid!-A<>dH|miCDz<j_f2tt}(m=DO85
zb#k16EiykewsXlAxh_T1I`bhVFhl}ZF{n-O@-1+1UGd2lxTeOo=6rKhU)4w{p7F_2
z3;N`kh@zCke2uUABx*Y#D+O$X_8J^CYM7Ufw}J4Z$`lW*3mU~T^<t-zlY}n6eA?!>
zX=P|n4ka+(j5j~Dlu_qra6ob;y_F1Vj@Jnw4~e4^ZfF-ODEhukvyfb1&<Qq*@-f_g
z5`u2=+2C#xy53OZpdlR`|BG-tz}#(f9;=lye)CjcM>y($>IDY(!MuI<!(Iz5x|8;W
zIYzX8PmgWwpr`l^DCpWRpT)NTa>5SD_g#ot^vR@x9<I?xkiYIc%b|!8X<vOJqx<ny
zYA)fYE7pUQ;}kHzVUlsYB%I$QUyX_fxWI*dydXX4GQOw92^EoE{Ji~q=p!Fptl+K*
z*gNlxZBQ?6I^n71%dYML+M7M??4oQUgT1)x3J?Rsga^RlKS5f9FW39Gkn+j~1+NhA
z{E77sIBF3i2Y*r5!Az5D@9n7I+!i{oHx*g<TKCe)LEZ#>+?=jABq>j8yp_&h!D_XS
zlDAi$kiAsb8Heh2QbN<{p;NoY6N$o--18vS4g5rW5VE#taBN0!4?ZZK3dq5d?yZmi
z9Dj$kDY86$UoZ6^nLK|9@V(hf#GL_|7RNOoSe<ht{GZWAok`j>)9yAeXm)#Qb@BGf
zRVTy<=$bf=e1V{AUHe}epYFzE_W`#7gRPoyK1kd(ski>=Cfw`10JXr#@)LV=lNM_i
z(_+Tla}USp1yy%M9~S&5?ro~omR849;$C#o54!^=F>GeNH}2E^@dmn$m&90|BL|&q
z|Ip-v!mA?zVs#Ngfq5fio@jDc-!#2(IoA~TTJRK+ZSs8ncZpjCzLD5!8c6=qo@#6{
z6()91ned=mx7vc+wDjKorTg3V2l3=ZtH*}@nTwC!6Zuuh5U(M(5ngK(_scO)Hh+K3
zt^WDJ%M8!E*pn=TiHO9Kjua0+KHJhRV+mVc@4E}7U6Gh=B5ii-0OD|VXH4spvc}$G
z>oNV{=gsu0Q+7+RFb91`<pzQ=>P4*mw|#%o3)uiiPb7cKZ|rU!w0FDl_c#)F$cA|N
z=7{jgX{{#CyK(Q3e=9EkvikvpVaM@81B1}(4=JYrtPcGtCQ~fzx!CI`oq27}kGR*F
z<UJMVnd=skI!H-SxQ?WIPSPQGgVb1)V+3tc^oOj|!WAiQh&+FOEXFX=3D28WC>lD5
z74*iwLOOp@6RmWfQicN%F<GI&47U3w@DdyE&u+g=o@1JRZ^c9Hhta?lb|ODdvhdVF
z(O=^BjN#$n6iLxbeBSh~)F_4TsNAbjnb#20T*(6<(b+I4BF+=kQa{5mMhyVR2>lO^
zp$M?V<040!MSN1~lkK?<e%b`@>hqM>oqwn=I=Nc!CaEH?!B3200?F}N0iM1`&MGi+
zF!fuS3v%aNS12%Onu?R$Cq_>64voYQ;2g$0x)@n;xspkQV<@C}Q3GFJ@U)2jRWWpL
zoeNl81zpR2U|ecz^N0Uq{}?Q1o~^IF8`8;&0Phf_^<3qzBfL|p07yVbtv7YC=)Ked
z_bX=MG8O<=MG{O9N!UOHFbA9KmNa}6bR}o5l?4*E#A>+uPQuxs4U1fLo2=grUgFm8
zVyw7shA+qSoxXV@hMzwoSMWF%ca)nu{_ta<bqXObn);0)-jW*_f;{&=%JOuw{r0UU
zwG|igoH{%3ET8<w*U2|I@>*dMCJ?8vP;cang#5LapY`K4oKu_-<NfmV1-#QjdFOC0
zV@?GUG|qCJMzX}*s{ho+lQx$w<^3c)t-cGq1&|FRQ>hXH8(0|Lhm~gX*-Dy)-|j9Q
zO&B?g`0)ITUK7WzjEXh$u3*EY!|PJ+^IK5)#;ggslNHqHJI10FSg44D4M!4`aNWAI
zKxgB_F5Gvy>^yb@7?}NZ`Zko@j9{|h7$Gp2!DeU7qqgRa8eD4)b<DTdCw7y?9L*+$
zMl#I3`L-b__ofCV*z}%F=-)H61#e_8Cc-`E_AAz`^IZ%_?{`p1jcI^vLO&lsI~6V5
zxIdIUA7{I-6mi(dCx!lGbi}hyWZD}mQ@Nne=vtj3ZZ$)(ee&`>t4@caKqs$TT8!yJ
za?i!13U56AjJJhPQ4EU8$$pfRM29{EGS=oDGKGgxAZJ-Bq)|M7?mtHsmA8;6E`_ix
z-Djn$|G={=o1+4Ts<76%)<?EGWrjezcSxgY+z9fMywCKXe8y!J!vk-A8g@U3PkVbl
zvfo6QqVd;AJTpK^35K(N<fe?$z|?X3%F4N9JHTO@sh%!4A6L05D{$dgKz4GR5WL@j
z;&2!3oU4eeN?~nK_pp>-*6NnkA8SV_4()oc4-7ap_geZh?l@?uo+;ha=H%{4I9@>?
zPJn^_-S^C#xT90QBmbS%sTN={)$c54%dg{*lPjHDmYDYTJ^x|J(HDn#JxGNbP%!zD
zy=9O%bJ>u_0sIb>7%z3TNd3VnzFc&osyckOY9K^O9#v1<TbFJ+HfX8Kzdc~gKS1Og
z&9tc&@|#O?0$aj0TpN3CneKTxpn29a%=19eGU?ZU;UKPvxxF{HZ&ZsFLx>QO#9H&_
zWM7l{|5(|*;ry%izDDe8Q2x`NnfOXSFDx8}dU7}@rl!Xqw9i))CI|C^p?DluzrqJ7
z6=z#Dt9#!`o2T(lrZP<0;p{^fm8rN0)w5N~sgHBm6~KW3bYpL#NLb`3Tli_c!blIh
z)`sY)jr09b-Q1lzujL#=wKR(dIJkXy2%LY`E0f6;nIV0wza3Ruy&Ywo=a3!}*L<Mf
zHRU)0Z)ex?<fv`RRHt9?p?R{h@1<{W@I~KXdGR;Bf8ni&q*X03VH{nx1uEAKUOHp(
z_?3}s#hytK{>D+Z5|sJ*I&bybqdd9VwTr&izh5G%2xHhMFJG}d8T#N+dGttsgY{h;
z!oj9`yc)8-u!>;*DC)ODzh`mB=eXbdD#ph7%r4b-2d;-_s3a*%23`E0y3Mr~0k_p%
zUP~AWF}=tk>J~Yg=bPo%`9U(ry;<-yjf9JFwvKR|tr0%sI6L&Rlg=IZSHtQchwQS#
z&o7`7=tsFUTHKky4(FhJR$Qb3crY#x6ji1mn~#f3J*#F{jFHWpbfE3Q-_6R!c&jEQ
zD!OU30?$CTU?-%+t^O*lYe?$^^60-T_$H>Zx3F&RQVxTM_AM`@i$iUleu^mA#yTO{
zAUU6gIhh|aOEjd}=h$np%E<Cy0z!FCS!?%7vgC04`C%8i2rw0o$sNheN5k!{x^D?T
z`mw)P>n6Pit>!PN*XDT=cysWGquDw7b7a=Mclw7QQnMj9v6KOX6zRJ@MSm(-)ik&;
zb9xT~3sNq`NzJn@V92rqjoRA&0or~ab{yy(s<YC7toB&8^cJlrf00vSF&o5Df1^=~
zdpBod`fJH*;~uk=!*??&kEQgNn2P=*Y|mX9T|XCZIYtRDTWXGoATmAo@Ye#J526pN
zSsGIFvSr0eVfRlfRKbl~<ekU%_p<CICb?g!l26H1QabYl>@x8%`O6PuNGX{oSv!jI
zbi6B8dr0JlAj?+t_@=56uNvAMmgQ}Uw3V7l`f!m~o0&n^Aliflp|Jlefdn(EIQvi#
z*VCJ<@E{fbqVz0eLBZoAS)tTtT&}ldlWc7Po|NJ~hAgN}eSsA-;_9cpL?gL#=Gp<P
zpu)KgoCs3PwKm{)7<(J@0lNNFP8$|+gVbTuk0#ZQhPeoxUWPV`ZK7f(6K{!u+4aIR
z71Waw>$b-=^E{I%83pEIi-@9?>uVv2^uXLfpHvtkWZDzcaXKUZr-&z}=Hr3O<5I65
zVm-2?ks?S%lL<ptTxhVjdZ(mapW<MLO-FD;p~?D^M4^-o=H@s@k|nP>i+O*mfY^DK
z5sy=N0KvN1?fj%cc-y!t?s<z~*9K_^D)fYyRu9~v&H{JMIQ1o`!Z%aCAA6kozI<K7
zqWBX8jb}@5rBUp~6mLE=>G{o5$!E0j1bHJa7KvIDSH$(|IHu5^efc0%XOl;@tt5)`
z{U=mwtT89`NofR^84{p{<J#(lPafWa4Qq#r`<?vc#pV$$t^MaN3a%FOqAm?``iAs`
zzyh)qu)tlZ)Jf<WyrwetI?W3Y(`zHix1E=d&dlbJrk9ys^0mJZA&o40b8PGK;_G|z
zhYBM$Z_FG_GPa|~p-^iE8sN&JB3%(og-LCC_5nRu)KomJl}X%M{@c#45KE)6aZb;U
zT)4QIt)o8K!oTvVm=*?OTqI4aBD(|?{e@T$E!B4FFH5D#rDiOyiKRH22SvJni16jY
zl6=IfWznhG3+-@zE-dgmwl9c-ub{na%wG4~0>83nMqmt17khV7aqDbUUYq+~LP4dV
zqL|^qq{V}s!yGx0WlzgN`t7tz)S*2@3k>wb&=G+P?);ofH7shy?~9<@i;|<8Nxt_!
zgPFjKU^UD@WTWh6^q$2)$8v1P@njI=>uKRG-oI5$)0F@183u^yj^ekK$<mkVc2Xb0
zWOoLgkjb#5pjQO3b!oBQkGiDKcUPXmy@<wt(G^%}_X-mLR1FGDc3^FKnbUvTQw0`7
z!_OXERcotZIBM7UEZtI|*s0mAHk&MJb$0?MI66tNdcfO$elflz8sq6R^rY$p%c28%
z8lh+8R|<Y;&np@RTanF>>A_GzruzF4<Pvo>2m7_fbt}@#R?u+p{k^eja1+z-*JSab
z;VJqd0SMFj#x{Ac?V+-WRUFzmXL`Dl)1<_03fs~^&h0q~P1%CMhc|(psJ=;MNP*f|
zfsWl7IoQ)cnUb7S$j{AR!0f7FE@PzBoht(IL+P2vJ+QRs5KG|J<y=zV<a1}*78s*O
z30uM;dsWT~Fr@{6{J8&qyZBN^gqf=tB~2dP$YE$I`EjCG)N|`K-*b{~@$)PTtbK@V
z`-3lO6W)(b#Ez-usgz|T*F~r~BgV)E4lxA`qO`2i&!_ln;Ol;w<LSx<b$ed}$q#Dr
zZ$=W>5P{)Kc->n6q{HGbZ8kU*LF5qLs$(K$!msY+HnqDdSBUMZ>p-1qFR?ZX%{C@q
zIuTkv`myd{vwNait#bbl|53^sybC=Q7ww4OCV^{owpd~)_uMD=Clz1&4S7sa*DOR;
zfgVP#<M=J7zGu2bVkKKH)&WyC+)w~vB^1jiNaoL$ei5EG$VKBGihionDJ==Aa>?b4
zh&-<c3kNPbx!{NNPQ4~!O#oQt@zPmJTdcSQkOrwu!r-xhH*s<x)Axc5pUIuazrW|f
z2#vg-Bf7f^P<)b-p3=u+-g_b)(Y#2>uc1&e7ZXwAX4#-gL*n>vQFqEA&`6z8r{!u&
zTB+B5U8TN`{14nxj~ij|plxyfcw<z_2n5XfaY~j;aWpILW$bII-9yPki<r++?ql9&
zC(;ufF-8i++zMGS#@&0zv%!0bj8kZ~NumnbGVP!H321s>SN8Q=hS-?-s_JM<-(8i#
zXq-Jnw(xrX`{i~uWQV$zi|?a~setU_;MdER9D?io6IlzGRmXR<hBZx@L&$4}F8Q_@
zCOltLWQ3sBwWxIfooQ8IpOmPM*5wx0dHwhz_nxpykKTAt685yj%xX93sR)=MZKR0k
zPnLzm05!p(<c*iAlb7yQY9oM|;X7N6kqV<29WoXL^W70Akryw`uA5lP#DMu*P*LCk
z#dEU117a=0lJ9_3pYWqN<6=s(Q9P=(ULj<lS=G8!k11pADdNH|;jw<NMaoT*PT<ds
z=GbcV`{3K<a3R+u?PeA?3E-NvP6TFT7wS<l1ybWU@rV+hoAsub5B{=6?!DsjuzFf-
z&9*9y0DSaf*(Spq@1PxY<WOo0!U@a0dnSQH$*Niy>jcxtE}WdXskDO0@@a{=girKR
zqtPo<U-Wt4dU_M^Mgz=8SY7$$&RgbcrIdZ!Gb%3nDQqI!Yd&--UcmTv<~12y&_1dX
z@3S57o*#H#+uhdr$r@;W5rmM4jPsz9J$}g98kQ<#2NrtCNi;FsEmEs}9w~p1-OuXx
zg~SW6-B-X%=`M|_hbWENKHvVvnhv^GB6l&>RFhU7?l@Rg3dk?fl7~aluLOH}J!ohR
zo_SIQ1`xMelaUWmJtKv>Q;q4g7Iy!c)E$@q{5uYEsc`JStuaUm<Ya#2PF4H;w!z`J
zQJoR&qpV5d9q<j+hn1vS9eLV2Van}<c2#G0<C0@wsnZ(Bpxj6{=Z;|=^`d8Ui;JMv
zxlCb^ET-r-oxV}lm>$<C;K_oa*n`psubSvtLTkncw&VmCsWh5DaOY{U3k#!;KF5n^
zxG8&^2R*gUb4xGyd57c`Nq#N%M-lgChI@}xFO`Up$&Q&+-jc7|@Ao-c^D(ER=NEsa
z+&;r_B-sS&AAPyrUCeRka)Z~e|F{KSMpHzlp>$goa&Jrp9_i*A9SF%xRB0Iw+H~T)
zUiVBmc#X35O*0BU*dAONh9o@<AwSHz2q*92rvG(>|CNTo-UOuPN~LY-F+Y5kk_5kD
z>tt}<Y6Btl!Vg64HOBO%g>FAR7yNnqyMyHosnynt<{T=T;WKbbY+k*bfjwyg=H3gV
zfrruJ$TSKr0{8x}M<i`v+J<^y4(*uFL{DcfU`!i))X(VHIVUq3`sx{r{f{V(moclP
zH7G&gN2$*&QM_<0A!t!E(R*_p-}Z|sxF~JP$+TqVxslDyb-7pf@f)65>-Ebes~*;b
zistQv0fGYK8AA6Fl)Io@bkcO4#a#Ru(fkUvAId8E1Z!3~@FMu{@Mk0Wocs#F6aXoL
zC1D$QhUWV3-d-2VwjV`7w3p0b_jhwTu^!3GH_A<a>{XW4Hwq*0DDUSj)t0KisKS1H
z=c&;K{10kyMym3R^BL-Z1%W>X%%r4IxeP?(pmc<+_~MVLwrRVPLhcM`hQ20p4$kyp
z1U&>zhOhjWAjt$qd&(LtlY=7UG#@dIe#t4<BqB!rJV!+|yJSh2m5ZBe;mi=I5`1#!
z!}V2<!mbCCPJwJ1XDkI7tlR1XN5yn<@<TpG&*EcG6(aQr{l~c8l*YYdaf@dS3W7zc
zerHqy!0tS`t3uQa#uva+>2J3U`?=xMBu_R{JeEd(t$!WAoTfcA-KnGbz|cvvZwcmP
zs5*37LM27&vPR}VcS)0nRWq3Q>CWw9)Ttd__FML?vU?}g?M#Z)fmf89-|;SdcJCoO
zb2<W7)Gp$>vdZHfGSY?Dw|U4^=u}jc=zjX_;wzy}j<8&q7u3t{#p$kJUw&QPAzB7m
zV2PSm;dZi&ys2V)GEwMzZ>`^795)xW%lzckLfW0cYLCsV;(&wCzJt%Zlb#L~I>^)>
z<gOjCi~4h7Dt9TP^FrcwSyI2<=(S!Eahp|3E%bgnHg+SR_0hqWU0wb64PKFXCzoA%
zid*$Qza0ro8376Pu;uyCm8tEmy>ZA7>J7S~g%;GS;s`}%dWsb_wh>7u7lh?zL)*r^
zqv!U8s*F|Z!*Ok;FJ-L{9_0kA4|{N3uo+C0P2#LwRt|GtQoBUC8BZD}pX*})9og><
zy_fYopZ>G6vSC-aHJtjuTp@{Gsz;O|vj6(w+AZ4tl?*xM$~&9|<E=VX_qA!S)1}a~
z9$}jGR2@~5>qY~V-M2b^nfw-4Djxqf@Z?X-|HIx}M^*W5Yr}%1NGbxl2uY>87AZ)G
zbcvKmN=kPlNG-agK|;EuQ=~hjyBo;`i~4TdzrDYG&e`vH$2ntvV|;&{G1ebzti^hs
zhdbsy=QXcuP8^ugiog-1$(~di^W^nvkgo3K)T%WBh4(1UyC>$Rk~YvhybxJEPP=U;
zN4`VR`Jr1nZj-#=8cNp2%=77zc{}Q=%$fun`Krvgs#%vRPRr3(RzWx)^%#`jcYSoV
znFilqEa`L_qfTa;j@EV*60S5XtF7I`48QZ&ix_1GbLkCiMdtx(?Kf~d@ef&-lJ)?=
zZEz4WK5@_G=uO1|5oy=SgT+V`DT>#~Yb)u=gp_0UMb%4>Hzyi%G!3u(?b)5Xi5;Q$
zYaZDRx7MpM8lR2GF|oAz%YD2sk$d)Yn5vd8mr$6>;W7G`ifTFJ2oxIzD@x6-8v6?i
zI7S&QnWI)929<vj*UQ(EHkyuvGGS}K9-V%A3dO^I{J`blQ88bHiN%CVm&wWTbyg2q
z_$tGrEm`9aPkJRG$CHCc{Izcbmt|ft8A`ccI}_#i3V%AW9LU<0vXtZQc-)%Fc4P&E
zt)w{Bl;6Q)^+Z1iIk_AJq@!~sP~eeob!9|#;k)m9H6GF~tjL{T3N9y*f|c2q{j_V|
z4D+7(TA1r1gi_*h{PqmpbE$CtL{jK+Gy`)}yT&;CV3JI`H*KG3m*c$q^61b_g8q_;
z3##_G`GA?_l+|l9VaeH|`QenCgZzPIY7yjv2cJ741iloM*oT)wx@_}tvGpO?{Gz1H
z`VmQ7wt*1$Q8qb3mIUH$tzvz>NtqT})5D)N{f@A4`vsAs$;!eqlLIZoiYpfwy<SPz
z&@;zy5r4eSU1C0#<8)Eay0r<GDuhB4Te`<gmjiW&z0JjIJM!JEZ)OKkyH|+&58UR{
zChQO7AZ%_*Dzj}M3$uEKI~PI1LE9}CL(#?Tv20o=RK*eOmHcc?gD~E>{@&mNi7t6}
z6XG(e`-x`4u*zhS0)*6i?vD!c&KI6m;wo52(>zs(!IB+bD$8DdDiY7)HQUpX<u9UV
z=1<%w#whjq%3iq;qR>03q9Vm}>-*$TWo|-6C2d%I5~^5stUu9;Pv%RXu`EjA1lT;h
zy4at}O4S1Snf}Jq7_y4W;ef689&y`gj@cuW1cGYC&Q(QwjJ{ih$I?cwwekq!SdTKw
zUPm8iZQI#VEd85>rwuEiJi1)@Kfja3dLR>7OlRj)5PPY&5I?rX#aJlzbxu6-nR1I?
z|Co$293!G2d05h@v3%~ndMfB|yhtaeFUX?YK0QBE+8^xD`^Ok$oWDxnwHs`hl3U!U
za-fCVP=~3KuV*U{A>BB*oxg0fgHn-p9o+r-)knkQ=89*s4o(+CxXYwbdx<ppeH(gI
zQfEm|nJLTI@(wGARhvvT!h0<bLv$#J&!md#E7epRs3AV1Y_D1AyXqw>X!9EO^D#9H
z!log|?3g#g{6^)QOQI{btKqO8pC#J;3o62)rM?i_)0&}5^#UzMnb>|?9CXzpakJnH
zX)lyvUoVT2Z=_vA7ppSlwj4IwVWar;0Pv$<g5E3BoYURKF&_S*Hj@Bb`IY}G1{Bib
zUtef~C2L}2EV{%5v(#$U+V8HD4dYLmlQixHN*cEJ?&KcrVVa^24d9{55{*R6>;)Gs
zSN*)mH9djOnu^XrEe(tQVL!sXM4MA6<SMCZt{P12+BCSD$ZsoK7EW<~%ts+Pnvh89
zmD*cc1{OyI8Kw6f$=PXv5*M`0vB1cJ<W}3FalY^#9?iP)c2FAk=&eKet12<mET@BI
zgQ;lLJ?0}<o>;OWLD9m&h?%b~_5`29yuRH8NzVPO?QTZOT<N_@BK>}^$aYW^y{<#{
z@5Y1sU7_DoXm8EE{PXxk%__@SIqkRY1(~>0F46|(En4Bsom+R3)0o2quS<Hr2)?x9
zm(esPwjMNY?R|KV%0Vx6<3Z(4Di0)Dfl5}1`lbdit!A^+g`)L8G?H&frQF4Je29nK
z72XiT@GBhD|9eUE+1X^IdfbkhMXF5wZtYecD2LmAfxSV?GwYPN&1h+CRJY(G^VJyc
zjj;QsdZ9xi;8c+GCcB_~AU3!*<M~lWAHdN(Y)3qBSWaz6cM(jx=j2TY0Xbx9JYny8
z2kL=BA<htM&J7g%>X4T<y}2Jik@?jb`s824uECGZ)+;BLjVzWQ7B;*&RpLb_2?~GO
z;Z`+eAz0?}>E0JEj`xnl=9G_D&@c_~yj8{m(5`mB=r_%5iCwk(AtKg4Q8`b{Gi4XG
z$)kU|BTrnut@N#%31$&H=YO}q**kOgpnA@V**a7)6CJaRB(cp(%VKQRWevY%-M(p}
zQFf}*Ea`XXT9pvz{Ykwo_!83lDXoiS;{m<GH#JfoS10Q53eaUsa>5<HH7knh?=&C?
ziz#Vze=rm<r7vTv!;n#KN)=0*qdh(+*FK+ro&<^wa(oz14|LaXobJ`xBP`g8j*^cO
zY6$4YmwaeFP^$h>XWY`lV7<SX66c&RKtg3rLIMxNRSW4^bi>gSVwyF%9lsz`DMqu+
zj@s?0aNJ;UVaMwvJBr;cVQV!1p`NnUR-C=0&laJbyD*)Uum=7ZR21G}rlE=Yu5o`Z
zZ|`YxbU)~W8gzvtts-pQ)93iA6^%(t7rl7T?fBpV7PY(&xXWZXrbmk)#X}&ak1R^s
z)rv5}27Lb&LH~|FhNP^-zPM5VX1I*sr{29|mA9>v$rq3cS_vQ<+e91o5b-8-;HNb+
zPHoQ2#4&H%QR8k(C)`bfb6*WOORr~tP{t>*Ab31PqQ<Pd&V2)8fA!;Qwfb#-qFGTh
zj_&3n{&k{|oE3i$UwQ1S()W_kZ5K+@<Id+wl{?S-8%-Xpm7)bUxMIg1_4fr`!z6&R
zf-yc9PH$vD?e4BUAmHD^;Nd6Qy<Ob2Bav}GPYZLHc^mBHugpl(??&vXd4!X!(K|aE
z-d+0^rRS3vP{mT!B+t45BA;9|3kyB#u}@1JGbq4pgNDyqq+Pnh)}UE0^y8!@(Xw9q
z3y)b24;c5R1AonAlW+uu(2J&n&&~N^+pBwm!kt(w0{J|ux@3;nGMNpIGu>KGkq9XM
zdii<@iYA#$+7v&lu7#cwV|5?x36^yzuEo=R8N&5R7mdipBJJYBWCpg5;OV=qi9xyT
zO6=91JNSaPqQWehIBS;Kf|nL2eN`i~IATSp$;Yh4hCS-QkgVR;=mbT5tLwtQZ?~w*
zBw1*N@xEWV<9r^oK3nU88kOld<54^p9Ta2bFkbp%xfug8L*b2qTv;!wK#DScz|g66
zSnNr<rQ(bKCRptx>Et4RG}2UcTRaK2Q&8M^8VS|~IxNL(zA+V*q`;nyv}<`NbMt67
ziwT<XvK~h0_oH703R>)3u%}FGs{Zc8Wn7jR2r|tnj1ynb-Pp1##YV+<BeJDk$O#tQ
zKkA|*?<yZC91qB3UQ|H*j53=wXI(?#m-Aukk|b{^E~BrfB)7UA)Yu<4t{yRlRIPjV
z@{wE+Z*42(Dm?YJ^<uW89;dEmG(q_h+i+UX>_q8%pFO?tVs82{9U<7tJJHK;*w6Nm
zdNTiJj3O+SS!bF5j?n2DmCeD+xUSNUM~->*h^b&7cmVUqhgvn4)~Yum#za1M^qDo#
zxx={kEn$IIYf6`E*;nlqdVMz=u4}grp#ZY;u2hPqd#)g?f0xHeA)x1tpV^oRMGU=~
zZ9a;<!eefOdeGO&dA<Hti-G#7Y1UexqN8tUg<Gy-K40flDL26Jj=_E#y{qPA8J)}!
zrQ~}@aS}m?k3S)<z;H1)V-s{zAfFQR#r!8XXJxsg@8Jfv!VZPh#5#|IIBC;+;V5x?
z2|?HU(OCUWKN}c*fZ*3Kwa%g_etZljw`SeoF{&tuML?eH+K*}jx~bIG(z`<tVWwPr
zN-nVZ<06HL>QHMMCd_zm1|PJs7fXep<o>sdzV61$UXGiXz$i&Rc<MdGU|JcK8s0tS
zrZ~++vnF8-VJH$*YL16K%Cvk<14dlC`<H>^M$3l1ge$Y?Pg-yBm&WSdH1sFd{UEKH
znhe<Wh#$X3Y?JOmytHwJ?qUQ5EtGYT>#_%MEZ>TZv7Z=+?OHc(LR&&sxQBXYxaW7P
zTg5vFqZ=l#nMH5jn?G@!kib^-X1DjMIJj*=#G>c+=^cJ8#c#g^zu_L7xiJRu#MBWB
z1fM9PE2v}+vsPF~#<hsqMC1c6!P34;+#(eszh;;y*}P5<VY_*{81MW`b-e4tD>`J-
zDvu(>nGB0XbVO$P-7K{4=Y#9E(#V^yn;~$E`RkgB596Ij4nKg&JG^*xEa?B_cT{=`
z&-p+<FnR~Q91=${WfzHCwdyR!hq8%t_`Fe>@!N>G;mJS<Ttw35iu!@pm%B*@(8$dE
zk1s|Ogh0mfNbQ{y=H1uYuf>=f2Ck7n!>N~m1iZ!n$kGXcnZW5>QMAXbk4=!sWsxuR
zZ2#l-R1`hpPR6VLRCpS+vvj}hVNhvEtevY)Pg*x&v29HlSd#7-6KILqz#l=X_PFA&
z5tT*TelO8eDqPkVvXYZ`f2~!O)>b=%@9ClwIOtaj?yYa-Ax|Qf!(5Xrj*?4V;qc)!
z#jifHsRq#IMA%B@eSdsL%CBvjy_l@R%Q;TdM(%$%T;9F33p}Fc9s}-G+nOJSE3)bE
zY?ltXR^vJCoOG*FCea+YE#Hbc>>~OFi_~{Y7lK&?*A3_fJNj}vKYrbu<CyN!8n4+M
ztIM*^RC7_@klM>w_?w$#PUBk81-Q>(9lvooCH~6O*278#qAP>pyUDCgPxLp}ci_ln
zKSjtgqXjn&y!E1(v55L&RdJa{68Fk<Q}t|4C)evh=;x^T@e_(0=7hu}(X!uKj=QqM
zfM;A~fnq|+UJzD}O-gL1_pI}BG+p0TG|@;jI}#9vYwCK>(KW*!^$eW_F%(4<H%&!Q
zaikaC1R3QLfT%EuTtsqvwD6g0jIvRD8(HuaY^6H3kil&=hREQo^BRAab#>Qu|C?9a
zRavU6c-yll9fZQ5kh*iTV9;yrLAt57`)codPJnRnmSK^kTozKXZ<jQ*%e`~IxiqEN
zow-VyA_~Kg$yF~pn`*{)gxavTadDH*mV#qFP?l=lhuT&48Ampg9cc&t=ezy`=%jYx
z%57$_sc3tQ3O)Xo=2EvSf4X>&`H8>R0suNddu54>zO49tvQ8xfZO-6Sj_|ANp54nZ
zXW62tJD7fA6ve=G-k#YIYek^pZha&PW;XXBi%%sr!1RXUsceqxdIq|@9m<gGo|){?
zhGu~5w#=13yzZnAo@SxHqNc<kx|7w5a3R%b10|oSZ}^rO8)W9L=bwP?bB-V;=C;(=
zdg={w0o}lKG-=!J7<=+0hB3qnRp`vp+Q7AAX1A~(tH#XMd48-q=|-lZ!c{LLpwWP>
z=y_Ignohj1Y+`~En^btwRMQ<@zb_TnE*FuUQA1_=<XgiGinc4X9FJ|t@<-ND-`fi!
z5g~Z!WAJEq$ihp@X)%kr0;n#!N4gUrG=#_L9`jMP%OLXXJ3n#qaID>>kkP!JL|Py6
zKfmZWov;=&Tt1T5|MgtY?ZQ7D7rPavJg;0}IN@2G4I`=zxX7Pf1gw$^y|4~h!AOk(
zv#Zl-&{fhtQGz#m8etzrPTJM*%xJE$<kn0b+=NmzKW@*TY9Y22jmvE|c{a3W-+REc
zQ^u_1&1-*f@18-=hRKm_E%wpuvLX2z9mCExjSRUdnx^Qy>&YJImWvYO@3GWL6}+iw
zPcZo*S)vT!J18(dg-(5KJ2mG9($O`s@%2cQ;e@|JIp51h0{5^*=d-TCHv_$7+cbHu
z-`7cOw;2fY2fpRHp4iZaIpA*YiNh{3sGKWuo~(P=dPNbzRyrg7%|FyS$(m9jU)1w4
ztPG0bj{Fh`{mR-Yvf?6`=2sg3jWLj$%@B90SClei0dxXtY1j)B-i<(D?>VC7?#X>0
z2Aq|eMTEJroNHtU_Z<#G9wTU+uEX~SZD)dn=SV;9C2-kc=4lO`)KDW4NXa8twq$Qg
z!JuEb^h+V`$EE#!i~1Tp0<KGZu~d9=I+X^Yi3!L<HkuU$bkM@r3*iH-8NbF$=v--G
zsZ3d~k{6CqZziKiCjvI0of}_6lS>Bds5>e*?LNI;#(u2Uw)fdb=y)5db$Wxyug_k&
zz+w@460zH<f_FwD{F1X5`yYl2S-#oIhc`E}2QqTT7b$7$pTOoG0degGr8wS)CBAMG
zq8uL2wYP!=s+2dGbPhz+A6`|howeITf!hnbwzGgcja`8CGI|C3x%Vc>;n^xWHY9V4
z$cDs)Pdni0_>Od#37Y4cBNe|Pn$}3NpC~!R$!<Z$HFBz-`1D)%ad4WY5#Q@g*7ZJZ
z620(SyD~=g#lkun<sK!{Wq&N=ThgaiDbv-W?V;prfp_H`sG`fOzq$G>vqRz)U+V|S
z3r|y$Lb(QpU?048la8A2I~$z5s!A!8G@C0cay#migY&BO^Je<oSF^!IO{g6gIt}kl
z6mFe_aiK4&oUIGHlC?yWcCs57sg-byY&pRA*4}Jp`8b(h*#$RuT>u=Rk4<OPemAQy
z?%0MpK*uKgak;7c(-niGSbIvRc(k-ZDE9}o9*)mSzKFgots3Q(!YUp0_P8fA+~#+S
zDt8~Rf4mMz(rJ8{;9AapFxCDw^l@bftCTZHSQ;#(rJOSLaITi<Xz>+ozmT+%_381E
zpfH~_dra6mk!gCelQ#RMP|&{|+Y2jb=a)bU=e#74`368!{0a({PPj#BHOu2A#4%zC
z`20hAZE^=VI(~ZCJ_pfbHdxqfh2I#ufN9%<#sR=-5x)~x^6+nljc1j?z|`_2-JzY|
zKy)Xqk)>ks`?=q{CQidcf#(h@ihFzZ@&fc6Mn>qa@}oNUY;GD|_lZK5dvXh^dej*S
zv|1U7tEfJwUh5##42R534TkOqhu#`ck!(CELwA$G`69m4R@<&nq2oUucQ^jqICOQU
zn3uup8vv;b+qIacRJq6Q5MnZ_PqnlEXad@@Crvb=-J(dgf3JLkByiqsn~Q{#SEj>j
zC+L=)n55X~lc~G$Ey)R#yRb~zL*eyPY-An~x`+-*<$Yo0|D)X^gyDm9vx80Z{KDu5
z{nh6&@7nW05hi!!hA+%#WCe=bWIUhW({G4fHPYG7%L-;NLCv*4Seh4|*k>?Z?Vx;|
z1I_&y3*S1}B>wLHlDtu6Mf?ZMntc*lMsPZB270h%y;}XU_p6tp6l`<Q>XO$xMVn{@
z4Y}4?AZJ7lDu%=Vn*s>F^>8#SuVphrTf|)WYHepzHlg@t*UIDT>{pn6f<<XNeW#9r
z>&2}QsxOE^lUfOmGrw=Rq1lf2`Gs>X%%?QZ!S;(H3~YR0r~961x3>Xwr;W1|oa(N$
z&=i#41|`FiT=zchv4yB>e*dswNtc%@A~vq&?yFURj6~rCHzK4aY(ea@gQh{ZF=F|X
zWm1lhK%0W!x7KPI1!^+EP<;3!0}lG`35j~>>eY8#8syHG-_wMf4sf(@GsG0tj#Kon
zBrJ%-n&|i=FRt>C$#{hQ4}V0=IN1G6E1LJRER*I_%A|N<1-HDS61tN~;+ozl7~Ucj
zoeXVKYJY8C&RuYGg%<cxjwg8nKb^=o(fz{1;ce}9e~?m>PWflGT_kgW`^RtyP+}XC
zaOssmU3w{63=)_-IR%W4IUSMF?^26XfqGwkxEij%zfLdQh7?zrz<;Zxa*pZd`s(uC
zh0pRhJs_^j=hNf^NTu6%IzJ%H*>bDi^#46HT_;Z`sq>!PV0b}Pf8{e(&;~ty&y<oz
z^)uHO8!2`9w<R5Bmsul8S##^^FZQPUg~ZVx^Emi#16l7Bj$$(OG`5Gi?iKl?de5|i
z){a7E!CKsCES73<t00TZ4{~1TB*HbJz=e|X`s?)&sR?r_?G>{vd-Fg9WFd}8cj2;?
z|2`Ie+D=eUaZ9%H?^!3$@6#vQ<&Z3&(ije((iZPh$NBz#_;chlyX`6UekeTSvu&@m
z3Z#VYVSU+`mz*HL`D0O=v*NU#YxBbc7rd>yXk^y-Na_x-0|M_8yK6aY#uSm=r)#dR
zeVOlqzy2P$f=2Qw^~b{!Bz!LKU}g#Pp}e21CcL{B_JI!8ZtKT}l?c#XTprNO+E%$=
zf2-IZ9Gz_s;+yoc7{ROe<FE3(iNF^XRp_uoYpdi#LKf8Rn}WMMPRV4(!h9%>j8Q%H
zO~3fFW<YCeWY*DYRvZsMKh;K2o@yagoQ}&&zxvX<0{2M^?)S<Ku(OI$r1*#Cy)-!V
zkI*?X+EsmmUOmpi5vgxnS2??~m0#o-26d^JBb`kP`FKb+;TipoOoWKzUEw^$PpE?%
zR$<ry`a@H(znN^G#+YN%Mr~zHR;~AeZ*5P?XtHdsO2KUT9X3eVEUz|};aRR>4wkkK
zvHP=iO>sJ}_Dvou&D$I$4_8P(fkQ?V9`^s{$YF5^D|Fw{O8^xD>a?pr>X8Ur#y-4(
zTki=?N6hpu`37N_9R8+a(30#;5k!+P*ndgNAL)xMBT9ppy;JC<s~V&CH9fe@ab9k3
zhQ;B9B}_%s{D3q+cvnhC!JxR&ld&gGSlR#nW3xS*F^e2w?Uw%0eE9UysEcsyTKt3+
zbDNbVe`h>*$T@lWjTRje0Y-p`2XAENdd*OP{{c2xtPm%|*$m})Hafh*^QO2AF@&y4
z@hyOKnhZs!_9Pa%no`FgS-)QI;{#fI9ZbpSU52H3PT^p#^O$SRerJ1e6W&*77U%KC
zz8itPZEzS}aOceg{-eZ#v2$Te12S)wUw?!5gawj;)lc6~68MmE@e!ZZ^2g7J!yVi0
zWOt%(A)SMZ@%pYuPjpj>4R&(3+u!=1&-!dr<UTw8QCoko#=!2dqc92Y5i%y)E7lzM
zC@N@^+Ym{^67?3tf!NxeOKcW@AwhzI#M5O5x4HgzxyRFbrJ|aQn=)w)!@@6ejAFxt
zTy!Uq`y+9G5$s=Z^z$lDZgK@m&3r;s!dU<2h9ZRY`62`KYzvDYSZo^8r41zhmH%*2
zMjegMuV%5XdT@1$Ek^zrfP=2eY-&F)T?KbaT2;s3=u|6=$4A8a`q%ey1OS{J5d>GY
zb@fa8^viT+lRvmh4R$^LT+&8+CuHd(vHwv<%1vus!K+`>+JbET92SBepx7Z-QGa8K
zWn51$72aC4PZ`hjJWWc|!y|XS6!<a64Iv6%sZ2wy?8;sp{d8R>S~D&%)K8Afaj_^F
z2;Av58qb(^#c9GVK*gO9M(tBCw=8oGyvu7P!*Xvc^bL;Q;Vd(TbAz6ay(00G2PP&{
zqp0{t4q^c(){*U-!S8wnotLyuX2WAXFFc7kE7Az&N0jIrzejTpGWuss(K<NLqdX&&
zf?M^E$$o|)$oDIBl^s>5Pqr^EP3q!k3xs&e*ina_1P3j@(E;(a8TONkaHwSyPexq4
z__?ZKG8cBSg5LgID#S2RZR};zSMGYWliUY=3z!|3Xn_vmd`Z4OJ1d`XpEG{Kx?wO2
zIA|J25sdChhMuUA*H5B-`0RCjRkWY<IXb(X_KQy|!pnPhR;{mvowQ4v5ri`#R3JME
zV!wDdjanyrze9jCIV4}q1l|`Z72W|z-l*s!Dq`~lR7H+-0gk&S3r-aalt!n#vp5E4
zEKS#xFJaFfKRr6Oo{oUnSpPWFP|91utPP5KzG+5?g0gzH{EGLLs5>4!SZZ_L9UeMI
z7<UlmN}&D^D=Z~~|2vTaCvSzF?!FIi<Xxd8=7>@>(a~P3mk_aV3KT5%o;D)wJ>r7+
zixSvD+=s9FWL2bH7MYJm+p4&WbaQlQ9Dn>W_uU3Q5_KA8h3cenk)npl((`adCP3{v
z^B-9UKJ4I_FGI@b@XYYSGY7~wAJIn8=(T^<yj6M@-3>hxQsk4KfVy5~Hcu`2NQ(t6
zKK^PsOn5d>zMQmRx<9Q_5v%BAWR84w+Nvp{U;FJ;j%^~!J!&KteNJIKjJHGIY=bdK
z6G$;0HI0+%x<9XTyrIaFiHV>JV~owz0HZ?K9+tR?qQl9cfB#djM<rPwH|J5J?;wD5
zB3siw4*S)Z%4L)Yy<8A!uw5Uw5s#p>39)(0))Boy-tH(GTo@O^U5vaOb$&!<x2Ih-
z`(4wFuGMSKa;&0o#!cA)?R_WT#^EV_f@Ycc=4aPtJ`hHR)1_!-$`e7GSq!**Tp`v@
z_*|3P{4dl$M}gVg*`E8}q-8f`_{JV9MVLKAZ%^8I&mK3AkUuh!vswoa(~rhAm=OAE
ztvBd0<?1>>`w-N~;6->4hbA1}E3g0;V8AFNf`5o5><Q;OeP<h2psuk&E8pjU;K2P-
zi_swbC7lMAsJ|pm+T|Pa;UMWj^34#ujRs_loKOyXA|Q@<#UKM>^_%r1y@cF!GD9B*
ze^Zd->$;c4K598x%P09=d^Zb`@8x8y$~$gBw7jQ1?@9M@iBTg%1;;fTIOLKWd_N49
z9efz5!}U<=SHkC+Xf??nA6J>du6l(!@^O=kl3r9;7g?gWFevPlGMqZ|MWT~Hmu4tv
z3icmqVfk-4u}qz&4w8!Ky8Uj6(6=qFsY5+df4LF6SaNgHPkIQ~^^^%DprImeIWILm
zF?YvA;L$#*=!i@~`Mt|&(S4WC!_32RIjiRts=JAT<~qo>SHs0EimuMiCowmU2B7;d
zHfK4YCMYXzp>N^*r=htI+W+{YtUJ6Xf*rs@!-KZ9(ju`=Hn=I?hZLSvOOiROz^*_y
z^U%SU<b}se<wlIK4fgg0UAKdThpLDhPfeF+P+}&z3Q~%L6i|;wccmtD+i+}Whav}`
zXz?~_Vx}cJnYg=8FhJhkMIV6{DK(X4b;E4=g5!wT=e3xzd7QVeD`*U7IEfP9;nP2`
zX?wZT>eCs-dW$BO#?r{d#sYLy^1J+Rej<Kf5)L|v-i}R|z%9B3EPw7^ALnisN4NC$
zpIKi`BB=Vr$_`uF%HGg0vdZ8k;+6}IOH*iL{#=$KYv*C$J-=%F;S_e>HApeQU_NV>
z(Wtapa2v1>P}A953VzW3g~N4|M84{k8TS0zk(h}2TiIzEMVXUF^yNqD4)-4|kLAKj
z?+NX^t;l0w{Sl<P^ZBPjziPg9+{KV(>Jx)-6XS`JX|G7Di?~!Q%BD;wzDWI>KAu_T
zzAr|`Yt2H%KKHkF`8lm=hmH>bf~cJ;1GpE*)PJ*X)eHvrgfrbx;b;xfnxc>{{O877
zE9ZRd{&m<l<z?;{>%-aFRIXL!?n{BI20u#z*@Pw1D;f`j%w~_kqKAA$WIS9lI+lZ@
z=%bRCf#&fsInj&J8h>y^x+8&G^y#lGs@FV<wE|7thk8J~fRK<xctdV7VjSn(We_L(
zTh0??SW_|F0#|-op0iAQmcTrq@0i5Y+N63UuQtH1b9io{1qvj2WYCsWLBnfXg4ohY
zO$C}xwLSRFS)7}(&XU-s4@R9|d@zdWFzg;JD1fawE~^>VYlEZ_+dfi)nY!S^%{!kQ
z^dRTW^)Y-9$rG-FS;R~`woTtJo(*k2@SlqqRCd49d-C=NYc@!)%^p?1Kt@d#`722B
zX05+Q^stM+tg6CFN}-cYqG}6zDKX8n{dCLyV5y_7t{&3myH)fqWVX!y3ZsU|00)@}
zZc8mmO57DfBFGhR+00h{P6(9*wQ-`cZ-&%%c1%VBd`$)7=J08&9vr;O7@PhM_e9hL
z+z6zhVyDf+@D_ZM*!P4-HDISw4Gw?BET6>`FRpyojEwFk$PH(2JmC+!kfMmf^n2>s
zlA}J*Vgr~VFJFGD`2`q@v!u%4XGAEIW_Q^`H%>~)8m4*z$SsEx@p~3cJ=R8*<-#V6
zjlFnqzv#bbIX4?SNle7y&&EbTGW%}g-Iw@*UE)PKoQe>@2lR;fg|tW6LJx701nY2r
zlSVDqVq}jhqSpB+8&*VqZWzVy?y}D4F4`cZ=&2_&*rCc-@4ky=^LQqptG%8U>;q8I
zHA9HA(`p=YL6d>|$#>xMVpPVK5?iIDza{bW+vSQ*3ProB!`!Yz9mmQubKW_SjONgj
zlgv3>9f<b6lKck$A<9;FbKAyogUxp(MqM`~mxw#@b9+sM8cO(CmTu}IGHJ4IOC9OH
zef|7y<UK$V*_WO*K6)}C<B+C9$vuwXABy#GKwfix(B2n0oYhlZmvXuPHi6r{zV4sG
z;>4g*g0cDh#-E`)GkFAe>;@B4WG-iMpUm-4wiXsS%{QoKITZT4aBLBD&DX+Ba(v2-
zXn2PS@hj3~fbta!LuWceRZu&$=ROTyJMg+3J&SJmUu!aOA~&Vdt6Bw5rEGcyzA9ZC
z_XV~l_<S+|HRexH?0FfB@s-VV#o&3ikL4L*$mC)gx$Hp5(SsrR1-I!%f{XfYbn?da
ziJ$56Mwsu9^v2ftF~2e(DZ|<hhlb#B8$1kC2N&+24#<w8(h(k)v3grNq|QlR#VWPi
zI^Q`!Inn*jvQ@04pBWyPBb&UWU1Bb8vys_i7i;HNdrda~!W(|<Km0KDHB^5GMxL*|
zK+Oj#PSYthxcAQOO*95*>G3lDz#wb?J=Fc2E_Ll0^yC0Q0bNh58uNH&4S}pC%O-1!
zk5a({<OojmCe?uCgVy+Z-8@H#*7pl%{%VR@(SmQ4L?|M~ms>nfvuP1ia`Oy;&Ivg$
z4J<p*t+VJSVMzFdHKNGW;bSPQEvyC#u@O*9gIsnmcUh7jUsems`(v)%%U8EHN_|&9
z5v6eDe@^~o5#9acbV+95<!B2U8ZQVdV>ku`WMmN#VrvNb3eYBh>0aPgFsuo=e8<5+
z=_&=3VOdFE1lX~J2GxbC#m5TVrPc=e)U<HPrZne3U4Zhua*qkU02%dPa-TQ``iF>A
zM8=+qi(M@E!flcg6X9|&iE7`!$H{3T1gvyrNNEy<u1SoGkNx?choo7_CXSB<P{tZ5
zl&kAFi~5J{?2}ay8g@qWnRhzzU7tl-k`}z{{cf~NPxr+6Cz9FSs5Hk}jjldFFDr3_
zFQT#R&)n4t-G&AAeSlO}!aXh#b%?(1+x^hW((|C0V1usVb0gJ17S)T+TZx|7=*p#U
zC8>M>&KWL7(HTId!EE*mPGJzOE3H!0@(wjYvq-If`txBSR+;<e{rT*<2XY+SDr?g^
zf@n4UG6;x4Vgi@34Q$`s9U^0Jcdw|7Dk<xJ?Qs=nWBQ^LkTpY|+etmWWxu%wB?EJO
zZ7YGgIa;cYvpzOv@dRzyyEfGJ6AF8hNCG<@-{G2h7VbzB&r$66dW~|Um>TGN(tbK$
zbXY7X(MtZ5DqMACM7|0GviFEZYnLn$M6LzyJBy#WOCky-efQ`!#}<f>-vP;FQk2FM
zjjBEZJDd!Figa5y`n%@E?KF#qEP}iPM6Wtm{)O<Lyn}Q18@l*_IdX#!+cbI*Y^o2%
z$l1X}LIplzWJ_eHHg-SXT-2IbIjm%B9;6Zy?=optHgg;y<uzkA_<q@EEB3x(rGFWV
ze5{VX>vh+2x0cYFH)G+-i<`ObxchSxd3_?Q-jtPyy674R)vqVl$9m2%TdAfN&~Bjv
zy-uBvtxgC1(7nEci|MR2HK0?>Z&$uTJ;Hjn-w3Zf-W_k#;JN9sn>3qa7|Wm2oj%Wj
zFKer2ZSA^nbPybkbN#9>XZAQ*PLN?M9~A#%cx4T)CFh^~4bY7L3JHs-xz}a}Arx1O
zR&eR-idy5dSZFHkPB8}Qi@IsOEwR=!G+a&cw_l|cI}}#|w;c}IrW_oSVX;zKK4kMg
zrVN~r5p91#2iVndYlA}~9{Y;RdqesGyvw?9BoYR_a<(sP^q2+@y;VklMq}6i8*bYb
zT&*ReSH!Kvb|%l9za#Vst^F3KLllN+)7z%SE4~!Z!BTzLgUlTaV5IxR#)q@*iCWyJ
z3~#P=R~54yeV8fViXNt~^-Xnkb>sXRBhd?K)Hdwc5>89pnY;2eexO%=P><o5jg2&M
z`72jP{x^>$QT=q&+51F}0DJ~sCy#A0UpM)sIf-wK6;pGpUv@+qW~Q{3XWq08$TbU$
z_kY=5-H87Oe%a?5_MHrnX)MVHYGTWLOUlQVc#+iyQaFB*=x-xV4?$AT+9!$(K>fR7
z-8joU&PRRY20wF=6g$>Cvo&)ZGBMma`}5yk^+R^8CD-sV^l$ydx+W}Yc4!+$^yaz>
z-z^gATg|MSXZ>hxyy4a0IiI^F-bG1T8Rd|p&tB9#!O=U%c~$8>HKZ>MkZ!g|R|~$f
z><*U-^9Cu^YLp1fq_DKfs(FX7C(R@mcHTuO4j*uZ%U<jUy+JEI|IF+CggQJM1*8CW
z5!9e=m$4l3+a^uv<3z5`eTE_U8$6ON$5ez<eC_y-bNkHsD@Ax->Z>iLO{o-@0cv$Y
zA4+WU8M<T@Ig+15k;(IJG>O933g)f(T3lqq(!?rDzIr!S7pqJsdNuOcrZ&n!M8a~j
z+aHkIm}%E5Ew8AHb|`9UXa{boDc&Y1tVp=}Q;{^U_$0JbJr5Gx4!b1TNIQ2c@o1_p
zH;wu62ZSdNOWA*3{VXCdd4lvZjrf`E4`~?w-Z-==wlJ?j#f1o^7GI6>A3PUtPmBrw
zDA_M#b}$h|`%;^5zLoGFTZtdb&DEA!i0_~<5qrk)Hb%3LPC~}3Wvg&eDH^TAo+*ht
z<aWgrtB6}Xx&;b9$KA2hTJ28BOUl8Gu=;(K-H599CL%F1SF4o^KeWmZQTa&`vr*Q*
z6q~LCM!p8&mot3oUwYE$F5J_RC>$~!_@o{FDF$+LT+W10vSwo2^s;*QdS*fUH^_f4
z@u$W}r%~WH?-Tle3V7!1OTj-~>He6bJhcz4sr=@0ozWO)sTFtLvCMGN-p4%Ag>!Ts
zDB7s*?ktpuPQChyL#v>dcAxnp#m!E6p`7r0RKM3NE`do{zFQCE85zQz>!R;&KH?(x
z@v0ZSx2C|XWb-(oPDc$Xk)n8+>7#@&=z5=2%HbpSG~7l<xY+5U7eO6Pk3taBP>tK0
zpQ5^`#U(VIRkq&{o<C1+Xq9*Q(g{wr5g&UbJa<_ghr%8qQg)mk=;2EzMt)Bltx*|9
z?+|??d((DmaoEQLUG^vloRV3b>!#Oa2&s!8bUa!MTN+lS_LZH%1GT8XVtT6#2ec!0
zX~C~G?1uwaA+FNUM6<yTBD)>p3c*pV<vP?|k?d5DDH3FT1KwH_Z7dk-^Ufu;%9-a%
zwJId%vXikdZc5C?9Yy8rx4>l=g3I4`<9jh5p%_BdYmYHauNNrJ-=daXz1|dCPVnsF
zbT_G;(4s@^KJgcNc*uAk+MgyI!g{T9@*S@tZ>B4UA17jvrp2E!mzl)Ei@bfkErwC@
zPT0-2=KO<+bE?+;u2-?kNntTJF9e$S+;O$CdA$EnL^iK3eNTmQ3#5*d@hXIK(Meq<
z%W`=2^?L~|Zw_tg?#K!_n3&KhUZG5hc+sBul4?}MFO#2KU+jM~Kk{5qNF(T5qZ;fg
z5Jx6?O)+GpmUinsoseN|v-xGYa;=j@G*js4KHt)5b;(%#E+%>S`%M|m?XvvOFK;|d
zagL<>2L$Fpf4qX`01?hs>C_RY_`f>|e}~j>Q5_07<k5h3%#dGz;Uz_ZiIR&ei>$&e
zjeHBx{MT3bJ_?{=?uU7i{^z^?d5+(dBCXOa^fQvTzjc=J@{e-vNmQr$FVFa_8r+Ae
zdLYFSFfGIRZ*Q7x+>-MD5?lWfp8a{_C+P)SSu8b>`4>+lg8Y;qZPDN}>*T}RkZvXN
z4mO=FCM+l7KVIVY(jrOVMxhUg^KYX+5dsVa@-Ha4<{<6y&*Slr_Z0J(gAoGr<Veu}
zIt<{Gg_q#J(^07gtQRko!&q?Fqgb9|iT^Ta3Lh~Q$lrcU72Hn(<7<C=Q~m)T!GEIQ
z{f7y}2)hG#jrv`&|MH<;P!Bd*@O)EP)XHg-7dn>$y{n(R-~MZ!DKNYbmW{gc1Bk5i
ziZm|51&)80QRI~3{5{hB=K=Y*4#mG5pa15Eiv(#@&eZ~wkN?%v{_~UnPv5UVk@zFm
zFR0$3|I3m6H+)E;g$yXAadevhb-n+~&GO&=(A$kpMDozh6J_UrItc%#4fc=E{bX);
z+M$8jzuam6h7bQQ2IRjzCjZ5>P<Vg5-M3mP=Ar+Gjs1@u{y%+lm<;yl(G`Bl-G9S?
z{L6iU#|##0Ku=WRzp!Hembn*cd;s=aqcF0=|8x-kuN&qE4Opxnoy)lXgMIrqOz_{Q
zywefvw<<DkwD-GfwEv%(4H9pwrrCtS?-ldMFqS5%+~k=Qx8|Xahd0nFy2SMuMth%f
zl1F&u7XJh({#$0~9~TkPA;9Rd`T|>VJ|A^r`rBa2BlFivXRz=LwAV!aS>?@fcUDVS
zDAjI<*Zb>(G)6i8_d0*3)(unP(FNsu)Y~6Q@gsFFeWhAMy`4M?TBPp9cqgauKL?oK
z9YgDscWW>I{>{?A{)Qg>CfCI2&y|N^Ua^~Y)be$b9XNkZ)HVD;78?FY<GJ!xQm}Bp
zqJuv^c9Pq<%_bOuXX@Ws@2LaEQ3@A1x^43yY2p^}?WGmbNSYjoa|Av^I0EHafbtDV
zX#m(*3G!ZLyho{Q```g7PQZVWbItJ{7kDY`so+`Hg!Sj1g6o<-NQ21juD8zJ?i3LL
zl#16mRL%mUZ{q$83&nGkW0^qMigZhl#I1kxzr*yu!}Pza>3=uf|JtViHR1n%IqAY*
zq0p=Fs=uw;d8R3RCGH=#k@`woX1fs_cqhyH>(Uehn8!Op3f<9s(h{L0)QLQv(d**_
zqgYChjJKjz-6KS7FkUAM=w6>4;eMFS*0W(&5YfzHWKP3PsnSlv_{f+z6_#kj`#lxc
zRT5e6!9qN@dB(S2DSuAx!u20>e*$A~>NMR~KtvfHmdYaw&SB)+b9mut2^KhqQB%Ni
z>wWWp;tn{iA5wtR8X4DH8+a4Xexp1K#=1<sg9NUz!T}C@H;+5@0+?S(y#ErV(cO|O
z0K;Ckd@je*@p-T^e6qxtIy?wvZ9x0^%b<rbL;7evfGC|9r2V=_Nbyn5s=j`XG{rnd
z!Q1n%w!1(X)?X!Lu=MG9Fvr2S!xSls$U7Zn5dumU!8W|VQZO#Wkh^G_*(_|%*BrOs
zW{*S&G^L^xr>Y=ly#fWhS?ZL=1WVOC5Fg}~ird=3@oyt9(i9Eg3s--EKVB2TQxU!-
z48atc+n{|BFO3l=fJ*ZZ04a{4@QCh3*m~q0%!eq*=wwc5%^D`~z5P{?<9prBr2L2u
zmEj2u(ycryfZU^c#-(TWu>DDKr}1>9zlU*jYdV#oFLn6PEmo4$A)}E5DKd{iVUM|!
zY!!KA@H{xGHKs69B%2^@MAjyS(a_qax=fWoiUt|dlRZ4rIZ4#LnDn|j0EIo_PDe$;
zrQORvPK}YUF?<hkOh#`g$E$eTE9S#oS<2->$NpaFYwcS|fMn3h&(_uR<|=NqNK^52
zcRKD{RnG;bcLgn&-1Ai_A@?n0zKt|rgAUm4aE@+Vh2bPX%lR$}Y?H6ydn3|~2p7qz
zIV>m{vv+<`z1-H=haK)(w>C=W!zQ!Y-TJrR)C!AcoUWMmR#T>a`!Q<s&(HSv#OT9>
z)b{GjGk~n$8MKwcwE5lg$pD^0ZU8{Ol}Y2&$T*!j;%caIlA`EdV}4|kOZTP?(1P`l
zdtT8%o2H)bTewKZGA8HvOkNV_7P2Bn3(Y)1X#nNB+WSB>xO!lppIm#+6mZu*J_hXA
z!%&g*7XeZyrYE=hV;V5gv0}J_uYul`X!7)2&3U_Ue05P$ts96%ALV+2i3=ai)sgJy
zTYn*WO=csd2im;O9&Q?g!U+g_Yr|I<GS@El^?=s*swj00@&YXYS7>HMwQmw#NDMtJ
z=6xH?rt;?UNPcrPOLeBD_gQcz<r-M`3MjYWb!|QyDSKy{NH(X14wM;9uY2kZQM>(K
zLrzeV<K8EwN^`yw4_+;g^HpQeWt8c*C{E{=q<WXGsd>^gyYsNt^MbhtO*hwd!^UHw
zldnOxN;=H)?yu@=ikvx~`Mqc|!RZcxj%^CVQX;}VD(_KRJpY;Fx>nXzQ&4cBTkw^G
zTJA^K!y8A;tSAAI#)~~oN%DivOopT^UC#{CaT{fFaz4}WTj{LJh@<nsY|Kg#l%eLN
z()~K&K4i3Yw!Qo3LHQ_;D2efW`#MkOgmvr8@|h9nJzNk1Rn7@>gg|C}tqT+$bsz<+
zN>iX>Qp*s9TJ7h-$D?gygph1D!o_f`k1<m%E>u!H5SY%E%Oj1P=6odEenRebov`A{
zj=ad_i7vX-?DoT}nX3!WX_mriP9^;%;aPVN20(R-9g&B&7M{-Mki`LEZuRt_K8sHE
z6e%1A;bMIeN9r#N;+fz?2Cy*|F&3sT^71Xiw~HGz<b<#88^f?w*~m{9B@<W9*Ha@x
z2QGS6pY`>WJY8O$(7)M*NF?q;xr5cX2Cqw2Z?H{^j=tnug-6NpYv2f9Vo0iAw-HUR
zobc$x#^5qzj?y)~if;4pa{}PpLd8h8Od;rsc`GX@X@!0Cx;$Uk1zZzu=c7V(QrB?6
zyT(DGPp~Oe4oFdIyiD*$q%)un?WWkCp4%MtIr8coPnd{=U7w8Wc4dPuhk!^7oxfMx
zFvI*j*j5I%9wE~5bfGgN(NewAcpbX@V&?q%s;OIzOaAn*XP^gx9oAu3o<ihcueX^K
z24oT6)V{--jao--J?qcKoHx=9gIeg)FP|zr3h;>t4HxOg$1r0IUg!YC6BTZg_2<Ih
zq9CrQor}BE!f~?Q4vwW|vM|Ge*n(11#)ZHs40&Q6&Cna%Q2RhghmOapa{`y^E7+B&
zg8~kE`cHo9@Hvzpk4It|9P>t%8|iaW-s<!%5;~+^ULNV3+jJ1I8}E(!?NCra1D;)I
zow=shAMH)E>%EUH&Ml|%zDe8Oo2p4IbA?V?7}lF!XxoRTWf=qx+swPG#=w?@ZDy=H
z_z;IcywwxSL=Nn|MKowe%5I`8U6^CYPudj~#Ao%m=`5q?tH}`6FZ7M;+$c8wx414U
z`TY&n?n!HX+J2rfW1zpc{kS0sQ~Jqs<&I9}ZZ>bg4W~H4*oaf|;EUYe;JY}zDlk}a
z|AzkTT^OxgJdo_9ER60==DWWR$nlabdy9q#h?GCj)i7gg3pC-mz42U%R<!P*kKENo
zXta%?d|>rhV)yyS!38PbmCyI2r=DrohJ=vu(f9<qKj)p2SC$y?K#j^{`r;UV7l*gG
zoPOn19gb{_;u%j$$4P$)qQa!573P~`$uo9{X&*LnQ`2!7+ggg~(g#cUT;|T<hlz0O
zBK#nAtHzsa=!cP_h<!(+#UGyxXW~g-X(;{32OII0p>m0CBraHl>qp~h?|N!87Sd)@
zp(K(XLdwIrRmDw9L;KA5@iSjLjq=l{lIK}fzF=wjM!pv$=+r_U)c<ZWCi=V)H>A2N
zD5m^G6CYiG`$zP5vc9^y-|k2WIvL{9j;Re`JrfP5D?cC{WUpQhnQRA4%a0wCrNj_d
zbL#{FYZ$aqlA^Cg%(W-cs?n62$RxRp7mrqr(mVR;9|M%Yx=K%rgN{SI%YQRD?tkgS
zyaY<(7?Izru;`Xe0_BjcItV#Ok|cke3tv@80u8*6YE}HWm$LjUB4$><!38JcXrOLz
zG6ib&MWEIw#+5OJuzShLq?8%+>mzT2&5XsbJl2=yJYI?8+S4seJN$!+Eb%wt4bUxz
zfjQC@&^$EQWoG*ye0|=BVFKc;-<)mLs`cM-`V}k_PjC59$N?4pP$GTvyczq)kMfSw
z(W^DzG1DLp);3_tH2dB`<_jeioONWrCoxS5t@`|-WOt~3G;dObeonnl5GAJ*kYens
zmbEc8udB?aWs4fO5V^AxW%lKEyJNIP6qGulijQ0s7li<#BAce?`^cta7rrGsKohwa
zlFB;6v!GPAI#ux;3uPbXbkF=<{&+pZ)^qrrvc}e^CBX@A|Nc;U^1b&BG^WWE=+A<E
z72cB)Jc~zJFlTq0pnjf@jMYYu(LY~fW_Av&g1)M<+=jEhI#I00<CbJeoYa;6o=Khn
z$H9`ttJUx0x@EX+4YC>#9`+Ow<md7f1*JQB0i?A060*wreao419BVcFcIM1=(b|dX
z((P}4ZS%Y65_A7p6G*lkx2n-VJ>QsW2-W2pSdMN@c~c#Q!tNsyuRqnp-0+Iueut2)
z$x!TVlV0-cWNv14OlgU*FOS(y{cT;gxv_U;el~<2TzXwo&88{TA{}$&_Msu0SACe}
z3Mfpq#F7aK2IK>?z3w=BrV)@IW;ttZ*f`8GOa6??%ATh}1MSIij$x$@?K>UTBlW+0
zK-a7EV?%@v`D3z643;?Ushtz|4i)Ca->@6*gtN*`DKhe6AEi3is%x8}PjN42EOq!J
zQ|-rU<cvg!b*5>AAzku<Cw3&9CIt`qH{Ml2S=}U7S~6aS1+lJqY-X(+tZax{3c3P8
z8t`f!m%0LSHVWL7e=l?Ql=REXzIP9dQpvPR`$;a+lofhA=x>waj~J77Rl2PBAo-~R
zAgdGZiPA5)j%=7DFcHJBfoU)mCcLKzTMdvT#@d@a^6h@4IdFb@xW)GHEQ+=_lojEx
zzsS<G6GH{q*6HFeP#Q6#B%HaHcd%rxB^tc=@kS%u&ISYNgO)Zel?Q~X=Gc0z9e<X-
z(14&bs?h+&s@LnP+1le6&|hKnsQ*2mVj`X2bF)5&U3)F#B|knJmD0>vv8Ky1dDce~
zB|Ser-K_4-e+N3~p*)Wn|7DZrB$UwhJN?|Co08+43?hRy+)toiHl48_n=3^O*;$@~
zv1W7ph;?-foNtVPJolMcv$f=$C#LWe=y=3K0*F`=67ygCXV3g>5M@#Lj?ngAd-+bB
zR|PekJva{3=3;EzO3x|-R2=xjqc;MuD9gJyz*U$Qua-sL6r&)iH8CI|7PgcS_k!{g
z?#<Rob`4Nb-RB55%m(6)lx9%C-<)JZSaW<K2l^=;uC{ugSpL9<`erRLdAQ)^u1Mcs
z(%a#uoetEJVn^#m;efSnx8hbTluQYkYb^nL8RxkAP2er7n|KWS3BS;L9L7f&8zIvb
zW;+J-VXE@vVrkWz%H*GkIp{#uvFywJ5!YN1<035c3Xe<cs!S|z?MP;*qX!M(oJ(~k
zB$d4xSpjLlX4=7TVk|Y6hxxm+idFiX#D_16LP-Qw<rtN@O>d3?v#s5Rx>&QWbjDWR
zV6YDK0N~$;-MXJVaa?M9vux=okmxpMx!d|Y#3<J%#bU`KJ)*t_&9oUe%|&uXTA3t{
zT*W(EKZfP0f`6wW0X5!s_!azC%@Cj8`o?+bYs6u1xqJ=$OCqp|GYZRm)Zw+@Sni?x
z{p=V$fYiaywY)^#i<A|%n95vY>uZTTzvY1GT3}jbWf@>dRd3$)n8vr<BDK#fetYc<
z0LHW=x1hAw?ViSBt`<KJY{sF4J|%B&Zn|j{{?SN0?!MS&Y<L{s@&;QgT<ease;<KA
zmGdoaPU6G`|7vU;lx)+<H*zO@_`O!BPh-j5kJ|5LFe%|;{$YQe)vKoKS<0=o6Mr&I
z5P21M(Ji_FRRqq-f-hEA*Q#7hn2?9C3k?~FrvOlo$P$-4{7HsN+Vx;LF3>nt@%lAM
zK~nZ^q&jS+YQ`;x(;||z3#Z*#m*LZE;NS9TcLVuk!U$0pTgT;ejnG3$Rz~2941n5i
z<EBFe4O*@i4(%ONpfK2g@V-4P@g{w5>61b?WMxO9-P%A+B=MQTF?^e&m&@V&cP3nA
zbQ`Ci?V_m!;fGt-hDC1uMN(z@@%Oz_7D9Vy)9S}j*ugD$+(-})bxnXcuPDlqzpG$-
zZ{T?=8=Vyrl^y|ICDjuSn|(-b1x&NcYp<f(EmlCoXgkNgcs@}OX0}gC{KoF=<>=2{
zAhQBW*c<}k*XP?hz4|ntsrcBvo<4|Y4s0BM7R)8hES<K1AJ1W?A)bb9K>JMN5JkOF
z!ZxE)`V)=WuEVYchYa@pTDsQ|<|nD1Q-x^G^VN!GRX5qajtr=8*hncGh$*~AM!Rsu
zOa9JQyHn_@p3Zo>_M?G1+!W<UWTFS0Fk4Hz%;ftM6Mgs|`B%*_ZsheB(fTkxHGgc9
z{Vj%fqe|ahPA4XdQxVnAc}^OEQncGQKX#)px5vXhpli}NncR8?u%QWGL3EWol-*~(
zZ`XZBfXQuc!6tb25hXG!m`upd=iY+a+#+UcRC=pRT`gwsT}M@tX1%W&GKmhMC>kGk
zeO~8%xc~QB03o5B4!(yi0g0eR`>8{WUsVI7YsiF?G{C*(md#Jhw^SWR1!Szh@mwr6
z%zA-1HwtYWgzP_Py<V@-rNpn^Kf6fv?DRj`2GJ`^mPbRj51VBZl6KbC)pt}96Fb1o
z4FDYb=Pn#;!{)l`uSX*U7|(HMPZqrO?W$IQjIJA~>{SM{g_GT@tu9AUy_3jYoD$|j
zT&1tXXF351<soQswE-#=*P2hCe!B+|Rt8GPY-DUgdt_3oLF2ZIyxJqzaAml9oown7
z^U>R)8X{O3yTdW(3GDegWHtkt-+phHT~d~s@Czp!G;MbJ##Kxrlq~mt1)R^G0l+(m
z+&hzJaw6v|QDI+Ys>b?VEUz>Fvd0PXX_m>fHXueze)6fD(_jenxiwfi)97!kJ;|2>
zO3am5&3zkE$x5r67kq4Mz47sJe}aUk0Z+pef6ERwXg--lY|`~}`yjy-4<Y;1(M}fQ
zNl^ti&w`mKW~jY6Y4O(HRLbVd6@?Z*sD6KFB05Z<jVF+41{7wHxr$BCZn^4mAqbqk
z^Ubf~p%Qbyt0LcJjY|9cS?dG9?=<Whb{3WEQw*@-MJL#!@D8EC8;gIm+(a@$RNF{U
zVoS_h9aj&Zo5rD=5VhMG6zfh+F(kU5Fq=WR<I{xm6W>7(x7U?b^4$oKnAGJNu*7M(
zeVRt+^}GRb(jG(`PxA16TTs_dLXXxo?^(-<3exU^ypPR-H~K4}X<YH&wz4lCDY51{
zUkum>D1^=sdooCc$qHePXHxw?JiTQ@R1McQEFmS0h%}N?(w$0oC|%NBLzjT4fOOXY
z(#_Ca(m8aubi)jt@8-O(=lubEVfJ2ots}kg|5V8VsFX0>fAEzGrqKW9%fT>h1D~Yv
z4Bj<tFlNb>{o_oap`YN8ef`Rwg@)YJ`iB+EUpTSAd=V;GH${#?S<f{kn&fwWM4H@+
znZ{YrAj|UyAO`Tm*Tq~NR*&!MTE7rXM~{)xmGmJ%sX%#7V>z%fD4HtuPv(zQV`-jW
zWV6Ecuw@R2u7H8NNg0?EDX7aRnAk)fVsUO~G4z}8uj@dzOu~kuae)Y%<(v1)^o0W&
zB74{Swrm3x>we1z2ZV}Ezuo~mKcEMX+_cyAh_Qt<j*E!Qv^FRBYQ7KidvV5&ZpMx<
zd4{7r=Jd<3?cABqDkh1bmMF5qtW0ZhTXb@cR=0Qle;G;q1wDh9)^$LvxV{}qzqGJ9
z05=%kdtTK5w>H`%o%;JQf~-ClIjR%1WY{}AU>Vq`*xbjOU8QE#ctQV~e~#Nxhaq@l
z)wz!xvbo^vk?p*6odsL!J)|Q4=GWsK7gqlCaJ4FzL(g-bzk|=|HXmDyr{kx_0pxaC
z(%3MN59GwGf5U(O7CAO6OnT<X%Oz2$3J;szps6l?w9bA6;k7ia44GQ@{L^3w+u$kQ
z189mPD2R%5=0_+EXiCmihFb<kMf~P4ys?RGoNVC2*+)(Wl!jLSJP&9qOy&hGheHI|
zfQQ9+GoRGa1M?p{)E<bxcWJbl-XDAbGWHI{4j&Ckc#F3ev6iu!I@fTO1Nu$k3TeEw
zVXI)F`_mjHCQnyr04-WMmL=8exZr9U=u=^4$g?s?9O2#9L1NnJy_KAFmmP1+kW$09
zJ|?0LD_}wg@n$tslmVb@p6DYZWJ|ZZrwj{OjzrWoySZMX&mv>v+nnJpmHK$^02&Bm
zKI;3GM!L5w*=hBnyD)Qn&)JxX0seb_WJMX9$z$W`K^9bLkxUI`I&o4SlPV+>SfOr2
zGuXLYj_Ln4gfs*ZCzWNNx`ZgP$FUZ=!1RF{Mw|wy=mrC3l4YhIr5Zy9*8e-4cmvt{
zsw_IJk)0*j`I?if*y<6$;}&C;#eRM+LW-ou)yq}~ZZ>=|J|_bh-rs#7hH!_zkDR&>
z+INh>rsL}z__9Wb#u3)WNC;kG->D?Xr>|PHDt6Rp3S=7r{n|zL%P1FY-KP}q7n3;j
zYBC_M2Gn!rhg*+?n63iZy$J?>5ww4@k>T4swo@MaC#z2-G`3~OLTP}d!F^Fm6$kmM
zACmoi=Sz4a0(oIEg0-Y_&lNxK6TVZ#5sN)G=$UVLNlT>|WNaX*8odz<35t(_CbFiP
zPsFQ%ZmpkUNF5rapz3(|9P1Cu9;<`ROe9?`H<L7mYkd@YOKyrxpSNje8_;6ts|QyB
zSd(a0M~)fOxl}XVN241;v!%%s=nQS#Q8@FbWb?T^i~)QFlKG?H&GWlVY3eu6Wh(^o
zneW>l>WrG)9f9P-mW#yZ+|HDp{&&IeU*_&_5U5y~$4@d)4<e$_6r^h!MzZKCE_Y=z
zeec9UEC>MNP>Xk4+7F8H6!<?`=dBQ^i0+#ecXf{^Xc-=yudfB+xYHW~aT<o2A~j3a
zeA$8iyxgngM)pZDIaOqhE&J;^t(qe!>cwW(48OY}`@t;=mHxiVHh~-nuYipNgbtt^
z*^!$e*&0PASb>$$aT&@o>P9l!<^=e@CSjTT%000fO@o!x3ZOA%CicqQ8KGy|F&%i<
z-@mO?O`m4;ZR@7+*GV!vM5i?aNTs1;+E^HuzYOzz?6ItJKcaz}sjA9=B%g}(>O;Z$
z$J~TJ8wwAfj`(hFOUPj`X14wuTae(eHzK;VrNb)0b${#jej3<NeEs@{XmRRmX@)mL
zdI{%Mg8Iqw>a*L@nYuN|x(0t!1n>L?{0xd+Xv_`)7$AKg#hv3t+r84)(&p_-8S3n1
zsRM<%yBLF)YL{wXOHTo4v_UNbaP`~+u$(3|;3560cF!q!HgXfl)h;(!mEXwMk!Iob
z;S&1DZHha|&Z&uFC<$iOC=PcCWq4}V%vYkMbZ%t7GgJQk+^EIWtg{$m+p~bCfZf-G
z67{S^AVO#vy}hK^cP05vWFKy_`cnXbMCqLg(+*xM#Nw#*DsK7BN@LeAMJM--v?lM7
zW{@w}FFOAt+r>p7v`6Wu5L5#B%$=M>#<zO$=;eGq3-+f_H(4q!^o}!}RUC;g?mZr>
zBfkepAT(adRWngl?q7by$mTKW5FlO(0DF5fi|?ATrAN(GkY8kL86@ao;Z%B-n9I8u
z?D}uO`*Y`QZx)Mt3;<53r;5J?O`f21#h0*yCj;3~aE^}5k}jG=T?L+lCtR#H;G|~T
zr7RK>kS4>snkC8nq#zv8ZY<e}atQ(k+p<}KIgi=&1TagicJMdNp-*fwpwA3^KF449
zQu(2IGy?A{qQ(ExMza{ySO*~Hm=3@6ObGkXqNrQK!u{UJ?;?*Y%6|4>(K1;)II7BX
zKp%()#c!7HT+A<@jW0;XX>VU3=UAki^UnnrZ7-<}yR?#-or51%VM(BJM}jP&N_#|C
z_ugcpdhGox@oX1&&FZD++#MIhoeY=2^BWl>J3%>HR3{h8?L)k|M%AoO@~daf2VW_$
z{<c556%MjgPdHP^kR#s(=!>ldAQ8CJ;z&FaY1ApZSXx>pSufT6I$XFgh+O<wF_jlK
z+qB^{XSa7KB*1ic_=n{Zp}UJ#RUAF}_GjhBFQ(?H(ig7Yn1$p6fv7Gze5>&Z7yFfc
zly1EpBzoWadHn1lTR;XZ@+IVb#mW9=Ohk)nmW0_^=kyaY_l*J&)yyChEn0wZK?&Y8
z?h50yhQ04oo}LeZiw*wc53CeK2O>yu%C&dGKRY)koU~8Z;*DJvZ2Qhc|254WMrRN(
z1G=<XDSaCTbY`EdWngBD(<vuWlIK85%qS{lO9AHx_py5XO1q`PJb7-HsOl4D^SFg7
zx7Lu2Gdlopmk4u{qpC$uu6iF+$#M*ukL7Xb_^nw+igpM;LVOBL7^3uW@2j${7_F`k
z3fDMtIkf-m2rgW%TCQuwN*|_9ILreAS%rcVA^NlmNznR|mn->X*x|nk<*3Tge(>a{
zbJ%CWQW%ey?p#Ru`Ww!=gatZ`te~Y^$Cbs?C*k|1CCnPCqP0l3<}ZH&%H;NVsAq1C
z{p7R&*)N)#@xe@tz${IX_yoHl*K2HG>i^KLs22CSO<^!UZrOu2Js1J8JX=tqs{6_8
zo7}k_T3fv#SHV~Y*|+k=2oEy+*lXjdpUi$j)Ac+__IIOXFfk1M;Tnxw^e1wgKpcJv
z{dc_qEu#~s4@klAEQwyJ=G^Lb^Ac|dzcTi2gnKnU+lAhTWFFGM%ExZGE)gz+U0(L&
z&hCguynXmlso1QcPj!vMyqbZGm!NmNHXg&d8G*7y?l5qo>qEs(K1FFtetkWir)N9b
zPnhb+vNLvh)HI->Wq2~r>;8B?8CCqCSp|5y)ecUd&p{IaeqzMSiO26tiU)MHO$5X4
zQB=*qt+z1wf-A8UO##{$D=}+;>Xl-?X(o-udxC(#d&?+6{org#(RF)^r6PL+ds0K-
zsG?p!Kb#f~hT&bTSuHfE9TZj(tF6a8xBvv1sz?!C%+(L;WI?Y%tD<tU!zj`Hx1*1p
zjU}c#+Zjku?NLL%H=8##YQ2~ZnO1ZQW?D73p~qs!4fsr9)52E*9tY3chEvyt4#7`j
z0iEj$0{QjTZ+Fu-cT;ZgNx<QsZPHU(iki0K&sH4No^mv!aAp9QbN)7<y{zhCwkd5h
zntZ#+{7PHfuk%8&ZnXV09Ox{S^yu;+{zZ1#ipC5e8D_MB3Lo0^fike2rL?3RbZpE+
zF?nK%%%iD5iQzft6%3j$+BIv&7Y`oEpFM!KNTx9*ckyKQEr?6t+b1a(+V-6cCiQxE
z)2m^i3{o1f3YUb}J-J?Ox&N%<uix~fK+hEmbTGJM_FD=G8Ge5T$R6ozgT^FJ`#$}|
z)(os}Ba&3OU`l@9@dH7=6u@40_Wc&#;V<T|W6@)<8~;&=#*AtzUyZGri^7eH6Su)d
zlW@3QmeU4J#|MYR8k8tYwJYr0HYBD!XZrw(>3;H{_RCuZPFL;K!lTq)AvDe+2I1D;
zt9)gL;}&bC_ghT$%i4WQ@(94rjU;XY1kJuf9GH?~GrSJzXvEEPCfKSeK&;=cOGcsU
z*Nz<CGA5d&a)NK;X#5J~ERRHTIT-(*L=$paMHkiNa-~w{ukX;Z&RgJP7`f>Ur69x=
zUvYgC<;Jr6ppK17*W*pAT7mXV7EUy4&9o34{w~&R??R_4v-eSyfq4#ed?b(Df8P&U
zk(<}DHkH;dk)JNT8Sz|{dSKst67kTAZE{N$Oo}o;jli(@8ZCKF7~g~K@CeB0zTzeG
zng?Qh@c>uPVwynu0)Rk9H=AyYZ~e6)*l$Veu<UBSdR{H-Y1qu#?1Dpc75y|SBF%^f
z|Cte3+|fp7AlG2OX+2r4kF#4ik946~Kp6**!kW8UDoS2`7PDUfb+o-k-)g~#B^v=(
z&I!ba!0AbV5llVo_x!g2UiI&IgqAj+g?E5zkA6R^!?MU`dU2#Ha3&~H<ALPWr1ad0
zZhjZ__AA?&wmvNHe;(zt&V$DPxd!$C44b1&Ad1M=7tLf_8#I;t5%w=^RO)4DKstQ8
z)G3xLXQDVbvHxksOX2ov1jM2;71LrJ#|ztxv)!5;t!waOzvu_t;>!ennz&@QgUsb_
zHeMq)H(-i=<NuIoD$PYFyb<FH=Zf1dDOY`i=lt-5iz>}XyVctbyf{i!@^}qOO6C6B
z2$t1+g3BbMZy(AQc|ob&-SGZ(o%#0|L?24o2=J`&dJo0!Pg`9SnK3H^tuUJ$-%^o*
zWZ!v^_KiO^xiJf1FU-x*>5}fU4R%VofQKR4!5o%PZCy0CQ3t=ta4T_$LsRQZb2#&k
zd#xSD<CNwC1%WJ(ArX{Br$g>nw@W}7d7*EPfYVH&p%If-u><cG{|hRTC>^JfH-j9j
z%*7QtQ3n98)JOx|y^U_P!JqLkDQYM2yb<Ql0sCrmmBtk&3jgQ)$mukw`j82m4qhVo
z%0|zlb5xC()Bk>s7_W+CX8|_mn*^AgpJDU~h)S-VG(Bbv(sKW<a<hCsuazoYXDGs5
z7fWaxgJRbgxJcm6Bg0D9;OQXCsxQ2j+g7b_X{)r)`?9HO6&`p7142LYON9J=e6AjM
zF%2*7-k{>u?*7$Sw-j(@vnx%W-!t;w696KUqHFBN-;Hv`k{W=tlq`2zpt8sAotEZ+
zgC8`=SRhnO@y#rcYNJ8tzYIAF{@(eE=~*NBA<c`CF1&+lJ^eP<vTC;al()`6)~0IT
zy#ZD18qVrTEF9V_E1&rOi2sBNM$LKjRna<0a;svQ;`wI8zz&on*x?7Ec!bNTzu!Ij
zk9>Fb)!g)#%#)6ew91pIM|gH53I?A=6wy2y%NPzCvB|)mH4qE+2gmN@kvxEbcHr#j
zP&32@m|DtTOO+9cm8lGYBzrS^ZEe6xsdtKFzF4P{=hv6-%xABxZ`G9sBp>(J&MxiN
zT>w~V@gLjer6Wl#;O?gDhs#ktp>;F!J$REO>hq*y#OPS`kBNe=*Mo<E?o#F?eb7&W
zw|Id&(NZj_L0Lvd7tXAFSzKg1-W9GVGphnW{>V(*bd00AaK~&lY(yp%#ZfxBf2yC$
z(b7w3w9T$ol7Y!;E&<lJQ~GE{gPKHJpUZoy3sOx&vzW%+PK8a_5G0XcDBflJCtvGR
z`9w2YME~H?^k<h0QYd3|S3%~tUt})Bm9UKr5!gUtl-bSipXeiD$()o3BJPEUyIMwW
zt&{1`Bs1?()%MNNqecrP6(G+#<|7mh99wRFr=@oc6?V4}3C1pRH$H2LSP-{;iOLbk
z9akR>wgB^MEa1juOv|M7<%;sTI0AgaL}pkrfl6vLg#5_v%Ekh*X`Ed3uy*UoItTS=
zhDTt%SD`#{V}^>l7z)H-a!sj7N)02?s{TPwcCosi0aOkFRG#2OHy{oiE>SM!<CLGp
zi*M+9w6aib(}yiG{q~V$XYPkw4mcOVsknW6pLFvc&gO0>*RE;0H*Kpq2)Orm=cQYO
z7{fN`dT(h}+0l}rVQ-N<PUdIi)bs6eFMKr}tbf>RS?)98PpkBCN%INtSh@ORQwIL=
z1?anH@>SLkIG@d(3&v=~GXtv34=nbU^75)39xWH#Xoz*v+;u*N4hw!e_}Ewc?Fd<f
zqFb6@Q*UgUMfW@;tpciyPjawi)%QO5Kg>kd5pi3aHHPCTR;t9nX!IlCW=~^k1l5?#
zNCABw#4XO>2okvAGXNf#`YCo8NdH2=|I-Pgz1q)Vgm-~xWmMzlxrmy-DZwd|KSY&&
z8#{n`RjK^9f(6`JB#5-6q_U5_gsO%SjXG0rcH$AobRNvwZVQU|h`2tS6)tK6bYC0?
z8H$K!%GJJrDpZu&_D_(Y-xuzlt1n-qsyhVG-PVP*fSCI2cOC}Jm>1Y)(nn$y!Gm?J
zee)V+x(1EyASFL-UOP{9dL`m52h$!0B&e)uFE(L~d7^sWVE^3sq(){HxYFbJe$biI
zAE=7?E%gqe9!T|Wz|Ks*cbq77m(16mjM1;hYNL_4@BnY&RUSqPF=0@f*;w8IP>6Wb
zMgKPneiiryXsu=aRxkdufy{DC3()6PW!Hl!lj8XtGo9V4p{}FgcIQPnGI4~fCHv<E
zAWY9&;*XV>p;Dh8m;dmmL(OF#hWh35tTyuVs1%VQJphlq?x%m<FOOVt4e(G<-p4R{
z=FWJyAxPGv1FU*EDC=PHvJ?3h2rPJ(Bqd-zjdKVe6=WX(XY-e3aCHs&Knx)O+6t80
zN%LZ2f<zbVri=XlzD$yxh5CW7(A|Ac*Xci!4!k#RVNeX#S?=pm*k-b<Hjh-Z6X?mY
zh`9Z}d)>6g54IY?KblW-yU!S{GLLGcT(R>130nL4_roLaNmF$dDIxJF_D4DQ<NF0W
z(en!+b4rVZ*J`~cY*oUZkPHO@X;+p4lZT$z=i=?=mtQSbljY9XeYT%@J<VC_AvFMS
z#!&e35rs)3RLu5MwCH;3M(=Pmr@1odLzHbwASO8d=|1?qVaT?5qU2`9JoYpGj)8(8
zc^~xIBW(M~0M)sFxbBGb6=u#6tfK{Wc{jlAK+C<C-JQJEo+)s~(eo3%3UL{Zz-sI*
zsqj1uC}jv9{&Dv24?>Rq{O`l25#1@b_M&BF`if6F;1|Lf@`%K;REEL*zzlu+9tV)-
zqzL)^yn6`kP(&Mh?KmDO!H@HcFW*J*@*~6ifT{Z1K9Jt~|LJHR2|~0SZZG&*8f^qo
zff)5JoBQiHQmd|GBv(KCMZUpWwe-ZaF{EXnej{PoJwix~#}p{-VKXo_QhzDGPp@T=
zvb7n)aVgB>B_{(TOMXsIpuz|=+s_UoWTtnqVD%`+lxQcerk4lGZ<jgp=jo6;-wNjz
zv^=!)4KL#zZ2KT8^LbM&mLf0ro)Z%w&y%}+R@|^Nn<5u-NKQ>k+2SP}aq`|imm17^
zSXCAYPmf_e1R{Ig02=#$Z5$Z5>{zwq<h12;7Z3Hyf5xAm%~4Dt+Fd+VMWh{1@E34g
z&OOnudl`Cnk)6YW4fg5;saLKPc_nzwMVTSbGz=BsXr>Cd??$g)YGgX>ZKyt!+XDOj
z-w^Z?>E;^DWDG(zXF&Y8MhEed1`C;;YBT!ZrYLg(jbkxQwQ2k=35G}B^U>bZ@I@J&
zLz$31xj$d=8~&GweLT`7dQeus8V?^Gs!~(r0lswSlNMhY=j5kK)AQ<`K58>tto?mN
zYAV8vb=2kgZm<3Zb)#FCHX8fC{m;-CN6dUem<L6)qtPuqH0J9uSAtF*5EL<pP?-?-
z`m@U!tbL*{n{|V@MB0`n<Kd(I57Sy}6dH6IQh{<Q0kSaus2K5Ed^B4{Td1SR!+9L1
zGbk6Qm>#)N1ZaM2-9w(sWanT8ng!sQ38hy(c3Qn%A22VC_cmoCy9WTIq;*53lpxOp
z)1cWwYIN<1H^|K1Hbq$mhK!c!Y9dfnOqM+=a3?$u_@^zmdH4lq%i<E8Q6mSDP_M!p
zvfaOSK_f;To#^9fm<l6+t_L}w>p`ITf8{S>h4>Jf8vv9lKHQyG-e{^UH@F?7BQjdI
z`&MTk2K0UDQ-TunX#~jF(`x$%nO>{O*<%t5OEVrb@i%jz6|J5=k`XTqCWuH$M<yRW
zHmrN1qKX*+IbZyvrnr_#y%D;C*sI=R-?YV^TC^Oc-LR#80)%CZ|HFZ5!3UJ+bU{mj
z<wk~*g#GD#Ie-}g8#rN<>OLsL*`Ht5Pt?!rpfhbd(5F$J^P$O9NY&KnS!47JUU#Pj
zQy9{}dIRl!S74=MC*%{%xN}r@QCk_lRj7ZN8)trASmbcg2+tqLvDIu`^zI4&9^}W1
z`kB}9GjszG)J+yN4SiM-S>}1&qs+g=(6u*zr~rV1bu>5N#?R&>3&Bf1<IL<66CaT;
zk00cK%8y(efg!8WmD1M-K)=}bJZFXf%pWaFDUQ(|@8^8Vsn3J2IJe&App%WqYDACQ
zMBeJLxsLsX(yd*i6d1o2j1_uo@)+E&0z{5GnZNwL77hpl`vlw$xYhpJF$vwZf~$@Q
zhB;&|QauEI@wlg3Eq=WF0Utp#9$%QeJHn|0CYVFqfBqtdfB@q>h0I;#KK7G0tMZ=<
zRGhM(((W#rh+TUe|4orCw!)9~n1<}MmcwuBph7pcg0WqD`5zy)2m4#17m0-QntZ4N
z0YV;m?d%JFzc^xkR(0lK_YrWWc8LoB44{D8o{}2KRJQ!?4>|Sv7#F}B?*WBMqMIyf
z^`#|kI_<ybl6FzdowJd>M4!1K&#inTm9E&5d{Gq6S8=(O7~6cfA-Kw0XKz^fYH7T7
zlv}r|6d<6~kG~cZ%MP}zKmc<@zRZY?NwOp{0y&HWa1nuv<QQSp566HAn;nf-kI0_n
z$5%zK%@`R$D2Fr=wWe`HMB^q<0uVYEg=NNR)OdeJcGv3u^-#d!o}I_>sb+RP`3^WS
zRT9Qc`jkg#wr|$|h>i@Jgx$P4vWxU7)P4A1{ReUSK=Bp8`G$f~fkz9L`~q{0sv6L}
ziuNVE>jJV)(qMBNQD|mb(ck}Mp{<0&076J$zW>6@m>;;{pR$O=&bq6VXNMcLmbF}T
zYOFZSlcEXH%val5)q$fN?zHB%&w!X?BK6ECe?45@eL75k+3-e+s4wcrdnWvEOy2{j
z>9W7irGL$K4RSS%K0e-_Sf(q>?zj9(^t-1(Rz58I&-d)_t6%_qS!r!{JZ|;a5F4e@
ztFGp1cX>Ezsdj;KJJ=65P9anzIso~`-s?RY=LZm(3kBo5lq_3gLVlM&Lc}nWw+77x
z+U9XPo}G;(pXdF*vJp1?lV5D{{cD346~d>j|Kp9G_+Lic7YK5H0MVywANiH;#9W&n
zb8F*S`}ykZOz2M|Wu5I%S9K4>&7N7$VcwL@sp}fiV2v^i;v&P_`!OJ%EmSIQMtab}
z2TRv3424L%BMuq7J5>A&eg(lEy-?%|Rx;ROJvhzo;Uds|;K^t!ejJv(+(@CZ(-MuE
zXVI;gLHjfKXmRL~X!jkPK>_zFD8L7uf4t!6R38V(`n@xwc@n+A$;;(d=86jIvtkI(
zl)8Z%8F$Rp>`9OSRRhkYCyJ@;v;B9+KBPVW`Xn~ZADZ7qy{aJ`1##}RX@{1}LIWSG
z%?1*;m%AT!0!`jo)xIc<yNE1c$=h?HjSAL9^t#w(*Th~L42%e~U@*@Ja8$niZAa-3
zL%;$Os8|$QA~%7az^qwABT7va%H0^}GJ3SV$W3=V76B6g2w@}jzXmcm^Hg~KqPKN?
zKRFT!Me#c7jP_f)(?)F$7YZq{8t@tk?iGE1ZB&g^u%a2MK8m+?L~n6sbF}(9fuCBc
zQfsv94YD{D2jYHSd<aeBqv_F+$4WGTZ>i1S@xSG*m)@1J-9y%zku{STC7|IQlWDJN
z?7b~X&=+Ov$<X8G6TB3^r$>>gIs<|SO;aNetL-=o8IT{R{YE~IeR_&Of3WT{SnI`B
zg80Z@)zF6|W|QR6gTD6rdoFVR1{E>7t8{Ob-N?<DY<*ZU9gz0NC7PW=j%8BmM|;N}
z#u&FvdSrH2k^WC<fPFfXr{YPL$>0{nYmm%bhw`mq`=eCj_pomeuhk;Klp!UHjx?lk
za3)tlV}Hd)tIw6>{d<x`9icTst9&H`NiWb&f@PyhZy+lFT%f?7Scd1HG}IOvI+6FP
zsCeD)W+)NQrb08toICBB4kwt+#KMtCOLgvq?QhQs#@mJEu3nKBo%Rz*J5fU+s4zL{
z;6@f&+!ujgamUh2F5a}C^`hw3nAO=oeQI^Qsn@C{A-vF=JY4k|4VwBuw<-MiaMdh%
znx^`d7n-bgJ2X16I2cDYD!}k6lNaCL&T6G9(mpLB-1$&EY$M=jDHZMu#9PM(ZL)#%
zi3PLq{XnM1(u`IiT!>SetU7j#FI&4rl?B$U3Eb0!dX#+?iItb&F9(`uuy{)oahbXD
zo=tmO*X}LnRwqT@#t(>tr(C(Go_J~aX~zR$Pj{D3xUl<Qj0j9#A$h(88UdMu?MlRi
z)Y?J?u?JUe@`-elDpMJby_h%>qsjJkZ9j&IzRh6-HW~vi3X(4D8h#Yneni9%RBM~s
zH5x9%CGVUl9{t*!H*8@-qXTjN6B0NYxxqcj1sJ7+e!YPHFON89G>(ByNim%jF+7vO
ze--Z8RXnY*R|4T1BGfo;haif)A5`C};PL`e|5(!}%Jz$)Is&mS9UyFdsGN0~Fh5*n
zC$e?-a#7+WfK{&zH}F6x*iRyurcwFT9n}j&hj$$aVwC=+>e_2ctq!H*VQ)q&F%ipQ
zge=-2y;14!+SjX&VVyW+KP2cFp8uauDO`!FE5bKs)1HJ&0BEYIF$pU9rf|ABK*B>&
zJxp*!d)qyZwl0W<oc6-@eN>k;DF1PLk=5j5PL}b;i{H8yyQ$uF3#mK&Qo0e~6CHL(
zLIbD2Klj}mMLey<&X$M_TlVrn^}l;UGO|k`A1pRQxjB~mUmK(9k|AJ!2z-IoUpZ}|
zv^XI}v{jY+*YvGphz4=NXtLEF(O0iH{*>Vs!4l4Nl1z(WC2ajc#tAY_jbH%3on+-(
z{eUxDYVZ+Gq^OnjZ{bteM(59Asx@@PflG4@npcEOpGMO1Rg2WKdf2AD{D%ID(Es*2
z1sK^G6`AFzdI(8v2O9CebYSd#;rg3x@^kEaitvZe1uK)0rQWZ|>u4h3RBJeh!bVgn
zqDOg2hV&0sfUAQH{l|snShQj970=ARGP!qHPf0l@(&fsXBi>zZ>SUbC7rYYB;O$pW
zH#?M_Q8`t3;DJ|>n>KB~Rz6VB7&0RIRE+lSO%|Lh5Vt|N$s;$hb1Vx=fY>2|r@!!y
zsoHFpPCP??ow5#sAyj1dTk92;*Um8vhA?DBk)8uthn>w{a=Z+?p3o=Ma*Z9v2M&{j
zAs{_=1vty~1g-b5-R>nC<avA;5JWx^t8@aiyV{0V6HpZ(_Zbi<XI1efCS9eXz90m~
zo@K=TMaa{J>-Fio$|i5W#wdUB7s#B!0p5&s|74*tdhyUp%CU&HYglyysc`|J=1aO_
zxCQydP~>KzFc8pZvZJF6`8~~)pQ2eZHZ-mSOe?a4q#QWNq?J5VP_doWF4JF@Nye;X
znuEXEu%IHX7D>q7ZC@lyMR6;Dj;x{k!$@Xx?1z?9YA>(OT(xdyj*{15M>O-nLpuEa
zJX^zFfh@5Mf`?1B>4x|vz5dtZ&56qW`}4QF#QDYGG>4`HZ+D!s404QEbs83{PrwI3
zc}i|tX_cO9t?X9V+iTm;-2%)nP$S=Rqnitqbmik-De+g5`&4#?T{qYyq=pgVGl6y9
z8E^Dr#S3!4;BTNtbdS;>;-#EVQ*&gFa{LcQ!wQsd{m5E}_WPtG$poyb#t@fvGLVR!
z<)wo!EKMnq#XDA!J=F(!q{6}oUybI#N871}v!YOiQLy$u0?eit37X9W<$-O24dI0T
ztctL1B|eY+gl@*I`@x(2ak#(+NP3S=Ox1%{i*SvK1~?43z=Hx-%4u~GQ(L+9WB+pT
zvR~ky5(avbQ$No;D&E4`cqWZvi`QrOzolwit#|7SojD`POAszs{hvmz{raS&?$XKn
zHq11woLjo1DUp{Xs0^3GHC+l^HE<UCN6i>I6U#{RZ`!i`UvK$tbFhdKu`(`yiQEMH
z?{B^|>FFQZEOTsqXnIRT=I}Zv>Y>8)u4b=D4GH_e6y!w9r)q+Vj40EwS82r@aOgXt
zJjZmF+$qj+{1y9tWOXALC;e-<T5>yK$=&pf!(n{iuV9=stJ1m7jr+r?w<=X2+R;ST
zX0*=7Y>q^BPpgxP1n&zDN5UU+IK9{a@4yn!0t_u;rL{I6%IxA#B?1948VhyyCE5mc
zWz%%yD(Q};cF>ZYeC4-zi7FR;rs&Ef?l~hLId8?R|B(&)dm-p>LeK`7B^Kx&-_)Cp
zhrxild*<f5;T;Z9WBTu=z%Ip%cmp$_-VqbM7Jr%3UbM5(nD)>u%mlA*9v<UqHEbCT
zJej(qNu2JwxKZ_eicDWDbV(Y!k`&b}a?CV#?YhVc_;yd4ZJc9M7xt>i=df<fM2M3g
z2a)Oz!CD6x@WbT7wj3u_NbiI#<B8fT^>&B*JuMhgyxg{{uIGx*tlg)`gq^~DC0PP9
z?k>nbAeJU3+z@?8WktFj2;zSVeA9=HIsdUk0vZ2k2t@Ge^?S*pjr`z?Ko#({fz^?t
zNmgEqiJ=~L5b_l|D&`?YlH<n~KaCAz^g~)f8EyY~FCGx~aXn}nUqqqvZfyO>__{Ri
z>FYqV+nTE-zjkf@;<T~NXf6Rh@Iyj~a_~#)EtkXU!O$QP7fLl1vOl3jQD3|O3#bgG
z-+fz54=}9mAN!phu=liFSG;zDIo34>gxqcLs&PWcolrgE^Sfe%<qGdB*9RCf@?|K#
z#eQhNhgD#QHtxzsZdMAu6<n7!tbd$z{nw4|a<N$nDy+W!lO+_pn4nf}=k+gC5_}!(
z7-U&8=-2E&)lJ`44k^zSicQnX;!4U>p`BwyK^L+P`cW)m(RPc`4j4~AA)y9qF0&^^
z0KZ~j_`5%b@}c~(2ZEj0F^6jej#ZNw9~g4nR_+7MdTXTO*;f6{;;xYd{blPFZj1Yx
zXd25$+^=-g`5;zhu-!PtX#w~QG)5nyz<Gl1H(^s#m~b0VI3M#a_DCZw8_1{^>@Z-x
zd(i?S@GwbY)f1Qb_9#b~Vv&aV`9t`VGSRReBls3HSVhDFmMWQLdF6vmHqhntgM2q=
z*4KD&${ASB4Y7xED1{A*n5H4KiW#@ClF>q=Cx_cD?z^GHRu--5(4Ii`WirR~DZlZ$
zdx@|+SEh@-*`IBXw=Vp#%v5vVU!ZkM1u$TMBtKD{ueriD2e|N*x@dM-bt`&3Wuy)u
zm2Fi}5T^{qFxo=`&YP!X@_~8c0)xB!FVen;cJB~>7rri|%!c(;Ddnq>DctlUAyTce
zBAy9K3g*>@su!PsA+%8ydrg=)bPe<?SY3xahQ47qne;z_hjs<~|KVlCD)N~{_)>Q`
zB0Ue(K5}NylQ0l01-@ZG!>$huc!kzok~Us^7+;PJ(6Pw&Ei0b-xrB9qzE`CuEGgD&
z#Po+W0-k%k!+zvul-MOVkHc%wkIhH#GC`F=d{06)?6yMD-Qu;s+A+e2U-c0YaHEkY
zOj#B%${PI#Vr~KbziC23v1XA}t*r<%M8|KVu4Uj~ZX1SoO~Brp`Z!=G+c{WuL{4Zt
zmi7ue{xYz^#Ax5#4<}<U`qsq+qKw?cM|wm+z&%An;HeM3OC>vPwQEe<;^WYGh!VRA
z_=Saog9iP$%m0>~0lVf4<YNLiLTtJ_t=2{5g7l=nd$Jlc7|>P680tKI*WiHZ$8>5<
zCXavKdK~??=oDvR8I(P@V&;snLGVV^2?H4Yi2<pT1A@ML{vQhNZy@Y2ka(o~Q5r6)
zj3y(OtCC1s{q3fsXr12cP)Jd3)Z}RkyCK!y`QGF{XwH2go5)PnPBbN)0IP-{lNlTM
z>}KPty5P>X-{LR3?X((yj4AU)J^bym5VHh~4!^efvyJvJQD5_B`hK{nj7m=DPe|+?
zjWl-jE0|=<-)-ueITTFgpnxc}?!_c?)UJ81Og`7doh*1mP@C0jR2C8r;c4yr(DpPQ
z2VK2uUh**c4>4^vQ=jZP`FUitjgsk7&YVkZJ_VN*u92Z#Cy8hK=`PRq{)TFGs;u{Q
z1@8r-Qp6-NC{ZXu+RtpXXZ{BDsu#uPZ3)b{UjCejD<8eXIn1kLjJOz*J1K}vGcN^G
zj6~5U2A^F`dApHLepb=s^$j0>EU%2;Fr#?B?^M1s$>37*xu@chkL$no|GFL3Mr7bx
z*<yBKs`?OR;qE#!H1SjbYNinonyhu4HPBpzhN?QIflB|mOxucnpjNqOWh;qN@~yC6
ztf!WD{w?fyF-j06CJ~Wg&&YN(U!At#fhOR7hAz}*(0rbw=h!H*61O{;2eY_;ejU&d
zF4X0_WAq>VGx~EWG`uu^>4b4f?2G_ik~>a@_NMTiOFZZW;V)O9RU%Cz&2&DMM`Ia2
z7DTw$#1)q@B>;Eti#*wts${Ac*mINH76C>Zn~q>oB1GHnTfDQdxZ;HRh2L3T0=MNc
z_eN^^Q3R%mj6Y7=QO<w6xA(<cyVBEKXbJ0+pK_XLpl5<dNjxxKq8QT7a=Db<^*7vT
zRqB+hINv<ca;=TT$-_2BEY<esKa=u3@{JU8TSD@eeaij#n(oR`!(R<$7>VB-<+{4u
zEEf6HM}HnZKJicuj?DTNvMi!W(0Bxc-AL}gE)s^<zJzPysl46E)x=Sd4j$RscnjRN
z+Q^=6U7<xT5wZcA<GB|d{4r#f$@;-N-XS<8S8^dGnrwJ6sH4jGDvrRc5rIb?%R<L-
zo84_Cn%z&LwNNi98Nq=L(RXCDfZG4{S+iToH=j>;WB-0stkdJ3vi@&xkqp?!X7_D3
zP_6PD(tNOLi|W(Rt1D*<N<8gbZ>&xtrThk%opJDnt8_mFZVkJAf0Guv_7=J2ztv@i
zv%oc>52t~0h;d;PYZ(t#kcs`d`i)zT2G?QJgwk>hSWNYU!F}wwkyhO0b<P%-%53!2
z!C&8XS&Cn;QGtcx&3^;t9|x#KPe2ELkw0QP8ACJkSJ&$zm3Z>gD%wBvZR>BxFNyT2
z5bMf$l^0)X@^L1+ACe7(5wXd2{mLC&(r-_#&5ZY(<;W>ejp>xyx~XL={o@5M81mzf
zP3!oF3rvD(<f$bJ9?IWAk(YZSKjah9ly12o@1gJlixF*`a}`vaBc;r5w`!@p7P&ND
z+z*bc<)q6l9=m$fsIcvT75C7ccW1t|%0eFY1<L6XAJaEO`5*sYOOjPY6C#U?qr_UG
zwm&BpP>np-Wa(ommi@cf|CQA3o1p3+?`;07e9t14+qiuF@bPGdbt=d5decb+vXIGT
zOKjllOyOn4=P0u^jdam^ae2Tk>ekTodiISj8PNwbl)w%GVCGDJw-GK#->ECf9o_n}
zQ(8ALTvE+6I&fyq^LT$%<X<Qq(N{`g37*{1>&9pAZWyltu4;t8@6fKJ1AvC~THrnW
zTSdV`w9zXQMWG}?ZwUp1?%&Bo!Z&%~)MnNW{4UfnZN&yUF;F2MnPe>^BX-9K4yXx_
zBb&NNwm}fK49$-Nsx>ymfpcqs2Kfk-n&7UsmgB$roX&t0;;>p7vEp;W+SrguA)MnA
zb=lp1q%qO=#jD%_Kv6b3d-nw$TeoG)_rINp;QZ!DE#Fs#BCI!3rNsQVqoCgcuRkHQ
z--CpXOaMk>k59?pb`RpRUu;X5Yw&_?CZyv+b49^#`9jDq#8T(I)JAiJDjJt#^fS$J
zAr4vfGDj|`_UrdNu(5kJBR{);VTalaE#@L_da0~WDm_mw&I<rBx4&Fp9n%*Hc|;IR
z&1q75>kbU_iHQHZq1t@sy$4fy!b(Y1$`v<zYzhd8^Wag!_YIX*c{f3Q0F4q6KsQdN
ze}UF=yOvWvLN+Zj6Ga>RjbHXq@z`wQAa>a2lLzf;gELZ|GMTyF$lhn73A!YGCP+1b
zfKXhCnWc|gdVS1c&d$bzek15rA3S)EzEaSz(u6MJeV=c{svFsZY}EPiPMnfXm08x-
zkRgX=^uOI9e;{Qy)nt_5Wcg61dH^mQ0NV*A0JU45VAnXVW^mt39{iX@S{ayv&;J_P
z8({cU(&8j=FxxIWX{j8dyJ?=ZRRG{m1HQv)TC=qZTZ4%Vk3L)7cv$m)>D1+Glw$_D
zjY#<{1PPhGNM>j<-_YiCZNr=~5vg#65&z!>iuGhRiOTJ&eT~7DBdz!h2+%`ZPKmG)
zO_TDKbj0Q3=oLw%9NQZI_NQjt+6r$DM?M-)whSs>9`5{>6Bvp}m;?6WbU<rQkC^il
z((UkpYoXG{gWB((mHCDsT0p=RTK56&Ui?h2!tc9g5h+#H+U%n?KOd>+zWln9zulkP
zQlmSsrfg3!$;G}cHKdD)S8zpomwPFW^}pQ#pd96|{n&^fsBs|<(j`rwn->0j;{rA(
zjhhCmRl(zi4T}A#tfXO|!#TEdyN&1^kD8|919?6-8Bklk%9}5%$>)#94QCR209+W~
zvuo<1x$*Wk8H}M^kU_bZI!G`Cyne6fHW31c-$lomj%yJz%IC-^#bELH%kb8(=(F)y
zFM`<;O&|Ow^6hgPdf^vx;bh_ErUlgqvTl7zH?Q(1o05!h14RwvA9Ngy9)2Z6JeEI_
zr=>H`52&lyfao&0gqmfV@{{naDFw+wvC9E$B^kZ2QDpl@wJBqt07=MgSIz?sRVKl6
zi@l^9JBF!9_~~xjmP9l=Q}Ae469UnBvYoLLpDvk+8C|S&Aq6Z(3zzeZ_JZSnS0dC9
z$A$BESj01ZypFlA#{S8=I$;45P*MB>ApwqM<hWEwDDpTr$ywr+R}P$28at$p4RXk2
z#KqVHrH#EWCnMXcj(Y12bEeQ~6a}CZusMvVN~eYMqOpHjWB;mMD^L-sq79L!$Rzy~
zKN(H4&j?s6kCwQAe7)ymlR|dnoqpE@yg=mySiSVOaI}%VGTjHYvt{<m#@D+<1+zvh
zgD(-Ta6{_Z7V|Y2Or;jB+M9(u_LYF_>3Tam7KCv8qmo{Q$pL}RTSQZ`fOhv~`7=!h
zlW)6DlEMvWh;1}$UovMf!XMLzg;DLc!|CGrRIIZ8j(vx=7cf!-m{G5<!DD%En5c`1
z7}_%5`;iEajIq08<x<&lG55!%1lRSSL<66NGyZOn{Qm>!ma=L&N?2q+@TLo0O!pyb
zn@9%al56Of;LK&?$0GojC)+nASnYy3)cy#X0WhHvseV%t-Da;pW07n)@vs0!hLQnQ
zSZ9jACoFKe`oeb(6#-Wk{NHrpu6BB4G9|2%i<6l=aBLy*kUFgCluNhl%iiaqtS!~6
z&S(5m`Kcdo`cSqU;@Rj0XW#~W=|i0S{HT!lEc)?-$jufQJ4Ae#QC)=PmHTz>XW$|-
zDQ>fg)o@E<^_h42L&2R(<aasWC(UbqC#z3A-}k=XqM(yTMYTHLK0Hv(CD$@-@t@!b
zvqG8YV?x96I9D}|fC@FVaPvICBl}`oqu%p^HDSfiktTwe6m+e*b6B^;r(L&cP80G{
zNU>@oSA%5C5!t|FIRX}&T56vVHA?rHAwzXC+e=92{BO`*4@O({5ru@po7VT=$u^^B
z1<;UCO=YEn?J0k}0zT~-^c~}s3JFchb;e!4+|GNFGUw}LD0BI)%&+PF5V=vm+Aaul
z??LtdP=qM0SYqJE8{XQMqf#D3@|gBv<$0`N3Ct9>lpd9yG5OVb5nus47dd^+&o>M|
zu=oN49MN|Pk}u>K+_Bu{ZI1@)1xJ~gvB`y@*R5UcdwTWu$*y0qE?Bm32l_NI&j;AR
z!CKSntNH`9R?eK~PHbpq9|AqyxODB)C#Kcu6efYL!mW+#97_NQvZpLV9ogz2V>}v-
z)SFw$HBfD`cBf_2uE5QUOk;F`z10RfN5fzAZ@=(zqMZ#eAp+JktiW)Juo)zD8Ir!X
zy?nhQ%d5buHciuq`_?v-pA1_UfWoxH{W}V3?p8+)Q;*O%(2&x2T-rtQ1W-le)mVD{
zGDokKL({nnBp=9;WkBXwb{_$pFYSeY+KB%RVHF9Nr0Vu)`}LROlK-ZJcgNVk=iV_}
z2qfud-Yc5Hf*}^0VnL;BQJ557ro7kQsA7~e6K8U`;W*^Y0&dqGHfRtx+~{~`J5ydU
zOmsxs%aD!N>4u9&fq=ccl<Q17e=6|_=b}+U6Uw(WxcsTr8#DGsfJ!FFQsU$BwIqNW
zmxf$F*X+3N<s}VuIkqi-60T=V%pF|}y%ZfIO4GiAk)-nYfLNkr<4|?MDCo)o;%n%D
z_$&Ij2`)OYo_@8Go2MWV7JZ7&gR1tFkuXvBYT4sNg3~|OE0eP;#UGrZWjS+i)?2`k
z3(ZE<(r2{2y%cgB161he#Q<D0`$NlYr#p;dx`+tF&crOl6o8~rS<GG{5D_?4u?YcX
z6-<UL@pkq#H*>eXOGc58iV<m3;j)b5Z8qJXl!z__&+<ICS<`;UVkaE({du#IR{s^H
z%%FJ*%vxl+>!g0|#D&%n8xZHWP^@7SD$r|gCNx{7CnX#_!?fo&k?Ak+3CM@X7|IvY
z4K@f_Uz>g^&#|8D?Th9DC3=z%r12@>y;3z~d6h26s&SjQAo9__okdqTShHN$B#Fmh
zlvybl@FON`eK2xVj4##Lk^7gRF(Q|FZTjfc=`|fC13>$Y!Vfa<DNAxuFmL9_QuMdh
z%Zj7sE7Kr7y1$M+Z^rvhLPI(pZZ5gyo-)@<AYuh=008JU)kp8vd5knPtz{rV)3fhB
z=v?&_;9!i6{S3<-_VfE6Gi``A7h($=e;v%d>8$e~n<;zB$?Ce}=Oxyx#nJ=tHu=H8
zN|`H!FOT_)w9?G!8otf$doqCQnv`7FH6W4ANb(tKY%;UT)L{mX-RvZl=h)3x4Oz}h
zO{5EY1zxLyQie_4+q`Q`=xi2fUr*mp6-`cMYZwTEHW_k`Z3-HlsLH4`d9~y`Xm?y%
zY__F{ehM<fw^ee0{rrngS6xCz@uwssLvckD@1LG9b#GdR6@n%jf!Rv)gWK~ioZyKs
z_3~S~Ukco<J|U>glxc39RiGseECe69k1pek0j@;JNsC<F^224wiBnUXqK-~ITl<0{
zU_ev)JZh#~@tGW=4?7Xqkz}DybK=)JQHbn5A5D?XTyCnPGbE?Wi3K*O(5bt}JIbuO
zG9lu6heuxmEV9>`a7x?3vihZWLvs%g*!yE=hx?qxUk$Uq&4lOmibu5l`#zXcH!u@Q
z)3#9dH7Db*o;wCP02?|N13jPsPLCtESMh%<rms{$?I)l~R?l22^R*TBagQp0Ar{VM
z;g#x6xxE!|piZ3Htd^(wLSQe2`iKiI_>}0N;E-)u=sbTwAC2ylt?&M6g=oIPy!+0y
zxDxf>gu}sZFW^@@!4H{zHz8LR@l!Vt@u$^ra*_1dher`;`%r1Gj49(NQxqs<)7ITI
z0|=bRyT6ejn7`rUnq3F(GCe|~NdYTo#pGyoWPQ13;CTj(!A--csK-G+5~=O%?RSu1
z<-V3oN%e#h@S#}cGhLt_Oga&(3W4-oy(K({3a{ftZjQeP7C7WIap@?jDE!p`NLy3#
zk2dq6q^ahUc@BeRe2L(2ni)3b`?MynA@5uB3G$XG^1GiI_WCr3O@d?TpG(^kN_^e*
z9t5@t2XuCb*z}ourK@nGMo;Fe!!U^2bl;d`f5DIe33Wb0x6vuc=LuggPSR~0q8`&T
zkbc3gi**B4jf{V_k1o57BB`atirDhf;IN7QwZ8LM#YcS;%Cpx5E`1!$XbcDKKxrsj
zy+=58E1Wb_ZI(drBOpc0>f38n-XfheqGA37dLtGFc2T_lmc6fd4aKr*BqBDy$9H>`
zY$w>-?^&Xz!ODJ8Fetgt_)&eZ=2l%QPRw{yFCnW|o$#4HWrA+K_4^&Cq77NS)`z9c
z<Eh4kEny<KzB=55AST1O4dwsn&42)kwd?D%)gr^7L6p}#S_V%UJht2FgK<KTVJ;2+
zdOKX@598|I!zC^@zPB08Ck252WQhLss>700i^1?=27Des!PZ{&%K|FT@&`5P6)W##
z4?vp61*{}(yrG>;I-1I2Sa$Af#s9Iq#3?0bglw}@epH21RGv~laIP_8K2OddBr~U9
z-gc@`6(}@pUShgiK^@47b{z~1JzaxfWdOmxF3vcjJm{8=04v`6q)!6cogR#TCFeuk
z2w@*uS^Vb&;2+-%np~Tn^6*%+$d}5t9p1d$K6Iw+JCJR&`b#4CbPt9J0JYTlbP7AV
zqH%s&J5WRGDUlRsj3Lx+XLV~qvVn~N3uv(l%T7Yy@Hl}(`;o&wEy|4H!P@`J0@#`|
z^LpqCWm0(X<Q8HpK4_U1!qQ~c+4m3dyYt9`wB72r8yuG)NQlZh%D|f3GV%sT!4bF|
zcAiGJ+L9i#1P~Nx$@dbo^7`Ak+;Vt#LHV+JC&~+feGwrV7zP-Cv>AoY4;b-{48pHz
zl;bRFcV~^F_Ujcss^d*flmro8ijxJ1i=!7NsZ%R+wID83yemR!<Xf2&Ct!%;jP%<1
zbugs1Dr!kX1x*oBautUPsxMmqBoKt)piu~W1}uooa<hCAkTKePAI_8lm|CG(Y;P$S
z8Ziyml~l-TTRk9ur77Ah+-V_35MmJn#@EKlJP?n}$nMdJxJT!-(b50mni)MYe!v_A
zgb0s|)>rz~6@LeqVMMP5MJLy)>=!ln7h3JLNn>kqP`MbrEvVBpe$al?Qp&80hHV3e
zN?Sf1{!;Zl*A4=%29>|o54S|tP1>wfT<YGKo_&*%X+v<@$Zyh5c8hh6J*!gk!czS$
zNuiW1pXo=qj=5A$MNeAb)(i1B(l3H#@vzd1CmT2>i&V3ytCWLrC}X{IgkYz+L+cU@
zZ^fkfRl+nc%pc8M=K=!AfuUrCx3<QKwa>@5P-AnUuG?T$=R7QQpK)-l?_o-fk;!%S
z@tUmQT~MFu0RHTN-=p6wAiBUq-u@%J?VsVB{aZWq;1CX^SV{u<e09zSNBl+Y#fl|m
zD>yZ}G5X6nLYq#MB|2fcuIE<QC-Mn=3&4REfm<FVUV%pY@A-;^_03k9JLcOjw&xjl
z-332DO_(=_e9)D^>}jA)eif3RVkk9s%c_!E57TNijKQ)WzGQmli2XR=ltQ)y!pBO4
z?YH=IccSWWSR<v;W<PecBLACKGJFWgk<9dQz)ocYi}N}xMdv#!@9hKJF|TI&R`4!C
z^G$M)sxp34F?Y!5{7WTZ=F08mC(txD`a=d)5w@o|$OZ_}pBK5<cen@I+>kbyYo3kk
z;hb9IZ$g#rNdkzkkaH)QDa+LeAK%yyx%E|lLE+ghZLIK<T0J)@e-$81jg;GcY2H!V
zHxn3(lzM))|KKsP#}!uYv^#ewmy}X@3V^l-S*4-epk94W01#NMcOU?_wE`OVGY^SA
zq8XZA<ON!KxYGEO$hr{5F>X|-7Dv+ka9C$ANUA&=L)M_7qp3GtzxBs?+U85mAay2T
znaWB0W11EwDc`sEtq;&N>DJ-ZHBY;=z6JuN{rZp8a0Yxo`eP&nTqm(W^C3fCM4zg*
zOTw_Xhx65o+GHVpq@qtI1k**+AxxUWLcyGF{|dP`D3tefYeZX>HE<Nk8CB!IMYTbM
z5P!Du@M7yZb&}mr6+_CBi0mo<_nV%gy~aaW?+wqe;Rf%(aR^?OJzOqwn7*TV%;@o+
z%6CJh*(G27TCbh1HkXnvxjij)SH81(&5b&+A>a)5T#wbHejh?1Tx7IrZ1Oi91QSGk
zT>GQWpbU=g3%y5TRsKP8jDX;Q?^MiYo3YboafI>jCG*GtQ14~-c3_-6rOl?zH%T=~
z+3&|AQ7#`}n{>5B0oI@ODKg_}C|JPd_bNh3cw@&N4<ET;X^817#K(7QW|@gQb|bh5
zQX0BfuvBi6!YiEln`TW`>^3jmWqf#IU%Jl~#>;|5Kt)!oWNqi=$O0EHbqJr0(SO?R
z3p2nbSqkHi&dl({8;j{;AbAxDyZ^V~mWctUn}io!wN1G4$1;2r%u`}$I%$iRcte^&
z4ikO4=epsz`$al9Kp8j~3Z~2v1@A`HxEM~sC0%G|pT5q|-{eHC<k^{M3>HoH5{q?k
zPQ-u@%2g`<nHmD^rfi~w1d1+W5q$A{;P#sZK-BU>qLXZeCw4vt%yx>JJ<97Z+3azW
ztxgBYi=|T_ExCtX?3vKbT|nBpo27quCkd&N-LP0fUzvZadxujFI^P874*W}I)`JoZ
z1qgN`6Qv$58s{^Je=cD)%~V_HUN%-dIUGYH3Jbfw4&C^o$*<#bBOg`v{nOm@3^gjV
zu`kxB&N4Q9R6WZ>yFMFT_5WOC3*pLEF2)2#p(sS=aoyA%b1Nap{pkN=?=7RUY@)Vd
zKok%qr7uEJknV1gZs}GKDe3M~5fG5>7HN>~P)fQxrMo-7IpKc3^{sF5^Ihxx^Q?9M
zaNT;%%sF$+vG?rR`<Q77kpNumD(A31{<`kAc0bd<vxR@Wa%^AvoJ4h;NM1xKORLc7
zZsAs~Wv8ab)9!H#q{-GwqSy_7LwY?bam4oy>>e>I`N&`a_h5HSY@BwK3?%zZ<;{Oy
z5+oIa#KR|v?>8HT^tm0@x<uLz_Im`{>iOK0!m*{LA}fY1^Jlp&m*pHbl#dOX*oWI(
zWQWu3a)NBzUZf1=D^-5P!!e5>mMt?AsD4JrLdfQv+~=Wi%vri90VDU7W4xlTnB1<P
zd2w|)a)b$VPQAyX5il}4m##A^3R-D4_SW7t`$r(JXY3$~C9W9B$_}?pdd!i+CJX+d
z<EFo^ml%0<^=mvuQL1omn?ybRz1`>}J<JCV`NYTbiYHXFsp|4DvY_c9l33Gh%c8AW
z7W2FMm}fF)FEvUy1Myo3U4uR~)^FF%6f5RFu~&OdL`%5DicNL$U}odfRlDTt6G|1a
zy$<^7cnZ0A(;7`Q*rb@*IJ>`m(d7%HLOvobcz6NqS)6w{O8GHA{a_d}=?rxj(wps@
zhDmPm6x=krmaj~=tB;>b8c#GkCZ0CZ@bFl_71PO5eUbQbua&fQC}q+9&yT(mn`QP6
zQ+vvxA69kd%i`T5B(BK_yB6pXj;`NZQLrU?=U!+2Bf<Eqh9J92VLH}~=d1Fh<oxaG
zr+jMeGf7?7AWGNm(Mn;?(S@I{RCNpxn`TWnzBel5%*#k}<iXmwkOzxitbap!p;e~b
zAjuipDn)z>7&sTXi5a)c>kn{B%)eppaBkWV_dJMJT--b132w}3no+agm~~&QFS^d5
zVAwyjD0i3PbGDZUXB56F^yEE`sSok<+v3nez9;;lGOpP42AsUs53cg3G%m`nK{52V
zi^2`C@feiXxCwbJrPUM)YOfy3Br>yaz@XdbSvU}Ydx7Z4`?gF?VfPOz1G7n!%}1!j
zkU%Ns_>`w6)+3F1_q{oZ=2woaI<x0udunF~va15e8F<~g2Ao|x99_b`X#I(`)hl})
z`4}_ls6_frT83zknzzGVW4BOZz3@GU5?wmG87DPJbpJ-I>tzY?GR*!#wIOi(Sl9hq
zfQTb6;zMW=b``E^QsTPRfK2%tAY0?4`V(ZE{D`Sf%O5jydSn1jIA5lVaBX%jYR~I3
zXi#w@XXu9<#N8PV*9QDX+gSP#>14xUfc!nMSD;&7%$cKurXX6A-^_{E*$2Xlr~h50
zul0^{GZoN}JMbMcX0&8<+0e-)UWC<Q2UNs!+xh2X+PpfLK_zwFVGo2QI9k5QuhxrM
zsnHv9zX^II0iRTT%E4c=MIT%9>Nq{RhvKXSPy6}OQWVqD%YC~oY=MaiQMFlA{(?6}
zZbMsBXV^UcIfGeJ>%S^7WxFv|dS<zZFVJS+FXE-_y{P{DUv4Z93g=h`F^ls<94f6r
zqnFpRh8{0<K7}00<&Ad{U?m{^K5hYuaAuv+m*PBj8^rAPe-?FV>i+E_B*#0VG4`0M
z__aDw%Aj4>wW8|DB>w&VOSn!oUbXbHp#CcKw}|7`XLq;VP_B|!xygy@5|FnW_6tr9
zpOnSKWR$e5lGFZWdjbzD0Tqz9>Po;<_Wds;NR4iX<awYI5>FcaLJGIgy9G9P&Gjt(
zc*aBO^*`cxihwQT=59w=3Z3b2@wHEk#mQ|@UU%P^yghEpe>+OYnE>P`5-+Vp{KT;O
zQ`4TQOcD=_^KAf<Wp)5WS)FIS<So&wV|RWep(SYaU0ptHm5Au+4w*zrST<atQO-78
z(<EW7zC3bSprQd0@`fPQ5iP}6P;waX6R&luvc)sWKP-xOkMlmY!(FVe5ge^ux_4DE
z<?)td)yTYVY0#=@8wFhS5zjecS^a3joaSr~QI;I$S4lA5w>h~toZ4*jdM7-6Ns7Q8
z*0I2sK~wy(O-eL_d$<T&-HK+o$W*C7>_WGut=stXbr8~Hm_hC@Q)T)I_b+OfQ?L!u
zMY}55npBI%2VMOa4GKN;d1HR@JzOb`T4-3n*QrO|Nk);gq^EsmDkfFqO<rJxK~<>u
zyuOkAvTXi}Ob!<OBw`%pGEhmb4mSs+C$JT0l-X}uS0WJV22ctG%%^;=A)6&dfH{7n
z)NTqZvzU?8t|~39d7++{r&`XmOU+Cj(>i(Luoo_|KeQNKejAu{V_CY0SCAoGcB|&+
z(w!d!0f@psLSwyNC*|OZ21N$z6D|>Q;XQ=>7qcMKf`)X*;+Xp|k-}b<HRHXVa)blW
zKj{S;nf;u@nd>H|IF72?0cFZn#$b+*kG8m?+x=$)sQ)L?fjeCDe;hkOZ$v$U0QLgM
zx8-_tJpSm!ys{7AgO!NUG@7svp1mk$Nl~7Do$$9Z*9atxiCur_X$_23!u!1vyq6y`
zD{h|LfCeV41NjNaFBJ`rhwYcwLs{roOXHt3QqIakU~T%F13c;18x5T98=b#CvvdZ|
z*EyDNZ5n~&<dT#XvA*jwdab{Y5WJrC77EK%?FYH&o3Jo^`rcpXx5-id-i~gVpHDRs
z@4Rv$RLY>%DM&8K-OwkdWiXm0#!=Q7M7uHT*^01FJ-zt;!jjn%!Bzf$S#aJ$WSV8U
zdflfmf|_TMxE>d6NUR?n$168o3$XXsQr$)r?QE@Gt3Gr+P^vW{RxVjQ@<E?T2}$dI
zfKk}_q*21i>e2V__YrwtH)Pe(_7JVVsB_wV_OTBOiE(q7{KXu?+qNU+F4^!bY*FzU
za%GN;Wn^8;-}hNPwj>+5thy(&B2h6jmnn+@R|umYdqa8jV;PHZKghpieBlbyEOnjs
zCTQ9>!ImlH4izI}=>{QLR^z$JitOL+8f;CHYfDY@&wL&PMWSNF7Ob}Nk{axVGkx(W
zaHk_bj=0IhTB|wh-g%d0D{|#+ED2pnV#=8Q`ug*#rshLw_PF|T^GufcWxH|vEcWsA
zK3S>MDs{ow;~&s9jZ(c%*e`T;=vZXgk0!Do%VAjg4WaWhP;zgxe)U9G@vzWe8rzgW
z3yt#XR}ZFrK8>3&p&^CNzj>K|3;cHDC-NT#>OoMg+^H(Mw+ZbL4BS9n2rOg|br_B9
zqaF;j)R~|c#2dCod5{SlYdMfVi?=Es{f8_f71=Gt5+m8;;|4Oi7NA2hbI^iTz)u+s
z>~$mu@q;FYnS#1$Y3xrn;I>|1HEO~Ad7ik+@+th}m`PNB;8w+@`MfXD$m-t^(scb@
zG^XFiC%q^|^svWKlr@?!uJHGIeS*K_$v2%=z^=%q{#BAR(P&uCk=D()9p_DsT(^ag
zBiXG^s$O`~8xD%p*MXC7ETi#{Ldin+uGP!;H*vyiWT2?6uXn#n)_BwsBMSJrnCR`}
zFDN$#Dimm(7yh;WnQpw`E!!{D7i(@<fja}K(DurIzwhU1+F{TfDu?&zWjNdC%Wao{
zT*P-YLoItXAL!O7a8d;NS^mp#BBBadEH#p)f&HB;o7j4E{<NV?fI8KqCz>gQ|6)bE
z!}|2S^I(?N*xuZ{F%J|dGv-gW_9WRN&5ro1+#KKkPMM?(T!UOa>jl@7n9T=5g{eYY
zzh>;OFKqn5JE~$D=YRa8Jy>?P3+NNhkprt(rPE{+d8t&;CSLjY9z20(kZnd}B)AMb
zg5&Fbv`%qd7Zm;ljet^xv0CNBKL^3$CA*cc(aG3y-as7&)k&y905MxNM+(So1?LD&
zyncV3Kc)C_TSC;7>+9cd#sLPi(j@ikqlF@BGfcX5QVVtyz7twsMWnjQvnA$T`8AT_
z)Bfz?=lZ|z(02x9;Y@f0hxi&W986|U!JpWck{nL7zV$hl%t&2~9LxmTLmhKNb=)P}
zqUF=h4j@5kf2X~IMwL$1s8sauQF@#`DKi(`;);Ued;2Y$k=)A)HMf5yRodoU)F+vk
zVGDH;iiW}FdLlD>DL8IjK|&$<pZT7*!<TSAB-45TkB;%xj@J1{Z(QmthZ6_Z;Qjg%
z^HQ^QYCdI=pv~+dI3>}oV)vKche2}0A)*6HByJsHN7TG~h#;Hd1Rsef&Xr!}B`JH2
z?j%h}&Ysf{!4-RVTX$itd4j0YX-q7054dOktS_fuS#UkDG8V~fM4VLYEGBaH0bKrG
zeG>=CnYVYQp7o7DxmdyVxQ?UCLH%cAY@Nq7KjvE(TsNSek8)45(zW&?vg>jfy3C`c
zOysXsJnNY$KR+a(P#LHcExF!^N6cSN5k@lF=}px8JS7}?7`Xhrgp)+$FDk-s@&=)8
zASL<QX<tWg%rWs8-2PDzMsf3YNiHlAg$|Vh4=`Oa@+U~-Y8TsgNmVA&3FNiP>jd=(
zhpTMi4{@lmj;2CM8*)5kVz}vzDXr;IH9DVs2bm2U$WUsda)F9mcUXCQ;}rrCdv0;U
zME5c0txHyGE*m7bKl<>vuxp-%xBGJ3wBY#@N8N&)abH{-tWj@I4`j}<s7239C<{XE
zfJJxIfrDh7&wc~nZRg*F9%g1Q2Lq3{?18eALa({@SqHb;X#f|Wm>T+Plk(A@+Ai~a
z=)^%$_<KH{<;b8MNtsR-bN)&BWaw~|x6dRUE`JP28W1v&G1C0m88}$KjqFq~b<9?W
z4?HhC@<i^j@$12SJ>K$4l>|yUhJ6RAD|WRSwKhfptnSX^-RRwLV|}{IDq2+O)-cI|
zf8tvh@7dkQh%8dQ@1qWQ-8=u$IJZ0BN=(gnq_^h>|3|91UGM^_+~qhZnm@W#$61fd
zsUd_%Jt|2Z-r;y_vqYJbBaz>18}=6D7%IFx^%$S9sFs>MXV_hn(yTvkDP-Rx({IB{
z7dhy-?zO1Dq`ns8v$WLJ3vAH_+u90Ko+14`aocGM%sBV;?i;0r&i2XkqwS~mL1h{W
zFB2uX)Aw`rc|FVYTaUhS8>w>GJJTy?Kf<Av|9UcyF854w!L4zVN?}fenwCHJ*H04e
zlB7E9Ze-r*s6Hy7{WBJF(Hy1HW`akf;_aC1Mf|sZ>a3p8*H>*kBG=6ymyZ4!wf2hy
zJo}B4?!IFs+C#C#&KC_n`v&>dAwfx;Lf7XrQ9*|ap~g63)zq|C6dqTLU*l_xGVo;A
zESV3RYrzL>Q8si_s_LkVUyw|Qwq5DyQQ`#clrMVd{!n+LA;B^qoN-($*n1Ul8^nr#
z{ylSek6NF%#n_(Fw#eL^7FA<IG$&b>?7KT6r+g^B<hLA#*v$M`O{<ubARC!JEZem~
zs__?fG0$1N#<j{uf>WAx%E{Ky5q2?Wl~K6JPEeSB5=za@){jKgC3f?1AZ<>a^KFh*
z^Q7?8cu36^PHI)s|0G2t4cE^od{7pUo~YA(kNBwQP~HJL9bRZh+~b_FIliYC)SqPi
z)bIGUpsY>=PuiOrH)qPjq?vcTcqUQNaRz9!@gL7qn%l6NF3B(+A@F*D>LP<In~XZ<
zhU<y#8X?nRUb*V}nHUVu*LHN%{BExziYxtEjq{)AkJU6Zf*kYa_#S<Bu6cpSbU{f3
zTX0@vShH6Cdw;y->2O=o0!Up?RJ8QFWi11as}mLH2R7o}8xIYrq=s`37Ng>@(Yg&=
z;WR#qJy;fMI7f`%>ex$72F|tg1^<i`$R_Kt6oh@;>c7^CJkY9oRNxqn^vX94?vDY+
z4hlTwdC3M|)6C4(+4_&2oJ-ym3&%FSK!;AwvE{7u(<zm+aiSl>rz4tmwzl71@sY>m
z-2{q+F^_)|!Sjgi*}9N{8hwnvN}xDy;S;&jPj*D~9!3QFpalXIcwS^gS5Y|b4HlnN
zF6f^AIUL>5k1=^;5Xeo!^u#^yOg4gCMM@OG06t@OB|>m~6+=vJ<Y%UcML-}B6ztmk
zM>Z1}JNVa=^1(c2@7&u_f;>d{4CKzZVsHAYmw16BEYZ_0*K`^Fk6pQX=Nhh2;Gm@G
zw?qED4+A1{__0RZ{=#D5N;sKGweG_UU<m3CPpN!DtDfM`Bu3_xfpgQy@T<z<g%VL6
zqO|4XSP;Q&C;x@U>lAsK(0dqQXac|`!Gg728qXXU;lSDke5l(WF~hG|e$NXo0}+vm
z&u}H9bdiF5fDpZ<;WS|H*V8t^mzqC?qq7fqA&(Bcnq(|bG^C+DBM#)}qBk`S;bqz@
zz+cHS-skqi@viR2@Wjm!@&@l4Az&hR-d-mOH;NskK?2sVWVQT#!3W%sIaz}&$Mw}Y
zgL0M%JR=NDracCQKLUId7Wl68FI<XrE5E8Yea5{!2M~KR>|!&k+ZAKc#H=00?w4{2
z!v!szD1vG{z$Py^Ly<bR+DdSP7TS6nYstPx!r5}tVaJ1vX^>V=0Y}$uH0MZy><Neb
z;{_a@YzLwt_&h<fG_Xu8v7Ct@GY1agA6Tb<yq1X2pJRmJG~x*cccsC)Vjxq((V;DS
zkwbq5K78+7XL67s$Yu9zP)F$fS4;~f_P`<NP$on5PCDg3<kr!}tdj_FyAa@s0ER$T
z0+AqR!WTF&*<`;_FvR`A*r;492oS*-V9>N8l0Uo|=nrJUfUrNlaUkp>*no-9t0%^o
ziUIX19u0o-&b9*c<|pLfCy!n{1S#flUZ21hV2k<^-TZ_J{G?Sr6;u*}pL_*BdHS&e
z1^S7WgdlXV);1<lT7xcQBqi}s=793&4=$Sw_=f-#!MC7r`}p2BPNlrN*!KDo=Y5u9
zMo<PQGM(MQmWLrD27m_DjzmpCSCbNO8XL0J$tvKxe?J4W6It7*0eW@7^2DtkpwGlX
z_7t>47WDPeH!XPrzNHp1xp}MfvB?9FC<g-*I6F#6cOL}88Q_fyUCex9K^hmL4`?3W
zUX%tj?=5sQT%UIqC0IAZml3QDpB3LSVM(zDJ@Qk)5g!#=^|68;djQm2T9h(h-h6~$
zfZIncRw!wU1@xH6ghTxh<U}hX^uD`Y4p24%dd%qj+zyuSBpe_;<BLc!m>^ye@Ih2I
zDMe88&q4Dk3Vl$eX9Jczz}sHK6-x3y@K<EBB)1ECJc`H$mJAseY@A;kfy1D=iZIYz
zg1t~4XwDln2cvaKD+RyVf>52IEl&fQo5cVdr*+tf3XIkTtlX3-(cmM1LryT---T=%
z&}enQA|8)FU<0uT<OiU6#*J?(pm{_ePl%?F8mEn3Ksc_51&LC>Lnenlyjlc3x=I65
z(w|Q?20bPMOdWm8l2-upLy8SZX|%$K5cFsW;Kip;tpu$|21H71w6XU=k5r&Xxfs+4
zup&EDV1DEt2Ydi4;^+@PNO9?v0ay`NanQVQTB-zS-s{B;(7i6P1siW*$A>s5g%Y%|
zRfuAO02Y`QY>KyIM0wBxQ-bDrHoY~V1r7k4{x1AHg(F4_%IkXrMtcn5XM{bI;1)jt
zci{(Yz<;-_3C#~gbm(7d`y|1yF)Z0Y;M|+MGN<cPJLvHQ?3&Tm7LfsHfrY^W6DX#n
zf)4=rp}Pw|awvknZYFB1s9=5+A^b4oQKR1CNAE8Dd<V_@ii(7R<`JZB5PR>O((?--
zQLwtmH!M4)k3EP87FZ2T_wOPO4X8O;Fx?L0_e;V41^6+tx(h$TaNIDMW?DLgA3#|4
z1!nRrxA?)m3qSZ!^S@X$P{8y*LV(;ml1DCS5#ZNkvnIEQRgFW50Fc^Yf?xR+92oEu
zTHr5WfmwdO5`h*NQ2kx_Ndi=VKKRQB7kpC&gdYQXB~UpI;ivg7{5%ECqX+s^Knosu
zi`XMMxW^!~53DZ64N+IOQe>il1^xvQgn>l~)La5+ZmR^<1i%r(&)i-3@dX6IStcq4
zMms45MyoTC`~iI7Z-Dl@@WTi-|IQF%5Hftko1AI<qZ@j;Not1>o6n9-4Y+$&9}om7
z5uOY*KaT)n4W&Q(Lj(~G=I1W_yZ{7|^{$T=e3Kk7`Y!ESnY3Vj0Dc1Q!jCZ2JRyz@
zwBWS2h}}qnBSeF&#uila1#ES&j6612;J287AUdXv=s<Hk5J4E@4T5?c2tUnt;Rg*6
zgyqM;NQi%;z-VjBgt{R90cgJqKW`!aY3zm=M352rC6r&qxDg1^i>GJKtqIUJqfkNv
zE7A%P1Ur2!pzK)!fY_eshd2;HFoF5G3qO*8AQT%@)xkF<0*i1IUMa5*<_F*h_b&YS
zLd~;M#{z4Mp>~VdQ2}^X7)1Az!nbr!5|>N?E$}ly5O)|DfS-W7@B<9Yzq<?!<aFGH
zA2QJVmjsAGKw<w4-M<|r0!|qiy(;!CV#lR3VPJ}aA%eKWzySQ{-G!fUKoEBs7_g)7
z!Vfysypa+sFxh0kZV~&-1Hp*%hVG%tWkC0Q>_Rfo0*e5GxWm8z{NUb&A7Ee_?=moG
zfPe17j}U175zh^S{3g4h``^DfAbNpA$fvkPY-x-<7nmYoV9@R|FaSTzcj1Q$5X4;u
zMiT7kJMcpa@lS825eQfdzD2n~?AvR^UQ5t3h9&wf-Mf7Bjs+I+e;t(nbx{7l4vOIw
z;*;+US0cBb8<?B_)BnZDl8uRIM$E9n+Iphjz_;0Ur2e1p<aX3vFW|)XSbo;0Hbhu6
zsFQhJO1--Ez3w9_F`^q)qJHzDhPFT`u#w+Ch@}A=sU-?_6thn<H)z2N_@HP%#`=uF
zwuu51QQb+F3680Pv%p5)Gqh#}^>PiL!G@)0eV7d~GAA&>4Kc9C;23QA6c9dYpf@#S
z(V>%z{F10X<S@trk4NSCab-#$FSHqV5N<akUhZdZ$aaPR?h95Ci34O+1C4|&Af*nB
z#2q>?rz!VQfZr5AwzEqwlL1ic3>eAf2Za(OFp>Z;5}gvlHBeSF%K@mhUj4}?RQmc1
zj07+53paFc?+2Qf8-A?`aUnDkSewsPl;_cn?}d8nduhLYqy!JB^gG}_FIFDH$Dlc8
z&|DM&;t=G!KL^}L))gcQ9eTe3+iCDX$PP4zAO^UPGc4^l7%e^IyQe6~zW}zO0ixFK
z1tUf<T2x?~wT+%AK};<VHP6gJ2)TAPH<oP6MmWt0{F-d`{;luDpoVG(?8y!};6Bnk
ze|E_C3Isix;tIQgsk{&e^COm%Dg%C_0}gjbvCZ<jV1DX>GjQIOYJ?7Y!~;Fn8nF$6
zLt}#lm>>7zm*Y^qrwI5U293vdV5N4jLGwwueq|645^jC3O9uGO8{Z4>Ki{hXKNA5g
zJQ*-G_l)gXq4<OWwD2s**`PTLaj@`$vBZJU!V`e$?s(+A1~nH17T%IV%m>01G}>2b
z$&z5SUSPCn@ojx?!D#Uy-@W%`CdAaq5Uvc&Ss~YM`Non>E`Jf-2eT{KfO>mc(D{YC
zh73MH3^+#u8aQUaIocrvJ&w?RIlIMA$({Hi2fkOFNFNF4kpcAR(r1#%a*LmUyYNE^
zHLs3s1}!-Et?zZFi!cuIW5Mc@-C8m)Ci(kdfd!$cM*oHpD`>6*_!in9Fq8lsA^bGo
zg&!F3y=J9@9zgi{4p#HCs8GZ$el+gFk09jQwNDyBo?_39C9CXt9JmCq09N-Fv9)jM
z2Eh@(As9f)y@YxkY{gkNu)qcCj}9T<iyX|)UHE|lQXB!Pd=P%1{gpZ-Z+MFz+`I52
z2Q^<rF^&Kh-1gS@I;cl10g@kJbp>yIF9iMMhtL9pv+!NS0q_%W7k&V7{JV=df`IRJ
z7k(huF1)f&4U9Gk8}hxZlZXhrfFBN4_ZG1(zcn(+!4#1K#9kUHmw+wTU<wgLG5#8~
z<p6&4?!r$XAP5Uw5f|`HH4tJ&a#Fg%2f0K0>kj-RLHzSxrsO_Y@ReKNYsCY_NZ`iz
z^1SuE?zafyKnpAZ2tvF#tq+0_6pM)wk_U;L5Pop)!jC0H5G-7T5S_gOqs1e<uM8ap
zV1R$_!Vl!yy|hUy1kLl`#+3LuSYvNvOt*+V_AZqd15+dbIY)ijM%Z9}MgU@KKQIk~
zni>c{&3EC42oS^!t^X0&(T*Viu>mT=2@wB4{Co#~1R(xti#0+8JG%GQ_v*dI>U9S_
zV_3r9(*6G>!vkw`GdE&IhY(xyA7byDrUXF?3=n&lfdTjlxC=kPz`VQ5z(D+b7k&U@
zkHXmcaKVBn-yn7``T9ljCFq%K7U7oe@$l~{gDC<AX2tR@0|SC*ci{&Z7__?#48TwG
zUHEwdnosTwY=PJ^{)X<)Cwq-ZAjCR)-69rs_!aT3f#JT(zySQ<-i04vU>ff-FhqcV
z?!wP&z(16xsdQixgl-WlbS))#4tf@BxPMFc^o$R(!4yFT=HFcgCKM3FU5*Q&`@0Mb
za9jfJa$H_Q&BqW0LTt%(L-+sdp!~0c@_)xc0Z)L9XgiRXnoWh+Z;i`>`wzJp-}{-i
zMpmBR0)KjY-a~Y@Cl&wv5GMt^f!0@Mrb+w~Q-l%Ti0KLq(AwNnMxgh5wmc{>$ewP+
zTmIDI3GmHcdRh`7x(dR%sXGv1a&MTQC)<<Fvcex2Cs3^A??FMXNo{)}Gw^%JZ@CG}
zda(-JxV{L0=<x92Z<vV}GCkLbaJL&2xPOcYH@njj^80VDoIC|7z`@?I2!6*AV+Y^M
zm(=;2MwyYESn$;=aC^0*wmGG#{a@_flL+Pie|yED(iaBAE?oLQX0jr`C-hRLVgGBW
zntvw#bLe+4`j`Jm=M%P|E_=N1L{M_0c`@?ZJ%m*$IJfbG#kjHbo6^4zng~5|stETV
zK1l_-+yTS&RYC6On`%}3sGot)^<4JGQ%U3$p1g@mw1L>xO%f91P(k7UZp+tH5G{WP
zA-&tmRZl?-<o9i%pGVbKR{D}w(}HK@q9}v|2JX{5ga`xE3zfdYlUl{mpa1fJeEjlK
zwpH^1u|16HAtJmkwkNsMSu~zTJinF#HS$RWT)ahpYf<mq!9V{uLJb9ov$kRUk)Lrh
z&{e}9BA7q(tjmqd4Jo7V{Z}Gw`2g`k8r;kYXhw-cCzVSx!!$cLXY}+}s<=Nrt}mlB
z%FM-qPDr^`R{;+Mna3*}uh_R|JmeH>A4IG+`C+@8(U0E;MZv&djad}uH)}@#$_q5a
zoWFw44%X+?BY{*<@1cQt_~G_c1~w=`Y$!GpYOa-dJNkVW<X2yZL|ku{>#kM?(J_}i
z1wtDPQ#L*Klr~~RZFie14Ll6D>-Y|aqT-AX#}^?*SN&|cNLuwQ`@A#T#>b0UZ@p+%
zCv9y0x;TIY@`Cz0{`{BIvV+F`O<du^gHIy|Gc549!QFmSZn~tlm>i$Fh$XcU5THo+
zkWKo@Zk8Bv{5}#*ESHfU*s1sUUZ4*0%}Dp<N_LJvVGm5;9irRe&~l4a5zpzK&MP@y
zg_!*My4=B0@XrSN^y_=Uwph&rHTCHHu9S1+Z(6%j<GFf*qg!2f8$p(S40w@EPK<X8
zhy(Yw%`u}F%<goRYku4}>~W`mOw1bzm9gzZnX}w>#@G&w#hqK&6YLmxV0$osf-{xK
zi+!ARP->7V=;dvDb;`90-VILPKHm7z701yRTS~J6a>x9$=v6`46XCFhBuFq1cT=xh
z1?6bQ*Iu=(F5OSEDw%Meyudz=OUhRYY@b%sso}}TwX5^II+^F(9540ZzuX{)baHJq
z4%o0|vPmyMdTPLK=L5_DDy2;1!xi@LC)zEmJHZ0-!HGR0HLYtv?8yINw-<>0a%RO9
zmh6Dbx<2w?UfCD^QK9wel|2qCy+Y%AU8*JT+iId)VAhN6bO)6vQ?C2OK+KG*+3`JY
z)}g?K<yRed1G>xO(kT5be>0NwIO@i~3O+{b4%dpl3guAos2smS^WWpk#3@!wdGz^c
z2a0b=RMU!|7b+d5-F#Yth(2g7ACLN=e^Qx@VK%F=wPdAlDZED)bPu=48`Q{z(>S2A
znf4E_1Z<9-^F78N<y##$7<9A&d5X3jUF8IaAQyrBa;H&fo^v=MRU|<1IREn72IV!k
zgqdROSN>h9d99L!?gZx!hrsq@pemMP(8D0_>uqJPQL}U3=kTw>y~dU|@zL0D#O#*(
zP(<Jh-1Sl2`4-Zu*EvZF)(c4qv$@<0vz>`N&6Oz!j((o)I%6A$lU3JK`jl9<HEfUS
zssn*j5z<rG*=h#qYPH!+{~Ac!1G$+0IG#H$ER@$Hk!A`)34=IPZ^G#-W?zkE%+O4`
z#qnQ$SIN~1efzl4!UxxPzX20?z8VNX{_96oDN)~$sxEn5oc2o=fT-A`&GSV5i3=vP
zlWp$448HIq(Eyg!JkurjA`zT#iuIRAanXkTlbmJaZJE0kMuj+TP;zlE%3r2=Us7xv
z()Kp@r@A~&dvblgQ$nQfC-k*fEi_hL>ILe>@O;nDVySD7T5?KkS9$GLMu)Sk;=e`f
zBGB1)ZoEWB)Dmg%tNU1<f4Lf)+N@_X(ylDE8ga<b6t3D6o;W|?XW}l}6{iSGZuCbi
zBb(JlkUcQ&+JEw_&wpWgr*nX9Ww(`Dq-v_-=rEGOc=Dv!2Im{9)kgSBcRIeKQAMR1
zH7byg_lAr8a=%B+=salK2nZ0AobJn%rSI~V^4ESD)hVxL1P|ajUtgAQ(r2tY-H2YP
zb`mI_0Krn(N^5OechAI<OZ>FdL(9OmVGr(n(hP!uhs#O*Wp<QR*H^tiUeLRNJkNtz
z%d1!5AY@4jjuO!0oj82UO@8yQ$djx{lkrViLCQ2F9UW6`Sg`zzo3~l*c~NCN9D3%H
zs-myCi|3>@30d36Rd$35i-snIO(*0AKz}!I{$ScTs$W@l{Fe(F`k(_w&}JV3?ZV#>
zpO(NF*(mMEnf#X^ckp2>hey?>o!xIg?%g$J)TKNX5z(omjVZ6X(<Rdh*9*)F<qkAk
zpoaQs(RjKjk+++c7%k@!WR{sfHz@1%Pk<EUK=k-*Ebt(Z)Od<Wgz~SqPYL;~nF|Mk
zwdefk6h9C6X=_wo46zb^h*C|Mp`akP-%LzJ(;x4SuZ!M$nBgD`(xFQ)^SWr5e?Byf
z1$Bz7?QX_XCaamo@n5Ydi_e>wRItZDfBjx?>+`>!&VNJkPzgRcT~2zL?iQBmb_LR{
z;<)WLa1>~CJ@oks>nP_Jx-_~kmw;N^uk3u@a*G+Awce~4<eewg^WSu$^G_pk5{c&r
z_IIv;#tx96>13Z~fQj4e^iCg)8Ir~oi}HQJ6%+aNh-~&Dg6!G{+Q-gSZ<Moj3u4Sv
zuGk0C3|+=cU3|?*hO<%T4KagxM$<PZ%KICB^QGSl(oPg#wwqdT)%Cb^(h_1h+!lAe
zwx}mgd(fjYuT8$%^HwYc{E;pHaE<FzdjuUr@bXvmWQMwu_6pn{pht6)2Lc{!w#z|#
z_Vx7%=Pz|qtSkf3K#u+AAt|X0`59Y$<E=Pfg{NF5@*EVRy4?m-CR@^c@wCGOmb!IF
zhNG61TPrPcu#l|Q@?@mPYEH3Fx8z6c=;Ul=;cV6VnxGhze*@6B6$RpQVemV-`8hV{
zualR95;R2~`L~8`ilQYMT_ma=XVWp@gOXT}Gf*k8ru0gavi=h2vjuKdp2JT#Z;Vz3
zR@qDW(R}@?{H|AzhME%`$di#-%?Bl=bKNzFHO$q8TQkry%4hswqvYhafj+~06O2VR
z6()!y)sm$<Gk9x+7Az(gaY^^-K0Fi$eu)a=sF(A}FTW-m+Gj7&@TV$GHOK2cz@t%m
zK`r+O>u1EP&azGa?72}O$e<I#NLE;Ag%OZs1Lxm2U0|7$lyJh6&*NfPa=~Yu6$Rkt
z`f;<T$k$LWrOE^_;>j!yl&`Y!C*&@z&#WGtiH^&?pN^+S=gt*>3(D?plwc$Te7*Fp
ztXKOvnh?)tQ!WS3I-fZ+O}%YbD*S^zsD#+Yey#{IJPXu7?N;}Y9Kre0wq48Tmpob|
zQE>z}RT?Zlb&Wl)?yKAc|Dq@*RI=>Z31hDCDftQ47oFZEQSQl!Cs19rqUEhA)V~`N
z%x&7bKam_n_V(6?X+RdUE*7!ez(Gj+#F9w(nuNWE!R<oA8k-8sj6?2ABD+DI>vA?T
zsJ*KJf*`h_>Ly#P<M<LvNM6%f_T_qgwcj(N_jz=<L@YPcAi{d7QvzFY8K0)zn#A7u
zbUt`y6;$wizEm6iPhLv-8}G7Gf@D-(;)5fBbJ&$7A=NI@*95&#f91J|X2L=AYr%6+
zjnpQwVfKcwLz7v`H*YP#2CNc+STdxfP_5F)n4l=<&>m8wR*1!F)T`E>$QDPf!Ton<
zt*X*`kx8Y0E`apw>`QVnbmqNPo{q?x=X;5C!u3D5_qPQjum~`MheBLIBDY@i4Az>$
z!SF;u2hhv#<Fse4mV=2YhX6IS1|bBFY0EH6L;~1w)CaQ*kfQyk@WT67a8hf~<ujEf
z^OvesMcD|)elE5|7(bUMlP=G<!`?0K)Na>a<AS`g(d_8V<%$_lYQnzQmH_1GTS+Ou
zo=3tqn1N#1w|%jo3-P?B2DjXtEFunn;!E<(1Ry~;AsxdiSM=t14^d)x{xwz!C#FdS
z5+ZY?XIK@1R2R{psbmE8XCB2Q&fV(4&HbJp<0rrCM_l}HKGvVw2Uy8&E?~p^bHY6j
zR?KXgvEj^oQSdgC5)Ib>L*49Bsq?(bd{0IzgRnI5+iLaK2=a7L;=4s#_g|T_g21H)
zZ%~*hyrF$^^M_}g4?z0RTQeeB_vK>Y6s{NR;)x;iUEt}Mv;c-~>|sRk1~xkBl^1yK
z5KpCUN+_%)Z>3PIk=VO4Xu);6hO1*WHGn>ndnQLN<5xqfY$u8*+JrjtGKfKps=puY
z-7O26`S6N2D5SqG%OLqVS|p!Q!{{%ocW4jY)&{eF&74eHBr;k(Hv<nF*z7V9^PFxL
z$Ze-I)r%?3Rb8H~D{$ea28&$-m&RnOOyN!ULa&|(0VD*%;srFa`-mMT_4&<QY8=~O
z8im$=i-+I(OL4m<`pD4*=+_&@sYGdM*BdFX&(;~TfvR=KIsw~N9tj$q%JW~~+|i4&
zgU^7ZQAUW~x1Z&9B|GBrR(1TDigbyjLHp#(y3NNWj|A6#kXMGya}qGszb^E?O*R&Q
zl8v=NCN)#*GYkUhx&P4u7>^%kGmRSX{#>m0C0b{GK-TESANcj3Kfr(>dt{t&U=s~w
z^$L?EN_KsSdCC-`%+0WwrMqGuXF3mYx71#ca8X~#$_5m!PFC*wMYQ#F^Of!6Q7IR(
zJ|^TGe@WgS#BcuyJc{;1uf|@)i^iavjHk9CWb!Kbg=X1?(!rV@ib!BN1CA;%VDS{+
z#{^hG@>Yq6f{rMrWdJ!>0k3?;j`F*%?w4YFaUC<VQ`LtYiM3mcY^<h7@8_d=)@q&6
z*kOi1o10}#AUV!Td&YQ}^)u(6aLEC~AN^;lx}m-`b9(jsjhRYW>w^aWng%=_nZI&z
zsZ$0$?^eL)+I@eJSewWqK>t%e2v+9!lt=eN#Hq*G>Mt!6Z%RAs_K(Do5e))hbH}_&
zHjS#YU8i#(?D-%jsFR|?Rl*6*SO1B3>~ZDtK{~NO)11B3WETb!=EjCTtg~fGw+3IE
z57Hzid|#?1V`ZqWp?mXQu-aPR>iIHG17}gPWSjfn&$u+9quwCNWhIEFCUx^`$ffcA
za@-^2<C$yZQsbdMOSGi=x7>N^)qg7T?Hv*R9vGtr2B&XSfHY}_N<zBjwy15awb2x$
z2wKdwo;^>O9QMg1z90TyopK7^G+tf}qBO21IP~Oy)DIfZKF-m1|N1wR=d}h`=)S)m
z5G6oIMQpCWf5IV@ilPz!l4}wP5LpA&6wqOT<=W4EDh8Rq9=lY5gnaUxo=M-!b%9RR
zpcvvkg-cl-g~>Jj#f_MbM|pae29)cdaGA_!WLIn)ypMxf;GEz8EhcOw;?Q*HU8klt
z$B+z=-cO0h$))_3!&|dC;()KM`!n9X-CD%D`}_4C%?iVABA4|-#;*&Irq$?m4`YYT
z3moX%hKz>P$T=d}c4AFmc@2l!J@3ifU3zdBr;wh}y;i^+8wN^deok=~IVX<ON0+zb
z2P-V+!rD#=kxJ)1vo45U$pQT+<G0|(qQMxUivQYejnsMm@X&U)!M(D5qc5#qz8+pX
zOZ3p$x>W6OBT83Yn8h&R(mbQvMj-BdBEBMbOAlu|p}MR?pJW~%yc&%h8zM!rFBw$2
zt`d5_do@2;E^x)q={So&zYEfo(E^D%ULUQVJ}-~ER`jFHEYK;ICT^*1K6yR)*YX}R
zqBk7U0X`&tG7MEH!}LDLSBIOwVc}|^Ksw94kbX?AhQ-6EQgE7S6+GT1u6-l(i>d!I
zeu*wx$n-P0Tn!a@YrXPRax>(x!y$0PyU}{JIy-eb9>r&|zPpf)$@^VAl&LW^u9Pwt
zCi?x-?fl3ePAcU-|3MK{yTN7=sTZ$@6e+AnqH)!M`q!qdTR{Fk4_8o_!oHN!RLV`W
zvu<GD8=Ovz&wWnWHfsAuFsd-rDxj43ep%Qse96WwA(|s&{4wzjBY9w27RjxLC*8x=
z;q-_=W_C{b)OBfs=DKY==kPc6eoo-29d8+U7v7K@pSnk6ogUY!5@-m`_t9yN$Qij4
z<28Wi9tx==xb00OfR?JfFF}=ZY!FTx%M+I~-bX<TtBpA6P%Hojx&67xWR}l+I5p=b
zy0I*M$WI&5`9$e7OQIg@8{#DLx&asbE6zPxMc~>enEetl7Jd+n)6JN^7y*h$wQQHF
zf3zw8*cr0^gQEKusg3*akE)#l2d(-+D(1f-lT<qp#dxXw=px6Dt_Fd(0MP=Jg-ayO
z{>h>HA&dXcT}!(4A|zF%>kBhOLHuy8h_?P5Pf{l!2b{)Rau9UbnLeAk&eXlmXSF_g
zPp!uIq@)W)%-UWjp2@5byw@VVsBCn!Jrnk`w$b;ezgJl3-bKynfYBx@&A@`+;_FN2
zu18`pcaGim`x`J)IsYZ`#Q)^GL__>?oy{j*KOkv*gaq7o1iW~i_WE-PqyoQ;b49Pv
zV2`iLnEv~CHG2=|y*e*^wSFsZiG{94-jIhd<cV@S7@P453@5w@&|y>|F4wdwb1tn?
zDi(E9e_l}30RMVUrb_t7SO~9FWG<`I9ISAzaZ$AJR!)~05W*wANmPVYxdsV92xWZL
z=+AXF{lgN-Ns)SHXSU)i3N-7VBE9CO4?ZQ;Dg3T_^2Ye~v{u2C0ghXKe$#A=#`X_$
zM`n#1shZ<Qw$w&sA}Awqy44k<=+yCW)#J9yf%Zs*Y3XP3N*o+;?)AXxy=Ppc-+nUq
z&i15LxaIZN_pmk=lbRS+v^ZwtL?(q#l(4-8Oj%i;(E8&mO;+d5*{>dtmT-uaK2#qE
zSD8=$37M2eYz2Em7E7(}W9<fub$wJT_UNwWDmzaohshgZep%hV#i%p^#d(Sp_x$Vt
zl3#uuYtzNVZpTyQYekdRGvE<`)0Va64cIAgy?ht_78|lGJkCZB%QefP*h{(-FAw}~
zlcg+oFe`yRr`N6@KG{=LWW?{D`79SQ!RLALN~GV<<0p?7BzkNN88})j#cm~6?C}e~
z4YKh${!M;byHec4kCr1vi$uV6mA7{9|26L`u|Iq06!+zZj&pOG5sZK+XlS{0Qu&8X
zO21|L6$$i7SD>~zm?LNCTr!7!Fq)R)WG2fM3T<G_eJNYfUcH0|M?wt~i18a8dvkAm
zkOCtFN4JxmI*PrfLeqb=a8<x4Z+CGm*u|}jmfmQ-oU^(ZJ48?=gzPC7qrTfkrDSO@
zj5A|w#;LVd?`dRWk=pPnD6GZYXTFl%k9M+&3`lmv>)3DW6dUjfd(JJ#AhU?Yn*t@Y
zqad)(sDR_`Zok>9(|x>T-pYOP<t$wfK5CWuv6rcx{7Fkl$yG^|79ViJZ0$EjMS<u~
zDpqqrIudCvSsJ5`<3Evu0Xczw)jw1w;6dnj*fR{33vcEmq~k#;)-&QV$E38UpZe?j
zLnQN<vw)79#?+Zyhro*e+`X2^9Fb{K*EU?lJoex0x2I(XK1e^$FIQfJ-f1d&`|fPL
zAZ)PI<zWPsO`2NizC>02!DHL4N<FwYgS$hI89q<N@;I1}5m4#WJlBq=DK~1QI$Mm=
z{YqSrs9V>&=fO$u$>V6UH<Ux96Q1K`-MW!qy%lEnH<B*yVrTD&r(hs^sHelak;HXL
za2Hr*(m)u_oIymeN6G%{JOtGz;UUx4yr-1Jm>at4*9e6JxKQH58P;uO6PLeAM0@FK
zndWwCjnh7soHsA^gE4#mwq2WL8N9RoVgunp!D&D2*3Y8+`Z1L13Bf;vb3^FjeEHd-
zr$EZEXU2reW%Ir$)m`N2;iT2PI`;$737Pfbya-YsiXYur+_=_fbIJiuhk7|pA<jgs
zMxr7G^z^A1%c)@=mm<DsB+2Lk&cQmaR7}2fIm@qkTEmJQOVNXDT^A!hQ?*tu_ZR90
z_vI%{7%y!|yjsqi5zE%1oMs}rs+Kk3b9i`4+_?R2$r(tp9h?yrVCj}i)<_Q49`n*N
z6zXsP7Dif0L89r0f;}RypR9z<@mbH#x@*)p((fYG82Md4SQ|8du4>yJvyX5Fo-i|-
zxpF($>&W?v^tsE}^Xq75!T`;uFx{ivu?2%f{EG>T`nF4;eAVudcgmj;JoaUOIiFEw
zS`XK3!ZtK)o4Gwi%i(~CJD0(&X!Tylhc$)lSoVU14@0!}RsVv6<DYTG73Y0<ED>>9
z5m>s$8}n0OUMb<^sarGk3WpY{2IfadT0n0R>vY5My3eCmEl+PX9IaK8VF6^t{B=dR
zNMR^gA=(k^R?ZRb{+2cWfon~?+pQQBmHurZ0kX<$W;(4!|D0`KRkt}ta+pw73RH+A
zK2X?hT~?({O_y3W=F*!ODs|ncNO?!Ixpr?$i%<;1VkX6S)Z%C~5i1c@1J->{j0^)2
z0SK>T)EUO39+QrmN?)*)YbSmDQ_sdJ_=QU*sp`99&G!MQq-wqeoy9Pu^@7LbsB<~c
zl+A?i9gn&3d*;oTVj_trdK{KXEQYd}RQ7>21Nq%Q^#)+s%RBekc0~;cZ{-=3i2KhD
z8Tt=m49P19@#etW1~)HnkoiF2<i6}gzVk{wHXpoh&i4378nRebH)VsJ1=B0`CgZsu
z3h(rpH{VqGGyOnXEERWq*Zu21aWZC$wI+oUtN90&r0W8b9AgB`nq@YN{`Xuh&e6IS
zvP<n3c~4*CRQf;HUEWns|Ev<Ua27q9%cc0$=PV1<zK9@b0{aHf27kKqPx#MiLG8s+
zs@NcSWt^A1HSVww{mNWh&DElQqv)dFQ5L*?;oOcbpFQHrJ4f2ma7CU~a<bGdQ9lA;
z;8uJcC94>fPxWqoV2KMJ=n{QB(aH%}<NLnB!IM*D1!XN)BObs>RE3qqzRgRTXVO5U
zjpcK(XR2SZX#A~Js)Igy(8Zyv*fUK$nEuObfFkcRxs1_^J)b#E`}MNNjrn3cmTMEb
z^h_hh-MI!WHMBX~-?Z@1#A|JLxzk9ye-|8HS(luxjifYlKi&X0P%jZ+Z-ws<57ujE
zf$HVw%NG}P>mj~0?V7soiz0KC52y`F^68?>CA(V}mO0EQmQ21@((V5I2D?_V^SL?0
z!6C08s?h5)EI02~W)IO2+8_>IC|<e@fB&tY*&89UunB6JWm%#Wxp2(S4ulK8OL%ah
z>!8zbmXKFs-yQ}Lc=pjt)H1x>Fm~9XNRYG;`rZXNr^uI+Y{I<4KscBn{Ztl&g9TG=
z!@;-5zdf7TQ-Y4jPZtW<35K`<5hjq11Sut2_;{8LO~*u)-6q4O_sJZHs|)G3s`oS&
z*PM1rOf7$sv%?7ZvvK8a_(QY*F!rWw&M)R#4e8)oz-1ZULL~6$->8d2^Rx?6Vg8hM
zN46>a{nyUhwE?Wg{VoyI2;MJMY&UBi_)+yl6jT%(BD7VS8Md`p7CIBSj^nv1kI@_w
zH!QYeLf?l{o+L?!9(Uy>{!>>{DMFRUy9{0jdO~!#&91!d2&t;2<;_x8g#3ON;D4_A
z%?>A~#J+#_#T?j1`p6`=6y^0ZcUP9TFOLnxD#6>>XQajUgiK!vIovaKEYCi<jq$KM
z{e7mu^d#)QygjnBI_LF8fO4El!bRH?o_v_$1aX@*y9DoUc;%EmPbPIlPP=g-SwL!)
zy#;nvN9ez}F3u9+^R2b`Vg}mCf=aRgV(>S4P~_OgPZwFRfeC*94fT74c7B)b9H7Ou
zL{#!1;N^Jf#y^*#l2wsJlFjq6l0OmMh65?6^cc0Y;|X0ygdd|6U>^^LQ2o9sguBTF
zHLskmqy^LUeb?eoj$<{)&gz=O(Xm(4DV+0}C67-eb^iO$MDY6G)!gXYrG6c^gCHPI
zww^!D)U)o;c{MKK&uM^yn&ev5zn@7u**vI&&m+tbo2Oi?^Ip5Dtvx(T<V)+jo|WO!
z0`AL_;y>n2BTe7UcfQw6)5}wY?pD0-_NfoRok?kmt|{@^$b5k+_B^_~<h0@?jqqO1
zl}?wbFjb=&3kB6G-lzL6tzKu33mBF-4F&7}Ij2nf>GX$kUmX3}()2wXk;PB!a{Q6Q
zEb;TmyCtRkNSUGb!nLK?nrqBBBY}@$0Za92;^Dsa`YT@>DpV^npq7A%5nK?=yXP6|
zkcd)tR52Q&b!I%Gqgk@vxp(ct(NDHiwZ^gHVB%JQKZc7DYyIVt{bTPdZ7Zh`eKMwl
zEbV1#k3Du;_rcPaV5Ip~vO_roO>#$@<)%s<!-of{n===tR_MKR6$|1>UjA}|b$AQa
zLa(9~lC<jQkJ7Ku{P$!iTNo97Z}oiH6vd9{*1}s3)-)?k*QmBPTX68jFYTD)M;U{$
z#qc(|2MYa|EXJGus-HI>EHEY)+JP4AzJP_+JBI~lMT8KC?4@N}{3Bb-#_qB5a*L=A
ztJTqj7?D>KN|D;mN?OoyXe8_O+hCc$vhPy+P7%}M`q8ge($Fug(5$K`yN^@7YaPYn
zrTyPke){DQ#7DtyGyHxt+}bb6tjxvz2MqKABg4FpuqZ9qGH`7_rfdTIb9V_X{LrW&
z$Ku*vdDdd{OA}|9eXOGJ9uCd)$ow$U+5Q9Oa+1Xwt$1XHc#k9jhwBx6bmP|2D5sB&
zkJ`H8YhPm^?UfZef)4Z}EIrYp;J!{^h*NpBQ>rT0S`aP_=`6vS4pvRF*fN>Ad=%ab
z#Tc8%8f#%};yNqIa&R1LyHE*dsm@#;yIc=Fo3oGcw((%zRxL1R*=Bmd<y%DT^MqN)
z3s<a^dgSSMbA&L;?x8OW5xmGnRNkw>as0_<;)#Ju>g(ePs3d#wADjBD6@!al*X%v7
z10JKeKZS#j^Ca+zFs(heRq2ST-<)D!m)kt0<<TB3<div^xxQM@J7+zXYWzOA$SJFy
z%fLjtfJawmZ28DbCeAabE?53n>E76Kq7u0nPN3=&$xPPPj1I|t?YuY^+P-(f-nz(2
zv<UR)B}W?b74~SaMiLFfyKsn1#cb0tKUU{`?3UUrTuhh3%Nn!ESk#U$Ov`Yw`5Y=g
zZ1Hu<)agOmDt;*5=)>Qi140w<#VxY<y3EVQmfW|B7Tv-=aNx3NFp~x|_Z2ncitHNn
zO50yXYS(dunJHW&>$;y-nhfL@I#6KuG=9M)5H>IFVyEz*hPSKrpbZ%7+N%E0Aa8zk
zb^f6KBbEnvI(n~Xu`aw`r`DwTQDN%d_dUr9x9LZ<=V!0B)o^W&)>&B7F7~w2**hvI
z5}$!6spiKKb(XQ`F%t1+Wn;q~s#nNTOdBOW;gu3$M9)q|2`s1ObG)*3@*)!=4B^P8
z9XH5&K4v}MuRo{v2#&VrhY3R!v7J&>`A;kHCEC5kiuHqeMM{htzs$IqvB^c==ftKA
zWX_l_=$m8AvrONA=M?v9lsJ@8*t+k6DedP6qtYLb*HSL&Q6@qzK4HtMxLI@$ei%a$
zJ{LRYOLI9jkue+H;XVZP-I2BbYr?#mhN=5u9i_+R;m9}kC;C3lkMlc5WrQEj?-7%W
z>Wc1vp84{)9@nLnx8$QS6B6RlA2l9yCsGMy!V58{_^A7BMT}!;d(#sd+ui2-A;g=S
z<;E*waZGM0t=TVi6m*5!cPB`DlK2e$?c?PaBHH8@P6X}Sa2eiUEf6yh+pju=mp*l(
z9~yT^x*R&OVyVgO7iBZK$Wto<w_R(*{{rmM!xGS&JejBuHl}rz^PImpXr2jtK$^)s
zc{gH1751a}T(`()G^vMMm)LHQ$t0NXNa^})SM0E_9epq%z`W;dW}T@OR`37~e-%gn
za6~s-C6DL{&6^Z%Em~oEK{$jsR(Kc7*3VC!@)^yEnPrLHPZV?xTq5aJY?frZ*s}2C
zaCLg($_G8rkrEOX!_=dno^l!LCIbzTe}?2=*uXRJbVr*TVt@BRoijFm-_!5U5c;Dc
zuF??Izdu7&^nQ0$<8rxMtodN-ht3EZO`12c>Z1pS-LY6WY)5tzKI=e+E|uGsTEj9y
z?#ofrXLZMcG8t97D<_ZLVyE+jk<x+Ett+P#BqOU7L<w}S_ZWXgIHahJGlFUlI8K~&
zSc`coXon-Gnsb!6x`+hMG`9U6w=V;Rd`as_V-h$Kaa$X(nmpwnp``u!E~GygB1SSl
zh1=T1jP_lQv5HFnOQYB$CBCZT{m_nRg)X9|Ua=)3X5n;6mmCS~B}Y7ikGab-n}fZ-
z=WA>pwXvvMJ%C4kPx+Q%=W8*!lX@Tr(3UtdS?X-Q8uc1$v+DmeCi}R}K<KY(PQB7{
zqD=~t`A~L`^2CwI{)JHJh>oJ-lv=gXg)VMh&C!`uT^R49HlGqsUpU0}0MBo=)0MOE
z*SpNY6tce=IIjz`MfQ)JyLyhB?MaTwk<j*Hq~iH(LdK0Vv}<65>~(dc<Eetf1R42D
zSFvoS%N7s!ez8x+>v6qlb4=zhT)u2pckIz2_ExawHgtVPDgD}8a1D8M{mFu+$LP+L
zWPEE3+x<$y(5UqMv2ApM0;7pKzbXwLGya9y#=)bB?Mw&C>kN*_%Lbq0PeGc|qGhcm
z9VQn<bnFMGpWzTcBG_Lmoi*?|m+rGuv8>B=xke^XB<W9Z_74Ruyz61Gg|&7UvyMb1
zH?tcDJ^f{jZ8;Q$^YG|wlLxOyai-u>Ryp4_yZq;?;e-z7^=5}IRXvvo)0a8B#?`#}
zY%_~hT#B-`qu*!o5O4xKJNWYm!Z2Q0ZNi@CnF&+deB9rPUJWcIv1|}Bu`yGvUP_wD
z^gaBdJ~rGa!T;iZp?;OwI08fLXq<!xf5o)$u)H)(prd?owXe7qi>ScW`{Oh2oyb6T
z(?1j+ZPr}(Xj$|7Y#+6uk~tMl^VL))GBOJBk8f4ze<>%=z)$zf*a1=D^9ROygQW-4
z)zY@x;A9XR5X@KCIl-ibd+@j8;-}8NK|e|*rgG)zr?Jw*;##L-utl$tt6)Xu^OJd;
z>>1C*tF51GhqBotss)<@%e$?l3iFg`$32T=(Z04tqCtckiw0to7WMarGBFih8*41;
z)HexY>UZW?Vw+VYD~56vMmTUUc3ZcV2bS!3eZ<3p=@6D;cZk_*k_>4X5`BT%wZ;n)
z=D@;B0Qron<H=Ey(C(ebEVDH$f25RhA`_&K)&e<n6j1TH4qpp43GrSl4OB11T%eBG
zHF+Q-VR#C@1RkTmzBs)zO=7$KNEMmTH%q)}E-|7${#k;<c#T78<#Ji_7vs-`O5VWK
za@F?(9q2t$Oa7#H`>uYc^5jc_eGoU_e)#-BHR^VaHebnxPTs%kH#{4^eAXtGRqRGn
z#G*H9W|E&erAwY?TIqi{8K<p&_x0UqMv~h`v%q5bfO0uKhs!p0<<9hZN5p~x;cxcD
zNcf?;%j#2Na;Bh_nQfJNKA(UelJmsm*dGUe1}k1W9tagw^`8>4T9%BPjZD?rywlmN
zl46k`y@zQnJU$mGRC|#y`PpzJ-|eE==p9Kw(}~bGGHHy)Z63U?T|B|RLAi4qO*Otv
z{||d_85Y&s^$iOmAsy0<h(RMcbR$yI-O>$1451<=UD73}bT<r$NOum6(mgcN&&mI~
z?)$jk=eUpe)ARBAHpgZ&Gy9yq*SXd&){2kydRf`NZ%UlFv&YVm*5wb03|}6oX{X*K
z+bM64GJ@9T7>S0986+?#3Gc|fQ-jP6rg$XHxO8PS?`-kr@7367EGSXcsex{OUp+4?
zy6CispG1XzqVyI?;#M$Q&d`rqT`Y9*rC)y%TG~^3w&WqqI;BUdc`NBIu#;jCcn^)w
z0rjik2$_s*gp1>rcetm%yAo;K3Qsl%)-DRvC6&~Z-?gWY?{QKFeTQx@+jYogpcMDP
zFc_3{o2EBPLOHx7i4{kC_m~_vbTFv)k<$2v$bE_46?&;=_K^r@>|6iXVDQa~q5o2t
z+;}}!%CgUs7GJ7Y#^WF3A}E!bef?J<rfUx2S1m;X=!6&y=ji4H&o(XoL^`CiBP@KY
z+z?u>8>~Res2WFz)|)Qg(y03e1@!s*>PaLv7(NNN($_3gR#!=C9}OB%O7^0e@zh>V
zH?)v`x*R*8Kgm`1>3T5BGYk6g&5D3dr$SmyXp}x{MT?2MI<=gU@sTUMY4`f(YJA+r
zTq*-^W;LEGP}heRTk4Rr@os5eF{*Z>u2fPx?G@4FWO+$imI>9K1;Cp520sw=>_?0Z
zX&Igfhkpd)2ju~gBt6vk`fPAjB>^RGJ}If?C=<5#)zi0iMv*L?DK`8xT?7&bOa6Nw
z1v7yV#f6g%yGSX9ONZ-T!uh-bZjVEtB!zj2;dgoD>&&)A7jq}|%U#$z&j#b$y{(cu
zV|>{#VNc#O7Dz>3)DF=r%4GtUH%qTy{Y>RG-o6PiL<%g5MX0POM*Jm^$3PjGbus^b
z>8AO{Zqt+2bw6jJ27Ex@8-#^Oc(EOqL}&c~CApiDe@Az-deY|{^F`OiJ)WeAzx;Zv
zD_G!JjQL@ibYsYCGdI)9y8Up`>&Qd%tE*Z7q155X4drV(u>968DEsmc-+v?oK{e4f
zl2%ZY#_M;R5w1+gu2NHTc)*qS&H4Al;`8Uv5?23K8<N5@(y-SVp#DLnX*{daA$JL_
zY6WKf&RAo)8$l!J{H?BSq&9G$h8IfDZ`rTOXZ_jbV||WO7DG!$>C{_R9RYo+g2gg^
z_p5<foos*j+ndHn&7ziJyA-O`>!&c>+9?N*?GZktumKBaY7~PviUq#thAKSQ(ojV0
zjc$oS1EV`XJ(qi_cAa$>4VMNjXSsGKapb`l1K+jjE;!a|1m=Y_lxE%oG2h&GSN5%O
zBqtIw8%rI6IoaPAX#8?V>U)aQ_`D$3)nc&kS^l+eJa)!^&K>&iDs0+gXQJa$7m(@D
zAiu^c%LmFL$Yyht(6K`1h1%%INy@}L`?EI1IIQJw_L`i0WRLwnis7ZcbX=wIP22X^
zGA#03x#~%mr3`uX5#nfESPRN+j#8XL=wx7Q8@;SALbJ84iB(cPck)r&({zxJ;$bEy
zy`h$JogUD|iC4m;RPFQ7eJ5zw$r#{S+l183Ut91`Qy?mM#O@&qvR1D@G+e%M#*;uK
zT6DQ*yp)x8zp07=@qyaj;pR0}wCBe7+~bpg-5?`ZHJrUxP`=-`6a``}zbyb`fe?Lz
zI~x}3Y{7GZ7*T4*#TTzdN+aE~d@i_dYYp+Wk;$g*7*AcGW+7n0&%_a*1v<H2O=+1{
zz;z;B2Z$E)sg%401ve*UbXS+I&U=Dn`KP;|plrCXkSS!&*E4pls&$e@4^1dT?7aMA
zc|W@ec5b6n_6@OBOL_Jv_g@0KKWAzdeVSrnEEg)HI6d22K?~Z(n)5F*aVQn^ulJ?i
z>h}x;VbdMs-YQa#*LkdiX<Wk)dg#&N(1}W^<&5tU+xQZMuJ@V#xizK8+t58A_hj{l
zH!9T}WiX<v1)2wKI9Fh}qM#B?tzb=Ef2st9HZ&nc$h&k=JN~S)IqL`u)V(#S{GJ6)
z)lU}(4zH>Cr-E0^+{el#uowSCt$1HHQ`q**%Vc6Li!vqSvEdQ@p+?<&Og~5g=xzF%
z4$?HMdofO*6x2HlS+aZ|FE<KqPUU<Tx*S@EeQ&)wEwY`hjlId#cW{KYj<!<sukqc&
zUbDAcY=zqn$1s{FMRY$%kD%nzrOE43VqR&C5#Dj>q<?eKSckU_7^vMe!V)ksq+=_Y
zkf9SxkNQ5P0=?=W+S1lrg^pU>hpksz*o$7w&kd8^<ilVWHddA!hz+j5iLoJ)Td31~
zWmV(;&+zM=cIf>xCs}Ip`Io^fhC*jrR+%nQWRU)zoVoHygcHS-`cPRh82a_I*CaaZ
zLD#dY`S7Q%8<y1qB-msOF<z*rSCTD|f9h>=lusiOXcP#iQTt_`ijqrqoF1`r_pe*y
z4Kkg=tpcbS)KeW=>Fbo{ZWOJhYTK_SR3U}@QLnikgKm<34>8|s5Q0EBQVc(xY0`nq
zv@iH>dz}21QcSeg)+k?ZX}vWqu^q3srhWOmMTB42;R0>f-p@v3+zeqjaNWb-C4oV+
zw90`!Y+1_oe5d)S)W`5=#=@@0w*MRcNjTqg+sW<Yu&Sj$Pte{diIc+k9mji(-E7)p
zYN(b3ju$RJljygab-hqDtm2<6?<0V+n*Uz177{3BbLle&$tIp1bE(8VRLN|&E~BmD
zszK}^2IcKcuS2?-<O>w1_LyOLUG^E-ckB@lb7?iZ1(Z35Mh%QVkYd=l;oVi<;Vs1k
z<({K#Ve)(|(oY<8BURGYQ;d^Rkv{Y3&zOYl<@d4Qf0FwllQo%`5jea%4R0;fJBdga
z@2i(6;=`Q)1>Y)(7^po(+`FgDsJzja!w9|07HBFRmC0W-tyjAA|3G27)_0iYk8)36
zmwO&~|E?BK;<krr*Kpo<oQ*MvNU#)VCEqdR0D$ZRr!F;!a!c?EC|fn6MQi&9e?n?S
zmV?;{Dsg*qg>^p3Wd<G59g{WT(T>W&54W&8GMUMCd>(irFe&4#c-~e+0<lR4N17TI
z_QZzvaVec=JQ9OYmr#sIc|SgwF1hxD6L+OK!AYTMb_DO<-A7&fO41cGcPe>v%o7a@
zPB4`bTH9D2ujtCm_uTO-pBju+(*wi4_w`DJ=*Af!bg-qz^&8a=+k;zIN8zNg{^zUf
znHV&X5<$_udg6(9{_O)cTvD#Hv(e<Ey``z966wCl^8=PimeUS`<iCdXp})FGTa25u
z{AzqOtrKzry9$}21ZJAZik+-Kh_Qd}gglx3z<0SgnOq^ogEO-mRACxr_F9CL&0wvS
zxX3slWzkgRuse4G6lid3X7AZL&*-@MJPWRJtaI`>Y_ZMc&m^LMO}r=H?_8gWsYX)p
z4x}ZM1md~;Vhmq;-Q5*q0DUg31M3<jy*X<=xlu+=F9pqC_Q@n|(NIG!>MZ0ur>8|&
z$!TKz+dO#Lal@C4A;`IKjiy?e&gCq>(=cei>dMRR=$KXdEbd*<FVyyGielzqpf(dB
z?fsdYtp!YTc;$Zd;fO<x?0WUh;yt68<+T>WaWIqID&fb?RQv<J%Hb#E4@dr(7~O3X
zVDRi{`Udvsv}+&RctX$7xMS1a-h7<XQsYUHH=f1^m#PeYhfys<ABEWEvXkxG?Ols1
zFlNnOp>m-Lx2L@s@rmW<TQ*y{(}K#kv@XPKQTN&{G4mqcm54zn=mM??d7VJ7%lT=$
zvR6Le4+L*eB}aaO+Ir;-w}Z)ZJqlhEdw~M2-D+6Rdc!@q{(LIxIrESa9P)hn51%q8
zdTgB5#iqpa#cwaObSt#6><$UWbSe7tf5I1U8Uz*==YkC>zPV7Wv7h$KRR67Bm|mJO
zcVkH7vq9*e@N}ITYIL|O>Tn?-B6k$Sf5RC3WXVv!lX8c^ea>nzT!^pH2B*i;Gvr|T
z?cb3!zE(BA%U#Obt0A8Xa~Al9+6RiP%5~+RYhgQFTsS>`3Df|5NEM%Z(9PbJR>k{~
z^<fH+UF?kiC8Glw#`@C6+{aPw$7CU^OZ5gHM)Z(i?zN%NeBPk&kpa^F{IITi`GTFo
zZG${+wpt(<4C{~-rzSVPsVm~9cABw_=L+-o?AJIGbFKq`JE@%9(!RW8ZG#iXhnq3D
zzL>{MftAnqGgiZ$T};Ql#N%z-J*SK6bKA4|(|uY5$ZSvkgdnZ_s=Z4EE{fEaophIF
z=Pi60Kj9z%9LPZLXH5|@@3h!oVU#uqLvkRfC~*hLF*wie5<NfZ+~AV&NqwhX5u=Mb
ze6}WSzxpK+k1H3J0=E;dP?rxZgex?o*=mtyX{3o=AoH`o>Db3c!Td-VQ!(*PX(m4d
zIwQDK8^?<tEp`x^D&*jsZzyif=r{6J&2*e+#b?eXy<Aw)%@6E7vgvjNQ`J}`Gf9av
zeRJAh;io5)_*Z|I&$cqZdKPLM!(_I1ec<0t%{+QKwEw1gy}J4xoa8$2v63>2Z>TE3
z(6(jU!|hx8Mma+p2io%|?<Fs*OLwS0I$lEOCsM33wx^}LeK1@GS!+#=fwE~<XSFP#
zfz{lhvo~5hpWRTu!!g+wG5H38$X}i{LF0+@u=Qk5&E3<h9Im^?>I@S~I!h>?h}j1#
zS+FNED<i`;wk<ox_1H7QFk(AObW4CaoW~Mnq+-TIQMg$ibM`$;5*FHK|4X}>$v!Dk
zqh8e4kQF=mg>Q!DPLiF2Qc;#Dt>l!iVk8>$YHs&v(!^>Rysv{1AwH!E7kyteu?`sw
zb{nmwSZBw|S%0>+tXZz9^@3ywFB6AA_Q3%)2ki<o8ksFci^TmwN(4gfFaXPL(zhhF
zu6Uc~2m_ViDc!$=CST<)qP59qdlzw3DxIM9(UL@aJy6JEJ!2qdj*rA&$20UB8nmeV
zs6uxN5~p2Q9X+`=ZKN>*CY^*#^>9aZ+}joq(Pd(=_rz&%Oi~zZm*jJRAAYhsK?S&M
z<?YRx*bMPH)7Bq3TGgz8n}PrlFI7rpvWl2~0Z=Rv`X+e#yCK`QR^pWpqSpH}3Nffi
zFAsKPs@iDwuH`RG28)}<qab@LhJ}diMr5^gdV+y5yw=l@bbm0D*l~`P(4yQV$q;(9
zbh<Y-&5ss~4b{h?n2`%>Psuky+7msJD?OtdW-2;L=pkPJ3&9QL->z789O!1JlRBib
z;~$2UB6{WNgr60N5k@!-e%;NBE}wpz=AHCw*$%Pi(7$We`faW<yJ^NFiKNNNxPE7}
zNF%;ehK>$t*M6A^7n-VLiauhC&xmDp$2m%8zAng->b!*P`(O3QWxBLx)TS&*+{B4N
zW0GiCyQ1hE7f++GNB)?lxcn;>OjwgPCKwF;6Q5w6f;RFy?bmNr4#yrAG<abzV@K0x
zdjp(I6{9DP$r5qo4NeWKpEKR?!&sEv^z4R$OHuW9K0Q7cHyL|Ek9`kcY)8IkfN!=C
zM019AFFjKFMOQ_YlR=16u-4(68~ZR`bmOI;N!a7Xcds0}b>`R*7SyUA1fDngEyyxS
zA<g>5PPSgEX&ZWEWL*q)9F2c?AhY=8rb8GnLLx6?<$Ko6Zh(2uNnA_(Zgm57ZbySE
zBOY3uOg6!MzZNkpU1>>1N&2+GJ5*@%*K;GS(X5iieW8G>u9eoIh0DT`+;10dGOmV8
zpN@n_V8j-Z?tN@^hsp!WwQEM~t+M=)3=MfH!Y-w>T?H%50b840$MwHe#a_S+Hvh=&
zX#>NDCVAYYm%zJwXorspJW(q94%X~t949K{8#jJ_aarUHk^Ty@_{J9J8^0T!pFi5*
zJkTxPqpLU2<&QnkPEerLYOT_u(W@??4T>Q-3LBxxrlcJY`l`%2Fbegf`x^vd{GT~R
z@YY7^hEzS4uoB^Y-2M#9<PGTBZUMxdLmHPm@T{{bee_d}N*)W1skdnk<5%8i-gWJh
zhB9BVjR4pv|IrOooIc_QEo^7ABp|_m51eDf`l+~PqX?n)pew#l3X$imW=H!=%^0Yt
zuMg!YE)q^a7~J8<x<jK#QMohqc4ty!n^<~NM@UPy9#Qc`^^X4U!7ra2ZRyl<cSi1n
zV|CW|ixH2LlPx2ae{c|paCorV7XuuTAiy>MJHYXwkonC#RT}IVZ2R_tibd9eexfR5
zq2?+fvgvcz{N`-!{Wz;Wp+>p@gCfL+LxBSnI-ujpQmeEJ;j0NxKKc81Sw-vm(y_WE
zOuw@jKg@f~S}1sh3nkU!F#5XpMX46q?a8Z}vjtcPUT;eMG)|8jFQ>byyubN;(L|%i
z_Uj66|41&&sgJ=9^0bL^iM^VMS8~h@v+QMSId4tl(~b47&D;drW190aL_5NpyxfxZ
zD^8z}Odmcs-6CGGL++<Ju;{jm-|d-SU;SuKSOOcL5F?$B+3$F#(9wrI--|s&>!r@B
zpB;_U!mfIX;>dSC{c+St1~ddxW`OT;U5(&#hpCgN_yVVlW99CyY-tP)zSRpt7R5pv
z*-H>LMY)}-Au+A9g(e;3-m$doDOAJ&Zoc4mrUVakLqx16$7jxaSXJ4oS@EPXcsrjl
z#~b-u4H@K#MDHybf-H9TEQY2vZ}~U-GpK$-5TI>>LR~`9rbWIg1I{QSZQx6U0rZre
zP3o|{`cLG}Uq>jb!R57Qp?7#=WA3fu<0Wr5<Vdj4EbL5iG_KJjwXmqHaIa&)1EWj8
z@)N85?_iM%%C}w|mWkYoUVs+RT=bv6FZk3c#I1o`E+pKt^8u!~Nj!^cDzP6QHH<LZ
zAnT=f^+i`M{tSS?YiZto^y^zoP@sP^9AmJ+usg%A#<C$3K2Q^gM|?Q{peqmik}Xe#
z`ZFB@@W7uW#7QmtqR;^?l%bt-vW+O3@hD}V#OJT6p-D`!J4He+s5Y|fCiAg5SSdr&
zI9)#a>>PybKCOr<yMXa(0@hJ%SCK>Pd+@@{kXW>vNdQvug4eD^tz>pmTcq(sJMl%<
zmKBA2{pw<<%RADpcd|s7k0SuMMxp5oOBe5?>Ns#5|F{aCstfc#YRZwn+7?0QbziB2
z-)<c_d&jd+E+8L6DDcq7(1s!%XM$IfZg*|rN7{-Uh0Rj76D^~V&-0TVC|_KDSfzuR
zzO;G0f@t(HFWw7a#~4QQ%Oz@3|A?mK>KGGtSsBSuuQF41Q0$8_=p9$#AQzP2ppG@6
z((Hv4Ii!6#$8t&5sPpILzzbfXMZW>JT^c4zmBPnk-i|-8)#u;e?kq7Xms{eEp-oq)
zP0}jd*~5+vmTT6uHp({6?kdCiCJ&u}lO@HW;7;r&>$6SlluIfBlRTpPURVIeJ%f(o
z!ZHmYIzs``)Lhd|aOiGbq088pn%8Ovxura!gfhX~ARdsTRDDx-_bL<HEjgXGG8RiM
zp0!4_RIF1^8?fRV@(e{??9N(+LaE=Z<U5^gm1z|5ok-<=UIhV#dIrtl<2^J+%;b~r
zeY7pc$Yd|0VD%Nw+4rILQ?bJL(An_r{UJep6eHf^H*G*TwTvGpI~msJ;{r*T_*;Gb
z`f@6f!P}<zzhSc&Jk-*QY6(5&X+gAQD@fK|wp@cpMC-T1!0R%aZ$A<~-?VgSr_qj1
z#h;TP{7sqavP+iD3{u-*WIQ6-^DXcR`S+_e;n}j?W)5qz&uoUeb3Fe*X4M^me?iB6
zM)>w8hUnK9l=mykqa}{$^oED0**}Zi`|K{|dT=$>Vu)Y%cRB)7>6(<?cQ{MBv1M(w
z<$Y3$eVo?|t>!W~3E6J9<LGqjX+XDx6TX^nlgDn6ve+&wM_LzMfOKS*z}#S*Ii`4a
z1lAplbzk;q(L4FTqI81O8?B~Z*j;qWv^=sMV<TgI!Ru(E+jbg)GabBA%P02)uYqt}
zgLsvL%&_p6zH)83>uShW%Vm;9_!kSVahU*ke*iujQ<>gL(1Ju`O&m=h7&qp867`Hj
z>JZHMDHu~0;n7(o8bUVRvh%u4l870J2Co3w9sG1@uG5%)$BIZGS;VUF;^wmEeNpfB
z&>Ww``&Kto=XH{JdO9gr-E`k+%K&}_seq32NcUkk+y!=H^KX~8rIRI>3cO>oE0yHT
z`sEpX2`kqH<{_Cr!?(U1P0XG{2#CO7|L2;8ui{8y(%jd&JT;Dc<?VR3dpk|nFC;?5
zzH5o7pKKUe{5smSdZF2+OeOa2^%qI^sTGh3)2q5*f(YgvaymZ&n9dC;eXn%`=G!6u
zP_pTUD&)bU%K6?a;uB#|<5SPOkNFWzKYH^M6v^X&7+9g{Lp=uBt`Bw_9Q(nQL^$?4
zxi^>^&Zw2~JAW&xTqlLNmI{o^8jPBKL;1uPC*4p1P5TIxYng}C(5Wb4pJV&76-afA
z3DpmIQ8neBL%(3I&;)nx(it$Iml=D^lK(`PhqPd~jw6*k#;Fq!)#0l;>^e`X1@87;
z`&6{UiGgyx!Dfe?Q$Bc_=L-QNvIsGYVRDa^*e<W6z$X7$7tdJ-&ypb}&DD67iNPJ{
zaPVepAxF#K*8p}1w=IAcdbORCZC9je8O2%l?WwDOkFJVO^0Idy<9kfTl7hWgzZeig
zzMLk+&-VslVA$R_23-qh@D583yN7})P0)>qF<2YAi!>xkN+~Z9o_Q3!90sYuD{{2n
z)$4yXdRdk+d7bJ<x0|BI@nrEtH#p0t4rya5ys^mRVB~iQy*(pZ{|s#v?JMd(^K-Bm
zp^N<GX3CF(nS9ri#{QR@6Zr>q#k@6LHnY`s#VuEdN5u!bX@CWtsoO4HF9`3fM7CJv
zq{1#8PR+TaENSA3<>K}aSm+7{4L_v|d6OOfZT~AxTORrl1=9;p=$Go-U)}G)C*7VG
z9|1&Q{<`Ab?+@#T!!>cKo1==Q!+4tElOgB`#|LAd??8I$$3u6~H1eHpfGwW}@iK|-
ztm6mx=P?89OAkv8^3QdCY>O_`5QqKxf9Ow%nRKb_B|^^Nm4;KxBL)*HDs+CF7kvkt
z`P@yzSEG9TR=p8;R76*j^fYJ&CpLlAuPWUzJBOeP>uU^KdBow=BbHV7KlQfLIz^@O
zBvkW{+h&77A*+^5RQRE}qj4V+6nm{CxA|~+s4r8tS5NF-(nuYm>SgOAL}$p)hy3xt
zP!^SwEjx~ax<!AflD`}GPk<UJffXlC!5QoA(l3>4{QdyzY4jg_%u=qf*jRW|kfD_u
zE4oA7P(v3aQQ^oIVQA)Pxg*aW{1veL2gnEbGc~*41|esR$U^{s6fF2P{#E<(cZPVM
znWFGA#Rc2}36%e06I-nRa0ej%d>e2&uI69-AZsI|yLr_S0H0f&=C0@TxT>dUX^)G;
zDYh@$I{lqnGEf<Q4A3DkVC;myD15g!R{f_iQ-<&8v#p_-r)N{<(b_QW8UFU+^E<4$
ziN*8CwR-!{7EOG~ece<@+$@qoSK8SsD%g##)Jx@z#eW}b-CTZ;<&*btgE@!C=S=69
z63`%gY;Fmg4`D|ENO+Ma(~cc`(hL%at_z<iB`+gUpWG_z)j4DXpZ_dTmf+PS*4D68
z^!^f?o^MEMtBIBcCG5|idaU*dVijQ`in<tXnYWa#%YzT_&xzaG@S|TPo{kv2g%x}e
zeG7n~m?dW{fNuZ70wqmWwvB3QO5@?DFNU=%zyTPM7e8ERDd#Z~l;qQ8ChyfANhN~f
zLuP(cff4bcso%b4V$w%#5O4}6E_!cT|9G@$|4fcPCadY%B<}KivI+7Nr4Vss8oEt;
zd!f;LWABp(yk6a%^Ua4PK@QZq-xqjiHb;lf-~Q<;d(%+3HQ|<hOT&WKHsfhe)L>VZ
z#TjzHs@&iUdfzi_gJ2xWZ83g<C&^Nv-}nYuh}j=TG(H8?psjE4qd)N~B88n%O}ueZ
z>rwohT=8!3%d(c!FO)C;u65T>JBAVqxS+F`cJ?c5-C*zuMfQCjoa1S<p^EDhffz3r
zPwgS2XnAx*uKS6N_)h=Mw%%UnuIIO}aJ2HDQ07Trf=YbeqG_GE`v6}ro$2Wp33^ks
zL&J9lTFV1>Nch%hL!F9Z`j5V5cg~&qWo7@xH=Sevlq6$5I%CtDz?O{^7F#~9(nPS!
zAn&=zA_|UVLo%UszF;EM)_V-(M3m^>QRcJN0{vUPR%6E@y5?^P+E8_ENODJ_E8B*~
z%UKafw0+lxGoR2LU>ZN5eF$DzYY}mJ<Zf2yd~^M(Q-|5YZI3l-g>*1L+-`NvXl@H(
z{H=@1|0v4seA#xd?CpTh*2Pv0T(0!WD`;!9ru$r7hhnC7uXqrF_vLYOA&o39B@uEK
zbSKR1;|0agr+1t8DVM3j5c#Hx9_Ndtr*XdL6J&)-v$Fn&hr_(Le+V%`XkF{$PB@4@
zEK?FHFmlZLA%EAqT6~G2vUb5FVFxgHEL#7CI$-GucRk1&O2eE@HOO`4w`E(F1++%Z
zLZBinO0>IzHSDC%)*e&~JQ0YKFd=4)aWdx1D*SJbFz!xkamR_VZ~(Ez?Ry3c_Lr^I
zlLIMBU)qDwTJPvfZNC{#y;Coj;XwwVWaNeIx=_nyzHOK8F^*{OC}m{r{#%pM6@RIe
zx{%$XpEgh10oA*{!9W&*;y>8Z&=C>w&0O9{oOmiwS&hz{CEdAl3-R6hy&5G@x@0o$
z7<LBc@6K}}%7DB@6Sf?c_qI}DG?Z*f??P-Cmx>RqYJbqdX}9fxp=|eu;0tcm=l8!6
z{Unw0=D+z{b-tD+CpsI|#f3&skoC^{SqE2YgWn)g09hp#v0Q!^ZGZssgS1VMVn$L1
zYgw7MuJ!b<qEatJBEieYb)L<>%aPjS@7}{Dj|kSOE13>JO}aK;huh;hWh&?A6y_<S
zFDS{wz8ntQYe?E!C@G6mV8p6Tx)}B9N=O1+9`&Q4T%upYUmPwY<Dm;3)VB#=8O{gb
z7%#XkqKN_T_SJTxQ6fE0@O$hn`mfMA@=C?q9I4B1f-u)gvh^^x>?Z@CNI#-sn?SJQ
zVAIq(BzjLa<&1oK5{(FryjLGEU#FMT-_F0z@NEisQ6D3F!HvBxwgH(Z$YtUZt(0OA
zvR`ipm#xZ$c^6N1e4aMZrS9*zsT9WMqNj{C`&)WaZQj~f$c#w-1R}u#AQoIrl+&=7
zEq^<{(YBRhmDL^Ub9KN{bmPZQNenuD6m5NeFT%650{cL^en(qR9b<KSwgHJ4Qga0e
zq*R^Y*FF|s_3Czt*_+F)8C>_9)QG~!#?7My+Z1nq+*eH4c%vh5$0z*Im-Vij^uNup
zoy+Tn+3L*2mG%sN0-WV3nR_3<A4tWqp~a?|b~ucyb4Fg~dx)Z04a1YOtu+lW{79>3
zPbdhjx}Lx%FGzfo*tsB$IdPJ<?1hbiR7=n5tijLw_zSs?X=>H`x`Qf$tL`UteV@{4
z*o<##^;|t;mrWb2FktJ>Tu&2%27xoBDmMY-C_MGQL1Pg7abS0VZCcuw>xR#?++WFV
z7sTmN{Ph|QJc=L0Td-sLY@5&H!pl?#QfnihdYtyP-nK|UBspA-l0@E)%-e&sw<4+^
z>uPxfqdFJ9X7n?<M$OEs@979_QD=-W+2ODEK(h7WodE8P719qbr<5kD3_qW=Td2^T
zB{smfgji+@*yQ;fS6KRUbw$FJcI%KR3+H1)!lkm&6ibU$_&etsE}xB>lw&3GXjo<|
zO1=m6Ur(DqJ9Nwk1l>?K*UmK9fc47^r`npBqonq98wFVP!Vu(HPYDSL>0^XYmn^DX
zawm=8t&`gvJ2g_Ko&1`G>EG@IBxJ^X_wo@Y%L2B#Td5+St8^g8WFd;Ce}Hf~UypYi
zR_A|p0Gj~VbA<IO*G(j;)k_o>z!yEC7xJiGV3qsHGbEBj%KCI>TxxLOLLDXw>cCP!
z3EeQ(Y1VpV8GRJHspouNeH1P<=t<4;oUXwrbz5<G$$q5)1MEug`dW&M@f{b6Gqleq
zfC8>=D2))y?56qh_?yP8*BL<kN;7?3mxI+Tc|~b-1^jYV2RH@*JTv!icm@w8$xlxk
zNMN-mt#&H=*tgDbTZ>|S;EoAWBmc!I*~R!~Tp=qiGi_(aA<fmbk#U|3D?>DO94Gu~
zl%j{ECs#)*A-|qCK1K>n@BH|vRkB?)VH{woOnmUK<S4cMR9dy@H1QP_j)M-X+xh(~
z>=!Rxw1gC>=L|d_C%rtC%g+d*;7qWS7+Qe}t7m4L*8S??#h=|j{F;<C28lVXqWeRq
zk|`j!TZ33wI0qhuf{Wwbtwo-Ar8UWMv~Y4tyfH{9WqXhRb(0lqBku{;;Un{3f>odY
zZd&liaxSy#UNOtsY$I;v{Px>!3)-Zdpta<a<B>qRFaD_d(rk$KT602uaGx`Hv-r<!
ziJkEsQ{lz2A``w=@IBMNf9}(`8JSSP`Ui|-_BMU*p-+dIJl;zNB_WB;0uq7m`q<&G
zcx?<;CJcmF2lN-n8=G8tu1$Tz7N+OWK)C``NGXur>TplkY5FtUO}J-DK1HkcH9U0&
zhP*yz{1%eHYUD~|p=Lj!uB>jA>0KIUC}NQlz$q{IwfV^uQU`%dKIDE}7kO#v;@pI%
zR4sA7{;ijywL}m4X3@V%R-|w?lemuczj^^Y-stJ(drZgY`wn!Wvf>_X6t)>FtP;AM
z!&dBfEn=%ZUJm7|`xq_iYkab0=wp;<A&2U1jI8L&YF_UNcro8tr?q7B96|5EZ8d4=
zznHC9H)*@tiyzMHv{>3Cbe7JDH=Ta3{%JgXpVPi_oMg~wj&?F6-s{Wz?^)2#Nh?4h
zR2Y@Pw-?MrHqa$O9YSmL?Fu}&&q>~orfyWVIy{)7a%w3=pBv@jgUsf04@&;D$7k<}
zF&ORr^{Yec)~<glhr+Ml{ybz}D!e`485i|Y+7Cea`T_Mhw7Qba1cT<;LuP$q1gJx!
zZw;v)4&4M}?mebTrC(a|zof~RjY=<meQVs(rC(i0B_v82D-)IkWc$()lt<~Dj-O|M
z>=oX;0uk?}UsQ3quScCky-Baihh_kD1kC@)FaZ$WY|RZFYf$VP28gBLr+*Z*0oRsd
zFqdAIaJ9$sqHHH0|L`vspCZ!&0eY_r6s9Y4OtW5zVRWZ<?mX7=>@MGxQr4r><ZqV9
z6(on9F{E7au>(K~N&es2R)$BZ?e{Ks#fRUFUmWBaKfBex&AQ#l_*s;gFy87Ey^anZ
ziU;A9zonrQiDzx=Spi@0gf>(;9EK0RJNyl0Xoya_4={yvEFhSW*`8!DdbZ%djyq9j
z%#WNZ-mO^Q?08lcQI?wVE3m086E^su(65Qs$Vb;|B75Xyq1mPUQ*HY<47x@+rB;XB
z_HQP0<!(uC0X*M0G@AAr)6SCrEvwP5kjsQ_rOcT6j9ff*`K@t;KFzsYXLjJ)@Z+yE
zdqU{__wIz{UC;8?KyyHi#emkyK$A)L8AzPxrh9xHyBy=kfv&{FQje`E#cNRKHM@SQ
zf^A*~2LYBc-|uXCvFYRnqwl2DkcRt9;>q7SVQRKPYgA?Wdnigjpw4$59~-M|s`aIQ
zJr9`ZcI_tiKa6fgny_Vr&k7xWLU)B~?oT4ReYuamT`rZY`g+@nD=F44e1~&^KfX!*
zur!`rV9@H+-JWdKx(4soVG=48kfQxE$GcC+b|BTMzu@`5v#}uCmU%fS+;NbEjE3*=
z-yrc0hToMcc0=KhY}ZZ75RsM0go6bNp1os4VHi*BQ@I;8wzrcS-PevHGx?8Rh=M_s
zU9>YBzOQ0O8l<g(w*TU=&sm?Y!D+Uu1)#cLZTXpo!in!PG}@2_I-8w<{K_L8=kHlO
zLjrOhlYy?C-P4%@T+#muhi=CHyB(*dx7lk0a5;y%`BS4f(d))S&js%>Wk9~6NC`f3
z07YY4ys%UEu;`X0Jp3Dt1;6w3qq&bJ4FeYO4IJ26jUG;E6{?C6gdN$#JHpS2Uz^!m
zhuHh>232u~jn&(*os<P!o3LotvaF15nOF+P5M$;g{FB+4B+v}sRVVSVs{^_5zhUjy
zZh``UO(`52pb|+LO6QfC_q>&r+Im{zoO5*g?)TP&u{V1A7n>*DrQ=KQ5g&orbVLpb
zzmaZQVSqGGOOWQBw%BCT$?ZMB?b)8RDJ*R%>~1f&HbSOByqmIS&!^&NT|w)|gRLCP
zvl+FAqP3plas5A`e-jiQr@W3M7&iiO&mP+i21O`8EF=|thAH%tu<TOvx%NqK^1$Dp
ze80)?hn6;{(O_*s$AqBN(%KOjuav<!NebuNvv5*De<gbV0$00>#`8<ks(CbrI`I=n
z>c5;r&$f-n+CFzc5fk;*<8&NN4$(l(*VD>|RZ09~U`8-<=P=QU{H1f=9RvcmI9x1n
zzu4`V2XZ|nB+*#^5MOUoLLc{h!*7P&2s3PC%8>A7{f*Px+|NBSFn)AF{4wzcqk>V<
znJNEVmbvT$H3lKpbK*OETZVoyOqAl~=FIuqnnnN1B9=_wm*yC<QfuRdm7%3&w|>oL
z9hW}z-%1)X&XA|GPGvMhtkd;W-lTGZ-d3f=Q`bMrZ$9;m@pZ?FYK^VcjN^-0_-m)u
zGhct{U?yA=MSD(*;<BPyw%2*{6~_@n<Za(y?eBOZS26*T41eJ)2>Y@ESK2v3?b4H7
z9_b7($wz`3OUDITY`VkEZIHTK_sK<b0Ff7J`5w2>BDS^dx$1-!NlzWB25ODCxeS~}
z3jI6JqB4x<%#R!xHg|*gq5f|^E6fO{ZSwThOIDG3>^$|R$?fp|!^jOptM3%&Nuq}<
zrFH=!pSxzwL;xd0Rj;`5b2<UYStl0drpt%20f+h90rx@%Wn!oLgXgy`g5{pfS0Itl
z>>3>4IX){aDpd!BAlC@o&}Lb{>t*9JOL)tgY)E{ZOH78hj`JU!;FVyUR)AHvpc$}>
z*Je3Xv(0+Bu`d%rGflf{+ZSm?X35gTuoQ`#-*O~lQN}46z=Rj`aABS%@{SvK)c@nK
zcgNaa7i~X~s}C7-DjGW9F#jX}e|-#_D0jhSzTV+0Y5FURP{YRDoj0&xs1q=#j4a*d
z!qFvX@7w^{FHiKDzuV?mQ|e{Y+7@NuU}WUgdNe4&A(lQr#l((>neHqMR|mG!8M14H
z%jlgfOL0szXwUiH-^uvM6vJCiN0db@(%Xu$A4whZFZyUsluoD``fPUcCbZ3y1;xEE
zjQ1^_M1}zUi3I5Nl$Tr;Fw*tMC!U`8Cuv|`l;M}nC&zTdQix?<x2@|&>f6C?fj-db
z;Q?M9eastF47(6#Cb`$Ab{yO1AsdmCH`hqI>&OTTQN_+k{kpAui{c417!!>f+YWz}
znyJE(kLi#LXg`3wh$}yoHk1m_?RKU?O``?rp{_26@9*~*FoMbA^BMglCnw;*kxdc+
zYU9WUCBRp;Y~4~IZBv%UGbHgZrK<~O{oYt(r5nK|PQ_RZ{Wguz2JVr4`!0xR%1Xc)
zK<7yci>0h7JzknAQ6EjNfG=q8B+PhN>)E#xO_R7C=Ra#v&*#+FyiEC5irwJCS`XBJ
z6sIiExkF*Tf8hI);aU$XkDGHcm|(Y<B-ah>XaE5ZI$+7r=(xmuDZ4_{^E!PhI)dA%
zdO5*D-Z9`~kJt)OjB7bGOiTjr+{lgeCy;RZDuVnh(^RFiyI}|I@qOPVhwGL2!i&yD
zSEru&qZ7vI6xWTAY=(xpm<On3tp{-zpsm3;mmFPDl<0*(K$39-(6s0Po9E@~F#h!4
zR~WB^$$>j1%E;G7io)O#vS&%*JRh+0y>{GvwSi?}?EvN`i2f(qK2BoMD$`P&2ZpR$
z=YzjbX*~jr&Z-KFBa4{>a=RqjEfh$;K4N#j`F9a<X&Emg;ba#=*LrgpF0?kae2o_z
z2CD3&?b>xZ!KA@Za`Aw}&8{sVpdW7Z`D85Cz`@X8ZZiBsZASjI{tM<s*~&rG%`K@<
z*KuLveYb9gkWF8{v%NkZTSUWibG4$Z@*jblV{1k8p0n+JGS%0>#IIS_auatkmKksu
z@#wU)y39B$$;e+BcjA62)cHK>nTpgQ4RlJPr}V>`$YWL`-%W~>oCP=xXuH%|GQBF1
zF1lMB*r8x-r)92ctvRW}?OIw{KHV|ee7wpv(`N<`*)=W|R|<i!6c1}|m|C55%x$OT
zZx($oP{C!IDsc{)hR_rMW7Od78Ov+2%PaGfp@34gkgZ$M2rY$1WPnZ)C2uK3|4#^*
zHJm9@EfuK#iJDS=?TeEW{G{;)300ie7VNyGkAsaa+D?4S0bL+&du%EQ#_w&W^_Fe}
zDkPAy#B(H(KszK{Bm$e@-H#^{;w@o9o?E-yna_?ZW?mEtRK@O3Y-wiVrNX}ON^~&;
z!;-q$Q^ya@W%li46xnoq8pk#HSqulFmpjDQXP)tSQ^?z!?-^k>(E(~X|1RN{=JB={
zWxn>E_>=<g<MZ8JT-B6Dtg=bH@MW~4Oo{O2VJ2KOK10;g<cx92h{{F7o2Uh)HAoG@
z2v%esEy!T*`-=L>$=;Y?^-u6Dzrmn$PYzJI=s1jgwrKpNqm%HfbWF!WIH}Wdx-C&y
z?WfLE=b_P#SJZYX<zH|7NxGtzRwvMO_ph^VNzM)(_WF?ZSWMgtxTo;^yD)y1i_^2Z
zAVX&KMXzS(afngOfdmCh1o7~az_|SV_m#}QU-8TIL8rf3%e6gSrv$lS(VfkwmF@*P
z>z9%{eKbw^twg4B8kby(asB4n;44ymbgAJD*^4r6(RzR!6)@q62`$gwz|WFk%RX(w
zu7doH6mNmrSph(NKltrquYOW%naO8j+bjW|voa?4RiZkN_#O1P#W}y8K)+mwWFK<(
z^+&`#SV)(a{X(rAQLB)t7Nw|2nbiG<%jf&M20g?JZ#6)r3fE&t3Ga+_(Y^sv&)%nu
z!7CI30-)|7k`(W}|8|4skqlBPMs#0A>{`F<cDlpunDyF#2Whi}mf?}M-6nVp6oEye
z<AZVmm%IEP^_gW=Sw}yyRf<fR_}G8(c(06pzq2A-Z_ci>s#Th(eek97y*{x$IVa0{
znldZ8|0D1UiSBJxW35>?g(|JSXW&nf)g46SLLVcFs%_*_0`*-K&RsH7Z8;ij@}hhk
z90A#@uM%D8k7i1vd1?EmXzHgeS>uzm+y2yw?tskxYmbfU5tqVeA4?FfN}Ws=b3Q7&
z`4{``(T6pfdm^`2>NA90;)1NC1`z>deJ}d}@`z3CC_&$Wc44!g%R(LCivFIX^+NI=
z1cWzboBzU;5q>?mUFg)hw>Ey8*ia&J;-dfwHO-suFj&LU_C3xC(7(tAp1l2C)D>B<
z6A*Px2t*Z~Fu(a`5NO&%`N<%R5FfRN`FAA;RW(msq}Z<;xr_EL>r2KFyfK!~f>ofc
zX1-?87th!M*#SV}Vh_~y>CSAg^;Zr552r2Axcz!RH~#F%_xf{7nY~tx?F89Yj1>OZ
zHV@t@KSk_hGQe*#&Gog4O?S9L%RT7Za4Y)VL~obWk<+m4$jc~^Q#8M3ml8K;;<4XS
z9kksWtAGvJ^zbwMpho24*c%FL5CaU@opN|t=@pnf$r<DuJB@ZDW_du)_>bYKjQ0MA
z=*jTQe{jpGCP$9a=h(nk5a#x?K4oDqspH{W!%)hrDu|ca92@OS?UdPaK&Te!!k-sq
zE!pV!o5ao3Hq^F^0D?L&x3VD5OM{&{IU|%WX}drUa_5>Yh(XDkWP=m|fr9HEp(Z0&
zDQMed8SF_JMrA3#C%MiXFzXhXjuH6UKg)ZqVPO^6W*ZnfOSs<?J<4+|Y8j{b8W<jd
z{u8H1ChZ>ptLn^OZQ2WA>DsjTZm)vW!*bwnbXq0-$!8R%s;x%p>%FFcLiTyRN3#=S
ztB`NPxIJH^?toN(<H7yNlNCLk7?dc!-Bgm<3WFzWj%l@=x#p~!#;{#xUT0@ydGV`j
zJ@)%7?AR3mduKkx7Uk%dcpv6A8m5`BBLKux40_DO*=-s4uW3vBNUplMhbjUTxfzq{
z4;Kg7?gw8smCkMsltu<^lxNU^>;Lgh!XyiRrb%3#)Z+W$SkQKZ#(tN;pq_9}DZBH;
zBjHMHk-+lh(?OlJ{>DDK;uJx<%0}c3^ZDB>UVji6<9Z$?8Rt^+S^rtDbKhj-h3&n(
z6-L}A^II~=k`V^@p&**YNQd~fpL@(gM|K{4(`xS?mzo5r$D)wCeK41|j={*&k-~EN
zCc7SX?k8wnb1M+<(T{>_(81PRS$r*!qDv1RFn>9(jakn3{4f_k3}jaDS)bJ}#MgD&
z$f%sobpMZ`_p1d^agrEf=uu1E#}>}TpJ3P_8uY^McbmjCd;$v5w=^sS_fv1~`xMqK
z_=_aZi6sfM!yi}Cfer)9;-hEV#=a7!oJQjfBLm=vRTyhRh!2J3Du_8;c%2Ma!UhV?
z0AGua2MXNxn5gZ?Q6D<3g&AK}^kE~@i&k#W(Q_SucIhs#t)^I-%CoPQukWljn=WsM
z54<;#XScuvHyIJuPV4P^+h65jf<t`(|CBi6Pm<O8`fpx@3E3A(X5=f2OJ(FMk}%g-
zqk=TsQ^{nB`qmkdnpxozY)}_?+|hJqt!*!71W{)10`@7%FaZL27SPTTRv?z;VWgaB
z+;plxQR}zd?SUJ#rRPk>!)5C<Y`r{H`7E#4jzZ8kZpJ+NwYh@Z;+1R(6YrT}L_k`z
z>$yz0TaGj}W?uA<&-#uzi1eZ3^oX@Lmr2In61Wt4z79=!kyS0PsY(5g20C%IUZo=9
z*Xt>}TxwdRdlT%$!`+y{k8DqgW^iiRp&)zhqvRLZ&WRdC8LOCC+WFlOWS8c;KoBw{
z`9FMA4=Dg<S*c|zerw7+<0(rKtElTr!6Rw}3ErBA#mv}-voR}J#CXtymdolYBG)<=
z)LgI0LJ&{TF1Ocwi2Nh(7!wn_?mdW9NW{Pt*SN*AOtj!g@_Z4Fg-yeUvkk7f2TLkG
z-}mj5Mk5xF2I2BGcC!Obq?Y?oz$9sTY`+{#F2D19)r531mNi#du^%?yQ+&cd=cT#v
z;c0_aFL7<IeyO*-DA6zCvMUT1phJGNofl>m!crZ3x$?~X6C=hAP!YXZFYu9wXDv*8
zF9QiBY>#UqlVum?JRuyiSM$XeS#h4ok-}eOO3!HZQps#JfmU>AK&hh`?!EtcrzXik
zk5Hnld-H{k+uH;~7w2NI$tmB(r|sHv(a&!2FsjN%CP#<^KW0!1Fzge$R+-CG!U`$B
zRDF8pvBzJ*$Bys()s@|)GL^qYSi3)rwHmnVa^;%#$UVt}KsO33<gl^kVYMgFTD&#T
zq+m9`)bL`%u)pZ9WyNx_&cXYIXO24dNIR&}bd)83Ghd02oq3qlCz*K9Uqu{ZWwH^J
zBn?bH49H|KUSSGWE3DHze6p*39ED4o2k`K%YV~laHZEoU$xf+fSgBsMqI<0j0YIRR
zX?n*CJR=vBF4ljWSBG2#Y66l?Qn!1lKFQdBau&{E&sAmdg!Z`6y=6Ke$^d)Yt^1@B
z)00ha?Ru7oBLIPDE*_^73|N5sgmgL_`9#gjJyd+^7g%cOI7yrWvt%VPZuN)z+y<`N
z{?0a<F+X!MRe;-lReQqqqj_cN#j&GJ)7#^s6{b}sxYT(}jvtdJBR;7HwNtuFXBIr8
zdq4!I=g!I(!;ZS7qe%K{omd*%ZlZ;oDNKNWd!Z)ldx|MCduzhBfXbG)TRy%|Az>sN
zp6xT=m~~ROz}sMvq)k0b7~`wm*TkexE^J*L_nsANbjWU|xb{MsW4MQ<ev5eh==GB1
zJ=7is)iOtQxZMvKpR?rto6KVfqV)Q^o)2;<z3clO=cx=~t7>JLd5n#L99}k15k8Q&
z=;#o4n@NBOccmOUOctmgMIhTnj@h|f#TH}2KcgSLjIVSR*~%~(y(7C9$cv{v3_Fjv
zCd=MBu3v?du19<dC3xxyc<8se!EA~BMe>+J1DINlb@Nbd{>7J5RP9_4@??QZsq?&^
z+$zf0wE85&3r`Oq0mAa1?b|aM5;;rA#CS$Y_wwNAnzxZ+?MmU02qS^%_@@Kbp?`sQ
z`)Wt$f<?b$Js&|LLG3-^*<_tsm{G9cjYPN`n#@bg1g7`@W*daci26Y}&Zd_hAjX|^
zuol<J?D}jY539-#W7Dv)M(c&P<J`fEq+_BkBi6%;%(Kn88qJD4{z=FDQuw!To`z60
z;Hy`w5LhZ!PM=i3gvnW^RSiMQrUDt+v)c(x>T!Su1<iuC#iK~sXW_Eh%x#iLqLZ%W
z$~7_7v&&(NS!7ZFO-utv%6;t9*npdJmJ`sV#nNLcMJ20cxIs)EKP7h$c0}N@krQH7
ztPpbpIy(e>1w99QId`}=53gmykC<hBG4sOT33OZMcD?gNG<gI)&^<fvq$(>MF%Kb~
z4HG7BRW;=44Eu6h2^2IKdw8NhAxSjDmbje<T^Y$0$`X#fbIVdd1OysE;3`oy>vaG1
z<Sesa2jJ#E%sIf(8XIpKg%*U)IVme0mjHPfYB0-gvo_SEQszDTgw=bc1}H!@DyKuS
zm<P5MgteCiN+*+&E7uRf?|c{Xr>cP!wNI<SKob(^xGu>0(2<&%O1GCXs2&naRrs%%
z`%L|R##}C}`i(J4Zji%S80z6We0O^XwS8{awnLu=>6?<OjePA&!}EFFed3gVNqC}|
zmuE<?^`><}2bo+^SEwR(Ic0!%ov0*wHhXptX_NqWvi|8>Zw+)au5$aUbk;x;HF6t@
z_r}<-rk6(thlkYdxW3!|bol;9*k;Cii+8(YD%zy_Xe24+Bu?G$a>*NZue<Q-v-~e&
zFMhY5c}#!7EeBcx{<Gb!L{(AgA>n2Fj8o5(5jnaI-vu`<Ib9s+v0B&Wyy<P8#h=NL
z#t7pQBh611-IS;VoOfxPs+4Pw3Up3ntJ{3MEnue~zSTFBNG>Nw@h6o#;duMix=fb^
zqwi{Obmf+bhWD?h*U9F}s+UO5?6@8}U1^eaKc*AGt$gzdiJ4H{mnYk0tr|cNW4wN%
zKAx+%+DNWI?ea^__D)H8lk4f{a}Dsx-NuaFHkSpi>BAR8usdeRAD^a3<g?b{g2N%L
z@xe$4v+_;~ci)eFluNo|zC|-P=J4@64)Ley?^v@*qYL|PktJr3c9KlkjbLbJMz)CQ
zZu1fQRvK>+yms*Ic;+tFp_A<4h4;J=Jm0d0Y$6EH3ijme4uez_CneZB`TojR>e28o
z_RC)nNCNXfVu6YonzM+4L7m^#qD7KdbO?WZ4Zpp1g3}iH@|1DCq<EUdH3*afkKf5p
zKSE(+hfE4%p|WHBnoy!h8qJ#a_Cxjwynn3+2B6^22(HNau>a|5E;4J`ty}P++FjZA
z=yXO!8(F$XpbU1dbWBe6SmJN#j5+Osri?^r^x0V5>E8qhM9$K&J+e+)7i5WsY(mm2
zm$h3YaBx(FDk?MA=Op3Rr&NLvm8jY8o?K^j>zOcbyByIGx5gm$*Z7B$;epb3{XBkR
zc3<QWtK=8+({3zNFp6IHFK+=yI;%^pn~sqyTWP6+(DaH`hLLBCBIoiX&>5FJmzGiz
zb?Iz%d&Z)dj?Mf}6{?`7x$CuPPs&0y+PuG{?j0%El&zz-egbCr-3oQzN9}q1yO9I7
zFA?IC=3R1q194JvNcT7iiYd%r9@}tcxP2~<{SPZETB3{n=jWirjydQIgXXlO%eRL!
ztNJp+wZ**COxxoNZQ6n)2d%fZ)6<OYzp_(R@xB9h!gdA6uOvxqy)nWa^7%q&&tC#v
z*UxtqlKec0Kr=)1`W}t4^RntokP`Ev4KIzq<b4D>gMh<q|J&hL;B4!5RaVT$3GZ}g
znVQ;O+8Z$Ce4RV~6h!Le;~*Qxpqh#HcF3R@I%8wSYqlbOGIyksXr=aiylQ0W;Y7Ly
zI_g(tlb$8HW-9~z>!mjVTB)?}NWT}<6xiuu4JRo<`*PcR9O+(RpdipT#u}fb7GK@*
z9GS(?oR<LvobgJo7oa~`&yGAEJz%TMh&VZzae7|7y?pZmeE)N_;Xf;Ngv>xI{9F{J
zx_+sSix<3(QvuiFPo*Xa{$q()Jp6?}mAVu-eHxr@QHTFEP<#|KJz&9DW0ueG#F6t>
zLn(DaS?_>v`Y^jA&3;VH88ZR<J;fMVAuwqx;lgXmd^T6t`@Z5lI>@nhk+Ij@LVG{T
zL@&$VdVAAU2%TsCdKN>n7D4*Ge5Am23-j)x;{X3H>PJj^z(WFgvb&!pM%Zvy*#X?s
zD+J;p@nfV3Xs87894OTSa0iuve;p40Uk+Q`ojrn=fC|p$2WQXks_cTZ!Qt@#<?ta3
z=*tyArHYCPAd*r{awT9eeWZ5i^6H+H>vw@39Mmut6Qft;aV#wbPw9bLMFK0k{ZX}P
z0Vx`NxdNehIDf&~mvZokKVW`Gsy!V1RqqbzlDWsWke3?%6C@gsV(tkUpim_~2V$o*
zYLsfPcsuTgV2jicN40i&V6Rb#2DG8B;9gTI?Rm-xKA;T~d_b{80Ul6f+M?b$%T!Lp
z0#~$d@`#J_YaN<=9{8S4vyAuas>kW;yaJtjNL~Zm1m|N8a%Ku}2?U`s_h_PmBBcp{
znI@e`JUnCRG0)w#RbXa!RFubJq5@@vI;wSrdb$PpXK{Kb)D7o_Zh0Vb6#pTJQavU3
z28?k6pMAG<P8N^ByU_nm2eT}xpHYCzA?OajCzMXc&Il}_1oAIY?%csFjVVv5(Lnff
zC-~<M92;2}Cjx(^MR6DKc90AMe>ny#HHKIlC;#Vg_5XI56r8QQD`9i@KHzJQP4A6^
z4Md(4e2xF*FdjHt&_O~0(3zMduYTM;*+FrSMZmZC&w~7CLGEsx|J)(}*OT<01^Lf{
z{3odXXP5c^?#BPwcK@&R<Ub4Y|9U|JVqS_re4yxamxbPCrFS{n|C5(4SR{=$MHOkC
zF;~%~oZ?G-n7~N#|LDE{>x+_rLf}vgbFXO;WkD@R{GkKE=w0gjPTUu@GX+DBHjCjI
z=$(N{B6*L7{Ufc--RpXWcce{!<k|1u;vslV_J7#>s<^1$u5Aek6+uuCkWN8BK)R*7
zyA<h^mKFm9q)QrUX6PPjRJwEMP`Xii7~;Ff|MR@>$#d|Xy(iBZzs)_c_w0SIz1Fp^
zbzRS+YtTQ>feK{)H6t1N;$1-*;o1{>7oClZfNWeOX$2GllC+#4-Q^S-1;ql<Yxx@-
zUR`nN=u2v+dwaL*s~iRTqdkl-o@G$=#7~O@Q(SN&5Fp@19I{eu@5P2D-FyQ1d3I+u
zEBK8)es)K(lP}xdzlV+f)8P+bbxcV1L-gN4uXYY(BLu5I+%Wo2hu?zLZ{@N<ujB^y
zqkCv&G#Ep+C75mlr}YOw=HN8`kjH`C|E(k)s3)Iq#FC;fkP=)VWz-5LSeH!%${xBS
z1#qU4-v~gtK_Kr2+Q_s-$v1@ml10(q9|QRQUMZ@f|H~361(wmQ9`G%AV-H(+Kj{H8
zNN*({fvV+^eIELwF)II5N!BP0HuQ-U)Bi2l3L(?QPrz?!!OC|O?{m<<0X14--Da`i
z-@~@9|KTtZSpA&hodtR|Gg#e-EEWZ;(P#Z14&MN)F)4!S!D^z{GJmU(sJC$hf1mL7
zf9l3A8wDlwS$zam>FuxbM(CfNK`G`e7<U`23w{oM{y5CQf&PpDxIlqNJvY%8XafGU
ziCZ23C1`&}f$}SgNeKN=d{Vx_5v3gE@%MQGMb&&IBMbUZx`L|FwI~(`{ZSr#bQLR_
zvMXJTes=Q00Uze2LMFtzunPS49axEPe<vK=jl3jqn`a6Nm;O22@gEL@(`&=G!wbg%
zt5d=1t+m1fuo`{V|KTtudbKTfIQXxU-|qb_4n;7P_|Yf(&v?sAh5w@s14alf>j;5G
z61bUcKoaExoev~6qZd@P`1HWyx`><g7Wj=3xXt!ync-lEgTti%=`h%cEO~USIAFCs
zSPe<b>P4>x+x$NrrUk3B@3CT{@2)&H8ob%VV+9tZ=-cG~&uRFF<e}?r4Ll5wze6MF
z8y*5~cnAXwy^a-ZMH4)+QFQJ7S{g)zwpbJNU2SIq5rIiw7=82iz}?t0h$BHiPYnP{
zKx?t1?*J9pUsTF&=!+%_1^X+M0#w&vcgMd)tHb^`fc!Ur{5OF7|Gshm8$kXWK>nM7
zfS1t!Sq2iU#XJn{y5R|!($HTFE}HCm{u;gN3@Cq)w<3ud#IZ+JZ>Vx*oXAHghqA+-
zXXg+DJJ!1M<9c)5w7N((`v-mbX11=d7wcb%rWo-b1zq$&RH15H%j)7<(k{F8iW78U
z9|8S+iY);jGhhC#xYK5(>hr<B0Q_?Y4IK1~_VGVCUEu`{CIT&R9|^F1=M5hK+uy**
z0`KhHpMT%%Fp!w_5r`22`99j8pvMw$A1!Z0#7YKoy1)OQ)g2QsTJ%6?vYLY1E!%ew
zS=f7l6n!cJvVRepJ@Bqi!5%&W)Ud%}3w_2OT+B_{3d=tXX0qj_fv&=ACUUhh5q)^i
zqJt%G(*B-=U#QmFE|^{ZZaam%T&8%CE!R_oDV+Y<EBihXD?8?qU0=8dQnU+=k*~I8
z6(-#azC01p$nad7wx4bzEDE|tb@BMJMT1=Wfa!1QysjK|M#O50iB>yrJc@%u0b5ov
z;C#9(ANACYOCNm|OY6VTjgIHpHE^zxCDj!g%no#;=^1D=Js03Y_tN<9VcPy-9@V%{
zf=N_V0jhypvo$(*Fv+o>3ip4DZ6K);bX9#GOdDg1Y3sZBjL^tL*rewH=7Yo=asv5d
zRkp61ubK4mbYw7r`luQ-r!BuN(S$BW2V71343BfK6}q`CAWD+e2j-QbScHNKmshBL
zh%6LXNtp*J`lsCH`1z+RtK|H&1<|*5x+qX2d|ajrW(wG!8KVohd`ZwW>Fta0@6Ce&
zE>oQb=#4AQ&(%9T9<Ok$a-1!I3jg^K-x7M<3ad7{Jl3~5{E3-awJ(l>I+PWEjS@aE
z&@I+ts$ESoE=Erel$s#F`tE(S8IM;d_1S*%^PUgW?m}sn@I?iKo02==*P>@|*6s_a
z<sAfiD;v+bqJVI4-S2P-$Fm#9KO%<CbRX{@AaA<*S9I<9LD<V0^fKO9Sk+z!;=Z|N
z4m$heR|}NPwu%d>2VQ85=0*#xy*WN*hobqvN@#7*tw{pPaRDe?Yo9a7cmR+)L|{mL
zMZ-6zrb&;_Bzyb-OMQ#El$^L%IrRPN(j%~mnSUOb)*{!8i_mPE2(DI>-I_yAdoaDI
zgO(CL_Zpx$UNbH)nzdHZqO9?P;pMys!qJ*k?njmO`z@#1#x5<j=bME=cJfSFMP%mw
zYH;o3&cJ>&rQFwJd%Mv58h#9f06H6Y;K)fO;SHdCuowMkSsn$XtBOB*4;~LGpSOC9
zWIfpzuQWHj3-VSsx(bAzF%*pRLYJe&q;~5Uuk4$4>-4WL_k+f5vVuw$-Yn~S0`m1%
zviViA_Ow#<^+Ub4Y`SXNs+9GA;8cLe%8Lk+jIJp1F-?0KSTJL~?c~uCG_ss>TvZ?j
z7{t0mdsr7dCCGIFh)wxj!?6$ZGXD%ff>it-1~RbWtDdRnsG@EQcYJBB-1WA(M3K7q
zrGePV6pxLFVNS<I1iBU@Qhk9oBH?ow*X22Bp3FKKaW_sY1|tcD=dU|ZTYF7p5TM=8
zD(o8NJ^bsD)I9>sG}>T>Xi=m2H`3B*P74%V*$DKz3*1QqsuxgT7PM@2+$}+^vFLy3
zS(2LJesU9HHqRV512p{)4-UBua5F?swB%_5(mnH6+8P#-%r<1pW1L-Us<52EktJ3h
z6A*{)U?iso0_BY&G>?wT|MyG#P%5vZ&V2art7f#kg^~ZH|Dgg4yy_~?IJp&Yg6|$4
zQu6NUp|u0g*O{nv08!=gxI7suO(<lt+ltC+-dGH%muoq_a@(IjT=3gZN|04M9a&0$
zdJi9z#jgR0b-W|!GR^FjUdNbvaAn|S&~ZIdsRd`r@EGV#t=3q#lysWr`<Fd~Kj~!2
zYqqV_palU?6FbkvXHbZ&`1TOo0PX3rU}PS~zU{Vn{Q~9-dYTB{A@O^OqRYO9o2kkJ
z-nHUFSTaAcss1Hr^%g4b^e`3hL?J+XsSS>Rdb5aKHP1-Y6Lv<mszw{S*qF2ZIqOKy
z)E#q4Gq7kb!V41L7S&xoZ)_!q*MdW7t}0#uvoe{%G;$Z<E9UFu;nWh9Q&l%BW>Ait
z{f^=^sNHg}HJSZ9SNXzg(BUelcWbE;T_>3iKUo)56FF9?tu{M?2VS0c4@UhFeJtBj
zxrY!6NKbOFy%p#WjLr}@$xL?Ed0j^pj*HCtWkAgvC;vCdyd8NnWLUpvQyM$TNT?CT
zL?Lj(U%S|f`=-)we*AkHV-L3-OeX&3O<>MAb~}SV+W+d`jA)<5<47PN_va43ThHms
zmM<2)3EVK5$OnbZi}Q)<Wf0%RXWd*VN|)vwoI5+KS;^kWi+6&eQ$g2Qh)=-&;o%>d
zn}#yHLZM#C!KX<a!Vo|+eDaKaB<+MMZBsVT;rV`A1ZSV+K~0eSovggOBP2i2dN`cP
z$#-Y1mO!hvTkRX7NeQQ*>vL*O<O9Ob{y))*CtCv9h3CKoB-Ygp=DP7!zUcdmoh*Mq
zVh7a{9t+K~%i#{MnuM|Eu3NRxaUgKSDFHlc#m?HIc%T4lIFMS&Dqa0Amb8n6qT*sQ
z=Xw0<Jj)4t9|ov`*Rb=31T2SbgYJ17U`&)<>eV_eHnelMjP6O`^i2STnU;-}(a(K6
z+{Wcn$DbWs)%J{zD#`~Y^%ey?$@(1tOHPZVbKv(P?~;P{vkSl-yDP`>=Me`dT4Ufw
za02mPX~&IN?PJC*@mTC6pb9vU$;)>TSSB#MWTFUI_(Ten7_OPm95>#;7b#2Nf_gMO
zHCb^!iO(^G|CZsjFl-7w$70UwS%l$jR$(6N9gX87UKmFee@aio{;qqH<;GZ*)oF3@
zSXT-wIUJaB>H6*JK3+CbWT~Qt=<TvAhm-m)0un#85;^=Fhcl-GgEk$!@X4`F?0wM+
zwXk)QFR}1|Dy^Y=UfT=&6Bij7(U1BXKU`ggAUl)Rt^hp{AweB5oNj%28FVs;WfD&B
z&{mrbwZJ^mzr((k?rzWqVgK?##%)kY={`med5;jA=F^;wRL_Ci%o8O=MW5(%vK@ZF
z)glq&N4qH^yz}1HFBX=5sf9wew(6~0_sYuL)efz9b@JKE6jN<xj_|)eGMMchu~2@e
z4j=_}$vb4BcgbBm2H-=cWT7MV9u81(FfrlnKIg{YWtuyB;TWlo$66z}xBUYkDnE&0
zTtAL56y6tEH2!=hyg15MjA35q!J#w|Z68?m{@Lq$RCn8d$l>h}Vdpd#5@6CxG2?E-
zUOR7%RKNE<ZMkktYqs)^`chx{<>P5>{3;j;eh|<8#@luIHn1paN)_IXvT)MqOL&|s
z7x|^6tBD<(M!_Y~XDUOuUWf8%4sOB>1^k5dDl&TElckS+k+@VTjE1#F`QMDZWnPtk
zBk|-{N<ceXY~vT^e=h9zC2(f@q_A@rla#Jvo~VK>--P_B+{?3g!istp=>y?fN(h_4
z#AoZ=K+At?0koX}7he0^PaO8;RjVp8I!%X>0{W2F%f?v*@uf+l<wuxvx0Gd-OqIue
zfbw{=hz(;OvAwytNz;12QO?PnyGz@1dcCI1w8O6fUvHpp(V&g4zTI$IDa!pb!-(^g
z_}I0)rPn8xz-sX}muPNC^rIKm50K4QjS%6j=Z6iuX#&^TmbBe`ISGv-UiM#G&)l3$
z%$kU;(i}7P3I*rxwJ9h*jBBzq2$2jV`LqNKb$++I%5{W?c4h2DOE~jm?Ht^(iZ>yo
zd<My^0%9?Pfteno#gKg`>E>;yV{&jTpa3fFws;HWM)L2UA8+eK=pFCa_hw0jtZYvP
z<!^@z^{|%ZFh?2}L(4vA$!rQRa_u2`!cjdYizH-SVVB^|+CwCGoWNUyRT%6l{P;8s
zOtC9cChb$7F1e2tL<;kGWAP3?7*CCB4f2S7tT}|cg<8)JTbzEzNM=JD&)m;l;)t>w
zMFEi!XZ^8rnTW9;vep1Ymc;As8v;Wj#Z|ujgUmjz=VR(=2q4UwU;c77eM9VcJlB5b
z>>j_dT$Zh?+!QMS)^~nlGcK*Xot5v3)K*TYUJSYx+cPs*yZxC`!bI%&=oLAMR4A{U
zycFIFM=)oGvo25s(Cpn!0}5G2_iX(<_6rAv51Sj#<H_TqDTEYtMOP{sE~MD^1U(Bv
zRy3p3<+=H3JTj$bhnHyC96_4!K{6pV(0Kp5QfHx4oL|pA{CW`knH!%$&c|BkS=Iz@
z9|RkpZfPpPQYX=lt2Q4ajqsZiVL)+o;uecuC9L&1JU!2R0}Whn@Sb~!n)A^{w4BcG
zt`1mYa14H+u%fM4CYb`(BA?p^vQJ-0*>EivU7maM#^PO~s)hC_64z|p{hz=2+HvJV
z0Hh}05)t9bO5-fv6Ce{HCr_~%DU;R~Gv7tgPgmtTXxazr9L7g{!<%}07gzEn3APt_
zO)rcw|KJ7&AiNS&^I82d{v+>jk3}k+_#Zh7c~4W7caO(3zkI*8HRAwjM5N*^<tr!i
z*TMFp?&abXf$yzzeuV?LoKV|?%-S{hRXep(nLw5L)hwes#;Q>QD}B>|eq5FwpfzzR
z_8LMcr4QP(y#YPW^Fvf%a<_x*Qrr$GM5+|OnE_4{p?rWJSZG{VlFIEAd-_h{yhVS1
z(9F`B+u30{N7_WEsZ-UVD3TIRfLrus)J<FTdJv_;`3KJkI(XcXz&bsTv?$`}WX%d}
zlv|{|e&qcFIojGF_t7AQf0eU#Nc`HyK8ErP$i00zOd?qFgz82_ZN(|q$x4+N!^3B)
ztlVQ6lopWQy=^LX)#~(75%SU^c&k|z2VfAO7)V1sD3<4!K@?>7b`%Bd?c^`Kpa@x!
zN|?e4zF;6i)I!iS{GIAL)g9F7p*pljd+%u@^W?AFgKz^d>Y$p)NyW<=v^=0YQ><M7
z`K?OIvmrki%iUMb+p~O}Kac~6ts)9UJ$dv{s+g=iv3cr5<-0pQ`R|fSw+o;B=5ZOU
zYLKFQye+_(?9`LV#mz|eoDp=7NHF)l!RFivDHqgBeRp-s*<7#23UqDuk&mab8{(RS
zjwtfTfY1fe^8D<=VQ(v;_#1sHpA~NAv^kVD13heROfB`Pz+i=IXMdPIQu;L2%kqF_
za+xHhCWQx$;VY#|Ru}B*tSU{u2~81pDlz)g{odO2(OTGY(Q=f?$ZXbDK!g6b`nRO0
zw-rE%P*RfQp@ee*F^hLx;N_(NLR$Xg#l|vWf1{ue1)p1$*R7^xLqb#_78U<PBvvq0
z$Xk^%Y9Wg_Z}BYugG#RiG1Xd^$@z^C!B?{m<t?>Xzqc0J#ksv;u+BuY6wBLPRDSPV
zpREtY_s7g-35=ZEmO4$4LuA@p@*TEi3`v}$?fr!zmB<eS$Ge~cmoxx8&O5=Ze5RSp
zxF<BLu>nB41pzEfJYq5z2kN#2CUp-MnenS$54A+>*c)ZdH=by&rw0V<%Q5S^%r_$Z
z1d_w)kW6IeWs9a>$6E%lEnPlKTbJ?{V%o3pC@;<tMy4Ka`^iXedMB^EKe!xfSfqw@
z8j{#slMV%C@I7Yt&ZXg{+R5u&Ymg9i&U4Q@LKiDiAzs=Xy2S^zW>4d59VEu&7$PGy
zdM6qj5>m4U{@`PTkdh&1Du9gmFg7ExPe(X6t|yP)dHXW^I4HTw+MoVz+UJL~)_e1w
zR;_3FeeK%*8VdZ>Y*daWcAtZnEZab|TVRz{%nk{anp|iA(NrM5jE_2{%=gko^uC@O
zNVXL!2tM`eTu|Q2EGK=Ep26z((@Ov^%ks=^eqEU8CD$eLV^2`~J$dM?hvY+Yn;6DA
zdJA6SgqhmSrRk)H@<SwYY_82NW1EFpr9cXLTa2v4?6R>=9oDfocwUGAxpOrb<HoX3
zpcd1%2k=0Z@;|$}3%#q!)Z1zu_@1$_-{ZBPXyyFf-W8Sd^{)7ti*?rAO3#3qBC~hS
zdw;Uhmrjb*yoU2g=c0`LUFFURxC@woM##-p?kCT6M|2eqNnDR-sluqsfUbPbUK70N
zYi{$MBE#I^$Lz5IX|+YUKpd*8p>a@f`4IvtA5^UxHJPo+H#9tF{kclDPVH1XifcE9
zaTkmd<{J(s-c5V|S2jOM^8O?ncZgZdPmCdUxXK-Jary#9XDl@#qz98(v6IJlPT#l%
zdEY8CVa3m*`)18Q*hghWCMx37TOxhG+MLb;qk&8Z{xCWVATU2a-@(ZOEFZ9tK-r9$
zBj^V{%XSzOL--0l4<lDx&-7b57}k4PuzjsCS9=pD)#^xnktE~`z%EP4)YHmw)R^7{
z!W3}5!KcNgkiZ?r&#cHyy1?!A$>{o6H~=m>=-3xR=Toeek7)l>?ICk?YwgQ{&B&6^
z8oZwF{YR5%b<1JP@W1$zE9UJzU&*k;yNcceS@}tv#zfvKuzeaRi;@vm7kZdXeQl2<
znI+>vjUbiL3fM5Wg5PdHRcsR&mwSLMqCTkn)#i%(sykM~+{L=ST0A@lJ}h0Uik>&A
z)DrI_X)6MVY=KS|#6!0KaSZm0m>%D_9Y1k$i9}Z&*kYQPd)U<+Vn?0SuEX-|a46kS
zxmnTkptV>fMXW!wB4lN0V<w7M;Umc1G#tc{8$-DTC-+v*Jnp|bEUpz!y3L^$O6o(W
zA&8wb?%}=HCbC~PF}N>6im^$pe#Z?sLzywEvr(Gh7P)Z{uOr$*)sEJ%@+}m^-vE)=
z{*kV<wwBX{S%}}ziR@jc^v$7`uC(lVpgmg~c&RUYkl%>G@%IWe46se!OM91$50VwR
zX+Kfu`6YZ~29#2F9{D7dYi=7cY2wW%l)6q9J(HMSCi!uT!wb&+1i(p2-{NH1RbJm8
z(RUSQaUZ$zLFzKUP4Qba%9RW7JXEb!t&Cg@fKmt)zl1)`njWtOpNAlOTxsJ<vfC7Y
zR@}y%<ql@ux4V1@bV-7!?psC)NEoKmM8vBpz69DX2&V$)2Jy9V#l6xF9K}b7{P-2q
z)C>n;!n{}nq~y0@F7Qs>%1JY;W1)V%rd_>GM|H~zarbk2uCp+~MG_YOE05{?L>&hz
zNx8ThnD4-pL5qYr|3oQhM^fM0eNQMZgMiM;PyzEvh{?3u*6CtB1f(o#VyHRo8Or4)
zdcwCS6$~NjI{C-#U4#<;=0J7%$DKE(UWQDbqhW;*0Fh|R+guu<)#B`d0+*}#?|{?!
zAzn#h^>8mY_#48gd<m620m{qKR_wR{&#n0vW-B@qToGzQ#~!td*SZ>M{7zcHwIaJf
zh0<l_(uT>ECPVl{CrG3r2dD~U=>psJ1ex&?lT9Na-CtM)ztV;4j5_(Rj2PU%Wvr1i
z*c%N-h@y4<wrR#DO5xj|swfjx7>$}&2I(aPjn&M4d|Ibcj21nA8|F+W@CKlrOa%l0
zd5!<`@Tk8!8fta=g#UP^YOin=)sgIg70KXe=3`r~-4rXl@$G$Nec!cRTPH#4WgGjR
zKA3a-GSJBa%GBrBJF<^UFmm6d6dUCy5x>egSnXp^F}Rv9i0s_3J4r9bXE2%#77dF7
z(xs8XHspHi@tZNWmVIlL$vj-GM<zeQ_ASnIo2;>%Y(1k|H(AST&5MCqMs5-pe5m=S
zIwHm-M|-?{QH9F&Y-FbT!fb2ZJWzAH_2PNU*(iK0>IMZK^h@Lct=}%6u4)-e?Icy0
zC`AIgE-ixzPtb&!ncPh5^GK7?tD4M|;mYJG6^VD#G-=v(1*40E2+8w{Pq_(4L7Sub
zh_!(<1OW41igG&*3;dAkF+*Kz80$_t?=F?iUY#H#^YdFlK8zT-^=j}2BhM*tUTA5{
zbBk0vuK%T*`s<y;+lH5IlMuVZsh_d%Mre7X6rb~WucO*gh6hVOV+85rOk1Y7+&uZ~
z+Bq3ae)gcNuqsvOmMZ_8)}iK>{ioH)Xo)&V<#Gu0y7e;2kPzBdK#Z1TXOg20cSu}J
zk*(d*XY$XCQ^4l0`U$=E(IlYoH#S<YyS{p$l4tOk@jZvYWP@<UMF*K_0mILB`b?Iw
zU*CTC=0a0)UY#uPOmjP#5@-CxzEolF;h?ls$lRGp?7hqrv(8bUb*>S-M^`8PqKkpn
zOa*0INEL@h5M6lcuT|!In8VUtVMbq6l(k`n$25y@XM&!|a`VDS1K}?=PTudl`S0||
zN2cf9Eq(K0vZjJ$+)389lIc5mFn|Ub#%YIjm8}_12(RU^fwsazG@>NHX--f}Saf8`
z!#0)-^Z~Fj%e05<j|H8}7cwx_o9yBzwt9Of(*n%5yv0jr`SJSo=j1#Z1fTDOemjx<
zmhn))xBrD$=%%7O=80GqA7gSPPyKp$kRCsZ#`g?^FX;P|>hz81X5M&L97P^YlmxrE
zR<bDtJI#quKz~uOnU10BYqlu0G1Y$xl`J*XzfR<%G%cHIGX6-l^^=1&um{bQou)KA
z20sa|7zhTzqK<TDBwI^e^u@YXYHNbQaJ7$^y6hd!<arYJk}aGhg^rl!)6)0jn)1}I
zqQvAxRE=N<tKYmnQ}LQo7Im$?ob#Df*?$w95;6UWlnm?BJQ1q~rgC!0@6Q&_jj$?#
z^2I?i5cJ>Kpt0!~IF-Eu!J~0wAfsSk{UoT0Z;v8>&Bo9Fx!~81=fR+WYrs|$TfIZ_
zP__;xw+!k}HyU<~0<Q%h8>j0dhkIQL)1$SleCU|UIcC|n@tQ|?=l!=6Wm<^e3@zr~
zVe3?+-uOuwYCq_04@GB;$+Jt&-5WvcqarDdq>BN`Mh&mkG)Ur{jT=|)xrkc+juGEV
z)HlcL=fc_MG2^t0uakF}YAAAVk-bfQ^hmVcZdM_z<%>j^*z9}+4S!k(h7!U)@xrjG
z&Y2H%iDSCG7mz^yIj~JMI#ddAd5&_~BBk;HGj@~rr=4i1t=_FeecwVyCEl}4xJ*|W
zQogR$G%rK_7^kBq?HIGD8gEp^;(`a@Ga{{im&zV`Ewq&whpPN07YHo!U7McjWAM%@
zm2PbYbJvH==d+?$MH0y-ZXfMu8>>$ls*yW|uQy9taLP@MpDh)(q{KHbUA{q&m;&*@
z0uGAP$JA_$7N#0vNiICg!%<X?(A(F6b|x8n;VOZ<GcA$lTTstE>m)EOgNHvAq4h8~
z1&i%b(cVK|Rrt3lp$e-UQ+8^YxoR5q;n9Y*Qo#ewO@AJ$^DYS)uBI={u*{$H{Ne8-
zTW5xQ7A_i4mdHOW)S6w?e$8H=?(xp-dOCD9e3wr%H**6<Vf<hDBPRL69v*?N%?!N|
z>OR97-28QzP+$zV{y2eq?uFRte&Kl0$om{|8KdLr?Xvs5M>8B&9fGZ+5A<)Eom#>3
zipM%B3OOokor321KQT~D8i-Dd7fanq?08`qcX1^bMO~B`bVXjx85DQ9=UAW<NXhT=
zMSUciP1j-pNB{bi<2b?VHBo|zOQ00V34mg_NWM$;_6p(p#Md5&^L`8=NKMoIV~fZ$
z<Y?;imqQdZC>@74?<9UAUaC+St@0x+np`x<2Xg(RC7~lPwK358gTzck9kpAXln`j6
zCq<eUGw-v6JCo-6x`=YJF$nEYNk>M>orNc6wzyJtTT(GojL(CFP6e|zig>7w-7SQB
z_%ag|T6m<|eX$a3CS?Y{UyMxC_+7m8L|W;mO5@J^F*bQI%_eWbWL(wLw<@~<#mCVc
zdr%1Fj{t(2V;eMqQ+ZngC3-8^N?TWz-N8pVuJ%5N#K|rp>D~f57^;MBH@;Fj<&0YP
zc|>lu0u|`rMag6b!SBud8SPn1$PC!S=kx84`B3OR+3eSX`u(!aWm1hjOZkhy^xYak
za;g)+Kl`Zg4WaK7#6aTmE>18ugWt1tnrV3~MNLjB^!-K^0p=`MFtA|S#A8RLk-Vm&
zoIUj~qw^8Ac^rSu9F?`(;=Z>~oe_5R0Qjf`iR*-_4PdStKbTx#?JCTDn8sDsvKLr0
zmH(XwoAw31O#bGcA8cviLF3&NUaHW<?zL#~Mw5W%HEBP#-VB4xa5|WN#g~tp=Ya;F
zCzw>f2#)sWvlS@(m<L3?XFG2trAS^AsQaF7=IE6Nw*9U+ylDa$VA=m0SkAt7^t8(E
zyqA1QEVw()n<z*g$LOVwa4>ViEHap7m~3bkd=7#NNYr|fJsp*msF9aw1a!v$JEyVm
zSlczj^$MsSLd@Pn&XGYzj3Fz|Z<UIhyymyX3e~Q>7>&qSltGJ^ziCy>sEXF)su}#{
ze5%cBYW>>nxwZiQ*Sx#1^@W)_%dlxi{u+em&vFwcG*%h9gK^z1TdXGR&Ek}Im<&%i
zuumpBQcatDOuRcQF4`NZvN>9LaquyrXpwkzR*oV$9F4vLMF|q^LY2=n;?Jz_!1_3w
z-gL#%d{8Z&89&Y0pGlUiQm0p+sZ+dyUwPWNn4T!3wkOLW?UJ*qVOudLO2k}Ir*lo+
zPa=L9z{RDPXSlj_x42wq8N;>uCXQ?5v-eemP+bfCJ&h~VR>`KjoFwz6cSPnHot$TC
z^q#kd-4S#^I2JiWjK)fPFB(=q#--(58`-s8(C()>i=$&nKOTrB1vsA%UNdHTmwu0_
zd0u0;Js~0LRLenv^))PBZdUiuu2xWiJ!ce|-RQ&+&YSdL0RHM|T(C5$Do3@9x^Xg&
zR{9`bO<4E1g~Ke3Nvn{b<5(0g&9}CI-(E-6X}U^Q&pmFXz^=0fnfdCikb7Yf@TN7&
zae~!O(hk{$y?H!ywu|ElP^MzgDK=1SXZl0zaXNZ)&DSJ{09kz?Gdb^3HeXg*<y37F
z9W>j>H~2XC!VHH1rW!Vqo;Jsy2WWd$35^|}_BU;)y`h8b(gzJ8OortAmg&L=>Rgkj
z3*Pl{pO&5Didu+U^hcAo#q~>PpLuw9aYX!C0=V-)os1^a@-0S#$7QNl76Ua5VZDjv
zd}*bcMYdQWD}h=i(zFuz4d<zwwGjJ601A|T5$|cyKTPr@$t)3N@8OMSB*%uq<odgX
zUk1OWI$V3A-L&5tI$gc8hqV9xW7-wg{=MU<__oe;)oTCAD&aiTx<CD4a$&=R$(W1x
zgbRqtogsuQS!epku(nDsDvP0!D__W*fi$9czS}WL!IYSLJr(NmY#Uf`*;N9r@Jigb
zGgsaL_pll%=DhBo?gfwMQC&LG@xbKB%c%*X%-K5UFhS{3Hm)|==(qin>_?RP2Ql$g
zH1&CfG8lgue9LT)EK`~8z3!+q%Negm?QZq+4)Ha$$y`2<Ah~BP0utyVY)4BxA6%VM
z-->wgzRrxA(W0IK*@f@3{ypL&zbrkbaD#WF-}*%}ziMuipL5PBneu*{LJ=2DDbnWt
z`s&B+p`u?5xJ47C!m`A%b9|il*VpHLYX%<r>nx9HejX@vC$@DJuIauV{DY1tu|U9O
zVd1vdQ8zpZ`dE8U0dFK@=xDGBsyk#xMY5)96AC@nB#%>$p&xNbO9g;IE7H2fR24<S
zp+-r5lU9QWdv4vCTW@Cs+JdiTy`EKIuaF5!K#*>L67b;T^N8C^HXVx3X*n?WnvEZ`
z?w6h)Z5Ld*_DJXg=kleT1TuZszhKNz$AzUwLxamb6kSCC@u#iK2{9CpRd11D_1?*j
zHW1M+0U=nC&+bS1aL7u|rT4sNmVUhiUe#=rWgi+BI8nT<N?PestasV_p>qSZ*OZki
zj8rRc<P>f=lBWs!S=#qJYc`}vTTOi45%oLw6v1I?+_jsWh_<V#9ugjM1llvaV#z|J
z*d+>`PaG@IDt~xW`WqX+IF7!hs<P|1K-Pw`>{=gLe0mbwj}{9eN8Tj=J{>A=+_kJ;
z@>Em4-X4n!S+zI=g$pC|rpS~J<|gW)zT2gfj$Vh4<rL!dTf4(VBW9B&>we0gE6<b%
zsWWMQW<(Ten$P=dJ2e@L{b|p&zi7X=(D>wRo9KO`W-cy!ai1zKmB%LvF}HA=gfoP`
zIR(QZP}$L|o-)L*r$B7`;ADZ+R0lLB`EX+Es3&9QoJm^S<d4QeRwdZ~6a^k5bX7ix
zIyhc0__;v$#OjYj6RQ2+-x1_$s)-AXMN9(?z*1jX4kI3Q004+6VK0G98wwE?E-t-R
z9cYPOQwQwW9F`YcN+}QHA{N3YO}91m?(mRtWI}V<xdiTV1K?j2m|wkOnqgF|(RyT1
zVt$?IO&?Z6uarSJN;iAsv_n}##*I5}(FJ~sx#=MWmyv&=@0*TGqc-?th+z}7H6R2{
z)9BT+5x)c&$AiE*Dqb<CB-@Mw9_z@c^T(T?c?UJ;onZqe>Xw(g-g@lC46}-NmbqFt
zwA?RiqA=P&H923h;k%6I*e`$4)K;|=D<1M}Tq-xuv5$Vp_YE#|;CbySFz?{~g!tQ&
zA&lUQ)`Fogwx3s4#FvkNR`ftx-7${I`#V}7irFhHlseFO4o;K35heEVQ9EinytVal
zDUi~6A<m4{tp4QlanptZ5WtQQeDIo&fz<*Ak5ncteLBdwf=XglDu;h=%2Z05yI8s}
z#e6d5m&SP>EZeFN8cYfQ(_nf}%p*vrc*L@%tDYYCKvfzyTHE3w>*MJ|>yfzGx^8#f
zG3H7P;$mr>(DtGg<K2qYJQ8*8_}f;)vT=fVQ0?`Q2Aeh~J|;6af*z|1xg5r*rdN&n
zv?J}CcG`PdsGY+g<}5+nST7ULRRU{303xIT!h(`fc%O0!eC|zw?(ooCb&r~Wt^%cW
zOUt;?mLQe&htp3P%LCm_nXW-6#t>E*$@7ss>r)lg_)P#%(}E;FqeW*II0zRA9aAn?
zb~2FE4tScKo{>a<={65LV4jU4Wyx(52TiA8yap16Ra3>?#!A-+nMWpVgMszl`sMIS
z9?gjlvm?Jg*iK;t@5V{)%nyTR-`DgHpTAOjZTzw}W)4}=H}`yRKUb9ai*A2ydrR`c
zQnTnS=>s&+h2T-ez~g2?`~i<gG87LHf8j11gYckX@Fm9*VBVBNmuPrV#66mE%`_w|
z=V7Bj9J3sUkm8kBxj9@7DB^KxPSn)N+bM7cvw@&)DiTq)bdxg7VvxirT`xI~9P_61
zPw>cZA_<+E4-<vRpk~IKH_H_fF`~xHWtw(@oB+?@G1>`07yy9(5oX!1Oh?k$9D>C_
zr}V=@idfOKMpDpF@(Zl0kPZEaiH|8l9bB|$XUY@cNxKxUE<E5E_d>(8sVn`x+)IUp
zJXdxXvvS)&=8<kE<9XYiOWdRJ(}VIEQ`f93A$u&Gd5B(_zYwQ-zn)E<O)}l`9`SFF
zfmA|7FfMgT>gGBQ{-~pNj9A5da-{m-WGFkpwxi9{0O>pP{+r!a8{s11XB>}9PhH(h
z-+=+mb`99|H#1lH8abV+Khx`(Pe~S*c{UPL#>jj|rr*&w<U1&|0(3%H_?$o2)lYQt
zx5EGn4MZ)&c*b;XjE|WFtDm&APIb<M_b!E?5|v+nn05Sx0wsSdOu^%@jZj33fQJ7&
z>bt^+N#t#7AH*3!Psbaxz-L#CIQR!kUCi9i=Bli!O;zm`#6j0-99ZsHAM_IHiOQU5
z4^R;3)TY^|3=kvheFq#a3=IHDho1JIAhY;J+EcfFkbme&AeOz|0%y}s4v>h*k?`g#
zZCPKCwO`2KZB8=gIHB~DFFw3#Y<a)^(Xz8Dl*;!51!#^W2Tbhr05_OqpKY)20X_7y
z7mrMwu4E{qy?5q*kRFTAhh0}`-r0kn+h^3n8OcaF-e@GU)yAJ{bx|wRGoMaIsh50j
znl~fPD)Y`?+6p@8kw*Z@%J4o?d$`~Hz{*Su(EfM~i^>3^<{=J;Nyp(P(WXO6OJ5|J
zv736Fq}f7Ns6;&U$*#mmG4!_3Js_{G-`U3b_30bl>sG_Jdq6O0jWbIki`HftI(#OR
zzI=yf1m68}8?-?(=Gq??EWQ5LLRM^uGUCnF%^St0)N+b9_W#i^z4aFB?z6N^)T#Ci
zokl;UK*$OwQxaXwB6d!LUQa;m#*q1yR&V+a+HPX+p-4@4nEC6g4v2PF<^pe;rNVK3
zA)JSswOD5}wW0CCXGO?)IA%6ZPVgwXa=VNU+2u=A;GUf1Iy4f!WqT_=VB~&#PYfS_
za&i;M%Api?@~;!w%^e^eF>|A<fUVfgkKsD_=J)pp5u%hm4dZ!_Um<|RS*m6{4-5np
z$-P6%;c8i7&*^5b-)46<LJ9T@8$EX&yi<lib8g#af@`_%qbWXc`a79Q0Qa3XCK{WR
z!?*iz$8_%St%w?`GYzU^PK7}q|AExzc_e78eT!2179h{KuMF_v*dv{JZ>g~Y^<lNJ
zedSaMTNdF*G9R6Yrdsj4+rNQUJ8slaAkfeRTtFJ_Q;7<dfa^=|j?5xKp{(M?rhOA%
zmU#Vimp&10MNJTx?{c?u`vUk>W&Y)r47WH{$CSVDI+$vbj%X%geS)cJ+xS^ZzvRsq
zjP<QIL_IAhY|wRM4*sUV3)gChcDa&9T}?gAJ)I{E`18OS&l^s<wptErB4f6@O6xrp
zXI*PKTqOR77?Q1AXtw1qmPOARHqs9yXq7LwD_3WxNB5-+`|BJdo8<D5u!mVh8n&)K
z%85j1H9$}6MM^)i3S-9PArJ0O?W8^=l)6>DXRci4@jpSwJ+Nvu<gPKX|8s!S5p{@_
z=F<;uwFk%MEe0(@c6A+!_FE$&`9k>^$p+vK3jt<N2X5ZBVXuS^JX6gQUcCK+&8yOB
zhL6>4u@&Hj<5S#YE!m@PPbw*iQFKAV`*XLCMYqjl*N`ye3hZYYatsl0%H=6w6EJNL
zh_Xzd7b1^HEU~R4i}J`V@}9&$zwC)z`hCF8RYWI^YPV9HjPYN})7+};(r-u5v6ta0
zhUu8WUjoa)GHyfq@^)elyODRH%{1SC(glnIIv0_Cw5jWm@@M(9`Z?<_djgE=*8Ll;
z6^0GAWdNyG^ZWE6WMvN)uA%rrIAw(*fzb#h;sVciVY?=&Npk}4IBYcFOd{=eYIOiu
za$h^=xEU*Cms)@;wz^*Q)i&Lw-{Sq`E_+v=SNjc^gGvzLtdcztHg;z`G|}*o&=Tm(
zLuTq+mL3JnF5$DJ17hr~_0*04qj~f1m-{%tp_0OWxznZofmc#{PiUlbCTm>H+@tC4
zuWBO=9g&NHP&Bt>uFjHuLh{=HgQjBg7NwXgf0d`hQn2o064|uQ=(OUK#eGS4g4r6o
z+>^#;gO>9w{i9l>%`xFTZem$Or~3|l*O7=+tdlcw;p3*n$IH%aRTtAXS<LAPzs$UO
zTfE4GvR$OnZLB!izJZ9^Y=vrP%5Yvrm!imh&Ze3w?++=}%*D9Li_4`bGA-mh6UwRK
z_@mYC#H#s%UE!#G?@E&ntZH?D6Q&QH%(l-SsYhurksMj(m{qL^-`>j05XswmN|(Vu
zy=?BMs*9+Q>W7U0-|BerP_~8lgdr<Q#92h$L71AR(DM`WoR;g1y^M-GulvUb?c2W?
zi<X%cM;23#yHE>MKHU)hrK{2ZL&zq}rP(c+3-0nG-Hk@z)mr<9AuIgbTT}p^Tq06=
z1W~vZKIN&rZjA6*H?=$|2dz=BJKhl|H>OCX-K0NAfV;|x-+(pYERy+VNz-%kT?&5I
z>Rj{Hs>&YCrRV*6vp4{AI+DZLO@-I6JL)<lGHvTak#|5~S!+lD%{khba_pV6$c@*v
zTeF=3?`Hh|$R-z`>{@g#|Lvb!l2eA_^`<#e8l``}ivsA>a|T)x4d>0#*>tZeZ<!?J
zQ|HU^X`2iiJ*KKWnJ+2=U)wf`86>dl2r+SK{6BdOPsmew{9GjFH^`|+yPgFc4xE4R
zIX|T=Qxp7kzxo=a(|SO^@bn;rkMR_~f0r_Hj{iwGFahjbb4m+G$wWjjv<Kqd=MSz(
z6%Uxf)NP#;$FVrg+#UDZZ;8KOL`4}RB#MBVCq8q5h_q3}HSOcfzY0Ih7jiEsvdIh>
zolhU(F-pJ3e@iO+1>UDuSJtYtZ1_jS3GFd|@WlvUZPok<_QKFJR`#9aV;dOiIQ#Hg
zHsXD&DVlxr1cSSz^&GN2U?R{oaCw1T2Q8cy!{Ea&)x{1V<EdL?X}UA=G8w0jXzCB%
zhnB(z^cE33-Y3Mm1^v`GG1w1DDJj!_P{av1%&6&3NR=>#l}(oUy{}`Rv4^Uov@yw*
zC10fhYN8Io1V%-x$?3;wM!7$xF0g^y;<kqblz~mYfAZINAg4Y+101r}7>PDWs2_mS
z4i<E(KPnc#^oR`7*PHy?eB<`wwiG$}LXzN5epljx)wB7E=MyfrA|T&tQa;g-7RhPh
zR^T6I4sjSr>uBC-EhR|xJKnpmFW(rlV)22MEA>*5IWhd}S4LzoXfl|ZkWPLnk;+ZO
zB3N9xU{U?z(A)F=HNrlOg%p<Q-`@6PfUoQ*YMml3g4?{U^UqxKXJ08%{qAVpQD}Lq
zZO&B6gUhaiW6IZha9CN~b=(AKc;rGSdHc}zGH%kKbI-%gn5;0NXM>twFa>^Fy*29e
zv3l6L3B`jb&+bx@l**k?zX0j9N6A-4ek^?{qF{4kx#~4R&*|dzjnV;k6}^#Jkxm@S
zS!Ep9NEO%h`y6j2>Uz~G>V#2*o)5CM&)j=NAhrn#grztJU#prOdF+k;I8?ds(abu_
zC{QC6vQ7NmGiPms;(i3l7nvTjERx;iU5h(BflHshJ=yaV7;~tHTaY&=`NfAnAk=?w
z+|mmM0P;>2n$nX8XbgLuq<N&>grb$XB85a_de{2X3ig^@!t`B+pR>W6Ea3$8gB2z7
zjTe1r8F05Ddd1JIE{M~YJh9BId@c)Sy65W%>tvbmM<U`4E>6=T>zs$w>Fvdl$E{YU
zEaxhPs#>8(sLys0qBg|Rp~t#hEf>xDV!&be7AY;D65{!l#@WC{<c2hGAH9AtClrwz
zX6iMKXu8|Sn-OVp1;o;~Z0f#rc06FSmfhp9eA>l4q7~+N*vADga$7w)u2DR>MuUyO
z_sfnlzA0YT5mcO?%mFu{{1OZIH0to#wwcHZxp8JKH)DNEJLp5jC}Z*zqq-TQ_<fs!
z5L*|ydf(Zvw-{oGG?&&SJ(4j{89@&uc#~`BU`}Ie0}@4`hdWkAib~(HQgNm0Ka&X$
zrKLo-vv$M3jWV(Ki+Qp|<<BLT?Kd|W9q%BxbKPYlcz?*z0e5O#CR!48oD&+WLCy#A
zN&%=lh(RoMUgUnWLxGXk(2ts)>^3`w+#A?+?3k#X>hctJchHM&uGBuowp3{-4_v2y
zcJjKDe7(p_>^yC!@+|>k`B4LSrzf9w;8MS?D88OQy@L84?fm5D$XzY!Dr}1yDD(yB
z4kWJ|H~0s0OmTtwLkVRnjbF4_F5kXo+OI<NN!}&+@BpU6w;jS%_0)<N+#+B%_chN^
z&!0oI@|B@HzK=|2HVXt6O!Ci9B7~aU>kF%aLfPM>$OMykyu?0{0*zP^e4urgGp;K$
zx4bJ;*NNt~ntWEr)2I>r?a(0yxUlj+<08291vcL@c&U7^H*P^Io*75ixu*SZoXH;k
zC(gLyTl%WA%NW&fm0;b|<9YpV;nhcO##4C)vUOVJWG7y&p&EIhI-1ii*P%*mTcJ~&
zv9z`clTv?|o=NR7OegGy9B*(vp$VER*}n`L{?6Xl6{*|pA2EwM?e3l!aI*Pg^|xO7
zTGZF8{LY~qCT03($U*nxtp`i3H?AOnwpeKY;vqoY7m50v3i-BfQJg7Tt5|OfUe@p;
zN?UMJbi;m|!hflH>HjRG44&XKb0_GDh%lkkTw|O`&x;oKHTT?X91!^+Mk8S^@M9mM
zTV8a9<#)3#Iug9ZywLD2D00i9K53Slw2!HV)jZ$osT)L@hpVT#B?C*SYu>_VUUN^6
z$H$_XM8yOeD;*T}?A?F-z!14GTX9NajjVG5eATDr#)XxQdoyeco`~{&=RiZwP4Kb~
zlPWVIbZP{B$m0p)?{bgIf>Q_fuT?<(3ikV>{Sw|GUaW~wD%XS=*pb>5b9-siq{VdX
z&dmOvJ9{iXGtZ4y!0^~xqwnhp^yYUjBj}k|^d2oxjPEK65<7`;GK(FeEQ2co{zJbb
zVB;m8cUYd%`^*tUkcwHJGbZ*-)tNLp#kpbOe%3=1&WfLZ{wYf{_kj+k{N4)B@fusJ
zMKA2@F}4`@&_XD3$OI@eZ_dgRY)Fg(Ao=WNd|)edZ79jZl%9T$+jmwn%w(t|+YjVf
zEpAJQ3hgfH1-|PDu1N^L6QvJI+Ypb3G1=|%{H``j#v4fSkATOtTtvW{*1j%6%Ay5F
zcYr5k1qTb=XcA?h1@J0C`>!NM*T#E?W#@iM90My?-1*@FDOEt+dgviYe1}P}UGxhx
zypks00g7W00=oEnqV37lwgvMt$;&8ZL-ar!Qt4-z&naZyi~Uuq{@fJwb6EG(r@SDE
z>lz9n`)otCQ($Du$$bDAE+RY_-sv`dNdpi7M=7d%A9X*TiQRe0te&%hr^r4mGV*H)
zuaX8+1P23^sh(c5e;V{)DLtwe8+JmK%1REcRa{scOsgJm5=i%6zvGE!**PDQgI4T<
z?(sHnKa?vr-ib^4*6nGEtU6U!KI1wjzi7ukM!@+ciG2wGV<H(^Q&lo~S$?gFn$2Yd
zU}F$MCLBd{a34PeR6@fmz?;#Dx2_aQ#lM}`z)(U5yM792_j<K1e#&zVf0ml|wQiGj
zzH>f1EUbzmEqop(3W%{xFV?@8zFCnvKE2Hu<sSaXQY7XtwP&$qa$w@@LxpU_t^nBZ
zlG%co6DJC5+T8|Sc7<6F1kBG@_02S-Lr(rcdJ4*9^O4hEvUV`e-7%<6NM2H5itq<}
z?AtNjsBTU^?=!!$cz5i%GuNyzz6%VK%djG8DJP${j1<384_FLT{K3|4dzqDNUVJiJ
z{;tP;Y(T&BCM4m78E+xi$sVdBP_K;Fx#GF&YaYi91Fns1>_hvx8ohM)i4O#<!Bl7x
zEg^<J^FlPa7}M8N3hul(#Z914UoWII+?IX$6-kgWZw-^vK{_jd>7Z*3s+rTL1L{l^
zrF_|On8fpHfe+($2GXAZrACpN+rxEuUR49ClO_SV_Tv@#(?^?y4xmHFjm0?~^U0;Y
zEC6_hXSwt;@-Fd`qy4NC1Tp+Hdo6S7E;Az5^h))Fa_eS<FM!Ht#wlf7Q|GTs&lQ+%
zInxQYsLzsUKy?-T<xi00&7|L@g%`|JC7bIRW}FpjCe5#1Ux2yAaV$d4Ll-rN%cTfT
z?cG_YL!!A7S*qg!fo-hqZoRaXpZ{)p*madm$CG5*TsEre!VXZ_b(7BiTg5@elV;b^
zrje)`E|ldfz{!@Pj-Pwq{jE%lY?>N`y>W(9(F06w)~cqR<b(}xvRO*h_5v0%2!Ivn
zm;R1h*WG!<#~}E48ALW>J>_~K<n2xFnf;NLtm*2tctYL6!Aey8+Y;+|&kwQo35zN-
zjHe=QiwugNpHm7XZV)Y|d7^*`-QWJ8AUY)Uw5S362inI~UUD)#sHL<Sv<<(~YPmXR
zJN|~{4RsN4{+)Bj|Ej|V;?&e>C$%+KoJ=h3s@RiB$YlQw(9N0~JLr1!%>y<|$?9Xe
zV=mD2CTW~VzK#w%`ADNlibCmJIW?_NJ<%VI@cpYML^@0x9UMAhttG&_pB?icT_AAB
zk?H+#oL1zMFFlv93f2uqLskwxk5qYzy;9(M1Q4esf|~37API6CmK4FH!z`CCfAE7$
zOTbPin!1PApvL*W*|BMTqt(&WYX~!-C3SUA&4-*rjr;*Q=;&e6z37S!0-RpmmUCUj
zA>Z?HB*Y&Xpqi-?`E=x0-lu7NG@Unq@bO?!JATaP<vKv*rSyBVGJ=apD6Xv36|!^f
ze>}Ly$V9PC@Jd1a<(%Wtm&*)qeQ0LOQU-k*Rw0tbczMjZT8k>pyAPWqw?j&23W!xQ
z(#Mn)c-t<TntHr+<oqCb^WHjbSe(e>&)jGU4O3^kL{<l**<60cdfffdO+B=CQ3|3W
zz8^poiC`PkKEU*%PS5aTai6hrZc^PdQJYTspFYkHd=AoEXbSZMu-Ch19Kv$1W_<|(
zYDRMV8>8AGL^rygyE_TJ*_p&7gg){93zc!j&+}6ku^JWK59Ek7wFXaK(@s@H-85{H
zvRuux%tW|_VR>E`I-!HwtIj&#Huu(BbUIgSxm>ItXSnv&XhE(yYz@Nt`sZr09X^TJ
z7%nXGxtJ->4*Bb^{I=>%(Bv)P7$52J=0p7uZee$O`;6ZJt?WWzdj+1_labDDvNvf0
zj%P-o)=nO$bScr=5Bgok?ZvKN*1YM_W9g#OjOqLRYWSiv!kK#V6Wby|Pqfha8$Q5^
z9P|IPp<R7ayI0)K(MPy62s=%6x>86#u~zd6e`yC=kITJ{>=u@+ogs0cfo^)d=N?fn
za?gAc1Vd@havoAN+kxR9K$FX`=6NEgX>Scj%2(H_PL|Pd$IXie*Ud&?D0$)8h|3cZ
zGx=K&T%N^+^ICegB*ETCm+@a8jYV%oRZ6P{bX*!15;U}b5lyxO9Qw?{%q99N8)(KW
zIaS>yDaFxwWwIjVZJxCI4r~esU9CIuPe7l>{OmNSD2mEr&@}HZcbNg~z-sxk<eoOV
zCZqIqLEyYQ^%E%cdTM;2tTch+o%QfJx+w!Og}yAwzG9D^=@<*l0a0LmP5or{^`UIb
zT!oao=PqC6Mvc}fC>@Hx=+*<jFPEnhl08__jNBHn3Z`MBn}r$0&bxfwJ8De5E(K1h
z;!eSA=A3K8v}-H2?y<~3AbJoI(Dj8OQ^lh};iDq})7{i)Ar6U@uqHuMLg7t7i}0mJ
zcB(%7n(2QqlI>`nwk^ssFGb_6v9`=d0~s`}6FT_9_bL`xmb$GybYEB1?W1Wl=SaVP
zyMD9M>^+-(UlNBk9F=}XbLq%6GB%$8xNMGD#`0CGPfy!>wybD?9_=fljeu=hw6$t#
zyw56vY#e}3ahV1Mr_qY+s#Vo_Xq!Oz$e4p&$RqXikDv676|cCZs=41w*t+5jvjRb&
zonh?uU-5#0aW(&HEn5q1M5A&V8c^5S2VRs$j*7qW(QOmC7hom?F(`74C}DKpqPv?+
z%3)BpANy**|6=5x)@s<@LZxtjG-f$<>OT=<GFaf6tGBfUb$-gSCQQnq3rR4l+IYE7
zZn6*zrhBj1F<<D5;o73<Si3wvdqEOcwn?DQwOmjpef)bpL|a`*T78dtXV-bGPSfO>
zhl_kFI!*9Odw`e{HQLd#A_tVZC`sW|PS3xs#u6%3<@0~_KhsvTCH{?pO&@PTxgb)~
z&bND$PU_+SA^ZJTr1!#lEz6jnMez-elc!angPkY&ZIJBs`U1>oJ<IQZ<HI{D4z*u>
z@}wZ`C#tBE5A-YTxJ`5NnaJ;GC)*OtpZ=waz!}$BjG3?0J*Lz@c;f9$VUNNJ#Q@L<
zI<a*F<%zWY7GzuMemj+g0%cF?p1`lpp~NUdeE!5IFg4|TlTzVHmOg5vIQ}@RmkJLT
zNB2U#DwK0;R9Tyn>z>*VWi1^w9bTcA=tSS<`Th{k-Up9s>C93+deIY*L6w}ls95G+
ze!Uq`=}0vjPlw!V+AnJnpL>-?O=dMWd$#^=`$5+}#^^%7qMpxp9c@aBuu5YMx7;4|
z_><Bd0w<+*eY3zG<)?}r<SsqRl`>s*UB3Vrjwk=O@_$j2X_j}BggHtlTH=qwOr&Do
z1I?{w8O&BNjS=kRFj12MF?nqLdP{(Df6=8u_}2$*6__s6O!E@=<W`Avy8EZA8O5VA
z;Pck~>C|1ZXXc)PE54&6AdAm{*$&l#_`=V8!s#1N_ikS`tqo}@Cvzwy@Qt5{dEVD^
z=)VRe;559TFgBCdlUOsqeaWi*z<3uxz=<h4m>>*^yC+szD+BE@CiJiRYV}5EYO{*f
zOjA>?1SqdANYc*!#9S@3GlRG@9mixyITzq{km~T3W!1{9QibQP(usHSj!4Q*{XHF<
z`?Jo?UmGFDHpcDq>sOb6PwT6pq<eb^(Ebk6jX$|YKSW~Z&!Rwjp7{nc{a}T)n}ei4
zwTu_1UhTTdb0$9QE^6C?3OtPDXcV!1+AwXxRE0snj?j1SFdn|T+&QR$OLZnt?Q{0&
zYU?9e*0GIZ<DM|P>%Qu{TLhp5<rgeAvg3P&v>E@TiS@4Prn9oO!d~mc#O+^jYU47{
zkbk*_R8WuFTvCa0Er0be4mZb|0c6J97-2H6=UlmW{f<Ufw~ht$m_^@-+}I6rJ|es2
ze!Wr7jyR6vXFQdFDm49j8l^mp_^~Q|!AHfHoh&~dB?DP7p#6{t=oU`~6VmvjRiB;K
zPkKV0pm;pb9$SrAe3e8?NL56>6%jw|uU0SO_P#S+H)a^Oemm?9vts(K$ude_9M7t}
z|Hs~2hGn_6?V=J&2uKJ>cS(bEDh<-z(%s!4CDJY3(jYA@0s<o4jdUZ;L+<h5`@ZWq
z_WHj4tsm>xKISi<>AW3vk9&+O&g(pDKcE!`g}p_eW<vZR(nK9O_o==@`@&=1%k(;P
zh=Wq-_OxcAT)=3xTIl9aYsnJJ`7hlP6$_V(l~8s;GZ0*IGYE^j7QBRJ!SQ6G$i;x5
z_5?Iz5%e$T90gX<qG_1-U>a-u8%!Q5w}ZHT>qea?Q(t8O>0!E8bW~ei^9&7I+F|SA
z!8h-1Tjxl68d>7Jr6qxcFCPUi=Cy}5EzHjSDl6rcKhMXqRPJej3QaDA&;JU3$8X5j
z0?>zO$UZu)4lIY&D+RyyWlXr`89$+79HxlJ1hJ^VfVdVc)t#%5PQQ>j9=iVZw^(QY
z2<dkS&eO+$ZhsjwW?2?Ng?rdK^>d&|>-m-6uj)F1<2kEFxfmKb`~qSx?_hP^2S5mO
zF{F<;#{aQ1_ao#q(k~fU025L_iakYJh4hoMPeT--O0jUTX&el3O#&kaQ@CUo+?L{k
zAY(HlIX-SwtF3V$6ZVk*3Fy|{_q~G@o_TKsI6y*BnnZ|vP903seyPUuSOEhm+HTct
zspN;OCFM`8+_{IyBWw-d7G-P$6>NhL2*%xVQO8XQ@`DsE(^=!QoNC*6fIr<$d66g8
zsIqI1%B=4RS+d;v;;Ymm>8SstwKy;7+#xq<HjPJ{c0_pXH(-4T+5PZh(!P3We_@q+
zfqI4h$)S@O^T|)DkB$JUbiLi1>*TU@m%r$9(Qf%?c<$qi-!q)Y;3_ee`+K_V&8)h*
zY~XFC1|n>i*{DL@4G@|xg+^Dks@Ir6g?03tE>ayga)y43edD=leGQKq`QbLGt{xlV
zz2Ne=c><%Z)~3f{gL!gyeSN5{8m{It9)h~$Zqx8|z(w>#nzy=9*4L;UD3))fWqvw3
z2Nv@<$oJG~t_oJRSCo{1_|a|Lh5^+NRjSze-t9heyfC$)%*OF%Btn)gH7vzu%2~=0
zeoQeMmuMPsVz}$*V@{BJS1$)>kOt!QHziZLUgalzCMhho^}Nge)BaMqxOQgg4pBQ3
zdF@ly_dcT4oRqU%o@>UcRV%+g%N;RH6zX$fWz6&SW<53VBe=WD)o{zWkn}0l^HMz{
z8D=jp5wn6qJC#lU=B$mdF6O1rXG@`lkU19%=U%+dCm}ZRD6ad36a_Rg1uAqCC9=P2
z)Tw#X%WR=Y%@K?bJ6cp1RN*+1q6eR_V*iyqQO?hiAatn37j$l!$=vg(lYDK~d1~=g
z1>$)9i4j;F>I0v6MrH`ww|Egi^bU4^+(gYggwm=HrLP+jE=nA8lDIosnB}{tTX=&e
zG~Yo2XyhK5;et~L55}V&;JLfSd>!=duZZZHP?5dvw<Z$@9hpGgqR)X-G(UTTwXQrg
zjo_S0oXiD+j5=av(7L4Q*N9&;>(>)(w<pDYE`NK84a(_#)pPz`VA{-WZ#iX<7T-n=
zVB~;E6AB~u7w*9Ly7k?!2yNdB)NMi#Q3;mHC}8eYf;z|h++KP#FmC@XgQFx4rBj-o
z@kirh(FpqHD!2SaBw7JPcaI0Zb9}BjgaAOOHt$l&Am1T*{F09ZHCE!fzzzxTm2`D&
zJSTU9lbbQac|&=7+TKEQohnHsgyqW?)Ce@j{3;93eJqD3`<|bMihdO4;it)O>J0w{
z_XocQfQ^P)Q#t+opGk~nYKM((v8f>9(cFK{e_eK>a$#HLk%dW`EzXDp|9s4qSvlk>
zxX=4<KF+Y?dP!K$wS`>)iQZNhw+@$&<WspN6E7Q^$F#)%Rz5$6hnea)N@7e?UAR(h
zIjKLnm~V80%8IZ5OycsOwxW3veP`8}ER^<u?5OXdfyV*J4ihM{<BpQWbM3jn;Vw(f
z`9lI)Ku9yLPQY;=u?y+=wD_cz$I)eXsi@w1#_+g5%X(WYA(iCp#`u}|dvH9#yx<gh
z$48AmA+QhG)X$&Y<$>)k$dEZ)Gl})kJwDvb@>M#+S2?S{#+`phZ$L<My_@JV6?MjF
z)8m<D)MI%PPIg^}7vB0U{x!fHIqwt<3f&tj=YNG@*#7B=7Q7R7X{5q=K10l`{ZJSD
z?6r<9!_VZUsd1Kf@8s(oCrTaaq_!YTS7PBliYtqsrX$XOv(9vRyTO_(bV*N<R?4?m
z><n<}*Gzb2om0hF(^~weR{u0gz}TGR?3n&&gqsTgtLWo~z9m~PcC(A{seapqx$agS
z%*r0aTHDswz2Q!*TW-p1ZO}R=!w*bSPx#Vam1=gS1?^hUTEaNa^|8StXZW|$nizg_
zKON~QAq)KBiI_#+t!VpiE&!0k<M3TUwA00bRtZjQ*4tp<n+{~=61&@{k-3nUe|WRG
z0Mo(Te)Fd8aQf9?e5Gh;3@rvH1hvnI`Salgv2j7vqz%FJ-p0we@}NSi9nsc$Y^1Nq
zv8PK~F+oMNM<njRu8+1ERgYu*HKt^}e43!1K+B3Rmkee9?RDg^;-oyMOPE9s44fUu
zlV;m>!&9aoR+HcKW_3yjT^#o2Zxk7#@i<h89D8#<mz?cRrL;L_bP@VqDq3zWJ7gYJ
zu33zf=sgcbE2G$}Yp!W~-MTzPpc0nK1bmHJkUvjIKLJpc9UE7K8WSVvVMfC>#9sS*
z*|s^6_3S4{i&V|5SVa{$%JlLmv|_gQ7n;w`4(1m9?ujPKC7Nrkmh=g1<WpIC=r_5J
zF$9&V2hIrjC{Gx$RnuC2P->tbu3HJ+|JoZ64aHLFht~MRBZ|6|J0ei~-k#y+jS1a+
z>9ab5LZ7ad1eN$Y>1^tyoM9Xe*5z|aR#g8~`YnhJOkllT^IZM>x2l1dojSG;9}eN{
z<?%ejkc&W_GFA$UxiSE^jnCF~U<q3jU$Cc;HLf`w3Rv@`*z1CVan}iNP^lUkhz%T^
zr|?~|>HuWaO2OD{mgAbwI;Nfcc%*NT$jcq8(IoBOL%v?><IbJplV*9oeTK6;ghMDS
z;4yx2SJc;iy9$)PixH!m_*y4UuYtJhnGMEWTPuxJ8DMRV@;{$}0%fha;Gdup7DNeb
zh>q#uZN?(a>HC}&Ox;;k7MI|2PP+;auv+><ZNZk?ZKmw*hs-SC2!-#G%8X!?!Q8Ab
zugxj2>KbbpLU%cqDond&dqNRU?gxbBYcdZ=oVj%k*Fpj5gGTKZnF-CV&1~%mxBuPg
z7{?-?Fe|0s{+YV!erhB*H|93xdcDN%-R&IAX6s#WsZP=;%QcStQ%fiUv6FRrJWAEu
za{!87Ne9Euj}yT3@zXBw^?$)?>7bChiew8Ti573$zGCR$*@)`cNioYh?Y-LU>2+%3
zKfI0~cj`Qw82>E0w9Okrn}VJpE!`8Nv*Wbc19Xf`C)z~V>weGKt)Nla5VM&_;O>b;
z449x$i~&%Lbd)3dv;z`h30!H!D2$qQ9OOpCIh!NJ%3w3==X`S@8n0-b#e!5{%hR;?
z?<d4K4z%XIT8m!k4^pMAVmb2HYS6|2KDK0G5F?y8ySf{rcKBHP?zi<>w9Lz5z=A_-
zRY_&^#Aa@Og-1S)H8v!&bk1<m?0HlDkl=L*5V9M)^84a>T-*Z-S1wurQ5=*%C#BQ`
zk}}^6aN+BfVHKCga6&s!zosz!$t*8?o5JR~=b2(w8PDMVnQ_$@hs)F(6y=@Hhv4X8
zfFkEW$Fwd;&sRQE_o--kL5POSUW*M=(7<Lxv-GQ;S-%z#Zlr@`g&RXFhtN;w>b7&4
z8Y#~)MNxitksj7fso}%rE6edL@WX3SIPyfavN}AoAR+Dq&>lD|!@ZkPnW5qgXXA-J
z<sa_MAF%Me8f{`t=7{}NlxLDHiQ=YOXJTE#;7@0F?^%iQKmpa;p-b)a$6{$G1aUHg
zM}k$36Ec<qsnHV-J;aqz`B%GT`E&UUPBmy$T=O(eAd9q(oMk1Y6_n_{_1zZnFrZ!x
z>rx(JmB?E5h>1bjMvj?6goc6)q18eF;m@U7UTisGy+tI!FZeO}lu^i5vCx9Ts(5L~
zAx8Ows1`=>pn7w0QVFQep5kQH@)Y5_x!j-92mNPld1Tb$-Gr=FFPz;_>>AE9a4~>8
zSCR;5dr718?L+!}rCx_T4tx?d880aR!DQI4Ad2hkew3GOI|Wpqqw(z_>dMpA=tn6w
zADnrTkE${IsXRR<<#V`UIMh(8d|}excz@i_ykVgAM9D_m`2OZ`%{YiH^%{mz-PcJ(
zOs%Jq2DbKWTSZ+9#7Wg;G}XTC?`2#FDfC>ZThhO;n>*~#uW-26gv1>cx!oMml*Y>m
zPNZ=g&f!3#%T!TXA<qa7&kSN%C7!pV&K-QoI)3ADIqab4RUp`Sq`ng!q<ViG?&>&}
zXS3{kZzp>IL#3sj!q!aB`X$!<8)sx1%NqfRam(+5z3?X4bNAO-$HRc27#*+vHR(O{
z9E{tY1rARuR)Sf1gIc?3x-X$eS5?WIV7OZ9yY9W@z85R#l(eIX+~**Aq*41`-|t>_
zqKqyUv3`N?!x*!}FN!D!>#LRix*ec8&T$rYv?N87fpalWH5A!!5iK@TZSwJ&VGz`u
z-b#<_a|xVZc3Q6F+n^Ye02Ce>w1UGL!~XDk{ZnqUUAeEa&HUHbe3K>FQ9=j#+!=3Q
z74w!{_kf}R9YAX_!FQV-V9WY~AGmrg{MBDT^;ZeSsZSlHmo6)){?u%;Hkkj`+{`?3
zJW3VqK1Fd~^HF=FT86$DAo;!0jJ*|pAhAms^w6;JP@6!hir4r8D5AKvPzlIasjJN3
zM<9TbP15J~%v0cra}ZaG{2)b2XN$@Z@Y<mD=K$kEzDy#Yd;xQ4VO9iHpyE~9t(}ja
zJN;WQ5RMO-zU}tO?d--d1V9&N*t;;xQO^|qR={tVc42r-><qZwjt|a^??IJwB|cYq
zN`2s=Giu)ulsiC%53jD+WcSJeEqw1>G;4-1E6UPZaHR3FA+Ot)92z)(Ln<wci}2ZP
zP<Mle9@9*8chU#IJ@$-L4esGw&_h0M@RIc;I`{*WU<xD)_*g9n>7XXw4HYR>hw+5H
z+4*39y~-qd>hNIiTExSR)(C~OkADmaYjtT?R};cJQ7c7|CMM-2G%3EzW@ovX0n(W&
zfG+{v>|Sl6M!k?6hO-5Qjv>37PMG{DJaUY1dt2wY6ip_++eVh(Q3|MLZcnjclNj6y
z9XS1wM(@%!pF4t|_rgtfy;bjds@>4T;rX_oZOo&)e!&|sQt_d|q<HZ;U48$0q)-Jj
z+X6wrnwLuImisn~FvFhw=q1}lM^^4|9r407Ug3TH0h6wFDaaHrRiqBlzFJay0jeFe
z)g7|7>>Yxpp9Sp43nyIEc4J6R#prC5^$An}k>SdfDE0YIRr3VQ>3)9cj6Db>EmnK9
zT~ViY2qYyJ-LUq39P5*d8547dWoZ0mR{ivNYg)Be?RHx{ex5fzLjrZ>(^3xghHM8+
za<V!SBLUdS!{QHV@J9@>{1TC$_Qd8<N~BRje<nrBmNC<bINtYT&qX0&NtE<txp$Q{
z#Vg71k~b29Y`c=>_ph4L5s%{w08CEHtCUcKGW;4-9A&9XM0<Obb@c~%%2|lIp3iGk
z;?crhCMz9WV@akIs?q(+D)v>;Y)LB5K%rD~1>$<(c%@(g;wTn4K^rX>#biBvr-Rrc
zDolqO<zzMKmcb^vST)g{6UX#_<Jk|$R+CJWhM)+s`p0;2{b(s=9&52ZU5QTWYx7;`
zr@&`nNelcdS)GxCR%9QeUE5pT0(eE*y=LQY!c`KC1Krv2hyC(d%VgsQT5eLfEfU-W
zWRkc(`WT{*Wc${TGgr+w)fk8}^@Oj??tAvQ4RtVuSG6c<x9(;yaZ_j##O=plRhD_T
z`o>Pp5=*z99=A^@><3TCD&BC;U$N;{Jb>rNWPSDOTW%(woRa(&+pV5kkoTzKk(Ds~
z!`D&ek!u@Y&b5UlatviZ621eqEm|%e5ZqEZ-tXnRU%UM#k5T68eT?>ljBEUoHQgvk
zK2%Ipc!^*Ho>ZIkmtb_#6d$jjBb9Y7yfB{MKaj80NhfPeaH`a<UIax!vomvU)muQ=
zPT)BM@D?>GNwK!OX2is9BUE(aB;R3TFwly*+-o$*8BxU|StH{+5eQnpH+yA!f_;$^
zCNZIc+P6LpMWtZ8kUvQs0jz;kv81E2iV^bpUT>j^ZS-kk#B|5w?VU-zz__-;*eczl
z9~l<#I{h$=^^})@wS*L1K3g1=#%`op_Sl`4xBgkFvAq0XBc9T>Kv$mINoPQg1qHWc
z@SQ2K5vNOEsY$rmOyx+4UpQ~$$H^>*Lb(uL$q;7CoF+Rf)j!x!^6P{nD=M_H2(ZCY
z;Lu2Rb9al#B*sPWl~>*9aXuUoWEuS`^ifkGp$A%jOC6E5U&*=M^vkcLB18Q;9^Tus
zl;VcktAWm>YdcPqNBg8t;_l_Bmc+ljL=+g-mv}<1Ne)jkeoD39{CsNJJDlq@XEXC<
zwW7FXD&8n~!h22+@(bj+37`H=djVcILc~ZyAo=)qZRt=yi__;lC}Q!s8(8$z&?Vq-
zjN`2}v_5E4;RP@bBd;~0<)Pp&sdl^JhQ8J1rC;U$U92uey5lu#{Ct#^atX|OVtz)Z
zb@NWMhNcvOSSP9Miu_s$k3FdhIpvxf1{RB|s%m?zLFNsGBOQ&Ww^d~THLZEB=bo!W
z+f=I=AC|(nZU6ZLiHt~G@|QCpBdrPmLH4n!(0r8FH8D_<X5zelPtI!1t~Xz{GhV8c
zk2Yif7X#Up;uEHqspB(&S^~&49k@gRNlXOiXp{#*7Q0p0Q8h*4c!`rwY~Sr?$J?HI
znqDW75|`;F*98|YDq>eT{@)4YPdqTo52S3?1U-HdaeB=cT1hf(^1EEQvlpxJYc@$e
zK}%k!k?b=b&o&;C$mOA0p;uJqvxGz5#TYD?;D5uQ!7Z`Gzj$bC3UU)4J^{B8pna05
z!$wNBLJ9WO>%$Gk((KBWR!@VjQ3={&WgX~J)Pg2Fcw*+Q0q2o!hTmfFVq|2kMQ2E5
zT?nHJiRF+HD5YVyi3>Ym`z=7r0g#EhzB7rR1>M@mDVS|}UG|D8S3XlVj<_GTy3Jdg
zdL#ptUR}HGJUb1!i`f;^IK-S)Y82)X$+>g)6<v)AEC~`9>sSKTun%pv3%Hh}2_pfU
z2D`Lj@?mQWWfopWH-~P9<b$$nvrVoxE$r{(%q2j8>-rY8$yKHqVBPZu1$S@ArwmgN
z+1@ReLrdKS4!wOlw~TEh>xYiF0P(HhxreLjzp;=lXGOjQdck;1^D1?pOH^wNW(#gx
zZm>TDhC2<lk{(<$w%;B)=Z9L1{phLslgwDm35llIrO9wEIbve!H*nF|AqB@Ol{_??
z=FYdDOM?MY8+Q&*$k;koe26A2mzNi%5SZ|}EDP2&Rg_|Ka;V7kZg>IL>e)sD`H0Qh
zjD234kaq2w+}T=u^enlBPo~R;$42HG<S+^KqrDw@7fUWBRogNH&Pv_uluVSF=`1l0
z%V{NDr?W^?uVKivmF@6}Nwtp{TEaUKm5VN<5;Jy?WZ!(Cb`mJj`%LjZF|ye$Iba*G
zz-leH-7iS>6y`ShJ?}iXP~ITuNy#0_;A@~gzF~L%qv4X^8zn=-sKKqx*y!cUE2aXV
z=EvT2Mqi+;ErcRKFPft$b@GUkT`QfF4H+DFk41$S3!GcmIR#AXvkoD@&CWpK;>5St
zt<K}p4q7jma=L$CDgwE?=_(|ZrWO3v=Prk>t62nHNXtMLwG5yfaqt0eJ3bk<Fex)q
zukm`lO;geF`UR?W7SJ5610+_ad&9L9v2)1U4LkWzn6;+v-EgZVAOLe!j~)73p~Nz4
zo$O{-J}dd^*hTD^YAz=H0p%N?k-R7JACxa(*4l78Z?*Zrd-I24bwjJ~r1jSf9`{#u
zC7*gZ39){Y_ZNZvhhe*fNXHcMKgOik^ovaQt>D5XS;##aG+)bKB|+qE<1XAtd`<)K
zOEwEA9pm;lm~HVGnWE6I$rPsHZNJ`8yExS~Njtxy4Qu_D7tJKk-LSxjWjfE1c;R`j
zVZgC8Ns%@4A}eM!`!8n%JO(;n0B1Sht_K7cH$|BlvVM1ZGBi~JGEBp-zhpiuA-C0j
zp&Or_y#NX$4+r1xb<e{Ek9ao_Yof6W&FHJ=x;S%V;6XV;NYU2?Y{<z0BjFM3^QF=9
z$SZ(Z!8B2|B`p%|2*Sd-bCM_ls<X9=+I*uzdtWG4_U!lFdp{`NCQhRk#FZ?l$N)TE
zY2C?ZpOp<oNzoJ8G|pmB<S33nk{%<iN|o9JEjhq2Nb37onBf`1d%65^C!Bc_Kd_ro
zyIxeqYiD9FPycEUM0)%EXHz*yc498Hm6>(k@T~t<)`L~OWQRQfe_P~M=de0i9!B#V
zgp|rR4e)gM59ix=tNn_gJa1DcuEv`h6*?Y7Jg4wBqDOu^p(JfwA>sPojrBoA3P68m
z850;Tv?wpSYx+T;r4a3wo$X?FNN6HN;gH%n`*%IXjH3!KGcPrkx8Tj6z<l0MMT~~-
zUh@t##erx27#=yy;&LfEc5B{IfSp?PC`KgmGf4h4ddd?-h#j#}DbB^)B%kp9zEqCr
z*w-#y8s=@G(>yQR$9nb?o1XY{+rrn57oSbO^IAnRZU{Rv3Tj<IOnoA~ZX;E9((ER2
zmC2i%JMTEF=Vni%r~}WT0J+)Y)##n}dmoBwujEs$Sbnzz-t-&EJ%EhQ1)<71=^dV}
z?Dk?nEc1Ex>(N|78r_rVtMgJx=R;BKX)lhHFSI|XU(5MoCN7Ks3!cyOnUgQNWX3mx
zE01$KKR(fDpVmr84o)h)7Ly2ek{>wAG`NB^T7;Qo9N?=Ae!cvsGg@h-*z3$sUml`K
zs>=2kkqU&M*kBxH-G25Jf=ULNQm#|?c5eOXmpPq^vH8S^Ycwz(G+rQHQ>@)|%KF58
zi2pjM>0+@vC$D~E$J&YKA>W10SIhkYc@DTgLIFh_KHw&0cj6bCbdnoGsvuqO`fx2F
zKti4-MeUPif77?)CLnZvHl=R5he)NEHnJjWJPj(izrs^Wj-<@`4?hXVf{O(^jdzuG
z>}`+km``PL@ka9|Q$H1tAlX^o-|ytPgzyHj3~6yVQ;W)+!tD@z(@g_fF9e{Hanx&j
z@7}t|qRd@fx8IJXF2xpaTodTVoy3nA2-!@MeKErPaFxk9l`u-gj>9)^RF^SeW+fyw
z<IX?ABOS8?c(0|SOT9k}UR?%?&Nx;tK({$h$I$C=3V>>A`Rcd_>Z9uAVb61)2a`e0
zrTo>P_E;|?(CBNp;o$}NV;G>Tb0PrZ*Q7CCKyByX+8+ljKhV*Fph5rqUyoLcy&EiR
zo&a*x1>#ZoMR&J1V>7%AJyNkivxuCw8eAYDk5cv6^x<p28h=%yhj&$h?LY7xPuEIJ
ztC&`lXQkN;#@U4DLkRxnD)nua7+5dj6Gc*I`^SXGRU=#Wg6GIK?}hs?mNV<urZ+?e
zpwPRa(8X+2F~sRKo|&Ub?Mga=*cM4~PB1J!cmR$29^)OlB_{_&h^Ntj*4Lat;fOIn
zONRn&t3!L;pGaUtb7Vjcm~Zb@Dv$%-vj@68L=`eTP)Ic&g+H2|8IiaXSqxbKC}%7N
zW^!>(=T%9vp08l17Ok2RcsPz+rWJjf6)Ah0YOK=Sq0hcR4RNmszH4hETIfzewN!QX
z|23@#wDSI}t11DfcX=vjWvgzch#)6E(O{2Wjx0JY5A6I{65*V8(L?<cWSF2f2N4FP
zFPzi>4&K!qyrUp82-?CxI#BwJ=>c^9{0D@oQ1xLHK>7c!DHRKRcgLT=YWHM_i~&#l
zJyiJYt-4b#NZ4dz3WuK58kqylWCaB<^!GcqazGfY7swDhWV)gZfb25zM<8>gurSaE
z98V9)M?{02aye4y;Kj31zJtcbP+*kGjFH|+>Q#Fe6Tw2nABY5p8ZvVPK>ImRZLNYr
z9w^8w3#tY&&sU2I^6<|=`#GntHbJ6sjU7lUWO;=`J+xq9s8*Za1|f)Sc+>dfY<fK#
zfmZmUKS*))r-P(=%pn-2_aWIVAX(Yl0<$G*4doF6&%_`?5m+rTo<4lMQ=rsdx6W#6
zqV}?JGgGC;RDLE(OI{hY>I~vxm?3N1aiE?Ctc5v{#Tv2C2jG!Mum+$LgDpj<E}HNw
z(1|&>(t{2d3;4})N(<FRBjpDl0KbSOblal?i7vt<(g$*dATZWYGf7nFvU~@+Xq}k(
zK%4AQ0N6Ue?QdvNq5m}NVSM~qp279d4+L;7L0_ClfG-TU4fx-i;L&t97*uG}*~5ly
z@X)p#fh72#56SR@1hzTr5@_cUY$MQ@+DsCXfL1V)0$s8;g#V*Q(WzjdF1UnLViPoe
zBTP#1cL3s-P#Rug(pO+=uim_Tm>SR%d$3HvI1yzZF``ArAVdF65YSx<6_<Pr?e7hS
zaHz=dJgC4%fFxMC*mwDu(9z|9-#LF20Y|yNFeO+yNfsp}=ra-EQ^U*4BZdBMp?KIi
zExY*m(5|!p0Gv8_DZx`0>8#)llYphT*+S3)%4W|w!5;o{omB%SdmIS%Fv+bjJ!s)O
z7zwWHz0*19<p8wYcnGHjozx@74ZerTU4X9VFJKs<(*Xw+5%kX(ZJ>`~3vqIWj#Cly
zfo35=rT8frD%j2B05b>hJ3-NJ9;Sx{rbm(gu<$ux<K|!}0TT2_0mGo(VZ>svF#f_o
zAH%^sNadlw=V0}o3nD{L$qzsmj1WouB`D4zMF$@bAu>rYG_fH11_;E#QzSy)e(xus
z*T>3>48AG!UOw1|L#w$W=QXrz<Y?fP7)a{5`wZcM_8_mpHy7=jjSYG<0Fot7o9}tN
z!21#c3k?~0RtwHCT5B*8g9{-uAP~5g30l4u%zk)DU~|AhoBSX5(LbBxpUv^#9y0%I
zj(;}CKbzy9YvrG7<^PJ!0m)KfjG-k{2G}g<o`RYZz*6|X@H4;}F$i_ma{n_c<$Zk9
z<2X5*7{F=zf2r|*jZ`=Ro&~hN5rA+zz!3Zx(_~ZO?>zD)zVV(2_m8cL+di0Az&y+&
zmjXTjFs*=fY&IAb2mPH3#9JlA;yj`AHI@U`Z8{OvgK-3`oT&HYF3{yb1oFygJ<+2N
z&jagC;&m+VgZT+Ow9r)v3uyZW!00nTQX+=hVRz_XQsqRCZ?>_t9)yhF{k8EQUt=$K
z0h6B)m~u|@Foe)&{ej(h!U0{9|G{eo{r#UhxWFo;MS7_IkS=-PE&`G<7+-KfUWEO-
z1Q~R&z<})hpA1N#&-Nel`y&Vp{uf3gq8M10;OOtrbs-0%lXxF1{jiR2fra>j=<x&1
z8_|Q6zo|PlObYEf7zz?+p=54p+l&BfaRX#;HzkCIk%86y1(>zL3-{>)e@*U{|H9-3
zb|caM?tefXv$kjEP<t4r_R}GB^9IZVN7AW3EAPPoj`N2y%;)7x>q3W08iVoRb@Nkr
zKZl}~(Nq5w_k_Oc|IWJrhVFmNZ{VZ-R~`k_UsbrI1unWUDJC$0DPI)BL$|{Z;66l*
zD567uFJe4c`HL>7sL-wz+yPk!lF0G*U9Ul?iqbRS5cr<Lm4i_trvW#2`gUmMugT5$
zUzyy%srdcBITiok(T{&N$3L6nzYUH3vpN3R9RF;Ne}}dHxmLgp^`BVP|6i_^KlghX
zk6W<Cu6szN6Q1~3yng)}9vcJhR=em!fOAhl^U3!DrUi%X1GLwo=opID7!1$p!ZDFp
z6)10p*rzl%_GSdk<QKip?>27T-P~MFUC;SihEg&-VBwVzV0wR#v!ZQ1M)Vh+rGBKD
zUf)Av_Y9Uah8Iy7r!dMvm|6G{{3s_(?@Fz}ox2x05E-O-#FKt(<WKDX2+{wMG3y<O
zwt|2B6U(1L4#Fz@3_LIVsQShI6X*|86C`1@LIyv6BJh{+-=&26oB;`R{L5Kb81zRl
z=!hTvuN2>tc_>^eAVD8^L;Z+{knPQ@N3f)iV97v>Xn17!;JHTuF-XEVp%LhR`|5=!
z4Hpsr@V5s_*qBbT-y$Xt?L7qp{qjzf0{nAQbWHFcF@JK{z%UVmf*%<>Xt3mBJUo{A
zXw80jO92DgrxFni)tG@~=1#~HBIu|BY9)kkX***0_ag-sUw|pNp!*Zb5v}^`foAe;
zU}L&1yl#%pK@Y`&pv|2Z2&b^%DI4hg=T@T|5Ma<HJ;0dggr01{Aa-E}01{lKLNtM`
zUbj&5(@$L*JDw#6^u`V)#Kg{Mp!a~FHj!e<SZ(w9AOq(=%MHa9epRz%y(=0ZlSu%t
z6!Hzw?ra?=_Kz1kg(qzL%VZ&I?u`a?TLlQiBfj$?hgA@ZkLis4{ZZ}pw|)4XNsG7G
zS!JTy`hJOei(h{3R}!!v78>)S^ck7<4l6<@Z_f;KmIn{0)}mM!QJ~Yq0@GVq4O|QW
z(?f+$&nW#U2|B$r==6w5PSK##LkH6%SdD0a2h(eXCk<6ToX$2QjloCaKRG=audq?S
zI-7DDZ!uXIpYHy&hh^;W7L9-x6_yTKOIw#9;Dv@SWWWt1SLf&^pEU@)sGbHy*cUJX
zy_g#9u4&%Fky?r5*V(Tod5s<L3G7>#5QBst?P8IAJ5j`ToJJs=2XE#J)v%BOd}4D0
zzt5lFO!$1ZMK(P1ADABA9<lC$dnySmV1&sDrN7Dg!(Wx+dw<)KHTo45mUI~hc1HpU
zP?+N>wjhA5T880I7*&TM;`bW7{rAH8?doLV%7!XOZ=uWchw_o;ULTw~bO*(Ng12zx
z_q>@%(ET`tD2%3W6u=Iix`)p$+RsvCp&|_r%n9Kojd4Z#7Q@eG^h}cwufiM~eqQ=f
z$XYC(X75U`y;v#fvN)_p)`wq3Z_p${=(QfhG+_CYdF&7xJnTE(9va#6lD8?<uZ;h^
zfE?W4c_rfaOk_XBWy+VrakoI1w1OXx#zg7s<U5YOTZ(@^m7h4WwZqYGK1YxixvL;|
zyfGl*b4@8-`D1=CkzTz>w)scSt1ytBfTfds<jDQ__v#2KI&6UBI&t<SBcI}r2s~qY
zp}SK!RJ>WPAe{J8YS~l?&FXn{1wInrQ>K9ot_8CUuLCBD#FwqYR5A&<^NlCHkj}n%
z8uKMC{n3xu;ad$$zGs?C2c}0WR9!8`UmUJigm8<MH<O&tcCaaimZT~(;f&i=8oBE2
za#Tx`i)4;3T6wL0VE&9DgCi31O?ZNKU^D)74ZfNiU5oZ9>;bt#tCp_kZ%9d$-cG5H
z{xDDgB}_b1{ou!Ub&CJCVNq+Imeb?si>u@Qp$ID)n#aeu`6a4WPkB6^t>5aykUbq6
z*&b^j?g(5O1!{R~BT{^7CZA<>g;Of~-zGEZ=DHHClzn{RA@*_p&FxAketTG<FC^uP
z%9;IuPauH7RT_C6>~73=l`}*9C$QMfXPiIdH~lcbr?3}prQKeyrOt6Jd9S~CTdZWV
zRq&Ey`+QFNXXDX&srvRNR!`Xa&Bw&2!FdZygbm$~cPGO03h4!{#%J1AU9=h<V;zWo
zg$WJ`I<BEdzTg-(V^4%n11g*NCLm!fkjn0s>ac$bUp-AnmjDMncY47&6NRE)iwtW^
z{>=(GTJY+*s&_7CB7>&1ceq(xWslSJ?b1P>+tPwm^P*4x2z~n>Z;qz>J7g6V@2Sn+
zSeY_B{m(`{Q6D{yHcxjp&HxyMhNy0}G)7DRkE-|r0e2A>k&uImt|!q`9NM=NrBm2e
zeQru^-jKECETMaPB0+Ee#p`#t`|~M;VWXvn{&+FnFt8#H=#qi((g|M!@j1-px<4*Z
zpPyDs!Kzp26y!<xWea!-CG9?!Gucu$6!?AAlbNe+ODCsUW10uh$>F}3UQx|Lw=t6y
z+8CToT#N2lfQKl^T~<_IM$q0~sP*RfCGYV<PIlHrld75L@?B`e6%w51hou;-A1*93
zG2I;sB1Gtt+VJ^zo$Nzn3vZsiU#BSy$Gyin-eUoUbj_z5QH)W}%VUK@!l*l3IbH{J
z^1)9R-cE(JvQB1P9$ZtLZlq~%w_Yrv(N8O!zCGnI^2@ja5b<K|XwJKjkd|kfdsxqG
z-wUVGpbwsfNe-%>1t1sxdUm0gw<zy|##1J_j0g^o=x>o8wz=YwTIfTuP8+|(fUHoS
z-~FxnR!jzFlX+HuBkQi}rA!K&uEg0cN5QDuq8K=ZJ`>pXl26h3ULGNWQlT_XYaRO2
z-n*lzi2d8l1+1+oKIyr|hNj>02$3dU965Y$b~DFso>hL@a#Fk6trXhkJJS8Lof*BA
zD7zcXbfQ}NIWP6$5YPKa^z1||TRAlIbS*wHf*gq9W$&+0ya1Qyw_9*b#1WwMk)RVS
z@HnnL4}XtKWEUf0803Lj=X~V3k|(X*V4FJw!~^=XqZvx)8upn`;77e`74s%J@D3c{
zaG^(jrhnR+eMx8}+I!(oh|cCq8JQ&-GkF|p<Kb3n{S?ff!d<NNlArPfj0?~v@L!$o
zTWc3+O=ykhJ6O$K^SkXN535>-5Z5yrxvl0P+(&y}9KW*E{9;dS<LT0>iyeKlH{&$?
z9b(152m!jXxq#yS#rlm;<;!QQxJ)-vk*O+NJC7Y<H3<<J6CT63VZ2D?PLfV;>lu;B
z;P!~%b++CpD$~u;4t}$Ye)P6rJohIk<_ue$zDsR7^)fEl&Jp=R@MCTRxrL0yX>!ef
zc6@HwFWTG3ZqZp;FO}1z?dZ0D$ONy=Y^cZ6DQb``oXFq}8M<UV{A}&P+aWd2k<I3s
zk<+Ad0-vPcX=T|9ZMtsJkV3t%%>>=%hS;<c&$bDV$udnkhd&w?^A$@=6r74sZd|j+
z-W5YNez#|Y9Cn&h^^wTW1f&JLPPrDtu&L+Vtfe;xGwRBX+~BIGqfm~)g(FM~fFGfG
zop|yv0UA`_27k~*Wl>>Ydbf6t<OwN7>+RblUa^@CzU>T^Jx%S|vC+d6U-!9o&7qJ$
z+nIsMIPv!A%S|Sll6o<mu}3Icg>^BQapk@ryBq0OeGLa#tzt5<$9aq$6sCbiHHs2|
zGcfnGCx61bjTzx6CH+<E;>`M7mBbX&(dl#^w#^(bgRy<q<sb}?UA<)lQ9u-tz=TF8
zNAmBxDEtgb1_?OX7C8aOF3M<2pKF%_yJz0}vAA20jUBSP6o}zR(O@`r2n8%(9{HwK
zc17`co^4YSQr((sM{ITjC>f62N95_GnaiJATD9)=`?tcjK_zBN>)om2WyS2P_DTC3
zR$e=`@T2NXPc;c?SrZTfYDGwOcCp?v#5t+@h<>L#>1>=Tx)||B<FTfGZv}2$de~=z
zf4+<_$tDku)%WVSUZ-iBUqys%Sg$tO|0aJW?Y%@F>hS}0e{FAOY`oD*MglFZ*7C>p
zuWgwRej>0^Wpg_12H5>CtxLO4Ah3^-wH7yjfio=kKtOwJy?+qSXoeH#J1X=}CWaMN
zL1l(HpXZ~ps8Dz%%`71P%0f%#hGbpIo#g!_)M%svM%3C9k>d$^E}5a#vafnI=QVUc
zn(e&F7xdfS_ne4uP@38C9JL}SLXM|eE_a^&DVVNI?&JaH#}36ZHBb80R;~mox*qIa
zV>I?&84mk*6UjEq?ova+_z}CFvtSbakTr)$?LPB5&p_~TkhR}V8)Zwk#7^srBHFKb
zC`|m$vt7<Tme06K0kpSeOg_Zg_2%+JLYu|*Mt}|Bq7_-hG3$c^7C0E51z0HK;6MF&
z!zk5tuUXg``b_EYQf`uqXl=4gQD2n9-15cMwkj+u<)-;#B%e@8&5GIO;1j>QMoCaP
zb7AfW`S|#?ScQY3<lvyN>050|PK@djTgk_L4ND$lU(wd!PgaD@a~KfwiD2_2s7HWk
zpFs;t|BlezrL3q-%gYvv&C{6R@Z?`fdS4>He~vF<p2+`7o%zuf6!Y;_9e+4Lk83q|
z+g+SAd)3u^@KOfc(Lb9$_k7qg8eykoR{qRDg@$ipzwDC%3NS{(;(G=b9Gy`$_Ykp=
zfxYT4+y#s>2^2>BCjp;mzJ;&>-l+3W4OgDUC!0e^1#N0wyOW;McS-tNIq1DkyC>}#
zd2h*^c$U<|POzRh7r-H$mzMcQ704{fieUBNxwxawsvC-s(087RqoyfF?wkpf+?`E5
z&iQglv)-GS#%A)hKJ%_S*~{GCutj1<n3*&jjw<9BSbvD8dy84bzL%^$%zIWguFL+h
zD(9Kk5%un^ffUP*e^7j$#ZY*;ZH@Dr8#zX03R?GyJ`2s?^FR2RNKd@mbaO+e+%r1Z
z&_Lkh=ve)3@nw}@{9GO_C<(A%hPoCJ@D=TMPb_E+fdKT`3r-v<!r9RC{p;_$u1O4<
z=9Z(dKdCn2Uphbl<BG^$-TI$ttGPxe0xH>7&Pvtw4C2lLv(b84+>+B@Pmina&R^X_
zHc1TZPvXXyw30eorZJzgy(S&NLY%sS4~#g~QAJhbHu2@Yz*oKBi;C%VHI4z^U^e2P
z`IwAjCwNDi?b1rYynsM2FYNWRFqqp=uQG`*gI#v*8Oc@%O_{8fd=0z9Dzh1$9BVX2
z-!Ji0YJ1ClrDG+8_E7pX>*b|V<r|&WS!Y){j3)1w>k@yZRB{~;r9;HHSL{r8-6v>Y
zbYMMvfv<bbdF^5Gx<4x%88(FOVX*z7$$J9cw=|}LkTg(E9->WX%By|F!rp*WLI$~M
zEak^xn$b4xc+W+ECG;XLEo>DZ-Y^t;o9!t`$iF7Fhx!JwBYM-Fb<&||J~9mpYD#(`
z{V_Uq`@6k98f~Z8+rpv!<(kduYGpcGs==sV3O~|Tz4SSU6uz>(QRt)~CCET|{#5ve
zu{UgqMgdNWUc}M1R5z5{a2?0bqA&MMPtju_WNkjA@=z5B&E!P@N@CbHL<ZfKMTN{L
zD>ZFejjRh*{w*(`Afqn`B<@{BL*Y~Em3kb;??^+|=#yFv8Qh%`W-om+!ZO_Ln~r{@
z1%*!cty~Iu3_QJd*}aZhp?{iscgap^me-FrhU4X3IG84s!P#ElF&=j!^D8`~=8Y7(
zBt3kl`;7&L%b!_sY6A0Ue1UI&a54nE<P1Kssfp9Sqh`=1;5>I$%GaP8%9*iHKK8yl
z-BxCk&SNVx=={?GSBYnQcz;e0u5n$}3vNee=fxP+FjPaikBxQ#H^IhgwE!=-;F%WD
z7EdNp?dHIFx{b9I8|CdL>B6{7VeIg&R{`e1&6fs#M;Z6X3&gJ<A4!liYrWF!i^>Z=
zba$c$_WxUP%C)+H4v{N`1>VTw?;_FohqtpysIS}>omW%kokO>*y{j$HFtu7uixoeA
z8pd1UsaHZ<L;Ouh$N#Ad!;8m}na1^9>TtXEw}G{viQyXqnkIW;HF6^F?LYiH@sQgd
zD=Y*uKBLOmm15e~BPGNcd~Te}X2r-c-5=qjz)RtU;rxUrWE&ED1_T#I;tHIKWH#Nm
zg90gHYH}STcU(|AEjcC2ln;6GqIl_4OHfcrcwg&|B9I*90x72#yF?5_5TV2*h71X2
zJB<P+INoDHvO`?Qm8Ix5^6!mWT<<!60Er-cIZ<v;yFhVOq6U(wd=6Eg;v{vC7ja%>
zuc4dx6XKR*=w@}<J&Rw*+f+7>3UAoMlZlE6|IBioZhOuy3`9ORo8J?GplVQg-K=sy
zYalZo>e8zw85QQWsQo(DqAI+4R?@;7qC7<D@aIL7%$B>oR;@7_s9h8npeC326;AOU
zJMz8oufL!5hcz8l1R|yslEGH-RzKIx|MgjyX`Q9A9-6d<*6pe(%v4{Dw3_ty*M$H?
zzj6j|WPV0bNhhzVX-`g5JogV24w8R!0dUR}vvbCt`_^l#=Fos}1JT?C%cS`&&n4H(
zCmw8yWvb5^wcbt&dase5?JRVZ7F6i2Y*$Ip|MZ@WmrP|#b#1*)QjFTXD%WylyDA&H
zh<u~SugFFOwC01NB%sIoBSa0Xhwr>$1Izp%_pwzMwTzr*WS);{Uz}`asHJ2D{ZWmf
zApKUQUSqd{Z!nohHbpQvh&>U%N}&}Jmuw*+24#J_U8k3%;<HV`7NVw!%vEkr&mW;E
z><twgi)oQsom45etTuc?fLKjq!72W#5JX|NfvkJNjM|SG??BwQ?j7k^cJ-VVT7h?f
zvBG12Ejoh?;&s?AyGny{F%!f?9{JLGO5J728<3@@AXWg&4wmeT>4cgg9Dh;(hm{b4
z<b?mv!IZjREC+Yz-=@fU)kyI9JbAI1ylbp`ipe0#*jWW=h7Orn^dG^A8RU)ufY!(B
zh1<%wc;Ua}siX7VTy?b>rut_yc9*g@4hK%R**~1)DlE1@B6rH%2k(R9SeVg*iFe-n
z^C3kLvW7_~eN}Fo4}e=j?7`D*(MurGX3)E-u6jKSD$_a}L-amjBLbC*mo@GK6)tn)
zA%Rq?QJaJOp&MQ8Pi50;0%MoPZB~oyq^o=O0rl;OQ=)$UW|j=6VKmTQZu5Se|32Rl
zx%<c7p1}Oerl=7I1mK>bk>(&mUzKPKh^E2+&b2`Q-~fAd^_YIJ3S*gFUWhre$ipYw
zqrd4G73vxD*5Us=aca*jz+v3=XlXo1A7oNu8tU+18th|Q375#@#BIvul=v!}%J$=P
zzK`nw{#mg>plS6ZiQ&5Nl25NJGOK=kms6jCSbjmO=GJg5LV!J>{)V<bT}4Qvw`5{u
zAs3EQmKZYKLi5ARs70>I{tmwrW9utY=N9nzVofHpMkwO9&gTwelCRqrXb5LK_-2Q*
z3i~}KLgMod>{F+BuBe@llyHVJ_?``<w|$y6kHaG9YQG&!^G(|{|Hl6L2;aHdiI4Nm
zresI@JIMoF5@axScqw5nZk>8>m~!p*H}(0akH>v+_$2VTOjBEWjw=DJo!$t7I>Q{L
z2`BF8TwG!oiK|8eCCYdrdsMU#M3|e0DBqS(5PZa<e)k3xS7Vt1Bzy-FERR{4(L(Td
z{Qa+yf~<VVfjN9a8zi$4>Qp&0FHvgMYe4_97eovc;7^y6_w2JWUh1}ahh5P`WIJ9^
z6U0RmC6`@)b27@La9ZI&)+<#An|cfm$zmoOILSKek;UOqZg+d3vu&?|qc%kz6q<%5
zz0u*mjg6)YbD5=k`>s+GpA4^#?<uw06K8rRJL9&ZXFHs+kTMC@cM9^AY$HDvpkJy1
z<=xi3fE06^LWb>?zTQu7UDKS)I|QhsmQ<;+Rrlz#kn8;PcEW2~A!1%{|Ie}{@@2hu
zD^EF!rpvp<M6=7B?{4h6h+T0RQ*4S^@*BE0_ljAWD(e1BE4*<}{`DI79ug{-$t?$B
zQkj>bje|P#Uk?_`Nfvaz(%zm7i9!5m^{l<FiZ_dO8n5Zv6%cv-?)ZUL2w5tJ*~?qN
zHY+Yr8vi{wTp|7kW3h0+n*=^}Tf;+S9kZ!szF@bX6M7_FC8*simtlGN@F7j16o~%*
zUPwhG1q!Hr9+)F#7TPb#IQal9oylY%M+CwAY_<Rzn(Z2yI^Lw0#O)I8-m{r!fa7_u
z1xOf*MZ=U5Xyl3UWVZ_Qghs!M)ok^Uv|qf4NVENEMeB}3=NO(tJGAH*Kh~}kHY&Y6
zmY2h#^F_ktylgOx%TaLQB=+|$KVit){fDIljJzkq$@;$3Sui4wVK9Eeq#H;<GH5;g
zh%F#E>j-NZcsO1h|7Ik&G{QWWSxdA(CcQO{2`eo%h0QpjORZ8@oL-&jIJXCxgs_f(
zhWofAg7h8dE0shIgWz@&9@z}eD0i%Ji%~F1!D3^4X6cFIi}ypO+|{z%qZhqwp1Q!O
z(O)XHG`jpAEL5x*zayAs;ii1XH_lU~dkq9RK>-Q8hFXPIETQhVWHv``&!LbtkFF*%
z`n)nf9uF8jbw^iA$w6tKpZ;E#y)a#DV=s>`wpXJCsO<JV-4F&+(#lwjR3~2!C6hsd
zj@Y-7a=Rlfb9@g=LP*20kqE&N`aA&UR$_R+Au%C2K8U;~!%$~5zwx_y{s)Ez=NWI2
z!4lWYB0j&<b+WX)Df@&Ma&wE*Z`sXclQyqNfctbk_AL1LU9SC(bMR^8m?S|QG$=;v
z!OZr&Ruj+h^iv1S!0Oq>$Pih$3qCiP&7*)V5c`f2bmGT=Hw+M-@jA#0fD`{&vGXHH
zEo805m)~sC(E$CE)E0>@8_KT<uj4DxjbBqw3%>V{f7Uh9z9sV^;hjcY3KV_b0|KTr
zBsONX6;~#1##H++nI{t(mS!6xaTwA~G;2L-T$Ris>}K&ywA5;QgBa@l-!lMz*221c
z(gcvES%@~W5yY{-bVbzNPWc%(Yo*PJbUX3*$?Ln%o09q<-W2aqKKm-0-As<)VgiYP
zr9!7|29c>_aJB8~rKY-M;*r}pkzCE4)p!4cBvq}tJyOCoDhYBSvQr&CXG=>>xuNl?
zdJp}oqTwmSLN{=DRm6XX`k~xNW!g0p_U{x+<xDzf+D35|Le_46fpTSq*fhJ?Xc9rg
zM?N)vS^S$qO=G5<O%~JKnoDD}f0m@eFx`fWFr<z@p8eV7DkG0{`nB$@8>&2H49wu~
z6=Xa`ilvh)7pr9#hoO~i@Se|rgBX^>kN7o9n0tzboJV~^f;^o~DBUa4lVpF8EOft@
zlmuSbAIaHzDgLEe8Kr^u>5<nPeNx3tZM?Xen}ZpO*NZ}qYcaLuakwk;An0s9>}NI9
z6LoLQJ*a#!q3AaGT#Be!3d<C0F35qGJU8~D_JjD~MS>o|uJrWdsJ=L=r;NHS0pU+W
zi_hhxO#%?_A8ZYSM+0f3%JKXZ%b(J2w^lC-Fe7=gDkl)uG>=}_S)BBb=PSw><;XD)
zjSzl*OC+&JHO1sW*`UVAr#ZRFySJY#5LflOfTvhY>`sE;U<Gk!vApuAqcnLvdL*AN
zFS1+mmYBXBO^VP+bZhvq_(VpXNx4#QzZHcQ(q@S9@wn9!4Qh;5iGW;Fu;HtdZ@1V%
zIhXHbAU%#YlY5jOtwulEekBVxN#N3ba*j)Y8yKt@%NE5JKVM};Ae$jL*gGkZOOWz8
z9*rmsd6T?Hw()oC8fq-C9`I3Cu3eJ!ma|GeweUPIG4%1y5<TL3^@HL~QCmPIb5O{|
zz%V{|`}s&gB4`p#(dN*#Ut8%q8B#rCp_D=ranvP?LhU5rtgy6>*;!Qqv3Vfv7X0f<
zi8cuZ6PY?zvWbkx3*Q)yIP=6|1(Dr#X_%15VdA6g54Xc}t_DOi%b`9`@cFd0srxL%
zqw-$DY3@D3{OIrh6lu#bed>ueazVHxRTOEB&7A4g!FA^k3TG2Onvk_UNt^Ru1=WHQ
zV>aXYAtP#E<;UOiHI(|<q2cj|{7j&;;*ZMPv#-str|ey^R}dv2jp0NB;&wW`yUPt`
zp&fPy?hA0D=X*THK`eu7b<(AXuS#GEieFjHitEkZa(;0<6S}|IKT0>pi#svh1SvHW
zAPuld_Z@Fs+s;NgnT&`mT;zM`Pw+}e(b+&wGzKFVq{^rQy!w-9T&ugnTtapx{a*93
zSF=$*LwLlgr&D7YUUfKtCNkq-o-L(+@vcXrtQi~dBkkTF#?ly{sO|O#@Z<g~#bFWp
z4FsWr0*AbhgI#)@q?e?`fH*?_jtoceoyu`jX9|0}LMbPzP3aa|N}y(_ZoP3}m01sO
zscTd|kNqfNRsHwAWZ3#0+TGrI+X+p*V?C4j&m43Xql7Qw=!Lo80~0L5zs;?C1fHja
zl%{|=`_K%s(>2`Xz_vx0Y+&{aizc#~v7&#J)hP5sw&US!Qe9JrILq%*cEzS#IpaE2
zeb|A{7H$PY+Gnr_&`>y%Zd-^`g(Y#Yecz4!AxG-9g$pW=wb)}1usR=wK`L{*kA}Wa
zW`Qm}k*u)<>*rAi0&&v0;rx%o_N-)#VG)a=l8PCoGOLTpr20yo<S8nU0hKfx$}GU9
z$JOGHXv)lBMo>yh>`X6)CMG){xz2yG=*mPrb%q>ccM|0N^izEiHl)uYqKhwa2Gf^D
zT-IBGNuXo)Joabeg+!v=1)2Mlu8GB;ZzII(@mxxyUZ=rxHj6Fwp=6{D<v7?7Kn~7r
z35-JP=7XlUA&vr@4g?Mk9NUNO_bW0KDcC#^@nf(2i!#4$k}AZRUi#`rLvY!`(a8yu
z%Ay0OqXR$g#Bd5QU!XR254%_GRDbBoi|Bx8tx0Pd*Tod{f0KD5US)(L$MB4YE`^r4
zi$v{-Nr8f#b=fOdXGi0@Un%VU{C9a0^VUnOa^k2Qw&Kgi(xdz@RsNXH90Ljv5u=`G
zd1(91p^W5>s>u^8q)Sds=#~>`$Iz%^l5mkDw~1GDVIWAxXA_W$Q;_rc)i7z-k9;yJ
z*J=&A6e=Ch^MVyP{<C_lhRG*}HKL`_5u7)cM1SF*ZkO>~@v)wV3nLNtm!%RU36CZ+
zNRG(T=n+=W7S#D_l8C;O%xJE!wJsDt^BgZSaPo-8t%lkk7_2{}M~0>@N-DjQo;CdY
zf|7)TPx#K!{<5DX3TH5Uk84RMVKn>$3p9PEhx=p66~kUcET3M5kCk%Dgh`@<h}ALs
z1AmNa?={U<2LeeBf1};=r)z};aMFAd#B$eV^s7aO1A`f!V_4BbHm{CA7%hn6tNSYN
zI9Bh90#dFZV!kZw`T?VS3toxRZhhnyh)nD#5z8dL6zL3=i`k@+BhCYdoyYtXv-@DH
z=elVM_6PMH^A~Z2xL#^|y-IWyPBgfTnPLR`nuYCeBsXKa{{sq00scuZ;>aV!uW|l@
z66?5YMb&|r*TeDh{34)UkV-(>gZt4JOkx5gM`W=Mxha@;1wwl5w3^k=7u;86Pv;;f
z&Rc&PYCQ*(m~V@Pm&m-%(_h&QI*M%4kMppBSU810@H{yYPs2&xtoI91>L<A<_e2rA
z$=bX7HVknFs-&M~aXrsdaE<wZnr4dWK&tiAn5hy?*7UJEy9>qkAlrJAa@(Tb)-o^E
zW?M&elv2m^LJ4*2#p<X_8^}a8E#Ft|FYn5$)QfX#hCbCJ0x7Sq7?6-gmxFC8Tj8-^
z3Sxq0`rtSzvp8K~uzU3-T^V1)3#>rubVt|kM@>#FZu{x?Kk^Pf6CV=2r+#-kJE*Iz
zSXWZFJ*oXsIf-FL)cII{&39vCic{kWx&1s(Iq60>K1w<`RwQAY7*-+_CTYl7)$8y-
zgX6$_4;%;2{vD9d@NYBy2C<qd&t9j;kz7EU%(-0d)HU2UEYhROKPgt;Q0{;YHX+y>
z4kO|V=G*pkCj8bYza&Q{kZYUqqwC(`>UZd2k#@9kk1rVqzOl(e;Ez&RwOoA&M&);o
z#5xrL^)bRQecGfH71`ZziDIi@)f8Of#y}QRf032o%V4KOxAS?t9jv9W!E_#3>zH2T
z0#t%m$(uSMkqtbvL#hU(#h4N~8EhVH1}uY$(;ASIYm%s5@{5HF(z9)j;py5-(|bYb
zt;5DIg?8EYRBC!eye;jg<KL#vcDfZaw5IqKb}|_uzEoA;rqvi;mDHLY+G@3V3lc#N
zV)k$)Tmda~xk0)`okOn1w-_D8E)4k5Cm=2GJc0})ie^4g+!+sgw+3}%jNmY(GLp-;
zk+sC>V?4EeY%$*3NB%}m4(_v%h$B<4-2cPgTL)#;f9>LcsDyM#gLFxEcc_%Klr+*I
z-69~}AT1>gf^>HZNP~2@NH?6%#^?LK=Qrp5^LJ*>AI}Uk&h5SLz4xcry4JO>#Ud4s
zCz9@Yn_tx3cSwXNa}qbRIbGN&P07vF^CIm!!~EpQwBpCx1`zHwA8u&0OvQOch-^x_
z`wAXp)x(9Gh_)ER$66vwq1HcnsQVb+AY6on&?BQE+d5^Lfq+-ou;WkAd+FYhL%V|;
zK4tBdiH?w8YFjP7HndF(mHV=VY)-CqN)+DS<<-CGVm1gm_hRMNf4rf_eso9E|6G?%
z%k9qnw$}WR090oYN`d_S&oJJm_N$um*TnCfX!A+Dx5s3+$8xC345WBsnqYndrE2H4
z0|4n6%>8jTY@L~9cCsDG(R!)nFYMrYR5=}~t*5<FE*(ykoz}?zxzPW8n5&)4xgtLN
z2obEVO_5S#iLI1MyRF!}%Cok&$2VAN=K5<QdhZ4bipvMQ?;2llT3o4BsO@b!IL@cz
zb2X&b;fyJzo2Fl#FjksrMo2}x$^@z1?PfM$+M8{aKkRbkktYjj7sapw@9rb=2Snfe
zOaqh17M<XL+*&5E+)W#(OVPfUAu#Ow1BdGDRI6fBrpPRBB$LX)Y^95Ho9#>1Z|pgG
zG6e3f9oFwAG#EP~50j>NZ&o5yW9t;TXCo!mOxw@8?21O?cE1Vz<f;`gvSS%jd<;LU
z;Ip<Dn_WxN>fxfd3zl22KyJY5gUblA@YSB6vu+R;wm?>h=;*W<vzp;9dv4K`L3qJq
zhm`qvNQMYgA>F&Idp5g)M8J$=&U3QyFy%zc9a&IIo`o_2@6Tfp7-)k}E4;?6G@l-J
zK`LGNePbEH>a7|c6$Zye6Y{hq%W}HBzus=ZJm{us!SY40Odz0tto5m`dJ3LLSv`Er
z{b87$&S}Sr!+Q69mSerA+<gD;vt#q=E$=+UqrY2nO^gT+SpA&pmE<G<J`8J=a=3dI
zI3QsQST$d;-qIW+Z<KPaS9(P3>9gx4Xu?zV;^K-Q9&e4lOkFwMtHTff>_YM@N2~DL
z5AKsQI!Ebu1VWaXQJt_wVu_<{eh-f(@SK`%C*FoWmfn=OXNJLOps@}OOws+=>^rg?
zQ_s~cmzF*;GZq+_^uE1#%xR&dMIc;o<-zDa<jG;%B12*E^$&c$jX@}$kSOgY4a4dk
zS!j3tiJ3*LD$Qje=|<(wPYE|M<uga|Lv~Xy42<?t{IEhcPd7BofP;vh{&q3V?+IUv
zTwe|ws8m~HmD#;#1}uo5BlY6r3Ffc0V~o&{+|RtopNwOvj2`BJMLzognMtJO1Vq|j
zvpfn-dvT`Tnf;}55{=7dkx92^f`x0NSA5{tkelteG1-F6LRo%f6pcV1<=y8}wiNr_
z8%u5!;`RK<M3AOSbYpdU%^6TVXNMIqe6`<9afK>wAMvaM@bG+4d=*!}$;I?Mf<^y?
z346oOJc7~dDqm^YD`lu}*xBb_VX|jG!#$3}6;6B?goM*DUB$R?4lu^CYCZLI<09+r
zM@$Qz-k;r$Ev1h(N;0);?faKaXv|VH^As`Kr&73`cP2{32K-mpD`Anv?HNWOFzFLK
ztYEND^XUa)rFiZ-$spCu_<^&qqPYDHVa!$g;B!wZ-JR8a3q2$jr<1s6yxv(6_{lP$
zBTs36m58TII@e44k}&~95{{t2M}&Z)C4imCQ+rq4jn<m|k<*_U@3#ssb4l&w-YA2f
zm3`A--M!=7G;)|jxOKT>6DhgPT_k3iy}~Rx5(zj0qhinOxdl}Zl9c%Qzgte#ypegt
zrnV2S`Hu-ohAs%`b;E{XG`@h!wRocMw3x_k<5gO6M6hF;zMnB!Wl5>4g+f`T|AU>}
zR`T+AOMqzizzwE!uRO|`B?t$9vSfZak6zefWL2qRXRewkPOoxVb$B5(K%7oBh?oV1
z_}37^WyawHK{4FNFP^N4lI@|teb5D@HC=jMo}6CqH688kkt2+_UG8!3n9XZDEuU+u
zRBRTPCzSy4;Nb{BzKDLYl+x`h$a5Yw+JRx-9g+MjgyFGc)Asgdsl&Q_)^jaxHyqOk
zE?gfsI+O;rD)UWw*v8MOT$`iLh{a_iJ2QTY>!90m`$ANar9jeZ4_PPMgNZ@z&9J@X
z#$A|Wq(ZeulTEivcA-+;VkS=OF)_8f<^Dzvp0bE}6~&F#&BV_X@|SMkf;Frsnom@_
zw@Hl3aBx-uvi{M~lN{4QwLS_l;YUQ5Zq@}c*+0wqEp^Laz|?t?A8j($4wlECrTRAC
zIrGbd?)`ykPu-(ml1pupjT3sVX}pGNn0vFe1Ex1`t+!EsYn){%EDW}C7>*_KczxCI
zrlT%xU;8v}Ch+NRAP-(ZRr2i6*wkgfSaaHRIMcC9npE0%(F~oQZslFm>6*TXIwR*@
z)>z|am6>Y9U@CuM(iu-UF?(3>(|VnCxn!ZVDgMM4br@^M_*iBj;y?a;CC@$a$vUZh
ztv#CJomVf?YqcNP$av9&J$7(#?>+!RDH5o=6+wBiy`J#y_QR?i0(%Vz=Y}ANo)~f2
zz+bUZp5frg=%E`vlvi6FQwGsDfV(F|F`rznA32x~0drY;V47qS1cYBhsF;8Qhk{P8
z_s)bIhx>2rh`J2j&1T_STuyOM+-*N_7>0|`+Vj{qiuD8MNFD+Hd+SEFP9a;dmgCpH
zp(a`zURDCla<j%`#=L6B<yF>Y-rf>t=bxTyB$R3{bf*j4^a(SKSK<V$=3jI>_iN*x
zx$eC|$@6ObT3(_W>j!EED*Gcv^j=+^dNL7ZoE-jHMG?1eo>GEnB(LD>oPu(Z(1fWc
zQKn(37-X8iTRbM_cZ$6Q4(KLO4LypCG3gG^aH3EYKWz1r3Nm9}6Cml|aVfQNS3PZ1
zY;99H=<O5prPl1SZ-v6;-HDEZ+dQ=Z1=5a>gJU;BS4)1g%=wXPkHCUABi%rkh)=u%
z2F{x1%aGuSv$6lCWQYkOzO|K0Cd1Qmat;QGs~2^K*}vQD{+zY>erv{-6}Q(_kV{}n
zRew6~wIP?3!tskiIQ9uJ_BS(_?kTzQAWZl^0Hi?8%KP9X=(#i%EP2dbH#ImlSYE&_
zH@eg02eNdycC?{y03x2*Qf6YC{%Ey)(gA%8zcWcv5{KTVr4Dnd$jzU2XL6CA7ng^H
zjcm(jz^s3%AgD9_b8VS-zooU&Y@vy{;TN0frUmZyd=5jxyHwi-poJD3nF=F@%TNHh
z&l(uC+BKhS>v(%|ADG5x0Dn1qG*`iulht_;sW0YADv@-dlpXS_3PaN}j(If)$BVBT
zy!tm>{R2sIbOj&xuyu#u$N*K<V@;tZ1#&@K?}wTJS=rx7iqob<dzSqzXkW%#vbh5y
z#q0F~HWo^CN?Smq{qzVntr<A<LFJ}H`WHM-6%{MRRvhkwDlfaUUQ`|4s_)fJrZ~Uh
zJUus5P)Zo=?OGAY-J77`{hX|-nd=G`xxkHzF)#=pfQq7yhpa`)WyU)U?-v)jRirjc
zgs3lj%k`*knHFza0T=J3@k5V}2A;P@c`$JAf<<U|u$IyaFX2f49_mN#BB;qhiv)ly
z5)3o*<B+d&&N(h_=bM_bMz=*@#li8odb;M^X<stGJMUVrLyY=uIPr|xbnrzL*LPhU
zB9mAqPi_=BBGXt@PJ&vJjzmH^z)qTydQKG+y#-?R`q*8eNn%jMy{hHWwB={3g!c;J
z$+|ky$hd=S!3Djrreg)l(_C)iR7<|qR>@4|^8iT5tud)w<CVT$@@J7xVAjKU!JoBS
zJ5H*0sooW^o@WU_DCXG%xHMklAD?}v%pzmr*qUku2xaG$$~kZV;;!P>_+16xfLSD^
z=*ch+*dCH)mkHo!<pA9F&`_qtefw}ti3@mg6=tmjh$HFGTt{MAM_!iVIL7Pm>T6Sd
zpGED6^Z)^j4qX?I9OYd3*E6SbmLapw3x2Ubo%0%okV6KvCUBzW2MO2oWvsunAcAun
z4KAZcpLAdu7nqsY&{pvDRkaIhwlsyQWQ*gD`nhHB#;fhC2;^V*!l(p1!93*@G-<h<
zR=WIOdMfK!BZ6hpSPiLJO=pZ4U!jolwoqV(Cw)I)A14p{&4?PX`sxv2`H>~TkA(cJ
z0>ptz52NNL@w{tKH2gC$ogyv*Od4N;=pA|bT4G&N%gKy<^^eH_hR!yTE2S%cmB<x7
zkBP+YOUaP43z#{nAhco4al|K0oy<91gL(ouJohemO*#y}==O{$OU_WFZ~1KGc>nh*
z9f{9e1~wa-W!>#TjfOOGja7*6B(1iVPXY|ygF;%Nn{U*NRdp#*ddJz%dn_UvCJLgb
zUCaB>P7yST7<tF;sjYtiwG|aj8pv$C^KAkCzg*=<@u3e7k+hna2z}1BW_l0P(lm?B
zpX-0t)xrB}n$5VJEUX+5dTGT*h~zf=-lerG5H$IKegLCKDk6zKEmd@$|8VZvHt>?v
zc^$gO=#J=)91}ZJ1Ph-qW%BD7&?pPKRXK75a#t6YJo_iM;DJ#CSQUA|^E_7RG!469
zX%rx2MJ2&h(DT~L&la@WhNF*cj%3{4Pfnu<F4m}$jW_mdxkS+$AzeCZi2aF0EcE^Z
z<4OnJ=Avkp|HwsS`8DvZbB@q%U_s%*$o)Q7wY}Cz?OcBc5LYn6SX{K^v>3}eTr1sM
z*%~s@IR`Z4hGWu+;%R#0>Nt`@-SnaKLhU#Rt^a=JT^|7vlAj`;^Qj18)n9Nv#xxr*
z&l)BL$m7w)TdeiY)@X4-hzk2bGacbfd;ICaKfd_F1N*60@RQ)|X+ro`VtZol2$7W6
z>hi%BaU{;w(Nye$m=R$oI7fEOcDzWjyJ<c3%}aNOSZ&B5se7l<JoRekfgaXO&cozo
zg6hly)tEic+OTnpgyFupUascWD*SM_7hl^W1>lpun=nS{n%5%MBg_|E{GPk)r4{qI
zX$`D5+pRIm5^hrK8oh1c!tK$E1l;Q$)$G9Xx)Z(F4G7S=!IJ7Z61n}HHL)GA3P_$=
zfZDFXm3wJnEHg+NsH$5e6_=JTc5$>(t(~nB))uK9)dCVT{#mFD@yTIz14gQvg%5dj
z9$khUW)Vsrh%F2Wr?Zgcghm&o>0@8+Q>uvD$Jf5ZEyjw;Vl3~Zdbu&&PpIZ9@CZ~W
z=COr^BYP`OhRtg^N(qFr;4>x2#!!TE=f<99rP2p8YL&Ns&eg6vj!<DLV~^G@+r_Ef
zY`?KH$SygX>5EL+r$HqVcaEcD2-$uS(%}2ER@o+T=uwbd(nRdWfB9i?m>T6~g2n?$
za;Mh7MCo|5+VSm}0~pVzO?|o=s)xp7LgpPt^h%krj08W(>n{V;hxi<~O}D3N^H~;&
z#Lnj3oBO`P`nmB1<C>`avHRd!hQ?F#5WKc5nRK}JSdKC?TCGtfMo$;396@!wmB+yv
z2|)^;&2(Cy${>4c5o-b8Fbk!(=_INFO$zdQF<WRavu=aT^Ecy_bIPx89Na$srMW{^
z0~>IEDcW(0Klo_<SLVht@6v|eZiajR+`c}-?Ewwx&%9wjIJcW+G0|`ClU^!cL`1Vl
z2%W!2Ia5Yk@3u)L01rGI;oa{C`_tUO_N0}WV0oV%PQ)uC=uSg;^|_zFHh|Gd4AB@M
zn%J;8`yKW?`*(-#JqoBY!#Nf&`MiMf%@kHYZ5uEO%G4NhXs&$SS_QE{v$pd@wlj#k
zS?>5i8S(06_(;F!$}x~ER$QqeIQ8!&7E~PlTqeHR9x>0^=YUSpG!)M7Qv5ON04VOC
zb$JT;KC69<stq9&i9RER3zwILZEA~lXt_OVb%%9K4`<-M3Hj?RI~wcitsl={*^Hhe
zwnMmBM0Q#)SkoU3BUeS>Xyl1<QB#xnekard7|evc1~_5gD9|@AC3rRpoIGD&EJa@o
zPg$sVs!8|gOTtNm#V&&I&68oK_E7szgs@i(Y>K0F3cHDXCU;dcu1rh^Uo)@;qvZu_
z$xEfVEwu+mT+KvKLfV{zWVVC+y70z#;n)cudZeg$=2Lfa*5bOXWkoDx4I5&5j(wVc
z{+En;bm5?`RH9vLj0}ph<_rnlja60FP#5QKzw9NoZ!k-sZ4fNT79zVKwZ92aRjHah
z06x{1wU^v|9^nGIx$_Q(*JaY_*(ExcZgFP`ts(Dp>S-95>@+L$dNx||q8&P_WwA{0
zb@6J51rGv{8MX>#aMVb<gCCMd@2uLQf{?%$uh<W)l<M~Fpd2i7sczj9%ki(Usk{!q
zaIZ%?nF)36e<V-%;zbJsbA<jV-7aRX9hFo_1RU@-uE{80TwZtdGTHM!>3u%@45Fh-
zKuggaDFN(RO4R7RC_*RnL{@KmGf|{ea0_W+3W~gpR-#jQW116h@X@!s0&JR(sO97d
zin-U0W(Ol1B!c+O#y(MMCd9n}Vxr{SZ)rl)MXRx&GaYd^mB-^gPkTP3FY_CV-5S_+
z*(|=I52S|$ooN_!JWj?<Ic#mq#X}YAaq^zIE}To$HG4d~(C`kIG#@Wg02u@^#tP{|
zlEpJzNO|?Zz9^-r0`P$~ylw0^|D#E~D7U-YE9PJewVB-Lu+hhcy1TL1eZZyqjQAh&
zXQCAqsisr;leOa;w7`7#2&co@-x1Niz<R-S7wwJuvDa5{4WiQCms`>t9;+}HJUYI~
z?C-nf3WQrpo`v{P1p+|_fa{U~?{;bFlbQ%wF}h;#uNQZLCrOV`@kE_t8J}Z(gEic%
z^TjuD=maRs=x*XmI)$`kBmSk}23kV)o8BbOLXA7G>7J7uW@GGf9@p!#TtIIV>LS*C
zymS)z7V{rqYJ>?|mjV8kZ_j($BamIOZFYAWoAy+bIQd<hL+Kp%Fcl&M-zdSYyu~4^
zXk!vQZ)qRPJ$vh#Ozie8T!l=w*ybGhTZh$PYU6C=l}V13;NmD`5pEyb>CX8)t9^=T
z1g*j-pAr3HrNU?r^COeJ&CaI<gn}}g3t>&u%|kV5>=yU{UcXzdWX>JX7C|$rzFotq
zc(3^fqe=BKdA{lEi|MESQ3|FPd5TuBEX-;Y0T4$+7_PNQ;iE;#cB#$Zb;!|-y!!1g
z{VD|=crNq^4!}<}Gh5aWPxzcV=eRpIE2~Um4CP2E$KVp|5X+x@79=RE`OIaUu@uW3
z>u4s}f+O5TbUnR1tTgZ%VzxYcn;y*(0bmu)s&Dq=1`rR?%Azi?7;xg0M#d~cG`Am&
z=otlF{dSMUyrh<9o6Pb}V6>wNBVv^mN<K=ZpH0Wcc<(qAYOWMTcv#7rd0BYoyK}rH
z_=&`05kn|$>qnxVS+yeL<#I^l`#(Rc?fod7e+z(s!V6bDE6N*nZ4#B43@?Fgt7Rgv
zU7tWSIIu_|p4;aq9h`-dz?e^7L*5~5Q9D#i@NEw`%Mx^V)~aex++G2-zPnYQra9cL
zDklOux4Pp8-oy2aBvq~KYMqiHT{<v-ZA!nE3`KYTxf~>9_tvW+>!*CODG%a8o2o)T
zpQJXwK|rZMiG_$BuE3UEirp7<1O7s?2qpJ9w&olw3gHf?nTqP%q3amM<6RH;`cQ2%
zby4ny>6@)U4ue&Z`b^ymC*VFRa+~Ni7;#y7?cuzs^@zbJ`yx9^(4`HGSY5Lya2!Vl
zBY?ncKtY3s@+mEzzhJ#O;urvp<9iqWfWqEY7H<et$~`s!Lx|UWBD2IwvyiZ<sqx}0
zBGsQZq7w3j$z#sS&8fc#{0Mo_=HCWZ4FT*N28-!r!BI-!*^b8rQcsVDN5td-PhY5x
z!TxMRZQs_}!q7`od?(|RYZ-!QElJcutz6avZ~EtN1VXr)%H?$)d46O>B_O5;+lG&b
z24Iy3KBORk_2m$6DatF>)m{+)JyXh1mNhJ*oMWo{1?UX-n70-&z#j@UHWzi|N&iO4
zPVGdV#2==K`5O96_bD2+DDGo%6h{%VJxs+*d0<J%R+!DF>AEx}eYD>_R{+_Z$PW}7
z-Rx9y)x=#r&wE6-$Lsy<hCD`U4Hev$gN(9z=IT3d=V&*soM$Hra7tf)eKpx@;)(yF
z{OG4D16Rn&{Be0vQ^{)(C&>r#61Ma^TQZ7?E4EyK`V#JRHl(|5jZhg7j{&>$ha|C%
zI4*zNM={V-cNmIw`*pY3O^>S`cc_yDor7B~K>SsuXln1!ZQ$2hg~6KGO4@~l^H)~m
zUp#I*#a8R&uzJ$3hq9-NtA}gKMvc?q>|y~yH?mVrCGs&aQY6Vfp9I<dP%XYR7)1UH
zE7k5tw*NglZN*wFWd<FOFHFA;O4p`B^d3MlJ)-mcCtF1T?Nk8}Z?M9ZqzT6TbO=p|
zBR+byhdBm;%nVH5bS=cxs6we3I?qffR4k4c)X{3VS#n3-yB&pBlr$#T%cxi81M<uC
zv6V?9Q--rl`R_Ref;ZWAS-60^P~MhPl9$M7!L>xp&HJX9BwxF9XI1+-z5VptC%ujj
zJ&&YI-EMW9<8nGg4OfBK3=R%NLxSMlfYrL)H;qpC#oDz!z#6~DgSigVK*UCnEvJ_C
z^ivGSyAmsYkfbmqVxexs>O6G73HJ7*0rl|y8Jsch@e_Z=`on)nQ({r=`A1<t8PH|;
z;g28UI_0&8JGLcGkp*Ox8TCXK)s&g_68);N3(J!JmhkSBYhbIR*KjPu&|c+DVIPss
z`q$*cKCNWE8IhxP8XLwpahw|$Y?PC6`Yv|s01?dB9IYx3q7dW#n){XLfw(=prZxmj
z`N8z}rSLk8G^^j`AjU|!;Sp~SkqWZOG8Qa6`wr(=lTmFbG#RI1@*{<Eb=6{>oMbZR
zH?15<JBoFMa!}1Dsv_vSlxlbgp3=m(rq=5!tHmaI-EIb~sx2hfDe-f6Dmn7h$<soi
z0tnEli4Xzo3;(4T_N%cA9op^_MZH3L_H#+a0c{Q;YA2hswcn*&oseqHJ1x2zlDIis
z4M*uwFx(Z4Z)e<>Pxy7a9iqwK$yisWw|kDHN+0Zt<qkgg<Em5IN6`G6hzIgn#Q|Vs
zT(go-7WoVD+o7KC^+RLs4TJ}ufk~v2HbZB=)5Ub35oco^x3*tfPo!FK{6S!WnVikq
zjZ<?{*5vc;<_nLf%(rqUgiS{DOIOh+G4#S(lDL<vF=&=yb*?%|lewxRVNZEW<#q;R
zDWv6H-PemKw{~UYI7v<A^<KFittU+P$1{I%+$r4(NbJ9?3t&8ze0+AFKuWa*5aPZB
zVY<`V08|AQ5!yz&xyT0X+Q)g`&HCk`u6I8hy0ogja16wS3oG6q^v6=YRC5g>=CYZp
znJD;dl}3`cm8!#U20-a}V_tJ+>HRe$RO@5QoToXARYjXLqYDI8rQ4C6O`D4(P^cVA
zHoS9RMZ7qypLg#US5TdX-MrESRT`+nU-Z1&pH~ntsxC=x5uJHcDeLs-8M1}<@uF4A
zT%8pK{+JvC=GZ$HH)_U05MHN9uU5lro|)zw0|fNXIJt_%VxqV&L(d<85Dx~F6~c`l
zURyB1IWzi?&#4FZAD=T=q$@Ph>@a&;;_hpf_ZGe5-b9y%);BiF4YxWHJpOsp$JZ&x
zuIp7+$y-Ovr#&8p!hk5A9gGu0JYRP7+R1?6#mJ;XGsez1;!XX-S#5|{*0U7zL<gfP
zXy<2s{-Pb#Vimcj=zU~JB(d>%`J|-$E=Gn<Aay*c8QQF#@A4HTfr9ybIqD5ao9wE*
z^jUqvpF?&lJPj!0n*oI7J#K&(lnThFHWjUB8u>vnrFm$UGKs?8&oZ#<{59U`Du7e^
z2pG4MaoJD|;wiK4SaQNf9bA6ga+HDZr&Zm}NLaWM>c1B7<Qh_c>em4a*WPr%#{LO#
zy|4ik?|{{HIYi>y9*megqac3ciF{?6e5)(!ORLubt10=+Pu#GP+8=tO+j9(fkLDar
zzmYolO)o~+e708Dixqt?lxq3($b-wQ4iK-f(6v8^gkmB{qIPdGWX+H*62P@u{&{$K
zc-a<G${VekTs{9fr3(ZTYz_pnO-oPXkI+tK1l3$-)g0pgp$}_uzDwNbj}!ojsudnv
zQnfPep639<&odh~C@21Y5Z+{Kv&K01m+6sO^}jJa)(3UvT@Pm|7si-g<M2nN2zzrH
z_eCnjYt>l_6??lHYiz;;YA4#bpu<eDc=>fIw`tA+@gPRc`3;=x<)aUCXD1bO$be~U
zB<ZBL^Ibk2S@YgJ7WqXMNg>VjhIX~|1;9tM4ZFQm5=f+VL}$$RqL9zF1V00-NMCdR
ziWF7(jHDN7#7+GAReXA1lrq^cp>i9D#^$UK>gZofrTz`?DtPDk0RH9!sQ{p*3v6XI
zU@Pl)26c(FaKgWTEC$rx6CTl=M(vvbY@v&(VLl_Xk1M=T9t00_8TA0bWIj?;DPSro
z%7t1T(w9j%zuC%_A~rr5=86Ap6IH4B$wb2Q>9?Ea7s0sT&`>+L`8N2u|8d=5ar0B7
zGWiD^;F+&P793VA=6q8}F2+!L-A^_ZaOefPB;W0u*1rQKWDm7(5`~>{*81YKbekIV
zah_}PDa^5j*9|f-2v1u4$t<Q&$%@`u{l_8e)1KG@CJw4yg{{K~v3zrt@q>X>=Ygf;
zb~Irrow|<XLKmIF6Njc&i_Yuj5bqmFfIA%1?@)qlQbej)Sl<ds5og=$e>~(zF!$82
zf#mvV`;9(|{vX)#FRB~MrfG-Vy+Jsb{XHef(3A;8BW3wr7*is4D|l)q>53mZYBC;v
zfft%48}S?Q7<dEyUp*wfQ}~R9a2ORe;%DymgtimVYgog#nT^WGeIYBH9KGZO(VCga
zL3Ny2uiLioS_Y8B{u_zn^97Z$*^lAZf22xjRawVY7eDEBCFwnql?N$*_1)E%e=@M1
z1WE?_r&=&S=ZP))ax+Z)`B7HLS58SH$&{;t*MZ@3k}X9m+atqeiW%e_`facL9?bNX
zTb0EL7H2)8(2)5XD%Qk5D2w8zVek{1r`2Gw;ml_%GV17)a(hi0Nk4Sm+H(N~+D{qt
zUvHE=m!wR$Kzi9Q+(yWh;<9Aj(n8WPk8_;O{M+spU=W>mN_wopd6JTY2q1K%?m^7e
zK)N?wKVz1xKre7idx9Mj+s6YG9YCo|Sh#mde?v?HdQET~obP<gp7n>k_v`4Yw2yDa
z=m>m5VqxjSV#Z($OiKGiP?{jHD_r4puzxazCzINSvakY}PRn=4**27DFLveh0GY~*
ze|sa9?>L(#{ncsRcgQGvF3_Qsvpv2Yyb$%P4SBV6<iVe)eN;`HqdvdC&Xvfk`(0uc
zIct<`ksR73POy>L0FER~EKrdy6((PyGWAwMv)l*+bzp+<h>_n=RFCJxESPBEi*f=k
zL>CI9U-!pWBYF2TufT4hH>d=?N4M1d_?V*yKZz$CBwf#B(G_k$0dEW@0OMpze9;``
zQd#RXlH`hynfs`eVV&)AbHe@eI3GF8=1uq)1Dt08lPJ7m6ONO{UpvLNY&Hh1!sp5G
z#18=m{l!FXhG1_8DLAEf=ga8F=ub(8_9V>FJBR5<*HnP|$&EyDjX#?3$<!or;9-_V
z$(i^G@8=W5M&cA;$J7M+G)*`!wULhHSXl5moK|!r<1#q$hhYxVc<w#0d#Kx;!fF+z
zG}%zr%jP{1+8HpqC=yl<Z5?`23&(2~w<s@?_`((ZUPN|^>WfoB5+4YJfZ+KpLqeQv
zksb~t*(#})B@|&25|?PyMy7czYno416(W4K3s0&pVmL_x)n|;03_qjP9Ib%@dmSOF
zpwP*p*9*L#0}Om2yqAm&&&t^{(^883H{GY}=jTMRXk4Y*#zETW48N0QR{p5qM)~C>
zTWS9j!g)Oc<84p<$1e?~6>x@oj(RO8X3T$XQc)m9=uY(V8kJ$apnU-MF2bke%fMlr
zW0u$TfqPj(wOSF?Dw%HX&F<0M*f%eS0`1yh*iX&F13R5X6k|0?$XP$KdnthJV1qx|
zFu@AS;2K8!0XZ)jc31+Ac{Sg#bSRw8e^`*D$V0ip$ep`|cMn?^8$d*G7({til=Fu=
zQDvC4Ysg9;T(Bz_VKML$eKHiPHx<F1i4p~@JRP`dguoN5t|1N>+r=6sLrln(iYb5a
zR@{EVcXKME9;4_JgT_NsLRJsBIi>PYOJ>c4%$%v0{Q4C`SAh)?d6@nB@!jjIDtF?g
zPeaoX@3=y-VBu8C?IW$K9P!vHO3$q>Ra6nrLAZd04d{SRLOE+6;c&uhx5K#SB^upP
zu@9SB8Y><62a>%9=%U@^YmB_IL4K<DIEKB(JyzTj+#<osttOf}l`-SOs(14z%Q?r6
zi}0N{(21#4JFv{5e?9bS%W3cS7(`m_zYJ48eid$EZ#CcFs>;(7oW}FbEW+9oCD+v>
zA}i1V+fI;IlU;4iG3(g#s_6@?U-SdH!mHcxqVHYuv23PIy12%k(N4rk!TWv-*Q#<+
zSN8z9#5GY|y!TWbjn3`o74J`g-INKknHd^HaoK;{9dm_iTii-#2$7wX*b-iyc~jvq
zU68W5XDS5=7o4y3rAR$Vrxl`qNjMFvq~d$h-S(5ka`z{=`&c(t)(k&Awf_0dP8Dsa
z34#>B4waJi-67UVzQMIEU^m^fN}3>i!9judLa8XUr#AGL%(6oqHnIezx`ZvfZ-pp?
zqZj6R4$ZBZfwbh;^Rxzxfjo2<DITfv@lZ~;qpSY!m^o4;$?Kg>p=Z)I4F{lBUCcCA
zc;95)AI;z1l+@z*>^jmQ%L2(fOT3bBcR1)7uMO?<l;*C*Gmt@vxZ-aS!|LUf$Yz{x
zg0gQW_Cq&ksCg<&el3b3$QtNANRvQ2$ZHy3#WmY)4~AnT_*rQmZlwOW`h}HF5QmcQ
z><l2L(G9&YPtV0l25~Y>Z^DA(juizgX?vx2?Ol}>F1?nHTXtg<P4EO^+MKZr>h=<y
z77pd!IapQc;kP2(Pnqbk`3?yk(9=p!NT*_4+BqXvhawwP^4U6ckxwda2A*?xc1Z|^
zfV3^&dzlL*@|KXk@21a3jg~-4PEr=q?3<#R$hc}esgc>7Eq3akfXME4V%^%H8q02K
z51$B;_irwVh^a5?KO=v4h)ffFgg2ywGD~M<M13&Ow*}IOj{BK&$DZ?fUSi87|E3cj
zmlHHV*(h6HUZM!}&vap;w?8T-@ighQ51+y@vj^R7C8T<wx&5;#aQJ#+QZHxPAv$zN
zL>>@mKH~O$09Ml<?X`qF)&B6V{=>Ru=QdbS;hq%ZkR1yWs4<X^r$0!k(i3xLmTul|
zawQEsljRwC1(Lyo;?81O`4ZCEtcV&<;wuf&<K4OE-dhz%_df+OQH-SkZaOrQI^5QP
zD?#h)pFR^bC$3fFUZ}##IZX#a@4YXOwqHx}t$Z?V1tj~oc^RnpVfqL_pFP*eq(ZmF
zf=$aEe2RhND)@#f?dmX%mr&`5xAd85uf1G#Q2)U%_EOQEcOq@JTbn9tWy2?v3m)<S
zPfvKXSrnL)xoVG}Hp6A16v6YMHto9D-*(!|Gf?s3iiEA8O!;z1c!A<Lj}3|V>uZvs
zCC5mB!Mh6v##Q7h=#WjQj1cbGe!-Xsx&)?9b|%l6W^=PgC)}HQYkwu7pMXDnpI-vR
zt4toJUr#hJB?H%u&TlG`RjZ1K#G<7r_gAK>Cv!J$kxwH~LTPVFo<xyP6A%R|NW^PH
z>WW3I*qo~b`@-c}it#aS_L&wPYZjB{BEZAqEYNK@=O#uEmjLj)STzpw(!tE3ujEg(
ztju&Qkme2h5!A7P(|;Dp<ML#V3Rnv70kor%w>ZESa-uh`EgyHW+%L$%!>X%8(7i17
zC>)=&GjfK}#{2x>(`+FF_3_P#({4&Q-|!tmU|P_2h0x;-fwcCchI49t3D+4bs;~u|
zrZWKAA=6N{UvO+@<G~lI6CL|0f$$jFI3~izC493H&w9bSV0jvObO};Gu1J9RdSO*t
z<z(KkBgc<K_r56%yoRuESnr9W5>605@C(@JodcfW3%>7h86;dN{XQ1;6LI^rC}qf^
zO>gfi8W3<O97FdR9TQll1}#;}*smux3e_$h3Vi<po~Wt`26GgH?fEfw?du=CBhEGJ
zikbO`u7GNdl{uxULL%4v4tJZWKg+zzeVU+;d3e>^amu>~yY%EyTK=`_U84>8ZFjlD
z+!8;mQgNb~_?)cu@ma$uvVk^$G|+ZpQ$MO%zgwX~4Lf6@UWB{6I{@yP=};?H*FZK9
z)mc6exB&&p#;!E!Na%1`C@1rmhyc$L%AzS>JetZ<c%3kK(AAbCAI4ph`zl#v@0VlF
zD+9LWp~#dtqUoSO9fQRAYMZD1q;^NyVwJ2`mo9D&-8<WC=F-3rF|kQB8TvD;IX||9
zwk|RP$n%g=hOdgKCJ6IjlcS^Zrikfu8;X+2Vc;<|@H1rD<uW(j+jA<*n{Y(LA~_09
z-XavzD6bQ`SS==sDqNQM45LgzGNma0C)f3@jeN(#L8&pgm1n;Yhb9A_>`9w+bG*Tr
zQJ!n*qz8#nW6jPNb*}w<ZMD;-9_EyQ(?n|v2fQ3(xFSn|_dObDE24!=Q}|I1nt}u<
z-ba8wI$(J7P2~0ihnxf#8fDoBCmsDr>$oXfdzocC=7)9;(<jWO=(+|^KYu6I;pe2>
z=z4@k@H}&3)}kVr<%@euxNHsEdgmiCh}CNbKjmvpgCQ!l05fh)m|KJ}fKl3XxAZB>
zRA|XFMPIxdKg#6C*+tUYIWU+%5gShBs50ns68TQWv2J`HIRgP%4$~Rkog>S_8=^*X
zceHe2=gN%h0e2k`hD7PH)v0{^Kj1j%$l$3X=VhbBL*l$2c%(6_Ul9Ltej2_+uQhkr
zW0;kq+sN-$WS0kbJ0YgR`<=D6Z!*G3YPI0Wel8jzpDv%zYgaYtwEm+@xjZ*m07$+E
zB`3*R;N9LUkWHvMMr#aJI84S@Ev)Zizd!7#WlO5naVJutOFPN>s4VCJ7J4?QtN2vf
z(VSByAznIMh0AG{lgheZOo$DHkRG5~Lxj07m{LD^xi@5CnkgKYe`BNbmv{wCj}Nxe
zS=w@$9`20UD?(~*dFEZiLATO8$FIg7Ob7LRv||^5W6O8HWF?YXoh4cC<Wq&rSz5Ry
z?es-1@zg?jJYhd;x;NU65z${mGg57AxJ$-m^Vsw%u}T`H#?wkER=+Xx)!es-UhoJG
zlmwq13Fv>-lYoNzSZ3+15`9~3ZHZT-!v+^HaOH>C22)G$htg_QczzEt?AU!N@%1Zx
zxWPtnWY>23o&D?cQ>C`ci4Iwcca!xtnhT+}CHK@EEHgDqbKJ>a_WFAOa^&EB#{tot
z4&T)sya%A2#K$99^5~1oUU+qboXfd%FG}4000gusb*H#6xBqAXFwQK!I{o&uev*uy
zf!s%nj+0p6yqM)H(Mu?-Fx~}_nC#rQO~YT5RQtp5nsU#oL0)N!G3Du37B>}4;A2kp
zDANE;UmoPeJXNw$?`LE{dpG&(R$M}|G^1b{QsA-&@_lsJ;`UM<QL_YGmh#mL@w;X5
zVSXUWC_|{L`Ft%c2@g`nFeQ*%`PDP9^L}f@_2-=^?T2uJn9b3ZAIL-MS=3=#ZkCxK
zc*5V-zRVI)m1&n@(`Msk^<W@bc<!*wyft$ATgFsjvfe4Jdae^ifqHe2bXs$WUz?w8
zdQ<8RPP-@A0#roEwC#Ct8j$K>04T)bW)%JDwTraKzF9b2KQfbp$@2u%78m`m(h*hh
z3xRb2A0_f!8%zy+bV^E>MVYjrPSj}J^+Q$^KZ^ZHxJS>t4sV&X`suE@d{_rj8A!=t
zOU}A>`u(d-`(qNfg*0<h<aL;Z@!S0!_wh-=(#O+Az#{h%<wD5Dfa69|xba*G{DiP7
zDbPf9aWd@^(LCz$oU$5(7|yj~W8$9lCv%gQk?W8Jg~5OvO#?0etcmyg1PW+E=XnVq
zkfqPxRD0E`kFm~lF<Qd|b3|#}bwG)?X7!U9Ko}~_#+`AE%4~#ckm24Xie!jM=H)6*
z3<8ILGp!^M(Y^g%(T;@wqsA?-EQII<lDKuWqx(;;dErELtp7-S0kXDBhD_8LXI972
z(s4QlCaefuCDD#lrPEEd_BKB6+<S09Yif$p#57er@Pz&8kvkCed5Qrg)%%D@0MSrs
zY-WPTkf=|T8lTgqD4M#<EJbvv8*ADq3E()!KTnq?^}KHCs}d-GM!BEAG3Xg1tu@<q
zanwAL>n@b}Zj?r2V(pc;#WT0gI!A)h?{T`>01U@JQf(Tl(?}0OSj&<^I}Mg7ncQ&D
zbzgMc#54#KdKq6tQtgVew%WVGVK^b7HOCTx<i$i5as$(5g)XxKKLwMc+?^IHy(yzf
zg=$jayl<UEd8|5(KC51Ldr4^ar$q@wQLIS9<u!%l)_(noLKFfZ(J1Fg`hflCwK7fI
zqc?r0ds=40(Y$U4K0~Ijv?M^nTjU8qWj1l<7=JzjxYoU#P!)no;hPYUdB2O{t3}hY
zlRr~sb!vNAx-dC3?dq_v`@rAMNjKt#E6wotof9bvY1CT_?nQ|^3L-aZH*Z(($SbX{
z$8+&V%YbG)yiE1|gkCgV9QSb;Dvl_iuD8_+wSE&zEVPHIJD(4F9dI?HfGoM5{FrkL
zko(=$CL`Pb3F}Y;t{%{@8ZI`_wU|IzFK_6w-TcGN;kXSCF*s`Lx*fG+CLlXqDV!*6
zr)IWm`g`-wF7*kdjhs@Kv0>(vBK(B9EDjV>E+w^<%FR<^UV>VOz-#TOlWPq${+}JE
zMwaUFn6md+PNI-|P3>M4KdpP!?t7_giW{f9$z_*c8_FegDR*?CxiN7Qyq8*lZ5elW
z&g<4WsptL9V#;cq$L4J;qbm*0b9-c+#>-NTDSoNPA4SuZsi+IN9`vqkENGny(F4T*
zNOiL5+Pu`|G~JiOw;Y&k?><2w&UobPQ#Rd}H}!5IjBSK%K#<IhXEIBr93;5fuJWzz
zyNkF~)vETC8&-JV2{p6n>^~r^+Q6ANaZ%d8+DAin^-yh2-5zws><%tfn`cngF&%ye
zc8PD8p8|+bEdqi5jgLqV{P|2=^Z086ueL|jmbATnK7szN1AyO%cHueu6UL~FPzqxo
z25#wD%R;pCylcXF{Iyn3uiyLi(EUou6BS*Fr@q$yOBbc|4Cd0O6>eGw(eKy#a6pht
z9G3Z;ba9p!3B2a+V{~h9w8+3Ucq?BH)^7!C>|AN%rJgJIo%)C2-2A3jj=#mWh|&Z2
zVepS3&l6^<-=es=@Qwn2jsXK-0@P5Oy5LMfuQVZk8?AeEl00k}p%!a_2YkM-XCE=O
zS&j_nbD1<VV-+6>$Sr&lbj_vvS&1J0tMh1|h}V8(C|6#lJG<$F>(q%Kg;IRe5y?BA
zqwyx@wx%u=O-pH#3vg#X*mz0j1xMzSZC)9^WOqPS`t?npv#jJDOOP=ugR(cxadOcI
z?CDDUyb_EZgE@z@##kZoM^KF1i`aEakbC4JvNMW0^i;Hk7@p_+jjO)MRE`7bg&4%9
zM-%ek-)!WY$e|@mN&J0vdF1m;hVBN<Nv7>+XQ#ATXmJ6J<_?Z5Bvnxi9}JIei2^*o
zx^eqy!(IQzq{wU1;<v_4^N-S{?MpF0V1p1M)7>IqGwXh+bJ`O3N1A7x!1coPRW?EA
z|AIzs=d+${!z31nO8i8o=~0~t(W?c6vT*1uRd|?XYAln6ROiohzln_@06mGfD7_AA
zeN^016UACm?jO~43XgyK-O&g>I}|)^n)zmDpUtH@(HE&b*M6@>JS$J8!n^Av<RT2=
zRDdAdvuvi=#STVEq=g%{$6&$3_9--GnW8Y|JOr@^PoT@b0YPTVp-0Z({~P{`)1|*^
z58+okIxxJV7(hoEiICn`B#G+FacY+W9utvUL#hey$E(g~A?<S5d%iyPh_w7Z1eNr)
zSCZfiitJQ+6yEJC@&v2pQo`sFnmrGj_Aos{O{&P<M+}wU^M`G%BTSG0?~ER|$-Dxz
zgmXVU0}<G#Oxhv;M;8F}H+q=c3(vSGQddH#{>A9mh%8|4oNZn`mkb%+RFaLQ8+Bw$
zZ~RPiyuYp_WmRPRHCX1i63kOD5M+x65UKX5VQV3z3nZcfWT2&SxJe#Cg1qrSo%eYe
z+5Ifed;xl-pyq%D>XAR>Fuc3|@c7^wAq0VgbD##OY{TcU{?vT@YeqzL4Gse6*n81B
zpB5k;Myp;j%i;Fp?IlnFfTer|?%EEIIRMgFp0zl^K%}4Xq8m#B*Oko%Y9qV%JS%i$
zi;wOFeQEz&(D&1Rj0_Z!a%!yiqn0OFJDm(mJX3~Tp!~NzZ$Y0tg4F?UCZhz|G5{6@
z3ukzCx}Vmt>s1#&h_-~w-+G8iklckFu00odh=k4Y`{094MB3ga$XLX4^?(z%M<c3%
zZeR!xg30fm;OO2@1ac|RYy-1l7RXcQ0s7s$csNM+6ow9<-+eEP2XroAr2*^jUhWdy
z;S()r{HJBfmHY1f1hycGSG4d@e_~L<Xc8$km;vGm4E!~w57B7|!b528k(nUSCZdWT
zs<0SA^W4t|n&H{Be{&sqof|aDX5InHP2ExeqtL=iX)}}J@=q5&+qcc?y#J+nML>>T
zKqN1o_oo1QE;=g^n#K?h2>{V{krq}kwY&2a(V^%5e_I3%<bS08fK`BdZx#I0qQ3&3
z|3`}wU{=5BNzj6az`(JJ-wTd|$q7-{b6%#WL4H4oHs*XF$w0n;5glkiG{o(HTLHr*
zU-afHbfhU)Sx(dG)EysEF##eaNL|km4?G(kdxy0-lH<*&#{@LDz`258*Kt_2m-KV3
zKY_6y;<mxS&&rSy*-wRO|B=7Hxg2QaaCVp}G<SVCK`SkodLBZ;BW9RBjN#N)0?5#h
z8i2Xu&Mtb7wn#vt+Z918uF&rn<zULEk`e9i$KV&3msxT|LlB`FRsqDl(gbV)M-*sC
zyt;2>_aSZO{{62o|FM_Zk+>L}-*2($G`e+qAVd2a_@jo4ifsQXy@&}t8HhuImlF1|
zC4@d@0^N2Vq{st=`!ysEo{dH}3;2&Pz6g*`3d>s#AO#2mhYDsEzt2Z<=zi$>&^SH{
zUB4ekSa7q)k&5up&B!6~=?}KU9MH@JgiL6Qj9_yS0Ak|MbCaR-H}_fXnQ|luG=n?6
zm4>nZFNst)sIA=u3PAN629_T@;;#%L4BRjUn4*FcE|}0=HNeSLmH9ycdR?Fc-m|=U
z*fn~8_h2xq|0X>7h`fiUO#*k?{gz<@`t2_<1;%%Z>I+0FF?4=13^?0B?EwW$XdsL}
z`GigvG=Z!Okbt_Ud@}06>y<#N;C=d?FTqH5;DJZs5wg4oE3hRFyr~XvkqaH@B|I=&
ziNyW<OTYrGi3hJ>5s1qS9*ZsxE;2Ox_EQx+W)h6N)85bJPVk}z9|5!$`UJb~USAyb
zev#Qf{`R*6Maatk3V&1d;}?VD-N%O*wnv|z4Wg6)<r=W5hm%+c+{@<gf)Tj~>!GfW
z02Am~V@3A9Qzb#C1|vb*0wQE}P^b12D%?*X2GFU04L#7Q(7M-|cLA~>5S{Tqxgg;E
z68;X`9IM38{Qz_ReIp(AY!@J;?~6wP8f^F=;5XFZXwYDWKpbW;C(#X|23xlL)Bz1v
zhZ?;0Z8-;O@F&pVCn&geNMLfm0k2R({H6gilb%4$$!HZ*2anNy31(iUc*s*IEfE6@
z7%Q9NCiVRWM|MAA#4Td?GX6j^`>z^g1fyvMDm06nz&`g^P6o_oX)v4JiVi5DvHb?-
zjivM>$P~FxAMCtOAA~v;2XyLRJuT3w(5hsz5kP_FXc6dCEhSNs`}vyyI`zHl%Dekc
z1w{(}QKUuxqyu*k|2uV~3qs=pI|)fhuuwV=L@rB04Gx7y7zM8m88r9>)L<gD25iva
zP^iIWu;R{8gJnU3<JyB0z;yrg3~Dfk#wI;@Hw!Rz>z&LF48UVqB|vim9wF<1{loS-
zSZI@|&vhaFeko|0_K0L8L+`feb3bCvFv!r;!5{fc0F8lS2IVQkd{9fKpfy9`=K*!f
zClYAQly${Gm$rn1@gv4xg=U(_F?4uDaHicK3u>TKi}T3Ppxb4FvEiv}IN-SNRC3U%
ze`P_)&~-rLhS$P!@3%UjxbP1vQ-sV3@&4?XA{IZsKUlOO$(z>5Sx)ibr?B89z)8@~
z%Jp^=<b?S!Kn=FnICu>;7&_Xz9zB_Z8cYQmtd7c{iv$`R05$mM+l)eRQ3;s3yT39z
zL!fnu4y{W9#`id&HI-ln>hM>%utL-H8JMON5BwoYu#eA!`w^RkWyA(ghkAkWe%T-P
z*h}p|UHI=t^zTOW??&|RM)dDS^#6!Oba?lcjtq6`uh=L!!v25%llUl-C#n@U$MK~1
zj*#RbC3%*=6lCuF-}q~Rg~f}$dz}9^BY90TPlSj?`X5sU0Yh<6fUKVa9&h0Om?8zo
zq8H2(*S-1S3(OB}vK5T`BR&uu)TAO%VH=P^Lk3K@hdnOv&}HXjz+3tow(t>&g^qAU
z4w8H8S_pi&^6}GxeveKCPHH8%ux_XyeNce;L&yS2O@MQf5|~%y(cO!S8U6Q9;sTBY
zR5yoEvjGiQ1w~MSlDH@_VbD3VuYk=mkQL$#8EH7+j%94GH)+5Plc6Kr_5Fc0xI>u;
z@Bwh85IsS*vn@Y3!mA@#=7AkSh6~=OyNxy@0$gNG168+roPsU+t4pudHW-OMmkc2|
z4N*m6Y?Pn%fmCehDiLn{lb0sFyo|iky&v)r?1K+NX=&|0AOwgjJ@MJ%m;6(hJ7I3_
zR!=k3^FwHDXzzEy_I82y&J3rj%@;=bGwvS;Q80)^`|z}Z5og>Tx8Osh$T@uItK4U<
z=RY)J;AMQ^WynO~e@F)ftRlkwFp-5m!^8G1q5EjOf}<3HlO+?;Oo8w5fJcmkLHr0l
z5W%5`++T$VPa6^glNdn;i%I572A<&8qK^SxMHvKRY!@wZ#0q{+iT)9MK<8m3hpwW;
z0564UCKLcY*8@Qj^~y(|3;Ibm87#%<JDIc(%n>@&(3S5g-U_|opj4>l?mvLOM*^>;
z;;Ot$1Kytx3*2R+y1xvx2Kr+8fBXUt`i0BOT?+7vI_MYwbVfG#V)=ji;@@8Sx0n8%
zOaHF8fA^(-ckh4CxPL8yf9<7v<MCg6>3=sj|J$l05{3sgjF^ep>iW_mgrlRf$|KUl
zb6gZ?LzJ%{mS0gu8o_zGp~Sz=VTxs43Fs-&;g7jKKK3Lsw!3W73J-<H6n*<E_Tk}7
z)Izqn$&my{y3I^B<6t$YAW7r<3DMS*+`veGPK1{Tms$<j&bAnN%JmtucJ9X0e|{*J
zuOF<Hyw<(dytm{p(oY_pYhyxoIBcNL1?_O;tY{k+^jU@;7{S@g>+O)4-x333Tt<Uy
z5)JtPuMrh-X>hnnr63zW4OsGmWi0pJK(v&PJ<q$m3o=X@WH=DFF0HT{l|>~HARBly
zCL6*^jOO=+QHW$7?n(qMU;HiL3EOw!oAyoFiLWh`HhtzJ79Mneq3My*Oy(2;AI=U}
zsBSeTSfKm;&~D=U*l$#0JM(7Y(=_;KS)U!OpbR<Q6uc74IQWrNkp-dl?6yjrwaQ7o
z_+i6GxmUKzCLU5>M<WG{b@BNLP<%0|Ui1!d-zdA5YtRT^+tMacyP$!FU?O~uz(nbd
zfl0o1L}1b2V%td+KTF>GF4VwxF<SH>f?Nz2^e>F3K5dNm{lW%(0Llj&EBE~(>0>|j
z@M8k#2vI~uC4SnpJY>3%EU9inSu#D$FV9>Jboq_#3~I_%F=f=@fKT!xIfqgHiF(xw
zxGfo|8Low~?LkX@YO-W=h(9B*&pq0q_Xht8+wH5~d9~+^J<M4<TkuY(!k1gEUO?@>
z!SB}c19?&jK%!yG`sVgZ>D^QfsD*Vj)UCxmO$y#nvc)6zmQnl=)H{-G{qS%tg!%Nv
zov+~Q(^Mm;&1dR*s=8;*dUw|4`~A$Xofvmr%rWs;Ei<v7U#ibtkb0f#@;O_@#QF+c
zD-zf4&ztKD?%eF{_kIkbXe&rgr@xuD=MgSj*N|Owp|V|QMC%1~Wy+kFI<%%~niAne
z7ji;(9;FS<H#)B7bLJP@h0H4>C!lCtAH@klFXyC6Y%~>9WQ>B4WYgX47mw>+64&3g
zC>WA2c($@*a^&|eU+Y#rq%ojL_b9jCiBS-a2gGG5UAK#iysO#o-69t=R0-Qx7_Ccw
z#50~VV!{Dv#LSYxDLFeJEG$uXVn$lV&faIB*TG2U>mdqrSY{ID_PX}a)4nUwe=Yk1
zO`kqhNb_{FURBdo{EtL_xo{Fef~U9%x^A^9wO3xX*N67@ziT_+Cxc7_y1R?F$whk2
zYNsC8QTq-r^7kd~n%X`3Z;;jp)0s+}E~E9zOmAa*k5;iyQh7Yizr7i<+|}$h%G7K8
z{-{5Q26s&Js`>VX+u4?7aJ$fJ+`zD499gpGh}g7>B0x5ybiH7*;3gJ%ZA=-tm$~^`
z;q>>-tE$42k5v7*w28+SQ-*=Bwx>P6Xulus925k?YSC6RReY0WDR{j2@`N{!k0Y5+
z_fT>RlsA?`nB#zy+V+m1yHGU9X5=^4rHR{bQZSz^*vD=>SZ_9-*rgkEtf7hRT#7aj
z#O%?7w@kz~UlqRo<M$@nnz$edo7t&JrBLl<UtGP^;Ejb{rNa9U9!CR{<rb6jnpdkY
zJdZ81wGxEPg>)uLr`Uy)cnca&8<!GkjK>XM3eIpPo(f?cW+nzIqY@?wfbHQNqeb8>
zUh8)(zjYyFf{v5_<#Vs-lHkTxV*cuWhSCNy=4Q<KU%R{;*l~bi){CQ_$BFb3*Sp3d
zut@W}z$Sse-d)4tN-a~^DT7Ll=$p#T#UgQ!(**_NpNqP>5#jU^<vjG34MFgSIIu+r
zTrSy(v2+eWDNet(+;&0sh^hr%dLO^md~Dd=o2RGq^Qq1%QCbXhbWe3%%CPC**In;>
z-_hKu+FKpXlm@1FOCbp=Sx^<fG3i5@yqnvSPxsOpKR@H098OWhl@<>>ixjyfw;dSA
z$v&Jr>l@!jxCr`qvMNZr9}lQhl4&y)LX4>=E<>t*js7mZ*BYk;ekVgZQkuKeZ5Ci1
zCW{D6(nM2DzPj6)uwr!1cdd~fvUZb-&-d)H#d<%!J#IyAT-xwr>qnf5ds6O}>veAW
zUet3fuKpDZb;*j{tuyUDePOmAG++bA;@Q~E9Qh*Z&`MMbYBt)pA<~##joUO$mmX8h
zk2|cq<*RXWzpJ@W%U9V#&1rV8wMITIy;J2QoSB~?x0omy<7;!eF&kRRXD2Rob*eB#
z+z^5w6B5+om4-o-7t?pIa^7C{GdG`Gci|1i;JxsZLi0aaIp!gC>iO;1vq=q#-Aw0m
zJO1KvRl}!dflwiD0Q+nWu~Bl9JOf#xG*lF%Lbovf(^;~-4%r<SPd9&gUOJ(g|G_qi
zDRN4|YFU1WogAg>xtAk+ay9?Oi#`9=R%h<%bt|=TF`sJcjzrp%L6Yaj{km8a6sMjS
zwMG>-1Zs2FDqBPG?H56u-7ny}34N92c_jl-@tKX8>N=_|Sd4bZ3$u2ozxP+m^E`B!
z0L0<7hNIvsHNC42dQd#|t4%Fki_~s*kOR?*Rg4X(o|kb<XgYf8QRFmxLeI3h9rC;D
zk4sI>mHL*k>~>WtdJWk}o4FIkQME^3c_)|B6mbJz2A{}~-5`jF8ZDpW|Dp?6*z`JI
ziZnv|P5hm)Nsi9dxo5NB>271%Lz>u?F0>=ZT|29b;1Omd@xz?{_5ME9mklIa$!Al2
zrYT-(rLLA?L!RQpnHznvvJMZEb7b(^e=gmurh@uy>L{*qnnaiw43Q$gFnRVWMvZ1a
zZ-x7zl=_O{I&b|_Yr6SOSi0=f5E6TMLiWGN`s;?Mw)cM=R^*6CcQ+D(bf-v)q%=rL
zH_}6ggwow0CEX=m(j_574?T2u{ubxFKi~V0`vG|L?Ad#*S6)}Go+0iF`Q@4|oHhMX
z5gV2q5&YMxGWc&aanA3&uAQSnby9Tqy5RDH<bhGR5l$RQA>{TprM6(z<3Zl1O|sD$
zEbg;mkgKzTNuZNnj$DwpAq;$ee9ioB<(K?!tYjwWvckK>kkNarCSSJlc+KQ#3@nKm
zkv)6Mt2@M)Kbo}3R1MlCxvfO-20Ik@@RnQmGm015y}HwCL?z;e&ympuq#_1fG`^J0
z)$AAGP9HdyiK<1Mcd{3_+Fq`Hb(og_3I(?%&(prvBO^2Oe@p~nUg&0WU|B3mQ4MOo
zeU7w(i}z^LoUafCJBQBV>}^UDL-vka*@x8*qP@nxbXP=gGXn|OFN@)jYrGN;lP_!n
z%rsB2%@<439cmtwlrW>Ra2%zAoEql~jS^HF*U@2hF2yY!8CuB${aaWtfn|JJ%Th$g
zo8>M#M5i2$1BI%St_Q?5Np~?VQbzVE@EF9O1clN_%i;Ic8X!mTH(u=iAieb2(0Q}y
zs0KqS^nd))FTj^R_W%3R#VIp(aQfq{reTBRd;*afi-H4}9({j6;!!N})rW)_EX#W<
zQdx-Fy~3V}sf#66wF3Wo1%d7c_>g`f&%1REYnLy5#d-NF6rn8B%eF->okxUn)N72r
zI^V?wKEezABfgo9K-Pn8&$%ctag<_~%1*a!ZY+S-k0Z(VZLdtTPQl}{JIEzmyH{vp
zTDLDUXiaG?GmcY-kp=G$xeGCOVKOUq<=jC!oHpw9e{yYQ3p;U4Zx1Wp0Xe68QS}eD
z&udR0C#BQ4jM*kny21f;*tRRPph*r|Q=uD9T<IQ#M)r8h6uwNcUE|+hZ291B?A#Zd
z3FExC=1+rNIo{G9nql#+hH;wA#$7!{8H|Djw~A8I7cy`#@FHJ<*D?k}bl$LvTA-87
z%weSYN!J0)TafzU!bfyqD?f9KFzv?}f!;I&e{An%9mYW*4*k&3!~unmQ10yO66z2#
zov3$fecsO+uj<w{Fw3Z}z_f!kJD;W@i;eEYjEV333Q~yRe#2`23{Vygg1rp8`tZ(&
zL>3&jqD-HAWhRrk&|Rf_tMQVE_9*t0)AqZ+@kjC`aP=D3!#`sDVs}Q(9Vzb!hbb+?
z1$DEsS-|F$sq{UF&4sXX&{_km>YwdYrM|6axU^J}Iq&1T$COruX``+Y4R*tw(R7wq
z9_|m!UfH!lgO=*p`KV*eTr7#Wiqyas)U{}Ld4!E$K_8n@`v((Rw4a+%q;iV?MEanl
z88*qT`YUMd5ytI4rAc$9azi{QAe3x^e9$7@m9GjzJZ615CnGRPd|2LgUxZpmaT*xN
zPz5M~!y5kU&b}LP{V4CeG(+q=07LsAQii0wE-7&=&d~>)a(=?}3b|DL*`t$1S0Rv+
zUD!i>&8T(uc@GWmWfrLm+woU`<|Us5anJ-Qo^s#1s3nRAqi;5FZv5RxG@B8B9*$wZ
z`SevgjdTR!ZBOt}CKsfp`EaFrpRThp;-Zl&t;(GrJBtdUSsoA%0PxD&A3BMx4kyF$
zowogUBB9T(FGyI{%Ns^4K(88veYbt3&V}%!TQ~){Li>}1qOD$?Y%pu=%$f18wj-nU
zKeIpd2cAI$;{9==O6`efIe!+^=&(u1!(P#E(O<CJv25FR&WnsSnIf`9$`$6X>ljW=
zNR|-&_Wl*-=-D^pf!gA-*Q@|?p`a2jFn$tu7=qoLkr7wag|`eIw29_IRWOt1X-fuc
zhRw703gq;1r3aQ}zEz4KuZbeq+s`+unYJ%#v%NfMYg4<%*j?7jQ!MXrSa9YQF!>|M
zmwP(P2B!V+M8Qg>gFMe?=oJ?16<13Cy+VK8MdoEhZ*kE^2CjT@U`6Y{)BpW#;Bt9|
z!zXm6EB66M^Bu4+Fc3C!B*c%W&BvpJc)SbUE{;CSMD#t&`+)R%_|-&|=TYb1h$`3B
zpS9UMCGWc*p0E6ci|U~FT9H}@gQvoQ&{9>ke*K+yEA<Cym1j4#R;5GbgbdM{j%CI7
zY;*i%tPad*)SUMKzR3Q4eIZysk`_-xk^zy`r}5uyzo%LI&NRTkZo^4@Lktfi&BzI>
zXN5Xf9tn6#h|W|wSGV@qwP(Dx%x?LCh*2Eki}U_vZxksO1S=VuYfo?{?{yJf_3v37
zCHlhnY$$=GY&5=`@Tg7SOIcdvb}OIaAE}KHk))Zd{8if378@O71DDZ|Wdlx!{*~I1
zpcOz_YgYzFMITD$1a?ZQ<FS^^8MTfPyu#sNnxF6rJc(q<_}K`L-1cl~Dc}LNjzm-J
zsuB)i7PE1IPZear5QNt|8QwxA=Pj?5@ja9c$&qtK{f5pL5XYWJ)npCCRn9g<6Y-;>
zdz_Op(Blayo7uqb%N*1v7jThCJ<bU!c^3~c=rNveNk@`9^YE;ifah)$@;2zSBVunn
z-_8u4d?bL}8`V4{nYg(r*prMi72s}Kn<z}-gX_%8@IL}qifoKQ`bvYb7f%KSe>kSr
zN<&I`F)vaiEAH$*`#{v~(AW5EWHJca#|KZ#ew{KX;e1=n5{#{v?%q4a>12xN(-WD#
z&lmoVt9M_v@>LA3g2eI7frn-ax6KY$D0}U&d2aY>`p^pnhF}`s?jqW#(HGM<e!-Eq
zbg3D0l=_}W4G!8+ZAy>l=-Z6Wmb`JP_uir68(U|QgS-4H=~j*$knvAq_Ah8_{(g{b
z;&znb!zRmL%m3o^T_z%utH9JYe3P);c?(eAEt%aA5sPtYioLiGEd9<Lvf>WnfzrSz
zlfd@v7@B6ENR#%w-s-I~KVsfWO3pK(Bel+em>L3%M%G(Fd}Cg_v$#5Mq)<W6>vYKH
z$XMQTUlo?gHuOaT5fb4e57v}Nlt4Ti8p1Y{`f6i(!nNPmB3W&0VW9P&Py##<^)~Ir
zv;&e=zYfexXJaIlC6;bvO3`<bn6yQ$@Y=UJquKSqCq5u=1LBTZ-e8##q)T)ZbJf3S
z^_%UN)UtbWGwoCCKZq-}BGGaU>Uqa^vwy~$-|>aqf8@7*tyl7O<fR6D$R!)GH!nxZ
zOi;kl9Biv(`f%f-OBOH^7-~8Iz;tr2lxHq!1R;?f;Dyo#SI7D35Y{Of4dFV~fy6e2
zoxh(;mjekh;%93~%$pRRA>BCa`>Ovj3KFS)|L4vhJ?Z@m&++<ECF#Vgg^R`LT`{en
ze7i<M&OcYVN70*3*wwi>(u3C6{e{SF^Qo?m4)Ldvz_Zo-Pg^j`Vt5BmfXlp<h28+F
zs|D8uCYw2@@yj2oNY7ev6!^p>QTbliZmY__oQfahHSZ#3{sS#gd&M{^S08)}xb}jZ
zgV5uxZQX6r7J`_l>z;>7!6Syjn9`>e)IBbp=_FJn(rBC^ROepEI4({2VWVJJEl22b
zL#MnyB>EY`_R>li=gYy{2By>c=L4+5?xub8nfv`JcFVWDPPpv2%|{!>91fH1LeBms
zUpZ(;cmIgnHl4BLf75Mpkr~xX9&zRZH|u{_-Yg=Ut6uBr``%w9D4RLGs3V*OR%K;B
za=HvM!V$}hqNU<X0jjr9YD;dV7#ktsE-XYNaqgk;`I9M$Lhcx52|#EmZU@G!TBk@o
zuU!s%Qb&M4Q49ftlG0CwjQnh0JjZLqV1`TH1PLut6ye1W2!$UE_IKAKR9-Sjiu2E=
z?>FasH)iNY$u*D)tTq+eCZyQEJrte2>fMZ1A(JLM;-IaMN5x8KHydYgO*CpnH<9sP
zgml;X)3#E`D7pJx*q3h#L^}ml@nLJ1d_cGg_O-F+GuG6Hz|(nih@0Px-l3L_3YI6O
zSh3j0?a|4Rvaq(?dj1}D6x7%ruMLM2OH~Ak6UAsWuDfhaRwhm$Zd`|Otm5543vpMz
zI`AP<;>W%fp))w>?O=b7+BPggWo%iE@646n=uGlqFXim)$}a%+{siCoS%D!Mp#vGR
zheyk`(@+lIi(uD@d={td%r3rT0B2Cl>C-~pN<Ykf57SJ{NaB2V?sJ#7DgiLvax>Z#
z)l=+{_$Sn!9Z&v2wnAr1kkV$ei|3)G0Hp#K)t3QDVC1R5PP0)DTC|3~*Lx_pk9GdA
zpo?wdqSvuNL3O6tAY?-7SFc2AJSFjA4P#P0!5>|}RV)cc@ocJwo_0|H%#kS#$`z;G
zF&@P?MKF*CYRH&&9!bP42{#<kxrjzOZLC_za~oFM<7pXLeRUGs0u8CO5AWOw=ZFM%
zmfpWOI9<T>eV)$#A6AU$&YSZCmJ8Ju{rwg=RXRZg75@}C+_g7uk(LN@^CVAP6q+ix
ztCi6Oe?h>Fxg_?aXF)tT4EoBx0wZ5G1b?x9l&#R-MslxaWV6H2HjJMGdy1h#-7p_C
zYX{d8<Ns=TD-W_V>q-eyO1=^*_wM>cWLb~1EtK&uP7dC7Y#s=I%qygYfSSK7F}F2U
zcW7c%HPDR0^B*Os=Gy_30g~14LZVNGjSQctD=~^Z!dp5;G8(1vwv&<9vpLrQp;Ey-
zPin0_e2Rzk*=XK2RGW`E0;uq*dmJdVPCQl1796~HWq2+_bd_3c5?X*gTddy{SsEUt
z9OJFcx8cVEh}927Em}@fdHmBkCg-hr9To;HZST7?f>KJKziR7h5)DYXpJuGq)?)u6
z<ZiEWk~q=~B;SMrJpQXD<^yZXr<a*p65-1sq<r>o4RC#BTrsirkP-g*t|T*R?fFr<
zsO$Np=mR8mzv~-)Mu9MK+v%}mmHY6^g)$AnpaX)NbNAOPDISzjKjd^)Zes*E`X0Qm
zGChl@%VCFK-y(;813z6QU<Qop;tp<4%9Zc1{9;yT%rZ-}>+#|Owvh;Mcj2r_g=?d(
z8PC{JAYdn8Y)mwU$J95q5u{l0sAwA<xa~mmeGgOX_XDMY68-XTswHkYA8mzo`n{t^
z?{B`9=+vv*JrA^!L1*0$C#nCK;l-k+7cv^B?|rA%I)4!e{%qTNe?IvMsSh<rrQfsB
z_QM{>4j_HT#VRI<!zf}RFFa|h;R?tW6_}BBLp?sF6IJBO_lMyfu7sa14jyDP=1#+Y
z%rgnAmj0aA-m=w2lw9!A_oi}P&{C7eZdQW$-Aj5&w@zO)Fl%w>+buzA4dKgee%Fy)
zDvRqQ8qu{V{gI;glpdlmCPmQ}?TWWc3IVF8c!cBW<=OwFm}|nkF2X;e--v1GHd=$#
zJB<gS7u<`>oma&*M|`u-L(yM<C*awR0Vso^ZZL6UM6|s{?+$5Ic*t{1uX)YB)wf$L
z<}ERn@5*y(d$4BLZoJV(90n_8N+{K+YW+bD0R!Q^;Huu{*01&qQ1~v%BM1|6QafC8
z!GGlV*7WNU`mDJB3MKA~7Hr&`L-}{J`K|rY#1JG-+FrX)L;uM6BONK|YCpd<<u!>W
zWelas>TaZsB1bH1+Lto(!jPq{-JaiR>IvLryWIO)bF~LGnLfP7601N{(sPHz$|do2
zo_Gt6udYbLi=69?NTM@%-Hd0CNxR1ghn89mg4R}h6k<_6=!aPf*i0Yh4yAc9BQ*9$
zp33}>FrQNTI{#C`N?CjGN3L{hcbJo{gtJV$QV)*gXdKLcK4ZCuCi_(?XhSXu$5s3o
zjIw+|8cun|A2=S!ev51><Nb5?AX&uOFXsmuo&Dn1mP}0?lP@KR5K-h@dOt}N^&R0)
zVPz)8(rY@k<mB@H%GqC}xSZTXAvb%xLa7#j_Rl{1rIOfkJ3yDrEvRudS6!vJ0mPtx
zZZ2h}^ZmsOWMYLQeO8Bkn6x~YiMwjonYK4kdX{lXpVW<7zlM2}kdaLA4j79213&~M
zyDO`*35ESAGZGwkq8Ot$kg2d&mJwbt<E#R^gh{FAKX$%yW90&kMgRJA=ks@jh&MXM
z40+r0GHW-JdM;AIbWhi_SXLTXY*72bTltZw)pguzt*#4`I40Pggc(SAAxKX>SOmR0
z?eh{-c6R$V1Bt~Qgit)R;t$G-C~i)#>Ca~Uww`%U(8OdVOV?SKZa~Qavh&lcGfuCT
zegXfYv=PDe%Chvgo?VB#ga!9S(1ai@ag6kJf@UW8hCd-hmd^h;TTyB=-7AWS@EsH7
z4q9WN;BiWeYg~GlHt@&rZVhPXXZ-iS0kz`V{(`NTY*(&K>s~&F8fb+Zgcu2KfS`YM
zOGaoI6~B|PRM^mzJ5^nWD__tWfxc%U>L%}}oXgwL2Z4w@R1(LU^yJ?~D)Ri+1;;Yr
z_?G<P1$OcEk~Kuc?FuuqiaYcj*y`SFnw~T0P?fMx_fJ8|L_YgA*Uso17y$A!Fty?2
zRSa_vS}3~_(gR0!npx9LQi0XK+9Zu30|D9qc^=y6ZHj>B8t>L(OZp=VgA^rEM8dpp
zYOU2XCW`01^fLtdE&(4=%dI`1RYHThsPcXC$O}7{PrEklz&yh|%9h`egZGwrvBsUz
z%ad<ysV&qz4WuOe?mV<>0V_hI*eehPOE$CwjGdhE$)3F~MzP;25-LAfxJhp6JJJsG
z_i4M%PII@U+KZ-El#G9B7b9FH;8tgJ`J5AdZ=Ugk?Uh+sFh%)!<?;kgaSNE2ov7D6
z1Qe-|XHQR*zjsHGKK}*u3<p&0g$4iJ*~1~6i~*4jW6ALW=8pfH1<<_a$;R(=vlo@v
z5TsBCHSj>SuV82Ms4?QQPFyCH8U?GZ^Bh9H__1tH)H}AX<P_@H4&04bNh0abpq3wo
z+&2KJ-toh`2%wBgfKe4WYd01dd#he(efwKY$av*;L&e)9Dj)gZvk!dQA9-Y3e$sb2
z(vi<`laX0C;3KJYXK`j;ZI$i)17XPxQeU2i-+mbbc1y!iP-@F}C-P=d3<`E7qHh!q
z+k}zs3PC%@>qV~+jE*Jp?=6)Pa6D)w$Toj&2%2^XX$7s-#XJw&(qVY@?q?tJZ?G!&
zUUg9nfi~(T;t$#?hbwopeWj*-FGyIEc({@MIU%FYxuq`J0Cbh!jf6G3GbfbXwY3m*
z%s)oh>LHtZ11=d+Da-tQ^=Y{Kr)d<GIu3<e%i7#8T?r#(FwbiJ*;>1jB+@U(*}_@O
z5ecLRG=7t>4iCkha}5JF+@ENYSkDOXY9~TNii9=AiFqwcLz}Z9kOd>S*z#2niS4-7
zgZufGP;{%D?wrncrzGe4QEjoD@^o(+a`oSXl8=q|fHF<)xER8$)lNBSgN;fZ)&~T+
zD_vf^>UX0ZSaDM_CZUaTN5mh}DI`13g5N!NIteR43-&Gu{@M~QFmM&D@vf#UoCJzI
z6(?7Pm%54<J#UNieBQ44stEFFKEgX_EkE5Q<@;r=lC&TvMk<#{n9zf#?Ic+&!CrI~
zpSDADB;t6g?-z&QmH^_~A_;CyKFdsgugX?}=q3`bB62ms<@vS6!Gp=X`24cB1$EXY
zQaZ>;J1bp5a&i9upls3|+H8;Kg?rvZ7QHT%M(q<-(3`#;rXb2ZL0oFi)`uAqKR<u6
zGufobB<w*H6HIMd{?tf+c9aM!EoU^PL4ubc{5BHa$aNlb(2}1bm&raxl+hv$_7fqY
zC<5sRTgKpeQgVQC9CD5P;=6%y%-B{9T7Q6Zm!1`REsL<`7Gu1cSWr~9Zm|4sZDglR
zxhQHrRZFm>c#R<)h>u7fCy%=A<9T>6p!b32I=_wzQUM2&5AiPlQQTGkycL(x3UMG+
z2MA&MQvE0QaPtk^oIxKfbbUAzWYGGDy|N<yNC)c)V4sd)QSr@6@RPpbUzA3;3V5=c
zX@C@HEQrAE!UOoK!yn&vo>xOUh7$o?X8T+=^p=UKCxFQp`kSR^v!-$t?~%yNOh#@H
zMvOQK!Dq%!*;73J&AD=&mUzs64`t|-+WRIuLq5hQFW`Bpk%u}<IqH+U(M!XlJtW1-
z^A_`rM7cE_E?pB44nrr?*`&(~<99bMgFBvxK7CoiW{Mp*BY&z}Z4gog^AX)XMLSaz
zxuS&=uW$N*MTy7YDMP`Ij;{=oR^<9+qgg}A!Uo1~AC5jn;~*R_t^c%<$^in$uqh6)
zIGIF0Co;3V6DGalS%b--wCB||k-f;r^1{gy<x#GjNVX?zW9M>DGiDTsHas9OE@wBu
zo<lN#u`g*Q;|<*Qq8EH9WH~gah*evgV=%HAOZSUi#~qXHnxl=66yeP0F?dHYCwexi
z3V;m)^^ecn)VHLk#TH`j^8v`1<&8znsJj#lsXjM*6_$l>edoJee`r-}4}9xa{2BU1
zIKz2r24R)?!WDZ=$;QZ9g1H-GdR~Nl=bca+d)*LH8<<W#coMGFW@tl>glOs?syAcf
zOBVADyNq>`LUeS9jo9xfB>iwfP)pLR9;68HsXr%kxt===zpl@CnN@~;{bel@&Z@~L
z&acoHK5n!B?E*`=9P{oaGR%$8-e@t}THL{7<OvO)#BJw;N{EC0+rUKF!<oi$*vBPr
zY5rZqV|vVD(sR4ySKyW_RCppwsMPcJCBD4SG+(}427PyEJg6G#K36uq{diC!_OWsW
z=3J>k`>C4UWAo2bi`nJ~N{+QNJiEA5yRuwrw79W0<oXA*R6xD8GWfs3I9rZeQ2Xt!
z;Ctf@Dy;be_;Wh-HgWL!Y89$ZoPm`Wew6~qxljFw|L(lMlTO)=Ub?W~sYCOU4m@Kj
zF`_cu*KgVvZgtLi)Bf%<Cv-{xWq(WpI~b=XOFZIkBVx+nxe*%&1zhTgu38+UVQ;D_
zDsRGLZc$kQS~X-cBt5W_gjEGH8}AWZoDLRVe`Zd5*{GsEYTdAW{VAB#<KkX}LvURH
z;S2Pnu`aw7$YHhz(6>|fs~dA`RfA<wjw6h(VH5(i6nl$|OzJEV7G9%+QKTmag|TqK
z?>mI7Q(03YM@i5>IRiP&5id#XsQqf_>{q_g_kTCpIVG%QjhQLT6UrrR(REtx7T9jD
zhk2DkeW1d3ZshqDJcK%BRL6rA%XeyVC-1a_7Ts1w*LJH%u=toHje807Jf~W@R~&WD
zyS~_s>XA{~KI3&Gipg}<WAE=z-q{s5u%jt<{kgk%XQ(=A50l{kpSg-zVZvTk*@Ke5
zR1b5h2RRc)N?HDafIOLVY@2*VkT)60(ZK}=$*06~cXYJ=mIAg%dK!(mE6i1b6-mx1
zBfZICg}6){Q*XO4hU{`0#vzkw$lq^&0h=;=hxv8UOQ5M(!r5jtkw%xvFQ5r>qRxL}
zxQgixVmCna-L^TT0~(Lai|Lbz03-~VauG7;D2^N-%k%1YwaJ?eMG)^Q6K|n&VtLq?
zHR3?|062K#C?C%-`;Z=;vYAo2II63)_m1ngE3eLS>g;?J1;^?#N&5NM?P+T?6A_Oo
zo_Y*F$<aTX{-{;ultCz%Dg!otXCcizCkjSPB@=}|EZ5+bDDVkP^k<kM?b!V?`8VzI
z=`;D+>*CF2o5{|U_XpN9%pVel{$lYPhIm5LFMzRULmI%vYC?RnI#zQu{}WB%Gaq&4
z=j@64QG<r-qL)9XCos`S-~}W@&&svfxX|{L2b5+4JOsz&cZy_+YOTma-D@l+q>_c4
z!wSnH_jwE^d2Da(#dKUAH}r&22#TK-{usI6F7}%3BYn4&8>@hA54HtF8!^9l=BsW)
zY#AUk5n+RCdfe`Mnq+Omj4|4Ev7n*5)ZIZi=X1G?WEp!qebeq0RG#=0{%G5Wx#-HD
zfI){kRi5kAWYNe{5r?-bIqtgocQyxh@lT(5@SQzM2AHBiWXBDs;x|TX-p?pqL%<HR
zPb}9g2s4LT<dD0eT1{3oyyc-1Q}6WazQ5DovbsHr#XE{S(R1i?YR`~>NYVyJ-!{PU
zC;l2%G<kM^)@oZue$~|ml?6gzSWM{P?J!q<q%EMu3+Y^6%4kwu_hz%&cr!g4rJ-&6
zjU;(y7x&j5{$Us{)&w=tA;u(%Mq<uOKQa_((d7=Gn?yP+!ogZyD$s*>Y>W=EL*<z^
z9nPQ)83;yvRbnVk-=`%xG6glz%TZVJvb|42E^Fv%BIGEE#OWs!@;D`2vi>xqmoOyE
z=Ix91^*!6IUZq1;&J*QwTb#Y!-=1)M=9E`f&<&|pj*BoNVKvMJGRCA{ZxvBJY32w6
zJ*9#_TaEo-#dP5V3&GZjOq}S-SmsZ8?ZIak&_D9a4|ZLH3+LdGSOyCzaTyPMpv31-
ztLNT$Y)m}!Tj?H2+!&tw5NO3D&~<c;&mSnJfIs3RryzQVs+;p=BE=njRii~M6#ZlE
z_Or&z2KmvxxI&}!BFXQ#(GAran^uGeL#nWYd#_-@6O#OF0YB_Br8Aqw>-{+wmuYw%
z)m73L@tW#5s(>E82t5N;*iT&}IIr_G8d4#km5At}GL-Vj?UYzS-()Tqls`z;cc=W&
zAm;asc`HW5I8FQm+OoW1QnN$tx)^;kN3RX1szadkc0J#XC)!^<nRFzHffg<(9hSe>
zjNRQZ+_f0U;s5x*K*u&tdm~X;&TvX6NZyS{Fo-HEcaMs;<<?k^=`BtFp%o4G`#JAb
zV`7v$Ft%SeRQqix)T+cL`HoN}f~J*#({$rScAR9ab->^=q_)_NH`@b!%lz9OP7M?D
z+uR@i-j52w1;~M9di0}@M~1THg#j9=)iT{x=`*9fdaDbUD%WyX)%|S@X#DdtN3uGR
zmisSfsrMjwmuEpCU2^5RJKw2QUO)IQy(yi^#Km%XE?>!JCTQ(3a3q(?u4gKzQ-ZpQ
zvZd33;K2;W8=?JGonDXYGR*lbiQVUlXpJOCD1@NVo{V(vS_z*kk^FID&HA>k)0NK(
zBi3O<=GzJDA9)juff!eqM{lv#Xfx0mJ$TAEEM)ejgRa04^^N)oM3B*}u394yZh*F$
zjWW2|Y>(CtJT<zIwU8S7F*%6m-fOS@GkDd9@;G3jZ&Gi5s<D9f6>I;7RF=e}s&<5z
zwQg(Q$sv+#M*kJd1QEOyXgdjji`kU+ihq&v^0ZlbkZ(M6>RMMf)xKKEWPrnROaK4>
zummJ@ie649E8-}@>ilHILIyp3pQ((29&Da>@ozEM`(*@AP%f9xDUa(qCt2kO5Ha;h
z+Mm(Prp_@msVi5c)_4_FC6no--*Zv(_X`-(`7bQ-MsdH5I90)CjtKMrweI{j0`mqL
zFrJ66r4*N|k+-@++^s6R{&p!r4*!TeRpjak?en~fm*?<)XKSq3gq<CM&*+daqTOKm
zjaiom#xg}dO~X$6a6VVA=5%T#wfeI%V_<2ohvYtsRrJcK-f3%g3U@2VMh5-a5YJu&
zqwOqSFd7+sqQ1I<nc-@I#mOv$y2h}}=d^$^;&Z~0km2kXl9;yguwPke>k2?tFb}Yc
zg;jiU#xq=%cHFWe{SIPM<?(H|>#Dj0p+yUEpZx?oLdw;LrJZ=<Ft#U~V7h^i!HO@G
zp!_sO7(<i7i5e^KK%zwR5T~M`92*zEeMz8eGrT%zGPc6Mfv>NHrN~cFO2toY8AirA
zytUJOH31YjbwTLH??q#=jMRWPsiJB<tLaU3?DYcD9@QktY`-2rpfCN{EnO~|OaD88
zs6KBZCnT)-u(QYar(vJ4=cdFJ*q~q%%R%XJlm}09@E|?9?g=C3)KpYW4=%tVEE-O(
z9h&hSG>1umluw{aHxF%amNpQ-oDo&?{RIl02KUAbjcg}BmfMBgk!gb<4_=GKPp>AC
z;EyD6b5U%IAZqdlzA>6<B7-h1U|-|=^~IYIDcg@#X#F<jb3ZY>rTOanm7*6S$%R)m
zUcokcse@16aG|Fmjz>KS`*omx-162BCk<vvNQa+b=!rlRXFh(st|&O7_Rc14*0JfL
z&PG|;)I%V$dAsO1rj&G(QjERQez|j`ezwp!-CzR0jb>Swd)$~LW)wKB!zp#nr29YK
zl$&owi*)H`{?9GFM?BQQYeP}s%km{>_P&uDB1$$}dW>dmjW@XZTBE;GJmJEoUQH=x
zk^%9~bh9J|7Ajj5hMu0aKOL)S&6=pDe?r)4dtJ>ZH?6m3jDAe;D9oC2skdoe{Ik~m
z7*b&pTT}$r$kNX?ShleZ1*0aL2AxMZ;`6ykmSnOor#2o7EaX9J(^0y$pIbBtPS(VN
z6q5MfNkfNK2&ubxXnU_m6G~Ibf@yx?p$qTudiFt)WkWW+LK#E7#wvUfkKa6<BeG+7
zp&2Uu+o2qiU3wbqz=w^TPywG;*h6bC5Q;G-5$@Uk)Xziva8b<qy0^;5@m%9izUJHo
zF#!m*;5~*~eB0mCr<af>j=GTkm{YC5Z#r9WUE4ad`X{3EE~e$eCJpcEuViZruaMO_
z?z**?O~v+8lOyd!bo0r^ii@eEQeT|EZm$5pjy4vgjq*k`XrIo81XV{^MPjxs=(`<h
zL00<zLQXYy-Ctm;Hl9ifpp3*VSM;%_Lrk$saU+f&Lm$LkMf)1u*|+9US%W7SCN{L2
z+cnm@&@cDKOmP?63-2-eX#Stiv?UKh3?dHIvrQ+m_V!1&C=VZ>+Dus>{m^rcN_+%!
zwjBR~xwc{8iAOC(g9HT~X5<-ilW^OKL?8E!))5<Ra2o3)RJ)TeiB(LEj+GXLd3*E0
z<GPlWK9gbh!4M5d1i<WAoAPzKr(XV0Js(N_3Y}%dbSEhCMWb?;`ms{&{Fz3HWS0wk
zsUu){abJg3JAKP|q}of6!qD&E;|lXr?%&5u<n=juw%rNGQXN{qVQyGto!|`C%%bNG
zH`$lTG8_wu<HCua{_0Viiqt>wI;4IIZ@yd}e#?I*D?vy>NV79__&85dFgALb=6N4j
zj)P*}`)PXB|Hyo&t`~J;A!w~5jEG=JhtVueS(CTP`sy9tuyZBkYx$P~VRh!$U=Hz|
z2J(}!Syu)-yfLXNM}e-#thoMv5Uimz>STN{wdQj!GywDI$^cWjx|EV)@dFIwA651$
zzNAXmcC;zUUk)Ogb9LBpg47Vx8(W7toA@&vU?^~sDbKh!J8IYM{^j8F2y@)yp{>us
zHC%C8YIjx8y+KqEk#lmCcp^!w<m#X03UYLf)z8W>JTKBcEA8ywW;9gL5H$2!ZM%`-
z9EBs-71}-2|6_zc_hW&F_QC<z=(^3}>Nz}Bv-(^(;^|3Vq8<xP(E6rjR`VXK{&k%C
z(A)J{=L40{p<wwFftM(BOEOv1F(i?WBf}!}g08k0jZwN)#*AQ7cfw-QR}K!+O3xB%
zr(|3((z{t+x1iYw=|kK7btul(La|<cgqFj^aD0s)^>q6mEHGSm^kP8t;Y;eg7gYG;
z&mmZvj%#s2;KC|t?H>!FK*i6|U5rB3F6ob<oOX4Ex=@knO5F|CByv^qxw8ehX;~ml
z57@)b1W2D?+FJ_1pSKda2Wlr1oVPUHq2ARF*Fbp_nAd+Dg_wmFoHf)MnvU-xmIX3q
z3O_KN>0S<5(5K<dMUjrONo8#45n|Qa>cCtTOtvK*a+xE(;_t+~y~ZTuGx+*F<6{TW
zpOaC$xP}2g!Z7tEzT=D{44K%T(r38O*fGkLi@!T6me9YFjl*WPPc^Ue9_f82Y<8U6
zAn=lC+Y7+=n7>U%1v>r-B;pRL{z9%Ku8mNf03Li(Dw8isKQzO^5&X9BBZ2HrLh`Im
z8|?50BA-@iq8HF}z14(HazH}RTF&HAKH%UtD|3juArMyVZibwtm{jfEy%FGO->X-P
z7W~_M31ZyabcYL@q7@#$(GvjSuQ8;qo4Y%9^#2U~cA8ej_wjRyBEpv9Qkh_}?1?Fn
z!*M_TPDkh4FLy!oYhAh&G7VKwnOC(5Pl74w4849>oCrWj)0^On1(7YOW;`N!(D)B&
z`XBdywG@4PUT&Nc^B9h*OAEuK-)~9LOlO+0;szGyW<+B3Jmvzbwj4hxE(Qu{G~@b#
z+(W<Dg*u9TvqgX(skc+V5J<oi3+iNw>$x6GDP|(g-SF_5{u`ued#_LZnS~l2l)6&O
zvUedw9CH(GC<1~K*~o9ro;?kaP4n?P$f>ADGRp!Yr>J83Om)J*j9GflNwvFKQSCe#
zWP6%ODuZ0)IQ3<tQ@Jkg8HCH~m3>LQ{k<$dh>xB*CNihfztA%V-3Byda`4ZK5qqNW
zL#KB4hZA)4)RWY^%kHCxH<(j+UW39`#jQ^Eax_>cxj*LWXx6Hxu}rZ+YWe>n%*;DD
zE`oaSZ!uQq)hl3S^G^MYjooaGGP$k*uW1X<fMM$EQScYszMyPponkCg_sgDluiGHs
zbdyivP{%ap8~^In>0;BwS6`~z^bzot^-sMHpAWib_P&lMD@+N^?W>f)|K+agF=aP~
zpIom@O#YFTX47u`D7oSXC83p&vzp3QXeZm~HK+)zdo7FH>Rc@61w$J6(V*C7^ze+5
z^P~7Nklfr}kBMvH1_jAXPZw%DhygM+9keE&^7s7o)3+nV)G8&IKSd|E<rN9?bVg9t
z*GI8sLwR6xN6%vJXKX8atr!Mt>><y$8pz2GhqZ){SA=L#`J8XH!d{TSPxLvkawIkE
za!0Q~E^BF&>OX`vCsj8SP_+g!A>Z6Ey{kHlv&`3<b<k&QfG<~1qaYd}^MjLaw*GnA
z95Z-NCH}StA!D!Y{Z7MrdND(wRy@yY62F3njp~r^AvC%l>s9VWE>|aF@8fJSn;Wij
z=kstQy8g{E=i`(%fhra+7A#3oWZ{i&W1aK$=S)gs{YRrpOG(z(!T)_7RfAw>OJTrj
z=T&4saI3SbmjV|hSo~sRX1RBEJgw*7Xl{xocYhXJ?ljwK1S&O((seCNl0n>o*_u-J
zZ2_0Leff_Om7j{bn-avnygO;{8=?*6o1zJ0cne^vlAp@WY|n&(QWTR?4H$e*H<cZU
z>~|NeqEwsr4;1uD20RqREu64JNfl^NNnawbc_184yMks2(?9Jv>s)7d96|KY!*r;+
z)`A66?8NzkA}>@+=>Wdnq;q9})3w|<xuleXvB8gVMaS^-=NMb*@TNf63Qe%011kDL
z8&3Lj|1`HZHC;y}(@EVde8U#7EUhSYYNl-Fh%f@H*td<C?e6oxj~o%QUw*c}Om`Y!
zWWy8^!}!ZX?Dy;yU-Eb9cM{24Dg+Ehzg3(a?VbKsozV>Z*no$muxgYwqY}IA){6;k
z%!6mRH3Tf+rQ4o&dIhlljaK`}|5YYrSP?Wi`;*xwlHrC<AysE!$&gGmwHcDzXb&l_
z6@7Gxm{bla8H*u<GKH`^t)la8TNo+(%opq`_-bSgXS)zyfH8O%UAXzSxJJC9MUBnv
zAZCN6O|o+ExNi34)nVGGbHv-VjJYdPRN0CML;AUBmSgq{o76Gd(Toeg)s;L5dr9ZO
z_awD+$e3m<sPX-GbeaB~-b?07d_z{)&~ld9pKM88vxkoIQu`Ce;I3EQ?tlo?FSsX8
zs_xXn30Sv~ji6=e<JB6$zEw<d=zjsybkgHPUjge;3vn^a|DF+u3TOx_y)<X*lWd;K
zyCWA9clfV)AcOA*w85e?ii74H+4htmh{#kN(re)&n>hrqWZ-|I>ECyEKSkH$RE)QB
z6t^4ou5&lEqRDf#nEK73YHaGX<#sR7`f0pSz`6VwiF{$H4pf{%&7&l}lm!+isX0@w
zk&{&6F-NtDVB@}9w>|C@kvZuy<!LTA1z;&kQ>L6Dx79^u$~2gY@&aVbHs8Fq@}btY
zzc3%)!D;=Fw1fmh+1+^`_RNLiUAhW-F!gVTM=SS<wHbwXL7mX$TeNk=vMAlPG><(P
ze;_%1#k${c!B}R%$pg8TpVbI?ePB9X>4+1@#*85b_0ac!Pa`=4@4ppVckOo=@7J3s
zqCR(jhp-GJdjtTR#L9pWL;U!8IQg;KbMBrvJrp1C?&y=?m6bBEm5IN^U;oQiiTAD;
zIu!mZlmoC&vcQpftB5-G4stw`np8ZK$*|sGXv852b4&^3`J><Z?bZLz6Ng-dmK$MV
zzM$=v%#wDm{)7|T?rbei@_5IQt738lR2RcvJ0M)3R~Dz^h!$ZZ?x4eSv#=9?Kp-~4
zqj%nj0qH>PXMa!1O)V{(I70G`IA}l9yG}a8?Q=Ycxtu&5o?8up@;=uK2T@n7LsG{v
z!4E_f50!l+Ls6a?-|;WkREmdfp7#E8qAu{g7W_Zmk-hvy^*eCRchsAppN+O$y)=Q#
zcKYK5wyX;p3A8V##2UY`>nMp>QT!Nl(|FAPum6ipnNg8?y`Kss6x#`&YUH7$BN{*W
zG_m{45LwhwhIIwb(AjKvr&`k6U%ZMr-OTO<{U^nV`mZVF+?La_6?_4w2O9cum8(J9
zj<<#9255MD8%flz6_R-=+}r&$XDQnrE#5GJ@awc+0Q%O<RH}SvkY#*RXW_-%X`8ET
z?@69t%@`UmW=Mpb%llM<JTp5RLc+g9{>Gagjc{5%2$j4TN^aN={bljSwKk;O(2c`r
z_8puTC1WB_$7-hOqB>-*ilA?y&5Fi$H<Dx*cGEZ8_P}J3IV0hIMoJ6S^JtkUnOja!
z!R-D9K^iMjlsMvB1PY`*DW<P@BoMv$6kb<seC5V>OX5KeV$YG<;KM3s<F#Hq#;Qef
z=u<^@50l~-Fb^=qpOuPV7TB&%J?EhH*;<#MEnI5mA51^!1x>JQx5=Xg*Qz;GIKVQb
zvL)h=u6la}U#lIAAZ9G<{oC4(8KXFwh2r#PgONxn)Kmu0UkfZF*}px1jb}mS(asK+
z^&VMBNB{a|1;kNWveN}0XxOxQNA}<C<p&=z<iA|62=J!|ubm+#TcdCiPUp;cEnXRh
zz0x(v3~pW3TD-&}$@2JmI-w|9)Y7y4v+sn@dl$7f-!qzpgxfvpG31kR*37XAkjr15
zWAp!0j{4~goCK(XNAIjEeZ7P?ZJc%|-z|~O(DI%78e!yWRnre%qbVk33-zMJ>y3hS
zsLuDUFfW=n+GLKGY55L_MA2pOlm$4g$V#NaMtLK;I&frFG4bOUdQXZ$r|fq+NHQ#d
z?&|TV&-``?@2Z$y-Lr2Q#VJqev^RPk%g0V<L>$69e|9(mQQiQNS~v61ifPPY*xObJ
zwSVv29zEw;{f!`>f=s2JO53tH<g|I=;!0Nq{eQ5F4S~*p=6w5cZ&brt%;4z(#Buch
z^=rH$|LBvmGxvUpIa=_u%afmz0za}L%;WQ$7aC>)V<)?sz01yRj|A-^8^@G9P6#a4
zUf$6q_|6{^V?@pAc1Or1O1=;@;zF=1Q`_4_1<BK~O;jNB*xE<pq~==HX}z^D!$FRY
z8+!O-$`S0|<g%xv_nmY24J6_Mc2U7)l|mwaUOg%j4FW#=&bOE6yX;D~&C8~`b`w9t
zIUw7FaPkbG*wSV`T6{SLHus{DQbglnlQqi;-9ABSu1vHuJ<B1#8ccRfC-#JT!9`do
zGX~%C1P4>XFvRv{%yL5E&uv{-bv%hwlmwT9`#;cMv-8j*Nu-98eUG#Q-+tcS7LSKw
zq35;G=*uXxNE$s@k|<b}SZr1|Z+|CmT3|?#>AB6G%<B`RB8n}3JfR>cFX^_2$%f@h
zT%~}|oW_WR?rFBZmhoAH(`<@^KIZRZ?P;$b)~CXX4P<qb7I+5INsXZyCHBgY7Qc(S
zD*V}XWYlA_^Z@OAF~?E}&Gx$_dVa?tKO*>bDG^`dGEj2nvnEuJvJ_c0<a|YH_{&&D
zwu-1S-h-wqaG_38T)*X^QLgnmltLI^7&UYunJj|eSM2w^UE7@$)cHXSH%N;!Vbhu+
zZn7YrB&%I_^k5d~P=+Ro-1JwMu?vmYOS@yTN4LcJdnJp>+paqbZ9h9l@|n>|@R(xW
zYGbz_jB0c54C=b7#ZSb4bbfj^dS8Cg-*jLbO`rMcl_n~0w7$s0O4~S9HAIfofREo~
z+_Tq>tgR3PA?Y+d!nh1G!msMy?+J3DD9LeMMU#Vbyrj4egu$s<@3VbkhccVS**7Il
zT?nTrL~gBeBl}b`tN1XmO+h&fry@LWIk~Mi#fV(UjSYN8W&Y05DhgMjEIO6j%35{S
zVj1pwMA5IMJ!-M!^|Iat#u>G6kCb|&`=`Gw!%0Q^UV;AgjFMKzj|8eWMi)&X4=_{^
z@c{^xKJhD3+t-kFXz&==zax*k7#K*{VcIAg40aGO6D+vdNWB{`l7Gg9#bxNN+kAP|
zsKB*DuNU5g)^9ePk&Ws#wOwQz>@ldpjD1UDl?|p{Q67LIm1O(oIiVK=0|@Bx%CWSS
zlssQvcbmOk?7eMLNcRXpsD@h5IRC*aceZFlACH=kL_K+=D)Q}wF<tzeX<QGh8#;ML
zrU^N7M?*dN#yvwu0t6sg%6OM5=)?;ZYW)PZ*00W)Y-+q4#YT?!xoj^$&NyBh1G-E6
zRx{p>8NjFOO*JF|N8K1U+jTzO4`Qd;tU245(!p=d5~FIvjyQ}bs|`@|>z&8L<G)&(
zH)6I{raj0J1F*q~6|`nf;er_JxFOhvgbyH+dbyUVsKBn{z;cChB{k5TCBeV7?fiO>
z1B}6D)T)Ym3$L?Zp7%|*cR^aHGAMMbJTd9~Jrj{W28s|2rSVw&X|Z$yfjOM%eGr%I
z9<#>^mk}jsHa{^5yT!;41aGJ|50hld1!!$HiOe!itBQc`M6CnX>*R18_;csa-a_s+
zrm60Q#xm#u6_4_JnRsP22ni0c9g}9c)w(UO3cyOI?dTjCz8YEpcll)AjzhroJPuS~
z3t8*!d^E1nHf_IqUUj-vTK=7H4dhUDC0<1a%(D}u)jx6ttuZCq**6cpjYg{C9bcml
zjeP}Yf_Y`)%#7Q}M1)|6xPQf!MeaLSwO|#Qts+v+rQZlcMHx%f-y2-*;4LAcDN(&o
z*;%6)FxVYn8hl@QGJ?V8<ZU;HPn5KvQg8n6*<tX!`&*cdtxs^pOdYk{dKreR7v_&4
z(r;8iWO}7|W~+PMH*DE8Mk}#-EE_^=5L0+UVG;%+>ThH3@<~&9EZ%@|;o_o#86;^w
z0|wZKe>B(Z5gNPbz?%am2AqFd|C9A>yatjU;?8F}iOZ<6VRxMoU!2f4ZgS#vP>&}@
zCr?BJ?4GegkFh|4LC}3Tt-ayRRoRNfVcsbD)Vi3gk%Xq>D%@tJBQ{1Bz6@MUb!A6&
zfkmB4nZLPUXA0q7h`yuYx(a@9;J0`gN*H!Ux&`7584e4jU^apA>y4cdY<&4Dyi=E5
zPkqq-#+K)V?6ZGgXE2|>G^`~$j8#Dzm^~B-eZeKO&n=e!`RikE4Z+A6Tjm+U-kfu+
z;C?}gbk+YzC`{QIC<nIJH*Xq+u%C6v#OHVkVoG)Z&z(#%T87LEunN5~>YYhjhD&Jf
zKPYB>v-ISgiOLlJH-G?!!{9jf%AebjmX9?U$5D{mc2X83p;XKQXMI|)He|<3Kj`c7
zrqyEZI-VZz&O<)sazGo#oIe8_qJEF8RzC($$!P8Hy#O@}2YdO!V^QaLE5lbHT2BdG
zS~l$LJ*5v0fDpD`3?AgO#jf-n<iFkzCW^e$G?IL|;fDKielW32rR@%7vys~hhNFyF
z3f!ihV2|4@ss<!nQy>%HG9u0gt!+x2nC`8$dQgnteG#N9)v2$XR9BFXb~%`NwcugA
z=~ynByw}ukQy*AwyW-rYuSaY3N;9-0CG7o+-LDPhg6ZDZL?iC(X_4e2o|->m=Xi1|
zn=Cb<X$1fNK)#6glm@4YHZ6!cQ~!lmh5MJ|A2nSiYM|*}5X<{4NDqAG#nOv?tgeTc
zdUY<SbF8J@4M`BitP<T_qsLkeYD`9YSe;mLc>aEJGiI0xD8^%(-xrY?0r<kWGggIq
zBhsaFd4Lph*bKbu?HAn*nl<A&LlZE8k(8e(2~2!TGwZcN-FJD66g8yEAwoe3&Q*x|
zm(N<VX&H#r7-JCTu`ZC%_W`Id(G4iWa%TjGZBi1AP;1wTV9eZ3Q}R$2s$R&>-zI&V
z7i8Tg8C<rzTn!bc-2xAR1ex)Gus269_Y$DwX|hRPF9(YYSVp%VUOsz<*k<OTYK9L!
zaNNgqH?jC}H;RU!a^FumGNw@*ce)kw%l_|f0}w*|zhxegW-v^uXVDx{;74)!J@`gv
zF{VTO#;xutoHT^ZIBwHM{P<m<f`&=)nODd4@{D~9XDGg~MwL4{E`ul43{JO%r;$IA
z0quAcDY^7A1Q$6P$|)#GAkPL$q)Pq)9G|!>V2PO@q;7tW%@ZG!-#)1PvNycC+dSZ~
z?X=hbCnmbfaWXP$(Agsurv81o3+xUO7vVx<`b`}?fr%6>fpF#jB)eC=EUj3n#i-W>
za$Gpy;16B0F)_ce<1N457n<{XNm@~BonD-_Qf4OjSv)y0mU8Z!5~%ch(!ljx7sAK$
zp$2y$<{P5GeRezZf?UPJpEc@~eS#2i9ZuVgy4G1IP>FjWO@2G||DTLlsQAR8+)IjA
zI10#s&r2*Cq<I<5BI5WS5Yo}?N)Km=ZTxTjNjVwKjtL>lfkqL6a^8H>)*_#A#&bdb
z)EJhipEQ^h0jN}|n-Os>nqO3Kfj~$Z&IfSq29h7V@|&b(`#deta5~Q91Yf{voTqWW
z%n}%{5Zfmn`CnONK~1RKCa?qS<>_n7@S3gG`;|QHTBQ97s=Ti=fc)ZIvKf17##BLn
z7gy5K&4?t%W6v&Y`E6cG4uBtl?E!Ag->UfV-J25;$77#NO_cx2P9vXxz5Zi=Rnf%*
zy#|<vxq1t9jYET%H{S;b2mVm4I$s^MQN)9^p?h6`+*~w-&*~DiQ&gk%zHgn2DD5y$
z=X{d}b{ov?1UB##?6hdKAn_1C*(k9`<)}PZsDbFhoE;qXD`?j3AA8w;w;!Gi_=F$?
zaD5<ZxAwZQ@v?RDm_L!6Gu)iCSY4Ze^K4#U8kK)(K0T(x(=z?4VwyR9Q)r){*JfBI
zma9uY4H1IowPYAEiFP))tp02mk!{|VN|FA*;5ogo^ECeO+>W1j;VG;20u`(H@k>10
zsMeO?&1+kt^$Y@N;f1fu?={IUN1fcV^u<vu+P}<y3bne#Yt)9EP-`(2e!TLwSa{93
zVzv~dbaHPH{t+K3r;7u-FB7q1<4_Tg8EI?XN0fCi;msfTrO~P4-d)KMx-eoycJ#b^
zCLkc&!9}9qfNTn~ie6^|AO9;VuGt|ReaftOPxk=?eZnTA=Jn`dzrLh5-z*BcI6j5f
z(b&}MzI)q^Nf6gX^`tTh@tEBYM^WfKokCKfw_7G<+o1B+WJ7Ir-4bv)RqMz#$xOg|
zaaay{@fn69wMJJ#wfkPs)e^579f2HIF?~y7xccPDH>03`J))=EMoheX8Fp9@5<T?!
z{zYRKyR;u=S4TjyaHuhRc+p+^9)zNyXvD&~&2R3lL4f_Is9w+0<vK$WJ$D=PRHRvw
z?YTwR>u1l;*(5*nq{;=s-qE6>Nf&Rr^w@KFD5<yS_5uBZpeF<cUhc9VaMX}kg@;>8
z`PKVs{lOSM^3Zn}eP<NGVb=2-#5UX6|1*Xl2YLayE6zU9a7e$_NgUV%`Z#Yxm#L=w
z(^Wz9<+$U|J`Ma{@sV=SWS6|-e=j=7iqL&p7#in425F4AL7Ed*D}FzS->~RosJie|
z_nD%dK&g&v-0Rm>4M6<lKgQ%f0WG(k6@xLq$E5FfJf<vMZRjBRI)rZ#ELZp6_FACi
zT~K|$^px=X{r*?)>^8a?*tDCE5g3!>F!zfhBL;M&3Q-3{ImOZWOlx*tKW2+F)DG6>
z4qA~JssTvjrb9NLUd;~Ru)i|P6BLp~s8)FGmL2QYF9>Rt`<R3`uc&8&yuD$LhZ%wz
zj1zZb_1%#p@qeunUS$h1&Y3bh@R=YDM}UGD{h?BA%6Nexll)T@j<api&7HS{i%Y0@
zm4hfuYllF<<!@_iys&0%a`j2dw*+R=$E}2UyYS4Iy1itNoAZlYnD3`&a;`>Q!SYdq
zEG-|+q$kX7ZXT(A&|JY4fe=Ot7rU8pJL$w)utzR4dLr&lG;ny@?Yh@LWI9a|Jchj$
zOLbz+d>_O7VdVT;@FwW5V^#F%vC<C|4ObgF>Du0-POrc6RYEUBE|>0pjoj>^A+~Xk
zGRAIvI9h4=zI!=5&yy2<e}|hr*V-M|-D<A+7Qx~}dqSwUqY|f^&Nt)HUW)hi`wb(O
z@(nO{>~-@to?Xwm_PIf&@yXhB4fnmPBzJG=8-DMdGR@vpVUNP<4eW1zEigyM(7Qgi
z%zvxzNdlUuas9Cy16SQ2ES3IOU?X;%QwHrBSui{SH<{Ba*@$h`#dzNv=TUi6`p(Xn
zF%rL9d9&9vH*)$1i7&m=Tdd}r!~aWB@4empucfRgY>+c&G)l0{hp|&k7vt8|gE6Qm
zdbjqZ=)d>@s~4JZ@y}ta9WSH&P6~Sa?}+JSx%p60mTI`%T@G!t_`gSzjJN~q>&KYC
z46a`&OS5KAMDhj~tl31D-+oEZ%f?BdH-hB#gZG(aI<&<~zceu*6s#2+T%u}mZoT3J
zkygCr9cHfvFp3MbZb?<vNbP>z)8W0KhDKwh@j$&0{d^<%)+^H_s?;C5^|?8-;;8Xq
zA}_WLO9>xtkHHL^@RZ3H&c$Z@@a_!Fr1uC{DZYD4m-(6AaY5n5f<j?sjV+nnX6GFI
z#eFl4Bd0_-CaY~z{AW1A8qVao3M+3;_PCve=%-qwn#%Vb{}2ECcJ%7}Blq(Y=jd;C
z;HqQ=^zx%?xH8?{?+ZKFpzQJtH|#C3PF~kF^zO*;?@9(j0JREge@sxgBUGCzMxT*P
zZBv6Y*oQ%vdly1=ce#p@(e_tSsPac0ObDLVw(Wjt1LG`idCN;f&iFXVBEziLD6C_a
z?Xf@G!4Sw$jW>t|LB;CZb((<LMcY~`j}Y?Dk<kCl00)>H@+m0xqJ-5)HREzn=$`)i
z|JZxWpsu3!QB*=HMH=aDB&Ab9N<yTiLy&He28#~q2I)@eR2rnarMpY`5qE8T-#K^Y
z&zvvk&i!=0Fu&RCz2aF<ttS&*H%)8ZMV%f`R$Ar@SKY+k7h9&83ababXx>~cxb`hc
z1`(56=jA+cdhyIg{60_DtabUMQ8yI1jCC&#j&xN&2>H{CB~y4JSvKw;N^Fgl2PAj`
znm_XB=DoZI8iks%?Vgc_AP_Fy2Nyk7D3_x>>~iQ8YYb*f2mux30|Qxt*!#>MLJ0<L
zV(E@tj!bfL5<-EI#^|Nsa(x4NH89yt={@1-r54Zp8p9R=)GE3phcaf(!_Vb|A>17N
z&)7##Fcn{b=&H?;=UKo>`_&-!lKlDV$=1Azq{ujd*JUY>PZ*c^sS($Aw_inAM=o9A
znban~EV4;hTbSL_)}tE^uG=p`(#1VJ*7tfL1G%rZ1n0jySqcE_1Zkj=we^FvU|=rH
zu$auZW$d?{B3H@^8D8^RB{SUi>2fRNzsA&F9PRiQ61Zk{xo}h1r#;=hmO{qaebb{W
z9|eW~CZz83lKf70s=tUb+X2d$l4Zd*D^Ms|e2)5<vhcMZhHBUSIZn4H?a;7dy;0x(
znHHMV$CsURygsHY6G_j|-?U%wJ1#-(yY<9?t=;*%m1E1WaT5N@u;Rw4wPy$#=y6s<
zAQo_WR85y7rVmrmnpPox?Xu7F`aGD!ROZi2@vF7D5IUQgYP~^bjk?p=2*T`Aa=KH&
z0rN%!t0b-^MRqi`Si=f4B?WZShnL!>n_qz(zV!h}DZp1MQWCrUc(0<1@p6Egx9y4G
z`vSYys;^Bb7SV`VYOyJY$QgS;VkRY8)KH4rXInQatTR^KQmLCQE2bH9fxJh%rU`?*
zqLseWA-Y0G)9@>mi^1AAiRFRa&sGw9_x;;l{ANktl|tdYph`mZc+2JTHo}>j+R-RC
zdZd)md+P4N52CzBTev-A0%dzEYTR9aQ98zi2fvauV2<mUXLUY~{sm%vu1?>Q79Bk5
zjw9xkl=Q3yDx21u0+7YvD;me)h0Pny+12y?eN$r#qP;=HgGak7;yqk0ytOMemKLAv
zc-`XD9u5UFzaUM-^#Hj?yeG1iZ*<tQos)TdJ0F6I4ss5=ku+78N3m2Bis?vQTh{eh
zX^wjaoTu+kx9c^HSin*8W4xa!$pkgPdI(U1&|_E<SgYn$UrtqSWQ>VFmI6u4KbUt1
z8tckg*Vg{N2Prupg#<IMU`^ppI|+zS=+KGTUKBOvePr=fvU-wUhhY4<91jcFbY?Nf
z$q2*iy!XRF;PnEc#eK`pak%c>4wDp*G<dFpp^J#vX)6!s@{!_k**sODEHVH2_1%+2
zU$Q)^M?}w@F9h`$ZCo~1){@MB|CB^ep}voXH{dc+-ZGaY@IA?Q<ZNN!`zH?lMZc1$
zIuN66D>A+{g}ykL@0=~juc&i|*t1m6`>#|8wT=D;2Zz<RgUSBD8W}sI=H3>;mD09J
z6uqL%l!=2a@%+*Qfv^x$avgh>C!#uTJ11pZ=_DKmMoy%3a-bB!x^w**;Ulyrs&}Pi
z1gjBH?UB6`{|}uNHm4``bFo(z6W@Q5K2?8_THPKTvN1*xi}%rN66I7yTj0ztQRe$^
zO9j30$By!R!~qyR(4F~7@oIbKC@}$w6P4j;E!=4q@D3NKDCb^!k5#bMYA4KlYJYvS
zM|Q7R)CZnJe@51)5EE-#=ptXQZNfQ_`o1P-NOs?|3!HuzCu+l>%A#AnFFLiBwcLXT
zG=uD}y?-f*y3|ytIX{THGp?od{08}%#Bz=ixBT%VuS<3jQbTs?D*Q1$o3pPMWP9T8
zKJa?9BbrdPF+W)>^#}1`oZDp8)e_XBg?o)p_y6cz#|MNQ@N@&yR~{|<k<BJ`6$KwE
zx%%AX;aB&=t`57l6}9e_n3&Oo^VO`layz3IPKCHv9uM2kehkZFe_#^^@d%FE^<vCL
zzufFLhVXOG)Kt&LpRKP&%|#x8ltBz3h_k9PWP)0Khf)n$@<@LUFi9P~F3#y{R0%ZF
zJ*Yxwzjjr3DX6xJ^^F4`@ksu3>jqJpO;a|p=cUu%5-r<zd>vaExqrB+B^!5ovBqr@
z;SknCMJB26buW2n)QaufeeI}=$vj)WhNwNzdS}m+)AZgj;i4+_O;Dct!h@Riv_KVs
zngr1g5?5bG-Kiq@gT-w*+{WJU!3yk;lfrfcoa$K<=3T_D-yRpcDwa>UtO+a~1e9R*
zTmMcmmD0(1P2uw~?i}5x4UiTyS>F0AlwqD<%(5r00LLuux3_voZUS=St~9F}X^=)A
z%%ZVgGcEet;}j1a;Q>B;P2B<*KNV*bX3Du2aW^&FS8<%uz-}#O{K)zN#R3W6Y<VI&
z;8puszIV>Ysmhm_GHJU_9oCI_aYB&S)L{IO?eld%(jF@DI5{d@5Wd_q_>uGTH8K^4
z*jjioNr97FOYYpV(SqBTz33ziIp+~S>5%$%=f&av)6Q|-y%-KNbc1D#T@>8561OT(
z_zp{2ea{Lvp5(K-cp~jhdh#^)j=nP$#4?sFvxyE63|v}`=u2aae$v+1Fw`hkUXo&{
z_UvI=685y^K_Z}ZM`W$<V^yF|+n&Rd!-K0G&5DTJS1gTMKq=qtl<(Ak5-+w}gPr&k
zkHtN@PZ;EN=Bhm&)DPhwwJ6T(Y_$i45L+3}_$SNP(gpkYw_SZ6aPG-8!OiY0#`gDG
zqdi+TkqRjj*vp{=#lRMo=?WejB(cSVf)S6n=EUH06`JP^f4=_%=LYkdQ~K6`-Wg|-
z_<d}@2vxlWw&1%rT3;>i{T*$$C0VSh=!&=|STKXBn4ZoC&;Ro|<!Upn{$A_O6Sl;2
z$N$_{czSb?Lq)pl_8Qa2&gGSl{xZR@9(<7a8lPUfb^yhOf&7srC+8H*jfY$1gCHaD
zea-<XmXsI#sXKmp+tmG2r2xh?rx-0ejpnz_`HZMbPcmZ{W44juauBEzXWg8bCN;!m
zv~3idT{(iN)r#IOjz?Cf`*cj#yr~8@lae?g`&_D<h1O!19#@&TE4TSZ7%pgg0L2P{
zJEqMKcD0wvf>+0!#25pmKWEOt70A3zc)KORLqQ3pZ~sq0SJI5zdeh~h$ocD?JrYnN
zlSR?I{uDIs-Ju~6;x0Z&yRzJWi}sTf`0^e}=HN1Fk+D5IJ}`Lq-rs1<ej7EkP$%nb
zX{X+%pCRxzrXZ{d^s=PXKaTBz%EL4$+(*g;8mDn{E#m5@SbPJ|_jFHUnRTkC;v~iT
z7kgOGx=e1a)Kklq@{~<yX?J~sKH1Y0uuh=-^jhuL-Voda9!AxWn^1zvRIB<ineDZU
zq~ZTM0T!jn-Tu(m<Y}FI(~1CR%A3VYGzZeti(aihWmoHI0S-2S9xeWk55HBcLA8>u
z?SU54;T}aZK_g+(Fuw+g>?L8kuQZPI?)TUe5DzJQJ`^dmzACCY>#RRsP3?cJywN$G
ztDK9LbS1g|ar<IjEc?mP5xXIhK&4(*b0vxx>8_g>jJqQHyfD$tioJr)MaBC{sUSpw
z!S|616iro+EE@7Nc4oaV4c#IvOiv)-=;M8bhZD{%gkq|DvYC5sva8=4N&N1QtDDa?
z&ChpnZZ?w|%?^hyjYxkV3tGzL3`S}<Pu_75{z-QmZ17;<^%F84<67)TGx-cpLW$a7
z!1!3llOrbr>~#5Q5yI)LJJMnt54%b=gkHY%7uc&`%o0eJYzhWmJmU7*{Q+Y^EmyAN
zvDI;-zkYBo0hd8ya&7kgLJG8NzaOzl@w_`d09HcW4^<|h7_ihsh~d8bnf;$k?LMJP
zSCn^MEVEPh#hE0uMKmxU^M#)7NJUjU(OG!TJ1Eg4?SR`Q{1ct$1l_Fq7H%SHU(4}z
z3i3ggmKe7}cN`VSo7*>+STp<>EyT;T8N8Dkod4oU<|6_@mK-ffA}CYaVK43*U7iU@
z0`$tF;A>a^v0lSp>#s;Fk*xOXtFCXz(<5=_j`o>EjUEKriRv5R91Q#30(0St+7|>I
z@+Kr)Un&G{MZ%Pr<j_r?%I;>I>@nZ=JpU_@RuEzW4>$omLVX@ZonLSNuF#YlA!`Vc
zfE){Rk^s_kF`aKe!@NKR&mUDk^_q6r$UcYr3)DW`<w5yo_Vsa6Dv5WTU~zg3HeRu-
zjtfN1I?g{N#YH4>j-@~qf{a#>RX^l=kFv%|QRn;47ss>plA?+4hW3{9>ntr5B*707
z0#1m8amdTXKm$y(Ve_ZMBcBj3E&Sqf7-iCP@w)~uE1QKtREDCkO|ukk?)KZn&5>+f
z{PRDb&U)WXfULb+KT-xLWy*D;A|L&yfL;0Hn`hkIy$^D<n;`E|fE@>p^sjgwl9kIA
z`GvmX+4f~8qE*4SRCY6DQ1q#9e^SFQ_P=l`t53HOlg1N-YeCeK6=gl>gK`h9;7ceG
zr(7Q&-RsFdxen{S$s)DYv{y#2Pjdv@L!3ww-T1_u$9;zF3XZ7mPg~o}<L^2GzVrUE
zA|Y)^$~%I?ZAEit%U>RmN}+ZW&woOJzW8vRai!_m{PN*iZ7wXp_eTl3r1wTxb8LbN
zrxoU7JTb`~AhuaUB9vfT1JCSf>kLk)<Hlfm7B5JTn0?&=l95oZgJ~82TU?b~um7=F
z@L#}Szx|ef>h6`$@@=T~pd0}nzGnI}oU3YaNb<M#*>5iTBj_D&P66X@{b#f0`9L5u
zWGIj#Pev?3=jSs?<{m@Kp5>W$m3xWOpFeH28|+v#Rr1`P1ZD8YTJ|fl{NIwWgE?TL
zLw8#KuTn^ZQ4DmrE=Y%qX7ym)KEXLMZg61xlVh4Q)Wn17EvH?)gvM$Snb>7mAMmR$
zo%o;ow~^-c`7SI2#2}hjGd@A)McDbm^*}9*aRxg$@fcN|pfBE5&>^drcZt29+mhzu
zwn(EPwKmAa;;<8!7j1n#ynMQ|$5>n~7PZ!f%iqJ4H^sixHoip6{@+>vppL=*=IWUD
zQeo6?WJsKlWAgliV~;ao>R`f3<XFA>i_KTv)2>Bob0AK~jJ5gw^0x=0@Ho;tzH!$d
zUT#0CdNfQL3H$!~ZP7ND%V&7R=A-UTkBcDxEZ62ipxnip^d%S23BATD!Hz5dI^AyF
zxj{REwScGlcjf^NhAqNS8z<O)a=pVOd_~R4=cHaJqJkHjjVx3BVb@@0^ivMRLj=-}
zZA6+2kcIb6dJ}1|YTnZjq?hTHQL6HVBI&`E0+;QK`|#5c{d*UPVjI8)mMeu{X9OHc
zwXClle1FxcnT>KN?baS83re)SM<U_@PWxyk<<C^q^gk%eDg=JkDTMAKL>gG!&t`Q>
z0(GeJ{Or?JjB5M0x2scP6z3)dj2w=h-D}}7I7%q)o;YZMr(B;*@>?OYhwVh2ln>6i
zO;^%~rqs-<*LftG{Ht6ST*PmE?EriRqw-O68jPDtZ8JFvKO@PvJ82&gi4+70d)iI0
z(e1a7)EKfV;IXxP9`&k?2oP++b|es6c4sdHLd*w>#uHlvSqD2hRILVXEGhCVcWTe5
zFKp#uYdM{q4I^$fq70?gkB;>3eRBSL$kZ=z;(`V0A=&YksOSJ+7w9$ggl+L`S;GYP
zQLKqxquu(za~D_=&!M>VkB$dx#u`Fp6%nzo=gBXxHwPP<-dqavH0M5iDCe|2!y@K;
zqNs=&GSLf5R&y))D)^?@l(Z(argf`ZvA;D@vC$r7UgCzngamHEnafib=@qaI4ur_P
zMw)qBQN%jWct1%B>z(awUg=Qiy)<-(tszN*?}=;Sp*IoQjFkAqFI@<p5@PixRA3i8
zrgUNO4|>9_$fAO2MkW2zh(9qhuHsqKNw-w;iV6=1*tmSqOt_t!ot%{b*it$zSAF~=
z$RH1eL6h&GkTX(p^9SPa(TU<w4K0H9zssN|J5~Y0ISp^ommxc9lrpF=4!o7Wk*9XH
zlNe-wXV9vaY8HNYQLplno{Zg2uk~A}oQXv?#m`2REa5SjL}=pnF#={6W}M&<(DVLV
zqBZ%dH0yQI_GmY9{p;pt3Wag&4{tEexf4HE);e^D6Is{Oh^{WprFdQ_l4>@za(*nD
z<sMu0MJFgOFTooq@-PIY$^Q&uZo^vm_D0xWG0xig7Mbl`!DcnfC4?GO4Z2J5n+|lh
ze!o)(6(dX7O0iIuHQ^_Gty2b7cHHI(OQJ2jMM;5;LdV6Si`YeM=j^LYY>$EbR&xIf
zJQ3LTMJl?0SmBq6{t!oP*X4cU^XYk(s)UCwjSiFU8Z~Cpovu2#^nw49lAAHS2lahV
zXF*PMV0?i$)v<6D$lS%YlUVf^Cw;A`EqZ3GcY_I12WVu9$c8I^>CA$1Am7I_VTegf
zgpx#IHv?TC%x2@gC0or4sZ$kG0!@|hc%O#?BXSB|ZCt-)<K%ygwA87{<N=mDZy!|<
zpTK`S83BbU&NnNk&ssUuzC2$jAb53r{p6UsmeJSF(>0~E`|`sc*VMzyzW<nIrN~LQ
zun)q`7q+*adK`CoOD!za{{(5h$ixzEnNaY%Wz`&mNispTh@Z<Pi0yi6o}!M64+BNl
zSuY?vsSUPw%Sr($!ZKwhkvphgT^(2<yf1mvKj-27N-pyeu@@ZfeMJm4(d`DkmdaXl
z=Rs{WM(w=gIq^J)jfS&1ag3h<McU()0Z|H(24ae83~3W5JqcU>aWxS&aW&Fk1&;cU
z3L@<6!Y{vi(DCr?@g>YhbwzY^n@m@(P8TsnKdqS$h=9?}tX6Ogx^Xu32cb<HPkG3H
zY3O$v$6c-W-=Gdh$|wlN?dOAO<!A4uuax&!PJzN$;cf8zi6&etg-D-$HK;PTdJaJ)
z+eD{ymwtqd(&sk{-&u#4uG!&teaWoC&kB~?=RJ?)(ft&t_jpq4Jd8Z5KMaCW`#Z2Y
zi>c#emHs*(ZNnNn-%bX)6f3TYt3Z&}9-QR8ftxX;r-zS-Aw{X@8Ht)8RpdK>`B}b_
zu!HQVqjN@6<Z8mq;U?Jx%PM?0U=l|;ahx}c^%sxzT;wzKcH)_eROyZEWY@36ilBW%
zj7U6rSl?c-PCu|~(MoDc|0Yxd*)>Wo^D^=SF^7us7n0kcL>RO0Rc4y|P0LxC)hyGw
z#H_rN@Wy33bv|pvbay1*#03d|?`G+bk5|)KO-n>P4Z42<h3xw-^!|2Ig?wA2378h*
zqIt!^4l~-yo_n0+G(|9WHSpL;@{vD(Sm&6z!ddOdpq7nf1Q>;P^BhI$W5;718A*l@
z&MmI<beWIWAH!bV??)2yXB-m8Ch^z1x@lk#aNd<wZXM^}`725EZLdmK`g}Peba_cZ
z_~G`RxGo*WYYGEf(J<vtqIe+2lqHIZjN#^Nce)HXg6GvTymU3Zu<#kPE`-&i@u=}k
zHt>7iQG|VMUWf__10@y*%^c38e<@ZC<#1$bziDV1Gf6X1=9@NSvnz2wSmB0EhRvhL
zzu_-MM#T=K5?#eWHuCXqBpRr$0zK?|kjBa#iY10TSt>rBSY3TyQi#^|x*E+hR~iy0
z5IMm;;b>h*yMAPMjVw-=y7#OiU14Yc#eA3P8tzRg|MJM7xl+=PPod>~f*r2?8ZYKt
zw;bn_C^C<jsdLtba&-(DSNz*@-z(zz%-{~3ikT$ahH&kRdI>PBOs*wIj^^)udn_^)
zju+5KHNu^oJEyzl$=}(ZEaW!C4;-)9r5~)XjColRPg&qB^KFtx4;l%W<pn4`4l+%K
zJk?@$8}dT>@@vqVu1*tJQymN&i@On+#hKADBJwag4SdK`6f$}uK}4-XXvF&_!$Nm|
zs!+l1?!u|qH+2o-j%~$M=pBJ2LHFSAqpXWECJCIBAkht0;vKCjVDESfcQcHdv~N_#
z$veoo9eGqj<U@C{svcttS1f)Ql=6hm`yTvv<XEyya;z>fzUPcD@4+FKX?gP|uIRGG
z_}+tm`NCUWi@K3k9_#kG`kl|!!TW8xEHPh2k>Rr}`}>jvGC;l#1u+FrJ~iIj>RF!(
zRajB;M;E3{*|<+ezb7bEeM$Q>G#|m*P%r|QMAgOb`DDQ7s|p)iH)R@EWUNfY#@{RD
z<zkhg3hRLvOhI0orbG8#k|{(ss%uX2_$o7M-&fAB?kX=4Oq#e8qiIys-|B$X75G~%
zT9eMqYV|m8-ev6(J5~5vG`w1%=q}hE4OW-^n!uV2rl{T?7CHK!_B@iwr+e@<45G|^
zy?aUd68C%>UU{q6JA05NK7vPH&I0rEG&vU$!XciL!Y%I49ckOpBIDfm>0zyV%kQ+#
z0+36@bTH3Tk#~jCHl%ft@_@@W9C@1y-rj^Y1{6bpih3@usOe0Y_vPoLAeUC>czsF~
zfgePDPYE3NH!NIc+Sofj<(KbU7nyH9)(9fP<NP@n_l_;f^J`&wXpAY^TqW91im>wW
zh&6mI+3QVvFxjq~2<lfRJp+FK<pq8vw|IE!@NAS0D`Xr+xTAD&N*By4cs@%+4EjU(
z)&<HNTst^q^052xVEn&WHHiP7FW&Wh2zvkO#P$%pPXoPwPFeF1ybqo)-u1i;dLK4w
zyNFEgEh-F$JuFS#FWC~%@Z4Mcuwg;-4>5+HeDfv!H!0F2KFJpVpJw1&^{XBnL9ZJl
z`nAQ`uH}H=-kRR(+hcm9aEKV4K>*yGyTrKQHye1F>L(pMSPUPWf$i!x9|!oY2fmZ|
zsDOweN^TF9^?TCZ2>cek@7HoEAPS+ZWHW>U<!b`Hc}#p;zw?Gl4V_`}$zInCAmCL(
zRhtYS9Cs=Fs-(a8p*nsvhUh(?97MksMQM9tFi<nJ7RweqXnaO6tMU*r5?ISV9yy-d
zbjf}2)9-~hFYy<S4rsD)G>pIqSP8UR@L2th$H<!C?Mk*2DnMO>D6z5flr9dd#3<kc
z(Ppt**zCf!nnAM}!7bW!HY<nTgGc_0L5>F#O+yCT#V7*+G1AME1hcs#V+4ATD<XoA
zkrlzPlq@RHu)_EK+JwK;e+3_YrWa*K$BfCt1dB_7Z#77HjUxs=d;t*M7x7gE1osDs
zva)pF1QGrc13CuNs{T8mtzTHsY*F`Yc^OSZ0ECb~fW0+XPJ9GE#c4#DLuBHY$iZxL
zU|4ISO6aE|GKO#Z>(wXFuyz1ec4U>5{~ib4@mL=X!?y)5%M+TE{}xw5`x2=rzz4`5
z{?Vn7w|X$N31(4Zbb{DTXcJ^$HZm!k=g=m=5%@loJ%JGBF`Pl^W9k5C5frExzGAJJ
z5D1&I@0Cu_;j}?ViUEK^vG|4yZ0e5^I8y8Y18A920As`Sa`C{{JH5Rj9%yneMGRUs
zax3aBb1>9ahcGn_fJ~C6*A|QgXANendZhUuOli9VQ&7R#;dB!tfMKOrM49DxTU4QK
zq5`1Y@z?^qJ@IP<I%#pbTPhxmv!@0h+=F|3OTaZq82MoLK4Ac>DG-!|piPK@O(6JF
zLYwFWcpv7I3(?Cyg(&l>k2oeYn>ZNOuUZ)b;a?npK%di|fDbX!00N0?<w-yYgbEPo
zh2lf-A+j_;AS~ulXzK(RZ0t$mhY$bQOF@h9QUAw93ea9bvnd0R<z(=oLyLF{W~<ak
zgNBU)!`^`@6r#i-FX9ZLlj#CS(B&}^0BsX2^Nz=#pMsOtjJ<&Ny8aI@`RzkKgAd66
zPyoG3iu&xH0d$0b3T*G90u4ZO9BiYvQ~>yba2P#=u7C=N@1g<#6koqrqYwfqfFo6)
z4}h?b0tFz@$IQ172od0Evm&ID;oQ;vp+#UY-7X^3Q6C~$KN$eBsAnAzGS-8=&2d{m
zKLMuT-GM3e5Kp1E2kcXnyavFk=CLNUP4Kwwj>je7r1jC1M4(BNZt+smr0*Mq5r~3_
zzeBP7mq|qnpd$oSfPNPh0Adw;kmU+yYxV_HfQ0oDI!QnUEq73XA3z`s+gu>hF!q7m
zJ4JcP4lR=!Adpmvav<2ck?1WK<@D~SfXEQh;Qs9*N?Dj8kSPL?rH8NbLXfNivrT_}
z`X5YLyaQ9dfU`q=7vckkrN$@6qdU`Qg0}eu0OgLymEdg){Y{A9rD5OV<@#?vh&OqA
zgPJRfl;36${GcO*s9@m^Dlh^xcLy6y1H;}y1&RQH?qH+T0D(}V&7cE&h<wYmAMEo{
zLyHhCxLt(c*cTcIWQ+i0cZdiXFzg+ef&qBS_uuT$$t;5-SQfT`l&mzs?eBQ}3p(ki
zvRBZg4!3yuUnz>QkHID)LmlpRuM|2$WDS6qcTfQ{kOg<JQ5-Pr9aI2V!yRli3}7+E
z&o@uO*2Ccb3HW=$zT#ljpcnS-B06eIAc6%Vg7_{G0o1xXFa-yk9epI<187(+Z}r3(
z-$H1c;PK)ek0-#}C0}yMph@L#@iLurO$vN)51#Z^j@vyZSA}>01rRZJPyt}0ZFjIy
zKm`kTP=Po=pgY)TI6xq3^*rdnILL3AHbL`R*zF?zuQKs}m5G1K#Ep-&D966G&8-{-
z=nApU|Fb{Mc=X$;g|yc3;)f#F&j~QDJ#IB72={Ms@Bida92WVv%g5&}Ok}40xOmh`
zy3`#IdShU)C%ItsoR33u7)gK|9f5NQB*m)%9a%kEg}CBxpo(%X^(jKa0g?cPKLx>h
zFd6`nxY~#KftOo>L|S^O4#})E!1X1q`!JyoKLF~gNA3a37X1O}?|lOwA@pGuka<B;
zq*)w}5FI1`#k%D!u*EbC=)cuqSerMD5ZieJw7_iHc64ZfKY(2{OXp&MB})NKAd!PW
z0D_AT&<GJ$GB_aq{1i<0)?yptP>76xA4W!WL)`ZVkiw>=rP$Emv0!jE8AeFy<6!wm
z*f)&4|IQ7%P4V5}L7#vf`~J@zhY^4YjA!^5!AO6=((1TkZzUH#;Pn4<$H!p7>%DxG
z(6p>TBf{4w0Q2~%0{&gdBME8hzi@6v9$Qo{5wwEln13P<AO8!qhGrnneInjafbYYg
zd%-&nCkVsf0eq3<WxhZ#=>}6oc1^&6uaT9(xb$>U5W<)OK0It-NC&~>HCS?LqB3+}
z$N-AHd|+_W?cjjb`zXG_ga)_$$Ljy8{Y1INv|G*iyz2jFgrE-h&6S<K#qh>|N>F1p
z{q0e*0QsC4i3%Z9BtS}rh*AUyrquu@ci>4XKr~UlTuAMe0$2M)JR$)ICIC+Y@4^#W
zFnCaS00fgDv|Hid-h?U-;0(?Ky3F=9-G{))2}b>0ZLbVH270lRIUA(V1A0-vgI?Cb
z$qgphi$fpk0Of%77j%~e^ip~kz2E}u+3FpHR={@u_PQqfZWE#;jD4DaYH{033TP-B
zpnm+xP=@F&1BiS1xFC}M;7QwEcml>n>Xv>7;mKQoCqE`8AiWmgiTYi5!UhJ{i&TaH
zZlv{39lTbt0m}xkgKp1u*H59JahT-jChbY-&`rV$sMVUET>b-|#s3K&aaN!v%q3Dm
zFCTy<e87x`4iSK-?GEr10@8eI9ddiKWw<3xeMTi7Xa!JoC!oz5Ru<ITqXdE<fiCj}
zH1Rut-rYvqU;<=Ba2LA^PjbMxujLsbf*S(bdv;s9JOmSfCyRIC3D9;C(laQb!Iy3o
zvE+l|kJz`o{gzD~SwrLoOc%EQHC@;M<~K|D8{%aEJa~72#}xqgc$F9veCP+r_n+Mk
z8GwiR4)DB(u*cQ@8MFe~The^26juuX2d;D|x3uYDtB4F8C9u~K^D^K<;AH@7P@*+N
zf<CeVFu4OyAghUw-5UY`(XeQMich(nAT|h(3;4+$cp?i1e?o%`0h|E;mQMwF;U)q&
zgY$qi^F%K+2#mn8)AGN!?EJsLGYC#DooCGt`mi1>LFe;3Xu+;v!FPa%31H7yLOQep
zebighjO`wQF1+M_Ui~ws1O~o<h618t;V#htU~(6pFanalLp0=o1>J!sdeGqXxe&lR
ztN$4hF7y9@WdqpVUXw00p`RR7qQrec0+NtS1%@w!|E=N6PX_?Eflm^Waf^T&4k(!+
z>;d2jyaPOM0rvcuBYp%Oxza6ZwkT&=-L3!>_JU|rR}1I%D1jilOEdtb`z}0r4aU7g
zGyptly9-aS!Qc|oFCl=p|Kn3jy7wVFGBDFYxA(Pqc<>X*$VHp~DI)=RnC}1&kdX^_
z$ViB3-T@vU>eEkF-$N^i{dY(DzbeH4RU!VDPWk_}3gJ_LpYvwLVq;*}Y4Y$VEdg+T
zkLg+~<4gUskA{)lHi1tM;g^sIZFt3P<<2U=V#ZpHYH*;lPh*3Mj6>lAe7&8lP1lqp
z{M<}0Od8Ho7)w9w-GuOpA)eyFB`bVBk^^>9+e}r&GVN4Q%gSyAchqPn{c*QPevAoh
z1ut%k6EfCO9!1%vL1=&a&um$KCa?-rTfIGCHQ1Y-e{2FgHZ{QN))%}Nmk+!u4ZyBl
z@9ZU#NCJEsUjbj^X*4MU7T{AI$fp6DwJ}EC4u-#}zR(@Yax|H&vG;vusbgX-*hc9h
z4~+lk6}CgjMzWv*d=zkNKj$#s#yIas>o?jKEZb>rU9^Bn)Q}?n!d0(0WQX0W8Y#fr
z^|32(GO!KtSkPjD|AGNL8Wj8C+cL!RA3+mWjD4Ky^8VMku6-_ti?8~-at1#M^^{V)
z{bv;(OG?Kje_eB^Xm{|^tI9R`gOt<WoQkL^H<h<2h^K)(IOQuuEBqLusX0J22Tt*{
zpHq5^aszd){6KRh{@?S!yPnfS?+;bA)li1Hz!94H9+6-K{)4p&a9P+iY8cq^7L5dm
zR-%SUk@oStVn*+XdW+d9aeFR>SpPj2$h~ny#0{N8!x5~jt2__j1i>@C43C|ro9l#U
z7Vd$d%P}3@)9Uw#c5=6ZDS3`(9`xtnTlkCZvE#m%SGV%5;ta<4iUP<G62KpK-N&^U
zfJ)Rs<`sUt$xiO+_-kdh&iPf$wC2jR(}-e+RFi=3s;2HhK+REh4;rhW=IheW(`U2J
zBDtUvSEA<>0ce|!Y1a&wx$H~U7!xWyM+x;IEzl`{17aSsKf^9GCevZ}_zpftY^U*m
zY^fs}bKA{Y<FM%DWzeil)LsSsNu#W0r?Y4H2umj-Vjm$dM>gyGs+24qin<{ZG}r_)
z6iz*RIFjmqE|zJPBw@FitFm0uq#TY#6VRomd!;ZpU;TWy&br3pTrXm8NhR+?wQ{k}
zt2|{srYz7;V?KiGaRJ7ataChvOLF8)aRzR`S2XtyAzh(_SD@<|F*9si=@-k{%1vX~
zoJTG7EZv}lfh{HO7)6)>JQSRrP!Q|XH@VhT+CgeEYZx639B1;vfAz}iD|g@3-1w**
zf{NYe@HM--JYDB&y3~@I2OFuMy5AmL;-4Q67asOq@T~mwRqX;9bi4V<A5o*2oc%`f
zCPn3iR-WammzHgVh^RxTz=<!J2RUoQG1(U1pZJe?`!l=On)*G_avY$0QGZ$O_bHL0
zh^dNA(6QZfMT7&CLN%G(dssSAjI#o%-8Mk+S*U))1V2fg>gA?u*QH{&vNF279HCHg
zjW<8uSU+3W^zG4JVa!^J*V|;bYX;pI;$_YNBcu_xE6pvg@bW%>g^(Qg499t`H;w1U
z+3x!bcrJ_n71EOXy{$*q2DW9^5thj0sqi2tDd1UkMJ}=P49c6l5g+buaMrY%Ri4ya
zph_tz>`bgNMM%qWh06}Kg6?APAZE>cMfSeQ8U}gjN5^%-qs~~+9ty6<>Q-49)=cp`
za|&HAr`w&)qWw1bF5=(zg*F2ou}tSr0cZZ(e(@U`leZ~^B90da9b^S(772wW<^4U_
z3c`!|kKFZlRg_+$Gp-_$3^x>gQs1U&0Ve3zK3Z<Vm^X#yZlOfhIr<gW0vg923#?-T
zzga6ij2i;oUq#Of&6`!7%3ZQBuwwh(YN>Xrsh1SKGM^swiUS|IaCHF=ld7!e&6RV$
z&{WJJXuvgf*4{Psr*<LD&)T&<b=R~)NGd|2xA2q#zvmhjQ#Q4LTa{AyJ|WDPOoQsi
z^HTq8<(<VG<O<|G#kKkK!3TY(7PPKcwpUe1;#MWC(wShR0NfJ|IJ_;SsGFM2$Xy4X
zBWXUq?{$3jvA$$}Km29>&N73@iJ(~nb3D7@$CR|l=l6Vwu{yJO6UB6iVgf|T;d!)l
z#jMQ3Mfe02SEd%!g5Qp>PG|UYdkjlakNb{+whX;$y3d(Hco*pjgdOUK*=QBdccz=d
zLy{6;uIvf#Z$Mx3Zi=y%r%Ax6yXvB=R{y~^j#s~uSZ4z{J06LwRsl5MTxEtOQQ*O%
z(um<FnNs`PrYd*ML|!}Tt~}+sao1VZN$IQS_9W#pC<C$F{<Og-Es_r-ZyGNQ(t6pq
z<b^k$5eU8yil`?kAACE24?kSkBr@zl?ztBrxr2}P)|%s!*kd8tEZO)itq4-*&XPtb
zxa1&P`42~FwJ0Sjc~}KJA$~__5<?Ut$*xN<Kru?~x(d((?tHXdwkw?GU8nZaa<!qt
zKJ!s|l=57@8r@{syL1x*5uy-*UGX|Gs^Zup$Mv3x#;aNll>NE2ZO4Kpoxjc-o{~C;
zfBzF5p!0Gitx1P+)~adPe|k!<%o0WmMTzu#)N=z5q>=iqpA6{IA?<PL<gb<Q|3Ij>
zH8jTgYvsB%7P@jOFh#qw&Dm*!(<OL9s=ar@q@1&?VbOcV^zP@cIFu^Mt4mFVkLrp0
z`Fb?)$d?oY1*V#V=-c6P7m3clS}_l|?Yjg{*JpCGwOqTRl2t4#leLf6C)o?vP<LfM
z1)XQUii!3?kXUg$E$iESe^EryFzfqtM6k5_wflCEs4Cj~#YMk`h!ypGgb<?$r_WxJ
zq3Ehe>11wrOxq24CT%F(h`2|ef;Ld(IgN2kdB1)FrUM(4<;5eE@s&WQheMTeYHJON
zZV7#RlSfGoyHnlre}d+tyE$xmai4ZmhSkC2>)4de7Nx3}E=psPdM#qc@mp#QaVWM`
zK@`wCm4RX}zPHtoC6_Q4@l)&qap<S-IQwM*4-iduB5x!8#YKtc6ykZOYrl7Gd3;xl
zh*$kokV3`BjRa8nH_#kzaer;scUxz?V!<`|t=FkLQPzF~)7Vt0Qs{TqPvLU;;{{<a
z1J|gTesKd)_1woIpoQ=6iES4$j!dd!zWiyY&s+bwCiR<>f<2H~5bk<n{k!UFL`goT
z?m=i*mGB_ySxXuq!hYc`EhbYBKl{D(j)89-P3OijQR+JUS#V3B?Qj96MZ!b_jD|nP
zXzP+TJoE{-w7lSfQFfk5vd1s0*rfs~{jchY@OUpVJ2~J;OjAJv2fH~JFS!rzy25j?
zcmI^Wk<6_zAE=IPwU#>`R_y2c8ZYhjm{yLIMnUAL8Z>GvHycIEP$+)RexNR(3<I@z
zSDF!e)VBipV4y5KYvDKZOX~0#2KzACgfjBg%L<>2_9X{e16zKx?N6eE`1C4yktbFL
zMUhNye)jD1UQHc@lWtYB`bJ&hFo7*lM%YXB<FO?Qw!xvn&}A%osKc`o?fLC6k3vO4
z$GSKNkCeuwm8&zJSQQ43WZU*hj@0@6Sl)WKGZu5ilf6RH#-6tNoXf+W{!GVd35L<)
zFITkTYPoim54UgDYS!J7<dZZzEBi%WoyXQ9{I5IufA3yKN#3;Gpuz0Vjn2YUw2`%P
zl0w)oaVow0=RuT{F6#}~%l=0oo77I8edoz0Y_F*zS(g~+=yDMNA;LdGQefq`Y-E2^
zFT4N0s0u&)^|2HAn!k&$mekx>=-jxci}%<D&#a7x)_#E$`(aPKMbDJ8HvH)fZQm?Y
zx(FnKqZ1dYz2r}Z$!@Vnbl+yA_JQkEA9cIw2F{7@Wqk9x$&g#W&nLG|S96DnzYKnE
zqks7uqCW+kKW}#^ws$OEYy4+Ce&VC$A*^52bP>#zVVkaMJa|3g93S7hzU%&Wdf0Je
z>aFl}C0CXOBU<Z%@(=nzQ7cqsScl_K-n)+2wSq3{IS}Ww!ISFti}D|BIO3d2W3Q>F
zhmrl!3KiBI>=TrU5gyRU=HzEnJ&LYsF9>w~2?>Yv=(P{h_fJa+l}N0E(+=ifH!(km
zi7-XU>;7HkbG?dPmr5ND2;C%i+78Daj4Bm>76Jx}wfkiZ=xdiTD8SHy`jD9IO<xI?
zh{M~G_t6EV{7ES0L!Zs%>bZw^W~Vxl$gH>n8->?;HLU2`-|Ne%6Z4s+f}(u+eT|^J
zDy*_f;BginOFRRhG>1x9(m{k&QF_VN`)9_C76`ZorQepZeP*y@1>9U@KN*w6{n>8`
zbuiF)?Y|sRs90A)C7HB6XjAyjsM5WpOJ~e?+OR{`Ih+{n0%kWE4lBg}=Heg4FJsw1
zN3znx+SHk!fBBumeI1cO_nP$-^sy{Z+H-Xij=I5#lqzC<ku9h3#E{2iSJ`EKVKkSR
zHjDWm%d(Sb7Qzao{h*Ne>;=$U`Z4Q@8dhCR2kSp!$C&iR)0>ldu%##zCnKy}9<h{-
zZ=wBKIb#lYQ)PDQ-auabgcM@OFX9Sx)dHi#qP|mQW6%?0nObWrP|9O+lXRipsqn#@
zs=k!2rK8pUFeK7?o+z=uGSuVW#vPB7uxJil@zt70g{B3XSQ$w6Lw~g{I*d#}F*(Tc
zz+{q0!$lEh3D1vpJ}60Mt{W|^_TkXK;t(`K?Y5MA>n}|7ge}K+1auZ*x!9uV%M`in
zG>a25$t$-o{^%~DzbSh>S@u$L5az;Jv$s-VTjA8_02JHb#`%Ur?P(|x8?w&@Z@4>X
z@Q6@^K_J%CR1{7_2?cvqkK;k4F;T4Y45g0bQ+w?ly`$7m=+T;1MN9Rsh7sGR9B($Z
z4UM0jf{dCm=I%gNA-bjZ#}yB*&PR2!543JfXh}*I8%KM34P;WDw_Td&X<PHi^B|4;
za0^!%IAsPz?Wlb5P%zo#N@+E?jex4Y4_e_dj9M3%77v*;gJyK`zms@o3BTA>HWVFL
zR%EF5f_sm-b(qJiZNuW}+7s;jPnpKMX4~gEyDC74J#Ra9e?rRS*G9@#AVJ=7-|qap
zRTvgoV)ua5;lbm-phE;CM){NewmFM8EHpT0IHw%Xz1$SxT(k+fNeS+eZ1x2;10D;U
zHB5b9?{<sn0^l{T${#g(1gbDpj}*-|_hEC5ni7@&ML$aqvVJ~0TssZhn128w538oW
z%~*?Q4iXnnRS<T|jUHV)4Vb5JxdjN8akK9AsEePQLSbx*dG^eZ`O4?>zrd`|g3@Yc
zkJrU^2~A=Yn^Y~Y-M>XRNOD7VO%_N574;Z^7#?@zYO;VCu48$Ps$E<%w@kIxD{`-+
z=wLg^GbaWW<)Rr14wJFjK4DNlHJ-<u>E>ch&Z#Dth({_^ha}14vJYVWT&b9I&1G4B
z(&ms*h>{PN*sUR7)C#2<JBthDZN&Gz8W`r<iY|u#a=d5}yDpu_huM6EZ1=}2Tz&E>
zwF4WOQ|3l{`9<{-QyNK5>lu&Qrhk|lIq&Kh|6LNnWmJyLjlk!Xj#;967-5nE<761t
z9y6cY!Lm+GuU1GBR6rLfNGq?Swb;Bt<-`m`OYdkz#?gjzUVCz3x95YTwo>=R*`P9n
zbhyf^%KhEU$%o*-j)&6OT_xX_c04K!Gk~=1R8x4)6oAjl!nCKcg|lVMg~3kpiI=G`
zZcYfP%Vq6qRHwpp*lno61nF!QehrQATm6eKGENB6JLKwgmd%AIJN^>m4EuUTz(9%r
zpd7L&JOI}i0#V@G#=-Q#?HQjULEf;x?@^h5mik}w0PI|Jc-3*6DHp2zRirVWJYQ;G
z_sm>}XBG96y9B0^?Z+?gUXj{J6l#O^3Nv+P8nO%xRmtyZu3|&Zbk6qzIo!o>VmUnV
zQDK+U9>o7~8L+|g|B9hi+RFHJe7re3nXJoZotY#h{2xohgst`U46eLnYI?^U4Qu^=
zf%e#?No$F}-J*Z?L?F?erZr8B1A9WE!r8$wUy1*bJRBM4^LBS<NpDb|GfV(BOL0?w
z>bjOh?!PSDhyfzUM8Dsk*<qSFi-Dp|$1UefOtaI{CFM)UH?HhwHLWprK1>R|bSx%R
z{{5IEtBxeR*IqYK*4Gkwxk!{nBxRsaW^>fi!0X)Y)SU^G2`Q0ioW(v0U6`?FjTCNp
zFuirmlOsL+RzA%|_Bk0^t3DLNM(%rm#zhvW50XEWGJyuIvAfNwoR@5$JZn0eGw5<4
zwHJIsszK)=@x7mMMoIbLX^z`ec|X6}#R<u()~^v$!xh{7rP05+pjw8iua`@IM}>z}
zOFIuAAlsNnZj+ESLx^l#-c##58J}hLy<TBsr~y&g;8Ol>dM%|Jl+!!n`t3mGbexm>
z=9k%JwdoOz<K5;HK9G)D=xX(CDMV<Fu&?pQ_S8x6dM6HA!MBkgzF$Aml046`U5Zu>
zeMG0x@QRdL<oY<my>W*V<oVxFlh~%2$IRI+V@g8xSl;ve5ZNw4wL4L{3C~mMj|ouy
zlnRo8x}ZRNf^ym(p80KAS3*f*+sJ2T6IzTadCV)_(byzkUYxn?o@W=%G3<4nA(iI-
zR(A*GL1Ml2D-VDwF$u+BK>_x`bJpfVZ{^E$oQOZ@5eSTd@chP^a=TKCnZL=$>vQt~
zCcZtSTN0W5Nu{jM7Y+4X%n>VG9pgJeUlT@OVmrU}-d;LQk?3<Y<4#~?d2;lQ*mYgM
zk4#&V#4%|2wT|0OZ-QqPk>Z8_0y{2DeSmbN!dWJ1&g(|o9H&}d`1D^iCKHA-aY$hl
zi2b2Qg%89lD7)Sj91tGGdukn3T;+w^ZJOdR#4xu013Rg<Zf@?a@a6l!@@<pVze@_?
z*It6|=f~v=i4QmqV70p4*Pzyls$F03!An#v`Dm%R9Q~fyWcUiC15ir06O@%y)obVi
zCas8#l1Dz<cmtm|QVQ0bK~u6QV5?|poJhs)I(hlMk!^%w61n<md{sH&yh>G%WqC4P
z<<>xJvh$5(M6VqDS(v`ZO2xR2leN=o0+%IIjJ9i3!{yA8!jw=xKat08>Q|r<y>UFT
z{qcePQ}c0Qa!wNkyXawX;ml_0@I=P3gu}M}!Tu6lY^m#G-(<>kEq=-0vD7(>EjMN^
zB{ID^>|u2>2|aj(AlJ70WWL~~_GGDH-Q@C?lE79h_q*@fs=BRXMQ+-^uAV(`-kfNe
zI|Z#kBk&3j!(FiO<V!d-D9@iGMOE;VX^>AvRLYz27%bl#Y)$wDOpd=$%b;ku*Sx?u
zws1K?<YR$r!xLmrhfNDqgF!>%UUf4^<*MS7`lU5@f8XcA=~AmZyT}UjCm^jz>DS_}
z$@o;Iw1C?XY+ISunWR>izrSg=gX%vHda6I3ECN=SZ22U{Ivq&|{>yK5=HIEnIx0?!
z9*Z1$k9s;L=e848)EE3tD4#K%9!ZNj@!a3K+(W7;53Y+5UUvA9m(<a4BtLg#o?QlS
z{4wa9_S+>etd#LzJ$c^{15=qvdKDq1(;V~D80abDf97z_3;$}&6y+Q5m?v?=Llf$)
zhn3omeCwEa=lgJnY0paCx_`?ntyb+3$0`!RFo_?$aWyN;J-=S$<y6rkkrZ_{>o24J
zBR@}hng+U`YBm_Z`{i{%qCozLQBAme?sTGwEPR8LmYP{@KxWbA`3nn4@~Zn&RXen5
zIvTwaAI_t0)OYSbm^$*u>f-Wru4@Qw@Bn5lC#xt;*1W%XBSM9hEo_#HsAhqsMuTR2
zf4twEuE-|}P7!7b6=O4=ok+4<LsA;<{no3nE^I@|X8+<-5Yk>kG}u}^{_Y5A*(v|$
zHNxXrx?sX*&ZHwXJzMY5BaX>>IYaBzI)0nK&<|WC!P+gpUs0vIBcz7SxI}mKT9N27
zh=fPE)@ftq^5+&yKC3*fJmG?1kc0KK^Zb?3K=Ze>bh8g~A~zR-Gy1_{m??g_E5U8a
zLi5s}BzW9ZegZ=ixD6hqE60i-qV+X(%HWWNv0a;LC9vD4J+m75b&V-MLO()+u(v&}
z^57vc4J>+s?)!0sf-r4Fc8F7DjU<+xYJ2Yw^ZC|It>yCSiZ8kjO*k&sA_~(7b^8@>
zKtKVI_!zdl<G-tQ5X)XRQ<qZLil816(uJfvomz;M-w65|+g+pe;b+^a$M@ZGaGk5m
zZc#oRFVpc~9?c&QZ-1o8I||iz8LISH5_LtP#uF&`O&(?sFXZ;{NAh{_5B|){z8WX&
z6vr<F4b79W?Ln~bKZJ>nWsZl@8BKb%%*ZGPtv@+saNA!PxYeE7%%%=LHBAg|(v~&I
zj&>q?NXYgESXZZW#U&>P2c15~`n5f$e}e@7QbAO}bOvN|8Np6>%C>jUQCOQvZo+B4
zQ_oCRydlyrR=@T;dZ-l9tR(kl(D}`U!1stoo;*dSVo<4`?bPCg$XvZ&Omp&xOe2Zc
zv6SCl=G`G6xC~c0BUYtV^6Xk^C5av-h5JXpBGk7_IG{jrBXJNSgz1DH(5%C11B|rN
z^8&t8Yq^$RL5H(G`9H5BrE~_`5Kn^AQkNc*@=lR<iuITxIRl0GY^Kdao=Wmj*@Mjw
zbLAFkkDiO%(Bjd(F$O*g*_7JO%|GQIA1%l~VBbml?YDeix+Vo5XJo>qWYlT%c(}hT
zUv`bJK%fzCwdO~%x0Ck;C{EA`%#xd0X?49g{>$iSoFKv?%^NnWGJid5bahd+ogP=Y
zw|l11B~O*-HcD>j8OAOY7wkrK_AjbQ6w-@7H^vORc_saLDhZT;ed3v;uUqEo2uCXo
zR3pR{t7CsSHe_2DpbLo44CeYkQG%B3OC8D@w~}yi|K%>_v|HuZEL$-<QLC-7;A65-
z-QE>;aC`D^+D=O-w3yU;bN!o=xTK)H0;uwkKTMRaag!QFE$lq^tbE-)UWB}&bU+xk
zy;U&&dCQ~VTX!HX(`vymL2(S8Nuq5f=;ThB<*tK}vB<ubcEWA>mMP0NZ_J#OakIYh
zFM}dw@%RriuS-Q>EY;1QtA96J<oL`=OU(1{f}6HO*59v*wG?~&0Uf(HM+#%>_>T^Q
zEv%TOsGX(ao|Dso+wPlM|7CvEzp;wLN!6L}FC>RpRrkti3AADgE1Z~RMxM-(AUOUY
z-+3ZN7wpR)7yF)7{bmp!8`P&N#phx$8}VZ}bq5wfIn2SornGWwGL8-u<<?~i_UW1L
zb~S3moh)wN_VKN`^VJVwp3-loSWYuC?P=43bWhtdvk4I5!N>A?f;Vx=T}v4LrK;%7
zbv<O3IvR(igd}OIQ(2CO8;0`f$VBlE5GGxEL1xOsftLKF<R8N|6G{qv+Fxh5`X(#v
z$D>gM@a$1>?2JL9qtk{k)pS;?llxYAN@?PUudY46IBd-H<jO>hXjYg;?(G?5iw1DE
zF5>*84-t(<Lrjvgl8_o`vNa!-PPBP1HQP|nZK<Q_v^!(U?Jtn~TGEq%zaS-&Mf>fw
z)4__}!WXXyvF@lUEcT`{fmGQsf-EKdZ~|vT;^F-)L*HFcI7>~yt>NU9KcA{PxzA4D
z#INlOu8|jFnHuEROS>7~NDmb*2`@V$)Xi{hi~mtX0>7mk`}z1KnySXZnP^=yE>q0v
zEAR2oC%{ZBJz2K0&Ecvb0&eGSb9-Jh?DIkV8Z)jYT#kqC*$cH}6?zK~HSBL1JoBHH
z5dSmYg3Ho(C_7>$(+)A9z#FDfrqc@Y_NlIrPQ#d3ZhU{3&Q7{Il~B!hF6rPCjc}qC
zU-VuuM65|eH_$d=RmnrwJ{=`s+gYwZx;C@csW&PrsNJ(FPCFm-J-AFzPYjL21)hGC
zYQv~XITFxm;PPw~KZ!fV6T3^ZVv~COa*2QXSkc_!7lE_{-N=K5DK@Qa$o&C4JQGKr
zH`q?UfxT#t=Q$sckuuF!=yH2LZYLYmy6y)xoPO~xDJla8{{*5h$uM@Dt!|>!7f0mf
zN=X0aJsDx-Fxpp#ku?L;Sd`O__0eU=A1BB~k)d-%B-BGYElMn()dFmmHX@v_AN6Xy
zt+hywz0AVbb?tL?Vy_m>p<mK`ef9&C7;=7~H+E`^O&5Gz-?sqzy8?yL%z7LyuHwpp
zmKMrsV$HZFnZ4+K>DAC$^b#Apg1ztR@eC6`<0O=oSv8|Yq*rJ2-&z0)4$q!(nu?J;
zT}qZc{Gn0h(J?-hZh~}vu~jUNja7j(e^JF<u~rd8YrXYeq)7uM+&J&`_i)*GwsGkv
zpycQ$*#u!7;U5xl0~^p)g4Frg9&2=dwnXP*h5)A5pCq0OTc@}E<U3;;`X{T$af>?|
z>K9ZXRO41Tf;(D(6jWG<6l^@CLmI=9#H1-aVU#jHs&+NJIhj=vkr<a_`>mAx+YJ4o
zzo->(q-KH}L&eVw+KWi$nx^1Ps<d8RHl<|G)%nxTuqZ}S7Lb%)BGJh=@spYUn--cG
z-IJEDr%^m}?!9vgMDk{PTB}+WAy&>mq8<y+Y>(t~#s_73dDHMq$o}-kYX>fac&Xxu
z5Ygq`;})Is4lj;Lw_unch>rAW01+#d4#4Z|@-h(@#Cl@#?oMDE9p{KdNFQI*G*WRE
zN=E#)uG)30w2~_}jQ3vxX1s4?rYYgqg;VKjk|NnLZwTZf2a#kfryXnwkv2~pHisw+
zkDTbjLrL9YW+?`=KS>Cjy^TK}uC+8=+gpj0A4_K|oj~|HioBd78s@*e8}r#S9FI;e
zkt*tOf8aC%(n%!G{M$8mG;o$`gd^5wtdN<A34PZIiz(@a*Ka807uPqTgF3AvM!J$X
zMQT@mapbDfVv>Hgw(6DY%kJs_gdp-!r1p~mJKsXRmj<X>Tc8s$zSN|9&qHFeK*J64
zcK5NM;q``dnXB^l<o;f#*LoVi)+XAp=K-!i;@CQsnn|+BiYv^f<CXdA^qc$}_I(c?
zSsfBbHE&h#iXV~)RJ|%+b$kbIy<>I7N{QO4vsJ(OcLh!O{0IzeF#<-Q42uj9U?)Ex
zB81uL<a2%XwMWB5)saO>KxMp7s^XJ<lm9Z%lx^f&4UHEr-5?|QgeK9v>agqAgJ4PN
zZ_&L1ofYGAde+X)^m{d*%*CGcH~F`*=s`({m;)aKOcyQIw4<yBoZ>o2?GqdNtSMa}
zSx?2cd3|4KiT6BXxS&#LsUpYyd}VE{u2kZ*KIKLn^GKTd>`3nQ131KwIDgkFc;5EE
zn-)+pbL$<SS6>r6J4uit9c?gs%`OrUyPH}I)LtijHjsl7B3dMzVzXvuYT`0ws#9j#
zc35#r?s}oAlCFCA^FjS41-e^T3CMv`78UrOB63E$Mo>^R>^>0=i~1qZb_NDjaYs8$
zu6(tYY}YkkJo2hCImTUIh}HCcKix%t8O>wf^XB;M!MtGSNpTobMIUs1Mx)3Jwt-4B
zkNg?cGhPp~9Sb|jo?dbIyg%hwY=1gP5FuE2H1Ba%I5SodophPgW6TdKj%Di3>l-U(
zX$n0zqpXSpWwgvm(gPa)ev1;ETR9ywjyTHo-=X>{XBQ1whR!}4t5#!oK~94)zXdPa
z-~<k#+OsOGr5j^bt4c!ixdpQVm*0aO(n<Wm1^AL{ovXb>*dZ6HSM7vD)rxacB*4?F
z%cR&4nmcv<439dzqol-JbPV!hI$%BFs(}G@WkTYjLq413=@AXu#`+>C`s)zhi%sKF
zXP9bbJ>BS!OI6i2vBpKHz3b3@a6weu{in{gBhsJ$+stgwyWjrQ>K`_9JB)@R2T>|Z
zP~i~mv{TuD61-FGi5O5O>K^LdRn!)wPU__qX+bu-y8HBX45;;*yr&~Ko-Ghe#MvVA
zMr6u!f2T;S-+3y?|L}M?v_=h<>`Vt5uyQHJ&yBU$AdSepA&F}5_wjG@jHLervT_mQ
zq&&CTJ9=UVhb;snkYi<st`cp>wiymPr?}*8<z(wOyX#|uE)r6cG-(r#HL|Zgk_t*I
z$FFI>Y28SW0c-m4x-fax`vj-pqpMj`CGz0=2DXInw?B%aBL@+2YKK(Ld95$=JeTM(
z<LDMCK>rYk&x$v!AJNX`(Zp%ED*iP3G~-0qFxV<Nhm&3@w|xOrGNK{z7>o?Qai9yg
zp1+P7B|lVI;}PxIM1F8WG-u@a|FHL-QBgKs*PtQ_h=PcUWE2Dmf@Em2k|YW!L9*nW
zL1?0=h~%7uM9D&vn+62QIcHFEMpBdEs|$VRd*6ATwPww8&-|I^j|-OcbyZiLI;ZNK
zefD-aRzJ>v|BChw(WjsU2*COTz!-65B`;&^=XqA!C2@cnuA^#$>(G~trKvY|3H-;+
zB+hFkQQH>WjOTghokNZ4W8IOm?}F(0w>MoZtFr<*%)8r}j|RsI+Af$CI|wPMLVM4B
zhu#~MI*c*&0OS5mLEP?|35Q#`N0h1$pkfT6<WwHH+fE_caZN@IE8|xz9_&l*#6yj;
zm0Akee#jL4r)c^66;oE;w%{b3CR~>9HaqRdBCVQ^_XFMEcNXa(bo#uS|H2-g!g$W|
z=G#vP3g7L^f?_~P=Ddny36*4e$`z!u-1TJR>bic|N)r`?oa_nJGHVx{ULS;`C@1`@
z=Y8v|qaVH#mcw1tQ3eUy1sW+NYq7vLkoC55==BI%lpNQBvRTdWSLD{C6M+`T?{q=c
zRelcn9c_VZiBM6t8{C*gNs~+|x2Xl%HlA<9&+F?UgN&Q6a)u~>T*h5@(0V@3nO3%F
zJYmSz(pMRu8`bo$^ycIv_gmafGrfk7mPb?5V-6>hQpM#$W`g*7v^YU_t0&REV^%ID
z9%hltfBO9uqUFGTk1a;Zn_fv|Ae*Q;0ku&?L>NPid$T3rZW2I70U)asU5M+T{{zM9
zV{P*<zl-o~W@MBsnba9e%_gwh;gX5Dnaoag5vL029vT&yFK)Jgn)9Onwb}f7ff~Id
z#{=^*<-P3a1HgtX^}ZgjEG*M;ZB%#47<D-6kw@^sJ)DubfOhBwQmZxc(ZVWXYto>|
zUhQitCT|2gxKD{GgAG^Sti?eWcmV_C(uSlE8Eg805&*$j>@`Jgwh^_*UCsDXPDq*=
zwZl-cSP;ddc&M{bYUltVf1CzybENJuz@EI70~ne7oz;n~WKG4<b-8`VjeP+BXbCm2
z6FB2?jFRQp$X6j1xx=W;pD_$ntW0;WsS2$f>M<PYd8z(BY2||>qqayu0<L1Os=Gv4
zwPPVj@~Oh?O%v^-AVToV3)=coJp@j>&gn5%b|{&R5)}rRMw1T7HhP*Uio@<RQo6s>
zaBe73z7#8+z;;-ced?YDixIV**Z^RowjmSAyQt!ueo7~i4}$;@qnvMOAZK9mWOw9q
z(voA2$j_;p91mRq0YyxWP9>D&OETqeTWotqelj2Y6mOSl8`w~5e1%fqa(8`#WPX<t
z;e%YE?NvfRFpAwZlZgP|B9P<=La2WOs4s6s8ZBngOJP#9=3c=vE4fu=!OJ9S7B!gs
z&V<|XEdayWubhdJJ)(BYc%CD-6;j5GNPO?K9391f3JOcA-cGaEg9)^aj&0Ak<z_EH
z=X$FD_(&aCM8dci)#^jJq(#nN&_w}&9JJbQy9Vtpn$ZGgF=UGQRj6vCjljVp<n@Er
za+T;ehuZ};s@~U5+EDaMuD4i|M7PqkFG3YZ(Ti??A43caD4-<2ljz~PBLB+!v^}14
z#I)%^shW+p^n-IjHr929c?p8P?R#pB<t%b(bug$;z5?x9Hxc5CcO}^ygC-8h&8^Sk
z+m~FSKj|jP<rwhgiO;?}N6;*Lu_I<+;TE8*aIAJL6&D?Y1V6>0!YQKlz@MS|vYR~8
z_!|R!)&X_HLY~zOO~Z)4M}T}vzZNZzB{Q(lx&DmrB9KM{w%t503!2EQZp;G7$56o6
zF_JGrSj5RXW@fv$yj$zN*IISJ9-lIg|3p&(fi6i*<$i$>&o`c6DCj{Ui7?0yj7GyR
zJGzZVyVZUFDL1jnKJ+S8Dc<q{=3*MP)?)L#p)FmgnYW^aDv8h<LLR5*LoUqi?1Tbd
z?7PplZXg@l-!mKp1DWeiDIKA;eufm(g{AO^1QV*klIzO)6ke-D0G1D0yOD6C)d3`;
zYVY*y0Vbo;yiQLK(t+V&i0gD(h$9OMkeS>qbsh2U%-Anakh*`csGuYU|M`r|4V+$j
zD=kv>#a1l<_Ux;>kb8$pJ}CCH4IBnMR6*Z>#|cJ*!s(&woGLhSRXlng%@aRnt090f
zLjA*m<uf&@vF)cA#ij5JsR)EYw`YjqP^|>@(5Kyt{WwiY`n$&EHDuPpOVKn>ExK)o
zG*NSFW!plowsNg{jo<?MY0<48WB_LPS9?3%N1cpKxrh$KR5gsBFbGrSV7`^1aS95Y
zqdRaBJ|h^cKe03KYLK39%|2RpG@nR#u`J~#IGmvw=1M(2ZtZsc$g6zB21N3$@Btm#
zh!*g4^bvY&!uE%kL3;{+HuYg;q7{s^Hy&hrA^HgYEa90Ck3dmL2<}~NG<UP&XuZmb
z)t&huW0^A#GcIlo-mIv+%9eUB)~y5~fvS-+>U9!$q;7BTIIxfa8yyDTfo86i+>{*g
z4k61|Z$47#-r6#|E^3>}W+px*zl2a`Z*WR9AIv;@#w4c_cmmb?0G&hqHy%Y?j0!4i
zaAB72h%JMW`!;GL9OL^_ReYicz<Kp!7SFdj2$RxfOIULKBg<)*S&n+wx3Q5N?y52^
zNU}$pX391iikAoFYG6rlFk7R9UMvHZ9TiRIfbI2GO_{K}Sl5<gHUvh(Tei~_8(JNE
z-kxR*aY?jA^6Nwm1U^|FsOfS0n6|C(-SuWmnEPdOfSJX{w6`uLDeHH*;_D}rR{Gwm
zFW;ux2%$Tb6T6Llz70EgkwO(LzgvH_Fe<iOQz9ZH90MZcGx|U_ik6Tr2z|eBh()Vh
z3QAlgT8&nfMj%VrO%6m!ed~Q+r~;6#7DlX*!?tY6TqCKe>Sm^W-D}@bN{QQ3Z>ux&
zUTj(u3t47_QRfilcBOb6E=eE-5Eu97qLLEi)P(k}5#y720VB7TG9e-ZqPK31#bR<+
zDq7TU;+Bz)OOHIx#^%r<;0w^DisN&|eW#Hp>NiV0rH*5Bu0|#C5qw?dU1$L;DzM#y
z1YgSQoe7eY$vv_~MqP>TUdC+80!Tm$7Pp2+7yw#aS1f$p@D86|Hk~H)cP;$*VS1S4
zx}_>bQa?G1Su3rJ+G?QJ<=v`u-`NbMYi`{TMkM~J0Yk_*uNNl!=ytkRQVfu?O8m-A
ziAVtS9nAt>VDpdnO@AV27Pz>#h!`t%qg{h>Y`*{DPM?)<Vw@?YD}QJ!3_l&z!gJ_N
z10S}M8vZF)Waldnz;(O{u(DwG-0xC--{RIOg%qudV7Q~=Ow5uW*RW?J&u@7(I5kJ>
z>L$bck!jKEc&rkEBs46j<0>WhU$s5TbP-0dHgZ1hs66#;C-JPyfLW3Xz$&vfxe}%>
zZgW@h4g<=rdux1LAzA`gT6h=Yt(2wzq!Hui>e_GouGQ*C34?^G<czpS;1j?gcNRiG
zjdf@Feoz@qczLv<>_xVHxsrSt-)L(jJ{NDByP^GTA<iIf3(zJVYXFpC51)S6jUeYM
z<wLG~<k3X#*tVwi;V7nv+LHg&;QJZRZB!8^lfO6K@v48*HFGvTyo>mMvKAD*_(7?1
zCOulbZZ72Gww>o-D>tyM2Yc=^SHsf!i{K<72Y-wBy;4?FI{-B1bxKH&sF$Sfic*Wj
zYLarA(~lB_%bhv@BqnBe{5UduKs*m{riFBTqyXaL<!Q2!X0s1KzW&bZ$<z~$MTtL`
z?JlwdP=j*uX0aU54~Uc)oV4PaJK~>ToY7y6UP2$fkm&eye;#lsY%uCw2DxF$+TtAT
zqeXA!{8|Ing!^=+jFf0pw(kGjJ}sEGKM&psmUS->!JwoW@#C*XY&Tgi?LKIYk*rKL
zqqZ4-|BVTx3+{9uD|grplmgzaqW}R<J7AdcCz-O8ED-3^h!>PI8U-xoS|wV_S^MHe
zZ5C2aqen{2eA*M)Us`UAHfe2-nz4*o@J+Xg6`DgujrZM&eDI3!N9vvVy4^ptwi@FK
zoCgPgpL!>yvD}QgyO-B`WajZDEzFg`vDeU{THXS?27&~k0{OL&>q2V>(kvBEU{1>s
z1+F5Df~WgWm&Q3a44<^c`h0>V$=yEy{@iRg<8eKrOm}TgQQ|rq^-G$=nPJt(_bc3S
zWw2)hf1f(Xzh4hv1$01hw;rj<2d>{8P8rDC+8xq%9t1LRZgMQVn*jn!&uD56v(3cd
z4DwtSlgHKkzkX!vi@92;7wbfXGbaoohN}+xE@kx%dC`N$J+UXySyEDiiVjp#-`}(j
za$MZADnWGSGMpS;cM8m*c0!V7@sK`=<^^?IHs@(qqg##pJ@zMLz2HRU;jy<kqE*Z-
zoNxu7%;14SqCwY6JvtG^_bD)6Y1mg)LsbMV0dP_vCaDmIg=;>Sh<r6jeu>ZClo@1o
zjZ)tH0R;8FR;J#ZrS9&}RgkyLbBfbM=M+>Ii`QG|bRC@p@ftlU=pulw#@sSP3XTh1
znm>0EPwMffq-VxVA6VR2-;4hKx<)blDHZZ^v0X|ac_kka@f3Xl;$A?^bc0`8`;y-r
zI1iTW0R+qEqvwaA3WN;~hkwv?>m8lPHcbf+L1Et}a)$4_J=dG|?{uL^ZBq(|e%3+U
z9%AJbmr2|y(NtNN7wSJuU)y+z-hz6!o`6<KpH}HPYyht_`C>78W{k{mck^k5Sm3mC
zXde$|6CUAB9iy~|jc#4m?TjrHZH+qf(_~VUc=M`OfTub8D6(bx!FH%JB^m;5E4l;d
zif}x%p%QeAjqV<{Cj;bAC%j0468_w<J$`X@ph8K$VkeYwZSF{!B?<s8dB&!Vn5%xg
zUg~l4M7`px>*G?)lF@Af(Mjom>mkUGfCf0OT+nJ^NSU!@VKIBSV(ExCve3!Awf<qZ
z(>8i9yHg}L1{67lStr~k4HJ)kBZ+R&1mkwm6(@Ws9qL}H58{#@8Vd_DHk&TROH@Q!
zPD;*S=54g1`@<vVjwy4$g7}>pU+WN885U)Hln3b)j(hlK$M;66B-tncqUSIfSM20H
za?R1}>m5v1scEK5a-}(Q+kF61(NY!DTc*7!&U|r}Yol2D^Q+I??_OfjJKuB32^=<o
zF9eSzkspvzEa3nuhR*E}csuqdYC5)pQV8zy+T3qE#g;gmQ_vOne<5EE?N8qMQpZ<@
zb+}pvB<Hlu8nWTvcHjlw7!(snZSRSWJ6;$)&^?vcDshp1vywMtFq5$-O6tFSCNke%
zImWD~MZ?Rd%HCLKW&0Mc4cgh07a=4p$p1_PtblBo5|C7-y(hZVn{Lqa_Gs0@cRG*n
z$|Sgc=E6?~-t8_**<Jd)eVufQ31os2I!Bcld}j@l9tuJz>CsxHOn|KqOK%IUIWEQB
zq6Be{7>aZ8BGXR@nsvPZ$U;OsDAp8r->sbAq7@?xB!5v|AND3gKvG<sVR*0e^PqRk
z_Nv|~NTnML|2m~7pGp9<btLuGN9#ro-%IO=cU`*@t<nLwBn4;TeGI56^yq107RlG1
zl;xY)D@NyNRIiHk?58UgHTK1(p<G9vc4C)unw|Bz)Sei*+BrpLdDNGg_H}O;Ggt2`
zE&;G7C@y|=QAfZM4G1kH(Peuet8E_eMzH6Zjz-O?teO56-_4g{y|C9dQX03!sTeO8
z8?6eWe0VkuRtDvB@toCF3xAc>=9fXe5rcWKk==Ac%1n99hd$)WJ(C{L>9b!c$T=|%
z`E>RLpDH-nd+be=4cc|9zYbIae4;&PF(%*YhzI?;;T^9>lR#JU(lFE&iw&xZWZ2XZ
zRKe^Ro7YP^-XoLD04_*v5`K2pPP<a^^l{h2_^Sej#Yzv>G@fOGT1jgWa$#)S_mo|4
z^giomK{DKYLTGhiYF?w)L?~qO5ISs)JklBE12<6AsG;mwtHW7kOZ6{#p(9b4z4<&<
zf8Lm?=}@i}i`8V2!un$3Q1l4>kJzQ*>NpKc&NqWgFLN&L03lorb=<`3d?3VW{c;k<
z0qwiuwZ(2uHGOeB?tx@B-$T$i-|76{ITtKfPyb)-KJrAtpzbBm1riF|&EM1S*-MCR
z&gxsAK&}QJ2;kC<fE4bZHYq?$IrMh4)9m}#D$M2mP6>dniz&}^z#nA;6+`D=pR3}z
z<ZFYu&Rb#cd1B$+r8hce4b6qqd=PzE3CHi76_A}~4?DP|7-h9F*hoCrZqA(qq&mXl
ztXj>imn^?zQMWHkB48B~4BSTtCmi^<OI$%ngtQJ_K7Kq)1^l_hM)8j>9R(E=J)_}f
zaJ>(8`bsT`ec^MQK-l_@yE#o#KHJO&$i#aAq$NcvMBvaUP{X9k!(M$At_J@e!{c6R
zB%nZhj;`)ov>z*#&r9rCpyfBxtT1o6q*$c?432a(Oi73Z-53`z#6h?k?uR(vZV6mm
zyLi;Elrv0M-D@goBt9Nk6Z(qND#FDfZaC+JrqURrjMg?TOA|B;tZjF-1JhaGc3Um<
zne8YWbRHb2w&1SVYOVV4XjD>xlre*?g0Q6tT+O=#&R(>yzsxnd=$&hXVc0A8v6wxj
zP6ohD77JN0M(BQ6TCZ8!hptCd@_lzjSI`+8zx#=k)2o`3O0zh--rRdja5uaUYI<00
znDRK2HSPaI{<1y1uM4O{HycE085H!2wg)DhnddGtFK}+i(a7unkTV^E*}ots*UWrO
zSXlnpWz`Qr%6XR3l=O##H|2~-4s(k%eQ2v;*Ln$Xa$dHrba;4k7PVi(pGP5{rP-p@
z7G9-t;32pnX(q*j(*WO3&iU%4v+gUrQ>SS3eu(+B6A4T|my<+)Qs4~qg)stv+->de
zb|VRriHmN5>t9ksDM5<Rk^B(Z4QSAND8A$V3uy>Ia6dr@_<QcOE0{$J!lY+V*Or?J
zB9}mE^366Ud@|>ADIY6*xwvp^pU{jvGC5I!=eA3GvH7G(J_>yWo`d(UC*`G9ufD6z
zp6A`lJcE@hXkp^bxppW?B71W9><=jdLvmrJGXl-k2rQn#+h@l{M+Qmnbl>@R0&Y9;
z;-V)R?6FVGbkgQvmXr7H>WmSBciwKZ?kMd=Rxi5py`N$0GAE;6DN*qasAgD|Y~{HI
zWi&lYWA={#O>d6tx{!QBu@a~A1yJ56=d+Ij<cy=tXNN0i0lpKu6FH6AR>7=7tI-r5
z>y_<pzZ=WOFe;8+Q{HS&D=)a>OZ(nzSo6Syeffl!A8OpoWieVRn+ZS^5{EmoRu}G0
zTi@3lyyxk8brsQ7&8AxwVYLfqJ<xOy>jV<tU3YFi2wf3echngr{^0oOvr;$&-Frp;
z@KF0K*D~qsaM!9O`)KQmMyX2qsZ!M&oC^4occcnV4;dHvcY8n%nt!vWBNk!?yw_e*
zCbs6FK(|KlSr#ddqfM(}eJa)q`UV#yW#fh-6Zo89ZQvlP`E&Pa-WgpVK^GoRayV)V
zpdJ`N9o}ZS+rprg%$$XebXSCso>4iM37m-uMqckeTuN+zDyA6)&Z6KR4ZEHTuDc>Y
zJYB+R7hQ$CXp-_lqVX+3%XUv8hF9*LKiQL+PmKw*vS#ysLWh^CtWTvD=EOyOXMIW9
z;#hQsyEkn?I3Do>IL3-%%duwjA|cuP70l(7*BWnKH5QQwL&BFXp|PL2$OgoY-(-hX
z^7_+$JcmQSS{Q#`eY}Nh6hjOUzhJ}P6#!_uN{lk6HEIv!KHCvSXuzm|bFT)36mYBn
z1>-VtqK(j<lnH7Ymy>|FVvL{w7a_fyQ@AAezD+#eTr#4F@(nwcIYfUEG;{zXe5EQ8
z(%(bV!2uG1&hsO5?XO!wSb<1Uz<0xjg#bmc{NT<6ml4CmvTchF(>8n|*Q74%`JD#a
z#m_z?E0pf~CE&KesZH#(k*n2puY?-Gi&%F&#gnJIgVd&abK)id1j4gk&==f;7cC$T
znCtW||0yqe3PTr<;le(HshdZ`Dmfc0I|=eBdt|;mmf2cLB%J0ZR=q@tv1IF<pDK_S
zKO_5oi0;z9;)V~h@uq1w!~34%7ew;fZ8w=BrU1|`SJgEcRlZzppezx--JXE~(kr1W
z@T?I;6t5*DuxHq@a!1t(kZ?}x!_3dwV?ejRk5xOtjfbBw*74p=x*R!xYm|>0F$DW!
zRZl9o!x%aARgJXC4S?}G4X_UU>#{h$`Qx<~TA!lONc#y_i6AtPGCn$xa$N6MVn)qM
z!BI(pzv^60*92Mr;B=pRK|qW~|HOG64l@N6$JJp=mN>2?P@v?qtWjdFTvUV~0bLyi
z?~UcP)g1OeET|(Z>*^>-{+ke?Ni=Su<zSs!S*B$ru(HpoU7^od7kB{ZX#0#v0cpph
zAL~CLeSwltVM`l4-O*~~lu<{FTN%`TqiJ~PkFy2PZnmvH4h73(wVZ?ipv#wmlpBee
zs~-NW1FDRtH=1`B2n8zfgK=5PhX?n6rFQfJGZ(=aKNCJLkSN#F#IO8dgkej=2yJ-C
zIng3iPMDD_9>XSdk3mnTv;G>%(KO+MP%}OQi-O#~vZ?jbtwht|?RlZ!y(JUgSjH48
z>SkZ_SgMB&nVSyGpPzA6%+0%?w}8;cy^|~UPNiZ3zYn^>Lt6M8Uh-j84pQOIRV(dH
zVz?J5GTT9`6cag&Gl)0);8Jg{|CzVK(2B9;C?YKe=4i<b+U(5ltX+{Beg2Hj&3dS8
zYVE-N*987v@p$e?Sl(IcWB~%L4^Tf(K&)Q>fQH?S3v8ZGggP90J6t5ya#dO3oW8S`
z<nsj0762g^4qVIos}cHJ-<{>~)enR7Yj&qc?IS-^f5azw-0FNWrS~%UvN51JR#`lt
zWhFr+%Apb+yOM6;7wC*T=n*xAXg*Cs)Wxb58JF}eNt}62fRyEwwH2PL`|)s$Eoe?2
z-d)~!4oZ%%Ny;gl#(mjd57RW!^;o_9K_>=SiJs45UM2ML8*i|!14JFzi*9uQ0~K!|
zTRJEzw0G;QY%%#8D!#{Xe6GC;{_c|IP=@BrJA6r*gZ-{Jt88lSmjw?1hPzmzZ31-M
zXMS|_2bXh3BQ^M@Isl{~a@j|{y4N&acmwq8HAPZ6Ok?(2PWCKP2wG$h)Yu~>54JoC
ziFU0vBlA`o?8%H;4-RPV94Vw+!>FJRHoadV$ZbAQl)4J&tJRD-58;PPO<TH;G^@nX
zQ)d_8C`aZD{KARrXaA~hOy+xV!*}1h)bExxgZ2`>T_ov4kaJarH7vjT{+&}Zvn3ir
zuXG+JLJeg?v(IC=96~1Sa+Krco@5-oYv;|}cCFLI2L!m!i!nJOjTfF7hHnVKt4pSp
z33~{T$8u1|03Zl}HE>&w>+G&iJ(x0{2bH49z@d!fYMFtk?DZ_D0UKWC4z+u4_4frW
zNZ;D%t;p2a+N%;J3K)9&0o}4ED8Atb-y>mq*|q6jFe_-7;w<DlTbXo}UckI!)&0FC
z)qyL|_kZ&sf%3>XzfF-;vQ7OR#R(TnGg?`ghU1<qxWSpF$*yz`viFb!iFR_NrjifZ
ziDzTp2^6#(3{{#|=UuOC`qy<Kf<HfP1h-?A!l0bgHB<N_C+}*~`~qEpnf>jU?ZrZ;
z7H~9Ki8nfy(M|Gb8d@lkVM2%M3V`JK56k4d&6i{1ZpWKGgFi$W^DchGyXhu(1kx~4
zCoZycqh?mtUw5o__7@rs1@m>i4dr4s2|u(Tx&-E!n#wqPhrh70xl5t7y27vDpO34Y
z7J5b#bk3_)cZ=swR;u$}vC_#;YOGgXAx^$6m%2r5*NThXkolcDVwF!*zKy)CR9Q28
zFdJ{zc~E52cZFE+wN7<l8fZ~-A=hoR&l7T=uKvwSGfbK!e``lezNRGkb@jXq=oYL!
z@VPPdxuz5=hSlOTyReBapC>IIUw=C|T48wE45BuB1_g@bVEavXS1P_qvk0+(Y`B}U
zjcf_&s-q!{p-irz8XbC#e6TB#`wWMn`oP(ctY2Vl`u!g7rQF5snEZ)XP1m@RyZUyW
z+GGIO#LjlSz4D>ZdGRH98OD%z`ZX@mezyT?=U3NWr{$gTN90XX1=*D@VVA*dEnH`)
zx3SWWUK9sjC!H)L)mRqNUvq1hff|U6XHND_AczBQa9_f}sQS0D!80k<0Pe0F7cVmS
z>Skxf;zN>MQstln2~!FN)5{>kyt23olS0Zt6bA{-r;Vg5t3ddrGu!k`!929N#NRn2
zZQGFTj=!X(=)Ncw_c@~QdPx@yk-f9R*B;0%E;AD>M=QAShzQZP|BPk`WC^xBwB1@v
zKh`A0n>8qe(WH&t+<lk20uZ*;pi3aF^HbwVR9@U?0EDd1?7GVWN3RwRVI5HRwIQ>V
z2&0RM-na=nFVkm^)lk!-m#tn5Sz5e?-Df?5+6F*X2A~PYTtHPuOkHO(e$MvSH)m?R
z#R&5;bj(TF_-Ey<RvfzcRT{G8QX;K4jixkgqDBIAdy+p^hHB{Dj;4O9ak+bQ*~SPt
zy|<I!12sU&sIfEi@0oKG9%ai#v<Fp)Qwy{H_XTrb>ls>2G81(lT!`qGMHjoDs1Nem
zv-?#Gfi_OFy6*m#?F4vdSE)q=nmqPUFc3-gn=P+``gwZmh~iA-F?HGURE41nNZlF^
zo@#(jCg&gDUb3!?ZyqmbdxW^`+S^B0)%eMN`*Zt=7Rw<lqMUVO?Ae4k8wdl1p5gI-
z^+!BXSTOArH)|Ad@yZ|i;1^eBUP|&QDk3$IfAHDrpvCA{*M`<~SX}QcU5ExFKvbBe
zX^xF0R1OIqCW9hlkD8nT=&}8D$AF+2@8a6=6TL4-<o=GOn<sly4^Xwwlp1H@Ekk8p
zH;~^FM--C!PNtBcBYzmy8dWXNmg;6gjEX|#scH5Qv`;Ag$@|$VH`F}uKQcsVPYk)t
z8`GljC(1VkkRi#mjY&3*ysUc-S{o7Vr@n$<qE@Om7jmf+mOdH*eC_{i@RP-Gnc^QJ
zQRq2Y6`rbD;oD|2z$+cYUP5jvrk|RRr47|s_sFOLP`uzLszil-=R3AlyH$EXzowJj
z$fA3{r%63GaIrdkCYS34?feqXp^1iO^upA^jnLf33lWw_zBDfpfC=r>S7BGIBp3Qa
z4K!%yE1gm@;ro0EpTF7Hxl(g1i_1)*Yk6_qNYkEn&C_zT?qw%j*g|6WU||drJqZ4E
z8?Wq2G0&*;UV5Pt-_;Y)RF`n#(AWhRctj-HKIF1P{OhyNshCm1GpxzSsVB>JkpXd&
zPNhqn0Tk>!Yo)KgzxD|Q2V!fS-_4|xYZaMLW`cn-aY*aM#+1zQV}nT-c*3>2!+lJ!
zB$4qPE%%Xu-opB%RFY*>*`zlzlj?PK7R#4t%VoyJK2<;f6?|)qpqbnYwRs?V%vZF(
z=W@7)NwD2fMwY~$!K)U>U1LSZp7>_ErSrm<SMI;_GzVDs9y{FLc}DiTj#BD*Dx2Rj
zORFu-$)WO+&Z0hN`+?LdVc!RtBvybd=m}JJ6dCe(`_alhkr>NCo^-0hSCG=9jpSYN
zo6Xm@(>R&mi?8>P>5|`I3=4xwR9L?reGe)P{vu^jJ2J97;t1N3=ElrJGj}NiPAMBE
zf*)4@La%8*I|}UB+P#|ra92B^hgTAyQD>a|)CSLHu9J-`arBG}RFKYQf-c$Xi%o%v
z>;B(Y^2gd&0zOp;0uaa5q;u}6tJ}2;&@ms}%Nwh1uofNOg!hIQ_GZW$jSN*1(*rys
zDX%FVg;rSOjur|wXU3F0*Cnv`WJxaoO(-NA0~1etv(>Xd;KgJnza&diCi7-({sK+N
zdF6{L1nLS<K;=FKP)2QGQfGg1fkzqj@uEg+biNv4nma$sV-(5VxT>)>L{kUC8D2_#
zxJI$Eqi-A-v50s~eeY0~W@tvsW1^#Xr<ALcK35I#<PKBp+<#$tc#!Nnap(z)FzL(K
zOM`deu_DVQQhREgSGcR_e{R=TI*>}Q#qR2%1GL|4rZ4FCFCKdgRko2kt>Um5|7do-
z{(Zv0-hIHWO@A}gc{9iD(GhrKD>%aF24uJgDp@5}Yl=y{m2|j&CzC<k8S_)M@Ui5y
zdx7!zzV6oewnt#U0on{85C^_Blo<AGE0GdS_MqJAR0SN{Ie0-tO>m==BcX?-c*1)F
z`9Lm{)+d~CLo31hbd!!EB&)CS!FZ&(0mzAt!uQ8V_IP~74)b%={9q=Wg8<uqqzpm5
zvEKodBHmOqHALrd&W^!uYAWL+-jZ+d2lbUGcJ;`=ZUb>+EmvOR8@)nG`9g&;-{rM_
z4z;FV@7+$<oPS}Ger&*buKNB0MrrNZ;1|TG@<3PGnhdxYtrL&!jMTleL9D&AE;uaC
zQ;@fy-2Il}Dt25o#Ljn{Yu-$tElObVh`X7Ld%!8e5ZtT&)fbf9B|;}3Z{%caHTdAj
z6_n6krM}zSV^SQ34}7>D>l?^pnE|*pQm&CEp1pY=aFF4Ca_xQwaz&a;p6MKIY^$PU
z1sD9efJ$^%2me1$Iuu_Bh!9GzQ02W=o;&L2q6Ss7n``fC9uwO9&IMUw|ErHZ%~?kL
zz8YR+B+mWn12^a(V9|Dm92|i1xuc?gDPaW@^E~uuQpCaaDepaR_IolIQf`F^-7h9^
zKQ3O|mN$U-EKZL|r@2Sk05neGr{!QuK4;y*8#9`1AyOQZd$Mm`cT1x3#N)klDeim7
zss`ovYmrt?^=NmNieGTrTh?*xCZMO4C62J>7zJ8o!vdGhM$}1P$ParyE34=#6G@G8
zh+tp(LQefbKD?fh{AVsZJB(!F3+vNdg8B7Al?TfmdtH?^CE{W=4XdpniKkxyvV{zw
zhH!Jqm~VH5yTrx1h4h)lLT7@q6(^~|?#bS;P1pEcsQEm>1e6k5Eq6@Bx4E>xNl;pZ
zfCJlTYDApFX425f3av^1SLb$Ie-Nq%Nxp68@27Y@QW03-HyKF@OTfHycJp{9NT@gn
z<*?G^MIHpWJE6MNr}~lfx&bOcAvAi)VUO?dSwvq~F`UjpyMoq}zX<K+ic&_lMLVwz
zx9=3^kw@*4{xa$s%8(KHKM-W=`$m(;OItsl?mZY!w@HnJApL5oOyL2}*y$cD02n9)
zl{r?bHss3-k|ID$oK5J;E`{92T&OI-m6u6G_p`Yaj1;|eI~X-h4r>)<k`wbQ!qyKG
z28vE;fJBL2vs>Kk)+PlC*0|aS@siYtIc%BIyml<l7~NF_$#LHOAH#PKC!D5Q!PlEc
zvR^wnSsVq2{Wm`!9FXXlY3}8}inZ=%wWGM~mJteQ1Gbjgn=au!G*HQ*PT@3FOig||
zJ0{1}DN%P7(D^{rO$LMh>Gax0MQ~Az?!2xmZ4rDN8BP```SB97Oo&S<hRq>&fwd&H
zHE{xKw2-q0ehZ<eMYe7bAn2}KP0+OSU^TFyCKPA_W(xFr@+r`cI7e^uc2)*a0{$60
zkNgCO<>uKe(7pGf;UPrZf(Zy4@dm?2Z!~jVBtOV;LypZ&`!V}f3~>$}oUKk=F2D7X
zw02WP=J~CQA_}6{R==+wnu{%2rX!DfClYS<>b%x*|M=zO)lXi-SFg}Ix=uSy_OLrS
zuD4H4z@4IyZD;)WtKR`IAU;9BZqjZi#_0%cQDog?u6EYD?P#-T<i7lHIt#Z4Z?hP$
zO4L`8z~SzzGt^uHx52MqErqeyOP6U<PWf)tmAx$*#;OCgWl?P73sP}|3F+k~)VIU!
zAEyS8YDd~+pt3z^Y&}lF#4@S5`9K_0K=kZ$wbfDGwP=nv#w>k;%eZHT>#n&QyY}A4
z;Rlr`)9>+lE%Y2<gZ3)hmAvALK@RGz)2ivsKDCMT*6{RfMbs;S9$SuwCT`1MVVR_(
z9$~*CFJuzx${r=C8MInCV$CC5@6U49arLBlTw_qZm$t2*0pGiA5nIF)i??!P7;*Wk
z;)y7D;ZEROX8YdM=HMefQ2Elj*)u4=Vo*JGkkB5_`%FvYEZ!rme1YC)hF0$qCR)-f
z^nr8?`ua&)RhIW|lNSBQK~{i{8e=o*y?d~_ZBaoom+9)4*~z2ORm?qU9Y-vhAs6WQ
zM(A|kJ6F9-+%P&&;Odhi1DMw=PBrOheaEID_F)RvZO(wknoy_GstB{0&D9@ENwU9o
zguF(uDBdJ%*#9(;OWhBW>7G`%vcS8(idTtg!4EjCG9@cggF-Zsr(Cz;V+J`U`q=?I
zN+CP@MoBLf0%6(luILf2k>f^jyVWEm8)Ha2z~rG$P52h6B*j{9iSFDdgCLk%v0Wg;
zz<r4;u}*te%h+#Rrx}`TbcnNKOtccOVzO#2S_A4kaTSqElXl&;XvK7VBDaetJrWyn
zTW_MA9C|Z=%$>l3Rn1W&F=xUSw@Lr%T`zwENip7dR#gpb3}WVF7JPZ3HKy&Gn->nc
z`D<1K1C5JcF9BG{Rq}h^JaCJtON$JGBKIcY+!>!}&(N0*5{t@{$8kC@dF|Zp?&OqN
z=u1h+ZV27s-iQG;l=tXKbuACK)MKFZTxfnLT0&w+;Iy1@4&b@jrYJYWEHv(xdt(#@
z7nOUCW6NFgx^}bMXpE3C-W<kv_-c~N!LN|k;)2rh*IrhkDbtN{7cvXce6Pn-(NtUZ
zvf&L&E(<(XpxAipV(U+tiZBf<j24Ktrno<UK$5v;)pT3%m^+5cttywD+;;v>@m+gE
z=e*R9Wz3>MdE`{&HgAZXxATTx=Rd`PE$B0+f>_3UBu-_AY5!uJT~0{7(tdpbQ&k9w
zHmNu}HAu0L-3~3ro0$!h3phH_soL1xdNsc=7rTYHZeZiSGknKOKtdQxn{UYe+GxH7
z_d*Jw2w`HWDyQx0ig9*R9vHrCkwa;A)L#{OaLO0A%9c<x%+d+y!!dDgy*u=MGqtkh
zFk8~TM{1mTe{^ueh;Z-Mpn5^mvF48{`ELF>>)@+xz`e)T+BCfkMz2-!UQ)CeLuZW(
zIAt4S?KnSkel#_m$1c~;o>w~3z4Zp*W}}9<YnHzU&&^eal>|KM!=aInv?e>cew8Lj
z&#nk!lrUj|Op8QP3nb1K8k$=paOYn3<ybzi{Pk8kL95Xr0bQ-0IVnV4GEybtHS0(Y
zj+map8Mw1$WS#bu`S_q%Df#|_fepiNL4zBbo<%&B_+}6+`~~*&JDGpvP<~>B*Z<_o
z1;k777-tn|T0ozI!U;c+BjL^qVZS83MI)>hPshdeL?`I>*R=#7$7&ASQAIStXb$V>
z{Rkhmg0!ajMN+Ki70V7WZlCF^VXf1*yzO`}dsRITeP_q{TYt`$7pY*fX(l@r+_MFJ
zn6Y?~gRRX9m)K8i`{obLW8|ouFP0miv1VCn^n)a|F39;QK~M)pTIk!~l+4E`207DE
z)E=|GxZv1>uuT8ZvwUZ^>2Zg5>p$yhn?V73foZ76!)15<Mo3e&YR`K|(XEfyK&k`K
z0W$?B+46X+m7h}-r(=XS(9g~5K+}{ACWZ<Z7n+Rlt6(z1<Gi6lA1~%ZAG_eM;Polk
z5JVUv!aA6bE12yxbV!-if5{IXv1uGabP;pD{S`yQCvt{*3H_GCs6;Fp5%6C)Z}qvc
zSMOnvVEx*g@{o=&9oo335+B=^#v~WOE+Ilii1{T+vQsmSOfHZSE=JXNxzcHcWg*Ea
zB-d@-gqY7#HACBSR3iy829^tD{=!=r)`UEOnrk=@11(L@;x&s!sUZVe%pV@DA`0Nw
z`JCM8v|SG>h@FpB=rxzId8a?Jt;6!ZuJl*Dciq{<T4zh33g&<74eoEl^_W{qcpJJe
z0PQ89zU8>sI-S;2qz5V;REFT^=&WXlteZv_*oaB->Rn(vAD?;J^3c+<LDTZ=b~2M3
z0}CI-A^-YjGE<<huM9McikBbyg|)VILer>m8BE=S`w-!IFc(It3|(;5g>g2F7Tj9d
zAGZJlXxY_amh>vj&=p@wIJgmfJ(GmwI{R1l0g@=~taiP~VI`960Gp;uqz(g&*Bf(7
z9dASAg$6`n|Nq%|i`3Zfv}nD*3NbP=qg<RGUNHJj4_Q*y?XTKW&cKx;COpng(jD_4
z0@R^a5v<!0C^W;Y#&<|E4MKi_xOFFn!`UD5r(Q%uLT2yC9Qu1ws3W<p6tqwGYJ@Ir
z7edMa&7xkS;q@_#b)3)yXWar5oX*t*aU;J4lj^Oh3Mm_;DT4Kg7$w7nK0q(b8{hZt
z0W|N~;7^nub#6jP)p%fcyt1m0z);#N@aF^5WYE_Ccq^GKa7PCZ{3vO3Q9XlDGO^Ps
z#12|PHqlyl`Z>Dbarw_)a~`J$LL((BEN2XmfCAvI!DxBt<L09SNl^(?5dqr(oXilF
zb(%1E_~m9Y3}`H3;Af)W;wI1TB$LUpJw~3}#tmQ_7k!zaF@{36ajktFvW>f#5B>Cn
z??VDj!J;4(&`cMZL62`Zw-f$`Uu4iYg{d+<PZXu}shm4gzd~wafK?pWpv;Fk=y}WF
z8A?VSkob_-V=%18#E}pabrvC*xdhI08Mn7!_j<ojg>G_b%3y>gf2gQ|#o{UIp3{lH
z0-x;vO<7*cBFwu=qzlPaNoxO|q3XS0_VXDM2Qx$<naElejtd+k2O;>12-3zS0G1L5
z-oj|sVlD-Yt^*9IZ}o#sCHPt)U>S&=)hix?r%{8i$Wf^l4@_4-7dV>6$ydyP<-b=F
zj48nKP9|7dVn*Or3(F#L!EK#`06ad7w7~>&`mET)Yze|!cfU46D+*+2E*_<eQaRfu
zjPQY9Z_o<!lF`=NLUZE)-k61$mxLxK8oVX?S{pRi{W!p#b;eRdW(9mwy$AynRD)B5
zUigQ!9uxctR@T>Z;ekBxNz>nI7e9!S$<Ti1asg=tp63y13f>$8%`!1HaK>P7Myt2J
z2d|68d5)Jka(%`gv<Fawb!OixwN(IvH3UO4ajfUj1STR0X4=0hPvaI?jF1a+)+7^5
zazK!d4O$pIt4Bm&l}w=6BF^onBnBi6fQ#uIR&RR`*e_$T!Q)#3ra6Aw&UuKqrm7FA
zTHTP$2R3p)n7^WPl^pzv4VDHkOqUm$Dj2l3YUhe&z;KHGW;j$}WvFgPo^LtGr~Q$)
z0EXlD7sL65`yB5`>|8mcSEV*`2{SZvLtwTY8kIi*@CTToM(vO0p8U21pTAiGI~WoN
zQa2trUHvpL)8doL%%FJ<Sc2_eEdf}nTxwiH7BI9%$k0~v=IX%XWr1P$&5GN^LTi2P
z_olhRR0KIDY#No{wyI%-28}t`@4(Xdw0tFlrYZrvaXI%~r3x61+TRQ(7_7|s$psh=
z6bJvX*h9hWFNU)ZeEiA%bNzrNMx8c$jF!GV3fp;TRE^lfEDtbR*ykf{@BOxf`oCF1
z3>Z@E#A7)SLD?YZMs3AN1X3ly5_tb+2_%p)_jF9Z0EVUq85(-fRu?>;78tgPZ7Po}
zv=OeHZ(fQ^chrDy0OE&?=e8=J&kl$7avhkvdVN)BZqnqy8yyDEWe$PiF#XMNpp}t)
zZvcHIQ^?Ey(YpYKGyNCCIR@i!Cped$*}44{x`8ag@p<i_QR!i>M&0z9CAO2UxB=Dz
zSi;Z0SpsCJ9hP@90dkU<9&Cq@vIxH?z$e@UKH)Ex5CFNHMMIlxFbRc_%YmC!JO+;^
zgdSg^5Kjv^3GegG8+6eRa>PLJ4vJlvp>#trC}=P1f-&o|F+p>qNC(~sGdq{I1BP?w
zZ-xU_hAge_T(zbI@;HBJ?SsKW{>5<IFShE|V1q)Ur|{v`b5FK|@`*p+o~+;u<14)7
zUy%;3G1zG_!1DfP3BXX}4Y~dMAfEuDVrTPMs~GSJz!LEOW(neu%dtoByaX;s6>>SK
z5)Gg)nC1&Te*B>vA=n5XMb0;GlcyM@p9w_Hz)=L)YS>EqB(#@7H2L|LXaWq!?{9_!
zR^~6!gbH%*|I=_T)?AqTs{PIxvIw`!=br3v@@XfuJ)7_TcI}Phip(I|^+K`kZ<YWB
zxW5D+U<p2dvjh-)rvGQ~5lAX*{}&ekX0IrCm8|8hOi+-*{!Vqik@afN!!uCKynJrA
zEe?ho&?-iQdHhRc0Y=pD7b60Z1@AAB<pyx{e=#CYZBN@_mO4nHDY*K#S99CAX9R6k
zegEHXUeA)A2n0eC5cmFO6(A7Z`CA|YR#E>qs|W#B`?o-JA3UCx`%@nzbMgAd`9@~d
z34vr)flA_UyPbt0oS<L-e}5!_g3fv5`FH+F^9I{+$vTQh0@{(#JpbGOP~ly~Xql<K
z52-l*BV(ir#=`(1zg}~i47iDZWQ-TQcrdYPf-d>x{!?T06oz5nkW9pL^0hmcKm11q
zI(-A&8}XRVvk?ExK$ob5shnZs4>}<X^*=Jk8y}x~3UBdzZH6vN|IC8_$0+}qc?4nO
zKSuc<qx|=_`F}j+e>~;C=hy!ezW<qH5O~V}OX1s=GV=1~Bg6At<3Do1l8mWU(RPa|
z&>JaV>MHe!EjXEVm_dDtdbsPP#f`R9nQt!YG*1z(Ix>V5s{cI)^{)p=rVFP`XMpm}
zoaT(`zh|-kWxa%NUcMW`?_0k5&kb~#92{pi@Eii6Yu`T;>1h<e8SGCs_a9k6VI3!M
zoUP{T=Y=vE|7AY@jUj`SGq~)3Y|H=WPVp1>gsBeJpD#rJQ)Bc5>y1q#f1eq7uBZBs
zSf-;7xMLxoCg?$V<$q?N&u)Q>!GDbMADGPlCr0V@mLYh+Df-qUm#;fZV`}aPyHRgl
zV&jRR#RX~M01~dKJ~@G>pqquUpz2WZntJf>3`P$Izc$^g@Dq?m6S?zHttfnFG4g@7
z8|vwY>s<`ZnXMI2KAf1*8dBw2i^y(~Ce;c~Z@Z(v>R_vTKm=C&?87P~CHsHZDkb^6
z=A<bjP<xZ=v1Pe*e2%U$pn)C-N<L!i;{sAiiPmu5Rudk%nN4$|4DeX57gv9|CP-NX
zf>bb4{YP4uT*N)^##X4NR<b-^iIn%5fj$gRtJQQW4I$01c{%B}LB2GI>Yy;G6>Fje
zcT01*S*UpSe;Om1*L^X(@a2K!X7{5tmbS<#YS11@&h}r{Z`B6FD8V6L<18u8V9l<p
zd7FhF*`z5%<PXNWYI$*)&T)_Y$3C`x-~}({7(14Vo8T27Np^Z2a!yEX&xMr<4}6|W
z=h=3z+5cUS@tOtcu|3=ylIuh*^~V5^o^JiK&Utt%NmksSj7oiKB6ML*3H8(AtfGY@
zx?qJ24d~Ou1}#W44{z~M{P*2jTZ18Xl_&(cZpsKqk^;%>yG0bgbWd*8<MYh{LIS(D
zyos*Mh0(bTiFVZ*HVq|;pX*u_Q{Fs7bWCjxsPN4u<XN@#b>&8O#BnziCylcKYBpB6
z4WG<-*Gi}{xTs6;sJSy?ss+AL!$`_iMJ3OFAZdxj*7WELh)CNa=e$1%&<dn%E~~*G
z4RqNbNJoa=^KO#*j6&NYK$SD8H|6CeCoMWd8KeY9K}M3t>9b|dFRL;u+Q){D^wD5(
zZ(UtQZn(1<?!2IP6?P<_s}JI*+MB51*kQV&AHYG~M@C#ZiJa!^(-n`(&#UsYm6_7Y
ziZvGg9J%d7rXh2BxWaNU?bkK?NC~gN-8Etx6|R?hm&o3DNK;N=_Zr=vQIbVewVLLW
zvhlX?pC<@$N#bpCy*@0;Dmp-8Qi1@z!NOOr(rl@ro2lER{N~rv$9v||B}48PnGH>C
zb(CqhA?GXhS(Oq|2lFd91XYW5ZL`Zc1z}K2JRa}t^UQHb1IeH*lH1^*_5A?}j_r6f
zai`U#4PP{6_fx?MbfJ^NqWy|;!fY-(qj;`|`7VQ6p=}6qwF)9ioxm#JW;c`zZ&DVT
z?F=Fpko|N=U^vFZc))F|*1K)OL59k+Hj(l9&v#(}_HJ2pc6x-wR>};D0{rM3olR_?
z=cEfLE_GOK*N?A`W;Fo%s)>Vf+G4?U(*c+*XfbG0kRX4A6>YQxb^Qt+na5RGv`&Lg
z|4zFmn?udsnyFtOmG%#!lF~Jg_^2br;)n%oKOML~yc1&3AN{R!@15q|Jogm)C2D=Z
zJ;Rj)8b0JF&wgk+CE@@p|M97<AVjL{rQNczMa41bk!_X$DugTAujpPC<nFfX0*-(u
zY!=IJKUVgCt*Sg82q4vO?Jw*p;#tXlk^cbn0Qf1DB|9_$+sSc-`j<vmNISL{pY$A#
z9%mFuM1+l5=H0(7$FGLRJvRrKNEn4qc2ZrBTYR=g%?eskdyhguLkC|*J<WE7U<M%-
zA=nc-m^-|n<w{(Ryxt3oVmA8tWRH2<9I44=>7oV@<00KJubU5~TD$Mf=rMOa+V`PE
zv4FPTLWGS+q|iK1mi}`1?l?YQZn$%eT62GmEA>WA*-Hxd9e3xMfT7ounS(fG787D}
zLMKd4apTJ&6aHXv0BO_B=8f$VfdE98po-~$F_l3Zg&wSQs!Q$IFH5QW@Kb~ILL048
zJ{{YGlziHl4QxW^yj4)Ize$(8Mp*1N_)<mFXf!$^7&ybGk&4pKqlbV@&2oYylW^L&
z=I8E2Vs(%o=OYdKGXCu;I@^xKkG79Oy0UxZctUmweNBb#uDPlKf`H4?$>k<9>Y2(<
zd7HvBu_#?XE?Vj3^&JBd4SmFcENXrv)7H%~7f5a{+L<$%M2(aMI-UZ2<_AOhek8XW
zzG{h-MNg+xAlt_HDj$Cy-Q;m2Eojq^P*}--D*sqVtl<+;^MFdMBWaV0^{6ZnLvfT{
zz(yRpy-RSfcst?FSGC0yQmb;=^~X~orPqrpOH3!4`_0Y>DrFf|K=SdzT11-)-`UTt
z%A6iOtfmuu#zob`*9%3`1-2>zMijL>@1;`0*0P@L<-C^xm>9al8><jR;lG3vsw-a7
z%oR_7GJqw+>>ggn$>DrJuZQs7m+Mop9G3LlQ}*yhLHmZS+kOB%UZJo(Te|gjn<X+|
z^DuU*`~4F{^>(LvFT%;^%K~Ys4L~Q)j+$BetLD|HuME^Yh2rGLIT3b}$9B6fc|B&7
z^Ia0+G#ST>DQe@^&6U-w59ZB`2x?+bY%)N~H5=2#9)NNZoD{zQ92BS#7mpJT`&w+?
zLM>-Rp}T@=JKL){d$t?P?MzhBcgXe{u-*cx%b)9PXYV2#2x$YYwG{V<8rXykK%?;S
zFE+VBZCPinOrR||SbH&5=5e=>$U>zTSM=&+YC_e~Bwr!fCw@@<_<-T-8fjq&Gp;<X
zR8L`Gdd1IuKN)5^9~=P%b#<$jb^qohS<=Cs^*+`vgQ3>Bpt(2m?mrt!*lhcS&pz9>
zo9QJPNGs0`yPrsRwf!Pcvpi)^IQn>{W4L$#bJS^Lq_guAxq}2zuI5p(Ke<r5W)mg|
zZ!s97cjwSj19nv^HSl!~XX61BYpU_YlO{ZrJ|GbZ7@iN{)()#aspBKtG8`1Pa{KVe
z{B28pDA(d*UzuGZ?48hBF}oO_<yNNZ*kxlQ3b&(cyH@Mr>8~<OTl3tfzhBLa_Dr@}
z7X-(Q&?qkcjZSs|n1tth_7P8f$x1QMElwl<ew|{JuDI|smm`G`Ga8Q{uoPWd>dtar
zyeA#!@?If>@H*)Q;_yu%5C{5{;^uNfei%e)S^x(B`8Sih6jn_t+ENRhk7numE(pGo
zLfg3&>meX0$ybcLSN7p%`4!(fKe&HDE%Z^v^vuKWO%~fN?Dc+mw)=+LZfgNu{d^^C
z*QqYsXQR#GOd{H4M&wdc^JkwsLCtaM0=A-thS1T(6`N-H;FbJm<&F=Ed8TV$j8YS}
zgGksP-Xmw4E6b<7y@8$j`YTW@cJ%Wcr1K|X9kIXTBHTZ7_G?CNX*lb>s~OA;PwLf`
z2^;vV&OMQX)gr)>%Dhb^THw=cRguvoHH*j=*h}sb9h9fZKGErRE&{NOs~NRI29jlD
z8{@}DN9agy8Kk$|XA7Gq|5(~4GP_(4ME3!jd?Qp|@Zh1fTgoJA=_rq>PYtnl%(195
z%4%=KPSuKDOS+O5=&T0#SrfccQ!IX1(Gf(dco6L@38>2P?Y5JtEt?)0^zptBkp!jT
zAI!JHg>Baq3O#BF)^A_G+t0r9J}{0RpOE8I*Cmp;|9%m}xznBa%O#fJLdj2S%V!er
zECw<ZblyMD#1ohcmCkRsAnH6cN_5tsm7}<=q~(!urU4J*uo`5}*giSlUds^qp=ncd
zeC;aD(6*}c#!Wy-9e5UQ+s>k4?V&?$YeiLInU?xCg2kf>fvWyx?4p8h({N{B&@s3O
zpblz3fM_i{_4U9OoA7armJQ9#H-Q#)civqFJ%BUyK63uAoHr&G$SjVDB!Yt{xCVu7
z$tyIpBZt$j<2lf5y^$y{21G2tn`%>qbQJ+&kYIJoYU&I>_rsV0HWOR)!va=|9jgq`
zgWuLbq?x!vJ4(=)d=F(X(->vfvC?(pmSq07B~H_c)vj1QEs1pV=Ryk~D^7{hnkZF7
z#IGgIT5jM6(gcsE>tc8bXbF?v25rov#Jhah)L<ZaXN$wt62|1>xn8rGi7p@XcgZPA
zlmy|4hx}Oy>;h+X2uB5(BweprO85Olz#Pst<aUjX+BeB|Yl(NuB$JFQSVKiTCkY(J
zu_$qG2-jjSN;1zhbq2p~xbMAIXI)GdFQ`|=Zz*21OJ|Wb-eSK>VD{+_7_Z0Sm{6Jc
zqDw9~Axv<HTG1xO!8YC~?V38I8wMP*T4V$ej5(AmIj-)rJ@#NoT)Bkb{sg$@TI%Ek
zd=om+!VHI%Q^4JU=i8jPEWEXHY8S?VWGvl#4-RlI?u@hZO}nDlN1r*)h<9A#!@3td
z&e*^K7D^gS@K7OU$k@vMei(kb_mU2M0X=~OXO@dZ^pKf8A2==tdInz0Avaz}bO})h
zFF4*>%T?lYJNuQoXQ#i`+hVWks^I9;z{|FOM--PvUbG^^M;h#ujU8%3LN%d~FKBN9
zy5?(ukHy$)jPYgI;jV3U7e3z-IbXFkY~dQompAD42fQ#t+_4~LeDL{xWZ9e1yJqU8
ziKx*w_=Z)0W9#RYy2*yi7GEvK=ztPRU-HXNHa9xZNf=yP+7#<0yk%bbJ8y(GpUiAM
z9#dLZ$xs=7L6;YNb$Lmclx!r5<<Ry)ZqH$uyg+2Zr0v@7O-aiK`~STL$EKbP4oOAU
z-!2i<h?NvgtFbdg1h%G7<G<kfnfCDmp;Bf*7+s>j`LE1~7L<#AkktN=_8DMlS`W#T
ztt}5+eYsScZ7A9pM~&{wgU6Lii1$ym`>i`uy%rk%<=oKPP_*r{F$cnIXr%**1jjAc
zU!QLS0v`WzOMO+UgFU{QutwRGz1O5%qfv>TLctnQOS~(7ArN}@zHpMT?Z7>7A!N8b
zKZ(-7V|I}Yd@7Dh!vb!H?a_`w$bc)N?uScs>s21p5`F6B?%ex*;1WYE{<u%80rZmd
zI?wiC&2DIV0A|cxYVn+bsGB7#%3B+>LkFrDE#59n_=oFlyE^*7fff@;&LYe!Y@1q#
zd;0F@yY-nBG#~D+%qDw(YJI74dVUwwEZA_h@6V%jA6{biGkC&B-J2{FXD{^X$_l$d
zR=rf4#ry#h9NX7STUHje0NA;*4>Vi1#Tq5q?oo2ETC}>-8;E=F(0Nc*<g+NGq-oe3
zaBkJ%n%QA)K^HK<y(*w2O!})MwvZ=9_p@Vo;gHsQjbPPFEvT+{m4%U?Cp&jvU#Cf8
zb^9F7WD^ZP4iY>R2C6?x9ESZxS}S*|M8=(QgmG|bhV1f(k^!**7J3p+saC50@?D64
z8h9x)KD0B(v!M=OEw9hsO)Y?|YMQy1&3T)&poKUyX^p9`5;Ko(H}ERO;JuKt9z>+o
zHc`9n9x2D?fJSYPlY!)yY`y;aj^l-N<tt#`B^D|i+W4$sbK@~aFZ{pYPL-Q@Un9E(
zzkysYm;8CZNaqwqFqbo^(3K!m-=F0{mr3gFXi+K75${?*ywkBfofwrMIbeqppg6~b
z2Mf>fnMOOA$=+99Le|yeG0s(4_1W&#-p88X57@BU$)h%$u-996D6Q1Cs_qgTqs<%R
z3gmIOWIsHv*6(3hAW!SaF<8^fp$ygbI1&RIn~fh2^-tVQhRb7*0sRjb@@OPGo!Iwe
zxjAGQRYS0~MYgdX4_zUs#JxlXw6!51^&r2WOJ5Etce4_0^^Z8K>d+inXQz&Vp%}T%
zqD$O>1oI();twL9$@KYV=R6zWtBYp-1Te<IY!@w#9BMDVpO`U8_;y6=DSxTGB=BeY
zbrz`xyUw65_=5|*K!~<{Y}gml$iT_4h=Z=6EhbM5hc3HWzB#zuWAxlZ>P1Clv(d{l
zUYCVG-eYoG4<uHvmevyZM1{0uJe9NREqw*9Dsg?2!kIP4({{Y4`-Ig0i>mLAr@DXt
zFA3F+q!KbhB&%$Wc@r{|>>1fB^WYdsgKV-Ll<b{xaIA*C9h-B==5UUEvVX7BeSdzR
z&-cIn=+Wa5@9TP9*YkP~%qKK#=31TY^S<EZn*#nFCD4(+m`u~72<VtZZnbo>_q92#
zFdsth9<AinkBG`^CCdYnSgs8JXH)_KwZcLd3=^aa(_z2)j4>a9KVj`og=TsXrgf;%
zI5Ew1N<+X*u)hildqUiBb!6Q_fYUnf=TkPP&FdR4tF4YQXfUVHPo#0k;W(P$g^46u
z2@(HsMTu|6%cw7B`Gq63+=2?PmjP(_;2x65@ci#QeL4RXnW=tLb}q~tIB0(snkz)M
zsHX?)*A3<A@8^@qQ%W`@Y}Y%N$uJQOGd6K;_W5JqB7R$=)EG08p8u#^cT&&9D7~%!
zc7d8d$#=(A$*D*_QirSGLzy)E?r(@CxeX_8jLFWbT38md%ZAM7y$83htGFO`g06vL
zBNA%kxCg$tsSRrKhdiy4a}V0I4o}=$R6|{GmU_&ynZ$3l=<->5yvA;X^|J@1=|rv<
z9oIRO&2ZaWc>$k|!>oSprMn%!maIc_v&ddezN)Z~*P}_}H<UC_<m;zOj5g>5egDN9
zIkrq|<>=J=k|aqQmCNd}?^)_*`Xn<;jFQQ^mfn8SnC$Rv>k0D~&DCPckq^1zoGN4W
zx;Rh@$vd)WrKAyW6(uoh6I*;9t#H9*TD>W(TyEPgTW*d2m?_c+%6MG`XNu3{jF~2~
zlVG{8M3-*K@*feJMgLB*C84Z5r1Fpl4a2-<fd;V^D$2W_HlnNaSK6%T=cv0eCXim^
z`rpq9<CBjADsS#h`$B$E+c}|1!<=SL3ryiyTLUoT+;U#HZEC(+<1myJxT$iD*wQqf
z09q@NLAE|YGRf-K`n7$U%vtg)0S+CB%T!Ns$V3A$Z8@Sv`uQ}k#9Dr~X?frYvTLa~
zZQ2)ZH&&B|Du~f^od3p9?K0R|8&4MFSmy{lVglGpri4W!S%Rv=zl2_TlWr?HR2eKZ
zNv0N!a2(?o({iDm{9Tsgn~PXYIg|P2$zi#?r-PMT0(O_)J`6V%GYgmf@O2M~1n}P%
zf%1R@I8S@hIkwX=e3Z8TemhU70RV-`ec5!O%~XaV*SNHp=3VHpKV#&r;OFk71#J$<
zY<KZsH^2vln0{)=Am)TyqV#Jn=>LAG?xZt*;D^<!iX~L7&Zlpz6ZD@*e?@cs=~!%}
z*ADzQ@Y5cPjcV?HndQl+g0x<5h|*9!%|<al=3{7m>a!;H2*P0pkn?rY*3KS>=NOOi
z63(#%ZGZAyAD&(<*UY?8o$*NzZVb<YFx_q?BXM{DZ__>q`r+74I5bm5!SIdjroAnk
zzK_H1jqTQk`Rhe`GldmrsysXTX1Cl849xEtkT5}ZKLQigA!%-iLA-P2VJWwkSJu4%
z@8Pc#xuCSB?NQdt8_QjbMd(9I<7kVq*29#1sO#yrHe?}F*w-@(l`P{GysB7MRVh`r
zH`EBDO!VlJ=|>X=o(EWm*oSOrFi;n}eG^@U^l6$JO&StVvYVYcTCz)|`>?4U8Wo&7
zAfao-N_(w*YRw5m=W0?z-rs)O<7+ph&4uyDdKudJy&6ao$9PUy>!+Q2&7esgxBpyq
zEXdjK4vOVNDyIg+U3}1HsgU#85KF~K;b^Q-zf}8y))(m~4i_h*n9REZ2m-xZnJq51
zS8l<_%x)I}OPA6)B4zS_ck_!RSC-J&sLR>emBX$EcQ^Bm=wB!&4_-b<t#<X2l&nm_
zXEdtsLi0E&&pEk}TndRpC{KXZM8&h}wa?RNmy^YY9e#JwK{`_1LTmC_AA*q2z%2<7
z%98%bcQvM$5kzPzRW0kDY!q?lKm1Vn{dkdOL(SX;B+ZB(T<EMGjHEp0het!%7^XMV
zCjLCJoj3299#RaRb2RR=N6!pecS}TO?2QkSbe??UK6U3$^cZ`G0a{@9O3jCn)R}&M
z)eu)M)r9+es9fIi%4@^FTTST&Y4~D}zhB``0BdqBRegASrq54%@mpUZHvt6j4y=5J
zHFkp`8c(_|>pxOvV|nlZ$$l64cP9OEpWzZ|#fl)M%wMp;nkgSyk>8Ip=bh_H*k`@h
z)6qVYOCzzjtMZ)F1lHev>1EknrQ{&UOszrSWJ`#UGwFErd#JELfXmnmWy*c>IP6ir
znKb#NhILQ!o$b|{XtXb5#Fs0cUz8~WIqm>pkjsK`%l;r6er(77aXz}}>eg*~SJs1E
z4T0|2PXX}5NPx1tg<Q6}#4)C+P_=V4EwRkth0?8LM_Y7%QCYpF5n^q<FPa%*Fj`_f
z-?uFKi<*Ow*m{U*){bBMgxnNmCb;A={=U$eJ)(70g;}-dGU>j-d1FrFbFLN{0p69t
z3#YTVtSm>@_H?j3lnA?|qPGg9m3T7^Pu?NfKRX68`R>1G@m?CQG8&nDTB&paS{K#w
zd+u;~8eo(RqP1!+$m+s0;JA(=`*=DG+~On<a~E-zLGZ`-GqLD+3!;*Q;_3iZTvbI4
zr)$VdFh~V`{LW;QNi&f0wB^q9BV}eoJ<kQhwC%6dXz#w_yHAS^+-$|pj%Loj`1Q^P
zr!4iD-EXCm81Br2`wbTds6|n!JG0i+#BNL!h4`QBQEhp@`J1)wN4q(gBY@mS#vFFR
z=euMhN^J{DCFror>U;XucD`N}hB+uGdb|kvUdtcV1ODo>^Fae&H$3~ucpOY~$>Kl^
zcG0J2B~PcMGeKT_S6ie2a!2wL{`+M*{yAP4z+gT%@9e}~(=J_gqdh2Q*pR%YEBmSa
z|FjVd)pp~?OXoCQ@Uh!UcX?ubi|wa!I@87sEl#%)@u39MWV9C8<44N!n7Stpr<!xj
zPP(?k!`$}r7)G#Rrxo0ozAP_fg;lOvU3NDF8G189X3W#Y@8zIEy8m;pS+E=ugq#!;
zcLJ7!T!66Wj_0YR;<nQjTUFTYfuIM^9|zSE?L6k*XP!{A)I{>LKwR>H<cwadJ3-%s
zryee<a#_u&bF|QlJ#X2<l^MUa3s4Wj+5=+S|L^Y4p+7qtLjCYOZ#Oz*K{PHQ?V-ir
z%8?RtGc;x*4-_FcuBb8?WZzIu^?c^agob2%IUi1E>Qhh|CTer(3ftEHE}iJ4TGhNC
zsOfD-poqqGNKCTkD3zpn2n!FM*k61WayapAYx4JTl}@Gdhh4Fo>Ea-+#xS?o<No2)
zL8*-wFl863RQm>yD-OdJQHtRocFXio(IUP{Y+)2h7Pk?rF916h>(7o+Dgs6!(zeP6
z$K7Y&Ext)tDm1%(r@BF0haW1CMZ1OE_BzrxGbMt<m!@t2)eLJ0>9svxSa&ZJc&1PE
zBPPSE$XvN3(LO(%-EC2$I2SKr52g{Rd%l@s)e&WS^KDs9pSl}@7bF={Hb@_fl{dzb
zJFh!eWizQH@WHB#+YT>udR%!@^-aa^HduzL4Bxe6+{yBy`teRP22332uOel^3zfF~
zZm*j%h1u^-UUy~nr9nN|Vn)dg=DycM^DuPaw8YQ`k5fhM7x{6MCDlMxrU#WlTmmK1
z%!?bU){WAf^~$`f`tf55imnbxa9swa9cca=%jM3KhYoo_#MvTV$x^%oXNw$LJXPP`
zlq~|8I_5>PWhuXPsz;6G;7&a8$&?2g>I<tDN<wN%+lcndFdTubhTO|LwQKqCg?Ks9
z4*&Lf&~ZTQ?|rb|x%2nQu!BKtX0?Z#MqkRQ!>8cMuNP2#`CvI*SIni27T>M!>wdsm
zE=cz<ZRV1E=TWJ~7-0>ijRC^A(Bcc^5$+@_joI-uD$Mdf!4St`$g15xc3S^R#4+RJ
z7OgUAM&lWLsxtRNznh!)Y)VIcYD@es?{2268HUEsyPX3-mNvnX)r@KhT@&z*i8E9U
z^AJ#8cNh50Slh!y(B@`O*}AF~Ws8)MQHmp49A8f?s&=eFYUg#{;6e60;JMb0<g&(k
zY~WX*GiWxnUzOLGavI3&6MA8BrtOmGy@8Kd5yzOub}JTQ8YfV8!{v3;ernbbM@jLL
zJD>-`AuQdBXT>z`hxWD-h9PUOHe?!@yn%I7Se5h4aH+d&k$w>moyp6vf6lXuwzd+%
z3;bG9mq<FLIpnjKee{s=led}>2jn(9?dw54VhSy9#9~a$`>0t&2bp@=Sdqw;Z~>Y4
z#1h8(9m!wP%)tvZ!he*k|1HDEbhWL|UJHvR+z}lqfg({m7-0U*3FP0A=>RLzd~cDN
z`r!)G2DY-lW}?{lP-=HzPSCN<k{|}4Gijn7XD_PBeah~1I>CKF{t?_szFFC0N=7i|
z*wwJgr*yag-GNqD?%op>NANTN10}08Ix~OG()w*#?`p71KP7%z7ZqF1+y_N3o7DU0
zss}He98$##^^3RHrLqK0a|axHCQi8&v9+frQIe;+6CD#{$INH$@#yjQ4R*e0AXRuD
zK^x%f6z{F{86NjDz9AB|p&|&zN)SoET$hboIrV(zP1yyoiE|`+tckW0=MCA>a@hae
z6+iNUOH_r4|F6ZTr6#@yTX`%mu%mo^D)sw|nbJzdnV6)vhb}pOy=m}4&yboj-OAu+
zMX6}RSntp;Onj}W4Uw)HzDsU(zvsHG&rYacik=ap8Rglh;-UM@{SRiY7%m-s%LQTF
zs*Uv;=ozre7}Lvu2GL9c#GllXE}-b^qaP8ZX1!}l`xAi=S+6#8e`<xwuCGqK_sXZm
z%~Dfj`hmgeHhG*DTvXFY*cI<`xYkA~X!lY8iqWicn9we*J0ycRu9>%~fI|h^m!#A5
zGACG-qe(E!iUFLaFZ+21qg25=#uO`+h=wr^HXe8R0c(Qyi<gD+-$pHb1<L-kSG#2k
ztG0UGK^m;;2HRqO86vQ+QrjyRp62#wySFZmb%A6EuA>b^=KA>7TafZ~;j6vQ!ix3t
zBT6H)`du1L>DQ)&(W$f?Xr`w3=)o{+1~B&%UoN{+<<jUi)kfp{^uUD0&4P%3pU-?n
zKqr>^9W2sWuWSbPb^J1l;y0~nIhdc~#Ti1rXQQ8VFD&t4rzVnRPns`$j`Um-s06VG
zT+y;yDy8jUrO{^-1oVX07q4ykmsr<$Gdss8LXB`2bKDoB5-PGQAwN-la#PSA+yhy=
zG=s#0Zo3UnEyzr_tLjh4_v4HUQ(z#QBR$5)dM=Ed5Al=S%TpkWOz<J;toHDCp0YqK
zaA$*S?uEtm%090((!jHM=)v4h|BJ=OaO<K=A0otBjY|)9xaJK<%tFo##me?*3tVLF
z`ZGaq8*d~zC8(GOH7eA5yRtL%_yhaI4^YMJ>Aq(>j{f-?dm50iLS4sh;K#;sSM4?@
z@j!`cavYrV-QGZ$PdNo=7J%KKd^AdyC<cG4(LR{EE$Pz*7!+YquUt^zSi2ZZUP(?E
zS|rAsd)m$Xu!$XsE+YnF*X|5*Hh6WUM$>dwR#R}Cjm;4`58o~*BiSJ<SJJ3^Lg^-3
zlvzHOHf(1m@g-`)r0ixYQs_-LbOz~oCSwY|U*b|0jxh&DlTN<Ne75lbVQ^;%z=1?{
zcS5?gJD3aBOVh~`CqpJ2%Np;GnRqlFFHfdTpFK-`9Q0x>S|g2u191&p#{c(yFQBs<
z%Pm5&YDE__MFN+WANJQRmH#4SY6o6ueorNO{uP%E`8l$^L%ghw*%Hr;w!+$|{hZ6;
zCOe^fT|#I2z<~2OcwujC=FXL+nPswO(!I+o_+PM-L$A*Q97L}NLJYt%u7jJZ-1)2G
zD=i@}`qr(9+yimjc_!ZnqjK9@^EMwu&kcXsi%G4*3}jYOeMMXn46?<_dPSV>o%*7c
zKm83;8~pqT9;M+h;=rn$$c?o@(FA(^Ec1y6T{J|hT5KYPv$oy1y@2vowL*^%iT|85
z^)~o^4ln)O=7j{Tk$^mjp}tmoTO}P0_Qs~h_x0b{F-4=x_=ofFy6U|g8^WzpaT5Wr
z(qXu_nr4)j$FhEwF9dPZyK>#ekVQz|*Z6hea<}iY=>l_Unr}+6Ky2e<<!#Bmk3#8>
z4$)8AJq>cQ6(;e(<f74tcuEW;J&xSoMu|%R<$i)o(S6D_Td}XBRH8TeQ?0sMOE`aT
z-6}9fgk6`ddIJlKmhx-vNo6uWc_SO+zf#_$Dfj!%`|BS2Mg0?#pF#s}BFJ~5x{iSD
z-3PKP!h;zWQJR17=HQ0QJ`nA%N8@!nu!=<;so({SpaBFuFuRqtd(wyh;+58hv*X1`
z-RPGv_uIR@z`vF@@@Q??;kq`<MyW8ZQFD=V^7i3WkX#TdY`DO-9yuI^OH7edqx6$K
zTHjH()vQKS9SZ9-pPE|lENQp|!c`VM0)7Uk5Y@Q;B$9`TQQsFe7<#hz+F%>H_rL)I
z++kia#7@oIl|M0)+#jGypQ^%HLfPvgJ-zWC+R+WvGF5*s^`-sld#?eujz3~%l|(tV
zjI!!euf^>V9JkBax{f_c6p4O={H_in)Bkp<JD`FN0%9jOh@A0Q-jR$2`~QnZ_8zQA
z1$f;#%!nwvARc$aJ<GmqR>P>d(0O$35{E1?zjYzB6Xzm)b)Y8bCEY1x3*43CMw-)t
z+=dT)x~rc_75Qn2)BNcPE7C!^G;$V%OLoR(ZdSIn_{}}_D#{-qxO$b;u$@)~7gQ6W
zcXOulWz95fW@zAw)+kc!1UD!d_4Iv0+=twfM<on<>~p62801gib~-=HJ3PA+d(5cP
zak4Miqk1|s6P{?9{j6hW$;76^HEgfkv$4892c5ESOnp$(4u1BVv?|QsXdWuC9yH&M
z=fdz2jV8lsccbexiu&9~bjRv^Yg_`1>j_TFeIUie5KucPpfdSGxN|6j`~alO=V0vQ
zfcp+(+81*@eJCTm_IrfISgG^=k3^=y4jZ<ZY1PgD%liCcmZgRN2D;Zy`US@y^I#7A
zQ8GXQVPtB3r0fwUcEBS{1Q=GqowotmDRMSpo5|A%qw?l4^HhAW@wR^^OA^5Z)^j3a
zaOtb;cE>tv+q=l3PHNe8Pv{~(M?1s;Y=0k2+&dFonE!p^vd&TXnBRAhm>7)MJOR(H
zxb00x)&n%>RkY}}{*Aa@WUeDZ^kF0$rf6BNz^CtGF!GpqJW}r8-=1=9CM%7u836l}
zG-j>IsXQCapYMh+Z3k{%;EY`%)9sK=H^m)KHh9~A^IKnc#{&^Q*!$=e0Rd+p8D6#7
z?SIEV2zI?=IhelpJ8-aJlQas~IBk(fO0A<9RhnGTLDnNb2+HePjQ&^%N7}y-e*z3$
zbAi*jMTNCamxzp9yL;7@y~(b9kL+R7){^58!ra?JwQ2)Q>UW9OM8<6w7e}^F59l%y
z2Cc}*OQPy~SX5*z7tRe@gMq#i-6vc4IY^OZ!vfzcW}XE23-wdKo2fZ9lQ+Dl7d9+Z
z#WsVIfQ#D=0yGI`K^zOLNIichf+4>XSWQqia60e)F^Wo{57<o5H^1DIedXjE|0nu0
z(@$`#DgdY|D?pf5K0n&o$1O>c_@oFb*X_vDX1W|1OhRjUaP?MbaEHGw<Mi1sWY6v~
zBUztVc6CvRY|eHaCdlcJ0YvjFMCo|5CgkAv&*5yDt%dA9mXhU2F(zk8BL*=}$g87n
z0a<9*jt?RG06Xl$t9yUUQ>;WAd(+l}0~+jVc`&4m)>J))PaS-%ul!HH{{Xftf9W7x
zSE%jo<9Ovxlntw->(Jpx;LVG)&MrOr)eavj*A{WDk<#D-BpO3J#g3=E6UYgAOgkXi
zE^o8hQ{J~AoPVsVlbQAH-Qkfmuj!wY!e3vmIr<$W><PZG%QUD|Ygjb8pP}2xl^J>%
z_N<0wHv@vAU@bqoSg2RPSM4bBmlRC^VlRO{=eTY;BbJ=Sh<;FWv{@biRP2)3gfc?E
z<B^r~``d|eTR3MNx|^MhzM_2;J506Lu64_WuJy#Q@R>cmh^6XJ51#?ez_Syv)rlen
z^^K+V{nMKJz+Kk52l;mHuIh=<g2w(=DUE~!gm&$IsqT}wCV%l?ziHv9!4I_#A}*Ju
zM3^4goi?l|QA2t}gsE5VsGI-vQKlX1YFZO<bvKXt2~c$D^C#zv&XXUqbYwO}hKM%q
ze*gxXKY9V0@n`@2?@rDd<9<G<|7@SslVen0%;mv(zvjoSAC{5qy_0)aa4CEQGz*3&
ztJhYxtZ|9Vwu%>0*6f%zZOG%W7}v|#pGW2!%_xL!c=6lzg(=$mcPQ_m(w!|%;t{^+
z{4B^=D_X%Dq#eueVFsI=<h1gl8W-Zi%gWQlkKAl~6sz7%9^34z62alHoB0M?B&#D<
zS;#3{b@sTh+=pQr6=ZP&X1}vm!}iZ1Q|tyhy9Ju>O<El7qWa>5`otlYjiOmD?zS3(
zbj^cLXD|v2#g%=%v5TP8Z=Nt4?X2rajJAGl0sCE|dG{vhEox>Aitje!ff)!83vWqv
z^PBySK|v4%hrPy5WgE}Gos&UC*<*?Jh>r&AF$!qj`X-Mtz3pG`@pawqY03ZI_Tn|V
zTXUf!RA|NMg7Y$>d}f0BiDexbi0&UU>?EC;=JTZT{15P-*6-06>G>&t-y>X=0ZF{R
zPJ0S-Oeftlb`Zq5N3J3G>ZQA-WU_I@`S?aCg2r69x`8YXOHnI1^cs;3J#%XkrF70!
zXW}_5mBK7ga}cwD8yXiWQ-pYsW;RFOLf;LL>ojd-RJU#n8a|!R6<GkLRq_1rN=B7y
zD$IB|t1QuW%1+uzU#BMBQR!s`ob2KvY8LNCtJHxlYfiQDT7CMydzgENJ+b-h8*)39
zTL}2L*yaTqWzscLc31a(B2MvB&&u@l9a6Pl96t`4cRVOMAG4eu(DW?-Wt_y=-!3)B
zo<4>BO(KrM9b1eo=(?1F!M<EgMlOa2t6ByAr399=KcaONImVc=d^3U1J$uVXJN>fO
zgL8F6>f%Y!=RWMcSWKVTS29oPW3$lu_#pin*D+J#sAsE*)vXd*vFkK8-@ze`zZgf?
z41R@Rfq_Uu=wIOXM;fdsW$wrtlejEuFHw+vr_`)bHBf{}*qo4=wm>8#MT{0PWs5pI
zMY|*}_bU#MaA299X9#?t1e=&W36X&cLa*wXOx`i6D7P|6+r+Go#|kwS5n;$88wIEi
zlLmA?SAT&|s3okadx!uw4Ssy-SlGYAw<7PAv@nE;T5DzDnaPf^Y;56v$mxy^xLaL*
z*8+mcuRG5>%$$+K6J&H8%B!2Ohv2{M{({~{lDm)ychq?c9s-ba;e>!tt#e=Owa{Ny
z-I}|L-jjUjX<$BKF`0BR=S2f-2U`0g8ssLYS$}&yvE4U{SpQrr8-AUi%?m3Ui!DRm
zb&#&BNlR|F&@;J^2L_=)2nC0j=yFPu5U{&?nScwjs5?*=MZpQ0RYKBuljnZ36(Cgx
zg2wpGQF0)T2F}Lw(wGOT$vc7D8^{$dyE@3)bw=_|X-h8(>^A?4-|vxFX$(|1f1PGg
z$+uk$nqW<?j6Ziy68>0G{#kyu|5yPOrp~p_a>qnWwXH+<J+qMsr&fb8i0~+fnQc8g
zMlzm2XaMyk@=g+;?>ObNF{RKwhG*V2o6-B$Aw8Ek2;G9<2y;<h4wf^@+VVY@%{V?0
zYm~7uS=}w&2yX1vPEt$B^IyQq(y1kTb`LvR;zsyHYh);6-PI6kX6mK*bHXE6abc(b
z&vIOQY?SvJJ!LSxgqlr}34kc4gJ6aYp+q@%bl{J7bT7aTI_TXBt~28oNaq3)O=}in
zL&<y&|Mp71<Y(sSx4NH8le;rJf3_iIkkq{Oj{ZQDrzX}_q#5zh!-c)|BM-C~_~L4a
zdBllE3@$Gi=saQdMRD@=s?<(2liT#AE(j|P2WY~jv{aL1zE3oYb)?H}8?<%;3g#BY
z&#6#>$)+99o>@-x2xZpI-YreQ@@dhI_p5*F--Zn@%&Jfw75w*Nj^EOaDf!c_C^7J!
zf`MJa>t=Uiv3m%IbIidbIx{6!Un<j^U=8|A>NyZznEPu#C&}z?D>WZY{ZzTFHdDjj
znbFlILD-Vs&y+tKfi3ebK_3%E3o9rsY3&H<g~{QpQ~1->nhu)lB0fm3DNY)uR(n`}
zanp}!_os-lsFbRZT%V^}C{eWwD~*pCiyX=Qj&R6KXvGeC0O`u*d$b|OmYBC)Co|Xb
z2U*f4t-={V^hRYTgFOtC?`%aZ7+{83qM1cTq}PB87AK#vnCJ35d~;0Aj<rta{rkJF
z0g*whU&@^utUaahkACd8|8XN?4nCGKC-gJ?^4w3KdboEm;{EkY2&J%VN~Klq^!_jN
z%zsAq-Ao>0%D_v~E@oX#hvEEXQie&<zfLPr!9oyk2V5J(cZ|h<^N#!HOBTGwHR)0Z
z!&VYxqJxJdC1T~BN2gu<SB@h7DP4jIt+s6Jhy4(Y2T{y*IrmjfWd75-M4b#ja`)|w
z67O4+J%4!@!+Q?mYiI^6wiT$jIir)kpJPPrQpJj9UP{dGR-$`roR1VIYh2g*rovt{
z!ca2@?^(>+h9A<oX9jOP+#{YJU;O$kfqC>$qiCdu{tCOLt(U?{>0sf9fc;M9>uO1k
zOh4ecGKX|K^lAX=FbR`$xAMU9CFE%TSSo#5)pkIf38yEjs?(r9JI-rHQ`fU*$hkZ7
znitsw?EJm_Gc-vQ7bQ(g8V7rj{C}xK-jywY$E@Dk&y6#DquXak7F4blu186ttnCK1
z;jF6g2+}$K!dzyp9=WU;4=`hFZzA44;7*qO0>+HS%af6*m$i)h9=HpP{5wtKT#(6w
z>|Sru19P{2r7RIDG$<MMJ<Qavs<=D?w58zJ9J6=}_stm0c2|+WqjXEaQ=?&g+hZpo
z4b|MI5CP%QIXjkjIABq&lUc`0X)aKuA6uerHE{2Ran`QaS#s_HgAZT6bOjUA)1S~p
zM3ZnAzafxw(BF?qvYlwX!Xlha!#w-pjaT}o$Z|S#wl4v??NEjWY`Qs@q^UQAyG8p;
zrbT@vpVIzAkw7+SHTP`;^F8EFod)T}I65GE(J7s3TOf|JRh5=OzRko`1o8YN4+@e_
zk9Zqt5{iXKtQaN#!6+Jlr~|ZDSxVMn9t*=8-yG~9zAIle0eSo-LfU(v5@AZWOMg=(
z5KvImiW1?|8hX<HnLTx|LfXx2c-_>O>{&4UvV(!^#xF4S$MKc>uV!mbeJX1{P*qJ7
z=bd}WurQWwiwr%t8Tywt2vGgG)H{ik7%ldF+NO2;SDz!hGM|U@&?}dXzeMcb+-7pt
zKO4X9s?2gqw$hvu%fzL@%-7$%SzM`Bg0w@`SDN^BChTAB^PQe3)>O3Ge<m}A<oXT{
z9jsU1w|u$e@kKo)TM?qi|MZKBBDw%)(>ZkT)#*UG4(GPp!Tq_vUvv*Uqbur)d0{($
z+OXQDI#l(T2Z{uEe?nO^=2zblmma^lb6<df?bf`O6dNixddIf&p%&;v*FYa?ak<uk
z-PwDBqCtgm*&r@%Wu5})N?lo9H^-o2uCEZp5NSzz*{}BBB>1yo9d>8K{FQGJTFU_;
z^NY!Uv^tXQXn;R(-5P{lBjzv+mzYa@{vnP(v_l2JsADU8LTg1^jkFkD>k>cM>cS|)
z3Nux_kK|!ZM0JKA#rXM<>OkF@0N*M5)f)|tl7w{|$%7uX?WoJ8UagZ4)5UVu(8d*(
z?^CIiaB;*8trCHOolpedTNk0MGZl%AVIi-f$CJL8f#)aFQJ{58n$&ys3WikOcC73G
z@(>}WEK%>}Y$DuHs=!)TQSb*9Hfq-$V(~hh=f8KrNUf0}Xp{ji#qlBlh$_@|fUu)3
zZkQ*n200mD%G)80D<T0#{QvW+-n&KepKHE!3ZOuQo?cQtedoijOnIH@JP)t^;%Uoi
zHk;(_@S3yolZBcFfKbA<sYQ}ob4!e85^=fmmVr+J4@6JTK7=l9v^2n|EmfPd@qChK
zjM5IM$eceF$(EJf93i-vTvB<3@#2_qX$dSaG6LN3%#$7vaErM7g~^tBZ?vi#9#4T1
zT7R=uiN@ayu-9%}(s0{oX8|uZt8p^T%|OA-k)9R%Y6nqILZ0*rn5s+z4;F2q^t50*
zvZYwqGxWxwd43+5Ocr`6985Rd`%Cpyi9VsojP4`f%ao`N_udgPaqRA*bArQ}I=OXI
ztEb%bIO@Dxh?4GNJ4+Bn7eg&CXf#4=_m(9m>o^1Go;5D@KCM<Q34N9Bf}X0)ehgmB
zCtE<J#$oWMI;mK|g5f>%2|wk`Ap5+w*ms{Bf(^{@vU#*RWt$ISas9Dg4xal@&=-#=
z#~Zpy@A*MUcB6{HZw_{as3+pMGA@_2#CLXS7&lZ`b{qK1<Fqr43FgGCU<eEL4Ot8?
zSPjww{=I$Sj;qI}S&4bz%QHgRsZf#rZ21DkusA`FLpG>x!ydDTjer;6GtdkgRomYK
zVzpIVzvge{JH|l81Bm!zrJ_u)zu@XH()Yj*?3LVY5^!yu!K2Sw1ch3(uM9>>J00#%
zmE{!BKjJYO!oP}T=R_LL+4F9=ETjztM}Ji(?-zY^MP1-&ZRm96Y+#!1Qg0?VwNx^C
zwE+2DOrEul`i&u&W}Hb5e49q8a4v#OB6N_2C(G!`K9;5=U|)PUx-?Lw$|^9RsRj-Q
z31#7eFAQe<&22#~HgLs<Lf>Fch%4AdoffjVDb0^sKoqq)nv;3k^NBX$&HLz%xIF=B
zpe2%Y+tVF;40KB9^?w$_=3zK>TIfHIsq`4}URHUMC9O}qb_9?*u^xbAS=||ec@Ub<
zeGFcr0jd1E?~&cqE3m@$Je>34)gS+J(YM@Z)$}gsL^=~MX7dLS=TjnPqtI^S?Nyoy
z29Gj(vE%YI{1m>)O^H#TJ!pGWXr*3sBeeq%)DJ5cleuD~$it98QK#_hOj*ifl*4zo
zg4~n?uL!)zHL^3-KS;UuU#cLDb99Y2GF;J^+;m6fCRqcZ>jmIPb`oP<uV_3nd9HIO
z54^o)H^IjLKcIFC?uOlyGfh;trwD<gEsF8JV<xN(Ow=Yeelyqse%KrQA2_043fDWQ
z>6jh!T%kQJDfXzg+w;0RQ>0Yv>MMZve(dx>E5YjV(Xyv<AO-6eY30JQ0l+!ywOk)H
z?7xCoJn0Xeb$3;ECXHKO<}c?1-?>7Tet+=Ot@L$OUumT$7i%bm5z7`kcJxKo&JCTA
zwFol1v3xH8ti9ZZDPxB&ZjmVxui_O@Ko?VFl$sO{oL1+CJ(Ga&5ZODPtEtlUk;vDV
zhz@7L$5P!<OhTqzOs1IX0;7|619bV5*xifE=Icu%m>Oq8EdO6A`Tok31;%+{NKvDZ
z)$@kA<m;%@)$_&#Jbq*f{kTIBG@diUH&P*n1#qkA1{pH*>#OfspsGKVCYnVkIH=Ft
zJOodv+CRm56Wo7`Q^Iq8f4ZA)x(3<yqrCqf7uZ$>`|_gmX`kN|g`jYy>mxw(JA;OK
zk5*Y=R1q>u3HoE*vv&g0r9tV3SOa~39Oo>hXT`UXa5@<~l4n#eqYg&&%_W;#cic%P
z?`bhE+iydAKEZF>+bWBem^W*_i(YrNWtXYO7<C7vnFU%m{zZSN<!hhxHsI#{XB|#Q
z`BU;U*fcR!y)&2KiE0;XB3Z7XW-F&Ry=&PIrVhU0bHP5O;8<6~?trI2R16D6(2MX{
z4)eJ(j`;Mors*qFr3vvsR+bC$nBzNj+I=c(QKwY<?^0PiDLD-U5ev?<Ct%T5f%_qr
zYc64l|J)Y}4(x%^%-dDSL!h#|z5cbqpYv;JThQ@w6Z<Yc8Z68Ad`M2^+@%$QY+v>t
z6E3BQ+rOCR3R;M@w*I_Yg~<i7yx6zlY*wGvCGocZU{!m^*8rKlct6BU8DP(#?7#)Z
zZ|T&p=U<{pdw{l=gIMDI1jqWRgOCE9JzTH!d7%mmOr!g3Fu6qd+{p<(h#=~?|AI)z
zZa_lwcv8<DnsLTpat+8A0qXl<@fZjalG9%vhY14msJ<<HwG-;8qSXX+k{zpg@WrLQ
z{e`P)tiF+Jdu&RH6j#_bn>+!5WYLC5&iU^WIle)1LsPty)L-jmKl`NJgVR?lAOniX
zr1wHp(=vz)I{ds2AmVk_ZLUneX8`$dtmIhm02(48_SpV}xmLCMBb4@EV9;h@D4w^8
zc+O_TS{J2Pls!7RTTGvD>`rS})+sAlI@2pVwD9v%<zk1RHQae)<#}JkLAPGlsy}a}
z+q(Ckd(|N6;XX4PknFlt@oJBG;Rp3<nvkuX*^%mgp8YN#rL89o25I_2;-DZ+>y3i)
zVNF3SJvRYpF+FXnZ#$3u>Km|74JubZih@eO4JQK@_W?tT+V6apfVZut`3l+0%4rq*
z^^L1<0s5FC5Hn*tk*i_UsUfE4{^@h%huMHjh3sv5MX}PKlaL`XVcUz*(JLKx^SP9Q
zFQ1gPOk<$Jr`uvLFU))g4_I%F=hl7Nj>^o+R!1AsG@#5z(N8GRN&OzUoC0xuSE+dh
zenB}z7Sy$Se=z0u`-w@!2&~<WvAagzwr|ce_T;nwCEQr4XLssmWmC)KY{wadmRose
zLoBzTY*)&xy0(Z8M;(xG2bWWW6U1!jA%V%oB75|rkBTzIE536JdUlAX>Hed?`YF2>
zjl4j_ls7ImeDgXz9LSPOlBi5nsjzH?WB1Q)f^~UnVbu6^HDbQZH0bdWRj*=Z^hu{I
zo9{qq*#3CEbCtIHiS^u%=xG5!xZPqAe2FpNUlL8NBOEOr!Dk-NbBau#<N_%9pO^BL
zR+fEyVlF>BM8ya)GTbL3a`9pubalGjx26hNV0=b(u$Yv&0ivs#`5f7l*b(FgfKE#=
zT>yP{)>GVJ%vZLN>HQkAhK#bPLo1g(e>#qU>^nmzOw|+<y({N#Y$i$^1T-;ASbn{J
z0$spBdtSXfJd(Y)w=!zp2f>54y+ji6!8<T%=DMq?#{C(ZCBo!50C}!)&7PF3Go6Tl
zq2)qub-ZX=mGs{;#q0G`fI{CzB<>euYBp%;EhVWgtDc^Rh}<#_8S+ruN_4Dmej!`5
z_K;Y!5&I#2Q5>M=Ye`Pe2pIX#PHDQXdC5s8?r%NUV$jUbqwJNdyHHW8<a8AmuAV`A
z<B0=%Fdd%d_~*>SW(51-aRUt1x388c)g$qqTGr28DXNQVc0V&2`h@$evR1Y%sL2K1
z#@QhQd0-a3^F7@0WFp-+$h5r47DaHb1MZbS-V*P|ZBs9o@y*c3-FlRZ-Av|+9jl=X
zMCv1~aZf)N+-H=5*j%7Ah~JXsKjW(5P0<fAL9(QA%2x$L{`dY%vF;uG_6iQl<F<=1
zP4kXyjk<27RSJ@BbM;3haCQQR#+81(#_qx^JUUDFgx0z}#WG!3_{7n;nX>|c^B^uq
zWuoas=j^_%8KZ+%`U7QECcR11GWH1&!)mb0a4q&TP-&^Gtl21IN8WLH`~3^%;JE*X
zRbrf%l%%um&G8xT+ml++fz~i+=_NAMoO`dBq#b*`LD%obU*WI)S(->M#MK1^3GT}q
zZ$ufIVf%uE?&G;WN}D6j?m(s?b(+-i+^aY>iCD$#F`>4G==V`J7MYaLWT+4TG<pUH
z2Z6$i9}d~`-V!$7N!&yGLbU6Le|`SODNp%3SId<3{mGHk@t8U1Y@28Cub{yFXx4JO
zEfd2ELF9Bzd)PibUrd9}`waKayZVx8u*|R!1{-j|(@60G=%#*fgYeuHNFrj(a@?Z?
zY8=2Xy%1yB#};7LP~>Y$w3BZ%OkX7$6V!PmBIWtFME?#0+%)omWw)u$3<U2!lzEOi
zl_N%~y~GkMSwHU#d@_aBt<OY>cnMK{AGL7O5KTt<cKc~c?|=b_GlVR{J2STWmswsP
zUwXr#{>c4mqCYv#-@w-8G-?ryn|G+CYQLj3xyUGQ^AT15NT=QLZ$uF?knLCDe7Aoh
zbASeXdeQJgeK$7Oio^B3(XK@vii1*xz<Fl3bh<s7Ha26^H6@N&Qv3g^l2_)l$2<Iq
zIP}-)*0h;%j+3va1>Jk(adg}!iZ*F|^2DS{t{{UnZDi%Yyu~TQRdil<!`?n4&fkT0
zaP5(>#mZ$Jyc6oW5Zgg~uGL-FA$Rd2{7VAF4m*m-f%SW1ct4>qS(+rB3MmGFcXa8R
z%EC@{vk>xM;yYX4Ge`uZpicxh%N2=kM9_XgmHiY4TQq!7u2l;W;AHD@5&<Nd33v(*
zX<s4<rHd3~g`m|Ee{;2HVTGrlwcXr~uK{gX-j9GmDB=v0rQ?2=-<i+(`)xej<17dU
zCGj5f;W~E=R~|Has#slpUBkGV%Au!9sHe)vXoTMJl2zU%RbF{s`4{rnjEf(MIM6vb
za_gu&8kKyryP<m|m^&P&ddne2;w(Pn2o7t4;i1j7Y%?c;%f3>!Gl5)vP~6e!8J@BI
zgC96a9c7vko@!o?NPtC+H$C@t@oGP98nZmp3@j22|Ah5CP~@5?FM79h>1y&BDO<)J
zhShs>3^x543EndvNU8lAZMK6joqkoGGT~xx_U!$cN*v?XP<UBU!i|Ph5lqcasWIV0
z>@7*pRnNW&x{)S%#*<OpGqiEtbJVfx4;cudt0*!pjBN8Wd+GP*OFc<LF0fsWcXVRY
z#l^qF&vp~4@CX=#SREE;p7XdplFz${G5U5z(By9(Y4{Zr7&^l98==2sDt9nKaa-xW
zN8)3Sv+&;h6Dp0f+Fwc{1uKJ2>)P3lEQ(v%E^}|<hb)8a-FQWd1E26ArZ4-J>$t^0
zaJAAJ5^nwv)1nd6mQ%ZBklo{#w_&?0o@Xb`1<th6Q1#BZk#NjC%SR$ARX*Q-*8k2F
zB9WyerMSu}_v+kv65<~o;7JQR1GMFY0_SK}q0LCy=Fogasl)vFwYYt@eE!$iE(KB#
zb;w>r{miS9%Sv5GiFxe4t_z{szFOt6!a|k{QHJM7G9A+t&-;?PD#mF(Y&hOlGknz2
zM@j4S!TAv4lAyxeE_sJX?$C2I8|EcGn-#m-$;DE{m#AWv{XqUzi$B}d8y{k0&|@#Z
z5p0J27Nhi@<iSPnUfvvXoR|sQep31*Vo~;Ff{*+4{)czcq7y!q*QIy)%UejQ(NP^F
zWGuWF|2o|`G*_XyYWA15rcZZ?tfm-x_lFT)OxynU<0LgciK=nllV8;ROE<n%UvyTl
zidSKNFX27?vB4HS7bDQH>7Q}?Sq~#E>wqZ<{4kL+fubpjb=@-5^@rVKNrvM{*9n0D
zxB05EjtdS6u@&gLWq5|m@s?LB|AF|mq3lx5INGvgH@EuZ4_C0GK@wOuZ+s(FF&_;0
zBUHXx57{QzG++_ab7}U!y^+JC&G5ao+KtU#Ki%<BQ9HrG`?1IKEXJa6x5HgCn9SBs
ztJRi4c5I>=N7?)Xg;#R#NtZZ7%O(nr(p1b&8qd0lWpmu-+rFs8@V@iWih|g<k7B<G
zwtjww`}V1(yj9UWY+=f&F#vtkBtAScW|G0*u!3wYX6|&n#z}E?<xR`73<0qk`oqsM
zbPjrqCQPUBH?F@HKKPB=7JRkBwC<R8>|rE()N9U9Tf0V{loKwndg*tRl6t>P<+8C@
z)QzxJv1uRYzyg||gpB~DJc=%!cQ!LMz=Yr#rbQ|CDs8*u5hQQP`Y(LLj^+msCefww
z`Y&x1PSbA7eBlbq^8uARCpz9u;!ufCU&mL#cv-@e>9azhesTV_a?Z-n>|5VgVg{8*
zMCuu4cJX7-05{V%@PX!ER;2%aBk3f+G<^;bAUYX7BZW80PfC3QrbWj3I!5z&XAiK|
zZ3Xk<6=->Kys7jH8S@P^FGKSbbQnj8aIPvZbC12FAd@a8X+#QZhsbv2xHfJqNl|%i
zRF8F^>M<Gf%tv|L4qP~2eb}$G%qtMDVmA6f<5dfcZ=e&8br4kh8FX6+H_#x(hB;t#
z*=%hvsXLCuteo7U6o7xc``4rXIGQq=ha7`fUYaWebvrCsGd(vSbCEtzvZI-mioafQ
z5rOg6sV88N+qJ=V7QRDURw$|;(2~1hboz9ZJhFSkw5?8)PL+Hp7v%2n<5rmK+!uC7
z%3H0_`PytP6`s=Hos%*p3<LSjyGdch?uO6|DB8cFFxI&prrAoZchW=4`rz!c;!|kd
z>3vHtkU>OlNdBZdSHN|*dbfj}da=1e>@3OotNTdwh|3r4Z1=$nKEt**egIiZLR%z@
zj$=7{7eyPh1UFy(ie)ROFFE_*po;GbXmiz{azk@!afd}i8e(VnZcx5gdP=|{H+1v^
zVLQ#}m;|oOr%hjm3yXa!)&u#I1FiLJ1oMJ(#~=DZGXuXtx4(wX$&Iu<v+~`;8&)`b
z@y0gX9}*IXZD?oHHNGCMt9?Ktuez08Dg~0qPYUV9Ms8efIz2pFI*Z9m7r%3+Vr&_9
z7j>{~Y9{l{Z*`Gwhgm=-@#IwmovQW|eJ76ChL{JO|G$UHy=pmTf1+8)Q+ogPmSt$y
z&+V%vxQ&wyQ=MZaUg{ZX!q@A;ekV*d(|+^yrd=iH+dk0io28Sp-ehF*9~j>~=y!e6
zQzPv%e576kKT_p5o36*^u~TI}frj2wpK>NRV-t0+APNbv$tqrXyNMgy0iW;Gx<-zF
zs%dT;bGQy_%ZG)uw08ZSQCXPmS*sSngf*OeZj30ljo*u7w(ZY=Cn*HZUf2s#cBwyj
zzY1Aa$9fez;DuYswg~sa&lj7j^=~6|NOO{Chr+!|+7_FABaIMz`;jk>R+r5UlRR1E
z*Ovnb5tg)8B&78!SvoUc<*zk*JhFbi2a&x0Om;K);@W*0t0N@-K=<Z=peU!~kD0R*
z+1wB+@z0_x!G5u%W=y%Zk%5019{=zP&xUU2Unv~zpME(nG67ldsdt`Au?Ic+C<*q2
zH%fnFQ519^0nZ5VW*P_osC?7fUveatfIch41<-Y}PmI|)19tOoD~5`(sOp2{-)o#R
zDllAy7W!*4H@WXme}B}?9}xVp`Qegx+LG5|>sJaY2|~IWwu#Qll!K-XYO_0Juxntp
zPCHXW&RnH$DnQv<Z!_O?tutGj(9K_0iaY%Ayd7SX??|c|z0muHk4w(N<ziHtkE)S%
z!pLDYOt_wAF)w!5l)13+YFqv9z$n3$)|<w~V-WtXdx384{ax?#HT1i^tR6L>X8f=l
z^;s<j%=pEJ?;{IEEa|%EV5i^l=B5Nf&g2ixkCg2*Ioo2;bgQMFl+|7YMm?PWtDWhS
z7q`W_qM-eLl_@)j`-!`M?aU#YmYs6JTRC8CQN;It`SE<?n6UXZd}Dy}Mr=mFe#$#W
zxL;Qtx1`klcMkKPTep?wy}KXHnKqb>zEt+T*EC-=L!kNDG;<33DAt=7o`qlguy)$&
z7QUe=vG>OFC}>)*hk=$=Zr1dQ=k`(kB!#DmNu~R|xh<R`qR5l&>J*EVWO(;)WJYa-
zG7C(c$zLVFS2eH8VM&+i`E*k7x!?l@)-K_^%%DeQ4Y^IFxQw&Ie&IWg<DVs;S@l{5
zeB}O#bd6mX^E)8GIB1oqR|d~{daVq@_@bu5Tu0Udbgfn-O=YyBa_%`DGRhjP+p2?V
z5_qs4pQ#yN*%#7{@9-{_v}|JAFOpJZSIpCbG?&T`-Xjm#sMg={Da#k)q26MYzE)7Q
z_!C|T3m3%Tt%Gd4nAqu-U2h_2BoHuvM;}vLy^W7I^l2OCrCb~L^z`(OpFWexrM9I^
zeOAUU=^55XQK-;BDDnyqNYFYyrju3Uf=d<n<@*Yr#YX!J%l20q&IjY$Sz{Z%G|j%g
zl3UqV%gR?hJd~5u$dz^@rZsUSG4MlUkb8HeAvTh0xl)<=;lmQ7X7%@`ad*wuK4ZhX
zk7FD7LFZ|^{?E+wPvcmk3%=JuAGAJPwL1`9)$qmU@j?aaE}g0In4@p^g#<l4+M*(P
zj}hi7PEB#{lEVoRRb@L@_euMBRP)&`*M@Vtvo580v6=1de7}BuGq1<>3qz|Fg`z4P
zW!lNCau%;HRi&vgBdWiVnX4Y*p(=W(Xw-Ly?5UGM%CUvU4<bf%H)sdveI)MX40>1a
zUh`lZI9j#MaH@HXT3qbv*9%*4d*wB1C=e<AIj>y$z62G-|JmWmk7h?de;$gfw~|Rl
z@b%vK&x2x?>x|NIES|H!8t;=9wL9P3yw;egTo&GX^+sfDiviQ;Il<TKA1>Fg9a_p5
zHJ)O2E5j!OBSDvozS#ktbnBmd$XG4M%yTzxEL0s#gGnSFv`?gA`^8l#e&Z3iTQ^^g
z##z0>k@TIL5Z9C5vi-|;hW=Z3R^QC$=0sadM-xO8Nq!~&*jMY9Ju@*+8!f@}#7c>l
zCMF24(LZJLWh$a4A(dpk`ptDvWl1pT(oHNjhNdN8CHW-vG?7KZ@~k*-3NzENINyff
zrsa%Qqp=%v3MGR_F~dwusl_8}oIffuPxU^&*HFm+YCCHXmIFkGRk#O(;eEAMoXeE&
zhfC}p?6iasa<Zc(gtbgu%O$nUg36k)jPNl*Fy4N=Sa>O9(Q9N?rBG(RN1`!Ef2{S`
zRu<`(D*Rm2-@XU&K|6A9<P+LGcDxLZ4dhh|loICA;*YcFT6P>xdFmTbxvCVr(_2%W
z4yNS|3Q(SsT|AmHTkA3&6muuy^>Me&OdLhdZ-;R)tC2_HR=31zu+I#88w%NZalOfZ
zD)ZVct_axzeFb=LDZd}h%-Jg%%I4KMCdq?0sG$#;26Yp-gYA21<6u~+W_B-PgswH}
z-6o&|iBCM;^6Cq)!pxC}!^Ak{EG#Je15mwSOo&<+!W7k}O}QW?;NES+mNhO7)9yT9
zI@>e#x>-t$4O4x$3)*!)BJ|=r!Zjpy38EZovoe801<oVCS`oPC$`OTXY|&VIM6plQ
zyqTAESL?~McG=p)ubzXg%ldT7J4t5#rpAlCi*WqO9(r|r>wN-UZ{;eR<|DQPm|WoW
zm*TrK{XO=bVwbCGCThGEADjGr93s6in~ee<a1+>|H9OPg=C3z>bJN9TTw4)?ca@`W
z9N7e`GP=}iqh*&IiY$>hK|$yJy<Th|O@f$!jdTGM^muT!{NemIrgQ!_;bb3E?7k2)
zx!T1i@KeUvx$?0y{L-Ig<v%ZeGJ*txud<!obxadmNm<-DCQJ_(%wzp3@0*)u>y>n4
z(=_zsUAx}u#Lgm)GJatFWM%i0xdX_~i%RMT!8ly=#5M!=B_B9f4eIZpT3siZyr&y*
zMpmuov)dLfCANy_;-Qn=%Q=flXNpaS(Lw&DrFp{5DOW_m1B{^#c4s^2cWD-ZyRU8W
z39#Sy%YNRKZxW%z->pzJ>9?qxl<QcQrfoL;@{q?IBkWu~vMKCY@X4$3pbh3dx~@Nz
z9epYTa;ZO!9o78$#=skK^JS8$_kq8L$ygM`b;6=3<IxD2Jlpwuep*7{$@#OC@D=%Q
zhOl&DmGz9hdg~JrR%t66vs{Q{U~tAz(JL`iC+@n!jR_h%+bk45dF^58R(5C2oh{$B
zT6Zkpah!Yq2*o3WO3*ipbE(~$G&`zBTC^>Sjg~eK&V;B8*R9849jB(<+BbaBI(xtM
zdut2y#;!LiYf8KQ?HsQ~d8Ce+^sTS}V`*i^B%ap>718aQf1>f*epGz8z>r;=jD(ad
zQ%?95;?Tiy58IZ#JZ0*Q&UMKQI#@12^+5uPTnr&X+R;q-Q6&Wq+0$OXprk|t%P=#q
zr7ixZv(uR`@mdn4_D|Hat!{P~J{E6h3VL?fj|?;{?rR5bRNf3w&wgZuHoc0lyWrA*
zmBUdhtaduhwP-u634^K*Nd>L;$z?@foc9!NxQHA_!rl}x-{`eg)kzuB7`|b7J8Z$&
zwK{+SZ1MF3`(l_3mV3RYQtNSZr=Pl$?eFi)V(PHS>E>TvkILt&P`O|1e6k0h;O?CK
zQfBVDHcN1>GGtEj+We-Rlc3L#n3*>X)B5S%xH}ZSIuqz_rN`<1_{T~2l^HDlaJx<&
zJmOg?av%8=>G4Bq0y;;O<`_|obF}onN~+Y}cy6ayMF443(3(!su($O3<_SunIVekX
zrcV*M$mUkO@g5)dXS@Bjw0LKY9xPFGeBCr`<^G2U0ZGP5(TphDbYIK*#nH6F@ZNvN
zg*DKRoT;Tby6+e`_nLJ|xi)MmrMfLXS|!&v$L#v)8w9ordv($KS`}=aMl;iPTh~-r
zfyv=RxKA0DB7El-adn{hiF7E7%^o5<+srY0NY<*`m%69=K~tr)t_JT~vm*TBWUo2q
zrn!>}n&9*iE0ZpAGwAzAx7Ed@N@mNnzu<vot@fB+goF7*&sJwej6q%(*IY85GqAjt
z6I2UXl$@u9|K<uiD(_v%)1n;#^MD2g_R_tGN=;P)8tUq+TekY>rlD|I_=j6xKP${x
zX4^@fMe%CRezfNjE^+0liFC_b!ze}FN;q>4&G^>M^hJ@~SHNZw(R{oZ^kt_Rs&_E#
zh1y8Gp=>%S17k_%D%FQsMC0)fq+}hB&oD52Atcb(#$`?q*R-r}Kli0#@kdXkeb~ZI
zM12sKk<YKUsJzO=mq{nT-4A3B^D+Y2q~mlw70a$}P;G^5&QF{QH17WG$8lxUN!Wjm
zmM2GK%m7kGaWDdx%`Ez`snlK_@h^(<??h1|cl|+G)1i_5r?)pX!9fePT9B8qBGge9
zuYarA3Y7WV++csWRFV}90AS>nFMf`DKBB9y<!ZecJ!l0wlPPa$zIb0xia;JYb8T74
zhc}ky;D<=jqearqyEE93u>?oVJdUl}Ua#!0^70*YfRc7JY<Fc&PRcaRk9Dls+cZn^
zXc;*rZjO(Bb5bNiJRWzi?yd2ZNb%ymDhyxGnJ|rOf~7jS|Kevtnb)Y9fR<j^o3(EK
zv%q?3$7Ed4>E^nL>A?q{K*5r#xvtg4Vs%zb-j=D9n1Zl3!eO))6{p6VLXLfe7c8?5
zdmBI*+tbuSa;3^Nmxj>bFnR$WXZXX1T6)*Q@7LSqBgsdoy(VnhkO4q>q^^ZRC+`;(
zCz1zIgFR$*%#fW~zo+(|^zT{M<^Q*fqGv39>rcBX31+_CA7`HGxasBg$aZ(Z6}iA*
zI^ZDs;>q`~O7c-EYqwt8RXOQd^ZwoY<L|GUe@=?6lkdf>uM$7wey&okS)U?1{lFh>
z0p35rdQ$h2S#<vV<16M)HB}SuWjcFKs{Q?Yf!?jIwUH{kZfg!DNA5f{JOAI#{p~Mb
zd@KIF_SSugU4GO3_ssv;EL+RK=hom5&GgaQM(TObu}{kNU+#SN^Dn<!`#k0-pZnq8
z+3P-DuT1{oZ~HeztohH6nB%pjtKR9Jnxp*vYv*x!Uw`}0DbZ>h1M5$BJ-)m5+N{@4
zEcfi+`~Uh&;9j%b-!aUY&Ye$~UuNzML#fjcLvpZM4kl9K0V=Maao$k=esAMjl{b8I
zZzY0;@D?0q0yf9(vwu|nEcq!a{_KD0j}LtApjgl4_^~gK`J@^PM@jF2^v!Iy)O;;0
z^93?~@ZEng>vxedFbPO_Fx|gZeE-W;-+dG1&RH4Qm7Lkf{PI%lYa6i%9(Mf)=k}o_
zZR8<CRQG*uK5$e#Zn9WZ#=|YoJKkPCv&OuT8Pv|^iD`VSK6h3dumaij;P>+-^8a4E
zYOGdX2Wm?(M;!S6m7%UeZ!SY)9rv0&mo}IH8$_4a++4rpZrS~9_kZ7R1X+J??|~0*
z%RHm=Hs=01Tl;;<N8!GT@9ZTl>qIAb+}qlJtrwJ!h;%1tuoF|UK?JMHB>rpa@Aq+H
zlg8A5TjWI)W9O6D-x+r$kb4<eZN+T}#EH$J4oW{0YCpZ3O_Aq-)-;X=6_!}X8vdg}
zMRX1r4XV+gf)#9|Wfj)a1X~?28dL)lR4;b9e41$-@0Y*t=ks;733;fkc348j-ax?N
z;<YSdF$D{^91-$<HrwX+egEyZzSu^85BKJcefHm~@XOLRy}5Qj4)Q<sd;;tbtV;Rh
zx4?=GTaqBjQf4oONhic(OD>8$1|E8PAJ_}k-=ly1{zjKiJ0|u6I|$#Os?C`~X^R0k
zaW(sZ{QUZNwXYBCPVRitD0T8lH^1bh?>=_>6?e-K*=EI4KAz!je9>8R4S3&1zUPy|
zepz3Y`QjPp94TwZfum_Hur0U!+s0{>2LZDmumRRkouW5`a<fKVMQjU<k!dunM#BnL
j9*^ch;?n}N--G{*i*jXSSkzN?GXR07tDnm{r-UW|f6UbU

literal 0
HcmV?d00001


From 63631b5b2b6bb593fe7aab498af50f76191cd9d7 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 8 Oct 2025 08:20:20 +0100
Subject: [PATCH 078/298] chore(coderd): aitasks: add internal-only api doc
 comments (#20020)

Adds api doc comments calling out experimental status.

Should be merged alongside https://github.com/coder/coder/pull/20019
---
 coderd/aitasks.go                  |  74 ++++-
 coderd/apidoc/docs.go              | 455 +++++++++++++++++++++++++++++
 coderd/apidoc/swagger.json         | 432 +++++++++++++++++++++++++++
 docs/reference/api/experimental.md | 207 +++++++++++++
 docs/reference/api/schemas.md      | 255 ++++++++++++++++
 5 files changed, 1421 insertions(+), 2 deletions(-)
 create mode 100644 docs/reference/api/experimental.md

diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 275cfe855621e..6bb706d1a5b54 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -82,8 +82,18 @@ func (api *API) aiTasksPrompts(rw http.ResponseWriter, r *http.Request) {
 	})
 }
 
-// This endpoint is experimental and not guaranteed to be stable, so we're not
-// generating public-facing documentation for it.
+// @Summary Create a new AI task
+// @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
+// @ID create-task
+// @Security CoderSessionToken
+// @Tags Experimental
+// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
+// @Param request body codersdk.CreateTaskRequest true "Create task request"
+// @Success 201 {object} codersdk.Task
+// @Router /api/experimental/tasks/{user} [post]
+//
+// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
+// This endpoint creates a new task for the given user.
 func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 	var (
 		ctx     = r.Context()
@@ -316,6 +326,19 @@ type tasksListResponse struct {
 	Count int             `json:"count"`
 }
 
+// @Summary List AI tasks
+// @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
+// @ID list-tasks
+// @Security CoderSessionToken
+// @Tags Experimental
+// @Param q query string false "Search query for filtering tasks"
+// @Param after_id query string false "Return tasks after this ID for pagination"
+// @Param limit query int false "Maximum number of tasks to return" minimum(1) maximum(100) default(25)
+// @Param offset query int false "Offset for pagination" minimum(0) default(0)
+// @Success 200 {object} coderd.tasksListResponse
+// @Router /api/experimental/tasks [get]
+//
+// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // tasksList is an experimental endpoint to list AI tasks by mapping
 // workspaces to a task-shaped response.
 func (api *API) tasksList(rw http.ResponseWriter, r *http.Request) {
@@ -419,6 +442,17 @@ func (api *API) tasksList(rw http.ResponseWriter, r *http.Request) {
 	})
 }
 
+// @Summary Get AI task by ID
+// @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
+// @ID get-task
+// @Security CoderSessionToken
+// @Tags Experimental
+// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
+// @Param id path string true "Task ID" format(uuid)
+// @Success 200 {object} codersdk.Task
+// @Router /api/experimental/tasks/{user}/{id} [get]
+//
+// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskGet is an experimental endpoint to fetch a single AI task by ID
 // (workspace ID). It returns a synthesized task response including
 // prompt and status.
@@ -525,6 +559,17 @@ func (api *API) taskGet(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusOK, tasks[0])
 }
 
+// @Summary Delete AI task by ID
+// @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
+// @ID delete-task
+// @Security CoderSessionToken
+// @Tags Experimental
+// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
+// @Param id path string true "Task ID" format(uuid)
+// @Success 202 "Task deletion initiated"
+// @Router /api/experimental/tasks/{user}/{id} [delete]
+//
+// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskDelete is an experimental endpoint to delete a task by ID (workspace ID).
 // It creates a delete workspace build and returns 202 Accepted if the build was
 // created.
@@ -600,6 +645,18 @@ func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 	rw.WriteHeader(http.StatusAccepted)
 }
 
+// @Summary Send input to AI task
+// @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
+// @ID send-task-input
+// @Security CoderSessionToken
+// @Tags Experimental
+// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
+// @Param id path string true "Task ID" format(uuid)
+// @Param request body codersdk.TaskSendRequest true "Task input request"
+// @Success 204 "Input sent successfully"
+// @Router /api/experimental/tasks/{user}/{id}/send [post]
+//
+// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskSend submits task input to the tasks sidebar app by dialing the agent
 // directly over the tailnet. We enforce ApplicationConnect RBAC on the
 // workspace and validate the sidebar app health.
@@ -670,6 +727,19 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 	rw.WriteHeader(http.StatusNoContent)
 }
 
+// @Summary Get AI task logs
+// @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
+// @ID get-task-logs
+// @Security CoderSessionToken
+// @Tags Experimental
+// @Param user path string true "Username, user ID, or 'me' for the authenticated user"
+// @Param id path string true "Task ID" format(uuid)
+// @Success 200 {object} codersdk.TaskLogsResponse
+// @Router /api/experimental/tasks/{user}/{id}/logs [get]
+//
+// EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
+// taskLogs reads task output by dialing the agent directly over the tailnet.
+// We enforce ApplicationConnect RBAC on the workspace and validate the sidebar app health.
 func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index b444d50a8c63b..d10e39fa06ed2 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -130,6 +130,256 @@ const docTemplate = `{
                 }
             }
         },
+        "/api/experimental/tasks": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Experimental"
+                ],
+                "summary": "List AI tasks",
+                "operationId": "list-tasks",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Search query for filtering tasks",
+                        "name": "q",
+                        "in": "query"
+                    },
+                    {
+                        "type": "string",
+                        "description": "Return tasks after this ID for pagination",
+                        "name": "after_id",
+                        "in": "query"
+                    },
+                    {
+                        "maximum": 100,
+                        "minimum": 1,
+                        "type": "integer",
+                        "default": 25,
+                        "description": "Maximum number of tasks to return",
+                        "name": "limit",
+                        "in": "query"
+                    },
+                    {
+                        "minimum": 0,
+                        "type": "integer",
+                        "default": 0,
+                        "description": "Offset for pagination",
+                        "name": "offset",
+                        "in": "query"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/coderd.tasksListResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/experimental/tasks/{user}": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Experimental"
+                ],
+                "summary": "Create a new AI task",
+                "operationId": "create-task",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Username, user ID, or 'me' for the authenticated user",
+                        "name": "user",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "Create task request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.CreateTaskRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "201": {
+                        "description": "Created",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.Task"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/experimental/tasks/{user}/{id}": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Experimental"
+                ],
+                "summary": "Get AI task by ID",
+                "operationId": "get-task",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Username, user ID, or 'me' for the authenticated user",
+                        "name": "user",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Task ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.Task"
+                        }
+                    }
+                }
+            },
+            "delete": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Experimental"
+                ],
+                "summary": "Delete AI task by ID",
+                "operationId": "delete-task",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Username, user ID, or 'me' for the authenticated user",
+                        "name": "user",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Task ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "202": {
+                        "description": "Task deletion initiated"
+                    }
+                }
+            }
+        },
+        "/api/experimental/tasks/{user}/{id}/logs": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Experimental"
+                ],
+                "summary": "Get AI task logs",
+                "operationId": "get-task-logs",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Username, user ID, or 'me' for the authenticated user",
+                        "name": "user",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Task ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "OK",
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.TaskLogsResponse"
+                        }
+                    }
+                }
+            }
+        },
+        "/api/experimental/tasks/{user}/{id}/send": {
+            "post": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Experimental"
+                ],
+                "summary": "Send input to AI task",
+                "operationId": "send-task-input",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Username, user ID, or 'me' for the authenticated user",
+                        "name": "user",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "format": "uuid",
+                        "description": "Task ID",
+                        "name": "id",
+                        "in": "path",
+                        "required": true
+                    },
+                    {
+                        "description": "Task input request",
+                        "name": "request",
+                        "in": "body",
+                        "required": true,
+                        "schema": {
+                            "$ref": "#/definitions/codersdk.TaskSendRequest"
+                        }
+                    }
+                ],
+                "responses": {
+                    "204": {
+                        "description": "Input sent successfully"
+                    }
+                }
+            }
+        },
         "/appearance": {
             "get": {
                 "security": [
@@ -11236,6 +11486,20 @@ const docTemplate = `{
                 }
             }
         },
+        "coderd.tasksListResponse": {
+            "type": "object",
+            "properties": {
+                "count": {
+                    "type": "integer"
+                },
+                "tasks": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.Task"
+                    }
+                }
+            }
+        },
         "codersdk.ACLAvailable": {
             "type": "object",
             "properties": {
@@ -12719,6 +12983,25 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.CreateTaskRequest": {
+            "type": "object",
+            "properties": {
+                "input": {
+                    "type": "string"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "template_version_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "template_version_preset_id": {
+                    "type": "string",
+                    "format": "uuid"
+                }
+            }
+        },
         "codersdk.CreateTemplateRequest": {
             "type": "object",
             "required": [
@@ -17218,6 +17501,178 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.Task": {
+            "type": "object",
+            "properties": {
+                "created_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "current_state": {
+                    "$ref": "#/definitions/codersdk.TaskStateEntry"
+                },
+                "id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "initial_prompt": {
+                    "type": "string"
+                },
+                "name": {
+                    "type": "string"
+                },
+                "organization_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "owner_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "owner_name": {
+                    "type": "string"
+                },
+                "status": {
+                    "enum": [
+                        "pending",
+                        "starting",
+                        "running",
+                        "stopping",
+                        "stopped",
+                        "failed",
+                        "canceling",
+                        "canceled",
+                        "deleting",
+                        "deleted"
+                    ],
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.WorkspaceStatus"
+                        }
+                    ]
+                },
+                "template_display_name": {
+                    "type": "string"
+                },
+                "template_icon": {
+                    "type": "string"
+                },
+                "template_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
+                "template_name": {
+                    "type": "string"
+                },
+                "updated_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "workspace_agent_health": {
+                    "$ref": "#/definitions/codersdk.WorkspaceAgentHealth"
+                },
+                "workspace_agent_id": {
+                    "format": "uuid",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/uuid.NullUUID"
+                        }
+                    ]
+                },
+                "workspace_agent_lifecycle": {
+                    "$ref": "#/definitions/codersdk.WorkspaceAgentLifecycle"
+                },
+                "workspace_id": {
+                    "format": "uuid",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/uuid.NullUUID"
+                        }
+                    ]
+                }
+            }
+        },
+        "codersdk.TaskLogEntry": {
+            "type": "object",
+            "properties": {
+                "content": {
+                    "type": "string"
+                },
+                "id": {
+                    "type": "integer"
+                },
+                "time": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "type": {
+                    "$ref": "#/definitions/codersdk.TaskLogType"
+                }
+            }
+        },
+        "codersdk.TaskLogType": {
+            "type": "string",
+            "enum": [
+                "input",
+                "output"
+            ],
+            "x-enum-varnames": [
+                "TaskLogTypeInput",
+                "TaskLogTypeOutput"
+            ]
+        },
+        "codersdk.TaskLogsResponse": {
+            "type": "object",
+            "properties": {
+                "logs": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.TaskLogEntry"
+                    }
+                }
+            }
+        },
+        "codersdk.TaskSendRequest": {
+            "type": "object",
+            "properties": {
+                "input": {
+                    "type": "string"
+                }
+            }
+        },
+        "codersdk.TaskState": {
+            "type": "string",
+            "enum": [
+                "working",
+                "idle",
+                "complete",
+                "failed"
+            ],
+            "x-enum-varnames": [
+                "TaskStateWorking",
+                "TaskStateIdle",
+                "TaskStateComplete",
+                "TaskStateFailed"
+            ]
+        },
+        "codersdk.TaskStateEntry": {
+            "type": "object",
+            "properties": {
+                "message": {
+                    "type": "string"
+                },
+                "state": {
+                    "$ref": "#/definitions/codersdk.TaskState"
+                },
+                "timestamp": {
+                    "type": "string",
+                    "format": "date-time"
+                },
+                "uri": {
+                    "type": "string"
+                }
+            }
+        },
         "codersdk.TelemetryConfig": {
             "type": "object",
             "properties": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 1a222932de75a..df4aae91d3b60 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -106,6 +106,244 @@
 				}
 			}
 		},
+		"/api/experimental/tasks": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Experimental"],
+				"summary": "List AI tasks",
+				"operationId": "list-tasks",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Search query for filtering tasks",
+						"name": "q",
+						"in": "query"
+					},
+					{
+						"type": "string",
+						"description": "Return tasks after this ID for pagination",
+						"name": "after_id",
+						"in": "query"
+					},
+					{
+						"maximum": 100,
+						"minimum": 1,
+						"type": "integer",
+						"default": 25,
+						"description": "Maximum number of tasks to return",
+						"name": "limit",
+						"in": "query"
+					},
+					{
+						"minimum": 0,
+						"type": "integer",
+						"default": 0,
+						"description": "Offset for pagination",
+						"name": "offset",
+						"in": "query"
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"schema": {
+							"$ref": "#/definitions/coderd.tasksListResponse"
+						}
+					}
+				}
+			}
+		},
+		"/api/experimental/tasks/{user}": {
+			"post": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Experimental"],
+				"summary": "Create a new AI task",
+				"operationId": "create-task",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Username, user ID, or 'me' for the authenticated user",
+						"name": "user",
+						"in": "path",
+						"required": true
+					},
+					{
+						"description": "Create task request",
+						"name": "request",
+						"in": "body",
+						"required": true,
+						"schema": {
+							"$ref": "#/definitions/codersdk.CreateTaskRequest"
+						}
+					}
+				],
+				"responses": {
+					"201": {
+						"description": "Created",
+						"schema": {
+							"$ref": "#/definitions/codersdk.Task"
+						}
+					}
+				}
+			}
+		},
+		"/api/experimental/tasks/{user}/{id}": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Experimental"],
+				"summary": "Get AI task by ID",
+				"operationId": "get-task",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Username, user ID, or 'me' for the authenticated user",
+						"name": "user",
+						"in": "path",
+						"required": true
+					},
+					{
+						"type": "string",
+						"format": "uuid",
+						"description": "Task ID",
+						"name": "id",
+						"in": "path",
+						"required": true
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"schema": {
+							"$ref": "#/definitions/codersdk.Task"
+						}
+					}
+				}
+			},
+			"delete": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Experimental"],
+				"summary": "Delete AI task by ID",
+				"operationId": "delete-task",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Username, user ID, or 'me' for the authenticated user",
+						"name": "user",
+						"in": "path",
+						"required": true
+					},
+					{
+						"type": "string",
+						"format": "uuid",
+						"description": "Task ID",
+						"name": "id",
+						"in": "path",
+						"required": true
+					}
+				],
+				"responses": {
+					"202": {
+						"description": "Task deletion initiated"
+					}
+				}
+			}
+		},
+		"/api/experimental/tasks/{user}/{id}/logs": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Experimental"],
+				"summary": "Get AI task logs",
+				"operationId": "get-task-logs",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Username, user ID, or 'me' for the authenticated user",
+						"name": "user",
+						"in": "path",
+						"required": true
+					},
+					{
+						"type": "string",
+						"format": "uuid",
+						"description": "Task ID",
+						"name": "id",
+						"in": "path",
+						"required": true
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "OK",
+						"schema": {
+							"$ref": "#/definitions/codersdk.TaskLogsResponse"
+						}
+					}
+				}
+			}
+		},
+		"/api/experimental/tasks/{user}/{id}/send": {
+			"post": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Experimental"],
+				"summary": "Send input to AI task",
+				"operationId": "send-task-input",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Username, user ID, or 'me' for the authenticated user",
+						"name": "user",
+						"in": "path",
+						"required": true
+					},
+					{
+						"type": "string",
+						"format": "uuid",
+						"description": "Task ID",
+						"name": "id",
+						"in": "path",
+						"required": true
+					},
+					{
+						"description": "Task input request",
+						"name": "request",
+						"in": "body",
+						"required": true,
+						"schema": {
+							"$ref": "#/definitions/codersdk.TaskSendRequest"
+						}
+					}
+				],
+				"responses": {
+					"204": {
+						"description": "Input sent successfully"
+					}
+				}
+			}
+		},
 		"/appearance": {
 			"get": {
 				"security": [
@@ -9960,6 +10198,20 @@
 				}
 			}
 		},
+		"coderd.tasksListResponse": {
+			"type": "object",
+			"properties": {
+				"count": {
+					"type": "integer"
+				},
+				"tasks": {
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.Task"
+					}
+				}
+			}
+		},
 		"codersdk.ACLAvailable": {
 			"type": "object",
 			"properties": {
@@ -11397,6 +11649,25 @@
 				}
 			}
 		},
+		"codersdk.CreateTaskRequest": {
+			"type": "object",
+			"properties": {
+				"input": {
+					"type": "string"
+				},
+				"name": {
+					"type": "string"
+				},
+				"template_version_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"template_version_preset_id": {
+					"type": "string",
+					"format": "uuid"
+				}
+			}
+		},
 		"codersdk.CreateTemplateRequest": {
 			"type": "object",
 			"required": ["name", "template_version_id"],
@@ -15738,6 +16009,167 @@
 				}
 			}
 		},
+		"codersdk.Task": {
+			"type": "object",
+			"properties": {
+				"created_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"current_state": {
+					"$ref": "#/definitions/codersdk.TaskStateEntry"
+				},
+				"id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"initial_prompt": {
+					"type": "string"
+				},
+				"name": {
+					"type": "string"
+				},
+				"organization_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"owner_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"owner_name": {
+					"type": "string"
+				},
+				"status": {
+					"enum": [
+						"pending",
+						"starting",
+						"running",
+						"stopping",
+						"stopped",
+						"failed",
+						"canceling",
+						"canceled",
+						"deleting",
+						"deleted"
+					],
+					"allOf": [
+						{
+							"$ref": "#/definitions/codersdk.WorkspaceStatus"
+						}
+					]
+				},
+				"template_display_name": {
+					"type": "string"
+				},
+				"template_icon": {
+					"type": "string"
+				},
+				"template_id": {
+					"type": "string",
+					"format": "uuid"
+				},
+				"template_name": {
+					"type": "string"
+				},
+				"updated_at": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"workspace_agent_health": {
+					"$ref": "#/definitions/codersdk.WorkspaceAgentHealth"
+				},
+				"workspace_agent_id": {
+					"format": "uuid",
+					"allOf": [
+						{
+							"$ref": "#/definitions/uuid.NullUUID"
+						}
+					]
+				},
+				"workspace_agent_lifecycle": {
+					"$ref": "#/definitions/codersdk.WorkspaceAgentLifecycle"
+				},
+				"workspace_id": {
+					"format": "uuid",
+					"allOf": [
+						{
+							"$ref": "#/definitions/uuid.NullUUID"
+						}
+					]
+				}
+			}
+		},
+		"codersdk.TaskLogEntry": {
+			"type": "object",
+			"properties": {
+				"content": {
+					"type": "string"
+				},
+				"id": {
+					"type": "integer"
+				},
+				"time": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"type": {
+					"$ref": "#/definitions/codersdk.TaskLogType"
+				}
+			}
+		},
+		"codersdk.TaskLogType": {
+			"type": "string",
+			"enum": ["input", "output"],
+			"x-enum-varnames": ["TaskLogTypeInput", "TaskLogTypeOutput"]
+		},
+		"codersdk.TaskLogsResponse": {
+			"type": "object",
+			"properties": {
+				"logs": {
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.TaskLogEntry"
+					}
+				}
+			}
+		},
+		"codersdk.TaskSendRequest": {
+			"type": "object",
+			"properties": {
+				"input": {
+					"type": "string"
+				}
+			}
+		},
+		"codersdk.TaskState": {
+			"type": "string",
+			"enum": ["working", "idle", "complete", "failed"],
+			"x-enum-varnames": [
+				"TaskStateWorking",
+				"TaskStateIdle",
+				"TaskStateComplete",
+				"TaskStateFailed"
+			]
+		},
+		"codersdk.TaskStateEntry": {
+			"type": "object",
+			"properties": {
+				"message": {
+					"type": "string"
+				},
+				"state": {
+					"$ref": "#/definitions/codersdk.TaskState"
+				},
+				"timestamp": {
+					"type": "string",
+					"format": "date-time"
+				},
+				"uri": {
+					"type": "string"
+				}
+			}
+		},
 		"codersdk.TelemetryConfig": {
 			"type": "object",
 			"properties": {
diff --git a/docs/reference/api/experimental.md b/docs/reference/api/experimental.md
new file mode 100644
index 0000000000000..edf6b729d83a8
--- /dev/null
+++ b/docs/reference/api/experimental.md
@@ -0,0 +1,207 @@
+# Experimental
+
+## List AI tasks
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks \
+  -H 'Accept: */*' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /api/experimental/tasks`
+
+### Parameters
+
+| Name       | In    | Type    | Required | Description                               |
+|------------|-------|---------|----------|-------------------------------------------|
+| `q`        | query | string  | false    | Search query for filtering tasks          |
+| `after_id` | query | string  | false    | Return tasks after this ID for pagination |
+| `limit`    | query | integer | false    | Maximum number of tasks to return         |
+| `offset`   | query | integer | false    | Offset for pagination                     |
+
+### Example responses
+
+> 200 Response
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                         |
+|--------|---------------------------------------------------------|-------------|----------------------------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [coderd.tasksListResponse](schemas.md#coderdtaskslistresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Create a new AI task
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/api/experimental/tasks/{user} \
+  -H 'Content-Type: application/json' \
+  -H 'Accept: */*' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`POST /api/experimental/tasks/{user}`
+
+> Body parameter
+
+```json
+{
+  "input": "string",
+  "name": "string",
+  "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
+  "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1"
+}
+```
+
+### Parameters
+
+| Name   | In   | Type                                                               | Required | Description                                           |
+|--------|------|--------------------------------------------------------------------|----------|-------------------------------------------------------|
+| `user` | path | string                                                             | true     | Username, user ID, or 'me' for the authenticated user |
+| `body` | body | [codersdk.CreateTaskRequest](schemas.md#codersdkcreatetaskrequest) | true     | Create task request                                   |
+
+### Example responses
+
+> 201 Response
+
+### Responses
+
+| Status | Meaning                                                      | Description | Schema                                   |
+|--------|--------------------------------------------------------------|-------------|------------------------------------------|
+| 201    | [Created](https://tools.ietf.org/html/rfc7231#section-6.3.2) | Created     | [codersdk.Task](schemas.md#codersdktask) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Get AI task by ID
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id} \
+  -H 'Accept: */*' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /api/experimental/tasks/{user}/{id}`
+
+### Parameters
+
+| Name   | In   | Type         | Required | Description                                           |
+|--------|------|--------------|----------|-------------------------------------------------------|
+| `user` | path | string       | true     | Username, user ID, or 'me' for the authenticated user |
+| `id`   | path | string(uuid) | true     | Task ID                                               |
+
+### Example responses
+
+> 200 Response
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                   |
+|--------|---------------------------------------------------------|-------------|------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.Task](schemas.md#codersdktask) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Delete AI task by ID
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X DELETE http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id} \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`DELETE /api/experimental/tasks/{user}/{id}`
+
+### Parameters
+
+| Name   | In   | Type         | Required | Description                                           |
+|--------|------|--------------|----------|-------------------------------------------------------|
+| `user` | path | string       | true     | Username, user ID, or 'me' for the authenticated user |
+| `id`   | path | string(uuid) | true     | Task ID                                               |
+
+### Responses
+
+| Status | Meaning                                                       | Description             | Schema |
+|--------|---------------------------------------------------------------|-------------------------|--------|
+| 202    | [Accepted](https://tools.ietf.org/html/rfc7231#section-6.3.3) | Task deletion initiated |        |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Get AI task logs
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id}/logs \
+  -H 'Accept: */*' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`GET /api/experimental/tasks/{user}/{id}/logs`
+
+### Parameters
+
+| Name   | In   | Type         | Required | Description                                           |
+|--------|------|--------------|----------|-------------------------------------------------------|
+| `user` | path | string       | true     | Username, user ID, or 'me' for the authenticated user |
+| `id`   | path | string(uuid) | true     | Task ID                                               |
+
+### Example responses
+
+> 200 Response
+
+### Responses
+
+| Status | Meaning                                                 | Description | Schema                                                           |
+|--------|---------------------------------------------------------|-------------|------------------------------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.TaskLogsResponse](schemas.md#codersdktasklogsresponse) |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
+
+## Send input to AI task
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id}/send \
+  -H 'Content-Type: application/json' \
+  -H 'Coder-Session-Token: API_KEY'
+```
+
+`POST /api/experimental/tasks/{user}/{id}/send`
+
+> Body parameter
+
+```json
+{
+  "input": "string"
+}
+```
+
+### Parameters
+
+| Name   | In   | Type                                                           | Required | Description                                           |
+|--------|------|----------------------------------------------------------------|----------|-------------------------------------------------------|
+| `user` | path | string                                                         | true     | Username, user ID, or 'me' for the authenticated user |
+| `id`   | path | string(uuid)                                                   | true     | Task ID                                               |
+| `body` | body | [codersdk.TaskSendRequest](schemas.md#codersdktasksendrequest) | true     | Task input request                                    |
+
+### Responses
+
+| Status | Meaning                                                         | Description             | Schema |
+|--------|-----------------------------------------------------------------|-------------------------|--------|
+| 204    | [No Content](https://tools.ietf.org/html/rfc7231#section-6.3.5) | Input sent successfully |        |
+
+To perform this operation, you must be authenticated. [Learn more](authentication.md).
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index c121096b094d6..7b096078021a1 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -277,6 +277,57 @@
 |--------------|--------|----------|--------------|-------------|
 | `csp-report` | object | false    |              |             |
 
+## coderd.tasksListResponse
+
+```json
+{
+  "count": 0,
+  "tasks": [
+    {
+      "created_at": "2019-08-24T14:15:22Z",
+      "current_state": {
+        "message": "string",
+        "state": "working",
+        "timestamp": "2019-08-24T14:15:22Z",
+        "uri": "string"
+      },
+      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initial_prompt": "string",
+      "name": "string",
+      "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+      "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
+      "owner_name": "string",
+      "status": "pending",
+      "template_display_name": "string",
+      "template_icon": "string",
+      "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
+      "template_name": "string",
+      "updated_at": "2019-08-24T14:15:22Z",
+      "workspace_agent_health": {
+        "healthy": false,
+        "reason": "agent has lost connection"
+      },
+      "workspace_agent_id": {
+        "uuid": "string",
+        "valid": true
+      },
+      "workspace_agent_lifecycle": "created",
+      "workspace_id": {
+        "uuid": "string",
+        "valid": true
+      }
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name    | Type                                    | Required | Restrictions | Description |
+|---------|-----------------------------------------|----------|--------------|-------------|
+| `count` | integer                                 | false    |              |             |
+| `tasks` | array of [codersdk.Task](#codersdktask) | false    |              |             |
+
 ## codersdk.ACLAvailable
 
 ```json
@@ -1981,6 +2032,26 @@ AuthorizationObject can represent a "set" of objects, such as: all workspaces in
 |-------|--------|----------|--------------|-------------|
 | `key` | string | false    |              |             |
 
+## codersdk.CreateTaskRequest
+
+```json
+{
+  "input": "string",
+  "name": "string",
+  "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
+  "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1"
+}
+```
+
+### Properties
+
+| Name                         | Type   | Required | Restrictions | Description |
+|------------------------------|--------|----------|--------------|-------------|
+| `input`                      | string | false    |              |             |
+| `name`                       | string | false    |              |             |
+| `template_version_id`        | string | false    |              |             |
+| `template_version_preset_id` | string | false    |              |             |
+
 ## codersdk.CreateTemplateRequest
 
 ```json
@@ -7572,6 +7643,190 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `redirect_http`          | boolean                              | false    |              |             |
 | `supported_ciphers`      | array of string                      | false    |              |             |
 
+## codersdk.Task
+
+```json
+{
+  "created_at": "2019-08-24T14:15:22Z",
+  "current_state": {
+    "message": "string",
+    "state": "working",
+    "timestamp": "2019-08-24T14:15:22Z",
+    "uri": "string"
+  },
+  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "initial_prompt": "string",
+  "name": "string",
+  "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+  "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
+  "owner_name": "string",
+  "status": "pending",
+  "template_display_name": "string",
+  "template_icon": "string",
+  "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
+  "template_name": "string",
+  "updated_at": "2019-08-24T14:15:22Z",
+  "workspace_agent_health": {
+    "healthy": false,
+    "reason": "agent has lost connection"
+  },
+  "workspace_agent_id": {
+    "uuid": "string",
+    "valid": true
+  },
+  "workspace_agent_lifecycle": "created",
+  "workspace_id": {
+    "uuid": "string",
+    "valid": true
+  }
+}
+```
+
+### Properties
+
+| Name                        | Type                                                                 | Required | Restrictions | Description |
+|-----------------------------|----------------------------------------------------------------------|----------|--------------|-------------|
+| `created_at`                | string                                                               | false    |              |             |
+| `current_state`             | [codersdk.TaskStateEntry](#codersdktaskstateentry)                   | false    |              |             |
+| `id`                        | string                                                               | false    |              |             |
+| `initial_prompt`            | string                                                               | false    |              |             |
+| `name`                      | string                                                               | false    |              |             |
+| `organization_id`           | string                                                               | false    |              |             |
+| `owner_id`                  | string                                                               | false    |              |             |
+| `owner_name`                | string                                                               | false    |              |             |
+| `status`                    | [codersdk.WorkspaceStatus](#codersdkworkspacestatus)                 | false    |              |             |
+| `template_display_name`     | string                                                               | false    |              |             |
+| `template_icon`             | string                                                               | false    |              |             |
+| `template_id`               | string                                                               | false    |              |             |
+| `template_name`             | string                                                               | false    |              |             |
+| `updated_at`                | string                                                               | false    |              |             |
+| `workspace_agent_health`    | [codersdk.WorkspaceAgentHealth](#codersdkworkspaceagenthealth)       | false    |              |             |
+| `workspace_agent_id`        | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
+| `workspace_agent_lifecycle` | [codersdk.WorkspaceAgentLifecycle](#codersdkworkspaceagentlifecycle) | false    |              |             |
+| `workspace_id`              | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
+
+#### Enumerated Values
+
+| Property | Value       |
+|----------|-------------|
+| `status` | `pending`   |
+| `status` | `starting`  |
+| `status` | `running`   |
+| `status` | `stopping`  |
+| `status` | `stopped`   |
+| `status` | `failed`    |
+| `status` | `canceling` |
+| `status` | `canceled`  |
+| `status` | `deleting`  |
+| `status` | `deleted`   |
+
+## codersdk.TaskLogEntry
+
+```json
+{
+  "content": "string",
+  "id": 0,
+  "time": "2019-08-24T14:15:22Z",
+  "type": "input"
+}
+```
+
+### Properties
+
+| Name      | Type                                         | Required | Restrictions | Description |
+|-----------|----------------------------------------------|----------|--------------|-------------|
+| `content` | string                                       | false    |              |             |
+| `id`      | integer                                      | false    |              |             |
+| `time`    | string                                       | false    |              |             |
+| `type`    | [codersdk.TaskLogType](#codersdktasklogtype) | false    |              |             |
+
+## codersdk.TaskLogType
+
+```json
+"input"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value    |
+|----------|
+| `input`  |
+| `output` |
+
+## codersdk.TaskLogsResponse
+
+```json
+{
+  "logs": [
+    {
+      "content": "string",
+      "id": 0,
+      "time": "2019-08-24T14:15:22Z",
+      "type": "input"
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name   | Type                                                    | Required | Restrictions | Description |
+|--------|---------------------------------------------------------|----------|--------------|-------------|
+| `logs` | array of [codersdk.TaskLogEntry](#codersdktasklogentry) | false    |              |             |
+
+## codersdk.TaskSendRequest
+
+```json
+{
+  "input": "string"
+}
+```
+
+### Properties
+
+| Name    | Type   | Required | Restrictions | Description |
+|---------|--------|----------|--------------|-------------|
+| `input` | string | false    |              |             |
+
+## codersdk.TaskState
+
+```json
+"working"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value      |
+|------------|
+| `working`  |
+| `idle`     |
+| `complete` |
+| `failed`   |
+
+## codersdk.TaskStateEntry
+
+```json
+{
+  "message": "string",
+  "state": "working",
+  "timestamp": "2019-08-24T14:15:22Z",
+  "uri": "string"
+}
+```
+
+### Properties
+
+| Name        | Type                                     | Required | Restrictions | Description |
+|-------------|------------------------------------------|----------|--------------|-------------|
+| `message`   | string                                   | false    |              |             |
+| `state`     | [codersdk.TaskState](#codersdktaskstate) | false    |              |             |
+| `timestamp` | string                                   | false    |              |             |
+| `uri`       | string                                   | false    |              |             |
+
 ## codersdk.TelemetryConfig
 
 ```json

From 8274251fe1a825b563b8b25633c4a4bcaead16ea Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Wed, 8 Oct 2025 10:24:13 +0300
Subject: [PATCH 079/298] fix(.devcontainer): check if ssh folder exists in
 post_create (#19987)

---
 .devcontainer/scripts/post_create.sh | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/.devcontainer/scripts/post_create.sh b/.devcontainer/scripts/post_create.sh
index a1b774f98d2ca..ab5be4ba1bc74 100755
--- a/.devcontainer/scripts/post_create.sh
+++ b/.devcontainer/scripts/post_create.sh
@@ -10,8 +10,12 @@ install_devcontainer_cli() {
 
 install_ssh_config() {
 	echo "🔑 Installing SSH configuration..."
-	rsync -a /mnt/home/coder/.ssh/ ~/.ssh/
-	chmod 0700 ~/.ssh
+	if [ -d /mnt/home/coder/.ssh ]; then
+		rsync -a /mnt/home/coder/.ssh/ ~/.ssh/
+		chmod 0700 ~/.ssh
+	else
+		echo "⚠️ SSH directory not found."
+	fi
 }
 
 install_git_config() {

From 037e6f06f58770471c848cdcfd299bc2a0161235 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Wed, 8 Oct 2025 13:25:18 +0500
Subject: [PATCH 080/298] docs: fix link to Grafana dashboard example for AI
 Bridge (#20205)

---
 docs/ai-coder/ai-bridge.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/ai-coder/ai-bridge.md b/docs/ai-coder/ai-bridge.md
index 5d62d2b3833d9..0a9ebeba81f63 100644
--- a/docs/ai-coder/ai-bridge.md
+++ b/docs/ai-coder/ai-bridge.md
@@ -99,7 +99,7 @@ This data is currently accessible through the API and CLI (experimental), which
 
 ![User Leaderboard](../images/aibridge/grafana_user_leaderboard.png)
 
-We provide an example Grafana dashboard that you can import as a starting point for your tooling adoption metrics. See [here](../examples/monitoring/dashboards/grafana/aibridge/README.md).
+We provide an example Grafana dashboard that you can import as a starting point for your tooling adoption metrics. See [here](https://github.com/coder/coder/blob/main/examples/monitoring/dashboards/grafana/aibridge/README.md).
 
 ## Implementation Details
 

From 544f15523cf753fe75c61cb4920efbd1aa9164a1 Mon Sep 17 00:00:00 2001
From: Sas Swart <sas.swart.cdk@gmail.com>
Date: Wed, 8 Oct 2025 10:40:54 +0200
Subject: [PATCH 081/298] fix: adjust workspace claims to be initiated by users
 (#20179)

The prebuilds user never initiates a workspace claim autonomously. A
claim can only happen when a user attempts to create a workspace. When
listing prebuild provisioner jobs, it would not make sense to see jobs
related to users who are creating workspaces and have gotten a prebuilt
workspace. When cleaning up an overwhelmed provisioner queue, we should
not delete claims as they have humans waiting for them and are not part
of the thundering herd.

Therefore, this PR ensures that provisioner jobs that claim workspaces
are considered to be initiated by the user, not the prebuilds system.
---
 coderd/prebuilds/api.go                   |  1 -
 coderd/prebuilds/noop.go                  |  4 ----
 coderd/workspaces.go                      |  1 -
 enterprise/coderd/prebuilds/claim.go      |  4 ----
 enterprise/coderd/prebuilds/claim_test.go | 15 +++++++++------
 5 files changed, 9 insertions(+), 16 deletions(-)

diff --git a/coderd/prebuilds/api.go b/coderd/prebuilds/api.go
index 1bedeb10130c8..ed39f2a322776 100644
--- a/coderd/prebuilds/api.go
+++ b/coderd/prebuilds/api.go
@@ -66,5 +66,4 @@ type Claimer interface {
 		nextStartAt sql.NullTime,
 		ttl sql.NullInt64,
 	) (*uuid.UUID, error)
-	Initiator() uuid.UUID
 }
diff --git a/coderd/prebuilds/noop.go b/coderd/prebuilds/noop.go
index ebb6d6964214e..170b0a12af6fd 100644
--- a/coderd/prebuilds/noop.go
+++ b/coderd/prebuilds/noop.go
@@ -35,8 +35,4 @@ func (NoopClaimer) Claim(context.Context, time.Time, uuid.UUID, string, uuid.UUI
 	return nil, ErrAGPLDoesNotSupportPrebuiltWorkspaces
 }
 
-func (NoopClaimer) Initiator() uuid.UUID {
-	return uuid.Nil
-}
-
 var DefaultClaimer Claimer = NoopClaimer{}
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
index 8f2317fc96375..d67fa2ef4b5a7 100644
--- a/coderd/workspaces.go
+++ b/coderd/workspaces.go
@@ -719,7 +719,6 @@ func createWorkspace(
 		} else {
 			// Prebuild found!
 			workspaceID = claimedWorkspace.ID
-			initiatorID = prebuildsClaimer.Initiator()
 		}
 
 		// We have to refetch the workspace for the joined in fields.
diff --git a/enterprise/coderd/prebuilds/claim.go b/enterprise/coderd/prebuilds/claim.go
index daea281d38d60..743513cedbc6a 100644
--- a/enterprise/coderd/prebuilds/claim.go
+++ b/enterprise/coderd/prebuilds/claim.go
@@ -55,8 +55,4 @@ func (c EnterpriseClaimer) Claim(
 	return &result.ID, nil
 }
 
-func (EnterpriseClaimer) Initiator() uuid.UUID {
-	return database.PrebuildsSystemUserID
-}
-
 var _ prebuilds.Claimer = &EnterpriseClaimer{}
diff --git a/enterprise/coderd/prebuilds/claim_test.go b/enterprise/coderd/prebuilds/claim_test.go
index 9ed7e9ffd19e0..217a9ff09614a 100644
--- a/enterprise/coderd/prebuilds/claim_test.go
+++ b/enterprise/coderd/prebuilds/claim_test.go
@@ -86,10 +86,6 @@ func (m *storeSpy) ClaimPrebuiltWorkspace(ctx context.Context, arg database.Clai
 func TestClaimPrebuild(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres")
-	}
-
 	const (
 		desiredInstances = 1
 		presetCount      = 2
@@ -260,13 +256,15 @@ func TestClaimPrebuild(t *testing.T) {
 				switch {
 				case tc.claimingErr != nil && (isNoPrebuiltWorkspaces || isUnsupported):
 					require.NoError(t, err)
-					build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, userClient, userWorkspace.LatestBuild.ID)
-					_ = build
+					coderdtest.AwaitWorkspaceBuildJobCompleted(t, userClient, userWorkspace.LatestBuild.ID)
 
 					// Then: the number of running prebuilds hasn't changed because claiming prebuild is failed and we fallback to creating new workspace.
 					currentPrebuilds, err := spy.GetRunningPrebuiltWorkspaces(ctx)
 					require.NoError(t, err)
 					require.Equal(t, expectedPrebuildsCount, len(currentPrebuilds))
+					// If there are no prebuilt workspaces to claim, a new workspace is created from scratch
+					// and the initiator is set as usual.
+					require.Equal(t, user.ID, userWorkspace.LatestBuild.Job.InitiatorID)
 					return
 
 				case tc.claimingErr != nil && errors.Is(tc.claimingErr, unexpectedClaimingError):
@@ -278,6 +276,9 @@ func TestClaimPrebuild(t *testing.T) {
 					currentPrebuilds, err := spy.GetRunningPrebuiltWorkspaces(ctx)
 					require.NoError(t, err)
 					require.Equal(t, expectedPrebuildsCount, len(currentPrebuilds))
+					// If a prebuilt workspace claim fails for an unanticipated, erroneous reason,
+					// no workspace is created and therefore the initiator is not set.
+					require.Equal(t, uuid.Nil, userWorkspace.LatestBuild.Job.InitiatorID)
 					return
 
 				default:
@@ -285,6 +286,8 @@ func TestClaimPrebuild(t *testing.T) {
 					require.NoError(t, err)
 					build := coderdtest.AwaitWorkspaceBuildJobCompleted(t, userClient, userWorkspace.LatestBuild.ID)
 					require.Equal(t, build.Job.Status, codersdk.ProvisionerJobSucceeded)
+					// Prebuild claims are initiated by the user who requested to create a workspace.
+					require.Equal(t, user.ID, userWorkspace.LatestBuild.Job.InitiatorID)
 				}
 
 				// at this point we know that tc.claimingErr is nil

From 46e242e444dc3829742a81311dd4a4fc68f2247d Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Wed, 8 Oct 2025 14:22:35 +0300
Subject: [PATCH 082/298] test(coderd/database/dbtestutil): add debug output to
 pg_dump failure (#20209)

---
 coderd/database/dbtestutil/db.go | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/coderd/database/dbtestutil/db.go b/coderd/database/dbtestutil/db.go
index a960822e2a732..b4ddc491f3781 100644
--- a/coderd/database/dbtestutil/db.go
+++ b/coderd/database/dbtestutil/db.go
@@ -242,10 +242,11 @@ func PGDump(dbURL string) ([]byte, error) {
 		"PGCLIENTENCODING=UTF8",
 		"PGDATABASE=", // we should always specify the database name in the connection string
 	}
-	var stdout bytes.Buffer
+	var stdout, stderr bytes.Buffer
 	cmd.Stdout = &stdout
+	cmd.Stderr = &stderr
 	if err := cmd.Run(); err != nil {
-		return nil, xerrors.Errorf("exec pg_dump: %w", err)
+		return nil, xerrors.Errorf("exec pg_dump: %w\n%s", err, stderr.String())
 	}
 	return stdout.Bytes(), nil
 }

From f1d3f31c10b07dd93a5335839ff240058073a57f Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Wed, 8 Oct 2025 16:17:41 +0400
Subject: [PATCH 083/298] test: increase timeout in TestRun
 (scaletest/workspaceupdates) (#20211)

fixes https://github.com/coder/internal/issues/1050

Extends the timeout on the affected test. It uses a postgres database, and so 15s timeout isn't enough to not flake with our test infra these days.
---
 scaletest/workspaceupdates/run_test.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scaletest/workspaceupdates/run_test.go b/scaletest/workspaceupdates/run_test.go
index 01e4b7f621bd1..b31a6050dbbad 100644
--- a/scaletest/workspaceupdates/run_test.go
+++ b/scaletest/workspaceupdates/run_test.go
@@ -24,7 +24,7 @@ import (
 func TestRun(t *testing.T) {
 	t.Parallel()
 
-	ctx := testutil.Context(t, testutil.WaitMedium)
+	ctx := testutil.Context(t, testutil.WaitSuperLong)
 
 	client := coderdtest.New(t, &coderdtest.Options{
 		IncludeProvisionerDaemon: true,

From e2076beb9f7af4394dfe36b797e9847ea5a1f2e3 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Wed, 8 Oct 2025 16:18:02 +0400
Subject: [PATCH 084/298] test: change to explicitly compiling dbcleaner on
 posix (#20206)

relates to: https://github.com/coder/internal/issues/1026

On POSIX systems (macOS and Linux) we compile the dbcleaner binary into a temp directory. This allows us to explicitly separate the compilation step and report the time it takes. We suspect this might be a contributing factor in the above linked flakes we see on macOS.

This doesn't work on Windows because Go tests clean up the temp directory at the end of the test and the dbcleaner binary will still be executing. On Windows you cannot delete a file being executed nor the directory. However, we are not seeing any flakes on Windows so the old behavior seems to be OK.
---
 coderd/database/dbtestutil/broker.go          |  2 +-
 coderd/database/dbtestutil/cleaner.go         |  5 ++-
 coderd/database/dbtestutil/cleaner_posix.go   | 34 +++++++++++++++++++
 coderd/database/dbtestutil/cleaner_windows.go | 11 ++++++
 coderd/database/dbtestutil/postgres.go        |  1 +
 coderd/database/gen/dump/main.go              |  4 +++
 6 files changed, 53 insertions(+), 4 deletions(-)
 create mode 100644 coderd/database/dbtestutil/cleaner_posix.go
 create mode 100644 coderd/database/dbtestutil/cleaner_windows.go

diff --git a/coderd/database/dbtestutil/broker.go b/coderd/database/dbtestutil/broker.go
index 4e814b93d0477..8a0d47b7b121d 100644
--- a/coderd/database/dbtestutil/broker.go
+++ b/coderd/database/dbtestutil/broker.go
@@ -150,7 +150,7 @@ func (b *Broker) init(t TBSubset) error {
 		b.uuid = uuid.New()
 		ctx, cancel := context.WithTimeout(context.Background(), 20*time.Second)
 		defer cancel()
-		b.cleanerFD, err = startCleaner(ctx, b.uuid, coderTestingParams.DSN())
+		b.cleanerFD, err = startCleaner(ctx, t, b.uuid, coderTestingParams.DSN())
 		if err != nil {
 			return xerrors.Errorf("start test db cleaner: %w", err)
 		}
diff --git a/coderd/database/dbtestutil/cleaner.go b/coderd/database/dbtestutil/cleaner.go
index 8387cc18fe2c7..23da8c8fc7445 100644
--- a/coderd/database/dbtestutil/cleaner.go
+++ b/coderd/database/dbtestutil/cleaner.go
@@ -6,7 +6,6 @@ import (
 	"fmt"
 	"io"
 	"os"
-	"os/exec"
 	"os/signal"
 	"time"
 
@@ -39,8 +38,8 @@ func init() {
 
 // startCleaner starts the cleaner in a subprocess. holdThis is an opaque reference that needs to be kept from being
 // garbage collected until we are done with all test databases (e.g. the end of the process).
-func startCleaner(ctx context.Context, parentUUID uuid.UUID, dsn string) (holdThis any, err error) {
-	cmd := exec.Command("go", "run", "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
+func startCleaner(ctx context.Context, t TBSubset, parentUUID uuid.UUID, dsn string) (holdThis any, err error) {
+	cmd := cleanerCmd(t)
 	cmd.Env = append(os.Environ(),
 		fmt.Sprintf("%s=%s", envCleanerParentUUID, parentUUID.String()),
 		fmt.Sprintf("%s=%s", envCleanerDSN, dsn),
diff --git a/coderd/database/dbtestutil/cleaner_posix.go b/coderd/database/dbtestutil/cleaner_posix.go
new file mode 100644
index 0000000000000..3c8188e5d8cc3
--- /dev/null
+++ b/coderd/database/dbtestutil/cleaner_posix.go
@@ -0,0 +1,34 @@
+//go:build !windows
+
+package dbtestutil
+
+import (
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+const timeFormat = "2006-01-02 15:04:05.000"
+
+// cleanerCmd builds the cleaner binary in a temporary directory and returns a command to execute it. We can do this on
+// POSIX because it's OK to delete the temporary directory after the test: the binary can still run. This is not
+// possible on Windows because cleaning the temporary directory will fail if the binary is still running.
+// c.f. cleaner_windows.go.
+func cleanerCmd(t TBSubset) *exec.Cmd {
+	start := time.Now()
+	t.Logf("[%s] starting cleaner binary build", start.Format(timeFormat))
+	tempDir := t.TempDir()
+	cleanerBinary := filepath.Join(tempDir, "cleaner")
+
+	buildCmd := exec.Command("go", "build", "-o", cleanerBinary, "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
+	output, err := buildCmd.CombinedOutput()
+	if err != nil {
+		t.Logf("failed to build cleaner binary: %v", err)
+		t.Logf("output: %s", string(output))
+		// Fall back to go run if build fails
+		return exec.Command("go", "run", "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
+	}
+	t.Logf("[%s] cleaner binary %s built in %s", time.Now().Format(timeFormat), cleanerBinary, time.Since(start))
+
+	return exec.Command(cleanerBinary)
+}
diff --git a/coderd/database/dbtestutil/cleaner_windows.go b/coderd/database/dbtestutil/cleaner_windows.go
new file mode 100644
index 0000000000000..4c743b90edba3
--- /dev/null
+++ b/coderd/database/dbtestutil/cleaner_windows.go
@@ -0,0 +1,11 @@
+//go:build windows
+
+package dbtestutil
+
+import "os/exec"
+
+// cleanerCmd returns a command to execute the cleaner binary. We do this with go run on Windows because we can't
+// delete the temporary directory after the test: the binary will still be running. c.f. cleaner_posix.go.
+func cleanerCmd(_ TBSubset) *exec.Cmd {
+	return exec.Command("go", "run", "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
+}
diff --git a/coderd/database/dbtestutil/postgres.go b/coderd/database/dbtestutil/postgres.go
index 567fae0dafc48..a55a99f972ca2 100644
--- a/coderd/database/dbtestutil/postgres.go
+++ b/coderd/database/dbtestutil/postgres.go
@@ -166,6 +166,7 @@ type TBSubset interface {
 	Cleanup(func())
 	Helper()
 	Logf(format string, args ...any)
+	TempDir() string
 }
 
 // Open creates a new PostgreSQL database instance.
diff --git a/coderd/database/gen/dump/main.go b/coderd/database/gen/dump/main.go
index 1d84339eecce9..25bcbcd3960f4 100644
--- a/coderd/database/gen/dump/main.go
+++ b/coderd/database/gen/dump/main.go
@@ -35,6 +35,10 @@ func (*mockTB) Logf(format string, args ...any) {
 	_, _ = fmt.Printf(format, args...)
 }
 
+func (*mockTB) TempDir() string {
+	panic("not implemented")
+}
+
 func main() {
 	t := &mockTB{}
 	defer func() {

From 5807fe01e4c46aeb4de5680f1e793a2b8d20914b Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Wed, 8 Oct 2025 16:23:46 +0400
Subject: [PATCH 085/298] test: prevent TestAgent_ReconnectingPTY connection
 reporting check from interfering (#20210)

When we added support for connection tracking in the Workspace agent, we modified the ReconnectingPTY tests to add an initial connection that we immediately hang up and check that connections are logged.

In the case of `screen`-based pty handling, hanging up the initial connection can race with the initial attachment to the `screen` process, and cause that process to exit early. This leaves subsequent connections to the same session ID to fail.

In this PR we just use different pty session IDs so that the initial connections we do to verify logging don't interfere with the rest of the test.

_Arguably_ it's a bug in our Reconnecting PTY code that hanging up immediately can leave the system in a weird state, but we do eventually recover and error out, so I don't think it's worth trying to fix.
---
 agent/agent_test.go             | 3 ++-
 agent/reconnectingpty/screen.go | 5 +++++
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/agent/agent_test.go b/agent/agent_test.go
index d4c857dc39637..ca0018076728e 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -1807,11 +1807,12 @@ func TestAgent_ReconnectingPTY(t *testing.T) {
 
 			//nolint:dogsled
 			conn, agentClient, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0)
+			idConnectionReport := uuid.New()
 			id := uuid.New()
 
 			// Test that the connection is reported. This must be tested in the
 			// first connection because we care about verifying all of these.
-			netConn0, err := conn.ReconnectingPTY(ctx, id, 80, 80, "bash --norc")
+			netConn0, err := conn.ReconnectingPTY(ctx, idConnectionReport, 80, 80, "bash --norc")
 			require.NoError(t, err)
 			_ = netConn0.Close()
 			assertConnectionReport(t, agentClient, proto.Connection_RECONNECTING_PTY, 0, "")
diff --git a/agent/reconnectingpty/screen.go b/agent/reconnectingpty/screen.go
index 04e1861eade94..ffab2f7d5bab8 100644
--- a/agent/reconnectingpty/screen.go
+++ b/agent/reconnectingpty/screen.go
@@ -25,6 +25,7 @@ import (
 
 // screenReconnectingPTY provides a reconnectable PTY via `screen`.
 type screenReconnectingPTY struct {
+	logger  slog.Logger
 	execer  agentexec.Execer
 	command *pty.Cmd
 
@@ -62,6 +63,7 @@ type screenReconnectingPTY struct {
 // own which causes it to spawn with the specified size.
 func newScreen(ctx context.Context, logger slog.Logger, execer agentexec.Execer, cmd *pty.Cmd, options *Options) *screenReconnectingPTY {
 	rpty := &screenReconnectingPTY{
+		logger:  logger,
 		execer:  execer,
 		command: cmd,
 		metrics: options.Metrics,
@@ -173,6 +175,7 @@ func (rpty *screenReconnectingPTY) Attach(ctx context.Context, _ string, conn ne
 
 	ptty, process, err := rpty.doAttach(ctx, conn, height, width, logger)
 	if err != nil {
+		logger.Debug(ctx, "unable to attach to screen reconnecting pty", slog.Error(err))
 		if errors.Is(err, context.Canceled) {
 			// Likely the process was too short-lived and canceled the version command.
 			// TODO: Is it worth distinguishing between that and a cancel from the
@@ -182,6 +185,7 @@ func (rpty *screenReconnectingPTY) Attach(ctx context.Context, _ string, conn ne
 		}
 		return err
 	}
+	logger.Debug(ctx, "attached to screen reconnecting pty")
 
 	defer func() {
 		// Log only for debugging since the process might have already exited on its
@@ -403,6 +407,7 @@ func (rpty *screenReconnectingPTY) Wait() {
 }
 
 func (rpty *screenReconnectingPTY) Close(err error) {
+	rpty.logger.Debug(context.Background(), "closing screen reconnecting pty", slog.Error(err))
 	// The closing state change will be handled by the lifecycle.
 	rpty.state.setState(StateClosing, err)
 }

From fa82f841c786f77dbd9440779ba579fc014e3193 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 8 Oct 2025 13:43:44 +0100
Subject: [PATCH 086/298] chore(docs): add documentation for exp CLI commands
 (#20019)

Updates task documentation with experimental CLI.
~Generated by Claude using `--help` output.~

Should be merged alongside https://github.com/coder/coder/pull/20020
---
 cli/exp_task_create.go |  22 ++++
 cli/exp_task_delete.go |  14 +++
 cli/exp_task_list.go   |  26 ++++-
 cli/exp_task_logs.go   |   5 +
 cli/exp_task_send.go   |  11 +-
 cli/exp_task_status.go |  12 ++-
 docs/ai-coder/cli.md   | 230 +++++++++++++++++++++++++++++++++++++++++
 docs/ai-coder/tasks.md |   6 +-
 8 files changed, 320 insertions(+), 6 deletions(-)
 create mode 100644 docs/ai-coder/cli.md

diff --git a/cli/exp_task_create.go b/cli/exp_task_create.go
index 7aeea13a44a7f..b506d679eba3f 100644
--- a/cli/exp_task_create.go
+++ b/cli/exp_task_create.go
@@ -29,6 +29,28 @@ func (r *RootCmd) taskCreate() *serpent.Command {
 	cmd := &serpent.Command{
 		Use:   "create [input]",
 		Short: "Create an experimental task",
+		Long: FormatExamples(
+			Example{
+				Description: "Create a task with direct input",
+				Command:     "coder exp task create \"Add authentication to the user service\"",
+			},
+			Example{
+				Description: "Create a task with stdin input",
+				Command:     "echo \"Add authentication to the user service\" | coder exp task create",
+			},
+			Example{
+				Description: "Create a task with a specific name",
+				Command:     "coder exp task create --name task1 \"Add authentication to the user service\"",
+			},
+			Example{
+				Description: "Create a task from a specific template / preset",
+				Command:     "coder exp task create --template backend-dev --preset \"My Preset\" \"Add authentication to the user service\"",
+			},
+			Example{
+				Description: "Create a task for another user (requires appropriate permissions)",
+				Command:     "coder exp task create --owner user@example.com \"Add authentication to the user service\"",
+			},
+		),
 		Middleware: serpent.Chain(
 			serpent.RequireRangeArgs(0, 1),
 		),
diff --git a/cli/exp_task_delete.go b/cli/exp_task_delete.go
index 361a0cfe7c576..43675057bde79 100644
--- a/cli/exp_task_delete.go
+++ b/cli/exp_task_delete.go
@@ -19,6 +19,20 @@ func (r *RootCmd) taskDelete() *serpent.Command {
 	cmd := &serpent.Command{
 		Use:   "delete <task> [<task> ...]",
 		Short: "Delete experimental tasks",
+		Long: FormatExamples(
+			Example{
+				Description: "Delete a single task.",
+				Command:     "$ coder exp task delete task1",
+			},
+			Example{
+				Description: "Delete multiple tasks.",
+				Command:     "$ coder exp task delete task1 task2 task3",
+			},
+			Example{
+				Description: "Delete a task without confirmation.",
+				Command:     "$ coder exp task delete task4 --yes",
+			},
+		),
 		Middleware: serpent.Chain(
 			serpent.RequireRangeArgs(1, -1),
 		),
diff --git a/cli/exp_task_list.go b/cli/exp_task_list.go
index 18b2bec95db91..e4d558e35d611 100644
--- a/cli/exp_task_list.go
+++ b/cli/exp_task_list.go
@@ -67,8 +67,30 @@ func (r *RootCmd) taskList() *serpent.Command {
 	)
 
 	cmd := &serpent.Command{
-		Use:     "list",
-		Short:   "List experimental tasks",
+		Use:   "list",
+		Short: "List experimental tasks",
+		Long: FormatExamples(
+			Example{
+				Description: "List tasks for the current user.",
+				Command:     "coder exp task list",
+			},
+			Example{
+				Description: "List tasks for a specific user.",
+				Command:     "coder exp task list --user someone-else",
+			},
+			Example{
+				Description: "List all tasks you can view.",
+				Command:     "coder exp task list --all",
+			},
+			Example{
+				Description: "List all your running tasks.",
+				Command:     "coder exp task list --status running",
+			},
+			Example{
+				Description: "As above, but only show IDs.",
+				Command:     "coder exp task list --status running --quiet",
+			},
+		),
 		Aliases: []string{"ls"},
 		Middleware: serpent.Chain(
 			serpent.RequireNArgs(0),
diff --git a/cli/exp_task_logs.go b/cli/exp_task_logs.go
index c7224e6185bee..6c99df3edf7aa 100644
--- a/cli/exp_task_logs.go
+++ b/cli/exp_task_logs.go
@@ -26,6 +26,11 @@ func (r *RootCmd) taskLogs() *serpent.Command {
 	cmd := &serpent.Command{
 		Use:   "logs <task>",
 		Short: "Show a task's logs",
+		Long: FormatExamples(
+			Example{
+				Description: "Show logs for a given task.",
+				Command:     "coder exp task logs task1",
+			}),
 		Middleware: serpent.Chain(
 			serpent.RequireNArgs(1),
 		),
diff --git a/cli/exp_task_send.go b/cli/exp_task_send.go
index c30c3597db177..4d9e10bbddae5 100644
--- a/cli/exp_task_send.go
+++ b/cli/exp_task_send.go
@@ -14,8 +14,15 @@ func (r *RootCmd) taskSend() *serpent.Command {
 	var stdin bool
 
 	cmd := &serpent.Command{
-		Use:        "send <task> [<input> | --stdin]",
-		Short:      "Send input to a task",
+		Use:   "send <task> [<input> | --stdin]",
+		Short: "Send input to a task",
+		Long: FormatExamples(Example{
+			Description: "Send direct input to a task.",
+			Command:     "coder exp task send task1 \"Please also add unit tests\"",
+		}, Example{
+			Description: "Send input from stdin to a task.",
+			Command:     "echo \"Please also add unit tests\" | coder exp task send task1 --stdin",
+		}),
 		Middleware: serpent.RequireRangeArgs(1, 2),
 		Options: serpent.OptionSet{
 			{
diff --git a/cli/exp_task_status.go b/cli/exp_task_status.go
index f0e1e7b865860..a43fd4feedfe2 100644
--- a/cli/exp_task_status.go
+++ b/cli/exp_task_status.go
@@ -44,7 +44,17 @@ func (r *RootCmd) taskStatus() *serpent.Command {
 		watchIntervalArg time.Duration
 	)
 	cmd := &serpent.Command{
-		Short:   "Show the status of a task.",
+		Short: "Show the status of a task.",
+		Long: FormatExamples(
+			Example{
+				Description: "Show the status of a given task.",
+				Command:     "coder exp task status task1",
+			},
+			Example{
+				Description: "Watch the status of a given task until it completes (idle or stopped).",
+				Command:     "coder exp task status task1 --watch",
+			},
+		),
 		Use:     "status",
 		Aliases: []string{"stat"},
 		Options: serpent.OptionSet{
diff --git a/docs/ai-coder/cli.md b/docs/ai-coder/cli.md
new file mode 100644
index 0000000000000..6d337b458d6a7
--- /dev/null
+++ b/docs/ai-coder/cli.md
@@ -0,0 +1,230 @@
+# Tasks CLI
+
+The Coder CLI provides experimental commands for managing tasks programmatically. These are available under `coder exp task`:
+
+```console
+USAGE:
+  coder exp task
+
+  Experimental task commands.
+
+  Aliases: tasks
+
+SUBCOMMANDS:
+    create    Create an experimental task
+    delete    Delete experimental tasks
+    list      List experimental tasks
+    logs      Show a task's logs
+    send      Send input to a task
+    status    Show the status of a task.
+```
+
+## Creating tasks
+
+```console
+USAGE:
+  coder exp task create [flags] [input]
+
+  Create an experimental task
+
+    - Create a task with direct input:
+
+        $ coder exp task create "Add authentication to the user service"
+
+    - Create a task with stdin input:
+
+        $ echo "Add authentication to the user service" | coder exp task create
+
+    - Create a task with a specific name:
+
+        $ coder exp task create --name task1 "Add authentication to the user service"
+
+    - Create a task from a specific template / preset:
+
+        $ coder exp task create --template backend-dev --preset "My Preset" "Add authentication to the user service"
+
+    - Create a task for another user (requires appropriate permissions):
+
+        $ coder exp task create --owner user@example.com "Add authentication to the user service"
+
+OPTIONS:
+  -O, --org string, $CODER_ORGANIZATION
+          Select which organization (uuid or name) to use.
+
+      --name string
+          Specify the name of the task. If you do not specify one, a name will be generated for you.
+
+      --owner string (default: me)
+          Specify the owner of the task. Defaults to the current user.
+
+      --preset string, $CODER_TASK_PRESET_NAME (default: none)
+  -q, --quiet bool
+          Only display the created task's ID.
+
+      --stdin bool
+          Reads from stdin for the task input.
+
+      --template string, $CODER_TASK_TEMPLATE_NAME
+      --template-version string, $CODER_TASK_TEMPLATE_VERSION
+```
+
+## Deleting Tasks
+
+```console
+USAGE:
+  coder exp task delete [flags] <task> [<task> ...]
+
+  Delete experimental tasks
+
+  Aliases: rm
+
+    - Delete a single task.:
+
+        $ $ coder exp task delete task1
+
+    - Delete multiple tasks.:
+
+        $ $ coder exp task delete task1 task2 task3
+
+    - Delete a task without confirmation.:
+
+        $ $ coder exp task delete task4 --yes
+
+OPTIONS:
+  -y, --yes bool
+          Bypass prompts.
+```
+
+## Listing tasks
+
+```console
+USAGE:
+  coder exp task list [flags]
+
+  List experimental tasks
+
+  Aliases: ls
+
+    - List tasks for the current user.:
+
+        $ coder exp task list
+
+    - List tasks for a specific user.:
+
+        $ coder exp task list --user someone-else
+
+    - List all tasks you can view.:
+
+        $ coder exp task list --all
+
+    - List all your running tasks.:
+
+        $ coder exp task list --status running
+
+    - As above, but only show IDs.:
+
+        $ coder exp task list --status running --quiet
+
+OPTIONS:
+  -a, --all bool (default: false)
+          List tasks for all users you can view.
+
+  -c, --column [id|organization id|owner id|owner name|name|template id|template name|template display name|template icon|workspace id|workspace agent id|workspace agent lifecycle|workspace agent health|initial prompt|status|state|message|created at|updated at|state changed] (default: name,status,state,state changed,message)
+          Columns to display in table output.
+
+  -o, --output table|json (default: table)
+          Output format.
+
+  -q, --quiet bool (default: false)
+          Only display task IDs.
+
+      --status string
+          Filter by task status (e.g. running, failed, etc).
+
+      --user string
+          List tasks for the specified user (username, "me").
+```
+
+## Viewing Task Logs
+
+```console
+USAGE:
+  coder exp task logs [flags] <task>
+
+  Show a task's logs
+
+    - Show logs for a given task.:
+
+        $ coder exp task logs task1
+
+OPTIONS:
+  -c, --column [id|content|type|time] (default: type,content)
+          Columns to display in table output.
+
+  -o, --output table|json (default: table)
+          Output format.
+```
+
+## Sending input to a task
+
+```console
+USAGE:
+  coder exp task send [flags] <task> [<input> | --stdin]
+
+  Send input to a task
+
+    - Send direct input to a task.:
+
+        $ coder exp task send task1 "Please also add unit tests"
+
+    - Send input from stdin to a task.:
+
+        $ echo "Please also add unit tests" | coder exp task send task1 --stdin
+
+OPTIONS:
+      --stdin bool
+          Reads the input from stdin.
+```
+
+## Viewing Task Status
+
+```console
+USAGE:
+  coder exp task status [flags]
+
+  Show the status of a task.
+
+  Aliases: stat
+
+    - Show the status of a given task.:
+
+        $ coder exp task status task1
+
+    - Watch the status of a given task until it completes (idle or stopped).:
+
+        $ coder exp task status task1 --watch
+
+OPTIONS:
+  -c, --column [state changed|status|healthy|state|message] (default: state changed,status,healthy,state,message)
+          Columns to display in table output.
+
+  -o, --output table|json (default: table)
+          Output format.
+
+      --watch bool (default: false)
+          Watch the task status output. This will stream updates to the terminal until the underlying workspace is stopped.
+```
+
+> **Note**: The `--watch` flag will automatically exit when the task reaches a terminal state. Watch mode ends when:
+>
+> - The workspace is stopped
+> - The workspace agent becomes unhealthy or is shutting down
+> - The task completes (reaches a non-working state like completed, failed, or canceled)
+
+## Identifying Tasks
+
+Tasks can be identified in CLI commands using either:
+
+- **Task Name**: The human-readable name (e.g., `my-task-name`)
+    > Note: Tasks owned by other users can be identified by their owner and name (e.g., `alice/her-task`).
+- **Task ID**: The UUID identifier (e.g., `550e8400-e29b-41d4-a716-446655440000`)
diff --git a/docs/ai-coder/tasks.md b/docs/ai-coder/tasks.md
index 78b9a9adbcbf0..878c542350472 100644
--- a/docs/ai-coder/tasks.md
+++ b/docs/ai-coder/tasks.md
@@ -63,7 +63,7 @@ data "coder_parameter" "setup_script" {
 
 # The Claude Code module does the automatic task reporting
 # Other agent modules: https://registry.coder.com/modules?search=agent
-# Or use a custom agent:  
+# Or use a custom agent:
 module "claude-code" {
   source   = "registry.coder.com/coder/claude-code/coder"
   version  = "3.0.1"
@@ -128,6 +128,10 @@ Coder can automatically generate a name your tasks if you set the `ANTHROPIC_API
 
 If you tried Tasks and decided you don't want to use it, you can hide the Tasks tab by starting `coder server` with the `CODER_HIDE_AI_TASKS=true` environment variable or the `--hide-ai-tasks` flag.
 
+## Command Line Interface
+
+See [Tasks CLI](./cli.md).
+
 ## Next Steps
 
 <children></children>

From 6c5b741bed0d70b4be3a41b66cf00f0e0e91ac10 Mon Sep 17 00:00:00 2001
From: david-fraley <67079030+david-fraley@users.noreply.github.com>
Date: Wed, 8 Oct 2025 10:32:21 -0500
Subject: [PATCH 087/298] docs: list tasks CLI docs in manifest.json (#20220)

---
 docs/manifest.json | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/docs/manifest.json b/docs/manifest.json
index 0cfb2a446fdca..df054c789ec25 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -914,6 +914,13 @@
 					"path": "./ai-coder/ai-bridge.md",
 					"icon_path": "./images/icons/api.svg",
 					"state": ["premium", "early access"]
+				},
+				{
+					"title": "Tasks CLI",
+					"description": "Coder CLI for managing tasks programmatically",
+					"path": "./ai-coder/cli.md",
+					"icon_path": "./images/icons/api.svg",
+					"state": ["beta"]
 				}
 			]
 		},

From 79736154db612b649579c541677f8d0bf76d9d41 Mon Sep 17 00:00:00 2001
From: Jiachen Jiang <jcjiang42@gmail.com>
Date: Wed, 8 Oct 2025 09:14:14 -0700
Subject: [PATCH 088/298] docs: add documentation for upcoming Agent Boundary
 feature (#20099)

## PR Description
tbd @jcjiang

See a preview at:
https://coder.com/docs/@boundaries-docs/ai-coder/agent-boundary

---------

Co-authored-by: David Fraley <davidiii@fraley.us>
Co-authored-by: david-fraley <67079030+david-fraley@users.noreply.github.com>
---
 docs/ai-coder/agent-boundary.md           | 121 ++++++++++++++++++++++
 docs/ai-coder/index.md                    |  10 +-
 docs/ai-coder/security.md                 |  12 +--
 docs/images/guides/ai-agents/boundary.png | Bin 0 -> 485326 bytes
 docs/manifest.json                        |   6 ++
 5 files changed, 139 insertions(+), 10 deletions(-)
 create mode 100644 docs/ai-coder/agent-boundary.md
 create mode 100644 docs/images/guides/ai-agents/boundary.png

diff --git a/docs/ai-coder/agent-boundary.md b/docs/ai-coder/agent-boundary.md
new file mode 100644
index 0000000000000..e7605d1481bea
--- /dev/null
+++ b/docs/ai-coder/agent-boundary.md
@@ -0,0 +1,121 @@
+# Agent Boundary
+
+Agent Boundaries are process-level firewalls that restrict and audit what autonomous programs, such as AI agents, can access and use.
+
+![Screenshot of Agent Boundaries blocking a process](../images/guides/ai-agents/boundary.png)Example of Agent Boundaries blocking a process.
+
+The easiest way to use Agent Boundaries is through existing Coder modules, such as the [Claude Code module](https://registry.coder.com/modules/coder/claude-code). It can also be ran directly in the terminal by installing the [CLI](https://github.com/coder/boundary).
+
+> [!NOTE]
+> The Coder Boundary CLI is free and open source. Integrations with the core product, such as with modules offering stronger isolation, are available to Coder Premium customers.
+
+## Supported Agents
+
+Boundary supports the securing of any terminal-based agent, including your own custom agents.
+
+## Features
+
+Boundaries extend Coder's trusted workspaces with a defense-in-depth model that detects and prevents destructive actions without reducing productivity by slowing down workflows or blocking automation. They offer the following features:
+
+- _Policy-driven access controls_: limit what an agent can access (repos, registries, APIs, files, commands)
+- _Network policy enforcement_: block domains, subnets, or HTTP verbs to prevent exfiltration
+- _Audit-ready_: centralize logs, exportable for compliance, with full visibility into agent actions
+
+## Getting Started with Boundary
+
+For Early Access, users can use Agent Boundaries through its [open source CLI](https://github.com/coder/boundary), which can be run to wrap any process or invoked through rules in a YAML file.
+
+### Wrap the agent process with the Boundary CLI
+
+Users can also run Boundary directly in your workspace and configure it per template or per script. While free tier users won't get centralized policy management or the deeper, "strong isolation," they can still enforce per workspace network rules and log decisions locally.
+
+1. Install the [binary](https://github.com/coder/boundary) into the workspace image or at start-up. You can do so with the following command:
+
+    ```hcl
+    curl -fsSL https://raw.githubusercontent.com/coder/boundary/main/install.sh | bash
+    ```
+
+1. Use the included `Makefile` to build your project. Here are a few example commands:
+
+    ```hcl
+    make build          # Build for current platform
+    make build-all      # Build for all platforms
+    make test           # Run tests
+    make test-coverage  # Run tests with coverage
+    make clean          # Clean build artifacts
+    make fmt            # Format code
+    make lint           # Lint code
+    ```
+
+From here, there are two ways to integrate the open source Boundary CLI into a workspace.
+
+#### Wrap a command inline with flags
+
+1. Wrap the tool you want to guard. Below are some examples of usage:
+
+    ```hcl
+    # Allow only requests to github.com
+    boundary --allow "github.com" -- curl https://github.com
+
+    # Allow full access to GitHub issues API, but only GET/HEAD elsewhere on GitHub
+    boundary \
+    --allow "github.com/api/issues/*" \
+    --allow "GET,HEAD github.com" \
+    -- npm install
+
+    # Default deny-all: everything is blocked unless explicitly allowed
+    boundary -- curl https://example.com
+    ```
+
+    Additional information, such as Allow Rules, can be found in the [repository README](https://github.com/coder/boundary).
+
+#### Use a config file (YAML) to set rules
+
+Another option is to define rules in a YAML file, which only needs to be invoked once as opposed to through flags with each command.
+
+1. Create a YAML file to store rules that will be applied to all `boundary` commands run in the Workspace. In this example, we call it `boundary.yaml`.
+    A config example can be seen below:
+
+    ```hcl
+    allow:
+
+    - domain: [github.com](http://github.com)
+        
+        path: /api/issues/*
+        
+    - domain: [github.com](http://github.com)
+        
+        methods: [GET, HEAD]
+    ```
+
+1. Run a `boundary` command. For example:
+
+    ```hcl
+    boundary run --config ./boundary.yaml -- claude
+    ```
+
+    You will notice that the rules are automatically applied without any need for additional customization.
+
+### Unprivileged vs. Privileged Mode
+
+There are two approaches you can take to secure your agentic workflows with Agent Boundary.  
+
+#### Unprivileged Mode
+
+In this case, a specific agent process or tool (for example, Claude Code or a CLI agent) runs inside of a constrained sandbox. This is the default mode in which Boundary will operate in and does not require root access.  
+
+Agents are prevented from reaching restricted domains or exfiltrating data, without blocking the rest of the dev's environment.  
+
+This is the fastest way to add real guardrails, but a determined user could still operate a tool outside of Boundary restrictions because the broader environment allows it. This mode relies on tools respecting certain settings, like HTTP proxies, and can lead to silent failures if a tool bypasses them.
+
+#### Privileged Mode
+
+In this case, boundaries are enforced at the level of the environment that the agent lives in. These are workspace- or session-level controls, including how the developer connects to it.  
+
+Currently, this must be turned on with a flag and ran with higher-level permissions such as root access or `CapNetAdmin`.
+
+In addition to process-level egress rules, privileged mode locks down all pathways that could bypass policy, such as restricting or disabling SSH tunnels or parallel unbound IDEs. This delivers deterministic, policy-as-code enforcement and offers the highest assurance for regulated environments, but results in slightly more friction for mixed human-and-agent workflows.
+
+### Opting out of Boundary
+
+If you tried Boundary through a Coder module and decided you don't want to use it, you can turn it off by setting the flag to `boundary_enabled=false`.
diff --git a/docs/ai-coder/index.md b/docs/ai-coder/index.md
index d14caa35c33ab..eb1fe33d7f24d 100644
--- a/docs/ai-coder/index.md
+++ b/docs/ai-coder/index.md
@@ -16,4 +16,12 @@ In cases where the IDE is secondary, such as prototyping or long-running backgro
 
 ![Coder Tasks UI](../images/guides/ai-agents/tasks-ui.png)
 
-[Learn more about Coder Tasks](./tasks.md) to how to get started and best practices.
+[Learn more about Coder Tasks](./tasks.md) for best practices and how to get started.
+
+## Secure Your Workflows with Agent Boundaries (Beta)
+
+AI agents can be powerful teammates, but must be treated as untrusted and unpredictable interns as opposed to tools. Without the right controls, they can go rogue.
+
+[Agent Boundaries](./agent-boundary.md) is a new tool that offers process-level safeguards that detect and prevent destructive actions. Unlike traditional mitigation methods like firewalls, service meshes, and RBAC systems, Agent Boundaries is an agent-aware, centralized control point that can either be embedded in the same secure Coder Workspaces that enterprises already trust, or used through an open source CLI.
+
+To learn more about features, implementation details, and how to get started, check out the [Agent Boundary documentation](./agent-boundary.md).
diff --git a/docs/ai-coder/security.md b/docs/ai-coder/security.md
index 8d1e07ae1d329..86a252b8c4f2e 100644
--- a/docs/ai-coder/security.md
+++ b/docs/ai-coder/security.md
@@ -19,16 +19,10 @@ not access or upload sensitive information.
 
 Many agents require API keys to access external services. It is recommended to
 create a separate API key for your agent with the minimum permissions required.
-This will likely involve editing your template for Agents to set different scopes or tokens
-from the standard one.
+This will likely involve editing your template for Agents to set different scopes or tokens from the standard one.
 
 Additional guidance and tooling is coming in future releases of Coder.
 
-## Set Up Agent Boundaries (Premium)
+## Set Up Agent Boundaries
 
-Agent Boundaries add an additional layer and isolation of security between the
-agent and the rest of the environment inside of your Coder workspace, allowing
-humans to have more privileges and access compared to agents inside the same
-workspace.
-
-- [Contact us for more information](https://coder.com/contact) and for early access to agent boundaries
+Agent Boundaries are process-level "agent firewalls" that lets you restrict and audit what AI agents can access within Coder workspaces. To learn more about this feature, see [Agent Boundary](./agent-boundary.md).
diff --git a/docs/images/guides/ai-agents/boundary.png b/docs/images/guides/ai-agents/boundary.png
new file mode 100644
index 0000000000000000000000000000000000000000..34f8d14a6b6428c1e863758257143746e531babc
GIT binary patch
literal 485326
zcmbTdbyyTmw>VCUNU0#rqM#xY3(~NFf`YUHf^>H`i!>5Sij;IO-QB%(EwD(#vMk-P
zyVQ@*d*Aoo`+V<zzkQzBnVmD|%*>fOwLd;7%aT2ye}IF7Lnim}y($jQ{aG9w{Db@V
z?rIoZSD)hG;Hp|lOMjA+mVWxl*}>e()(i)SHr_2}j3da25o%zfJrYgz0$IWGnbj^K
z$DBw~btdLlkVW+Mr+M#h=O4v{MIJVaHaa6&Xjm{5oNJPf8qF1e42$jv@9jm@bo0f<
zd^5#V7JIxq-k%by_kB>%MDL5}9YP^;-J0>@Es-arp^z6{@UpbEAXBq_qTTic6$Pl;
zW!gNE80Ob|S)*--HuHtzqg3uoy(tJsH-T)lqbE#VFx*loH}0@(WZ(hwU&i7?EfGE%
zV&Y}u`fYZ*FAYz3Bd-sCOA7y98kZEC-Ah^fi_!WP-jwt-BJ`E7_w9PfP~*d$SI4v^
zzn%xPmj|xBn(PT?8_4Dh)0~CIyfR$AxL7PoZwl-v?a-JG7w<%h)Rd~X?tivi3fiH|
zqno=BVESOey?XJb;RuhOoNLDoSNHmpS4~Mh$<XVxx7U0NRFXJPO^gr{kK_JfvWD4L
zIddf?oY!~d`#89vRyYKACEUA2f0ypoA~pnv=q`VJm)>XM{Ret~HWU9pW&DGG8opDL
zmXo{7)l8ht%<Nq(9bCVzmC)Xinzd5@>iShlQPjl2j@!u8!Pt!3)6Vf96daJJ=v~py
z%+=_rr=6|6i>RkK%fDKP-j)BU2C_W;R})toah9)2pPouPIGa5c<mTb#VUc+7^yyQO
zv#GhL>U)`gqu>1!XR&m3brb~xJv=<PJ@~jCoGpO7A|fI{o;ScZZ@BJSaJhi(U5z}s
z>|I#@i^zZIyf<?(akg@FwQ{h3`VU<rV+S`^aTb<;I{NR=e~r`3)9QbEvUmCSwC*Md
z{09Q$<>mqYH|;xA&_A`JpR7F1Y_;B7+1;_{t`7-b9v&gkzYzWp=zqHWU#MUI2ldSx
zLH_@Z`oBQ`FX|T;GiPZBySq+ZCH`k^{*C;<f&WGX0soo%|Ki1eG5TM%cbt}Z00RE^
zs!2Ss`+V(%gYy<g?)^J;Pu$%!aEzIp)_HZ2{oeGK#pz4YFV(!Hq<o}LtCYp?Ux#;)
zHavaG-Eisip7zEDZB_7y*4pyB(TaS5Wmwp&pDYhp#HvWUI7xXfT`x}CzQEhO$ADu#
z_7)i;_4}<~>YIwcDZ4KZ{vK-HNC6+4wy~)|Nes|kdB1-B;t>~Tiei=oypETD%E`sm
zi{3gV`oSQ#m?e5O_{lnR>TO|wDt_KQd9pbAR|5Y(DjdzMGIMfRPcJS)eJ;;~FAv%!
z8O6Q$hsVZ3%NCnGZY3XVY;1H*O{vE<^*7!lNVIts3rXh`o_%W7+5lMa8glUXR-4^z
z?lxf$NXeVGZLN)I)S5GE#nM|s7T4#6GXzV$eI*tP(s%0VA=*4-$J?t}B?SP?hfcS|
zZX(^bbf@Vc8_l+@k_*q;<NRYSxYd$;`3PKoRiWXZY0X66TgaGyQm<3xe)MH+K=*n+
zFVwyM1Q}Saht)aooIL-CqBuk6`|_P_cP3)?_A*ActM$bo801;rg#Y~E<fnFibr|pZ
zq~j-5E`f?0ff#0nW2=jtyCJn|oQ)gGbF|jE-(6`sW5Sc3BHrx!a0R1zaN49b+tOJ?
z@uH|62~(K|V1B?r-w#t`g*-X2f>-Y$htk?7g`@rQJW1j9Hy!iJfRihc*2!7ta)Au?
zG>$Xu*34*KqkEl&nA?2=n@$rkq#lXx-jtEPpK>|BGEz@LLQRyT)t=4o&@inuE<<D0
z%gYNdbed7jol{X!@jW(vbab>M`nOF}Q`4GTaaegA*1bqeIsKR*1zDq(5dUAxEKYBU
zBCDSmnW;%GwIF7g_GndjqEqHR?(n?WN<gQa2~;W&Wo~9wx1@cdv)1k`Fy7y%@w)MH
zPkvRcp>~Zo@3VfnBL1E&D&EP_DNA0br2)%b_;1qx*;48I^oQQf6QG)Duf1^_)^zPW
zBRcKiV$Jr&t9K~pmCAGpjbuNOes7V(2Gwf=&Ib1_M=q>hQP5EESRCrib&>m8E8o4|
zLkwdh<dE<O?Yzo|1dHp{tNHcUQrj(Z15#GWw9#X^zWm|g;aOdU0;bB!${}hH<qt#*
zuZ4nK#RVF`0~yspFvaRB(}P?(HK$alfo`#0ql5y)&3o?+x0=01XxXyjf;|A3`=?Hw
zkL%kr{=(WAOrbhGGRb3I&J1tVEYeX|3u$8`q?u60ZDBR{cNEj6IEQA+DXvK`haI2J
zHMxmH;A*-(2lAMqAvw|BgPl8o-o3q3ue=srPT>;=FBPIcTsCy&l4R?9PPL3>9}H}T
zqKo4zzqhyaEx6ZeT7~XSn*M<N!!sFrPthnL8(u%lTvS!de{ped@@;e9o-3zfx!P5m
z@{rG7m6vm)e(SNuF~fv4A&uMoK#EoQ-3}YcK-ya@?7Lgl5ASVIEY_w#-Rq#*tJV;J
z+I1eBV^ti<(W*~e1{$^o4<U38w%m6p!1JZu?#D?et_=IU)?;rZtaN1%u1977)=gAs
zO2bNT)Q%g8ffX?)0%)H|7czqYdH^8GAW-}3*D#mtO~W9_$lq#<?t$NICg!1n$BD5c
zmqYB4BvKafehU;clZ4N@)2>H!nUBdICXK%CdW^35L3g{Y@^dLL5A61_w)uKHM$5^)
z8M6~Z_*I-Ie#@b<&!G6!+COm}PY&&-5!pDm!c_P@@q49$OwIJUO|7qf1;{(+Smx~H
zFme*?jd2A?7%W*geeuR%_mt}g{c^D28x0-FXouP@nJZm;B-lsS{tAV$d#;jm3~GDh
zgBcaF+6iCu1z&30H7#D1CuBVKwG$ZMKi5A%&uFCVP+VHin_SDOJI7fY*6!(amG618
z+7&~(-K<n>Y*g}m%Q>$%px<To=B=+E8`zx3!Vj!rG&;ADoAJofzukE=noBqIM=<Ma
z8T8;Wa_>d?fd(uw#aAaDXwV+#0shvsaOzTs8JX8C-clIxD?a@f;ER{pHS*F%zdhHf
z?$4h;#M08zMqbvUqDwI}l8@p6cHOnOYah;3#99MXTZ$X&!UKF1*8>mZ{B?p`BhpnH
z1|v4BCMszU-8x?JX-0iviCjTBx%H^w6~(^RR{zX7EpQ_=9SeD=7k+MC4}b?ki`<>D
zZxzn?<BOA@&vQ8hHU%r3C>76lX}(k;c@KA+cAryfi<E<)ebQ!5YKJ~0l<S!jZoozz
zUJ5G1m0*24Nut~yiu&5hqGTV=Cb3qH{~Q3(-uW^cm@Q3PZCACn_&RbJqS<|64b~ys
zdtCR=4nDWeT)b{fGa-wuOKCs1KG+H`UEK2)u{_=~4#(6f!Da$X=0=cF11^mw$AcAZ
z{4sSjsYuvP_&kJJNCn!aHn##B8&&wB1Apsl`!wyG$pCV8cXSK#;oNM?aBh#(ghq1k
zT{fdouD37DWkZ;;stRgTK0?o#b>zWw=b03%7d_#8ZSFfYi=wtdel@*b8@yu-Tk1q@
z$~$>?1Z?LOc7z=SoB+4hj=1x8xA9+PfZENZ&1Mb#zmCM3!cKWYJrx}3+^T`qDdkpc
zo7{2VbgOMag1;VIAu)Q<TkhLD%WW7}j$;&N5Ter=U*1gLcHHo>{<jdqK`6R!XBI7z
z*(brjxVV^AJo)9ftU+ke_w@Ai@%ecMEEa40;bATw!>>muM2&r039`nU=#53Z@y8Ld
z_1BfpWq<e5sufG8zq}Gf^1cs)9Q5x5KQFsqG{<AgP10c@yp8|<UhycG6lof#LQLu#
zybEEe4#KZM(zs(_j_e=nfVZol^oVH1gE;Xo{;%JMuvMiZX(^mcw5qf<2bUFXHYJ(|
zwKLka#PasuG4M~0O-_Otii=rWQj<wJcG&DShdyYx7md7^wvD~fR<Bl^wa#(sIweD#
z=0&VF0wk@py!3j?o%oA`SQv+p$So8M{1t5#l4!o2S2MW-8gYlDthPT=st?~m!bZoS
zA8Jm(BWr^Q`<IK{3*hvWti=LlfJL*X-TMo9ZrRYQq>`-VQRTF52)`_ueqrYuR-hzg
z;$7?8G=AZ<`T=jz;6`=$hCtpy3ybdwxGbd$-ppN;0=1a+!f-ph;Le_Z;Qe{g9bpS;
z*%0d0>T!?&mO3zEgeiUl9bV`~>$hG}-902Y2i8YVj&#3Q7wErEEKe!beBUiRqeEIg
z(vS2iQ&3z&KHu?zUH7h|w#Jp~M%2qki`o2=51QDov~`6P*pQ`<m`B!Zzgv_J{>pm-
zrayAxUDu0R4u9AFi=5lN@ho8XYHl%~MkoF3WBD(=JiGBQziq)Tq9_F|3T&jOqS?8C
zBY~ls=irH3RdVrV%H&t3{2_|Fn^u=Zyv*aq^2q&Y_M=}utU!NIjn7TfxOT(rMFlvi
zcBNA9s+7>7@G6lcgMDmg3+p_w?6py?*YcNprfDo`)GK^G4_Z58AcofE0L*u$>=~DO
z^51w5`;y)8p(h;oKD~Q&+t2wpwguGv;Vi<nwo>oGgCk477fmv*rplbTJ^GtH69IUD
zhiB2b`J22PLy!vJe)+`m-|w20Lwwjbb#!X|ig5YX0^Um8+GM>>Lgu_W87t8ENvE~<
z6{1Ghw0U3j%PUcJ)0nHshGIXtZl#iv_D3azP>KNlCv%G%;1uhhKSbl-keO=_#OY64
zO@)_Lp1haswIr1;JS8Tz*5e*u>RPb1)C)DwBu|^ANX}bo^RjPNPd{yXl&7)1;q=E{
z!taF@`qdgCy;WN|6Fg_S07RkrT;WlaxA->Iw8D|lYmY_bcBwi=Uu&{3@Wk4Y&Rs-H
zFI3n7SWW~VfxFyzh3y=XI<PMfZHbf;>58XfyrxD%H8$6cfN)pVKQLzloy1%pJIsj{
z%3#z<^x20E{>6{nr%oa}g@D_By{VZG;KC?XhGRE?=Fgmu9_(%Lx)8J`Ui%CWO?bN(
zRs~rM9n!8*kcY#;SY=2{v%Q!J%<74Scxwq2^J%zY`0<Q3Tj_T8=W7<apN0ic;Iv(J
z#Rv3Yiz<Hc#M`BF+Z1+XxYKS`wnTC{qG>NmCktk~$O4`lxv)MI;DB0N>MG81D5a}=
zY@zL&2ghnptXA}ddcWw`=LeYYZOa#ix@){vsCF!^ee1LrE?1ls#KG#(x^pDITK+^t
zyYO3KiKF;QLpoSte&^o;lmR!knGxN>=&7qxmxw|-j~fgif=d%5m@$|E@RK5KBP!=T
zshk1G0C3Rddb)>6!8x@v5vM)yc~lhn7s-%KLCS09H;Ket6y}hQ7#b$KL*LNwll#U>
z1JoojPP{Ayc}f%wxyi*Al|EkTbiTs87N1X9t~bYHClCZFuZshRmipZ1TvxcO?u+X=
zDKQ<I+ZjGF6+Y_uafTrYnvUZ(?mx8ftM=k<^mO{AG+TG9yS@`!rYS_BlT@c|Y-8G#
z%_Q9V()t5BXL0IOwmGwqGeb~O+V)p63p?v)D#)k3rVw(;jLe*!xWpp3N;=B@v%_~b
zyXGs;%58Vsx1hYmOlw&0&}t3HYJq?4i3aByTV4hn^I)KcU?%LQ2y2ha_CfSj!HhFC
z#N?|V$ErwqXab!jPKAauYCuo{qTkvA*q$DOl_m<d%=cKqJ=$OxXB6bD;CH?rTjb8F
z+)l}~+oQcJ0<yXO@d!?vUX(V%jp4~w&ZE8f4*o7M?~o2s(qOqM2vsu-@2O)RLcW2J
zrL4&hX}5BBEx(Qm*K1GT-HXiwq<dld+jX^yvABtQndv1~Z9B=zfHo#8guSe;ie@C5
zGdpcNtKdq0<Xh9A5Bogq9Lx^>>QJ+DhGdb@Dbyh_*ode1Y_fdHv<$Ps#z3E;#16Ky
zQ&dM4igD*NOd2Y=^tDGdWEP!;_308G7yU<K|Bn)A*lN|`GIcuTgL))O#K1RV8pGTf
zpX#0#{&@aRCcVX|fH0$JK(TV#LS=t;Wto%o(^2b9pd&Af!7WR=wXeogj5_4C4YdW*
z6yJamy71Z;F|+mN<*VGOf{Ac%GoC*V%C7VNQe39qpJW~ErRz5eejAOvE=sL?CY6p(
zjD7XB&qhW>qn*l5Bl;z#E>AH5awA~N=a%un$4EKfZm!(x$=RRj0p}_G%0;L3W5}yd
zpu9g4CU)~O3H=YJ2KAz6sfxd7Fa@ZzCrdxMuT(By{8}w{$^MuOtup`GIboBX%VuhW
ztY7!ocqn#omi%&<L?agx=dQhsiGo$tHYr<Sl7+`SKI@Bt-|T@FH7sdE5mbV`I_l{g
zd2sfqGtaa^vzzUsjB*`y;K<3H<S<jCeYf)RCrb7A>vtNXU}xLZ$Z|-Fdil@*-dKW2
zu$D?yTnm*=rvA4^@$jsw1*C1);m|a$LiJe!0wK>?tv{n(2TJoguh5oI3~dOL`RBn=
zLe;WzXJ<?f8mKM1h8yZ7bcr}LHUP@9uc$8K??zyoruV}+;f<aaegAw>TAUjDiQ8n=
z5N6If&*#E9fk=cChUA2LtuwXGDVLZSqb})}^x6Q(SKy{M0)}EeGU6fg<V>t!uhw*d
z&pnXKyXT~Nz4ZUx1S?Wx>nOKe7&vX{2N3;!s;f&XDI<g8yw50hsJytC<K`)%ibSr=
z?sXGQ*x!?P`h?gq;y0tcV^6X4n<_6e72@(|FsAQWKjFR)dp(!*xz(NpkNM|x`wPTp
z(b&Rk5tS*;Po2C4)J2JOY$AXnPd*~ncLkoj#b5LEx*r20;``iL4ZfOO=c)qK5VjPd
zmVpNDENatliVB+7d(;Q!xYD_6GS6Wu8Q4K>V2~2VhC-#(=m*<DPhFqDP-moyEuEgb
z(^^d_ElEBE!n!J-r^>)O6Z^Z?GEqHWrlnrB{=R0L!3L~@Um@p<-uh9pyF`1~L3T@g
z*OS#jR9?d>pAu?EFl9p`;ogwSuFc^5JB~cqpj)#Q#Q9G&3q6>LQxk4xbtg&agS8WR
zbHkuib<;bbHt#!ygrhWLaLeW-HahFw(w*5O)#U8-l)yK{Wq}hoB@}6H#O*GQ&bj{M
z;!HM{?!paKC<<3sMpP`6p-!EJff|3nf$8N;5KxCpwKvT)z6HSHb8Fm&SL^6drMAR;
zA<@oX(1w%P-t1Y-v(_>;O2?29xYa!gifUa^6^`BvePC$L-ztqmB+`MfPRn=F3oM>%
zW}_sQR~u`C9@;6U19fQC#diov=aj&{;&a%w_ay-{=r=Ph%k-y!1J#QxMvpi#!@Prz
zS@&j&OB=;?m_n0(K^uTmJ(xHv!Jr+`)OPuB;#N5T5lq`Lq?_VKUxwP)SgV$~Gbs+A
zU`Mnk+GA3}6SZwx^+9sne)2=L!9y*}EBt~A71!D%+zz3w^odUOk5hbqvbNq!+(9QF
z^OryIGF$vV7N~Ft?uOm4?9uO4sKCjWV{jCUd$Ntxi?oiaf=aWYgz@F&4Ds(HqrpF1
zD2<$*-$>`HnIzHTwU}2j5@o~WAD?u-SRlS1?)-D}A+wR3)Ha`rlZ%YS>?>(0bA|#c
zXh}bWT2DQ}Xyovzs6p5ozSPRd!jpnu$n`rR_K}IZVr1r%?*wV;qD@^3*@EGzTCHp9
z^r?=H_q9LetiUIxU!Y#_Hf0i=trCzYe21Tk64qDnFmITc4C3ah2{&<MRg)-x;7fN_
z4c2IOtRS9kdLR0}d7ij(VP7|8OvY7JxEoSA#HxI>bl<=TJhcSA3_}--?(MEm(HkXt
zs9Hcj(e5r&do>YBC5l3K7hHv1_G9MuA~q-8Nq*MSW??@^DnYG<aC4oX<ZU^8z@S#E
zoM|<tt@}Btd}+)sEYnq@xuPK=zN0X`Hi-yRh>Tg#1IJeJR->JnQX_Nod_kEG${<qw
zhgpD|KCiFo8C1YijUWe+JDZa3*yv~<FQmR+h`gwyi76s9$-k}Y(MAiPe+=$1$Ll)j
zbtlG`g<kzq*_FDrK8tk~9j*Q`*6<fTPt)|RiIwa2hi7ty3CupvH?sWY5#%gK;<<|8
z4RCpE`!BxeN~qmrRD?mRPpcEJWIVpMl_-)mW4UDU&u#X(Rj_{gjr?TkxQ#}ex45Ne
zOGRsz!(8<FJBawAcvdk>sH`3&E4{5Ss09;KesJ#5>UAA-9KQ)v0cHs54TZO^hJD>C
z>bdDNcBl78$@+PZx};O03}mALWJKx0nU}wJ)y*Q&ibq<qHN?1{(8$9QvqtdK5aq=E
zA!+F*W(xAY-kYt$tykqk;p^^n3<NI88Iu{b;iYOrisDjY>jU#@A($&+dx;%nb1LnP
z?QMTYE9GUTV)lD*%hs=D(~?lhu?!gdBJ$L*rDsaV&N9Ki`fOOU`b<+5DCx@uDW_^b
zc(I_e=I!g0HPf~jzdsI}r-aS0pLHrRjEs$h{`vdoE7e}Ms6j_Ur4^P4ktZz=-<#sh
zxD(dlPJni+^%EVrp!xGr3ouPCb2lF#_GRvI^8&&`V(*B``-wP3R&n<E$u-;Kab}1O
zx(HD;#Dp4xzadjP?DnJYuf7^}2#GF$ZhL!*2oFXqpIYQwoR)|%qiWsvIjd64(G66N
z2|~>EgARbDEf4@@vfMv!>&L4r5w-Vg_MP~*krSu9Jh0%Oq@=J5={}-U1w)W&o4rp?
z2EXB@?`jZl;ALS1X!L+it@VCL+t0r67C@(xK9@m1$j{+k+dVc$%+2_N7BhZ{Nhif8
zk|a*zPn#Ve=f+7Oy~!D7EbnNx7q<?#{f8*zVF&O$+L!p(SRe`&H}>_jUxZM`Ioh0d
zyR#fw-&RrYf*K{<hl40g*rpU#y%()XRW`=1rY3*r<$8JlWRz<KwVCfd5?&7(?dW(r
zTkl{%%fLV)8^uVh0y=sx{O#P9vl+)Po*PUsq~Fs%H1lS(LHM>lj6!~3Y=^Rq@z}AB
zXmF%`M>MUE+r`$i9*7xtOa^;1Mi=3Lv6^0UUMzKhMj6REgJa_T@J$XbS?H;P>yNhM
zJ%#`mzvO8S!ws7}r$GwW)eID@5z~kUQQWRmCL@bWE~YLw<mVyZ6=s6XLh~f#ec})b
ze<=o?G8u{Pz8anUQ6F4uoe+Hu7M)%Mmzogew4Y<q;Up;d;hJ|0-L8_*Voi-vcZehQ
zbj$I0ec-SKB@W!3tz?z>UfF*%E=>{a;EiB-RLT5&jngUe#+6gA!7?`1$ZL?_`w@!z
z8hh`udnF{`(^lbTWP}#6*PG$7ZKXUyE|!nN;M^WLQAdBCJdghTlfTQH<q~?`snOF<
zA3cjE>dLx3_A%OE+(_UroQbZ@;6D1YHM5rTHL#pq#PgM`Zh?_yNl}S#FVFZR7W!WP
zCnDV`AyT)74lxJHNvR1D){tH>*W><xe7?cNiD=;-%G-XnLx1PS@5xuwp)nem(K(s|
z#b`Q^*IN>=SKVOiO1@K%1LAp^47!le`XWo-RB;y;Mo}+=BrQ<MX>MjM59EqUA;hM!
zeQ)XnJjlc}m$?O)+AxX^vxvfValWtpH8s*oRIIZp{D;65zBqspb5!wd(G4C9Z#%DD
zT@7U>&$!;T=<W<6LddWo2=Iq{Nx@9HLXq)@M&A8WZvlM+BPl{d?jha3RV3)33W9Qa
zM6}(FcE>d*n6iwSoTxKsEp*XaZ!!+$l;7ZO_f=52tZBPw))yMZ6i#B>hiKB2vIYO@
z#Xh5GUaYZFn{D&?rW+yYy7{R^M4$LgIU8Mx%dV%lH|U&>8ft6PBmAqPgCQ-=6iVKa
zzlZXMV&1@<8&~zlu3^Y1z5P?|p4s{S{*SZG9uB%a65eP>VV4cXQk8B71bfuWG2ip*
zZat61Cv1)ew^(?0`|V|W=(mH`diPi*(U-X`ETLvEGi(l<e6=rB^&m}s<g`LtK|r4^
z1%%H!hXF<&y?lGUY)SE9kFdqexSBL=f3B9}+-NrpQyg@*daB)5sGI-0UKR!6wHs|E
zAo{Y;mTLtxHCY;&^}a$MQ9aie3c6%}OZG;UE<$p|2FLeZ<tnhhrR#B_eZ@eUm`9)c
zsmufLtdJmhr6Yi(?~NfQi>;eirlJxDB-nxO(ET}L3@?R9B?bX|^~!ydRj&Eh=SPv4
zE2{jzHm-q@lo8RhCRFfI6({PWj(g91n0=0h2X#yC3-(qo)LJ!+-l_FaYm*ZkhpSZO
zqm7fo--#~_poe`Z>@dm2?qABZc-#6ilO&`u!ivyb#9Pz)&sp3cO3?XIL@5oDBcavN
zMO`W9+By3!B1do(M_8K2K9gZ5g5L$NPdyz*Yf~cIHv?t%11)Jb3Z_ESYq)-vh0ozE
z(6GLp_fC%Xs!3B3-{Bm~aa;4=rXL0Gyr^qA{EeyvERRCk%#@D43c?Y9z{QBj$X*Qf
ziOVkO_1`|y>e$(ulPh2-hXGvJU#?t@5u9|V^L4Pms?*O(4)vDL^qfjBdVWx@;xnV)
z8s3bA$8EAQmq5L5yi_1f&dh@+sWV4s&P}dbZTrrm+4cbLF=%`$ckCjzdZC8GC(7bk
zYI_o;4rKPZ%j5Ku+2Q^R1%wbc6ih$bPRo12lfLJvg_)3Lj&$)Fx_|8jG9X=&r~f}*
zz7eaAlL4Eu#+M)j-B_5-SqXgE@Ai82mn`6ii|Bbz`}Lj!)J?8JBWd%<<XCpNC#F}S
z3_Nb?T&xfrUY&`PmyIKNKk3@Fr%;)J?yo3SUpg;!h)n3Zr!#2bqMg!ce>TGOv!2MG
z6^#JI2X#^a595(4Nq<^Cdq2b`9@z3pfJ4ms138`dxm+2MQI^BAQ@dR<A6B0%kB<(U
z7ux}D+}{hUVMf@vrE!T;!gRWc{c$!o>K=p0mr0|Lr(u+139UL^QAc)J&Fzn)n8lxr
zE{H!ef4M=x5q(qio4m>zqs>k0KJ@EKpoONY4WK&1)Z(Z#U&m(1N>_#!TKi(c{>X~c
zEx2u;%gA$u{<<#sFUDoHMw#(}(c8JA_j|pA)5Q@G8NrDH?-#KH5(G1PbPu|vzjdv2
znCH>dy!$4aswd1sl%f`UQpm<o@?Eu>$DVbG+T0{A)G+mEzvX09IJ08wXu8~2pyF-s
z#?xnZDDy3TwK31t0q^OcoQ1QUX)SJMPhg$hd>vN{x)(?;wBRU>o`p(Kw;cupdz5(Y
zY4xc{$q&KVqrtwqM6)#jD=F=L8@P*TapRSNVT=Ef&+>(j(<3Y_<Hi+@hDrj!kYUe6
zsB5~4;r))Ip_AV#LR~w@Ufxs_Jc_NffMKHW9nSo<{ti4=5<zC{c<5SJ^Zcya&Z>@;
z?@#z~>HGBf$@W>t!if4scb$eC?2Zi^B8y~hjV}YEh+b!tq?->Qtd+_77}~LZW;qv!
z`y0sS#}&BMWKc2CjmLoK-MPDyHcN&ZI<o~+WXU6#a{r{Z?wSF^$qiQ;F87-eT|y>h
zX60<*RzWbg>PDRzA(%6)Rh_qm$9!!wH0b5;FZ*;Ciyj6GwADANH~rGwuEC|cK4;UP
zA;OkEYm^yb7XZhNGsL-y6LKfl46~!|u)#4h1ZT6mc1bHIAwN#iLAahBC$@v?#I8H5
zRx7ZWF+YhpVqtp1!*{SM(Z&0t$PfjLa=G4td{p@QNPQZTZQ1Pf;NWWXAmRjXE<x~l
zpWK6Q8#huql$o8;q8%>UPp;D_Q!V|l94382?U<4KC>X6`{i}P?d$G=wAF8N21&iPX
zE%({L9Y@mC*yrS>2n3>1lp<SLeSfJ{tgSyFYV%U~IdV%2+84Ss{s^sqR;2l%_3kz{
z_&NG<9Tnt;3xX@7c92^eL-5yjm<|WJM&%Q^a(+%W8h#M<=V<T*hyKye4#tc0Z~Mf|
zS1UxUS_n%T6^?kb7mgd^6wRre9iNnKJ$K7qHIyCE^=*0atgD4yirR1q2d^j&w33Ro
z9rZCF@W@7=4?mf_(ffWPKZN-ESk^>PXYpRdi_JBkgKq|&yOq$jS>tO;KHp<q?6zjR
z=qLxMPc@{Q1;GRS+55Y%$mIu1>$J_clg|Xz3E&N=AR+TCnW%9odD=?EK$5VaAT?|@
zGOc0f=w2HYDlfJ?ter(4q>*=4XhApWy`9avFFqU0^aUoWYog}k<Fh(vQ%>gKdy<k9
zbm4ae_3NPt@dsxAfmZ5@0*P8SPW)9)ey(dp$#9sBXBqG;wX6^V?*qM8NpcW)JG8>5
zmp92!s~biL(q_Oxo=v4WtPF|IZII#mNKu}(HNVV>mi${kir2#gFh=tDR7C${p2M1M
zC*xr!5pzV8LI<5-o=cvAjz_|xlfJ!eG)mO=x4?%!!Ft?l+SV$K;HW|yP+tZVb?oi?
zxhcNs!{KNU5YIi3tYSYPXY<?g<&x(?B_e%CM*_yS2ZFOB{*T6bXIUGY_zE!^9Rp?1
zTzLkB!ZwM^y4|ica4DsHad_o&S@eZDYm|0oEst@X4W(u`)tEf*e;T8dfeL58x@5=1
zL0SDw8U^i5NSWX?Zs#uXeKzKmF5I@W`8moC3v@CU_M|GCII%<&n|sT!WbZNJm!h+l
ze5@wV196$R`qR3u-n;%%IhntLcyz!!AMO7{i4<vmGiPw82rjm7eI2p?m+E!5o{@gk
zTXC$Ahx;=|-@}idS34@-VbM;EHuqc8L`On?M~JPehC{Iytxm>r7I}QO3j&YbK^EUO
z0kP7f-9@)b@ruO4=^;UHg&$X1<<uvvZ&p8C=TU`y`=T$h_H{{SZ^O%K7*aaALws%F
zSxK~QBxY42J3!w`6}^Wm9LUV+Z&BIpX3};T7+P&gib}%z_P>en&(Z7Dttt1U@^N=2
z%b?PUl~%RTRH3Dx1z^9O2S;I6dBng^Q$++gJ~h3&mpGyJW^E{SNKuH{W6&zxeHbO{
z^$5_qzQ>-Sj4ZDE?Wy&6Exjz#$g|tcXlH|Wb>d#nS|^Wy90}}~6RE0nK`$TngZDT&
zow(ccw4(JJ^*pue-!gl7f^fem74w`cG6zp-bkqSlYOV_}X!!2p8$PTp_u=wJcQcbS
zUvJ7HvJ;ZRR|~OP=}XRM?<~I|=G;5n9-wMW<_F}B9St*5cYDp}6!ec{8w!53w7j$X
z#?N(PBq5igvPt<9?dV&QDH);yTai0S?6!~yBaT2UeOy)Z=Nw&IF<d(K&OiKc)wFOI
z2%^F3O!@OrCj^u+C2NnD;wc<x)GbU``7rV~QMk~`y6mg24CuT(eOn~6nEX*WVJnp%
zhj$qv<8h_YcRoP)F9Jd3abgF><BjJGCE)8%Kx8O?)<?hv5q!+rd@o9mmfK+LY@SJ)
zB6a*6Pl8-9b-YVTP!jGGp=*1?lWqvHZ2-R`*CjxY%~LoQ>h=-Y9j9?m>NF$m?=gd(
zv0acZ<+frrQdl!2f<xMp*LZJx5-1@dM@L6@0RemuT&973n4!<`rGomF5D(Gva(>CY
z=45Y6dO&KQjebm!yD4eD!-CgNX{Cg+MuduIPxW7HFVMF#1d877?b|!{p2J{f-Hj#e
z3`V+8M|x#j8tZx2;|x_*k3vltqw4J~`h*0}!v0nu=CEen(KsM-b6eNX(fn+{ia-9p
z@l%Lr-?I92g&#SMP-v4!uFQW)hgj(G+)O~1kD@%@TXajJgCxUF$OS(;#$wJ4ZqE+?
z5r`)SCddAS)TVQ>^1ni?L&WwQSR<mM`go67nK2)qJ2dbMM%;O|)BFlePJ)>_Bqake
z&W*6BG>TMwZ1zH@*YFOZ558;!_uq%~3=H86dbg)4w^ZPM7_UAGWn!7{dW_5sN3$2f
z?~genXL2x3yI07~&xtW`lXQKJ9VsvwoRrBmO1ghX|DtJ@$gvFxI4o|*79VLnuy~xh
zq9&1m5F1-YCY#%LxKJZlj-A^rQjw>4saAL4m)CPqwou_epo_+_NOH;!-t$9~oRmfy
z7ea|(e8vlro!XBo_BzIcOa_YA(v)5R8abCpU&s6JW>kE()dJcE8Q0kSj@fcd_Ai%j
zZ~PI@L|NC7)mN3D{1RZ@y>W0aLCJA<F}1#E{(v{zk5Uh4n^)<gF9|L_&85HfLExwR
z`>d3Vw1yF?ZTu4cKr3|Cxr6Od2GYo`V-eU~J4i@%YOYeK*9PotGU=G#?rNkbA9|JI
z`_`|DF9GGV@{(%RrR}JJyAlHo)M0P$%YY~(fBK&2jdocG18z^>$yvMx(k~GR`m4=w
z8%C)m>`cAPH$>xpz29Yhw~hWua)saR&E~7?eUElA5DUaO5Xqhmw{O*Z;Jx``+Jma;
zb^V!4`d+Bb$v|ydCEZXGehyozy<^?Gdf{}JY@1(zfuS9NUI)>=2reR5E+O|$aYiBr
z#so0<`#0*bg8Vep5JC+3y@k=t3%S!f1Ev%5Sblw`zFo-ZFnE;zFWsGyh?|ip3Bucs
zAY?wbNJ3O9ze`8?rMHVjkqf%MeEq3%^2-lOL&5enrwHtV>WenL(dVj$$@tvv&f4<s
z3m4g`qQU~-{g|*(pF<hN*S8<-IOS>OsU~|u8*^x*xG6=W@y8zj42FasFc*Sco;-3*
zwZy(tA^F>+yG!)}iQuVtg$l%QxBi*reeyDpTCoRS=qNhuKKcO2{a8D$|Go@S8lg`P
zyJ$z)y((*B(PO%;u2M$M1jm>kF^6>o!RSA1a0n;8ZY{O0>(+1SeuzhOx2i#m+K8p+
z5>x&6tm1p!Q<Lh#d`^Ojib~(fuDgv~=kqJTFfyZ|zLC|Tj0Uk(&r?@dyzTwngnQ!<
zz<TcQZCuXJQQS&Xkmi@&f1`e9u`nrV=64x?pm3jTe@-RInTr=rO~}k!Nb18Lykv!M
zx<XSPKh_Sm-0JkVF~&O^3sqFnvRmipeomuQ8&t)@bhy?s!45z`isSM@Ym|C;r`7jD
z&Cg5q1iL+HS5cuFCmcN>tM@nKKKGazDndwfR%ng_1&(QLI1K&{>Z~*DZ_2lsipP@~
zc{(;TYRa7cDJ|m>6NeCbiHNynUn;7?3?{9Fm=r|61kkqnfBNiNko_z7;y&e;8tJ>O
z`ze{sulC2;KODyuZfl8#*AYwh|2|?;`TUq{mZE5x9a<RX@$S5yhe{MBOXV;bbmN+o
zBJtwd{-L)@Qlifem|9SsS*(9E8-Gr6j_=g;lHVbhNF}@WyZ#m=8~zMbiRqPef4E2C
zQjnkHMnbflJYQ{LfR=1O^y}stYZb94C`u?A*yguiY3Q7v{dTb%>4|P3CP@MDtFgf-
zaIPdX+}jW`NQJe;%AeR-(soOzJf)>1<Qhj&&ojck%zCzHRS90X#Skjg^D5fSUsmOF
zD4o(~6KFCzO7l++3uZG@!{F)JdbDTpRks)}_RwAnv!799+M>Rt3OuF;rvF^78Ics;
z`bOZ1NH&<ti-9A6c<N_R0iG4pN6(L=o;@@8qG`_tV~awb3QWtLq~$Lh_hNr-VkB$)
zW)9LHFxz}t4L}l69By6e^pyYHoRYMpWT8;%U;ZeGao(Jba%9=t9h{pvPI2!ecs<$v
zoh=ax`kJ>)6DJhdo`l?-KW;^dAN+85Xkx<<BKW=jc5@!_GHmEq@A0_AhvOjNn))RV
zHSb?sKr3~pL1y(U&o35khe7z>XPZK6V~3}Ha}2tN3T>Bf;9F><Xn$7<*tU;Z%uDg4
zR34;}9PBHY7!it{Rq0{XwF)z%=j)*Gxv<#wZ>LW9B{`#&;|!CP6m~@Db`S$1m~0=f
zs(10OEXMCzIu3ob6%Q~m(!bC{YRSwKT9qyOP6_CWD)(Yau^A^F9~^Db+D$*9{Hqza
zRw9RhjEUQp{l!BQhP>gk)r`hRE&xH_q=IUH(sJSX1vix5BS8mv$k>Uj1Uidm=ObfZ
zVnO)(GUSSl*?m<zKW<`fmtAMb$r18v)IOIi-<2%oLsG|KCv*>9Mt{Tw_{q(>%C+f2
zO-}0Dc}J$ptWyT2G_&GcZ22v{5cwto<j}fj=Rh*%cXI+v0(NL(yKg3se$_!W7M5l&
z0ykR76Na4lj`PrDs0KjGR`0QOM%98axsyB&dBUtHgSRjTpM|MfYNX+zEd7^D1btc-
zti`)OqGg3m`BHPxU=G+3dV{!n7tg}Qn-;C+X{tTsynX`QYae!4Nqa+dg6lWS-07@C
z^Vz`KFK~x)UeH+oOZ)nfbbUt_Lm3KHRml;|mqwLtb9`Mqp*UBbka*aAHGPutQH4K?
zES;9VLkK3Z$yQhE`CVpRr@s-7!<?a4eAPT$3H6xku9(dnQp1k&9c=P-=}=8LGC|ov
zo+6$1WErr8*WWLh$*Ec}_E0gy@Rf<g6D9~6F5L*W43<=ux<(q@APXoq9;6Cl1~uE>
zEb+BU5K7!;25|rNziwT=Y!xo!Nv}d9)&4BB8(-pN#&o4fj+GnhXk0>e%-<%BW6pU}
z5w+v(nCCLS8|1S@lDi@NqtAuIV*2E0=3gv#UOi)O$^@?Hb_s~eEGfKLCIn4NYJG_<
z0Wh$KjtK*bQg24wif9b@e4Sz^7?#m}jze7a-)}J)w?CBmB8WPk`t`8#&k$Srj%O~o
z{b7B)xm-3ce;F9<eu%zDzB_gvG&)khH-ccjY8d8i$vw<vS3t;I8A+Z3H_~ixs=r1c
z=ti$jpLM5Xgz5T~u<mDU68<eP7%D$DLW2yH>$S<5$MFCu!G3eht@+Ms%6fCr9RhA)
zrGCa}iz^Qta=QCdd8wE`ClU1t_w;XvDP4rp%^Ww^koV_^APlw-QQX+4-tQNs-j5*9
zqX&wXGAX;wbOB}`(Xtll%$Y#na1v_@@%GDft41q^!FH!xp|0kov$6tUADgnD4@zuV
z%Vx;(cIL^pVwnlUi_?^8ps=;4wm($g+TDmTuzr~P0{t%eTm{8^xM?vln_()+F1ayu
z6mKiJnH_g9$izH&&b8OPyKHvbrizk8qTS7+9fnoFZ7acYGdx<&r&qwyz2|Kik|2ZP
z2E5-Lo_ao>$Y&w)dS02hVL!NVQ9u8Fu=_g5o|U6Rl8Gfy&13sEo}8LQPQqtwT>1EQ
z8rD~kg1W2N;&EiLmyU8}oijoXsMo5UT5L)=f9IZMoLH!4kxc}oy_vL<C4O1z{5VNx
z3gxI?KM5hMdO*>oVC3cgQgmwAV<Z@}|F>ecRLLaOv8gIFM;XxLYCUk;rM}`H8zmtw
z9Bv+}9ITZzc`r^GZ)-~Cqe^I0V0`sESJCmVmr<aTcud&5sMbRSiS6X}YG!jg+u%Y@
z=umo8I!}&@<j5AEw7AZ<?hOn32Rda;WE22j9+3NTfaBUPH6wj&!RfZkefZu3xW1p;
z>}$4EJt2D%h)O!~3CcW48A?W%YD4`($Dv%XxR$x@>7vr8O7PaGi}TA#cBw_}?+Gp=
zcuViCf6lVJqPpf(l7*&Z(j>fT)i_N%w&F?+tNVViGbQza0^hoQbEs1^$Mua+Ihix^
zOYZNosC^z6dkyrI>Y_Dl8-Hv!BGoWA$3CqtXCuZW>a-N59!DqY)f2p(%?4nx$UohB
zEfRL>zU`?m_{-?Y;&vc&IMK<QN&SH;vmtY?OtMhvQ1V{FbhP16P}%x~vx6-~4-8he
zneO3RBta5xe*QG@Q-8cjXITE@UjSupEIiL$TRVnqhwsyMYszV3p3z@Z*`(C;`>6cr
zey**g?Tjbl)M_=BoOt0?DHZ+m2G_C8l5=kwHfU-pDxNb9gj8dzhR~of<7!WR|NJ=z
zIl*b(%r+QAqSyQ>xjx^vh&7wfoSe3LTR|_1i`sRQBh48%+qWM3gPMx^`!}ag$+VNG
z4s6aohcyvna6+yL!H4=^``Igm^FI=4`dF<JT?a>EceAU5zK&9UcG^@WE61i~!|0g8
zdO~Rn3zj+i+d4@{XZ_-|<8o#fuC&r}`Em*WFmzQrcxl+$2nLC``PX}RHh-^o{d#Ef
zd56gFkjMnU&_fQeV8JyLy^d>`D_j2-W6Xm{?)~}fs8edF(FL`ZPleAw^0TK>!t0CP
zN<cSv;n*50MFr>cBa;e(jIC}qN6_YFqzm9s>olL6X9clJ`|V;jrmGX*O>{$StxuQ)
z1p=Ma(S|3DqlhGk%CfW&(pN#D-rG{kDZ8BXL1R^TCc@B>O&YJOj-ZmOuSqY2BS$$+
z$m$0X8%MT%d|nnVq<<zTTC(`)45rL%qr(I))f8am#hv^gyQ0%FRR8uvm?nr*T*r}f
z{H-yhzP?Pth3p}~_4lEN1A%bTi%4q;v;47I@L?dIXBLsqaSTP9CC$qHT-N2E1I0&~
z{Aa{9%yn-?KtUuoFhizqC-JUvA1a4F3Ry45Cv+?HFat+j%;%yy$7*3c8+=l{{;$5$
z#PN|=#3+cLI->rFnWRa9<Zg+GM058F6~tm`4g{vp-_{GXb;{quBZEYzdI5#f$-MZB
zCi7SRIpm$f<C3^uA1conNQ%!Yh|mN=?mb`eeW@!4Af<K&?7s74ytttoKp%|4FTv}F
zVlR?}pu^I`^_W~zTD&*&ODjLT=d&>?s{sOlM6tAJO`TD6XWui3?;)2OdX0d@l~AS5
z@AN}TmY8QI*#w`m@Frn;A+wRXG9$8}F5`@xlmQc$LuBi3gRMi}laxG;WVl`h;gX&e
zP%N(pq+n|*_edp5{g!R|@tN&bcpqHzW|)JF-=*_1=@P8DEdM^T02>F~OigM{_fvYm
zW%g=Q380{>#5E1|n5SzPm$W*>m1Z)G32)l`8^ABQ-NjIYepY{(?IthMpsLj&P0u)L
zP<ma15AbE=WUx97^sb>pwAp<>XQjYYC}=6f5&iK8zjt9?A|Rq!EfZRL(g%gwc;)CT
zQGB^1pvi#s+*=71G~}bjuJ9TNv=Tc^<*X>d5o9fsFYDgT5iF@OvQyamc?xhFnp}Q4
zk`4zAsUvc%{glP-X_Cr`m|b-cD&fIDlOtvIUcXGzyfc1XFs&?5FNi@b@@;(X(fZcO
z9X<x#xR7!Bkb#D~b!mj*5J0E5ligCIdsx*^J;x(y1M<p<_bh&j8pu1fF@FcUlGU07
z^Na|RW#qo|>A~=bBu|4RHc=hf3cI*;h2i2j4*KjwQ5F(?WOvRgyZH#Zsa_1BaJSTa
ziyArS-N0i*06zHNg6^Eg2%L1#pmEBm6}fm0INg$myBpv88Hvx+kdsBe8NRl!8nW#x
zE+VHZKioZ*pN?fD`m@19>+r9#C|1S`p&q8spW=HF(D35Yx=I0#$KCs-B9t@71nfwa
zU>kEF{~@o98zLq=;k$^{V{6{x<9y_!f*;O9yR^cG?{$emNbuFE$_?f5AunG5QG#d<
z#~W=(4VhOyqn1)PnwC;TobDQb=$_zNrO0Lqa0Q*kb}B1&MEA;aVusV-Y4Y``cSnx_
z`4VO&0O<IRh=GXBZXnwEf_?qDQYQJH%{PBZrzb-lX8MJiHY!_VhnNP-D;%PLB$SFR
zx!2}s9UcIY4LG$1eOc{%cdI{%r5haqdQF69>x&$PfS){*Sgu-P^FCC-(Il&1XBEDa
z2ya&L7Y}nXPJ-C5Qgb&mN^xpMtQ(=JGo?_cxj^^q)bom{$e<%K`Ur>N)g;J6PK6T5
z3~|(N3P#Bt7Yzg@+RD#&{ABk2?Nl%@R9$7X`$w{S08!uLZGWOat0}Ic_MWMMM7vDa
z4`V1m8{+2jk{vqbhe54xW^jhS5&#_WWc7RrEZ?+!qJYqEFps|x-yXkVk8r~$#cUdy
zegqZ}*Q3_PgEUPQ=9#_o_dFYq?^8tFJY&8JOceaiy@yjiE(83WUSzuxs_7a*UJ!jl
zJR>fQX!&?fMqW?o=8vE6@U)p3bF;%sk~%J<ar2G>yRs^a!+hIczhvzUrN{mj=v6ya
zEv{DtmsBf)i~LU1SZ%}$uZdUWkq#lg_h@eg*O@UB_>!(6_FLVXbUNA5;N3TpHDg<R
z5JWi9VaR@=iQY^O#lb!stXgaNNSraXM$(&>2A&|atr)iYYsd1|`njdHWSKPMNyT{4
zO$`3mO(UJz`*mGF<ov1eWpRojUxzA@$OHw?tS~RSB#~b~^4j!1VmbM0W60@8`;>~c
zLmde;&!+@<`4L*!|M$&BXq7JgtFzyK0#Nvk4O1%WDqz3izaK<yEXKN-=GfSH_Pu;j
zJHjf%k-&J@W6Kv+t7TjD4=u9?x&_OJIU-Rv#);I4>jhP2a7)_RT(TK5=e8KNF!OY$
z0K{;m%j)iD@#pF0E(Q@jp^v!ai9aO1jMVYiq!dqavnI{}ZJSGpF}(b8vFpTj%nZkm
zW7M$JSy?mHC?Jx(*Oi~9{g82sBF%Zb<7mA=(3F~}_Nm4M{uA=&YvC}PwE@7IC%J6o
zPr>D0#7a~a4^I(U@;jv&Bo)8pGgLgK==Da}X4;fFgz+;06LVRe?fk=g9^~6oNqojq
zlvdX-$CSRa5=94hwgpsxq4_-g!+~|CNjt>LH*-NoMyd?-I<j4x0y*zuLuHvgL5vLt
zACo}2^-|PL-6g4v8|y8TY|z*v256VY^fxrFNX_tQ@Lw<&`PmMPD@C@epV}^8A>;Tb
zu^R06Y8WGJLP*Wq&lBBYFOR(K<rSzW|DfYxJ)kJ+MHeH}`A@WrdnDrB&bD;p`9J4u
zr6_nUq7=Umu&!-J0C=YITg82h5Q44jY<k?M+~3tKltb)AxX8%+f0<NrFp4{>|GxZN
z0UolXo#@^=U3V2e+zjCPCgXb4`nh;`8>ZWxa@ifSr_H!1{7@7L`o37f<FvnSnk(d@
zs;uO!x)sINU?|G@+LQwAGr2k<WaESqGkDIHV&~Po$>BA$8ID~a4X|{nG<JRZtMmRx
zLub#`0BRCbCs}uP*<9-%v7lEbkSdyZ^8mt!0Iz@zAh~q6QKkcA?cHkZ<-o!pNBiwC
zYpb9fMC#lhCBDB+sm-ED|4DeW(q667=v!8=;)iUUX`XzNIfAhK`GqYWKH%kV6Xnpk
z0AE}RJ%wxR)l|WXjGOl8%QNP!FB!L8ycXK0FE^q>2O25YWJ%nQ_*7=W<*6z6rtfuZ
zRU22C&3Txc%j-H&#P=H2Mp9FY{E)SKuA2SBN}kO*W-Io$ro%zOoO?BTJ>|@{sIpP=
zQNDTf4}+t|++dr(hLFLgZxh|rM*_L`I_Uy??@?EoXZskjwzg`2jBU-T|4}Hty4!_2
zAV77#y9D_V{>yW&gG~~{&SjiVE_uu<`B?Jk_|BMYa8$}fEnPtb5Ck8du1VX5y}a=R
zIe!7ffW;i{;y(Zby#f>&ockc`W{%SdKsG~I!w^XO6VH*eqDpv3s7lKgKPvKlo7U}J
zSWhpla5o<GY=5ztm9dgZrC=;YZiR<zTl8>z)cB#Y3?q|_-qL&IDgYXF7tsdgtpur4
z`V-PPh#nCW8csYp!=y7){5>S+c9qBOHy=bbp<v2eYu~|^RNWp}Y02>rA_+|?!yK`(
zVxyG+B?3<=NJm8jG>|yTc{2<#-|8O_F^enfcoITm#_9i!@;<mzcK-Md&D<%Rkchg^
zp=m20Ek}&b-k+WQs*8Rfz4^r38~@jNhzj1F&+Fxx6%n<^EJ3gkI-mU9injg*hEXLV
z;>yy`utI31{jAjC1NhnyU!3|Qn&7dZOmjt8&r95MVs2Au=q4UUxDik9=~(q$z)nAh
z8yKGkdq^P3dDw;T_Vr=!=ioYna6|DD0*^-}XL5Am$~81z?<MUyhKQBms5x{&Xw+ut
zW`KKchJSRO2QzmUG-Y*@NsN%lZCoTHC!1+AW0L{OOkHa^rXe*b=4^zYIvG<}yBEtF
zZrI3Z;^)nBuhCXzeIf%?XQVKtvh^-}4F4;0f1k0)X@w@bV}Ja~@hXnoa#P&h|B@)|
zy4VO;nQt~JB8bbR6(tRAv-X^Nvc^~_OvDinkHN+Yq!FtDwTraW%_h4Rso4~;=#HSp
zEElxVu1sPL+xa~e3ee$O#b_(WPIJe=rh~RiW54&*hJ_U6HLY8`H~u7|H7~9KcPE8W
z__#n;;_8=$$no9>iL)3A@HnmsM_p7)M;EhC(78FIfW%5eh{`sfAfAeWp>4N2t%((b
zXO$YG>o8y4|3}n&N3-?#@&8th8fmLFnn>DesoJ9vE2yF^lJ>1FYL6PVXRX+zY8OR~
zP$OOTsvXp<O^F>lb`UFsug~vye!uVkIrk(d_uTt@z3$`jyx}JCSADBqO)zAJv_`e#
z^f@|we8gT&_-e1_>TWP+y3Dq5@dUCEuPUf(OiVS`-t(Fa2|cLj8O<~Y>Bdrn0p8B?
z&mo{=GykL)kdu}fmzN8TmVUYHC<voqun*(HrCqagyv*hw;0FGoqC~Zs!(%53omY#X
zgq`l+w3YA4GL$8>|DX2Ni{<W8lDT1YI$p?<#u7}WKd}a>0EmAiOY(x%O%_!y($^N1
zU=#hPs0JX>PsgPs0eBP_tvSW|KL}!ka`$wA3D+?>Qo)OLGzTPA-V6#xb~w=OK4q{9
z15o%ko4uQ<kq2P~^lmf&5H((sg*UjB(azM$itUz;3W9i*pI<&7VhI=tX7tVNEz}+6
zj}VYYa~yIlza0>S$dg$;J~kLYJv5Xp{4LHdquO;hBE3L~)6Mh?%<@bfE6V4`c<`uB
zcdOf&9g1iv+yfjGf<B&AL1$SWgXs_(Y~BGl$+5462{&LHtx_!tUi9o%9pLO>lR<u$
zKRvT{OfJDpJj>2gXx=Loc!&S53jhehHOHBOe^+sIxqrd0rq+B^CYXweXkwYG?)UGS
zrQm5CH>*@M$?6kRRZPmbAXY<iMl@c&n$OS%msc?;s=Q`yj|=|m86<6rlaG(%8+ctI
zbf~!jRK!0(B|z%GXi~tA$S=pNhtHRf$bfdsW#;HsGH@4`8SBceK(q3W-ecIT@x!px
ziY~X@DpO}0DhtV%%MX_f&l;emLjO5G%T2al{~|}fxxK@F+S$(&ju-@b*ztS6{be?l
z&G-8pCu|9_<XGT5v>*hn1Y8oKoebfqU1|K_PqwjuGqDA%S#VcGVJ>wY0u;&STaf64
zDcJ#lWjf}e2>0eQzr8eF2N0b1oJaV`$HC0MRlo<a<o<i${Rs`A7!UNN6FijlR@0y`
zlL>J_I+OrrWrC{s#Q}u-GjQgXWZ>eZnM1W@nhN)iiLM_5n5UQM4iI%J0F#_eKlZ~%
zhhs}FG7ri#NS&z5(*xj6G#jatCw7B~-*0ABCZ@qRj)7xDn)F~jGbKzg<EEDJvI0S^
zsZ#@D4*zqcTyS!|e!vOO54$hx=wX-H5*qmZ*N7)oCQ!6Einz45Yv=8(NdxfBG0ip&
zAjUW1s3TOCI`bk+c#v8O@uv60u)97bWqrxV!+1?4%8%WWag!C^&O%Y2@FIMLyWaw_
z=k!W*qR?h%&7qqYmz=V(L*Y1uBy;|eJy3E$)byiPWfwO`-cr%_#|{~;G$si*PQsYH
z^NY-b#MS=aj)q^f?TnA)H1zr3`b$2<QH3B5iN~i>#_!BTAG(w}40@EfpT|e}r^pE?
zXPGS^%!9CbuUt(ygrkfnZUHyg(mQ0)r7J|{g+louZ<VObhKZkJRy^ngU1SzJQ`51P
zH+g-+RtcL3^Z3&G38W#<R2d{$fS$G4W~HB8d?}F~t}KTaA>5a$<cZ~z=j8}k?{YZ;
zYPL)nDB(I2^2+O^*_>{&ojA>KR+%>4BX<WsW(o_llcRS~ELG(I_$t(!I<u@_PxmH1
z@oKtS{6-|6zc(J_UNu{ygY9<Upm)3coxI*FAvYZ+B-aZXYd>t&Yz_9yVjD(wuN(c=
zSX3<8rl9727#@b_vbr?}DN_}^c5PEnN0Yc_tHY*GydrLcwEmdS_NaIh2U^Wne{=0u
zb+XuY*uwl5ZD9wUc5;<HVF@w(=6kr$F8=ejsj!?Fsvrki#}C?l+Zx995wmLP%c&_i
z6umKOvD&*}?y=JToOdV$<DHQ?Xjs9tgsU)!3jI{7%W;d<tt25O+-&j6ZSkmQNOT68
z(mJ!U$&y<KjW~<(J<-R~^^30-cGjf1EXQ-n<oDAbD)U+|{`r#^@b^`E>#OPwR#xD0
z>x-^`$|KwmDK48zA!;fV?b*`0#rLLyZyMCsC28Yi`#{lkJ3+$p5y{xM9O=L9(>GJ%
zI14qlr>C2Ju%l+!lktUJ69NZw%mhkgD0yoHJc0#VMRXcMq*=>-uZ&-HIxm`RO`joC
zeY5!nTZYTYDi3qo7`S#TkN6v`TdTMpdvsqG?DFt*lljGvsN3}w!MZkp#c^><F^LI1
zKHq1|W(!b#`{vQ7%H71G)F5U9G$LSib><qB!&uNrKH;&mgigP9=Ti;mNUwLLKXo}&
z-`T)j3--kF#u7?A7by}_FfL!=bm@stp~LnC1^vWfQ)C1uCm?K9U5Q4t>_hKUm1GJ0
z&r8!e_WQg)GIQ!QIiP&<D2;p=AtPOm3z6k_2c#tIm!|wcj$9+SqqmCZiJ*89ht0>r
zZa3>KCgt)!ClkJhx4AduG}+gI-s@*)MPXRhTWFtD$SaVc`W;Vr)@H#_Cp?hx#-YX+
zP<3(jA8SNJ`AS8O|5}d3!}m`>pg3R98iZY;+Eh3reScL5_2m&o-Ps0#xn?vVXauwH
zm5{f~i4%+q)RFot^msaA*dG>d`|dxC@^A}&q#`3I$-1796CcB*>|OS)nO?-1^XJnA
z!h);%1364VX`&n0!MGoQ`yUOlu!7aEu(%q=^q#9x-)dp+4&=B~b6!oxr68`biJULa
zE*?1kx0SuW{`LgSMUk*))^BkZc(xK4(E;(RKX`h{%z&_<;}**efk5H_jf;D@zZNvC
z+9dTL@HsQv4@LZ}YX{$4xVXRhCM~9ohbuzg=$xpje6#W5&~4%LTmWy|!1n!q=Klw~
zG9sAoB((9_mfU9rbkc#3R%kQW>53LqvW6ir<|K8cuK_zxKb)@J<SS3@m?sPnp8wu4
zkZo_H?H<3fyg3L6AceZVaIvPG(lN6#6T=V8_He9z#3XgqMpLAr_ig$wBA{#lm)vnQ
zBddW(_AQ7!zV@xX19qD_vmJxE8Um+SNG69DS2r#d&Jjy<UpR4T84Rd+nYkv>3D%c=
z2<aiHbIc4Z>iZyGS`7Y+N*Ph(m`JLH53y%n`Q|t2Sl!lUL-b2v^lNWaJ}8Y-pEOUT
z@x?1cpVkeVh~V+<`Y#)n*X&!Qo&Bx<X!*G-$~tN*lo81hV@<a=rYfc9-(HPZ|L=%S
zHVRt&d*Q|$`}@Y*|08>1S;Iw0IKM)S%-~t7Z7=w1($iXY5-jJMgN@OJsGA*Fa%7Kk
z@9nQ5!bS@xgvLlwTbT3u6?Dq%!7e^aB!EuKR3(s{2sr<XZq1E*i{flh<!+b>IN5aV
z!I_lYBZmi+D!Y_iIeZ^@_<nFye-X<eqf=K<EKkWXaS+_1olkH4gJnDV!^&E>7<~B0
zRj$<&lfuo@%}jFb*nA&mh<R^60+1=yArLi5TIclb!S);M$1bt0GeMSn5w0<9z7Ci+
z?TyW?;wiokQLaH<MM9MSNJ4SKY2oKF;%Z2*L%;x9xt)W;2DO-ejybD7ucFSWiwC@z
zQVBl)rW<p$LV7o$0|2ww9lTA=I*W^)nk@xRU`jDao=5L}pY1U>yB3?ZM!JTShBq=H
zO)2v!i`lh2C(u4_k&s<GOyF@!U?h-}9O!`FiFXYx?MuH${BYJ|4Wy>*gqHT-K46jC
zU-JS_UhxaMSm`=J*27Yz2>LkGPLwIgY0T(d|BTWOSXB<l7afHMST4*70yGtgmrkeD
zN_7|C>R$FW!MDw{dp4N|r|QVIyT&fAi~uQjfHK9t|9*Z&^a|HL(y+}*(X5EqF^REZ
z#5@ECzG(wE6GKx2Ii@D%c4+E$82LPTih2LqscpqfVWu>C#FeTN&?ZN;Hh#-r2zc@n
z_w$^r%~^>eh}=shm*Lk88!<7^Wg$Ee#aH(>I<)$Nu9xk5nCgBZB|t~9V!(KRDf$xv
zJcQj$xdRD`qkfc3K3Fm7ZQwJM|FOdBq5k9;jY$>bQ8tQ8g-GqFiT~-G!z^9G1P*)^
zCC1HCySF*&4mV<VCC^(%>v<WSNI|W^HA5GJR6S&`>%Xm)Xij28X{a9~3c}aMesmlT
zTM6Y-_Q2_PfmmzoATA-Slh_P+k3V;&=80W%W3Tk@!5vZA*=yU|J$$@>2d};**c9#5
z^aqH|%o1j4VeOS;O=tUq2&I{U?SbBlk+q8yiS)lCPb76+hj-B+pl&58dQFsnS2+|~
zwo=_oSHt^qwy$jJZ2t9+I=So)S`Hwn3RZBVLSrmFKIYO|MowmwE<Y>|(80g|*ZASu
zq*Win0ec6|8%b>zCq)l3xR7!K2i5HlxU>>0y3+!)AxBFyor)Wt#eT*a!f#|d;}%#w
zcz)Vi(k;j?DAcY5>_y1d-)_mVoZyC0x^3WlY2WlH%8HKwyuSmTd1kIGEoZ6n0zEq;
zdnLG41ba>fr4?z?yP0MY?!AEYSX6ilJdbHn5R>|RSd)`tm#3Vf`RAW<!C2CnonScL
z<dwHWf?vDmm<hMZ392}zR-L=C$-=olX=l9OA37oHOFvT^1mAT(r)~Ew&3Z@vbnu=R
zx&hg=&kz%=0<Sg^Y%*|Fyn<;!DVuEYp8rH5JbZc}V9~v4wka^szwxcM#jm&81<2UA
zIQ0KCjJO4n{=_NlEV)27{C{L?G*kui^tk%0dHwlFV}z>sNQ`^}N*_LNEB!GhYM7(i
zY4YZYh)=X|bS@dSb-q<hwxPfr|43hRzeso!kl#0zUoqOR${#R6$lp^M$ZyTh-*3hp
zg12-@%qWVyAoqMvr?(kzc0Y;*wc|g7O+gjaoz-?KFI+jDC*oLYlR6UP{+-Wdo<P%=
zI$NZJHn#-><^|vR&dqcvUON7z)<O1ZhfQRa{<XYNJ>==#?@%Pl+>tq%v*dQ!)$od*
zNPt52tS$sz!rv}C`jo)kab-&t53I$Fn(WS}gzfw+_hcmAhPZ!222zIS79i)|Fb`6^
z$^E|+rG>5kUFI~Wh;fvu;W;3$x5hn415Vr#cLXSgrJo(eoqK~Y#B}1PUGcMi?$%iy
ztA5qd(CvqLtAPp?)`t^gjnGE6psYdh&9>j2r_?6+j;X7^_T0^J%?3B`N9QO1s)=!m
zf@Yeekm(ED9!PmSi^p1X3_h@PUM583ZZ`{}Qf>GhM2n8Up-LRLZYUNvEQvZt9?<Z4
zJmp2W;?yv%e87AqZ)+=#pkJi!qidGN!(fJ?ff#6EpN_T)BieUYTyINiUV}6eY*Krs
zkws5hj@x1Kd6I~<4GXMsTPOfD?A|D5>kn++vkW9>1UI6~FFU&Sk8OW1Y*G&(7%1ZE
zj@=tA*CpHk9iRiVB8j@cUbyNg=W@8qZ8c3f{|?kmIg#J2usn&ypW#Q*aB>b_v#WzK
zsA(rnHbP;$R(j%+za<my0s`pC_qN6vFdnDs4xP_EoN%n9>drL(^=%FqKVr=~4=Hgx
zsp@2<ezFl?)+L4X4h1GO%SVRoV?P(vj09AAR6Y_l{+vP)+RWX6{FAH%DNC^@Em%_b
zfie~UQIBTo|2rCjYn>RyPzx)mX0ug0-i2K$dqX_%Cu6UNp9}~Y1<lgM((-j14mcwa
z?3t)2^P?X+a|S0Dj#klUY4lKe6osKVWM=Ip3i_#Pd*-Gu^dKxUt;>b5&b03Xyt+Cn
zusCx@%9t!><v)pN)!we?Bc-xQyXg~&L#5>8=92gRNaF166*?sm<>RG|$026{a$&@Z
z6q{LB%hYj2-sL4Lsk&Q&Y^61aU#2HOSCMbb22OV5Z);)_2Q+A~i9PGmid0}-YixQI
zdfmj$lQ<=Cwm*)o@rk7wW$b}wJ}!5*Bu*B{BFQAmX20U~Wq}IY(L&w(8f4xt#uv-H
zuk}Qxr4P4PqPAEXT^sH>jOWM_(ff=j><n9SqDFBBXI~8Sb_L=c&nWgjBQ(r8V82;H
zSd-Hm(scI2WnHJA{V?!k#${Ux5GHLSxcJNcj>D8^CF0BAd}hX5iiU4%QF>MQx^ta?
zHp_M%u~*pCv~!dpz{od)d9UFn8~6U_@?C{{vmuKMx_U}(Yc<Pn_0URgC94;8SL65i
zn&f18mEB(@ICsZ3Ot!>l_;BSdFg5*%i8Hxa{jOU+s@s45TPtcvSAOkP_r?Gg`@rqi
zc%!ECggsw161ykz%A;q^=$^yoO?GsaVgYBQK;H0-%Vty&$3nHqjR&n0#3aj@K951c
zvWlnw%I~h^G)vq?W57FZ+Z|i%?j4>Uzt8Myv>Xf6Azd!LN0o0r)T&0+DC8Ep?zUct
zZ4310VQ|TI3qe4k;>TS(?6Z}23B~N{NTy2OyP9cf2IGCvGa(sD-_Sg$m*0_?z|}#)
zkh>@2?t=TIT(5;-pyplmYgz~~d4mE!EXcYjC9zutrXZKA4w&H@D<uvc4_)(Ex|^G5
z;VXRM^$e!B9Q5{c&>QPTt|WXw8~CC@)r@sZwj-z~KE5uAh-JAiPx}<7r`62Ih@$4}
z5i7)z^uix~uA}mskN3&n?ymqHJ;+XD`$6ELt%TzbMHG!DMB?~8-*o8IEhd3M-Q!PI
z1{<7lZWTZ7_u5oH>d1pP<hQkRRAwT|R^vgTN)(Qh&xWmxt5~d7l!(@vvR2vZ1(GqO
za3kU*X|_fP1UpcdqtA>aUlg2tdmnY$v)EJq%_}L9129M3<J{F<8=P-1$q4nhla$n9
z>r$ZAF)s$XoM;o*r5Zg<zufw7VZoJtkB}2OC>g`_x}5`h#lZiTcaEZfN*-b7p4Pq9
zJVn%i&D9SvLy(hFNR)FPUH|-Dz)um5GUk?+1W2sU{pGn7CVei1zP@E?W;mdm5ZNXG
zoi@<6*`fBIpY|_&<z7m1{rX2?W+ztSLep^F!Lfmk2bSh0%OtHWib-wregDH~f8#ET
zu)Y<cDK%@g=3{-hSpNO*9ms9ChkZRgfHg{F_l~qwDUBu}2blRBed)H9`xjWm<3IzA
zhlc(&ATT>RmXH$83}uP$*p2(?IG5a(uYB67%ob-`8s~Oov2eEO9O$Q57%t<x!ZeF3
zC2H55?m*66E9h;@h(S|H<wu=gL%D(XAz<Fvs4x*2A)DUhh(5NhzI3OQ6teBDIzsP4
zdK3-DbzM04PA1>(K{C&Yac8zh-_+wOZl_xidE`gUjjWQ-Scr`EA`$%j>0LyI<4zmN
zOK*q~;p))dxl5CDpLsIN1|BI4MmSjU14tG8v@`lDcVl84#v+~S9oZ4kGXt|=<&9{a
z>dAvyuFV@6#J`TTIzy5$H~GJg-$6zX{aF;f^o*OLm+UepDo4{T8Xjcu?;i2K@0ON#
zmB^AQ5JR1dI-|54G!M-u7^o#B(VJiQF8J-Hk9{<F_9c;ly;b>*<b%D*WIQJd<V_ca
zuK+mGVu+v340@0c0)IU(q>nrGa+tn4bJQ-|ekp)L$67m}y~%#Y5;1pE-hY=PT?LY7
z!1I^`As#dqMEM6zx_WZcpL~xiaQYml1Fy35qgO^nO6`g!?lhzKK#7{)@+Zwq+dJAh
zETz(Gri9`9tH^(#tsY3d6tw(lcMJR?pC_GJWDYrv$eMVoJ6GJ^>|^ZxpHn)CQGd}r
zNRRS9Kckj{IXGbnY^yUma7%i}VD=g~b-MPk4Z+OFCigN{0QAZA`RUpA`5EkNxO(me
z+*X$&ad@Y_?eIcRb~WeCvM-Y|{9Yw~G%dEc6Qz3fn0SeIke#)wvlG>`AmLf!x*LzK
z6|pc3@IWKBFFd)<IM0vNTNiur{;3Y-3z+>a^!tvhx!3I(d)IoxUfh5s|HZC75I3KJ
zgGH6|FZ^&6>$@WovDB4Us{${3x674enhi)cM3%n0p-g#7FHxGcEX%MU7)OAs`VBid
ze4N|pZUFOkVa0r#bAnG`hmWC?EaZnSc^-pu9v|Cf*V32>#&I@0W9Y2FBrJtK0=h8s
z2zZ7AoT@Cc!%Jle?d|PfIWHYBDsDc3qdx2;o!oMa&?%85O&MZ<;6bG<xvS|{Iy><n
zdrrM~Xwu>zE=`|u`uSIYMWWW#W)EflMo`^#jL*LzO)aC%5~EK_HYd}ENRf`Te;cIo
zgE@%Ku$I%QeyY(TFKpx5&8b#9!-+4YVKHp&dfltKQ|RV6rCdR%NS&`o?YHGCvwKRj
zoE<mXJ&8EMT@8cu3g?&VD6>Jqy?ltzN!%YFx&y{yLLQ1>X|xAymxJ!xzMlw&nmg@Q
zRX2z_F(z*BT+YCil(sd@6<+|O3j#XWtQP~yeGhvac_Gt>gAhjqZ@nbIRpG1UMBoYW
z;K@37;0`xG%3IxrVM~w9PDY!Q$R4ti_7C>kkFP9TJ67DL?LYlQ8JI6OZDcCgT(zIn
z6Xg@aZ1<BPq##UVa|7n!D_lODgFID5jF9};>qO^*=f%2OC=hv%KMbCyQm!vWC(b<9
zl<nDf^4SvI$qIwB5YtYW9qEvGIUl?T!Wi}$7q<ynx#f}&TXh$dHy2rwy?+_Lr>&Cp
zlBsfCV6%UJnCH#+fTt%bzIHyM#ob7&UuI`av68Esy~?M{u-CUue{gOgqophUUNE4h
z8mQd$PUPb+U4Qp(&`v-9jK##pC0(4aWTc$WMZ;2pEOtMyFgGpnTw(UO?+gEB=w-!C
zjldASjffTX4Z233v%AjQfm<;g(2?fGn*O2c@qxCYjy$IJdqpf2%4MTgc3-LA)*-Nx
zI9u^|aHd69K5wkQhP`|ANl*B1rqeFW=~K|*eNBykEm_4TH>8=#schh$tZM)x#~zFJ
z%?!*0(-INAa-;qG|8VdtOK8STq>9&aP;>|32*(7!vhE%O=WXQ)O`E(%pv}NvS%6SE
zs0-xoy^6`mGZqAyhMnNu2ueI_c2tZmCM;-X!%rn+T>&%@%ZeQwt7EtSjSdbEMiH37
z-l9p=9xFA&=2NP;{|GHN3N+oy>DaH|CEeYB+SC8%_@>7I`@ZXZRf8*r64i7RbyIW*
z4_b<LCozlKW&;-=zbCaUD_VjM;-*LueczDTsNcns0K!c$E)>k1$5MZ{vp!BTSx(_l
zr~Tzbq-175H2uB)g8?;0;#F;7XGm#DHb{Sh+mHGkL-~GRSWz{RrzX1t7Tf6JCJ2Eo
zv*E?;;T7C&_{KpYm&MT81$N4x&$jOE?<WOoTj0(1J|*gF(l!JzPLYOhr|Y2yAbLsQ
zz%%|Ps!7vnJ$d~#S#A0aD(J?$RjX5pfO+Q7-JeUu2kgfl?536fiDnXzb5Y$fiH%2U
z%49XynV_>8jD;*&X_>9!(q63TNu_C&JBLe-Ceu+|*^|IZ`y2no&0g9Sg4EaNwe7Ji
zNI3Q@rNK2ZE|?H7!i~hzpp%<cF12r<cIR>J$I{ywe|b7eP!tx4BzIF>+9x>})XGrJ
zi8y$66`34Jvd|*M!UK-bfv}A+_xt;U?9_OBZ>;mM-t2|O(y<~^4JonvmTzc_xpr31
z_>4O4B9%Epe(~ys=;ph8YNjmMIGIvvo^%k(`0gP7`-1<(yV@2?+_v+FbwBGLp%eQz
z9s~+ufKch9FL1G7>e%w+tBJ=C11?rE6bQ`T`}QX#0oVN`m4*$wH6e8?=KrEaU2jGg
zaVu2F6>?f>6i@I}nJC|k^-%o2ou9>m-Z#jxL}m?PF%hj>KM%qjL**Y@k5!eBL^9KM
zHZ9-i475&-&Xuh5Dzp$@QQe9LB|q4Bw8U_IL4XuEBV@^8_QiDqYz_n8#S|D@@a07x
zvG|^>wBe_~i$%k_2U~H*BZNrS$YT#Fkb>Kt47d-}VMuMQZ?jG&cr=oaf|V;4sH{)>
z!GG4ahkKn_;Z_c3snEf|-^l-B>Z6~3HM1hE<*PExBI<h|JYFWb(deoNBjK7|-py;n
z3aWdXPM7Lh$Kqx<ADnoI9Jza~v*;qARB7{JlZ+Q0cdHPnwBc2WY599rv1kR9$ultf
z&af_<lr-h~$b3a?Eg#=y!^72)q@S8Cu_e-qM}Kn7|3hf5$fRvShFD<o=Ga`#*_@Oa
zFOw#I?Ux92mwMOx11p&8?#ooApTj25^@@xasG%oO^?TB9L|V$9xRsd>$l`&}zvFh>
z<zC@ks;lIU@7|C45}6RhitN6Ul?hSvm6F)55y9eiCopTAvj1}qE{e=2_ze%Ir_Rq;
z=T5s4(Mt|eyo`VPKNse@J$l0|828p0?L5%MmD?)s>s9{7^!1P|o?GM4@v?$5o|j8j
zEKGWDrGnrhqv%R_4#Og!8o$p)nDfqn7}5X4WH*?R{tG)UP8R=R+lax2wL_db72hp8
zVmp{XU~8ZI4Hu82mt0)#iz)s=%G_g&TIg9e=L>CI@^PyeoV@QQKVOktz5)gy`=*QA
z*vA*zH+@5&rxVNHr5rQ0Ox=xw`ExvFRdd~YR)4t0`G#s})#I?W-kgqnsDp_w{|wg}
zEbNsLwfNXf#D%)|e2#JJ)}H_`+ju_vG^*2&0L8)35$MIo`J91_mCs*~^RHl;7QgY=
z{MmbcJ}M#aR*A@{dFIUb(xW?ui`dV{+5aYJkj|tSR79z(MsKEnZrP~Go!gkYiW>TE
zh@B?xafIrvK2Fp5iapEmg3IQ!tICbA9mI6gYDdL>dK|a2hQD(IS+Y86CxvqB<^=$m
zvT~$Qed|WdiEhuoWGITBK_i-TF3NhUjRki+*2thtU$^D#na5*?i-LkJmT>_J<W-Ms
zNB#wKwb>6DAIN-!k27M!D`WFdU%nxY@;)7uvwO|)kk3~?<HbxXK<O7ULJ8bnbWs{|
z>L9jzfjZx2H54g1QcYxf0eIYa{4A0^lv_~$gN14++5;@_`fQGYhikzbW-T2Z4&l=D
z{<d5Qoss!d<Q?>u{xWPvfHt;z^uDEgaIXtU2w%Sx;}oD6T^`g5bPy>hRcW)hnO>rJ
zS{B?nS?KWCdxza*E}Y4g%ho$RJY0tB_4$GGIn?Q8*|*E$il^no%K<Y8bN3JGH=%dE
z)0u3z*LJwT<eV;`u83Dz2|BC6R-;K0z<%S$WhbV!f-#3ryIgbs^Pzv|{Au9=mM9+a
zUknf$B*rU_s$kYvxMpDbcabl*6za=YSrvDAxO|D3JPInNq^(QOv2(qwZ~9spnTaWF
zFJ~^Rn-ZCncA$``bO*EY@!sVtRh@TaYpo^OsimrI=_nCm$$dIdRMbEym;Z6cGV@V$
z2QcciL=b9{Eq5`{aHGM41$UvLMk2qdTia(&i{a|;xRCnsxzRd*k;Fo~4bGdmlKasP
z4qLgxM|9$>a`-!nr9n?IWsSjDKB69Jx{n5PmhU|`cDunVYvGQ5H`{_+wXo}(EEC-n
zmGogm1(Wj#WmA>Q&>-khKRJ*h0n{T#u)pBi_IA%`GoAP#yUr_(`%5R{l9U@5;1p<q
z9O_ZC%Ikyt4dV;thS#(|{dg8eHIpUtLS;*2Nx7T>M#JI(EAImY4;**(EBwalW^Tw@
z5}0l-rgQyriD{r-<mrG4Ny>w$!D#6ub3x+AaI<!ncAgD(#m|+oPwc<2J36FDa#4q!
zebTRJ-e6k0GQbYJK{gkESAIWsfyvh@!@P%yN#gVuKSeS9qPHTtG@3V>8m%kx#ZtP0
z1qhlF|E(+mF70FiBYxwA!X>wC0uO8~A$Q|kgAU#<fQ_a5ev7+_TWl=Obm05jp$DBU
z!u4n0GN`tK8`pitt==l4#hOp+Oov~q)A9zJ*Y6vCA;#+{Z?Ffr+`>uHo}dLPycf6|
zp0`s03JZ5dK>-7_Q8g7TefOeKWXX1+qY%L(-izl~wS)j1HR=S2V4e!(-Amx~v)Q}v
zwDCcY5L_sTOo+Av?_Qg#vNO2aC*v%qzwx*JYOXF<e}@cXd3@jRo&SB~!MQ|N9?hrF
zSv$)$0`tdMkah|ll_9lKXYzs#<z1N-+|??lqePKeV23h^2;OKor*6lgKr_xw)B~7o
zF3519@u@Q53{ACU>U<WM4d30doXT?^#6FS!+%9YT6Z+=QiJOm;v_-qzM#K(R-JO`T
z_$bA-JgKtd79~)6F2o!=)$#qW(kI!S8rf?>m3_^@F~jFI8nV$;hcol^MQJCAssU3M
zi^tn!PmuK>w@ljl3&#G7;QSaauZkhI?WHVv#D6w`Pq2+&lxL&UkWvSPq@E0xn+}Yn
z<48zBhHEIN46!;|XwjU0is|gaB$jbvqwNrYqcHHNe2dGPL4h0GwIgpAxH4dADu50k
z8Bv0WJPrm-t73LGA!l=tcb1X|?JP7EtQ57lPEE`_19(}sCp=&^B|vCM6O(klr+n_N
zV=@tRT;$lI_}Kd9scLbBGI@Y|6B(%9KPCN}+d{4Le;?X&b^m;P=kVz=V+H?d4zgWq
zgA+Cp;==@UwQd0)yI#Hor2)wtODdn|DpPX3dmF+V(IyvJHc<LNI4-6Fuy=C<(l{vU
zh-3rXD&P}X$L|ZmyfTyj5J=+T)hKy!os$U{b^qV7bG%q@E{mdeRKm*rtk&PMW}#&B
ztbP|BLO}P_w0C4ozohrD{jh76<w{*+2jhyac;VlNiX?xH6A6Ud5ZfM%4#7=kUo%^G
zXpyR(Z|ss5vV5>0bm+be?bHTZ%0}l;A=8A-7J42M{qW1r=xdu_;}U0bONHn>?rS;`
z&9E>Cj-Glh8?Yd2(Ud3dE}jkEl^iQeq`e?FY>a~i{~7Sl@M6=d2m7M+h>>#isH<n*
zpXYrN{5bZk$&Q)78?w=0>IR}|L5@We(C!>()8ot>t<bb@*mPs14G%(Hbd$SRn;s{d
zM!NHp%%h^yKS%Op?y5ne^?JC|q;q7C@}}(!N7?)#j}8?lCAp&Q5J4QSm)khvA&tCh
z1c0$rqbtNZHo{TD=1zn&h0#)SvmM{8$i`dpl;|q{l?^=I7Y+P{ln`H%yJlSedfw)$
zw|Ry}+z2%+OI7YI3)LN?DX=A(ltX`X=Q#qX0zhTkWZBd(xrK1{pLX^t0#@h{(ZNuA
z{wZu4CtcGg8pn;K8ZJlbhh_8s-5|L5?Cx9kA^iRqb@wFNImtRFB}Md2IM;0~dpzKx
z{sUpU>~j@Hk#y<gaN1(R-=@-?<Q3l%hY?u(?i3)0u{^U%pNF}5n?Bg_TWqkMR&duk
z=AZw1{5~QW-dwsDWnuNcb1wy1H{&L`8Cy>VZncuRmp}E;dz+XUH7}PskN%f>K2Q+N
zN=yu(L!KEhdUx%qO)L%M&ki;Y<T~1EQLb0D?8&;zx62aM{>s?;O+=otZ4)jOW6#dk
zh!XoDGV26N8<ll|swq^3mUFxFPkgDl2K|GN;JbojQ7rjoFOd=irAA&1c1#&~*`?DG
z<t;VR`dLlJ+26AN+wI{ZDML8fZp(f(bpK&V2BTQA=<-Uw5119?ApcTRIrfY>lhRSC
zSX}4v<0C?Jb$SSBE$nOgAEs1})S2Ky64q=TQI(5zNUA;(rO!cP2gu??!>u=g;Ehq)
zo>#?4%<Y!Bx3x&Dm+dDXLQd-(K`BH*1RXT9RZ_F?lGtE^jV5zM1YecALo9!y`-ODC
zzK?E>p|B+gU=?LS-Xs?oxiZ&$ncx7cS#lsA#|D>J&c+TXe9N`mk3(+ZWLIZ;8*V#{
z&|6}-wqr3I9UK`PHck1QS`}E=>~$AnV(y>Lf{jFNrF3%D-`kExh`+9jUD9qtsQ`Xs
zO8aT$n{2%PpwKN}KX(gBMKNrGbX*4Oo(=iRg9Z<DtNE^Lrij!?uC9*9o5&2A0-G|~
zS+4xz?_gBH_Y;RyZoqDKyrp*4>hsm1&@gyS8@Akcu|npz0bt44H&mS*r|cpH`i;b3
z<qNmtx3k#BluR+8358z*T~i_z<hxh*Bl?17%x3Q@t>4NC->PxhAe6c+CM?WtSW+DN
zRcv5#5?7)7#Bx3AbdKJxr{jRy9<Lmv%Qb}40v5a!>CDG!gG7Y$`8~o{x?(}1<kc8I
zMA+&*)a8{o@XAtABL4cSDVb3nDR@qfTPqyRT6LlP=3?7Y0L2DSy;BW`?kvd3u}&*q
z^F8REvwK3BY?RbiDv+(Yr;FXd(u?zD{@Eqw#;wjB&Mt(|11J|S+Tr%B?Qhs=4o6=B
z88gE?$@}b@f}e7>){_gJKdy%Hk_V)J^OGHBg{o>_+T8b8&#`_Xzp3x9?fC<<fU{Od
z#%WO$Uk36J$9C2;<vlGAq7gW`2P-!l+HR%Kxohvf84PR)A9{En``J<csfK3$d%N4-
z77swmo-!G*y=;#Fsc4b4Jrga;O9N$0o&4<vB0G2Kr08kJW8H*a4-aD9^f0z1ayX88
zi$#fN)tge}XkKCeGsB%xt$*HH)W{)$GX@U17eMjd$C-@Z?ckcpQ{qBoe4-y(MZXod
zX|YB@-+3Ip+vne>g%1j(Epr>NeF}})WjrAZ{os&O6!oxkrKBP><wcGcAM-PPz2%$k
z>!}#<_GO>?WJ}jm6su9YvT(;YT^k4>RDQ>LAqaf)#Ja6I_H=VCDRI2n<qanJOGa{H
zvIEUZ?P|E@690Q`!7c4DO~|>IcfV=9VEwM2$yKM35KvTP1#eWeGIdy)4`N|ZPhfZE
zO5!1(mfQqZQm`{-Pa2s-z*PnVW;>X0FxbN2xrORSdBxwm16{3x03652TgeZXUVv+Z
z%}X!ANac1d^H+dkBBUM5=Id}Deegv%A$QWpUeW_ckH=fMhF?-Ux)YByQw?r2*fn^*
zcSi)UBtoMa%7o(Li$|*i%@XKm5`xvAaQ#b&lmgcqcw5rOU7`_RcG2Nm7m^xSgtTTG
zg0~D@EX`>Qnpv8N(d<lIMuS&b5hK{bK_TE>kw;~!Ax_L990MtX>{UTxxK_qXGP=NQ
z_NlW!ooh0`d-#1wPt0f&E<KtE?UmrFo@134Aq~z{DEzi%opA|8LjCpYn;A>Eq3uCx
zpQ$H@nzaS&ak%pP-H|Y2NUHh^hqQ2Bu4@K7b6+l5iI0TPH|po9a#vh+Gh^Dm$nF+_
z*)gKPB^=3;HnrE0>$*X_c`0~e0LNwbe$g!91~5;w$NeROGccYNwviqqTNL#OEKUi5
z)`n_MT<67A8{w7>wD;zvJcIYd!z&R+OyClA%FXm|#I#GsTv4TZwz=;ouKF#m9Asz4
zyE-_CbU#6HO%T;8#91+TmZ&kpd*w$E@{0*Blwo6%>`|y}_Xo(}9kByd!xsAV$Hb_{
z-jF+0>oNKhTpjXeF_TC5(^hL-<fatZ#c{%@RiQLcWS3S`8xqRp>C*SegqX{3Mau{l
zLed`#voH6S!7}Ih`%ftoti{pdWZ?;>6^OUiTPs@Nq>W-e7=`J5z8ECnHoPqInNu6h
zbF&JVfgHG0^}!_A@^)6+>&X~Ts~KK<{75#yqA6PRkI1NnA#pPOHBMqnlEWP7P;sFT
z?Ojf9%R5*0JLFq8^!mqgHg&Xxswop5Kb*t&GDLi~W}x?YajU?_j3z;nj+X9jh{~<o
zXG?LTx5C0YRl@{$wEN_~jL3M&Rv5}K0@dV_jEhbF{heD@nC-9Gwuc0`&kF0|Qs=e~
z`;=BT%JuN}g$?~P_QkVs@1Yg<vo%PvCHF3N|FyW=k6(n>?G1}He$by=6p3vq6tF{V
zQm<Wsfe+z8%`V%Z2TQ$Tl6s3Z>tZlDEz@QFvz0FtNZ{M8xb2_a&*Cr_?_a@GHRYAR
zv3bpZ_$9Bt_dV%8x6|ndIl0b{W>1VU&N&xm{B~@p+0LcnfM?m4loHa_A5zAUI4t{W
zV5c^(m-^ObF7~uepn8;+{ZNS{DQeodDC8Ia>j%?Y<DZ---y3{Z>JKW5`DSl#{Nrg+
z=&VaWC1#0?JT+d`M^z|$ba5NoNWHgKps4w7D6HRV{CiHGa`W~yrpD(7-E-852N@Xh
zkioJhfBe<~T(cA3p~BgtAvU4^jn_bhzNs1PdOexAclHl(K5=PcF;8r*XfssL^w5J1
zV8T#VQ8*;`#p>&3Ss~*R(Qoh_op|Nhu)k02=bfI)!*KceY435^rQ!|V08a^%k=Me&
zl6I>_dW3R5`}!<7h9czew}rB<r+aNsF=8kuC0oUS1|OH$E2w{B;ZZD;m1p?roDGoK
zpR^VF>C}FG<~xO(DxS8+PaIEGH_WxP*?gi<&hytq)a<GEpUIaIx@khvC%^jt{`88}
z^RhO7HtXyk?tJ<wQ(dVl+k^nJYIj;Jm6dwSN+63S3muontt!yZl2*@2*iE_45kD;-
zOAA=1M%vIl!M8~_RLp)|sy1^h%fWo#>LPgAJ%B7d;I7SwP#Jk=#e#FBp^s#jMQ8YT
z=k!dwP`W;O&YS5yNzxkEPFHJcD+7l#?X)&VPINH^)Q6Q|-J4l8%J++1l=?s0osp+%
zc{E2G_x&6q5TrgZv0cA8M2PQG&dxXJ4{^HCK+hcz+)mW;`2zRv%&w$Od-~+DB#cdM
zyYn1AJ?MtKg)D{HU8)QJsOc3jpJ}P{aV7)SmVTmWr`~^?xmG$r#%mDbX~Yun8q&~o
zqyOTM$rd)tU>h%^R6Bk_#^*zy!n+qPH8j@k+`$`Q7BYJ@<O`aW>lhaX;u1=w`H0Sh
z|HRz|J$CYc<#Ckn<1k*o#M_I@DA%`97prUMsu^z$P7|A@RmS=tx`o?siR|J<T}Gx0
zRQlLo;~=GHq>_BfeIvhuUK}7U&r}WFS3fpRqriZL2pCdzPK>>~o}cLTos>q_^Cj!7
z2I<+zOGQY?j=l$KedFZ&miV6C+b7x1wRa|0sNa2M)qOLjeqYY2RXit_a(Rig)v(_1
zq_1tkI5%@Y(`lwxj|TDIdq>@dWJ9e<E5pKas9o%n&*a>u0_Q!Z?W^)v?sgr#Q#<Mq
zPnZ0>Gc(ZCJdS(d<s5BPQ&GgP+rJA?V)l6Gbbpp9M}=Og-Wy%BqL<CTYpGoBPd3S{
zPsGg`uaz6T`L`|8<g*bGz4{+ef<qcPz|{bZ&hN}X+&v8u_1{(!MqQk~GlON}xt6{I
zpGif<xBRHV?=fo1xtn&A-Q3(t2RD1?GqO%HHpUy^v|>l&>5@OZUQ7=pdUZnYk=F8^
zKW#T?LMhN~ZI=nG>t{)N!(8bDg!4v`BSh@G6pu5<Ip`VTIUV{MED4vxz;Vyzey|$L
zY2wrD1r4?-d7O2p3iMKYD?zrdS_EYHM5WUW-kF57*>GY@$@(pC<TIIUzHP*{)$hm=
z=M0zpHJgTH?S=4;idzr*@rQPA{4T98Q)K+~YsFpKaI6X)wcRLX<kL}UzWtrSpP|1p
z<t}OI%-?z?i$U%#fidQ|e7u}rp<1MHSw8rBo$NtG)ONj;5v2~cmesTJu+N!oWxGLU
z%1^J#TIn<4V^6v(2!Vd9dat=O5vhM1_Cmii`;1uP9|+e=qKVGWWr^)tabdV|*H-|e
z_lB1%ZgKeX`tgkpiV<A$hG1umzwUc!%&liv{v3=_NF$SC9LUDohN1AR>}XOMja_U*
z@9FNnX0e~&-RGZ|X?31Cv3m`U>;IO#XnfBLygkW|Rz1()md>7Sb?F>`$gsKTA7W44
z^`*0tx*D*)<e+&C+ngUW7tAo8(aE6__4D|yE}g-_KrfA->%C@#;I*Dl#x`E9+ir_q
z9ejf51%-~??>{$gdfdezzWjakgmIr$*p*Pcy!Sw_Rr9P@5PxsyW@`*~6dmK9fP{xv
zmL(&vsuz#V-iQoODP)q<E5{SjqPJ^)f7<jx-Ywy8zBiUz&blJT#yy*0mi%4=EaWbS
zshaS)@8%;B<$DYo8yr3!8FaHsyOk8Kq-m?6k|JjMF?6jdx-aYBzhoGEHaW8GMimV4
z$l{$f$FWDMV?eoK&!9q?;olwYJ`2Qp0DD=+w854(p|{aJ#nEAVSsD)XGVNNFB#<Qn
z(iMX5v+l737{DKbjJpo9_M*nA%N8MqyQrN^7|-&a@FoLj(-1+<G&YaLcfH;6Ac?T8
zr?cqS?s$6zMV7ynRKOYOkb1T<TZbyOed(H#&5~_pII;d-R+6)kVE-8bRZgHD-Cm!6
z(M9Q8_36aDW^rM`vPvpRb#Bg9Kuain&)>n`b>{2-yAYcywEa5r9&Tx~b!oqewPCNd
zW#9kN8u7bpb=s+y-N<wiu6hGr9^d~%RQy;Z3CW_~7*%>qZ0~!br8V9xsIZrc?(Hqi
zn~EIhUCF)HDd1vlv*JtVE*7II?PnDq0#snhtsz&l{PEc<X+%LQ81R316)>htckwpw
z#U@it3?LWl!9ayzMI`&VE*IZfZ`1L>+-$%|6Cd|&?K2(b{tP*3#4kCRwu=HUTjKW9
zU8jd~8`7N55}%`41O#<6OU&f1XiqJr{T{t-yK8@^cTgr=I@nRJ@4AaXR|ZXnbC!Yj
zTo|p*wJn!TIbRSI#6Z$241HRn$m!_~vtkJNy&N>3z2p(pQ7&&cQn?%axALhB6K%&G
z!J8`vf@7ky?yF6jCDk?e`P4~W%{%&_A}*~rnh49X7tT=(i^0%FIku6jI(<-tmehW<
zZiEBQZF#_ek2PO5KTsG7cn}Ikm$nJolr4i?9S0fMusra){c^ce!lB~(7Jv*la_sx2
zqA&TH2SgVSml?MT*X5`7_V&4o&*F^kO6*z#{M~C^8{?%Lzu?2w=6fu3GeRdg<U_iQ
z%7Gjp`T6=%La^9$@2<%dQ|8X26^H&}jyh(S=i_!@n+GTS0GEl&wVq_{zqMjWx?=ow
z1=XlbnOBJ6-6QwwvL@p|1v)KwMrQIuzlDtX)I0qC|7Ip4D(en-7u&#{@k%AY&3ba@
zOH+bgLPlVr>ALRB4&H_WrUE;lhA)tccJ!1x2kklEMCYc9rwcsA`V4Mv0lIa;)bTtK
z!`+@ctmx^HnU6nL431WO0j93<{kx+lpPTtnpXmAQY{*zq`=<ZQlM1yf%^kz|4bNM_
z|B%2P;U{km17Y|_C!+F$kivW&I|brE`7Reb@k8O$UDA&@mBi^%zfC|Kxd%afX($Hr
zb@-<Q7QK97#u-5G_gly|f`~80_;*g_?icqL*i`HkiE%xxsN9XPf%b9WrF;}fj7@Eq
zr0o3YR%+USj<1yYul%Zi1=(sy1kLQxadhe`e+2v4ywCbsSM?gdyVdBOF6;L?V(N70
zWp>=znindwjJRsE<9s?dmP;9`8ov0!JF2f|if7o#1x+Q)8$Ac7l+5U^x>%=@MQm}}
zsPmg*p=mqblJdh{r{sdSb7<~<a@$O2YW=^Qs7n(Ohd`w=_frMjcWiB`a+GtQ6)U>&
zP1b?gpvsVDi&lI8y*Y@;)P@d5bnb<5J@?M{hRTK@*KfJ58EvYLrhX}a*xq-@koD;A
z14L<5weMhpd?KyfKY<GcRtQ@pij9UAZ;x_O#75sQw1vnh;FuIbi?>-S(hIx>>O=d8
z!C0XD3kd5%(cCTJrl~RIcQzh_hrj@`+~T**MA58DS88%wU>(2y^Z!i!7q~%RD0flf
zhG=@FZAnG^v{rheUfK}7Z=cm>&8>U&UxhGWP`8|Hv$WFU!q}ZE__It!=Xc|)O7McW
zia&eO`^8AF{R9E5-`4O|s!*=k3V=)do@2+60K~=N8c1%C)4OaCvdScKIV6|coAj0K
z<YL_T>@Z;Y(}PCO$6-373!<c$!;VnesAUM;Hk=jOIPopy^ESl`;ZhI1s6rXGtAKx+
ze9?i_FDCC$9qC<|HC0F`*xS<`>9r^T>(Y-=@{ODC8b>)YZq9$n4(v<m4`VH!V3=N)
zCBGs!LrL@5YL@KV^xNSF4HVH`yY!M<m(kh4O&wH>9vRy=lR$a1%d}_o-%@`T8MCNY
zr#f7RPur-}Io0y`jvRbnDol~l+y#kGkk+rg9LY2!7Vk5~ZAo|iS0hj{?zH&^H~?XJ
zGoVo+>!#PIMCnc`sJgR?jUL;HMV9?z0v_sra5`~RY7X+$-Yf7n{`pr`KHGj9h$?+t
zWu*ajP(PQ_DR)!lb`GfcdTs}~V`^XnBj0vtbKeG`zJ>`_p_zhPCZZ0L0={|PN4ao7
zJ2^6%$1_<$>7zvihs@@_`R^u6{Q|q9D7S3ZG8#4T@<ZYe0AFcg=;CGPRqbM%;~{Rs
zWOM9z+)lZhL%0KjavAGUg{prE#6P5!9(EeS5A@v^OUBL)MlAVlWplqJ>v<H3eLDCt
z{mIhtIh<$T<6F}$(9uAVQFP3{pohP38g9Q);K1oUC-ri`&c&-uugCe<HaA&iS@jfc
z*YJVrt$rcQob|k(^;eb=1_i{S%}$kiWmsXUp}vNbu2)S@1U;tDE@#cVXBFnIEZM)|
zGI2x%YBfy+!x@q7?i60%_!T4lBfli49oZ(E{yAN789ZOQBx1zo8)jwg@%h>lXHu7D
ziUWnCc{uIJXX9o5S@*BEMVFP07ISryAY{Ps|DW6bZ<J%IV&GsdIX*{JY@~iNcZBOD
zww*A9-hC&4=^MZ4<+PYmdQ3a<l_qr~>}bTW55T=#?pZ)JF7xYr1Xmi~ZW8A+=o9>W
zAT`%Hnl@HO_>4<BPBK9Fw~vOiot7)?TAYdAg{cih(y#^t-E)MVSV;%V8IJ#ZD@$g0
zx3M&=D4W%nr+ASAEU$lPhM8~g)x^_WZ<bD<G+f9&IICoPv#l%znwI-w>{({tF@F~O
zFcQYY_4!)ZwTvh_<Rg1~c=KiV5Z7yj#9J}bz_g&Z)hYJQy&Q_^b>k!VVskRJ2fU=7
zBmLVGG8u@>x4Km12`Bz{Z`nEDR)`g`0<Io!=*RnceldKR%@on4pejpSAFx9y@e#Ul
zeJ|n8BzINBX4JT=fI)~ibhFb<SBX_CVe}m+shNB1#Dx;8+q$~MU{rs%mbvgaA0~e7
zLn(?sn0Ine*S2SxZI?xbbhkvX;}PAXSO;w5<Vj!O@zlb*W}8g6<TrN*?raRGEy`i!
z9p2vY*>Cx0zW0uY6%!J3;NN%lj?1lTRjk&C>jFi-c3KV`*A`?kPMw;WiB7aqCgJWz
zfZF#OpSVF#HYsT_n;RRSa2djSPIqCeoi6=G0qm(=F)I0m(+=gCe3oLyU5}cpOz$1t
z$dmZ$(&TrSR{A|aGj2)&WFY@=%hnx5b%X!&gt~b7Ty^-wr+V!}-W_*3y=(EG?4Iv(
zT2&<DGBdRXr`tM@jp(fV*vG`&By6Fs68(bAZ;@vI9tk|5YxWnO5|d=1o78dXn%5mv
z2c0S;{PTiKR;8FewMGMj;V#*-+=kC&bV!bQJ^7>?zw;f;Ye^nnaa}gWUhYaM;mbUY
z#&P#;oZ!JA%b--#zjN>XU|up&JuLSpFK-_6^tjPEF>K=71TAzv{`a+W!{!RZoF7~E
z)uVh4yOec3bks3<bbmv?ypHrT3#(d?xv_Ndie}5C=J#8xg6LUl<}CP3u?gX)7@HG!
zG^;$X6y=Zs;^K$h(UFkLa$fOh{^#&D@H92rjg;#BB`7`H{dKC#mk;tHw(bEB`t4R6
z+%ESu4>I>H8p1O`w~pqS)qWlmalN#RvALjaRM9WRs>!e{hEXd6UXClx54~D({JvSP
zXD&v+Q*a1?58+?3Ze-$YrEi5v_ml9+CO@Y@xxf*$$Vi==z=C|L_U_JOrwo=gRRIF*
zE6yht;*-I?HRtvuD|oxITuRAr^h9zmNZC8DqdOQuLLxt%%&Vk`!b07DYoJBCUQ+Q4
zsog`BmOqro2t+m!&C-`|%vi_V*VPacG+2o<5)OQMePd>xmx&$yU<INHuR9QKtgNgY
zv=;f2u<ia-*O&YhnxVL@HN-{aIXBjS&?uxR_av)EBiCzkH+k=R-@Xh+5p>NkG!#?`
zq_kA;g2FeFIOCm0SmUg=-^f+b7O~#U3Jzxi$!}%u=)*XEkLOJ}%-<@e=4v)M{6xj<
z_70B`I5Q_ScOC*D<^4%JQ^8Ctb{FWD$9O{RoEB<gOxxV#oBb*1kM541^%5VFYvLxp
zouw$wKGP6fZ!eXvyFV21h67wS1SpRwXel>v(>s^8>5C3F&nl%qCNG0cb`u0&RqcM{
z<~!t&_&;R5cTkgS*zGM%MA{a%6lp3=rGr9f!Ag-56$R-iU_e>`2`z*spwgT41Vo95
z(t8UKX`zG;p@-fBfdC2Z%RV#jcg~sfe=?JKCePg0eXX^AYkTASMbTpD9b{uAdRH(D
z{z72PCij*4AImvNj|2{-gTxFRw1pJPG1yEM$%N+Uyjz@$-zTgtupo<4Op6p>#SNyc
zK+azaE`_S@>(hG!j>%m-5`a{h3=2ocOleCBTp6tRBdAX8mf_M5LBF4@0B?<->>?j^
zR3TiHQV{C^ba9T+)V*TvUjFlUPwN5Ty?jq+{+0R6<ysRst@wo>mog-&HqJxYSlKa;
z`TqTXSOBkt2J4@2shOy3J$Wm&nS_~rD=$<=N3ma?&O0NunD6iPg&b1EVAVDsnSq}1
zDE3qzT(WnGX@helwv)lsdXbQA-K?Ktxa()i`sEofPRut3QxUiy#TgA94(DP`-kb{k
zaft9y@(U<(t<;Rs-O~vaTN!*WJahbeY`xuWO*=rz?VC!M($aq1>Vl!>njo%kF8R=!
zu9ywc|FuJQ(e%6=@}cNAHLOi)@&c-9dv~r`G6TDAAriPh;1LZH#)gb3cc#nCV+N>&
z#%s+waGv*TJZ`u}k>q@s0aA)+=2U~kvbbAGlWE+zqq18vxxL#`0^VXuBxBwhlq*Wn
z^|U!fs}4fsul>epTAU3w_8V)TgU)J%a20js`<3tDmW6HBCw)Z5Ckd~Dyo(LU#fCV>
z4wKAg^4?pj5GkKC68`Q>wS2YuY%G*8C*clWyPmduJ1?fcv2O5&RX-|#<l~ES67iMb
zjRZbMw!|_?US1Tpv%9uL*2J=sj6r)ZDG&_Bk{f~ls*vE{8g6<rS9;io2+%(F-A?1<
zOu1rKlka8s9#`RY^u;C}Yk*ihGf^~&u$1{H07-oennl{~N;EV7nG|<@t`%o;tO%<N
zY#n-O?N5~Ebn#xRI{|f9N>dV~PF&~>HNNTLwg*10<UE#}F$}G6dxa35Am*-I(9wC}
z9mV<KedZ6-iPhkg#Spo3-(ik{7l&BwrU0GYo_QG{F6EKUpzNF^XU#y8<m-osvWdf&
zlA?2qAg2S%CUZtK^_FKo!&X#pU9l{q^QG^>n0i4D+ztzZeZzQHOvJ{wRXtsgv=s73
z)A5+Pbuf(`2w&ki%4*5c{KH^%4_%S`Dt~`k3;7*B!A)t7Lc9d#*9;7<4ChCC;Vrul
zG{QaDW2dV)<zn!j)pe%Ur@Q7BKc_n-S<4RHl)=}Hm-_cyOtg1WB1y1k2=KbU#Gd8?
zw-$%eSyC}@^KVUr%vI3Foba^pPJMgvql`gmOIQ8VaRI)X=9;hItb6PwyA9A^Q|2e?
z>v1~rtNq4-;f{u`l@%%K2LJbt>3_{CB57RXhqC7kGi)=8pF3v_L`f=PJ#1_%TpG54
zL2~sUH<zT-?&oyB<vBKG9KV$s%uRPK;)h*{9uIj-Eb-L|Bai)yq!#kLHJp-ioGi%T
z#Z#SFoz&$*FAypdwr%kK;jKp-ndgcS!wVfJP}{P0bo}0oNvK_!5_XUSW@h;Wym*yp
zd*~cbfP0pYc+(q<x{C$hK*C87m8&(L9(FZlnKry)w-)CqfLF?jH@df#kFISXJfX8!
z<jVqOSQSB%y4ny!$0CWGcd8nbf9xgc)Iy`7+>nY?7R(iHwU%2fkFSU(69OJy<64cU
zl!II-n<Hd_jgZL|rQflhRtEBeFX;Ulg;=P1<cPLmFDG@@^DdtrChcH$&HkwStmK)#
zxs!Hn$h)DOwm$$=Uh1Fz*Epj)UYY6kmWGhQdr6n>iPCfPUW?**!R%?tB`+o|{-NXZ
z!=v2u#=y4&KK4jEU|7J5R-&aX)7Wo`)uqnurw=vDu4hhL7D*m`<XG!WZ`hJ8*HXCD
zQJS41I^ZM0on6!ZSG$jgTRz!u8&KN_BNq^ayw1H}Bh)jq-3_XYk>eAUjlAqWS^m2K
zGyD|Ijnr~4wWv}2ZFjM3L^naLFTV4gN<B%?3hw*b%3mIa{KU|!-00!Rmi`Y8{36-P
z4C+(P+M%mX5(@j0HKI8<-u>PG<Yl65(#d57IthCC_?ji6cPUA~zQD9;;9vaT0c71}
z1N@{u{s!y3mq)PJtdYEzmv7vH@-Y6d<EPu2>q#wT35<==8ogG%s_KtoR^~2G71^dX
z$EaavuONV2zsr-F`Ri96|0?i-hChwRQK9?D?64h}on{Nmm0wWRdD<fZo-ZO-lAB7i
zZDzJKQb1_Ut4~-<J}VRiK;-GvEU>X4ov(WZMc?&3?(C<UW(flcZwbp%P4iOiGDfFw
z&r7ATX2Bbey%}K<T0>oV8#7~+7UclQ&$QsD602BWiS!bqY;n>~i_`p$L1<9Lp~hZ=
zuZGtwSYihonw?J?(@1hi+9()m6Px<RtCMYG<3XR|4p~j+@ntPLN@dov)}K9<?j5bw
zXpjRR3EA$_gB_IH<Zyw0n~fUGzF>{_-Glr1<mzQ9V+{l*@Y%1}WbeDR2fzI^1FWqr
ztFtt`?d4W0HLTRlzj`f1HLXUqTM06bK{_ubmd?=$BLy)-jMXnG&5;*ZuA_tlpOVZ+
zz4zuu;DF_=G|}b=hUXT)>}HBzjqtKJ@WLOH*n;~1a!*4};3KAiBQi^xQJ2p-?xIh+
z(Xfh^Fh|hRXOO4eo*)>Ja%gt4O~_mqL32=I*VD5Qx36AoIG7I($gnwq_~o;~nV2uR
z6lxkc8NSH?$xZ+=cP%xuGv{cfCP<QE+nA?smNjo2tN=VVXMtL_sHxz4?w68JlCytr
zh4<cA&`1$LET%9!R7xTxAqN{zt5#2+3$)m6Fq%4;`R|m{0W@ho6wB=FY4tgeV)WKq
z#S_FpI+L{;ia1ZZ?!KECtCC&%vvN9kOw1mX;_TyqksT?AWJ|Rpr#pRWXPLxkqvKnL
zOD*0W1%=M!g;nuK^4L1W*A!HP5+BDd&ESr_<^WFRqx;UoDI-g*{0VY|ZB)ZIj@B*{
zPqF{FctkV0?de#hkoEm1$qNIgE{TyUOCyuVFM|qkyW950;g5opyQH$7@Y3Kc$g?#h
z5H<=996dq=&%SM_yM<e0C%zPEi!xa&sAkm03->zLmiG4`!+f)EE0Wlm&nl&0CO+72
zE9o#6BizW4(M34HS%uDFJfX^QpuJCw=OL5c&^^^eXWka~jzitmV68tOzciVL=ox)q
zCo@?6cHo+_ja9NcFsq1lVbgkgJPepqc0p3N-K#}v-4w7ig0CMPPq9+BNV@|2j+2L$
z>&Cj*%!v~RKUPPfT}_Qo7hak9trIM*vo)RRXLr9ejMjcwqREQ$OdS_d8ivKJ%sjpM
z_~T_zcYMOxP=NOP>CQh@kMnKklKP=rE?0)eU(ZH?oW2D4|7l?4abwXeI4FX38#??l
z*vsyg%m`%`^Rr*^>yG6lG0%`*`1y~*z_7|#$ZgYX9@Mef)DJoy;gT&W{h>e)m0}2P
zIl2lMwFM_0!ih(!s%6qa<u!|WI-r?M?0>1`qZ(12?!Hl!Ji@s<^k#)BYvc^8&7rrA
zN|iX-Ub20N{co{s{z;C_wQ_Iw+BFK)K_fE|Xc0G`h!Yl*H>PwGm2hjXW}SN+;DyD{
zw8&TZB-57jfa`hfXA3>)N_Kt@BLdb{o>EP7Xscf?I~U?!S{kdr-~b`~sx@gmI833<
z>AHvYb3WV%YZ2|o#EFo}B73(}#~POJEd=BSn(az;OH74%*wl;g*HR)~7@gtkDERs+
zXMY^OT);V>SIdn#?X$ZnMjPV+U}pc=<%I|DEi&datW9||K}f@5LPViXchb;)TI+ts
zW~G4Ic0euc!14^`eIMg>SDfTx?E%6e?u}er?8V+k<SEPlpli~ov^H*N)6$e0Q|w#q
zQaT^#(B01Tw=%1O`)Uis&P(-d^)03L#(Pt4p8<)D<+Km^0%ep&=<1f347PrG?^q%f
z+idt81b@&KZ#Ydpu7)LZ9D$QI84oIHA&a~Q!b6=5(rXy0LdEXwe$!fJlhenIJyO5d
z-fjW$;)?%)U-$GjTfSnt%nE;l{laOE@X~B0I8noa^P9~{8+(KsqY}J#4AvU}Tq!tf
zcV13wcNeP96TNzv%v>Y5s*d}*7U-lNCP%dWKF{y&Hd8N4tduKLMhv>^u3kg!G3m{S
zw?AD1_h_7W{U=}j?={GOn~@zlnGmpbWnEX({ov_8fO_S!{?z*)mwueI0_y*|IFJLS
zTEypBt<SKgY=_fcL_UDm+DRM1Dozvld!_ubI?Mg>iD)~?`o1iH_uJR1={8TkH`r!S
zQfdjS)08RPuaZl2>>ja2M9{oXSq(bf%BYGf*=s-c<OO+q0h6)>8w=c+D1qnzMLmMP
z?Z-(rH_P5uIj8Io_L<PXFLGy_Wcj2D^>hH77wwQDBqPb_u5a-|_B{-b++~qN_{mN;
z4Uo8R%SWcI>62@&>PS6o?2Q1t2YB%YM_Bd_x;~rEw|!*+pw{x(BjMT`PW1$q3<-{`
z;){Rn?(2<an)1eSaL%01LDtW)lJ+EA-%U`%UKe4VvVpgf@YIjLjCYHeSqm`YEG$^z
z>rM2=Cmjk47)=LC*I#T)Pq5`sr$i5JFv_?_BFQjCy<ptnJPC3jL=@~hqYPoT7t-f`
zSTkq^^?i=g-2n-rDJRL<5sEz^CeNqhJO*!1^s^Zcq%UP~eN0+eohx)w`B0Tt{HJ&G
z(uWTYHGA9Y5v(11s)dZZmN;<4b`uftX7{Hpm(iC~8@ITYS1ot9cW(Y8rl?%&OGAq&
z!Y|Gt0*L(8@yfY1i7W%1&XV_8;_=Z4oaX7*9dG4LiC`zQc)d{dQEr!Vvb}sH;(Ed~
z`6Eh9-rjmgANymI<8)EUpu<#z&%|`Qcd=dW{$BT%^GdmtVW>^nvB6ifRtt&Vgf`26
zH+oF+2FCSx98>KUSj~RpKViHAR3AJTz&)RYzI%QTP$W?T*8C89>n=l5kQa-xxp|qs
zA#mhsTKMWaadlQ1Ij||a`sLD8#^z0yKE3|oq6=R=6bq)-Hfy{*YdkeWF5vmW<ngZY
zD3H(e)LMk%&EV|0@xDHTNsCO(!MwkqnnikAwm_eaua0l+*A;uGH{!8zJ5^0SvPjuU
z<X;DiA9J>Xf<mQ3!vS)2)8iB8u<<5^k0{2O=#U4x?LcApYRiBgm~hT{Hpkh4gE2ig
zBMPvrq&p{hap<tV$hwi;|MnCw29ZEyRl!3Rc$auW0gy^1*XV_QxyR$lZSqEM<ORcA
z*rS<l;#A4)&~#Wsdi(<Knb9Y!%zpm}iN;O_8zA7KMH86g9xJOakM!<;#^QyC?2`0#
zzJ!10gSQ^$1hCM8W;Je&+0%J4Be{w*24}bSEV&}X+U}D7J;6NJ25yf$zp4LWB*d~a
zrRP{miGyB#@j{={*y4b{x@r6RrsMQt((|?6QHE_N`jvQ)Y~Z$~s&A|*xUPd&4cp0#
znptlq*a*!>O;g)s>dBwW|2sp4vjut9Pwrrg*w+ExIp0_#7il3$eDW9xuh@rB-N9V>
zyX!JAQM?lPt3_^A)kZqFj51nXG3T5Aee<R4zUfM@Qj0$@oV-DtnY|3fW|nbyy98td
z<v1LMdli;ar{l|&^BNOxSQ>7=QfJZ`#fCDYWCnLDws^H*S?AjXhK1mTQt5n=Wb=1a
zHZ79)eg!uXUWMr!zlT^PB(Z&OeF-F49!_m2EG(BVUmf+kTr4eMDgrCWT#>P{#2s3~
z>>VYq1r{?g1r}F*XTQDh)1^DAOyuB=h%(7RN8&)tZ>H(bQA-u4q?YT5=Ja3^e7dz7
zyk5{(8CMm!#P}<aX42lfWa^jmTvBs}?D65%1Xj<nR#p%p7+A!{rv_~{3-F2)VTq&3
zZwp>(B!fUgVtzv$f0EXZdjap<AuYXqgts<3^Pd|Dkv)P-xK>}naC&q_-sng%&>7`8
z-^*{UmddE@aq>$_tqM`i)M&GF%=mGI{_dRg$@iz#jgMK+KV0f~P~h)r(iB;?c)=}0
z5-ndO4jWm1YFrZElx>Fyq}BG)OhZvr_-T0f+tYZ)cNueb9eta688S*TvnziX03Fgu
zW4@zRZJ{+|i^8Vnt2`nzc3VL^4AspSqgr;37*k15u|eqCU@U7Kkh(fv#E9fWY0SPv
z_{%n7BVv4)XF@<=jdEjeF|WGB;@=p#+GC^ONA#>lW|6x;gNrW)-4aDMIt%RgoVDon
z@u+kzmTMiC>tt(@Iz>fg?n-B{R<!Z*>-R0O1bq<w)X!%IRIQS^RUAztvZsD{Pp4}o
zUNQH^i)v73!pyo4`BofFYByX$lO<@Z5*_tl22YEjVHY(ZcM3%YP}g{sK|tycC)nvJ
zt%%I-n7Qz5CoIGi{Wu~ej#>lto$)uV_SIpK;}|pah3JOH#zb~veLMLs1}>$9FdKRQ
z1vxw&!}>;4%_(jPvZa?@(GwDytGIn~hm!-?0<Kh14vYOh_3|tQ1ztBko5o2%0%N}p
zQ||`xEZ0sgJesZuWS&a#S`+$cs;V(qd${-q+qY~Ab<tC|%?q7i1Ygdu?>M^BIdk^m
zD==$E_ru_$v;DO2jYiT)_m+JDTlN5|+#}*paKiU-x7o82=o64DD5apZ)+a|9h5I+S
zLmU6K>Hev})TN7tzV02S8y@}qmTw47p3};Ads9)TM{F$WqjBkzt6s2m!@wS|&A}xv
zTd2EeToq^8E$h>K5xPqncMnPeSOV{8{Ye5(WGIAC&(@32*7@!_yWGEMfAU{_+XANt
zHVC(qe2%Zf7Q4B>D)P-=nWr<RfRH%r>a4OC1gmnoLo99mHw^l9dPfItJ7))`{^NiT
zS{d9Pi2+8tlONe8Gl?4dnQEg8<G%3*7W*_&Wc`PlM5g}bao<KcnIlQ8DjF|VjHw=a
zn)n8v<f>eu)l}yNyWGs6<h^v^16z%@i{vLeD!E!IhNs+A$kt^mhtbi|c8_bqOdJ`a
zVPR3fX_D8g8BH3(({hKUXklfYkrSf6czcNU6ikne+jAQh|JSRIG*bm3H8Y+4o2x(e
zN!u7(A`Fw1u}zni0-^ulu!gj%uiI0b-X3|Fh~1~a4-d|ZQg)+-qusNZn)yt-ietXQ
zi37CT&_q?gXa66CKR)Wm)Nq@l@KRhzsug^*1HQ?p5wzTsUaBG379$5(O`(l7U{Ddh
zv8uDkg1MmvY>LRW5l(4A9ykGSq<|soETfgB%b=6Lpy-9$uDn1Nk?mdgDGr+rqF-^>
zn!M2e>i~k;>dk$nQ?@I4U^2?2!`JRGm1bqD_*t*n0A8HZKp|{1E4}f1!c$>V#94@n
zV>=A$Y{W1eYR2O@+6oS;!U-}&m~*I&B7U;xpnR;D1GNkirzrw8d$~!NrM=WhatfI+
z{66cN^XGS3!c&;a(+jCm9*PoaI&;nBm<<fpjc47oI<nrzzoW#<+qvcgIP}VPFWA&N
zqieAgFv|7a7L{@ubj*s$WGP8!<%lj8>@wo*D8KI`=DTnXgpLgm`XY&fMp<kpBh!RZ
z0e68S&1^8GV(=|6q|#rF1CvBKaGDRU;%X>Q0%^)*VdX9pyRO5e>OW3(UO#y%!IscH
z!<Q5Pz~7N#KfE@?@?Dj*&B)`*4i*V`4}jkcVa8J(R61Y?ck2m0gzrXu<Ob1NWZC`i
z=YMUcD+}>uFmihdOsDEwP+N9_De$WI8!umo4C|>JP;FDt@E_w)#m!4eYqNazWwoWM
zmgtPtgH=g|8|f~^9Qqw)uFk+U(eV{p<&_@#u<wn7w?mDGL!fW>544C@cS?c%+-bd^
z(ZB5Y7Ag7mxoHKs^({}KtH>{dZ6n>L+@Ef+-9d^yeKx#SnZ%;lwS9->pl0J$`tS@l
z^Ftu0BI$GMQWOQ~NgoG$k4054mv>`LpmToLV^ejsmIqGeDYG%LJVv*YqE#9Q<aFCK
zh|i!cDdT#<PV#LFiQ5AXAFgO)Ea-2MZhx0YXx!7o*8=EY0A=I<y>dPAGnP~e7$zEB
z7~Jjrq#1rL2>tOnA@;kX)g&s76q=@7w%2WfklS1~oni4+^*bTF36Mk6z;Z^22CYL*
z_HN4Wk<romGSNW+?tj0A@8^*4zZ-|W;oFY%{@<$ez+8enP24ZNG!Aumgt2>essOGR
zAUbJ0lVfJm4L^M^$%v$Zk-pD6Nf&-iQ>1SS2T>rf-Lsvy^t>xsP|3@mt6B?l(x)3?
z>k=WhtWh3wf3uV^XqglflQ?#rp{nKbjh-I@IuQc+a2Dj=9?&7hwJ4P<OTt%DUB@X;
zKg!JawLyTcfRN9?jn&S9kI(<<_k;@i16Wn!VEcJ2N0*xzrG(7jM7dN0MMG^>?dIXn
zZ@9);-uwf!TNfK;Ox^qY@YCm`LRwp}LMI{aY&A|B_TO3j7ynR>dDe$!5sGy%v{k*U
z>HzSom-^K8+cPUV>oaMfY}N7Y288|VqY<xIW1~0RZb?25cvh7Q1O$H+2r|d%Ra3nH
z>4IK&S*L>YjBfOa(Ch{+yv$$JFe}0hUH5bnJiT2s1<bzU*7zIhT05R&3#b;fAd{Ui
ziWz?tUjMPFju55Mr7hIVa&gyL2REF~Z7L+LR>)2FM@@20($wf`8I&^?_8nhmNDSyT
z8z}4b+77XaWq}P`6}s$y6VxZXuWI)$n`c`UUVkgE=yXJl`O0e}r-E4a6*bT>Ge=$C
zBXSYPk`pfiWW3ReUoC%@wMXw#A<FR{eX#U5qSyiDEh}Q2RX!#oH+#>L==_kIop}<T
z|I$1~pRo2&SUm?xx`5KC!U=cjsQOB8#^0V?$s#+io+si4TYdzZ_xRi@wp=R0&Aqfs
z+Wc3LzqO0Mr>U!o^b$p~$PCP<T{rz)b1nvq%GT+p00&xg;E&A6Z8`+Yq{skfM1I+B
zG<!lw9_i(%Qs5;&-M&R#9)!o>D+D67Xk#T~$Nj;5_49eTv-#)ki>Dnl_!}nfq%$u1
zq(ZhY5t<`1y1dE|wBNZFrA5wOG88^7M4nB2i)(v-dYQW8IA%`|y<CiY!4Y^`;uC2T
zlqiY<yVASU-(D?Z5w0i<8*TH#eJAPj#x^+*Cp{vI(s1(~)A7T`=r_+>)Su3VGE*SU
zhKPNWdM_)roq`~5BNGmX{k9Li?OST!f<)y$#~e$C!8c18qX#(EcGhf~S)y+kvxW!`
zV&{kIgQqKI`u@nNefT8l$(=^H?o1~{eMNc&hJCwT30&yyL0V`g*$7=|>9~8f$n&>s
zKBQdU_-Itmx;r7HZo%UGK|VcbB=WROoSb1e*JYB4VLqDokwNyP40YTddYp>I8XHkY
zTgnfd!o$M0*Iuf+F8mi2>`?duYgl()eLjns5j=txoz-8@LD1hHW)G~&lbzAoG(V<x
z7^HAt8wpdIm?-rKp@gWFI%urdGp!dmPqI@&>@qi>t9lO$lLhv5tJi5oqE@oH2B#@9
zf&N^pcdiG!v{*DG6NMhO+v^>~wiZOfwwgI~C%9DoIbpa%815FR?$5T>g0W4GR(Zb+
z-#<bpzG%E5i*Un#fwzO#K@E<@wq(imw=4Iyo=uazA^fQ3AE02)=|NFm$V|42U>1qW
z27M+xqSH8j{q<6FV)uV_ZVLCgw0!SH3~7&Zr4O<O{zN%fnffKL&SaQQN_2l+yJx-H
zW5hR8h!~pu4~-XRr(2Vp5Xa+JCSWJyJxr|kS(VaSO9DE<&YiW;hXH7n*xGTXbhYLL
z*4iOvVLX3;osWHiD<BC(5kpBd^o(LohnoVde8GOkHS+<=D;6!??iQJY+vH?4Y2Ff0
zvQ#Y3ygLH!Tf}OwrEWPI&!`mrXB=z_+pjeY_qM4|7*oE1d$6*IlXX_FG=tp<b9YGo
z<7T;GjL&O`MeSgO$2qe7ap_uo0aD;5%-8W70t3vQkvduqC;g?33NZ(FY9g{r#94p1
zRMEBhW{*~qgPK+fIIQ$n=U$<UW%@%XN}A(ubQ*`xLA0Ji?SL_nw4ha`F5U(P+#<^A
z(%(%mu$Q~OaJs?>oAkNK5XhhF3VgECuIuus6`8j)<nO!P<S?bu<&!g#SJJl`97}f1
z_WHH)Z+;Dj8gFFzM=fUarK>Rof%E03*+3n$K>Ln@x%cjK`_(QV1LHNvD|^g(pI2N_
z1bg)@y=mwa33Quvg{&R7q`S|tW}UH03uh6=F0SSPQc`U2G=qA|--~La^30Etgvomo
z)wqyj!785%nba1Mla?!E74BkM5GdfUNY)G(P02*7Rw+QAS?>_6!hDF<2iiVCR8)}K
z#DxIvTki~Vgy6@tX4-MLZWNWr$c%XVG`LB?)$SY{A^3fLtagm%*``_X{K8F}a5~?)
z8ybU}z(;t~wd9U@S2z&`oj724$74hZvyDQn;1zq32!eJLa6iVrSGad%yaqUW{Bm~B
zF|^jIoZ(Ee&d%6{E{mb50HKiw@<UW|`i$b%z54r^t6fVB1B0tf_zv`djwJzr7}sbO
z{3Yv3{yib)sm&L(`^{-{Yj+ccH%4gpTi;wy<c=jift|0akR#i4HK@zr6fbkEtTSY~
zq0>Bf_&+1wPsWMj{j(j||Gy<8YOz#sDpzUTI%VMe_0X;*Gu%){>AQ%JvYucUWQ!C-
zI7v#4NS*3LCC181zMg;b=zyNjO#>DPNSuow;zSC@W_8L6r7mpxpR7XyRc6IOkhT#i
z(?}E!sF?*{>e^&Wv>6A&4*A$1r)?gWh0%5Za-zZCy`}Vxu_6xMK8KK1&(OPE_O|_j
z1ejn)J&U55?mr!ma;uVUW|}?(zSh0oI>0N$ANEdhvlnepamq@}#M6OK-@+R+t=`5;
z?yT&89>UCY?>WaamiAcna9osAyEjF)y@@jgv5g^X6f}18B_o{i6uTShZBywv$$4`6
zkXGg;FCCq|!g@yU-+~tW!v6R`%;@K>H{^+R$ikKYCY%go2vAQ7W>mRkP@52p5HM9y
zYUyrWT|*1>Y3}YrwtMk1OD`lk^!WuRUrD4|6ihCan*}$;+aO%PrYRah)Gk)cz;T%n
zJQT2PUGEI=gxzit5Wr~qOsPswH)?E3dp!KBm%6fm&Y9@hzL$!qyZhVbi?rfu(16t;
zM`1CRgI`kd2JSJrP0r7@Mvglwd{c1muR4P7%<XKeRk0nU#^S&0BzgY#`K9MqYDz_1
zLLbsAkbD#zU{y~IB85U^5#946;Zhh+dcRnNnzF_YmY1F8knRl#4cxY2J+1f3o{lK8
z?m74l=C&<IG)M0aJyBV+Pdu^}tPr8*p6h4b6;U?Q0F+ptQ?<J7kK`2j71r8Vjj!Iq
zgtYpl>tSoM`<g_(+^nBH1-`la6%%ylhOX}Ycu(N&-Bfq0;zd(nx6iT~%ykL#Y6B#3
zt4%Uh+J5@)lZ*c_xv3xc+wILm0*}|;cmwOZe*fn1$uepl_XHj%Hz#p-Y>UJeY5Xf-
z!B=Fjk~ck#7NShyKQ~U-B+q5L#0bs)#U{|qSxIvIJYN~VEv0UCly4Y9^YLA%8s*lG
z_IHAPQ0Fg3V`IhkD8z;z+#kSG6TVqfQ75=^Fr|qpP2uJ2W`zQumY7Z?+$CCA4J?d~
z#t^9f^fe}B|CA-$Xnfb)>_r;P>1UzS7lpJCL|GB?#sMG%ft5oRC!lQR7R${_kGZ8N
zmFo#Kqc?C~m<G-7m4iWT?z;5M@(nf&9dwFv<9GPqh~M9)?$`@Dpp=|WN;r>qJQDrH
zw<iAL9uGX^T#4xV$x?Lv@>X>pPlJ~6;9&(u@$-@+K}<ofs`IVDhEc1k0dUz4_%18n
zyz@d7uhBJ*C+M#mq1Af7o?K0GPkLi?gTqI|lPBasoM^n=$m2}o91c2i$<H1I$Fd>~
zbImDCTg#Va(Kro7qc6J-gE*(|+j>T{ZHJb+?6VA)h4h9Bx>&I!Z|(rkMc*X%`9DDK
z@mJa@LrPu4d#wh=yKai-EXW-eJ59hKpkl|(6BNnO$J}5JAXGRu2e)0Wo10olo|7kZ
zlDa!O%J?GO`!4P*Vso4IR>mH?(7PF3+LxY4uHKzr7J;dty&Y#<PNxGR5KNNfH!2@w
zKo_F?2Xg&+ij~ZQQSNo`1O(SVwCg?ObTQNvCqH!dhZuyFcWTRKC5N^q-w-w8Qoflo
zHW3W=F7vc4XHb3;Yafel?Hvt(L87!ALEZHo^^4S;yE0mV)-_Hu$DZsWnKyLC1b?kF
zi<~-kOfc1h)va>M0i8FBWoS{kSiuAPC!?D&vC<Log)lvV?;AARRH>m^)&lHZ&;;M<
z2J6nliz&|?yb7rzVsg|x$=G`b?MC}yzE><Gi`rD7*5)Z@Yfjupxpsj}DAD5q3F$kD
zk!9;^=2}Y#w*7l^U9m2Ur8WoK1_+rr*&2(HVi-;A;1PoUu_B~e3Tf>rX(?5SxC&$o
z3r0^c@<ZOPbFZaf64~PkcXR2q18f;4?wC(VG?t0bF;Z6sGg>z!Qy6rFX?J&|GB(-R
z_*|^yqtX5`Pb*eZu;>T&C(d73WadOPu5Xw@)95+%C>nPZouJdO;l6)kamngkLX4fs
zY)<S%h~lCy$ani&va%iBBeN3fvl9D1HnuC9G36OsYkQrT0L)v}nTGD+=RnmYC*HF=
z#(w*)qZLo~hlB1gyt39081#|qUWT6^1_dofMdMZd?Qz=^#fD2vHcRTgTC3M&BVVQ=
zmQtz_s3jUc|2MeY39G-wIXh#<gB*U96RNC(vj44_n8%1_pp}<sJx=Xa(e95RJG-RJ
z^n18veq_!ngRClzO9D>mG%r^?4%?b%3MwM2?0*8$34NFkyqtPw7*tSfyWkRO)KaEb
z6$(1ID5=5Ku>MJlQaMx*-4Ti-aQav42gdR=rZSh=B~c-CoYZ><2fFQS6D$Z6^qbsh
zyI{K?G&E0XE6JM7KeMpDT>_D;jGe2LqO<2=><Y8KCfMBM%<zZvbtJ5z5<S+`a=d$?
zw%YJkVH2sLdRT8Z1VJO7(`&SwwuglBc8db2>uD)5Kl42Idl0aum}!0$=krA6T<gUz
zP4EZ<Cia3M^UY4#mzy!!FGc#O0uZX8Yb(8^Ak_ovU}+%Ya>RMQ!>N<*zuhlaqUZX_
zaELDbryL@sg?DDab9OPqjqE{nk^hiS+%0P1PEQOVjQ>6}%5K=u+Fk&<Z5}US9_6oN
zznbgpM;GJS@Ja0HgW*74bi4h8g!(i0{bpVr+|iadZl@k<fb4e9`06^t>KB2A21uEg
zQ&Mi%w9b4%-FDgNjNLClluB(S$h2%&VW9YrE4CR^0#aoTfi!8L*7-oY7~44p9Tzuu
z!Hj?Y69P7#sV{2buP<jMI&Wp2@)-w@_zeCzYdK;^?)No~GaTF1x6f}f1~OYth)ztT
z0eP(}@Rf^Z$Me|yGS_V67XQ|v_=pjifg0$4_h3*(wZiO#P)+w^{g3<2LNm4Yd8+*$
z9(zoqiBDgetP2Urgm*G?Iy-sIt#-T-27v~DOHbjJTh`KmQtp8!em_MUzgCr^6s`wd
z(EOQtu<ifV$YbBq-?0K-`3lz%7CqEQn~D#-Tpptd*-MQrXN`ILTG%iL_nG1k4=++*
z`pu0C;r%0bSjX2Ks*ui&F(|V8`iADWm{rW~x9u4}-yBJY2JU{l<B4p~BLz2t#eg=g
zP^d~ja)S4Gw0(c9J%!XcnDz+$$#m;4z%%2Hx^Ik*8iz?l<64+{^()Dx-KQp@Ee##}
zl%pH0C-E_Ag9X76*b1Vno$YBuvjSuSDAXV6k#Lw$nskV&OVl@}Y&DiQAfygyssM7i
zGHY|Wa%$gf57C`oBv^hF<@^-vzoiN|9Xd{I?rTNML1e<T4tmZi6qHe*6rJtOPj0=g
ztIPjgKUmdBUCMYx4XR|-f_am36^5tzz=~*nu8neOJJPEsWo^gIHlkY$mYUtjSE&qD
zEi-e64F6QL_(_%!u-Uzi43Gd`NA*oEw-%a7&ZgwSX-HYPxT&XnM8DhUpj_gUt+4<u
z*)j#(hz?*!wQW~8M9BL8R9DZ!^>T<9lVeJ>*_Va?#>z>(9AzIVi#^x@9<c6~Pj8p|
zEWKVeM+Dh+o^X2^qFG<8K{@ck47msS11h0!0r1VEo#t-qyV8vstOb<CzRKxB%m_?z
zbxl&1&HZ$;I#xYR5O2X>WL2Y(MVnnPR?a>gKGQxckQKcSA&T^KdcZQbfg&;|`cEOI
z&ByAR@Nr=WZLSf?g)g0qY|`)jh1fv7uK>J0ER92ECwAWua>HQ~tAh{+DWhOmB3K+r
z!1u)p>yYGZR(n^n%9sxEWWwgGMnVXslyFqA`Fd|o2r~flbRw9;S(-A!k2d!`Md=>#
z_E`%SX{Jnrxa3RyH#>Kp(HmP+(M>Mn4N_>Rc^|aDo`qfw+OgA&h7Xibzofj`KAGPc
zpHh#|C)UwC*#}yhWtEjmmVS584Z1r6>8bF3h!3=*)?Wc_0?b^PrdT)nO+2*E48Ht8
zd5_+-OtbGTlv;Z*Tsf?u&f7pT__8I=Cu%{Qy@Cq3xSq;oSy7r|v*s$xE){^kCyoS8
za7K4MBvmp}G!P)0Q*wReG4KdMK-e9!9iqjIq9RGod7FF{bs07{!QkXQkX0uw-S#@M
z86k>qwD*(iFv@zB+n8)+&hsrSoN+*Ux%|Q2o|zyk+qJ^n>as>P!D+pJw6U}{lwv1D
z4Ul&1;5ayif^2DtG}!9!&OEa)JTA|8r^63<F=|Q<eQZwuiPRlHTS_)E9e!djO&iwx
z($&{~ab-Lp@8morB<_I{`$v3Gnby)(-E#C*VnDZ7C`7}fX4&{ID~el}OI3E}3Iz=Q
z-0Ou&adzkA#Zx3o%-Z$w&lO5tO)2EbZSrQ?2WXA&mJDH69J4++T>#$P7-wLCbh*i^
zE<;VZ4Hit@kI~6L`m<p(8|yKWkx{9$3et!sIpx}aR`e%2x;QTz01uNzZ@j=zwdp%$
zwGx`sHa{g<`9ZmwJp)hI2!kUX+>Bps)MdnOIeI(1R;7N^0PT$U3);45im3L0!8z08
zo7Zb@J&+SfH$b3IUQhgObc!^~0ba{~*O9^fIH^n`9NJy$aZlM-w8bdEBTJHRQ#bVe
zcGE@(;m9*ol_xK=Leq7_mwtiANbHl#8=o4;NEJS{OrY;a=UrA4yz1wL1+u$upkRV~
zALGGQmYySY$LHL$){o;4kb+NXZPG#VMkT8F)w)xCzMytS<f6;q`v9jJRY$E|ZY__j
znvCxmKQljip4~D=vApIEKz||FE`1_7i5OXNNcQpf-7u1k`Y2H^v7Ggfpg#QG+rb`>
z_K?3<*kUo&u?VNY;dHxCk6J=wm;@UTpBcKvvh2neg$*^#eN}Qzv?8yE$(;_$2{EuF
z8%uJ##LD@qeuVGx26<#P<T1T_Y7>aO-TO6?!L84z0+67()R`=rr}j8AESN)8zB9@N
zAOp~oDe6~{ybSPMfo#dW8WGZvq?3g5)^zHa89gD32XVwWwJr?je&-Nmj~(r(Wqu7y
zl%ekba`Ro{%V#yx_Wvn7a7&2vEJ9eue<7uh6$STQ>S-~JQ`3^334Ws@D2||2VH69y
zMrx=sp0;u}3{&U$IaeV+%T&uCIHxWNO{5|7QtwxfphC}85VF=i!&-$%$*R=a(w&v_
z2(JCwadG?~3%_1xYo&>}a2e0RI7pgjU!waKd-TEcfIMeF1!oD=#N5I{K<M3Ovh`{z
z2VO(K$)XkHiZ#o?I`q`^A}0g{ssSN92-U6rx9;pYKZ~SnC`d{=QgxKoQ0JJx4|wqF
z)KR2r_pmS^)~@U3bsYpe!fKr;BL*2y2yYt_Io}l#ne?7~zBZGuRvpO5sm2i~&;LtH
zSo}yo4=g_+k}b6|R%ri7WbTKV-w?w}{Sy)Y;kcwI;K!cTQbndH?cJP~fr5tMf1r6m
zd$I$vYr6A)$7Cnrgch$|0#3o1TSjvBfeO#!?$7hl^C6ZF86a8QK3p>JLWW@RQR!+2
zu;mUWpWL#ZC(;jEFO>dDLkyo&Yl35d7UlN|jX%+)nek6}PA~dGSFHB_W4U4M{Isx<
zNd_{pzn|p$o+Qdq5_dI!ZV^(ff2^01;!#$mnq`ko(N7Ouk_|?5(A{eqlgKfiIlroc
z63yAmaO_6K=Dz=B{n(Mp@^I<EqQ6~+?lYeki_r=Ddd3047L(i`Y_B}HxpFZ{HK@%L
z)^<q;&BJ{%Z*!c?s2WoFjFtfSh0c*fKD*)GKnX8wwk&I7Q2*vbv{G*337o$w3<b&2
zx?lp_hvY1(AW!2Q36Z@eI<9)ByHWXyJl85f<UhZ)^KIs|ARum9r>}*Bo&C*Eo%HEy
zj+o7QjoWeq;S5>#IS;lPA84=tA&Luli}SKZ?q5eMKdf4O0_FJ_)7$yVV(2j5Y%PU2
z7>-(CAW5o#X_$!e0O|<y`!SA+22q*I12H-OMuj<=Z$6iVUYe=78hsf3L@-2g-6{Il
z`LhmLE`oqe!$9$Ylfi&O>FyPP>uj#ukr!g3R^du|s8Xzi@rhJD&*USFdfIgS^I2A&
zzl@NDSE>gr)~EYJALbgDt)3jD+zvE(=Q5^Lmi%t^o-bszKAJf?cfVu(9bE=HK`)@{
zQ-lt6ETZ$J=I(?1#ii``hzF7r^y%wkU0q%c2aVxK(wcc|_x_aHJrT{0-$F6>iIG}M
zc3(S|Q)ewo2R(;Y%Kg^!ZTzH(!fLxlT-X1ghaxJas+whgm}SgF(gaEyK$Z6vUBh8C
ziT-t^p6^_B=9S5Jye^wwz!k6d!-6V9AD5BiuR`X-jHrfY73v3~RY4p%tC#klU(9or
zM&bJ1dWaQFuo4xb#)22opOy&qE_nsON0-^>T27ArZpbf#<rd@bWOneXIv0|LV*=F|
z26Ce*1<I&s(h&T@Zw>jyd_>>S@XAE8t?-s^=9t{>jrbo2L`|JIta>No9|YmU)=op2
z^Rd&Jv@2|b*lX1_70@hs9^Jhk<<ibKT+bIfn2xXlIn|}UJHF*jLTF=-MgzJ|j-=2e
zDIFT6?h%dnxZ<M?Ya^USFcTpVYQB!JpMAv}KbNS@<^pEm8tSAKliw)UKg7GxrXJSI
za#!JCNTM?eNDi~vVX~2*!8~EMf6qp(MIP7Yv4@Rt(gdNi)g!m>77b?;#itVh;d=)Q
zTDu&B@R;MyE_JMt7}e}>uHQQbq?WLlbmRDW>iV#mpPmKfhYj_|bLEL|yY;(#7DHbr
zd14~hc!fW7<^V<PE}q65-po!?fa9wV)0CrmVIe-rXZzQ*NK3sEch3ukq;1L%mxv~m
zK%k~pW|=Wy%>H5ihmphELVTzaXDEiY7<up9ZoVbia_4Y~hS|0Y`ogQc)iXLC>hmdJ
zYn~ZC$J`F3w?_ZKT@7}U?lU1XWOJ5M@+TxTsQ2yYh?iX-s6PywevfOvv{|<W5}HJ_
z!cBM&BDClnv3{ndDzE}$*EXdCqE(*FOKSlWaNu44i68K)CgfndI{g0*Guo6fa?FOG
zCsv+=j1OZMo`HjiQS7lwNcwBOZZS!Dr+VeVOm=E5bPHg3m2xDjI~ve%rZOWB+c`h@
zML3Hr59{iZUX+sn+^DbJblqYn`gW^FqJtLH%L2N?-}sp}cVkPkapG3KUN<qtXJdp%
zz>}b!Z3Q1T9j=<|tM*bzEPkq|c=1d&>G=F0mT;0;_UH>vUZ$-!6Z9neG}8+cWO39@
zxGHj1_J$D4ct`BgB6ev5GYkF(b3I+(`IU<H1b7^N?(cNFt@4#?xU}M2H3y{<fj$Sh
zi&VKUrhYts)RY@YJTsEt!?V8=<qj?fX{t7y7Vk+dt1Jr)t|)h0PYPF!z4$;2e^Jrf
zsz)+AR&4c#{!_}gXTU3!$yV>a&VRJ*JQKwiIC!zGcNN!^8+ZTMe7d(di|n<fIAEBA
zR?&ScKcJD-jg(!&1Z5MRIG6nc=KmfpnuP7f1N}r}FNa9x`kb~_61LoXVkHXIF;doK
z?3>#m9O(!S-Xa_RGg8cXAmA!$?vWfEP`|Y(Fq<kTrYv?M4tNKbn#3Zf1<#I&Xs7X~
z_y1z#f_wpfrcgDr9=WM-cYBo_FXERxf}y*>3^g@QhvW0MO&2)$=HwDg(Ggh2>rzpZ
zZYO$$I);hcrM-38F5n<>I)PN~O^+qVBaX)3ti{NB<&zPS2Ji7saIQ7A80h%AP72BW
z^nL^j>7e}pvONuAcW2jp@ZyoL`4qO*$iT^6F6kxr;7L$-=DGh-ltE|LXVDE)_>!r1
zhr8rT^?Nm(Mz#DK&JUpx5roAO!1?|4V_T?WmvXjxCX1V&8gj<p;!di~D{(%TG`ofL
zEJ=s~gk1^;l%YI+*~9`<=J@^x6`^ia#9pYwbxFCe_eDqc<~1*w$;URZx4!GGnJ-W$
z*8u8Gi`6P2^$Hqii$Srje>(g=xC_#C481GEBxd_U$07^I<TzI3G=yt>BxY`*5tlh9
zrpbTGF$*j6tE{d_q<LEPWMAbQsUunIhD0mJGTls^%GQ$7tNPsP%FOH}lB#rzqN%$E
z&-gT9J6j3!d4c7FMJE^;d+E2C!Tsk@!8({5;COK|LP~`swe%#4p}@;gR=UXE2QeJ5
z@?xj0MdFi$X3N`9pKraLHvv%9F<r;m+VaN6dkt&FGj~spgU-*{kf-Z7VIWBqcqeI$
zS$jG&E8|1Pzn-3ueh6Fx`B)j^`ENQT!_vZ@0825jmf?e(y@t*I9wL-JffVcKFzbv+
z29YG=Xo@u)r|KiE7`pf89k+$N1e*4}+{4>Q((MKM#wSb=9#w;N)r&H4uQ|`b;3Pl<
zd^Hm8m^JM49BF4g|N7sWh16<6=ec1}kn@Y)0-WFCj1nsyDOq7a<%Z8RM<dt|muzmL
zI<^i1W^wX7*)go5De9tkIPR4l7ZIsNrEKud=kshHe@;X_E?xEwP8td}j@y(@gFp>8
z99zN+<BR=020iQ{E)X%#3^T`J=3ptLy@ABhR_m8ztdTIEZ%bzfE0spenpIajl)3Mj
z=(X;3kk_Tqx5mn2xz=(RIC~f<+Nk5c9sf{nGeaqS=x=LpGU%j)F4ida{y_+{vN$Km
zg{@cZwf39kxBw15fb^!vS=m+UO4e4fVOImpWMvzvpV4YqjASjEZ27mkT={$N>yHqk
zZR9$>&ADb@$XmBSDV?_Cfy8?u^lVj!X*^T7o#m~8v3UK-Z_3)KE?MQ#3{f$!1s9HZ
zcUlN+)eJ5aA(oz#+qj|4L9bD{ONh5N^rGWz0d|o*C;b)U9qAp)Vjo6QVjvHnuKM=P
zpvs=xJa~ky7EJdXEY-u|1yJ9VfPk-LJ30Forgd}AR_=?B$ugGMkcy?HEI3|;yv&;N
z<r4c|?56pS!XTHBec^^Y4^ma3>+$ryg}vJqgZe@6-Gl_Dm!6M1S~GkiV17HEeH$oR
zw9q$@z4kDe(`_Hm(Ud%Lu=d>Vb9AEsV`Qlckv2fF`mQyFTopY2z{YD0cq?-ga=)87
ztZ9X+bNc;beiJW{$g06o_n~TTby~Y`Za5wOA8OzC;{dvxMNhr7<fm4v<m98-;={^&
zWb$@mbF*oav_X8B;-c)44!`1a;(z@R!jpMz`igWL>E#O)F^!)5Fo^KW?Hmoy_Dt~3
zs`HMk^m>L%pZ$OV*P=siH($qbEPU0?T*YBBqNP8{Gi#5^-_-~#bbT#+I@stF!HB{f
z$Gbhnw0_jsntGe=BcoaNh>pkE&u2lv<^w^~#o)W3^=elOPorH0UCmmyP`R9gj6n%6
zVAYJ)y_Ln0xX`)Jx{s>6F2Xvx-aI3Hwl-GrrosI2ZuHbRf9<b4YS=5S1+}u$l3zjz
zaa4cFOI)-ngX7vm7&S>ocO8GQGA)&+r)6Z)?&j;1f&F$6qp~2lz-p&V8j@Izo%z0A
zUPq!lUjh>MfJDux<DJ{Z?%(XHP`FnrxYef?;(7md2nB(H@1D#t8lH~FosI+g?tT>&
zJxLteP%JX$r1M+saw8ZUiL@;<PQ(wrq^+xM$tu*hb{6C}UW<8J_l%ed;UC_X>dqDy
z-?vFb6^Ei(5$oR1UWgF+6)XEMN=}D8s;^@Cx~*Y)rrxxm-VX1dPiacq)EGLeU|qQA
z`oJPFj+e-$cy;^@K_7j~&nSPc|DDa;aMEUTzosgnQ&&V<#CiuiSpKNBS}ox0%;*Q+
zYt59ooD#VG+n}2~Mbb2tTeNK;yUrfC+WiyCq#Knzqd5bzf74(9+_!}FwSSzbZqq-6
zNa-~3Jg^w`9ei+z<rDGcy(Vy#W0saLUI6MLIjaAfko|;|4!GTSezH#c9s19%tFM~d
z7(}i&D_6X7eW?D%bT#*lff%h~Cv)0&**8c`@wy6W;G$T?Qo1_&KO3t9)?`G7KQQ%s
zbXiKCv#Wl6j?N*?1FfZX(1A7RUh|5+w~v|0jI%Eq-(^cbS)^&^fOEyOTw`h^ZUFj`
zIZ&H8(vsV&x;SLG#U7|9q%mfaq7aAjq0)hf?QxEJa|5aUnWUSX9RA9q@70;35Wud0
z+1ED0mg|MH2@U6sra!REK~&~5<_gBpRnZOP&qfwS1(6rLFbpw=w=0fw?yiIaDqrjL
z+aVLhzdDbpJ-u%q<5Jy_Q+(<u$JLaK(vruPPM+_GoMCP;)c?NCYKr9N9V}NU`N#>_
z`OTKKe1Aq|e=Bg+Do?IGs*J<a#2QT}seYHkxVrDSQ~O!g;jb{4=A5>Ok?BT-gxUlu
zkILk|Ca;o~!9N;n9KTN{!pdO|;}-xLy4ZsYdvV!M^H#w6AkBOh;tSjm7)P#a7!cQF
zg%5M?Y^|z9^N&XYhhBfoE(^mZ2v^>wzOysjXEPFjjvDobRXE7++p%H54h_18%lQ+H
zO_Mb}ueS}_)hBjd^0a@}`WKyTZ;dgv7koU{uC#esmMBN2k79<dmv?SHsBcyRG~|L2
z@3TZf=@aSYR8|hfDlvhhMr3EmR6|scB;__fN6n<_2zJB!;_Mr>|ATw>Kda5x^zF7n
zk^D)jh}*pmp;a9P@9uXE>;#=4&t(|~II*^#&c0y5i_mWhdQ;dU5#UfodD`b^&|ouQ
zI*x0K76FL`U!kos1Xy(O202~iC;`lJo5AY^ee;>Fhj8e9d@qM!roP9+C1Z6dlxgG-
zV-_>jugx4ScgzN7Yq)CkRU&#f%M^X?J&?hxKDiKb{nIpK^rrBvfXOyT5$snN4T3XP
z9U(AQ_Oq@s)9N8fFI!X!vrXNG$f*DBv6>cv99Imv0d*>UG>noN5x=vZ=Ja6CzI!-}
z8Wk4`VA|UZ=DdEp2~KiKz3!1qij|Xymt+-^@_<H0o`Sd?9%fJ9-_%g5PH#(qjXLeY
z;6Ku8M@duIcsV{!b*V{A0W*kAg!KG;53-`q<t>6Qwy_bZ;+o^`i)@>2Bgh2pR%2#Q
zP-uPz%Vn;H<lECF>C@U(CMpq>Bnp%LVr|2F1$B;rO+GIf#a;Zbl)RRb`0HtfEWbKq
z0r*Y{x_>-4E(N{T+c66D{Az@POJa@(I`6g^S*X0|&}WhU3{<`;RX_5(XQh5zl4jjA
z66)drQvMDPrAAKoP8+;i62VCTCq0%g&*@qNPd{uvhPvopXkYSim^^2cPiQf5nd>Y_
zA*^Pz40oY^FQ*<#W@N5D2@=3BIWDZntU_+<(Es4tOt`&ssT+{G&|i0mIF2}0dSe!g
z>H66E81om^u6}P~xBJ;pG()i=M5(~k_wX^j_O^hLaCgxi&Om!0ejiKFAQ@c$9~J<1
zq@3la|D#ZgnKTgGiVwQXR5+D&E3#g`TCSh2nB~@&0cp7@O+mAUfY;_d;7l(2tB*R}
z6g|F`?QLdNRPJq$H@Zg140`qdv;(eH#@k$%&hEQXLveAfFGs864vea3cCUkB3y(VS
zXYbNhV60oy<1^OKk=M20DOa$9+Mq-QI)<^U2Zy>L_XM|RTAtTKS$v`u;AA;4U<u_n
zPt&?0OuV#dwNRw#<yECrnO1`+Gi@hXFj(WltwZUSV}CSG@dseR{~u#-85Kvkr3(j#
zU;%;!hsNElarY1)xVr@>xCD215AN=+4FuQ5-QA&)e4H~gcV_Ol&RyqMt**7|t*YI%
z?cL9Q_Oh!|p`IoRvc&A!87#7G;nq5sFUPMSF{fEu^f+0`YH%;v*jMDL7l9<a|8y`v
zU@mZhoW7Xz03ifLDkiKbEO+GaMuAX`YL#k)YSZ3vwT9q6VBf|_j%st0$7XAjgKY^e
zL@HV-!R&Ea^VbeQth}2_8P`-{C~0RHZZhv!6ZiAx!<b3tY}Cz1AA3Snss%z9g;A%^
zsX9(HF58g^A)Ymv2#4J6RE=IYb}m2M@5B)V6gk)iNDhj<CScr6AR0KB>19$AP%h*u
z6EMj3#}iO}dAZRh^z&i<Mb>u!l@RN@?MTTO!r^y3WD<J>dpg5p=F-M>I!Z^*FbT<R
z7(zrMPA)^}ymCd?F$}eCPk#2g!!BZ%J0VadD;C+kr?LvOg~_oNDZ<OmTy7o<0n<|j
zx0LNBGpdK|Yq29f@*cY0aEv_T58u~C-`7wvzfTA}c);<ZV`r|vFne7u)7^02`0NPE
z*Y0)FG)ktDSAGr`!>}D>&fZgA8zG-YRnn<@+)kwZX$^iSzhiWUi>6p1|6;z@?DeNP
z64~4)L_pz6eotd{w&VI7pJ&48eyA&|c(<0`!`$<@r)nv>NtDSZs9&oy9ASN%N#J2Q
zzb!rrR#8aJGvj)g7Nj?VWqX<ZpwlsVuR~~3sQVFRYX30Lo8=4I9jN?6z&kv@n)qo?
z^)=Y;F<2RWPrcPLej|XX+|xzvdw1Rs6PfknGW|iZvk04|C?9?8BJ{~+v^z=&?SqB;
zP^}e|umCt<Ah_q4efKDVM{G-7QGecJN{D#cTF9^Yz8La8^Ai0`FXLyfGVoB*^e~$!
zuP_<{eF<6X+88c*vLWg|jf_mJTpx*8qp21s2{^D(eQtP;({1hmF_vjW`r+Cg%Wpsi
zujPN(Mmz?f>y<i#GSF*;8Yf3v>&zET`f(tFbKjQ;+&#^w{KY!w-_6;=f~0n!(s8Ss
zT=j*TeRkf?tLhr9I^MPGnE}5|#|8Hun80T<m;d#HXTDsU0gPK>I08}ItW>X^a-?mo
zwa0u>Z{GZa?h`)7E5+Z^%qdlp`?J?7qIPwXyL_z4IfU-@tt4DR=Rze)0yc8`GX-s%
z6>2$m8@$e$qKtdHW%hK4va_A(Y!XJ>vQWBxJ=SaF36=9ypj;n8Rt*fWy!f5FZNyDl
zx3RR(PeuKeU}=iLXG?9uQ<><hygTml-~;G;$MdbrBb-Xwameszv>h}aN^{dj-}jAP
zD!t*jPTpZ$BGV=EPL~e#CG29y<5K-Xv4`2+^}Kb9KFYXaNH4nj6)*k8ST;XAwTjEP
z$@?Xf<tAmfmZW}W4P))escD=B-Ge^&>h1CiQt$ml^$XfF<m}N8x_of-;|uO%UP7;F
zGgYUt*`qt8-+$b_kb2pqDIBRE`g?(qiRuts2jCm@xj=$jDR$AKF{7OB`@(;qaQW}D
zDOAo}7`<5u?9%#hn!Vbli+a^@-3saXf{JZr@!NjZ*dd{L^_Kb!!7fv1n`PJ^=QOa}
zig?2TY5u;+KPHy3KXfi!xPe9}Jk24!`PLzP-`_Tu)!n7&imR5Zn)bS0bu1eMj`EkY
zBb5%@U+cO;n5HPWy(8~`D*@^!>Mw(Fueor)D(39ys_DK{<SXUaR2gGGV0!<`SGqk6
z=}hak%o$R+jm(DBh`i9`pCM;jb%*2b(3)Px+^hPWj`4q}yyj$!6FOhAeCDbfY`*tH
zw>NpORb#PSo9e%hS*ddQg#-x`^Un7fZ6{>B3qU~i>Rod{eFIEFI)LRVZ3&*wt;u2m
z3`g;&&s8Fmc~vHndRP2A`T}<eZn?gE`43H<7@PYfw*`HE`BK0cB2Qr@eUvU2VUWui
zLe4UPhvV+m0J*q>tBQ~a=<4JnadFG2MEXuxo&#)23JB<+Z_cRrTMtyzH|@H<czyO@
zBJ>(8wViH#C}nrAmwQEhzGpI#QaF|Bwp=f~h#l7WT}`!UleFQmOg$UJilOB!DRoE_
z(ImE!?>*Ab{(=T^IZOd~T!5n(kGo+he;4~0T;(wzgB7wNwdjv`$j7q=f9_*0%Sl#X
zVyM;|cx&7ig4a^MPa6DRdv?EJ`MOdoJwc@PPazK>m~Lc%DOQq=Ku*RT1>^3&sU$+k
zo7`PDFr-3L?9mBB9|+(S+)%uPfZbi6UPuqON0a{aXWW#paGU<F?M(R)0XuX0Q73H@
zS_EegPJOpr%$RiaN9+Y)(-f?z=ju7)!@Pt|)g3ron_}RXbqbD)8oA+#O*>&?Fg3`~
zRUI-vNlP3&;K(USEClK--_eHc`XhHnF<f2*->+`J?OGFBU#vU#n7*80ao;RCyrTr$
z8S-&02+v^!x86sTA?a^93D(j>o4MBI%aaEWWohB`pB%5(inPeF1V>e}rdnv*$CKt1
zymmk19wL6xlr<1VG)aknapYj(7i@ImNZ1ciLP38kN4TM_Xs>%7wt~NK>aT^>LV4=F
z(f@nEjqdvj>Bdj43y2COW?P+DU|Ct>1>_0#d+lxu+wWo+zFXNB?OWPnmZn(GAlC<2
zs6sm43&1DZB$B&0W%qX$8FKCuo<1rTT0>Y7?3S06aKVT2W+8u(k6ll2B1+Gkit<P^
z%KcqlgLzXMicJ3q$jU%epAow=+-Yzq*pQNxV|D|NLm7v^*+iNuyZe8;RH8;haLKd~
zbdt^cteVid#sFbnO<6P7;{$sA4KZU*4yoH2;}5A<`s*%;k))5sXmSwO3QHR$LO~&w
zFFzDoh!H?az~8c~ZY2h-fho+%O^qm#>!<HRX+X97WglydGX<`KwIvuv*VL#P$s;Y}
zk9nix03|lw-qLp)w~1d;ID4~b`$o(L_n2;lB4fos4`V<1YpFH1TjdXVCkYx9UOs0M
zQ@!{nf6|l>oDBT4%*}f#N%TEEE%wy)kluYH>*&up8CMor(zp*<;^(Ua*yYmNau(mw
zhOmgSUV_l%6nZiAsEtHD03x=`zE6MZvLMt^Xlz+12Z`o~s@0PRg^OsF915}uTGK47
z++la}yzcc#=+`Ga&ije1S4@O>mja{hBV8~+JOn(X?CbsYM%aY{0u(_agDIyuvI2(G
zYm}nfh~{e*S1xy|r1R68rDw~h?VmroAojs6)n1#i%u1Ra_pP3FSF5Z^G3G%5{hbir
z-2|iq1S#0GhVvu|ce;vtKsU%|LMU<Tl>Nb?JSBh_jI2j_D_j5AvspZOMeiS1-Ql5R
zix4@-o*rFf+10URZnG?>Mfz*a_0-R3dXvBVh99KQ;&_;=2^@T$+^gu?TWh^8CEUGB
zO^SIQO-Eabu50Axb5LTQz%&OR_`V&)z>o$Iw!>;1l8ZUs>$>Eq|Jotwz9InW3plpS
zzexeueZxJ|1>Va5bAp?W8$R&9v)A>Hz=Q*frS<-^r-n#iDUWCN_SxO7X7xi}&g;gu
zGgD4YNxACF#Ar!(Z;3wq7h{NN&Khoy?0nA2wyS`Gy=BO}(zEj3UO(p`Ow+Ay!0ga&
zBXg1G!?($u@o^!0el5`TLS3hN$6^wchfSr|{P(1+h4z+Rr35d8j={Bq^ZC}v%p{3f
zeDq@tcX@}_1rT^z>XV;D;$r8yOMZW<*UQWdbMP6*9`1-xvM$Rhv3jeL`&S`vp3LI|
z-AJ<|TJ80Z4{tpAyb6!4YIMG%pR4#(g+g9R-*y#L{wUqh1#B~(TjDQ{+qpkf6_=WN
z+*g?H@?MHd*+iV9f5D<vZ<(=vno$Y1?PY!MUcIPhU;Z}vICrs=!PM~g`XKFPS<f)@
zoq62FviH|J7(ZLPxsQ{?Cro}<K!xr#neiP*>aMqX4SWys#B9US=9Dwi2N$2SuZn*d
zYz|U`XYO>Ch%IDCC-1`y=#)&u`(4~aNCaw<Xa$S;l$)G;xkl{h{uZ)&FR)GQwR<T%
zU3S<DC>iSP#GREeujF}hP_h(WbT#NS`&1=Csb|ZT*X*JCOnO}K;<*PM33Ln|Kw!ue
z+&%LiOHmH<E=rmV+469Yas`VW%QHQyfgK9h+WWb{$qcRU?mSaDeWUq8FCIm}wH-~~
zhwR4p%^7RWr)a9l^q!Ojj_%37tP^|q=bFnZK0uI4%sVu*{;Bb5+rnGx;i%JkkDj8g
z;6jt|y!bI<rS&BWm-}yzXE|H8g1f)=H=lI<$7?X#x#!ubPdfMD^uest)o2FQ(=05y
zr{m_dz*2(%jrOv^D^D&I*T${F2FE$639B9{65eY~{TyF=_Vu}5yn1@oR?b3shholj
z-rJmiaue&>v$-Wsh|^J0v}ft$P{xa;kNY(4!|TS+D02(!zn{^cujPHksxG%`ZNcpB
zK`sJv^-WsDn>l*zfB(vr5o+a({(hJ|kT<)Wg&~?TwJm~>o?L%j?v&Cd&casD;k5gh
zkK#4o-sGp~(4+3Q7;nCrxr9QTgpml>Rdd;7JEAfqAUJiSV`P0PGumi#A=ll~`(4mr
z$?d3T4Hm7c-}(RG?L#mhQyBcaq>9;iyo3}B9o$|;<#LUAg-W)VFIvXYvKCIk1?H}0
zc7EfBtmm8KPiNe|%1tc;(<w@#Po~Q7t`V+wGPx3~NLQgIzb#_ZZhp8j)$YiwYHHRf
z`TR0TO#371lS~tz<8N4pi%G~PbiNl);M5b9fyFTCgnUEzg%%EnP`DQw`DspZTO`;k
z=}3U~JiK;H@YK^G(!f35kQwKO8!hg1rmntqviL(rp|~sJ%O`vC5_7!*sq=zCSf7E{
zRFP}Jx44+y_5^#LYhHLNSf(05M$Vj`?6s4p`EBh9(`oYeZOfZo`_sp1LrdNW3_<Kf
z^MiL{_>Yw2W=wlmIeD*m6+1U7a$A3>3-$@!zjH?^(T|8=g*<mi;>ERUA<~gAt<Bll
z(MRV_VQ@H@FkB$H!%K}`%*qov`I=NjdAJu5bF)kKHC(O3qDi4aNenbn=MKfq)w$^m
zLqR(6?(;xde&4)KVV%sZpQoM|FADEZt0b2nQ!*)}pja|iQi6+_U%hV~X}j(Dxhw4U
z)SZw*mo}mbXW$xykev6l62B&^y|ZOX<o8x%le?^7yhD%C{%ZVq8A$BGWhqEa{DAFG
z>*=WuV@>@VTsz5@hmpTQkb~SJGwtmM-1rL@q9i`(O{Dtl%0s@IQ(x#zD#`cUGW5)f
z+u3uFp!}5OnNC@tqW5rSQcyV^#eu~@dPvpI6lJ<s$mC>c;JlkdTH&p!s%V_2{4*lr
z`Q?a!VdidD$VWh;7?Y^`6Lb6aY+NfB?@xJ$j6lT;Dfl06ap)5OPc9cx;5f5@JymPg
zVUs*{$7o}P`Rqw@ZR$>Hk)XBS*682Qb~jqC9$jnomaTe9fAXiFv&~QVlA_oc5%f=3
zkask<w3yvH&)LynrBoaiX{Wso`V?=py4(?Z-4`4)aiWW^x86u!juEIc(w3vVc&xGN
zYYKnTcZ|}jv}C`AkKpt}3%xkX<(8jyzaEb;J1xBl9n5)@iJ1cI(uKUav=@&fR(U&%
zkh-={)2et!{{hwf(Rr>u;1gzXHN!mjkId||puPdADt=1wc3L5OXO3R;OXB2msG}|O
zECk04N9jg;!Moa1kY=*J59fe=t$DSc7uS4JC41A-$00sUKkA>o<f(&Ajf{Ie_icNg
z*@NsWi>gJV&99Svi9<HeDME}Ze2MqBr%Sg_w;oy(F7D}j^Yt_I?-Ld>6zVyOCwmog
zaAWv>pQHgDnS~0EDkAk^kbl=|>?|fYlRwIA7&{vDN^*4Rr^ps+YF%$m|0uGA=)9f2
zHk=~#xjdD7U5cBX-#s6LIo?6jxKbCM!N%duPtAPIHk0*xXul~Yd*6yLRBFy5!p%SG
zuP^`58ftaPPR<eZ_0?0~w@^G;^!Q_^tD~gyl;a&j&rYAA+0r*!9a-f5?raws)dlXm
z_R!jLmNWGao8>2iTz=?HUZa&6oBsSnVz8%V`f>8iApE`Nfk7yc@sU|SjW*``-E+)-
ze!rZZa1f@8=i}mYfC12Wa+X!hf%f9*)<^b)G)?i(ubk_zI-@PF(m_X^9Y>AN=!vR&
z`qDl{Y;1PcR&O@X>3fEB^oz64+g5L%UA4}?FS?})1}G6{qgfF&Z{zDcD=f}(M3BT>
z6RP+WvoP=8B@W#}{+eDW<TLP>@o$t6S|_Vwist&$#rD9Dk-~}^u%Zv)8AqZ9n`;d1
zSQ%HJ?^RcKcN7V=Ja@j?bl+=n{c&Bf?PquUfWl<}Pk<tg=pP#^Tpt*?pB_TE{<rz(
zsnbq&N1A&*U3sEfWB&2Flj1=3HVMYT`q=9v&*NrW<q7BuYZIFTv3ID(bDbgmZg24*
zB7>#%-gc%j{R$-1DVl83{c$T(R9hS5p;r~CV_jW6>9VrkjBV?1+6;1e47V1HNVTho
zy2N06rQq{^*11`WnMD1_muHTBS6MB^>EiFy(A@TVqrrT3!5JIoG7Uj~R>p0DoMhcw
zATRka+*Wt~3{)Hr(gTNWU^i|&=QBoEG98?8-jh$%2*^^|1dSbe0MlN3xR@_@`Nh0&
zLMGo<k78g_zv12_o=g=APUL6bi3=ESEPo^*BaynL!I1K;lJGukzcnBl`YE$bfK74z
z%F_qmWVy2*xbdhcVRQ9SGx{}kr3t76i|H>;iXja<fdhMeb7_Nr6g8`~Pq?uJUW*l4
z-sdM|u6iO~+&>mwsQZa1v6Hn7oxmJ%x<KYhR8CM9e1$A7JgxpME5UgYojN)4L7xUH
zsOx?iIZcF-@$l$RzVru4yHar!t;i0;5$}oo;Vu(KVUws`77I=$|1kJo5nlm-Ej3V;
z05d1>lESbN9L@Fk%ehZzJFlTB69^+S{A>=*6lC&~cS^Z(TU!-wH!Uq}sqSIjd#|>g
z#7Xn)(ujXBl&9X^NN$O%()|0DcKe`T^_F3K_@+wj2we6N_NR8Km|!gkMo>M{(X}+`
ztcHmk{=Dc+2{XshYlrk_WXX>rA*r988moC#BJxE8{^o1>;+L=K;S?gf{%9tr7BDge
z(h4@sNzV+a7#rR6gN7lt@h6W|KL?KE5LM2q8fx51PS^hWo%J-xv|}B$>V-@1<PmA&
zG{8jp+weJeoOI+6#06;`XE|>>i0K^tnYF8SqQ6bB^%5sNl;%|ocks+Z?;T|gSl#Ao
zDPq4hZT;pFoPH$}XWO5CQ?sRvA#@V&F}A`JF1~AYXstKzlYfRf-2B#8gals6>+kCP
zxoW{v^)n3pTeL&hx}aikr?N(akWCIs4#=9_K8nI2Iy|W@Rx_e{XIeAj^)8um{c&%^
zV;N1pmPDft?w)f|$C$sWX51A>Pb|qmviu^U_7~UZ1b;To1UXas#rHO!gmYEzp=}Yr
z$^)fnT$?2X(QVCTafy9mX*5QEU356lmSTHVpa0BdtT>7%cwj^z_R0X4s_H3PMt5`d
zzED8F`fWgf$0lI0B{gWmW3W!oH94ZYQy;^V9(U2k;Vo^_Yv^q|%@gf}0ulzSc#iQt
zHQtNRfB9{zyuQ6SI-Sz8-*GqSz9RWtN_Vn_OK@Un-YA&!k)(XEMtLO$A;T4Irh0y;
zmbp7yW7AXT**5d=(&}V^y$Y*QLMM?Yx(@d$#!CC5EonQ{Q~ktgmDSSa+G~fRW(KHX
zeS3CbaaeWGp*g8R(RIgDWv&CZVntqY(1~$dG%}v+{O}rjH4+|y*Y}gKRJ-c(hIFIw
zDSPO_%17ysSE29DA+!0<Oo%cbywA>IPUx7HcferSCTp3#p`GeV*zKA80_xcBnEa|m
zg2_t^&}HXp?S;_oZ^5dRS)p~v!Vk~r&bPZOh;-*a)$TvF57Qq@%<m$w!)=uzrZfsD
zdFmxyRi%H5p$z=)-~DT|TAgC4fFzEx9Jl*&7Ttb3Kw~<FX&!#WIi>cen$s;gEtue?
zI*Abj6oyCcM4Atc6rgMWxogR<Mnvw=$YOI*OMY_0o@FWs&cyZf5SHM+pf~vW6H<UL
zMuQd*g%7V+)YU&xIHNNI2#d!oO6{{$VwTcV?kYId?JjUHlQ9Q=C%WJIiZ>myX6-hH
z)!vg@`ADz%aNwN`tZcjde!=e&t%wq+uR!N^lJgP>%lc(YD%tA5+3ytdief63%wC?l
zBCy-TRGe^_Gkk~zwbQ>D+z2lUZ*0vN4!Rm@pcp8*o@6rZLhI(&+F#q$FN(4X?zLGC
z8d?vPI3>=<-KAJ54|!aA9|(xg;}FRL{A7g16bxl|_05~In+Jag_N!Kr^M^748+(+o
z6<7Jd&XR*KHoV`KT}^&hR&w`3g5|+hC%ot@b^f8Pn<lN`sl3$Oocr}BG8R3D{4f$(
z&)?>IdnF|C+<bx<PF}GCJrdqJ2Ui215P`hcOYP>9#4DP=x-&Z;);-Vq`QNP2)1n0J
z6j7q?X5s0j311{MfE$?<?XF)Z^{1}(4zoSaYg4eop2nt#vM+e}%y@lZjr5vvdJ-Y2
zAg}L{@zyR2C%~71IE{%pR;p=Cyk=hod=1H!WJYZp+so7vWTuv$VJ-vc))<m6T@RfX
zOOw!G#8soQK6sD?zseQL>a`n$?2}W%u<=Aw=P>We@7kstoRzM9$vzj=Oaj_2L09)q
z)=zkxQj+6^Q5a`OL=pzxb(gkhj>K=!jc+b<Ic3HKB!Vl}MiJ@*T`nizJ;xY@W>+0R
zMECV5LMO0LdnWhAQH+<oX>WZ}Bq=3AYF+*M16L-Gw#GcV6VEq=ooFaKEz^+CCugby
z^V`3=qryi@d&s>3&|$*lv55aX)F@+Y@@qd6#cd?ru;cOf-V6k~iGSYMi!=~}fz2R!
zJ(Rk~#ken=#N&(=kgk7j-$kJHDogkJY!W8D2!q0RUp)$|9K<CXYr`Wta7m;D56^1H
z-<{fEnQK}Nehr}S;PdZKZ?mROpz%2a^cnx2a_N(rA4-Z7f%gbN6Zw1v;*nULl8ihh
zEA|iP=u`w%T{H!RU!Y;?XWN4Cp7a}ZeTCsxK6&dzgl4J+qJw%6xz<G}$Q_Pf0}r=Z
z{j$y!z8N~9goXbip*FP-76J`u!-#c%>Bx|SpS>MVnz#bW*Ypzq(2bW8drC7_ks3tg
zHC*w;55&icDN>8hW0#e8>XejCRLmxar^bupsMInWNGN4xvd}=<Rz3?j{90ya1FzxP
z-IrS4D)>rVjRNRbB%J>F(ncXp77@V{Ys|2s>#U{AsTtPB6D;L?S9h$nxKvfPFEp`Y
z{QeQYc=_ea{}g6U;wP|%xHV|lngCD5{3Vk13dp8%kYk0UV*>=bS)u}6VW)EBlygAS
zh<+q)qB#3Y7eL~0Xv;8MJOm^t8<>r^mdK{;#y@0Jpcn@{wH|_{t{0jmtkMVvTiZ;V
zoXTny_w{@0LLY?t3e;h)RnMut>inf5!g&4RuaoXNIqwzW>VKN9Xk4gs&DWWAif3E*
zEJRr7*Vcp^s#xAG;|P7PoI`CZQ;4nk9~Tms8Y^F%f~*VM7q*lO>jpBhR~nt?d&SRE
zUJa(5XU$D3H`M)hCkZ}H-nJ{tJU3qMuv~OLXBvX|JF5_cPMqSs>9OShZ7Nm#KWvOY
zcHwMbJv~L_3~rk@oUJr7lYzllsmq(eU6)rkpM`V|4TQ8@s4Isyy?7X{M@0<r5K*&^
zQXbSSH5M)58&HR_!8>r82C*&v5Y})41OC$7YG0}VeR0#+9IQ$ogUp4ZO=>;mGmJLI
zW%xmeftq5%5ph1?lqNWLSs<B;cwYSIbfN6Br?7b*p6EAf_Zz!iv8}Dz%q<W4)8!t>
z$JU}0Tj#}B%|VkoEfD)eO-Gf47(pPa3bg{F8TqrAXJVvh7}GMMv?)L$B=8uAUS`Y~
ziDDg>{j-{Fjc&c7##galS)$C*%6Enqs@f&hQ)UYJHeYe?45_2NJ<mA#bWV6o_?;Jh
z2;0;vbYClGLJ4jp&z&O=jy|184mmV}q4lG^c*Gt<`2=goLcW&#VH1Sj97IMTo4S;<
zaIFku7V&3&yoUCa^>X;Kp(0xq+#~D6?Hkte#lzZ8AL*ita{*rb%L05M5&D9JPRMx6
z`HE&`Cv(o?e`$G-q@+RXWP23hjbt=q7q!hU9=E7XzP;4}`PqxV@XH`TXz{D$QRPox
z#h@4mW2$7F6o)%S@gEd-f5jnJCP&#!k6EKUQcu6nRVUA=trZJ4{^$Rzhzt7|z0j2$
zL6AnfPIFbr6rCJY4I2=o?B0dpV#~LYC0i0N|Kf4^gTJ4Hi*z7T_C?!;;-KB5rC7wp
z?LIx%rw6Mxc^O0+{Ym1h2t0-Zj_aJ>2)EwOg(4bKwGSax<OiVcJ&9L;lZ*#x|6FL<
z>JsX#T5W_RH8C@^ZsmlvtpTAzRF;TPhHO2X*BMj)2k7<nuI4Tn<HZQ+sT3*pcQ#0*
z*7@jwC+^rtUcM5j9g&LZgf6KBi(PsBBr2h=>Ml-(#Uh(u=FlgCe_Jqn9OQHASQK&r
zLhUV4^l&>}<nlM3@5>d5R2Gj`j`U-iG8=curY0t@II_J;XIb~DNgA;t{Pg38m}UEC
zN}hEa_8i<{Q@dG1o>T9u19Y$!M478@cm$!nPmSL0Pim!CN+4IAQOxdTFOekE3H10o
zeOh>T9pFaEl*cOU+Qfgv_bUFv>luo0qem1N8vM|$Tp*Cm=kKR{JY|vbM3g^)F4VL4
zR#!m$uJ_2Xd@J_sB&H{UcS5P?;!cW<k?Mb#cKdy@Pu)T>*^Cdbm6ar~30fK@pk#5j
z#Qcj9#!j1r`?FR#Q6p9(1+@X!6Z%tS?$w3nLC%6-BAr;mTEC%e1MX`&^+19#`F1}y
z)7WFmH`Lp!e!X(VcpFfjGAB8qcxQ_0@z=UZltl5MZEG##xh6L?aP|uh&05|qJ`>s`
zJ9{?z*O6wwfTbqqvBFNoofkb#X7v8U@ANDM3qSAO*qnIYbH67u|0k;YpC8u$J~@E`
zJ46m{&?S;Mv{*^WuFeGOuYTrtVVJkE{{GP3kz=?mW$jXUbG5BC(syn9XGO0w=a06n
zcJLX)MfE)XX*!z@|HOPv_a4ZIQ2T_Iop8}ZOHuou3PMN%?ag(1r72VSes>KeSkez!
zVb(YDr?Vc>p3AcT&a*B2>bb0sT=<<<_g@<KpYFBCGFtew3JWyb!H@6rUmo{A9q+$5
zWCCE{$#d=FV-@N_K|L+LmI76)4sda@|Gjbz9kltV`BmCXj2Z$1-2ax+zxuTq_(|i2
z;<w_kHXSuIDs=v^ZhpMZ&M0Tm4aa|rKN`mWWlR8V>Ko;MpZiw}{xb#DfYm}16C^*5
zB-%gK`1fA#e}*3alt7OMX)Hgu0wLUTr{$AHnx3Iw+s^CBQw_JQ&}sF7L#xK(tkg2!
z%_pAuo7*ul7SF{02wVPz^#1?Lmr89$uJ#7Qx&msI1PYF>Y(z;9mX<h{mlkKC{B;tF
z`)N=?sm5H9AP-&t6Ay!SVy=a9B}?jmPXd_!)L8yl%e`jP<PSd;xsP&4PTHB0Hu8G4
zh7@KR_+!O?S(Hq4sAdGg#^+=#Di8-rsClbj<-xdy*l6X}QFw<pDosJXWi*m`1A`f$
zTEyuOT(v06w<@u%;XDo~uC%PaYxO7TNZ3%=mUM3X%|1D2yX_}NEkBwOh{&sFJ9KQ|
zRFG3tua6NG$_{l3t5u_$%1BME5e%|0FP{i1iOJ8a<ceUYJ8_^~`);RUTZm++MJ32X
zVA0GYZi^d0XK}!1RuU5_Ckf0m2erKy=hOYQ6e0yZ^0!&Y00lyHMHc!;hpa=o1C;8b
zMUAFnlv@sa(}g6#YId3G&DeVIwP;q$B`?4szw-Oc6Rck3*T&?ozkBa!KJRms0+jk*
z)1Np_My>8m1~<@SVs$EKiZ%?#YL6FRQh1?$CPYDnK3QM)cfr>-4q1se8V{pb2URSh
zf$(haO7O^0tc<iIvW(H;^~O>H5j8IwlLJ7zoVEftL9Pp_PR9Moi`VP)m44~VkDl@L
zI&|6DS(JU@^p{brT>3Nh*0&0hi}MRb9ttUhKe4JD*QE)r!HCc2E5^qU#p$kbYU{N`
zg%NQdoyLKo!eX)tVmH=bV@_!{&c)(R2A&0C`xfkV3F20Y;Qvg&k6)dq<C-_hHl<-$
zT;Nl;swDUV3v}k1I*Ux*^ZyDaoEu0xS$?Dq?x9|=8(WMeCJf2H^EigraPO`dO^1O=
zIqQ~Np2ruw2(F^Y#+XqX)|Q{=U&5Wgvlr9hEMc5>NQ*@wajPZv2-0`1MWf?I)^V{)
z0BIA!G#hiS5yl6vPS;Iwv@bYb7$Y;8lb&Gx$KKEXODQq^*)gH6k+VVgukFqhU~x8+
zO2kwLIY9<#7nL;95wT?BICX^(8Vu<y8Wd9pL!Pag0TQbML{VJ-?2joO07~xcsVkoF
z=W6H%iq_J2Y7etAT{|g9L&IJh$7mPKzJze1&L9kj1TdS7G*7&~jt=Q*l?J~CN06D^
zuiN90g5@smHiz(-p(wTH{XQIHRzNZGZb^g#;u2Y_{hZJ?521wAP8)N%^-yM4x|FI5
zP8dm9KR2c>>(lwDNr{n{6m}?UV$jo*o<3(4CzOI`R#;{<15UY?4KZr#wvlB4*-TS<
zA_Q2iVS{>Glb2<Ru>hnhCramj{lJYMs)j6205wbOkNSpM&u3OE2-K@_ps!fo%LD;A
zwR8XcE$R>Us*c%8;5;}fT}KCgjah~CtPX&4bN{dzOJf_ZOeGL<45rB}3L;b)8iFG(
zs~s1}#^c~BSD*%}IHBJ=$w3y}Z&`+<)lvDEwmjv%_N6!_`D+97ICWb+RpVxraRwyi
zvATaS+HsWb)&u!%hG6O+Bi(|3qDG$3B`@n=^av+;cnx&UT=<UtoG*)dVi`$VV@B|B
zfR{X!(s5ne{`9Mp;@ZHj#dTEYWSucU+0?2GukCx`JIWQ;s!_ra_dB+oEsYsWF^<DL
zXK%I(78&BWZNiVCb@FKw?*1_hJ7iz8b*8?q$zLr$mE=9Vsf+*M<=6DaP1ZJ{<gYeG
z3jSnXRf0boKgx}N1EWrKBjoyJj?74<mvc0=_zpCp19KV;NcAHF-q4Lwx|o~%(I8n+
z+=R7gNNPFxXvBG11r|4jLy=C;L)-9-$=T&v>J(h9hLP}ZQ;EWyH71dGKkrbnx?JJ2
zd1jl#*(|vSOQhnT`d())bg>T0mllgSPZ*=C4&po-2eFFp@D^G*&^u7EFZ4q+ZILyH
z`X<WByicqfR&FGfi>uUE#y|KpXxZqNK)2UEeyTFH-}foy(&k!(S56N<hG4L$*~&X-
zPIVe3z$!E@U!awl+oFYgHa+nD2tb7Yh7;ML1wh1tL8HO>j38N<+$2^ey3o~s*@=m<
zJtcHbac3P<jox^p8*>*}>2^0(YN~qF5o0yh_OD})|JJw73Q50>od^97eHWKX76=3=
zZoiAE{GrWEJ-KLUS@SlonVH6<D)l|vgu_0(I&Qoz>R&ru%8RCi*5p=dMOj7YegZ~)
zO+dm*aIGU10;DlGsGr4>?r#7s%hKmU4S>_yXQEYU)oE&XmX6;_4G_PWycC8g&|8&H
zr!yNZb5QF#&xv~N^X<BDP94(yp?b28pjMGC8RjDk!q5fvG+v*z#zitfDOR5BI3*lM
znowv1nk)a-No8a5Ld*f79tvkAm`F|(N-};^RDm%&N2~-6!Cg|Tc$nF#lIXs}P79P!
zywx9>@;;W|7~?s;YAq5@^&&{H_YCzXL>ew0WEqCX(t<OX@Mgd8vyO%3su;75F_>Xt
zDQ2-z(+Lhe*5Or74s6|+IXYUgp!cC!(QP^T7*5nkffC9wQvO^iDl&UH*WyF03Zj}#
zKQcD*yD0Fyktsf3qC_TdQQUA0jfW`Hi@Z`ojlQIv-o?b?XvP@)e!>l#`5{pH#j^lu
z1-3#Y%vy23z1;NK5*!GWN|M+oI1#=_RT(s-2x=`tG0cw`QAm)S`exAd7D+R6qMo7O
z$O`2RnXcIRj!tqFufe#P=TW1QsblX8oq@Lz%R$(NtXQ*es+#jV%D9EVLe&<zph+^g
zNljdx&4JlyjoC`q{$dCFepOT_2&(35L|O4IJlCo=4OYSz%cuI3Dk354I__LErVL$O
z@Jp;9Nal#C*DTkHPuwUF<ptx{?P)ef4nJlOmruK=h;cwI%f?JZmuLOFYkci`s`f3a
zqgcg3tj*c1XMLn@)=Ec1_HicHy!HmpO43xTQ&w-`MtPwal$^ry)>{d!k<Hv~8o{*t
z8EMsbt2C#hU#2U}6{y<Iy8Vh^jhvvEr~ueJ1O_lE$Q)gR2i_u`F$yXb{2FLj!5U&`
z^V6-h{d|q}wzhfF(@;gKAwlyT)`sDS*pFHtC40;EpK60me_5-;7WdOSc+c~{;zzOr
z(kR<1kn#I)U*8eruV{v;B|j2|()D;X+LAGMEZoRGquwI8ThRqKd~3NFLpEozdfurV
z=l@ZbRkR@3>@C>bIM4@7R%}!#A0+j)g(B*<)9z`@RdW&>m9&RKq(6qak-poXEX%J9
zKb*Rc`K~uN-R*u3R~Mq&{WGK9zit92xGTp(Kn}F8gc}mk>{C+Pa>z2cI$ZCi^+B)w
zcCAm{P6OA<bUm_;zkmiegNxUFDE0$-Cmw(I;*5}2jMkl4@-_Lt7r-sx`(u%VKOuMT
z=70h0e02%KzlLD|CdEmc!OqYl!P`i1@vuGu$632DNP(7=S+s{^?`p18Cpm(7jU)zX
zBMtklC3mP0u_`=+<Pgsg0g9HH++p>U-VXe>v*{>nHw%!VscU7SCh~G07cTzuJ9Ze8
zU#6>gcM?-?K;~~D^+VMxuL@pS!~pq-6gAPDN#$+DCw|8)bKR1@lT~=I@DI`>XfDwH
zoK(e5F1^O3N#v8-wY8Pi%+N>c8(DB%0g{kdS)CzXd3<daCX;~;&7X}-qacHwu%0hz
zCgUV;rQZw*!BB`RfKR>fJQhvwjcq@O`5X<bJQk!t@V)^i#pIHoG?$twwD_|2HDE$c
zdmi(xO^|gn^k-vz8_C4}7R~o)!~*h_#u}ewS9|SUaMymbe>ZO%kYW3(A$qCBBRkWM
z7Ni)8?OjhMboi-x>z5LCD9X)E<W{am1<euQmRFG-O-nsfyTU+)Ld^VY=!*6wcfO1A
zcp9P`n^c<6tGGVcU^jIoE>>c_Mnvi$c{>YKHgPtUZLLu2mrLsAk~RzE<iMw3skk%y
zK)|G11g$b8`WjK-JiN8C@2A)Y3z9kKW|Q?jntcHRs91#iBgXMpPcZ++9v2n8tOrGR
zALitTWLkz$=;ApD-&MSlMv=0EI^u**2m}TNeNNXD;TIRan(qEotcBME86~=De@f99
z99rzEq<*qNcDQuxUhjK4oog5;&<^?1{bbx19JI(>*4I6lo0`haWlnhjwm`Gke?;j?
zSs~@p_dL(=^c^Dr>^ln;X7O5^0H12w89fGaAreuX#)dcAXAA7}&paMN0!<z{k}>2k
zkDG$n{N6lV*M%O-ZBIr{br5m2s6*KONGM~P3FOKSm!K}TWSoEn2#U9=*8;PQe~i>o
z3HWiRgVqa2QG{n^HE(RuCm_sH&E00JGeUT=!aHX}@k?riXQF1AUDmIY?a5Pn^hM-$
zkcNsIvc3QjOa)|!WJjqX)Iq<2Uok(xoZ1j#{^h_c`8UXGhuEeWY2FaFyTmx*69Wp}
zUAopSXN6U{P?0-@SXN}dWI68XW!-b>ZVzD&NF1d+S=WAmAM70X(I^Q;9EU^<xp=mZ
zX$Q>*I!~TmX>aKq?pE&3YaOo&N4fZzuTJq4D;zb)6(I#}gZ+|#dG@#1cVqQ?t~?}6
zW5ajQt$8gb-Z`f}VqNm1{Jet1<q?0l*Gx3`Nx<>ZXzpX?-WU2qEW1xTpUfDRdD<rp
z6ID;21C7$lHhQNV^nVc8Kx^+(=w;-S$J>u1+obYuTAuU=6|Pv&e~Q35rQ}w-cwL|z
z@6LCLZhkmGn=Ruf<6ZEn_zO2q@~p>!68VB+Px-mOaEQd4r|2SWzdc-1;99xDx6y8u
z8=9b<`d1V_q9tf-e4ex95nLL2Dg4XjbR!}tNRYi>2t=l0$QJY8S^57fA+7m=nE9!9
zD4q~NdaLa_%&Bc|Hkv$MZwg8t-^;9A8J(!q{!<Z80x*vz6tEg;64~V>U@fUBzz!?0
z&1lwe3<(5H=YvMKTJuM3VqtH@@sMC=zdKUK;{!~aMo30*Fe^a27bTb^02Z3KPgV)&
zU{Y2gc6QyO;$nqplM&^kcotFWU9k<DQpaysHfh<68A%;O6Sc-tfAT1#7}6|`1dyk4
zYh9TbON+5Wg)_MAn#AJ`1F|8%sxL!wnsU)8jh~Y%lM5(X9mQ+6os?@C7y)a*T6oDv
zW2sPHN|K`-4C1*TVcFSiE{DRvw5%*nd6|!KG(ujFELqKgpDan^1qS4A#d{-a!9aFx
zvmQz8Jlr~edSl~jww}1!5EPab!=2aqz}DqTgReo4<gW21k<S%Fv9MGc#0zeOI9xjH
zKl_?#t!>g|3S?y9?H0T!Ytg5-Vp-tSPur<Eq(jq+Ix(Qb{#0r=;Yr2{<NfUqiD~&%
zd&MRX?^<IHF7ch6RWVDb<#9gzYTnTgPcl#K0U&NhR2d2Yrxqh{;s6pUIHDPu@CHdd
zGHiY1l)Qmu8ZmTc`=9voVt~__yj^K4k1+a(fRN88ak7V^X3`kC&`Dfj!Z~)g$|IWl
zr4VTwdTg!t1sBLuiKid^l|FAfvq9?}%OwE>xak%530_URi1_$4RPr{Auxf4Mh@GO1
ztd+rdSJI2DIFE&?O8XW2=x!5;>I;YuwEdE=;=`=YS@%RaW1yua{3C}GH8zb0Zb&F<
zeYN|1GLvT2C}VoD0Zfrpv<1pMNCW235A|mC)LwNn^J1>kP0RbeAMy3Gjq1kwtn(7~
zw#m5dqJ|$Tm-Hd#0me9q*H`=&@bVO=<5&h`c-$R22Kui-e~OT(PX<U%w>^17W}SO_
z^w+^rc{PTNbz&$FcKc|xUu_syG&|g3Bca+>)yc5^P(4=lWATVVz24!v3r)v2A8lZx
zF=ATm#_|x{bo0!0tWB`_Q`zmz#2bXiYT|?_1e^t@^IC{@TSAt-GP18Gx$jPDSOkh{
zxwpf^+JIK9Sfq|)vgY4&sttOyZX5MY*Ob|DJAA&qW?*o!AJTrm+`ReqoN3svp{k1}
zPPjJofU{O?#*vITe#2`6Mo}jEs?r-iX<M_z*RFXJTpKHNhc3|m_gB_iT25I|6LwVh
zTJiB?eK0zq;BJd_&jIgayW4<lN5;I+cHrr-hMz)C>VX!F?mo$mIT-w9!8~{&2!l_1
zYd;fwaQ8H#V+@QuExYH964)8;m_{v`4sDq~Xsc34;iO!m=-UgmKN}J)BVEFQptf2e
zdz)mJ`HhP#e70D4I?M;PGaPnH^m@yBbZA7Zwm;ce*E;A>C_Vsby#?jW=RimpPESAq
zfPB{64qE^ZHVm#uKeb1_*0TZ3cc(GC@#fI^#*_BXQ~rr?t!Uer-n*WDYu2C3y(ML&
z$@{^oy6qblz(Wd$%g$h4P&#ymMs;4KkhVG|)%SCiRiWtXG^nCGJuHXc8#rA7BEZuc
z!!EVXo&hy@5AdeXP$rq8bO909^`DNdbt1|kSpHkfZ^i~U;|r>_&qspZ+2{Ojxu=V9
ztsqGF<WNll=-)|;NHKVL|6$^S#o@xp3&j|fpT^{v8B_Fb8yu&f+DEIh`2V!7G^dOw
z%qAmJVc5^b-#7=_h%%#A(!J4Tn#`b42FlRIp85eqpef=J0IbrflE1j(F<$m=->H>R
zghlTy6oeBPic_<*o(M+R;;&R>4{g-8(*u#3NTEgG{aD1gChua2ncmG|1Y(1lhlvO&
z3}NDWrqK@bJ!2jXBPQUKSA_iQ{DM$CpLTP&ctKYk%y_R@NYW>qQmM0jgkC+799?$T
zA1h`^7V)}(@1&Tq(qA-H6&yo$u?OJfCg}382H>htg`D_m3|wX?uYl#S4QGDj_?Te`
z=tLDG-!3RVqt2n4x+JsiGVhb+#C|4c>%Yytb@s0qImsOOJx(?+@mIReqe8YWty}D_
z`e52o*9`4%Sb`G-O4+O(@jKu^<}i+dBF)CQq`>@fFjzGTAX0|{4K+|P_5Sw1(BctU
zmp&X%VLP4eQcyS}X=5gjao6~#O2p4&zB39!R5*RYTr!62m-jOgq|pd@rqV!^JpSe+
z1QbA;qw&;uKj4R=Yg@x$xXcoAvkDCVK-xC>gnrpW;&0oK(0%`?5W4A@?N^*C4^=ED
z&+;0>s(>S?@kX)q;^6L@W_Qf+aSZoct>0rJ5SqW)HGttQQB>v{vZE+lM7a=bYuMqo
z5G#?GxVvX``v{%lH~dnu1JE4k^$W7xL{pZS4CS_@9lbReQ5P%uQt<1AN>R~$YW*SE
z<f|gSd7QL3Rie@Y&O?UxH9}m^Plecgj}4J(`WbW^Qdqn#5sv|aFx|^5_cOO#YbTw%
zl_uM>bCr;^;x;?s^t?~Z<^yuvY3-Z+)(1^QvL5`(+a(JFK8DB7%BsQu<3hbJf-?s`
zvO=Y1jK5H2JZ``hv_VC`T}pNWzcgFEG$E>IaHpGlCLs#;8BYWDPWp@^JzFkdcL1~$
z&i<vBJAx=_AFkuvOTYtOmvCi)&5$9yFJaOiQsVHN#JKzh19(F%SXG^KAfj|TKxeC9
z5$70$n%B;oqdNW$ZGm3MX3_jJfc`exN{aNHyS5y5XB224Z)4)z*Rd66?bXD3&;$QF
zf^s;>a=?ntqrYm>j`k$G@6|aXls*;^W6^bnTQr?>k9Tk=mI$u63aH^hDoUsSMEOW~
z{%rmF`_Ib~)4PONQ(`Qth~^+dMNSKb-LR5`Wd5Rvy+a~V{r(hRq>h#zjoZ8CP9?Bc
z?V3)Uz%|MhktEiSG~!`&Lo>!Sq9o6;YoyQ^)DPd!tq&Uk@%FPsg`mz2#K4)X86Gx}
z(HXl>{zq`#!r9HrIXC1KfncrJ=4IMgmmwdW>o!J%OkNb0?Hhu(DuLe4-kVF|n@Id}
zmu70X7wm`C=ZBMZJ8;cAt&R~FeV|C?Hj8g$x6P&Z7HI+HAR(nu6vf?GMrG{x)M5zn
zP{)2fJf^JII{MKcbjT{n)0lZxUD0D#Plvzs9CchSiBm9$Qz6WL^hGiTjBd>+>bC7v
z+#g(3=7(Xo`uwP9ve7>$b$aC;cOfoS2qG+If|yCm#83!cA_$(IgUkg}>!_Y7w+pg8
zal{=dVvpNltZ8e)CRddqV^aIHZ>Q_ko<kUdAubm}O(oA!+o!lMzs)x`=(r+}un^Fa
zJJWa2h2Gp+4|)+s(a*b@fo*nnycM3O9Sg$$SBd*y8A%=o*yWcG3(F@vRA3EJi4h{M
z;*Gq(eq^TZ-yKg$LYmpnW9G@a{I17w0;6K|WMY_+0RLC)ddv?6+&}?En*N~AFzEGU
z4l<&l1sEQ&(9-T6zZS3<3NYL_!~rwXqF^+tvU(|R8rnc#Px(mG??8VHnNM=RjKl&_
zT(SH^Nlh61ht9bHtE9TIQDM7k85#rJu&~2`(=Ordr~&NVFT{A8e}UiSsy-qZQIQSk
zTVXMWIrU3AK=QKz%-&&4w42i3ev}VmN^-n6v}jqG<8L*Hms2I<Q4dS8%T72<Am_Zm
zH5wYW^`G|%A<1n6%#0A!iMyd%L-6ooq+4A0$|A%GOsJi~oFP)3q_fdv2jC=HIUP7I
z!01v`PmOZ?1c{R2^fDgV2KHTouVnIcM=h&rjtxViUqFj+<i5J>W4=CsN#^v1hrl&B
z*N-}k7c=D%@7fr%Lj({jwB#rJi;;zs{KG3Ofy^L}tE;LdEb7rU?i-eDVhAzPY?Cme
z-?u5FelQmG$uDRq6rI$J{mJ#pkrg$i-s0Cmfp*UlSSD6=-EO0Z4v6sp!nh@I0L;?h
zZO=EZm?<Hf4DSa+=rwIhpyhgvHMApu(HjjV6!T*_{g~}XH9)(qt#nVQW8ctAS|9|K
zYrlP)LKh-kH%Gko+j?K?l!o;%ji4vwPLrz#Qxw-awNHmE3<U!!Ep>%esduPvfrnk)
zRtjV3gIs*urtzZ;&AFVJhTW=jYmNrLD@%a}BhEso*UArZ1Aihcd-+HM3L?nCN#8-n
zvv4o6!!L9=`6KKRN7o=0-6dFp_>ttP%DSSj8+<mq=r*U*?sXz0uf$cJA<*VNDwjtj
zG{-p;d6|zCzdtv=l+sHA>)i8sl|W15P%iuUd{}IfzP-UNd)5JfcGo{zmD1=lBMtGp
zs|gN=*3(D=wdbs2V>nGOj=K_~8~agJ`!3bIsw32g5^>1%x0D}YF*CRy%fT$ns6t57
zKlha$DVPwsPS5+?Sfa=55XnRidx6!VsQO;6myZnl%cqIM2s8a8;?39*C=SInpi%sD
zNJXN{ej3K)9L`(cM2&u>L=;@RZ4E!(!xea~co1F}@=>x&@%3g!I_<j0gRg@3Adpx;
z$^|=3+sc`~iD&6<h!}&~IFhVI_>fHRE31&JS(#5xydXcWi^p-!mdrtLI1owh<Lj=^
zM=sZDWs-LcUFi|#)W;y+Kj++DRUh$iYNL?YCm>5D0mwnM`##3j$}Mapmmm#MQnHek
z>Y%pr<C_f6s5|8o{kqj>d}Io+bm;TPw&8X~UF~>NYW$21K2QqAE*%<9>TC;w<$rMj
ztoKlsO%?mrM|x%zkKwy^U9mb>YW&q%@|J_8T_D@V7|Om-xfhW4cx;q9MA~V3>@Xy{
zJY?`zL{iD&?wU>a?veprU1b~gRtmdn)jVT?!9PU%<^|a~Hr(VB4ZlHceN{SJAI{v*
zX5|#A2p8FrCJA#X>`UKvnm#Y?3%w9MMdU8#Wm)B~;BZnDd=VVW=WB!pOg^ZbmwT~?
zKf9h}utI5vf(`m1!b;r3Y-E|}H0vuD-Q8Z02z|Q0uKjm=y|12swgDT}uk8}n^ppQq
z#Yx=23wGG>D|rgW;#{0M?~h-o!8l2z;L<FOY~QE7y-qt%Pxs?{qP<@J3#Pw5&*-DZ
zF#={IFqs;dA~NWhob=eDjUd>t7E!j3x}GnR^Nn*Mfzl?Va=+2=!zq7C1Jngpe(7Ju
zjlC!Hl)NeTfvj8%VI?MT;soCS01N5!xDGR1Xjy;)g;;=+^BMD|OkHWJ5N4RwW)KPb
zxIp}+Btirr?hFG4AV*d~Q%WG78>(a^Ht5nA5ro+=919LJu>|Y~W5a`ETY^zA1C%zT
zXYje$%mnG9!5<LfA(2qNnu4t|N5f?SO4MK)atN(yycn2NlJ3$th9g#RFuqV0o@_SS
z@DLW?@5<x_Yzsv&V7VK~XBUf3G&J|JB@CxS2KzO1@@K*&Y|7C*o+WjjSphX=Ii7F7
z<brh7`!E^Qwr#2Q5<9N@nPym`0fzmkUGmaNUT*+YSkok_p^CyZv+HWjZiNY+udB6%
zTtxAma@%Nz=Jm9+fNYDVqh6T6i$r38aVD>1EZ~$?`r7tJ@@B>Lb5AL+MdwMTPeR9>
zhO-GZgvN`Ml$9wG`=*Q$Ct`u%4q%=p^jTjiwgLtJ2~brSEi(*3qcRB3#>@`q<dd%M
z!KSy!fK#)=U-GI4v<E59%wqLn63~4jsEJbEhQ*yt;N0gD=Y}lh6kDV!Iftn@aUg!L
zSnHpmAd8HRGaf_G3g`pxVCg{f4^1!R+x#L4qNw}4-kY8Un99#~y_KG7`eC%LY+3u=
z`&{KVZW*o;HU8ALP6t(QtZDnJFEjyW`(uL(voDCF%T?(1Qgn9PAo}L8Lo<Hin3~y0
zpg`(HWUQW(Ogk1oQYYWZEcVEO$^E=FIWq-?U%yi8GlEAfLrXOsPX>2zX<{!mi;?aY
zz32fVE&GtKh|_bZYcdP8@`*-mS`teEJvFBAY>CN-g&+vuW5uOIU2S4VRHu>gLqfFh
zkawBUaZ#&&>rRV)s(vK_BG)@9A4#q2QYp*|J+@>fB6Y@dA{IlcbzQ}eMx6hTvG<OK
zyWQHymC>S;=td8s6D@itf=47sh&Dt-3lqJUFrs&fmLQRYV06(LqjzES-bWpE%<!9>
z_q^?#_xoGVTJz7WrF_c1?|biSU;DbY94^+`=)yoe@?C9i>=$lc1FexkR-RvU4s>zp
zk|J}v_UdpTxeMl6$avdW2dabdx{mxlDF&dM<OV{AOGM^69oi}+IyBhHA#_*)%96Wp
zD#A$Nzs3NPRoBzRGVwOM6?ybTtJE@cRSfs*E)zPNpjX-@CK@lBD}&=HU~HLj^X}$1
z$KB?55RQ2~kHc_M*n?{2TZH>DC&|P2)>fr@Y62-FNQUM*+Zm9Y4dOuTHM6NfW;=1n
z8I!^`G$Y*7QQ~`Zd}=R%3Q7es@Mz7C2<&KnC|T(3#Pt%{eJ(4$9^AdD?98)oa^c*a
zpS3soxMPe=W)8fAgH+M4!Q`ADTb9N4Wuu(1`#LvmY38Q);#l*GqvA2lGSWjWK#3o-
zrhvlu=AhP5-@|!lwR4tEVtIh}?ZcOY^g;^EPKSI7&%E;j+#24V?|V*5<v(3G`!zLN
z*mS)&yLj(h30=XEN@^xK#j#1dQFZU{q5C*O3oh?ka(>>rwTPW4&NORT>hm1++sw3Z
ztA|>aw-z<;l{KEoG4uUS>*XX{iIH|-dAmQIU<EHE%i(>Gedlf<mjpRnV~de-p!}!^
zC{AwUY*6RcqZ)jkZ7J^lwERGx4x87+#q}5j&!)4uC>)|wTyA>67e>m}6KKr;Oy6_L
zN@gDCN`WuY`%wiA+50h@ndtmca4R*mK<?`&vX+TMZMqb2=Fg`av1^%Azf^WpZ<jdL
zbm3Bm1lvOT*CSt(aORzKPU7g<8FAVGa+mrx#u$N4_#idFYx1s_$mQ!HK1iNb6t(w{
zjB^hJjhPHX&*v$<MyoA?B&Q!8G@~_q8(wSWU7KmQt3PZQK3H`1Oaxy|MR5isWvKFO
zeCOjT0cpNq;|{AH<bd{Nuf)?iCgF2(X{t?)UBVooVX^1Z_UdfezETCzT|2#|Yr@+C
zTHG}dMS+i{=EBlIRIy(K=~y1}<ml7Q%f;W^ya&x)IvmZ(0eB1*@lHFdOcGg<Yr54l
zzrd8)vcI)_AT@}0q7LGGk7J+0^(r2e{n!S`OOw@oQDq9)u!e+M`n3K4exQa;P4gRW
z!!5u3hL9ZZf;Bqcj`ZP?phT6>2OdwX8H75@q}sk#EqRxS?wyFFv?Ivfm5(E?N5m%W
z;_m#a)i5fSIHZ-S&{iQ}-J!&PiycT~vz~Ha1m&%;GV?o7?E8Jz31}jXmY|3`WW+kV
zo(~88{0+r>dfD01jjVs;2Au#o^T0=WiyUJP{(41}4Mu`Fv@<&bms=n#t8Ohn2VZ}y
zQDq{87yP(X8hy02(5dpa<UP;wk0<JQ@0v7oe2=?dHr(8ke*5Z_xnJNfOTv&6*8B42
zTml?>O`~5x5yAXYauSUG5wF@e#ecyl)!>r_L~Hr!(1a21>ItE3Nq3h#yW*YarDLvF
zHdd@TE_sq2=tM=3TDyapaNB;L3YgdVb&W_58{zl$A!3Aipd@IO|Hv3&!{^QYIiv|P
zs4{CgWuLTKM43aw$AL-%?-$ob-BCG)L|YHJQcn1vZ-R&RUGHSO(G`$W8AuS^I`4Y0
zc({^(McB~J{QlQih+UQW7w1)h#!_3-0B`E20T%W56@HuB6ox*E^RY{iAKUpwS`rdU
z8Fb4!BA|Yl@2$moU^m4h10!NrO0&hE<!3oS@es<l0U%+!lVrAiPzfs*HCn9Y|8-Xm
zCYMEo9)orKg&>y>l3${IYSfA<I}VQqicU3QK6<XBf(sODecY$(e5~d1ocg^h)#UX5
z9;2*OmY`d!;)r)Rd~eBf`W<8X=3cO=-=o&88?<ceGdIk_d0!$GQb;Gw{@GgjUbcNE
zwyVK``n9&hhXvnVPGbq(I)QERZ&n2cD<I>L-|W3W{`848EuQ(i&wFes=o)A<uRiBb
z97@)m4w6d7D>?K%!n0E~e<Ko!#uxe?u9(6$;SwXLpcd?Oq^N&qU-1(}Si(+Utc$fb
z`*7w=TA2D+2J!YOH5}A_*T07dpI6r?Lp;@xw{vzPg?T*tGDA`)QA1*9rh5oV`7A+3
ztdzhhu~#(ndtu__W?0f|%c+_YGnFi@on43GJLbmiOiS6<$rDw8&%Yz{Km|X_l3;|q
z_dy1KImGBqqs$+8oF}S^B&){erWEAyJbuyixv+3oK(E9ld(cQqwjxF}=#z-<)4Vwc
zidTH5b&F0~5wbo9xgoz17a#UN)hbC{+=g<*;P1kAui31THp+@-<fk@4RZFjYEW&7?
zzetWN*_ywx2&^_qtZgJysg4tk`rLJI{=JiVjCm)p*6-Q2?aMq!Y^DOW9{Y>fGGqTA
z6Xw|Gi*}-sFHSliGdfyKKVYJJ#X1Ath<m(x3$a0eF1ziq_kzOxr{T%uuBH0JYik{;
z5kZ*luf#I{E!Yvuy8e-^A>3=r3ZH-_4`G%qnzYSW4w`$l={mC6QmXeY_jLVSMQ^ES
zivPz7_+H=`$vD0Opy*Xl)a}<@<-70LxodZd;M8X|d~tOTd4@XkS=o(xe>r&kY9H}z
z%6x#YfbKRFnNzszo?8Ywy=5e2WlA=ns?~lwR{v@;zPkNGL$vUX4P)qwVd>gZbBzJO
z@3)i-aq-I!ICNO!?(Nq9>b8AWH`;Q=QeJCejhjHKG!v{*QxuRo`~6Ead;Iw}iI2&8
zBc9ORuWKJg8Gmdz+2GOAGwDiDlUS8}qcr8wh+D8<r73>t!uj%dn1RK7zN{;&j3V*G
zy3RR>$KZ%P<s(Zz=(cf>y7bC*6Ofso*e{Frv_hrV{N^nMnBmgbz3@qC*(R^3$kzv#
zu7mW2WlDxcx4-NZ<iFmVyhS^GPNCB=mBBEv_E}?nIU>3bf6v})nlCfGcz@<;p4ZWr
z^)rQi;VX_{UD@na^lKF$o?!al;Z^3Wld_$=FY6JzOoD_&70+?{+M8#`<<?hj4eLV+
z{hiTN8K5eub%Ea3eAJh_R+U6Z2K5ftoR!}9cO|Odr}XwyPx5>ZJLA@qzhm?l;(Kc{
zl2bH&ggwWieiF_@ss1CLxa6$EP{eKM%lBK2$vxX^rN-ZzOl4Wj6l6T=3i7f(Ya3Ik
zS2}01!q%rc4`@q%_l06pbH8=BC@rYnVSm=iw(RnK@7rhTH$0<vPCFM^$qUi4Kd8#R
zFdZ4oPEeCokLB`oi^*1(F5k$&E4f(1az_0g;w|KY&4S2>N8$D3)&9=TyRVz{zgXt@
zJC{6IPQ=ZdecNT*f|1EQG?cvIV@*7$kaHLro3y3xqLp|i?S4-~!uR(`fQ^nr4!v1%
zF;h4)N^C}5l%l5cu7(Dy87UlU*UeYUMgq^Zn|z%+6?f(4(Yqk9DD#WQ&fT?fvvz|w
zSB!r3$X^O`@9VtzNu0<ltB8KjJ;<#26NRsaIcX!PlKpv?-z@-dWu(VbopB+BX1R8b
zRl7(z9Al)Uk_}SJ)428ErS6u{((_FKEppnB!Am5XZS)g)OiH)QVByqu)Wq28C&uSK
zDb|ukT(p4Y%3`-)WB84=OPP|EvkyxHff7%o`fo)CDV*7D2~G33*(U`g_Ugo0TGa0}
zM!PD2-|bBrww9q{MVb}&O*>U^ia@nr#($;<F_$&#$D3hF$Bd++Ez|Cn@tyI~d(^kW
zGiNwW?P7+>&<sUG;_T<FjTs#Fowx`5>n%sNS_qG6>*m?|2=M7t-GLR$jj{3Sd;J93
zbIz#R-^1HFCtuR5{6kCgKgW?AiNrvUoV|aLPnOX(F);?da^0Q?dir611hKUPmw%>K
z9xnyFTFY-$Jp0QztmSD?Ha#x=qB1aI;V`vuKw1^Q*An^4e^URg5$O9V@I2!nBhxC#
zt6`}L++W77(7&hB)G9o*Rni=^Ei-<Z@pnR>mtYst_K{R3SrM{Y`_rOtQbfvOACc_2
z*r{?aagbdk`s>~Pj+3|Ywc<J(x}W{+ATT_=FsOd2Gn0{H<lg0a+{tdhuNptj-_B;L
zd)5YG9Qh~2+APrZ9oFRJVxD-t${2TD`z^boE;WZ5+j~LHGFB<bF&07D3K_ZGS(a*H
zC00I#A5?>1hb^hPs&c5p3m?w5GDNqyEV@}|#AUp9WNM78G(%r~^`<--tO?iH9G!w&
z7qhy?hXd!etH1y`kRw?_?qi+-ClE+J+4O6%l1r_-YVA|46>$B@dO^)k_m%e>a<z6Z
z@HEm>EY(zyCy6f$+>7rVUsp>T4P8Ez02*mxgX7!Wwt^oNu-EAyvhojk*k_z~r@UuR
z%{Z})+4-0aY_`zae9nL7cZVSZ6|EjXO>yawuq>P~_N-DA?aeY>=Je#nl-x$|(KJoY
z^QSx&$@0aMa?sBfDIGs7E|(<}Kw8hchu>;nJQbE`(I2E-%j}t8lB1Y`Q<kPX4`*sG
zNx$!e5g(Zcxhqi`v<^M_&Fo2k_JAw*#Kq@$KE{3qb?2?qbHj-V7VG}L`1jCL=FLt|
z<yKDUC=h-$bx~?C+UJmFa9UN)YBCve|19yfdF@ZJS*!AI6R_!CgDq5I><o48bCW6H
z1CO*<J#T}XIRek4s;T51AMzG;qPqKX&*z?6U8D&051c&uuyR!gQCxa;jfCyN&(DVJ
z^Zt!^{$B%j|C1Qd_K~(?akTuIvu>DhD3DM>g<pM8UA_p_>HjQu4U>rxn6N(N7!Jm0
zT+0k;^`|1_j2(Dc*~4;VS%V@aTgGX_JSKn3Nfv_^jT{Ds$hNZZR~z<YcDWK*OYS#C
z#os|pGY)zTmRFJ89eg_K9A`sFLbfop4ARlkU4eShJNSG4dK6=SUyONerSW_kV0<S1
zcgiTaY0?Q1SvYvyZT*0y#Y-hbqF?M{`iq^_=8xa4YEaZ8J4(FXs(%5%ZQ@A}b6Gk#
zd0D)7mmB>QqmmC+uPGH<-<H!(-u|x{_W$Np{uw9u-{0WsHU<DzVNt$m3QTp;M>W?x
zzW*`W^3Tx$ZgGiag&7+#G-ZBjJoxVoYtV(+0wy0-Fq=ldSuJ9{A)jd%LtlB~CgT3}
z74E(ZJ+NC<nA*CkS7PaN6?+}PYW3`YU*!Mmn+=vG>w%RCW=y&EOFrVh?WWM48yMHs
z7W=o`jG|pSDy5m<3-EPaX{=ZJA>Aw8X|w+H@1(vJRHUVTB&@+69GV~Bz3Y-xQL)}&
z+`v)UHq%>&t)q?g=>LVC()N&aLTq09o0_40cI_IKj0lTg-oM@Tzx>XhFwT)9aK@F<
zlB6=Jsq_wZc4GxuStp>;#lbv`Ix&|O|DuKeKi=L_uQn(B7o#)MqMLt&gA5e`(o#xV
z>C3?~y~E?hE`G1LgH2ZczBt~0dkp`_gOsbHk;5U0t+4#OJi)3eDTmjue>~b<Z$+p~
z!!j!tfy1S0y$k<%XX3ZQc&Fpk`F8*DSLCi}mK4sB$PLNw2aBmD+=#8Ld|Jmv#U3F4
zzXs61uhE?60Qg<RVQe7($g4yaSH0oO0SZ9&vt;M5dzn|Fom8^Bi!ohV>c5>mOvJ+8
ztSD^6Rf_*`!v>@?81WHEgcyAp_6W??wd@}p-}j*H2P`?)lx=&r!ymZgBw9SUfA{m@
z&t6w=@~=2QeKB9|LSg8cZx#<?4l|a^>B)HpH!%I@CFW?89?IkO20d2LozYi72oH!+
zoN}rNMJ@Hj{>wu9_l1Ld2uqQ)Su9foWJjEnxLX-Y1S&nIVt-(n091IMz^43|fgvgc
zs#3Q1#j{0$GG<*@G}~Q?;Wbpa=RABUhmGb65gBjFzoQM@Hgat{gTcO{>r1*M%K=&w
z4Lx`Dtp<jNzgyksm`$*@=irltIM}vBnYSG^`D*=|7;5E;VWVKoiQ$G`2I=@K4bfD-
zPvXJ&VsO(QC(BLB{x;u0p<Vu7bIA|^<udM)qw?>uM|ZswYu<tfylQUU-|Qgvk`R*{
z8#a%1%@%}N<oZ~y6rQ$@RKL6M2X1pn7;cO0Gc%g{)mu&k=8w#L%0od)PC0^HcL}O$
z-H_mj$}al3m{<u<q2PHKGv&fu07s8j#IxA;xW1=}5m&boSH{zanY-?DSx8qu{TX+g
zGk6*j?72p?fm$j<d61{9>L)r&um3X?P1S9T7YQ$@T0RYrH#A&&A`uc-!M5k%7PBq*
zfFn<N&D^-z@dwxcW4Zk6J`&S5ozR8=WaGVuDYbs%S5uaiol0gf6liCM@9C}}#%o*&
z{0dV1(<CckZ|pNQh$)9w{d?BFk)PsR-RXE4&>Ekq><GwQuia+=pYaP~hvG|(`*P6K
z#AyzC6q64y8@*Hz-PD(i*$B975$i3lw2G29l{t6>+DzX+J;*Quej4Dg7NU?Ot00S)
z0*~nNlanWf+EG1-3IDJY@_8s{0wWG&RsX1<O<dS<WshPeU;&%g%6lst1C7~O+^gkP
z)L$x<FcIqBH(X1$zP2cCUOef7e@{u696uMZ*yukb58c5U?6P+Bt`#lb<$(*%$0}-f
z&vk>-*45ZEUikl2H}`CSnlr4eTe^r*S6U_yc<8xPGARX@8PXmb`(Vp~;)B~fmC9|y
zt0}u@^v`E+C`k|)1yl~KXB$87zEEBW9y#<=W8Re7;f?;d@wYk>Qp91>v@REXL07MR
z`pm^NIj3OCaz(`4f_n-wPq^E^>hW!QSxGe}FVz%z6hr+rU*tVE^d0!UF_;}c;kgF!
zUX%Ak>{;L$zOS$+8iGZr1$QT~XM9su4`0nn1)HLF$f)_pRL4H#eh@JVL67%8HGAQp
z$x6z=Yp`)T)kCdx@>j#@q(wiyks|ctw2L(Z{@|^zw|EKSO_2aPu;a6u)X`53fM@WH
zGGsRf)Xlrml_8SdKZ#=kp6$(gwRByx1T9_%IV`pW)oR?fXIpv6SPUMTewKIMw3(?d
z+F<?*8MUUcs@gZx=;PjSxsl!f!e`#0QQzQobLpgYx8oPX2<uXK`WpO|i8cS}irD@+
za@r&hm9v>vthDF!@HX(?)C-@WhJ%)?6SK?cd&;|O;I4`}5|c=2d8m_G;yl7~Xw=tb
z`d1Bd4my4~-x|_t8*sR!_QH9fx`g7ROidKhEPUjz`3pvE2;JrSvtfTzzcX;&3(>$n
zlUpt2t=HM>IIEbcAzPjJw3>+nCgt0Qca>fyUe*e%ET#2mSk$`I%tulI742(-DoZJS
zUUvIu)c9E&4Lb?_<5(Cc!tYr$Jll}^9{eg#wB0f1Z!IyWm_Nz6A=OcEO47LwkDC9p
zeD#!!DFQtk_Vk;df<dEhIefNs8RnA~Fna$9A$LV@HDDz{V`vWex?$aKILK}Km#f8P
zJ9V%PjN$n-5iHJhHi_WnSI0P-!xbTG7qV^l#fv@9gXVLZqxUUJwIAm)Q1Z#1-jGK}
zAeC#-x(c@V#$5N!m7&ZvX&I|q{pY}o&Ja5Q`C_k~7HV3K0N<M<j8wYOZ&LSOQo3(x
zN9yA@C3=I3uXt=^Gh?+XXPN_y8cxRa`-m77zaZxtOi;_Ax~9~b3I|P9b7$DuzQRPs
znZ1v1!*m%{&cW_t<^I1*`cF=(ldHad{p!M4)OgU+h&kf8iGkcZe_u^tYkx@keRaEz
zc4`Ns0>ri?n1=qG@9L6Ij?6O)-p*WjQPzTf&69#Xzqt;{?B)m=Amu~OtU7;nU$(bY
z@JkAt_PQ?fyj(YXrRbeWKBUr`Q@5+gGpdO0;aM+hJh)dke-`xfJizs50{30N0sRA_
zLi@}U&DU{L1>VyBqp?;`7O?w1nT#!m@78fz;lekoAsCf)Xg9Emo!qXjgbywBv_}SU
z<@#`qB^khVU=uQ1ySHw!h&F9l9a89n7An5f1Xt%42~GcWb-ryqx$<}|<IZ5zKhC`&
zJ3zg~&X;WI^E1RcQka;x@$V%tZ~tU`VG|vq%!LnWth8%>)`<2<EAl$he^?+=QrFYo
z(0cem!FxbgPHM*EC4J&YW9;*k#t1pB@(<S4x$2_LCu7H9)PbLn3)r~h)|;L3ermUy
zFj{v6JHRjGewwZXSf{UHGtb1z`?S9=<g)cz-w!#e(|>SNck|LdDxGd@zv}MMo$~3l
z7b!fv3!}OD`BLibew%p~d7kY=Gg_Mv?|br7-kCJz#lr7N-#%d2eYv;U8y6Dl;rpyQ
z*Q(5~OQ^4^yuQQx?d3)H&7TmGEfD@4o8geaB9rnAM0+>tk?O;e#OudO=p?&5^h9yS
zdCU2YfID_OUo_KsitZNA;60F)6r&1y^rjqB-g;rZ?m;UoFk3x7D3x~<SE&znDDi&w
znHnm}<>pFn99OC5oZjLM_{q{JU3Of1cKy??!uhM&HA1Mz2uV`~zDlTks_<P^n1KEk
zR^Cq{D|Vl<k`r}exqO*Xhk5Ha)wuAq>~@&jFJ<6800+(JIynC(@G}1fbtB?4=TZD~
zv`xw0ykB{<Fp4MWta2qVl}UkZaA4@wexAvY!ogf+1ayLJnk(n)*J29#l^5XT_sL(1
zNRt!&Pz8+5^_a~YOh`s-{@Ka#=Nq(jd=CmX+U@ECyekycoAMvIY=s0ZWH@+#Pw`>W
z@S~Pzo(Hw4FC5yeRXogpE31C<k+b4%xB+kDYUWv<09807RR@!a?w$%rAxP8X;c~fW
zGSk(rOROlPN0It-Mt*~iFFe0;7jxVb7PL;a#{zzm_*T&WNvx77*`}nrVV1KJnO0%}
z^TPY~z^t4AsUJyY`8JNEN*Pf)ojI+}X48@i7F13;ABgx0R*lW8epoyamYTU-W}_vj
z6;ulv_h~UXJ0j)hYr5RE?ZNLJStiO>e+R%!+-~%!H<IM&8G5~$%yWEMQyy4@iC#pD
z=$C5b_^z@png`<~=$i+&jm2YmA8D2@-+_XPJ6rDVGt&nS#T0c?F<q?vzNA=WNM0Zy
zWFI9e|AxxdxL<ZmsTL7VA!c9UoOPJRcHLWhsbf|7HPJoSqSX8D(^QKj(MDpYxhII`
zF5O3#G=)eb)9`nv?D<$kGP^Mw$2r;OwYF<QhjWKv0kM$j{yt}G)Qo3motr?&6*O@+
z%kZ@uK08*5AX9YIEd35V`lv8}(kJ&y?sX>9hQ*$9k6FzfYMZVQ^g9vpR$W-kB6@I9
z7-ty0>ta?UzVwZ-yTH4yp&qj$hEbRQq@xwI!*K&uJnZDi&;bU2!{qj;%PyYGOG-(Z
zoFS({3VEtDVc&@42~uVN_&aQt+Z^~z13x-dR&9bxmCj$h@japSe5xU{C6;JZ`QZ1s
zJ&K|r1vwHW;$j&7-O4-dlWnBfG^rx94`Cr(TZL;#f`Os##5eBt*+?<vW75qtGjyd2
z-{QPw*T)?Qk%}p)XI!`vCO=@`Z+%bYs%l;7AgCNTeDY{MgqT-&fU|113Dvi2bv5Jp
zB=Ox<70yKFxY@#O8_k&LZHMJBX}aw~&jbGGi}kQlT6vEg0w;oUcXJpK(7g7v-3Cyw
zn2lolJ8x-U^`}@$m%;BdAFO-cAm8tR9>w&-jpEhjr2Om;KOarK8lU-||09*D=E3{o
zK3BBfpK{tpgS$;hVn4Q@=+$D)+nb?(u8{wUNc?*V#7n@>_$PTne}3EA&(YWJDe+{~
z%;M-HK=KKm!uuzM6VS@52ls4)w)rwMoUJ{d`km!DW;6o*D==7<8?fKua<tZ~QP7*i
zA9L!y?mSHCo}Uaao%F51!G}xjo}}UNJ-3V+x44ylIYlcyhP>bv9Xs__>Wk6QVMi}>
z@!YQ%C)V4!I%qUXtoEBjCJo$$4tYdFsJ7guE4y4&e&o7U7*(>-5$e!!vz^Dt9bpeb
z7JEo8{MyN_Y?zphLpcSXE@V-9Z!2jLD<HMo-8i?vgN62x-EX=Npgg3fZm(6pO_#n1
z9a+^<co1;DFRfJ8euo30n!$K9CJSL-IxFPB>cWbqJzIdq8dulYt9~B;oS_k>9tL}S
zWCe%}4T}@ABg)?50i@N&v9#7I4H*~)bKV~qaudns(ii;tVsmfIkaIIe?n^gzOE*r@
zl&pjJg2_YULXzQVj59+d1(efHY)6V1k%cpHq(LZ~Js#2k5xK82A(mp3pinEbUTN6d
z{EcxR&6!`jWsNRC%g?z!Ndf5bJX5P1^i<|S@Ok6<ax`#kclmgFIJh=&Ti?1;{wzwi
zNv$Z!ahgh4qwPGL+sY~_dTZ9?1i~q9n@2~#dX|Jl3H*fIp|7SVd9Xyp(A4(s(xVJc
zuYk;nU<W$Evc`yImbxDNQdN+W*pJrw%T`IETiceg-j3tNiLV-`T^YOFo3@Sl&gVB5
zQ27Pc2%Lhx(47rFaQJ)#P9Uu=!*PEa)VN*o(!KfAlr?d_(I@kdpRFw2ZQg9>^5$Ag
zpLws^>kq9L`BOopfmvV}8N+}WlBO86v%4@^utLOv?iSUKBSMIG2Mf@pr@m731Ukd9
zQ3O^w8f)zb@+_I;Vof85-J;I#C1CvE^k0XLI@99%l@UMBzL2AA-5+o;c7~0`<V(}$
z)I+QP0~lhC3tb#<FxgcOAwHLC{9E|0%WZ%m#0FgX!1g-<pO36_an|$)!DK~-Q-QD1
z{U#@`z6yypmMY#HJEjlL)@F#g&sv=+wbTh4I?KjRZy#T@6Rv-wn|!DiuwoUJrd%tY
zsjrxn!>LCp7z&UhJ1ADcZf9)WJ)&%1mM-^;=WF|8usfqm#CyR7Ny=)uxxR{jLl@(@
z6SBe|+;PHrTlG;W#hdeapUiCcmTAa+OPvA*aTo)P$O^&obVMzoBiUJ3bU0uEHL%E+
zX=&#%O0`WS2^X2MjR3E4J&IHgx`1+ANsKpMti;AMg({IUBnACZCrc05Zy+&YpwDVL
zd?zNHX&v0acN6helkR5m2D{jwrxeh)Ki?R?glZ$CP8$x|2S-to1qU9715`_C)a0Tc
z;cZ-S4b8eW4w5QdxLoy}))T4FNI=rNgOv<mx9uXDIxcZnl$QV?Qd|3)?N;d#MoLRm
zNo4=tQRQly=n<EJ>dB|_FiK6PK-$gcw;l`#y$Opvn%h*KTCsQGd>y#wY%LUWY8K)E
z$j-;~<_oue%60yerm{M2+^HXDd=p{bLH_tR3YSapfQ1?LVZ9O?r?Hy*wu%ua9V|A;
ztYX=@HyRD7A%(_<9$z&8fqsv~;sso`&kSb`?KWr=E!Q54yP4E{;kw1(#$NUNVfVe)
z)6FvatAm++R$7kWto>5?mya6n?q`e;8s3J72ctS<c{$M3y}Jtm2Q^0#TLeG};7PI>
zLR>?rNrIttcK%~4EXD}klVdMjF&wnS7;?l&DKyE3RRtd3+3hEN&=D&4K{m;OiBbF=
zl7NAxxQ!v?w%ywGVM=Bb43{p5RfJW;XS(>k1%q6+SX-VMHMJ4jQRB2{vBaz}D%<GG
z*w$K`hya5*_ZgH2l(lloDrd<r#l?`O?a3efw2CBb+2SfCxO^S;CdSkB-!O;&YhRCP
zqak2TvMHSSLDwqvu)rEK5!=_r_`>{an&QR2fo#SzcG+!X!M?vTV?ZbeQ;SK<q8EBY
zW|9HfDT8%$egO^Ei9_=DyG11xS2Vw-sha)@`ZjK<N$?@^zF5ja61nbNDjR={p(pD~
z$L!*@w|;3=HW7fFlrTwDfOm>(;ID7d_J{qgnEs4c{LiRt?~>x*9E;sNRz{B|X8bYC
zIc1kEqW4Ie+sM(>&3+`?IcU-ImsT9_<dM&y^pyD=@0i97dbeCG<lHC3?0T8wx;+J%
zZ0~f+>7knU>84tvCDa^GZN>e1!#(azgh9&9AFDR&;GN>&K8Vx_B>{eKpe{GfbHuv{
z|Ji2kpmyR58fsiI)V%X_{l$TQW-mP<;*I7tx%EYOGBZSeh1%uge!1^^MX?oMRQ95a
zLW>Q@VjR9X_RRgp+mSFF{>O1}CQH4dUCeXXZwTCXwQ$~Y+-KHO*-6ZI7*>s!XG54=
z#GW{Gc#A(yDtLrYrGf-p##N1p-RR+0J|e5at4&JgbWtUU#i2{FmwJnBIp7s%@+o6R
z9i-|vTedb*Iy#~oHB8u+CdbW*(M>f^qFM#|nUXSD3I&S&hQ_`vR9S5j{UQI7*+MK%
zUX$+dOT02>r~LZ0-(|nG8!t_u@o<?!X&pj|EZddK6dry#sQAuOQ!Sr>mT0UmS_QLw
zd^sGlP*#|auv<tlNg~uCy;tgN2b%g&9)jIn2XS0w{bVPVv>`frFHsmO4+=NhS-2eX
znOU9Ba+LTA3sdqwxjfEnwY)y0z8UE;q48yst+=eQzN+#3{nTul>OP_i2vh2jAE156
z!HU!%_AduI-f><8?6TGeU(GIx{;{(EtL1XgeWpytRbf+t3Z{b}Ek_;q(>6|4n^#W)
zgqP0!cZ&Z1it#ry+!f2DG6f$Hg^_tb?9nA!EPn6khNb!%LzYpDY0>+?8Wlz92DoV5
zsg%*WA86H9f15QIHLW>_35{FSW|W6qS*)+#TzvP;_m0b2^)o&T$$Cq}qs9F}Q$`E|
zM1I4Uz^f!_G)a2H-!PcK#yiRNsY0JbFE{|1<UPho7O$9SAC`qbx^^CXaPDG81tCe2
z;M}u`km(Ubn&XEN<wC-;W+J@<fJbmz_LRLIRo=@s5@j2`AdCh<y$LTRDfvajh^mV3
z98Kc@Y+vr=KsE#=YmlgkW%rr0m9z;1+LJ*DX_z<x9x!FE+YlleVon?}m=Z>S?ghCX
z4h{(?nIP69{nw_ytoq=V2c?Dg3Fr23f;bHYq6<(-1g!v5fjkuX4gnSrMp%CW|3xSs
zzEe26QX4+S5w%PhxfhL|@<lr}i&L005Co%AfDupcbcqE+2g$u#!$=8bs^cx%vY;T#
zwp))Gh&%~{IlqKTyDqiWb9L@3Y)R+{!lJ04U`wZ=NX1A>@7MUwJ&$R61(KAQ=*0=D
zm~PyIb}h6e$q1O01!3K>Eq}?uW1S%q)%1+^d9uyh2J64egT1EA>>NrDyM@G^5)rmQ
zHD%mvQz?SS6isor)ClqdXLQjzuJk-sd4*%zgB)x3g4ij+nN+lt97#(O{GqBe2qJP}
zvmZ+7<sP`oN@)To3)*Kar9Fhp>;ly3Q5&7y0Nd<<UWJ9DgyXTymTI0U8mV6heCk`i
z65T5-E>1V`ix=?;SsEcRM9(nGnGLsOIM5@}F2(uAS)9YM9a)Ec|4f_TeB}N#>o+%U
zG!C>!{GIr0i_*4XCzVl*bV@4XBXfya`dIxU;2@oSWM9g`sxez&x>2Kd2VCbOs&YD(
znW^BNXHjb?<X5JX=aM`uYkl?J^Mki(!&Xl2`nQz*O`#)2DOu~gn`yjxdBWt`b~<tE
zsc_iCj*sk*IQx_E97%4aY$Q?QDriN0x73PIU%c<{)}&!L-NYnLUoM@Mp!5Ct48`cI
z<3BRK-oBqH)%%^Tub%Uyss>&bhoFl^Jq%YAQZ_}b!W;s4{fy|?!iixVJ><y9qwhvR
zKLRnU9AZh_Thv92-fUb@qvL#?YgNUtG`!_Vb~R2iRl3Wo)|&vHq7fZr^VR$TZt#l}
z0Ij0PqT$)2p*lpRmj`wo+K^DDU~z|Jh%sV$(}7#zi0SSjkM>FU8$vyT6>@a`^+|C&
z4c_$TA0OvFXDiglePdOmU8iqpx&Xf6Qs-)RTmFle2>f+i${*5jHsc(RIKlnXt6JxW
zNt{d?q?9L=b_9qDa#|)58RQnhSNDL~Sqc+)7TBAcfErWK`dm%))-{w&`!<G_{Onbs
zDsMZ9Zzz#6Qzs{<$NUU3AI$EBpw8c#7vwgj@keX}INbgEE#d+@F^&l+QbF(U?fiUb
zh=^7Hoi$&HvjM^l0G5}5RP$nm2)c8p+*fN_M3F0L#QFr+o%PeC1F%5E2Gn|t2cGtb
z{@GIF0bQ7vRBFM6M%Bg@^g##R)8(5iH*q>?=2JG>iq%y@)I}_$pxfRt?Hny!__X}T
zNY7JTem@C3@8T)6Dr^`8<!sR_{KlYEZmO0;6*ceosKeTPE1anioWnukP`q995Ewzm
z1%Sil%_0Ho<Q)_s1o@gUjO1nsr?9T8Vuz7~n`^bM>SCYw*}N>*5_0$_h;FK3vwpRE
zc<v5a|C^o7r8Q1fDlc4A-%4oBs$seuypF+m=NDZRq)dE4E?#Li>}6#4%U9N4brh$e
z(sLFHbDd>`!W0!0Ouq7>(sF0}lL@c-*kywn6^~&Hp5x~spPcsu3hYl6B?QA1KchO_
zWTe%}Qw5%Kh^4IXR`~H!i=|BP7V9lkrIIS-ss=8xgj0GoA##b1@l{i{UY^tIvLJ);
zdkH%LwYspX#{OWOFOg^xj`E*hZNmMTU1tX(_AsZLR)xmY7YZK4<$_Q3hq|fwad|hH
zYOrlxoB)jrgkGtK>IQeRztqG-Q;x3bTccByQb>=fU_@(reL9x7pFOI`CV^I=$jsHo
zY`THo!k=4V(Ll))W(%5(Hlo%gJ=Vs)P)39*OpQvCruT*^6B1OzgP`GG%i&a6#!*Ps
zqC#P+fusC^s->#b1b{|LHAsPq4Z5a0Xz-1FY0E{I*i2z1Bw2?@f~1XgRzh?Y4xu8t
zxn1T*G-OO7NI;-<fhYC$dC1QM=5bc9y;%Q~HUa{Y#@tX@tX&=7Efi7QH&AJo!bPEG
zPEPbZBn;H_DlwcYOOjvCabNZE<!md~g6CBj&ly*icyvW9Tad%`p}8c)C5~E7+--n<
z4U%u39DPXVe5X{qi%vpoz+;e>b$}$nxGhvpAWTX58Na1Y=}F>c2dIg&g@%4NR7W4m
zO7EO1-_u0kUSYE*;WI)R_l#P0{;kPnkB+jPJ+pTT0qfiPI!)n=FRgPL-}v1E=@>!!
z6mcM$8Ul++k2oo&5wirumvThBnN7vy>XKWHDb7^;KidCtK)~BwAlkn_NU0@p_x|6d
zfJzbUYE(Si{G@w}O|H6i4vn?w$IvHc@~7prSdv``c^`-}zN-7^#1~!Xo+n7Ha{Q)Y
zbHA~l{e01E-)}3~vkJmOlE`*P>YZl8V+!6L{&Za+Er%YdRhsVo)Hdp4BHlF4@g!b;
zkKr;J-ab8-RJKiHBi`##{xE~FoDTU!&2UaU`A~aV1;Zq!O_njd2fWpSd-7Ap!<XN}
z6>B><itc!S<LpgvKWT_+A~449AX{TTsgI&j4QCI>slBMu6&S(DYys+2McgYeYX39{
zy|C^^Dq>T&op`f}Q!VMD_zghFu8Y6LkCzI!WkJ;#me`(=67>)fFOSFlJZA9Vj#4U%
zX^kf$Ac!Og1Q>Ilv_-L-2_%K?PtM)qzE$+DO}<C<gj@kZ&iYjm&WepSgCtg}HHmyD
zZsPn=`lQ2+EqOghU4=71?F7$xLw=3sF#HJ-Ghn(c0kriIzxlNMdvTey(HxBzK}f|~
zvIR{w=L4uWViYp}oD=caVRt<ZHJB*qmK<^t?HJ96?0Qf{$-a`%@Q_WSrMld7gyXl-
zNkKf=j++Vt%0E?SM-h)vU>yvg5tQe|8)QYy-rfb}OYw@%X$|zCSl3BW1wJ)PP@e5o
zpHO-Ai%9cqk=iYZ;ETc$_X^u?!9zQ?BU+-Mw;jYm+}8pgz+J8#RMvmMzHj_-r*qT(
zWw9fY+3Ro7Cz5Fqp8%{5L?>C_E)B@nM{rtu2TRwL?l;QGgj8wo8rU6PYxmlDzZh|o
z29r>yM?_O)HtSGjcK%SfXBU5#SJArk^hb+ox$#a&FH@5J*QB=_UD9h2zHC%_uW>0L
zvu;WiidYk`hm*!g*Ic6`G)aT2*T9oiVL0R(WgzR_&dFtT{E?@KaYrwKhgHvAN)m3d
zWh0cb0R?F}GjbEh_^<GXB?#~R1VU4Lij_&_U@=No7vVIjWH~Er>{hO1%r1xTy#u4z
zftQ`2>{rE05#Dz8vTQrw3rp{?x}1PM-86CEorw`jxM)}5>!G`drXYyA{T51TI-wz~
zezynLcyenO`_&{z%?9DJLKMXBB8~ubBv_jvD7{|Xlt3$NCWI?mS>fX$;uCf7VZ^%^
zk2&pV2+s}~gVghwxZ#jgbj6_j>DD_ouTj~xSF0ZhdLt2|VTu~I&0Q=V#C!=`@Fp%p
z;3%A@sYBTl!F%RS@vYmZ=fmio1qg|YT?_YnYb%7!&oN@XxTDYtb@tuZ%g}PpbJa&U
zWbPQI!;xGFU^t;{J|q)`c2Xz{B)P2w+uu2*Y(BfjZ-C%D2;R$}IS@-?6`$i7v6LU=
z9LsnZkCtvRKZLn3{wJTW0-u&CaJc5`ia1VO<8SG>4gml%obB30gelXrK55QY$79Dk
zC05V#xYYY)_})?9Bg58vSIZZyof;>z56yb1`K^D+OwZgxTm23}3t0=^9G|+Ub#kw|
z%-nbA4I+*Kc<{!~s>Sk3>7;Da@ara|9!8UPtXd#EB3@XvT%VR_;@UJg`EgDUs%dVZ
ztEQ(i60Dig4NDU5mhC;!wMu>E7)}26`LWto-BJ7lel;MLOWyEvLZpJ&kRU>bssrHl
znbDrW{xH$ns+t~zP?dccV90))oJGx?(DP0#p(nYbTlDBJ-!-~OKJW8SpENu<<SUj(
zAKB<Dd0lK@$#&7Yt5HGZ4vomLkZ5PLq0<#Df|G=b4Mzbb)EE-1{w(Dd<6EIonv@mp
z+l~P--tJ)?&>)qD9ZuG@)L_QMu#f9H`=galJ|Axzh0OFYo^YY(;Gsb?GmKD4Mo!zN
zgP;Sc6w0DI8v@{*Zf0mUWnzonf=QboI$8wz7!maDqJRU@#o)D7?aRaA-&5gTq1Bp9
zZDB(%_I5>a<>iaYuUQI7k!=upm}R?i;+=?3UGnALme9J#Y8mp7K>?&aAUVMw9tQRQ
z)9zTfxjtw0?!orvWArXz{K~ejafH}#WQU>jZKS#jkCpg)^~I!3T?OATO3#T=u_3O#
z5yQ_$B4wj0JGiU%U5&3bq4L$Xwo?kxI@f~BZ`?nt(4s(Ud;RgxNCsm}R$l#gR6%J+
zer7k;g@6^5Q;y;LHrknghePE;0gwT<Ycq$x1EJRETowBG7_FX&HXb@TbR!@6sU|9-
zuLl=J8q**P;BCJ3=tO1H{l?45W8@}o{QS>A)Dg_yZ}iTvpltBf*Ge-0vl7jBVd3}Y
zRlW4^p!!*WWbezAVcuOmNgUNv;dj#9%Wh`i2iR)(x9CVbz0h1u-yFJL7rJSYXW?kE
zz-98Y3s$;a-pWy1$6GGS7fTTtZE&%eV_z=D7@rkB_^Va6OGvgkm*8LBg{7R1OR;jC
zd=-SlIIj=8*i2vLo6BK~8*bB+kuc3r;F+&+_o{zIjC%@pYe_b+&fJdwA*+xV4b>L4
zcPDW@4n@qDlEecL%y6ayWR~X7?hv#Kv@TbLP;e7KBY_fh<k%wizyeJS+jr`Y{&$R4
zuM%U`qY-{5cMylKxWzT7T%KFlf+wJ-8kWoCtj1Yjvlm|J$#G0l-dSN=U1cIR?|?@U
zg6O8U#1?g`W!=wtzM##t3>f}Ul1n%R3Rhd!U`9Ex$%F2s_9uz*hV4KP)CwD$fK4yk
z^iQwu8Q(vB1BGwmj*w)tCA~nHzHQF*om+I&sL<f%EiJLihWCozf+w^gFr(Hj1#DR0
zX?F;w`(-w?O~szmzS9WCrXz)DqP1xKtNT~Xyd8wGQE`J3!*ymEc+}-RlqG%*>sKOF
zS?Z8eFST8uVU$b?^S#Y71r?$^C$|UX!heO1bW$lHZg5qp{U-AMZBSS%B=?BV)Mc4N
zoilMBU8Qm*6-$<@6mXU$T3?MAIfvv1FMPk+(NR98Wo1Rj>>YL`oBgK{!8jnS$szwP
zVY==AlmP#Kw0d&NNL}Q@;~)QWNbQl-NnjJAR=Rj|*}mtK_Mz8c-D1kxEJ0ABc~5>=
z)MRG<W$<E{XT%InIj&mKaWOcV|7Abn`J$L-0?@0FL_^TP<%TIs_fh$MUEWhYe~rUX
zU5&^202zCx9z5Qzkc&<Z??l@$8`{Kx4&^=Mr*?T*SU(O)pY!Y&(ME&~yupF6EFVIP
zFpRAiTC-l^0NJUFsGcyD9vb9Jb+X5#uDmS`+EMCbIWGitt2Ky2v)T<AkecDwCDz!T
zWAs$(f-cu0W<z$6KNxZqMgkP?An>2E1jp~qfUoxIShrW!#X=fr$so+ffZi)k-M9{@
zb+@!$h}G?~PJVCB<WNeFa7I`mX9~?CzsjXvCxuek)!E>dq<fG$-qaFt4E`fdVAIJL
zG3gG#s#aVWe<iLogZZ8QHk-Yuil9xrzw%M%NSvx}!N0^-H*htHMqM-^P5~7+5Auzp
zkyHKaPnr7D=OWUkJyu@r(fJ%W(UvfQ<`HM#r*2H>w+>MOgyX)te^^>a4)Nw6U>&Wm
zQ2%&KMd6FM^%3O}Q3|P~u{uKzgq|HuuKcH-jq?q6w}PpYDJBt_U=A31BPBRro^Wn0
zG1BQ@#2sxwfV&AiFgA45aAq^ofq?{eXM-}5vmz`B@GKI+6P!S+f8scid<5V>>>@TF
zVMN0cq>+aNw(&J;!Y8p%kQw_V$3>OU9Z=UV{BED7RrX284RU9WfH+ow@<~=m9JO<D
zi^R*5&D?`PM?bh!o~<)YINSA%dI%(4j+q`!8oYE%2C<gYJuR{L;igA2|G6UMU3~+I
zxEbQ|?gshl029FbrxmMy-ak2xF82W!`y~ff(!%?TY4!P2JBoi3#P;B>XeX5^!sTtB
zzkfL1vfAt84F5xrxu>onxQHE!U*|8YZ*oy~H=F)3C9~&=`lfsL{FPZO2gJP6peS2m
zzqL-$d&%ZQbe63k@iP!(w&-th)fjsXUf{QNma$vC4iKSgXaF%F8{t7rcPkQ)ZiRPp
zHTfRzmR`NauO+B4FCt`rGk8dsnYV5_cg4WnKb3Dp?;A>v@s^$&-7(VN_<7>$e`*1!
zsk0T}MUv31AtER6xgvR>NqEu18sYhC{s?YbY6(JiV7i86e)lvD36|?aqL?l_;uFUr
z4rvv}sqT^xka+9Wx8h(@nF2iQs)yl;5FOGrJPMq0*i@j&?g6NsP#d#7PyPd9YyZW?
zfChvSgae?J0VDt}?}JZ~!3f|c#IQt%?ILOfPY^!^*0^w5=7~L>V%?6AAr-ygGwflr
z>6Ekb=(@8`>Fyhmtd7&9A;guftJk<iGyR57^li5wE$gw(5JKFlDf|-w7ic(7X_8o*
zhJ#a2oQkH3^P%{4qn5cJt`P;QjB~zv#ck(c`JrTB`wtGcK74~2rgYzs0n^cuMKbDg
zEvY}Ek<22zT?S<hA{45y&7)P|6<i5e7qWH&P;ZEU!w?m*Krsxo@fIrED}ox%T1khx
z-FzL`PKCOSTcez72wLLBIP#0CLW&?x?MZ$K<L7Z8WlfGpHZazs%9g{f{f9Ry0Y1mh
zdft=RU`La6DiBNdq|DRx7Q#UM@g7baQe8`~<^u(L0u!b~{?M#YCJ8%8q^cRIW^sVn
zU=V&-d#wx7)2KmkmdWM8d70-^hmCln9E`)yxcA^=<hX3BL-#XUXQf@I7H2J_$z>`1
ztm3!`Jpb}T{xoKU8apx|+mhl%J^LheP+;<>frd;ef^^MQb+XYp`!np729ROj;z0$J
zL1H-~V7VCAmv|X~SmA4#Yg}oAKfvPPVDaI?hBJ)#Vjk-xnM@#;^J=pE7m)DeyUmo%
z{$cFg@Zc_mqw-3>HJ@TPR7ot1P9Tg<&H}Kp2rga>^RAuB5n0?ZAWKvI|NB_-5;(d<
z45p3bp5J?<w<gGi`8<r7-6$M~Hu!;17a;4ICS*(R{HBr**x7%!lTr`k1nz5nl+AN}
zIi5fL=)=|^eVv<|n`L%Ot%E<|(4ZhQ_HD1<_1E+5yrY2)yqF+XNf&QuOxLU|?{~f&
zlr~H6waZ*mXvSP!%=(^t$koR1HF8)+<uX-8zI9LC&MKLycy@y|Td;?3TkJcwPz7C>
z{im<eGR~0Sw7i;$BdTraql4B5#4sIV1InY0Rb2;|p@V^Je3!mM)5Lu2bbjvoseXq3
z(oH)DrafnbF+#J^L&g$E5xHK$Fwn;M@dZ~pn85R|xAPaKU3f>uY~8DLWJK$~(w9^>
zoXJp;1u8Q|r<V^Ldnwoj;o3Zk?#fy5hAJ0pLiK+dOtuU4svJtA%njHHmwR@fJ296#
ztnLHQ@2mX5EBqUmT&wYXau^(JbjC*5C}VK(BRBu%GCyBd7*SLd8Bcjfh98R~<Q+AA
zz;#P%Mc{}NP$BF9yKpebDmRc%X(rPzcN;wzZJ^?!{J=G#y^Ez9+V}ESw$$T_B8$cd
z%ILw{D>cNf6HsGa3l}J8Xlv*z6{=(lOpSPhGYQ3xqx`2f2L)w(4~LhP#m}dUG!h5J
z79Oq{=*i?E#O+rhgZCy=;_qUlGuZt>`Q<p6v{mJ5Yfp6l&e`o?xLCH`oXKRszL4Z<
z!|wd8><wW4B6fZ;SN7K-3G4N-g)Kb~YvuJ;;`OT*4p(p6?&g)<^0-cEjMNaEF?%48
zJ+(freS`Yuka|;gj>!=S^~jPM=8#y4_%0Fn+pQ|~>SM^{H;HE@m};tmMX7Gghz5re
zdQc5B@v@Mr#s0Rd2;W}>|NVJ00l>8UGDTl)vZU9h|L*{{WFWx0f9aPTkFNqeTxz11
z1GBo|r7tu~@@+PQmp4ul-DTz#y>6;xIIgFR+!u}y17z~CV`eh>IVt0b!5ib*Vg}jn
zc}+JhgC-`D7n8qpCEgY>HTJhIYT1_sz0pJJYX*Q~>dbVDX7Ox!Lf7hKEfKy2^YA-l
zSl&`W53EJ&sRb%qwuyNKmsw=VK0;{PnDnb$uc{1X>o#$z7tC?l9+VUZQc}tXUqov~
zgC*%!>Goxw>6SVBAnK1ZLoPF`sNCs}ys5KkF8Ud>shXa3!tv25a_8P3|FkFby;w5i
zsqHUb@^o1&9A``e?^0zaxCk$kH|i~=dhOXvSva{YRoJ$F4Tsql_Wx;Z4rQkW=BC$q
zBc5<x>l7RCAl810!v$<VE9<roA^yDNd_N2#5sPU0-18C;w7_czN;JP+DKmoWr(=3C
zQQWLW70dkjmAwEHlsuX-|9sVPgA0ZJ)47%sI&<OmTPC-byK+>@(wQ4H+gN-_-h!xJ
z+l{2-=YUCCWs~eqH{IK4hf~bC%2hJMX2ymRWa|(Jhh~dibk3~r%lPY=a_mf#eBZ1o
zV)SMT*V9GK&2rjPjycfB$o(W^9mnDN!4AP-17DU+SJBDAi17_^4~060lV{+`U-duD
zcGDioAPyIwucijHSyo01Qq7h!SHhWxr>t*It@9T%R!ef5$l#dOp2VhgIQC#hF4%u|
z$Q=WBcL~OHhXe+*CR6@(aoEN7{<Iut5xXIK_d}uhmrXMqr(m;=Z&}sKW&g#sqPUXA
z8?T#ZC1}JG7t1j>RLY>V%z(Y&9BP9)yD2$#zm(EhS0R`wb`%>Oa#B^!H1+r&q539|
z6p2}w*gW_9ScQI0kQu9*Z<OiW!s`0J_uIB>(v#Nov+nPY|HSv389>=1Yg(|7`{zS=
z1h3f?oBr7I6w{8&r;8^AgE#W7w=R-puQ{@BcExU9qe5Cwe`XH{ogNMTcAT&CvwJvX
zXrX&oI;Bb`4$)STTJd5$$ZVFk3DufADKsuuo3Fq(Z@neLFzmO#p>INWy{K~4&^r|G
zq%l<OXFnF=aJ&m|Qs}PFjlXB)KIn@^idxi(1-{V}&_@PHMH^7jZPFoR-Y;<r=0-LS
z;_2;dY9uC7S(AZQ36vIe?Z5==GV+KvwQ>pj?USz*?kP#WQw%|t;QbLtRAM~&P&z^?
z1d~2-u1$_c-39grO$kEvNgDlPV`LKrR#uAF8ts*V_O1`P^jqU8Wz-<?2HE~Da-(;9
z#ezXD)k`F0fnQ>&Nb)<0>18A;xj=C$!5l?Y3bn4BHksvFyH#ObnD^4zWE~T8$=yBX
zT~W6rlDqGpznAD!!wy+qJm*AxgTGfowF4VnD!a=3+T>9(3KbX0gSRi9lk87lyk3Ya
zjt+8;Wru!rmKliAP<e4nbm47>PPXR7s|coG#Dfbb`sW)9a{j2O+rNH_1RupH<>Zd@
zy_7k6vfJII*2=Us^oy4DDo}BY?a<hE_}75tQktyfQS8rB=VRnibdW@f&(izEmN^sn
zdj;WBd6*+8H9(z%xe~qQVdPZxy^j_A=3zS_qjUNqJUYH6o>u9Wb*E0wBvW>t65MuJ
z6niA$Eh#$nQ~wj-;U|D$UK>WPRkC^86+M5x`&H-4C%8LS_68M#Dc?RX7IVAKzrnW3
zhTP=&xVtIeG@uT;>Nv3c2lgTv|9hkS*Mq-J{%#Vc{5f!noVO`b4fxdX;*nd$|3}%I
zhb5Wr|Kl^&<k+I6mKrLhsFkLvBknk5YUDQMOzxWEQUPwbWFk&k83~eDZm3LIS(6)@
znj4x6YAWQC;=W*@xgsv0s9!wuIp=fcobx&J`&}1*JUl$t!*$>9_kG{*?e%)QsG%Z9
z$Y)jKgX{n{uM~eMS8J~6XMbD{|H+YdD_be(cgm@Nfc=ba@h?b@gbc~F_)fh)4)n3q
z24dqp2>MOC6&}GyR!^3?5;HPG9--o?GO!k#-?S5`s{5frza<jJ_+5a-0RXKsv14kY
z1QQ>!PyT+v6jqVd@<>q@D`a-Qav+^2gYOsS*m05q2oillY)91C;jL@Q7z`F)i0~WX
zkNxyc_3DzZM|?-iqr^oWEturQZCW=YJG|-D!5{fA>=e!ModG!Bla?2WUSRB}X=7A6
zq!{~4mSM=a&4ex46&S;+e5q}`LcmS6$NWeu#gut;PiNS}Sheq4jNfssDH1sin?@fQ
zyW;txOxy3%Y-u+a^8tR^dHOTlj8V08B%1NQ2diz|Lpx2;fUI?2H`ruOOP1#);5rL6
z<taG?JhMIX0t9lVnZ9o$XGemU#x97r1N9@p%%Oqm@t4~D!oqE?xdC~jUe;iHVcP&%
z6t&RMy_dx4sNFxh<(#p}JHX%xFDMpJc1*bc@-Yn9vlR68Yw1C-LjaZ$Eb4eSa|&yw
zdIa1TNn9GqJ)whkqHK>vSdITC?k(<*4F*_&R6>g^a?7D7rMjUA0yH5c?$-!N*Hi4-
z2M6O(_iIWGlJc4!H*T9Qu1bn;>qL=3rW=UG6RQV1>09r0PUtK)q`5a+8}}cIMIVCC
zszDvJ0Py1eUy-X*IJEGZgSiPM+$2xs&D0C8Jg&wgfpitUIj)+IQ{0~(kXHr0cFG{J
zf5sHzJNy{$;9YPgl-^(OXj=7@-{54;kEc)uuC$aSg$#HQ;;F&Uti5{UAnOWTuh>~E
zp<_xV6|YWTd5g@%+M-)Bu%2b1wT%zJ9P7(dA6>nZ9oRk<S6lJ-H(Nk^b%l{NWr4Up
z;C3tic2;f>&OEcj`Vr+4I#Owio_b%Rxy8U(*<_tq*87Kn5kRV&Bg9of9Oz}uD+Pa(
z*WcFNj^O_7Ll?V)qI~ejUXi+Gy9ekemF5Y(f#oov`F2Fp)pu~4U1$V>0hYKBKpaj=
zz^#@}Zd}n?g6k{Jp8U#x!qdqPL4(^GuZBI=QM(_TWM|TkAU+%_#*Zjq$++F5ck)1T
z&dlqZWlZrLo!)jY1Yyh9-YTl{N>}zwT<`ed!R4j4@LtkPXBkg*gK3}@^70JWorA_X
z0ICv~2}qV9C#fUjQ;Pls+C?g1b&7zaGLOY{0b{M?i^nJ2y@XhLLk|TimI&^9{gin%
z7hhe9uyA4Db68i*p}MqASo_#(R+fynRIEOENe%8SWR%vwk{aeUO;|5msr5DDYEwt|
zhu3KSSB?B9W!-N#<{nt2qXIpy%^>)cP1!%ct-T5T(FUOb{h4z+FcSj`F;i={-du0K
zr5l)krm_XMNmrb9@VdFwMn&wE^RrT<y}0f$dXkI@Up7&fR<aSe6P9QS*4Q(Zk)%|n
zDnOnC-@>ocj1&fQg3L=pM$XswUJvTYSF|aXh)MD)(b&5=xm=~R!qs5CGeIc3&}GwG
z@EnR=p$f~YCJE|>{!}n&ym>RG|M5|yh-MT^*@SFsZZ+B!k#^hHG7@|jkGW8b@yi7E
z-N@D84D>z1STDa-?7V^7a*sbZV7=KX?E&+e{Cp}2rC4*rMzQ~Yw22e<E8*23u$<E{
ze%s}rOxS-mXa9c9xmR};fFR~Qy=Axb3#oDT^Bd~Men$!W<CSY~z1;*g%WAY5-!9qy
z#g<Z0B9SwlFv~m|({{UuGK<REx?H~Mo~z`SHTu@qeOdcUB%I*Bo})eot8pV!s#fqU
z$xz7GM8ca?a5tTPi|QX~6k*3cj--$>vbdRa_l1|ScK!&!iq?we7aAr87Q5aB{%Ysu
z+XJhe(NFhtD{v&-o-#qmuUMs)`EAr7hToc3IyTcnhpsz~GR;>l88u&rX)j`W9Qp$1
z){48g{@A5hYQY<83j&R!xrOhlYrYM?q0iv@MHl{Yj{W;$`p2Cz^`g&vNtbIb<du8g
z+Mt!foecV3@v;=b4zXFSCu6hesZf6^0ZBa4HuJJwF37hTWIeEY%-}0?2HjJYI&>XX
z8=>c43%1&jHz~_vSI8*{U1=rNN`e<bM)R*H04v&pyp_4Wz{%$-mEBZa2!b%{ti6Kk
zV+jn^jJsnCXIk*aG+y)yp;*j}K#(`5cB&!YSjW;rSW&)_Z><%5BLF64+Rd}Cq6b%5
zT~+zOr++xtOwzB6dm9V2u_*FrQ?5$TucR_7``s~S<0Gs=x4)3RYLVHU-N+&??bvqF
zc3yxP98zE(Yc>O1d#ZN5oO~|<>@)Oz5fTwEU*+Yt=9*&zOzGPwMafn0Z}pT-C(JkS
zBYSB|M{;wzP?_jN*j7YBbonX^S6KPST+iFpkyOZ=vjGgiP@zX{nW!_Z7G{P`SBoUU
zUu`!2*}M9?I{vS}_0ukE+p!-3h(u;Q>dm|%afl<;_+8lga|Y7D&b`iZ@bMp#(>n6)
zMu3p23+$$4kcKa#-mq&w{CA@xQ{v8BF`XF=M`7F+i(n1`8Uzk8O$C$5CBLgJNS=QO
z`-e*GTwIIY6F6L1u~SA^9W{YfXRFl4F9e0X{L@4KwndA6l{i24Q&16w!hVyRJ@7hc
zs9I;Rwm5ynX7mqB{T~Ak*4$HF#HQhM!3MdbAA;;j$Ur;N=#koZld7p87AbCy@ZV0~
zo$!kHF1MNwYK6~%qgPPf@afH*t!2s0VRux0i4*Fd=QH)muXb~ojqI&RKjYDg%vg2F
z$K1%(ccof?wVN`te~m?%_W%&Rwj;&eH1g-Nf3@TOyOk&UweGv)MV|o(tskooKKl<x
z+JB$TGUZPP!EWQf2mjfN`RhORQwioD1Up4M9?qa1y}5P!wO}cN<(Jcc>rcDE*o*Hc
z*A|nDolO3Dw*JF)FjidQb{syouU2<+q4#HpXhcLoW$oUFDSwiXA$S+7aLB0u=hW<9
z{OC{r^zV8y)+J@Qyq9ESQ*bBsFURxe2i*7V8oq`)^{V3Bf7kbamzBbk9}SoaPu!dT
zC5-X!PyWlD|NNJtyH44OOTGDS4qnT7e<j_qpY{|0Z-$Ab)@ki2aPM!O$6>Qd%RC;G
zSL{i|)eTg-!A*4Ie))Nq#-6+iQ%O|zZOdvq)!@lJOG8zu6M5aytyz6r`Vz9I{3-1^
z1wy5Wt84^Pq8D9tkym`wYf#JJ&X5?(*b81Y^yJtk^pLY#Bplg1XM>>8Zw0-`Uujak
zwx!20a)=4Z3G@xX)-B1uBL%tSR;`fNRz+_$W0!yf;HaWy3aS{?HIra<eC@;g-o61X
z*C9M-_VE9_E$V;X7B153R_Up|q~rk1Da``2NzsGf;r2%TzNfc$*mdxYu?uTQi-Ozt
ztPc%->n_n;{b}_X6;&j8@kqtup5FPm(z5-M&%ez!zEc`r-WxHLnEjxGmH1{|q%(BM
zJCL{t_U{Vzu^kZ-_OTLQKTJzIS4s8`*pGJK4(=4s%daXeW3hvefe9wBzG~k|`0+Qd
z!{LYhDLVfmv%mbR0JsxaWCVWqi~C<47ysC^{<sJ}{Qa`VbFF&K><@BFHNUcE+Ik1*
zzs-bC-~D5vWHo0WIPSbN@^A}kp@8-@fs2ZMxiMsrAM$=mhg=GEBgN?hO|;=Z4@6x4
zei9<rCvY9K#FmF-dhCMF1m@4ZS9#dcNxv0~oBJb@oTFB>dcd_Lq?2p|SJ1lM4(FjW
zkRoZZ9XNjYOM_bb{x18ITySCu^f){*GPmZawbyz0@+stwCu^Vb<ERKaQw`7mD=q!U
zN*%);Hf#ep(~E-w5XWZh#T7K}P(QGpxt^Y1;F5yUvNoI7No1Kn1bAhu$9`vv%G`Sg
zvKH|=wc$n{wF(&_G0*ON+XlTh2XTg1WriJFflB?4B6Z(jn$D;FUMup>gomc|t_Ku+
z9AEB3aK@H7zbR!x?v!p^%b!~|%NLW)`eS7TO5}R;-ot+1l6wFBp7p(?gtH0w|G)d`
z81wtExDLv*{E0tpTmNJ=|6lhLejIx&QZhfEvx>jFm4lrE$)0=8;>Uyc6gVGnl=t!~
z>y0qfQ1sZfrdCuo-#aj$|3>O>`cD;~>@RncVR2SHLpc>et>e`+)9v5GH`elbKLBmE
z;8b#-kxRl$q-xRM*IO^GEPqcT@sB}YBEc(t^kP^wNoBpMaX)glLfd&RxKM$DE03$2
z$54%LJH#7sCtn>TZf5|qlJ!p`t1j*d1>)c_`E$xmL(X)yZ)XDC<Eu^arE;Wa@0L%^
z{h<pxhHr{N@r;I3E^JBAyIfll8{pN{YIPYNkXSchfytk1H}Z_v+Vd^rd0u%>6sE#{
z@c#E@=Q3?}x#YabZ_VpO$^VoEk=?UCJDC0|q2a^A7$+!lqiH-=D{#X&%1S(MSPYH~
z=-I3czw`Yc%T+?~141d%_H%9QE;z5Yw=5R_RP)Z9cv#2WS&jI)KKkXvliN8jTs$~W
z>jq+qdLukpZ$~-tf6T)CL;D7HNb}E|s=*`T@3qU<AH5c}KnheiMGqPdKNFHQ@;}D^
zKhCXY%dy`4=}7L@e2n|8x8;AK@$<?%=I>jlLVB!sP(WhsJ0Jn>RA~2TbARmi(`~K#
znm_A@irUy3H*2&qmptr;Y7Be(S3YYt^xE5l;0K%;%^ne4EC#hn-2gk~iV!me9;A)z
z8_)mM8nm{oTNqy(jooIimx{(Py%>GVOFsJNu(!E?F^*nwM9l~PEqMQ6tZMXV%vw;k
z{w8ZnL}pg?!9QyOi!dhoRyg$&+H1lxeYfA!?Yri^5n12Sc5K^t?1E;ZM?z5koaQ<v
zJ?5)|nc0TjL-UU30irqGP!C@D`m_T@-Wa-3vJn%RNWBocEj;~K?v>byooNN_+I%|O
zK{DWUsEmkYnnSD2tZ8p`q`=~y@(?oORjg~$Zi0P<U(P=Swyl<gDq0E0XKpz=abAKF
zdvZpxHxMR|P^jz)wEJ#2=ECap9vDt8!5mIoac()Cp5V8Aa*)STKU?riuda4;kihqh
zZ<b3eE2<Y(4fQH;ORd9*PmajXY$oOpMX3e*p*Gj)gDQo#B&4aML3eX@_!vuzOo%DV
z<QNq!{6l&E<3#|zZY9p}$%XM9tXc<*5aY*dbRsiNxA?4*-`kcY1>mleQtKw-_^dr&
zS7!P+cHsVdKj=aSO&7n9O-uelQ~H|R=&6Pxd|H0?vv)%?=&qCnIx;5v65E)IqbOP{
zsE`2$f$eHtwA4kr!4Q71t8qid=3;Ne)xPx`A;$0sy`bI~sCeF&YRmaNfmiH~(Kx1g
zXmLnbFH1Gt-rD>;y|$>HeQQGV{V%}(Zc$zuJ1@<=8P}mZF0%U_?6-g0o@BH0Nu=ED
z+c)>BLT?{V7O+kqQaS3y)AuTg+TxLGKa6X52|i{{ehP539C=Q$RnV4Cye)~c*RGP_
zK(D?<VdOTObyCPK8eDT~bI|4h{iaLt7r2j(Y@5LRt09xnkypX|z8p~v-LQNuUG98#
ztFmyTvZF-g9|=5#J8%z*Kyo{!#PT?t=)^v|R=%1y`i^{tF=Hn#It}O3Q`)TSs?7zH
z(%q<K8jT}#EH~))gh=7v|HX2!Pu$t%Caw}+m_V~meJE^DdnkCi+%5QyvGQ<3#E8<%
zeyJTZ&9>CO-N_c=3ftL^<n^A+v-YF=Js0mzf8Oj9MF@vDV6UyE)PS(}MiK8j?5tN=
z@Y+?l0b<FfYv37^&)dm+L>3U*#}1z&{#>pzVI+c@p|8E-+stZXxCx}4I#Rt772Qb0
zO<Gip2zhA`M3o|ydTX^u&69E>cIlxOE_&P4clalZGV!7=9~+b?Vz~3~DD8pS)g8bm
zFT)(_brWu~D{8C%oAB+;wb6>TEO?2F9wUG52dCTGyP5?D2HNJKt65<<b!3o1N<}Vh
z%T%SgEZggcUEot}*?HkEOs5aR^grtK|K1EP`yNsH!9TsIA_B?5pX#2^=qMcwN;r;M
z`TDM(O*daB=l?1>gTIh+@ZipfYoj{go_awN6fDhuZw%OxIlJ`9Lb4;~Z-WSuNiy_Y
za^tCDi#J;mS+&z7>J8ploFtv3xupMX7<24{IWk}lujI4BP72y63mV)(x(=DHRWOE!
zB1dEN)Ja6h7MC#Ee@$8o*4`Yh<hGH%Ti2+)hPRVm8>yaD)lTob*Kvk5n57H=h~e)j
z-M0fspG7xmc<K!HB(g+(3(9ut3n>D^Heb>%@(4?Erom&M17Ddt*yua=aCp5;XZONT
z&>-zS?fya2>7}yM?SzuW51FTVZsLKpiU>CnoPv1EIyq@=t_!@mwo#65D@RaQ+-k#N
zj;>(lwOJ}f=cf}k%^^?uVG7{qDBs71y#rl+>tW(~9UaAIX8fm58TplOy%b*dh_;Hl
zN+FGYYc*`M-As+n0!G?yaPc@fvq3XiGj&=qP%%enX+p+GSMaJ@EEDp%e_^rKx%};@
z0^vZ0nGV~vi+;A6ShpolT@gG1!>vx57>@^z2zLOSnM{Yf&3gd=>nqP;)e>#*-lQUF
zUp|rTOzAm}9onQ*pqEJ7XVwz~B=72BmD`_vk8nD53~bFq6{F@RktgK_m1{?hVXE6t
zm?@gkpWk|xQgm7>@IQL->t)#oZTmqwAFUaAzMmR`Vme7WXyC@XD!Nr#QQa>aSHSD<
z7IGgq53)6Q+ah$#D*Zuf^z=gqZd{Gdt9A?F!=NNy88GOwRKiL?GC>Ec!@2@6Pto62
zPQGpD-xG3$gY`h--OQ;4b4k`p{if?vIlMj#7l(D!J<EayBa)xgpmTsdbsRwT9;suE
z6nnS2g{HVq59dFAnQ9wm<!Lq|8@9N)B7*a12E`5SAi7Oh6NNf-R1Hp@`iX%-zzGWj
zxEu{e%G3#iuMsh6^;h=+z};!(PSmBRyv>P`$i`O#X*fsq#H7@Sb!AbgH)X3-Du$8{
zH(qtLG6LfW+F@2ek0d*@vN?YZO!re%F}*t_;<h5I6onN2l%iX;k}R1lN|<b4GgxOW
zWQcE__Eq4*`|bU4$Z||5{Qi8%0h56VSlC;Yw~UpRh#n+9k(H@I)1VE$Hu?IjjWhC|
z+REYGP%_+nsMW{)>@Q6+M!t&?a+^5;&ql?ka#b+a&1Eas^(uQV6=ap<z6heGVKkd(
z7>D;J$*=fT59qP{w4?il{a+)q2$<!Zl93j`LU7hyhXKa`dW&z~ZQrL{+J!{hNvVJ^
zOD&dtPWJO!-qOXb#qdYL5nnX<k;iOriqiQ1@BsePMPl5}wrV97K|Ba+Ycg{PJ%7b=
z$xW)wO%^nOEa2*!LaD!9+bv-<mk5FpPj=@bZRv961D)hTo98HXmtsfjl<J1k@+TL6
zvY|sSaL*+n5@Px&<L*@|#_#g`J29Vh2a-*H4z8=Sk^!6}9ukW1D!S@&f?x5q^&IjH
z|0({P<;I|5pF~W|sR1kC6m*wf<#ToLR9o6R%h5pnsP*=AJ0LAR8p*XG#cfUflH3~3
zj-z%G^kd)2$B))-4%T)A2_IjN8M`CK78pPP1<zxbW8Xc!SG2`E);DT6|BlgAADPK3
zI}RVUl4%#z;3APqjfZL8Z#s-N*#~7wFA=ZXtYmTcwj>>dv2M0RU;5~>JjYa(_uEyp
z$3P^yIdVvl@uCp3^0uTJ0~5&fPesn5GfVi->_wVw#4wx4$YzEprsGCmB@RzLlimNF
zBk7wa<;z<l>Y_1v$s^$uIqe8cv6Ga6PBWGyzeG>^`<1VJaR+W&Wlay}gZ-EFSPj~J
zlQQAXyuNb}Y9H|yp>DzxB-HI?Z5P~Dqgs|k-wjwo0WQ+s%ePC(NEEoHmc_{!^QAq)
zie#0z=W2PEvu)R5CYuE+WXNsl==B^6px_-LoOYv)&%`f$ebWAmFaHOshvmi<1~GSw
z|Adh+1zaIYTg+Nt-P}Q8@)lJ4uLI<7Po14FQl&12Yo-@26JqG4$(K`LrGB2ux$IgU
z2~KtbX03R<lcxlmqxqwSzd4fQ3YIyyXZsAw0=7^Nja1{Zo`9SoYGJP2X5q`f(6~!u
zd~t<aaUI;M2(aeG-$6H2xI|FOK~3NWvzc8^1C7&R;(<ZkMRzWA*#KPtKTd^Yy>M3U
zDR=?yO~N0W9Y7Eds>`c~JP852@NX+1iG9Lr8YI(q))1JF`nu{9=Fhy#K3-XqKMNB!
zMRi2}3TESvI}S6M3X?O}Cd{M63z=Yg>42dz|MfxXP@l7bxTM&TlNJ%UZ)Gio#E5-n
za=$m6#xQnm2=AC=h544m!y$`F2Qk{=@zUnghg7y(ummrmXF?JrNTZH`gEtBLua)=`
zf3iwMTx%*jFG;$DCTY{_2#v6;jhmYAdM8T%qMF2J(ue(y6k{5H(WL;;m&9;|i2>%=
zjhk}{0ZX0F&hS1;xRjQ)6sJqM^!er=UeXp7Nwf8RCHS*%pFAg>sl<gp=H&WNb=L}X
ze(PTEw)f&s^;rc?ys!ZPr<LE{`+^Rs1BN}coLf{_d8G>JKeQ-<nr}%|omE8g95oG%
zWVV`|G+R#kd=Jnu>I%eRkna=MUPkLR@i!Y4<@G%zIJ5VFS=@v0vT05<t?KG>;cz@w
zlo!+ko9YI2TG(T2mKWa5=NZ7JA40Z#3Wp6L@HUhx)vCEHe0CD@vqsc>ah8+|WHDaT
zQ>D8FM|Cat&Z>}H$kSl8n`N=vj>)JDueZe8y${fIlQ$^V3DlgN`psrMH7=W<AF+5x
zvz8LvVMV)L#?xW>Sl2cfHj4-+geGuxax|?ma>bkdSW9&#an4khGL|E!<2KOhOp#CK
zzf0)n7kR5Jy*G4^mWW<uZ?yy%xFNd6hwg|O!KQQFItvyX6p}iId^2@~-31SmO#wc>
z%@scFE++#T5=wr24*9E-nY$AVi_uLPOS+!)DODlmamfd({EP1%CuJt_FPpSnN*lbW
ze2S&<cxzK+*wJaJAYxD0MWJ9nvN_Fg`N)q^HV4gon<wq*pJ^0zoq)Le_a5)L?CaxL
z{E>9aeIp^bti-6<85;!fqTTC)gqT@qV#b>jCsPfaLFp?Z(yi<E?`?j?I^@kZJI$&d
zYUnl$o#6dqJE>xFEZ50a${#HPHxtBY>r9#4^14QUXME*+c(z>fH<LLA<g{3%RE+mW
z$t|9dPO^czP*)9Q)hl#1kT+Q83?+qo&rg38@}i$ODC~d|0!)Ymu;DF}UrXE6-DAv>
zT(597kA%3g*uA&wXrvc><D((Y25D+n`yN%aRDQr}TJ;)ZoSEPF3>W1%my4`zn*e!~
z|L&)PMlEzHucK0zz|IQfS&bOmoKLrpVLvj1Ek=H7E;CsE)EvaC%f?@zhm0jtX8G%<
z!Bao;m3J!ng2>29>qZ5y{%{A%34bu|i&rlRgj(*nRL=j9NRcROza!TlqGewej1kc+
zKsK5JOotQJW!ApkuIBD@WKFZ(grJ0YV#XPiy44apJ#fYY81vqnJ$Iq^CuaMjGX4px
zynJg)SMycon~vOyvt+>~gH^tUnhwp&7)J?gcj>kB=}rxhBlX4^eCwxjZoMO)KMWA;
zGxCn2;?_)3Afz5PO%5WrRw!bR;h_<CV84XnF6S9O938@TR<1^6$ekMBZLTORf3Ome
z-A-nR%3Ho0Y6{F0=u1R?#~T8^e;;{PX06$LiyKAFtHre$v&a-CzkR|ai}{{oMP@ch
zSgd<!uyxh~drKoI&IZCT;4NB}_Eep<<^Z#0;n+Z<1MRksrvmM5>Bd(}%HuE5*^Y<@
zSv+I{B`twqMlFU7a~T19v$JzxIuiTWvZ4(S2m<W+0b51bQGS5dB6zRkX0K4gllv%Y
zq(8Kff>+OCat{N8Xe?<UUezKMQjIIw!m(7ghjP=B0~|AHl!m@3lLKu@4vfEu_Wv!e
zD=Khle+o({w#~erszAJz^dxGz)0*R(y$3ggOZvWx{aE3417PH=`WMj4smHVHi}B{w
zf-y03Lo&en>XMZdXQ#$5xkKvL0hx7G9xi%xW5htccp~6tD5Xs-zVYdc;>IgdF?9T4
zGU&)Q^QkTIbsJ5B1=5HKPjI~(+<LEL^C+x8YUQn0O;oFmr|!n-Q<_F<y}@5dED^y-
zUuG~Yl|l3-F7g+X4rr|l;u9{UgQlj`YiJkuUSdLDsA5mK-1ICWUOQ59A>#dl0hoG{
z4}1M8*#m1T?jRIA;O$WB7<qRnd9@}a5kv%|pU`q~qSmRkqav!sQTgUql$)$96MlAM
z0hgFPoj^u^UagxPjgy2J&eS#PE1@YPN?E<{4H}ASY}2|zj#(Z+hiLn61t(=53347g
zE)kk`i8cY3AR4BAisg^Ta}Mq?yid?^$u+!@Yok2+;M9EyfNq{i>(z+<AA)?DljQK<
zirTE#itvZ#JKFcN(<4#V1i4b1RbmOo)MP|NhC*M>i^f#Mdu<H#(P!G%37+75#kGM*
z3@37=|2OZLX02gw3-hXp;D^&9Faf8XW^8udd%wvVwXmlCmnAnedp{6!j|@i_`Sdxj
z9ePE3<TNDe<!i*a0)NWb=iv)tB7Zm=GyzCn%-+9zvs^-k7xkF9aw4&>nyt^%8_O3_
zPMCV3dlts3D$W-Ayfd=s<fQv+nX-!N&xG9aPm2V2EVZAd9c#42`80pi*RE}{Oo2CC
z$!5{GM;rhq%n$;nKOnp1S`OYG*8lU=sKW_^L?~{)3Gw7%A$v?jKd>!SD5IAswTvrU
zX$tg48p2$+(cwYq7VzB`B<mQei=*=`8ijStK<D(pbkk!c+x8sJ{Sc;Hd_$Y(YH_~-
z7{|^0*)5mm)8VwHxH+LdGlbqS)hA3I;c}uZ)^fTPTvH*|{5PX9$V_g(ZyaHz!=a4N
z{wcI}>`PrE%KiX0>gdptnAhT>dr2Zn`_X;RRbbR)Qj|r4KB*$WN^?>$g9%dvuMbP^
z@L0?bv{*jKGx~uc>H?h^o^=pBFFv#+|D%Mt?hdyeJA%<9s)Alv6Q`z$YyfA<NZ$4i
zD+kE|vy{wpkA4NasQ|zpX8bu5_veu1A5rZ#>)!x~)ifT+Q1uOn0YZSTfqI1cF^?J(
zlwDK~s~mnhnQ@P~Q|4-<qdKlmQSqKC{B5(e>_SBd@w}uhK*3Y+(TOg8y;TirHz$RW
zs+Wo+61J4xuABlhZRBGfKYZbJc(;+xn<f?Ums#61r~=o?C#g{C#$+ki37VJFQ2`?W
zlfES2^`xE=A4$c{Ui!x8QslCY=QvE0&9p&}bIZzWkRun5_cuEL!bU{AP=O;`tK|&L
zrTQi{H$x)yyj@pfAk-+LJ$<qY1lXV%PqgX2o9cypyq>$?Eq>354ev*}jb+Xtf5A1=
z*pB-Z4!DI|%_i&$aC3Sr)|VIPiARm4hJOTN{oI3n3}!Sizjsu0cunGd>EUzl6Qn-f
zf<lagm04#Ysw|en03j#wAjbUcu!g9Ab1(ZOhNr4~6VZ6?s3bQ%00q-}XVb-ofMB=_
zRrlT*{0yDVkR4K`4U2`5+(M-a3Xbr|8$E`oAP<fC=$YXMYBM-H2p~b*Wj!B=jevV1
zB+3M~iDs}PRAP>WJKGrEtuXHGL19&#BY;B&CMO_8BgN^DBtj~3gT+Z)7X!cuhY$>1
z8b;Yn3?FN%7rHntyLF>c7azD)`RMfd>U^N79Wa&=kB$L9ddTgZ#(*VcVXYOk-Ur`Q
zA}`e)b^>VdQ&#NM$qk=Yz~8}EP0d5vOP+d!TtiYtU;vl9in{EU%DTa!TUK3`@thRS
zcfh787x{v)rO|2vqhNVPkHK_(8@70VI8TEy-dDS|qNm45XVytr!-6NAX!EoSwe=YE
zCp9bE#;J54#Q~XSbx4LZ@1#A|H68&-NJSMhPY=KvT%X6;>#ny1n0@*(f|5)=lH-hU
z4gn?^q+~v4(Dn(38<_9c^7J+HREtGxT%CIDYsIwQfawIhVCryOMK0^kbUKVWG!wRH
z#=8h~VYTNPwnSfzE_kSo;NSFYJbsj+w}uRhwwKdZT9b}JD25^9@li541Fz&lidwDL
zo^g=u^JlDhL0Re13PTJ0G=~{Sz^LG~QV3U35_OKQ;B1~PKLIr{S`PvDx<Bl82e1Th
zvvAB6lK`h@BuI>e5dWoWpyp=sn-!21#5wno;FA_DuepLHgPBF|LV}&t2GKW8{U5~y
z&gze2RW2<o8UHQ$vg2J}(-!5gOT-kh`=CH<Mzx=1u~q2B`qO^4*Drnp?YcN|Q6{S4
z{)@C11WFiG4f^}d<QAO~!#N_77%}2}O~H(~PP79jUHlnZeT>r(t64CeYcpZJ)MDtj
z+-X!JbrJpeBvFV7yYy3XYK#4uHy40jAh}eq^+t47iHP{Y?fs=ZXdtu;>YF4lsr%@~
zYtWlCP;WKm?lu}4YJ2x60Bb33jy0$(K5@>rpnuis8<MW5pz@RK)#xV5EFkI=;f+AV
zK)vhA`4mrHhqk_XM+pV%gqC{ei!Vt!9^-RdJL(kWhU2aZkhY37xzxJX-4EHs;XgX4
z<SYk2W7E||x}fY5Br#T)#=O#wrB3NWEC+98tv2*5Hyt$-F6!I$?#U*0Iuju2Hmp44
z7AL#-%?T`A+~t7Y0v7;S!|#qX6#*k~jYay>vAFP)G#*~NH|2R5<cL1oh)<(t99*mR
zK{9QX!3;^`yvvpSa+0tP1G2OOJ6>yU-UBv`x<Jr>gg0KZ$aW0F+GwIpuZyd*1gib`
zH~9U%y2IH>pGi0NPq^8)t+!Xz`jM<>oTr%eqU6Q3%=!cd#hP9keMgIOv&4T1d}uCh
zks&Bkh47j;{R`Un$8s6#6l`OqYMg<@qmXrlS=e~`xy0<D4MUI>+%aU^bucW=goT=7
z2w~R_RJ4n4`t;JQZ!_yv;q+Tgrt-3oPMt`5^Uy5JoJ#;@x}Po28F+AiQ9WRUxrQk5
z%xd<}&g~T|L&!C#dH5<~FO!wQD5QHfYT|GXzx^D9G4;&tgEH$~JRZzKZ{gN18y0)-
z#&4wNan|^PiT?FCbAB8Oo&9Z?M)sL>>n&!_+SFV*WvbgB<(v(m`FXbAfNTdh(DZ>N
z=N=uLqxsptQ+#nP5Yl)Z)7X4;@4RIMe>x)%&Kr~Wo6ir~N{=NA!X9?=XaJZgq2(BC
z4nTN`Sr=mN9Z4~yNFSYO^Ul*B#{>`*D`oVJB79632Q~*9FVYvHFxns4K7Hurepvp}
z{h&^y@Xb?hr+zj$!$SYBa`3XLqS6gb_Elwd%ZUqDE?uz<{rQU373k8X2@Na+213dd
zL#rpXOLO$Z{YmFQ4`?A$uce%z2h=FdV(~As&zFN9KR2uNFiCYM3UxfY9#cVzdRF;o
zphn^v;@VJGW6+Dn6L*@mTTgG@Bos874CF?Z*E>-cHHJXNMNjtFT%q5pgvEPcZLlUJ
zm9tL|b=#9CQz!EcWFCr<&gLYTL2eq*oUvD+wyhKyU6^JV!m)*yPTu#5NRX-=5d7Ye
znPx#fNjdfH8$}dGz9E1$Mf0pbi_%F9SMr}tRw2CcLC>}y?3OH>njq-U{kB`%vWtYA
z!4}fGSwFd(lzE8p#?HhxmJKLG?|veOeDe6DR{}wNZag5r|F<z}Q&Y`rnzK}@JMDGI
zq4K!=_5>Za8d&h+-hKVAp5b=60S|m^v*qcjtO@lR_I<^*`zyyrpIc`MUXewS_I`c~
z*R2-J%fx@X>{qao6ha0#NC0N6fj|kj3F%F4C%Whag!0Oa8czw3ALY+rLM6wiTos%v
z)_6mHZAo&|ZO6d&#G$=l9e+AA^kjOfz=v$k)U!9`Q}Cy@5RX2qoq+eTcQNuz8Tb+{
z5gi)q*Oily^`7jgY)M*oy8gJ*E7Il{Q<w7fMXozX)??sEb<^xI;3i}@;$+bS!I7gZ
zLEy!fPldjjDCE43PDT#5;-NIK@rHdn3IWj2(s`JSlbcR37xp@s(|a!?lH2awF*I{B
z(_=m-U{u#L;d+TdE(Y^wP}f+F5ItSBCE=nVzpSi1iODZ`73WFKuwZ!vWHa}X(Dv7P
zXgvd(;giOe=602u*~g`r(8A=t`HR&95?7cnRp0~Y3iGB9N(B?28QQ9AcLjYMlp5nF
zo)o#kB&4y{R5n=3e1n-G7I6gAnKKpHk+R!{`ZCM5_h44<or=!FB5#S(sF5+oXdZCA
z9mVcU!-bFhOFi7b6q)SQ&v3;>1q&Y))RRCV%21VxX^mqbKIkDxQ`Md5e1dH8{AV)$
z2z1M4;No7WG8AIuF!3-7rV3Pz0L3xiVSns834MW}ipu+$k=NVw2c^7bFP2fD48z2{
zJxP;kdy-!y-Fw<7?Ly_oNr)_KSi2D!zreCaUjyU{OHHB?jrJ2)VCoc2Ev$t*KGMz;
zEp=@`VL%tMzUZ3}gHm?6B&#@3&ou0Nvv#;klgQ<#TMvOc1;<|PX@aI~_0aVKux$^X
zHEKc*JWtK$8?H~gx9$b-PC?&mCYAI~sRr2b&WJluRi`gPU{gMW&v0|71|3moj@Rzx
zb$_BRb(DRWwK#bm-DqE*ec%=Kd1DQt#^&yfp3_8&-0k-GhDsgD*{alH`<0iE9k7Ll
zm13XSPcYRT&roZbAuey_ty9b*1etc<OsF~7pV6`$T0Tvra~b+TJnED5_ViCfqZJFt
zYYlrP-9sA_brKus28uqDC5Fg|aq9s=lhy1P%#1aq6uGbjMbNH2^LQpp!1XO0s^w&2
zLMqns6)UG(74B(!P=bUt`}%QT0Q5vYz9yi&JZMp$45SsE0ngmk7M4)XV3MD88y5RK
ztetgLr<oXRf92aAh4rE9(jgH~GUE@Hftk+IX{VNro=jzFU&UO|@{oV)uctHc({y@r
z1oz~~^#&^+@B`ayM@V!k0KuO|-OJ=FoEn&-wbWcR81z|2Gz7>e&+skELxgAPGzDIc
znJ&U8pv}~m?y<41Pr1-ru_6!bSGKN|YjFWU^jeB7)EMf;iIgc>F)M_|GN1wIXXGDf
zS|?d1Gn;ogh>S{eLYo%8GjSNA85)TBv~ObZ<#iWwBSIG4+|r6U?zMb{<s?Ud3U#WJ
zeasQ8^RD+SR>5VC|G1B{b<KhtvRo<Im_vqO-pe*bwti;%0k+-#dp1GztCo_e2+O7Y
z%>}H*QqzfVZ=mqCb(l7{5nc7ipj#l1E1;_i#IsUAd=)+om(p8T4PUmYQ#(PwDs^7U
zglJAQgYqwC<bqn$%9x)WB;9B>d6&YV51>lZ3AVx~Pf!<+UHZyB1<h?~6obC(^bfOK
z$P+4=^Q{Wc2T8g3JU6FY^uZUWE!rqdjB`#(V`#k2%$FS%5w=Xdpb5Jx*^0Vf8_#=^
zh-HEaCG)9kyB*h&^;fFcsfJP|hE`tOi(L+RYy#xIB-XC@F+C)Yn%BhtG2XfLm^tkn
z?ZkMix~Z!5^u<|W$n}PdnzIB27gbE9{oqi@JyB+HzDW#-4qml8Ke89!cr?8+*Mrn(
zIO@d}Insg*1NS90=^(xO)6@ip;cZ$t4DT8j*7WKSDiDW1O&w`v8*(P|gJ93w)Q<8P
z{%G5d2&qm=>iY>t#4(szI-E+fHtu)>*_z4e7P6JP?H@RR0VmT2-hsU72Be>=Z&=oQ
z9a!$JK<dywtSJ<*BIj>Vn-<!4S1evj^>TJi7&ub8(dPQn%a)dKIV3R}9C?dg5#J*J
zcGP>;Fi@$Q0p#j&UECx{-}3z+NVUbiBx|K8-w}{+0nU-H9f9KLeJkD9X&o=uk}&-2
zeXspda~S?|aYWOZt6QJoIBJXhjEjXDBKWvLaafj)2udaidy*7AfGd?KvF}icE!9X*
z;41YLkYj10{%CSf_{tdJqKpV4Cg2l*60?<SdC!=M1lp%o&w)Hi2B4avljv#fI~7vE
z&gG(u(;0my@Jkb@4hQS`&qd?Aw;SJlY89J#Xg|l+iJ4tWx1Covri|&i$-QRf@`^}D
z6vu`et?vAt3m~4M@73Az0I!=ZYHTiO<1kESHae#}g0l@~7nAI^Oxo{ro^PDE@9v{-
z%>}mc^J#aq6dK>0;rc<Qdgw>h=)((WymlCl;S4UF=7<85a?7XIr6orS1lJ($B`D{D
zl4o20$ua*^(V3y_9`->nalZuiu8zwXTGRJQ3uEPEFr6Wt`aa9%YqcoXo1N@Oq_Y6B
zDaAxBVvN)e#0x}iUl3ARgPV*I&j6(onJ1bP3&oQz604IGuIOrac4U_+gxyGXCT2eO
zI)9}K-g=UQ_@vP)vzc?SZ0hloAM6#R?3Pc>D!wR!BMiOUYC%2qK0OX8l3cF?u<Ec!
z4FF~SsgQI~9%Wyxj(V;`@sl$Y!hNlHDFAHymQn=;55aso^J?*tr_R{Tf|_%2+T-4N
z5t$vec0jbf&spOZ9yyTfSB>Eyoa5H>fY$rc&$8n!0P<9j3v|Tzsr%LE>g_$JXuKq3
z{Bt{~TLFi*TX-npR!OJb#K0^01A?PfH_H@glS7q@zW|AS;8y73!0e9%{nw*|CTGvu
zW9?BtS`|N4$YOuI6E}0VseSJeuWhTo!I9On{#U4`y+?zvAsq{g{vtS|;=IXi)#awF
z_Y(k*0R@)XNAvqZVcn`$L)F+5l`V~tYYC<P-7etoZZ#107!LciII|?K=t^??kA-Vj
z(g$+-!hKQs5nd1DHETUgT3ly@5%VJ-em&sfV(|5B_`;{SB%MbYLg$n|*yxh!?RQnO
z6JoXPck~04+H>u^)76(;c2A5)_FfaR;y0dX#nAk5rRmXzWN~bkLzpXSl81ZA2%pfC
z9qIDPEUnw-OUYN#<ODTt&jK{%oBJ9s&_0xbIZ^cVw|OYcBW>PE3^F~sG^!~=J{Em8
z1&O+bPe?MGL!-3ptp|Dv1Ob^Fw9KW;gP{s8$eWP#oOmFHPj|&>Q~Wkv_G24rek@#N
zeo$3~r!KGtu)yW93j~bjM6w8o3^VhZ<yp@*s`JMB+ngAm^A=1;U$6Y)nq7`&#cljJ
zXCxw%r>-P^X|LJ4u2XbkucXck!?pfPViFRV&caVDW04Kvg5nefKIzF0xs@(fEdwi+
zw;_jwsbO^4cMrI1x|I96{$D482;B9h_KRjA!&+vg_-{GEu^+@+q!qRff@M#ZKi-2M
z5PN%}q(P8VzOCy<RNG|57w$>AR|v9|@>tJtthWxes`vD<)`cotL+?JsQHTRuS4_o0
zw-qOGPnlTHExBBRB%%la>|)ppUmAD;l?AFI-<T}Zs)@A$*N9tRLE`+58jnd*i<`B8
z4R>P1Ot_9&7mfywpHPdx;EryxoUk)7y9N4|mJ)Zy{WC?H1T!2cI~9i2AYG~VB#G*<
zSa0ZFpL5BKu-8rF9VggVW+yw|Sm*{%S{8=fgs{9fMae8bbseMT^H)+1iYi;uu0IJ|
zi`aGh>@T@Rvi`J7TP93i=`rGK7<QIf)=|Oa-!L1HgV`g0go$bwQu$Y!4f<}mHM2+5
zj9@$~07^{|h_`lFp14;9K?k3;J{4wC-{bnjgM&f8dOIcEyV`i3Ag3E3zcAoVl5H|A
zvAH@fEirk7GpRSC?*h3gE9?Kr_kBdM1bC^`NCm)944PT8+Q)N<H&Wz`-l7h@ee7t}
zAN<jkKJaMvb+@6|Ak8Ib;$z9h>R#hm3TkvpMY@Vs1y)b`V7>-WJOzim2&&bOX5$a8
zRbGJ5Zw)r;2VPZv>zgR3cfh1sZx(c%qk7&%uO_s4D?sQJ-9+Ttiw<A8DuZcTobzM7
zUepoEnO`#_tbNx28yO0UVHCv;v|eg~-~`Rof<LD8#oFf>45xKlrzv$CZ10_YUVAh9
zTZx%Qnx*FA)hP!Y*1&za#KwSZsy$>uJIQ*F`=wbcit$Y!ZLD3)xQQkv0`Bhj?Sg#m
zokzJIpgFtQ0NuOqh_KMq_C$MgrhNFT7?Lr|Y?N6{H+2voO7IqgJIqD>qeDTI!v($R
z74<&@YJ|CcMl@k0Bvdtyyc&GA_T!aaeNSf-gWe?0!<7KNL%@C?J>z1qPJ<)fsCIhU
zG~9u!I5Rc*Hs`OC+o6XHg?mZ+8==otEsHIQF6UdlVA1dg_by49C+S($TS{3^{N$q+
zbm_Q-XRYtStm)Jt=oPEti_fh)vS0iTzh902j<_s!FA)cGQ*Qn6;NEW(sq^U1+DT8g
zI%Pu(@D%JtAIFJ=Jb0@OOZ9=^w#@w+P$9o5`(AoPnGEL<T!(UoqDguBg7TskgEeZ^
zg<d3qKsAklS~8S0Y1=HAb*^uE{ZRok8z9NIa3@ahBR3r}XL_4MO}J@f8HiktmnIR5
z#@q9>BZBIRwCWQux&@!vUFQt4CO|5XKA%XunHD{NH%VsdQxN{rl#SYwv?JxyIV)^T
z8CsRN;^TN|v<3JJ)`6Ywz`W>g0)jM00T_5`Qh94ybn7+SV!<79IvHn!$XQr#cVqhG
zbd*Nx!<fe;bvxnq!#1}jNEHlc{eE|A$y&YCb?a#K3z7fuV8wg0GcGkC6|9S3L%M@J
zcKD&PI0LUF0VypmaS|LZxf-?{;`=TFlK7bnFD(s-v7wtpRBbbRnj<N$x%1&O?fQ!I
z`{CL%_P7dQ@DE;wk7UhR%e)VQ5SiIV)vKs$foDrUSX8}#a<((qj9~z8LM3HJg$4aC
zYTrbluca8`eld}m*#npvGK6;w$i_kvbm`9UV?abvi`p(E|C+RUz-|$|Ia{tHNlw6C
z%)E$`G+nGSO$CbRS=oYKx-7(Pw=jGG#;Uju=`f?NFT&zRXR&u|+2jLe%U^A9^<60;
zG-F&7&5-xT+*sh-e(Mu#ZhT5f#)~?Sm4NqczT&%rw@xF{O)B$ItZpUpGEbeM1yh!e
zl}@ghEEm;J*x`6}qJY8!Z;Tj4>ByE#uFC>DRgve9<Mpr~Y^Pgr5{tO<=l24Pr{(sW
z`8K69P^g&<pwB_=h>j%q5Px>-S)VgmrS~uZ!Os36(OwrJZviI7x5pXv6m%@u<aBh7
zX8$Fq#~rZ~1=X!3YD?Xc!0M6Upwp^hPe24BIuwcX{e2JKH+c_n5AJ!2F!a;8Tnioh
zyDhH{i{dqvJ9J8s#2G1LqN~(L!TRx4nRU>a{vNeEs&D4qiTG_=#VfJ{0(zX%AjXk`
z-V}F*s`b&ZE?qXtk0iKC@8k*}rXCa{^B+@tDC4fX2wrHSZF84Za!6v!#cG@9st^RI
zkNM$ZamR_nc2>5;YN@hI2;dJ^ypP#jpNVANl;7a`Cz^k6ykQITIOs5(4*DL6&@Ck1
z@i8FxS`(*eH>63Z)s8n8e&greM`R{l_#yS?>U7h61;r8P=j@UY^zmjfmehXxfsQ-3
z@;by`O};OMA&Dl5^+1JSiaZEKlbuzdKV7s(Fvsh?D9*CINh@dG*va<md$14dt*ScV
zRmp;nY)M$td`2KuRJT@`$=M&^rI#xTHB3zf(VGH1Cfd|$`FX?d+rQgbXY%q|AME2+
ztsZE}I2>0t6hP}rjVfaoolt>P7KH>AL%~~}v5$SK(`3Ny@hfD`<uLzwcazA6F1jSI
zw95EKqHk^KLiYD0{!L`1Y_Ne?m^>^$Lu?I#$?4#Sq#e_S(@ZlgIP(V?m#LIox{(*3
z?y$Br<GEJpk|OC-7SVF?D@l^ol*y5O;IoqMZ9o08nJvxO18aTlL4t2GopTGg@BEiZ
z>RZl|@!oogexoG`W@X6N!HQl@a)ZLjIJsdsTilu@>de$fXF%a6E2n<*IzX$SokRD6
zjZi+rW9f`bro$HU4PG(5ueh|%`-G5Qyia~p3S9S5={-^i`|dVdgSx|?h^oCMYWIWa
zL_(ULEjHc3a*ADn@~V&$JNv3|TBMg_Gw1Awe)rQ!WbHEH2Z@?q@q&VePrUl|rl!m{
z{h?!rz=rD?raDP&JodAArHs+}d%&7DWl!##{@82l?I8}`4i3F<MO%t@p|e}q?FY`g
zA=~)}k#hGdLc$(h1_I53O!ZpQ)FWD>z+KJM8JWI+t@{7pV%)z+fn>>|c;^9>CPf*l
z+&M8L0dh-ey*vSZaZyR0bzGzK)VH7yPkiO%E$><>e=NO+$F$0~>RA?ltr3xWX7(ht
zuN?tTr)n0zncNNJ*JWxZpZ&r9{9Jr2Kb~{XY4($<cXKQj0=)pOsTGiF)06Yi9ZXOz
zD3dx<MV+w^#Rh@%_!%USjP)i0;kX#u7$k1oETZ3QO+Vt{oned=#)Pfk)@n7hZ3IDc
zLH#Q&Dui}wmxHH{tof3PxvqNm;%^4xPLv%^`cYHiVgpJy@STz5$dXtLu>`TyDpYTM
zSX=77rO327dI_XKBYto_BM=UY7>;;GF6$tu;O4;#+DgQ-9hNdqqqqAj2h-kX#+5sX
zbOzkIcBMlWg(y%h++h`DP?G`}gCPE-J1K<u`%}=Asxq?inay+F$^CB2FdvByd6V}i
zg{?_&egAo#nO(bsc>Jw}?JbiTh8&eDnyRW9cr?yY>MiIrd)_S%c|lpldvhld>6ywO
zhe29hch8URWLrz}q8XJxBzp2>6I~*Gx~&R1cu-A)nz$|kJ!JvR==;Wm>u>;ZNg?@&
zdK3o0I@?EE{9qWrvDE<FTGZ6|7O9f5#XoUJNROnV>_Kn`Y;A?-TNRaTzs_bSxMOC8
zq^?y~i126A*gT6lNn7#2)?1pb$ATK3a+Hs<?_@@Eqp2K`c_mM8?OKZ&U5nujeBhWZ
zL@}x%McB=kwHp<5CcndA$gHGkdh4(TiGP|qY8;Vf(Nr=gVvTDM&b~^`T;UZ&*1$1w
zcHo1LU$za#qxU+Kqek4k5H2?JaGttVB{S6A8<uki?mpD!dt_DAi6OEb4q!AIL<VwI
zSfUi{FJ-1xW~24TbuuI~`5AT+vsI&JZ<pLb+F&@7c5rP_P9+*VIX0zq1s8SA)kMM=
z=`R$~nhzRXT{4<l9}&@NMWK#u3udVGr!iYQk`}sj`1=M=63P$U5VbvA+-)ALZnbWv
zVlHZPK@S@J=!}}uYc)F&IMaU%Qj9EU*WO&$ON6KvPjC^-=q349h~j*fs3$^f#)fWh
z8ggG0^^^KuYO%Lcsfi5SQ%JBUe`YtuG&`WC2VyRz+G%9txpBDB-KKA+y)?4F%pWFs
zm=>bh6nI`h9K&jDuYDSEEk%!aqai80&J#1*xlnQ4o)`78V55%ndvx9HFK|foqMkYX
zQ$Ws!i0%TI`2Qi<er~MbAQ&nG5`-8XGF5yDB7ze3RDiNT_!or6M;DUr;dZOzGT*AY
zfNp{+Kt7-VP{^`niUd~PSk>xjlHOpH8}7yP7jMAvd!D|CBpO3|Zi*5Y?U(9L-A-N{
zhe=TfKrM|IvjbbtP@#d3k{r+hHh1Z1Oi~u4j=;Yw9Sdp$QG%~&D5U=0AUOz{2lY3;
zeQ2XA570R|ems43Ypr&hzA_ZGAtukF-3v$HLkBZ$)(4&(zY5<w*k~u2EgUzgN{<c|
z9!>zg!0(dcv7tc7B(hFQI!nTq_@g4n+RF!f5H=lPz3Xylr(9W{3s3n&0mD5F06QCs
zbPsEyz9=t0`o1i%<ini;nV9%fau+8vP+RXK8x;Yag^97VUxwC|gOD~?VYR+Dhc%n6
z<BgvF5J9d8II9A;FLLNI)>-Pb`qq?h-&+l90oOK%2tgKv=dT)!iO#vZqg%tFVbo(e
z9fnOp7g-m*34K|b9HU^S<?VD`SH@zV6kv22+aYvoSXU{G7<!A-HDaLOA8i&jJX%e+
znU4$p&7_zDqfR6kGqggEEsQuNw>igTmuBZUznnD6G3Py|BEK>ZJNPIxmrN_^d7%%X
z<~wn!EO%s<nK9BfxHjEk?HRFR>}|zQ%o2N?N)YU>K!1B6@BZRqW@+}jX}uJCQfYhi
zK69yf%$83$ljuA>5yu>|$<`k~p%t>2j4b9h-J%3+4&o-<(P`7o9h=BJxl-=vD~;9X
zLCa0mMJB5*+vt)zKE841gxI+}edCpvUJ77znk04IR8=D)ruQa0$#b;>codyTz^afJ
zmT#prWm8UtJ#5bGB6FT#)^srF7Gb~;22P<o`;=OEnzw<~x7XHU$DIkGWsArSu?%zG
zY`>a+D7x>}XiR!QwDXHseS3XTESGG~kwD=-J@7E_7PoCP9t#fbO=M`TnmIID$<ih+
z2fxEGf4B-X;$75M+&5b9A87azXo8FA9T(mk36%VND$1ke-%qhW-3i8sw*wHu-7!+~
z9D^qf(TR6_6I_)o?_MdkR6dC%zdRxiS|S=rSrT>Ws$pHZDc?NlN%?=2eRm+$|M!1M
zNrh16%{4AJ4KtgI5ZAg%MI{$kRLHp5Tp=Xm8f9cvDv5AqhI@@`WoKP`@9kdKwSU)p
ze(L@C^#1<-Gwyx8p3k$M=bYy`k8?CiOQPnDsD{EB7Fp=*bXtf$N<9q|<;-GQvT@~#
zxX7*+KlJL%80(#=>kaP=ES`n8wNOfidZ`AHDfptJ&<BEXdn^`|5vJoLZ89A>U3n8K
zp&RAhWG^pXamTStNXB)M7*uQq8!^)M$`zq{Z%U4s1W?k`b4nJCRwps{L@Fcn5t(|>
zs(Vny*-RPvQ#RFH4q?JLi}qKDL+p@n4Nt}~L6RUatfeLgFCVTjU(5l54k$=xEUOxz
zPqg!RZsPBU<~J4E@_zejFvg*jo~o82S3$!qPiWIGB;w~2A;=&oOI`e2e`*b9Hhu~t
z&A!OA{!ZNMxsr_wU`la4AirD_lJh{fMs(`Ctew|Of^;~pCa0nnU%ML>va%&y6Wqjn
zX0lS~X`?DBsN$9BoOtl#guu{x3MJlg6VJz-QVfOLPP<MU+246<4bWsC9DFqr22RE#
zH$gNT4Mt^Z<j#as%>4c2Fs7f|@n>ByQ6ZU*+d^Zzg;utY92OEwkv9BDxh!Q{QkpDK
z?&-`~)*icAhv%pkT&BXDo-&+u>|-BC(Axd5=f~M|x7)*moK>gl>bR;D#cP>1lN4ga
zA4<|mCt8_ox3RNrUv;7u5T{50z1|1Gx2uel?>=8??lGi%>3CqWS^e3v-^+1}uFPVR
zJF892dK55GsDy5@5DW6EfV8MD^a7gKE*@tTNXWd0pxg)G@@sj{1Z&`m3)mc*+&rqY
zBMd?-nw3UStBt&=VHei}R#v*>Y~S&Lue3OPt=0k#WSzkv`fmxt_SoD#!xB%|&T9S(
zrh<tIjcZxOBu!1>4Xr2<mJ86yPlB^AKsTb6Z=LHB^%anl6e<RV07%-+vevbcZ^H%&
zY5tG}?eW-xnHQkm&m6JhQP)UN4ye$I!DVr%tn^HXDAb}j99YuR1M?*1R(z-|1Y`+}
zd0iN71$TjD+f!E3>*WYyKpVl_bV(~c7o6SXaWz5W`<qvM2)a0Awei$A#kNUsl5`JJ
zXAR()Y%RjPgX_Vv>f?NTDq6x<;+af(ICQ!i2{k}_-keC4$jsQByn->}S)Vv0@;;Iw
z0s1OLa3$RF;=((amzN=WcgA(0$f)9BaZG5frqX7WwMqWHMT>4{4)j<Id85J9a#|vs
z$By)F8X>wnV`QO>$WIfMQdn_LoFj1dv?3!|?r?^n^RKwh&wo%rbXvIh6wB~u4~TDa
zDp+b3=UMCH6Q&-I^CKgA@7(HV9rUvDXHd2a&*6Kri<g+4)RB#-_j-3R*Q<$wx6O1p
z45K@fs&5ww`|M-M%H1pQB@Y;HHyinY#AUyW;q0qHN{r<bDYjp@uk=bxjeYI@AZl~r
zD;2Tx{H>*8o{bioDkg7Cdb3xk_?5(qEAArav+8fztjOi|Ds^|*G%9_;m(HVG+ETj$
ztBV*%iQgAxA0-f{&4cW<dnp{Ay?4{_L+{a%ZCG|gkGk>VI2#Cu%w`1S>z6JG_RUk>
zqzN%i>9F38Z&#AVi?c}z1oQtx%YqZDY#<dE41BX$;C8)$eM7{3=yy&2NmIf4SKHOd
zC`gpbrc+sLvVll&v4QFL`yFb7@Negvmu|2`TSoC0gDaBpZP)04F?Q>@7$cv@Q0eD_
zn!T>v3g0+0?i;#rX8;rGnkvsLzx8}?lOcq%6tOVm4t$>f;we^&nbVsxC665Gb<3}!
z)V;IMwuE;<EhS@n%mnMtMt)3!m&`n8dMN*yZ?2ZZXJT)J$;VCK^0~mSobq#i)rZkE
zeJlQh_*2|esM(HQL!y$?3exh@aed|Qu{Mat^ZE$*V{24uUlD<tf#?-W6|ie#zVpy7
zyiEoXn*Yc`6hYD$ET%?5oL??Pg4Lu~EnSHXajEAp(4qTiTmuU{pF4IdJ`)RQaLlSD
zbU%)+Ac_T;il5ytmYt*`8gG=kw<XAXRfjg2Cuf)Rbn^fcr#Sg;b_c`GDA>-x>WfUQ
zL+8YfPK6Rr7_*ICb4q>{mU_<1ECm)Ey^ELG1a6Jv{cdzUfs6qn#{`sm>oQ)}O>$~7
zCC!o|1z=Z(Oz-6tzDO0IliM`0)@^RLE=4ZbXn1bx@4YH5pxEh7Dk3^cdN}Tp<*lpU
zSTan=f7Ohi{{CSo(mgn_pv|beEq>);io%$i-L0Y2ZP`Kh?Z?S}hF-Zx2rb?EJ=YP2
ztnm&q(nO9ksZIX}V3{HSZ88;i)~~3=b5&JB5E_Sn+a<!68cI)X_mI@D3<PinLF}}9
zYv$T+lHMiL4e-PgNt|ip9z7{o!u7uEBcBDLw6MLkLPr)>WLDZf@0>lR1if0V|Co5@
zc=v-ly}En31Nm6I{r0r01!rw!a4C7fHXK3rg!FPR;FE8AZss1jqC5(-{BCVax{rkP
zwoAuEBIjEl?Akq#q^t)D1vf08=^pvm;BKp9yxGgZeKfRzTmCz6FO~{yrDxPtv=ZNk
zubO;BCRKwG0x|^?ic-b-euD9o(SGKnn$W2k`0Vo`%le}5<~plPvH=8HmM0k=lJY=D
zDZJkOp@gkqGUjdydF)&RK~q5>2;;3dHTQjpghowyz0kWe&U7sS=%Lux&-z=3j~ub{
z&PH#ZBV)I1DCGT69A?0MThDWLx>jOcQE7bbLCbdd4(6pt2XJ6UK}%1Qw2VksMgo<4
z>NxVrEAoyt>^qTAy{Y?>@|~7WOcTAO570iG*%$9AcC+ow0Bv%^@iDS4?U8XV?a-D-
z2+fk_*ss%}JMZTWOo%q5zO`JtylB~L*7M(&NYtUvLFv0voOX{V)<aFuV{awBvy!4$
zZi3+})5tdKSJIoLAVGJ#m4UTeB3>!GKcgM}8Q1^q5jo)Zulf}BPVPOf#OLSgg0$rC
z>+CfbC4ul^35F~ln?vrR7TVvzj)59c=MkQx3>o=Ysd#HAFCm4m<nIc-TrCJu)YK~x
zdy$QfG)VqNqcud*K8rItTxVlCl&KBb>JbW-k2=uT5QxPnqck)(I~uTcq0ZwHkLDFV
z5yiXOn#;CJjP_95+|CzT%JS=uaNG3s&!K&8t$X(H+AwVB_^i5rd4m5S(c7ofg4!Cr
zLkiy=Y)HnWdOgOIspX6|&W}H@Eu`5s-L$yF4a9ZVe6F`?AiDS9fM>QMZ_O%AJKHXt
z-ZS;)1a4)mM*%0ClI6dWB_W7w++z+vuTj>NxRi{|e%6gy{_c{Qa65^Tm+u?h%KGH)
zrZ&}u+39#v0p4OI`b;&M2AUB93neq$TgYU2>ZNx+kzhQB*4^wNg~_KPUN}N#ol)5=
z@doQ<HS=A{vm7n1(ZIgKm%!RZ7oH@~Y7S0${=yITFYe623l;=Zu-hV$n35i}*SJaF
zbws-(ggy4Fgq2KEo3s4df@i~~N#<PpO4`l+eg?BW+L)G3Mf>&aH&K7H?RQ2xtQ@_t
zcL(}(XX$;2OiS2DYD2ykt6L4XtzxOGr?F^Xwn>kB7!`e?-ALA?&p=~x@WIC~40fDT
z-}~~JiVUoJaHZk%j}~T>zj-9b_94%2%$X_E-HDXbF44J*XdK(P_NbI+A_gf*UXZr3
zZP|D<_T48!UOpDG_~HC&$r^fLt218Q=Iczv_IelpREb^Pv+#k3+{o!Sh^FR8V~p*n
zs|s{y3W4y#q-cXFQ&gBY6>M#=7~2+9W*LiUsakV?Ui(3^-W@W9l@Hw;D_ykC>RPO>
zA`GFM>@3M+4UfdL^OrP%dtEhI8)dQBvdt@Zw_bAB0y;PDd*Z}_FBhgqsvZ!+2O=xn
zc=oOl#Sz~pCEFrLc_3lN7CyNAq5N#qvVvmijk&rn;J$p;DpN(WO@`Ax2^|2mtBLZA
z1D*eXkDwxdP=>U3T$70MA!{X6a=xXK^GHG&4cW|<qUklUyS0=MZrzk%vskjXYyQ!P
z+@id~)TA^(1q`8^xZRg^jNB7Rdt#+=3KDeFHib4EF-U&k!PeJ=-RPRKNwz&gSfV1f
zwo4bZcRH=o*2u}a&(VEx>wo~S44KymdB~Sm2-`bqd(IJ6htGDEJ8F8cdG({2wj$*i
zZ_?%4nABJqQeAx87zIW+`Wkp>DFwBTMeS@(_AUr)ZbbrE{y>ZU`EGM~o8|uC#CG%D
zeHfo20&PLB8S5!%2X)+X%b?<vT+5)Fe;6)VFMhWPw`D^!cA|4bO#d>J1zNwx>6D)Z
z5chQqk5*Cq7;M0P=9Xq#;XKT9j-}`$?W*l*c=w)0(nO83!BI-%H!H+?Mq%zn<=SSo
zOrtE*codya^W<jU12Xo3f79B7)S=G_1M?m{lUa~o17;<{Y3O>*1o-&gPzVS#tQLWE
zsx+#(zmALf0yRrc=|k35ZC8_fNCl>61P|6%HTpz_ERHxL%25j!Yg_xS(Zt59EcrGl
zZiVeAGS^M<rVu%0cST-!x^FisW~>Y(O1CSL2}YCIg&wQv;Hm6KiP&Oil+So`t&?&>
z%WQvVHnkGs42}C_VC^bS{QKb7pBqC(SbZma&Igz6l|7EXse-sjMSx?XUF<cBwyf$s
zWFpo;=9WqBRa_a5PT+<O5EP|$4li#<;C7ZaTrFKqqrQuV$_r$?0phJK`Sl55{ph4U
z)+6vgaN?{3%O9oqK4`JNH!C?tc_q*;)I-J7uoyHWc0|LP5(d(SI=VrH5AWm>9y$c<
z+lJwjw2Gd@6Y@`AG48K}pJq{W{oZ1e2{3Z=(|=Zi6X<-mMGBbOp6{b0o%G!<G+1mg
zNr~8aB`2_N{Ws8)cHXPqUv|H(Q&Bjm7<Tqc@7~~3nm5raGd>ERoA>LdnvWe^x6}C}
zS}}2<**$bta0(>~nG5Kad8CW;-%|40y}Lal>muD7+TEuay{FQTveew~Sfrv|kH?oN
z&uCNO&Jx*t2Q$(%ur7afYKffp-Q9J*WsP-Ak)bIwYUv9-^BK1v^5lG)5`DJHE)sO3
zW928icZZeG1I#1#x$UXh+jyP%>rfM8Hhv^)YRZ1?KZ2@qYEvX`4xl`C`>d}W{e`{0
z`|f3*vENc)G)66HeQW<<@6XEfkM?u@!172c1eK*p*2^DiX8tUyA!?g#u$%5QG!o^b
z*S6lW)|C~PT8n!0hh_gQN%|q>y-RmDlIHWgJ`GTxV$D+LUF^~VG5mUwJ*>R6qK4lA
zV9D%uaA*7d)%N;#_r6PZwu{5tW{#)24Bk*KocX!TUsm=YuCN78J7KiY_b_iDv6%>T
z>wDPZa~$w^yMTNSPBnS%^dvc?`xG|vrz^2}eY0(Q!99IR(<R6!rQZn+)+k4AaKf2i
z(vfd6Eo=bEMA()~_q=Uh{Gs9jFKcuYRO2VGK8Hy9#su4Keu!N`yiZSZ^HkWPf~s{@
zqsEn1!e0~(M?V=7+}y&itbCsQn{<Sb@|*6xWvB9~^ck+Brvjsg17?b^Q9>D{r@n2;
z|0{^*U)=xmhgw}~i%~eIL+4LB{g>`ps&LxVXckn|WPJO;UYl&swTAthVSnx6*FUh)
zhFkeJeKxR>=?T5$Vfq808(7V3^Su}4M(I$ew?v1{ukYlCsTcCE7^GP<?zHdK__X2x
z6s~*!A=K2hGSIXi7o39EW}Czho|ilG?^ijRn!|O{1OhyjG_>j}OS1mqasNu27v<Hw
z4v(n_l1I>241U<xPrCVEe|2T1HYS%ikly}(Q*=?tVP~<y^e3dmL`@p(r_REH!LQC+
zC3jj7C)bMq<;l%w_i^Jw^>qi%{m>z^aMUDTx?53c^!XW?{{sy#?~4{K;^n{7>nE_t
z>-%7l2G#|RKkejS9|WNH6&Ny;#K!DuDP~6ftu}v}n}7L>tj4}fPkwuOKB4KeVd%RL
ze;M9=NgkG9jzg^{`|K1{c@IuNI@`0yg$utDmCoM&7u_j;Ll0;=k}v{XEoqo+MP57n
z1KV@J2NSH5A=^i=$c1hv?xCrsCC`WV|5f73rGHZ&%QofFt)QKsuQ$d(%cMyz`>gmq
zSEB5~4cC8@-||Si9N}+2ktdorhZx8;)H-|q&15XJSy{i*#qM8NP(A^2*l`LR`1m8`
zwpofi)@CPXJ8cS?ri{{LdQ5uy6HU*~WTgJj+Opqm$F2{#nFP&E{hDg;;c<l~Sc8U^
z<@Obp47?S^Op_9__b6z=fnZ)~{zc$|%2E1*QO5WWc9(R}L-n&mq=iJIJFaUe7SpMQ
z#*&Hp%*AUHNk%LY<yQ3lMA`&rNW{?KAWuPIb{-RH<7$c@Hf6@%B~m{lzvng#IDCOi
z;WJV0dC_orciLJ2s$qn_sD-iR>T#BcC$u03^3mnN(b>-PV_VA&Rpg0=s)?1ije~b7
zJY(~pKQim6(ERo>-h=d7KmAyKi?=n`f)bH@K4|v=Oz#Qi#nxhpJ%!p*3REV5+pNf9
z0H#tkYoas3DoJ|D+&csxr4&iA5OlOs-0@b}naa1qIyV<*&+Cu%2Y-RLx1Y40h*xsq
z8okY?*5w_aIQIK{eecm06o`Z^RVZJwh4a-@$0BjD+CCa6mHHHK@+CCsk5Bz`b=0l#
z`ud+7E?rLs6EYF^t*xzxwd0jOC2Mvp365AcdMMGzg=W{&nkQk_E<7^*YR8KWr&j!=
z2Q&6tXV$z*1Bj!~;Wp~@2QBV7ZIKtq^7V;TbkZ{l8_%qnEz5Gd_3wD8Lv``&S!n?S
zZ)FKv3kM!&nkU*sh9mx1_l=`@IN>oPwOgS7Lc9Id{k~?|+caNln=?lQ>JNVGFLg&!
zhHJt`sLohb7-q1CbFcHl-a4=)OZD;XOTi3KAuZ3_n-ovEMyPIwl=%}+?HXvH)@5~S
zo^v}Ah^|fFxVKpNXyBnOMV^jDG^)`_F;dU7{<gtXa?yuLal4WG9>MR?e0GEY;X&5*
zHuc<BosdAhrZP@|b?af*i>TihrOP^OPwKPBN%m8h;(+i{M$M5wkE~Lh4N4E&cT-%0
zMu(CDD}et?Dt@DT*hyoBiVq%TN~ky=o9(MUQ)J4eU>6SM@PahS(0r)$=}zAzDF1Lq
zkyZ`w8{v9RI%&73&zY3BmzT>AG3BZIQ3vMDJ<4nxneEJ|dbwhABJNQ4^-(-?po_(a
zcrXz){U(SjVSUiko-zj9BP3&;EL6k7k;5@hPxkhIxruM^h&)+&J1LO%^|$A4Zc6)g
z06++}Hj1%38xADc<2^bA6Js{&cdsOexXtZq`rNqF;3X&W8#~z12Yjp_4VH>~zUrgA
zD^+lfwy4D^2rv!>!b_D#LIwXfD~G4)^Rl0fs(EBNAEz5wNS9iO_99sa)puB908cAQ
z-6ze;!eMLo5;5tQ-&P5r6(tl`@T?c12<<F%3A{x(Nf@3%*6R^)A6}^i0<lz7vJ+HP
zIBRme1>^qU`ylHSZx;#`j>u^m?<c&s1&FDU=(#sm-O*c^c?gbB_oK!M5IL_I9V%d3
zeD*Q^`1kOV{G`Xn;$itZ@GSl9N0J`+&2*Uer)r&RCxiKdE@JK?o;RgqLk%Q(;t3<`
zjGoVT$o<Hc{IbIhxB2gEF?!&_FIpn2;ZeR>cT1!rp4MzirkRQ$o4itCNgN+)J|(XI
zCIAiwN0+gYHron4s8#>1o~?~t`$pM^k$;Q#zKQvXXu}b-<RtB>Drz@JmZj&mtuk<F
zX+Ct%kKEk+u>h6Ztc?v<eO6rMduVI<wSK+#__Z`;`5O?#$SW7ij|lL3<PH^?p+Cw7
zORYs8)H5-^;FO+<UYNdFES%C*$EBQOuuv-_1!LWqw^mlzPxIV|3M%S7#nX%{lio1p
zkH5lgmEde(0KO~;AHO+hGB15ha=qhLO5;n&qD^SOX7~yr7>zx{9sIf1DpaCVhP!wj
zOcn;6js$5`9y2LoQJdE&Ag{9t^sT3bF<78YZ0}Jcy_HyO2Y$1|5XR7=yyq1nM~;}f
zZKdFHttCVlQ*AnKb0)sGR!N+BDisasjj|br@*C#g=+5bezfan*YIc7P+w|mKX_DPa
z25~J0hwQ*4TK6HrZbpZ)dDdNteYM+o7)Yq&!h@Yif-xPODMp$iwv+WeqQ6P3wf_NJ
zw>x`tyG`#<_!s5^1MQ#8^bZVZzTm6ot<e#mw3b+oJkTUYHz4<HQY9hEfAO3qoCVri
zUm>^p#UFj^+7Y{B-gVvC9?$!AEris7L4ufCUnM$XnXT>j6j=<~wAWC6#W_NroC5@+
zmB_}PpX&C-bfigU$QIK*?(6WDu@<j?<__lW*yZF(j`fi!7mL?TO3q$YzS8Ugj<)Xx
z<XyLl)0Cw>%H*4Oa#`RYo&le|o&AE9pqjw^?A<Ze4XkBmO6?0kZccrFWI8H0_8iPo
z0zP}rAK)E)o~i~{NQOr7BxY8}oS^pZM>W7QG$q>+IaKJb%>u)?Q^y$g1u$ukThOu1
zq&ClmduCDFT&yhDH7B1@A!#c4o$`wL6S(&JYnh}LO!C^QTr34(2}QznmLhqPZ`8q#
znj*XRk$fqhk0k~}DQdr+fz5)x+jeG7+YC8BpM*b<7?i_FBSd%%m{X+<8p==dUj$q;
zlx$|b#4(oazXFnVh(m|<Y9^qx8T*P`R28IWYI$6Q^XAN<a~G6Z=$t?_9Yr?V8ut)|
zlyRE?%CWPfZgZat1C^;WbuUiJLcKcTxla_qxNj|{9YdPwpR#r6bjfCq!Bo3h)XBH$
z2RHRz5dnNjCh_ScTsG;{CrJhl?Kk>R#=*)xUD31&g+r*VEYx_8!PGMz_T959a`qP`
z!Ir^c-u{fz*I2B>ik&Kt*s!FuC43TSFg8}t-n0bxgpQm?#50YBwpk7FCxl?|iLb<u
z!JJ2JGF#op!ejz*I}7%DqE2<{F>;PA92hIT-~igBS*Eg6<GGq`3-AyO=SBw=>Hoeo
zrseb=rFmOGC+tj3<ul0mZ0}QXN6YYFCU5PU)~4Hd>&Z~v8bq4#*6-y0*=+nntYcUR
zSN)pYmP@v9?|ERwDvbSd&rnoowchR$hm$S7m*_f|uv?4E)XZI>KXNl-Y6etyb<lIE
z%%!|(M7jPn2}f*JI7GKphlrlrT$@{{6bcZ>k^{$m0o&1`s;k=D<6>pPFMz=#2;i3S
z)-fSlB8YReam2&xRKD8KXl&YSgo(fXB-DukIpL79!i8kq-S`HWtm}^uFtyMSm5`F%
z9QHGP9LJuSYBUk)FAilkKcq&59%q8wPsI4&wQYr^C&sf&M>O=Z0C#gDovR=oh5<_D
z(KmCdZc`B`eQc3<X+hg(hq&k2C*$Qt(Uf7ew>71HJM*fxl1tw%t-RN7yn)8d7vf_m
z_cdeP#}4`2(i~mtQBUSV0e7Y~mxSWfdCpAg00{5)sEC9%eVWim!S)s-qt5l+b}P5d
z&k&{>*}GogLobqVCLsvrFOG9+TiAsS0G)B>3C8BH&daB>a_<h)0BhXz#<9IiOTl5z
zEj-qV8<?Tx_?;`tE|EdP$aiAliWhQJw|fdfyv%e6wtu*YKPtwb9uJ2vgCJp^=Ng(0
zH#ShgFL(I1+y(Hds53l1+bb?{EpOxk)aHk%1G^W}ITh0dg9d+d45m}j1yy_dV=Wef
zxuzA@It&+}+@u|HA<m9&3`FNe1zh4Wb)R^-j}hUlvpCF~sJ3F$oy9=VUaj3nQFSSA
zmaRVkJ$k?51(4)JJr_8V-6!MOMCn#Vu@sA~SpW;YmiFri+N)E>x|z=03LOBFGWCT1
zEL0qL9`djeTEy4$Bs-d4nC=QGdU&;DXeUdYpP6@)wpvLs*=x1Fh9#*H4A%@0LDm3Q
z#rA<^JED$F3veD%_HsVGVm?Q8RNQp5UN23=!XK@lrhz5#T^WxPaDkc)3t#fO$Q;Z|
zNH&VF9w4aUL*QM}sG|4p^g<o*;LujSbpLmN<nL7c5qc{4n$^(oA*HBuao{Z$pXrIY
zucK(LzMdgP`Xk(@+$1zdg=#V-QD>(enYg<ml<2s(BadDVrA|^6#;ftyAzPHXEul9n
z=xk~R$LGEni*90w4e(tjw}t%f-rkXH>rmy%kh@)e?m}7LPVdd1o+rLSgj33S99KQY
z^ZR4PG_tL~y<(Lyi9d9B!z7arQ}IGc$M-NXQ@2lLLv=d`#Cg1+?i!&T|80qW-V#+O
zDMOYe`W^NRC~~{V>^lFNNNsEQBwl@l2sRD*hfDAe-QHLJOwHGVgz+bFRmNE%UI!Zb
z<??oGWUy^4JVjGiUyUDOY=XWUS>B}LY(CIAGAst*WXzW{1HbWATLg(kTvBB@5VS#<
z<V~XGW^6XpQgPeen7VVB5wcv}E+m^d<-nuF*gAEZYBD-%*<n%U405`)qL>KdCrwps
z^VgiT(03<;?dQQG2jk~czs5d`2Jw=3Jf`{Zi$a=a{^P;GJxc9G^8?-@l&HiNDtsMQ
z@bqv(2r7zKi{v)*J~oiu)a{KUf6o(Vx6PTf1n(&6C|<R<hhY!+9t2vRswo0LV)+nv
z2ve~<2jBC!V>k+Sr!Ap?=xLIG+rxC9Q;e@w2Dw`V$r9Kz1!2tfx2Zb4McC=>#!8!T
zvu3ie7vx0JGEZt=JGw*AM7v|`&7O-+s*Tdo%R^6Y><@X2QMrz&q9Y=3c;MG%RbXG8
zr1e9QNhrh8w?NRzQ7~H#foZ>(H9=8+q{buqRHcTpxD%5O38QCzCPyRKe)Nsm@iU|E
za&XaRtUc0VyX8md&vsw=P>PKM8WD2BmA6Nj?u^na7U%dfk<7k9RD#y3Ov&8H@wFBX
zBp+nc`1rOXnlbxU7w|*f`(ZHhEiir`k+KQ0`vt~wK6H28XRokFjmLYG57KqU=hWkk
zyZ9xJ$C0Ty>y)ym)J_az7B$w@p#PhQTma=@z=Y7W!fo8$<4Vb+s*K5UuZ0YrR6S;_
zasNsm%m9KryxyVW(_)ky{nK7Y#HrGpsK21-9sqW9SZ=D23YLJzjO0*Z!Wqlcp{v8A
z2a=`f5A6dl_Zk|wt)76rH4DW*p}O7$VN+&GL6fHicAvdeKj{@oDt{v%w7sTMHk;`Q
z#8F21ix1qy>(d;7)t7^vLe~$wA6uy)ZVm0BLfAhvCKX4K%G-6c#8h}tq(~FB1k1?%
z+F?5sD6l-x63n8ZWyUWjkQfm}AAHh*SNu8nnE95%(1yN_=^MRKI%)$wwf0QwiG@DF
zi#k{Q4ufV_V#w2@^Wsx48oA}RnSoo+cFI|`+~iM?p|4cg<jAMS@aPLGtCj*BIlK58
zl)pGqFrJo^WaiHktWFWQMXMZoZzu-{J!S6W#8->*7bcdoZ7JwR*7A&vXeFBTl-xQ`
zK8s;tMe?(;RDN`S&M-z8wpiSwj;d`lRVGa32Z+ip<GD;Vp%$aU;{9W+cOQ<M(HRzf
zxiZf;sqQn1xY+6|42jTKpHkj)Cst9>f+kfiv)kTsH4QQM=V>HV&7bM=bJMaYmKJKs
zA$QC(M2#=E%<<Ac%Iit%sih!Nm~}43bI(0fb~8h-J)uKdgtZC^O*T~9a096Tl=eO)
zf&^aw3tLousky@990$auoDHqAoRzvgMl}7OnTj8dAu=n$*pET@G-9?IHD{e!T_IIZ
z18_mcwNxn5vjJ`*&+192vRK?lwp2(#r9tN-o|gN{No#@LOsXV4eUg{K7&HLrkGAyV
zfh((hzmoh&t@3El`gE#hygWxOqj;3D%C#eOv!DYJmm+8b^e!GI>I3lle#ePIWWeY;
zwsnMBQjG^d%b&>TnyY=MX)LZ~T<!nDrug1JpZATwyExpdlKs)LK!xwq<27dLdbvlS
zV5lWO^T9sKm6UP1d4#{T2L)t6du9|g;!Ascl+U!wpY~J~r<NP<oA+?mNqTOJw>i?8
z^gH=x(Q;-?IQ%z&Ig~Hh&oRnA;+}W#aUc8%Px2A*w?V)fYEJ>a9DvcNfF(Oz-p*bW
zIw^i7G?Z1rMzw+mD@@@xc&fy}?UlP^&OrAVdc>E(GY;}N9h&>bDwGO}5O#)q070o_
zOB{=q7Sx40sD>9yw7fXiBI|@dt`p@JwS0)qcBQvm+L0GF!Xw?7^iF^ZswgeaUkj)@
zwMVGuc^A&J+lpYyEzGG$WgPaLE<Z(`&`DL(HZr%9!?1G;_8wZyn!xH~sxZwgi8Qyb
zd?7XATw{D}l_Kz=Q3lcVtK`Gqsi2(1@){P~np4loxRu&?5s-L<SvlV&C=K8(lG5@<
zI+zXM*B-0pG0rhHobXER5lQY@T9YA2c6#cG5|oJ)`J&2PhHkztO4e7I<$&x7O*S8r
z;{n*{3CPrGmIGQY!x?7J0z%YWM|Gkq%^AB=LoSLi?gj_HJ7_Vf0^F-}T%+5V0Yjf0
zzcqQ3&H}vRr_Mz&jHsoX&pAvtuEnLoR6vT<QhiGgvrDG};Q=!v14O0hrE@B-a0Hx}
z&!n5H^@;=UVw#i?(CcP{Z32*Eb~TX*MOaOJuNjVQJYInKA>yeY+&1Ecs+VHeQxL=G
zy+wSaZ16?Ea-_FEkFD0X;meF?Mo$>pj-200Ky}e5v1k#ZgJmEy2p~A}c~LyLptV*x
zz+1I+y7tJ9Gwh@Qy*xz?7h@VEJ|C_1(vr^@gN+Qc>&+36en`z1xh(6joIsWfEllUG
zn^i03vc+?6(J43x1)n8j;)ggh4||wQx1o2YnU%3;@%5WujFzE^l!;_-wGr3)bGix3
z6n~B$(QU?I9^iBpUt+}P^|t(&AGGp+dHcTAw9+wVY8DLEwE*A}Ou!gW{(x(O_m!HX
z$g!Xfz*XeQ<~Ntd06Ed8RQQ6QKp30ka=>j*X=$Sl$d;ysDZ(A`=5pR9bx{=6Q5tNH
zYOYH1k?)~s<){PY96`i2v(iB@#$U~2yG^J7A69k_xHZ=?jbxT&uV-tFetIC86p4Q=
ztlU-&L_U2mnkp(iqT+LGeOWaqUqyr*Dd_GS5+ya3>`sjnpB~v93-a8YbF&?bR;TZZ
z%w8Os5vTB5c}Wf}>s=tEwq9WzP!ybeA8Yz>F3g+6ALP@UDNg3J76DnAfya8(@~Vy~
z8OUbk{)q)3GTAt&!i0O#c*u$*5X7@dsAgxczcei*LW<Nti*MSfvMZ3HO}>9ojm3jz
z8|lwzTZ|<`C{cu}{+!qiNwzbV!SQ~O?38&K?3IgODQa}LM0y>d%GjdiNLjaQOuG*>
z+1xGT1U$pelRvIh^j`l!3V=tAf8s$9YMDIp3|p(&>7_|utlh3L&?88!OaUl2q2@-`
zo!iS5OQ%iu;_Yi9C!RlYv+lqBdtfZ&yW>OOJP8Q>{rCUDONW@FdA5Oo(n(%vx{4jX
z#apik=P=C)K;qQsYxxT~L5e}`9byf9D8^Q(@vur_nuo(#eHI3|cvXda@^#g_DZP;#
z%hArSYlNhB`qT8_@b8+oCUs=Tb@{mh*5e)ka`e2)cP13&p#Y2I*?5?ZZeBZDDGUEf
zPAojk1bU>-Z8I{2VewW-UR9{{YR5?1oVDUkTZJgmlBt!w0II?l?@QS71K1XE_)v2P
zcbqirakKX_yC~z@Zx0tZp-qkvFNa@NuIB{#Jw51=59F?E1(r=;Nh7zjdz0dT3xtv6
zkjoZ~!J?oX(2;S8WIS_RCE7207QIzxeS&*lDmhdQ2)kdwe)!gA#G8|%f~W^+Xo7Ga
zXN$@0DaxTcneO8ckU+WZ>yJW_@5Qp`**Du703X{m!v-?-YL=Un1iiQQeNXE`2chNw
z?v8i`oc+TRoF;ouqi8|qZ%N7FP!^88<WL`tJImWr)RRWzmxrNmszA<qQA8@y@!Z93
z{}tLgUm5m*D#s{Gtz*NjiT)32?juizL!h)I@n%)opk1#d)~_U@Iww{n@Q@P=t=lGa
z6Iqv3b&|zC>d6zxIstE#e3YdJucHSnhyWJ{h4@oIPfl8kSf<%t_arV>9rqp`fpSy6
zbq}3Xv$POc=$J_{5-_@FewZ3}@&(h@iCqD*V<YEu^7FryVpvNu`}QYSj8MBoyotW3
zdB>Jl;Pj(767wOL<H-3KvlrQO-`p%-TZs_NJ}(E`O;*aY&`AUbptLPBl#&zu7&nVK
zYL(etmi?O=nM$U`!x<&o-ZKs6MN&^9g?YW?-PI8I_FKW{%-owdq-`y@xo?#a)PnpP
zb1y53O=LtHGezl*qUBL6bj0I^gz>ewZZW&$XH^{3N!M**kll#)VHegZBRolUf=7BY
zm2@#70PksxRfj`ZQzJX4mjF|HEF9(TM$L=dE@>8aqB=^Xdyfe3Q{1N0)RnzP+y77)
z@q<L0=9N)-sb56QvJA8$wth{gycpA<jKevJhaM(hu57oW^u7dKC%#k#kdb1$-_B>}
zsk4z<M-C{`Gl9C7)#*32N-Nk9AUd%ae<zac(<!rL@MEgO?sFfe$j8Xo?9Rmqua8#S
z0=!;d5m={;p_x*)$H8|->EM0ptH;U69A#Kxp;TwqS5VjTX{|<IFe#$ZAFX%F)+s<3
z{#lLxAiXvv09+dJ2K|(+i>B+;rZB$hrOTYjs=rjAXB7W^qB>hIzG_p@;8<3sAXYe3
z0H&CEIKYyA^li%JyK<d!65%3HW6(OU&b1nA2r+(yI%wg6UDWNIAlP>Fu$tfTVDLOJ
z>e8q`gv@}c3Po+VSt+B)UsB2%E{RvldED~va4^4^oAT_SkGaORV_)$=Am!b#j7fW}
zwDY}d-RIW{6ZyUX-C$rssAizcnnot6;z>xiBl%D^+_bha_8nVSoV#Pib5xh#S`8zz
zn#sl3XM8#v`KHMu;9xd=7oC#rn+ESLK1}7g6Xy+UR?t+ttGyj+U{)Kz<I-NkgLP_p
zw<G+wfALdZ`-dPlh|kPV?@g`mrJyMg<JD+_3d>=-H4~7y*CH~-W(QPXO76AM<5prU
zl%q@~`#VP6(K69et``NABU@X1A%|}<Hn&fvi%~+9wpY{vj6EwbWh3~s0A@1YI{5)C
zX5`74A;9WXPLi72w-+dTds7ARh}SB)$BBY`&*UUzv@M;6<hv=6lpM8rs6&Ny7mZa8
zH0mgnd0D?w&7%C~{AVtj0(b3WPzjKEt5p;Af0|wrOQ1YFkp5&QH7-4(#3HH{t_|p@
zGb{pISy*RB<~@aV9s2-6DsIhxxmX_v5{>$BcAAxaH^pr<IA-}UcphU9t>e{?Qku5T
z4%8#%95Sro^q1Pznoi$hD8@IMJbMY^A|rd_UCHO5VuX8)(@t*=u}4ue9=Mz!x6fk0
zQK7&W-;REm{*nfrehzRsdxH&55rhW28B1EcXOi1qksq<?BglA_-I}E1o}@FRx-*ZL
zgM8wm&eqPIgSt|z6#<+rTox($yy2j`=AtXt#-fcmHN%zk6U1#tqUDxvAm-D*ok|va
zDv0Fmc`m)4DV*y*z?$}JBl#Dj8TE%Ng$NE$np7WO1YLF*-r4WwS~TB`#cfZ-JTCW@
zqCXCJy3aS6;Nygm*C|!Dn{u>MSChsM^`2rJlACV!m6xDQj-E_bKOw@{fulA}=N&?g
z4qr_P@kjRJWo~HQRtX<JII12FetxxmP#s!I03Gy|4n81O&K|IF@f;^?py7LqMq@`~
z{L^DBrdn=pi^WsDx69G_PuQJs8%_4T(Rwk0th{}(B*9z$YriERs0hb*?2<tVVlZ3Q
zLr`JR^<mb5Pq4RYQ4-G*oUQF5=y8-Z(K)rZY*0=DSk({2&Z58EgbGoP5<NTJR?7oA
zNDV7U)XW~p(kvt{*uU(sp@kXzyOn+&W+<n^G{Bn7O|GI<I#vK(RSlv&ZHduP#6M9Y
zMbvY>t=*+;Pbm*g`U4geU(x|7Lc(-+Rsu{pBHd^-Cofy*yj0C%n}0)RNHVLpiE|#4
zItC_ObxVqVr>=Z>QtTc>Fxvf^q<s{6*x$Y@**KyWh!k?M@ISb_+yuGDuoAD%KYpH@
zEDNiwWJhfbFf(Q<VMe1jt}Btb>WxYn<GAak>rf-d;rEGDv3+_T!Y*zTz5aVHA<>&=
zYp5%EXG8YTFN|(Pxv)Shi><8J#HiV;xwn8CiSFC?qhF|eucIDEJ0-9TzBeGM+leCP
zO8}lDbCT0EUu(WS06j@^ENTwWo1X~gp=S7B!>-XJ7Eh&f4sA5M-e#c*8V6~&wu~s#
z&B?uk@vB4$J_`;(C4a2+RkVu&Yw?sT+gT{gzq0TL(T$E-@KDULpaaZ?+7nzjkbqgL
zY3RK~lx5MhKaAkL<T+$xqnb-w&wI*p8J2q}v=ugzj6ZBEC}LX?jK$Y-c((<d9#ib3
z-BX--`t+p8;|PHVBb`QYJNCI08g7;|TKFgQ^=u%y9QNf%sRl3BLx@Zw6KdICT9ZXG
zP5{GOHTVoSJ<RIaxEG|nZ63lZO`Q@~qQJf_$@Dlnu{yD}O2`9L7NK(4LUZ&9SUmcy
zpRJcu%d0O-!XQEplbM<?cRc{qy*+D$>y?3%=`fLsG~i>we4qfaD>OG)?k?+908f}{
zUm$=VnIZ^BQ-n-VPencVsEyrFPlja=i||m#ia@2RIgXN3`yzo|t~?$lY*V3V{>0Q2
z-N?*Fx|fp6Mg^xw2c@N;zA9-vPcvW^zz+KXkmgKnDU=l^QSHa({)#r0bFUn`#J4W4
zEPDpO1G=?pR<`FyO4?c6+Z*Yl9$?hVo2eJ&loDm1G@{I-J%v7`ynUMBU&{VpoLAX{
zG+siuVlcskf5yC2-;6)uG5smV0&4nECBff~<)G}zDTl;ED8_6#vz7`fqQThJ6g8LR
zn~_hsNJV>XXjBJdQyZ-Q%~AT3_Sg+8g_B@<-*<;B%6ZtKbflHeOCTPHXO~q|qy<-;
zPEvs*jGx)E%Hx@~PaX;eGzLGVVF?;lM$YWCSuyU{?e?~-YH_GYI}!NlN2=N3wnY4+
zn)G6=OkQT+r_5b6i<t~A=GWpaVnK1#8320^0TBXMl67gOGLPFpM`;q5Q^pTln#11G
z2TOotCg_!>+iNuxofq-y7AL$L50>B|*&P^pO_tQ$p=XES4nntRiXEy%#+EJ1s*WV%
z=~*YW?>gsHnDp2$BT)0%^LE=}>=r6A^n3&r_A^Blp=HOoEuZ=3^P2Y7P4V-vco3AS
z@rxV_G#5T5;DN6|9XIrnkj^%Xje6znZx_dM-qyG<htJef09aBQ^DJKJYPVmpq%uhu
z|I)3<dMJR&ghMSR#M7c2yd4~Hd?+uNSq?Q+PA`3{cDh40o(^Y7y*Cjy|0cUt^9NI7
z%XeKliF=S_I8C$euiRgU(*2lHk|(WjFKO*W0w4}K-K45e&jLC~)lz51@pR~cx(exr
zK*peXjPHqcz>97$)GV8AJVKQ{rPJtT1N9#C1-?>gbK1#(qtCKFaaoP!0Fkf9?4d}c
z-ihgmqm|Vh)T~!1$l2lj>mXecl#Tb6-@DUsl2_n0ZK<My!8{bRrn7i$pJQLCFzC!j
zb{_hx(_2tu#cNvk>pj3V51Ep3g0t(4`r4pP9G*dPEQVz6uf_a*Tc5WsIaUgx+K$hC
z3&BS>GWqoM)dd}va(OtP7tdYKOAwT!^O>%-CSd|#MUe+iDM&F|o}H<>5*AzLFS5mj
z3pEF?N-mV8<O8KmK(8Y5{6rS!>GM49<b4@34iT$<#9<y3Vm!vAWHDiJ#{8R`B}XmK
zVTI{5v6?}1y*Th!u@GEc=PU83n%0T8*WokSs8876YXE-b2K|<($>H%06C`9#ksoVM
zU6q$In2abz%LesQwMEu0E3_THHJu`#i1uRaY)cOs>lDiE6oR~k?HRlPnJ-^wVkASG
zslv^{+9xrTgV(nZY@Y6llf;p3xKkY7i^ZJZiG(S7D}3#kR#$c=eS|(9)(-yM7=YR|
zt1zN-guSH=2J|BY$QB6GFu;o0@c|PO5(XXU<4p#kd0W0Z@Zq#@i%Wzn$-8-D)S+7u
zP?n?O-DO<vmQL`sX~YHj8zP7f!abaLbARp-$DMpU-PcpL*I1a=%l1Mmp2(3eL}&^*
zc{jOjYlu*z4E+oEIwe%=*z=ZYW@|V{6(hT#{DWH8Z0kF}lE%Nu*9E5fjI|en+V8sB
zOs1c@<a9RNONkcdW63eKtVp-h)QV@av<TvIe{7?;#>2XHKq<Ea-_xL9WRh_lj<1V0
z%Nf|xR}2ZY(!U{8@IAIT`a<~)=O~qvL(`MbQSe$Gsl(jDgvqyNX;}xo+eWZ#o92mr
zBEcMr3~8HV)E;hyd{HNYT5?=&_x;){o#|L4tclg=9C)!fr+dx_M*(5{u_SOHAuR<m
z`bIrGt*S$|m`TU-ECFpgE1k0?;DiZ2AwMre_>NwJe0b=;MHqoVFfUP*)+}*eBe^#T
zmwhglJ({P20QI-G1bEq=R4_Ta0*vpdvk0=e70mQFCy3EI|J@lM=SI)pj%V2|+TNv&
z9o%Ni?z=?aU)=@_zhJpfFAcytbsoAi+B9NoksXxBS@K1ahj*xF=Ul>Fg{n41bwP80
zyOI<vaq@NPV9+7&wuTY6UO=WHf5L9woG~lFN4MVcg0toK@G`9OSWr4b5^@dLWo1vN
z483f20W}7uhOF7nH4pDDW!RQ2A<_|Rkb>zDMrW-4N3v0w`??`Hx7z~u?Lscvq;mv2
zgf?^pVFbR`fgJs@gFg9@m}#=q*sXTqGHMaXX6Kcn@9ZLF`oKeDhPj5`b(LqOuZ@YW
z*NsCkZALoEwWi4{*z8$^3}kBK<7(Mw;iS6jN=v_o_+BULhQfMmUG{c~g--KzOMBaQ
z<$#hdY`@Be`bG;nd;}95&Xzg5lRKX3C@PICnl!rwHVwGjPFl?ldrHPE<vRhe(ldzY
zg2ngZb0ZPy>+OY8Ga_>>2icqwa(lM$i{{&zTt+W5*1Z)o^4Mp(ive9XJC!qAguORe
z?8~xIMrG(EQ<SNXXyHet(_2FGBC9iTzi})PaBvW5Z`Z^kS(|b(q6D|@&5d$8o@)II
z2TZn`HpYjk-fsquEmbl(gX0MV=h+fp#H<i^#A8P)W75?Y)3GIVymTO`d&DOn^sg^`
zoD#p6f=%CLJ&f@q;=TJZz(U;VtGdqtMv1i}Q?g#Vm-7sNPg61auIx0D$rPSMOV_A=
z(I)KT^1N=j)-Q^>RA{Wx<+rKQwcS-UbROZ<)R|$_XEe4fCGy2b)zeqfws~-q8$%nO
zq_T6yX};O{?C)-bEFCT7jt6xJE<<eX`cQ14XyF_{w?X)qWh44hzAssAKQLBruzyi3
z6Y73HpxK!+%gNmzz+a9{>MdbER>`bSer=mZ`mh-;MtZ52(p7Xb`HA1}Wmt<xmkWc_
zv{q^B7gmC!I!Z+gfB7<y!(-Zlj0f1S&unH@<lr`V<MAvw4pO?c=vhVAt;|t0)YJ1|
zGJ+F#@zYBM1p9jG!~jo570X8(N8>xQ|4|Z}c#%dyp)d%yyI^0nHMX@h2lNu_FLFdk
z`>rgIDbijSzPOIMx40EpS?B#yNZX;WcMQ8@PD*ZFLcKp5{RBy^xE$$PxKovh9e8Y=
zF7<_JE!v7oer@B^e^e>{w!QLeGziGH197s6%;RNEtyJ`ssUKMH*J%^}+o=9Ge@@KT
z8<r!N^YW8y!{>CR!IYD}pv%=|d(Y)SzbDgvh~)p*!pmoArBlqld|eWVOw{I|Vbu%A
zuLxg~uO2-W_&{s_OU)O3-El#py+iM#$HgYL-mWMYisndO!lZj^Q5LHu^PWwCI?~JB
znAhI`^j*|oE8w>wMeHyaK@udNeITf|Q1k<3Z0GIg3aC@us&^X&I25kDldS(xS$CuC
z8Sc3L9;4hIv;IPL2t~nw5nR%pM%hwWvFsjy>ygqM!oK1<s&RL(U1Ev)Hrq6F(X1r1
zDoZjAFa_2kISVuB30XLG*qP>yu47ywGmKa9?tax+(Mj45D0cX>VAp6xC?j~Lq{@s)
z!|DJu9j;csXXq;0%%)C#k@$p9?)Dm1v%IXRb`-QYuAGXB0_cBVhtA7+iwHSf+ZuVd
zE%ISxS_3p}n)vxEb#LnpdzKq>-smTuj_3eau;%ckr7CJpe^f&+5z1fl&=);KU)_B<
z^8S|u8)SO^3|F*c@9?AA`p*>s#6+o52Uge0-+ACGNV}RGv@X}5R;J!$PM>&=W`2ka
zQIKlOFC3enDZ4r_<awbq`d8NqfWY#b*`>FyHK9J=+H9nlqa<v59dhkzj?l!gf*m6A
zl~!Ie{K0$&by_XO9IatpR*oS=VPQ|ln3TO{Np}nB9Czt2j-x~tnspGt_MAvdrnH6=
z(nZmv2cUBiy8qDf9>G>{B6;D9f}{YBKx@?!R!TULSoVvDX$?;w1>Ev$Y75AmsA5^>
zUCE*CjQwkWX%Pp|7|g%uIfzy_M~)?v>*XI`8_r`Lu76}Al$=a{DFOL~A^xp4e3iDq
z<|v)QeJ-Z7D*}oyAavJJrw!hFY%bnSX)hGI0{YF|fi=r<A>dlmmLNVc>>)5T)OEC^
z-eRojzQdlO?dtBfSaQdoZ~w1~W%8KDYj7~xtg5L3;x)8$0OuWp+pF3RVeH=c)6_V8
zr3Y;9w9F*Ow%t8JgV5L0Nqev%RbnVKQWoQ1hRbFv{hKWRO<#FwyLO*{^n`o_Mk6o$
z@PTrA*8BDi-u9@<jMu+=9{;6cmAY)%G}<ox9Jw?=V$81?_Kyt;(Pt)^A%mvchAt{5
zU<;NQ-2{FJH348>azX$4WNoks{D+18#pd7s>fm@ZkCr>iiVSYfq<;c#i@uLsCwc+(
za6+op|9O5noTV94*!12ELZNXjuNZ#C-|}jqoF#hcSdqJ2MK^cEAWYd*l8(`BZd~=b
zWd36Xul_+_HNo#GeiR1P-%is1VpD$;7p|l8Iytx4TFZiEpy{_h%oP1VDu)-ey6@z)
zzxMv(=Fc}o-|RDOLI`8SU%daNDgT36CW_ROOOsM5*P36@@E;GdIZ4RM-8lA9Csw3$
zv3lJ#(0qH(;laAk(V;h0zsHn+J`KQqa1aeEV}Q?<?O-%A1b#`^9)4;DiPE}r6<At$
zB0*eu>XB)4hvt^`@zA#atj!(PWgcE|gT4T}V+&e3OitYVC27AMrJOcMvsFEz`Kyop
zw8i1a%wiRjk3R>s{n|?W__ag{8XG}Ehh}5T;t~qnA)F91^8fR7Ei*~l+kQ<+3a&@8
zZfHl@eiVfdKJ4!5GDdg5U-7AWXm!)^edvD*hKQnX&lYI_PhKh8_ZfzFWR_~vi+@zp
zAGLwHUcg0P@01!MpHlbRr`$D$Sti92CS@K&4(?m4IZA^Ga8`*QiUbG%-!j)>s$r%!
zl4LXX_4T=CuP|&+CO&}vlAOMtM{S4Nzr0R`mGTu&?rzo6CNv<ZHK*@8K#8PVe_E&C
z$rl7JXSIQ>Mxsxw54r9+?97J6SRznOBgGGYsWdsy%CTU=1(r<2w#}_?O$jnV+%k_&
zC=|K|_7&O>oxZg;_hIqePevnCeYiO(X{2m@&~B;Pe(<YYKi5$7o&TYge=wKYXJP{;
zjGupZ^gO-vev?SBH0h;%#M=iys=Bn+aC39g$j*9p;rft_{opIXuiZ-#y{|>}emled
z!G}L3LrlN{=GXK#tz|qTW%Y&u)hq0y+f*3Cy&dT3;q<yx)~EfSgia93QTCi{c1SCu
z!zp3ehd5LC>$jFmVMBS=3;*_>R_t6b)A(HUgRY$?JR1$MqG+~S^wv@+3=^64pJD~d
zVWx={X>uBk9!FVw6_(}aJIkb7d2QMKxZ$6vHhh$RnbTV*NA5E4)sKdXQT<7tvtc*W
zQ+>f->VF`$C+oBUcR{w?uRit<N+v#_;nv9+ag?<#PF$n3NO&Ut<4hx*I5-$JmGMp*
zVQ~IWqx2`~f7D(TvqNy^8$5S>3XrzF=IXeMB6rUb=jdbzrZ0xSXrCaGjM_f8tDurU
zp9^aIT95%*?}XXgbjo@p%;k;Y*2|uURW<L)PRiKxWHc8xM{eCK{WMU=qP9tez~F+v
z%$C0~`EH37F`Cw-WK<JVZR{LdpCu1zarOHAFfBG@fB;R}HO1NsuqUBxO-p9gT_cq(
z*}__glG(V;6fm-XCm!yWIp&kBZ<~d%Io*R&8V%Y-*`D^)Eas7twvhXn?H-yo$(~|}
zC`&ReDDdnN_Vk87{*+`o`K}kQ?j==2Y6?kj7VwCCf46pKsjsa0h3@>?+KWe`$i#(B
z5oh~k>urV&N1Be<ALQUi`e>Ok&;-G9IF);VXpJrhcMo->R<0|rqrGjYMpn4~nmD%Z
zW+!|KWqJZ5K7rH*J4ul}fS&oH@|>yqLod+h3Y)#{&qKN}m`@jo8Dtv;BsEm(aUBj?
z_|(4j+|-iVtg=d4-~G-WpDs`SP;+x81QiDMCXxh7bhBn*GwQgmNHv+APDbw=AHwwp
zvd;s#iC((ZPxY75>}waVhh;x3w1>@Hn9Cr0^f+6n$rL;b3F%hRwrDcmG)!&C&zJH%
zd)s!+I}g(q>%Pm+o<z{|u@@anPi5b@x2C!l)04!N^8Dg%+IZ~RXPfMAz#99}=Ss7L
zRDGZE53|DYs6D-z>Xr^dE*4Tic=h~V{KcA7Wx<5*YW`y3ot#9jgjK_>x6vE#!gM!_
zvUl=gUw%@6x!gz~e3}Dz-T=n;hU<Rj%ywK`^)8v6M4gU5cW3AQ9%%Mf|Cgbj1(^(Y
zDKO^5=8Jy__Fr=9dt7~ZnO?dihZ3=O!8<FZ>J%eZ_H42DmP<l?$D8`=aPm<EMq`M-
zXPS4YVQryKBm;AUY3ajw#sa>#R!q?Ub1$$jKYOs&<z;I2Qi~hV)pnvhOxmcoEyMZo
zL-^v<Mw6_w*E_Te=_aRIAf+gd$!PRmrf3Fv&4Zw4vcs{Uf!I;}K$=<;{C||ac|4Ts
z|36+*(n6sm%Va5}C}n4+k}X?u3WX6O8QJ$Sk|Ws-6|zjFII@m?9s9nAG4{2wjBOZ<
zF*AO*^FHUitMmTU_xE`CW9G)(_gvR&yI#xlX}SQ#z)QB`WFVF-Y-;dh`!?4WZi>5x
zm23_brNgKspVmS0*A`6TDiV`+YC^iNvdR8+rxG}K>`PITYQtw3_L7CZE8eJa#bmJ;
zJ#1Z$op`QQks4+U(tSMvUc}wZK1o5&HEz2B$)KY4gqb<ZP{S>6KjTw(70^T5ACx-X
z@SKT*;ViC81P=ho_C%bi@FH15p%9QAS91#<uuY(@y@XdUmnJXwtSSVdZ$KMXgDgJE
zMe}Z966u&Fnx!JGVvHo%=woLv;021mn+jUC;~#4MO@T1nsI!j5sJKO{Wpy|r6)lhf
zzDsl2^d}IDS7~5MI-gz3E7-K;8?ThhJJtvTe%&_o6{v;R^gFK}?9w7{%*0bzddH%v
z*v3D5_Fb_0_tmc57D{b<@`Zf4@jn82eB$LCF6ljzl%O~j*Z64;azXFu4j8A@dQgS3
zc&v2h1Zo4cUMEM~82h}x5`DaE&1Ji!9y&kUz6PQ-rSewXS4-K@9x>pa?b3l(WS6c@
zrb_}}W4cEttgT!&{fLwPS>g*{%dSLg8Oh#s@*hsPw$XD)vzE?R?W9i)R$<wr23*r8
zUpL*Oo!5nMI+e_mdufUf?n)zUq13LJkL8F2w+)6(V!;#G?CsCl`DyG1>(_V6**q8O
zttg*$7F!?6`1I+*ZtI?~v=ElecaG2jbi%$oCIk)@<QyQ+4OQq2B9pZjx>HBSHVI)*
z7t;&7Q0JQ*9+nM8!0h+M)xCCoY5K&)yJE0ELPf&$_1B~t!)zJuIQl^A7yPX@SIGKF
zFO!C38L5-B&`(R-Jvt^c3R0D6nAwf>R}1Bs&#mQb604%?NtmYFGnftF_I<5B)B1v%
z&9a*`!!gwtceazE+g5kHAxNXE7~v95UlRgZ9b}i4pH45|zDu=`DD+lHpB3~EyK89y
zaSqWL<SP2!ZT-u^!HyN@04c4f4qest6JtO|YbMLk_gK`vsKv#_l-BF5@_`r0t$r3R
zX`Cm_$0tPvX4&=ymaRW?PeQ=;^t-gn<62*duaaveR>{GNJ|)?ubBDPHOT0>&un4N7
z-emM?-;hI7<d0@DYno+8wW!y!JC0X8qIXRk(p{QjSIzgXoJ(fmwv4QFCESaKlJ+Ty
zo7YRwyW-7pL)XD*$s!f+1K#B8NpIQ49tO9)8Y2Pueu-5B3zf<&h!^=|og1Kt2q4<~
zGTBD`z!~T1iZj~>iW6L|=xhtTyp$YbjD3#C8ufKa=aUS<g5}A{<JlN#He1k)me=w%
zC2(4I-2DigIxn=BgESf82IBUabqdgQA;=5#$KYB<t#}lGm}fy{*+zG+0g88uxHI=s
zci~-Qfa!wj)y2@uMS}(dH&e5bGr{78HBz}~lpFjvlZKOv+^~;zAn;r#RWeB)@g-$x
zD#L>21OE_xIKHkVR2$w1D(rr5CR1o5*!mhXdnZ}<;h1H)Yugr5Hd!V@JDU$0lnkvs
zk0Q^8nDS=BK3|Y*^CQlFEkMb}v?Co|igS>%-W8ZI``F(q7K*^CmfLJuxXd*It?r~R
zYe@uT;ZZnxgpdM)&RQL1w{Do3>jp{BPD-FVdV;j4Z8ONmDeNP?Mj_-QA)%oBr`gnz
zqFaJ*E@%1QzoYwYO!lv^!q1aY9RB=h;MqUtZ^r#uN0mO#JzNh2@uYM$R^Mg`l(kG_
z@~+S+Xr9p0K6ov{|IMQS!{y2yIzE0MKk1LuLzf%QU5>hTQ;U=wz3-D}X%m}pY42V8
zBwZN48h^)Z^*JVJ&|WTJ?hayL{zy^l3M&PF0{$pG4&=I^J68|I9)n0>MR_S*KudXY
zO4w2ux6E6xU6$w=srG=$AzN}a6DWWC5v1$k*f{$T`9c0kG!r*TByLPHr7j5KLNstK
zLA`xI0eZQNyVAgD=;6}PO<1nI05`}+-y)<STkB!Z_8;;k)=$?9URIvAp1w1M60_Bt
zX#(cZK*BU*@?it2aV0`2B?e0j;+-`9x_Ka%$f@MAP5z>zozQkPYxqi$N~QflJ`?!6
zKwXjuIUS6QJ0HZZgd=5#)L{wc*;&4(oNLqRVB3hXoa^qlA{;3tFD0^-VaLVRS}}7o
zoZhq5FT^&yq;UiQBI!X~uDv-Y@2%_@OxtnK*gKo0$WJ=WJlk83%CYF?;jUJm0hvoj
z<3H;!2PqMBAzmeqt)HgNC3h{AV0P%++tj`itT*-SJ&Ms`IQGuhsj{s7Q=TTj4dAW?
zBJj|GuEy6swMuTbL3}hL<%VSCj3&}qpWbru;+Oui-R&MEiZt!@QA93)uU)F|>O#O&
zH@-s60v)ONU}G#|0MmT`oo@4T-KfEs>d6%2HfG=MM=-r+c{T|m@$C)Y*HN@8+sVwL
z(bKsG1{0-iboJt(tDv%)_?)t~?4OV4hp6s0)>yt@E?dS-Y|WrReBKLaw_{SS$Jht%
z&x}9cm&9|(@fy2NgP{Jp6G&;0=SzmuwP<A#_!-?qF}F1D%KYw6;fmlAltJWK)hFV&
zT!@MO*`f71gS~yiFcGfh<)QH<Stf&5<e+S<+zb=?1LyXvQ@dE4cV99ql;;MPExxzg
zB4Nu>Z&pnLoZNH3-S=k9K3&pdiIBW`i#$mc8R>LmUzD6cE48?I*>yWMkB;V~<)?Wk
zl2kYoldSu)H=FR0ujzI79~G;yRQ7T#5n~Fj+4IHEUacoGc}Zb&nmsbRzXr2d#6f7Y
z;^&*rVP_vz)=5)<kYUgQ5#-wE!|pp<?}mSgx*w^{(`22U`GHdbH)|15N$Q;9$dU@L
zyK=%7F4=(5D9<M>Po9t2?&Zmu;^dvYl~GaIq(7BPxsf_H6=%Eqb+~HPDg@$*`RE9U
zi)g;6PiTdy<%bYO$9oDDVOAcSOilo+uKp@f)3|A7^HOffsrWCMbT;9Q;wX`TBNl77
z%s)0XmiHsFBjDl<U4*HO%feY?<v`-B1L$Pvr!Ew_4T&b{r~XF6KoH3WGh7v+4<o?T
zM@lc9=UtDF)EzUS1}JQ&G_Vh(fnADg0^}dvO2X9L;*Fb4=8gm38#I1ctK_UzUe`@9
zV;!2EUOsB)@+6~4&x=M@j*-;OKB_}C6aRBqb7UFe?y)<&i-|v$r}=a9q<?F?2B>Vw
zuHxhE3zegIVl6YBx|GXCdpaicS>DOUHcy<$4b}HjqR77EM>BD;G<OkL-6+buB&RcV
zN~^|b6fnnXC%$mZ0<Q}4T6cJwg5I%aK}uFWVIRp)v&{&y&|}lEe2XNiP1dnEI-Tv{
zd8OiJ$}5d)qO#2>@><4$I5){Rg_*2Kj-N=I-H#OI$)>;M=&`O7i!OBFT6xlfUi;()
zKPBZT!;NR1*U$RYHB-CV%ex=s^EG`97T@U72=W=EDQ$R~SZ04Pa7~4E1$LH>IaQtB
z>Wu?vv;ZT95AyZ6<J?E~8p%+iH94xpY@33?ME!wdVxK5)zhryi&S5fC`od7XO_C7!
zy$S>{bQhjU&ITi`5nK_9uIrsj^kQ??in?IM0Q4)|w5uQAr%g@}GE7{mFqb|&#hTSU
z_sCYEGO#xKt>h=}ikAJpv*Qw_$aE>E*{{KT@)P&J5&)(JpPois5!z2&D^1k3QU&bF
zE&^HMG{H*fZt`!WJ?C{<{q2}#EVRO_g4}QpldC(|2&i5iXyA#zBZ*CT@sVOONSgey
zDrGDcnd#c6nb3Bb_$e#lRJJ1WeRf2_{5ZQD^}VKckj^?+1<vmIR7817mx}$oE7Bub
znHS~oh)28+`Z{cx^eCxmrbcy{se<%ATJB3AAF;uDc^{N?+**8acDjbef`}x4;Fg}f
zTzPlE64A>+4bUYRuIz)>)#}@;=U#WW2!PBa+nFW~Pl`PXzTWVQGLK<IRe*NRL=``i
z7(h6l9Vj#Ek<7c&R%^g2($#uhW2syD#XkO9lyp;W91U3;_gTNu8M=;c_B$Rx5B(I*
z;&k_g8?}$#B=OloOp>TM5~1?qtt?jroR=`wermPk3ulr|XF9tkiHO!Jnm3bi{FEXg
zIo$u;u3_HmQux!pZ24g|VK=17No!J95T6fW{vPkbg^)Z-@RDNU`S|VLHN4CtvF&qo
zFB8}Y&Y>npXuls(bf{ZJH~{lRtW=*eOIk%o%TsLn<x7cyutex$w%2eV(0Au<n$WEV
zE+wg8D4DrIsM7hnBg6fMpTjctPZ{HGWe`Clv+MN7YSNO#2SX)|rqnMot`16HqsKx>
zfsL;^$?tR$h_7XnV@l_z`5;m+no`1zGX<gj3|n;yXCG`AM;u-1HkoGSIwV=qsp5qW
z$u_mOazxvc02{Q{n$&E#(3SEV3i+P3qUol!DR0FS`));Khz|TFCi@ECn2*BhF06rs
zE9p+MK_i78%HL?nn`;00rm(Bamv9|QPm1abF^jZxt%^?B?H3_Y;3rv6vgaE(eTJ<&
zZ&tQow`U(^3xGz>%eY27C7p^``n=8JgMiqr65emr%MF5T76`fg|MMjCcW$5xe-L)H
z8h-)tv2&tHVY$4AMbT-Nt-O`RCNe~e#aPzzecio=2iBYZm$RDOYBL82YM7P{A7HKn
z<>BOTqN3^JNIx;Y6r}6j!r~)0jz`=&M~Tm<<)@#lH+|$)QpXbqR-JY}Wl*A;<d~K3
z?K9{Ki-Yy4Nq-ttA1jx?{0NQ|w;)E#d-aA&d{MKy6+yrMSqp~6G>NaBC^6l9=Y^KJ
zYY^{g_eny^QLFw=Bbt}%NrTfTAg7WVPe1=)`HHDsN_LB*F2u>W?V`8$i4k1z;%ryP
zi6LaBl*Qem!sH0}f~w47FNxi~F9HTNNIZ{{{jBKIbW_|;wvYT-ry?S|*A><R<(<K_
z)Tu5KzV@g}ucDO|O49_Pgjp570a4EeL2g<;;P}+CuzhZ(54e^WKSHQB219-KEK{Gj
z6n~~YDkVmj&g*Rb;nSVwlTHcI0ZGu%)rR5}Cs15dJ@!NCJl?%p(#J)lJB-g~&BaK0
z8mZkDGR>8K7HkWxK+VWpmIUjjECWx{2ej9~AxY8{jim>7g-g@17wXGp4GP{T{4A?;
zjbW2b7XG|_$#X}Kmu;APb;A2)0iWV@I)hg$Qp2PXjjT-$H7J`vqD^DyY3L>u$YO7I
zoD84b{CqN`{Ie4fu9Il`i=K|tL2?9g<_5Y<hi6s*<uO0p!?}%YrD*fw1%?QBX*l(S
zd<zLoDk+s>?rs`ZQTt}J;ris67q}qAJW02nEAI2ySWmd|6Uv?0kO+*`1$ns)6$zg{
z)g}E+$+?IKgdz=@J_VfY<9hGD!8GYz!A7WMXD1hZhLeE8KJ5304R_Q)-g6;~_YLGI
zYo+5!z~h49_$tp9-@YJPFD~)?tk&G!0Tt=bO9F}K4VJspHV8h`Pk?hXy;uz_pD(D;
z*C=~dG7r08O);0Cq@`NgLYD+1DsYw=8=H&gITZ?2Whg?A@nA_GZtsQH6qy%p1?(d#
zuJ)V*qTE3!`OUjUqm9t%FX4-WNu}9dB@r~t$PfTu!^Z8ZxB=u?(&50(rdjkGpCWX%
z>MK8Yik9G@Ck0C@=m4vvk8gHSlL4uFZt=pG2eS9_h8oEY20J$#nZB)1{jG8TO%ut=
z`qctMyrAi|%Dmqw%3+Fjj}qm~rp|b!Q)Vp|*58C}uIdNgt7yAE*g7eDzH-exG1%I4
ztb9E_3boqby1qdnigFA0x#Msw=@6-9|G|XR{!IWo;8b|7J<_+~WSDM!K^7dA@tL!v
zw>vdyK7DE(<7?83_8M!=oJt;)i`a~}@~hAuQoOJUPI_cVJ*&Z=tKp*V{W=zlTwLT;
zEh;L=7}=g5Y9(<&4Xke=KHHxdYqg~G`@V*pNA)#6Tw-Md$#=J6Odu~h4rnM4xb=RH
zU*RWp5O${83ZKb)tk+kiO!ZjscU7Se$7DUs+g13d6@R*FsS#D!xx>vbzdPLn<%&?<
z&%Y`OOYWA0xt6@XEy`B0F~EsEqcISq=~R#Xn={UaKa0J9+PHM2S>C3E%~sWzuc7x%
zu}?<-&2{@7RyUKWwvy<yim3i=Z1fNJf1ND9GsUpTYnnMF&NCfVQksz^y-PNoV(ZY3
zsM~o31z#&u5}8^N|NUs7?h{<qLFS1c*j|qX@~&J@M@pq`M~E)X75*aWaqwWIu=6`%
z+{$(O1yO7GV_IyWGSFl)l(~FxviIY+mPK6F&qxw}24-h+S{#ZQW*h10pWnEt!TxmP
zGWw@Z1h>a;-&x#B-CGWzmR<R_V*9uFEmllWaKX2qF63~G;iCJC&Cw}#p+=$j0d^4$
zFH{Ay?vwVBO*|9vefW2O{4ZtMJcet1Rbo9m8eRq(UZ%I=78e1~whg!K{=8leKB)co
zwT<u>dzhCDvQ4?f?c0;gdZNaB4kNDS6rBHV{r^tt{dF(g*_?aNwdrRsK$%oZfS5dR
zd%4oLSn=E-P+oKGpC;er2Cx6nT*NJW?M6G$F<wPBrD7&pUSICElIixD3cvbSJJkQK
zs7F?rFkGy*+IYOBx!Ap``03nY*`1N2pn1WfJZJB6H@9W?K?4<HfZq40BIAz_uGrmn
zUs~aV&phUNeD`N!dIr#kjCIEN$1~|4vY<O=9y_$nzy~t+M}hL!X}7^ZDi{S$_%0O8
zv0)Ix{@Dc;7BACCXmD`Okg$uJ#@KWW{<N>;HwGr1oC#4G#cKSyW~m};W@+WtOkyqV
z5bnF40$9|Z<|U!Nm4ZxTg)-<^sRn59+jge^n#8|X%nahUPZ(#0|MDqw!}Sg@lXX|m
z!ha_sB7JPR?)yH398reynWVD?5$=mh9!Zx<L|F&Fmxb>P1t0*sAAJ@Fv$G4+xN6xw
z%vIRX*bN=UC}JPfVwad`r0>g#z`$UYw>_KP;LZ|;6(a9@|EKC^Yzge_3rnu7jlDGT
z1bi_4nT?Hf8Kv8{L?&HC?5_rh;ysM3AA{t9PE+}%-6j~nEk>*55qA&PQMMuL#jVxw
ze+1L7N5gEsG9-nfV@*>1p;I4_2Q8X=_itm}9{uwI3`}0n+rj>MOau8@6*Jg{k;UkO
zzjU^EoDsgyrCR1$PfXQ0=E%OJqLDNi8|Z_7jMMljW&i=a@!$ghSMi&jsEXqs_Z3Ub
z`XmoT7jthT{(qIy)y<LtV>=+C6ZUOYbDZ&@vHV_C=}$@}dzp>T?6x$#t9SeS&Ew33
zR3#D>K9Jo+K<r)^Y~R2?YxHlGu9_3fF;Omcwx&KqlvAH!?hwBNNJtH;`ZTgh02kt~
zW(NPvWmIjQ1Ns@%|B#c=kP<q${<XX<6V?BrkmqE#T+-$KaSvI-qsx0YC(Oa&yM9bo
zoPiDoi+`aQ-K_GFO%@DPDVz3aF!rCC$cU+D91aZGlHD~w<HZNb+vH+(g7tCWe?!B0
zPA*1GaXB9i56m+?3ACJv<EQ>$qy~#@K4T0Is#4J+$)C$F{Y#(|<QU@N&?;w`)du`S
zd)&~$0~hu(UuB4=CW_qo+f{T(?;YbzSX{s21xR`xBQ>$uDCz#L3g<90Y-0qTupiJJ
zY`|hG<dpT}+=O{&^tNMa_1I0Hj!7AIs0SqrkAoGx8oYMpAm@-@GSx@X8zBfO(aJS?
zq$K{iO>e0-ukJS%;mZ58)5di>R*<c`m!2a)H|i>8F}wfcKxL$iHPXewbg8bXOQh{%
z=QtfDS|+BUM|c0;$740!jFATZ{iS!e55J!h!;E-!11A~g_%)}fS$DoeN>+50k_oKU
z>lc4E*z1H>=>by><Tt(1@fk_F7yXh)15@25P0XBTpCw%Dk&@jzTUs9YY<q=I$Zc01
zWRLG|!SMz8#e>DH*4L)H>_XWemmUz_V-mA@%mFm&U&q3{ush}C@!sL9o`vVc#|qur
z7k~R5+v81RcV9W7ye=vq+HG(!ylDo1)=thsP?hq8>y}TC^(+%tbpA5CemyGh=<a$;
z`lu}RFxBsEaTW3SA3G+mwgG^hfFv)5jB2H^)M=&_rE^2y2sE2)BBOX1l=-zpfIx}W
zXEMlC|F?yon%WGt@g&Ch_1@RtTOggc&or(IS1?e%DVl$)#=9Erx299Y7{7+8>G&q`
zJx*nhMR>Gtp^C2jR3CZR_p-ynne(51Ye)fq0l&ymA{EoH9JHElDx+=S{q2|g*8?aq
z40#vTRwaKep*s9aArtm+Nwe2)uCw1>h{_jAKk_#g!0w~}TfP5tmFL+t@8?HB<=Ye6
zduP+WZCdh+7OI-Eb*toi0#~b)U>h4-u6_8^z!Yd5L#Xt=Ur7VB=^wM=7kw^go3Uks
zBc7%qEzBE7|7lP<6Yz{#dgjsD#Q#V5o<DC>g*=7>v!(yjq4=K`y6}K&+i(6*n9>#h
z1zMEajdx1b_zv<z#s2f3T1-!alq(CQz%LM+8l=TEQszYRoWaAi@A{2cZamwZ0AOMJ
z@_;A|XqHQv-`?=qC;fjf^6q0A##dpoU$!ujLcpPF=f19fU3}>6?X8tNup1;QreLT2
z>FS2xHw48CRSh|g`a@5T`P-W$Rj@)|U8sBvi*~g6X<pMIiFvn)?$HO0n)ev5^%f5k
zyJjhaEMuD;t2ay&K;O|_*!k~U2s2d2f%sqoz_|kzHd=0q4H+C54O~+lzWKI~Ec%1H
z{LkY4{Z(ZT`YpP?c5?$_p-uR+$^zFC6T;x_@7x5N>?uE^58HhcEwKxuNdiVmmpm_p
zJo(m}egBbvn#|BDKOh7)xIwI@uM?J8ftt{$!)`}6zCC`5^CppWdS`t>ayA@*;-{w*
z*GjTF{%Q_#7(5ucLf;s&X9dAmsvV~AVH4QQ2aD++$ffswB?ii7W9%^XW8?QXPUvz~
zdahw(4V`Vrl@U=e)y0A2xkj~KR9{p{_4{_43{lb*UHWSWw$K_e=giW%kf(OKBgr8Z
zue?BITna7nh*Y@b8^k=TFS)i>nN{g3K#skycG-7ldm_<&)F$YjKCxch0)1T0!$~hU
zra0RvgoMmQcPAO-7}>Q)D?IisXiwNhn=Q<?D+V|^Vna6&L;6ewycLM7{67mF02CZ~
zWu=yt)fd35`xDvGf?;^w=SZ^e>3IZ8;|cwZ->^2OJPS4$FMnDS2IDxTIwUiY+B%tN
z?H-r(H!SkqgDdVYDz%Fm>)s9(JzcJ-jE#mySNf*o?)_kge=r|@HVhZj{a8l~w#JnL
zzch6$J-F2#J96m?CI*xnBO<xD;j;On{<WCF3s#?5<%@p5?{i<8n~DVT6>TrvNRI>W
z`s#Xr{*5-9qKXOMq;RFvz2lx(+ya;OS=%SKL_Q`3>B7y)0Q%ikIN`zAX)rLcC=IUY
zIKL<q2%pzSJqZ%%4yw%O>`QMF$O|48fV4K$L{wa7_)=io|6+Hl^DL$crl$c<ONUX+
zQKcPUfg&Fag8^ooSvnQh+E$Pe@Q<HSWS>cJ@U@zhRoM&>SqT8?tIg{K53$7<mff8>
zR?_QpLG8Hxa&6(CX49C5p`3up%Zr}|k8b)}OK)uwCvUr^{M1T&GcR~QZ?CA`_U_nb
zA}MA*mvf56R8%M_t~LoSGG7$JIv93XkUb?2_5)~={g$(x*HxD`^@nWlB4`udc7keU
z;ERG&T<MFXdUlIG1B$K5x~(r<{L2iX%B-fxmd}UOeJ`44Z5KkYUg;BeSs&-+s)W>X
z0NYJZ{Rw$@UNngWOiRrQ;|EdR4c>`BN*VE0W$d@|ZlfZd1fio!8#s&Fe#}O}#EAQt
z9dxRS9eMKgX{dPyvCn&<3vXUov(kg2yF56YRJ=+dWV8BGdQgLvk9D;w>|Ih@&Uu<a
z9G!G8xIUG7AzDf5b8VOJ0c~A+nMn@O8YC}k!br4o`aq9R_(XInEAcMRD{@@w&`|Eh
zZ=AwUURtAe$7QU2OM9-2zf%mv^Q5dzA5SuNw9}%HagAVU;1F3L8fCb;3(`n#w?|wl
zUu_Zl6ZN%B17Nf7s75Sbl=Oiteva|qR#_$LSv2ZUN|rSXI6-$`l;}sM=N7O6FmL+~
zvpq3|6YJj$6IWX$#<Z_JR=r0?o+6*;!;HRU<X)PJI2~8Vwlx@IXdebeUh@U2I3~1V
zkaglm{*8{q66KeuyReaMHN_1#p!itCpexw51Nr{k@!#usqihWKVNT8$^qX?i$&HZ0
zx>unFiNgllbA&1Norm)o8i~rjl}!jzs^zIE0p`>OzC_Zeu&`MNXtev|)RouPLP&JD
z;_+Fa9QuTy7G;7xHe}rAMw;m(G<D=Xto(^5|HtJ5ISvRAYRKbxK0~?LZOQY3EVUW}
z6G2iub<VhsegUPe>1ex9;pi31!-tp_<uW?=D!N7qr!*+^x2v)&UU{?6bAH&sm)vGJ
zAKIu2?KeE793h+Ly>quH9NBe)jX_tFf8vEOCDO$|EbaNzi$Q+V$MBKF`_@lMj`ePq
zIWgOpvcdBn)8@j3cQ(BUh3MM-oEV*jXcX1b`|S~LCg5dSHkUw>gEC}IJ)w6ZTIxnP
zLY!J1S(h!OgqE-$F79sNQWoDo@(QONFAsh)c5dm41l-CbO>_;;CPP%?G#cc<>t(N)
zWuWY*PbFV6of(Y~R2Dd@AqC7v<5zYesMjqo&MhwrLb7k31bu(_|F^68D=?BR16q!c
z23E-(G?hNV61-{IsQi?}tuuVHBXSO>&<nL%yBg{|uEW5nduPJ-As^seHf}~5Kz-Ji
zdakMGYz@zV`!N)tL^$Rt$*jSmD9Y#)wO9RV(_T7X`onQs|J9pFp=;CQymBsFodHK-
z!a*OLZm{|`IiXyypHzY)$<L42CBbS=AwKg-&ndrPJemZQKustbN8Y1|b%9_D4t%w&
z0cEg?><=`4(QpkXfl*`pnV6fApY<2VqqnBb#mPzL{(K0c(fVvHt9-X6oal->jS|8|
zzEsJ@>H_-vhWZ?W*LoOkoF61Xt9t>yd^xEm!HBh?mYIumN;&X`w$o8e4SF!Bf;7Qh
z)@%Hb9TFtw6_^%ukvJJ$9OUn#TpkM4bFU}SZY0VPe@~wM(x_7Ynrovw#HT?N`CjM9
z0)GSYQ)LTUMk9PuY6tL5MT`njut|wk?KJ8cFg8i}A+dBy>UY$AN(uJzf2I+yF{B^E
z(emoKL-gRwKDFmdTfULt|M4;hygPI?Q57r3w6Vq#=@`9layH+qEkCZ{xFIBVs`n4#
zRE)ASOFhVI_PrbNW+aq4$yv*7U*63^L{8XT<k=A1jO&D3kx8kL5zM(mrhsMXWqT6!
zbQH0@Xm#a++{zBXLg%^}nUo#VQVl6YxAyBH>y({XnI%J`FIB$>Z>X!jtBPgZJH2av
z3s25E$L;|59iQq$Brr}vwTP%=<ooGDOz+gFxN8xqPE-JD&~^>b9CgcU%j^A6d)?J*
zFJe!rfhy{NCA<QiOb?J|=9xwQaZTH}Eh1a;xsl5gUQnHemJsB<CQr^8E4-$OQG+|l
zP(R8vCy*zIJ;y98&H}Ewe8zQyeXWku@y@u~bCpTK7YocwNPkhE1!gSQ19YQ&RVV<?
z5GUpw2qJ6)wD$R){1HmjS`P6Ara_!lc?UafL5AFur4?kseij@DK^WF9NG#-?Yzqq6
zzW;I#K#sRJnP3o$y(C;Lsf&-_s@_BQG^u)3z@qzPgH;P%kEuW4teeq`dmo_$po3|8
z)JB)wENo~6ip$7njmu0f#OtB1*~ghU5q~w``}rR~#qOk5Pn5W&KV#oT?x&lj^!_4a
z#lIIEI2L1;cbme)%J8B36uX>y(!?J6uEAF@p1G8$?0Sf45*WEZ(>dW8rQ{*MKWHD6
zHg6EPi`BaeSs+hcjj4n&@8Nl8;jiqDd4dlTPCA8HjYb{W^<(#=_8^ee_W%^MK*r;2
zFjMcvf{9(E$q;7GL(NP=$EiIKntq;gC=TulpJdrobln%<G&9E~B<j$l>r_3qLmMk9
zi6Ym+SFS&=<*X#vOLM}be_N|LERpXSnE^n=T?PZd!WX4IZvV0K6-xhf*5#Ot9hFVZ
zvg;AOP9>MY!Wh1vQ{xC(P?}Bn1NV^P(Q~jIW#gvk6%v4M`-D8uiNGeEdu6#Fc3XX#
zybD%~`4Zx)67jY!)WFp9kq5D!^8tfatn{aS)FvKc=cu28aZp4_wGg=GfJ_^zfZXUy
zZ9KQO`;-@}&sntj3q@x8EZT-`0ZjIlBPNIOL{g6~>n?WagBoVA2zdv!vxO>bTwOP*
zJCRjat%LyZXe4CHGMEB9Jj@RVJ(8#(-3j6KH1FVvA3qK0ni0tQlSQD06Vrvi2_k6o
zGryp<_aJHl9od}d6CnEg=9PRA3Qk#c!N4?i7rSJT5aoH+@uh3y%qC{D;!U}~Nkd7j
zgtN6SZM$;EduUUr$8yIKbLs1PBVm3Qm}ncMD*Et-v2p%Dj8L`@jR3VLUQwgu)SAA$
zfcXIO{%#`U$FuQ&g9-;P=2$a*?2B5@r0{BfFE&Bh$eA;WOtU<t(Xg8Oy<m9~(xbNL
zmb%x(9!L<+tfWrV!Brk?^o4663!ePwNFsHuvuK)|8g;3LT`AIcwOM#5+EMlowV00#
z<^nb^ge|CRke#&=VJkDHoi@LlK>%P^iBiBm2w5oT*)~8tVM_*rgAuj^>SX@+fj3#A
zZmhKSJXKe{{$`p9e%UvQQJuxhRcn$TLE3FrdIP(u#W5YLk5|(+7BYzZc<o4Ags|7U
zT6RPAjWc*fsk4-feauoh{5F1u2y!i`P<H$<HzkPuX%Lss0`l2&AAD<qy6p7`xgOn&
z4DQQk>AAf3F!e0^xrg(FMONPCYL+*l17C*uDA$~1zMdnXbI8rZ>FD+|avTI*6F|G>
zbiDZn@=*j*HmdFfd^{xN#s$|(w1J^LTiDCjN_#kq&8L7M^J#P^^(|7$cRboN=Ok)}
zIuox%z0A2FX+LQdTJTJbt>$GstpjWkacN^$ob14}$0Vc*jl3<>kW)60fuT$F($2yI
z`yZ66YILM+$9ue#A=E0Nt6tO){0p9W#_CK|v0%Ca1vxkW-(9s<j;L*nzhkMap|ITV
z;4BW777Zr=c5a`0gDgzg=sDx5C_(k$GosI=S9#`z^*$gzX|t?q>={qH#527{iWJg`
zRKLz6loAQQF3He*arQVjv#5}I<l`z?jeT`DC67w41n{^;EnF`jwg@~$)YhJ4){syf
z2w>cgSC865FA?d*rJx)!Y=?c=q-tK`qO`7sUC<TaSB*0DxWf!q_b}su3I&+$8+Z~}
z>?wInLs6(J^3u&ajE<L7kMuVPAK+L1!l+xTF?`9|6lcjBE0NJ<5%!W-p{}(c?FLoo
z)$Qno<0s=d5l#`%C@J+Eemx=ESXmAHI|<uc!x;b;vTFE8wk4xVTnBtI_2>fqox~AC
zCN?eg-sjx5t@<YF_XYUy)nEv$nngpQSLhI$$x!#u_Ot2J@Tg<8N$1{RE*T`{-ppw8
z>t{!!WemMx`s3}k$cidLfYKi2jXeQM>fELdGg8laVISgY*W$e!aKfSJ)Z$Z`%|5Y!
zmk9G|!B`?LSxKCE@U>e*VdJ~f$N!mPQXh9=!>K>lR(QqNa5G@Xdbz{vLK(mih$<Y?
z#}9BV7FskeGB#>3-nel_z|oJ9Q+-$<t9atmie#k6esyDq{cH>>&qIayCPjINxSF+Y
zC>Ct{g3~Dm73DjrpLLIpn3&KWbZ1p`-Y3LiY!^*lBlwo5d<pjh#O7wAxk#p_?aV7e
zL+yPKb7Q8Ngv$Yk-acmv@=)2swh^quQKsIY*^%n-Ji{@7EiZ$C!<l3MDdA{=L(N_)
zr-Bc1D2XI!Xs$v61gKa0xy_?`0Z@J6xa@<^F6`WC8+Sfr$YJ;R3M;BU^Y%3heg1tW
z<`ed^ahwktIHX=8Gfwe}%Dz)Z-}F!kue3a&?hz7JbL0Y9ZjFVz{>bQ{vW~NKzmeY|
zUKpCNcuo}2lEClsJ1A&G?n18an<q0R<cW#&Jn~C_$6WI-jcNg>v9}Z(q)^VY?(G}H
z<^Unf<(vpyRp)*4u!w?w`*xmSv{iiGl3mt7-Pq_?=mrEb@E)ocCNm@QQV*VtbhgY~
zoGA}zk~LZ4+6<_8T@zFHSmNb=2v2Q2!YL=SSd*GnFVRsqpI|loUd5O6NT&lo@Bm{T
z;ybw>S7}**3)1TRj-=~vy1f5+Q5aQ)JPcFiyD#qLvoQV9J*rn&i6qoAW9iN|P6WVc
z3uj<Sf*S74p3E)*3{e|w6w&b8<?lSM9e-xdU>~HRcSzyTzVfu+S^7swQReJx9Kx2y
z)yk*0qo||9*Tc(i9AWmc$Bz??8O<<YYv(Yeb55=M{v*K`+8o>3XJ(yGmN`=-A)!qT
zeB2EKw@L3%W0qSPAnyIl&Vn(q6^?ZebU3EE>cJ@ub1mg$jqI8Ok}O9u!vqp}g2g5`
zVVjrwgI;IY29li?%V7=m?>%1VZiG&<VkRF-yu1uB938K;sC}CvG4n|YHJ8({FlY@k
z3n@UCoT?wKZKBJ<ra(&ArnfnBcG?v3yPyF@gb*Jss9)(-h5u3CrWCW_a<bIw>6AmG
z9E&eSH&Hi0ZnOHoEBCjF^{>gvTezRX%`jPw=1-}Igx7J<xR!s#OZQ(s!EsA=Stq~t
zW|n2MQH??2In;-fK@Nd+9>J%CTGvHSb)l4zVMR!Csh~Yt@5qNg1OwPcYxvW2!9i~Q
zq%WV2HFC>E!6QucJP0r4xHK(EvoTZ|wTWvk*5Ox5cpB>CCK;>)BuESWANu7Q6`@d^
z<<m)L{Fw2_W83hc#kv_S)rr72lc)PBbHdh1H$rB$ArCmQ(8B?XjR4dZ`T#4C{fb1N
z3l1u;uOEViC!-1DYUUF&Ji1xd-j*DZIPPFw4u6~sw!46QB6wxM_@Z_HDOo(Yf9)ZV
zid|UL1tPbp+YU9l`<1Bo{`ftv(_HRJ>*>|*Axrp3oULOw2(pe&d*l=Ggj-+b!IFw2
zo-kBrKXUm5q3vm5-1;3J%OtC(S!<q0v>;7#b+4|-ITrlC)94K+Fy1%2k{SPdu{l$q
zjA>htOOVt4t5J(=q(jHcFRCJ+UEaU1;}A?}^#r^6yym3XtJ^E@Z{N7wlyXzSXE*w3
zcp$-1b`w>n$PJqzz>3@YIS%Bc$2D$hUvy4%j-9#xaR1J1?+5#ATY7w+BEHy)7e)>p
z0bqhUoXZ#HXCh)lA5OI^Qm>8`quc7SGqb`W$=N)29>0HF|2E~>SAdy>+xBth9WAzj
z_oO`#ftfaO&{k@(a$E85i{}a&7P-Nq2bvM+z`Aj5MXc*+L>`};b60_)WWT((bLfq%
zwV6&<kmLHjv)-+vzx_@^NBF>Sw~UdHHlyK%Rb~Pw6z-T2=q+Nqu#nT3sbV;%a7(}K
z+)2W?17xx_+}ofWYn|O-z4=LIv<{L>w3h%kgdr1WmLH|k{-;s+pBIHu*ABx{q@s=(
zJRV=jyb?tOiyi9{8d&%2d1=m6&l)Vs;ileTi{CB<X?UveqR4f^s!mX3;781~H~#JN
z6>k@@54RW0o*p{Ku}37>Okzz^HEEGUK(-SVX8!~)hwF$l21jcUpAqw$<gDp%x5YE9
z(3!Tr>?)ORKRO3PTq-Dg032_5C*#8@2JZTE)9v*yc);Ci9mSXTpLZG85ibO<r|E{d
zqQMx`rnhnKxRa_2Uo4=8V%}#}B&j34O^-(nr>bW5fyh-aTMGn^V^Yy4fS63KrlXiZ
zQWN)P*;jwg++bl9I2wc&mEfkPIo^9bxNY7d=f&c6PS>4!JULq@*c4#|L6>4t<Vj~(
z3IvtycCRaWrR8*p<^r}Bahsf?VoeRwLA4iEuH+_pN{@4tBnZyHMwB2tFe7Ee1-mxM
z3i0naDSzNB{O+yn03glIo<2e?Cu~Ia+&(jL5wy$mqGoR5WPHbDa=8DfsLpNj`;}@r
zW_Nj^?ltV`AkP54V5YWD)&m?M^<i#JV)#eJ3Q{+}o^C`9H{C{5^)}=9$^hKj9^Or^
zDH7TUv+cmk3ZzCH4LEk+(pgEqAMyc`i%0TzM&P6+<m&>{vMcW>3V>DA8!9qYi2gSY
zs9Xgg(7H5rDg~IC1~_`UtP{zLV!q`xM%`QzF#i3NoL<FmfAWrt<8sAjxW$GHkr&@)
z9cHqzRc(*HuYm5T*NcZ4+HW`Toe`EkQX8DzYBgN_6zlKP4mVE7OQ8r(z13Zqj4P;$
z&B_R%XE4Y4OXn`&#zgNOpV|coet)YvWWDo&cSgjP`Cv+YrMC0j!$#T@Ufi+xb%$cB
z!0<;sfxOVn{gnU&{?q6Pa_~&I8i-eVK&DeE(x)uH?{BB*V9ZF}XtOWSt{e+*)mi@)
zDP*Sl_#5#YjpvHZBn~-|rj?Vd_VRi>Yd{XuK?r*StVkaBPwspm3xA|{==7|*fHMCP
z&;9a;EIA&i&uZp&26;AnFne3LAU(+wfsF>YHQKnXJNt)4PQDYCJY>yrP~@cEo^dgE
zxQ^ceg<v5L@5nHF>5`hm^#?qikH`hE1RrbDKUj6r=wbo~k4V*}7#;gny{p$>fSpbS
zYh2$iO_|j*6AE`GeBj*RD35gq+Fc@wE9x0R#Gs4Tu%-r?TuPfSz@2x%LV6v^44n#o
z55Vr%TRYcfi8Pk3+KRtDRn13aI!QVoil$>Wn(641lY_nF&{P@H%jkp>@DNk+inpmU
z`aXp49;&!;8gHa&ZJQz@=4ifj`bvN>Il9l@E(2L%Nt->|sg1Dj5oRegMQnZT0~lK7
z9{TH`!i)}sahd=@8g(``#%>B<+VN0pY&g{J$@C)cW~Ph=(%F8>Pv(Vp^V^UR@52_G
z)*CJxMz99ZMn<&jG0u$*P{+m|7R!P<_JP^?zrAbtO*0^}*iurC7`x(4%TkC+JoGC9
z(~Ey@pix%QbkXF?-2*X)gL=zO$1=4;R;crA+X)4cEKdMnRrUQ17j;v0b6Ji{LR{G^
zbp}NB`P5T^;)OiZZ990GO1VRaI0oR;f*`K_d!p9g3hae`O%}Nx!rQzpfgpw?pSf{8
z2+>Ss;`1;gp|_`_b;Bq31c)x6Gh-)M>Eo;oaS4b3MwnQv-jQoM$b)iTC(J~y?gFPm
z4jJThEiZU1pc@-_d`{7JQvx}yP!;K2#uhaqYsxMIlG?D#<cC-$rv3cW(FZ5R!f^=@
zUj)a+-;Y+duVG_ym<_y6^z7DO27RJm;#N2#RCTU16{2Mhun_$_Pj8b#ppKz9jy6MK
z`b+k7?e^0j#~X`Xo47-2>f*{}7mn5&7?xTMo!UNB8){=-yA0%Ca2FA5+X06;RlAuz
zb06Ad&fYez5te2jyY2B3<Z@pyKq1(MV{o@RQdUZwj8IBFrlFZ(?wsfv-yRa9lOZj2
zxqFdbqcss?OE8ak>|%f47hUGQXaFt|UZ`&h4Ox$9db@moLI<lyjF%EhEl$b&1*Pvd
zp%eaW7el<wqR`OU(GzcWNukQ1>mPAdu{ZVxutnj6IieEWu^i_ggEgBJypuzp^Jvh7
zrW!x4N5DIVG&z3v7z$=MRll#{>}Ey%@7f!4E~oSr-#JvzT<sSX(o;0oiP{l8AGu)A
z^-h+*w29lGSU^=}FFZEnLQ@6li)OO=^_^k15Ck!jl@)dQ?lr%7GKbbnVf)9`hVL1N
zy1#0jgjffh_Y@1cykCqYSEnemw)TQwMQwB=O5msyRgY1*v&|msh$AfU@7FmL!(k(`
z(DdMe^gs_MW_n9=lwuUvR0oCC(}0vuL@`Mr7aOOhli*?%Dlwg7a8;$!(HqNCC`Dke
zK>OZ4ht!-ny@ahDO&*f}nv`ozvgt54I8`U?El20(ti)I+d0Nc^ro2IFZSnACuMCD5
zhIU^#3ywssFRB}FHLKaLRW~Lzc2&fBWVH<wU)x#8z9pCzj-K+iWqD)wKYjoIyeK2#
zXCabfB)rkT<87<If?n_@gho?Eo4o@L9)hgC;oN_WrP(Q9FK~oVY!nL0j#SnQys>vJ
z`ga*$qa$X<0!hZO^DJg!8v@aJ9~c6zZD}oM#CHsIl7Xb=xSrWNWJEZ}*+_j4q^bmj
zgZrb0h($+iJ;qjg_M@)vr2gZN#WyO!itW~i#ZXh49Si59ZfBTXY>OXgtCtEwT`&oT
zaVX|At5W8KI8he1;dAf$(Tf)l8Rh%yXUOeKx%GvUM=lS#j}G5x<l&af$mehp(RmMP
zFOYMw@)@`~W^IwR=Ej5gRMmh8&hD6=jazT*xZXk3fWdH(g)bMuglUIF+KoyKM<g*I
zDMvEvj9T|$uFd<nQ$3`R6M|Ed9~&JDtSTQbX>8s))bQrQswdu(CZ2H^m%;yF@+}SX
zb}{@HM(Z0+=>$cF#@l9jEKf`{owq931#6JYl^O)wsPUK#gCl2*k}w>i>b<EV{LF6F
zYHV|Cgs2^jay6!FaWUwo+~y=fO1m(j>%&;w(SUuYdDr5^eTc3{OzH1)REVmUE^67f
zg-vn<_gL<8_>U^$&ZM$%lbO(o7_wx9X`mcS{gpf@zWeyV?4A5$+(;Ssr&Jl;a%@xv
z9@d7=muj{5=H=};WwYQ_8!VIKLFkCuJU2qUf08#&%^oI%aGT}m&wYf7YKGVIz3qG}
z=b3)TW$OJv(c1#qtdme6fRdjv%nCepqVXeSjZN8*c-ey3Khx%n%F%>wXqmTDzjFES
zvSV5BCK5k5XP@lA$EM4wuf=I^Om>>e4+2E@e;#X@1RcIc*cm8PT4N0mP!lfs*p`l8
z##p%MD!(hU8bUp?tL;;bl>3dM<VGroy3l2DKoWS&E;(PqME5qe6`idADC6v;Q!_e4
zsy`67B`=?F#o!Cre(+_Mr=nyWN={S~cU49*zQL-*b97aHgCr)cF6dhz-CBxw##)L8
zuN-)l|0xvVM6r%*V`V~F4}^k9JiKzz*0mGbm&4&nb^tB_y+XDJ(#bw_E+u|L8y-S6
zm9|2K6TAv5nu~DF<#0T~2_qM04cDh4JGoL9{F|&`*?E&9jfEGD=iC#Yr!=Md7J}m1
z=Kgk%g~ARtG#P9MH{pdA0)n>>SYH;fqgPy!rzHQ%#*TL}vixS2r*&{!ZClfxBJrqy
zgQiUX>e~j%ml0N9xi2L2hRVXdB<(fn+hK_()DD8}oQ84~nJ-%}>O7YST%Ra5$GNo^
zCc5K1&Kvx-J2IhFl+I<2Gs|QLs~I~R0;EOvdd2q9+WWQt)1dtKVh+eJ^Drzb<Bd>f
zLCf2rr$bvzv?1(%9))!&g`N5ZgsOrYoKgD3#Wo)U?0j&$C-s(nc6fZ%gXPzBgXzZh
zBFbMbWBkq8$kL7Vv9IT!V9zcmM-F<XuF~F|?Wy{X;v3*c|KVr+?QvXb)j1U|IkDj;
zgY029d|_YQdVfy-h%AFq%z!^ff1AacE8fZ!ya{(<m{9bULSk~k@<UJlA!}ce3U&{z
ztn3tVgYK9tg-Ks@UIv)yzl-qy_10F+jKIJxE^<tL;@J(qJZpRC2x4P_0@`$^KlE*E
z$HdYHFZNeowayeMpeE3#6rrr#YU?o(7hUAe*SGv*QHDhrM$dS5D!FGb8FCIJnCx6!
zS|$=#-xes-G^whYw-(=gV_p6o{U*3EBv+}T{gfxF5%o;?=`bF;*Z?rEYrS6Ry<{{3
zRNvASmWnM5==sWJMpFt;^qSX2l8h)GnJ`naiUIB*i^6D3n_T!>#*Qp0@f`0X=ePIr
z(Eqtj8zWWQvERf!yJOVRt-M(k*)Eb{v~v-Hx%A|7Zu4@jEz!McK|lLfdvle2WqC1>
zVwy_bN3+eYDD(no(hTg&=?yKegXAI_eD-f`_*)2Y2g!o;J_A!D6ZlkE;?!il>v4GH
znR(nE1HE5x%frq%j5BcWyhAa>_d}taH~>~#JZnd9XMG*A0=4P!mG=IWXYgOK{nI3=
z39aDcWA0^(I6-%gE-gE#(ZP@p^TGe@&%c-aKUWs6k6+s_?O6}+;FQ3WcsbKpDW)ow
zbi^Mf>;_qGWnOxJDb-)MbGQIBQhqoM9hfi92V=)h7d-U|X-AJ|M*UpI*l^c&Z?h#~
zp>H;ImsB+3Hbg1*aot`lir8`5Xrq8Owsp6;)r-=<(~0naD$4Srt4jM*?XdZ`t^wXV
z2OuYl@80?Tk^Yrv<YrFjOE+t{On;A{v6ASTh8OosP1RD=4%x!PLrXZv%8R!>Gi|8*
zd@a3xFxs-F40N4MY!g)*JbI=iD<^IT(K)u+Xj?M)qpJR>xmY2GcQQC*UcH^Nf%Gf$
zq2DbB@Ub*8s)y&j2fx_(3(P#We%d<^eS?Zn-^t_nAloTl|LwPbAT)Xl_M0sJu=zi{
zExPJwaWSXllZG_;yXW|q>i_$<`Wo-{OQ$*+asT$sqgG|AzO#=m@4Ht{{J9nz>oQn#
zDdZtOl}~;7q&ekKk@g9)=H5x@?^bhD8>7s8(mp--x0U`|pez{(l|zj&H%#bdBV&{D
zRAz8izqN1r45ew~^AD^1ueVPf85$`E;<3HMlVxcW-^#i%CxZcfiSLoL0nC)E_)CBK
zzrX4aR|MH*u?+Eo-unB0Sj}I*b*MR*UxokuqWXyFFKq1(_hgeb+D*6QVv|SzFa7+#
zt|we#u-<Z>`|`;#LC)FgtH)ZqOkjN0jFstqOE}+}c&lpT{f8+V#^0-oLnd>^4s~>E
z&1c4*yk);>YgbD7PR{<d!nXh<PuV0HT*l7PG04<1RiEC`*~5}W{4PIQr6G_b9tY7_
z>W%sF3;rN-vUeH7Q>*a5@!MSb^|Jn;*bV_eCNL{!_U<>5d5t*%#^9sT-fW8U`a!UM
z{O>2sz#jFA+wBwkW{+gG8O2SWxVGEe?`-(FS#fYaE~`*R04?%bcO=A>xo6MN6A6i)
z$OoFNTlAqF@m$mIcB<+)bAnM=Woc?<H|-+0#jXJ~8gtklo0?eJm>sLB*FklszV0^t
zZWaHRe}pMlRpv#=;EH9NAf?tzOO?c#F_Js|wXfZ_Q=_!0i_Ujz@v4fC@f9{BVgyn?
zCa--x%&OSeuky7v<QKQ8a%7t|xXCNrK7an3r4jM75OgRhw))a9@RnIs;#XoK&-U1_
z-Su}9{qOeG!H{8!khDP+$F@QRT@Am!{&w+ykd6Pm#l---yiwm%{hcHgYaH~L(EgSA
zd{rgI@9^f{j#S1}TU?^=YtWACLMa3l^XAG9z!=Zt)JjBv!3=AsElt98y`^4PHJ`h*
z?3=W~CmTm7=r6s{zijE{>s5Y#b=1}*oQ=4i<H)gd-un_m{6>>g7;6eTFB{~inJyz?
zI!vpWwM{Nf>W@HN{Q24rzhzYQYv(DgYf15aCnHQVh?0oexiYY>F=j^qo^i<Skn;xI
zhX%{+-#%Vk<7tgW*yf><!e3X}@OOES4`xkM+nU!9+#z|x(rXGcWM-G6;ix%Bn}mM+
znaw`Ofid0Ag(1Y+26sq!^vNLv7!`im*ST{2m_en`yi3N@<o~(C|6G)fW29Fy#HW{t
z`bGJ6LA*B><`;O~GoF?$7CO#WE=o62;#0BqMK=H0GubW1s53Kj@Wr)4jkVeqboV`m
zROGd#poFzeee;ox(H5$$W4Jv~U!(=YI=a!BaQr4*mZ5mev)?2=uLxx_vShfkSdrI=
zrHG3@+ti6K{BDE)d8lt*ObP9VK@DR7&lxd-><$2(&)aR5+qpIlDBN?;IBbW7UM<K<
zH{!(R7vp97|0vz{(c^E~V%aCx)}^HGe?9Ba!aQx-vXvhYU+e_7BPNnOIPxo}c!2=d
zXVWBI!FRi*v<bhF$PgdB<U#wDWX8u<`5l5a#M@x2DQeVysIL!4k8!z&qbspJWD2x?
z*2oRRHNR@0Hd1G%6HIWPe6j@%+E$D}aiDZRLxufxu@0543Ob0!G=k8|5H`@iK`FcS
z`lF)tIib#0L|a_;!zgDe3Sy0M&bnfcy}Y?z%J_6YL;O-;ozj@{T$$+%`2<K+kMwA2
zZm1z<_OeWWUb(GWLt*!T9FySq@}kUWaq;#h*$hK}{>QIZ)>du&;(lp1{%|=B$#|U)
zLP62}P;a~SdE4wPjscP4ZtT`8SAy-Fo~*ilxls3s4Wp1aPg1+>tE~n}nYB08&R2w;
zwh~I5ci@RcyABumJCOw%4YIUwA+oUqZ9vHT%4Rz;V6RSA?L&R|mDHv<nJdY{C=1~k
zZTT3VIL$_l#~#y3<IxtCN>bYihImZHq@;V&vX`7YAIjBqnV^k;t-1~rk(~KDF>9*1
z?&VXw=|vTbcK(gK`S?D2-|ZnH95o~1Q@qxp5ZJcMl0`h1x0|p`-)&l&(zeztYwdKA
zoAjS-AHX^xAj{fS%M-((68AQ&41{|Fn={hnL@SCeUAG!&+yq)d=K(mF&H1eLesXys
z-Fpt`*ZW#5bEzD;onU9r3-9zEy#im`9NM8T?_?o>ZX?!8>8(Ozcjw`3b9jH*s1&JW
z*>^o1nhE@#ZXX&qW!N(6RW>nr6F&DPeu|4mA=rmjRzsncCQiNm89R(n3#juL`T@QF
zg>S*nqp3fQhj!E%1La8Hk1|kii^MK(3mWTo3^r&*1~?Er^v#b(CR8r8X}i8<*VB+a
ze5QQHEJFof)-h-qjy8IV=@`~_Lb~hRaa&Soa)ouc;R)ne!?Oe(TXx&xkjwoYY*Vdo
zw$>E;A4(IdI%D_Mu3R-}m6L2phC-uOvvhAwMKi7p<XH!1W8Ubn$to7EUomcjv?0KM
zRM^qvJ3QeD{T>+8!2w&X9e{(H-nU!H?b{yR#8gvuo9R^c#&1}Y1~sDy(_nHnYdCGQ
zS6?^N)bs0W{<3~0UI@pGY@L};<{C_5%{+T1o!wzfHm8=Y|B}hl>vUT}s6SiPh|fc4
znJ}NnxZmr^D*@KKDSeR~xj#Cl-lDdfebS2Y0IeTaz2j2<?$kv3ZjODEE4~E1=$sT7
zq<4K(4MOSe^VuAc*%)q>s8n3~{}_AosHF4${ePyKoNCfZ%_SEyQ7iY%U17>n$!)5s
zG`AF!%3VrRP^PRD*TBhLDJ{F_&JD>e6-yChR7jl>$gR{slT-weReyM&bDwk1=l-5^
z|NcY%&?9f&@7Hs=uE&LVXcxn%`gQ&1_I0+z96JqM1Ob*#W=}TC_Lto06zczV`tOJ7
zf1Sq_={w?5GKLpbHs;+OG|wJA{`i|hGmJ}VVKpStu^igKbG(O*S`#>_Yes}bP+`kh
z#S{j@G^1=tU6zJy!Fp($HC}-p1!5-5YV>f-?5lIDb0o#mTvT+TYzbqq{LKMc;`m8;
z#p0Ag{fOhdx1X2+Cf7?z{U+9?g2zwCO&sOh0%;jT0*V{!J<9L9S+0eDdtqNq%zP_v
z=_p)v(9UUg#jKDRFx~F2ScXmir3k&E^2qz+2zM2Ue&p8y=|%9oVI|P&z4K?T)w?u?
z-2L>>I;PNk=OV=)iwo}mULjSqyu6*fP6<5u=>Dd|kN3D&zVicYu4Z1D_MFcHmZZY7
zTW)o>?n-RD_SNTSfRstOyp3(UTXjsI;4bXxMj0OJl&#7(kgljrS^MQ{P_80koJO|y
zL+8w(=|K+z_eQHTTm<jk+-UF*CD3DV!`b@b|9KFoI>hcUZ*q*S&ivCP#psyHCvMD-
zs?WDGx;%OZ8Rnk;M%LyKj@5?3k06M}KYXB}ry2^WJAUr5%NSO-aHw`mO|cjDjMmAC
zg)bC6eiAL+mY_|MuFen7yc$j&f>e*7`d4~x`&HcTV4DC~m}{Dxn=#=Uq0^(EqTH+;
zlb0vIC_=Dw(W|oJt+1GS^}~~>EqO+v{jL(jlqj4QVY}w8S1A&zw36{jC3B{(+tTmz
zo?(+t6E<vZ`xSRvBv<=8yS;Y$C>igQ-?Z#wh-bwW{)kK5b&O{%qiS=}5A|kyp3rFQ
zH2ufv%a|SI+3NA#nCONtf^Ut1%DHu&4hJKFA&A~9XIPpD+h(?OuP)*bI9mxUddE!O
z8zX#EOd!($lJ}XHapEBuIh{7$+C#Xq(LA*|yvwR(2A~ilC!{aFC??yCPpfPUW52o{
z{}wTRk07Ka6XCiIu5K=K^?i`2<plZ}*mtGnRgHZ9{VkAG{<+k^w`WXdAy)WBPNsvy
zeky>a{Ld;(QIs2RUoV4K#|(^a8vTxn4URY9)eZbKdT#b=^|{_ZbTh@+iOqc}I3x0!
zhPuJAr{Vz*P_snw=x9q-?8K6KitgtF|1=6WqArAc6-Mv_yxyG!5eP9}*!&-+#1d`1
zCs8N)X!XwvHCm){OQcW#&Da3vs26wH-79G;N2@S*TgFR1evQtzeM}-{)$NKbxeAtJ
z%g4>Vsiws9hwm*W_eiIv<j|pa4X#BkZ!4y2>_9g%N6r>i^x1;H>fwT;91BzeWlcR@
zPri%V6Wg!j|6(|u#t<DneSuUf8q^5}KC7ofZhRWjOs6EnppL>d+coywvtI`%j-EuE
zHozim5%IrgR=}`r49})HuL9Rhyfwl;-TX65N?xl==q}F17cxnS-D%SiYVeIrYnNbp
zP~MEUxi{g8Z}ke_iR8DDYfrkH)c%t6DMa#DV|vS_gqfCH8^l}J<>Y0B#CiSvB-y?{
zVdBJwvqxAZ=Xqm~DgpK!Dt0ysYPcTsSMcAPzW>t*{p&|Y&f9<d^YJf`@Xx8*3WblI
z^?Q?JPk`rDO9)%q6F@M1Vx??9<QBvcZOYhtRQ<|b9dsMav*;Grf%#-|t>uTk7lBkk
z>C3zKE#mS=s#3rFJ~dx8ucaOOZH=b~FXz5)bG9`z(et+`ye%l`vyvXq@}k&KKhysB
zQPl&M3STbrI(ScNYhMK@b5|8;_>hRp^&GU7-fVz5;>R>uDY23<%A=@FXG$%7M0@Lq
zT4y<})XmuETl5hVr!ia#dtu_F2e@ilH+;A&>|sT_;25$AH8A_TClF6}y7*QVWmgG9
z%@z{U*Zd!NkYS~y>(M=}zoCN!I&B^#b6;FNx`-~(jj;NR+wo&=!ZVu_Y_WGzESbtG
zkLbP*83P31sF;@?IX!sr5}R&}zzl133XCIR=Da+WV$_+-6|-}Vw!+rjt{0gqBi4g&
z@_T4|F#|b%_+n1R(on!3<W|>5n3O8bY*O!0_`upbU1D~>ld=1p<n=(w(g#P$fRg}i
zvw1e@XnUREnk0zh4a*<6?jjtz(;bsjaW}ED@!DKXpVmyVc{({{mhYIzE36aq813$4
zBA(4Vg<?l;B9#%%$iJ+HZH^Gv`tZ~(k#|u6s}t?mOyl)WX4th-J-}%^+b+9B;LFmv
zRYxMvK8WK`o!LF`*v8~UbQEaCXlbJv(dT--QCj&@^gv$c7Cmx6KHhsr=Dl^{QJwX$
zfB5IIHG(5Ml1R{!b+2*>^!)X<WETZlbe_fEc(_A{uHOTll+wuJkGk#+w%&6!T7(&P
z3g*uEk#f4D$5zSf%>%p1HkteR%)emyeYWLg35xO$c0w5^hFlRu(0;a(`+wm%rg}r2
zt^LA1+SQk?BIQsH%H!utBmeU-sQ<p}^L{(*xA~6e@lT2_p1A3of9>!yj^~B5;UsI5
zD+9VMBPJ<^0Z$@YA}a2Gqo{KI;cJ63UF;e5@#e>*oW^M&PvJZ%=zXGK!PHv>wKtXj
zsgaQo_xsQDYj59tpBeK8X`4I$#*X3`x}v#)&7?b8t%p((HOc^{@REn5JI3RD7HNLX
z$6((2G4gg6rYmJLDuo*k6^`ARSHJG>#W!++m$)SrsR48%sE#@t8aooB0Yd#}FkkM-
zT$Wty5=w{ng3|+&(HDrka{6>M|Gk?^-ug!E4(c!I9wvJHb>nor4Q_a>E~BLxT)$H;
zIs>DXf|ncyY+XnCjS+j_*S)xFbXyOd=eqQH`kmuh+vqPQjinxq((I~%7oPpvUU23S
z`$p$-A(q$lbjIm=XmgDD5V|o;-GYYy8j|%xpn%Zlf!nw>ul^758|xFo4BIPO55AQn
zJqKZFWNPOYi`^*=J&#L(7n>)}UOMyBwCg{tJPe9893{hk(GjcaYN5g9<zmcwX$9Ny
z)Au@1nK}Se;xT>o?jyGLy|#`H6mxE8Fk6d$m7K&?o|DS5eE51Pm){TX4y|+6nf<Kf
zJ4k*>@>I52iUG|G@I#>{NvzV(Ye~iuyZ)an<jDOOQ%@!>TpQ~e>ZfjU%A@kYEF8BZ
zbRoefv-@ylUX{qjsa13!wC~aK0wrE(>rEX>lnsZOAE8*Tp%28FC9afH8eGfMj6>+o
zY3VbgVKFTv%?Uw@d)OlatY!v*zv+^f>li+m+Js9hv>ismta*lrNvG#H3n#HpQA5f~
zyZz87w{b>0U5k}Gzi|tF5J3N7=%mY}6j}Ni?qiSBYp}Im!<Ye@^&^^RMEx&in@1G?
zyhC|T)a`2})`{bPxX6)_N;-V}o}H<--UNMzPCL5msYl$QG2I^)YIAzn9z6;8)pzZ%
zB2LupCT;fy6~?%<>gk<8fS`V*z3=yb{^#KJze>>U8PnTKd%9k{W&e{9cW)2m@ZL+K
zgA>8PL4ntrsPT1SJ9a>entMz;#s7?|h3aLjo2on3idgM_+WW$}-o(-$!o6^A7fkjT
zzNtcOiZQy_Nz6BiL+JT|(j`)8(UE_%09IM0${b)?BFH<4z^yB^z!^Ow+4i(}oZcHX
zS89^-;u}hNEY`(-x!zUTiJ3k0W6;*q%pU@xN}gBGejA5OxTfcP+hM5BYvg`4K>BN}
zOx@Cfd(SGjdnqL{aIP_G$vBMa7qrgun$_IbASupm<(1|!6U`HDh93KPejuZ#`gb6v
z@39JIicG6@#1ub$t-+yH>cFCaAyL1#dnan{jJiJcFWDVkHsl(kvf!txz3(AJ_^q=5
zrx2)EHPfwX#^fgB+=Fn-x_#qFdD#O~n&7w{=Gx`1M=fb4_?!$nQeb=O*tMq~x=5k|
zKJ;j2{9GLp>UW@`4aBpK`sfV<5w?9%xh)?X>EwE^a6qBuR+gDgbP6I*YZ4YAvOHk6
zIcejS0(WiHjm|32O@ZDF7qG7U%*x@G6qHK`BsciPTvW7I{9Fm5q~~^c#><vArGcfk
z%LO3G!nH#>C7rFIb*7=T`VCClwf(#o1uheKoR-kJ5WV6r`U8}Z&H4~nP}kiUrMOd>
zqb^%VJjhz1RI%&Rg%Mknt*|Z+u`-QVnezE)5&{jkiqlq^AXASG%o5}<{oUMd+1lXT
zhAu!*zCvue{K>Ciovd<Es)<Ml)a*fVpQTv7f5@;K4wCNDNoR-r(S0uy(FdojTqn-5
zuVqwles$>g(8Nt4WW**Ss{WzW)@8DfoY1t=bRc8KIzs#@B*C)w>657r{IJr-;qGxW
zyTvS2fDW9i8M^4<jto~wt`Nnp=~x3xJCsg)ar~-1T1y<Yf9RtBX}h>5=mKG>1DC)x
ziMD!OB>a#b6*2Tq87zvM!BA|S`X8_R<_b*#{r^By54BrP_6cqXhdS2fi*c3-Xx`#W
zoId_NBr~BaK5;Aiua<SZCjOm@Gd+!%9l-CLAmUL2S(zcxUlXL{bZEKdxVdycU~Lwt
zpn?olP29dADu*ef7OFkKq4jyL2Z}zOd?5YbyJ?bIJ9dvNuOS4WR7k>>6#kN2<c<9S
zlgo?zo~pg46&RV{XY&Sl4|oT7jrsUBW)(xi9Q8UeFnN-pOnr88k2%#8eOhU&u-)qj
zH3)5Mj(!%D`A*A)3=lMb&e~5rhcv<%QH`HHNpJx+fy7ilWl*@Suf=y(ih)L(M}pFo
z#XV|N5(R)l0%w7pO>ckcHKnGboi`tk#s6ltsjycyl^>-9_dGYP)EuX>8d35kH(a_<
zc}&^Veqyg5Oj36&3E8T2G76>J+MMqHY2&SA*hBboS8YUX#P4T-fc!rFnZl;)^zH@y
z0|g>c;T_or2GMT$01<NQcym+nK&H>K3DI%k@h{_bHU8?MB`Y>^Rupy=GiEui-p$O3
z{!qZ?7b;7$^cm6GoK8d_R>Nd-?MblEW`=d@(ek#(?ohwV><ErMU34ST6cU&=PD&px
zyPi(Ftu?pv5py*-2s<VF5VfC*Y14@AH0Ed@L`3wBfDY7%`O}AW02N~cH`#Ai^t41~
zo1zzovsV;$wJld>L=PgeoiePMd0Jnp$b%!RpS-K@kBWj0eYn=-lcU0O?hnZRp2;Z4
zNonZ+;>dX=S-np2pLe-ZcZy9>lIGK^60{2EOq{p7q$F`6)bIR#M<KA20Klij23LG6
zy@i`CjI=-r5X57@;a@KFv$Q70DM363S^AMaC8a7nj#zgy`fIWs!=Ok#pEY(<_HL}|
z{T4~hFL#|&s3rcV|L%(qHP}n^X~L#(w$KmMflz^kzW)@z64ArU0JF0OCAAK_0Pr!=
zl8t^eV)wE6pMO0aSC%5c1vZ|YKIv{jcb-EgZEX`9^re5=>_kaP#Q1_SOa0bak9pFz
zlO5jn)6vOh#*i0bJcW>*g0Qt--M?=sKU2=tFHfT%I;2^1|LJ7m?WR)&EviajdCWu8
zp2>2Vy@fk`ix1v{Tg~;Ph3ScgiyRLrmyAG)qY$K^E>_Zf$n7oZP_2BP_|cS%z88}h
zEVHabZ3SM;3yI2mD4w0|M7-@biWIV}VgU>EAg3V8Bl`cAY?+k5eZu`f74qMtn4CJ&
zapaz%<B@wu#0Gn?56}_l`Mj-BMb>-IgFo%^3yZa|uSbDlz<OX8aJtZ}_;r9?x+5?P
zOG@y0IbZa=JYn+|y5EsMhWgXt(Y^iP*&2grBeVV^0Y>MK2OM?e_<Wn4Bl3F$W_w-h
zC}OS^spB8_xnJ;3$lQf<#6N^#$Mzb?G(X=SGjaTC7G^eLoB$aQ>o$Vr1t>+Cp($7P
z*f~|MYkOTtaAP8pcnPe0?6sN#01F^|KL5P$P>zZXKUc4nXDxL<Z3FRvefI;6U*%L+
z89*y*ItDqmd&x|B30BXI+xWdZEG^-&?3aOSRS1ty*-^Uc#~u{gXb-oqUzSye72ns~
zb8!QzRW`Ug5Xldi6q*x-do_grM7-CZd#R<K#B^5WN08p4q?Z8Q)8x0rG`bQTN$a-O
z?UH3Er=!19>q2V0A_CzsZ3fcLy=UI4NA0Em#)Qed%PV%ZCb#R|ecdT#26D}P53G(f
zU@tv8#9U2bG2>OvB_TqxAm0}3^w<E;3@3ocJleEeJVcLlI*~@OU?#9&KUm~_nUJ1&
zQ?_B&95P-GlKy5X1cb6KdA<u-*4(TN)C3&e@%9~jXu63u4y2p#6vJ5_D@d9}v+AE|
zX9{3?6~iM|Ed}Z>BQYx<XT<|?cH*2$+qnXNF8pDZf9-o?#E0qY(CIkYfXyW6{cNA8
ziJ}5OF{5tHo_=c<iin*0x<|%U@$NIGFREW=s+DB-gPJt7Qu3wp?DFoX_!#qHTk`HS
zW|oTSnuJMP86UthJZOhXVCGZ|B{a7^id?_5M|4;@>Yj<SAnUKx2;7>b6SJle#clTp
zg2}0ccfdJ?W{<{gmSDOCuj}sdLws_DPLBNEk`VJ|n(#OIV15GKe#sySDy(t6-ZRn%
zw*GXj0w>f%jOSK}kxlIM#=>_eli)EHDR}2PZ99i+8LkcEyWtW&HfyI~4gEv8WXgGY
zkAw@^cyZdCc-1ET*6p#Id8>?|G0srtYf&ZL^*>kBf7=uOyTVhfG2@Ok@l>|*13v*|
z{l5?6&kX@j8J{wFcI1GnF-?M16n2%LRXYDvwN~}PmSgR(2rLMD{@8BJgRx?Atn!*F
zgwS()7##?C1{799K^~0B<dUWMJ2YEYv2Fv%>sNH(g`ZU~bYUML-%SNnUq0>I>(e{v
zlF(jsx5h6q$HJ*l!HIMs`6`fn=c*u&6zFL^*nW>8BbS3tN87Dtbg6itChN%=dpffv
znt<Z2{`C&!p*n;7gljjdH4=*~mgfY8G3c{#3B4p+qHwvw!R4r0YO&dRfY%#d(a#47
zM@&4hP2<D*Rt1*h6%}nb&t08G4}6~;oZ%i!3p>X8=i^_~(Z5Ksb!V1km(D~aJh5WO
zjlV0^g9;Vpfziz<*SZ|3fA3}0(k?<e%xr2-*#6wCfjw3(O{P-h;b{jE*H;jx86b1I
zr8R9hDE%YnY4Hq1*YfM*7k&4<RJQ~s_l8k8>gY;Yp1RS;65EqkMn4=nN2F8{cB-V~
z=RVl*df#OIkycPF=jzHGqF5#Zow-*qgGzS$ctQF40XVYXaZ}}bF=~M^JLf`2riyPh
z`d<W{dy~Uh*=v2SYeFX+k~@BxEBmw)HNczdeq~8VNe)J{0O4z;7Ip*TbH-3EhKJ1V
z2|x(zzpJfM>&TSr!&g=dW9bp8qU(V0>!{D#ODTqz;dy9A`kcLvgu91<Pt*Qv;UOoW
zN;U1G15A@vll+dBsTppm&piKl+KgS;qQS)U(TN5W`vlVmiE%mKx>>We-#SXqxo~eT
z2l7PnjAB<06$ILn=*-#J31+^WfE&RdjV>w?XKgfXbQeD=&2SI!Mm6n71e40eRa>vB
z1IR)Cqk`Fan;AtLNQzu3i5hZRvjnlDHzx&|ctml!)Grsw88n-lep{kvH`LKY%oP8s
z2kyUK`PB>m$hoo#IzCbs_N*kkLM#%!F@jI_U6s+aFS@w$>%)XTRsFJRoO!wy%tLqF
z%zHg&Fs<Ltk>8)+F|$A1h9V!LkOtGo0V=I)2xz1&93)y#{hIX6ukocBRc#G3@76C@
z|4kb7|Ip)HQ@eNm+8jVqumX_UmpXQ&VXajGWu$CU;e%|_MM*EEU5qt>G<y~SpV{nc
z6<HIEO$`c3FV9o~bB$9B(S4fe<LG0}_~NKJ)pkfP`W*~%VH0v1;(g9xxV0^Q-SeWT
z)G%9g2p~egcyv#3I~baz7>_)mtA?|$?t|FD(4b7<)!RAFXZNTk-+gZ|a{SX1Qf-PL
ztcK^Ix<3jo*2<4wtf8c0#*q0_BMDgm#s1EzaeOGj^9wo@PWBuM$7&T@u@OS?UxJXB
z3Y2R0_`}$WdbOhH=s9VKon3-w_=VH!EErA^4S;oNRpth~tTPO)v(#XgL<R94?rL~0
zo$Q@(#X2ms^yE4g9#~q_FDos}A$0tUXk;)4nO-ye?%UhEDdL^+m5w94T+2`(*>$Ig
zTyTBN1a0arEla~u`-K<CFrka3%a!=~eJM$cKMop;S$@Q_zM_o$fJe&K9gXWbr>rw=
zBl_U9cIjYHCOfy#m0K3VbL<3*KYn19jWy1+q=d&mW>~r>0qNpsqU(}=n@MD6-@Qc-
z@@Rjp8(c%Po7>(RDTEMD|2$NsO=C|KBj;a9|9rO_#r2`z$_thKa#ZaRE&3YtYtYzm
z6=Ec$Nm=Mx%l^o{Rvt9&4FEH#gp4kbIT3>gvl3c0scSPOhzsBDEMif}uPZ2-i<x)(
ztQeromUgDfMLYcY*NW3cCk<(@d68JCX%o;||D7ZKr(xLKbP=|LwGVH(d*j|+t6y>r
zl5kU3ICLDqZn2<;HZMNiqcAo)z7gqY;QIi0|G3n=xpSJXY;6XGQin+&c2Pnd3`v>3
zHtXm%Z9@wBK^$%otmO}dS5PejZ(B+i3G6CO<|-?VokD4~lfov0h)Xblnml?)>XVDM
z*|4*i?<ZB2sAi_c(m5S9xI9*}wC{r{2>!K{hKed{>CFrk{vbs{!Q8akD@Yn>4w7&F
zLtck{-)M_%TPyN4nA*IUh4Uh2O1UW~-!|q%%NqZuo8jYC)zuZ*_5!QrWRlIo?lWFH
zJa?S+x<Cpz;a+$W>xsEW?HVZ9Bb8ZMzF8;~V1BChg9`&xJ*qu+TuD5dG?ei5u;oq3
z_UNobaPFHC12J%9sa_ZR6S*217|L?GmD4C#^%&h}pWqdpqH}LY2}K_f4g3hK?Y$(M
z#RT>3+P75L9$c<gH5=}?<~xh20JZ=t&pbVotojetyEh|5(BQ?sKN$}y6^5>4`LNGu
zRl1#?QkeE8-pda02kX?!q7HVJjr0UmW~-@r_7o^EIZYMmkJ_exK`y<ijynpTRat_f
zAlE338S%{Vu9Ah8SZv?8hpuW1{K6GnyIw<|Y0~UmGk7lAA<~t7YjNMo(48us3Du5c
z-!#Q3N|sFoVYeQy|Edn<=fo=~Sn_N1(NnalJ3Y)-JVU#*TKd(yIcVu4Kdt^`sA8OH
zH{~ZQ(q(5NGD6IyqcFajrS^u0M0CSa>*b)lrXy*UqP2VW2!}<k?Zx_luuzY=Oz8$3
zC!K7sodI!B(W8r2jP`1^6A)T?IpT^-bhbT&7q+lgK%y#1D#kp<VdiPGa|L)3Nhxa4
zF)UbJ<E$@EL=6D%*ZG0Z0*!LK>0NQn`n2Vp-oay#wlrvHfT4MMbDXkonVhX{;;w{>
zA04_rW}x9TTiyZ6xs;G6FHL~!9l{m);CS)ZO@eY?fP4A`ctc;i_|~Mm$KCVlKncU%
zU(NgXv)`-PNfvQ2WA*sP>y|G<aZ6&G%CZjRe7WnRS4)$c+<ql~O$L~ok|fnTo9}Dw
zZ$e4WGqd1k;r7FX3+$c2v@&s6MC|yORwvIoVKLMW^m)T71wkiJ%SL_d))d}9!f^36
zY^W2SYeW{QEt9!v8`hxcQD{|3eYf<F3enf0{0#8&x8MCVztB&Ht%aQ?m%#RihWF{D
zPJ(aWlu_T5S{5;FeQ9C&>2zoh3UAHumnBYJ{$ERvc>cCR>2(t1z30!6N1o4bD2{?E
z&mzw+3g#@GO3E<yT_|kF{8otE2zZ7j`3laxG5R*53TTE(Y&v$pluC~CIRZ(f2JLZ|
zb0_~{Y@tL%{xP8}>O(<}qU}RDb5UAAvDiHJ;n@Q4rs$(vNTRn(_@6@~0G%4Rysv#n
zc_Z?(X=kXLn<kMAWEf@28DISiIs1Z@8RLgw(3{-3VI{=d_Kqu2{ECGfIxYHY4e7LH
zPqWGZY}k-qE1v#7F--oK4*9E|*`lgRD6~ANp^?3kKBpMF^G2L>GnZdXk<2xe0wopw
zIvSE$O+B%0egsFf9_7%HZ{ebMRTA_PEEL@2-tf}qGre=Vkx6!xw6aFEwS%sEPm3b-
z_(6}kmqZ_94A_K+8>4aby+OT?;&^ebOIPo+%7cLoiwQl)6flE`M7tSXD00pams?mE
zk!;Cj6ipVv?ekvJ9r0_YWP87N;pe{i@u4qtcEdZN;E_pD_@%npj!KSEH+n4PW+73a
zz2SI*dqZLv<=qFt)zT*i#yIces#*jA(KP&`lhdQ>#mvpz(zf4na5UxN3Q^Tkiay}r
z;k)k8`GA*}6170VXGbo<QN|D*EEPHIw%GcyQ4S*-((_X+Dn|wzGA!>dCVxE)Kxo^5
zmS(+f_xs`CB})Tk{mFB1uO4Cmirv07sVOXze(SOE3zwf<)S~J7>R<`>dO<}=P+aq=
zbfF=G(D<qP8tE=K61SKGnC~5TGz*7$D_SsJoLt$KE}5_t>k*23Mh;BjEiX%Rk^X4c
zIhh^BrXa2iFDg$N0YsKU_0w)j^mt>k0mU;=8@|SBA^Y(p<!|{kz6pOJ@XHBCg#flc
z+!?g~f7F@(y{L=lA81dwq-pZ_$$aL6{P{Y!5wC1BU<lBw!pL8y`3L*fymFZXrXu0J
zWvPYuRnwW?<7jP&Hd=2^HISHkx;I~i;6v37#l3^c=NICE@6@-jR&Vr0P#dB#+p15^
z&DuFP=VJKJC*B8~pkGP#%;NayN5rQHMm#7Jpdp_lIm*I{?Y%f<2=&#s?M!WB*5kWZ
zh6)?!PXMlTEhwJW&PPelCPc^*N@mS#=IfBXN3kD$%w(T(T*JLx*yMtsmp7>GuGcJ&
zjmNjby1qLcm7tC?EMNZ(xDmQZFx~S7Icbh?O;z*ITA+CCqYsT}hUS%e0Agv{0L?KK
z_;5mmuOtzCJyifJxE5|+U%KNv#i1Rxaue@^vrbeUnohb_P<ZF)Za#Z=qVS)<uHM%R
zxm^xJ2{<Nw{9Tn0*_`=R2R?)=m;M^kOdj^L{-#G@WSoen*nhW+7H+_q?l($Q(D+QC
z5nRng2`Mwrl^D$}RqNcFqK@t0EF`be!}I|Q`)6D(PVTHSWZtdf-&0OENdQX+RX}sq
z{yUPTA7obH@L2rdm8Dn}pu4Pp@x5$0zDe6|KEBB~+`vr<P%&H?Q?l}&RAf7EqNl|-
zv^&8l-8`9#Y<Vn)c?YEwt?h@)1!s!W)0A~xa~4lF_zlXC`L4vPDs(ussy=12*@wm|
z@n3V<Qy_rOCRfW}vD!-3%r_TdmeOCqjuq=B`az590fPZJ=<?tlcJ8}%l{ezNG-7@(
zxT;@^qLGHCvo;f%I>PFi^Vth^_v}9~2>~8X;l=brdf{Qk%XJx`%+^VJK8!(_UU<ql
zfN&d;P=+c)X9*snSPNx>x4_Z4uF(FUEE^EP;PTR|f`*0o$en(4JNP<AO(%94Mjzs;
zr5o!z)wdwtt@Jb{G%jd%f|R=RSK}{NAU-9I+`7%4UJbgl!10?8UQ*kKQ>;H${`b`A
zW#-$XO&G2Cpn9WcR`g(wTCBv5VtB0jeSf)+z-ty#cLQsTJ+s#p81vfkfbEiYhN5E8
z^rPzUv4a>o8L@yPMp>dGrD@BP9he)~U$9vw9M8Gp2UQVciFwFr(|3grE~uUnEW$}W
zFY1|HA5w&t4979O%a8}?nfCO}8>*?;Ozd-PoN7q+4<x7$uvvI3;^48YvpZO2qr>_9
z3>A>WxJKw4q{+z9y%AWp%Zf;*u2CFwh0Q%&m<>-yZD%F6@HRxtSwyXRlqZLwN(KRl
z@K^zs;g`RK%{cb{=NpCx&V|^ZVljR$0U1NQ6k#A(n<zPMh!{<OqILP#w@Oh^-}xfD
z8pMQ+c;T%%V;-in$SA%$Jkm%9HBXnoeEMD67UJ`Rme0$mUraP3G0!|MXz2tA3NQU~
zctodzNrv<!B#tY)!S*CQ{9ag=_7kjqbneGO>op<afy>mfc28?x;UVo|7O{G)q=b2A
zy!STJU)H2a#Si+?bvINr=4Y=oeD!*$<<Oq2j&u~Dt?@Q$te|o?zgaSP!#Xx4mOMi$
zE^)CL@EkS$4ZkTHr^gY8?bQD17_qI?`m1A|z;LlHUvexbH>5qX(IC4fHyOp{RyZ77
zN6&R|swT|64b&W?9zB#p{FV_XxFyADZjDjt*o!wlHl-hPX~MlGX@(L|1e4YC3#UzL
zxw8+tYeS(qx$wJ7oY3gfaxs~$80{u0Oy`aI3Wi^>9a~&krlIYv7FS~Ip1LZKg-LrQ
z8#_S4XChr;nJY|>t2Rf|T7r4x=5wbe>Bx8H+}S`H&l>ktW#d>+U7N8n;$SF$v8)`#
zpWBC<${<RzS7apTm{vyxYZII@ozpMDwD=yHA-%xNy^Ne1h(wjf4W<7veONPK>A0N>
z-|Qmu_g@E`&OTZuox2=FL-!xTj1{}arS&;A)3^bgE^A8KAl=30tC2)}Ej^;Y)PG84
z{9StQcQ13H(9o=57R(&q<k90wu4VE@i@RejaJuM`l9bs*Ew#pUMHKM=pR(repiVUQ
z?&I&@+ZpW`Esh`$A4;7qkuyw^s9JHB7<J4fX7z+IzWS}3syEhi_KfrQ`%+JYo_-XI
zE?>CZ)koZwM|wiaKXVc5hP@`K$w+frJa^wDjdqn?R$TPFXdcs7VhFM07g0L~^yghB
zZVzirAP*WMus2l0$VP)Cg+j7*w{l)I_C7YdJzytXZ}#?kbBIjQC#dL*n+9>7AD8kE
zjfUv~XN<u0t|;|?ypP(iUguw+uHl~(qoel;^St~)H?VHL@eERx!2Y1KcPFrDeFDxM
zv2JXmhbu@M`u)GWJ1ewI(H+hMG*~}bcs)+=h3i6ovVf9iw*`Pnb(%d*y?)Vzyt<hS
zlr=aqCuUB<Zm}&&-;6{q?^A+{pD^o=8Mm*Eg~e1Ff-T0u%z67@wrLW6qpmoedW9jN
zgc3_Esr6ZJK?z$QCL$IqHUPflG@o4CxAc%phYv;yFlsyHWpv5#vn!)a`A;}Rj;pk=
zf%H>8j!<wHsKKwl!yW;QO9sT;D#De#i8hBUY6<a0S9jRT=Z^4#D9J^wYbzEpyuozM
zHZ7LmU?TIz@}4)7oV{vzXr=`b>xJtWCzZ6c#wwe8Q!)p^R_Z4C%PK_vrRtD-hMV}g
zLrM>K3h#H!PwGgfOqTnBLb2avWQ0gz63VDJeawYr@(SJWBA;g-Fa<;D`n|vD;jiY@
z-3bTkxC+bHVFk(wk3YXkKWi@t*tv%M)6c%M?9Mv{Cq{$cRm2{NiL1S~<Kkx6AGm!>
zJG4*ai~g_!2_ybx^yk_mP9^M5F%y@;e35L^EvuHe)!sj=tnIzUgWy&;o1hVz1o|oq
z5{kW*{h}x7<CKt3U}x@&;e<nmOFw3|yWkdhldTpXM%hRlrte!FX`fR-A#;TDzE{@|
z<VZNxW8-+%bexj*^{vMobW_=S8T7}>PtZ?s7HQlGwdGSnR;%%Nul$yG#caPfE~On!
z4f|SW)9N4MzoG_T59_~@I9_2^ezRe*X<BAOL)Fz47(a56F8=rm&n<^9%{pyD`!qKm
zIdrX4(+qYaz(Jx~{44sQFHlrEF&`rTKd!d_N98r9+Kv@>+;npYp&0!P%mQ9T8liiC
z*rUHk2XY9l&ww0-R1L+H{!mUSVzAFSL7ty8gY0m(2Lo>bwbs4JMwmVos@|H+%5Tn#
zJ67|VFNzmu?kb%xm@nFe0X~k<aaHt!oFp}9cCPwi-P+-#V2(qZ?^Q@0uONnMhW3N)
zaqYVJr-3it*);yK%gIc$Ej(OL!wbCl%hMyj8=rD7Zu#xD8i5J?W8r%@h+Ujz@27j~
zI%ZbIx;7?zt|kfeUW~vBARi$gq;E{4nI8+S8Ayt6;)wnT_9;z&B=g=n!^Ahv?Qo9T
z?(qw%m<DbDf}-Wi6-NizP(qSbRw*#hSe$;oa+KR6<t6PDr=eus=l%94@DP~b3w&6`
zqXBNL2_Am(Hu+ju9$3M@+26fvf>>0rDZhA*et-*Zl1Z_a5uu*!b4_I?$Ch6Cu9+RC
z7y|}ouMu}xF3noy<HNt%jG&KRcl{cZ3A>k;X<q9eXut7Y%I1UL2|TWna2@UJfh-fZ
zGcNw{HWc((8#-O<j%!zp*LOKDe~Y+a7G^*Ah4QoNWcRu0Qf1JDb9iFJ%KN3a0oHp1
z;6{J)5?0E}<>W_*K4jh&@`aoCxE6T7bC)=Je{(D}p4S(Yv{+pTVqDewJcNqVAC#Bf
z*C&pI<@Gu~+!gT^ut9`jIE6a_aB5be&r*%Q;xstI8NT`{YY+zFml{BoHDuTOWOe(y
zt5T2ySD*X$Bh!w3`KTEi{t-8GkTXs<X(dGv)81M*kBfhQS#>D%(m;NKd2VIjecxf-
zOuFp339etSHac=<#77gv&g#d&$_Z&uB4PlvrP%0N3H|4pLhrsGy%Gp9lb^1ZgO|Lv
zw1T!gaW?tN)>n6eRv+fS4hX4O1|U3o?rb>!<SnzV@`pL!F3l)*R89bGBfE>NT`Irs
zL`<z{<;7K*XP=n@6U^zmdY}gzwJx4nQvhcX_K!$eFyYhgh^agtG<LRjX8PdE^`-*#
z9W1Z1?jkvR|Bc(%Et!Go_9^<QzRa!Z%`=%T3hLNi(yFl~$h=h?Q3dPKu#>GvHz_es
z&al#dj?n0g4m&!nZfF!~N9CPLDCc1BeAJOUNTy8n=})&iU#P42{r^77;A)Bv9kgU}
z??^}CksW(<(iC@Dk%(J?Px~|P8PI>I_%-IY5nwDZtuS68m#z)P9*^^*GBmX9LsgGL
zd^UsXAv+-YkiEQ9Uf$T#s+abj1Ujs9vcOlydUQ2yz(%@821YLy=3njlO$4MGjR3ud
zIW-FPVB}+2p_!rOWg?~!`NC_k6sLM4RQiG8zT?vD)lu&rrs#B)5C6!Z#grvcG~49&
z$OmE%RgTLvcy;ZezJkbh^urt_1P&AeZCdIq%cG4j)T-0P>bJG}^3u>CkfQyRm|*gY
z=WFlS*{AkHGSj0PFa;Jc#7}sPd!v@1um$kd?W~Dv)_5L@-Sn&!@m|9>LQEO2v*F<l
z(h(#V9F&2~OxInz6E{90$r%gcFasqJWw`Jw0DY|$I)iK;1lbuqF={Csuv5}Gd*XH^
zz0{QYYJjpCNlCjYx8?EN*8CG$lA8n-L3muA*z+ZQJiiNMrWbCk<9r+AS3OhV<062*
zh(9x1t}HE@<QAq3MpmpubG{yBW0G+rQ3^K6$Ho+L0%ehEg43nvbx}{R;d1Y28rEuB
z%uwb@jc7ys$eiP;mv``?R1<?90gDehYrglzLWCD?N&Tm$V%Lw3{g!q-TO|{_^#Bju
ziggT}-4jJ8tKZ}8Q%Y}^R<0mnP2(_&TE0ym{}&gstEuSW?=AKWf8=$F{+}!2qUs-0
z)m}==8vW7lN;uYOH0~Lb&~+nYC{OK*)1nmsyuG0O^8V%)^A$2DH!AN3@B;hQ%%xA^
z4IrfYy%G;_C0V_#y>&TYUli1=$IDf1fH!f~k^e-W!TwMnmN)v@n9L#Xtd6)YO&iTs
z(Oix4ujk;hL)DF3n=DfCAz@4D9HlfF%rZ#yBtu`9d!TvQZ$l{np^&N+(`R4yvEDV3
zw5DXY>v6F@T@tSK2GO=DlM9s^E_u1zFiutNhkrE!-PO-VE6>d~yN?g*Q_K^WJGoIw
zGGdE{=nZ4FHTmGjYY&V9W!FOaxz-Gq%$Ymn#koRjN%&X@=~2acd<@;ASb^nn-duAv
z8$M8I>}!{M-IaB{=6_FoZ~wSG@yf>@hR~iPO0CYJXb`iQbI-5Skoo&zkV6ptJ$lsB
zdyd5TlHZ&1fX9v-9L4w7I%4mJN=A#x?WAX|0@Ur0%>$uEPk^7R?#`kyyRvlyQjIc2
zs+HQfJ9_h1k*Zf!>lD-{P=8TG`Gd;H3UGuGWA%LQbKKT#g?u;`gJGWI(wN~!2FBLL
zRHIK1O)6CrZ!5&KP=QWQlkW$e;$IZA1<O(ecpI7D9pgU)S95kG<^<*<v%5*a^M9yh
zmK-q+0cBf5ZY`1X`#wOL&KbX9BMzmjmT85n&NOE#GRN&SwCSb#o1U>=c4bgY#pZX2
zDihVM+!_vY5|!+7&>j-Iy-c89j${3(qaBrt*63^)uF0%>5QFVxHyPw}I|fEzL$3GB
ztG`JU-O@IM#V(sdZ(qxIO_BNzR`pSJ6A$SjVM<>7uQ%;<Wv!M2Q4xAt4g(WA{lId;
zd*~1>L7TzM_DMK;8BZ5{f&u1BPwcXjJ@vw5kXoY<MHRLTRl3<Z@K#;$@|L=K_Wpfu
zRu9^QF8It{6h3jSn(s=8ifQn#<k)6eMnAszw76Oe&WlKHED^`#!<6J=u2Uk<I-20O
zpy@Xo(O2SnYC8S7B}l?e{z+(}EYzN%hV^Pzs2Qdtx!A1YVS<OYGu#w;N=SdGQ*}Y~
zv?o;eV*2AxmT9tx@`7j@J!gURpiXW@DdJW1-~YY)n0wN|jd|UhcvEHi)s07-ru6hr
z?lah9-E2xINB#P+H*4Kd!W1hw*)D?F(>*(yxR9Zt4d<~B;r9;eSD9wlRN$LAqQ`Pu
z$`et=qMBwP?e?dvZfnH5v~!wLn+fiBW-hRJPmG>km8PTuii@j~vIA|JX$oC%sI197
zoH2B9VD{|=Zp!p*TbD`oU`dn<0X*5aeAYbugVOD6bPP-)UM5K2rY>@FT2#G+u6ATm
zn4C5ICi@ZwlSWHU6pT{X+*fy=PP}0Ua8szYwpM_Pn~$M=LG;uOB$wtCoKuLDc&z^a
zs`W%$d!u95fxiOL8p@Ee1-LoJ#-0yMQXUO=Q}sDQJyl=`C4i{f=w8up)@X;gyIFn_
z#c;dD!U*iq#0ZyWf<@8^{c<JO!s7PXEnQBX34Y1zzWJOC!!3NU54OiLlg^uvUFWhr
zn;^B2F2|FT*6)GukJwYnfHtTTu%f}qip*y7^rn{IMvApq*k9G#NV;H!&STcjcu)JJ
zCfRn#D7C-g1un*k>NE;Au1AsV<@r9ib;ya>8pBkTM2(p)52}S6uYr9g{7rn<QB+it
zXujvTV|HdoSqHp)Zm30T3ZeDI3x!O`CoYU;b}KrVsGERDJ(iJLFfHH}kVq}TrRi(i
zsg}cUdus93RPuDSrLO$pJDw+AiVVNoE1a&2I~pL12YBX3-92~9t0GE3rY*F~4CUi{
zRg!vhP_jQ~H;hr#S$Ywo@0144syd_obx^qpSzTLHrwua|+JM(+teNqj2PLIm1q5im
zj;4}!|A7zOsQFPG=luMF8o(WyGyLp^+^{vAacIap&%_;Z%sdTLo^h;do<(St^uep>
zMd{YpD+T6($T3_(TE{ppjn<HE?GzM;WyFOBf_d$hM<^x<q6&AVBpKyoV%Rxj>*lBi
zH-LVJ%0dl;aCTB~wr$736J?+`2jk{TV|p-rB&{L=Pf<x{ProSE?Z%h7_Tn7J|6x<m
zwWB~*<yFBxqu6hl+KnK`nM3Of?UNpjZZ;mdLbR=*b0p+@x3zpxF<er2QFuH=87ezj
zlrql@FW#I)AgxSbxvq5E6Xbyhmn4-_lyKS#uMS+wth@v33A^dTuV}JB<}EXALk-63
z;=HeJWlfiQL`VAmn-uup&B(vsu?HwN+=kyiesJ$c?2ql@UdQx;Lg2H2(>Gbb2l=Cs
za+_p1ggl>m(<I7n(3~@bvmefpSJ)4i-ib!&r8$n3KbX3ZiDw4W&|Q2Njb+6n-2DoT
zTsPH~4j~Ua!GcG6e)H<-7y)!3tI`5OU^KJBC>Xj62s6|vtr*VnX3tkRg31d^)>n+w
zSOfF?y1{i>ie)gNG9~?XEPUE8`F3PJzw40z<{N!|7#TtvuBd<oFvMNBAT~)8mifSJ
zQyfk2*G!wQ7z-j8?r~`wSSW8ytNIM<5S^rl%^0v^8g}eLM@xNnq&B*f+r@j|3>-i5
zxGNH-O{p_UcgTrhm*9u!%;p(bLhKv+UMTzV(gM}>M`!JVXh|`QZ)cr1y?_pqu=;MX
zA`$4DRc<qD(>O{EYT1yGOTX)H!Lb0xg}<qo<LfRVUFpN?A#*$wxR#Jl`pGvpTbpgi
z_eS}Xis*}jx=_XUm9@&UmR2rRa1u@|CdX-Ad|D#{o{fs8y@4XeST2;wNE~xEPVro`
zKOu36t23EkItVCNI6)q?Ah_aJRlA+aWlr+<es%$00G^Hg{o+g=oXCdmy)-m-g7_yP
zqS*$)fw7(FncW8+Q}fW2uptgJ=PS~#C~`Ah8dIf%h~R84lu5%Ch4cTF4!wmKHp#Zk
z`CBg?ZxY9GfAdSUpWh{<{d4+gfp6B-=dEYV`EfhA9W`bmxqdxviE^GDOxKG2tv=&J
z@Fs37;}5`fSKl{W>@b9v++%z0{$CZkkXZiAdTo*}ewo7<t=&av^AnZnB+AB%=jDm%
zpz@d3NLTLPl#QEMa7YP1hE_}4Y4)SSg#LI}!K7J5Lnbb>1tX8`o&-<ND<Ed_r&ey(
z*|p!hmvaj8cW!=!-EOZcSin&@Fh2=2ag1=o(FEQ{aorsCvdn9n*Ww2RN}dp{?+ySE
z;^w?JK0yO$@zGR!mU6id^y`0_v&*0Sy0!9Jw&f?^0^2X$8ejR(&mn3XV#2`2-YI^&
z$Dm0D9xx%*mrw7fM#j~P6imgA)K3pJ-R}n<$T`!w3xVw{-^9$Oeg~Gmt+l5Qna{yz
zka{!4iEJQs8WmrPUYA@x@-YOrk~eAT5%ySm+^KquPiAPQDJ;Kwp>DM$9tj2F<+;yk
zo(foZ(QL`Wosd5k23?$j2{!b>_73|u{g&3LhQ%$bm+nrp=c0N}(CA``yEIt(H%`L8
z@9_V8)86Es26M7v>GC$3$oHFX_XLKf9KpYO>W;m##&Tq^9gxHWF{Quc0~R@P4ff(<
z>qNLJ7$VG#!^VW}sfgUcl6JgQeYL3|bt^1Mbf<-EV(6BH(HTmw^}DBVa?qlotl|!S
z#piXGOc^&PihfUrHG2`6h050JjxojIN071q^{J~eaX)SKjBO&FuKsP^YG9=R9GezF
zO1zmXX4J$9r{9t6p%}xCE?>jYsw#f^s6EAB)z&_<?d8N^U4QL-*?<ZmQ{}XoM0_AL
zQk;TZ?wMvF%P0QYdz7sZIjj$*6Nv|inJq_jLN#j^`O&Wdy72RVgn%MfhUP|GH}nLl
zY_&9AUW2Fv-z|tcguAn1)aC<LNH=EOTjA$Ex~mOLSFU`Tdt<LUQ5QJkxz{6?&_c}|
zpmBx<S<E_TI46Oju&;wSPA3>rT`3_hoe@@O4f_1*O+y=s(O1>ek=8#W3Y?soyZC8L
zf_M5bG@B~=Mdv@SjpDVv{XH3~?##%R-vQOX-=uF3Zu^Auz}0%v?$X1k8`7Opn)6D~
zR0{}bwM<-E9z^T!!I|!kZGC05b2BuLI;=6rUFoVq|0Pb90say1bK!<%InO%1{H3M5
z!#DivElD-35iU4X;MZYt1nNs>i?w^EIV>fHc!*LXg80ohCVNX+a~HAM0p%}nVqFdC
zqVpFmovI9cf70{~w`63+*P&>8@jopkksTR99xEXy1aVNq)CzcaF|7ktxZI(lDPa=>
zhzz6n3wyZ909{5EEe&I%!Cwz!aXC`sO1><JgVf!OZte&Ll;d#(v3RNn$Gv&TnPBmc
zl!=MyRwo2SZyV1APn)!E|G^mM@~ZKSj<0=qcf;M0{|nwJ^gX;a^Xa)XVC!!Zu8;1j
zcfIZn|E0@Q;VVPV!?sEq2aM65?HOBTTVx&0D{Z)`6!WdW1eK(OEstIU<AhYx{-Ab)
zNIb4+s}JL#TIe6_oKF~O^G?U>bxwS!?)$Jh7U+h3%D}ahN?ZTxtnl#2w+bt+^obT|
zGe~EJskXvqKh_V1u)NR!&Iq1fKq?ZW4dv3Tkd0?`V1WFJEC7%nWZBcV2N3mZN;}_R
z4te#&$s%IPN(ti7)o{wroYnU@CM@Ko0h=7Z^y5G`;=&P{yj8%tDo&{vSjcCV_<5~8
z#i0zs4DROUvLm9iO~KHK4b+*50tET>-1<A{>Te&#zZg8eHurWOWSVV#QV_&KgS!>+
zWi`xGi7c?N05zYC_pP3;^QnOBMy+N5g3@GjfY9zO`AX<EFZ9*F%<x-^<dn_;H=RB5
z6g{Kg6Q6@Qb9+_2&K|#dn^3xh?7v69;#F2UcUL+wLzFCdfZwEUQw{{1vzk5r!R_&3
z>mL+^vwoVWslR|ZTuM)#y2JS5rmz=(*-n4#*P**^On%w+mLGjS;POwk(C}YQJ}zms
zN?SOFe0yJ>+`SYG#Z4=C9nb=z!i!?+9SLr;etzSuuE01y;|r5aJI`si{FgsnksGp%
z*SG9i?fs&N*Ad5J2G@n!mge6Xe&ST%uMe^8$zm_NhjxP<_H!_6v`@vSc*UQt1M$#)
zb=<Lk5g!zWU&LJ12@^bQc|D}B9FvfyKzg;Wf1eARlhC>LGhMGG3e`Mev%76GyO%M;
zl*^N;gpKjO(X9Ukw0ZNR!_W8j7XZOy>NZ`HFHx^@;zB0PpE|(VYdWCXlv0#UMd6>9
ztOSb4nz(fjl)&TFHj&p5vo)Jz*|5n2Y$dEKd;wgI#2|CyuIjPL&zx6O0OzhOp5~N&
zG0~YSA9Adl3P`>!vaFlo<tOL1>EU&DvyU(Q{Ez+u`PGPu;k4CvN>@;8Ca7k`o-6ZF
zm#z4nO1jlvBJhifDkafEgZutp*xpy$RE!LIkK&Ry>TWX<MA5!`cd9EN9T*|aw_o*^
z_IG~Ok}@}^SLD-Q{I&#s9wQ?KDB0X!ig+4uBT?|evVNOtv7%uST{Fh;$=d0*xwRcl
z)7{pFnR&e_rN-Ex#&mg`+jxsF+ZlT8np=t#pD@xbOLGRi6}(i|$Z_l-ez?naq}0v=
z>HXrWX52~X_1NW{WFo(^Gj!=)G9_`^4F2a*2I=-Mff&t#KBAKX5AeluYt7OFGi<4_
zJN&hsJygHB9=df$eWC=g)q6Oo<`rlAOjlgX`Q*&xKe;DYUhygf&U5Q`67ptTH5n)s
zu8U3M(4eAH|8Hv5-`~m4e0y(SbcxUCMO7AN*Oz=R$S&Q24ExhLBA{uP!Px_u58_p|
zr+-Tblh^+C%4p4AT=^VtZP#n=Vo!~juEo~~@L$bM#aCaDqFq~9j2C)PFP#1QSz2J^
zcJO3=c-BIG7f`wlyyY3^2+qciIc~acisoK{r37%Gt7M_()iy$Xu4neLdT)XH$!P4%
zpT+)AFy2Kmu6@-b%IVP}7V?WqwlNE)am^#l^AD=GK4k**`*%vZUD?}`PgrivjQ{OU
zUubew4N75+#L>Bk&QX9OO{rn?OXKFPwpGeR(6$d-VHRJ1g{OJRy~@er?3caO3WOp;
z-BmGx4P~YE4P1yE<M<HEi#J&tL6+;!Q6M^8-R2lls<4LedAn;A_=K0QP?DFZ58W>Z
zSSAtSi1C)LsylS3S0tZ#fgG|r6koM+Y)Q?P*AL5VTRA$tRs^K0Jq+BQg&e(A4Z8_#
zT}jo)H5T)g`K2h{#?v)SjxsLcXK%qnOJvwO10`qFFnxO*aL6_46I&PWnvBYSv1%Nq
zc3FTq7WF9H@;F@-JiD@*V;VYAmh}0!>)%h-f2-yHQ$nw+x!n{&O3z%!R!?ZPuig2%
zc;AV&m8~(bAg+c396r$Fc0c6P{k9C?Jp`vRIlp)3LtQdw7Cm%eU(roOuug$Fqnv#f
zMqXpdPNvC5?D7=y&DqZIU$?WUYL1eweDz!f^M`B{FLfM%#6@`f_`nOgg2q!Rj*gC1
z7!w2KUuQPIeo01cBqz_Tg;#*$zLRwJNIQ8#ZHS0j_PLmNcQD&N?C2z~Rx5O3KE`~y
zHGG*%LF!d129I1P4-K8~jHj<XziZ4t_`T@XaUAty{*y-23t4=76yLs&)FT`0soTE!
z($}|V_v+_K4TO@5-;-*gY8TUZ#}a9h*STYq#x2Tp<?g_up!H|qOTklr)$DS)57}|`
z`+Gn7-_JBErGCH1=EE+&`mXzLAH;mzX(uY|3*$fhK2uM5hf;piftu?>KlbKgzxnp`
zVS~qycZJ{mb%&R^p;^YeTkF5LCHJfcA{yaqTm-E?@KW2G+9y-e$mJp1O&d7wVsd?X
zdF4aBLs5TSpM0^9d@$}W^6_u)144z@LtF3jwnTs}=(^?B=boV}mhYZ($yfX_!O#fH
z6{>sVZ_8b!E5&KHms=8E-1`40d+%sC|8H$LWF$%w2@#!$8KSr7J<$n47<~vr^xjJl
z5p@{7ju1hV(R+_z^xiwsyBTG)cYJ^6dEWE9?^)+}p1)>UYt}vP`?K%Q=i1kG?Y+w~
zj^c6)GfpaU|6VFQ_rkh5>%2Ne=VNlo<Hg)Yn+CyGXFVCit>nJJn&|z4o&-ml=E?)?
zh(7VyqC(o-`&a+$O}E>LbNVtH?Z){b$HEZ@Td0B2@nKnFBRgdO@0bznn_PXxVZ!cS
zL7e|yWTNjzXK756<(MpF#cVWfT!<Y_tF82Cx=af)wWmu+zOC_HJ{3_3??%A1TtK-y
zZQB}h(>vej`L$0C1#u&#7#*${9}kG%D3&3Y%Q>2k&*q)KIoD^zghZddV;sbPb^De7
z{$oeFWq+1y8<48Fha$QW7b&jaBa{&eZes!7mh$n%ylD#<0i|s)+%b|iLsRUGF=b;S
z>JcqoNH7r-Ic=uWI7QkxM9i{a!+G-!Bw%w`(`9QJA@K@^BXJfa>47GL9Fm>?qGeXN
zJiWPI0864ZCF2QjR<(^A%;NgD=yyk}M>R3s9d+PDF0zVFQ4G)UmLMlS*Wn))Hcmwl
zNl*jT)<b)bH&KbUpyt&Y_c5Oh=4!LVE7u!rxq8t&>Zjme7C9_vIOdgJPW0PM<V_Ch
zBe^RlcCd{|DMEc`(XX(M>M8ye-XTtDPMi#~h|}^}#o~f}y{mEiD{UqlAy*`eGD%cg
zl__nktlZ|ydgLM^i<rZATn;3@0Uo5(L>;QpUxAuC<RW4j{01YNE}hio74)%Fm&eTS
zdMVnfZaZ#;F9U$i#6e2K&+i*f{hilp+HxNguXU*z)H1}Jj>+aS5!<O+!7^8$KKI`8
zZd&(tvZM1{jcKo59qBU?!&LM{4GGjmPEZ&Yo3l_4es^a96`XCjZgL5G#AT^-t;@bh
zy;irI1H--XY~!iQs}`5e&%?31^?BG!1h4n5H6#_Oj$+ve?-WnA83Q-9D)}2Sif3^C
zv+lE9_@m_~pP`47r((VGj!a87O?-5jyHRqPPb>jc0srQs1_<C}X<dW8GGtZ>B-Q-9
zEW?!2u%(6Q{(=`u>wmrOpMh|EB1Lz1^iQ^0W=-G_*(*1Mt-+J`T+=)X><$L9k|~6&
z^~~8WT24|^VXAQNR+}8$_0^|vKNs^6EH1o2NbLNUU{_0sDS557DI=dNaY?9)_9{G*
zZa!3pH?hL#{dPM2Y|tqa4NPjE9Y2JO*rYXRI1LRu>zF`2&o-df8!A3AfMr(|)%h5e
z7x^D5;%&rs*r&GI!Z^h&tr|Qc6!Tyd3;}o58cztAg8M8bGgv$NnCHR-rrXLl+zz*$
zhmf3NtMC2CIwFPt$i7I5^+|jDVySEU>txhIu!T*kzwc_@WG=LqwS&yZa@0~ON&?Rw
zo!=v2o6~X7HiKcGbI2MIha~***i_fgHsWhnJ38BmqhM}%nFFck?v%GTfez4(f{!5r
zBe?^<CIR&JLmLxdzj#$A(6aE8t$a0KtG)cgc1FKgwehY2?LQQ$NCbd$H%FqvC5xl?
zAVC}x4~r2zhGsEnIzp=AIQ_=?+Rt<%Sb~EEs4(Y{qj2JMp2{EmxepsxL0m{pctc0;
z_6bn2^m}(#&(EX2hD^5Pj<a9Q%KyCof@HXKed&_Unr}TtXa4=R;9&cFFb4TY%p)>%
zga_!4KTmif;wfzme(?qmf#=J%5v83K27X5H!dojwKsT_{sM6G6krtX+HqjCN9iL+R
zw3`W$1Cw#Upf*Q2@OOXQul#Yx<qWXbnDUK|fJ=33NbTOmRM9@R-<kU~*O_fvk!tbM
zK#2cYNG^>4zDD@~lKOU%l4}m)=8E%w^#YjnYJ5md#!u-|qV*a__wpliA?p+a<#GrR
zKexGrV4vLokbIrs)wB|_xW&uukt8bHgpmfcQKH`bBX{9yZo$x0lXtM3NRBf}`-A)v
z?nufCOsyDvx;Q4Eu}VAX`4^h$H>JsxrFlT1dAy4)YBv<$)*a{;_TKkiNEK=cQB4Fe
zT$ez7@S4vn<a$eM11rr4u3&z>`L4!Iz?4Pvph~9vpW{kXx_)^*<HOdCEocO`^w@cR
zBR|le{W1$G?(o|Bt&-F09t(kTX}Ie<zoGElwV-{U&-v&jy<+OR9ybrgVlTZ0s&1;v
zYU8c3cO-=yCPCrpYsl#expS-Q^H20TBe3WV?Sp0MV`+MnG}5Bi4~(LGb6=mpwB#c-
zy;a898i1jx^fz5q!er0A)3pT*U!upRmQup`b12Qp(U8xKzU7&06M&ANs%}z_X@(Wq
zDW-dD<9nMp8wsMYQ&@EesCgIdX=@H%t`6hummx2+_)kkr?i-xr=?~ym)op|j8D4^j
zxiDVZ!*Bcz_sA|WlU?K#ZF2ra)ZVc)PMv{>f5qCrJ#zl{sni+TBGM{1c;wVAaEd<9
ztqd#+?1EoS!PBK3rLPEQ+vIsWdmz_GVn~_H`Y=-ChN=$h@IidB1!^Q2?r)Mie&>n)
z!fJ+|{mvP&invDMM`7TG7kB4z`vM1X$KWVMcpQ?E9`l_(1;<uo9y{XdBW|eX`|C64
zjgVHE?BX>R3@&Z0NbIff=5d6|JJ$8^WgJF4P*HYjIo$#`i^R$RIzTo))49HSM<bgV
zVn`zR0RcRk7l1hD*jzH_^47iA|4`xH<3+zcXLxGvH?gZtwSgAlSs<OlwZ{teLeh!S
zgFIaMI?x>j3101*XMHC8=Vl5tp9@G;fNasHCkis>jSClz?a>dKYK*No&oQO+7o}4P
zKw~>rmi21?i)v@iaN>LPXm$EZ%rMv0Fsd>TwHDBb@SfW~a+O>I6b1g=`1LiWo$Bm5
zz4_Q3_AJ5w;J$w}bDu|WEb#6M{1ORoz{IJY$El>f^ejRB;ynIm;>rZs!lBQEyDymO
zlY%zS4J@*k$Y&$5{W;|d*zYg+hzxwmZx=yqrAPz6-h^iyb0C#)@l?_PjGuBZDPkp2
zLrA(a{bLfg-kgc+=!f>(ih*BU84qQT-V~*(UAC)XSpe(|m+rb47n3Mpn$Cn-O(C(z
z$T};wg+181f+T7Wn+S~2Uk%a!r7Nc!O!4N2Hx!2!oydS{S{`4I=TBHE0!!~N^)MqL
zuunj{nnmPC=Rfzh`#woGUvD>OG`LKKLr}7iIBTLJGm<N_=@IUw#5N=6-;Z8tP4>xc
z|GBo{^Xbh&?*ch=O2Ha)>wbId#e0#BEfT@D<B=0wy1!RjbYDcSrqExu()a#gMxEf$
z7+Nk7SRdch+-~7hYK!o-E*e1xL(YOjABtyitj&9sa2A$(%_qs5u9b3g6R)X3$X*$l
zpHMd+QYUlY4N7s}MvCu<*{6B@xi|3s>LivlXX7Zslx>Qee?I4*Gd7hffON@MlF)t&
zG}!+SV*Bsmm;oh#xAiA3%+w)P<dmHA2|o1Z#jn~&HcT_FXW_oB7SbmJ7YzeFE#((&
zatGtq?(^7IlNK#?xHGt|9zaEfvKSNtw-K{4zL;{>V=?lYkj>+a(*~8WC$Gpongww?
zZ@B^RZQHqKRfm^5NdKX5qc{W@X25Vq^{3faY$KC_-o^6gLc%sA?+`8G;<z)gyG^Iw
z&4OyH(G`bdkgKt6AdT1A%g3B7GRDnepKHzTNc)PMKhIx*-yHjA1lVJ`Re2@0%O%)I
z$^91Z`x&FV!A(x-gVJ<*0bb-boK^2j=*CGto^?qO5UVme?gu974gZ$B%Ds8D{$*~5
z9ZQlnoZtS+So6*4jRYxCZ|avP*UAapAzD@s6+S#3O?;(QGd8Kf_GyVxVwsWmFq8ZB
zX&`ySb5fF~W6@?lQf6SC4mAmR$BTegA04%|+Hn#}63sLkMwVq~iFIe*^SicFt(+e3
zu|4&A>_vbtlXCq}2CjAcnG2t~V912t=Q}FWa$k_&EJF&<3GZ%?U_K|ykZ&KpwfEBO
zj|37D(3<(L2>O{W>n9Di+FinIdV{|ZA(_p~>o`3W2}?WBil1BM?>DZFU&r>ErYlL6
zuPM>_!Vf9oF$8jwm%k;`LREJD_}lONzD*Gz%#V`o>lO_!*TT7Owjfsp29iF}I-P=L
zQ<*KKaAB0qyA8)_n8mj*KTBKEY_MYJo(qhHQYj0mjI~9ml$F9k0m6TNj^_gzE}o|Q
z?u@3Th;IM(%3povoz!?T<ixq*OxW*#VSi(bCY3xSJ#SbFS?@^nok}!^MOeIDQgPcH
zTBkgrT{xso&iqX`(9nG0eq(18k5%eZ1qpOW(l@lu9*9;AU)<vN0{;Wz>(*&_8$jF!
zM0GWTy(}0J1$?b2a1!RZJ$wr%TKd91ubcXP{B!(1e|@_zO#Wi--=mB{d>Uq4a`>jh
zx07w|+>brf(uT}(LQh&*IB`1zr(iUIEYOq8CxtrqxjzzE;(Zw+Kv{{FN-xf{Fa&OM
z2Dsq(2RN9*BmrZ1F?gAH-HjjrSewjdJHPlE%ac~jpf2~h-sbT;CMf#}fz@{GXl94n
z^)2mW;V{oaq58}uS9#HpBp~xuEsPJ)ea=E4rT?VMU#}rUzJ;3jChY}7%w2e9Q!G0$
zK_SVZ3?SL{{l3I>pakVvvZJU{Fmdx2TmtUtFjA8={I(8Q=rbeL#=Lf>CdCd9Z{Ug$
zZM%<1zHHgoRlHo1);Z9pP6AL#?EAoe8ZDODZNEb62N`CHPXi)7ztH>iW@}0o@-cta
zv0fXXa!eLfB=X<iziL#e`0RWxmskY=C<<|p7rV9#mYwM<-Ye<+O(!8dCi5B!d}O)-
z6xJ!{N6131YXnar=kbu_$+A$RYhAT7phgn;l?xe{H*0?Q1Cd5Ag8q#@Jc9^D47Zx<
z>tDjm19eRBT}~aPeh1$0$_IRS9Qq)JQZf$qU2{cs?$}E+iCrQBD-xrwEH(Am)}KeM
zB2~}M9=@s4(YN>A)^~1B>b#9+m8%l&g*BNaVw<H0<SyefMN2906nBXvVhNZuyta%k
zEyc9Cbv7k<iVxf6r2TQfPvwO5elE^o&?6^gx!SJDMVyWE%kOd=o{_s5p0I<ou)m&x
z<j*R9ZaB6gXXA(u0=9`>#PmA1D+>7p^Q0Q%i@JF~YMYi7pxqf7@1(zw;f?c^Ca1<W
zL77f8D?<}CEfQ(lLmS@`3mg91%;x`0eribYX{-bL;<*n(<5+6g4sM(!Pn|tsU!RxU
zK^WJYB@@2lvi;?UW7+D0`1Ir~zJ&pw{Us;mYuqoHrN%s-fg6GAsx6O`v>P6+@gqFn
z-dn~?NY{A5A~pOOtnxkAlpS~0rQt7!Ju<Uds!Ee}FOpOk&<IMyR~p#_q}?9Uy~fp!
zxo8Ewn9DcS6S|5NpMzz-5tfWFNJ|YGz9xcK;x&K(K64YkhE2tJmnMjIfD7)r50mDQ
zgjMTGVEh*Xgp9`IvJ68gDOof#csZ~R_X0+Ewz5i@n=Ulfo=<L88Y9L`z;d|=jeXk{
z*YI4|Sfymj{9>4^M)BH_H)Qo8g5ap`h4TY?57B(tqu>cu#YfRQCPg)8tm;9HFsx|h
zjI`K}P#aJFfxG?wb<D^c*4BG_T4&3!rzVCXW5Mjcu;)NK9dcE`AuF9Cmy!we8JtwD
zf=tM>5(*%163+QMucPKMnfoz_-{MNC>^o#xr?Dymev&9$DzU9)bdU!Stn1BbG?f?~
ze<55F1CUdlvg)OZZdoNW?pW+q6H?MR#sH6{GJbG0wPe}+91+8gVMZEEd#eU5XQLl5
zUPSo0`P`iP`xnz+3zhz<5y#WN=$80E?PZ+>Q?wGVU61`iOJH=sO`h>^Z9=b-sgSto
zs(0X0<wP+dkj-~3qj|?svE7ka^4N?MIC-E?lC=J9#HEWDyi=uZ!anuYZiOV)_%5TY
zzQ!Y)vlU@Hdhamk+O${xNbsO8WT*V3c~!Xy=sKvo9oGvh>eEJAs%9-Wf1&mMOYXNs
z?nJL!pt=!w|Ei>PLY%zrf1}?289sIZJ>CGM;{9^v{RYI5_Q3JL@x+0&9uR&b!X;WQ
zV0#xKe=t)J0wlxNAi@wXHZPMQx)v(|)WI~;uF@DK%R%PHYWGAp;!q4F9Hr9HhKq*p
z>doGBB<;pgA%#g^PpS%dIpK}s{Q^;DGEA`01fJpU!9I3HS1=?+hCt%kTfqc(U{F8>
z@<V}y3+&$3k0*7TY?L+z_Xg1{mRl)aRsPG)F)W|=S07?FuFA0tGb+TEpWLcRm_;Ul
zlKzb2Q1(Mu`~9R8>Pcn7cavO>QXc{V#02;-yvfdcXp<bv#nUYh^FC|}5B<q00{W!*
z%ox6U_pCvjL=nhxxH7LWThbq)OcE`Gy1jOCdkd3<@;l>H#}nm_Xk*iKg)#>!Xsmcb
zuwfYgD&R@g%N^L4<*_&8aWYTK3Mt*<7Es!-WQk)=&yD75ta2AhL!xk?>uwdSDllR}
zufxSJxYl-A8uE}tD&nx!=X<a}nFxqEnP^)ofO03zDzK?U@FRy(`)8J`)l^dcnK7Hc
zu{{zMa!>0F#=rfbL28e~032Ro#1X&S8*%GzvDARL^?>3uZ>LQx>Z95rIn<NS|1ua_
z5GI_svkc?@Al~+-jp)YMx=%z{X_(lPL?3t*(@A`#TAdHzq);wnNVQ!Hq_NI;i}2mG
z21{PANM@9Y-R%|k4MP*cdA>vU53<)mT%L+dK&5t*g^@MVFk>QjFOxf>1QIqC_aToJ
zt<6?+pZRV8`zN<Ab4WW*f&fwix`N~QX*<LMhoQt<hGmI$n5O>;<MW^P#c=6NQk#1f
ztS|MY9ReHzP6-2vP@G(1uHQ*f@idHg*lP;aKI<I?F8U!gVnNY6Unp&zB#sy*dGB_i
z2p5S)3#NWN1ClFrLQZ~xtUW5DGHah#nNha7<9G$wf$=iVK>?YnSvWY97;FUQ;X8pP
zjWCmH#NMEv3c$P{gr_9Ht|cPFE!cOsiqqNhbspY8V+=b(X~?5V1<ofmi7M(R@nSWi
zJa@H8RDq(xCbCXnmCNqUOlm5Uc+4dlx{S(7`i~Z~{)Nm@GrkFoBb6}*wMqxZ1BmgU
z!WMjb<g>~MY$$a{XEO5OzU@n|<r3a<EV6={dXh>W9N}?!{}L)vTn<{rvzE?^_(4WM
zP4am|i#7Sj>ap?>!3;1!$GUR913)dI7#&@qzTN8Oq7kO)f}$+=L5b<5^d<BYnR+p`
zJg;*%OyXEgl7_6Igzx_NmrChknMcekI^{NerzEes$;DQ*j*W{_-w>$$&E_{>(Bb3v
zcUcMGdeCQH^rTWkEdFJuDypOV9&ZIGY|!Fr@;6FZ?$?*ZqnO4u4e@6J3T3gGcT<mg
z(#l(n7QKr=1B4<wo)~e-UR$#5I0TCIFZoQ`kJa~_ZaRXhrwsRr({@LO-w41B4=5+<
zn^<Loh?|8A(0iV&Lj+tZJH(jH;ro0#?w|fWC-|QtL~c=uA$kZy*slHAnX;x)qZ?5*
zn*%4?AzLJSU;Nn(FUfs~{No>eoo8J1NYa<uV3y=Rxe$Ha!1m9CAGasm2!PP5KWzD(
zplFVyC^;!wUozi#?kvO(rSFH>@N`Zwm*@h>(Lgxla@nT{Due%uao}Zv4Yhd;Sj-$e
zw8a0DvvIoP`~^dhpIg0q;MX5yRf=7U)`x_>q7T<*ns#S+^QB<&n;bWzgy+Ru%)kFO
z+59fp0Hes?qBprj2q-zdKrc)Bw0wLVhSV=Rl;ARW%<v@5V_iia%b}KBR4t;G9o{YQ
z>c9ky<n-+T`Y9%~bgI@U0VpTlPJL@OJ1DXQzJ3X#MuAzpFu?3MBLa#w<>hb*7njAq
zi79<r8!={UaZf`vI?|RIc@&1JjCcu2Phpl#TLn$55dWXz9}Jz}AGsfvE5jbyJUvPD
z&ykPp&w0zKtF_J5jJ8gd_kJhcS<H$`CidFl5VEX)dUTf0DgFm?tuIId2i|W@dQ|nD
z?`KKC1Ls{J4f6Ba<Kpqu)ne9cF3jwT>~C$a9%h}|Ui+aXmec~y<c=;U4&|Y?2n2We
zqtT7?H;FQ-M^IYJ$d&znko$k=11)_KEk~k5N7o-ae)`(~w}HTUKj7_`Q>PyWAq{@W
z8g_KJe5(PD9nPG2iT1*z<h@v={_r*_U>pKQ=cBP)-IdYQ3R)C~4}e7y(Zn)P?5*Or
zI_CJ~iHNSqBiX1{WHoJ_dWx4d6ZZpW2yX!AAXcAcX20dFTdj^s4BtUidil2D+`WA)
zDw7l>HBJ-AibL2q4&haoMXG6`hPJba?We+3hhtV#ylkUL!N5rcC8-dIq0cFn#@o8h
z`?Re>8M(bjQs?7xv7XvMrF23Kw=yUVx#(1ueLKGGdBD%L+)M5bBgK10F)Q;TP6JV8
zF*aUdbWrajGFwFw2l?#xhOaPPEGo)ILs1eGGg^zA07_nvagr%g(MIc_R!OZdSu;HC
z>x<CeEH8~jR{@Nn41}Ki{%7avZr+t6+gQJo3ZNBn&=<UZt7Y`F8Db7RIW*IwWfEN1
zQM8i@bk6EJl32b`PZz2x78n$(Yjj#SVg4FPWONWH<{1jVAWScAqcNO<U`B1&MSHGc
zy1Zx2X^aj0Mn_8WXt3c?m}>LupBe(grjj*c^s_U{4z2o^7-aM%-rdA6l&5P01cF+|
zwtLDJXyq>H&eJvn4dY$ks@iS=*SQf$RkXgTd17f>9DT?6l4rY|(}8Zm33n>!UZc3`
zykqx6;XjZQxBpQ#_x~cC7RTofBTSR*K^-kmXUTetp4+G6s#jpr<1(8ufJ}7#FN%T!
z%;+CY-#xriyl<7rXqgp$9;5o#&{$CbtS5ocgXjgA63vAk_npe^&_4wQK}aZp<@m$o
za7Sr7#TPpcDfkhS=N*Dgj_6x}K>6dQLhYi0Bp&?|qW_r&z8WcFi_4%tyN&olCVg>4
zjQA3IJC>Pp)V(e23nc;wqcBeMB}_e3q;i~A1Q8H4HQ&k_Khkcg6@Br2&jJ0B6<S|&
zMp3{P9;&jya@(}vJnzTnWiB}0O?u5ryZ{Lp$P`H+4vRg@TU?TC)IuEwNnGu1zC7QE
zAb*%zF{NqhW0C#(kz}O4{j^!>h;@^}zR$WSDLLW;OiCIasG4<mwnvRXz=$!pQ_MsB
zF(r(Buv~Vx%qZPW!&xS3;+^LoVi7D%GwCv;$CN?+s(zFBZ7eYn^sxm@-i5c_lVnee
zdc$c@WRBSIn(8r1xHKZ?@20={f!M2r>UCpVTh~t#`iDxN#8q~apCvx>saHb26nQnq
zX?RI@8sm69qO6AG)Sp#Wjj0KKB$<|hZ9=)$)Rt|_+4UMajscmn!#a05p*LsH0nH!A
zm?11(S8F$zyrO5Z!^4akYF%S>*(iq>3foo<*=LBGPDZG{PIO%xeX-qpyrzj2_?!{j
ze9b$Rej7Xgd4u_PI^->h;K*2lq!Y43PSi9I>Oemd9uR(Apw3OhKdS?zp|casj&>|0
zMelatwiu}cr%dB=3@2WCPd$6}tR}(dpxC|9TAY1@<GWO}9yex0@@fP;fMtd?a%FIs
zeej>JAb7X1^;g*z6;J4?TCEc^tIY0%va9BKPLE_HV5Uy0sv9{-KOeATEj#64-f**r
zCkYv4(#D2uL^OD7CNG5`0dBm2lkL%mIxTUAI|(meBnQz2crpL<co?N=(;IN8#Qt*5
z++ys&X*gKZVdGb<z}XK9`JQLFbtP(npMT&G$b!IS?F-j4{-Sp;QA(LSYNjScbOd)+
z+Yay?tq4`fR(#?daPDru{SbRtzgNfRdPw^7GB#pm+5Rw5a%YuDA4^SJtkSgg*8R0e
z4_q-L4(0Y4?qqUaS|%1>OYU18w3j%;R`T&SXmp8<gsRyV19cX&CmNES@eqKAp+c*=
zrtz0%MXjnwL&xx&%dy7N^+6HadlHu|19G7>Ymg&=C=h;_O(>GHR&V7y&fveO@>PcR
z*uYuObtvi-)4|(q4l%Uc;OW0lp1OEAyDlNP4<c(lr``9E?+1wuMh76w@(bQKdvD7P
zb<+DCbWR6YpR+Iwh?F%oyjDC4<#B$!KEpVrGW_I0p(aAZ`Pbufu5YeZ(73m2IQ=eB
z!9K_9{08Ik7Fhtc>r7Wn0>3hop7l_u;CQ|3GG(Stbp{cMc_E&2k3^++lCC$QWb-0X
z({rARds9|(2XoU`IS@=v1@-Q*k?;R?>TdwBn+Bxf7UQn$;iaeB9YJpnCHtjH?v!Sh
zD$nFoEL`?2q!9?hp88>rqz`EL^@zXT{U6B3vqe3P%T2f&(_{zZ2|`QlDgR>hVij~A
zKksC0l?sGrmM=CeitBgf8T)MNcV|@CtB$=CY2cKIR{kkflX-Q^@8=ri%6pIv+@>gA
z>8lLi6{6`l*sq5qG4i4E$an(=g4g-R_0Q|Re7DE^wC|Q7@FKekYY!pE4o4}t6_*B#
zF}Hjc!srN=Xr^(m)`b95fOK~X1!lK>eo*%mONksPUq;(38ZCd50V&?&W}}9&_-*9&
zu&}DuoHO67!hfjLP_M)uVif{4U0<xf%c=XzfV)qpJJ4@6eoqM#^YkyPZ%5_QDKpmm
zm0bA2ZVJs0Ip$B^d4Bl05f;#dDQFfsj0PTJ_1TZ;-&jUSSZyad@A>(<KGvzhSNa{L
zEbuu7_>8yt#JX94lmwd)`<bBUuv%PbD4I$7k4Q)=sWnh4!upd<B4lkI$@7o!lO&|x
zj;Alc_SbqTv|2T~bwEOq0lT`86d~oTXb*L_-%tHG%eqRLK=iHcUPY^{q2whFhuI|F
zh2{j}mP=puiJA|HG%be8$s1qa_p4&nTJO8e#)LrxFS_!Z%HEK`gbR3(j4LVUx0~7+
z^s)=OY9z<^q3CUY9+cA;1fBDN*&OM@(Yl_mRY8R<N4GqGY2mGC5$}0}#IiN3l?#iu
zYRU$!rdOqEWlw8K0*&PoYoiA{$qB?w111_{9-|*F96bEQc5#qO>M`w&#iB7%$HX^F
zlD&;@B=nB^zydy4<=n3r&#UMd>xA1kyy~#Ol<SA1JJhy&Q?9YxMDJL*5h`m`{bX>n
z_9bQ4Y<VR&M@ljEzf<e~GcwP7BJ>Er%O^cJ0xH@5b+Pi!p{V;MWQsZF^*h}s0KaA|
zqpxx&#(~k8?TqbZglblZgsn8hloQ7$z#`WRpEtYp4YZ2q)pVG*56NRAtXUgzz2bif
zrF=@BC&zro5v>Z<eCdY<`@5oVS^xf)@^cnXv(ixZoIsR0mtVln5jZjtzS?w4Nwm17
z=cx;{Njan$Tr22!9H%ZcV9v2Qv&!|*dSI$1=R6&=ngU@PL}W7PtDp1{?BU(3ojk`A
z%MoQ}no-pThu8PSfcOd-(a$x?%6V>H(%-D#T*5uGf@N@>jHRloBu?7$*Y4C`w1sil
zd}W|EuyNbuGYVz+`{vw?Mtdi&;r)u0;{AU-CkSlTE>o;21MJaJ9;X&XD;vXffKy5&
zDoc72b%~E<5a(Q%sQT`cHY_WN&c&L~3KFrNM9-}d?+U`&j<m->p1?+KFq=K}JpODo
z-gugXdJ&23l67m2;?wP&9)-AN#qJ!6FC2?+R-^lw&dT8F<B`B}|I__z!|CU(UulFI
zo~yFPd<njvK_XMAU$w2d<@rZ@dorKZh!SA>it|_*YW6@N)fx|4n&K~!Ex5NF;w@sV
z<4rJM!WTvU(dYZctvokOUv`+qr{)2oh!@8orE>+KE(wy;mV@3L8bia3n_brxklE~<
z-+GRe)nB^>-O7gQutL{mt4c!P-SeHYjKkmi#Mg_&+Ba(pm#Jf^So=(x#Z_=TRn&>j
zF4sw{={&Hx@hBdll7>!wGr+@tdG;=8ks<YJr(m6y*2eYqDDh<r@eh^Lvopow9u{Gk
zgWpDo-^(l3owEnO|HE+d6d$#+_cLkDt?WsS4j^G6IN_9>4YB!eqSyF!rdmm8OYw^q
zHp&(@t2ADQOv8XZf?s`Vt%gWC+#zh6)0n&$HJs9|EDR)f(&(i7^%pSXVxE5^?R`v{
zSO!6lIi%Prc2IZ(IA=hu_sdZ-cmxFY&@cCR)8^HYL>Qo`ka=Lb8TbhIJaFVTjYzyA
zAsr<8Or5RCpxhRiS@$EJ@C!Bhpc~bF>hl6<#LW@pTKQf%s2AT-@}T8zve1i9vhW`S
z0p3j|MDQP9+p^x7g=kdOScHrire%DG3@#K{0zvrgv7Zc<0dpQ5kZ0E0rhGm(zx~gM
zlQUm@YV#=>Gf-6e%;S}7oAl=B><%%Gck87u9=(2J%Dt}#t{6Gc*OJ(WC?%In>c-Wt
z3z(vXZvHk^FHnMl$CTD0XL9T83c~ZbT3`@qT*Gi!(O+*9jZ;fdf0D9`i;|MVkwzmY
zQRI2m2}nOl9!cj>_*T~Gi*U)>5Vo<d&OS*<n%N4!1gfpwXqc1U?`pzd+}ANB<~+{Q
zBx-8q{flGPq2B4GyXWKCv2KNTC&#y2jRQWSDi2n|HNk~~$1ezi=RCGtD4iNVeoH?g
z@Sps^k>u?(Wo9?IPscGki6@T)tx-az0urunh3WC8;mG?Bsdr4AS(gBQlE-|KvDSfe
zCz;|ZQLCgPM%PD)>kTcj;vQ2M*4SfVlUUd^-;+62?1aUfnI`@5n@9e=!L>Of1l*TZ
zMnILr;D$P-gi2eij6H_vpQzSl+u@URX~J^pisufz_ety)*<-#InzLYgHiL(BsA1KU
zOJwgWIs1YeZEV{#m*L({zan<Gw(I^cnXew{MIBO`uV-t2CsAJx2$!`VYcJ}2)?L&d
zmT7#JgWISabU^Tp=oOKY==V2|buw#l&vAQjTX1(s1P7JkqA3^_IVZVZvg30Ianx|V
z<TS}5F`Q&vj7so1CDcd8j53A>rK1Q^Vr>nUBiru>cnKUT8XM(H35%40eBV3ad7sIV
zd%2N|>jTd5hNr$I+>m@2ER!uUN)^vh&iWjyKdDhBw`0vY>T(cI4|7f1!v&kdOaY@)
z7CsOjPW2WxCu7bM1hmL3HCE)|kF{v7cw<ve<8nkvFg-Vj9KQNk@kPh%Z<=R5Ql?R8
za!wLP;9~{3&jUJy)UJIvei9SY<y8%;;g5V#tUDi5y{|ZvhV>i9rwWYFzeWuw2eTJw
zgoE>88mQ6*MNuPS^ZCO;`#zlzm{uBZ5Y(>ecf3lCp7MAykUI1kEERZEGDOGC%qg}(
zCIa;LkbSCO$aDO`|Hu&~Ou0sn*^CF`+7sB7e1-J!_fG!O>8V5%auJyQ{hd@1&=JaM
zxxpOX7c8plk{#=D*WMd1<F95B+3|N`CKAg*iV-#D^EJH>RP=>oZPE0XvDhB1nY7A%
z^)gfqHdNt`Rf?HB{s*PagSt?kz)A}O>Y)j*Unx7)@@46(&ySH3ZZSQ~7b>mF36=Mb
zbBfHtQ{SKwtY_lCjcw_bBaR~iWQ#s+k9aW#`G|oKt1kcdnQw`t^3sbOA}b76TQ51%
z)3pol1DTsO*g^ZV?x10dHzZR#Q};=YJAn`pkm!;yf+&gTopQ@_{Y*XB=Q~yH0H>i^
z)^Bh9@$yJ}ra0?nV>d|*+|{0?^Y=emF{2{KHZP+$8-bW+?{@&I@Cwn{^qq&_SyD$y
zUK8Fu?b!S%`QQLNNT-T>wbN=^xJs>`&=xESV_#$(`fNb(2p7|_Vff7LrFpDyv}Jql
z7V|=5xH!L{2j14wbCazSjiV`SYY=6C1Lj^brb`x#<eSD!7F!-8^{CO`H3=DAT*=lt
z&Oa87`z*0#{2JQKjeTHCegSkEO_2@BwJC57>TLK08u!`C^|Q+G(j;J4O^E42-6jia
zRIocH#h~v8%ENeugtJAuD<tN#)IkBSq2a!(*0E|)xQxg98R?Y?-ML3o;@)$|*{U-6
zwF275(5lOkuOSm^Ljw}l&D;!71WA}xRAg*!oS(!euJzoGp$VU-k?8CQY+q{~4ezko
zwr^LJ^DxK5pyH#Vam%IP_wd?)d^9p+n)pv=by=;I00qJ`h>Uv5@aV9#d~cKIz7^h0
zQy^ko_FSr}lJLI3xQ`{<3QgSXZ<nWUC;riC3?}eb!IPWbJ8Ra}7q$C!ZpD%RJv;Uv
z;$yKPAc~`PZQ9kb+B~qt^ttw+&O05cYSn5AVYaS9#Iy&%YYev;1f`K}mUzY4YT9b+
zYsrfLHba2YV|F4waE;z<kzd<w+!q;LV%)2hTVc6EyZd5T+?T8daWQny*X2ErcCNZ5
zTaI%Bz3X9pv7ukQ4ZlPcZ1X7$TOY9xxtfGt>0sFNrG`oTyL1z_3iJ-ri_8+lgT?2|
zs!Mo2`W;w8{q~1tnGFAcg%bV5R%^LLDo|SVJ3~8c8$_|{oHN@`lZN_X1qe(c?_kMT
zS_BFeZB474YPb^*T#7fPKQW<C2<5uXu(b#LPRd7ihC%AeN4=-M3#aC|3RC)Jy&(lI
zAAT0>ZGK;n)dr0w5ue7}1gWw#4XN!8D}y69SDZnpL3Q4)H=WOpO$t{_Xc69~mR5zR
z0{NMq`<Ow_Z~&c?wc4oPF!*GN!_b^r+_H;?bW-j-`z@omM6jyJ<i`2ClXwHMuxTBW
zRyvU}j4=+xx@2R_Y(+NPZOD0&ipx*ztmoMkp<yvB*S=!LH}N04tKB2Oa&6s_*aC25
zHMbX2zP9L|oq9L%r0jokN_c#DJgHQYf9E3}7crknRyuC_Ml7>`4_BTS#d;-QM+hrf
zg*&8mgGv)xF(x@2DZP|c<aiqVX_JMjEJ90)YCuT4?iZ)<*03&$UmG)PJ)-No8iAU2
zwYM3CTxm^sjP+a_UTf3Sh2oL3W~(TY*+aoYaS=K6AxKuq1P^j159MMvlia?06O+0A
z?B*6j(OO4V53cg;<AjHwF1+-&f%=&Gp9`FP+Rqjgn69tr^O)j|`lM`kn8KC2=F{8h
zqte8y<P_Xaz+56^F5?tA5$S1|P)q%{^iyIZ<D+cV3RQW>?(o1UTN1HfnUDnajM6&r
zL{9VNDA?&2!pcQUPB=TgV-D)J#DxtSr_qzTK)d|<y+e*eD)Zekp5P8>O!2B#<EZYH
zhnz&&Z24GI{LaZ6Nz|L<cPo`D%~*d<EK<Y<nC(%iERWV2em7NJAg7NqqxlG)`pH>m
z$Xk#2X9=hu2K4dSW3IiHWk!n?>XJ$9?Os7=;Mm2h8G14)Hc{35dw#>O+W)^$QE9$P
z-RN&}yLc7;bESgt&mJF{COveZ#5+XES^<M+{5k;HD-HkHJd);3VqFH4ox13jf>%ug
z>yiE;)Kx!3cbZ%{J}LbU?g&>kte95z<kv=XQu&6&=k&(7(acQHZFZh0NS^Fll|v5Z
zwS4|+&h0N#U$_lL`kL08LB9FZ(9dKS{>Hcu?QT(<?^x4!xKHXJMF}73O=1Phz(F?1
zdG{Fg{J~cr^Ed!?E`s9NiUWajJpCLII2~-UDX!Ef5K3hh%im2s6N1#k2+l)yb0QpV
z5{n%hJQ7{%E!~Fb<lOU3b1VuIPsS#LT@+||?;C;8jFLx;$?qAzcl(I8{v`2DIFhe5
ztw-(s3b$jiCbvE1|5ph>!~zZ?h-*&V<e%rZBbC{7vrDm6{9jnW?eqYc1tmeOGk*p9
zU5E7NC9Z*e>b55i<N$HU4_@(vO{AWzzvB#?#Q_S4`_xbodO@l=C%cAmxzat>O#ke2
zAC3#YUG!!g3G<Xfg=3jwV_j#OLfyOV#5f*59E1LKb>Bbo;~vY(eK$GXV!!sXsIT&x
zQuDu-1FKIP*2T}gszgdVwhPjX-Xp&J8u*e*ka|-2uk{R;Vyfyqo?2f~boHSJ|4Xh~
z)RWC@(v(zRSVCygO#fH+BX@f{j8t=Wx1z=(MtTuOV$&^-;}$TkuR32QLKbka>3(rV
zblsM_y&|0nW8LcMI8?A@ArJoy`L^J>o}O%A!3oqCnv?lF;4C!+IsSX?<R7Xk;JI2C
z^@7+ivFA-DccC6E^$XQ0KRq_D%B%km8eEJAf7Mx7VofzeEQUFBj$~k6Uv-X`xmtop
zpd#U)=gxUA03%Vms_TbXkgs0dzWA>e0{}R=qRzW1a$)S<`+HtuaQDZqK38IHel0eo
zTGV(_vjL!{o-yZxONgg`C^`Rg{nST%2xm_@9lECfyktAbOnSH)Oc9`zmuD7s7-Rsy
z$QmlPX#blc`>3|t5!qmnYNzdYycL&~Vt>j%p|wyrS+Vf1WA7orhtunAHlRzhTA@ss
zY~XL_vTV`6=(U=v$9emQO?*-2o{~|n_5a1jNllA$qdl#KeeU(|YK1XYZ+G<W^4|+J
zToJtgde@xMVfT47fq+1Efq<oLe;s`vhhBg-;=W^GaFa-13uIJI$j5BcjnM&#KdRSY
zh69dqto648Kv<W|$qSYJ-G>ZR7SItBf6hF`hoX)l$A)P1s{G6}{%j#W`>D001!5uI
zcn>Inx%RytIzDE*Xro`)yb^3Lwa!R9_P_F4NWi)<ThL#nd_!p9Z%k7q(S>#MKGxp<
zMT%PU9<a3_z0wTr5U7=P&KF79$4F<cdDY(YcxO5R6}0`t=wQm|u!vm&_XRorwId?l
z%GDG;i~hoXcq)l4>LS=rp{7*bdY>vlS!%JQ(Uo91gZr7=K3k8)ACrm;Gnbo6Xp2*Z
ze7JYN{HwY-e1m#?lu@JG`kDs&v4P*&Qpj<A&6m^8qe|bahnE^9HW{~jpa?$A$<@)8
z&Zyph^$%n4QO)ti*E9yUL|zXKb}22dB3pu=2zi>oYzc8vyxuBYkJ(&mEI|6Lu<C;*
ztWN;Ez>g~^fGhYxi4xwiZPmLN`EC2#3VLe+ZFTz1xB8#osF8S*1T(sNqn~xLc2OPs
zk_%&fg(i^JzeUCqw77mDgP|D{a}|}X|GzESA^6FLKbxV+X9V9NxgPP={?@k5>zP?<
zs(`!9lQe5ZkhKfh>yM;rh@kGb^oR%%%H~Ok<Q+Q5HOxOtT;-Z6&0k0hYD5u0`eG61
z9Q_Pmt=_%n^z5nHG*8*4-Vt4}#c$tD4vGN>NL{pe+NK-6f0hpmUw3YuB<`iGmkrwT
z_t>DnP1Melih<_8BAh48UJv8u&HMKL#Z?&e;Cn<F?OLpzu}g+=FkU^YI>ZqYci;A|
ztl!i;Tt#Zep!}4XnmWl3HujlO&)j@RZtwRMZt4PyP47<g@Qm?L(f{v_tr5Px<GHls
z{_Vfbq1GJO>JmY&*Sns#G4C)$AP_HQ%BZ%l0l)q*jzH0SUzTo!Cs-T)@@4$mHKA&x
z8R;6$lu2%%Pw9~rA;w<fs&i&xd-~`NG4+gehGEE*x|qHb7Y^IxvnHr)s(<my%WPZu
z!@oi<Fdoc%-U39M_n3dJ>j$kn!{R|;3@7-yvRe`Z-lLzWtA$B$?Mm#S9YD6tdS!`_
zKtuv<QT3C_;LqrDnakfcwZsXh^)~gCn5Zv7_xICUu62A)wU2bg{4K?(5EkglRQ828
z|1vN+G(LX^mqfES812}J{#PLg`zHi}brXp@dPEb6W45-84$jX@u!(4S-J=UoqGKq(
zA|rQs6K=^F+cc@;ANX)F9dXLrJfo-2RjYN4>j+5M?=7EjQ;(105+1+p4om$N{!v9E
zugTXHkJGBbj2@Zrp-!q#f_w@jDFuH>pJY1d(c6*Y;FI(dE}H>#+^M>t_{M^?ZsPcr
zHWS0OIg#C}8C2e2vhgA%_OYZg&01UZBk6OGm`MSgte5e|Jaca)r;znIjf{OixW@Mf
zb?Y3!x;?~gar$p+Pl8zYs?F{=zl_cJ&X_tR%KgdC*>-~{B!>oNok7uiGOK<xYh{l=
zr(&+0fv#ZBZlRiyB{#ia6I4AYDEB^$O*mv!-;K=P<(dEZIitvmzw~S8r&`ZEC{<y3
zo#Nc;Hh#~l#@@&sYQZtwl#FvZRXrznFT*P<da6jrO&%1UF0-4po3SL)Oys%S>}Nqv
zIQCBuxh@h<m4$mQ3?;Zeah~|)KFqiLZad*6`Ngia(eEqm$A#ibE#Dq=ZCsFDE|>D_
zQ<K@?jL`bYVj0MJb=+>fbiB=On<TzmU8ux6ojU>kp$mSEKWtpoc%f&`&`8nR`!`l%
zyM?KFr&Bd3b7NgWuCMMsMnD&nF4b!agOo_SGVitrH^uQn!`x-4!iN%tI1`lm@EfG)
z!aAv+Mx(j&@B>~8nCrlIiVu(OHSM*x9^m4$E2o<~vv5#9I_PhDI#);Mve>sz4+5ya
zq}lB`+{jRnYs=>dP1iKH_Oo~>m1{pEO=|i{f7sH#2QuCF<v(6jBK%d0m=NuM0r>x~
zxsxCF%07qx>6|5?m<3>EkMS*Vn}cY|Rq=pn0#r&$@uQByPqQeuNe{u5VGvYqnnH2D
z<518h*u0G&_b#cer@0N-;KOf7-2H6~nZejoEr%alJR2_W+V(P*i-syMw`zLpR<+)y
z-5KG{{BzQ7a?sNlDe}zyYyy;WaVaP2L~M}##Rh6>Jtc3oIBSU<XYbufoHdjHJ8XVV
zIVUf^xMcN`{#gX;t{T+Umoxj&@P`}G$?GIsRfEu9{aflq>>aaTSnaX=)z(zw&-5t;
zo1rM4?0WH`?Ng@yc5m{-*9Qr<;ibxT=~ut&V~Y62xgPbdWSULTDF`1^Q7V)p8zZAW
zxxgbp`+sNYKgSQqKj|W-@7hrAYSA$SS&3Kt9s=#+WMEH=vy($k1*l4hz3sL}m-+mD
z89Hy<mwt}wqNidvYts3l+B`em@%{FlvWq)I{Ns)&-|8#R8vD7OSa%A6`tff3kr;UB
zMFdr_;YV*cb{b&u+prEJNsdBCZcFE)0%h*&n4g$zqY)X=QmT#<0cGv6^0Yd1rNdm5
zIJaMC{xwW|3(=I0#=|$MFJSjh#JC^QOjkdpXwOz*^92vp^Ta$Z@WO<o&`^`MhQ#X1
z4<D(d`S2KAu9c1tNx*{|{#8~q0l-~3zDeQEi~K*Oj(`4Iq>{?Sf~1EkuTux{cce2<
z*XfMyV0%TRHk_-@SAl+4L>I<+KSEu%R4(NpEgvz#{+A~U_82mrK*q!m(*q@3cTx_s
zWnJ=i=DBRCOqO|v%y}={P7D-Igd|><e&TX5YcXphaZ4S_*YZidmcEOj$m>gQ#kf{{
zO!e=p1bsslMe$FmQ(bTa9ckl~52<Oluire)<ZMnfLpH|=kL<%5<ARwEH3r&pT{Yb`
z*H7jw|2VC-QS2QDk5*Vbm8@o?s2lz05$EpkC}9QUllX(Gz-uOPnF3ArS0|fox)kCq
z&MaLLQ~o0=#zDy2qAv79qI-6l;tYynGC_9$cgAGmY`A}=j+~A*D1Szqqq5h?N%HHX
z+_?iiYHI_*Iem^J&i9;h>%nHbRO<ukJClFB&wcL?&D!<^+WFDZzr6``|M+YD(1m*2
z<a>=>>`dRXbD;~l;n<kJ>vqn-%(k!TOz`Hr9~b&;{##RB`QsY%*OgjM;hMhD-v0Yt
z@;x>1>dvqAue|fk;aqnY>O5uU9}8>PO{Z%6xwWTIky3bmS3%2!+f|fgRBbvE>QcL-
zI!Y392c~rG-?Q*;Mdp;#mZP@dLP|OHRQXMFt`gf19}4Vb%_c~ytLQ!RIuRoxWKN4M
zoD+~}LKBW<8S1@ni2Z?_V8I#N&eX1!dEpH#hd(&5Bk&$IdW7~cU+8_to^#^+Z_1u;
z?FN4t-Z^%_${G;Y#r8G;PS)0s4<4@t9)@4n*hNZaH?CCaGfpw#K5^tScIpZB(29c`
zfqkCur8$+WwhIF$;`pFMw(M=xBVEtkpMo|jY1*21s68iN;ibDxf`{NSOSrpb?xXqQ
z^UxPC2{gOcI{r=<+c(W4b#UNFmvCi}m9~zTyGi*PTh>lX{a7he{ku00whzUdO7v}5
zK%G!qwMU5&)t9;&R6U0rW=y}#+geS_^;JfT(U!JgjUFITb5pVjN%h5ge+w<kh36?$
zg;hYHm-YTvtEg9F;Mtke`y9z0@&x4>=~{yv4lSPV_tedfA|lK;#NHjpit#8`ruMys
z-7_pksCN`*u1(KoHNLx(ro1Np_mSM*WAO;pzTX~9b7&P7Z7-}*$mps0u}ovB@dzti
zY5u2b{!EtUNS5_)hcDW@;UE@oxm2sP;_MB!>+HdV9p&OgCAXcCbhrJ?)Q0(IHLHCC
zk4bBZGN(de+~VQE?bXVWq#7UG`u=>iOZE2@oYtA-`gAe}ZLmzJDn7plKU8ts*V#wD
zGa@^cu0wJ7MJxy^__7P^An`7opj@_`99zEE(2IlDiWDHk8e;Esf+#5V9mJ~^ZYy54
zy3i-8@#&Zap5a(N9v8Xsa+xac`VXIxdw0s|Z&a<3iuGOMSMMU;?@YFNz^G*SwBG;W
z%V)itd)+ser?j7EPBUYNI49pmy_`)o6hfw%(T+Y${cCEfms(#@$T2P8vR&-52$#&x
z3MUE+vz1fx<k&WacHFFMLnSemC&b@g{2z|G|Hkmr`K?73G^y~*QEPE~iO)jYqCZ1-
z&TA%r?Ea<XezjM#=$?-FQCIR<_F>Pp5A7(8eo~+~b-@Hf2#Zn)-QYgSyR;R2Pq>-&
zPyTa}$;{lZ^pJ+HR#`@074K1cya~uYAzuTk-+Q&jLz}~Vf9}2}dbg~+L#}SQh^miQ
z$h6QSoO3%^LZ*JBp^hkOMW_GG!JD8W)2T9OFQ`>PtUA{0J@?>-5iy=gB{6BL7!j@j
z`Tldi0^Jqm)aoEF(jJP;w?1;d(+q{<^tH;#*&kMP<eqfI+8595vno%m&{6*VUcfu8
zam5H3+Wi$<ofP=o_knD7aSYdPK@_db82>l+t)5>~m5)|6od9?qaUcn1=mGmT=Q|`s
zmw!j<=D*jwu!kG~7o0vDx@t)Y?-9o>6EW0}+YTjO*MUtruIk^jdp?Sl?4Fz8G+gmG
z7dqjX2~~4>W?S3vqki%t#oxzVzne3-TxwvllnC;noV$HjA;ecP<Yxv*mM!PKccb6o
zAFWWpxL$rYv%_O%HJ5}3tD1+p)HtZ1yTS%eVP3k_o%$~Ag)>8wjBXqsSBv_6tBP%D
z(D7v-eoA(@Z*pj$^|ULNbWmGu^&8pN;q#5WQEK8NYF9n$=EMC;?|b-pkHFMw(`9Pv
zPvjbV)_+fSFG#oJ_{&}UqC!{1bdrvIF^|B*g0O^v$RjBJ`+8Jd+%M&nIv1*$LQJw#
zzRlx|x~~^D{edBSPb<_GggQOKI60E-Roi9gORNR#bt9WbC*{^Ee%^Vtci~g@^zhwE
zJxDbpUt=NXkgGZVt%$-y<=^>=A17%c+Vl@Gq)>?}5we9wxZi$b!ASLdmDdKgmk+V{
z<vX85@nqzV&;KM~9n2r+E$nARESzg!bX!{GPrSfQHa1;0^kjXjqf7LCFA+QMb~WWC
zG2GJ(op^I<uf6Yyoxjm3wnACZj8)RBL~gons=ZFH_CudbeOY<&cu|HhH^D4v@fkxM
zgU%a!H=EZufrQsbV6_gDHDi^jF9tjkLx4`3X0H!QFdOje$9m?=$<$MPS6!y3As4F!
zQjf{T9;L7>lEB(Zk({lA_@D88TJCXVNY9VIo!opy@2g0K^F;c)A!uFpGYEf(>BNKO
zz<*<Qn3Qp32ftedN6#npVf@fq&sPhpb0pV~d<9xre@v1{Ih%`Io=1YoPbLCB`{?Ln
zkHyS|f;Og^-1b6#Un>5d-+ad)`-U~+-4DZmUe*Wwba|Ur-d`IF{&b@v&&8hLLz(vh
z{HV9LM2V5fFh!1uJ^Kkr=;Qex()3m^zJisKK^F9M#CjO!dLdtunwqcjOzoH#P2u>K
zQ4{{?n7dCl;*YUJg@xXG5RblN`C3R&Y|a@CdEIDY)yk~;q+nMU8m?sV0G}YRaD3;L
z+=7pa`ZSez@&@n2K2)sDy=PfxKWmwtVb%g_9R=KRqok-$+LzB&)n}BgOqI@)pZ9$+
zw;1mIqDYQ{%4hN_4^nlD|Cva(v$m&#ULQr`t(t{4CW%Z*9;@C(mzzx!#i}}YT_2v4
zgoT^@TG#isA}muKpkjUSR~9v!QKV>;^wZPad3H2J98+4;S>FNje5VqJ3D4a!lj2Qu
zR0BO^Twll2tJ%<Cg8V!gS9{gr%MyA+xX}5*@DOyBYW@_m{MO-dQu7a`wybX=9V1O!
zDd;%qd}fz%abBwpgS;O8H?;J<v?-hNR{iuIRc9X<ax5s~jfZ{Y$zQ4cuU-IY(Fayr
z={|6~2QN}-S-gWVtNEI(qT<Y?*?(lB;|<O!(Mix>?4gn8-|B1GE|}|GR2zjSKBbw|
zgv5O6d?j(T)$c2Itcv^Q!)$D9nFgVvkcIzR!c}EP;-YRi(o^QulBn;=+gV`TQ`hOB
z>S>Rx#)85NN;<Jsrke)4@fE&fplkHg_Koo3OX`<L=OXGhmq>AV7?YBZ1mn>;Z_ljP
zcrPw}`2WM+cSbd}uInlyMU<|9^coPQO6UnqIzdF~9RZOJ(t9UTrT3sTm0qNG0!WPl
zLg>BM5Nasixc6D-obBG{?6t<Y|Lz?lKQd=#W_iEwd*@r9XKf^rRA!^vGKl}4bV-`-
ztZJE={*VCQ!s6SZ4N=Wx_1nAh&8sZquBdmW#)&2CfUzS4oQaCYSNbhrT~l-PTseCA
zghRrGnb%_YQ|zN<%3z+$FXc;Nu`R(H>i$8qn#pwR{v4XKcs5b-Dh}V4J$_L1=9$|U
znFRCH#gESrmf5^*Nm#yZ@qt;4eNAylc5;K!;JXkByA{f6&e9$=dKF>FsN^Y4S}^B=
zIo#Y(_w3trkVKnn6`J|~!oM2CVyw;467JQO4h^{FIRvZC*#56Y;eT_>M2v7TC*?hn
zYey_QZG=FY(T~Q5yiFhH1MJ%of@?!%vuD_1x6RnAZG;wVKl7*i(S;Ql;CJTleAIK&
zZ0_oxX;0z*IYauL3t5|(3n-?14o*`r-=TL!nabz$APB#9?mk!+<h!=?IMZbf;lM6t
zQuI{5n`aSkuY~MP6MMV|?kNI%U&3YnA-1D%UkyckJ&C{o?qB;viseRxlRqd133lH#
zIPQt%`WWn9W0-XPBk7w5Z)WamE1TJ@zua27yG%HFYkFXt=CFbNwh5r<rYA%6we$v`
zjv5|pfdq~MU+a-p4TO-w+NOov#N4=75!_jz-#64I&$suzZFSmwZA5)mwz8nnmd&4m
z(6?62--%u>_8!nwVUn~7N9SyxAPgSr;N)o+*gDFi-`}HP1s3F#6jw?K$mYA-qWqck
zjf#Y<uw>&cBkiHCPlU8k0#PbKp!HJQKubWvmM3|;U7>@D?ah6c=9{pI)YBk>R1E=L
z0`=-M*C`1q9|5ZEFEP$MotBULKdjZ1qqUGB#T|zge4Ix&+lzU0zXM7&I$iXH$&85%
zJs7h9B#7%RiKIv*Rl7d)t`!1CM2r8^vcdJP2tnNJ{W8x+p<@=1M`om}7tgUd2XWWw
zM_$h=^Uda+nki=zeS>WY#&a3(<%w><DqBcm2`9x!X5_v*RD~cYx?^l4kjwUUb5>-t
zqOSGBW@)jb1(NITaLm0-w*IE9=w=7weJXXs{D(JY0%Khpx;b_cVg75u{(3s?3f~Q0
zU#*)M@0cP!jnbgsdGiwh4Y~$f>&%w1vHE-?H=>5M*@!DA-!hnHZ?MCc2FcY9I&%9N
zw$kJGXHtAr4Ld#u8;_}ulV*F&W+QnAh&4Xu%G2e;Gb7sdt!z(U?;^Sla;mfhEBHh?
z7<@cKMS!c>Z<|ec-w(P9j;N<XwqEWk8*Qy7w-sd5j&WW&5x?~-9?WkRF%_KXo>ld@
zCBx8Ampa=WYm3jw=s;v!Ob4jRibV+Pj4>1dJeB3ArO08f>CkJ;YpTVyQUL2nhO*`l
zB1*WRTD`f#f}_FOja&LR91^$hM^5=1_e`!D`(@*;)PM2Ech!rHmx>oY9SC)eIjEQy
z{F$-VEuZ08Y87O(l@XiWc@~wv=B!spHwgsp$((HHIDk4!q*FoU$oXE$yAm(oXO()=
zr$*{Bg3dPv>Z=GDg#@GW<WL3~dVW|4JWJIbBBV!htj(KYAYbS=&A`HD4;7P_(G#?x
zHk+zykIUb5OwgO33h#W{m;n3od>|B6q6C*)q|usA*}X@21sm>svMw2f$b&bVr0DEi
zWK#O+CaA{rOKEUjl(MN2<W0v3h{B6vsNYrxdh{ymYUxFyi3Y&`;_=)Yc3^w!Rn*(7
zEN}i7<nhDKJOj}9t%9+sVgP<TK)?P3={41>Bm7?2j!2&ox@PT%h*<l2;Efjy{kms@
zHews}J19;gXT)d63payHOp`b9VRQS!r(cqKGhV~fi5jL^58H*t?y&kG;E{fCtMpsx
z9l34YSE1IM(Ju~k=!{*qN(!~rFWX2ABu{i1tGqVDB`l5r4*orxE#RM#KfD(yGc-|Y
z$6sYEr``TU>ywB)?!|0v|6pWWAZ|uy&POIGJfoneq)YUBekYq>9I$B=EH4UIQ7q<b
ztN|9-qh)V%<D}W;h|2${m35w`y<f4CjI;6QyKrriuC3fL_OTgC^0!__AvAI^CLQO~
zzV3LGH(eQSwcs=QQGe%fB$L5qk1q=nBs;7FoI(`%bRD~kKL5gvdgT!BA`r(<8z=qa
z6_Lygy-zKyMKT{m*T4|Pbkn%-+8BpPyckM>bnW^6jLW!TQR7~n;H3x!;S&<jp$Qu~
zAxEct9l-W*eDHhupg|CKt%B5k>AXefM3vP@s|y*W0X{OQ^li@FOk7Lcve^^gSpZ)%
zd$1r$XbB0N`?|na`i>3FQJ!`{?+tf3$K%~^fI2|nd~^GW<NRCRl84<n+P7$_r_p)d
zTJF<s-a4f1^KFNLA|;$F;h^JNB=1Lhz}KzXrI4wS)CTQ%rE53eV<BIvrL#k`JVwT*
z9E@i?txWFMcwQoJkbn{c%SHv?mH9)^4#ccbrq#XO`6}SeJ`?o3ECtY<{JN!%WsZ<7
z#Y5kN1Q?zFk+1%NB(=w)@0;UT2V2e2i^y+!eID4KC@~O=`LlN-gV0#0_5RDa7HTUa
zG1K$Bw$-62$QoM~R0z`+Oj5j<|2ko4o~AIEzy~MDJtWq>+XneHV9?u~r{LOo$j^0v
zxXm;B*w#0#=R=Lom#IJT&9amUdXIopAMF?_bzI2cje@7en%8aHU2S&S_gyR}fRCwd
z9;F3)@77znik;rX!nk^R><8il-oDJni8+3ASIrxh-MH5qLRtr=LpGf>mlH~uH#zd}
zS#T5j_#PO#m+jWEj#)=#iMqJC{=Bg_IBzi|%hfySbw}4P1b))Irc~5u-^z-T^adWw
z4?HOyp)Ra_lT4sQ12F%YfseS;!cky^AajX#Aw?%B2XXBXF<Ss0mN<M_OVsv~pgaG(
zS{iij8e8Upl~3{YO2%8NCAHHk(tMtRKWq)rU2O^GBvXu-Av_>SNC^#}@hQIe<D81Q
z!7ln*Sd6D=8iMwGBWk&LG)&<5=W`3%TrB@8y+?<9P)zer{~MZ0z`HrH;*84&wlcMB
z@!q>Nv-T?I&y4p~YQBn+h`$CW>upIrz2ZsjW(W&Ex>S_VE|I(mRK{pW?V4XJIL7}_
z^?oaGUn717o@RR%9QE>!xMTtfHPYg<&J43d4Mbe&6$-_&U+2|F>4@8cXb~6ZR;m;k
z-+>sJPuz69z8>29GXh|2rK_qS>J9PcxRv$OvdEBZamdWQt(_S7bDY%rlz>X&ZN%t;
zJjb)Plq^tTHl_Dzj0eM(I0b0(XYX2|caCCZn%Lkay=l>b<Gvc=icqs|bP^cTb>%BT
zo+v>j>9GCDK-h_V*7J~@J&0!wbh|47DR+m~V-{rY#WS{cnN7nVzC|vO_$fVm?d3EB
z!o(Z(W^`Rry@VDGb_!u=<J47y%8|$J68jqUC(H>k_`N)ODnX@*<x}oSBm*N$_P0ts
zi03v$?;4VLXLmCU!SktM$3F&yw=~b1>H*tLf@8$qK2{#;5_3ac*phY0F)N@~<sftT
zPNcYOA;J$)c)r&PKKZcVnr6pi^aU>K!g)5D+4*>Uu$aQZ>uyu;8fbmD{KWJ=hAl4j
zTo7fz9-O|?!qP)GiFTiJU8|m5Jli~5omh8y0M=aVN)ihWg@9CW8@AqTf6^&DtEcux
z&c?k&Q%{*mj1LYZ)P#}F2^G_V(y0phF|)!Phd28JarDng%bLF`%+X+fc(8RuUwz2+
z=2YU44n$8lL(aCLzt`m%tvWiQ?h-vjH%)<@zIy>+5yfmzpo;*K8@}3%SMM1cFcF0y
zp+j&brWuUM{V}!M=x}7h){Gwk-QX;m`ln>$zr@vX^dT^K9;9|N<ALMZE8J^W4{(@U
z(Exw)z=V{tt1GJ}$D;+t3+AFizi;?f0SYn^QduUuolc^KrVsD>d<30b`Cak=`fzzA
zAyfO><1{Y`gW}_=$?^`zm##W6$%@$MZe6UV@IiGb0dhyV^i!PY8H)tlypzCHL+YFB
zRcNxjrwaGF^mu7Q)z|O7Bs*-7JcWec!O>j{Qpho6sz2R-?x@zreZx3#q9hP%LPVQc
z9YiuyI-k(`*3z5<IUhNnt(bJ>vS6M~%#Y8c$(SVwfq(<7GO;g)J2}P&0j)0)ISdV=
z<(eLG(lGB7O^VEhwjKpmB>TsV_R3U7vLCln?*ZQ^C)PdkIN)8A&2AkAGon)gxVYV`
z<PICE20=r&;hsdEAL3kDO}L)kV{td5n9*H-z8iJTJB!Ku3U`gIkJ<>o`GcDA8;7x1
z$Oj_$L>{FTN^~5POvd;;s7~3ZvAko}LkjD8!h;K}m7nysUcz$bH@<O+z-$bj3a>x-
zR2Xz<y)>znisvu@o;G<PqAm8!YL@<@eRhg9V51rj9lB?*oyKKtJxO-z5*@akDI3_F
zY96SL+}~3*K}YzK2@F3v+FpBBbQDdpV_pGa$5k55anTc`;5&S+>r!Z@hU~0`GZ1$h
z*qmu!Nt^ioXegi{5wD7=$t#t(Wa%D&$<<19nXE=Wh!iaqa>$ycxe~oDE$$mtpQB;|
zw#%{<+)>fb{rUVcIc?!v56Dd*34Vc<S@UFx^=NUdFN8d8Z2isscDwg3>76>c6(>s^
zzD3O;U$SqW4l>GR$}O?oNcEa+vrO+K%zzX48Ypjcr+D)(i$Irc4Tg)9d*tYWmBDir
zKsNbVhASnh8|{Y=vmqNwEu;)HTSr-#51scLB*(B#@n{DUFr}NGcs-T#BQ+(ul?+@W
z7YD?emAr}aac8_u$5`ebwf5`XYJh>+pj?jlc)I9q2m){}f`SWHgeAW^1&3@oi=KUi
zFr$6EMaHZp+Q%in55ynj-o$@`6J!PUN2gJ{DaZHb6_aMVXf$;2G!zF<1q0StFvyKF
zx3LCkzCDsby(#jB#rIhVIq%N3L^&D{y)`I)dYo|buvLkdr6OJc{?7tedJtacJ>W7t
zsmW9&d-o-e#GH&ah}PVP`_qG$`!Qa14<Kcgyb`($(apTp@81lm_l!o@6oc*tWD#de
zd;*L`AiBcMd9#Uvj;z4vmf1e?);)SF#vrPal5#W|XsEik{Inf{UKP9r3whyv`c4s4
zL}5EGF!-2#<f1~TY`#|5{z&4EZLtQdXw@HjN5Mrs)Q8Y&#69t}IPFZ}`y-zmhaIc+
zG>NS3YWsudAIk+#o)3jeN=W8@Ymh%b#m~@$MqiR`ahx7_-mgi#U^1V-*UIC~uRi6J
zZgPRIiMW%QPhtrAS+!KLj7m#Jn5Blru7VPJR?j}3^)x;l;gUS;%C2nj4JXn^qxqJ{
z^d5mcbmxxWTV3ni=2F5g$zdw7g%>a?p}pm`4al)sw#j2(g+Yq;pr7SI!fSko?OkI1
zntR&|GzyM+6i}7feEQ>%J*Vs{+ob1%MwCllkG!G$Vd4ITOEew=j-s@T?Q2WT&XCZH
zqE-yJXwIk8q0A5c$ie8c%bSJy(fUxgRi}A-0+4k0?-*nMRE6++f-L54V5D-n?(2K1
zAV%rn6M4QXcWmbvHW0Y~ZIczWEUU$MaK%{e^;1M>LCNWJNKRPW5Nm99q{_OpKN;mg
zN|(C|2x<~^EjmZxO2|3venG$uLL7P=GR<iYa$A-FwgqWE7GoF-l*!{Jr@>vhzT*Lv
zuxn8iw*{Cub;u>Ga3^Hl@l<hTJCcPMv4zj+5K3sPVvH2`#OZ~FC}TqMzUu_;`h#m<
zl*-@vkOn5tPu-m~y`gbI{<1%hxQ?h=ZeHw0FTc^TM%wjHA8#^eRkNnaeiICK5iB@L
z&k>rl-FwN!73gs4>y54Xz?%r(`%W;eI7DzFJ4Z?Rm}2|hg)*6Gndh6~u=y{G&#xm1
zI0%Ug6`<DDGWS3dMs+M6NoCuM<|YrE-s5P$jAmbYF4%f)l-`LvQ0QHtoLF!xP7w4F
zt*C)maI!;TrxxMOFSD5s-$_gNacbOEuO1oGIf1N`)lp`C89S{bPE@m{d8~HbFE6Uc
zWpJ50TBc^cI6?10eF07*)au*FliC~uJRbJoE{5J^*3__B>Y>QDuJ7lhD3LmaV|7yH
zBW`TED^1J<dU@6YhWz2RA=e?;W?soq`_x;Tjm{(a+o`QIjAqKPmJK;5R>exs5a4-T
zcIOF>LH5xV$_raBuN~hPCV^D8Y1*Xg**IhckYa%*cB4d#UCntIq9~pm97YN}c-1%h
zSn~8^iX4-UQQ(#Wn`>g0ba^-DM&VIIx4a{0OdT|b)RP{Y&kerFZ2Z`7)b8UAhH3Is
z9q*rJe)bhQ6YUkDk(%hq)+D!;h|a7@*m^YiBts})L%DWRu(K!*$?}ogNjk@y=;v~3
zc~(4-1GGii;&V9g)s-Sa^ZY?leh0yo{3FL`t4Uh2x|n*8oK=>n_nIb6`_wy$9*fV(
zdgDjLqF<(bi<DPt+~n9jODI$dZGt}@yVID-!Ef5ohKCqPajl;4n#z=mLu9B*1$Mf9
za?LJ#8t+4%s!U)iD|s$CMLwSPV^U*3IV-K2(#^6`_nSD`YvrNT<1j=z8LeHN@|z5D
zTbzvYAt-G&ef)bJ{p0W2H_NQT@&@?Z<qu>eHJ!L2n79E}-MhfCLP_>BPFN&bY-LG{
zT#10`28npdp0ZT=f=R+T_(c929y3PId%tR;gcc(Z__$&J#eoJWQZ{*Fz>{dwhi8~d
zGR@@1NV%tSBGgKLksMdUc}8_mse8bIM}X#QL+{!Lws@|<>TMOYrBO`>4ab;TOERbJ
z8qC+$sCZ{brUMSBkN3}ZFkL@PBlGUNudq_xIGlo6;<&s`pFLL}Zl#Kl$AM}ezmOrF
z3rqlpJ#=A&th9W!@`$PuY@LGB#jwK_dKo9w@KgtL5mE30a$6b8LDSy(3OMp~@h+^e
zB78}7<qacrC|mQQiue0>0YjAFPj{*dL7?N46z@K?<tnxye{)%i(swM{GY>J1q=<zJ
zLIl3$(xqLIq;*=!AL<HcYaBImCOG?y;m)<l<O`tG2=iKMl?DzBZdX{Fmt<X#5;+b=
z3$35wX)3+k^(9tG{E>a7g2MMx9H_L1^k4}1me@X26}7hfZ2!@Cb-=5=cN*zlvg>{F
z)94Z=@@30l-ShFAWiMWH62+}Qi&|`eTSIPpKy``Dof)<_7``o#(#PE~-~TBew?H!I
zIk#zuqWYp9qm4UF-%eE4PPRmfOD-qTNU*KSAE3r2MH(V)#M_2<{PLMR-dYH6!F<$x
z?YMzQI|M#Y=2;dKXh`E<3N}|Vd&oeN)NB^1kYsY7nIcT$nbb@djwq`>kiQF5gmPYW
zh^xC3HUe6dnRFBEg*Y;9_5-rE{U77lZBxEdDy$I!)~J-nWy%5=*Tup3NO@Sf_O(P%
z;LMknI;vt--&Gve4>#VjPE(jeH|Tuiu~|-TYEGs^AO5F-yzzXN0X*9w+ya3$x7oVX
zZn}M9la^NZ!%$1J_+U<T0*lxrmc!>?aNyj$L%;fMGVM@DHv!}|-2JioY`yH_i%s))
zZYGh56gmpKZ!g;fJ&LJp6v*S_(PYvKP(b5Y!&>7<6V`9{{6!fr#^M5+O;~P^bdw4%
zDtY0l<lZ|>{wBB+ZOyY@QaNhaO$j_TNw|*q80iwpYgcX0^7Ve|DxJLexHZy?=TMCS
zU;9GcGD*&Mw-Fno@gW~^0^fBS&G%2V@-1^smu-?3HyW9d@IUPG$o4Uvfn$vZ8eBlj
z1M>r&qnZ2CD&DD#K8bb7-i+6EpNNc)<qHKAZV%K8#|92+?R(Zl`)+X`5~M<0L?nd=
z!aK$qDsN~e4qG#nT<`Mh8)^IyU8p>vk2zeEIN+b$Pc(Ta(K&tB{|8?j0h37#@A%*a
zU8$tR=95Hju~QD)MV@7qH>pP4Lgq?3iS>Qy{%<cGuC^#Y`@B%!=l)W2V0mil;K+K`
zq4g%-X1KdNG^isFxn7{zJfZoXm2c*xsrM{MZ!=@{8#<K^4MSw;+;9@7p?tBC4*<){
zu-Zz9zrNbaqd#68D_eHq2vu`aHt4mIkJ5jXO;Zm!t1FBPQ8?J><-2B`&C)$|6L`2P
zF>rwGfz$Su*L4613k0%ZKIdhgaa`u{o-9;Dur~65^`LFGXjfUcLhZ{Oy}37DW2%H~
zBlrC!A|L}3M4yOUz7AQTqCS;Qs!#U4S{fDHaEaHMyf2ilDsd}I$l;an&W6h!$l;ml
zpn^a0PRfNr6hBni{FAFbS{dd_5s>Eq$~DQ&neg%(2r|+1*3mAlZBr1?U=K<!d=Lt-
zeP%q=ljtKe$0PB!_BA$bm3syQ2@a20hf?Xz=C@408Y%j`{RHvA8%z-%42$Xrs0~#i
z6p&v#Y)XSgVk6lOQ4Xstr?Onl-@1cSZtJ8IZE+m2RiBwR5AD;u@lrecT05y3=AN`1
z8Avwbb3BgbI4m3zayc!gzr@CQCn8TNMm$MaCss$QxawyYT^^j6Aw7Y|i=FT44zoSF
zM(5yL<qR=-8C>-o<O60Es<ZZ|jX(Yj2<2m(p6~z<IS%BjI-V9esT;-y09K`i_S3GP
z!F$dAM{C#?-y(|dLre<~pF6(19k)HavR8{D*i8|->+$iM!A+8=@E?uvhZtPCw>IAE
zucoEHFwr^OY(4PXHF&KzTee}P8RalyJEt~$lvJC6QnOh~X?d5fYvI5`7RZ1WI<k`o
zk{^HJ$hLc!%PU7$9vmav_gJq%_*m^>I2tmla=#L{3b!uVJi*tTcQg7pdh8ZXay8q1
z>I7aIz%5x%aVYZ4#RP$R*D^VOf1?{%@L{UpfosP1&50MelO`1IsGp`IA+tjF-0G7r
zSqHnS6~Me~E_w8>wy3V?%lwx)UW_Ah@nBR+l;LtCMn0Q7l*jsnplJ8Qoc7*uxZAB6
zo_b<s`m>(z6_UeI<U1>O?hBER3U<ajZ24)G`?S0ZvX88hLmcsZNvP9ZPX}r36HBxH
zh*^l<WqLUI8QQJ6#qlCKc%tHG&)1X&{Mqlxo23nG_tbv;C^H(4F;}qTwTSZScI&0x
zkR%bTH)W8+Qdh^koY=2U13T>R{h+xq#whW<T(+5efvo{R6o2oBTd(@(@9%aNj%GyM
z#m3|DW;baYIIg;6<P`SW_cUnfIJ%!z&%l7=-_jjl(|wbSO|c_7XqxG%iah@48@|E1
zRQD!1Grwi!(p1bH+e_iFEz*}fOCLjbOgFb^NNqllv{4Y>$maZHI9gj;((eJJ6gpU?
zRLa#w#O(VgFw=j<A9{k?#t4BaY*<(^a;u>p-cxlkU#6=Er*cg~z1Dbl`S!Q`QkK(p
z7I~8*UlV_1CRkM4gKr%sdU9@UteP+_m;`WhGRBs}S(sLr-`#p`hr9dgQBYLA`>19O
zk86(Pw-gPyUE|D|$~w_qFM)CaisZx#qSJQpW#e{dvIHvE$7*i4+Yp)askIvRqcG;6
z86&6EU%Dx)iPrXwAbw^)Wmv7yj%U}hnwPpN=1VlCkm2^79emrW@mrw-CQM+q9htuu
z;D1A1D6(a@$mk%Z=3cbe+8ch6GvQ}D)`cbf_qrFI@|z@=8x)KqZQr*v@P3+&zk3{A
z$d}lbe*S3kKHX+MFNLHP{s+myPQ~MmN7-MDJi;z+W$fuqd5=1{?u}Aq*+@Pa{L(e~
zxH{6`$C6U5B#=DCb)fzFb??K(%y(c5d2GFd!bDv^)?5EPBg^l0!#5luN~O~9Wj~mQ
zMmhWAf><TQJabH}X+G&%<%{y&Dt>}kCbvgC*1YAsV{q^LO9o7)yF>M`Glg^V3|5SA
z74K)R4SsQ}%#_8b5>y|nX~Ee?&|#y;v(=m3Z!L|Rr!^1res*5a7kDRTG_}`m2_6J6
z=;(+`x3<U#B4R(s?h<|HIg!j>alh%S@Q7;I{kdrPcQu<KtJeb|p49i2yVhGtcX(`H
z^AJ}dkS%)(rzu`lysKhoqv^rwqB%DB4$&5N&A2X=J+Wf-5uAW~>Eo0c&QD$cM6%(R
z2ge=SwgNzgSome}l4iGO5a8CGOmbRWaH9;{zd~Q5Dfa3`<DNF-;GeyIyZNyp=$0#^
zkl%QLYT2!bh_M0{ZVGQVIkB2gmVrdGIjGODioEE^mSw%onRb;S$WQs3F5aJnJuh`O
zCqmV}hg8sXnDMd}!RRa)VD<&D3;p38H17@b8)zOQW!$9h_<|^Umvd#4gc_2Dv1B=O
zqKvNB50V!VVi$FeUeCX->~&Zjj5Vm7#(0%DFb#3M6JJj;Jl%RjaLD6_@l;D}v)G#i
zy$x(6A5GrEa60qE7w{P%q=jP0#=OE}SX9)0gs1tMQ32b_mrH~M`p9bxhohH%K&CQ3
zlXh+S0#$6P8$MDA-Sqg3+t2X>TY@J38PbcUvogs}ZL)l;qxnSt1IcJ(x#(g8|H)C`
zhj{PjO>eJ)jx2T~4PE@DRV{Pp^=-<wB|iI)Oskd|DbMOru)iv{YHI$#4U5%BgUNSa
z;X7=mhY#1%Barl&;uHe0nE{pGRQxtU<!&F`6<HwS_pa2?{9YCPlaYIknf0w6c0HZ^
ze)1T<IB}6{dK_;JOKS{~aiW7=3&ZN$XS*J8?u`H|o$;8XdbN64@I%{f9b+yt8B3PT
zv{?U}JLS2Jzn3uoYyaKE>&d9o{L@}?zh2n&0Okn3o4BiiM4TBxq%Lri9K)--b?=Gr
z4ZormKLsDW+1X}%QxH?KKV#<T<joZLihzPwvFvmwF|l&T{iaFf_{Dle5r((xqlJW%
z{*oy<>(lC}S)(US@+vNm%A_ZbUm1j_X;CC(=h<L1hEX-{`KYL4x&k}BEgwSfiH6L&
z&eXEtiq5g~q{sex^zUA2pj++f%EtQB&RO-zL5Z|o39%>(t2@L;_ruo(si=rLkE>i%
z(~-0O__s4*JGs!UH4IV|DF)=Vno&)@1C{1FUG!z#sV|reoFnhZEyefKxv_5u`}PER
zJ&<z;#^uBmQ*n!Yr>lu|N+WqOZaaO1zSw#$9yYe~r7jYkL)-Z2(5MmSa&FfmFMq&X
znfcxZUc;J3RztEno(`#vfwwYO@<8JQmf`7!7V0NF!@D;BzI5T&g6o%>*MXFOT2AjT
zHy`w>E}u-tqIluZOa(Wx8H=!0MB3=@dbmHG?Lx&?#^g5JA;cW1<zIN;vNUQaozY=@
zF<awXS9;&bqAy_3i1*tEl_0|FB1Rj|qDb3SXkxkR@q+Ty1-x%AJGj4n%WS*!Zk&Wg
z2R}F1(#d;zsyJQ}H{2~&WE8!!PTLTW@q8QYUhTM;>KAiK%UbJwviCiAWA^Jzb+Q}e
z6Z6yoaCBVXhPE{l>oAPlFyqpt1_yjzf56SXp->=8$%~qcGx8u_pBeP0oQ*CZswM85
z8rJXB&!S59>eQs<p=&m(Sm?ApxBL<vL+^WUoV1vhc2*^!ZedUB-xtmPs%oU84>VUQ
ze{b&@-%YKErfL*7!%?VpX0*5xy=-p}ZV%)BaGA4c(`*%BnhEO{@Q(A;buI;>=X-8e
zq*?PSx(|R1V_I%B1-JItuBrj-iKe(iwvuDGL-#EvTP&6=`X;v)Wp*)-Bc6c$7)kVD
zH=U|nTeW+?<Jb6r#HNm<>u-!i3izzHlFH+EV;x3~XrB*<24Aynx?+eX&g5d}2<mQw
z=ycXn0@j?stvu}^mVZj!+I#)2U%Nn|^7?;7&+0x9JfsjM(RAal4)5Kl_}d~a1>$5G
zxO}n7Ir<Y&{*Q4eaI_z`Tl#bcgBR(q;@o+UaR@x42fRPUib<h+>tf8>H7tOJzsY<b
zm&wr#9sda+rC;=W9PfWn9FhbE6}TCam>8sQrhkz>RH%mw9bx}i_qQ`+8|oBGQS>z}
z2&2jz%Rf=h^S3o2H&3WiUSD^ZY);H#ka^G_Qa$l|+fToOiE?SZkLaWK|DqT0Unn;o
z#y|jD`>GjQpCLAP|Brsj|3VMEhRbt2^(J@hzZvgsM}cin3IMj!7Ieu_KKa6!k)b;2
zU!;KOz&J~-k)I8ZP&PJDs^GTXNM`%Ve{l={gCu`Da^6xFi-K!kL*wB8`!oM`<o`&h
z#B(bUQeMwlmtObhWb;oq_J8LdG^w6ooosA7?@L@rrbxw;^V6kRhnW+#zfY02!SDb?
z7)Iiw*O{ji`u#A&pPJpjPPfDQjSx6~MfW9ioD1i!NHb*6q3S<GWzU4`=F8z~hPd;%
zeMk9k7aAwSX#^#t&cRg1zq8eR`eXds_?f@W5ycRGz4xodP8b*GQniV>pd#zn{L8rZ
zOMZkL^@dGi1lyRKs1{yD?VgUY$-hqy$0}@>tKfzus`>IiCN#D?bsdpsV*{E@|6`2i
zU$bD(U&?_g`PHmiDujzk^C%fqoceXO=r(&?$nNg$>>mgJk0bd{BlDj}21sR_EIp3~
z>E=?&u{t&p9A=9dN$BhSw*3AxKRI1TaJZ*oKV5H!_@{Hu|Fqg0$`)$eM91un5fHrB
zWg?WTl?osg5VWkMwsqvIX=hG)p7}XM`C0E1=Xa5bW!R=2r!K1Jna*8qcvJkL{E#j|
z(l(O;PCObm{#Uq4inr6hA+s)Z3t_o4WkVaFnUZ9PJ6Ht^U2fF5ccMS{W%lIFiI>j#
zH^Rd`<?x|hMJ!$iE^SY2z3MZ-rs90*;D7R2FQv5|Ahge1#!&;g=DdObxu0C5h4A4|
zA3Ac{r2JA(!v9W*i2Y7Sf(yiWf0wtwGS%)pmUk(SZL<`=Ij-~1Otb%HkBK<xN9<n*
zWX!Q-oPX(qtigRyK2f7N()MpI@sDJk*n?|s1m3c(>3sM&?5|ysGtf>Y2PeZ$T<A_Q
z?q9p;|9{MXBkKP@n*U}-{l7D56L2fcdt%7?vn9Pbw6kkv1B&<~)WsG;2ERyKS53N$
zOPV(=`z}HOkVf}C2IfA)zI5W4Hs@V_BWI)1G>gVy^tZ9!xYYmm%^r&Dlflg8{I5u+
zB*~scxNs##aI(w1-2sKc0lO<Yzl!soNBf9&`#!*w8{_o5#(jB5OkLzIl=QFYVt><<
z|FzksMOaK^TQj-PYfEJ+2k~?2Q0ZGHE1|QEBHN|2ZSAy%Q9OrdaWCnC7-M3WJ~?<;
z4p5VG**&f;vKuM<C;j_h=lxeVVJkQPkrGKdmWd_89pNg>tORi^rk`W$Z1f}vEt}hc
z4bXK~nb<;!6|RwuLKtYq_he?|@?_5cd6X&b!Zd(VmCyzvc{JMom?fj!4@(o>Bj$;P
zEjZa25C1o-_%{WPjB4|{3B-0x+<EEQnpVN83wbUphsF}C`g)C3Wea8bU!BRyISnfT
zqA5&vn@?spY>dw*4|5qWUwKt_QK%Tv@@qIeOeGI8aBROh(r<KJx$%oO?oH<%VO0`|
z{kB9WyV0MHeZ*D_B#%owp<Af!$QjYKOu=R>uAC9LtGliw63ZHI-f%o=Q^<HRj~`pu
zKl$LVyk$hf2yX}8K?Ozz$n^Q*-tEU!6H>S;2#5y4pTsRDrl|1Lzx297!@#0Pp{d<a
z-p%15LZIh8?Zu=u&|>lrBs$a03g&xEdQk2=q9&{+CxIyd`7Ns$Zx`3l+*xHT0uhA&
z;-tL;R`=c1ENnV{tIoCK!q}L5z~>JKX3$Q&C>V4eFes2X!8Rc&78w8!-uwF0A?jvS
zGLCe|x?)>a=PV3KN7$aE<_~Qs6e-<CeQ6r!S=s$T4}~k(_RLjAAqHgoQk)79mK9w!
zUYW^=zF~h|2LH{Bzwqvw_u$x1rLe8^Y$c<lMH}@mhme+;>)G$~3a<)pdVjP4o*5eL
zpa-l#E@CIsE&!Rt42Kp^gGI#w>=pvV-&Kf2#wmonS1+~Lwg$L2+=g|l7CVg_x|d9u
zi2E&BrS%LA*Bp}x*8z^7?lFvva=F72{X9XLnI)&HQQKT8i^5LckgUpR4Eaqi^(l)+
z(>JJK^^`o{?Jk7_WW)^ov)=?@CwZl>_$J^7JX<rC2g~(-L`}tf$6H1GlRoBofm(Me
zFg&A*3p&zewF<7_-J0P&_kd)68d1;m1cLh$DYDIA%>$;kg$|Ps&re$ZjS~Lvf{PKx
zi6ukg21Fm*miF5%QUqqYj_EE{C+XYQTV$>uV0mosNK0XQQ+!ia!kyJQ=NErgk3eV(
zn@Oj9&Zp+G?VFFrpg-YCsZ1*q%{pem5pDVY@JH4#(B{n6S|VLxKj|dt5$R-Jvxh+u
z=qQp=bgu7o6m;1$cp;m0u-tdFB<Oqgjf4NSw+PpgAPo9~W}#~s2!ne5Fz&u*8b?jB
zHY|@}ce`BF9$LG?Y?L`*Ojy#~{YJS|inEi%+q>Dh1XHZ5G<<RwE?9w*0Iin%VpqH5
z9r+d03lkOF3lT$wCZF(65?9IScSp?b8@Xk9Ssp8WM=1gvz!3${)!F;w9G4^N83lhq
zA&3|e+CC`1&X$3hsIEQppY>c*E5kB}7YYuEm^T48yywnmNhe>G%{;r7v+Wok?e`&F
z5Fz0LUp%~za}7lBbO_5mZ<=jvhEq5|TFGXgBu8ZQ=qSoc!aTwv;+EgV5@YPR%HK5E
z4HAiR9;v4aPt9#HSuR7OtlGOq&Im9q__Up*`|?=`)4eiQGuap#R0oOwY3G7wtHtna
z7cA5Nk{~V0*to32nPzGs&v8Ma<1W=Avjr{}wzx~8+w**<wk%TcP>H^vo72cGMRhQ=
zdJ{o?CI|vaiU)p`5OE5-1EPRUTMVU0Omt^6y7Ks-Z}A>&aO1gz<@;1o!ZvJtEoLHK
zkTZg*EuwN4`TXEznP8X7K0H`NsFooOMK)$LJX9z*R)~TljmR!@)%-Rl9gKFIva7vw
ze8J7yR*xPM508#;((*m2|6`V#*x+6;%yO<EuG9Yb@;8$-<^|3rL_*7|X6X+_7Yz6Y
zrlOOmI>zc|5jVm^aTGFZDh7M-Jd&l{I57JCD&v)J1%-#)ZBz$Ui(|ul5K-9IZfgPH
zlHGRU<$@VYH4_B&w%`~2ysSu06iJ1F=StF62MGvD2*P}iC4Q$ScOSDi`NgK;a9E|M
zD4&4v+1g=-gU=G}5*r;0Eii&2!VRmrQ=&7=+qz%^cF57If(-j~(9bgj$$Obe(ubr>
zhHeuUBUP}=ZD!)d*t+1;wJ=)y)Y8@~43v{Aa~Wf;FfFAhqqrO&C0y|~g_rBHr}Lga
zJk}!$ebCR#=#n~Oh<wbmQ_eJWy48BM#k|`l)r<mT!TxDgqwi|EE<P^(#cme-spW#L
zz6ajGUx@o~d&6qSBzNzm_2;Dq4_=Df>R!AG56uVGEB*)*rDmPhUs$>02wSI7^?2`O
z_&NxY>$pea^fBd-zksS~{$?k@G|5XT;}`V*(hp5D!(-Yz#0&TtrE8#*dh<+>CfOtC
zj|P68E1%<21I*DRx6d;CRmB?GaVc6jMu$JCd}J3(e1T5oM!-ce<-FSJ(@#_ne^FsH
zY<@24zONk~-Sp{?5uTqXSVoZJj~A7wVBMH`B-^(=xVejw_~-vvcOsNHmoDw^pW48%
zJIs@$S}9_Gr0vvU^;C=y&N+dtZFZv%v}_fZ98L;pIK`@ILEs`(DuN?|G(yV0<!qHX
z?yEJeia7pxq_j8A4L}ldxwhW_c*2Urc(b(mc=AYlJ|ao|L(C}~1Cy2qD$-aY<Yow2
z2p)ui`8JvO`-rs&_ET2XQ_OfPNbU}tN3?6Taqe=LRAins5T6WZ4g*y`Pib0amu*@M
zA?;u_qwByAy2o;BM@wDGRF-b>g~CUfbr}g3t-=<GHBkhO8IeSFO1zZ@Lqvs_fg>g0
zJ<)f(>-cUEVdm0#M5=QiG&NdRqC0>~AD1qKXEP!g$sY1u*o?^)mygQu&G$E5ceSIm
zg>+?CJG`6^-tt%4NTiyz<N0IA8t3haot^La^YCx6%3o@iIqF&5wd~d89gE~`@xbDp
z5c;1!HnPE^4Z3Gb5X|Pf!RU?O*OlSgx%&&So1dYjw0<?cz1yp!TdeDQ16&o%!sNOt
zBaW6LmBqDc{)C>O98YPzSV5hU0$QDy*k<`jFtk<t7WT#7DPlfnc7H6yKSoRf=jx$f
z&YN=oT9LTsv6SEJw>CGxw^nYu6PnjPf45qh`EY@LP9;|ddZ2TB5W-pJ_998g?F_Ws
zec+<|?zAZIn9#0C>#L=tM%#OiD*{3SBisF|C$FR=qzt6m7LH^l6%SUp6Epi39~0vc
z%aF39H|<6Qgtmp~bZj|~Rw2UbmSUv>>19alq8=Gk1902nPwHeir3pImOz|LQ!*jil
ze8}FDK9b9<SneeLe#7|mKA`;;3hIO<CYLv$7$2V9Y(_yt`JNQR!E#a|8o0_R1s~Jt
z#dn7;doS-Ub*h0?ORl@xl6R20k#?0^mwYtm-jb{L3!$q>8;Khje^fhNImA&WxX9}g
z5$nOX9J_NFofSLU@6y`WT_tv$>GcxSWtIu&-X@hI8{fB!TJ5+ml9(tm5bkOTLU!V@
znm=A!#X`tSG8pCOLwx#BHOX*m-?vx-WcSqvF7F}WUY%kM-$Y$wh~cn24OtA4yG?sD
zNXg6?RM_;JN!@luc!>CZzBV%X+Z$~uLF#Ae8=oO>1w$O{h$yfI`a;Sl`mSBXS9z+h
zn<N-Ps26Z=<B%`jD9dt6$1@EYJe8e^i{-_RQXs+WM6{Z1oN<GXh!cDz`)Sa=f~52v
zG92;EO!CDvop8PoY+-uM1srw-*=3Sg;Fci*MGz+f$dn)UKr#cP;XKl~jXoQNQFYQh
zTohCqF)bl?d6pbMM-gc&F)k_U%@*3`W=c9y*Yb;yg@MhemiV>mol^S=xZ%C{f#G84
zJvk<)hVd9qC=;Ar%g*IPoVVE>r>&ksF>?+!a&?R~mHmbl<kUG0zk(unoq|kJ#QyPa
zNg@r*X<qI2%hD=)$Ih@+MNzy-1NRwM^9%io)=3VO9?4i5KUo0TxDLKqyQ2M!%C6wJ
zu0tPzIYHckCze9PhrpJgs+ym8$ME#Ya-Pwm_U$nOT4XoO>jXOGqWOCm>3?x!=y-7%
zUPRbB!TZ(x7H`p>09RJZJi55U_<|if@IcZ*YG(%eGnwN&G65m^Q3TArlFV(x1>R<)
zzJ#|UNUK>@nQ`7qNkJ6fXBkXIIE*T7BFBx>ypK;6X<f-4eY8?w>0lDkz}7;%3Nc~5
zT#5I{=ZjQiY3W)SHcFEK!WZ6_n66&~pY|dt3M=ksh_ys;N4!kz!Jp%S?gzI)_n)M>
ziL6^qV--Dj&6h~K%TrB-x(|$Ggc`9U+KF4Vu+&$%FzO$T+Pf?sx^I(+157$MEsAx8
zaUVcZ$P_}f<iM$HknRrSGc8Sw4r4ckpU8esGXE2u<ymCslc-fPe3!sS`WUQDXK8C;
z_*Shs5)73*alVXqh8=S`82y@tfAZ7A8hGQDt!>lP%ar7d9kR!y_dV3^Fyokp-tq6a
zPkYgSj87y?`x8UPq}UgaGy-wQ^2stR-~<MaKNK}pV07vq2_t<a)Fr$ScpQJcyHX!Z
z!0hz0sgG4p(ce|6?@;M>-x9Y)MLy3-MgI0v%|!(Dgzju)mZNe@lr9*D#6s>d)Y#vt
zewgIk0IKVM6o1anSoZl@?O}@Bc0?%n2-9b1TJw;Rc$KkFYee2+k~20ME?>Rm`qU>+
zRUZ|>emhYqW5TFt=A^KOhQynU7WHL0yKeZN%E{vQSVxYXFNT$4JkwZm5Zj1XXT{Cj
z7Tagr>r>DFQ8fFfr2A{zC2amchu`!tXW&w3o7Pq7Xe)r8x9I)S!(Wc!j+zO9ZDoD7
zu}Q!2v)!b^hqQ+wLTlOHyB;rM##cmkf<Ja!1C1mT$ET^UK3|qF>0(rWMmyIGyV0;#
z1oihaj2ru3if90qMgTPg;sg@I!mc4VOOck`uGZYK^DM{J+Q~IbmRIk=Zo~3N&_^|A
zV*odWo@VgynE7UkMSo4dw;gNF)9euw0j;a)LZ1n(bNIdYYS~NTZq<Wgy4_S-3vqsZ
zM{1rI-7O8(7E{gKSIgE#ATHlwt&BspteOq(Sd*>|UPvr+8#yfX@H-x03(MGTrs=uO
z0lYNxe>{6G+bni9EN{FL4??A2Mm;%RCKN^=^Hf;g-eq@Enp~aaEU?J<ZhF;T2<mSb
z#1yEbe^Z9hSS2}3>tb#Fj|;gCrIzEbE!MKun)|m1axS#Z98%sJc4-;x_&O}%b<<FI
z`6>;<qx;q7k%I7?58C4nxl@qZ6#)*g>Wl8#>)ZI~$QQ;PH%bRYo&LZAxFRGnaL4)x
z5z(B1kDNq>;5rh82F58~EA;?QW-XmtobXbkVYiKh(+J<Pb7)=QH9~H;2q2&GoKw{a
zzJBQq_Lh{LX+ZYn(Ovab`Ai7cyTryOxAk8xm@T<DgNlYicZ&1n8N?G(slihbT;UoV
zSwj~1@nn+SFKHvg$&<sZou}-}0bL-8KSr4>qfXu5FG;2MM?C@wC%5lA8<nRUJ5&>%
zskTQ<>k6h?FDV<J#7|R4A7#1>(X<qU7X^VMevh;LL!uA%(YJWqqDIpB{f>+T<&g=e
z6HEQ<z>2EEJxf&z^F=j@gXtm_-vjtm(;r6PKLxD+yW9Eq?=cF$oKIW4cKJrNi>e_p
zn})@=+}#^O*@XB6HZ7Ms4kX_r?p)c9DU8Og4cdYkR><(#06-@B2&q86AV+CcT*5v>
zxm(?FdH(QQwu*52N%=Tg9hQo_*JUnH(0AN8v^&i*TlEOv-Sv|nWqz*Z!ztjiVXbV1
zrLNdhJxcn~5)lH!rddUDR%Qa8)o4ffC%L|;7pj;D4PS^IGo9%9c2y78lV2f#@+Wj3
zGRuQK6sOpt&g#}bM9PC@$N+Q|ktKd|k{;G6a;lvm<`nFj;_&0|g87jpm8VdaLXAcJ
zcwGCm6U5M*#5N%$EGbd%%8CIMD?%C~p-DQ~SBHh_;_kb2WvOQ9Nt?1PtZ(9Qn`2BX
zUhGm}wKxOW)t!z7u+A3jzQjI){bhAN+<IsrRFrku6hSx7u7z&Pu44lkD%Go>30QF>
ztmpos<j?OSNm-UFCm<$LY^eB@rk4%a_W7_^^S{U|JRVUl1OUl+ze2Csek)>q_0(U4
zE93HD@Y!a>t)|bL9YnmDSmO4zJ3k?;%#WGm>n;xZ!>>uFX<ug_BOpTpZfiiwrPk-O
zJwm?9W_d3?23`7{b}|w#M2z?n@I`4u98n*rnqQq_V+Z=-Cg!;nugWBVF1%J?etY2Y
zjiihlPLT-_%T4H^3@pPO)$MnY6%iwX?Rds2PH(MbNEfMtQnIQ7<T9xv&x43~Qr&hY
zh2+FMUUS>K`jGWd%VK6cmZDjc(Fm|VfyODvC=2<5w(%u_6WgWZ)sTCOV5%2~9!pTK
zO=d?pXV^a6YXv5GJX0m@!Ez6@&m@C-Sl_x3M%(RU=(Uk=9@WjNdp<_4j}7(AyyTgP
z>$sKh%g--g0oZ1S1qZtI#TT=iS3*i?%}r!Qhs;dWRn1<kkr&oKbwhPgk+{g&r;Yy#
zuMvFQhkrYDBrCfzeRwa$xn7LR0wsLwJog`$%6vK2OPazLh;Ox``)IiJ%T@aCpLrc7
ztW8Z%RE6aKWpK2iq)l3JGT3o`wppQJBAtW}Lxg~*cIyfTOexi_kA&Ckkc{>$>5iZA
z-@)aft*7j^%!^EIjyPW}QVfCcTix?-$b)VK5z7!_Ez@)ZU&z`*0x8^rZj$1O57tAX
zTN)2%!ig>OzuX%6#mU9o&Ga=6UIGJMkcB)9z1J-Zm%aAh5KfADUD%r1)js~7qXx-w
z$QRD*vp^Ic5nLxLYH6m4DD=o1pw|db(18ba{o=}WGA(WXBDHK9<)OG}L1hy}<q}A8
zouJXyI-}l%wYOQ6jgO4A0@|_~7XUB=T%7W^475@hU?Hi6i_4PuD1{dyk0;4nd@v(0
zh6?Xh%?rpr^L?+geq#_^$E>4MC&JLtkr7x?NDtvThQGCfv}?ffNCI!ai+7dHsdl+X
zTwjTI*we-(BD&Enl4Ne_OX0sE`zko!^+Pt_R~?pT!?Eg1j*Rx%GyR>2Qx~&@%HN|x
zo!A(JJ|n18@3;7{$T2o!s@yZ1=_dEfpm8iFM=F>sQKj~CTnKPgU3VCPMZo33%wdB*
zIKlaKCKC=nhAMYW_9j?7nCBf4C!a4baI|=|KH$j^)Q|6xx+t1)P&Qm1PxW|2+=(~q
z6hz&47c_0nf{Q;%t|dYf5)oJiCqvzw!)1^YtcXsbP$v+3#$k11<d@`^o--l(x|ppr
zZ+A<5WJc9S30mYjgTcf2;=nE_ku)Ahnsx^{ihD%9m9HzBI^<QSk`zXH@wuf>cRFYj
zsXG+vw;H78y7~jED5AKK<_BlD&Gy4=nA3;Rw3rPl32pQU2NEqP>u~qy8&cDfFrfN@
zLq4BbcY7O5HPb}8SX)l%@Q%AnW3H)r+hxXw*!jHXPF|iQ`);y+*HBJyQqSF1w~)to
z5h3|r8&aYK1`g7o-ht|rG0-kLGHu<+?J9E#ZDZdf40i!v1bFG_A^R%o8{?m}5&tIn
zOj7FeBW(kxE(U-XsT48_kT>zr!UasbD|&qiiu3>wGks)QpN|bNDe^mVBKsPVmeZlc
zP9{Y?{`nE2&k%C_l~6D{8b;lb)Uu&IEyYxE2ynw83L-dyXueaycv~7v*uG{ojgWBa
zaqzJNs-JTU-wUF|x$ox4RBbZF?gkhU+313bV<SLT3e6&dT4(W}*7i-f%_(|b7jIY%
zU@TNIjj;qzz)KvC%wGv<T~a_s<I83$nR2X~6HhH4`q(BWqM40qW*W;=mgIC2JSM&k
z(QW2tRi|AJaAECeQKbp_UXPL+erG*wTa=nh%G3Q<8vv~%>X)DnR@B>m?$RjMr7=cs
z->B$27CcuIq=G+(Em6GYo4)^O=KSWW|Klc|8g3;cZ*AG`pv3I`r8r{m-SbS7svm*;
z$8vy-bKp7Qi_<w6)|#$4)MRkFM$6;I3VI5wVAqy6X$z|fA-3ID4`A|)xzj<gcr%E-
z7ma0y%$^uWNS@=$!by~%34Fop(#lQNE}ZrJq{SXbWPzaxdIZ*|%-{AO6ksER4yVqO
zP-NaI@eMT7s^ha=5CUp<L__;9KT2cnut$T@brFSO4Ppe48Twxy1sByoW<7spVBj)~
zl#wkJtoDT)wu#C7DA`e#dTpy1q(C?iFdv?5WkJ(9T;ObW*ZfD1SZ}J<RK5YMTqz?T
z%#XV3KdEA-`!*zTqp(?}d5z5}P2A>@-{}j>lGg|YIk~=gE#H6gvHwwEzxjT2Teu7}
zl5-u3RqZYB+DwRM7*japuB-gi=TAQ-qx>4pF3OL`FSD5f6kLs9tBy30HiQdQ<VUq4
z;}s%0OIt3;L|&yJom;CZ=K7J(YNDKqPB7#;9_$I)KMj0PU9zgOnIERPQ#0*lugMO`
zcqHVNA(vqLEGK40-C3Zb`s2w^#B1=;rkS>Cq6wTK#n|tx+Gf0z+2cEcP{NtzewoR^
zgM1|9rz65;5o(OsjEEE<u`Y_{?=Gn6M{y&>p4O%dz$$9f3!9y5@*;GTEv#!bvi($y
z%?>gfkZ=86v6^!-shGF8TIoE>*WY}avmp5|qz~IF6z6krf$G3(i`Tdo153ISj>%~9
zjNv!PfO&?S2?`#h3o?sO%Mh<yC8}U8TxdF!%;uuPdGz+D@nc7dscllE&xVR|dgjIA
zkqI>X8{DSDzV-4L)sUY#TY0zxGFS2|N97xLXE?Eg5OR#TOxPHndm+OA3N1^pEF@1x
z%Oy-)7V6yknj5%+N)a&sD)KCa-)mLa?@)K_k-6#|(r_^4XfYw#2C$=9JLz|pS<~+$
zO1uIUtQP=Egp>TNS8p~*Yp|G`1{l}4&;911{ja`k4^bd<c|~B$wA@^2FgR}B#NVkb
z#^J2#MPon6$J6L|(06jhlSaF5*itv;{PIWs;QQqY6{+|H(<X-A4R&1i&1PWVR!|dA
zu`wE#xgwz=g53iDtqP;vh`aw~1PJbgjmSdWr=5B{k`fa9;hU5>7R6A1YjLNparuf8
zjQZ4%gJ=wcs_wRZKEkp^yQh0h-cI-+sj^zVCCW;-rpdTw<1eX*SlnaL_HK@*$a3kv
zf{X9OmM<QbW13n~`8)5+kso6#kx_Helb@!FB`%49#*>0QMn%gnH2PTcm_MU3ZG^`1
z)m>FG`WvEmQ|wNxwC6^*WEGdbyx8s9=)3<z>uk8D(n2rV#oz8o<x&7|#nY(9sa1FK
z_4%p(<itl?UD){#w;}}8^ozu0isvLx|FlE?-fI}>_xR)gvPRn~<V+X?2P+<z_t-q_
ziLYzZiQr_(V|w1}dq7}E40rf37C6cHS`zFTnnX=#V*n|B_bmA|>Cu|4XW8!4;bAw7
z!}H{Z&OzZw&#HsYqw%Z1@P2xVa}IbKICym?vHL~gSt_ayU!2z9uIuuINb-q7hj7Nl
za`pWy1Go^^2*-z<+~^YIUrBLd3xdFb6gB=4(fcSC((B4053*0RYu?RSz@j%9_XMsY
ztl_GPRT8disN)yjf9a;#%l{8$?*Yzs-}e7sRaZ+@g|tRvQ{z$;6+1eVs?}C&w04TB
zP3?7Q)u>f_1nELsGxnYlHDikyAy#b>BZ=S_*Zutezu$8|_wzj0eH=L)Lc%xS&pOZZ
z{W{N+^)y--<@+Z6(+Wn&Dmcw^jeN^t!fwL2*>*Z~o%@v<T&Fou%AiE)N&SZLe-2&z
zj|+o#8PBiLBEtoO;YHpq^<Sb}9)A<uS@cB8_LPkdIwVmlES)`tbBGtdU2u$}pT_<b
z-S{VG{=a>y2spiJrHAulX)QqULh+6N_Lcu+&;8>m<`TU==F;tdpRQuV6rUnp#d5=^
z0>;1fsQR6@Q4p~3CW`&@UahzP^1A+qA7boISEgNO98Xfg8<;a#hdKY>`~MGSwS{O5
z+>&<m=eU1%KmON`Vg+NPF>o+_-S+<yqxxU&Jcjr5hVc>y#Qv?jMSF3TcxWes)BgHI
zx!zr8lYehk(`M#25~vu}!=vIIBZ0q)*88{L@74hP_=SrOHqWEcY5A|_{WcO{a-_bu
zaI#KB`j({q^L@bN&{KSJH<YAff1D0fD(yCy4*mL<n{f;4wbFot&7k#?W1$^LO3;6q
z2J>O35&kUQ*Ab>PALI#8aqe4OQ|rIn7`aF3{b@~e)Pk7*i4>S+VEu(li34CVB~Rms
z?fe5kr%Puo>Qn#Ke#*@qnq%VW)_|@1&y#GH^p~H?N1S>@dms1o>DabWi;nLU*t}*M
zz<&MDum0brRU9i_(7h2E*#sWVf5VLZ%Rx>Mpl!AZbI%I?-Er+?pplhv2~q1e{@wW)
zck%R{7ssFdb^rc(xc|$T{ofZTYBFTKj)|F%yaYw(sA-J^$NtNa`zLGj|9$FYNvGCo
zci68dB=PUSL9}baoI4$&b4hMr@3`&g8{m{4zjmztcSdQ}_w-H^WQTd||J^YXV5RLD
zOqiU=BrE@+UUm^Yr&AdXn|pgTWxw{)4=5<DC76MGU3n`0yV2jZG+Sh}XTNSJ{$Z1}
zQ8rhfQM2TRf4)(_izuA@<NU@~TO3edk!D!EI@p{RGEVb8gb{ONN4<4GQL%iGOt8qG
z6GHK-ve~})C_|HX<HshQnP7*`epzu`cb3#4H%-wzly!kx#07i-_w08bszIzTdwbZD
zb4+$rXZ*aVe|M(QPE=>{(h0Ev(a+am{otG^t}+>C;Ir<f*PB{%cr7r3;~s2A>K;2K
zo5sF<k!<c!1k0Dg-$(ET`;NR<f!_B->mbfsvd+Csk`c4i!{$P~6<$?iX(pu;-}4>{
zl)&q{-WyGTzaAP>_ombqG7-N^yXeGq3YN!onWVv+3%PV}xV_U`9jYc@4RzZIOOSAU
zkg=EH;XImaR$Tc1%l7~4+Vr7&j$5%5T}%OMdAEDjKFW#3c^yQ<V!^=*e>{IZvExkb
zcHWlWklLztavOYjg5kg9`|DE#&D)4|p}RnC6|NGz1K8rS&yvZR2%-Uc;|jfUB9M?%
z2u5#@0i1fwHhJ8QNnGGE=uSN{+NvJ1t3(eTJGtm9EhfuUBbk<v+)hY8C8I)ylHP=>
zQ<hHIapTfRh{M{;28AYCk+Bn*dF1a&i<vC(^X@^;wl3vH+lX^Pomt*k2WXI~v7+cZ
zYs%Mu)=>Y|UiXiM#*L=G^w_Fg<cA5JPS?D6Euyu)u6E6@(uu2c-o1Isq+j!9JrXeF
zaW_Ohb(e>kWm_m{579-Ng&SeOwloIuOICL9SKug_e#qha%4y&7P7z9V(_YcaB<^^>
zRD2(Kf8D)bY5Afxnuane?8Hds8-I1q^3|W}_J9Xg22qNZ97+NUf{dKG_0YbMz3&Fu
zr}0r;4h!G8-M4&HE6Pw>)6F@lIYhTWVbp!8#@(S6e6%#L=Qmt@@a`9x>c6<tGVPe2
zS`K^Ehje3jkVs^QAe~Og#<tLf)^Y4~By`;+)s=nRZX<qaCuWrMMgVp=2i!>Nkj}|D
zoLbhep7x&HU6c;-tD~t&=Q<aCTFY>Qs>i6mE#^h&%<|KNzupWmken!2;JfBHlxZq*
z!^UsdVZ-I%8R2$EM(pcaz5P?B6SQyXa*Vy%AAT4fTm6u;8PQXn?BNH74~y6hi=YpC
z_C|A#I2wQ58$OL!uY8V{%5<rj3ts`kNyy#PV1J~AQIM0Jp{{;`60uh<f4phGa=3)r
zU7~yHDeWFMpB&O?#_5~j5i&lB!G5_vdsqcW?q50mvO6AfG(H@wFjE7OviaOcmFn?~
zuMgljEFO`Zf12mKsuulx0+HU<?jT?9y^%RXb2AN2+Y9Fzgiwa>?pD+pxhD*v<>p3J
zW(aXB8?GUTucy7n^{S^ldH}bryswwHw~`Fhk9HCIaB{DG9QwgnCT+@}kaqV<LW1gO
zfa~~paj+f;SX!JIh$<?QC~5GZ^_ZvR64bV76_*NzM~yAjrUSMb54U@l<%3{<_n>GY
zJfO*fPM__BMm5(ne+k@)GF6q?IvO5X$H>6n$evW&LmX^7H%<9vnS>b>oTeeN)qXF~
z*FQ#D;Wg+kfEMF>7m;Tj-@Jc&Mo+_yyqIQiLa{tqLkKin<`cHqpE_+uHyi=k{p7A3
zX$Yx^y=5l^N7xqXJntr_L_Q>?o#H1e?R>}En1OLfP=yyf*~42HjgREBMM#It5OWk7
z*UYyvbM^}DnPqy5s%MnL&W3UM$qx)Q9T!x|8X^8_^4_T}uK(4|zwZ=z6Zm1>j;b4e
zl5;{`HrNW<3W#`l7sN5AXR|02<$N?^tBZ$hH4ssYGule}GYP7lX@_4i-hy4^Ww^SA
zVVIi!Yiot0ill{Fk2g{7^<Npnr=$<_ns<cvf%Rn=y&Pq4vp_MO9CGwlMf<gVR3AQ~
z%E8sbg4D*LpP%Euswj!12uD7nn7`(c`8FQ$+uErvnBF<*+8hKQ4j)p7T6kDV?{P)@
zR*XtfRrAelwhO07Q;yQP%>lL!9L=<)>m4N-^f=F%(n<TnB{`*WH&#yRtu-Taiel?u
z{1Hj@4;?>BzGO&ZIwo1iL4lVyf)9~qvM}_@tb534v#hB@B)56E&;!1+82GEY5M5q{
zScE`iMRS72XhhhS!MH`h#=_xJu5{4KE={bl&$^&7m9IYezgW4Q3bf{U>$sHM#Up}V
z?mvW3HX8Ft%J%&e=rk54^BXf)pHTfW6}i%z4_Df#+nyLE6CK0*mFKyJhnHfv`P4}R
zyNxQFSuT`*$>Abgy>s1KQ++<rK*_=1t&COGRrv5)!@VIoVl*~<XBd9GyYjTef0S11
zS-4+%r^0%uF&2N?vUPr!1MMJDZQ7T*Gcxg_KTpn53e>Y&`Sc)jyupt09ZvZkg?ab0
zbwx<OcR+;h-J)HU$*v(vGZ1^rm^Vb+KEe{gDGI~h#|n$o)(NAfv^P^8pDtF5qg7*r
zG#aY6+qf0vO8Kb;kp&OT8|zAKFsfx;!pqCp=->?>T*T`<SQkHxf|H`$cP_Ca4`&XV
z1j?-8jWIen<jRby?_vVbG}3A2<oF;S7(g<Qi|28WkBfOndhrDuDB072s6cSTt5#)m
z=G>0wlx(rTpvRS0zR2z&Qi2O=!C3tI6M+(ZEqMu+Ur=24Dl!4Del!HxR|^>BIK!SW
z!qK$-j^O{TLP1}~VJn!+u)Ff9lx-m)$t)XD(>v`EvsoD(i@cteOe`v?a!~(cnJ*){
zBCXTHNkqzdRC?0icJMr8JJd@cO@5vjnJZuD`q(Bx0w<PQ5f#7N=V|kRY_zjG>g~rT
z)lDQDqqL}B8+T$l8uui*?qYrQK?mKQMOZ^#OUhSsia0U*w(dN=1dhwqe;Af09ZZOx
zzg$$mS?3riiWvO+5wKFt*+*U-;TronHaF~5mSX3I^@F=#4=SOvEC_9Bx@qPOj>;!7
za`|#O`y(sjqHtNY8?I$1+r{<yFxO_UItpxD-}q?SIA3M+aIoSqjAyuAwEs>xx!Dw7
z_9-p)LOH9mTsk1Er9-nx&j-}9nHI&+`klSU1MFlp`AvkLW-J(@MC4n;n3uBHK0#nz
z6ES0B;m7YdEEFx&7Ln}v&6w-sMrMJvLt3g%C_dKTRPfsm_&IQ^<>FHDt_PH!4xQKS
zO~Lp@Ez4Rk0W|kMNsJ_Xv&?k!3ExK2u4&`8dsLFaF(#?RrJvRpR8Mr1raxSH%g7p~
zJpZ$DH^X;A&7R$MVjyI{9Il3x$0E2Ub1E&DHrwy%vc8FY?uUN?ofwy!!2)Htge<#9
zxFVW1laN~z9qb}f=rIns4qvUoiEV%W@Ee*=p!EA+xdk=j=qtEQV06IRrmb|qgvmjM
z0m2qCtWFT~u?<{Jb5^poe4Nh{(7latLAF_R4+p=-9^SR=U0lhJkM6@j?}DPt(W@O{
z(aJ%o#2>v^M0`(1EssWLUHc0`szp4`9vxZ~KRbIRO-StEa-<|dOy}9Y-h|PPt@=UW
z0}QF@p<N8>k0{3s*_j(1qDO7#hi#ilH^XDvO=Qon6Sumbjf;9?Jhra5!)Yc%9{hL(
z&MWHGxNuE6BP(z(r6kanG%V7TD)aX#bs8mb9)KxyX4uNGJTDJFkTnmSDbG`&A`9}W
z8!3CkzvpMmsCfmuj&$i)W~}ikS+fUcxwpQ?-J?ydoPfFAkq94McmpMRn1=;dT~+G>
zov6>N`cSq~_?_7T)ah{tSR(I!Au{QOApbzzuO$$UgsKDF%V4&_v)KIp=EEty?W7!V
z4^5-|WG!UA!1Z2%rovQDaT-7<rc`9rx?Qu<7}PlXyEJF*KDc;-f1MSUZti6EdhlL5
z-*aj-twU7<TbHA=(~fAaCH~rvzchWDE9EsV^&3?L%D2<xj@LbTJ|1)cS{bgXTF<(J
znSgwQ;GLu|@qNLF{OtZs;`Q+~-^iD9>*Z+Pd3=OoM2o=2gwjUEaNa32!SM9PUQ813
zUd5Gyg&byLI9vwdT!;#1M4W}w1EV}A;w`J(J7r3=-b)_!Wh)Z9uQiz^9*;%rYp6M;
zgG$P}Ns*Pkxm7kg9@5^>j?wQbHbSa5mY1a4zVA+mi6;9Vtu3Rwf9HrHMRD{tE0Pve
zh;VKuPy9{65>0%XSf^vn_J>r$Rk&BIbUmIOx;`8B2=$(&*@O5Iml$h&UUE{pc6)6|
z8qycP*SKDNRVZZX4xi_zc!aN7dhKlcv+idH6Nxdc4!VhcM8D+d+YeN`+8^@3$F4(`
z5-g8`EQ+oXmMZPAd@j#q&C4FS!~|+`*2EaDbA?c%hE?Btc?CreQ}~bDN1ol}lL`(r
z{#7#LKb!UeWkTrn$=h?BY2fWY`0l08VAp4wA0<=Bl14*$|9b=f|MjPnTL$&53`6@0
zvon5|DZg(^tKjN6=8$htQoH_sg{P$6qi)-Qc#ho2qHi$K2vxQ%hNI79#OtOTpnctD
zMsf@aYN>76!z->q*w^EY2fFaaW2|2}X~sd>5Aw){slsX9ZdeJ{;L&BbV-F!_tTa>8
zPGl`?ZN4aZbvaMj11Iv1&_`3~SYs|$4~%cs3a?DuxY!XHenJMQVFE?24$j>BuzgBV
zFo<IsX!u2b2+{Sp5A)5g9d)ur?cdUcQ%3Sps7g`=QTd}KwZk&Yf{N#e*K+|;!PU-z
zDw25VW4v@;GqtCg+ZkBil*pNN;qE{yUuZ0|{~N~78Mwnn9H^vi2+iqU##+MjD4yBh
z23Qg#(0d;yzZReK>XUltyJP%oj}91))(KAljZ<hQ_pLzr4l$9yh)BJLvR`SzD`_Y@
zh<mRb&CG2*fu9gVAjsd=HR<<gZ8lD>nlY-zte9{4k4G97O5u|%N$)Jv8(uw7M*#R&
zv~=4pS$F?s*iX~y*GG0JA`7z2>6r8DXIH!woF3q9<3G%2)5!JRy75LAY^~=qK*Z#(
z?`ir3jZm0liRbLIe@w5eIJ?tB`+&n}YA-s5kg=tHJg?6CnLbER>;cZUUp=(_)Ib-o
zBA>cVK}TzreDjZ8dTa59A;Gcp&aMHIfN)>=<ff%o-?r{&tZ$7)Y71Q*^@e6BBRRgS
z2O%d1ome?<M>;;biwM@=%xUr*G`m0)RXRp%Aad*!DObS(uOVFq@w)o9gTguA8XOgF
zH6Kkj^N9AJlBhyeG11I|yhKvBag#@HGkI965cNXOq`sL9YgSs)Fr|P*b9($_^=*5Q
z@xeCosBB_Z^P;3H7vfn-6AS4E%My+=R(ojc;bWT$_R`v&Zi&uCx%I>FBbZB_L!be*
z3r_9g^rS{v7B+RxkWdP7e!_TQzOpBYj1CD#YMY3OD_EY|%;)6<x#0nUt~A#vibd44
z5r3tG6V7Uzemspknl=fb%r7J|Tw#0_sL!y-F#GkWXk+lB`ri$T%_<7rNdA4otctvv
z=>r?LSgHufv%b4Or#7qu51H64(~*MptB_ZQzq9m;!q+q2UH2@gB;Hx__5|5vB`rY=
z)Cpf#YVC7W8js%_>*C0R2l)Z6Ay#!E2Mr00GrpeP?I$9m;4h=m<L3~}KA@?UBxY|>
zD@>_qvcNGvJ>pYIQIpbK=+72L-sZjM&GKOq;5x>qP9DTu0}Ox-FePSeH=k(^iMpMY
zXl;0iJ2?zd2Y+`?6oq*2ie5xS6&>ZPAFUvw`iuerB#anGz6pbOj2;&vtj`~|h?GlI
zhRUCV&Y|;EX`1Cl(8k`uy5M_ErQ`Un!O4m`542R95Amnrbq2W#fm`^y*8>5_myWtr
z#Nq;zb7`ry!PIP64DzE|>j#9yI66Iwmo#V)0*;00A=o|x{wQ^YRC+#+FxeePb%9WX
z({zx#ig!7!xP4i-sqG;omIy$Y9zq=b{U+t8^Mu5wm1Q%k*<VZ+e&Uv)<IWo4yT^V;
zI}!4D>4WQ3p-d2?rJxPJ8JjwvHl@DpPwDxN9>u8J#Z8n|ff)eDA?hW!2G_|x?s!t5
zrbVCUIX&lG%K`0XoVW%_A{?eEW(|JqPg$R&v&gK(SEu{*<C70)mh)W`WC<aoGh{dZ
zcyRW;!1E|`^%6I>gAj_ri9_%2Fl;*1osGEN7cVcUzow0U+j0S3h>KD1WHZ9nTQ1>s
z)KW>*=n#T*_{)yv2N}cJB#wHSXO?`Ffe6&{BV9zA7Z2YTn<PG)`N?G%Dds~ALvKy&
zV8eQr=}xCKm_FEPO)D81%eHuLAb%=1zOrSe<Oo|5yTxsz1|^!$*FR8!0?W}wRbx34
z;H>p~kwWM$9n1rW552Q~w~T?3b>v40T`-q_^xsuDW@`jXgI`DVVS<Kya}->czc|?`
zA$O;U(&;&#`{d#4pbUNgmk>25`nn63Y?f(ysYquA?l<{r_?AK73rHihsea*ebUssm
z(9&xn%U0HA$o8frqf@F(qyra6!r4ct(`?W^L)|jdtrr(W?_sv99Gsz8MjkLB#qY}d
z*cYIY6@$xG!_y9u;E&FMKm)}T)KZN%Qj!Av1E4}X8kBO3OCrb5DV&K+dK~HL^rPJC
zXm6Ya4(@gi2DWXlJYg3t)(}gQ0UBe{IePjOaH`;;sAmjkobo20RG-mrNnrM`?F&lN
z^K?hRD40}fKQ^mUn4wjcunjk=H$FWZHGdQ69XshDLz+80^}QJMk%ti>qzEVxZcxY|
z+)ymyd6$0&)Jy=~{f55@3PQ9@e}_ap<rDpO--cCs?oYqvVTnuz!AMwdwBeK9a$lTk
z^gWt?!gA3YTP_{^nU}b49I|H&mGbVlIWO7-7*Cf7bftlTdz?tYxwqwBR@|KF98TpT
ziw<y^pECSLZuodV_d7r3$Iav@K*hp5%xqHRyBiT=$jmGC<6Lw6h}c?msG&=tglF6r
z`D+$;_?v_(S`%5IrKmQhyKe++q`}A-W+|k~YNTgi6$7~R`1DAfOEUS1-OiBH^qfQT
zHFenPrK1^AF!G{fZ8&Nl?xIXAx)(OHn<voC`b9!KhL{ytz7u(yLG#8wm)yx%4Z7Sg
zJ5YpxPfG9jF1ds<5xn1RhQx(>9FfZV191Q@KW0vsCY?YFgs^HGgCio{(9>Ftjm~CM
zPTJ@Wr>^DR4`b#tiDVnvn%g>2Ybv=>%3Cowa}eVdQ;%lELA072BQp!V*19onW#O2X
z$;@rPJ+cU7h<1WiPQ)C9)>QnHi1Xh^ZE49=Yjm*AOHRS}qV+JQnx0tke0_WMBd%et
zd{t-VJ=V`KU><NEaH}xNaf}{ZeoORfw%=Kw8B}(^8nJMtcNi{{?Y|Q^)ODo4asO?n
z|D>fh*pE>(YrrZA6JE+}<E6m|?g}~Z3GrdzcUqXdUmc|%b4%52^r^8PEh;A({<3YU
zBGv~)<M!Oj!i-B5J6gl#&qTy};(y~9q!S1oKkL`{LC*n14#XB#wYt28spGG9Nthnf
zw$#^7vq0Sj8W7C)`O0Tz*d|q_3zg@CvRBo(Wy4>{{~<C`5E9epi~I`L$#(xkD4lh9
z$OVJX3tFu>xFFbe88XW1g{cXd=&=BUe|1F3qcj9*Dca+xB?t&F#I}u<C@G7={27u)
z5NjWP2a*X5w%LCmP$K;}4wf~I><X8SvTBiNM83L|g};5{_QhMbZgDQ8sB7FnSr-9f
zw(oAwj@qDJIoSy8%5Xf!FB&JpEIn`0Yh1h?d5`l>%-c$cjUL`mUDxv!qjlJejk!7}
zc(BJJDvHB8c27{Bj>CotTx1HFf&uA3o?oXhe+3l?Q9ayT)n4p}gjf(F!pjvxn;J*W
z^KG$_C`B?@E9{}h)3M|vTUwS1?f6=#G+Ux$ks+<8Gl>rQN+ylFvbvNm%B}5+zy*#V
zv~<x+pjC#{U7=rXs_t<u2gI|{v5Cj)v`i$27z@~L$T9kaYu)2LTkF-^1O3@55v3i^
zZp8Jj8O;yO_*<O^!GSorrs&>U^!ZN-=+G?&VrpfM``WUcT@hIo(3`IQ22{o9Iit$-
zGZI-CgfNvJqeEO8yo3r<t?@ldsoZ>Ou{1D6R=vO4t}hh~7n(olbsh7;IwNas|E^Zz
z*1(E+VkK8qvJ7<4PcIo>>YK>VdcAYAIo&?X&J!PJijj3>`o*-gN*2UoB;XmYOZfu1
zN_)xV3K(#SdHQw=r}f6>LxIWPs<}22oo-Iji(GJf)5&)<$QRpZ1H&S(fKx_+Wtf)K
z^4q#ra+YPEbVqJg+)|tkV}8S6!&u@XfE-Bu(1KEWq({#}&zjg2#zfCdozUfA5jf+1
zo^VOv%<V7;Jpf!)DIe~%G<j1rm9&97-f+LlnDD_}(E%w^8|zvt6R91dT}W{JG9~wX
zPVVZ)5v%3gEfXQ5z+IXBEKU3f6XCr);VS4bC+RV~j&#2`J79l!tUMsdjL_~)>GCvi
z!Xqz#{+;*=g47>b_<Cu*Pep~2F4P84LPRF13O?h%+L{qEAIIXC{=>75(Vd?4t-Kv?
zQ8oiWHn=v}W*M!`uP-}6GfpDU7}@}j6?B${uL|x9z7QDUPvrl0U)RH(U_k1K_eSdJ
z^OvC_6=M3H35~RBs6*SsBg22TH`Y{iBx2sV^~mMXOVfaLvy+S8MIQ{JwUsn@AWUOI
z{m92C-6t;~$;7qtPkdkv`*q+4ljj<S8amb~im@`DpVn`Q)1uwQu?YqZeQ+hAymn10
z{u+az><;-^wt=_V(9nsd?P`%0o~tRSDmLN9dvpAC9B7Oy4{1(bU$vL2C?C6VZM6*>
zWx8a^CkiD?{ak)z7Dz4xN)mGWukLXf+PN@%C$-I7lk7~jcVzd3wsux>J8njV9{&%5
z>wo^$d~!=39ZXBX=HQ}r_vW-ddz8sJ$@iIlLjE%+yvFa(-DiWT5yQ8FhL2cO6`91G
z(&OK^Q&`Wu)q@fyE>{gYK_^7&zV@Oj^}IpjiF)gn$BUM{Z@6GT!PvbdClQq^nv+g9
z3d)txeCp!HOCyYX6Qxy3edh$u!m(IxQ6o3mFcYU@m5uhb*papQ2Z7*@YbCbsuihar
zFGNWKy*D6L<k6GCTCQnSxyl~(ds>BF09t2`4o79>2k>$kBc<@7QxEf+NthSvGMpit
zFNGv~1oN~ndhD4<9@@&OFGdA%W`zjbnMGdNwe8`yS$`~I1ZCsHbu&g}J;uKVeZFo>
ze+hYBgN0ssED=K0aU!m8oqcm2e;&Qwlje+sai+kG@o`yp$;O7P&D-V5kRZ&>^BPz6
z1rZjEb`3T^&0h54hb{Stx(#<K5`m9p74R}fZCq^^gYe^5Mf&H4mCLJklWugFSVB~Z
zUy8u=x4Oy0m+TkEepKq~idY==M%3)ZVo=YFO5&BP$o5Q*fgSx3l(*UxPN9&R(!Ow@
zS=O`mCZvK4`xqtC9Nue9bsep4N-t}Nqpt^JX8GBPv*iW=XpHp_X+qYNS<NmKZ4&5e
z^}c9}W1j^0@-=oZFFt_0Goc1wjTx=f&6#LNHhR|@O-dc^{r!_uiw<fZ<YkzmXqS4m
z7gk*EYjwOebAAiH*|2tgcv`*5UU`el0LD9Ww5`}@ck{VpZB>*CrT55ApkIh+w~<W@
zC&X{o1^D~UkklL?XY6M#K(3>}Sy6%w!Kl23SO*YNgAH62by?NE9MkwBY2y18Fwxm<
zGIGpFg%<q0hv1U5P6*a{K7kz5RKn4VW2Jkhr2SCm4yDlF$BiyJY2$^E199pcd=u1z
zhRj_BNE$OK>+2`WMDWm%G^{xC74n0>-(!5VE4nt-*)2sD;`excg{DF<@u9JP79M)_
zH%usTl1GoXW^9Xmb2)Bz8XPYe#2G$jFs5Y;nq+O`y);iYnvbdnjZTpK%Mm<Et#_$^
zJRe)Oh)YP)$l}H?uzETav3<Qh85_~T(nRK`d!SxI7AP)d?~Mibq}v$q>`OVf$q}Tc
z3UPK9vC_*=&!W4HfdQ;G-{!~5lWXmaExi&0j90bhX858EgYa{A{cLRPD@(xIpja7O
zgo7m6>F30b`P>4xQ;NAdJnzeOna(ORZYi(zl`RiGb&tKBT^SLF34K^(@K9>eRHre8
z`D}pm^&sh<v;)F5bVrpEUh7$vc7{Kk@eco9*!?C@8uUGUiFN>WvY)}RLJqVG(Em3h
zQ7iLS$ax-zw#t7HJ#IJXjY6c0Abc@JRew<((9o70Tzu+5XB(#KkdvbFvL5|#p2l3z
zM3Tad57L@jOaU|Qru9pc)5N9qb`@^}Tn&M;LSf2LF?XX(5SP{(LRB5rmNw>A=u4un
zp7c2%^e*ma_+;IfKKa=`?4=MGP`7dDqs!6@no!X%TRAof{n@s6#?_e`y!ITI3E4-)
zZxFkAKv?j%MSQh;v7|fQ+#BGvEMdGnjU!<7=ziyIN$xfd=e+aV@t+^`LJp*0gOu9p
zGd%SZzT-0@YR|El`##u+tnG+jZEOAwKO!YzhZcTc<8P*;l~i<awCMT9=vQe1pfzEk
z@-~&#t8hOap34k|Dv--&8iQ-uaAmQwz1QaDICd~`)2fcuucW=4a^slO>_x+7xt?Q{
zu63wBU={l|Zs8#qIj*9FKsmNFu>D+-JuQ;a*(F6W0a|oGH&bOmw3IZ!Qo2t*&MKQg
zNbsG48Ei26MzS~5bu!9P${HUH!PW8`07r`MB5Q9+68np_7@6SXUinK1==x^1Z(<U(
zP3VY0zoN@tpm#!OXh>n-4PZ$XM?2i!oVX<6`BgoY(3&5h-H5iJf6+}e9f^mJA|sFn
zV|TG)J-OG3qP&C$B&~%P4Xc=#KQ$T^8T9Zv>IabarJ1$dtdB1&B4<g-iRBKu6st7(
z@3AsmAkg|^d3QeNBE|ZLIo>W_GR^Ckl5?!5(x&ZHph#|?tnqRNv-^Ch=W@UM`!tj6
zS1E?!;BwGm-+%HlXWbY{<==(3;OZ=CcK;lS<d!(4!JxJxDseP02%69Wr3XVl5Oelt
zLY6YU>oYoJ#-{_1c00<^upGa!iD6H4$k_G53<bY&9J9Pa=1FycRKP+QdGsO6kuPPx
zNWlQ!ytKMfMP7iNx3}&q^-QOC{!QfyQsf39jCqB6H*4x#T`cs?IcKN)lj~Ip>mwIR
zE|!s-Pd~uts6Iy!cD1~gFQ7Z6YvP)jKyYbmj-GdLg@Ep?v>*ovpJw5|0vHY4E3o7d
zO=>ut-pVPi!M`8Osac|BvYB&Wt|PXa8%F#r^vIoBZNJe8mf&P8O6vVjbzVFx+#ebl
zo4b)*gq>N>K$Dn3bd2~jbZ0!@UJC(l_Psm&y4V=3A*R8P`3^ONGo&GxO|i7P3ZZPF
zS7uPQS@ZzP)q+~v_PXt>!lEN$^(%QWltdcF`Yt5{PR@|Y*N-76i_GJtp~<K9JpAWD
zIK?n&eI)r*>kFcZFg%4q`;6@|ed0IqZF8r&O|N?-t78shpo*5%S*>0R=tAXVMYba|
z&pvr*7VDd@Oe)ytZ|N23!Kj4=K|z2!02p;d%S{7K?{;Ad6Sm`g@5flbFZX~%-rj~9
zx&+lX(`t`sf=bYW)Q5JwF|7?{_LBD%zw*`F$b<J~Mk0P`t9uI*?09#5q{l_Yr;;7{
z^m7n%mH{!RA(@raSn12ocoKP!tguPy5F@Sxw6As0!jwKS2yz3B;@~sqKwZ-el3DC*
zM38c}xjJLi9Am!eWLIkLUW2S}(k_fOAN?V{S2VyWYB+FqLEexeh7Jtx__Tm;>-3?;
zZm+y<G7L(a?X>re==wx*IIXzxw;qZ{3{GOD0?R-1RvQ}CvVDgbhkZ6F$GhK~4|fVH
zY2xm3ifcyBUWHtq;X!YSzTb;toLV&f(%DzMnH};6>%neyn^mwpmXM{SVU8xRzTGc8
zEP5>P8hd}S{7LR}N;0fQfQJ|{AMx@DsoWXHi{P)$mnTcB5J&sf%|Tfo=PoBIG|VyI
zRlFTJOFqRj^4FG)Y3;Oa&Q5BAAHC~y5d^@NP95kY0)?;bENGtoGHVqk-ENJBg6v^_
z3+Z#Tki!eD`i&M?$Xgg{(BF3A2k&2N`%{>(+$~aP_BiLzHb504{0hLqXAz}=w4$;>
z5cQdzV@5k}>?%@7M*T%!A`GXh-%I#W#BiR0=WA(9P|%1{-@+AII=`aYue!BjP$A=`
zNVddOs5c$p)5U%)X!-ffPO89X>){o_rD*1=s4K_Q&4)ho6O1Au`}QGV{W2L##VE`7
z>7tON=g&)mHXQRqb_|ZY06OBLb#8*J0!;4V?vbn<^TKg5Ct<930hGWqE1e)xM}%2M
zk3WJpHePWa1#;!yXM-OHYIAZ$C><#O7;iq_gE9x=fpE_Jcq%Orz5Z8-{DzG|w<^i$
zmpxTFgxu3<62thME?uE<MenW&zWmk`8|EkjmmrDe^|GG4Q``hesVoU{j?6$>#clii
z5wnj^dCsx)vkP)sf+m9V-NSBfHf8ZN(x9kriuKjt&GyjWklg9OJ?g5fexy0_!GNZ)
zkkP!*^&Rt;{K|RHqtnoT&he7#v0V(4<NgHyx8Wtr<DL-ln3X=_)#^<d1d5!zWBT(T
zc8l@z^?9LUAwi)bfl{Gh;K5U4bNR6ZrR~PItgQV8M<WKY<QpgSHtVG8IuJDKisqMX
zK=7|EHidpjGwD#jqqi=)bP3Q~t@C#=MDB8W@MR3=23B*k2F9ED`%Tg8K>TZ>xsN_y
z?W$`&-*mwEE|#P51(pWt7%XRbFTGxk%GW)hl0sMN)k!n2_x5mE5T6a>eCa-XW`Iv`
zetj?HLxguPsE!yC0doqj*L*@0A-pQ<DxT4-(>p$`kTzUDvqx)FxJ4h8#XmoCE=?~4
z|7KC*vy-yUDuYr()iN#Hm<KdKQy(T#dG&n`B`4%ladr?Fe)IM_L)qZt<&a<}3efbI
zRw*E4ooxva2=KeldinYm@b2o4s&e73z=c`MLL00++^j8s*eFt^7piephp*rO(b%j?
zM^ATlUY@-T5MxOLSuU~rzF&+#{uLk2-;(u$yN1>0B@_zZJ|mjX#LCEeJ8=6gA9t0|
zZ}(MAcA$_*?#M@3Y+tj|=cG?|q$BRPQHk1NcndTA^8%>?G44O2z4(2~7-inprjCtK
zu~eW7zzU!t%<5a1!;l<|0T=?RIAN7mkjK)Uq4Bmu@$n2c4aMF5W+K<kG<dKekahT;
z-oWjVx98^~5x~0HHe-sNlVS+1L2g#0+inm#U`9^k!BWeLtiGJUL%}S<GkHM(fz<~P
z4v0;E3qP!dgYJMzaQNt7C^NQ~FE%?Ivw@#8CbLz1;?NPtc%M~fxG(Ewx^$Yb#hc`V
zrh~>W*|IiDHUQ7ra<Sky0`QW*)Gng9#W+nifnT(S5dhi*?POt18}=%pIs(}`$@O3<
zO4|6bMv!Sw_w<_m5vi#)LJW1UFpQZs0T^4z93!)LBy87q)o~yYI0WFc4pR$_uhao7
z^o8CK`u}PHc)5m9J3~}=NG$nCpHd}F{i4=kdkmI6TE2eps=CRc^S?yM|5XA-=he_4
znr%P~nZeNf3|IH9#w;-z_(d6YT>bLgO6p;-;t^@hk_N;b)eo2Jt2-*sj|}G-<^l5$
zz0oCaYL~T!eS%3xEA<CdtE<xC%GRB`+ZOJ9IZAMJKzd0f^DfzL__F&u-z<^a1J>oR
z(iT*yo*SrFXlCMp$GPc(@{FVNA=~G_6w!=?HE>sKY|tL~INJ#y7Q35d4?H|Y*#I2d
z1~qqH0urKBkDcxV`4t)G$AdS<Q4UJ1e{72@nRlGqr-fbN1~j>_GaT^dw^rXsCgEV!
z=vLc#3$DSibhUb8(QEb*zmN_}sBQ(q1^2Urs6J|?Qua9(Z&E7|hmpx6T}i5AxK#ED
z-5enLil%Q;JFM_ebv5YeS&(PL#8;<?J;kI&4JqUeeLewy_o0iQ-kC6XmI{OcBBDd0
zd_!H^IPcJVT61fNgi!KBlu^Z!Gah&1|I#)FZa=(hb({Wk4v!#E@ZwY(zs!4Ds~Ug`
z;7<T>&T)FSPpgKO&KahM6hUf*iP3Xo@ws|fP`qp~qaOqJ_I%RAySf@uJ(odq4lazQ
z!k&5qa~k}*g>sIGzSr`bUgnqh9lXjvq0rblWe{FYbT0CpShOP3aF%L&H9<Ldu{wCI
zI`32s<)mqG6<8&vJ2xsV0xb$%Kj$*ok=h5vADve0(ux^loMZfS<u)rK+JxLH<~Yjz
z91RH=EA{K@x{U>Xie%DiD$>^G8tisG*>`0TNFaBbT(_x|%HD^@*tEx>7qe(Kl<`)5
zdqFlv_<gI<VQ>CaAa!%=cyo3+>^jlGoM`W?()ZIJ+OBF3Vay3$_6fExlopiueAV+i
zyoRAN(4qm{>%(A)a%6@U>Tz<y%VO?k>tyUlaR?Ej2fOY<3^AtVOGr|MdE8*oFhZN(
zvoU2*a(tjHXuLB~bBksa$8peVyqUpPJbZVIshXYxxITm9hMR9_wuop%OVVC;O@bvo
zC5XCE_}2d~w`=3p$7WCt)fDsc5~ZHp1y9qYtqiw7R?M$@&d@JMhrSF>7i~70{WQwG
z+bvct7$XGwPx^+^dCFVb9c~8jW^BUmfqkacn<<N7&-3!v72Pwh(GR~3@HRM5-x&a4
zrxc<ccr*7z?>>=p9Vs?_UaqL_q!bm+-+r!Qm_5sga7w)f5pzB*B42JzELG~+f>7Wu
zjF+6ewJNOM!Xn$x)qy8&j!SnP?GeR6VS>o3`iYS(njp~Ns<WM=<JrlT>!<Qoc*~o}
z7Do$)>rNh%BcfTQt^Gdiaj_dGWc8C}%32`9b&QRnB^^DQUQ@rUlz_IUfJ(f<q{?d#
zqkeny;SE3iSv-9Z#^b^7q3>h>q1#tnY_18nMvA>4KfCHY6xaM0fBNv&05lkRTen5z
z7;C40V?M&1?qY9WuKUD*0<A=q;EOqhqbZ%58U~g~iDcm0^t<!kd;*W~{SrwdKxn%9
zyn*_0M}m7-u3H&+Dw^ZGO#}mgZT#1b6aG@ddp@X4KECZw{udc-!t+9}-05N~6Zc*g
z{o?qfu_WrgV_ldNWyK)vme30)+YWcBVKaaPRQ^7_I2F(Zs5jvo(}r-czWFtu7<2w@
zU{zKow7<i_*)9m00$Gh6^cQ&P`6F7nDbNC`_rXTLh<VXQ-Yz)sn87W^^s)Wa>V&(i
z{=~H#k3@K702eZ(^DC@c!@=|qA)qC`v*IzG?bNs1@4meY`ux3OSpquj&2^Slp9GA{
zxQj;Ve}ht~*Me&a@86oQp$?ubfsZhIwI7fxa(cZ`HOuA$m7fO-CnUZTD9IBo74Vk;
z-_*RzcsIDnxCFhEc>`CVp^Azm{}DY`qaMdaXIkEK#uV7&)mW%9aP(<k<-_z}<<D9M
z?|;NaIhGq;(wbj&?)^t}J6<957!ueJHD+;Yk#HZ;Q|jk_!Q12hq0!84GjcOEv(U^2
zm34u*n&r)ayh;1Hh}iuEyM&mNCCO<*jp%2XpU~z)E$KxYEMj?_rSG8pHPrtFJ7#@C
z20r3G6e!yn=+XDq^N<I;5pHK)b(87!SQt3|y-D~SbMSSA!&_BzFg+hH@IY>#2>&9b
z#>r&zVH_s3rNyqP&vhR&-gz`s-9&h+gB2g{7pXE4v~b_Tqq_vCtQ?q%syV(-XH^hA
zu7RTV&l5|~oz$!<s?_|G;$BtkjT7UORZHd&{blkmEp=t^o^$b9dv#9`YI&w|_sR)Y
zc&1|B;BkJ8^PLNeC~5YpDV?7EoV|n!_wV)+Y4*-L{(L1Qax9J%yK=M@ass#vFng(U
zJyhJCP6e-Pxj(U8nDwDO@TKdFIUaZ@+aL2Zqe)7;-#*csE5ai`jz)1)ySHy+=APaP
zyF~pF&vQVb8O$zZ`;&EeY?3*{n_jL@@ArU*fvd|C@8m;V{d%6G7;l9sX<XH~jAczK
zB_ABm;6R=ye8=q}oHk->HwfF3B2~#<?e}=pdt_d%T_~_s-{`wX$zXD?Db%LpK#+P_
zqXAO2_PForC$oIiw*ve8dG2(V=VFzQQ!lpV1T9(%8cdWmnxxoo21&`xs@&n)kgLMP
zGs~Fpt;QPEmi0Xzi-C}-&s`}t(JU^H18X?GC<n`OppwaM&FlHu!sx&-<MbD1-Dyp`
z!x1lkafA>!IvqPaWD~qZXG&xEf->WH=$5={MLck1i1(6jfsm;=Qvv#U<*@gEh$wD~
z^r<1|y5KsOIxP<WBU`Iwj?Lt#esGmIhjl&q4;K$}A@tbXK_VHOcbeZr%T}WD+}iw&
z<9valZtEH5eVYTndn2-8@{Gu)Ys9K4F^t;Q7Q_ikc~SCb*_^6tli_Tyc3yDjro4MB
zcF?gHQ|<%xy*Y(uX<bT-2zk+iYW$O?Uo0<xlgqmb_2@6_W8Ch%FLTmd4koks>C}TW
ziM@8<#bG#l@my8FF{V6f>vgiQx7l}t+A1dybhTn$W&XqDWqWmPP*9R18g8hNH83~9
z$O%5E?9yz21lFd`Lt%W{FyTeQr{2b|daJw9zulf5f`g^Ry@}WJdW#^0w`XC+Bw#@g
zcX|)Ta7j3R6q81a0rMp!U4E{?WOLzwY)va@7Uj<6gG!R!C$S|NKNk1dO3sQj9TI^K
zia>!$#u<L*3BghXTh*2JaNm?QgB$x}<fo=ILb)Kk6y<P7KYMO?Mc(3YVTSg7ZR?+s
z^9i8xg^XEU7pK)!Xs=mrmMcfVQd^_%u$GE#Vt`D*?}Gufpa*NYp;=bW{8#S$24Bgc
z+%ya2rVm+{7jC9t@OR&<)#~`+A8+MIYj3uRf4=N#pjd_#an|bWh{r7Ta3)n4v#W?3
z#J%;u9^1Yw?X>GIO{>#1WWh$<(a7EHTNWVXg?I!(<BKW`<5HAu=N2pi!>pFt4?ZUa
zr<zqd{QX=^-{h7rbTB`4uM$l=wUCO526r{}7dj^T?`2%~&?kL#VPuOVMq*y!$^LqV
zLW7pJe{ah93@~<f`kT|}`r~w~yAw-gv9E$g#h<&}kyiMgwx8k%Z=zy;>4UtARqcTR
zT=8|bjbPX{cSKq;XUa;NqK%MqxkFAcxT{f0bR)Um5`~{JDRXajs;>YA_Z)xci1#qI
zxj*f3eN~QqF-p{SuKd;8BD0kwMSK7!ETr@rA|XB1TWgVemkZVfJp2ZqpAx%PJhB4f
z>yZ__RAPtyCbc1()0=CbpRDMoDSPP%2$wyOio)Er+=#S0KBUD8?rO|`h5OLb4(5|N
zowIWUbN=GapWacL(6o%gT`O4RoHqa=OoTijLSvCURYMky0ad#xQ$T><V*2>U#?zpe
z1uf;~(rxDFN-JGa^7<w2s|FU2ZeCnJYK3!tCApPcU(87pcNgz5iM^L4o+LW<sOI22
zOnlrYB#KWPZu=bFQ!^Ysz01XOaC|>z70K!T(B@H2`jBN#aBq!4w*3J`G*{njEYTR3
z8?#|cUGe-l#b`@zbpKctuhp3Hj#R_Tg9Tn~pO=aIGNC!9iz+pPiaT1+b^Z}r=}ILB
zxZ3{NZQNs&xl7=@Myt148KqXG<h0*~gG6I-4aO&`V>tAreQ?~^{hVLw%X~#yR}c1u
zN+~MZVFn{U_#a!M-CO&xcN@ULxuCS7Bd(TaR~D5c;K_alM$=;isMvsB8kDCVyZCx6
zJEk<hteV_f7TR-tFnQuyX0VA>v}ibNGB+T8Hh~nU9W1#ExP686#Ot_Cw)|W@AOMfd
zvnpM4cuUkHE{4X2)}Vgt{39K{JY^|3Hf(m|$3DAauI96KT-;$L|AEWfe&=xK4fZ_E
z&a+g8sfB{=VYNjES`8)Hz3)1c3)lrnZJDs`3am^O6h|2aJMOV||5iHYnYArfomSEH
zqIeW?HDVcAw(02FTwz}24)?C*0}%o``^Td6xt?t+Btan+87i?E(;z@X^37o7cQ2bB
zRqlQYj<Mc^AJS^Db(T4AF7~*`9!@B-QGt%8BR{iCt2eTJW|TBI^cQMrrEc?7mWR!e
z_NwJnJ2er+CUCyAo{ebn37N@o`=cX*C4Ow5s%U4s<=c_$TRCHSwQ%V;{<=QX;CRTI
zgLDCp=X$`H`bEcnUcX-nGC7q?<u7eEVPOMP*2T}FIlcpzSNU*0TYzE!be$H<Y}n~s
z`xz-3>DaK}S@5MHQ5>I!$wFVg+FmW96;tluXJot7%Q+<tH_rH~=agS$e-L()R(q~<
zH-eAa^7?2Gmm^j8tIa)`opqp{MP+3%M}Xaf5=XWGCKSf<6*Nk?Z<!U!M8+==8Z)KW
zI=DjLd-v3h2InY%mS2&F`gejIJj-`R!44dJw4w}?>%1A$ORox(<Y`OwK`NTq{_Ic*
z2QRgY^|iCM+=9rp4`-D~uLQxk$A(F|{g>F@X2Iutf_<M*UR+<*yt%f)w-#6wys`Xj
zV|&h9>V-PIyb{~FC8~a?qxA-7cf4<UJ^*Cf=R9VQ+o^0VBxE|CL#j%yY)-C4`Cnz_
z{_`N!W};rCYGglB{@J2~RW0w@&320od3F*u-wUo^;Ap+)2S){Q(vL%WhzcDud!dzO
zH!KgYm-K~|^)d$5@&&P@SL0GDsKrb|(4O=(0B`QD7)(ovW&jQ*R8eY8%O+mFIDZmg
zb<&I&BiW8RFAxTLc;(ppm(&foUv-OrD>!1wVPuNn?fh|4xlA_r>B--|O8MLiPv<kA
zEU+*(E-kLv@VnTc*HC=b%wZpc=9qW<VlckYelVqumdLB>m^V__>ak)8+Zh-`54ATP
zKr`Y$@4ef8`Ic+5>~#T=`Ylv+*`?eo^Cc?1iZl`2;3pdXMaZ)M7|2R!4ayu}BDhC7
zf?vDkR6-uI4D#?ccLs9YsBW#}v0&?`ewgeG?S+V3T0C^(I~zeNO(Aget^}P0HG}xh
zTEeI>q=%hfuxevTN7<*t${#_&OSpz}UmC4dQ^%n?W9(hn6TjCnRu;zdxW4dMX6)8{
zCCfFp1xD^)a&BLP6<qh1BLYzihbORZGj#>!^!TCHxWz7;@`*xq(`FDj+TL+7p!vqZ
zFln&)N>LxVi3mBsp^@LQIE9ta#x2p(lph=YCt;0zIkD*%FRguCGQd%ef(e)CD8<#d
zu!E+3zTXcp-$9am&Npz9ceoZ0`%j(?+rn7UGr>JOm8qbUz{2s^Nwu8ZwO*s+^&Jxt
zM+-icR4pA;I+3$IfZ5q@>wZiJ+%9pabAfQ~>O0TCS4TYFY9lvuh=X!hqIcX?P!(gY
zMN#VFeJ9SC<3Y|;ySUV56=~?q`V51dH?f{ITuc1h^tTSXu>)g>>Q+fBt>KYc^Llr2
zd;i%d`eI>s`fn}UB{?OsPuN_Rd|z>0=UG)}&whj{(RS%1)6{XDC28T?wa2N*fmh-E
zwSzz3aWj46mTAU84jO#c=AK^p^W3eEpz76Ww>F4McF;cK!BlEZWp|T`@4NRR&XOIY
zyj#s`76l_Q=B<dAj&Iw(MVgdUwv4>|hEvWTn`+HNK1o^?z`bfK(=g3_*7FB?5vvOu
zlwxwvob&M>?{-RXW+qO!iAFY-7<?Spkttq~^jjrth;Xb~?=>t*T*>_^K29f>k4AlU
zD`b!vhxsQZL06;yxR5pG*xJ55CcEYUW!3(23z&wn`{+CEVN|y$MzT}&JU>KDH8(Kt
zya!-4$Q+Hc^-H!FE-qG0X1kaMQHRdkzlBh@+i%LL@xaMZ3O6MqPHbO1RlG3dW=%RP
zgO0shvj+J1DVC~at6JZZpYtU{<n4!W<*h~Iw`^8Sm6x8IJG4ZX$suEmnmBTHq<5b`
z9z?V>`vV$eiFL@fObKHtVr?$G(>@sNg!y1*H9xm0yvgl3kBY^x<~4yH<RAeLh0VR$
zU~lezLi{XLmF{^M@R9>gq-5mQzE0j6GPnAajQbAa<h<W_z0~wYXde>!Vs^#;hlf8x
zETZg(I_Ofkq^#uk@wzeM=+@+7eWTe64-hTebB3vx?o-aV$1}LzcyZwHl}B|gdEyum
zT$$NuZ(zDs(MD<3(jO^*?C<M@TJEG>hK#pAsAD@ZE%vHuW9(*ddie5<W@t+GkKg4#
z_nN6ZaCT;bzpmXMlU4mXSqdz=uU1$#KCtHf@|)M(Z^kkEwNb&uV)L2vyj6+YTUA!G
zKQj-1-*kyaR~Gc^$cQ(me7X|2rsUbQC?Ijym#tjzyp>CpKt|fTaa-}1e&7%c+gT%<
z!&mMSg4-{(Zc<a(Z-Ty#ag8wCB)rmnb!I;uQjCNtEBW9qT_10!>lug~6g7#eyhczn
zn;d$aR&--4Z|aBKBzuaj{}A||j+KO<<lw<>y3(rBRN*=2%CcwMyY72Nh}3FkeZN2D
zpKp%+dK@Sv)CqPYB7|S|VctL;cjxyT*fPA7H=FcFJ*#UiQSC9e8F#wi=sqafP>%Yj
zw#Q@~(fh=f+8vZvkn=<BSjqgb2JQ1LnZrd*_rZ8-6o%f;C-t@SLMZWYFLqp0=J6C`
zV;(sua^sSA&E$*3a`uUXG_y}vB71cDzW~W*L&?cLI^(Zawl3#2)rTyKVNx9#(c_Ds
zuDO~?h_)Q&sh6rAd6*dF<haeYdVKsoDv{=i3;Oiz(MF)T`;YkVCEzAI?49=Pk+1ci
za$AZ%1x#*Cx714#IRrmSeM({MFDr1oE4h))kh&motsbZ}_8`E?b+p3_B-`N?eA5>Y
zx|goIndxta#s{6XO2O%<>0OE=dSL9Fy3BGVCt!$c!lGgZvA$=2M6el$)@=;^^nBji
z&QQ7w=DhrMQbQi`M^vVOJ4b7dQQuVJ$_!t*iz(LQS>O+7I^ugoMRM(fC%@GRd8E!i
zlonXSzIr!esE$97mu)CgJBRl{{y491qtg3~Nxtt(sI!D!58QaHz+X8)<R1IpJKH?g
zI}dwSEI1~nnp*NKC_Gc@7mcc6ChV2zW_dpIZJCs?*Am!*j><gqwOY=6|2n~s%F<=N
z<%~=M37<mGC!nf(j3WX{4mR9+OIJB(xOQ6*{B@eCDGL>vRknj|CK0-lL(>LkFXX`B
zRAm#5${ZfOu_D(^jl|`5a(YADs*6wdS$>=aOXU}mX2SC{uL*w2UP^4b)Oi@rEhKpM
zy{AfgZ12#$1Dksvky>UTer8U5zva{P6?;3oA>_h~y4U2#+xK&#{K)j_aO<*Qdds(;
zQvjtOK9>~CKO8XCnJFSjkshUnYF<v@KwU8-(kT(1Gj_6#>$m-0ptXhVj##94sx%d?
zxEdf-zq&bI`<_BdEO6m#uzVz{6FyK!eHdZuNA|09@jUx;dU_;M+%`3?jx;uY4m`&2
zlp$qT9uQkrq>f6fsdR9C5j3mdBNBZ+4wd=)&w8f_Rb#D=k+wrNYH5krbd$8L&g|AZ
zF{VXh33VcN`^q`#SM(gUh41RB>?8x8oIPA%&lst-Bt0ihzxWV%?~UXI(;=-oTb918
z__ge>?1?VRTDjdKFF9&s3gRWs8=>m&F&pXMk8#+lF#lmXdv5D@DVR=%^Mv!~0M!dq
z^5ur5kX7vB`6`LGa+KmYx~*1H)EzX$Hvrx^04rJip7Li(o2N3z_(+#a+Oy{Tl(xiT
zvv)=j<y3*RJrnp^Sn-{o(<9%Xwv2p!A7^_c^>V6eVCX$JotXG5e%_4dhk5*Gb2dty
z!nN-c9q#Q)nEW3AXh4_0E5?5=Bjim8`XN(S%Dh9l+)wO2M{>UZ_Thdq`tD%eVJ*Eo
zpev@PwBoFUt!wI`ckxuIXd{N3qO~i6y^Dx|)d0R$#+H)J*AkQ=7}x~r$XJZa5R`qc
z<>LrVAk92$Ve%yY2?y>M2kxd0+<#lw7=de$)2>=I`_0Wd(zfa~psam!$FwwyTovdY
z!&?=~=QZ-qq@}H__e+;?W4T#f7WL$z&H)+Ko>@hevoy+6Juf*4F3s}tnEcepm4Pfz
z(uiChT%MY++hxwFN{ne^5TMeCMmWK16jO?O#IA*cjDP9gl~8F4lDX!vJEgKfcnIWL
zR47NY%sQ4?W(5z@kapd=<s%J|rb<$vEQ4Vj0TyF;NmFI1E{3*`$q6VoVALTmhwwN(
zNky=|1?jc8(31T3{HSfuN5Q+U3oFt1aFH&UtyOB#Jz6Vn3teh@%*B@gpSf=*yR}OA
z%nNMRD&T&^uQUPV#Jsz8_;YgJ&(72*r&r2%KX58A>SjlI_<5spC_V>DT^YqPpb{Kc
z<NQ6!M^IAec}U0>nJLF2ORurO29D{tE!Ah&YYY^{K$n{W$7sXjSBa+8`HNuln4hbX
zy1mOlV7r4%71(95nQiT2mL&_sOl1WwZ>%oYl$P|>qde*4b5MR-tHX_`C{P%kogI<F
z&nx+}UX%qk@oA{`;O<*!o$mrIaukQ2o}MVD;Iw|dxGI^?e$>mY-+y+<4<5p2!MEPH
zvG%OR%49vRr@4D-)J}ip+>}_UD>?T5$T144of^0U-ukhKP8W>w7J}G=+BQ7(^kP)f
z3bMEc8Q)qV5qB4LetFhAdTQ4=H*mcp2#-c0bv1r)w(L$PpBuLN(LnR_fdz^hI?Pr5
zY3glmos26Q9_d=BF6oVH7azHEL)DV=$>T~Kh<aQYOQI};oZ8@J^_<9B(gsND{c?FW
zqCOWlMb`?Ag$G{sZKCtCjM9>VxaMszxBj>+%aezyZOg;f#b2%SPdWJ0U0$Y_k0S3@
zs4I^Ws`?v+zw$K>6|};=Ro{)T=ZW+YR_@wg%i@|St176}gCa-c;wK2p=ck<Y0b38#
zm3#$GYnms|cg}&rOLNFifBHfl+{peSf_gfFAL*muT<?1tR%r98jR~E6q$zoV+!vVx
zt#$5;s;|W#cqqDnq0m0m51&hz9!j}4P1q5x^>)edhjG;Lvb<vB3@<jYiAUz5;mtTK
zB#8^0R()&ceRB7N17A!Il)BWcGuc1VuQjgqh+0;~wTo{}|K$16=D>1$sqL?80=Tz4
zwo<b^f78~srh8nU8($G<LqKUy;u>Rf?Q4XgjU5+S-~@X~u*~-%us|whlx#63!^0Y4
zDaqs7+I9=uUuoMTkvJI6)iPVtv@6fBcHsf<_k5Cu!c%F<^Sbo=Dx3>_UW1NX_1;uL
zo-hW$!Y8T-bwOGY&MoFQ+8^y;wNJTLXu+?JZ_x?q6RjdM@d`9e?9oIuKUe2S!+k?1
z0T^@<7Uhs2<~K`1V@sjSAbma`BsKfNnJaZE7oC#wTd|NyCN&s!pBPdvu^q^ofZIh^
zVIj*}e9@O$Pzbz;_I^{btepG)(5#n>5b8K}aILWB9?E+x7TByrm%DfD+qW<6*|R4m
z_}+Z;&9um;bDRJy6Mmm%@_MCm8%hJ?9nf5f|ArSMyb`P@;q5t4<X2+ldGMK2ySO3~
zuZ^@-W}nNTwJ>gT_#z#tBBKQu5T}TFlur4xUf{@%K3ahIEKoRNqU@p@7S$}~#yIK$
z!G1C<4vBxrM_vq-chJcb^YCAMbuzfz!U<8HtulScXg+quHTiW5-L7027+M<fJF+{d
zcwHsDuRphAN{KJEqdd1u`&q(lpzDr@_Z>8M(&|ypIwb8Tu^M>`qE()?@RhIkyUno7
zdby%hLyM=!>rmUYr=9$QHh9)N>i5miCwF(xfx^kS%IF%OOI+3@?0v-Fu2+q8Rs7v!
z@gzqp2V`aI5oU>qY^R#BrY*l_Xud0O8Zv54@Hu#{(^mLU=q}o78oM^ZsfOW}_#ETi
zljC*{6y7$jO~y77w+U**efFCIy<qU!A>IaoBC=OQ84s|S+seHyK%ZI!Rzsrl!>YW6
zJ9!~+wgaUfavS(Hq30T6KC4K<!bKf=_qhwue0895la~2V1)q{vSWk{89C*TkFBS)~
z8>tm=vHTZ{_9xWdZw?d%vhB<5k0B-0mMSJzs$$hTQ#RZ@5|*~=eq+`SUK6io8(L3S
z7D*ab+Q~vsJc}=JbvQYH`_LTs<otvKUrY{IXQEC~J#yX8b?1)8C%>31d+e!h*!Bh`
zxnET5sV@cJsm%{qRmPIP0rqo!Bad<`v(nOv(gxiTU#j|7%>==@oGW^@+%AVvAg|6~
z(TkMJGe;)l3@%Z(cnLOp2L<Mx>p;ozC|spCXexxYK`MAs(s3=%tx4s5Qy#|F{Guvx
zvz|mRpU{<{RT=KXrIb|mF(`7h<a+5Pokh0BMIVE}JU-!^%5uco&%rKF^Lct|<xicq
zkZ}ut>hX`uebE#3`f(%2K1xT!T4ns}o2A^V43;ghi3xCOLUZ!=Uco;2d@dSr=b9~B
zwxn--;~QycXehn+-g~jYre3-<-EVq|A}y~pgz}%mG(8xVurll<5(s4{!&@7gY;fW(
zVxOGabD+pizLpMr`;>PRihPs}KV{>ND#Et}Kk2YOS{6b=ei3osPL<EpfTspnzMsEZ
zj7XavvC0%T5>_{&WQuT7SxmM--f~1fvxUxsz9g8s+V!KPdzjaPuOt=wV);_&QR=2~
zPma|%P&k&;6sg-NDCZ7Z=^l3U@-^o9TZ?Iq>!NBNoR+uC^Q(7R#j>3;RvEZp%Rloe
zyCR=RTcLNmq;e@$^nJW!oIOjUi)(s1y3!(xvKGV@q?YtfqTbwItoUaq(3^F%4eaJr
z>6vs%ZwI?TNskM?T6uIk#Cr>A@RjlcC+cH^ulEM>q2#L9$tJ$=5{7lb*&gVSYszC0
z+7yM)UY{JFjRV<sH#IWrs4%tYA%aS8eX<HfjgDGwTjGtivdAJ|bK1!8<aAFQ2oBct
zyLKDA??4XS+;zA+Tht5MXi8cnVUgQC75tcG((X!dp*ge@<Ck}>i)ISHhfw&no^b7p
znthA5E8CiQiuk7Oc{of6oakRzuJ^?bmgk3q#qFhtN1Ye(4A=5*h1%ZiOPbSkk+$H^
zbA-qF-cF@_L1k&F;z+n&3GNMa&K3HSl}3GOl&5B35H0ifd#KIL!>3rhE?PXeL!>x+
zXm9QR#Y95*7KY=Kg|DA8L@=QNqso`XB=sB>xzrF-84~4qF-rNa2VU1YmL7Azhz9U_
z3BHkj4!=lO0pUJl&;U!wljE~+Aoz*g^eN@HwoNT9hi!OWjwSrjx@LSc4O#EX3mN%o
zd972gS8%r<DYA;~5UKk8BZcHcL`ErR+foWG%BhAnb+*JluGbjLp+0IG^Jm4YHvDlV
z=pON2Nuu?-5VolWem%Y=YL&+fDeOg6aP|*4D+_*|=vWthZO19*`HXptUm>HV%1B0g
zS(UI7?yDehTU60?if$a1Q9tT&Mmg^1gisfmJN4gbTWw3{vEqvbU;zN$f^LGW6;#qZ
zxqcxyV4d->-PHbs-~EN4d^wTUg?gQ^hFHCQ5vzmxv)&!omlpH*9W`f3mzFs5)GE?r
z;a`aIlVf!bgiXchx+z0%S9i9j$bTNCa6F_w7AvHtE%lx!{#6mj7bCva21jV~6nfNr
zd}Qz1y$~w0rG3hDlryym`{GlCR44h9+0o=$!|sqK;y6WKo}Gn^31s_=)I-P89e;_o
zjj?gT2I%T6J|!gIw?A8Yn7<|(QGb0@cG31T9@)9RGx|t#%vsqdR<_E&L9>S9u8vxP
zca`rmCZ<^FwI46W^4x3YLB^>SGv%GBBQ2_Yi#p)2$u0Qq#J;j|>|j05A-9}3=c(=s
z)`ef?`F>pM_<FD0LPpAm-(rM;2$A-0MJZ&<)nnOW$zTM5F~`AmVJY=?;QjF&V-pqM
z@?596Kc7eO2|_;#PvD%lYL4|+J~lN29YFZ4vbcZTv9#5Wwc=}eD|)hBf{svH;tj9v
zrQ<Fj)`0&$Zt0(}0I=I}H2$pH`u*0mX5GCvykdckO3*OQ_Xg*o<f<!cac2GO%=Ycu
z)3$Bf_&iQtFI1G<G@%3t{z1{Fag1uBa`C@J1LC0pRoSxXjG#CfvMvm%6)fj<D75Hk
zGv$-JWgN)tT^6+B0~Ms~;^HThG+gx~7MvijTgYl1Iue#3WMw*k*`dqf^_=(j-jZ~B
zIy$?!=}7ZS3_Q^IhMj6HN_|pez%%rlXFDxj9XPJlVVo0t>fkMTARrEc$(jv%1U%%E
z{Lh%w3I-?ZLaD2@m?yWlaX<n3%ZI$IL>mrUCk?}978pLYcW>&!kv)6qVmfo}a=JM`
z8@49Wn>7@nf<a(FRMlxrTxcSk+@R!UKL)`n$(7QJ9Lu$YXQ=o0Y{MP)6<zM>>`vP^
zY)Vh>IglpUx$NAPOX<?}Yb+$<^MDl+1*d{Vw!ZR;2@o7To6k-hJr^LvgjB^u>&YT<
z=5Mg5Ft`Bw3|Grs*O8H2uzdiwPvYm%z`LR&0w1wcX+Pza9kk7TgX!7b`=F~MUAlHP
zox6N7O)bpQX^<f5^&?EnBgWd>&}rA#%=%(d?ogO@*m*l-p|I3nJF-SOz!#GYMYlq!
zOA!rCD*;cgcgcZP4k{N9ZH%hlM`v>H$o8~-WF*bc&8G90E~N8g*AQ8rY>%{_I7;69
z^!YkVn|iDrsJyAr(e>=TssGi9q4gRQEOBq=la3Agi*je?1hZQ?{^0nunlEBpv4IZ`
zgViComLKh#wiXr{*9G5hIWc5_wt<6|j|E;1ZDf{4;60ogyotipbdLKa8sIbr8n_p8
z{Sn*gXq)wC@4B|!FXV#KIAyzBX*2x3g)Tct8Jt#a?Z@Sm!J0CV7&U+h7w;Rdt#&a+
zM;G3|G@|qFylT4Ob7=tNH90)j>5no9G<>*sARXATGY#Ya-I$t4r_P;C6SGrk&WaZa
z^Q8hsjwi=`;Q-9HiaBYdo-Qo1j53(4CRdEVF9qFyAliyD5g3?)w~G-Z$Uk+k3?OGM
zBUEK8WO?=ZF*u}kCEMMwX^#ONpB=?YXvnQ8I@?^d6&^kAN1?#JNzq{`eT-D~zKI}s
z(G+q8w+i5*xTD>vYXW-k+3G`v513}(Pn$Bo7%#<a9p04o?cAAq8DltkW;9*CaXrmo
zGdnt+c*$*Qg<;@Z>`gsvH3nsxa$Oe(5A{I970<zxIOWKkpmA@Ei))7a`qQp0BWV|H
z>h&vEVl3tA<V41hM1t1B=OU_t8c?3xJmJ6>lLOWtYeT7F<+%gjXj6ZGI<#v~>g9Un
z>g9Bvv7)h=>FBGJnsl#Rdos>+ubg}E`Ly9Z>$}p(@Wym#|NgWzJC`mnZtK|e%&mpW
zh8B$hpURv@2${<#WXg3dj6>&Y;MPk2`-?~Gqk&rqgWTsc_Llv7`iJ%x{W?LkX*6h#
zU)%4n{^+YOGH>Kjc8e=5lOB+DgrOA{xvWnc1_siheFtKm;M%q8=``b0;|p_DXGZ4f
z>z6(*kCatl3BTPDd?%u$i?)~tvF+{ZN(XlCN!x}ur-`Y_bn^VUbamn;jV-vl`+Vdw
zXUW~Jgx0X%pO6)syzgY3FL(=oV$Lp5l7>2NnKOpEpez>eB1dwEOq`z<UY04nfB0Tr
zSTaw$!}Jfr<^@~|EZ8eM`?mHC3|p9=b9CZ1DT${)HO5h)oIm?v&aG}77)*zE?MwZ=
zed*fGo9X1)GvW7{KGU%hr6l+q9QxG$<Y!)Fn(J-!OQBC5#26QK*gkpYpj^D)d@1nC
zwH<S_^xDOgFjGiN*doWS&{^l&OW&aZ!D1Q@CHEtE1y5-h>K#mnw(m~EgF|V2YAPKc
zJ(Z@IKV8s9q1YkEdq98L4mS6Y|M!|jC3RrZoop6(D<YH@WqzOsN^@Hg46?@C4`@`6
z>K9A;z=MAqLG{d^)yGxaOPq8smY8&H4gox1ydNl29vpCGy4E4*N~5EL;qD4uAt&FQ
z(Fo8$Xb7UQSf5w&Dn$OfdGdXl*ny$IA)RvZ9EsLK;2z?oN?ZrJSvas|Yg*sal`b(6
zcLV3+mIf;{W;tL7^E=R)xT06vHf-d#IXha=Bd^wXccp7AJQ$-fo0^@ChFu3$O77?|
z;o2;}BT&l{$?w_#uH0R<z7~WZ1TM=Ed(<Cf0KdWy(XDtAZ%E@<_cADSc>lrlmp}S(
z+R{Ime({@Mr@w#Ww`u&+`P9*ajjZxE>=yY$R|wbX>!1Z0?j1@4I6+-qI)C{s=xdYX
zX`IC@^NaI}&P?G9v_VCz?)yP;l&iio@HIG?zVYHq=`VixV;0torJw)iwe;FsZ={<u
z*nSWylUd@XvnY?u@4Ym3@@M1O-`mRq5f-#jf99|W*Kdra$vJ4m256J1L7c<=yD#)u
z#|J5M)9`R|G3doBm(%3rR5(*Ev=mj3V!!g!qk7hbM&G)7(xE;3(!c)6zeru!uh-vx
zJN^8%U!~D&m(rq!H~%+idsL};WbuN3?U<(>*PC#H)<KIQIxp^8rH-4$o3Zhm>B`vk
zG|S-iLXm??773J}y8Yz%EF36xHdtB!5vZ-&fGz&c*S?Wn{_<DSO>E0AUwbuOe&bqN
z#0bSoe==!@i_C=ec+~wu=qgtkQZc7aU)W(ZcRhYh7YX{YgM)nosjs^i<J=K%s7=mJ
z)3KRIlM8vEDEP8UQTIElbPx+%pL2(|gebR)xMt8py|c|OIQgc9f4&{)H^6OUhS0s<
zp5CbHz9BTt0<W9XlPtKH2_N@fk(F-C)`;Yt-rx<ai0}w)i2a_5$ip^zgt@Km#iniE
zv^fn7^r!KOiCDntE>O9A3O3=Y$NkqH^*Ijd=FhtBP+9mERNxLAkS<Y+0W|rP-@J^j
zpr37xTm)i*=jpQ!^!2698#kvuWOnxad3^P021&IMg&UL;g+eUZ%27y{_x62v?cJV!
z^zHAa!}|`T6X(yQzxwO{n&vJuFo16(pGsEqmAnPklk2^6z?QTdA98qbLmH+no?*i1
zG7F7o8HXr5zjx>lK4-4axg5tXHVpQsjrgb@V>fQ3v59d8ma^8UhTd7{!>NA6DJ=F%
z8q2+OeUXo_D#*{tn#K!WIvyIT$I>ul-PE5|KchY}=`p;4`p9C#n`7uOV<5#2eo<r}
zqHGaqk$vz$c_VO}bA5+WpAEeqb;Yu7(db$CqW<CY4bqOk^vrYVN8kBg+Q188|LyPo
zHvRVfchbzw>#2kBs%R_8C+^}A0bJTNf5xtGSRQ?McR-935-5zyX9;{7pqIf2TZnOU
z(f6LM+tUxe`K|PAe(%5iZu%du{xXf9ILbI$a52USMJ$)G49t^<FCYi3GagUcnyS7Q
z9k7DHnjY%+!JWGqEBezkym@na^PRWSFMj=x>H6uD&iI$q_jLW-^qcRA`bRgDa*1&&
zZ0b-?fBO0hFQq^EqaUWZiK+A&<I>lD`zn3Yxp;{p`bSkADinpK&E1#qIkoGySJ6h*
z#;=ME&NVRSw#|4v^rDV+p}eA@YF&I?BT~VnLHhOEH*ZM;_U~y^wKwbOS5DElzcz7$
z-*_;ns&;W7ZLu%S^0!30*u`R}!+ZCozxb1XmNqf|^8SY(rvLu)ze_i-Tukd6M|44K
zFtu=&@^ung<g*;x+n+*S^gmrtuxV&R`r#jbH+}igGwB?QYyRfdU!<`Q-i>h|>C5Ah
zEA!%Z=)b=Zb<439U!vQLEV{65H^;|gyw$nIqIZRR6*B{2DRiu0JAMA)fuYm|zkTu6
z#TCXmsej3ZXD)U^uCnGX*&gNG>q#8S;UXUwP;6j)**O#S>^!n_!9mukte55~ze2N%
zh75Gkm!H@<xO;E<^B??i8ri%xeR%ZK^jBB@d%8S%Bj#FSJhT-0IlC5rAbe_QlNSTb
zn~bo~+&Zxi{^))?u{O>6h3n|iWyb9ree7UpT`KpJLG9oc39ep_Ep|6!wp$sW>t)Pw
z0=>P$d~>`wj_iv*tPbVTiB&#+*<$C&w)DrZd^bIF;7}T6(c%C7pZ`-jd-Y<Pc4m;e
zop(`d$G6pKd8`-MIKWsO+{~yvIKMi{pDk7vV;AFa;(8s%XPpD4>>ROc(@1*Z;NjH6
zgtf+$E+2idoLKdp=X7I!CY@oD_4tKzY1%<h2eF(%Mu@qw$*}M5S=e{494q5+f8pgO
zCi83MGFOQao#3Ah;5yzw*}`rf2htoXrcaNKh66H<Ia`3&>tS^VlQ`QqZAp7~?qWi0
zAboi3NV>vg*sQz9U_6#E6fu#Z42!Vq#ZxKert)on7<)UvqX8CX<aN?NrL997(@(zh
zgEX>hd-~}w{vo~o?%OdL0-9|g5XiB}Anx$saQflbzLoy;Ti;E+?0_?m!)l{8Pp9P{
zUi-)N+jrkdr)MspU$_K80}#P`In>b5faxhOEGRVHj(;QJUEY*BDnUANI$k;!;w*oo
zQ4W|@#R^<<`Ri_pzuc%FrfUtW$KUOJkx0q6671#a3SBWkQ?lOiwN)1FGFIiuw-`dK
z((tS<<<F2TrlJ0Uw4YVt&+I*zHsM5%Zr_#ON3Tv_ybv9o#c+~^A-qZhaJ;oqTbST^
zo_sGo^K9CQ)7a0%4=YgO^HM)$a`??7A4S9On`Wv}d}gVpnavK(a^Bn*`Jm6SdKA#Z
zI3+I}dMZ7=br+q3!E|EF_ViJAUz(U0OY2-OLmH(fS0yt#ARz2p{lmOD^Nr_TOfN#`
zR_c8(3yFLq;0lwEfBUOnr1y`1n#OqRdmR<h0q8P`cyDqQf#%`%xceBi``)+yFzwj6
zBmMPH|0aEeqd7iJdEllT<42ajy_xkh-2t|ews#(P4?S{{E$mjMf3~^(y*=sK{Rh(v
z`wn4W)~B%xm($UWBfRbBg07xe?BuH8J3lPx?(w^G_@=yfKCE4iv<knJv38DTijt>E
ze+=KE(3<PIrE?Rcb$H+%bGOouU-@48>hmw~cGy5#$L>rz@Z&5Ld+qHv(%&<Hb>YU<
zsK-`}D4`+8X2}ooPP<T!tUu++s~FYkt|d06fonaD`5yFfXXTYtb!_wqw8xwJhtf+=
zJ)I8YTa5Mgr_<YZGWpI>f_|QKLAU&n#$t~Z^zA&VLvP+UdD9GQcUR}X@plTp9jrSI
z3n|JRZX7r(Z&OLB0~0-jKeumxdhyV6>Cn!7Y16=PTG!JZ3(epA^rQ6aci&8(o;@9%
zOcy;rj3XvsU{=!y$)(!1*X_UerM-U`c&%PW_S^j2f{U@AW+$<ipL&Mf-S)+RNG~>c
zv1@($_|)<A>YJ~pcaD9M)^*dkH3hOd_(rVO2kEJ=o;c!dl?V=LM_7(SheOG7x`<d&
zhNfwzt3ZdXb2xBI-%$GA*T0#bI(#_2`PN(MZ+`i6oE>OpH%bQzm09xuk7dd(UQOJZ
z>F(1V$XeVIeTW^rm3Mg8-n1QGtCLl}y{PQ^a3aul(u5xYua-L3v2biAT^zg0+xw^K
z15Tv_TXv*xzw+(0clVz3zyHVoz?*$%m<%QpG%l`N#5Y?$iC6r;B0_z2%zoOxYd7-W
zOMTiMe)TT=o6Ed;KLvh_sD|+5hQHuju+FCkcgUYCA`7d_>Os}%tf!fxLTx+x>iDdd
zu3g^cVJ@Z`Vxjgoo_is^^2#5k)2C0T|N6H-O&8p)j4^@Fe$;WTL%S2a3(rm4{wVcX
zSvg?;)UJK$n}6^Js9#6=^{;=Oe)s;{=q)zGdIt#44xi;ZF3dXYR$T8*&e;~X!uI*z
zjzXh8tM~4T<yAXwm~YqHZr3SkUs9buQ?H$)J)F-HDo-mssxhSu4O|S4)7pHu|DCs@
z&wRjhtn&UoXv!4aeqO!)G$r5?(@eR2S$(f>f9(&_SHAR8dh3lh(yxE_yL5T{h9kmN
zs@9U$=2vTudw&+w2U}jKL8T6HUm+Vcm;n2mzUi+1`;u1pGy0~qIVF9mGxtJg)G;7A
zaboM`c$Btfg!a*~iI)x>PJQ!B=?LxBvC}8gWfs_!_N=u$Cup-q=5uR&>vN__+N9HV
zI0)uBFKty*@{V}aUJ?nl;YPp<cYW?+;>_J^Uc#5!$AJ6dzJuw5_uo&Sz_%%O%C&8-
z`x?!5u2wf&5qs>O)r33YdC{0VNqZ+uxEFZs_<k>N?gYP;)2R35S6=jO)}y<v_u^k@
zu*_DQQQ}tO`|7qc%XX!_E7Q1EjCG-YSPvJlHGT9&_HN&iUfh2ubu+d&w(Vm2gh|Fv
zmX1gAn3(3y?7leEfCHH=AnV{w9nZ_#@8!H%ixUFS1~keHh!5)|t_9zEnNqzH<)&XL
zt`4K!eJSf+^S6V!a+qy^B@QtL@*;~X4sF|=mWF21g{`B!%-P4-D=!k0#zov>6qIpN
z7J8cY$Mx41>Ex8U6gzxGi*LE+YW9)pR0*SD+fBOc_$++LWzxC;Q8)!wy?~OY9=7~G
zII}W>0XHu`fH$;X9rP{tZQ7dt<&Xa~J%8X(TAG@Pox|1rPtT2}R~a{Xm2tn^s$nre
zD}Gh6x8NnMaq8hSU5EDWPX~AGN?RF2pSe1gcF<ouedSVRWeSAl_}>1s674x<*g|e?
zPq#1;|Lpz)>1lR{7+mT|pKjZg-g@tyXr~t%>{E{NZFRT}JWN_0nT_>)YxBS4y_;*n
zu8RUk`ZlB=fA<Gz%gE;R##?WvpZ)6RjAJng0iVkeJBnBOv5xr{{hV%o-^V}w)=MwP
zxUGH28EoVYUSfXtlaHAH`}=f>Im_^!APH|K@-^55@Kx2O6wY<^I#5d}On+4&F7R-y
zQjhsL#`wSawXdf^=1=~^fA~MsxoeCopeYN`X&!Y<ndPk7ZbG%;`d-FxeFhlM?%toa
z3~yn9-E`W?_1euF)O*^s8owgLBYMiZY29ebcP&))F{NKS7QXD%EQ`0dr5}Ii2kF}{
ze<LmMlC_IA<l&jim(pw0iJ$%YRp#CBMadTnuM}c+)NV`AU0#LdPuXPov<J|hMn$T4
zorBoW)0ckuPrj9Q?An!%oH(BT{?%WmG3IhZo~COL_yLAWkH5P(Duq{0&S@TChrQ>}
z)2DarO})&a?qh!O3i>|DdJR7hEA4k%gxD~G^7tMqZy0kJP?Y&$P@@6#KX|TOxpDW0
zr|Crg`9J+}+SJ*XKSjbo+j<%q58Q+_kM53MznuOD6JRGVo=0d|YF_;&VwRv`cYc_w
zeu!JWisbmFi4bp(D4J_2)i6zEYZEIrqE@hS5UiL~^W>w%Hq$j?s`AQnxz>Xl#-j?X
z$CdQr&`4JT%a!8A+YY_oQro?CNBYV4f0$<3!R4nv`)QhHGJDq1X!Jy5$CgK=*_Qt4
zx4x5hvU|(|#$j&elXRUosBbYCzCb!soAS0YGj7=cnn22PSV5-BR|_>>`I|VzT(L`;
z4=_l(7bj=SmThSx&Zs*e>A<<8MgwkS0xlDH4w7`JQ@|Lzem$K!cASRW@5ilABMc5a
z`}}k1lMNrIe&EKs6q3d#qjY4gC!$&DT|<(<GCVtVaFX&warJEs1+@BMo%B#{membT
zhxQ*x2lwxb35s96_M2FNEmJJd#@(a3<Oj}K=a$Dr9jsEc;u*9wa<6p*W)**%DdklY
zi`s27iFYQ+Bu02WT`f4`3bbZXg*Q2-lFTyNOIYS!fN8`>9Y>B%>Q2#EpFD9Qz47K7
zX@~_$AAay*y22tp*&mA#X|xNf>c4zmTv}jZ&QSWw;b+so{G&gK)$t3H)9J>|v2>H`
zI#y?Q((w3ptNLPj;uAW;bEr^8>9#tOgEM_~K32)^=#m{&>p<qhP2NWQh!yucyN1&F
zt5?!77O6~8U)|b%9#^#RsMK3mhu@lC;7$0E^vYMhmj3KJKS-N9deZd7B)fc!vl^RD
z3X^p*!@;=t+)l;athTKZTpMk3)OEldod|qGXK&h#W4VXPcI$YzG|9t85&5R^*iuy1
zkSs%^O1g4wNgnYLM**38mgODJ8|CJ(oXd3ex@4#_%dk1e4LLFrbei~-9UX!b$Bw19
znEZ4=>BA!*$JW1oqS5!aTXiGD%GD*8+N2?uq+UhICHkJP!YQ~4vPr8?5)lOjd^uW?
z6`{?Td{=Uq$aJQ5xVG3ef#iF1tpGBN`^;@q<YU!(5OS(xwj7g!M=pXV3b=IPLK@}m
zpmF>T>*-T__NNUSx1=4sAu+(`)ZCTIT^|Zs`C4j61*wWGr8Ux)fP(y8UR$#lc?c%U
zqnSeax8sfcl(&)6`@o@KSP)X9`K!Q{a`IypSS4-EX>f!sOXfqnlob#zmY9!bM(?yY
z7}a!>&f`1pyptwxjHeqc+WqwCQSyYfuJS=~AZ)Hu9&`d$*afPk#IFRHx)fbOx|>Vn
zEwE~ET7wENYe^b7SzgAolw5Kbu91tNfKdUE*8E0HCkqXCra%AwkJ2;yScFd3W8(Tm
zx;Du`n-gFTq?uiiA^cp1kA?11S{=72ub{KWH9%Ksnr(jOeQdW(xef}A;E%oh)i0+R
z-p)9Ne|752D4+B38{+zLO?_)EuD}eOt4MKGNAKp4f95Fkmb@<dwypASJw5Xt+WwJ|
zE$N?q?+58?3}Oya@7*=YU0;^q>C!A;SZCrWx7|P~!VQ2;T`TZ2mX(HAg-2Nm1>SVS
zo2@JoefcY2PLnss)3M{n(kP!K>c;N71EjpMeJMxOZJ)`WWhk`fVM_CO6q~BQ(F<MM
zn3UVg!qn635YkKC623SDIMIn*W~|*uXd|YixGz^(7kq>l;;_J{FGg69{Qd9ncHZHq
z)4J)oG{EAT^^15|?guRzE>1wT?e|@u9*>3m*VyI6t+EF?y3<Z}pFF^VVFxT+2<&9H
zgQ3b92=FXRPCnWri7><Y3BDUXjk2)gz4zWv*DhX4CwOV&9J}H8Hqm+)BjNKGhRJ{P
z)O9q65Lg|?$6>Z|f0x%rU4>!Gr7a*aukeVw<>fThGnZaqRY~JgXg6(!md_<kv(#Mc
znsgA;EP&)ZBg^VNvXcFduQ6bXyf*TQuD$djmu^m`eqOS1qQA*J>r#b*X!6T_ev7HF
zCwe&rIj&wi3)&e{;c5lf<ZX`v_4ah~HMgzu1pk+IYa@Pyi?bY48S3gyo!A#&2#V4`
zAg<A&l%jazENshBPd##31@}VxT5`;JGrl=3klSU-30FJ^Cep^=Gl!o^2U*PN7{J@K
z$2Y1sd__0Bpb8O#qu&4kKmbWZK~#0~WUR?o-DFHGrrc#p9SqITJ(IYCQSuwxdK7sV
z`xfzJD3CL}CWPi)hE!zVfLqI(VQ`L2SuXKVg2+_Lkv4~V{Y=2~&pea%GN3p!J)2(p
z-EY#|0zD`OdvoF<wML0?(;OSf$>gyq>-ZM_l|oCLI4rMw70MNIEl}FXp~32mODRCO
z{JFS1>Ld1W3w_!{ylirD_+%Pnp!8~xRk#q@YdDv1FetY<$sL`gw>4X)IoFRmkP=?>
zy6~zszj;i%7Cz=HFwEo84ps>d{==uOv^meP0DOd(&_>UWrVr>---_=S&|jb$TXv&O
z&PWTQ0lUyq4~qnxiW~zEY^ySHQf~@><oKtbrZ?PilLa;(fBX@<3*Cs96BihVh|h#t
zf*HXv>q^!z?+e^UIiwShI{jw#S^K+(#imakI-EAJlhK<jw7SfAfs0r3C`PvU=J)5J
z_3ENtIE--d{KfS8>u;nPCWDTBawMIjpQTUJ!C0;f1_H+l)m*260*;p7?of`UoDyHh
zyAf7yYS+NA4Pb+sFnns3(5}21$Te;QaxG1U+dzTGCZ##Fl&oHt`+!nCl)NQQ;7u4g
z)b=9Uj3!Yv9M-xmkbzomD`|v{j_d`C%qe+P=ULXbM&?G2W=J#tvV5e}rtaLnGd*?i
zP})kJ`i+bF(6?E}n2Rim?F_)xNr+8+4QygtC5cPsi?_L6WZuc^CQg}q`B|8mzB-iV
zz4@eTdD%HW=PPh6FPGBfLrzyxG@<5kI%z0}ZEPp@*!K6#=$Z8TZ(mQHeLd;JPd`Z)
zE?i>V&OU>w3-rJ$aL=|XLla_#n)S<6nV*K{JYF+js&fHJiso^9;A(to=3DzN^D<*u
z$F<~aEvMMG5})%lpMoj^rMQW;`rS;~yfa@tU4~PVhK*7fg^Og&-MJd%xJ55olp@L?
zE|+z?eimKKC06(bjO-6u_6&0`AJ9J;ppQ61pYbDX|0JK>)7)BY6AQ}W!SQK#w%tXY
z`qJ~yr)kEvKmG)rxqKP(T$R|sQ_QlCibE?bd0>vn753j$nVLx7faB9zM-$tXvK2lF
zsYs;Ap+Ju`fbyDuIai6#rBq??&+&cVjhUZYNaxR-PrbZc*Gb>Amv;4q=blTmo42Kp
z@Od0();}$6cLSaabQo*#lSYfcIDYh4dVBLbj7fK;qsNc)GREbITYxBiz~G_yQFhQ!
z!?n&k;hQEF0#t<sJwZUOk4x;LeT|nr-hS(yG=26;x^(Gsj2SrAGEYB0^o>kessS+|
z$=^z9736#g&<)P!Fw=&djpS&;%Fmu7-%3JjCR_0?mz$$I!Mh)s?AWl0m-M%#lPpy7
zD;V=2QK68pmEd!j^&yXMUAufGoj!3Q-Q?xqZeD`fL%Xq;ms77YcH3+J5ejHIOdaxU
z@DvCY$gl&3*N>HGtoJ`M3o?i5`JFwfAI_t?xXrnW-QYGfG!Pp|bYVxVpAL1#VW9wB
zX3r|X4m~(vcAW9EcZRmcOW;QstGIgYTG$^K@u;swEGDmm4fxfGs@vdgBb*GGw~der
z)^ZJKrm61Q<ZD8>{Z71Oyt?jRt|9r}xXj;XDG^3^j3<I&!CfBB&&;OF=P#sV{YTO|
z?z<VU(--ey4CwgaDaN@v(<~*-M_;T7QxrUeU49MX2`DMOmV5Qhqlsy*&kY?iEr|=y
zBXQ729$*%^1Pp;z_CWpYr(fmR)o$jjFJqV4`zn0>dWiwtY&DF86*x-7eLHHvloN29
zA;k(;d?6xINO&CBR|e?ZpyKT5GmN9Xm#*QPj9$9f7)LW%d<I^o+`|#8KU9)Z5$^%U
zL(5Xf(R-D?9QAv{d@ku*<4T@;zJ`1hRcK!5vZis6fzs_v=yuO6pm<kf=aeNnW-6Y>
zWRBlOc3ikRKE`u#4D9w1fwvh$)C!-tGT<+cF{lnbuHcoH_!&W3-=xg6k`1rLof%BO
z1U&Hz9LZ<-ZU$1RSe1ux^AoBwOintYd5dcY+5iMvMH#^lgBfqoS3yAmnVp<oq%k#p
z;k6B~F!I3ra(RfiWjZ+?Z^VifdBt0ql@bZA4pW0amqx|UK~;QpkvC)>z(L!&d4z4d
zXVZX#g>qP+0MMY=aTw_8iOI-)Y+W`?W9I<30|N5xmOQDP4e=2#8=SnmMaE8EyTa5X
z;z{G9A-9+;l2^(w<miAo2;6e{U!jil=Ig<zZdl(PgF*e=cY~vgf%4XT;41EwETlj1
zL00qd`{?NDG&MG!y5^Qxk<4NV-llws6{j}%Zdorq4V<D}%lGFYuSlRwrI8RjF1{fQ
zvb@!lSE)wQs#(eR1ww&SLi1JpijEdJ2k&(X*Y%`>yt(_zGhdE3n?Cy8yJ>-ejCpw@
zZTw=PLj_v&J-`ON(?KaAQRM<pm>9g(IW(JPMRrcj)B&c=iM$jV`G{3!9<fp$hGaTI
zts~sx)q!~X5oZWCWgLJ|@&?WFKs-ng`b@g07wWrZ_?#gE5PsX!bTUQH#W>QL-^nq{
zv>vHPHtzCBnzb1^uqK$9o=zuDpGtqj>gQe(T)2KEU7s9hlEq1O2b8RDN;s?muyLkI
zJ2=dWb_SzfJoprj(6RK%M<1p$Ow!zB@yQZi{mBdGfjtvtNuNBnUQ0{JiTk|Ui;y#|
z@wTX?`4%sDk|Jp09EWtZJAzLIw(y~s$F#^I8Flm~+vmOW(FbYj>J4a{V26%tX@a-H
z{p6n1RT!Z8WWwOyVlZs|9Ft&tGV4pww+Cn7<oh3{kB=NlqpTR7B7TO&bfcFqq-nNg
z)JBV1mW$^V5GAI0<kUWge9;Xj*^BHAx8u_b2i@V!2^bg9`3XBaPK(GjO7Wy#@RN@j
zYUVSH&baYbyAkn59%aZI2g`$>%E7`SW6|dfC2WAV$O0tE2OQ)W2bm(jvw&m{7~E=?
zEFd~SRhp0_<*q01+$0NZPMu6Yo&S5tU1W!&Yw0rEl$N(qf_LTvOf)(0C16{=f6yuJ
zF60YL)DsefZZ|M7hlsCz6q{p8>x$(rVMDd$@-*my(BLhRLXCFGFzXTlhKX0yS+26k
zI_AIdBZ2A7&(C_`5$TOKopcHVLd+{YJO&>vN7@5U<TO7COeZXGjrT~SJll(0j!9#}
z)%qknVbG3zeCl{|vbGPq(T7Nfzu%YkZ)7ss#Wm!${7h*s-_p#_Q~U$8LN3c9@H7rQ
z^Wc{yK?{H4Ctm|kLDY_*srGCUwkGmp*%1W*kE?atRLUUAV5fzACyFJb{4yDN&^r|+
zFM{L72=EckLe&aeo;ma<GVL0M2owsp>KgITEiJ;xG9j1AEH>&zlp1;3og!Hvka=VM
z@u#4*?KhZA_ze?!N3q8aE?#7SVKHo>iTLp^9l;JlTrew*;;rqfEJA$RF?gfjArB&L
z#S`w=Jk-@jqI{PzHW0`l;O-~EiyR`0V`5%rSf>7sSX+mcn6eARxduLQ24f=ikAlCE
zC&z26{9LO3P!~JZ>>t_9R>3bYTEtt-OkNy0c9ew&6KMfEd~y7Gy2jh)`l-SZe$)r9
zE)bSSU{L*6SNK|$MBEw&*@c-;C2i3*2yl`Kyt;Zi()Pj4>6I71o+cO!n7ufb&d!{~
zhwNhEwLqXpk&(RVk7tdOH}X|`<3bU67&bAOmvNSgASE~(7zHwNI_er_C<oI;wusHo
z-iEHJr}$I0vHH0$9(tNd@xFBG=+X4v#~;Ge$uvXeOOs>i@(tb+XK+*f4qXF=cFKC7
zoe%@%BrUE6S<fQqTvwDrkQ@HadSuv(4EJr=lD_+;ucymQJWZd!n$FLh!j|^{6Kw&Q
zRf}BY<xlt;SMH;qK>|5dbZ(*en$VH$sO<}K=hp)u7m52@k8O<a!c$k=*@eOaHijz7
z%6clc{w)2$92t5p!G6{Re%ERIrCtUvJ7(rm9~!%xH(z#-?2I<x=;(=bopy1a3N(RF
zb?)*-e0!J9XW2TSGKlZrgJ0kaUHT5{j&HU#)Ez!#zdQ#j|FFa8mpd4pW$Wf&;Ul?=
z;dK`7T;%gUdNcXWU=qU&Wgj;@24HPJ_rbkTD2qlP*tyWefL3}XqnTGd0v`&>e7F4o
zvM``WV9mBnz2G2Wd<GXHLqD{EwvRkVEkFsZ+5YBPz$>s^!ze?vlso)4Z7DktB!9G(
z=!ZM8M4y*b7FcY4(ftTh??k3{v`#XVD9e$KIJj4ceo{o)_p?~4UkgEj9r_%>Q*eX!
zs6{Guu%sE6;RM-XAI+ldEkjvYm!jXtbMS?$DpIg5*Njl>8DRN8s5h4Ep1~W~*7cwq
z`qd-Mt1oHvp^vtyE&vadff0U=G)Vw5QdAjuE+Fb{#AjJ5PkUlnk|ix=Qm(v~Mxm(}
z+NEr33P^cuWRp(sBYo}KN_*g-?u5P}d&)UTJ$&Wam(tYuL^}1}$9$52ZOI{O5fzuW
z>ZtZG@YJ3tU;eaXCQvghIO4@wog=-rCi;xQ!zNPFvDRT3?wVuLkSTnV-!aw@@PMt}
z!W$DQe`(L4Gd`A~-3~pj#%`SaSAXJjNXkc>8_6?GcuK@W33j5JiJ7Oi?MYvM_A6<e
zMZh2Y=FN1S&kTg7k|)Ncz`^_;xoya@3b_hLUWuc-nu?2I$XELneOK$hNDD905>B)W
zVWfu(>B#5LzfgX{j8s3VNAg5@!~raQrjRdT;Xe{)ZjY!dT$Otd{2b`)N&ReV+RYo&
zVOLF4;TU*=-}<1jf-jK9kzqC-+uTUAIUSS8_?m|h!{dkC;DvoW9^nBrp?lFDMpETs
zj))9~<b2kBHH<_3M6TgO0VMDb#wlLnDqXjps;!g|`7-~T<93!G`ii`qVB0t{kiN2y
z9TxW=NN=zy%dvMp;8V$zi4P9r0dC<zO60SAc}9r=KQzj*4{)(;Nf3AKt7Au^n8^Yk
zXjw-G{U&YFN1uG0#_1<INpq4u_ZSneE&vtp?0ZNnc@<`q#kJ6A$&_I^VJ}40XTmdH
zmZeWaUk3O)*ctKVgY3w=ZF{=(!O=86dnHXUR&tB>E$doEtGHVl`PNYv73aB2m(r^&
zusL>`ov)b;yNLfZ2Vz83iNPiQbLQZ^G9$D47h{_8kwg7nLROL#dM6oVR+bPQ6Prpc
z;(TVH-*Hsqqkf1SFak+Vkn9=V%6WW=LLHOu^3e8<fXar51LbfSy!K(LDkTVKinE@o
zZy86`gE;VuHUxz9L6top>Xwoy#(FG{BnpT*l)Tz|_+)&P#z~oCaYGLR-wK7*@GbDl
zRcy_c@f0_n`NhadFyC^hi`c6ui;NjpAwX%^Ve*u+!BILh2eaO3FQP3}wxm-m`rwZH
z?-<<30{3U*ZT-;?KTS6;T;+vLN}^w5Um@x-z%5hUVvL@m!>3jEjN>_L4RC=S@;6YV
z;-568<rn-1mJ!;16<6r-@+IkG%-(#43WHzx6p_bZwMe>*%A8P!0kO(QVU>NePMe1G
z5N-Qy`(t9m#hs|QnkvdOEp-CS;$^JU_^3a9^;f|UKVN;Bm-yn7G{hG;-kQO30w6L8
z-vs!=0gFc6&Gz5&rCQoidr}2H;v}C8C2yu1E5l=qNk(e&Mq@)p5fFgH$Kk`B9l<Zk
zio5}aQYoLB*eFl_gx+w?a?TWjY?TjvpngfC_RBx<%y-Zy85Pb!xA`m+nR~=8FUTtR
z0Fdx$)KQWkut;NBF_s(|fL#TfCfFd(!ZbfJw#>k<g*MT!9)yhbb$QP6COvue9paDv
zdVnL%_~c~zfEVztv7_=le#Yf$+}61$(<-C*D`nx+^iWTC@j~J&FMc&mUK>l-PMk?s
zXU|7H@>6~8@*pmudlbD;@uIYSl4(Cc8icKGNaup%<=#l6iK+t>Ry=Y#&&?brcf7{K
z(2`xYMjV04qv2yz1%wSHCZKV0j38#+h?kG*i8fqcA$S6=%2S_kj6VJAAHJ84GG^jV
zshfDY?%4x}qVLgzZF8L2o>E?{n(+`9`-l*(bI5KfbBx=bNlWv;3O~t3u2)%j9%JYx
z<^Y9!1<NWZ0yDknsk8)r=qdKxXWJe*n#Uc<ZW{(|vS{r3SbFXC-=$*%ybx=D`T9j(
zV#hKwo*nhIQBGFM&^<t`M@ftCCSQVUD4g-~#{Yt=2&oJDn9kjKL?1M8Bd5tLz0TY>
zZ_Z;{qT}#dkza+t&w4uU^<jIFnm(q#Ui?gV7+P2d_rY1NS(idLD?KAiKvq7V@M%0>
zjAuzyTF(OaKjD*KPqE0tm!rDmZG}v}%@6X|y6;oeQ|K(ZCKJNG*bewpzX_|`x8M!I
z%1~d>MFsLO=FGs+HYD^euvc@lP3opU*vI%wAN^Zi*N1j~79n4)<J2+R4S#WnG_)J8
zuFLBaqoe8Xm=E{GwW||1>1&L`D`X^|9)(_I7x)pRoP!M0@G~v2g;#99d>~86H9$mu
zxzAt4D|3sh`9epzFM2@Knn%DgRfS{DU}%;FV1r(9G)aRb_-QKf3pyy*jW(>q?;iam
zoo8NcJ-)av1Ndp8fsGsEWhv*Nov+iAD!?ovWG@VXS*i4`ER#a>9ce=L1QTLd#CtDa
zL`2%<YZWVgkrqB06wknrt3e;QC{^n*PAPOK695tJ%Qpk)y?rcgkJ=RddJzgpm9CP{
z5`zg51G@woO2oA~NO4a`=DJzMjf?1kFHK8TE&=MR`YmO|X_LiLqY$*Ar`k?mO#9XR
z>uE!bqviR<m=#o(@nVsg?*51cHYHnBM3@wf6M;TI3P)6u;9$n49bP3(qrtBbZ<qGI
z(1cLp;2MSp0Y@hdr~BghOX>Bu-%1~xJjOsb6Y>g|<nuI~lZ$+Bjhz?fS;!)L9dPN!
z$o9~=vL-}FiAv;WfK=#SwpHvUz5_!z%S5n)y2h!eUA$G>-K*&X5anAJG`5RWz@EO|
z)XOA!2bF4(GH=XGrRhaJBSgZS9>a>4)76CmWwD7{Id)Q6rufXnG>*_b4)PMTiMNYG
zbQ(3pgM3HMiDGeIq`(Clw0Q=NJ1DCUT)Ti{C7uM&skvEj)?^Su`f?1gGIG=4VC?#H
zjmBnz&bCgH21*(#a!T?XP(2kmx5*W{*Moo5Ux8r298gjwVV?;S1%Fom4$}CksE%29
z>12h^#C1d4V0Sltr}=mb!D9RQ*4zNJxm&|5i*{z&@y5?d@v>?@qMpE2<mJS1Cxcks
ztn%xj0oDPYWAJ@ufqb{zYoju8AcaVy;qsGWT{P0YTy1F0gFwPCE`r+}bj;|qkYP!^
z;ZOOD^3BGxt{~*?*#ko(X*<SRXRLH?E9|0C@jm1pa^Mc*=Nrkr$iD|i$*Uc+DfNVJ
zEi%^>4R#E$a9a$sa4JaowstOcuOS<FZsX94p7z2QxBlNVusI#tur0RK-`lr|J@TN9
zdf|3~(`>^#JFkvvDFKYIHPG%3ppLp~+izED3S3~MZp|Vmc@YXpTC+t~(!@;-zuRw3
znGbcO2Y&RkILiiZ8hQC<pXJ*gIOu0x?L^OA4Q?Yh1Fo^HKjAi~8h7hZ5A^m^PkN{e
z>Wtr;odH(C(>f&)P9*7gxcgOStbU`e5+_|YYF+Gn(#=jX-N3S8yUApv-@$ZZDhBt#
zwVU#~Xtitu?8w@|GYzSbU!hL<Wfn<8AAIa1-}Vg~(@s`S4^qyFPmjj;k<YSS<Q(#t
zr>>8K^BjEE_DHjnr1I2B59wN}8XkG4jC_;5v#$$%okKp0G2j~xO%si<1LC;qLA*ND
zMP2NMm(psZKE=){M{rQ5kon}IG*Sn_M^!C{BzH0B)JNT8t~Bo)LuV~f2R~+KpEo~v
zFP&o|cLuvSOZ-h>&F~hTI#*dnAOJKNwg#S&lC&P^s`&O*bxA#4#J+S<fBTgY6{-_8
zwbP*M;-5nhnvmchO4f_4)p0uqI-BaB^?n9k`(``ThTdpn23a}po5$*qiz9tweUcp)
zY(E@CSNAMwhV4XcH?-BUzz;la-_6sDo$G~9o!Fd3_&Z0s8Th(DJ(Q<0X#jcRC!T%S
z!RXA%9}=88e>NP#N!pA_%V0n$ct^bTMrU5xso!Q%m*(L~Z(lcId`lRp>iP`!O`X+m
zv}2HMO|HwiWWa_%ytY5IJv#c995w^`{N}I=PW%qI@$nfwZNB_vur=xuv}VVV{KCKn
z+X3mu9{RoG*a-lBWm(Me=?zAuqXe*2Ps^Wql{0YrS+FTz)hOR&o2DI{L(gnQVM%5v
z7qSEl+Z^lUAobZc*7`Gt%}`D~$jG)vJ#Yd=+i?r?GkWz>y2zVyowRd9RDy4P`D<x6
zv_(@SVA5HXe2Wek58C3u8Ms~G+SjZ6ZU4LD?M%Pt?Dt@Gv862Pm9T_TUE`tUl;u?d
z<%p$n1)0Dh?Be=pXZn$cIxbYdH#{{no$FuKmS&t~Q7+dOT^wByt1YyRjdmElnT2-s
z!-+HhOxur*vhB5=S$Yq8wxE7N0Chl$zZ<oOZK^4sx-rWF!)f?D3ttV-h<da35%d*)
zaP5(%=!Bv>(0YSGrJGE4+eW!~Z_#!;FszC(uZocW!)|CV^gH^Hza8Hxd86JSE9*tZ
zPq}2itchjC$b7LpJ5Tzm*bDgNH<o+w9ebl~vF_VWVN<z=j#c@+kI&VR&#p<>R(%F=
z4I73Hl81BJdpK$Bs7MRDVf~Y~5hgwM^QOiKZT``-pQiWT{~*10^ds7ur8Gl3GKF6=
ziGQS@S!oZYX+LOJC@*|nePndXx~Lx}Z(`94>Eh5(MXvnlS-s7nnT17c%@k-52=}ni
zp{tu6DX^<MSzxn&cpKY;cJPMMrgXBK?@;6a%`!0HrvhgAMOzLKaSVTwv%7osuvKs$
zJoVFn(e@)peLwvK>y`h3Q9+6TZ~YmWucR;?4^rmOLwl_J>??F5zl~k}X)g=JxA3{p
z$qQF#-#$vO^L_J4`H3v1kj6AT#o$r*Dc$-Q?A5+ugQ*AlDo)VM(6&y~MlDdVwTh&a
zr^e``U@Oq?tqch48Q7E#Y#2!c6Z7z9IE{7<rp}&0+GOZt08bBBTJ2hgIKbC>scr6O
zv3u|ac-ppcKFc_P-H%c%k9?LVjp2`jt8JzWQP#5~PcLs$=`+u>a7{Zkr!C+YK6Mn<
z<P~6oUa$3IH9J;M*X|y)DjbmmI(dn2Pyh0_zfSM=zRTNaw7cN@t(U%*zV|Y18;Sq!
zwO^)B&YX--M7fB39N+pT_D-KgSWc3<xIr3w7|80>Z|tYdAzq&``{B|@b1Oi2rvIk=
z`}oDs26f@m^{eR;6BpC86O+`%CEZhC#NZ%&FN31mRCQH9#rDYsQ~DB1_&<~O`Ot%T
z>r^Nnx`-0o8NVnjBqxLTao>ZC^=GVG_E+;~IeDWMyE{u+9oPjwM{1wOMMsm!)H>y)
ztI%9N6TTdDs-s=-$97p*%3eF8UCh?PR)8|GN!lknPK&mo&|<vGY`jfOFE7D30GHbk
zwl$VU!UJv7*6!l5%}MrHImJ|)7&4r{6$`9}8Tjr%hMnMR-)&-s#ct3S6Xz(leMafC
z80({ct?i+|9(2k!T3KlOeUmNlCx<$q-LPo+vi4z0X^YaLJn45rZ~#8ZEBWc*`?^~*
zu~4@Y9ai}ql-Czh<!mc#cl)4gdUhI~V&#1ahcrS~Z?(_TGEbbc#N5O|Qy6fp|2^15
z#~8Yir+OKFDfGD^x|UG{Z6n3G@Fzo&Pfa;D!pe;~NZ`*Mo!~xw8+Nf}((~|!t!a|s
z@SQzFX|4xr*kN0Ptpk5l13Q<?@@$z-kat@z@HK4H<<BhkNq=mX3^CCT?2Jv$BN}2|
zq3&JVL;S2u)<p+W?f3Zx<J=6IOnc%uO%L_43m<UWF$VY;Z7MtxIprv)!ZuPu_^8N5
zA6{81s|oC>{Z{L-ymv6uKB>ENbkjfR<~j&%yXk`;9NNaB19;QB0b5I*S2qD-Tkg-g
zFFyLp^V(YKCg?|79<~ZTyM4BO<?to&d+k5#XE~N*S_LQ8eb#m2T#V-U#60yv-_Lq6
zi!5T2hIFRxj6PqnZxYVf0A*WW)sTKZ>22S}IxJq}3|i}BnNB_Hfaq*f;j_NHP{liV
zfDHi$eHwkg;uq(V1tHQN<(i*b&&sm&-Thpyc2#^7mHpm%{LOCc%pkj4S$F1WgD2;Z
zjW!P1c$kOU4nKWEJ@--E0n~PQg1Yag15BwssF)f2G_M1~?hMmQ-3wm;o@o<j^xu%3
zeZBDEOe{~~c|SIEJ-*fsK5wvpa3mcX+?p;8FlL1O^=TGZU^7kqouM6f!Hs=4%hrzd
zX@7xZou3EqIc$b@!!fa5{Ob<zCW@VJ$FcAD*~q_}GP~_BDiaL#EV!LKcP3<UgZ|<y
zWw_W)9g*+qNw(1PM*XHPLSrBDQm;C&G1`9Z;v{;bZH$FOq_ak@hX?vz{TSGt{rH;r
zaJzYPdSCCxbhVqe%%N)@|4yGl-YOGi(22dX|1&^e$OS9<N7q@DcZ0sPv^X|k+pVtH
zR^_^{hNxFrw|eYn+IEXCby5E``iorUY4oE>Z!X&*$A~rz_Qix(EFh)O9>)6y(QWzU
z_^bUt<&fnFcVr6XWtJ&_#w1x(ZQnZj8RUunjC>U@{=(l3Oxx?Tdc6F|&(X?|#V7kw
z+Vd{_Kl@FN!+FeU6O@B`ioUsx{*uOte|;3&eswdZGvJ*zL0WB|d$Do02c1l`8h(Qp
zrnFo7o#tQb2u{{e_cr@BS%(~l($DOnZYiVrImZ?C+ig#=6UZ@7L~~Dke?L9}df_;^
zmAD&S5C&+2GyNOtvwbpsO(m!rX!CkI7-Ppb-J!k>ZAnituDJ(&yGDNjZAwdB_%_%#
z^-aGRR+2w!y5j6%f~pUlwU6pcEuk~W-7!#iAq>5Nud+m0_4Ys){S@<-m)#bi%bm@&
z)qUtfH}cW0PT*@gPVGczv^D)bd0Y-!v<KQy?Ts(QMf-+qVu7Z1OaXB1fyO@lrFhPG
zF9O@fvrG8`!?s7ROwnf9mzM_Bs^2*c@X~+qC5urOuBp#?9Gp4<?Df_wV1@j0AyGCl
z$d3Ai{x}BXBvp(R&=xxm5-;YcZ{$}$#Wz<?Y-;Epynqi~;FiZ<tQ)lB*epMFAAW7*
z%3hV^Wg@wv4|jZo{m6ZzKI&uef-+{rleSTRC?D{ys*~1B`ImhS$KCad^!e%6+OM(h
zt1s#rNySF`q7TKB{&bhRhu-9VF>@7^Glg$9gI#qJQNP%6SLI+{Whf8r<2!z(9(oAd
z1$x>){X)mm?c1tb+9_?BZIkVkc5#7|Fa)YC=w}|s`fNKqHOG9<{B+p$E_5_}DC$Nx
zvUmLPIJVzi(;Z)&1CG8)*nMdPp7guJeJ^!3CZ6%%4i1k1lf^c@gXv1o0QS2h{FDjD
z=7AOMcj$_J4admgA^M?hDtwdQE)-CYtbyUrL1*Z?sVrP3ahRuW6N@Uu_+X^SX>9u)
z<BP>j$jTR~`r(J;RPs}Q#j$GjU0bZa2|M^sm_<6S;T*xBJDHHrdZ^yGv%2#jk*89C
zC49ph@OS*&Y35DvfuMN@eePKnXvCrx0Bgte-y|i-;iUXsv|-=faddaR)u}kkZl}_u
zk2wV&%cAqhSLGMukPBDGiq$oD7LsNcS4i^=e2lRv$`0#526-br_W#ryU-Z7t0^5n3
zQz5f)bYTIViSg**2zf<R-25lM<vAxI-m&PE`eM5{h3@E|$d)V#=_LdI`T+X>&XuT}
zQ5T_c23>HTrqRAomVP8z;xJ$1AW&3FoZ)eAdED3@1b!eYZGJ5y`fs%7{mi#^;tMJ_
z`?%o;lirewRQxi=Y3A%MF>c#$HR9#+ue|*Abb!xxIbI}e{u_t5#KDcXp6v(QkJ6{M
zopllO9PQhrejBAl3kRU=Q<=v;1NlhnyrlCY{q*IGnYPYiGs2f5MBJUzk-ysDyvQlr
z9Bp{?bxEi0cH-|lf9Rq%eSjJCA#fy4-iOa-DbRV=mkg~F;7DoIVaqUe<_tGcZ~BqB
zu-(<rc0}J<SdNM7H&4^P=wHVIQc82KLw<>;{;4_|z6EsJ?%Dpu+_Y^uJej9n=^y7@
zmb%&@x3z-#u$<CAFif7x|E|i<ux$CWV4Xr&El1?E!?tiPDjT<MUpmK&>u2H1LfT6|
z?2q`G!oY@M6eatH>Z9}Rk-2u(waRUVeFf&k^lgaO);MnK)p0P#eIf#7)mMym9^YaC
zyJ6i4+Jh+L^(km4xzlI2K0EefeUx%_T)WZJ%SaQ~cp(nFV-5&6z<w58>L^FN!@iME
z-q@aWBRl<K#}B2)arg;zF8o?UD5qgtLmvpdgG2N)hbjq)GiCOKkE-rDGDdmOYrC(+
z!`_>YaMRk}WIc6pqI!BOUPipkqQhxq=sJx>8qKVylo&j_1LRtg*zP_#?gIy+I#S_u
za2+5y!-}YnP906tR2C-zY(E^taNA`YOa-lyIIy;B)7JFV-UE5WkkBbsm0n@tgsZLg
z?c0|&Z{8fMux>EH{vKQGxh<3O-oX}S&mMXztwV8DH5av9y>gXLBF&@&`wph9TiJGu
z38fj7`t46YO2=6_rvs<DTcI}%45j@$cBUOH%ot*)2PZ?XQ}(D^jq|qU7*4u_zFK~C
zGYzx4>zO?V7--)R4f`Bh(BI(GE$5lo-@R)`+PRDE&Npw2N_ql^>Vu=720UqvhL}pM
zA$l5GzwyGC(hk1G`pyUMrw=|o5`)#~xbr|!d#D5VbjaDLK)}){2~J}ne>}8Z{tWYN
z7r%?>8>0^BYdA*O`t7-=pGlY59pF0K?fX{eo}D}ShTtX|ve|U)>a}zhKAygM8LFU6
zJjsvO!GfKow1r84oxDA_jjj7Oz+VSm#&6u@JA3ET`D>S`xOq@2{0YnDrvvC4gf6bx
zOWtARHoSGSYb+@5I@|D{Popk;Agv2u%xh;K8>cryX9cH+tAkguiko<8^zahDVmQIa
z5C>^?@iwyG1>ClIQ`$7NAqHtKT)D_XjkA1j@hZ+TI!iwPw0{-I##Pc+JLI~K_6`<t
zJjFLyw=&Ric+2jz@fJp%#_?+hpGkZ89_TC+^HU6XTws;^vC&fupv*u35~Dz|-Q34S
z5<0pITsMFxqKZXX?hbI~(uH)1x8JQ(Wa1~51ygR<IFz5?;B$Mv%>x_KbNddYbvR1L
z&z!;$Js*P?HXJV08UT-7eCB7*?%nAsPO1Y&zKJE0vB&`(7@@J;!>0}W1lgwHjWJ+$
z5ni4K&vWRE^*^TC5v~JdBWz>*0&l<c(<xDzbO_HP?<E?t9a~4z4nD~+uwf_$Pd++v
zG@Up%$}R~vW2d7R_8&?c(J{Xns63Z&cI=!V1NU=RFXGTTd=2jQK9Qq3?_#m1cJECa
z>2xWRJ=mU3c6u44gSc-O;aj#a*v23z`g9yU7zJlq#+bx=>cGC}7@uXEyR*E(&YS{z
zs3UeO4bhnH9NC@@96A_V!un>nD|Tb>RIzZZB^8}_otSu25&an8+n+BSemZT41xVBr
znr)_9(<OERJAUy@I>+bs!YK^eEFe!nZAM45r<)l7d1l9+v>Dnuu#p3FW)AQvovp}g
z3gu$&1ioQ=I$h!|wLB=S>kYqxX<QrnB=)U`JSB{>V{nK2ZG19f-?klT7rP1!3@{-v
zMW^V})wB)0asi$8MHz^v0}K8f1a`7)JKOW`;S(xbH*Si-k~y4oZO|!f%{g{b(1F5D
zK+pIT9G%aXv7eLIZ@`mvX)`+4KQNGv961t>?xro9(+=#qj@^lqCwR;Ld@QikX6XFr
zDvu0pPJ6+1JGk~Usl0%GUuL52^o7xM?#cx^U4AOhnxE^Sj_(Tx5648gZ;9%#+o^LG
zq2uSzu$uv&rXY3JGFhW_bP%aCed)kc(J{M5M{Asg2M6}-4LTj{cE=AFhMlIaxkx8q
zkWo2!2&0@c!y};m30cTno$Jj58~G&7uJ|n1z~BIrUGveVPK@1TfQiAIt(#~M&!&sl
zE~ZH)!5}5%!>|*&zA^Ht&rWzch~-WM*5BjkwGNmV20y`2+o=8CIKbpQJ0<PLMr>k1
zfjV`a#a!pua_}@|%~li84qyafpsOpmodsYAw(m;2$m^u%P0G4>@gjb}WZH%;nWV#U
zg8Y|nUXS_~T?EPun~a>6C|fz@BXcbDjDT3_j~ulD4&u3!gacoGf<-&972jfz!G{?-
zBTm$wJa?8Iu&x1|HrxFC%o{sXQDA)lBA0jjIXWUB<cfK*v170W9ox&N8+Y?o=`i&{
zn|WjWW*WuDe0r9h*cgb6&H?GIg)spEz8jg;-;IqrK;0OkPH9gjSio|Q_VCy!dIwJ#
zRtg8&4)$~V*&3dS4GcGyf*mDjyRT7y{LGK-<K6@N)6j+u=@M<n@iV8>SvtE;Ob4aV
zyw)N84J}9C9BkM|TfLueOK-*&yVHjYQnbaFcw6ff^!di#V%2fYLd&&8J#{hA2n!_k
z@7SGojf|vW+L(FjfqBoO1GXDe4l06MbdJ_SaFzI&P(W8U*^cp9lilc??Y=g2oJHT4
zcw_fd+TWW@289u%W2*qQ?=Bp2a&9|q+J4%N&AfG?O_;>SxzNBmJjMi{J0KE_%&`y1
ze=l}u*T!vZDY_*+y?Z~4h#3sSCTJ_4#m~CcOPhs5dX8P!PG7-4otUF&^adwK8{;;$
z2Y2m`Z+W}rzxGx;GJ5t*_(V>&#HVo3Q8{$?2lWD;>|mkFE`DzPyN`N5!1oe**7c_6
zckD|`FH%M?lZRNRv*3A#w$)uIVF3Twba>;!${o<TAD)hA!?7`LkA02-l~dSM7u7r2
z5(`g2a%D}+^;c?I4`UqE*h3xK#n!#s`Zx03-~%k+?8Gl*0rT+Y^xRX=rfGVNb4(^(
zxQYH<I-ka{C-LS6?CFC4gG`L=$M4$7=cP8{TR6FJjRhK~@o7dc@wT@E{L~ekp71Mn
zZ^QS(M(yt3ln!H4`)K%WTc6vxkHzT##YWzs9XLC78QXC=FCsy4gzN4z{rU#@LkHM7
zVavwhn7ptbGK#Nxl)8TdKOq(@A@3NDQ0M#uw4LAGv{4(jZ%x~F>|kQ4D^1{+pQ61u
zgAH)E9#NHBw{xtOgZJZE$z(g|z}*>a`+4Nw1)cu(!4oHZsRHRFb^pUN$HNxrpE>~I
zgr#j9RSxUKpb$tqg|QzyKfGmQ+J^ttga37TY%HBTbA~>{mDo|xg`PUTPF&e%+rM)c
zgRNFm%2n5>2j{TgACI1-94$qz4dNkRG;J}NM1Rvo)%&nl+J5=zM54RUoxmPCz~G>3
z^ed2`HEJ!sY7_0}n9v>aoE+S0pLXXS>{(yBP9J7Bb=Y>-x3?}_xEP-(Ik10!EIu5)
zcp-gq;&}Lre&5}Wk2X}F(*D6Vd?Vj1a>Ccop&mbbHk}7w{RIMppH86f#-{Cpk4~T+
zrB8X4312OH4CI9W*OLz87j76FO4rf%PmUjt1%8coC#s$tlj_wE`J3M;uLh!Q$A>nh
zjr659Z^wQxS-MF7*#68YgKA?_<Js@09q`Z(b78GCKDBFK+OdVLxbYuE;R@}=sdMMj
zMQqJDeRp?2b08`Yens}RPXf}Z0nhx#IiGl=ecVpl`_wM#Aw2Cu7v>l<xOwgp3m*sL
z%}o2?*24VDpT6Ep+j|JV`NLyJ(%Ea57|?UkJ$&L{pGV(Cy;fIG;R~*VuFx6U)gJ84
zw&7vw1#*N&`%v@rw=T1bq&sA~L&PM{%8}|5_=Y~kozJTuxxYYP3Lj=WpT~6Pnoabj
z4sG6%HsKu)bPlAi9()%6dTW|z4(8^<R60*T(@6#wdRUj$D<>lCe_OY<qeq+Yk6grX
z9Xo%4c34|;85{1zQ0$B-YyGWtNK=(gx@;>3=wIq5+7~%>{3QLIdB%8#({}X61tizU
zZh#+sEbQYLI_#nb{RjKQ)?v4)-wIFn^BINh!BZBn<4ar|!+(SS7qJ5lxZBp)cDt~}
zKDY~92i8%in7G<-%gL<%^o^%qNLS}3(jx7}G<cZzI6AAZv>W*LVciAj*yw2nU>ES)
zH>Z8@$i*Y?9QiQn*bp*3L_OWReFx)HAG6r+S`3hDzk8UJ*-Lx12Ynj>mM@Hrk5A&)
zT%=x{Pgm&6EuoiA?5U^f({A)_Kd?Gc2p3g2#&n4>FDD}X?AIoI2iyEB_#N*Z`6!*Y
zABf)-?FH?zgS(z%kQXI&bZj%98r%cSjo@&Df%*?V{Um%|YhzTCh8&AfLm3;P^&5R?
z7xHbP-}OBHrW27}w84II>k78+%9X2(zwL|9TnyTGzcrUWIr(Y$n`7vZgV_#F4>Cz=
zU%|InHv!85-y7K9Gkmt;G_t>p?%8hJHpa^X)H$*9<(Px?-S*&5Z-JhE{IaX~(&wpD
zXV4q#)H*-A2|uO6-OUb+?7&|bN(VNfGmOIw;@|8W-kM%{o?QaKPakZIe$a^vXVT@#
z8!;v#+->O1Gx*FsFiNX1j=!g0dW%UNcfr|Co9x7rivr(g_dLgroJ98px@QhQMg3!P
zkDN|MSjTPmKR9(PO=IJthao`~tM%=(?{_P0V8Y5zMDBq%_UB!!GY*aRPfkLk?Y@U&
zH!dDi76<89ZeHJqUveOgQ16GJ@k_f8F<IZ6ZlVQKD9B|#NqYR^xmbWOM;&ny$R2i8
zeulcJzG$A^VZ?fFpUrW*S@OhWE_kXdqAS|AsV<J)2cCQJkw)-|hZw7H4CfkkU=-io
z@e>!lx`T=^wZS9w6JCDy`RL<~Gr{7ED|=`kH=?6XBwj?0r=invtvT{IIbc6dX^P`!
z`j)$qz5S^z*eNG-#_)+83p-8U{Tgje_zUnmCJ2JRagt?g9@+j<Fy%U7I@r+@y5_jn
zX3BHn!W0XTF3^WMOPLp;HFhJSJh|iK-y!^<UC7Rbb?z!Ki7$Ne)TwBDcVa)b!7pFf
z8l!*w?van-(*?#7XwUEB2pN!GIe=~SQ8r;eciGRRu5ZGYXxnc%{z_Y8dvgPy&9})N
zi<iC)==jUeybv$njM3+^Kj-+~AY)JJ`%P@sIqg3>H%%5jE5~3QFW0}>)Y+Gw-LWr?
zbo8hG*_2*D_xjk;G3pe~>y^pt__$}%^%?5Dc&b~}|1RE=*@Z1th9k5$L-cKKve4)P
zvUhyhw%>_pHBEcrVkFzyy_>hk1h%^o_>#yOc1ra{8QTu)VlTG%+SJYT{*h18IeZ9@
z5oGqvv(KO-H_{FKO6}<O9ou7ZoI6Bcxq3C70LL5HCfk1(lDcR|{=G;Y@1uUpM?Z^t
zfpH#vux;D6roDT2r(xQmX>9b7<Hy*o;52<R#>~O>*?or?N6BN8>+u2nb8_|6#k0|_
z%`>s9o@t|$T`W+f3@40-kjZZ7lwSR!4#LLOH~Lc6sSC7o`a-IkJ2hH2ec6oHS<_Z%
zwQlT`r}XouS?F+4zl3s6Q}4B)zVKot_61^ZxFs|n%iDq~u+1g6#d$2waWp@FJWP4|
zzRnw*XO}Mf{*z4bh0lPJ>Z`~{>(nsgukJp&mwG>f9=JoB_U$~nX5Z$<>|`uHo+Xd;
z#X<_M_QCxO_+HwLE%@)&MQ!Ru{FCGO{#R%}?0^>^PP!cD**r8H?d2z<C(<-pY`lNA
z4US#x+%&@2@)_D5#>42xyI5o|{NF=gc(|JhdFrr}@u$w5VGf5r1iry8+Wa0CZaKc<
zZk@-@o#N#Od<1mj@ZLi)9%38r_|Fo3<?Gn9)A+&@*r;3fF^cTqhyCas(Bmg_cj8As
zMcD(`Ru`1LwD({vMsc2Cj)kDdk>v$s>R6&<Q#-)jF#;EioMBwr@wROL@+9&G^!=IL
z2UFkhAa<28AN-C<?0_~)s~XA>TCiNu+7*xL68E-GF061YV+;NKN$QOL;eN{BVmn1y
zE_6MIy*PpVZ*s4{8@?YjBFyAs0PEyI#(efLPvj)H3+k>TJNpW!!Ou^{xciwnF4Cup
zIUi7UerM4)?C=Y$IqQg17p+4crF{yl33n&hXIa3Z|LY6&`bh5RFolfIA?p+HvV657
zL&&g%Z69n9S#RY<+`ahkJMdXu^e}_}bP<2-lat4zug`D*{wXqsPG4%@yKfh}xNc8F
zEaZ?^zMM><j162(N6(+aPhzKHV9QtAd`il7g8==iP53GMx9?6n@lPD{(OzDqzjpHC
zXp9-;g#y-n%9S4Abi*gd+4pbXlXlRy4AKs}80;!My?{S;;`}J>i;Fuf7oNtMyp(Bv
z5ApE?O8MUB)&mBEI=rFZ2W<nijR&B0=fS;cXwycdwk|$@slR*`A7=_*ATKDOT>Eh$
z&+L=ZX+rT`_-uX6c!)#%f<IuYzA0<?>TWVynTI?;d$SdP+OZ(Vrf*_5j-6+$;Kt=@
z69xOk@KxgY?}4CA`0M-R4P#uJ7~|63Ud2y5dg^#OkB>5q{%IG3JH%-lVhpCT-TFl?
z>gQEe+8_LZ?TiW0zPl*HPwI@GyMXWH0{FgkaQB|*i+3O#7r(gCfD7<OuU$w-&YsM6
zmoh|d3EM7?{n*3j_8g2k>C52bqTAifec5O91zE=@Z5J);CiBw1kgu}K?`~j?AbV|<
z^K%<$n_U2AyLJU1Wy7Xne2uOciwk{^Q33L=dK9f_CNjjI_01RChw(M+Q)st_(NpKI
z^yiMUyZ?D!fb}IwUs!X#PeoJyv7@1I1j5{U*oEM>9Iqexd=`ezV0+br0qT=qVsOrO
zkog|l68$RcvFi<-H}xwyF}{SIal!XK`ucwI{@S%0>C@9ELhcq6^WEs4;~_)XciSv|
ze_u*+E>Zn<UO=DEerE4LFZ~b}$lyyY@D+(3DxY6laf~+9OdH4hkHH&cK7>3E?%9Lg
z*^JMJ9|jL@;C~!BgZ;&~nWB$i+nvX%GGFV|uXYdTIMh*elCxvYuA|t)xU_R9!}x9;
zAT@;_Y`gEg#sqCwEbJt`{Wr(a?3W&-4RZ`m8)O^gODz|vw;vuqf^OM^=HQge^x^If
zEcKJ)ZaJV4ik=t>rgA9+jjj%xD^?d!x&<ne*Lix<8UqLM{God|pcqyfMh6dcVqbaj
zE9u|-<j?7}V)hBU!T{un6DOD?-I4awxgBKDhHrdabWoqICx3h8W;kRo9eytT`@i^C
zeAif`*Oe}_O8nC!pN5fp;kg&m5TA@#!kZgoVU8<CFH<>Y+0kHtw3~5)e*Eq4r&oCM
zeGd+z4xEE{(^RleF%bXw*6ZmP@4TKaV%X3~;3pih?df0t$xm1$f%8LUzsVNEXGTZU
z1v-OY|LRxM2!r6Abc`pdJg<NJ0o%x5X65QcI0ZUFOE@*VcWg`F{_@w;PyWdtra^4$
z3tRW5|7U73{bp<;O)xn#4I>>)Ql&l1T}|=b9ZJMpRBPlBUPl37BVtfImu5t#iGc_@
zhA-^em;Tp(_3zTLlgDE6cgvPd>Dj}F!5xPX++4u)Cf{oNfB*hxX_Sr(Yz<geq^%hF
zpM3K>>7RW0Wd^|a;1u>!7H@hnA^85$kJB&S{%!j0hwm_9$_hCq1{d+XHL&hD<BkF^
zKmVolwJ*Jto_hKz;%FjSkvGPK@cT!Oq@VrfAJf|>J|&E|4luf99i|2?lLApT)cgRN
zX>8Cb3v|@sD4ir7{O4)R{_NX-l)n1h^D!9WTWpNfGY~ux9p0b)`d8`APd)@D@=$h_
zJi=EhWmZM6bg@y`$mHSIUV1tG+aLW|+S<VzPs~j_5#b==|NIyKCe4A&0&iwqo1I9%
zeCs#qCWB_PH+<t;$6!5^r9<h*-~4v^{#U=A4$)Y|8*t=z^4~=szkTPe^w<CR^K@xu
z97m>1ERY%6^C7Y;A#8e`SXsv;8;-}He(QT__u&KSXTSJ|^tZqIc{(?Cg*Q>?9>TZ1
zIH^BGZ@>S&@1$S-!_U+Bwd+iVQ$J`}SvDU|;g7!k-SmfF{wj;+Mq*Om9im*Q_U?(J
z>2F_qHT~{`_plAQQ5eGUc!m!7zx(l@r|nFZ*-%VOOr^Kq<{PQQL+S8A28!s&&ZAtu
z1@oW&_OH_z6T;&-4O{4B{p%n7I332(cdIs6VAAsmhw`s}`rp$80~ZU^HnmhT4xJ@G
zMX((j|Ls5ji}XAba~l~5=$;`TZ=?SRUHJZYz8|~7xO>ey-l+PI|Lw2RPha~bo#yN5
z5Do3W`tA?YAkM_!z4~hUo6FZ@RlT;&RrPzQ*MI!2@1}qHqd!jn>A(CJ>itc4!}gQ#
zMjZ{k0gsg=VLk8{f<qTw@N|&Q*1!L=zhu$bw$y=b>_kw5-2>^3W1pn|{ObQ;LCE!h
zxa22h;E#h)I#PDF{+ECGKQWldf(2Hkbu$TQL;RON`R6QfqLT*y9Z<Y9H<|vA|L^}w
zzj^PiG!L)*q*iz}ppo63m9QnAC><OJu<hJCxctL!{$cvom%hwE_KxWI>2Qr*<a^xL
z$D_l#j)pxBY30UzzK!q)PrsPH|BY{^uRi-CozlU0(@V{~f<yA&v7_l{@cWa|V`+f_
zmBE3&^a7p5|LrgTZJNP0IN0jIwR(2slRRjw&g@{2$cfT7-+ep%|Lnczb6#nBr}qFP
zNCE^i!2kjv0D=H>&P{eVdpb<e1Zhiat)#NQ_=Eo&mp|HD<+5FNdA-uAERCd5&-9Sp
z>}Jk6AZL<@L<WiA>$(qKl1(*x*xGfKtE@x5c++{$dBXkN;dh7UbLjXs^cRLT0;qzv
zp4fLd9p7^hr{{WjLpJt3I38{ih<S>&|DdBKJrks-f9OpBQHALjAAOc~R8&W$EgkLx
z_icdNzv245y#xWFP)6>E^T>b0iQIng7biXrpuQI%&Pew|d-pRQ0!?J~1DrGg68$G=
z_FfwX8(A<K;|3Juh{dt`z9XX>&fq61hb!41^yK~{>HS>?!+E8=_3@10$Y*TbXe4#f
zhBfIwo&Ie)dmYC&{CPgrJmv$CZP{3r-rsj99obDq7}l_KCEp(=L#Q5u`F9ss!}o6C
zY#9o99%bTD%E|#L-rs#No#4JIwenewVI!#9;ZtX>T~24NUjj7m4_>TdS%5;YtF|^B
z-+M3}g!k)&(D1a{jX|`}`UU~c)}=<kn!o+(i*SNl`Oa)O)k^~_Ay~Q%-R2$&w|LDH
zN4Bow6$%J^SJ1h-Hhm1ey|;4@K;q)iISiCj34PGinEvkc=gfZ-5%=Sao003>f$v=n
zKD<Lr&s!$OdwRZWZi)=;GHC35#`B{CN8uCeGb10FGK!(z2C#SP+QoGK-i`E>03vy@
z#;>L1%K*uaQW4@q#<UKj(q8J=)0wPu{>+t2$c)RW{aG(lgyV`}m7l<)>M$BCVQKcP
zfolU8T1_p@RIe#awcECaoag}*`rS8Y(y1#KQV0A^5QH5CLT+-Kw;loJ!5_n6z`Rf3
zl-N;In|^xyWZHu6Ff}q7YtkUat2i9~{>v}I$jhgkmd15%3|$*457mGyAMQDnest(q
zfY-_q2iR(Zt&GjzojHZvf0+6(7UWOr1^<%6snSqe4G4H_`>yoqvG*~6D$_I-<gy^h
zEO6!YmGkMVYnM_-KLNeW0W2;8hgTLBr#-b>kbg(hzM8EVG^`h9I08ZeFuuBUK3!m4
zv_8WDi+*F~yxEx_9y!WdJeEp}S5avXy2UxWwR%%mJUj>h06+jqL_t)lt=&W=0kVro
zftW3vpT0rgbgcRTfajz4=)B%YaMTIt=40-;0$@RKNN~gqzZS>l%ipJK=v6%goaRTA
z^!Ja9uwpEaxzp570>EHWcGuCjBkx7P$|B@h0n2^?x<}3W4e7IaA7@o|Xuui9=C^0R
ziqgmP=${T21Eh9u-kLr=@<G~$US;;B>(i3dZV7w&?)CH~boQvLErR7@O-c*gS9);1
zmCs>Uylh+cBEFydO!_yY`#t#Q$LN_A1oY&OpwF?cS65V}nyMPco`5p~V`hsNrHl7(
zrN8_A=jrO5o5){A4jn;I<k+4A=@VrAIvhF%)vIZnozeuK`uyuN>GFd+;e^hEW|hN-
zckE3c9z2pZmuyG{V>qQ~>-th0XdBAI&QYEY&P=kF&ZmF+`b*?;Q<}FJP!<AO3D~ix
zc5C|ihaaa+Ys#Z?Sybs_Y}BpJUcbs3zQowHh5_uD=#26ZK&oJU{9E*u8XN>G0W@a;
zun{!rVOKkH=S;eYKHZ1zmyd%u1MRX=RKmW6J;k+u=pXrAOjPcwHWXeY-*IeR+bHp&
zD+-GGZx#pA6tti`6HHSFpHdMb%U*!XkvA}F7yP4g%ciuU42K2s-*q|yZ@h8mPCA9&
ze;JuP>RLpPDPFuV9o)7%{o+TTg<d12nfYk|=*0(A=VJ~BUs%6Los0IU*VE2<JTC@F
z*@FE3)yYrNu8o_K!K^d;!C^JP3)ilu)0fYu+ii_$L_R~?1j1jZ%Q*Qv{&=6P*8oa@
zewFB8zx?o%v}0p+IAzM#m%%Lvr0eKReFXAVRaK@{fM+DAQa1Tf`iHzz>FXO;XfxSy
z^l1b7?U9|k(n)mxjo7D=Iqz6Q>(_9|ow|fQ)bNn?HH3{#mL_z%9ln3^=zFOIfc5|U
zzy3qIeE$wv!Q+fOU=V_(8UW^xfAnbt72mjdE2=iCzd9w1QapH~AKAm#-*>oX19(KI
z(((AKPkxe0NHkeRV7vy5PXDIPwsiI?^6loe)H*=sC^XH0!prh-1}#gUqBEXE7c<b=
zAbt7X3ofc0wvW>H6LgJy`Y4DTvo$wo-`6(3quc1Gb`E_Sp1O%S_%Zi80p73-XMkC0
zR#_Z++MkBei<Z)dC)f=Et@2|jRDkT{fg|aUn9Kj^KmH%7|LU_y<k10VMFO2fKYi~*
z0`-=qZ<xQ9)@E=+>=Ev3wq-S-=Py6{IPFAstia)>?I~SOf)Qv7oxXB0umXW-b+n*I
z>^R%*kx}QX`S5-2Gx=d`kpeGS3gCEn_ull!?|+gu5J0eqwA=-V(tOy^fAfn!#kmJh
zESgXC%HDMD=GFAqzxfTa3kMDVbj%6R9^1JaIee6$(9+0=j-V!}LOFc)##Qi;YpDUJ
zdjVibta)1UvORO{wau>|p_|Tq7djC<ac$w!^#1m}=~sXBi*)|XSrQ3IZrBL;jgxc=
z`8b2_Sl`x?zP@@Xoo4+%n;K_J4dx!&koTI9^>fDb(6(I!FCiCcqrt8QIo=d!U`#Jy
z(-@dN%e7XQEKkP{97@0V;M24M8+-vvdjW($4@cI2`)7a28YE*L{@DTWdG6X3_M>k@
zb{7TT-@A2t>L(cKfB);hrZU=d0&=#ePfvUhNd*7H|NQUMb$C-b0XsiC_96D)vGm{n
z`~NXr#3?<D-nSB9^&qyea&;4O)au91?-c!L!;yUc&W-d9^0dCQHO)iTgdAfYj_%r>
ze)hqS(!4P;)d^bBfz{H|mZ}NJGpJ(`V73{C20fX)Gz6$UPEc^jQ1v)?gzM5rB!7@#
zp>3+%G@#<^tC!hMu?cx$C9JtQe9Qd3K9^iA(|eJXRxPPnU!MNmPk)JwTauPymkt49
zH@CEc5%s72`@zFVbjSnS7-as=Tw4};s7`JvSZ9fP{|D$cwdf2cxJ+TMnb6jZgH7!1
z_weFwbStw}LlJZS;U7n#ou3^&9*JsJ6Plue@%*B~a5`SPbv>QBjJ=4ik&h0lTq*^(
z`}s$orQ^trMP&GB6PsMNa{JD7X!owDSZmss2?zh-pMISNkt2f8%W+8VLa+IYKl&vB
zS!naDX@juu-G3Oecq_KcGMq}vjv@45Jd0@nOvLsW0Q?uf_!G8hUJ^F0>mG9_oQVJ1
zum2_u*RwShP8V63Ybb`F7s?1LzJ7wOaAN-<@Qw1&dBhK`4Ah7d_}uLq>B~zOqH3Eu
zos|^oHrAv+`^B$PHP~b^^3`qA&942$M?Z-Q$uGbN2AGH2?ak?b{oB7Hfsl$F*rG)^
zi1%&Tp8l(!{DJ^O<Q+kgQQ3=1yubPSRQmmeufYMIA->VQS!Y>w7}`t27r_H}Rc%f`
zIr;(PR0q9h{B2fS6S;J&{sD7%Aziq0D>9g$Gk;c4+g7nD{da%z=c%a)8w=ahV3S%f
zMxEF?TD!q<FN16S)$jfx^^>))Wc85Wl@u*YKW42R-Myb6+4Z4+$}Dw$m{@fNd+2wx
zc?e!G$<Nf69pfB7jSIcyk83m2bFve(Q5G{7+O;3-Kb*E#lI%qL%`jJ{ns9RE9y$s(
zaX8MHBlQ{+)eeFA{RphAWKnUNA>p*Qzc*cH>)g%sv!bj#0y9iD)9Gp;ssX4Y!|xto
z6Yb>pKF5Q8u7RI@diX>-ihf(Mt}K!r<ckKVG<CG6-=l;74m-t!3b)KLD7Or(;J^Oy
zFBzj5k}jTN3#GJo_wH~&X)Fv8T=<~AA^jEjgm$=92<M|mRhCzzzx>sorfPKXB{;mL
zw}r_3KmO>`2-=;3pANxa9&|LO|K+d$V;X56jdm1B$0%pJYwOZy*hL4o?u_6XEAFXp
z^&x+6KfIs*@yscbzjSzI_MU+idur;^PmX*L&iQHVMDh0<*RBx|v>y4fF|9=J5FgbZ
zR@Wcv9ZXXM#BG63{pHX9O&Wz)x;@ES=*=La;Kj(@$6yVYZr@D5ISr;}KquoPo}@GH
zPe1-yI7`hAmlt0_M-&sNuC7XD=&J?*j$?0}I`<8>FV&^`N&bV+|Lnw%*t)hREoZFe
zv+%9-&_{6VufO~)?Z)wpV^C}`cc{Cgj4&tj(QkLM{*R^Io9e)TU6TYwv8H+%n;Y0B
ze|H+}9oxa`Qu)Y5^$8Q`c5JFmC*h|DckGFTK&zf<YYdDJgMU53zWiOP?`R80yYf`K
zSO0+Hz};USu#H%8kivH!(pv$)D<f#pb@Be*LlM9@NidHI#8!ea5%SB6XG5p$gU_jh
zd$_y6DxBRPuzo+3_g7XkR|ZhQtNCZ*&^L2yxSOB?o#gi2#2saZGXEp=v0e1lKo@li
zt2;bJcHczb{ms{3rB<A~+MWw(qw?Y;c-D@ZE$PO++o=`3;<@XT`4FF3k1p{sI=0&}
z{S7p3kk14>$ts73kr(!FBS9c|$WuR#$6MGWYjsRkZ%QjxtcU;*9lW1^eL6kCZ#7I{
zP{s1K>CZm?X{y84m_;TSV3S9p_g(b$-<|uCz{02eZlM}k=-z7H1|II+x;6a~`djsC
z9J;J0{R9ip<u-iw(+D`3U@WG<3Vsb1_6782Ta}l!rDf3RPoUcwbmsHv?@0g^Z<%0R
zq$eH3|K{V*(wg$p^tYeGQ^C(Cuvf)<-tBPi#M!cAAuo<IUi;Bg3=rsS???yW8OyMB
zJ;XFSA9tmH0`I?c|26@y1`&f>@SWQT?_kc4?>mT|vp<4~g75k}c*~=X7G%yh=?1~e
zPvMEm5{c0&v&!G#=d>j|lnl@Z?eQU9@;@V9UO2x?aFTz9zII^i?x=L{ZVB@UzI_bu
z{u2A*F~MBGp7BF2A4eYNm{7bN?Dk;YHf*q?X*=?*5S_>MByIK5r>pnx#yl9bU_iGv
zZXS5&VeE?!;r(SR*QPuIt_-->RecfN<Zn(5<IEo*5Q(H98XY#fZDs!Rkpr8`%D|=%
zr4P`<OYn(A-}tRKYCQn}f5#fW-S_}J>>2%_olK4Xv&uRA^&|MkDgs^Ad#!3W36F3s
z{=-+N(p4%Z_l^#6Gu9e?RX5B=)NW^;kMYZf;oE=t+V33ss3woBw!+pfc-;1y>a>0%
z!Dir#V%k>ny4Tc@e*4v#bRR$B0J^CaOq4_3*Rcruocp^5vU_It_iye&@0dfhdwAOt
z<nXS_8u%MNhTR8{!x%Q)%Yabtcbfq2&(D6zt|<+vkKki<Ki8eU+v@eD@SB71jbr!<
z2+AX9O@1_jZTzSeJM%(jOFzZG?ACp@E%+jx)jm?D8<eU&YjVIQ+VS&GK0*K7n65zs
zpR*P_W?6Ima5=o~Lv**3hmHh3kq_^;a<PeKU*5cw+B>=!1N0o|C>v4RI78B3ar*So
zd+1SH*v70mg5`FA)oL?F)mj48+Th*42J;gS>8H=yi`q*j;haF<_<%K44qjySINLph
z52}+O)1oEC;ZHby?R@INe>O2q0^vIx&Xsc$G!ieoDnkctZ4gIe9zH$sJ~}Reb<mWw
zXpr9{^)PI(>&U83)|pl989=8i{3-d`x4cm&3;S@cEz*`;CaTl<8FLgiBlBMZR=1C}
z_>&VSQ{9G&kTd$9)QMXO%KQAQ)8Hcaz_Rhf&<=yYRw`#$OMAij@7%hV9(Q!&(_yu9
zU-_;2l6IDb7H-_SmAXmnpMp;F;Jxd>+V*YTk$!|tx20@jw95*GlZ<<BTUT0vT*nX&
zdtN$qT-3F+;mSyWI1Z+961%U2WaZfUj6QqZ?P!KCeigpuNFcyxi3ATB94GKce)wI7
zpT7Q$_cVxWJ;{H2x9mut9{&*E8?pl$whE9H3G11Q)91gA`*q@fngyfN*Ih{e51{w|
z3Gobt*bCYx;$hFmM$_eo_u%QRX%M+BJ{0$rS2$rm@GvgmUyuKc5y*yI0?UZZRWlzY
z%W{ooisr#}3>eY4)M;peK1+JaRy7(Yn9ydNsK5P(e~d`t>e6x)6w1EWEv5>>;?#qK
zwzYwMgqiFCK&c)KT(il!L}~*F`TRHkls0nyRv5i|4=+UtUql4g2+H?;0%ZmXT(AUx
z{0?R$Az1<8lcVp4VrXTBhd1sJkxEty3#g*9DyoHO{F~|X)vc=mzMG9Yh*Rp)`HQKW
z67jogw?}qM-TIBG4h7zTp_Ye@kv&1qU24V{nV^zRZd^1-HCzRGmlrO9p)N_qIL*fv
zO++OROUZe_7czp*-tqT`5w&aJ&2{klqKtd^$IE&mU)n|my$T8ie<|NKOW;FA>=*hJ
zAn41+-xFXokBqYlGI7@iqpR<1PkjJHV;Dv<gyO=YbZF1sbOOO*1b$mXV|x1dY0yDA
z24xMuHBwl`tD(C+?yunDr}2ABni`bTjly&Bo3m+TY$UD4QC|*o+l_K#K#7@Q-9+ze
zAZFD86jF908zYTGnRE0vK65ZUBV*=Bc%0?=fO3GQC@?#r8N8h7)`Lel0eez0K^+^b
zD$|zADx8owK!_H7N*1(+43p=D;_&*f-pzgZT~D-moD9hp9O$P`pGxc4PGB>J??!+D
zh169Xa?gmQeh$-nHiL5)=Boo<!4Vnr1Sov~$nyTd!)Y~i)B31BvU&|%TZ{8;Eza8a
zq*IKwQ#fe`P)J>4lF~c1k2c$vC~=I!G>mhv59NGIT^$)>RI0(S=tGg5K+>XKM7GJM
z(y{=O2A}lcoTRPN4cAzXqgtin;I<vHN9x@x*O<%4$?6%URh2}%vqp{{kMe-6fDKbP
zie^w)+~@nusV`G4(Z!p~tJpVuT{=vl#X=%RhcR~V;|S=(K%Bvu*WK9}Wke0!kOy43
zdNp;{H)Gi6k?~bbxxu|@35IYHhL{nkt~mv?Eesmr{U{FLYgezQ?gx#43#*xr3JjFW
zbd!L%_MYx2V>b=0&j2DfHn)TWRnVvJDN)X3R+iEKY;0DiA?C}mGjK;^ybc<FK|tLg
z=T6O)ugt_M12lIyRzaV+4_<o?!KzjR?HUYbR@Q~{=Tki(jeRVkD#^#kPeve|RS;Al
zRR+Cgun&Icxb(rN&YwG<8Y!b$hVb21Q60SW9)P}p&KTD=8)5(us*9ir%lgG~@mjeT
z(aN{A)JFSVwyqYVXuL<DqQ<Y=pmj7gqa?P3VO)xXp@Iy#r2vgR+)pKo#Y>ybnw_7v
z0?_HeFeqTOw?EyxcqOuKmXPVc77#?o?K}XS$<vhl?VJdp!i=(&1q59#noUnong-ju
z(?;lP8(AYpB0r%D!F{$2slq9#;bEquz~mT#mS&qCMiDj0Whubqo$EJKKS6EFmMx6{
z$?Z7A%zEhgHBr9?mmxcBt4_14(A(3-R-6}PHbY|{;;f0iXj!K^`A7q^b12X}pf$T{
z)gB<0sDNN*!c+Lnm9yvhembqhc~gq=zoTkXYGK`26=Do!(I{&0+?dzg3^>PcJ92Xt
z<?#8{fw~>(2nO&5=Dx43Gd*f<fG?2gLU33GW3hVu$~1&Sz6d2t^$vX>;f&(~8a}c2
zaN3Wurd+&!;ZkIMS$cd8{HC(B6mau{G)z$4BnFKcpYl_)*^co$14ma;%J$y1n-T1)
z1Ir-Ub^Pwr<L^hN!L^6TT7qoM^3pkSV()>p4+pgSDnGb^l1qk`L8@k92re&2rW;7+
zIJ&0s8L_74*0b!N*Ds0pjRA7Z<P{3G$P@sSt18_Hu+KeF*0HeC<*PTNBFtipkPYQ!
zX&(m80D)GcWZcywr;O-!NxtnKZ`?BG+|P6dh2f-=g`l%ztdF(y<>9Tnsjsgu)<y||
zU>i1+rjzd-$MD5*_i!AYgMdZ)WEGmDIQCBfmaZj$q5ckl13;j2y=u+sRKo8*K60Eb
z0>;u9fdm2uX8Gx8RkwICMCM^T)xHY4h|=E}Rg|nGCSP8RgJw-B^9k@`X7>~Lg%umD
z_mwku-|W}R_l$+KEq`KI1BmSC=m<X5y7*qoCxCeid~nl_?KoW)Vd!Xhz?bG8IeIp8
za0Nj0c7U>d@Ox@pr5k525>PuxNlr4{0fRPIRi)#|z8-=!p0%>AXc%QqM%IRxZF<X#
z+`Vk4q+(Ez*(Ev@HX+}d?%v0l*2OnCQppx6r$X6DWR$?Ul?-1Xn;mb#mYRynbadYV
z+PgUo0FbpJ8w_|^O*X|E=Hjzs?*qU+V;)(<jDZeVd2v19bp9xgSa^5ks`WVBYp7z;
zg)@L`JLY^G{n+X-jooBW;(Su}&mbGuvK9}(PYnhs1`u#f4X_`(Wo~Wjmd&)|z%YOw
z+tcAx%r+;=_4uC;NG7GT&)+;t`tC%wUb=WOJzm+EN^vyrs@;|*M#eDe+fxe;uW17C
ztav5>CO}*uy`Y3I0w~-KczF^~VH1Y_W5&e_9hRqE3J))<-Wc1r889&nNYscE%R?R+
z1e9xx)5_~?cH@*-ORs<J2bS8^G4nNyU_IM4m9Y)VR%l4)Kr0!-Rsnp0Y@1?C8=iKO
zxzY#jWrY(eEur^0rXOPbt^hoHh|xU&;9y4E8UkdikryYB3uEJKadwZfC16s}tQA>y
z9)8#kKiyEg0w8-c)wRZwbl(cNI)$!42!FbdJ|J%tbk~WhjM#=##-L;aJGzk_ce?@f
zkQ2(c4K<bN*#3jDRa6g7EGyEfX-RW}W|sZlw6Q8Gxiz4pT0(s}w#{a$7}TH_@2T60
zK1IbGz;hD_98!;L4Zl8;+2{Xxf4$zTYi9G3O_;Q$2(i+H+2+!ddXKNQ^j!P4O&x`)
z$@nSX8%X0e2KxbLd(pFRU%dukHj`E(r>c>Odq|*==G(DB8UW4Rw#I;nM&|z%0VxYn
z%MC=_&zvq<xdH&*a_)d~Hf!#l!K;v`er`6f4)eXp$Kkf_bgvl@0q1lvL3f+BZYB_Z
zcT}Y4!p0cxf5Ju39ck|mI=HX*)On>|w3s#t&fmLsBeHef(ri8a{0UCPp4N`E4xUpA
z58lc=-z9M7DWKmnWYG@vo{x~VR?KRC(2xd6Y*>h0wE_OMwW12!a-3lF(bR)8cs_LU
z0_Vm6_SP8VwYsu8K&WQc!wBn8eL^5cXNH-&GdO^U(2)#ymiA*_otNy@cXrqDeEkrF
z78K5SYaT(h8*tiEL4dired7j>4YK&@lNss)=~lORatVNkd2rs>(vHIbUmqWRKNSLK
zJwh%j-&{KzD$3F(t~W+-!T>hF;DcM(b=;kY)}1fk?LhzMdIDxvtJ;r_b(DZb?c1h%
z50IGzrqV65ug%0OKvqA+X%Tne3u!H?bJ5QwtYw3_1<`a&1wr#{08cS}wGx1p@f;7g
zKAVqjy8-*j00IL7hWeoId+1E)G6iJZ*W#SthW+WbCI(eL>>|L9u~ATQ2m0y?nmg>U
zx6Hl&)-!#iO>V8z+(J-F-ZyDY-a=$>H39nTkzp@z>|oy_Yo->GwfSN=^crPT*hXLw
zW+KZMKRbRhEu$~3j~b$igpPzYWNKPP*l}~KPOGPl5O{22h+_w-zpY_eE9V;Rng|+#
zPpK0W(#IlbNZn5!*8He3-Nn{hT1b`P%1vZ)uS>(M0eSlEwgzYz`OOHd({^V}k3my2
z@ZdZ3*U+bWqv~ZDK!5FqjS)a@8Tvb|O)-{Mn`mroN~dSPOe^OXVv7J#K(4=5QVC%V
z!Ozdrjfb~!II_J2NMIihp2n{BXt!H1j$_N|kkMY(F|+_X%%Jm9E8xsk!fEHTmDuL1
zc-F~01D-HLaLo!p=Y#0cKR^Ca1Pyi*AoB#U+X@}4&>1#VRgsLaN5mQXgQ_ntNW|jK
zqsWhk5ALV==%!o13e2LfCedPj(F&?`7NsZXEB!c0hH&WUxEMy~uo9rUjX<y4w2CuX
z1y$NzLtyXz<44nb=q@_O?%%$XZe1s#0;g@Z;<IUb_16jY@g2w9$CAH+_dVFTXTJIh
zeF1=%z@rl8W=Hv^lwYwq%I`Pae}IiJl7{oB+yDlm16G}Q2{LSV6+!L<$*zU>J#Fnw
zH`}n!7=J5$t*I<ahp=D9aE^a|?rZE-125p=$Z@M`9z#ZN#JStgSTr^?1#c-)pRI+5
z@7SG&;GxZ3o!%<skJY+v-nyB_I-bCLmxI@lxI<QYCzxM7G-7bgB-r1Rk%82M9wCmT
zS>c*$Z*NP#`~34%yLto8ugcgyvl#i|Tnte`wVi;XL7b|S>;+&|DogUaE(UStpE>h2
z+gP%V4mgJu6Sr;Ok(QCDq2t%N5ucDB%1h)aI-1>j;{bH8V_=PK<oX7DDHpY+O5lwK
zi@6Q!*H<oKa#9xqJ|*uwckWzjDx{Ll%5@RAE+%sC!NaI_CI+gG(mF(f(hxY2&Ua|W
z4DhDr=JeYyzQ6{<?m(ZbM8<4CygwX@vCSCmH6z@G?%d1YtkPoO=Z{Z(NU&;6nkK01
zD*E&w7|9Z<7RfVe!E+1%>I)f;o`iG5%x9}e6%p{cmG7Tod-PxvpKkmjs>xN9Qw;?N
z#Q_2@9=0^6OO5vf`}OW->24?J;4tfE`TRxc(apQ*G0t79`;;**YuBw#?;SWuwW$_#
zF&ybQ80h485b}3_gk*{@<fjIp7}UBKJMl+2zO1a>*ZDZzZf%FQC#ZD10vl|7=wJq8
z4ULVYj$wjjSQpRX9rg9~Y5wp;+Fb@OV-0VhVs0_X5;`HR>f74T82Yf)efp3M;tN0Q
zc(q2gi{1LdZIZP!bu2Y97u_9Qbf4;g=!<IzUevbfghn5<H^;V7W?vgz>9%54iC@Z`
zirIa0>Z_P-u{a%eyQ^zc^Y)I^cbQ}y><#5&5BkVCFs9Z;OQE;5X%iI})(|jz_s(r9
zYW1=;AzMXY+jI?~OTnY$P2yEnx-El_4X)Tpkn@XYqv_K1TY(K&{cb}=dD>Z1hsrdW
zo}K!F>Oj5leo|_n*EaOEZzj(~wWX@{<*A%xxg`W@xP9(0_U>KuaT9^Wwd74!!8W_!
zfVDyt)HTSIzI-Y`gI&s-tQN5W4Ap?-V<d%&MV=)gYm`6=fvRV$@AKy_AV=3l#g3}d
z^0W_~v;caO1{&@@Nc{x8%#w`P2LE!4^3V<V?adoEQ*V1`S`2pOR<?(>?WVdtJ`HF}
zT@-ec>B{l|*FLnTd^6d1|Ms1!8ryuh>q)wF_ik*pS%Q61y0Ic1KxgVg7ak<|@Hv6U
zA%B^F^{n^7wRVGF<iXpo-M$dm&Eh3glxJ;htE!=@0a(E)WE^}iwq{e!n4|e0LVK<#
z6S;P>77uLM2^LqB?p+e^eS+_$FqLw@()DZ8C-0x6az<Bd?c=ug$|dpQz1ZJkFcquT
zq|V0X)Y8-(x`9=N)`AtC1lLf0KfiY;J;p9FU^E|{ZRh6NNdDRaRyfkrpB^^U<4c-O
z%T_K=Ys=OLU+h7D8^*b-BUxQc+}aAK>Tf0>S=BeHp3nyaHX>0D>Rifqi+JzG&t~!~
zQyUu_(}FR!VMJf3h2GX-ClsS6<r7#iHaMJaqElF1*92~D-YM3Fl?=7xuUxvEIvzBn
zf*0(RP(<+a2ggHCv_iCPn1DurYM6T(>3?KSD}4T&Z@x+G__NBEuLcvv4}t#nu&E)c
z7EQv-CV&|m2qGAV)?%x7+W7>!R~K5dx&&;RN-OZ1eslw?n=M{SwN~_(+6@&^CD)|b
zX>5Ynb|xmBo4*qcxPoc3bB~;GD^hJ}D@iOwhkSVZE{S?$_<I&bz@(KB4NMsVpPHb`
z-T;0+oxYXulMnVEN&Dfe29#X7eI7Z_MyBw^)##djuU;^QeKU$(JIJ;&dDw{2L}<rE
z25swU68CMnN6t3+HmA?tJqKsfdH$@MZHd@BxCmhN(2;`?^jgFO$RA<~INj^H678ew
zQ$LVF$yOjACJ6s_Lqo{-6$I6aO}~HiSR{eUb4KwUxE4*0YHVs@-ofe63Fl8vr#gb`
z%faBR5NTkqc$lcNEtFqqLl{)<E(J#klsF8Hi80^0d<DKn5-DTq?ih7dm62>WicK`u
z#<<R60KY(=LTA>N*w4CJ$(-D}aD_@;1p0xat_7Q_B6$7ykt66g;Al-&=~60ZJSQ8a
ztmibx0eCsC@qX@)XVA=S8aPS&p&0zU5d6Bcrz>5*a)p557f~Ux9NE7enK3*-uo}3}
zNNWRrP1YTAr&W{P+3QJBw&2ynSJ{!Z$+?)~y0z$bA09XYw!JNl4-8T<j6{9xUn|C}
z1DjS(8~k9v#dYY$1Q}(x_O80*@jVB^hbG26fNxlvxnx}l!9lg?HbBA38+<_1$Qtow
z6`klaomR7+Wt^8YpVeFH(vf2X2I41Ze)urm!mjV?>;fvFrO>4n!|va|pJtIqZkt`m
zYCpd3NX)&vG@zXa4>S;oWfWtf@6|-ELS*9_u-ioy)e&g;;N~58|5Q|mDK9TaU)q#f
zH+NA*wGW>MG{*TwoWF;@n~15erwfd!8#_b%*(%!`m>+|{`>-(!(YatB&?%!%|NhVs
zKH<5OvYFB*o+3$oW!k@W2kZDCRg;#7E$xmod0>JTnWzHS;#RS3pO~lx6&Tb^R>gh4
zeeW3Ox%<SdbB?}YkEn8v-d|f)jc@sI+Ptv}pI>8o()}d(-x}=p^<|~$BN8+X);5^W
zszR~OAU5$AgQ6{}VG#+h>N*wERsZpO{ng^;>QUa$;FGPDn+PD<7r}`=o!zMkJ7E<2
zWI4Fqrcx?mG1i0A*_MRri*D^J|1W`eAK11tf<VOu#O)1eG(deldQWxD#t06#^3Kq`
z+sF^rVqh?=jn{4d=>1#%Fg~tdd7<0Z)mCjvAHZw%v9~;^$5;83u>sRYo<@=;v_Ce=
z?mpNgCaM{D=lX4GZc1N#@q6qO{8aRP|Mp$T(v|py*t*g2kUAYJrptNxmmG+=SBHf6
zuEh81SN}hKH8<ip1<eJku!t;S7WO`j$rY<t5ZscL_lFlmM6IR&1$;C}6f%}pwRBT=
zOM7~6$NtFp(6EHtq*ef<t3<%I!NAQ(7-P0A18z2!K$}~*^iY~>SH&hkjKyg+ff!~{
z`1v&y{l;!e)1zpZozw%6YVd-Fh=Bt-ua+%df?&9suHLv7W%FL(Y25jETY8^}X3N6w
z*|Lquue)h@CfmEs($yEt;v%ZJZ~>so_GPhO<{*mhWwI0QH3LlHB(*xk5a7IJ@r|Yv
ze1_izLl}wZ-tN>0aI}gAc$bCy1f|Eal#$_09~ERC-)2MEXSu)9>6=G37yc^yrAk|l
zrnA?teaAUD<KDK}Mt>jM(;(1bhg1@JnyzDTJZf&F<ZgZd(<g}NUbSjfs>WzLPlTcd
z7pKPDTdvWdl)>Kqs3g>Zf#E)z2lwnt2M-;hOg1H~0AVaWYrMMgsj@upFUwFVxO4Yj
zx_tXuY|~JRQG1O0?IKco2TIC$gt#R*#}Qm+D&&SB+Rd9R8u-<?IF8wv2tvv%P&iR?
z43H3L&qMjSed~5QPj=p8%KPhlKXULu+C?=Y`&WZf^z6Y9#vWi4_lseTn>u#ck&X1+
zYw4fwb919IF#`C~fH3TXNv~PBBz;Ig%n|@}tBQPuk<>x9#W<ciAMP_Mcxju>^f0UN
z2ux2$bSsWJ9bgZMEPTOt8%rxNC=R2%)kejjI~W_ID5_R^F{{D(&W>D5=iYwDQ#kcd
z)`k#JmW|&*|JR}53k*C!xyMGJ^e=`Q!BuXl@f0UfODn-ZC^UjZGGfcqA42E~Lf^e}
zH(l0Q$6C!JLUS*HF9!iW3_z)^s3a3(h`^$3Z$QhH4-rY;2Ow;AT`2-{9rWea3D*cf
zdcgYVV+>~irJrJ~4`C!uBglsUYtG)f1|W<R7huz@Mh(zaWEF&iCFX%CQ-KbtilT-<
zvh?10)_Vaov=uOR!NG!5i*kCS{vH(<?xbGU@-zm!W89D7<bBML=q2jBzNHBOz;ct&
zKZbynt}Op(aFK?wl~e@Wbi5f@6#-;1n+*CNn1&q9cw%I$u_&IxZ_Zr33<yHy8VvPX
zGT`3_>``$v3fML3`L3TJOXfj?^9cbXUy{kN7%gW{bsbyfk%2+L(nSK|+-7Ttxt>6%
zyDgbP5-KF}Q`P?5Aq~Dx+qutk&#o;Mf&~a-qjYxyvRR(C3&89A`Ex{u6V$;Nx@FDr
zU92fUNpuPDWEUl?9f6?3XiIf%WFkH%81Vvql^45*@KR*RE*xG*0b=&Uhwqr3&K4>H
zm>NHF4ok`3xXYa3@IJD4Upj%3q0{O5om(*m3vrlOCRfnjASh*%<&6!t=s-q1!T`8?
z^+p<Cyp{qA?%lm79e`GM0Y+GE(^BIq!Unsz9mDzCH_~nRhYCpvfh0Qt(5K1t3j&kK
z=o(#)v2;8kj!;lQ76DXeqSX8Yl=92hF-A~2EkSR!F9B1_d#}2`EGr-E?{Wjpv$O2+
z`e)fE-~KC@W;t7(_&Rq6`v%fQK-cR;c26Q#45+Yb%PN2v6-mJbjb#lyL50foWmI=z
zyEeefo40QQpq(XvgDpsiK-a)IzVJj;xY^41Si;@xHuoCeuzW3`*p?{q-3Xuh-Pd15
z*=(2H<|-7`!|<scJ0eiBlW{lOXdZIGGQV}KL6zTzhmX>^vuC5se;y9&t?>H~_q*)@
z+3*s#iYOxyrGjH5veAffrr)m*PWBDIiG`nykzk6|QMLdy)B)n!_p4W_Qb$(bAZyh!
zj(f-;`te5}r!BPkZsSAd;weTOnW;wLzj<UgdGpg(?`<>lz7AbR<JZ!podi4m{>)dg
zm4wZys;W#!<{wF`%K>09gv>HDu*0n1HS}9x)2(UR+uGCVFHgs~xnFP@v~rZdll{!)
z4gj@gf|9KGBj{zYluosl*0yy0;$_Bmep>xgoHGQFwG+Jh6<I}96_x3I*9CmbEeWiq
zCdK`sF4;NAh*`*Ft?STWYRgvZY!DPEd`^WSG8;;&HgYy6z-Ob{P4418dkyH%5}fO(
z0I-VegfX(8zk%K!2W?Qk5}<W2e18zfpfV;53V54q@m&sX!C_0)Ft{l%bkMkc(K-P9
z`OwqNoAASj^$|pAdGRg%+tMoL!hp)y0>n!&HfGV7@h}R#-+6dHHQZ*q(Z<FAnyWWf
zrV~fsOM7qzm&0e5G%rHF0nl>(Bz?ToSf82!T-M<DFpH+nwZnLQdG#XmMlc;#p8>Wb
z1fPtcOX(1v#sO{>ux$W41|b;)c;>=+<{#%QP6o5sSJ4L@A!a<aA}gN~v_>PN&o=v?
zAK8d}YoRzk42@N~n!7s)i0%$>ep^LlRF0egJT?pEEc)0Kl|$Ud%s}_p!V(>08lJce
zeQqm&z@~L&QJLe*vuCo>;K+CN#KV&Z(%}OKSW`6-L}c0MxaVsP%#ns4*~&NH=T3Dt
zCou5uw=`2ZvXfxGVgQ$&Y2)Ti*ac)hQVGf}iKfsMCQ08O0-PHL2sZ<AhBe_9SZ*u1
zp6VcX@7_&kr8mH4gA7VB(tk-QUAH?h82C|ZQv_H}v!EIPKD#=)(&|NIv=cC+!(tSt
z-Bk?av-fTy0|4A{V0k|u2IW|3X(`}?PNq5nKLf14av5N#J~H)|uU?&w&H~iHa|DQ1
z^WN=e?7eHuhro_ysvDXbBU{ew|FzJs+Y0PMpLWa8Qb5%^O^;&C{EaUhzi*8p*LW8|
zB{$CB{hVFVTX=Dw<MrIh@t*s5<i3mSwAaq{>kL%$oH>01Sv-aQaSMCxQ4@eQYoG*Y
z&}ZCa3vx`oY7O(%V0n9Ft<}38wKqoza;q#Yo_2eT6=@st`_;i1#$eD?^?v^8+;Kb6
z*k%>JcbheN9tWjWAmoj8{oQFZ0agZAaVibW^q+Y7>cZduD%aP!AIZ0LnBRHuAU$ks
zAh36TIs~7XkCJfd+EudJ`_e&ZU_IH_Zgt|8sq<$5=4=3b$3V>1rsj0}`i-!~VtZ58
z(NBN+lc>B`2_Sm|xou{kPQG583I@t;Cp+ALo$HLLfRi@e62Q=^(z3WmE8B~<L(@SM
z%1(}K=Dxpsxo<<<@<+a^T@^B!=SK8l?PE(>F9y`wN;RPq$Btt+z*}jz73?e*ZhOjC
ztRa|n8&2ev>GBz>;$efeVi%f0SOb6i*{7ezHnVk=Rp|jd^cm|IRb`H_->tRMn3By(
z3s%&uBPeYZ^7s}>GMBDjjcq4k^zg27GTA;R0JeyGz}H^VDcS{N8!7hyodz(=VYQbW
zyP#p_*h-8#ojupeF3w#MJiu+w+zL7$y+c{!e7Fs%0n7bVc-VLNAOP3~Y@&@3aH*Z;
z)aQDadv@Httb8+@EkDW5^Bg}PMu&NTebUc%SIZERFOE#1kFh-uGD{t&xtHJ$WX)(k
zng3H{+Ov-Q-Fz;*23^~r!Hwt@*Dg>|2mQ3Es|~vcyUGeZA2BxNINbrG-J<(ZXKU6V
z>@ZsqKrG|&dfRN@cOHyaj1w|eN3CnbK(H(K(b@ZZ(h4$DM-Gjq?NqWYLB^G%v)*rO
z;x^M^Yiz(NXE48j;1z;Jt~0KdBhSNT+uOH09Y1yqP!wkbcE>~Tqgk9%BiI&Z(spBm
zuOQ&z)1x0mLeMyY2ERK;^~nhw0Vp%$bU;1-IenRe5A`8$-R5>3*K@ldw@!9@PhVSg
zVhwy}H30WY<buI{j{$v03Cb~0qGXMMn6<Ix^0iwx(?xX625c{Fo05`}bTaQ`R9xGQ
z!}i9#J87^3dx<_iL*F#}x3jS&P47Jdp0xt|pK|zQsNH!~PsS`+p#wc^*GTn1Fav`!
z%~Hm!;eZz5ExxoOu)5XO4Qta0Y$!j!bLUPvfB8~uhhjhpe)X_bVx7DswwEvd`Sb-5
zGWCp;RUW#TuP-lONaY0BtXQ-pww5hs4Gs2zlifhp5pWt~3*Ge^XalJ1d@siy+f87V
z6{T9>!<WI}?qe4{C)mubeNTMwK8bD>QKjH2&ap0>tb*4jdAVJZTSThAH8LKjk>R7@
zGfT1i_n~(!S-mp0M$n#_WIU8Xy*Q~ZV$a;0y`8qMuSkoIfEnNvukUI}|9JKbKyJ1%
z5L1|$jIC^}l4-Kt2-sm$H`~78KpCvw7G?Zbg2lKUla;xyVP{%a-pWZ+n1OEFH^%E1
z%!|P~RzpO)P6g1)_Ug?zx+|j6RM<1{2<I!4PVf}oY9qRx$AKNYLYM4lZx6b;_vm4O
z=@mFx4&@(9>sX7Ms;hz)h6%KC%LunN8M;Jp3v2&i?GBu4*jLyQm+#&r(5xY<u}+|~
z8JML**eZyw4Yx(B?`p>(-H)SmCT&1xd4cY>11Dr;83#GIva^SObwn&<9hoe)3t965
zXY=(N*TL<mrZ+kqRRa#=nA}6c-R8<Fg0Jc#u+X3c9X#4zZmp@_Y1N0zVybN|RB<Xu
z`{0*WU~%o&RaHkdIWyEHIzj&p@Kl{<29w^rd7YreJJ^zx$FHQi)0Wyak7`&ZRYXMq
z))U;DQTDLq*{gW#JMRDHk?9K=re!wzF6h*x&!+^}Tn2x<k1RKEX9WQ^`}XfkI|+u^
zw{>T_N!D*4*wOIh6qxoT{H7^AZfZ@l+s4AdvvT>yR6qdAod%q8JX+CbtU_g_&vvj!
z14`cQh}9Zv(7x$3GAO_;h!0UYp@bxkmd2*A^I8cq(_Gp{z}BI|M<UV9N<${GSS>=_
zPMcBrMl1{t(P!!2z5D6f-P=(W&uw5%fLCtA#;jo;&)&I-YHPJqFeY@3GZ!zU<#`2Z
zKNUUQ;$k^#^Ac;~j>$Jv5!9{`JGUyhvRi#&5t!7@icM4l+7t<TH?CfbYVkujCf#P@
zAUe|C1N+l<g2%7I->rl+$@-b(o^Fk4fZ<5pP*jGgB(Nu+_4p8f!Yz^v8rX{V8ThGK
zhn46YQv)X?f*EA+%seXN5(M%MdbnEwt7n;*dtl$bR1LndgR!~K*geK6C~fqQ3`b?r
zZi4yTj?`+$ZrNd##2feptd<~Nh(KrCc9JW=>)g@|$rf1RJ#Y=N$#U>9f4gca6>qq%
zYh4~H^*Q`Ob9}Cjx(5ATo!)I5>d_g$`1%xb7-uQ=!RDU2REAycR)u1O>LCVEIFHrL
zmAH($$W`Rc1@PA)@Zg2;fnB?IrlUuXvJSVT>)>VG;96tYn31SxBi=Y@(p!&g%@BwJ
ze>JJF1Q|Gn!}`i4<QqJ31|D4jZ>rr2jzk48*PZsiJj1oW5PC7d#-um>3#Y&SIz4D^
zbTOul;4%mHGyezoQ`K?{+cA+Kf&To0-!6n_7;wL7eK{3o#z?NblFp$sj$se3CgEuB
z-recQ(IX_tR;6XEFN0Ra`y8j>w<vXa(1E(DSWu?D@=V*DkKjp+oq>=3M6B3qKRwue
z<2?hRmngRl5Hs-aM*V}R)L^nNdH&engR!2ixMH%z*HmCLn4_5UE0(WH+xPE=2(#<Q
z`0~f+Or%oX1^RC6Bx(6cUnJw~q5tbiSeZe8J5S{kY3(_cSHe$#jcK)ID~X6t8tm4=
z+E~GTtSTgSFiaIroy;r1R@9+ZvbN4$yOf^de0BYrP!$W~O`iD1drpeO5%aLUF<y)(
zF)rx^$wXZQmwk2deClJZE+*h%3v23q^e`*#Rijh3w6{gjk@DO5+m3FgALjD4Yv~)X
zV*PRpSVNmOQP~D8WpjBY2~Aazq~6yv62U-oTrXQQwBvQMjn_1fX{D96lezXiUsze@
z3cUGIeG|4K0SWM*ip^EveQYtq_i?rt@P!Y4YjsWa%Q|?}rc#n-aZX>jbP25ab_CX~
zfezG9kDmMhEUqH0gnm2FL6v6!H0fani9Q7QEn@DiJTH%5g?}Wwy!4eJ_cqYA?@T<0
zS7{4G)vHB?VK1D&Z~=^U81}L-)zs9aPgani%^Io1j%%T6&IkcBs2U{g7e)n8D}qk4
z7BBF-Zfr+!%Tn;Houj*`MuGi=yoqg-UXG%@^@x_m_+{_o!|WTs%8gIF)S_ZGTtj?r
z^>g*x8x8kJiXV&Zcy=*1$KN{<<JW|4{}BI|woUZgK6^j@$GzykpTuiF<l%LrF+4d(
z+QrgDZCNGNq*MBe{%MDdz#Ep}_uX8xIeohN69S@Y*ygzdoQaA;V^pJI><z@;%I9JP
z4fpHer(fagv--~hwlOVFKVg>>E1wx;S=34p#V|?Z=ta>Ic?A!PA6SXLVl(;<eul~o
z71+<vJju_u8|ovmeHPuyEs(^UtfJYB{C8)Sr6fDlfB`M%9tOQ+z2z_C;6MB8>!3yC
zuv=k81<yywwEOp{C^AeX$SfJ<#K9x6rRrL6ta{dzI@DT%QfuJ->sG8x13i7|i!V>J
z6(9+5@I|YoAKrH$?O(N*F~vre|1fXd&H;|T#VhB8e!h9cY4PFQE6!7nYFBKl+7$d>
z9Q5?LuVXh2m@A2q1jsF4oR*2Ra{uDSr4**1G9J2s7_+qQDEQZ_=I&vea^sQlX3n1b
z(#p1CVMEwfH}2d{w@AY7?Cjvz`Khw9GJSmVquBD@Emf^_H%@|s^2WYui<`)A^`Y#B
z^xq5fUwPo?@g3)Bm#X`V+trkAATV()^e~)GpFNWvVLuLm4Xs+WGL7$^NUN#7C&mjC
zX6#t!{Bvgjla#ktf!l-MU&fzx{t|vr^sNGL4U-3cvixW00&Bw;sz1>+9D$Pb=DUte
z-qKd*$6@1$Vevg}js#*pF&Y0VzWQqyE=R>=18kJ1Kl|}#RC?S%@ZLHK58RK+@Fssw
zAOl>N-RR#7pzk8qmAkEMhc6nq<2=cwvS-FDyKCJ4hy0oE$u|DG2<(Sk=>IF{=K7I)
zwq3bN`Y+u^?=iOqvN4oyRd@igmSS{l*<3>$I|9bDSbQT0y9Z9HKm^Qq3L0^b%|1Yd
zr^92Z2BXxSvyp*Ot>kxSze;yd6rPNsEEA}s)7$;njcE10BW!UpFf<+|(S|W>1-B+J
z9$oO4iJE<EHZiN{1&ezgOj^fD34n<Ela`YSqfu%A%@wjFhA;?5XD7qhc3<zqfKD|y
z?3V$mfU$(J?q0tWFz(@b6DZarAp>;QUc<=yEoJRm*jsZ5AvVFfo1vZ4GF|!@#Oc_e
z5V=jr4H)M%<$qTT^wvL0O+>#6&|5Yvi}8H9mVVfjc@GE1BVKc7KF9^yL}O@=;v-{T
z3QG(E*XrEEpD#f8Jb@|PB@$DG{0ZYY%-FbB_y)kHVg$L>7X*q0Or!(LQPwxJpCJNn
zbYzTu7%5u}u(fEEK#}f_w0VRQ*(+B@Ibq9n&&Rnh)3h}*+~+964**Oq-oWYA)sjZh
z-a1hd7GdNXrC7D4F7{q6#CU!-nRPS=?AeFxL4WM8bV+|+8;ZD##-`DV6$I{-;(%@;
z1EHa%IZ6^ggYx>IomCk6>ktwZH8_m`K5ru|XC}B3*UXOW-d^8veDnC$y5s9f`Z)>B
z^s@!e0DY+*sV4Gq9K{<z8ql+8khOr8WFXcIO7DD>B59y-9{Ya-x>u8hI6g9p0e?T8
zBiO8$wPFa)(-D=6C21W(#Vlvbopq6EJ_$(VKF5~ge3v77fbg|{?nCJ|Fx@DJ6*x93
z$x5+8$2d;4wd+?C_`*J>Tw4RPgL}D$w?kkskb8x1WL&K(^{BBSGSw&eZg_ks6?L>m
zSzNa~u`0!lM`X5fPfH|D5Wq4pG@6zTE@hi6@?Q8X4<UZ;`sHx!wc$83u+EArmS}U!
zHy>`VVWo-1c~o*CP|9+<qg-n>{ZNs!VXnJuKKKovOXF70Y6p~jjzPZwFs2tC@&c5i
z3kPLGUl%-s{nw$f=iJjZtg|ei`;HM1aj&&0Z5sf@AVa_m8n;v%M5wMUC9@r;kPh6o
z_V&oi8W+H}%`X?^tJ$C#L7%TadG#uIHEp%*|0Lr(Y`I$uKQktm0HS0Sikw^3m27Qi
zdnxk~7Zy---`gRKf`uqxE18!8+P(+`MIfiXmx?ba5o6GrfNnm(w1It&O^$hFl;a2A
ze^@QbOb7#x)}z2a=brabIL~4b_D>SfNNf5=M<@$j#P$!BQK=#3fiV#jDCTpOK%;Q)
z5|w<G()AA>w=!p}1NKv$z@St~vs`W&phGbr&VWFazeizl@6<aOH&4jADj{0;06?>)
z*Kap9q^E!gJNUc~Cxc+C;Ev;H6@WYU?xm&%vOqA@2YSh>Mxp4T(%H%<Ytq)yS~5UN
zW1n~{5Lms+4E%BAPdfo#Udd9(ql=ay&!)IGS@m37L)Ug?+>EJkO>wT3YGC`ZFL5*L
z;4FZ2BS4VBO^-3kiwcVXuqZW7z=IAn1Aqj(AUS3-d*o)}yJjRO+kKt~n6wIj&8^%l
zRoJA%i=dzuc+5ET)X7>BXs@iQN<}5?driL#Mzc=~pyds$dG{N(TGIsroh~*%2qO&`
zFtO2BT83QQTD6I+Hul?w_ZS6U1fMD+W3mK=(vp;J$8zZrS-}bz#z&xS(b6KE;MJ@d
zvc>49Acm!DHT;+3_;c&3TNq5|%~Xe;M&V(DIDrJSw^nZkByl}EAS!$r*UgO$AI0IP
zb1&n4e9oU&-wQ_0kd3w`tz^vIYVIB&i2;s7$Z*T2FX<>kH|b0zn+T$VSLq})gWiCj
z+_iJh-bCIak9qlJ+?ls?6D4S~2GG%MB+Nv(jXb@EUeZtGyCuy#aqNtc&b?)PJC0=y
zJJeBWl}v{<1`IAQiAq>E?%z${JiLj7nhCzwIXT3hu#2gDR2y5!=zz`{6lRHy<8Wvp
z2=Y2IV<kGqaf~!73#W(3;VYDhRgc<({v!Ca5I{h~%aX|q?mHb$t%py}jn2<OWWAYl
z#TbcO09v99IpgD5F-|d7{wh1XRm>_fCn^One^#k;o6Hf6nkV%`sSO^WKG;hzLo_WW
zGk%r3%v+yxd^c->bU-`kuLPkpS_9Ow#X6~akWoEtqp`k=RxFReP_u&NL)p4wYXE}y
zE{$J-?ash6sG>)Ir=XkJo`tCzK68+k7-(4xFLN#&8*@@01N55F-d{M9YKF-oWML1m
zCR&j}4|+NX=ET@huF<Wih6c}(H%6rk=Jh#_(>tt<R&>Ncc%QO8uWMdpRMhO)iY~i4
zGUOg(#9FeHMswG>3F6ha4?d@Do)Ld|;W$k(2L0p1sfWzlUig4}wLfDGK8H>pBNrd`
zcBIMCg_&-SOmnL)hZ4jFU7t!UI6O4ctibUN+d;V{<T&$KL`JVNbo0h)_RL0qKo)6m
zVar7eU$)X0T<`VwFWbmhaoBVoXrbxp=n&f*!jlLDTti^YFuGzt+nuxxJc%)V0jTV@
z4O1{T$JBs9oka$~TKd(@xqIl~O*lCOFw`rab-hU2Frp7{-9>QXYN}i=Wy~MP7Dwv(
z2IxF17$$&sH8e`KKLVn<o;fyM=>_v1fdh<<`a;N4=*PXV)iaC9TEB1yJA+`QHs(=V
zrC^APcvO@aK({i;Rh!0&5*qy;@@X@0yIIHQ0h8}{x8q2hjQyJp;9mznU9gbs9PSZ1
zxbw>GU7Ih*(J^(<ID-CzHsb9M{*&WrUhU=e-?)nR&UoV7{rFxPqg3=)0&^a@zplp@
z*h_ceQ&(`z7_>PKUtC1i@;bofQYzmS!h@GA2B=4t$ZMVd5oom=*(oKjnkhivVOvGn
z0^{d7cGG+K@Xmq_$|~2c!O3Rty6vAjo+X1H_dQNeuRWvUDcj;Q7sEJKayn$jrJR(k
z)x7wFN8H<cqDPM4RKAIvG5Eo%W7T6d;S{?H==%)WvX*&VhVBy8MCc<cn93RxsfFNx
z!H4fP002M$Nkl<ZF#@WF(VyH)-HH=MlT@ndV2cz2)YUy#6)nM@S%A$-Wk1&05WK=*
zN3+Q`0sLAup`i;N1Bhf`LMgU_;E7vsbdm_+mJG8HT(tKO^vZel$mq$Dk2f*DzO;>(
z2zI!Jb3+GiAu_BF8-F!{qX!9;UWdJ1guXZUe1txtGh(k;*>D28zrL|4wNTaTG0rOa
z#Y|gs+6{nKy}5?%JlRv8-wokp6~I*9sIM`Z-uA6Wu1{7JD5Pr1T5Q%5f+MVoaS5mW
z74ZS=GWF3G9Fb)kD$+hGnC5~Gq?}xzy@^gD`|Mw7I%o|5)pLAg-)6x%I?;-etED*o
z%drbO*ixpE`EP~Jl$G-_o0ieX4K-B+)~$*xGXse83g~-~*?0HN_4V?g3BL7Ab$+YO
zs6#xPdWK_%?D7$|1I5l9$Klx2-<=-yb)v&gV@KiGhEL6de$=Ll(Em#aFtfssTb~#-
zc!}+6y5ak7U)Dwt=z0Lb69BpE(7~lCw_>p^_St*eju@*sUh}ezZ@%C}&(#s3PCbw0
zi+1n=@sn#!52Ko^PX49neJiQbwv27OSE7&V6!V9cur_<L2D`MOxsfq#hMztO9y*SV
zUWDyg2iR_KZWW-j!T&lu$I<(S;PbuD2coLp&T*>n%o1dT9B%6AOpl+VuW*AYX^S<n
z5d32T8&utIl(o1BhsRRvh<uz!Ruzj<_vmv5>q=85!suXb!!91ircej7-Rsdct*~|b
z-raQJ{_WI>{bk@^BUMC}2<oHX8NgJI-fi_-Hc<(^$&Bb{Y+KxmgH&BjOV4V+2Cm=f
zYKiRh*jhTncO85Z2r^yNIZ>Zm#n|oHN~ON-wdkK~(rJ=d&Rw~Z9)NE==XdHMs(jh}
zIV<mSa31ZK2e^&fGj#Mp_!AQvd~+Ik>sAIA2p&Fl<!owYJ2Kp(k#J^Jxdn6U#Eeq6
zttdnraC?bIV1gact7~qsyDhDUzShALD*%NJVtT3$&cYDC(V^tF00zEJ(FQBCSh3=9
zS6dpq_&gN?5DSEhEkWtX1-1gf79V9^<}+stnadt<hPAZo33}hd9^@)?KZ#Bw1{al)
zc@1vP881j6L+%evus+sBaEkn445#Pm^WUT^tdpkz<dgK<Kxy?!?ei(dc6^44VqlXd
zxy*-mFCSS=P}CGv445azAx7Ncj9$|(Uc2qeGR8*SNn5qPiNIQP2CHGa1iG-P#|r1A
z&8*Ey0=3-c1yYM(r$O`|w~Z(S3vmma{;5&6z@ADS=o#v7z1ke;7-Ft@@TQnY+sY{Q
zfq{s@E(D{px<L(VMdw`5Qjo=5d!wycu&V8}%G7ek+vLJacdn&ttqp06{w=@;m`9NF
z3LM|NNsimPu`*r3p6nxiHUbRj{UV%(-SFL;5AKopb1U^S7qN{UZL~^}fsh6>SQU)n
zjl(fghR@J<F->A?V>{3x#^Xu-XnI5<rWIlgVswC&;n}LlexLoFyV&a=z5d$qfyNBx
zG4Q_vTi5$P0@pYPuF;MS?Oe=%MqqX^2_OVcxQ*C)blXMkO~@%K?b5bkWZ>}VbNDDh
zdf55~0QPltr8C(7*9k!BVO!5hZZzeb&@pYFcR4&OIBwV`G?Wi)>l&ORn@Y=Z$g`CM
zNnQ<|t$}U1wN62IYbxn1O(p2cTPmy3CoiS^0c2OKDdvknkTL8T<?tl}r5gLeB<bT2
z6~0XLC|_5G^L}N_StI~}CruE5I6h1TJ($R9`fjC(N$9^FOirD+ADXfXwChtHJlp1n
z1Plnaj%wAb&|6zO>Pg^x6k|HUJX=9*MLSqwRaL5}tqGjIiT7@CWHQ$P$#p#=<Ef0T
zl*iHG+#;hFo$(tSSyvt*v*hd80*p$mMKO@Y$Qa+xqmTV0vfh30kYGE4IpG2FgAsJ5
zh2R0DIHU9nSY1mDMm*82euuDSwUMn-B}VJIxelgs#sESRzJ_5)&fOG!m!C>3`S7L@
zbPFA-^WYyd1Z|EmK5X3b5*uLjgAeeFpr<V8BjW?=0`Y*)N+bQq@F(D69it?IH4(@)
zGMeE9(14Y#)cwlfr>oF$o{(^Sui;T@W)9^=FD3@lf{rDr>S+~~1b0P%d0}f4V5vH8
zrmxtB*AKh#=AnF-@8|TtNSa}Mbp~5eL_VvW?ZpY&iyhbk&ng68?P1LM8cq*x22))Q
z->6<+7QD_x#D}dUS7TpU5p4>`@Nzz@0qfs{KDG*)F39VOrYxq9%6+#8e$dnuTaMoA
zV!JDBG40GD{X+y4j`Lof4y8XZ7kRB)?&?%jcT`jJuM-i$HGHn~Q|vZ$e)_0QtllsJ
zJq{Cyv;iz;1Utpb$~{zgzYI?KHOY$I@T^HLCI1f}iZlTK8w^Z)j4CG6X@xzfO>SK*
zlV{3e{n|vwGUKe=kJl62&x&uO1g(_d^B8shpq)07j_!j^KZhr4vrKD5)0e=Cc<EZG
zXWTYckr)Wiw2F;>4Y6@6#Fe6hN+&JoM^=;oUgWp_`8Lmqci;ZVlj7Vsogev36Xtkp
zUTpt;kwBU2=>0?V)5@Ld>Z{Rj-bW8pM_P)^wSr~=x|2yRZih3_(~qy`db-};7;D0j
z=z-3cqhlICQVL&n8`l}I(%}ExGvj;Apmu-*$YFD}V4UZ<g_M0acfK?^3Z~yPHH;G(
zM>0!GA6+rmpc66I*;V|#7i7)y+ai2aCU+EKU$r(iM=+OuI)hnT!GWLB)(Mi14E~ee
z0=q++s^>g~PxWK>xl2JlJZ2wwg?L2RF5DxtxU#W~`*C9vX05QQ&qvHho46G|Y9Q<k
zk>3;Td1(`R(%!8*0`pnS7*0|Bt%&xywqQAdYw3@4EvnNDf}3@Z^{3_ms?^i9$0T&H
z&|(53$bipc@T1?^DEQI055MGKOl&d36JzciSmCb;JJm{hE$Dg^1V|Snd#xT*yOrb#
z^!PO^S4HL75%dq|C$9E#?tJ&^5wGTehB%L#sV|ryt9&gasJFX=Bte3?#0K@{EF36c
z>%H+vu0FhDci6cm${XNZz;8=etfCz&!|uCq9Xf5I!UuY*^wNdSSpe3xvXp={Xf_`{
z;30iy%@XHAw}yXgAxWxs+tyS{Aa4&9`A&WLCBEYaVY9gA^*y`&j#Zt<gWjNbXnrN>
z(L>mLOY9INmyMn`@ZpgSsJuXbsyMN`e4KMk;h_W2SuuFXJowYL8iE$V%MC<bz#LDb
zSFWdTYrx<P_%|T)8|0Gy9qrx@=+q$Bsx38fZ!x8~^W3fHrXg#_TmHtWwB6?z7nr%W
z#X80n=ESzz$X=4u2hexaf18m}c`KKs@(mlXxv+(>rL3+T-JH9Q>)2_A664ux`<bW3
z8g}sK=)g96qBz(&s^GfySwGcx)jzb0UUV-=+wl1ql)4<9VkvV!p#IOb<nJCKw|MsY
zaZj(GG2)<uSzfz_!;Z#QSWW?iwfO%R^4Y_Vw)E9Cb_YQRF(7&&{(@=zKXsLLY2k9P
zH|9av?fuB<iz=Q5AkCmVJwOgNKW$Hg;z`IEG1aZC;oWsxux;=|pkH<n50Gb+bW8^A
za-hEBc%9#QmJ2cDH@v^Sqcfcu0gr|Ttj;&7FM;b#@Hj#+nZdow7A=m%kO9^xPOHFj
z$I$tEXq&ZaiYBJ;*-?zd;pSm0xCQOXnr0uryJa@!?MJqv-v0f+e)EnaAQ21RNhi-S
z(gpzB`Y|r1G=!NN6&y=N_2ZnF);NTya|^)G=6O_Dm=$1RL0L||0m2rL9_H7R0MS!`
zE15t<p~b*fNLi_40l!<Y7y(Z9!vw~?<@c}NV~Yxy=)?jRAoqO^1DuCoQAsZVlrAP)
zUC^eRh1msxKf?f;DPG7msdR%d?8IRru(`CfgtDZ7ko?ZFY66n^7`XWWcC#ouurUHj
z2Ge<%Of$wEW&nF+7I07R#dt6lL8^0vN;6`AQY-efwl+tEv4YRQifQ`p_55A@EdIRX
z;D6U?{63s9^wY&DfE%T#U=F$KyMS~O*-im3C(mr&`4}YwIJvs}ddcWPQ79&}4`d-6
zX(MF6z=Rf{G%<s*kTqT`IrXT%J~C|A0OW4jRu+5O7c$T53C1ZV!&FDWVw5Zww4)d8
zpzSKQlQ<+S*=^O1Y3@%bGzOgDcQ56t0gSh9LBJM7m6K3Z=KB0fvC6LYCKK>|Fmr^y
z*%~TLD`3PbC52=QS(0{USy7rOgc-vWOHl~jLZb+$$?8?BP`s^_!&SWen-`yJ!`q%R
zLBfv^atm-o&x85Tvekk?ByM*>XHveji$)j0BN$Us_7st~`DCLn1JrY$%U+`KyI4=X
z3Jywsaz>Ov?gCu2Ja&0)b!^ABkhZ$_u=|z1>k-|eEso<PziYzCX@~x0$|^NhUg&Oo
z2+%<3N#47)Q)@dB=?GL{4(N(~Vli~xD{>Kvh~uksWVcRf99=57t8kDMGoF6u{-E<&
zN3LI6DY#(C)mZ=hW{h?F6ajkkAqF$s2E5=i0b#342?k}#G(VJHS@Y(7%s{}i(2Uh`
z;&Z-ss&dmMAnNC?huoT&$2HMb(hTd4)gRf>`9;)<nMNU)1K0!x<TW}d1Qe|v<eu=Q
zE7k;fsscHLk*yQJpuDls(TLU`MWK@BGKVe=d50q>Kz(+F#ww-n!6OBgs9-Y#O@u>)
zwuFN0<i!z`_L4+h&-3An`G$=HbQwW!z|JhM^OzH%N`rp_tjb38)nMf=8P6|o@U2gC
zZ{(*cKudA<TdAs_5_H|H)d2uvB1f2C%b1T7D95@+*<Vq<KIqI~6r*;R0%j~`O}qfi
zHhZ-bMe+rE6}ykKTY9+Nho!}fj(*5Jis_2(Cz>jc)Om%R7=`D%wT&en-3nnCAj80y
zNqCBtNzB%8EF+7Cv31+NcB1N+qm-7Ql<nBPo7YR@x(1b*fdM7Kr=UrAgkUa-C^25M
zD7mv{L`k^Na_mLR5b3OoeM7mwph_s)w$b6^k8L$GzlTaWjzd0%Izj{mh{$8Wg~(Ds
zSu;}GIbpKl)hO-uHCp!eKQR{4jQ8W@#qi~2WYmrT0(U{H{qXNRc+4!0l@Sy$*OV1B
zHj`m1t@#j8Dr9UOV}oDJ{^?@Qp0l3viOet*(kfDx-qz{sTq_r8ExH<IAz26W>7x~Y
zI(wf)cI^x@V;+5Z#(e0I>8Ia|S?4Oi_EWlEg<Nnuu1*4MI%v~4w3N@*F772QsMOB2
z%wUtA!}(1AqMw|XjY|yhTL;H;qK};K*c1^gxQy|!1mp|=ua20-Woy$A9Wi^fbP>T=
z(B5)*logEx)?CQp{N(%Wp7PhZ_Rw}^nr+G*u6u48`ny$63?R}7R-b6b*=Yu;+t<th
zemn)B`TX3O^f_R?^r@0RpEk~eHkJV{nYrOST1iJ8r2s(JAXgRjCdPD#^|o*^<<>){
za!+n;Thvt?L$`DgaIym1a}0hBJvb8%S=I;h7?lq=Pbc>*{3SZ*Mc(nSulC$W9=uo@
z$fKlkI7#_VUB>U6zc|m&;+6P4WxdfQo+8)WCZnpVD*d~^_=|MC{yrJjRAfQ6b>pyl
z3J+ic0-&}Gr@WfG@$m4f-+#n?=T0$uya!Oi{j+!0Y)(J>)h|-ngE|~_Eo_z772Am3
zC-6ciguu7!7Ig^Yi4y$C#0ebUtKk_H8_7t)d8+Za9H7JO7X(G<CeDR`^>c2lGiE;g
zHlNS(F>sV)R`oK=Nj*RST3u%beNnwjIx{fVKti{#D}+YeMsF>plMgPZ8iDMAF<k-=
zD&V(np}G`ZMQ26kbhe}4KQ_5<9lD@Ze&L+BXLbH8!9D0i`9%vtM=`@$Jy+Q}gKQMV
zQA5!|>Ux1>q0{2vl@mCw)th?>RJ7XMEMqXnLTN=Gw-U#?Wvn%LtA^+gIbODR?nef%
z<Z*4mkbDAHX3?QW0WWn1=QGyxkSQ;U_?{c7QEQV(-wQZD_!cy@kcOA6ChKwE-U!&3
zX8a8lEnr@X;15=QFxc@0bg8^luTW=Muz;*L-UrC(d@=v?aQ@FMg>M3CScyfMC{GAr
zhIQ}Or-B0Q(ign`1#3Tl-r_LUFJh<Mz{U}r)nV$EdUhmi0BFHLkS@m5KvJD!^SHlx
z&g}rMeHg|%ckP$F&2eG~Vs*q&%?;e^yh&d8|H{E-gZtPJXi4tuog&C|u5Ap7B$qXm
zr;u%&WT0UaGQJ=FIL-Ly!~Z7fdnZ94219sVgSxF?U;qFJZpdA2CY?PD4D=~K&A`&!
zed7LcKR$;J%}BNSWhWWTj`xw{@1+%G>(ecCTPsWsA-kHJ+2RYiqpp<CHBqH$vmNki
z9?^sB<r{xP&P2~Mp68j)qe&TNi>sp;JT%Vx`FyUvqC?6`B39**{$}~kz09p3Aio(W
zV0AU%c-{7`;o!G&Mj<p`2#wFzamF~Q^XC(kFb`UDyICtlnK8P%iYj)1^h@g(Gj=m<
z6Ic;Cs{F4L9p4}rE*AaETKq<b{@~lp&aj{IgFfWD`>h)wnTL%si_-KMTTa=vjd?VH
zcQHU|f<IWPatZpCTi;p9&>-qP=&L4GOfjX4X>SqwV<CEyAp1hsIyX}8N<i{S*Y&#|
zt`RHvEJEfO2xOZ^S*J7HL%n`<Y$~eRRF2k#9qg3_C{=KBHty?dCtlCdgzfm&8ncD8
zQ+=u!zU&A)ryEJuDJWTvGlup9yqZ~D2>)ILzm<pP^ga{;ufQWZ%k$e0&xm`|76bGG
z?8DX+jGbNx-P3+Cm3i7V^mQHx;5<@5r*KAv?57<In1>~c(NSpcGcvE+dmo3hbQ<S@
zzn>UodmniCZt#HB>(>)V0*`eL=%nlD9h&*F1JapoRv*wdlHav-v}5B_!GX1*jF~06
zycg%+FyQ?%^sunMU5M~U>Bg#e257kjnc2ey=xOrQVPy0=c=1xkbrF49fo|#SP4T$^
zcs?>|KG;tl>tq@`N;;e6IUl;4M|lD$Dke_VUKy<pFbqKaj5Vlp%B*EE4}({p5}Z~*
zC)OfE))NR&;yp>kY9nA^fZ#W6>BX#3@r4l*jXGG%R#KkjUY1d}8bb@!n)-1@lo3pz
zUaanfxQa2g3P2w7XEr=vL}l4~^^ZvKpfUtt><e^0gWk=ybPD9RGpr-&HpUj(-d0<e
zQZ<?4I1pMH;~P{MXl`qZD$>)~>Gm&HkQev?M~=H8<)SZntYPVk2|?$9*8%9By?P-6
zPuzBE%JD`pO|#D2>O;rCLg;fLI*i*htN^UvTE`X&wVTm{#Ow*$WvrFIu32#dn;6ak
z#@;PNUBi`BV>ojBcv@Cg8cAwy31T&rmS%z+;DZIsl`=SV9PSzO&o#sTC2?a4ns6)V
z`S8>HJVK$t3dL2lOQ+$-&Y|nct!%Aaq^{<CjDt_KceS&1%k^-wJqMe70c}pALudoK
zAPmk?2i86`9L19CdEDFJEypdc?e!gZo?R5amd`CgN3trY7^+o5dJJ|!@Ao$b5`B5)
zB2{fKhW@Nfacm)8FGO3RamIWeHncSVoG~XVE$n`or-=eO@}!ZBf6lE)`si<2C9Da@
zCgbg1)d9>Tx^L7?L`kWrOQqDPG|t+1jGg&}pod5-TtZtXsBXkIi(S}sJ7;zVjy2yk
zICmv^mPvdA$cMlf!3$>L^)Ik%2EhxgGHd|6+dnvmp;pjlv6v2mR9s`_R7d!XfJhVJ
z9yC#%3LawhY-wE{GX>v^03?2=?8xZWQTFhR?>>}e`a42qV5=^H{$7A1JjNE)X*Y%5
zUVu)l&0_VtZmPApJ%c!gTahx^v1T!H$+pkNTpij(9oO*vmIea)htqTHYPa}!As@0i
zZ*S6fHq_H&{W3ppPrZVK7ZZsTT2?G}yYz7}O#%d#;Fw&xVkx9H8^MxpwI#_o8qS4P
zF%1NE`zWh0%?Ag_gLd4S&8=OmJhhN{4Ibrv{UP+NoyrOdjLF29S^Es8md9fjo~mwc
z;6$#{hM0R1ym>hfotCccjg=((AXg@#yL{GuDS<pzY$&EbOVGpBi<DLTG}hld<d~S2
zw$udvgu9LK#by$!2ripiWB`I#8EcvItpek-ebioXi-dOcN@+|TB@aAAy|aTkbZZaC
zMHyo|4S29mQ^*Ln@P!}(=Wz@2Yb3n1A}1&L*s3B{^Rn`uYr`!@Y^zmh^?8Kzj%zAQ
zU8}*5Jb@!O?dpjcjpnh{P<Pl%J4)GF_r2q6!BUd0;=t^Nwx2RTP3Wk7;EV;zbM7g>
zvfWmrHTYyHYsM{F7L}|D`hO1HS@p|pX57kKT|>ObgjhFJ%^g{bvNq*D`>yBEeQ5YN
zI%+rcZ!l<WRaN?vKmF5GaqkY*usXm133}zbwzlRhF%o{_^{sldN}L#ag%gof2Jhd#
zGgUIi3|#1ECD^*!vMZ4N%79oL+|O-rtnQ@)TE5uAJ@S#U1<-*y^^N+6={63{Y50tM
znp=i`9AiA!xp0Ki67?5pN}lSy<TV+Wn_CmKRk{%ehEaw6Yx1*tffe2FHP(}miSrt{
zCx-WeM;89?-S`dv=b>9`ALcvp(2lZAJA01fzFO}7#Di;#6VP<l5PAmuFq0wbE>_Pg
z1haytK`3E^GhW)6kYFUKThU?{I`~d}FBK#~FVQx}E;fL79f6SD*q=|JAp?f9WCS`G
z3?%OUhyQST3?uE0U@)Ggp*}DXw_|*P{xZ#40AxU$zc5)!+f+>DFg#NI%{8?E+7!RF
z!krZ*l;It;XG#nodUOqlRW>v?rTq7Q1aClJcl=^#GWxNRuH_iV5DIf^h=%2c@mn3S
zi|82gU*{l?2svU-gFeJ;y=PqWjUT!G1Dj^d?PD)`T2u;@55V(ApqZQS@muhn0`$-<
zsFqeibOu;BiR$3tai?#2=$$eJ^#ke7M~pq4lNE>=8@R2_AfD>B$?Hnjrv(Hm=npl>
z#_#1}%9&!;@d9i?b&2^rj}my$OCZ}Q0T*r`{AYju=Oppp2d^b~%>Z(I6kP<@%rF-;
zcy1zJjh)@M9q)QL^x`1~)QB-ZL5>IirmFiSI$kHAJq7D_JJ;Aoihj{Z+7Dk22Kf4&
zym9W~Y<uvY1_geALcVMnTkEm@)x)j&s*N%s#siI5ph0<R1w6M$lx`e92||0>gnG9E
z8bOXdYG<2L){j-^U0c0i+W+_Oe~TW?oG{LTEipdY;eq)_Gw@Sz@6S%0Oe+W)dkQVw
zy~?g9S1*&;#WbR4i1+Jdh;HycUs>i`<o~>BbYt#iw{y!a+g*Ya;&{ao98>wV$?MAD
zX=xUlW}IOWTQ~4-KDyl^_@a7|<Kd1iCW4M2$67l(piOpM0Hc~_k&79(^ns)H_oP+G
zT<@riat*z1&(1aE+fUIQ+UC@7_*=EvMPM|A$Y<B{b9@^0tzahTG1J^rzB>TE{r9JT
zj}Ap|8B-Gk+}T9E$aU+ydM%Gw$2@zF+-LF14<txF3|!oKC+XMiB;5wDdebI$I3Q8Z
zwy;LE^$f(;zv#A}j(zU1`7sxK=5qI|+{1Gm$Cu>CH;zv+`j0l5IE;x%y<jEJ>BkIf
zkTg=(Qh#jWRZ7f&HbPt&-PAEz%-D!Cs6&bs?<?MiE<sPZjsEvV=q~QI6Ed0W>0gS&
zhT5>#4(G_n>sW`U#X)D(QD0yuSb6+8yD_Z854m~sW_Czf8e^{fT#AgfnyG1<1=w8v
zUaTw<`k>QU=tLfw2dy}NArm<#H%7VV?502bukz_%kAKMs%*}Le!h?8uGY<l5gV~)q
zcP8B;s$B3|5|Y4-IkRNsFh=SW%1h?@M1g=tEvYUe60~_nAb}1(VjjuvMS*~UnYkFH
zp5j^(o@QS5+sH_!0Y)Ke^o(%*$nf#HD%^9NO|T`a0D*D<(OVwXNKdn^r6|ERUyl$q
ztP`q`w&d$j&BQ#!$n{VlWT$>)Fu(vA$~~hPm#nA&5)iT(<B*BLprlYG5{G|hxQEQ!
zs6LGkGaLNOCT3@OrUy5VN4$B*KQJ#Y@;U>RX$w%p1GyU4R2Xny&vCqik;!Cu??SeB
zM!-7eRt~XjvWpQO7o{mxW}nk`6;LzK{JoBVVif!BJ8Rin_i&UxE=1winXTgmF%baq
z1csU=t-PHbw!c1992~nb+NDwVoOUTVWnSSV1n`h9=D|>dSa=<VQ;bih8t24R3>4qX
zD7=xMdj$B%Jp^Y}epG5o0d|XtR@?@2vGig9-27}2%B|)2N66?FPLS5J2)>*l#Pzsr
z^dqkR{eM&xW>GxMo(&@MbbjyL#GLTG%Cbf+w~sd4-uVb7?npZrN9IPS-z-ipfh+}>
zjw3S{=V4U%usv4HaIRPxT*<5X_``>zq?5`lq6QR^?d3QTVa|0`n?i_|6Ew4u_x&hN
zmMk`MUq<cq6)ZZVHGb9-gmY*wfi)PKf>;81_Hr4HlMxKVG5R9?31kRXdJUZ)@!&H{
zbeqj;6&6R|a^03lb!0*ib3NN??-ZQKJ!dF;fNc3H&f|N>&LbO(_#pR(xnPjEuRVyf
zc%R4GHghZjWBA-)f&h4+S^0(ATInd;T2>vI0yP!Y1WgQ3?vyNBKvqliKWu7@Ko1o*
z`<Ody)4Lv?8m9}IVvIyoy8MpIz5I?>j9~PYo@D3GJ$qNzvW}%NBIeq`+n^0U%i80a
zQsAp~l8x@G>v6(c52xSpF*`|mRpHj5q`_qHl@CD*=h3W&<%~%v4P4QF#BUkfQH=C4
ze(RX2?9RZG`5V_VQaKb-eqcXsyVuYNat-o9)>ppQ(6wsBb6!s}sXh!Y(&$zONe9Ik
zDDH86aL<0W2HPB&r-KB7PS6GeAvEMCq2o*mfpX=Y-jn+TEwH}$k3$^Jz~`aNao_mI
za|GAK%y2`;8yeyw+@JA*wnlkByO?Tf^ixNzK|uxqLAB98F3In_ZZ@}$)At>Yg-7sn
zUduC_4}*`CgI4Ge+>?)rV+cSQgk<)oL4E#n_5}x3gar;q`Q9Kvvv}swM(NlRwv(*M
z04DgH!C;>KH5pXMa)U0%2w)heKk_R7DLDn7bRY)5rhPfSEVGIV2CTWspc{As=bI%a
za4h&Z1`uZTEayMQKKh!qm{aMrl>7D(di4$CNqbdD;r`f|WS0Xvym#O*8JEZ%=)*1*
za=jwvTi!3=CauL<nR||V`iFLywKa<|!DXXux$kVx99hOS!vV?~uws!JzgD4vB0>)d
z6iA-VeP4*m&&~aO*3bgz)~)HBi&1{(mH>px#W+fH<ACjMGnR)k;jqw!?9P74J=CXk
zNGlHvxD4u&KI7lqXTJBg_CZ;MY{^!c*ZBS;n)=!)Tx#y8;Zg|0$ob7(iCe@GzoWr|
z9wV%UJ53D%);|X%C?TNr)1xOsJ{Y)cAg9iRyUmR_-6+NFV87#`B*@)6Muwl-SF07A
zy>S)Qhf={CD%kdNC);@JMOPWis)gJl%Z1?1P7GW|k9EooVLX);mFW<b7~Ga?1GF;+
zzZgcpu?+PJDx~BKZgVcA4_)vAFu^q}4_4Rk%WSPWH_Qho`aVZLu3y)dJ<Oz-`YjG9
zjHM&{4uw7zMjqF(GSVV=$_TpEGalq5KpoPsRP4RJ`|#Si5sb6=lRMkdVn~byj$m}1
z_fyIoe!(}{gLN1IpYRS3!DF44GQml*_RQ`w<1zwq0HV}&#t7=N5}ULbSEA3-N(2N+
zxN}ElMDpESBVV;^u8n-2`z&}Jyi{kb*NMPHzKx1Pyw_-rai43amo$K=z@R`DN-+SY
zTNs%AX!RafhdgEx!A$b1XYfu}g28qMf7@I2Gbh)!OFK4{x2!Gi$0OF7bL?8=H@w#&
zVV14B?Korbob_c8v;0km+<XRGZYEDu_9-WnAM(n`hNrD&LyyrWZ4-4-ZpbtISQ*8$
zK_=?7d=vfPB5^(5zMN}c|Ccyoje8*n^tI#V=X0Ogt2a)0?d<I5&ZT`;zZ*u6b;J#}
zR_@AkLmzY=xfYWKf68nP=fdB5l?Z;-FmNK~K9!ew1PIJI1|r9|T%!la+*O<aE2%)J
zep|6&L)uhX8RfbA&}(nqy+frTDrk1M(Jpj9__p)zzdv+%TjyRfnQKD)%HO)qX>G=f
zoh9a3N4tHr!mE0GY<;O6M8L3B?dmpGrQ-(=rP{hWFn$8|utnUi24NiA`aLJ`Qn~Ck
z?4NSeijjTT&Mg2ggXr4jR6?-&h`~v2L1_i2YgBJ(L5H1S>>XR_%_G<5c=L{bg7&$}
zH1noSKL(8}w?oEr*%{>1B>hnq=_u3QaqWh#0nHY0?<F`74({C(rQCJUYJ(J@M-=1m
zRSz2^z*b!)qjttuUdlDX;qG9+<;eQOd8{9GMT6(^u;s-F#`&H0t$2j%%Jm#U*{sdT
zbmsdk;FaGysb0)E^fgD&B<HwJU9*0dYl$EEn+P`L*~F7|IE{`hT}(9(=8JL9>_GxD
z0l+5FGjvuJK;PmWIReVju^+`<=WdYu+_x|9$qVlp_w@(#S$^Q}<c~V0<3azdT8Y<(
zF9|Z{JehtLutc&DK{R3_p|^8&9Rl9Nig**uiRXuG;$B`o`<vZoj*R&H4;-ABjh1|m
zdq6wdv#tXSeCApmKC^MfYQzidOXe`colASQ(^s!rnfAlOwKL7=R$p}+rNuZrwA*zg
z!88~Et}C6`W$&zPwo|sA!SwwU0g$tdi2%Ff>zsLCGXdQ`b_|Endce|R!0ZD0-i4EY
znxuf5(lV-D5~z<|tTU+f|KaY<zpJ{k1kEF%0U-fG2nmD$NzC(Pu$etO9O;P2$jr#f
z%B;@SUDdr-|ImL={o1{{S5;T88gkBxNT<^_w!vWLdD1K-1_=a0BS`f3?eiWGws8>I
zooiL~mEL>z-FNR9_St)%J)M0>+wUA`V5&NY_;rs}f=JuZPlJQC`ApM(ZATO6x(3Mv
zZi9z5D_}|^982+1-QXU9nSErxkw=QRS%!o+in~0-r8sgnD#jamdZ7+?`X;?B$H~^V
zWGUN(v2g4mL8Izqj=h!r)`xTe7Kry0;aCJ8rmRQE>H{p2c<_WQ9*!&5tS4k;8tE{I
zZ#stM1=7eSf@@qAY`<bL1kaSwcZ(k)Xk(f=ei|4#6HG9cIvzefb~H`F3s<s*w;7AJ
ztlJQ)sU4TI1V|sh$kt6bDeNE32!13Esq=^2K|}n`&jBAHZ}5+Qu{a6%2hSGIMF@_V
zVQExkk;8$cU2Ky1+kT3#j$vd#pj3IBWoqM7hU5hL^BNC9cT#|VMcG2I1YZOu@_ykn
zL7@5wy6-4sIWaqzX?7iuBHE*F5V{!UQc%Flg+MxV#R*tx*jG$jA9g3(!C1(P88-Tt
z>5xZr7x_&YNEqa1YDXzT$tt-q%J3}XrU4ehV+0&vW(s-HEuihETX~K{BkF%lr1XgZ
z9&}6_s(nDakTyPPL_JvAdkmZm{P!7ot9C_Nlj)LY%nE$9yEA?A^^vr516zYOElc}%
z>|q=EH$rD?@9Bzd#gCI|W|(=$En4YljAitTvVPOyxQFdTWG%pT49D*T^!fx`%mFdX
z8}J>siZVc0FhwAiKo97m;Ze7+7JXbyXCOy6fzhM%XbRn63cR7a)WO5HvjAI5c$LF)
z9YLS8k1lc)UUg(6+qhw4YFg8ZUJD-s{ANZnz}4-99>B}Q*HAZsdk})O3O=c$nq}!J
zL31IK%n(!}<w-=eIpz+Yaix81qY>@41-!T}?L2{}%|Ne`4*&cD<l$k?8!k98TZkFH
z<h#v`Uo{zb$#p}Pc_@tg%sOBOvHRH7v?*A61Y-hZZSPb7KY<U@F1Lf~y+_vg8FV0I
zYqa6On~<O5yg2I0*XZE1cZ4!sbmE`PVG5d&XWP#T+TeEB)>oYCrWs@B1MUvlriZKo
zX4jphgUVd?+j;CMeYVFg;0t&FvS@q$#yz&pm->XXB^CMSIC8Ue&7ioQ-4{4-A%wKK
zb#+?Z(v~(7OgIWJFfiIJia$Sjoa~uw)g|une8@MHXW*`jBKK_H6<feZ+bEmba6BUa
z!aFCJ%WbD~izqGvz+DP+h^5ht{1NBHx2&J>B=z{1dfurUS0W?WC>eFknsR8*p0uCd
zJs?Yp3**kRWyO)p=crTeV4cWCz{d<!)wOITw34k`kio~mEqNB)A%3^~`_M~d0k<u{
zO#7nO<qZa^i>FWEKkDbohtA(LjqU(rMoS$z+w2{rd_=dn-#Jl!u6}Os^^Z6Tfvtt{
zw3N{Kf+xbi!I_7QK|cXj55S=*>Ncn(<_ijTzLxK4%kdEJ<!4j8{FGMhM|@Iip|*@W
z@dVF;XR^!hvrT86mZ^kd#G@!neojH^muAZCCXm-`_G_3E-3Ge`T3m*$!l0IO1lZmt
zI3e3-p$A~_ss|u(_zHcnpZU9svd3t{1L~2V$;Y*Hy3ph?dcSuv9P#Pw$B&`+jAJWs
zt7&xwZNt$W?h^@>jl{5W^##T}>bAasnD+?dUvIlGEyA@>4BvyQc#M0Yd+lKIoEat_
z@xt-<JwKaq#Al)Y7)yiV&D5(+*~9?qHZIC@_SB~s>(MBC8V0K#rYz<mjt2@jmdw2+
z$d=*Tp&6F%;k+6W2-VsbUj`z{qi11*SU}MB>pQji$a@R$=J_h*V{JZWs-!moPvf`p
zwnSG6en6jKakgXs?(Ti*E$o|vWJ_#ki`6g5Aa}7FI~ua2xT>tEJdj%*MLla@Zso7P
zJ4QYiujm7^57$PdMPTb9O#7$qZUDL4eLA<fSYO>Heucj|QpKZqCQk_)2KO6`oEJw4
z8)%b44LmN#juHXf*gXx5W?c;>!E>prf>d^HKbdz_D8Pj_8T_Pg$~NoIb-tL!i~u#$
zUg?JV7z^oE3JpH)^?+{18Go&!{d36x>tW_Kw+=JQ-WXYXwC6aN3ZE=H`n)JdJ2W_Q
zUF;H%{d6i7P8nnQV(sD&f7(ABbMfsFesVKSDghZFBrNqAh{xf_<})q>Am=-Su;iE8
zO2kp;Z09Gl=Y{WufV<$K)FtGEdGUDhym-w|+w5HhmKNvQ&dWoVLx%wNF5WEa(iR<y
z1w&TgN&bD-@<W&8)3JzI4;dhIh(d+YDl6mHBJHZ<KY@1=vdflnEotA@9cla4ZDgvM
z8#Lg;CGo8h-<xw__{oG3f0k2(v2Zuw#m_>6;&)|n7f}`m$oj;$2n3_^+5#Wxf8ri#
zUV9Zi01w$E0()^i{V&?yY`Qw5b_02c!Nb}ZN1wtsC^T&0@FC?J{bUA_E5}&3vWBp8
zTwXks*W?Yh%OmK7Pw#aOlUKUS!usVcX+LxRwk_LPuu~OV?zuydy3PXh)3QKN_!+dI
zeIsy<--7ljEBZ{i&u|l53!0!>$1m(T0xvg`lUF~S)Bk^Syo^x(`8p^<<iVF3Lx^M$
zCP7U1{~RQ$JW>vER}3om82Dmp&oB(~s0=QT8{|N75%_`tW}4UHDv+GrgYrSNm|U$=
z>K8+JD86!Py++$-2Npl`g9PZkB9@rscLh`1;|eN?QQ|Md_!hU)9-U1ZuH#vLldM8m
z3v5$7w%sU%lw$<9j4h&ADN}*3n0EVH^g=yMn3SgwZbYgpc_iSX@XDkA^rOfHDM5w6
z6)-9)6*!G;Yc?!o1`v)B`lqrZJ9-SfX?11-0HLT1sIVxGD-H-F=Zt_h<w5OvEVu?_
zW7Y40H}<e?#VS&yjg#KCi->7fG-3#L<?{Az+ak4@&IsFL8yz<fVG;*`eP+Dzg4G~s
zg#nOuDaZ&z+hVQayMK;HHmJuVeD|7TX4?Zr=o9r&uW99EY>uy~(y!mR9xGGas$quT
zXk1KA2K)4}VqgLTf&n=h3+#WcgO67_LP+;19|V9!1F_$2pVxpSf|<8S3w)O*xEhKb
z-vdv<eTCxaSD|KwITc+Md6}(F9owIKUAXBtemKEXpW|sGW|!iG?2Bw0t1)1;EM1mX
zEpCo2qh!GD;d+ZKB}ViI$^lcyaSCIK4BQnM7p`AHu)7x#{2EedTx?mRMd1bpIMdO_
zY9D^eBj{LpV|HAdc3MRs6bYC;qs~iU`O5IOEly<NGN;c5@%UYsW?Zo3!rinnp5#ZX
z@mX;&aFI5}U0f4ad|8gQ0(#%$FDu6>b>Q?JTy-z4ZdyTV_og%iES8d5*0OrZxZrB8
zDWjSh8*7zR3fLX>yvkdKgl%B7qa6FGq1iv%&u@%bQ9-n=9=X498h9kG*-vpQcv<1D
z=d{9;z%HJ)p@l<ye3irU!x&{fJg#9-x(Z=RC?dcJQ4MPvE<!*Im@qct8^22XIx>UC
zXlJozM^6KuK_3Q;SiW$~MnBt4$<gH8N84dP#T0{dd^umJkQU2S_)#$4vtt(yr{!s4
z_z_Y5SHSf_oD0LGB_+)>##)8xOqD_*DhZsCk4k^Ds7D-%@t|RjObAw#ufxiFgsOdz
zcST<*##Iy1u0k8bFd)L(5zFS&VaPRFx91rqKQt!62YHa{1NP2)25vH`g|IE`JOUT^
zG+<J}y*M`(f77VuGZ9d!K#2luABA5CpNwPi+(!Dm_#^)bBN%l$cLopRxy*}z56{^+
z$J%*6R&Y?J=k`5<JHQ*^69yO>EI%qbj{`^fO?V0)+hCW3bCCx8p09bma88|pi$Q>t
z$%7g(G+^8#YtAWFBB&r5&?$^GP#I)5i4u0Dw=)78RS*@Z9Y_0RA^N9`<gYAeRfSFx
z=2~H{4B%mP!S|&P6l{$n9`?tviuqXhOE=tIf>IqF^SQz+f-nL%s1jsTdCS#Xhwb4`
ze~&uFdPbD-a)nb?6m5mPIrAXlmhUZ$S<Iu#BY_DN3C4O)9G>L96fS({BZ}jVE>MRw
zka@8Jb>^R5&4-^sFWejRObjB%3+GsjLPy8go{`nZtvG=iS;1(ajeFg0U9&EnRXQ3T
zbYhS}@r=QZw*7GXa;u)#FZQT}X<$Bwk@6uctyeX-vdX3*(%3dor(2d)?LUaYmB4E<
zi;Uxtw-XvJHmzBoc5K`dD@D7mT@PMANEsS|)-*MzHA|WSZ|<>*?6aEfvp5fKh0+~^
z=-A};`-Cqq$2D=EFXFu4N6GSY_Vj6tD6CA8q=X%1>EJUZb|)+O?hz1HhMbpY;zBuo
zeD7gJxt;!OlLO5tS9%g(bOPp}5%7w(8%U@DGz>%0P;nS~<vty^wp83!eo#h{7slvQ
zxLaOIJH<o%w_i5l*IMGGXcqOyFNIbXu0MyE*M0IiP8I1rfLJWvPUYM9;0ftIV2aTJ
z9pMb=g58%~M^)$v_5$HuC%{cs{M^A9U4}ue7%*vB78h;vgxf=w3#XRyhdd;=U6{EN
zjRBAOvG`=h0eb>23KOlPG1k&ISH0#X?#L9aDG18u9yJz0Z(jwJ{5JD_FK~!A^gXvX
z!$v-5)*g*_@}P0(NPa60+2`Nx$nB1C{hkLiZ~UGgxMY8PdAu+zfj9QgIZ;QfD}5L!
zuGmI+9P^a2DPMEPX}9Ir2A!~WSYBh9@hX%b@(n+Gcc3fR?X!UbuJZc(&pt^#O)YHA
z(#TeP3nPtr-J-g*Z|7@a<T88O@a?{U6_5UtkBkjIP6G?$>^EWWc*a~vpQDS6z2oWJ
zDF55GaZ}pKUiQQAm}^(Bk&2zv+XT%>m$h%d!|Lq7gm{LI1|Dlr)0k!u;T;@QuIyS4
zPjw|-6WRG(?9fl}`dyp^X6ea>;b@&j6b_;PYDdsAH^<l_F9c3HFL}gubZo{@-k|gE
z33~D~I5;r8+^Y4$Ikvtfdx{1{d7LZROSs>liGI>tYYVWvLdh?j<f>lw?)~z7=~1|O
zM34`k$}U``35*i=*v{w=-<_Yc16mZw^R>TOmJ+Q&_}Wh8i{;8o(v*dN>)>{7E<q2z
zlP<JhCv7}inZXZfQ0&*PJmeMt@*4GASw<|%`BrI`9c2|N@#EX|#r(>3iU?Zp2IrfQ
zi{*X5Kof|3NxTdP3xx(8WIh~jImgp6F4-v{?0|=D<7FcPM&3-{t-~%x-9F}JfBS(W
zKoSosZ@||uDErEbjDQRBh_q208;i2e7?VN`!u$UHVYVcME(pZM4;)To{NDr>po;?6
zezxw>5FPdeOLLrk$tdWP@bKliJj6Lm$FV$A{vt0PW4wl;BZF_3EnXa3)ft4;i=*=)
zPQ^7%%VG<e`E_;JP*_FG3i8-05P426CSFxw@U#umHM4f$ieuuOD1Vb5(-L0x)4GAR
z=i(LvMk%rFk}}W}ZV>N+#|wXsfH@ENHO_f2Lk_=-9y&xieFtab=8b6!{G=D1{N7bE
zW@6w)wX*Bc-zeyn-)ygRU`wshwo(oKFzDbB0YwIBh0V^k7R$9R8W}P#pY~Y0)Aj4u
z$+|_rAKxu4bOf$jiw^dFV4Z`)oGx*O({?izxP4wbGFLMWL<0w1*yC1PuG%!a*}!LP
zt4DiWoMXAtMJ#CJi|`G2LC3Lhg7357r?Y^Sc#z%c-shhnEQ|_Y3;;3fs5q)_sdF>r
zhbWZtM4&<)*6C=*i*k8{HYgtxD2Du`%wSKgDPRMgx?)~j30|YV09*q{p}(NzD3d3+
z9<8%;;DsMn95PPewSA*9UXG9bQhp0K*a+^mNf8vp^R`0X<}1@$zUI6Acf3UwN{heH
z{b_G(jUk@$63=rM6$#P8bDh#&QSWn<{c|jx`?H*r>$Fut3*4XivsFry)UEB78?+65
z!&ZbtWI1kO{Fl@%O7+ZhZnd|*ZB;Codx+eAw(~kcY&v;)*5?C2zGX;p^3o&jDz<@k
zssqXc#m$i6(Q$((F$M-~3t;s#`{Ya7b=bl_NB#EQ1w?LL5ZMp;Eo_;zC3p}m;nHt;
z6rSM2F|iIaYMOED#*KC|QTLMl899kDbN&~<3|BEw<36^I&?)&I@K)Xj_s#0%0vsuz
z@JsF&-^^GRSVsS(-JFTQyZG)k%3zX>S1eL1;NA0niR1KJ-ph%&(hq;SbmcORPaMYT
z2|k0}&+?|=jaR!mLT1%oF6?zQ3V&fQ?YS6FN0&jek!_PcINrYd|Ke!JHDxSb@q>3!
zPHYKR97F53pArfE65pjm(MQ6ecM-U(teSljdA#Fp+eQ5z_Rr@_S^Og1<T9Y6DA>Y8
z8Onv{NKwv7;=8mU46k65o*X9gS!Yl1G`E0W2!1!!)~8x*R|cki^374QhcJ$u)0`~d
zaDE3p+91P+@R8^!jem-b<0+0-r<+SRdt&iW*xPJ#Zq2jz+=KY~owtCO@ZcA1(q?n`
z<}7*?+ZV2c7R};q*7thm!?mp~1fJG}{Pw7yZTOH&9Xl7C8CW^V_wKIl*y4SXvH(HQ
zjh%7cb~geuQi<DHzLICqS1MN)(V1zml442lMcO6J6*|N@-?<R|5!U?Vuxh(2L1&A_
zt=yv?QDOasM>F<NEB9rb7xyWa`<#1}uU#M^FvW+M=lRa<QG(@o<Z<US+Q>K;#@?0`
z+amOf0XccBgh75jk1M6yXWL?#lp%ldh*J1&y(MHK7@=+5*xuceYh!auT8f?1;EN^T
z&SNt3clMDz8K0cN(~&VIS|3II<~JH#XjZ`A2W*ps5jHvk5S|iE8}l43%Yjsm4f9O_
zcES%#kM=9~xZp)DLu+CTEYmS7J`?^7<`-dAgqN_9#DuMLQvR)Y&Ue}r^KSsr?=~@i
zYQOL~Wh&blf7Zu5Y?+RQFt*IFb-)XB*xNokVL9TaG%gDXc@jJdIK*At7e|&Sm9ynr
z#2Qd9u;6=s<#|6c>u`Sry7)Y_Aw1<z56OCX?(A81jKE3GweWlL`_so{oJ6*~eycA%
zV2%@xMLV~d;M{WS-t8f1acOFrj}471%e8g$Swyxem9ubk6uIgVnRlMR3+#X3UjgA_
zI14@az7OHz;isVRL|POW`d000$Ru17rb1J?44a2`4(rQZjImR8%<zs@<Z`)7`NJ7V
z8COgfF23}I1?@BU7Dj~<EY-0=?vRFQON<xS#XIMW2v+kujG~-*{ON>aM#)xA0cMO2
z{f7FA&)UCO?CyQ^LA~|brAxF2-JGp!SFLDEdtTd}?jQd$O`&ImF2x)oUfD_BdFAmg
z;;GdY<w)@>a4z4@z4j#Y66MNRoXl_P^HPZQ`j=_WX6I|R(>{8|KoRZe!aVaDuG$b_
zV!s`<jH}j^>l3G+U-SBlN4_VnIB?M`!9hzH3&(?K5$bgOdBxz;GVvI?33}lvpR^8}
z;#dhI$Jq0XC7f|nhEFt;CJQ?|r;ae4YQg2L_+{K`x(xj9xONRc8`&Mv0lfFM^&3+C
ziq`0GjJcIjrf`k2Ik(PP0K__NVo}ERvv_107boCMwi%pJ_Hzs@Ew|b>!bjkF!ZhwH
z(6)WEAJ#iTfXn%_=VF0{e9j+~^<4a5@SZltVFFRLJ49oxA`a<-a%gK6S%+-j7;}#B
zlJ`p&j<53`7uaUFE^VRzyS8kLvAJ;>-z$NX!({7otloNkZ<@nBVQ-9<<^Be2tcUW2
ziwi14=ir)r%KCzrMvsb(D}EN5`U)TV0|EhFj%cq?%0KfhuiCaEQvWkIN4zQ=0=&oo
zIOn?G7^@)orx3$qLdU#cf!xW&2}<S#wgrO5K!?Rq!sP{GYq-~8pAjAO4y=vBqmHOv
zg64j=tdWW4uLk$1pi%}#I`@Q@!oU|^AQKI9CG8Xupu*JD$nMwY9=6j=UJ`UQ+iRG%
zb`C4+CJ6+1GNo{8KclE1SiA~+!t}Y{pq@$E;PXcB#hr4`Xk<M0?9Kb#KEN$y);6t3
z3)wcH1L4z*9rtnksC>m<ymEyX59|M)@}6A;w)q_R@@H_3#@OcO<`8yGd!I01&Jf*d
z$qPt<<+dKCjWp7997B?;j9g{t5rT>p@^8`hKjug-WF{i<aU(x!WHd^&julgDTie*X
zvOJx?a)y1lPsVmSPZ-BGR#L8Bxr)eKwqkMIdB!e9A)Wx2O6p$3YV8H2c)Nf95jX<T
zGf~%aEw*ssHZv&1sutRs>j&QA4C5g#gt3JCN??#0XdS2MM&OUkpYfu<qon+jQJL=Z
z^0lk!5<*8fSrP0_e^$lzCPY9*6ul9YMaFBBqd*INg~Pkz8QT=ka6*4&YLy5CM&=e3
zV3{GDEtop24qCvl2L9=2oy&OD@-hYJ1S=aD4bCeAHl`b!VEm?V7AZK`)?C*sG_ZIJ
zu<(zEBf{Ju5x1XOLDm}g_I-oBEnE1Uz^K@VpstcW!&Yf_Nu^0zGh$L+{0Kb0(SC!}
ztyfWc5dgVIoS%!Ku?m{HP2{>pBn2|-jENZ-$M^{>UT)>#IEPV^@~MHcg<GM)!cczV
z*voGmZ_b14#3#oLdQ_3JNR?(E7LW6H3Zk!ZaKW?uqW{9cp9?=yJqKKk3o6y7j5A$p
z+v4W5i~t)~2{vKedq}_CFWPJq)1;}RMez(hj5;ml`I+B-=%5V}9$@k1wmm9)_RCV@
zk9zH&YKt@&^I)Oj(PWF~nWz)IC>nBte(fXA*jEFGgp0*nWwGa;ecuuH`h4Lf-cD-#
z1qW)t#d)mqG=2M+u!qlUw4V=es3j^t^J)4(J&uG1)Eo#%Do0Y+R+9qu{;2DC-OINu
zaDJi2YiM8sJ|d5TK<I1cQx@c3^w*#GD~JYxM}C*y?3TEpa^?P*E1OpYzFateJ{|k!
z1nH4kxeNVlBeTth)>RSYk)O>F2yK!-@c;lo07*naRAY#R&_`=4)nMh)utJ?Qm*4o}
z9KuCYQ%mDM;(HNR!Z(~+z)Z~KiFn2Dai_!RQ~7$FaA&a`OMBU28I~u18-q{Isj1HM
z7!KC4vB?;3Q}mkhx(<VMjJFR^reo?nFov<pd9oV*=eA#^cj%8iRK7@>a<^3pLpt>7
zcn3Xc3?Y)-Au(#(6vPIOP63Oj(C}=w&~ZhETOo`QaBDrz@lwB8Vx-F&wz)A|mWpTz
z+nUXS*xV*(A%dZ0dSt<w1_J_nDlR#1*glOEj&Dr&(1lq=e9a(xXgE|s6^gFz(5Np@
zRYARoaj$3SPGstF<lMH%EqCPogJd<DqKt@ee*x?o`R1dnZd$!IGJ1`p4By0|*?p&<
zRju%5;2=6g8-*+K!wj%6U8!5jDQl>p2)i2Q<;4VbEy6KyAA$H5j=1{>-2&77jfIoj
zfy{Rc0>;kZ9}N$c$PM)<&vQu2IbwhhuLwMa-gHzcgT(-I23q9vfE(vr6NX}6%okiy
zu(tov&0qrg9`AnX5#>p5+zVaCoGZ@-ABs*3KWQ+A0p~0pKp9h+wI;{UxpuBw?0}3n
zx;tXq%xZ#J8ZpwjviZ#e2U07k;Fn%ooH_<D5V6m!2GMYmy|iI3{t!KiE<0an^q5a-
zaOa~)zkhp>d6exW;8|;1ThkjT%_~-~Ol`}Su?1HTtEKP9c+Q<O?^*DV+Yo&G$tN)n
zm_5cl#_LQ=ntK@ZD=mKeh%ph$F-I5S%V&%OV^M&oSEd-xNmtC`Y#c|qy3yXA+WY$=
z!=JdU0%XQOx9&8p@&xj1WJ-~!V<i2|W1I&yzB1kc`ND79NuBvlV9Jm2$F-R2C`VqP
zG1OK2u7q}+j4o52)>Y%*1jak%ZL=|mr&X+OakaK`b_KY;hyVuX1S^;JtS5-oR#2Yx
zN3-M2i@8Ofc?3G<(|9jJRxAqT&`(}jW`#G$U4d=Ecm1j%`w0fy&?%g+;6WW-9qC$M
zH>>WUGy17AJ)bR?Ou_6{YGwelFln$zC$=4IwkyDeEu+9AacbICYVes%YlZgEP?c%*
z6P4SA@V6Rx@i-Z&<OgoC*TCH7wuG_W01CHTr9?)mLLcOLMWtHU2ebkJ^wTzbUjUG^
z_~M(_GaMFxo9kQJBAdY&j+d)Fo#`$PX`PPZXpFy|dDVmB3$2JJqRJPZ4Z4hrxy+!0
z+$5SsySV)9E6)|5*N9kLpkV6_9`;A^&(Caxlta;O%E(3>_!a{sPYn6UvYijaQ}9ej
zv`&|z(akyBK!3Mhb4B`D0_d(H`@3b~l7>ZT_l})u$L1}p0BuQ&yW7Kv8THsmUvWG;
zDPDMXJ$h^(y<%J90;j^)?}fI<1Hztbkcn3T4H7?eCcOM}zBJfxAuF}M{_<!zF>Yf}
zvM9H%J^04Hyj@M)oy%5MmM(Py=$Pom*uDb2OIfFmId}=F<IV7J%S8_?3ek91G;l|o
zY-6GEoWAt%x46$YD+I1OEozw)>sc)|K-P&-<~)BkUAMGv=BP1)=Al97dlxw<`zhDy
zP`lpIp00tL5Bc48Y3!Nn76{C552wlSLZ75X(IE`Z^gDnmV1MYKZSn<IzRM%EC#Xxh
zJyRvwJWAMF%LNL`MGer3X`$W9Gm5uto{#Z!euEZk_}wjg-FjjQns?82vwF@U<Efyq
zO^&5wsE(5}a+EM{JqlT)ec)y|$Lxm&;c8?w`L<bgq($qc${6QDBMQ9>$}fyh;Zotl
z$BIx0`m)ae>nR0_`#O@`a@C+<<yM<1Kgu+x_@s;iU#5?45gMthk>4jCD+|(2V51y1
z2fB$q(Jxz*r3?xMzT)=tRumfcl8-_+;~Ax3R|Z;Eex8yk??w5=?|D8IrUqT)d1w@8
z^_3gf(lz+_Bn|_eo~8(whr1onJ=!1m9phs0)Iv2uht!}L;;L9Pug;pFj)HC_l7-V1
zT|xQu0Y=;@^y}qKP3Y@v^$8yxWZ}(i99hl_E1H+Hkfbbi^WCjpi}S@3=Q{9h9xGlK
zu-#`BFdZecjyz4(K^a_qNtmkdO20x<?9o;h*&1vxSDi~;=o2e6)ia&}k=_*W#XIBR
zf`;~vn|<lbH{WFWrLjIOTh^Sm-QR#ybTFOo?TC3@C$;Tm6e-g}J)V`6zkbhqV58$=
z`{<*3X`F*Yj!$GEK@JROAoLY>x0pGpkA9kUHymix+<Wt8@He-W@IDW>+nVDxGYpa|
zJ#C+@@^>?g)?j!ZWUHuQg5)ojUWyd{Elo?)+xrisMFc{vZe`BH{xr_&ZRJsAKgT_6
zEVh|{o!yS7Hl|Vnf=ZzS4b8!0__V%|U+GiWm*62XZO0%odGgFOtBf5pB4uJs0#}6#
zf6hq;U2v9VW1dq#@p|AIGQd;tS-6Yej=MUQwz$V^^-xnbC)LkGwxqvPY)#~ty4a)<
zeW9Ke>e@=Lcaxr9+g;R2xs>DB6c_SI=Wgky&Qb!uwR6g;#ntwKJT%>Y#R`Arbo&W!
zQ=gJ&#Mp98Su12u>7&?I@VOFsy%xUjc3x!!qnQm#J$PRIT()+o4Zw`rr@(Px!lf7k
z+RJD0uLuXB7uRHF)aAJY=5-y4b!;7jn#Fc(eb}OIvIACmWNlG*-@%rjt!(?dih1u^
zUl;sNTLRBoU!k1*$=B~aqygbbx1nw2L}_#OeB=iDSY5%k^%G<O;2!4;vr9UkxK+Xg
zJltS&Yl^wwI-TH^N$9jPa%A)Y_r)h+NtfctAHH*c;adLX*WWEW4)8PIn#V%kp{>yI
zHyc_vcBrq<o*=UjTeOJh$l<e*eJZM}$m&A|7wvZx5co=gG4@=EAjfDt^vrjm9~F5w
z@Sr2{-MJzbzj=lGGd>aEL!YW}NX2Gj;J^&~u?Q;&H{&MHxgEIna!w-~_QgvV+3tt!
zmgE!E;Z}uieLG9t#(+iV8@j73Y;Pl2gokar^Xnw#xvgBlKIS}e-226tAg^e%xHb=c
zd!aHubpKFWIM2<|K7n3dNxRL8Wd<JWfc<BAGRBa`=B~$FDV<uMbC<LhV;S%))JI*G
zT>^tG)kY_8r_I5KJa-P`cV*OQYyr}AD(oQDCFLvxc|<m*3+ck;%dFU+lUmv0bJzAA
zY3;hTY2B(d>C{yMlej154tT*Ncxn^P_@_;~1D^uLMcd4PSOY(;<~2xg)nmq{6yJ<D
zi0gTbi|>B_?jdf)%TeGNxBXdwe5%8;7g`+X?TsvMbp*R@-MBIB+PamkquNqSb93st
zPsT4~ZtY0&H^<U;-(o@HiIXSNedIox8g@6c$5)e8-nrW?8Uxj7r*=YRM)j^*?1>9&
zYSSIEwm^oFVWJ)x#RZQBXd7Ve0vZFhiYP39bt^4xE@qW;=~+3v(XD`7<uBUD%l>)J
zgV}z;7jQs+=opG`$|0W18@*XsiU<7XCZFRII(O$m$6RDrR+RTMnFoLMR@*L2ebC#)
z?<kMDvs6UziF_a3Ksc-G*da4~D4Z$H`5eL|@-4xr=m>7pyp7C9E+Evu)j;1|1lo=4
znHPf71fH>pIk?BN`0@h>y^ULJU);(YPsN-d-(L*uhrl~+?qvj(RkKx4J%NudS~tK#
zAByy75TLYQ1|N6(w|R`?ZMHznc5KG6rXse05hiAKoI>USx=gRgLkh^06Ty4Y3eIVS
zBoyNWY}6C8y)POUt&Opu?%=}_b4DNNyw5r=*;nM;&UG_b`4qqDBYXl(!w02YjLvX-
z-0eT%{m|1~=C)-^nrTzQ7Q~i5$W?C3E}q30iwDX^+~7RQP{;f~OI(unqXE=K2b^1{
zpn;GpcupR!&F5Ng7jrw%hkuF(HOK<h*vs5D(zz*uKB;34w$gdn1RW)JAL!}sifsWK
zpv6sV*;V4;eq^GRX&HgZZcX~=(IhwoOanrWrNH?9BgVV%ljp^knG4O%U61}VA09gS
zgzPZL588g~(O<Rs3tz|4G0z7z(SK$`z(SqKP|A<`FC4?L*`hm|fWhqsgEXjc0(*>h
zW9_r^#T#($F>{-CTm$6h()T6UQ9Py?Gi7J>eSJvE9ge-eg(U<4-g+<?<D+ae7ha%T
zJeTbghX@uNz~?p0_O$AR!K-PPyvi)hU!MAgvZm6Oty|JYGOoV9{k7N{ZL0HHy2G}|
zA-mF6=hDEd0)9D{SidAI5755N1=`0e=pPzpehxmsFaBD%BcBWKXNM!~A^*vvCv26c
z=VQmH!zS!@k(0ubw(DQ4gZ>wQtFx##<lko__^i<HKMDN&)=!kF4lSOlx2RV(v7PI{
zgQ4t)r{OL<UBO(Xz03Kj510-bNCK_|k1N7Qn;E=NnON~TWKCs9R!P`Lh9~-<OrU+X
zg`lwpwj4W$yztrK!}yj5BiK<Hb4~NIAaAINCks-GV+Y)YgJW&5irWi67|(Wxa&$K3
zH~k^nQzLL!Zo;`ZB;MG+g~$fgJo}h!XJ@8Z^bk5G{D6Ap%gTw-FX|`;9_hPPr*7})
zOxJE=W5nJfE=zOO@MP^!4_U;et--eC13=JL`G@1SW?4&GPLQN{)5AR3J1{_ioSFLM
z2hQK%4fpF)Z&}R3RN8s;_&4eEqes&nV57e1wra0$+QxR63o>7$BB@U}$peLL=pzUs
zCA3-mluyZHpVI!IM_>p#h2C0d=x_Dm*giW#fB+I15h+xt{5Nz6&|(|E-L@CMdtdQh
zoB!f(#qRj~|EmK6WPAc~EK5e@p95&1hLeyhKuZhAPzqs{GODEz&{LIDDtEFHp>lQx
zf(;m6zsEITui?%B1XEl_(2UH=fE}Kd0Xlf0v~un<nZS(1!YM#Ia>R3PQ$}6|e1cC<
z=5-1$gh*B{ZDw`gT@26nXi!;NL8`-6u4zo`#8BydVwmOouJKQ$MZ>zrw15G~>CWVG
zOjF7sc3Yiu_VXhyJdG?ayEbi2AMHMn8d0Lp5{U4(hd)i{My~M;lZ&~msOiN=gQ0%w
z%JYIHQ18yqIUugQx(ku5!%4NWwKW9JK@1h9VkdM2;w6n>OKTANP(LX)nN-{YWHyS2
zrKpVLm*<wwU-Xwxe}m}!3<n3llVbv<r97O6k8$P>-W`m6ZSN7tqQh(<>6PaqG>a$2
zD1Hr1QD)SIkN~q<1KhitmXR9R$ov_Y#{9I3EGkRc%1LL%2<<eQ)ZQux$$T`%lUSND
z$qqEL5XdOpZBD18!pSr%<is~-)(~Wd80!(*HitIVz@VJ-1`!Y)*LmPX6T)dtU2ST=
z$^P&dj72-T7+|)|zs>O+c8m~x@)eUi%1I-cGVTyn{)81#aBn6`fvsu_<3>o(F#8BY
z;(XfK*3_Ij>lddU_JV$j5Zi=PK-jqQUIBWP@wM!TB&LCs^h!sOH%PZ)u8PA$w(ICb
zX<7*!T4CPvw(m-d5l&8>KbLxXdtyRy8!-<ROjicGvd`>M)$``21vrkLwwEAuvoA7Z
z(8!+9^-G)B$G#y=BjDYl&k!PQ&1INCP#luZgPtijA}SqYS`{w_LD)-&9*%#c5aiS6
z^ZnvOp0F#qw+bcFRe!G5F`cEHAZSwDLxYZt5;P%%B8sK@XGg$7AbOn-UpnG6`1PQ?
zt|N+hdDGIgVnIWytgT61IBePxZdJBbbrlnwm_qp~JkN)%_TxK;<M3?W;hvy73XuPm
zG6A}Gee{_pg@N#zEuIwGtRSwF3d-aT2*5Hp^+gA{WMll!1<Djx^4NQW$BXSMUdz7}
z--~mG&-sc~B$WMt;D9m4v=$s$Axzi<xNGQERPGA1)}_l+V_kh3o@Torg&x{x5T%YT
zS6m5|#RwBCn_JRI`xR*YF+y|=xYr!Qnn4Hd^*e#^9a1TMr*|>_erAXW721TbY8Dig
zGVc-=!rWg~ma1`vyS>Uo0ub*E-eF6@0Td$yR22n-7BGmb6b9YeGKvsOeO}yj?{F4|
zMOng8{$mQha>vNLq4bOYQ1lEWwZAVyQ~Z<CEYs_rYak2w#}LF@0T(^@w_*v!Pc9V>
z$D}we;*WdH4#Kn6G%ywjo^8N>qLaOX>BwRfu2t}UgXW&<#EfbY45>yX#)xX2`>uRg
zwW1~UYWU*&H1J$X5ZUUswrI*Q#%<>qTc@FEm_S7p(prL3%y_k=6GyH_3~*%ef_e;|
ztq8KLX6ou85HAax8lUg6m#GG{g&2(65Gb#<V=yMYys|@U<Fd4Rc^d|hxdD5z#y=sT
za$+tW4S6vi^Qj{!gmoI_b?F6(12{_iKo{7kl)8$?)Q=T7@M__mR|a}xOGq8;26Hv7
zSeB}4=clR8_A~^3x@AWRt8F4cjk3)=*GAyszj*h<$hPumXgHlD8^)g#9HY~~x(w(O
zroMElX#8wiRGZeXXiZnziM}`3mA|${&FSFY{b|Fdjp@{xv*~kE-wzM5S26|&`KhU3
z7cQuc^q9-9Uroa(_!AVWL1W#j)e#KT*NbD4xl4nTLmI|)&-wEJMQI1$0&rq=U>e^!
z2S#RKG4L#J2b7hY{9wF)=go48a+|!CssjJzQ_5q(rzl&c+3|?6;Jah-ga*#Ui!xBg
z7s4+#k^Z_7N5bu%-gNQe#neBE>;Ufol4<*nZEQKJaghDxF}$jb2j|aS`%c@67ox90
zVZ|$%hQ*at;IPh^iHDEU>C<Oe@rCj-*oPB$EHy7DXmT~Uin6M+E{rem3is5l##mH_
zb8Ccvs;-;81Oj4ELSCvSU}s@H^BrxI&(PHjU_YN7`MST!cfBEkJ`1B1Fnx9}v`BEx
z@YuuHa-o6M8;#)GWgKSrz+LAcjTbAIFUN^dm&#e;{Q%|fDN26u0vXoJ4(b;tt=~Fr
zi3s7Pn0pvAA*?*4)21345&s%7m<+)m+@eCm1?(~KD7FY7=vJDpKzVIJv0l-*6er%j
zFy<{px!<sI4ZOV}vROWazhoUD*UNhxwuOI=-1dAP7oNQpuf->~J^S<#@tarvv{!Oh
z?|J^Gk<WIz-DU}M(c)%c+Sh^1f=tQ4RN?HdZ(584tC2mc2h**tN9pk>#(fMuU~<q<
z1pb4!(v$l%H!NJlD$Tkyi0p>TfC`<1tzG)Z5P{QW6q!|iwF=sIKAY)Bz9PuDrfP25
zzi~%;lQhmZ@7+lsvm$kXpoo}Totr7cm*q%r&;FvX&^Pxuj|MG@SOtLiJU_(zB<z23
z@a@#b+&YAU{_*jz(x)emu^mp{CPcV<6z7lp?d9*e4N?5Fo8$q7VxlchnDOVh*p%Fy
z{KXp!_eVczYqZzPocoA}wBcU_7X_C3i@1k;3;)P3c?%A5Dsiq?Z7Kt~{azuC@<d3E
zocpx;ia{ou*Q_N-qB31LeJ<S|fcEbVu>Hy%R{GVY4Xf9LA<m#1vkNGW)0k+pefiG8
z?}aV}@Acd{FW1PAfs^0`?e@q;_|6Nyf&fh0;wi2nVbC|z)oV!9f%lYPdUYv{N%xsE
z=CPeZ15Sk5I0cjji}(&p2q;;%vaDIUu6K2U%Zo#XPfJ*6K>*3=QzyyRXJ!X*N@fk5
zpF^GRHkq>Q_V*pZU-(snRCX$4!;}F7OBXCk8&<4D<|p9v-d%WRMaUoOZU&Q#pyRkb
zfqLH*4&(>W-2-HVC9JTlWp(yUUpL!mWLgY;2Yq2KI@oP=wVP~@<0^cqTCBH`S*{j#
zFKcavx1*t<bp*Lx$6|Bs@{rx#5^VCG`gUn*##yrlr|d%H7qgWV$4mUn0T9SQ$PDUS
z&FHeqt*)M*RXH!5xdz#26nD5ozhxYBc#XiX4cwl$unxUwUYfW`_Djam1u2b`)r2!x
zhf*Ir{0Vbjrh2+0&J_>47hk1_Uq8HDyfgpiXbL6fbCDNZszD!H4BijW-w_OSrsNMC
zMc>xpVW5zXtVi^F8F+6%o^sh^oCc3+N5lMTwo+Y%4myuaX%CUt2_m6}Oye1U#J|i#
zI4L&h*PHrl-*We)@9bz$Kl8cZ))W>vDW5C+Wlonf6sr%L(P+;6xxf@z9UQ&~&VgBJ
zc71hfXkMDC`K{#s?bJRr0RQx9c?XcOV!wm`WypK8nY$g+5u5`v1U^C)!8dGdWL*MJ
zN07rtN5_zTSE8b0cm;<BnI8;z)8W^MjBR`RyRIU8kI)IYGWx^>V?V~+ScSf^3fa~G
z?8p7!5$&kNV7vxe(MbCcC*ecjs(nkmR>Ng&WXNS<YvKO<iOdV#Rme+ZZo&*$@gC#B
zsB#Vup^us?`f+NW@4Aj$gQ2y#F&#W`fUQPW<J2BXy?1UUMmXS%Rvl%8v+dc~S?UiQ
zw8^<nW2`XM$)V*gJ0;Y?3|axk{I1>|wCW?l?+g|KuE0mRdfq~ezXa3_-?_=%dDUhk
z^KerWHXmTwJN5uWFIbB)z7nJOa`@l&4V$?CZtA#xogj-oaBqfyX|gD+Y)kXuB?j~B
zguPAnD-Fn)O9F<DjrxkRKpFNbGoQGf!VEm76dRHAj?Vh5{Q-BLHP}Dq7uput51<+R
zFCphv@|&R0W)k{zfDHWQqPn`zscRa*Zf>YDuB*3%tW2ZIVZsih!3yG|PAm1QM-N7D
z-Yvu)wjy=I7bn}<SctkB=GUivY>BjS-TKJD`F{@%qg$AfnX#mg>Zty^U4Xo+68q~?
z=774sUbZuM5Zif}P1ZRgW+dCrD{KtlUODqm8TIJwFc?p}iZ-+=bt}uI5Ap<_3Y(8Q
zxzuVV85bN4-G9K=OcP=ATM5oD!)B$^;r8v@@EHvD+#6_4r5g9O$XJ#y@z$(}LH$(W
zJmjzO@)qD;fex@~<A&5o!29i+1L=DE4RCoN&AQ9;WB_77oxgEdyu2x`p1%_LxH>zf
zDO2nY{W^<;6y#xn-*-568BevRj6l~9p#QQZE5e!Dwq$vF+|w0pal5$H>e9&O57@3p
zomkw7KG67#H^37Z+AGJ#Kfi0MbfBVJ@hPXX&l$Gg*RmI{d7I;wOGMUjeuD>&U@vt0
z)A@A^Sb1HEU2urt8l9jE(gOHgWAl=958LVhbI?-*9)L-fzvNlkte=lZoW~eBYBr8G
zGI+u#+i-nW+bZ)b_lZ#ksklW^1Nws7N4OQEPH(pjb383Wo_Qaek2+4x{2JO?o5lya
zkp*zPQ`S7TxN2(A{<<KITz;JHjz0*eo(Qh)p<JYGH>M1}3s?D${73$mWgz=u_rxns
zc<Iz$0vy(2pKu{u`|#~3$L-x$wrC5VlODj+wPQKgyQP`@O`D|l9qSMoV->vh@rvw<
z0VC^h1pUaPBDz)boPLN3;G_df8P)Q_-id9}tWVB4p$k%u&n$=Ut!-JArbk%>aJ4;k
zbhoGOAu{fwZ<-xu4LrOW$8a@HX1A1a0gqb{4U;L}ZBVM1`)bh($GbaX>nl3Kcr-#A
zZWp>JJ-l`~^)uH$#Q_&`T(p3p;qO%r?}~B23Fubqbp$NkWzorH0)YnP$?)+~boN&C
zQ?sZjH|TVAEc`RWnfAPei*b~rTULUv4+gNEfE#lutFE>owXR$l^3)*o_mun9P2CcE
zm_<>|CCkWKwj`}z)|N&uU!>d_f^Fuf*T~ZGK69Klo4@$@m+8s_b}~RObN+X6h<M?A
z+sgR6wTQZ$!FnxA+2#?MF183Pj9rW%d{Dkk%mw3zXUgx?mS2vclZqGuPKy|YL#hrN
zHgj|Zm!);@HGtC$d*ZG(MCa(B9qyOc1bnzxTvcMReSXeEMp=Yz;-cuM$Zy`~0tt0=
z#Q-`MpJ=K<+kFJl3*R-sumQQ$ZFO!CaM3exllhdgy`TCV$5-Vyj$6iRoA>-odR+`n
zZEIbV?hx!cgB@ZH3o4r%n~|5+Lhf#3owq<0N2kG6gOJ_I(1kbaT2>P9h0PJ!*^Ej{
z7dEC1Ysgv*pHU`qE~LqUr{%(k`BI2$_cmxS^P&u6?fnc<*xq%P+d%^*oHw)$x&%rr
zbPmtFgWnw=?qjJE&uR03m(V9}0soZ!9)%vg9G~F2<*jL=<6785Yta|hvB2)bcRxrE
zvHyMi<!9NJ$(U(-wq4=Np!GIEdCt0||Lm6_gA;Yx#(*q5((OX;!<*GDY6)0bL?EqO
zqsKNl$W8OX)g=Uj7)UnVk6&s48U`P<OU}bSwt3w~{ACN%?Y{nW{@giqCT!c-wn{+8
z9ox2~^4fV3KtG3I0Rztr*`j*-N;~54+jo!Ruior=@ih&6su{DD_=ncvhnhl88OL_p
zfR5@S)h2yC(49M2M1YOBO&Q{hI(nt@BfwE6igBcD<t1g1qAkj%IflxL+O?G{wI!{m
z{L6h^;0O2yFEqeFym?GuL<Gc7DBBV!!MqsuUhu0CTG-sSCIZl&F#naplUf^=rjOow
zKh-a3Ajtb<`r_DE=^;VFGX&_zd`$zyB^O*>!d5hlU45KEtZIZ06X>{?;065`5Bs~I
zDd-WnI?*}bJI`B+eG1)!{^@_H0vnWs%nmONJO0`M)Y*it<556g!4-#~6E7KTzGwZ#
z`Fa+CnDRsyx0{W3C5sXDzw`_f@WStl@x2Hu1Fa^((~waq=J_acM!7Gw|HPaoy>lPq
zBwg6YQQ&UC<eb^c;_C@ax|K@Fpro&L5kAeI9(p&mBKw_V0qe&{ze<Df2Dd)*5U%BP
z!}+w5SImiAQ%;sftxUPl%+k>=+Gh~8fm;afk-5}>69Yxd2zahR)~Lmv7xom&(EsTn
z&w33087L#(m{m>PVRV3nir4@b&8@{Yxf<TO5dSOsAN<Lh-J(o=Pnfy@V;S~~mGtEX
zG-np^1<X;ak!>4+ZEPJSUvp?^r?vv0HRDX#{6(pOXD{FE!PbGSMSH54>snZ-u?QXI
z7CL1A#0c}Saxnc4I*?ZpK*}QJAMHDscC@TU=$=mJ+uPHB`Q?921M~&!BlU?m;DI_8
zFc&rkHx41c+#;aK%yzR0#9Kh$T)6H$7C!rcN*;p<_5%LWoAXl9j#lbC2Le`7g)t4G
zB|7%>Am$rBU-fYO@~FS+6aS6fCnI{1II^((-A2B6&v$?Qr(DUCtOnjVBvMYo01c8=
zBMh{)w2{KTJdH84NSq>=EBnV0dU|j7lNR<SNKF(RNL-8aZP7vm9gudm4p5vMOE6xq
zZeEclQJn5hj;7nJC?CZbWcolkkQ3QFBEgo{6G;jp*Mz`HR5grL2g*2xv!N-Rjic<D
ziStB;B=L<CO{Rh2dS6dkkFvIZ*XyjLo}I2TnLVX_2e$7{TQ_VDA=?#>k7AN{qGW=G
zDKCXE-FMsQHw|Sqw0$Lt)<Vi1VQ<O7iHCX1p<opD`uQOoBxr@YW+sXn4ES4dFrB@0
zk<}>eu{D8?De(T+4+tvrx(w%E|Iu&M;ywH+thv|fmG&E~=-3g;xWqpXg{2?oT|J7#
zKCZh$T%x{u<9Zsz_@>cyHcGzCLSap(vk{_UpyECaqxMB1Mx`KD;lo@E7I7Ti%3zYf
z3|F(PTfYG#{&c#@N-vq(TYLAX<;^JI1TqCYc*bEAfBbWWmQ&0|gcgl36&TLiaeQxK
zLfk{7XakuOjL5%B>MIW&f=)<A&l=TOi6OcXp+rOHW0>cB@UI1hzZCqKsB~Z3`{_23
zt5Ym}Q5n2Ne|3_rCrDy%*}*hDr;^Cuo(MQ{mB7X=o6-|-VdQWBDwW=V-P4y6n0)ZH
z7>H=bE4(oxGJWX-SdPP>HDn6gxj3=+yzxewje+?l<KmvAP8z-hj!ynN7^*LJTu-m>
z+MRZ6*%rfm`qG6+fxR2$X3w^r!9c%0_65cbBB&V$$H^O2{=S1p-_v4w!?*c{!84r%
z!gOQ2*vweEifRnzZgl*>(A_Wy@leJM>JwjXQNJ{`Zq4enmxyTyJ6-AMNF^B0wrttL
z-iccYvYMOz<KO*Fx`dG;B4CNOt;T55w3PJD7%E&%ARd^_Vi`1C{TL-1e&N{N$IzDH
zZ}%|#;P7n52wzJ8R|S)hDG@6XIDEdb7U6w4lOO`<1Oi&;T~c~OpD*%3d8hDlD=Jq%
zx?NA;wZ*?cf5kdO838U6)YUc6pZW;C+j?+gDkU2H4m{>IxPI&2o%9rEf-CQ$3}EYF
zak<E1!TEapSa`E-#r8R!sRX!EZz+PRMlK<<v>u})cvK00G;7Y<<*jLy+3^7mvjGgM
zBcznHB85U%Iar<s#VPuzVrB4;9NY38zYqxdeAYVKP;BChjeE(txb145+t9VNUeB0q
zBY4p3M^1l}N^l<R+_WX_TD^%39;_N7z(!h-##Qnj;`Hc(?zXSlm{wsp_%UQ{RxMYb
z7zMo>T5LmT>_chj#z?5J48tMF03+=*!Ukg&<3gF)$dl)wNK0wogMZ~&DppW1H@QEw
zt6@wjy?N877=JTat>3UA?IZ<Z0}<H|Nk1RY2CND~A!DHNqn5y*O0?s;S#z=x4}dK~
z;aZEr|7d0+jj?Ry77igD@PgSOq{v!BS@KRtUicIS0veLnii_DOntv}2LScS=3H-er
zK~6mH;aDqN^?;vkt5&7;@Obfe{t5UZHE)K$?p(V8M-r=AG+ywS<L%2;;@$AXJMdVY
z32*H`h;mb!di(m)TmnwEZrYr-Y}gp9dONy0!=R`W!g1(fKEH``c-w|e>A;@7!5=QR
zUkm5L7L37W2dKi}cLRPf$lRo0sspN{r!x&=oLt+sI=%kdYY`oOx$`<k@;bKT*__@0
zFP=hgS$>Ev#<@zebWt~FZkj_L+<7c{s9|1H0-Oi0T7_Y{5?(VodlquTy$GJ1U~a~W
z9Xx6+a9NLV{r(3(0^uqn8%Y(B<r_DyPx}uXBp6_X?HoqQ8q%BRK!r|lOxZ(Op{2>d
zrDdrCBXs?us`O|%K^d$f877zpjHICelz#=%o6I$x{WnuH5%_N)YdmCrx<nr}Mmh(-
zv29m47$z{PPoRuSn{L%*2C*(u!8W4&?cM!)ta!WJc@+cqOj=9Z_pnEE6*5mdV`0Vu
zd6zUTJ!r5O*Tjmvy^Q<>{s!E<<}2p;pb=(ZepC4p4_@u?#=^~LmJ2b8HV`FWgK|)T
za=VDY8TprrQFFr*oRQ4C$bv&SSzYPms@oZ^3CoS^*QZ_Zh=+HELRmI2crNp{fj9FB
zuyq^^9-RQT;`*x`FPr=1J<FCYONaLEi&Y7A7<sN=Z^tk+MWFREoH|WWysOm53BZ$f
zT&3^`qtF<NlUv}K74YD}gQ>H-8w2q?3>zELc5wAEMp^l(QrLG6>gAs?$@7ddnso0G
z^v8L8^Cth9L!5hicr8N)e&>Vt(-iaR4d_!I-qzZRap!&ZFrQAJe0iAp=w<|W84U89
z4(qdDzkVp+@htPI85!@vLsSx%E?k_pv9+h^+pl4ydj#LTGx{KmVmf6l=nl?USIaB!
z@7%V7fb^+YWun}y%=gxweIdV{J9atsK?g+~Q&uhX`q!KCir?&l(3WpHk2{~_`CIJv
zS8CuxkUAzMjNJh9l-ql(TM2)A_np{N`Fd9ePUq>g6oc@4?|l$P>%+&7MDR_d-AB&M
zb2H9p=+fYCVWhEo>z1u)9I)LOAO$*7&>hkR-$mA(#31ALh!255H@tBOna;UJW5@zz
z{RiN5)6%8s-F*jGrP2@%sBr?m)G=HkWWC`CWd71Q7y&l)MOj%Iws-bd+P1e$_JLdW
zna0v@v$f1gt6Exdco0nFiZU32Tdo~Bc_NKMvxrL3FCTx^!+L#r$X_%h+Zw72KpV6i
zPJ8e&`a<jcF3!G)nZ*&3UUa-EgUOHNm!bdAA9*eA=#VV~XZhU;tDJ@#^wof2x12^)
zV>O<K5rHajs#eE-)WbL&G2_M@cV}oQ+N@#6t(SJcwkzfv7gC%h4fkDscjZ^xs+DOD
z&rd*Oqw-<oZ=Dml#}poYEcTx6K0oE2e1yD3pS(A88|Yn}6hGz5_EG1jeRS-?;mmcf
ziBlR*{4{fhaH)b1?%2LPGMl>nOan%=J#XxdK=skVdm*EU8^SYWc-sW*G~AzIh4U8p
z(u$T<=ym0xUnoNjgTDqglyc46Be*;_|Ji$h`q{VdKk-@npb^tCZomL+28l9Oo?q^`
z5dn(3cD|N2BUep68e^67&DbX3iPjuy?nlmWbyw^9wdvrYL#d3_^%rhjk1clET3gav
zhYk{GT9S^OIg!p^zf7<Z8KrnG^9@ep_~DiclUek0idAcOfuDhYn=!~9f+tmAL~Vrj
z<(Yf8ZbSE6L*P;sd|92h@S-*YWLy<)R=^F&G82qt9l=U&4ZU*h+O&J)77SwZ(<r)8
zQQm%n)lhw-muu>kyP4ni;dq{fUfbE*i{rZ@?L@ZSx??La8H0y^p1!(x7I_xataF^*
zDjabN0c5@@)bru>;%&uG?~$e+>BvCOR8DRrn0o)7J&_f_m4?ozgUrLX;YsDp*Unp}
zmzRfc+O{?AXPakN=`CQjtC>hP1DD;~cSZ({b62mBIif#s%;3rb_bE2%2S1BCrgRYP
z1Z$_D)6h%cdq^nJBVj0yQ)kg8krxffLkv76I}?V<%Z%F==wcswW+e`&Yn_f`dD;Sx
z-3`w9%-<jVJRQ4qHXG}CHs&|#n81c)kfk(d_Q1E^d^0V$e2HvzY@ftf7{uz9T{^&|
zE4T3ON9SEHjRI3Mr-(}raVFhIPMo6bF<^KX+%kyFc1rKsVAO41-?%;P+PN#XEvmbG
zK8(BanteN8k020(ihFPNGwuZN%HM$N+<8^ZnPeHRtqU8IuxY}^)kgM=320)7#X)zO
zYsP?|hwTix4=75Dj=LEly!SS8%qJ&~rA5n@rY&pMr0wW9mym0ZUAxHLl#EOqE5Feh
z0lSREA~~MpTK@jRJ2%QtT@}2zenDD3Z(*z~j!d=4-z$)h7nPTgMQA+cL}fl1rsJ+{
z!GNSo9qnn``ps$c&K+sSET?CnDdeoB*o*e;+mn_oU6R_d6P#|pno35%H0DKNqcilt
z-hHVQ<N0}l($Abd69Ico$ehlp%4m<UMHwU(dT>z}r+#t3tx6s-&Sli8v-*R#-a#I3
zPq(0l2hga&uERKW4Z?|xme?ek=wmay*X$YwY3rypGgt#yGK6jNmf0@pYjHKI&Vy?7
zon<UEnO`<Ll@SE99H(%FumyHY&|TJ!wMH<?7+F4g$fgxp*MRCMy6FvIvuW8%Y%d#Q
z9&~lO^TKNQ&1>7R`7lon+~_6%n2;ChGN?mZbPFhH$`!NX<Q(Qj?JjP&(~f?27oGIM
zlhM>m;8|oD0;Xmisn@2tpgvV%>|azqC(_POBgfCjwz&fS;mZCgrouZord%8_jjrfo
zs&;tB0E<-2PA%OU0Mh}VUx6HbVD}qI`D2K2xCr0SVHxusEtS5D`nqy(Q5FuYlZSE5
zZQk7CD}IOe#MKJMcD1y#c}E($eJ33|aUxy0hAxHNu?AggA+nCNcOP1e72foX;lg2%
zWs4Uu_y<qrRR(3c^{N@NwyatoE7#Q@YmOZc{93hUReA%xwh=pZZ&zm;7`Ppd{IC-<
z9&^#L7uU^+ZF5{4pkr|<IP{P}`1|0>LxTEl5$rZW-=w)rZPK1EDf(rHa;;;Y@8VHt
zo<&aZtxMOhV!z&%cI?{4Hs!SS{28Rzl30wfeaCiqKvO!56Y&aqHv&@B>wGau8#06~
zQ$B#)!ga6t(iUPSsA4<A0ZO^fRod~iX_|$tw5mMq#I{@-c+ea3%rJIM=lVzRZUZSN
za4cTxX-``oZcWQuSENH_Z>H(lWh`<a$eAG2o!hn}S8s`IoqgDpy0HTzphFofenh5i
ztXq<45xbu}$OVRN&CAjPaDIfcZxU3eZ9#mIhee<eXX=~FkhQg$PNQFab@5EB`rn3q
zbK9nk;O=brHQBk5+3lynb!OmPg7bFSBIuZaJ$2f-@B=f@JMRoXWj-2}?-L;DKyZL=
z$iC=_=m!hP<WUKWUR;Hp0=t%SpEm2Y%Ukdl;G~2<-=yE_17_<0+0&B7#c3ZllzA1^
z>FTn}>5H$bfd3PM^P7<6T0#eYh<-W-Uw0vzh~RwZ{N2Yq<-({p-v*}e|66wl3FfRx
z8#Zo4-q;p_hrQUpt}Cm6V#@2%iBeTQfLHOfaHaSmeLuU0Nv;goY{ZtddF^_(QM?yC
zQJvU~e5+QkV)4vEZYN7Tncd97DqbN~p?l1vE8U$De7An<7RHRlwWm%*=EbGx=G(xZ
zO`A8T<LD`7<9G^uY?E@Aa^*7Yfvp4!y|Wkl6m1wG@W$*ud(g!;;D`C*%qjRH+1v@@
zkpGX70nvaH^~4qEc<&xK6n1E{2WSV{x?v;shMF`p;f(J=Wpq_bgMkZ;WVbL_z(84I
zFv;e}e79t2nlpjShb-I6eDN6DlKv&_RN~}Z9KTE8r?v3@8iGO=6Les3tbD)#G=rEY
znIGL6?H0QBFmgm>gcA0Qr3=C2uLhybt6Q92!!}kz_Mr}J^5&j03#r?qJmS6?c#ZNr
z0}|zQF}G`*-q_lPJq9~|ADMU=?>pGpO6FoClOfVU|MHQ)N2d!{UiJ}B6!636?b8x?
z{g2*!D;9-a!wz9U)h_UDJN^pieS<4Uz*U{^E^O<$c{8@sTmuX~c<b$;HMdZ$!vVgX
z45IoQ#&LM}fX@am7(@nuv4vM**RN0WaU9PE{}%GyOgQ4DnW5Jb<S_=$KVU4}Hq^z*
z2I^GdC(xHzhuyY{{TyeLBGYWrI;Qm(86>$FyX`12yhD3kcqy)$o36d5JFQ*O8upfV
z4jxLC=wsr|lBOj&lS%99bgchKnkI-yU0B}lT(bxq(SctLA1EE4igSNAi-wsvW?{>j
zswhP^W8o+PMrNy?g}h*v3VoAJ!0zpL-id6UX84<htg;%}?GSb+`}Fu9KTbF9_J>SV
zic+a<bv+A5c5U6B9-<c-baIzP*Ymu-YE1;^xP{m#!SVXX%mStE7DtR{VNjpp#CI{k
zInlq6GwG+nq-NET7Jv6gKS{MGzh-NzhvAEToq4etdG+GC^DJV;Uj(x$VXWL$BDQ1(
zN2(darz7JmP$Clu<(ehLv8ci3HvzEj0-Jlt8Z+RGx=a_k>z1~4EQDxFKl{;-)BLZ#
z#OHM{vZ`<2z8#y+s?>4$I<`<2o7+cp7=`#g_=ohc9NzNg-hHv~>pJ$D+1O6EuGx?d
zVt>8$;BI>Ii0#wxU&^Po>15bsJL)*J{TM&=1LTpjUG1slWKC*hF`l^Eg`Ktso6iIM
zUuDp=f!ht(6Y2@XC}(V-{Lteq&rCmSY5&8glj&i}R4lf*1O01DaSngXOWR=BvN&f7
z7O8?piuNrpDiei11OL|c+s{0?u5D#nzivbN8Erjr@j}?G*KlpmuHCV#NMtPr&K|xO
zrmOs&FVFdV<^&l#s3*pqYg};bU5M%q7y9rG*x!R~`q88DutS?=aSbx+{;j*xG-Ggv
zWDDciQk*LcFq;GYEJAj!gReeC9$Z?3?-rhD-TEY4fI7vnnYC7*?GV9EGJh8;Xn(B)
zuh%l)41veJ{R83C)&{p4952B>tjuCVl~3HdR9Si$J|Ik+S<G@^-~KdDy_SG011%4t
z>((G!4}ph18_&TP^fTW=C!XS33*-FJyYHnF=g-B~uuGR<)7<`gB<C2KWZq|9@mYPK
z>aqjMEa=E<R;*43-+Gf^t@3oEvx7D~K|g6q@4x?E@U5>-9!r<|ncwgsl+b4b3>{lz
z3S79qk~wV&zU@*1XG&L>rO&@QlJ25sz?_Uy0|%J*!I4M6#@%YnZn++PVHmjIh6Y@;
zylcm6;YXVpA!wMg^T;y=@T?1<%x<I|t>Q6!l9%(HGL8X$YnQjA2JoF8ra=}%4cue9
zMi3|CMWD?qz5RC`U}F!106=^X2U{d55{tii6hGt3{|9f3Yd~7TOd&?)LE@6BRjZJ;
zps<mubuUa^XLDAdXcv=;MxMX_@-wzoxQ+43V4P|g-KO-ffBr{l4#L8G990!Cj>R}S
z4<TqyAbfvLbm1?*{G8}Bq8MRx3j38zUaOb4rvK#^f1K*da_UDTxy+QHp{Rr{Esk9}
zmwx&6;dJK4CDH*_L_1s+V^)&C{pz!D9JDgw{q&vpn8V)+<T3T(7!KZZ7+p?7RHHC>
zSACQs%r-7ukbd#ePttY*KNcWxi=;C|K`vQJFbCy#4)&){P990WJn~r}swgcti!p+5
zHQH*tb+v<rySW%BdTz9n3X=dACLe(sBL;k-fmb*j2x=*ev*RuiXdt-M-JTAA{Z-nz
zZd2L>16qeLpyQc%6DG6r*dFQ3rHkovoC%|}#mG37UiXNfg&<Z+(8)B^p^<AAFBzBj
z%%E(SR--IDuB44jw2Z%#^&rlJFOGkm-rl{J%sFe*Dg*+J#HQVRTzJifK^onza0V};
zulykxR$3oQ&m96GTs{6LKmB<KIHtE%VCiMA*3XY0jkM=ZM5dXmsj5haa9DnH@Ersh
zRy80{3r|-H>~g~0xFJ1eaw1lp@i?6R_RCK(hR_~h)dds$^w`&oQE50!fB&POMwG2V
zTjjJzf&9$1%jxpD3m85~dk1c7%F3hj+p(BTpWrOzPEuA!e_uLz`C_U!3VIy^1F(7m
zFa}3Q($O;~)8BvbX#|t$V7QO*<{!TKDwPqau)cK-4w*yg(Cd2`avZ$~Pm?Hvr_Y{F
zN4`GFzRIvd#(|lah6d)n0{#?kDRznHLDO*RXmIKpx}EMb*{xbaB<9&uu{uG8*$fNe
zIAIK>?@4%$so{S`TPM&$6iR>kqYu*u^w&w*XkjCePk(bFT|9pw6s}m+1(GizFy?>$
z7yl|U!PGL@nWlXajDOAM_31IVrV;*cKKnSGymAhl0U>Q5=s2&uD*fs2{sEaTnnI8@
zs$C^m-k~u3#-7*1F);!H{o8;4e`2J+LVzBtWN0rX1f3}?l;U77Cj-qCxZ-wJIzfb9
z5hOwgmH}Nc`rQA7{@K^-C_Cc(;__<tiN6)AP$!^a_oVcB`J$zW<HaM&eEzj~`Prwq
zVpbnl>ne2W1o}6B^vA3YUYJVZm2ST=o0ayhRjsL^u`#_n{cai~1piWBXZp|o^{><A
zPJ}<oC}RTlPoeB7V^z*G6}-?bz+(+39JYf7sTBH5@vzz7$9rC!Q#|)&9Y$P_AjljB
zcW1%-*R`!m2U(T>8p@K!)Cm<9oUtZWuBj#MzwiOKg{P??&s@HMaJ3-qMmcZ~_0<SI
z@*0h4&SgEFo$1KYqX;d%2*;BM#?|m3B5&upjT>}{<fbF;X(ds-@TF<y2d^1?Q-UI6
zzlDJ&7maob+oupfcOaPUz<In0A=$pjlNBzET%NnIE^s{K0`nW!YgqOEFMs-bX~XiB
zX*StvDtXmclLDJQE+RsF-|Meq)W)etRPvww^`EDs=T8Rj6xIeB&BA%35*30m;AW&_
zKGG0US`7|juz~r6p~h#Z(kJ8n`J0&KwddEJ^F16xpD_*WvGZrcS-4~UrnChk!rE4X
zUAb=(C+;+X9QRQAW-ros4_~4vx?&^&PW@Zy@X6!B=U2C^NdF4HI0X%d@W(9=i9|n&
z(sZ@`Iz}}z)Igs`nh%T&r7ylY8soMF0r;c0-%aoD!`TLG42INU_~qfl%&8YK4q%`K
zKMfSoS#tRJF^qIGq%d8TJ~;Fi!4G?)Y@^C=!S~DH4;ninFpGY>a?JFFA0B)c=f&1k
zkK$a0VR&H`0k6z0bp$=E!zsjC`1FJTo4@?zSLqXsiUX84i}~bAe@|KfFO$yJpp^g7
z@BUr{iK%pI92y%MNvBR7OWo}_-f6c6d+{IyRPe+Mc*7VsT-~B_ILvB+UU-2HxDd4A
z<xD{s6!-)`2XKTO!O&UG*zdv__wJi-k+o)Tz+PEHVgJ;*6X_Crr@FE)l<!#>?g`pE
zg4|;elK~tbz4>l>8+nKsI1KsIQ`70l@#E>tg^L7L;lQ9Q*hVU6j;%nEDMc2WW-h@0
zjPsI=47^H!k9`>@P(XRb6(r=rWDJWuAY&ci{=q|8-8<!rQz)f7_HIcZ>^YcLEpATJ
z2>i7uuVz0n&}K0!Xx+xD9OvTaC%;L*`tmRl`2=5a&t3580`tKljES3CR;54v`7dJC
zi+CBZ868h&&z(!{-96w0tC`@xnLGbr^WsO_Ry^os91|#YuC!aoJmG%6@9jU7-rc=F
z=w8`TJiBoIBHMYek1b9#02K3=G<ELAH4OL!Zeqyz>3biBY-13Ld+iRQ&@5TEK9vJw
z=|~s{d<yl-UxIRhdFfoX>qP0A20vbCV%%B0uZ*D7p20im>vLxaLaIsIR&Pwd^Ztk6
zsp|>g@9+s%Hk`e1KHa!<HH{3DeGdm+Hj@`BeaVM#DZ)c&(zG}<f<zD*gF8guPa;>$
z-Lew{^WyYlUhly_#-Q0RPn}4gfAe*^@~De`RD|LD<kgGt<tp~2-jxpEINZAxrx_E8
zG^TE#6YS)f)9EG#q;QzLFyG|bfBScvtwLJ@{>}!sX2JUnkXPP_E){W_FQ#%wFi8Cv
zQjT4gH&#JYo6?8K{qI1}%1s)v9Jh1uw=2-p1B^H2(g#2?h(SY#GS4lPZ<X!J4O>$)
zJo5KhZENN#<)qI~9Z#PkPj_M*e9GK2!g!tSyq>Diao(;x5L*y!+psa}ldhfPE?l~l
zP7&x~y7buB8Gfn)J!=lmJa9#twGA5lT{-ObB{RH~3Cl3LQb-sOiVzGZ9}LJ<fx|er
z%obt_;RhJ<Iy<`%9b-*O9)}_ZGWKG{i*i7*yca)<cq4qBE8{49in}_uW|-eK24~}T
zmj7as2~g@t_pdN^@Z<8i7`LHo<$(w!^3%e>@lyI&sw@LvR@%tQ|D5zD&O2A0l|ciQ
zG<`lYf%5Rq1!RU;*_I}d4{qV?K6>tS`m?|Mi;z);pIiBzK6x_L<M`OQetp`CQO@~O
zxSO%c-_H}k-b*mQfxOP`K%3SUJDa=w?RViKibz<VhYZK~nwi0s(8|lo9|0R^#sFJW
z{Z3%Oc*-1F4(^seu7W4<F!#Du*hLn1=u|ONSqn~u2$Tj_@4+*tG4hro=ggukWh_x9
z<{NPynwX*yU4yq%H%`@7WXM?<FS~G7Ylt&bsmhm5v*4xCa89G;w*H6v>YX0ynNO&D
z7W!HRPMkrq7mSUJLHj$=Qw|0^G^lClK6Cn1Isrd%VL_yDr_VQs2XTg+h|DhX{`cQ}
zE4_uxpv+nc&Z|3~MoznO7JUH&o&jrgFXmS37vFx<fdm+MuCdKU4BtSvbp$P}!#V!`
zfj3$BaUcRrCTQcMq5HvCU1jE$KN`$tffG6ouXJ^QOQ+IKWXAnCFkjn%0}x$8WBbEf
zgQ<2g+hSm}_Z4jfzVgZ&1W5k<S6@Ux{9*zJevWZYr<gMLY;b=FS?K)5v*{B2CLFWi
zj65wcj(fy+M<fo;i*ot1YsKIAERLMIq&oWbo89U3wM*1fk=7y)t!rsZPneqwBvC&6
zt4}^=b)WLhtk`Pd$obQ(1YE#8yb|ZtzI1T+9@I#)5>#M#o(R5p^3=(64?d#&Ee_{8
z(J`oB`V=QT{2sW)d%om*KC^G)Y$>{WHI9g)+=6K$a7I>S0Jd_wPRys^xiXBjsMDhx
zht}V*pkx|nu8z(hzxOVBCSz5~{0+^HqHkQfdMRBxa}GU<G6SA6Py>zn9^e1~KmbWZ
zK~$s(K4Zbg)$Xpef^4uZ%G!dAykQkOIB@7g9zDvO`&a+)tKiW(kjKE;KAg5skmV*u
zStU-8%ODQb3C6eYKE{0X%W-tDq45V~lEXg5xIV!_U|{#LOJ`DS)3<tc+W*?_w2z>w
zu))9=+_LN<<9_7C@d)UdMka8@r9tC+prK!UfD-|I*L3*K%R1-ZWW2^fiqDvTfA!U;
z7_SK=U>rO$T$%gi3pE6aRTBJ8JCOLvh%%TyV{V!QJlk4Y(>uVdANjHed4GJGAPr#j
zYDd1$6`^K0Sz6bS{s&~XHf&&xI1ww6K^n-Gv=SUDK|j0L+mZeO+50fMK^gj)^09N*
zJ)Ggk)%$Q<?jXoUy4s0zz{MJF4<+q&c6O(eCyu3i$X3>BFt#=_vzDAh?tN|j#<U+t
z&fZO1V^zArJ+A2N=;=;pE}p}lf>RX-s7_rC(RR_fbC@8Li=8(jtJ8*+E7Ji27I))>
z(23$!HUH^Xf0NF1T#N104X9bwv^@Q<|MGuK^<`{-ivikItqpaH()QPPrKgP9@yqAa
z-yHrVJ?Od-^R|sO%Rw`%@&C6!{WmOVa}fZ}Rq)d-9!%l?vmbqw-a{r9hx*5c)4%<9
z|3?HLs}nr{FFya~I9pQG#e%cfkfnCQZ{*hMH}agT7cQrhr%q#BCrYBgB*OLszD}e2
z_Td~j&-~F`-$-Ve#`L4c2IdDGMA&XF^tPw}@OOX77H5NOfnny>YIxdf>1S_$5O$Pu
z#&sS}OtWsdz-8^)HEEJE**qtGhEw1#Km7;nX!oFtnRE@k=i|elr-M6oN0w4EHMwGV
zHgJ>2_4f_HbI;<a?4kWx9%LwDK6FKW3APvKJ83g>5r7xGp*)pie>BUe0buIPz8(Xc
zlLWXd!f|aT)}Oxfqx9kacNNVdONQIVoxgA)`tHhqSBVE*_+Frsm*Y8w6b|J))A_3>
z9Y=08Gr)HE#A^gf?pU)v@Tm-&mh$*DvM7CV6#Wu;-9D7S1d+_rYwI?qp99n8xooe8
zo!I;9Km48a7K=R}!h_D<xSIYG<6zKIw%ZkJ|KU%Eo6b;E{xq;-k~#byW2=5u37xoj
z<RCnJ4}p;Z8^*&-R#(rSOQ()~6E<jNy;z6=d@GQ_$|jvRkW&~pvu?=yLhnVMGx)WX
zv2e>x<uvV!+ArifN^@q#yV!A+EZbzMCIIfegKx#Nk8pOk_w}Sd`>%hMZs3qJI6!;s
z#er^c>FczA%MKh}OVgkH!7m7~Age6$u)OXbbMc9b=TlEdXL>?r8#90yw6YOC{fF=U
zI5pQbl0Cu2d6ntM$nbAZA4-oH>kB=d>EB^{(ZTMbCC5I)Nr+(=ci|M}ZHLzwv{24`
z;leMo)So?j9$tI`z0WM0z?X;J%He<d!#}|$#g-T7VRH%UnNJYVTI^JhF{HPXb?$G!
z_{Vhg^zoSc#2L4QnhorJ@!?O>7HqZ#S(GD>FMtosf(IUYeJ?@NJJ?Pd86DXEU;pLL
z((w!D(tR`dz$30)y+Qw$q}}kvJ)5_&_>7Dm{Mk;kvv;BkpFVYl073%!k+&a%5Rd8m
z6>NZ?LZ90Aq{Bb?Jz$E>uoS+i-uwXj^676*rW@evI6ABIeuj@Sxo1EqNT3KYF1>Jw
zFGc;p+q9FNIDI;@L7EN!=O2C)wh`xsO3HqWzV6(1wc|!!P{Z{J%20+mdf_Zi=V}(#
zY$f3RwX}o9TVj$rk+j!!`D!}-_3?CnFfXW8u9!j(IDYLyWa!z447MJbrmeL#<`frc
zn{D<gy71RWzfQNzm<8>+I6=O73K^>rr?-p!3@~*;SLi3$D#nL#NRHkj`|1khKIAvr
zAddop(hjoXe7Nt;w63WI-dKSw1irodemd~vPy}+cgVX=}fBg4pY6J&7bQ8f`e6}ES
z|H)5&j-1)bHl)+wDgmVP=cj2FelCJOT%c1<X23H9kN){TehjW7tH9rsX<gJdN!!h8
zcocbS&i37@g?_fSBENx@20DKH#bIQCW3lL1<79+LL7Q%EVjzv%NxLx7EON^HT{ru%
z2RYvSaZNqTu`J4yFAVc{P9=AFh;8%!z!^Tpb>+hm=tbH2qeE|pd>PwrQuY}3)Fb!<
zF5yRcKmbu`%>UErdT)0+eBv9%Ek!WczyAF{3cQKTFO=(iubg@1#trO-+Uv1vVDD>M
z+>rhV`|D=>SWj`>S3?hV*m0cSYq8hv!C5|CU6HQ!_oiQd3QfWbXW%DpUHb<ge2Bic
zIaSTDRUWUoHON%7->en}9y({<qK$vSSbTQuXe_wZcjWk(O|uNxt;O!swxSg{XkRC|
zoVH%OcqJXfr_qPAUz`#5r;tAnyz@aigblozfS^)>`wft-VNR_>zFvyM-t3npb7!Yt
z9XXsn{)z=sV+PUS3&b{k6g{bezHOks-}~`T!ycwSDZNe-sC$C>=*HD+5p*yceuQd6
zR>J$pk{1XfswR8P>h#Ay`#G|&J5pd90iUM`P&vyy+}TBj@KJ-n^H@6AbmNr|$-+57
zS*d~rjKcR0ZN@^8{t$lWysy1in~%Kv7~|a0+rtPsTQFZhQ*YrPJczut2syWWVw%8g
z0-w;E%m%DI#l_BMiTM?9`Q_nHkhS$Ul@XBLf!*#K$}S~)^9r_XZ_WWm)F;h!Q=b`V
zE_Ymy#Sc%=fwY};FfV_J?pB7KXcu$%@4SnzS3eCfEhqSD6#PAN@>IHZ?HV=`wg6+S
z4OmlhFvDUw^Ikdj`6uuaeMGlNpm3`5T3Ukc`Zm6}op0<)w+Ya?d-RJmiI1y(K|}fp
zwuwVKcBL``!wBUffdsstcF$uG%2t90wM+LSyMN3xe*?}L;3|(RLmsL`?<vCvCVmNT
zdB1=Du8pe%y=NA1rqkd)!S?cX=F0i#3A;9K!|$@4g|I9fCg5a}pp=n5#s{1DQ(*7h
zN-<GteEfzt+YpBh;fOX+_icF0F?924=x;at^!)>GrkTA5qs_CBbEdHgn;rb(C1{`E
zjxv1ulgO$q*fW0o);o;<>uKiE1l#83Z3f+j{?OjNnHK3^`|V!n@T>Ik=bu4)=-}|_
z%kAyxKuxKwtu6ih$G?N@Wkza(RKbsX1UE0mA7&QqqJKr7kJ;WYf;Wp6o*}8k?zD>q
zfRQ`{e&V*j!+p0>39|7l=tP+7b1eb)3}!!n;|g>A+_ZP+Ze+iWk?kfHLNljM4zth!
zxL43t7eR&XMSe&>dhgv$Uo+nbn+@2QKBT|X`+*I5qzO8lpU>(;!OlEJpim{Y8F5Yi
zA-LtUE-=3j|C}NV4gz&#u{1lXHd^Ia>B;{Yh~GfVOXx%<ln^!sJnA2xKxa3gZiI5&
z21`4sb1SG6!KYQ&==RaKpS}G)L5IkE=*o3-phfgoGYV^S8i$75iQwq@Q|Uka^?wdO
zTNDu3@M>?cr~iHrnMCpBz(h2a6Da4tiUN^6eDS>a-D}^z{@XzVq@o@g5yIY0qWKK6
zm_JLllBqKzJc2pM@dRkQiehk(?U*<;(wHvJ6(=(P8CNMY^F~@N%Ji6EV!lI!tNXsu
zT=4^CS>q0AN+GaL6zW@WeQX@zd^5UV=V}=W+8rF<k@A@bHSGJWMod?#T<E@$W*sRf
z>bWJhzcHPv0>d~=skgT`UFmFR|2VfQ@Ttt?+=K5HX~l0~s4?&ZOwWDbR0e*NJ)d>H
zc|2oI@y!dCgOJbf7cO5)b3p0_97{TGx)9W+Aa06{+TzA<zZLra?aMDdAxyL+j6=*u
zR{!IXFVirvZf#l?d&xQBJ|>uE6lT}e*OSiS=;|K2gE0^W?ij-8Z{k2OAjQ?v_Z~6f
zAlPd3lr@{)(^dWDOfIfQ*T|@&$dMk#5UFq=3{9Ilx4I?_X7>jN(;Wnm`3OO?m_Q;5
zTj7^yG`0?-6d%8I9z~4o3B9D3<ob%1mWUQsV7-r0WQxNxFg&xoSf7XxzYPwh4kpIg
zOg8Qthdn8jUNaRHoyI!V@7=u{OeGB4)I0?YG(Ju<0cv<$Twjl(fP)3vaT^0OIb3YN
z9(x4aMsXMndimIVcTk>PG2&PUk1&!E4**{c|Bs1!ZmcJZ5e(V@lwpicrufo8Vc%3_
zU7>!REC!Xwj-)%c?#9+Tb2U0JPCECDOuve;$c!o)A9YlO@Jww5bbHp0A3m{l9`x0o
zB1k+UnBmIJo)C082x2*lbKJJLiv6*Q3vH0@?U+K>Bb)`NQL?A_y&ngK`v*FC$RCUf
z@59)C37Fmj-<-(gTmI($)xE&`5qMh0#E@425tt$6VJy4}4Vu9quhIf%pgF3isW?oa
z(;1BK8n4P|PGlMqv49;cB5>sa0WogVAWVZk0x&2t;E<8^j&seIb5akyOTkxTZl-oC
z@t{Ed#Y@{}SoAo2$~62MyQT^5({X6zs<<|TA;7va|MmIjhft2{J^9v=@6SI3UxtB<
zBN+FvDr6D`#uT?6I$9KzB26!}Ie~PmgI_@-4*TyYf@?Y(2Z@kAi30ETRd+d85mZnL
zF!B4h53fWK-~QoS-)*mlb(pu~Vs{4s!dQ>M-Hee{VL~DAHjYEHTg|Rw+m(jefRly+
z1GD6<cL-McnqZU>c#Q!MMt;wtU#4|6Lfusa7g?EQ&>+c55Wt_X^6PH;)fb;4bRiUT
z-Q@0Fq+tK#*q7-dhE5HM($3ZH&fr}g;MX|#sgP`nepf}i*XoL;&8$j9Kw`Y)`J)KP
zW?x&ls6Mti(D*Ey7a-0n{e69@ViKVl&D}r`2Am&VB@KVzWq{2vE0Z1~sC(UCM=@-D
zgTPfeXAYT6dV&YYBOPPM!Tm`!CRGw-=!!Nuqu2A1d28|8%RZmY;gl(lG5Y$<`SWQC
z$GfYxs(`(L9Bva*LE-CGv8sI`!9n6{;4C}})OJ;_d~pI^bQ_#nO5l(Y`P0y)%7?2;
zE?m8gfbBLDWF3GvN*F4+S9&_2%^BwQ!AMtGrRK-aW6aV081m0tW%V<(JSI#T2f=4x
zrsHdx!h5#|BbBuQSc5}%(-=V`;=(c<J(0eVd*jb4;T;AwbXSo{r-I;2WC&C6#;Qee
z8W>EVG*9DH*GS`j=P@Thzk}oKZB8EzP8?|MkKia3JOB~V;AYu4e)T*?!@Gey3}YB$
z<T=uu=}ujR^A8v~OuhLK$K4g?aPdn6q+=e=;{S)ecYm_uxb8fw8z2FY07MWZMN+aP
zQ!i7NY|9Ugy|Q;^cP3^XUeAQ>32)4g6T1`hFFE|%ZfwNF>~1)`u`zzgBg?WRTQ5r_
zMN)hM1V|7M;!P6o*M2|Wlc%cg?c3e=HW~z4JO%Wvs?3w;oc!j=laI>E(wWIGI@T-_
zq#a-&%-fxOrc5oC`!C1k!=IIX(|5XZOWkjE@bTeHvb+MOs_*BN?kT-V$08t=l()`(
zN85kDq=EKf`C1l$Fj0;Fc}@@P55J`y0@a>g6(8Ol{Gr-c9`+uR55BHCdRA@j4`2L=
z7hN4arM6MF>&1AYccD2Kx?JV3f5N`8V`0rF!roLl>Qz2JjAL=2-;8U%hKGJk(jJ%n
zT~@orPBf&W4SV^uSGy$*$j)fXcRpjngKk<|eBV*g|445fpd+8&#I`A3)I-xnjwqL|
zJEFGodz$!TE7(uy!4MOldXygv5;PcjUh>$9?LF07Pbf<WZR?AA>yrK%yCCq!6nzO6
z<(<Uu(-xoALk;;O`b_i`uy1^Tf2A}#J+PC}H#C960=0AUHR*><)c-{N=Z&M6^-x^q
zqpjZ0`Yk#pS!qDnI{AeBEOv8P^^|@YyF)f{J*U+!3?YDodM1;`y*?Mz*Z$#i&uX#M
z#qN{p%k9<o$M4f52k#-CQeTQi8~8g0g;(Tf59vX2_ndY{QG5ECC-iw$`5RbYR{O|q
zI4{X(y!`e-zlk*Xw$-$oFC6t52=fN$x3pOLog;5+vO#aFNHBSE=7bf;P4xkoY`vg9
z%_~O^xsOQO@^g9!#()wsK3hQ@d{OrJ#<92hNtk%}f!&3_z98TD-Di|n4TAZ6=0_e>
zyCxrbP77>KsZ6eFQ6BvdCPUdGp9jJ>UU<fDXnt1MJfyd`SOjB#3^sZY_VQbA_&eY3
zXUc89FZ>xavuN)%jYD{QGkuDN4c>u)7XUt@$-{%H=gOV)V4Kqq*t5<3Ynr6|j(p8Q
zEm%G;KlP#(89P6!M}Fx+_MH8cktrCnwSJP;=e&_r{MOs@^(+*p2(WQ{F{OYUmy2$A
zutUG(*_X9AkUFGm{13EAe?sN+eJxC6(GK;W7dSj#ls}}O{JP3%hrnRr4E`MeSUiny
zxuUvoR(*Wv`U9C-aP%YD^-cMk&#3J7KF9;pSjbB|b>Q^_e)viqRv|e*<jI-o8N~&m
zebzG$L(+fx11!*^-^JL3PxD+?+whj`>xX){Ks&-1jeZlmPi@m;qRZ;PU1VIONxicg
zTRp2bicezkh9Ha1k#$Zs_r@CsHEDUsKKnI|#i)PuzZ<&N#1EG=iS(}es4NI&JMuR)
z(Ro7s3)%=TSfWm#uS*B+`3DQa*FNZt((bU+B@g^BYX>s?;YYO?@1xooguXJ1ybddW
zFUU{PKf6wQC_Gune(u`E?v<l&cHOtW(VbEs@d+(>U_lOWUsnH(t?pmYgYLs`AC{hB
z8}_TH<}yLQ)%DC6vdE$p`j0QEZzz-RPJQMV{PrpffG^3H9#^|~N&UgSk3XWf6t!cf
z7NIa%hAr~eExU<*L-QIe7UEmyObEU&pMPAw@FcqHt#fwyBCk9U#s^U*eByuysf;x~
z|EZ_6%a1-^gAZ4`NuT(2<?W~Xj1LcIy_1NP#iyq3<d9Nvy_pClX7+)9rC)Yb?GfY5
zcQxO@E)=}D#G+b0;dNSV7H@{KZ8ZIN#?`M&_y6|ozwb_|&E?Y$e1d|9<X6=W(GI_G
z;5E04*92hSZdq3}9Ku3({YJ30jy$xy=!TuWUelPK3DnosZ@8$oHtRhv+MHKA@`C*0
zan1X@p*C>*;=@_t{_MfmT&BPHsZV!L?tjdEcs`^1zRHmP+e>e}uFvi16SYW}9b$9%
zJ*FlZBfllS|ENXQ?+F_|p~Hh(IRY&-I_J3p%7-+J{TWNVtg+MAzx$o;swR4Qfb*XE
zdN;)98O=%Dr+J@?Y7<`9*cki1NxxHhWc>Vw-ZK7gKlrxF_qZ0iY4=NwEjXCVI--6b
zJMX-z{L|;B4-IB4);urYaZqu~@>62z@g82?4`t;?_{<Y@;F<@xv)c~4`z(L&{_d4S
z2eezs6+gt~gY1mY9{8sRwTS4X>Vg&@kkAaGZNp2$W9=g(qKjG(zj=K`<EE?UFLVdh
zIYL*M^6>JO7Kk3v3sV=~d(ZmQ*Qfu+o0k_gcW^{?jGc9OOZ9X5q{JhdkoE&s^^=Zi
zj^I`4&%+WPyfY6#$B*5X*pciX)!tv!nD`SayN5J+Ouy)|?DQSgM;1@Lpu93Br2nl^
zO0;z<ef$WECSFxM743u`VzRrN7fYzTnVVrw5iDp+u>VVH!w!q*Nj;e3b5qz9eux+K
zShUN+So%YJmfir$-arT6_vXQa-Fb~KcdGNji(iamVjLni@;&JH&Q*PiQsu@tj4>GP
z0t>zVR*RDG3qSwFlUi)E*JX8C_2!7$S6-xfU2On!E!0K&2H+!gJqBk>`WMs}WnA=y
zk9|tJY)c2t#n8SSlTBVz+n`MN1qf{YoF3L6(gO^3%GE4<jBV|5c_^!L(?q*oA8>oh
zr`i=|e6MP;ncHa1Wqp>hyWUP_j*(qW80#=^_q@swd%MPPP`dJ>$1&M24;NXu$Q%6h
ztC>&om_T*uHPv}`_&llyITx5?0WST~hkos#^c16GpE|0YfSyp@m7fw{7P`N!dDNHG
zW*ibm;0T_`G<cj`K!7xTKx9IX(;TaE<b^|Q;#(Rou%O}7PkhV|b?K+^Fq^q7c0hdb
zbuC&@eH5T_W5P=X!KY*ot8ScGK7r!y^U;UAsCM^~{uuXNRXO+t8MPVYVQ7!1^^5z^
zFlrxJA#apF?ad|W$~be|4>V_{ekeZwA^Ci4nLg>UQ~HdL>eL%5lZ)E*!)aBLXEh%F
z_A@{9P9R5RZ|qjY{2YLj|F<<3|NaZlYBAaUUYv$Kpe*`kACk|eKd&~PIoMBs?33NT
zoqEwt{c7fFj_8v?yr?2zRnF2ySvjrwcgCbw<maFM#Lw$N_kJy|k=>}S^NEkc^5H)b
zzcVU-@6I7vES_VBtHW>VlMCu=$dEe5nar)yw`Xi}lzDX9r@|-)loSnhix*|y(Hz68
zuju6<E&O@%sZY_xGdAo#{lbA)x`S#1880)(jFn)MM-_HUewf`7x2eC$+yjv;U}WJX
z{w?~p4z@h%)N##u@8w~>=9O=$f9f4oq$3Z5nQLd~v+KHMfdYB++@kb-NAndw&_bU}
z8uNYT$)D?X>j5-<ROW@xYH{^J)s3HM(Zaj<aOIKw^Wq$zef{xkFRAZzMf0!6J+@)@
zK70<Jn?8I@b2m!&j>?lAaU`(UyP1CIuHVdwFGoM*6B`z?9^bqqyXRBS$2A}FgvyYe
zGiU?&bjxwoLB0UMt~!ig=>Jj{==`R_zO6CB8TA*L^V_F!3=1|GFXG?XxrR9vUgDz7
zpdM4Vj_M8mA80NOKlt<~p7PfU*t4A7e@?5OvYRhEC$mEua(D*7Sc9Elne$_D!6!7H
z-Ju8T`0Nw<v=#N5{x@G#;MoK(VY1r_zLW=)?BIOuUG09Z9d2k3=*wNx_~N4K$lK~;
z@p(27p;nSV{xPS0^sOV^cBQ!`J7s=>dJYA4g<dQmJfc1WI}!EI$YgKf2=vTCe(?u-
zo^oBg@qAqUOFnss9b8dbJ{wE>0ylQffidH8?3LYuyi2z*0BS&$zh`G&7T6q7{(0bx
z-?kE*`vZ;mn|+|OorNwa_n^iOln=?nkNx0>-`7j^8mH|0h{G?cZ%f<y-Jj}HMe>pO
zV&-18nUCjdpOGE%0Qi{tl~3;5uZ3>XP53a!$PPR#4n3~A??p=p(m{UTR$1&MyIQnD
zIgrM>LqfgM18+W0%kwQKQ@vLK>DkHg?x0@CW!{#*c*dff$XIFes0$}G_lfTzhs;m1
zNSdALe(=-hG%x&q_qk7f+Mgn05e@ApyPng}WLKqgijOgvSgPGPqxo0HX%}~&*1|>U
zAW@#fL@CNiBGquk^GTH#{%J|iFy2=`_(l0>#=Iv~N1k~2QT1*0;T)xBZu%{aQ(n+K
z>QVJ4=?mfaC{uRidr9+Fx3nOM#RiW(^l-OZ<9@0QpS(M!Ij`q5_Q${bC3>)PNutOM
zlZfCIzmz>~&3W1PbL#u@MGEHa!1J@8)hFvUp2pWPwqdMAn{ZNgOkatAjGN91n?ncH
zFVgsehx)E)@|Pa>2pbV;5xMMNyzz?^Brm40Gw?sX^t{Jw>;T1Q;jkMPWi!rw<?sQ^
z!)`qO!dIzW-<4l{N&bX60{rL4^lak6_N@1PJ?lMs{2k2)zYy3+M;1FUR^X-GH)Y%3
z*Ww%&eV^0fdFGTasoo#abKY<M=(|v=52tBQy;RF0EX^3|nWA>H)cE3c`Nr)maFl^v
zmk%I=ezv7{?uMRe^BkNPpg6pkSL1ZrJmx}P)0lu~BeY-mTy|4Dr*`^>FFvonnEaXQ
z4Q+^E)mUDeR;XN`dG0wa{J7u+uHJ=5e&w9n654*glwrHhfm>85%U<h;^2WDu;Nj2*
ze|lNvazMVa)20V3TK%NPVC<MopMtr`qgvqj;wvv{_hvpbOg?1xDl7c-F@@1CXvMGa
z5KrX|5!7e;f7gW#FW<1pgfRTo`<lyPQ9PPFEq}s7cd(@2%Gv<N8z1}l$GevfYmQNM
zfjZ`Ks<1mGdEe1|9nb7|Nr8<y*!1CyusL$%ExjD`Q7s<U?qF&kS>Vn*6l1$LPoGem
z@uQg2eDV|C;f{VSdYw3WT(++9iWW(}c1-;#wHefZ`VFitc=_!^-Hq?@rIeHYQVknL
zFxI}N{NsyXP+fe3@uJ#JY?M6Gm!j?9%ok<8|KlHZ=ife|mx;9?S$#}C5y?2wZ4>1|
zGU<6<`Q<r2KH`hN@CCn!zykmC!sghKquRytK`-ojN#h0PKiw}9A27rI4!-`n7TBm?
zf)YCO3`Yf_{*wHhZ0nq`KdId!T}b*}^jP}Rm%en1PnWRBgKf1i1Pc)-IurNOksTcL
zLQfim-~R32?*8x(|FHYq=RVi{>7V|o4Fdh$5gaL>d7+^{aNvNq^TJ>V=MUbC9j)pq
z*>;r)Te0!x1G`V`R7Ix1LC*-%NfLh??L~FE*;@Ck96t*>cvE@*PHn}fT?|-t$s!3?
zHquJ3t1_ZfnjAYN1LHFfbevd#!zz0oRPi~O`{lm~!?18VOja;q#SS2BX@8CZ1({PC
z3`u@c3uLslxK@DjHZxmK?$85a9vJcY5Ej9lX90;)UDx2=&R=op`cdU?ug=J#G0kn!
z$>;@5&Yixb39L&zWKpG=G9M;`k<V(wM<39Ncwu&2Z@|B&&I1EjI+6^!v#d}#52{~7
zGlTjwF*wkmh=~ql-KRIZKDzf|W5ghx2LXKJk%w2T@~82;BBydy<-=Q#bpH2hAkHKr
z4_Vk=ivcc<72F?C=YmzTd(@F;YtwhsLH58{Y3Y1!Qw4oYgKTyZ;f+$Z#H0gxQE&U-
z&)cXpRGI{1i|WhDD^7Bc1_6Atmv8Ixi449E$#>&+Nd}z&Rw<rU1Iol2+bZJ7a6+t<
zeR!8X3neV+BZ-~-s?e3LO6GwX`19vaQz*~q%ssY#zZ&<CX!3)t$@XijKqhJEC@|5^
zw=j{(0O*<wlDAFWNe~8<t60o`*zkfJ-LyG@KKBET`u?ywB-oS;$#sFofp3y}afyU@
zD_A8}S40y~(o+wdAJD`D&YB4&2DadNL7fQRT4d^jhMBTb7Om(={Hi+R*iDZOsZ8+R
zvLZk1Wbi{BIin5^pXgyyoibn%o1BbfD7A!81`H-XBKvtv^ytc`jKG?29-h@h3ozA-
zGRBo~KJ~IggPX@yhy5);>ZN$Xi@ea$y`TmQOtKN9fu|1bS;B7gKvn}-23hL6w|b*8
zqGKlBOgvrCWCq)z(|PqIAGnH#AoOI=KGnlV^w5h3r{vEI-PGv$K@@p{ul|t9g#32Z
zDR$lYExmp7$9kJ)mlj$4Uw{4ob>Dpchutyiz21IhafieMO-s!=4>}wxO9ec#-m`_<
z{Thwz(wh%Ys4hOJ&NqG$hT&6mqxwxF%i#K5V|307gy?v2u+m$jI`!k_<5VYkLx2bM
zJhY=Dh@UZ~<c2o<#&yUroBjv=I8sO7D~N>xEN)y<-B16Iuc2;V(IAR%gHx~Al6!gg
zE-lVD;|>#@1(lM&$H{U7-ZWrA1rGw~Xfc7z0;n@ufP#O#rjA!E1eE_&hvjkMf**TN
z4}s~Z@M)?2dP{}HTnu>d5q!(?LGj~3KHqU=<vNSFSk?cKbmTLCJ7qtFvq*sR{o=!?
zB95w)cSeIQcJQLD0Y7{jJK69}Zt}Ox2nS5`k8Rf3{+LOnGir1Aga8jd?^hu`p$;f-
zgt67-84V)w^Gu9@-5#}J`=tx3<(*ee4zMc>gK(RVC5(Rvos7w{q0D!0+toew(Vugt
zcbD>d`HXzL%AB^IonM#;{a63|UvxVk-{1Y0zy7b?ceFbBh*s0nv1J13J}E~Xeni+k
ztag#NHF)zh>ahH<d?Q=B^Y$fmlzs+21K-a#dG|fAM-#2;12A$`8Svnm#b_slFQ46G
zf`B*f1Yq~X0}pjy)C4eFDc{grDHpZ74xg-eUw(~FG;fOk!SDWl_jfP;sQa^Tf8B4E
z;@hzKC)BR(lmFf!In+&iEC$rrmE_W%^7#i=_@9+uWs=8-;#g#~SGdzxVOvBN*f5yG
z_p><a9raK6v>cOQw2$nF#3YGsqpzboY<0KVG~TLwS2Ebv@~Y|-?F0in4VmSqW#6jD
z+f)t@sIBLXn@450yLrflj!FwQ?CKM^XqO?qb$ea%7<{s5@Il!dzVs0dDA^L1iArxF
ztij<Kb@q9?l((Aj$=K6=y(Ph9<wY$#<on0GrMFLEETW-(p?)xE|Hy8=fg&B43}cIL
z9?H3G6@F_S_#FI@ZBT<FaC=O<u|1}8=dD5p*w|t8KgCn^hc=0UGoN2Lqk-Z@*&=;B
z>~_2S*lyK9@<^HUunX>&gbkn6c}Lj9WTe^z0Sdlgx3-p))NsJhWk;DvXLdQG&&T)U
z`KB)ZmI)jtF;2=qF@QwoHT;nNyy#nHxmUjAQS}w*zrmBf35!bT6+FCuzXr|f`^oq4
zaE*3~2fN@!J}Db^_IX^3h>*hs8lPp$-7TPl20gQ%sP%fX8-2=T_dfSgczEH5MA(h6
z;bAFl4TH&RBF1*sJAe<}!7u%M-di?0D6jXc9N8U;&+hC}zP-3iw#R_(9DY~rDGQHi
zcUf$XeeV}N{rLOUmqyN2O;+<D`ji&rT~y!rifoKUU*y%;G(FG-9o9R*G20*7KiWh-
zW3ZpM12wtC_ub#6ooCQGI^fSiJB9z>CHwrSwqM0p(N9G>yBqN-r}OIbUXl-I5%HBJ
zJ)}Wbm1X!B*|pO1ef5X6FpIv?1M0tcmoBB@(;a6RH>i(<{eY*xXDlB@znM?VviOKT
z4&w~A0cRlw5B;u69({23Y9XHb$-)XItGob(x-UH_8~RmjZ_Qig^yhg<#T$3dCp6fb
zZg$9a_REj&mJh#9{<OH1MIF3J?1$E*QJLaDqXZ^#Q{cJ><t#H72mMIyN0dLxgu~mI
z%LYQPV1+CuRrsVH?H=1^AJwENi%{sVc}yjm-FiubZMK>4IIDWaB-VY(FW)g|tL6PF
zJ3IwGj03xnd7*{-H<!ihJxva<kcT=<S;!fwuSh)%*}HXSl8$lTC5>}<D9HELHJxre
z@#FZeS^YKGaghJ<fsHc$rq8@z57a4#Q{v0+hD<{35jM1!d}fBv)bJt#i|o;j&&*g?
z`5$)X*{e6Q9@PZ&F4ZUO9be6uf0yPfSS0hV9{w{fe*cyhOUS2Dudom8mFG6~-~a31
z@BVvzqUNgFivQ>9f7N|U3z?a`WE_Q!ds}-lAnY`ALvEsO%08wKlQ^$2M%bo`!6#YS
z$(1*suIo)T+QQurD38h$Z50#IEFkt+ngz}pqp-sz27xr@4VWwV*hjSWyX+l5!>(%N
zlZP*nPK(|ZMxVj$Dh1phR;a%lUqlSV>YM0>dQV@B{?^AH(hC*5?WXXnns}qXL4T7S
zqj*#LwAz1UGnqx(z{53Oz@X3hkn%^{Mf*hC&4YpmHHpOnjkD_W9amjc=EG;u)=2Ii
z`4|>uGS;vUr$41U^0x6geKG_e&RCPWNg294(7exH_{`N?y#NJr`W@7Xox*mv%7=%n
z`&1sgWFG?8{U8>;G4{ttr3hpxXP)1%UzCplA13?Br$6mTd!@HRX@lw8GS7le=#1Rt
zB{h_Xu?^uJ>>;}Ct)GaG*ekzHznhnAcq<l1g1_9Qx{p0DC&Pk=(`xI|ztJ`_{@ts7
z(c|im^WbTR#!2iP!NPDpE5HM`_f#jabr#fkOf2nE3v}3{G1We`$1Hl`6Eo}tf!}7q
z{u$W={sUC;IS;7aW$^$DESSs(KNeuwk4QcbfvJaQwcx-Hy2!u4xKEvU9&<dZu{#S$
zc5B>1*|K{LW8rg>!%H1EG-kXcVa%aWPJ88-9%12!^rW76qFMYHn=<)p9c7~|R@c(;
zsP~HJv&oblZ!GeVi@qKU@TfP`wTG2gKBq_j8Tsz_33n!W85>iYad6J-7UUC%NKgIS
zF5BL%{vLBhd`g8jkRCENLsIH2pRnM;0Dp`(DPL?8n)@_%qTleSaN!dgY)j4p8(v~N
zE8C=h^uESl?DB9;c}6#vy^L*#{vK7^@sRxKgTiXJ>KBWPuv5woA5ML`Dqkb-VSI8j
zpP4)68t7L)s_`H5T|D4qK`diqK1I(0swjKad*$&-?U-@D%91R2f?9dN{;3DNlyFM+
zK%Y;+&f|9J$C&-&4{L5xm~5AAx{X!Y^B|4g!yr|##<YA=Sp6gAn^4*@{LK#ONS_!T
zX;Z<RPf38wY1!I)()Ff%j$b4|S*3#?i!zx*V@%EGsU8!yJ4Lr$*z>^htolcM=INU3
zjt6^`9Xkg<rtt+Yjrbw5OH#d2Dd`%n3&vgSJOn<pTk51Z?tZ-)&HOEGIiKhCZqI7#
z_|y(Nbe&P#eM{p-7J1ROF^;CZ_>2OdvO1$a8;h2`$Y1)ar)hqS1z7Cxj>elT%5nSN
z?9Ss%<!hgGen9>W;9d7M$HZqPnCtN_sd9Pr-;^yO3*!8(c8G{l7k0>^#3(by#5?s+
zhBl7&d{5eo`p3+_A@73f^DTB=Q*y?h%tbT402Asz?GNK2UOLGBIuDIl$az_Q3cHWR
zXZW1eb+m?#j<UwXqGzjl+ErXTTgzVY_m2u2{1Y<Sp@khxSUCK?`kFCbz+|vf%`s{I
zjq+h$9$$<dft%-Lw15ep!b^92_Kux!uv3q3FnIA`e6&NC?C|1wX8CWPPhc|_GzZV_
z-0vY5gOawg0*x=OYgd>Z8rRCc<&$=)KGG+~C(#FI&W~NiShN@~uIV!pTDXIq?v%|^
z7hR`ig|tJ=Y0>vTp**sq3;v8<%^%yYH~aNzk^l4`{$qFe)i=6teDj-HFnO?h=t&j<
z%kQZk;nR81%l&@YC@+NIs~(W=e_V5YwEf0dhJ;N}4(LUlr!KNciSYt{nmJAU+LOZc
zBYLP${ijc;SYZ|A3x0mlO?8O=>3b?49(?-{DRqFhi8%(|kY_x_i#_ZDj;^O<ch}_?
z*#R0%@k5>mk*#8%%xmxfnt1?TB7L7ZZQ(-ypLUdSEp0&fGPFUzc91#YIem=BULbHk
z{#){R2E!sp{^B#;TI50BNc|^1SIz@zWHK*FJwzJ*m-HSF)2E^i3s2fbJ{ynUV4j(D
zSEMU>q#wp&iCt|h^@#F_OzIbl4O|zMj)nE?G{GDjpJc|C`OF4>-gEs*M>~0mxk=5B
zAalFg-v_lb5uf-yt^OD<H!)UZPLlb72V|S{tEGm^670~4g(D~AyW>T?zz{w6Q3jM9
z{SuYEZAST^zR~_MpT->LyYg=*g%k6)m<ONtLq^z<>Yv)2{c0C^k%HaSm~&(_bw)OT
z&GB^wbg^%gUuE&hQ);XJ^*{R^eXjMZ-AO%Q{hM$7UH5hE7IlGVCzO3ZhZ5z#woi;a
zV-n<!=RlO*KCP1bPyhCR>3-vvzU&th|L;HhGd=j<-tEwCX!x-!8uRnHpyR3=^ucmo
z3>$DiT=}9rz-XWRB%fkrEJB;XgJj0gya>jk9NJ~(Z1}tuJ4Ul}J$*!8Sfj6nZn|+>
zhR?q!8=()tC-bni2ZamIm-xigcFCpvr@i+$O}1(8Axs$aF?YlKMvVLDzo`tAaptF3
z98Y`9*qnuce3pgXY<aOR<_H-p3NPkO)MnE+VNT>e>B*<e0MKoz${(BL^S8`R(mvAf
zRA<+I6kkez6I-?I`Qf~54QyoJ)Q`)mE0=@~a$PWLAL(mS_o?>}sjZ@o1taFZ@fq~r
z@uT$1uBt&|9>)5BpN?pEDCN};(B_j=52{~5Sun@TqH`9RJ*xJcT?T23S=4b<^@27I
zzf50@w*P*yr){Etiw~z?L_0wm#>|wL!1BEEIrXJIE@<r)bEqs--m7wC4vujg3(hD<
zzi_6u>AZY-%oWNfh?lB{G^RhLzN*@A`rv$`h-ZCZ!?R5mAM(;It(teK5iaP=Sdo|S
z7+=WjwSe!GU$&tB;ffeDJo&J`EFj;^3sKa`EAq2Dg}Z$dV_ErL+nP0@<)fO1|K&5T
z)M4iE@W=EsACukS>(8nUWS1Cr@AaIBWbRR$`nW#Dip8G0q<Jpcw}Lg^-rap#FA9EQ
z?<3tV87`kjrA}Oxe`CDDr@H>=-~ExElf2)3?R($u{^G~lZSR(LpBK*f4UTA^d>QwI
z@hAI&0-pqu^fdVOvv!pS^Dnf=9~DNts0L8@Q~drp<%_58Jio`**nMr6d<5gIJ!;!n
z{7qf5?}EE@WgZ5fPalaz;(VGJpTV3P?b{x$FW^}gpQfeGU)H<^bM^vCb0WLF2<p^D
z^~bcMkQcIxCw(vcH}!%~x6!xexfJti7bJrngS494FPZQOCYE#WlwI*WW2gM>KKWnP
z7~rFL&U8uj{(@|Nhss%l53Mb@;&ubuWeka(-X}l2i|3PVe2VXu$MO6KUq_+O=+BO+
z4W};CPhw{qu+~hE%Z+|J&qbJDKP6wv;&|+Y=LEF(xsZFC+O`L1ON9-e&+VUOfQ_Dw
zv7->5zUD=dlNZ(hlijhy6m#^<Uo!q;j)L|`Rmp!+!3TbjISD>@%_rL~X{<7RP=47r
zU@<Ve=)CrtHm8ssQm41n0-MZSG^l!GM@I6izp4klfBeVY@BQBIc{LXcXr?QSGb$iR
z#~|%b{^U>m{dp$qI0#RmQpT)vRJ6$$S3sEt6C7&g^ngXpj4Bfc&W-=nPc?yVSm?M?
z=o08S6N;YQ4(xzLtQg00ror~xWHLr30^k)B4syzph0)_kkVWSPr^;c+CVGwNJb1&Q
z!q{~AD~sZd48QrVXwt%;)mt9)NJp>QQ`k)zq~9`;o?Zx~doUxF>XV%=c|;x^w(*hW
z5f7adBg11y3ivPq#Kad)8)ph~<PXl12O%p%gC;ueLn`4Q{rGoX-%_S?$RY#}DAbX0
zWs+P5wdyaq6N6l`15Uhgz{*P+Fy0&m6XT-aC3P;mfB|AP3d_Pc>_<dOOJnPJ@~Hgq
zfR;h^Rps@X%9+*T$mIbG=_tGF8a&{-cL)b2&nOdCyRvdqOjI747FVN)6QY9}lQhzW
z@>AnB;T2F+s)bHbeq@XthG@JoQ%JBC7KBh13Zj4SgkXs6r2Y8K{${%_BU7zj5^$M5
z#`Q*=RX>E2wvOaLwl$IhY-Nsq=!wq!W5qO>@CF1AFJtkDbQXqwtCtRn1YkL-pR;1V
z;v53n-Rx87r&J`QTqT$C$8TKIgBj}cHZ1_4UZ5Lf@b$T|jJlv`m8W-G!M<A@bWF(b
zrr4xD(pwGXHEmTKZy_UI<su$xGi;lbKlR3)DY2nG!i2KFrniXD9gURA3V}qQA6+w1
zz~|vu;DC)IKaf@DMLM$LnEdg^4VV&dR|da!P-YCVcc@N1t_O&}{OQkk|J|?ry0)7A
zV)ycof71Q=-~Ubb%n|LJq6UZ#0SgZ}khAiThN0lfs8Pt0DklEux;g`X;EFwnows>w
zbg3b@@&Fq@qD&YY>JxsA2M72`IxjrHfF>rLz$^ZO55J%n`EMfDJ%Kw9^vEd-!gzRw
zovPHLjyVE08Wd<i$wHg><O8s4Vn#Oaoa$N?-er+Ot(P*rtj;t#(-A>s<XzT4V~2R%
zr#NtCaSRhQd_KkPi<n&3gbVq$pTQ6Dr!u6>3CCYyM@&*<X8=smfEl0a!4|^)WINK$
z-@I0uh`{b3AepVtySlLJ#eG_o$zny6h2Krpb=nTFN4K!Am^^3I@D1!(>8M}WsTVW~
zFSv&Ui&^uBHU=d3@7&w{kshpl<rjacd-uf2?z?~Y&F=L>2feN2&*_cN-_n-jzx9=`
zbcfEq)BWfF`sdv<2lQzo4e+mO0FGkYH4vdb+>{Sq(!h^8LA!=Fw26E!3jfVuQf{n2
zq_xVPx)k-^{?r-J4~E<D#oLmO`uy}0`V7^-`6CZpU-{|F-S__CyBZMkJ<<ET&GkS3
z_22A%UE5y%pMUk|-Ct_E+1GgsUV8F2B)i@5_LSRx{H1tCDfrTZWb6!o75-eY!ibJC
zWsZ%~S79YL9epY9&MfT?TLtImmB>4GCknSw)GIP@Qytrz>a2QOXv&PLrzpx6dd!46
z;7MyV15;t+hkc5}w&>do{S2j3CP11v765O<2Z+{#PwKE@ZBV+x=6EX={g8>xkUu`h
zg|2L^%Z@knB^dBhe|Yf6!ecLfQ&<G4zS!oPY{^^eaGhubT!SCmGgEh&2*Gc`m&4d7
zk5^TnV2f?DRk6>aA`jFNaG_3;SK~`!#i1(`xiED86f6YhIHHZ}6;TT6ArH&Ih($m2
zQ?PR$2q4#fOLdg(SJ_VA6Ua)3-YOB}Nd9i&JMa(K42Sf?zF5FU{YGc^9Ta7J+L?S}
zuQ$}5;;*;K#w|m6qbHz~ZKHA39XbmG;Y&L7hlYdl21Dv5vgkMZ%?l=6<~ZOrE=Q7(
zPmYwKjg-6~&$uX%8URho%zUdAbvaV%3@+IQn9pF~?~uV8HoO&^n9z5l3`kEr<w_X&
zMlTfLwAPXF)MLt!T{_rao<80U%0jXeFY^>Lu{FM`rY>*F!;22#p@XfT?d!$Im`V%R
z2=GNC#q*E!+&ZmfXWM7w@%i{m+l2UW)<2M=udfbpv^$dNHVJ#tpZmk$fC^%PZL%np
zyt&`g%9({3<|z5RC5e-vo$>bHO3%S>T<I*GZwMQFGWN=6u$Xkl-pH<XMi<plv>Z}`
zN8qBs{zxqQ0A2K{#E&GjtF)7x`P3PG)V|DH!c4>DKY!abxyZO_e7L_WyC*G}y8o#>
z!k6ui@!$51nW$wNg#4DC^2A%q?4$=YnH|Vj#EHMbe(=vo1`GNQEUMr-@u5sMa?oeH
zDeS2~^et6TDp%SV#zpeMDhvF5=z+hE281@jMX55oX&r|$#b)TkuxJ%rXy4fJgNI38
z{4L#iaQuW8CjIiye@>sz_#e6_^chP&i}!#0<^S6qdS4I7G#KPzkRRs?ho!7^LrE(C
zwv08iZHo~|w4wIh!ky0vVY9JtNA`^Gl1_|kC_}$(E#Ataq=CEsWQ=U1pAQ}U<`n%7
z@~XUH-^97kDvc<Ym6o}ds?t>WP{!B`W8s@x_!IRx>JzEA%l=rvz=K8><}%Sq9Uz~y
zX`Vlz9aEcc4Jah#4L$J%wo`n+bY4;)%Kik?ReIVBCK#9Hm+%Fy58~oQhU)jxXQWOl
zA-_rye_RhGL9SQJd87!6xK@pFdrZ4b|3N=Wt-J_N{?HvP(I092x;|lZ_!UAaU)cvf
z3Ljy8NvF8TgUYu#1$gtf`T<W-h&Mizdca)N{n(6f<Bzt0_AcI}3vO;_k*&DQJvxJ@
zfR}5-r-~NeD5dG&QSW&me3||z>B!7TH{>(H>;50<RnC^CI!b*az1t9_C42be>zX)*
zceL-(_M+=G<pE^*WE+d*vuy)W<``H{=6;d-94-SvWc<)U<$!<0w)=8cInf`&&pDlR
z@F5-3ZfNH`j!*=>ZE%AMZ1J1;UnYR@edy+wMc^x2U<Xujk3NXXk~twn&_gr67RQzE
zEPCb-<s_ci7yT)zXC0IyV`kd|FZ`NqTpYn!f6PtsNiViCcOPD7A+LOdBs8Hc+0Bv%
zGnBpc0Z;f#Zk8Q3%Oc4u%CqeUpP@hW!Qar{>C(ChK+i>4M`NY&I`t#CE4{GNpYat>
z%mzGfXnw-j>K;Ad#~-xz0V+deO0$qd-$&^fccUvhk^|~Ec7~qDLV+Il$!_cvBX!7?
ze)uXD%Vc`exX(!arM@&hICDf@v?aUl+Sj4Ga)^BL37-D!B$|jHf7n{IL(OJkrW7ir
zxFVk_5bP8?M?qw{EJep#wjR`(I<UdV*l+0UHdQk0Yb1~QMBU%6x=(u+eOP#^%*l+}
zee8n%H2HL2x7h#-Y-ty75HDIk_yA|}h(87won7`KFg9d9u9}9kPkb^SQqu6pb=aFO
zBm+MVR#ceqH;Tnhlm`w_wk;`-EDEBpj}2k(a1>H1KXFD+{n77plw)Dr>__*rj&U}?
z$~uZc{v*WwQuV2}$p&|-{_%NGKFN(dd>6iuK26jLsiFt7p5s#(pEsw!?zRE$7%Y8y
z{o#9<*Y@18f}Kw*By!~pOS!2sVLqPzKf1A#pXUr!|8L5-l3ChP6{_@Oyr?m}a3usA
z7aNxywnH634|FBUeF^cssl1^NSO#{;qJN+ee82iyj5}3O{&e)C+F|-D`o!-4`XBx`
zy{&zy`-`vtjds@fad%lohW(;9i+b7NgRw*6id6dc_<fxu58cIAN7P;HO`*ao`e2lw
zvw*T;pXe!|2A;%|8`S~*Q6~4Xct_Y!_K7KVz|RJ-@et`$v={6s3?}v^oTVJRJg)(<
zWb#lBzh+#`KvJbEV_RqwQ%l5GIal!$Swxey4{T0a_p->d@1+kMv28w2#Q`n>PUMj)
zU{Ith?YOK;X@r?{K{Dk}8;lK%=Tfi{kH*vo!v`=%<z)wSrf-73;FF2ef6R>9k0|>%
z<04;58vqSyj1BRUD*dqmc9691Qa)IGeN*Xt=mZ}Qu%thWJZ!L01m4n_@?(b_+VL!J
zrFI#c)_}w~gU{G|o=V!FtvJhH;0N?iYVnMM@}wQ%@N*NMhbWKPW+0Cp2S4%9Bi*lk
z`g7gC{I%cgp8WWe-QR05**CuT58d;}-s~=F$0ay`XSNfA=4QR>kNbgWrvKo*Pj6@Z
z$KU^V-LHN5SM@pMx4QrRzx?O!E$!xWjXFdw>~DmP#&s;{!FO<gIc+fQH4D+)ZrFDN
zKYB@oc*w|&FUf2ZDj)iJj4f;f!OlEkNj^NLQv%X6zk**TEoo>==x>q%?=<Ht(kWV~
zuoE19>OR$vw7Y9+zr6?nJ>eled7%Y)Aya9sFSdlAijsyWFKdxT)?^<-icEv*XhIqA
zEDWEFpL2UchJ^#;C)!BT@a)X(zRDkcXfI>F0QmzD(btqO;JK3Wjg2E0i^5jyQ;{vE
z*#^LOIJh3)4>5T~E`XE=^wbS0=0)(XU-%pFfj_oNA58UxGWDOBkRPxiZy?Fv_(%<e
zxcgv!UL*qdJH*6gCwy*b(U6#^YoNAQd2_!HzbO9?wzfBzAzLSGhJ{P+Yeulc!NP4f
zN>h(@B8;;1T%Yu$4l{n*!Sf-}z@G!Yo`cbONoA7rewZ2UAbl9x5A;j>r?|vkJj5U0
zp|X#8Je?(jaVcY6_X`w<zjp%o;D_W3*f}2CW^9a(kL};z{lWkEyWMYm=8N6?Cr)>N
z@wLD9i$e74KdxQuzVhWScVGSLSG(u6qy1n0!#BHcz4}~tdYk6<$@3})dE+m03uRDK
zzLc8&kr(O8oZk}93Pcm>RC+3R<0{)FugQ=3a{42bKVvrLEU+Q$C$)hVJpC+0@vei&
zgOAc&7e=Nfjq>1lmHj221JmYcu8{%{8uZR|>Jy1Kw%|DFNL^y#Ds3p`$6_gTcix&_
zu8;U%r4whkB{*KhMVqm#@tE~iJQwb_bE)$2u9XUul{%jo5#{bNfE1w}_ne&MkvN{)
zi-#g;<4DiA($BPnhv`98X{o=?k8n{YT<^dVdv)JJ&&K*WPU<549PyxEX1it{MD>>T
z7wNWbgJV^~e~K2_^l@UO)bJAt2W5aBoM$btiJo!LZkgY7xK#QhM~-w~``XvM`;NZ{
zrp!({&H)6%0i4e`cmlTpbUPWRJaCBaH)FI~U54?vkx;>h12jb#w)I1>{;O2&)F^bV
zObr7bX`^r|APze@%rXc706+jqL_t&wkywlY3u7{it+{+HhWyI|LuHbm2hybVqMR1#
zP5?6>Hae=EDv5qEFlccKVjmSkJh+cEqSV%Y7!w@=QTSRH&PO;3@)~^5X3(e^FvKuN
z_g%5V8K)XfIC9|pO{FE-dWRc25rHX_t}JlTQ#d(oHA=cPzI`L4>Y|R2Cl0~Vibf^e
zrq4N0aXC^iuHmaE8RAQ$PsM7Oft+x1$5Y$pO0x4!C*rDPd$qhODF+UM1NKVcHvzO{
zP<FyM^KfKxnzEtX9uTZ?sp?|&xS9d2ox+#z59i=8{ZM`!{*}HUirS)#Fvm&{u#v8y
zLOf**6`2APcM{PB5{_US*K_{DahwkP$g_GV>dZ6oAG+IOz>h*ee`Il~f2POj(-F5L
z$4VV)ETMr5+2L=|V@M-``X2{!B}WdKtt??nh$rfF21|}4CmxMl@0EtKT;hTK=patr
z6{qwhN=rlIvZU>#=@6<KxXv0EMi+TdCfJ);x_qTH1C3?rW+il=StlL{6IplUeHWNT
zUKk#VMuX$+ddq;rd23)qejMz2K_dsx$De$>`}hCzALu*WU(nXCJGE8k>F%Gj<v&|5
zUZEq#TLNeTgURd%GyRf>^$wD=dKk=>cWdXTW+x0X(q`ZRtN6>@>JCMXL1022w`mYh
zEr=nvqDj0d2QuVaoTtzipSt9_jzrmk{)J)cVWA#8;E(BOk%Ugv6}<sK9poWDoicn_
z9?ptxJRr;)CDfcyye%QwJWMktn)utUH>jvWwj7=P=0GyjnTIFd{#f-deLn33IP+Nr
z64U9E)w`X<W3T{>Z77LjD?yh{({Zp+@zeip%RAie@rL4(d@G#j3~MR0?F}OGk{xb%
zF+p>mR;SyxbsxDOFi_B{hx6TZp`9h;?Ba0f&>J1wXg>XmU+8|}v!C@F^mMq`(TA-=
zSy=mn=brWFMc&gy=PmhAYDY|PNNeG<M7_|e5$oHuB0tzSz5%b}OgHVY0VXF@$Swm7
zF~Srbul&fT+Ddf^=G?Qr<6CbZ=|28zU+MnU@BUBSZ~oR-_3hC!-Gh6y3xZa<v)kA6
z2VUu(d*!FvVd|9phw7Nx9(MTIwv+Fsq9b_XlavQk(qZ%z?g6lXr7d%95ca&?1{vGc
zdLT~%`K%@KDxIzxPdJcA(b*@!p97q9C3+dJ?s+((HcXVrkOy-)k}&8=FHWNI1Q3HF
z{R10p2MLxT{W(a3IQKy?WYQ{(2Yxr@`-u#F!r!yfpM!LwvaI{mr-(c39e=BT^fScI
zgGW<p0FLieUXew|*=6FqJNc?V)=vUMZ=Jc8e%LXZP|D~W@=T>W@|}8ywx0Y@7!kb9
zLwksLQgB3Bf>ukX$eiFb!JI$I4@TH-=qtY@-@}15P|rQdrhCfYZJ)wJ(<lQlVuZ#7
z%r?E9fPSHGQ+k)|!TkpA#UT@0ihgvztTvp5dm^)3!i-f!JMXEl&)AJ*F4@)s2f{s>
zL*G?CiyCQB)ACa8j58R_I^fM8(L9LZtt#$}nQq<o659$2dp8c!lQg^m<cI09HPYC2
z)sE4&x^FDz&~fBB?nb|jW;Gp?(z?P#wu9fd57#aIM62jB4QfglQtPTS*Uq2nW9ErT
zd71$F%}ex2{Ld|bF`@3cf8FX)e6~V9L%i}2T;R<gq5J~_YAFMM{-VFFd-*{8fazNO
zCnaqSd1nEJ+kLQBIJ~f{l)!_8mRddtDa}VgE_&|Rl7C5lQcl@ApogO&(P2H6pTW{2
ze34)3Ifo~P&{a4t%P*rbZB9JS4XHud>;mab9H>6H@8x{LNjVic<2ve#C!Q1lCiJn$
z01x?=wc{EM4Lm7(j`+pfNCs*2&kxF5WN0CJ>2*^J5Ydski09&n@(3K$&jr`y9CYyu
zx8xXC!<~4F>9Vj#L-)I2p@+&ISLvD^AfYE8mZfXg7yX*gRJ~WU508r;hzT8R0bk&L
zj{2xfIDTI3{U83z-|c?osn7cj<2PS<y?f@Bm%MfQ6}9v1Tm&ZI>9KihLz4fzXR!4c
ziU}<}%tz<T`e8DNexK`=bc^~0S7b(+P`>1nG(6PWrtx3AT%z_@VN0@o4#uqXqhb*d
z<*Y#c@Xyz#TJHxbluzi(4j_ETKFU=fyY%HX&{cg4&5B89?iD3WO(z|hYoMK?MGegr
zg(jkNzsI@JwRI+)=yZLZ{)Xzrea+Y4U#KH!MH`5R;F@}b9gGjSEOMYSIVIgS88$v`
zn|wI+Fqlh#<YV(3lnt8jN09TZ2Qkh%dGi&yj0AzX^d%2u-0>kbev!WNNEyU1M_>%-
z_v-CI<EL;h$duxw=gm!7g?%Kl827Ny1}$B$(OUw&kV5u`UuU6$AGRwFKY>32caGG}
zH~Ik|ww+(nxG3^LjJQiUJ~FUUSyMh_Rb_X-Y!Y2sX+b3?tuz|Da=5*Bc~ZPcjC=xp
zOq3HAWkVkMvn;N}H+AHb+>D?6kXQwkI#5>`n|NYW6~ldA`q46)NGp^jm%i9ey>*GM
zEEwakWcsZ1UF03HdVwRQ)qam;6Fkph{e>;NX0ZTbSxya1!(yVXje1JfTxz<2BE*t=
zfBJ>G$U+;1-_Qgi_7!~GdI=x+Mmp!h8I?aE1B|Pb6MO`@ytxDWAianhCdlS+GA^Vu
zZH@cTWMAz|wBtm^!9x+!dz?seiCL1rg^Sy|o|%GVXUHIY?AvTV@{5!sm~g<#^+&Xr
zNAzWhRSxNR=*amy+M#&i0{<=rJpZ5vaw>l?A-^C4XJsQKgxWoZG&J$hS+=D7Sbn4R
zJRJcN%RDAKVJvI0e&{-6FqR*L?$`=3VgLN<55CfGiMCj=F29yM#<)BbBPM9k!&u2i
zw`n(9Un^zW2GF}bqwQxdfbt^RfBdQspt%Fe@s?$xj|3QJVy%?~j%<ctbMVFdKVlnP
zut51z%@r<h)0@-ehVeZWTMFBkNhi$Pivd-*`4D^?i|$4e-8bbPps)k@>Nc<%5zcvO
z-u5}vC(ToEErv^~3p@z(D-;^5&?CYE{7*C!I?0E59!;_2IB3GIRk8J7yp(qqGjKp*
z(zxxzj1_Ia>XcGAi|}$iSBSlolB(!r=d`a%LEnLPRb0Tq8Ymvx)G^N(5({Wt)~-WP
z!7$FyF-OSa9^}J?IW*>q*tug#Z=2tcufD9jT*4^zi5BWEev~|6cg}-Sa-acewRMPe
z=7K*<ba{~@&#x=J`<VDb**Cnfjb-h$5cA0B5qT2>9icA|K<yjR86ToQ@=x7F4|pu;
zfj?<|D3ZFsTtob8;fiNrSo9?nW}Kv}=f%-C7{HtP*WplzWN!2THIJ33%c_5HqTOXd
z0QD9euHZA&Ff!k3O%U1Q-0pbnrcZW|SQz7TnIAOTJf-wONsv1FWW2qP5ix%E$QPcX
zqyI)3;#cV}64oCICymDwy1u3{7VUMk*|>Pwx58}?O3ApI_IJB>C`JqNGQm$_QFbj<
zHh?{VHMI+SyU9EZy6Pa5`mPK8M?cw$^pptqQ~W^G5|D&EQ(0%d0i+QAV4-j&@-r>$
zT;;djyl!=0eEMlEsQ(w;Z+!0QZig0G95{Tad+ybj{Yl81s+V4<D$XIns+i}ZKjfQ!
z|1I?swUtD7U48cps%O_V*13)xV=sNdQ~$sZGXn}`SLLslBh@FSkF;HLCfhU-$D&^!
z3PV5ZNWU2{lqmcu&)o=6JSQFSizC7VB`B08ZQDL3=D+DxwxmvGJjH~?e#(vGXkYp7
z?ve7vLut?3v^n9iB?Pa?Wh@+2o>e|eda)$OEaX3|BKSLvWC{k?ZQ=o_A1T}T#Yc6D
zINP{2!%D*k1WGWFZ17RI^Fn`0eU*5TKCDQR!oOGy()m*&P75B+yOhA+Ew_HJmJ(S3
zUYtcDG_D(zzvxnsB%-9Y_K<$U($`Zu1dTLq1#DYt<;aW6Sg$)2k}d1e{AT1E*3=2D
zf^r+|{<rR7&!6X}F-i3)292aPFi0oN3T&Yb+fz+e94{_0XM<ibH=v8ru}%Jg!|BK`
z{4gZ7Q_DQlRLbCIGShK|9dg7oWT8g+D}UN*&~+Mq=0yr_bnwCe^9PzSF}}0|EL1zG
z&t4rqa-{p>CqLVL@yox|ee(04@y_PFn8j`}yR<REG3_SwtUe!j@aS9m@`W~tkk4N0
zAio@l<~r{krZROOS~uHd>&&Asvm=ngO)nh!x@WZUWr4NZQ|SdZZf})uEJlf8-Hwo$
z?G{||2(~T8M$8k-K5}eFESo&s(sK<oroW+IVX8KmLL^l6LR-oxobrf#fv-MBq5g#0
z_a;7Mi4MC}JZ%7TO*f=CslzN=>A^Z}QwC%o?)=EdV5``J+Nh}6l(BTTQ;GVa)QISh
z><hyOb!bDh%1lH^1_6$Uv)rb$?L_72a^U%zd?~c_AK1L(mOfL7eR04i+AaB8@n2FK
zg(Z+XkNqKXzQ`Jy$6<Y(c2egSz2+%>@|r~VVx$XH;Il>j3opFT9Xxo@E3)R%l?QCR
z?N6cR0iYb5$Ke_8xPiP6CRr3a>D76m;m29%h?9z2QL<I@){o-|^O5J&C8Lpr(;OXi
ze0cK(9$dqi0R=}S%W8>%5f%!&@iA2xE42PY7m-A$Dh}3)9tuu8h$X$<tj_!+txgkJ
z!AUDffjvdsL)!8d4URcFjtBRiK(VIC8F-o({CsdX8PX!!iG=<i_vj*pkmrdSVS&BS
z3FYAdxHu23Av1&krcfa9K+%pWZ6Rb2DM>xqS#dR`T+AK$p$d)=YQlZAQ=c1M;CPI;
z(mS2fuqX&+8o3#wo8>qkT$7U+#G29sQJN$)xf$YEB}f5dxsEp%c<DgCQ-y6o9l9x$
z0@gwLo`*x``>`VwX>gIYW|DW7l##k2H^iY0nqz%q$&ro(VW*sp%%n0KP}Efb_B1k9
z0Su&p{<zJ?v%wMaB**trKurf*RlA-%!6y#zR$`?iAN=FMX8hJDA&#TbCT2+K0cmR)
zC&Y>*so)(YN=Sf_aoBR&Tuk1Q31q~Pm+&C(*a6=F=ljr1c=1V_LkA9bFX>ysr?ssl
z4I(yTe9S62B*#IoA!POyDZzrt0(7IXcEzwm%^ZZf;0~?dn5Ah|0dnubqxnQUJYmD(
z>$oI^sD~r$a=2gbDlmpaa1CEa*(=7qO%$ZlBVVKrp(ikvk4Ei|05XhS<H9`$`G||A
zWz(OS#5po0c>*F}3P0vIB4ilWXPj}d?Aair-B8Bx<ZVpeDB^IZD6XQzWPOyNXF%Rk
zN8z5JlXvPYJZZD=Z|xr}GC60b)<xrDY5WkEbba8|MbwQUW$;?=UVQZx4L_E<BTv26
zJ-+`D<BlDj(l(dxYrDZW-+Z(C-iyzA%Rt^{_jbi#g{`UHtBHtqLwb7=ra;QUt@ZB}
zLt@DHuhM2YQex!aq(rtfgn$hL8@34lj=tZ_w*H^_<fpsc+G?E6@w?gr^UZ5-b*E3B
z>R!>?_pct;8#o$H@%>pA+1S^JvbPU-N>}|fgfum*%a|<BASr=9jRwllS+>;LK`Ut%
zqO)N@fd|PWGQzL@hj>MZs6^yz{n!F^=01Ev#KVO!9txPgXAB~FNS-30i}qF*+`yl+
zZ{pW}A)<^);L#L;)RzjioM7Th;y7Ta|AYYxB{N`ZikUxw4T+RjaF?d$5$qgpK8RFI
z_6O;+5frtbIK+nn$Tkm$nT6x6VB_Oc3!V1_&rF9+S_tPB2sUnEl@I#>-mXyCIGwMl
zAB0m!6zhJQ!-Ck8atbFctWzeUz!|8SnCGn}Gin6z=I~iRX^I(cGIyTCt}+~(P0Rx8
zu+u2(;JN5;@+O_zMl(PI<*Vu2Ux=76f{|=(R57!UON8V2F-`n(i=446VirC6^iqO$
z1q^to>Vq&zNI6Y~UPP8r&%>I=U8Iukx=sBZ)0nv4CntsF;ts$V_$7hz2}m5xSGWcc
z6i&=hwg*YW$7VkZUgU{?TqimA5hGg}3G6R*;dTLIHKk88f1qgE&5WN81QT-|CF&Q-
z(PvW~vfWtOXirTlT~NnyEiI?MZEhIZPe3QzCO&N`(n61qPXr*)|K!`0MFxDBWTcLG
z!U6^yKBbRqiVy~$IGM!PN<%iro*5PsM`H^;N8IKe0Z}iALoe4^g-!ZD#}4vI-uN1{
z(QV{6_&2qkj(!XGoY@Ncz?+BFKh^fvr_OZ;UVXiL<-qIR6-~DAAeE`A@WRNQeI)PM
zu`@y?H??v*CI;Ly_Vj|Xrk@ayp6J?a8m-mYz~_m?`Sy5`d(snRo635vfVmEGzyX&y
z;;Pkdc$zyB_>(?yvhBEh@UOBXYb!&b9~Ar|bIBRKElmtKQ-3)kKT)5tM}qy50CAET
z{zbTH0)rG`Yor{G;KV)BhP#0xuO{R891JDGuQCLP=D?5jwQ}%W$#vX6GFKGU0kxCq
z3eJ%->j?3pP;gL_qLmq!(}yv_C#XNChh3g5P5eYlDG^5-i%=#|<3X+B6mIFr3Xv9y
zZr;sCXRg(no7R)D$hXW$?|z7gL`H$}tB5Eg?yys5#{>jmqjAG8K0Q*!xv$%bV=)bS
zak$)d#=gxkf1AkU$!*9Lm1SuThKVibRWbS>G8(4jrO60c+(ZDyb%R9+?cO-*j{Be>
zt^U*($)iuL;Q5XygQPVyPCGEjb_}_MCSpn9vQ;=^BNV%(ha>O_HY$4p6UY>lXB5su
z3C1`EGa``)<3=btu)rQ{OOi|ZfOl_4A~v~o3P0&M*C#ZKdXy}Ak%)5PNSh7$&cy^h
zRHp1NNY##3$Kb+&D>6U)hOYe}NP6<7yz|w|)GbH5kDK<}3ybK~2!{5_4H*1u%%HV0
zb-KobfuIt=KCLHW;MO=QlB*CG_&}3>ki^8fn&|@U;mTrA>S2$);-K-o4h(b+ww5yd
zL|KcLvV_RI@o_rbUl4zI_K-Sez8`S*gHL#klF*LjJf>qTdxVHEq-bnUq*Vs7NzbF2
zQ*slL()QRW&Qn-Y*c3`LDS1%B5F{G~lSd9xa*0ZbzOhk&$0R&}C(?c;%F_w`16NX+
zyRU~hU5PPq{0k`#AlL^w;P334tUIDquLOS7Nu>rD_&ZT(OYL?LdfD2Am#!c&8RU5p
zsoSqKF+cH1ek4>XIAJ^N+yfJIV(hJt#dSyYiQ2#Yfj*6K?49nou35wg5iIDD1YQIY
zZq*!X3I&<BLIR19lLg?kO;`6fQ4CwKf*}Jz!C7Z)2_ZBJ9uEgTaJTrzi<9Ym?=1P=
z92G`fs4ISA;T=BUYg?sEAZYS?S_tBxL}6mO3|!!xe$W0?e87PPm*5F&^5Zo!3eWy#
zSel6yOWl`#uJq8Ou+pe5gGfH~G&5q;;7uj&wjJdgopo*ebZI`YYKPk)VQsA7q5mxA
zHc6x7#GFiw>2)I&g8(K$)CXBE(nd#<?}QR$Y<hx7Kh`V8H6kEN81$q)%S=NI*YMP@
zgCp<Q5f~XOk@3lsLvJ1KZs~=&OJ~n_&%gZB?v=L>cjxsP$!l8SL>aVP_fqD$KxU$g
zc*eU|_4m`a4s{phT8?Q>@sd7s#{vLerbszySG}D$7m*t>jIU*ZR@75u=%2zk$8$Jc
z>z<5Tu6{V1PUpDd+;Sy4`s>&QHtA3^NE(=tDt}r^F?IXb<Pc2^_~OH;({|{zF-oi;
z+YeOmin%b!bm0VnWhfSXInbFKhX;v6VHWNyD6xdZ%YF`8^3u|JF^D;eSIe8@8e`Jq
zS6GmgV-247VL0$H8NaDm<Had_$tYlr%g{4)AaCS?MPuj=T<GqXXnVba8DfnEznLe6
z5zZe+gp*Jq4h*g1mM{X9zLhm;Jg!!l1am7=X!wmXXxtp1`7~=&>qi8XHDQzowkgvN
zU8v8xH+?(n)Z!+?(ak%K2!A;;*qR_^`QAa2r9jlh+xZ!-?xX(_;q0tSy7+53a^4lD
zbl}KB7iPYG^3sdlE$xDT<nv$X_Uco2^ypY%bMllvy{)<Rmkzwzy{zX{@8}aje9A4k
z>SEO+b<Hz`HgTWr<z3Ebf)Br?MJVX%Owk694u|W<wk#&zAxw-TJCx;w6otEoVBZ!r
z*p)nsc<}sx#n?jasGqTjz_OIme!wLVyyHHU3K~$*l~m1pVi|`(iwsioLWA?@J5$(3
z$cyvpAf7iw+eP8PkFrb>&d9PR(h<&F4{}@okqoN7I!^WzGY&zOIYSrz@cZVcGctkD
zoYe-qB)FFjXp?l7svExyC(Mi^auk*&h6->3Z@0x5slw<>awIR`%<+S@ZOOw1BQ)q(
z@x8-y`er#{(?>dN!nuYfw#^pYx}J`oPQTtg&M0Ar7X`!$b(c%nh6`w*>d6Tj4$|t*
z>{>buAq$zH;IAw4;gs=<%rwB3)GN7&oyH^{UWrPP#G76}HdqI@4q>Y(h%p~7AkIWi
z7=gXx;Z}$5p&K2>I%=A+fe&Q|PIkqOZ##`s>YC7X4wvPK#`@_;W#RP7pesE(h#wr0
z?G6G#i9cXcnK+Z-UUXc5bJz@55ymgPAO}ZMnxA-3exBrp)`KG=ha<6TsT|?-x<Yeg
zfnCUedmO1l-gCCfzG$JzNQsFHE*Y1R?cS%zn`Oykxy%$UQ_xS)aXIfnl4<&s8g4i^
zSzhE&0Z;^$e*p*#d;{Xru}yq1KnX+~8q7w&!DSRM=Vjy<xk`X+Y)6t@7Un@j<jlH{
z1o?70(@?{-g-7bf!>5SoZ9!p#a3395Y=OLoeW91x$xf}S!t;o7&bvGhXd{lp_Cwx$
zEje@&bWglxL&RZ*q}Mld^;sfz{`l$rFX_{3`o8>`^ZEwlB@g1gOB3Wy6!PGchr^x0
z)F5M4Ig5<)P5<T2m+SasdeqC1z$)%CEYHmgC>QVynZ(6kqf&U%ucFmNu<KL9hX}Ks
zV89I>qjq*<fhD#2+|r<%arT*?>BAH)Fa^Y!Uv&p;D?yOqtuBL^b0wLXRD^j=+Q>q5
zTKZ04^Eo61FPDRS=P=L@$&R;R?g21B%yJ_t@RlCN!BkF>KO?m=D6s7BR=-H>y?0Pk
z-`X#(qJkpQ6hxW=Qba_0Zz9r*pmY*?kxuAU1S!&_6GD@!(h0pI(n1Nng&s)gB@iG$
z;Np9K@4e@I&w1}TzJJ`A-^`uaGfDQ|Ypthzp0Zc=T8~JZ!TooX04pqh#0uzNF6MHe
zP@_JNnZ+*zF}wl{2|42!cEBL32IR>c`~2>T4{}b;pdK4x&C(=5ISkfJ3@LFM{U|Oi
zAi$XZIO-n0bfa7|u6jaeqA|*K^%ya{hTk3|IC);*?A%xIa8hD(>AqjkJA7(<f%=-k
zn9f15CRLbHHqRX{LkE(PLE}M%&3B!u9{j_3SQkm=rW6?}a_1+hl><~+S~=SUeexcU
zi}!Z@23aL|9NHD8BG$Qyusn~;YbL^!?<+C_o~$S-J<zU*hE5ekstjFkE8>uc^jTCh
z4!stt7g2kYO6DSW_X~}SPdY6l>FY4nz45Oc*P<w2>FY+CJ|wgb>BW{B^E&l#LYy*%
zADGUY#E+`Sbx6lfs)Ra)K7E0g9k&=bYYUPQwK*o<=6Lq<i{nEFS`Q#=xq~;oyh-lY
zG*^tw!}+daVby6rV!*1ogtqb!M(!Zxu2C1^`icjH@XDiyMK@C43`NEtO^o=ShPm@l
z*(&4$naG?8Zs>f~VY%5JNz%X{`al{}W)PdtNGVvCKMD`_AB-Y(fLzJsg^u$O`7jDA
z(YhEs&vGNU5xT&r6ICu7G`@7Rg7uLaXF!3gkz$!cH@i>%7Ig6K#y)FPu{QAzXwjGB
zJ3&I|t;Cz#{>Mq?s+`=D)(bu^&7V$3Uo5<$BXs-aNP&CqpDNlclNf%QF<{6vT-5ni
z;tf^Q+D9fVDejQ`)v6%=#`mZ`cBG8NZq>P(5Itq%aPGo&T80~ZdOtsIQl`E=?Fu;Y
zKce(|x<33#IhES8)JJ{Zw&h2t(q?MArWMHOiL$o4hQ-%HYvt7Fw9#;Bm9V&I3h{$X
z<0#f&cbl}VzTGfTzfgH9_U6JEI&jr5nz>KyAPp&6^7C0<=@pXTd(Txkgr;BXE5Bfk
zr1bvSM7q!R6hUDmYx=X6fzpS!CXc=bpG(6Sf5eh<hi1ej{hpqOA+^9c+sq+4A`2<B
z@gBo-B&kJ{YPc_{@9nBsswVn^cq<FI^T<M1Sz|-(6aVsaC!x+qJ6Ej}Zu29hSn9Z3
zz0AR3)RPfjE^fH^LD^f+mz;b`l)H_Z>+>7IHP-j=HpOXeLo3|jZzh67?XJwaWlp+q
zoQ!Qg;9VumV0q#g_z9SCyZ8)JSDqd}9MSeN^PbJid1GXSXi1{YhKxBc&C4`%EaPKk
z(~+8Zf+F8u1KzxQksqdTFmu&<bsMRu9M4#E+v~?m-4sy`;b(GREI6DSA}D`+C6OHr
zdl?bPipf^!ebWDk4F+A2R_t6E*WwUAwRz05{P?ka>37ZSrL>=Sn6ABJaK8PyQuWxY
zJky$fXPz8zyH5~ad3MkxEk8Z_I6IMT*d^%h32{W2?zL?6cPG1!J#wKQfrF3Jjj!U)
zlU@aj_`$Ukw6A~dj(q#(=G{R!`#|y={qY#sZLnHX+82tzcrgD~qZCi3gdCU1cyePU
zZ-qApTl=8m1;&JsKhSDjvLo359d+guYsHj*cSJQrCQ7`Pa*L2vao80^ubJXl&Pbt3
z*LDM^=S`s4z{K;3@*@3m9o8dHU;bh14L(zaRe380v+vqpw8e$@CK!>lMnc5zSIy1E
z<U7+6M2%^O!M<jQ<f_Tt{t>qNmXp(#t>;F=Y3ZnYXW=&sh#2;W<5X#u^ygUF#giE{
zu6(;td}I$^37<SjlL(}^TDDI5^S<=PM=s~Wiy5598Ra69%&3%zMOySAkq}R$?9Uab
z#@P$tkV{H<{C%jaKec5lq(F@)^ao4vd{?hfWq^}wro2_>&_dr5-||DDPkC?cgsG#y
zaQ|d}UgB+(*mY1y_JuS$YXz2Pb551(X+A{z&{}`)K3Nk>o=v}hf|bT0?_%lko<v;t
zn>6gk*;6C#;E39tpdznB?zGB_K&^A~2R7IEwg-uCkF2txJ~eC~i*?oS0O}_t3g~G{
zfb}!!!l3$wZ}5D>`zaG&ZPOHz4gKl{VpbwGKa2=`KaUS8buXnC8#Wq_en4FrhR#Q!
zzmTthF$(k|L{SC79Ndxe-svh&l`!8fhAdwxWxsIVh!?W#iXvd~Szvrj&ZnU9?VMEq
zhJ^1|4;6Mwk9zmC2cZ%yQt}&})BO0*;G7@AyZ1@86f`PH-!O4d8!!m3z9v`9JYxd1
z1pSn`r;>K_PUFHa6LJ%;ZuCb2rnEpc8S)l#5jeNS=<2V~fFYf5X&Be(aPXtgL6mM{
zr0=ib)EHm+!l~c0sl6w<KlrpBo##jY$|0GH9rl!>U85e$8@^%Y-AN-M*(LC><K0QQ
z%BwqlH$Nvy-G~omXEM6;lW%R+?zvwEBv+8?qoNXH+;!DlWa_M@TDlZMVjn|1TTa>4
zATeEqlJUEG{lfcQ<`r)sXrpT&ZF8VkXpqVqZ3!h-BS6>kTFF^}BayN{7<ekLxxr<d
zB~QZ!U*jFQWJeekb32f<cdyOt-jed{*Z7o`A^1l7(b>q{m4P3Xb#@P)6pFL$k2aA`
z+%VbQ|5Q@<0VqirZpFwov*%0?kIde@6-bEeC^Oo#eYv@4v5>^vIY7!wM{$S1YWR`v
zgK$ze7C`KSDrcE(AR4H%E0+W}9NCUu_v{RnBokCJQ}{SYKYCA$Zbn0rvQOUSCd{q0
z`rvZK27Ttlf{&>PhjC6%w>#^zcKcDSJ&3by^HW*sWEdOCXJTqDspreugG5hCW?iy%
z>linPX&Q}|Rd`>05c?iX62(vMTt*ovX8VGf3zp)g>2z0%BuK~Y1=88qP+syUQ8DCW
z{Cyj?cycJ_L0OD&?H;Ml=srJ{*=1qn9UV+R*#^N{!m;lQ^@Ij#`=2CMgpzlYX8=+U
zMB7cxhk6EueyxX9JP20p1hbi=#5BnHn}hCdci)BBtptx~zk)ubh>8xg<&a<80Dkmf
zz+=gB**!U>Kl2Dn7qr@aWY_C+tDdKO!uUn0AzT4*r2-K<dF9oel$rZ)>@prlhTNgS
z^OUUy3HlBle+=JJh#UmrWxWh!gxINc&ek1YU9O)g%4&VhEV&)qJC@?%Y90m_e{ILc
z#7lQCmYSFLR%{SEVVsAx*T&*(1a%dnllDD+iR-)l^zAQ>?DNKCIl+@kaOuW`(RI=l
zzK$6R%L`qhhxTjM5Ie<qE0kH<!?-)Z#~jRqg%-orTRyc#3Otq)`_q_{p9*V4w*e-6
zCZ)kI_A=i#<<pQUdW(3`X0Yy@Sl{L@bJO@0q&m%UW>o!4OcazZ{!$$dW`9hX63gm&
zr%vG{Usg;YpJocFCTznNlQ`4)SfaP*72i(2*O8aqs0tb8X8Rg3x*>l0VO$NL`#OlJ
z@r|46ywuA6yNrVg!Km|tj7`y-oXCn>QFgYf#%TwI7r)f9Xe4?8KnHs&F0))WZ^CMd
z`=DxIQ?6XTqs_I=u$zQp$9ADUd8#@R><d~PLibRPBFsWG?FJL$H{=W&#yMpwS56B!
z$jVF9o8Rj3+<N6rALX)in?V*&;+5|fqQH~8#Jhb{)cUdN(*ZT5S2qu@lCM6a*t$kk
zpYhAaHTf0G5V`2fCm&@@x<sCty3#zc8n=9CbCw@1hQ4dJW|<zwXuYJ?0;V>)Q%;_C
z%vzK2_NpQY$y%qg;?90*EVEJ}FGM-y=hH>vS)w;hCRsOceqdHTPA_|Gz4_uJpyoNV
z=it$y0o83#gWU4*7ilT>x4PZ@9$KwjEYXy&bVIV@5JgndO)-R3lP_@K$~qOHjmV-s
zo@GnAX(bwzsP{vTxV3%p(O7ob5mZc=VO|HpNrrl-`ll!AH{i~}G4LJ({a|y*$~Z#j
zJxSmvB5rAWoY}{3MxvryKhN*i({xqtRLvgHL|*rbh-Q~hRp}C0R(R4&R?RT^^0qTn
z#^xSQI;N9cGR(ThhD&CMFofd#2`et@BfY38A5GOZeF_-V-t7f@yZX&(DU{h2dKleJ
z@%}+8+XJ;+;=Tl>o>|828xeda&cie+p=U2T6;BoDnefu_i_U6lUvGLi-!Helxal@r
zv-!!vICh9q1kzD%GML?GrIK_NMO|6zTfHrLx?Q)u3FfOe8H%cIwjws~C)ur&mLy*o
z{$fNEu&<IAXOqU~`pkV?;Bpb)D9!LG7rT`=5$)y!2UVrpy%p#=`;^Le!^@e=xrPTH
zjE=9DQ)yl7N8AoB+$m{E(?vdP;GwVl+WhV|FzGfjR%8jlQL!rjwLaJJ8l|YvfWbkP
z_4|)N%7wRkvI<IIW6^AIGrz41E925FDe@Gk2j`n2$D4Yq3C-52I$xr#A1hF?-nB7I
z{fwx6n0|{kdKr~)FXa4G^=-Vl-Jq6a8}~YQVi%LXHTQeEl!>wzbD}jbKojaH5vq+F
z+Fy>mn2pXwnEZ!h_=n#_#$`jc#E&V#)j^kA?uOh&KFk_Cc1%4s0p!odwN8+?atCB=
z7HmG8Iv)Ln-Hk+cPORGc5%qmG`6%hCB8k*@)ik!$l<W9LbIq1+Ee|yQfPzxCC0_K)
zanz0CJA7svs`__rBT{Ok$Y74^k66}?wR(>Fo>V7D1bsVVVeIW<c+7*gIjkr3$%`2W
zsSGr^G!c0+KRR9e$-W)FAnF>{%<AUKPijnYUF|8)p<~%VyBC=aw*j@oh02wfupSo{
z7T>t%&p!Sd?p{$~B6JywUQR<Vbf@oyC@EgcTtL>Ie^n^!86`L(qS@{+spZky9^zak
z6ER}r4SW)k^)5gwDDgTtCinx!xab9)cJ2y!x{J;u>w8vmv{fat%F7)F12#7aT4;1^
z&9C~e5>X-DiT!TLH*N(TTD>L6$^DWj9JO-Slgt)kCyC&=r>Yz6#rtHR8_+u8$pm4p
zQ`ExS;>nm^XUB&u2xmoAN*+n|aQ8wIWNgmsUkP1Zn)QMk`j(3AP3u(&G)|SmomRQd
z4_-YdiHj!X<h|XeQkfN5?f#j#AxvQ+{)&GBI?yW`T24+XP{lsY0ljvZJDPaT`uz1%
z5}x7giLalsxx*Fbha=tkDr1YUB8f6NSmF=RZH(q*-ghRtu_?OL*9|18qu5as2*km6
zbJiVrlu3J=@9Rpg@lg&4hS5sA%;Xh=O0BvE9k1z9J+s`9Fx8!4Cguk@O<Gs%UTO~p
zk7m(@QvRHWnX!0^@;=>oRlg8v=#(GuFnqNTL(#_Jr;ksM-?4@|`Q<A&gc~Cp?Yahd
zO-x2G`8x%PVW-^_tNJeB4gdY+a8DUS-tCcsK2x2n<sK2Oo0xE!40`+O+m8ovOww!K
z6H1D&#1Bme<<QLPT3A+CO>CHDlA|h>#^Y3}ixZ}8;~3O4BBUrzR49sj!f)DrOjz$-
z3H@aemEpU??eD_l33xPAMmZI-mqbm5y_*I1RkPhEx66ROWqy9Es-lpD#5XC!qJ0#6
z*swP@i@iJ1dS2+D-ra(w_tK_ku_<kxUbbf{*&BN3JIcQLaf_oERhrj5uWoaT>gYx<
zDo9Im>9C~Xt`Y(_1TDw~B#F>)SBY4zayDXdM6orm>ZZQX?smLTMlR8X^qrGiB0Rk=
zcTWZ(-?Pf^26EB4h7CUWreF2|Svg&+g@$`McRu$6L<aX^_j?{mzWY^R=%v;H#Z=uj
zWm`V@^|gvx;pGQkjua%SjO~{o;suj-du3Rjgp+^l;}u2O<M*L%&MXP4tYB8KU0QoB
zNB7Zf(xmH71cda>%WToFQMAK3@f`PMXtPwp86Piyst&TX8H8$tA%ij<t`V=Qw5uO<
z>^7}Nw;VQpr1cxtGc{{X$K+&rHh%?Wwq)cQ-C4uHm=rlBc6E`s;w&4St!P1U+u&ZV
z{fz8>NYHAIFW1*M&)oI@W3M(_c!mUE%?-1x=r^r{n5i1r*NyF%bl_SqFSpaqfDXQU
zdo9P2hxSGA%GaOpPNtyzfqVWBFDtiPX8}p1X2&4DfNi=c2r<j|9)Is#7bhH;eE&Ah
z2B{n#lrW{UF{HXK2<ck-sz)(0GZbPbDnt(3DRQAR-G9Hus|QBkxvG4=Vq(SPS$Svf
zV1M#39%nfgxLh;srLVSbdhfc*v`J&0taVo6;)pMwQAp|Q<h`^J6rbG|zn(tSRtuwh
zpu#-vd+}6JYy0U?&cZLJd-tMtg^gWFtb)~(JEWQ3-uPVp?oq$}oeADx>r{FB7!FBW
zq>$6>>U}JAPtd_KzZk#$&8HqzZwppmlqD{vj|)`Mi4xma7}gKQUIoE=Ek5|OPu(qB
zb}F$v4jgl~zB4YOr+vHnk;W|}qRyXP{1L`uXhrW*9jz|{+63>$MI*bOUSH@rs{MLP
zjNU}_Cymz}RoN%G(+Cp6qeR|{F*2zq0FnsjSr9IaeEeq1T02&?Fp$FPSZ&0@Mt6cr
z@j<-z&|Z4KkN)_kkH&(d`>iNE6OMkq-Lcg;4xZwWMeYZ+8b<LT&?*?^Y21j_=fyNf
zeo9{D{I7|#kyv_7b)d}bZL?pFdHyDRV2I6g=(bhzuV=9SJMkn~nq;@{SBAjMAjP>f
z+p~ACW)p!Me41H0J~H+p({#6V+WqW$3&T^!O_KbIE2G-(T6Gk&+7|ByKk0pD(<8eo
z>{zl@m*9K(pUTWJn9Gj_2tU+cegq=t<z?|>;b^B|L)IA--zne-or!IUT5(P?irjhx
zGPyMhrfKFr&_5L#>963>v^+~u9u~FIWWnBk_O1rvGH6d1SpKWQhaUGit}>my6`>X{
z7IZ}|vbDXm1AOkVDq)lqKG9gGgd6m6d3qJ_NoMoLNa5=rx0H^fPW@3+>=kx(>F*As
z>;^{6*Z8n(CHR)W9+p|M=E-*pbd9aT>m~=a`65s9<GWR~iUSxe6i;t<CCZx$ce*_p
zBa8DUf4LR@Fkx@xT%bL4KgBfi{rc6F#`=`%@{9o^j6txDnSk>&d#2Y&-kfoHH&4IR
z2%D6rjO;m1`9vn<H6fE=6A38IC98gxvvy!f{JD?8aKZ>!p1Y9i_2j*S8Uvl~LLM7&
zHn+Z$&(-nrreeM0ar5S%8zD(w7Loh>A36M}ejr^rODB}UxGR0RQR1o_Q}4@pskxLU
zDZ<BxVJl;!52<S`iesHr8hCYrBb6Cm6F>*yRDxn_X<x%tE5W0MizCJyJW_5Uo*SFR
z&s*PbVl|DK#8*>!BGRJPe$*CNb}M;BIJMAECkTlJK*?y5mnzLq8qZXR&CglCw*}V;
z-;dM$!a5*xUw6`_9Ej`wYDdXtZX);W3^E#E*B-BF02VXSHC|6W>pEEDT&QXGi_tpY
zG%U4${Ioe35bPB`8~nta$kV*8I7&5Nq0Vd_plvoWf|6qf6c<%Q5(bDQIz6*%p9nG%
z6ktYA*8Td_bd~BTmD!d?F23?8>T^c57GRoheUU7OWIWCA`59KcHaIYJE&n>3sA|Xe
z$v0CqDXsMDDs@afsaL_U`sMyqjyuR7_sSNyH;yYwrWrb2SW-&8mu38i3C$<dh1I85
z(!adeHRP81-us0K=2ayskPmT_c&R1nJNeEcRWKs3BJ+qyY6PZpM|;G%9#GWDNZ%c>
zUdEuk7NZ>xanZGwJMC=aHnXtf9q}oeKd8A|t?w1|HaM7=;n~E#2`fR4(~a^JI4;LN
zeaXHl!JLRu$@$SIbXe(qM^T}G_=xZMYZ^Vx0~8eC^2RT`9FIrHs9g$>%wx-r)BCm0
ztfpj#hZw;Ch5N$`%8DH(Q}yAEMWaoz*n&~Fq|FTLPPx+LrEb}zR~SgFxh0v6JwkM6
zuBpLi{d+<E1i+_QEGM~9R~~BNQ3eJhNNz?)nFl@7W`%tF@b=WzAV^Oxd-YLKO}Ay<
zhZjHf7HLVKFc52WIL5}*CupseWQO}aYCj^2rGmF>%t@%n!c6qp$Hm;no(3_~_;@DY
zBbgrX<9ZJjWUU?DE!q+^l=Is%+OTLpiNKY^YL0)k8Z7^;Rkwc*)$6kkjm4N7e>g~#
zA5mlzb*3x2g1Rg;;z1$&i87#O7i#KP%z!qha(|{Vn7OLc>$Z!CoWEk9t@2veidkx0
zIL|Uw&sh;9W@XEYx@VGLuquiI^CQc=O0<p=>ClRPKKw!mgDLU)a&9s)<ee|e_YeCu
zLVZK?RoFYm9$+`UW6RVZ3Td@~9Y2D0MNs^#@&&pn<LqzA2<#0z5?+pYB?zwsmppBM
zGh+#~Oh=`SNwiz`=yN@H%Sg1$C_^Z=0Q8ZyGGx%ZrG2so{MwxDi3c8>ESrN<>OrZR
zPxcI+cz-?_n4MD-;rj7z`ow$f<^@fHnUBH@Mm##m`@~;D&$gq~vbk`qtIBisd+je1
z<}<4)1}^~DylwBKr_yn>-{Q23LuuqhyKV9DT0MpEnupnk;^h7YDyip+7?r8Ph7p|}
zgP=T(idm+vsmym>1snU`G|K*+J`$!~G4fepZv_P+%1^tH=vkG3t4e#+6<QbK@~bF(
z{lFtA2}?ylr5A;zlZ&M`d`KT_b+bk?%q5&cKixxJysP6iR#)}pHBPm#{*B~*KBRib
z23I(%zMuI?cDS#EPy9}=w=gI6eca9~VLbO9RvpPW@Ltu#3?p!hI&6jr{>v*Vr3x2#
znmt*nmN}!n&skV-r~lM9GLm=L+7Ly|G_9+VZ02u^<~x?<D{NZRBLoK&e`G=}A~yJy
zTBef2`+s@X-zqPOHr`ZW<-1nI+BFaaFgpktlq<d5pX^NuL`Ev$`~&A>10&uu6w*eF
zwqH`?nw~=&^KmY)uYzQXbEU6hY786M7`e~a6TrLDWZ)m~Jr~}9RRXzPzCbP9XC<+*
z<_IBgumO)874CtbA+avi50kM!&HN)TH><gSFdD~8-+kB6n+s*FobDQxX+!6-7d<qg
zuCVev`d9lNjj$+bLQd<@N@Zi%I*32JQ7oBrKe1kJK)iI$O4B)^Z6O%7>j8-`eHLot
z5L|EpiAJpAUmy2BN6Q4+;H`Qepz1;sYCIDC*puG_qdC1w3ND0ic<BX=rMP}#Obw%(
z_57;XAg|*dyVN?mq=XinbG`2DRo(`Qe_;X#z=q8&pKG1#_9-<=drw26w0>22xY2Mh
zcs;xkW|t~dZuVL4q$q(upu5sO&PAW_XQylLQ^wBzjkP%6{QWB};tM>ecpF~-rhQ#*
zYY=}epk5AX8`z&6W}o73w;jPpQ@{X(x7)lq!FvAW_Edx5yg9n|Y;CHvXHvSh0Hsf?
zL>>I(Ynuf}#3|(mIFaM%8Z3wPv*D?#!@X)=i-Lwn2@xXb8(?@k1o2%NM64$x?BVb_
z*nvs@=mouyJ7=(+=@rw0S24Avp<nqgvhLB_2s9fST=1++Pe3}XrVn+x-0l7H&4eQ0
zDLdX?8LKK0o^pBxnrVAtX`R=6n=(j>6<+W?lI#Dh0(Kr~D1ZJHQB)}_R-P2B$5GHe
zt|nzqottr=%5VZDz~!}d+P|C_w|yPH+;ooHRssU0*zG<U$PD2spsZtriTwxiQ!R>l
z`8#}P0~zRkY@=(0EiqcIj$5gvUb~IMwbrks@bu@HKrMo2q%Nbm1#x1Zbhc{|kF4tE
z<SDkNPn|_jL4;iZF<ktzw2}q~Df4!p`$<)s_Eh(_uy>}!^-w8bgP<)s7Terr(3|f%
z8PtiDL#`1pjuS7klmpWJ+)1K-UyG8|^0v#hg2&wXBH{(Of!hX=8|ir&;~so@D|ZXx
z#i^5p9WzY;QX=2s=}i%m8<Dv9a6&6<hpn9=UXU{!)3a|FE=iUxC!n9;Z?R?c%pjuI
zATr>M<DILpCoooJb~r6kNKK&B@nJ!o!34owK7I`r;?14qSfuxDX7q#87q<p9d-l^u
zSLPNaFnGq2$oWJj_AtuBuPw1ql<ei6>*k;rLA@*mi2d~VMijD1GxQZRnyS;VYeG@T
zk6|RTv|!Bv?azl}Eft@S26*t=bCuP_ud40N)pFR0ueiFUYgo4n)#Si)2m6uyJsw*P
zir<}uXsX>$5D`WkHWuAmij(iZucbMV+^G&pib%Rxs>>#Zdj62Zrpg6~Y1&))e|WL|
zu|LiQ{S!47AW@H9a%3ZfbofAzzfgN}{d5#xaPv;8YR^gcA?_xxFr$tiinCiC?VXoi
z-+blxXzgvB99g>3^t{8(m<+v!NxKY4zoY&<c4w#g=Eg?KJp;vwQLos2!t@p!U}abd
zL|)9X1f6GK2$d80je*w$1&i<9))7&-N9J~KyL|L&qEI&Ht~Dd;C0rH&L!rx}mBmys
z^!2j)@9S$Ly)^AY4*C~(iZ`})8`CRCyhrg(F|CB}<{(^FR4sZYNBXyXcSZeoDX80g
z_dCPI6$Yw7-Js|^!t^*xqPhm1pb`(A7{xW(q4&%-ta;Dfk7RlcR2oRxu;yTux#G}n
z)6os*hK9W(CBV(hT8bDSIeC6%BTS<v;&vT1`Q)9`dTQ7iV9;bA=3(J5{<HwQQnKvP
zU}K3r9gpLU@b{w^RO3-j)-%~qoK#4y@^lcCG9SAJsUj<_eVIjeY)n==(TQSIDN%+I
zMz(Ibg-9A(D5sHUA)$Kdna;SFQsVW?+t{y5vR{WC`D!R6r@b`Bs8;{Xxjc6}@INk%
zzkcM-U)WPu_2y(Ma&{qKUkYOUwxs&{HGvX9P6{ll^y)y<{i;;@Qo~Vi$2Gs2O0fMj
zR948KOV8rnO63&0qpE*ZtEFv{fsGN-y=$LZjbx3r3zkYapjX?*u1;UEHW2R7u9@Jv
z<M$nKd7b$>j5@0ITkp$-yN}AUqy4Uc>^aTn0)6lI{s%FaG%W;48y5@O7uS-$tcl}c
zy!K9QfAQ^G1Jb~XtzsQZ4};5BGWoE+rp}yo1}pj&Ri1i&x|+`dbb0l0&;FC8|BthO
z|3mPjG*{Ua(fh>w|1Fn)zx8jTWrHqzsFRiR>t%eAZUtQTvflm@*HKM2`JU*Ry}+lM
z`sV#(Hfz*Z#JX<6`6ube8bp1_4H%n)jo5ep&ZOtfn$7>!$m23uD9Q1w-?E8+>r0n0
z5CJd_;s%UEgU>kU#Xm4a*oB;qm7wwrxbU6rg_VNQMtL(T*B$!JK4*i`LnzC2>>^5l
zdwPG^uXd<thWb)N+VaK#pb+=0b{Eo0D<FA}&M&U+gi8uS_O9f1AXiXpBi0pA&lSI?
zS^2j#-5^V;;pXR_y_OyE`@A4cVBNZngxQq&XoS%vJHEQ)lWLvGNl9lO8{@^%Qri<^
zjWWbG2%x%@cgc%n*&WJrJHU*7y;m}?JHobLJ8tgDVf$xkT!c^gvhyl)fj{>TT~T|z
z>)Hp5)plwqowN27G;V0>cESo}%}b8il4u9)<w}y-k`yJ!>oCrw$1{4@-}^dS?Qw1Y
zhcqvdC;fOA8Yqng`wPO#UEUCVkRC%<1ZB!ye}A}YRsOcdJ>xQKUMqY78?32*lW_RI
zTWS1;?Qf0zTOaX6o`jH|EZny4tsc{d_MS+-@3oAKBRe>?t{9t*`oERfe<J#~0sc!g
z)l!q!7Sr1`et2DIY3X;}rZJ_{pm;u_jywHdHvKPqcO$DUz9HBHnYD9Rcl7Q`jVuNI
zyKMf0K+4{c@3Lh(tcj_gadC0sc2ND3@gb*sS4p}s7#G4QBrVB=kU?V$?O1hjU^@#n
z^jqd1vH!O`7%M+oxFJY8G)nxw1h`Xei|g}4RC`R60!Lu9TzMvKQRnMW4O*G1;eShE
z|G<d`(Tpw8v&z=|`S6hR_XkI-bD{MyQfCTByW0}8Jy5F#$^vz_9bnyzk=BeV6=L<<
zC&45A*ks9n($T*~K*Xc6$!oOk1tuMl=ha+X9_mt9@U}<uaqleKp~Nt~sDI@t>Zlpf
z<h;4HeOARe%SAO=cDDeS2o2MhGx+yF`A<ljq5aKcNR>cQvPpV>Mw3rH5I4;2*0NuC
zQRHLSMKC*(=~FM}fAGp<{Q$f@+nX%rC-x)yzpXR2O^xgSxfg(OFY|)M3+1AeA?FBn
zv9%rTxtI#{CxOA$`F>hE)e$$LlG)V~VAFTF%<TGeK>dtSlS^@f8+0QH>!@fjQRYJu
z;bLksz{Nd4Q(pAH!ot60M1PB-g$((ud8>S&IWz;N@0*jyr>_Aj_t|O<+zvlIa%Ds`
zsAq<VPSZ=CxO=Qkk2%;NDr)LXOjPOG--V3U{W})>w}bsJ>Lza!9T3}T>bd^_1MX6u
zBKU91J?G-~m?$yY0C?lawlPy44WW#aBlJ?BA7U=+uRIn}W0&QSw;Y(CZyL9^eM}Sm
z@0)vZSZm)6L35VmUuCaZsV8@DarnvqFaXSrUmC23JUnf4PSU@~p#FQ=X|+c$qQ;|U
zdg-Ab2W*YW-sJ;`{-0pz--7q2)^Qo*j%&1U8M#AgfMNzGuSQk5TGpt?Hfw<q_DS`H
z6Qv##4zrPR0=*}Z_adBMHzxc%!fO4ufo=EXdSh!yy3MiK*S?C%7Tg8YgHgJg>m5xO
z{C=N^Rl3yxIdtg;B@@%NYfLb$wrk~;l`j%4618byhEI|{-+D#PeA|-Tk2TVGU@a9i
z5Wa!K`poCeqtd{9Agk@Z8C?B)_*{d>(fZg$mABiD-=Ro+ve`Hq<Ra125`f9>2bG@B
zAHRcOX$5k&*<IxQN+*|-ois~NDcA%5>=0JJUV{G^rDNp~;MX}H6yS)O?&U*Tq#}BO
z`Yq-lAN}6lo6)oTF5ANECD)a*{_Gea4YcK+)R;Qu0hE@nbUeU8hB5V`HEfP!uaq$L
z+<!<ad*Hs}f*SW^UyCr*)}u2*aAK|-3@q7$=f@@JH^;@>&L&IWO8BFrb?S-J7T1H)
z7V)FI5~Ta0eaFSA&0-*TF2nvm<+UWDHQm1rwLVt3k!&~a*lSqNf37;}AJ?P{^6{P<
z@`PI&9UUf2xH()TYk8Qv>s))H@n;7*<in9oC$V61qXuZJBW3mgZp&Yj+`K>a%;Yq&
z?rn_nA1X&_!H%N#kUM)I-+S!GpXv2dHfqVzz%mh|bNi-0Y`PFhxk@Z(H6#75^iNy5
z-a5De8CjVh|5H{6gaez6L7gOTv45)7|HtP48CCyJoBsk)3;#a@?E~&f!zOPx3)`oE
z?42oU`2xl8AN%u^leMdxoj_I!5}be7No~sYMrBX|wcT^pki+^v^bc9rtAD!|#MFV(
zABF+xTL;v3>jZ!5k)M<?2A+TH_jmO!{zFn1e*UJEdhW*U|Fe1h<5lC!Jw9f4OiL4`
zZ_%Z<UWz)S6f;(+lgV95^H=hnVu=m_YfO3#eq4XAhRMWM4B&ev$Cgsb%5V5Cbdq0E
zBNXjsP;Y!a<987>U`%pE4w`c?@~_E6ZO^UCK3RpF8vYW%oLH_k>4;KPYySssXqB=q
znASs<9L)Yo)V~UP=qTxcHdLct(MbmFHGEYn$n3{c{l5>CP6WScxcSpT>o1+7L!@^S
z2co|Ju)dYhdV_TkSXS5C={WJH(c&)aAhq3H%TbEIbpJ1ZQm0(T#Q)nvwi<Ce%_Fds
zOipXVc?3^@P2Sj6Uao%-vk+zA9OtacxE=5>4l6q1QfSc;<}3d*b4ug?9V&-|xwFoi
z#X(o2=AQp0siITJI#MEJdjI#3Vh<$#eV%%7b<5?q@ug{9^J_z;J=}g)*whQ@JlOfT
z_ROHX{t~r+o1oDN1sZK9dS|-MjB@@Z8(1i!Tx}ZGtI@#zPai^bNfsr=EF*28B$=dO
z!u_{@!2~7w<?X8GeeQXGZ;A_(zl~s0LtEoNMsB@D=^03w1l;?V%KYmMP9?vy50HKH
zQ{dkZ{STu4hnB<FJ6pmqEhP5-AN#9&FGR&{I-a)tJ(>S#=>Kp=4f4Um=7d<V!2VP9
zACr*(n|MC^jHiDw+kZ{`^!1aE{Wb<!TYtg9-|F$7eowRc4FMHM0qieY|EG8V?a4I3
zz=n+KYxe(AMhl*|4C`IjaMuBssK;Sa-~7F1%4mPPXNNTXKTU5JK2rR4&!f9r?th2Z
zza{dYe{Xg8Ew2CDLvGg_lqdbmfGx~@z2s6*fVagNe+N;g=R}v`Z{QR7hxwm!Yx6sB
z6v#DiCH=i&|8wE|%{^(vzrkUc@?Gh7%hol@TGzGVHO@CAfALQL<<EtCM0B_t5L%o}
zVfEejjtHzhuAuc~G<BwPhuzNoJG8h-i(oKBJyP1<&(s>8wqVqGE|`a|-`}go^j|)B
z3e#Q}jG9pOvXVu-FOO>V7ewq#3wl{`0U0kvBsyA8bHcaZG<CvvRNVDjR%M)loj;8f
zs|;_=sAZYuXJ}mOQeMdI998U*n48m?R-9VPT^=`m;shmM)fEY#!bU!auMK1#cI7zZ
z4?Tr5+&DZWiat6=u3S-+^y;;hw>Q&Mr=>|d<lenj)54f=SfSpe$L1vxuno!-`@Af^
z;<zm7H&xo7=YMh(aB&onGhbq%98leJJ2^pTJ4+N{p11wXR!?xtVy7M>uL@ZosEB#$
zQ6dkRc23)0=71oP4nE_^*OfdqHNAT?^I&2lv~5H8d+@&ehbViGx?ZEs2i>>|w!PWq
zE}_ki_2Y<rI=DqL7F7Iu_JCIX5pu}0-`hkanlEXk;Et-+QK#)JRSmguVeX`>jrzn9
zG~F9@Rne#?)ip_icOqbUs#|N^`49ptn0s>+E3$L6(fbA=67CJn7z(gVY>c;V;8k8=
zA+p<_nwn70o`s30NSjtPc|nRTeMBTx#cae*%$vbjSBZMY8AK9$V1();Gmd*jTouhJ
zUGF;aHqrRiN&Fr~7-<<7qN{V$F+z&Yu}~<6ztJ+p8zpYWDnT-l20yj%o9J`wiD|4G
zP^5#4=BpkiyKH+tN1rva`Io3y8=XnG5AEPQtHHL5{K>H`K&2@sHfFEWF|jDyHQ?bv
z<q-WyK1FTpb;}EbljS1$l76pVWJ1pzwp)EFa>&BJWT%1+h-cwpv41FAm*fXaFYvoW
z#$#vgxwtm3b%cp)`e`Yk);u6qmo5a+uYEYkJxO=n*gY!<=Fp(_n$^CmTG(#65Q1EB
zvw+?*g?uzycNkgB#f-#UPd{MBff_K`R-WII&)Feob#v9oN)yH@z6N`2TxpTLgVaO?
z5C-yZ;_wERrs3D&-l7@sqe2hzl24x`0?Y!sphlXO0}VuW&y^U>fOv}lcS-ic+-Q7b
z9-w5x>iK8ts!VkF2WK!(s)!VNO@08)lh&B9c5X)==C=v$7$2}Qa2P)O4KW=-MXzR)
zbgq846|1H%$Y1Agj)N}-x5RTVi~f}dp4rv8Gn{DAD_;pb-rR)uaDE+mvXIw(alUiW
zeE2E7VGdg|f%-TywmDD?;qDUv(WPas&D6QVFRk}3ld%fTX=j4x*+=f<j~?Fn6A%2z
z+V=e<$}{mDezyC4L+A!8q1Qe|f_p!CZW;9GB3vC4TuLtB7iaL4&_uEDI#t@Cex6eV
z%VCWF(3<63Xpp3-vqlkQE3HB=;!EsCxyK<#VPAfN_qgD}7d6;9WO`nJ8=u8&gd+(V
z62Q;C1N0`gI#cSN7<V4?1{gHJERgfjJ!Q|8rr&A99H$GS3`ev(TbwObrmXt%X1r!L
zWKj=KUkJ>z^fb_%q@MSk+T%s<N~I#!_NG{O#T})BGt$@y6sm;d@y@~;=9BO)<@<b7
z1v8qY1O^$#U|Sf<lVj&~nyuK$u=;d$tLl8BV!8@L4^&D;sZ5Jd>SXgL^OpRDz5T$7
z<rD~5JtonAcEBkJc8dWBWs?eJM;)NqeNOr%?>Rt$3~~+|X{y)ug~PVcjX{;#NiCCf
z%F#GwUsfDp&pP(Eu__y9#PFV@8@)CMx`ecQtE)M$R!87@W1xt}*hJn~2xtYc`Uzl-
zJt@67DNOe5NjAhITJVVVn2X~Wor^uj3umtU0uqZ3Pqa;M`B}V@4a9dVSE7q;Y8!jN
z=KUJoT_LFsIElTSS!>l}Yqg4ZF_gL+JA#0=^)~kP76EXHKrbu>_Z~&zWv4Ah_!Z#!
z%5m1tLFM#J1z|<$fl?{I>$@dbB4=U1IXa;EPzH|D@4tK)nS9kc88AfcH#ElC_>;2;
zfFA?;Vbw1V)C*gVBU*Ivy)9?G?Ecyl3XqfG#&*gwhJdwX|FyBg=JmqprrHakfPEn|
z`b;!WXtKBSdvo6h^5f`3!JhL+A>SEIxerab1yMCRUWqz-_;#tY_Vv>9_0rC>q>Zlf
ziTo&kNq+wh9p8>I+m=Jy((`?(3(({xjL&!A%QFFVen42tj{I!=fQ=0Vmx^?%gyZcn
zON4|yVJa(r+h+Kxni?U1>q$e)X@kkd#idk52V<DfEJr4CI!9-vhwn=TtAAS)5RV03
zU_Z~-j=#NDAoIwK%Z%HnzLsiUr7rKXP+3}&*IpH1qpGuZ88I&Bb(3<6u;a*rb{{vB
z;d>-lx-VJ^_5Pmh{hjCHd@2(^wSL(ZFjNiHwC`FJ6Ha?DE~ElnmIIh$e=D(23O^!6
z&+XAr-T%BK{fPgFBtG|e$X8;bz6D1#V}bv&!Us711oRYc3SBw9@kRJEuk#n-JN$M2
zO(~Wl)8#$A<%c=#X=vRF4@#U1_mPX))p*DEJuzt;V|(7~BeU0{B-eUp(5e+$0|3pr
zq<vL4!4(^=GH7?Tb#|A_*ShZ+jg?@>#y-)Nlry_^Vaa0G$?8NQsxltjr~aAD_|4u;
zg3vL1?m;$T(<Uy0kk8>Z;H(4a>)VQw;j*M+(u+(>c%JBkB<hpgne5N%i0j9lk<?m0
z2~gXkJ>RR~KCQ@k-m)mQyvt_M*fD#V@;eFMN+FaW;<ua)e%JyiN$D!%)r;sWN7@~(
zn!fLl++?GI0!_=Cu+hS40^P$Q14hh90RU1!oAKl;V}1RO-;P+c#Dm?|e!4|(ShmXZ
zfT0qz`SHF+ry1>qAk;&9i!H_$Hz{fEt;{O^eHXiSUiY5|&({6Mg|#!Gav$a&#&l-y
z3C)LQa;b7B2`=p*nzs-o49Bg6C6WsSlE%M!IX9?v#4i->2G03=YBOD1yh?p$ZLwcM
z#m%vYju(eW0vX1aCr*PPB5wx4@KV($PD4byKDI23>z9w*M|yt0<b8j=cXV|0{bG){
z#7~qvgS_SJcBXa=8aoV%Bsbe7?c7>UXB~?sI<&Z_=maw6(tc%3aBiZUW9x?SrRdB$
zHuus+T|JNvEH(kz?c(5PekQSSmGr@p7JvmC7j^pma#|k<5L-1gI-+#-#w7>f#u}P8
z8cG=OtMa9D7_NDjq8{JXwY>0|hJH**!K~hZp0FCQOg&D>(c}@_xjI3yNu0Q*`M%cv
zrjOnLE}vx_ll<EjffAV57(=6GU$021>Z9x^pOq1{69#Qb%DSVbou+#1xPgx2?oG!R
z%^GI?-*zt9&bei7xCj4bRPO07Xk%C3JdY+`W;fezK+JAedmpzmHrJod?nq`t;Rklk
z2Ern2lo`>;_CvkdN-I0uN7;-VuUj3&5&+Npg{1}Q?dxtcD<kqgpuTp7!?H1-X0%T<
z`btVYJmEzxO}xL=h}5|S^sqv5cT=E6pAD$lymm$&HoIATOB{-I$>2__*!pU@N2K*;
z5YyT>$HK`@q<MH#4aRVThQ{2WRWoI2{~9Z1WhI4yDxB)ufe%#32RcR=uuB+&V!Sx+
zD)rx}@wa`Zzv?!v7DY|pShd|w;@!}r$Lgo7XU7+KJRa_t)<^p62$?R4h~Lk5JjpNY
z5=Zgm^gH6m9gXly+~-Ty-jK*;gM;#L!hF~EfRSs;l465A&E=a2lL52RIyKkS{StJ_
zfSt)p&rLJNh7)im4m>uJd44c<>C#JMLfcE`!xEYqJT6M)Jp}o00*~B)9$1b{3`Y<p
zgKHjo=X`soq!}sJY=-4*!EiD&>_#0Ry{GMGN0`g#COVr!XF9un7ZfYWIIJv)a%>47
zvuo;^^L^FmRpa4PLmn|Z1B7^vmoFCtoD}H5Jv;eA=6AvQm!StLD{V(jSfsw~9ODy7
ziac`(2MG~57#Gv~?-B+$VL?(yAX#TOJIGSo)Y??X=&z{R;tfJ`hDVpBpc;WMJjbCK
z0w^b2m})g8y12ZUU=C$JXXys_nFCeT_zQ0m49=f6&C~LTzwKEefcb>&O784S7J7IW
zc<4)@Mc{f8Yl`X*=ZAaRV@AP8p;*S1egTIWKToHN)A<132O9`!*RQ9H=ZlOb8Mr>H
zXq=_PMr912$2x&g6z7H=DMG^6ImS5SZ2M9=iH?GEDr;r#&EOM%@{=VKG@@x1QOt0*
zKv;Ty2EXu)#Lu5^%`@!ZY$?U7cM%u$^k4m5lTAX>Y2V)cs6o;kyY$(!N3bAqxZ3B&
z21$LYW0BbTYRtKHN2oYZp>AXtx|P(b$NI%>#wAUc8CN#SH!S3j6awH;j_0WL-|2l<
zs2Cu)uinW351m1;SA(xGk|FT7JH#%v7A;U=_1v@wE5>L&t@damQT)jL0uv@LZtBZ!
zn{H<BuvL;)brN$qT(sjx15lIA?7c&qu1}7Tcg|jRA-36vW8Yvq4_zTIksrh5eY(QL
zUF6+1F22*Abs49D3}*9wUA)?KRkKiixL>y9k_r9t`Di&y!1jgjCSV**<1e93A;gIN
zCQm{eFyY}hu}<y3NZlEFx+rnm{#Z7jcNr(%)vK0KynCbGE6E`z-sQ}4+$^ZuRxdWa
z>7-%2iPhX$`li%g-owlSJ<jGu+U7;i!&6GBJxVLnrdo}<0_qRazB7CoHQt3a`Vy-$
zqz_Neu0`%4`G9cWUrYGTtBgle^QSErr!nZaOJ&LK$2C@Fag*O>oLS5=eZ3n95e8E7
zl%XX>KwY0hXr_d#0BXSH_Jy9jmuZT*WAuS(e?wz$LnKi700&pckE%y;BTc^4iuDTb
zbS=g;9or+tmRK422&FCoOnbieaQ=P0$gMlQyv<Qs3j1C+1I5E-brtmKmT8mdetp;*
zY)8~Exb`Z~>TQ#`v@+T&P%$)HSQzKy-$oJ0SGT_ZdK}CqZu0D5lk-N<l|Yy>iy};(
zn-_T&ofu_^gY{b^i@rjc9GTyiWDq~mPP#FM_8maq2{F%8k1agos+p<qUX^7Ob@-fl
zGFlK#db@FJv$%HmbBTyLzD}Jgkzv|r7snQWVJrL%>E`i_^U%=x6G;8$#+DfIOK&lE
zKT67o!vgUY4x}ut6mil$d|JFM1flE?LmSc@9+-Y<BD8DSqix~&C=4EAK8b5kfnbvA
zp|@~UaNj9H&68q>>BmCYWwhtioIm;`$Duj_OI29Y-qiP{$4Jk<;PUAb6JJ0F*2K`W
zaj&GI>yav`9>|7pQUYIolve~n#mqfnbkKn+oyIsehs7;#v_`#!4vvFyv@~Y$#wNO8
zav;s319iNY?HgWKvq*8c8A9A(So_me0br(^Q(6LT+j3rdLV@~be)I+=($QwzL#rWY
z@W9GJzIwkdz|P@J?;b#p`+8LlNkxv9Yh{7KW}J{m#~n%8q~wEV0BBa)+dB7e{?lP<
zy$_xM!K)j-$>&dn3hEfAFE`}&?H_|Q_CO*ZI3et7qDUEk@>`5VSA(MZ^pY#TZW>DB
z<Y#S}c}M0n2`ffWGisR8cvEzpig{k7=wyMzdR`i+OIZ(u>%M#`LlCHbieZWnSIj_G
zCZEL8==FGP>!#QB&Ag6|shDTke<T7uhYgsC<HZ$1Hf+Q!ux@I65%##nxO!#qVo|f1
znXs*-nN<0_ESs6I4Troxrc&T&#B0+o(<Rm|L4pQ!k-Sxx<W9%dkHe&~HH!k0-i2%~
zTV;x#FsmC3wRyoT)T8gEJ4lIvTc*i;I!sO!88%OJt~R&X;gPa^dT71)gNfdS@#ul3
z+9lwtyck$vX~6XEuGeKc(U`Jk(k$@NcCFM8)?1U8ZWwX5uDK{va7$va+JUd7?31KL
z)DnUZp*gK`3hS4&DT<>us_A)ik;UJuzzEf$X10}P{9uBHsA6Vxh5}2Vkrt3OV!e`;
zlbH}(&C9jPFjVSBLw=pZdUuYPPc7PMn}FWd6K5l}BD7`Igcj8Fs2<5bAzX<K2j9aT
zF2kSUJ|y^V<)`_g%VR(jOmMH^G`6INLCq3q*@uR9ONF_cGXwtBI)ZrJ>O{e{jO9s`
zehGTIF>|9^o!-0u<W<OqE=`1KuUKQdSR`q*FWFa>b+j<1M@&V@XT7iDr!)X&-7X01
zZ8Dn9T<PnI<w3_%Hgw0FC6wz}j>}}^+L>dh=S>gWKKZCIj<Vd8=e8J05_bXF52(*=
z6^rjU)(-elxA>)WsR4W|sYqj1scyyEwlq>raX<uJ9CjA51}#{F7;KR4Ayn!VI&mVM
z5w%$vU%y1a+H9h(!$@|~#(38DfUTCxO;N&S)k10`zA>TKYq}~%a(yZZuO+ngddGeR
zRbj(-S_$57-$c9TfY#;b?J+q%FvN(|iV<8eSp>!-Vj}A=SdlG%*aIp_^9H42A^VBy
z^cKfuxVfeuq)NWbo@<V<{;fD_oXCJkMz0|1Fo6`*rMZssbl|i|1ouXL9?2Y4G#JUV
zZB9SopadUcc!6>;2{q$<(Z1iz9DP?h>g&?G%L{7!%yU&&=;7$^Lg;=MdT8m!qF65=
zX%?H-*sV(YeIwQ0K>si%?TM6Ik1nqQ0F$WP(p@f+oE_Adpg!j-A#MmMC4GE)2Hwc)
zue6Y??%b^?BxQ`Ev^C|{9@yizk9)#M$aov~p&N?Kyuf8L+WJ=*#>~Os^`h`9=NI_!
zjGokuCp#~Euvk!h+G=2zU4&lfXna8=i{pSgg9xmyro5y|yS*D<eo6uq?K$Cc+sx|*
zJ=6Bm9-tD|KPrz(a2et`U5<IVA+;9ci-?n1=h&H)2(BCTb#!pMKr#4No5A9eo8t<b
z6U4i0geKC&?%G<gU{>lfa%X%q&X9BRLN058VhEgXH+7ViLEctfw79oF{KywRIjOKY
zgFw(8y+DC;chy^d{=|0Y2K68B(L^8H+5z;Wbo#j!<pAqnl9Ao12nAea=DtPK?}b$+
z_P@qsOP{qY7U=4=gN1zWe%nk#9coI6%3WCa4_JwWil{-LzP4Sz9C5H+DUOx9Bb_o9
z?J{D$=hocz0~08u9ybnV)%c46dTFD55O@uJe5PP_O+`;;SBbdIb`S{1k=)#q%!DZC
zwIiQ8oQ^DgBIW1mpOS0OGr`BWr(=-uE)~&@5n0U7&Dc1c&M!byWZ-<l)t(*7-W=lO
zP0;E}TGsVn?h$HEha0R94VA-T9i|o%vLNx^sIzW2)fo(KnQH?c6eaJC+CQwkPc!6}
zlv8Y&%qZ5a6`(dye&CW$&09>{6vhcK$q*gl_Q5UY193;~2mQp#CEQvEpXWqk0I`|g
zbtR3<GlI#=v!hdPj8iZ;CS4viGdGieb|52V-(0&2wQ%S2&=tyU#y=Y=S8eJZa)60N
zt3{)$)0JULkY!k=MPB4tK9c#v-hPwl6TX`fvHTn{Z8u6Le3~X`=kLuLaK8{%V&x;9
zBgqC{&K}ScAKjVD`Oz0%x$!txE>^~#2l<J%V!!N@Z=h^8pF|?|i+=M7h1YsriD9*~
zGv3O*^1#Ro=WOlw4j3mjK?4>$dkiroP?N5y9cH_#(wy5=X%+(|Oa%Pgy&9f-x%Sqh
z$l)aAQHFoy?F}gyih#FG9|8N8EVP?mkkKS+Zl*{|dhVwo3ygnt{5tbG5L;1~v@s1U
zZ{oFqmv1OWbG<6Zu;xO<<G+W;t6M|v*o=!|S7OOamf;p!IvKXEN75P>!`#^N@H4#-
zZ|EI#s3K_AV7%=}Vh$<MN#HTh4wHo+ylH^J-G;|2VlF4O;B}bq+;Ha;lx~K*rn(n;
z8G7{lIgB)Ok+|7twb=bIjIn>~n@>tEzAk2{3s7OzRY&4IHL47@XmVbRK3OxEc8+Rf
z>8hieI<(>2>T}aP%EDKRF2gxadO>OXtHzA<MxbZ#avq+7%ZaLrvG_@Tm)D*20mB*2
zZQ~9V3GcXt^jwJ`qi!XR3`@SJH36p&3_6n?w>;xLlAwz4)%)p}#W7U@)s+y8O+d1r
zc|nn2WX)M*HK8(!zd5GZpRM05S#*Jk<8rTusPj6(+w>T9^Sp<h%a)~0tCaNZthn#C
zrNH%is)hmkZySa*9BADhkgAanhfkNyMESC~*<@V>2)Epi868p+TtWNyVOQkUD_rO#
zQ1zI!0)H6F5O2?csZgg!?`e7Mr|6^N>FJrQo>Sgj(}Lx4`9RLR=vbvNBZPQm+<}0X
z&82r%%z!)-%4`N(;pOGcj+^E-nmWb7xQxx*O1=$ghZCV>P*HL2rH!|5qfbuan_vGA
zn$G*LsjTbb<2cGVh#AG97$7Q2L`o<_s7XW=M4HMdAe~TT5<sey5L5(2dXW|&N|gZu
zp*MrH&^totN+_X|kU$awygWa=|H1v-d+s@Vuk&4dHSc6DHKeQ;;R6&oJrVjnUAU#f
zkfNl$k7lZ@6)$OnaeXOB9s6t~pCj`p4tskpa3nB7f}y&a3u1KqK_4<$$FyY38`Wa<
zm4#QPu4?Y;_QZeOD}R97%`QO~2_HTQ8CZ$nF6Vn{aEH1ACn2=Hb#>nq>AiS7NzFK<
zN*LxM{!#zoWTwZI-gZ5j*J%SB->T`W9e>u-D34f@L`}x7CxEQI2_;QkxLv{G6owxx
z&Pqv~+GQ(-(>v6>(h%_I@PG2x1a~1YaeX*6la>xol7<9zPT-usj>6MpQ=#)^a$aMR
z1RrFXMJGqCW>0DRfV6!O>ygyEYY-nm!!s&ly=|D$HiR$%*cfj8cB=Qp$5#a7L@l5u
zWpL?<*<_W@3e!TI<2pTajZ`<`Bgc9I5AsTtZjjscCXL-EX{7Uu8&qZwjE<jtZ5>GG
z&zu1(h*vT(>@T5#T+6jv_=@`FndhTz2F*K5*@MBQe2qLQw_=(5&(gXLED7DJb2nDj
zA_Arit>+W>ug9%ikQi|`{=N9x;sy2CQRBL<DEQvwn3)s~Q`3y$F#O#Y&s=YQE&WU{
zb<7C3cj+v=kHH^6v0HaKXIt>c_T!hmpe6bz)2T;eMCeFtlUSqFupG9u^yOoDrxY)T
zgKKt&dS8>X)|a@C_bdBo53tNWU&hk3m)7=2%c)-9fSP(V7ooJzNx~Kw-LDRHA>_}}
z>Sc=uHh}6T>a68{-xWe-?FyFk`|?ekEjQoxiY?PiF8KX+UN9>ud9+4u;(M=Wk5d^2
z8qgyR5+&&G@zlLCWpsqQJsHb;i<+s|Q3FZa4JeFu#`MdL=WA1qp#7+}>{0IPiL$>B
zezD6geuDko>UeUjkd0IF=7<$;S{2q_KI)Dm;RcpAGg^%frdmTc(2Ht*Zj%M5wfp-e
zme)sF>itSdh+1h6Lb29lQSF#Ehqm~9z|_OB<oKR0)5luVTkHX_zQBE|SNQsvD#S8^
zV;2|Ql{u}H+OwZiVtd_hekK3U-LQjmHDi7!^@|fI(d1dI>Ll0=<P7>c>b%xt5;T?U
zm94aPZ{I3zGpn(H@U@~SuJ?bEW!Xu~_TlC1*CE(MbH(yxor($BcdFYaxO>jq4SCY0
z(1D%1QWbj#H$T5LRkhqOZZ>keU1;O8Z@&WIeFH?V?2&l?ZXDd1)VNo#zNCez`sg=m
zL+DO@q8AkF7CU+}fi`w`%xKPYThi82e>DON-m*wC2TVo_4$f~{uL$Zd)`2T^&A>>z
zJzSNON7Mz!_U-PP3*Od1(u>Uw7ma@XS&M9x{TfBZFU>9CC_mea?<Q;Io-VJ~e=tOI
zCmnz|8Td4+8Wb2-ShMug!GzRA)2#JPrdBnU81PX|9|lP$X)wyb`PfA#bbLBWc`(_s
zMie^iEzy>c8w*zlyQF+n>c)!}gF^^<#yxe$+Z507iRv3l$&q3~PNvv#J#n`OJ(HQm
zcz9h(L#%1YTyd@KlV_q-$o}tGyEn72-GJu(pk_MHQ9Z>ueK^KuE6m+8B;lEC9&Rv&
zQ%|Mk7&&dOU;@-lL=TPTtZYe2%)jSir17o?7;RZ&ai_cu$-$}duQ|4#5B{fmUxYN>
za_#HKtYDYZBo-gUuE+&U8Q?I2h~xU!O5ot@SzLp#a_8!4QG=|u2f@wJ|7P#<`ZXkv
zi^A~5xSG~@2}UL)$<NBvBqMHgKN`<8t!IwX?VtEWWviPsc7v5CoP}0(m>rjD`$X4<
zMp+ieT^YVH(Ov&Qma5Wkcm!ml_6UU%=?OTh6>go$ru~+^eFpdbkC!WNwr=tPLU|=0
z@uIAuF&#T6QI*g^9Sn%<-z6S#Rj<Cwi)8y`JQOq^xcej`V(Hg}9}8x-nIZH0!Snu9
zGmB8lw3h^F=)Pv=kZ0y_&il~OZh`z?K3kpC7}&kV|B!;;sy-WY7aNi_4p`ucvEgi-
zU{e?KXQ;<n^Pz;L%xrEN{zkinXq3{ar(b2=$2`Sgt9mBEK4P#+GaI;kBB==S%kLl7
z3h<28V)wNoB!lj8M)ptGoupRFMyXo|V^8OO4-~2=082ShjGyb~IiTqvVy{5-{V!MV
zgOq3`vAgQ(V4dc!M|!Pr^b;G4>Ao(N!`gVL_6tdLt0W81Xg06gj3y`5ntuIBvn(Bc
zwS}BAvRzGvuNBH^IAp+!z|tND2R%t15Ik%rGvJm%%Kg`8v@snzvJlFxVt1brW2O%#
z?XoCc-<PFF!b;iNV00x8vj!V93uR)t55TNsPdT@4lau-+ux89u^)R^*>zH?hJ?P5r
zZTB0VwW&w1R(iv6drt=IHJCZYb=RbOQy7vccQY8LjxquXu1dhyY*^bWwarq%ohq!H
zkhT9@uDN=KHS%5jpWFzCGYxT-Hoep?d%a*B^%YqG*7ZTFVLRixEvQO6#eBUmIk=LY
z!ZPr1i1YjC32Ump7I)sQC(b$<S5Ir)O`d<+>~^v|<lydQS(DAx;FAmOu79#OS8o?}
zx-i>R^uOlq7zK%%_H@oO5xkGDG6Sbpa>@TeIZ^7y!QCuc+Si7nLivC-*FmgtktF0W
zUvj$W<Zv$Bn5nfGu#f8|hDDLoCsIiFL%0JPdbUohwN+<=KjM4upTu4jM--|*Y$SHf
z821c#(LVH+6l)B0-_V2UtMAqaq{5QxPY#o6+q_5emQ39K+JmVvJsg8gv6^tc1RM2Z
z#5NS7>efcJn)|gzusk{6vD6bU^iz4(B63@c#lAI5oghRdtWnpmi1rw)O~n>BA9&^@
zso((8)rB6|*6)F)C%uZ?(k-Cwcq#mblL@M*q+Swfp}NA=s{Jgd)b()?E=|RxbT$){
z2VI;kyDIIsPgQuF(g62D!0g&^(yXIa_xzY%Ams)NJ#3I=Wj3Kw@x*!D`*+Gulg0Sb
zEM^@3fn%eyH#%w#ebL?gmU1EGA-td$+Y6R)`_I6bH>zSe<p*=qoP+c)Q4HowvPxYK
zx#GbXn!es<1d=N<IaQ;-NMTw?;G@c3m;fhmtw|DU@#*y+&_^|kw-AT<!lIELgnlBq
zKAAzhcy{~{etsN+W<Kr9kAkv3VtmoDZ86zB20b#xF-$$u(TyURVN)1OGLGb!XSf#s
zF=m5ySzWE3;LhE+qMjfe)D3P^*&I9x2X-yeVWb}HR80uul40pg-`R#(LM*2-;y-58
z`OYWI5pbk+*C$i|{E{X#U6@r>Jf~IAl?Y1NBa`LURSK%5VC@crrzqg1@52P>rec))
zl;5nBEr<&6S+4Dg-)#8mJ%4vBR%=jjEVb1k(=cRg7(TgL=zYFgGOWHL){V*3CIFmS
z!@K8MoLa90++O$N2%DbrB;iw9{E0NN`Zf25%qIx1WN>GS#@=f2SFALieNysuhI1bf
zVw&m+N{rSH6}O^73_;Iqr89vRl|UMSY`P^HA%ZJXcZ~6uD!U9qR?DJynZ8LgMgiW(
ztx?%iwf2S+T_(UOVuyQ=w4iNyp&4T|b&Lq^g%#NT3f<o|@q0Wj1iY<TNGsW-tp+Y<
zSe+ERC*+5pByNB)>cSBP7Zr-LUd9UpzcfaERq9E?HTYb^iLW}y4;QS9<QuW9ObqEQ
z4Yt?lO89D=*W#C2>G~9|V|l1nLuaggJa^#cQt}`rK9%^ntS7$&E}?S&Lb^}K8-o2s
zShq>g-p||fo*M-c1fOb?`YJ)uZZjKeoE8t+nO+>|-<6BnK&&q`z`MMyy<{O1i}nWL
za!1HAS=@ic(RmWHHy}@!q7pD~2x~Xg2kN12;~u0L8vkdT8byzyLfGNhO8FxjOUE1J
z_)RS*=E**o?%|`>2X9~yyDC*BnA3_v!%5iTn}O546L=aSR={@2w9|$(sLnXGAh)ir
z)qDrOPCzF@^C)j^*o~=-C)M@Cn6Gm8h14ldh8=OVdj*%Ry-Q4bkZv;vkDgodeiPQX
z-+b*yEW%Y8dQ-=SaxZl<oKbP#g!(wUh8@EtB&e)w)CNE4oXTzc$l^D$`8$tq7BjGD
z1`YP#49E}ZU)OQM-t&NbEPqVCc(_BJmjL4Ov`DM-T~^1QvA#W`Q8xaGyh~vmvaj@c
z@nUc{l3z>mbkHF&^@(4Ami*SP3!zX%emKl#`8<AAeW0nXBsW_t@S(X=+xywoD+uv0
z!fxE&NC8ZK%BK&CeiP#@-LS;F)n9B73)7vdOf7_A5=U$XM&(JE-t26jcCeSJF>H_A
zSJ32rl+#qxfn2IKFm{ZGbf{*^<j#q0D@lF)ScY|U+(4OrAS6heSVUe(4|VY1jsQTu
zD?y1Tf{{+wwWAjXvb&T2_>^z$B7gIlTz2VM6P|6IR5sohUb`W`oWYo^64fOjKY$x$
zsF_Bs|JeAnd|RGzsXyA)=?Nr2*OT_DJ_cqZ(<6e9w!*|9GyZcOP@hjhYp!i6-W99v
zkbaFpC+n!#EpY$-)+|k0YHB@KW2(}`tHgb3r;l=&kHJP1Q+Ett2b3P)z;I>!IRjQA
z(;z2Kqh~cKkQZ}-t{S9YZ~f$?sSIRv4JZb8XC16-8Ma?@T6KgVYPv*j0+5l%l)NfM
z<MEIugV|Pt$;7Lj{u$Fxb%UkPuYQt!#-Np4APnF1)$KS^7y8xGw%q>4IiGO5f1=_d
z5WJtoudpkxBqkQ@dXzHxq_KX3y{9sldr2F;<R50Sm3qrxng;P|?*YzVe{N<{H#aw9
z?kwEoKmC27YuZP&#8q#4Ef40_xVop@N0NK-Dd<m#g5?i#dZo$1+jPKlHwjF=G(G9V
zuU86F7Lr|2c=y@WOA*3-vp*6y&+2{~D**h~WSFyUW7lF!I`iqw1=voPU8hYjVrl8-
zt<&UQ-Bmny6?k*!iCKjUgaxDJ#|1)9+0LeKf2lg68r?gd-sv{MGW@BQ^$J5NMlgL6
zGO(a5t>T=zkHDzKS<OJ4m4cn7@8n3{!h|Vvv_9-?Pz7qO&`3#v?v)7W`A+n&DR(-k
z4_V8DA99*BBrZ5yhR!YfVa6`Y`v~9ahH5Y1yC?IUuRFOcjrhI&T(g?(*@=Z>TM<ma
zG!K)>AnRQcuZoGPQRo<a_a#K?n4)Mnwp4p=+{cvcTj6G}HldGe+~^(xlVbU^w9b!9
ziLXZeg&#IKLK&{t-WNhBxyDm7(%$ihv<>?n_KLJ#YgmhNG?57U(isu`lvQPK)gIo+
zbhQ-ame<-EwBWwZd>gh5;lM6%`?eeaLH}BcBJZfr-?|h>88#x3*1?tyHPZc9B*yNO
zE%~uf`c!va_U1#68aqCKQdV)BaovA9d@Q1mp^2aUpltc-5*M06jPQH;=RD=zJTYvK
z3E7(-8?@dn7qTt?GnE~U)#n+UAL48H*EEC$)(3rzn;%LtR6J{Hxg1^JtT$|J=?YOy
z+?2areG#-`+S4D6)Wd>n7;?ZY_WVbdPQ+xm_c1eK-brjt5;3AjC#SHJu?g!G3EMzt
zc*kQ|^4VUB=2Ep0X|F0@-nQIM6>*bPREV!E>lw|i=@X}jSgz5<*ZHKi#0rBu8>Lv)
zG5pOfPjHt`!lwkOiE|4P=7iXW#0EML8}X5t7NBOBi(g+u=Eg1D;8e;nht<+8{@WJQ
z+0D=(|FtLDXpR%6I3E3o$!02?eYx!76F(vx<aW<wqH4to$9*B|Y6*vKAUbbxCX#63
z0Nd{XEvjnWIv62<tC#bQ`N<a0e17_Uy?=&x^6(%NM!aj~EnwOms?MV5ZrGX7aVB;m
zx_cATEA@Z_aa4qW8?#foi8-wvoHH$JfMEAnokSekhKPaP)=eCzQBm_ih{zS($w|{5
zzHk};cQ_}`FZvqB1#~0Mohu0P)k>W#NZlJj_(p4TU*N4+(Q><0&~`niRt4@>1sF9R
z8WPzSv>pVc-t8MlaO}k!?+G{j7kcJGrJ+XD$F#%_kC<%>-Gvz9gV;PHKw5MHB{8dO
zZV`avW?-e`BpWBITCl?{VkpD3Mg>Q2#XHkI4;ZX@^Dz*%Rk(e#PX&#Gs;*X|vTMp~
z^~puPxvX%lBgc(hlg)_kzB8}-VnTeGI`}RJKDzUsF!CI(s!gg6N!5|97;6b{j)bh$
z#mZTiXfN95lDszLoUB|e`$nO`t6{lmU(N$x=)u<SFLj$4BQ{xjVoOPhO5AXM-5}Kb
zcVW)f<ZM!efGBYov(d0O3fkOl85<qIY+#!2xdeX(OWDU<lwZcrbS4zb&HIl5oH$p2
z&%yE9s=ItpvvJh*-D}ekxnGas^CdX7B?!m1j}ko#kudol2kFS0<aZ>QUcRm$>m<3Z
z6m!(HSP5V%=_OQR<0kSBh<z?#>m1Y8n%WMz`~r_%2v^egF*Ba8mNb3=4kWwxxX3!>
z25ZO+j-v~k(F*JOaqQZoy6~dZZl>9jxL~xaFdsH7$*)@litgFfj68DnaGXgfETy>)
z3<0QT0K4VzP6@}#`g$7+da~7CVd&m>!R<<kKZLorPli3B<2=YYX)S)}%hsD^U{~Dv
z=&BAOrZc|=!_-??-qjS8{25fh>`0iW^r6yiyA=T<ojvVRtGn6_kb@N~S%apQjMB1_
z&SVw{sz3EDcK&^?L*e?`Xx#P}l%Z&|&qo?9BhUeNBx086xnN+>lQ)lU1*DMLJfbg>
z;yv%09F=O>>W@I&hLQ#xM^&gFw}*5#7HfHbm?9s;CSvqS`SVkwHONh3E-Tk>vBP8%
z2;eaK(l-V`RT0X;>_&Dtu_8URyP`XZR!pktqRJ#5J+N<gcO11m!02Fdn<;|zYkj_x
zq1I#7`jJthCJg7SOb|3bn2U<bHmARmWhTt7X2JiJ6cYpQ6&svAr1c1?8T1s!LT|Dt
zar5P$*$x}UQ76$J<t^>I))TapYN;c1=d-C-1IJyxGgY<ODDm~v#}i<$s?ChLLOICk
z9rX#e=!p=xc0ZN!3{jncozye&T6HXa5$$RTWX8><U5UdySeWnm@m5?s<_-IdDEUmt
zClKhm<R;)+1Y6J=7L^k!^4WtNTIXUlqN6$f*!v+4-CDL<I(X^pcl%t*9qb0dBz968
zxKS<Vs%H`8wj)^cNG}_1Cjt_X@nzl&OdPzx6F`WqN=Y@O8gH1%2Yx_}OGQR5){_f6
z_@ECgSSgWTU$)=J`Lw+YLCW=W)m699qEX~z(!X&8`~Nm#9<EASPY#F#F9_oO`!A5+
zlQ^&E8psg0BTC#M#k}nn9)3m7adOeA@A*V|R0S^v#<nD<S1h7Bo8F<&y&>hE1XA)|
zp>SsF|IY$&{;F7A;J~+cbx>@;q@%7RX7NO!8K~VH1x>8B`0>Ul@3VV$6tVvrXPR<T
zD<Y$~1}?#iR60;&>%Zw4<JdNEa7VbCm#wznvg(mkKH4X`q;0EPsyD6m)@}u{ONggu
zMR7D>m3L<vu24??pad+mo84cDMc&%~1<t>yJkSAGDpl-KsG%!v-E7z~RUB^mhVUM|
zF42t?u6YXals+m5fi_sSeeuY;D=$P0t6>+2+!PuOgDD+<L0NYK7K+#66Y9G;@~-Yl
zq=ZyOy}5!sIW!ATz$gb_H4R3780^9)9c`DcSjbL}i$H}Pz=ZlO31hK%FnOni_Tfw;
z^>*Bxk7CLKL>iby)0co%X9di#`wp*9Q?oop=Ra#^(NI{y2#)MChkdc!5dutn@=^3>
z<&>#M^SkFX;@=2{<TtjPjp}(ZwGVif7D29pW*mBLv~-|LOmFJQg-Py<!4Tqbh+;hc
zdD&1xv$aLpXEv^(XFH=6(J&HbMUVg5m8Y|CBgD>oB3gfg5<5qhz5vzO!3BJM0}0^W
z58;I6VbDd!=x-k4GBV>|dOdP0HOxm&0XM0GQ0^T>U_~=ZR5{{jrA%j(mHRqB^u+0>
z-xj5O6dYq)o^a{4V0*IDKOCW8EF<G5Z{bWKzPH0Z;*(rR7f!Vzt9V^)WpSWFy&mPN
zBi^9J{0tEHP`O=veipl^hjrwwUz(47_|4QTen)9I6vX>MuZVhcCzh0c;@45@ezdI+
zX)~4j+sjkKd7bp?P4;QT&go7A!#T9-kKYtpT7BK5M1U{P_MDd3c}?HG@|$Hq;+vJt
zu0q7&Dz#9S736$ZXm;Bhe^3Iag~DHGG5-Jxe!@>4*LWP%ptRrh?YuHfsre0c8rEWP
z=bQe{Qz=}-TtoX9<j-?Iq-A~yjGAsvxOnS^(#L(s`HigU-|B;A*KMeB-mGr3<Kkv+
zv0liT9h&rmgRqZ{^M_l=w{fKk?Lxr$J6H9x#zsk31LqIsUa`s}U})dk##uMENF%XR
z8PDnaJ`r*_0nofvd}M!VfSmko#l;M<heY^^A&aaT@FOY$Yp5H`ij2dy2xD4y5SZ@x
zrlNyyC$Vp|F5zSsOYOrNmdPCPT2RH)HM`}{qoESaPd{DM^0UKCDgJkIH!{28T|fbZ
zh<U5M@=hP0T({Q6RPw3W=0yXNBRh=rzqh_<K7>8tfsfWiPlz&ef6SO(@R&&1{0V?q
z5jZuP4P6ijZu-3|e9c~N@ZN%D>;F(NO>CeRGJ#M>w`5gqPE;6XuStVr>whwm2tui8
z^#ybCt`-AndrGr~!6!s_>N=%oaA2WlS#8IcinAu|@HfBIQd7KuG2aoz(?#3(CZG2)
zdKE-Yz!uEG|Da;sz9C41ROAv?H^F09z5CZC^}&FF_Z|+pmx1f3OY@wxI8GWJG99g_
zZ^)3#1ee*??JDo^EQ2sAn^V)*l^HY~s<OEVCI6FOtuFGxv1}%<47E9I5j5<Xk^rsQ
zTzxB0uy1wT4moZW7YrByV_LyhQ63AKd!z*!l0(zRmr^wQV8V<?Hc#oQp(zP9pRiK)
zFCW^rEh}&@d|pTJhFc|o$G_e@$smq=9KcZo;FzN-+?~~+lP|1eW+*5;ImD-AW5tpY
z7SS^!0d;xgz}JKI?tKkJWyl9=k)9cg(jk(!zSNr<Ar`>B>IdGl{AFagI{L49sn&mB
z(BbSr%p7meXr5_=lz3``7;}*X=#TB9f<)W=akd!2PK>=)(qGM<nMdKfgdp#XBaUkL
zIDaC&eQz0v)SdZRMtSaE8J1S+fqk1aKs*!Ttml21K)JEXw-@Pw)t9ZgDhMPFmmNo*
zrqEI;;BlY<RPmieBJPA$BKmiJH;Mn?y<r@Vno6PRFBi0*CH#B{^8Tt$(OSB8S^ZKo
z-G1N%;+cp}`?(CqHt2832TZl!wL*q$u1VJOegz&mXMfYpDL#sn8?Rl9jN=)>g6-N|
zN<$7i#M<P|9qf*3bYChz#F9VLw=!q<$5lJ(I8XJE>yv}ny=sm~ao$emuGgm89_58(
z&9H5N5A}dJT~Je!+n2wP!SHvA>Bf>31BjbX&Q99*)pD*)Ypp$wyMp`?fu%)|zy69)
zEzFBfLvIo=%U3o7MQ25X$|!dmnHB1>Ml6Ul#@ihd=kAbk@EiPuljnSttQj&3-u#e+
zXGh}I$iE&3j3j0My-drcJj8KbvK3v-BLZHN@wDyiZ*_kHZ)n)b(4CG}QzMcO7Eb`p
zi!M2Q2uB&kH_h;$=S)P1p|fnoSh@wkKxrRIdy~cBnVz3_?)}`gFql}n8#F_eXmg1U
zIKL_t+!cZ8>Wa(42vVl>`bJzx4{UAozLCX#WExKNnUc#GTb&Dy{2%?``8f5<W}REX
z(Z`nK05B0e|1~4X0=xG4H+KRtm(#&p?gg(6J@tygV(x=DP#~(Ud16$e`41qJw*xrd
z@kE5jc(d9acI(-$)@#_I=6_XG%PWI!C;|Z}r_54OR?C%cVe7u2sf)WDz5@8)!+dZT
zL(YA395H_ox(=aci+h34g#A+zAxh3ANKPT=awFt$1R{Po!N*{=En8V825F!k0M=)w
z&4H1f=#qgEyl#H*(a_V9jxNfdL2k=ddtM%BV>_S|hkIfx5EekVfT=w?c0@9_|FjYJ
z!zur$*)37bfu^T1o}$c(c50##vK4PUD^Ch4VnZzJSDYm`D^k^?U?ud`TsL?`A^TtP
zRCRnTIT?FP@@z(9M^Ch?cM+-4<?mOk$2t;>_?8GBCDi0OI4!k3DP2>O#@9@@dh79g
ze-%kFpQlN}6rV=e4#ml}|I);~D0B3$70T9vdU_g6K+rzSR@3$IOnv0+w?&_;qcex~
z_=Ea3TQ7XG&pG5pvvo_^s#3Y7m@{so2IJ1e+#m%*PUrtLiCEuit)`n+V~;1M9>W?I
zJlyWtqJ9Y;2$ss4ZLA2!_P|&v8ldG&xjx{QDZ2>SK$8sd4(Tx|Ra~{pO{(8hj0@-!
zDMq6OPKsW2>hvy{OJ_}wqf$E&M|7loG@APC>m(v2aOH}1vWo}mIsI&IN!zL;wrx}j
z+JUF^J*SAZfJ?<YPJ$-nm!+Y99(UZP>RB#)@slr`7@1NT*z9of&S+p(8V9VI;x!xs
zxOt!+Ajl!&;CALstmN5BNzk|Vv;C&*DEoz+n)1sat)1nNg<nBE8r=<V=Z9Ij2ySj?
zsJmxNUF}w0?!60|jQgG`=*=r_wR3^%b)DaOMJ7@XF#EqQj)Y+s!iWn2zv_~Ib_UOM
z3aE3%=g@L{A2^l4;xc+*dXE@#!#TJ&9Ip1nme-X5h1;2IpTOkU&@eST{aumEZ)x0p
zkH|CJE%q&am|F#2eT3bw6&(SQxe}4BxR65p0$O_>64_0TBz~GFq>pOxEAFqTUpXxI
z%!+}HUOwOu;06myCwLF{L#@X0L+>&dI7wg&+iLzaP7CX9ZD+H@hi6&fRkp5mh$2@_
z5iHYA|7SK<U`tFzLGP~ZrU-CL#hPjx7rcSg!}NU3R9fyVJ7_2auAe3Tg*b#FhD^1X
zVj~$B4X}<@<}2?vFV!r+K7qs`5)F2)5?E#~2*w+p>Qoy~WoH8XD+<27zpxz39<UF7
z?e5V2KSmp{wfr}cT)V}Jh#mhWdwQhPzg>e{3|Y2wcW+IRXAj9>Lk&cV3~G#Qd_Z?q
zd69?oQ6V5sZ?%Ac@r-QtkA;FK6cybmX(5&fhU#V`c^)G=p)my^r9)T={bQWIL0%s{
z(Sci<%^p1No8@MZ`rLq(Q(hrAbe+!2K%kM2F)<gEL&tUv-+}D^J0DKY(IDr*i&Q7F
zrV#_wmxe)m8xCdLu`4&?=FmwE?9~W5(nI1;%NV}qp>)oJnL0OdV2n1Y46`U2)$>8y
zvC9Ra#eS_Ag-1P^dS;AS&~$jOL?E(0vYMO^O~|}H$X@nA^`@Fw7ZU7dvA>IFOG_+Y
z4$R1Hl|4MsnTWO6WqU1RGu`-AL)|MXetD5I7mPDLSQ<6U0Sei-nRKX6bOdhJ+g_3>
z1&s_II)Z#+=AUn`<`S>zI=l(3ldWm=s2q3<%`8_jDV$@#PYdE9=ECNKkw)Wl%lw{J
zmvC-9=KE2S*@(4Nt<5W=kq0(v@f6*lWyQ@M>)o@n?VbN)a*>-~tSe@y3}xc;`u6*z
zpY@*thS{pG+7Z!ztt)tctj=S_`=<u!$(F!ijYRj0#netp$4W%2=Fv~fOIdFAS-bfn
z*arY_Qb5m4zx<-zySOwD>ttTln>W5yEJHG68rV!hjRvcVzf|0xjMneIGRp3-G5o}j
zXUYNv{o<8ub|{u{`FdIl7u$q32Ea7?n1Fz<b54L2jJ8(o(cobYil=veP{Y<@^ZBdF
z&qP`5Edvj~!a}V1{Cn4_F_)D%%%Y^;{KtKC2B5Asr;@le_s%^sL2bCdQgFXwP2XIf
z*r<pi4Am%>SSwAw#+yUdaEgB+JUx(yPKT(OfD}7{7yS=OHI&`R^#cPuDlzxCF^^UV
ziY4w_NH!~yN^eG=rq1iu3{ICQGut$}DazTaSy%^GOdVdxlGUPu{gkQln%*r0rC;Vp
z38H64cktyGO=GN4u1C2SoX78Mp*rrP{*bK#LVLP|fy9e4ube9Rn^P=0XGHIcU5)(<
z>?i-)vi*-wXTj8m(m3SG+2q%^Z#B{v{G)q!))F-*fNzCDyk_SLzKXekg1Ze5)cxG;
z{L7Kw0$vVWv{t>gSsI!G)P3{bG|@HjQMP2zjt68=;2jXjKZW^H<aSC;Fp3+YZ~pts
zw{LB4cmLMU5wHtw`_UT;IQ?OZsp2UrMo9m1##oiay)^{9!CiTSL-OSQ{hrXJnC7{2
zJ>iX$Hm%_o*Hd>8!O9lEAM~(*GA(&~JpyuXFz27_bC*@$nEmjaU8L%EzJt8r?{c*C
zPv=z`L3M?`y!{jODHX$&s&{|<Z4Met)_qAoB~wEwmy8|o^cLfs%bEJb2P{8hjK1f>
zD*ue*14@A>J|dzI+x`TeH-w|_z;Sk+&H=mMDZ_d}n_p7T0Y+uVSM@K5`b@kE<mY1W
zU%Q|`Gj7DVCS~}c$t8S#aEvdnt`p`?D`>9M^Ef~gTbfMj)we%UciQlBHxA2(ABT8Y
zg!um~NJp&V74Mpytl=^FlUww21EH{nUE!c;PSd$4TO9M|M3oT%Xr7b^<rD!W1oQj(
z6w@4%!f1b%A0@#TG1G9Uk2R1>)6NMqq7aFG%t3ZMO$5qZp*p++7)6T`wLx8s7z9f$
zbEc26+cl=D`c6oZ{K4~cNub1)4{vxaZxuZ?1BZ2jc<pLc-xOkLMFhAAO2Tj`a%QZ0
zP*ME}qjdo8M41%G=!n8zL2bNG-|L6CU;m%C#6#<g%V1Z%HMb>%-rkYDU0&<?_6#Bi
z;Ya>!lKfUADk_hFQJr+x<%oanejFaRRf;6SzpUHm!M`94Yyl(xs4rE6BS$6fM$vhC
zP2XTg*GY6?KpEx9^-y=RDna6%{c<>;X>iRW6<y}U0>8IcRZK1JG*;3ChG7m*-I-?Y
ze9~+B8HIUm>pzsC==3I9^=n7Y!Tj+NQZ};C92F(dC(5-yT22xg<h~eCm}7-z3+1Ir
z`K9q&3m&t(Ke9x=z0O{%_$!uD7jD4*Hz+kPQ)4Qx5a2uWW!O{<s%IG=WwDT?cvp}5
z><K=kLx`Q=q(v93d8vb(Ya41iKQW?*687v7P?%2FVdEHNc<>F?JKQg@KBD7+7N&1X
z@2gh1pkO9=&Mv=fGHD$%r#Y?*U75<oK}#Q3bz{+){>YZ?@b3{7aJAuyDg&~;;McCj
z!i|z(dW^h7nA*arUz&e<pzjJ(e=xYtf0<$jY{=yp=wGN9`xW=MT2=N@?8`y)0P1}U
z(w6xGKP8X`kq=bRHx{|A3|bNEO?u$k3-5FVuk_YT_VKMRG!k9iN=%mT@ygA|BMpNl
zl7CK%;@zW5D`#eiFpyLfz>)Bm=|_8hoFejkl=MP1-ydrXBZk|^48ToKl@sf2ZE<+9
zc5%BDsdDTYioz-vQ06mQ)Laa>^-?KoCXR{K22X4d?fjrMk%L74|3C}jo^sFPAtpI^
zV#`W<h*BoFUfzU9j%x<?{*<2!eBm&s5D{f6dYtxQovRxg@r8Vzqg-57Ju~PuR%-!D
zmx&Re4rv(MwmY2ctvUctZSlkWvVgylk4Z|RQC#=K91`F~47gLzh<j_!;=o?d_K=wE
zC7@cPiZ5?wU4_vf4;p-|B_P;;OR+C%{#TZr)=5s}`?01^F(2KP+jB-S$`e5ItpK1Q
zMR&4~?w^L(ABXqOkt0z|;n2R|#qiRD-wZpD*qjgoF-p<Z=Dh%;Jf7sEuzzJ+;`Vff
z)RL-0=#g_14Ns!nXrR8xTrK0f7hs{oV@1Cf_?SSu+7DMzs^L907B}Qn23a>a*k%8n
z-Qi72J-AAotUoI1B`u#{4?>2Ew+qwVJ^ClE+#fl6a68v}rnF_Inc-PuDr~CMFUmDa
zN!4#n1x3DEvl|SVyc=zR{^{a4EC}@d?!CP_!+m|ok)0o!*8&Y?!`DEQ3+CiT6tnGt
zHS`}Tv1&;o9<wgIKax7Jo9nlFUypwOfQQ4oY9hlu{xtzvj|w3k0T6ES{k4=EH8q{)
zAXe4|_PdKVYYum9_PE{P$-$<#Vd~kK?s^e|5o=a3!RTx{`2!Rq^7=3FXeV@gSnoQi
z67Y3rG+XiCzR1F@{K@oV=}t(AN=Y0017EKX?BPS0SJxN<X)gN-j9183+`BrfD2}=K
z%ZaB*800q;1uH#N90mltoNgMcEXsA?csojnB#~p($$TQqs$S8)6^cu$WT2)0FGhgK
zvbq6?^@`qNI)rIPs>jDfd!sa^k4gpHPVTFKr!kL4_`H+~beFktYW*IRY`{=L+-(z+
zb?rcg%erbLDeZ$L@3hHaIL&=aDoM<VedbW%Y7&-WSs3-5EU(FsIaF>YmJ#><XToli
z7rCVep&DB{zK8%!p+W@|ktP}=(>D0oSNe+;oH-4GE66*re=n9mh_WBAoceRULyew%
zv^B`&Lk2IYUJ@^D<}|B40N3Qi1up**_+A*E`B_r@LK5vkHdI+CMqm)L7+H&c*~^tc
zV+&Swwwb9HHeRg<9zo60@XQ1obR;q8Z)8u@e+$BsYn2~~9!B}H2lR`<uiU@JAHWq&
zVQ}fWI*C25HUR2p4cATd8*7VjQx5MqMbb}k6mK1*Sc@OVW=9%q+z5YvxHvi=sGVK&
zy|T8bxNKRHHJNSG^Fft;4}$#Q@t=nYAN2ws_16&3G^>hC%Xy2=+hyXU-tbC5Y;5Uq
zIlUmcV#-O?u;Wg!iPlRaME^%#X3UIWWdw?CAs7I^CZAX|=<{?i<ASP21K)%yH_t85
zZPa62eQ8q}08BbD)wj#k{BY^H(b2p)`OSa9tfw+mF+zEIN2k-~zwdnK9R!hsA~$d*
zAG#gHn;$zHuj0Q}$JD*p{E``TC&+h+ev=fR%CI&a{7RtM4fwhrzL!3DCk;d&*m*cB
ztoy+_9j9oL`7w)w0lDAAot8DaO%NS6SO-kS8C!cj&a#YR>ikZKZ!(g9DcTqA5xiy&
zJG#?MyDT1~0u_wX$~BcRo#4FPV=Gzu6Iwc}YEjq0!6T%YkPqtwVix`8@=(&z6Q*}b
zbbobkDg=O-wH#FRQGx(-&FgI!%1(^sc-XRuZ){?f_%pick(91Ix+zL=p+Rvu%yeJH
zAxTNkh<x$FLU{dS{L4$PqUC~>Ln_k;2TM$u37g-&AuX{!4q(qL(3jpCa&oGi*2GmE
zLj^ri@176#mqPxmY=6Y*>Dt|B-IYEZ3x}>c$7ln*KUWZXg-`bluLUkgT}1r766Eee
zAU`o2=3DA`x&LEo?``mw{>$$nZX-A>*UoqekLiRFk9HxRZLBu-zZ*jHqhRdIw7e$v
zi>)4)+`7ivYG_WO(#b6t5H>me_3YOUJMRqdL#PR*-9DQ66ciJJ-spHl)IM0&t5FE2
zCQbF3kDVp+ehUdCO556-FenMZ(TclC8jf9sr-2N0w_6@sSE3w<0RRN#l*M#Ky7ysg
zxG~qkFi8*K8QXk?&!G;p`BO4ZB5gz`Q)&NSU~O_`t^S&H>fpJJlTAq1r(+^m>STg(
z$)-XMNNQZi;p&_}T~!08yi^Yv0YjLHEzP5TOc7DwQM*uGxytdkSOF$}aOc(LW+_!1
zO1|C52ry*oAgaSo2gMthDJeXg%Z!8oBc(Uq#Bly;A{IP@pyXLqZsHGB2MZ?C2uy`%
z#FjS~$eIM^rNIt^^?*&zOu?%Ex#+^gXi|Uo;vm0Qf9GT9cYTRY;jUR(uHQRtkwRnP
z<eRAG%K<%ookh7vQlesgcXIeT8FHrpCqBoQsT2IagpT*80boXt#K!DYx;?dGUwG!p
zclMoD*6v+IUPE4=AdwP+(;Tl(p1*qfo85z}IknodX=}BpMPPKgoq)rsCkVr6q2jly
z0l$6-i$0pPwFv1754~rL{w?72Q<z6m&+exO^UUvWXL04fN{OFG<L-d~kGh1+X}W}S
z=0Ct@5(U2|=ud_6o$6={dUL_Mf&cc~+#jCP+)|I=M}zMcoV%v8rgGx!98P_6=ITJa
zn({@C-j2*^3<bP+n}B-~e3`lWHU_ALivYtvsYsLKHdrP<=mj}^zc~KEW5<^w(&+1L
zdF6$*-wePWcmD`y4|U#i8@}ri{7<LDJA_6o!d#8}=pAC`aYM#EnoEnT!|t_M4<*Zz
z;g4v3uA#$PdDth}o#IXxTF!+dDK~ij=8ewD#MDD8`GCfa@6>&A#_K^Taz^)Sgoq^O
znNs&8W%S->4-xw}`JRpp`;%n(8D`WV1FZTU6J^2>N1DS_Ur#Xv9s!P{A17UQCg<JP
z#N&gVQ;%Fjx}~VnNSTSsLP4p>tZuNuNXQ=DkK~!3*{#;FCUdYWPPK$7is}&!&`{`@
z;67UDyh9#P4c=h5DB>}f_E(&OLEqo<W7TTkBDRJDq+O=fIlLIFBN^Sg$1J7fFs;2Q
z!L}HCWa9C^gK99tpdJU0%mDMXe0}fNo;R`PO!KNbvffVHh?M#Y-XT?EkzF9!+&Uok
zBC{frkL-?7pq5d@pu=W3pT%QxnCE{+N6obo2M)gj-&5zfLLfn4jOWB^SUTWvCO)0o
zAFy@<{{CR2Pu0qW9~r(?TS~2>yvYJ8v)Y05P}|{~`Y@{TrHMY=@;UGG)>Z4_|IDav
zSyNAM7@J^L+10iO)soP((_@NKo-e(%0m1*AU>6-Tu5-I~W0~zKXh%#`=;D9EAuX(O
z{gR82$yABuKd?QBa;QYK_EObN*FoJ^hlO#98~v{i$BxVY7J@z6ZHY0La*Z$~nZyDw
zcwanr37P0xYF-vbCg6YA&%~F?0y9)!jvDil=XK3C!%UdjyJ80Rsj&1ZN15}K;f&Xa
zigO$u`Sc&~d<d6Djx5_uq$TZn$-2Mi;|X|^oMkgi+5Ga%`leWM`~Tz%90~$sOM}MR
z^!rjh4(*kt*tcy*0UC9ml`pJr>vlCc%_-Eb)p{tWsZ#DlE3MpHF$y+nhFUjfYq?3u
z#btSncALAXVmJ}0Iqhlf<uuJ+L(M$~T}i54c>Ng)?p;zX=4as&4}sdrpH0hcde9Qb
zIosSq@dccr{2JmHCE-22>&e9R4)->-8e`razc<C`UXqFS^e(L~tnU(W(sNDuUuCDS
z?z>`sBl|<!mI?ceJg=`UwY~Ly9s-Z#^Hf)|ezkE0SC@@qDEtLv!#QZzllkl)t0fpp
zN$gwBcJ7B+&{nxX^mL(7khc`>%IP|8yaa0fB8rcfEI5IANwezvril{StUR-|tVp!B
z^0t;m@~<zh8!?B3{LCYNQg&3a1S3VmjXXrw>TRgq?Qk4~BOTJ72?+YV+qUBhF$@1Q
z%l9??j#S7vAq^=pBtMOcutINe@}T{PiFEs{-u=?h4iP2J?eS$(l!Ldp^8y}uwA_NP
ze$N<(IF#47sUbt4g-PmiD7zX@lYAKRgyuZMPb$W*O;#*_duFS3OW7mn5!rA2+}e6s
z^?NTpBY&im_&XwB-MF|KUE6a~%+;pAK*HGJoyzp{P`mEE@lhWyP#Peu{R}BZF*nY?
z5`^3F-VNXD-%MkiQbJ!k?nxU8soDAEAH%=THYwb?klwiC=negW^IwbbZ*eAle=+B0
zSWusNQk}!sijhaoFz2i?Bkzo$U)KL1)yHV!Ml8ifg!dXZV^vO1uWKIf{h77B1IFgZ
zIq=19eWex7%xN6e74H0eb3~z)&d1(tcy9zxvl9-kEnr4}6R}&l;gs9RUAEfaTfjwx
zkrRmzK&bPI-{)XT&&X#B9OHpmV=53=oS|Ekrg`M_vKWTgGCcExLaCionA;l<{x0E6
z5QU_h<Q!`sFd;~3Y>)faJX_g1#%%u{CR>~>tr?ZhUCDkou;s>3NEviSmlx5q4}L?M
zgO)E3_)Mle37?P8@)a4_GFts`%6Tgc(*=>JcQ#BA2folbj|Ah0xAsmX=|1wSG37lD
z&ip>XH($|BHn6^1%>{Y5U|aVEY@*ehVI-?;%q}|GDJ+TVkY#j@=xH466^d-&@_Dbz
z)+MvLmA06XFtG@{A4eIX<et2eN=~fnFdon4w#QB>XLmeA-2~8xxtg|i2o5=`0!_gC
zRM&6upP4evM#CT0Qrv1};6DG1r*(V(&9y^r*xHnRR(wWwj{V(q(4^`7w?PFY@-UuO
z8b=ls9S1Jlq4Wi!H47>klR)aY$kZqpT1B|5Q;jTr!P~h;e0m)1L7(8c&mjTcjV`1G
z9NeW;+hwCenR+jz8VsfTqQt2WFypVhBZ)6a$`|?!d|Jk&`a4%6V22&(gByE`>!NLB
zKy#jCaC<PcpcZTAK9hhXy^MRoTU8BFS=lk$?5<Q#p>;&GpPG*rvShyw!q6WfN}tBu
z^sR!NCGx3{U-q|?7uvl@>IQUZlZ;~3PsW6VjOF#SPg%F0r@j-9kv?DQ8e{EEWZO5<
zpQ2~tBLCu%DT*#TCp}rWNaHd#Y<^U|WCPh7$}|x_Px)}NK2$}bmQ$G>SmQN@hZsjX
zs~?4RI`s;f5VDpVQ>x$;at^Tm#|HhI4ZbRFvPl}h7bAS+!He&RSS4u9lbR$N$3f)R
z=AlNH8mXntTjGa3Z}y^9d|9|T^7Q~!jr=(8>F!(u#?py%t-&4JsoVEMm7MJhZB`s$
zXZwbX*OG}Vkqb%h-l&ABwS%gYYL@*tuRTMhfmeFbx96?iORJBU`KX~!?4d+KQJ!`5
zqAD*A#P&+8c(SKn00{zy`s9?U_oo(gT;h<E(`X`^Ue%t-d0#2*X;()B)5Ui#*1lAP
zwrgz6Kt4n?7Ic|O2xHnkp+YAbuwrybl=N214B)w{`EfdgmhAib;NIb@5WCVu7n*sz
zt6L$7RjBBMq4uf198smqcni%<smk})l55Oc0qsldWcBgDVXLLyUzQ=LyVzUCquo<s
zHVz>UA24qI?uFLDs@pf`Xu0*_!BkB((TORja9R-4c6u=#$T<}}V=`<iE{#<)_Two}
zKlqsG(tKI)xFCsj-tR<>J2txR`9xhQ$8<5Qh=uozt5$Ef$qssc=%{z}O;16kfGH}|
zY0kaIN79$#)Rcd!Mbg8vm#vVQhwMK<^=>d>%L9flJ#}zLkj1W7GvM>$;0}~`-}r{s
zzddZfrI-<SOV5lNAxrJSI0W|z&(8nIhb@($Cew~YDsE=6g)El;Y-V)TR%Ew~N=dgh
zm-H$q7nD3^O>if#v>o2XEHeTJh!>P%^Sc&29L^mr-#4t%&ki!9-aqD)AI#H~-iht#
zSp+T=xhZPx`>MU)RU7?IBz8=Ev`2bsgK}kHoIhYO)_Y0?C97k~s+N#de$CsxXP2=J
zA|~9o)hidqr55Bu1S==?)p5{K3EcAtTvXMGq7&!vWTEHOtw2uvZx?t|pws<H*Eo!t
zd``yIeswRM%F+P>CzJQ7z34`0mb{qd&Pz$ONqE@XPb=YXLPv(*j(zh(55M>!^5bp3
z{(G@gMy~}k4IQP>Q4B-by~e!cO7;-p$BjDv8^30pvM(PQzB2@vShcfv|Ac%9XqkNN
zsq-`Z$uC!JEd)!yU4O}0z4InaHuM?pY)znqv%REkyh;ljnyU?YaIQ<@N?j}@oO!A4
zrGmu?2@gD5kN<CsuVDuiNU?nRd$#+tGcOKD!XvH+1qD&Ho6o%$+gyu7)>OQhAmCIH
zDBVIs!*k_qO=mEdze-9w>an&(z>H!$pN`>z<=(&<h+n6!!l)|$%@)(E$e_(zL6pnS
zeyt`g-0XfOc%N|R#po*y1BQ6z8)8Qsr|78uqM!GzPssKop5AeCZ(BCI_MG;&YK6<R
z$sWh|MM}Tcgb8b=UrnSamn6Qj3aVfk;W<@dXK=e0g9}r!#54F|RpfnJb|iybu0?GZ
zxMs1tX#dzLI^CRtH>n5>q%aQI%0WQTV&Z23u3DiCjOKkAM2WM&yi5TuGtlZTkfYTW
z{*Z*3a;j6sN}&|D>&f70jFVhf``=L)g0IQ&-zIh$;XUJPaw<I+J7gfBpQuw2#rH1}
z9DXHCSrpKSefYt)XNE76QqJIOOC~?Uc^?nk&+y+nyci{jPth1;tRT5G%>!Et$gLQ`
zrcB@prjLCcFM%-t^6pu~k(m~GUkXcvm)QdI-)u8yEjyw7VD!vOq{%ozdZt2kAjX#8
zLRC$udLtrT<UXjzQ4qU+r5QRO86^_*%Y8F`buU=ewbWw~?*(nN{l>5@s6*8A@d20S
z90|IGlKr5s@0gYwZAMzw6_8|6gb;g`uN_TztKYCZz)8$q40FkaoD=Y{kxST&zR#kB
zA8XdIUzz4+V~FE9(@nh*ltk<A^WR;Va!%dt&zm`M5#Y26^=Hc<x;c&;onW+JDKgYz
z6b1N|@)quRyYm^FC^I+Jktj!LzdIAUJHulrBgZl8I^IXRdfdg&!icK|K|*ZIY-ljt
zp=_2JmyJQfQ&Sh8W0V4V5<fRD+c(Ha8jH3q`?^)E&ONskqh-{?y!>WS5bi3<kysrt
zPjN!Y_B&xNo!+y5)$qZd>n;m4HNh+hc4l;Gw50viOIvU?ozVIeH?<rAxAPW6_azk`
z@}kCi*MT}-(E_qL-V~>16yD@Nv9Hio2dgX1iS%V1y~E7WnueYqeNYLl!1wR+0g@OT
zyT*5;bwq8bCI-DL+*t4KhBA7M#|0|3J&!aZE*p?}gh=?MX#<Bmy3C%aB_`2OW3(;s
zy^X~0!#D!Qe5xH~Wqwk(Qm1+U3LclU7*|6S&vH`fJ+@;lD%5W5+{im6eOGYM1e*MF
zF0d)V%?)>O2C1#3^2$=?gT4dN{GIFKy`!4oo|B1(zHixYKi7}J!syp8n3sLn?x_g#
zqg@*ZhB7ak&O&xBD&iq&qij43HrXMT0L`6dXmN0RJySO-X7MkQvikESoLwWzA|I3C
z)0L-zBRavmrZ(mFW=))WN?CLTF9MKMYC`e%U(^<!j-pat2+Lr@qhjJRYS|G1vtmY|
z4F#WA@#*2mClCJ5^jf-R)h1SLH%DXPdI1Ku|JT}TA;npF3!_kIwAAs`I}3%$AY8IW
z8-#p&E3t1CaupfN_|&C~cbdHRq7$(;)kj~pT$e#cAY5$5Z2^28o=%eyhZKSJonbw|
zwNlSM)8#*8`;k4gP*2IC-u;R>;?ZK6g-H~6{FeEu#{#YzuV}aROm(;7Kw#g2d_73U
zBPzJMP{8YZTY{~Vp#|TLG^5QFG}%hI*j(LB$o70;7D9>LaC#z)!1k%myt174kNjOP
zaJ6~m7svN)dyJCN+361|4)t|C9<+hx?=iE?$00e&!2b+9;OH!>y#m5o%9n|cp}B4q
zo^JN?kO{Z%mM8Zuv9!>#K*{<OFDVnhsU<_irWR)Qv&RtBPVO(jKwvXe-;#W}Il-mu
z0{)?GDtFr}HWXgbF{dHVxL>pLHqSgvWf@%(U7hQ{eqV}5{}jsUxYF4xus061`NMnr
zmV6|Fd&4zu;OC|3jT{Kn;UcWv9~o&IC7g&l9-PZsGEYnvxKi-S%L{x;^T)4>I@*eZ
z-r8?IrO7|M`@8m=Kaqbe=-s_qcW<WSi5GbGh=TWEP0X#_V@LMgoqdwAXusvW*B>gd
zb@5tC*R}Z_orcp9+0TifpB{FT4`oMWG%Hla{t!8OpsNvI#;Fy%dd#|>h+h2jfCmu!
zn!cWu&<$F8seTT`{A6pKXS(v7DFt~R*A>hj(z9WAq&3|lcfhW^d?USmBR6ehUQ#3C
zM;m)#7h|-sqx$y}7Jgq>qb(_|-1r)Gv&J}4=UeWm*iyZ>)ZgqIjqD$+C#Q0UM86hy
z%QXKGJ$^x#^w}xA2NY0@%1*1;PD*VVj<mAd-uge9&ND3O{r%&WN39%GrkIO5reqFM
zb0buyo?KL(lUrPcIdZ0`h^d*GgUZS+nWe|$p1E<N<Uq9C1GnS?R0Ku+`+M+z{C)7f
zuFv%u_jup0cfvi`03Yi${?d?~=EdijIm2wfyfcs)R`1Mc&*<7oBiLtS)yGLKg;Mv7
zmtHYJ;qh0PQF`9x-Cd&{HpyG(I5sK<R%`EuQrDVOo0j>f*$$f54k@z&{!&MIdT5U1
zexV*B4@6&k1;7dcrn)(-4|6Y-+!biN37X4V!@f-Z#wCfZ7frI#X(J1d0z2g3vF+S;
zL`TtRxdpJ4ov*%nF2tmFOD-f<ili6*xu)UoCuVA&y&=l^q)uN-+FZM%>h+S|a`!h5
z-fuEDT~CD58T`yL0w;bAy(AeJ`0{%Udf(Y=Z_&WFeaN;?z}B^Y_NUSJ?Z5Eb*#wHJ
zWGW98jN_&{3<OVm_sb_YcHs^h?8q2%h3rXBFbLZJm|Z`)-a8d4BN*!cL8E-K3$!p!
zf02V^oeSXNHscH{dOQP3M+19^k2E`Sl>F3>W9SltI4ERC^6W!kx|-TxE^&C#`L)eb
zoj3Rfbo6&|5eQQU4oqQQ2LVSgt5*)=G_wa<!4qkSP6GEfpQq~Tkxffv!EjgC!Yx?O
zA(PiGSvtb^_i|S-2})brr2PHG95j4sQFreaQs$Wucw=#kbz*jO9<~eZs^3f?+5Xz=
z2)SnK5;ffm-k^vGxc}Gb8&DJeGCYox>0PWt{}Iu9kC_-!=yLcx=xjenAgrf=r8sV3
z_e?H#G`JjWSCLV7+v4R&eCYZxmYF4f6BnJMPF_;>?q@7MSQc?f@ret8y~d)(*&{|;
zDpkdR1woY4@FTbO(t{gZ^r9l80P7yNaXvy#e&$0;(Sxe;c)}kpStn+`-3jLQN}>8w
z0{S|AyLnm8fzJ|+@-bN!J3~25r@7mUN(m4J(m;6V`Fa0W?3}P5XXA1=yleBE9sAFe
z(SIuRVKj$?$!DH-*+usT!n$f=s~#n<j-4}K_dk1BHH5>3vO)Or()WM_!}tV`tyfY$
zQ>O4Y;x{%2i?J~>7XzsS{h)4n#|4d5RQ(s@us_hh=D<ip9%1%Rx2oWF&`h)?CcS-N
zw|9mLeK@Di-M%8Tc(eYCB%0(d>>52J7M<N$qKbaMe4Tw453t^?NK91&MLFZ>g8~Pm
z5Sy^snMqp087VzmfVC;ZMth}8BB%txmYL8A`;M$KG8BMj#T%5L;cHr69D7Qg26(-l
z(>`U@;$I_`RQb2ZrcM`sZf|*Fh~n=RU$NVe8*&fgp_1~L@we%{UN^3uoi`C9o)(PZ
z@qZ?1=zsc;dloMSVqtRWtFtWtXbZ~ad5F<SUR<SsiGX!{XsdkW8MiZrZTBT1Z$*!#
zra2AWN-KX{vyM|p_W)j+eJ`k-5MFj$J{|;#Gs})j!6xK`G@9Bb_+`8;E@VK_AK7w$
zVsc`TyMd^|nrnEHuvEAS%UwKv*CXyb%Gb9dWB<atyHSXFda<?p*hTBpL&c;v;zSfc
ze|`JR$cJPZC6feM#R<=3r>4m(JgHnLXS0wL-GzD8-<g7f&S!BKp3@LU&8SSx8idvR
z>h^1z`C*~o{i@mT(ABN+$eYmI+0LYU35TQUDk~-#=BZb`{BA+cPSdPgjn#@?t;hN$
z7O%TY!{~wD4=?bKlWqku8KAvC8-nV;f*FYs^`~47u5FNdHiZA8y_jB!<YF$Au;oGZ
zbnQRRML?Ri2W=+@1R~1HV`fIFNk7nmQfVIo)1G-0W<kX^yb|G96NJ2Fvu)8kt5$Wp
z3^(PUTfFhmaLi}Fy^d5C+a_xQ(EQ~5OF+;$_==r<Xu%cDm5)iA*DXs9w4uqy$^?d<
z!08auomfCmfV;I)#baKiFGwLkDV(WVF^^w6d-PtB-a=SOwOF`tLkvtD_&$2xO3Z*r
z%?ej~oe&L5YO>gz|AlUxyLW)@F<@%iqt%1|WkdrTEAU~uF2NzuO$n;}bEG>LGqD2C
zk1YC)ziGycxj0cSYPrYVtI>?`;Nee6{9=A0t2^!NL>giARsRY<qB-*kXqVn|z`mZJ
zC(ta!Ck<I5aQcqNv}F#MaF`j8#+w=DtFr6pd*HqgXE9HPFp9JHv^M@FblA<4x=Y-g
z0RiBn4*?6#8JAhXFL3g;UQb=+3A)`kUmbFUCMcC5KUy<588ZVPVTTrAFE`n%5Q+or
zbc%J=yJ6z9v(oLdU6hl^#Z@o&CTHaq5Z#e9Ggrsj_t0JRSwm>Ke9T(>N7976*TFwI
zmnOJTs_Y&a@NT5@I0?i?!5q8SFGn4{jgLsq5+WtQnn!#2PY0U8eJMf{OoKx~a43!c
z*{TA2vL_CcBHj5i-J3GU!yz|<yOj1=-jzqi^|<_d4VaQdLGCB`b&`J^=z!SsU^t&U
zaOFeajj$CID8_=8xzS1w#tMI$5icZ1n!AogPw(=UTJjxi)nTjb_RE@tbZogV6PBb^
z`%9SodY&^q`hJ@sv`d1`9KB|e^MQPl{uVe;%1t}<ZALY3e)jHcmPXd4WK3W?lB1>f
z+c?@@_(kFn1jYPkPwP>CbKd8Iulymg&nol7!pA$^w}iv5ir93<K|AG{;s-Bs)f;D?
z#oiSbU;NvZp<)!@>D$>Au4dLe%XpyEFmO_@vQ7iHlUJucfyf$E#fF{vC{xvUAaTez
zBNnlC8}9o?ah>~ud$y5gEX=sWE3A51e&vB9uOfbsALjX8`0wp^UDjJXS#7R~-!w<q
z#ipKz{x#3Fo9U+s5}R)(e^Y;E;;cfi0301QTCdaRdypY5K+sl3hHz@f!yp&_-QOF)
zsA%}0B5eLwqx>hS7wz|iZ?1@v-8w|3s3LG?(g8r{&B<Nj+uSIb2xs7daMysSRbS~6
zD4aML8wRbdDi5!_2zQC{?mP`k?D}p?N#cV?lEwM+VRy@xhr#`M!c&s*pQ2D|x%qcp
z^%Fp?;ytm_Rh4>K^z%X6E{O^3_i*Y}Ag5(M)@-l3kRz3r3;`KSl(G?EddvCJ=q4?n
zF(DlKRF4evRdq~A7G~W>>ROu(rYUZLl&F19oj9OsKm3?`l0f_9wS5`!+OK(*=T60&
zGoEg%?yF}y(IXl$D%ahd2rTs6h_hltYR2eK3Et8r75||OY-m2BKE-b3z0xqe)CY8-
z5?PTmFC(~@U8=lo1oAos)T2)5NQ?*G3HCpqZR=yC7dl+M<W!-toJ<ZK)4d?wJnxT3
zq~NGmj8$(Rangf!_ozt-HGGYMzh?lnjYMW7KEb}Wg59yOT4yGvJUX~=vT2KqZsn=P
z+*YYsI)MYIF2sCIIqi6t0j`(@3Sv5AH4m3>P1*j?jf0Wy)Vx7ycbmv-b6UUM;dlD!
zB?o58vZABC*kYDmf1vzZ;|PIwKu%f8*1M$dD??{ehw?ld4L2_!_E{v?nvQ&p?;7Su
z6^Q<d8s>!yptV;e0(cBBGMl4tz+u14UZ1HNDpd6+pbX)7qXu=Osy@8OzWFL&MGfDr
zP4_EEwLzhJ6>j}#Bq-;x%#MFr@#shWi}bTH9MwH1dNzI~c1FD38Mr%s{2W6f`9)L$
ztJ-56t6ExQk4OmC9;<ZtDyz$X=xL>n?)Ff8a7CnnR`&Y{4JocOk^;krQ}4E8d;<b1
z{pDuv;$RCF<@^>Uswv~hp~9xJ%-@Rz!MuTQF~8CJZ4yo2Wb1jzj=n!u_ZnF2s`&F;
zlC`XAri<!gk;rCt))B*j`OPxu@2VV|)?`%`UB;SP5+RpAWps98oUV-GH$}RA26%gv
zUn5k0pXpsLUAlyw<x)ap?1}#!MJQv^eRLx7tTbn}{AI^FV$%s*>J?15M%MRXS@_g?
zd`+Oov(J_R(FcIWz#pJYt8PEv3Tf^#eVwr@C8QyB7Rv6@JL*A17Z78=1d)On*I7s`
zXYnJT^S$+UPHg6FQ0uEzcWL{ZSv@_G=!Fc}pLsmZ_hjbNlLxf_lk_FFefxKDdyR$G
zi>)Sn&SfU*7{kuT&)wn<$WABZm<BXg=Sg`WJsrPF1{4Onq8AY^6?K!-WQ<341z&}V
zs@7Of^m4EVQ@)bDsJ`Z$DFB-vJ>#=C8ttXROfT&$VlcmOvY~Fbh9o*|dt+t%<LgeU
zlyUjOm)nNr$Gc@?Ukmt7OI8qEid0LE{=S`Dw0I}z+0hHYK}i6wy>2!9Et!_g9X>9<
zBsS6|@F2?5fUNpV-y~sisCX<Nl#>O68J4PO-uUD_FR2_t!oDJ3n&&1S{f-{84&Ocj
zx-{Tw(9A>B-llsbpz7zgC~Xm}d07=Qz3m?YLxsI0_oQ_|5*eT=ja!loyS{araNYp@
z&XdvtuH$6X8QN3rGBjRWSAo0q(v1Zs87nf5j06?wQQ4bDW&;^ppuJzQ&79kfZOLnM
z;`m`W8l11`Z?{z$8;_kO^KtKShYErR=sEY`8#F_edm~iQgKY%_!;<bx>T;QpxF!jC
zu?){n<5R&pCCjR1exA2aD0Uyh2WZq_T_*!1fVrBEGn5O{2W-=IVvZz;sBy;cTFj82
z3G|ndOzY)HKQCdxFy46ky$K$LHhm)H&~o-%vWS%NS?J1LOS+%G@W#2WsFupOM-Shk
z&4R?f2e^n{WrU1tDuMO}Vu$li0DO}TKAYaXV1JXe`KJg+E?(Zsd&67B9-Sp}qESUn
zFH<#S{I5B=gUEbIkwi_`d<*Z|y}mf~DWAEwU*${P73gd6HC{Gw4BDvD?QDL`A7Mj&
zHQ!TJ8R#b?Xj1Ts+!PfA*&75kU0bP>c^H+eu2w6brH~tR9DG!NZUss*8AKxPp5tU_
z9sp?5%5c_>k^{=D$VkC0TO<HA@3EoSPtP0YlQ+y07M?qOp^{B4RBs2Bx0Mi6i}J{0
zr}vWM=60((`7f>9E7wkyOB)q4hgh$4yL1RVBjm(^ZhE;jN|nVK?iOFC-ARO7dAk$U
zImaXM+sP53V(nte)TkW0WCA>FliJeCKP65co_lLAB5x}|V)5u>T@uRo%;z|Xek-*l
z3iQ?(5F;L_y>MGI!2MIg90D#r&ru(BS-CdlW;v9VZbsro)DIA2f37?Y7L5<QrG;L(
zj<?lr%W{lLB(qmSkhxj{N4s~rVqIanYQUCAl^O5yv+}m?lKeozEXeJotDvLzq|%?W
zgP(+E1MpcSlF@j}gnMnvABCR+L|r)<K&kDbvJ9+1djUdwbi~N4F)kSSr1GdQ=r1C9
z;aRw&i?!=p9*BzC=mIk!_S@V@k2OrOS^8|4>QDLSssW1t=yeZWIgzY?8QG9H#ela_
z->FPLe_){#J4H3{EWWM~*g&s1KM{>G(8<mg)%7hupVe}FhWl5dox`w_MG~2f^1;OA
zJKP0hSJXsZSeZ)Tm{sqOU(9mC@Mi#iuk!}1`^oWTK%O0W1x#T~c^U(zw=EvADL0cQ
zg`H@pifr|cG==TA<PQ|kzbv%20enKfV`JjsYx%4q<b&V{i{@=ZEU!}II4aV0Mst66
zm(s}h1ec3~{`0<cdEcW9UG}bB<ltTP<he!|aH>9mXKOAVqS7P}u-1{CnbX^eS#8$M
zrgv^|?>sBJQbXENBfa`NWP71AJ#+3{hBrN^|I;p|6MXOv&?qieNS{@}FZi%d`q#k>
zL0E?=e6AJ9R%M>{I@5RT<piV~LOYpo>?{eLmMA>1osz&Mv2zre^>4t?+||Ln67(ko
zB^ZL5cTRFv40)F{a7EHa#x}2+u7FIwGR?NBlNJgmlG=~cwk)os6#opB+L6&D)WlQ_
z{iplA<IwGOdJS<vYw^{{G3Pc;VBauM`U@pZ=ix?BcXSC4IJU%{)&&l;j{kf+iG8_p
zM?GQzf;Q*(sJLobHz0F=`X`KYRUp;vPBL<qWL*Vq*i@5oK>r-MINxrd0!;UP|Brpf
z#EOYsqeha@*q}sb*YhR2&>O;z>%*6cLjn$;3-DO!4?UM0<+VqT-IEB_fS|Wea9&M!
zG}-SfNB;``&F+sKG*Am2ULMSQ%^Omn${t^RAStdPLHPp@-9TMY9HSA@fh($$)S}L+
z_CmTU23;aFwel+|)@1&PLvy!LYxEg@UCuY1NNLg4fwd9q^*O#H?tt};m9JW^>^x05
znO3T7-FA6y5Ja$1X&Vx@W|=j_*1F1!X?KXwX@Rx@qq>s!J<sZl-I0n;;bGi`WRIOS
zuNlY}M`Uj!6EzR0_Z*|_B8}@lk(-q0j7yEb1CpM=%wy3iki3+*+%VOvBUFJ+jOqFt
zMAde%oa@2bSBPDGX)Qk)aMAPctv~HFWz0Q=m;>d@1*I!b1AJ6~tBf~%A@2($^uyg2
zjL&8a2<_J;n8Vh`(q$;8d@{o?V0+BRcLR^5-X)&rr?BE-CE}0>U4UvnI&Fz3K<5IP
z`JaAjz%59BvZYs=dTTuY))(a5gDQrp?mz7Y-<{?;Qjkh-=4y6gXVGy~RmIdQcPBW*
z#CZ1T3NjSIq^vJKxRs(v@?*GvDq+@`{|GIYtGdyb!F19cj(xTD<*fC{yHok)9=xSv
z+3WPrLii<65WN>S5AeD%e$jiwf&Md(uM`j1k#a!SZ`bi7!0vo@#Q+2o4|Ey6?s%FM
zjp?pz`Vdmi=CixE@q27U{P{tpc~T0`>|?9WChcTUr)AJk7ym2;ayXfCL^~sxX`&e$
zExg@8D5b(L{oIbW2%=A>5?g80+Bdr|%wPnNdnBUO&*2le@4!QJVJ+?xgE(9|6<~E^
zeC*@1Z5vD7uy^f@B5IdJk_FvIimSq2FAqn%lwJu&>umNuI1VQK-vmp!jRCa}k&2|6
z<#;k3$Bf46x&T5I!1=EA-|*WD)8D2v;!*QI*RFK!l|||oX&jg$K|4QuhOhWbHl>SD
z8}sh+<4vkax5WJI+b)^;x{%UGF~7rc)#XUmV^6<L!wSMU(JH>qaQg=c9Y|>c)MYB?
zEQhBBao=3>6p9gMNJypOJ`lCUWDbv)tCFxkmzv3PTd<^Gd6n2|>be|y8p+M8G`rba
zTZM@518w?luAh4J)ND6<HN$uOcRT-KZ<t5Lha)Nl@Cl~_)<jAegDa_N-iek}97uci
z#PaxV*Zgv1WBLEH0DjlbcP;2m1`8g+>!Y$lop9{GySf@<Ukcm*Sd*<3=%=@|zMB0H
z(TB9(_!u{$F77?6R$>ab<pPAOzreGr%5woVMbT@f9B=J~;Koa(=C{?QNDq<o(AAz9
zAXQ{k0bn0s#(Ya^5|9bi!qH>q6zURhTUoqYrmC0J-N&2iA=QN=s29WgK90Zle*O$D
zF|t*Z_zmwgX=hhk1mQGSU#Z8=MwavisGv@xD}*axW>47Fb`T;!x)!36U}#!gCKA&3
z9ZN%&@EB<NvTT-Yv}t^kUr|bvbMKTY5zj`B8XGkvtjCnWePd9?YzL_cqej4Of2ixE
zR)0WQ=II2X6Z4<`N*o)a1QjgYZ50O+Qk<$J@v^fN4O8#r-HqIsh}hQ`PQ+Su$27+c
zT>UMRrGI$Oa~cscDFD;05I=uS_@uJgzW3EgFLe(W&Hl)jS6_BT^?vzvs;BjR6o?mb
zs{8J!TZy#NxJl^i(!e}&t(aW)$AymXUtMm4Ndu;61~@hMqy_#Ce)|X5<WHwrZ`lMZ
zLp$G%_T%(9abim*i5P2;$aiqhKEUss{tY5;rT94ZWuf1Ab>A}4@xMgg+`IYv<CLs#
zESq^aArOHZ!!kt#F_tpxDy|MrJMG`hYKfQBCq`P<jkTf16SY){U@LE>J@?cqrTgZo
zn(ktJ^fv<Q@|Pg19IaYM=s;v#_mSMTUqYv*y>OG#M&i!xs59qa+xBl@SQ?@%?vlWT
zn_lkr!cJ0E8MhAZ-S<l=*?7PD5VSYelbVgn2qN!Ye7;*aOTvvOn&T=7Veu#U9W`Zz
z2};@01C&I=B%X7+(e2;vLSVm#HelnF)aQF=x;nJFVodGWxd^hqat3{u_#5Q|c^`W3
zQg2820_>13nKT~yXj#$s_vV{dSndC+qXlA7H^vIEJMT`F*8RMa52+8obq6fw?_X#*
zoVy-VcBr#V48yd{x5d|Z?Dalb?A&7jW#(H(_>3~tW)rRy!U9qZq6+5emzHl;)Cs|t
z#E;(eHZIRg`NtVBz`~q@&it9lB_77p+v{bmp`B5G3);PiV)*6rzydxI>W8F+S?MmA
z8)$EpXjz!VP;GW1z{nwNF9A0mruj)FzTI6zrEz?A&@p45z9pbJXeF8HcCDFudN}-M
zwE{g$aYsvjdf^i5aZi9NhVJ3;0?QByhcZER0<c{VsDg)Dr{&J?No<R&8JeAn(slRJ
z5Z`4u*>m$0pYKvmKf`s^j<<=JF++@SGZF}~)eH67#$dLmhku8$1{*zqKUlSDm}@{m
zMca1@X75KK0TVd)7tXF*mFVpXqL1UAkn5`9_D6-vx{2H2^%M|jLwezd;!?>tB|g@}
z74=jpo$*ZgCeSuk_Z&3KqHvS)Dfl92H$A$APb52Tzj+^XHtB2{c&4&c)nonm2PT_S
z`CZgOl<%;%a2?48Up{wMc<&Q}GrI<uad=)|peZH{+?y(lFDDN35k~_Hr^2fb!|&BN
zu@3Z&J?BOq`N27Zj?HH@!x7s1XE=Sfa{5u;u*$>jQ+Ms7Gs;r389ASggHqV4rDH%{
zZS{PP&?AO3-raj5bc{>N=kQ3;PWRs<u*RO48S0I*BaO{;-7Zu*Rr5-gIIUX6OIPcc
zJdf9zG8JQXce+Erex4G=U{Zre?-FWs`UB=$$|W7yaBY7%$+30AB4m|<6K&M=N&RJ<
zf!3-3r*H42Ip*$fS;3HJ{W`v8$o33WwOU9Pd8a)F)mZ;#e=oXVxH+W`wzFmmVcZ9e
zjh%7mJnRXm9~@5A2W4-`YGeioj+(gYBgS_Mql-%b;arMb*2;*cU;jS!=bVP*zoL!x
zgFfhL8!~r<wYgB#)H(e$Lw&7~ePY6{u!2BfT{R+IfCzA;;R*lz$5?y#lbzbwf9O@l
z2j`pwWGA-A>nGRUnouI?Pq21V&?cJN?Gw{~6z^?;pxO;l5IZ?pSf2FkP@blY%5$r5
z+HLQmdezx%=89!+?0U?q4-{6UzW4T&;G{!#XB6hv_f|u^S1VOr{|^vurG8Vb=3&P8
zq#!uG|9~2a1f>S*I5*&{86T;h?Xou9$0z(|x$Q{A+Yz=##PYJr(X&T_FJiiQ9Uc80
z+xb6?Cq^g3`s8+sGZe8c`ES!8afV^K`_O=^Fvcn{(4KYfusR*n1X=S0J=}=Ra1;$K
zJ5(np3pBaMf}5U>kWm$;Tg~Mn{rZ?Up^k-q`zK2k9sgsrv6kk?|BEgbb|mb(55qkV
z&Q9AqMGYC(9HgF^X{xRRPA_!~%Wd=>Ej@sY5AkAV1rOczox%7m8FF^AWbe;#f9AcE
z3qI5jD=)#Rdn2ExaBgZfVFoRMeJp8q29DTvJ{$e?1hRW(fe&Z{ezqIt2+r0CViI>d
zOEtV)=VBZ?<3sMp!95)!Z0;%9u5uoOQCh#2{?hqjY~?SnEr%TlMhKTDV>-JQTu;L0
zL5%a`E9-a~bediuo^fn1E8PHdW%i5_VoS-FzDI1`{_bDSHOgm}jz2a>hlMpP{TC>~
z)p*WqyS+TNBb7w_PjWfs0XwF;icm$GW?jcV6(#sr5I%W>JcN0GYdR9k<6oAW(kkzR
z{02`(s4ZLf=z*$0ZPAP^-PkRANpU%uUnaGq4<2kieI6!Drs0ZPLm#zyHfp*mQs|TD
zU1ELIFU_vu67NAZ6)Z}cD`SlQZIwF_0F5zis9AYcn)$Pq6z1(T#Xrya>tya9VZzO-
z#2o2}R+>-mf;Uc4g1T*9yMgK(){h+tfYxfsV<<z8V>6P;Nr{vh-c7Fn#O^c?8n85z
z6vyl5oF%WhjtB)j!C;sM=&<RDy$j}bx;pZ(dC~Bl{8$CcaAJBi<K%L7_Ti6?dw81k
zq5Hodbu`)g9#zrFcEwhU&LC}DfgxFaJ2KiBa@5^7oZhcjq>%V@2CuY~fHvRYI+K%w
z)Vh=1Cm<9ArnLa%Gi)EYWYh3PI5y08D39nq1nli7J_-p*<vZNpYCYLtRi#4QcA4<$
z*3rK3Z-7*8FR8V%{Tgz@Hq|dLD(G!JTHyOB#O{8pPFwR-zzvaR#@^B|w6Jl%%6b&>
zq!T~;6zR`5+zk@(T`vF9UuRwo>2WKytFKgDs?vUYLiq{rpk58(q0<A8cb+^?)z9`X
zw%mzqmmiJQ8K<Q~VJ5z0F=dx0PPFf14F9&-C|F#Jz&TP>|EMtG&GN=9kL&r|EZB#@
z2gOs?0>bm%3ya{XoNxcq{=T9m-uTk>Ih2!Qe(C`=;5p%04JhzMUb9;ce@#pVz>faz
zouF9J!b`pMUn%Z)EhAiWBdnwetw;&G_g{U0+G?K-VS8>7-eReNsngrZcJKK;mBx-s
z#_xj&;b%1+S8hpKZ$l-0iXKj}6-*C^)B^v+XKk%4v>Pyah!$weFYCBR2h@CwR~nv@
zYzMS{M$J08mf{JVVtJ0K7cHRM#W_cO^UwHn*h(QF#Oo~k4e6(VP+(`gxnTXarJ3?e
zEAB0I=?c7nimsa}gJjG(HKD<hI@7r6Dqokt-=l(Qi|-rC8*-tvzLT1hg+oWVnYqAl
zDC4}U6d~|>$wl4Pqix=@?1qG);cwCehG1-C3?Qh|dF#(;L8qT<mwi@JfLnS8^hv8P
zziLfyxV;pCnD{0xN3%us0;3^hw^N0Qpi4eVQ-4#N3e9YZ^}V;T>b-gA5yA@Gpln`g
z?%}U!z_&qTcA}`P2UcYlEQuYXQ&?(g2YniArr+J$3i-NNzrA`9-s#G^v%44G!e<?l
zPJvUjy%-Q@r9VX1(J$k18M{m#jd1442)>cl{7%K`?j<BV<V?v-Y_=Pi2ZK4KzonIl
zaTM&~ho!5JNVtZ70VOfL>ve7CD?`KyDxp_0;vwu*W7S7?hS`)?Kv-MJUh7aCP@VZv
zlewVfbv{#d8}!Vd8cC?*7s(typ5rao&uYa5Vc)>L9T*KhBXHCCcmb@DmIu}?+-0K_
zX%1&ELYf3$<*TwgGjLx=$y=HH16rSy_6CI-7yO>KM^73-gzdY%ryjR|5jW_f`TYKX
zh!cYS(e+cI-lU>5mXXV{S+#&w!?x)$KB{*?+zLM;)H^ah$=>97<I{$_#$k=wlE9<@
zu1Bsqr^DD=c<kV@PVB~Ee#4}4v*?}~ft{?#%`1c#6zOwaj1pdl)xDXzctEn&fBc5L
zaMD!@4g1Y230oA?dDYYx&+Xv9I2_M7r=p$ofqmJP(YwJ+)`YzQ-t2rSz8E(CCCzN*
zQWu2w`WdtxB_pPORvQ>$EFy$`-2WD|_!*;}75dbboNNL75{CW!4zr&_8y9EZ1wg{Y
zT?d6iR$eGo(?;a;=WzCJR$u0)Ydr<n?6Dbyy>G+7N3EaC%n*~LT%=lsXjqw?BqL|-
z)J(SV4YxrV5T&>e^SHQ2%VEhkB$=EJl>V0@1UDr2XzAvIfmuwgnxx>H<B)FnLXHo#
zL)K=rM_pUzhxR%{w+qos=^_&jcS<{>M>nZByv@X{GT}5UU1B|8o7AdFEA^w8WCz|x
zvA-f*MK#}fcE6c%+M(pn&0i{G(TDH&>*y@%?(=zq7<nD-hcXafATV)gBYl47sVk4F
zSwAVIoGtW7y4hyaFZ59YKLRq_@3WmNfYY$q=c^BCl%^V~%e2SBn?H9<gpOiYGQ1i8
z9!)ltCywAiu!ZSN2;@52YV_RE-bzaUPv1<%<R?t=Wk(7i-&AQd18w6L?(Fjvk3Q}&
zENM4yVu+J2P$}xBBJu8ozRi!3xqqHL=q}DuUNBl;`rDi4&J^NPsk?$KM9#<<O*Grj
zfn>C2$ue2FACE>&WG-56tOGB?PWWh!4bh<!b9K6-I>HtQ<9S8d;L?pn_n`M(jBi3v
zSZCb<%r5#LmWH_QKgm}l=zmX=Q5-v!n(28-r>gSOu+Rhx?Vq$aNsJHu5+Z`O8(~SM
zI?q@mGWa=B<Z%bJw`)O56++MfGE$Veou{_W;bjRD!T~u1aSx$<p&1p}5B@63e)bVt
z+X`$Nx}BM|@=l0hr@~5^UU1q!MksIcbwBJ!bor-5RQ_qfcm=MggzK-6AuWG^mqwKw
z+7(Ae3q8JPSD;h@vl=!O-^l0`WlDwPEuZo0X|!Vw4d$VPokk`N+`Mg`IXeg|4ba7V
z2ZkSW-1fR3_o>t@-oehL)azENg9hW&W*@b;f~fYD-J335x_MlK{PEs1{wMI3Los0$
zLv>iTywrYm1ZuNjm2Ht9<~Ufu+N)C7F`xE~C4YMnfCH!Or-7)gBA|;Y{Q_%o9e+mj
zJfh04`+63V!!d)1ItxKPSH?SE7#ZGKHfb0;{8dzY<zYq$#aN7Wb=vi{;p!vMlywjD
ze88`->yFL5t{@_o_y!)PUzNx~d|3HAw~l~_p!JLI5*;KYWy(GhtvqAF_S?6t{EI8?
zj^pxnSUPM`t7f;gDU*l1prC8~n=RaoDr3Y3A8OFVkru~hz8-|TvOrx>N4~l?>I1V(
z>c#Rf#Te~r2DJ$YDG(ww&XrpB%yKs=LD@9OSzX0G3kKe6R_|f7x49r*{9FJ_fKG{J
zFRXfC6~$U#7kF^)CA_8u{>9&)%Kpw`CLWSJ{pW*gHaVq`kisE@dCyH7Wfnsb@;)~_
zr+lq2@o3iOu+^tC)ugr%yiS}AU`njLldwmBQJt;Ixr7Z56ZaOWDX0E!5Rgxc63CNy
z7QSX3=Xis0sT6aW?ZkSHJt?p4+D6js|6{=(>md}>(DZ$-&}&Kh&XI?3Z=L60mDmrf
z`G`T&ez!>Sfz-TAX=O`V>9U<uMlQ+uP_s+H<=<L{6ofHT*=&N@F3RTiu{L%Tou=l8
zY=4cP_rcXnM)@4~scKkspjUYBORInk&YMOjhuN3GrTpG!L-*ddLz9w1hIMGi<RP2}
zphE<ykkYNSvgQ|S>Tq%<;9%z;vTC({DbAC6wAUg(aIxq9sUA~n(hSkWX-O%OC*_^e
zo=yrJ=Vd9>WdJnPY3TrEjR9w>3wU#=ncj)*!HtECu1N2<(yw2fzpHt=xhkK>Tl1_V
zE7i9xLnSnc=%A6l?Q+uPl;*pq0k0viy)G)>zj&`pJ5qV{;>lQq+FTzx79;k^O_eh?
zT6U>!;0?SQb+6}DthsWOsK9Y8jyn74{?&OCZMw;`DtnXg03~Z(Z;`~3t4{Ayr={=A
zwVzUx3d`~cF3;~P?EJp)OS_R6{YQe#zD?k}u2&gJbPvj55*VaXzK%R(raV7)Zf5y6
z`wcFeoTxu&#IjlG{Pva-^>>?v$~rCHqSG2{VgyVR4gHGnA38bn)VT|2ve*1V>mFV4
zxbfjV@-n{Et)CT$oVZiA?>y;n&@j7t-T}=}3?98t2QZfAB?SDL)VNaH({C<$yL=&~
z;@);WX(tZkT#`DpU;F^J8CaBbX~kE5v*XXBCIC&@U({>8pUgfHU~t}^g6Pn?Un)KF
zULv{8|Io}Iddi4N@^hL4nR{1nhNQYC<^WWE{LI8ukH`^+0SCB$w%K;t;KcEj(=xgh
zzLjy2T?<Kwx(DYs7o}LIfewnkYdy`0jb1;FDDKISBbvw&H%fW@b8N0|XqatEc5BWz
zYFgtP`@c|JQv%F&R?EooJdPM=5R}}`5eZ}YooMEWUTP~pJ-NjrZFN)m6N$X3^eOz-
zl9rn&mXtrI{<9Sb*8GOCO$0YGyd{zR`P^xro<QF_FipAK#yj!?rcj0*$eS}XIk#0B
zaj;q;Jx*ow=+E|Gen;%R$CF6`%<`~3lSf=SxT=FkT+;t=VNuGCt@vnRktgtWDV39N
zz;8Ic>+_ZRsz;o@9qSXw0W{LwPfl;OTl3<Ve6S`dOclrY>LD>;;J1N~r#`_JoOR1@
zYrWbW5Y2S^6LdfiugmK7eUU5T-v$xxE!gV}J~Zmu#_^?ZkZ{>NCsHPHGSjW30yh#I
z<>2+UHC*@pZe{|pCEf??8qNcmqPEwf7cFV<$vw)ejAHID<%q=77M}beJrb4AtuaeJ
z+(-<@K0A-6eC0Bqif-V!d0&2I)mvot2{2)2wz%;xt+m@0^|9oG4`Dwngd6j77h0E<
zvN`h7?A<>cod(`jSB}o(MYY?kCMbIsidZ47v3zwOwtqLX+=lZyEO$Ca^g&LLqlhf?
zm9f^8nG#xQ!P^uSwyIv#6*zvUwNSHa%m7mfhPq$do9r_FUo{7v6ui3=Zy4B_&Fw(a
zS0E3M1#y;j`Pw)ObZId~6u9tbeC8DviA?B3)m_?P^B8NX7@9FmkK^kQY*nAWN~kH&
z|GWd!uR2J39oYTBLb_w1AoY%ESVi8vA-fm1*Q!8yMDCfC`yThS!s6&umoVE+VD)Uh
zj`uM^KWf(tvfFBhJ-L7LF;iT|`)pdhk5tn@2**e-%hr-{CB{d0`w7B7U-G$?FL6tw
z-mm<U1g*PiPL?k~+b)AV>6u)(pa%LhG&}FTx$*|7+gaG?-b|Ghj<NOBeUXO>O#D^S
z5rD2LzhvW3*|dK~M0o#Ugw6?^?|iFn`}owPoEF`twp5wp9*7dcn`TJh_W#^WPJ;%b
zECQ!*BdNBCvK%b0Okkhru*e>!Z1tR_eLTwV2dj7;Rbpbrm`fwrk;@*lrdN63MEQ}T
z_Fv-jlZqZG4By=%mVHJ!<B5_Tg{Q9bPlvJ;>jlN(aN&!yjGn)SUoLDHb$~L7J>P~M
z0$~UF3<3B3**a4@=&wh`WPL0>t$z{W=~^CH67o+*V{TRxBM2E8Rw_wGqXJaj5emax
z)@9IV#gMd;?VP95D93w8yOd)5q^QpMnU&nI@ws0zI(B8`T;-C^+PatP@=d;xR^6ZB
z4*!YH*CU1aBfcu?2zYBgTDZ4&3}&K9nfJFN8Vio?dC{(O1z2*4zF?X?_x@U(LcrDL
z>rO39pl)@xtJeJ5rF39%PZ2MtsMaEQHm;O?D|mBcr+`Am5nuE@Vdi4DN;N}xRWyB?
zM@nBpY$=6+>A(vSdkG_s#pY*9VccIh1T*YuOIOj*4<BZ_pGQc>jOZ@yLo-z@h1n2t
zK9QyA@5XJ>2(ba6u;R#*A_Vk}*f>4TgoG`u;uGW8{!SJ#woJ8|q?<x3LexBW?`TWo
zYs8badcTj?vmXY$QeCk{Fv6fZvb&oZ>-j~}>sCKP0t=|oKL629mu`2nd>2Y7SN9zc
zX_A!?>B!<*GDt#lL+4qNmT<xx41dllFuzz)yV`FlbgN<OCQ9INM?#+=Tlc<%dFcjY
z?(nZPXfT9qXV=}-?^M+Qv_u;vPmRjp0st1fYm3lWv-P;eXTE(9biB+|**~GbtTKY;
z2l35sYC?WJ!_<1V3t%|~*2^H)7ueEpHbEyM2e~ZG!m%}sBXKzQSH}pXwM$vU!^3i3
z-c9b_U+6Y_Up&isAfxVMsGhVXBx((N(oB#f$KDw+>WDzS!#L=n*$cP#4**ztv?77s
z(uKSpG`yo^%56&%Zo{jD!mP-uq#149zvZX>A9-VLOvS{@RGCjx%ljAb$D619`$UgF
zt2*hCg`LdYY9PPQYSga~GS0o=Bgftj+Lf;hGeE#JKL+%z_pdF&LrkW3Qx-F3y4%1j
zq;%dj4LOH4PvkYRH9}^LZSIeJCM^8AWs;kY2_%g%uB()`#_09g>or&sK$$IUjnFwo
zAu+hhtm;?na=zb!qPV$l$lvE1`hd&mga|dclzNualViE0B{>K)0?d@UwoD42`@6`_
za?U|Ubk|=Ovz-$@w<gmZ2;2w=(tOf(lQk}pJ$J^d3MJi7oXg+eiz*(*5lRBqs|!9V
zkUL7J)H4bdHyWzy@Y{6KBad}V#^zR?uZCma(U^%;MgEbd3!wiyTOR&T+cI`A-`LPz
z!9`R*a3?1&>7mSt(tjn@Cp?hRH6UvBbD3AKnuPG`TJfso-rnHvvxb5sZ$?Tl<;*hX
znPB|}?gKS(-O<c;<g<^rS@4q9)}KwU{ZxyH@Fu(Y+KLBkc|>)AqHk_|p7`pR?s$V1
zwEM{A19o8`@S${xjWO`q?$BYt<ko)vNJ}Tc>!Ge}t#*9r{;}D|PGL`-*<5Cxi<EI0
zeSh62qQP-c^|K#czpBO0oD})fTqaD4?YHPAH7Fi$-FmA3==;TiJt?}$U!a2(<B=$0
z8{>a~$i2^<)}iPA-WA=Z#zR_pQlgssa!%YC`D*WEL;Y<@y^(Xqk^f}AxAWqWkmvWZ
zJRia(FICxhwp8t#Z&SMyYC7aNwk!1`eEBi06Elab>be`8=vINrN^!g(d*cm3=aZnD
z+TqgD6Z6Rp<z};=Aa)DCn7LZ>-tR(F`Npr7dxNovcr8iIBl0gF*!vmlWFy15a`AyD
zsv}2tcQy3G*)!iXC(wKd&0Uk{hv)mhSIC3ww=)wQp$s8Ofr__rnSnV$m)jAvsHW{9
z+Wh+E_@o2UU5HsXN-E?ctBP^AFj_=FA;VFGr)ga3X~18%H#@cU$Gmb}+ipZ|g&fF-
zgcED2BgQIFkOFbmGVxVnS^NEC(dyjG$+<6m@^$8#*^1o6qycP|vS7GsY2TMe+`UA_
zaJDIgeVj$LF2j#Fq6SBYyM!6mF&FwNr-U?gC&tU`F5F2UUiI0=Y+QW5_M{`ffxKC{
zd+wJ3zbd*TWl2ZJ1FsRDj!6^|3CvrsS`<1o&=S*_dy5dyhwD-vA4jwo16yE$n~(F`
zMI>DgygGs_<s8}k`0^KDP}+>U$NW?-<%9s>XzL^&SIk-SH+4~2hkQF4@Gq9rgDlZG
zYaus1(jEgM-c-^5k%j&&t9D&jh5d%d1xqyA6LswX!oMN-e|!BltbjqDE`kJ%I1_UT
zK7%nA4t9K(y4HMTVt@d4;OV<Znx6tK5dH*11zRd<NzGBRVQi9<sK#kUiq6g)l398)
zoc<lPJ4NM};3rJw{lLiN^O*#r+cR2r&F{3>MSy@&>)Vou?da@A=COFBd41%#mXO|%
z(50BZq_(Bd$o?wJ&%fa86Li!G!Isn0c<6cJcG(Q2yoIL!VF^8FpKgS$SC4$!AXz6}
zhl^@ilIc>)UbCHNW|s4p#IzSJ)a(r2%1VBoS0i$}#J1^4>(PkA)|5oi*yD(3RpBrO
zg_VuSK#aBJ2-qwt)IX6tmL+Q*c<~9F$7T(yG8G8ipZTzAVOe_HD=JmXF%7z<pMupS
zYc0ra-6AjktxX9WxNU@KI>w7Ss)ja53yMnm3twVWHzSVr7Zv?aLA_R|>sOmL!#8!c
zJxX$TbeAN@zkp%1H%Dc$JoQK8hh9(_F6$z4>*4+B3Yp8YFj`E>WM$X?4&08<iQ+Jh
z2>h#0v(l>$WZkI*Z3R@QMMNjA23>?GP88HUrVm8&x_TR6x&JJMdk6nwxC-iKk0muv
z7CO-1^MbaeOTEsS2L&tawa$|DC*l>gTg!@Vk-Xt`Qn1+QVduH%k^?cJsjv_pFq-xD
zsPES?7##H|L;IFhQ8=p-?-26C_(cSF9+YCvz9K`vC$`Nnta0lo3=2mGMly;tyV!}V
z8Okz^*3t3s5Ly(-pX&VMQ^Ikg94!Ll#t9uR&CJF*uYTMm933d)m=oJ(!n!wKB{kMA
z&Uo#i?RMjmcaN9F(?>HT5R%6!Zd92bRLB~NoHWZ9?pwRk@nuvl0_J<SnV1J+USDWw
zFt}T1e0aw$^Nk$ynwz;6vvKksFg(+_8Jr8W^na1b_bI_7aNbn|M&)Ot0Y0_ARwx<O
zbv-$(|M~gI<wh$pf57qklgp3RI~(-N^+n;upNH%>KEL!CO04D!r&$_LK)p)tO3Kt<
z(8I(vF%i(XD|>DRHCjmkM(J+jvi@o*iIP)|*Xghw6R#^jRyXCwW3F>JS=vLf&!F-d
zsCC~mb(=-R;o~gx;SA;efu9!guJ$7rZ+<vq*X!AikC&leC}n_`Xn^o~Rm8hKt_!Yr
zrni&Zi=?{tFi%I^#HCAepQK^_u&~dU^j#Bo2n`I$L$NwXp4!1}jh}uOJGVTXwwGL-
zj`2Od)y6N9DRi$)l<xg`kZ@-}fOZxY2tO;s&MbFP1<h-*hGAzvw(D=%H0JUmw7WN=
zcm%^kX)VU<`rW`xU2FoFU*97D=ab@>-8v_Y!+n=JonIR^(lA}Uk}<y%rkRpDvv6zv
zBf4|*+ZVFN^FEc~x<KZjDMUHU1`u|}U8u*0F7yid4lhWj9;Ba=k;>NNnagLz(!*@l
zJ1bBXJ^I66*HW_+av|6(DD4t<zDjW%pVuOnw;;cZkr0A*dt<0EKu7D<8+B{{gXCvm
zJC`V3r5BK4*>gH$$Mtcrz1y)n^we-BGa;zvg-9a`7HzfavI^~-hEG@1R%dLYZi5f$
z_LL-*DU?>#ds0*FHNvzP2LK}n&MS3|0h$?-Wa>b>h`sy!iOQf9)gMI^HOI+$)5bV{
z@^MH1I<i&t_`9zP<M=}HTL&+CLm<aRIk}_QA#1gNMYW6Co8F>4SM@kEJx0|BzRkaL
zFV53NX9P$wAh&GZqd;Y_Hr!ACa*7><d$1XS#H41BPDeBvnPQV0R%W^i*7rLvX7v2S
zHeR+O?EU&7-G9IP3h=*hv-T%*{n+IGHLJB*s>U)(aeE71@0S#rx6`~MdDxfu(JLc-
zwl%&!Ed1m6*!zS;(qZ=Et?D-5sH0u|Phl}(Lv!Jj@@=JOebMV9q>har3%6w|$koH&
zkCq_AUi})giMZb})RXY2V3|3u<H}(CpG-=5?VPN8d~gs|%ZrTconcX#Vlz3VRJJg@
z8u&GOL7fllcPcn0A)EFi)g{_u%ml8zr%BY$9M_LmBx4l!a}|xBs?RVl)dx?z94t+?
zO7Lc~UuNi6T!B%q4<}lFDS&6WZ7xX$B;q<d-XM))M#jw@zj~s&j?Wt)1>5pP_Q^_e
z2`yQ<+sAxHCRxe%=}gK{jo2w4pO;qq7c|2aVP$cex@ar<!eCGmA>f8n;^rx1P^)J?
zs^)1w6-;pxr~#UqY-yo)y)Fk=G&Rjh`ZSi0cZx!Z6a}OoZkiGmi{TYSb8G3nPZ-CF
z?0+gglY;Git>d*v{4A9E7yE`g)&Ti;gd1U1ZvptZ3jp>!xW6|`)LMX)?}BVqOvP+V
z9GHc_x14^<v#3#yD&0ZbMZm^c_xrhPSExYzf?=h`b@(%BFO~D~{)ooPcXo?BtI&XJ
zQ_+S5foV*hCUd>(X+!Bt0WTnDK_biu)x%nac&%y>w4Y|@Aw6~LhQkaSD`XGEco@8d
z{qO&^B+BbAT6qLAWM^y&-<p>wfTR2vkLT_CBFD#WDKRN$OohpTUti{HR==Ozsw;P=
zSxqXkZvjfra!aT~;6qM5YB`Nr*mjig7<AxX(5LSoE9LCqe5g*e?W#Kqqb7U`E2Bh<
z2v@5=_LRVG=3cnrFUmEk_&52Z*`n@x_Ae*Osd#=*WW}gfn&p~epQOvH%wcDkJ0rWj
zUI0^LY<iE6yi=N#&y5t8nf=DkG4k?Q-VH<wzV@Eq_RLjmE})XWy$sMlZpal6hSv@(
zB>Sg@%<xb2n~mNr(a`#g!qz;>na2pKVA{Va+YJ1Nm|~;Rj_@YF!`*)0SVaT(Ao4x!
z2Ar4p!$FNY-_Vm+PxHnl#_?=7uekk0J@7wgA%Dj2a*BVyD%~^l54#r#*i~mM5h#~<
z#vc-PRaR04qCbwl*CPB{`KGdqx6Ij>r%;31!N>c7W)-DMx<0PNl0GpT3*-G)l?H^?
zRgcx4zQ*6+cq-)Sl~F3=3z46fh}L=f<wTE6;I-K{0~vwGC*R~5g!$sWcSc?Q1igBv
zjCLBkr=M@-FK%^XsQha{gS4;pzZqrTM#`BCw+C)tp76)33aIWyN}5+u)n<pjlcrAf
z$6gTbTe&^6T1ses4|8<TTo=|GLqvUg-9qKpM~@AN*Y6Z9lyYAspnd;g!jr9-T`1R*
zf@A<$%zI6)W^~B(kK`){Y2wlYTW9t@wj3w~2x!Er!t$7NZ!OFpx_x-vS!fQ2j<r3R
zMxLZUjF}pHiOArte1at~GR}>UMZ>(-npxGQ#eVE(?OuND7zoChbERqY>)`?zZo|K`
zp!;wzLPH!j>w8D(Q-snU9o3ctWDdqnel3d;uP6(zQVt@?t2DlLfk2Z*kW8M?Z3VHG
z^p>#`nY=#O>ns{E>JC<2cpc+(p1|avkpnn-TQ{-&|BbfF0A`$LbKEjAXz|?)<CHtX
zz_iihC+P*sV4M9?N_m5mnxYHZAMN@So*2`k&5VkdIjFMs_t|0|zw|z1r%IVZpe_Hw
z+g~%q8UcT^^XpC(@jz}IJV^##T)SN=+_~~e$|V&yPqN=yghYfiosI$ubARBtVb6>P
zTOa=T2wzdbSA<Z*{FAgr1l&I4FE}*EiNSY9ZmhhR>CSg~0Fqg><c6H&0fXv?eMVb5
zlh`dhP3gJ1D+66i{@UEYyEE+jKV3R!RhzpzSi*XV?cj!?hW7g*|LAe(n~NtW1OMEe
zo}5%dCi_rDlD98onUXidZ?>^8Qe>{MMHMwSAYyo*p}9=gzqu%Rj9%&Zti$7=#@A)R
z6xZw4<ER|HgLLZ4(Ei10-igLn@WMqEX)6-Jty=czmW;`{vK>?8-XK#%)f9q}6v7G^
z6{jxKjFeu3w~{#~k@1eS57T2WEn3^bT9uF~_KjD#_mKx<@17;7;(w$BdQ3f0c6#=<
zM|yam^pvoEkgBF5WubH~WnF4%_GHAiXVQC9ui=)mOW4k<lD2U4I~nuxjYXBlz;+q0
z%lu5OknF^r_E_L9@pAzPw+M6{Dq!qkK3~J>eh&ESdZ~mlnZ}1>UUv9$+h`T0GtCFl
zW_{eH-y<wpuJVPv=%<T>qbHN~nrXxO$QQ<-kn0=O6ghj$9jSlY^}B*1s)&GQ%9VD3
ziQ92IMPJCRYSS36E`D0HiWJpGk|B%f7SRlL5o{i!RjsuiVUOd=Vs=!r<DyP8Uj$IP
z46p4Z%P}okMhwRg?X*UZWtln28n1cOJ+)SaHLa+#!Nbw?)J@ub_{2xWH~jS<0maE2
zXm&?3^fj_<yqi>lrn{Iz2Qv1Vtg0!Or8gia2XtgIxyO7-kpI!zd;F(%j#BuGq5N(i
z6`09UV7G-=J3*8=P<Lm>tqQ!=HYRX61?MGY-=Zv5%*)QMy@B{pxec$nm`opMZ{4oz
zGVT?AKz)J=xu1v#sOP+x;(X&S8P-^T*zdfS*6mWvP&!*5IOX_a^V;I&gEgbl@s2o6
ze@?L7Fu26O7R#{6cS*zB&dei8pNO2#F_57|`^WlyDT(il`wE!X!z6qx%AS1%#VWCi
zh@SZfuEr~b;*w9j+VW67@G>TL=B)uV2c;qlfG!v!dbRHofyik5%&6WAXDd|*r2qW}
z`+VKJVG-dtV;Xoll%pmcXBd<8F&B$!Jf6Dgc=^0Rhm;<T%n-n=+?9cZVon%FY{zL~
zJ7L4n1vMYE&Sijv>xPTzR%+@mBTd*`8KSw2f4*>yUs!pYbCHlITW`j1+Op1nuv)oX
ziTLKZuLiX#tc*z+XI_|bQ(x5&w6GI?g_mA<7PuaL$oftw4slGNiWcE`7Y*y5sIxAo
zXuPbGK9+#R*D_mG9M{Xcy<ng1)NEI&c8)Fv&8URbZ-`KZqp}=(Fn*pvsR36KW~14a
z7V7!Bp0{w*9eZFnhx9FgzTKU@*Su5g(^Lnp?&osI5zWKmvu*jQ20hr@(7BkRB_Wu{
z|FQKh{!I6O{Qp&AmxQa7RSvsKk!VZhJlj<&m&C48QOqPljv)=(gi7TU!*bd}?9-L=
z`M4Q5j2wo{A#50P-sZG1{CvLO+xPeV{tkb@-h01ax5w-CdcK~o=kxwRglXvA<G#}-
z+`{N4V}`jup{EN4Iv#(nYa#ev#hQW52En5BvyZmcTPEX)oToK=A1!IP2;gSK9)0e;
z7}@RYT#5+Y?6c6HcwOhq^Pl{&hmI_QeVN&Ef>0)yXtYpqv<>c?sWqN9j$wU|6nV}Z
znmQc9u+A?0eAq#Ew?A2xkqKM`m(fb{G3SYSKHslA9J)cd!t99)cMaNm<(-ug82>$D
zuLaos;s;Ux*={?VWCh--Y3v?w>2bzsGxR?GX7UJ61~LvV%mL|A*q>!|&K7Vk!rI51
zGuO_Io^vegQ#&cRNGaRpn!z7YPO1A;`s*25QOqKKIQ^>m`<HvRzJJU~<W2(txjOyk
z+@{k9aHq8X2<+d|)3{Gm8jZ>^C}X(-=5e5kK20UzE8DRwpxAc2O|+`!>fUWbXxPi&
zTGXuEy??t1@UZi_xKX)bJWqk|?q#Yse|E<$HfcnpVc48lXA|qJv2`xw<|I8Yxw7*F
z_nlf$WV(|Dg_c%Li#k0yLK>cVcP9kmfvUJJue=2e#Y8v=JYegB4hY1^FRFN9&c5gP
zmLn`e16m>}8rqyk?QXW$qyGXFdb&C2k2649^sUuXK4BWQ*IfNnwu{Kvbd1IZ?=Y07
z;-^Su@xNp&e{L=Oo*-@*3t0W57Ud@|D51)ye?RtX;`<}wHuk`KfFI+;SUI22Wx7CH
zi^zWRq|Sc2?_hd>FsTsZB031qv=K4u<&g`moP*5|<A0snV3~Te$rG<K2F;eLh61!~
zK0tyWTU1BLiT0rqtQVVNwp#Ql#Vr#zpv5Ge=6kTez@YAx6Ll+E9+bWcoTC}+FP{OW
z|F%*q%3&s(hVgP!M(Y()4QZb~<OW4pMLn)jh+5ahaNc-zYwn(BwRQO9UFIr!QSQ>z
z?4A1SoqV|MAf>ImdEUz74a@<bIsfKQj{PkY4?8uu!HpsRomKVg2V08cg*F|FU2TK$
zvD*m|b!P}l7UZt3sgpYwyl3Ap_h^PH)QS(q3fc@Q-Q}5VC;6Jn*a~8C#VMuGBr}l&
zN^pn5_e*&}C_iQ>jNiUwP)8B8Yk7EQ0(8#a%mc&_022yeKhOpAX*j3^cQp?8NKNpZ
z|F$6Ordo(f&J$%Lw1iAy(3cI;z<_h2=}`IwE<#*lHlwh5Qdy;a7cQj9CwqsRcBGO<
z>1Qh#54Zz4XUx2W;StfRLk1gy0@#y=6A}=^M8|&clkcg}(=D7!pz|pn-><qx`_-41
zRma!4F%H*Fq-XR!4Ai}O=rjMy8|~H8aR!7E(np`8!j*^fp&;l9pA0am-R46n@cDJv
zHrgM2?d9}u#qWIPkM3Lmo}Y4s2fJ9m!Oh;Yt72sq4zq%vZ%JCu>qF;^y$nCaJ^B{x
z`c#%|OWJgiD?TJ&dmI8B^oUQ1?qYZ5Pax$g2KG*xul)4w*HzX>rjB$whXV?^=Q~le
z_oyLy3D)0}v8gZOH%^L2AH^?p_3&<0w&2MxB^FG{>lkji)h)TA^@>#|*|wR^QMXU{
zwl{CZPfgwcOXy0Dy#MqR>I6JuFmo~xy=>E40S#GaT@ADEwzb||xE43?yZ9gI@x7eX
z<?X6S2&v~LqCoh>hv1|P+R!Nt`UPz#4aH+cDx;shOy<I^&2d#i?Tk(*WrG?m;E$b|
z4Mbts?id|L!)KmosZa3#Dk(MN<O#6Q!$ddzqx=q^a#Xv^Qt!m3^d|Y=o=EEw*7YMF
zSR;M!Ue?(T`u~$gc*uKp*s-Z$_V&?da!U@^g0LfJ#yw>m%xzDf)(F0ENc$80y~7oa
znCuO1JbhZW@JPz%*Lbj3k!09b>qyH1`OTw~%8D$z@Cx^mSC5S^MU)%r(aBo6qkq@2
z*l)(K9anv?Ag{Rph-=yb>=252J^bxDMiMb<Qz~!AC^tQ%5OKh(_$JwR_%GJ|aNU%!
z45J&S38x}oJ6$`l?9iB?eCDv;fp61fhd(mC6g*a%VmCc~hxmaO1DFHyd`-q=EBl@K
zdF1?z{;K4F!OnlEI#bjN77*+APE+X|?k}^c(@&%?qR8@ftfuLnMl(VAe{@o~{@ll>
zOWL0J1SG^`^swsAkk_K<8>e8m6Fu4blER!zvlGpdAk>7}G2H9%Ri__}5|9OXsv%0c
z<MP-CmlEUSSu#+bwOFY&^1?fwDU32PcKo@=^D{3~j`RO*FjcK7PEoJ5JWJAXAW0yV
z0Dx7+PRwj(1%N<$^mmH3SL$rC3cE7%Qf#^)$)253@Lj@THXC|fZX5kmJ?`P)afL$P
z&t^8OxAeL1fsq;9k?ZddLo+2c><pZB6d__#T=0YM7BaS&6Wu-yeHT=+ax%I&5g+Iv
z*`0!xZ!(2`ANg`r<%@i4gJyL*ThI0k(Hn|~OzN?KV*<PA4lS}5<8P~)Gx(Y}cf}>g
zM&D~HK{gJme7KSJ2TXIO@$j#c0X(z1_&fHtx9y^b7beW9)$y^$e|4-g`ZX%pzHN9<
zTb9HWFYEi&7z3wTbdJaK?>mYM3%R@->t*2Ij9tEHK!f%H;3NfWA<aUE^Ups}fd$s@
z^YNK)tPeM^Ej)enY+@I^pgTt%Rx;wdV!ZyFMgjlX^Ih~0vizEouka><c%wV_p6XG^
z@RW_=qs$JlAZ>+JG#gyzb)8E%6cC3ndilrMvB5@LAhPc;a;1{>{opvu$Eg*Q<nZH-
zZ&>zar7O4#$qlSlnZwnGV}wbFo~J%Fo{KlUOO9Jmom(P{Kb(X+zi#>!I_zW){^z@X
zr~*}Zx+A@nAERiJ+Pe8q%kcM;uaz07-z!0mQ<6J3H{{S0(qPz)2P@htuWb5<V<cV2
z{;&oI$6L^boi+4BOB~|0raX!ZdJL%pfaC?|kK@xmC})c+%|*6ht+t{xOzDD42KMDB
z!ay%oiLsqoTpV!R>-if*;J!#3FQ+4M2Ptb>JS|=kT&WL$!qqh^Wz1$PRbR7D+hB2C
zZnFBiZ?<$;I|TEU>e}=%?NDtwXhdcxPk7WH)9pWh9K*LR`ATz^z>1VIie}wc?yoo1
z>fSVL86<0>!<oa%@?r<=37PJN!ouxiaE>X9I|Q9~l%WbPDi6nG%fmc6|MK3niGJ=T
z1*tWt`<u+m^1ymw&nR-b>T$7cw@Jq~e7|vyL*DXPpKq$}@kAvbwM@hio3lbD7in$R
z;j4dAIEM_wG8!E0)-k;q$6bNA*8oWb=A$Jy!^hU_nHj-8V2Nmze`oJ9Hb#82kfVRe
za+q60t+pS9YN+-cL(ry30(sG~nvaD&M^Mu;hDh8|k|Xbf+zu8KwmWdn&&X(V0r)-f
zmt?`+g;E7kUuSiCT(S%lIdOIDfU8xu#^wzRu<o+vK)N$0lGpUS?8*a6A19QR@BKW(
z)s<5(^cu(^HIpPaJLV(T8ey8aSwAn08?vcnSEQosbl3|Bb*7H4e+tPsIr4_`LLXT~
zt;zxTRZZv<V}LSlZSg$r6Sa9cBa%3ts>2KSASN^+Kfw5HH{H(j8e2gNz-FhKOa#sp
zg0U*lt7IdtmR<u2KEOZ%gFmh}-MCrT-8fEvCuJ*s)W<g4XRTs_9msJw*x;e^q<cL5
z@wW4*Z|#t247|wsk3Buwj6GTTfb;iTo&Aee`s<nO=3bKeapxT;6ttS>C9AIgnGR&6
z1;1}WzL=yn(#ID>L*}Y3-PHiR{_G<tS;;_nfWm!CEUO;0PqPJg_qYT=_<>(h#x<UA
zBbk-{S0FVUrS<EP%G38k4%M(*4{rM5(H@pRl?y-)q6gs2P``6{)CMLwMpPEzw&J$a
z*%EMgw`E0kYhMkox8oGN{$!K4lPU~C5lX>U*#xNIG)PlbRAAxB$S-Dmiv<Lw{~&wi
zpTf~Q$Ul@YDLz)lSuV<3EBD3oGc#`SrToqFt1ewX-vTJ}3*U4wzawZ(w2jWFF4NRX
zMlx`1KBDQ-ZOm~HE*KA)O_cpEm2rM52T^>=hnFOLH@-Eu+D2$-d~C(P6SqR^%SG&1
zsrzSFeIyT7>mIHW7@y#HZ0U>4m;Q<<Orf@&Gvi$d)X<{pxE4uLi)V7vCXOnr7|1ge
z_i$>FLkN2o9>fRjG)N6R71C<Mfkv(x+y2{~8iNiXWBmd2rJ86)VN30xCXRa!E(tR6
z6~2uOwJR(on?OUGB6U_BZ~H!59By-5boN%mr~d^Kt38t8X@*Y83*IW5`((JURIc|f
zTwUgW>o!Udi(6pP#G^2joP4bPhg5K>N=CxZ`=KJmB`!k)n|(Es#oZrz&`@A!cqVw5
z|0Ls8D5!;QEmGR6<9Ns=h#B{?0gz4blVd`Ws@P9!tSm@TX&`@LDxJQ0Q_f~eb6ydc
zny<D>gHYJI<5AdZGfhPfPUk)@YWif^HY;snjS;9Gjw?G!#yxnGcW|tS17EkonEsg4
zu)Z=nY3F@$Y<tQg_K%K<aietXY?4ZYAaeRtKy&2&$WML@ljCLOePM=S-3^wIC4QvO
z`qa09RLn&O;6wzR2k7F!;EO*1Du(~SDT9Q#cIg(aXQGCkd&ITkDopD3?1u}@3Pg_A
z#Ua+8-#lzD32wNSJJCZf;;i%s4o`avIeF_%G^D9Vtcy%lLVTRvlXp7MBJ#?9SNudO
zoE4TIK56H4TzT|WDNa#g`W(d+O!+Gg(_42nG~g`IO`^}}6(maw$TNgZrKoUxeD}&r
z|6>`S#-|su+Gjd%IREsK?{b}$Lt#2G9x>N)4;u1ZWcyNo8x2s!LfHhw?B$lVkKtxD
z-3a#Qh=Y_U!xBxmnwi=m%d}4gJTJ_|3E4LoftGO*fH-Sv-*6+6R}?p>0ou;7Mt_%0
zUAR2+9F~O`{dJI_rSiz5Eowlk%XBfV(-eK<GAxGKwJXx3AVyOEwtKD(`z~n!Jy}YQ
zG@HbfEdoJPDs}iIlzwHVP3(6If7uKU$hTBd#QUp~1<h8Yx;MpDOBFgsm*Xbm#4#}q
zuW~}V*E7X(@&&?p)LvaRtnHILYtc;_w8Oo%G_gw@I-#;c4(bHp(eVJGoL%oR(&0iO
zUX8ubtM1d}qI}X9Px79U@VL4D^5%D`0O{q)#f59oP2cD|7OP1C^hN>BbBnZ=CBR<j
zrEWHitOx>5+G^mBE~UEc-X1D97b><#7xZ_{j(#I6!1FU%uM4M~1b>{f)aHAoN2!^k
z6aFx;GLf;xLud3U<{c)jlVWv4E7$n3u#f!ko4(KIjvT6rZ2P@nYC#`xMoaq6=iba=
zsYGpOvk>*G?^_SdY5lctV4wVnHs{`c$gD*jm%WEiA-+n6o;6iCw;8~68a2QKu#*<{
ztKhC`1${Q#33%0|J<JcSRmuHyZ?<3R!G4a#kuxy*dz{OJX#_Rp<C#7=%V@^i8OL(=
z&ohO&)&Rnh1f8jADtLAFEvbimfO9e4Q`jp9QaSG7hZmnItlw?k(AE9rY#ND5bLO^P
zRmaW#-o4;Fap%lGzTA;tJRkGX{Sn&e4#aFfS~5BcG-AMrFmF85xjtnU=^&ItNkr*y
zYzkA0*^l0l#OLG&Q@i8mhc96x3k4pL$GQB&H4Sm}2bdoDt&`u16dY)pFmIODK}wk&
z#`q9TP5GdKxc95&!I2efz%50EfLplW!xCIe2VjB(Jlx#Ilg*L?`P~ID#Sdd?gd4Ks
zlP`(0ui}I<zp;k2Fq{10*U@J&TB1v%Cn8iu4WHhLK1dR64{rtBp^=(pk(06zOn>GH
zw4p+sq}1r=oQw;+8PoTQF6=zLSW=h|qkC+amesiqI~`$)TIHz$GqbthteD@}jd9z@
zdBd#Lv=e?&&BVckc`nh%&8D~3c0yn9*7P#$Z79rDl?KnqB?#*p28O255fRJ74Rjl_
z7h8LY|3I7PBZCb36V<F`8$7M=ID2m=GVKR?3K+1**g9x{b3W{P=V`o|#)rBa8mtc?
zzAPHuPA^v667B#^CQpH(O`1FECPw9l$<`})Xfr|x4%L<a81`#uA9Sp~|2rh~N@(93
zaSOHKoqYE}80b-tLaA@D4uzNf(ME0~?A7VF9oCGalb%<Xou{4zwD>ekqVjS&Sl{8J
z$JOMTFBnvD6ER}2!Rk<os<5ERE9e!h`3TauXyxj`?F6&iwAmw(ayktu*2jzx%S4V-
zMWaGJ*IK9qYKwI;WwgLWvYT8spc~8!pvO8m2^282)^Xv-1gl?@NtkJU44N@e_xEl<
zxT<k{6Iv4KD;Lk6CI|dGYB1TU;;V-$&C!)gV;BalK2&SV5awD;)~%M9Ux)Ah1zh$^
zRgMGh-OZyZeV<;e9EEce5bsR|F8bp03vVc?L?OcP{so}Gv?RFeW^rPD^BE%|GGL-8
z$)4K_FbZg&!3Heecx=?=%8l+$n#uQ?m8RyK%#L9xjSt+~ngr4)bBgdDejmJrC5f5j
zY2Tb^GPv|!fAIq!Vb^mCjx5JDQH3|6Nc5LZH-05fM#nb^zdl-+jOt_s)o~PpFGYqV
z%h1j(yj9O=M3D97oOP}2`F8?y<!kog!K&vkqmA(R**?s(QJNf=mC_CD4lvcz(SD0r
zc%UtiDRvwEcl{7}YqWLJL9yF8QGxr9`_kUcGGz!84uM6g+XluraTAxzAN(l+b)F<o
z-E>8<m|etxKjqQx`>BCEN49m(WThZe$fG6N->F4seVh2>5DY0u<FBey`4=c*awi2!
zq|C^P{pq@e@`^F~$pw6`==5$f&wDS^j1Bs3f!NHf^*jp^a{j=z0cL$0oBB$(whkI{
zuP(VjisRxQazBPf8P<iw+7zuH6i)d#NF~Us`s1s~&X_~f|BD3>6n*I6PBcL&rg%xA
zbRwSE_D)r)5oA)tt>JaHX6P5qyW4eywUS;OOP$JGX?YZ>q(x9y`?c<Z!PiH(l1@^E
z&LJ>qlrQ@0aq_s)O&uvYzmJFIL@i^;g~p~OaoV=<PuO|JD+0XHYdO)IJ*^=ARCf?J
z+X3qfexr&kedW)0g@)}zfSg|*kJj*T^gjpV_NL$T@mGxiE)Vn$JmNg^`<%%#!3u1!
zU_ptBEwqEYZo2R%gchZKT#^z{a<V|YkEo1Ew;XI7PR8*y-ikCGzN>~Z3f_58eXlT&
z4iPS_t?2rhB(~OL&;c-7%lZlbQHV{6acV%4)zDi~Ne;#tb_PJ?CQ%I)vRx@(RPv5s
zyTyO~IMIZn=Yw!wG0c|O1#h@zXlIn~3IsN}XCH;i^a;ANbGJ9`(NbHb5(=&i?jE=)
z?uf!}KK?HeEVZSo9WXFH)vFF>ohp1(u;270o2g;NRsf3k<sGRj=7l^38p*4|(O&>F
zr<@32cKpiJLEv!%mXrnAcW7ghUU!aoOk8SA6sj0tT9_vTSOBA2tK3e&?>yM>^qqNJ
z;K$|WtU&+!7oT03jf@t&S9SzB%ibVOq+uNC@4643;Jgg7OkYu|+1I+x5~j{*s^K=P
zURf=I*a;du4ONkZ!6u^6^Ut^Z+%J&w!8X;29GqAHpn5*WMMP!LzQ8wzkwUK>)ZY~#
z_D5?5w}~=s7+jkBr|IT<{SsCTl}jeK+TpVND^hlj*OR|Cf2mhA#Ax3DP8}Y1N~3Dh
zV_`U<?594x-CoGf(0x)M?$7St_-l$=K6(R756!)Gkv;KHDWGk&)y`8JEbRhIgV#cn
zj_qViLqhx1U3t$vOmNq{pSRp>hM%C5yOmu$R~uaq1wZou=-eYcIuvqMrc#u9ndEdn
z<D`sP(Q1r3%uZn*XzKfHX1QhNa)4uWxa&-oXKQHBOK<DlldI98Menh{kq$>X9rxnj
zy-JefD8QNumS~9xdYjyiW!>OKAFhU$-TNCsZ^z1WN;T8;a2i(JR@;hw7Qkt1|IdL&
z6U=5sSZ??CE#!+b#tV7KrstsO0oFec(+ZwI)#_l<RYjV_DQik31g4(5FwWIXNBi%7
zy!OEL;q<Xp;W-E4!<DGG!#&sGJ8`|kab|JRp0-^{d+4!1Jpxc@u%$WihibRr;&?AY
zUm@13`6yh6SopB?lUY7ln3`1qID@#<F3a1iCgJtgDwG|?vUm|@fqFoXC-ORU8+zNg
zQD23|voW@h;1o7NEi^)*b7av3G){|vz0qEXqSVWc7AM)iiHsZ`6E}9PUv~myAz71=
z1}&E#GSoo3S8Uw0AWL4BKqu(-i5Y?>$J^sJdUd4Z<TuMs*l;uu<e6tnEhbkn%;0o6
z;27_fYUo?7(XhQUW8VE{+j$)U!^=>@%4?!GIAy_43KMWfs$9g;(<`OW<TtlYGfPv_
zm+a|=f5D<uO&X)rL5siM!q3rXRB<*&7r?9R*7SDb!0~|V8kp;H$Mi+zf#|hNvvDV#
z&<F%o`0+C5fFaU84Er}tYmDv&zbzH)h{6&(AEFz{!drp9tFG`fq+U4IMxgNg?{V?F
z?cP&E=~s(gsoyPT7)Q3m*A98u{BT{rE07poP=@marmmY4kEoRT-PZAy&BrH&ppmO1
zyJc6M4_W;<9DB6I_xXUb-sF7{&ENS@w*T*h-!$J37g^$zB4Mr*m=AR1pKi;&Ht<M@
z<65K{)wSqI_4^yYWq-Xe6eGWk6<o3U<BURjc>84|JyqYv!i+k%1e-0&?^aJ%%iU>v
zg~bUf={hYIN7g);Z^=hKvI5yQ@4-f^uR!=iVxhhqY%=`eD+I1T7Ba~{6P9{?@ZXsh
zOWTd|NqM=NyIB_A;>pY`dGC_2)^8zRE#W$22HPTnZ4ZL-RbsNu3b2{>TaU!<$NjFW
zvx(k4Z8*AYWyH&7^bHjMW3=!r=pi>Tnk_H2+>)L7ApEkPfkCb%TQ_AOSynN8(F_v?
z^yk{!^{UzP`XbFuLyGsg8eNK2;ek+_vk5*qK&<Zx@<1$AEOp49`w<@#69&MoHb_26
z*Gi$mzr1>xNp3)Rcdx$l5g*4>XJ67~g=!JS{0Ib&?FaGUl5z|VD9Dz@n8gu4$omd=
z+~G^Yk4uK4bsjc-b%qPWZ_L~8YoZkRs>>rkOFp>WnC3~B(@<SM>#)A~(j?N%65&Qu
zfD0XE1Sj#g#m%<mdVU{~?-6wf`<MLZHXvoUJqBu#^dnK29;OHYQ@7k`k@7fX*z1l{
z{4pglw(!^<<F-767OuKjtoF((^<}s&wiIb)NY1EQZGNzUNrT5Pz_TyQDAS*K3bW-~
zR~My2R#h$Q7?tBaYcp7OC8M;s*Hta6o0?lp+eqtzjg^JvMhIjKY5$fULld3{gt@-4
zA7;qQ5n0^!;}t!6FXsMgAzj=!6&F)ynR*fi0c=0Kw|leU?MgY*!LGzsqo>wBb!=m^
z1*q(HB5KC(I&`w*jqAK6w2>U6!agvbluk?%)IaByl61Cu(MFlplvI*i1RxGi^}Viu
zaGX^(DVa6BYywa~@i^8~`{NMBH=g<*uWKom#h`yq>!&ybagx@Ym}YDkF7Wp>Vpa}J
zV`YJ~(Pzc7AJ7X355yhFEq(@k$h}}7#+#p#7jBkGg3@t>;(*t=Fv5OC>|(&@9$@ON
zor3O`q)x8tAz1&kuGa_GvQ<W?PNqu!!!p`li;4Rodxwu(`Nq2r-=nHW7K_?Q)Qx@D
zaYoNg7O}WgFn^DOS0B~=83{tpbhON^+_ssGaiC{I>|3%-5&0@yWtdUl%!zb8ro&5L
zd%MOY$ds8_V!T;ym?7~5Q*nlw7_%rS_7DxlnMG0TKa^`dLca%XW{rQf#(LfzHA+I9
zXkDf=FB_G<rW%BeCuOWPUG~b7wF-XDK8C9*kMemkh^!3}{zNvXuTMGS2NqgrGmTOF
zJ$motB!XHzgvhsiuNc&jtN-MvLC+T(G~b9B>(N64xiteH6=2^(0=`G^!Dakwz?LZ=
z;rGiK37}}#$&*U5PuhA7iqPR5^)mTb9Vze|Vu?lY{fJIVOIA~N^cw}av!dusvx~P%
z*oT#|P1TSV+CE}lzI1tYLaRaWU&f(tAfTUx-<e<VU|O^BFVW2>_;{}__P*>_O?y27
z<um?{^lW)6=+ltN#!<BR7=qR2bO>3R6SB(sUC|rUo1Y3^jnHYS*CI0VUuVx`>)JP~
z!H{nFh*A29`h|bHp>soM$!%ikslm;D_QMz(@$Yh|+5NH=jm9+$Pi@@EZp6wYMsj?p
z(I8k?3TjITsXBJ4G_5!$Od?(ML~*;NsqiRVpt-pkK5iaKwFR01?Khs4Sdp3{^+IFT
zYR9*ig8AZ%Wz0+`%62kD>^3Jw_0?qUwT&*KAFP@I$2((aUq#e%=)+z~BlfFSlb!XM
ze>ZzxOVm|2n_z=(;;kmtwkL}}MXF^a?7MIgEO~nmUkwnyQb34+qqRJ_mpg%Sy0*Ub
z>o+N{Lj73C{O_*a7;S@97JXob)zcdX*$@h%9fH500_u)mi^N5<efWQXh-;-P6y(rv
zxD6*zT&aqKf&GW#iT8&V9)(~X`8Qx#7VR8H4ts+XxZ^oKkBSfhRnfw|%5&;^l7m$E
zDeH@Ky!@8E*70uGy7|tn-fxAJ8i%ayrI%DYs=bAruq{TT=4UQ?DZKU5>g2<)wA-Er
zE_N9sabNoa;&JRiR9#VVh*xuhPDoIQo?M})^aIAsgbzm2(#To9PBDtVUrHA1*v}{X
zD57b_p(S(ju+h(CSql0KQ#fF=F9M-w6-f(H2UbZdSbDLdU;5;E2oy6S2k;eJ+)VRa
zbTrxdj6Sjip3x_5=dOSAg4N&&s^@>y0V*9$tZXU)WnAZ5^Gl1@tNDw?&>bj+L9_AO
z8)#sH41D57Wr$FC?ANM*I#^riIFeAqo1CFv>K{*^RQdku!>xb*xB<BSm)`^W{+sP3
z2lIP@MD6jvH1m&`?%TWEI4XVX>2G)bxh~n9r}p9DkIhXuNq0pB2VOUHCHZ&P`vV@>
z<d2S0cQ`vQ3d?Il3RNIpm&1T$=WGkuqiuOJdq&3Ck(0uicp(6_t!_h(ybd&13gsU@
zo-t6N{VoLekp|g=is^hlRDcvuF{k2HRCe8fOh*R){(BYl`mZsA)4*u?Qj5^)y~rln
zR?RM>n{R4XP-8)Tci-q+Hi32JE&o4MZUo}FY~cZUNPw{Th8#FktDr5*W>NSWNX_;`
z^B5C^ADbaSB#vQoBsBZNO|lB3Pao8m^ouC!7ySnE53BHWqJC;p(1ubp<i{5>^vDup
z1sGMUMRZkLa!JTKXuQEkxv^OuA_T8nteP6XxRo4O=IO^!@uFO9B?~{uVy{+mH4t@Y
zYB<#SQ_OLXwoIQ(J?A5;yR)_8$tI+^@ikRLT(gwQ(EB|o_!ZpNl$-r3gBmd3a3^>@
z<MHNEA0c>kcvaHmOc{oZoUpbL^b%0);x`b%%Z)$Lo&#?+M)+qsR*sKYlsC1?$6d(i
zk`RB5n-b680Lqye)|EAM2REqeJ}sInx_j*#>NfE(`u9I+5!8l{1a)GGhkBI)sL+?|
zU{^MmR1TcN$E`2KG83zPhNc>bbQ!9rtei&u>^?bpPxSy_WI6fe+QNIeLdSNbBRJr$
zXi8oYisR68tTn}}GT=z6l|nMuPZRWA%Ot$jV)S~p3jBq8FFR$qtai^Ys#F<jI84UT
zNAz1G<%S|`f?4r$?bhm52lO-gSNx4Ew^@q`04c~Lg_l+6<c7c;X`4N2)$8RfyQW4`
zP2c;N1xv`<!gTGX1hxu&fVq4ZYw|qzwh*tc>XsFU+RWLlQN@tz1{;+?FI+T38axn+
zCR$DR--0}o%e%ki%iwl?Hye4RTHouHPYNy)o`u)9{hpkj(loz6(oPjw_sp80j(ib>
zZYNv1F<~v)$5X|<YA3yBjXK;SP|@D#o=#m66VS)>jexX8f;?2X39y(^^mR3Pvmn85
zHXFaGA}`S*&XV;oiP<)!OIb~(=TYa4=NRe$;w9?j*|Q;?9`1YHw+Ku$KxTS;13O+>
zcdX%kkOoKPdcdE(5W6W#o6yHiX-$=~_u$#{WW1K`3eqS$Ws&iZ5|p@*^t4tWzsr*c
z{aWKuYfTOr$%c-y&4asDane_9<kxWJQ~!jade~+abuy^!AL~L5J2@0g0m>{>8+P<K
zxyo=K(cQRxqMgSz44U-Wks=6Y?>@wS*2+Ny>VuyVnn)W`2K3XFQE_~0l3v)X{4RAt
zX2zPd+0P+7$90B1&FFQP9luYia3ifDIp|WGp&KYo()mboofU&#dRcjGNKP&n6|u)#
zWpH+V!~0}!f6)Im*FH=A%}4m|=Kb2J<!xk)>C-U-PDfoa+vXh@b(j9JozQNGyF%=B
zADF?asXYDV0*CU-3wvJujB|c1aWh%Dz9J=;sxB_$h}99OOJ^^&$!ZMtqMOVD{=Iy&
zr`dIalp9UyIQ>?zD(^6>JT6Xf5XmZUi>-j(W%J5Asi8)<DZXdK(^dQW9^B@|X<-&?
z?*^aMO2_=GBEOiUdmGzgxyZF&{SGm1NbJ+a1lg2W;mI?@$#jX`fDFAHk1F1o8Vk4Z
z94aQaWwgwC3!J8YVJzU34AjtV^4RTKEv3nPIaQqBBv1vzd2vt?Zs@?Ge*ir4@*Pa~
zDT{bh2(?~iyQdkngBL}9y*9Dx;wgst(AhVY$%JTLxrN_F%`r#ePeo<9Pv86m{eAB4
zQ1K_PQu{6Um4IvdqMY4+%aFD5&Y$da-J9+&hTn_}X@o;IMFD`cox6cS$=3)=9BV6#
zhYVcVS8UPlIG-pt8y4rcN>2$GR=4t-{`8y0(@PkXFcY+y86g7%D?>$egadIyyWN6r
z^Oj`Nek7%KTH4FnOh~sIu~VU3&$XCXK}uT&%qA4@_eH7!vRyCocnL}A!XyCPD^_)R
zA`0q{-}w}r&vCX9JXP@)^5qdG6an~B(n?&gwEe&J!B@(|A}mFYYuk;^n1&~X_U)}d
z89!s=w8ngYdc@@i@>2RswZ`}feGhB(JxrFK$JO!+<GlVBo!ySx;l_cxfBNR4a-*>w
z=y%MZh89RMX?wvH;<H)oo`{-lfnD)1F0Vcl6i7>A)!t%1vq`R<gP_^x`gBllQOMe(
zxS%?grTrq?9uc$+)p;C{AN$~z8D|#%9-u#dfbg<e3)^Ve4j*1&q!tEiQs#Ky%;e<;
za&Tkr?Uzv8(pe3c8uQgx<KhP>mv0rk<VM*mv{X`m(|rdrMvAg7T{AqHN!%6O_wpDk
zRkaGjuvvsr{LK@TsBOmUG>WHW8s+u;EeA~YSKM9IdS$pK_FDv7$;xG|uf544wXEH&
zGvBvQg6J_Yd-67n&z8(~#U1D-c%UGMyoG;BRKCzyTWJ1fbb=qY+$*IBOK&-_J_io|
zo6U(F<_OK(dHs0cXyP%?Q^P9~^;#$J+Bm^*=^gCc-Jo8rCR6-{TIc4pbe_=k7J%c%
z{``>a%UMZ9&%TGLa%$Zg@gAfqbiRAPg#yWh-&3%6RJcxv@l9MY^LxpVinu&W%MsuI
zL6e9`BjK&(G*SeswZzHYMS|njl*e{kl)hn1#A+LSxaZbFkKA-Ze@tonPY&Ao+oexO
z7w;O1KLzJ?{A@}hf2%+*Hl|&%6K$)qN->r5uR3plPBqtkCaGAv)}xY23F;^g<$#qC
zycB-XB#=D-_GK<!{?DY2%am;qa!~=e?3;+RJV@s>wKM)L#E$$XYhz*?A%_(wq~-Ia
zy5riBLouNjtMA$2e?td;e`%w-?P<Y8dMO}Ic<cR}ZBF1a_Y8{#ZX9kFP0P5+ym0DO
zq=dTV7@oP7Pu{g(X;p}}Oj@BmqH4;5Pi{xROf<T{4~HWrLC8ye`!J*9?3-~m*s!HC
zO&C3~Ppx*Ij3)c6`S~TW0TJI8PHT+z>4-O>DXb)R!ED3CSIqF0pzM4HV%;2m_mOv%
zZz6LM|G;=}b&lM_I{aklx!#81^+b-`FTw#mcP)>or@c2IfJikdjly=u8zuYgystX%
zU^@b29j!J&A1m=dyp$F9lmrD`8TjxJ(}(wTC*=8-X*Ed~qI)W=TGtq!O)KYMv!8Ij
zwQUyi9N$EKTA&ql@p5Mc`c?J6_@IH;^1;<MFM?OzHR(E3&)!d$`)tc9E#ms@2H$u|
zH8Lj%zW|7yiQJS}TEfG$;39!8qOO5EwXAYsdJFL)G_z-9>pPxVAMF1@f5gE4W2~^{
z$)d4=qrmq(<dqUEoGl68*66y!nbI&uefRI>L^v*_3f<JL>Y7N^6~le{k6zUAybnES
z%?@-i`V!*BzrQivwqyFs<DczoQk~7YVtn318!1xon^x6Dg+046vB98c8YY6!S_l>X
z=+l6eddW7Ccg9{6UNd%Q?ZL3N%8O$5T`c6j==t$YtP<N7yOHzvs`-rbtHrsrug26L
z!4;WJh>_Kd&DGN2RkxZ6e@#zIoL}j_bTO+opiSSSUcIx%Yusoo;JM{)e$Y3v7D$V1
z<HfnW6P~~J9ydyvHgRc`h3|G6ZTD#giS&l&rm6xN*R@b9*4?nx%V*V&+ZWxf8>oq3
zDlSp>Y$kvt%o&8MOGRx%uL9O<_A@bkI)XRV7pb71E^K2bCrB$Iz5G@$+r;83ngMwp
zjZaU+&9!fy-qN^`?%ZJEUG}q_mL@FCLw?wp3c_}5tz9KRvZTqut9X>4<ZQZ|x_ni0
z!%2kQmC{4GMDO;3sSDR9B~-_J+fpeXn29ET$6Zhd-n~?E_L>2{(r;}wGHs{)YxlY^
zLoW`cH);28esGOcx4Lg&81q4_9=h(Q>xtOS*P5+r22klbLvv*H7105Fs|7KCx>=fp
zZl_3~DJ|nyG2NWze*}{R%HA#?EZL0^TF?p$k-O50)b|p^?uba^S*=#%5L%M!p#-(0
z?5|h>5vmv-CH%8PH)tAo2|3)Wd1qD)MV9^+4NK*@+KKzJjefQBTx+-9<6?X+O`!HN
zAdQ9f(7M%BbdpHQ!GN9@Yr|QMUG|hnTNG~UmMs%-ca|cRcdWjn5;a>Te1OB;zTGR;
z{At<!6zZm(!g!O$IJ)r3RTEpi*A_ed{*6h<SxDr_V2rEY?P0g@uif`du>Ur>k`3as
zY+}iR+X?`vL%XoAG!eRH9(fZfXLgsUXQjNCZX{zTv~SD78?ECi1^pH#!J?eoe6od0
zP)$-_t=}e{Rw6yR%IFX2ZH&u>4)M-2la&o^FEt`ph<<Te8e}NNjh8N%lmJ3geH(2M
zg}zgz%7vv<{Ht~;(8-J2vmayGiKH7(OL%Q#Yug4p3TB3AzZHBi?rv`Fm02<*snn;_
zfB2DIa6<eKX^VlAaOFjlzS}#jv%Yl}Xcq;f78ABIq~~IlKG{Ai>zeFpQcw3g>pBt9
zebfq*WqNt`=?TjK1z6Al`9e%Pku$7;<Ooiz(0cACe*?(G7WiHI83ieFD*<Vr4B`kq
z2>p!PM!ffh4&kBq{`HzW<}IF@{lhaR8#z*AQim5H%kYFtAsTrh>tF6ajXLW6qNrSD
zHlKPPG3=Ibc>6m;3T9pNwvdvuveMw!kZWbAHL`yyZ<U;xR#On+GN;22<fA67(%m{_
z8vUy1u-NWY*R?&9`G!~@(U**ib^W!CX$Fp^1)iT1PSpP@uQ;r|>74fh`G=M89ipy1
z0<k@i*C<U?6$}q>eDT&;LOS|&8Y+uH$+crPnRvin{2k}sH&y$VY{A>SDEtz$0Zw}s
z1<v@_175J)gg1+tF4No$h=#!Ul4;D>%L%}xDd`8;-q%`$K=v7*-i-3}y;7!0)=#FG
z)~EJs&%5hEh?k&XAy3Z6@Wj-8dA;Y8NL6plQ<HQ7U1O{?zeL$P$f(d=@pY8=lhIip
zQ1Y6MQ4VC-(TpEv{Cr@I+k0V*-Y@q6^(OS5Dpt(u1k?{}?D?e1n-Q02We8iI^fzdb
zCLt@Oy2PWmkyL~^avL`$jgSf6>0nM|+8hXeVo6nIOhX9bnIfjsR#s})tToZwdU-GU
z=5gCKZX2F-*+b8Q7I$_Bl{|uTa`giYxNOI;-JfgE=;nx)#O(azGQ=^a#a2T%ucyVQ
z{dY?4Asac@-n{4EG``hf^7r6mblW~a-1wK#H!^zef$Z;1p>inyPTeTnjv4c9hjN5-
z!EE1TSx|7MTIl8(?1bSO30)hIQY1VOg;*QLN4)f+4TwBR99?4YqM$sF*Tm>z5+j@I
zn_L`3&$L4#@RStjQ$vTD_&$w{b|!{dGOw_SILR3vfcBTSYSpALE27q&9IbB}CAR7-
z8{I3oFbGB))C$U@vwa(0vI{tiS#g0CDog;IGhZH!EMu!{rTX!z9rgHlpqHU?i9P>)
zK~3GInqhM6Fs*}aKBur8%v~e#wMkyC7bcqlWXoCDEN|GX(sv+Gb<e?|L@;wl$fh^F
ze_G+PF;%GS&2#)YX|Y=l8ZfXXRt%|<-e2xuCo?N7;07LOp@9A**&_{`i51AW0+C(<
z&Cm%cQdOx+x>)*~b{y=uxbIBB5E(kpmv+Erco4Xkp7(jhgr)}9G43U|8V}xqmLtSG
z^-*nvVV^3;DR^RGLVpBbpL}@qhlZ8Q<V8CT?@MD_V;kT|*}9;nl?qd#TWxGs49pP!
zl7I2B==9*~jk+nugt7a-k+sQo*g50J48-8nF(i5ztjB(lST~6_v!=+rTujsLO2i%|
zNf*My^Jjmq+$mAF+RS^-YVq&ApUj+Tx9&={3eg<GKN$I9t}z~h+Mcrk32CpE6DShY
zm5k*&zU4>8La)i*p%MLg14|Fn4VC5W0YpvKZ>JOKsWs{^M-@90GtwOyZLW4ax|(g7
z-(u~Qhw(w;UL4<4810Y>eTFY&JFfh@9SmOHO*gno8*sM-jeeJ@XvtWk8;j|acN6iZ
zaiT*R+PtqoVU4Ock6v1#i>&I~@qK33Cq)|H3a2yc)VB)+Uyzj`W<|?=`OxHuq~$DQ
zEzeGCtOFl8DM=lKKEyagzq(HpM?_fG_%=L~dEnjkACtYwUz+?CHgg)yzU_do3^d=;
zMu;UJV_pN@@|j;OaaDpL7<((3vGJq4LSJ?EQ{D>|2QQD*fUz5;QQ%EoIPWWI9c@<H
zg*RmLGpYqs^)hhVfVt8<Ttc1hPU_PNt!}L`$0SCff^n>eJUo42FSC(W#0{i98__Te
zRgPOtsmqEdk9ZbB-P!q^+v9m76Q>Ye&kcC%9KcHp@=8N5VCQtZdK606c;8al{S1u#
zpXpZpIW#LOKAd}IwsyZr`-+E2E-tFnrz%JiZr&19NphYsUj%+b1R~%WH>NpRhV5hS
ztq%hXKlt#n(W;Vh-s2d-9isbs=j-vKoUg8eK1e-tjrX*+<Xg~%^eFlybvhpAA*8&(
zK$2T2C5^^WKiqdMzb-!v=w8AL@MuIW89t%pIq@^_o*WbCYCd#~l<fwVgl70095Nd+
zC9E191Yl5m+Dfm8aWKgXzW<r}=<ddP)Q(M(19EHd`6HEeng;U}XwNVXy^a@OIEcLP
zAXrLUiqN70A~dy%-sNeXLY_}+HU|{eVPlucdE%ltdBM*w(r<B%8*G5<TnVJ}A-~IF
zpiE?d9N6grf@SnJGmC%oK@nT&#>*9@b1xD|<a`fMMx`v_14?f?dk(0zTqm^8Q{C!e
z#;vhyU_p7$pN?pgBDdG*Q?*I@@}8=LP#$e*pFgUbMchcm!v`0~7Pfl!SP*^M%MhQC
zE(3@Ui}~_g_d-kmuT}$yp%ST6A`PJTKYmyg<har>9o8w4|Ax*CJ<Lg2&DuTv%%8ty
zQZ$x05pXf>!P&Kyo$$lUS|-%H3$R;pSfG*mwl?YKE_y+23+kNz;+M^O>XP5UN+%du
zuEHU(IIV0V*`#(AirBH)Ux*1l%k|TIaS>H}XX#cm$1@F=!a-Ky3j}qMpR4V4(!>Jn
znrtWu8X|DLluKG?`yc5FS}`^!23FYi<Le5B$Hjj;)_1Dcw=?cJe1z};K@%POzg(}d
z>F+47HaZ@VaGqf5vxzx(2HUtSy5~SjZ{EqC&J&W}%y6=*(~XuAT<W^`hr5zaM%n!9
zK+tlCO~9k3lHwZckNRGU%CMmAI-yl_m=v7Rhn*`%i(2znp!&c5=iu1Ss&a$kh||3*
zpAdxsY5Lo+D<(Y~memH!wYx#VO{Len7o9!36=!BgW0?OPzyHU8x<iXpiVR~arIy?&
zM?-{g*_}W93!3o(24A-gT(atwQQiqJ(qZ!z=BBOX#8Rx~7VQCQq^1C6zCNe1X{o}*
zG6@@B^~JozEhmuY1ThD?b`>-(DCJ!*oep^bBWKoXIumbFb(i{ICNt4MyVk8T@!GDD
zlzLpdM|!|dFtI#pXza^BTb+ikcI(C2n-o17)$of`0~R&6meW3TXvS~E)S>2!lF4}w
zAL5t!<efqQ_(kY3{VxgSg-~>JALYs}vt-hP5I(~{0->xKWUTxIYnm}s%u1uWbKWw{
zvV4pHBW8hD%-F<!+|kjb{oRo1ip_%RWv3UvTJ^VB|3j>WYqrb{b}{?E^86nv6QLcu
zXr&m~FMV(tpg>#x-Scs+J@k37sxjiiWYmmaZdYHaQsMt=B&Wmr&@9u<S22---XQ2|
zp*~rgyBX?2b$n?VMBjF7_W`e$hnZjtmn$Go`_%Nk9%>&$aNO^~^H+vDG~(VHcla{J
z+2a~<z+V#wJxzcMO&(3vm!SVZxu)3joj914MH%CDr4RJujF&5q&r^S+TZkUB_uFZE
zDWZ)Z)*KNBWDK-yYEW!aAp@I?%gFMdIP19!1HEVWymW8XgUc5%q1HpUcECd(gEd6d
zz-Ch)VaM;YsC~qD;44K6{$V3^I-;D?vEwLuIb4vB8~F))-d&si3yFbLf@=e+?mCLH
zaJM0$-OMU3<lwUr!T<hx-)fU03IgdZN~`OXAaqDv9&i;wIS5Lt$z>Ax$N!J!ro+ks
z-U9&7Y16ggBJ3Q{f|{%Y4D#|5A`0R*{}X2<T;APT=J=>>j&pQJn+JyCJ?jS6qB!tb
zyF9sy<QM&fG~KZ;HUnTwW5otT+{ecfA>Q1I_>51;;Dzuvp?6{Kae~fNvnw9LFOhvu
zF}sF`LMQTOeZ1H7<c4b2&C^yqdn;noM3tU>-rI|*!dk9IXMv!fd?_VHelz3EGWekx
zZ2*fs88izGLXd6?3;gy1;-Tgl1KUfnO^iSXBd#&vbh8-%zW$T;Yw53?*AK24i}Kd`
zRkeTZZtU)i(^|2=T2;i|yW(zI=r%L-!lw3KLiTSadg-d)!+*GVZ#_de#~S7$vPfTw
z5_z3hfDJEbM%rwBslMB8jWGHO%2|GGrXhzMwr6$P@$E)VI`CeY7&y?w{2eqM_<NP*
zGc?z^2cjz&=9Si=Poa$K`uvD|PSeA_g~p7FE&)Vc_~d2SlgG2m^yqIdQUm5I<a0My
z*M<wQ*doYS>TVE|S@B7N`_%iQYfX(!{_}1-f>y?O0c;W<w=0Z8Q6d?;*yWIMz%K-2
zQ80RvGEI$|uEUgBtmh<DCcikTB%t?ufpEO0s8;tW@2daDTGH7hLD+<Wc17BLE4&}M
zod3^a1Hc2k^#Goa5?B6QEGdFo%MX~ibysxUw=xsJ)~w-ctcuF|MH&#x0IG<GNZUg+
zyD>p>1a+&HYNyx=NrDlE0T_?xp%=)TcLINEu)o$0U;NMZxlJsaPZHAimky0SK3X;8
zrwSnDF6f!jO1vr%+ll3G(kSynIfR_qmKko!4D53=D->{RLSlJ3T@WGhOtfDcUc!`8
z7&M|?WnPUOrWyZ!2lO*gC&*}sdlVILiyFnQg?Qo2<FK<`A1XU$TsbccX9Gp9!&#&I
zfPD3elh$Ul2HW7Vo^FfiW^%Q9D!P%WZfLubgc2onm`v`q?l04f$M~@k@SRCGMQ10w
zx|-wZ{4&yG3Aa%T!Ys7n7WVM+yX!uXjpi1Ek*B072-Lf4?~&yCX>Hs@oLgCUke2YF
zxHu{h=s6dlXlQfVvN+)6XrPE)hFLwEimdCs0qUoGgE!jEEa_KPHD8ch!ps;$0A71}
z)g3O2xhFySx@yx@472Pfe&l$b!&cA~+NyS7ZPGdKIdcu`&J<`Mal_5VH3IXOsRHoW
zRxdt3^oN8%eyd2{j;Q+!rF^hHp>Nnn?ECd@Nt-W%(wDImzzZU61OaxpsJkJ&y*5ui
zt7g8yZi&w8eKL-dhMyobzAcZQBV2m`-6)5Pvjvj@`HOcqm(JDe3I9(~@MyDPM6KX1
zA*;-<^x6O1-T$|uShqGBI;UUBnmxK*(V+d%aVax+U%KE4a4`s)J{h)QgK4%=hOQUK
znN;odIAeMLy&mZp`F)3j+Hs+KefXuUP;2zpXVBoY;_+P8L#z$_I*J(jtPnSxj@wB%
zKtc##BMhp3=6jcWIvXE4McmmQ-`!?y;FdS!b{5BX7H@{Mx%Jtdkk=eEH==1-iN5VP
zj8t4S5jTKhWR|nVDVU%%eq|l!f;?`KiCbiiF5@=d1NJAp%$XMBeMHM@un9G}rJ(K*
zuuol^Su@G<JAAtjjvQO1p?Hir>j2b>F3O)*P1>sNfZjn3R_%<AZ;wX6MR>TOa3*wT
zCd$t=*y);nu%YtR+=u|5;J&nEOO?e1zhh>OGx0oU2$I)j#?r_^)}&vr{AL1QcxG%K
zsg;=l>K#>TUD}(#kY^_l({IX2jc*bc1^*Rb$IVJppXSrT+Of5Q2)Hl;K6t`sxVZp!
z1(cFTT>YYPL1*>9S^;!pm;4D$Db~}^VHP$*#+S+G0fd?u2fZ-(W;T42CHJzbi6+0p
zk_V@e^q@mKgisNo<5P}Da5qk8Jgg(;vR7Y$8@ODB5FT2=i;zHqcGw`Cqt(XEBm8r)
zy3RKH4dO<f>&%Eb_YGnra!x~Z7L*(bBC&>K<!)-c?{aHsBgAGQPx?&6EyTOdo1b?9
z*5TdCR?KndAJD9Bxh1^mHZNf{J}(UEiBJvTy#hcTs}aG9e`v`a>4)%2w$GS=?{BS&
z`sdFCiNfo-LU)2s3B<7ZDfV#v;OGrR9D1R5_FO8mN<mR&td&o?Qrj*pYOd!zflWV=
zqfA*)oU4CGQ~65N;<{6KFJG`r``d-olJGZ|N5D2I3oW06R;3Z>Mn9jOG^!}g#Tz?)
znN<Cw)WocjT<I}4Ds0c4&=B`+8p5nwI08D@aHs?P^?8ZROWBbdwJmo@dRp_q^_dRm
zB?0}*Xmdz}*Z+z){?9q_e}}pMb0Sn7f%=vj&OSc8bQ!*KnP6!IP~Vv=+?i{Utjkue
zcBryrW~W63C3zTYMuNuM6>GevD?cqKZF>nKLynC1m9>`M7@s4vpC17e`Q`s?(n(@E
zfFyiRs`5k+|5+ZEy3D!{``{zCYBc_ULmAY6@3aYBvjP3u6SJKj*z4)Ml9%EbNsvg^
zRw7J1%Uv*OFD%dgs=Wa`C)Z&6_f8a57^Sr3kWueieqvdXtfE*mGP+dZscLZM9>@(b
z?%vT^>}fhS&AxAgEcc9^a^2~(3EkZY4dsD$`Jla3BW$rHWv6}~xm+V`d3tYW8onLd
zb?UfqCdo58B<fX!iBIU(i2T^*K&3-(Q@~K7>>PNl-BZSAF94bd9K{W9PAM$+32Y}3
z#QBQ8{tfmMiXPcy;jz5kbQzE;Z0^{nRK}=0b!Ab(2ji`61a<n=y^az$qwFUZ|NH-h
z!Ee;qUiialbpW_ugPP6tmh-I`8FU6x`7?JaEUWYnS22aP@*CJEs#r>m;UMgVb6SV}
zcc~3){{bM54OE3r9FDWq>lzx~CkyZ_sGd%ZAW+2|eeW*_Tzm7=y-i#AW41_(l4`16
z;8z^=e=+vvQAzLN+IQtPcH7j-k_?r~%G^$=g)>xcB{OqZyVM*oXA{GDWT;F{(JU>|
zP)RMVEazFo8FQY>SrG>WH3LCKM19%kJm);?Iq$pP^{mBTEdJy7yTAAMx~}_kS3awN
zrWSqRq{9X-Ve$)G<;4-RKkeGA-d21DSZh=Rsx*o49TsWFOaGsRZn;f$GPjF!&U)qR
zCFl9u9fnqu_zVZijh>bRnl^emz!-Md!c@}yySJN7PwwNYb-iYFS-tu3y0+e7rPw63
z?cYh34*ZhNI%;YEzXZW~!N0F|tNTyFSV1z6GVv2#Rw37wc%kd-%CRx4aHYxlp{?B4
z*7BKdQ_#5JNkF#=8>8$mtqcB-N|>~<&ClgEpNsgP1^R#8$NqQ47JbngI_>V)K;4&N
z`CH7HM<KQ23ZXJx|8^F;Bol?&bf?C`*2`gTRkDu55>LGqWpI<h_6om5m6rw!ZMSeN
zQNu>KMAyfbG>m7@`tkC7au&+m9AN784t!2teL}tF_JF2?lnh^dO(&BRAG!1>bWK3P
z=km+VuhSqh{DQ!HyKv3Q$IHW%fAM(Ik3`RpCg`<P4q0>z+sTIc+!%T6m8EYuXl|S_
zq8@c8Gn0*cJ;i`j+Dh5kOykA|GlQK16mXF2Ct!8#ST1>SZ0JA+UPCHzq>Eb#S@foO
zj}dF2J_Yvmg+XGvj>6OR_3g!%e|7)O{VBy<g=Kayg=_JVa6u$Vcy}C#;{Y`Qytsbh
zvF-aYgWowP7m}f@<P^yZ+Hs!-*`p$JvauWIDrfb>s>Ew`1kPwN->*2w2w~&thHmFc
zt|ok-l8ldF{Pi)HRq9c>1i0Xa?V`Z;&#8$#a;sUoV^HXYu2aQw5~HstLh-gSa7Xr2
zpc<-3i!^f}Gv2gM3+z4l;z}LTax-31YELM!Hz1RnKHm-M*couABxvm35QqI7g!<?=
z%t_w*7qcOaU8=+`HIRLJRCmtpbZ6P`f^?`~BjpggYY3e0+7D|@t=X?3nIQR8UqrFW
zC~;(Ho!%-fd_vMbK}p|9pAUTxubQtFepa_-u6Y%OCH`iD%ZydiX15}YCx`tT=&uLF
zC3maXPeX1$Rc*Ay8V!|64Pz!npGMK~Ijl$)?ZALlt&e#VJS4b##{$RBT8}>~T=KT{
zb)bG<a@?qyw>8_1SmB}5r<h5#48Q87JBdhf!=8ISrS-2pXl;2$j#BesW|(O)a8<k#
zbk$6o?NE%FqP$D&tov*6C188qQp)!F=4Cmn^;*~_=sxbO-j)HZq3*THR_>$Co!cFv
zf;{%+hBRS|rRvCuo8Ro;ZX#kQtnxDZpLUl;=j$eZ@yoHOAp2u<+@f)J7zv*kgM$+m
z{n?#hXCq>sW%<?%X4p4+0E!VY+UZ!qI}qxkKf!GGrH_;IC3jN(hlKHeyfXh){q0p0
ztDL1rY;2P6e=K{x0GxtcQ2SHF__IPlfYV=qnmInF$|g=b`tWTVL_Tosbzl3joFB43
zTkc4~Yqj+q2Y(%kL1h2?`kXv%velC45vYD~EHKd473D`U?PIn-%DDzYx1ZKNA+UQX
zvh&og<q6+;>?kdj!nR5Yy3cIRtflNnJ<O6wW3Q@fweK&Kl=iKu*!)d)TjhscAE%S#
zPry=q=}oH}s*4cH)OtmwI_koy@eerW$;Mde<GcFrPko9RZekDknt({$w!1N)CE4VD
zeY9)o#Tq_b84$pc91RT4>ffFA4(o3(PyTsYr~b2r=Lc60+CEV*=IgWI-09>EB*`tj
zi3rWuMszjYs;FN6Dk-JTZvM9+(j;Doq$C-xHG&l~QCKdKAod6P<h^oCBM{w~-J>z~
zX~C-_v^v*nF!qL5MXRBLd+pBt!rlHs@WhBs9`%nCZh>e#^_XU0henP3hs0o&?Kg=}
z`@4Uno4~Eh=G$AA-d}XP`{G;}a!w*>`(PnoDg>OCT(6D2J?|wAYUHXSJV+%F+=2BM
zA!L_EziVxcCjcg8)n_jDt3Pf|oa^W|(ZsMU2qpoL_PU_GKi`V@+j$10qe{Z7)@zqA
z<e68BTMXU}M=VP*Dg?7v8FmaP^<2+W&;+FT_9rB)yz(5-*=8ockRs`oG1af^oamvE
zi>=h&TLsQfm#4`zTUu+gbY<>qvsAMp^QMfBIn-DR244@#h=jZ_gs9`C2nT4VVs*)M
zNed(W%co)!M3>K9`@oyQMoD&RMfu&G&MBJLH%%ue;-rs*<`Y=#c~`2-dOl>$`N8T?
zaLPZhcM0Is&;oV4A0N=!2cvsFeEG%t=tzrJhA+hpBTbaD7F1Ob@0<4-3E2ckDSt;y
z=(P^Bl7)jiR>1~I$>h-X)_X3pzdZY`CI|K=Xo;3K+ALCEi#2<?4@AS!?2uP&u<6zg
zjj-flsN1Uh{SA2ViNxF5tixZ8z|9NbpH9xlkTa?luEp&b+5_d7huDP>tOw^V0J%8K
zPOiT&!r6-xTvW*G5{~k3EeyIg1f4a!PyW;Uj>nQb(W(FE->9r7GE?U3U&7AdB-^aw
zbcy_6YCPp5YMLrx=~lxPH`>V}jfltONYxuv^UXQcl=Ua1rQjgIIAUvTSYx)?Xwm0Q
zJF$kILgs%2<lHgH3E`OhT%Bge{iF`^EZ@Q{6djp#j%t`^V|nd4?COB3{`A~zjuqp0
znm;EhlA`rnw6yJXl6Kvnv(m~2C4JS`J+HGJ*xNyiqKi`A{N=A6XJ;MJF*26=dZTmw
z{b!#POZ2+Ff!EIee^!D27NP#LENBn_P~YKoe{<-S7vd27Ls`0T-^i6?#J_*|l#E|1
zs@gxCpI5ifQSM+SBJBQe|5Tm_wB^<%94h=$ap0j}pINTtANUa0HN1;Zoo&v)&bNI}
z@UFZTA0uwzTZkeweB+6>L7a)KJf1qmWOhJfe5c1oO3gbRQS>6OBp;R*@JhRBucGhz
zv|F+y3f~!+kfNApE_|wq9bFk73tdvGSxl5gj83D9`?_21NqiGTk@`w|3oYmiZRP=Q
z{V5+*!2@r40tXT3na2r|T{|^TdSoNGl8VeyYw-8Ho%Jke_V9hhh$iL4I!Fv&i7&W%
zkOA^{n2R-}^b-OXl3knNG;!QH?AfhS=u&A4^wc2ZlH#Z=^gacu@&Q!Kq~^`M++kVt
z&RCGSm7&wtRYEnoDV)qtMw}`By30uo|8v$OCkfns2InJP{{@rt=-@Z{VAR1il}Mq$
zS8_P`Z3~!l)f%RP7vGsxEj|}L=gWUqKLWQ#lf~QQTd}iZJNH8bt9S_<26f}}(iY@?
zsYMTt@jE%L-6?SIAfh9|3d7u&le`m|Q_m|8d)*V5r)<c#yBhHJFZjjzKo=PVT{RX&
zx!A^*%qYDTvAw5or}tc_uz5e`!NGT$>)&pApyTe&9@f~3S6R2T_usNO9v&SN-L;%n
zk@bq%sE9dVd`xraef{R84B2PR((F0zVdJ%W3!)8hw>?o~^M_T(a5(n>hF8n?eU$|k
z1sVq*oYR8C%f?!g(`l^t=?Sh$gQ>4JQZ)1!a7?F_FdBe}1*m{Hr=+FA4H`apV2)Fa
z?B2A0*JO^wRYHS~jrV`EA~KoU>nzjWd?{(Sw}6&~e{YNP4MU{eO_C;7DOrjk7AS1q
z5ICl-AZM+~BAjuiww=$#C8aX7<^Ivp=T;Ogk$@jnzb+&ojf`~q%_q_TEl(paQ;&*7
zlXM)jO!dj&6G?$dJyGIyf)=Dd4K@8H+X59RxV8OJ|Bt%hU?$29-I8iz*@5mb!_Hc)
zZr-!wI{QUu)_>oW`MT4L?>S;Xc;?}fipD-uonpS!qz}H4{`OsSQ3D#|eekoz{F}|&
z6HG(C;DwdL*ofQI9#WY^sSdi20A^a~a+AUXswlH?zx*zgM#-pJ|C<bSyL)H=HsfLO
zlij`s4^=E<k9OnS@+`vduN1$NHyc=|;bPSN7itD03wZ>aCMDRbJBHPP{Xk)?<LBMJ
zzFXv1IR%#S@9*?}XS<VI0Tld1JHdXPEr#eX4GX(9^E`3+d7=Fg{MnM0PocSnlOv2h
zVSXnH$bPB|Fg<i+W?}fc-Qd8asUq&>D@WdM%Jo$P(#WXhU?8mF7<?uQRjPs;)UpW_
z+{>03<;U4_RmM44mDQT}`RH57!Hk39A%%2!(Gk&>J?GyvAsnln866RvZ)DQu0~pk5
z?%(pYzWIal{ocb)fz4oPeUJ##-3<?%R_5QXVsj-C({=}o2#Rxas)0u)zx9d6x`EZ`
z+07yQKd72BgHbRLD_Iz}yI%*z`4kpNWt<M&`d`}ke|0PWU8ew_0BBv+wYq#k3QDmm
zUGcnZr5-umk>={aQmi^H>StWNi~DF-9WZ>nlZ4N|k_o}|20jGF7K8cD&SZ&O;qo}D
z^{c9#Pv46-*wF+-fPbOa(om6Hg0U?tJt+{y>m$NSyL8dbx@xG>qCW2jy_%2fyju2=
z5Tlc#@I69yGjr{WhkAWg=}W>*Y-~tk#Dq&0ZY>{CCqGiu;7K2}v!Kk|QQT~WrEJd!
zgU@DtPB`A8ol+#<_bngc-$kt51tem5IRxFtzDA<Kqo8~{b%``tt8Kwh;~`wa6IldL
z)_HW{5+AFdKnN~0^T-$f8=v}1r0t~C&yRRyVXPY#C5SRR*|Q>PW1(dFp~(drR1|Tv
zgIwoH)YjE4m}-Xi?`!Uz^X}&bKo<g}_>Q!`AI_><Ld)lfOO$zaRJGre$^#JuD7=yX
z7J<y3;JgU2-;s?g)UdDeopt^t>dPyqs+_EpiDLh%GtxqzqlTNk*$_L?Y=xmFPV)nb
z<-+arW~?cr@omfVE`^utMZYT@`71LDb<qkvBLfTzWZ){oXA@0loG+8O3l1y(gn7+A
zHHO{misI~FG(J^Vk-YsAh2YOy)GR2Kv@8=aqRCh2khEvrtyvNOZGLs=cl<be^Y@?T
z2Qu*(XZ)j?)qj-&LcNc3Eh470y53|q*=}M+7C_soqt(i*Mf}KjEN6BXx(-MuRNgus
z!7Fy^h0HcnOZ+rGDAldSraKfk#1<^MqS-!1Lq9iNBx!j!l~s(DEh)_i5<Vm#y8cU%
z*NzAsj@lgm13EW|+Nwa=QR6oo^<-)TsarM8^?wZPiV|jgu6N;7n_buQkm7lD@YGW}
zDs);-lpk+aNYV3SS{>}@{v;jRAeJI|=ECetT9?Yy$5T`76<H4+4c6oMF}Nz^XTAk!
z)`m2aei%^Cv#2j4KZt*^=_zn0Y2Wwr9Uq?xe&q!X=<A>t_imAU?Wn0*9fZQLZts+^
zew)*Y8jv)~QZ2=M^kTLlh&>B{HVqrO$EW5A#nWC>(4Lt%elwUNRL_z;CyY>y3Zs$5
z!5Ww~!VbgG+V8WE^$~(#u*zRf+9x*+xP9rZKIu^?;oHeOxT030pf&pTEm8KeX;5=*
zaxfl4OmqUuEV-68pY0)=_Sl>Q-=N`jaBXzSOSiEP7L*h@&*y)QP7pS44FFrqw>&7r
zFYY1mS1>Hg%M3Uq6~%NiNlff+-|=tSF4!XKch*_KXln%_4%Fi`b|IAaW!mzJXc;sT
zNP643`45S$lF|Rl1$)&)N81?aa&t2aHu9|^2FlB__)^{WGOsWJx6VCW$L}K^p9qn^
zb|Gc+JE)ooNZd`Z*l_KY37vIQWXl$LOYatZLq`JTwI^r{suu0Is%tC=lC8Ci<LctL
z{+fGoh!jmq{4wq!<9J;{m8snXhf6sisefe38ceN>*k8L=9TB|~tf>uPg0a{4-(TlO
z>UV6vs#kzqAcWo&J@~Y09?ZZTZ8UdE+SWPW(gVU)twy&#g3fysuk5%}D5CkJO8&L<
zaPL2AjVnKcK!R)Wpx%`ro-X|P9sf!2M14QRY(k=IFWNRe4y4sl0WfA>u|StPIFtMe
zce`TIuV7`WTi&Leb3@E4DK<bc;bm*>Zq$k-`m5%*N!>=mw^_jKU16wM-gw<gP@yT#
zXL%U6bNx+W0xb!8)Fm_WUm4L)ZkKVbrq9xTNzCQe=|p2jP=E}$*aA`Gk=mKy6?6QX
zR!aPV?U{(D{8a+dnI_LbnN9-RXRS(F8k-f@i{=%XqaE8KW0Q;YF5mzwct@3Ix^-Up
zopw}^I$zN$Nn^theTXk%!I0euJA%pYWBmQnTzPU*2}ez3NfU$o^46kHPATxKW{&Zn
zBus+xc*96@o^YuU!qQ~4Xyej=YajTp``(t0e%s|;RvO}5QJpf%VM@#%i8szPoN(d2
zfjS%3d*$J^xRx}YWhc4EY{S>@a_%owX1M|RNe}t2N`&g~!rA{~0q~;`HVj<xk1A^h
zs+d0doqI6#xDIW}#DxUo1cKjjdv}(5HEO2Ssbq&AMouq$f1M&=GGm#&aQ=x6^qGRq
z0WRqmc(H(TM@|#Dk@0Q(${N^sQf8A@wID&cWZm~8fE2bjvs!*zb9YsfHWD+({j_j-
z{Vgh93mSs(Bk{Xw!tM_@tlCotfRyn?Z(J#Z(lN#OlbfY=x+h%YNUe|sb)je_f?zYu
z@%rs?Le;cxuM=hXL<lt-nwwX(K#ZVmP2mwIwgjVkr>tmP*jsfUMLlWhRFk20o2dcD
zlTOwX2fu4O^UqryN;G38I$1P~s}FXh&4M81LD)6l`a8bWVqrdk`+pvh(~N~Ds+;<L
z8;{m3mtCX+Y#*0i^Db>V{Z`yqB2e~%`h=|$ujr>{j@q@9hQ9mDWknu``=7pxvXcl0
zKGO4jLJ+?qk>#uQ_x<#;sz+CPn@CajBygbv2c+={vUa#__OCx1?(3DmLvec<um3_A
z+)pj@jfG3p%HFU`|Bz^U$DnBN^ha%bJPGaO_ZEvZg@;sN+CtE62>@C4ncj0%lA1vh
z#So?GUdecLxmAx@_~^$P(MeFx^k}Y0*jqCgWh61ctGKLM8N1JV%SDl!>L%878iFYs
z9KQM|NWEdK>?QxRL=RMSDj+3(Kn!26i8-{Fy}GJQ-b{h1tCc1eGCM+~jEgK3tZG*C
zO?``bGBA#eh5dIRWKhjM`E2yJ<Q572xmaWJ!&z&C{<VMQ^&^AM*9_5qtti?4)@M<e
zB4Lshl4?^1x2OmXkHz^3l0_~_CqpW1%v~`t$G-~M)S0T&qxOEV?P{&$>DgOokTN6`
zi5xp$qTevg-2BN&#0dwKok0lb8{|<gD^d6@QH>}bn3wnZ7oBuA%TV>F-zxJgJ)?lW
z-~!5l$RSr8FjeO9)V(RxtdXO-kPPG>aWJkdZB=qgczS<41|;E`pyTJ_SoYvgD*vc_
zLa2#{#=r)|lwHbtAohne#>KH|{9JTZv7BoT)#gGludrKT-7`<gp*&U>)4l&^_Z{Bu
zzqZf(^!=R?-L|$?tL4(YEmAHiJ;;lSECBpQtb$8_bhYFSJ#<Gf$CK-EPEb7R{;@d-
zlDyQ6_Q=#}BLa|8=DgE|VPnxRyCJj1!O&cyg<SUyKH<+~x1B-VZW#J{$acle){LE^
zD|x^8@C*&-26v}`&y=FQF&c)$Mv0%B6U}zt(vTO%eP`hTby(*@><lr__@`Ir2rB0o
z$}ii2)^|&zx^gTq4^;PIZuGAp@KAk6cPyktv^=Vh`o%`$9Df4cq6y))syZ0HY}Vuj
z7KU-~2r_@aWVNe3M(?J`LEh5X(1!+T4uePAQaqsCw9fsEY_=TqTN3|?2KAVnv)x1$
zutu3JG0C4|z|sXa<SKC3&8*7QTtkGHSaWA8d-)_whO8j(`>xqc*GN#sAFFB{q#t%6
zAy`-8&`1yHFoHisVyFq4bPGqOFKy(LAoR$>&9>ZfJr5w_d+%DzW_S8sa@IUB=A6B=
z+qoU;hRAGflls?B(5RVVt=cywdh)iTnisS;N*G6j2cI~slpiswsgi!HIz8<sbtJ|Z
z9NKdMrwcE&s*R{L`CW)7KxbV7p7?#$RJeILF$Kep7n^M+KQ~+MYd5Pl(dV~GBv{mk
zr#RIw=+!LhYMqSL2}qw1x?^2CDWCM7_FB#S2-QJM2dq6nuXdK*!MzLkMwKs!A4&}>
zYRppJ&|NP!cNU|CR&bUXecC&otrxe93R8*p%M8`Pz!|$8Ue{?BO1mX>OB}n%pZ3a}
zk>=b)p!srOA^oj)yvk0O2YSW#l|ECyH>{_zJO-d>@O!o<>+IB=pkd@9jR|ylQ6Tsm
zSLAK|IpYSz;I}2k#KeV*tJBLwzT=-BVp9xpm;SwBvsu_CJ0f;%7)O2GqDze|W;*`4
zfUur@?f{f(ORZ@(S;?C-XV{`y^vmz{KNLSB__-Xc0=)VcWT^iuZ|3=qb8B5DrM3Sw
zGg^Av3<$);t7@6Si_h%v%144cukUWIJnsoe-8zjaPi})D`!~?d&=|+Yv&DZ|aq%V9
zZRnFyBhD}AVnG2_zdrJg;4&T9RJ<d<?}z*d{cP_Zc57*~@$v=O@jJB53|e*9Jo0?n
zR_ly}NcuLlc0ttQNeK@qT%#rE<>8r*P$%6C9?TX!zu9dhhA>Rsc_6m^-FSG>uD6xh
zKR~1@u6=~7b3do<4SDq;0VU5cBh-)Ho^T%)-D30-02O>uC<-!RG5>_9Erq&1O6VYY
z&}%p8YL14mx81u73!Mpr|D(=Fwu@P>2Fz?(j}%-;6b1YF?u|Xpc~O6Xgt9W~ioJ-$
z&*P6D(!XE*V*0m)uPj_0ZP!=&^2Kma3@WOqc%dQE)DZtuR#|=M{#?-WhO3$4-b7s|
z*;>{f_s0J0THR)w-^>4gK6NF9B=|(S?`m_cjOmp;^z;G#RrTo1M+y5{Q}2r6W=#W@
zD`&_Z5+=*xlonZ?vqSE&$5eSeI6TC7CMm*5L)--7LBw}JnP;-Lo02$?xX{Vux#q|t
zou25o@1>bHrPpmQ&P#;fpLnB|YR8|~k@z5Z<Kwy6m-`8O3YdtIu@8;|ps>Y<A3hjn
z5L!{hFIX?tg6SHjmsT25%R_4<OMLsBlrVdI-zCwez?q^1cR#vyx3H-V?V=MQh~B|o
z^4@D(a`>b>Q<;+>xu?El0kr+oIt^mRd{|6U<SnR*4(9^BUR_yst0abr3^1FpnP%7#
zMJR2KQ;cZrXq0n{+>lpj(baEGuF!vvYOlP~5aRFS{C)qki6%<-%^LQT$g4haEFjR(
z=k4)QWUAMqL8pv|bsDa@H`5_hxp796X>WX}JdDng77pB}y-gM_4%r!w#7vFo2K$_3
z6C)4JeEY$um9!!x9C!J`>1u<JTe5BFcVgbMpP^))S|ykUM5l^y+a~tU4Yhd*TIX5t
z0Kj(hVVdC8i@+Z=YAoW}lB(a69`s2_d;ph_`s?pzKT3zksy;mXa0KsYFWSZaIGA@q
zN>rnf!lL9Z)}2*WhoZTLRNweXXM)xr(JyZ7^lRwe+umnCD&J)W%Eg*Ky4jaFQ~NA4
z-s{&bKe%Qn!{?&wK&#Pt$1bJCBZ|H(&*kRI_HT~@lAuTI&<z?!d^3{Vh9CpgGWT7*
zF0sP{*JpY|E<bPsBE=2$`<!5pozeCC!|DieMqJu}|E7+wt=rquBj`+@$bFyS5nQ8O
zivoceKID<0N&5E0_P#pG5gBZjrdipN2_PjtjR6AqPDCQ@;~vz=Mb1?XuO{nSiX;L{
zn&Gtv&3&N1jbzRQj1^g>Az0Uy10b*ykr2&<v!G%rm*<Eof!%VcTt?Lo8v42>ml4%m
z4Cvi%Y;=NZVdFs?chF34sdH_qtMR`9VHJ3}3PX0|Bg|tn((|(=2{7)<>Q;A+-M5`|
z!{2AaENF2O+@AO>47&N(@}V|fSsF56BH*3K*;2BBrET%sPwm@)tq=6?6$@l&_wJ=W
z)@o{V{^v`a^g0WtT}~vfslq}fqHTt9Nk#-VaA%HFS5iEG8D9;=g{LXSdzWlB*qm##
zyD<^j-`;u&hrhF73fR-7vQnCGDSW22p4mdKw%@JvD?r76VlagV>swIH=^6}l74`6B
z`w$@kF$;&`KTv(qqKVSN9i5@>H#~;Kg$<RG7FWPto|qA|e>ZSOHPBfO9LRwB{rYM=
zE!dl3q9cH#4KGgX+raPvet&9oA4V>~4YC)kvGfQ?ge(xou-jgw<UP`0rhThA{L8h^
zl(=b*>>IU#+-$kSVN87l_k~wn#I{(t#NZm^L%1KYGPoI{<4o~;BzgcoQLR}W!fq~)
zi3t<#xomWa_E#mUM>n*%-^L}<<2xguMox+Pc0oo^^A^Sb2ggyV2bu8vQPbW={UEW-
zylz!wiwTXLx1)QrkNqjE(ddRUw_*q2kz-MBz*M62_en}~AlnTg%VL9V)YPhzoqH`X
zmMA|rjbn!B2R9)@qdgld%`^YVFAY*^SuW%<{q)m}(fPj9X=oR<l2?i3TYn%pn!#&1
zTMCn#mcr}4o40Q;0b1@~j@P5<kK;o-;m(8=WR%CFVYAGze&KtowJ6Tah1WX)xCNz}
zI8E(@y-<Igw!0BAs~@+l3tNO^eG8u|!xtzjJ?%PX{MXydZk3c79cU0KHzzC|H-YNr
z2JY3J>e?&l3LOU8js0il^ZzX7|HIn$y%Rbe2Xk_19B_NpL&XxmN|o3M%T9W8`c8kc
zFS+JX-0N1{6P?((FT?a&Ou+r;fKuPFeFdUA|JLXAyV64kdYy|*??^n6y{>-lzHgcS
zL;4T1v?xE2tZ%uk%|EEaMNtm=Ho!XdFI%RW3Eo6y+2rlG-lv7)&iFJbi+AOFkf(l7
zQ%&87&mo@t7R}S`!A0LrpWEt7zf?SY^?XG8Oh92)<(`Ck>#|Y@Fk9SKa9N4~m5S{f
z&1PR3wlC#*VV^Fc_KeJygj(RX(`f7c3Y5;KT5(tW052!TQlBW<E7~kVh<b!x`vkcd
zSoso3r)85%#Ap89yx4hF!%%oV4I>+;o?aTIR_vnF?bbgEvQR_gtqXBL)j5umzRu|H
zMX4GEKH97ZOuMdZviiMbx4o0jrQ(Z%<dq{f*t@b3JN{kgv?+^_4Q9JW;HYtsEnzdN
zM>w>fq<54ccwKlV$Zur-vEyjsnIt{>9n1s23@e`GZY1}sIMyxrCBescad<U~B?)$d
ze^~y4nd#9s0x6Cbzo-t3O|*xNeJg!Z^av;>=!t%fKrd;|4(%1iRRkyPvM=FMJ&=pz
zp`}?51`|-o>~Y`n{=el})-G{V==IVVoUIdjl_2?h{l`Z#1E53kDgh)*wSc!(gPP8N
zNKyoc5PsR+xi3SHMDiX0j4psmsY#pEbmrf0mzwBiFh$5;@sbtSN2~u?=RZbCz2p{$
z{Xndzd5m;H!p9GlR5$BFAavzU@_<nbEpQm6F`FM&ecZz8C-qCS-<1E;9>#0Q8?$54
zNgPj&vg*9V?6V+>s<Hc*D0uF=)ShXV9DMIY#6W<8vS;7e9$A;9gnu?nF!_j9NpSz0
z%$ZwXvYSI_uV1*n1$5E)Ad>TUqqDJA0mn01{t)tpG}bq-2~%OyMA$SZ`KYBqob|@B
zAP}3`MPEsr3Vwh+oV=z<7JeyYp2o_*4HXQMDEwp68-EdBKs0>@(tx8TFd<W<;mBWp
zu~if{ftd(p0JP~LiKhuWTjy%7Lv~sTEy@t@gvQLhU8K1=W&QiJgHOanyO$do6;Osu
z@AaLe_hHcm?EW-d!ZDZc`@b%n#GGfe91!iyFh$CFvs(_14l6v0GdMIi6-V;WcIh$h
zbXO+T4zo#Hu7PWv&ddYgxvDN0dM493a-`95<DizSFiq2^;jOpPZ1JFdPT`2>O>M>a
z2U-ngy;lA)UlX)?A2V)*pTM!>;h-7xLtzmupkZPz$_i@S{fc1?iBsX6y4h{L5-?){
zJC?`heOgd~9*q#PZ11W)Kfo;&`;-|qa_U@yhyUiW1n4<144Pe7P1e`Z^$sy#1AuFQ
z#}UTO$91NuReG+q#jz>rnA`qMrfrXaFo%fHswPaw$PkL*i)nNOoNLLmaf_s6%OKLc
z<x?s+sQ9<iEgx-U@&x_H2MVhD_*yTFbeBB*RC^Rg#PX~H%63*KOf@#0+l{Wkid**Y
zEZAL`?K18azLVzU;GuoPE3wXh!2C{z&<=I3{F<uxKx<7b@l$%S2Hp|eBg+w`elT@_
zw##=kIJ(DSX`}+E(ZuJ;i3==x`X$aA8z&`LQKJoVf~oB5(i6amYOZdbXeJ!lWm(0P
zcgavw!z}9u5eHKP>;-?JiESf2K*mFETo^Ur@s5@TF9EyZU^#IDEL_a|0zTt1`Q)hI
z)kK!z+L0=(lgzfl!&874)ooQ5&AJaC2}2$+Tz0CgZnN>PYI|~6zyzY@7yrqPv6%%`
zB#D3$@9JB^xXJn^q__jnL&NO;SQRw6I<bKIn_(k4tux?wxIrqu-%Ix%FPVP{SJm~(
z*@l!FFsgKK63$Gay&lzs80V}OZ_-M0^>e}^<psqi=vpJ4(1^2kJS8w4mCn+E#EL`D
zz-cE?Xm|)VD<870q|p)^>XfrkHA)KYu7Qq=i_t{l&Hv7;|Br;-fBPDEPQ$T?hI2V;
zuSF6~pLg-ss8ZS820J6~Q?|x7_#~!UlbvVfWltqvjTKupQ&fM?>969xAW04U;@s$n
zm)1a2zG<*Ts_R*Rv>U!CFgbT>G4Pb3!l<&XTE!k8&XKOdPwJ=b*kvDY$m(Hb)yIG1
zh~i7K#p*_56YCOx;Xgnaqrr|UL}sIuHAYO<h-Bki?z^-vprMJHVQPcVksVNfH+Jpe
zV9UOINpU_fnXfX*G}m1VR2v5Rs-r85yy>IoY7<U@e&^8<m~5DuU{FVa8>wfz5fbi-
zKmNq3V5AA$m76Z^g`b?3?P|>z4-JBvz}@{hWz3%qk(LIK=V0P1XX?4cszzL{IgDQ0
zL476}UeVwDwBBMgyEe*qw&`4QRB&uzyw-N1Lb@jFIq<k$yg3mAN#%>qV*AYZ9+U=e
z(owAb3BLw7WLBQ%tUOZi>;-nF@d*S}BD|xPRqb1KfISU>g^o^_@=;2Ixle6$W&3A!
zwpz};qo9;bNlPZg)4U@}RJ@Hg)#utOjFu%M2D#4zWFQ&*HL{<ZlF7t)e5L*s>i~el
z*y|56a)P@gCO9CD^5;F)3#$8TNog)g>*P(=bwvl3c%{u`C90{ntzUo6_a~k4CF~}#
z%DFJX7Jx+Z`Uo0JSUdq6i?~oNL52{G7+6rOU^sQq3VC!EQin_(Z8$RSTyqq*X&_E4
zi3=!V#5=ppw5q1==njo^>Ox-6qaTU<y9pfAt2D`K<S{g2Hq1VgjP3x=jM@}GIB({Y
z8VevqBy}4W-$N=VVmRix5Nr0T=Qp@+o05DHV@<f<THB0IHF7Qp)`Z_l*Db^=1SDxi
z0_s77$T>q_;w%2>Nad;XJA6f{jDga0^nCK|;DRlfU0G@G8wXAc?bxHBpEC`hgUJ2(
z?!fO<sSPJcX`|6{QG7%~i`mA5+2L_L(M&yf(ZZisseiBlTUq^3WKKQM*rSW<Dz3i(
zYXwA%qI$Fw1E(MFZko`ZU(y@vvVsJFbe;S3K8Td#b*?z5D`ADjX0@BK1z^k7JEQW<
z%S8*?!REfx*=H*$?+_RX>2yjf%Ag~`p_plV6kME_*yY9twNX!`R+|~s_P%=)cX)nI
zbuj;#)d7VQ7dH0xI!Q^UEwz+-?C1P^`KJ0cn0`}{V_@0i5qJddoV+{Qs+=jl?T{8}
zKF1LQ$5~-KGar;jNSvU=0x`xq?^UtPvj!gdHQHdhLl0OZXyb3}$w9YA?-C(cUD9(n
zd!?GXFWiTBG)B~Fp4nu$#uUoGJB(VX7QQNAp7meU-5#KsbDEdMir*<}h+sTY^x9s$
zN{o@bSvHvB+5oRaJq1h3p}WjxsiDlxqqq%Nz?X%iHEi(K`@oplYO2oXDu`77WBoH-
zd99$`<2q=M^oZow9yWTy#>C9}&6%2Jk8|AP#;bUHhXLB{o!c53tK07-fH(aArk=6@
z%*UzwmiaQf9B1#Ohu_nMmGrtP29LC-cj8t<XO)6RS|_|UK9v4?f^L2kV7+mkzf2|m
zRB)X^xK!znkO8?cescGW4XmSk5-FyeI}%C29)n96&g<xfhH5koB1+^Uc)4xmF})|G
zR+C%7%)U9zd8)#=g8(q`Mqb}|U>NOrV=)Af+68ugx||1H`-BI#q}imY>{2TsWIW!<
zj`Cllb^kw!lxb&UU#zmG#=T@2rg~~n)I%+G8+=Il8}G^yk0;&xvJ+0={imHY%qM3u
zO<jrkvRt)g{rCQK-{y(^`I4?gZOCgiURIjH89;9b>(&d#N7q+VSJg9RFRG`G+q~1v
zl(jx<q*hbm_o#pD>6vW@SvU2^Gj6xE(pcfIg_!Bkpbr)m_b+?}i-_}TNdv=AJ@Jiq
zl!*<H-}uB8<jWc0%0BX6U{{-lygXOB@RW4ew^jFO*=On}4Xd24WISSzwlf?KSXF#S
z`A)k7X*TSkUMB&fUPM2TPw{1&omS245Ec~d`aqKI)`s@&F7~V6=wUy2G9fCL=xvu9
zdhu7RCAbh#NSP7S8pfC1Z1(_>2AW4$*7Lq2U09Gc<Rm+~S4ykU;cEW!*u3{ocw>3S
zYvyS)1@>x6wgdTGB9AW3-6K$GqdphAAQ)z3NG3q$7IiAR#BsA%cgM@7#frt@u(x8_
zN^m=n5_&=}ra1(1uH~8Kf%+2+>l(e(fhQ7d>RFJ%g?%>*u*GuMm3JEK<jtM;$|D3-
z@jl_#0$<)-oqZbE0vIcp>+c*nWF>6LgQV~yDadr~LG{Btl-l=mgg%wo-h~8H%w7$}
z1TAQgucTuz6-Ps>->LKNRsugR1uI4*09QAuRC~da4CWV*Gd1<9yIaM3r|k##Y?|`~
zrq?FqV>>8`%xd1BSF8~|v~f>xo!P1SFDxXu(S57tAnpZVO=BG|P4UwkB9h6He`OeV
z)0y=Bgb2F>ptZs!(YVN#bb;Z-w~Nv95VTL~s(Ag37N%^7d;7=I5;9jJ73%95sh+ex
zRt8eiC|0A0mQbdQxMD9b65L$OyQZ_i{lu6q^)Y&6yMu3;cRmeB%@dwXL}Jb>_dbCI
z;5V<6`e}^veAgRA<Hq|H>;dmHg>xdLgy!DL!^<-SMtoRdqh@`F@y2L;wAKFcx0Q`e
z3;3V`4YN2IJ>x`rD?-XsuMBP-U{JT|AlLKVZ57alBTU3r=1*)lPMBA&R5OgZe}eKR
zO24K0kE&I~=LpXORjCtqV~B!94gb-vq&31q5gfYus*`qV#<n)%%TA<n-t2ds?VLtC
zbXAio%1G~V-}wFMG>I0O-M-nTC<%OhOO6GCrEI_k*_|+))SW<0>hN@oFcym2CAQ%6
zv!{mSr()W$28)S--HJhhQzr+B$?*=H>$&U5j521Tg|7oECZ_mW2u+v#s#jW)=cR2_
z&xzbpBDE;V2Uo+N>jp0((3s(;V&{&9I5|fdqo?0}TsWdN_cCtbqR>9nRavo=#?>6T
z@nf*G!qdBrX6M6f1*{@(yTf}e*I;@X?bL;u=B@p8tlz;#)&9kM+U(y+e(fwRw`meX
zXY`#YoHOS=mCk(O+4`IeJ!+k4N#eICYlJtp(zt&CCMT5o=^qkSjv(;r+&X@A&N8$K
z>wn$T!&vV)cJ%cQo6{r%b7`12tgQSHj?Y{0={1n@(C^B{ogoh#!?~Hu;ntiin%9f}
zZ)#Jzk?(fLsJ>S1ccfZsx3|XU?x=Fv!3H&oC_wVqi{8`p!Bm$myU9%0PZ5U${DcpO
z9_)?TFE1<#U3S`gf*6PW<f&z=;G?Z--3IEpk75UvT+`Q$=<9F0B;%O0K4+KyEH9xB
ziS+Xu$b^TD9jQNHHx3Q@E<Gw{1u`Bq9-oOAGQzBXh_M1vRBeB+2vhn{YKb9)7Ts!%
z&I#<1UTd8bfgxpyZ`5B_ev|JN9K%X%ba2jyIpCMZ8qO)yo-uN0W06l5K&M6L@09yH
z-ENzgl?|w@alK-FHyNr~Qo>OQ`i$I-rpO-jo?MOoZud9cDng`LL(al?yU{lY5rq6f
zh2XjSz}LT1J_ox@6+UNOuH@Ox0tiH<k<SSC>jlu_D+@kg$U|~al+W1kC+K$#x+a6C
zlp0Q04^7pao&)Se0T@YTjl*Dw3i94~QAwKTVAm-XKhJ_v+gx1V^8f(uoV2f?#g1sO
z4N|((%iCw@?VRJidJ=!5WOQicc1Yt{yW2yVz27||^j5vVa>CmYn4><zPGE}ycr01n
ziefa$3OP!;WaRi43qX02T)^vrHI~)#b62JAhCH24W)aq=3Qk71l-X#lyxDFgb|T)V
zD#z#W;<4(6p_pVu@SlEShb;M*7w0(=W)w-&4X=ww>Z@?X0AydkjMS)LW2_l52U6Zy
z{S!3G`g&lhV%k!2XR+mq?E1@7_359g+8s-LW{Axr?|SK;Au1Nri@f<59-uQ1DGd`W
z=NA~`G~%UU{0AKev7$dRZnix}-k0FI6J-Sp|2Ak#>w&E6pFjKS<W=$@7>dw;HV2gk
zB0kBlKvgpO`pq5uX}*6q5PO7{FZ^89lD(A1Q&Xnl$z4uAO7%ne5|IjEAwxeNifo04
z2?BwIb3dKJ)P6@*#9E@0m47w8(~iis6cm|U9Cbg44~w}l(OaTqI#3_3uZMZ>%ZyH3
zNEPwhCPGs?w;gbLq0@$sA^t7TEYdP>L;lQDI!@$xfI=^h0uV<~)WToqJ*Pi-m$7HQ
zs&On`hEAPCy;+r22)GEHbN#h;G;iySro;T4{+A~q;hd-i2$#~FLCvX1(ng0@J(QUp
z)MdAx)aR#>6rg^oi=UfKY}oVsh)jRqQN6cZ1;xPN`6YA;r996n$p5S`Ub+{`-DAb`
z?Q2MkR`6_~(=DMHsxf%V`)=cFFDhQwfBx0MN;A?XN^@@SS8WV3pEiz+5ku@2H#er3
zO9QNY)_|%0zG!Zxzt`ArxfDuMH-N<+6b;CAN;?=h%@-xu5J1UOQa|h@^U}R!G6$CP
z=X^H*udZ-w4c#-3yX{}vfhL?!q{|L6oQWl^mn2eTedg5z3%s&RpD(Pfg;aMsq#z8(
zJxiG$CSy-)qZ~kivf*~$<7H9v8iIRL9zG^P<dK(_(;Z6^QW&+VBoA)mjC<KMR-JWP
zW+Et4g*b2v>SHBK<fq>ZoYOgAl)<8DA{LrfMNC*~0b1Z&kr(oFure@P1UYS9Vyn+t
zu=$7TN}@KVMv70$bDr!+#Nymx=a=9jD$?DLk_XB3q*+2E_H6zmZgzr}&)N9`r_oPP
zKW~^%&plMo>iQqVE?(eyDkxZ(T|GR#wdM_Y$@>t6hJJ`NG1%EBa?fIa3g2b;Pzl=G
z<pkA`tZs^bQP3Z|dh!=%`X;6c#gMUYAqsEU$z3u?C699;lPQDuFrQHU*DcDSTsc9G
z>ka<*Q)zQ-Anm%KF}1_YXHmG46sNhf*6F+5cjZJ(%h>y}_NA|2$Rc|fIA+1RBbBL6
z|BWc<slaqHH}Cc&YPbO-$}Tys#@HirNhOwNtDKnMH=}6NG5EsY00=#yCpz0IGwe@=
zzF)}$wMHj+P8@5;yfJ!H4#{G-Z&IGdC^ayu&>xvUlx}&|r83N?d-r{~0p~1q>V&gm
z68_li)P81^1Te+KZc1?Sk-X!1w@9?(n70dPaw%~&^mSzIIg;%#LgNC6J*=phTD{_%
zT*2=*dr=eVCd?tx2cP)tWJd1P#dbWn=+?V;YQjxyKo9bQZ?MS<{luNK1P7j1G91|Z
z;<uhhemR<>D7EJwd>d+q8)oxeTdWj!o+*f14PRRETjRYaQV!GB4%>t;N(8*cGK;)7
z;MHN>w2J9G)Q4p^qK%seB-+FSND7|zulO32h?PuCTxZhz;QkHNEOme(b7l`Q^3#eb
zHKj87#uUH%sFmJ_STHhU)+8n^&s%#&NxFhjiZY&J&*sb1oczOCIn+-aR>SixS+w35
zJ@&!I{oWZyW7_mQ$+b12<A?jBK&Lj$m>z*G3k!|#&f2OH`^bQ}&>E%uuJt;XEclcR
z{@A`Md>UoAw(nO{X|r}{B=}9)E4pu|w<z^K9}#DASxSjdwD6;yY7ikyhEHTdnS8an
z)(;EDz2?-Yqo~<r1X_2-kUgN*W(S(OeWBXbak2WD8mgQ1^G}A8%lLRr{4t6yp!2K|
zzmmK<5NZ<P-@r_foYtTKWdu)uE_#F5XJs<ed(aKJUWA1QzT9~4RdZ$ix1ZWhpd74v
z+jCZ15|kAj0(}$zBP-bQA{eM=NY_h0D_S_!f@^C0?x0f;nd6Y>v}U=+W@~Q<GM&h4
zguJ>_gBy}DM=<aJX#y7p-OSvf7=}R)C-RSXPXFIY`HqVG$6}DB)&lO4Kv^iO#Idi`
ziFIjL_JMk8`A0cLThDUalV2xJd*G3>{QEDx4<D1hQ14&y*!#h7;c(r(@o`0DdPG8P
z>o5e;|5r>3xnTKbOrX7{S+uf<RokuYC|jj|wdn&<Wc$XAsqrG$tbbn?hxI-qbvETj
z-O%1Tdk)-(Pe9+a!nmE9aQ~2i#_#e(lk3t2Qb5V6%|*3vk6&|IouSb(IQ%?Bza@UB
zoV7MUpaj}BxZx$eQJ#kZW31Q(4N53p1(brcM_qgOK(oH;jKnvEnHdw#*>#~qtUwj9
z*#ScIXZGk=N$X?so3pIeZ}Q*63cesjz4u4RdVzuPSh1xP@irt&sQ$#yIiMpt)f7eK
zEC&P?CE&KNuOBN6ZC&;D*(v7x<a~ef7;-5WyPPstfc#icI2~EYO43Y}&GZlKf6R&q
zCnVi<kb=?TwvS9`K*Ey&MlL2`fuRENDg@G`RQg(Rv7_`wFL|W7*B`4B-16R_wo4o$
zLNEDQqhp7suFv||LvYCFqvWz%tV=>>O9f(ZoIKbYm=yp`uTjYxFB4a*na=Cxyp-o_
z!H?qtb0o&Q{AOZa2yP0G>vV%5x^%fnC%&k2XXMX3jYmH9z&?$H?OqdF09=lO!(Up*
zS?epD4ckt#dP?w4)Bt<mDX=ugz4X4p^4>;?jf~4qUuV1=7tJyOfExBTE7m)!eT=-&
zgtn(u3jo^jd}?JRocbJ*$UTOenpNDenQD0uIZQVM$V?h?Rq9qv3_jPEymDOB`P7yJ
z*|vyb_Y<a{i*tH(Aydd6xqwj(21pZfVpE&+Tn2-D5rCVy6U?0z<#$Q*g%4jVU>k<{
zhv5BrE&};CrCz{C6^f=ndBrXJW$Oj&AWYLa$hA8!QvHg}>to%5vm-TE>N2{vucNsi
zS}30aR#T|W(%SaZx3!g#UL&(&lEiSSK7^npeJDMTB!AQIWK-^^X2%tM-ccft0npm5
z8LnHQCfp7F(dOIjhs+CEpEn8rCk2?Noc8kP)GGZ*NGoh?tlN$O<o;p&AJi!_J4(}j
z*=)gAH;tVWOQ{J~A&>ot{Glu{Bl2LDN#s&+hsImin^5I9Ik6<NgwN0U^6t&_Ukd)%
zX3$ho7l+3%49JYghhCg&<r%aBp`;V}Gy9A(UN=sNO`60@gi;Tr?#SS$-e#%w7<nw+
z2@2(1(hTbL**P_c8Iu1BtAW3=)EJLbuTcfn@@~23Uktk2t6`)N9XeE+S#CrSs4AeQ
zR&~=eySs4IgT_|GBy(VRX@6AVf^L8^`1qaW^@9tx&HNnQN%nIq1Ar=G_Gx4qj!&yw
zx*1Y4s6Ewf$#8U;3Mmq?QxkMnxL<<_6%2Fjh5;pmi%x8w>Gocjec+-nYnL86^bSPQ
zZF{PJ#zRU*N0^FOls0PB$h@uX9x;#MwnrMpF3%)lrCyz|c0wM`w^o1-gH)-ne{*aq
zeg8#$SH)_A9XwA>S<nlE5N11n1#%9~Vp~wg-pAoP*#qQHlOz73#YeeY4%(aFQ-dD&
zr=uoj22T-r(zwq5L?!*dglgZj5$}E>Fu0nepvl1T|MV?m-U3qI49m{F{kY&fW=Vg^
zOD$19TERv(b`dWM{RbJp>79^hXHD(%@|pHki@xvlPvtjVuWw??o!J@U-y~u{4=by?
zePr+R>*ljf`&ANe#NL>f)lGJYxajL)>(H?Sk(|C^gpZWn_DQjjedqJiPObc;*R74k
z{6fdT;TOR)@xS@-5B$DDis&jeT!-cSDl!F_GgnG}_fZ<iR>w7z`>t3o2pZ{!L0b^_
zMkdNnp#cBIYwK2xCI9_{5Z=5@WeKGCij~9$WR3sE5_`pmKAAi9AAwpAP_k86$DI`M
zaehbpP_G95hivF5O?9ih6pvzmPjt2!)ztBkpY}<PCjWcq#@~==o;vB`Vlr;<%D7Mn
z%&ht6#xZ<3>GhH|ks+AOJz2+UM<541r~pIx8`t5`a#n*G(OLG}sAn<pW+i3qtMq@+
z8t`<gJSol%>rYpXRU&^Ql&M6jmQJ3Iz&sAQ7<waO7L=iXIsKi7iFxf()n8I+I&v{H
z(e=XY3ACHeG+i3U*Ty~ftC0VJ@W#?#Wlb=Wp~cl_Zz?Pv&JzVm4yQ^U0Q|+f70d)+
zD{P|(HhCW0m}ZIFfZzFgn7C6v8($B{7Aij~84gwckyGmDHsyP{Jqv&dtR0_xR1Ij*
zLXBLT0}Ak#26_kEfDB}PbZ}7<?YKU=<R-sr#5)pRzxk%j58$4uo%hymbjVI;CI{Af
zsG9XvQbRCGW5+kM%VU28rDy+$Mr^3KUD*CMl`o~+Iw4WFeYH!D$iq&|Dpqzq=nbXn
zNEH|w9ba&4)GdV#ZhuTyvv!$1oEX}&YOTV^0@g82I}x8bTT#ss@59>1#V4fWl>%FT
z$8em$n>r9aUcn#AdYUXmU$f#y+34mm#eC+@h$g7qcMj`@)Nf4^svguA(~HJU6jxu0
z2nzqE2D?l`vlcqrU^|@7RR3$tv|cpBzpzAqVP_8OHkg<YYR+@m*c|X}YWpttFeof`
zyY@)hOsi={i?q;lW$*BCV2c=ZcS&jE^mfBNR88m<H?y)!8lu+SO_ejKSfzi5%aP`O
zz$B*GITedzkqT~|8hWYvokDl1(p!siji)3k<cNu3T`nmm=cTST2lYP43%yt`ih*D@
zQV8U^v-n9VD^a2`8q9kKP_J+h5f=gf4gfqNx3R&X&D#eD9nx;pus`|f4e}Bxhj2Vy
z8vbstX<!q;2;7nPlXL3M7yXxBkyG{%FFFfW=KslFP9B;nUoW`4Wk4q^f08y@8ygDD
z`(!0I`V=~~>dL9D8jM-7lv<hE-Pu5_SV^sxwAL*ZCt{Wd)^m01yf!-_8`0D=Si#kL
z`qIfX3ft&cnz))VJ90_!BZ*hY@p%zI8hQlvTDh3m@TRX(OF9i0ufV;K(V!vUgQp(f
z^t2CjRvMd;jF&f1DMj=s_P(6CZx_3xfmw!LR!05spMIV((?<3nN62`Pb6_fouxi&-
zosrooXQMP}&JP$PAx1=4=nN=m*3}dZI;U(&;<~Zcxqzvp5{o}%vDNz5NXfr;@X92P
zX2j;F2+7@dv%?)LhFolpdMbA1D!`HSUV1zsBHS}ylX)X#wcB`;{zMu*t?k%tD(KlT
zi?LGJ=hu4#9!SKbZ4UxB5#u*lZ*bpL3pq{VF(z=AI9N;D<VtYm*{MweqI-J<pLuut
z?qaX7t9OFG`~)s!f6hev9YKCgG%(sp#sjgZhA{-%S<EXd<4Vp48?L;73)|&(a*6x_
zfOCJN7c`iDiUget*!aEIY^?7%&N)W&+o1Gl`T1hZe~&l)pV!XmKh_)8x99&@NtZtL
zqe74DWl+18`X06YQu&d<o+hMCJ|#NlN%uWYl5JAM+I3avxpQY~MF1m$B@iDdo1|WZ
zh~S4Dl0D=gbuF}9&mN>MJBKVVW|>>vmo4P1E?twDaV^t>?+ucez{>eFo{+|Wm5Szd
z{*8}&Dpw#575WGqF;!1o=s!-^i5-E2%a;@#LcZ$VS1dj<T)(qsf${Mb`|HuIBRIle
zaNlavAY%812!sF}mBuhlfSa<nH03px$L-5b_Mp@s7r147xCw;3MA65cS^usuaVyP{
zGy>I4op35mL^Y_7jh!#8_BlMP>9g5vCyl(%t*jJVJGb9pX#)xSTCipr2Gx5(s(LWo
ziP%}4PY@3*8}TlEssVYq`DWYs|6%XD<JsQ#|BbY$O>5NN?J;7UQY%(l)GX%|$BKrk
z+FM9OD5_$W8a1M&)t;(RY7?r6QKPhC)F!c45Fz~1d++()d(S=R`#bml?|*qD`F!5v
zHQ%q-^YwZgCL>;d5@W6>x9RT}QE`?XK8dTxi_|QmwtuOJ{FJ8G9eTaIv5!3EGpbn*
zs<)<&m(+j)0&}T(Ik*f*qMXmW9KrSXX8AJc`5qXg)G@TqZgX^8mB;J$vRcj9!&GAJ
zr_13r56uw1)6lILktWiI8>z9rWIl<tm)shl>u(eyy{Bw5s09@Xy!)%%5C@ht2&79o
zE=+CT%WLM74}&xc!o0q4@lDX22=fNd_JqT{X2LP7fhPHovD}OfX1^86I0*Ei{F=x1
zy)2Bq;Aj%B5HB{EHm^TSx{c2bq6vLM8rO0)b%bA?zWU<_>0D`Q)#}G2KJMN*P8}^`
z5xu$U>o13Gqz4l(rR&MJ5xWdcLB&<fa+Ku@r2*cA{-@YfuOF+1Y=bO2<5DZ#rZ{|;
ztU?|#SGKdw<H}dO!yk!MBB$(a1*_AxEINtQ7HA6)b~XQRDx{+ivw8O+HZbyDt-ASI
zk)f>l`(2EgDEae5=aaAnh(96eBHNi)iCJ&hj|SidxqM)5SO9wKfsC9$HK~c(B*}5<
z2IYgfl4sHIjmOX)JwSXhiW6R5Ha-2lntwMrOs<A^{($s~eW)^*njwk_P=KJ`uBj><
zPD$55*}REMKSq|s^wy2UZzLYODWnO=!iFawIyKFWKGUpOu{h8US`uae5*aAO*mk8b
z%?uaQ1%chnNN*>_t_H&|@e3>TS6#E6NrS+R4gu#}87)sf0W#7T^)}JWORDiB+i2Ox
z0ab&JhbC(eJs3z$hY!r=z9BUketb6&n4oR|t7F&MS8Ul6XdK#Q79tG<a@rr3UhCp2
zSW$2b3Q&5RcXD_G{<+INzrC$JjHhv_pE(|~8PS4|$TX1I`m%g(Q{ETatBmfj&l^9+
ztZdP63M7dgSl2wHKk$p^I@CMO)ginUX?}s-MI8>SJjxClPzH5m^8GkUI9hn2qj`8s
za7ASIjlb84n0@KzpVuU9yy_9l29O74#Alk?FWy_c7l<I+={$}3h(C4T{8n&$wM=th
z&Bwtwnua!-rcHq6k+|E<3~##{*A!LP6bb1&ciJ0|DrRk(uO5q#pr;I&!y!(HrmA2_
z7-UpQ;NrmjJ8$i}-(6qPztt2ocZSAaOgELrfBloi$<`UJjuqKKU1!kcpWT06>JBuI
zRDRQ72TeW0-T7!nqktAgOXfE@NsiTNm<#QcIgu%8$wD%}OEmL9`=^-oT$U(7#hka#
zvu4+<<38U#-Q8!g0a+rYk!u-t7(AW%t;uZcOJPfbdwJIVwu*S@26r*N^GRHZ5XSH-
zNxKc+*EFl%j@vPnh>|$Cim@>Ao2k#o2vxM_&G_ndCi?dxvcNI*x$Y4guUk$599t35
zc$vUhJnL>!eT;lTY<2tH0VNIW_7nHZ6mTBX#iQ?)96Rgeh*)=t(|mdc^26gh+z=!?
zK|1Q9bDdfkTL5rp4X@s=k_J))Re;OpxxMZH)dMeI4n#H(layUA6=@GdMs{t>%}=>G
zwHEk8OtWQi&xHo)0!~`yLlq8yC)?A4)r(Inp9xX)@dqmi;0MNB6gNgCTLMLo3EWKp
zZ`iEuXf19ktj(wdqK<N)J=%TK#eG-8W_2*Vhnr_QqfTpPH|;lm<^mBDJlV+oL(c4*
z7uJRkW}Er*vGE?H5049Z3X+aDTnn}%l8=x|cl);;9xx9`E_j$cN+!ipG7P0vU$>W&
z`mPL^*ZHGAJit65Z3-16Oa}JJpS<jW_i5)I#bai(A(KZ0ZQD(FvX<vz#6!Fj?3}^)
zg72@Sn>yRf+Jf87!JQ&psZjt)QCcP=UAq7I2!6ta)kOciG8Gr<`Go=JO1G_#nqlT4
zh2?aLw^REoCG9^?LrC@YDmz6jNr?u?scvzl#fCezzPs0H;vK|AXl2&s`2os*^O1c2
z<@p!Fz^yPnY@)gocvt^1?;G4~VO~g6>f)k`o;E37o7w_FEzzb)7ysfCun;<C)(T*<
zbGrK&o7UZ{-*YcTJGqH?O|513`62LR4%j1d+$K^Txzi1BO5T}!%!_GK>?kKaYFT_)
zp~vfGTkP(V9=UDxl=tNV4j+4&*_Om863`ik(Cf$a#W6ti&|$NEbaaUx0GBOs0ef7+
zCkJ3xD5))pw?=R)$%*JMOj)RaxYKhrMkyj@jD&yzP`iG8em$k8Rtx(Db(wAP+>Se)
z=<A9+(iOeEu1iwDbf_MS08a?vh*}~xUG1-B>nz;Pi00Si0ob~VMM);oR~Ta|x?!^#
zyK&)b&tk&KX8m=yc<Yze#3N^9n9z2TVA|*wKi@)T44*+~K?mc8yw~FjW*ItdTL<?_
zRO}@l@mDdI8^Epjx;mYTcqbkUTSb?&=$gI=o|^<&=KVe~a`%-3r32Z~NoToINh~eA
z$*Y8I+Ro2q!#`<SZccGyyEb2Lhe7LTyVaL`J$XP5=8p!ayR%c=D`R8xCx^46c}G1`
z1_;kkcy^X$nME8#&ejxiqG$o#-vTc3L)PA54YoLtK62-uC&qxP9zKppzi!KC*&mp3
z_-U6b6AR|vAjPIQ1d67#kh+6A^8y#PxpNj@R=)uDac;;IloNqo(0-2U52RU{7O|u6
zo%BA*F&k>-@`WB#TN|XQGukgywj-w{JI_ihx}S)(JGjoqPt(GB&Y(Xht7=8q70yG?
za`Syg6bQ+ML2{wp+U?OYyU~?%Io*_gitb!wp*Hh1!cEO3n)%L65pqJxBoL*un+K-j
zxxbwrxy3S9r2@D)$UgqSU8Nc;LPW-FKTv^#TinDRdj_=&s>;nM@l+c}GsE7sUXK!j
zKVZdcm4MswATGI{ommfrBW1Sw7SvnAgi8mEc*^<Nm*gB~&M_bBu@9IK!C4sYY<d@6
zZ46>NOFda0rwDvk#WUbVW(wsAG1fX_tPp+3I5A{6(Sk7xOVG)NkOpx6u1;)Uz=@UM
zK4|8a=97<`=g7wB`f2FYw&@}iMZMjJ6``Uik`}|HQNcjJ!BD`DI0!|Io<xE-ZY9gD
zZzsf@KebA>AhDNIFW+;z|G|b0HtTzqZ+FtwMRhl>USEV?wlgN;qB@s1v?XA(Fy>I-
zlIP?`+;j<SDGr(rpzqX5Tp%X41UhqS(HfqVAurdYr%Jf+@-Lll$l0A7mgAUbz({PT
zt6vi!w>EcASE4Rp21wt|8g6)R(D#5-HZz9Vbf7geo&{zoSw#Gh&WTf-!rJa+F-9`z
zS-b?E@G&&t*mX@g^6f1OXO06fqX_+=95<^Q+5<@mU*ZeSv$hbLtS^T~4yi3&n#T$j
z3WsQ+F*fv)VG0Yr_m3AuhZs(7P`(#X?!(L~m;*s4iYFBvX9tYDly6{_%~3KnVYhc{
zS>I_%@FB)i!`QYoAL14CWEfVf5~lY^diLYnwW5fLok<teoJ@;i?O|?eq(3|N)sKOK
z!dju(47lQgYiuQ3&(Q=(Q;r(Icej=Xaat$>2eink4OtYV`7MQVxADiXY?>E*Bk3Y$
zx^1_Qka)iW{tWkxfP(E8>?BkE`4r)P<B`Qe`2$v3)8iH-JLKbZI94Lwl$;W|!GCgN
zhCkk^fF8w4nNe?bkl4<fKZ%hKU|6l=v}_k_XWN-HIZjHD=i3Pthwz>9i)<)$W(E?u
zIXX#cBzTwBoUh{24}rAKd@9Gun>nXBycs1d({*=YuPq$OY2g9H$5%@V=%L3_{yN9h
zj*{@)EG-?zAH=gczM;HN?qYYvRaMLh^Md`xm5J-5YmQ{D+sFN`K64f)6GDf_Z(D5_
zTEy|2j3;Nsb<-+0b9N4B=DTQzaRfZ?d{5Z+^ivcoZ3ODV3I2d4@})dp`roX<KMjN2
zlh$9^D~#jA#=4mGxqt&<X+4RSJy5Z(=TgAUu*$APZ>Q|tJDFMY8EIiTnY{O#P)lwa
zmw_z1R;hxHP^hssFq&zrO*I%NCDyCHcPy*zRJ<Qdn28O9wE~?Qtda$R+t5R!s58t4
zOij84yhu5R9Xd2`Z<E)6$+hvFcd1#=n^>0I#MOZsOn%^@INr{tKGz{xxR*I_o?-HF
z1-%Xr^#+#yIR@ap%kk}LWUh-k75qB<B0QP|24H0sO_E?RG5?GlPP$Dr<Y;#UC~YVL
zv^g{dv;;hG8F%-p>qIQ%7*H*flxCt0wj%q(bC$$=D7);=T7p}D<yEZh&Ij#8XOuSl
z#egKaQwwa)8TH{gXChSY=^c@XzRNu4vwKN51lWSO3GH)Sr_nt5IiU-E-kmbLXEg~Q
zM_VwT(#}M>vSh!JySHN{Na<7Q%)8DJZIsR3wDnSia`g_i?n0Nwix0sAGIIGq8nzgJ
zkwVN;jy_ix|2XwoiXbuehz1enV!^-v&T>H9(8{Sy!a!e#S%yCa1zF%tk7sSL%?9_)
ze9-QqBm(<nj@>tA>D3{60zAdpxuiB*H`ErVWA$Q-%Pp}sL)<mrFt>ttsk%bsoD!|_
zu)9m3VjW_d``N@+x&79BrB;PN79ly;B7q}*X4mXtlzcETr9rVM@351k@>TIVe!Y0o
zS@8}7FKp%{N;WVpA|aNqpv3PJ3@kh&t1f7}CFzfDqu&6uJYz3gW`Nnr8L;nWfH+){
z+OTISa)3%4qX5^tYWEf;>0@*8TRiAF-o?p*>R47~lqMXa$B`*X9Fz`3Dreu#yJt9U
zyXIax)E4-ta(-$i^em-6jGBEDftwiPisaz~d5Z_Yfh$%putJ+!V2s8%=UM`WvPnH5
zZAdOD1ymZc(T8oLBq|b)kTi4~o<Uo3bBDt^+%o{{<7hRcx>kueyGdlp{s0RMY<{bs
zN>QQG#4-}f=cIF{rGIk{#YtH`N^Oz5;@)Tb(A``mq%XgILu74MWcRUBiF1aV!e`%3
zF}Zo>ok@DFH_PnIrN_dZZ2Q^MTJ#^1LkQr=?IWiAt(OCe#VpQ;jt|(iP6>t^i0t%K
z=ljofw&GMY>^PRDp66{ZhSD8~9SH48z)OIWjl?u4l8tOMozpnEsfBsRe3opq(075{
zKY6F`a-!4HkAm2)PQk_seFoZw3UNybM3J(z*7P=VpYVbmrGCs9*J{XRx*Nfz9yG*;
zxSERJWXDPFoxDUT-AyhL5`;=`!SJCp`&+Rw+g*3*hG$eqj}uQS1s#n^U7MmCvd0hK
zVh2->lRji`HFe04`?7bMTuNs<rz?+>y0v<bm&OLNTZNp9c#pQg$4u45+5@t5*{KE$
z2NnhGxOP?3Lq}7~GY7N~Ga*FQ$)59R@bL8M+t_Bp9au%z)j65Ip#i?#yt}5`xdG#|
zA}uP@VV$k#rYj7eTT~+*(f3k>!~8dg+4<U75jnDeDXOhg?7w;tzN8`5-EsU|F91UX
zx~|ivz~p=9M_eR^d#kky-O!RUnRtAHZ*d20ABY}Y!eEw}OCMi#Z`o$i(-~knmUI(r
zXSzXrGCkjC!p2oP$c^rv{nRvrK^XB%1dwiIP8<74JY#Tnxp@>Rm)dm}(o4DaoCQuy
z-+ty;U<?S_IxZ|w&TfsWe2FIMKHof6P`5g@PiUBJHswboTCzo)+>W`7*d0b}ur9IA
zCkl7w)*JITU~En`GnAgoCxAXPEQtp)L+Na19<eT+$6(a?fMhIE4ii`pthkO?w&&VI
zv154eWkqDyNUn(wXd4xBQhSI@Bw|j}T>3wYEZtwYTm;;TVQ(8sGt?QdCAZ}*=X?f*
zEX(RS<6?y7X_)!;cMJLV;{U^or|NCn4gfh+sV?V0<PC0-b#eSB3a?jHQ`1}rKeHT^
zw(jXA#e{$vUf_CIeL{K0E?ow%ciJ-$a9`ZQTsuH;#9i4+_%N?17r}W#y>7RJ!ffjl
zc0%o+Z5J_yWo~V%-UtTAtTqvol5j5+43D2BD-&mVz2jex8fXKrF?|rNh&==5q28z0
z(`)4PlXyGN4C1&8F?kX!cY1&Odl&PG-oC|TASiY46ZGnwCNQ|D7Fgmd88Ggz=+m^d
z(4pWRme6DJ3;CM%;)2J-`4JJEo%wU2lg`tV>k8x#R8V;mhSb#?;PiDE$ip4hmRL?G
z5*{NMHR7JLdhyu@1)5FZyk$lamb?*igA0r5f%5xtEOko+=wicWAWTx`x<y%eV+A-f
zWZ8LqJ|avs2J<@cGl?-#@kR1>yyvuG5OH0-q;%7oxED})L8ty@frNLUnPX?3@_4b(
zDD~V+AETA7+)s5YJgt^!@wg=d<tF-7%0RVYTn3rc6}<N0{1H~!Q2kXRyO|yZ*+RI+
zuDp=biw#Wn;gP6Ydbo}qV$;sB=Fwc393Y_HlBl(jy&f?>JO+oOJFw*F*a6IOFUBiz
zX)GUklnpiLSCLS?XVC+jvrCVK@;nSURpF8J+Pl11UE)h%8^x_1nN0XS^zQkP5C}^|
z5G2I}%HWzSmt<n0jjwc46XnRtAtX}~b?|@+y)(ZKti){X#%RC}DF#$vf#Qr@5MF9R
z&pQmqofKPS_$RaV2ciy*_%Ex!%NrJMDMnd0)}7GTqhzVLFFDH(aWUaRg+S0?ULY6M
z&*`fYdD-{A#gY40ow<Pk(mqAs`Kp@(1X7l_FGzZ-O5qzSt4(WhGX=NPGAx}NU?JZW
zfHCo|RJH}LeY6R>mAP6iR)T6MCOuxQ4;U90h`=hvF%j+vW(QL4c)+B)WR}k0Q6da@
zVhSd38M0)tNxyG|z3Wq$7}G$yz`sDw*q`O}!MYXP;Pnbf7Tir&ruLzNL%hf}d0h;y
z#zSqSVt6)Q!#mZ`u$;jzD0L2q&$!M$+G|{S-TXreZZ7Y^^mcqho?)hPflGb-c0wiI
z=!mGY-hS4u4k9t&H%^3i3Xd)jb-XLl>euYNEQP0so_Kl%CZqXlwGve<igH7m%W?h4
zWWpms_3x7NE<<KWI^kq6%PBden0lpfuSeE-oqBV7GFES{9;<z!p45E>za8UwykZ>&
z2JU6NNJ)F)xD>iD*sGqP>cJ~AT(ij>o?66GFL=3#RpV&Y$r+LCwW$_7*?#QgTJ|g+
ze?IWi?n6-OoFUHAVr6gMfUU<PMteN9?xkZ8m2^X8Sw-*_NR0Z^)BZwg5w?=^>k@fG
zQb4kKS>QGIwL<hYZM=s-BWYswhO;v-=CX;pn_`SCV){<vQ2|~e7<(%dbcLbpwDly_
zpy%FbN##Dg8UH^qfq!~|Ml(*F*{jVRTa?b`9bXCDr^X)wzVeg0CMi1C3Yxa<J0z78
z!tB1vI92$wSZnk#Hy5AeDF^L^@4jPKchcH<eW7OhG={wVqC9f%&AKzbQs~MlokF6D
zhmK8uZ&TAxAEg6wNDCA_A>b_jCe+Rt9<&vmyWV_Cv^cG%ycyd3f~dq|MDcEF6CS%z
zxwE+l^{3w~mOf*$cc$WrFAy$Tu9K@D-JKo;6v`w%X*P8hdAaNftQ`pqnzcU`=r1Ce
zKz(ynw-%g3rDwU{31V-6)c5jA2AbCie7(y$30XUK*p9Q|Go}TgVz}4RQ>~ir_?<KX
z&#Z>n9i`^wT^xlEKHE#$eJofeIUZ1an!!pbD!68!?4li<Hk(JDrA@>Vp+Qm>5j$9a
zkj+g^@@UEx?|B0virQ!Q$C2q;!@F`W=`rC;m+;kz+Dm4~CP$=^)oY+p2%JFahkAjz
z^Dn35kFc+oM9OVW%vemLN49}4j;@K!Yc5vCYc1NL7Bw`m@h3Ojb>b@r0_zc~RbiRu
z?Yk?x)D6pJYSK&K$L6^$S{l|jrfTtd5ogtj6}n$_N>VK-*$OLJPnEwCB%<OGLdo81
z3!$`;d;9kcqSY4Rj%&lxm+{^4-gTXK2h_aNhgAd7l@L6#qCf8@{5U~7fNf#6JMh;m
zV;xAMR>RS|#k?Z-SIiUJ@*49NI~8Vd^ufAHWDf6fflH-wc!hzZm96FUH2ugyi+FtB
zR)PLqLPXF&RtYO~Qx>5nc`K{(A#6ZlojiTTB~6{*vHJ+5gc%h0mZO#?#a`Qj+Eu(J
zf&j8vmvajVqOO;-3sIe$ZFTQqg@*Wf11M?u?j>}{!Vo_q@LTW4+R6r}G98g|(+Q_h
zzy4x2Z5Ot7m($LIc9-))4%}P1ANmJ*7O^iKbxuY)rd`y7;ra@@@&`XTqoEfushhzE
z@7i~<FXZ>~4o2Hma}dnktP_h3qe4d`{^mjlKShpOp2f7JV6TO=;D2;D%J3(6TZz>0
z>nz-f3GcVgT3r~CdZwldk%-(6z!FERQ()!H{5|s`yBX7o9*O7?H@40Y^4O79HIi*5
zg1_fE{h{B(X2MJZJ~>4_Rcw0_Z*)^zLw$3dg;EH5on>OTY0-bAu0CSeI1*?s;I$y!
zWwG%FCp7>wh?GlGGPi?W^mNbpLmO`f*a5j-IV=X&a@p?Ds)j<i7Gni~Qe&Uuy{Eq4
z?^P{d4Xx}_J%CNcT{k_R<%_7q6(u=1t7<vlpHA(vak{bdn!bh^u~Coj`JS)dS@%UW
z!gr8aS;w9_pv2a%6JD$Rc#eCyyeI>m%y1zm6YqE!IS*#q1q+7k)LN_Fm33=}-E&77
zjI+39g?~%A5V&r>?D(rl^RX@Bh}@A^BGNs?-+b8~RS@eM?wF{)xwp3iKfJHGS)U|-
zwK($qp>~#z-zNNS+oM%MlV<k8ED6<kRjWvufS{BY&)5UIQBMxsnj^EX0igqLeFIAd
z=INoQs7Lwr$3~6Vq(y_A`k<uu>%HU<!di-x&stuMphryKAh72Sq%@h_QB26T2&p8;
z2ef;775i3pO>;K0L%hW!$^&4JoV&NBBCRubpQWT(6okNYTiApt`o6?ZFLd@yx+5a0
z1)L0RdeTd@)Iqm+r{e<Z%?m;jyNepL9Fq%LwDEz58X2qQmASF|EwC#E2PpEck~8nG
zBA!(jd*%+d#?Y0H@}T5Tv!qPWLb%eQ1NpOWP{4wQM!j(63m>VS%9cI1ZMQY`+VhC;
zd=rn_^JAo&xk@!ALoZ7Ih{)6+?d|CAhwpmseBlUwT-F|Nla%!i1}xaDt-5jrDF<T*
zO-JB60#4_s086q}NXag)gXh$0CrNGU9@>2NXy<5u-P1m@icc?<_4LDe4B~iRq!!U;
zG0`|XuMc-(1<5Tyu1csa`8s1#%ND;LgjDk8!Vd$2%i}_p4ax7%qd$i{Q^m^P4iR&F
zQ{S@bKA?j4OrjmIEod)q+PQi7219<c&(w4<6|vcg`9*kNh9a1JtL|E)LcL4lM1Arn
z%@;)n^*UYsu+drwqNT<l*Fa~<vyo4=`Q$K2{zX}>0A)dNBuQ$8e0`xham|XHuNwLT
zx)=Xq1!EnadH=w?hrP?~l_p$JpnQaNf~A~SR?Vw6!_$ix^0|B=aQR}5K)StASB2ST
zS4IEoA(Pkn5V%hK?wj&l^w*v*o$(7M@2f2}$y(AXa*Y#Sar?`mn+E+|3z<Fl)OQl!
zC!z(LweZ^r^%`%9e~*LzX7iAmX5jX-IDo4YF0HDtGh_r%T2a`G*?}+!ME`8Nl`mT-
z-9XMlUQRr5nD&{%xPB}bIi6uySFzL#-SC>Gndi1y`xv;?mlLqF(7m6K*zzemrFL~V
z+-Ew)dB9)lXfoxNFG9+D%KO{0P4+(A37e%fM#wGq_7dY3O7u`e_kXccTkF~ie@{|J
zi|~sC6x70cQwKQw`|&RCOa|_d<B}_toJ=PUVGgewNDWrx&EhG=kNCXl<P)NhqdG<i
z&isBIE<A3Eer!0p^>n9k)^qLP@Xp#kT(HIrEm6e>Z%&Q~7Di-2bi7rPA@F3=a)fDF
zIffg*JH|);5xtfTgde@A5gHB!_K-mzPkvc9Id*<?n0kc6m40d2i)24C{#H@mzFKWD
zQNJQl%XJ7-#lNv<a$fq(4|*-K>uIa%m0q*-M~(z_f9tXUs@I}efva&q0(rHmuSl*D
zlLvw~G+Rnx<6<4zR*c{ihi8G|_;kDbj=s5pY$0QZTkY%<>Uz4cn`b8S=5>@!C`~<9
zlwZnsv^N{Sbj>!^^MXo)oQDmmF&e2CYvyCZ!@QZ@@im=P^>n*8ctAdK;7j?Jxm}0I
znNV^R3m%}!b<Id<z`4Lpt1Hd}hd*f;Rrjjp8Vwv<g<q`Fw9$0Mze!YZ?evm+=^Z2|
zP3=UH-%;H>+#=U0t!&W9d^iBVp6k-sG2X}<5V+@oi$^(=)x5G+T^b{XN~Z1}uk`ZF
zL&(OBMD2#Sb?d2#Isv?aPIzwOwnr)D&iG!)?cKxhmEQYHO?=Z|KRYxIx9sownTC?~
zg5kL%<*ri`$@$ONDZvQPS5=MMCdnAjwt+7nOmu#qvH3fv-p*`|W2~T^-Fh+UFltwA
zZf@_iA}_7$_A0$5R3k}Vao6q@h!tLv+~G0&nQ1af$+5x46LaR^C#MbIlkGc;MVOK&
zHQh%I??a{z#Na}*_RN$In^U2%CG{G&-pnNsr3ggHE4MJv-tC@RZs;J@{*=3{x&9op
zId3~=<vq!INP?<)eM?TNaD02xNwu61H#odMLY=HO9Xwtd*K`p0`h++iruki<eYy`Q
ziJw}~ki9gOtk!TTKh5114B{&nx)O8%=l^;T9Qp>$JZ7rh5>RmLb66tuX8}p-f|)Ap
z7_nO&^IPH1_79$efFkig(b4G5gXk<(8+K&hP?M>%cEMY3iyb+}>G$7qb7`eKn?-6@
zPyMv0#jMi`A``%rsNH+e$=eaKUBT~DQcsL$HaKiO2k4H?RtBu^D*TB`_@duRllw)P
ztC!eL6YCaTHKr{!)8wdrtZ=hbaN<kxn7@-*QDq3+U-<2}O6nyEUBMuYug2hcjxD<i
z|IYD(o4@Ine|!C;Hr;UOKt|>tllM=)t=MPe16S>Lnx;toE|2$zWBeo0w;@hT@3kTB
zWoG=p{p)u_mTJ?T#g#TI4MYBfApe?0{O!HSMkDH0H8R>;|A`LxgAAlDoo7lEt*WPQ
zAJO)odCA}2_-}jmuS3o#a4EJfDSY^v@h3*~ckB7vv#sM2gLGbZ-QAhHMn-<p3~1hO
zDC&9>OB0Bd{L_K{V<ulUXzz$lw%vW3^8Cc)KYsnAVgH_XExkk~!|n6sJ^u~usDsga
zeI+xlVE&tBKBDf;-Rs-GI{X(K3VzE?edujU;r}h_|0wmF%>N(z{ibJIA93MEJkk02
z@`BdZ*6>PvuP9Ad{bQJ~luGBh8-kEvh?{crlh-zXS@BKs(|wez7V_fi^K&2ZagcA1
z;-J%ua}&twpVW@$^tj4?q<gWy+_CX1TmMl*{T2H^aajLIZ~35G<u!4WEe%Ppkzn>{
zgS&U{_PjJxOS4kd)^=2IY#5=_XE~P>5!srM0Tzh%n7QyW&$&7LeYa>Y6gct2vDhEI
z^N;n~?WopI_fjudwiNs<T^9pR>CFOWeacnKYK}O_q-S8OZe^#_zsh)C-GA<yI&{ai
zK5Tm~sbQ}(uI2Fux7QSth#kO0EAd&p@DCPR+t-+@#a^8)7!lElJmz`H)L{3k<Kkae
zm96>!o(o`u!E1D)ap#V97SGzS1hbXnt8_A&hew(BF7GW&)cOKbKx9JF0H62RyBA*H
z8s66j?XQjPjJc!bHE9;j4?M3Ba(x|gY({)1YTlkvxX$yEU2991`Q70{y2USpT=4pU
z#YbK??S(5be^D8Og}Cm~ssdDqNM-6NWsxZeEW^n)YRvTLp=nRn(*srf=L_~jNt4+Y
z?fV{CdHWP7ku}iOs9W7I6lDKkJw@lFu4%Vl^DWBa`ua2mqqT#TkjI|2vzl(XAh+G+
z&~n4qR|cPr?FZ%=8t!DI9eCF{nO>|i(+s-q>>5Y561F==IWGW)nvOOa-}0jq?_?Er
zi6ENJsQBma8#LD^mz_M_ohr{WTnY&Ya#4xgYnV52jSCUat!WQ0lW2!7JT6fPu__Qk
z)|uP64nZFOCwS<OjUPCYu67OF{#=tmkFEVoSP$dH`puT3U;Ns0RNTi)(mGx7YW3CQ
z0OsPKVG9lHd`1+j9fI)w`_Z(h2Md)J=5}O@!cVWQOL`1N;3FZ{NNyynh4$W0>3W$E
zkbU#Fj)E@W!cdYK>?YI~h=0B6P1NIqL&uBdyweZXt*EiEd97f=tcKg=&Bch9TatbW
z$|3a8yHx|AiOGZlf>-Rf6oR>S%jbfC<f*%(USlOgyp6abl;^R<#hw>hpcjtOwN~hm
z`i<R@4%Ohx^G!hf_+NGnTIZN1xxm9}z0ok9<wF2FdR5(TM)#0fd-YQ!6{McQ4k8u8
z$jc?6ux*fP1mcp!R+Oj+i2LJ)RF;C{eKg~TT7ZmbR-kKL3+ynU{MRQ^50QBf*yt{%
zcHQWCZQvYzo5XS+DU5YFrI!7xMXQR(2ov}8E)eRunHr6kWe%4<<xc3Kflf_0GRli>
zT-5MUvLd7P%DoAOXO@{EdBY_xjZ@O^M$++xLJ0wEunuX|&R8kon!-BP*d;-z^KlHw
z?-No`dD$iamc*i(gQ<4wOO<g^o6iV&dnZBXUN0vI2Pt@thDLv*!l{TVk*V{*U1m_l
zGx_y7`ykPHR-$;Xo{;y|5;p!G0+2}vCw<+5Sfh{lSEucd8Rj3~D&7S5)8s07(9zje
z<5jesPsyY9QLN}|;ir^?32{*3o@^!9!jeXnU0BPODz<?VezV7iyX)zuo6QGK6N{3x
z{G=1=c`*x*Mzov}Xd=xeE`Chlmah{9fv5t!IAkc|{SCJKBI_4XdR_uzDaU;rpU;)o
z+W#Yfd)q@CbQnY(r<R5_i0j@*Hd(-n8TV+JnQAV%Eu}V2fYnUzu!WA}{`$md|7!_C
zf|6L_gQ&vc5{oPwXZYR?j+=agaY7+r6HA5!FiY5uopeZwG3GNbd2i5w{e5NB8C4@d
zsi1av_4_004DId46%|Ni93<t5OhMT5wek0F&P0hm5Q^3(FwkD!`sh5~`dI5^Uwsjf
z<@X@Mm;D<c=cDwl*dB@(z7TZ*F8(aAKB1;!yg4Ei(vEKfr<i5Ou~K_VgTuGl7<!)>
z#E<8>9!PMRrU+@?rpDc!pUiiqO#87m`yKb#w0vFx*Fw6IJLjI*IC;o1Jt$h6tPfn=
z8+G;#XZ))4mk$UPL3F!kaa5b|9$>`5r)$~${r)$e486e*^z2%L(dLZRVxkh7g&agb
z&4j2kY|#pg;n3Mw-gA148B&%s6EKB`H1u>vjMA;{u8d_yq73-<YhcE`V$#zZf((J4
z0x0mK&a3J$t&pA0?lW6NsLHGi1MPXtz9;5uv@)Mav>9WMsBTQ5!13KaK5p1ztFJ2)
z4U`(zyhwj6W1Dad?ZG@e>J;%dPYe3)iG+dXRSsNR_6&WS1VNGz0~Q+RtkBnGN(doQ
zVG7rE+{SWZMP-PJ{iJSN|0EU$JbX^WZRFrJu!|wuGFt@qfE8ZM4rrT^>FNbyCbL<C
zuloiqg_|ZTuPNzJZ)*hBM$msH#%tg>v|>b<MD;})JQ%ExA8?*19e{fTsc0f&byI%l
zAnO}Z+!|meoh5pRfqj|BfP=1x-gRupsSD<_PT+6u)*l<$fB6<<F%w9uD%X0DxLI%R
z*Gbi=zogPMqB%HpE9f*EIkZ}R1lF7asL~;zr-)Xo_oJeRQzfs8HGbk~Z8uk5z=F|*
zY-{tQGH6(UfjYd^osDZ$a44Vrqmhsv-<sElvMUU$$?9tx`ZR#Ha|Cw=uIQVL4q|>t
z`uw5XU5A4j$ZAMn5O?+CZ&r2EB)WY-Fvm}6`F9xQp7}P5j38#2o$obHwLY#{z_w*L
zI^$?#zd7=mke?Q^60O*oJELg?SD5Nt<g$4c^+fWF05OU;M%pe!pm-zOvqS}8H@A#D
zM<@?Z9dCK&1`z%Fk>~}S7L4S_EPAJp&l)CO7<+il?;Q2AHgeQDL128jysN*`g2oib
zf&IXyKh_=Ze^W>gEQo8jp?madzEDV$JeaJpBs2*&5$fZrZg1+8o==n~$I5l3Nf`cu
z$f+Ve5sJUMd5GF;SN_Yp-^o->BfvAI&UoJT5+|ST7C`e3N4BmXAdw8XTOq;1(8dCo
z;5a{6(m_apMGJAsMLU9?>~;$HR*Uk|acsqi(uc5#wZ{Kgt<;o!;#9M#(<TNO<M>fO
z^=um}PShyon>ns6UNqk290q41{0)oO3N{cjsh0-RO>d<|oeS9#8>BM_c(*d})A?WR
zl7@!-;?l>5uAK^hBLo<p5z!MQW{F;8Tj8#IAm78d0hX&^;w5r@L~g`fxs;%Lu``B7
zz;(<n_FHmlk&x!RV#o;RjJ_sJYSsX~6=C~z^Z<`l_Q~NUJrW{s?N9jD`nNN50yQO+
zeAAE<>ylT8L%phUxzYFUl+9=!09t0*^;B@l+GI0D?)8)r|6<1w)@U_~vEq5b`b~mC
zXS!$!wWcG>Os4G~Zf0t}$`UJcl_l5jr95b8>c23jj4&UDT$d_<nq*0VC>;-BEa^cM
zOUO4-%h^Lb+P94caK0kdLOntE(F-{OH={0?R+ULtbdW}~D@DY&@mI^Z$PgRob_ef-
zf*O;?y|Z{yS}PrFnX-HoSI%VF#=gQ>2i^UoW<LY?b@^0rj~o{qx^wZAAWO^dCnow(
zl$n&uXe1u>K$JPe!zG@NtoOl?9LExVubuBXJzO&TUCcRJB^0FdsbB=QlAakt%Nvx&
z`0^Pl1SeTYAA*B4VVMNmfUX|#&P*fXwv1>WH5cw?oD3Fk#QMuKiwthR#}?OzLZdAh
z`^DSN<}4NyxgBSt%xs5bdKmM>>KKy&s!DMrCI*t?S-*G&q%tW+u#eI9j?Be{@EbTc
z7J~KKU|iItfF7p2=lRBe^^}iX<R-z2v4Rb@TX<1UN!=(K=HrY?0R~znrhtS=!C#l;
z%~R=V=>ejt)^U+^XR%CQjnvzi1#!t1LrUe()PEQj3GgaRkGeo7vK7B082HL|XpWes
zG!w<pcD|UDh{%{#+uLFUl4*2$QlAM!t;kPiSm=IAl^GI_@Q4?Y9JkC2=wwv)N=-Gf
zKNj;h(_9%GIBt_hO4X(h@<xnF#R)kw!rIQ(SXoqXC^JPbuYb-0EjHjsMoSQBF_#$x
zD@@dBe<bRlF1L%Y^)o#{>aA?2@1m|}civcoFxXku-C%ITvQJq0{B=il8^9w3=6)hK
zC37!IH1=C#XswVc&Ml_!T!_+g=ua;GXw^hBxSuW^!_xiSnP{vOjjO_82WhBxMzetl
zB|3-<jONQ6FR4Ga^MUepj5-*KfF5sULHNK(twj$DIQgmSLNWH^*@ofFcLejs7CG-U
z<1Ge_Vd*^&6QKk$*7T+iMcvtP+&wS*4WL#r5>N$Bmq63zuI^f<Nr;RKG$v~=q^Bl&
z>DVx>89xW<sb+NetXRi6)LC~1`^v6g8W>vL`pW?xD(R^w5xYDQYXc$XePaL@hiEH4
zm;~TN$AuG~#s3l<?MWJ8MZaF2*lVL1x?&@27Z82U2qzU4M|FX@H39n^t-7Mu$3MsI
zf^bouY(az4nkb_8T;TW}oi<K_=_7}-2%!wt)j;hG1J#<V&Zhdp=&J<!dE^P9&An$C
z60LS8OAC1st{w84Szw$qFFL7uHt$*^iaxkf=;fHlC5WLw|KU%Z;l|Y_&xH(~Z#WV=
z&yETjr&&N3UUdoA;GhpJRJOaNvqjsHr;<x7l$AZJWR~^q9Qqts^6OgeF+Y9aI(8Tl
zRAtQuFGfYl;{uWuxb{fAI**GI1BhKWJpCw!3w0=G+)FJ(FXFmZ)?Yr%Yy*78+N7Cx
zm{@epc-Gb3XA7dfpKLR}pQP5lHP*_Xpw$CkHXSbIE)s@{7OCEpJO|C#gt3Q(C2boc
zAZ?)v1h_OKi#{K|(=9V06UA5@HlL*S6hj5+TxGP>O`bVRr}Ihze5Wf}NWMhKO^{mo
zT&|u{hD9wJXk%ISEO{skCT4^pAyeFw*jAS4d;&MR=aCO+^J7Wct4(gLS>0%vb+Fm#
z;3v{&wkbdcSVqI6ORo{2DrE_Pjz3EYA>Ggi;;Y*&I_V-vNT*|n+#oOJ1Bwjt7jnL2
zsPL})b&6TQF$9&9>yVz!jcd;$`rc!PD=u(b1JZ_M=z`7jHNMcfK7GEbLof;H7UMhn
zjVL=$D-b<Y=L~M6R<f&NFH>c6eMVO(Z}7}8q05y|aufdS+ZNyc+pL4X&YiK}PfjZ5
z-CYX606K0)aZyp^%+v38w7$*Dzdr@V=kIJZZt{TM8}uX#Fx}-_ap()CqhmZTS}{Xh
z9+t-<!A~u8DAi4;Cr6*yTC`4&cjXn4h16;xRlRd0Q$M<ZwO271fUY12R;NWKPzy=L
zkiykT1GvS!8HRweG?N)R_(S=A>w=K#*+R2`Ab&Gz7~z+}G|zDbX*V_QXcVI$@_^ey
zYltqFaYXc0jBc_)Jli*%-KFr#cy_Gc-yHbVR^mc;`rD1!coCmcCgRnQHCyJBLZK6G
ztutNP5&Ic24D2<9>C~)g`D;A43&4?+BU+(TK2T=;Rf$mK4!;uDD2hEWaYu}S6l=rx
zQiO^m<K$l;hy;*~6<H#Obb?e;2HAm2G)Qg0r>31AS+$@-Zi=L>)^4AQcbOu3&;r9)
zgJchpNOTNq%P$lR=~E9_z_MyPlRsx&v{_P6-HzWU-H5sfp=B6v%h2fL1i|8xT0|4`
zCA}mJ(E)z>@AA@f|HaSz{;`yY?r`(f6nYlHydPZfyGS>V5fFF!b^#&d{oqz@3Ri0D
zFA^2tC|04KIe4@lBOAEuV)PkCHc>)U1NK`20|;|%(7>|I-naQn2)CFm)h}YaEjlQv
ziO##~|NPA13~%Hh4|*%5^$cAg33UO<IZ{=`*ueBu)RGR$M#qVJ|A2-iL|!cQf#=%s
zzVB&>rvdm}n;1cQC^?Fa4tmdE=IkgS3(T!k)yvk#iIe1rnPD#Tz+_~AndrP2UB&8{
zG!@&}YATIIASo^Ta7jh{`%x#^0qp|^PXis77{MmS5V69Tnajs!_T+*}QPTXX^J(}n
zQYfSZd4X2k7efhQ?$i@G;i5*DsI&6Y&s1Ki?AXvpIdVZBnD_ASx})JW%gD<buMjJ*
zOUCO4lR?~Cv5w;|>7bSq^6Db9Gf6)^mQzn{s4Yy)Kxdmizda+;9W|J^rg)28W`pTC
z2JcJx>U(8^;C7<uTW<qC*F|8m4mown5^!AxQfBgY)~Hv3k)q7WZG7#QB447mOIXzV
zB~*wLp1<>4529&K9aT&ZH_Ke=M}HTHR6R#~YVT2ms-|Q_0lq3Db1t@SVK`m&3-#$N
z-;pf30t&9fdKiBawTyD~WF(62?Y*60qs(M6wJ8GxIdr4S0kRd==iC6dIZ8jsMAb>Z
zqH*5J1xXR2LYRI8%W#u*Edk1a*MpfcQS8wgR|jKF>F!n-Q%mE=D&sw2*VHr%DomJb
zuD)tNsJ2jK%41q9bc8wnpg@jyqDvjrt2m=4LFCN^1g6$WD@ve^^m!VYc0_6DojrQ>
zv`xp{V)IU9hS;2DQD)?85o@hapn6-J0R(Ze0jm0=UgBhhRtLzIc`%E3i5aw>qqQJ)
zUI`$y0sF1Z5$~AU!@)7^gf{5_QqLq(=$HyEG=p_G_d|3d#Vt}fPM$Yr8HzAO-r~hn
zbRp&Dk=kqvsWNE?fdHLdyGzH?;LGc&2Eu5@CNaxpqx>U6r!=iPKwWG=(9J7Nf^($9
z;hA&u=G)J|FRj~9qCM4I6lVWkGxsmSROHXbt*5ttdD8xznjdS`kWR%bsITsLE$9gX
zwi$~D*1_qqh#%DPg-Q%aF2F@Uzk(g?W9zT0g<k5HH7X1$XwXsOsZoV=(HusAI~+gh
zskbozB#VV;`ACP<W*Rklx(q9XtBU|h4r~;L>0_bXda4v3GA~Ah$StVX+EalhC5Ws&
z*KaKLn|r!HA{K9MMJ)1Fx*R}irxl?4VMbT?46QK1VupqC(xNhk751E6Q40K^kcIAn
z5s@84D0G~*2;wN#6L~EY76azz3h{^s@wv<0OF@rtQ*mH)Pn3CJ7nwwiT+B78&YAc_
z$w=a4YKqWWT=2Nn4H0aPn&Pu$kRP|DIbu6yrx=Iz(ZbHkq9jE4$Nl=-v_9B$J`hNP
zKJpnaWX@%Js1JhQ*|<9@0%CYle-k?1MtiyplpA}$T%tqqSfy{U+TZB~)~Z$%YU}Bt
zm_yQ3eiyf>8wHS0smcA8d(Qvv8n@mTn?cCF%}g6)|1LU#+}UJmOhnnF5Wr0OerRAO
z8Enh-P4_Zr)-Yv?N?FE=($VqNQ31hi@_F-Wqk`Bp#%rRM$ZHWR54FT!uqrcsy>}r-
zq`Jhc&N4}O++VVz#6iM>zfF#b<(Wc=L~VASC`-tgdJw^KVlP%yAo{KmY3q1*pf-jk
z8%<erUmrG~jW>lAv0y&PnAR`pmRVrq?1{uZ>~Jj=Cr2vgR@c)8jB}u(70BD~%i(Xo
z%%4)*gS7LA>I*U1YY#hZZV8qx8?Fqd$7u8y0cm9`pQv_U9;o{aT!<&9U00xVPAeuw
zl5a-$I;_7ow1DZc>2x0*Cgm$WD}X*Ug}q>Fl<eO||JeERXOh9cZ_}SUM@WH6fzsY8
zW9)2ueD7*GW=eG!yiN(!#G#amw(lD;3AXa~2j;gv07xuc#Ka>NJz|pA#vh9UdY;GZ
z7Q37l>Fh03x8DvC(Yq`6EK$SjF?(>z`{mvWgBbt=k{1R_5CXFaYvIm52>?;+pnt_(
zj>|X4L8aQR;Chj8zK<engYhKnm0)9!c*o>oCuui0TVTjt=>C{{?+N9|UeqSU)un_N
zCdC-rDiGqeyf^FI`Fd16WGV%+vdw>2awTGV*w?j_YyIlIVHN(Km)dK_+gSl@(RmeL
z4m@AQtm2Fv`AXy)J{x)!s*R3_QCr7+-Xy5}bypGkJp)mt^(D0CXOTQzMLjELbGv9}
ztASvk!Nkeaz+{48f#CoQT3%i|omB!a$JFMKV|S|E54h;uartqg0?$hrH`+jGX>t6n
zE;VBAGm-xgoLJp)W78fXe6%e;iY?^UZg0T$J=ujmSDS`az5n*!(`KwO)c5Ft6`ek=
ze(AddYD8(`()(fiiYoU#<*bv~o}ril!S<H^(JU&O3N@A}7o28c&c7!}IWE*nXmBdn
zb#g}(s1o!Q)>HY<ejx^Xxc><X;$PI*KR&j8W-QI2$qkZ4o@J852Jc{{Ht8>>E|*If
zOfiTrXhDHphl4z$+a;qqUOHdd;MM$JZ-H#|Gga~Z`Lg9L<oi^aaP-8%rQ0r1TW8&C
z9EA~w4A-p<0+&-#;M#7K;A1{nlW#Ef#^J3)rGSukZKG?FANw@`xIB&EU-Q%hmv|a+
z%%g`y;7bLHV0u!%%eRV84gu{U^};n4hl-o^FIm+MMHJH;Tq1gkAPPAy0_Fdvi~n;y
z|KxgGEhG;$fpPqcWA-LJ^U{ieYjo@?_N9*;Rw}rAII^rMEAhlB^PSVna{E5$bY>t-
z`f6-U>qR=RtBk+QVr3G!f>g3tgRUQBPgk2zvXfhUO10hA>H^nrl_6Um634~I)O1AS
ztox>6(7qd_=IEW$1YElzHDSXE6x<ARp3X|iXLsXm*a$`)s+78y#$N`Nz*nsM_bL>W
z{|sC8pSTLSg6}!N3ci7~j^i(NSEm^iW}Fe<&<t%A>{N84D#cvPBUekg-pN#$0(m!-
z1p|$>z!#3*tpN<|=sc~^prrSSeHF>8N{F}sEKBe6z%s297K&ii=&J3n`7PcEVeM{f
zwI*{Y8hGPnmh&r%=C$mN>Jp#Q7GR2;Mwe@Z{qG&d|D54(i2-UXxfXzvYp$37s(}Pu
zjcHj3f2NxhyAtn^`Gbzv=KH^xYolfn>TCcnH=nqy|1sj`xAFefB2&2lEYCs3J;<XT
zgZ`VxCRM2Lm`N4l#ms-Q&7UvvA4A$Q15{@hz9Ub*Lr@q-|E&1(Pi9(pKD5H0=TCn8
z<J1aRm^#fq`mP^-=PCZqIsBdH&j+3t{QoZIU;ogm1z@SjVMzY@e}C`qrcMn=R8>{Q
zLhj%HRj8gP<*(D3I<%?=ZD_?9L8bM-LaX$dP~l0?ZQINLoAm$d!l=Zp7-FJgu7=#B
zD1X@!P-&5!Ma4Aj&Q)6dRm=LF6N|WUfT-86Ux)Pd_w%ronQ_$#(d8KQl@wRL8_6*N
zH*;f;Ep(0|B;1x(vuNgZ1a~Xn?U}R|7=wd3_&|x<_rrY4*ev$+sl{LefE~FNv<}2=
zH3tc|7XoxHeX||QC-P7zlZK&Qo&6P{#iiBsR)@e3&<ar3gwtCmx^{P^f^d<tsqN1y
zOr<t-P@cU3H1+-Ch@<!6jHpkImG8dHR~Ar77@9~k5X}P)tYx|HKF>iorMX$&)nnzZ
zfZQ{0J;Y2IhHX>kv&wf}wwp3CTJt4mnnPtgel?*^N&#8vK4d!<us2~&mnfyEy4l&o
z^Tt;x075=eKDoWWx!95FfL2bXkOgfb-m5Ya2j<?-Ryt9oay6|LS9Pz{OMCwt=&b@B
zWY?$ED;WA#jp{^y6Q7ZJzQN<M{yX0K8xfJLH=}qzGdE{Ay^4%^UN!Lt+*!)?9p?5J
zImr4)5>nyBRH50e@1dm3yj<b*N2Dx0PpiZE-pW<2ZmQ}0>gnE??bz8a*8?>UWZ!8^
zFNHFc74dh2Dr?Z{zTM;Z^BXEh{rG)%5zNU?<jvlE=Caj5RzlTo*93hEtj#VcIH7jI
ztW*z`_57Pqf?qJ9v=fgoKi?j2A%8bux}pQmPYzXXOUpBr{`mI?KS#cz`nk6GR2j6(
zpMU;u5ENS_I_PB%dP?t`jJMY!%h$@TIgk81_m}F>ov8Ja1*{{!N9Mto0dW|H%+I&&
zsGlL<H6sMI>$tgy6aQp8<``-k!&PSp$U8k?Y`Xh>HbDRw&-4TTa@$GSMzx5I9KeP)
zvhoOAx;7Q@E5mAjE3QdEwlQ6>lX&3P($|t+{YC2g7~24{`}UmuTMJ{m(gFYXHl8u9
zI0|(KRKtt1JfBdx(x+_a{kR2%s#`NHs1mza<tgvJIuMHykIcQnb1za8G?*FWDbi^o
z^Z0~%n*B|C+4cgK!o?~+Cq6ys+4x0R7XDpeD+(AF4q9Ot-_)G)NbT(k;NO^_g3P!O
z`ejfBp~jjJCjUR$Kve;`oHVhgIUJ~eiz_+6{YM4I-X4<T@|Th3jmgjcII3v<rX9cu
zfQ?S(`9>E=!nfPM3v{(M0ggAb|4q-R3R3lz-BRj-o_vB{eK2pf+Ye6Hs-{9d+Vsa?
zjEUXh@!*!N)Ces&-69m7boDHK1t$T%@_uI`o8L3hgH<9C4_Vv%x>@{ez0oby?QX^|
zQWaX?d1@C?>IEJ5mO^%L^W}y@+!9BxVk8^X$@LbAxIE1J_kUmeV*s@QNjrY;=D4$b
zL;PuTw6j23`+a_P3NGxs+SsIudXizM@U-{eByG*-=!G_wXu;o^foXm)K8uKd#ph%l
zQbOkw*HF%y;hvR)HCqdK!gUe#Vs`GFynA`=)3Otb(OoP!SPZV_O+?VV2r88eUgEOd
z{LVU&4|W;+HoL!F%$hRqPd_*bqY6l=9PMT!({x1ltkbyD*w~8@CaV8}gDc*y2}`<p
z6Ab;k0^6xhsl7O?b6a(4{PUhsp~z{TjB^U*y#<%;TR_vMw1h<b7Y&0w&ms=KMux5)
z)pP7e(9OTAt_b|IOes-hgfW$y&JYg7q$r2BDl3~mS$?uSm9Ke|cG6G_9gcUp^U6EG
z?2;L!;c%~q4D9yFJJ=a1@^pd2We2`<d#N-Xr0ojHupYrz{xa<|?;oj*f0+7zut}-;
zcl)cPz$9Y~ipR-!Ja{hYu$cKs({E@s|E>9#E3*?fiK};~SLk+w2V`7SM?HVJjWCt>
zK6pA2(AW8$S{ur=F<u+WexH7K#Qlv8|HbTsS*fVcmjcy1RaW!HcUQajIMVI=HHYlY
zOA_>6ORd*MCevsP1~+=VicV4Gbgh~kIlkzjbtpLUzT5EGQ>5pY(|x^PIXx2p7W#9f
zqm*3%;P_mtLb|N}w)Q{Lum2-Al74E89B(RDxS7#`FXT}DKO;03<*(j#oxR}8_-nUP
zwNh=ZLARTe4gId@VczGO)X6LNPHZlpMZC<kP>W|O?nXYkuzBXjSFfkO=4E5%Zy{Y>
zot~v$LJ~MjNBetTM>7{&sXk$dz`5u7PyQ+Hf3O9A-whwJij~lcWnQh4k`muFWxw@t
zSNA7!DCx~b-{oa-h4Gh)qw_a^xy{^Amr>)*Lgo&SHY+Qk-f{0yS9$bF+*IMF>+|>A
zZ_ixL^%+v)PVpfH=bHuo7(KRg79kU{?qC!Bu4m^5tv7K!VVNf*kR6>z?!I!mp-!bo
z!+kGMyMD>HEbLZBwNv#N+GRRs(^n&M+`Z-uIxmkdt>)@(bfY44Z17J@JgQo{ahm^s
z1~LNI18y&}soK%F-3qExe0qJ*<=a+xz3%5^@RN`cQu;+_tGg=~G{2sYzE}3OXvrFY
z^K-~Dv;R2${}_AEpeEn&Yfz~I(gXpi3Ti+EM5IYbq^p!r6ht~Gz4sQX^d_PdDWNDx
z2k9;JA|2@^^j;DYY6u}4clX`dedj;3znS|(K4dbP=eeKfy03H2b&gg3uX=^Tos!1B
zSC!H+VDW4Uu<Z{Ony(F>C%YbL!KBlnmZPFJCSdBfp>~!<Q>EgXRt5*l$2EeIp*G(~
zU#N^XR|b9vkPr4zS)Nu_bKcf3@uUzF6C3JY+`96w!IcN9@_ojpi4Kdu*RFjQ_xgW>
zhyTZW!;#kZ+pFT<%n$O!1v6g<#_C<Qca+nTUd3tqzyG2>gkm2jYlPT8bb092QM#!>
zGw^pm@PBy$7#DIhF=S|y3arx54eMTGN@KSky>m0=*i3s;RnyhZf!I8{^Q*t4#6M^Y
zca!+to^JUwISJ(Ca_h$5)Tt3Ub-h}#8tX06vy=$0gU1GY-A%oauT`wV$pbZxwna!w
zF$41Op7hfb0-uGtX%A6I#epgo_uj#53^)w8yF9kGz$Z1-L^Kc_g^XnNV#kOwpaJ~Z
zlF4wUj2;NLUzL95;=x2{NKxC1c!3;JPnW2<RxhYm#*8%T*TeZ6f%8lu|Eos*j~C|u
zdM(3m4BjyvPfoY{MA6PG^f^??TG*C1mhYt9rR7nIIE>6qjrv_%*5eOeBy}0N<w5~p
zrq|xrc*QAc#j~&f_SoBGAFL?cP1{yKB&8`J13E*Opl3!-akZOfL#(h{pZ~s}rg?1C
zqRskoZ!0N(PyPUJfU=X5u<lyiDAw!$Sv)BbQ(F^Ds+*LccW=^<@gNEFXQUg;Rv4>5
zKKXq_ZR9H#{eoWThx~rEji)*eom*AA<FiMwuc~^&l9V&1AOHTaEmF7ID-$<u_Qh)Z
zEW-~r1Wo)KFL6sa%h|Kh&<zyf$ZMeW^75PO>V5-zb=6OY88>LPUoWc<_ek#r{N?T9
z7qQpk{;_KIL~-UnEa0DdE6hhFTW@pak@Hbm)8}kvw)@s*HT#=PfqhgZK13zmfDT0V
z?P37#05dFu`YL8MtcIN2^}BGHzHaN>eS<-*iYRp=iY61PFNx5|!D5U1j&_ywbgI>2
zNvg%8|I)clJq{kbmd?WBBKwf{-mRpT_pVBT0FtCQ9$Ozg;e*SqG-JA1!vxCrhgA7d
zZ}1CrxhK7os(SrdMos<j2p-}2ItRgj#2!x|=2b(VFxlHBwQo)DN$osQ-WB^xO?ANY
zHqwpIwcde02^w{6th_HBDZ&?QVL_=;s*-+TG<Dv3>4&pFWj(x70Nl{(%Q<3n8$!k_
zSzWx(+;U*k^=h>nQ<V~^6>!=wxUqmea!7<9oQEXm^N=h2JjPh|n<Hn;o%+MCbN;eC
z%N7#fUMuXS`%2gdyv%c5+Eo82Myf>`EUeqQ2!{UlKZ6mLFjr`c6FXgxi1hx|*L$47
zFW$ySruUz}{)jc*I9s<!Na=)t^ttEYKY`foE6jjo!q=n%yK5b$p35S=$8YcxbkL^6
z?-&lfjAbh(8>UZHwhfj$N9rpE%tj(t&G2-L*O|RRreA{W={xM)G<=F>8;n05uVw17
zrMlnH^vv<S1!r3N;5etGonG%9IZcB)M<Kt{eVcZ1+!;!Qh!ODvAX$$KATaof7qVt@
zrN(%HiX;t2Ke0qJ0z6Wit#dN*A<FyaW|;iN)Y3>{fgsukE&t^vOFRmeyV31&lT5`h
z!SAl->Xd0T%OfosCq+#)(CtYw)J^3O*0L#t8F!#J1iLxisvBz0EkHO%5VVbP$Nux8
z;VAZ@38*<ySgpy8IC+Pi(lg<Y;10~a96xI{32;TOVO$UmA8S3AZD}9d$Xyfq_2F;A
ztexIK&0O77%S9-Xu|ivc+;Inhm^CKVGxpxx!Jy!$=^Hx*bjdNW3=u2a&m-U18LNNV
zm&wf87gjz>FOo^0FB4bS(=qfqej)Oxm?wz~v<nA|%4w32s7L#o`(mhy{y0hr9Tx;#
z+3^1TwCDKrs|N9Hkyh9=I#{7Fgmq&pbgdGau|@^sKkCtb#k$bml-7SBl0)kER?EO$
zxpsHCQ+qtUHkk%yB+SDpt8WZF82artpyqRydDh>3#M+-fCjtr<-+AR$i4Pj6$)``h
z<XL(sv#RDPB@aeU1bt@_635!#J}5J(^}WnIZaggrE<DiGAFwJYlL%ZB%N=qc+f+N6
z9Gcx$R$`gDBQl&8nt>{jdmBN|<JdIK@D+{j<yo>Ghdpa;@+?$kcwP3#B8Hd-m(=UI
ztHX*Qj&KrP5wV62I*_KH`HOT8vtw3zv;m>C*NuAZOgZFeD#vg!{!5^zUz1i*>$}63
zv9vu5_$|9@3lTg4GheH44AW?V-<81Qh>M(?7O&Zpb$WzVDtw6Q$@#5c{|IkSnOtE3
ziHlQdh!Mt2`Z>R<^mL+n)^fSw*;DC}%gyi4Bp?9sx~o`(@mc9DSZlQX<*<jyD}57~
z-G}o*CLq;U-nKZ=57SRCMn{?!i5_S$5{q5|q`v3xe|lh=is!^#O&d@twyA@H{g18-
z|F1*czmIJ_58J-4S_ciqy<i|=|J^beG<hFrerw`$_n+D}eGZ-JfScyrzY_LeAch8}
z@~?gcKWW<CilLh}0&s&5-(mlp;`(LY+D3ODsEY~lTQ>IZm&gf6oPrGDmt9O78;u6-
zb{=CV{<M!8-s3F`*h8$GEl(e5v6DGYjL52Ily7(dQg(G@MiC@ZpELbgY<uzZ{YR8A
z{#NYZitEm$)kfyDu@EX#%6NFXE&1r}SyU3w<jA|XP!E-qLiWR_R6oojQfwJ(Ds|j6
ztf)NOHE#c!lw_F1o9-gTCLcnJc_)S$I5h|6K)~(dk9yc@of9uN2T0Hmz)B;9m9Rni
z(O|Nvf#SYw;I^~$<&e`?#J4}t8hmom-s_X3<$M139-FSpZRmKN&FF$fJ>V3yE$Cg2
zjs9M%0lbGn_B2ud+8Bw~H)_tZX<GasyzF#zlQ5?x{TAWxXzN?_{@2#I>|1??W;ZCy
z=z62pbFGg>Kzv3;S|6iu7#H0#8r+;Ucso|zzSpk|1p7X^6~n6krQ4@V+UhZOeP*#y
z<`!{RP6QG+jwFfwp^(Ev&W9gtV0%R3od|?;<o6|whXVy_UDY-8*KgfTY%WL5KRyG(
zvtdCI5qrbhkSU{t^9gMd?o|tv-en|W`;Kv^)jQU-?#=21`Z1!kA{OzFVIc{=@#VP}
za)GwNSkl2&le=~YA|eBfpm8wk%m}7EBA+J<{z2r_PWyV5k55i@BvSCA`u$HSFD`Nr
z4ZFUr=3r@GD#J9voFqk)SCxsFMatc=lxHP*8Bcqhjy8uro*@wq0QQguHiZzYm*_&L
z5ou6c=Cy)<LIvP^uX}4C%QIdQ$3p>!O-%Wn!~fBG=zl-c1n-e4liL5XDE#_4>@gbP
ze-HZus9jy3RrG=;>sQM3v;iPmyH(Tp?eFDT64hOj{hEQ4{>cmdlr(m=s={wf{Mw{6
zyCl2$jWaT#i7_etk7>%p4?i|iI5YVFF61__lBh9Fj!7w>$c``m=w`&R_}(k^?$oAh
z3tSs=?*6x?$f|LU_euE1nq|{2LXY$@cc8UZgVU+44;CPjj3P`EbTuZpT!*LkXgnCt
zI*yZFeS8h}P->H%t70<n30c?vZ@z}5!6Hd7(%G+d<~o&HX`Qie90dNP7*I<&@KDK8
zueo$JVsO-$IAV#^KCnmpt`T}N9llW|sF!{-;OP^q5vcanMt4eot#9Q|VMV8M=tWO?
z>nKU2Wf80R{Q~_ovMDw8Nm;1l1Xz=`O!BP+Y(i;!8ua{aUa93k!MFL1Im~-pm#+9<
z%l7rHhpE%oLUtO-N52(&q+~xDkUyPj93OdeQWKC<gl^Wxd6hobPpR0G%dPY9O1NO6
zbN=p_`HNc@x8JWrS@g8{VDC1phF6L@S;yn4`n1H&qt_369?%>dM`h}J?$3;|Z0sCW
zTJ*kuLM3B$GxVl)Zz9GRf)d-9`P1$Za#K6vU_yu02rYuyR!U~RQx@@YVmz6-!L#xc
zj}7eM@zE6y<s?(XaBU2i5pb7-Pzd?_>VgH#$AlOd8n4TOTv|S!Z4c*jMO#?Yw~i*(
z78Vfg8WLB4u75hi5xO_lUx5n~4&cyZ71jekjvdG`9|Y?D6X?@l+1@U`kNXsNt{}VB
z8CqLCaDIG(&YAur{q)aRI;l~iDzrcRVw|Gk90G^pPBH)V^<4HuSDcIB#|K~j(xsEF
zGJNfP=M1iDVmJzdg#Aaosc9wICT+#N+Faq5+8|0#=!!MX&&Mp&ccXoSU(g2C!$(a@
ze-F=kiWU0c17$9{C&M`NhHBXBgN;~TTkUE*BGOh-a}7D!!oM|YfrU@g=KygJJ#Vb0
z3dx|Bj8A2Mx6Z+cbrh@{YM0+1EZZ~yM>OqP<(GZau^LV$I;uTV841wF)ulO31Q-g@
zPeBA_Yu%h?--bfyWVJU?^SYM11;6rzO&<H50pD=Xv{V_EB|e9};X-BNs}0ZV103_S
zP`_x}aJ#t|WwvXjCM`M|lU!zHQ`t$g{o&a#%DPE}<|%N2B^ojnl$>O>H_S3Q;$R?=
z(#x};4?pZ%bcG93RB8HGZt}cMv(uAIAr2)p??b(v(h7s+tc3mF8~fo(U4J9noO9-y
zb)gyGXAK?RpzM}=H-zT<fA;S`y{`0j<o-+nMd=gJ{!<-7UExKw+g?6q;;Q8&Nprq`
zirU`|;bECi!Dm$1gl_iSx5kzP$VZ5#mNvdG3YPKj*$HNMKAyND71y*Z;*`0N<AQ0Q
zqWpdUFGtIs8j(6`_`BC~%6jBy6a|A*itxqH%FB!j56X=i-t?|tVcsCH>nj&FIi(&c
znFHe9yIm20fsKo_q9KonT<tq89>?#by;jU=)V`Mmt5n18TlOGSAH%Eej<lN-H*o7x
zh~q^=h7z=2%C)6*IEQlA@ikdab_C>Br5y!P)h(o{%<bc=<QH<oS|$Ew`*qj^<jYw6
zi{wSmmqa}`uy)3Ua(??^_O<lwnMM!0J%zc)06^aj1pYc}|E$sa-=C`LLIJMvBNGuc
zAQ$i&0ES!9c|Ebl1H%VveMnj3aTx1OtnAe5$B_!p3`!k?R(USbv@p{cy33!i;}~>y
zJkifR%Cm1w_+V^6JXj)@{^{2-2-|}dgB})XP?M6(Ezb&-AWhh4m;;H%UrG1Q42dVo
z^cTOZdRaj+pSUlA6V7Akq(&i|)E}$!vd9GIa#+(RL{nDvP)tpOrU`tpW{NV$qLMo@
zpu3?7vO06icB#2C`+2O;>R^F@W3@3F(*Bp*tKZ@6hs5s5LGK=keMOwC)HvY^WFLqB
zPeX#HpV~66OC&z<4rQZcxi=4pw$1KVqtz`GOcnYbzI==2DOF#pWp65ry_k)gs(n{n
zj5RzB;^|XJq`Fh`!g~${a{jDteMr2tjEMr1jW~afY%R=@QYS}p`ML*U69Uh9`Zr7G
z`#GFijZP=pQmtSh!`g|)0S`cGmDR{MRui8Zf7DWdwlUcAxA4N>#;*W6PX54ST&oG(
zcUyDT_dvU$97&>(?&N=T);}GvWw6mvBe=1ftiEw<#oA9e%Hv5v1rQ=O#;bTzWa$@7
z;OGvTjlgr_q5g_^5hOQM!1z}U&R5!Lg)|)-s~ed0E0qD%<cQ?Kd|kOe0Y_-LJZioA
zMKL-Nl+_~BPh)cBiiNe}4_wjyM)l=QhZ!K3T+TueYVkx<`gl-mqrLI-a6y)azkj~r
zMJrg)D!`}A5dJRI*w%UY8~YQt!qdzkfIMf}TTdM$)7J=?`K|RgUa>Z!uWL~Bs5zah
zX~IrIKb*^h5soRw{h2V$D8$$py(B;gTZFe7Ek_z@E$(hwJVjz2hCIbEI5rP_*@<~c
z``l-5NYWNKSc@5~8kxA3S(JC-vbli8#7r+eCS2wP3YE9uirKSuSP$)-hfZyAiO;!-
zj)ko{#!~+E`?FZnOa-!+L&-@*IE4o0KSyFOJoTcGu-1Axjd7iX{`{R*WZ_!6`%$>W
zeV27s-`(muSne8Blbq(PQ&E482k2cPw0=bOfaS13^4FT!Yn6CTfq%jW!94ZyJz@(W
z5+TR|5>c#>pF_Xmm^)14AW^uGIB)mw*u1(B5Dy8yW!hE{WqqW<r5bYoWoK=vGb8vA
zW=eVKmp`l$!dap4ge>+(#Vg+PkP*=qqb(8WOL=5rL6$8gX8Z0KVCJ$Y;CpPqDOF%+
zjR<Uy6ZSb`i4}erW?4)xEWh+`o=Jl4{EqH+r(O>Y&kjI_h4EcSJ%gzN@4HabZ<34N
zd6f=fCzRLkI!nKS-I)oek+$fxiaMmiAK%82*)hHeh4!NpA+OESml@~A!?PKCU_J^Q
z{ZhXG)*E3L&G)v+led-Wc<3jr*nB(AC-qDmKumW(mA78)wJw6tN`W>iCTV=<1D6&h
z=oqYm0f_}sUE9m;SF+=a-AEb7Z!!e{iM?~_6*2P01qWm~t+?K~mE~6k6^?0R0Zn)L
zXY=%ps%+kbO;EF5D)P8-fMx(zS#C}%Jdd|gg5}MBHz6U_zbs0mO=C4YD}zPPZtOp;
z`?9nh3;2Hsj{mI*`TyXqn|Ggh1*ymJS#xwvWL%4}Q?#0J3*nlJ7dUb4g`TD0{kVnc
zC&{-hJQ6Rr|1b%8{}eK;YV&~t*yko|MzNjuzqeSHP}Oy>?`i109eRe1`vl)LmDvTv
zJnU!u)qc0;GFUx*z@o`B8R2o3LTQ)X(*POyM!!pP^|R5A8U!|G{Ze3Au%{sbOSS-v
zOd074Pjh{|@f2HfStM-fR2IzNROe6xi=2DwIYGXaS1|IG$!hr9kw1GO#Y{$V@DspD
zhE3B1L)Pz7irD>9nmWoelwi~D>S1zY#XvmxT!C#Ae<Joe;f+QDsJaRG&dX_KTzCK2
zZRhVd%u3<-Mt9?3KsLo+pfPLD84&$pR?n-(CmVyWzHqsmiP%WmJ!@!W3s{jqsX9sN
z_VL6OD%)ODHF9)R;otzZz6mwH;knAB`nHJsgwxA*bij&;weX<=G(m`f+S8-gwDq&%
zvj{UQ1o=lhT83Zd&q9S7(SbT2YoN9|wEeSMS%pyl3hGRtUp{APFr%KZk#K@;7VZqB
z4IX&wMflaO+6w||4OfgBk$&KwMVn$bk4%JH4OmaT?7s_JK?2`sOkHE}ht{7GgU2A>
z4$i=u@spnPj#*{bWhMhk)5#z!exy-nb@@~GqIdsr^43YD5~$Pf6E(D-P32&Un%8Ks
zgMS|Psnk+U@bp#5Pz1A(aWHVY6d~mmIY^$}pnehV%7UXJxy$&W4aprr$7M?#YkIgG
z1U$H*eV5^0yL9y$H{Z+aeq?W!>4~aJ9yzk@`}kGXR_lwo?xz9S9D!7(ciAWcE8@87
zO;ddRa|8QUz|ex&<r^WoH&XjF9+C-Zsqj#J4-&sFL{{-Zg>_Cu;-mfOA8DE2%Yy#W
zY)tzM_3h$M74TnmAlDeK7=DmJdIX!AvO_^@0K6h4wAV}OZpt#_yC+`1RN_rp*6TGw
zgw`lI-eo6A9EX}RgcvWY-=VZ0Rf?DOZ#U`TkUhTcV{Znt!_0gz+-7}#qoZB#;;WI_
zuaV{lHv~=(ne?Ups+5f-e&Xs$_6zdSkd5N>xu7txUvt}Jgx+5cKds0CHCH5vm_-|3
zbkF35Dr(61M-Az^;3+qbchsP|<E-v&1!v$bx1H@1pZ_AcvNt4gqnP<{;Qkw|Mq_4u
zT{1~YjfB1I8-O0D8?aSu;?PuenTy;#906aN;ng&anoEHO&b=NFJlwwNN(c~u`?YOp
zs}J97{IUC9GOod5hYk@ddVi=Qlg4~VmB&J@?I!;!e~<T6&4_bJ`7;FJuvx?Y;Sgis
zlzil&@@<QrTey`lzx1n}OZ;vw()O^EHSqm#M(ew>iAc5(BlsBspM6<DQ2_KaHNn!i
zo;8&Q5;Gi9HX^`Sef%>Wqvf*pr>w<%1$*&gu*o)75^c*0Jyz%P$?pBaM`AkA^upmP
z0yWmX#z1dx&r!mI^~?7)o*hFY#efFn;-M}=V08()A@~vJbgAsqh&-=w7};ch=hl4r
z>jL_NqBx_t5j!!C>xE3;&7YfQ-w&alQD>{vQ;&&Ady)6K@pUoucd@ZXh|?}o#-kt&
zbyY_&_MB?V+i8@-|16-N>_%VMl&J6&%E_HDDeo)4@t98iUX({c{gzAY#J5rS4P^4l
zp%72R+!mTodh9j;9%qq)DdowXl=R=0@R?4@Dm=4#S*0>Am&-)#QT{xC?&<~Yql+OC
zkOAHPqD}zz2$q}@fYFvFcHZLIHjVz+oz4w|))Rw|R<sPJ(;0>A^@@j#`BdJvp++MS
zHc#oB{yv%)IrkEe0jc}BvRvxN0xCyGcx45i9;{x__rI$Kdmoz4SAJTK`8W9oO%8wV
zNsc8xMKd96Gee=-*GVK_l4&zk2i^R=FLg9$S6<`tfEXd0qaf6FSB|z?F5YtjjP7Dm
zPv$aR^gkM6v42rPetIM0?lws#lxMVZ;#2GX6M0iI_^956{Ae#E@M3%lMpnmg_~MCz
zwkO|8lCpmhC79~Ri!3g!Z9bWniq5`+i$Bf8SzIoY<yfAXUS+mUk)sH=zw4mygZJi`
zm=(eC6Gmn?D0u71xXy`TzTui9%|W!MGgK6(`--G|7k$V_WMNNWw{FUF?3>9PQAiAO
zc*fp~ptVpjy(K5XN!CA_>^Y;%;ulK}&mlE9Z<lKS67X3^L!MIR@Wah9$RW*Bvi;Hc
zYsr0o&+hMcFoDpp=l#-$aTkV3NuLWcB+iGB%Gmq2-EJ5UT5M8WS6=BCzhbCYkcB?b
zq{yclm6yCUi@Ex7-X^|v3|=tn@IDs6zgnFBPY>kFYa~ZxGioFfzn5ROkzQwiY=)uA
z7Zks-7861L&FQMgDH$r`MMMnbutSndMKnmB6dDf|CJ<|wzrlx(*IDc&r@?>?W+M}3
zrPT}H$6+r;J|C7-u)oow`|D0S^9wgU5%i_ePI*XjQfYU9_#;+eoIbX__3~G<&uXWu
z&3Llw=|mc42HCPfoP{iJLIE{vCyjJ0?M$ieiEI^L0z87TuZ=z<-r&yBRvu_i+k8%$
z6D{mUV%<RZ?)tYzn!)bI?g4wm1FOb>{6gf`sHeY8@IA7r>btO4UiT<uc6Z@-gx-Y(
zebXm#v_<@EeBxgu{Ky1&<RV?|6xeX1$riP)QZNvBRS@`ypc^U_KdrQ*DkeUYH<wu?
zVIytu(Nu<XYZq{MzVs$cR6L5ja1Ox#2c07vGwnI<;J@fg2*uo8wmlpR6@M2LFfw7}
z%?_EHwD_`pJ!4N;qQ+V0TZ1k*>EyN10-?S2%E0HK#cMzfUp-!##Pcn)$uouPY)OxM
zPRmQPA<(bE^E8iG%F+9!*Y8vA3Uk0F11=3{d(Kl>O&%41q)m3e_(>bHj`8@Ksx*`f
zXNm34G}_33O8gf$ZNwFZ<$_2lqr$L12B!@H0Jey0j3iX&)fyyXH?G}f3%W~BNAjR=
zERCE%hG8Ikv3&hH3)!{Nc*q%p>5I|pRImy;;_&sVrph(i>#}5R%YGqxqY&BlyHrmi
zTUGyzy<#A3zccf2=F?rK3uRN%;5%f>%N+iP2gG=%p{!@p<zlTRMT?UAG;$0auU>qu
zf0@r~`5|FFu@pT+r^0_<relSMVA1F?!w5e-?_tVH)%s)~A!7MsERvl`AvoqnP?x;B
zh0QZxR1pTdp+|plypoRHsC(n__9SUS59OKVHjEp%ENV(rNn2G^rDG;dWcATD4P|Lv
z50fRAW7g92Z#ULASl0wT!>DSkm--uAjiL+D{QKDqVI4pHD_E&L_)nLC?V<Ex$`z(y
z-!MjKi*2-<+D-FHlkT-w(!lmGS+}8zKqHRz;l?aXN0Pfc7emZmXtEvkDf7@_(F4$W
zKHEC1{9~Eu<!69I*K)IFMJIeVVP8zo<(J!eUu6-O-8moNv=?g?Z<it4u_>cvctg*-
zJ<cOKpfBvGFUiHdWhFwM<9Mb$DU_|$?a%izNqgcyR6*z&oz0M`wf%>+JofO(JJYH=
zk|ENbbykucb^Hs<SzZgH3$yVBwTgtzt?9-Qk-&w_Ru0LNHF0IHvR*rrjw?lLuiT(d
z>9FRG8~Ug+ub^oYF#p=!7pc8+W(rqNUSU;R*@P&=*qTEk>G3T!*4~Y@-S>g_HjcbI
z24!5v&({pl?q81*x^?tdPc*!0n-W$j4hBTM9z}C?l*~sK<siI6hJ+y=v%vYK5(Ll>
zJ|7j5?3Z{sl~$$2?_9V<5Dw$-+IZ-2KEG_nWmeTB7e5w9Kv#h;9)8(9<Nj_fxhDRK
zlbOsxX+=$OzjpQQD*#{5RN*)xj{i5-hS}z_iKlfE>M7~C+#7c!<6`0MM+w&2XCzky
z-s69RULk+`wP-X3)}9Ms&9BY?e8`|#)bF1E*@x?DsH)<?-@gShnVkjR@dV_C129o7
zZB>DI-K9?c;~Yd(i%CrSg%e>n57}uq-GmS$a+Sabe69_gYsKg{Ft>uW9<TKVrt<OU
zcgiywov+lqo>M0-#*=*ZTBVZXS(-m^gtd%1s0<2vIl7~I1oMosz_QF4D??BY0;i}J
zIc%NSxdN=Wfh1ldr(*_cR=l`Q9Y)VtqVrj9U|inYmTD`H5TKYtMNZFrTl16r7%TZb
zX2xwB?vi4*2;OTT=G)5=y5;n_)<J9~djby!3!j+X_C4=PdEaeDzb<!klg*-2j_2Wi
znmDyQ|Mz9hL`HI!!Ep>xt*@HB@wq&pqK)1i(~Z5WvYCIuq=Qjbbz$TgrlNF9qjXzW
zQ*$wmpBdZ(TATb1OTer*>wM^{A%nc9_LZ_mt6pIeoa_&WPUMD}$;SGVeY(FUC#P<|
z%bN-36)Kb7Pn!-dJ^pS`{qtpb=+R(}+AwB-6T;4GQh7J4%*(aiIQFnJV-uZ6%C#W%
ztko8YIhgtn+xq|9`V=(w^`fuR$ipN!T#noTj?J$2O0e{tHx7qCKE>_THEt2<M;w+C
z<&jcun1#rWORwY5ifoU2>zJhTM9wALv1nCA^2N>)7`gQLV;RrM*{l`aw)Wkp25qZw
zlrtOOYqix)XJ%NJ>bpjnh2sPuxRnF)GisV0v6%htVU{fuq_}|#*T5<S30wIi1Vz6h
zKJw4lqV+sis|G-4AZBWZ2<XHuC27@tp{%>(tc~`)>L-zmb(J{4K-Y(fzhqSb<6py_
zbuz4`DxMB_0nF`t)XiU;OLcg(Qmiy39$9JqI!2a*V&#*)ZC`e^GIgtab%f|ibdSvF
zGmm`=muK@IW~pZ!zSs|!+HyRdE4fpaW;8?bkWJg2l$5h;;H|GQ5Me3v$k5XqtvXn#
z(F(3-37JH&879bo;W%5RdZ=Ys#q_wo6e@U$i0ded<9{B)SI$V2f}TjPPvgmO(*D5!
zM|G_WJp*3fMn)lH`1u>TVKiI0*#f835uhdOhRLO(0c{Oif$k`4lU?~Ko|1v-#Wz)B
zCoc!oeW6c=$tl%c)G(RZ{6W0evpy&U$N6K7a$jEKh`w`y((N)+gN5A4+HXG#GynPz
zMVQu(l}BGM?_b$@z`U|7#>)1YzFXjt`Dds1(a`g3v*!MsmNq5n<5o(Fj9U=VKdch#
zys}S^W52aV>oBVxyohWV*N1=;wxa%|&{N_@8~UMBe_+z@dyb=$W}g%&`1C1vzw(`A
zf>dcee#SiJ>>Lo)UVsc0Ju*}=<m*>x$kn6!YpXWk(c@8wHy^n-KWmMKZO_td!9Z8i
z)76iD-*YOX*{m3gu-<;RH3}4>44AYk!H;g4me6||8dRV2vG82to?K`8Pb;{P?1F>?
z5jmJU>!9X%v-s0J$M?!!1?8TR8Ve<tPmC?x#T<u?rJ(t^%gs3NOznjq-5_egdXd+n
zeI@l2xLNfP&b8?aJaqd>Y-oB;lM9o(B((+qE^!jX&}4f&-Pz)qW41QD>JJm&>JC4%
zrSnnklB$U{qog~ZRM`Eh+*EzDR}1;^oVY<>gGX<9-*7JU(XO>{RBiKrYX2hshI!^!
zWa#XZ1HK_!n+_`SC!&P~1Dg9)m2#D@7H-BD)C^KXo_xQJ7>st7S0VA|mx?@9W}foD
z?5^QgjFQ!C>+tW&jr>$_vfm?p_aW@cziV;L(Pdk}z1`DE^!Hwj{h@lte!i0hXSecx
z^u2P-Dniqb%v`wVE1~NWznZL%?%$76lq2fh0xGyX-*qwva^^(CR(v1}5jUGkrSv$T
zd_)?rHz0cB7aG#Iq38Xi<#Vf4uhW_36ICDQtUZ*TRtZeX+`IWOG0@}&i?98Q7v38q
z-n+pjj%~$KN)T9LfM-09`!8wgd&fWME}tZb&|Lt@mCD=3I9<F$ZiLY_*KSpM|73xP
ztq6#Sz|YN>tXf;oyG7u~p(4<C13W|HuGVn@Swv5ZM0|F!%d=!ix49t=Z|eB-0O{qf
zhDl)Qly7Jv&t&b-@eJ27sivXINh@ey?c9?o$~aJT`}fWDq~s+dAR^38CF}u)mMPk*
zqFwh0^J;)|@50eqUG!P9&=KZAW|^K%bv%kw%x+T8z#%Hago~J?7Wmg%L&$T+u4R|a
z?StRR?TF-a-{*8o;M=}C&r^NU@LxeA4NfFPkCgwi7`&IMBo<;PXw_LPo(bwM=SxZ|
z=e-ZkO^##Jxi8=F=OBH$Nl+4=dRy|-E0Z6Ldr%i@NfjKfkXRc_5UrE1Kh2_-)z!%s
znB&rif$a~n`kWt8i)Hy>c98bKAu~Q>xoQr`tCibt0BcnITWgatR>QD8*y|%7Aa+Ao
zNqQwGK{ZG57?;b2*}AQXzbP4uo1GDvf`02+bhMJR$H^yGL{TTC0*>@6hhiBO-W?#W
z#ox=q5xR%A#Q+eG0-xuq_uK6<`CS{Fk><d-Rl}~ZM@ka+@_AN#N||swFgK=gp#Iir
ziwv5K`}7vMB4cFDlRXRNI;W_*s?H<#dMfq!d+`tg*xq|dJFv{0fuORYlkw{vER(#%
z3)i37SE<+YTyoqZzJuk<{4$r0^~ZaG*0_;H@mq#(xfRHy?yWqpXHo)Wq^Porcy2*p
zyBa;04z4S=wO!(cjUut$<iir2=CrNo!E|q-VJs4T1nFT4L3+RxMOnLLnX@wJ!Og>)
z8VirXtV;YT!XOq%&nyyjby<bfWiDRWgAP&$TFwrAA;*3VU1*?!+`AcJy!V6SXp(Ze
zJldLH_k2SnaJIFGQf5<sD~ijXKWO<O*v&t(8(8VBJ@idb@1h|2aQ#-6C5AW&ds_Z|
zm5LA89nN|9>K;AR|B#uvr6)4A%d{ky#Mtf!AiDy-E!wncb@=A7+)X-J@=v06>q+!I
z>oJ+eHeH;j>pvFsBVxQyrXilsDii1k{R)-Ok~wB=G7P$tl`ZU3$AP%p^iv;FW-COx
zzi5Ce);ND_xZGCK{bxfqLQTgB^a-Q4C=-g`jga<VhQP%E25~mx1^(R`KAX=Vf(A8%
zl>kuVRqD9U;MG_p`O(Ze0F%8oXB7|fIh4z@i}C?+?vAgfCrrK5i$9iL4>c5cpBI)R
zWzH9OX+8Lz{=dCzuQT<Lar0M<$p@~vI%RXjLuGHcx#(1hBt`jUL0>6VLj@E9tHhE;
zqacAesHe#@WxwBW$*WMm!gMq{FGzB=P)ZNnI+q!rUa{o8@e@f2_HD);CMC#FQ+T2l
z_l#qw51TJLXtYdSa+<hni5kfJ#(wTzy0L#F(h$xMSvQuJiXXH`iV3nu)4dhO!%yE&
z5jE)VHh1`E?3W8!d)_ZuFo%)ML(O^*_}Q|bY@`9QwzC?Y;kdW!RUD9$26v3&*<ZI2
z&ygN=V`|4-?H?lWc7pPP=3=aTZYKYmxn`#FYjbc!xr5U6{$Yecd!l@HrZ?AwZfiun
z9cTF-@3+*gKf>q>!DuH5Bm#-s_Ldkb<bN$q4D5(<WjFRxx=sV}*`Wz^48!Yw2;B0l
zW0cH<kd5f<pLs5H6;ynZIQ@N_T$K5mL)W;=Xor2WmQ>uJrDVPWt3;!&xho4`AJxMY
z36DJTz)zhZ1xG-LmgCDRC}Vp|vB~ij%<mG7+}MKcWyPQ7d52I^LWEZfm6js)gz!mA
zgqCHuVw@gf*QDpfxe7Pz)jE$~1YbZJ2}dTEF-Sn**&6bsJg^EEO3Y0`ws_0Vf(a>s
zi!Fg0c{6}%hAkUivcEE!=b`w+oaL~+Sl*Brt<la1Y3gh4V#dO0o$(}$)D--Y+1{T3
zU!0vS2<Vxm27cbvd~g7IEN~<j%3H=7?Ojpe962qo^}!j7*?^xf|MNQFfrZ>ztq2d?
z=w$Nb2R8bi?52POhJ6ldrhW10PViYMQH^QBBK$dtnrGMe9mn(0Z3X0hO#OZeDIMqe
zM1*v7=%^VDsr&i}yAtbQXIw$`6M#^u|7pBRzz5of6`~Q$iCGqXLq&Y}k=y_<;<8%a
zMm^v|UZwwX(oBZPX*W>RMn7*vPPLM<q3wEnhEAoNs@V;mG9f9~&k?70P0lyxKG#Yv
z;N;Y}tffsul>Ov;BSL}93a2x!%P}Err}@*b$F^|o;${97N_<=v!(x6b7nb1jRRQ&F
zsTmpIkM<Od4h^9Gi6wn?#juN?6*^ShpD_ZUV5V@7X$j2pUkb;+?^N&yTL#l=T+A0%
z`Bj=+#LjPy1v)=<96KHPwBxkms!%l@J``$6yOH9^v+c~|1)$c|_*4#AD|~>uTFpdG
zu`cbwPv!;?#3*mVFI+!Uf>&!Sz$YVSTAS$oaH)KTM?uS*yie86I(hIB$j$`tuH(UC
zOhN7;b)NTAGID;c4`W-*;0yM&zE1@$3o*Q`poP87Z?9*Z7XtgKJ_<7bRJ^Xv{M|GH
zgq*|hf%e&WFGZ+dA(8GThOJ!PBJ+s4z_oNUzXHFj0`!k>{OsokPD)v=Sl_ebpH&D-
zo<R06F|CD;B$tk*ozf)4c)_qz@SiZ`BtXOilC`j}(XC?vKRxe8&YR$Dy~LvZKvCu?
z2~G>Uj@@fUwRMttK@YRo7*|AkiYwumZ&ppEeszuG=&p1<`9R@Qt~*{LV4s|(qmC-X
zRw9nIvXCBxFTwF%aI|j`4|xGA4dw2vxz_nH0Fo9)Nf_+8Pos>7pNy+_QPasJYh$rX
z)s=EdARBfm=E`y;7BHr0rdY8J>tcFbyWAdkY}&x}8QFc&^6T1ep-SRF+&p^yn_%ni
zB4Lse5wmhePiP14XG!_N{r0TD34kGc_f`TP<+X(EnQl4))HMz)EEk;K_0N#;EAm5Q
z0gb4Zt2m@0Gt1@W>{g?U)|2A{J(C?cci7wVh;qaTXb;Y)BvY;uJiN9g;_lRwRb~`Z
zz@}6=sR1nIFY;gI)Sme~Vs{R6c0S4qp^rA^r#|1+Yn_9#p!rFb!vjF|i4e24f7Bw<
zVCh2ltY5HPaS(C!O@mq1*$u{<R*>aeB;t-e9*49(cFs->#{SD1-iNjl{af+lPLTwn
z4ee>SB=ZeTw(Jo0+tr#uokTYQFyUk6^=?w;y=J1>2tLV)zfmh#b=YSN9?d-?7{<1r
z5<*Tb2*(aNo#J@Gn~}Y6X|^O%$X4+GneGf<4lY1fB&6g<?h-l30~(3tf?QfQ!OgFR
zW?eZU)NGoO*HxmW_(|@uMl0~YTs0Lb(b><zKj|sEo!$T}7Y#W7Op4P*_lb=F$6GEj
z15hn3%e;5%ZP?XGlNpy`DN_aRZIdWFDo5}YI>9gAI*L?=T6eh|&^G$iGEUZX0KhY-
zvrb08e`k%Ji_!wLK9B>g)EnmWacQX>PWpa0a&BjWdv9|8lf==e7rE@T^cKt`+P*Is
zdelze{qZnK8UBt5Y^1QCIc+1LmpY!3%=Xtpwfzp|l1*8q{j|t=1XXI#e_Dh0h)9u`
z%9-7OjEh3j_we)9H$O0TmU&EHOOI6+VmG1$OuBS*udXt^nga29fs^=7R6qf4bJ}Fj
zIFjS1q+^d=-s&cHErlBe>&L9Yu72RA1M$;{tvV+UFNHcKGbNz7r69FaW7U@TeT8+!
zN^-{4eBbp(Mx}@8RuC2Nra~tXFFM5<lT=yC40`#z?;yfKRBny)2e7YC1bcRzcu})X
zj+xtKh-O5~$&pthPcya?Imv%@esvaDfQxg2RyEz0cIb&)YSOZH<%`zW$dX1lghQyo
z{0q`hjQ`n%T{+R+6pS5da?^TpG+~j#izr2c@pw0clM;HgrSE8|i|OSRs`a7{;l~4=
zb5Q06c7)$bU|lPeBCG|T6(Dx_fzn*$PasB8(?+o*KW1FcAcPq3ZUE{Ofqc)r(R{YE
zg&<%?uFjCBtmsdl{k)p2VE(x{o~wEAK~}uplgwr&a!IYA!v!74S$WMxXW(T7;*8K9
zhqQdsc+2m?gpfe2ay;FPUVJ@{%(#r3^QGteu1sM2i;y2z{@qC~<|a>IE}2G@^NG_N
zBcOw;izR}?*-W=8f++o-$G4;Ky@<eL#1hi6cj#D$8L60fz3#}zh<VFVklM{#V|ZAj
zE4IbaH9q8am|lq{Tib%fTI7&mmxiJvv*b_~9kaUyyp^RBh0iTy8<c+YLN1X+a?J-r
zBe{kBXDJ0mlPOVPvtI<~G8v;4%zCS|t|{iwcJndc)EsS3lH{Mt8U18_jn4f%w<0K)
zBbqXRFS^IrAKeZA9NNL)&it1lU7i%PHm9JH*s(;wFP*s<M*^g^J}UrkLo|b4X!t(8
zDOv;ef9$52`ocast}mv3eQ?~>^hJB$Kl<fLKxu|CAtW4jxekCX0!!EZT#Uqeum0TT
zh*tYI`2Y%Z)ydLv>oPXvFS*APog3K>B)>n{O0<ZQ1>Cl1KAAFr+7DBCW_YC*U*qew
z;tDJ|${EQq)Q<pfg&isRmyt#nzqv0Dq_$>rYm4pRm2$rN7bN9gt{8v*cRZkr-GFYj
zG6mH$p5cALNN#E<=uZr&Otz!V$_PB|$~aZi=#p2td5IrJU1|gxO9!rB<?-NuP3LG0
z(t|H6M84!4M#$eeEpUsaeP1S5zpP{Uqu^zDv%o`(xMue&vuqSa!)|u@Ufi@5W0Ko|
z7unR4U;(=Z{u{E-;eP&JHa>XvC9!>}R%vjzo85ov@Q8(4ftd4LQ79>%(tu^F;S}Wl
z3h5eS-L?1hTHQqAVE$A1RszzgF<t8y<~{RcAa-UAu~VNmIIaykKYx9O^h0@pFPrKb
zB?(st-oENUBR*;oWO$O`w38>ngt>XYhjwcu_ih9>^Smo_(;GgZe6}(<(%8Bd9&qf`
z6*mWOvqbd>liz91-HnOFCe^$6$wa?cBs|U{yHyKJu>fH52E%zjgN*Fglu?j8?^VJ@
zaqB*)<<$3Ve;jh6^uh~u;LZal7@uh^WCT2pey5?F_(w&nehj=6n%=tt=zrMQ<Whyz
zn|5;N>4|fRR*|r1u6m_4Qpj(=@)MF6s2KbFi`2!|?=C57uhqAjc!#U{Li}RQ9->LB
zq`hGwI>S>VW7jdFT&BsTQ^r{Ib`^9O2(^>}EvzolHVL{|T=uh~Jev~tl!31-0n~>4
zz>skbYXQ5QAL~cnh)DxfGXnpJ+6|Qd4#3^snPhv;BU;|I*Sr`Fpfdux6*aMwGcz|3
zWnB9lXtFF=^U(nExG<2l9O~QP_b}^&Trf#_{KcdU7?st+42i_fsiK8{CRLH74KX1y
z`Lldboe7PBN1?581xNdyC}XVDCeqVt?T=&=BLUFr-|7d>>UZ14(>L}KJ#hNAe9ww!
zaHSPHCiuze*GiVMBB>`SZ}&f3E;m|<FjHxg$umY#zv6$G6B(3#d;#C~lfOrD#N4b|
z(mwv2|6yA~v@rkOY=$6FU(jEzpb#f&%{L5k=xg2V+x(8%rY|U;Q<L-Owh;}5v-V;h
zEcd78-h2l9_{sl$_gzel+JLb@w5bTQPc^mnIx9!CL`BX_a0lH?n?`xJITvhI<X}Q~
zOYW4tcqY`GFYA<4aw=7C`1#Uc68%<WawWBBMGk+sIe+SA?t|_hN~E}dPC&98r$tg-
zWt46i7W)m0rc@ks!y=Hld)(7^x4r=*6W#dqKqW2=33#-b#!<<bRc5lcq1*Ex7PN#D
zQ&ff<MmuYLBw!^bOWfbK9HSt-9~L5>su|hC{(e}7Tz5a%&Jg?e5$n{sV|$RfK$+X>
zj!fcNbolv<=F6^e54Iy&UKVz^#ffH_$D+l5?Jk4bl!2mVDe0LDcQ-Zxl0rPgamtQ#
zy#*r1X)QrEf{tyDN-nBjzq>;+!1J;^lBzJD%Sxo$f>g_&as9HuF{5~r3`lv;(2@78
z0YtqhRPd3eIVFM#{Udd2^_5T)`dKQyxrs?voQW~EOGi(m$L_25+`vz7j~ik4TN^pU
z?x5%L{XQjdw7>bN7^MUp`&b+}H-P2eZn#xme6jvW5+U&S9?3_cuPLAHVsm%H4Qf+{
zGa~C#8hd@-sxn6}G`mzau}DTZbq(Rg7*P}07_?%_NFLip71Frt`5jU27{GKhGbC&~
zVaAOI8d{*C2zLPqo5XO8GZHotes~>siM11LEzfb*-$0%)Alg66czlc5Z~KVKk$Gbw
zYH|;KQIsHT5(Vh#qP<832X1~ilW%^%qqgv2F>+c|E<n)r<I*qBi;lD*q;50MUgrS1
zD?&yxukE36jT=(!%rGM~=}F9L{zz_Qp<cwu(6aAN$1E}`W~(tttNLhhBcYMQ3mJZ(
zd*<DIYZu!K+vSewNHxk@XdkzhcjI$BbW+I~4rD2hTcu*3Cfy`(Lguh&Kdm-~Fa;~&
z3{)2U{2lO)O&xB14dOc#rpnq#<3j7tDT#A3#^uWJlvDeyq5-QXTJzB0p@aJCkUON^
z#u*&9p<`R7<vR3^T}K}nvXaqFt+*zr=rzc|vbe@0lI5mc6pbVrdzHNsb*H*SD^+gn
zIyo(K`UEM*rP;`yy>}5MIVm%fCUb|1($i=`p02JeZ{Jm_+OAcFR@)y&`Q5D8TPd7G
z02@k|s^#C2CB`~ss*p9KqZmT(`XP|na{IGmV)M^-Vs}WA)m0K<j~+qEnkUr_b75WJ
z=cWS@h9_OOy#=jYeu;J|Z;=r){LBTiPE}%L0|dBpHWn-(oUSF5r!^G<IE8ZA?8&Uz
zJnD=?Eqcs-aJ1QB0lnw`w<8LkQ*!!D@T%5m2m2Ne&tN5MR_f7wE1q~22I=$I=)mhQ
zicu7}46jH5m%dO@(MU=`S3P(v)-A4p5=|{e?Q^y1bd@jinOE3zyIbj?nX}pPzm+Rz
ze=295M8AmYh55|`cHraC2*%^HJ8r?W<-#_I&mcD7SI~k;U?h72-1^hB26`~fn@5w`
zY5}Pc_GgC)fGa3iSpUNb$YWdSN`t3<GXLJ>GX8a%f;j0oj)*xqK-8l-Bz=5%Z+_(G
zG!U)xLuo90jx&!v4BUOQP0G;C)+jfiW9+>#nt52oq}&{^p~&2^uQ*0^o0GYH|I7Mf
zC5J?F&#(FTFUj6DW4h<_+t4ocoxT*n>O$O!40`3Q4nPAI?d`G#>fvxns$b%f#H>}_
zX=KtOa<1J1c)KF+kJ|gRMvuFnmq$_?HG_6ehdA(M=FE1?gsvoMe(xy6DWoW8!P@P#
znvy!8zF@dG1-a0;xL4l|zpeCYA7{KDoXbro{5>-=5c8&)TQJ|88RosHv5-OR<va;R
z#kA4)Nv@ZBgzRU^EW9bm=35-R-A$VveJcwYmtt~obq>3lMogPrygwscVqso{QxU>b
zYOmZ>LHE|%tn09=6vEpxB3S52SUK=&BJ2d>tkBG`V#JB58^E=mX{(}O2+liVMD4cv
zN50v1Z}1Pl7&Y+>K_#8uZY7A>39Sm2l9G8;u>(jxzs^ccWgLLrxXK4X+LqsnEzE40
z((1-yk%vE5mBFP`cihBaCzTx7nVo@XU8w5|usZ{dLCp+f%);o3S0*KP0{XOozOqK|
zAgc1BKdfO;>nNtSYeQ4jv7yaskjMW`NpO6}&G(z`jvm9Q0F%=kz^`h53mEu!qKWyg
ze-x8lbSM<$G-K_A2@`7gppMMj;wzo9j(R&n9^i2`TIof%LCLx~`bZDkVN7W^^NO<I
zAMJ!Yt!qWJmhCzbPMvTCeWnS<(w01!Zw4D8ndVFhZ2BYYTQFYktW@GbSILEWw!-N&
zD$aEf?xuF8{$IHFHZpD@lE##m^N%X9Cubk-g9-zFi0r>q9oxu1#gi~i1wg}R3sn}r
zBGs)V2dswqF{y}i#7dN~3!mg73o|*N=qs&0OXg>aj5oSPf%@SbKj&S>(>9n40F6vr
z-lyu!LVX*?jcqgQR5x7s-iZou?g+j*b%dY#(WnrycY*y_f|7#@!gV|C{-5(!{@huh
zi^M9-k_}Qbi&I2XhVdh)vig{$m0{DuF2~<zdM$xT;ptuLQ-lQkrxizLQmy4%G0^L@
z-5{Ck<X+63_L;3g>HM2f6TS|E-Px@hL%zqJBri-ZnLI0&YcvheWYMLOO_g3>aOs21
zj*p_9FL*gz7jXM;nY;a&H9qgndOv#EwVN0Q$@1-V)WCd*I{(bkt-^f!phw5Ptaq=b
z>~fVAac1mWiCY6-;*mUosJh0H)k3CpEvdtA-mW8STf*+B-o5OA^G*7u0d!-AgLhbG
z=1kY0DrN|IM3&O0ID7_`Uwz_I_^?|>#z6pKW{?guGrzbvXiqSq+jN&=<y<J)x-Aj=
z*7RN>_3d}#Lw>_~j^|tOXQeDx&k67K{Cg~vu0?;Np?IdEu?Ol4TZrrh@O;-}q_8+p
zkTxsF|B8Hodsm$xvhl;4xlc{{#{f3FGvTtI9=oPTE<LCU;HcTIS=x`0wsAE%{oS1q
zZMePV6L<97jq|)mmvSpuYS1RDvh4Qkn5_}W-N8;BK57>SzqE*mqay;^N%nmyY=2D)
zQvcqp5t1<q^ij8$RskwSpoBbuf1<?A|8I7YH#W2Xe|Z7?|C5cuA8*`bnOSI6lG$Vt
z>}Ok5wjqeku@z;1bg~WJZ0Ai+JDcTHddA_BckFmx(3hXU8pc-D@m-&!igT4hg!}>X
z^0DOih8!*>iky`x+ri;zqwTXjEjC8UFe^x18sZJ?!Qjx$VM4U5=qw?1=TN~?ZETPJ
zQfWnn@GLDg_r)hYfY$1@B>j5~j+UpXX8|PdO%!i2RY^AwHJ_E2>=rAU4-UCuqC}xr
z5kVd7bOGj!50s#fPkZYF8#SzR7xTdv4g4*$@##ZV9lTQ^G!$bP;CJU%R?-470@+=+
zVN%H4%H3y(xGOCMvd<EZ`w?{ECjKrhxOV!0(afkpV_bg~LOKiNcIs{t)M*DN_K2BC
z6`~IF47GG&Lzwv9v<|sE?BQs*@OR-#I-KK0fl}^P)CnNo(HEyxph~tV;SKsD*L9%l
zEnA!t3(csJu|@2!J@$keAw096>#}AH5A>Pjrd68wZ9#?z1&0GB7{oYbXq0`AQ^zeO
z(|p@-usN3SRT*6*QfP2A__4+R4Xvlpe9`2)%5{|^_Gu{}cv(&L%=YD2@58Nv4z{VU
zF_(S1cJHk+8U~iO(9yuGyPX!}{DbY`H6;o%8=7>OM7NxB5C1C4=ryU-6y-JhB@XO=
z26kc@wrT9&OR}fM7-Y9T+|a$i&(6kq#8xPc>q#n(&$}F@bxR@bEY~h{Jozg(#&I)t
zIP)*5nX)|h?9CHbZ`)gXR^D1ucU|7Jt;WM8kgdMtGV%K8o<Wt=Q_rv8j^U@Vsi>-%
zqrCKXy#LG~CT%170i_$B(031n7tGC_XU!Yr9F}0IZNZ&OA5|3~{4Nwmpyj`QCd_x<
zt!$xRJCuwOPtU~0VAm@pBi{A-?!h$yk1ZDbqP=C%-vzz|Kj@9+_^Qy(ox7||iMABX
zfi+MSpD$&Z)FSq@BET056L1%l<5`jk(Z<$u?Fd;60Z+<$?wAAb@MmF|?CRD$bW%i2
zc0iFM-|VK>cEk%Bn{o<X-UzH(%?5Q}QTimw+WEEUTcNDLTn#4zvK6;NaR!Bgd26_>
ztd`o$n?oaTraWYNjDCa@c7!;`uaI>geA{Z2XTT49$_tB@p;sBu02N7$j62yFu+M&k
z)>xFB*p|Dfiajg19Q~VuvKQefE$n`HR;9d^+>q0Z0iHH%$LXnQ{ZLMy{$>&{`hT$Z
z?g2^P`~Ub^Yinn#T<e~<RV!<z&Qi-8wByW{sdY?LP$|h9h)xle6kMmzvb^Rj?@DD#
ziikHbZ`fvD5y=Z6m|7~30-7KyAozQCF8l86d_HIG|KERa<^6uYUhn7q^?W^^&llHw
zK>i>{RfM546|2?LwebNb-VsXh-nPH*<W|j;7Cw$*%C8qbNU+|LAUK|)U)1#GN`Byn
z4i^}wEzc%BJAE<ugY6e<wyB)|TCcRYaVKo1@5#v`$E;wR#*lq(U}n0{+VTg-PAu%W
zwv;VhcUAOEG5?mEcQvUN)M9ID8aS}EQ*g_B=j?~(n6?iVr;-f5xxhLHj~`~&{_JUZ
z1kShb`QTe>F-r-G_uxzzEjI7<_%0te?^YIkbStI59QRlD=5Z}P;%Gj>L^~bGSQ>=u
zSr!O;X*J^7$Z3~Q^^O}sN$P~Mz`t(ZNxgJn@>Z>($1+Y*${e4>zq!)NK#}chS3V}T
zES|H7Uwl-U9{)pstaOXsS`kh#{nTLp@W%(!VzS$e7qoeNQGTb!E|cFb+O=rooQ-&C
zpV_@sr(ZXyKA>`^Q7m`5DzHV`x^ksMI}#4M*HNj1s+|#O!UJ$?ckT><MxM@T=N847
zO>zQku!R0(?rQza9EUs(bhhTUR~`jBf2gm@(YEe#baCbNdBj#N4ieER9Yx`JWCXv-
z`Zr9wK7H=K&i<BV@;W8PkNspN=-)%(uYUM`onrOFP-#d9cJcIeH|P6Fm&CXfqu}+C
zf%-+gg}j;DX4<I$#r@8;Z3I<AMzDGP$7xTF+DTrlcY_fu$JcH@?5<xAsPX>%Z^{cV
zzeswX1ie))Z;9;qg6M0sGVb!KCw%VfO|9zL>jyu^s(Hq;o#X#=!=he>pIC`+U-|yV
zrcFDBzVZ7DIY#*24U6ob$MBg_mxRI!rGjxSb{@gV9k-acQo4ixrjK-_batxkLfh+r
zr|rAjCV;|rtwGDBpSErHbA3X7Jhx|TQ{IVJ9UITTyzuFTuhR+1t1Z`#xTj|SzI*yR
zy?p-mH1xWgGOk_vu)4p?$@xn~%wt&R4%rbL-76xC*R5WuFTgc{jXWs{GQvpPUkWyD
zuo5v6`&fA4`#)xVty#MS#vV(?>VAqEYdnVy_IUE@a7#qPG*%j{xdRTG29RVg-)w)K
z`g#gbR)6qg|0A2UTZi&iDNQ%}m{GsQPrkhJ+4J^v=(;(Q<=F3MIQCl@+SU|+XE7HZ
zWd;=e@NxL)#Eqbxij%Fkv<K*lgY5cKqoI^=2>UWtFSU5EbIMDiPW|X`0cvrv=+Aji
z2TfistPX;cC$7I!CO+@<iiCPg&bk2KrTO~%b*f3V8Ggq>c%*tgZAcIm#-ENFAB(be
znRsUp0PFyyZF^0;+`&rPdHS+6@O#Uv0kE5=%^&rurxPi)jm5<ps;Y0Yw*M*qU6UVg
zIefjt?eZ({Zw%*Ur|h?%a@aVRjk=kVw$-C+;Ms49_giBBI)1+I{PY7GvoA~jVfaqv
zY`pZkoD^coeNp?O=Hzb_=Q40G!s|(AUE|P39~;YmSGxGCAEjwwy^$8UtL8U0*)*%3
z_Ph^FlD6%+g`aH|g4F^j>1fghb>=ffR{3b!Y+LZZE9K=4F6mG2CT()7wMA-T8Nb~V
z{p!rq^{x9#6`@q+2R1KOS6J&Vn!mi6=eeGqG$E+eyWd>n3kv^y%<1%GZ%_mGx0^0c
zqYeRGw+(qGB>4RQ*pHEJy1pr3TUp@u#l^*-oKN0ge!mG1`gr5gc<=gybC}GZb!{%&
zPf0h*<2;+_q6X1_AS8`G*g#3zO%oY?uxq09-$m?csViWJ9%t+yE=Y*E?PzDeV*1di
z7$Yk#_>WoqcFO;L!?CXcF1enr|3j<=*!*&E|H}=9E@Hm~(r+pHdw?a^Prtj)`t13!
z-|+c&jZ1vYM@5&(`uh6Xkhr+U>5kDqqA35Q!fBrB&o+#Y|C`+YT84kQzWhJme-eJ?
zWqj`+(SW}{?RR+^^~-DC`Qpq+Po4&E%*g%26TNRy!yg})t%iq(FBzw&cW=zt{+|D2
zcbLaS>c30S_kXTB_xFzd_m%$_1G|g=gta34jTHrEP7r_l^nVwtyr<_j`dzO743zqg
zYwBM<G{gSA-J=F8C#2f{RH*+xX4N-<D4V{je@6`cFT8m9WIG^`QQ(gM|0Dl5CIg&w
zuX;ou-I(#|_3`oXgLf&O{}C45czgDM;pPyR|4XM&2{x{6EG)(AirW6SG5*~q{TrK~
zg5Gim^gcb|kNB{+ZmiS|kOvpdn(ZHc5`P%5ZTJtvSN<=}_`m+|QV5udjAa#O`IkFf
z(w@%G&u?Rn&c2Ije)6=7_bXx;e11JWJ^lSO(S={$_g^j~p99mzUTF9gkS_1+_Z##}
z0;f&*=QjqQ_<ahV+6bsE<|FsNdH$|B{>=@iS~t2k{8d5z1bWFK<o|hK^7c_ae|9a7
z!m$<Hc+2`*-xEmc-pdE3{=?n<Vgk-z27lym;c_<I`~LdbUboM;rq3dByRpSlj`AdF
zKc4TE)Q_qT0+$a9?#A}7<OMWc$;QusQ2Y!_mlE<au1FT#$7kCSt@#n{8mA}}VaD=m
zA*SC>?VGLf9iA&?F?J0GCpk4s?Z<eGC9?!kLx%YZ*|>}EGT#^uV^}4}p0}`9QKqY?
zsG$*hS79ZYAdjzPBXjZRXB(sMv0J$Xg;PnDZW)Kt1CeVrf`VjSe~;?&!4_^novc}%
za#FN#KYA~7Kb2Fon?;?gk5rP>cMU;gIHflvLIUOTtYaum`z$oxNhNMfY6F?>#1IP`
zkS|K_gOAwUQ(kz{(G`xI@RUI{sM^OmXtTBeW)q7to;hU&R~V<j#3VIYXI-tcqS|P@
z+mTk><^~Oidn$z*59PH&xwOM$+Hh1=k;{OyqK<cJY=l7X)z)fX5<Tc_Z4ShiL&G%}
zL~`}QFvr5>@#n!DbIpbIny_9}n#Vw6khi$5ZP{T2LXkp2H^a-qXlCG1nuw&13`0q!
zrYjh!pH-S0z3?+9%X)WA6N?cImPCV5v!xZymYPcNt*C*8&!;$h?sfZsQb)O`^bjuu
zuHzjS0(@JVaO?YD;s|FGE+{B|<@1qQ24ptmh4UIE5QYg;?PEsn#B(w_D{yWcNXuOE
z;(@4IHmJLSztvx|XV_aa7kL&Yt0S&W=66Z!f{(b<AAn~(6nu~Q#s&o!CFMR*hjw0!
zs0vC@<0!(U@Q9sgWuaoIV6BmR)ydRe&5xba)iKnU9Tpy|am!G46EY*V1RUd=s=ae~
zOt^=lyQ3G5InS@)Tw{iy%q36>LRTJ|oXAx<kKXqWkrsS1?W_n>J;s<3Jy)`5p4Qg7
z<I@HwB_z=W+0C_}N#@e+8<8q%RPLg!v*+{?T^?QV(upu9xMR!@GNTt54;jw1E<eiC
z+|!SGQ>^8U_PwfUux>9(7>KGgEC{!svCtSvs1Hr_K<XCbb=}XCmxwsyzNnO4#eu?6
z`5<y|=>wY>==E*Fq|?DBb>7j)pi*oX0#!#vbBC#*8n%rWb+OKFmegR|e$+OI=*wJl
z(6%b22}rOed~u&V8|!3K0PotBF3%_B7EcLdOKirf>%lv`6%BnbjAF{8mTZ%fg=dym
zTN1_cJVwlFABw-ys;je8v1~)DIqo!6SU%GLYD2*{h@gV$<Get>y<ZK)V)5-h-|3=X
zXjAIV+bMp#uW*L4$66)vN0L;fUU0@9GWby>i<!xl+d`kgmBW1`Ytj=k9Uz^K`wDT+
zFUs+8{HC3x`Qj%6lz*XJNv_6W-D|Qgl9dJLaErQ^b7`woI@BA6M>*Wpmzc@&+7gG{
zY0LtxlzM`=E4RSj24PvBiKClM7U-w$*QeQ*i$;RMOS^l&6<DsPoG3F?l=>*vX4YUj
zD8>m?ZxLP|N)E0x7vFFDvSh%O-W&B=97SVJKVSrIp@5|-ua%Q`+kNyXnJjP09(pu|
zjv%aH+-wI@Ew7T=2K&y)9Ei*+(}_E=S)-|=TRX=xRk(x~nR#-4;PJcc19W-P-7zkK
z&;FF?wOl!==VY0jXn_RJgiN%`3qwxQGcvI=_MPnKw$MYmFQHG)2R%s}Z+(%oXd7!z
zsy5r#NXz8DXkBH7*0CWIW<-juYA+O}G8*2j$~vQ~DMXrX0g1wPgk;6`o1kn7%ckRb
zZuCfHaw1@^FkaLmC>>XQPqBj%zQcQ33e!S1Q#cS^UM}0=WH6l9)rA0c$5c@s7K;-m
z)E#M#7L64WJ8G)H;-UVu6<ZG)UYUt&ZY5T-P~@fV=shslp<vgRe%)Q-Dl#oe?THU8
zq@~WmG-0fx#C_zTLh&OeMk3V{p0H{k7$vI<`hqJBRmTGDE!MsE&>JXCINKSemy+)-
z1Hai=*xZx%^4y<#60LIDMAp@k0{A0}NkaxnjhxMcxny`^YQ}ZjAB#Q3Z37lR{u!#;
zJG_NIGKx)OS6E)P&*^>+HI2}%TNw<|0=aFXDATQ=y7WL!(|(GyTQKKJ?`JFQ%kL3i
zOj&5|t?vi>ww!}U<tVe1l74KDcSf$pX_-0yNpT{5swPM5eH$}Mo2nUb=ydmL@k}he
zXg<V?VrGWJP*`_e9(z%q$Z<$PDDslH3grp*wf@*SC5+vBXKPC<1nU`H9OB9AUiL=A
zri-ZD-UQ^lS=-u7Y^6W9iaeR(h)tTQsU-Mod>V;;r>D6Do}qryGiL3Mq;ply;fsyo
zMMcbqmSrrBf!xxHh<^;`4k%8P2cdUr2}p&CoUkXwzC0^)KZOfuS_k3Wi~TK?{$Er_
z`#)l>>-kcAu+<`x564|Wp$icyjJfhq=;8`0W9?>iQ7$<K*&9_7+`b&OM;mO;6y@Tj
zo5rNsgp9`Ufn=}7YHd((sub&MXu0eJV=L<{pL@ZlhUEM@G{4sc4O1gKo(SuaFdKfZ
zRLrMY6~MkpEf1nP%wR&(=+)mkk!g^$@LaT_HKwVPv=%((td=+43htqce(ZiW_@ryZ
z2fb|JR$_mPV47PIwR;emlp5M44^`#ck^H*W>bdfhk19aB2e+!K6xL__c~5q>l>KYm
z6IRuN2TwR#ldutI$)lsLC)kjEw7T2?g_BuqXt|(q?MOKnvUtdt#<F}vZ6%Kr(lFs`
z9(<xa8y)PY-6A}O4gkcp0H>9n5ZiimU*jH+5caPfPfir>DS&lNevOKrcxKesCfLGv
zrxiA{3p|+XcP#jQ$z4v%k|LgCjR8#i;M9!|Y`z%SL<0J*uGN8qoSbZ&6i&TDRZi@L
zsE$xY)HY0AGF#@jBWOccCkx1E?u>4S8KbUTU2-xajMQbAGCtHeHS(e>MzIuHAFzx>
zRUMtKWa%()0};P|qAy!jNl_gw5g61X>$k-2BYQb$f9|Qhnk{}U-qU1ZA5%aDSy_zD
zS+GOQ?C>|kf#km#CWS9JC{cyZK4Ql%1-X(z3W`HMoR@{@6<^4Jl8PS|PMK(mhS-TY
zLG@<?aKsc7{6Lwg1Y6~0hT$Jx@r8*WjB>;yc>?Ov>!m?IdM}<L-bD!?5h(#1_b|(R
zW$;RNrd^IX5D{={0<hR)#(kEWJ7yI1TSp=UqJr=iB3?+!@#%9zn-YLvp{iG#qbI6^
z*m%aIhUTX4FNVth8bR}#N0wb=CUPIcW!4e2(DJ!TL)~0av}Yk&q{SUc7gSMj!TQph
zTZN?9o`_IJ8O$nnd3=Z-cy)_5$KA$rsm?!SEX6)2Bx8K2&b$pOsze)x7-|#K{4us?
zfPAg#E=g#;QA>ECMxHCP=G6^DBkFSqTp<DYjf)~|^XIyfAiA2~R?JT~!b8a!O;Vzz
z3p0W)f64Z0h=)42r_sv>GoT4w3~P&Y0nWyH-XTFnLA!e6y|*A{NBV+OY$Rn&496us
z3q6alC_D<ak~l=47uLG3YhJnH0M$Fg8HrlH#}6eGFUu=VA@jWrXmwtNXbgNA88nHk
zcb9m^jGjwvvqI7i6PXP_&}e#7U^(e)(&8NB3&-vY(eHeWspDKj*XEv~Bgtk6J{Op~
z&cPT;BxU($P@8h-K_(gjeTj2(@lwmagtI5D;0O=e!TB9yIjlPnI<l8CpV`zp5I=Vj
zyRR{@Au-S*oeM-lj38b?M`U`I_DDp;VrjcZ*sd2`C~(Q1HZ2z*iQT>=RZg{l78vY5
z&x}<5l*r6bAq%^Q9(OXZXG?b#R#r^s5QD@!;sQ4FS*h9D8Bp_FX*F9xQC8SZ(Ev9h
zZzIY^p1ch@3m<ZDPa*haGYYh}$EJWxu|i7h5R}2n$vXXl!pe&bWPN)DsL~L~t4kBk
zfi+&n?TLF(5h>IlG}JP$u(`d;JE=0jvIc&sMM@Yv$~_K(407Y;We|rL9a(!t-!xL#
z>67r>08L|}nt<>VwQJUU9eWHec%Pyk?F*ntF{TNkX!t&wuP1sh5jaFM^Q3a&5}>Z9
zMg@X7^MKY-|K^yA1=H0F$DwTf%jRQZhBS;^o&jq{W@|aRJ4VK9&Uck-6>5hw*@(tO
zCZpQRES7Ud&|IE}3?j8!2Rx!M9vL#fwb5`yMdhOXThPJ>v>-XUlQ>634tk+k*dyIJ
zyT)=r-FMuZ8l;&1svt&2SuQv%h!kIt+t!7w2cdjJim-f$M4k;(U8zRa`O6du=H30Z
z0Jpid;+2~*o=LChYi{|>glz3y$8#=ZzrhgnJagqCdU?Nj%596)%h|GBKpWjmkIrXj
zqIS4$hN_DY+)58qKp&PR7Y6w2cb}LUf*yG>i^4g_bM^Q`@}Jy^;U`DfcHxx}oi7vL
zWp^`r_*z7LW`&*bmhmj61VOk;g*2Tlg(&n&y&{mkU*jqanXY!Up~r?pZ;4uGzCvT1
zhap}fDkB?wEs6!TiH|%@0S$r9UNtF(vh?_2_{aBvdPF%T_AIkC22k=AV`yjJ;_P-$
z<4zX6Kp%ClF{WXzbog4jC;nWv(ibMv3#?kT&5`$GC<Gdlk;6wQNqKy#sGM#_<WD}t
z(buwEmu>GBHZ-KJ6<SK_fbz$cdcX=8X>vY<Q3iAAYJ(w&eV5r7vhi#Y7P-htam>M_
zy3(lAkhEsK^yG#V*HqT>GW`pdO?N-OL47ulr|>JG?&DVg(?QWz!wg@m0=^sZ0fhX_
zVkjpvEFWd)>&e3uH6JdX3T&BNCy;H^((f7D^kso?B0UV{AZjGneC))@m>GjQH`n@G
z=w)X(ltytNmzN<TDs3dQl2Dl&s?P&KYmT_d4QdQEO+wx)6y$*UNVCi`Pt!udxzZeL
z*a*bU2rxo`%i=UcDdc<p<a=k#Y+jd#*0Sun49KA{H6#smVcI3#@ew6<i?^$c(#4zx
zz8w`FHiB$J?(x<K^sT>fsULGc%RLquvTG%&&%ALIqOoHvT)CE!vY*l=r{rKMy|Gy~
znqIra;PyJex^i*>;pmo@G0`+O<EFIIZFvxiD8}L66k6N5lZklqhaKLo_MI+VVUZ|I
zVKjIJ{Ah1V)^x?B{HLO+!QjFdxtTA{<%%C&EabfwCt`@!VI#*IrCE3}Bauwe)tjMk
zMb=H=nS-d>uS-2Rp~tpRfc5e;(jO|QLKM;V4M+DtD2d*zezne{(~FtXKudyS+X2Z5
ztIO1I^_J@nQ_l|uYjF6rZLY@Bd{|sjL3f?Tv!u_1A~%vVo4F(N-5{ZTcPRkS<_rWI
zPk0Ew2FlzwWn<^RQm_cL-K;JA+7dKL(7WJc3a3%dW7hU3y{H#H$9L{;v7?R_5I_3_
z7Lyn;(aOgI=icK@jS;fT*S8$dA$lu3NdPS6%ecEQS|8O6Cx!l$Deb=8(>Nuv#8B4v
zc%dJa2`{`53_uo~U^C#HhhBbAkdv;K1Lat9v(Q#9F!Aj})m35s6nP&Aijk*R(@M0p
z1If19?*EY{J+>(34l=1Cs97@rv9z-?K+cN&6b>l6H?GIHsv|D6Q7;NNkNv}5+mf|L
zXy;#BYZt!ZlwM@aSRN{$>dlR5sG@CUH8u#qXiyEOD0<|@0o<2|8PCoTcIxRHHnEGk
zfSkloMP~p{A2T|4un+>n_R)f1;%CXHJozt6=em~5^7>9-Dl|;ORg<>Svj@kJBqhW_
z^&^BLs<%+@Yb1zWvteN)Q|%>s%MT3d>4aod1RsJ6Gtcafsq-$x_6MQoy%UO)M5cu~
zTkS1-HQlj2Mq4&DTiW=-R}SJAju5WGM00sf1tF4z!J%(WZAM2hnQoxF)Ig-0E{wy2
zMwEHB^fW!qoEoOq&h4`?NO2wuJW;P!5}kCFK@*V~hwLe2P9mApblI&5@ICeB3BpP&
zjk2e|7bIpj<vj!nSpeG{M9Q-z&{_DfXj4ZsI${~hY(koAE`h1SQ&`8bFtf%K(&SzW
zCQpWei+{A8I+6qBe+f<x%lAAVMs{Czx)$xF>x1p<ykKhF;8|T*b<ksL;1M1na3)#)
z^EaBm!h-T|#NgZ$hK=fshy~tc<%9Stv2`HFv9H_5wKXVawZBQ^hiq-N$uWuLhb(ur
za%-5NdP6*42*M0iQ0&ronrg0?NkpByJ^4ZCj8X<PP_(}1fy7Hf^QwMU%3k>k4@zSp
zW}{Q9b^JW*xza(M6-gV`-jB%5v>Tu|5v`X{4xN3mUR0lkMESM(>Cy}!M6x5|{DSoK
z!)Ab0!--|p<thv{ekjCVS>{bvS#Gg`nt1r1lv3tBV&$%`$3S-Lp*6tj*hCcyEI_9K
zI}Ytc&0aM%#wFn>NJSo~cCM*M{lYsS<!EtU@T709X7%O4>d>XE;<cH0=)rO+2Z?^X
zQ-AG2h1j?_aLC(_hI1UVoV0tME~A!R*;<^3j6{+Ti_5KL+1lBKEu*yXoz!ZMmQx$p
zYhh+%R?dguq02{#33|L!))uoh!^usRh>X%QBE?}9bDqe4HL9D*%2Sm(kU|%)L&Tq&
zH9uI};YrCmcO&A<_hp^}%i=Yz1CaHB@%yL$s_2>SKePf{yl09^$+vFGOqciL!>^KZ
zl-vjLqelan?ifKXRD{}`&Iv{joJ0WuMng*3uCXGrsQ!#DrftSr4JA>orH9q~a|d&Q
z(C{lNttbQtXZa#qb&9_jHl1kHO(6c5x!k|<sp0fdoajmF{6#_4!D<jRlIGiCw+~P(
zzo3d*sH}c&#sd_6J`Aw-)IF+#Y<dt;JG<7q$u4XpI6>$O>&!-T`x?1*IUu_FDop8H
zO7$Cj&HhGhx5Lv;l%Jh}lX=jGxDZe%$K_zLpb~K`fmTOB)4h@c98^yOHtoZc@>=2+
z0@_FFSo^qFI+EY_XZbGEyh?_)M%`<#%FVI$Kk3wT+~V&~WjwI9vRh9f(Zb=H6lYUI
zGzZysGQ}8I#jt9aLr}3{)-H_E*_EUCsA{^?^gh!u4r6t5SRU^|QCO4c)Lj!T&`7}U
zQAiPbR&34Bqz!o+DxiqSKoSZKBn3Fe7`aQ*#C1@2zbY+k@ac{OJh3LSGeUTTGBpTk
zk)~SX%j+)chI--XAd-zZiy!KLEgfS@5rn(K6+<&vk&n2;!P&-c57TDFH^jl`^1+bC
z$jN!r*gwIu?`;3TGqw0np&6GwJ-%ne3=PqBUxf>^r|C9D_=mh?9Dg{&(6`i}JT!<5
zu|&4o<rvz@s5_}@7D6d(p{HcQI!l2dR5wGK+f$kiiAC18sYjz<ubGN=q&LWa2tG?H
zswtz!rwzW&bwsH{)3K+%GkQLV+*)`vIq{r}z3{Y)1Jo+@^-TND?MbTVKD>RX6zg5y
zHm{>gD3Zh7p71E^a&#Chc2tBD{=C-uzM*kg*YYik&fdhkq{N26x|=zYGmFpD!*+a<
zWLA!V3hzu`u}FvVD-2VQZn3G$_5iS_y1l8XiNk#^CD~MIqtYG>L<wiaPEk8uBx%+r
zl#g9{F%wOvvlVyspsEN8YKy(_Kuc@aHOITu7(wZ1DA2vZ^b8|nN91`EIAt<&sKU#j
z^G7<J4_c{3R2k6PxlNCot601zqoKugqp5sFP7+i}c1OhY;U>Ue0x?fAbst$&>Tv6j
zjaO+AvT(ZY!(l0S%ycV;;-|PaA7VV0`UxU1`f9qmA@Nr3ib(<m$cMEwRIxRB@5{4b
zLMH=5iY@mMQ~P$sRAz(9?|>|0-6Rcm3rmvyj*2Gs9wML0<pd7fJ@WL!6T4zk4w?~w
zr3q!KHvj=Gb_s8ah>=~@R}WRPB%yCQ3giQlp&1C>y1UBL7>3VtD$NXsqBC-_W-w8W
zH)x4w()pRb3Jv6^vf(seX3^A9(P&d>n99F@aEd6ywBIAkJqu+p+-DYJm6LK-k*GEs
zopDj~))gVH@rNq`U9g3eWFM9^xRX^?Y&;hWiZLo<$2PHXJR)fgR2)K7d~S3NRHPRO
z!5bkg+y>s$$6Hyz(ov@ENJ(>-+-a<i5>-~}Rc&S{F#{%szL|KrW53}sq4z%82`1k|
zs(9d+KitHYP#A$jU)~HvQ1@W{QOyxC6GErjxjdY|#Zq!i)lnO~A*BhDmSYHN$ZT~{
zL74ku6ML*tbpV-dH_fUVKkOdCTsNz&G}m;MWA9J*s8Z0hTnd!CTU&hn!?ppi?PnIo
zlvW^T9LRec1vW@CoeC=KWFE~0sEh{;s3iyY=uj><;CTaAB&=v{a8VuRI#9wDO^=go
zkQQ|;ge6BOFHn=|xFlPTKzG|`AHWjbUj3+*7Y7nwFGb#LotWG1$xELaJPx<rI-8#x
zdzPeNHdkBAYK4u~jgQU6L`|PF+B8QLW5hQmaxZFML${|oFW=75D>$0O8)1z62p=$6
zLCp_6W(oEehjY$(vfH^r7s}|2U&CSeP+xh5H4zKM(65Dv*9O7B4RvR#Di&*axDl*V
zq4rAY4Qswd^n4lVUJ0YR5U2W4&(1LLgmdo7fdrb|CDotKDGEmw(w2O^O9D$B$Y>xO
z9z_DK;YJ%MZL#szt}UDFKn8sejI9VW@yE7%SSoOVZiK<tFNS$d-Di@gQ0G(OvwIMw
zK55-sWlm@%yj%W5n^pf66BrHfL-Kw*5vJOUX@?1Ia8Y~e#*=g2H*D7|o=~!f^5u*i
zOYuSRm-_OGgg%6oAb0tI8Aa3pW?2%kz6bT8fkD+21EGoL!bGTTbP2zDSurtU%=EI6
zcjV=T-l}-gcW^9S3A5a3y5PMST7QNC!&GHu>Oj^&OEynSp+)AsWN5g&*@^<e^#)Kx
zWmii4!eHWnSPAmB$1!b-N4VSwR{Q+TVBE#_Nzv@gC$ipblO$R5m11kdd_BM8g}7RI
zv%E91gpKcf#Ik)%L}S2`NB3?<(aYeNUWu<q)E2Q5qbA#^<yzXV(eM6N?cc)nZzpJ7
ziw#f@4?k2@#MZH8m(T#%FmWWfodPNd!kQ&{PH|fohle<}vm;w)^Vl}~m_(=umdsuJ
zDVJmfB*=Mtd8_^D{Q80G=BUB`;h=;>pqUJLORQaVKg1zS=xU~}y4PNTUOwS<qgb9_
z`BOk`sLJVprbjD<D}3z_9k#>QxL6n?t_g3talO;!eG0R6vz98r-MX{9mK#ziHX1K5
zbyn{SR>eIudM9~+JshMd3MpZ0=RBe~qISQpfXqXNwMYUrG-V`OLXvtQ1%h+ki5bP>
zvaCq$2Nq)}N?A6e`r8imXaP4U8!M;Sh%aH&x*O_9lx_!qx_3!|K9JeZHWti%V$ApO
zry^9ROBe2nqFs|-_bk?gb>@)_heIjzZXjB9t-ubh#QHbC2s~(rPp@bBBpHT7b@yBY
zJWEo1(OuEGyOO+e5e7MgiPC7K%z{m`8lpoR4DPux>DHupXf`+<1(PY%fGT3DRqTBf
zaqN+R;PNNPGB#9M`<D6?slq^u6I7LgBa`^xWnVakg?eoTao@)zi8x45W9U-c`aX*>
zAt=_j+sHasc2jN3E`rT_qqS`Sv)kvQk8!)g>*;fH!Ex;z_1-3%0&mx2BJr%GIl7-<
zl{>cIpMKF8&L>tE0xFJjuN^^xG$Ver!B#=e85B}@gB}D9+DcjLu|T_;+EX}DTplA_
z(wZn#A(=k04RfxZGDRZyxCNSXsXetMA#vK1u+zm%Vt2K4u~}e1?&?83V`|7KYvaTq
zeboTQ%d>lQZt_T~4&>~5UO1RSF1ke~L=3+6#Guj#&#|wW2D>)Cevvn6kaTYAD3d5C
z@=$g|xifqC5C+f+29sz7DRRhh3m{9N`Y2_{L0!2Hf8$h&m*Vpr?(6!1OuJke2CNAN
zQN4)Rsy%A+U^pi>wDp+23f1Wsqi2>NbBp@2u-Uu?k{Y`$A@O`~*pZwiM0hl43DsJF
z319=+g=H-Mm<PAAtt+L1E+myvV~2PK%7h}+1zt@<-`5D$^HbDessww?A6-vu&cQbX
zUPaS8Jpw%21talkwOM#nn{{K_ncBPCElFL@2ggSyNqq^(YPp4f#66NAyilA6bS!v&
zZTX}PT<O&~A7$EJ)X}O;1j*yh+0j<}C0OG+0G>P0^gNOu!~%A13#WyQsUCMT#T+w$
z0+bN2cG!p2auzJr%@x$qI(=mAu<H3jXO1kdJ#l_8c&v5zRA{=Ym78)@-%8ye&C^$u
z<?*YnPtL#;PL_2Rd=Y)FQv3XrWF(i;l~Rg%92LOEQ--Hp?fg&T{PCS5c@T^fqh59a
zj1uaNIk59+wb*bj?g(RaX2E%&bms|bCf?#^!<Pg5Hwhm=7>a$Ef^JecOlNIUST!v8
zx*^5mnD9Piu|8dNwWB}{)kkjnB>dB>CUeuRAMy(R)(~C^=F<h&uACp-+8M55V|+<?
zjutQtLF63OQ9Ehf&Bf<~a&Ow`i0vB3whLD+Y!O|@OZ+a`r`IQ`Q!MY6#vp@owLQsz
z|EGtvWxxs?x-H_SHh1>vki^;;Wc@;r#&#>{4W-EdlaeH@k4^bdzc?W*zp&1Q&)cOP
zy}lqNGNShkZ=oF3J-=3BTyF@~FJKcmY<lxVgAJ7h<^No6O;x@asAmz5uS;(*bWd~J
z1jz1I5H>x^^romQ#thznRFCEqivx8t6-{6fwfa@2o&sx@N#26$JJelH#O^~yoXy7f
z*s$FOdyTY}pcyiU9v#-14dEFh_^)nEZd1F{63@ZMyq1$8?S)IZLvut+)e#e66-44>
zCki6dgIeZ_<V?b?#`EXHMnsq#tzPG|a#{|J)_%UakE$;CEWyj{+Ejn)p;%lJWz-B@
zz=X0mj*VTEQ)c!onzVb0CSBwdM6!-Xpl{!HH0}hNdnw{8Sr^Pbmr{80!69B#)o=k+
zRo>}t+%@{T)Kb>!v<N_fLkwZsfV++uiUZBOSQ=f;FXynEgdjSwqbWPE2(?Y?%))1o
zYz5pzrZI*?&w%MF(-ZYrrj5<jss|7POoBl18C~JCm2O<}<WSg_w!|4--iKxqeu=Fr
zpLDMn+Tf|z`9)XjDP@AUOcH-=ldv+jk}kS{*sQu}z;Bd7F<!}pO8<1uQ12PEX$d#9
zJ`-37tZ&;}7@muz;8a-|z}BcOko)LrP}~0?y6Qv*p*+`^E)is6>lv_ywHOT^yM#C5
z`Mh4e3b#HyUFCU<#!sTLP$~P11>xD^rM5ffV=Rg3q%^YRCbsjg8KE*0*o8TBO%P7h
z@XNcNL+QqI%-AYtm@-X5^T%IJXQXn1kHksqN*43XB+AoNhhCtQf)NoHP!NRZ4Pga^
z79sTb4Wcs7vAQeO^G?f1U#g80<N4W>S3SkuQp^h=yJblU4+R!Cnuk=$U8UO4*&=}}
zyn)+F;Sk#QfB{_~-y6SBh<KP!BCB3CTA$qEu{_kDY67<QV0nZA((7o`=dql|D@L)%
zYO3v#+!uXk&;j}qW&k>)SmOkG{w-OO&;tP=6;HZ)B~2C@hg@2}*m5~7UtBt=<(!F?
zQz7kS<@jHCLw%q|C)>ai>|{BM-cO4uU@k^8`i@dj=8af?LcN=8yNjK4R+0a((;e66
zqO?frZ%m|%D)j&pVLdy-UF}D0aSLE;!w*h2vFLNatR0L;If;1y2&E`-VE9$3a1&hq
zHSyq>kPu{FU!v`g#Ri~|ifd%J3`sC!J@-?3$$YxOGKaAo`hZ)nb@$-H(X|=XTwJKb
zp#Uxb+`u>}IS=>B9j%Dd=WBbH=ftZ`RHZ<4iXWhTpqz6-R7Y9)l4uWNYo6ZxV)eD2
z>mlozBW#NwPjf5U9}|u=7HNPw%b_o;1+6wCx$rPRnyC`A;>3`#a2If9y}xTAFFA%^
zzDz<!1L;l(5!-J|Zm%LC7oDX!_!6d#Ew8{8RivFEFzEwV*e;skQ{wv|)EraqWHcFq
z;BTg_PG2aLK{2>C4*Z)FojGlFx#6&GAZ)vIrmh!FXDgPHmqHsLn%7;4brW`VV2Z_*
z%e4m27=8dg#<QU>6C!YEB;uzQ2NxEc5kP_?YMIn#)^SL4aWf4^Sq^fN);_5^+CDe^
zc~|~=s{>RbFlnN5X~`9_X2yM4*0tgMqmT&93y1ar-Q7L>a#0D7o1dFV8B0=nuarJP
z$d2z*9b_!o?q&tqD|e&oC!J|d%eIl>Hv=0)FpTZM!vr3&C9&~2vNhB|_?3rAi{Rlw
zf-A6pNFVZU#~s@uYel569E_RO7N51$RZLgd9{bD_G<eqKMMW)1aMV3wrv-b^Sl;xw
zZEfr9O;H)Ffu(Cmb~q{WSRQ>mIfO*_<Z@wx{pq5zEIpPUtqxe1CvFC^8^HFMD^tB=
z5-?EHE3ZcP+w+f<=&FBqz;N7`k!2`8uxFmcsaA8JaK0p<+%Qf$TEN(TjRC5sTpgGu
z+kvK$TX&q$AUg|Bo_y2|Hm-iJ6RFxagaFoTv2t=A&cWG4<1DCX+6Jd1QAH0_Ifj$Y
zi5XF7nXlzYUz{O|a4wZTce{8R<uAK4$-P#>)JhL_2L>Sc!}7sIu88qArm8{#>MII+
zV}Hm*8gnEA%F3jrj%KK?p!dSRJKdcu!A=klKI@h4x?PA(ohiUR8@BB1zO&01$|Q`0
zq%*>IoRG-<$QE!4&4HJa#p4Z9n`YX=sFYJfK^n`JW*bq<JggQ9vO0OU+X4MHge3BU
z$9;7Ch@KD*Ga_ZzSdfxAcNb3f8UQxDQ~SNZPPTfgyGDk1kZ0mqlXhR2(hL?;N0#tO
zY9?LoKXz32=qH;MaTtw?i=|*25~Cf|*y=JC#+N7-E6Y6X*#VMNfotv<4%GF8-r%&%
zw^@NT^=yh=vL2v2X{8Al(aRO>sH;gh|0bcWGT91Bl|5X3-ED=XbW#N)MWXcNC2T;g
zWX)k63U_vqdM))`sq#v5p6YL*M?0*gJP?t({Jt<zRqyNUTQ~b~tiY4AMK!#3!QSWc
zjmt-R?$m3GsDHY}De&AnQ;mfxVF`g|Y$k*uqB#j1ER6fj=HP+?k_bQql}BG7;L!cv
zwCsQasW-g=5Qw_L_{V7e7S*M#d~YWGo;S)|<4c<qY{F1f`^W;f!Ar(Y(^7I>AIcYO
zMMN)?!8`2PV*HG%!j@)5UhNlD*j}<vypt<v4(P5UCsa&VG9~00$|@%bRfMQxoO?0X
zuCA7(kwzN;l-p58&8zy4N+DGh7|-Z}DY7u+wI40~c9yt%nJ9Zso9Zd2-3$h27-TcL
zC_WTgvpC0%$*aR4bTo*HW00HP_Sju@tTG$V6*IWTv8L6E=)%U5l`J&YNa05>1JiTR
zWPihuF^I9|sH&l%KfO~QiXeod^G`Vy+$iD^MpBO2hGsBC*4;i@Br|?)zp)(rsIU?A
zh^$EQ7K_sdg$BEn^^di!iQHO7Mp4d{x{N2D_|5z+tW;CY&u3ztG$XCj=fK#)#_AIT
zHgnTXT1#|5DRmSnQ9qBrs4;NGxi4N%m)>(NDV%a@7C_MH2Q^1yIUiC)b#PX1Bb0?8
zGq@sJ9XkrTPkOa9wx`;fDBf{`?Iz2VMeS^-tft)4irU1urK)s_UgsSfs`n(0!hw%4
zga_FyMed62qr#95wNDWjTH*;u4>)OSt@#ZCT=N6v0~I8#b-jwI&B<umPp@JPhsYdY
zYg-IMv7Uh`M6an}h?DAkKJiEK0fM~b5sDRt4rr-f+YwT%tEAdN&eIg!-L!0c1nJqH
zy1fN#9fvKB*=DHTpCIyHB){kiyju8zYRieD8%iw5FdhRFVVf&8F0>nH7Qmm;k=6rE
z05A;FViyrs-oHh)w}3e1X~SI2tE`As`i)?PR$TMaULAxJ0{7G?0)H+Oj4WO_CjHVo
z9Hurfp^6z(BTWXS)!$~1h2MbGDiVQUz?Fm*);=aW%XUUSrs$9*uPa%1s1H>8wGS0e
zI%@#zCqYmKy7RW6o;{|gKJ$MT8(@yb_pgjXmB67-cz5Anu_?J?VJgI!KY08kkiLxC
z^%zV)TzDf?5qvvW5lE?CaB;T{R(h<}Dv|9yK7`%;Qmd5uTabbm^ktVcJ9szWMaC<d
zdm;d0I|FE}+`p+IoM%nSTLlQbUbLIeVPwESyNWwVt7et{9MHmUIJUKN-D^qGBfPTu
zd3kmA(ZwKBNVAbuKtu6o^=iLM^^fuCjTuow8xdyPm?hYgmy>?dD|x(5e0isthHA@Q
zymW>+YSt1G2mrGRQ0W)D`5qF7OPU)1QneJ0sgSsY^#?4c1~C^NO0QbL_gQrKfN}-_
zsxC$+?S*f8uovN~LrARKxrE(=-bu_fjDy@aMvwWdzrcA~m{?Ej5Wv5H`|J6ZGPqlZ
zLAkxRwP#86`P(>IAuT*tOg7J~Kcn!Z)kUhF3kZ#pTWwp7u|zYX6DB{7c~}!{sM+7r
zdU&h~9s<|hTfg8gNjnNpakMCp&W;$T$n(T;0VTjrhOk6@HSUhgCs8=s7jnLFt44|#
z^zlu|Q{OY0E^TP6XyW4C9XB!O%GGd=`2v{O(oqy=+Sr<jJ-$~#8^}XML3~lQ1#=c~
zJx^;5+Iz*b8?m^%*6|}S!qP{d*+?swTtw|-r+V^oIbL9i5xA-~=eFq<@!uE&z0LUs
zK}pQ7w(%-75&TA=w|OCwgsE0ojE^{a(6T3!IY##!jCT=lq_xa7`FOSW2k?~sRZYCb
z%hy@Qzcp?s2Z@qb&A!79TeEQzj_yi&FNW`z%W<q~tKJuvr8N(1K?X4A^p1D08QS$c
zVb*2M9}!j-={@xSALar2rYucVM%0BW-rf*HM!7l<8TXubcEEH+&n^?&4HGYD`wnRW
z;wD@M;X=%gm6t`iCSNJn#0#uTEV(c39<$3I!W#(GNe?XUsx3C=@6yYDdKZJ+!*J2d
z9(-7Pg6d4u1ht2{E2Jd9lTHcwmBq-DJ3<T<n%*l%+B<3%9=zB(*6K?Ur&aYud1+hy
zrH$*jMLmW33Ia1Kw|$I>+q10wO4n+4gpq-X`Ln@N93np+*kg3bRln*<1p8LcC7cCY
zC7rrum#RJRQo(><HC|#)dWvcZuK_&NsRfHm;i#;@g4Wri4C7~_tarfbpHBULp{3z*
z{J_5|V_shT{LS-E!Xej-J_)NdUjKml+2S9q$hf?BgI?Rya^*&S5xudo1t_1=b#z5r
zy3N<;q=xy70Wc6^{0)X6FlkR_YjThr=GA`wyp`uPfc7frZq~Y`qwN2QbU!t)5u#OK
zy|humlD4<?Bu~HI_GV$~#sS%>!*4=A^AX1Ne+gh{=yB-(hgkn7!2Y}E8&?}mjXC)v
zNlehvhQg1(xm^N)Q9KHw+@Ln0w6E2zXHp&(IPiuL2}K!w;!`qK!v9tL@EfH3KmWXb
z<MaF1vZ2X8tzOtUdSP>ic%ayRJ>kvefAs<w2l^jQCJhk5lVDc)2Pr0;P)wEQU5s*$
zGrzli)p@1Ygcw6|FP;mceNGZGG5@75;D7(=`GL1=il0i`>WCH%dw_wqBAM$?G}&NP
z_S+VYIXNb@NQNqSB_wG%WE{TM36BBJC!bHnL|<opVPbRq-;4DA_fP!wJ=Y!I^7N)d
z{Ks3IzxuM~%6xzRiSfTTS6mu$#b<4%CiS_P7Yura$3JAfJ-xEn0atfYc-scbguZKE
zj$aiJe0kmJ;$_e5viRVHgqG=9n;kvRz2D0S_qyAW2cqv7J=@)CRRyj>jMwsH3s<6|
z{C=l0B7V=twMoA5huCfh>BhCTQ__$g)j!IU40c>!tI6G`xUge%WTTf)=~b^Io-!*)
zs-v?_nkw~Agw@qwkw%OEX}$I-?{Dv-R)_8<eA}Szxw-h@NX^B+M7X^?we5MX#X|2%
z?1?QadVl+#+HvE)bdTpptI(pq^xAaif8YLow@PYM+@`W~uoKTc37JDJJ|Vs;tp&rA
zU8WrzKlTMxp%$-n;&%+pUVKqXO)ib+7AfrhylP+LUa(C2_&s<k`FVY;|Heea>eNTt
zs&g-E0#cJJpLTU_A_oL>jSp|2kW6TVZ3g8<#mvQnFC}kQi-${_55iMjl>N2~*llm(
zF8hBW3)#7WvDN!Qhzxi$)X&6C1I+=Z8r19C7_mW50!{RZ;<4B|uG3Rq$F)-e=HQ{1
z3r`0f<GRf-@YHTunh{I8YUfZOmYoX5`%pVs(;tl`{BcpkZp&NSs9$1U-_*oMqtVKR
zg64#k2$IRb2r2q2uHg9Xhg6VQm4#1lL7FS3u8nWJ`O)hF1L#WYpA9y?2T$JgHQ%!Q
z(>JtJKm3T!IPqT6rVIt&(Jn!OjgJ}NM6pMBQ$Vqp3nGcJHM0wMZAV?A4{xd?MRTNR
zxb%q&T+d~(%2tg144_A`l?(;YW7k`HG=H>e=ePS?jqkmuSK4;D5HC9oC0=TXo_cnB
z{^uV)8Lwx9#)?6B_4NaL&=(4@8?qO2JcJNl^aPgm&YjDCk+i&Xmx0y$&pScakX!H{
zhX=&J`e8m(_d2sVGD$Nw4(R$gc<`-aWRf24N+%t@@-K7w%L{(@;#AefUDup<{BQy|
zy?Zudk}=)}bZGsDIs;uLwc>0K(Cqwp3lGe>`LO7L3DW@b=>YRz9^#kEyWhKjZUhbk
zS*kQ~?7eCEft7L6TGWcDFftbC3!50XIMq2%;{`}c;-_vidPJp}pt)*z`^0!#!pe1?
z3vENfFAnMVM)}2TWNf(p(+2%R?e+D;;Pjgt^wr+f0NL9;nv3TZL#`IeA8g>NK5zAb
zLf2e#ta0L-uUBSC#Ms7&@oO)S+U%Hni2!Fv$2<o3dOt6R{f9sKuT`;`=GO-|=<g&y
z{_2dGN8KyVg&jlB89>unZFcxX{B-&}KZGcoz=@0J-yW3(zk1_CaMMSk&%fL5U8{GX
z1o2C~oI%6}bpq?vz!3jkY9|fOY$*M}#`?<6-f%P;TUb~)zPuc}{;YtRYY`XOu8mz8
zUm!FlsAown+fCe;s40ON2X=?!)akz}FZ*3N`Ns{XkQ;4wyZLyOK6oNpmW{Qoy_I-C
zMEJ#y3G}4DZlNYOW5ffw9(NYkyH_9HMZfc@2mkWbJ|7)h+Nj?aJ-Z&c;NJqA-Td>M
z+1brUKJ5G?rO$tR>ESRlRo?otuB9RITWD*;+0)-_9Qjl9_79q7XjB9kw7JU<Roxa>
z?1`;pbAufb4l9FVK})5(V@SkJ)P$mB#Ub(K`^HaNYehVQjAsN|{YfuiB2>|7L0FVS
z3L^=M!pM@rM&75BJFkEA&F34o-8#MTz^A`|>3#bt>plIXV|RZvUVoN(Ys%$o{A!0W
zVfA@3Xz7h^rF~s)Q^>~8WAxzap<E+|PDzC?WA1mYdjHwI?aaFm^U*gi=f2<KWZ8-r
z`7d1K0Z02@Pc`18?DZhXUm=V&qd_${fj@t+NPP9`t&K2ZET%^~ti9X>ezLlKy7NBE
zfPQiP(zi)|Gs|YS9xUI)clx$}(c$oQ^7}TMtG_yO<LY;!5P~Sgh@kXNQohpDz0@;e
z0Nq#}*7!s%|9$XhbCE!!IrD@M1L8Z}y#LS`6Gt~jxOc3I_D=5VxX<!#S96lz_My)G
zso*VZ^jbSVY<b`I>1_J(g}a$&#qY?Rw;w<~`F8eOIj2r3I*fI1UI87O1s%rgi^kwY
z6%($j{b`@2UFfv#=+LVYl<k{ZHj2Q17ry_CHV5A9+2Fk?{A^EQ=&I$#7p-j~pkckb
zV^SxZ47dqhTfA8RRfjp-@lCV`C^>rmcD}YT<J|=79|Ju7;ydiqn^*3|wQI(ACvEZ`
z?Wgs|+M!qaNSnK#cS}3{JmVt4DwjVXNUbFs^Bi$JX8h84VN^gDNOJU@WgQU0Vvm<)
z1~pgY-6z>^J{ka|F^z4%9u@oZFXVU!l@TBQPU-TEV_a>$im+5_+&0_yvVTw?Z2+Ls
z_bz#)+TK5*q#S&Q_xv*EcY4=zqo0ZZOSjSiXq+}V5-)-20et4o+p;@OwyRjK$DB@X
z;lKF7T>Q&J?=ZlY>$%9MT_<^O4M+TH<hrcgF;R4ah+BOt?VFYa4mTnx7c19+PIcNh
zZ~JNME#MatEN<A$WxuQS`1@?)H~)Q{_glq|3%J#;lZ+^w{uaB5Z|WK8T|ezBt6jBB
z>wtat1kyt2{UfvgsA&J2ziu6UzN$xfbA!02D&NV5_hHDMY8<a+Lb=_^Hst%6?Z0o|
zel_B^Z(09pi`C}mUwv_6Q<&&`mcuhYD)?MVUOqxi|6^ipw!uR9{T8<qdlYwH<&nB3
zH{?405iwML{`S)xgy|<v#8$&IyZJ}|U0`yHpQ=}O=)~Vwzn#Cu-=3<qBIl9U38Sg^
zp#%RQ`reP;XkM@32dvd6+Pml0j~A601sGgc+7eaatxqEQ)+#^s0iRrwg}B^~5GONC
z|3143(A#OV#*$0>e#7C3Ya2q=OZjVh=tz97SK8@~0oEHr+8bMu;>yW?knm~S#(_24
zYg#;JUR)rM=pGZhM;!a^fi`T57k~OPp<@knyxseLT)Vmr^HI!?Z=a!>U;i*XU_8WI
z{BMIjH9dP-=hEO^qlNyO=1)ysURET1xMJM0;JE53nSfcW1NzF@|D8;8Zqh!WSnNaE
zcI&Cc<^FqxyoLO@sejDs@3v_7>8I<fQ8MtI*6-`e5|clDgP9hG8o7>*(0)C@>5V11
zPx;`u1zo?cwfL^tKPd9$2ExKZf(GW?YPT(3`Dd%kiaBtH`>&Mi&1av!v6!*=+LZR@
z<IkQbRf7{rZ*U(NN0_<1G&@kE(Y;*BXng!b-#=Y$K-h*B;8d*H_c?2@zuX5$wjIhd
z{p`BQwl|WP6}-*`tR5_EQYLr~9sovvdh_Wg`Zauf_O-VXjWClYem6QBH#st(&cf`@
zEJ4v^a>grF7gfMJRW(|U7bDEIFR0PG?b`<>?TX>pFG6In#Z`A>#Gsoat-&{rMh5?g
zav+3Yq=D2<N#={<AYQ2@S$012+58lbnrhvsvDQ5<w{AG7eew8&*f*@GDJ}}=Zyjgp
z*_aB}w^uj>IVL<I*)Y21r)t88S_+#Wz5!;lTl@0G&Xi2GZKX@(a$KaeVAz377zfh^
z3KnV;G^5J&tu3IDQyQu97<<gHF*+}#oinyCb=}-(eCeKovUY;Fh%(1W=K@c-w-;N*
zst0JXfntH*Fi$z)vEF?Squ)-h9e&l`<!)%%C0mQN(GEPDL%AtxlP>Zu!j~T=A}yX3
zrq=f>`7hM_RRpK4Sl;S+qVEcHGktHjuEb}psppE(R2*>hH8s<&%x0!Ff=^n&RELbC
zaB<=`(fW=tC`y*4okO%08zo^bgXNapW=&m%8i>KN^{(-YYXiI2afZOgI1j}r9jzyb
zilfszV=sktwcVm&Wnts(w+bRd+y}aS9jR^c5i606ewtEZ@%-b+L>f*sp3g1nk|q*8
z8_D&{(U&4iwh&Qb`@SgG$fS`v3v6Q`{C~6%bb=qsxYlxVEDD5T2V|;=Aa-qlM0$-s
z`?#%ZUX43<OclErGB*$qoRJW?uvo0*Dy!NBFFc6iN>s#*Im!ASFR>h5onB1K;67vd
zXnSgzHwO0LV;4m@a+%}UG!(9>oRldY6F}OK>QYd-p2RwKoG81(N(lCdkQ|Lu*2tDZ
zko`UwAIW(KkXk><#vMG(2iqh!Wz4`XPCs6*B(_~{i4Ddt`f3{}D)zi~<vPCuIvrlU
z`&FDQ5k+)isE^7NJ#Y>AbK8z<)%AF`BKt<d+<*wTQ#(+iXc`6mFvvF=D49Ll_Nl$3
zwTI2RHt)Mq5%OeLJGVGwf*)+&PMmA(n{BDS?aw~jY71F!f=`#r`UU$M<>y;0L*(t_
zpk*yYx%Tsi;jx?Ee79Zheo|J=R?oKgp%!`JsFEgdN?{0Co{!7mdfXlt7U5;mxutqW
z!WVYySMq2ems+xad%_Igz#g1XqU0(<$2w84GR9d21r)N}qKoMC)s!@^tj^EDFd?2R
zdG&iVbv@nD1&N|-C7(E|C{cPAh@KE#MIn|;(|IP@ELTnTw~<fELU`<Z;_$Za)xqhj
zR=g9F^Ll>NpZ`C~-aM+wvt1XjrN#P*;Lyq_sp8O9WiVwX#Fi>fh!&N3u0)LxAwqya
zQcDX`hKLg~C0Z(I2|>gNAwX0hh-46f1R@Y1kU$a$AtWRr!|(Om`|P#PcfNCe-G7lq
zvex^q=Xvhwy6@|HG(zjB!LS6}OrviOTKh~zz6bX8ms5wUk@lLupuc<nm5nomB_*no
zcQ?4GH}_z~96R1}H)e0be2*P`!Ll(L&eqraK9Mwxc3)^RR^gsI94!u&oiLY(y#+Y&
zqh|bS&k+eBzZ<1Q;g-$7rK-o?RLrrCYD^j#m0H8!zq;K1JWBC8VMvxj^re$J>iCyv
z&#`rJgdbsC<46`vkN+{=a&^=T-_GWPDcFTDgugF)YD5}4R)^hlgk9K{$_iJBCK~Hv
zabP10!Q+w*Z-$bJ!d0#d7qGda)6yU%erDXqKRF27B^nPy{AMI^Gwy~%q*I9Q7-+Z&
zt%u_=(Bn!VFO1-s6nY)@^t;RzRYna6DM3G{i$xeFY#e^mDhU~(sB(jk*}5a!uDj}o
zE0*wHU<^st+o<)e!MXMnjIs?R2pj%9T+bX1m7N<!4ihAv___0VMWHc#23hAc?|qIp
zt8`%}(V@aNII~t5j=l%OQ$)ObWXt6N1k7D^_KvP%G}CcKA?31A99dZLW$4L?$0uaj
zxo2u?l8-5&<6|1x7gXduG$&jE?HTuCmq_q-)YiJBp5JVO5R3xhPmz)_<hl5g6}kk<
z&O*#L_YuaUf8wJohCd7X(&?!ud~`1t&%txEyjRQPi(+X7eu4W|O16O<=e4v4*@EE2
zV~PIR+vbY=#K=I_oHrLNix4!`RVQf|I8+;0JW7-1g?`3~SJ)ytBJ0lrT_Ry)&1%!T
zR$M;8Md<k#x)1Ytp5g1pCV#lkE`lfPm^iwwS%qSvV1E9^WiU~*1VulwI-<5lCMIGz
z)IBsmw9q|owdXZhi4*(m=2$(1^c`wXsV|CpZzHjPj7#Bhlwp3WL2=CF<Mu-xTbm0W
zaH|Yqc=To1QbXG;Y<?YKi0!+4_Ah^%>dNPHvP_YCe1t@1pW&89XDA&p_23n)L+yAa
zkGx%ZwpR8{QI$5_WniTdz6!>0^PZo5M}Um~UXfZ@rb+4!jOKuQ%0eWzsNK0<F#Td=
z13FG#Wq_@IYiewAX$p+5VO0h-hs$)FtOZmDwGx&J_mxBxM8}gf<p}yC>ekvK5B(i*
zDMogcf)Cw_uh5ID=kI>YjTazhdQK*ZuQXsu@4F>bUer%Gcs*Kmply%v>=I;(6g5|7
zXOC)#&<{4G%p4uHp=ybq_Eeg?OiWW{)LX<UgT*u<<XuCuc7D2iAY{fS$7qwoE-?a*
z9$V{xsYgvWb9nQF&D1{BpW$e_>|COB6fj?}I>Wi5A)}{?-M=#8`xBV0Ig<c`3*047
zYeDEZHd)*DK!3D7c>pU6YWNoSE`67lk`O4h!CAD<Q56mt6tm@GwB$sE#M+z7yVFFd
z;+KU9cNpxA=&bq&m5tPnp#W$+VFxPX@dJzypE-}4%L`ekhSKUixna^^!iea7<8u(Y
zos-j{-PlC0_tlO&AZG5l${|ZV78QmCoQ`X+bYO*K4K^5%#@kS1C_-2*3`22m`3|?$
z5WIE*9y)k+l&x$xfbS}85d1p+h~5z+ek7WwlnnHQ!4YCq2d~EGcY-gM1J{kTa#Qe)
zr}KDkz%DqY{DdSFG1G}Ha^cnwgGC37^_A+er80e`Jd%B0X9LIaO6qU`+2o9$@oQWh
z*A7XeGqNO^sN$g>NQSI8(Jn>hu7oXF*L{1~Q&CUm+?%7)CEnSbtU9K?{J1{!qVBW>
zOi`(%qF*EgWDP!ATW0Vcdqy3f@%epBQ!Z*;dc<)Ab*P*LgY$83nI0-{W0g67ER~MZ
zJ`v&}6{y+@gK$JsBAERmSV-HAONlDzPYaYTn28z9x0>j>KHwNGG1FBr!QxE0EB~!-
zx}hl-{wMjyC@iI9%nlklx5u@v!4>;XvBwp@&mJZ~H9|utH!#a@g(NNW7JB{9h1gK*
z;2SQl2;KO|o=6F|eC5rEU_=KNj%TW6Q;)Ns8%V;k5OEk<%O+DqTpo+WXC-XNzU>{I
z*gPE+hnVT$`l8EVhu9b%ic(azbgnRiIEmTAr1H|V<OOll0yE>!6=ajpb)nqnO~(Gi
z@56#m!da2g>MOSKth20$I@)Tu=j;3i$|7I+jN>b4qBHbFcV#mNUJ1xF{N6)y@`dT-
z6)sXrQumU`J^P&IaBj0PSj$tovHQXZBl6|%u+#4G<1D4m-gcG&CGr-h(kGF7Rd=)N
z<1qq`UJPBK-v<{f2b*Z3@{GdwGw(G(Y>m{3J29omqA`s$E+4F#g(keu!7P-BAEC}5
zwa~Q0BuR<?Sbb$3pCR87kC@>kVPB&&!2ry_6W%wB*r#EHK{vU`GTZzlZ3uQ~{?aV^
zFg_nDh_7$zP$#n$5e3~sLIE*#cbb+#_PpVriqpZQBd!#V0$<cFgyG)6JJ=V!<I-yA
zL2<n_d}=8|972tb$7zR*uQ36}+aZc_!DSj9axRRmPHnKi7^sd=RJf2(hG}pu#{Z^z
z2sLI~H(q{BO7)=!KvTUh8it<JK|nb7Uj@rKgTWMG7cQKdT*vRndn76BH1o^UFjb=>
zI<-kQr20bzXG_Lg#q<5`s-_?9xl_te;La5lQE^XA&Kn!IQPrQJ(Jv6R4*a>M@GU(7
ztjO`mLN5U^d;hqO<Iv-Zg@4JUk=R}A;WEVuB81&i?b^Zlk(DmF7_PWa@I1HLZ}^H|
zV*Cqx*(VvyY05k)nW#<_C+yR@p5%XB<SFnL*i)a6*Q>$$O6G5b6-GhQ!raA$$Oi1%
zmZ4Q7Z+<fDB<nkzI#Z?-Wz1ZgKClo5fm^|g;4WI=5{IwTxP4kF%2#pu>30i;$SfeE
zX2*(?hTfryb}d{ccBlea)x)7Z<abdFQ4|HJ6OQ}(6SM0nNkbi64EN^^Ad=D~?aURf
zdf~hIt3a5-cvm?Sc#^_q*7Rg((vX8i^7MpoJz@oPvff3qz~PLI)FcV1TjPyt0K$<O
z8u`<`wb?>ET=G@pJPQaRfq3ykewAzfo-|0EUO?4`EAH-O!HyJxA@)PwTaH7UcEdb=
z?{s6kN-|YLB3=f}ajKX!=blaKK0%Arg>RA||GdjiIZy$yug~8l45Q)MqnvQ$LdtNp
z=XK4b1vZ_G&%kPHvDzMAi&;+*so3RBXyBOZ+{mJ*7vItFb@WOWF07%pQf6i;?gzUY
z6rs|4lQ|f=v;%`86J7})mEPed(F(>i^H%|~vs}{Kw7~M;hDZtJ!Y(k1b0X%ih3JPO
zZ*g9UzDlYk=*vO0DyKBbS1?9Wy}2j6@$Ss>NIf@9E!DoCiwW>?BXm0Q7s_V+rHp!v
z>aT2G1l;ehipDJFNbS3*T7FV{pZ_-aLfqgcxNaF$-xW=>KHi{aL<K{2^0KU2HZgYL
z>qY^)Js!D#Jj5vN!Kl0>M9GNYS!7)vA^DiTgaq@|-yYUwAH>cShI8oz`L3<lc*Y?q
zL{10XZ@sI88AhySX2E92t<z5oL{DUcT>Ji3vNx@)Ckzug!4}QW9xy(WU4=(V7#<vN
z+EAXJWU2+r1B=EQM`lLnboNtRXZ?cCqc7gc`Ua{VwRevT6~oBbYp8$nzMy@_jHg7#
za+zn7pA+Dk+4C!qWP0miR#PM14Y<w^Si$oQvVCK{ysJLis3u~(w`n*bSE&W+5eEs`
zG+7&h&<;yZ6H|*$mj|tuENcQ*M?&CZTi|9XoH9unTY0(?xUy5Q>}Rhz37Sf4T=7{g
zlU<I~rIF_{=HEjMS%E+N;XNQ2v5{Dhu0n<(OD7_A2}IaI;~!2e#`%Dm(~;KwP90DH
z`7Vy&4{qtiT7))eR#1s5fxTy{s<sj%UiQxv)NY&Ospnw2!hVEhK_cC@nd98^4GfY9
zix<IkkKB<v>K_iK)!D1Ytcz&7ft|(cTkl~(<)RAx!cw$EL@a7+DmLS&&(i4i1_?&R
z&g@B0#rkxB(?r#>Z$P%qLJC>5FYB<r^2gGKRV7b(l94&ttccX_u5iFE-|A#Mz|dJr
zF&vVW#zttVsw~d;wD@Y{ZJ@#><1#CO9Z&UdoRzO=HdQxl9`i9lH$?7F>;gqnv$#4K
zzIqre$0L=g4S(88G<G4#YQl<?NrrsW51kpQSh-uNtdaR}2ce=&&U5?dy|cB6_4xtD
zq2~+C^S(=jeAgtVzqCxP9Eo1FpO9TtJ$l9>muuhEO5g^Ck2bK%wYFHvLMee<7P}Ba
zqx*<RHSMP>Dy*g#*!Q&f67D5yM8L`$IAKlp4F%d1ed#8$efsC|a;hP%HL|0MA2twH
zhX-D8a7IBghVJH6@VE4))(B@1He0{_Ip$_RgKgBYp}KcY`ggc&#q;~`JXEiO#9+Yn
zReJ5roT7w+G)yZF{gM00$59t?0}Ejl9d(1GZ_Q~Ge6seB_<4J*Y>q}!Mk`_BO#(|V
zLsm;m!%UYO?FJEj#)9e=2TM{O1LUyu{ZxLp^eU(8c~b?F$FW(ES7D^>Z^PI38eVhn
zm2s7YW$^fOM=RMI-$VFMP_A5^Kl)P2K(%WxjAdP$golx8W&N4L@$QAI(_w;Q9jDc>
z-2_X^f2!J7XZ#BWg)_;Gvy3_L&LsVATEVWhnNw}Wx@QeH!&Dddt!6wXcnRJHcuTC=
zQDagh1eC$?xEeK3lf*geJ|o@K-hKkarRu;5JW-}n4hU%Bk*X#YhM9nSQ`==fbBcx!
z(BB?_sSa=lu%yY(4VDP0qUnK=SZ$tBXP!Ke2U*G53g#yznmvantH)ZUGldP5!erde
zsP=d43XB-162qLj8124rN2Quqa5+t`bqHQPos`u$GT=jS;mK#pDdYzZob=`8OU3Rx
zuuI&s<C1zS{f(~Gyi_dvUK*F`H7f-{B`2d(hx-HH7sh7Kmp3*E3qz6dL3!UMslF9(
zmBf4|n<Z{u$iMZq3w@+d%*NFJmZb9J)-gk-#d)&+^LA-ypQT7;R|?Z3RZD7TWU6Bb
zzF>@)iE60Sgve4BuF}6&o?g(twR|7Z#P6QJ+GSlAc@&>9=blO;GlwbkKoE`3V9%BJ
zv?q6IN0|bQ62co`OM86=u#pn5;2cP`{EMuOo2lM5(^#Bhd0dw{M-$`3C!pv<wX_s1
zldQZAPK&hlKMA+aOA0<tZ9L`+j_^<BIi55w7i8R~wp;|C%ulSpNTYgOo+X#~V>z=T
z`?0nJBIcMbAxco3!t%&QrEt1Vj+PBu=h33`f&zV4{T4`IWdczWiSw>9G^s+N@wLVX
zcBO>J-VkwpayP*<7`sf5sYs33%MDTaXP`P}8QlcS(N(?V549+IxuP|r_#&!kjGRJe
zM3MKB8wp;+SE?0FHQ6dRuJA`xUo`Yj{SFutNGWV<=K%&s!v1*FW{?wi$%7|>KJ1tc
z8R+A&mkDrPd(r!DmQ7PJrSSAg<6{9O-mezJoWvYMpJ}H5Mfi~r8q_g>h-8nG%lh=o
zBO^8X%S>y(Dpwh~9rlbiM-2~$7roc(6X~}IA%c?OT6Tm47QKK<))L>{JIls!%Hi4h
zN)A>8tYm$!fq|@)3tP6jqx+*TlFr&xFI%?;+cXP1S&4RODz5h1(wiYkQ#uAQbs2KA
z3*XMD-<d`a)H9CaqTq$vv*qjCB@S*pt{rZK9ig~PM7gEDo(oJ|(YA1N$HT{N6WbX;
zE(|kNZ5um{Z)(IuWo*R=g^Gu{l!ST;on&E%sLNhxY%t8Gac%P0L2+z)P_VfId2D`U
zKziuz;M=v{@&OBP?%<@X2*Vp+95-Gv<BW*LSEHY)R-DS+&%wkbR~X~;xOF@eE{Z_f
z&+OtZyEdn+n32CmQ5t5xO}ZmIy}-&#WEQckwB0Q39~d6deFfQG2P;g`*7=3O#cA*<
zO06*oB4GdnB!U{es~cRC>Pjmnb#F!l?DA>|Z&Z(IN2MvJ`b4#n7w5y5-t!Hr&gKqf
zeI8bwhiz%uj3}nikF>k{Yf_h996{_h=q>o#d7HAv0TM<W0h&=fh$UFCJZ2aW?l5eD
zLa%Xp=juCvAmx{pCLhaeQ*9Wuc~e%PB)W37)}poRL5S>{!RY+N1MR8}al$eeu9#`X
z1*bg?Wy5gC1SPY}!Iyv=uoK#pHLRAe$?S-Mj)CfM$)+a7Aw<#FAN(4<Ri$ZyDqQpV
zK~4mRjF9&YqB0H2OIK9ZL3Nc250aAo(SpJmO+$yj(g$Rq%d%>Vt&$ui>avQ~f=;M0
z4kHPGB2SDJK5PiJFj|ANxyoXuxaoc0#~1g{h@nb+Ab^p^HUu0cirTu7!U|W|=(5~r
zRu~3CU!mQa-hH<Lg4`&I##}#5E9j{i%Y0J>b(<foygVqI!vE0(-9;fjY`eopzH?#}
zR(SThtdNv|nAhC#Btm<uW?x#Pc+q|9HcAVsltOL{_9t*NT}>|*z8emgHw7+P^^{A#
z8uyU;!_W?$frd-_w#MNuF<$rnrX*76O`;kW@gYV@NDYCnNPfwjeRPoq)Vbo@Jcc_G
z9==Pj#lBj?vRFtlRY*W{2AgW$h3vwNi*JC_#9VUYYjlU>Yd^D6a&cyxhhE{t$+0k8
ziOm+i!ohlH2!Xw^AgUdwGXZ-{&u!0)d)%7{N#yP{sHR2Ia_IAsJ?Km?@%q)a!iSD7
zgUgBp&;Y>|<Ncmo&e=X5qQ5iT!hv{E7$G|87lg5gMj`?;<9Kpga#j-YH=o}t$c6l)
zf;$5}nV6)cD%@~}8*-C>vGS?E65ut)LJ~>ydF>H}exzhhf1U?n7iF*ksMF{t#vIdl
zky|81EPHONHqcXI<33L%lW#=OnVHCX9Qh}~O5xDT&8xb&QF3Odp83#lj3B8nci+nC
zE(#&6%|ymk=;3~~781&ygecXgmLpa<5l*SXo|AT^$t0&YInmOyM~Se}-x!%h7}MHa
z&u9{lvN6iDaRU}Wf(v({e*<gtnnFZ!ULiOi+!g7Ly6^B9$;~a}5`i4CSNYv$^lh{V
z8n0J;jKP@KRw)^=RU>;<bMd;tk!rcH%9nmIXtN&#9)<w2C87(m72hFFy9p)yxWy4R
zzVN*{8bBFui-ReWj1`~diWFf&;^_4GcI#SmPoz{eP--VU9N6w^-%gHbB4B`LXFRSp
zZ*If~06hkd@4P@t;P=jHUZ3xX+@H!hg)aizd$Q+bMZyXUu^$Z&hm*3Y?zPI|seapP
zi$)ClV2@#yZ|o5IT@2XSoB<@^PYhyWz7t^$bZs5Mz)6PA5Szodtha@lP}$7F3JAm1
zw@EhA+4?+M0O1px=ue^ri_qWu4;QkdqGw3CURi~HFyDExaNN~3_B)?s7>%%5hWzrR
z<Lvov?d;R&_>w5FJ*4?E@nXBRziyQ6BRrfkK9`pyq7F<_>3;~y4WttP_Kr<T0nMgX
z_2_P9$`%25r+HPH!tQ7sMGm!%cZ?s2_IAKTkxG1ycjVTZ110`f0J<j%qZ)?aW>oXD
z*>ADOpoAdQ-Mva(r482Yt_PIR_4<yFA`AaMtZoApG7EPKnyMy1q7?3Tt>8Ab^GC!D
zg9uIqeEvxMZS{N>*|rZe#2k(+hBpo;Fe2C<`0d>Ol>zdec-%CpxC5WOLKzuyDNR0t
z-@`6(O-tm2>{4ZvA;oEuveJ9tWS|^wag72!gk13z+^)0e5O(s}Ed+#M@qPCnD?9G?
zWr+bZdPt~%V_B7+vpHx^6MGH_6FbLgK>^-!MJ1SDVd4h<*>#NvW`)Yn{&358=EcjV
zBm?~s;nSfphwKZ3l@=^7urVT@kj)~y0qzYx|HgHzzU}(VcMfuhc6V%{>lmoFy0wdK
zaXlg-3cbBqd-f*Z=2$idpJmPoo0p7d%@&={o_CjqqDlFR@{Im^^i;w=J*zz<Z8Oc4
zFK%vPmjlpmCx(*=i|cijl%eTB^XegaY;QyNL=)%Ny<Ep6&OLY*%24`)QP;PODvA({
z$}Z0qlG&kx3yEebYybL-74od-`Y-?+({sp>9lf%Q<?t0T403gF%6G}#{2~!H(p}=e
zS_laXG?Ld+tf;&phuR`CKX7h_vocVYSAGDJX)e)l^gK30RzBJ_QtNVHZ06f@6*m<u
zg{1iyTx-`Dy^8S?)Vrn<5ktF@=;DS51yf&GLB2l2A$^;+pd3ouDZjN|F4g;SPZw&f
z^UPVk{@FLCtJ)tsjQf^EydGMK1JV~x1W>T1CKhJE_GcIW**FZTkke0qQeQvbqmrH{
z91(EJkvP!4qE5GYYOB`jcv~qO1VUc&Tezx?qn@p>!=!}-v5`*++z(+a<oILze45L#
zd9^K)nLtoWJ7D)Z+k!S%XW#h{_vE3QkzMBj#!|2f%;IV5Q&bdQTB91tjM6iRatYoF
zaT&(;fZH@nn3-BOB#W3g9i?CPKUrZI=pf164<EHFeRnU?7ZdnrPe$Y_?=3qlh@@OT
zBz8|76iy*K+Y1QE$N+!<v>=!7;IPFc4mm_K0fq{Mhe_=hgAkZMTj$~f2Y*?QktBlX
zWw#)nOn4>c%^dEeJ+EXr`6_+RfB#gy=3Yn~2cO`3d7*>^Av7LaMK;hxKgnR>6%ea<
zb1D6SLPNw1Cy*#~IvD`$#E8hOmU^nTy+l(KT@(sudJSN;)&<Xm%V*t@lafTzMS`44
zCfLGB1WH*&x+<zGWnTNv-+L)cx{QLbV?jrjmpv8MO>c%^!ia1UhMwUo<#2<c4}Ez>
z?Pp8XWjSisgt0&)1y7Cy^(w6wbZMzYognH;ApycvE|*b6nc9t#dQ5!}roM3jw^V_=
zW7w9eFAvd=R`B`9`x~;w-ZQ*fH!%w?$~)OkF05c*5GE(uq0!v5fT`n2Q=w2Lyq`zK
zybWm2wiaOS4CglmN?`_F(*9k^&6g&tX`8Fq*OcY)+E~%k;HgD|9Fg88-`hBTfpLgI
zY+9&okoz|x&S-n1<pjcBju9B*R>!B-$0s$l1oP^Cq*X=Gwj#2Hj{uDdKGB`4ZrsCy
zU0ay-j0tZDMKas9q}7oo!nG>)UroW{WWE^1apCeLtz0%N&|GrS&!%?pupN72K9lA|
z!e|32cmyx09!5Oz*pqO}6TktO<fqS~A2#}Hp6vzTtg&*w`s;k~){70Wco->?F<27r
z$QjFqR(XnezWvO$0nvp3BD<5#6niV;k+|uannvDo6TzW94So`Ob-2I3+RgBO)dr@!
zjft-CTCHpy<B41nefB`t2GL0Q58WUvD^CG*RTMGKdm_n6<lHgoAfE5k;<2SKfV^Ud
zXrv&-an;8b)c`oAmXRhUqyVF;J%jr;0Vr(<#(r2rDQal!uXxDLMzf<E!BBVjNfo%E
zaruOu+dN!KgjIUQk4E3h>Y&6RRbl8*Nh84*8L)wsXVDyOQOA~kTG4Ev3sC#hc=?{l
zN&l1D>7`JqnCK~&qfHx|*h7}93)=CO4wObQ#d<!l&3t&`gre;qBAL-3vxt@1R1}5Z
z?wtRU=oR;P{lUu%T(z}37o!N*&--00)C@JbpL-lI=l8IO9GD$-`xyebQVrHn?FzKY
zw;8~uRh9<KjiIrdPbO`DX@oPY!-Q37aolv>TV_WvVaRPB34w?5b;t%nik6WDPH4u<
z2QY!f)+n~t^Ac$0i3K~kFVJ|Fm5%(fAI-MX_iM`h{LKiRV<1C<4?L^h6~GBLq+$Y2
z<s2uJt*_FSm69_!N*k~szn{h9!56CaI^XkpSDOBUdnsCCTRTWH?!P!HM(t<2+GYqf
z#lyq2ROaK#Y``A&xVvGiRmePcIjD+KGOCp>39whK5#~BZ>gPH3#<A3zjz-RITqVjA
zF~_Lo^K#O5Vd`*=$D~bAd|$u9{qV(YtZ$LhO8`JH(!EU+#%=k!=rr%WO?9N_JWvmQ
z(=lDKI)q}vvLB|+*nEK3<LB|iaQW~uZHCHmD7GTd2-nE?cH+&fuBFhHRBL$Br3Z@L
z<Ayu4HC1Fc<q=2a5huMU3agFE)+3!o6qPHyxUAGwd$DPczWC352~1b6W10$=JthNs
zBBNA$oK#4F`TX?&e{YEIqx~uvs?@SOo;;2QTC2w?TAQX@+Ay}Acl1?lba?#x8JBbK
zTlXx?K84PA*)&wTap88E!2U)nrHvZM_p7(nC$WjbGYh)Hpv@BQZ(dWOd@Uw^+b+uW
z3iQ<|VYDPRTCnVzw&!sZXGfAHRq=kt=bgqU$;AaT&+JG*5Nkn_i`)bv1@$hXE|J;H
zd;D^SlH~^U2>_hu&Ok!a)d626>9H(R7{XP}VTT<Wys~g9kNkNB?>w@JkF&E?3rgzl
zxgwwG-ASrrm989e`&adiTDX5J-j}}ZX#6wVx*urTN8!pYMvH4LdY62hPLgv@+0;eo
zhoE`iHbZU(jh!|CZMW^?c6ANU9af1AIM?awZ!ObOwF}dZgk&(+QRU)AW8XmQ%ZF#0
zN-qL^J~w>`yS)*dgmR11*>IBzwUKOU80Uxbc(IVz%K3>szj9*;wIJeoTosm+8_@yn
zt?(2f9jC9i0s5A<%{-inUJsE18l%jXxjIZRLK_>M&DA^hw0otn*k8c0gm5HN5$i1m
zy0+Srpi7thTkqy|V73vnBj4M?qmZ^uoET`fkQdR#B2#K^Ke#-fZP_eN2!PkOhQf;o
zZXEx{pul2{9mgX}*=+xg{G6<6jaDq8QX9fOpE=YQoI%(>^c{wosa#Kj66xjZJ+lV|
z%?hAXlF*i-tiJ16oHe)?Xi!UzQ^_|lj?Cn9oBe%L)Yi}~R8>r|H5?n%!wZ4dsyaAa
zM3K8p8aXCjy{!*3;%#vGyAtT9+2zMr;OxSF^IIA|vqt8+l^(4qa}%o(pEQjxhjLYa
z3??N$)P7y`U5cQN_9Iq`saYQAN#DtRR_7<n)Srk`94JNq38Wuwnq@KxJuOCZo)-XS
zdas~8RT|BYv==;^J5Gdk)nK#@aLH63c_A3PqMEa>5uSoMu5fpDz;&+J%jzwnvXSV%
zSSU9u&6Oz=B`CKyP=ak&HRL0taD&PpB8wb9i}Hwx|IWhMw*2TmpHzRz*fo?q%kQZp
z<s;`6e@#CPm_MZ4>!tQV&{yW`3}d%`Cd=O(pTcTC-KxFhhoA5Ffjx9xL<MA{hi67c
z3Wo@KR-ktZel9FPF#)Lb;C;cyGG%$*Jy%QL0pJTUVhC(bvvyYs@42GV^!VeiI0)0h
zgupQ{SrnQ8g~bIE%HX8=PxGVRN3eMkUivcUTL68K4L0Ia7c_Vm#l3LP#Odkh<^-fZ
zK}Nq24`o+x1GY|fRgy8xN0tn<;U~}OGI#qTgo{4HQ$YW)CW?PC7<GL7_Xq9`4sP7c
zm(O|Ja_RXOvNaKyhVbn9L;3m>8}z6Y6{-#|2Ol0Q3lS`zz3Eq>VZEtt(X=g}9)ANd
z5@Q&;eGvsKC+M2g$?@UThVk@=0POV)NG>k!Ndk;%0L5&g$GQ{TSRxUsC>psXhXoUe
zvX$YAkmJyY?I*B_$1anU?)*XkZ_Mv3ZSc=bXgEm#ztj46sK9zsV;M&H%!z#+qiia6
zn-`B&1hub@abJjYWG9=2ZX(D{?X-M+s7%8tuQRr~b97Q*u!z$}51`Obyib}Jt$$w(
z)>c=l;L+;&lnZ-GxhMT~#D^9sVqk2+rh(vjTU=7-)H;L^<?u(~O#ji5$}U#=6syao
z`dKiZ%C{f`$Ra6KhkR8?Q;zn=Vz_Wd*jntRiJma5u5G@5bODvZ#IaA0iqX@kGyaEp
zy{N$Ass_l{Fr&KjjmJY}37AF3EY#ATKOP9IV0Y<RsG&*t=rblcHE9meUTa9^k@Ou2
zMXu-CJxBKjWA(Sy^}wXfW@r+nC5@&fjIe!yKJ72KW{5P!wk~4z$3STqH*3IujD^x(
zBzVP_@IockKQvPdPm7UzPtsgZLT=iPtLrOkWD&AUGO<+0082J|3nFc0D@iNbz0CZ<
z9^EXXr~Ej<J<S+Lz#!{s?^+x@X#{-HcFPWbSb0VQqN^UAF@Jfsjd3wRptHNcH69@;
zaXK9y2c=NzUE?{eaKpvu#OX3s*$RU<92q6RUGB;hAg5t?2Tybe@<K(U_gENK`=sM8
ziVU=minxJ~6OVBsx)?BERExiu$!h|z#v4t|j|o2K2$9j?wC20L&zLr1ZkQOfw^tNU
ztZ{uVtke^;V-#j}MLytjG*{?q<UWWsZd=C!%5!kCj_=rj@jhDFI4mpLlR#(Nfw^I8
zp`<xQZh}$5Lex|H+_NKqNY$Wr3KMYHz$NS1jPE#<ga!+^@kC#y(yy7i=uqrKq_8oG
znY;DdeyB*50`FLVzIX^RX4^3CGdnbw^K8#$@73i<?sQZGI)x}-0mcN)SK!bEWjwpw
zwx%mtK_o@e`G0|tixfHk&sqb6m#G~O;)bvj%$3s6Rpk>!MTZ(R#P2T09^*tc$JG$v
zGb9W2Suy$?$y0={q_*K>$@Qzf>Jw1<s&YY;qI%XBU->-TpxquEol?d|0%0?#mTv>h
zHYk1G^E$=UI?rs58faLExDdXPGhBvh-VO4UVnsO%J*JmAI~MLxcYfZQ!0(P2m|q&Z
zW&FAWE^Q@bM>hq~L?MB@iR=jW5Fg1wlkgr!0LBo(G2X@g2LH?yMkckA{jjOH{Ymi3
zJz$ck9#x-9Sq8A#G5vl|fk^umi(mMRkl&BmgVRPT>^02F0ay_M!{v09z}~<O+{-ZZ
z3q&vi-{Ykc8YnaM`1%H)aN}39g+lF{>B}2*h3$J1l<g~*0i=1gcjA!JcpD5M)08J9
zD;qQBGkt>4+I#Rja0>vLmC1J{LD;8tWZxo+5RCo_l3hgO_IRXF04?l>lOV&3f^48E
zR^nsZq<BB~C_Wk<pzNYVWeYLN(3OEw<^EN%adfp;aKZ_eRh*f1OnRE-pdS&D6}Nh&
zC=%|{U)a+fLVx?A5VjyRVV`6UHQhvSd#w-39PWPOpE0;v5(!Cpx`Q1S7!8-kJqz#@
zB+XPNQ<V&IQ{Wh+0~l#=OsfqS2n{yu>Ii==(D)Hk7nI>MK<lE`Sh7K%*<p=(=KBUU
zO%rq3>`OFv<9=hfGC}WZxq8-JPe29`U}(s|779yU<=GjZQdO_NH@cj)m!*9J7G;@(
z#LV)hKu%N;&NwOnXBVAj>BKjHr>usJmq|RiDze1yeSIcabyo)9#!-VKFi2+jO0#xs
z1jZjG@K($4obo0o0M<)OgTyxs9pEnqqXHImsMcybE$_XxuxqwQ%Yojo8|rx2+$>t6
z-tk{0Eu5@1B74d7*5+dAm~47v*nt*#66(NP$agiR2+N*VE92p1vU6=G5SlXCp<c4V
z`kd-yU{`}@lG00n%VIAle-6|d-*UNe&+1{kZlDW1223;fi>Rf{(;&`BZ%-G)C$NY>
zDfR%GRPZq{kz<8y|4MTkz&C;kcYs;KG!|S}yhK#K#!h<!uCPf}rY@6QXy>%-kwH4B
zTDY#2-+kX((p(VDULDQ?I_=^UV<bTMP^7)i49axAJ1Pl~4Lg~*?Q6R-ZBgaFVa|P~
zke~%iBBf#IF+y(v+i_)NxQF9YVT_{HR?a-)lvM&JV~IATZLa1vKNW_-$D#$<I2jp`
zb1X&ac_SKPMzIP`a-f|x4!4B2v)Y=o5F=dtSabn30c<$p>!y;Hp)|mv8t{K%FV%zP
zPdx-wZ+5(Zk&4i@8*ugUqx&<S6PhqS7KGk<USK0(KF?-FO@csnr7_71GgoVJed$C>
zv5Gz~<zCjx#8vrVjNYPVrK?;}K05P$jx-a(ZYkgcf3t}5hlVm1+F*(*Wks9)mL}g$
zprcK00~^W-6jE<3J-QF*F-t0y6%-sNuva-e3{O^2wkfj$X!PhhR|TU5?oyXH#;%lg
zDIuarAb;$8C6YGLYWZ+jdjhqV4(Y(vdyb3-$zHFV0Ku}-G>Go8rxl7qzAFLl29LOf
zE24cNYHFKV*^yb{$sTMDo?@xlIv9stqNr!d?Ubx1o=cQw!!kkABZS@(e6<p<<X&R2
zXX6#@7C5<v--@|BS}x)lTwLw9AnWrkLpAM-TLo|xFosFQ#fi9GCG2vvGJK`Z7*58r
zd|5&-$(|gvPSms=n6s8_>lHD`s*E#R+B-NX?EVBEOIv}ZFL3-ZFo`s!BeHcYG!57W
z9|gq4pAwazhlr>>TrhOE@Nr|{;}3n46GdR(X0hE!^iK<sOt_LX!XPU~=9Z&pARX|1
zt4(sYGBpsAQik9T&~y<+Rj!f$MZZd4w=QC}lX-kNY5$@BD^V!@__}5ODgKY6Ulai3
zg)JX%7;f8b(Hj3hp{V&3A2e~p3C^AQuP6Wi)3jc|zn?e|1CHJ#WZ%gQVDVl4cOJ)o
zBPslwk5R~v8GXd&Blqew7u}E8QU52rEqvaKthsg8vNC2!ysQX|-_qtAn(lT>lXXsi
z{SjA$e0%hN@+S7*0kjJLgL`-WD~V<7Rr`UDKH72T=nvnW`G36LgmU}h8?#|X@M4=U
zuJ+ddWYycoKEY(VEq=41aS=%xSCZU?Il8i73Hwz!3|*{z)6>c>Sv~uDQd3f?PxUs|
zEf$Jh{`DpQ{fk98ejKQ2R@QcPM0_4qlq8J!WE)lF8DV-^X!25B4bsm(^er>7KUQ7^
zOW(v?KYwT%^F>M~#&d6U&G>u?eqjzlXDUW-#nU0F`lm|8pyG4T-((x5kE~N8ly%Q!
z!D9a(JQrWYwv3=@vk&fvTBHv?tbwdsuKGrlfnCf2wYiBfb@*CByo3_`SK!}Xv_;Mq
zbt7n#l2ZzeE{VMhkOK2cD;}7bMtxw3M(mV);MyTNGV=7u$U#@*Du4#%VU-Prq4Vq;
zy&t~I!|HmlS&6v;9;+V)HlkU^dVp{?iRQ14pVvnaqtDp;Iz_QHBVTeEiAA-qYlY}d
z5Xg*A_uqZN@pYd>m94SO_4ZwUU=eBR0}w7T!UGo+DC`Q#f)5bH><tD0kGgivGWRmx
z>;4npLBcA9fL7m$*4)Xnz^Xe-uh~lnH6O^Qi=|jisYSG5sWiG`dj-H+BV?-wYkgC#
z4`@F~MEpk!_DM(?WhK-{bgF=Yx|zxO@xYhL0jPcefpJSuir|H^JyeM9L)n@y`AQNh
zGRZeQLZvyk{A1C-G01;^kVsov%!Z}88+1KJ$)poq93DSgP;spsmo@ERK~uqLs(<oi
znGeiO;T<Y+14O5cHYz*$Iwn6NHwn)x+2;Yxu{Kj?O>H5hs{u-Dy7hGIqhI^3T_@u^
zHwQsOS!7?%nZJ5a;=)L!mUf}nHfLfH*tC_&CW2o2&`v*6+TPmp-B>&tOv`x9+<+y8
z_CY$d;CssBwB_R#Mj>BU(Rc8zWyj)g#|zU0C1S^X<DBKn@N$rQcFhJVdNme@A=gvV
zy*IWmWf*lLC|1*^AwS`OMZm0!f)%wK@OL+M#}&{u5ITq1w}_K3Pb_})ZcRScC^PCi
zX$G!Qd*JGem<^e^5RBXsEC1s^ScOc0{F<WmjJaZAE_l?3tNz0t(GdGO7nI+1#q?(L
zOpK9*>Of`;d}fFe#xz7d#{JlSGemG_IKn~c+7t9pLv)c)o;$v4e(5nW_0jbXRlM0M
zB>@Wm(C=w~g08E;fZZ|lcb1myf6^D75MOHF1a~Yg0?)U6|J}aTFB616A@q-%S<BH#
ztGdA?;>{?Hk39E24xnvXfYdM6+5_iMPb+0xW`;@vJCq09Gdb#%K)ubt2UeTpGe(0y
z_f0dY;G2I5JL#0q7&J@DxsHe`PQbqgi?)SN)T?3~5P!@LUikgm$HoKtj+J)VqyPj|
zpiagmCuo+uAUaF^;fUtZv~{#rvy(b1c133ItLY7lGL3m67yNM@E$zOa(`l}|ZhuMP
zw&^Otuv`n+xrK3&2^#a;Ha`36MZU>KGw_q$oR^<vy}e~(3;p;yS=5Qs+x@zz({A*$
zC;ijN6@_#k6~pWwB{}Kr7`~L;8wAbH_wU)*=hKuXxIHZ(;z3Yxa+xh?SsEH2on7en
z>eHjy0H-R@jF|2l;oMaWYKH!vACmQCQxCq+H&jqy;aUG3HbR~J!1w`Vo~xL2l3aAy
z8a*|efya4}G(NMNAj#8zI3cp~VSy)CU*Rf{$XFNxXL+9Xp9HyoZ({%bzgOI^l_tH&
z-Qv+UanZ_6-AB{)<$YkFmx4a+u842xm*-mNf~<ZG6%<1E=8JlkZ`=ZX-F5#H#Ov5o
z*Fb^Y`0xIqGIPmN)<w6QDV?oep3fe?x3r$NxW3f=rt`!>BfxIvI=N>fJ(pi>v_S0J
zPWLg)?p*?Ok`3aAdsylZB;3glZqW(RAN%NIstKs{&pnuz1P|>W&!N8SFcG@X_OX=B
z*wyAzCGll>fx>y`5-_EzKA`TZ2!0~px_x|eCvN_iO_s`^a;Fmywq;!Bb-mc+HaNZE
zhvoADnSVg>YrR-zwir7r_Ad|i;<u0u3o^q3)7`A!HrdCU(*^#d%K$Zsj9I;YW+wZl
zr|N&0KJ33O^PcCd$u^Oor=))`I}pq2%}DRt%zj%rEEkOQ?<K5r^lh%J2wOJV(&V<K
znZufWr&jrf_t@3N3Yw<E5}R4=mUG^G^2KIIc8P6`PW>%(kMoS@i`!nKk^dVt^Z&){
z_9=dG+%pD@dv&l|1T|{%oU-SRm&UF!J!s`P5x4Q>cGKJqZ=vUJ{G4v;VwD~<@!RBQ
zd3&v{#(wnb+B(yni?E;990e_RzU}=$fplLBmFCBqW26?HUwrWGPWt%xgTFkm&->cy
zM$Bh<vFnx%pY8kD!`o!vu=TV1!uC>q8(=~I>G{)RnUt2<Joh#IdpdoVHw3{)z@q86
z8^7W6;}>(++-3s|=ThHo(t`&!`Z4@{mrD9JuJg(Zv$ES!4B~fb9?dL%X0nH-45y{W
z9*5+{PB7k@xtWH~=CAoY_ZM~BqFJLt=pbG+o9ln@_394O8Z(hv^T5p~9lY7^>~!7+
z*I1VG`pfDQDN)ExiuW}A`%>-n`4^w=jv5q7r(p-zl86~BkiM3^UhX`#dk^tZU%6M8
zv$LN?L|4ko+;rcH*(csVb>6pN-v}YB?s^pc-;e!&qn!SqA6p7u9EZkqez`v9>j<-T
zS6m96`MQ_RCVrdQ$u5k8zK*6}SbZ6L>X!%WOalRS`;BYgS!Pbr^S0;lHC23y89gRm
zotw4X7h{^^t-eWku$g0)HqrOdCK%w39b)h2e79-s!AHjfmNxZFd}?`9Pll6kRlMA0
z3ifaiO(g^*ULHhl{B?Btpg+y*+QeEU>-%W4-|xpe=PT~_5Ij7W&TTb4X9esYY<qF0
z8R5!S(+jWt?Z^|XgPS9)9$j-F_IBR*hlyuO@@&3GX8em^o4l@@Afd+x|G;@Z`OO^5
zT5QB+OP>m@-|fxBJLR17vDE(IM!qg6H2b07wnOpC96Y|91Ilr(#8u#XbGB_=KIYT;
z{cy{p$?&w-hwLoPte!mB6Y?V8N_#)p^j8m1jwe0h<JDb%FGB>DpZZzbAfOGg<%&zp
zi=RJ2j~{+@<5NWR<bIIZkIo@4Hhz*OJ31-7vZm4OfKCpGE<D`r_YdO?O;_5tXo5Je
z`CzCK+Qs?p)2Si9tXXHe&FT-$6rhW>I2VZ3F4b(wJ!17M&<d49qsD*id}{&~=UuZA
z$HLgQr>zcX#`yZNzMt22ZZ*rvQZ*6U&B9;&Jh{R2D?9N$SQ~8qXR{ouW$hm9(w<U`
z@XEUO$-L<)qVL+=A7)qAN2_1WBrt8`XRBbH&SrjJnLTsX0r_(G#6Mg<jLK&|E-1Qo
zlfT-|r(Wq?>z(5==-{M(nd|<>x$Tp9)09E5&o3atdeem2l2x`r%64RbR4mLB{WFwL
z$-v8(kFef25AN}m=l6jH0j|r(?0|~{bAPq^b;>_dURHhAGTZsg5B5o{7tG&4qC@Pk
zqsETd+*oUcu^*)GKksZBjo#%B-%0qCb=Yb8w|=8G+9-K?n9W^l66muR-N^pwUnA!K
zH8QMhN`JievhcLkS1}>i)|i{_R+k(z+oSssvz?$}*WFW{zkId$GCZSyi;0<8iSxei
z3A#rPxd~ReFX`c@d{-#!$nlu(jpo-qvL1AmraPKu8+wdtQ0b(N)a;z|k;xaIbW{#$
zxvWB`($oYqrPax6+sx)}t+C97TUnKO%Q=VH2iJ;zdi2})^-0~8#hz{Q-L{S@GsRnI
zj*HIYtKqk6J9n84Ie$JCe#x$UI|n><eA`ZyQ3IR_T>H>(_%usHg!4o~%%QPm{~jhK
z<FFa~t!1a{Y<~QW0@s|qDg*!{9U?wHzCYuM@W-Xf35F=QnXj7!875~!H^QU^vvrmK
z%Quhiej)3o_VIgA&#!Ju-}Ffup_?m5wg^6waZ9=j)Rkjztc~HnKK)M>jVRE^ddh?{
zgX6S%6!qbkvbD+SXy{{a!_{Rk%vS#Rp3}+?xi5EJ+X3L{!xnd2<=R?JPcU8EF6Lg_
zVCtvdAe?n4NIqL={xPqj+|1`oYevkGZjkp6G(%0#qDklO;p?63DCL9ooKam12sq=6
z$+#z<KujE?=v12j0lQZR86UiSpYytQ#o?`5MUU@xPZM%GvG>Wkj_Kr&*4i45utd&g
zHzDm?OxEhI=WL@q`VHSa@wVWEkGmo2N$kPAh=}QjyPK1Vvi9o__T&~l>U)pMGQqh%
zVumMLJ$r!APMNJlz!B2mD$%`+{z-qt=-~O!uE*Mp>pH_x=@lCY*6BMa8r}<Ry$kZc
z<Vq&GHxKK_4RL$#LOw=+oV}Glu{lpK64bw=8|!yOR{cjc@S-p9KGd>J$DU1{d%~Ww
z4fHZc$oBXe5KhLwJ}j@t@rmf&Zmh#?8!%>Tolm`3{1kCy@<Y;@V!b)}?f0O|PE+m=
z;GWhoF&-wpZ$Is{T<#38bN6E1ck;?kV9#1j$9Q~<708oMeGGDv!km!(eO#JB*@uHp
z`2*yBwtmzE+WNb0FyTVZ_RXfDRtH>89)+NT^UlDaJRdNk?3x8;_$~5*Ac0*}1ji3R
z{2;(EYBT?*%f-iEK=lV!pL8@%cY;WghYgU4&cp_FQ!{qiY}~3@_<o+NkOJ2Qy!^%8
z{N+%y@yij#Zrj{PRtMuZ*8Yby#NP=;JzLUunO?Svn}~D%_2riF9j|Z;$t|Ydo$Jm0
zz5?OSgN|;?-6w^apJ+*&eFZVGT@GN_nY!fN5!z!-BWsGYfCR}iRp@mS49Wpx4I(VY
z`q`xaIsGdq-K+C&g&!3DoS>M3?{;TdJ$<mXah%J#=Hy=4A}sevxi46ncb{eSj*uPd
zFWQ+nKIxB+mQs&HFaxFOD`4}g?9CDz2%698)adpN7myjS!VC`?8D7*AT-E+f<7xi(
zuX6uLFK+A3h4tLuz`mKzKm5Z9K;CCjwPjHfqEVsFto>i6_Mg6J9P_b$+uS_XH1+?8
z#emt|2K0EoU~sJCCVIvINkU!sOub#lhC`sZMY)sU*gWpebQvW9F+1Xry?%Y?2Hm~w
zxnIwgtfzXJ9vPHn?jX2Y-M^CF>7)7sw;D-u*yfpGyRqH*z8p{_3NFO}Mfi$u*3vCP
z+o;)vE7%WdteP1y*ml;^TaWC`)eS!MB~uo2%JeVj9_+77kedt4y}efGCEO6{sC0;O
z_)@dwYTT(y<^vOX#m)LF=DE1^<Aw4g4I{Q*zUzIktk2drSjQuVLn`8xWY|vqjfw|g
z)60YUC7?3t1QJnM6h>!>*d6y}QPgCPMJaJKe2?|D&)Td$R!H>SXTE~}i|-D`y;zVP
z^B${1J@xwEwKjnBgxYb<9dnqy_sRj&buE0OVI>+<*}oQ`@AQq+u6q9}A2l(VCUkx_
zn5=%;JQO49Q96J01I{qKEBEX4K6A)})fa1h7lk<4CQl7Tj=XT)gVXl-w~7ZADZ_b<
zus<~=QD)Dw#6g5ibq-XWlgC#V@mtI=Z@m$pYF}A)T+wVgQCak0qm$wZf%2?j^Wo|H
zuoUo(?;~@eR;RvOsgh-h4s?BNJKpxn9?ClAlls$VYdKGT-XI^HUG%qC{#G@)b^M*5
z#q`s=$xAby&QD&67*U#%GisnNFzPx#4AVe$K*<{o!pK%IvR8SEkuBLT3!B;i0Uc`A
z?zi&M-tH@`)41vTmX7MTdpn+X9^SwD!>f6yF3-5Q_|Lqt{7E$`_pMrfN+l3o%|1N;
zx6wKe|A~iLIZR$_&Q{veUfR;4H%;Mf0n)zBb3{mEX0J`IHMMAIxAILV6-1b!(><pr
z?2ls25}fZZ6(O<&2R{12&hHB|&&BFYUu{1w%5={npeEOmvd-N-#}cR&Xc^Y`VxHt=
zngzzdV)8(8zo@+L66VpI<&zE5=QmDoA*j0^29L)m$PL-^uWq>Goj1OEvGKC9)?AVy
zyM*2ipX@xi-UMW($O1&fIx2Axzg>gcdcL;)IJ7Nbt=sgX)T}P1)@k@fPJ8D!S*9Q4
z#Au#bPgPxS*RgXkuayMD0Jb$N%>%^Fb*J6PK~CmCp<V@R{``Qol&<-5d`d9!IRT=Z
zCD=txzmk2>EOOGjyzP9l{w8~k3Ahr4N<JqJs;Ibj4~NwWN@KrNbtRh)pXw>_Rad^a
z)35>WfHC{{<#qSPw_CiHkefOWG5@Kr^DoB#?_D8l(+B70@sFG}X7-C|7P))Vn|kcB
zJW-=P8J?9-4to<1g3Q95eH0&3zXOXePJP<xVAk!-_{Bo?A39)Pq?A}fazGuMep9&U
zUficU8K#_~fXfXwLCuby5{$q6EYF>ox6`6?pIP>)itjd?e!Hk-?lpruS5A(UP%E+&
zulya4q`dk$6TpOEPA1#U`W8)hnEGcOH%}X0jId7FZgF|G#Qhln15L+Ut?P*RXI<rk
z>fFl_+NnJYzu#vtbL@BU+h<O4HtVvDvHJZNC^^P2Fw3y`FjyUO%d1PF0^va>jzINt
z?VFTjb5_@ro367J_cBTduoFpBnnJ8J9z<<fY_lT8#^l-2Z*IZ*?p=P}^yhAfb42Ic
z&k5UB?<rq@hxq#i<>>Ck1+0yi+GrIq0g`9jT5Ei3Op7+($ndo?ok;w0S@dF!$zJpQ
z8wC&n{%P9%yfvG~LtY&;DeYWm{+07*ukM@Xn3*Lyr(d&Z-!WH`ZVIF!_p!){PUp3V
z!`tz&7xzE)e2oL;e9`u>y9Leu!8{3F8?60lF~?Ouu=XY|S~q3s<hQ$RtQ)+!@2zR4
zty$R>^UPiJ0`{hiXYZXn-@e2lC;c3OYgeY@9{m=(X=M8(`~Er;7w11ky``<we+J@9
zV9!81$@w$H=`(qF!^E+Z9v7;E7kW*xmt3BF-_UmYLP~e3jXF8r?`DNn=FUB$naV-D
zrQMu`H%9fnIqR^!>2D$E5)+8m)Z}kJu@9Q3(v}}OwQF4CA`blR;svy4g0beN=JTk}
zUeT1`^)Hk`G~+7GXjJ!mn^^!(Yr@3R_{4Z1!u|!`YDdh$oY+rtZR`ru7oxV^^r+za
zZkxI?u?BB`)L9)9r902yz0VwO8*2aRC@#yR#cE;Ej2((oxXgZRc_|s`d+!u3+<vf|
z-$yRI0UJ?koY#74bPPLy`>kEdQ0(_MqrH_a99T=)_T`SdYphIT2gCh5;U(Pm6wZOe
z`9+wY-XQ<1VZX({c8yP9asHOQeXv4ZU*9>kds>v~k{mGTNiadfIR82qi^R@hfA~DW
z%kJl&j^xCe<^E%kc71KTEg&)06KiVvb&E80+iT~Bc85sWl7!X-$t&iW{Y*rh$zZik
zr%YVWbS{f{(z#*oKJ%xK!&gtIq;cPb`!J3sa=Yxi1)ZWIbX1*@ao)_;1I!(H;2Os~
zR0${~kmM!rf4XF+8UjWBeO*AHegRyDu*B+l%+Ei+yykhtIXmj1vM<xz8oKs)is#SM
z8U3C=Pa)6zh&0b-C@;k$M#asFLp?zD2Ix(cMriMadvC6ii${?03gUoJTmEenft;K9
zr`xVnZWO?@0tZX}2N-tx+}g`lpIx~UW4@N?XU4^8rs`D*4QI}v>a;$BWr!^_ejySx
zbWhacE@Ba~#{JWj@W7_hp#+BYMdJUrqGJ)sTh~@6eKD1j&--fZHh16lB^!5J<UZMv
zy8YZa|7hZqY%xpRFGlIUhaZ@V%u@_XpZCqZuCn1%vPSY%-~Y$goqT<u{pZA2=bl`>
z{=?Yt*BOb|v;60Wo|DM=u^zaV!TDF%oVo93{onb0^Y-ZU>UX!E0;l@07uIN^dxANE
z^FDvtE7)1%wrxMmP|wHr!vJ^;;rdxM*5@C6uD^Ij#%5;exhr<3pM?RJYQMgDewW?j
z_VZt6zcvLPrE$}E{m*N+`p<5DmP_;$P%P(%{EzReV)^gyB)Vn?%{CUa0p}poHJ*}k
zvfYPULKz31ZLR$xYeRI=0X$lb2Y5Q$xqwsZr0ChIdZFQL_U{+g6~qNRxH)}55;z+>
zXW<loQuJhdgARK8cCq{e(P<nQ>BcNl8!VkQ=aZu6`ZQpWuYbGv{R5)QC7`#`IZP6Y
z+k)&!(X(C`bRgbs_xlG)NfYM;fU(Q7v<59rLwhRNMdPAD6X4tW_cfDpwB{T|VC+hI
z{lsfDnuU9|0fW3USH70LpUBJzGTp)%7`w((K6R3yry>`0I^Qk3Uwm>zPQ=nZL!E9o
z>;LzPe{9YF`~QE}^WS-QUgZQS`AdQ6eF)Q;i(lAgm%qCFHine6b>0aWqUi@Cz$Y&f
ztFc@Qm>}=1^xsyDHp7K?;e!n~P}e-xWKXoDfH&FPTM0@h%k6HSBjtSJ4>}-SVm+!P
zC6wi$@^J326l>zEYT#*%n?d<3(qJ0K8VEezd@$Dw80_V*CXYrIa5#mok@e$0<6D~>
UGc0{QBN>3e)78&qol`;+0QFZE)c^nh

literal 0
HcmV?d00001

diff --git a/docs/manifest.json b/docs/manifest.json
index df054c789ec25..023479cad22bb 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -908,6 +908,12 @@
 					"path": "./ai-coder/mcp-server.md",
 					"state": ["beta"]
 				},
+				{
+					"title": "Agent Boundaries",
+					"description": "Understanding Agent Boundaries in Coder Tasks",
+					"path": "./ai-coder/agent-boundary.md",
+					"state": ["beta"]
+				},
 				{
 					"title": "AI Bridge",
 					"description": "Centralized LLM and MCP proxy for platform teams",

From 55be304e532def2024bb0fd1654ec06b535f4716 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 8 Oct 2025 13:39:47 -0300
Subject: [PATCH 089/298] chore: replace remaining MUI buttons (#20200)

---
 biome.jsonc                                   |   1 +
 site/src/@types/mui.d.ts                      |  10 --
 .../InputGroup/InputGroup.stories.tsx         |   6 +-
 .../DeploymentBanner/DeploymentBannerView.tsx |   6 +-
 site/src/modules/resources/Resources.tsx      |   5 +-
 .../UpdateBuildParametersDialog.tsx           |  11 +-
 .../WorkspaceTiming/WorkspaceTimings.tsx      |   4 +-
 .../CreateTemplatePage/BuildLogsDrawer.tsx    |   6 +-
 .../LicensesSettingsPage/LicenseCard.tsx      |  13 +--
 .../LicensesSettingsPageView.tsx              |  14 +--
 .../NotificationsPage/NotificationEvents.tsx  |  36 +++---
 .../OAuth2AppsSettingsPageView.tsx            |  13 +--
 .../ExternalAuthPage/ExternalAuthPage.tsx     |   3 +-
 site/src/pages/GroupsPage/GroupPage.tsx       |  28 ++---
 site/src/pages/HealthPage/DERPPage.tsx        |  15 +--
 site/src/pages/LoginPage/OAuthSignInForm.tsx  |  61 +++++-----
 .../CustomRolesPage/CustomRolesPageView.tsx   |  26 ++---
 .../ResetPasswordPage/ChangePasswordPage.tsx  |  13 +--
 site/src/pages/SetupPage/SetupPageView.tsx    |  18 +--
 .../pages/TemplatePage/TemplatePageHeader.tsx |  15 +--
 site/src/theme/constants.ts                   |   2 -
 site/src/theme/light/mui.ts                   |  61 ----------
 site/src/theme/mui.ts                         | 108 ------------------
 23 files changed, 129 insertions(+), 346 deletions(-)

diff --git a/biome.jsonc b/biome.jsonc
index daa99a8b90ce4..d1258a77d65ae 100644
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -51,6 +51,7 @@
 							"@mui/material/Popover": "Use components/Popover/Popover instead.",
 							"@mui/material/Typography": "Use native HTML elements instead. Eg: <span>, <p>, <h1>, etc.",
 							"@mui/material/Box": "Use a <div> instead.",
+							"@mui/material/Button": "Use a components/Button/Button instead.",
 							"@mui/material/styles": "Import from @emotion/react instead.",
 							"lodash": "Use lodash/<name> instead."
 						}
diff --git a/site/src/@types/mui.d.ts b/site/src/@types/mui.d.ts
index 49804d33f8971..daad165f7d335 100644
--- a/site/src/@types/mui.d.ts
+++ b/site/src/@types/mui.d.ts
@@ -13,16 +13,6 @@ declare module "@mui/material/styles" {
 	}
 }
 
-declare module "@mui/material/Button" {
-	interface ButtonPropsColorOverrides {
-		neutral: true;
-	}
-
-	interface ButtonPropsSizeOverrides {
-		xlarge: true;
-	}
-}
-
 declare module "@mui/material/Checkbox" {
 	interface CheckboxPropsSizeOverrides {
 		xsmall: true;
diff --git a/site/src/components/InputGroup/InputGroup.stories.tsx b/site/src/components/InputGroup/InputGroup.stories.tsx
index 77c86e52344ae..728970af93c49 100644
--- a/site/src/components/InputGroup/InputGroup.stories.tsx
+++ b/site/src/components/InputGroup/InputGroup.stories.tsx
@@ -1,6 +1,6 @@
-import Button from "@mui/material/Button";
 import TextField from "@mui/material/TextField";
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Button } from "components/Button/Button";
 import { InputGroup } from "./InputGroup";
 
 const meta: Meta<typeof InputGroup> = {
@@ -15,7 +15,9 @@ export const Default: Story = {
 	args: {
 		children: (
 			<>
-				<Button>Menu</Button>
+				<Button variant="outline" className="h-9">
+					Menu
+				</Button>
 				<TextField size="small" placeholder="Search..." />
 			</>
 		),
diff --git a/site/src/modules/dashboard/DeploymentBanner/DeploymentBannerView.tsx b/site/src/modules/dashboard/DeploymentBanner/DeploymentBannerView.tsx
index 4f9838e0255da..eccd9ad6b62bb 100644
--- a/site/src/modules/dashboard/DeploymentBanner/DeploymentBannerView.tsx
+++ b/site/src/modules/dashboard/DeploymentBanner/DeploymentBannerView.tsx
@@ -1,5 +1,4 @@
 import { css, type Interpolation, type Theme, useTheme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Link from "@mui/material/Link";
 import Tooltip from "@mui/material/Tooltip";
 import type {
@@ -7,6 +6,7 @@ import type {
 	HealthcheckReport,
 	WorkspaceStatus,
 } from "api/typesGenerated";
+import { Button } from "components/Button/Button";
 import { HelpTooltipTitle } from "components/HelpTooltip/HelpTooltip";
 import { JetBrainsIcon } from "components/Icons/JetBrainsIcon";
 import { RocketIcon } from "components/Icons/RocketIcon";
@@ -323,9 +323,9 @@ export const DeploymentBannerView: FC<DeploymentBannerViewProps> = ({
 								fetchStats();
 							}
 						}}
-						variant="text"
+						variant="subtle"
 					>
-						<RotateCwIcon className="size-icon-xs" />
+						<RotateCwIcon />
 						{timeUntilRefresh}s
 					</Button>
 				</Tooltip>
diff --git a/site/src/modules/resources/Resources.tsx b/site/src/modules/resources/Resources.tsx
index 094092619347b..13e1bbf835252 100644
--- a/site/src/modules/resources/Resources.tsx
+++ b/site/src/modules/resources/Resources.tsx
@@ -1,5 +1,5 @@
-import Button from "@mui/material/Button";
 import type { WorkspaceAgent, WorkspaceResource } from "api/typesGenerated";
+import { Button } from "components/Button/Button";
 import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
 import { Stack } from "components/Stack/Stack";
 import { type FC, type JSX, useState } from "react";
@@ -37,8 +37,9 @@ export const Resources: FC<ResourcesProps> = ({ resources, agentRow }) => {
 			{hasHideResources && (
 				<div className="flex items-center justify-center mt-4">
 					<Button
+						variant="outline"
 						className="rounded-full w-full max-w-[260px]"
-						size="small"
+						size="sm"
 						onClick={() => setShouldDisplayHideResources((v) => !v)}
 					>
 						{shouldDisplayHideResources ? "Hide" : "Show hidden"} resources
diff --git a/site/src/modules/workspaces/WorkspaceMoreActions/UpdateBuildParametersDialog.tsx b/site/src/modules/workspaces/WorkspaceMoreActions/UpdateBuildParametersDialog.tsx
index 7241bbed439bb..20f962eb41fb9 100644
--- a/site/src/modules/workspaces/WorkspaceMoreActions/UpdateBuildParametersDialog.tsx
+++ b/site/src/modules/workspaces/WorkspaceMoreActions/UpdateBuildParametersDialog.tsx
@@ -1,6 +1,5 @@
 import { css } from "@emotion/css";
 import type { Interpolation, Theme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Dialog from "@mui/material/Dialog";
 import DialogActions from "@mui/material/DialogActions";
 import DialogContent from "@mui/material/DialogContent";
@@ -10,6 +9,7 @@ import type {
 	TemplateVersionParameter,
 	WorkspaceBuildParameter,
 } from "api/typesGenerated";
+import { Button } from "components/Button/Button";
 import type { DialogProps } from "components/Dialogs/Dialog";
 import { FormFields, VerticalForm } from "components/Form/Form";
 import { RichParameterInput } from "components/RichParameterInput/RichParameterInput";
@@ -97,10 +97,15 @@ export const UpdateBuildParametersDialog: FC<
 				</VerticalForm>
 			</DialogContent>
 			<DialogActions disableSpacing css={styles.dialogActions}>
-				<Button fullWidth type="button" onClick={dialogProps.onClose}>
+				<Button
+					variant="outline"
+					className="w-full"
+					type="button"
+					onClick={dialogProps.onClose}
+				>
 					Cancel
 				</Button>
-				<Button color="primary" fullWidth type="submit" form="updateParameters">
+				<Button className="w-full" type="submit" form="updateParameters">
 					Update parameters
 				</Button>
 			</DialogActions>
diff --git a/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx b/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx
index 847b531949c00..7614013c9bfbf 100644
--- a/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx
+++ b/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx
@@ -1,5 +1,4 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Collapse from "@mui/material/Collapse";
 import Skeleton from "@mui/material/Skeleton";
 import type {
@@ -7,6 +6,7 @@ import type {
 	AgentScriptTiming,
 	ProvisionerTiming,
 } from "api/typesGenerated";
+import { Button } from "components/Button/Button";
 import sortBy from "lodash/sortBy";
 import uniqBy from "lodash/uniqBy";
 import { ChevronDownIcon, ChevronUpIcon } from "lucide-react";
@@ -96,7 +96,7 @@ export const WorkspaceTimings: FC<WorkspaceTimingsProps> = ({
 		<div css={styles.collapse}>
 			<Button
 				disabled={isLoading}
-				variant="text"
+				variant="subtle"
 				css={styles.collapseTrigger}
 				onClick={() => setIsOpen((o) => !o)}
 			>
diff --git a/site/src/pages/CreateTemplatePage/BuildLogsDrawer.tsx b/site/src/pages/CreateTemplatePage/BuildLogsDrawer.tsx
index fbca0b5626307..42c3f9b47a5ca 100644
--- a/site/src/pages/CreateTemplatePage/BuildLogsDrawer.tsx
+++ b/site/src/pages/CreateTemplatePage/BuildLogsDrawer.tsx
@@ -1,10 +1,10 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Drawer from "@mui/material/Drawer";
 import IconButton from "@mui/material/IconButton";
 import { visuallyHidden } from "@mui/utils";
 import { JobError } from "api/queries/templates";
 import type { TemplateVersion } from "api/typesGenerated";
+import { Button } from "components/Button/Button";
 import { Loader } from "components/Loader/Loader";
 import { TriangleAlertIcon, XIcon } from "lucide-react";
 import { AlertVariant } from "modules/provisioners/ProvisionerAlert";
@@ -103,8 +103,8 @@ const MissingVariablesBanner: FC<MissingVariablesBannerProps> = ({
 				</p>
 				<Button
 					css={bannerStyles.button}
-					size="small"
-					variant="outlined"
+					size="sm"
+					variant="outline"
 					onClick={onFillVariables}
 				>
 					Fill variables
diff --git a/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseCard.tsx b/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseCard.tsx
index 99c6a1f10b3c9..1bcaa77cea0c9 100644
--- a/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseCard.tsx
+++ b/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseCard.tsx
@@ -1,7 +1,7 @@
 import type { CSSObject, Interpolation, Theme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Paper from "@mui/material/Paper";
 import type { GetLicensesResponse } from "api/api";
+import { Button } from "components/Button/Button";
 import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
 import { Pill } from "components/Pill/Pill";
 import { Stack } from "components/Stack/Stack";
@@ -106,9 +106,8 @@ export const LicenseCard: FC<LicenseCardProps> = ({
 					</Stack>
 					<Stack spacing={2}>
 						<Button
-							css={styles.removeButton}
-							variant="contained"
-							size="small"
+							variant="destructive"
+							size="sm"
 							onClick={() => setLicenseIDMarkedForRemoval(license.id)}
 							className="remove-button"
 						>
@@ -150,10 +149,4 @@ const styles = {
 	secondaryMaincolor: (theme) => ({
 		color: theme.palette.text.secondary,
 	}),
-	removeButton: (theme) => ({
-		color: theme.palette.error.main,
-		"&:hover": {
-			backgroundColor: "transparent",
-		},
-	}),
 } satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx
index 2a0b7f8d39b55..cc2e35df6b6c7 100644
--- a/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicensesSettingsPageView.tsx
@@ -1,5 +1,4 @@
 import { type Interpolation, type Theme, useTheme } from "@emotion/react";
-import MuiButton from "@mui/material/Button";
 import MuiLink from "@mui/material/Link";
 import Skeleton from "@mui/material/Skeleton";
 import Tooltip from "@mui/material/Tooltip";
@@ -75,13 +74,12 @@ const LicensesSettingsPageView: FC<Props> = ({
 				</SettingsHeader>
 
 				<Stack direction="row" spacing={2}>
-					<MuiButton
-						component={Link}
-						to="/deployment/licenses/add"
-						startIcon={<PlusIcon className="size-icon-sm" />}
-					>
-						Add a license
-					</MuiButton>
+					<Button variant="outline" asChild>
+						<Link to="/deployment/licenses/add">
+							<PlusIcon />
+							Add a license
+						</Link>
+					</Button>
 					<Tooltip title="Refresh license entitlements. This is done automatically every 10 minutes.">
 						<Button
 							disabled={isRefreshing}
diff --git a/site/src/pages/DeploymentSettingsPage/NotificationsPage/NotificationEvents.tsx b/site/src/pages/DeploymentSettingsPage/NotificationsPage/NotificationEvents.tsx
index 32f4d56ed9909..dc220c1252483 100644
--- a/site/src/pages/DeploymentSettingsPage/NotificationsPage/NotificationEvents.tsx
+++ b/site/src/pages/DeploymentSettingsPage/NotificationsPage/NotificationEvents.tsx
@@ -1,5 +1,4 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Card from "@mui/material/Card";
 import Divider from "@mui/material/Divider";
 import List from "@mui/material/List";
@@ -15,6 +14,7 @@ import {
 } from "api/queries/notifications";
 import type { DeploymentValues } from "api/typesGenerated";
 import { Alert } from "components/Alert/Alert";
+import { Button } from "components/Button/Button";
 import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 import { Stack } from "components/Stack/Stack";
 import {
@@ -66,15 +66,14 @@ export const NotificationEvents: FC<NotificationEventsProps> = ({
 				<Alert
 					severity="warning"
 					actions={
-						<Button
-							variant="text"
-							size="small"
-							component="a"
-							target="_blank"
-							rel="noreferrer"
-							href={docs("/admin/monitoring/notifications#webhook")}
-						>
-							Read the docs
+						<Button variant="subtle" size="sm" asChild>
+							<a
+								target="_blank"
+								rel="noreferrer"
+								href={docs("/admin/monitoring/notifications#webhook")}
+							>
+								Read the docs
+							</a>
 						</Button>
 					}
 				>
@@ -86,15 +85,14 @@ export const NotificationEvents: FC<NotificationEventsProps> = ({
 				<Alert
 					severity="warning"
 					actions={
-						<Button
-							variant="text"
-							size="small"
-							component="a"
-							target="_blank"
-							rel="noreferrer"
-							href={docs("/admin/monitoring/notifications#smtp-email")}
-						>
-							Read the docs
+						<Button variant="subtle" size="sm" asChild>
+							<a
+								target="_blank"
+								rel="noreferrer"
+								href={docs("/admin/monitoring/notifications#smtp-email")}
+							>
+								Read the docs
+							</a>
 						</Button>
 					}
 				>
diff --git a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
index 55ee649353158..4b42f946758b8 100644
--- a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
@@ -1,5 +1,4 @@
 import { useTheme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Table from "@mui/material/Table";
 import TableBody from "@mui/material/TableBody";
 import TableCell from "@mui/material/TableCell";
@@ -9,6 +8,7 @@ import TableRow from "@mui/material/TableRow";
 import type * as TypesGen from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { Avatar } from "components/Avatar/Avatar";
+import { Button } from "components/Button/Button";
 import {
 	SettingsHeader,
 	SettingsHeaderDescription,
@@ -48,12 +48,11 @@ const OAuth2AppsSettingsPageView: FC<OAuth2AppsSettingsProps> = ({
 					</SettingsHeader>
 				</div>
 
-				<Button
-					component={Link}
-					to="/deployment/oauth2-provider/apps/add"
-					startIcon={<PlusIcon className="size-icon-sm" />}
-				>
-					Add application
+				<Button variant="outline" asChild>
+					<Link to="/deployment/oauth2-provider/apps/add">
+						<PlusIcon />
+						Add application
+					</Link>
 				</Button>
 			</Stack>
 
diff --git a/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx b/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx
index 105e7ee501b38..c4ae645d015c2 100644
--- a/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx
+++ b/site/src/pages/ExternalAuthPage/ExternalAuthPage.tsx
@@ -1,4 +1,3 @@
-import Button from "@mui/material/Button";
 import type { ApiErrorResponse } from "api/errors";
 import {
 	exchangeExternalAuthDevice,
@@ -6,6 +5,7 @@ import {
 	externalAuthProvider,
 } from "api/queries/externalAuth";
 import { isAxiosError } from "axios";
+import { Button } from "components/Button/Button";
 import {
 	isExchangeErrorRetryable,
 	newRetryDelay,
@@ -91,6 +91,7 @@ const ExternalAuthPage: FC = () => {
 					</p>
 					<br />
 					<Button
+						variant="outline"
 						onClick={() => {
 							// Redirect to the auth flow again. *crosses fingers*
 							window.location.href = `/external-auth/${provider}/callback`;
diff --git a/site/src/pages/GroupsPage/GroupPage.tsx b/site/src/pages/GroupsPage/GroupPage.tsx
index c8906f6f4d3fb..4213a0ac20400 100644
--- a/site/src/pages/GroupsPage/GroupPage.tsx
+++ b/site/src/pages/GroupsPage/GroupPage.tsx
@@ -1,5 +1,4 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import MuiButton from "@mui/material/Button";
 import { getErrorMessage } from "api/errors";
 import {
 	addMember,
@@ -120,23 +119,22 @@ const GroupPage: FC = () => {
 
 				{canUpdateGroup && (
 					<Stack direction="row" spacing={2}>
-						<MuiButton
-							component={RouterLink}
-							startIcon={<SettingsIcon className="size-icon-sm" />}
-							to="settings"
-						>
-							Settings
-						</MuiButton>
-						<MuiButton
+						<Button variant="outline" asChild>
+							<RouterLink to="settings">
+								<SettingsIcon />
+								Settings
+							</RouterLink>
+						</Button>
+						<Button
+							variant="destructive"
 							disabled={groupData?.id === groupData?.organization_id}
 							onClick={() => {
 								setIsDeletingGroup(true);
 							}}
-							startIcon={<TrashIcon className="size-icon-xs" />}
-							css={styles.removeButton}
 						>
+							<TrashIcon />
 							Delete&hellip;
-						</MuiButton>
+						</Button>
 					</Stack>
 				)}
 			</Stack>
@@ -353,12 +351,6 @@ const styles = {
 	autoComplete: {
 		width: 300,
 	},
-	removeButton: (theme) => ({
-		color: theme.palette.error.main,
-		"&:hover": {
-			backgroundColor: "transparent",
-		},
-	}),
 	status: {
 		textTransform: "capitalize",
 	},
diff --git a/site/src/pages/HealthPage/DERPPage.tsx b/site/src/pages/HealthPage/DERPPage.tsx
index 8b4b85bd37551..3a913f23e05d5 100644
--- a/site/src/pages/HealthPage/DERPPage.tsx
+++ b/site/src/pages/HealthPage/DERPPage.tsx
@@ -1,11 +1,11 @@
 import { useTheme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import type {
 	HealthcheckReport,
 	HealthSeverity,
 	NetcheckReport,
 } from "api/typesGenerated";
 import { Alert } from "components/Alert/Alert";
+import { Button } from "components/Button/Button";
 import { MapPinIcon } from "lucide-react";
 import type { FC } from "react";
 import { Link, useOutletContext } from "react-router";
@@ -100,10 +100,9 @@ const DERPPage: FC = () => {
 							})
 							.map(({ severity, region }) => {
 								return (
-									<Button
-										startIcon={
+									<Button variant="outline" key={region!.RegionID} asChild>
+										<Link to={`/health/derp/regions/${region!.RegionID}`}>
 											<MapPinIcon
-												className="size-4"
 												style={{
 													color: healthyColor(
 														theme,
@@ -111,12 +110,8 @@ const DERPPage: FC = () => {
 													),
 												}}
 											/>
-										}
-										component={Link}
-										to={`/health/derp/regions/${region!.RegionID}`}
-										key={region!.RegionID}
-									>
-										{region!.RegionName}
+											{region!.RegionName}
+										</Link>
 									</Button>
 								);
 							})}
diff --git a/site/src/pages/LoginPage/OAuthSignInForm.tsx b/site/src/pages/LoginPage/OAuthSignInForm.tsx
index e4872d6600389..343353d18dfca 100644
--- a/site/src/pages/LoginPage/OAuthSignInForm.tsx
+++ b/site/src/pages/LoginPage/OAuthSignInForm.tsx
@@ -1,16 +1,11 @@
 import GitHubIcon from "@mui/icons-material/GitHub";
 import KeyIcon from "@mui/icons-material/VpnKey";
-import Button from "@mui/material/Button";
 import { visuallyHidden } from "@mui/utils";
 import type { AuthMethods } from "api/typesGenerated";
+import { Button } from "components/Button/Button";
 import { type FC, useId } from "react";
 import { Language } from "./Language";
 
-const iconStyles = {
-	width: 16,
-	height: 16,
-};
-
 type OAuthSignInFormProps = {
 	isSigningIn: boolean;
 	redirectTo: string;
@@ -26,41 +21,45 @@ export const OAuthSignInForm: FC<OAuthSignInFormProps> = ({
 		<div css={{ display: "grid", gap: "16px" }}>
 			{authMethods?.github.enabled && (
 				<Button
-					component="a"
-					href={`/api/v2/users/oauth2/github/callback?redirect=${encodeURIComponent(
-						redirectTo,
-					)}`}
-					variant="contained"
-					startIcon={<GitHubIcon css={iconStyles} />}
+					variant="outline"
+					asChild
 					disabled={isSigningIn}
-					fullWidth
+					className="w-full"
 					type="submit"
-					size="xlarge"
+					size="lg"
 				>
-					{Language.githubSignIn}
+					<a
+						href={`/api/v2/users/oauth2/github/callback?redirect=${encodeURIComponent(
+							redirectTo,
+						)}`}
+					>
+						<GitHubIcon />
+						{Language.githubSignIn}
+					</a>
 				</Button>
 			)}
 
 			{authMethods?.oidc.enabled && (
 				<Button
-					component="a"
-					href={`/api/v2/users/oidc/callback?redirect=${encodeURIComponent(
-						redirectTo,
-					)}`}
-					variant="contained"
-					size="xlarge"
-					startIcon={
-						authMethods.oidc.iconUrl ? (
-							<OidcIcon iconUrl={authMethods.oidc.iconUrl} />
-						) : (
-							<KeyIcon css={iconStyles} />
-						)
-					}
+					variant="outline"
+					asChild
+					className="w-full"
+					size="lg"
 					disabled={isSigningIn}
-					fullWidth
 					type="submit"
 				>
-					{authMethods.oidc.signInText || Language.oidcSignIn}
+					<a
+						href={`/api/v2/users/oidc/callback?redirect=${encodeURIComponent(
+							redirectTo,
+						)}`}
+					>
+						{authMethods.oidc.iconUrl ? (
+							<OidcIcon iconUrl={authMethods.oidc.iconUrl} />
+						) : (
+							<KeyIcon />
+						)}
+						{authMethods.oidc.signInText || Language.oidcSignIn}
+					</a>
 				</Button>
 			)}
 		</div>
@@ -80,7 +79,7 @@ const OidcIcon: FC<OidcIconProps> = ({ iconUrl }) => {
 	// if that happens, but also still need a way to inject accessible text
 	return (
 		<>
-			<img alt="" src={iconUrl} css={iconStyles} aria-labelledby={oidcId} />
+			<img alt="" src={iconUrl} aria-labelledby={oidcId} />
 			<div id={oidcId} css={{ ...visuallyHidden }}>
 				Open ID Connect
 			</div>
diff --git a/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CustomRolesPageView.tsx b/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CustomRolesPageView.tsx
index cd94b6a18e669..e3074f3ada94e 100644
--- a/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CustomRolesPageView.tsx
+++ b/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CustomRolesPageView.tsx
@@ -1,8 +1,7 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import Button from "@mui/material/Button";
 import Skeleton from "@mui/material/Skeleton";
 import type { AssignableRoles, Role } from "api/typesGenerated";
-import { Button as ShadcnButton } from "components/Button/Button";
+import { Button, Button as ShadcnButton } from "components/Button/Button";
 import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
 import {
 	DropdownMenu,
@@ -72,12 +71,11 @@ export const CustomRolesPageView: FC<CustomRolesPageViewProps> = ({
 					</span>
 				</span>
 				{canCreateOrgRole && isCustomRolesEnabled && (
-					<Button
-						component={RouterLink}
-						startIcon={<PlusIcon className="size-icon-sm" />}
-						to="create"
-					>
-						Create custom role
+					<Button variant="outline" asChild>
+						<RouterLink to="create">
+							<PlusIcon />
+							Create custom role
+						</RouterLink>
 					</Button>
 				)}
 			</Stack>
@@ -157,13 +155,11 @@ const RoleTable: FC<RoleTableProps> = ({
 									cta={
 										canCreateOrgRole &&
 										isCustomRolesEnabled && (
-											<Button
-												component={RouterLink}
-												to="create"
-												startIcon={<PlusIcon className="size-icon-sm" />}
-												variant="contained"
-											>
-												Create custom role
+											<Button asChild>
+												<RouterLink to="create">
+													<PlusIcon />
+													Create custom role
+												</RouterLink>
 											</Button>
 										)
 									}
diff --git a/site/src/pages/ResetPasswordPage/ChangePasswordPage.tsx b/site/src/pages/ResetPasswordPage/ChangePasswordPage.tsx
index c7ae619950b43..9ec361a39932c 100644
--- a/site/src/pages/ResetPasswordPage/ChangePasswordPage.tsx
+++ b/site/src/pages/ResetPasswordPage/ChangePasswordPage.tsx
@@ -1,5 +1,4 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import MUIButton from "@mui/material/Button";
 import TextField from "@mui/material/TextField";
 import { isApiValidationError } from "api/errors";
 import { changePasswordWithOTP } from "api/queries/users";
@@ -119,15 +118,9 @@ const ChangePasswordPage: FC<ChangePasswordChangeProps> = ({ redirect }) => {
 										<Spinner loading={form.isSubmitting} />
 										Reset password
 									</Button>
-									<MUIButton
-										component={RouterLink}
-										size="large"
-										fullWidth
-										variant="text"
-										to="/login"
-									>
-										Back to login
-									</MUIButton>
+									<Button size="lg" className="w-full" variant="subtle" asChild>
+										<RouterLink to="/login">Back to login</RouterLink>
+									</Button>
 								</Stack>
 							</Stack>
 						</fieldset>
diff --git a/site/src/pages/SetupPage/SetupPageView.tsx b/site/src/pages/SetupPage/SetupPageView.tsx
index 96654bdda8514..57534ddbe74cd 100644
--- a/site/src/pages/SetupPage/SetupPageView.tsx
+++ b/site/src/pages/SetupPage/SetupPageView.tsx
@@ -1,7 +1,6 @@
 import GitHubIcon from "@mui/icons-material/GitHub";
 import AlertTitle from "@mui/material/AlertTitle";
 import Autocomplete from "@mui/material/Autocomplete";
-import MuiButton from "@mui/material/Button";
 import Checkbox from "@mui/material/Checkbox";
 import Link from "@mui/material/Link";
 import MenuItem from "@mui/material/MenuItem";
@@ -173,17 +172,12 @@ export const SetupPageView: FC<SetupPageViewProps> = ({
 				<FormFields>
 					{authMethods?.github.enabled && (
 						<>
-							<MuiButton
-								fullWidth
-								component="a"
-								href="/api/v2/users/oauth2/github/callback"
-								variant="contained"
-								startIcon={<GitHubIcon css={iconStyles} />}
-								type="submit"
-								size="xlarge"
-							>
-								{Language.githubCreate}
-							</MuiButton>
+							<Button className="w-full" asChild type="submit" size="lg">
+								<a href="/api/v2/users/oauth2/github/callback">
+									<GitHubIcon css={iconStyles} />
+									{Language.githubCreate}
+								</a>
+							</Button>
 							<div className="flex items-center gap-4">
 								<div className="h-[1px] w-full bg-border" />
 								<div className="shrink-0 text-xs uppercase text-content-secondary tracking-wider">
diff --git a/site/src/pages/TemplatePage/TemplatePageHeader.tsx b/site/src/pages/TemplatePage/TemplatePageHeader.tsx
index dd93054f64d9e..8db6afcd07292 100644
--- a/site/src/pages/TemplatePage/TemplatePageHeader.tsx
+++ b/site/src/pages/TemplatePage/TemplatePageHeader.tsx
@@ -1,4 +1,3 @@
-import Button from "@mui/material/Button";
 import { API } from "api/api";
 import { workspaces } from "api/queries/workspaces";
 import type {
@@ -7,7 +6,7 @@ import type {
 	TemplateVersion,
 } from "api/typesGenerated";
 import { Avatar } from "components/Avatar/Avatar";
-import { Button as ShadcnButton } from "components/Button/Button";
+import { Button, Button as ShadcnButton } from "components/Button/Button";
 import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
 import { DeleteDialog } from "components/Dialogs/DeleteDialog/DeleteDialog";
 import {
@@ -222,13 +221,11 @@ export const TemplatePageHeader: FC<TemplatePageHeaderProps> = ({
 					<>
 						{!template.deprecated &&
 							workspacePermissions.createWorkspaceForUserID && (
-								<Button
-									variant="contained"
-									startIcon={<PlusIcon className="size-icon-sm" />}
-									component={RouterLink}
-									to={`${templateLink}/workspace`}
-								>
-									Create Workspace
+								<Button asChild>
+									<RouterLink to={`${templateLink}/workspace`}>
+										<PlusIcon />
+										Create Workspace
+									</RouterLink>
 								</Button>
 							)}
 
diff --git a/site/src/theme/constants.ts b/site/src/theme/constants.ts
index f74611cefd324..28b5234d8f138 100644
--- a/site/src/theme/constants.ts
+++ b/site/src/theme/constants.ts
@@ -34,7 +34,5 @@ export const containerWidthMedium = 1080;
 export const sidePadding = 24;
 
 // MUI does not have aligned heights for buttons and inputs so we have to "hack" it a little bit
-export const BUTTON_XL_HEIGHT = 44;
 export const BUTTON_LG_HEIGHT = 40;
 export const BUTTON_MD_HEIGHT = 36;
-export const BUTTON_SM_HEIGHT = 32;
diff --git a/site/src/theme/light/mui.ts b/site/src/theme/light/mui.ts
index 8092b5f8cbe80..8fe2e25b6ca0d 100644
--- a/site/src/theme/light/mui.ts
+++ b/site/src/theme/light/mui.ts
@@ -108,67 +108,6 @@ const muiTheme = createTheme({
 				},
 			},
 		},
-		MuiButton: {
-			...components.MuiButton,
-			styleOverrides: {
-				...components.MuiButton.styleOverrides,
-				outlined: ({ theme }) => ({
-					boxShadow: "0 1px 4px #0001",
-					":hover": {
-						boxShadow: "0 1px 4px #0001",
-						border: `1px solid ${theme.palette.secondary.main}`,
-					},
-					"&.Mui-disabled": {
-						boxShadow: "none !important",
-					},
-				}),
-				["outlinedNeutral" as MuiStyle]: {
-					borderColor: tw.zinc[300],
-
-					"&.Mui-disabled": {
-						borderColor: tw.zinc[200],
-						color: tw.zinc[500],
-
-						"& > .MuiLoadingButton-loadingIndicator": {
-							color: tw.zinc[500],
-						},
-					},
-				},
-				contained: {
-					boxShadow: "0 1px 4px #0001",
-					"&.Mui-disabled": {
-						boxShadow: "none !important",
-					},
-					":hover": {
-						boxShadow: "0 1px 4px #0001",
-					},
-				},
-				["containedNeutral" as MuiStyle]: {
-					backgroundColor: tw.zinc[100],
-					border: `1px solid ${tw.zinc[200]}`,
-
-					"&.Mui-disabled": {
-						backgroundColor: tw.zinc[50],
-						border: `1px solid ${tw.zinc[100]}`,
-					},
-
-					"&:hover": {
-						backgroundColor: tw.zinc[200],
-						border: `1px solid ${tw.zinc[300]}`,
-					},
-				},
-			},
-		},
-		MuiButtonGroup: {
-			styleOverrides: {
-				root: {
-					">button:hover+button": {
-						// The !important is unfortunate, but necessary for the border.
-						borderLeftColor: `${tw.zinc[300]} !important`,
-					},
-				},
-			},
-		},
 		MuiChip: {
 			styleOverrides: {
 				root: {
diff --git a/site/src/theme/mui.ts b/site/src/theme/mui.ts
index fc20b0a9f9be1..4435579a33153 100644
--- a/site/src/theme/mui.ts
+++ b/site/src/theme/mui.ts
@@ -6,8 +6,6 @@ import {
 	BODY_FONT_FAMILY,
 	BUTTON_LG_HEIGHT,
 	BUTTON_MD_HEIGHT,
-	BUTTON_SM_HEIGHT,
-	BUTTON_XL_HEIGHT,
 	borderRadius,
 } from "./constants";
 import tw from "./tailwindColors";
@@ -61,112 +59,6 @@ export const components = {
 			}),
 		},
 	},
-	// Button styles are based on
-	// https://tailwindui.com/components/application-ui/elements/buttons
-	MuiButtonBase: {
-		defaultProps: {
-			disableRipple: true,
-		},
-	},
-	MuiButton: {
-		defaultProps: {
-			variant: "outlined",
-			color: "neutral",
-		},
-		styleOverrides: {
-			root: ({ theme }) => ({
-				textTransform: "none",
-				letterSpacing: "normal",
-				fontWeight: 500,
-				height: BUTTON_MD_HEIGHT,
-				padding: "8px 16px",
-				borderRadius: "6px",
-				fontSize: 14,
-
-				whiteSpace: "nowrap",
-				":focus-visible": {
-					outline: `2px solid ${theme.palette.primary.main}`,
-				},
-
-				"& .MuiLoadingButton-loadingIndicator": {
-					width: 14,
-					height: 14,
-				},
-
-				"& .MuiLoadingButton-loadingIndicator .MuiCircularProgress-root": {
-					width: "inherit !important",
-					height: "inherit !important",
-				},
-			}),
-			sizeSmall: {
-				height: BUTTON_SM_HEIGHT,
-			},
-			sizeLarge: {
-				height: BUTTON_LG_HEIGHT,
-			},
-			["sizeXlarge" as MuiStyle]: {
-				height: BUTTON_XL_HEIGHT,
-
-				// With higher size we need to increase icon spacing.
-				"& .MuiButton-startIcon": {
-					marginRight: 12,
-				},
-				"& .MuiButton-endIcon": {
-					marginLeft: 12,
-				},
-			},
-			outlined: ({ theme }) => ({
-				":hover": {
-					border: `1px solid ${theme.palette.secondary.main}`,
-				},
-			}),
-			["outlinedNeutral" as MuiStyle]: {
-				borderColor: tw.zinc[600],
-
-				"&.Mui-disabled": {
-					borderColor: tw.zinc[700],
-					color: tw.zinc[500],
-
-					"& > .MuiLoadingButton-loadingIndicator": {
-						color: tw.zinc[500],
-					},
-				},
-			},
-			["containedNeutral" as MuiStyle]: {
-				backgroundColor: tw.zinc[800],
-
-				"&:hover": {
-					backgroundColor: tw.zinc[700],
-				},
-			},
-			iconSizeMedium: {
-				"& > .MuiSvgIcon-root": {
-					fontSize: 14,
-				},
-			},
-			iconSizeSmall: {
-				"& > .MuiSvgIcon-root": {
-					fontSize: 13,
-				},
-			},
-		},
-	},
-	MuiButtonGroup: {
-		styleOverrides: {
-			root: ({ theme }) => ({
-				">button:hover+button": {
-					// The !important is unfortunate, but necessary for the border.
-					borderLeftColor: `${theme.palette.secondary.main} !important`,
-				},
-			}),
-		},
-	},
-	["MuiLoadingButton" as MuiStyle]: {
-		defaultProps: {
-			variant: "outlined",
-			color: "neutral",
-		},
-	},
 	MuiTableContainer: {
 		styleOverrides: {
 			root: ({ theme }) => ({

From e5d7f43c5168de8daa5fb62c408d48d4a52dfdf5 Mon Sep 17 00:00:00 2001
From: DevCats <christofer@coder.com>
Date: Wed, 8 Oct 2025 12:58:56 -0500
Subject: [PATCH 090/298] chore: add auto-dev-server-icon and set to
 monochromatic (#20219)

---
 site/src/theme/externalImages.ts     | 1 +
 site/src/theme/icons.json            | 1 +
 site/static/icon/auto-dev-server.svg | 4 ++++
 3 files changed, 6 insertions(+)
 create mode 100644 site/static/icon/auto-dev-server.svg

diff --git a/site/src/theme/externalImages.ts b/site/src/theme/externalImages.ts
index d92fdee61a722..60316c594be86 100644
--- a/site/src/theme/externalImages.ts
+++ b/site/src/theme/externalImages.ts
@@ -143,6 +143,7 @@ export function getExternalImageStylesFromUrl(
 export const defaultParametersForBuiltinIcons = new Map<string, string>([
 	["/icon/apple-black.svg", "monochrome"],
 	["/icon/auggie.svg", "monochrome"],
+	["/icon/auto-dev-server.svg", "monochrome"],
 	["/icon/aws.png", "whiteWithColor&brightness=1.5"],
 	["/icon/aws.svg", "blackWithColor&brightness=1.5"],
 	["/icon/aws-monochrome.svg", "monochrome"],
diff --git a/site/src/theme/icons.json b/site/src/theme/icons.json
index 390d8b0becefc..aa3db061f8f92 100644
--- a/site/src/theme/icons.json
+++ b/site/src/theme/icons.json
@@ -8,6 +8,7 @@
 	"apple-grey.svg",
 	"argo-workflows.svg",
 	"auggie.svg",
+	"auto-dev-server.svg",
 	"aws-dark.svg",
 	"aws-light.svg",
 	"aws-monochrome.svg",
diff --git a/site/static/icon/auto-dev-server.svg b/site/static/icon/auto-dev-server.svg
new file mode 100644
index 0000000000000..f043b56d0eeb6
--- /dev/null
+++ b/site/static/icon/auto-dev-server.svg
@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg width="512pt" height="512pt" version="1.1" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg">
+ <path d="m500.48 262.2-48.18 73.984c-0.73438 1.1367-2 1.8242-3.3555 1.8242-1.3516 0-2.6172-0.6875-3.3516-1.8242l-48.129-73.984c-0.78125-1.2227-0.83594-2.7773-0.14453-4.0547 0.69141-1.2734 2.0195-2.0742 3.4727-2.0898h24.781c-0.007813-29.523-7.7188-58.531-22.375-84.156-14.652-25.629-35.742-46.988-61.184-61.969-2.3711-1.3633-3.8633-3.8594-3.9453-6.5938-0.085937-2.7305 1.2539-5.3125 3.5352-6.8203l27.035-17.613c3.4766-2.3633 8.043-2.3633 11.52 0 28.473 19.934 51.723 46.441 67.773 77.27 16.051 30.828 24.434 65.074 24.438 99.832h24.781c1.4688 0 2.8203 0.80859 3.5156 2.1055 0.69531 1.293 0.62109 2.8633-0.1875 4.0898zm-85.043 79.359c-1.5078-2.2812-4.0898-3.6211-6.8203-3.5391-2.7344 0.085937-5.2305 1.5781-6.5938 3.9492-14.965 25.434-36.305 46.523-61.914 61.188-25.609 14.664-54.602 22.391-84.109 22.422v-24.781c-0.011719-1.4531-0.8125-2.7812-2.0898-3.4727-1.2773-0.69141-2.832-0.63672-4.0547 0.14453l-74.035 47.977c-1.1367 0.73438-1.8242 1.9961-1.8242 3.3516s0.6875 2.6172 1.8242 3.3555l73.984 48.18c1.2227 0.78125 2.7773 0.83594 4.0547 0.14453 1.2734-0.69141 2.0742-2.0234 2.0898-3.4727v-24.68c34.734-0.015624 68.957-8.3984 99.766-24.441 30.812-16.039 57.301-39.27 77.23-67.719 2.3672-3.4766 2.3672-8.043 0-11.52zm-245.45 60.52c-25.434-14.977-46.516-36.328-61.172-61.945-14.652-25.617-22.371-54.617-22.387-84.129h24.781c1.4531-0.011719 2.7812-0.8125 3.4727-2.0898 0.69141-1.2773 0.63672-2.832-0.14453-4.0547l-47.977-74.035c-0.73438-1.1367-1.9961-1.8242-3.3516-1.8242s-2.6172 0.6875-3.3555 1.8242l-48.332 73.984c-0.80859 1.2266-0.88281 2.7969-0.1875 4.0898 0.69531 1.2969 2.0469 2.1055 3.5156 2.1055h24.781c0.015625 34.734 8.3984 68.957 24.438 99.766 16.043 30.812 39.273 57.301 67.723 77.234 3.4766 2.3633 8.043 2.3633 11.52 0l27.086-17.664c2.2109-1.5195 3.4961-4.0625 3.4141-6.7422-0.082032-2.6836-1.5234-5.1406-3.8242-6.5195zm92.16-390.5c-1.2227-0.78125-2.7773-0.83594-4.0547-0.14453-1.2773 0.69141-2.0781 2.0195-2.0898 3.4727v24.73c-34.734 0.015625-68.957 8.3984-99.766 24.438-30.812 16.043-57.301 39.273-77.234 67.723-2.3633 3.4766-2.3633 8.043 0 11.52l17.664 27.086c1.5078 2.2812 4.0898 3.6211 6.8242 3.5352 2.7305-0.082032 5.2266-1.5742 6.5898-3.9453 14.965-25.41 36.289-46.48 61.879-61.133 25.59-14.652 54.555-22.383 84.043-22.426v24.781c0.011719 1.4531 0.8125 2.7812 2.0898 3.4727 1.2773 0.69141 2.832 0.63672 4.0547-0.14453l74.035-47.977c1.1367-0.73438 1.8242-1.9961 1.8242-3.3516s-0.6875-2.6172-1.8242-3.3555zm-6.1445 210.23c-9.0703 0-17.77 3.6055-24.184 10.02-6.4141 6.4141-10.02 15.113-10.02 24.184s3.6055 17.77 10.02 24.184c6.4141 6.4141 15.113 10.02 24.184 10.02s17.77-3.6055 24.184-10.02c6.4141-6.4141 10.02-15.113 10.02-24.184s-3.6055-17.77-10.02-24.184c-6.4141-6.4141-15.113-10.02-24.184-10.02zm90.727-26.828-10.344 14.953c4.0039 6.9414 7.0859 14.375 9.1641 22.117l17.973 2.9688c6.543 1.1445 11.316 6.8242 11.316 13.465v15.055c0 6.6406-4.7734 12.32-11.316 13.465l-17.766 3.125v-0.003907c-2.1562 7.6992-5.3086 15.082-9.3711 21.965l10.238 14.797h0.003906c3.8047 5.4375 3.1562 12.82-1.5352 17.512l-10.648 10.648h-0.003906c-4.6914 4.6953-12.074 5.3438-17.508 1.5391l-14.797-10.238v-0.003907c-6.9453 4.0039-14.379 7.0859-22.121 9.1641l-3.0195 18.023c-1.1445 6.543-6.8242 11.316-13.465 11.316h-15.055c-6.6406 0-12.32-4.7734-13.465-11.316l-3.125-17.766h0.003907c-7.7031-2.1758-15.086-5.3398-21.965-9.4219l-14.797 10.238v0.003907c-5.4375 3.8047-12.82 3.1562-17.512-1.5391l-10.648-10.648c-4.6953-4.6914-5.3438-12.074-1.5391-17.512l10.238-14.797h0.003907c-4.0039-6.9414-7.0859-14.375-9.1641-22.117l-18.023-2.9688c-6.543-1.1445-11.316-6.8242-11.316-13.465v-15.055c0-6.6406 4.7734-12.32 11.316-13.465l17.766-3.125v0.003907c2.1562-7.6992 5.3086-15.082 9.3711-21.965l-10.238-14.797h-0.003906c-3.8047-5.4375-3.1562-12.82 1.5352-17.512l10.648-10.648h0.003906c4.6914-4.6953 12.074-5.3438 17.508-1.5391l14.797 10.238v0.003907c6.9453-4.0039 14.379-7.0859 22.121-9.1641l3.0195-18.023c1.1445-6.543 6.8242-11.316 13.465-11.316h15.055c6.6406 0 12.32 4.7734 13.465 11.316l3.125 17.766h-0.003907c7.6992 2.1562 15.082 5.3086 21.965 9.3711l14.797-10.238v-0.003906c5.4375-3.8047 12.82-3.1562 17.512 1.5352l10.648 10.648v0.003906c4.6875 4.6367 5.3984 11.957 1.6914 17.406zm-36.047 61.031c0-14.504-5.7578-28.41-16.016-38.664-10.254-10.258-24.16-16.016-38.664-16.016s-28.41 5.7578-38.664 16.016c-10.258 10.254-16.016 24.16-16.016 38.664s5.7578 28.41 16.016 38.664c10.254 10.258 24.16 16.016 38.664 16.016 14.5-0.011719 28.398-5.7773 38.652-16.027 10.25-10.254 16.016-24.152 16.027-38.652z" fill="#fff"/>
+</svg>

From 4b8d73994fac27d296d52397f518c49a5cf752fe Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 8 Oct 2025 15:01:01 -0300
Subject: [PATCH 091/298] chore: migrate MUI icons to lucide-react (#20193)

---
 site/package.json                             |  2 +-
 site/pnpm-lock.yaml                           | 10 ++++----
 .../modules/resources/AppLink/ShareIcon.tsx   | 16 +++++++------
 .../modules/resources/PortForwardButton.tsx   | 16 ++++++-------
 .../TemplateFiles/TemplateFileTree.tsx        | 12 ++++++----
 .../templates/TemplateFiles/TemplateFiles.tsx | 23 ++++++++-----------
 .../pages/HealthPage/DismissWarningButton.tsx |  7 +++---
 site/src/pages/HealthPage/HealthLayout.tsx    | 15 +++---------
 .../pages/HealthPage/WorkspaceProxyPage.tsx   |  4 ++--
 site/src/pages/LoginPage/OAuthSignInForm.tsx  |  2 +-
 .../TemplateEmbedPageExperimental.tsx         |  7 +++---
 .../TemplateVersionPageView.tsx               |  2 +-
 .../UsersPage/UsersTable/UsersTableBody.tsx   | 21 +++++++++--------
 site/src/pages/WorkspacePage/Workspace.tsx    |  9 ++++----
 14 files changed, 70 insertions(+), 76 deletions(-)

diff --git a/site/package.json b/site/package.json
index ddb04c084ce01..62b2b8dd64981 100644
--- a/site/package.json
+++ b/site/package.json
@@ -91,7 +91,7 @@
 		"humanize-duration": "3.32.2",
 		"jszip": "3.10.1",
 		"lodash": "4.17.21",
-		"lucide-react": "0.474.0",
+		"lucide-react": "0.545.0",
 		"monaco-editor": "0.53.0",
 		"pretty-bytes": "6.1.1",
 		"react": "19.1.1",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 396028241502c..e788524025aeb 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -188,8 +188,8 @@ importers:
         specifier: 4.17.21
         version: 4.17.21
       lucide-react:
-        specifier: 0.474.0
-        version: 0.474.0(react@19.1.1)
+        specifier: 0.545.0
+        version: 0.545.0(react@19.1.1)
       monaco-editor:
         specifier: 0.53.0
         version: 0.53.0
@@ -4885,8 +4885,8 @@ packages:
   lru-cache@5.1.1:
     resolution: {integrity: sha512-KpNARQA3Iwv+jTA0utUVVbrh+Jlrr1Fv0e56GGzAFOXN7dk/FviaDW8LHmK52DlcH4WP2n6gI8vN1aesBFgo9w==, tarball: https://registry.npmjs.org/lru-cache/-/lru-cache-5.1.1.tgz}
 
-  lucide-react@0.474.0:
-    resolution: {integrity: sha512-CmghgHkh0OJNmxGKWc0qfPJCYHASPMVSyGY8fj3xgk4v84ItqDg64JNKFZn5hC6E0vHi6gxnbCgwhyVB09wQtA==, tarball: https://registry.npmjs.org/lucide-react/-/lucide-react-0.474.0.tgz}
+  lucide-react@0.545.0:
+    resolution: {integrity: sha512-7r1/yUuflQDSt4f1bpn5ZAocyIxcTyVyBBChSVtBKn5M+392cPmI5YJMWOJKk/HUWGm5wg83chlAZtCcGbEZtw==, tarball: https://registry.npmjs.org/lucide-react/-/lucide-react-0.545.0.tgz}
     peerDependencies:
       react: ^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0
 
@@ -11353,7 +11353,7 @@ snapshots:
     dependencies:
       yallist: 3.1.1
 
-  lucide-react@0.474.0(react@19.1.1):
+  lucide-react@0.545.0(react@19.1.1):
     dependencies:
       react: 19.1.1
 
diff --git a/site/src/modules/resources/AppLink/ShareIcon.tsx b/site/src/modules/resources/AppLink/ShareIcon.tsx
index 7e6660fe4b162..d9d536f999259 100644
--- a/site/src/modules/resources/AppLink/ShareIcon.tsx
+++ b/site/src/modules/resources/AppLink/ShareIcon.tsx
@@ -1,9 +1,11 @@
-import BusinessIcon from "@mui/icons-material/Business";
-import GroupOutlinedIcon from "@mui/icons-material/GroupOutlined";
-import PublicOutlinedIcon from "@mui/icons-material/PublicOutlined";
 import Tooltip from "@mui/material/Tooltip";
 import type * as TypesGen from "api/typesGenerated";
-import { SquareArrowOutUpRightIcon } from "lucide-react";
+import {
+	Building2Icon,
+	GlobeIcon,
+	SquareArrowOutUpRightIcon,
+	UsersIcon,
+} from "lucide-react";
 
 interface ShareIconProps {
 	app: TypesGen.WorkspaceApp;
@@ -20,21 +22,21 @@ export const ShareIcon = ({ app }: ShareIconProps) => {
 	if (app.sharing_level === "authenticated") {
 		return (
 			<Tooltip title="Shared with all authenticated users">
-				<GroupOutlinedIcon />
+				<UsersIcon />
 			</Tooltip>
 		);
 	}
 	if (app.sharing_level === "organization") {
 		return (
 			<Tooltip title="Shared with organization members">
-				<BusinessIcon />
+				<Building2Icon />
 			</Tooltip>
 		);
 	}
 	if (app.sharing_level === "public") {
 		return (
 			<Tooltip title="Shared publicly">
-				<PublicOutlinedIcon />
+				<GlobeIcon />
 			</Tooltip>
 		);
 	}
diff --git a/site/src/modules/resources/PortForwardButton.tsx b/site/src/modules/resources/PortForwardButton.tsx
index 749ddfc32bc01..78d4e999b340c 100644
--- a/site/src/modules/resources/PortForwardButton.tsx
+++ b/site/src/modules/resources/PortForwardButton.tsx
@@ -1,8 +1,4 @@
 import { type Interpolation, type Theme, useTheme } from "@emotion/react";
-import BusinessIcon from "@mui/icons-material/Business";
-import LockIcon from "@mui/icons-material/Lock";
-import LockOpenIcon from "@mui/icons-material/LockOpen";
-import SensorsIcon from "@mui/icons-material/Sensors";
 import FormControl from "@mui/material/FormControl";
 import Link from "@mui/material/Link";
 import MenuItem from "@mui/material/MenuItem";
@@ -45,8 +41,12 @@ import {
 } from "components/Tooltip/Tooltip";
 import { useFormik } from "formik";
 import {
+	BuildingIcon,
 	ChevronDownIcon,
 	ExternalLinkIcon,
+	LockIcon,
+	LockOpenIcon,
+	RadioIcon,
 	ShareIcon,
 	X as XIcon,
 } from "lucide-react";
@@ -385,7 +385,7 @@ export const PortForwardPopoverView: FC<PortForwardPopoverViewProps> = ({
 										target="_blank"
 										rel="noreferrer"
 									>
-										<SensorsIcon css={{ width: 14, height: 14 }} />
+										<RadioIcon className="size-icon-sm" />
 										{port.port}
 									</Link>
 									<Link
@@ -475,11 +475,11 @@ export const PortForwardPopoverView: FC<PortForwardPopoverViewProps> = ({
 										rel="noreferrer"
 									>
 										{share.share_level === "public" ? (
-											<LockOpenIcon css={{ width: 14, height: 14 }} />
+											<LockOpenIcon className="size-icon-sm" />
 										) : share.share_level === "organization" ? (
-											<BusinessIcon css={{ width: 14, height: 14 }} />
+											<BuildingIcon className="size-icon-sm" />
 										) : (
-											<LockIcon css={{ width: 14, height: 14 }} />
+											<LockIcon className="size-icon-sm" />
 										)}
 										{label}
 									</Link>
diff --git a/site/src/modules/templates/TemplateFiles/TemplateFileTree.tsx b/site/src/modules/templates/TemplateFiles/TemplateFileTree.tsx
index 9578d4aba1548..c4c0c7e041d46 100644
--- a/site/src/modules/templates/TemplateFiles/TemplateFileTree.tsx
+++ b/site/src/modules/templates/TemplateFiles/TemplateFileTree.tsx
@@ -1,11 +1,13 @@
 import { css } from "@emotion/react";
-import ExpandMoreIcon from "@mui/icons-material/ExpandMore";
-import FormatAlignLeftOutlined from "@mui/icons-material/FormatAlignLeftOutlined";
 import Menu from "@mui/material/Menu";
 import MenuItem from "@mui/material/MenuItem";
 import { SimpleTreeView, TreeItem } from "@mui/x-tree-view";
 import { DockerIcon } from "components/Icons/DockerIcon";
-import { ChevronRightIcon } from "lucide-react";
+import {
+	ChevronDownIcon,
+	ChevronRightIcon,
+	TextAlignStartIcon,
+} from "lucide-react";
 import {
 	type CSSProperties,
 	type ElementType,
@@ -90,7 +92,7 @@ export const TemplateFileTree: FC<TemplateFilesTreeProps> = ({
 
 		let icon: ElementType | undefined;
 		if (isFolder(content)) {
-			icon = FormatAlignLeftOutlined;
+			icon = TextAlignStartIcon;
 		} else if (filename.endsWith(".tf")) {
 			icon = FileTypeTerraform;
 		} else if (filename.endsWith(".md")) {
@@ -201,7 +203,7 @@ export const TemplateFileTree: FC<TemplateFilesTreeProps> = ({
 
 	return (
 		<SimpleTreeView
-			slots={{ collapseIcon: ExpandMoreIcon, expandIcon: ChevronRightIcon }}
+			slots={{ collapseIcon: ChevronDownIcon, expandIcon: ChevronRightIcon }}
 			aria-label="Files"
 			defaultExpandedItems={activePath ? expandablePaths(activePath) : []}
 			defaultSelectedItems={activePath}
diff --git a/site/src/modules/templates/TemplateFiles/TemplateFiles.tsx b/site/src/modules/templates/TemplateFiles/TemplateFiles.tsx
index a7abe1c7bc3e8..e23a42762013a 100644
--- a/site/src/modules/templates/TemplateFiles/TemplateFiles.tsx
+++ b/site/src/modules/templates/TemplateFiles/TemplateFiles.tsx
@@ -1,11 +1,11 @@
 import { type Interpolation, type Theme, useTheme } from "@emotion/react";
-import EditOutlined from "@mui/icons-material/EditOutlined";
-import RadioButtonCheckedOutlined from "@mui/icons-material/RadioButtonCheckedOutlined";
 import { SyntaxHighlighter } from "components/SyntaxHighlighter/SyntaxHighlighter";
 import set from "lodash/set";
+import { EditIcon } from "lucide-react";
 import { linkToTemplate, useLinks } from "modules/navigation";
 import { type FC, useCallback, useMemo } from "react";
 import { Link } from "react-router";
+import { cn } from "utils/cn";
 import type { FileTree } from "utils/filetree";
 import type { TemplateVersionFiles } from "utils/templateVersion";
 import { TemplateFileTree } from "./TemplateFileTree";
@@ -94,16 +94,13 @@ export const TemplateFiles: FC<TemplateFilesProps> = ({
 							return (
 								<div key={filename} css={styles.filePanel} id={filename}>
 									<header css={styles.fileHeader}>
-										{filename}
-										{info.hasDiff && (
-											<RadioButtonCheckedOutlined
-												css={{
-													width: 14,
-													height: 14,
-													color: theme.roles.warning.fill.outline,
-												}}
-											/>
-										)}
+										<span
+											className={cn({
+												"text-content-warning": info.hasDiff,
+											})}
+										>
+											{filename}
+										</span>
 
 										<div css={{ marginLeft: "auto" }}>
 											<Link
@@ -121,7 +118,7 @@ export const TemplateFiles: FC<TemplateFilesProps> = ({
 													},
 												}}
 											>
-												<EditOutlined css={{ fontSize: "inherit" }} />
+												<EditIcon className="text-inherit size-icon-xs" />
 												Edit
 											</Link>
 										</div>
diff --git a/site/src/pages/HealthPage/DismissWarningButton.tsx b/site/src/pages/HealthPage/DismissWarningButton.tsx
index 09ff78d9c01b2..b1d04d2859b7a 100644
--- a/site/src/pages/HealthPage/DismissWarningButton.tsx
+++ b/site/src/pages/HealthPage/DismissWarningButton.tsx
@@ -1,11 +1,10 @@
-import NotificationsOffOutlined from "@mui/icons-material/NotificationsOffOutlined";
-import NotificationOutlined from "@mui/icons-material/NotificationsOutlined";
 import Skeleton from "@mui/material/Skeleton";
 import { healthSettings, updateHealthSettings } from "api/queries/debug";
 import type { HealthSection } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import { displaySuccess } from "components/GlobalSnackbar/utils";
 import { Spinner } from "components/Spinner/Spinner";
+import { BellIcon, BellOffIcon } from "lucide-react";
 import { useMutation, useQuery, useQueryClient } from "react-query";
 
 export const DismissWarningButton = (props: { healthcheck: HealthSection }) => {
@@ -49,7 +48,7 @@ export const DismissWarningButton = (props: { healthcheck: HealthSection }) => {
 				}}
 			>
 				<Spinner loading={enableMutation.isPending}>
-					<NotificationsOffOutlined />
+					<BellOffIcon />
 				</Spinner>
 				Enable warnings
 			</Button>
@@ -69,7 +68,7 @@ export const DismissWarningButton = (props: { healthcheck: HealthSection }) => {
 			}}
 		>
 			<Spinner loading={dismissMutation.isPending}>
-				<NotificationOutlined />
+				<BellIcon />
 			</Spinner>
 			Dismiss warnings
 		</Button>
diff --git a/site/src/pages/HealthPage/HealthLayout.tsx b/site/src/pages/HealthPage/HealthLayout.tsx
index 10c5b1695dc5b..5c9c44dad039d 100644
--- a/site/src/pages/HealthPage/HealthLayout.tsx
+++ b/site/src/pages/HealthPage/HealthLayout.tsx
@@ -1,6 +1,3 @@
-import { useTheme } from "@emotion/react";
-import NotificationsOffOutlined from "@mui/icons-material/NotificationsOffOutlined";
-import ReplayIcon from "@mui/icons-material/Replay";
 import CircularProgress from "@mui/material/CircularProgress";
 import IconButton from "@mui/material/IconButton";
 import Tooltip from "@mui/material/Tooltip";
@@ -9,6 +6,7 @@ import type { HealthSeverity } from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { Loader } from "components/Loader/Loader";
 import kebabCase from "lodash/fp/kebabCase";
+import { BellOffIcon, RotateCcwIcon } from "lucide-react";
 import { DashboardFullPage } from "modules/dashboard/DashboardLayout";
 import { type FC, Suspense } from "react";
 import { useMutation, useQuery, useQueryClient } from "react-query";
@@ -28,7 +26,6 @@ const linkStyles = {
 };
 
 export const HealthLayout: FC = () => {
-	const theme = useTheme();
 	const queryClient = useQueryClient();
 	const {
 		data: healthStatus,
@@ -91,7 +88,7 @@ export const HealthLayout: FC = () => {
 											{isRefreshing ? (
 												<CircularProgress size={16} />
 											) : (
-												<ReplayIcon className="size-5" />
+												<RotateCcwIcon className="size-5" />
 											)}
 										</IconButton>
 									</Tooltip>
@@ -155,13 +152,7 @@ export const HealthLayout: FC = () => {
 											/>
 											{label}
 											{healthSection.dismissed && (
-												<NotificationsOffOutlined
-													css={{
-														fontSize: 14,
-														marginLeft: "auto",
-														color: theme.palette.text.disabled,
-													}}
-												/>
+												<BellOffIcon className="size-icon-sm ml-auto text-content-disabled" />
 											)}
 										</NavLink>
 									);
diff --git a/site/src/pages/HealthPage/WorkspaceProxyPage.tsx b/site/src/pages/HealthPage/WorkspaceProxyPage.tsx
index 74fc699bb10c7..2276c24cbcbc5 100644
--- a/site/src/pages/HealthPage/WorkspaceProxyPage.tsx
+++ b/site/src/pages/HealthPage/WorkspaceProxyPage.tsx
@@ -2,7 +2,7 @@ import { useTheme } from "@emotion/react";
 import Tooltip from "@mui/material/Tooltip";
 import type { HealthcheckReport } from "api/typesGenerated";
 import { Alert } from "components/Alert/Alert";
-import { EarthIcon, HashIcon } from "lucide-react";
+import { GlobeIcon, HashIcon } from "lucide-react";
 import type { FC } from "react";
 import { useOutletContext } from "react-router";
 import { createDayString } from "utils/createDayString";
@@ -107,7 +107,7 @@ const WorkspaceProxyPage: FC = () => {
 								<div css={{ display: "flex", flexWrap: "wrap", gap: 12 }}>
 									{region.wildcard_hostname && (
 										<Tooltip title="Wildcard Hostname">
-											<Pill icon={<EarthIcon />}>
+											<Pill icon={<GlobeIcon />}>
 												{region.wildcard_hostname}
 											</Pill>
 										</Tooltip>
diff --git a/site/src/pages/LoginPage/OAuthSignInForm.tsx b/site/src/pages/LoginPage/OAuthSignInForm.tsx
index 343353d18dfca..e2c08caf69f35 100644
--- a/site/src/pages/LoginPage/OAuthSignInForm.tsx
+++ b/site/src/pages/LoginPage/OAuthSignInForm.tsx
@@ -1,8 +1,8 @@
 import GitHubIcon from "@mui/icons-material/GitHub";
-import KeyIcon from "@mui/icons-material/VpnKey";
 import { visuallyHidden } from "@mui/utils";
 import type { AuthMethods } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
+import { KeyIcon } from "lucide-react";
 import { type FC, useId } from "react";
 import { Language } from "./Language";
 
diff --git a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx
index c9b63f1422478..34c55313d60a3 100644
--- a/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx
+++ b/site/src/pages/TemplatePage/TemplateEmbedPage/TemplateEmbedPageExperimental.tsx
@@ -1,5 +1,3 @@
-import CheckOutlined from "@mui/icons-material/CheckOutlined";
-import FileCopyOutlined from "@mui/icons-material/FileCopyOutlined";
 import { API } from "api/api";
 import { DetailedError } from "api/errors";
 import type {
@@ -18,6 +16,7 @@ import { Skeleton } from "components/Skeleton/Skeleton";
 import { useAuthenticated } from "hooks";
 import { useEffectEvent } from "hooks/hookPolyfills";
 import { useClipboard } from "hooks/useClipboard";
+import { CheckIcon, CopyIcon } from "lucide-react";
 import {
 	Diagnostics,
 	DynamicParameter,
@@ -308,8 +307,8 @@ const ButtonPreview: FC<ButtonPreviewProps> = ({ template, buttonValues }) => {
 					clipboard.copyToClipboard(textToCopy);
 				}}
 			>
-				{clipboard.showCopiedSuccess ? <CheckOutlined /> : <FileCopyOutlined />}{" "}
-				Copy button code
+				{clipboard.showCopiedSuccess ? <CheckIcon /> : <CopyIcon />} Copy button
+				code
 			</Button>
 		</div>
 	);
diff --git a/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx b/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx
index 3a6b7daeece66..7c7390682b6d1 100644
--- a/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx
+++ b/site/src/pages/TemplateVersionPage/TemplateVersionPageView.tsx
@@ -58,7 +58,7 @@ export const TemplateVersionPageView: FC<TemplateVersionPageViewProps> = ({
 						)}
 						<Button variant="outline" asChild>
 							<RouterLink to={`${templateLink}/versions/${versionName}/edit`}>
-								<EditIcon />
+								<EditIcon className="!size-icon-sm" />
 								Edit
 							</RouterLink>
 						</Button>
diff --git a/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx b/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
index 408ea411a84f9..a070ad7913a68 100644
--- a/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
+++ b/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
@@ -1,9 +1,5 @@
 import type { Interpolation, Theme } from "@emotion/react";
 import GitHub from "@mui/icons-material/GitHub";
-import HideSourceOutlined from "@mui/icons-material/HideSourceOutlined";
-import KeyOutlined from "@mui/icons-material/KeyOutlined";
-import PasswordOutlined from "@mui/icons-material/PasswordOutlined";
-import ShieldOutlined from "@mui/icons-material/ShieldOutlined";
 import Skeleton from "@mui/material/Skeleton";
 import type { GroupsByUserId } from "api/queries/groups";
 import type * as TypesGen from "api/typesGenerated";
@@ -28,7 +24,14 @@ import {
 } from "components/TableLoader/TableLoader";
 import dayjs from "dayjs";
 import relativeTime from "dayjs/plugin/relativeTime";
-import { EllipsisVertical, TrashIcon } from "lucide-react";
+import {
+	BanIcon,
+	EllipsisVertical,
+	KeyIcon,
+	ShieldIcon,
+	TrashIcon,
+	UserLockIcon,
+} from "lucide-react";
 import type { FC } from "react";
 import { UserRoleCell } from "../../OrganizationSettingsPage/UserTable/UserRoleCell";
 import { UserGroupsCell } from "./UserGroupsCell";
@@ -260,22 +263,22 @@ const LoginType: FC<LoginTypeProps> = ({ authMethods, value }) => {
 
 	if (value === "password") {
 		displayName = "Password";
-		icon = <PasswordOutlined css={styles.icon} />;
+		icon = <UserLockIcon css={styles.icon} />;
 	} else if (value === "none") {
 		displayName = "None";
-		icon = <HideSourceOutlined css={styles.icon} />;
+		icon = <BanIcon css={styles.icon} />;
 	} else if (value === "github") {
 		displayName = "GitHub";
 		icon = <GitHub css={styles.icon} />;
 	} else if (value === "token") {
 		displayName = "Token";
-		icon = <KeyOutlined css={styles.icon} />;
+		icon = <KeyIcon css={styles.icon} />;
 	} else if (value === "oidc") {
 		displayName =
 			authMethods.oidc.signInText === "" ? "OIDC" : authMethods.oidc.signInText;
 		icon =
 			authMethods.oidc.iconUrl === "" ? (
-				<ShieldOutlined css={styles.icon} />
+				<ShieldIcon css={styles.icon} />
 			) : (
 				<img
 					alt="Open ID Connect icon"
diff --git a/site/src/pages/WorkspacePage/Workspace.tsx b/site/src/pages/WorkspacePage/Workspace.tsx
index b1eda1618038b..83b8a6397104c 100644
--- a/site/src/pages/WorkspacePage/Workspace.tsx
+++ b/site/src/pages/WorkspacePage/Workspace.tsx
@@ -1,10 +1,9 @@
-import HistoryOutlined from "@mui/icons-material/HistoryOutlined";
-import HubOutlined from "@mui/icons-material/HubOutlined";
 import AlertTitle from "@mui/material/AlertTitle";
 import type * as TypesGen from "api/typesGenerated";
 import { Alert, AlertDetail } from "components/Alert/Alert";
 import { SidebarIconButton } from "components/FullPageLayout/Sidebar";
 import { useSearchParamsKey } from "hooks/useSearchParamsKey";
+import { BlocksIcon, HistoryIcon } from "lucide-react";
 import { ProvisionerStatusAlert } from "modules/provisioners/ProvisionerStatusAlert";
 import { AgentRow } from "modules/resources/AgentRow";
 import { WorkspaceTimings } from "modules/workspaces/WorkspaceTiming/WorkspaceTimings";
@@ -131,7 +130,8 @@ export const Workspace: FC<WorkspaceProps> = ({
 								setSidebarOption("resources");
 							}}
 						>
-							<HubOutlined />
+							<BlocksIcon className="size-icon-sm" />
+							<span className="sr-only">Resources</span>
 						</SidebarIconButton>
 						<SidebarIconButton
 							isActive={sidebarOption.value === "history"}
@@ -139,7 +139,8 @@ export const Workspace: FC<WorkspaceProps> = ({
 								setSidebarOption("history");
 							}}
 						>
-							<HistoryOutlined />
+							<HistoryIcon className="size-icon-sm" />
+							<span className="sr-only">History</span>
 						</SidebarIconButton>
 					</div>
 

From 9935da86c624bbf46e4b47789052e7b5e988c799 Mon Sep 17 00:00:00 2001
From: Jaayden Halko <jaayden.halko@gmail.com>
Date: Wed, 8 Oct 2025 21:13:04 +0100
Subject: [PATCH 092/298] chore: migrate appearanceform to Tailwind and shadcn
 (#20204)

---
 site/src/index.css                            |   3 +-
 .../AppearancePage/AppearanceForm.tsx         | 265 ++++++------------
 2 files changed, 89 insertions(+), 179 deletions(-)

diff --git a/site/src/index.css b/site/src/index.css
index 6486e162568ed..40adcb9fbab58 100644
--- a/site/src/index.css
+++ b/site/src/index.css
@@ -8,7 +8,8 @@
 @tailwind utilities;
 
 @layer base {
-	:root {
+	:root,
+	.light {
 		--content-primary: 240 10% 4%;
 		--content-secondary: 240 5% 34%;
 		--content-link: 221 83% 53%;
diff --git a/site/src/pages/UserSettingsPage/AppearancePage/AppearanceForm.tsx b/site/src/pages/UserSettingsPage/AppearancePage/AppearanceForm.tsx
index aa10f315b6f2d..0b86d8fdf73b6 100644
--- a/site/src/pages/UserSettingsPage/AppearancePage/AppearanceForm.tsx
+++ b/site/src/pages/UserSettingsPage/AppearancePage/AppearanceForm.tsx
@@ -1,10 +1,3 @@
-import type { Interpolation } from "@emotion/react";
-import CircularProgress from "@mui/material/CircularProgress";
-import FormControl from "@mui/material/FormControl";
-import FormControlLabel from "@mui/material/FormControlLabel";
-import Radio from "@mui/material/Radio";
-import RadioGroup from "@mui/material/RadioGroup";
-import { visuallyHidden } from "@mui/utils";
 import {
 	type TerminalFontName,
 	TerminalFontNames,
@@ -12,10 +5,11 @@ import {
 } from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { PreviewBadge } from "components/Badges/Badges";
-import { Stack } from "components/Stack/Stack";
-import { ThemeOverride } from "contexts/ThemeProvider";
+import { Label } from "components/Label/Label";
+import { RadioGroup, RadioGroupItem } from "components/RadioGroup/RadioGroup";
+import { Spinner } from "components/Spinner/Spinner";
 import type { FC } from "react";
-import themes, { DEFAULT_THEME, type Theme } from "theme";
+import { DEFAULT_THEME } from "theme";
 import {
 	DEFAULT_TERMINAL_FONT,
 	terminalFontLabels,
@@ -67,67 +61,65 @@ export const AppearanceForm: FC<AppearanceFormProps> = ({
 
 			<Section
 				title={
-					<Stack direction="row" alignItems="center">
+					<div className="flex flex-row items-center gap-2">
 						<span>Theme</span>
-						{isUpdating && <CircularProgress size={16} />}
-					</Stack>
+						<Spinner loading={isUpdating} size="sm" />
+					</div>
 				}
 				layout="fluid"
+				className="mb-12"
 			>
-				<Stack direction="row" wrap="wrap">
+				<div className="flex flex-row flex-wrap gap-4">
 					<AutoThemePreviewButton
 						displayName="Auto"
 						active={currentTheme === "auto"}
-						themes={[themes.dark, themes.light]}
+						themes={["dark", "light"]}
 						onSelect={() => onChangeTheme("auto")}
 					/>
 					<ThemePreviewButton
 						displayName="Dark"
 						active={currentTheme === "dark"}
-						theme={themes.dark}
+						theme="dark"
 						onSelect={() => onChangeTheme("dark")}
 					/>
 					<ThemePreviewButton
 						displayName="Light"
 						active={currentTheme === "light"}
-						theme={themes.light}
+						theme="light"
 						onSelect={() => onChangeTheme("light")}
 					/>
-				</Stack>
+				</div>
 			</Section>
-			<div css={{ marginBottom: 48 }}></div>
 			<Section
 				title={
-					<Stack direction="row" alignItems="center">
-						<span>Terminal Font</span>
-						{isUpdating && <CircularProgress size={16} />}
-					</Stack>
+					<div className="flex flex-row items-center gap-2">
+						<span id="fonts-radio-buttons-group-label">Terminal Font</span>
+						<Spinner loading={isUpdating} size="sm" />
+					</div>
 				}
 				layout="fluid"
 			>
-				<FormControl>
-					<RadioGroup
-						aria-labelledby="fonts-radio-buttons-group-label"
-						defaultValue={currentTerminalFont}
-						name="fonts-radio-buttons-group"
-						onChange={(_, value) =>
-							onChangeTerminalFont(toTerminalFontName(value))
-						}
-					>
-						{TerminalFontNames.filter((name) => name !== "").map((name) => (
-							<FormControlLabel
-								key={name}
-								value={name}
-								control={<Radio />}
-								label={
-									<div css={{ fontFamily: terminalFonts[name] }}>
-										{terminalFontLabels[name]}
-									</div>
-								}
-							/>
-						))}
-					</RadioGroup>
-				</FormControl>
+				<RadioGroup
+					aria-labelledby="fonts-radio-buttons-group-label"
+					defaultValue={currentTerminalFont}
+					name="fonts-radio-buttons-group"
+					onValueChange={(value) =>
+						onChangeTerminalFont(toTerminalFontName(value))
+					}
+				>
+					{TerminalFontNames.filter((name) => name !== "").map((name) => (
+						<div key={name} className="flex items-center space-x-2">
+							<RadioGroupItem value={name} id={name} />
+							<Label
+								htmlFor={name}
+								className="cursor-pointer font-normal"
+								style={{ fontFamily: terminalFonts[name] }}
+							>
+								{terminalFontLabels[name]}
+							</Label>
+						</div>
+					))}
+				</RadioGroup>
 			</Section>
 		</form>
 	);
@@ -139,8 +131,10 @@ function toTerminalFontName(value: string): TerminalFontName {
 		: "";
 }
 
+type ThemeMode = "dark" | "light";
+
 interface AutoThemePreviewButtonProps extends Omit<ThemePreviewProps, "theme"> {
-	themes: [Theme, Theme];
+	themes: [ThemeMode, ThemeMode];
 	onSelect?: () => void;
 }
 
@@ -163,13 +157,15 @@ const AutoThemePreviewButton: FC<AutoThemePreviewButtonProps> = ({
 				value={displayName}
 				checked={active}
 				onChange={onSelect}
-				css={{ ...visuallyHidden }}
+				className="sr-only"
 			/>
-			<label htmlFor={displayName} className={cn("relative", className)}>
+			<label
+				htmlFor={displayName}
+				className={cn("relative cursor-pointer", className)}
+			>
 				<ThemePreview
-					css={{
-						// This half is absolute to not advance the layout (which would offset the second half)
-						position: "absolute",
+					className="absolute"
+					style={{
 						// Slightly past the bounding box to avoid cutting off the outline
 						clipPath: "polygon(-5% -5%, 50% -5%, 50% 105%, -5% 105%)",
 					}}
@@ -210,9 +206,9 @@ const ThemePreviewButton: FC<ThemePreviewButtonProps> = ({
 				value={displayName}
 				checked={active}
 				onChange={onSelect}
-				css={{ ...visuallyHidden }}
+				className="sr-only"
 			/>
-			<label htmlFor={displayName} className={className}>
+			<label htmlFor={displayName} className={cn("cursor-pointer", className)}>
 				<ThemePreview
 					active={active}
 					preview={preview}
@@ -228,152 +224,65 @@ interface ThemePreviewProps {
 	active?: boolean;
 	preview?: boolean;
 	className?: string;
+	style?: React.CSSProperties;
 	displayName: string;
-	theme: Theme;
+	theme: ThemeMode;
 }
 
 const ThemePreview: FC<ThemePreviewProps> = ({
 	active,
 	preview,
 	className,
+	style,
 	displayName,
 	theme,
 }) => {
 	return (
-		<ThemeOverride theme={theme}>
+		<div className={theme}>
 			<div
-				css={[styles.container, active && styles.containerActive]}
-				className={className}
+				className={cn(
+					"w-56 overflow-clip rounded-md border border-border border-solid bg-surface-primary text-content-primary select-none",
+					active && "outline outline-2 outline-content-link",
+					className,
+				)}
+				style={style}
 			>
-				<div css={styles.page}>
-					<div css={styles.header}>
-						<div css={styles.headerLinks}>
-							<div css={[styles.headerLink, styles.activeHeaderLink]} />
-							<div css={styles.headerLink} />
-							<div css={styles.headerLink} />
+				<div className="bg-surface-primary text-content-primary">
+					<div className="bg-surface-secondary flex items-center justify-between px-2.5 py-1.5 mb-2 border-0 border-b border-border border-solid">
+						<div className="flex items-center gap-1.5">
+							<div className="bg-content-primary h-1.5 w-5 rounded" />
+							<div className="bg-content-secondary h-1.5 w-5 rounded" />
+							<div className="bg-content-secondary h-1.5 w-5 rounded" />
 						</div>
-						<div css={styles.headerLinks}>
-							<div css={styles.proxy} />
-							<div css={styles.user} />
+						<div className="flex items-center gap-1.5">
+							<div className="bg-green-400 h-1.5 w-3 rounded" />
+							<div className="bg-content-primary h-2 w-2 rounded-full" />
 						</div>
 					</div>
-					<div css={styles.body}>
-						<div css={styles.title} />
-						<div css={styles.table}>
-							<div css={styles.tableHeader} />
-							<div css={styles.workspace} />
-							<div css={styles.workspace} />
-							<div css={styles.workspace} />
-							<div css={styles.workspace} />
+					<div className="w-32 mx-auto">
+						<div className="bg-content-primary h-2 w-11 rounded mb-1.5" />
+						<div className="border border-solid rounded-t overflow-clip">
+							<div className="bg-surface-secondary h-2.5 -m-px" />
+							<div className="h-4 border-0 border-t border-border border-solid">
+								<div className="bg-content-disabled h-1.5 w-8 rounded mt-1 ml-1" />
+							</div>
+							<div className="h-4 border-0 border-t border-border border-solid">
+								<div className="bg-content-disabled h-1.5 w-8 rounded mt-1 ml-1" />
+							</div>
+							<div className="h-4 border-0 border-t border-border border-solid">
+								<div className="bg-content-disabled h-1.5 w-8 rounded mt-1 ml-1" />
+							</div>
+							<div className="h-4 border-0 border-t border-border border-solid">
+								<div className="bg-content-disabled h-1.5 w-8 rounded mt-1 ml-1" />
+							</div>
 						</div>
 					</div>
 				</div>
-				<div css={styles.label}>
+				<div className="flex items-center justify-between border-0 border-t border-border border-solid px-3 py-1 text-sm">
 					<span>{displayName}</span>
 					{preview && <PreviewBadge />}
 				</div>
 			</div>
-		</ThemeOverride>
+		</div>
 	);
 };
-
-const styles = {
-	container: (theme) => ({
-		backgroundColor: theme.palette.background.default,
-		border: `1px solid ${theme.palette.divider}`,
-		width: 220,
-		color: theme.palette.text.primary,
-		borderRadius: 6,
-		overflow: "clip",
-		userSelect: "none",
-	}),
-	containerActive: (theme) => ({
-		outline: `2px solid ${theme.roles.active.outline}`,
-	}),
-	page: (theme) => ({
-		backgroundColor: theme.palette.background.default,
-		color: theme.palette.text.primary,
-	}),
-	header: (theme) => ({
-		backgroundColor: theme.palette.background.paper,
-		display: "flex",
-		alignItems: "center",
-		justifyContent: "space-between",
-		padding: "6px 10px",
-		marginBottom: 8,
-		borderBottom: `1px solid ${theme.palette.divider}`,
-	}),
-	headerLinks: {
-		display: "flex",
-		alignItems: "center",
-		gap: 6,
-	},
-	headerLink: (theme) => ({
-		backgroundColor: theme.palette.text.secondary,
-		height: 6,
-		width: 20,
-		borderRadius: 3,
-	}),
-	activeHeaderLink: (theme) => ({
-		backgroundColor: theme.palette.text.primary,
-	}),
-	proxy: (theme) => ({
-		backgroundColor: theme.palette.success.light,
-		height: 6,
-		width: 12,
-		borderRadius: 3,
-	}),
-	user: (theme) => ({
-		backgroundColor: theme.palette.text.primary,
-		height: 8,
-		width: 8,
-		borderRadius: 4,
-		float: "right",
-	}),
-	body: {
-		width: 120,
-		margin: "auto",
-	},
-	title: (theme) => ({
-		backgroundColor: theme.palette.text.primary,
-		height: 8,
-		width: 45,
-		borderRadius: 4,
-		marginBottom: 6,
-	}),
-	table: (theme) => ({
-		border: `1px solid ${theme.palette.divider}`,
-		borderBottom: "none",
-		borderTopLeftRadius: 3,
-		borderTopRightRadius: 3,
-		overflow: "clip",
-	}),
-	tableHeader: (theme) => ({
-		backgroundColor: theme.palette.background.paper,
-		height: 10,
-		margin: -1,
-	}),
-	label: (theme) => ({
-		display: "flex",
-		alignItems: "center",
-		justifyContent: "space-between",
-		borderTop: `1px solid ${theme.palette.divider}`,
-		padding: "4px 12px",
-		fontSize: 14,
-	}),
-	workspace: (theme) => ({
-		borderTop: `1px solid ${theme.palette.divider}`,
-		height: 15,
-
-		"&::after": {
-			content: '""',
-			display: "block",
-			marginTop: 4,
-			marginLeft: 4,
-			backgroundColor: theme.palette.text.disabled,
-			height: 6,
-			width: 30,
-			borderRadius: 3,
-		},
-	}),
-} satisfies Record<string, Interpolation<Theme>>;

From c84ab728a8c209fd1bf291594c8b5cec86c47100 Mon Sep 17 00:00:00 2001
From: Rishi Mondal <mavrickrishi@gmail.com>
Date: Thu, 9 Oct 2025 03:54:13 +0530
Subject: [PATCH 093/298] chore: add nexus-repository icon (#20227)

---
 site/src/theme/externalImages.ts      | 1 +
 site/src/theme/icons.json             | 1 +
 site/static/icon/nexus-repository.svg | 5 +++++
 3 files changed, 7 insertions(+)
 create mode 100644 site/static/icon/nexus-repository.svg

diff --git a/site/src/theme/externalImages.ts b/site/src/theme/externalImages.ts
index 60316c594be86..df260d99838ed 100644
--- a/site/src/theme/externalImages.ts
+++ b/site/src/theme/externalImages.ts
@@ -158,6 +158,7 @@ export const defaultParametersForBuiltinIcons = new Map<string, string>([
 	["/icon/kasmvnc.svg", "whiteWithColor"],
 	["/icon/kiro.svg", "whiteWithColor"],
 	["/icon/memory.svg", "monochrome"],
+	["/icon/nexus-repository.svg", "blackWithColor"],
 	["/icon/okta.svg", "monochrome"],
 	["/icon/openai.svg", "monochrome"],
 	["/icon/rust.svg", "monochrome"],
diff --git a/site/src/theme/icons.json b/site/src/theme/icons.json
index aa3db061f8f92..546cdaeb4c8de 100644
--- a/site/src/theme/icons.json
+++ b/site/src/theme/icons.json
@@ -82,6 +82,7 @@
 	"microsoft.svg",
 	"mlflow.svg",
 	"nextflow.svg",
+	"nexus-repository.svg",
 	"nix.svg",
 	"node.svg",
 	"nodejs.svg",
diff --git a/site/static/icon/nexus-repository.svg b/site/static/icon/nexus-repository.svg
new file mode 100644
index 0000000000000..ca135cd5ebac9
--- /dev/null
+++ b/site/static/icon/nexus-repository.svg
@@ -0,0 +1,5 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" 
+     width="256" height="256" viewBox="0 0 256 256">
+  <image width="256" height="256" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9CWBcVbn/9507kyZdWbrQJk3TPZl0AcJiQWhRH7KUpUjx+dxwQX3qX4WCPEUNUUE24am4ggruNKC0VNAnSgGhbIWSJtOFLmmbFmjZuqZJ5p7z/3135k4nadYmM3MnOafnu2c/5zu/c77vLPdmqsiafo/A+JLy94+bNPPm7na07MFrzpv+8FfvKH30a8ee+/APB3W3nM2XewhYBZB7Y9ZtjounzC4vKpnxZ23ob2yoorsFjaKY0vRZ09hSszG2+fNSbt6vK/PFtdS/ELAKoH+Np9ebSCQytLhkRqWJ6aeIzHxmhkNNXmI3Ho4hZcjkG2NGGte9aeoD/+/l14e/dXw3itosOYaAVQA5NmCdsVtZWamOK5z2sd17zFoI73Xa6OFEHCIYQ9QCp3tWqTAyQm2grKMcDjllbn7oX9MfXvTP8r9dOQVp1vYDBKQLVgEICjlORXPmFIwdHznjF3ffV8ek7tFMY11jwpqIoQgYLsFAB+DZA2tChlU4pDgcctjhMPYFZ7RoWjn9kSu/c/xjXzkqUluZV2kqlVAPqrVZA4SAVQABGowjYaVo2uxCvf3tu9jQv5h5Kilmw6xA5A8utAAh1lm4cKHTnTZcg70DTg2oTywZqBBoD8cYcljxYFT2P41NaqO7Y/9ljy+nvGUrX+1Wvd1p2+bJLAL+HMlsq7a1PkFgwuQZN1BTbA0b54OQ9hApdpRS5DCTDCxDaumQ4U2bNkn0oZhu+FAFk/zDpYBkhxJQXhzRcNL61zsO7vnLvteHzF5oFjsLFy92ZDdQWYldAUjyWwo2Aj2eEMHuzsDgrnjq7PnFk2dt15quJkNDIe2QecaiD0kV6UxQGzS4sXESt4nrMChSjuMDLg8NzhGKyZhD5Bo2rlFaG2UMnY2UZ15+ZMXvao56YUwVV+loeTnT9USiCMiaQCLgM2UVgI9EwF0Rpglls06cMGXW0+TSg9ilHwfhy0thu9vCnVKmU6/SikQJCBFBCcQJZRSuA5QoBo+ghFhpcyk3N79Ytuyqa3eNqgtXV1OIEkpAeCdrAomACiRXlqlWCEyffvqwe373l1v0QXoSq/7JxmjHGLytj+dixiItXrjiJAkrc9J/pB7ZCaQQlnyoAvIOBXwoXqaRgwePgsa48fW9e1aq/D3zcD+gqqqqNEEREIxVBAAhYBaDFjCOLDtJBETwi6fM+Fpj856tRtOXceYeTK4OkTaUpETutsKfiG7tlLcOdhbizhL9NI4rAglK+yw7BNwSIrY0xuah1/ftfnTmQ4tKo1TOlaZSERRBZaW9H6AAGasAAjQYPisVFRWDi6fNeu++2O5nXZeu18YcpQ0E388Al5nxDIhliLwQ2PEVgSIOkaEzYuS+GF329PexG8iLVsfvBrxdAfJamx0EUltVqQHrzy4CkcjCvInTZ03fufvgH0yLfpQ0l8k5XyfYSt3S+9vvRFKmHG6vIRF6ifdd8RN2A8y4mzTOIPD/3zv37d5RW/D0omhiN1CJHUEldgPxvPaZLQSsAsgW8intyvt5+Xx3T2P0uy1N7koT44sg+LhgMyQDJCTZfQET4ccdgERlgxiNtiVEdWCZsFdxwkTOUchxc+1DTz9T/dDbp1XjkjAqbwsQaW32EPDnVvY4GOAtz5s3L/TvF1d/8u39tEa7+moI/hBPuLWBAqBWRAmjmbA5iFMiKtsOOAKr8kxw0t7EYnIMkTrJUOhJk7/vj7VDni0ia7KKQHvjlFWGBlLjRVNmzl279bUXseL/3JCBMOBCHxrAX+lFEchqn0oS5xETpR4JusIN2bvKkkwP4Q1eMtADD/iWZoRIH15O4pkUHI9oAV5lri9dclXlwsWLHbImIwi0bcQqgLaIZCBcPPWkSUVTZ/0BAvAYazUDTTJjxTdGxAaqIOFCxElDqlJJ4oTYUxRYUKlj8vOIizbSbn2FBBdSTkKpbRrEC7N+HDM7ebgm+GZtwTObyh+8+r/ktwcqDd4W+Dmsm3YErAJIO8SHGpDXemMmln3HdRvXckx/CCs7O8RCBGkgRUyQdxK/X8oYUQiHyI/vqatEt/S0UDfyC7+p2SDkXlBcEKcSEhiUYj2mBILxJmTu3Rrb+u/7H9pXIUpAKCWj9aYJAZWmem21bRAYU1w6f/eBN9eFYvwNjlGYNDKAGGuikCImEXwhpAw0KxCEtDIVxPTU/csaf7XkQRo+0EDIRn9VNhodSG2OKZo5c0xh6QqOmYdY09j+1nes8H3ZJcYFZ1iz+7Hm0L7Xyx665qt9WflAr6u9/lsF0B4qvYyT13oTyirGFk6I/EqZ2IsA+V1tV/bUrX0vm+uPxRmKJY9Y3xRZelXdzCXXLOyPnQxCnzA3g8BG/+Lh38+v+UKs8eA60nQ5M4WYW2/vRfjJmu4gwEZxWczR90WWXPXErKXXnNidQjZP9xGwCqD7WHWaU97nj5s464LCkvKtjjY/YE3DUIBhKJUQ51lRAkJewD46Q4CRyMbhd7ew+0xk6dW3yi8RIc7aPkDAKoA+AHHC1BPLNtS/sZi1uxSCP96vUgTf91u31wgwNCnuB/TVtOnA1rIHF32+1zUOoAo66qpVAB0h00W8nPOPm3LCqKIJkVtbmg5GtdYLZEXXZLDzN2S4iwoSyVIm4bVOBwgIRj5JFlwSjjGO+TF2A6siD155hsRZOjIErALoIW4VFRVhKYJz/hed5qa12tDVEm5LMmFFGbSNbxu2u4S2iLQOC46tYw6FNOvZOBr8K7J00X2Rv15z3KEU6+suAlYBdBcp5CuaM6dg+5tNp4+bUL6Gtf5fbcwxnU1QFLE2zQgYIkez+YDW7pbypVd999SHK4enucl+Vb1VAN0czsIps4rc7bt/y677GGtTyph5ipjsCt5NANOXjVG1Awq7TF/f4+5dH1l61eUIW5tAoDNHdZZo04gWLlzojC4q/ZZ7sHkrufoDIvh21c/MzOgmzlDFJCSKQIZnNO5f7ip76Konyx9eFJn3WGUoM9zmZitWAXQwbpWVlWrc+MhF/362bjtAqsLMkgmWzN3NyZnMHwhPXfe5EInqfu705Ozm7krGRchnAkNFIfD/btc1da/v3/uzsr99fWylsX9k5AOU6mJupwatXxAYO2XWiXffU/1/xPQgtvtjZEYRTNsJKUpACElHaDFNj7BkZ8XYGPIplb+Cgk2ms3LtpbXtc9s8PjZt44MSBhSfMi1Nq+97aO9V9vuBw0fFKoA2mBSWzLjPibnPGMPzMLmNCIBSioTaZPWCyOO5PX8Ykrp7Xq7jEr7QS45UwZcwOYYmTZqkPX9XD6MNkSKjmDRTkk9GrBAlTKo/ERVQxxxLTLeazXtXlS695uyFZuD8/kBXA2IVABCSV3uFkyJXFU0of5uMXgjhCXnT35v8RAzX+xt8uL5fwkIS9gVPwGxLXnqiXGs/IqlvjN+m1AbeScj3i0usfx/Kz/98dXW164W7eHzgwvxHjEsfBYdvSVZfCRgoBQL5gm8YqVASeKbNMjPwj1NvG4H+KiN2l9Q+9OzisoeumTrP3g9gNHuLao6Ur6yMnwF912e7aPKsc159q7FWufQ9Q2a4TG4hPx0u5g15k5AShjk+IZk5EUOt0imLhjnOkwYPmvkZFaK5c06Z+fFN0ZVbEdUtW8VVet1FN/9OFReMVRy6gQztlYLM8boJ00YwYmYibBY8RSAZ0kzMTMyHUw+bzTdsLjHk1ry+Z9+NFQ8tGjmQFYEsHj3EL3ezi/AvW7bMkR4UT5ldXlQSedjEYo9A+KcYQ2GZ1EjzBB6ubznpaWfyMbM3Kf082XJTV30I/5vM5r+PGsZzt21e80R3V/62vEdnVDWvOeembwwiFWGiB7CTIJJfMcGRiPyVHy4zU6aUQFseJczMRzIG+UaZa/Ybve7VPbuvmLP4yoKB+NNkA0oBVFVV6TffdIcUFpff47bEao3hcyD0kBeZRtRW8L3IXHhIBwyEAO4+HTK3hI4OT92+bd3PotFoc1/wX3PeLQ3R82671HHU2Yp4DZb9eL1Y/WUHIG0wZ1cJ+Dwws3i7T8zHsFK3vzOI/h3Nf9b7a8NKU6m6X0Fwc3aHswHTUVn5C0vKv9Jsmrdgq/9RYygG4e9K6Hs4m7oDed/lYeb4yodV2ITogVC+c8q0krHXbV29+u2+a+VQTbXvv+UfkXNPnuk4/EncDr7BmmNeqo7DyJx9JSD8MCdwkUD3CLsBPtFl81zZkiv//JeljVMrXvi598l394rnbq5+rwDkQ57jJkTOfXVX4ypcbt+BdX4YG/ln0HfGzBXKvQFkjgubccxqE+b5U4tH/+eWV2rXLF++PC6UaepSNV/mrn7/Lb933PAMdvVduCxsRFPAEU9YZsYzGJaZ4wqyB+wYxQuauOWlAzvWfVV+pLQHRXMyK4QgJ/nuFtNFk46f+tRzddU4tj6MAhGIuhEiMkzegZZgxA/nkEWaF/BdLxCUBzPYwoqvHX7L5PF1Q8Yeffppx5f9Ld2C37b/tRfd+Hrdgts/n+fyKdgHPIsdARbQRC7wl/AlFUMinBWHGZj1oGVmLsCs+G59y+bV5Uuu/s8eFM25rP1WAYwZX3qDjjWtJkMLMCpGERsMrFjCA0QqrgiQGrcyS1IpHhuQZ5xnsAfhMg7dq8LhmSNml9227qmn9h7pJV9fdK3mkttqoxd/f45j6MNEznqGyAsl6uaEm3WHmTHm3CM+jOKprtJ/LHvwykcjS6/swX+t2qNm0pK5u5VCCLqbNdj5IpGFefI+/7jxZf99XFHp65iEX8c5P4xLKln1feYxPam9WeDH+a6fPxAus2z3seEOqWecUOiE7RvrLt+27qUd0erq+GVcALgsazz5/rzm/FNJ0/XGmD1gSXgTpQtvcCwzEzP3iCHj8Hs1c23Z0qsfmPO3ymN6VDjgmXNeAYjQL1y40Hn74PpTXnuj8UkM7U+Y1THMuKKCuMP1hgCTkoUQQBZqS4j24sQNFik22O6/oh368Kc/csnp9a+sWhUsBuPcVF92mbtqQdU70Qtuq3Ja1IlA/36kNAFzOMGz/rzoCWeG9SXvNO3dNGPJ1V9bWFuZ15OyQc2b8wrgzUZ17FMvrP2pcmOPE/EpSimNTikFecYgi6ATjO+STEiQhNsSsgXHgncixW+xQ5Xh4pGzrvjIB6rlNWZwOOyYk9oFt24sv+CUj3GLM5eNeg45ZTdA0ifDREKIy7oVfnrKhFE0Iqb0jbWb9q6duezq9/W0fNDyq6Ax1F1+Zs2aNQSv9a5sOdBYo4y5AoPJiphADCVAEgYRDEPgfcH3XMQlXfEHiTyecc7XDj8Uyg9XvOvEyI31y5cfzBXh97Gs5svc6IJbnotecOup7PKniNRbAD2tbyj8trvryrzobt62+aDEJjZr9x9lS658cOZDi0rbpmcz3JO2VU8yByVv8cTyC956R69lTbezNsfivK9BRoQnQXA4qQQQEL/HvvjF47viDwqBp4OGaZUTDmg9nAAAEABJREFUciqw6l9Wv3ZVfTYv+PoKl4UXDvkDlwweazR/j40yGDfdV3Vnqx5feWimi6AInsZF4S2nL/nqsGzxc6Tt5pQCmDBh9glFE8r/qV16kIjGEmFtYSYYebRa6RNxcIiY2aPEzsDzU4AMs4qRw29Q2Fk0fHDk1C0bal6UVT9ALPaKlSqu0vJZ8eBxU78T1mayImcxkcINDQn1qu4gFEYnjsY70Gt2UcvLpUuuumLeY5Whcx/+4aAg8NYVDzmhAOLb/Rk/cY37PKbMPMIrPYJhZjw9izHwXInwKR6BPMxMzK3JSwzCQ/F+7fCdg5RTvm1DzU+i0eDc7Pc1PCtP+mxLzYW3bR41tOATYSLcDzirsHOTZmT8hHy/uGknZj7iNpjZm1NSAbPvNxM16V+89s7uZ7c1bZ0jaUGnwCuAoonln37rHbeBXHOFYflHAB4WmNMh02r1l+2ZT34WZhQApYZ9f1pd7HfJp0RD2OaTEDnqr3n5oRO3b1p95caNNTsTyf3eWX5W1cGa+bc+GcrTZ4SM8wUM61votBwLRAkw/O1Ymao++clSxCc/LrMuM3uTUVpljvtxC31is4o9Nn3JV+47/i//UyJpmaKetiOI9rRMRvIXTig/S35918Top5rMUYaNg4a9iz64CeuJEYRfIyx+Q8YgNwh3zRKXpLbxEo7nQZZeWOb4oDMnXNnZJshA8GVG+yScgUscG2mDcZz/aNhcO3/T2pfX96L5nC5a8/7b9ofHTb4rlEcTHJfuYgGKyEWnxJcgmaJCiCUZ51SSOCFJl3jx94yYE+PWQ7dtK8zxeiSeOeFnvqzZaX6x/MFF36v4x7UjgvhHRoKc8BwIkvf5xcXlkcLxZX8yrv6n0brUsAkJc4oAKqYEZIsRZjHiihDDD2/cil8oHkKqQSE/kHBNO3GJpB45qe14BRMC7/nxaJvOivcZxV8aPoRO2LFp9aPIMuCtdyyAIihrGvrlkFEn4VJ3eQIUSLRKeNs4oil88pKQ1XMz95CxFWrbosSlErT90a5j/mf/gea6xQ/u+UTFCz8PL1wcnF8k6gDhtt1Kf3hcRcXgfz+z+tstrlvrGvNBrJYi6OSPswi+QyxxDH/8CinBFgRa4hOhwx2kY2cgu4M4HZ6j5zHMnTbpVSjteh48IPg/DhWY6Ts21/04Go3uQ5S1KQhUX1bVXHPhrS+OHjZsvqP1OVAE25lw3UuJPzX08sp09YVdXJBMkGSa58nog5kxK7smUlyoHbp7f8OaZdG8Z6cLk6IIsr0rEESFl6zSceNLL6fX97+CHd7XAZQAapiZFIGwgEPwSYwvUNCq7JJhrO/Y/osrqZkln5f2WpU047GlSCt+0nC4bMfmNV/csmbNq+3lt3GHEFiO+4EPXDD80REjTSkZvhIpe8hoSDosxchbETBRyDdGNIAsCYSZ4pGfEiiXmUneQuHe5+wYuXWlD1z58zWDnhpJMH2lBFBVj63qcYk+LDBhwsw5hcWRJ5XhX5LikUAoxsykRPCFMKTMkHM6ZFyMscEZX2MSaPgPpWTeZ0x8R5F0oZlMfEJqrPjbQBe++6QZZ+2oX70289zlbovy2nDFaXc0jh465GfMCsfA5vuImjSpJkOiBLyuKTwVwqr1BMGqgITAWmYmFXKI8vgzLqmX71+691PVy2nwPLw6pCwYQTHtzVZWViohv6HJk2eMLyyZ8dMYmSeI1RwVUi6zoxxmpYjJSRAzky9cIvhCOiH4Ek8w3kILN1O2s/Y0uIVOegdbvW+cflJkIrb7D/WHD3kyhW3bdpafVRWLnn/ra6rkmMs51DiHuPklIhdbAVgZCO9eGIiTals08GFm6C1HjTEO/9js3ffim7v3z6s0lUqOBZlkPu3IVUL4/Q5V4JxfVDLzW02ueQWy8llmY1h5WzgIPikIvne+R36BB7ocCh4BEXaTWPWNiccRFEGckCGN9lB7RDLnmNlzxS+sCGnt5TqIzvyR88MzX90U/Z4V/L4bFPmIqPz9e1YeNWLYu5Vq+QhqxmvDELZfcj8sUxgKAZE5aZnD0F9TcVH4j+qlex+uLXh+kiiBSiiDTPRH0EtrO1VVVVrol/c8cPHOXQdrSOsq0hxCo5BkdlgbqAAjgg+VSBAvj6AfML7IJN/4ConAMTMSUYw0XEZqeq0n1gSBR5MGbYNL0mjWsMCGePGTOWgUvcgqNO/VLXUfblj/8vb0cjUwa6/maleOBXXn3v3HwYObpzM3fZtZx/oDGsyYSDjJYDfwfjbuS7V5K+587pG3wvNwLPAVQWVlpUy6Drt7pAlpqTSVmeLJx59eXDLjX2TM/Ya4hIi9QcO6z0I4xSkhooSkEVbaBPmCTwBHITNRXPCZGTmImDl+J0TpMcyoHyTtazQhCgF9QFcMOCGtmbaQCl0zSI15d0N9zbPIYm0GEFh51i/eKBhz8AZFLbOZWpaya2KEV0cyPonmTcINvOPxrMFuguAb4ii+Ykts0Cuv7t97RRVXydQjup7SYtKmAIpnzjy6eNKMn5pY7N/o5LuJWDNjH09YL8k4RMRY/RlpnkDhQei8R57ggzNmhuwZj5AblkkMM7fyS1x6iAnnelC8dsMENg2x4j1MoZ8Odgpm79iy+s76+uUH4znsM1MIrDzpFy218/93TYE56r9CjnkvBmYdFhI3RREY8CIEJ9g2KQMJNl2S/8dJj1fEP5q+7KonI3+58pSkIkjk6StH9VVFfj3y3X7x5JmfoX1mDWn+LAbFQPRxvjcxY0i2/l6biPeKSOfF44+UJ/yMGKz6JJkYARAze0LPzEgkkqcQpdEkeQPjBtLP0F0ho/4SCuWfsGPLy1/ctGnl7jQ2b6vuBgIrL7j+wILzhz+15uI7Ikz834bMG5g2niJIFPenViIYHMebX7Lyt8MSMxNWPofDoXebwXkrSh+5ZukJi//fqHay9irKE8Ze1ZAoPGfOnILi0pkVu/fRi9DCPyfDY7DCA3zWWDfRDocdYgZ5t/yJYsTMnlcEX4iZ0W8UIxSj1kZy+tQ6JT0hyLxXcYhUc8jwamVC72vYsvqSra+8sMlLsI9AIOCvjpGDp/46RHoW5ttvoQgMaew4cTQAkzKh4OSO9eceORCdkFLsqNMaVfji9nrQmzjU3pvi8bJFpTNnNuw68Adq5meN1tMM4IbwSyK2+NqX2VZtMWN7jRQReiGvw1j1sV0gaAVYTpJCXqbMG2YmRWoPGFn0qU9ecvz2rS/9k6wJLALVl13m1l70g9cLxpV+VnHeJEXmYWLyFYGsKJiZwWGfuf1ZLbIguwMhirlETe69pJ2Zay+9/a6+5r6VUPa0ctnuj582806O6RdYu+eRNooBM7ZgXlXogPTQawN+L04eBjFCXv8VsoCYZWxQGBlS8yIVxztJQ0JGLUP46ceD8wdNxqp/Z1VV4jKGrAk6AvL3BdELb95qDg6/lF2+QBmzBYqgGfNTY25lYzJ1CJmRCY5UzxXhgV+siINq0StC+5pn876Cz6w558a0fEUKUZTmjozebnEv0DH9OdzBho1LYVn1BeAEtVupCL7XWUn1BD+BgIRTCHV4gi9uSnS7Xub262g3cyeRzEzMIMVPqry88m1b6r64fv3KNzopYpMCjED0sqrmhRcP/fvwJppBRleSMU0EgzmFswE2BtgcIIhoI05aSOa6T+01wIwtiif4ct2Mw4v4tV6vmBdOyJt4ltZHrV24kLw3Z+2V721crxQAYXcCfhW0Fbb6JgkkAGZhDK44SfK2+sYQ8ifj2uZJJnTHI9oE+Tqqw4sHg9QRoaxYZvYEn5i2Uoj/c1t93ZlbN7wUlTRLuY1AFVfpFZfd0Ti4sOwOiqkI7qf+SNqNGeMaki1BUgm4mL+Y0Lh78o6hcJGOzsd3pfB4VuZUeySJvqCnuhLfOaF+JUoA7CAjdivXHTd8xGwzcejSofuOi5VT1KXrqUPT24ReKwABKam7GKiJdIMMvJRwRfCFBDhhWFwpI66E4ySstEMi5B1RvGDrJ4RdBlBI3iJoKByBVlzJKG0mKaHBiPVbStF3Rx+bP2Xbxtr7JJ+l/oWAHAvWfOD7W45upk+7pvEMw00vGlxaadViWGliTiwCiW6LEItX5gphe+uTP8UlLZXi+WT+QiK4NVFi/hrCrYQQ0qV+maOGDRSPJlL6p5qcUdELf3Dj3vWvuuXRcmijaorURUxqO33tj3N8pLWCRa/jKeXRFRF9jwxAFUpJRmelw+iTBqUm9MLPzPHSIvxxX/LJjDTEQ8ih7+NtC89C8Uz8W2cwl2/ZXPfNlStXtsTj7LO/IiC7gVcu/sWzI48pOMOYAx9mbn4rxk2kOYa9AGav0ZgqxiNM1vZhwHyC3LZOYwd1xAW/VYIIf6sIQrUmkdeQy/pZE9KnrjvvR58fN3ToO/MeqwxNOvptTXRI+Kuq0nf/1DsF4HUsWYXxgngws6dR4e3c9lIJiBD7JA0xx9tljrsSh5EkyeP5ZTcAYrSrDNeAydPmnDLjE/XR6Gteun0MGARWnHZH4ysX3POHYaNMscP0vdSOYxtOCrNZ5gmnJqT6oQT8oMGq7vlT4kgEHyT1eGl4aFTmemoGMqPpTbTzuVfO++G71p/zo+cqTaWau5z0qF1RI6u+EIpQe8JfWdn6j+sk35ESODnSosEqxwx0U1hKCr3EYSBE5cpggLaSQ59raFg3e/uWtSvsH+0IQAOXVp70iwNrz/3p1/MpPB1bxIcMppEIqndk7UQ6oB9ageYyRBuLixeJ+YZ55ikRCcfrE1+c2NDt44YMLZrI+p55WPEXLl7o0PXkGV/wJdCR8EuaUF9QJ13si+rTWwczYxGPU2pLrYQfI6mYW5C12bC67thjCyLbt77y89T81m8RePn829evvfCHF3LMnG+Y1xvGVh3ULWT8lR+Czy6TY8gzRuHGAAGDdGYdg7OUjSmb3XjKV5EhtmXfMWbv+lcPa0UEXwh52rXLli1zotEoy0/oyW6g3UzdjOwLBZDSAYGNUsLd5KIPsyWFX4MNkEMswD+E13qR7dvW3lhTU7O/D5uzVfUzBMaMOPpfqmTEzBCpTxPxm7K7Z8ZcIhgDcUlQIgYbelzsYZ4xBF9pSD52AXjKhpNE8MmQVszrWNMHZzWefMmH5g9dX0d1zs7lUUV1URq2Y73BcR+Vk7fd70zwJZOky13VCy/UVax4JvroXb+5/3yJP1JCj460aAbKAVANBJNCjSaZmZgPEaKS1mAgPOThSsegbWuI+Lxhw9SHBtH4BrLGItAFAsvPqjoovz8wXsV+N0KNmMSaf4b5F8M5X+Q6WRphz894+gQvYXISDgNkWMPLb+JxnTN+yKwPnj/0wU1vP6qqr4+GRPALXj3aCFEPTUnp8SXjS2b8KtZCz0K3zFNM3n9SeqQ7AdXD9jOWHeckry1xZV8h5IJbIfF7BG3rZcLDwI9kUdgGlzq7kX7tMcfknXbqqTMew3apecOGR7yPQJDVWotAl2rnoeUAABAASURBVAg8ct6Pms45l/YVjC39kiJ1Es70f0chKAH4ZJbFCWHIumz6sShhqSeNV4qe8JNzb35L3uz159560+hdpB+/ntSwHWPNaNqlhYaNXW+ERkVHmUgkYmRlR/2d2vGTZyxyD8aeM9p8FCdbjTmO93DxIt0pH8/Z+iky0zomwyER8PZIBFpYEVfSxZWwEBZ48sOQe7nox4WL6GGc2xTfOXjwsMlTJo25Xbb79pJPELN0JAhUcZWW7wfqLrj95eiFt58b0ups1LOBSGGRhyKQ4wBe/xnHuJiTrif4hh4uMHmT1593y+UvX3CD9+Mwcrs/l3DDH40aEXif5tJc3R3hHx+ZedH4aTN2YEd7G5F7LJFxwAesBvXOZl0BdMQ+M3tJzHHXC+DhCb6LjmvjCT7uWMjLwfxoKMSnNGyJfmnt2ufeXL58edo+nwQb1g5ABFZffNujPGzIiWzU59ngbgmXy1iFcTwgh3Fx6Ljqg+vn337+6vk3bUqFp6oq/qtYshiJwAuJ349PzZvqH182a0bh1FlLdTM9qDUfh7mPWY/pzpj/BJcUFEFyE0BHYgKrAFI7A5C9oz0AgNAbIsAgGGitCXFbtEMf2rq19j82bap7PrWc9VsE+hqB6FlV+6IX3fQLCoWmEqvfsiFXtdDX159/a2Tdhbct7qq9roReyk+ffvqwcRNm/1Dv59Xcoi/AfMdxH/OecOKXDEKsse5BETjQARI+QsoJBSB9Ywg9Nl2e8Mu2H4JPRvF1o8YURLbV1/1J8liyCGQKgTXn37BlzfzvfXrt/JsL1l5860190a681iuceMLH9jUeiGK7/zmDkwVWPo1Xkzh0GFns0IwiI4qAmZgZ4d7Z3FEAogChBNBd3LXwr2hIXtH2bdEb8UrkAOKstQjkLAJFc+YUjJ0264x/v7Butdaxe4yJjdXaDUHiGbtc6AImLXNfG/gNw3jCr51gKQAR0d5z1M4wMmqWThPTChVW72rYFv1Ug/313XaQslG5hkDhlFlF7s7df1ax2D+J3KkKLxGJY0r+xBbbXXRH49jr4pIbsx8hkQU4sH2zdvdNLWDnSK1s5btZ1rByvr4N53zZKnWzjM1mEQgsAoWTS29g3RR1tPte0rGQ0q4yxsVyp4nYJcYrRYLBUddbWBnRCJIoAe3FSKh3lHUFIOy3VQISFpK0BAEUaMAQmynnnjto165dfdT9RO3WsQhkEIHiktKPF02Y1qBcvchoMwRz3QHhagtCj0M/k0i6EBEzMZEhEXhmJsSQGLkPYyPi208uAdF7HHnQVRF16fMhQgwTszKsWBc1Nrpz586NoyNIWLII5AgCxVPKI+MnlL6Ao/xPiFShMSqPjGL5ghXCzEKIR29EsEFIQ8CzIvyaPW+KnMTDvXmild4U76uyiZ61X53cekAJEOHNq5H3+/IqhayxCOQIAtOmVYwsmlD6O93i1mljKrDMFYB1b80jUsTsMBNWcqOQpMj3M7PMfYJLHRu346RupKhu5ElzFu5+/WH2FEH3C9icFoHsIlA4KfK5A02N8vNyHwYnItDJOYyZDxEnnOnhIyZmRQxCDHHCFX+c6DCDY8NhcT2NUD0tYPNbBCwCXSNQPHX2/MJJMxo4Rj8lQyNRQgRfCN6ElRU/4e3A4dT4dPitAkgHqrbOAYvA5Bknjy+aOvNxE4s9QK4ZByDkvkoEX6itQEu4M0Lx9FqrANKLr619gCFwsKV5im4xZ2pNYcKBX7bpIF/IfTSYTMpnvX5sFlyrALIAum2yHyPgmkaGxBP5b+0pbownanFFEPfH47P89LjKMg+2eYtAv0EAr/ZwnR/vjhFxJ8IlvueRVd+75acjMOkqYhVAupC19Q5cBLDCy7t9bPMh/Z6IeRrgcEAkWujwlEzFeNxlqjHbjkVgYCIgQt4eZR8NqwCyPwaWA4tA1hCwCiBr0NuGLQLdQyCduawCSCe6tm6LQMARsAog4ANk2bMIpBMBqwDSie4Aq7ti8bUjItXXnFFavejr0x9Y9KfSBxY9PfWBa6JT/7To5gEGRc501yqAnBmqjhk94YFFEyLVV57h0YNwu0FlSxadWbr0yrnTl1x11vSlX3nPtL9c9d5I9VXv7biV9lOk7Zn3X/OFGRD2g4673YTMEybMN1BIfdCE1BwV4jI1KNR+4f4d296nvz3ucboLWAWQboTTXH+lqVRNec57zODw47og9ISbF35CO45Hrrih0BMaZBIkfiEKOY+zE17uhEL/cpy8f4byQo/S4NAd3WV3+pIrTyp/aNFvmvJUvQ7znUapOcbhIUYxKaXw/psTRKRCNNAM97zDoi96Sj1vpW0J1TbChnMPAVf+nwRjSGYdayN/YU5sKB4mirsSFiLywv6vSshXq1pr0jGXTHOMujKl1V+cN33Jl55gZZ53jfthw2S0fPWqDInwe3/fCr/8iF2Suqq0f6fLsHTRQwxMFznSlWwVQLqQzVC90epydpIfnx5qlJmJmQ9FdMMnyqCjbLMXX1kYWfKl+yhf/VU5/C5ikl+u1ETQHsxafq2GmYmZvSqY2fOzhBK/bSdeS20RyJ7wCydWAQgKOU6uS9RWeCUs1J2uMUNMsXUnR5EcKVLLLFy82Cl/8Mr/as7XNdrhC5k5DKmXWWuw+qdmJS8SVaVGIn9q0Pp7gEAmsloFkAmUA9qGJ5yJ7boKMalwiKJUnhThWX+/esjL4ad/ElP69xD2Akh4Hk4YDjIolIVD0DzE3j94rc09BKwCyL0x61uOjSIIs/ers8YxVM2XYT9BFPnrNcc1N+n7lUOfhoRrKIA8YmQDCQOyu9CH7QEkxVIuIaByiVnLa98iIEIsNeIWTxxibWjeY5X5J/zfV8cZQ//Hiv+DHGboCNndEx5siJmMEDySgIx+PV4l9pFTCFgFkFPDlQZmIcAEYhdybYgOuM1DmlroYbQ0EyRWM2MPYHySKKHDpg5KU0ckBSz1AIFMZT1sFDPVsG0nAAhgxU+u3lACpCl/70H3z4ib7XFn4qs8afaC8YeCvkAYaRB3eDCF8AYwnmafuYYARi/XWLb89iUC2NMTQREkaCppfSYUAIQcUg2lAD8knuKCTvHpwoxgChPMCCM7FEL7z5S81hssBOIjGiyeLDdZRsBTCsIDLgHEgfjjfICnv+qL6yXYR64jYBVAro9gmvhPKoEu6mfG6t9RHobS6CjNxneIQCYTrALIJNo51lanSkCEO0HY9yd8EPhUH/rrpcG1NpgIWAUQzHEJPFfMkHSQMJpUFAavCjSIoAgMzgnGyDcFmjRZE1AErAII6MAEkS1mJvkDH4bEG+0aoyHl2nisGnjlOwIvEI9jY1SINDso5EXbR/AQsAogeGMSRI5YBN+wLOUQeCgAlpnD+jXSZgm7VKXI+WhI07nsqlOFVDOdq1z3w45rvhRy3ZfJmm4hkOlMMoyZbtO2lyMIGMZW3uNV4yhvFFZ+xUqvw9vARa6Jla+94H8L11z8/QXRBbdVRS+65fc1l9z6t+iCW54TqoO/7uLb/lC74NYfrYbrVWMfgUPAKoDADUlwGMJCL98DsLfVZ3qByMwdU3D0iWMKRvxs/QV3rg0Op5aTI0XAKoAjRa4flmPGkp8g6Z53rje0XRnngrXz//fky8476t/Lz6o6KCTplnIfAasAcn8M+6QHzOzVw3zIdTTdOyI8PLLm4tvlbwOoiqvkEsDLZx99j0A2arQKIBuoB7tN4yh1gLS+um7B9y9/9ryqPcFm13LXGwSsAugNev2wLG76Gsl1/2tCuPnOftg926U2CFgF0AaQgRhkjm/7pe9OzL1s9YW3LXnkvB81VVZWKiGJt9Q/EbAKoH+Oa7d6xczEzMm8uO1fv+qi2/7qR1RVVWkhP2zd9CGQrZqtAsgW8n3YrvwqMHOKIBvTrdq9W37NeNUHkuKOnQ7dAq6LTIJrF1kCk2xHPDBD0XeMMIs0d10fM3s7AGYmeGDhkjUDCQGrAAbSaHfSV2Yr/J3A02+TrALot0NrO5YrCGSTT6sAsom+bdsikGUErALI8gAEqXl7CgjSaGSGF6sAMoNzoFthtuf/QA9QGpmzCiCN4NqqLQJdIZDtdKsAsj0Ctn2LQBYRsAogi+AHrWlljwJBG5K082MVQNohtg1YBIKLgFUAwR0by1k/RyAI3bMKIAijEAAe5Pt1Jg4AJ5aFTCJgFUAm0bZtWQQChoBVAAEbEMuORSCTCFgFkEm0bVsWgQQCQXGsAgjKSASAj+79ikAAGLUs9BkCVgH0GZS2IotA7iFgFUDujZnl2CLQZwhYBdBnUNqKLALdQyBIuawCCNJoWF4sAhlGwCqADAMe1Oa0/QYoqEOTVr6sAkgrvLZyi0CwEbAKINjjY7nrZwgErTtWAQRtRCw/FoEMImAVQAbBtk1ZBIKGgFUAQRsRy49FIIMIWAWQQbBtUwMbgSD23iqAII6K5ckikCEErALIENC2GYtAEBGwCiCIo2J5sghkCAGrADIEtG1mYCMQ1N5bBRDUkbF8WQQygIBVABkA2TZhEQgqAlYBBHVkLF8WgQwgYBVABkC2TQxsBILce6sAgjw6ljeLQJoRsAogzQDnSvXM9gcBcmWs+pJPqwD6Es0s18XcWoiZW4c7Yo+5e/k6Km/jcxcBqwByd+xSOMcwmjgxO4iHnxQZ+ZmfRDwh7JEfFteLI5L/FswYTpSDY22fIRD0imSmBJ1Hy1+XCDieEGutibSBjVNcsE08zRgv/rA4yL38fwBKFIB4umzLZug7BLIPuFUAfTeaWavJaXEphNVeSMUMhVoMhWNEeS6T41IyTdLbkom5pKA0oB0o5iIzWZMZBExmmumiFdVFuk3OAQRc5RBknbRiMo4iNxSnmMNenKSlkuTzSaEsecSkQg5Z00sEQijP2In5hGDcisCnUjw220+rALI9Ar1sP7KwzlCYIPhEWmGbDzKQ47bkp4nrsib5Z9gQOw7J7l8phRsBOx16ORytih8KmEPegPnsiAdsQHrKThVX6aFNtDSs6fyQVheENZ0Xcp2z21JYh85OpZAJne1o52xy6WxcA5ytlXO2UfzFnrZv83eFQHCFXzi3CkBQyHF67pLvvbn6wpsfqb3we8tWi3vRjf+o7Qmdf+M/1rz/2/+oBeU4FFlnPxTLOgs9YsAqgB7BZTNbBPoXAlYB9K/xtL0JCAK5woZVALkyUpbPHEJAzv0+JdjGxSu1R4nkbDlWAWQLedvuwEFABD+gvbUKIKADY9nKfQTwlpW8VZ+Ca6wCCO7YWM5yFAFmvFgF76zkGABPZzbLu4OcUADy/XpnGNo0i0DQEGCOK4Gg8dWWn5xQAG2ZtmGLQNARkEVLCHx2YxuAXFmyuaAARJUKEeXYRxZZGlPbbPYRMBw3RKYLEesqPc196YK7NLduq7cI9DMEEt3Bqm8Ywg8XMQaXAT5BJUiMRxIHTzZtABSAYNQpYfVPpOvY3ROmzz5r3rx5oZJ58/LJGotAgBAIC/juAAAQAElEQVSYOG32KdrE7iCCwBPkn9thTlZ8n+LJMrnjviw8A6AAutVrNsaw0WY6NetH6xveul+99nbxuIqKwd0qbTNZBNKIwLRpFSPHTZnxy5aY/jdpOhmLfEKuuD0V0B4nWVMCCUbb4ymQcQxFoADyhbgPWOnsOnBDBZRAJBLJCyS3lql+j0DhxFnX7Wtu3oL5+EnSRn4NQIRZyO97qt+PC4ybawrAAw5KgF1XD9GGvrxz597V+/a5l3kJ9mERyBAChVNnzy8smdlgjP4uVvwCNGtSSFZ+xmqFKJwF5Nk5Sf7Oc6QpNacUgDHG+327hMukmDXzxJgxvxlXPP2FoomRU8gai0AaESicevzx4ybOfMK0uA9hNhaiKVnhfUKQWARfSALdoKwJv/CWUwpAGBZKKADxEpBnIQRO1K77TGHx9N/ImWzhwoUO4qy1CPQJAiXHH3/U+Emz7jAtsZewCr0blWLayfSDj4ghSCLITPLDrNSlieclEpeyacB3Npvvedu+8ItLOAMIgszAnQm7AZDij+xvOrDuqWdXXzdpUsWInrdgS1gEDiFQWVmpCifP/mzz7tgrrtZfRooIPpxDVoTIGE10SPgZqZ0RkoNhhfdgcNJDLhjHAY95vFJhkLx4SVTBLumjmUxVU8u+54uKp3+kxL4yJGt6jkDRlJlz7/7NA2uN6/6EDB3btgaDOcgQfGM0JdJ8oU8Eg+94MhR8Ng/n0GDV9wiDYEAMJeCQ472BdcjBsUCRa3iii/uB5k07lh43pTxSWVmpDq/JxlgEWiNQOLF89riS8n+6MXc5VvWpbLQCUVtSlNwM5Jzg+z3OeYFgZmLmeH80rmUM1n4oBIlA50KKHHid96lmvfrue+67pbC09DBNjgzWWgRoHN7nF06Y/g3Sscch+Gcpg80keVLuS3pioiXBkrBQMiLXPJCRXGO5c36x9ENTU5ziigG3stAR0A1s1JfogIoWFpd+xl4SkjUpCIwrKftPatr3HNaOb2tthkLusXmM4b4PMSn54BWB9wnB3Lb9TgF0MhwOjgphjOgoMvyzFc/UrSgqKZ1njwWdIDYAksZPLDtzXHHkSWzv7yFDE4jYZe8P+bGVJCJmkXXq1ORy4kBSAP44yYgyMR1Pmv/2y19XLx43ecZ4qwhoQJkJZRVjcc7/ozH8D6z2p8F1iBhX+TSgzEBUAN4Ay27AGBoE9xJu1mvuvmfx9UVz5sgXXV66ffRPBKZPP31YYcmMr7UcaFyH4+JlmAMhOkzw46s/EZYJ6t+mVwrAhc7MNjzMWMwTdIS8MFaAIaTpG2bH2+sLS0o/HrF/W3CEUAa7WOGEGefvO7AnSi59lzUPhvBD/+NJIvCp5PUD86L74gFl4hXK1AOMe0256IznOcJH93vYXgOOQxowpSS1DqUkdOWVDgl1lS+N6YzOFBltfvXOAfPs2KllZ1ZUVITt0SCNiGeo6nFTZp9QOKH8UePSEmP0OCINkTfMbLz5yvId3yFeJA6kCBkkFn5xyHe9gP8Ql/13BBLoa2KcSlLIQOCN6Cy0Y9Ah8t5yIXCEVh1hOa/YjvU1fwrlhRcxq0ZE+HUl4fAAVEzUDgn0QijXyvqdaxWJgNTVHiEpadtL705csgJ42CiF+XG8adaP73h7/69/88ADo+T3B5BkbY4hUFQ+55iiKTN/ZFrc5yEzc4lcvNnTjHnHflcwP+A3UAGOT6QgVIqQYvAwRNwFUR8ZmfseQcjJF/pE3V48OsHyqlvSjdsIxr/Dw/MfSWQ5IkcdUamUQtvWv3z7oOGqhBx1K7OKIQl84dmFBbxeDgwGCXmBxEM6m/B26Ug9Ql1m7CJDah0y4Moo4hh/uHmv2fjKlp1fFSVgXx12AWJAkmXnVjRpxpfNgT073Bb9eYUZpkikmskfZ7gMdj3CeHuuH064cJJW0pOBdHiSc14Ev50GlCghCD8zNSP5T1QwrPjVLeu+tWPlygMIH7EFLkdcNllwY03NzobNtV+lkDqBFD+GBM3cM8zaKgHUkTHLfDivLICDSOsh7NINGzbvrHvm+br5VhFkbFh63JDc3YydWHr2q7saV2HVv51iWJZQC4SLZX4xsygAFoNoWIRljOHrwDLiheD0rQUPwotHfs2tt/dxxnzBx+Ifc9msbFLqrGmTx330ig/Nf8sv1xu3TxSAz8C2jTW1c06O/AexWgiGt2mKd8JP78xlBs4KhEzMcRfejFpmbjUgfuOYQIS7gWlG04NQBEuefSk6XRSBvR/wEcquKzuz4qkzJ72zz61WMV7maJ6uROLJOOCMYeAQ4yEEx7Pi74q8jB09ehMvc0rK+674E3yKF9sVJhUXH6MV1RvmK3j08DMjE497bvny5bGqqipcDlCvTZ8qAOGmurraDU0c+XB+XvFUpdQ3APteiW+PUjucTIcSMDIsyYjOPQKgUOe5epYqfAm1LeW1Y8z7TAut2rh558/vvffh0ZLHKgJBITt03JQTRj31bM0N7sFYrWPUBTi6KZzylYsTvaHk9O7BjMpcP7z51KY5BwKj4oJPEPy9OIneFOaCE44bPeT3st0X4W9TpFfBJEK9qqVN4frlyw9u2PBI07tOKruJ8/JKgf69bbIkg8xITYbiHmbEQRHEQ9l7MjMxx8nnAjubPK11GIP3EdfsX1c0MfLFZcuWOX66dTOHgLyydZqaXnSMswiCHyasHJoZA+aQUcxC4IZBgbaYS56qQh/Ap8IdtHPAZedfKuS8a9hgdX19/ap3Vq5c2YLEPrdpUQA+l7Ib2LbupR3b6usuVyp0BhE/Te0YZk4KGjMfyqHgF0KMgNQeISkjlhm8xFvy9HNcEZjhuJD94c43m9YWTZ55bjzZPtONQGFJ2buKSiI1rNVdyvBYjdmDVd/RDmPVZNbxocJTd8GKN5Rd5Ol9MvQSkcxjEDNLox5hPoslEUJ4CEfmZlfROh0KnbN9S917t26oi8LIpV/vmeigBmm7g6S+jf7ERy9+msYOex/A+DjGaycRrtaIBAjq0gC4LvNkIAMGD6zjySyuR2iWjdaTOGYeGj9xxt+LJh0/FXHWpgGBovLyY8aWlP4Ms2Y5Gy4lUrJoKkgQE+YIxJ2JRPw9ovjklikmRG1Me3FtsnQS7G4S5ruX1eOIyUhYSCKZGWd9Zcgo17Da7zJ/k0YOPvHVzTVPUoZMHKMMNCaXFg0rVjQWOMX3DR00OIK+30Tey07yDDPGzvN18MAAk1AHydmONkY7xjXvNW7Ly0UTyu+Uz4r9i0K5I/Ap23zmYvslJccfNap4+rWxvW4Dx+izkPFBWpuQYYP5ayDJIlIQITKkUojgP9RfZPPCvnsoJd0+5vjcFi6152VtvDhGV7gRb89+lBdSk1/buuaWHb18rdfTvgDAnhbpXX65GzjuuMG7nQkjv4szzmy8qHmQGYDIOKJq+PHs2BoPwI7Ts5uCW2etC7Aj+ILesXvtuvqdnxd+Hn/88YzjLO3mMonCFP5HT5i2YH9s33OOppvYpQIihhjHxZziRmaEUDwUoKc/V11wbGR+i9hrUUCk2KAjip9UYT5zW/3qKzdvrn09G6xnZWLKTebH585tHprX8krDxtULjMPvYaVWQ/h1ZyB4ICKDDyy8gbI+fx5Trh6Pjd3/3n3P/U9s3PrG8b///XNhUQSVlZUqlby89tEKAcHnF7+pPn3chCn/AoZ/drSaSt7MOFzwMRcg/JLYEbWqOisBLG9kwB6D0A+G6G/AnP9gQ33t3K0bV6/MClOJRrOiAKRtORLIBYcMdv7UomeG5ZeeRI5zDdLeFEUAgveQbSVciMbAkxC8gbGpPMPPYIzZmNO1q58/ENv6642v7vZeG6LfkoZka1MRkCPT+OnTx91175/uZtd9nLQ6S5FDzIqUChEwPZSdcWUmqypi2s4NRKXV9qTyOG9MCis/5sIOUvyt447NL9++uXYxBcBkTQH4fRdFsOGRR5rKy8kdPSL0M6egYAYR/4SMacKIy6fFhlof5hAMrpVJKiQcJl30ABPgg6apuf6u3z7wred37QrjDUlIFIEoQCHJP1BJ+l9RUTF4fcOOz7jNVM+GP8FGMbcRfsCIKRHXnYyAUFzAKJhGGxeMNZEIP9NvuCDvFNzufyddr/TQVo9t1hWAzzEEwgUwBz6+8Lydo4/Ju0rn5Z2qmJ7FiLtQ9AIkhtzPHXyXOT5RUzhVmAhhFdPfim3eufHtRnXZrl27kplECFLyDijvL//0p7NffWtfrYnRj1lzGMKPYVcJcuCyRwqYMpARghNoazBpsUN12HANKfXu7dvWfLxh/cvbg8a0ChpDsiOYP3++++kPXbh666badxO7FxGbzQk+46eoRCBHHbnFGqe0/g0uCR+9+4/3z5SdgJAoASHpl++Kv79SUVnZ1HFTpi12m8wyY3iivNMT4ff7y8zEbDySOGYWByTTAA4hzRDS/XjqkUHVXn7mIyzfQbmE8L/Jij933OiC03dsrXvKayiAj8ApAMFIlICQ+Bs2rXmYh/C7SJlvEtN+YN5ChPvg+LFAZgKmAOWcweRj3GzP5WZ6/qkX6n6+4uX1x/l97u/C773PnzzlBt0Uk1X/Ugi+A8IY+tMxLpBYQRHnWxlqTQzg/JhDrl/uUExXPqmGGe0oEDIzx114O7XdSgyp2/PUmKKC0IR7JL/8rUJQx7TnyEmPMkyfuvTSd7ZvXnNDHg+ayazug+w7GK9mwtZAJokQ5aDx+NYmzJo/bppjK4smz/hSdXU0JG8LpDsyaXyScH+gwonTPhrb1wLB569RTOWh75C8+DQUoYz30VACG1wFHa7fmZlgQeKCkIWNwmxojwjxh5PUL0QphplTQphlCEoen1olIiArvYKbtIr/bvJC47dvrltUXx//HF52s5FIxPjKPZk3IJ5W/AeEp8PY8ME76aQpDcMK9BVOyDnJGKrDEDnxzOx6d8IYsHg4N57+hGdjQnhVNIZb9M3vNNatXrv1zbOlz74ikN6IIhA3FwkCkFc4ufw944pLa0mrXyrDY7HiJ0ZLJQXU75sIHDBBEJJNBkpAJ/0Y84QfTi8sWk2WlvaSgYSnbRwz2E3sFhJZwLeRt3ouMT1jmN/TUF93zvYNNQ1+urgyjkLiDyKpIDLVEU9yUYizcvOpJ5au2r4lWkEh5xPI+yYmhcOMo7UxrmFctUE7ID7nLKZ7vnJpmuO6fx1bEnl4w7Y9JeiztyNAv1mUgE+50rmJE8sm7DlgfmpaYo9inMqNSVzyJVfsw3viK8bDU/ouRlbv1Nowb7wgMwQdPgeD4fPBHI9DdNJKeZTZg6QvN2yJztm+pe6xZGIOeXJKAfi4Qihc8Z92YulvB40smGIcdT0GooWZFeKZFNZTxtJBuWlk4ilD55rYwfXvHOTv7NxJ+XV1dY4ogVzqUWFJ5GvNWkWNS5ezUTi+K6ya1MpgzFqFMxrA6zlPkA2kHQ1DoPEkEp6EsKoQOE7yTDASD4cw037MBfll27bU1MunPQAADrlJREFU/VjCuUoqVxkXvkURbFq5cveOTbVVKjToBFK8DPGiroUIA6pB8dFFQi5ZUQIgVjHz1d0Hdm565yB9uK6OHPnTY1EEshMIan9Gj522YGxh6RbWVEVaDwafgZ1nwBjsYW+SUAKYQ8SM1QPEzCSMC2FHYJBX5tMjVKBm54dLFslfulKOG+lbjnchzv7WDS9FP/2xSy/msDqLHN5AhOmHB8GIEhCCNyctejJKxeiXu/dHV722u6UCZ2qTej8QlE6NnTC1bOTYyS9AfP4MkSrWWoeDwlt7fMRXf6ToQ2uEF+ctH4TzPdII6wh7v8MXZcUfwjn/vIZ1tTUbNjzS5KXm+KPfKAAZB7lsadhQu/y0ikgZO84i4/B+ifdJlICQH84xl7GalnFz7Olf3lt9/4Ztu0qCwv80+U81i8vuMC0cDbFTwRyXIOa4GxQ+U/kQQZcwDovxpUKUgBAiJQ2Xyrh89BTDO8x8WzhcXLE1IJ/vgsU+s/1KAfioyNGgYVPND1TB8Ank8B1GeT9bnpyNCSXgjS7K+C68wbaYiMIgFAEtMDGzvqik/CaJyCYVTpnx9cbmg7VM/BXHcUgplSSCEZ6F4D3MdhR/WMY0RPhts4pXrjApsNMighIQBSCEPv0+HM6bvnlz7XX9ZcWP9/bQM9H9QxH9yfepS89+Z/umukV5Ya4gpVZg0Bn9E8K+DgqeyRd+30VyblicRxmT9dqi4kjDuEkzPhmJLMzLBOfyUYu0UzSp9AOFE8q3UYu+wWgzRuKEgDGgVt45WvwSJyT+tiTxgSCAKS/0MCNIaWpRmp9Xypm7dUvtRzZseGlXIHhMExMqTfUGolo5EggjJeOO3bB9c+1pKuRciGPBVkxEUQIKriSLX1xRAj5JOFdoHC4K79y9v255ybSZpelkuqKiIrxiZe2kccVlf9cxrjZGFxn/8gwNC55C8OaE9XlVxLjsw5N5EzYCn9m2re6UbZtXP0EDwKgB0Edavny5/FUhTSo65pFpxaMmU5i/DEWwB5PXYMBF6NvC0F5c2zxBCUOBmQIsYnNiB926wpLyP02ZcsKovmZu8uRZo1/bdeAW43Id2jobuw+81iOCHwtnLsFFSSOTX5QAO+odFeJb8gcXnLptW/SeZIYB4BEMBkA3411cDkUg1PBK7Q95qFNOjrqXyDv5UYqBQCVDuTaz5QuIDx5sadqI+4Fr++pV4fgJMz7ZGIs9jwPTVyD43s2+CI6PUqrfj8sF1+Ob+f5w2JlZX1937fr1K98QzIRS+e/P/gGlAFIHcntNTcP2TbWfNCE+E/u/55Emgi/kC31bF1lyxBoaBkG96Ve/rq4pnjRj/pFyXVQy65yiCeXPY6f0c9amuL16PCFqLyG4cRhXdpVSa43jvG/SxFEf2rChpkHuNiILF+bJNxbBZb3vORuwCsCHcsfG2qcb6qOnksNXQPpfRTwcPONW/EKYNFj/4nE58wTT5TqmH4IQP9aTXyseP2XG5KKSyIOsY3/B/v4kIqhJZmI+nHIGDDCK4x4R06tG8RcnlYyc+YmPLnhs7ty5esq55w6qI3JG79ql5RsL/+6IBoAZ8ArAH+OGzXV3H31UaCqz+gYzy50BI83AL0RwhZJ+pElYnEATVm/Ir5lLseb144sjP5M/xe2I4dLSU44dP7H8m6bZrCVNF0KB5LfNm8AhJ/qeyruR0VR8+5D8o0unloy8e+/evSxfVVZHo6ER48frciJXlMFAEn7BxyoAQSFBNTU1+0ePHHSLw2qWUrwUk12mjZDkEFdI/EkBQB4vHNRHgj+Pbwj0FbzPyEXhlan8VlZWqsLiso/u27/vFeOaKmiMENK9MnBz1np9V+iGo5ax48waUWC+NmvWuAOjRo0y8me6kyZN8gR//tixbnV1tdue8Ods57vJuFUAbYBauXJlS3396rVb6+sucljNw/R5CVng4AnJ8J5tHjLRhNpEBzGojKExeNyELX5NUcnMuRMmzzjt7l8tfoqJf2nIHAWmGdSh9XYUSPVdeANhGR1T4MQnZhVjxa+okLpszkllF08pPnYNzvkxEXTZ5stZX1yhgSj4gMqzgpfnsY/DEYAiePyoEc4ZxHQVBHwncnQqHMiDLIG3Iit52OLPMMb9l9ui5X+heRe4DoP/TvuHPJ4NkvALL9IhYUz8nsv8JgT/63nO+Jmf+PAlD4iQy9sfX9DFFUUgrpCUGahkFUAXIy/HAodG/bRg0IgpEJAf+Nn9yYawEZKwEPy5YuU9vgg8uiVOrrAd51Ow9sn71VjsADSR1sx35YWcyOUfWfD9oqJG78/GB7qQxxFr/2kVQPu4tIqtr19+cN26p/Zura/9iqLQicz0GDPjghxTEBMPT89PRKIM4FibSQQwFM1G0UqHQ6eMGZn/hRNPnP6mtJ+66ku4pzQQ8lsF0MNRvvzyi18+9eTIfxjiS1B0A+QfCxBUADx4eopAXKTlgpWlXygXeE3ymIovBH9zzKHLjx6qTtu6dfVKudiT7X0ys/V0ioBVAJ3Cc3iibCdlgjVsqf3LmFEF5ezQNw3THiIWRSAKwBMomaRCZE2fI8DMxMxEIXX7uFFDpp958szF5eXl3nZfxkYalHES11LnCKjOk21qZwjIG4OG+uhN4SEUIUX3EBHuo4woAY8IBkrAwLG2DxFQjNd6BYMKRxREviYrvlzyCfVhEwOmKqsA+mCot6xZ8+qOrWuucAfxTHbUqg6qFEXgUwdZbHSnCDA94zC/Jy88/tLRQ9Uu+e/kqvH+Xsr09YovdQ4EUgOhk5nq4+sb19RCEZyglboMe9S3sPpL0/6uAHtWEpI4S91DQBSmZqV2KcVXDsk/+uwtW+oekx/nkN2XCL98xGSFv3tgtpfLKoD2UOllXOmk0X8ZPGj4RFJOJTO3tKnOVwIyuYXaJNugjwCw2+8o/sGwwSMnTSoZdae8ifHTfNcKv4/EkblWARwZbp2WWr58eWzDhmf37Nha9+2wM2gqVrD7MZlTy/iCL8rA96emD3A/NwKzJ5y88Bkjj83/RjS6fJ9gOsBBSUv3rQJIC6yHKt28+aUtDVvqFjohNZ+Y1yJFBF4EH17Pil/ihLyIgfqAkmxh4o3K4cs/+fEPnFX/yqpV2OofyDQeA6k9qwAyNNqXf/QDj3zq8kvLcZb9Gpp8A8QgEXoheMkPi3+gkYbwHyTiqm1b66Z84mMfuN9u7SkjxiqAjMBMJBNaaGt93c2DwqFyiPttaFqEXghez6b6vYh++2BNBoT+GaXU75yjw2MnTxx5M8IeVuJaSj8CVgGkH+PDWti4sWZnw5boNSpvEBQBP4a3BQzyvh2Aa4x8ZQw6rGDAI5iZmA8n9AfCTknS5JK37WF+hkPqlKGD9RX1q1a9Y8/5mR9gqwAyj3myRfnfjKZMHHU2Kz4PciO/RiRpTFpEhhhPQ+qQQEliTwjKpCfZjygvc+f8oQ9t6tVESr1FrD43YjDP3bap9oVoNNrcJlPWggOtYasAsjzisurNOaX8//JCg8sU8SKw00jEMSgBgsHOwMWOQLbLCEEZpCoEZkZk3IqwtyVJkbhUV/zpJBH4VmS8td5rEgd913Wcm9UQNXV7ffTnVvA9WLL6UFlt3TbuISAftGzatHL36NEFPzJ5znTl0C+RYIyrtTEMJcDe8YAhS0JI65H1lUCPCh1BZnNIH3n8+u1qxGuHHswb5Ex9bVPd/zTU1b11BNXbImlAwCqANIB6pFXilVfLjo2127bVRz8HqT9LNenHucnVqllrxzU4ExiSAUulnrTlC2RPynQ3r9TdHmnmNUrR+17dFF2wZV3N5u7WZ/NlBgGZS5lpybbSIwQaGtY+3rBr/Xu4RX8Wx4F3SKM49gPww4MLNWO8VVYGEMrCi8vGwxd6aTt1d4LdQCO01bWf+filM7Zviv5T0oNOA5E/mT8Dsd850+eGtzbc7RQUTIYw/Y9hbjTeaQDS7+mAuBKQzqQOJDP23BLZhpgPxTOzd2PfJkuvguANdZL8OMdtBc7gsaefPOP78uqzV5XawmlFIHXepLUhW/mRI1Bfv+qdrQ1rblaDQzO0oiUuszZETYbZeBuDRNUymMzshZjjrhdo82DuOK1N1m4HwYtLTM+Qw+VHFdB1cqchdxvdrsBmzAoCMmey0rBttOcIyBm6oT66QBWEzqM8ZzMpFuNVJIpAPIzNgT+oSJQoj3y/73qRvXwY6BGQIeaNFDKfDpeMPqthY90Ge7vfS2AzWNyfKxls0jbVWwS2rX35/7ZtWB1x8sJfoDxnPxQBQRC9awKpW87l/sCKwAtJfFuSfG3j2gv7dSXT5As+kCF3r1Hm2mNGOLO3b4zeU798+cFknhzzDFR2DxvbgQpELvZ7y/pVPxk8Iq+EQ6EfekKucEHAcZL+pA4uM2OhZon2qLvC72XGQ3YWQthgxAxRCxHfNSx/ZOGOzWtulV9OJmtyEoHUOZKTHRjoTK9fufKN0PhjrqW8vBPwyu3vpHAJBx3gHwkEH+a44IvQ+yTx3SFvguDGgXHbYIyLIrGXoEnObNiy5jPt/X0+MlibQwh445tD/FpW20FAtt7bX1m16tX6unN0KLSQmbeSEpElLNbkvS4UwZei4qaSxHVNmow2m4n0p7dvW3/K9vo1z3RdxubIBQSsAsiFUeoBjzs21Cwdc2x+hJS6HkrgAO4GkkpAa00i/H51UBS+t13XwVsG5DmIOr7rDqVTGho2yBeK7ebN5ciBzLsayJ3vr31fuXLlgYZNq789OC+/BNv130LsWyD8kH3jKQB4uuq6geAbpXgZF4TLtm1b980d69fLbxh0Vc6m5xgCVgHk2ID1hN3161e+cdrJkU9iIZ+rST8DJeApAKkDAi5OW5LdgoHSWO2wM2fz5toL69euqm+byYb7DwJWAfSfsWy3J/IxzvYta1e8vv2V07TRl7tktktGUQAgWeklKAQ/7SFW144fN/xd9fU1z0qkpf6NgFUA/Xt8W/Vu12sb7w3T8GnM/F2Q/6LAIBOEn39sxo0Y27Cl9tYVK1Y0Im5A2IHeyf8PAAD//zMGniwAAAAGSURBVAMAzHL9PFPxZZkAAAAASUVORK5CYII="/>
+</svg>
\ No newline at end of file

From 8942b50872ba1cbda3188b008a64f1f358f32892 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Thu, 9 Oct 2025 17:33:57 +1100
Subject: [PATCH 094/298] fix: allow unhanger to unhang dormant workspaces
 (#20229)

---
 coderd/database/dbauthz/dbauthz.go      |   9 ++-
 coderd/database/dbauthz/dbauthz_test.go |  35 +++++++-
 coderd/database/dbgen/dbgen.go          |   8 ++
 coderd/jobreaper/detector_test.go       | 102 ++++++++++++++++++++++++
 4 files changed, 149 insertions(+), 5 deletions(-)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index dae0755cb5236..6df0168612c87 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -274,10 +274,11 @@ var (
 				Identifier:  rbac.RoleIdentifier{Name: "jobreaper"},
 				DisplayName: "Job Reaper Daemon",
 				Site: rbac.Permissions(map[string][]policy.Action{
-					rbac.ResourceSystem.Type:          {policy.WildcardSymbol},
-					rbac.ResourceTemplate.Type:        {policy.ActionRead},
-					rbac.ResourceWorkspace.Type:       {policy.ActionRead, policy.ActionUpdate},
-					rbac.ResourceProvisionerJobs.Type: {policy.ActionRead, policy.ActionUpdate},
+					rbac.ResourceSystem.Type:           {policy.WildcardSymbol},
+					rbac.ResourceTemplate.Type:         {policy.ActionRead, policy.ActionUpdate},
+					rbac.ResourceWorkspace.Type:        {policy.ActionRead, policy.ActionUpdate},
+					rbac.ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionUpdate},
+					rbac.ResourceProvisionerJobs.Type:  {policy.ActionRead, policy.ActionUpdate},
 				}),
 				Org:  map[string][]rbac.Permission{},
 				User: []rbac.Permission{},
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 39350ad948ff0..19cac48cb4ac2 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -1639,10 +1639,43 @@ func (s *MethodTestSuite) TestUser() {
 }
 
 func (s *MethodTestSuite) TestWorkspace() {
+	// The Workspace object differs it's type based on whether it's dormant or
+	// not, which is why we have two tests for it. To ensure we are actually
+	// testing the correct RBAC objects, we also explicitly create the expected
+	// object here rather than passing in the model.
 	s.Run("GetWorkspaceByID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		ws := testutil.Fake(s.T(), faker, database.Workspace{})
+		ws.DormantAt = sql.NullTime{
+			Time:  time.Time{},
+			Valid: false,
+		}
+		// Ensure the RBAC is not the dormant type.
+		require.Equal(s.T(), rbac.ResourceWorkspace.Type, ws.RBACObject().Type)
+		dbm.EXPECT().GetWorkspaceByID(gomock.Any(), ws.ID).Return(ws, nil).AnyTimes()
+		// Explicitly create the expected object.
+		expected := rbac.ResourceWorkspace.WithID(ws.ID).
+			InOrg(ws.OrganizationID).
+			WithOwner(ws.OwnerID.String()).
+			WithGroupACL(ws.GroupACL.RBACACL()).
+			WithACLUserList(ws.UserACL.RBACACL())
+		check.Args(ws.ID).Asserts(expected, policy.ActionRead).Returns(ws)
+	}))
+	s.Run("DormantWorkspace/GetWorkspaceByID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		ws := testutil.Fake(s.T(), faker, database.Workspace{
+			DormantAt: sql.NullTime{
+				Time:  time.Now().Add(-time.Hour),
+				Valid: true,
+			},
+		})
+		// Ensure the RBAC changed automatically.
+		require.Equal(s.T(), rbac.ResourceWorkspaceDormant.Type, ws.RBACObject().Type)
 		dbm.EXPECT().GetWorkspaceByID(gomock.Any(), ws.ID).Return(ws, nil).AnyTimes()
-		check.Args(ws.ID).Asserts(ws, policy.ActionRead).Returns(ws)
+		// Explicitly create the expected object.
+		expected := rbac.ResourceWorkspaceDormant.
+			WithID(ws.ID).
+			InOrg(ws.OrganizationID).
+			WithOwner(ws.OwnerID.String())
+		check.Args(ws.ID).Asserts(expected, policy.ActionRead).Returns(ws)
 	}))
 	s.Run("GetWorkspaceByResourceID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		ws := testutil.Fake(s.T(), faker, database.Workspace{})
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index c2042e687f607..f0e5b58d1bc85 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -420,6 +420,14 @@ func Workspace(t testing.TB, db database.Store, orig database.WorkspaceTable) da
 		require.NoError(t, err, "set workspace as deleted")
 		workspace.Deleted = true
 	}
+	if orig.DormantAt.Valid {
+		_, err = db.UpdateWorkspaceDormantDeletingAt(genCtx, database.UpdateWorkspaceDormantDeletingAtParams{
+			ID:        workspace.ID,
+			DormantAt: orig.DormantAt,
+		})
+		require.NoError(t, err, "set workspace as dormant")
+		workspace.DormantAt = orig.DormantAt
+	}
 	return workspace
 }
 
diff --git a/coderd/jobreaper/detector_test.go b/coderd/jobreaper/detector_test.go
index 4078f92c03a36..9d3b7054fcc3c 100644
--- a/coderd/jobreaper/detector_test.go
+++ b/coderd/jobreaper/detector_test.go
@@ -533,6 +533,108 @@ func TestDetectorPendingWorkspaceBuildNoOverrideStateIfNoExistingBuild(t *testin
 	detector.Wait()
 }
 
+// TestDetectorWorkspaceBuildForDormantWorkspace ensures that the jobreaper has
+// enough permissions to fix dormant workspaces.
+//
+// Dormant workspaces are treated as rbac.ResourceWorkspaceDormant rather than
+// rbac.ResourceWorkspace, which resulted in a bug where the jobreaper would
+// be able to see but not fix dormant workspaces.
+func TestDetectorWorkspaceBuildForDormantWorkspace(t *testing.T) {
+	t.Parallel()
+
+	var (
+		ctx        = testutil.Context(t, testutil.WaitLong)
+		db, pubsub = dbtestutil.NewDB(t)
+		log        = testutil.Logger(t)
+		tickCh     = make(chan time.Time)
+		statsCh    = make(chan jobreaper.Stats)
+	)
+
+	var (
+		now       = time.Now()
+		tenMinAgo = now.Add(-time.Minute * 10)
+		sixMinAgo = now.Add(-time.Minute * 6)
+		org       = dbgen.Organization(t, db, database.Organization{})
+		user      = dbgen.User(t, db, database.User{})
+		file      = dbgen.File(t, db, database.File{})
+		template  = dbgen.Template(t, db, database.Template{
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+		})
+		templateVersion = dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			OrganizationID: org.ID,
+			TemplateID: uuid.NullUUID{
+				UUID:  template.ID,
+				Valid: true,
+			},
+			CreatedBy: user.ID,
+		})
+		workspace = dbgen.Workspace(t, db, database.WorkspaceTable{
+			OwnerID:        user.ID,
+			OrganizationID: org.ID,
+			TemplateID:     template.ID,
+			DormantAt: sql.NullTime{
+				Time:  now.Add(-time.Hour),
+				Valid: true,
+			},
+		})
+
+		// First build.
+		expectedWorkspaceBuildState = []byte(`{"dean":"cool","colin":"also cool"}`)
+		currentWorkspaceBuildJob    = dbgen.ProvisionerJob(t, db, pubsub, database.ProvisionerJob{
+			CreatedAt: tenMinAgo,
+			UpdatedAt: sixMinAgo,
+			StartedAt: sql.NullTime{
+				Time:  tenMinAgo,
+				Valid: true,
+			},
+			OrganizationID: org.ID,
+			InitiatorID:    user.ID,
+			Provisioner:    database.ProvisionerTypeEcho,
+			StorageMethod:  database.ProvisionerStorageMethodFile,
+			FileID:         file.ID,
+			Type:           database.ProvisionerJobTypeWorkspaceBuild,
+			Input:          []byte("{}"),
+		})
+		_ = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+			WorkspaceID:       workspace.ID,
+			TemplateVersionID: templateVersion.ID,
+			BuildNumber:       1,
+			JobID:             currentWorkspaceBuildJob.ID,
+			// Should not be overridden.
+			ProvisionerState: expectedWorkspaceBuildState,
+		})
+	)
+
+	t.Log("current job ID: ", currentWorkspaceBuildJob.ID)
+
+	// Ensure the RBAC is the dormant type to ensure we're testing the right
+	// thing.
+	require.Equal(t, rbac.ResourceWorkspaceDormant.Type, workspace.RBACObject().Type)
+
+	detector := jobreaper.New(ctx, wrapDBAuthz(db, log), pubsub, log, tickCh).WithStatsChannel(statsCh)
+	detector.Start()
+	tickCh <- now
+
+	stats := <-statsCh
+	require.NoError(t, stats.Error)
+	require.Len(t, stats.TerminatedJobIDs, 1)
+	require.Equal(t, currentWorkspaceBuildJob.ID, stats.TerminatedJobIDs[0])
+
+	// Check that the current provisioner job was updated.
+	job, err := db.GetProvisionerJobByID(ctx, currentWorkspaceBuildJob.ID)
+	require.NoError(t, err)
+	require.WithinDuration(t, now, job.UpdatedAt, 30*time.Second)
+	require.True(t, job.CompletedAt.Valid)
+	require.WithinDuration(t, now, job.CompletedAt.Time, 30*time.Second)
+	require.True(t, job.Error.Valid)
+	require.Contains(t, job.Error.String, "Build has been detected as hung")
+	require.False(t, job.ErrorCode.Valid)
+
+	detector.Close()
+	detector.Wait()
+}
+
 func TestDetectorHungOtherJobTypes(t *testing.T) {
 	t.Parallel()
 

From f31e6e09ba37334e62a3f46bf37efb4c265946d7 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Thu, 9 Oct 2025 10:42:01 +0100
Subject: [PATCH 095/298] chore(provisioner): support updated coder_ai_task
 resource (#20160)

Closes https://github.com/coder/internal/issues/978

- Introduce `CODER_TASK_ID` and `CODER_TASK_PROMPT` to the provisioner
environment
- Make use of new `app_id` field in provider, with a fallback to
`sidebar_app.id` for backwards compatibility

**For now** I've left the `taskPrompt` and `taskID` as a TODO as we do
not yet create these values.
---
 ...oder_provisioner_list_--output_json.golden |   2 +-
 .../provisionerdserver/provisionerdserver.go  |  61 +-
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 provisioner/terraform/provision.go            |   2 +
 provisioner/terraform/provision_test.go       |  56 +-
 provisioner/terraform/resources.go            |  18 +-
 provisioner/terraform/resources_test.go       |  22 -
 .../ai-tasks-missing-prompt.tfplan.dot        |  22 -
 .../ai-tasks-missing-prompt.tfplan.json       | 307 --------
 .../ai-tasks-missing-prompt.tfstate.dot       |  22 -
 .../ai-tasks-missing-prompt.tfstate.json      | 142 ----
 .../resources/ai-tasks-missing-prompt/main.tf |  23 -
 .../ai-tasks-multiple.tfplan.dot              |   3 -
 .../ai-tasks-multiple.tfplan.json             |  84 +--
 .../ai-tasks-multiple.tfstate.dot             |   3 -
 .../ai-tasks-multiple.tfstate.json            |  45 +-
 .../resources/ai-tasks-multiple/main.tf       |  11 +-
 provisionerd/proto/version.go                 |   6 +-
 provisionersdk/proto/provisioner.pb.go        | 683 +++++++++---------
 provisionersdk/proto/provisioner.proto        |   5 +-
 site/e2e/provisionerGenerated.ts              |  14 +-
 22 files changed, 482 insertions(+), 1055 deletions(-)
 delete mode 100644 provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.dot
 delete mode 100644 provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.json
 delete mode 100644 provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.dot
 delete mode 100644 provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.json
 delete mode 100644 provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/main.tf

diff --git a/cli/testdata/coder_provisioner_list_--output_json.golden b/cli/testdata/coder_provisioner_list_--output_json.golden
index ad25a3ec48549..32de8cbd857f4 100644
--- a/cli/testdata/coder_provisioner_list_--output_json.golden
+++ b/cli/testdata/coder_provisioner_list_--output_json.golden
@@ -7,7 +7,7 @@
     "last_seen_at": "====[timestamp]=====",
     "name": "test-daemon",
     "version": "v0.0.0-devel",
-    "api_version": "1.10",
+    "api_version": "1.11",
     "provisioners": [
       "echo"
     ],
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
index 190be34a7ab5a..f8d361f5373ea 100644
--- a/coderd/provisionerdserver/provisionerdserver.go
+++ b/coderd/provisionerdserver/provisionerdserver.go
@@ -597,6 +597,14 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 			return nil, failJob(fmt.Sprintf("get workspace build parameters: %s", err))
 		}
 
+		// TODO(DanielleMaywood):
+		// Plumb a task prompt into this when we have the new data-model ready
+		var taskPrompt string
+
+		// TODO(DanielleMaywood):
+		// Plumb a task ID into this when we have the new data-model ready
+		var taskID string
+
 		dbExternalAuthProviders := []database.ExternalAuthProvider{}
 		err = json.Unmarshal(templateVersion.ExternalAuthProviders, &dbExternalAuthProviders)
 		if err != nil {
@@ -721,6 +729,8 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 					WorkspaceOwnerRbacRoles:       ownerRbacRoles,
 					RunningAgentAuthTokens:        runningAgentAuthTokens,
 					PrebuiltWorkspaceBuildStage:   input.PrebuiltWorkspaceBuildStage,
+					TaskId:                        taskID,
+					TaskPrompt:                    taskPrompt,
 				},
 				LogLevel: input.LogLevel,
 			},
@@ -1976,27 +1986,34 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			}
 		}
 
-		var sidebarAppID uuid.NullUUID
+		var taskAppID uuid.NullUUID
 		var hasAITask bool
-		var warnUnknownSidebarAppID bool
+		var warnUnknownTaskAppID bool
 		if tasks := jobType.WorkspaceBuild.GetAiTasks(); len(tasks) > 0 {
 			hasAITask = true
 			task := tasks[0]
-			if task == nil || task.GetSidebarApp() == nil || len(task.GetSidebarApp().GetId()) == 0 {
-				return xerrors.Errorf("update ai task: sidebar app is nil or empty")
+			if task == nil {
+				return xerrors.Errorf("update ai task: task is nil")
+			}
+
+			appID := task.GetAppId()
+			if appID == "" && task.GetSidebarApp() != nil {
+				appID = task.GetSidebarApp().GetId()
+			}
+			if appID == "" {
+				return xerrors.Errorf("update ai task: app id is empty")
 			}
 
-			sidebarTaskID := task.GetSidebarApp().GetId()
-			if !slices.Contains(appIDs, sidebarTaskID) {
-				warnUnknownSidebarAppID = true
+			if !slices.Contains(appIDs, appID) {
+				warnUnknownTaskAppID = true
 			}
 
-			id, err := uuid.Parse(task.GetSidebarApp().GetId())
+			id, err := uuid.Parse(appID)
 			if err != nil {
-				return xerrors.Errorf("parse sidebar app id: %w", err)
+				return xerrors.Errorf("parse app id: %w", err)
 			}
 
-			sidebarAppID = uuid.NullUUID{UUID: id, Valid: true}
+			taskAppID = uuid.NullUUID{UUID: id, Valid: true}
 		}
 
 		// This is a hacky workaround for the issue with tasks 'disappearing' on stop:
@@ -2008,19 +2025,19 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 				BuildNumber: workspaceBuild.BuildNumber - 1,
 			}); err == nil {
 				hasAITask = prevBuild.HasAITask.Bool
-				sidebarAppID = prevBuild.AITaskSidebarAppID
-				warnUnknownSidebarAppID = false
-				s.Logger.Debug(ctx, "task workaround: reused has_ai_task and sidebar_app_id from previous build to keep track of task",
+				taskAppID = prevBuild.AITaskSidebarAppID
+				warnUnknownTaskAppID = false
+				s.Logger.Debug(ctx, "task workaround: reused has_ai_task and app_id from previous build to keep track of task",
 					slog.F("job_id", job.ID.String()),
 					slog.F("build_number", prevBuild.BuildNumber),
 					slog.F("workspace_id", workspace.ID),
 					slog.F("workspace_build_id", workspaceBuild.ID),
 					slog.F("transition", string(workspaceBuild.Transition)),
-					slog.F("sidebar_app_id", sidebarAppID.UUID),
+					slog.F("sidebar_app_id", taskAppID.UUID),
 					slog.F("has_ai_task", hasAITask),
 				)
 			} else {
-				s.Logger.Error(ctx, "task workaround: tracking via has_ai_task and sidebar_app from previous build failed",
+				s.Logger.Error(ctx, "task workaround: tracking via has_ai_task and app_id from previous build failed",
 					slog.Error(err),
 					slog.F("job_id", job.ID.String()),
 					slog.F("workspace_id", workspace.ID),
@@ -2030,14 +2047,14 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			}
 		}
 
-		if warnUnknownSidebarAppID {
+		if warnUnknownTaskAppID {
 			// Ref: https://github.com/coder/coder/issues/18776
 			// This can happen for a number of reasons:
 			// 1. Misconfigured template
 			// 2. Count=0 on the agent due to stop transition, meaning the associated coder_app was not inserted.
 			// Failing the build at this point is not ideal, so log a warning instead.
-			s.Logger.Warn(ctx, "unknown ai_task_sidebar_app_id",
-				slog.F("ai_task_sidebar_app_id", sidebarAppID.UUID.String()),
+			s.Logger.Warn(ctx, "unknown ai_task_app_id",
+				slog.F("ai_task_app_id", taskAppID.UUID.String()),
 				slog.F("job_id", job.ID.String()),
 				slog.F("workspace_id", workspace.ID),
 				slog.F("workspace_build_id", workspaceBuild.ID),
@@ -2051,13 +2068,13 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 				Level:     []database.LogLevel{database.LogLevelWarn, database.LogLevelWarn, database.LogLevelWarn, database.LogLevelWarn},
 				Stage:     []string{"Cleaning Up", "Cleaning Up", "Cleaning Up", "Cleaning Up"},
 				Output: []string{
-					fmt.Sprintf("Unknown ai_task_sidebar_app_id %q. This workspace will be unable to run AI tasks. This may be due to a template configuration issue, please check with the template author.", sidebarAppID.UUID.String()),
+					fmt.Sprintf("Unknown ai_task_app_id %q. This workspace will be unable to run AI tasks. This may be due to a template configuration issue, please check with the template author.", taskAppID.UUID.String()),
 					"Template author: double-check the following:",
 					"  - You have associated the coder_ai_task with a valid coder_app in your template (ref: https://registry.terraform.io/providers/coder/coder/latest/docs/resources/ai_task).",
 					"  - You have associated the coder_agent with at least one other compute resource. Agents with no other associated resources are not inserted into the database.",
 				},
 			}); err != nil {
-				s.Logger.Error(ctx, "insert provisioner job log for ai task sidebar app id warning",
+				s.Logger.Error(ctx, "insert provisioner job log for ai task app id warning",
 					slog.F("job_id", jobID),
 					slog.F("workspace_id", workspace.ID),
 					slog.F("workspace_build_id", workspaceBuild.ID),
@@ -2066,7 +2083,7 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			}
 			// Important: reset hasAITask and sidebarAppID so that we don't run into a fk constraint violation.
 			hasAITask = false
-			sidebarAppID = uuid.NullUUID{}
+			taskAppID = uuid.NullUUID{}
 		}
 
 		if hasAITask && workspaceBuild.Transition == database.WorkspaceTransitionStart {
@@ -2103,7 +2120,7 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 				Bool:  hasExternalAgent,
 				Valid: true,
 			},
-			SidebarAppID: sidebarAppID,
+			SidebarAppID: taskAppID,
 			UpdatedAt:    now,
 		}); err != nil {
 			return xerrors.Errorf("update workspace build ai tasks and external agent flag: %w", err)
diff --git a/go.mod b/go.mod
index f5d8227f9a9c1..95308d48ff94c 100644
--- a/go.mod
+++ b/go.mod
@@ -101,7 +101,7 @@ require (
 	github.com/coder/quartz v0.2.1
 	github.com/coder/retry v1.5.1
 	github.com/coder/serpent v0.10.0
-	github.com/coder/terraform-provider-coder/v2 v2.11.0
+	github.com/coder/terraform-provider-coder/v2 v2.12.0-pre0
 	github.com/coder/websocket v1.8.13
 	github.com/coder/wgtunnel v0.1.13-0.20240522110300-ade90dfb2da0
 	github.com/coreos/go-oidc/v3 v3.16.0
diff --git a/go.sum b/go.sum
index 193bb9536325b..5b137f059665f 100644
--- a/go.sum
+++ b/go.sum
@@ -948,8 +948,8 @@ github.com/coder/tailscale v1.1.1-0.20250829055706-6eafe0f9199e h1:9RKGKzGLHtTvV
 github.com/coder/tailscale v1.1.1-0.20250829055706-6eafe0f9199e/go.mod h1:jU9T1vEs+DOs8NtGp1F2PT0/TOGVwtg/JCCKYRgvMOs=
 github.com/coder/terraform-config-inspect v0.0.0-20250107175719-6d06d90c630e h1:JNLPDi2P73laR1oAclY6jWzAbucf70ASAvf5mh2cME0=
 github.com/coder/terraform-config-inspect v0.0.0-20250107175719-6d06d90c630e/go.mod h1:Gz/z9Hbn+4KSp8A2FBtNszfLSdT2Tn/uAKGuVqqWmDI=
-github.com/coder/terraform-provider-coder/v2 v2.11.0 h1:E9mjwCDHoKTp9agCmNQ5viky4dKrt0Gx0vDxsLEPRf0=
-github.com/coder/terraform-provider-coder/v2 v2.11.0/go.mod h1:q0cAdlM1cafFGQ8Vug5kwU+34S+wtJsqylxTjVXX+rw=
+github.com/coder/terraform-provider-coder/v2 v2.12.0-pre0 h1:Jcp/NCDfrYtsVlXOr4pEZ9EBtTbKTA/HeToIOI0nx4k=
+github.com/coder/terraform-provider-coder/v2 v2.12.0-pre0/go.mod h1:q0cAdlM1cafFGQ8Vug5kwU+34S+wtJsqylxTjVXX+rw=
 github.com/coder/trivy v0.0.0-20250807211036-0bb0acd620a8 h1:VYB/6cIIKsVkwXOAWbqpj4Ux+WwF/XTnRyvHcwfHZ7A=
 github.com/coder/trivy v0.0.0-20250807211036-0bb0acd620a8/go.mod h1:O73tP+UvJlI2GQZD060Jt0sf+6alKcGAgORh6sgB0+M=
 github.com/coder/websocket v1.8.13 h1:f3QZdXy7uGVz+4uCJy2nTZyM0yTBj8yANEHhqlXZ9FE=
diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
index 50648a4d3ef1e..c97a583af7c9f 100644
--- a/provisioner/terraform/provision.go
+++ b/provisioner/terraform/provision.go
@@ -266,6 +266,8 @@ func provisionEnv(
 		"CODER_WORKSPACE_TEMPLATE_NAME="+metadata.GetTemplateName(),
 		"CODER_WORKSPACE_TEMPLATE_VERSION="+metadata.GetTemplateVersion(),
 		"CODER_WORKSPACE_BUILD_ID="+metadata.GetWorkspaceBuildId(),
+		"CODER_TASK_ID="+metadata.GetTaskId(),
+		"CODER_TASK_PROMPT="+metadata.GetTaskPrompt(),
 	)
 	if metadata.GetPrebuiltWorkspaceBuildStage().IsPrebuild() {
 		env = append(env, provider.IsPrebuildEnvironmentVariable()+"=true")
diff --git a/provisioner/terraform/provision_test.go b/provisioner/terraform/provision_test.go
index 90a34e6d03a8c..bf85404265c98 100644
--- a/provisioner/terraform/provision_test.go
+++ b/provisioner/terraform/provision_test.go
@@ -1048,29 +1048,6 @@ func TestProvision(t *testing.T) {
 				}},
 			},
 		},
-		{
-			Name: "ai-task-required-prompt-param",
-			Files: map[string]string{
-				"main.tf": `terraform {
-					required_providers {
-					  coder = {
-						source  = "coder/coder"
-						version = ">= 2.7.0"
-					  }
-					}
-				}
-				resource "coder_ai_task" "a" {
-				  sidebar_app {
-					id = "7128be08-8722-44cb-bbe1-b5a391c4d94b" # fake ID, irrelevant here anyway but needed for validation
-				  }
-				}
-				`,
-			},
-			Request: &proto.PlanRequest{},
-			Response: &proto.PlanComplete{
-				Error: fmt.Sprintf("plan resources: coder_parameter named '%s' is required when 'coder_ai_task' resource is defined", provider.TaskPromptParameterName),
-			},
-		},
 		{
 			Name: "ai-task-multiple-allowed-in-plan",
 			Files: map[string]string{
@@ -1160,6 +1137,39 @@ func TestProvision(t *testing.T) {
 			},
 			SkipCacheProviders: true,
 		},
+		{
+			Name: "ai-task-app-id",
+			Files: map[string]string{
+				"main.tf": `terraform {
+					required_providers {
+						coder = {
+							source  = "coder/coder"
+							version = "= 2.12.0-pre0"
+						}
+					}
+				}
+				resource "coder_ai_task" "my-task" {
+				  app_id = "7128be08-8722-44cb-bbe1-b5a391c4d94b" # fake ID, irrelevant here anyway but needed for validation
+				}
+				`,
+			},
+			Response: &proto.PlanComplete{
+				Resources: []*proto.Resource{
+					{
+						Name: "my-task",
+						Type: "coder_ai_task",
+					},
+				},
+				AiTasks: []*proto.AITask{
+					{
+						Id:    "my-task",
+						AppId: "7128be08-8722-44cb-bbe1-b5a391c4d94b",
+					},
+				},
+				HasAiTasks: true,
+			},
+			SkipCacheProviders: true,
+		},
 	}
 
 	// Remove unused cache dirs before running tests.
diff --git a/provisioner/terraform/resources.go b/provisioner/terraform/resources.go
index 1b6c099038910..e94852fd6b5b9 100644
--- a/provisioner/terraform/resources.go
+++ b/provisioner/terraform/resources.go
@@ -4,7 +4,6 @@ import (
 	"context"
 	"fmt"
 	"math"
-	"slices"
 	"strings"
 
 	"github.com/awalterschulze/gographviz"
@@ -1023,14 +1022,11 @@ func ConvertState(ctx context.Context, modules []*tfjson.StateModule, rawGraph s
 			return nil, xerrors.Errorf("decode coder_ai_task attributes: %w", err)
 		}
 
-		if len(task.SidebarApp) < 1 {
-			return nil, xerrors.Errorf("coder_ai_task has no sidebar_app defined")
-		}
-
 		aiTasks = append(aiTasks, &proto.AITask{
-			Id: task.ID,
+			Id:    task.ID,
+			AppId: task.AppID,
 			SidebarApp: &proto.AITaskSidebarApp{
-				Id: task.SidebarApp[0].ID,
+				Id: task.AppID,
 			},
 		})
 	}
@@ -1066,14 +1062,6 @@ func ConvertState(ctx context.Context, modules []*tfjson.StateModule, rawGraph s
 	}
 
 	hasAITasks := hasAITaskResources(graph)
-	if hasAITasks {
-		hasPromptParam := slices.ContainsFunc(parameters, func(param *proto.RichParameter) bool {
-			return param.Name == provider.TaskPromptParameterName
-		})
-		if !hasPromptParam {
-			return nil, xerrors.Errorf("coder_parameter named '%s' is required when 'coder_ai_task' resource is defined", provider.TaskPromptParameterName)
-		}
-	}
 
 	return &State{
 		Resources:             resources,
diff --git a/provisioner/terraform/resources_test.go b/provisioner/terraform/resources_test.go
index 715055c00cad9..5158590aa88c0 100644
--- a/provisioner/terraform/resources_test.go
+++ b/provisioner/terraform/resources_test.go
@@ -16,8 +16,6 @@ import (
 	"github.com/stretchr/testify/require"
 	protobuf "google.golang.org/protobuf/proto"
 
-	"github.com/coder/terraform-provider-coder/v2/provider"
-
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
 
@@ -1528,26 +1526,6 @@ func TestAITasks(t *testing.T) {
 	t.Parallel()
 	ctx, logger := ctxAndLogger(t)
 
-	t.Run("Prompt parameter is required", func(t *testing.T) {
-		t.Parallel()
-
-		// nolint:dogsled
-		_, filename, _, _ := runtime.Caller(0)
-
-		dir := filepath.Join(filepath.Dir(filename), "testdata", "resources", "ai-tasks-missing-prompt")
-		tfPlanRaw, err := os.ReadFile(filepath.Join(dir, "ai-tasks-missing-prompt.tfplan.json"))
-		require.NoError(t, err)
-		var tfPlan tfjson.Plan
-		err = json.Unmarshal(tfPlanRaw, &tfPlan)
-		require.NoError(t, err)
-		tfPlanGraph, err := os.ReadFile(filepath.Join(dir, "ai-tasks-missing-prompt.tfplan.dot"))
-		require.NoError(t, err)
-
-		state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfPlan.PlannedValues.RootModule, tfPlan.PriorState.Values.RootModule}, string(tfPlanGraph), logger)
-		require.Nil(t, state)
-		require.ErrorContains(t, err, fmt.Sprintf("coder_parameter named '%s' is required when 'coder_ai_task' resource is defined", provider.TaskPromptParameterName))
-	})
-
 	t.Run("Multiple tasks can be defined", func(t *testing.T) {
 		t.Parallel()
 
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.dot b/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.dot
deleted file mode 100644
index 758e6c990ec1e..0000000000000
--- a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.dot
+++ /dev/null
@@ -1,22 +0,0 @@
-digraph {
-	compound = "true"
-	newrank = "true"
-	subgraph "root" {
-		"[root] coder_agent.main (expand)" [label = "coder_agent.main", shape = "box"]
-		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
-		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
-		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
-		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
-		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
-		"[root] coder_agent.main (expand)" -> "[root] data.coder_provisioner.me (expand)"
-		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.main (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
-		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
-	}
-}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.json b/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.json
deleted file mode 100644
index ad255c7db7624..0000000000000
--- a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfplan.json
+++ /dev/null
@@ -1,307 +0,0 @@
-{
-  "format_version": "1.2",
-  "terraform_version": "1.12.2",
-  "planned_values": {
-    "root_module": {
-      "resources": [
-        {
-          "address": "coder_agent.main",
-          "mode": "managed",
-          "type": "coder_agent",
-          "name": "main",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "api_key_scope": "all",
-            "arch": "amd64",
-            "auth": "token",
-            "connection_timeout": 120,
-            "dir": null,
-            "env": null,
-            "metadata": [],
-            "motd_file": null,
-            "order": null,
-            "os": "linux",
-            "resources_monitoring": [],
-            "shutdown_script": null,
-            "startup_script": null,
-            "startup_script_behavior": "non-blocking",
-            "troubleshooting_url": null
-          },
-          "sensitive_values": {
-            "display_apps": [],
-            "metadata": [],
-            "resources_monitoring": [],
-            "token": true
-          }
-        },
-        {
-          "address": "coder_ai_task.a",
-          "mode": "managed",
-          "type": "coder_ai_task",
-          "name": "a",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "sidebar_app": [
-              {
-                "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-              }
-            ]
-          },
-          "sensitive_values": {
-            "sidebar_app": [
-              {}
-            ]
-          }
-        }
-      ]
-    }
-  },
-  "resource_changes": [
-    {
-      "address": "coder_agent.main",
-      "mode": "managed",
-      "type": "coder_agent",
-      "name": "main",
-      "provider_name": "registry.terraform.io/coder/coder",
-      "change": {
-        "actions": [
-          "create"
-        ],
-        "before": null,
-        "after": {
-          "api_key_scope": "all",
-          "arch": "amd64",
-          "auth": "token",
-          "connection_timeout": 120,
-          "dir": null,
-          "env": null,
-          "metadata": [],
-          "motd_file": null,
-          "order": null,
-          "os": "linux",
-          "resources_monitoring": [],
-          "shutdown_script": null,
-          "startup_script": null,
-          "startup_script_behavior": "non-blocking",
-          "troubleshooting_url": null
-        },
-        "after_unknown": {
-          "display_apps": true,
-          "id": true,
-          "init_script": true,
-          "metadata": [],
-          "resources_monitoring": [],
-          "token": true
-        },
-        "before_sensitive": false,
-        "after_sensitive": {
-          "display_apps": [],
-          "metadata": [],
-          "resources_monitoring": [],
-          "token": true
-        }
-      }
-    },
-    {
-      "address": "coder_ai_task.a",
-      "mode": "managed",
-      "type": "coder_ai_task",
-      "name": "a",
-      "provider_name": "registry.terraform.io/coder/coder",
-      "change": {
-        "actions": [
-          "create"
-        ],
-        "before": null,
-        "after": {
-          "sidebar_app": [
-            {
-              "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-            }
-          ]
-        },
-        "after_unknown": {
-          "id": true,
-          "sidebar_app": [
-            {}
-          ]
-        },
-        "before_sensitive": false,
-        "after_sensitive": {
-          "sidebar_app": [
-            {}
-          ]
-        }
-      }
-    }
-  ],
-  "prior_state": {
-    "format_version": "1.0",
-    "terraform_version": "1.12.2",
-    "values": {
-      "root_module": {
-        "resources": [
-          {
-            "address": "data.coder_provisioner.me",
-            "mode": "data",
-            "type": "coder_provisioner",
-            "name": "me",
-            "provider_name": "registry.terraform.io/coder/coder",
-            "schema_version": 1,
-            "values": {
-              "arch": "amd64",
-              "id": "5a6ecb8b-fd26-4cfc-91b1-651d06bee98c",
-              "os": "linux"
-            },
-            "sensitive_values": {}
-          },
-          {
-            "address": "data.coder_workspace.me",
-            "mode": "data",
-            "type": "coder_workspace",
-            "name": "me",
-            "provider_name": "registry.terraform.io/coder/coder",
-            "schema_version": 1,
-            "values": {
-              "access_port": 443,
-              "access_url": "https://dev.coder.com/",
-              "id": "bf9ee323-4f3a-4d45-9841-2dcd6265e830",
-              "is_prebuild": false,
-              "is_prebuild_claim": false,
-              "name": "sebenza-nonix",
-              "prebuild_count": 0,
-              "start_count": 1,
-              "template_id": "",
-              "template_name": "",
-              "template_version": "",
-              "transition": "start"
-            },
-            "sensitive_values": {}
-          },
-          {
-            "address": "data.coder_workspace_owner.me",
-            "mode": "data",
-            "type": "coder_workspace_owner",
-            "name": "me",
-            "provider_name": "registry.terraform.io/coder/coder",
-            "schema_version": 0,
-            "values": {
-              "email": "default@example.com",
-              "full_name": "default",
-              "groups": [],
-              "id": "0b8cbfb8-3925-41fe-9f21-21b76d21edc7",
-              "login_type": null,
-              "name": "default",
-              "oidc_access_token": "",
-              "rbac_roles": [],
-              "session_token": "",
-              "ssh_private_key": "",
-              "ssh_public_key": ""
-            },
-            "sensitive_values": {
-              "groups": [],
-              "rbac_roles": [],
-              "ssh_private_key": true
-            }
-          }
-        ]
-      }
-    }
-  },
-  "configuration": {
-    "provider_config": {
-      "coder": {
-        "name": "coder",
-        "full_name": "registry.terraform.io/coder/coder",
-        "version_constraint": ">= 2.0.0"
-      }
-    },
-    "root_module": {
-      "resources": [
-        {
-          "address": "coder_agent.main",
-          "mode": "managed",
-          "type": "coder_agent",
-          "name": "main",
-          "provider_config_key": "coder",
-          "expressions": {
-            "arch": {
-              "references": [
-                "data.coder_provisioner.me.arch",
-                "data.coder_provisioner.me"
-              ]
-            },
-            "os": {
-              "references": [
-                "data.coder_provisioner.me.os",
-                "data.coder_provisioner.me"
-              ]
-            }
-          },
-          "schema_version": 1
-        },
-        {
-          "address": "coder_ai_task.a",
-          "mode": "managed",
-          "type": "coder_ai_task",
-          "name": "a",
-          "provider_config_key": "coder",
-          "expressions": {
-            "sidebar_app": [
-              {
-                "id": {
-                  "constant_value": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-                }
-              }
-            ]
-          },
-          "schema_version": 1
-        },
-        {
-          "address": "data.coder_provisioner.me",
-          "mode": "data",
-          "type": "coder_provisioner",
-          "name": "me",
-          "provider_config_key": "coder",
-          "schema_version": 1
-        },
-        {
-          "address": "data.coder_workspace.me",
-          "mode": "data",
-          "type": "coder_workspace",
-          "name": "me",
-          "provider_config_key": "coder",
-          "schema_version": 1
-        },
-        {
-          "address": "data.coder_workspace_owner.me",
-          "mode": "data",
-          "type": "coder_workspace_owner",
-          "name": "me",
-          "provider_config_key": "coder",
-          "schema_version": 0
-        }
-      ]
-    }
-  },
-  "relevant_attributes": [
-    {
-      "resource": "data.coder_provisioner.me",
-      "attribute": [
-        "arch"
-      ]
-    },
-    {
-      "resource": "data.coder_provisioner.me",
-      "attribute": [
-        "os"
-      ]
-    }
-  ],
-  "timestamp": "2025-06-19T14:30:00Z",
-  "applyable": true,
-  "complete": true,
-  "errored": false
-}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.dot b/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.dot
deleted file mode 100644
index 758e6c990ec1e..0000000000000
--- a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.dot
+++ /dev/null
@@ -1,22 +0,0 @@
-digraph {
-	compound = "true"
-	newrank = "true"
-	subgraph "root" {
-		"[root] coder_agent.main (expand)" [label = "coder_agent.main", shape = "box"]
-		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
-		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
-		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
-		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
-		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
-		"[root] coder_agent.main (expand)" -> "[root] data.coder_provisioner.me (expand)"
-		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_agent.main (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
-		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
-	}
-}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.json b/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.json
deleted file mode 100644
index 4d3affb7a31ed..0000000000000
--- a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/ai-tasks-missing-prompt.tfstate.json
+++ /dev/null
@@ -1,142 +0,0 @@
-{
-  "format_version": "1.0",
-  "terraform_version": "1.12.2",
-  "values": {
-    "root_module": {
-      "resources": [
-        {
-          "address": "data.coder_provisioner.me",
-          "mode": "data",
-          "type": "coder_provisioner",
-          "name": "me",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "arch": "amd64",
-            "id": "e838328b-8dc2-49d0-b16c-42d6375cfb34",
-            "os": "linux"
-          },
-          "sensitive_values": {}
-        },
-        {
-          "address": "data.coder_workspace.me",
-          "mode": "data",
-          "type": "coder_workspace",
-          "name": "me",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "access_port": 443,
-            "access_url": "https://dev.coder.com/",
-            "id": "6a64b978-bd81-424a-92e5-d4004296f420",
-            "is_prebuild": false,
-            "is_prebuild_claim": false,
-            "name": "sebenza-nonix",
-            "prebuild_count": 0,
-            "start_count": 1,
-            "template_id": "",
-            "template_name": "",
-            "template_version": "",
-            "transition": "start"
-          },
-          "sensitive_values": {}
-        },
-        {
-          "address": "data.coder_workspace_owner.me",
-          "mode": "data",
-          "type": "coder_workspace_owner",
-          "name": "me",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 0,
-          "values": {
-            "email": "default@example.com",
-            "full_name": "default",
-            "groups": [],
-            "id": "ffb2e99a-efa7-4fb9-bb2c-aa282bb636c9",
-            "login_type": null,
-            "name": "default",
-            "oidc_access_token": "",
-            "rbac_roles": [],
-            "session_token": "",
-            "ssh_private_key": "",
-            "ssh_public_key": ""
-          },
-          "sensitive_values": {
-            "groups": [],
-            "rbac_roles": [],
-            "ssh_private_key": true
-          }
-        },
-        {
-          "address": "coder_agent.main",
-          "mode": "managed",
-          "type": "coder_agent",
-          "name": "main",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "api_key_scope": "all",
-            "arch": "amd64",
-            "auth": "token",
-            "connection_timeout": 120,
-            "dir": null,
-            "display_apps": [
-              {
-                "port_forwarding_helper": true,
-                "ssh_helper": true,
-                "vscode": true,
-                "vscode_insiders": false,
-                "web_terminal": true
-              }
-            ],
-            "env": null,
-            "id": "0c95434c-9e4b-40aa-bd9b-2a0cc86f11af",
-            "init_script": "",
-            "metadata": [],
-            "motd_file": null,
-            "order": null,
-            "os": "linux",
-            "resources_monitoring": [],
-            "shutdown_script": null,
-            "startup_script": null,
-            "startup_script_behavior": "non-blocking",
-            "token": "ac32e23e-336a-4e63-a7a4-71ab85f16831",
-            "troubleshooting_url": null
-          },
-          "sensitive_values": {
-            "display_apps": [
-              {}
-            ],
-            "metadata": [],
-            "resources_monitoring": [],
-            "token": true
-          },
-          "depends_on": [
-            "data.coder_provisioner.me"
-          ]
-        },
-        {
-          "address": "coder_ai_task.a",
-          "mode": "managed",
-          "type": "coder_ai_task",
-          "name": "a",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "id": "b83734ee-765f-45db-a37b-a1e89414be5f",
-            "sidebar_app": [
-              {
-                "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-              }
-            ]
-          },
-          "sensitive_values": {
-            "sidebar_app": [
-              {}
-            ]
-          }
-        }
-      ]
-    }
-  }
-}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/main.tf b/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/main.tf
deleted file mode 100644
index 236baa1c9535b..0000000000000
--- a/provisioner/terraform/testdata/resources/ai-tasks-missing-prompt/main.tf
+++ /dev/null
@@ -1,23 +0,0 @@
-terraform {
-  required_providers {
-    coder = {
-      source  = "coder/coder"
-      version = ">= 2.0.0"
-    }
-  }
-}
-
-data "coder_provisioner" "me" {}
-data "coder_workspace" "me" {}
-data "coder_workspace_owner" "me" {}
-
-resource "coder_agent" "main" {
-  arch = data.coder_provisioner.me.arch
-  os   = data.coder_provisioner.me.os
-}
-
-resource "coder_ai_task" "a" {
-  sidebar_app {
-    id = "5ece4674-dd35-4f16-88c8-82e40e72e2fd" # fake ID to satisfy requirement, irrelevant otherwise
-  }
-}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.dot b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.dot
index 4e660599e7a9b..2c05504b42460 100644
--- a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.dot
+++ b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.dot
@@ -4,20 +4,17 @@ digraph {
 	subgraph "root" {
 		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
 		"[root] coder_ai_task.b (expand)" [label = "coder_ai_task.b", shape = "box"]
-		"[root] data.coder_parameter.prompt (expand)" [label = "data.coder_parameter.prompt", shape = "box"]
 		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
 		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
 		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
 		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
 		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] coder_ai_task.b (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_parameter.prompt (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.b (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_parameter.prompt (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_provisioner.me (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.json b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.json
index c9f8fded6c192..f83c8646d7ae3 100644
--- a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.json
+++ b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfplan.json
@@ -34,16 +34,11 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "sidebar_app": [
-              {
-                "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-              }
-            ]
+            "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+            "sidebar_app": []
           },
           "sensitive_values": {
-            "sidebar_app": [
-              {}
-            ]
+            "sidebar_app": []
           }
         }
       ]
@@ -70,7 +65,9 @@
           ]
         },
         "after_unknown": {
+          "app_id": true,
           "id": true,
+          "prompt": true,
           "sidebar_app": [
             {}
           ]
@@ -96,23 +93,17 @@
         ],
         "before": null,
         "after": {
-          "sidebar_app": [
-            {
-              "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-            }
-          ]
+          "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+          "sidebar_app": []
         },
         "after_unknown": {
           "id": true,
-          "sidebar_app": [
-            {}
-          ]
+          "prompt": true,
+          "sidebar_app": []
         },
         "before_sensitive": false,
         "after_sensitive": {
-          "sidebar_app": [
-            {}
-          ]
+          "sidebar_app": []
         }
       }
     }
@@ -123,35 +114,6 @@
     "values": {
       "root_module": {
         "resources": [
-          {
-            "address": "data.coder_parameter.prompt",
-            "mode": "data",
-            "type": "coder_parameter",
-            "name": "prompt",
-            "provider_name": "registry.terraform.io/coder/coder",
-            "schema_version": 1,
-            "values": {
-              "default": null,
-              "description": null,
-              "display_name": null,
-              "ephemeral": false,
-              "form_type": "input",
-              "icon": null,
-              "id": "f9502ef2-226e-49a6-8831-99a74f8415e7",
-              "mutable": false,
-              "name": "AI Prompt",
-              "option": null,
-              "optional": false,
-              "order": null,
-              "styling": "{}",
-              "type": "string",
-              "validation": [],
-              "value": ""
-            },
-            "sensitive_values": {
-              "validation": []
-            }
-          },
           {
             "address": "data.coder_provisioner.me",
             "mode": "data",
@@ -256,35 +218,15 @@
           "name": "b",
           "provider_config_key": "coder",
           "expressions": {
-            "sidebar_app": [
-              {
-                "id": {
-                  "constant_value": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-                }
-              }
-            ]
+            "app_id": {
+              "constant_value": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
+            }
           },
           "schema_version": 1,
           "count_expression": {
             "constant_value": 1
           }
         },
-        {
-          "address": "data.coder_parameter.prompt",
-          "mode": "data",
-          "type": "coder_parameter",
-          "name": "prompt",
-          "provider_config_key": "coder",
-          "expressions": {
-            "name": {
-              "constant_value": "AI Prompt"
-            },
-            "type": {
-              "constant_value": "string"
-            }
-          },
-          "schema_version": 1
-        },
         {
           "address": "data.coder_provisioner.me",
           "mode": "data",
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.dot b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.dot
index 4e660599e7a9b..2c05504b42460 100644
--- a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.dot
+++ b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.dot
@@ -4,20 +4,17 @@ digraph {
 	subgraph "root" {
 		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
 		"[root] coder_ai_task.b (expand)" [label = "coder_ai_task.b", shape = "box"]
-		"[root] data.coder_parameter.prompt (expand)" [label = "data.coder_parameter.prompt", shape = "box"]
 		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
 		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
 		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
 		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
 		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] coder_ai_task.b (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
-		"[root] data.coder_parameter.prompt (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.b (expand)"
-		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_parameter.prompt (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_provisioner.me (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
 		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.json b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.json
index 8eb9ccecd7636..d97cffd45725e 100644
--- a/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.json
+++ b/provisioner/terraform/testdata/resources/ai-tasks-multiple/ai-tasks-multiple.tfstate.json
@@ -4,35 +4,6 @@
   "values": {
     "root_module": {
       "resources": [
-        {
-          "address": "data.coder_parameter.prompt",
-          "mode": "data",
-          "type": "coder_parameter",
-          "name": "prompt",
-          "provider_name": "registry.terraform.io/coder/coder",
-          "schema_version": 1,
-          "values": {
-            "default": null,
-            "description": null,
-            "display_name": null,
-            "ephemeral": false,
-            "form_type": "input",
-            "icon": null,
-            "id": "d3c415c0-c6bc-42e3-806e-8c792a7e7b3b",
-            "mutable": false,
-            "name": "AI Prompt",
-            "option": null,
-            "optional": false,
-            "order": null,
-            "styling": "{}",
-            "type": "string",
-            "validation": [],
-            "value": ""
-          },
-          "sensitive_values": {
-            "validation": []
-          }
-        },
         {
           "address": "data.coder_provisioner.me",
           "mode": "data",
@@ -105,7 +76,9 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
+            "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
             "id": "89e6ab36-2e98-4d13-9b4c-69b7588b7e1d",
+            "prompt": "default",
             "sidebar_app": [
               {
                 "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
@@ -127,17 +100,13 @@
           "provider_name": "registry.terraform.io/coder/coder",
           "schema_version": 1,
           "values": {
-            "id": "d4643699-519d-44c8-a878-556789256cbd",
-            "sidebar_app": [
-              {
-                "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
-              }
-            ]
+            "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+            "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+            "prompt": "default",
+            "sidebar_app": []
           },
           "sensitive_values": {
-            "sidebar_app": [
-              {}
-            ]
+            "sidebar_app": []
           }
         }
       ]
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-multiple/main.tf b/provisioner/terraform/testdata/resources/ai-tasks-multiple/main.tf
index 6c15ee4dc5a69..805b16ab313d8 100644
--- a/provisioner/terraform/testdata/resources/ai-tasks-multiple/main.tf
+++ b/provisioner/terraform/testdata/resources/ai-tasks-multiple/main.tf
@@ -11,11 +11,6 @@ data "coder_provisioner" "me" {}
 data "coder_workspace" "me" {}
 data "coder_workspace_owner" "me" {}
 
-data "coder_parameter" "prompt" {
-  name = "AI Prompt"
-  type = "string"
-}
-
 resource "coder_ai_task" "a" {
   count = 1
   sidebar_app {
@@ -24,8 +19,6 @@ resource "coder_ai_task" "a" {
 }
 
 resource "coder_ai_task" "b" {
-  count = 1
-  sidebar_app {
-    id = "5ece4674-dd35-4f16-88c8-82e40e72e2fd" # fake ID to satisfy requirement, irrelevant otherwise
-  }
+  count  = 1
+  app_id = "5ece4674-dd35-4f16-88c8-82e40e72e2fd" # fake ID to satisfy requirement, irrelevant otherwise
 }
diff --git a/provisionerd/proto/version.go b/provisionerd/proto/version.go
index dfe38cff30b7b..a7ea326d0f466 100644
--- a/provisionerd/proto/version.go
+++ b/provisionerd/proto/version.go
@@ -53,9 +53,13 @@ import "github.com/coder/coder/v2/apiversion"
 //
 // API v1.10:
 //   - Added new field `tooltip` in `App`
+//
+// API v1.11:
+//   - Added new fields `task_id` and `task_prompt` to `Manifest`.
+//   - Added new field `app_id` to `AITask`
 const (
 	CurrentMajor = 1
-	CurrentMinor = 10
+	CurrentMinor = 11
 )
 
 // CurrentVersion is the current provisionerd API version.
diff --git a/provisionersdk/proto/provisioner.pb.go b/provisionersdk/proto/provisioner.pb.go
index 905ab583613c2..b884f5a21aca6 100644
--- a/provisionersdk/proto/provisioner.pb.go
+++ b/provisionersdk/proto/provisioner.pb.go
@@ -2860,7 +2860,8 @@ type AITask struct {
 	unknownFields protoimpl.UnknownFields
 
 	Id         string            `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
-	SidebarApp *AITaskSidebarApp `protobuf:"bytes,2,opt,name=sidebar_app,json=sidebarApp,proto3" json:"sidebar_app,omitempty"`
+	SidebarApp *AITaskSidebarApp `protobuf:"bytes,2,opt,name=sidebar_app,json=sidebarApp,proto3,oneof" json:"sidebar_app,omitempty"`
+	AppId      string            `protobuf:"bytes,3,opt,name=app_id,json=appId,proto3" json:"app_id,omitempty"`
 }
 
 func (x *AITask) Reset() {
@@ -2909,6 +2910,13 @@ func (x *AITask) GetSidebarApp() *AITaskSidebarApp {
 	return nil
 }
 
+func (x *AITask) GetAppId() string {
+	if x != nil {
+		return x.AppId
+	}
+	return ""
+}
+
 // Metadata is information about a workspace used in the execution of a build
 type Metadata struct {
 	state         protoimpl.MessageState
@@ -2936,6 +2944,8 @@ type Metadata struct {
 	WorkspaceOwnerRbacRoles       []*Role                     `protobuf:"bytes,19,rep,name=workspace_owner_rbac_roles,json=workspaceOwnerRbacRoles,proto3" json:"workspace_owner_rbac_roles,omitempty"`
 	PrebuiltWorkspaceBuildStage   PrebuiltWorkspaceBuildStage `protobuf:"varint,20,opt,name=prebuilt_workspace_build_stage,json=prebuiltWorkspaceBuildStage,proto3,enum=provisioner.PrebuiltWorkspaceBuildStage" json:"prebuilt_workspace_build_stage,omitempty"` // Indicates that a prebuilt workspace is being built.
 	RunningAgentAuthTokens        []*RunningAgentAuthToken    `protobuf:"bytes,21,rep,name=running_agent_auth_tokens,json=runningAgentAuthTokens,proto3" json:"running_agent_auth_tokens,omitempty"`
+	TaskId                        string                      `protobuf:"bytes,22,opt,name=task_id,json=taskId,proto3" json:"task_id,omitempty"`
+	TaskPrompt                    string                      `protobuf:"bytes,23,opt,name=task_prompt,json=taskPrompt,proto3" json:"task_prompt,omitempty"`
 }
 
 func (x *Metadata) Reset() {
@@ -3117,6 +3127,20 @@ func (x *Metadata) GetRunningAgentAuthTokens() []*RunningAgentAuthToken {
 	return nil
 }
 
+func (x *Metadata) GetTaskId() string {
+	if x != nil {
+		return x.TaskId
+	}
+	return ""
+}
+
+func (x *Metadata) GetTaskPrompt() string {
+	if x != nil {
+		return x.TaskPrompt
+	}
+	return ""
+}
+
 // Config represents execution configuration shared by all subsequent requests in the Session
 type Config struct {
 	state         protoimpl.MessageState
@@ -4734,334 +4758,340 @@ var file_provisionersdk_proto_provisioner_proto_rawDesc = []byte{
 	0x05, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x74, 0x6f,
 	0x6b, 0x65, 0x6e, 0x22, 0x22, 0x0a, 0x10, 0x41, 0x49, 0x54, 0x61, 0x73, 0x6b, 0x53, 0x69, 0x64,
 	0x65, 0x62, 0x61, 0x72, 0x41, 0x70, 0x70, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x58, 0x0a, 0x06, 0x41, 0x49, 0x54, 0x61, 0x73,
-	0x6b, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69,
-	0x64, 0x12, 0x3e, 0x0a, 0x0b, 0x73, 0x69, 0x64, 0x65, 0x62, 0x61, 0x72, 0x5f, 0x61, 0x70, 0x70,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x49, 0x54, 0x61, 0x73, 0x6b, 0x53, 0x69, 0x64, 0x65, 0x62,
-	0x61, 0x72, 0x41, 0x70, 0x70, 0x52, 0x0a, 0x73, 0x69, 0x64, 0x65, 0x62, 0x61, 0x72, 0x41, 0x70,
-	0x70, 0x22, 0xca, 0x09, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1b,
-	0x0a, 0x09, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x08, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x53, 0x0a, 0x14, 0x77,
-	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74,
-	0x69, 0x6f, 0x6e, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x77, 0x6f, 0x72,
-	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e,
-	0x12, 0x25, 0x0a, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6e, 0x61,
-	0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x77, 0x6f, 0x72, 0x6b, 0x73,
-	0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72,
-	0x12, 0x21, 0x0a, 0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64,
-	0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x49, 0x64, 0x12, 0x2c, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x10, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x49,
-	0x64, 0x12, 0x32, 0x0a, 0x15, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f,
-	0x77, 0x6e, 0x65, 0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x13, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72,
-	0x45, 0x6d, 0x61, 0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x65,
-	0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x74, 0x65,
-	0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x0f, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x65,
-	0x72, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x48, 0x0a, 0x21, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x61, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x1d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72,
-	0x4f, 0x69, 0x64, 0x63, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12,
-	0x41, 0x0a, 0x1d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x5f, 0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e,
-	0x18, 0x0b, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
-	0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x69,
-	0x64, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74,
-	0x65, 0x49, 0x64, 0x12, 0x30, 0x0a, 0x14, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65,
-	0x72, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18,
-	0x0e, 0x20, 0x03, 0x28, 0x09, 0x52, 0x14, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x4f, 0x77, 0x6e, 0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x42, 0x0a, 0x1e, 0x77,
-	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x73,
-	0x73, 0x68, 0x5f, 0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x0f, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x22, 0x84, 0x01, 0x0a, 0x06, 0x41, 0x49, 0x54, 0x61,
+	0x73, 0x6b, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02,
+	0x69, 0x64, 0x12, 0x43, 0x0a, 0x0b, 0x73, 0x69, 0x64, 0x65, 0x62, 0x61, 0x72, 0x5f, 0x61, 0x70,
+	0x70, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x49, 0x54, 0x61, 0x73, 0x6b, 0x53, 0x69, 0x64, 0x65,
+	0x62, 0x61, 0x72, 0x41, 0x70, 0x70, 0x48, 0x00, 0x52, 0x0a, 0x73, 0x69, 0x64, 0x65, 0x62, 0x61,
+	0x72, 0x41, 0x70, 0x70, 0x88, 0x01, 0x01, 0x12, 0x15, 0x0a, 0x06, 0x61, 0x70, 0x70, 0x5f, 0x69,
+	0x64, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x61, 0x70, 0x70, 0x49, 0x64, 0x42, 0x0e,
+	0x0a, 0x0c, 0x5f, 0x73, 0x69, 0x64, 0x65, 0x62, 0x61, 0x72, 0x5f, 0x61, 0x70, 0x70, 0x22, 0x84,
+	0x0a, 0x0a, 0x08, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x1b, 0x0a, 0x09, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x63, 0x6f, 0x64, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x12, 0x53, 0x0a, 0x14, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x74, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x72,
+	0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x13, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x25, 0x0a,
+	0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18,
+	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x4e, 0x61, 0x6d, 0x65, 0x12, 0x27, 0x0a, 0x0f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63,
+	0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x77,
+	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x12, 0x21, 0x0a,
+	0x0c, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x05, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x49, 0x64,
+	0x12, 0x2c, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10, 0x77, 0x6f,
+	0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x49, 0x64, 0x12, 0x32,
+	0x0a, 0x15, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65,
+	0x72, 0x5f, 0x65, 0x6d, 0x61, 0x69, 0x6c, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x77,
+	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x45, 0x6d, 0x61,
+	0x69, 0x6c, 0x12, 0x23, 0x0a, 0x0d, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x6e,
+	0x61, 0x6d, 0x65, 0x18, 0x08, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0c, 0x74, 0x65, 0x6d, 0x70, 0x6c,
+	0x61, 0x74, 0x65, 0x4e, 0x61, 0x6d, 0x65, 0x12, 0x29, 0x0a, 0x10, 0x74, 0x65, 0x6d, 0x70, 0x6c,
+	0x61, 0x74, 0x65, 0x5f, 0x76, 0x65, 0x72, 0x73, 0x69, 0x6f, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x0f, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x65, 0x72, 0x73, 0x69,
+	0x6f, 0x6e, 0x12, 0x48, 0x0a, 0x21, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f,
+	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x6f, 0x69, 0x64, 0x63, 0x5f, 0x61, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1d, 0x77,
+	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x4f, 0x69, 0x64,
+	0x63, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12, 0x41, 0x0a, 0x1d,
+	0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f,
+	0x73, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x18, 0x0b, 0x20,
 	0x01, 0x28, 0x09, 0x52, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77,
-	0x6e, 0x65, 0x72, 0x53, 0x73, 0x68, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12,
-	0x44, 0x0a, 0x1f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e,
-	0x65, 0x72, 0x5f, 0x73, 0x73, 0x68, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b,
-	0x65, 0x79, 0x18, 0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1b, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
-	0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, 0x61,
-	0x74, 0x65, 0x4b, 0x65, 0x79, 0x12, 0x2c, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x11, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x10, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c,
-	0x64, 0x49, 0x64, 0x12, 0x3b, 0x0a, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
-	0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x12, 0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x4e, 0x0a, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77,
-	0x6e, 0x65, 0x72, 0x5f, 0x72, 0x62, 0x61, 0x63, 0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x13,
-	0x20, 0x03, 0x28, 0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x52, 0x6f, 0x6c, 0x65, 0x52, 0x17, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
-	0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x52, 0x62, 0x61, 0x63, 0x52, 0x6f, 0x6c, 0x65, 0x73,
-	0x12, 0x6d, 0x0a, 0x1e, 0x70, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x5f, 0x77, 0x6f, 0x72,
-	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x73, 0x74, 0x61,
-	0x67, 0x65, 0x18, 0x14, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x57,
-	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x53, 0x74, 0x61,
-	0x67, 0x65, 0x52, 0x1b, 0x70, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x57, 0x6f, 0x72, 0x6b,
-	0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x53, 0x74, 0x61, 0x67, 0x65, 0x12,
-	0x5d, 0x0a, 0x19, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x61, 0x67, 0x65, 0x6e, 0x74,
-	0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x15, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x22, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x2e, 0x52, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74,
-	0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x52, 0x16, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x41,
-	0x67, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x22, 0x8a,
-	0x01, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x36, 0x0a, 0x17, 0x74, 0x65, 0x6d,
-	0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x61, 0x72, 0x63,
-	0x68, 0x69, 0x76, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x15, 0x74, 0x65, 0x6d, 0x70,
-	0x6c, 0x61, 0x74, 0x65, 0x53, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x41, 0x72, 0x63, 0x68, 0x69, 0x76,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c,
-	0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x32, 0x0a, 0x15, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x22, 0x0e, 0x0a, 0x0c, 0x50,
-	0x61, 0x72, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0xa3, 0x02, 0x0a, 0x0d,
-	0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x14, 0x0a,
-	0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72,
-	0x72, 0x6f, 0x72, 0x12, 0x4c, 0x0a, 0x12, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f,
-	0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x65,
-	0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x11,
-	0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65,
-	0x73, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x64, 0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x0c, 0x52, 0x06, 0x72, 0x65, 0x61, 0x64, 0x6d, 0x65, 0x12, 0x54, 0x0a, 0x0e, 0x77, 0x6f, 0x72,
-	0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x74, 0x61, 0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x2e, 0x57, 0x6f,
-	0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x61, 0x67, 0x73, 0x1a,
-	0x40, 0x0a, 0x12, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x61, 0x67, 0x73,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38,
-	0x01, 0x22, 0xbe, 0x03, 0x0a, 0x0b, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
-	0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x53, 0x0a, 0x15, 0x72, 0x69, 0x63, 0x68, 0x5f, 0x70, 0x61, 0x72,
-	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20,
+	0x6e, 0x65, 0x72, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x12,
+	0x1f, 0x0a, 0x0b, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x69, 0x64, 0x18, 0x0c,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x49, 0x64,
+	0x12, 0x30, 0x0a, 0x14, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x5f, 0x6e, 0x61, 0x6d, 0x65, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x09, 0x52, 0x12,
+	0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72, 0x4e, 0x61,
+	0x6d, 0x65, 0x12, 0x34, 0x0a, 0x16, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f,
+	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x67, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x18, 0x0e, 0x20, 0x03,
+	0x28, 0x09, 0x52, 0x14, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e,
+	0x65, 0x72, 0x47, 0x72, 0x6f, 0x75, 0x70, 0x73, 0x12, 0x42, 0x0a, 0x1e, 0x77, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x73, 0x73, 0x68, 0x5f,
+	0x70, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x5f, 0x6b, 0x65, 0x79, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f, 0x77, 0x6e, 0x65, 0x72,
+	0x53, 0x73, 0x68, 0x50, 0x75, 0x62, 0x6c, 0x69, 0x63, 0x4b, 0x65, 0x79, 0x12, 0x44, 0x0a, 0x1f,
+	0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f,
+	0x73, 0x73, 0x68, 0x5f, 0x70, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x5f, 0x6b, 0x65, 0x79, 0x18,
+	0x10, 0x20, 0x01, 0x28, 0x09, 0x52, 0x1b, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x4f, 0x77, 0x6e, 0x65, 0x72, 0x53, 0x73, 0x68, 0x50, 0x72, 0x69, 0x76, 0x61, 0x74, 0x65, 0x4b,
+	0x65, 0x79, 0x12, 0x2c, 0x0a, 0x12, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f,
+	0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x69, 0x64, 0x18, 0x11, 0x20, 0x01, 0x28, 0x09, 0x52, 0x10,
+	0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x49, 0x64,
+	0x12, 0x3b, 0x0a, 0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x5f, 0x6c, 0x6f, 0x67, 0x69, 0x6e, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x12,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x17, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x69, 0x6e, 0x54, 0x79, 0x70, 0x65, 0x12, 0x4e, 0x0a,
+	0x1a, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x6f, 0x77, 0x6e, 0x65, 0x72,
+	0x5f, 0x72, 0x62, 0x61, 0x63, 0x5f, 0x72, 0x6f, 0x6c, 0x65, 0x73, 0x18, 0x13, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x11, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
+	0x52, 0x6f, 0x6c, 0x65, 0x52, 0x17, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x4f,
+	0x77, 0x6e, 0x65, 0x72, 0x52, 0x62, 0x61, 0x63, 0x52, 0x6f, 0x6c, 0x65, 0x73, 0x12, 0x6d, 0x0a,
+	0x1e, 0x70, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x5f, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x5f, 0x62, 0x75, 0x69, 0x6c, 0x64, 0x5f, 0x73, 0x74, 0x61, 0x67, 0x65, 0x18,
+	0x14, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x28, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x57, 0x6f, 0x72, 0x6b,
+	0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x53, 0x74, 0x61, 0x67, 0x65, 0x52,
+	0x1b, 0x70, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x53, 0x74, 0x61, 0x67, 0x65, 0x12, 0x5d, 0x0a, 0x19,
+	0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x5f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x5f, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x15, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x22, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x75,
+	0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x41, 0x75, 0x74, 0x68, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x52, 0x16, 0x72, 0x75, 0x6e, 0x6e, 0x69, 0x6e, 0x67, 0x41, 0x67, 0x65, 0x6e,
+	0x74, 0x41, 0x75, 0x74, 0x68, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x17, 0x0a, 0x07, 0x74,
+	0x61, 0x73, 0x6b, 0x5f, 0x69, 0x64, 0x18, 0x16, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x74, 0x61,
+	0x73, 0x6b, 0x49, 0x64, 0x12, 0x1f, 0x0a, 0x0b, 0x74, 0x61, 0x73, 0x6b, 0x5f, 0x70, 0x72, 0x6f,
+	0x6d, 0x70, 0x74, 0x18, 0x17, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0a, 0x74, 0x61, 0x73, 0x6b, 0x50,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x22, 0x8a, 0x01, 0x0a, 0x06, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x12, 0x36, 0x0a, 0x17, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x73, 0x6f, 0x75,
+	0x72, 0x63, 0x65, 0x5f, 0x61, 0x72, 0x63, 0x68, 0x69, 0x76, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x15, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x53, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x41, 0x72, 0x63, 0x68, 0x69, 0x76, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74,
+	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x32,
+	0x0a, 0x15, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x5f, 0x6c, 0x6f,
+	0x67, 0x5f, 0x6c, 0x65, 0x76, 0x65, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x13, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76,
+	0x65, 0x6c, 0x22, 0x0e, 0x0a, 0x0c, 0x50, 0x61, 0x72, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x22, 0xa3, 0x02, 0x0a, 0x0d, 0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d, 0x70,
+	0x6c, 0x65, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x4c, 0x0a, 0x12, 0x74, 0x65,
+	0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x5f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73,
+	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56, 0x61, 0x72,
+	0x69, 0x61, 0x62, 0x6c, 0x65, 0x52, 0x11, 0x74, 0x65, 0x6d, 0x70, 0x6c, 0x61, 0x74, 0x65, 0x56,
+	0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x73, 0x12, 0x16, 0x0a, 0x06, 0x72, 0x65, 0x61, 0x64,
+	0x6d, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x06, 0x72, 0x65, 0x61, 0x64, 0x6d, 0x65,
+	0x12, 0x54, 0x0a, 0x0e, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x5f, 0x74, 0x61,
+	0x67, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d, 0x70,
+	0x6c, 0x65, 0x74, 0x65, 0x2e, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x61,
+	0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0d, 0x77, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61,
+	0x63, 0x65, 0x54, 0x61, 0x67, 0x73, 0x1a, 0x40, 0x0a, 0x12, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70,
+	0x61, 0x63, 0x65, 0x54, 0x61, 0x67, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76,
+	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0xbe, 0x03, 0x0a, 0x0b, 0x50, 0x6c, 0x61,
+	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x53, 0x0a, 0x15, 0x72,
+	0x69, 0x63, 0x68, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f,
+	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72,
+	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x72, 0x69, 0x63,
+	0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73,
+	0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c,
+	0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65,
+	0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e, 0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56,
+	0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x59, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61,
+	0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
+	0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
+	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74,
+	0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72,
+	0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73,
+	0x12, 0x5b, 0x0a, 0x19, 0x70, 0x72, 0x65, 0x76, 0x69, 0x6f, 0x75, 0x73, 0x5f, 0x70, 0x61, 0x72,
+	0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x05, 0x20,
 	0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
 	0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56,
-	0x61, 0x6c, 0x75, 0x65, 0x52, 0x13, 0x72, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65,
-	0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x43, 0x0a, 0x0f, 0x76, 0x61, 0x72,
-	0x69, 0x61, 0x62, 0x6c, 0x65, 0x5f, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x2e, 0x56, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x0e,
-	0x76, 0x61, 0x72, 0x69, 0x61, 0x62, 0x6c, 0x65, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x59,
-	0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x21, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68,
-	0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x12, 0x5b, 0x0a, 0x19, 0x70, 0x72, 0x65,
-	0x76, 0x69, 0x6f, 0x75, 0x73, 0x5f, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x5f,
-	0x76, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1f, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50,
-	0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x52, 0x17, 0x70,
-	0x72, 0x65, 0x76, 0x69, 0x6f, 0x75, 0x73, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
-	0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x6f, 0x6d, 0x69, 0x74, 0x5f, 0x6d,
-	0x6f, 0x64, 0x75, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28,
-	0x08, 0x52, 0x0f, 0x6f, 0x6d, 0x69, 0x74, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x46, 0x69, 0x6c,
-	0x65, 0x73, 0x22, 0xc1, 0x05, 0x0a, 0x0c, 0x50, 0x6c, 0x61, 0x6e, 0x43, 0x6f, 0x6d, 0x70, 0x6c,
-	0x65, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3a,
-	0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0a,
-	0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x61, 0x0a, 0x17, 0x65, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72,
-	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e,
-	0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x65,
-	0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x12, 0x2d, 0x0a,
-	0x07, 0x74, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13,
-	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x69, 0x6d,
-	0x69, 0x6e, 0x67, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x2d, 0x0a, 0x07,
-	0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x52, 0x07, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x70,
-	0x72, 0x65, 0x73, 0x65, 0x74, 0x73, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x72, 0x65, 0x73, 0x65,
-	0x74, 0x52, 0x07, 0x70, 0x72, 0x65, 0x73, 0x65, 0x74, 0x73, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6c,
-	0x61, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x55,
-	0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x5f, 0x72, 0x65, 0x70, 0x6c, 0x61,
-	0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0a, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e,
-	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x52,
-	0x14, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65,
-	0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x21, 0x0a, 0x0c, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x5f,
-	0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0b, 0x6d, 0x6f, 0x64,
-	0x75, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12, 0x2a, 0x0a, 0x11, 0x6d, 0x6f, 0x64, 0x75,
-	0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x0c, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x0f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73,
-	0x48, 0x61, 0x73, 0x68, 0x12, 0x20, 0x0a, 0x0c, 0x68, 0x61, 0x73, 0x5f, 0x61, 0x69, 0x5f, 0x74,
-	0x61, 0x73, 0x6b, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0a, 0x68, 0x61, 0x73, 0x41,
-	0x69, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x12, 0x2e, 0x0a, 0x08, 0x61, 0x69, 0x5f, 0x74, 0x61, 0x73,
-	0x6b, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x49, 0x54, 0x61, 0x73, 0x6b, 0x52, 0x07, 0x61,
-	0x69, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x12, 0x2e, 0x0a, 0x13, 0x68, 0x61, 0x73, 0x5f, 0x65, 0x78,
-	0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0f, 0x20,
-	0x01, 0x28, 0x08, 0x52, 0x11, 0x68, 0x61, 0x73, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x41, 0x0a, 0x0c, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x31, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61,
-	0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x22, 0xee, 0x02, 0x0a, 0x0d, 0x41, 0x70,
-	0x70, 0x6c, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73,
-	0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75,
-	0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f,
-	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0a,
-	0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52,
-	0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0a, 0x70, 0x61,
-	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12, 0x61, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64,
-	0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c,
-	0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f,
-	0x75, 0x72, 0x63, 0x65, 0x52, 0x15, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75,
-	0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x74,
-	0x69, 0x6d, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x69, 0x6d, 0x69, 0x6e,
-	0x67, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x73, 0x12, 0x2e, 0x0a, 0x08, 0x61, 0x69,
-	0x5f, 0x74, 0x61, 0x73, 0x6b, 0x73, 0x18, 0x07, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x49, 0x54, 0x61, 0x73,
-	0x6b, 0x52, 0x07, 0x61, 0x69, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x22, 0xfa, 0x01, 0x0a, 0x06, 0x54,
-	0x69, 0x6d, 0x69, 0x6e, 0x67, 0x12, 0x30, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x2c, 0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x03, 0x65, 0x6e, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18,
-	0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a,
-	0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73,
-	0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1a, 0x0a, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
-	0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x12, 0x2e, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65,
-	0x18, 0x07, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69,
-	0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x53, 0x74, 0x61, 0x74, 0x65,
-	0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x22, 0x0f, 0x0a, 0x0d, 0x43, 0x61, 0x6e, 0x63, 0x65,
-	0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22, 0x8c, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x48, 0x00, 0x52, 0x06, 0x63, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x31, 0x0a, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01,
-	0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
-	0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52,
-	0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x12, 0x2e, 0x0a, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00,
-	0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x31, 0x0a, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18,
-	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x48, 0x00, 0x52, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x12, 0x34, 0x0a, 0x06, 0x63, 0x61, 0x6e,
-	0x63, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x06, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x42,
-	0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xc9, 0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x03, 0x6c, 0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
-	0x4c, 0x6f, 0x67, 0x48, 0x00, 0x52, 0x03, 0x6c, 0x6f, 0x67, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x61,
-	0x72, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
-	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d,
-	0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x12, 0x2f,
-	0x0a, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70,
-	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x43,
-	0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12,
-	0x32, 0x0a, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70,
-	0x6c, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x05, 0x61, 0x70,
-	0x70, 0x6c, 0x79, 0x12, 0x3a, 0x0a, 0x0b, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x75, 0x70, 0x6c, 0x6f,
-	0x61, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
-	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61,
-	0x64, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12,
-	0x3a, 0x0a, 0x0b, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x5f, 0x70, 0x69, 0x65, 0x63, 0x65, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x50, 0x69, 0x65, 0x63, 0x65, 0x48, 0x00, 0x52,
-	0x0a, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x50, 0x69, 0x65, 0x63, 0x65, 0x42, 0x06, 0x0a, 0x04, 0x74,
-	0x79, 0x70, 0x65, 0x22, 0x9c, 0x01, 0x0a, 0x0a, 0x44, 0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f,
-	0x61, 0x64, 0x12, 0x3c, 0x0a, 0x0b, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x5f, 0x74, 0x79, 0x70,
-	0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
-	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x44, 0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64,
-	0x54, 0x79, 0x70, 0x65, 0x52, 0x0a, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x54, 0x79, 0x70, 0x65,
-	0x12, 0x1b, 0x0a, 0x09, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0c, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61, 0x48, 0x61, 0x73, 0x68, 0x12, 0x1b, 0x0a,
-	0x09, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x73, 0x69, 0x7a, 0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03,
-	0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x53, 0x69, 0x7a, 0x65, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x68,
-	0x75, 0x6e, 0x6b, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x05, 0x52, 0x06, 0x63, 0x68, 0x75, 0x6e,
-	0x6b, 0x73, 0x22, 0x67, 0x0a, 0x0a, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x50, 0x69, 0x65, 0x63, 0x65,
-	0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x24, 0x0a, 0x0e, 0x66, 0x75, 0x6c, 0x6c, 0x5f, 0x64, 0x61, 0x74,
-	0x61, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0c, 0x66, 0x75,
-	0x6c, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x48, 0x61, 0x73, 0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x69,
-	0x65, 0x63, 0x65, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52,
-	0x0a, 0x70, 0x69, 0x65, 0x63, 0x65, 0x49, 0x6e, 0x64, 0x65, 0x78, 0x2a, 0xa8, 0x01, 0x0a, 0x11,
-	0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x46, 0x6f, 0x72, 0x6d, 0x54, 0x79, 0x70,
-	0x65, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45, 0x46, 0x41, 0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x0e,
-	0x0a, 0x0a, 0x46, 0x4f, 0x52, 0x4d, 0x5f, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x01, 0x12, 0x09,
-	0x0a, 0x05, 0x52, 0x41, 0x44, 0x49, 0x4f, 0x10, 0x02, 0x12, 0x0c, 0x0a, 0x08, 0x44, 0x52, 0x4f,
-	0x50, 0x44, 0x4f, 0x57, 0x4e, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x49, 0x4e, 0x50, 0x55, 0x54,
-	0x10, 0x04, 0x12, 0x0c, 0x0a, 0x08, 0x54, 0x45, 0x58, 0x54, 0x41, 0x52, 0x45, 0x41, 0x10, 0x05,
-	0x12, 0x0a, 0x0a, 0x06, 0x53, 0x4c, 0x49, 0x44, 0x45, 0x52, 0x10, 0x06, 0x12, 0x0c, 0x0a, 0x08,
-	0x43, 0x48, 0x45, 0x43, 0x4b, 0x42, 0x4f, 0x58, 0x10, 0x07, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x57,
-	0x49, 0x54, 0x43, 0x48, 0x10, 0x08, 0x12, 0x0d, 0x0a, 0x09, 0x54, 0x41, 0x47, 0x53, 0x45, 0x4c,
-	0x45, 0x43, 0x54, 0x10, 0x09, 0x12, 0x0f, 0x0a, 0x0b, 0x4d, 0x55, 0x4c, 0x54, 0x49, 0x53, 0x45,
-	0x4c, 0x45, 0x43, 0x54, 0x10, 0x0a, 0x2a, 0x3f, 0x0a, 0x08, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76,
-	0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41, 0x43, 0x45, 0x10, 0x00, 0x12, 0x09, 0x0a,
-	0x05, 0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x01, 0x12, 0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f,
-	0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x41, 0x52, 0x4e, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05,
-	0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x04, 0x2a, 0x3b, 0x0a, 0x0f, 0x41, 0x70, 0x70, 0x53, 0x68,
-	0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05, 0x4f, 0x57,
-	0x4e, 0x45, 0x52, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d, 0x41, 0x55, 0x54, 0x48, 0x45, 0x4e, 0x54,
-	0x49, 0x43, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x50, 0x55, 0x42, 0x4c,
-	0x49, 0x43, 0x10, 0x02, 0x2a, 0x35, 0x0a, 0x09, 0x41, 0x70, 0x70, 0x4f, 0x70, 0x65, 0x6e, 0x49,
-	0x6e, 0x12, 0x0e, 0x0a, 0x06, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57, 0x10, 0x00, 0x1a, 0x02, 0x08,
-	0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x4c, 0x49, 0x4d, 0x5f, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57,
-	0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x41, 0x42, 0x10, 0x02, 0x2a, 0x37, 0x0a, 0x13, 0x57,
-	0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54, 0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69,
-	0x6f, 0x6e, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x54, 0x41, 0x52, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a,
-	0x04, 0x53, 0x54, 0x4f, 0x50, 0x10, 0x01, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45, 0x53, 0x54, 0x52,
-	0x4f, 0x59, 0x10, 0x02, 0x2a, 0x3e, 0x0a, 0x1b, 0x50, 0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74,
-	0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x42, 0x75, 0x69, 0x6c, 0x64, 0x53, 0x74,
-	0x61, 0x67, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f, 0x4e, 0x45, 0x10, 0x00, 0x12, 0x0a, 0x0a,
-	0x06, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x43, 0x4c, 0x41,
-	0x49, 0x4d, 0x10, 0x02, 0x2a, 0x35, 0x0a, 0x0b, 0x54, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x53, 0x74,
-	0x61, 0x74, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x54, 0x41, 0x52, 0x54, 0x45, 0x44, 0x10, 0x00,
-	0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4f, 0x4d, 0x50, 0x4c, 0x45, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12,
-	0x0a, 0x0a, 0x06, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44, 0x10, 0x02, 0x2a, 0x47, 0x0a, 0x0e, 0x44,
-	0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a,
-	0x13, 0x55, 0x50, 0x4c, 0x4f, 0x41, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x4b,
-	0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x1c, 0x0a, 0x18, 0x55, 0x50, 0x4c, 0x4f, 0x41, 0x44,
-	0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x4f, 0x44, 0x55, 0x4c, 0x45, 0x5f, 0x46, 0x49, 0x4c,
-	0x45, 0x53, 0x10, 0x01, 0x32, 0x49, 0x0a, 0x0b, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
-	0x6e, 0x65, 0x72, 0x12, 0x3a, 0x0a, 0x07, 0x53, 0x65, 0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x14,
-	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
-	0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42,
-	0x30, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f,
-	0x64, 0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x70, 0x72, 0x6f,
-	0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x73, 0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x61, 0x6c, 0x75, 0x65, 0x52, 0x17, 0x70, 0x72, 0x65, 0x76, 0x69, 0x6f, 0x75, 0x73, 0x50, 0x61,
+	0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x56, 0x61, 0x6c, 0x75, 0x65, 0x73, 0x12, 0x2a, 0x0a,
+	0x11, 0x6f, 0x6d, 0x69, 0x74, 0x5f, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c,
+	0x65, 0x73, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x0f, 0x6f, 0x6d, 0x69, 0x74, 0x4d, 0x6f,
+	0x64, 0x75, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x22, 0xc1, 0x05, 0x0a, 0x0c, 0x50, 0x6c,
+	0x61, 0x6e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72,
+	0x72, 0x6f, 0x72, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72,
+	0x12, 0x33, 0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x02, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f,
+	0x75, 0x72, 0x63, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74,
+	0x65, 0x72, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61,
+	0x6d, 0x65, 0x74, 0x65, 0x72, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x73, 0x12, 0x61, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75,
+	0x74, 0x68, 0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x04, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x29, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72,
+	0x2e, 0x45, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f,
+	0x76, 0x69, 0x64, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x15, 0x65,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x73, 0x18,
+	0x06, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x54, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x69,
+	0x6e, 0x67, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x73, 0x18, 0x07,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x4d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x52, 0x07, 0x6d, 0x6f, 0x64, 0x75, 0x6c,
+	0x65, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x70, 0x72, 0x65, 0x73, 0x65, 0x74, 0x73, 0x18, 0x08, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x50, 0x72, 0x65, 0x73, 0x65, 0x74, 0x52, 0x07, 0x70, 0x72, 0x65, 0x73, 0x65, 0x74,
+	0x73, 0x12, 0x12, 0x0a, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0c, 0x52,
+	0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x55, 0x0a, 0x15, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63,
+	0x65, 0x5f, 0x72, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x18, 0x0a,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e,
+	0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x65, 0x70, 0x6c, 0x61,
+	0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x52, 0x14, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65,
+	0x52, 0x65, 0x70, 0x6c, 0x61, 0x63, 0x65, 0x6d, 0x65, 0x6e, 0x74, 0x73, 0x12, 0x21, 0x0a, 0x0c,
+	0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x18, 0x0b, 0x20, 0x01,
+	0x28, 0x0c, 0x52, 0x0b, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x12,
+	0x2a, 0x0a, 0x11, 0x6d, 0x6f, 0x64, 0x75, 0x6c, 0x65, 0x5f, 0x66, 0x69, 0x6c, 0x65, 0x73, 0x5f,
+	0x68, 0x61, 0x73, 0x68, 0x18, 0x0c, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x0f, 0x6d, 0x6f, 0x64, 0x75,
+	0x6c, 0x65, 0x46, 0x69, 0x6c, 0x65, 0x73, 0x48, 0x61, 0x73, 0x68, 0x12, 0x20, 0x0a, 0x0c, 0x68,
+	0x61, 0x73, 0x5f, 0x61, 0x69, 0x5f, 0x74, 0x61, 0x73, 0x6b, 0x73, 0x18, 0x0d, 0x20, 0x01, 0x28,
+	0x08, 0x52, 0x0a, 0x68, 0x61, 0x73, 0x41, 0x69, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x12, 0x2e, 0x0a,
+	0x08, 0x61, 0x69, 0x5f, 0x74, 0x61, 0x73, 0x6b, 0x73, 0x18, 0x0e, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x49,
+	0x54, 0x61, 0x73, 0x6b, 0x52, 0x07, 0x61, 0x69, 0x54, 0x61, 0x73, 0x6b, 0x73, 0x12, 0x2e, 0x0a,
+	0x13, 0x68, 0x61, 0x73, 0x5f, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x67,
+	0x65, 0x6e, 0x74, 0x73, 0x18, 0x0f, 0x20, 0x01, 0x28, 0x08, 0x52, 0x11, 0x68, 0x61, 0x73, 0x45,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x67, 0x65, 0x6e, 0x74, 0x73, 0x22, 0x41, 0x0a,
+	0x0c, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x31, 0x0a,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x22, 0xee, 0x02, 0x0a, 0x0d, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65,
+	0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x0c, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x65, 0x72, 0x72, 0x6f,
+	0x72, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x12, 0x33,
+	0x0a, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x73, 0x18, 0x03, 0x20, 0x03, 0x28,
+	0x0b, 0x32, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e,
+	0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x09, 0x72, 0x65, 0x73, 0x6f, 0x75, 0x72,
+	0x63, 0x65, 0x73, 0x12, 0x3a, 0x0a, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x73, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73,
+	0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x69, 0x63, 0x68, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65,
+	0x74, 0x65, 0x72, 0x52, 0x0a, 0x70, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72, 0x73, 0x12,
+	0x61, 0x0a, 0x17, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68,
+	0x5f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x73, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x29, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x45,
+	0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69,
+	0x64, 0x65, 0x72, 0x52, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x52, 0x15, 0x65, 0x78, 0x74,
+	0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x50, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65,
+	0x72, 0x73, 0x12, 0x2d, 0x0a, 0x07, 0x74, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x73, 0x18, 0x06, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x54, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x52, 0x07, 0x74, 0x69, 0x6d, 0x69, 0x6e, 0x67,
+	0x73, 0x12, 0x2e, 0x0a, 0x08, 0x61, 0x69, 0x5f, 0x74, 0x61, 0x73, 0x6b, 0x73, 0x18, 0x07, 0x20,
+	0x03, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x41, 0x49, 0x54, 0x61, 0x73, 0x6b, 0x52, 0x07, 0x61, 0x69, 0x54, 0x61, 0x73, 0x6b,
+	0x73, 0x22, 0xfa, 0x01, 0x0a, 0x06, 0x54, 0x69, 0x6d, 0x69, 0x6e, 0x67, 0x12, 0x30, 0x0a, 0x05,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x05, 0x73, 0x74, 0x61, 0x72, 0x74, 0x12, 0x2c,
+	0x0a, 0x03, 0x65, 0x6e, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x03, 0x65, 0x6e, 0x64, 0x12, 0x16, 0x0a, 0x06,
+	0x61, 0x63, 0x74, 0x69, 0x6f, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x61, 0x63,
+	0x74, 0x69, 0x6f, 0x6e, 0x12, 0x16, 0x0a, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x04,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x1a, 0x0a, 0x08,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x08,
+	0x72, 0x65, 0x73, 0x6f, 0x75, 0x72, 0x63, 0x65, 0x12, 0x14, 0x0a, 0x05, 0x73, 0x74, 0x61, 0x67,
+	0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x73, 0x74, 0x61, 0x67, 0x65, 0x12, 0x2e,
+	0x0a, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x18, 0x07, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x18, 0x2e,
+	0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x54, 0x69, 0x6d, 0x69,
+	0x6e, 0x67, 0x53, 0x74, 0x61, 0x74, 0x65, 0x52, 0x05, 0x73, 0x74, 0x61, 0x74, 0x65, 0x22, 0x0f,
+	0x0a, 0x0d, 0x43, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x22,
+	0x8c, 0x02, 0x0a, 0x07, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x2d, 0x0a, 0x06, 0x63,
+	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x13, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x48, 0x00, 0x52, 0x06, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x31, 0x0a, 0x05, 0x70, 0x61,
+	0x72, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76,
+	0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x61, 0x72, 0x73, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x12, 0x2e, 0x0a,
+	0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x03, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x18, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x52, 0x65,
+	0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x31, 0x0a,
+	0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18, 0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79,
+	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79,
+	0x12, 0x34, 0x0a, 0x06, 0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x43,
+	0x61, 0x6e, 0x63, 0x65, 0x6c, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x48, 0x00, 0x52, 0x06,
+	0x63, 0x61, 0x6e, 0x63, 0x65, 0x6c, 0x42, 0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0xc9,
+	0x02, 0x0a, 0x08, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x24, 0x0a, 0x03, 0x6c,
+	0x6f, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x10, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69,
+	0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x4c, 0x6f, 0x67, 0x48, 0x00, 0x52, 0x03, 0x6c, 0x6f,
+	0x67, 0x12, 0x32, 0x0a, 0x05, 0x70, 0x61, 0x72, 0x73, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x50,
+	0x61, 0x72, 0x73, 0x65, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00, 0x52, 0x05,
+	0x70, 0x61, 0x72, 0x73, 0x65, 0x12, 0x2f, 0x0a, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x18, 0x03, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x19, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65,
+	0x72, 0x2e, 0x50, 0x6c, 0x61, 0x6e, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74, 0x65, 0x48, 0x00,
+	0x52, 0x04, 0x70, 0x6c, 0x61, 0x6e, 0x12, 0x32, 0x0a, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x18,
+	0x04, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x41, 0x70, 0x70, 0x6c, 0x79, 0x43, 0x6f, 0x6d, 0x70, 0x6c, 0x65, 0x74,
+	0x65, 0x48, 0x00, 0x52, 0x05, 0x61, 0x70, 0x70, 0x6c, 0x79, 0x12, 0x3a, 0x0a, 0x0b, 0x64, 0x61,
+	0x74, 0x61, 0x5f, 0x75, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32,
+	0x17, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x44, 0x61,
+	0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x48, 0x00, 0x52, 0x0a, 0x64, 0x61, 0x74, 0x61,
+	0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x3a, 0x0a, 0x0b, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x5f,
+	0x70, 0x69, 0x65, 0x63, 0x65, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x17, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x43, 0x68, 0x75, 0x6e, 0x6b, 0x50,
+	0x69, 0x65, 0x63, 0x65, 0x48, 0x00, 0x52, 0x0a, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x50, 0x69, 0x65,
+	0x63, 0x65, 0x42, 0x06, 0x0a, 0x04, 0x74, 0x79, 0x70, 0x65, 0x22, 0x9c, 0x01, 0x0a, 0x0a, 0x44,
+	0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x12, 0x3c, 0x0a, 0x0b, 0x75, 0x70, 0x6c,
+	0x6f, 0x61, 0x64, 0x5f, 0x74, 0x79, 0x70, 0x65, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0e, 0x32, 0x1b,
+	0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x44, 0x61, 0x74,
+	0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64, 0x54, 0x79, 0x70, 0x65, 0x52, 0x0a, 0x75, 0x70, 0x6c,
+	0x6f, 0x61, 0x64, 0x54, 0x79, 0x70, 0x65, 0x12, 0x1b, 0x0a, 0x09, 0x64, 0x61, 0x74, 0x61, 0x5f,
+	0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x08, 0x64, 0x61, 0x74, 0x61,
+	0x48, 0x61, 0x73, 0x68, 0x12, 0x1b, 0x0a, 0x09, 0x66, 0x69, 0x6c, 0x65, 0x5f, 0x73, 0x69, 0x7a,
+	0x65, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x08, 0x66, 0x69, 0x6c, 0x65, 0x53, 0x69, 0x7a,
+	0x65, 0x12, 0x16, 0x0a, 0x06, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28,
+	0x05, 0x52, 0x06, 0x63, 0x68, 0x75, 0x6e, 0x6b, 0x73, 0x22, 0x67, 0x0a, 0x0a, 0x43, 0x68, 0x75,
+	0x6e, 0x6b, 0x50, 0x69, 0x65, 0x63, 0x65, 0x12, 0x12, 0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0c, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61, 0x12, 0x24, 0x0a, 0x0e, 0x66,
+	0x75, 0x6c, 0x6c, 0x5f, 0x64, 0x61, 0x74, 0x61, 0x5f, 0x68, 0x61, 0x73, 0x68, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0c, 0x52, 0x0c, 0x66, 0x75, 0x6c, 0x6c, 0x44, 0x61, 0x74, 0x61, 0x48, 0x61, 0x73,
+	0x68, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x69, 0x65, 0x63, 0x65, 0x5f, 0x69, 0x6e, 0x64, 0x65, 0x78,
+	0x18, 0x03, 0x20, 0x01, 0x28, 0x05, 0x52, 0x0a, 0x70, 0x69, 0x65, 0x63, 0x65, 0x49, 0x6e, 0x64,
+	0x65, 0x78, 0x2a, 0xa8, 0x01, 0x0a, 0x11, 0x50, 0x61, 0x72, 0x61, 0x6d, 0x65, 0x74, 0x65, 0x72,
+	0x46, 0x6f, 0x72, 0x6d, 0x54, 0x79, 0x70, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x44, 0x45, 0x46, 0x41,
+	0x55, 0x4c, 0x54, 0x10, 0x00, 0x12, 0x0e, 0x0a, 0x0a, 0x46, 0x4f, 0x52, 0x4d, 0x5f, 0x45, 0x52,
+	0x52, 0x4f, 0x52, 0x10, 0x01, 0x12, 0x09, 0x0a, 0x05, 0x52, 0x41, 0x44, 0x49, 0x4f, 0x10, 0x02,
+	0x12, 0x0c, 0x0a, 0x08, 0x44, 0x52, 0x4f, 0x50, 0x44, 0x4f, 0x57, 0x4e, 0x10, 0x03, 0x12, 0x09,
+	0x0a, 0x05, 0x49, 0x4e, 0x50, 0x55, 0x54, 0x10, 0x04, 0x12, 0x0c, 0x0a, 0x08, 0x54, 0x45, 0x58,
+	0x54, 0x41, 0x52, 0x45, 0x41, 0x10, 0x05, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x4c, 0x49, 0x44, 0x45,
+	0x52, 0x10, 0x06, 0x12, 0x0c, 0x0a, 0x08, 0x43, 0x48, 0x45, 0x43, 0x4b, 0x42, 0x4f, 0x58, 0x10,
+	0x07, 0x12, 0x0a, 0x0a, 0x06, 0x53, 0x57, 0x49, 0x54, 0x43, 0x48, 0x10, 0x08, 0x12, 0x0d, 0x0a,
+	0x09, 0x54, 0x41, 0x47, 0x53, 0x45, 0x4c, 0x45, 0x43, 0x54, 0x10, 0x09, 0x12, 0x0f, 0x0a, 0x0b,
+	0x4d, 0x55, 0x4c, 0x54, 0x49, 0x53, 0x45, 0x4c, 0x45, 0x43, 0x54, 0x10, 0x0a, 0x2a, 0x3f, 0x0a,
+	0x08, 0x4c, 0x6f, 0x67, 0x4c, 0x65, 0x76, 0x65, 0x6c, 0x12, 0x09, 0x0a, 0x05, 0x54, 0x52, 0x41,
+	0x43, 0x45, 0x10, 0x00, 0x12, 0x09, 0x0a, 0x05, 0x44, 0x45, 0x42, 0x55, 0x47, 0x10, 0x01, 0x12,
+	0x08, 0x0a, 0x04, 0x49, 0x4e, 0x46, 0x4f, 0x10, 0x02, 0x12, 0x08, 0x0a, 0x04, 0x57, 0x41, 0x52,
+	0x4e, 0x10, 0x03, 0x12, 0x09, 0x0a, 0x05, 0x45, 0x52, 0x52, 0x4f, 0x52, 0x10, 0x04, 0x2a, 0x3b,
+	0x0a, 0x0f, 0x41, 0x70, 0x70, 0x53, 0x68, 0x61, 0x72, 0x69, 0x6e, 0x67, 0x4c, 0x65, 0x76, 0x65,
+	0x6c, 0x12, 0x09, 0x0a, 0x05, 0x4f, 0x57, 0x4e, 0x45, 0x52, 0x10, 0x00, 0x12, 0x11, 0x0a, 0x0d,
+	0x41, 0x55, 0x54, 0x48, 0x45, 0x4e, 0x54, 0x49, 0x43, 0x41, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12,
+	0x0a, 0x0a, 0x06, 0x50, 0x55, 0x42, 0x4c, 0x49, 0x43, 0x10, 0x02, 0x2a, 0x35, 0x0a, 0x09, 0x41,
+	0x70, 0x70, 0x4f, 0x70, 0x65, 0x6e, 0x49, 0x6e, 0x12, 0x0e, 0x0a, 0x06, 0x57, 0x49, 0x4e, 0x44,
+	0x4f, 0x57, 0x10, 0x00, 0x1a, 0x02, 0x08, 0x01, 0x12, 0x0f, 0x0a, 0x0b, 0x53, 0x4c, 0x49, 0x4d,
+	0x5f, 0x57, 0x49, 0x4e, 0x44, 0x4f, 0x57, 0x10, 0x01, 0x12, 0x07, 0x0a, 0x03, 0x54, 0x41, 0x42,
+	0x10, 0x02, 0x2a, 0x37, 0x0a, 0x13, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65, 0x54,
+	0x72, 0x61, 0x6e, 0x73, 0x69, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x09, 0x0a, 0x05, 0x53, 0x54, 0x41,
+	0x52, 0x54, 0x10, 0x00, 0x12, 0x08, 0x0a, 0x04, 0x53, 0x54, 0x4f, 0x50, 0x10, 0x01, 0x12, 0x0b,
+	0x0a, 0x07, 0x44, 0x45, 0x53, 0x54, 0x52, 0x4f, 0x59, 0x10, 0x02, 0x2a, 0x3e, 0x0a, 0x1b, 0x50,
+	0x72, 0x65, 0x62, 0x75, 0x69, 0x6c, 0x74, 0x57, 0x6f, 0x72, 0x6b, 0x73, 0x70, 0x61, 0x63, 0x65,
+	0x42, 0x75, 0x69, 0x6c, 0x64, 0x53, 0x74, 0x61, 0x67, 0x65, 0x12, 0x08, 0x0a, 0x04, 0x4e, 0x4f,
+	0x4e, 0x45, 0x10, 0x00, 0x12, 0x0a, 0x0a, 0x06, 0x43, 0x52, 0x45, 0x41, 0x54, 0x45, 0x10, 0x01,
+	0x12, 0x09, 0x0a, 0x05, 0x43, 0x4c, 0x41, 0x49, 0x4d, 0x10, 0x02, 0x2a, 0x35, 0x0a, 0x0b, 0x54,
+	0x69, 0x6d, 0x69, 0x6e, 0x67, 0x53, 0x74, 0x61, 0x74, 0x65, 0x12, 0x0b, 0x0a, 0x07, 0x53, 0x54,
+	0x41, 0x52, 0x54, 0x45, 0x44, 0x10, 0x00, 0x12, 0x0d, 0x0a, 0x09, 0x43, 0x4f, 0x4d, 0x50, 0x4c,
+	0x45, 0x54, 0x45, 0x44, 0x10, 0x01, 0x12, 0x0a, 0x0a, 0x06, 0x46, 0x41, 0x49, 0x4c, 0x45, 0x44,
+	0x10, 0x02, 0x2a, 0x47, 0x0a, 0x0e, 0x44, 0x61, 0x74, 0x61, 0x55, 0x70, 0x6c, 0x6f, 0x61, 0x64,
+	0x54, 0x79, 0x70, 0x65, 0x12, 0x17, 0x0a, 0x13, 0x55, 0x50, 0x4c, 0x4f, 0x41, 0x44, 0x5f, 0x54,
+	0x59, 0x50, 0x45, 0x5f, 0x55, 0x4e, 0x4b, 0x4e, 0x4f, 0x57, 0x4e, 0x10, 0x00, 0x12, 0x1c, 0x0a,
+	0x18, 0x55, 0x50, 0x4c, 0x4f, 0x41, 0x44, 0x5f, 0x54, 0x59, 0x50, 0x45, 0x5f, 0x4d, 0x4f, 0x44,
+	0x55, 0x4c, 0x45, 0x5f, 0x46, 0x49, 0x4c, 0x45, 0x53, 0x10, 0x01, 0x32, 0x49, 0x0a, 0x0b, 0x50,
+	0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x12, 0x3a, 0x0a, 0x07, 0x53, 0x65,
+	0x73, 0x73, 0x69, 0x6f, 0x6e, 0x12, 0x14, 0x2e, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f,
+	0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x15, 0x2e, 0x70, 0x72,
+	0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x2e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
+	0x73, 0x65, 0x28, 0x01, 0x30, 0x01, 0x42, 0x30, 0x5a, 0x2e, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62,
+	0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72,
+	0x2f, 0x76, 0x32, 0x2f, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x73, 0x69, 0x6f, 0x6e, 0x65, 0x72, 0x73,
+	0x64, 0x6b, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
@@ -5814,6 +5844,7 @@ func file_provisionersdk_proto_provisioner_proto_init() {
 		(*Agent_Token)(nil),
 		(*Agent_InstanceId)(nil),
 	}
+	file_provisionersdk_proto_provisioner_proto_msgTypes[32].OneofWrappers = []interface{}{}
 	file_provisionersdk_proto_provisioner_proto_msgTypes[43].OneofWrappers = []interface{}{
 		(*Request_Config)(nil),
 		(*Request_Parse)(nil),
diff --git a/provisionersdk/proto/provisioner.proto b/provisionersdk/proto/provisioner.proto
index e38edd3aba1c2..803f3e2197ecd 100644
--- a/provisionersdk/proto/provisioner.proto
+++ b/provisionersdk/proto/provisioner.proto
@@ -335,7 +335,8 @@ message AITaskSidebarApp {
 
 message AITask {
   string id = 1;
-  AITaskSidebarApp sidebar_app = 2;
+  optional AITaskSidebarApp sidebar_app = 2;
+  string app_id = 3;
 }
 
 // Metadata is information about a workspace used in the execution of a build
@@ -361,6 +362,8 @@ message Metadata {
   repeated Role workspace_owner_rbac_roles = 19;
   PrebuiltWorkspaceBuildStage prebuilt_workspace_build_stage = 20; // Indicates that a prebuilt workspace is being built.
   repeated RunningAgentAuthToken running_agent_auth_tokens = 21;
+  string task_id = 22;
+  string task_prompt = 23;
 }
 
 // Config represents execution configuration shared by all subsequent requests in the Session
diff --git a/site/e2e/provisionerGenerated.ts b/site/e2e/provisionerGenerated.ts
index 65e0557c1b779..c5a7d16274a1c 100644
--- a/site/e2e/provisionerGenerated.ts
+++ b/site/e2e/provisionerGenerated.ts
@@ -375,7 +375,8 @@ export interface AITaskSidebarApp {
 
 export interface AITask {
   id: string;
-  sidebarApp: AITaskSidebarApp | undefined;
+  sidebarApp?: AITaskSidebarApp | undefined;
+  appId: string;
 }
 
 /** Metadata is information about a workspace used in the execution of a build */
@@ -402,6 +403,8 @@ export interface Metadata {
   /** Indicates that a prebuilt workspace is being built. */
   prebuiltWorkspaceBuildStage: PrebuiltWorkspaceBuildStage;
   runningAgentAuthTokens: RunningAgentAuthToken[];
+  taskId: string;
+  taskPrompt: string;
 }
 
 /** Config represents execution configuration shared by all subsequent requests in the Session */
@@ -1217,6 +1220,9 @@ export const AITask = {
     if (message.sidebarApp !== undefined) {
       AITaskSidebarApp.encode(message.sidebarApp, writer.uint32(18).fork()).ldelim();
     }
+    if (message.appId !== "") {
+      writer.uint32(26).string(message.appId);
+    }
     return writer;
   },
 };
@@ -1286,6 +1292,12 @@ export const Metadata = {
     for (const v of message.runningAgentAuthTokens) {
       RunningAgentAuthToken.encode(v!, writer.uint32(170).fork()).ldelim();
     }
+    if (message.taskId !== "") {
+      writer.uint32(178).string(message.taskId);
+    }
+    if (message.taskPrompt !== "") {
+      writer.uint32(186).string(message.taskPrompt);
+    }
     return writer;
   },
 };

From ed90ecf00e2a7eba5b2ca060cf5348831091a9d3 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Thu, 9 Oct 2025 14:53:08 +0200
Subject: [PATCH 096/298] feat: add allow_list to resource-scoped API tokens
 (#19964)

# Add API key allow_list for resource-scoped tokens

This PR adds support for API key allow lists, enabling tokens to be scoped to specific resources. The implementation:

1. Adds a new `allow_list` field to the `CreateTokenRequest` struct, allowing clients to specify resource-specific scopes when creating API tokens
2. Implements `APIAllowListTarget` type to represent resource targets in the format `<type>:<id>` with support for wildcards
3. Adds validation and normalization logic for allow lists to handle wildcards and deduplication
4. Integrates with RBAC by creating an `APIKeyEffectiveScope` that merges API key scopes with allow list restrictions
5. Updates API documentation and TypeScript types to reflect the new functionality

This feature enables creating tokens that are limited to specific resources (like workspaces or templates) by ID, making it possible to create more granular API tokens with limited access.
---
 coderd/apidoc/docs.go                         |  17 +
 coderd/apidoc/swagger.json                    |  17 +
 coderd/apikey.go                              |  31 ++
 coderd/apikey/apikey.go                       |  10 +-
 coderd/coderdtest/authorize.go                |   2 +-
 coderd/database/dbauthz/setup_test.go         |  14 +-
 coderd/database/dbgen/dbgen.go                |   3 +-
 coderd/database/modelmethods.go               |  80 +++--
 coderd/database/modelmethods_internal_test.go |  68 +++-
 coderd/database/types.go                      |  37 +--
 coderd/httpmw/apikey.go                       |   2 +-
 coderd/httpmw/authorize_test.go               |   5 +-
 coderd/httpmw/workspaceparam_test.go          |   5 +-
 coderd/rbac/allowlist.go                      | 304 ++++++++++++++++++
 coderd/rbac/allowlist_test.go                 | 231 +++++++++++++
 coderd/rbac/scopes.go                         |   6 +-
 coderd/rbac/scopes_test.go                    |   2 +-
 codersdk/allowlist.go                         |  80 +++++
 codersdk/allowlist_test.go                    |  40 +++
 codersdk/apikey.go                            |   9 +-
 docs/reference/api/schemas.md                 |  35 +-
 docs/reference/api/users.md                   |   6 +
 scripts/apitypings/main.go                    |   4 +-
 scripts/apitypings/main_test.go               |   9 +-
 site/src/api/typesGenerated.ts                |   7 +
 25 files changed, 930 insertions(+), 94 deletions(-)
 create mode 100644 coderd/rbac/allowlist.go
 create mode 100644 coderd/rbac/allowlist_test.go
 create mode 100644 codersdk/allowlist.go
 create mode 100644 codersdk/allowlist_test.go

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index d10e39fa06ed2..6ee189e18268f 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11713,6 +11713,17 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.APIAllowListTarget": {
+            "type": "object",
+            "properties": {
+                "id": {
+                    "type": "string"
+                },
+                "type": {
+                    "$ref": "#/definitions/codersdk.RBACResource"
+                }
+            }
+        },
         "codersdk.APIKey": {
             "type": "object",
             "required": [
@@ -13256,6 +13267,12 @@ const docTemplate = `{
         "codersdk.CreateTokenRequest": {
             "type": "object",
             "properties": {
+                "allow_list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.APIAllowListTarget"
+                    }
+                },
                 "lifetime": {
                     "type": "integer"
                 },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index df4aae91d3b60..48aaadadb993a 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10425,6 +10425,17 @@
 				}
 			}
 		},
+		"codersdk.APIAllowListTarget": {
+			"type": "object",
+			"properties": {
+				"id": {
+					"type": "string"
+				},
+				"type": {
+					"$ref": "#/definitions/codersdk.RBACResource"
+				}
+			}
+		},
 		"codersdk.APIKey": {
 			"type": "object",
 			"required": [
@@ -11901,6 +11912,12 @@
 		"codersdk.CreateTokenRequest": {
 			"type": "object",
 			"properties": {
+				"allow_list": {
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.APIAllowListTarget"
+					}
+				},
 				"lifetime": {
 					"type": "integer"
 				},
diff --git a/coderd/apikey.go b/coderd/apikey.go
index c7a7eef3c6a7e..f2aec89e5709e 100644
--- a/coderd/apikey.go
+++ b/coderd/apikey.go
@@ -116,6 +116,37 @@ func (api *API) postToken(rw http.ResponseWriter, r *http.Request) {
 		TokenName:       tokenName,
 	}
 
+	if len(createToken.AllowList) > 0 {
+		rbacAllowListElements := make([]rbac.AllowListElement, 0, len(createToken.AllowList))
+		for _, t := range createToken.AllowList {
+			entry, err := rbac.NewAllowListElement(string(t.Type), t.ID)
+			if err != nil {
+				httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+					Message: "Failed to create API key.",
+					Detail:  err.Error(),
+				})
+				return
+			}
+			rbacAllowListElements = append(rbacAllowListElements, entry)
+		}
+
+		rbacAllowList, err := rbac.NormalizeAllowList(rbacAllowListElements)
+		if err != nil {
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Failed to create API key.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
+		dbAllowList := make(database.AllowList, 0, len(rbacAllowList))
+		for _, e := range rbacAllowList {
+			dbAllowList = append(dbAllowList, rbac.AllowListElement{Type: e.Type, ID: e.ID})
+		}
+
+		params.AllowList = dbAllowList
+	}
+
 	if createToken.Lifetime != 0 {
 		err := api.validateAPIKeyLifetime(ctx, user.ID, createToken.Lifetime)
 		if err != nil {
diff --git a/coderd/apikey/apikey.go b/coderd/apikey/apikey.go
index ea186223a1374..0dd874b340a90 100644
--- a/coderd/apikey/apikey.go
+++ b/coderd/apikey/apikey.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/cryptorand"
 )
 
@@ -34,6 +35,9 @@ type CreateParams struct {
 	Scopes     database.APIKeyScopes
 	TokenName  string
 	RemoteAddr string
+	// AllowList is an optional, normalized allow-list
+	// of resource type and uuid entries. If empty, defaults to wildcard.
+	AllowList database.AllowList
 }
 
 // Generate generates an API key, returning the key as a string as well as the
@@ -61,6 +65,10 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 		params.LifetimeSeconds = int64(time.Until(params.ExpiresAt).Seconds())
 	}
 
+	if len(params.AllowList) == 0 {
+		params.AllowList = database.AllowList{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}}
+	}
+
 	ip := net.ParseIP(params.RemoteAddr)
 	if ip == nil {
 		ip = net.IPv4(0, 0, 0, 0)
@@ -115,7 +123,7 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 		HashedSecret: hashed[:],
 		LoginType:    params.LoginType,
 		Scopes:       scopes,
-		AllowList:    database.AllowList{database.AllowListWildcard()},
+		AllowList:    params.AllowList,
 		TokenName:    params.TokenName,
 	}, token, nil
 }
diff --git a/coderd/coderdtest/authorize.go b/coderd/coderdtest/authorize.go
index f0d35cd6359a2..f53ef3fa3bea9 100644
--- a/coderd/coderdtest/authorize.go
+++ b/coderd/coderdtest/authorize.go
@@ -68,7 +68,7 @@ func AssertRBAC(t *testing.T, api *coderd.API, client *codersdk.Client) RBACAsse
 			ID:     key.UserID.String(),
 			Roles:  rbac.RoleIdentifiers(roleNames),
 			Groups: roles.Groups,
-			Scope:  key.Scopes,
+			Scope:  key.ScopeSet(),
 		},
 		Recorder: recorder,
 	}
diff --git a/coderd/database/dbauthz/setup_test.go b/coderd/database/dbauthz/setup_test.go
index c9a1b2063d691..6a3f1a2b3fe62 100644
--- a/coderd/database/dbauthz/setup_test.go
+++ b/coderd/database/dbauthz/setup_test.go
@@ -225,6 +225,10 @@ func (s *MethodTestSuite) SubtestWithDB(db database.Store, testCaseF func(db dat
 			if testCase.outputs != nil {
 				// Assert the required outputs
 				s.Equal(len(testCase.outputs), len(outputs), "method %q returned unexpected number of outputs", methodName)
+				cmpOptions := []cmp.Option{
+					// Equate nil and empty slices.
+					cmpopts.EquateEmpty(),
+				}
 				for i := range outputs {
 					a, b := testCase.outputs[i].Interface(), outputs[i].Interface()
 
@@ -232,10 +236,9 @@ func (s *MethodTestSuite) SubtestWithDB(db database.Store, testCaseF func(db dat
 					// first check if the values are equal with regard to order.
 					// If not, re-check disregarding order and show a nice diff
 					// output of the two values.
-					if !cmp.Equal(a, b, cmpopts.EquateEmpty()) {
-						if diff := cmp.Diff(a, b,
-							// Equate nil and empty slices.
-							cmpopts.EquateEmpty(),
+					if !cmp.Equal(a, b, cmpOptions...) {
+						diffOpts := append(
+							append([]cmp.Option{}, cmpOptions...),
 							// Allow slice order to be ignored.
 							cmpopts.SortSlices(func(a, b any) bool {
 								var ab, bb strings.Builder
@@ -247,7 +250,8 @@ func (s *MethodTestSuite) SubtestWithDB(db database.Store, testCaseF func(db dat
 								// https://github.com/google/go-cmp/issues/67
 								return ab.String() < bb.String()
 							}),
-						); diff != "" {
+						)
+						if diff := cmp.Diff(a, b, diffOpts...); diff != "" {
 							s.Failf("compare outputs failed", "method %q returned unexpected output %d (-want +got):\n%s", methodName, i, diff)
 						}
 					}
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index f0e5b58d1bc85..289d664a1a603 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -27,6 +27,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database/provisionerjobs"
 	"github.com/coder/coder/v2/coderd/database/pubsub"
 	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/cryptorand"
 	"github.com/coder/coder/v2/provisionerd/proto"
@@ -186,7 +187,7 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey, munge ...func
 		UpdatedAt:       takeFirst(seed.UpdatedAt, dbtime.Now()),
 		LoginType:       takeFirst(seed.LoginType, database.LoginTypePassword),
 		Scopes:          takeFirstSlice([]database.APIKeyScope(seed.Scopes), []database.APIKeyScope{database.ApiKeyScopeCoderAll}),
-		AllowList:       takeFirstSlice(seed.AllowList, database.AllowList{database.AllowListWildcard()}),
+		AllowList:       takeFirstSlice(seed.AllowList, database.AllowList{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}}),
 		TokenName:       takeFirst(seed.TokenName),
 	}
 	for _, fn := range munge {
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
index 230b9274eadcb..2ac62215b4444 100644
--- a/coderd/database/modelmethods.go
+++ b/coderd/database/modelmethods.go
@@ -145,24 +145,30 @@ func (s APIKeyScope) ToRBAC() rbac.ScopeName {
 	}
 }
 
-// APIKeyScopes allows expanding multiple API key scopes into a single
-// RBAC scope for authorization. This implements rbac.ExpandableScope so
-// callers can pass the list directly without deriving a single scope.
+// APIKeyScopes represents a collection of individual API key scope names as
+// stored in the database. Helper methods on this type are used to derive the
+// RBAC scope that should be authorized for the key.
 type APIKeyScopes []APIKeyScope
 
-var _ rbac.ExpandableScope = APIKeyScopes{}
+// WithAllowList wraps the scopes with a database allow list, producing an
+// ExpandableScope that always enforces the allow list overlay when expanded.
+func (s APIKeyScopes) WithAllowList(list AllowList) APIKeyScopeSet {
+	return APIKeyScopeSet{Scopes: s, AllowList: list}
+}
 
 // Has returns true if the slice contains the provided scope.
 func (s APIKeyScopes) Has(target APIKeyScope) bool {
 	return slices.Contains(s, target)
 }
 
-// Expand merges the permissions of all scopes in the list into a single scope.
-// If the list is empty, it defaults to rbac.ScopeAll.
-func (s APIKeyScopes) Expand() (rbac.Scope, error) {
+// expandRBACScope merges the permissions of all scopes in the list into a
+// single RBAC scope. If the list is empty, it defaults to rbac.ScopeAll for
+// backward compatibility. This method is internal; use ScopeSet() to combine
+// scopes with the API key's allow list for authorization.
+func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 	// Default to ScopeAll for backward compatibility when no scopes provided.
 	if len(s) == 0 {
-		return rbac.ScopeAll.Expand()
+		return rbac.Scope{}, xerrors.New("no scopes provided")
 	}
 
 	var merged rbac.Scope
@@ -174,9 +180,8 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
 		User:       nil,
 	}
 
-	// Track allow list union, collapsing to wildcard if any child is wildcard.
-	allowAll := false
-	allowSet := make(map[string]rbac.AllowListElement)
+	// Collect allow lists for a union after expanding all scopes.
+	allowLists := make([][]rbac.AllowListElement, 0, len(s))
 
 	for _, s := range s {
 		expanded, err := s.ToRBAC().Expand()
@@ -191,16 +196,7 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
 		}
 		merged.User = append(merged.User, expanded.User...)
 
-		// Merge allow lists.
-		for _, e := range expanded.AllowIDList {
-			if e.ID == policy.WildcardSymbol && e.Type == policy.WildcardSymbol {
-				allowAll = true
-				// No need to track other entries once wildcard is present.
-				continue
-			}
-			key := e.String()
-			allowSet[key] = e
-		}
+		allowLists = append(allowLists, expanded.AllowIDList)
 	}
 
 	// De-duplicate permissions across Site/Org/User
@@ -210,14 +206,11 @@ func (s APIKeyScopes) Expand() (rbac.Scope, error) {
 	}
 	merged.User = rbac.DeduplicatePermissions(merged.User)
 
-	if allowAll || len(allowSet) == 0 {
-		merged.AllowIDList = []rbac.AllowListElement{rbac.AllowListAll()}
-	} else {
-		merged.AllowIDList = make([]rbac.AllowListElement, 0, len(allowSet))
-		for _, v := range allowSet {
-			merged.AllowIDList = append(merged.AllowIDList, v)
-		}
+	union, err := rbac.UnionAllowLists(allowLists...)
+	if err != nil {
+		return rbac.Scope{}, err
 	}
+	merged.AllowIDList = union
 
 	return merged, nil
 }
@@ -235,6 +228,37 @@ func (s APIKeyScopes) Name() rbac.RoleIdentifier {
 	return rbac.RoleIdentifier{Name: "scopes[" + strings.Join(names, "+") + "]"}
 }
 
+// APIKeyScopeSet merges expanded scopes with the API key's DB allow_list. If
+// the DB allow_list is a wildcard or empty, the merged scope's allow list is
+// unchanged. Otherwise, the DB allow_list overrides the merged AllowIDList to
+// enforce the token's resource scoping consistently across all permissions.
+type APIKeyScopeSet struct {
+	Scopes    APIKeyScopes
+	AllowList AllowList
+}
+
+var _ rbac.ExpandableScope = APIKeyScopeSet{}
+
+func (s APIKeyScopeSet) Name() rbac.RoleIdentifier { return s.Scopes.Name() }
+
+func (s APIKeyScopeSet) Expand() (rbac.Scope, error) {
+	merged, err := s.Scopes.expandRBACScope()
+	if err != nil {
+		return rbac.Scope{}, err
+	}
+	merged.AllowIDList = rbac.IntersectAllowLists(merged.AllowIDList, s.AllowList)
+	return merged, nil
+}
+
+// ScopeSet returns the scopes combined with the database allow list. It is the
+// canonical way to expose an API key's effective scope for authorization.
+func (k APIKey) ScopeSet() APIKeyScopeSet {
+	return APIKeyScopeSet{
+		Scopes:    k.Scopes,
+		AllowList: k.AllowList,
+	}
+}
+
 func (k APIKey) RBACObject() rbac.Object {
 	return rbac.ResourceApiKey.WithIDString(k.ID).
 		WithOwner(k.UserID.String())
diff --git a/coderd/database/modelmethods_internal_test.go b/coderd/database/modelmethods_internal_test.go
index 16d80d69c15f0..574d1892061ad 100644
--- a/coderd/database/modelmethods_internal_test.go
+++ b/coderd/database/modelmethods_internal_test.go
@@ -3,6 +3,7 @@ package database
 import (
 	"testing"
 
+	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/coderd/rbac"
@@ -38,7 +39,7 @@ func TestAPIKeyScopesExpand(t *testing.T) {
 		for _, tc := range cases {
 			t.Run(tc.name, func(t *testing.T) {
 				t.Parallel()
-				s, err := tc.scopes.Expand()
+				s, err := tc.scopes.expandRBACScope()
 				require.NoError(t, err)
 				tc.want(t, s)
 			})
@@ -59,7 +60,7 @@ func TestAPIKeyScopesExpand(t *testing.T) {
 		for _, tc := range cases {
 			t.Run(tc.name, func(t *testing.T) {
 				t.Parallel()
-				s, err := tc.scopes.Expand()
+				s, err := tc.scopes.expandRBACScope()
 				require.NoError(t, err)
 				requirePermission(t, s, tc.res, tc.act)
 				requireAllowAll(t, s)
@@ -70,7 +71,7 @@ func TestAPIKeyScopesExpand(t *testing.T) {
 	t.Run("merge", func(t *testing.T) {
 		t.Parallel()
 		scopes := APIKeyScopes{ApiKeyScopeCoderApplicationConnect, ApiKeyScopeCoderAll, ApiKeyScopeWorkspaceRead}
-		s, err := scopes.Expand()
+		s, err := scopes.expandRBACScope()
 		require.NoError(t, err)
 		requirePermission(t, s, rbac.ResourceWildcard.Type, policy.Action(policy.WildcardSymbol))
 		requirePermission(t, s, rbac.ResourceWorkspace.Type, policy.ActionApplicationConnect)
@@ -78,13 +79,68 @@ func TestAPIKeyScopesExpand(t *testing.T) {
 		requireAllowAll(t, s)
 	})
 
-	t.Run("empty_defaults_to_all", func(t *testing.T) {
+	t.Run("effective_scope_keep_types", func(t *testing.T) {
 		t.Parallel()
-		s, err := (APIKeyScopes{}).Expand()
+		workspaceID := uuid.New()
+
+		effective := APIKeyScopeSet{
+			Scopes: APIKeyScopes{ApiKeyScopeWorkspaceRead},
+			AllowList: AllowList{
+				{Type: rbac.ResourceWorkspace.Type, ID: workspaceID.String()},
+			},
+		}
+
+		expanded, err := effective.Expand()
 		require.NoError(t, err)
-		requirePermission(t, s, rbac.ResourceWildcard.Type, policy.Action(policy.WildcardSymbol))
+		require.Len(t, expanded.AllowIDList, 1)
+		require.Equal(t, "workspace", expanded.AllowIDList[0].Type)
+		require.Equal(t, workspaceID.String(), expanded.AllowIDList[0].ID)
+	})
+
+	t.Run("empty_rejected", func(t *testing.T) {
+		t.Parallel()
+		_, err := (APIKeyScopes{}).expandRBACScope()
+		require.Error(t, err)
+		require.ErrorContains(t, err, "no scopes provided")
+	})
+
+	t.Run("allow_list_overrides", func(t *testing.T) {
+		t.Parallel()
+		allowID := uuid.NewString()
+		set := APIKeyScopes{ApiKeyScopeWorkspaceRead}.WithAllowList(AllowList{
+			{Type: rbac.ResourceWorkspace.Type, ID: allowID},
+		})
+		s, err := set.Expand()
+		require.NoError(t, err)
+		require.Len(t, s.AllowIDList, 1)
+		require.Equal(t, rbac.AllowListElement{Type: rbac.ResourceWorkspace.Type, ID: allowID}, s.AllowIDList[0])
+	})
+
+	t.Run("allow_list_wildcard_keeps_merged", func(t *testing.T) {
+		t.Parallel()
+		set := APIKeyScopes{ApiKeyScopeWorkspaceRead}.WithAllowList(AllowList{
+			{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol},
+		})
+		s, err := set.Expand()
+		require.NoError(t, err)
+		requirePermission(t, s, rbac.ResourceWorkspace.Type, policy.ActionRead)
 		requireAllowAll(t, s)
 	})
+
+	t.Run("scope_set_helper", func(t *testing.T) {
+		t.Parallel()
+		allowID := uuid.NewString()
+		key := APIKey{
+			Scopes: APIKeyScopes{ApiKeyScopeWorkspaceRead},
+			AllowList: AllowList{
+				{Type: rbac.ResourceWorkspace.Type, ID: allowID},
+			},
+		}
+		s, err := key.ScopeSet().Expand()
+		require.NoError(t, err)
+		require.Len(t, s.AllowIDList, 1)
+		require.Equal(t, rbac.AllowListElement{Type: rbac.ResourceWorkspace.Type, ID: allowID}, s.AllowIDList[0])
+	})
 }
 
 // Helpers
diff --git a/coderd/database/types.go b/coderd/database/types.go
index b534e9e269195..fefba8acb747e 100644
--- a/coderd/database/types.go
+++ b/coderd/database/types.go
@@ -163,9 +163,7 @@ func (m StringMapOfInt) Value() (driver.Value, error) {
 
 type CustomRolePermissions []CustomRolePermission
 
-// APIKeyScopes implements sql.Scanner and driver.Valuer so it can be read from
-// and written to the Postgres api_key_scope[] enum array column.
-func (s *APIKeyScopes) Scan(src interface{}) error {
+func (s *APIKeyScopes) Scan(src any) error {
 	var arr []string
 	if err := pq.Array(&arr).Scan(src); err != nil {
 		return err
@@ -314,36 +312,11 @@ func ParseIP(ipStr string) pqtype.Inet {
 	}
 }
 
-// AllowListTarget represents a single scope allow-list entry.
-// It encodes a resource tuple (type, id) and provides helpers for
-// consistent string and JSON representations across the codebase.
-type AllowListTarget struct {
-	Type string `json:"type"`
-	ID   string `json:"id"`
-}
-
-// String returns the canonical database representation "type:id".
-func (t AllowListTarget) String() string {
-	return t.Type + ":" + t.ID
-}
-
-// ParseAllowListTarget parses the canonical string form "type:id".
-func ParseAllowListTarget(s string) (AllowListTarget, error) {
-	targetType, id, ok := rbac.ParseResourceAction(s)
-	if !ok {
-		return AllowListTarget{}, xerrors.Errorf("invalid allow list target: %q", s)
-	}
-	return AllowListTarget{Type: targetType, ID: id}, nil
-}
-
-// AllowListWildcard returns the wildcard allow-list entry {"*","*"}.
-func AllowListWildcard() AllowListTarget { return AllowListTarget{Type: "*", ID: "*"} }
-
 // AllowList is a typed wrapper around a list of AllowListTarget entries.
 // It implements sql.Scanner and driver.Valuer so it can be stored in and
 // loaded from a Postgres text[] column that stores each entry in the
 // canonical form "type:id".
-type AllowList []AllowListTarget
+type AllowList []rbac.AllowListElement
 
 // Scan implements sql.Scanner. It supports inputs that pq.Array can decode
 // into []string, and then converts each element to an AllowListTarget.
@@ -352,13 +325,13 @@ func (a *AllowList) Scan(src any) error {
 	if err := pq.Array(&raw).Scan(src); err != nil {
 		return err
 	}
-	out := make([]AllowListTarget, len(raw))
+	out := make([]rbac.AllowListElement, len(raw))
 	for i, s := range raw {
-		t, err := ParseAllowListTarget(s)
+		e, err := rbac.ParseAllowListEntry(s)
 		if err != nil {
 			return err
 		}
-		out[i] = t
+		out[i] = e
 	}
 	*a = out
 	return nil
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
index b534a124ddb95..08b835ccc6630 100644
--- a/coderd/httpmw/apikey.go
+++ b/coderd/httpmw/apikey.go
@@ -434,7 +434,7 @@ func ExtractAPIKey(rw http.ResponseWriter, r *http.Request, cfg ExtractAPIKeyCon
 	// If the key is valid, we also fetch the user roles and status.
 	// The roles are used for RBAC authorize checks, and the status
 	// is to block 'suspended' users from accessing the platform.
-	actor, userStatus, err := UserRBACSubject(ctx, cfg.DB, key.UserID, key.Scopes)
+	actor, userStatus, err := UserRBACSubject(ctx, cfg.DB, key.UserID, key.ScopeSet())
 	if err != nil {
 		return write(http.StatusUnauthorized, codersdk.Response{
 			Message: internalErrorMessage,
diff --git a/coderd/httpmw/authorize_test.go b/coderd/httpmw/authorize_test.go
index 3ec4ca5a4c8f2..030f23935ef83 100644
--- a/coderd/httpmw/authorize_test.go
+++ b/coderd/httpmw/authorize_test.go
@@ -20,6 +20,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/httpmw"
 	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/codersdk"
 )
 
@@ -173,7 +174,9 @@ func addUser(t *testing.T, db database.Store, roles ...string) (database.User, s
 		ExpiresAt:    dbtime.Now().Add(time.Minute),
 		LoginType:    database.LoginTypePassword,
 		Scopes:       database.APIKeyScopes{database.ApiKeyScopeCoderAll},
-		AllowList:    database.AllowList{database.AllowListWildcard()},
+		AllowList: database.AllowList{
+			{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol},
+		},
 		IPAddress: pqtype.Inet{
 			IPNet: net.IPNet{
 				IP:   net.ParseIP("0.0.0.0"),
diff --git a/coderd/httpmw/workspaceparam_test.go b/coderd/httpmw/workspaceparam_test.go
index 78e0929df7bca..7b9871ce6dc41 100644
--- a/coderd/httpmw/workspaceparam_test.go
+++ b/coderd/httpmw/workspaceparam_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/cryptorand"
 )
@@ -67,7 +68,9 @@ func TestWorkspaceParam(t *testing.T) {
 			ExpiresAt:    dbtime.Now().Add(time.Minute),
 			LoginType:    database.LoginTypePassword,
 			Scopes:       database.APIKeyScopes{database.ApiKeyScopeCoderAll},
-			AllowList:    database.AllowList{database.AllowListWildcard()},
+			AllowList: database.AllowList{
+				{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol},
+			},
 			IPAddress: pqtype.Inet{
 				IPNet: net.IPNet{
 					IP:   net.IPv4(127, 0, 0, 1),
diff --git a/coderd/rbac/allowlist.go b/coderd/rbac/allowlist.go
new file mode 100644
index 0000000000000..387d84ee2cab9
--- /dev/null
+++ b/coderd/rbac/allowlist.go
@@ -0,0 +1,304 @@
+package rbac
+
+import (
+	"slices"
+	"sort"
+	"strings"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/rbac/policy"
+)
+
+// maxAllowListEntries caps normalized allow lists to a manageable size. This
+// limit is intentionally arbitrary—just high enough for current use cases—so we
+// can revisit it without implying any semantic contract.
+const maxAllowListEntries = 128
+
+// ParseAllowListEntry parses a single allow-list entry string in the form
+// "*:*", "<resource_type>:*", or "<resource_type>:<uuid>" into an
+// AllowListElement with validation.
+func ParseAllowListEntry(s string) (AllowListElement, error) {
+	s = strings.TrimSpace(strings.ToLower(s))
+	res, id, ok := ParseResourceAction(s)
+	if !ok {
+		return AllowListElement{}, xerrors.Errorf("invalid allow_list entry %q: want <type>:<id>", s)
+	}
+
+	return NewAllowListElement(res, id)
+}
+
+func NewAllowListElement(resourceType string, id string) (AllowListElement, error) {
+	if resourceType != policy.WildcardSymbol {
+		if _, ok := policy.RBACPermissions[resourceType]; !ok {
+			return AllowListElement{}, xerrors.Errorf("unknown resource type %q", resourceType)
+		}
+	}
+	if id != policy.WildcardSymbol {
+		if _, err := uuid.Parse(id); err != nil {
+			return AllowListElement{}, xerrors.Errorf("invalid %s ID (must be UUID): %q", resourceType, id)
+		}
+	}
+
+	return AllowListElement{Type: resourceType, ID: id}, nil
+}
+
+// ParseAllowList parses, validates, normalizes, and deduplicates a list of
+// allow-list entries. If max is <=0, a default cap of 128 is applied.
+func ParseAllowList(inputs []string, maxEntries int) ([]AllowListElement, error) {
+	if len(inputs) == 0 {
+		return nil, nil
+	}
+	if len(inputs) > maxEntries {
+		return nil, xerrors.Errorf("allow_list has %d entries; max allowed is %d", len(inputs), maxEntries)
+	}
+
+	elems := make([]AllowListElement, 0, len(inputs))
+	for _, s := range inputs {
+		e, err := ParseAllowListEntry(s)
+		if err != nil {
+			return nil, err
+		}
+		// Global wildcard short-circuits
+		if e.Type == policy.WildcardSymbol && e.ID == policy.WildcardSymbol {
+			return []AllowListElement{AllowListAll()}, nil
+		}
+		elems = append(elems, e)
+	}
+
+	return NormalizeAllowList(elems)
+}
+
+// NormalizeAllowList enforces max entry limits, collapses typed wildcards, and
+// produces a deterministic, deduplicated allow list. A global wildcard returns
+// early with a single `[*:*]` entry, typed wildcards shadow specific IDs, and
+// the final slice is sorted to keep downstream comparisons stable. When the
+// input is empty we return an empty (non-nil) slice so callers can differentiate
+// between "no restriction" and "not provided" cases.
+func NormalizeAllowList(inputs []AllowListElement) ([]AllowListElement, error) {
+	if len(inputs) == 0 {
+		return []AllowListElement{}, nil
+	}
+	if len(inputs) > maxAllowListEntries {
+		return nil, xerrors.Errorf("allow_list has %d entries; max allowed is %d", len(inputs), maxAllowListEntries)
+	}
+
+	// Collapse typed wildcards and drop shadowed IDs
+	typedWildcard := map[string]struct{}{}
+	idsByType := map[string]map[string]struct{}{}
+	for _, e := range inputs {
+		// Global wildcard short-circuits
+		if e.Type == policy.WildcardSymbol && e.ID == policy.WildcardSymbol {
+			return []AllowListElement{AllowListAll()}, nil
+		}
+
+		if e.ID == policy.WildcardSymbol {
+			typedWildcard[e.Type] = struct{}{}
+			continue
+		}
+		if idsByType[e.Type] == nil {
+			idsByType[e.Type] = map[string]struct{}{}
+		}
+		idsByType[e.Type][e.ID] = struct{}{}
+	}
+
+	out := make([]AllowListElement, 0)
+	for t := range typedWildcard {
+		out = append(out, AllowListElement{Type: t, ID: policy.WildcardSymbol})
+	}
+	for t, ids := range idsByType {
+		if _, ok := typedWildcard[t]; ok {
+			continue
+		}
+		for id := range ids {
+			out = append(out, AllowListElement{Type: t, ID: id})
+		}
+	}
+
+	sort.Slice(out, func(i, j int) bool {
+		if out[i].Type == out[j].Type {
+			return out[i].ID < out[j].ID
+		}
+		return out[i].Type < out[j].Type
+	})
+	return out, nil
+}
+
+// UnionAllowLists merges multiple allow lists, returning the set of resources
+// permitted by any input. A global wildcard short-circuits the merge. When no
+// entries are present across all inputs, the result is an empty allow list.
+func UnionAllowLists(lists ...[]AllowListElement) ([]AllowListElement, error) {
+	union := make([]AllowListElement, 0)
+	seen := make(map[string]struct{})
+
+	for _, list := range lists {
+		for _, elem := range list {
+			if elem.Type == policy.WildcardSymbol && elem.ID == policy.WildcardSymbol {
+				return []AllowListElement{AllowListAll()}, nil
+			}
+			key := elem.String()
+			if _, ok := seen[key]; ok {
+				continue
+			}
+			seen[key] = struct{}{}
+			union = append(union, elem)
+		}
+	}
+
+	return NormalizeAllowList(union)
+}
+
+// IntersectAllowLists combines the allow list produced by RBAC expansion with the
+// API key's stored allow list. The result enforces both constraints: any
+// resource must be allowed by the scope *and* the database filter. Wildcards in
+// either list are respected and short-circuit appropriately.
+//
+// Intuition: scope definitions provide the *ceiling* of what a key could touch,
+// while the DB allow list can narrow that set. Technically, since this is
+// an intersection, both can narrow each other.
+//
+// A few illustrative cases:
+//
+//	| Scope AllowList   | DB AllowList                          | Result            |
+//	| ----------------- | ------------------------------------- | ----------------- |
+//	| `[*:*]`           | `[workspace:A]`                       | `[workspace:A]`   |
+//	| `[workspace:*]`   | `[workspace:A, workspace:B]`          | `[workspace:A, workspace:B]` |
+//	| `[workspace:A]`   | `[workspace:A, workspace:B]`          | `[workspace:A]`   |
+//	| `[]`              | `[workspace:A]`                       | `[workspace:A]`   |
+//
+// Today most API key scopes expand with an empty allow list (meaning "no
+// scope-level restriction"), so the merge simply mirrors what the database
+// stored. Only scopes that intentionally embed resource filters would trim the
+// DB entries.
+func IntersectAllowLists(scopeList []AllowListElement, dbList []AllowListElement) []AllowListElement {
+	// Empty DB list means no additional restriction.
+	if len(dbList) == 0 {
+		// Defensive: API keys should always persist a non-empty allow list, but
+		// we cannot have an empty allow list, thus we fail close.
+		return nil
+	}
+
+	// If scope already allows everything, the db list is authoritative.
+	scopeAll := allowListContainsAll(scopeList)
+	dbAll := allowListContainsAll(dbList)
+
+	switch {
+	case scopeAll && dbAll:
+		return []AllowListElement{AllowListAll()}
+	case scopeAll:
+		return dbList
+	case dbAll:
+		return scopeList
+	}
+
+	// Otherwise compute intersection.
+	resultSet := make(map[string]AllowListElement)
+	for _, scopeElem := range scopeList {
+		matching := intersectAllow(scopeElem, dbList)
+		for _, elem := range matching {
+			resultSet[elem.String()] = elem
+		}
+	}
+
+	if len(resultSet) == 0 {
+		return []AllowListElement{}
+	}
+
+	result := make([]AllowListElement, 0, len(resultSet))
+	for _, elem := range resultSet {
+		result = append(result, elem)
+	}
+
+	slices.SortFunc(result, func(a, b AllowListElement) int {
+		if a.Type == b.Type {
+			return strings.Compare(a.ID, b.ID)
+		}
+		return strings.Compare(a.Type, b.Type)
+	})
+
+	normalized, err := NormalizeAllowList(result)
+	if err != nil {
+		return result
+	}
+	if normalized == nil {
+		return []AllowListElement{}
+	}
+	return normalized
+}
+
+func allowListContainsAll(elements []AllowListElement) bool {
+	if len(elements) == 0 {
+		return false
+	}
+	for _, e := range elements {
+		if e.Type == policy.WildcardSymbol && e.ID == policy.WildcardSymbol {
+			return true
+		}
+	}
+	return false
+}
+
+// intersectAllow returns the set of permit entries that satisfy both the scope
+// element and the database allow list.
+func intersectAllow(scopeElem AllowListElement, dbList []AllowListElement) []AllowListElement {
+	// Scope element is wildcard -> intersection is db list.
+	if scopeElem.Type == policy.WildcardSymbol && scopeElem.ID == policy.WildcardSymbol {
+		return dbList
+	}
+
+	result := make([]AllowListElement, 0)
+	for _, dbElem := range dbList {
+		// DB entry wildcard -> keep scope element.
+		if dbElem.Type == policy.WildcardSymbol && dbElem.ID == policy.WildcardSymbol {
+			result = append(result, scopeElem)
+			continue
+		}
+
+		if !typeMatches(scopeElem.Type, dbElem.Type) {
+			continue
+		}
+
+		if !idMatches(scopeElem.ID, dbElem.ID) {
+			continue
+		}
+
+		result = append(result, AllowListElement{
+			Type: intersectType(scopeElem.Type, dbElem.Type),
+			ID:   intersectID(scopeElem.ID, dbElem.ID),
+		})
+	}
+	return result
+}
+
+func typeMatches(scopeType, dbType string) bool {
+	return scopeType == dbType || scopeType == policy.WildcardSymbol || dbType == policy.WildcardSymbol
+}
+
+func idMatches(scopeID, dbID string) bool {
+	return scopeID == dbID || scopeID == policy.WildcardSymbol || dbID == policy.WildcardSymbol
+}
+
+func intersectType(scopeType, dbType string) string {
+	if scopeType == dbType {
+		return scopeType
+	}
+	if scopeType == policy.WildcardSymbol {
+		return dbType
+	}
+	return scopeType
+}
+
+func intersectID(scopeID, dbID string) string {
+	switch {
+	case scopeID == dbID:
+		return scopeID
+	case scopeID == policy.WildcardSymbol:
+		return dbID
+	case dbID == policy.WildcardSymbol:
+		return scopeID
+	default:
+		// Should not happen when intersecting with matching IDs; fallback to scope ID.
+		return scopeID
+	}
+}
diff --git a/coderd/rbac/allowlist_test.go b/coderd/rbac/allowlist_test.go
new file mode 100644
index 0000000000000..3db5c4096b244
--- /dev/null
+++ b/coderd/rbac/allowlist_test.go
@@ -0,0 +1,231 @@
+package rbac_test
+
+import (
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/rbac/policy"
+)
+
+func TestParseAllowListEntry(t *testing.T) {
+	t.Parallel()
+	e, err := rbac.ParseAllowListEntry("*:*")
+	require.NoError(t, err)
+	require.Equal(t, rbac.AllowListElement{Type: "*", ID: "*"}, e)
+
+	e, err = rbac.ParseAllowListEntry("workspace:*")
+	require.NoError(t, err)
+	require.Equal(t, rbac.AllowListElement{Type: "workspace", ID: "*"}, e)
+
+	id := uuid.New().String()
+	e, err = rbac.ParseAllowListEntry("template:" + id)
+	require.NoError(t, err)
+	require.Equal(t, rbac.AllowListElement{Type: "template", ID: id}, e)
+
+	_, err = rbac.ParseAllowListEntry("unknown:*")
+	require.Error(t, err)
+	_, err = rbac.ParseAllowListEntry("workspace:bad-uuid")
+	require.Error(t, err)
+	_, err = rbac.ParseAllowListEntry(":")
+	require.Error(t, err)
+}
+
+func TestParseAllowListNormalize(t *testing.T) {
+	t.Parallel()
+	id1 := uuid.New().String()
+	id2 := uuid.New().String()
+
+	// Global wildcard short-circuits
+	out, err := rbac.ParseAllowList([]string{"workspace:" + id1, "*:*", "template:" + id2}, 128)
+	require.NoError(t, err)
+	require.Equal(t, []rbac.AllowListElement{{Type: "*", ID: "*"}}, out)
+
+	// Typed wildcard collapses typed ids
+	out, err = rbac.ParseAllowList([]string{"workspace:*", "workspace:" + id1, "workspace:" + id2}, 128)
+	require.NoError(t, err)
+	require.Equal(t, []rbac.AllowListElement{{Type: "workspace", ID: "*"}}, out)
+
+	// Typed wildcard entries persist even without explicit IDs
+	out, err = rbac.ParseAllowList([]string{"template:*"}, 128)
+	require.NoError(t, err)
+	require.Equal(t, []rbac.AllowListElement{{Type: "template", ID: "*"}}, out)
+
+	// Dedup ids and sort deterministically
+	out, err = rbac.ParseAllowList([]string{"template:" + id2, "template:" + id2, "template:" + id1}, 128)
+	require.NoError(t, err)
+	require.Len(t, out, 2)
+	require.Equal(t, "template", out[0].Type)
+	require.Equal(t, "template", out[1].Type)
+}
+
+func TestParseAllowListLimit(t *testing.T) {
+	t.Parallel()
+	inputs := make([]string, 0, 130)
+	for range 130 {
+		inputs = append(inputs, "workspace:"+uuid.New().String())
+	}
+	_, err := rbac.ParseAllowList(inputs, 128)
+	require.Error(t, err)
+}
+
+func TestIntersectAllowLists(t *testing.T) {
+	t.Parallel()
+
+	id := uuid.NewString()
+	id2 := uuid.NewString()
+
+	t.Run("scope_all_db_specific", func(t *testing.T) {
+		t.Parallel()
+		out := rbac.IntersectAllowLists(
+			[]rbac.AllowListElement{rbac.AllowListAll()},
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}},
+		)
+		require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, out)
+	})
+
+	t.Run("db_all_keeps_scope", func(t *testing.T) {
+		t.Parallel()
+		scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}}
+		out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}})
+		require.Equal(t, scopeList, out)
+	})
+
+	t.Run("typed_wildcard_intersection", func(t *testing.T) {
+		t.Parallel()
+		scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}}
+		out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}})
+		require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, out)
+	})
+
+	t.Run("db_wildcard_type_specific", func(t *testing.T) {
+		t.Parallel()
+		scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}
+		out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}})
+		require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}, out)
+	})
+
+	t.Run("disjoint_types", func(t *testing.T) {
+		t.Parallel()
+		scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}}
+		out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceTemplate.Type, ID: id}})
+		require.Empty(t, out)
+	})
+
+	t.Run("different_ids", func(t *testing.T) {
+		t.Parallel()
+		scopeList := []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: uuid.NewString()}}
+		out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id}})
+		require.Empty(t, out)
+	})
+
+	t.Run("multi_entry_overlap", func(t *testing.T) {
+		t.Parallel()
+		templateSpecific := uuid.NewString()
+		scopeList := []rbac.AllowListElement{
+			{Type: rbac.ResourceWorkspace.Type, ID: id},
+			{Type: rbac.ResourceWorkspace.Type, ID: id2},
+			{Type: rbac.ResourceTemplate.Type, ID: policy.WildcardSymbol},
+		}
+		out := rbac.IntersectAllowLists(scopeList, []rbac.AllowListElement{
+			{Type: rbac.ResourceWorkspace.Type, ID: id2},
+			{Type: rbac.ResourceTemplate.Type, ID: templateSpecific},
+			{Type: rbac.ResourceTemplate.Type, ID: policy.WildcardSymbol},
+		})
+		require.Equal(t, []rbac.AllowListElement{
+			{Type: rbac.ResourceTemplate.Type, ID: policy.WildcardSymbol},
+			{Type: rbac.ResourceWorkspace.Type, ID: id2},
+		}, out)
+	})
+
+	t.Run("multi_entry_db_wildcards", func(t *testing.T) {
+		t.Parallel()
+		templateID := uuid.NewString()
+		dbList := []rbac.AllowListElement{
+			{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol},
+			{Type: rbac.ResourceWorkspace.Type, ID: id},
+			{Type: rbac.ResourceTemplate.Type, ID: policy.WildcardSymbol},
+		}
+		out := rbac.IntersectAllowLists([]rbac.AllowListElement{
+			{Type: rbac.ResourceWorkspace.Type, ID: id},
+			{Type: rbac.ResourceTemplate.Type, ID: templateID},
+		}, dbList)
+		require.Equal(t, []rbac.AllowListElement{
+			{Type: rbac.ResourceWorkspace.Type, ID: id},
+			{Type: rbac.ResourceTemplate.Type, ID: templateID},
+		}, out)
+	})
+}
+
+func TestUnionAllowLists(t *testing.T) {
+	t.Parallel()
+
+	id1 := uuid.NewString()
+	id2 := uuid.NewString()
+
+	t.Run("wildcard_short_circuit", func(t *testing.T) {
+		t.Parallel()
+		out, err := rbac.UnionAllowLists(
+			[]rbac.AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}},
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}},
+		)
+		require.NoError(t, err)
+		require.Equal(t, []rbac.AllowListElement{rbac.AllowListAll()}, out)
+	})
+
+	t.Run("merge_unique_entries", func(t *testing.T) {
+		t.Parallel()
+		out, err := rbac.UnionAllowLists(
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}},
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id2}},
+		)
+		require.NoError(t, err)
+		require.Len(t, out, 2)
+		require.ElementsMatch(t, []rbac.AllowListElement{
+			{Type: rbac.ResourceWorkspace.Type, ID: id1},
+			{Type: rbac.ResourceWorkspace.Type, ID: id2},
+		}, out)
+	})
+
+	t.Run("typed_wildcard_collapse", func(t *testing.T) {
+		t.Parallel()
+		out, err := rbac.UnionAllowLists(
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}},
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}},
+		)
+		require.NoError(t, err)
+		require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: policy.WildcardSymbol}}, out)
+	})
+
+	t.Run("deduplicate_across_inputs", func(t *testing.T) {
+		t.Parallel()
+		out, err := rbac.UnionAllowLists(
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}},
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}},
+		)
+		require.NoError(t, err)
+		require.Equal(t, []rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}}, out)
+	})
+
+	t.Run("combine_multiple_types", func(t *testing.T) {
+		t.Parallel()
+		out, err := rbac.UnionAllowLists(
+			[]rbac.AllowListElement{{Type: rbac.ResourceWorkspace.Type, ID: id1}},
+			[]rbac.AllowListElement{{Type: rbac.ResourceTemplate.Type, ID: id2}},
+		)
+		require.NoError(t, err)
+		require.ElementsMatch(t, []rbac.AllowListElement{
+			{Type: rbac.ResourceTemplate.Type, ID: id2},
+			{Type: rbac.ResourceWorkspace.Type, ID: id1},
+		}, out)
+	})
+
+	t.Run("empty_returns_empty", func(t *testing.T) {
+		t.Parallel()
+		out, err := rbac.UnionAllowLists(nil, []rbac.AllowListElement{})
+		require.NoError(t, err)
+		require.Empty(t, out)
+	})
+}
diff --git a/coderd/rbac/scopes.go b/coderd/rbac/scopes.go
index 72a825003ccfb..ff8f08adb1e5b 100644
--- a/coderd/rbac/scopes.go
+++ b/coderd/rbac/scopes.go
@@ -236,7 +236,7 @@ func ExpandScope(scope ScopeName) (Scope, error) {
 				User:        []Permission{},
 			},
 			// Composites are site-level; allow-list empty by default
-			AllowIDList: []AllowListElement{},
+			AllowIDList: []AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}},
 		}, nil
 	}
 	if res, act, ok := parseLowLevelScope(scope); ok {
@@ -292,7 +292,7 @@ func expandLowLevel(resource string, action policy.Action) Scope {
 			Org:         map[string][]Permission{},
 			User:        []Permission{},
 		},
-		// Low-level scopes intentionally return an empty allow list.
-		AllowIDList: []AllowListElement{},
+		// Low-level scopes intentionally return a wildcard allow list.
+		AllowIDList: []AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}},
 	}
 }
diff --git a/coderd/rbac/scopes_test.go b/coderd/rbac/scopes_test.go
index d3c1bf8cfb1eb..a6f50b0326545 100644
--- a/coderd/rbac/scopes_test.go
+++ b/coderd/rbac/scopes_test.go
@@ -37,7 +37,7 @@ func TestExpandScope(t *testing.T) {
 				require.Empty(t, s.Org)
 				require.Empty(t, s.User)
 
-				require.Len(t, s.AllowIDList, 0)
+				require.Equal(t, []rbac.AllowListElement{rbac.AllowListAll()}, s.AllowIDList)
 			})
 		}
 	})
diff --git a/codersdk/allowlist.go b/codersdk/allowlist.go
new file mode 100644
index 0000000000000..48f8214537619
--- /dev/null
+++ b/codersdk/allowlist.go
@@ -0,0 +1,80 @@
+package codersdk
+
+import (
+	"encoding/json"
+	"strings"
+
+	"github.com/google/uuid"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/coderd/rbac/policy"
+)
+
+// APIAllowListTarget represents a single allow-list entry using the canonical
+// string form "<resource_type>:<id>". The wildcard symbol "*" is treated as a
+// permissive match for either side.
+type APIAllowListTarget struct {
+	Type RBACResource `json:"type"`
+	ID   string       `json:"id"`
+}
+
+func AllowAllTarget() APIAllowListTarget {
+	return APIAllowListTarget{Type: ResourceWildcard, ID: policy.WildcardSymbol}
+}
+
+func AllowTypeTarget(r RBACResource) APIAllowListTarget {
+	return APIAllowListTarget{Type: r, ID: policy.WildcardSymbol}
+}
+
+func AllowResourceTarget(r RBACResource, id uuid.UUID) APIAllowListTarget {
+	return APIAllowListTarget{Type: r, ID: id.String()}
+}
+
+// String returns the canonical string representation "<type>:<id>" with "*" wildcards.
+func (t APIAllowListTarget) String() string {
+	return string(t.Type) + ":" + t.ID
+}
+
+// MarshalJSON encodes as a JSON string: "<type>:<id>".
+func (t APIAllowListTarget) MarshalJSON() ([]byte, error) {
+	return json.Marshal(t.String())
+}
+
+// UnmarshalJSON decodes from a JSON string: "<type>:<id>".
+func (t *APIAllowListTarget) UnmarshalJSON(b []byte) error {
+	var s string
+	if err := json.Unmarshal(b, &s); err != nil {
+		return err
+	}
+	parts := strings.SplitN(strings.TrimSpace(s), ":", 2)
+	if len(parts) != 2 || parts[0] == "" || parts[1] == "" {
+		return xerrors.Errorf("invalid allow_list entry %q: want <type>:<id>", s)
+	}
+
+	resource, id := RBACResource(parts[0]), parts[1]
+
+	// Type
+	if resource != ResourceWildcard {
+		if _, ok := policy.RBACPermissions[string(resource)]; !ok {
+			return xerrors.Errorf("unknown resource type %q", resource)
+		}
+	}
+	t.Type = resource
+
+	// ID
+	if id != policy.WildcardSymbol {
+		if _, err := uuid.Parse(id); err != nil {
+			return xerrors.Errorf("invalid %s ID (must be UUID): %q", resource, id)
+		}
+	}
+	t.ID = id
+	return nil
+}
+
+// Implement encoding.TextMarshaler/Unmarshaler for broader compatibility
+
+func (t APIAllowListTarget) MarshalText() ([]byte, error) { return []byte(t.String()), nil }
+
+func (t *APIAllowListTarget) UnmarshalText(b []byte) error {
+	return t.UnmarshalJSON([]byte("\"" + string(b) + "\""))
+}
diff --git a/codersdk/allowlist_test.go b/codersdk/allowlist_test.go
new file mode 100644
index 0000000000000..46eec4549ec77
--- /dev/null
+++ b/codersdk/allowlist_test.go
@@ -0,0 +1,40 @@
+package codersdk_test
+
+import (
+	"encoding/json"
+	"testing"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/rbac/policy"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+func TestAPIAllowListTarget_JSONRoundTrip(t *testing.T) {
+	t.Parallel()
+
+	all := codersdk.AllowAllTarget()
+	b, err := json.Marshal(all)
+	require.NoError(t, err)
+	require.JSONEq(t, `"*:*"`, string(b))
+	var rt codersdk.APIAllowListTarget
+	require.NoError(t, json.Unmarshal(b, &rt))
+	require.Equal(t, codersdk.ResourceWildcard, rt.Type)
+	require.Equal(t, policy.WildcardSymbol, rt.ID)
+
+	ty := codersdk.AllowTypeTarget(codersdk.ResourceWorkspace)
+	b, err = json.Marshal(ty)
+	require.NoError(t, err)
+	require.JSONEq(t, `"workspace:*"`, string(b))
+	require.NoError(t, json.Unmarshal(b, &rt))
+	require.Equal(t, codersdk.ResourceWorkspace, rt.Type)
+	require.Equal(t, policy.WildcardSymbol, rt.ID)
+
+	id := uuid.New()
+	res := codersdk.AllowResourceTarget(codersdk.ResourceTemplate, id)
+	b, err = json.Marshal(res)
+	require.NoError(t, err)
+	exp := `"template:` + id.String() + `"`
+	require.JSONEq(t, exp, string(b))
+}
diff --git a/codersdk/apikey.go b/codersdk/apikey.go
index 82828fcd7d77a..ff5d749151e8f 100644
--- a/codersdk/apikey.go
+++ b/codersdk/apikey.go
@@ -44,10 +44,11 @@ const (
 type APIKeyScope string
 
 type CreateTokenRequest struct {
-	Lifetime  time.Duration `json:"lifetime"`
-	Scope     APIKeyScope   `json:"scope,omitempty"` // Deprecated: use Scopes instead.
-	Scopes    []APIKeyScope `json:"scopes,omitempty"`
-	TokenName string        `json:"token_name"`
+	Lifetime  time.Duration        `json:"lifetime"`
+	Scope     APIKeyScope          `json:"scope,omitempty"` // Deprecated: use Scopes instead.
+	Scopes    []APIKeyScope        `json:"scopes,omitempty"`
+	TokenName string               `json:"token_name"`
+	AllowList []APIAllowListTarget `json:"allow_list,omitempty"`
 }
 
 // GenerateAPIKeyResponse contains an API key for a user.
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 7b096078021a1..cb616c02e0d30 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -705,6 +705,22 @@
 |----------|----------------------------------------------------|----------|--------------|-------------|
 | `bridge` | [codersdk.AIBridgeConfig](#codersdkaibridgeconfig) | false    |              |             |
 
+## codersdk.APIAllowListTarget
+
+```json
+{
+  "id": "string",
+  "type": "*"
+}
+```
+
+### Properties
+
+| Name   | Type                                           | Required | Restrictions | Description |
+|--------|------------------------------------------------|----------|--------------|-------------|
+| `id`   | string                                         | false    |              |             |
+| `type` | [codersdk.RBACResource](#codersdkrbacresource) | false    |              |             |
+
 ## codersdk.APIKey
 
 ```json
@@ -2243,6 +2259,12 @@ This is required on creation to enable a user-flow of validating a template work
 
 ```json
 {
+  "allow_list": [
+    {
+      "id": "string",
+      "type": "*"
+    }
+  ],
   "lifetime": 0,
   "scope": "all",
   "scopes": [
@@ -2254,12 +2276,13 @@ This is required on creation to enable a user-flow of validating a template work
 
 ### Properties
 
-| Name         | Type                                                  | Required | Restrictions | Description                     |
-|--------------|-------------------------------------------------------|----------|--------------|---------------------------------|
-| `lifetime`   | integer                                               | false    |              |                                 |
-| `scope`      | [codersdk.APIKeyScope](#codersdkapikeyscope)          | false    |              | Deprecated: use Scopes instead. |
-| `scopes`     | array of [codersdk.APIKeyScope](#codersdkapikeyscope) | false    |              |                                 |
-| `token_name` | string                                                | false    |              |                                 |
+| Name         | Type                                                                | Required | Restrictions | Description                     |
+|--------------|---------------------------------------------------------------------|----------|--------------|---------------------------------|
+| `allow_list` | array of [codersdk.APIAllowListTarget](#codersdkapiallowlisttarget) | false    |              |                                 |
+| `lifetime`   | integer                                                             | false    |              |                                 |
+| `scope`      | [codersdk.APIKeyScope](#codersdkapikeyscope)                        | false    |              | Deprecated: use Scopes instead. |
+| `scopes`     | array of [codersdk.APIKeyScope](#codersdkapikeyscope)               | false    |              |                                 |
+| `token_name` | string                                                              | false    |              |                                 |
 
 ## codersdk.CreateUserRequestWithOrgs
 
diff --git a/docs/reference/api/users.md b/docs/reference/api/users.md
index 9815ba5406e33..0cfdd07c742dc 100644
--- a/docs/reference/api/users.md
+++ b/docs/reference/api/users.md
@@ -830,6 +830,12 @@ curl -X POST http://coder-server:8080/api/v2/users/{user}/keys/tokens \
 
 ```json
 {
+  "allow_list": [
+    {
+      "id": "string",
+      "type": "*"
+    }
+  ],
   "lifetime": 0,
   "scope": "all",
   "scopes": [
diff --git a/scripts/apitypings/main.go b/scripts/apitypings/main.go
index 1a2bab59a662b..c820bc4e1dec1 100644
--- a/scripts/apitypings/main.go
+++ b/scripts/apitypings/main.go
@@ -56,7 +56,7 @@ func main() {
 		log.Fatalf("to typescript: %v", err)
 	}
 
-	TsMutations(ts)
+	TSMutations(ts)
 
 	output, err := ts.Serialize()
 	if err != nil {
@@ -65,7 +65,7 @@ func main() {
 	_, _ = fmt.Println(output)
 }
 
-func TsMutations(ts *guts.Typescript) {
+func TSMutations(ts *guts.Typescript) {
 	ts.ApplyMutations(
 		// TODO: Remove 'NotNullMaps'. This is hiding potential bugs
 		//   of referencing maps that are actually null.
diff --git a/scripts/apitypings/main_test.go b/scripts/apitypings/main_test.go
index 1bb89c7ba5423..77b304e21518b 100644
--- a/scripts/apitypings/main_test.go
+++ b/scripts/apitypings/main_test.go
@@ -42,13 +42,20 @@ func TestGeneration(t *testing.T) {
 			err = gen.IncludeGenerate("./" + dir)
 			require.NoError(t, err)
 
+			// Include minimal references needed for tests that use external types.
+			for pkg, prefix := range map[string]string{
+				"github.com/google/uuid": "",
+			} {
+				require.NoError(t, gen.IncludeReference(pkg, prefix))
+			}
+
 			err = TypeMappings(gen)
 			require.NoError(t, err)
 
 			ts, err := gen.ToTypescript()
 			require.NoError(t, err)
 
-			TsMutations(ts)
+			TSMutations(ts)
 
 			output, err := ts.Serialize()
 			require.NoError(t, err)
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 1e07cf1aa2895..ebb9ed1a835c7 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -95,6 +95,12 @@ export interface AITasksPromptsResponse {
 	readonly prompts: Record<string, string>;
 }
 
+// From codersdk/allowlist.go
+export interface APIAllowListTarget {
+	readonly type: RBACResource;
+	readonly id: string;
+}
+
 // From codersdk/apikey.go
 export interface APIKey {
 	readonly id: string;
@@ -1007,6 +1013,7 @@ export interface CreateTokenRequest {
 	readonly scope?: APIKeyScope;
 	readonly scopes?: readonly APIKeyScope[];
 	readonly token_name: string;
+	readonly allow_list?: readonly APIAllowListTarget[];
 }
 
 // From codersdk/users.go

From 8f2394c2566488ed5685b55a4adfaa5d28e5b9b1 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Thu, 9 Oct 2025 10:09:37 -0300
Subject: [PATCH 097/298] chore: replace MUI tables (#20201)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I tried to break this work into smaller pieces, but since there are a
lot of dependent components, I decided to handle it in one larger chunk
and rely on Storybook to catch any bugs.

That said, let me know if you’d prefer a different approach!
---
 biome.jsonc                                   |   1 +
 site/e2e/api.ts                               |  12 +-
 site/e2e/tests/deployment/general.spec.ts     |   2 +-
 site/e2e/tests/deployment/security.spec.ts    |   2 +-
 site/src/components/Table/Table.tsx           |  35 ++-
 .../TableEmpty/TableEmpty.stories.tsx         |  16 +-
 site/src/components/TableEmpty/TableEmpty.tsx |   3 +-
 .../TableLoader/TableLoader.stories.tsx       |  16 +-
 .../components/TableLoader/TableLoader.tsx    |   7 +-
 .../components/Timeline/TimelineDateRow.tsx   |   3 +-
 .../src/components/Timeline/TimelineEntry.tsx |   2 +-
 .../AuditLogRow/AuditLogRow.stories.tsx       |  24 +-
 .../AuditPage/AuditLogRow/AuditLogRow.tsx     |   2 +-
 site/src/pages/AuditPage/AuditPageView.tsx    | 108 +++----
 .../ConnectionLogPageView.tsx                 | 103 +++---
 .../ConnectionLogRow.stories.tsx              |  13 +-
 .../ConnectionLogRow/ConnectionLogRow.tsx     |   2 +-
 .../AnnouncementBannerItem.tsx                |   3 +-
 .../AnnouncementBannerSettings.tsx            |  95 +++---
 .../ExternalAuthSettingsPageView.tsx          |  78 ++---
 .../EditOAuth2AppPageView.tsx                 |  72 ++---
 .../OAuth2AppsSettingsPageView.tsx            |  58 ++--
 .../DeploymentSettingsPage/OptionsTable.tsx   | 137 ++++----
 .../CreateEditRolePageView.tsx                | 107 +++----
 .../TemplateVersionsPage/VersionRow.tsx       |   2 +-
 .../TemplateVersionsPage/VersionsTable.tsx    |  70 ++---
 .../TemplatePermissionsPageView.tsx           | 296 +++++++++---------
 .../ExternalAuthPage/ExternalAuthPageView.tsx |  83 +++--
 .../OAuth2ProviderPageView.tsx                |  58 ++--
 .../TokensPage/TokensPageView.tsx             | 159 +++++-----
 .../WorkspaceProxyPage/WorkspaceProxyRow.tsx  |   3 +-
 .../WorkspaceProxyPage/WorkspaceProxyView.tsx |  76 +++--
 site/src/theme/mui.ts                         |  68 ----
 33 files changed, 795 insertions(+), 921 deletions(-)

diff --git a/biome.jsonc b/biome.jsonc
index d1258a77d65ae..9d369e6dab6df 100644
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -53,6 +53,7 @@
 							"@mui/material/Box": "Use a <div> instead.",
 							"@mui/material/Button": "Use a components/Button/Button instead.",
 							"@mui/material/styles": "Import from @emotion/react instead.",
+							"@mui/material/Table*": "Import from components/Table/Table instead.",
 							"lodash": "Use lodash/<name> instead."
 						}
 					}
diff --git a/site/e2e/api.ts b/site/e2e/api.ts
index 342b08cb28914..0a1765d464b26 100644
--- a/site/e2e/api.ts
+++ b/site/e2e/api.ts
@@ -213,7 +213,7 @@ export async function verifyConfigFlagBoolean(
 	const value = opt.value ? "Enabled" : "Disabled";
 
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .${type}`,
+		`table.options-table .option-${flag} .${type}`,
 	);
 	await expect(configOption).toHaveText(value);
 }
@@ -225,7 +225,7 @@ export async function verifyConfigFlagNumber(
 ) {
 	const opt = findConfigOption(config, flag);
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .option-value-number`,
+		`table.options-table .option-${flag} .option-value-number`,
 	);
 	await expect(configOption).toHaveText(String(opt.value));
 }
@@ -238,7 +238,7 @@ export async function verifyConfigFlagString(
 	const opt = findConfigOption(config, flag);
 
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .option-value-string`,
+		`table.options-table .option-${flag} .option-value-string`,
 	);
 	// biome-ignore lint/suspicious/noExplicitAny: opt.value is any
 	await expect(configOption).toHaveText(opt.value as any);
@@ -251,7 +251,7 @@ export async function verifyConfigFlagArray(
 ) {
 	const opt = findConfigOption(config, flag);
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .option-array`,
+		`table.options-table .option-${flag} .option-array`,
 	);
 
 	// Verify array of options with simple dots
@@ -268,7 +268,7 @@ export async function verifyConfigFlagEntries(
 ) {
 	const opt = findConfigOption(config, flag);
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .option-array`,
+		`table.options-table .option-${flag} .option-array`,
 	);
 
 	// Verify array of options with green marks.
@@ -296,7 +296,7 @@ export async function verifyConfigFlagDuration(
 		);
 	}
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .option-value-string`,
+		`table.options-table .option-${flag} .option-value-string`,
 	);
 	await expect(configOption).toHaveText(humanDuration(opt.value / 1e6));
 }
diff --git a/site/e2e/tests/deployment/general.spec.ts b/site/e2e/tests/deployment/general.spec.ts
index 40c8342e89929..a1dca0a820327 100644
--- a/site/e2e/tests/deployment/general.spec.ts
+++ b/site/e2e/tests/deployment/general.spec.ts
@@ -19,7 +19,7 @@ test("experiments", async ({ page }) => {
 	await page.goto("/deployment/overview", { waitUntil: "domcontentloaded" });
 
 	const experimentsLocator = page.locator(
-		"div.options-table tr.option-experiments ul.option-array",
+		"table.options-table tr.option-experiments ul.option-array",
 	);
 	await expect(experimentsLocator).toBeVisible();
 
diff --git a/site/e2e/tests/deployment/security.spec.ts b/site/e2e/tests/deployment/security.spec.ts
index 2d8bb0032691b..3f5e9a9b5c38f 100644
--- a/site/e2e/tests/deployment/security.spec.ts
+++ b/site/e2e/tests/deployment/security.spec.ts
@@ -47,7 +47,7 @@ async function verifyStrictTransportSecurity(
 	}
 
 	const configOption = page.locator(
-		`div.options-table .option-${flag} .option-value-string`,
+		`table.options-table .option-${flag} .option-value-string`,
 	);
 	await expect(configOption).toHaveText("Disabled");
 }
diff --git a/site/src/components/Table/Table.tsx b/site/src/components/Table/Table.tsx
index 03f13be1ee7af..99a8ba8187461 100644
--- a/site/src/components/Table/Table.tsx
+++ b/site/src/components/Table/Table.tsx
@@ -47,7 +47,7 @@ export const TableBody = React.forwardRef<
 	/>
 ));
 
-const _TableFooter = React.forwardRef<
+export const TableFooter = React.forwardRef<
 	HTMLTableSectionElement,
 	React.HTMLAttributes<HTMLTableSectionElement>
 >(({ className, ...props }, ref) => (
@@ -82,22 +82,23 @@ const tableRowVariants = cva(
 	},
 );
 
-export const TableRow = React.forwardRef<
-	HTMLTableRowElement,
-	React.HTMLAttributes<HTMLTableRowElement> &
-		VariantProps<typeof tableRowVariants>
->(({ className, hover, ...props }, ref) => (
-	<tr
-		ref={ref}
-		className={cn(
-			"border-0 border-b border-solid border-border transition-colors",
-			"data-[state=selected]:bg-muted",
-			tableRowVariants({ hover }),
-			className,
-		)}
-		{...props}
-	/>
-));
+export type TableRowProps = React.HTMLAttributes<HTMLTableRowElement> &
+	VariantProps<typeof tableRowVariants>;
+
+export const TableRow = React.forwardRef<HTMLTableRowElement, TableRowProps>(
+	({ className, hover, ...props }, ref) => (
+		<tr
+			ref={ref}
+			className={cn(
+				"border-0 border-b border-solid border-border transition-colors",
+				"data-[state=selected]:bg-muted",
+				tableRowVariants({ hover }),
+				className,
+			)}
+			{...props}
+		/>
+	),
+);
 
 export const TableHead = React.forwardRef<
 	HTMLTableCellElement,
diff --git a/site/src/components/TableEmpty/TableEmpty.stories.tsx b/site/src/components/TableEmpty/TableEmpty.stories.tsx
index 3165ed5fe6f6f..c189e3bfec890 100644
--- a/site/src/components/TableEmpty/TableEmpty.stories.tsx
+++ b/site/src/components/TableEmpty/TableEmpty.stories.tsx
@@ -1,8 +1,6 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableContainer from "@mui/material/TableContainer";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { CodeExample } from "components/CodeExample/CodeExample";
+import { Table, TableBody } from "components/Table/Table";
 import { TableEmpty } from "./TableEmpty";
 
 const meta: Meta<typeof TableEmpty> = {
@@ -13,13 +11,11 @@ const meta: Meta<typeof TableEmpty> = {
 	},
 	decorators: [
 		(Story) => (
-			<TableContainer>
-				<Table>
-					<TableBody>
-						<Story />
-					</TableBody>
-				</Table>
-			</TableContainer>
+			<Table>
+				<TableBody>
+					<Story />
+				</TableBody>
+			</Table>
 		),
 	],
 };
diff --git a/site/src/components/TableEmpty/TableEmpty.tsx b/site/src/components/TableEmpty/TableEmpty.tsx
index 4b1b72c5beff4..1dd2d08dbd469 100644
--- a/site/src/components/TableEmpty/TableEmpty.tsx
+++ b/site/src/components/TableEmpty/TableEmpty.tsx
@@ -1,9 +1,8 @@
-import TableCell from "@mui/material/TableCell";
-import TableRow from "@mui/material/TableRow";
 import {
 	EmptyState,
 	type EmptyStateProps,
 } from "components/EmptyState/EmptyState";
+import { TableCell, TableRow } from "components/Table/Table";
 import type { FC } from "react";
 
 type TableEmptyProps = EmptyStateProps;
diff --git a/site/src/components/TableLoader/TableLoader.stories.tsx b/site/src/components/TableLoader/TableLoader.stories.tsx
index 645b4e343c493..c15b4eba4825e 100644
--- a/site/src/components/TableLoader/TableLoader.stories.tsx
+++ b/site/src/components/TableLoader/TableLoader.stories.tsx
@@ -1,7 +1,5 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableContainer from "@mui/material/TableContainer";
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Table, TableBody } from "components/Table/Table";
 import { TableLoader } from "./TableLoader";
 
 const meta: Meta<typeof TableLoader> = {
@@ -9,13 +7,11 @@ const meta: Meta<typeof TableLoader> = {
 	component: TableLoader,
 	decorators: [
 		(Story) => (
-			<TableContainer>
-				<Table>
-					<TableBody>
-						<Story />
-					</TableBody>
-				</Table>
-			</TableContainer>
+			<Table>
+				<TableBody>
+					<Story />
+				</TableBody>
+			</Table>
 		),
 	],
 };
diff --git a/site/src/components/TableLoader/TableLoader.tsx b/site/src/components/TableLoader/TableLoader.tsx
index bdbb7efcd70ea..8b063b22a6dce 100644
--- a/site/src/components/TableLoader/TableLoader.tsx
+++ b/site/src/components/TableLoader/TableLoader.tsx
@@ -1,5 +1,8 @@
-import TableCell from "@mui/material/TableCell";
-import TableRow, { type TableRowProps } from "@mui/material/TableRow";
+import {
+	TableCell,
+	TableRow,
+	type TableRowProps,
+} from "components/Table/Table";
 import { cloneElement, type FC, isValidElement, type ReactNode } from "react";
 import { Loader } from "../Loader/Loader";
 
diff --git a/site/src/components/Timeline/TimelineDateRow.tsx b/site/src/components/Timeline/TimelineDateRow.tsx
index 3425b06abe05a..4f38f7b34a759 100644
--- a/site/src/components/Timeline/TimelineDateRow.tsx
+++ b/site/src/components/Timeline/TimelineDateRow.tsx
@@ -1,6 +1,5 @@
 import { css, useTheme } from "@emotion/react";
-import TableCell from "@mui/material/TableCell";
-import TableRow from "@mui/material/TableRow";
+import { TableCell, TableRow } from "components/Table/Table";
 import type { FC } from "react";
 import { createDisplayDate } from "./utils";
 
diff --git a/site/src/components/Timeline/TimelineEntry.tsx b/site/src/components/Timeline/TimelineEntry.tsx
index 727d5933c285d..2a9c15703267c 100644
--- a/site/src/components/Timeline/TimelineEntry.tsx
+++ b/site/src/components/Timeline/TimelineEntry.tsx
@@ -1,4 +1,4 @@
-import TableRow, { type TableRowProps } from "@mui/material/TableRow";
+import { TableRow, type TableRowProps } from "components/Table/Table";
 import { forwardRef } from "react";
 import { cn } from "utils/cn";
 
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx
index 03ccfcf38dbae..7bbf0a06d8f96 100644
--- a/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.stories.tsx
@@ -8,13 +8,8 @@ import {
 	MockAuditLogWithWorkspaceBuild,
 	MockUserOwner,
 } from "testHelpers/entities";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Table, TableBody } from "components/Table/Table";
 import { AuditLogRow } from "./AuditLogRow";
 
 const meta: Meta<typeof AuditLogRow> = {
@@ -22,18 +17,11 @@ const meta: Meta<typeof AuditLogRow> = {
 	component: AuditLogRow,
 	decorators: [
 		(Story) => (
-			<TableContainer>
-				<Table>
-					<TableHead>
-						<TableRow>
-							<TableCell style={{ paddingLeft: 32 }}>Logs</TableCell>
-						</TableRow>
-					</TableHead>
-					<TableBody>
-						<Story />
-					</TableBody>
-				</Table>
-			</TableContainer>
+			<Table>
+				<TableBody>
+					<Story />
+				</TableBody>
+			</Table>
 		),
 	],
 };
diff --git a/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx
index 9661fbab59e75..a1422e95deab6 100644
--- a/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx
+++ b/site/src/pages/AuditPage/AuditLogRow/AuditLogRow.tsx
@@ -1,13 +1,13 @@
 import type { CSSObject, Interpolation, Theme } from "@emotion/react";
 import Collapse from "@mui/material/Collapse";
 import Link from "@mui/material/Link";
-import TableCell from "@mui/material/TableCell";
 import Tooltip from "@mui/material/Tooltip";
 import type { AuditLog, BuildReason } from "api/typesGenerated";
 import { Avatar } from "components/Avatar/Avatar";
 import { DropdownArrow } from "components/DropdownArrow/DropdownArrow";
 import { Stack } from "components/Stack/Stack";
 import { StatusPill } from "components/StatusPill/StatusPill";
+import { TableCell } from "components/Table/Table";
 import { TimelineEntry } from "components/Timeline/TimelineEntry";
 import { InfoIcon, NetworkIcon } from "lucide-react";
 import { type FC, useState } from "react";
diff --git a/site/src/pages/AuditPage/AuditPageView.tsx b/site/src/pages/AuditPage/AuditPageView.tsx
index ed19092c0a640..080c3a0b2aaab 100644
--- a/site/src/pages/AuditPage/AuditPageView.tsx
+++ b/site/src/pages/AuditPage/AuditPageView.tsx
@@ -1,8 +1,3 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableRow from "@mui/material/TableRow";
 import type { AuditLog } from "api/typesGenerated";
 import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
 import { EmptyState } from "components/EmptyState/EmptyState";
@@ -18,6 +13,7 @@ import {
 } from "components/PaginationWidget/PaginationContainer";
 import { Paywall } from "components/Paywall/Paywall";
 import { Stack } from "components/Stack/Stack";
+import { Table, TableBody, TableCell, TableRow } from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import { Timeline } from "components/Timeline/Timeline";
 import type { ComponentProps, FC } from "react";
@@ -76,62 +72,60 @@ export const AuditPageView: FC<AuditPageViewProps> = ({
 						query={paginationResult}
 						paginationUnitLabel="logs"
 					>
-						<TableContainer>
-							<Table>
-								<TableBody>
-									<ChooseOne>
-										{/* Error condition should just show an empty table. */}
-										<Cond condition={Boolean(error)}>
-											<TableRow>
-												<TableCell colSpan={999}>
-													<EmptyState message="An error occurred while loading audit logs" />
-												</TableCell>
-											</TableRow>
-										</Cond>
+						<Table>
+							<TableBody>
+								<ChooseOne>
+									{/* Error condition should just show an empty table. */}
+									<Cond condition={Boolean(error)}>
+										<TableRow>
+											<TableCell colSpan={999}>
+												<EmptyState message="An error occurred while loading audit logs" />
+											</TableCell>
+										</TableRow>
+									</Cond>
 
-										<Cond condition={isLoading}>
-											<TableLoader />
-										</Cond>
+									<Cond condition={isLoading}>
+										<TableLoader />
+									</Cond>
 
-										<Cond condition={isEmpty}>
-											<ChooseOne>
-												<Cond condition={isNonInitialPage}>
-													<TableRow>
-														<TableCell colSpan={999}>
-															<EmptyState message="No audit logs available on this page" />
-														</TableCell>
-													</TableRow>
-												</Cond>
+									<Cond condition={isEmpty}>
+										<ChooseOne>
+											<Cond condition={isNonInitialPage}>
+												<TableRow>
+													<TableCell colSpan={999}>
+														<EmptyState message="No audit logs available on this page" />
+													</TableCell>
+												</TableRow>
+											</Cond>
 
-												<Cond>
-													<TableRow>
-														<TableCell colSpan={999}>
-															<EmptyState message="No audit logs available" />
-														</TableCell>
-													</TableRow>
-												</Cond>
-											</ChooseOne>
-										</Cond>
+											<Cond>
+												<TableRow>
+													<TableCell colSpan={999}>
+														<EmptyState message="No audit logs available" />
+													</TableCell>
+												</TableRow>
+											</Cond>
+										</ChooseOne>
+									</Cond>
 
-										<Cond>
-											{auditLogs && (
-												<Timeline
-													items={auditLogs}
-													getDate={(log) => new Date(log.time)}
-													row={(log) => (
-														<AuditLogRow
-															key={log.id}
-															auditLog={log}
-															showOrgDetails={showOrgDetails}
-														/>
-													)}
-												/>
-											)}
-										</Cond>
-									</ChooseOne>
-								</TableBody>
-							</Table>
-						</TableContainer>
+									<Cond>
+										{auditLogs && (
+											<Timeline
+												items={auditLogs}
+												getDate={(log) => new Date(log.time)}
+												row={(log) => (
+													<AuditLogRow
+														key={log.id}
+														auditLog={log}
+														showOrgDetails={showOrgDetails}
+													/>
+												)}
+											/>
+										)}
+									</Cond>
+								</ChooseOne>
+							</TableBody>
+						</Table>
 					</PaginationContainer>
 				</Cond>
 
diff --git a/site/src/pages/ConnectionLogPage/ConnectionLogPageView.tsx b/site/src/pages/ConnectionLogPage/ConnectionLogPageView.tsx
index 0fcadf085f7ff..b1223c1ee023a 100644
--- a/site/src/pages/ConnectionLogPage/ConnectionLogPageView.tsx
+++ b/site/src/pages/ConnectionLogPage/ConnectionLogPageView.tsx
@@ -1,8 +1,3 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableRow from "@mui/material/TableRow";
 import type { ConnectionLog } from "api/typesGenerated";
 import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
 import { EmptyState } from "components/EmptyState/EmptyState";
@@ -18,6 +13,7 @@ import {
 } from "components/PaginationWidget/PaginationContainer";
 import { Paywall } from "components/Paywall/Paywall";
 import { Stack } from "components/Stack/Stack";
+import { Table, TableBody, TableCell, TableRow } from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import { Timeline } from "components/Timeline/Timeline";
 import type { ComponentProps, FC } from "react";
@@ -75,61 +71,56 @@ export const ConnectionLogPageView: FC<ConnectionLogPageViewProps> = ({
 						query={paginationResult}
 						paginationUnitLabel="logs"
 					>
-						<TableContainer>
-							<Table>
-								<TableBody>
-									<ChooseOne>
-										{/* Error condition should just show an empty table. */}
-										<Cond condition={Boolean(error)}>
-											<TableRow>
-												<TableCell colSpan={999}>
-													<EmptyState message="An error occurred while loading connection logs" />
-												</TableCell>
-											</TableRow>
-										</Cond>
+						<Table>
+							<TableBody>
+								<ChooseOne>
+									{/* Error condition should just show an empty table. */}
+									<Cond condition={Boolean(error)}>
+										<TableRow>
+											<TableCell colSpan={999}>
+												<EmptyState message="An error occurred while loading connection logs" />
+											</TableCell>
+										</TableRow>
+									</Cond>
 
-										<Cond condition={isLoading}>
-											<TableLoader />
-										</Cond>
+									<Cond condition={isLoading}>
+										<TableLoader />
+									</Cond>
 
-										<Cond condition={isEmpty}>
-											<ChooseOne>
-												<Cond condition={isNonInitialPage}>
-													<TableRow>
-														<TableCell colSpan={999}>
-															<EmptyState message="No connection logs available on this page" />
-														</TableCell>
-													</TableRow>
-												</Cond>
+									<Cond condition={isEmpty}>
+										<ChooseOne>
+											<Cond condition={isNonInitialPage}>
+												<TableRow>
+													<TableCell colSpan={999}>
+														<EmptyState message="No connection logs available on this page" />
+													</TableCell>
+												</TableRow>
+											</Cond>
 
-												<Cond>
-													<TableRow>
-														<TableCell colSpan={999}>
-															<EmptyState message="No connection logs available" />
-														</TableCell>
-													</TableRow>
-												</Cond>
-											</ChooseOne>
-										</Cond>
+											<Cond>
+												<TableRow>
+													<TableCell colSpan={999}>
+														<EmptyState message="No connection logs available" />
+													</TableCell>
+												</TableRow>
+											</Cond>
+										</ChooseOne>
+									</Cond>
 
-										<Cond>
-											{connectionLogs && (
-												<Timeline
-													items={connectionLogs}
-													getDate={(log) => new Date(log.connect_time)}
-													row={(log) => (
-														<ConnectionLogRow
-															key={log.id}
-															connectionLog={log}
-														/>
-													)}
-												/>
-											)}
-										</Cond>
-									</ChooseOne>
-								</TableBody>
-							</Table>
-						</TableContainer>
+									<Cond>
+										{connectionLogs && (
+											<Timeline
+												items={connectionLogs}
+												getDate={(log) => new Date(log.connect_time)}
+												row={(log) => (
+													<ConnectionLogRow key={log.id} connectionLog={log} />
+												)}
+											/>
+										)}
+									</Cond>
+								</ChooseOne>
+							</TableBody>
+						</Table>
 					</PaginationContainer>
 				</Cond>
 
diff --git a/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.stories.tsx b/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.stories.tsx
index 03833917e5bf4..c52f533eb2075 100644
--- a/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.stories.tsx
+++ b/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.stories.tsx
@@ -3,7 +3,6 @@ import {
 	MockDisconnectedSSHConnectionLog,
 	MockWebConnectionLog,
 } from "testHelpers/entities";
-import TableContainer from "@mui/material/TableContainer";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { Table, TableBody } from "components/Table/Table";
 import { ConnectionLogRow } from "./ConnectionLogRow";
@@ -13,13 +12,11 @@ const meta: Meta<typeof ConnectionLogRow> = {
 	component: ConnectionLogRow,
 	decorators: [
 		(Story) => (
-			<TableContainer>
-				<Table>
-					<TableBody>
-						<Story />
-					</TableBody>
-				</Table>
-			</TableContainer>
+			<Table>
+				<TableBody>
+					<Story />
+				</TableBody>
+			</Table>
 		),
 	],
 };
diff --git a/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.tsx b/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.tsx
index f66afde786e5f..f9d14432d4e91 100644
--- a/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.tsx
+++ b/site/src/pages/ConnectionLogPage/ConnectionLogRow/ConnectionLogRow.tsx
@@ -1,11 +1,11 @@
 import type { CSSObject, Interpolation, Theme } from "@emotion/react";
 import Link from "@mui/material/Link";
-import TableCell from "@mui/material/TableCell";
 import Tooltip from "@mui/material/Tooltip";
 import type { ConnectionLog } from "api/typesGenerated";
 import { Avatar } from "components/Avatar/Avatar";
 import { Stack } from "components/Stack/Stack";
 import { StatusPill } from "components/StatusPill/StatusPill";
+import { TableCell } from "components/Table/Table";
 import { TimelineEntry } from "components/Timeline/TimelineEntry";
 import { InfoIcon, NetworkIcon } from "lucide-react";
 import type { FC } from "react";
diff --git a/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerItem.tsx b/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerItem.tsx
index 9f72601ea9607..2b7b777e6e03b 100644
--- a/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerItem.tsx
+++ b/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerItem.tsx
@@ -1,7 +1,5 @@
 import type { Interpolation, Theme } from "@emotion/react";
 import Checkbox from "@mui/material/Checkbox";
-import TableCell from "@mui/material/TableCell";
-import TableRow from "@mui/material/TableRow";
 import type { BannerConfig } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import {
@@ -10,6 +8,7 @@ import {
 	DropdownMenuItem,
 	DropdownMenuTrigger,
 } from "components/DropdownMenu/DropdownMenu";
+import { TableCell, TableRow } from "components/Table/Table";
 import { EllipsisVertical } from "lucide-react";
 import type { FC } from "react";
 
diff --git a/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerSettings.tsx b/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerSettings.tsx
index d2625973065a6..fb9978f84d1fa 100644
--- a/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerSettings.tsx
+++ b/site/src/pages/DeploymentSettingsPage/AppearanceSettingsPage/AnnouncementBannerSettings.tsx
@@ -1,16 +1,18 @@
 import { type CSSObject, useTheme } from "@emotion/react";
 import Link from "@mui/material/Link";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type { BannerConfig } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
 import { EmptyState } from "components/EmptyState/EmptyState";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { PlusIcon } from "lucide-react";
 import { type FC, useState } from "react";
 import { AnnouncementBannerDialog } from "./AnnouncementBannerDialog";
@@ -71,7 +73,7 @@ export const AnnouncementBannerSettings: FC<
 					overflow: "hidden",
 				}}
 			>
-				<div css={{ padding: "24px 24px 0" }}>
+				<div className="p-6">
 					<Stack
 						direction="row"
 						justifyContent="space-between"
@@ -105,49 +107,42 @@ export const AnnouncementBannerSettings: FC<
 						Display message banners to all users.
 					</div>
 
-					<div
-						css={[
-							theme.typography.body2 as CSSObject,
-							{ paddingTop: 16, margin: "0 -32px" },
-						]}
-					>
-						<TableContainer css={{ borderRadius: 0, borderBottom: "none" }}>
-							<Table>
-								<TableHead>
-									<TableRow>
-										<TableCell width="1%">Enabled</TableCell>
-										<TableCell>Message</TableCell>
-										<TableCell width="2%">Color</TableCell>
-										<TableCell width="1%" />
-									</TableRow>
-								</TableHead>
-								<TableBody>
-									{!isEntitled || banners.length < 1 ? (
-										<TableCell colSpan={999}>
-											<EmptyState
-												className="min-h-[160px]"
-												message="No announcement banners"
-											/>
-										</TableCell>
-									) : (
-										banners.map((banner, i) => (
-											<AnnouncementBannerItem
-												key={banner.message}
-												enabled={banner.enabled && Boolean(banner.message)}
-												backgroundColor={banner.background_color}
-												message={banner.message}
-												onEdit={() => setEditingBannerId(i)}
-												onUpdate={async (banner) => {
-													const newBanners = updateBanner(i, banner);
-													await onSubmit(newBanners);
-												}}
-												onDelete={() => setDeletingBannerId(i)}
-											/>
-										))
-									)}
-								</TableBody>
-							</Table>
-						</TableContainer>
+					<div css={[theme.typography.body2 as CSSObject, { paddingTop: 16 }]}>
+						<Table>
+							<TableHeader>
+								<TableRow>
+									<TableHead className="w-[1%]">Enabled</TableHead>
+									<TableHead>Message</TableHead>
+									<TableHead className="w-[2%]">Color</TableHead>
+									<TableHead className="w-[1%]" />
+								</TableRow>
+							</TableHeader>
+							<TableBody>
+								{!isEntitled || banners.length < 1 ? (
+									<TableCell colSpan={999}>
+										<EmptyState
+											className="min-h-[160px]"
+											message="No announcement banners"
+										/>
+									</TableCell>
+								) : (
+									banners.map((banner, i) => (
+										<AnnouncementBannerItem
+											key={banner.message}
+											enabled={banner.enabled && Boolean(banner.message)}
+											backgroundColor={banner.background_color}
+											message={banner.message}
+											onEdit={() => setEditingBannerId(i)}
+											onUpdate={async (banner) => {
+												const newBanners = updateBanner(i, banner);
+												await onSubmit(newBanners);
+											}}
+											onDelete={() => setDeletingBannerId(i)}
+										/>
+									))
+								)}
+							</TableBody>
+						</Table>
 					</div>
 				</div>
 
diff --git a/site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx
index ad61a7c188b3b..1f7d2d59ecc6a 100644
--- a/site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/ExternalAuthSettingsPage/ExternalAuthSettingsPageView.tsx
@@ -1,10 +1,4 @@
 import { css } from "@emotion/react";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type { DeploymentValues, ExternalAuthConfig } from "api/typesGenerated";
 import { Alert } from "components/Alert/Alert";
 import { PremiumBadge } from "components/Badges/Badges";
@@ -14,6 +8,14 @@ import {
 	SettingsHeaderDocsLink,
 	SettingsHeaderTitle,
 } from "components/SettingsHeader/SettingsHeader";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import type { FC } from "react";
 import { docs } from "utils/docs";
 
@@ -60,9 +62,8 @@ export const ExternalAuthSettingsPageView: FC<
 				</Alert>
 			</div>
 
-			<TableContainer>
-				<Table
-					css={css`
+			<Table
+				css={css`
             & td {
               padding-top: 24px;
               padding-bottom: 24px;
@@ -73,38 +74,37 @@ export const ExternalAuthSettingsPageView: FC<
               padding-left: 32px;
             }
           `}
-				>
-					<TableHead>
+			>
+				<TableHeader>
+					<TableRow>
+						<TableHead className="w-1/3">ID</TableHead>
+						<TableHead className="w-1/3">Client ID</TableHead>
+						<TableHead className="w-1/3">Match</TableHead>
+					</TableRow>
+				</TableHeader>
+				<TableBody>
+					{((config.external_auth === null ||
+						config.external_auth?.length === 0) && (
 						<TableRow>
-							<TableCell width="25%">ID</TableCell>
-							<TableCell width="25%">Client ID</TableCell>
-							<TableCell width="25%">Match</TableCell>
+							<TableCell colSpan={999}>
+								<div css={{ textAlign: "center" }}>
+									No providers have been configured!
+								</div>
+							</TableCell>
 						</TableRow>
-					</TableHead>
-					<TableBody>
-						{((config.external_auth === null ||
-							config.external_auth?.length === 0) && (
-							<TableRow>
-								<TableCell colSpan={999}>
-									<div css={{ textAlign: "center" }}>
-										No providers have been configured!
-									</div>
-								</TableCell>
-							</TableRow>
-						)) ||
-							config.external_auth?.map((git: ExternalAuthConfig) => {
-								const name = git.id || git.type;
-								return (
-									<TableRow key={name}>
-										<TableCell>{name}</TableCell>
-										<TableCell>{git.client_id}</TableCell>
-										<TableCell>{git.regex || "Not Set"}</TableCell>
-									</TableRow>
-								);
-							})}
-					</TableBody>
-				</Table>
-			</TableContainer>
+					)) ||
+						config.external_auth?.map((git: ExternalAuthConfig) => {
+							const name = git.id || git.type;
+							return (
+								<TableRow key={name}>
+									<TableCell>{name}</TableCell>
+									<TableCell>{git.client_id}</TableCell>
+									<TableCell>{git.regex || "Not Set"}</TableCell>
+								</TableRow>
+							);
+						})}
+				</TableBody>
+			</Table>
 		</>
 	);
 };
diff --git a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/EditOAuth2AppPageView.tsx b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/EditOAuth2AppPageView.tsx
index 8b18d462e794c..73149d2a30645 100644
--- a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/EditOAuth2AppPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/EditOAuth2AppPageView.tsx
@@ -1,11 +1,5 @@
 import { type Interpolation, type Theme, useTheme } from "@emotion/react";
 import Divider from "@mui/material/Divider";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type * as TypesGen from "api/typesGenerated";
 import { Alert } from "components/Alert/Alert";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
@@ -22,6 +16,14 @@ import {
 } from "components/SettingsHeader/SettingsHeader";
 import { Spinner } from "components/Spinner/Spinner";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import { ChevronLeftIcon, CopyIcon } from "lucide-react";
 import { type FC, useState } from "react";
@@ -233,38 +235,36 @@ const OAuth2AppSecretsTable: FC<OAuth2AppSecretsTableProps> = ({
 				</Button>
 			</Stack>
 
-			<TableContainer>
-				<Table>
-					<TableHead>
+			<Table>
+				<TableHeader>
+					<TableRow>
+						<TableHead className="w-[80%]">Secret</TableHead>
+						<TableHead className="w-[20%]">Last Used</TableHead>
+						<TableHead className="w-[1%]" />
+					</TableRow>
+				</TableHeader>
+				<TableBody>
+					{isLoadingSecrets && <TableLoader />}
+					{!isLoadingSecrets && (!secrets || secrets.length === 0) && (
 						<TableRow>
-							<TableCell width="80%">Secret</TableCell>
-							<TableCell width="20%">Last Used</TableCell>
-							<TableCell width="1%" />
+							<TableCell colSpan={999}>
+								<div css={{ textAlign: "center" }}>
+									No client secrets have been generated.
+								</div>
+							</TableCell>
 						</TableRow>
-					</TableHead>
-					<TableBody>
-						{isLoadingSecrets && <TableLoader />}
-						{!isLoadingSecrets && (!secrets || secrets.length === 0) && (
-							<TableRow>
-								<TableCell colSpan={999}>
-									<div css={{ textAlign: "center" }}>
-										No client secrets have been generated.
-									</div>
-								</TableCell>
-							</TableRow>
-						)}
-						{!isLoadingSecrets &&
-							secrets?.map((secret) => (
-								<OAuth2SecretRow
-									key={secret.id}
-									secret={secret}
-									mutatingResource={mutatingResource}
-									deleteAppSecret={deleteAppSecret}
-								/>
-							))}
-					</TableBody>
-				</Table>
-			</TableContainer>
+					)}
+					{!isLoadingSecrets &&
+						secrets?.map((secret) => (
+							<OAuth2SecretRow
+								key={secret.id}
+								secret={secret}
+								mutatingResource={mutatingResource}
+								deleteAppSecret={deleteAppSecret}
+							/>
+						))}
+				</TableBody>
+			</Table>
 		</>
 	);
 };
diff --git a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
index 4b42f946758b8..da72549e420e4 100644
--- a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
@@ -1,10 +1,4 @@
 import { useTheme } from "@emotion/react";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type * as TypesGen from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { Avatar } from "components/Avatar/Avatar";
@@ -15,6 +9,14 @@ import {
 	SettingsHeaderTitle,
 } from "components/SettingsHeader/SettingsHeader";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import { useClickableTableRow } from "hooks/useClickableTableRow";
 import { ChevronRightIcon, PlusIcon } from "lucide-react";
@@ -58,31 +60,29 @@ const OAuth2AppsSettingsPageView: FC<OAuth2AppsSettingsProps> = ({
 
 			{error && <ErrorAlert error={error} />}
 
-			<TableContainer css={{ marginTop: 32 }}>
-				<Table>
-					<TableHead>
+			<Table className="mt-8">
+				<TableHeader>
+					<TableRow>
+						<TableHead>Name</TableHead>
+						<TableHead className="w-[1%]" />
+					</TableRow>
+				</TableHeader>
+				<TableBody>
+					{isLoading && <TableLoader />}
+					{apps?.map((app) => (
+						<OAuth2AppRow key={app.id} app={app} />
+					))}
+					{apps?.length === 0 && (
 						<TableRow>
-							<TableCell width="100%">Name</TableCell>
-							<TableCell width="1%" />
+							<TableCell colSpan={999}>
+								<div css={{ textAlign: "center" }}>
+									No OAuth2 applications have been configured.
+								</div>
+							</TableCell>
 						</TableRow>
-					</TableHead>
-					<TableBody>
-						{isLoading && <TableLoader />}
-						{apps?.map((app) => (
-							<OAuth2AppRow key={app.id} app={app} />
-						))}
-						{apps?.length === 0 && (
-							<TableRow>
-								<TableCell colSpan={999}>
-									<div css={{ textAlign: "center" }}>
-										No OAuth2 applications have been configured.
-									</div>
-								</TableCell>
-							</TableRow>
-						)}
-					</TableBody>
-				</Table>
-			</TableContainer>
+					)}
+				</TableBody>
+			</Table>
 		</>
 	);
 };
diff --git a/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx b/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx
index ea9fadb4b0c72..11b5182e566cc 100644
--- a/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx
+++ b/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx
@@ -1,11 +1,13 @@
 import { css } from "@emotion/react";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type { SerpentOption } from "api/typesGenerated";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import type { FC } from "react";
 import {
 	OptionConfig,
@@ -27,9 +29,9 @@ const OptionsTable: FC<OptionsTableProps> = ({ options, additionalValues }) => {
 	}
 
 	return (
-		<TableContainer className="options-table">
-			<Table
-				css={css`
+		<Table
+			className="options-table"
+			css={css`
           & td {
             padding-top: 24px;
             padding-bottom: 24px;
@@ -40,66 +42,65 @@ const OptionsTable: FC<OptionsTableProps> = ({ options, additionalValues }) => {
             padding-left: 32px;
           }
         `}
-			>
-				<TableHead>
-					<TableRow>
-						<TableCell width="50%">Option</TableCell>
-						<TableCell width="50%">Value</TableCell>
-					</TableRow>
-				</TableHead>
-				<TableBody>
-					{Object.values(options).map((option) => {
-						return (
-							<TableRow key={option.flag} className={`option-${option.flag}`}>
-								<TableCell>
-									<OptionName>{option.name}</OptionName>
-									<OptionDescription>{option.description}</OptionDescription>
-									<div
-										css={{
-											marginTop: 24,
-											display: "flex",
-											flexWrap: "wrap",
-											gap: 8,
-										}}
-									>
-										{option.flag && (
-											<OptionConfig isSource={option.value_source === "flag"}>
-												<OptionConfigFlag>CLI</OptionConfigFlag>
-												--{option.flag}
-											</OptionConfig>
-										)}
-										{option.flag_shorthand && (
-											<OptionConfig isSource={option.value_source === "flag"}>
-												<OptionConfigFlag>CLI</OptionConfigFlag>-
-												{option.flag_shorthand}
-											</OptionConfig>
-										)}
-										{option.env && (
-											<OptionConfig isSource={option.value_source === "env"}>
-												<OptionConfigFlag>ENV</OptionConfigFlag>
-												{option.env}
-											</OptionConfig>
-										)}
-										{option.yaml && (
-											<OptionConfig isSource={option.value_source === "yaml"}>
-												<OptionConfigFlag>YAML</OptionConfigFlag>
-												{option.yaml}
-											</OptionConfig>
-										)}
-									</div>
-								</TableCell>
+		>
+			<TableHeader>
+				<TableRow>
+					<TableHead className="w-1/2">Option</TableHead>
+					<TableHead className="w-1/2">Value</TableHead>
+				</TableRow>
+			</TableHeader>
+			<TableBody>
+				{Object.values(options).map((option) => {
+					return (
+						<TableRow key={option.flag} className={`option-${option.flag}`}>
+							<TableCell>
+								<OptionName>{option.name}</OptionName>
+								<OptionDescription>{option.description}</OptionDescription>
+								<div
+									css={{
+										marginTop: 24,
+										display: "flex",
+										flexWrap: "wrap",
+										gap: 8,
+									}}
+								>
+									{option.flag && (
+										<OptionConfig isSource={option.value_source === "flag"}>
+											<OptionConfigFlag>CLI</OptionConfigFlag>
+											--{option.flag}
+										</OptionConfig>
+									)}
+									{option.flag_shorthand && (
+										<OptionConfig isSource={option.value_source === "flag"}>
+											<OptionConfigFlag>CLI</OptionConfigFlag>-
+											{option.flag_shorthand}
+										</OptionConfig>
+									)}
+									{option.env && (
+										<OptionConfig isSource={option.value_source === "env"}>
+											<OptionConfigFlag>ENV</OptionConfigFlag>
+											{option.env}
+										</OptionConfig>
+									)}
+									{option.yaml && (
+										<OptionConfig isSource={option.value_source === "yaml"}>
+											<OptionConfigFlag>YAML</OptionConfigFlag>
+											{option.yaml}
+										</OptionConfig>
+									)}
+								</div>
+							</TableCell>
 
-								<TableCell>
-									<OptionValue>
-										{optionValue(option, additionalValues)}
-									</OptionValue>
-								</TableCell>
-							</TableRow>
-						);
-					})}
-				</TableBody>
-			</Table>
-		</TableContainer>
+							<TableCell>
+								<OptionValue>
+									{optionValue(option, additionalValues)}
+								</OptionValue>
+							</TableCell>
+						</TableRow>
+					);
+				})}
+			</TableBody>
+		</Table>
 	);
 };
 
diff --git a/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx b/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx
index 93ebabdae4ccb..97a2030071a45 100644
--- a/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx
+++ b/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx
@@ -1,13 +1,6 @@
 import type { Interpolation, Theme } from "@emotion/react";
 import Checkbox from "@mui/material/Checkbox";
 import FormControlLabel from "@mui/material/FormControlLabel";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableFooter from "@mui/material/TableFooter";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import TextField from "@mui/material/TextField";
 import { isApiValidationError } from "api/errors";
 import { RBACResourceActions } from "api/rbacresourcesGenerated";
@@ -29,6 +22,15 @@ import {
 } from "components/SettingsHeader/SettingsHeader";
 import { Spinner } from "components/Spinner/Spinner";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableFooter,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { useFormik } from "formik";
 import { EyeIcon, EyeOffIcon } from "lucide-react";
 import { type ChangeEvent, type FC, useState } from "react";
@@ -255,55 +257,46 @@ const ActionCheckboxes: FC<ActionCheckboxesProps> = ({
 	};
 
 	return (
-		<TableContainer>
-			<Table>
-				<TableHead>
-					<TableRow>
-						<TableCell>Permission</TableCell>
-						<TableCell
-							align="right"
-							sx={{ paddingTop: 0.4, paddingBottom: 0.4 }}
-						>
-							<ShowAllResourcesCheckbox
-								showAllResources={showAllResources}
-								setShowAllResources={setShowAllResources}
-							/>
-						</TableCell>
-					</TableRow>
-				</TableHead>
-				<TableBody>
-					{Object.entries(resourceActions).map(([resourceKey, value]) => {
-						return (
-							<PermissionCheckboxGroup
-								key={resourceKey}
-								checkedActions={checkedActions?.filter(
-									(a) => a.resource_type === resourceKey,
-								)}
-								resourceKey={resourceKey}
-								value={value}
-								form={form}
-								handleActionCheckChange={handleActionCheckChange}
-								handleResourceCheckChange={handleResourceCheckChange}
-							/>
-						);
-					})}
-				</TableBody>
-				<TableFooter>
-					<TableRow>
-						<TableCell
-							align="right"
-							colSpan={2}
-							sx={{ paddingTop: 0.4, paddingBottom: 0.4, paddingRight: 4 }}
-						>
-							<ShowAllResourcesCheckbox
-								showAllResources={showAllResources}
-								setShowAllResources={setShowAllResources}
-							/>
-						</TableCell>
-					</TableRow>
-				</TableFooter>
-			</Table>
-		</TableContainer>
+		<Table>
+			<TableHeader>
+				<TableRow>
+					<TableHead>Permission</TableHead>
+					<TableHead className="py-1 text-right">
+						<ShowAllResourcesCheckbox
+							showAllResources={showAllResources}
+							setShowAllResources={setShowAllResources}
+						/>
+					</TableHead>
+				</TableRow>
+			</TableHeader>
+			<TableBody>
+				{Object.entries(resourceActions).map(([resourceKey, value]) => {
+					return (
+						<PermissionCheckboxGroup
+							key={resourceKey}
+							checkedActions={checkedActions?.filter(
+								(a) => a.resource_type === resourceKey,
+							)}
+							resourceKey={resourceKey}
+							value={value}
+							form={form}
+							handleActionCheckChange={handleActionCheckChange}
+							handleResourceCheckChange={handleResourceCheckChange}
+						/>
+					);
+				})}
+			</TableBody>
+			<TableFooter>
+				<TableRow>
+					<TableCell align="right" colSpan={2} className="py-1 pr-1">
+						<ShowAllResourcesCheckbox
+							showAllResources={showAllResources}
+							setShowAllResources={setShowAllResources}
+						/>
+					</TableCell>
+				</TableRow>
+			</TableFooter>
+		</Table>
 	);
 };
 
@@ -333,7 +326,7 @@ const PermissionCheckboxGroup: FC<PermissionCheckboxGroupProps> = ({
 }) => {
 	return (
 		<TableRow key={resourceKey}>
-			<TableCell sx={{ paddingLeft: 2 }} colSpan={2}>
+			<TableCell className="pl-0.5" colSpan={2}>
 				<li key={resourceKey} css={styles.checkBoxes}>
 					<Checkbox
 						size="small"
diff --git a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx
index a4384a8ed058a..319251103ddf1 100644
--- a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx
+++ b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionRow.tsx
@@ -1,11 +1,11 @@
 import type { CSSObject, Interpolation, Theme } from "@emotion/react";
-import TableCell from "@mui/material/TableCell";
 import type { TemplateVersion } from "api/typesGenerated";
 import { Avatar } from "components/Avatar/Avatar";
 import { Button } from "components/Button/Button";
 import { InfoTooltip } from "components/InfoTooltip/InfoTooltip";
 import { Pill } from "components/Pill/Pill";
 import { Stack } from "components/Stack/Stack";
+import { TableCell } from "components/Table/Table";
 import { TimelineEntry } from "components/Timeline/TimelineEntry";
 import { useClickableTableRow } from "hooks/useClickableTableRow";
 import type { FC } from "react";
diff --git a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx
index 81b68ffad50fe..ec340ceba7197 100644
--- a/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx
+++ b/site/src/pages/TemplatePage/TemplateVersionsPage/VersionsTable.tsx
@@ -1,10 +1,6 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableRow from "@mui/material/TableRow";
 import type * as TypesGen from "api/typesGenerated";
 import { EmptyState } from "components/EmptyState/EmptyState";
+import { Table, TableBody, TableCell, TableRow } from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import { Timeline } from "components/Timeline/Timeline";
 import type { FC } from "react";
@@ -49,39 +45,37 @@ export const VersionsTable: FC<VersionsTableProps> = ({
 	)?.id;
 
 	return (
-		<TableContainer>
-			<Table data-testid="versions-table">
-				<TableBody>
-					{versions ? (
-						<Timeline
-							items={[...versions].reverse()}
-							getDate={(version) => new Date(version.created_at)}
-							row={(version) => (
-								<VersionRow
-									onArchiveClick={onArchiveClick}
-									onPromoteClick={onPromoteClick}
-									version={version}
-									key={version.id}
-									isActive={activeVersionId === version.id}
-									isLatest={latestVersionId === version.id}
-								/>
-							)}
-						/>
-					) : (
-						<TableLoader />
-					)}
+		<Table data-testid="versions-table">
+			<TableBody>
+				{versions ? (
+					<Timeline
+						items={[...versions].reverse()}
+						getDate={(version) => new Date(version.created_at)}
+						row={(version) => (
+							<VersionRow
+								onArchiveClick={onArchiveClick}
+								onPromoteClick={onPromoteClick}
+								version={version}
+								key={version.id}
+								isActive={activeVersionId === version.id}
+								isLatest={latestVersionId === version.id}
+							/>
+						)}
+					/>
+				) : (
+					<TableLoader />
+				)}
 
-					{versions && versions.length === 0 && (
-						<TableRow>
-							<TableCell colSpan={999}>
-								<div css={{ padding: 32 }}>
-									<EmptyState message={Language.emptyMessage} />
-								</div>
-							</TableCell>
-						</TableRow>
-					)}
-				</TableBody>
-			</Table>
-		</TableContainer>
+				{versions && versions.length === 0 && (
+					<TableRow>
+						<TableCell colSpan={999}>
+							<div css={{ padding: 32 }}>
+								<EmptyState message={Language.emptyMessage} />
+							</div>
+						</TableCell>
+					</TableRow>
+				)}
+			</TableBody>
+		</Table>
 	);
 };
diff --git a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx
index f9460f88afc8c..07047bbc3da97 100644
--- a/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx
+++ b/site/src/pages/TemplateSettingsPage/TemplatePermissionsPage/TemplatePermissionsPageView.tsx
@@ -1,12 +1,6 @@
 import type { Interpolation, Theme } from "@emotion/react";
 import MenuItem from "@mui/material/MenuItem";
 import Select, { type SelectProps } from "@mui/material/Select";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type {
 	Group,
 	ReducedUser,
@@ -29,6 +23,14 @@ import { EmptyState } from "components/EmptyState/EmptyState";
 import { PageHeader, PageHeaderTitle } from "components/PageHeader/PageHeader";
 import { Spinner } from "components/Spinner/Spinner";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import { EllipsisVertical, UserPlusIcon } from "lucide-react";
 import { type FC, useState } from "react";
@@ -227,153 +229,151 @@ export const TemplatePermissionsPageView: FC<
 						}
 					/>
 				)}
-				<TableContainer>
-					<Table>
-						<TableHead>
-							<TableRow>
-								<TableCell width="60%">Member</TableCell>
-								<TableCell width="40%">Role</TableCell>
-								<TableCell width="1%" />
-							</TableRow>
-						</TableHead>
-						<TableBody>
-							<ChooseOne>
-								<Cond condition={!templateACL}>
-									<TableLoader />
-								</Cond>
-								<Cond condition={isEmpty}>
-									<TableRow>
-										<TableCell colSpan={999}>
-											<EmptyState
-												message="No members yet"
-												description="Add a member using the controls above"
+				<Table>
+					<TableHeader>
+						<TableRow>
+							<TableHead className="w-[60%]">Member</TableHead>
+							<TableHead className="w-[40%]">Role</TableHead>
+							<TableHead className="w-[1%]" />
+						</TableRow>
+					</TableHeader>
+					<TableBody>
+						<ChooseOne>
+							<Cond condition={!templateACL}>
+								<TableLoader />
+							</Cond>
+							<Cond condition={isEmpty}>
+								<TableRow>
+									<TableCell colSpan={999}>
+										<EmptyState
+											message="No members yet"
+											description="Add a member using the controls above"
+										/>
+									</TableCell>
+								</TableRow>
+							</Cond>
+							<Cond>
+								{templateACL?.group.map((group) => (
+									<TableRow key={group.id}>
+										<TableCell>
+											<AvatarData
+												avatar={
+													<Avatar
+														size="lg"
+														fallback={group.display_name || group.name}
+														src={group.avatar_url}
+													/>
+												}
+												title={group.display_name || group.name}
+												subtitle={getGroupSubtitle(group)}
 											/>
 										</TableCell>
-									</TableRow>
-								</Cond>
-								<Cond>
-									{templateACL?.group.map((group) => (
-										<TableRow key={group.id}>
-											<TableCell>
-												<AvatarData
-													avatar={
-														<Avatar
-															size="lg"
-															fallback={group.display_name || group.name}
-															src={group.avatar_url}
-														/>
-													}
-													title={group.display_name || group.name}
-													subtitle={getGroupSubtitle(group)}
-												/>
-											</TableCell>
-											<TableCell>
-												<ChooseOne>
-													<Cond condition={canUpdatePermissions}>
-														<RoleSelect
-															value={group.role}
-															disabled={updatingGroupId === group.id}
-															onChange={(event) => {
-																onUpdateGroup(
-																	group,
-																	event.target.value as TemplateRole,
-																);
-															}}
-														/>
-													</Cond>
-													<Cond>
-														<div css={styles.role}>{group.role}</div>
-													</Cond>
-												</ChooseOne>
-											</TableCell>
+										<TableCell>
+											<ChooseOne>
+												<Cond condition={canUpdatePermissions}>
+													<RoleSelect
+														value={group.role}
+														disabled={updatingGroupId === group.id}
+														onChange={(event) => {
+															onUpdateGroup(
+																group,
+																event.target.value as TemplateRole,
+															);
+														}}
+													/>
+												</Cond>
+												<Cond>
+													<div css={styles.role}>{group.role}</div>
+												</Cond>
+											</ChooseOne>
+										</TableCell>
 
-											<TableCell>
-												{canUpdatePermissions && (
-													<DropdownMenu>
-														<DropdownMenuTrigger asChild>
-															<Button
-																size="icon-lg"
-																variant="subtle"
-																aria-label="Open menu"
-															>
-																<EllipsisVertical aria-hidden="true" />
-																<span className="sr-only">Open menu</span>
-															</Button>
-														</DropdownMenuTrigger>
-														<DropdownMenuContent align="end">
-															<DropdownMenuItem
-																className="text-content-destructive focus:text-content-destructive"
-																onClick={() => onRemoveGroup(group)}
-															>
-																Remove
-															</DropdownMenuItem>
-														</DropdownMenuContent>
-													</DropdownMenu>
-												)}
-											</TableCell>
-										</TableRow>
-									))}
+										<TableCell>
+											{canUpdatePermissions && (
+												<DropdownMenu>
+													<DropdownMenuTrigger asChild>
+														<Button
+															size="icon-lg"
+															variant="subtle"
+															aria-label="Open menu"
+														>
+															<EllipsisVertical aria-hidden="true" />
+															<span className="sr-only">Open menu</span>
+														</Button>
+													</DropdownMenuTrigger>
+													<DropdownMenuContent align="end">
+														<DropdownMenuItem
+															className="text-content-destructive focus:text-content-destructive"
+															onClick={() => onRemoveGroup(group)}
+														>
+															Remove
+														</DropdownMenuItem>
+													</DropdownMenuContent>
+												</DropdownMenu>
+											)}
+										</TableCell>
+									</TableRow>
+								))}
 
-									{templateACL?.users.map((user) => (
-										<TableRow key={user.id}>
-											<TableCell>
-												<AvatarData
-													title={user.username}
-													subtitle={user.email}
-													src={user.avatar_url}
-												/>
-											</TableCell>
-											<TableCell>
-												<ChooseOne>
-													<Cond condition={canUpdatePermissions}>
-														<RoleSelect
-															value={user.role}
-															disabled={updatingUserId === user.id}
-															onChange={(event) => {
-																onUpdateUser(
-																	user,
-																	event.target.value as TemplateRole,
-																);
-															}}
-														/>
-													</Cond>
-													<Cond>
-														<div css={styles.role}>{user.role}</div>
-													</Cond>
-												</ChooseOne>
-											</TableCell>
+								{templateACL?.users.map((user) => (
+									<TableRow key={user.id}>
+										<TableCell>
+											<AvatarData
+												title={user.username}
+												subtitle={user.email}
+												src={user.avatar_url}
+											/>
+										</TableCell>
+										<TableCell>
+											<ChooseOne>
+												<Cond condition={canUpdatePermissions}>
+													<RoleSelect
+														value={user.role}
+														disabled={updatingUserId === user.id}
+														onChange={(event) => {
+															onUpdateUser(
+																user,
+																event.target.value as TemplateRole,
+															);
+														}}
+													/>
+												</Cond>
+												<Cond>
+													<div css={styles.role}>{user.role}</div>
+												</Cond>
+											</ChooseOne>
+										</TableCell>
 
-											<TableCell>
-												{canUpdatePermissions && (
-													<DropdownMenu>
-														<DropdownMenuTrigger asChild>
-															<Button
-																size="icon-lg"
-																variant="subtle"
-																aria-label="Open menu"
-															>
-																<EllipsisVertical aria-hidden="true" />
-																<span className="sr-only">Open menu</span>
-															</Button>
-														</DropdownMenuTrigger>
-														<DropdownMenuContent align="end">
-															<DropdownMenuItem
-																className="text-content-destructive focus:text-content-destructive"
-																onClick={() => onRemoveUser(user)}
-															>
-																Remove
-															</DropdownMenuItem>
-														</DropdownMenuContent>
-													</DropdownMenu>
-												)}
-											</TableCell>
-										</TableRow>
-									))}
-								</Cond>
-							</ChooseOne>
-						</TableBody>
-					</Table>
-				</TableContainer>
+										<TableCell>
+											{canUpdatePermissions && (
+												<DropdownMenu>
+													<DropdownMenuTrigger asChild>
+														<Button
+															size="icon-lg"
+															variant="subtle"
+															aria-label="Open menu"
+														>
+															<EllipsisVertical aria-hidden="true" />
+															<span className="sr-only">Open menu</span>
+														</Button>
+													</DropdownMenuTrigger>
+													<DropdownMenuContent align="end">
+														<DropdownMenuItem
+															className="text-content-destructive focus:text-content-destructive"
+															onClick={() => onRemoveUser(user)}
+														>
+															Remove
+														</DropdownMenuItem>
+													</DropdownMenuContent>
+												</DropdownMenu>
+											)}
+										</TableCell>
+									</TableRow>
+								))}
+							</Cond>
+						</ChooseOne>
+					</TableBody>
+				</Table>
 			</Stack>
 		</>
 	);
diff --git a/site/src/pages/UserSettingsPage/ExternalAuthPage/ExternalAuthPageView.tsx b/site/src/pages/UserSettingsPage/ExternalAuthPage/ExternalAuthPageView.tsx
index 01f468a232987..14252c625d4ba 100644
--- a/site/src/pages/UserSettingsPage/ExternalAuthPage/ExternalAuthPageView.tsx
+++ b/site/src/pages/UserSettingsPage/ExternalAuthPage/ExternalAuthPageView.tsx
@@ -1,12 +1,5 @@
 import { useTheme } from "@emotion/react";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import Tooltip from "@mui/material/Tooltip";
-import visuallyHidden from "@mui/utils/visuallyHidden";
 import { externalAuthProvider } from "api/queries/externalAuth";
 import type {
 	ExternalAuthLink,
@@ -25,6 +18,14 @@ import {
 import { Loader } from "components/Loader/Loader";
 import { Spinner } from "components/Spinner/Spinner";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableEmpty } from "components/TableEmpty/TableEmpty";
 import type { ExternalAuthPollingState } from "hooks/useExternalAuth";
 import { EllipsisVertical, RefreshCcwIcon } from "lucide-react";
@@ -58,41 +59,39 @@ export const ExternalAuthPageView: FC<ExternalAuthPageViewProps> = ({
 	}
 
 	return (
-		<TableContainer>
-			<Table>
-				<TableHead>
-					<TableRow>
-						<TableCell>Application</TableCell>
-						<TableCell>
-							<span aria-hidden css={{ ...visuallyHidden }}>
-								Link to connect
-							</span>
-						</TableCell>
-						<TableCell width="1%" />
-					</TableRow>
-				</TableHead>
-				<TableBody>
-					{auths.providers === null || auths.providers?.length === 0 ? (
-						<TableEmpty message="No providers have been configured" />
-					) : (
-						auths.providers?.map((app) => (
-							<ExternalAuthRow
-								key={app.id}
-								app={app}
-								unlinked={unlinked}
-								link={auths.links.find((l) => l.provider_id === app.id)}
-								onUnlinkExternalAuth={() => {
-									onUnlinkExternalAuth(app);
-								}}
-								onValidateExternalAuth={() => {
-									onValidateExternalAuth(app.id);
-								}}
-							/>
-						))
-					)}
-				</TableBody>
-			</Table>
-		</TableContainer>
+		<Table>
+			<TableHeader>
+				<TableRow>
+					<TableHead>Application</TableHead>
+					<TableHead>
+						<span aria-hidden className="sr-only">
+							Link to connect
+						</span>
+					</TableHead>
+					<TableHead className="w-[1%]" />
+				</TableRow>
+			</TableHeader>
+			<TableBody>
+				{auths.providers === null || auths.providers?.length === 0 ? (
+					<TableEmpty message="No providers have been configured" />
+				) : (
+					auths.providers?.map((app) => (
+						<ExternalAuthRow
+							key={app.id}
+							app={app}
+							unlinked={unlinked}
+							link={auths.links.find((l) => l.provider_id === app.id)}
+							onUnlinkExternalAuth={() => {
+								onUnlinkExternalAuth(app);
+							}}
+							onValidateExternalAuth={() => {
+								onValidateExternalAuth(app.id);
+							}}
+						/>
+					))
+				)}
+			</TableBody>
+		</Table>
 	);
 };
 
diff --git a/site/src/pages/UserSettingsPage/OAuth2ProviderPage/OAuth2ProviderPageView.tsx b/site/src/pages/UserSettingsPage/OAuth2ProviderPage/OAuth2ProviderPageView.tsx
index beb1ca09b8fc7..7d2ee3a8840b0 100644
--- a/site/src/pages/UserSettingsPage/OAuth2ProviderPage/OAuth2ProviderPageView.tsx
+++ b/site/src/pages/UserSettingsPage/OAuth2ProviderPage/OAuth2ProviderPageView.tsx
@@ -1,14 +1,16 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type * as TypesGen from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { Avatar } from "components/Avatar/Avatar";
 import { Button } from "components/Button/Button";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import type { FC } from "react";
 
@@ -29,31 +31,29 @@ const OAuth2ProviderPageView: FC<OAuth2ProviderPageViewProps> = ({
 		<>
 			{error && <ErrorAlert error={error} />}
 
-			<TableContainer>
-				<Table>
-					<TableHead>
+			<Table>
+				<TableHeader>
+					<TableRow>
+						<TableHead>Name</TableHead>
+						<TableHead className="w-[1%]" />
+					</TableRow>
+				</TableHeader>
+				<TableBody>
+					{isLoading && <TableLoader />}
+					{apps?.map((app) => (
+						<OAuth2AppRow key={app.id} app={app} revoke={revoke} />
+					))}
+					{apps?.length === 0 && (
 						<TableRow>
-							<TableCell width="100%">Name</TableCell>
-							<TableCell width="1%" />
+							<TableCell colSpan={999}>
+								<div css={{ textAlign: "center" }}>
+									No OAuth2 applications have been authorized.
+								</div>
+							</TableCell>
 						</TableRow>
-					</TableHead>
-					<TableBody>
-						{isLoading && <TableLoader />}
-						{apps?.map((app) => (
-							<OAuth2AppRow key={app.id} app={app} revoke={revoke} />
-						))}
-						{apps?.length === 0 && (
-							<TableRow>
-								<TableCell colSpan={999}>
-									<div css={{ textAlign: "center" }}>
-										No OAuth2 applications have been authorized.
-									</div>
-								</TableCell>
-							</TableRow>
-						)}
-					</TableBody>
-				</Table>
-			</TableContainer>
+					)}
+				</TableBody>
+			</Table>
 		</>
 	);
 };
diff --git a/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx b/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx
index 786a96712e8b5..5174d95886eac 100644
--- a/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx
+++ b/site/src/pages/UserSettingsPage/TokensPage/TokensPageView.tsx
@@ -1,15 +1,17 @@
 import { useTheme } from "@emotion/react";
 import IconButton from "@mui/material/IconButton";
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type { APIKeyWithOwner } from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableCell,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableEmpty } from "components/TableEmpty/TableEmpty";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import dayjs from "dayjs";
@@ -49,84 +51,83 @@ export const TokensPageView: FC<TokensPageViewProps> = ({
 		<Stack>
 			{Boolean(getTokensError) && <ErrorAlert error={getTokensError} />}
 			{Boolean(deleteTokenError) && <ErrorAlert error={deleteTokenError} />}
-			<TableContainer>
-				<Table>
-					<TableHead>
-						<TableRow>
-							<TableCell width="20%">ID</TableCell>
-							<TableCell width="20%">Name</TableCell>
-							<TableCell width="20%">Last Used</TableCell>
-							<TableCell width="20%">Expires At</TableCell>
-							<TableCell width="20%">Created At</TableCell>
-							<TableCell width="0%" />
-						</TableRow>
-					</TableHead>
-					<TableBody>
-						<ChooseOne>
-							<Cond condition={isLoading}>
-								<TableLoader />
-							</Cond>
-							<Cond condition={hasLoaded && (!tokens || tokens.length === 0)}>
-								<TableEmpty message="No tokens found" />
-							</Cond>
-							<Cond>
-								{tokens?.map((token) => {
-									return (
-										<TableRow
-											key={token.id}
-											data-testid={`token-${token.id}`}
-											tabIndex={0}
-										>
-											<TableCell>
-												<span style={{ color: theme.palette.text.secondary }}>
-													{token.id}
-												</span>
-											</TableCell>
 
-											<TableCell>
-												<span style={{ color: theme.palette.text.secondary }}>
-													{token.token_name}
-												</span>
-											</TableCell>
+			<Table>
+				<TableHeader>
+					<TableRow>
+						<TableHead className="w-1/5">ID</TableHead>
+						<TableHead className="w-1/5">Name</TableHead>
+						<TableHead className="w-1/5">Last Used</TableHead>
+						<TableHead className="w-1/5">Expires At</TableHead>
+						<TableHead className="w-1/5">Created At</TableHead>
+						<TableHead className="w-[1%]" />
+					</TableRow>
+				</TableHeader>
+				<TableBody>
+					<ChooseOne>
+						<Cond condition={isLoading}>
+							<TableLoader />
+						</Cond>
+						<Cond condition={hasLoaded && (!tokens || tokens.length === 0)}>
+							<TableEmpty message="No tokens found" />
+						</Cond>
+						<Cond>
+							{tokens?.map((token) => {
+								return (
+									<TableRow
+										key={token.id}
+										data-testid={`token-${token.id}`}
+										tabIndex={0}
+									>
+										<TableCell>
+											<span style={{ color: theme.palette.text.secondary }}>
+												{token.id}
+											</span>
+										</TableCell>
 
-											<TableCell>{lastUsedOrNever(token.last_used)}</TableCell>
+										<TableCell>
+											<span style={{ color: theme.palette.text.secondary }}>
+												{token.token_name}
+											</span>
+										</TableCell>
 
-											<TableCell>
-												<span
-													style={{ color: theme.palette.text.secondary }}
-													data-chromatic="ignore"
-												>
-													{dayjs(token.expires_at).fromNow()}
-												</span>
-											</TableCell>
+										<TableCell>{lastUsedOrNever(token.last_used)}</TableCell>
+
+										<TableCell>
+											<span
+												style={{ color: theme.palette.text.secondary }}
+												data-chromatic="ignore"
+											>
+												{dayjs(token.expires_at).fromNow()}
+											</span>
+										</TableCell>
 
-											<TableCell>
-												<span style={{ color: theme.palette.text.secondary }}>
-													{dayjs(token.created_at).fromNow()}
-												</span>
-											</TableCell>
+										<TableCell>
+											<span style={{ color: theme.palette.text.secondary }}>
+												{dayjs(token.created_at).fromNow()}
+											</span>
+										</TableCell>
 
-											<TableCell>
-												<span style={{ color: theme.palette.text.secondary }}>
-													<IconButton
-														onClick={() => {
-															onDelete(token);
-														}}
-														size="medium"
-														aria-label="Delete token"
-													>
-														<TrashIcon className="size-icon-sm" />
-													</IconButton>
-												</span>
-											</TableCell>
-										</TableRow>
-									);
-								})}
-							</Cond>
-						</ChooseOne>
-					</TableBody>
-				</Table>
-			</TableContainer>
+										<TableCell>
+											<span style={{ color: theme.palette.text.secondary }}>
+												<IconButton
+													onClick={() => {
+														onDelete(token);
+													}}
+													size="medium"
+													aria-label="Delete token"
+												>
+													<TrashIcon className="size-icon-sm" />
+												</IconButton>
+											</span>
+										</TableCell>
+									</TableRow>
+								);
+							})}
+						</Cond>
+					</ChooseOne>
+				</TableBody>
+			</Table>
 		</Stack>
 	);
 };
diff --git a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx
index 417a5d731e33d..17fa32fc8443a 100644
--- a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx
+++ b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyRow.tsx
@@ -1,6 +1,4 @@
 import { useTheme } from "@emotion/react";
-import TableCell from "@mui/material/TableCell";
-import TableRow from "@mui/material/TableRow";
 import type { Region, WorkspaceProxy } from "api/typesGenerated";
 import { Avatar } from "components/Avatar/Avatar";
 import { AvatarData } from "components/Avatar/AvatarData";
@@ -10,6 +8,7 @@ import {
 	NotReachableBadge,
 	NotRegisteredBadge,
 } from "components/Badges/Badges";
+import { TableCell, TableRow } from "components/Table/Table";
 import type { ProxyLatencyReport } from "contexts/useProxyLatency";
 import type { FC, ReactNode } from "react";
 import { getLatencyColor } from "utils/latency";
diff --git a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx
index d066d1542853a..ea903b0444825 100644
--- a/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx
+++ b/site/src/pages/UserSettingsPage/WorkspaceProxyPage/WorkspaceProxyView.tsx
@@ -1,9 +1,3 @@
-import Table from "@mui/material/Table";
-import TableBody from "@mui/material/TableBody";
-import TableCell from "@mui/material/TableCell";
-import TableContainer from "@mui/material/TableContainer";
-import TableHead from "@mui/material/TableHead";
-import TableRow from "@mui/material/TableRow";
 import type { Region } from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { ChooseOne, Cond } from "components/Conditionals/ChooseOne";
@@ -13,6 +7,13 @@ import {
 	SettingsHeaderTitle,
 } from "components/SettingsHeader/SettingsHeader";
 import { Stack } from "components/Stack/Stack";
+import {
+	Table,
+	TableBody,
+	TableHead,
+	TableHeader,
+	TableRow,
+} from "components/Table/Table";
 import { TableEmpty } from "components/TableEmpty/TableEmpty";
 import { TableLoader } from "components/TableLoader/TableLoader";
 import type { ProxyLatencyReport } from "contexts/useProxyLatency";
@@ -51,40 +52,35 @@ export const WorkspaceProxyView: FC<WorkspaceProxyViewProps> = ({
 				<ErrorAlert error={getWorkspaceProxiesError} />
 			)}
 			{Boolean(selectProxyError) && <ErrorAlert error={selectProxyError} />}
-			<TableContainer>
-				<Table>
-					<TableHead>
-						<TableRow>
-							<TableCell width="70%">Proxy</TableCell>
-							<TableCell width="10%" css={{ textAlign: "right" }}>
-								Status
-							</TableCell>
-							<TableCell width="20%" css={{ textAlign: "right" }}>
-								Latency
-							</TableCell>
-						</TableRow>
-					</TableHead>
-					<TableBody>
-						<ChooseOne>
-							<Cond condition={isLoading}>
-								<TableLoader />
-							</Cond>
-							<Cond condition={hasLoaded && proxies?.length === 0}>
-								<TableEmpty message="No workspace proxies found" />
-							</Cond>
-							<Cond>
-								{proxies?.map((proxy) => (
-									<ProxyRow
-										latency={proxyLatencies?.[proxy.id]}
-										key={proxy.id}
-										proxy={proxy}
-									/>
-								))}
-							</Cond>
-						</ChooseOne>
-					</TableBody>
-				</Table>
-			</TableContainer>
+
+			<Table>
+				<TableHeader>
+					<TableRow>
+						<TableHead className="w-[70%]">Proxy</TableHead>
+						<TableHead className="w-[10%] text-right">Status</TableHead>
+						<TableHead className="w-[20%] text-right">Latency</TableHead>
+					</TableRow>
+				</TableHeader>
+				<TableBody>
+					<ChooseOne>
+						<Cond condition={isLoading}>
+							<TableLoader />
+						</Cond>
+						<Cond condition={hasLoaded && proxies?.length === 0}>
+							<TableEmpty message="No workspace proxies found" />
+						</Cond>
+						<Cond>
+							{proxies?.map((proxy) => (
+								<ProxyRow
+									latency={proxyLatencies?.[proxy.id]}
+									key={proxy.id}
+									proxy={proxy}
+								/>
+							))}
+						</Cond>
+					</ChooseOne>
+				</TableBody>
+			</Table>
 		</Stack>
 	);
 };
diff --git a/site/src/theme/mui.ts b/site/src/theme/mui.ts
index 4435579a33153..f7b5ab1bc52ab 100644
--- a/site/src/theme/mui.ts
+++ b/site/src/theme/mui.ts
@@ -6,7 +6,6 @@ import {
 	BODY_FONT_FAMILY,
 	BUTTON_LG_HEIGHT,
 	BUTTON_MD_HEIGHT,
-	borderRadius,
 } from "./constants";
 import tw from "./tailwindColors";
 
@@ -59,73 +58,6 @@ export const components = {
 			}),
 		},
 	},
-	MuiTableContainer: {
-		styleOverrides: {
-			root: ({ theme }) => ({
-				borderRadius,
-				border: `1px solid ${theme.palette.divider}`,
-			}),
-		},
-	},
-	MuiTable: {
-		styleOverrides: {
-			root: ({ theme }) => ({
-				borderCollapse: "unset",
-				border: "none",
-				boxShadow: `0 0 0 1px ${theme.palette.background.default} inset`,
-				overflow: "hidden",
-
-				"& td": {
-					paddingTop: 16,
-					paddingBottom: 16,
-					background: "transparent",
-				},
-
-				[theme.breakpoints.down("md")]: {
-					minWidth: 1000,
-				},
-			}),
-		},
-	},
-	MuiTableCell: {
-		styleOverrides: {
-			head: ({ theme }) => ({
-				fontSize: 14,
-				color: theme.palette.text.secondary,
-				fontWeight: 500,
-				background: theme.palette.background.paper,
-				borderWidth: 2,
-			}),
-			root: ({ theme }) => ({
-				fontSize: 14,
-				background: theme.palette.background.paper,
-				borderBottom: `1px solid ${theme.palette.divider}`,
-				padding: "12px 8px",
-				// This targets the first+last td elements, and also the first+last elements
-				// of a TableCellLink.
-				"&:not(:only-child):first-of-type, &:not(:only-child):first-of-type > a":
-					{
-						paddingLeft: 32,
-					},
-				"&:not(:only-child):last-child, &:not(:only-child):last-child > a": {
-					paddingRight: 32,
-				},
-			}),
-		},
-	},
-	MuiTableRow: {
-		styleOverrides: {
-			root: ({ theme }) => ({
-				"&:last-child .MuiTableCell-body": {
-					borderBottom: 0,
-				},
-
-				"&.MuiTableRow-hover:hover": {
-					backgroundColor: theme.palette.background.paper,
-				},
-			}),
-		},
-	},
 	MuiLink: {
 		defaultProps: {
 			underline: "hover",

From 5d66f1f02770c03cf80f61aed45d4f9b2b17f6c3 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Thu, 9 Oct 2025 16:41:40 +0100
Subject: [PATCH 098/298] fix(provisioner): use sidebar app id instead of app
 id (#20246)

In a previous PR we set SidebarApp.Id equal to the appID instead of the
sidebarAppID.
---
 provisioner/terraform/resources.go            |   9 +-
 provisioner/terraform/resources_test.go       |  54 +++++
 .../ai-tasks-app/ai-tasks-app.tfplan.dot      |  20 ++
 .../ai-tasks-app/ai-tasks-app.tfplan.json     | 187 ++++++++++++++++
 .../ai-tasks-app/ai-tasks-app.tfstate.dot     |  20 ++
 .../ai-tasks-app/ai-tasks-app.tfstate.json    |  93 ++++++++
 .../testdata/resources/ai-tasks-app/main.tf   |  17 ++
 .../ai-tasks-sidebar.tfplan.dot               |  20 ++
 .../ai-tasks-sidebar.tfplan.json              | 202 ++++++++++++++++++
 .../ai-tasks-sidebar.tfstate.dot              |  20 ++
 .../ai-tasks-sidebar.tfstate.json             |  97 +++++++++
 .../resources/ai-tasks-sidebar/main.tf        |  19 ++
 12 files changed, 756 insertions(+), 2 deletions(-)
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.dot
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.json
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.dot
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.json
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-app/main.tf
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.dot
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.json
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.dot
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.json
 create mode 100644 provisioner/terraform/testdata/resources/ai-tasks-sidebar/main.tf

diff --git a/provisioner/terraform/resources.go b/provisioner/terraform/resources.go
index e94852fd6b5b9..a65615e5f233e 100644
--- a/provisioner/terraform/resources.go
+++ b/provisioner/terraform/resources.go
@@ -1022,11 +1022,16 @@ func ConvertState(ctx context.Context, modules []*tfjson.StateModule, rawGraph s
 			return nil, xerrors.Errorf("decode coder_ai_task attributes: %w", err)
 		}
 
+		appID := task.AppID
+		if appID == "" && len(task.SidebarApp) > 0 {
+			appID = task.SidebarApp[0].ID
+		}
+
 		aiTasks = append(aiTasks, &proto.AITask{
 			Id:    task.ID,
-			AppId: task.AppID,
+			AppId: appID,
 			SidebarApp: &proto.AITaskSidebarApp{
-				Id: task.AppID,
+				Id: appID,
 			},
 		})
 	}
diff --git a/provisioner/terraform/resources_test.go b/provisioner/terraform/resources_test.go
index 5158590aa88c0..a2c5b536ac2db 100644
--- a/provisioner/terraform/resources_test.go
+++ b/provisioner/terraform/resources_test.go
@@ -1549,6 +1549,60 @@ func TestAITasks(t *testing.T) {
 		// This is validated once all parameters are resolved etc as part of the workspace build, but for now we can allow it.
 		require.Len(t, state.AITasks, 2)
 	})
+
+	t.Run("Can use sidebar app ID", func(t *testing.T) {
+		t.Parallel()
+
+		// nolint:dogsled
+		_, filename, _, _ := runtime.Caller(0)
+
+		dir := filepath.Join(filepath.Dir(filename), "testdata", "resources", "ai-tasks-sidebar")
+		tfPlanRaw, err := os.ReadFile(filepath.Join(dir, "ai-tasks-sidebar.tfplan.json"))
+		require.NoError(t, err)
+		var tfPlan tfjson.Plan
+		err = json.Unmarshal(tfPlanRaw, &tfPlan)
+		require.NoError(t, err)
+		tfPlanGraph, err := os.ReadFile(filepath.Join(dir, "ai-tasks-sidebar.tfplan.dot"))
+		require.NoError(t, err)
+
+		state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfPlan.PlannedValues.RootModule, tfPlan.PriorState.Values.RootModule}, string(tfPlanGraph), logger)
+		require.NotNil(t, state)
+		require.NoError(t, err)
+		require.True(t, state.HasAITasks)
+		require.Len(t, state.AITasks, 1)
+
+		sidebarApp := state.AITasks[0].GetSidebarApp()
+		require.NotNil(t, sidebarApp)
+		require.Equal(t, "5ece4674-dd35-4f16-88c8-82e40e72e2fd", sidebarApp.GetId())
+		require.Equal(t, "5ece4674-dd35-4f16-88c8-82e40e72e2fd", state.AITasks[0].AppId)
+	})
+
+	t.Run("Can use app ID", func(t *testing.T) {
+		t.Parallel()
+
+		// nolint:dogsled
+		_, filename, _, _ := runtime.Caller(0)
+
+		dir := filepath.Join(filepath.Dir(filename), "testdata", "resources", "ai-tasks-app")
+		tfPlanRaw, err := os.ReadFile(filepath.Join(dir, "ai-tasks-app.tfplan.json"))
+		require.NoError(t, err)
+		var tfPlan tfjson.Plan
+		err = json.Unmarshal(tfPlanRaw, &tfPlan)
+		require.NoError(t, err)
+		tfPlanGraph, err := os.ReadFile(filepath.Join(dir, "ai-tasks-app.tfplan.dot"))
+		require.NoError(t, err)
+
+		state, err := terraform.ConvertState(ctx, []*tfjson.StateModule{tfPlan.PlannedValues.RootModule, tfPlan.PriorState.Values.RootModule}, string(tfPlanGraph), logger)
+		require.NotNil(t, state)
+		require.NoError(t, err)
+		require.True(t, state.HasAITasks)
+		require.Len(t, state.AITasks, 1)
+
+		sidebarApp := state.AITasks[0].GetSidebarApp()
+		require.NotNil(t, sidebarApp)
+		require.Equal(t, "5ece4674-dd35-4f16-88c8-82e40e72e2fd", sidebarApp.GetId())
+		require.Equal(t, "5ece4674-dd35-4f16-88c8-82e40e72e2fd", state.AITasks[0].AppId)
+	})
 }
 
 func TestExternalAgents(t *testing.T) {
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.dot b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.dot
new file mode 100644
index 0000000000000..c36ff5323696a
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.dot
@@ -0,0 +1,20 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
+		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
+		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
+		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_provisioner.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+	}
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.json b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.json
new file mode 100644
index 0000000000000..2669980027ba0
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfplan.json
@@ -0,0 +1,187 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.13.0",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_ai_task.a[0]",
+          "mode": "managed",
+          "type": "coder_ai_task",
+          "name": "a",
+          "index": 0,
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+            "sidebar_app": []
+          },
+          "sensitive_values": {
+            "sidebar_app": []
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "coder_ai_task.a[0]",
+      "mode": "managed",
+      "type": "coder_ai_task",
+      "name": "a",
+      "index": 0,
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+          "sidebar_app": []
+        },
+        "after_unknown": {
+          "id": true,
+          "prompt": true,
+          "sidebar_app": []
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "sidebar_app": []
+        }
+      }
+    }
+  ],
+  "prior_state": {
+    "format_version": "1.0",
+    "terraform_version": "1.13.0",
+    "values": {
+      "root_module": {
+        "resources": [
+          {
+            "address": "data.coder_provisioner.me",
+            "mode": "data",
+            "type": "coder_provisioner",
+            "name": "me",
+            "provider_name": "registry.terraform.io/coder/coder",
+            "schema_version": 1,
+            "values": {
+              "arch": "amd64",
+              "id": "6e0bee77-2319-4094-a29e-6d14412399d2",
+              "os": "linux"
+            },
+            "sensitive_values": {}
+          },
+          {
+            "address": "data.coder_workspace.me",
+            "mode": "data",
+            "type": "coder_workspace",
+            "name": "me",
+            "provider_name": "registry.terraform.io/coder/coder",
+            "schema_version": 1,
+            "values": {
+              "access_port": 443,
+              "access_url": "https://dev.coder.com/",
+              "id": "5c06d6ea-101b-4069-8d14-7179df66ebcc",
+              "is_prebuild": false,
+              "is_prebuild_claim": false,
+              "name": "coder",
+              "prebuild_count": 0,
+              "start_count": 1,
+              "template_id": "",
+              "template_name": "",
+              "template_version": "",
+              "transition": "start"
+            },
+            "sensitive_values": {}
+          },
+          {
+            "address": "data.coder_workspace_owner.me",
+            "mode": "data",
+            "type": "coder_workspace_owner",
+            "name": "me",
+            "provider_name": "registry.terraform.io/coder/coder",
+            "schema_version": 0,
+            "values": {
+              "email": "default@example.com",
+              "full_name": "coder",
+              "groups": [],
+              "id": "8796d8d7-88f1-445a-bea7-65f5cf530b95",
+              "login_type": null,
+              "name": "default",
+              "oidc_access_token": "",
+              "rbac_roles": [],
+              "session_token": "",
+              "ssh_private_key": "",
+              "ssh_public_key": ""
+            },
+            "sensitive_values": {
+              "groups": [],
+              "oidc_access_token": true,
+              "rbac_roles": [],
+              "session_token": true,
+              "ssh_private_key": true
+            }
+          }
+        ]
+      }
+    }
+  },
+  "configuration": {
+    "provider_config": {
+      "coder": {
+        "name": "coder",
+        "full_name": "registry.terraform.io/coder/coder",
+        "version_constraint": ">= 2.0.0"
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_ai_task.a",
+          "mode": "managed",
+          "type": "coder_ai_task",
+          "name": "a",
+          "provider_config_key": "coder",
+          "expressions": {
+            "app_id": {
+              "constant_value": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
+            }
+          },
+          "schema_version": 1,
+          "count_expression": {
+            "constant_value": 1
+          }
+        },
+        {
+          "address": "data.coder_provisioner.me",
+          "mode": "data",
+          "type": "coder_provisioner",
+          "name": "me",
+          "provider_config_key": "coder",
+          "schema_version": 1
+        },
+        {
+          "address": "data.coder_workspace.me",
+          "mode": "data",
+          "type": "coder_workspace",
+          "name": "me",
+          "provider_config_key": "coder",
+          "schema_version": 1
+        },
+        {
+          "address": "data.coder_workspace_owner.me",
+          "mode": "data",
+          "type": "coder_workspace_owner",
+          "name": "me",
+          "provider_config_key": "coder",
+          "schema_version": 0
+        }
+      ]
+    }
+  },
+  "timestamp": "2025-10-09T14:27:27Z",
+  "applyable": true,
+  "complete": true,
+  "errored": false
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.dot b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.dot
new file mode 100644
index 0000000000000..c36ff5323696a
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.dot
@@ -0,0 +1,20 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
+		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
+		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
+		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_provisioner.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+	}
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.json b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.json
new file mode 100644
index 0000000000000..a883d2143586c
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-app/ai-tasks-app.tfstate.json
@@ -0,0 +1,93 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.13.0",
+  "values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "data.coder_provisioner.me",
+          "mode": "data",
+          "type": "coder_provisioner",
+          "name": "me",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "arch": "amd64",
+            "id": "a1fe389c-ac5e-4e9d-ba76-bc23fe275cc0",
+            "os": "linux"
+          },
+          "sensitive_values": {}
+        },
+        {
+          "address": "data.coder_workspace.me",
+          "mode": "data",
+          "type": "coder_workspace",
+          "name": "me",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "access_port": 443,
+            "access_url": "https://dev.coder.com/",
+            "id": "bca94359-107b-43c9-a272-99af4b239aad",
+            "is_prebuild": false,
+            "is_prebuild_claim": false,
+            "name": "coder",
+            "prebuild_count": 0,
+            "start_count": 1,
+            "template_id": "",
+            "template_name": "",
+            "template_version": "",
+            "transition": "start"
+          },
+          "sensitive_values": {}
+        },
+        {
+          "address": "data.coder_workspace_owner.me",
+          "mode": "data",
+          "type": "coder_workspace_owner",
+          "name": "me",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "email": "default@example.com",
+            "full_name": "coder",
+            "groups": [],
+            "id": "cb8c55f2-7f66-4e69-a584-eb08f4a7cf04",
+            "login_type": null,
+            "name": "default",
+            "oidc_access_token": "",
+            "rbac_roles": [],
+            "session_token": "",
+            "ssh_private_key": "",
+            "ssh_public_key": ""
+          },
+          "sensitive_values": {
+            "groups": [],
+            "oidc_access_token": true,
+            "rbac_roles": [],
+            "session_token": true,
+            "ssh_private_key": true
+          }
+        },
+        {
+          "address": "coder_ai_task.a[0]",
+          "mode": "managed",
+          "type": "coder_ai_task",
+          "name": "a",
+          "index": 0,
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+            "id": "c4f032b8-97e4-42b0-aa2f-30a9e698f8d4",
+            "prompt": "default",
+            "sidebar_app": []
+          },
+          "sensitive_values": {
+            "sidebar_app": []
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-app/main.tf b/provisioner/terraform/testdata/resources/ai-tasks-app/main.tf
new file mode 100644
index 0000000000000..475e0560aec2b
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-app/main.tf
@@ -0,0 +1,17 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">= 2.0.0"
+    }
+  }
+}
+
+data "coder_provisioner" "me" {}
+data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
+
+resource "coder_ai_task" "a" {
+  count  = 1
+  app_id = "5ece4674-dd35-4f16-88c8-82e40e72e2fd" # fake ID to satisfy requirement, irrelevant otherwise
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.dot b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.dot
new file mode 100644
index 0000000000000..c36ff5323696a
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.dot
@@ -0,0 +1,20 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
+		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
+		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
+		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_provisioner.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+	}
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.json b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.json
new file mode 100644
index 0000000000000..6a507463d1292
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfplan.json
@@ -0,0 +1,202 @@
+{
+  "format_version": "1.2",
+  "terraform_version": "1.12.2",
+  "planned_values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_ai_task.a[0]",
+          "mode": "managed",
+          "type": "coder_ai_task",
+          "name": "a",
+          "index": 0,
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "sidebar_app": [
+              {
+                "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
+              }
+            ]
+          },
+          "sensitive_values": {
+            "sidebar_app": [
+              {}
+            ]
+          }
+        }
+      ]
+    }
+  },
+  "resource_changes": [
+    {
+      "address": "coder_ai_task.a[0]",
+      "mode": "managed",
+      "type": "coder_ai_task",
+      "name": "a",
+      "index": 0,
+      "provider_name": "registry.terraform.io/coder/coder",
+      "change": {
+        "actions": [
+          "create"
+        ],
+        "before": null,
+        "after": {
+          "sidebar_app": [
+            {
+              "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
+            }
+          ]
+        },
+        "after_unknown": {
+          "app_id": true,
+          "id": true,
+          "prompt": true,
+          "sidebar_app": [
+            {}
+          ]
+        },
+        "before_sensitive": false,
+        "after_sensitive": {
+          "sidebar_app": [
+            {}
+          ]
+        }
+      }
+    }
+  ],
+  "prior_state": {
+    "format_version": "1.0",
+    "terraform_version": "1.12.2",
+    "values": {
+      "root_module": {
+        "resources": [
+          {
+            "address": "data.coder_provisioner.me",
+            "mode": "data",
+            "type": "coder_provisioner",
+            "name": "me",
+            "provider_name": "registry.terraform.io/coder/coder",
+            "schema_version": 1,
+            "values": {
+              "arch": "amd64",
+              "id": "6b538d81-f0db-4e2b-8d85-4b87a1563d89",
+              "os": "linux"
+            },
+            "sensitive_values": {}
+          },
+          {
+            "address": "data.coder_workspace.me",
+            "mode": "data",
+            "type": "coder_workspace",
+            "name": "me",
+            "provider_name": "registry.terraform.io/coder/coder",
+            "schema_version": 1,
+            "values": {
+              "access_port": 443,
+              "access_url": "https://dev.coder.com/",
+              "id": "344575c1-55b9-43bb-89b5-35f547e2cf08",
+              "is_prebuild": false,
+              "is_prebuild_claim": false,
+              "name": "sebenza-nonix",
+              "prebuild_count": 0,
+              "start_count": 1,
+              "template_id": "",
+              "template_name": "",
+              "template_version": "",
+              "transition": "start"
+            },
+            "sensitive_values": {}
+          },
+          {
+            "address": "data.coder_workspace_owner.me",
+            "mode": "data",
+            "type": "coder_workspace_owner",
+            "name": "me",
+            "provider_name": "registry.terraform.io/coder/coder",
+            "schema_version": 0,
+            "values": {
+              "email": "default@example.com",
+              "full_name": "default",
+              "groups": [],
+              "id": "acb465b5-2709-4392-9486-4ad6eb1c06e0",
+              "login_type": null,
+              "name": "default",
+              "oidc_access_token": "",
+              "rbac_roles": [],
+              "session_token": "",
+              "ssh_private_key": "",
+              "ssh_public_key": ""
+            },
+            "sensitive_values": {
+              "groups": [],
+              "rbac_roles": [],
+              "ssh_private_key": true
+            }
+          }
+        ]
+      }
+    }
+  },
+  "configuration": {
+    "provider_config": {
+      "coder": {
+        "name": "coder",
+        "full_name": "registry.terraform.io/coder/coder",
+        "version_constraint": ">= 2.0.0"
+      }
+    },
+    "root_module": {
+      "resources": [
+        {
+          "address": "coder_ai_task.a",
+          "mode": "managed",
+          "type": "coder_ai_task",
+          "name": "a",
+          "provider_config_key": "coder",
+          "expressions": {
+            "sidebar_app": [
+              {
+                "id": {
+                  "constant_value": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
+                }
+              }
+            ]
+          },
+          "schema_version": 1,
+          "count_expression": {
+            "constant_value": 1
+          }
+        },
+        {
+          "address": "data.coder_provisioner.me",
+          "mode": "data",
+          "type": "coder_provisioner",
+          "name": "me",
+          "provider_config_key": "coder",
+          "schema_version": 1
+        },
+        {
+          "address": "data.coder_workspace.me",
+          "mode": "data",
+          "type": "coder_workspace",
+          "name": "me",
+          "provider_config_key": "coder",
+          "schema_version": 1
+        },
+        {
+          "address": "data.coder_workspace_owner.me",
+          "mode": "data",
+          "type": "coder_workspace_owner",
+          "name": "me",
+          "provider_config_key": "coder",
+          "schema_version": 0
+        }
+      ]
+    }
+  },
+  "timestamp": "2025-06-19T14:30:00Z",
+  "applyable": true,
+  "complete": true,
+  "errored": false
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.dot b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.dot
new file mode 100644
index 0000000000000..c36ff5323696a
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.dot
@@ -0,0 +1,20 @@
+digraph {
+	compound = "true"
+	newrank = "true"
+	subgraph "root" {
+		"[root] coder_ai_task.a (expand)" [label = "coder_ai_task.a", shape = "box"]
+		"[root] data.coder_provisioner.me (expand)" [label = "data.coder_provisioner.me", shape = "box"]
+		"[root] data.coder_workspace.me (expand)" [label = "data.coder_workspace.me", shape = "box"]
+		"[root] data.coder_workspace_owner.me (expand)" [label = "data.coder_workspace_owner.me", shape = "box"]
+		"[root] provider[\"registry.terraform.io/coder/coder\"]" [label = "provider[\"registry.terraform.io/coder/coder\"]", shape = "diamond"]
+		"[root] coder_ai_task.a (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_provisioner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] data.coder_workspace_owner.me (expand)" -> "[root] provider[\"registry.terraform.io/coder/coder\"]"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] coder_ai_task.a (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_provisioner.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace.me (expand)"
+		"[root] provider[\"registry.terraform.io/coder/coder\"] (close)" -> "[root] data.coder_workspace_owner.me (expand)"
+		"[root] root" -> "[root] provider[\"registry.terraform.io/coder/coder\"] (close)"
+	}
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.json b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.json
new file mode 100644
index 0000000000000..947e3ee1e9485
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/ai-tasks-sidebar.tfstate.json
@@ -0,0 +1,97 @@
+{
+  "format_version": "1.0",
+  "terraform_version": "1.12.2",
+  "values": {
+    "root_module": {
+      "resources": [
+        {
+          "address": "data.coder_provisioner.me",
+          "mode": "data",
+          "type": "coder_provisioner",
+          "name": "me",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "arch": "amd64",
+            "id": "764f8b0b-d931-4356-b1a8-446fa95fbeb0",
+            "os": "linux"
+          },
+          "sensitive_values": {}
+        },
+        {
+          "address": "data.coder_workspace.me",
+          "mode": "data",
+          "type": "coder_workspace",
+          "name": "me",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "access_port": 443,
+            "access_url": "https://dev.coder.com/",
+            "id": "b6713709-6736-4d2f-b3da-7b5b242df5f4",
+            "is_prebuild": false,
+            "is_prebuild_claim": false,
+            "name": "sebenza-nonix",
+            "prebuild_count": 0,
+            "start_count": 1,
+            "template_id": "",
+            "template_name": "",
+            "template_version": "",
+            "transition": "start"
+          },
+          "sensitive_values": {}
+        },
+        {
+          "address": "data.coder_workspace_owner.me",
+          "mode": "data",
+          "type": "coder_workspace_owner",
+          "name": "me",
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 0,
+          "values": {
+            "email": "default@example.com",
+            "full_name": "default",
+            "groups": [],
+            "id": "0cc15fa2-24fc-4249-bdc7-56cf0af0f782",
+            "login_type": null,
+            "name": "default",
+            "oidc_access_token": "",
+            "rbac_roles": [],
+            "session_token": "",
+            "ssh_private_key": "",
+            "ssh_public_key": ""
+          },
+          "sensitive_values": {
+            "groups": [],
+            "rbac_roles": [],
+            "ssh_private_key": true
+          }
+        },
+        {
+          "address": "coder_ai_task.a[0]",
+          "mode": "managed",
+          "type": "coder_ai_task",
+          "name": "a",
+          "index": 0,
+          "provider_name": "registry.terraform.io/coder/coder",
+          "schema_version": 1,
+          "values": {
+            "app_id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd",
+            "id": "89e6ab36-2e98-4d13-9b4c-69b7588b7e1d",
+            "prompt": "default",
+            "sidebar_app": [
+              {
+                "id": "5ece4674-dd35-4f16-88c8-82e40e72e2fd"
+              }
+            ]
+          },
+          "sensitive_values": {
+            "sidebar_app": [
+              {}
+            ]
+          }
+        }
+      ]
+    }
+  }
+}
diff --git a/provisioner/terraform/testdata/resources/ai-tasks-sidebar/main.tf b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/main.tf
new file mode 100644
index 0000000000000..6f1428eb83e99
--- /dev/null
+++ b/provisioner/terraform/testdata/resources/ai-tasks-sidebar/main.tf
@@ -0,0 +1,19 @@
+terraform {
+  required_providers {
+    coder = {
+      source  = "coder/coder"
+      version = ">= 2.0.0"
+    }
+  }
+}
+
+data "coder_provisioner" "me" {}
+data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
+
+resource "coder_ai_task" "a" {
+  count = 1
+  sidebar_app {
+    id = "5ece4674-dd35-4f16-88c8-82e40e72e2fd" # fake ID to satisfy requirement, irrelevant otherwise
+  }
+}

From 6213b30f10c62ef5214e72878e7922610e8cf2eb Mon Sep 17 00:00:00 2001
From: Hugo Dutka <hugo@coder.com>
Date: Thu, 9 Oct 2025 18:35:09 +0200
Subject: [PATCH 099/298] fix: replace http.DefaultClient in telemetry with
 dedicated client (#20247)

Replaces a call to the http default client in telemetry.go. Looks like
it was missed in https://github.com/coder/coder/pull/20128.

Related to https://github.com/coder/internal/issues/1020 and
https://github.com/coder/internal/issues/645.
---
 coderd/telemetry/telemetry.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/coderd/telemetry/telemetry.go b/coderd/telemetry/telemetry.go
index 075083adaa96d..75b432022bafc 100644
--- a/coderd/telemetry/telemetry.go
+++ b/coderd/telemetry/telemetry.go
@@ -355,7 +355,7 @@ func (r *remoteReporter) deployment() error {
 		return xerrors.Errorf("create deployment request: %w", err)
 	}
 	req.Header.Set(VersionHeader, buildinfo.Version())
-	resp, err := http.DefaultClient.Do(req)
+	resp, err := r.client.Do(req)
 	if err != nil {
 		return xerrors.Errorf("perform request: %w", err)
 	}

From caeff49aba6315e05dd9aada89658da8ee9ee518 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Thu, 9 Oct 2025 11:08:34 -0600
Subject: [PATCH 100/298] chore: refactor roles to support multiple permission
 sets scoped by org id (#20186)

In preparation for adding the "member" permission level, which will also
be grouped by org ID, do a bit of a refactor to make room for it and the
existing "org" level to live in the same `map`
---
 coderd/database/db2sdk/db2sdk.go            |   4 +-
 coderd/database/dbauthz/dbauthz.go          |  66 +++---
 coderd/database/modelmethods.go             |  15 +-
 coderd/rbac/astvalue.go                     |  21 +-
 coderd/rbac/authz_internal_test.go          |  48 +++--
 coderd/rbac/policy.rego                     |  18 +-
 coderd/rbac/roles.go                        | 215 +++++++++++---------
 coderd/rbac/roles_internal_test.go          |  10 +-
 coderd/rbac/rolestore/rolestore.go          |   7 +-
 coderd/rbac/scopes.go                       |  14 +-
 coderd/rbac/scopes_catalog_internal_test.go |   4 +-
 coderd/rbac/scopes_test.go                  |   2 +-
 coderd/workspaceapps/db.go                  |   5 +-
 enterprise/coderd/coderd_test.go            |   4 +-
 enterprise/tailnet/pgcoord.go               |   4 +-
 15 files changed, 234 insertions(+), 203 deletions(-)

diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index 7d9622b316c2e..f28fa00407622 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -693,13 +693,13 @@ func SlimRoleFromName(name string) codersdk.SlimRole {
 func RBACRole(role rbac.Role) codersdk.Role {
 	slim := SlimRole(role)
 
-	orgPerms := role.Org[slim.OrganizationID]
+	orgPerms := role.ByOrgID[slim.OrganizationID]
 	return codersdk.Role{
 		Name:                    slim.Name,
 		OrganizationID:          slim.OrganizationID,
 		DisplayName:             slim.DisplayName,
 		SitePermissions:         List(role.Site, RBACPermission),
-		OrganizationPermissions: List(orgPerms, RBACPermission),
+		OrganizationPermissions: List(orgPerms.Org, RBACPermission),
 		UserPermissions:         List(role.User, RBACPermission),
 	}
 }
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 6df0168612c87..4f17a897039d2 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -232,8 +232,8 @@ var (
 					// Provisionerd creates usage events
 					rbac.ResourceUsageEvent.Type: {policy.ActionCreate},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -257,8 +257,8 @@ var (
 					rbac.ResourceWorkspace.Type:           {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop},
 					rbac.ResourceWorkspaceDormant.Type:    {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -280,8 +280,8 @@ var (
 					rbac.ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionUpdate},
 					rbac.ResourceProvisionerJobs.Type:  {policy.ActionRead, policy.ActionUpdate},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -299,8 +299,8 @@ var (
 				Site: rbac.Permissions(map[string][]policy.Action{
 					rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -318,8 +318,8 @@ var (
 				Site: rbac.Permissions(map[string][]policy.Action{
 					rbac.ResourceCryptoKey.Type: {policy.WildcardSymbol},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -336,8 +336,8 @@ var (
 				Site: rbac.Permissions(map[string][]policy.Action{
 					rbac.ResourceConnectionLog.Type: {policy.ActionUpdate, policy.ActionRead},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -357,8 +357,8 @@ var (
 					rbac.ResourceWebpushSubscription.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 					rbac.ResourceDeploymentConfig.Type:    {policy.ActionRead, policy.ActionUpdate}, // To read and upsert VAPID keys
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -376,8 +376,8 @@ var (
 					// The workspace monitor needs to be able to update monitors
 					rbac.ResourceWorkspaceAgentResourceMonitor.Type: {policy.ActionUpdate},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -393,12 +393,12 @@ var (
 					Identifier:  rbac.RoleIdentifier{Name: "subagentapi"},
 					DisplayName: "Sub Agent API",
 					Site:        []rbac.Permission{},
-					Org: map[string][]rbac.Permission{
-						orgID.String(): {},
-					},
 					User: rbac.Permissions(map[string][]policy.Action{
 						rbac.ResourceWorkspace.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreateAgent, policy.ActionDeleteAgent},
 					}),
+					ByOrgID: map[string]rbac.OrgPermissions{
+						orgID.String(): {},
+					},
 				},
 			}),
 			Scope: rbac.ScopeAll,
@@ -437,8 +437,8 @@ var (
 					rbac.ResourceOauth2App.Type:              {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 					rbac.ResourceOauth2AppSecret.Type:        {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -455,8 +455,8 @@ var (
 				Site: rbac.Permissions(map[string][]policy.Action{
 					rbac.ResourceProvisionerDaemon.Type: {policy.ActionRead},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -532,8 +532,8 @@ var (
 				Site: rbac.Permissions(map[string][]policy.Action{
 					rbac.ResourceFile.Type: {policy.ActionRead},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -553,8 +553,8 @@ var (
 					// reads/processes them.
 					rbac.ResourceUsageEvent.Type: {policy.ActionRead, policy.ActionUpdate},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -577,8 +577,8 @@ var (
 					rbac.ResourceApiKey.Type:               {policy.ActionRead}, // Validate API keys.
 					rbac.ResourceAibridgeInterception.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
@@ -1254,13 +1254,13 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
 		return xerrors.Errorf("invalid role: %w", err)
 	}
 
-	if len(rbacRole.Org) > 0 && len(rbacRole.Site) > 0 {
+	if len(rbacRole.ByOrgID) > 0 && len(rbacRole.Site) > 0 {
 		// This is a choice to keep roles simple. If we allow mixing site and org scoped perms, then knowing who can
 		// do what gets more complicated.
 		return xerrors.Errorf("invalid custom role, cannot assign both org and site permissions at the same time")
 	}
 
-	if len(rbacRole.Org) > 1 {
+	if len(rbacRole.ByOrgID) > 1 {
 		// Again to avoid more complexity in our roles
 		return xerrors.Errorf("invalid custom role, cannot assign permissions to more than 1 org at a time")
 	}
@@ -1273,8 +1273,8 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
 		}
 	}
 
-	for orgID, perms := range rbacRole.Org {
-		for _, orgPerm := range perms {
+	for orgID, perms := range rbacRole.ByOrgID {
+		for _, orgPerm := range perms.Org {
 			err := q.customRoleEscalationCheck(ctx, act, orgPerm, rbac.Object{OrgID: orgID, Type: orgPerm.ResourceType})
 			if err != nil {
 				return xerrors.Errorf("org=%q: %w", orgID, err)
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
index 2ac62215b4444..b6d10569a7cf3 100644
--- a/coderd/database/modelmethods.go
+++ b/coderd/database/modelmethods.go
@@ -176,8 +176,8 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 		// Identifier is informational; not used in policy evaluation.
 		Identifier: rbac.RoleIdentifier{Name: "Scope_Multiple"},
 		Site:       nil,
-		Org:        map[string][]rbac.Permission{},
 		User:       nil,
+		ByOrgID:    map[string]rbac.OrgPermissions{},
 	}
 
 	// Collect allow lists for a union after expanding all scopes.
@@ -191,8 +191,10 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 
 		// Merge role permissions: union by simple concatenation.
 		merged.Site = append(merged.Site, expanded.Site...)
-		for orgID, perms := range expanded.Org {
-			merged.Org[orgID] = append(merged.Org[orgID], perms...)
+		for orgID, perms := range expanded.ByOrgID {
+			orgPerms := merged.ByOrgID[orgID]
+			orgPerms.Org = append(orgPerms.Org, perms.Org...)
+			merged.ByOrgID[orgID] = orgPerms
 		}
 		merged.User = append(merged.User, expanded.User...)
 
@@ -201,10 +203,11 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 
 	// De-duplicate permissions across Site/Org/User
 	merged.Site = rbac.DeduplicatePermissions(merged.Site)
-	for orgID, perms := range merged.Org {
-		merged.Org[orgID] = rbac.DeduplicatePermissions(perms)
-	}
 	merged.User = rbac.DeduplicatePermissions(merged.User)
+	for orgID, perms := range merged.ByOrgID {
+		perms.Org = rbac.DeduplicatePermissions(perms.Org)
+		merged.ByOrgID[orgID] = perms
+	}
 
 	union, err := rbac.UnionAllowLists(allowLists...)
 	if err != nil {
diff --git a/coderd/rbac/astvalue.go b/coderd/rbac/astvalue.go
index a125b6bf7a4ff..d207ae888a3f7 100644
--- a/coderd/rbac/astvalue.go
+++ b/coderd/rbac/astvalue.go
@@ -157,23 +157,30 @@ func (role Role) regoValue() ast.Value {
 	if role.cachedRegoValue != nil {
 		return role.cachedRegoValue
 	}
-	orgMap := ast.NewObject()
-	for k, p := range role.Org {
-		orgMap.Insert(ast.StringTerm(k), ast.NewTerm(regoSlice(p)))
+	byOrgIDMap := ast.NewObject()
+	for k, p := range role.ByOrgID {
+		byOrgIDMap.Insert(ast.StringTerm(k), ast.NewTerm(
+			ast.NewObject(
+				[2]*ast.Term{
+					ast.StringTerm("org"),
+					ast.NewTerm(regoSlice(p.Org)),
+				},
+			),
+		))
 	}
 	return ast.NewObject(
 		[2]*ast.Term{
 			ast.StringTerm("site"),
 			ast.NewTerm(regoSlice(role.Site)),
 		},
-		[2]*ast.Term{
-			ast.StringTerm("org"),
-			ast.NewTerm(orgMap),
-		},
 		[2]*ast.Term{
 			ast.StringTerm("user"),
 			ast.NewTerm(regoSlice(role.User)),
 		},
+		[2]*ast.Term{
+			ast.StringTerm("by_org_id"),
+			ast.NewTerm(byOrgIDMap),
+		},
 	)
 }
 
diff --git a/coderd/rbac/authz_internal_test.go b/coderd/rbac/authz_internal_test.go
index 284045b11fba0..1d52304ba0ed9 100644
--- a/coderd/rbac/authz_internal_test.go
+++ b/coderd/rbac/authz_internal_test.go
@@ -633,13 +633,6 @@ func TestAuthorizeDomain(t *testing.T) {
 			{
 				Identifier: RoleIdentifier{Name: "ReadOnlyOrgAndUser"},
 				Site:       []Permission{},
-				Org: map[string][]Permission{
-					defOrg.String(): {{
-						Negate:       false,
-						ResourceType: "*",
-						Action:       policy.ActionRead,
-					}},
-				},
 				User: []Permission{
 					{
 						Negate:       false,
@@ -647,6 +640,15 @@ func TestAuthorizeDomain(t *testing.T) {
 						Action:       policy.ActionRead,
 					},
 				},
+				ByOrgID: map[string]OrgPermissions{
+					defOrg.String(): {
+						Org: []Permission{{
+							Negate:       false,
+							ResourceType: "*",
+							Action:       policy.ActionRead,
+						}},
+					},
+				},
 			},
 		},
 	}
@@ -726,12 +728,14 @@ func TestAuthorizeLevels(t *testing.T) {
 			must(RoleByName(RoleOwner())),
 			{
 				Identifier: RoleIdentifier{Name: "org-deny:", OrganizationID: defOrg},
-				Org: map[string][]Permission{
+				ByOrgID: map[string]OrgPermissions{
 					defOrg.String(): {
-						{
-							Negate:       true,
-							ResourceType: "*",
-							Action:       "*",
+						Org: []Permission{
+							{
+								Negate:       true,
+								ResourceType: "*",
+								Action:       "*",
+							},
 						},
 					},
 				},
@@ -926,8 +930,8 @@ func TestAuthorizeScope(t *testing.T) {
 					// Only read access for workspaces.
 					ResourceWorkspace.Type: {policy.ActionRead},
 				}),
-				Org:  map[string][]Permission{},
-				User: []Permission{},
+				User:    []Permission{},
+				ByOrgID: map[string]OrgPermissions{},
 			},
 			AllowIDList: []AllowListElement{{Type: ResourceWorkspace.Type, ID: workspaceID.String()}},
 		},
@@ -1015,8 +1019,8 @@ func TestAuthorizeScope(t *testing.T) {
 					// Only read access for workspaces.
 					ResourceWorkspace.Type: {policy.ActionCreate},
 				}),
-				Org:  map[string][]Permission{},
-				User: []Permission{},
+				User:    []Permission{},
+				ByOrgID: map[string]OrgPermissions{},
 			},
 			// Empty string allow_list is allowed for actions like 'create'
 			AllowIDList: []AllowListElement{{
@@ -1138,14 +1142,16 @@ func TestAuthorizeScope(t *testing.T) {
 				},
 				DisplayName: "OrgAndUserScope",
 				Site:        nil,
-				Org: map[string][]Permission{
-					defOrg.String(): Permissions(map[string][]policy.Action{
-						ResourceWorkspace.Type: {policy.ActionRead},
-					}),
-				},
 				User: Permissions(map[string][]policy.Action{
 					ResourceUser.Type: {policy.ActionRead},
 				}),
+				ByOrgID: map[string]OrgPermissions{
+					defOrg.String(): {
+						Org: Permissions(map[string][]policy.Action{
+							ResourceWorkspace.Type: {policy.ActionRead},
+						}),
+					},
+				},
 			},
 			AllowIDList: []AllowListElement{AllowListAll()},
 		},
diff --git a/coderd/rbac/policy.rego b/coderd/rbac/policy.rego
index eb9187338c29b..0d11ea4cea6f0 100644
--- a/coderd/rbac/policy.rego
+++ b/coderd/rbac/policy.rego
@@ -114,16 +114,16 @@ site_allow(roles) := num if {
 #  Adding a second org_members set might affect the partial evaluation.
 #  This is being left until org scopes are used.
 org_members := {orgID |
-	input.subject.roles[_].org[orgID]
+	input.subject.roles[_].by_org_id[orgID]
 }
 
 # 'org' is the same as 'site' except we need to iterate over each organization
 # that the actor is a member of.
 default org := 0
-org := org_allow(input.subject.roles)
+org := org_allow(input.subject.roles, "org")
 
 default scope_org := 0
-scope_org := org_allow([input.subject.scope])
+scope_org := org_allow([input.subject.scope], "org")
 
 # org_allow_set is a helper function that iterates over all orgs that the actor
 # is a member of. For each organization it sets the numerical allow value
@@ -135,12 +135,12 @@ scope_org := org_allow([input.subject.scope])
 # The reason we calculate this for all orgs, and not just the input.object.org_owner
 # is that sometimes the input.object.org_owner is unknown. In those cases
 # we have a list of org_ids that can we use in a SQL 'WHERE' clause.
-org_allow_set(roles) := allow_set if {
+org_allow_set(roles, key) := allow_set if {
 	allow_set := {id: num |
 		id := org_members[_]
 		set := {is_allowed |
 			# Iterate over all org permissions in all roles
-			perm := roles[_].org[id][_]
+			perm := roles[_].by_org_id[id][key][_]
 			perm.action in [input.action, "*"]
 			perm.resource_type in [input.object.type, "*"]
 
@@ -151,11 +151,11 @@ org_allow_set(roles) := allow_set if {
 	}
 }
 
-org_allow(roles) := num if {
+org_allow(roles, key) := num if {
 	# If the object has "any_org" set to true, then use the other
 	# org_allow block.
 	not input.object.any_org
-	allow := org_allow_set(roles)
+	allow := org_allow_set(roles, key)
 
 	# Return only the org value of the input's org.
 	# The reason why we do not do this up front, is that we need to make sure
@@ -171,9 +171,9 @@ org_allow(roles) := num if {
 # This is useful for UI elements when we want to conclude, "Can the user create
 # a new template in any organization?"
 # It is easier than iterating over every organization the user is apart of.
-org_allow(roles) := num if {
+org_allow(roles, key) := num if {
 	input.object.any_org # if this is false, this code block is not used
-	allow := org_allow_set(roles)
+	allow := org_allow_set(roles, key)
 
 	# allow is a map of {"<org_id>": <number>}. We only care about values
 	# that are 1, and ignore the rest.
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
index e5f822b91e193..27162b7230cb9 100644
--- a/coderd/rbac/roles.go
+++ b/coderd/rbac/roles.go
@@ -282,8 +282,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
 				ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
 			})...),
-		Org:  map[string][]Permission{},
-		User: []Permission{},
+		User:    []Permission{},
+		ByOrgID: map[string]OrgPermissions{},
 	}.withCachedRegoValue()
 
 	memberRole := Role{
@@ -295,7 +295,6 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceOauth2App.Type:      {policy.ActionRead},
 			ResourceWorkspaceProxy.Type: {policy.ActionRead},
 		}),
-		Org: map[string][]Permission{},
 		User: append(allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceUser, ResourceOrganizationMember),
 			Permissions(map[string][]policy.Action{
 				// Reduced permission set on dormant workspaces. No build, ssh, or exec
@@ -309,6 +308,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				ResourceProvisionerDaemon.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
 			})...,
 		),
+		ByOrgID: map[string]OrgPermissions{},
 	}.withCachedRegoValue()
 
 	auditorRole := Role{
@@ -331,8 +331,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			// Allow auditors to query aibridge interceptions.
 			ResourceAibridgeInterception.Type: {policy.ActionRead},
 		}),
-		Org:  map[string][]Permission{},
-		User: []Permission{},
+		User:    []Permission{},
+		ByOrgID: map[string]OrgPermissions{},
 	}.withCachedRegoValue()
 
 	templateAdminRole := Role{
@@ -354,8 +354,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceOrganization.Type:       {policy.ActionRead},
 			ResourceOrganizationMember.Type: {policy.ActionRead},
 		}),
-		Org:  map[string][]Permission{},
-		User: []Permission{},
+		User:    []Permission{},
+		ByOrgID: map[string]OrgPermissions{},
 	}.withCachedRegoValue()
 
 	userAdminRole := Role{
@@ -378,8 +378,8 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			// Manage org membership based on OIDC claims
 			ResourceIdpsyncSettings.Type: {policy.ActionRead, policy.ActionUpdate},
 		}),
-		Org:  map[string][]Permission{},
-		User: []Permission{},
+		User:    []Permission{},
+		ByOrgID: map[string]OrgPermissions{},
 	}.withCachedRegoValue()
 
 	builtInRoles = map[string]func(orgID uuid.UUID) Role{
@@ -419,18 +419,20 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 					// users at the site wide to know they exist.
 					ResourceUser.Type: {policy.ActionRead},
 				}),
-				Org: map[string][]Permission{
+				User: []Permission{},
+				ByOrgID: map[string]OrgPermissions{
 					// Org admins should not have workspace exec perms.
-					organizationID.String(): append(allPermsExcept(ResourceWorkspace, ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceAssignRole, ResourceUserSecret), Permissions(map[string][]policy.Action{
-						ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent, policy.ActionDeleteAgent},
-						ResourceWorkspace.Type:        slice.Omit(ResourceWorkspace.AvailableActions(), policy.ActionApplicationConnect, policy.ActionSSH),
-						// PrebuiltWorkspaces are a subset of Workspaces.
-						// Explicitly setting PrebuiltWorkspace permissions for clarity.
-						// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
-						ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
-					})...),
+					organizationID.String(): {
+						Org: append(allPermsExcept(ResourceWorkspace, ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceAssignRole, ResourceUserSecret), Permissions(map[string][]policy.Action{
+							ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent, policy.ActionDeleteAgent},
+							ResourceWorkspace.Type:        slice.Omit(ResourceWorkspace.AvailableActions(), policy.ActionApplicationConnect, policy.ActionSSH),
+							// PrebuiltWorkspaces are a subset of Workspaces.
+							// Explicitly setting PrebuiltWorkspace permissions for clarity.
+							// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
+							ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
+						})...),
+					},
 				},
-				User: []Permission{},
 			}
 		},
 
@@ -440,18 +442,20 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				Identifier:  RoleIdentifier{Name: orgMember, OrganizationID: organizationID},
 				DisplayName: "",
 				Site:        []Permission{},
-				Org: map[string][]Permission{
-					organizationID.String(): Permissions(map[string][]policy.Action{
-						// All users can see the provisioner daemons for workspace
-						// creation.
-						ResourceProvisionerDaemon.Type: {policy.ActionRead},
-						// All org members can read the organization
-						ResourceOrganization.Type: {policy.ActionRead},
-						// Can read available roles.
-						ResourceAssignOrgRole.Type: {policy.ActionRead},
-					}),
+				User:        []Permission{},
+				ByOrgID: map[string]OrgPermissions{
+					organizationID.String(): {
+						Org: Permissions(map[string][]policy.Action{
+							// All users can see the provisioner daemons for workspace
+							// creation.
+							ResourceProvisionerDaemon.Type: {policy.ActionRead},
+							// All org members can read the organization
+							ResourceOrganization.Type: {policy.ActionRead},
+							// Can read available roles.
+							ResourceAssignOrgRole.Type: {policy.ActionRead},
+						}),
+					},
 				},
-				User: []Permission{},
 			}
 		},
 		orgAuditor: func(organizationID uuid.UUID) Role {
@@ -459,19 +463,21 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				Identifier:  RoleIdentifier{Name: orgAuditor, OrganizationID: organizationID},
 				DisplayName: "Organization Auditor",
 				Site:        []Permission{},
-				Org: map[string][]Permission{
-					organizationID.String(): Permissions(map[string][]policy.Action{
-						ResourceAuditLog.Type:      {policy.ActionRead},
-						ResourceConnectionLog.Type: {policy.ActionRead},
-						// Allow auditors to see the resources that audit logs reflect.
-						ResourceTemplate.Type:           {policy.ActionRead, policy.ActionViewInsights},
-						ResourceGroup.Type:              {policy.ActionRead},
-						ResourceGroupMember.Type:        {policy.ActionRead},
-						ResourceOrganization.Type:       {policy.ActionRead},
-						ResourceOrganizationMember.Type: {policy.ActionRead},
-					}),
+				User:        []Permission{},
+				ByOrgID: map[string]OrgPermissions{
+					organizationID.String(): {
+						Org: Permissions(map[string][]policy.Action{
+							ResourceAuditLog.Type:      {policy.ActionRead},
+							ResourceConnectionLog.Type: {policy.ActionRead},
+							// Allow auditors to see the resources that audit logs reflect.
+							ResourceTemplate.Type:           {policy.ActionRead, policy.ActionViewInsights},
+							ResourceGroup.Type:              {policy.ActionRead},
+							ResourceGroupMember.Type:        {policy.ActionRead},
+							ResourceOrganization.Type:       {policy.ActionRead},
+							ResourceOrganizationMember.Type: {policy.ActionRead},
+						}),
+					},
 				},
-				User: []Permission{},
 			}
 		},
 		orgUserAdmin: func(organizationID uuid.UUID) Role {
@@ -484,18 +490,20 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 					// users at the site wide to know they exist.
 					ResourceUser.Type: {policy.ActionRead},
 				}),
-				Org: map[string][]Permission{
-					organizationID.String(): Permissions(map[string][]policy.Action{
-						// Assign, remove, and read roles in the organization.
-						ResourceAssignOrgRole.Type:      {policy.ActionAssign, policy.ActionUnassign, policy.ActionRead},
-						ResourceOrganization.Type:       {policy.ActionRead},
-						ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
-						ResourceGroup.Type:              ResourceGroup.AvailableActions(),
-						ResourceGroupMember.Type:        ResourceGroupMember.AvailableActions(),
-						ResourceIdpsyncSettings.Type:    {policy.ActionRead, policy.ActionUpdate},
-					}),
-				},
 				User: []Permission{},
+				ByOrgID: map[string]OrgPermissions{
+					organizationID.String(): {
+						Org: Permissions(map[string][]policy.Action{
+							// Assign, remove, and read roles in the organization.
+							ResourceAssignOrgRole.Type:      {policy.ActionAssign, policy.ActionUnassign, policy.ActionRead},
+							ResourceOrganization.Type:       {policy.ActionRead},
+							ResourceOrganizationMember.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
+							ResourceGroup.Type:              ResourceGroup.AvailableActions(),
+							ResourceGroupMember.Type:        ResourceGroupMember.AvailableActions(),
+							ResourceIdpsyncSettings.Type:    {policy.ActionRead, policy.ActionUpdate},
+						}),
+					},
+				},
 			}
 		},
 		orgTemplateAdmin: func(organizationID uuid.UUID) Role {
@@ -504,25 +512,27 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				Identifier:  RoleIdentifier{Name: orgTemplateAdmin, OrganizationID: organizationID},
 				DisplayName: "Organization Template Admin",
 				Site:        []Permission{},
-				Org: map[string][]Permission{
-					organizationID.String(): Permissions(map[string][]policy.Action{
-						ResourceTemplate.Type:          ResourceTemplate.AvailableActions(),
-						ResourceFile.Type:              {policy.ActionCreate, policy.ActionRead},
-						ResourceWorkspace.Type:         {policy.ActionRead},
-						ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
-						// Assigning template perms requires this permission.
-						ResourceOrganization.Type:       {policy.ActionRead},
-						ResourceOrganizationMember.Type: {policy.ActionRead},
-						ResourceGroup.Type:              {policy.ActionRead},
-						ResourceGroupMember.Type:        {policy.ActionRead},
-						// Since templates have to correlate with provisioners,
-						// the ability to create templates and provisioners has
-						// a lot of overlap.
-						ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
-						ResourceProvisionerJobs.Type:   {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
-					}),
+				User:        []Permission{},
+				ByOrgID: map[string]OrgPermissions{
+					organizationID.String(): {
+						Org: Permissions(map[string][]policy.Action{
+							ResourceTemplate.Type:          ResourceTemplate.AvailableActions(),
+							ResourceFile.Type:              {policy.ActionCreate, policy.ActionRead},
+							ResourceWorkspace.Type:         {policy.ActionRead},
+							ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
+							// Assigning template perms requires this permission.
+							ResourceOrganization.Type:       {policy.ActionRead},
+							ResourceOrganizationMember.Type: {policy.ActionRead},
+							ResourceGroup.Type:              {policy.ActionRead},
+							ResourceGroupMember.Type:        {policy.ActionRead},
+							// Since templates have to correlate with provisioners,
+							// the ability to create templates and provisioners has
+							// a lot of overlap.
+							ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
+							ResourceProvisionerJobs.Type:   {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
+						}),
+					},
 				},
-				User: []Permission{},
 			}
 		},
 		// orgWorkspaceCreationBan prevents creating & deleting workspaces. This
@@ -533,31 +543,33 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 				Identifier:  RoleIdentifier{Name: orgWorkspaceCreationBan, OrganizationID: organizationID},
 				DisplayName: "Organization Workspace Creation Ban",
 				Site:        []Permission{},
-				Org: map[string][]Permission{
+				User:        []Permission{},
+				ByOrgID: map[string]OrgPermissions{
 					organizationID.String(): {
-						{
-							Negate:       true,
-							ResourceType: ResourceWorkspace.Type,
-							Action:       policy.ActionCreate,
-						},
-						{
-							Negate:       true,
-							ResourceType: ResourceWorkspace.Type,
-							Action:       policy.ActionDelete,
-						},
-						{
-							Negate:       true,
-							ResourceType: ResourceWorkspace.Type,
-							Action:       policy.ActionCreateAgent,
-						},
-						{
-							Negate:       true,
-							ResourceType: ResourceWorkspace.Type,
-							Action:       policy.ActionDeleteAgent,
+						Org: []Permission{
+							{
+								Negate:       true,
+								ResourceType: ResourceWorkspace.Type,
+								Action:       policy.ActionCreate,
+							},
+							{
+								Negate:       true,
+								ResourceType: ResourceWorkspace.Type,
+								Action:       policy.ActionDelete,
+							},
+							{
+								Negate:       true,
+								ResourceType: ResourceWorkspace.Type,
+								Action:       policy.ActionCreateAgent,
+							},
+							{
+								Negate:       true,
+								ResourceType: ResourceWorkspace.Type,
+								Action:       policy.ActionDeleteAgent,
+							},
 						},
 					},
 				},
-				User: []Permission{},
 			}
 		},
 	}
@@ -680,17 +692,20 @@ type Role struct {
 	// that means the UI should never display it.
 	DisplayName string       `json:"display_name"`
 	Site        []Permission `json:"site"`
-	// Org is a map of orgid to permissions. We represent orgid as a string.
-	// We scope the organizations in the role so we can easily combine all the
-	// roles.
-	Org  map[string][]Permission `json:"org"`
-	User []Permission            `json:"user"`
+	User        []Permission `json:"user"`
+	// ByOrgID is a map of organization IDs to permissions. Grouping by
+	// organization makes roles easy to combine.
+	ByOrgID map[string]OrgPermissions `json:"by_org_id"`
 
 	// cachedRegoValue can be used to cache the rego value for this role.
 	// This is helpful for static roles that never change.
 	cachedRegoValue ast.Value
 }
 
+type OrgPermissions struct {
+	Org []Permission `json:"org"`
+}
+
 // Valid will check all it's permissions and ensure they are all correct
 // according to the policy. This verifies every action specified make sense
 // for the given resource.
@@ -702,8 +717,8 @@ func (role Role) Valid() error {
 		}
 	}
 
-	for orgID, permissions := range role.Org {
-		for _, perm := range permissions {
+	for orgID, orgPermissions := range role.ByOrgID {
+		for _, perm := range orgPermissions.Org {
 			if err := perm.Valid(); err != nil {
 				errs = append(errs, xerrors.Errorf("org=%q: %w", orgID, err))
 			}
@@ -774,7 +789,7 @@ func RoleByName(name RoleIdentifier) (Role, error) {
 	// Ensure all org roles are properly scoped a non-empty organization id.
 	// This is just some defensive programming.
 	role := roleFunc(name.OrganizationID)
-	if len(role.Org) > 0 && name.OrganizationID == uuid.Nil {
+	if len(role.ByOrgID) > 0 && name.OrganizationID == uuid.Nil {
 		return Role{}, xerrors.Errorf("expect a org id for role %q", name.String())
 	}
 
diff --git a/coderd/rbac/roles_internal_test.go b/coderd/rbac/roles_internal_test.go
index 5c7a00d899a40..5f18cac44a7b4 100644
--- a/coderd/rbac/roles_internal_test.go
+++ b/coderd/rbac/roles_internal_test.go
@@ -270,17 +270,17 @@ func TestDeduplicatePermissions(t *testing.T) {
 	require.Equal(t, want, got)
 }
 
-// SameAs compares 2 roles for equality.
+// equalRoles compares 2 roles for equality.
 func equalRoles(t *testing.T, a, b Role) {
 	require.Equal(t, a.Identifier, b.Identifier, "role names")
 	require.Equal(t, a.DisplayName, b.DisplayName, "role display names")
 	require.ElementsMatch(t, a.Site, b.Site, "site permissions")
 	require.ElementsMatch(t, a.User, b.User, "user permissions")
-	require.Equal(t, len(a.Org), len(b.Org), "same number of org roles")
+	require.Equal(t, len(a.ByOrgID), len(b.ByOrgID), "same number of org roles")
 
-	for ak, av := range a.Org {
-		bv, ok := b.Org[ak]
+	for ak, av := range a.ByOrgID {
+		bv, ok := b.ByOrgID[ak]
 		require.True(t, ok, "org permissions missing: %s", ak)
-		require.ElementsMatchf(t, av, bv, "org %s permissions", ak)
+		require.ElementsMatchf(t, av.Org, bv.Org, "org %s permissions", ak)
 	}
 }
diff --git a/coderd/rbac/rolestore/rolestore.go b/coderd/rbac/rolestore/rolestore.go
index 610b04c06aa19..c2189c13b0c1f 100644
--- a/coderd/rbac/rolestore/rolestore.go
+++ b/coderd/rbac/rolestore/rolestore.go
@@ -124,7 +124,6 @@ func ConvertDBRole(dbRole database.CustomRole) (rbac.Role, error) {
 		Identifier:  dbRole.RoleIdentifier(),
 		DisplayName: dbRole.DisplayName,
 		Site:        convertPermissions(dbRole.SitePermissions),
-		Org:         nil,
 		User:        convertPermissions(dbRole.UserPermissions),
 	}
 
@@ -134,8 +133,10 @@ func ConvertDBRole(dbRole database.CustomRole) (rbac.Role, error) {
 	}
 
 	if dbRole.OrganizationID.UUID != uuid.Nil {
-		role.Org = map[string][]rbac.Permission{
-			dbRole.OrganizationID.UUID.String(): convertPermissions(dbRole.OrgPermissions),
+		role.ByOrgID = map[string]rbac.OrgPermissions{
+			dbRole.OrganizationID.UUID.String(): {
+				Org: convertPermissions(dbRole.OrgPermissions),
+			},
 		}
 	}
 
diff --git a/coderd/rbac/scopes.go b/coderd/rbac/scopes.go
index ff8f08adb1e5b..5c8c80305679c 100644
--- a/coderd/rbac/scopes.go
+++ b/coderd/rbac/scopes.go
@@ -78,8 +78,8 @@ var builtinScopes = map[ScopeName]Scope{
 			Site: Permissions(map[string][]policy.Action{
 				ResourceWildcard.Type: {policy.WildcardSymbol},
 			}),
-			Org:  map[string][]Permission{},
-			User: []Permission{},
+			User:    []Permission{},
+			ByOrgID: map[string]OrgPermissions{},
 		},
 		AllowIDList: []AllowListElement{AllowListAll()},
 	},
@@ -91,8 +91,8 @@ var builtinScopes = map[ScopeName]Scope{
 			Site: Permissions(map[string][]policy.Action{
 				ResourceWorkspace.Type: {policy.ActionApplicationConnect},
 			}),
-			Org:  map[string][]Permission{},
-			User: []Permission{},
+			User:    []Permission{},
+			ByOrgID: map[string]OrgPermissions{},
 		},
 		AllowIDList: []AllowListElement{AllowListAll()},
 	},
@@ -102,8 +102,8 @@ var builtinScopes = map[ScopeName]Scope{
 			Identifier:  RoleIdentifier{Name: fmt.Sprintf("Scope_%s", ScopeNoUserData)},
 			DisplayName: "Scope without access to user data",
 			Site:        allPermsExcept(ResourceUser),
-			Org:         map[string][]Permission{},
 			User:        []Permission{},
+			ByOrgID:     map[string]OrgPermissions{},
 		},
 		AllowIDList: []AllowListElement{AllowListAll()},
 	},
@@ -232,8 +232,8 @@ func ExpandScope(scope ScopeName) (Scope, error) {
 				Identifier:  RoleIdentifier{Name: fmt.Sprintf("Scope_%s", scope)},
 				DisplayName: string(scope),
 				Site:        site,
-				Org:         map[string][]Permission{},
 				User:        []Permission{},
+				ByOrgID:     map[string]OrgPermissions{},
 			},
 			// Composites are site-level; allow-list empty by default
 			AllowIDList: []AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}},
@@ -289,8 +289,8 @@ func expandLowLevel(resource string, action policy.Action) Scope {
 			Identifier:  RoleIdentifier{Name: fmt.Sprintf("Scope_%s:%s", resource, action)},
 			DisplayName: fmt.Sprintf("%s:%s", resource, action),
 			Site:        []Permission{{ResourceType: resource, Action: action}},
-			Org:         map[string][]Permission{},
 			User:        []Permission{},
+			ByOrgID:     map[string]OrgPermissions{},
 		},
 		// Low-level scopes intentionally return a wildcard allow list.
 		AllowIDList: []AllowListElement{{Type: policy.WildcardSymbol, ID: policy.WildcardSymbol}},
diff --git a/coderd/rbac/scopes_catalog_internal_test.go b/coderd/rbac/scopes_catalog_internal_test.go
index 4530447e993a1..37de001fae2ea 100644
--- a/coderd/rbac/scopes_catalog_internal_test.go
+++ b/coderd/rbac/scopes_catalog_internal_test.go
@@ -36,7 +36,7 @@ func TestExternalScopeNames(t *testing.T) {
 			expected, ok := CompositeSitePermissions(ScopeName(name))
 			require.Truef(t, ok, "expected composite scope definition: %s", name)
 			require.ElementsMatchf(t, expected, s.Site, "unexpected expanded permissions for %s", name)
-			require.Empty(t, s.Org)
+			require.Empty(t, s.ByOrgID)
 			require.Empty(t, s.User)
 			continue
 		}
@@ -50,7 +50,7 @@ func TestExternalScopeNames(t *testing.T) {
 		require.Len(t, s.Site, 1)
 		require.Equal(t, res, s.Site[0].ResourceType)
 		require.Equal(t, act, s.Site[0].Action)
-		require.Empty(t, s.Org)
+		require.Empty(t, s.ByOrgID)
 		require.Empty(t, s.User)
 	}
 }
diff --git a/coderd/rbac/scopes_test.go b/coderd/rbac/scopes_test.go
index a6f50b0326545..270f6ff02854f 100644
--- a/coderd/rbac/scopes_test.go
+++ b/coderd/rbac/scopes_test.go
@@ -34,7 +34,7 @@ func TestExpandScope(t *testing.T) {
 				require.Len(t, s.Site, 1)
 				require.Equal(t, tc.resource, s.Site[0].ResourceType)
 				require.Equal(t, tc.action, s.Site[0].Action)
-				require.Empty(t, s.Org)
+				require.Empty(t, s.ByOrgID)
 				require.Empty(t, s.User)
 
 				require.Equal(t, []rbac.AllowListElement{rbac.AllowListAll()}, s.AllowIDList)
diff --git a/coderd/workspaceapps/db.go b/coderd/workspaceapps/db.go
index 9e26a28c71370..337f4fab52f8b 100644
--- a/coderd/workspaceapps/db.go
+++ b/coderd/workspaceapps/db.go
@@ -355,21 +355,20 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *rbac.Subj
 			return true, []string{}, nil
 		}
 	case database.AppSharingLevelOrganization:
-		// Check if the user is a member of the same organization as the workspace
 		// First check if they have permission to connect to their own workspace (enforces scopes)
 		err := p.Authorizer.Authorize(ctx, *roles, rbacAction, rbacResourceOwned)
 		if err != nil {
 			return false, warnings, nil
 		}
 
-		// Check if the user is a member of the workspace's organization
+		// Check if the user is a member of the same organization as the workspace
 		workspaceOrgID := dbReq.Workspace.OrganizationID
 		expandedRoles, err := roles.Roles.Expand()
 		if err != nil {
 			return false, warnings, xerrors.Errorf("expand roles: %w", err)
 		}
 		for _, role := range expandedRoles {
-			if _, ok := role.Org[workspaceOrgID.String()]; ok {
+			if _, ok := role.ByOrgID[workspaceOrgID.String()]; ok {
 				return true, []string{}, nil
 			}
 		}
diff --git a/enterprise/coderd/coderd_test.go b/enterprise/coderd/coderd_test.go
index 860c4135e0c1e..00bb3e59e616a 100644
--- a/enterprise/coderd/coderd_test.go
+++ b/enterprise/coderd/coderd_test.go
@@ -739,8 +739,8 @@ func testDBAuthzRole(ctx context.Context) context.Context {
 				Site: rbac.Permissions(map[string][]policy.Action{
 					rbac.ResourceWildcard.Type: {policy.WildcardSymbol},
 				}),
-				Org:  map[string][]rbac.Permission{},
-				User: []rbac.Permission{},
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
 			},
 		}),
 		Scope: rbac.ScopeAll,
diff --git a/enterprise/tailnet/pgcoord.go b/enterprise/tailnet/pgcoord.go
index 32bd896669c14..79e5c13c93983 100644
--- a/enterprise/tailnet/pgcoord.go
+++ b/enterprise/tailnet/pgcoord.go
@@ -106,8 +106,8 @@ var pgCoordSubject = rbac.Subject{
 			Site: rbac.Permissions(map[string][]policy.Action{
 				rbac.ResourceTailnetCoordinator.Type: {policy.WildcardSymbol},
 			}),
-			Org:  map[string][]rbac.Permission{},
-			User: []rbac.Permission{},
+			User:    []rbac.Permission{},
+			ByOrgID: map[string]rbac.OrgPermissions{},
 		},
 	}),
 	Scope: rbac.ScopeAll,

From 97cb19eeb57afe8e57027459ab5d5714e9bed1a1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Thu, 9 Oct 2025 13:55:55 -0600
Subject: [PATCH 101/298] chore: replace nexus-repository icon with an actual
 svg (#20251)

---
 site/static/icon/nexus-repository.svg | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/site/static/icon/nexus-repository.svg b/site/static/icon/nexus-repository.svg
index ca135cd5ebac9..6db132b3142e0 100644
--- a/site/static/icon/nexus-repository.svg
+++ b/site/static/icon/nexus-repository.svg
@@ -1,5 +1,5 @@
-<?xml version="1.0" encoding="UTF-8"?>
-<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" 
-     width="256" height="256" viewBox="0 0 256 256">
-  <image width="256" height="256" xlink:href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAQAAAAEACAYAAABccqhmAAAQAElEQVR4Aex9CWBcVbn/9507kyZdWbrQJk3TPZl0AcJiQWhRH7KUpUjx+dxwQX3qX4WCPEUNUUE24am4ggruNKC0VNAnSgGhbIWSJtOFLmmbFmjZuqZJ5p7z/3135k4nadYmM3MnOafnu2c/5zu/c77vLPdmqsiafo/A+JLy94+bNPPm7na07MFrzpv+8FfvKH30a8ee+/APB3W3nM2XewhYBZB7Y9ZtjounzC4vKpnxZ23ob2yoorsFjaKY0vRZ09hSszG2+fNSbt6vK/PFtdS/ELAKoH+Np9ebSCQytLhkRqWJ6aeIzHxmhkNNXmI3Ho4hZcjkG2NGGte9aeoD/+/l14e/dXw3itosOYaAVQA5NmCdsVtZWamOK5z2sd17zFoI73Xa6OFEHCIYQ9QCp3tWqTAyQm2grKMcDjllbn7oX9MfXvTP8r9dOQVp1vYDBKQLVgEICjlORXPmFIwdHznjF3ffV8ek7tFMY11jwpqIoQgYLsFAB+DZA2tChlU4pDgcctjhMPYFZ7RoWjn9kSu/c/xjXzkqUluZV2kqlVAPqrVZA4SAVQABGowjYaVo2uxCvf3tu9jQv5h5Kilmw6xA5A8utAAh1lm4cKHTnTZcg70DTg2oTywZqBBoD8cYcljxYFT2P41NaqO7Y/9ljy+nvGUrX+1Wvd1p2+bJLAL+HMlsq7a1PkFgwuQZN1BTbA0b54OQ9hApdpRS5DCTDCxDaumQ4U2bNkn0oZhu+FAFk/zDpYBkhxJQXhzRcNL61zsO7vnLvteHzF5oFjsLFy92ZDdQWYldAUjyWwo2Aj2eEMHuzsDgrnjq7PnFk2dt15quJkNDIe2QecaiD0kV6UxQGzS4sXESt4nrMChSjuMDLg8NzhGKyZhD5Bo2rlFaG2UMnY2UZ15+ZMXvao56YUwVV+loeTnT9USiCMiaQCLgM2UVgI9EwF0Rpglls06cMGXW0+TSg9ilHwfhy0thu9vCnVKmU6/SikQJCBFBCcQJZRSuA5QoBo+ghFhpcyk3N79Ytuyqa3eNqgtXV1OIEkpAeCdrAomACiRXlqlWCEyffvqwe373l1v0QXoSq/7JxmjHGLytj+dixiItXrjiJAkrc9J/pB7ZCaQQlnyoAvIOBXwoXqaRgwePgsa48fW9e1aq/D3zcD+gqqqqNEEREIxVBAAhYBaDFjCOLDtJBETwi6fM+Fpj856tRtOXceYeTK4OkTaUpETutsKfiG7tlLcOdhbizhL9NI4rAglK+yw7BNwSIrY0xuah1/ftfnTmQ4tKo1TOlaZSERRBZaW9H6AAGasAAjQYPisVFRWDi6fNeu++2O5nXZeu18YcpQ0E388Al5nxDIhliLwQ2PEVgSIOkaEzYuS+GF329PexG8iLVsfvBrxdAfJamx0EUltVqQHrzy4CkcjCvInTZ03fufvgH0yLfpQ0l8k5XyfYSt3S+9vvRFKmHG6vIRF6ifdd8RN2A8y4mzTOIPD/3zv37d5RW/D0omhiN1CJHUEldgPxvPaZLQSsAsgW8intyvt5+Xx3T2P0uy1N7koT44sg+LhgMyQDJCTZfQET4ccdgERlgxiNtiVEdWCZsFdxwkTOUchxc+1DTz9T/dDbp1XjkjAqbwsQaW32EPDnVvY4GOAtz5s3L/TvF1d/8u39tEa7+moI/hBPuLWBAqBWRAmjmbA5iFMiKtsOOAKr8kxw0t7EYnIMkTrJUOhJk7/vj7VDni0ia7KKQHvjlFWGBlLjRVNmzl279bUXseL/3JCBMOBCHxrAX+lFEchqn0oS5xETpR4JusIN2bvKkkwP4Q1eMtADD/iWZoRIH15O4pkUHI9oAV5lri9dclXlwsWLHbImIwi0bcQqgLaIZCBcPPWkSUVTZ/0BAvAYazUDTTJjxTdGxAaqIOFCxElDqlJJ4oTYUxRYUKlj8vOIizbSbn2FBBdSTkKpbRrEC7N+HDM7ebgm+GZtwTObyh+8+r/ktwcqDd4W+Dmsm3YErAJIO8SHGpDXemMmln3HdRvXckx/CCs7O8RCBGkgRUyQdxK/X8oYUQiHyI/vqatEt/S0UDfyC7+p2SDkXlBcEKcSEhiUYj2mBILxJmTu3Rrb+u/7H9pXIUpAKCWj9aYJAZWmem21bRAYU1w6f/eBN9eFYvwNjlGYNDKAGGuikCImEXwhpAw0KxCEtDIVxPTU/csaf7XkQRo+0EDIRn9VNhodSG2OKZo5c0xh6QqOmYdY09j+1nes8H3ZJcYFZ1iz+7Hm0L7Xyx665qt9WflAr6u9/lsF0B4qvYyT13oTyirGFk6I/EqZ2IsA+V1tV/bUrX0vm+uPxRmKJY9Y3xRZelXdzCXXLOyPnQxCnzA3g8BG/+Lh38+v+UKs8eA60nQ5M4WYW2/vRfjJmu4gwEZxWczR90WWXPXErKXXnNidQjZP9xGwCqD7WHWaU97nj5s464LCkvKtjjY/YE3DUIBhKJUQ51lRAkJewD46Q4CRyMbhd7ew+0xk6dW3yi8RIc7aPkDAKoA+AHHC1BPLNtS/sZi1uxSCP96vUgTf91u31wgwNCnuB/TVtOnA1rIHF32+1zUOoAo66qpVAB0h00W8nPOPm3LCqKIJkVtbmg5GtdYLZEXXZLDzN2S4iwoSyVIm4bVOBwgIRj5JFlwSjjGO+TF2A6siD155hsRZOjIErALoIW4VFRVhKYJz/hed5qa12tDVEm5LMmFFGbSNbxu2u4S2iLQOC46tYw6FNOvZOBr8K7J00X2Rv15z3KEU6+suAlYBdBcp5CuaM6dg+5tNp4+bUL6Gtf5fbcwxnU1QFLE2zQgYIkez+YDW7pbypVd999SHK4enucl+Vb1VAN0czsIps4rc7bt/y677GGtTyph5ipjsCt5NANOXjVG1Awq7TF/f4+5dH1l61eUIW5tAoDNHdZZo04gWLlzojC4q/ZZ7sHkrufoDIvh21c/MzOgmzlDFJCSKQIZnNO5f7ip76Konyx9eFJn3WGUoM9zmZitWAXQwbpWVlWrc+MhF/362bjtAqsLMkgmWzN3NyZnMHwhPXfe5EInqfu705Ozm7krGRchnAkNFIfD/btc1da/v3/uzsr99fWylsX9k5AOU6mJupwatXxAYO2XWiXffU/1/xPQgtvtjZEYRTNsJKUpACElHaDFNj7BkZ8XYGPIplb+Cgk2ms3LtpbXtc9s8PjZt44MSBhSfMi1Nq+97aO9V9vuBw0fFKoA2mBSWzLjPibnPGMPzMLmNCIBSioTaZPWCyOO5PX8Ykrp7Xq7jEr7QS45UwZcwOYYmTZqkPX9XD6MNkSKjmDRTkk9GrBAlTKo/ERVQxxxLTLeazXtXlS695uyFZuD8/kBXA2IVABCSV3uFkyJXFU0of5uMXgjhCXnT35v8RAzX+xt8uL5fwkIS9gVPwGxLXnqiXGs/IqlvjN+m1AbeScj3i0usfx/Kz/98dXW164W7eHzgwvxHjEsfBYdvSVZfCRgoBQL5gm8YqVASeKbNMjPwj1NvG4H+KiN2l9Q+9OzisoeumTrP3g9gNHuLao6Ur6yMnwF912e7aPKsc159q7FWufQ9Q2a4TG4hPx0u5g15k5AShjk+IZk5EUOt0imLhjnOkwYPmvkZFaK5c06Z+fFN0ZVbEdUtW8VVet1FN/9OFReMVRy6gQztlYLM8boJ00YwYmYibBY8RSAZ0kzMTMyHUw+bzTdsLjHk1ry+Z9+NFQ8tGjmQFYEsHj3EL3ezi/AvW7bMkR4UT5ldXlQSedjEYo9A+KcYQ2GZ1EjzBB6ubznpaWfyMbM3Kf082XJTV30I/5vM5r+PGsZzt21e80R3V/62vEdnVDWvOeembwwiFWGiB7CTIJJfMcGRiPyVHy4zU6aUQFseJczMRzIG+UaZa/Ybve7VPbuvmLP4yoKB+NNkA0oBVFVV6TffdIcUFpff47bEao3hcyD0kBeZRtRW8L3IXHhIBwyEAO4+HTK3hI4OT92+bd3PotFoc1/wX3PeLQ3R82671HHU2Yp4DZb9eL1Y/WUHIG0wZ1cJ+Dwws3i7T8zHsFK3vzOI/h3Nf9b7a8NKU6m6X0Fwc3aHswHTUVn5C0vKv9Jsmrdgq/9RYygG4e9K6Hs4m7oDed/lYeb4yodV2ITogVC+c8q0krHXbV29+u2+a+VQTbXvv+UfkXNPnuk4/EncDr7BmmNeqo7DyJx9JSD8MCdwkUD3CLsBPtFl81zZkiv//JeljVMrXvi598l394rnbq5+rwDkQ57jJkTOfXVX4ypcbt+BdX4YG/ln0HfGzBXKvQFkjgubccxqE+b5U4tH/+eWV2rXLF++PC6UaepSNV/mrn7/Lb933PAMdvVduCxsRFPAEU9YZsYzGJaZ4wqyB+wYxQuauOWlAzvWfVV+pLQHRXMyK4QgJ/nuFtNFk46f+tRzddU4tj6MAhGIuhEiMkzegZZgxA/nkEWaF/BdLxCUBzPYwoqvHX7L5PF1Q8Yeffppx5f9Ld2C37b/tRfd+Hrdgts/n+fyKdgHPIsdARbQRC7wl/AlFUMinBWHGZj1oGVmLsCs+G59y+bV5Uuu/s8eFM25rP1WAYwZX3qDjjWtJkMLMCpGERsMrFjCA0QqrgiQGrcyS1IpHhuQZ5xnsAfhMg7dq8LhmSNml9227qmn9h7pJV9fdK3mkttqoxd/f45j6MNEznqGyAsl6uaEm3WHmTHm3CM+jOKprtJ/LHvwykcjS6/swX+t2qNm0pK5u5VCCLqbNdj5IpGFefI+/7jxZf99XFHp65iEX8c5P4xLKln1feYxPam9WeDH+a6fPxAus2z3seEOqWecUOiE7RvrLt+27qUd0erq+GVcALgsazz5/rzm/FNJ0/XGmD1gSXgTpQtvcCwzEzP3iCHj8Hs1c23Z0qsfmPO3ymN6VDjgmXNeAYjQL1y40Hn74PpTXnuj8UkM7U+Y1THMuKKCuMP1hgCTkoUQQBZqS4j24sQNFik22O6/oh368Kc/csnp9a+sWhUsBuPcVF92mbtqQdU70Qtuq3Ja1IlA/36kNAFzOMGz/rzoCWeG9SXvNO3dNGPJ1V9bWFuZ15OyQc2b8wrgzUZ17FMvrP2pcmOPE/EpSimNTikFecYgi6ATjO+STEiQhNsSsgXHgncixW+xQ5Xh4pGzrvjIB6rlNWZwOOyYk9oFt24sv+CUj3GLM5eNeg45ZTdA0ifDREKIy7oVfnrKhFE0Iqb0jbWb9q6duezq9/W0fNDyq6Ax1F1+Zs2aNQSv9a5sOdBYo4y5AoPJiphADCVAEgYRDEPgfcH3XMQlXfEHiTyecc7XDj8Uyg9XvOvEyI31y5cfzBXh97Gs5svc6IJbnotecOup7PKniNRbAD2tbyj8trvryrzobt62+aDEJjZr9x9lS658cOZDi0rbpmcz3JO2VU8yByVv8cTyC956R69lTbezNsfivK9BRoQnQXA4qQQQEL/HvvjF47viDwqBp4OGaZUTDmg9nAAAEABJREFUciqw6l9Wv3ZVfTYv+PoKl4UXDvkDlwweazR/j40yGDfdV3Vnqx5feWimi6AInsZF4S2nL/nqsGzxc6Tt5pQCmDBh9glFE8r/qV16kIjGEmFtYSYYebRa6RNxcIiY2aPEzsDzU4AMs4qRw29Q2Fk0fHDk1C0bal6UVT9ALPaKlSqu0vJZ8eBxU78T1mayImcxkcINDQn1qu4gFEYnjsY70Gt2UcvLpUuuumLeY5Whcx/+4aAg8NYVDzmhAOLb/Rk/cY37PKbMPMIrPYJhZjw9izHwXInwKR6BPMxMzK3JSwzCQ/F+7fCdg5RTvm1DzU+i0eDc7Pc1PCtP+mxLzYW3bR41tOATYSLcDzirsHOTZmT8hHy/uGknZj7iNpjZm1NSAbPvNxM16V+89s7uZ7c1bZ0jaUGnwCuAoonln37rHbeBXHOFYflHAB4WmNMh02r1l+2ZT34WZhQApYZ9f1pd7HfJp0RD2OaTEDnqr3n5oRO3b1p95caNNTsTyf3eWX5W1cGa+bc+GcrTZ4SM8wUM61votBwLRAkw/O1Ymao++clSxCc/LrMuM3uTUVpljvtxC31is4o9Nn3JV+47/i//UyJpmaKetiOI9rRMRvIXTig/S35918Top5rMUYaNg4a9iz64CeuJEYRfIyx+Q8YgNwh3zRKXpLbxEo7nQZZeWOb4oDMnXNnZJshA8GVG+yScgUscG2mDcZz/aNhcO3/T2pfX96L5nC5a8/7b9ofHTb4rlEcTHJfuYgGKyEWnxJcgmaJCiCUZ51SSOCFJl3jx94yYE+PWQ7dtK8zxeiSeOeFnvqzZaX6x/MFF36v4x7UjgvhHRoKc8BwIkvf5xcXlkcLxZX8yrv6n0brUsAkJc4oAKqYEZIsRZjHiihDDD2/cil8oHkKqQSE/kHBNO3GJpB45qe14BRMC7/nxaJvOivcZxV8aPoRO2LFp9aPIMuCtdyyAIihrGvrlkFEn4VJ3eQIUSLRKeNs4oil88pKQ1XMz95CxFWrbosSlErT90a5j/mf/gea6xQ/u+UTFCz8PL1wcnF8k6gDhtt1Kf3hcRcXgfz+z+tstrlvrGvNBrJYi6OSPswi+QyxxDH/8CinBFgRa4hOhwx2kY2cgu4M4HZ6j5zHMnTbpVSjteh48IPg/DhWY6Ts21/04Go3uQ5S1KQhUX1bVXHPhrS+OHjZsvqP1OVAE25lw3UuJPzX08sp09YVdXJBMkGSa58nog5kxK7smUlyoHbp7f8OaZdG8Z6cLk6IIsr0rEESFl6zSceNLL6fX97+CHd7XAZQAapiZFIGwgEPwSYwvUNCq7JJhrO/Y/osrqZkln5f2WpU047GlSCt+0nC4bMfmNV/csmbNq+3lt3GHEFiO+4EPXDD80REjTSkZvhIpe8hoSDosxchbETBRyDdGNIAsCYSZ4pGfEiiXmUneQuHe5+wYuXWlD1z58zWDnhpJMH2lBFBVj63qcYk+LDBhwsw5hcWRJ5XhX5LikUAoxsykRPCFMKTMkHM6ZFyMscEZX2MSaPgPpWTeZ0x8R5F0oZlMfEJqrPjbQBe++6QZZ+2oX70289zlbovy2nDFaXc0jh465GfMCsfA5vuImjSpJkOiBLyuKTwVwqr1BMGqgITAWmYmFXKI8vgzLqmX71+691PVy2nwPLw6pCwYQTHtzVZWViohv6HJk2eMLyyZ8dMYmSeI1RwVUi6zoxxmpYjJSRAzky9cIvhCOiH4Ek8w3kILN1O2s/Y0uIVOegdbvW+cflJkIrb7D/WHD3kyhW3bdpafVRWLnn/ra6rkmMs51DiHuPklIhdbAVgZCO9eGIiTals08GFm6C1HjTEO/9js3ffim7v3z6s0lUqOBZlkPu3IVUL4/Q5V4JxfVDLzW02ueQWy8llmY1h5WzgIPikIvne+R36BB7ocCh4BEXaTWPWNiccRFEGckCGN9lB7RDLnmNlzxS+sCGnt5TqIzvyR88MzX90U/Z4V/L4bFPmIqPz9e1YeNWLYu5Vq+QhqxmvDELZfcj8sUxgKAZE5aZnD0F9TcVH4j+qlex+uLXh+kiiBSiiDTPRH0EtrO1VVVVrol/c8cPHOXQdrSOsq0hxCo5BkdlgbqAAjgg+VSBAvj6AfML7IJN/4ConAMTMSUYw0XEZqeq0n1gSBR5MGbYNL0mjWsMCGePGTOWgUvcgqNO/VLXUfblj/8vb0cjUwa6/maleOBXXn3v3HwYObpzM3fZtZx/oDGsyYSDjJYDfwfjbuS7V5K+587pG3wvNwLPAVQWVlpUy6Drt7pAlpqTSVmeLJx59eXDLjX2TM/Ya4hIi9QcO6z0I4xSkhooSkEVbaBPmCTwBHITNRXPCZGTmImDl+J0TpMcyoHyTtazQhCgF9QFcMOCGtmbaQCl0zSI15d0N9zbPIYm0GEFh51i/eKBhz8AZFLbOZWpaya2KEV0cyPonmTcINvOPxrMFuguAb4ii+Ykts0Cuv7t97RRVXydQjup7SYtKmAIpnzjy6eNKMn5pY7N/o5LuJWDNjH09YL8k4RMRY/RlpnkDhQei8R57ggzNmhuwZj5AblkkMM7fyS1x6iAnnelC8dsMENg2x4j1MoZ8Odgpm79iy+s76+uUH4znsM1MIrDzpFy218/93TYE56r9CjnkvBmYdFhI3RREY8CIEJ9g2KQMJNl2S/8dJj1fEP5q+7KonI3+58pSkIkjk6StH9VVFfj3y3X7x5JmfoX1mDWn+LAbFQPRxvjcxY0i2/l6biPeKSOfF44+UJ/yMGKz6JJkYARAze0LPzEgkkqcQpdEkeQPjBtLP0F0ho/4SCuWfsGPLy1/ctGnl7jQ2b6vuBgIrL7j+wILzhz+15uI7Ikz834bMG5g2niJIFPenViIYHMebX7Lyt8MSMxNWPofDoXebwXkrSh+5ZukJi//fqHay9irKE8Ze1ZAoPGfOnILi0pkVu/fRi9DCPyfDY7DCA3zWWDfRDocdYgZ5t/yJYsTMnlcEX4iZ0W8UIxSj1kZy+tQ6JT0hyLxXcYhUc8jwamVC72vYsvqSra+8sMlLsI9AIOCvjpGDp/46RHoW5ttvoQgMaew4cTQAkzKh4OSO9eceORCdkFLsqNMaVfji9nrQmzjU3pvi8bJFpTNnNuw68Adq5meN1tMM4IbwSyK2+NqX2VZtMWN7jRQReiGvw1j1sV0gaAVYTpJCXqbMG2YmRWoPGFn0qU9ecvz2rS/9k6wJLALVl13m1l70g9cLxpV+VnHeJEXmYWLyFYGsKJiZwWGfuf1ZLbIguwMhirlETe69pJ2Zay+9/a6+5r6VUPa0ctnuj582806O6RdYu+eRNooBM7ZgXlXogPTQawN+L04eBjFCXv8VsoCYZWxQGBlS8yIVxztJQ0JGLUP46ceD8wdNxqp/Z1VV4jKGrAk6AvL3BdELb95qDg6/lF2+QBmzBYqgGfNTY25lYzJ1CJmRCY5UzxXhgV+siINq0StC+5pn876Cz6w558a0fEUKUZTmjozebnEv0DH9OdzBho1LYVn1BeAEtVupCL7XWUn1BD+BgIRTCHV4gi9uSnS7Xub262g3cyeRzEzMIMVPqry88m1b6r64fv3KNzopYpMCjED0sqrmhRcP/fvwJppBRleSMU0EgzmFswE2BtgcIIhoI05aSOa6T+01wIwtiif4ct2Mw4v4tV6vmBdOyJt4ltZHrV24kLw3Z+2V721crxQAYXcCfhW0Fbb6JgkkAGZhDK44SfK2+sYQ8ifj2uZJJnTHI9oE+Tqqw4sHg9QRoaxYZvYEn5i2Uoj/c1t93ZlbN7wUlTRLuY1AFVfpFZfd0Ti4sOwOiqkI7qf+SNqNGeMaki1BUgm4mL+Y0Lh78o6hcJGOzsd3pfB4VuZUeySJvqCnuhLfOaF+JUoA7CAjdivXHTd8xGwzcejSofuOi5VT1KXrqUPT24ReKwABKam7GKiJdIMMvJRwRfCFBDhhWFwpI66E4ySstEMi5B1RvGDrJ4RdBlBI3iJoKByBVlzJKG0mKaHBiPVbStF3Rx+bP2Xbxtr7JJ+l/oWAHAvWfOD7W45upk+7pvEMw00vGlxaadViWGliTiwCiW6LEItX5gphe+uTP8UlLZXi+WT+QiK4NVFi/hrCrYQQ0qV+maOGDRSPJlL6p5qcUdELf3Dj3vWvuuXRcmijaorURUxqO33tj3N8pLWCRa/jKeXRFRF9jwxAFUpJRmelw+iTBqUm9MLPzPHSIvxxX/LJjDTEQ8ih7+NtC89C8Uz8W2cwl2/ZXPfNlStXtsTj7LO/IiC7gVcu/sWzI48pOMOYAx9mbn4rxk2kOYa9AGav0ZgqxiNM1vZhwHyC3LZOYwd1xAW/VYIIf6sIQrUmkdeQy/pZE9KnrjvvR58fN3ToO/MeqwxNOvptTXRI+Kuq0nf/1DsF4HUsWYXxgngws6dR4e3c9lIJiBD7JA0xx9tljrsSh5EkyeP5ZTcAYrSrDNeAydPmnDLjE/XR6Gteun0MGARWnHZH4ysX3POHYaNMscP0vdSOYxtOCrNZ5gmnJqT6oQT8oMGq7vlT4kgEHyT1eGl4aFTmemoGMqPpTbTzuVfO++G71p/zo+cqTaWau5z0qF1RI6u+EIpQe8JfWdn6j+sk35ESODnSosEqxwx0U1hKCr3EYSBE5cpggLaSQ59raFg3e/uWtSvsH+0IQAOXVp70iwNrz/3p1/MpPB1bxIcMppEIqndk7UQ6oB9ageYyRBuLixeJ+YZ55ikRCcfrE1+c2NDt44YMLZrI+p55WPEXLl7o0PXkGV/wJdCR8EuaUF9QJ13si+rTWwczYxGPU2pLrYQfI6mYW5C12bC67thjCyLbt77y89T81m8RePn829evvfCHF3LMnG+Y1xvGVh3ULWT8lR+Czy6TY8gzRuHGAAGDdGYdg7OUjSmb3XjKV5EhtmXfMWbv+lcPa0UEXwh52rXLli1zotEoy0/oyW6g3UzdjOwLBZDSAYGNUsLd5KIPsyWFX4MNkEMswD+E13qR7dvW3lhTU7O/D5uzVfUzBMaMOPpfqmTEzBCpTxPxm7K7Z8ZcIhgDcUlQIgYbelzsYZ4xBF9pSD52AXjKhpNE8MmQVszrWNMHZzWefMmH5g9dX0d1zs7lUUV1URq2Y73BcR+Vk7fd70zwJZOky13VCy/UVax4JvroXb+5/3yJP1JCj460aAbKAVANBJNCjSaZmZgPEaKS1mAgPOThSsegbWuI+Lxhw9SHBtH4BrLGItAFAsvPqjoovz8wXsV+N0KNmMSaf4b5F8M5X+Q6WRphz894+gQvYXISDgNkWMPLb+JxnTN+yKwPnj/0wU1vP6qqr4+GRPALXj3aCFEPTUnp8SXjS2b8KtZCz0K3zFNM3n9SeqQ7AdXD9jOWHeckry1xZV8h5IJbIfF7BG3rZcLDwI9kUdgGlzq7kX7tMcfknXbqqTMew3apecOGR7yPQJDVWotAl2rnoeUAABAASURBVAg8ct6Pms45l/YVjC39kiJ1Es70f0chKAH4ZJbFCWHIumz6sShhqSeNV4qe8JNzb35L3uz159560+hdpB+/ntSwHWPNaNqlhYaNXW+ERkVHmUgkYmRlR/2d2vGTZyxyD8aeM9p8FCdbjTmO93DxIt0pH8/Z+iky0zomwyER8PZIBFpYEVfSxZWwEBZ48sOQe7nox4WL6GGc2xTfOXjwsMlTJo25Xbb79pJPELN0JAhUcZWW7wfqLrj95eiFt58b0ups1LOBSGGRhyKQ4wBe/xnHuJiTrif4hh4uMHmT1593y+UvX3CD9+Mwcrs/l3DDH40aEXif5tJc3R3hHx+ZedH4aTN2YEd7G5F7LJFxwAesBvXOZl0BdMQ+M3tJzHHXC+DhCb6LjmvjCT7uWMjLwfxoKMSnNGyJfmnt2ufeXL58edo+nwQb1g5ABFZffNujPGzIiWzU59ngbgmXy1iFcTwgh3Fx6Ljqg+vn337+6vk3bUqFp6oq/qtYshiJwAuJ349PzZvqH182a0bh1FlLdTM9qDUfh7mPWY/pzpj/BJcUFEFyE0BHYgKrAFI7A5C9oz0AgNAbIsAgGGitCXFbtEMf2rq19j82bap7PrWc9VsE+hqB6FlV+6IX3fQLCoWmEqvfsiFXtdDX159/a2Tdhbct7qq9roReyk+ffvqwcRNm/1Dv59Xcoi/AfMdxH/OecOKXDEKsse5BETjQARI+QsoJBSB9Ywg9Nl2e8Mu2H4JPRvF1o8YURLbV1/1J8liyCGQKgTXn37BlzfzvfXrt/JsL1l5860190a681iuceMLH9jUeiGK7/zmDkwVWPo1Xkzh0GFns0IwiI4qAmZgZ4d7Z3FEAogChBNBd3LXwr2hIXtH2bdEb8UrkAOKstQjkLAJFc+YUjJ0264x/v7Butdaxe4yJjdXaDUHiGbtc6AImLXNfG/gNw3jCr51gKQAR0d5z1M4wMmqWThPTChVW72rYFv1Ug/313XaQslG5hkDhlFlF7s7df1ax2D+J3KkKLxGJY0r+xBbbXXRH49jr4pIbsx8hkQU4sH2zdvdNLWDnSK1s5btZ1rByvr4N53zZKnWzjM1mEQgsAoWTS29g3RR1tPte0rGQ0q4yxsVyp4nYJcYrRYLBUddbWBnRCJIoAe3FSKh3lHUFIOy3VQISFpK0BAEUaMAQmynnnjto165dfdT9RO3WsQhkEIHiktKPF02Y1qBcvchoMwRz3QHhagtCj0M/k0i6EBEzMZEhEXhmJsSQGLkPYyPi208uAdF7HHnQVRF16fMhQgwTszKsWBc1Nrpz586NoyNIWLII5AgCxVPKI+MnlL6Ao/xPiFShMSqPjGL5ghXCzEKIR29EsEFIQ8CzIvyaPW+KnMTDvXmild4U76uyiZ61X53cekAJEOHNq5H3+/IqhayxCOQIAtOmVYwsmlD6O93i1mljKrDMFYB1b80jUsTsMBNWcqOQpMj3M7PMfYJLHRu346RupKhu5ElzFu5+/WH2FEH3C9icFoHsIlA4KfK5A02N8vNyHwYnItDJOYyZDxEnnOnhIyZmRQxCDHHCFX+c6DCDY8NhcT2NUD0tYPNbBCwCXSNQPHX2/MJJMxo4Rj8lQyNRQgRfCN6ElRU/4e3A4dT4dPitAkgHqrbOAYvA5Bknjy+aOvNxE4s9QK4ZByDkvkoEX6itQEu4M0Lx9FqrANKLr619gCFwsKV5im4xZ2pNYcKBX7bpIF/IfTSYTMpnvX5sFlyrALIAum2yHyPgmkaGxBP5b+0pbownanFFEPfH47P89LjKMg+2eYtAv0EAr/ZwnR/vjhFxJ8IlvueRVd+75acjMOkqYhVAupC19Q5cBLDCy7t9bPMh/Z6IeRrgcEAkWujwlEzFeNxlqjHbjkVgYCIgQt4eZR8NqwCyPwaWA4tA1hCwCiBr0NuGLQLdQyCduawCSCe6tm6LQMARsAog4ANk2bMIpBMBqwDSie4Aq7ti8bUjItXXnFFavejr0x9Y9KfSBxY9PfWBa6JT/7To5gEGRc501yqAnBmqjhk94YFFEyLVV57h0YNwu0FlSxadWbr0yrnTl1x11vSlX3nPtL9c9d5I9VXv7biV9lOk7Zn3X/OFGRD2g4673YTMEybMN1BIfdCE1BwV4jI1KNR+4f4d296nvz3ucboLWAWQboTTXH+lqVRNec57zODw47og9ISbF35CO45Hrrih0BMaZBIkfiEKOY+zE17uhEL/cpy8f4byQo/S4NAd3WV3+pIrTyp/aNFvmvJUvQ7znUapOcbhIUYxKaXw/psTRKRCNNAM97zDoi96Sj1vpW0J1TbChnMPAVf+nwRjSGYdayN/YU5sKB4mirsSFiLywv6vSshXq1pr0jGXTHOMujKl1V+cN33Jl55gZZ53jfthw2S0fPWqDInwe3/fCr/8iF2Suqq0f6fLsHTRQwxMFznSlWwVQLqQzVC90epydpIfnx5qlJmJmQ9FdMMnyqCjbLMXX1kYWfKl+yhf/VU5/C5ikl+u1ETQHsxafq2GmYmZvSqY2fOzhBK/bSdeS20RyJ7wCydWAQgKOU6uS9RWeCUs1J2uMUNMsXUnR5EcKVLLLFy82Cl/8Mr/as7XNdrhC5k5DKmXWWuw+qdmJS8SVaVGIn9q0Pp7gEAmsloFkAmUA9qGJ5yJ7boKMalwiKJUnhThWX+/esjL4ad/ElP69xD2Akh4Hk4YDjIolIVD0DzE3j94rc09BKwCyL0x61uOjSIIs/ers8YxVM2XYT9BFPnrNcc1N+n7lUOfhoRrKIA8YmQDCQOyu9CH7QEkxVIuIaByiVnLa98iIEIsNeIWTxxibWjeY5X5J/zfV8cZQ//Hiv+DHGboCNndEx5siJmMEDySgIx+PV4l9pFTCFgFkFPDlQZmIcAEYhdybYgOuM1DmlroYbQ0EyRWM2MPYHySKKHDpg5KU0ckBSz1AIFMZT1sFDPVsG0nAAhgxU+u3lACpCl/70H3z4ib7XFn4qs8afaC8YeCvkAYaRB3eDCF8AYwnmafuYYARi/XWLb89iUC2NMTQREkaCppfSYUAIQcUg2lAD8knuKCTvHpwoxgChPMCCM7FEL7z5S81hssBOIjGiyeLDdZRsBTCsIDLgHEgfjjfICnv+qL6yXYR64jYBVAro9gmvhPKoEu6mfG6t9RHobS6CjNxneIQCYTrALIJNo51lanSkCEO0HY9yd8EPhUH/rrpcG1NpgIWAUQzHEJPFfMkHSQMJpUFAavCjSIoAgMzgnGyDcFmjRZE1AErAII6MAEkS1mJvkDH4bEG+0aoyHl2nisGnjlOwIvEI9jY1SINDso5EXbR/AQsAogeGMSRI5YBN+wLOUQeCgAlpnD+jXSZgm7VKXI+WhI07nsqlOFVDOdq1z3w45rvhRy3ZfJmm4hkOlMMoyZbtO2lyMIGMZW3uNV4yhvFFZ+xUqvw9vARa6Jla+94H8L11z8/QXRBbdVRS+65fc1l9z6t+iCW54TqoO/7uLb/lC74NYfrYbrVWMfgUPAKoDADUlwGMJCL98DsLfVZ3qByMwdU3D0iWMKRvxs/QV3rg0Op5aTI0XAKoAjRa4flmPGkp8g6Z53rje0XRnngrXz//fky8476t/Lz6o6KCTplnIfAasAcn8M+6QHzOzVw3zIdTTdOyI8PLLm4tvlbwOoiqvkEsDLZx99j0A2arQKIBuoB7tN4yh1gLS+um7B9y9/9ryqPcFm13LXGwSsAugNev2wLG76Gsl1/2tCuPnOftg926U2CFgF0AaQgRhkjm/7pe9OzL1s9YW3LXnkvB81VVZWKiGJt9Q/EbAKoH+Oa7d6xczEzMm8uO1fv+qi2/7qR1RVVWkhP2zd9CGQrZqtAsgW8n3YrvwqMHOKIBvTrdq9W37NeNUHkuKOnQ7dAq6LTIJrF1kCk2xHPDBD0XeMMIs0d10fM3s7AGYmeGDhkjUDCQGrAAbSaHfSV2Yr/J3A02+TrALot0NrO5YrCGSTT6sAsom+bdsikGUErALI8gAEqXl7CgjSaGSGF6sAMoNzoFthtuf/QA9QGpmzCiCN4NqqLQJdIZDtdKsAsj0Ctn2LQBYRsAogi+AHrWlljwJBG5K082MVQNohtg1YBIKLgFUAwR0by1k/RyAI3bMKIAijEAAe5Pt1Jg4AJ5aFTCJgFUAm0bZtWQQChoBVAAEbEMuORSCTCFgFkEm0bVsWgQQCQXGsAgjKSASAj+79ikAAGLUs9BkCVgH0GZS2IotA7iFgFUDujZnl2CLQZwhYBdBnUNqKLALdQyBIuawCCNJoWF4sAhlGwCqADAMe1Oa0/QYoqEOTVr6sAkgrvLZyi0CwEbAKINjjY7nrZwgErTtWAQRtRCw/FoEMImAVQAbBtk1ZBIKGgFUAQRsRy49FIIMIWAWQQbBtUwMbgSD23iqAII6K5ckikCEErALIENC2GYtAEBGwCiCIo2J5sghkCAGrADIEtG1mYCMQ1N5bBRDUkbF8WQQygIBVABkA2TZhEQgqAlYBBHVkLF8WgQwgYBVABkC2TQxsBILce6sAgjw6ljeLQJoRsAogzQDnSvXM9gcBcmWs+pJPqwD6Es0s18XcWoiZW4c7Yo+5e/k6Km/jcxcBqwByd+xSOMcwmjgxO4iHnxQZ+ZmfRDwh7JEfFteLI5L/FswYTpSDY22fIRD0imSmBJ1Hy1+XCDieEGutibSBjVNcsE08zRgv/rA4yL38fwBKFIB4umzLZug7BLIPuFUAfTeaWavJaXEphNVeSMUMhVoMhWNEeS6T41IyTdLbkom5pKA0oB0o5iIzWZMZBExmmumiFdVFuk3OAQRc5RBknbRiMo4iNxSnmMNenKSlkuTzSaEsecSkQg5Z00sEQijP2In5hGDcisCnUjw220+rALI9Ar1sP7KwzlCYIPhEWmGbDzKQ47bkp4nrsib5Z9gQOw7J7l8phRsBOx16ORytih8KmEPegPnsiAdsQHrKThVX6aFNtDSs6fyQVheENZ0Xcp2z21JYh85OpZAJne1o52xy6WxcA5ytlXO2UfzFnrZv83eFQHCFXzi3CkBQyHF67pLvvbn6wpsfqb3we8tWi3vRjf+o7Qmdf+M/1rz/2/+oBeU4FFlnPxTLOgs9YsAqgB7BZTNbBPoXAlYB9K/xtL0JCAK5woZVALkyUpbPHEJAzv0+JdjGxSu1R4nkbDlWAWQLedvuwEFABD+gvbUKIKADY9nKfQTwlpW8VZ+Ca6wCCO7YWM5yFAFmvFgF76zkGABPZzbLu4OcUADy/XpnGNo0i0DQEGCOK4Gg8dWWn5xQAG2ZtmGLQNARkEVLCHx2YxuAXFmyuaAARJUKEeXYRxZZGlPbbPYRMBw3RKYLEesqPc196YK7NLduq7cI9DMEEt3Bqm8Ywg8XMQaXAT5BJUiMRxIHTzZtABSAYNQpYfVPpOvY3ROmzz5r3rx5oZJ58/LJGotAgBAIC/juAAAQAElEQVSYOG32KdrE7iCCwBPkn9thTlZ8n+LJMrnjviw8A6AAutVrNsaw0WY6NetH6xveul+99nbxuIqKwd0qbTNZBNKIwLRpFSPHTZnxy5aY/jdpOhmLfEKuuD0V0B4nWVMCCUbb4ymQcQxFoADyhbgPWOnsOnBDBZRAJBLJCyS3lql+j0DhxFnX7Wtu3oL5+EnSRn4NQIRZyO97qt+PC4ybawrAAw5KgF1XD9GGvrxz597V+/a5l3kJ9mERyBAChVNnzy8smdlgjP4uVvwCNGtSSFZ+xmqFKJwF5Nk5Sf7Oc6QpNacUgDHG+327hMukmDXzxJgxvxlXPP2FoomRU8gai0AaESicevzx4ybOfMK0uA9hNhaiKVnhfUKQWARfSALdoKwJv/CWUwpAGBZKKADxEpBnIQRO1K77TGHx9N/ImWzhwoUO4qy1CPQJAiXHH3/U+Emz7jAtsZewCr0blWLayfSDj4ghSCLITPLDrNSlieclEpeyacB3Npvvedu+8ItLOAMIgszAnQm7AZDij+xvOrDuqWdXXzdpUsWInrdgS1gEDiFQWVmpCifP/mzz7tgrrtZfRooIPpxDVoTIGE10SPgZqZ0RkoNhhfdgcNJDLhjHAY95vFJhkLx4SVTBLumjmUxVU8u+54uKp3+kxL4yJGt6jkDRlJlz7/7NA2uN6/6EDB3btgaDOcgQfGM0JdJ8oU8Eg+94MhR8Ng/n0GDV9wiDYEAMJeCQ472BdcjBsUCRa3iii/uB5k07lh43pTxSWVmpDq/JxlgEWiNQOLF89riS8n+6MXc5VvWpbLQCUVtSlNwM5Jzg+z3OeYFgZmLmeH80rmUM1n4oBIlA50KKHHid96lmvfrue+67pbC09DBNjgzWWgRoHN7nF06Y/g3Sscch+Gcpg80keVLuS3pioiXBkrBQMiLXPJCRXGO5c36x9ENTU5ziigG3stAR0A1s1JfogIoWFpd+xl4SkjUpCIwrKftPatr3HNaOb2tthkLusXmM4b4PMSn54BWB9wnB3Lb9TgF0MhwOjgphjOgoMvyzFc/UrSgqKZ1njwWdIDYAksZPLDtzXHHkSWzv7yFDE4jYZe8P+bGVJCJmkXXq1ORy4kBSAP44yYgyMR1Pmv/2y19XLx43ecZ4qwhoQJkJZRVjcc7/ozH8D6z2p8F1iBhX+TSgzEBUAN4Ay27AGBoE9xJu1mvuvmfx9UVz5sgXXV66ffRPBKZPP31YYcmMr7UcaFyH4+JlmAMhOkzw46s/EZYJ6t+mVwrAhc7MNjzMWMwTdIS8MFaAIaTpG2bH2+sLS0o/HrF/W3CEUAa7WOGEGefvO7AnSi59lzUPhvBD/+NJIvCp5PUD86L74gFl4hXK1AOMe0256IznOcJH93vYXgOOQxowpSS1DqUkdOWVDgl1lS+N6YzOFBltfvXOAfPs2KllZ1ZUVITt0SCNiGeo6nFTZp9QOKH8UePSEmP0OCINkTfMbLz5yvId3yFeJA6kCBkkFn5xyHe9gP8Ql/13BBLoa2KcSlLIQOCN6Cy0Y9Ah8t5yIXCEVh1hOa/YjvU1fwrlhRcxq0ZE+HUl4fAAVEzUDgn0QijXyvqdaxWJgNTVHiEpadtL705csgJ42CiF+XG8adaP73h7/69/88ADo+T3B5BkbY4hUFQ+55iiKTN/ZFrc5yEzc4lcvNnTjHnHflcwP+A3UAGOT6QgVIqQYvAwRNwFUR8ZmfseQcjJF/pE3V48OsHyqlvSjdsIxr/Dw/MfSWQ5IkcdUamUQtvWv3z7oOGqhBx1K7OKIQl84dmFBbxeDgwGCXmBxEM6m/B26Ug9Ql1m7CJDah0y4Moo4hh/uHmv2fjKlp1fFSVgXx12AWJAkmXnVjRpxpfNgT073Bb9eYUZpkikmskfZ7gMdj3CeHuuH064cJJW0pOBdHiSc14Ev50GlCghCD8zNSP5T1QwrPjVLeu+tWPlygMIH7EFLkdcNllwY03NzobNtV+lkDqBFD+GBM3cM8zaKgHUkTHLfDivLICDSOsh7NINGzbvrHvm+br5VhFkbFh63JDc3YydWHr2q7saV2HVv51iWJZQC4SLZX4xsygAFoNoWIRljOHrwDLiheD0rQUPwotHfs2tt/dxxnzBx+Ifc9msbFLqrGmTx330ig/Nf8sv1xu3TxSAz8C2jTW1c06O/AexWgiGt2mKd8JP78xlBs4KhEzMcRfejFpmbjUgfuOYQIS7gWlG04NQBEuefSk6XRSBvR/wEcquKzuz4qkzJ72zz61WMV7maJ6uROLJOOCMYeAQ4yEEx7Pi74q8jB09ehMvc0rK+674E3yKF9sVJhUXH6MV1RvmK3j08DMjE497bvny5bGqqipcDlCvTZ8qAOGmurraDU0c+XB+XvFUpdQ3APteiW+PUjucTIcSMDIsyYjOPQKgUOe5epYqfAm1LeW1Y8z7TAut2rh558/vvffh0ZLHKgJBITt03JQTRj31bM0N7sFYrWPUBTi6KZzylYsTvaHk9O7BjMpcP7z51KY5BwKj4oJPEPy9OIneFOaCE44bPeT3st0X4W9TpFfBJEK9qqVN4frlyw9u2PBI07tOKruJ8/JKgf69bbIkg8xITYbiHmbEQRHEQ9l7MjMxx8nnAjubPK11GIP3EdfsX1c0MfLFZcuWOX66dTOHgLyydZqaXnSMswiCHyasHJoZA+aQUcxC4IZBgbaYS56qQh/Ap8IdtHPAZedfKuS8a9hgdX19/ap3Vq5c2YLEPrdpUQA+l7Ib2LbupR3b6usuVyp0BhE/Te0YZk4KGjMfyqHgF0KMgNQeISkjlhm8xFvy9HNcEZjhuJD94c43m9YWTZ55bjzZPtONQGFJ2buKSiI1rNVdyvBYjdmDVd/RDmPVZNbxocJTd8GKN5Rd5Ol9MvQSkcxjEDNLox5hPoslEUJ4CEfmZlfROh0KnbN9S917t26oi8LIpV/vmeigBmm7g6S+jf7ERy9+msYOex/A+DjGaycRrtaIBAjq0gC4LvNkIAMGD6zjySyuR2iWjdaTOGYeGj9xxt+LJh0/FXHWpgGBovLyY8aWlP4Ms2Y5Gy4lUrJoKkgQE+YIxJ2JRPw9ovjklikmRG1Me3FtsnQS7G4S5ruX1eOIyUhYSCKZGWd9Zcgo17Da7zJ/k0YOPvHVzTVPUoZMHKMMNCaXFg0rVjQWOMX3DR00OIK+30Tey07yDDPGzvN18MAAk1AHydmONkY7xjXvNW7Ly0UTyu+Uz4r9i0K5I/Ap23zmYvslJccfNap4+rWxvW4Dx+izkPFBWpuQYYP5ayDJIlIQITKkUojgP9RfZPPCvnsoJd0+5vjcFi6152VtvDhGV7gRb89+lBdSk1/buuaWHb18rdfTvgDAnhbpXX65GzjuuMG7nQkjv4szzmy8qHmQGYDIOKJq+PHs2BoPwI7Ts5uCW2etC7Aj+ILesXvtuvqdnxd+Hn/88YzjLO3mMonCFP5HT5i2YH9s33OOppvYpQIihhjHxZziRmaEUDwUoKc/V11wbGR+i9hrUUCk2KAjip9UYT5zW/3qKzdvrn09G6xnZWLKTebH585tHprX8krDxtULjMPvYaVWQ/h1ZyB4ICKDDyy8gbI+fx5Trh6Pjd3/3n3P/U9s3PrG8b///XNhUQSVlZUqlby89tEKAcHnF7+pPn3chCn/AoZ/drSaSt7MOFzwMRcg/JLYEbWqOisBLG9kwB6D0A+G6G/AnP9gQ33t3K0bV6/MClOJRrOiAKRtORLIBYcMdv7UomeG5ZeeRI5zDdLeFEUAgveQbSVciMbAkxC8gbGpPMPPYIzZmNO1q58/ENv6642v7vZeG6LfkoZka1MRkCPT+OnTx91175/uZtd9nLQ6S5FDzIqUChEwPZSdcWUmqypi2s4NRKXV9qTyOG9MCis/5sIOUvyt447NL9++uXYxBcBkTQH4fRdFsOGRR5rKy8kdPSL0M6egYAYR/4SMacKIy6fFhlof5hAMrpVJKiQcJl30ABPgg6apuf6u3z7wred37QrjDUlIFIEoQCHJP1BJ+l9RUTF4fcOOz7jNVM+GP8FGMbcRfsCIKRHXnYyAUFzAKJhGGxeMNZEIP9NvuCDvFNzufyddr/TQVo9t1hWAzzEEwgUwBz6+8Lydo4/Ju0rn5Z2qmJ7FiLtQ9AIkhtzPHXyXOT5RUzhVmAhhFdPfim3eufHtRnXZrl27kplECFLyDijvL//0p7NffWtfrYnRj1lzGMKPYVcJcuCyRwqYMpARghNoazBpsUN12HANKfXu7dvWfLxh/cvbg8a0ChpDsiOYP3++++kPXbh666badxO7FxGbzQk+46eoRCBHHbnFGqe0/g0uCR+9+4/3z5SdgJAoASHpl++Kv79SUVnZ1HFTpi12m8wyY3iivNMT4ff7y8zEbDySOGYWByTTAA4hzRDS/XjqkUHVXn7mIyzfQbmE8L/Jij933OiC03dsrXvKayiAj8ApAMFIlICQ+Bs2rXmYh/C7SJlvEtN+YN5ChPvg+LFAZgKmAOWcweRj3GzP5WZ6/qkX6n6+4uX1x/l97u/C773PnzzlBt0Uk1X/Ugi+A8IY+tMxLpBYQRHnWxlqTQzg/JhDrl/uUExXPqmGGe0oEDIzx114O7XdSgyp2/PUmKKC0IR7JL/8rUJQx7TnyEmPMkyfuvTSd7ZvXnNDHg+ayazug+w7GK9mwtZAJokQ5aDx+NYmzJo/bppjK4smz/hSdXU0JG8LpDsyaXyScH+gwonTPhrb1wLB569RTOWh75C8+DQUoYz30VACG1wFHa7fmZlgQeKCkIWNwmxojwjxh5PUL0QphplTQphlCEoen1olIiArvYKbtIr/bvJC47dvrltUXx//HF52s5FIxPjKPZk3IJ5W/AeEp8PY8ME76aQpDcMK9BVOyDnJGKrDEDnxzOx6d8IYsHg4N57+hGdjQnhVNIZb9M3vNNatXrv1zbOlz74ikN6IIhA3FwkCkFc4ufw944pLa0mrXyrDY7HiJ0ZLJQXU75sIHDBBEJJNBkpAJ/0Y84QfTi8sWk2WlvaSgYSnbRwz2E3sFhJZwLeRt3ouMT1jmN/TUF93zvYNNQ1+urgyjkLiDyKpIDLVEU9yUYizcvOpJ5au2r4lWkEh5xPI+yYmhcOMo7UxrmFctUE7ID7nLKZ7vnJpmuO6fx1bEnl4w7Y9JeiztyNAv1mUgE+50rmJE8sm7DlgfmpaYo9inMqNSVzyJVfsw3viK8bDU/ouRlbv1Nowb7wgMwQdPgeD4fPBHI9DdNJKeZTZg6QvN2yJztm+pe6xZGIOeXJKAfi4Qihc8Z92YulvB40smGIcdT0GooWZFeKZFNZTxtJBuWlk4ilD55rYwfXvHOTv7NxJ+XV1dY4ogVzqUWFJ5GvNWkWNS5ezUTi+K6ya1MpgzFqFMxrA6zlPkA2kHQ1DoPEkEp6EsKoQOE7yTDASD4cw037MBfll27bU1MunPQAADrlJREFU/VjCuUoqVxkXvkURbFq5cveOTbVVKjToBFK8DPGiroUIA6pB8dFFQi5ZUQIgVjHz1d0Hdm565yB9uK6OHPnTY1EEshMIan9Gj522YGxh6RbWVEVaDwafgZ1nwBjsYW+SUAKYQ8SM1QPEzCSMC2FHYJBX5tMjVKBm54dLFslfulKOG+lbjnchzv7WDS9FP/2xSy/msDqLHN5AhOmHB8GIEhCCNyctejJKxeiXu/dHV722u6UCZ2qTej8QlE6NnTC1bOTYyS9AfP4MkSrWWoeDwlt7fMRXf6ToQ2uEF+ctH4TzPdII6wh7v8MXZcUfwjn/vIZ1tTUbNjzS5KXm+KPfKAAZB7lsadhQu/y0ikgZO84i4/B+ifdJlICQH84xl7GalnFz7Olf3lt9/4Ztu0qCwv80+U81i8vuMC0cDbFTwRyXIOa4GxQ+U/kQQZcwDovxpUKUgBAiJQ2Xyrh89BTDO8x8WzhcXLE1IJ/vgsU+s/1KAfioyNGgYVPND1TB8Ank8B1GeT9bnpyNCSXgjS7K+C68wbaYiMIgFAEtMDGzvqik/CaJyCYVTpnx9cbmg7VM/BXHcUgplSSCEZ6F4D3MdhR/WMY0RPhts4pXrjApsNMighIQBSCEPv0+HM6bvnlz7XX9ZcWP9/bQM9H9QxH9yfepS89+Z/umukV5Ya4gpVZg0Bn9E8K+DgqeyRd+30VyblicRxmT9dqi4kjDuEkzPhmJLMzLBOfyUYu0UzSp9AOFE8q3UYu+wWgzRuKEgDGgVt45WvwSJyT+tiTxgSCAKS/0MCNIaWpRmp9Xypm7dUvtRzZseGlXIHhMExMqTfUGolo5EggjJeOO3bB9c+1pKuRciGPBVkxEUQIKriSLX1xRAj5JOFdoHC4K79y9v255ybSZpelkuqKiIrxiZe2kccVlf9cxrjZGFxn/8gwNC55C8OaE9XlVxLjsw5N5EzYCn9m2re6UbZtXP0EDwKgB0Edavny5/FUhTSo65pFpxaMmU5i/DEWwB5PXYMBF6NvC0F5c2zxBCUOBmQIsYnNiB926wpLyP02ZcsKovmZu8uRZo1/bdeAW43Id2jobuw+81iOCHwtnLsFFSSOTX5QAO+odFeJb8gcXnLptW/SeZIYB4BEMBkA3411cDkUg1PBK7Q95qFNOjrqXyDv5UYqBQCVDuTaz5QuIDx5sadqI+4Fr++pV4fgJMz7ZGIs9jwPTVyD43s2+CI6PUqrfj8sF1+Ob+f5w2JlZX1937fr1K98QzIRS+e/P/gGlAFIHcntNTcP2TbWfNCE+E/u/55Emgi/kC31bF1lyxBoaBkG96Ve/rq4pnjRj/pFyXVQy65yiCeXPY6f0c9amuL16PCFqLyG4cRhXdpVSa43jvG/SxFEf2rChpkHuNiILF+bJNxbBZb3vORuwCsCHcsfG2qcb6qOnksNXQPpfRTwcPONW/EKYNFj/4nE58wTT5TqmH4IQP9aTXyseP2XG5KKSyIOsY3/B/v4kIqhJZmI+nHIGDDCK4x4R06tG8RcnlYyc+YmPLnhs7ty5esq55w6qI3JG79ql5RsL/+6IBoAZ8ArAH+OGzXV3H31UaCqz+gYzy50BI83AL0RwhZJ+pElYnEATVm/Ir5lLseb144sjP5M/xe2I4dLSU44dP7H8m6bZrCVNF0KB5LfNm8AhJ/qeyruR0VR8+5D8o0unloy8e+/evSxfVVZHo6ER48frciJXlMFAEn7BxyoAQSFBNTU1+0ePHHSLw2qWUrwUk12mjZDkEFdI/EkBQB4vHNRHgj+Pbwj0FbzPyEXhlan8VlZWqsLiso/u27/vFeOaKmiMENK9MnBz1np9V+iGo5ax48waUWC+NmvWuAOjRo0y8me6kyZN8gR//tixbnV1tdue8Ods57vJuFUAbYBauXJlS3396rVb6+sucljNw/R5CVng4AnJ8J5tHjLRhNpEBzGojKExeNyELX5NUcnMuRMmzzjt7l8tfoqJf2nIHAWmGdSh9XYUSPVdeANhGR1T4MQnZhVjxa+okLpszkllF08pPnYNzvkxEXTZ5stZX1yhgSj4gMqzgpfnsY/DEYAiePyoEc4ZxHQVBHwncnQqHMiDLIG3Iit52OLPMMb9l9ui5X+heRe4DoP/TvuHPJ4NkvALL9IhYUz8nsv8JgT/63nO+Jmf+PAlD4iQy9sfX9DFFUUgrpCUGahkFUAXIy/HAodG/bRg0IgpEJAf+Nn9yYawEZKwEPy5YuU9vgg8uiVOrrAd51Ow9sn71VjsADSR1sx35YWcyOUfWfD9oqJG78/GB7qQxxFr/2kVQPu4tIqtr19+cN26p/Zura/9iqLQicz0GDPjghxTEBMPT89PRKIM4FibSQQwFM1G0UqHQ6eMGZn/hRNPnP6mtJ+66ku4pzQQ8lsF0MNRvvzyi18+9eTIfxjiS1B0A+QfCxBUADx4eopAXKTlgpWlXygXeE3ymIovBH9zzKHLjx6qTtu6dfVKudiT7X0ys/V0ioBVAJ3Cc3iibCdlgjVsqf3LmFEF5ezQNw3THiIWRSAKwBMomaRCZE2fI8DMxMxEIXX7uFFDpp958szF5eXl3nZfxkYalHES11LnCKjOk21qZwjIG4OG+uhN4SEUIUX3EBHuo4woAY8IBkrAwLG2DxFQjNd6BYMKRxREviYrvlzyCfVhEwOmKqsA+mCot6xZ8+qOrWuucAfxTHbUqg6qFEXgUwdZbHSnCDA94zC/Jy88/tLRQ9Uu+e/kqvH+Xsr09YovdQ4EUgOhk5nq4+sb19RCEZyglboMe9S3sPpL0/6uAHtWEpI4S91DQBSmZqV2KcVXDsk/+uwtW+oekx/nkN2XCL98xGSFv3tgtpfLKoD2UOllXOmk0X8ZPGj4RFJOJTO3tKnOVwIyuYXaJNugjwCw2+8o/sGwwSMnTSoZdae8ifHTfNcKv4/EkblWARwZbp2WWr58eWzDhmf37Nha9+2wM2gqVrD7MZlTy/iCL8rA96emD3A/NwKzJ5y88Bkjj83/RjS6fJ9gOsBBSUv3rQJIC6yHKt28+aUtDVvqFjohNZ+Y1yJFBF4EH17Pil/ihLyIgfqAkmxh4o3K4cs/+fEPnFX/yqpV2OofyDQeA6k9qwAyNNqXf/QDj3zq8kvLcZb9Gpp8A8QgEXoheMkPi3+gkYbwHyTiqm1b66Z84mMfuN9u7SkjxiqAjMBMJBNaaGt93c2DwqFyiPttaFqEXghez6b6vYh++2BNBoT+GaXU75yjw2MnTxx5M8IeVuJaSj8CVgGkH+PDWti4sWZnw5boNSpvEBQBP4a3BQzyvh2Aa4x8ZQw6rGDAI5iZmA8n9AfCTknS5JK37WF+hkPqlKGD9RX1q1a9Y8/5mR9gqwAyj3myRfnfjKZMHHU2Kz4PciO/RiRpTFpEhhhPQ+qQQEliTwjKpCfZjygvc+f8oQ9t6tVESr1FrD43YjDP3bap9oVoNNrcJlPWggOtYasAsjzisurNOaX8//JCg8sU8SKw00jEMSgBgsHOwMWOQLbLCEEZpCoEZkZk3IqwtyVJkbhUV/zpJBH4VmS8td5rEgd913Wcm9UQNXV7ffTnVvA9WLL6UFlt3TbuISAftGzatHL36NEFPzJ5znTl0C+RYIyrtTEMJcDe8YAhS0JI65H1lUCPCh1BZnNIH3n8+u1qxGuHHswb5Ex9bVPd/zTU1b11BNXbImlAwCqANIB6pFXilVfLjo2127bVRz8HqT9LNenHucnVqllrxzU4ExiSAUulnrTlC2RPynQ3r9TdHmnmNUrR+17dFF2wZV3N5u7WZ/NlBgGZS5lpybbSIwQaGtY+3rBr/Xu4RX8Wx4F3SKM49gPww4MLNWO8VVYGEMrCi8vGwxd6aTt1d4LdQCO01bWf+filM7Zviv5T0oNOA5E/mT8Dsd850+eGtzbc7RQUTIYw/Y9hbjTeaQDS7+mAuBKQzqQOJDP23BLZhpgPxTOzd2PfJkuvguANdZL8OMdtBc7gsaefPOP78uqzV5XawmlFIHXepLUhW/mRI1Bfv+qdrQ1rblaDQzO0oiUuszZETYbZeBuDRNUymMzshZjjrhdo82DuOK1N1m4HwYtLTM+Qw+VHFdB1cqchdxvdrsBmzAoCMmey0rBttOcIyBm6oT66QBWEzqM8ZzMpFuNVJIpAPIzNgT+oSJQoj3y/73qRvXwY6BGQIeaNFDKfDpeMPqthY90Ge7vfS2AzWNyfKxls0jbVWwS2rX35/7ZtWB1x8sJfoDxnPxQBQRC9awKpW87l/sCKwAtJfFuSfG3j2gv7dSXT5As+kCF3r1Hm2mNGOLO3b4zeU798+cFknhzzDFR2DxvbgQpELvZ7y/pVPxk8Iq+EQ6EfekKucEHAcZL+pA4uM2OhZon2qLvC72XGQ3YWQthgxAxRCxHfNSx/ZOGOzWtulV9OJmtyEoHUOZKTHRjoTK9fufKN0PhjrqW8vBPwyu3vpHAJBx3gHwkEH+a44IvQ+yTx3SFvguDGgXHbYIyLIrGXoEnObNiy5jPt/X0+MlibQwh445tD/FpW20FAtt7bX1m16tX6unN0KLSQmbeSEpElLNbkvS4UwZei4qaSxHVNmow2m4n0p7dvW3/K9vo1z3RdxubIBQSsAsiFUeoBjzs21Cwdc2x+hJS6HkrgAO4GkkpAa00i/H51UBS+t13XwVsG5DmIOr7rDqVTGho2yBeK7ebN5ciBzLsayJ3vr31fuXLlgYZNq789OC+/BNv130LsWyD8kH3jKQB4uuq6geAbpXgZF4TLtm1b980d69fLbxh0Vc6m5xgCVgHk2ID1hN3161e+cdrJkU9iIZ+rST8DJeApAKkDAi5OW5LdgoHSWO2wM2fz5toL69euqm+byYb7DwJWAfSfsWy3J/IxzvYta1e8vv2V07TRl7tktktGUQAgWeklKAQ/7SFW144fN/xd9fU1z0qkpf6NgFUA/Xt8W/Vu12sb7w3T8GnM/F2Q/6LAIBOEn39sxo0Y27Cl9tYVK1Y0Im5A2IHeyf8PAAD//zMGniwAAAAGSURBVAMAzHL9PFPxZZkAAAAASUVORK5CYII="/>
-</svg>
\ No newline at end of file
+<svg width="144" height="144" viewBox="0 0 144 144" fill="none" xmlns="http://www.w3.org/2000/svg">
+<path d="M74.1175 91.8918V66.5908C75.7822 64.1363 80.2215 62.2333 83.5509 62.2333C84.7356 62.2333 85.6071 62.315 86.3221 62.4716V52.6433C81.5662 52.6433 76.8954 55.4178 74.1175 58.7472V53.5999H64.0645V91.8918H74.1175Z" fill="#29B473"/>
+<path d="M9 34.6697V107.444L71.987 143.833L134.96 107.444V38.4622L119.501 47.3951V98.5078L71.987 125.967L24.4659 98.5078V43.6027L69.0082 17.866V1.54972e-05L9 34.6697Z" fill="#1B1F2A"/>
+<path d="M75.1909 0.0114811V17.8672L117.01 42.0584L132.472 33.1288L75.1909 0.0114811Z" fill="#29B473"/>
+</svg>

From 2ded9d6a7345611f68d88e69fda460d21964a611 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Fri, 10 Oct 2025 10:02:03 +0400
Subject: [PATCH 102/298] test: remove external compilation of db cleaner
 entirely (#20240)

fixes https://github.com/coder/internal/issues/1026

Thru a (perhaps too-) clever hack of `init()` functions, I've managed to remove the need to separately compile the cleaner binary. This should fix the flakes we are seeing were the binary compilation takes 10s of seconds on macOS.  The cleaner is encorporated directly into the test binary and we self-exec as the subprocess.
---
 Makefile                                      | 12 +----
 coderd/database/dbtestutil/cleaner.go         | 47 +++++++++++--------
 coderd/database/dbtestutil/cleaner_posix.go   | 34 --------------
 coderd/database/dbtestutil/cleaner_windows.go | 11 -----
 coderd/database/dbtestutil/cleanercmd/main.go |  7 ---
 5 files changed, 29 insertions(+), 82 deletions(-)
 delete mode 100644 coderd/database/dbtestutil/cleaner_posix.go
 delete mode 100644 coderd/database/dbtestutil/cleaner_windows.go
 delete mode 100644 coderd/database/dbtestutil/cleanercmd/main.go

diff --git a/Makefile b/Makefile
index 8f7bc9d17eb28..8b17b88e2069e 100644
--- a/Makefile
+++ b/Makefile
@@ -1020,19 +1020,11 @@ endif
 
 TEST_PACKAGES ?= ./...
 
-warm-go-cache-db-cleaner:
-	# ensure Go's build cache for the cleanercmd is fresh so that tests don't have to build from scratch. This
-	# could take some time and counts against the test's timeout, which can lead to flakes.
-	# c.f. https://github.com/coder/internal/issues/1026
-	mkdir -p build
-	$(GIT_FLAGS) go build -o ./build/cleaner github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd
-.PHONY: warm-go-cache-db-cleaner
-
-test: warm-go-cache-db-cleaner
+test:
 	$(GIT_FLAGS) gotestsum --format standard-quiet $(GOTESTSUM_RETRY_FLAGS) --packages="$(TEST_PACKAGES)" -- $(GOTEST_FLAGS)
 .PHONY: test
 
-test-cli: warm-go-cache-db-cleaner
+test-cli:
 	$(MAKE) test TEST_PACKAGES="./cli..."
 .PHONY: test-cli
 
diff --git a/coderd/database/dbtestutil/cleaner.go b/coderd/database/dbtestutil/cleaner.go
index 23da8c8fc7445..851f4488f8688 100644
--- a/coderd/database/dbtestutil/cleaner.go
+++ b/coderd/database/dbtestutil/cleaner.go
@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"os/exec"
 	"os/signal"
 	"time"
 
@@ -21,36 +22,43 @@ const (
 	cleanerRespOK        = "OK"
 	envCleanerParentUUID = "DB_CLEANER_PARENT_UUID"
 	envCleanerDSN        = "DB_CLEANER_DSN"
-)
-
-var (
-	originalWorkingDir   string
-	errGettingWorkingDir error
+	envCleanerMagic      = "DB_CLEANER_MAGIC"
+	envCleanerMagicValue = "XEHdJqWehWek8AaWwopy" // 20 random characters to make this collision resistant
 )
 
 func init() {
-	// We expect our tests to run from somewhere in the project tree where `go run` below in `startCleaner` will
-	// be able to resolve the command package. However, some of the tests modify the working directory during the run.
-	// So, we grab the working directory during package init, before tests are run, and then set that work dir on the
-	// subcommand process before it starts.
-	originalWorkingDir, errGettingWorkingDir = os.Getwd()
+	// We are hijacking the init() function here to do something very non-standard.
+	//
+	// We want to be able to run the cleaner as a subprocess of the test process so that it can outlive the test binary
+	// and still clean up, even if the test process times out or is killed. So, what we do is in startCleaner() below,
+	// which is called in the parent process, we exec our own binary and set a collision-resistant environment variable.
+	// Then here in the init(), which will run before main() and therefore before executing tests, we check for the
+	// environment variable, and if present we know this is the child process and we exec the cleaner. Instead of
+	// returning normally from init() we call os.Exit(). This prevents tests from being re-run in the child process (and
+	// recursion).
+	//
+	// If the magic value is not present, we know we are the parent process and init() returns normally.
+	magicValue := os.Getenv(envCleanerMagic)
+	if magicValue == envCleanerMagicValue {
+		RunCleaner()
+		os.Exit(0)
+	}
 }
 
 // startCleaner starts the cleaner in a subprocess. holdThis is an opaque reference that needs to be kept from being
 // garbage collected until we are done with all test databases (e.g. the end of the process).
-func startCleaner(ctx context.Context, t TBSubset, parentUUID uuid.UUID, dsn string) (holdThis any, err error) {
-	cmd := cleanerCmd(t)
+func startCleaner(ctx context.Context, _ TBSubset, parentUUID uuid.UUID, dsn string) (holdThis any, err error) {
+	bin, err := os.Executable()
+	if err != nil {
+		return nil, xerrors.Errorf("could not get executable path: %w", err)
+	}
+	cmd := exec.Command(bin)
 	cmd.Env = append(os.Environ(),
 		fmt.Sprintf("%s=%s", envCleanerParentUUID, parentUUID.String()),
 		fmt.Sprintf("%s=%s", envCleanerDSN, dsn),
+		fmt.Sprintf("%s=%s", envCleanerMagic, envCleanerMagicValue),
 	)
 
-	// c.f. comment on `func init()` in this file.
-	if errGettingWorkingDir != nil {
-		return nil, xerrors.Errorf("failed to get working directory during init: %w", errGettingWorkingDir)
-	}
-	cmd.Dir = originalWorkingDir
-
 	// Here we don't actually use the reference to the stdin pipe, because we never write anything to it. When this
 	// process exits, the pipe is closed by the OS and this triggers the cleaner to do its cleaning work. But, we do
 	// need to hang on to a reference to it so that it doesn't get garbage collected and trigger cleanup early.
@@ -177,8 +185,7 @@ func (c *cleaner) waitAndClean() {
 }
 
 // RunCleaner runs the test database cleaning process. It takes no arguments but uses stdio and environment variables
-// for its operation. It is designed to be launched as the only task of a `main()` process, but is included in this
-// package to share constants with the parent code that launches it above.
+// for its operation.
 //
 // The cleaner is designed to run in a separate process from the main test suite, connected over stdio. If the main test
 // process ends (panics, times out, or is killed) without explicitly discarding the databases it clones, the cleaner
diff --git a/coderd/database/dbtestutil/cleaner_posix.go b/coderd/database/dbtestutil/cleaner_posix.go
deleted file mode 100644
index 3c8188e5d8cc3..0000000000000
--- a/coderd/database/dbtestutil/cleaner_posix.go
+++ /dev/null
@@ -1,34 +0,0 @@
-//go:build !windows
-
-package dbtestutil
-
-import (
-	"os/exec"
-	"path/filepath"
-	"time"
-)
-
-const timeFormat = "2006-01-02 15:04:05.000"
-
-// cleanerCmd builds the cleaner binary in a temporary directory and returns a command to execute it. We can do this on
-// POSIX because it's OK to delete the temporary directory after the test: the binary can still run. This is not
-// possible on Windows because cleaning the temporary directory will fail if the binary is still running.
-// c.f. cleaner_windows.go.
-func cleanerCmd(t TBSubset) *exec.Cmd {
-	start := time.Now()
-	t.Logf("[%s] starting cleaner binary build", start.Format(timeFormat))
-	tempDir := t.TempDir()
-	cleanerBinary := filepath.Join(tempDir, "cleaner")
-
-	buildCmd := exec.Command("go", "build", "-o", cleanerBinary, "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
-	output, err := buildCmd.CombinedOutput()
-	if err != nil {
-		t.Logf("failed to build cleaner binary: %v", err)
-		t.Logf("output: %s", string(output))
-		// Fall back to go run if build fails
-		return exec.Command("go", "run", "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
-	}
-	t.Logf("[%s] cleaner binary %s built in %s", time.Now().Format(timeFormat), cleanerBinary, time.Since(start))
-
-	return exec.Command(cleanerBinary)
-}
diff --git a/coderd/database/dbtestutil/cleaner_windows.go b/coderd/database/dbtestutil/cleaner_windows.go
deleted file mode 100644
index 4c743b90edba3..0000000000000
--- a/coderd/database/dbtestutil/cleaner_windows.go
+++ /dev/null
@@ -1,11 +0,0 @@
-//go:build windows
-
-package dbtestutil
-
-import "os/exec"
-
-// cleanerCmd returns a command to execute the cleaner binary. We do this with go run on Windows because we can't
-// delete the temporary directory after the test: the binary will still be running. c.f. cleaner_posix.go.
-func cleanerCmd(_ TBSubset) *exec.Cmd {
-	return exec.Command("go", "run", "github.com/coder/coder/v2/coderd/database/dbtestutil/cleanercmd")
-}
diff --git a/coderd/database/dbtestutil/cleanercmd/main.go b/coderd/database/dbtestutil/cleanercmd/main.go
deleted file mode 100644
index 038637320e0a1..0000000000000
--- a/coderd/database/dbtestutil/cleanercmd/main.go
+++ /dev/null
@@ -1,7 +0,0 @@
-package main
-
-import "github.com/coder/coder/v2/coderd/database/dbtestutil"
-
-func main() {
-	dbtestutil.RunCleaner()
-}

From dd85d1fdd8fb88f41eea90867db5b398539927e5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 00:31:19 +0000
Subject: [PATCH 103/298] chore: bump coder/claude-code/coder from 3.0.1 to
 3.1.0 in /dogfood/coder (#20263)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/claude-code/coder&package-manager=terraform&previous-version=3.0.1&new-version=3.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index cc223996ba7e9..eb2dfdbeadcd3 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -866,7 +866,7 @@ locals {
 module "claude-code" {
   count               = local.has_ai_prompt ? data.coder_workspace.me.start_count : 0
   source              = "dev.registry.coder.com/coder/claude-code/coder"
-  version             = "3.0.1"
+  version             = "3.1.0"
   agent_id            = coder_agent.dev.id
   workdir             = local.repo_dir
   claude_code_version = "latest"

From d9f95f22858bd8a94839b354ed902fa18428d1ac Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 00:31:27 +0000
Subject: [PATCH 104/298] chore: bump coder/git-clone/coder from 1.1.1 to 1.1.2
 in /dogfood/coder (#20264)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/git-clone/coder&package-manager=terraform&previous-version=1.1.1&new-version=1.1.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index eb2dfdbeadcd3..b17f0f94e179f 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -364,7 +364,7 @@ module "git-config" {
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "dev.registry.coder.com/coder/git-clone/coder"
-  version  = "1.1.1"
+  version  = "1.1.2"
   agent_id = coder_agent.dev.id
   url      = "https://github.com/coder/coder"
   base_dir = local.repo_base_dir

From 299a54a99b071eda41d70727e2e82e7c356807a1 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Mon, 13 Oct 2025 12:02:22 +0300
Subject: [PATCH 105/298] feat(coderd): add tasks rbac object (#20234)

This change adds RBAC for tasks.

Updates coder/internal#948
Supersedes coder/coder#20212
---
 coderd/apidoc/docs.go                           | 12 ++++++++++++
 coderd/apidoc/swagger.json                      | 12 ++++++++++++
 coderd/database/dbauthz/dbauthz.go              |  4 +++-
 coderd/database/dump.sql                        |  7 ++++++-
 .../migrations/000378_add_tasks_rbac.down.sql   |  3 +++
 .../migrations/000378_add_tasks_rbac.up.sql     |  6 ++++++
 coderd/database/modelmethods.go                 |  7 +++++++
 coderd/database/models.go                       | 17 ++++++++++++++++-
 coderd/rbac/object_gen.go                       | 11 +++++++++++
 coderd/rbac/policy/policy.go                    | 10 ++++++++++
 coderd/rbac/roles_test.go                       |  9 +++++++++
 coderd/rbac/scopes_catalog.go                   |  7 +++++++
 coderd/rbac/scopes_constants_gen.go             | 12 ++++++++++++
 codersdk/apikey_scopes_gen.go                   | 10 ++++++++++
 codersdk/rbacresources_gen.go                   |  2 ++
 docs/reference/api/members.md                   |  5 +++++
 docs/reference/api/schemas.md                   |  6 ++++++
 site/src/api/rbacresourcesGenerated.ts          |  6 ++++++
 site/src/api/typesGenerated.ts                  | 12 ++++++++++++
 19 files changed, 155 insertions(+), 3 deletions(-)
 create mode 100644 coderd/database/migrations/000378_add_tasks_rbac.down.sql
 create mode 100644 coderd/database/migrations/000378_add_tasks_rbac.up.sql

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 6ee189e18268f..617678ab99454 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11932,6 +11932,11 @@ const docTemplate = `{
                 "tailnet_coordinator:delete",
                 "tailnet_coordinator:read",
                 "tailnet_coordinator:update",
+                "task:*",
+                "task:create",
+                "task:delete",
+                "task:read",
+                "task:update",
                 "template:*",
                 "template:create",
                 "template:delete",
@@ -12123,6 +12128,11 @@ const docTemplate = `{
                 "APIKeyScopeTailnetCoordinatorDelete",
                 "APIKeyScopeTailnetCoordinatorRead",
                 "APIKeyScopeTailnetCoordinatorUpdate",
+                "APIKeyScopeTaskAll",
+                "APIKeyScopeTaskCreate",
+                "APIKeyScopeTaskDelete",
+                "APIKeyScopeTaskRead",
+                "APIKeyScopeTaskUpdate",
                 "APIKeyScopeTemplateAll",
                 "APIKeyScopeTemplateCreate",
                 "APIKeyScopeTemplateDelete",
@@ -16977,6 +16987,7 @@ const docTemplate = `{
                 "replicas",
                 "system",
                 "tailnet_coordinator",
+                "task",
                 "template",
                 "usage_event",
                 "user",
@@ -17020,6 +17031,7 @@ const docTemplate = `{
                 "ResourceReplicas",
                 "ResourceSystem",
                 "ResourceTailnetCoordinator",
+                "ResourceTask",
                 "ResourceTemplate",
                 "ResourceUsageEvent",
                 "ResourceUser",
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 48aaadadb993a..83a51e31b8287 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10636,6 +10636,11 @@
 				"tailnet_coordinator:delete",
 				"tailnet_coordinator:read",
 				"tailnet_coordinator:update",
+				"task:*",
+				"task:create",
+				"task:delete",
+				"task:read",
+				"task:update",
 				"template:*",
 				"template:create",
 				"template:delete",
@@ -10827,6 +10832,11 @@
 				"APIKeyScopeTailnetCoordinatorDelete",
 				"APIKeyScopeTailnetCoordinatorRead",
 				"APIKeyScopeTailnetCoordinatorUpdate",
+				"APIKeyScopeTaskAll",
+				"APIKeyScopeTaskCreate",
+				"APIKeyScopeTaskDelete",
+				"APIKeyScopeTaskRead",
+				"APIKeyScopeTaskUpdate",
 				"APIKeyScopeTemplateAll",
 				"APIKeyScopeTemplateCreate",
 				"APIKeyScopeTemplateDelete",
@@ -15499,6 +15509,7 @@
 				"replicas",
 				"system",
 				"tailnet_coordinator",
+				"task",
 				"template",
 				"usage_event",
 				"user",
@@ -15542,6 +15553,7 @@
 				"ResourceReplicas",
 				"ResourceSystem",
 				"ResourceTailnetCoordinator",
+				"ResourceTask",
 				"ResourceTemplate",
 				"ResourceUsageEvent",
 				"ResourceUser",
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 4f17a897039d2..716d6e3825f9a 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -219,7 +219,9 @@ var (
 					rbac.ResourceUser.Type:             {policy.ActionRead, policy.ActionReadPersonal, policy.ActionUpdatePersonal},
 					rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop},
 					rbac.ResourceWorkspace.Type:        {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionCreateAgent},
-					rbac.ResourceApiKey.Type:           {policy.WildcardSymbol},
+					// Provisionerd needs to read and update tasks associated with workspaces.
+					rbac.ResourceTask.Type:   {policy.ActionRead, policy.ActionUpdate},
+					rbac.ResourceApiKey.Type: {policy.WildcardSymbol},
 					// When org scoped provisioner credentials are implemented,
 					// this can be reduced to read a specific org.
 					rbac.ResourceOrganization.Type: {policy.ActionRead},
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index b2cac7185bfcf..cef9e37445059 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -197,7 +197,12 @@ CREATE TYPE api_key_scope AS ENUM (
     'workspace_agent_devcontainers:*',
     'workspace_agent_resource_monitor:*',
     'workspace_dormant:*',
-    'workspace_proxy:*'
+    'workspace_proxy:*',
+    'task:create',
+    'task:read',
+    'task:update',
+    'task:delete',
+    'task:*'
 );
 
 CREATE TYPE app_sharing_level AS ENUM (
diff --git a/coderd/database/migrations/000378_add_tasks_rbac.down.sql b/coderd/database/migrations/000378_add_tasks_rbac.down.sql
new file mode 100644
index 0000000000000..761a8d943f198
--- /dev/null
+++ b/coderd/database/migrations/000378_add_tasks_rbac.down.sql
@@ -0,0 +1,3 @@
+-- Revert Tasks RBAC.
+-- No-op: enum values remain to avoid churn. Removing enum values requires
+-- doing a create/cast/drop cycle which is intentionally omitted here.
diff --git a/coderd/database/migrations/000378_add_tasks_rbac.up.sql b/coderd/database/migrations/000378_add_tasks_rbac.up.sql
new file mode 100644
index 0000000000000..18d81ac4436c1
--- /dev/null
+++ b/coderd/database/migrations/000378_add_tasks_rbac.up.sql
@@ -0,0 +1,6 @@
+-- Tasks RBAC.
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'task:create';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'task:read';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'task:update';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'task:delete';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'task:*';
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
index b6d10569a7cf3..6254125cc1004 100644
--- a/coderd/database/modelmethods.go
+++ b/coderd/database/modelmethods.go
@@ -132,6 +132,13 @@ func (w ConnectionLog) RBACObject() rbac.Object {
 	return obj
 }
 
+func (t Task) RBACObject() rbac.Object {
+	return rbac.ResourceTask.
+		WithID(t.ID).
+		WithOwner(t.OwnerID.String()).
+		InOrg(t.OrganizationID)
+}
+
 func (s APIKeyScope) ToRBAC() rbac.ScopeName {
 	switch s {
 	case ApiKeyScopeCoderAll:
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 06c0e98fe4f64..4f4632569ed81 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -206,6 +206,11 @@ const (
 	ApiKeyScopeWorkspaceAgentResourceMonitor       APIKeyScope = "workspace_agent_resource_monitor:*"
 	ApiKeyScopeWorkspaceDormant                    APIKeyScope = "workspace_dormant:*"
 	ApiKeyScopeWorkspaceProxy                      APIKeyScope = "workspace_proxy:*"
+	ApiKeyScopeTaskCreate                          APIKeyScope = "task:create"
+	ApiKeyScopeTaskRead                            APIKeyScope = "task:read"
+	ApiKeyScopeTaskUpdate                          APIKeyScope = "task:update"
+	ApiKeyScopeTaskDelete                          APIKeyScope = "task:delete"
+	ApiKeyScopeTask                                APIKeyScope = "task:*"
 )
 
 func (e *APIKeyScope) Scan(src interface{}) error {
@@ -431,7 +436,12 @@ func (e APIKeyScope) Valid() bool {
 		ApiKeyScopeWorkspaceAgentDevcontainers,
 		ApiKeyScopeWorkspaceAgentResourceMonitor,
 		ApiKeyScopeWorkspaceDormant,
-		ApiKeyScopeWorkspaceProxy:
+		ApiKeyScopeWorkspaceProxy,
+		ApiKeyScopeTaskCreate,
+		ApiKeyScopeTaskRead,
+		ApiKeyScopeTaskUpdate,
+		ApiKeyScopeTaskDelete,
+		ApiKeyScopeTask:
 		return true
 	}
 	return false
@@ -626,6 +636,11 @@ func AllAPIKeyScopeValues() []APIKeyScope {
 		ApiKeyScopeWorkspaceAgentResourceMonitor,
 		ApiKeyScopeWorkspaceDormant,
 		ApiKeyScopeWorkspaceProxy,
+		ApiKeyScopeTaskCreate,
+		ApiKeyScopeTaskRead,
+		ApiKeyScopeTaskUpdate,
+		ApiKeyScopeTaskDelete,
+		ApiKeyScopeTask,
 	}
 }
 
diff --git a/coderd/rbac/object_gen.go b/coderd/rbac/object_gen.go
index d0c78bd480766..9efaa0bfe1e14 100644
--- a/coderd/rbac/object_gen.go
+++ b/coderd/rbac/object_gen.go
@@ -286,6 +286,16 @@ var (
 		Type: "tailnet_coordinator",
 	}
 
+	// ResourceTask
+	// Valid Actions
+	//  - "ActionCreate" :: create a new task
+	//  - "ActionDelete" :: delete task
+	//  - "ActionRead" :: read task data or output to view on the UI or CLI
+	//  - "ActionUpdate" :: edit task settings or send input to an existing task
+	ResourceTask = Object{
+		Type: "task",
+	}
+
 	// ResourceTemplate
 	// Valid Actions
 	//  - "ActionCreate" :: create a template
@@ -430,6 +440,7 @@ func AllResources() []Objecter {
 		ResourceReplicas,
 		ResourceSystem,
 		ResourceTailnetCoordinator,
+		ResourceTask,
 		ResourceTemplate,
 		ResourceUsageEvent,
 		ResourceUser,
diff --git a/coderd/rbac/policy/policy.go b/coderd/rbac/policy/policy.go
index 93b0ba4e76215..cdc91a134a086 100644
--- a/coderd/rbac/policy/policy.go
+++ b/coderd/rbac/policy/policy.go
@@ -63,6 +63,13 @@ var workspaceActions = map[Action]ActionDefinition{
 	ActionDeleteAgent: "delete an existing workspace agent",
 }
 
+var taskActions = map[Action]ActionDefinition{
+	ActionCreate: "create a new task",
+	ActionRead:   "read task data or output to view on the UI or CLI",
+	ActionUpdate: "edit task settings or send input to an existing task",
+	ActionDelete: "delete task",
+}
+
 // RBACPermissions is indexed by the type
 var RBACPermissions = map[string]PermissionDefinition{
 	// Wildcard is every object, and the action "*" provides all actions.
@@ -86,6 +93,9 @@ var RBACPermissions = map[string]PermissionDefinition{
 	"workspace": {
 		Actions: workspaceActions,
 	},
+	"task": {
+		Actions: taskActions,
+	},
 	// Dormant workspaces have the same perms as workspaces.
 	"workspace_dormant": {
 		Actions: workspaceActions,
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
index 18d521d4748eb..d5bf2e2af81ef 100644
--- a/coderd/rbac/roles_test.go
+++ b/coderd/rbac/roles_test.go
@@ -505,6 +505,15 @@ func TestRolePermissions(t *testing.T) {
 				false: {setOtherOrg, userAdmin, memberMe, orgUserAdmin, orgAuditor, orgMemberMe},
 			},
 		},
+		{
+			Name:     "Task",
+			Actions:  crud,
+			Resource: rbac.ResourceTask.WithID(uuid.New()).InOrg(orgID).WithOwner(memberMe.Actor.ID),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true:  {owner, orgAdmin, orgMemberMe},
+				false: {setOtherOrg, userAdmin, templateAdmin, memberMe, orgTemplateAdmin, orgUserAdmin, orgAuditor},
+			},
+		},
 		// Some admin style resources
 		{
 			Name:     "Licenses",
diff --git a/coderd/rbac/scopes_catalog.go b/coderd/rbac/scopes_catalog.go
index f8deb57b46fcb..ef4f3186de4fd 100644
--- a/coderd/rbac/scopes_catalog.go
+++ b/coderd/rbac/scopes_catalog.go
@@ -50,6 +50,13 @@ var externalLowLevel = map[ScopeName]struct{}{
 	"user_secret:update": {},
 	"user_secret:delete": {},
 	"user_secret:*":      {},
+
+	// Tasks
+	"task:create": {},
+	"task:read":   {},
+	"task:update": {},
+	"task:delete": {},
+	"task:*":      {},
 }
 
 // Public composite coder:* scopes exposed to users.
diff --git a/coderd/rbac/scopes_constants_gen.go b/coderd/rbac/scopes_constants_gen.go
index ccd9622cd4df4..a81ccf7be49f8 100644
--- a/coderd/rbac/scopes_constants_gen.go
+++ b/coderd/rbac/scopes_constants_gen.go
@@ -95,6 +95,10 @@ const (
 	ScopeTailnetCoordinatorDelete            ScopeName = "tailnet_coordinator:delete"
 	ScopeTailnetCoordinatorRead              ScopeName = "tailnet_coordinator:read"
 	ScopeTailnetCoordinatorUpdate            ScopeName = "tailnet_coordinator:update"
+	ScopeTaskCreate                          ScopeName = "task:create"
+	ScopeTaskDelete                          ScopeName = "task:delete"
+	ScopeTaskRead                            ScopeName = "task:read"
+	ScopeTaskUpdate                          ScopeName = "task:update"
 	ScopeTemplateCreate                      ScopeName = "template:create"
 	ScopeTemplateDelete                      ScopeName = "template:delete"
 	ScopeTemplateRead                        ScopeName = "template:read"
@@ -244,6 +248,10 @@ func (e ScopeName) Valid() bool {
 		ScopeTailnetCoordinatorDelete,
 		ScopeTailnetCoordinatorRead,
 		ScopeTailnetCoordinatorUpdate,
+		ScopeTaskCreate,
+		ScopeTaskDelete,
+		ScopeTaskRead,
+		ScopeTaskUpdate,
 		ScopeTemplateCreate,
 		ScopeTemplateDelete,
 		ScopeTemplateRead,
@@ -394,6 +402,10 @@ func AllScopeNameValues() []ScopeName {
 		ScopeTailnetCoordinatorDelete,
 		ScopeTailnetCoordinatorRead,
 		ScopeTailnetCoordinatorUpdate,
+		ScopeTaskCreate,
+		ScopeTaskDelete,
+		ScopeTaskRead,
+		ScopeTaskUpdate,
 		ScopeTemplateCreate,
 		ScopeTemplateDelete,
 		ScopeTemplateRead,
diff --git a/codersdk/apikey_scopes_gen.go b/codersdk/apikey_scopes_gen.go
index 606a704ae4bdc..d0e88bb2d6894 100644
--- a/codersdk/apikey_scopes_gen.go
+++ b/codersdk/apikey_scopes_gen.go
@@ -133,6 +133,11 @@ const (
 	APIKeyScopeTailnetCoordinatorDelete            APIKeyScope = "tailnet_coordinator:delete"
 	APIKeyScopeTailnetCoordinatorRead              APIKeyScope = "tailnet_coordinator:read"
 	APIKeyScopeTailnetCoordinatorUpdate            APIKeyScope = "tailnet_coordinator:update"
+	APIKeyScopeTaskAll                             APIKeyScope = "task:*"
+	APIKeyScopeTaskCreate                          APIKeyScope = "task:create"
+	APIKeyScopeTaskDelete                          APIKeyScope = "task:delete"
+	APIKeyScopeTaskRead                            APIKeyScope = "task:read"
+	APIKeyScopeTaskUpdate                          APIKeyScope = "task:update"
 	APIKeyScopeTemplateAll                         APIKeyScope = "template:*"
 	APIKeyScopeTemplateCreate                      APIKeyScope = "template:create"
 	APIKeyScopeTemplateDelete                      APIKeyScope = "template:delete"
@@ -214,6 +219,11 @@ var PublicAPIKeyScopes = []APIKeyScope{
 	APIKeyScopeFileAll,
 	APIKeyScopeFileCreate,
 	APIKeyScopeFileRead,
+	APIKeyScopeTaskAll,
+	APIKeyScopeTaskCreate,
+	APIKeyScopeTaskDelete,
+	APIKeyScopeTaskRead,
+	APIKeyScopeTaskUpdate,
 	APIKeyScopeTemplateAll,
 	APIKeyScopeTemplateCreate,
 	APIKeyScopeTemplateDelete,
diff --git a/codersdk/rbacresources_gen.go b/codersdk/rbacresources_gen.go
index 6a8185e6eb62a..a48b688a7aff2 100644
--- a/codersdk/rbacresources_gen.go
+++ b/codersdk/rbacresources_gen.go
@@ -35,6 +35,7 @@ const (
 	ResourceReplicas                      RBACResource = "replicas"
 	ResourceSystem                        RBACResource = "system"
 	ResourceTailnetCoordinator            RBACResource = "tailnet_coordinator"
+	ResourceTask                          RBACResource = "task"
 	ResourceTemplate                      RBACResource = "template"
 	ResourceUsageEvent                    RBACResource = "usage_event"
 	ResourceUser                          RBACResource = "user"
@@ -102,6 +103,7 @@ var RBACResourceActions = map[RBACResource][]RBACAction{
 	ResourceReplicas:                      {ActionRead},
 	ResourceSystem:                        {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
 	ResourceTailnetCoordinator:            {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
+	ResourceTask:                          {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
 	ResourceTemplate:                      {ActionCreate, ActionDelete, ActionRead, ActionUpdate, ActionUse, ActionViewInsights},
 	ResourceUsageEvent:                    {ActionCreate, ActionRead, ActionUpdate},
 	ResourceUser:                          {ActionCreate, ActionDelete, ActionRead, ActionReadPersonal, ActionUpdate, ActionUpdatePersonal},
diff --git a/docs/reference/api/members.md b/docs/reference/api/members.md
index 6e02b90bc6b9d..8fac25e9770ff 100644
--- a/docs/reference/api/members.md
+++ b/docs/reference/api/members.md
@@ -213,6 +213,7 @@ Status Code **200**
 | `resource_type` | `replicas`                         |
 | `resource_type` | `system`                           |
 | `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `task`                             |
 | `resource_type` | `template`                         |
 | `resource_type` | `usage_event`                      |
 | `resource_type` | `user`                             |
@@ -386,6 +387,7 @@ Status Code **200**
 | `resource_type` | `replicas`                         |
 | `resource_type` | `system`                           |
 | `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `task`                             |
 | `resource_type` | `template`                         |
 | `resource_type` | `usage_event`                      |
 | `resource_type` | `user`                             |
@@ -559,6 +561,7 @@ Status Code **200**
 | `resource_type` | `replicas`                         |
 | `resource_type` | `system`                           |
 | `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `task`                             |
 | `resource_type` | `template`                         |
 | `resource_type` | `usage_event`                      |
 | `resource_type` | `user`                             |
@@ -701,6 +704,7 @@ Status Code **200**
 | `resource_type` | `replicas`                         |
 | `resource_type` | `system`                           |
 | `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `task`                             |
 | `resource_type` | `template`                         |
 | `resource_type` | `usage_event`                      |
 | `resource_type` | `user`                             |
@@ -1065,6 +1069,7 @@ Status Code **200**
 | `resource_type` | `replicas`                         |
 | `resource_type` | `system`                           |
 | `resource_type` | `tailnet_coordinator`              |
+| `resource_type` | `task`                             |
 | `resource_type` | `template`                         |
 | `resource_type` | `usage_event`                      |
 | `resource_type` | `user`                             |
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index cb616c02e0d30..4c8fcba929505 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -909,6 +909,11 @@
 | `tailnet_coordinator:delete`              |
 | `tailnet_coordinator:read`                |
 | `tailnet_coordinator:update`              |
+| `task:*`                                  |
+| `task:create`                             |
+| `task:delete`                             |
+| `task:read`                               |
+| `task:update`                             |
 | `template:*`                              |
 | `template:create`                         |
 | `template:delete`                         |
@@ -7110,6 +7115,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `replicas`                         |
 | `system`                           |
 | `tailnet_coordinator`              |
+| `task`                             |
 | `template`                         |
 | `usage_event`                      |
 | `user`                             |
diff --git a/site/src/api/rbacresourcesGenerated.ts b/site/src/api/rbacresourcesGenerated.ts
index e2a394894965f..0f62160563dd2 100644
--- a/site/src/api/rbacresourcesGenerated.ts
+++ b/site/src/api/rbacresourcesGenerated.ts
@@ -156,6 +156,12 @@ export const RBACResourceActions: Partial<
 		read: "view info about a Tailnet coordinator",
 		update: "update a Tailnet coordinator",
 	},
+	task: {
+		create: "create a new task",
+		delete: "delete task",
+		read: "read task data or output to view on the UI or CLI",
+		update: "edit task settings or send input to an existing task",
+	},
 	template: {
 		create: "create a template",
 		delete: "delete a template",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index ebb9ed1a835c7..c84e4ed054b6a 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -247,6 +247,11 @@ export type APIKeyScope =
 	| "tailnet_coordinator:delete"
 	| "tailnet_coordinator:read"
 	| "tailnet_coordinator:update"
+	| "task:*"
+	| "task:create"
+	| "task:delete"
+	| "task:read"
+	| "task:update"
 	| "template:*"
 	| "template:create"
 	| "template:delete"
@@ -438,6 +443,11 @@ export const APIKeyScopes: APIKeyScope[] = [
 	"tailnet_coordinator:delete",
 	"tailnet_coordinator:read",
 	"tailnet_coordinator:update",
+	"task:*",
+	"task:create",
+	"task:delete",
+	"task:read",
+	"task:update",
 	"template:*",
 	"template:create",
 	"template:delete",
@@ -2915,6 +2925,7 @@ export type RBACResource =
 	| "replicas"
 	| "system"
 	| "tailnet_coordinator"
+	| "task"
 	| "template"
 	| "usage_event"
 	| "user"
@@ -2958,6 +2969,7 @@ export const RBACResources: RBACResource[] = [
 	"replicas",
 	"system",
 	"tailnet_coordinator",
+	"task",
 	"template",
 	"usage_event",
 	"user",

From 952c69f412b000f215125dba8ae186badfa3671b Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Mon, 13 Oct 2025 12:25:58 +0300
Subject: [PATCH 106/298] feat(coderd/database): add task status and status
 view (#20235)

This change updates the `task_workspace_apps` table structure for
improved linking to workspace builds and adds queries to manage tasks
and a view to expose task status.

Updates coder/internal#948
Supersedes coder/coder#20212
Supersedes coder/coder#19773
---
 coderd/database/check_constraint.go           |   4 +-
 coderd/database/dbauthz/dbauthz.go            |  31 ++
 coderd/database/dbauthz/dbauthz_test.go       |  47 ++
 coderd/database/dbgen/dbgen.go                |  38 ++
 coderd/database/dbmetrics/querymetrics.go     |  28 ++
 coderd/database/dbmock/dbmock.go              |  60 +++
 coderd/database/dump.sql                      | 318 +++++++-----
 coderd/database/foreign_key_constraint.go     |   1 -
 ...379_create_tasks_with_status_view.down.sql |  33 ++
 ...00379_create_tasks_with_status_view.up.sql | 104 ++++
 ...00379_create_tasks_with_status_view.up.sql |   6 +
 coderd/database/modelmethods.go               |   7 +
 coderd/database/models.go                     |  92 +++-
 coderd/database/querier.go                    |   4 +
 coderd/database/querier_test.go               | 452 ++++++++++++++++++
 coderd/database/queries.sql.go                | 128 +++++
 coderd/database/queries/tasks.sql             |  23 +
 coderd/database/sqlc.yaml                     |   2 +
 coderd/database/unique_constraint.go          |   1 +
 19 files changed, 1249 insertions(+), 130 deletions(-)
 create mode 100644 coderd/database/migrations/000379_create_tasks_with_status_view.down.sql
 create mode 100644 coderd/database/migrations/000379_create_tasks_with_status_view.up.sql
 create mode 100644 coderd/database/migrations/testdata/fixtures/000379_create_tasks_with_status_view.up.sql
 create mode 100644 coderd/database/queries/tasks.sql

diff --git a/coderd/database/check_constraint.go b/coderd/database/check_constraint.go
index ac204f85f5603..e80307ffc463c 100644
--- a/coderd/database/check_constraint.go
+++ b/coderd/database/check_constraint.go
@@ -9,10 +9,10 @@ const (
 	CheckOneTimePasscodeSet                        CheckConstraint = "one_time_passcode_set"                            // users
 	CheckUsersUsernameMinLength                    CheckConstraint = "users_username_min_length"                        // users
 	CheckMaxProvisionerLogsLength                  CheckConstraint = "max_provisioner_logs_length"                      // provisioner_jobs
-	CheckValidationMonotonicOrder                  CheckConstraint = "validation_monotonic_order"                       // template_version_parameters
-	CheckUsageEventTypeCheck                       CheckConstraint = "usage_event_type_check"                           // usage_events
 	CheckMaxLogsLength                             CheckConstraint = "max_logs_length"                                  // workspace_agents
 	CheckSubsystemsNotNone                         CheckConstraint = "subsystems_not_none"                              // workspace_agents
 	CheckWorkspaceBuildsAiTaskSidebarAppIDRequired CheckConstraint = "workspace_builds_ai_task_sidebar_app_id_required" // workspace_builds
 	CheckWorkspaceBuildsDeadlineBelowMaxDeadline   CheckConstraint = "workspace_builds_deadline_below_max_deadline"     // workspace_builds
+	CheckValidationMonotonicOrder                  CheckConstraint = "validation_monotonic_order"                       // template_version_parameters
+	CheckUsageEventTypeCheck                       CheckConstraint = "usage_event_type_check"                           // usage_events
 )
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 716d6e3825f9a..0d2a5f4435790 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -2885,6 +2885,14 @@ func (q *querier) GetTailnetTunnelPeerIDs(ctx context.Context, srcID uuid.UUID)
 	return q.db.GetTailnetTunnelPeerIDs(ctx, srcID)
 }
 
+func (q *querier) GetTaskByID(ctx context.Context, id uuid.UUID) (database.Task, error) {
+	return fetch(q.log, q.auth, q.db.GetTaskByID)(ctx, id)
+}
+
+func (q *querier) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (database.Task, error) {
+	return fetch(q.log, q.auth, q.db.GetTaskByWorkspaceID)(ctx, workspaceID)
+}
+
 func (q *querier) GetTelemetryItem(ctx context.Context, key string) (database.TelemetryItem, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 		return database.TelemetryItem{}, err
@@ -4110,6 +4118,17 @@ func (q *querier) InsertReplica(ctx context.Context, arg database.InsertReplicaP
 	return q.db.InsertReplica(ctx, arg)
 }
 
+func (q *querier) InsertTask(ctx context.Context, arg database.InsertTaskParams) (database.TaskTable, error) {
+	// Ensure the actor can access the specified template version (and thus its template).
+	if _, err := q.GetTemplateVersionByID(ctx, arg.TemplateVersionID); err != nil {
+		return database.TaskTable{}, err
+	}
+
+	obj := rbac.ResourceTask.WithOwner(arg.OwnerID.String()).InOrg(arg.OrganizationID)
+
+	return insert(q.log, q.auth, obj, q.db.InsertTask)(ctx, arg)
+}
+
 func (q *querier) InsertTelemetryItemIfNotExists(ctx context.Context, arg database.InsertTelemetryItemIfNotExistsParams) error {
 	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
 		return err
@@ -5668,6 +5687,18 @@ func (q *querier) UpsertTailnetTunnel(ctx context.Context, arg database.UpsertTa
 	return q.db.UpsertTailnetTunnel(ctx, arg)
 }
 
+func (q *querier) UpsertTaskWorkspaceApp(ctx context.Context, arg database.UpsertTaskWorkspaceAppParams) (database.TaskWorkspaceApp, error) {
+	// Fetch the task to derive the RBAC object and authorize update on it.
+	task, err := q.db.GetTaskByID(ctx, arg.TaskID)
+	if err != nil {
+		return database.TaskWorkspaceApp{}, err
+	}
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, task); err != nil {
+		return database.TaskWorkspaceApp{}, err
+	}
+	return q.db.UpsertTaskWorkspaceApp(ctx, arg)
+}
+
 func (q *querier) UpsertTelemetryItem(ctx context.Context, arg database.UpsertTelemetryItemParams) error {
 	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceSystem); err != nil {
 		return err
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 19cac48cb4ac2..4034a4878f309 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -2347,6 +2347,53 @@ func (s *MethodTestSuite) TestWorkspacePortSharing() {
 	}))
 }
 
+func (s *MethodTestSuite) TestTasks() {
+	s.Run("GetTaskByID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		task := testutil.Fake(s.T(), faker, database.Task{})
+		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
+		check.Args(task.ID).Asserts(task, policy.ActionRead).Returns(task)
+	}))
+	s.Run("InsertTask", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		tpl := testutil.Fake(s.T(), faker, database.Template{})
+		tv := testutil.Fake(s.T(), faker, database.TemplateVersion{
+			TemplateID:     uuid.NullUUID{UUID: tpl.ID, Valid: true},
+			OrganizationID: tpl.OrganizationID,
+		})
+
+		arg := testutil.Fake(s.T(), faker, database.InsertTaskParams{
+			OrganizationID:    tpl.OrganizationID,
+			TemplateVersionID: tv.ID,
+		})
+
+		dbm.EXPECT().GetTemplateVersionByID(gomock.Any(), tv.ID).Return(tv, nil).AnyTimes()
+		dbm.EXPECT().GetTemplateByID(gomock.Any(), tpl.ID).Return(tpl, nil).AnyTimes()
+		dbm.EXPECT().InsertTask(gomock.Any(), arg).Return(database.TaskTable{}, nil).AnyTimes()
+
+		check.Args(arg).Asserts(
+			tpl, policy.ActionRead,
+			rbac.ResourceTask.InOrg(arg.OrganizationID).WithOwner(arg.OwnerID.String()), policy.ActionCreate,
+		).Returns(database.TaskTable{})
+	}))
+	s.Run("UpsertTaskWorkspaceApp", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		task := testutil.Fake(s.T(), faker, database.Task{})
+		arg := database.UpsertTaskWorkspaceAppParams{
+			TaskID:               task.ID,
+			WorkspaceBuildNumber: 1,
+		}
+
+		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
+		dbm.EXPECT().UpsertTaskWorkspaceApp(gomock.Any(), arg).Return(database.TaskWorkspaceApp{}, nil).AnyTimes()
+
+		check.Args(arg).Asserts(task, policy.ActionUpdate).Returns(database.TaskWorkspaceApp{})
+	}))
+	s.Run("GetTaskByWorkspaceID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		task := testutil.Fake(s.T(), faker, database.Task{})
+		task.WorkspaceID = uuid.NullUUID{UUID: uuid.New(), Valid: true}
+		dbm.EXPECT().GetTaskByWorkspaceID(gomock.Any(), task.WorkspaceID.UUID).Return(task, nil).AnyTimes()
+		check.Args(task.WorkspaceID.UUID).Asserts(task, policy.ActionRead).Returns(task)
+	}))
+}
+
 func (s *MethodTestSuite) TestProvisionerKeys() {
 	s.Run("InsertProvisionerKey", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		org := testutil.Fake(s.T(), faker, database.Organization{})
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index 289d664a1a603..e00ff31b9602b 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -28,6 +28,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database/pubsub"
 	"github.com/coder/coder/v2/coderd/rbac"
 	"github.com/coder/coder/v2/coderd/rbac/policy"
+	"github.com/coder/coder/v2/coderd/taskname"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/cryptorand"
 	"github.com/coder/coder/v2/provisionerd/proto"
@@ -1560,6 +1561,43 @@ func AIBridgeToolUsage(t testing.TB, db database.Store, seed database.InsertAIBr
 	return toolUsage
 }
 
+func Task(t testing.TB, db database.Store, orig database.TaskTable) database.TaskTable {
+	t.Helper()
+
+	parameters := orig.TemplateParameters
+	if parameters == nil {
+		parameters = json.RawMessage([]byte("{}"))
+	}
+
+	task, err := db.InsertTask(genCtx, database.InsertTaskParams{
+		OrganizationID:     orig.OrganizationID,
+		OwnerID:            orig.OwnerID,
+		Name:               takeFirst(orig.Name, taskname.GenerateFallback()),
+		WorkspaceID:        orig.WorkspaceID,
+		TemplateVersionID:  orig.TemplateVersionID,
+		TemplateParameters: parameters,
+		Prompt:             orig.Prompt,
+		CreatedAt:          takeFirst(orig.CreatedAt, dbtime.Now()),
+	})
+	require.NoError(t, err, "failed to insert task")
+
+	return task
+}
+
+func TaskWorkspaceApp(t testing.TB, db database.Store, orig database.TaskWorkspaceApp) database.TaskWorkspaceApp {
+	t.Helper()
+
+	app, err := db.UpsertTaskWorkspaceApp(genCtx, database.UpsertTaskWorkspaceAppParams{
+		TaskID:               orig.TaskID,
+		WorkspaceBuildNumber: orig.WorkspaceBuildNumber,
+		WorkspaceAgentID:     orig.WorkspaceAgentID,
+		WorkspaceAppID:       orig.WorkspaceAppID,
+	})
+	require.NoError(t, err, "failed to upsert task workspace app")
+
+	return app
+}
+
 func provisionerJobTiming(t testing.TB, db database.Store, seed database.ProvisionerJobTiming) database.ProvisionerJobTiming {
 	timing, err := db.InsertProvisionerJobTimings(genCtx, database.InsertProvisionerJobTimingsParams{
 		JobID:     takeFirst(seed.JobID, uuid.New()),
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index d2f504964d946..5f191fe66372e 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -1482,6 +1482,20 @@ func (m queryMetricsStore) GetTailnetTunnelPeerIDs(ctx context.Context, srcID uu
 	return r0, r1
 }
 
+func (m queryMetricsStore) GetTaskByID(ctx context.Context, id uuid.UUID) (database.Task, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetTaskByID(ctx, id)
+	m.queryLatencies.WithLabelValues("GetTaskByID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
+func (m queryMetricsStore) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (database.Task, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetTaskByWorkspaceID(ctx, workspaceID)
+	m.queryLatencies.WithLabelValues("GetTaskByWorkspaceID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) GetTelemetryItem(ctx context.Context, key string) (database.TelemetryItem, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetTelemetryItem(ctx, key)
@@ -2455,6 +2469,13 @@ func (m queryMetricsStore) InsertReplica(ctx context.Context, arg database.Inser
 	return replica, err
 }
 
+func (m queryMetricsStore) InsertTask(ctx context.Context, arg database.InsertTaskParams) (database.TaskTable, error) {
+	start := time.Now()
+	r0, r1 := m.s.InsertTask(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertTask").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) InsertTelemetryItemIfNotExists(ctx context.Context, arg database.InsertTelemetryItemIfNotExistsParams) error {
 	start := time.Now()
 	r0 := m.s.InsertTelemetryItemIfNotExists(ctx, arg)
@@ -3533,6 +3554,13 @@ func (m queryMetricsStore) UpsertTailnetTunnel(ctx context.Context, arg database
 	return r0, r1
 }
 
+func (m queryMetricsStore) UpsertTaskWorkspaceApp(ctx context.Context, arg database.UpsertTaskWorkspaceAppParams) (database.TaskWorkspaceApp, error) {
+	start := time.Now()
+	r0, r1 := m.s.UpsertTaskWorkspaceApp(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpsertTaskWorkspaceApp").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) UpsertTelemetryItem(ctx context.Context, arg database.UpsertTelemetryItemParams) error {
 	start := time.Now()
 	r0 := m.s.UpsertTelemetryItem(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 09edffc9deadc..9dc5f1adf2562 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -3119,6 +3119,36 @@ func (mr *MockStoreMockRecorder) GetTailnetTunnelPeerIDs(ctx, srcID any) *gomock
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTailnetTunnelPeerIDs", reflect.TypeOf((*MockStore)(nil).GetTailnetTunnelPeerIDs), ctx, srcID)
 }
 
+// GetTaskByID mocks base method.
+func (m *MockStore) GetTaskByID(ctx context.Context, id uuid.UUID) (database.Task, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetTaskByID", ctx, id)
+	ret0, _ := ret[0].(database.Task)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetTaskByID indicates an expected call of GetTaskByID.
+func (mr *MockStoreMockRecorder) GetTaskByID(ctx, id any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTaskByID", reflect.TypeOf((*MockStore)(nil).GetTaskByID), ctx, id)
+}
+
+// GetTaskByWorkspaceID mocks base method.
+func (m *MockStore) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (database.Task, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetTaskByWorkspaceID", ctx, workspaceID)
+	ret0, _ := ret[0].(database.Task)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetTaskByWorkspaceID indicates an expected call of GetTaskByWorkspaceID.
+func (mr *MockStoreMockRecorder) GetTaskByWorkspaceID(ctx, workspaceID any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetTaskByWorkspaceID", reflect.TypeOf((*MockStore)(nil).GetTaskByWorkspaceID), ctx, workspaceID)
+}
+
 // GetTelemetryItem mocks base method.
 func (m *MockStore) GetTelemetryItem(ctx context.Context, key string) (database.TelemetryItem, error) {
 	m.ctrl.T.Helper()
@@ -5244,6 +5274,21 @@ func (mr *MockStoreMockRecorder) InsertReplica(ctx, arg any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertReplica", reflect.TypeOf((*MockStore)(nil).InsertReplica), ctx, arg)
 }
 
+// InsertTask mocks base method.
+func (m *MockStore) InsertTask(ctx context.Context, arg database.InsertTaskParams) (database.TaskTable, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertTask", ctx, arg)
+	ret0, _ := ret[0].(database.TaskTable)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// InsertTask indicates an expected call of InsertTask.
+func (mr *MockStoreMockRecorder) InsertTask(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertTask", reflect.TypeOf((*MockStore)(nil).InsertTask), ctx, arg)
+}
+
 // InsertTelemetryItemIfNotExists mocks base method.
 func (m *MockStore) InsertTelemetryItemIfNotExists(ctx context.Context, arg database.InsertTelemetryItemIfNotExistsParams) error {
 	m.ctrl.T.Helper()
@@ -7517,6 +7562,21 @@ func (mr *MockStoreMockRecorder) UpsertTailnetTunnel(ctx, arg any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertTailnetTunnel", reflect.TypeOf((*MockStore)(nil).UpsertTailnetTunnel), ctx, arg)
 }
 
+// UpsertTaskWorkspaceApp mocks base method.
+func (m *MockStore) UpsertTaskWorkspaceApp(ctx context.Context, arg database.UpsertTaskWorkspaceAppParams) (database.TaskWorkspaceApp, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpsertTaskWorkspaceApp", ctx, arg)
+	ret0, _ := ret[0].(database.TaskWorkspaceApp)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpsertTaskWorkspaceApp indicates an expected call of UpsertTaskWorkspaceApp.
+func (mr *MockStoreMockRecorder) UpsertTaskWorkspaceApp(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpsertTaskWorkspaceApp", reflect.TypeOf((*MockStore)(nil).UpsertTaskWorkspaceApp), ctx, arg)
+}
+
 // UpsertTelemetryItem mocks base method.
 func (m *MockStore) UpsertTelemetryItem(ctx context.Context, arg database.UpsertTelemetryItemParams) error {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index cef9e37445059..daa55fb1bb307 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -477,6 +477,15 @@ CREATE TYPE tailnet_status AS ENUM (
     'lost'
 );
 
+CREATE TYPE task_status AS ENUM (
+    'pending',
+    'initializing',
+    'active',
+    'paused',
+    'unknown',
+    'error'
+);
+
 CREATE TYPE user_status AS ENUM (
     'active',
     'suspended',
@@ -1796,9 +1805,9 @@ CREATE TABLE tailnet_tunnels (
 
 CREATE TABLE task_workspace_apps (
     task_id uuid NOT NULL,
-    workspace_build_id uuid NOT NULL,
-    workspace_agent_id uuid NOT NULL,
-    workspace_app_id uuid NOT NULL
+    workspace_agent_id uuid,
+    workspace_app_id uuid,
+    workspace_build_number integer NOT NULL
 );
 
 CREATE TABLE tasks (
@@ -1814,6 +1823,180 @@ CREATE TABLE tasks (
     deleted_at timestamp with time zone
 );
 
+CREATE TABLE workspace_agents (
+    id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    name character varying(64) NOT NULL,
+    first_connected_at timestamp with time zone,
+    last_connected_at timestamp with time zone,
+    disconnected_at timestamp with time zone,
+    resource_id uuid NOT NULL,
+    auth_token uuid NOT NULL,
+    auth_instance_id character varying,
+    architecture character varying(64) NOT NULL,
+    environment_variables jsonb,
+    operating_system character varying(64) NOT NULL,
+    instance_metadata jsonb,
+    resource_metadata jsonb,
+    directory character varying(4096) DEFAULT ''::character varying NOT NULL,
+    version text DEFAULT ''::text NOT NULL,
+    last_connected_replica_id uuid,
+    connection_timeout_seconds integer DEFAULT 0 NOT NULL,
+    troubleshooting_url text DEFAULT ''::text NOT NULL,
+    motd_file text DEFAULT ''::text NOT NULL,
+    lifecycle_state workspace_agent_lifecycle_state DEFAULT 'created'::workspace_agent_lifecycle_state NOT NULL,
+    expanded_directory character varying(4096) DEFAULT ''::character varying NOT NULL,
+    logs_length integer DEFAULT 0 NOT NULL,
+    logs_overflowed boolean DEFAULT false NOT NULL,
+    started_at timestamp with time zone,
+    ready_at timestamp with time zone,
+    subsystems workspace_agent_subsystem[] DEFAULT '{}'::workspace_agent_subsystem[],
+    display_apps display_app[] DEFAULT '{vscode,vscode_insiders,web_terminal,ssh_helper,port_forwarding_helper}'::display_app[],
+    api_version text DEFAULT ''::text NOT NULL,
+    display_order integer DEFAULT 0 NOT NULL,
+    parent_id uuid,
+    api_key_scope agent_key_scope_enum DEFAULT 'all'::agent_key_scope_enum NOT NULL,
+    deleted boolean DEFAULT false NOT NULL,
+    CONSTRAINT max_logs_length CHECK ((logs_length <= 1048576)),
+    CONSTRAINT subsystems_not_none CHECK ((NOT ('none'::workspace_agent_subsystem = ANY (subsystems))))
+);
+
+COMMENT ON COLUMN workspace_agents.version IS 'Version tracks the version of the currently running workspace agent. Workspace agents register their version upon start.';
+
+COMMENT ON COLUMN workspace_agents.connection_timeout_seconds IS 'Connection timeout in seconds, 0 means disabled.';
+
+COMMENT ON COLUMN workspace_agents.troubleshooting_url IS 'URL for troubleshooting the agent.';
+
+COMMENT ON COLUMN workspace_agents.motd_file IS 'Path to file inside workspace containing the message of the day (MOTD) to show to the user when logging in via SSH.';
+
+COMMENT ON COLUMN workspace_agents.lifecycle_state IS 'The current lifecycle state reported by the workspace agent.';
+
+COMMENT ON COLUMN workspace_agents.expanded_directory IS 'The resolved path of a user-specified directory. e.g. ~/coder -> /home/coder/coder';
+
+COMMENT ON COLUMN workspace_agents.logs_length IS 'Total length of startup logs';
+
+COMMENT ON COLUMN workspace_agents.logs_overflowed IS 'Whether the startup logs overflowed in length';
+
+COMMENT ON COLUMN workspace_agents.started_at IS 'The time the agent entered the starting lifecycle state';
+
+COMMENT ON COLUMN workspace_agents.ready_at IS 'The time the agent entered the ready or start_error lifecycle state';
+
+COMMENT ON COLUMN workspace_agents.display_order IS 'Specifies the order in which to display agents in user interfaces.';
+
+COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''all'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';
+
+COMMENT ON COLUMN workspace_agents.deleted IS 'Indicates whether or not the agent has been deleted. This is currently only applicable to sub agents.';
+
+CREATE TABLE workspace_apps (
+    id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    agent_id uuid NOT NULL,
+    display_name character varying(64) NOT NULL,
+    icon character varying(256) NOT NULL,
+    command character varying(65534),
+    url character varying(65534),
+    healthcheck_url text DEFAULT ''::text NOT NULL,
+    healthcheck_interval integer DEFAULT 0 NOT NULL,
+    healthcheck_threshold integer DEFAULT 0 NOT NULL,
+    health workspace_app_health DEFAULT 'disabled'::workspace_app_health NOT NULL,
+    subdomain boolean DEFAULT false NOT NULL,
+    sharing_level app_sharing_level DEFAULT 'owner'::app_sharing_level NOT NULL,
+    slug text NOT NULL,
+    external boolean DEFAULT false NOT NULL,
+    display_order integer DEFAULT 0 NOT NULL,
+    hidden boolean DEFAULT false NOT NULL,
+    open_in workspace_app_open_in DEFAULT 'slim-window'::workspace_app_open_in NOT NULL,
+    display_group text,
+    tooltip character varying(2048) DEFAULT ''::character varying NOT NULL
+);
+
+COMMENT ON COLUMN workspace_apps.display_order IS 'Specifies the order in which to display agent app in user interfaces.';
+
+COMMENT ON COLUMN workspace_apps.hidden IS 'Determines if the app is not shown in user interfaces.';
+
+COMMENT ON COLUMN workspace_apps.tooltip IS 'Markdown text that is displayed when hovering over workspace apps.';
+
+CREATE TABLE workspace_builds (
+    id uuid NOT NULL,
+    created_at timestamp with time zone NOT NULL,
+    updated_at timestamp with time zone NOT NULL,
+    workspace_id uuid NOT NULL,
+    template_version_id uuid NOT NULL,
+    build_number integer NOT NULL,
+    transition workspace_transition NOT NULL,
+    initiator_id uuid NOT NULL,
+    provisioner_state bytea,
+    job_id uuid NOT NULL,
+    deadline timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL,
+    reason build_reason DEFAULT 'initiator'::build_reason NOT NULL,
+    daily_cost integer DEFAULT 0 NOT NULL,
+    max_deadline timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL,
+    template_version_preset_id uuid,
+    has_ai_task boolean,
+    ai_task_sidebar_app_id uuid,
+    has_external_agent boolean,
+    CONSTRAINT workspace_builds_ai_task_sidebar_app_id_required CHECK (((((has_ai_task IS NULL) OR (has_ai_task = false)) AND (ai_task_sidebar_app_id IS NULL)) OR ((has_ai_task = true) AND (ai_task_sidebar_app_id IS NOT NULL)))),
+    CONSTRAINT workspace_builds_deadline_below_max_deadline CHECK ((((deadline <> '0001-01-01 00:00:00+00'::timestamp with time zone) AND (deadline <= max_deadline)) OR (max_deadline = '0001-01-01 00:00:00+00'::timestamp with time zone)))
+);
+
+CREATE VIEW tasks_with_status AS
+ SELECT tasks.id,
+    tasks.organization_id,
+    tasks.owner_id,
+    tasks.name,
+    tasks.workspace_id,
+    tasks.template_version_id,
+    tasks.template_parameters,
+    tasks.prompt,
+    tasks.created_at,
+    tasks.deleted_at,
+        CASE
+            WHEN ((tasks.workspace_id IS NULL) OR (latest_build.job_status IS NULL)) THEN 'pending'::task_status
+            WHEN (latest_build.job_status = 'failed'::provisioner_job_status) THEN 'error'::task_status
+            WHEN ((latest_build.transition = ANY (ARRAY['stop'::workspace_transition, 'delete'::workspace_transition])) AND (latest_build.job_status = 'succeeded'::provisioner_job_status)) THEN 'paused'::task_status
+            WHEN ((latest_build.transition = 'start'::workspace_transition) AND (latest_build.job_status = 'pending'::provisioner_job_status)) THEN 'initializing'::task_status
+            WHEN ((latest_build.transition = 'start'::workspace_transition) AND (latest_build.job_status = ANY (ARRAY['running'::provisioner_job_status, 'succeeded'::provisioner_job_status]))) THEN
+            CASE
+                WHEN agent_status."none" THEN 'initializing'::task_status
+                WHEN agent_status.connecting THEN 'initializing'::task_status
+                WHEN agent_status.connected THEN
+                CASE
+                    WHEN app_status.any_unhealthy THEN 'error'::task_status
+                    WHEN app_status.any_initializing THEN 'initializing'::task_status
+                    WHEN app_status.all_healthy_or_disabled THEN 'active'::task_status
+                    ELSE 'unknown'::task_status
+                END
+                ELSE 'unknown'::task_status
+            END
+            ELSE 'unknown'::task_status
+        END AS status
+   FROM ((((tasks
+     LEFT JOIN LATERAL ( SELECT task_app_1.workspace_build_number,
+            task_app_1.workspace_agent_id,
+            task_app_1.workspace_app_id
+           FROM task_workspace_apps task_app_1
+          WHERE (task_app_1.task_id = tasks.id)
+          ORDER BY task_app_1.workspace_build_number DESC
+         LIMIT 1) task_app ON (true))
+     LEFT JOIN LATERAL ( SELECT workspace_build.transition,
+            provisioner_job.job_status,
+            workspace_build.job_id
+           FROM (workspace_builds workspace_build
+             JOIN provisioner_jobs provisioner_job ON ((provisioner_job.id = workspace_build.job_id)))
+          WHERE ((workspace_build.workspace_id = tasks.workspace_id) AND (workspace_build.build_number = task_app.workspace_build_number))) latest_build ON (true))
+     CROSS JOIN LATERAL ( SELECT (count(*) = 0) AS "none",
+            bool_or((workspace_agent.lifecycle_state = ANY (ARRAY['created'::workspace_agent_lifecycle_state, 'starting'::workspace_agent_lifecycle_state]))) AS connecting,
+            bool_and((workspace_agent.lifecycle_state = 'ready'::workspace_agent_lifecycle_state)) AS connected
+           FROM workspace_agents workspace_agent
+          WHERE (workspace_agent.id = task_app.workspace_agent_id)) agent_status)
+     CROSS JOIN LATERAL ( SELECT bool_or((workspace_app.health = 'unhealthy'::workspace_app_health)) AS any_unhealthy,
+            bool_or((workspace_app.health = 'initializing'::workspace_app_health)) AS any_initializing,
+            bool_and((workspace_app.health = ANY (ARRAY['healthy'::workspace_app_health, 'disabled'::workspace_app_health]))) AS all_healthy_or_disabled
+           FROM workspace_apps workspace_app
+          WHERE (workspace_app.id = task_app.workspace_app_id)) app_status)
+  WHERE (tasks.deleted_at IS NULL);
+
 CREATE TABLE telemetry_items (
     key text NOT NULL,
     value text NOT NULL,
@@ -2377,71 +2560,6 @@ CREATE TABLE workspace_agent_volume_resource_monitors (
     debounced_until timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL
 );
 
-CREATE TABLE workspace_agents (
-    id uuid NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL,
-    name character varying(64) NOT NULL,
-    first_connected_at timestamp with time zone,
-    last_connected_at timestamp with time zone,
-    disconnected_at timestamp with time zone,
-    resource_id uuid NOT NULL,
-    auth_token uuid NOT NULL,
-    auth_instance_id character varying,
-    architecture character varying(64) NOT NULL,
-    environment_variables jsonb,
-    operating_system character varying(64) NOT NULL,
-    instance_metadata jsonb,
-    resource_metadata jsonb,
-    directory character varying(4096) DEFAULT ''::character varying NOT NULL,
-    version text DEFAULT ''::text NOT NULL,
-    last_connected_replica_id uuid,
-    connection_timeout_seconds integer DEFAULT 0 NOT NULL,
-    troubleshooting_url text DEFAULT ''::text NOT NULL,
-    motd_file text DEFAULT ''::text NOT NULL,
-    lifecycle_state workspace_agent_lifecycle_state DEFAULT 'created'::workspace_agent_lifecycle_state NOT NULL,
-    expanded_directory character varying(4096) DEFAULT ''::character varying NOT NULL,
-    logs_length integer DEFAULT 0 NOT NULL,
-    logs_overflowed boolean DEFAULT false NOT NULL,
-    started_at timestamp with time zone,
-    ready_at timestamp with time zone,
-    subsystems workspace_agent_subsystem[] DEFAULT '{}'::workspace_agent_subsystem[],
-    display_apps display_app[] DEFAULT '{vscode,vscode_insiders,web_terminal,ssh_helper,port_forwarding_helper}'::display_app[],
-    api_version text DEFAULT ''::text NOT NULL,
-    display_order integer DEFAULT 0 NOT NULL,
-    parent_id uuid,
-    api_key_scope agent_key_scope_enum DEFAULT 'all'::agent_key_scope_enum NOT NULL,
-    deleted boolean DEFAULT false NOT NULL,
-    CONSTRAINT max_logs_length CHECK ((logs_length <= 1048576)),
-    CONSTRAINT subsystems_not_none CHECK ((NOT ('none'::workspace_agent_subsystem = ANY (subsystems))))
-);
-
-COMMENT ON COLUMN workspace_agents.version IS 'Version tracks the version of the currently running workspace agent. Workspace agents register their version upon start.';
-
-COMMENT ON COLUMN workspace_agents.connection_timeout_seconds IS 'Connection timeout in seconds, 0 means disabled.';
-
-COMMENT ON COLUMN workspace_agents.troubleshooting_url IS 'URL for troubleshooting the agent.';
-
-COMMENT ON COLUMN workspace_agents.motd_file IS 'Path to file inside workspace containing the message of the day (MOTD) to show to the user when logging in via SSH.';
-
-COMMENT ON COLUMN workspace_agents.lifecycle_state IS 'The current lifecycle state reported by the workspace agent.';
-
-COMMENT ON COLUMN workspace_agents.expanded_directory IS 'The resolved path of a user-specified directory. e.g. ~/coder -> /home/coder/coder';
-
-COMMENT ON COLUMN workspace_agents.logs_length IS 'Total length of startup logs';
-
-COMMENT ON COLUMN workspace_agents.logs_overflowed IS 'Whether the startup logs overflowed in length';
-
-COMMENT ON COLUMN workspace_agents.started_at IS 'The time the agent entered the starting lifecycle state';
-
-COMMENT ON COLUMN workspace_agents.ready_at IS 'The time the agent entered the ready or start_error lifecycle state';
-
-COMMENT ON COLUMN workspace_agents.display_order IS 'Specifies the order in which to display agents in user interfaces.';
-
-COMMENT ON COLUMN workspace_agents.api_key_scope IS 'Defines the scope of the API key associated with the agent. ''all'' allows access to everything, ''no_user_data'' restricts it to exclude user data.';
-
-COMMENT ON COLUMN workspace_agents.deleted IS 'Indicates whether or not the agent has been deleted. This is currently only applicable to sub agents.';
-
 CREATE UNLOGGED TABLE workspace_app_audit_sessions (
     agent_id uuid NOT NULL,
     app_id uuid NOT NULL,
@@ -2530,35 +2648,6 @@ CREATE TABLE workspace_app_statuses (
     uri text
 );
 
-CREATE TABLE workspace_apps (
-    id uuid NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    agent_id uuid NOT NULL,
-    display_name character varying(64) NOT NULL,
-    icon character varying(256) NOT NULL,
-    command character varying(65534),
-    url character varying(65534),
-    healthcheck_url text DEFAULT ''::text NOT NULL,
-    healthcheck_interval integer DEFAULT 0 NOT NULL,
-    healthcheck_threshold integer DEFAULT 0 NOT NULL,
-    health workspace_app_health DEFAULT 'disabled'::workspace_app_health NOT NULL,
-    subdomain boolean DEFAULT false NOT NULL,
-    sharing_level app_sharing_level DEFAULT 'owner'::app_sharing_level NOT NULL,
-    slug text NOT NULL,
-    external boolean DEFAULT false NOT NULL,
-    display_order integer DEFAULT 0 NOT NULL,
-    hidden boolean DEFAULT false NOT NULL,
-    open_in workspace_app_open_in DEFAULT 'slim-window'::workspace_app_open_in NOT NULL,
-    display_group text,
-    tooltip character varying(2048) DEFAULT ''::character varying NOT NULL
-);
-
-COMMENT ON COLUMN workspace_apps.display_order IS 'Specifies the order in which to display agent app in user interfaces.';
-
-COMMENT ON COLUMN workspace_apps.hidden IS 'Determines if the app is not shown in user interfaces.';
-
-COMMENT ON COLUMN workspace_apps.tooltip IS 'Markdown text that is displayed when hovering over workspace apps.';
-
 CREATE TABLE workspace_build_parameters (
     workspace_build_id uuid NOT NULL,
     name text NOT NULL,
@@ -2569,29 +2658,6 @@ COMMENT ON COLUMN workspace_build_parameters.name IS 'Parameter name';
 
 COMMENT ON COLUMN workspace_build_parameters.value IS 'Parameter value';
 
-CREATE TABLE workspace_builds (
-    id uuid NOT NULL,
-    created_at timestamp with time zone NOT NULL,
-    updated_at timestamp with time zone NOT NULL,
-    workspace_id uuid NOT NULL,
-    template_version_id uuid NOT NULL,
-    build_number integer NOT NULL,
-    transition workspace_transition NOT NULL,
-    initiator_id uuid NOT NULL,
-    provisioner_state bytea,
-    job_id uuid NOT NULL,
-    deadline timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL,
-    reason build_reason DEFAULT 'initiator'::build_reason NOT NULL,
-    daily_cost integer DEFAULT 0 NOT NULL,
-    max_deadline timestamp with time zone DEFAULT '0001-01-01 00:00:00+00'::timestamp with time zone NOT NULL,
-    template_version_preset_id uuid,
-    has_ai_task boolean,
-    ai_task_sidebar_app_id uuid,
-    has_external_agent boolean,
-    CONSTRAINT workspace_builds_ai_task_sidebar_app_id_required CHECK (((((has_ai_task IS NULL) OR (has_ai_task = false)) AND (ai_task_sidebar_app_id IS NULL)) OR ((has_ai_task = true) AND (ai_task_sidebar_app_id IS NOT NULL)))),
-    CONSTRAINT workspace_builds_deadline_below_max_deadline CHECK ((((deadline <> '0001-01-01 00:00:00+00'::timestamp with time zone) AND (deadline <= max_deadline)) OR (max_deadline = '0001-01-01 00:00:00+00'::timestamp with time zone)))
-);
-
 CREATE VIEW workspace_build_with_user AS
  SELECT workspace_builds.id,
     workspace_builds.created_at,
@@ -3007,6 +3073,9 @@ ALTER TABLE ONLY tailnet_peers
 ALTER TABLE ONLY tailnet_tunnels
     ADD CONSTRAINT tailnet_tunnels_pkey PRIMARY KEY (coordinator_id, src_id, dst_id);
 
+ALTER TABLE ONLY task_workspace_apps
+    ADD CONSTRAINT task_workspace_apps_pkey PRIMARY KEY (task_id, workspace_build_number);
+
 ALTER TABLE ONLY tasks
     ADD CONSTRAINT tasks_pkey PRIMARY KEY (id);
 
@@ -3272,6 +3341,12 @@ COMMENT ON INDEX provisioner_jobs_worker_id_organization_id_completed_at_idx IS
 
 CREATE UNIQUE INDEX provisioner_keys_organization_id_name_idx ON provisioner_keys USING btree (organization_id, lower((name)::text));
 
+CREATE INDEX tasks_organization_id_idx ON tasks USING btree (organization_id);
+
+CREATE INDEX tasks_owner_id_idx ON tasks USING btree (owner_id);
+
+CREATE INDEX tasks_workspace_id_idx ON tasks USING btree (workspace_id);
+
 CREATE INDEX template_usage_stats_start_time_idx ON template_usage_stats USING btree (start_time DESC);
 
 COMMENT ON INDEX template_usage_stats_start_time_idx IS 'Index for querying MAX(start_time).';
@@ -3552,9 +3627,6 @@ ALTER TABLE ONLY task_workspace_apps
 ALTER TABLE ONLY task_workspace_apps
     ADD CONSTRAINT task_workspace_apps_workspace_app_id_fkey FOREIGN KEY (workspace_app_id) REFERENCES workspace_apps(id) ON DELETE CASCADE;
 
-ALTER TABLE ONLY task_workspace_apps
-    ADD CONSTRAINT task_workspace_apps_workspace_build_id_fkey FOREIGN KEY (workspace_build_id) REFERENCES workspace_builds(id) ON DELETE CASCADE;
-
 ALTER TABLE ONLY tasks
     ADD CONSTRAINT tasks_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
 
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
index 8497ac2bcd4b4..4c629797d11d7 100644
--- a/coderd/database/foreign_key_constraint.go
+++ b/coderd/database/foreign_key_constraint.go
@@ -48,7 +48,6 @@ const (
 	ForeignKeyTaskWorkspaceAppsTaskID                             ForeignKeyConstraint = "task_workspace_apps_task_id_fkey"                                // ALTER TABLE ONLY task_workspace_apps ADD CONSTRAINT task_workspace_apps_task_id_fkey FOREIGN KEY (task_id) REFERENCES tasks(id) ON DELETE CASCADE;
 	ForeignKeyTaskWorkspaceAppsWorkspaceAgentID                   ForeignKeyConstraint = "task_workspace_apps_workspace_agent_id_fkey"                     // ALTER TABLE ONLY task_workspace_apps ADD CONSTRAINT task_workspace_apps_workspace_agent_id_fkey FOREIGN KEY (workspace_agent_id) REFERENCES workspace_agents(id) ON DELETE CASCADE;
 	ForeignKeyTaskWorkspaceAppsWorkspaceAppID                     ForeignKeyConstraint = "task_workspace_apps_workspace_app_id_fkey"                       // ALTER TABLE ONLY task_workspace_apps ADD CONSTRAINT task_workspace_apps_workspace_app_id_fkey FOREIGN KEY (workspace_app_id) REFERENCES workspace_apps(id) ON DELETE CASCADE;
-	ForeignKeyTaskWorkspaceAppsWorkspaceBuildID                   ForeignKeyConstraint = "task_workspace_apps_workspace_build_id_fkey"                     // ALTER TABLE ONLY task_workspace_apps ADD CONSTRAINT task_workspace_apps_workspace_build_id_fkey FOREIGN KEY (workspace_build_id) REFERENCES workspace_builds(id) ON DELETE CASCADE;
 	ForeignKeyTasksOrganizationID                                 ForeignKeyConstraint = "tasks_organization_id_fkey"                                      // ALTER TABLE ONLY tasks ADD CONSTRAINT tasks_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
 	ForeignKeyTasksOwnerID                                        ForeignKeyConstraint = "tasks_owner_id_fkey"                                             // ALTER TABLE ONLY tasks ADD CONSTRAINT tasks_owner_id_fkey FOREIGN KEY (owner_id) REFERENCES users(id) ON DELETE CASCADE;
 	ForeignKeyTasksTemplateVersionID                              ForeignKeyConstraint = "tasks_template_version_id_fkey"                                  // ALTER TABLE ONLY tasks ADD CONSTRAINT tasks_template_version_id_fkey FOREIGN KEY (template_version_id) REFERENCES template_versions(id) ON DELETE CASCADE;
diff --git a/coderd/database/migrations/000379_create_tasks_with_status_view.down.sql b/coderd/database/migrations/000379_create_tasks_with_status_view.down.sql
new file mode 100644
index 0000000000000..45754139a7940
--- /dev/null
+++ b/coderd/database/migrations/000379_create_tasks_with_status_view.down.sql
@@ -0,0 +1,33 @@
+DROP VIEW IF EXISTS tasks_with_status;
+DROP TYPE IF EXISTS task_status;
+
+DROP INDEX IF EXISTS tasks_organization_id_idx;
+DROP INDEX IF EXISTS tasks_owner_id_idx;
+DROP INDEX IF EXISTS tasks_workspace_id_idx;
+
+ALTER TABLE task_workspace_apps
+	DROP CONSTRAINT IF EXISTS task_workspace_apps_pkey;
+
+-- Add back workspace_build_id column.
+ALTER TABLE task_workspace_apps
+	ADD COLUMN workspace_build_id UUID;
+
+-- Try to populate workspace_build_id from workspace_builds.
+UPDATE task_workspace_apps
+SET workspace_build_id = workspace_builds.id
+FROM workspace_builds
+WHERE workspace_builds.build_number = task_workspace_apps.workspace_build_number
+	AND workspace_builds.workspace_id IN (
+		SELECT workspace_id FROM tasks WHERE tasks.id = task_workspace_apps.task_id
+	);
+
+-- Remove rows that couldn't be restored.
+DELETE FROM task_workspace_apps
+WHERE workspace_build_id IS NULL;
+
+-- Restore original schema.
+ALTER TABLE task_workspace_apps
+	DROP COLUMN workspace_build_number,
+	ALTER COLUMN workspace_build_id SET NOT NULL,
+	ALTER COLUMN workspace_agent_id SET NOT NULL,
+	ALTER COLUMN workspace_app_id SET NOT NULL;
diff --git a/coderd/database/migrations/000379_create_tasks_with_status_view.up.sql b/coderd/database/migrations/000379_create_tasks_with_status_view.up.sql
new file mode 100644
index 0000000000000..7af0e71482b42
--- /dev/null
+++ b/coderd/database/migrations/000379_create_tasks_with_status_view.up.sql
@@ -0,0 +1,104 @@
+-- Replace workspace_build_id with workspace_build_number.
+ALTER TABLE task_workspace_apps
+	ADD COLUMN workspace_build_number INTEGER;
+
+-- Try to populate workspace_build_number from workspace_builds.
+UPDATE task_workspace_apps
+SET workspace_build_number = workspace_builds.build_number
+FROM workspace_builds
+WHERE workspace_builds.id = task_workspace_apps.workspace_build_id;
+
+-- Remove rows that couldn't be migrated.
+DELETE FROM task_workspace_apps
+WHERE workspace_build_number IS NULL;
+
+ALTER TABLE task_workspace_apps
+	DROP COLUMN workspace_build_id,
+	ALTER COLUMN workspace_build_number SET NOT NULL,
+	ALTER COLUMN workspace_agent_id DROP NOT NULL,
+	ALTER COLUMN workspace_app_id DROP NOT NULL,
+	ADD CONSTRAINT task_workspace_apps_pkey PRIMARY KEY (task_id, workspace_build_number);
+
+-- Add indexes for common joins or filters.
+CREATE INDEX IF NOT EXISTS tasks_workspace_id_idx ON tasks (workspace_id);
+CREATE INDEX IF NOT EXISTS tasks_owner_id_idx ON tasks (owner_id);
+CREATE INDEX IF NOT EXISTS tasks_organization_id_idx ON tasks (organization_id);
+
+CREATE TYPE task_status AS ENUM (
+	'pending',
+	'initializing',
+	'active',
+	'paused',
+	'unknown',
+	'error'
+);
+
+CREATE VIEW
+	tasks_with_status
+AS
+	SELECT
+		tasks.*,
+		CASE
+			WHEN tasks.workspace_id IS NULL OR latest_build.job_status IS NULL THEN 'pending'::task_status
+
+			WHEN latest_build.job_status = 'failed' THEN 'error'::task_status
+
+			WHEN latest_build.transition IN ('stop', 'delete')
+				AND latest_build.job_status = 'succeeded' THEN 'paused'::task_status
+
+			WHEN latest_build.transition = 'start'
+				AND latest_build.job_status = 'pending' THEN 'initializing'::task_status
+
+			WHEN latest_build.transition = 'start' AND latest_build.job_status IN ('running', 'succeeded') THEN
+				CASE
+					WHEN agent_status.none THEN 'initializing'::task_status
+					WHEN agent_status.connecting THEN 'initializing'::task_status
+					WHEN agent_status.connected THEN
+						CASE
+							WHEN app_status.any_unhealthy THEN 'error'::task_status
+							WHEN app_status.any_initializing THEN 'initializing'::task_status
+							WHEN app_status.all_healthy_or_disabled THEN 'active'::task_status
+							ELSE 'unknown'::task_status
+						END
+					ELSE 'unknown'::task_status
+				END
+
+			ELSE 'unknown'::task_status
+		END AS status
+	FROM
+		tasks
+	LEFT JOIN LATERAL (
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps task_app
+		WHERE task_id = tasks.id
+		ORDER BY workspace_build_number DESC
+		LIMIT 1
+	) task_app ON TRUE
+	LEFT JOIN LATERAL (
+		SELECT
+			workspace_build.transition,
+			provisioner_job.job_status,
+			workspace_build.job_id
+		FROM workspace_builds workspace_build
+		JOIN provisioner_jobs provisioner_job ON provisioner_job.id = workspace_build.job_id
+		WHERE workspace_build.workspace_id = tasks.workspace_id
+			AND workspace_build.build_number = task_app.workspace_build_number
+	) latest_build ON TRUE
+	CROSS JOIN LATERAL (
+		SELECT
+			COUNT(*) = 0 AS none,
+			bool_or(workspace_agent.lifecycle_state IN ('created', 'starting')) AS connecting,
+			bool_and(workspace_agent.lifecycle_state = 'ready') AS connected
+		FROM workspace_agents workspace_agent
+		WHERE workspace_agent.id = task_app.workspace_agent_id
+	) agent_status
+	CROSS JOIN LATERAL (
+		SELECT
+			bool_or(workspace_app.health = 'unhealthy') AS any_unhealthy,
+			bool_or(workspace_app.health = 'initializing') AS any_initializing,
+			bool_and(workspace_app.health IN ('healthy', 'disabled')) AS all_healthy_or_disabled
+		FROM workspace_apps workspace_app
+		WHERE workspace_app.id = task_app.workspace_app_id
+	) app_status
+	WHERE
+		tasks.deleted_at IS NULL;
diff --git a/coderd/database/migrations/testdata/fixtures/000379_create_tasks_with_status_view.up.sql b/coderd/database/migrations/testdata/fixtures/000379_create_tasks_with_status_view.up.sql
new file mode 100644
index 0000000000000..c2d1bf11475b8
--- /dev/null
+++ b/coderd/database/migrations/testdata/fixtures/000379_create_tasks_with_status_view.up.sql
@@ -0,0 +1,6 @@
+INSERT INTO public.task_workspace_apps VALUES (
+    'f5a1c3e4-8b2d-4f6a-9d7e-2a8b5c9e1f3d', -- task_id
+    NULL,                                   -- workspace_agent_id
+    NULL,                                   -- workspace_app_id
+    99                                      -- workspace_build_number
+) ON CONFLICT DO NOTHING;
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
index 6254125cc1004..a50024f5f7580 100644
--- a/coderd/database/modelmethods.go
+++ b/coderd/database/modelmethods.go
@@ -139,6 +139,13 @@ func (t Task) RBACObject() rbac.Object {
 		InOrg(t.OrganizationID)
 }
 
+func (t TaskTable) RBACObject() rbac.Object {
+	return rbac.ResourceTask.
+		WithID(t.ID).
+		WithOwner(t.OwnerID.String()).
+		InOrg(t.OrganizationID)
+}
+
 func (s APIKeyScope) ToRBAC() rbac.ScopeName {
 	switch s {
 	case ApiKeyScopeCoderAll:
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 4f4632569ed81..8f62f1a3074f8 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -2885,6 +2885,76 @@ func AllTailnetStatusValues() []TailnetStatus {
 	}
 }
 
+type TaskStatus string
+
+const (
+	TaskStatusPending      TaskStatus = "pending"
+	TaskStatusInitializing TaskStatus = "initializing"
+	TaskStatusActive       TaskStatus = "active"
+	TaskStatusPaused       TaskStatus = "paused"
+	TaskStatusUnknown      TaskStatus = "unknown"
+	TaskStatusError        TaskStatus = "error"
+)
+
+func (e *TaskStatus) Scan(src interface{}) error {
+	switch s := src.(type) {
+	case []byte:
+		*e = TaskStatus(s)
+	case string:
+		*e = TaskStatus(s)
+	default:
+		return fmt.Errorf("unsupported scan type for TaskStatus: %T", src)
+	}
+	return nil
+}
+
+type NullTaskStatus struct {
+	TaskStatus TaskStatus `json:"task_status"`
+	Valid      bool       `json:"valid"` // Valid is true if TaskStatus is not NULL
+}
+
+// Scan implements the Scanner interface.
+func (ns *NullTaskStatus) Scan(value interface{}) error {
+	if value == nil {
+		ns.TaskStatus, ns.Valid = "", false
+		return nil
+	}
+	ns.Valid = true
+	return ns.TaskStatus.Scan(value)
+}
+
+// Value implements the driver Valuer interface.
+func (ns NullTaskStatus) Value() (driver.Value, error) {
+	if !ns.Valid {
+		return nil, nil
+	}
+	return string(ns.TaskStatus), nil
+}
+
+func (e TaskStatus) Valid() bool {
+	switch e {
+	case TaskStatusPending,
+		TaskStatusInitializing,
+		TaskStatusActive,
+		TaskStatusPaused,
+		TaskStatusUnknown,
+		TaskStatusError:
+		return true
+	}
+	return false
+}
+
+func AllTaskStatusValues() []TaskStatus {
+	return []TaskStatus{
+		TaskStatusPending,
+		TaskStatusInitializing,
+		TaskStatusActive,
+		TaskStatusPaused,
+		TaskStatusUnknown,
+		TaskStatusError,
+	}
+}
+
 // Defines the users status: active, dormant, or suspended.
 type UserStatus string
 
@@ -4137,13 +4207,27 @@ type Task struct {
 	Prompt             string          `db:"prompt" json:"prompt"`
 	CreatedAt          time.Time       `db:"created_at" json:"created_at"`
 	DeletedAt          sql.NullTime    `db:"deleted_at" json:"deleted_at"`
+	Status             TaskStatus      `db:"status" json:"status"`
+}
+
+type TaskTable struct {
+	ID                 uuid.UUID       `db:"id" json:"id"`
+	OrganizationID     uuid.UUID       `db:"organization_id" json:"organization_id"`
+	OwnerID            uuid.UUID       `db:"owner_id" json:"owner_id"`
+	Name               string          `db:"name" json:"name"`
+	WorkspaceID        uuid.NullUUID   `db:"workspace_id" json:"workspace_id"`
+	TemplateVersionID  uuid.UUID       `db:"template_version_id" json:"template_version_id"`
+	TemplateParameters json.RawMessage `db:"template_parameters" json:"template_parameters"`
+	Prompt             string          `db:"prompt" json:"prompt"`
+	CreatedAt          time.Time       `db:"created_at" json:"created_at"`
+	DeletedAt          sql.NullTime    `db:"deleted_at" json:"deleted_at"`
 }
 
 type TaskWorkspaceApp struct {
-	TaskID           uuid.UUID `db:"task_id" json:"task_id"`
-	WorkspaceBuildID uuid.UUID `db:"workspace_build_id" json:"workspace_build_id"`
-	WorkspaceAgentID uuid.UUID `db:"workspace_agent_id" json:"workspace_agent_id"`
-	WorkspaceAppID   uuid.UUID `db:"workspace_app_id" json:"workspace_app_id"`
+	TaskID               uuid.UUID     `db:"task_id" json:"task_id"`
+	WorkspaceAgentID     uuid.NullUUID `db:"workspace_agent_id" json:"workspace_agent_id"`
+	WorkspaceAppID       uuid.NullUUID `db:"workspace_app_id" json:"workspace_app_id"`
+	WorkspaceBuildNumber int32         `db:"workspace_build_number" json:"workspace_build_number"`
 }
 
 type TelemetryItem struct {
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 27e828e45a950..48bd064e20f93 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -331,6 +331,8 @@ type sqlcQuerier interface {
 	GetTailnetPeers(ctx context.Context, id uuid.UUID) ([]TailnetPeer, error)
 	GetTailnetTunnelPeerBindings(ctx context.Context, srcID uuid.UUID) ([]GetTailnetTunnelPeerBindingsRow, error)
 	GetTailnetTunnelPeerIDs(ctx context.Context, srcID uuid.UUID) ([]GetTailnetTunnelPeerIDsRow, error)
+	GetTaskByID(ctx context.Context, id uuid.UUID) (Task, error)
+	GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (Task, error)
 	GetTelemetryItem(ctx context.Context, key string) (TelemetryItem, error)
 	GetTelemetryItems(ctx context.Context) ([]TelemetryItem, error)
 	// GetTemplateAppInsights returns the aggregate usage of each app in a given
@@ -550,6 +552,7 @@ type sqlcQuerier interface {
 	InsertProvisionerJobTimings(ctx context.Context, arg InsertProvisionerJobTimingsParams) ([]ProvisionerJobTiming, error)
 	InsertProvisionerKey(ctx context.Context, arg InsertProvisionerKeyParams) (ProvisionerKey, error)
 	InsertReplica(ctx context.Context, arg InsertReplicaParams) (Replica, error)
+	InsertTask(ctx context.Context, arg InsertTaskParams) (TaskTable, error)
 	InsertTelemetryItemIfNotExists(ctx context.Context, arg InsertTelemetryItemIfNotExistsParams) error
 	InsertTemplate(ctx context.Context, arg InsertTemplateParams) error
 	InsertTemplateVersion(ctx context.Context, arg InsertTemplateVersionParams) error
@@ -729,6 +732,7 @@ type sqlcQuerier interface {
 	UpsertTailnetCoordinator(ctx context.Context, id uuid.UUID) (TailnetCoordinator, error)
 	UpsertTailnetPeer(ctx context.Context, arg UpsertTailnetPeerParams) (TailnetPeer, error)
 	UpsertTailnetTunnel(ctx context.Context, arg UpsertTailnetTunnelParams) (TailnetTunnel, error)
+	UpsertTaskWorkspaceApp(ctx context.Context, arg UpsertTaskWorkspaceAppParams) (TaskWorkspaceApp, error)
 	UpsertTelemetryItem(ctx context.Context, arg UpsertTelemetryItemParams) error
 	// This query aggregates the workspace_agent_stats and workspace_app_stats data
 	// into a single table for efficient storage and querying. Half-hour buckets are
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index c7daaaed356d3..1409a079f584d 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -6653,6 +6653,458 @@ func TestGetLatestWorkspaceBuildsByWorkspaceIDs(t *testing.T) {
 	}
 }
 
+func TestTasksWithStatusView(t *testing.T) {
+	t.Parallel()
+
+	createProvisionerJob := func(t *testing.T, db database.Store, org database.Organization, user database.User, buildStatus database.ProvisionerJobStatus) database.ProvisionerJob {
+		t.Helper()
+
+		var jobParams database.ProvisionerJob
+
+		switch buildStatus {
+		case database.ProvisionerJobStatusPending:
+			jobParams = database.ProvisionerJob{
+				OrganizationID: org.ID,
+				Type:           database.ProvisionerJobTypeWorkspaceBuild,
+				InitiatorID:    user.ID,
+			}
+		case database.ProvisionerJobStatusRunning:
+			jobParams = database.ProvisionerJob{
+				OrganizationID: org.ID,
+				Type:           database.ProvisionerJobTypeWorkspaceBuild,
+				InitiatorID:    user.ID,
+				StartedAt:      sql.NullTime{Valid: true, Time: dbtime.Now()},
+			}
+		case database.ProvisionerJobStatusFailed:
+			jobParams = database.ProvisionerJob{
+				OrganizationID: org.ID,
+				Type:           database.ProvisionerJobTypeWorkspaceBuild,
+				InitiatorID:    user.ID,
+				StartedAt:      sql.NullTime{Valid: true, Time: dbtime.Now()},
+				CompletedAt:    sql.NullTime{Valid: true, Time: dbtime.Now()},
+				Error:          sql.NullString{Valid: true, String: "job failed"},
+			}
+		case database.ProvisionerJobStatusSucceeded:
+			jobParams = database.ProvisionerJob{
+				OrganizationID: org.ID,
+				Type:           database.ProvisionerJobTypeWorkspaceBuild,
+				InitiatorID:    user.ID,
+				StartedAt:      sql.NullTime{Valid: true, Time: dbtime.Now()},
+				CompletedAt:    sql.NullTime{Valid: true, Time: dbtime.Now()},
+			}
+		default:
+			t.Errorf("invalid build status: %v", buildStatus)
+		}
+
+		return dbgen.ProvisionerJob(t, db, nil, jobParams)
+	}
+
+	createTask := func(
+		ctx context.Context,
+		t *testing.T,
+		db database.Store,
+		org database.Organization,
+		user database.User,
+		buildStatus database.ProvisionerJobStatus,
+		buildTransition database.WorkspaceTransition,
+		agentState database.WorkspaceAgentLifecycleState,
+		appHealths []database.WorkspaceAppHealth,
+	) database.TaskTable {
+		t.Helper()
+
+		template := dbgen.Template(t, db, database.Template{
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+		})
+		templateVersion := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			TemplateID:     uuid.NullUUID{UUID: template.ID, Valid: true},
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+		})
+
+		if buildStatus == "" {
+			return dbgen.Task(t, db, database.TaskTable{
+				OrganizationID:    org.ID,
+				OwnerID:           user.ID,
+				Name:              "test-task",
+				TemplateVersionID: templateVersion.ID,
+				Prompt:            "Test prompt",
+			})
+		}
+
+		job := createProvisionerJob(t, db, org, user, buildStatus)
+
+		workspace := dbgen.Workspace(t, db, database.WorkspaceTable{
+			OrganizationID: org.ID,
+			TemplateID:     template.ID,
+			OwnerID:        user.ID,
+		})
+		workspaceID := uuid.NullUUID{Valid: true, UUID: workspace.ID}
+
+		task := dbgen.Task(t, db, database.TaskTable{
+			OrganizationID:    org.ID,
+			OwnerID:           user.ID,
+			Name:              "test-task",
+			WorkspaceID:       workspaceID,
+			TemplateVersionID: templateVersion.ID,
+			Prompt:            "Test prompt",
+		})
+
+		workspaceBuild := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+			WorkspaceID:       workspace.ID,
+			TemplateVersionID: templateVersion.ID,
+			BuildNumber:       1,
+			Transition:        buildTransition,
+			InitiatorID:       user.ID,
+			JobID:             job.ID,
+		})
+		workspaceBuildNumber := workspaceBuild.BuildNumber
+
+		_, err := db.UpsertTaskWorkspaceApp(ctx, database.UpsertTaskWorkspaceAppParams{
+			TaskID:               task.ID,
+			WorkspaceBuildNumber: workspaceBuildNumber,
+		})
+		require.NoError(t, err)
+
+		resource := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
+			JobID: job.ID,
+		})
+
+		if agentState != "" {
+			agent := dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{
+				ResourceID: resource.ID,
+			})
+			workspaceAgentID := agent.ID
+
+			_, err := db.UpsertTaskWorkspaceApp(ctx, database.UpsertTaskWorkspaceAppParams{
+				TaskID:               task.ID,
+				WorkspaceBuildNumber: workspaceBuildNumber,
+				WorkspaceAgentID:     uuid.NullUUID{UUID: workspaceAgentID, Valid: true},
+			})
+			require.NoError(t, err)
+
+			err = db.UpdateWorkspaceAgentLifecycleStateByID(ctx, database.UpdateWorkspaceAgentLifecycleStateByIDParams{
+				ID:             agent.ID,
+				LifecycleState: agentState,
+			})
+			require.NoError(t, err)
+
+			for i, health := range appHealths {
+				app := dbgen.WorkspaceApp(t, db, database.WorkspaceApp{
+					AgentID:     workspaceAgentID,
+					Slug:        fmt.Sprintf("test-app-%d", i),
+					DisplayName: fmt.Sprintf("Test App %d", i+1),
+					Health:      health,
+				})
+				if i == 0 {
+					// Assume the first app is the tasks app.
+					_, err := db.UpsertTaskWorkspaceApp(ctx, database.UpsertTaskWorkspaceAppParams{
+						TaskID:               task.ID,
+						WorkspaceBuildNumber: workspaceBuildNumber,
+						WorkspaceAgentID:     uuid.NullUUID{UUID: workspaceAgentID, Valid: true},
+						WorkspaceAppID:       uuid.NullUUID{UUID: app.ID, Valid: true},
+					})
+					require.NoError(t, err)
+				}
+			}
+		}
+
+		return task
+	}
+
+	tests := []struct {
+		name            string
+		buildStatus     database.ProvisionerJobStatus
+		buildTransition database.WorkspaceTransition
+		agentState      database.WorkspaceAgentLifecycleState
+		appHealths      []database.WorkspaceAppHealth
+		expectedStatus  database.TaskStatus
+		description     string
+	}{
+		{
+			name:           "NoWorkspace",
+			expectedStatus: "pending",
+			description:    "Task with no workspace assigned",
+		},
+		{
+			name:            "FailedBuild",
+			buildStatus:     database.ProvisionerJobStatusFailed,
+			buildTransition: database.WorkspaceTransitionStart,
+			expectedStatus:  database.TaskStatusError,
+			description:     "Latest workspace build failed",
+		},
+		{
+			name:            "StoppedWorkspace",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStop,
+			expectedStatus:  database.TaskStatusPaused,
+			description:     "Workspace is stopped",
+		},
+		{
+			name:            "DeletedWorkspace",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionDelete,
+			expectedStatus:  database.TaskStatusPaused,
+			description:     "Workspace is deleted",
+		},
+		{
+			name:            "PendingStart",
+			buildStatus:     database.ProvisionerJobStatusPending,
+			buildTransition: database.WorkspaceTransitionStart,
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Workspace build is starting (pending)",
+		},
+		{
+			name:            "RunningStart",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Workspace build is starting (running)",
+		},
+		{
+			name:            "StartingAgent",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateStarting,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Workspace is running but agent is starting",
+		},
+		{
+			name:            "CreatedAgent",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateCreated,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Workspace is running but agent is created",
+		},
+		{
+			name:            "ReadyAgentInitializingApp",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Agent is ready but app is initializing",
+		},
+		{
+			name:            "ReadyAgentHealthyApp",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy},
+			expectedStatus:  database.TaskStatusActive,
+			description:     "Agent is ready and app is healthy",
+		},
+		{
+			name:            "ReadyAgentDisabledApp",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthDisabled},
+			expectedStatus:  database.TaskStatusActive,
+			description:     "Agent is ready and app health checking is disabled",
+		},
+		{
+			name:            "ReadyAgentUnhealthyApp",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthUnhealthy},
+			expectedStatus:  database.TaskStatusError,
+			description:     "Agent is ready but app is unhealthy",
+		},
+		{
+			name:            "AgentStartTimeout",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateStartTimeout,
+			expectedStatus:  database.TaskStatusUnknown,
+			description:     "Agent start timed out",
+		},
+		{
+			name:            "AgentStartError",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateStartError,
+			expectedStatus:  database.TaskStatusUnknown,
+			description:     "Agent failed to start",
+		},
+		{
+			name:            "AgentShuttingDown",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateShuttingDown,
+			expectedStatus:  database.TaskStatusUnknown,
+			description:     "Agent is shutting down",
+		},
+		{
+			name:            "AgentOff",
+			buildStatus:     database.ProvisionerJobStatusSucceeded,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateOff,
+			expectedStatus:  database.TaskStatusUnknown,
+			description:     "Agent is off",
+		},
+		{
+			name:            "RunningJobReadyAgentHealthyApp",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy},
+			expectedStatus:  database.TaskStatusActive,
+			description:     "Running job with ready agent and healthy app should be active",
+		},
+		{
+			name:            "RunningJobReadyAgentInitializingApp",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Running job with ready agent but initializing app should be initializing",
+		},
+		{
+			name:            "RunningJobReadyAgentUnhealthyApp",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthUnhealthy},
+			expectedStatus:  database.TaskStatusError,
+			description:     "Running job with ready agent but unhealthy app should be error",
+		},
+		{
+			name:            "RunningJobConnectingAgent",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateStarting,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:  database.TaskStatusInitializing,
+			description:     "Running job with connecting agent should be initializing",
+		},
+		{
+			name:            "RunningJobReadyAgentDisabledApp",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthDisabled},
+			expectedStatus:  database.TaskStatusActive,
+			description:     "Running job with ready agent and disabled app health checking should be active",
+		},
+		{
+			name:            "RunningJobReadyAgentHealthyTaskAppUnhealthyOtherAppIsOK",
+			buildStatus:     database.ProvisionerJobStatusRunning,
+			buildTransition: database.WorkspaceTransitionStart,
+			agentState:      database.WorkspaceAgentLifecycleStateReady,
+			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy, database.WorkspaceAppHealthUnhealthy},
+			expectedStatus:  database.TaskStatusActive,
+			description:     "Running job with ready agent and multiple healthy apps should be active",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			db, _ := dbtestutil.NewDB(t)
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			org := dbgen.Organization(t, db, database.Organization{})
+			user := dbgen.User(t, db, database.User{})
+
+			task := createTask(ctx, t, db, org, user, tt.buildStatus, tt.buildTransition, tt.agentState, tt.appHealths)
+
+			got, err := db.GetTaskByID(ctx, task.ID)
+			require.NoError(t, err)
+
+			require.Equal(t, tt.expectedStatus, got.Status, "unexpected status for test case: %s", tt.description)
+		})
+	}
+}
+
+func TestGetTaskByWorkspaceID(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name      string
+		setupTask func(t *testing.T, db database.Store, org database.Organization, user database.User, templateVersion database.TemplateVersion, workspace database.WorkspaceTable)
+		wantErr   bool
+	}{
+		{
+			name:    "task doesn't exist",
+			wantErr: true,
+		},
+		{
+			name: "task with no workspace id",
+			setupTask: func(t *testing.T, db database.Store, org database.Organization, user database.User, templateVersion database.TemplateVersion, workspace database.WorkspaceTable) {
+				dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:    org.ID,
+					OwnerID:           user.ID,
+					Name:              "test-task",
+					TemplateVersionID: templateVersion.ID,
+					Prompt:            "Test prompt",
+				})
+			},
+			wantErr: true,
+		},
+		{
+			name: "task with workspace id",
+			setupTask: func(t *testing.T, db database.Store, org database.Organization, user database.User, templateVersion database.TemplateVersion, workspace database.WorkspaceTable) {
+				workspaceID := uuid.NullUUID{Valid: true, UUID: workspace.ID}
+				dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:    org.ID,
+					OwnerID:           user.ID,
+					Name:              "test-task",
+					WorkspaceID:       workspaceID,
+					TemplateVersionID: templateVersion.ID,
+					Prompt:            "Test prompt",
+				})
+			},
+			wantErr: false,
+		},
+	}
+
+	db, _ := dbtestutil.NewDB(t)
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			org := dbgen.Organization(t, db, database.Organization{})
+			user := dbgen.User(t, db, database.User{})
+			template := dbgen.Template(t, db, database.Template{
+				OrganizationID: org.ID,
+				CreatedBy:      user.ID,
+			})
+			templateVersion := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+				OrganizationID: org.ID,
+				TemplateID:     uuid.NullUUID{Valid: true, UUID: template.ID},
+				CreatedBy:      user.ID,
+			})
+			workspace := dbgen.Workspace(t, db, database.WorkspaceTable{
+				OrganizationID: org.ID,
+				OwnerID:        user.ID,
+				TemplateID:     template.ID,
+			})
+
+			if tt.setupTask != nil {
+				tt.setupTask(t, db, org, user, templateVersion, workspace)
+			}
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			_, err := db.GetTaskByWorkspaceID(ctx, workspace.ID)
+			if tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+			}
+		})
+	}
+}
+
 func TestUsageEventsTrigger(t *testing.T) {
 	t.Parallel()
 
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 605db1cffe777..59ed5699502a7 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12507,6 +12507,134 @@ func (q *sqlQuerier) UpsertTailnetTunnel(ctx context.Context, arg UpsertTailnetT
 	return i, err
 }
 
+const getTaskByID = `-- name: GetTaskByID :one
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status FROM tasks_with_status WHERE id = $1::uuid
+`
+
+func (q *sqlQuerier) GetTaskByID(ctx context.Context, id uuid.UUID) (Task, error) {
+	row := q.db.QueryRowContext(ctx, getTaskByID, id)
+	var i Task
+	err := row.Scan(
+		&i.ID,
+		&i.OrganizationID,
+		&i.OwnerID,
+		&i.Name,
+		&i.WorkspaceID,
+		&i.TemplateVersionID,
+		&i.TemplateParameters,
+		&i.Prompt,
+		&i.CreatedAt,
+		&i.DeletedAt,
+		&i.Status,
+	)
+	return i, err
+}
+
+const getTaskByWorkspaceID = `-- name: GetTaskByWorkspaceID :one
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status FROM tasks_with_status WHERE workspace_id = $1::uuid
+`
+
+func (q *sqlQuerier) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (Task, error) {
+	row := q.db.QueryRowContext(ctx, getTaskByWorkspaceID, workspaceID)
+	var i Task
+	err := row.Scan(
+		&i.ID,
+		&i.OrganizationID,
+		&i.OwnerID,
+		&i.Name,
+		&i.WorkspaceID,
+		&i.TemplateVersionID,
+		&i.TemplateParameters,
+		&i.Prompt,
+		&i.CreatedAt,
+		&i.DeletedAt,
+		&i.Status,
+	)
+	return i, err
+}
+
+const insertTask = `-- name: InsertTask :one
+INSERT INTO tasks
+	(id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at)
+VALUES
+	(gen_random_uuid(), $1, $2, $3, $4, $5, $6, $7, $8)
+RETURNING id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at
+`
+
+type InsertTaskParams struct {
+	OrganizationID     uuid.UUID       `db:"organization_id" json:"organization_id"`
+	OwnerID            uuid.UUID       `db:"owner_id" json:"owner_id"`
+	Name               string          `db:"name" json:"name"`
+	WorkspaceID        uuid.NullUUID   `db:"workspace_id" json:"workspace_id"`
+	TemplateVersionID  uuid.UUID       `db:"template_version_id" json:"template_version_id"`
+	TemplateParameters json.RawMessage `db:"template_parameters" json:"template_parameters"`
+	Prompt             string          `db:"prompt" json:"prompt"`
+	CreatedAt          time.Time       `db:"created_at" json:"created_at"`
+}
+
+func (q *sqlQuerier) InsertTask(ctx context.Context, arg InsertTaskParams) (TaskTable, error) {
+	row := q.db.QueryRowContext(ctx, insertTask,
+		arg.OrganizationID,
+		arg.OwnerID,
+		arg.Name,
+		arg.WorkspaceID,
+		arg.TemplateVersionID,
+		arg.TemplateParameters,
+		arg.Prompt,
+		arg.CreatedAt,
+	)
+	var i TaskTable
+	err := row.Scan(
+		&i.ID,
+		&i.OrganizationID,
+		&i.OwnerID,
+		&i.Name,
+		&i.WorkspaceID,
+		&i.TemplateVersionID,
+		&i.TemplateParameters,
+		&i.Prompt,
+		&i.CreatedAt,
+		&i.DeletedAt,
+	)
+	return i, err
+}
+
+const upsertTaskWorkspaceApp = `-- name: UpsertTaskWorkspaceApp :one
+INSERT INTO task_workspace_apps
+	(task_id, workspace_build_number, workspace_agent_id, workspace_app_id)
+VALUES
+	($1, $2, $3, $4)
+ON CONFLICT (task_id, workspace_build_number)
+DO UPDATE SET
+	workspace_agent_id = EXCLUDED.workspace_agent_id,
+	workspace_app_id = EXCLUDED.workspace_app_id
+RETURNING task_id, workspace_agent_id, workspace_app_id, workspace_build_number
+`
+
+type UpsertTaskWorkspaceAppParams struct {
+	TaskID               uuid.UUID     `db:"task_id" json:"task_id"`
+	WorkspaceBuildNumber int32         `db:"workspace_build_number" json:"workspace_build_number"`
+	WorkspaceAgentID     uuid.NullUUID `db:"workspace_agent_id" json:"workspace_agent_id"`
+	WorkspaceAppID       uuid.NullUUID `db:"workspace_app_id" json:"workspace_app_id"`
+}
+
+func (q *sqlQuerier) UpsertTaskWorkspaceApp(ctx context.Context, arg UpsertTaskWorkspaceAppParams) (TaskWorkspaceApp, error) {
+	row := q.db.QueryRowContext(ctx, upsertTaskWorkspaceApp,
+		arg.TaskID,
+		arg.WorkspaceBuildNumber,
+		arg.WorkspaceAgentID,
+		arg.WorkspaceAppID,
+	)
+	var i TaskWorkspaceApp
+	err := row.Scan(
+		&i.TaskID,
+		&i.WorkspaceAgentID,
+		&i.WorkspaceAppID,
+		&i.WorkspaceBuildNumber,
+	)
+	return i, err
+}
+
 const getTelemetryItem = `-- name: GetTelemetryItem :one
 SELECT key, value, created_at, updated_at FROM telemetry_items WHERE key = $1
 `
diff --git a/coderd/database/queries/tasks.sql b/coderd/database/queries/tasks.sql
new file mode 100644
index 0000000000000..fbdb46d9f9701
--- /dev/null
+++ b/coderd/database/queries/tasks.sql
@@ -0,0 +1,23 @@
+-- name: InsertTask :one
+INSERT INTO tasks
+	(id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at)
+VALUES
+	(gen_random_uuid(), $1, $2, $3, $4, $5, $6, $7, $8)
+RETURNING *;
+
+-- name: UpsertTaskWorkspaceApp :one
+INSERT INTO task_workspace_apps
+	(task_id, workspace_build_number, workspace_agent_id, workspace_app_id)
+VALUES
+	($1, $2, $3, $4)
+ON CONFLICT (task_id, workspace_build_number)
+DO UPDATE SET
+	workspace_agent_id = EXCLUDED.workspace_agent_id,
+	workspace_app_id = EXCLUDED.workspace_app_id
+RETURNING *;
+
+-- name: GetTaskByID :one
+SELECT * FROM tasks_with_status WHERE id = @id::uuid;
+
+-- name: GetTaskByWorkspaceID :one
+SELECT * FROM tasks_with_status WHERE workspace_id = @workspace_id::uuid;
diff --git a/coderd/database/sqlc.yaml b/coderd/database/sqlc.yaml
index 702064ecf260d..d12a7d399c203 100644
--- a/coderd/database/sqlc.yaml
+++ b/coderd/database/sqlc.yaml
@@ -112,6 +112,8 @@ sql:
           workspace_build_with_user: WorkspaceBuild
           workspace: WorkspaceTable
           workspaces_expanded: Workspace
+          task: TaskTable
+          tasks_with_status: Task
           template_version: TemplateVersionTable
           template_version_with_user: TemplateVersion
           api_key: APIKey
diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go
index 36fca8f058135..58206e8ad298a 100644
--- a/coderd/database/unique_constraint.go
+++ b/coderd/database/unique_constraint.go
@@ -59,6 +59,7 @@ const (
 	UniqueTailnetCoordinatorsPkey                             UniqueConstraint = "tailnet_coordinators_pkey"                                       // ALTER TABLE ONLY tailnet_coordinators ADD CONSTRAINT tailnet_coordinators_pkey PRIMARY KEY (id);
 	UniqueTailnetPeersPkey                                    UniqueConstraint = "tailnet_peers_pkey"                                              // ALTER TABLE ONLY tailnet_peers ADD CONSTRAINT tailnet_peers_pkey PRIMARY KEY (id, coordinator_id);
 	UniqueTailnetTunnelsPkey                                  UniqueConstraint = "tailnet_tunnels_pkey"                                            // ALTER TABLE ONLY tailnet_tunnels ADD CONSTRAINT tailnet_tunnels_pkey PRIMARY KEY (coordinator_id, src_id, dst_id);
+	UniqueTaskWorkspaceAppsPkey                               UniqueConstraint = "task_workspace_apps_pkey"                                        // ALTER TABLE ONLY task_workspace_apps ADD CONSTRAINT task_workspace_apps_pkey PRIMARY KEY (task_id, workspace_build_number);
 	UniqueTasksPkey                                           UniqueConstraint = "tasks_pkey"                                                      // ALTER TABLE ONLY tasks ADD CONSTRAINT tasks_pkey PRIMARY KEY (id);
 	UniqueTelemetryItemsPkey                                  UniqueConstraint = "telemetry_items_pkey"                                            // ALTER TABLE ONLY telemetry_items ADD CONSTRAINT telemetry_items_pkey PRIMARY KEY (key);
 	UniqueTemplateUsageStatsPkey                              UniqueConstraint = "template_usage_stats_pkey"                                       // ALTER TABLE ONLY template_usage_stats ADD CONSTRAINT template_usage_stats_pkey PRIMARY KEY (start_time, template_id, user_id);

From 5dc57da6b42c143d4515ae3ebed55a3a6d649eff Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Mon, 13 Oct 2025 12:42:38 +0300
Subject: [PATCH 107/298] fix(coderd/database): ensure task name uniqueness
 (#20236)

This change ensures task names are unique per user the same way we do
for workspaces. This ensures we don't create tasks that are impossible
to start due to another task being named the same creating a workspace
name conflict.

Updates coder/internal#948
Supersedes coder/coder#20212
---
 coderd/database/dump.sql                      |  4 +
 .../000380_task_name_unique.down.sql          |  1 +
 .../migrations/000380_task_name_unique.up.sql |  2 +
 coderd/database/querier_test.go               | 82 +++++++++++++++++++
 coderd/database/unique_constraint.go          |  1 +
 5 files changed, 90 insertions(+)
 create mode 100644 coderd/database/migrations/000380_task_name_unique.down.sql
 create mode 100644 coderd/database/migrations/000380_task_name_unique.up.sql

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index daa55fb1bb307..5b23e7b28801c 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -3345,6 +3345,10 @@ CREATE INDEX tasks_organization_id_idx ON tasks USING btree (organization_id);
 
 CREATE INDEX tasks_owner_id_idx ON tasks USING btree (owner_id);
 
+CREATE UNIQUE INDEX tasks_owner_id_name_unique_idx ON tasks USING btree (owner_id, lower(name)) WHERE (deleted_at IS NULL);
+
+COMMENT ON INDEX tasks_owner_id_name_unique_idx IS 'Index to ensure uniqueness for task owner/name';
+
 CREATE INDEX tasks_workspace_id_idx ON tasks USING btree (workspace_id);
 
 CREATE INDEX template_usage_stats_start_time_idx ON template_usage_stats USING btree (start_time DESC);
diff --git a/coderd/database/migrations/000380_task_name_unique.down.sql b/coderd/database/migrations/000380_task_name_unique.down.sql
new file mode 100644
index 0000000000000..b15f33255508d
--- /dev/null
+++ b/coderd/database/migrations/000380_task_name_unique.down.sql
@@ -0,0 +1 @@
+DROP INDEX IF EXISTS tasks_owner_id_name_unique_idx;
diff --git a/coderd/database/migrations/000380_task_name_unique.up.sql b/coderd/database/migrations/000380_task_name_unique.up.sql
new file mode 100644
index 0000000000000..13ccf0b2d3fa0
--- /dev/null
+++ b/coderd/database/migrations/000380_task_name_unique.up.sql
@@ -0,0 +1,2 @@
+CREATE UNIQUE INDEX IF NOT EXISTS tasks_owner_id_name_unique_idx ON tasks (owner_id, LOWER(name)) WHERE deleted_at IS NULL;
+COMMENT ON INDEX tasks_owner_id_name_unique_idx IS 'Index to ensure uniqueness for task owner/name';
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 1409a079f584d..01584a03ba3a0 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -7105,6 +7105,88 @@ func TestGetTaskByWorkspaceID(t *testing.T) {
 	}
 }
 
+func TestTaskNameUniqueness(t *testing.T) {
+	t.Parallel()
+
+	db, _ := dbtestutil.NewDB(t)
+
+	org := dbgen.Organization(t, db, database.Organization{})
+	user1 := dbgen.User(t, db, database.User{})
+	user2 := dbgen.User(t, db, database.User{})
+	template := dbgen.Template(t, db, database.Template{
+		OrganizationID: org.ID,
+		CreatedBy:      user1.ID,
+	})
+	tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+		TemplateID:     uuid.NullUUID{UUID: template.ID, Valid: true},
+		OrganizationID: org.ID,
+		CreatedBy:      user1.ID,
+	})
+
+	taskName := "my-task"
+
+	// Create initial task for user1.
+	task1 := dbgen.Task(t, db, database.TaskTable{
+		OrganizationID:    org.ID,
+		OwnerID:           user1.ID,
+		Name:              taskName,
+		TemplateVersionID: tv.ID,
+		Prompt:            "Test prompt",
+	})
+	require.NotEqual(t, uuid.Nil, task1.ID)
+
+	tests := []struct {
+		name     string
+		ownerID  uuid.UUID
+		taskName string
+		wantErr  bool
+	}{
+		{
+			name:     "duplicate task name same user",
+			ownerID:  user1.ID,
+			taskName: taskName,
+			wantErr:  true,
+		},
+		{
+			name:     "duplicate task name different case same user",
+			ownerID:  user1.ID,
+			taskName: "MY-TASK",
+			wantErr:  true,
+		},
+		{
+			name:     "same task name different user",
+			ownerID:  user2.ID,
+			taskName: taskName,
+			wantErr:  false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitShort)
+
+			task, err := db.InsertTask(ctx, database.InsertTaskParams{
+				OrganizationID:     org.ID,
+				OwnerID:            tt.ownerID,
+				Name:               tt.taskName,
+				TemplateVersionID:  tv.ID,
+				TemplateParameters: json.RawMessage("{}"),
+				Prompt:             "Test prompt",
+				CreatedAt:          dbtime.Now(),
+			})
+			if tt.wantErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				require.NotEqual(t, uuid.Nil, task.ID)
+				require.NotEqual(t, task1.ID, task.ID)
+			}
+		})
+	}
+}
+
 func TestUsageEventsTrigger(t *testing.T) {
 	t.Parallel()
 
diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go
index 58206e8ad298a..03e2efa0931d2 100644
--- a/coderd/database/unique_constraint.go
+++ b/coderd/database/unique_constraint.go
@@ -121,6 +121,7 @@ const (
 	UniqueNotificationMessagesDedupeHashIndex                 UniqueConstraint = "notification_messages_dedupe_hash_idx"                           // CREATE UNIQUE INDEX notification_messages_dedupe_hash_idx ON notification_messages USING btree (dedupe_hash);
 	UniqueOrganizationsSingleDefaultOrg                       UniqueConstraint = "organizations_single_default_org"                                // CREATE UNIQUE INDEX organizations_single_default_org ON organizations USING btree (is_default) WHERE (is_default = true);
 	UniqueProvisionerKeysOrganizationIDNameIndex              UniqueConstraint = "provisioner_keys_organization_id_name_idx"                       // CREATE UNIQUE INDEX provisioner_keys_organization_id_name_idx ON provisioner_keys USING btree (organization_id, lower((name)::text));
+	UniqueTasksOwnerIDNameUniqueIndex                         UniqueConstraint = "tasks_owner_id_name_unique_idx"                                  // CREATE UNIQUE INDEX tasks_owner_id_name_unique_idx ON tasks USING btree (owner_id, lower(name)) WHERE (deleted_at IS NULL);
 	UniqueTemplateUsageStatsStartTimeTemplateIDUserIDIndex    UniqueConstraint = "template_usage_stats_start_time_template_id_user_id_idx"         // CREATE UNIQUE INDEX template_usage_stats_start_time_template_id_user_id_idx ON template_usage_stats USING btree (start_time, template_id, user_id);
 	UniqueTemplatesOrganizationIDNameIndex                    UniqueConstraint = "templates_organization_id_name_idx"                              // CREATE UNIQUE INDEX templates_organization_id_name_idx ON templates USING btree (organization_id, lower((name)::text)) WHERE (deleted = false);
 	UniqueUserLinksLinkedIDLoginTypeIndex                     UniqueConstraint = "user_links_linked_id_login_type_idx"                             // CREATE UNIQUE INDEX user_links_linked_id_login_type_idx ON user_links USING btree (linked_id, login_type) WHERE (linked_id <> ''::text);

From a8f87c2625643b42e37f4fb12d48de5811cb427d Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Mon, 13 Oct 2025 12:57:06 +0300
Subject: [PATCH 108/298] feat(coderd): implement task to app linking (#20237)

This change adds workspace build/agent/app linking to tasks and wires it
into `wsbuilder` and `provisionerdserver`.

Closes coder/internal#948
Closes coder/coder#20212
Closes coder/coder#19773
---
 .../provisionerdserver/provisionerdserver.go  |  81 +++++++++++++-
 .../provisionerdserver_test.go                |  26 +++++
 coderd/wsbuilder/wsbuilder.go                 |  16 +++
 coderd/wsbuilder/wsbuilder_test.go            | 105 ++++++++++++++++++
 4 files changed, 225 insertions(+), 3 deletions(-)

diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
index f8d361f5373ea..8e07eb4dc5e3c 100644
--- a/coderd/provisionerdserver/provisionerdserver.go
+++ b/coderd/provisionerdserver/provisionerdserver.go
@@ -1964,18 +1964,41 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 		}
 
 		appIDs := make([]string, 0)
+		agentIDByAppID := make(map[string]uuid.UUID)
 		agentTimeouts := make(map[time.Duration]bool) // A set of agent timeouts.
 		// This could be a bulk insert to improve performance.
 		for _, protoResource := range jobType.WorkspaceBuild.Resources {
-			for _, protoAgent := range protoResource.Agents {
+			for _, protoAgent := range protoResource.GetAgents() {
+				if protoAgent == nil {
+					continue
+				}
+				// By default InsertWorkspaceResource ignores the protoAgent.Id
+				// and generates a new one, but we will insert these using the
+				// InsertWorkspaceResourceWithAgentIDsFromProto option so that
+				// we can properly map agent IDs to app IDs. This is needed for
+				// task linking.
+				agentID := uuid.New()
+				protoAgent.Id = agentID.String()
+
 				dur := time.Duration(protoAgent.GetConnectionTimeoutSeconds()) * time.Second
 				agentTimeouts[dur] = true
 				for _, app := range protoAgent.GetApps() {
 					appIDs = append(appIDs, app.GetId())
+					agentIDByAppID[app.GetId()] = agentID
 				}
 			}
 
-			err = InsertWorkspaceResource(ctx, db, job.ID, workspaceBuild.Transition, protoResource, telemetrySnapshot)
+			err = InsertWorkspaceResource(
+				ctx,
+				db,
+				job.ID,
+				workspaceBuild.Transition,
+				protoResource,
+				telemetrySnapshot,
+				// Ensure that the agent IDs we set previously
+				// are written to the database.
+				InsertWorkspaceResourceWithAgentIDsFromProto(),
+			)
 			if err != nil {
 				return xerrors.Errorf("insert provisioner job: %w", err)
 			}
@@ -1987,6 +2010,7 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 		}
 
 		var taskAppID uuid.NullUUID
+		var taskAgentID uuid.NullUUID
 		var hasAITask bool
 		var warnUnknownTaskAppID bool
 		if tasks := jobType.WorkspaceBuild.GetAiTasks(); len(tasks) > 0 {
@@ -2014,6 +2038,9 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			}
 
 			taskAppID = uuid.NullUUID{UUID: id, Valid: true}
+
+			agentID, ok := agentIDByAppID[appID]
+			taskAgentID = uuid.NullUUID{UUID: agentID, Valid: ok}
 		}
 
 		// This is a hacky workaround for the issue with tasks 'disappearing' on stop:
@@ -2108,6 +2135,27 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 			}
 		}
 
+		if task, err := db.GetTaskByWorkspaceID(ctx, workspace.ID); err == nil {
+			// Irrespective of whether the agent or sidebar app is present,
+			// perform the upsert to ensure a link between the task and
+			// workspace build. Linking the task to the build is typically
+			// already established by wsbuilder.
+			_, err = db.UpsertTaskWorkspaceApp(
+				ctx,
+				database.UpsertTaskWorkspaceAppParams{
+					TaskID:               task.ID,
+					WorkspaceBuildNumber: workspaceBuild.BuildNumber,
+					WorkspaceAgentID:     taskAgentID,
+					WorkspaceAppID:       taskAppID,
+				},
+			)
+			if err != nil {
+				return xerrors.Errorf("upsert task workspace app: %w", err)
+			}
+		} else if !errors.Is(err, sql.ErrNoRows) {
+			return xerrors.Errorf("get task by workspace id: %w", err)
+		}
+
 		// Regardless of whether there is an AI task or not, update the field to indicate one way or the other since it
 		// always defaults to nil. ONLY if has_ai_task=true MUST ai_task_sidebar_app_id be set.
 		if err := db.UpdateWorkspaceBuildFlagsByID(ctx, database.UpdateWorkspaceBuildFlagsByIDParams{
@@ -2578,7 +2626,28 @@ func InsertWorkspacePresetAndParameters(ctx context.Context, db database.Store,
 	return nil
 }
 
-func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.UUID, transition database.WorkspaceTransition, protoResource *sdkproto.Resource, snapshot *telemetry.Snapshot) error {
+type insertWorkspaceResourceOptions struct {
+	useAgentIDsFromProto bool
+}
+
+// InsertWorkspaceResourceOption represents a functional option for
+// InsertWorkspaceResource.
+type InsertWorkspaceResourceOption func(*insertWorkspaceResourceOptions)
+
+// InsertWorkspaceResourceWithAgentIDsFromProto allows inserting agents into the
+// database using the agent IDs defined in the proto resource.
+func InsertWorkspaceResourceWithAgentIDsFromProto() InsertWorkspaceResourceOption {
+	return func(opts *insertWorkspaceResourceOptions) {
+		opts.useAgentIDsFromProto = true
+	}
+}
+
+func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.UUID, transition database.WorkspaceTransition, protoResource *sdkproto.Resource, snapshot *telemetry.Snapshot, opt ...InsertWorkspaceResourceOption) error {
+	opts := &insertWorkspaceResourceOptions{}
+	for _, o := range opt {
+		o(opts)
+	}
+
 	resource, err := db.InsertWorkspaceResource(ctx, database.InsertWorkspaceResourceParams{
 		ID:         uuid.New(),
 		CreatedAt:  dbtime.Now(),
@@ -2675,6 +2744,12 @@ func InsertWorkspaceResource(ctx context.Context, db database.Store, jobID uuid.
 		}
 
 		agentID := uuid.New()
+		if opts.useAgentIDsFromProto {
+			agentID, err = uuid.Parse(prAgent.Id)
+			if err != nil {
+				return xerrors.Errorf("invalid agent ID format; must be uuid: %w", err)
+			}
+		}
 		dbAgent, err := db.InsertWorkspaceAgent(ctx, database.InsertWorkspaceAgentParams{
 			ID:                       agentID,
 			ParentID:                 uuid.NullUUID{},
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
index 6409ba9b1d0df..0cfb83faa4465 100644
--- a/coderd/provisionerdserver/provisionerdserver_test.go
+++ b/coderd/provisionerdserver/provisionerdserver_test.go
@@ -2850,6 +2850,8 @@ func TestCompleteJob(t *testing.T) {
 				seedFunc         func(context.Context, testing.TB, database.Store) error // If you need to insert other resources
 				transition       database.WorkspaceTransition
 				input            *proto.CompletedJob_WorkspaceBuild
+				isTask           bool
+				expectTaskStatus database.TaskStatus
 				expectHasAiTask  bool
 				expectUsageEvent bool
 			}
@@ -2862,6 +2864,7 @@ func TestCompleteJob(t *testing.T) {
 					input:      &proto.CompletedJob_WorkspaceBuild{
 						// No AiTasks defined.
 					},
+					isTask:           false,
 					expectHasAiTask:  false,
 					expectUsageEvent: false,
 				},
@@ -2894,6 +2897,8 @@ func TestCompleteJob(t *testing.T) {
 							},
 						},
 					},
+					isTask:           true,
+					expectTaskStatus: database.TaskStatusInitializing,
 					expectHasAiTask:  true,
 					expectUsageEvent: true,
 				},
@@ -2912,6 +2917,8 @@ func TestCompleteJob(t *testing.T) {
 							},
 						},
 					},
+					isTask:           true,
+					expectTaskStatus: database.TaskStatusInitializing,
 					expectHasAiTask:  false,
 					expectUsageEvent: false,
 				},
@@ -2944,6 +2951,8 @@ func TestCompleteJob(t *testing.T) {
 							},
 						},
 					},
+					isTask:           true,
+					expectTaskStatus: database.TaskStatusPaused,
 					expectHasAiTask:  true,
 					expectUsageEvent: false,
 				},
@@ -2955,6 +2964,8 @@ func TestCompleteJob(t *testing.T) {
 						AiTasks:   []*sdkproto.AITask{},
 						Resources: []*sdkproto.Resource{},
 					},
+					isTask:           true,
+					expectTaskStatus: database.TaskStatusPaused,
 					expectHasAiTask:  true,
 					expectUsageEvent: false,
 				},
@@ -2992,6 +3003,15 @@ func TestCompleteJob(t *testing.T) {
 						OwnerID:        user.ID,
 						OrganizationID: pd.OrganizationID,
 					})
+					var taskTable database.TaskTable
+					if tc.isTask {
+						taskTable = dbgen.Task(t, db, database.TaskTable{
+							OwnerID:           user.ID,
+							OrganizationID:    pd.OrganizationID,
+							WorkspaceID:       uuid.NullUUID{UUID: workspaceTable.ID, Valid: true},
+							TemplateVersionID: version.ID,
+						})
+					}
 
 					ctx := testutil.Context(t, testutil.WaitShort)
 					if tc.seedFunc != nil {
@@ -3060,6 +3080,12 @@ func TestCompleteJob(t *testing.T) {
 					require.True(t, build.HasAITask.Valid) // We ALWAYS expect a value to be set, therefore not nil, i.e. valid = true.
 					require.Equal(t, tc.expectHasAiTask, build.HasAITask.Bool)
 
+					if tc.isTask {
+						task, err := db.GetTaskByID(ctx, taskTable.ID)
+						require.NoError(t, err)
+						require.Equal(t, tc.expectTaskStatus, task.Status)
+					}
+
 					if tc.expectHasAiTask && build.Transition != database.WorkspaceTransitionStop {
 						require.Equal(t, sidebarAppID, build.AITaskSidebarAppID.UUID.String())
 					}
diff --git a/coderd/wsbuilder/wsbuilder.go b/coderd/wsbuilder/wsbuilder.go
index 223b8bec084ad..6aef8c2c2aa17 100644
--- a/coderd/wsbuilder/wsbuilder.go
+++ b/coderd/wsbuilder/wsbuilder.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"database/sql"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"net/http"
 	"time"
@@ -488,6 +489,21 @@ func (b *Builder) buildTx(authFunc func(action policy.Action, object rbac.Object
 			return BuildError{code, "insert workspace build", err}
 		}
 
+		// If this is a task workspace, link it to the latest workspace build.
+		if task, err := store.GetTaskByWorkspaceID(b.ctx, b.workspace.ID); err == nil {
+			_, err = store.UpsertTaskWorkspaceApp(b.ctx, database.UpsertTaskWorkspaceAppParams{
+				TaskID:               task.ID,
+				WorkspaceBuildNumber: buildNum,
+				WorkspaceAgentID:     uuid.NullUUID{}, // Updated by the provisioner upon job completion.
+				WorkspaceAppID:       uuid.NullUUID{}, // Updated by the provisioner upon job completion.
+			})
+			if err != nil {
+				return BuildError{http.StatusInternalServerError, "upsert task workspace app", err}
+			}
+		} else if !errors.Is(err, sql.ErrNoRows) {
+			return BuildError{http.StatusInternalServerError, "get task by workspace id", err}
+		}
+
 		err = store.InsertWorkspaceBuildParameters(b.ctx, database.InsertWorkspaceBuildParametersParams{
 			WorkspaceBuildID: workspaceBuildID,
 			Name:             names,
diff --git a/coderd/wsbuilder/wsbuilder_test.go b/coderd/wsbuilder/wsbuilder_test.go
index b862e6459c285..3a8921dd6dcd9 100644
--- a/coderd/wsbuilder/wsbuilder_test.go
+++ b/coderd/wsbuilder/wsbuilder_test.go
@@ -47,6 +47,7 @@ var (
 	lastBuildJobID    = uuid.MustParse("12341234-0000-0000-000c-000000000000")
 	otherUserID       = uuid.MustParse("12341234-0000-0000-000d-000000000000")
 	presetID          = uuid.MustParse("12341234-0000-0000-000e-000000000000")
+	taskID            = uuid.MustParse("12341234-0000-0000-000f-000000000000")
 )
 
 func TestBuilder_NoOptions(t *testing.T) {
@@ -94,6 +95,7 @@ func TestBuilder_NoOptions(t *testing.T) {
 			asrt.Equal(buildID, bld.ID)
 		}),
 		withBuild,
+		withNoTask,
 		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 			asrt.Equal(buildID, params.WorkspaceBuildID)
 			asrt.Empty(params.Name)
@@ -140,6 +142,7 @@ func TestBuilder_Initiator(t *testing.T) {
 		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 		}),
 		withBuild,
+		withNoTask,
 	)
 	fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
 
@@ -188,6 +191,7 @@ func TestBuilder_Baggage(t *testing.T) {
 		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 		}),
 		withBuild,
+		withNoTask,
 	)
 	fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
 
@@ -229,6 +233,7 @@ func TestBuilder_Reason(t *testing.T) {
 		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 		}),
 		withBuild,
+		withNoTask,
 	)
 	fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
 
@@ -275,6 +280,7 @@ func TestBuilder_ActiveVersion(t *testing.T) {
 		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 		}),
 		withBuild,
+		withNoTask,
 	)
 	fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
 
@@ -391,6 +397,7 @@ func TestWorkspaceBuildWithTags(t *testing.T) {
 		expectBuildParameters(func(_ database.InsertWorkspaceBuildParametersParams) {
 		}),
 		withBuild,
+		withNoTask,
 		expectFindMatchingPresetID(uuid.Nil, sql.ErrNoRows),
 	)
 	fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
@@ -476,6 +483,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 				}
 			}),
 			withBuild,
+			withNoTask,
 			expectFindMatchingPresetID(uuid.Nil, sql.ErrNoRows),
 		)
 		fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
@@ -526,6 +534,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 				}
 			}),
 			withBuild,
+			withNoTask,
 			expectFindMatchingPresetID(uuid.Nil, sql.ErrNoRows),
 		)
 		fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
@@ -669,6 +678,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 				}
 			}),
 			withBuild,
+			withNoTask,
 			expectFindMatchingPresetID(uuid.Nil, sql.ErrNoRows),
 		)
 		fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
@@ -735,6 +745,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 				}
 			}),
 			withBuild,
+			withNoTask,
 		)
 		fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
 
@@ -798,6 +809,7 @@ func TestWorkspaceBuildWithRichParameters(t *testing.T) {
 				}
 			}),
 			withBuild,
+			withNoTask,
 		)
 		fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
 
@@ -860,6 +872,7 @@ func TestWorkspaceBuildWithPreset(t *testing.T) {
 			asrt.Equal(presetID, bld.TemplateVersionPresetID.UUID)
 		}),
 		withBuild,
+		withNoTask,
 		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 			asrt.Equal(buildID, params.WorkspaceBuildID)
 			asrt.Empty(params.Name)
@@ -929,6 +942,7 @@ func TestWorkspaceBuildDeleteOrphan(t *testing.T) {
 				asrt.Equal(buildID, bld.ID)
 			}),
 			withBuild,
+			withNoTask,
 			expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 				asrt.Equal(buildID, params.WorkspaceBuildID)
 				asrt.Empty(params.Name)
@@ -992,6 +1006,7 @@ func TestWorkspaceBuildDeleteOrphan(t *testing.T) {
 				asrt.Equal(buildID, bld.ID)
 			}),
 			withBuild,
+			withNoTask,
 			expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {
 				asrt.Equal(buildID, params.WorkspaceBuildID)
 				asrt.Empty(params.Name)
@@ -1057,6 +1072,7 @@ func TestWorkspaceBuildUsageChecker(t *testing.T) {
 			expectFindMatchingPresetID(uuid.Nil, sql.ErrNoRows),
 			expectBuild(func(bld database.InsertWorkspaceBuildParams) {}),
 			withBuild,
+			withNoTask,
 			expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {}),
 		)
 		fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
@@ -1133,6 +1149,59 @@ func TestWorkspaceBuildUsageChecker(t *testing.T) {
 	}
 }
 
+func TestWorkspaceBuildWithTask(t *testing.T) {
+	t.Parallel()
+	req := require.New(t)
+	asrt := assert.New(t)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	testTask := database.Task{
+		ID:                taskID,
+		OrganizationID:    orgID,
+		OwnerID:           userID,
+		Name:              "test-task",
+		WorkspaceID:       uuid.NullUUID{UUID: workspaceID, Valid: true},
+		TemplateVersionID: activeVersionID,
+		CreatedAt:         dbtime.Now(),
+	}
+
+	mDB := expectDB(t,
+		// Inputs
+		withTemplate,
+		withInactiveVersion(nil),
+		withLastBuildFound,
+		withTemplateVersionVariables(inactiveVersionID, nil),
+		withRichParameters(nil),
+		withParameterSchemas(inactiveJobID, nil),
+		withWorkspaceTags(inactiveVersionID, nil),
+		withProvisionerDaemons([]database.GetEligibleProvisionerDaemonsByProvisionerJobIDsRow{}),
+
+		// Outputs
+		expectProvisionerJob(func(job database.InsertProvisionerJobParams) {}),
+		withInTx,
+		expectFindMatchingPresetID(uuid.Nil, sql.ErrNoRows),
+		expectBuild(func(bld database.InsertWorkspaceBuildParams) {}),
+		withBuild,
+		withTask(testTask),
+		expectUpsertTaskWorkspaceApp(func(params database.UpsertTaskWorkspaceAppParams) {
+			asrt.Equal(taskID, params.TaskID)
+			asrt.Equal(int32(2), params.WorkspaceBuildNumber)
+			asrt.False(params.WorkspaceAgentID.Valid, "workspace_agent_id should be NULL initially")
+			asrt.False(params.WorkspaceAppID.Valid, "workspace_app_id should be NULL initially")
+		}),
+		expectBuildParameters(func(params database.InsertWorkspaceBuildParametersParams) {}),
+	)
+	fc := files.New(prometheus.NewRegistry(), &coderdtest.FakeAuthorizer{})
+
+	ws := database.Workspace{ID: workspaceID, TemplateID: templateID, OwnerID: userID}
+	uut := wsbuilder.New(ws, database.WorkspaceTransitionStart, wsbuilder.NoopUsageChecker{})
+	// nolint: dogsled
+	_, _, _, err := uut.Build(ctx, mDB, fc, nil, audit.WorkspaceBuildBaggage{})
+	req.NoError(err)
+}
+
 func TestWsbuildError(t *testing.T) {
 	t.Parallel()
 
@@ -1514,3 +1583,39 @@ type fakeUsageChecker struct {
 func (f *fakeUsageChecker) CheckBuildUsage(ctx context.Context, store database.Store, templateVersion *database.TemplateVersion) (wsbuilder.UsageCheckResponse, error) {
 	return f.checkBuildUsageFunc(ctx, store, templateVersion)
 }
+
+func withNoTask(mTx *dbmock.MockStore) {
+	mTx.EXPECT().GetTaskByWorkspaceID(gomock.Any(), gomock.Any()).Times(1).
+		DoAndReturn(func(ctx context.Context, id uuid.UUID) (database.Task, error) {
+			return database.Task{}, sql.ErrNoRows
+		})
+}
+
+func withTask(task database.Task) func(mTx *dbmock.MockStore) {
+	return func(mTx *dbmock.MockStore) {
+		mTx.EXPECT().GetTaskByWorkspaceID(gomock.Any(), gomock.Any()).Times(1).
+			DoAndReturn(func(ctx context.Context, id uuid.UUID) (database.Task, error) {
+				return task, nil
+			})
+	}
+}
+
+func expectUpsertTaskWorkspaceApp(
+	assertions func(database.UpsertTaskWorkspaceAppParams),
+) func(mTx *dbmock.MockStore) {
+	return func(mTx *dbmock.MockStore) {
+		mTx.EXPECT().UpsertTaskWorkspaceApp(gomock.Any(), gomock.Any()).
+			Times(1).
+			DoAndReturn(
+				func(ctx context.Context, params database.UpsertTaskWorkspaceAppParams) (database.TaskWorkspaceApp, error) {
+					assertions(params)
+					return database.TaskWorkspaceApp{
+						TaskID:               params.TaskID,
+						WorkspaceBuildNumber: params.WorkspaceBuildNumber,
+						WorkspaceAgentID:     params.WorkspaceAgentID,
+						WorkspaceAppID:       params.WorkspaceAppID,
+					}, nil
+				},
+			)
+	}
+}

From 51b0767429658f362a6d5c6b2056c68724a36e86 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 11:54:09 +0000
Subject: [PATCH 109/298] chore: bump rust from `1219c0b` to `e4ae8ab` in
 /dogfood/coder (#20267)

Bumps rust from `1219c0b` to `e4ae8ab`.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=rust&package-manager=docker&previous-version=slim&new-version=slim)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/Dockerfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/Dockerfile b/dogfood/coder/Dockerfile
index 7f1eda55a6c58..932e2ce9b06a6 100644
--- a/dogfood/coder/Dockerfile
+++ b/dogfood/coder/Dockerfile
@@ -1,5 +1,5 @@
 # 1.86.0
-FROM rust:slim@sha256:1219c0b5980e8310eb8e08a7fec9e2159ffc9f166cc9999ddb13604c43cd0eb6 AS rust-utils
+FROM rust:slim@sha256:e4ae8ab67883487c5545884d5aa5ebbe86b5f13c6df4a8e3e2f34c89cedb9f54 AS rust-utils
 # Install rust helper programs
 ENV CARGO_INSTALL_ROOT=/tmp/
 # Use more reliable mirrors for Debian packages

From fb86841071026d937b11a954a02a3d8a28739de2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 11:57:31 +0000
Subject: [PATCH 110/298] chore: bump github.com/brianvoe/gofakeit/v7 from
 7.7.1 to 7.8.0 (#20265)

Bumps
[github.com/brianvoe/gofakeit/v7](https://github.com/brianvoe/gofakeit)
from 7.7.1 to 7.8.0.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/6af983166ac57e4b39f11c665273d6e61339637d"><code>6af9831</code></a>
emoji - cleanup, organization and new function additions</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/1399ba0ab2177c19f83432e20a619c26be517a35"><code>1399ba0</code></a>
generate - improve generate performance</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/3840eaf8c61407e57a8e14382c0e81dfbde15402"><code>3840eaf</code></a>
internet - added url safe slug</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/1332b941476e911422b8647d8d6b331de703513f"><code>1332b94</code></a>
airline - added airline functions</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/ae44694fb1f7b11f8687ec0b292961e462ceb847"><code>ae44694</code></a>
readme - updated to reflect text updates</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/e5a4d526a4e615eaa77b8361ceae4d0ba7ce71b1"><code>e5a4d52</code></a>
lorem ipsum - simplified usage and directly use sentence gen</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/3890a67dc9728b7f8a0c0e390eab8e91e455eec1"><code>3890a67</code></a>
sentence - updated usage across repo</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/ab13d69433d91d6521002017f30ee1c5b17893a0"><code>ab13d69</code></a>
hipster - updated to uppercase first character</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/7b7ddf7db30dcdd4c562fdcb1c59049b29bb6641"><code>7b7ddf7</code></a>
hipster - updated to uppercase first character</li>
<li><a
href="https://github.com/brianvoe/gofakeit/commit/5e08f261402527fdba32e9f74187809cb3a5987b"><code>5e08f26</code></a>
template - update test usage</li>
<li>Additional commits viewable in <a
href="https://github.com/brianvoe/gofakeit/compare/v7.7.1...v7.8.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/brianvoe/gofakeit/v7&package-manager=go_modules&previous-version=7.7.1&new-version=7.8.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 95308d48ff94c..34c292efe6cd3 100644
--- a/go.mod
+++ b/go.mod
@@ -476,7 +476,7 @@ require (
 
 require (
 	github.com/anthropics/anthropic-sdk-go v1.13.0
-	github.com/brianvoe/gofakeit/v7 v7.7.1
+	github.com/brianvoe/gofakeit/v7 v7.8.0
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
 	github.com/coder/aibridge v0.1.3
 	github.com/coder/aisdk-go v0.0.9
diff --git a/go.sum b/go.sum
index 5b137f059665f..ea22c5135be03 100644
--- a/go.sum
+++ b/go.sum
@@ -836,8 +836,8 @@ github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl
 github.com/boombuler/barcode v1.0.1/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
 github.com/bramvdbogaerde/go-scp v1.5.0 h1:a9BinAjTfQh273eh7vd3qUgmBC+bx+3TRDtkZWmIpzM=
 github.com/bramvdbogaerde/go-scp v1.5.0/go.mod h1:on2aH5AxaFb2G0N5Vsdy6B0Ml7k9HuHSwfo1y0QzAbQ=
-github.com/brianvoe/gofakeit/v7 v7.7.1 h1:Z74GFLZz57rAUHjpNbaKOr8c7nXdUohsiwF/jhkqE0k=
-github.com/brianvoe/gofakeit/v7 v7.7.1/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
+github.com/brianvoe/gofakeit/v7 v7.8.0 h1:FHLerglGVodD2O4pnQPCmFlkmIRXp8MpAflnarW5sQM=
+github.com/brianvoe/gofakeit/v7 v7.8.0/go.mod h1:QXuPeBw164PJCzCUZVmgpgHJ3Llj49jSLVkKPMtxtxA=
 github.com/buger/jsonparser v1.1.1 h1:2PnMjfWD7wBILjqQbt530v576A/cAbQvEW9gGIpYMUs=
 github.com/buger/jsonparser v1.1.1/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0=
 github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 h1:3uZCA/BLTIu+DqCfguByNMJa2HVHpXvjfy0Dy7g6fuA=

From 5ab72cce63245138fc54814e3c3b4bc690c6c67a Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 12:02:14 +0000
Subject: [PATCH 111/298] chore: bump github.com/gofrs/flock from 0.12.1 to
 0.13.0 (#20269)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/gofrs/flock](https://github.com/gofrs/flock) from
0.12.1 to 0.13.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gofrs/flock/releases">github.com/gofrs/flock's
releases</a>.</em></p>
<blockquote>
<h2>v0.13.0</h2>
<h2>What's Changed</h2>
<p>Minimum Go version 1.24</p>
<ul>
<li>feat: add Stat method by <a
href="https://github.com/ferhatelmas"><code>@​ferhatelmas</code></a> in
<a
href="https://redirect.github.com/gofrs/flock/pull/127">gofrs/flock#127</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.22.0 to 0.37.0</li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gofrs/flock/compare/v0.12.1...v0.13.0">https://github.com/gofrs/flock/compare/v0.12.1...v0.13.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gofrs/flock/commit/bfec60bb026171031050af631b6dec974f14e9fa"><code>bfec60b</code></a>
chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 in the gomod
group (...</li>
<li><a
href="https://github.com/gofrs/flock/commit/7094284415ad11369be4662a7c12be25963b4ea5"><code>7094284</code></a>
chore: update linter</li>
<li><a
href="https://github.com/gofrs/flock/commit/8111aec69ca1501f26bb5198ed02673e87806e65"><code>8111aec</code></a>
feat: add Stat method (<a
href="https://redirect.github.com/gofrs/flock/issues/127">#127</a>)</li>
<li><a
href="https://github.com/gofrs/flock/commit/6f0f0ed4e14d546b238ae500710aba38b924e135"><code>6f0f0ed</code></a>
chore(deps): bump the github-actions group with 4 updates (<a
href="https://redirect.github.com/gofrs/flock/issues/126">#126</a>)</li>
<li><a
href="https://github.com/gofrs/flock/commit/fe44231e563ec57fda028bc2484140fb1f24a6d1"><code>fe44231</code></a>
chore(deps): bump golang.org/x/sys from 0.35.0 to 0.36.0 in the gomod
group (...</li>
<li><a
href="https://github.com/gofrs/flock/commit/f74f0fb0332646c6b3730bfe9cce6fc0badc52c6"><code>f74f0fb</code></a>
chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.1 in
the go...</li>
<li><a
href="https://github.com/gofrs/flock/commit/c1f6d161c8e3b29a4d612e34ff17b37d00d4cd2f"><code>c1f6d16</code></a>
chore(deps): bump golang.org/x/sys from 0.34.0 to 0.35.0 in the gomod
group (...</li>
<li><a
href="https://github.com/gofrs/flock/commit/c542c57ff5f6af1d62b6864144170b612731796a"><code>c542c57</code></a>
chore(deps): bump github/codeql-action from 3.29.2 to 3.29.5 in the
github-ac...</li>
<li><a
href="https://github.com/gofrs/flock/commit/425570ba9b698b04bb9506c4906f137fb34ac7e0"><code>425570b</code></a>
chore(deps): bump golang.org/x/sys from 0.33.0 to 0.34.0 in the gomod
group (...</li>
<li><a
href="https://github.com/gofrs/flock/commit/12753ea298e1aeb97f0881ff3fc07eabcb2b86e5"><code>12753ea</code></a>
chore(deps): bump github/codeql-action from 3.28.18 to 3.29.2 in the
github-a...</li>
<li>Additional commits viewable in <a
href="https://github.com/gofrs/flock/compare/v0.12.1...v0.13.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gofrs/flock&package-manager=go_modules&previous-version=0.12.1&new-version=0.13.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 34c292efe6cd3..ba87383d7b737 100644
--- a/go.mod
+++ b/go.mod
@@ -126,7 +126,7 @@ require (
 	github.com/go-jose/go-jose/v4 v4.1.3
 	github.com/go-logr/logr v1.4.3
 	github.com/go-playground/validator/v10 v10.28.0
-	github.com/gofrs/flock v0.12.1
+	github.com/gofrs/flock v0.13.0
 	github.com/gohugoio/hugo v0.150.0
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/golang-migrate/migrate/v4 v4.19.0
@@ -201,7 +201,7 @@ require (
 	golang.org/x/net v0.44.0
 	golang.org/x/oauth2 v0.31.0
 	golang.org/x/sync v0.17.0
-	golang.org/x/sys v0.36.0
+	golang.org/x/sys v0.37.0
 	golang.org/x/term v0.35.0
 	golang.org/x/text v0.29.0
 	golang.org/x/tools v0.37.0
diff --git a/go.sum b/go.sum
index ea22c5135be03..866e6d30ffa0b 100644
--- a/go.sum
+++ b/go.sum
@@ -1187,8 +1187,8 @@ github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakr
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
-github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
-github.com/gofrs/flock v0.12.1/go.mod h1:9zxTsyu5xtJ9DK+1tFZyibEV7y3uwDxPPfbxeeHCoD0=
+github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
+github.com/gofrs/flock v0.13.0/go.mod h1:jxeyy9R1auM5S6JYDBhDt+E2TCo7DkratH4Pgi8P+Z0=
 github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1YrTJupqA=
 github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
@@ -2330,8 +2330,8 @@ golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.20.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
-golang.org/x/sys v0.36.0 h1:KVRy2GtZBrk1cBYA7MKu5bEZFxQk4NIDV6RLVcC8o0k=
-golang.org/x/sys v0.36.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
+golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ=
+golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
 golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2/go.mod h1:TeRTkGYfJXctD9OcfyVLyj2J3IxLnKwHJR8f4D8a3YE=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=

From 847058c56c40d0a5bd56247494ded049f58315a7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= <pawel@coder.com>
Date: Mon, 13 Oct 2025 14:04:08 +0200
Subject: [PATCH 112/298] fix: set default values for `RevokeURL` property in
 external auth configs (#20270)

This PR adds logic that sets default values for `RevokeURL` in external
auth configs.
---
 coderd/externalauth/externalauth.go               | 3 +++
 coderd/externalauth/externalauth_internal_test.go | 4 ++++
 2 files changed, 7 insertions(+)

diff --git a/coderd/externalauth/externalauth.go b/coderd/externalauth/externalauth.go
index 41797706eeff1..f1ab1cd0388be 100644
--- a/coderd/externalauth/externalauth.go
+++ b/coderd/externalauth/externalauth.go
@@ -814,6 +814,9 @@ func copyDefaultSettings(config *codersdk.ExternalAuthConfig, defaults codersdk.
 	if config.ValidateURL == "" {
 		config.ValidateURL = defaults.ValidateURL
 	}
+	if config.RevokeURL == "" {
+		config.RevokeURL = defaults.RevokeURL
+	}
 	if config.AppInstallURL == "" {
 		config.AppInstallURL = defaults.AppInstallURL
 	}
diff --git a/coderd/externalauth/externalauth_internal_test.go b/coderd/externalauth/externalauth_internal_test.go
index f50593c019b4f..65bb5ee7deb62 100644
--- a/coderd/externalauth/externalauth_internal_test.go
+++ b/coderd/externalauth/externalauth_internal_test.go
@@ -19,6 +19,7 @@ func TestGitlabDefaults(t *testing.T) {
 		AuthURL:     "https://gitlab.com/oauth/authorize",
 		TokenURL:    "https://gitlab.com/oauth/token",
 		ValidateURL: "https://gitlab.com/oauth/token/info",
+		RevokeURL:   "https://gitlab.com/oauth/revoke",
 		DisplayName: "GitLab",
 		DisplayIcon: "/icon/gitlab.svg",
 		Regex:       `^(https?://)?gitlab\.com(/.*)?$`,
@@ -79,6 +80,7 @@ func TestGitlabDefaults(t *testing.T) {
 				config.AuthURL = "https://gitlab.company.org/oauth/authorize?foo=bar"
 				config.ValidateURL = "https://gitlab.company.org/oauth/token/info"
 				config.TokenURL = "https://gitlab.company.org/oauth/token"
+				config.RevokeURL = "https://gitlab.company.org/oauth/revoke"
 				config.Regex = `^(https?://)?gitlab\.company\.org(/.*)?$`
 			},
 		},
@@ -90,6 +92,7 @@ func TestGitlabDefaults(t *testing.T) {
 				AuthURL:     "https://auth.com/auth",
 				ValidateURL: "https://validate.com/validate",
 				TokenURL:    "https://token.com/token",
+				RevokeURL:   "https://token.com/revoke",
 				Regex:       "random",
 			},
 			expected: cloud,
@@ -97,6 +100,7 @@ func TestGitlabDefaults(t *testing.T) {
 				config.AuthURL = "https://auth.com/auth"
 				config.ValidateURL = "https://validate.com/validate"
 				config.TokenURL = "https://token.com/token"
+				config.RevokeURL = "https://token.com/revoke"
 				config.Regex = `random`
 			},
 		},

From 4a373ee6afba858235665cdced1ef55965181db9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 12:16:05 +0000
Subject: [PATCH 113/298] chore: bump github.com/valyala/fasthttp from 1.66.0
 to 1.67.0 (#20273)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp)
from 1.66.0 to 1.67.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.67.0</h2>
<p>Special thanks to the following security researchers who reported the
issues fixed in this release:</p>
<ul>
<li><a href="https://github.com/zer0yu"><code>@​zer0yu</code></a> (Enze
Wang)</li>
<li><a href="https://github.com/P3ngu1nW"><code>@​P3ngu1nW</code></a>
(Jingcheng Yang)</li>
<li><a href="https://github.com/9vvert"><code>@​9vvert</code></a> (Zehui
Miao)</li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Add DNS cache management methods for TCPDialer by <a
href="https://github.com/aabishkaryal"><code>@​aabishkaryal</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2072">valyala/fasthttp#2072</a></li>
<li>Fix username:password@ validation in urls by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2080">valyala/fasthttp#2080</a></li>
<li>Validate IPv6 addresses in urls by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2079">valyala/fasthttp#2079</a></li>
<li>Validate schemes by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2078">valyala/fasthttp#2078</a></li>
<li>Reject invalid hosts with multiple port delimiters by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2077">valyala/fasthttp#2077</a></li>
<li>Reject backslash absolute URIs and cache parse errors by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2075">valyala/fasthttp#2075</a></li>
<li>Reject bad ipv6 hostnames by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2076">valyala/fasthttp#2076</a></li>
<li>Reimplement flushing support for fasthttpadaptor by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2081">valyala/fasthttp#2081</a></li>
<li>chore(deps): bump securego/gosec from 2.22.8 to 2.22.9 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2073">valyala/fasthttp#2073</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/aabishkaryal"><code>@​aabishkaryal</code></a>
made their first contribution in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2072">valyala/fasthttp#2072</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/valyala/fasthttp/compare/v1.66.0...v1.67.0">https://github.com/valyala/fasthttp/compare/v1.66.0...v1.67.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/valyala/fasthttp/commit/b26ff4866918a81247d8ce1cbfe07c7da63b2940"><code>b26ff48</code></a>
chore(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2084">#2084</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/19624506292b2f05ed08774d1f6c814340efb409"><code>1962450</code></a>
Fix copyTrailer</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/2272d532e154f55d6a9cfe316109d2be850a6331"><code>2272d53</code></a>
Reimplement flushing support for fasthttpadaptor (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2081">#2081</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/a17ec74999fe7a1f9a46d09d644584e73e97f908"><code>a17ec74</code></a>
Reject bad ipv6 hostnames (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2076">#2076</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/f18eb9ef0c366b9ac212e41f4bce3378b215dbf2"><code>f18eb9e</code></a>
Reject backslash absolute URIs and cache parse errors (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2075">#2075</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/bed90bcf091dc56b3098fb57cbbc1ca931d5ea34"><code>bed90bc</code></a>
Reject invalid hosts with multiple port delimiters (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2077">#2077</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/d3fc68239107eb85a36b3baf0b9ca873cdf9b95f"><code>d3fc682</code></a>
Validate schemes (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2078">#2078</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/af41f54adbd2b47323ae0b1caf76e79cb3c2e824"><code>af41f54</code></a>
Validate IPv6 addresses in urls (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2079">#2079</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/75dcdb8bba3eac0eb091a68a5b401cf9755be0df"><code>75dcdb8</code></a>
Fix username:password@ validation in urls (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2080">#2080</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/ede09fad738b7c16784e37064f49f89c960ecbb0"><code>ede09fa</code></a>
Limit FuzzTestHeaderScanner body size</li>
<li>Additional commits viewable in <a
href="https://github.com/valyala/fasthttp/compare/v1.66.0...v1.67.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.66.0&new-version=1.67.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index ba87383d7b737..cb228a7f4c4e2 100644
--- a/go.mod
+++ b/go.mod
@@ -181,7 +181,7 @@ require (
 	github.com/tidwall/gjson v1.18.0
 	github.com/u-root/u-root v0.14.0
 	github.com/unrolled/secure v1.17.0
-	github.com/valyala/fasthttp v1.66.0
+	github.com/valyala/fasthttp v1.67.0
 	github.com/wagslane/go-password-validator v0.3.0
 	github.com/zclconf/go-cty-yaml v1.1.0
 	go.mozilla.org/pkcs7 v0.9.0
@@ -198,7 +198,7 @@ require (
 	golang.org/x/crypto v0.42.0
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621
 	golang.org/x/mod v0.28.0
-	golang.org/x/net v0.44.0
+	golang.org/x/net v0.45.0
 	golang.org/x/oauth2 v0.31.0
 	golang.org/x/sync v0.17.0
 	golang.org/x/sys v0.37.0
diff --git a/go.sum b/go.sum
index 866e6d30ffa0b..4a56e851ff1b9 100644
--- a/go.sum
+++ b/go.sum
@@ -1866,8 +1866,8 @@ github.com/unrolled/secure v1.17.0 h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbW
 github.com/unrolled/secure v1.17.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.66.0 h1:M87A0Z7EayeyNaV6pfO3tUTUiYO0dZfEJnRGXTVNuyU=
-github.com/valyala/fasthttp v1.66.0/go.mod h1:Y4eC+zwoocmXSVCB1JmhNbYtS7tZPRI2ztPB72EVObs=
+github.com/valyala/fasthttp v1.67.0 h1:tqKlJMUP6iuNG8hGjK/s9J4kadH7HLV4ijEcPGsezac=
+github.com/valyala/fasthttp v1.67.0/go.mod h1:qYSIpqt/0XNmShgo/8Aq8E3UYWVVwNS2QYmzd8WIEPM=
 github.com/vektah/gqlparser/v2 v2.5.28 h1:bIulcl3LF69ba6EiZVGD88y4MkM+Jxrf3P2MX8xLRkY=
 github.com/vektah/gqlparser/v2 v2.5.28/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
 github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
@@ -2178,8 +2178,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/net v0.44.0 h1:evd8IRDyfNBMBTTY5XRF1vaZlD+EmWx6x8PkhR04H/I=
-golang.org/x/net v0.44.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
+golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=

From a10ca93c42f6c8203bdd42d9abc26cc44a11af67 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 13:12:57 +0000
Subject: [PATCH 114/298] chore: bump alpine from 3.22.1 to 3.22.2 in /scripts
 (#20278)

Bumps alpine from 3.22.1 to 3.22.2.


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=alpine&package-manager=docker&previous-version=3.22.1&new-version=3.22.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 scripts/Dockerfile.base | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/Dockerfile.base b/scripts/Dockerfile.base
index e13b5ffa666e0..d14d88e1a544d 100644
--- a/scripts/Dockerfile.base
+++ b/scripts/Dockerfile.base
@@ -1,7 +1,7 @@
 # This is the base image used for Coder images. It's a multi-arch image that is
 # built in depot.dev for all supported architectures. Since it's built on real
 # hardware and not cross-compiled, it can have "RUN" commands.
-FROM alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1
+FROM alpine:3.22.2@sha256:4b7ce07002c69e8f3d704a9c5d6fd3053be500b7f1c69fc0d80990c2ad8dd412
 
 # We use a single RUN command to reduce the number of layers in the image.
 # NOTE: Keep the Terraform version in sync with minTerraformVersion and

From 3d779c2093b8d6cc0ff9605568eb4d0ceae221d5 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 13:14:01 +0000
Subject: [PATCH 115/298] chore: bump google.golang.org/grpc from 1.75.1 to
 1.76.0 (#20277)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from
1.75.1 to 1.76.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/grpc/grpc-go/releases">google.golang.org/grpc's
releases</a>.</em></p>
<blockquote>
<h2>Release 1.76.0</h2>
<h1>Dependencies</h1>
<ul>
<li>Minimum supported Go version is now 1.24 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8509">#8509</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/kevinGC"><code>@​kevinGC</code></a></li>
</ul>
</li>
</ul>
<h1>Bug Fixes</h1>
<ul>
<li>client: Return status <code>INTERNAL</code> when a server sends zero
response messages for a unary or client-streaming RPC. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8523">#8523</a>)</li>
<li>client: Fail RPCs with status <code>INTERNAL</code> instead of
<code>UNKNOWN</code> upon receiving http headers with status 1xx and
<code>END_STREAM</code> flag set. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8518">#8518</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/vinothkumarr227"><code>@​vinothkumarr227</code></a></li>
</ul>
</li>
<li>pick_first: Fix race condition that could cause pick_first to get
stuck in <code>IDLE</code> state on backend address change. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8615">#8615</a>)</li>
</ul>
<h1>New Features</h1>
<ul>
<li>credentials: Add <code>credentials/jwt</code> package providing
file-based JWT PerRPCCredentials (A97). (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8431">#8431</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/dimpavloff"><code>@​dimpavloff</code></a></li>
</ul>
</li>
</ul>
<h1>Performance Improvements</h1>
<ul>
<li>client: Improve HTTP/2 header size estimate to reduce
re-allocations. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8547">#8547</a>)</li>
<li>encoding/proto: Avoid redundant message size calculation when
marshaling. (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8569">#8569</a>)
<ul>
<li>Special Thanks: <a
href="https://github.com/rs-unity"><code>@​rs-unity</code></a></li>
</ul>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/grpc/grpc-go/commit/d96c2ef4f3339142d20a47797d8a5a4fae948607"><code>d96c2ef</code></a>
Change version to 1.76.0 (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8584">#8584</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/79c553c64de01994d8b9dc0dcac6ed765ac7de50"><code>79c553c</code></a>
Cherry pick <a
href="https://redirect.github.com/grpc/grpc-go/issues/8610">#8610</a>,
<a href="https://redirect.github.com/grpc/grpc-go/issues/8615">#8615</a>
to v1.76.x (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8621">#8621</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0513350812453ffc1fe7fd329817a16fb40a8cfe"><code>0513350</code></a>
client: minor improvements to log messages (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8564">#8564</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/ebaf486eab0fdf28996baf269064f83224538150"><code>ebaf486</code></a>
credentials: implement file-based JWT Call Credentials (part 1 for A97)
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8431">#8431</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/ca78c904b12dd41257291d6b9ba3309a18f0b277"><code>ca78c90</code></a>
xds/resolver_test: fix flaky test
ResolverBadServiceUpdate_NACKedWithoutCache...</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/83bead40c01c8c5b8407e4573203ab34dec76c78"><code>83bead4</code></a>
internal/buffer: set closed flag when closing channel in the Load method
(<a
href="https://redirect.github.com/grpc/grpc-go/issues/8575">#8575</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/0f45079e3826e866ff0d2034a8732c0a482e3170"><code>0f45079</code></a>
encoding/proto: enable use cached size option (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8569">#8569</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/8420f3ff9ce4617369e054cedb51fda6d45c3340"><code>8420f3f</code></a>
transport: avoid slice reallocation during header creation (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8547">#8547</a>)</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/b36320ef9aa22c1b3eedd607fec388fc61cc6583"><code>b36320e</code></a>
Revert &quot;stats/opentelemetry: record retry attempts from
clientStream (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8342">#8342</a>)&quot;...</li>
<li><a
href="https://github.com/grpc/grpc-go/commit/c1222501e9eeb118d6f0df19fa9387fcb6e5a6a1"><code>c122250</code></a>
stats/opentelemetry: record retry attempts from clientStream (<a
href="https://redirect.github.com/grpc/grpc-go/issues/8342">#8342</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/grpc/grpc-go/compare/v1.75.1...v1.76.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/grpc&package-manager=go_modules&previous-version=1.75.1&new-version=1.76.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index cb228a7f4c4e2..2522e914d00f3 100644
--- a/go.mod
+++ b/go.mod
@@ -207,7 +207,7 @@ require (
 	golang.org/x/tools v0.37.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
 	google.golang.org/api v0.251.0
-	google.golang.org/grpc v1.75.1
+	google.golang.org/grpc v1.76.0
 	google.golang.org/protobuf v1.36.9
 	gopkg.in/DataDog/dd-trace-go.v1 v1.74.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
@@ -453,7 +453,7 @@ require (
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20250715232539-7130f93afb79 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
diff --git a/go.sum b/go.sum
index 4a56e851ff1b9..1202f200291e9 100644
--- a/go.sum
+++ b/go.sum
@@ -2678,8 +2678,8 @@ google.golang.org/genproto v0.0.0-20230331144136-dcfb400f0633/go.mod h1:UUQDJDOl
 google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1/go.mod h1:nKE/iIaLqn2bQwXBg8f1g2Ylh6r5MN5CmZvuzZCgsCU=
 google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 h1:Nt6z9UHqSlIdIGJdz6KhTIs2VRx/iOsA5iE8bmQNcxs=
 google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79/go.mod h1:kTmlBHMPqR5uCZPBvwa2B18mvubkjyY3CRLI0c6fj0s=
-google.golang.org/genproto/googleapis/api v0.0.0-20250715232539-7130f93afb79 h1:iOye66xuaAK0WnkPuhQPUFy8eJcmwUXqGGP3om6IxX8=
-google.golang.org/genproto/googleapis/api v0.0.0-20250715232539-7130f93afb79/go.mod h1:HKJDgKsFUnv5VAGeQjz8kxcgDP0HoE0iZNp0OdZNlhE=
+google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b h1:ULiyYQ0FdsJhwwZUwbaXpZF5yUE3h+RA+gxvBu37ucc=
+google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:oDOGiMSXHL4sDTJvFvIB9nRQCGdLP1o/iVaqQK8zB+M=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4=
 google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
@@ -2723,8 +2723,8 @@ google.golang.org/grpc v1.52.3/go.mod h1:pu6fVzoFb+NBYNAvQL08ic+lvB2IojljRYuun5v
 google.golang.org/grpc v1.53.0/go.mod h1:OnIrk0ipVdj4N5d9IUoFUx72/VlD7+jUsHwZgwSMQpw=
 google.golang.org/grpc v1.54.0/go.mod h1:PUSEXI6iWghWaB6lXM4knEgpJNu2qUcKfDtNci3EC2g=
 google.golang.org/grpc v1.56.3/go.mod h1:I9bI3vqKfayGqPUAwGdOSu7kt6oIJLixfffKrpXqQ9s=
-google.golang.org/grpc v1.75.1 h1:/ODCNEuf9VghjgO3rqLcfg8fiOP0nSluljWFlDxELLI=
-google.golang.org/grpc v1.75.1/go.mod h1:JtPAzKiq4v1xcAB2hydNlWI2RnF85XXcV0mhKXr2ecQ=
+google.golang.org/grpc v1.76.0 h1:UnVkv1+uMLYXoIz6o7chp59WfQUYA2ex/BXQ9rHZu7A=
+google.golang.org/grpc v1.76.0/go.mod h1:Ju12QI8M6iQJtbcsV+awF5a4hfJMLi4X0JLo94ULZ6c=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=

From 5c8176b7ff05ab88bd348f76ac4cb745a17ab823 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 13 Oct 2025 13:30:16 +0000
Subject: [PATCH 116/298] chore: bump google.golang.org/api from 0.251.0 to
 0.252.0 (#20266)

Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.251.0 to 0.252.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.252.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.251.0...v0.252.0">0.252.0</a>
(2025-10-07)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3326">#3326</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/c9925454087ae745d966061b1e5e091236a23b73">c992545</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3328">#3328</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b9b915b1d871407fd86912eaa5073dec1dd28cd0">b9b915b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3330">#3330</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/fcb7723a725ee8eb73e0fb511c1d5b33c25ebd50">fcb7723</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3331">#3331</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/a67f44d16fb8ee506127e2d411b84e708d4fa4df">a67f44d</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3332">#3332</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b9890fcd362e2b7fe6f2ec4b37257408d5f09edb">b9890fc</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3334">#3334</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/163216d91d6e20831b2cda5400aee0e587cfec18">163216d</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3336">#3336</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/2c4dd78944ebf9f04258ccea6800f57a7cdd8dae">2c4dd78</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.251.0...v0.252.0">0.252.0</a>
(2025-10-07)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3326">#3326</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/c9925454087ae745d966061b1e5e091236a23b73">c992545</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3328">#3328</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b9b915b1d871407fd86912eaa5073dec1dd28cd0">b9b915b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3330">#3330</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/fcb7723a725ee8eb73e0fb511c1d5b33c25ebd50">fcb7723</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3331">#3331</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/a67f44d16fb8ee506127e2d411b84e708d4fa4df">a67f44d</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3332">#3332</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/b9890fcd362e2b7fe6f2ec4b37257408d5f09edb">b9890fc</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3334">#3334</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/163216d91d6e20831b2cda5400aee0e587cfec18">163216d</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3336">#3336</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/2c4dd78944ebf9f04258ccea6800f57a7cdd8dae">2c4dd78</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/88c288c3544fb39b71e48e545d4284f8ffe0c6a1"><code>88c288c</code></a>
chore(main): release 0.252.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3327">#3327</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/2c4dd78944ebf9f04258ccea6800f57a7cdd8dae"><code>2c4dd78</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3336">#3336</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/ceff1a1fca588d5f1e24d6ca53b8888d0c9175b2"><code>ceff1a1</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3333">#3333</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/163216d91d6e20831b2cda5400aee0e587cfec18"><code>163216d</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3334">#3334</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b9890fcd362e2b7fe6f2ec4b37257408d5f09edb"><code>b9890fc</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3332">#3332</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/a67f44d16fb8ee506127e2d411b84e708d4fa4df"><code>a67f44d</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3331">#3331</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/4312741a471f572fe1ee6c0d00c9311265fc3e14"><code>4312741</code></a>
chore: update CODEOWNERS, remove blunderbuss (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3329">#3329</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/fcb7723a725ee8eb73e0fb511c1d5b33c25ebd50"><code>fcb7723</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3330">#3330</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/b9b915b1d871407fd86912eaa5073dec1dd28cd0"><code>b9b915b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3328">#3328</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/c9925454087ae745d966061b1e5e091236a23b73"><code>c992545</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3326">#3326</a>)</li>
<li>See full diff in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.251.0...v0.252.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.251.0&new-version=0.252.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod |  8 ++++----
 go.sum | 16 ++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/go.mod b/go.mod
index 2522e914d00f3..0a29d2478105c 100644
--- a/go.mod
+++ b/go.mod
@@ -206,9 +206,9 @@ require (
 	golang.org/x/text v0.29.0
 	golang.org/x/tools v0.37.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
-	google.golang.org/api v0.251.0
+	google.golang.org/api v0.252.0
 	google.golang.org/grpc v1.76.0
-	google.golang.org/protobuf v1.36.9
+	google.golang.org/protobuf v1.36.10
 	gopkg.in/DataDog/dd-trace-go.v1 v1.74.0
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
@@ -219,7 +219,7 @@ require (
 )
 
 require (
-	cloud.google.com/go/auth v0.16.5 // indirect
+	cloud.google.com/go/auth v0.17.0 // indirect
 	cloud.google.com/go/auth/oauth2adapt v0.2.8 // indirect
 	cloud.google.com/go/logging v1.13.0 // indirect
 	cloud.google.com/go/longrunning v0.6.7 // indirect
@@ -454,7 +454,7 @@ require (
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	howett.net/plist v1.0.0 // indirect
diff --git a/go.sum b/go.sum
index 1202f200291e9..102fd5a725287 100644
--- a/go.sum
+++ b/go.sum
@@ -101,8 +101,8 @@ cloud.google.com/go/assuredworkloads v1.7.0/go.mod h1:z/736/oNmtGAyU47reJgGN+KVo
 cloud.google.com/go/assuredworkloads v1.8.0/go.mod h1:AsX2cqyNCOvEQC8RMPnoc0yEarXQk6WEKkxYfL6kGIo=
 cloud.google.com/go/assuredworkloads v1.9.0/go.mod h1:kFuI1P78bplYtT77Tb1hi0FMxM0vVpRC7VVoJC3ZoT0=
 cloud.google.com/go/assuredworkloads v1.10.0/go.mod h1:kwdUQuXcedVdsIaKgKTp9t0UJkE5+PAVNhdQm4ZVq2E=
-cloud.google.com/go/auth v0.16.5 h1:mFWNQ2FEVWAliEQWpAdH80omXFokmrnbDhUS9cBywsI=
-cloud.google.com/go/auth v0.16.5/go.mod h1:utzRfHMP+Vv0mpOkTRQoWD2q3BatTOoWbA7gCc2dUhQ=
+cloud.google.com/go/auth v0.17.0 h1:74yCm7hCj2rUyyAocqnFzsAYXgJhrG26XCFimrc/Kz4=
+cloud.google.com/go/auth v0.17.0/go.mod h1:6wv/t5/6rOPAX4fJiRjKkJCvswLwdet7G8+UGXt7nCQ=
 cloud.google.com/go/auth/oauth2adapt v0.2.8 h1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=
 cloud.google.com/go/auth/oauth2adapt v0.2.8/go.mod h1:XQ9y31RkqZCcwJWNSx2Xvric3RrU88hAYYbjDWYDL+c=
 cloud.google.com/go/automl v1.5.0/go.mod h1:34EjfoFGMZ5sgJ9EoLsRtdPSNZLcfflJR39VbVNS2M0=
@@ -2534,8 +2534,8 @@ google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/
 google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
 google.golang.org/api v0.111.0/go.mod h1:qtFHvU9mhgTJegR31csQ+rwxyUTHOKFqCKWp1J0fdw0=
 google.golang.org/api v0.114.0/go.mod h1:ifYI2ZsFK6/uGddGfAD5BMxlnkBqCmqHSDUVi45N5Yg=
-google.golang.org/api v0.251.0 h1:6lea5nHRT8RUmpy9kkC2PJYnhnDAB13LqrLSVQlMIE8=
-google.golang.org/api v0.251.0/go.mod h1:Rwy0lPf/TD7+T2VhYcffCHhyyInyuxGjICxdfLqT7KI=
+google.golang.org/api v0.252.0 h1:xfKJeAJaMwb8OC9fesr369rjciQ704AjU/psjkKURSI=
+google.golang.org/api v0.252.0/go.mod h1:dnHOv81x5RAmumZ7BWLShB/u7JZNeyalImxHmtTHxqw=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2680,8 +2680,8 @@ google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 h1:Nt6z9UHqSlIdIGJ
 google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79/go.mod h1:kTmlBHMPqR5uCZPBvwa2B18mvubkjyY3CRLI0c6fj0s=
 google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b h1:ULiyYQ0FdsJhwwZUwbaXpZF5yUE3h+RA+gxvBu37ucc=
 google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:oDOGiMSXHL4sDTJvFvIB9nRQCGdLP1o/iVaqQK8zB+M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4 h1:i8QOKZfYg6AbGVZzUAY3LrNWCKF8O6zFisU9Wl9RER4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250929231259-57b25ae835d4/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=
@@ -2744,8 +2744,8 @@ google.golang.org/protobuf v1.28.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqw
 google.golang.org/protobuf v1.29.1/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.30.0/go.mod h1:HV8QOd/L58Z+nl8r43ehVNZIU/HEI6OcFqwMG9pJV4I=
 google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
-google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
-google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
+google.golang.org/protobuf v1.36.10 h1:AYd7cD/uASjIL6Q9LiTjz8JLcrh/88q5UObnmY3aOOE=
+google.golang.org/protobuf v1.36.10/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
 gopkg.in/DataDog/dd-trace-go.v1 v1.74.0 h1:wScziU1ff6Bnyr8MEyxATPSLJdnLxKz3p6RsA8FUaek=
 gopkg.in/DataDog/dd-trace-go.v1 v1.74.0/go.mod h1:ReNBsNfnsjVC7GsCe80zRcykL/n+nxvsNrg3NbjuleM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=

From 9158e46bdad9766a1d9f5dddd6d6d8d50cf5593c Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Mon, 13 Oct 2025 15:11:34 +0100
Subject: [PATCH 117/298] chore: upgrade coder/clistat to v1.1.0 (#20280)

Upgrades coder/clistat to v1.1.0. This version contains a significant
refactor to the cgroupv2 implementation that improves how we calculate
memory and cpu limits.
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 0a29d2478105c..a4c53bd6ac606 100644
--- a/go.mod
+++ b/go.mod
@@ -462,7 +462,7 @@ require (
 	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
-require github.com/coder/clistat v1.0.2
+require github.com/coder/clistat v1.1.0
 
 require github.com/SherClockHolmes/webpush-go v1.4.0
 
diff --git a/go.sum b/go.sum
index 102fd5a725287..e86141f3a6491 100644
--- a/go.sum
+++ b/go.sum
@@ -919,8 +919,8 @@ github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945/go.mod h1:d1AMFw81rUgrGHuZzWdPNhkY0G8w7pvLNLYF0e3ceC4=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41 h1:SBN/DA63+ZHwuWwPHPYoCZ/KLAjHv5g4h2MS4f2/MTI=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41/go.mod h1:I9ULxr64UaOSUv7hcb3nX4kowodJCVS7vt7VVJk/kW4=
-github.com/coder/clistat v1.0.2 h1:9SjtcTVMGfM5LbdhjnkyxO3RCngrLvVu1+NXBs9QUy0=
-github.com/coder/clistat v1.0.2/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
+github.com/coder/clistat v1.1.0 h1:RTCLX+0/Uur/qFHSlbT2lKen+fWdicSlT9AMaF5jZWs=
+github.com/coder/clistat v1.1.0/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
 github.com/coder/flog v1.1.0 h1:kbAes1ai8fIS5OeV+QAnKBQE22ty1jRF/mcAwHpLBa4=
 github.com/coder/flog v1.1.0/go.mod h1:UQlQvrkJBvnRGo69Le8E24Tcl5SJleAAR7gYEHzAmdQ=
 github.com/coder/glog v1.0.1-0.20220322161911-7365fe7f2cd1/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=

From 152103bf788dc5a4c06586302a255a212e0fe77d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= <pawel@coder.com>
Date: Tue, 14 Oct 2025 09:28:10 +0200
Subject: [PATCH 118/298] fix: add default value for RevokeURL property in
 external auth config for GitHub (#20272)

This PR adds setting default value of `RevokeURL` property of external
auth config for GitHub.
---
 coderd/externalauth/externalauth.go | 38 ++++++++++++++++++++---------
 1 file changed, 26 insertions(+), 12 deletions(-)

diff --git a/coderd/externalauth/externalauth.go b/coderd/externalauth/externalauth.go
index f1ab1cd0388be..f33a9d36700b8 100644
--- a/coderd/externalauth/externalauth.go
+++ b/coderd/externalauth/externalauth.go
@@ -781,6 +781,9 @@ func applyDefaultsToConfig(config *codersdk.ExternalAuthConfig) {
 
 	// Dynamic defaults
 	switch codersdk.EnhancedExternalAuthProvider(config.Type) {
+	case codersdk.EnhancedExternalAuthProviderGitHub:
+		copyDefaultSettings(config, gitHubDefaults(config))
+		return
 	case codersdk.EnhancedExternalAuthProviderGitLab:
 		copyDefaultSettings(config, gitlabDefaults(config))
 		return
@@ -855,6 +858,29 @@ func copyDefaultSettings(config *codersdk.ExternalAuthConfig, defaults codersdk.
 	}
 }
 
+// gitHubDefaults returns default config values for GitHub.
+// The only dynamic value is the revocation URL which depends on client ID.
+func gitHubDefaults(config *codersdk.ExternalAuthConfig) codersdk.ExternalAuthConfig {
+	defaults := codersdk.ExternalAuthConfig{
+		AuthURL:     xgithub.Endpoint.AuthURL,
+		TokenURL:    xgithub.Endpoint.TokenURL,
+		ValidateURL: "https://api.github.com/user",
+		DisplayName: "GitHub",
+		DisplayIcon: "/icon/github.svg",
+		Regex:       `^(https?://)?github\.com(/.*)?$`,
+		// "workflow" is required for managing GitHub Actions in a repository.
+		Scopes:              []string{"repo", "workflow"},
+		DeviceCodeURL:       "https://github.com/login/device/code",
+		AppInstallationsURL: "https://api.github.com/user/installations",
+	}
+
+	if config.RevokeURL == "" && config.ClientID != "" {
+		defaults.RevokeURL = fmt.Sprintf("https://api.github.com/applications/%s/grant", config.ClientID)
+	}
+
+	return defaults
+}
+
 func bitbucketServerDefaults(config *codersdk.ExternalAuthConfig) codersdk.ExternalAuthConfig {
 	defaults := codersdk.ExternalAuthConfig{
 		DisplayName: "Bitbucket Server",
@@ -1053,18 +1079,6 @@ var staticDefaults = map[codersdk.EnhancedExternalAuthProvider]codersdk.External
 		Regex:       `^(https?://)?bitbucket\.org(/.*)?$`,
 		Scopes:      []string{"account", "repository:write"},
 	},
-	codersdk.EnhancedExternalAuthProviderGitHub: {
-		AuthURL:     xgithub.Endpoint.AuthURL,
-		TokenURL:    xgithub.Endpoint.TokenURL,
-		ValidateURL: "https://api.github.com/user",
-		DisplayName: "GitHub",
-		DisplayIcon: "/icon/github.svg",
-		Regex:       `^(https?://)?github\.com(/.*)?$`,
-		// "workflow" is required for managing GitHub Actions in a repository.
-		Scopes:              []string{"repo", "workflow"},
-		DeviceCodeURL:       "https://github.com/login/device/code",
-		AppInstallationsURL: "https://api.github.com/user/installations",
-	},
 	codersdk.EnhancedExternalAuthProviderSlack: {
 		AuthURL:     "https://slack.com/oauth/v2/authorize",
 		TokenURL:    "https://slack.com/api/oauth.v2.access",

From 9c6be5bfe7d80010c366238465ab8050531eefa4 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Tue, 14 Oct 2025 11:25:18 +0100
Subject: [PATCH 119/298] ci(.github/workflows/traiage.yaml): explicitly fetch
 comments in gh cli invocation (#20288)

Closes https://github.com/coder/internal/issues/1053

Updated the `gh` command to fetch issue description with explicit JSON
fields and formatting.

Validated with manual workflow run:
https://github.com/coder/coder/actions/runs/18492815891/job/52690197479

Agent picked up additional instruction from comments:
https://github.com/coder/coder/compare/cian/traiage-gh-20085-18492815891

<img width="1339" height="406" alt="Screenshot 2025-10-14 at 11 02 36"
src="https://github.com/user-attachments/assets/c3daf103-3d88-4f11-b5ee-d3596912aaa8"
/>
---
 .github/workflows/traiage.yaml | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 566cfc78419bc..2749e07a4f63f 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -189,7 +189,10 @@ jobs:
           TEMPLATE_PRESET: ${{ steps.determine-inputs.outputs.template_preset }}
         run: |
           # Fetch issue description using `gh` CLI
-          issue_description=$(gh issue view "${ISSUE_URL}")
+          #shellcheck disable=SC2016 # The template string should not be subject to shell expansion
+          issue_description=$(gh issue view "${ISSUE_URL}" \
+            --json 'title,body,comments' \
+            --template '{{printf "%s\n\n%s\n\nComments:\n" .title .body}}{{range $k, $v := .comments}}  - {{index $v.author "login"}}: {{printf "%s\n" $v.body}}{{end}}')
 
           # Write a prompt to PROMPT_FILE
           PROMPT=$(cat <<EOF

From 06db58771f5d5831673e21dd3fc2465b246b24ad Mon Sep 17 00:00:00 2001
From: Sas Swart <sas.swart.cdk@gmail.com>
Date: Tue, 14 Oct 2025 13:20:43 +0200
Subject: [PATCH 120/298] docs: add troubleshooting steps for prebuilt
 workspaces (#20231)

This PR adds troubleshooting steps to guide Coder operators when they
suspect that prebuilds might have overwhelmed their deployments.

Closes https://github.com/coder/coder/issues/19490

---------

Co-authored-by: Susana Ferreira <susana@coder.com>
---
 .github/.linkspector.yml                      |  1 +
 .../prebuilt-workspaces.md                    | 78 ++++++++++++++++++-
 2 files changed, 78 insertions(+), 1 deletion(-)

diff --git a/.github/.linkspector.yml b/.github/.linkspector.yml
index f5f99caf57708..cd052c53b251e 100644
--- a/.github/.linkspector.yml
+++ b/.github/.linkspector.yml
@@ -26,5 +26,6 @@ ignorePatterns:
   - pattern: "claude.ai"
   - pattern: "splunk.com"
   - pattern: "stackoverflow.com/questions"
+  - pattern: "developer.hashicorp.com/terraform/language"
 aliveStatusCodes:
   - 200
diff --git a/docs/admin/templates/extending-templates/prebuilt-workspaces.md b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
index 61734679d4c7d..bc0ba1c1c3fbd 100644
--- a/docs/admin/templates/extending-templates/prebuilt-workspaces.md
+++ b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
@@ -247,6 +247,82 @@ When prebuilt workspaces are configured for an organization, Coder creates a "pr
 
 If a quota is exceeded, the prebuilt workspace will fail provisioning the same way other workspaces do.
 
+### Managing prebuild provisioning queues
+
+Prebuilt workspaces can overwhelm a Coder deployment, causing significant delays when users and template administrators create new workspaces or manage their templates. Fundamentally, this happens when provisioners are not able to meet the demand for provisioner jobs. Prebuilds contribute to provisioner demand by scheduling many jobs in bursts whenever templates are updated. The solution is to either increase the number of provisioners or decrease the number of requested prebuilt workspaces across the entire system.
+
+To identify if prebuilt workspaces have overwhelmed the available provisioners in your Coder deployment, look for:
+
+- Large or growing queue of prebuild-related jobs
+- User workspace creation is slow
+- Publishing a new template version is not reflected in the UI because the associated template import job has not yet finished
+
+The troubleshooting steps below will help you assess and resolve this situation:
+
+1) Pause prebuilt workspace reconciliation to stop the problem from getting worse
+2) Check how many prebuild jobs are clogging your provisioner queue
+3) Cancel excess prebuild jobs to free up provisioners for human users
+4) Fix any problematic templates that are causing the issue
+5) Resume prebuilt reconciliation once everything is back to normal
+
+#### Pause prebuilds to limit potential impact
+
+Run:
+
+```bash
+coder prebuilds pause
+```
+
+This prevents further pollution of your provisioner queues by stopping the prebuilt workspaces feature from scheduling new creation jobs. While the pause is in effect, no new prebuilt workspaces will be scheduled for any templates in any organizations across the entire Coder deployment.  Therefore, the command must be executed by a user with Owner level access. Existing prebuilt workspaces will remain in place.
+
+**Important**: Remember to run `coder prebuilds resume` once all impact has been mitigated (see the last step in this section).
+
+#### Assess prebuild queue impact
+
+Next, run:
+
+```bash
+coder provisioner jobs list --status=pending --initiator=prebuilds
+```
+
+This will show a list of all pending jobs that have been enqueued by the prebuilt workspace system. The length of this list indicates whether prebuilt workspaces have overwhelmed your Coder deployment.
+
+Human-initiated jobs have priority over pending prebuild jobs, but running prebuild jobs cannot be preempted. A long list of pending prebuild jobs increases the likelihood that all provisioners are already occupied when a user wants to create a workspace or import a new template version. This increases the likelihood that users will experience delays waiting for the next available provisioner.
+
+#### Cancel pending prebuild jobs
+
+Human-initiated jobs are prioritized above prebuild jobs in the provisioner queue. However, if no human-initiated jobs are queued when a provisioner becomes available, a prebuild job will occupy the provisioner. This can delay human-initiated jobs that arrive later, forcing them to wait for the next available provisioner.
+
+To expedite fixing a broken template by ensuring maximum provisioner availability, cancel all pending prebuild jobs:
+
+```bash
+coder provisioner jobs list --status=pending --initiator=prebuilds | jq -r '.[].id' | xargs -n1 -P2 -I{} coder provisioner jobs cancel {}
+```
+
+This will clear the provisioner queue of all jobs that were not initiated by a human being, which increases the probability that a provisioner will be available when the next human operator needs it. It does not cancel running provisioner jobs, so there may still be some delay in processing new provisioner jobs until a provisioner completes its current job.
+
+At this stage, most prebuild related impact will have been mitigated. There may still be a bugged template version, but it will no longer pollute provisioner queues with prebuilt workspace jobs. If the latest version of a template is also broken for reasons unrelated to prebuilds, then users are able to create workspaces using a previous template version. Some running jobs may have been initiated by the prebuild system, but these cannot be cancelled without potentially orphaning resources that have already been deployed by Terraform. Depending on your deployment and template provisioning times, it might be best to upload a new template version and wait for it to be processed organically.
+
+#### Cancel running prebuild provisioning jobs (Optional)
+
+If you need to expedite the processing of human-related jobs at the cost of some infrastructure housekeeping, you can run:
+
+```bash
+coder provisioner jobs list --status=running --initiator=prebuilds | jq -r '.[].id' | xargs -n1 -P2 -I{} coder provisioner jobs cancel {}
+```
+
+This should be done as a last resort. It will cancel running prebuild jobs (orphaning any resources that have already been deployed) and immediately make room for human-initiated jobs. Orphaned infrastructure will need to be manually cleaned up by a human operator. The process to identify and clear these orphaned resources will likely require administrative access to the infrastructure that hosts Coder workspaces. Furthermore, the ability to identify such orphaned resources will depend on metadata that should be included in the workspace template.
+
+Once the provisioner queue has been cleared and all templates have been fixed, resume prebuild reconciliation by running:
+
+#### Resume prebuild reconciliation
+
+```bash
+coder prebuilds resume
+```
+
+This re-enables the prebuilt workspaces feature and allows the reconciliation loop to resume normal operation. The system will begin creating new prebuilt workspaces according to your template configurations.
+
 ### Template configuration best practices
 
 #### Preventing resource replacement
@@ -280,7 +356,7 @@ resource "docker_container" "workspace" {
 Limit the scope of `ignore_changes` to include only the fields specified in the notification.
 If you include too many fields, Terraform might ignore changes that wouldn't otherwise cause drift.
 
-Learn more about `ignore_changes` in the [Terraform documentation](https://developer.hashicorp.com/terraform/language/meta-arguments/lifecycle#ignore_changes).
+Learn more about `ignore_changes` in the [Terraform documentation](https://developer.hashicorp.com/terraform/language/meta-arguments#lifecycle).
 
 _A note on "immutable" attributes: Terraform providers may specify `ForceNew` on their resources' attributes. Any change
 to these attributes require the replacement (destruction and recreation) of the managed resource instance, rather than an in-place update.

From 9f229370e79365f7ac0bb75404dbb83a278a12d6 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Tue, 14 Oct 2025 17:33:30 +0100
Subject: [PATCH 121/298] feat(coderd/database): add ListTasks query (#20282)

Relates to https://github.com/coder/internal/issues/981

Adds a `ListTasks` query that allows filtering by OwnerID and OrganizationID.
---
 coderd/database/dbauthz/dbauthz.go        |   5 +
 coderd/database/dbauthz/dbauthz_test.go   |  12 ++
 coderd/database/dbmetrics/querymetrics.go |   7 ++
 coderd/database/dbmock/dbmock.go          |  15 +++
 coderd/database/querier.go                |   1 +
 coderd/database/querier_test.go           | 136 ++++++++++++++++++++++
 coderd/database/queries.sql.go            |  48 ++++++++
 coderd/database/queries/tasks.sql         |   7 ++
 8 files changed, 231 insertions(+)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 0d2a5f4435790..c291464604375 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -4485,6 +4485,11 @@ func (q *querier) ListProvisionerKeysByOrganizationExcludeReserved(ctx context.C
 	return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.ListProvisionerKeysByOrganizationExcludeReserved)(ctx, organizationID)
 }
 
+func (q *querier) ListTasks(ctx context.Context, arg database.ListTasksParams) ([]database.Task, error) {
+	// TODO(Cian): replace this with a sql filter for improved performance. https://github.com/coder/internal/issues/1061
+	return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.ListTasks)(ctx, arg)
+}
+
 func (q *querier) ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]database.UserSecret, error) {
 	obj := rbac.ResourceUserSecret.WithOwner(userID.String())
 	if err := q.authorizeContext(ctx, policy.ActionRead, obj); err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 4034a4878f309..f65a65c3228b5 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -2392,6 +2392,18 @@ func (s *MethodTestSuite) TestTasks() {
 		dbm.EXPECT().GetTaskByWorkspaceID(gomock.Any(), task.WorkspaceID.UUID).Return(task, nil).AnyTimes()
 		check.Args(task.WorkspaceID.UUID).Asserts(task, policy.ActionRead).Returns(task)
 	}))
+	s.Run("ListTasks", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		u1 := testutil.Fake(s.T(), faker, database.User{})
+		u2 := testutil.Fake(s.T(), faker, database.User{})
+		org1 := testutil.Fake(s.T(), faker, database.Organization{})
+		org2 := testutil.Fake(s.T(), faker, database.Organization{})
+		_ = testutil.Fake(s.T(), faker, database.OrganizationMember{UserID: u1.ID, OrganizationID: org1.ID})
+		_ = testutil.Fake(s.T(), faker, database.OrganizationMember{UserID: u2.ID, OrganizationID: org2.ID})
+		t1 := testutil.Fake(s.T(), faker, database.Task{OwnerID: u1.ID})
+		t2 := testutil.Fake(s.T(), faker, database.Task{OwnerID: u2.ID})
+		dbm.EXPECT().ListTasks(gomock.Any(), gomock.Any()).Return([]database.Task{t1, t2}, nil).AnyTimes()
+		check.Args(database.ListTasksParams{}).Asserts(t1, policy.ActionRead, t2, policy.ActionRead).Returns([]database.Task{t1, t2})
+	}))
 }
 
 func (s *MethodTestSuite) TestProvisionerKeys() {
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 5f191fe66372e..675cc81b01148 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -2735,6 +2735,13 @@ func (m queryMetricsStore) ListProvisionerKeysByOrganizationExcludeReserved(ctx
 	return r0, r1
 }
 
+func (m queryMetricsStore) ListTasks(ctx context.Context, arg database.ListTasksParams) ([]database.Task, error) {
+	start := time.Now()
+	r0, r1 := m.s.ListTasks(ctx, arg)
+	m.queryLatencies.WithLabelValues("ListTasks").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]database.UserSecret, error) {
 	start := time.Now()
 	r0, r1 := m.s.ListUserSecrets(ctx, userID)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 9dc5f1adf2562..d6e07b77dab43 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -5848,6 +5848,21 @@ func (mr *MockStoreMockRecorder) ListProvisionerKeysByOrganizationExcludeReserve
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListProvisionerKeysByOrganizationExcludeReserved", reflect.TypeOf((*MockStore)(nil).ListProvisionerKeysByOrganizationExcludeReserved), ctx, organizationID)
 }
 
+// ListTasks mocks base method.
+func (m *MockStore) ListTasks(ctx context.Context, arg database.ListTasksParams) ([]database.Task, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListTasks", ctx, arg)
+	ret0, _ := ret[0].([]database.Task)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListTasks indicates an expected call of ListTasks.
+func (mr *MockStoreMockRecorder) ListTasks(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListTasks", reflect.TypeOf((*MockStore)(nil).ListTasks), ctx, arg)
+}
+
 // ListUserSecrets mocks base method.
 func (m *MockStore) ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]database.UserSecret, error) {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 48bd064e20f93..097d8901ddedc 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -595,6 +595,7 @@ type sqlcQuerier interface {
 	ListAIBridgeUserPromptsByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeUserPrompt, error)
 	ListProvisionerKeysByOrganization(ctx context.Context, organizationID uuid.UUID) ([]ProvisionerKey, error)
 	ListProvisionerKeysByOrganizationExcludeReserved(ctx context.Context, organizationID uuid.UUID) ([]ProvisionerKey, error)
+	ListTasks(ctx context.Context, arg ListTasksParams) ([]Task, error)
 	ListUserSecrets(ctx context.Context, userID uuid.UUID) ([]UserSecret, error)
 	ListWorkspaceAgentPortShares(ctx context.Context, workspaceID uuid.UUID) ([]WorkspaceAgentPortShare, error)
 	MarkAllInboxNotificationsAsRead(ctx context.Context, arg MarkAllInboxNotificationsAsReadParams) error
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 01584a03ba3a0..9db6f585fbaa3 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -7314,3 +7314,139 @@ func TestUsageEventsTrigger(t *testing.T) {
 		require.Len(t, rows, 0)
 	})
 }
+
+func TestListTasks(t *testing.T) {
+	t.Parallel()
+
+	db, ps := dbtestutil.NewDB(t)
+
+	// Given: two organizations and two users, one of which is a member of both
+	org1 := dbgen.Organization(t, db, database.Organization{})
+	org2 := dbgen.Organization(t, db, database.Organization{})
+	user1 := dbgen.User(t, db, database.User{})
+	user2 := dbgen.User(t, db, database.User{})
+	_ = dbgen.OrganizationMember(t, db, database.OrganizationMember{
+		OrganizationID: org1.ID,
+		UserID:         user1.ID,
+	})
+	_ = dbgen.OrganizationMember(t, db, database.OrganizationMember{
+		OrganizationID: org2.ID,
+		UserID:         user2.ID,
+	})
+
+	// Given: a template with an active version
+	tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+		CreatedBy:      user1.ID,
+		OrganizationID: org1.ID,
+	})
+	tpl := dbgen.Template(t, db, database.Template{
+		CreatedBy:       user1.ID,
+		OrganizationID:  org1.ID,
+		ActiveVersionID: tv.ID,
+	})
+
+	// Helper function to create a task
+	createTask := func(orgID, ownerID uuid.UUID) database.TaskTable {
+		ws := dbgen.Workspace(t, db, database.WorkspaceTable{
+			OrganizationID: orgID,
+			OwnerID:        ownerID,
+			TemplateID:     tpl.ID,
+		})
+		pj := dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{})
+		sidebarAppID := uuid.New()
+		_ = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+			JobID:             pj.ID,
+			TemplateVersionID: tv.ID,
+			WorkspaceID:       ws.ID,
+		})
+		wr := dbgen.WorkspaceResource(t, db, database.WorkspaceResource{
+			JobID: pj.ID,
+		})
+		agt := dbgen.WorkspaceAgent(t, db, database.WorkspaceAgent{
+			ResourceID: wr.ID,
+		})
+		wa := dbgen.WorkspaceApp(t, db, database.WorkspaceApp{
+			ID:      sidebarAppID,
+			AgentID: agt.ID,
+		})
+		tsk := dbgen.Task(t, db, database.TaskTable{
+			OrganizationID:    orgID,
+			OwnerID:           ownerID,
+			Prompt:            testutil.GetRandomName(t),
+			TemplateVersionID: tv.ID,
+			WorkspaceID:       uuid.NullUUID{UUID: ws.ID, Valid: true},
+		})
+		_ = dbgen.TaskWorkspaceApp(t, db, database.TaskWorkspaceApp{
+			TaskID:           tsk.ID,
+			WorkspaceAgentID: uuid.NullUUID{Valid: true, UUID: agt.ID},
+			WorkspaceAppID:   uuid.NullUUID{Valid: true, UUID: wa.ID},
+		})
+		t.Logf("task_id:%s owner_id:%s org_id:%s", tsk.ID, ownerID, orgID)
+		return tsk
+	}
+
+	// Given: user1 has one task, user2 has one task, user3 has two tasks (one in each org)
+	task1 := createTask(org1.ID, user1.ID)
+	task2 := createTask(org1.ID, user2.ID)
+	task3 := createTask(org2.ID, user2.ID)
+
+	// Then: run various filters and assert expected results
+	for _, tc := range []struct {
+		name      string
+		filter    database.ListTasksParams
+		expectIDs []uuid.UUID
+	}{
+		{
+			name: "no filter",
+			filter: database.ListTasksParams{
+				OwnerID:        uuid.Nil,
+				OrganizationID: uuid.Nil,
+			},
+			expectIDs: []uuid.UUID{task3.ID, task2.ID, task1.ID},
+		},
+		{
+			name: "filter by user ID",
+			filter: database.ListTasksParams{
+				OwnerID:        user1.ID,
+				OrganizationID: uuid.Nil,
+			},
+			expectIDs: []uuid.UUID{task1.ID},
+		},
+		{
+			name: "filter by organization ID",
+			filter: database.ListTasksParams{
+				OwnerID:        uuid.Nil,
+				OrganizationID: org1.ID,
+			},
+			expectIDs: []uuid.UUID{task2.ID, task1.ID},
+		},
+		{
+			name: "filter by user and organization ID",
+			filter: database.ListTasksParams{
+				OwnerID:        user2.ID,
+				OrganizationID: org2.ID,
+			},
+			expectIDs: []uuid.UUID{task3.ID},
+		},
+		{
+			name: "no results",
+			filter: database.ListTasksParams{
+				OwnerID:        user1.ID,
+				OrganizationID: org2.ID,
+			},
+			expectIDs: nil,
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			ctx := testutil.Context(t, testutil.WaitShort)
+			tasks, err := db.ListTasks(ctx, tc.filter)
+			if assert.NoError(t, err) {
+				require.Len(t, tasks, len(tc.expectIDs))
+				for idx, eid := range tc.expectIDs {
+					assert.Equal(t, eid.String(), tasks[idx].ID.String())
+				}
+			}
+		})
+	}
+}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 59ed5699502a7..558ace2fbe1af 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12599,6 +12599,54 @@ func (q *sqlQuerier) InsertTask(ctx context.Context, arg InsertTaskParams) (Task
 	return i, err
 }
 
+const listTasks = `-- name: ListTasks :many
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status FROM tasks_with_status tws
+WHERE tws.deleted_at IS NULL
+AND CASE WHEN $1::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = $1::UUID ELSE TRUE END
+AND CASE WHEN $2::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = $2::UUID ELSE TRUE END
+ORDER BY tws.created_at DESC
+`
+
+type ListTasksParams struct {
+	OwnerID        uuid.UUID `db:"owner_id" json:"owner_id"`
+	OrganizationID uuid.UUID `db:"organization_id" json:"organization_id"`
+}
+
+func (q *sqlQuerier) ListTasks(ctx context.Context, arg ListTasksParams) ([]Task, error) {
+	rows, err := q.db.QueryContext(ctx, listTasks, arg.OwnerID, arg.OrganizationID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []Task
+	for rows.Next() {
+		var i Task
+		if err := rows.Scan(
+			&i.ID,
+			&i.OrganizationID,
+			&i.OwnerID,
+			&i.Name,
+			&i.WorkspaceID,
+			&i.TemplateVersionID,
+			&i.TemplateParameters,
+			&i.Prompt,
+			&i.CreatedAt,
+			&i.DeletedAt,
+			&i.Status,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const upsertTaskWorkspaceApp = `-- name: UpsertTaskWorkspaceApp :one
 INSERT INTO task_workspace_apps
 	(task_id, workspace_build_number, workspace_agent_id, workspace_app_id)
diff --git a/coderd/database/queries/tasks.sql b/coderd/database/queries/tasks.sql
index fbdb46d9f9701..0ce0b6f85fe0a 100644
--- a/coderd/database/queries/tasks.sql
+++ b/coderd/database/queries/tasks.sql
@@ -21,3 +21,10 @@ SELECT * FROM tasks_with_status WHERE id = @id::uuid;
 
 -- name: GetTaskByWorkspaceID :one
 SELECT * FROM tasks_with_status WHERE workspace_id = @workspace_id::uuid;
+
+-- name: ListTasks :many
+SELECT * FROM tasks_with_status tws
+WHERE tws.deleted_at IS NULL
+AND CASE WHEN @owner_id::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = @owner_id::UUID ELSE TRUE END
+AND CASE WHEN @organization_id::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = @organization_id::UUID ELSE TRUE END
+ORDER BY tws.created_at DESC;

From 3dd3859ebfa60a72299c41b489f1e403ec72c8c2 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Tue, 14 Oct 2025 13:47:02 -0300
Subject: [PATCH 122/298] chore: add task feedback dialog component (#20252)

Related to https://github.com/coder/coder/issues/20214

This PR aims to add only the FE component for capturing user feedback
from tasks. Once the BE work is completed (in a separate PR), this
component will be triggered after a task is deleted.

The goal is to develop this feature in parallel.

**Screenshot:**
<img width="1206" height="727" alt="Screenshot 2025-10-09 at 14 31 53"
src="https://github.com/user-attachments/assets/1f92026c-8f05-4535-bbd6-85c4b107c037"
/>
---
 site/src/api/api.ts                           |  16 ++
 site/src/components/Dialog/Dialog.tsx         |   2 +-
 .../TaskFeedbackDialog.stories.tsx            | 120 ++++++++++++++
 .../TaskFeedbackDialog/TaskFeedbackDialog.tsx | 147 ++++++++++++++++++
 4 files changed, 284 insertions(+), 1 deletion(-)
 create mode 100644 site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.stories.tsx
 create mode 100644 site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.tsx

diff --git a/site/src/api/api.ts b/site/src/api/api.ts
index f5b47ed824cde..a5c9148b017a0 100644
--- a/site/src/api/api.ts
+++ b/site/src/api/api.ts
@@ -2669,6 +2669,13 @@ class ApiMethods {
 //
 // All methods must be defined with arrow function syntax. See the docstring
 // above the ApiMethods class for a full explanation.
+
+export type TaskFeedbackRating = "good" | "okay" | "bad";
+
+export type CreateTaskFeedbackRequest = {
+	rate: TaskFeedbackRating;
+	comment?: string;
+};
 class ExperimentalApiMethods {
 	constructor(protected readonly axios: AxiosInstance) {}
 
@@ -2732,6 +2739,15 @@ class ExperimentalApiMethods {
 	deleteTask = async (user: string, id: string): Promise<void> => {
 		await this.axios.delete(`/api/experimental/tasks/${user}/${id}`);
 	};
+
+	createTaskFeedback = async (
+		_taskId: string,
+		_req: CreateTaskFeedbackRequest,
+	) => {
+		return new Promise<void>((res) => {
+			setTimeout(() => res(), 500);
+		});
+	};
 }
 
 // This is a hard coded CSRF token/cookie pair for local development. In prod,
diff --git a/site/src/components/Dialog/Dialog.tsx b/site/src/components/Dialog/Dialog.tsx
index 13484f1840f69..61a6ee9f8d619 100644
--- a/site/src/components/Dialog/Dialog.tsx
+++ b/site/src/components/Dialog/Dialog.tsx
@@ -19,7 +19,7 @@ export const DialogTrigger = DialogPrimitive.Trigger;
 
 const DialogPortal = DialogPrimitive.Portal;
 
-const _DialogClose = DialogPrimitive.Close;
+export const DialogClose = DialogPrimitive.Close;
 
 const DialogOverlay = forwardRef<
 	ElementRef<typeof DialogPrimitive.Overlay>,
diff --git a/site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.stories.tsx b/site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.stories.tsx
new file mode 100644
index 0000000000000..d1e8e4ddbbde3
--- /dev/null
+++ b/site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.stories.tsx
@@ -0,0 +1,120 @@
+import { MockTask, mockApiError } from "testHelpers/entities";
+import { withGlobalSnackbar } from "testHelpers/storybook";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { API } from "api/api";
+import { expect, spyOn, userEvent, within } from "storybook/test";
+import { TaskFeedbackDialog } from "./TaskFeedbackDialog";
+
+const meta: Meta<typeof TaskFeedbackDialog> = {
+	title: "modules/tasks/TaskFeedbackDialog",
+	component: TaskFeedbackDialog,
+	args: {
+		taskId: MockTask.id,
+		open: true,
+	},
+};
+
+export default meta;
+type Story = StoryObj<typeof TaskFeedbackDialog>;
+
+export const Idle: Story = {};
+
+export const Submitting: Story = {
+	beforeEach: async () => {
+		spyOn(API.experimental, "createTaskFeedback").mockImplementation(() => {
+			return new Promise(() => {});
+		});
+	},
+	play: async ({ canvasElement, step }) => {
+		const body = within(canvasElement.ownerDocument.body);
+
+		step("fill and submit the form", async () => {
+			const regularOption = body.getByLabelText(
+				"It sort of worked, but struggled a lot",
+			);
+			userEvent.click(regularOption);
+
+			const commentTextarea = body.getByRole("textbox", {
+				name: "Additional comments",
+			});
+			await userEvent.type(commentTextarea, "This is my comment");
+
+			const submitButton = body.getByRole("button", {
+				name: "Submit Feedback",
+			});
+			await userEvent.click(submitButton);
+		});
+	},
+};
+
+export const Success: Story = {
+	args: {
+		open: true,
+	},
+	decorators: [withGlobalSnackbar],
+	beforeEach: async () => {
+		spyOn(API.experimental, "createTaskFeedback").mockResolvedValue();
+	},
+	play: async ({ canvasElement, step }) => {
+		const body = within(canvasElement.ownerDocument.body);
+
+		step("fill and submit the form", async () => {
+			const regularOption = body.getByLabelText(
+				"It sort of worked, but struggled a lot",
+			);
+			userEvent.click(regularOption);
+
+			const commentTextarea = body.getByRole("textbox", {
+				name: "Additional comments",
+			});
+			await userEvent.type(commentTextarea, "This is my comment");
+
+			const submitButton = body.getByRole("button", {
+				name: "Submit Feedback",
+			});
+			await userEvent.click(submitButton);
+		});
+
+		step("submitted successfully", async () => {
+			await body.findByText("Feedback submitted successfully");
+			expect(API.experimental.createTaskFeedback).toHaveBeenCalledWith(
+				MockTask.id,
+				{
+					rate: "regular",
+					comment: "This is my comment",
+				},
+			);
+		});
+	},
+};
+
+export const Failure: Story = {
+	beforeEach: async () => {
+		spyOn(API.experimental, "createTaskFeedback").mockRejectedValue(
+			mockApiError({
+				message: "Failed to submit feedback",
+				detail: "Server is down",
+			}),
+		);
+	},
+	play: async ({ canvasElement, step }) => {
+		const body = within(canvasElement.ownerDocument.body);
+
+		step("fill and submit the form", async () => {
+			const regularOption = body.getByLabelText(
+				"It sort of worked, but struggled a lot",
+			);
+			userEvent.click(regularOption);
+
+			const commentTextarea = body.getByRole("textbox", {
+				name: "Additional comments",
+			});
+			await userEvent.type(commentTextarea, "This is my comment");
+
+			const submitButton = body.getByRole("button", {
+				name: "Submit Feedback",
+			});
+			await userEvent.click(submitButton);
+		});
+	},
+};
diff --git a/site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.tsx b/site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.tsx
new file mode 100644
index 0000000000000..ddb05fec4374b
--- /dev/null
+++ b/site/src/modules/tasks/TaskFeedbackDialog/TaskFeedbackDialog.tsx
@@ -0,0 +1,147 @@
+import {
+	API,
+	type CreateTaskFeedbackRequest,
+	type TaskFeedbackRating,
+} from "api/api";
+import { ErrorAlert } from "components/Alert/ErrorAlert";
+import { Button } from "components/Button/Button";
+import {
+	Dialog,
+	DialogClose,
+	DialogContent,
+	DialogDescription,
+	DialogFooter,
+	DialogHeader,
+	DialogTitle,
+} from "components/Dialog/Dialog";
+import type { DialogProps } from "components/Dialogs/Dialog";
+import { displaySuccess } from "components/GlobalSnackbar/utils";
+import { Spinner } from "components/Spinner/Spinner";
+import { Textarea } from "components/Textarea/Textarea";
+import { useFormik } from "formik";
+import { FrownIcon, MehIcon, SmileIcon } from "lucide-react";
+import type { FC, HTMLProps, ReactNode } from "react";
+import { useMutation } from "react-query";
+
+type TaskFeedbackFormValues = {
+	rate: TaskFeedbackRating | null;
+	comment: string;
+};
+
+type TaskFeedbackDialogProps = DialogProps & {
+	taskId: string;
+};
+
+export const TaskFeedbackDialog: FC<TaskFeedbackDialogProps> = ({
+	taskId,
+	...dialogProps
+}) => {
+	const {
+		mutate: createFeedback,
+		error,
+		isPending,
+	} = useMutation({
+		mutationFn: (req: CreateTaskFeedbackRequest) =>
+			API.experimental.createTaskFeedback(taskId, req),
+		onSuccess: () => {
+			displaySuccess("Feedback submitted successfully");
+		},
+	});
+
+	const formik = useFormik<TaskFeedbackFormValues>({
+		initialValues: {
+			rate: null,
+			comment: "",
+		},
+		onSubmit: (values) => {
+			if (values.rate !== null) {
+				createFeedback({
+					rate: values.rate,
+					comment: values.comment,
+				});
+			}
+		},
+	});
+
+	const isRateSelected = Boolean(formik.values.rate);
+
+	return (
+		<Dialog {...dialogProps}>
+			<DialogContent>
+				<DialogHeader>
+					<DialogTitle>Task feedback</DialogTitle>
+					<DialogDescription>
+						Your feedback is important to us. Please rate your experience with
+						this task.
+					</DialogDescription>
+				</DialogHeader>
+
+				<form
+					id="feedback-form"
+					onSubmit={formik.handleSubmit}
+					className="flex flex-col gap-4"
+				>
+					{error && <ErrorAlert error={error} />}
+
+					<fieldset className="flex flex-col gap-1">
+						<legend className="sr-only">Rate your experience</legend>
+						<RateOption {...formik.getFieldProps("rate")} value="good">
+							<SmileIcon />I achieved my goal
+						</RateOption>
+						<RateOption {...formik.getFieldProps("rate")} value="okay">
+							<MehIcon />
+							It sort of worked, but struggled a lot
+						</RateOption>
+						<RateOption {...formik.getFieldProps("rate")} value="bad">
+							<FrownIcon />
+							It was a flop
+						</RateOption>
+					</fieldset>
+
+					<label className="sr-only" htmlFor="comment">
+						Additional comments
+					</label>
+					<Textarea
+						id="comment"
+						placeholder="Wanna say something else?..."
+						className="h-32 resize-none"
+						{...formik.getFieldProps("comment")}
+					/>
+				</form>
+
+				<DialogFooter>
+					<DialogClose asChild>
+						<Button variant="outline">Close</Button>
+					</DialogClose>
+					<Button
+						type="submit"
+						form="feedback-form"
+						disabled={!isRateSelected || isPending}
+					>
+						<Spinner loading={isPending} />
+						Submit Feedback
+					</Button>
+				</DialogFooter>
+			</DialogContent>
+		</Dialog>
+	);
+};
+
+type RateOptionProps = HTMLProps<HTMLInputElement> & {
+	children: ReactNode;
+};
+
+const RateOption: FC<RateOptionProps> = ({ children, ...inputProps }) => {
+	return (
+		<label
+			className={`
+			cursor-pointer border border-border border-solid hover:bg-surface-secondary
+			px-4 py-3 rounded text-sm has-[:checked]:bg-surface-quaternary
+			flex items-center gap-3 [&_svg]:size-4
+		`}
+		>
+			<input className="hidden" type="radio" {...inputProps} />
+			{children}
+		</label>
+	);
+};

From 8ac54534f4271950d763a5adafba1b74f46fcb97 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Tue, 14 Oct 2025 20:58:13 +0200
Subject: [PATCH 123/298] feat: skip deprecated:false in templates search bar
 (#20274)

Fixes: https://github.com/coder/coder/issues/19746
---
 site/src/pages/TemplatesPage/TemplatesFilter.tsx           | 2 +-
 site/src/pages/TemplatesPage/TemplatesPage.tsx             | 1 -
 site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx | 3 +--
 3 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/site/src/pages/TemplatesPage/TemplatesFilter.tsx b/site/src/pages/TemplatesPage/TemplatesFilter.tsx
index 5a511130425fe..246d409d8c572 100644
--- a/site/src/pages/TemplatesPage/TemplatesFilter.tsx
+++ b/site/src/pages/TemplatesPage/TemplatesFilter.tsx
@@ -56,7 +56,7 @@ export const TemplatesFilter: FC<TemplatesFilterProps> = ({
 		<Filter
 			presets={[
 				{ query: "", name: "All templates" },
-				{ query: "deprecated:false author:me", name: "Templates you authored" },
+				{ query: "author:me", name: "Templates you authored" },
 				{ query: "deprecated:true", name: "Deprecated templates" },
 			]}
 			// TODO: Add docs for this
diff --git a/site/src/pages/TemplatesPage/TemplatesPage.tsx b/site/src/pages/TemplatesPage/TemplatesPage.tsx
index 5eb55ca6380fd..0ca5d827f0e13 100644
--- a/site/src/pages/TemplatesPage/TemplatesPage.tsx
+++ b/site/src/pages/TemplatesPage/TemplatesPage.tsx
@@ -73,7 +73,6 @@ const useTemplatesFilter = ({
 	onSearchParamsChange,
 }: UseTemplatesFilterOptions): TemplateFilterState => {
 	const filter = useFilter({
-		fallbackFilter: "deprecated:false",
 		searchParams,
 		onSearchParamsChange,
 	});
diff --git a/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx b/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx
index 58b0bdb9ff8a8..9f6897033d4f2 100644
--- a/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx
+++ b/site/src/pages/TemplatesPage/TemplatesPageView.stories.tsx
@@ -16,7 +16,6 @@ import type { TemplateFilterState } from "./TemplatesPage";
 import { TemplatesPageView } from "./TemplatesPageView";
 
 const defaultFilterProps = getDefaultFilterProps<TemplateFilterState>({
-	query: "deprecated:false",
 	menus: {
 		organizations: MockMenu,
 	},
@@ -118,7 +117,7 @@ export const WithFilteredAllTemplates: Story = {
 		filterState: {
 			filter: {
 				...defaultFilterProps.filter,
-				query: "deprecated:false searchnotfound",
+				query: "searchnotfound",
 				values: {},
 				used: true,
 			},

From e0b15360757e3f08a59c1439790ec1a48cd5d308 Mon Sep 17 00:00:00 2001
From: Rowan Smith <rowan@coder.com>
Date: Wed, 15 Oct 2025 14:46:27 +1100
Subject: [PATCH 124/298] chore: clarify autostop behaviour for existing
 workspaces (#20295)

[We have tests to ensure this
behaviour](https://github.com/coder/coder/blob/152103bf788dc5a4c06586302a255a212e0fe77d/coderd/workspaces_test.go#L2957-L3004),
but it is not clearly documented. This PR adds a note clarifying
autostop must be enabled on the template prior to a workspace being
created for it to apply to the workspace, i.e. it is not re-read if a
workspace is restarted / stopped and started. This behaviour was raised
by a customer.

https://coder.com/docs/user-guides/workspace-scheduling#autostop
---
 docs/user-guides/workspace-scheduling.md | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/docs/user-guides/workspace-scheduling.md b/docs/user-guides/workspace-scheduling.md
index b5c27263a7e2e..151829c27d727 100644
--- a/docs/user-guides/workspace-scheduling.md
+++ b/docs/user-guides/workspace-scheduling.md
@@ -39,6 +39,9 @@ workspace if you're still using it. It will wait for the user to become inactive
 before checking connections again (1 hour by default). Template admins can
 modify this duration with the **activity bump** template setting.
 
+> [!NOTE]
+> Autostop must be enabled on the template prior to workspace creation, it is not applied to existing running workspaces.
+
 ![Autostop UI](../images/workspaces/autostop.png)
 
 ## Activity detection

From 3699ff6b488891bee7283ffca08f277c91c6bc1b Mon Sep 17 00:00:00 2001
From: Jaayden Halko <jaayden.halko@gmail.com>
Date: Wed, 15 Oct 2025 12:16:18 +0100
Subject: [PATCH 125/298] refactor: migrate TermsOfServiceLink from MUI to
 shadcn/ui (#20260)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Summary

Migrate the `TermsOfServiceLink` component from MUI to shadcn/ui

## Changes

- **Replaced** `@mui/material/Link` with the custom `Link` component
from `components/Link/Link` (shadcn/ui)
- **Migrated** Emotion `css` prop to Tailwind utility classes
- **Preserved** external link icon functionality (automatically provided
by shadcn Link component)

🤖 Generated with [Claude Code](https://claude.com/claude-code)

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 site/src/pages/LoginPage/LoginPageView.tsx      |  5 +----
 site/src/pages/LoginPage/TermsOfServiceLink.tsx | 16 +++++-----------
 2 files changed, 6 insertions(+), 15 deletions(-)

diff --git a/site/src/pages/LoginPage/LoginPageView.tsx b/site/src/pages/LoginPage/LoginPageView.tsx
index c6714218ab0c8..7f87a8d9faf3b 100644
--- a/site/src/pages/LoginPage/LoginPageView.tsx
+++ b/site/src/pages/LoginPage/LoginPageView.tsx
@@ -68,10 +68,7 @@ export const LoginPageView: FC<LoginPageViewProps> = ({
 					</div>
 					<div>{buildInfo?.version}</div>
 					{tosAccepted && (
-						<TermsOfServiceLink
-							url={authMethods?.terms_of_service_url}
-							css={{ fontSize: 12 }}
-						/>
+						<TermsOfServiceLink url={authMethods?.terms_of_service_url} />
 					)}
 				</footer>
 			</div>
diff --git a/site/src/pages/LoginPage/TermsOfServiceLink.tsx b/site/src/pages/LoginPage/TermsOfServiceLink.tsx
index a3ed055c1835e..c4cfbb2310bf3 100644
--- a/site/src/pages/LoginPage/TermsOfServiceLink.tsx
+++ b/site/src/pages/LoginPage/TermsOfServiceLink.tsx
@@ -1,27 +1,21 @@
-import Link from "@mui/material/Link";
-import { SquareArrowOutUpRightIcon } from "lucide-react";
+import { Link } from "components/Link/Link";
 import type { FC } from "react";
 
 interface TermsOfServiceLinkProps {
-	className?: string;
 	url?: string;
 }
 
-export const TermsOfServiceLink: FC<TermsOfServiceLinkProps> = ({
-	className,
-	url,
-}) => {
+export const TermsOfServiceLink: FC<TermsOfServiceLinkProps> = ({ url }) => {
 	return (
-		<div css={{ paddingTop: 12, fontSize: 16 }} className={className}>
+		<div className="pt-3 text-base">
 			By continuing, you agree to the{" "}
 			<Link
-				css={{ fontWeight: 500, textWrap: "nowrap" }}
+				className="font-medium whitespace-nowrap"
 				href={url}
 				target="_blank"
 				rel="noreferrer"
 			>
-				Terms of Service&nbsp;
-				<SquareArrowOutUpRightIcon className="size-icon-xs" />
+				Terms of Service
 			</Link>
 		</div>
 	);

From 05b037bdea90345e23e0dfb3c33e852d672bb712 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Wed, 15 Oct 2025 15:56:07 +0400
Subject: [PATCH 126/298] fix: avoid deadlock race writing to a disconnected
 mapper (#20303)

fixes https://github.com/coder/internal/issues/1045

Fixes a race condition in our PG Coordinator when a peer disconnects. We issue database queries to find the peer mappings (node structures for each peer connected via a tunnel), and then send these to the "mapper" that generates diffs and eventually writes the update to the websocket.

Before this change we erroneously used the querier's context for this update, which has the same lifetime as the coordinator itself. If the peer has disconnected, the mapper might not be reading from its channel, and this causes a deadlock in a querier worker. This also prevents us from doing any more work on the peer.

I also added some more debug logging that would have been helpful when tracking this down.
---
 enterprise/tailnet/pgcoord.go | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/enterprise/tailnet/pgcoord.go b/enterprise/tailnet/pgcoord.go
index 79e5c13c93983..54bb87f932d04 100644
--- a/enterprise/tailnet/pgcoord.go
+++ b/enterprise/tailnet/pgcoord.go
@@ -873,9 +873,11 @@ func (q *querier) handleIncoming() {
 			return
 
 		case c := <-q.newConnections:
+			q.logger.Debug(q.ctx, "new connection received", slog.F("peer_id", c.UniqueID()))
 			q.newConn(c)
 
 		case c := <-q.closeConnections:
+			q.logger.Debug(q.ctx, "connection close request", slog.F("peer_id", c.UniqueID()))
 			q.cleanupConn(c)
 		}
 	}
@@ -902,7 +904,8 @@ func (q *querier) newConn(c *connIO) {
 	mk := mKey(c.UniqueID())
 	dup, ok := q.mappers[mk]
 	if ok {
-		// duplicate, overwrite and close the old one
+		q.logger.Debug(q.ctx, "duplicate mapper found; closing old connection", slog.F("peer_id", dup.c.UniqueID()))
+		// overwrite and close the old one
 		atomic.StoreInt64(&c.overwrites, dup.c.Overwrites()+1)
 		err := dup.c.CoordinatorClose()
 		if err != nil {
@@ -913,6 +916,7 @@ func (q *querier) newConn(c *connIO) {
 	q.workQ.enqueue(querierWorkKey{
 		mappingQuery: mk,
 	})
+	q.logger.Debug(q.ctx, "added new mapper", slog.F("peer_id", c.UniqueID()))
 }
 
 func (q *querier) isHealthy() bool {
@@ -940,11 +944,12 @@ func (q *querier) cleanupConn(c *connIO) {
 		logger.Error(q.ctx, "failed to close connIO", slog.Error(err))
 	}
 	delete(q.mappers, mk)
-	q.logger.Debug(q.ctx, "removed mapper")
+	q.logger.Debug(q.ctx, "removed mapper", slog.F("peer_id", c.UniqueID()))
 }
 
 func (q *querier) worker() {
 	defer q.wg.Done()
+	defer q.logger.Debug(q.ctx, "worker exited")
 	eb := backoff.NewExponentialBackOff()
 	eb.MaxElapsedTime = 0 // retry indefinitely
 	eb.MaxInterval = dbMaxBackoff
@@ -1019,7 +1024,7 @@ func (q *querier) mappingQuery(peer mKey) error {
 		return nil
 	}
 	logger.Debug(q.ctx, "sending mappings", slog.F("mapping_len", len(mappings)))
-	return agpl.SendCtx(q.ctx, mpr.mappings, mappings)
+	return agpl.SendCtx(mpr.ctx, mpr.mappings, mappings)
 }
 
 func (q *querier) bindingsToMappings(bindings []database.GetTailnetTunnelPeerBindingsRow) ([]mapping, error) {

From 24dddd56c59f3ec452cc5c78b042236ccc26278e Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 15 Oct 2025 10:03:34 -0300
Subject: [PATCH 127/298] fix: keep button in loading state after start request
 is made (#20294)

After requesting a workspace start, it may take a while to become ready.
Show a loading state in the meantime.

Fixes  https://github.com/coder/coder/issues/20233
---
 site/src/pages/TaskPage/TaskPage.stories.tsx | 54 ++++++++++++++++++++
 site/src/pages/TaskPage/TaskPage.tsx         | 13 +++--
 2 files changed, 63 insertions(+), 4 deletions(-)

diff --git a/site/src/pages/TaskPage/TaskPage.stories.tsx b/site/src/pages/TaskPage/TaskPage.stories.tsx
index e084789dcabdf..f1a0d3d05b727 100644
--- a/site/src/pages/TaskPage/TaskPage.stories.tsx
+++ b/site/src/pages/TaskPage/TaskPage.stories.tsx
@@ -320,6 +320,60 @@ export const ActivePreview: Story = {
 	},
 };
 
+export const WorkspaceStarting: Story = {
+	decorators: [withGlobalSnackbar],
+	beforeEach: () => {
+		spyOn(API, "startWorkspace").mockResolvedValue(
+			MockStartingWorkspace.latest_build,
+		);
+	},
+	parameters: {
+		reactRouter: reactRouterParameters({
+			location: {
+				pathParams: {
+					username: MockStoppedWorkspace.owner_name,
+					workspace: MockStoppedWorkspace.name,
+				},
+			},
+			routing: {
+				path: "/tasks/:username/:workspace",
+			},
+		}),
+		queries: [
+			{
+				key: [
+					"tasks",
+					MockStoppedWorkspace.owner_name,
+					MockStoppedWorkspace.name,
+				],
+				data: {
+					prompt: "Create competitors page",
+					workspace: MockStoppedWorkspace,
+				},
+			},
+			{
+				key: ["workspace", MockStoppedWorkspace.id, "parameters"],
+				data: {
+					templateVersionRichParameters: [],
+					buildParameters: [],
+				},
+			},
+		],
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		const startButton = await canvas.findByText("Start workspace");
+		expect(startButton).toBeInTheDocument();
+
+		await userEvent.click(startButton);
+
+		await waitFor(async () => {
+			expect(API.startWorkspace).toBeCalled();
+		});
+	},
+};
+
 export const WorkspaceStartFailure: Story = {
 	decorators: [withGlobalSnackbar],
 	beforeEach: () => {
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index 771cd172a63e8..1b4b2c1c38d56 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -13,6 +13,7 @@ import { displayError } from "components/GlobalSnackbar/utils";
 import { Loader } from "components/Loader/Loader";
 import { Margins } from "components/Margins/Margins";
 import { ScrollArea } from "components/ScrollArea/ScrollArea";
+import { Spinner } from "components/Spinner/Spinner";
 import { useWorkspaceBuildLogs } from "hooks/useWorkspaceBuildLogs";
 import { ArrowLeftIcon, RotateCcwIcon } from "lucide-react";
 import { AgentLogs } from "modules/resources/AgentLogs/AgentLogs";
@@ -206,6 +207,11 @@ const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ task }) => {
 		},
 	});
 
+	// After requesting a workspace start, it may take a while to become ready.
+	// Show a loading state in the meantime.
+	const isWaitingForStart =
+		mutateStartWorkspace.isPending || mutateStartWorkspace.isSuccess;
+
 	const apiError = isApiError(mutateStartWorkspace.error)
 		? mutateStartWorkspace.error
 		: undefined;
@@ -223,16 +229,15 @@ const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ task }) => {
 					<div className="flex flex-row mt-4 gap-4">
 						<Button
 							size="sm"
-							disabled={mutateStartWorkspace.isPending}
+							disabled={isWaitingForStart}
 							onClick={() => {
 								mutateStartWorkspace.mutate({
 									buildParameters: parameters?.buildParameters,
 								});
 							}}
 						>
-							{mutateStartWorkspace.isPending
-								? "Starting workspace..."
-								: "Start workspace"}
+							<Spinner loading={isWaitingForStart} />
+							Start workspace
 						</Button>
 					</div>
 				</div>

From 9861931df120a75ec64fc1d197bd86c78ff74361 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 15 Oct 2025 10:04:17 -0300
Subject: [PATCH 128/298] fix: select the correct version when template changes
 (#20293)

Fix https://github.com/coder/internal/issues/1062
---
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   | 73 ++++++++++++++++---
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   |  7 +-
 2 files changed, 69 insertions(+), 11 deletions(-)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index 1710bb3c347f4..5577ff6d9046c 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -30,15 +30,6 @@ const meta: Meta<typeof TasksPage> = {
 	},
 	beforeEach: () => {
 		spyOn(API, "getTemplateVersionExternalAuth").mockResolvedValue([]);
-		spyOn(API, "getTemplates").mockResolvedValue([
-			MockTemplate,
-			{
-				...MockTemplate,
-				id: "test-template-2",
-				name: "template 2",
-				display_name: "Template 2",
-			},
-		]);
 		spyOn(API, "getTemplateVersions").mockResolvedValue([
 			{
 				...MockTemplateVersion,
@@ -126,6 +117,70 @@ export const OnSuccess: Story = {
 	},
 };
 
+export const ChangeTemplate: Story = {
+	decorators: [withGlobalSnackbar],
+	args: {
+		templates: [
+			{
+				...MockTemplate,
+				id: "claude-code",
+				name: "claude-code",
+				display_name: "Claude Code",
+				active_version_id: "claude-code-version",
+			},
+			{
+				...MockTemplate,
+				id: "codex",
+				name: "codex",
+				display_name: "Codex",
+				active_version_id: "codex-version",
+			},
+		],
+	},
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersions").mockImplementation((templateId) => {
+			if (templateId === "claude-code") {
+				return Promise.resolve([
+					{
+						...MockTemplateVersion,
+						id: "claude-code-version",
+						name: "claude-code-version",
+					},
+				]);
+			}
+			if (templateId === "codex") {
+				return Promise.resolve([
+					{
+						...MockTemplateVersion,
+						id: "codex-version",
+						name: "codex-version",
+					},
+				]);
+			}
+			return Promise.resolve([]);
+		});
+		spyOn(API.experimental, "createTask").mockResolvedValue(MockTask);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+		const body = within(canvasElement.ownerDocument.body);
+
+		await step("Change template", async () => {
+			const templateSelect = await canvas.findByLabelText(/select template/i);
+			await userEvent.click(templateSelect);
+			const templateOption = await body.findByRole("option", {
+				name: /codex/i,
+			});
+			await userEvent.click(templateOption);
+		});
+
+		await step("Default version is selected", async () => {
+			const versionSelect = await canvas.findByLabelText(/version/i);
+			expect(versionSelect).toHaveTextContent("codex-version");
+		});
+	},
+};
+
 export const SelectTemplateVersion: Story = {
 	decorators: [withGlobalSnackbar],
 	beforeEach: () => {
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index 2f399ac3e4d87..1e9c2d2f49653 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -165,6 +165,9 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 		...templateVersions(selectedTemplate.id),
 		enabled: permissions.updateTemplates,
 	});
+	useEffect(() => {
+		setSelectedVersionId(selectedTemplate.active_version_id);
+	}, [selectedTemplate]);
 
 	// Presets
 	const { data: presets, isLoading: isLoadingPresets } = useQuery(
@@ -269,7 +272,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 					<div className="flex items-center gap-1">
 						<div>
 							<label htmlFor="templateID" className="sr-only">
-								Template
+								Select template
 							</label>
 							<Select
 								name="templateID"
@@ -326,7 +329,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 								Preset
 							</label>
 							{isLoadingPresets ? (
-								<Skeleton className="w-[320px] h-8" />
+								<Skeleton className="w-[140px] h-8 rounded-full" />
 							) : (
 								presets &&
 								presets.length > 0 &&

From 09e2daf282a441c6a118babe3d1abeeeb455c16b Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Wed, 15 Oct 2025 15:34:21 +0100
Subject: [PATCH 129/298] chore(docs): add external provisioner configuration
 for prebuilds (#20305)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

## Description

Update the Prebuilds troubleshooting page to include a new section,
“Preventing prebuild queue contention (recommended)”, outlining a
best-practice configuration to prevent prebuild jobs from overwhelming
the provisioner queue.

This setup introduces a dedicated prebuild provisioner pool and has been
successfully tested internally in dogfood:
https://github.com/coder/dogfood/pull/201

Closes: https://github.com/coder/coder/issues/20241
---
 .../prebuilt-workspaces.md                    | 57 +++++++++++++++++++
 1 file changed, 57 insertions(+)

diff --git a/docs/admin/templates/extending-templates/prebuilt-workspaces.md b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
index bc0ba1c1c3fbd..10722c1b26a21 100644
--- a/docs/admin/templates/extending-templates/prebuilt-workspaces.md
+++ b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
@@ -364,6 +364,63 @@ For example, the [`ami`](https://registry.terraform.io/providers/hashicorp/aws/l
 has [`ForceNew`](https://github.com/hashicorp/terraform-provider-aws/blob/main/internal/service/ec2/ec2_instance.go#L75-L81) set,
 since the AMI cannot be changed in-place._
 
+### Preventing prebuild queue contention (recommended)
+
+The section [Managing prebuild provisioning queues](#managing-prebuild-provisioning-queues) covers how to recover when prebuilds have already overwhelmed the provisioner queue.
+This section outlines a **best-practice configuration** to prevent that situation by isolating prebuild jobs to a dedicated provisioner pool.
+This setup is optional and requires minor template changes.
+
+Coder supports [external provisioners and provisioner tags](../../provisioners/index.md), which allows you to route jobs to provisioners with matching tags.
+By creating external provisioners with a special tag (e.g., `is_prebuild=true`) and updating the template to conditionally add that tag for prebuild jobs,
+all prebuild work is handled by the prebuild pool.
+This keeps other provisioners available to handle user-initiated jobs.
+
+#### Setup
+
+1) Create a provisioner key with a prebuild tag (e.g., `is_prebuild=true`).
+Provisioner keys are org-scoped and their tags are inferred automatically by provisioner daemons that use the key.
+See [Scoped Key](../../provisioners/index.md#scoped-key-recommended) for instructions on how to create a provisioner key.
+
+2) Deploy a separate provisioner pool using that key (for example, via the [Helm coder-provisioner chart](https://github.com/coder/coder/pkgs/container/chart%2Fcoder-provisioner)).
+Daemons in this pool will only execute jobs that include all of the tags specified in their provisioner key.
+See [External provisioners](../../provisioners/index.md) for environment-specific deployment examples.
+
+3) Update the template to conditionally add the prebuild tag for prebuild jobs.
+
+```hcl
+data "coder_workspace_tags" "prebuilds" {
+  count = data.coder_workspace_owner.me.name == "prebuilds" ? 1 : 0
+  tags = {
+    "is_prebuild" = "true"
+  }
+}
+```
+
+Prebuild workspaces are a special type of workspace owned by the system user `prebuilds`.
+The value `data.coder_workspace_owner.me.name` returns the name of the workspace owner, for prebuild workspaces, this value is `"prebuild"`.
+Because the condition evaluates based on the workspace owner, provisioning or deprovisioning prebuilds automatically applies the prebuild tag, whereas regular jobs (like workspace creation or template import) do not.
+
+> [!NOTE]
+> The prebuild provisioner pool can still accept non-prebuild jobs.
+> To achieve a fully isolated setup, add an additional tag (`is_prebuild=false`) to your standard provisioners, ensuring a clean separation between prebuild and non-prebuild workloads.
+> See [Provisioner Tags](../../provisioners/index.md#provisioner-tags) for further details.
+
+#### Validation
+
+To confirm that prebuild jobs are correctly routed to the new provisioner pool, use the Provisioner Jobs dashboard or the [`coder provisioner jobs list`](../../../reference/cli/provisioner_jobs_list.md) CLI command to inspect job metadata and tags.
+Follow these steps:
+
+1) Publish the new template version.
+
+2) Wait for the prebuilds reconciliation loop to run.
+The loop frequency is controlled by the configuration value [`CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL`](../../../reference/cli/server.md#--workspace-prebuilds-reconciliation-interval).
+When the loop runs, it will provision prebuilds for the new template version and deprovision prebuilds for the previous version.
+Both provisioning and deprovisioning jobs for prebuilds should display the tag `is_prebuild=true`.
+
+3) Create a new workspace from a preset.
+Whether the preset uses a prebuild pool or not, the resulting job should not include the `is_prebuild=true` tag.
+This confirms that only prebuild-related jobs are routed to the dedicated prebuild provisioner pool.
+
 ### Monitoring and observability
 
 #### Available metrics

From 6c99d5eca29dd6d2e44c080c5a557b26f02ec3ad Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Thu, 16 Oct 2025 01:56:43 +1100
Subject: [PATCH 130/298] fix: avoid connection logging crashes in agent
 (#20307)

- Ignore errors when reporting a connection from the server, just log
them instead
- Translate connection log IP `localhost` to `127.0.0.1` on both the
server and the agent

Note that the temporary fix for converting invalid IPs to localhost is
not required in main since the database no longer forbids NULL for the
IP column since https://github.com/coder/coder/pull/19788

Relates to #20194
---
 agent/agent.go                        | 17 ++++++++++++++---
 coderd/agentapi/connectionlog.go      | 10 +++++++++-
 coderd/agentapi/connectionlog_test.go | 13 ++++++++++---
 coderd/connectionlog/connectionlog.go | 16 ++++++++++++----
 4 files changed, 45 insertions(+), 11 deletions(-)

diff --git a/agent/agent.go b/agent/agent.go
index aed6652de612c..ab882a80efa4a 100644
--- a/agent/agent.go
+++ b/agent/agent.go
@@ -781,11 +781,15 @@ func (a *agent) reportConnectionsLoop(ctx context.Context, aAPI proto.DRPCAgentC
 			logger.Debug(ctx, "reporting connection")
 			_, err := aAPI.ReportConnection(ctx, payload)
 			if err != nil {
-				return xerrors.Errorf("failed to report connection: %w", err)
+				// Do not fail the loop if we fail to report a connection, just
+				// log a warning.
+				// Related to https://github.com/coder/coder/issues/20194
+				logger.Warn(ctx, "failed to report connection to server", slog.Error(err))
+				// keep going, we still need to remove it from the slice
+			} else {
+				logger.Debug(ctx, "successfully reported connection")
 			}
 
-			logger.Debug(ctx, "successfully reported connection")
-
 			// Remove the payload we sent.
 			a.reportConnectionsMu.Lock()
 			a.reportConnections[0] = nil // Release the pointer from the underlying array.
@@ -816,6 +820,13 @@ func (a *agent) reportConnection(id uuid.UUID, connectionType proto.Connection_T
 		ip = host
 	}
 
+	// If the IP is "localhost" (which it can be in some cases), set it to
+	// 127.0.0.1 instead.
+	// Related to https://github.com/coder/coder/issues/20194
+	if ip == "localhost" {
+		ip = "127.0.0.1"
+	}
+
 	a.reportConnectionsMu.Lock()
 	defer a.reportConnectionsMu.Unlock()
 
diff --git a/coderd/agentapi/connectionlog.go b/coderd/agentapi/connectionlog.go
index f26f835746981..bd11f9e72679e 100644
--- a/coderd/agentapi/connectionlog.go
+++ b/coderd/agentapi/connectionlog.go
@@ -61,6 +61,14 @@ func (a *ConnLogAPI) ReportConnection(ctx context.Context, req *agentproto.Repor
 		return nil, xerrors.Errorf("get workspace by agent id: %w", err)
 	}
 
+	// Some older clients may incorrectly report "localhost" as the IP address.
+	// Related to https://github.com/coder/coder/issues/20194
+	logIPRaw := req.GetConnection().GetIp()
+	if logIPRaw == "localhost" {
+		logIPRaw = "127.0.0.1"
+	}
+	logIP := database.ParseIP(logIPRaw) // will return null if invalid
+
 	reason := req.GetConnection().GetReason()
 	connLogger := *a.ConnectionLogger.Load()
 	err = connLogger.Upsert(ctx, database.UpsertConnectionLogParams{
@@ -73,7 +81,7 @@ func (a *ConnLogAPI) ReportConnection(ctx context.Context, req *agentproto.Repor
 		AgentName:        workspaceAgent.Name,
 		Type:             connectionType,
 		Code:             code,
-		Ip:               database.ParseIP(req.GetConnection().GetIp()),
+		Ip:               logIP,
 		ConnectionID: uuid.NullUUID{
 			UUID:  connectionID,
 			Valid: true,
diff --git a/coderd/agentapi/connectionlog_test.go b/coderd/agentapi/connectionlog_test.go
index 4a060b8f16faf..81d969e5bad95 100644
--- a/coderd/agentapi/connectionlog_test.go
+++ b/coderd/agentapi/connectionlog_test.go
@@ -3,13 +3,11 @@ package agentapi_test
 import (
 	"context"
 	"database/sql"
-	"net"
 	"sync/atomic"
 	"testing"
 	"time"
 
 	"github.com/google/uuid"
-	"github.com/sqlc-dev/pqtype"
 	"github.com/stretchr/testify/require"
 	"go.uber.org/mock/gomock"
 	"google.golang.org/protobuf/types/known/timestamppb"
@@ -75,6 +73,9 @@ func TestConnectionLog(t *testing.T) {
 			action: agentproto.Connection_CONNECT.Enum(),
 			typ:    agentproto.Connection_JETBRAINS.Enum(),
 			time:   dbtime.Now(),
+			// Sometimes, JetBrains clients report as localhost, see
+			// https://github.com/coder/coder/issues/20194
+			ip: "localhost",
 		},
 		{
 			name:   "Reconnecting PTY Connect",
@@ -129,6 +130,12 @@ func TestConnectionLog(t *testing.T) {
 				},
 			})
 
+			expectedIPRaw := tt.ip
+			if expectedIPRaw == "localhost" {
+				expectedIPRaw = "127.0.0.1"
+			}
+			expectedIP := database.ParseIP(expectedIPRaw)
+
 			require.True(t, connLogger.Contains(t, database.UpsertConnectionLogParams{
 				Time:             dbtime.Time(tt.time).In(time.UTC),
 				OrganizationID:   workspace.OrganizationID,
@@ -146,7 +153,7 @@ func TestConnectionLog(t *testing.T) {
 					Int32: tt.status,
 					Valid: *tt.action == agentproto.Connection_DISCONNECT,
 				},
-				Ip:   pqtype.Inet{Valid: true, IPNet: net.IPNet{IP: net.ParseIP(tt.ip), Mask: net.CIDRMask(32, 32)}},
+				Ip:   expectedIP,
 				Type: agentProtoConnectionTypeToConnectionLog(t, *tt.typ),
 				DisconnectReason: sql.NullString{
 					String: tt.reason,
diff --git a/coderd/connectionlog/connectionlog.go b/coderd/connectionlog/connectionlog.go
index 1b56ffc288fd3..b3d9e9115f5c0 100644
--- a/coderd/connectionlog/connectionlog.go
+++ b/coderd/connectionlog/connectionlog.go
@@ -62,10 +62,6 @@ func (m *FakeConnectionLogger) Contains(t testing.TB, expected database.UpsertCo
 			t.Logf("connection log %d: expected ID %s, got %s", idx+1, expected.ID, cl.ID)
 			continue
 		}
-		if !expected.Time.IsZero() && expected.Time != cl.Time {
-			t.Logf("connection log %d: expected Time %s, got %s", idx+1, expected.Time, cl.Time)
-			continue
-		}
 		if expected.OrganizationID != uuid.Nil && cl.OrganizationID != expected.OrganizationID {
 			t.Logf("connection log %d: expected OrganizationID %s, got %s", idx+1, expected.OrganizationID, cl.OrganizationID)
 			continue
@@ -114,6 +110,18 @@ func (m *FakeConnectionLogger) Contains(t testing.TB, expected database.UpsertCo
 			t.Logf("connection log %d: expected ConnectionID %s, got %s", idx+1, expected.ConnectionID.UUID, cl.ConnectionID.UUID)
 			continue
 		}
+		if expected.DisconnectReason.Valid && cl.DisconnectReason.String != expected.DisconnectReason.String {
+			t.Logf("connection log %d: expected DisconnectReason %s, got %s", idx+1, expected.DisconnectReason.String, cl.DisconnectReason.String)
+			continue
+		}
+		if !expected.Time.IsZero() && expected.Time != cl.Time {
+			t.Logf("connection log %d: expected Time %s, got %s", idx+1, expected.Time, cl.Time)
+			continue
+		}
+		if expected.ConnectionStatus != "" && expected.ConnectionStatus != cl.ConnectionStatus {
+			t.Logf("connection log %d: expected ConnectionStatus %s, got %s", idx+1, expected.ConnectionStatus, cl.ConnectionStatus)
+			continue
+		}
 		return true
 	}
 

From ade3fce0f6155eb3df6332f5abc52d78d7b994bd Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 15 Oct 2025 16:41:16 +0100
Subject: [PATCH 131/298] fix(coderd): prevent task working notification for
 first app status (#20313)

Disclaimer: Claude did all of this, reviewed and committed by me.

I find the "task is working" notification straight after creation to be
unnecessary.
Added logic to skip the notification if the first app status is
"working".
---
 coderd/aitasks_test.go    | 14 ++++++++++++--
 coderd/workspaceagents.go |  7 +++++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 6425e06c771db..4172cccda6851 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -1008,16 +1008,26 @@ func TestTasksNotification(t *testing.T) {
 			isNotificationSent: false,
 			taskPrompt:         "NonNotifiedTransition",
 		},
-		// Should send TemplateTaskWorking when the AI task transitions to 'Working'.
+		// Should NOT send TemplateTaskWorking when the AI task's FIRST status is 'Working' (obvious state).
 		{
 			name:                 "TemplateTaskWorking",
 			latestAppStatuses:    nil,
 			newAppStatus:         codersdk.WorkspaceAppStatusStateWorking,
 			isAITask:             true,
-			isNotificationSent:   true,
+			isNotificationSent:   false,
 			notificationTemplate: notifications.TemplateTaskWorking,
 			taskPrompt:           "TemplateTaskWorking",
 		},
+		// Should send TemplateTaskIdle when the AI task's FIRST status is 'Idle' (task completed immediately).
+		{
+			name:                 "InitialTemplateTaskIdle",
+			latestAppStatuses:    nil,
+			newAppStatus:         codersdk.WorkspaceAppStatusStateIdle,
+			isAITask:             true,
+			isNotificationSent:   true,
+			notificationTemplate: notifications.TemplateTaskIdle,
+			taskPrompt:           "InitialTemplateTaskIdle",
+		},
 		// Should send TemplateTaskWorking when the AI task transitions to 'Working' from 'Idle'.
 		{
 			name: "TemplateTaskWorkingFromIdle",
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
index 0e6d0430e3642..51654380e59db 100644
--- a/coderd/workspaceagents.go
+++ b/coderd/workspaceagents.go
@@ -471,6 +471,13 @@ func (api *API) enqueueAITaskStateNotification(
 			return
 		}
 
+		// Skip the initial "Working" notification when task first starts.
+		// This is obvious to the user since they just created the task.
+		// We still notify on first "Idle" status and all subsequent transitions.
+		if len(latestAppStatus) == 0 && newAppStatus == codersdk.WorkspaceAppStatusStateWorking {
+			return
+		}
+
 		// Use the task prompt as the "task" label, fallback to workspace name
 		parameters, err := api.Database.GetWorkspaceBuildParameters(ctx, workspaceBuild.ID)
 		if err != nil {

From 03d285db26dc37e660405742ef82bcf8c513e9d8 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Wed, 15 Oct 2025 16:01:34 +0000
Subject: [PATCH 132/298] fix(dogfood): fix dogfood template image build
 (#20312)

Previously the dogfood action was failing because the image for the
dogfood template pulls a version of docker-ce that depended on a version
of containerd.io greater than the pinned version. The pinned version was
a workaround for an old sysbox issue (see #15723).

Example action I kicked off main recently that failed:
https://github.com/coder/coder/actions/runs/18507966953
```
4.879 The following packages have unmet dependencies:
4.955  docker-ce : Depends: containerd.io (>= 1.7.27) but 1.7.23-1 is to be installed
4.963 E: Unable to correct problems, you have held broken packages.
```
---
 dogfood/coder/files/etc/apt/preferences.d/containerd | 6 ------
 1 file changed, 6 deletions(-)
 delete mode 100644 dogfood/coder/files/etc/apt/preferences.d/containerd

diff --git a/dogfood/coder/files/etc/apt/preferences.d/containerd b/dogfood/coder/files/etc/apt/preferences.d/containerd
deleted file mode 100644
index ab0b8f9891aa2..0000000000000
--- a/dogfood/coder/files/etc/apt/preferences.d/containerd
+++ /dev/null
@@ -1,6 +0,0 @@
-# Ref: https://github.com/nestybox/sysbox/issues/879
-# We need to pin containerd to a specific version to avoid breaking
-# Docker-in-Docker.
-Package: containerd.io
-Pin: version 1.7.23-1
-Pin-Priority: 1001

From 408b09a1f21490c047435135fd7c99d40555e0d5 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Wed, 15 Oct 2025 19:13:59 +0300
Subject: [PATCH 133/298] feat(coderd): add audit resource for tasks (#20301)

Updates coder/internal#976
---
 coderd/apidoc/docs.go                         |  6 ++++--
 coderd/apidoc/swagger.json                    |  6 ++++--
 coderd/audit.go                               | 19 +++++++++++++++++++
 coderd/audit/diff.go                          |  3 ++-
 coderd/audit/request.go                       |  8 ++++++++
 coderd/database/dump.sql                      |  3 ++-
 .../migrations/000381_add_task_audit.down.sql |  1 +
 .../migrations/000381_add_task_audit.up.sql   |  1 +
 coderd/database/models.go                     |  5 ++++-
 codersdk/audit.go                             |  3 +++
 docs/admin/security/audit-logs.md             |  1 +
 docs/reference/api/schemas.md                 |  1 +
 enterprise/audit/table.go                     | 13 +++++++++++++
 site/src/api/typesGenerated.ts                |  2 ++
 14 files changed, 65 insertions(+), 7 deletions(-)
 create mode 100644 coderd/database/migrations/000381_add_task_audit.down.sql
 create mode 100644 coderd/database/migrations/000381_add_task_audit.up.sql

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 617678ab99454..0fc64ef9b0d18 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -17247,7 +17247,8 @@ const docTemplate = `{
                 "idp_sync_settings_group",
                 "idp_sync_settings_role",
                 "workspace_agent",
-                "workspace_app"
+                "workspace_app",
+                "task"
             ],
             "x-enum-varnames": [
                 "ResourceTypeTemplate",
@@ -17274,7 +17275,8 @@ const docTemplate = `{
                 "ResourceTypeIdpSyncSettingsGroup",
                 "ResourceTypeIdpSyncSettingsRole",
                 "ResourceTypeWorkspaceAgent",
-                "ResourceTypeWorkspaceApp"
+                "ResourceTypeWorkspaceApp",
+                "ResourceTypeTask"
             ]
         },
         "codersdk.Response": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 83a51e31b8287..867e5e5818e88 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -15759,7 +15759,8 @@
 				"idp_sync_settings_group",
 				"idp_sync_settings_role",
 				"workspace_agent",
-				"workspace_app"
+				"workspace_app",
+				"task"
 			],
 			"x-enum-varnames": [
 				"ResourceTypeTemplate",
@@ -15786,7 +15787,8 @@
 				"ResourceTypeIdpSyncSettingsGroup",
 				"ResourceTypeIdpSyncSettingsRole",
 				"ResourceTypeWorkspaceAgent",
-				"ResourceTypeWorkspaceApp"
+				"ResourceTypeWorkspaceApp",
+				"ResourceTypeTask"
 			]
 		},
 		"codersdk.Response": {
diff --git a/coderd/audit.go b/coderd/audit.go
index e8d7c4dfe9bca..e43ed1c5128ec 100644
--- a/coderd/audit.go
+++ b/coderd/audit.go
@@ -420,6 +420,14 @@ func (api *API) auditLogIsResourceDeleted(ctx context.Context, alog database.Get
 			api.Logger.Error(ctx, "unable to fetch oauth2 app secret", slog.Error(err))
 		}
 		return false
+	case database.ResourceTypeTask:
+		task, err := api.Database.GetTaskByID(ctx, alog.AuditLog.ResourceID)
+		if xerrors.Is(err, sql.ErrNoRows) {
+			return true
+		} else if err != nil {
+			api.Logger.Error(ctx, "unable to fetch task", slog.Error(err))
+		}
+		return task.DeletedAt.Valid && task.DeletedAt.Time.Before(time.Now())
 	default:
 		return false
 	}
@@ -496,6 +504,17 @@ func (api *API) auditLogResourceLink(ctx context.Context, alog database.GetAudit
 		}
 		return fmt.Sprintf("/deployment/oauth2-provider/apps/%s", secret.AppID)
 
+	case database.ResourceTypeTask:
+		task, err := api.Database.GetTaskByID(ctx, alog.AuditLog.ResourceID)
+		if err != nil {
+			return ""
+		}
+		workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
+		if err != nil {
+			return ""
+		}
+		return fmt.Sprintf("/tasks/%s/%s", workspace.OwnerName, task.Name)
+
 	default:
 		return ""
 	}
diff --git a/coderd/audit/diff.go b/coderd/audit/diff.go
index b8139bb63b290..c14dbc392f356 100644
--- a/coderd/audit/diff.go
+++ b/coderd/audit/diff.go
@@ -31,7 +31,8 @@ type Auditable interface {
 		database.NotificationTemplate |
 		idpsync.OrganizationSyncSettings |
 		idpsync.GroupSyncSettings |
-		idpsync.RoleSyncSettings
+		idpsync.RoleSyncSettings |
+		database.TaskTable
 }
 
 // Map is a map of changed fields in an audited resource. It maps field names to
diff --git a/coderd/audit/request.go b/coderd/audit/request.go
index a973bdb915e3c..20aa89f6a870d 100644
--- a/coderd/audit/request.go
+++ b/coderd/audit/request.go
@@ -131,6 +131,8 @@ func ResourceTarget[T Auditable](tgt T) string {
 		return "Organization Group Sync"
 	case idpsync.RoleSyncSettings:
 		return "Organization Role Sync"
+	case database.TaskTable:
+		return typed.Name
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceTarget", tgt))
 	}
@@ -193,6 +195,8 @@ func ResourceID[T Auditable](tgt T) uuid.UUID {
 		return noID // Org field on audit log has org id
 	case idpsync.RoleSyncSettings:
 		return noID // Org field on audit log has org id
+	case database.TaskTable:
+		return typed.ID
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceID", tgt))
 	}
@@ -246,6 +250,8 @@ func ResourceType[T Auditable](tgt T) database.ResourceType {
 		return database.ResourceTypeIdpSyncSettingsRole
 	case idpsync.GroupSyncSettings:
 		return database.ResourceTypeIdpSyncSettingsGroup
+	case database.TaskTable:
+		return database.ResourceTypeTask
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceType", typed))
 	}
@@ -302,6 +308,8 @@ func ResourceRequiresOrgID[T Auditable]() bool {
 		return true
 	case idpsync.RoleSyncSettings:
 		return true
+	case database.TaskTable:
+		return true
 	default:
 		panic(fmt.Sprintf("unknown resource %T for ResourceRequiresOrgID", tgt))
 	}
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 5b23e7b28801c..71e2845d1c245 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -460,7 +460,8 @@ CREATE TYPE resource_type AS ENUM (
     'idp_sync_settings_role',
     'workspace_agent',
     'workspace_app',
-    'prebuilds_settings'
+    'prebuilds_settings',
+    'task'
 );
 
 CREATE TYPE startup_script_behavior AS ENUM (
diff --git a/coderd/database/migrations/000381_add_task_audit.down.sql b/coderd/database/migrations/000381_add_task_audit.down.sql
new file mode 100644
index 0000000000000..362f597df0911
--- /dev/null
+++ b/coderd/database/migrations/000381_add_task_audit.down.sql
@@ -0,0 +1 @@
+-- Nothing to do
diff --git a/coderd/database/migrations/000381_add_task_audit.up.sql b/coderd/database/migrations/000381_add_task_audit.up.sql
new file mode 100644
index 0000000000000..006391ac1fbaf
--- /dev/null
+++ b/coderd/database/migrations/000381_add_task_audit.up.sql
@@ -0,0 +1 @@
+ALTER TYPE resource_type ADD VALUE IF NOT EXISTS 'task';
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 8f62f1a3074f8..741d70f9d2680 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -2670,6 +2670,7 @@ const (
 	ResourceTypeWorkspaceAgent              ResourceType = "workspace_agent"
 	ResourceTypeWorkspaceApp                ResourceType = "workspace_app"
 	ResourceTypePrebuildsSettings           ResourceType = "prebuilds_settings"
+	ResourceTypeTask                        ResourceType = "task"
 )
 
 func (e *ResourceType) Scan(src interface{}) error {
@@ -2733,7 +2734,8 @@ func (e ResourceType) Valid() bool {
 		ResourceTypeIdpSyncSettingsRole,
 		ResourceTypeWorkspaceAgent,
 		ResourceTypeWorkspaceApp,
-		ResourceTypePrebuildsSettings:
+		ResourceTypePrebuildsSettings,
+		ResourceTypeTask:
 		return true
 	}
 	return false
@@ -2766,6 +2768,7 @@ func AllResourceTypeValues() []ResourceType {
 		ResourceTypeWorkspaceAgent,
 		ResourceTypeWorkspaceApp,
 		ResourceTypePrebuildsSettings,
+		ResourceTypeTask,
 	}
 }
 
diff --git a/codersdk/audit.go b/codersdk/audit.go
index 1e529202b5285..0b2eca7d79d92 100644
--- a/codersdk/audit.go
+++ b/codersdk/audit.go
@@ -44,6 +44,7 @@ const (
 	// Deprecated: Workspace App connections are now included in the
 	// connection log.
 	ResourceTypeWorkspaceApp ResourceType = "workspace_app"
+	ResourceTypeTask         ResourceType = "task"
 )
 
 func (r ResourceType) FriendlyString() string {
@@ -100,6 +101,8 @@ func (r ResourceType) FriendlyString() string {
 		return "workspace agent"
 	case ResourceTypeWorkspaceApp:
 		return "workspace app"
+	case ResourceTypeTask:
+		return "task"
 	default:
 		return "unknown"
 	}
diff --git a/docs/admin/security/audit-logs.md b/docs/admin/security/audit-logs.md
index 2c72528f38ea3..387bdd9836a19 100644
--- a/docs/admin/security/audit-logs.md
+++ b/docs/admin/security/audit-logs.md
@@ -32,6 +32,7 @@ We track the following resources:
 | OrganizationSyncSettings<br><i></i>                      | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>assign_default</td><td>true</td></tr><tr><td>field</td><td>true</td></tr><tr><td>mapping</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                             |
 | PrebuildsSettings<br><i></i>                             | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>id</td><td>false</td></tr><tr><td>reconciliation_paused</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 | RoleSyncSettings<br><i></i>                              | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>field</td><td>true</td></tr><tr><td>mapping</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          |
+| TaskTable<br><i></i>                                     | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>created_at</td><td>false</td></tr><tr><td>deleted_at</td><td>false</td></tr><tr><td>id</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>owner_id</td><td>true</td></tr><tr><td>prompt</td><td>true</td></tr><tr><td>template_parameters</td><td>true</td></tr><tr><td>template_version_id</td><td>true</td></tr><tr><td>workspace_id</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |
 | Template<br><i>write, delete</i>                         | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>active_version_id</td><td>true</td></tr><tr><td>activity_bump</td><td>true</td></tr><tr><td>allow_user_autostart</td><td>true</td></tr><tr><td>allow_user_autostop</td><td>true</td></tr><tr><td>allow_user_cancel_workspace_jobs</td><td>true</td></tr><tr><td>autostart_block_days_of_week</td><td>true</td></tr><tr><td>autostop_requirement_days_of_week</td><td>true</td></tr><tr><td>autostop_requirement_weeks</td><td>true</td></tr><tr><td>cors_behavior</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_name</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>default_ttl</td><td>true</td></tr><tr><td>deleted</td><td>false</td></tr><tr><td>deprecated</td><td>true</td></tr><tr><td>description</td><td>true</td></tr><tr><td>display_name</td><td>true</td></tr><tr><td>failure_ttl</td><td>true</td></tr><tr><td>group_acl</td><td>true</td></tr><tr><td>icon</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>max_port_sharing_level</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_display_name</td><td>false</td></tr><tr><td>organization_icon</td><td>false</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>organization_name</td><td>false</td></tr><tr><td>provisioner</td><td>true</td></tr><tr><td>require_active_version</td><td>true</td></tr><tr><td>time_til_dormant</td><td>true</td></tr><tr><td>time_til_dormant_autodelete</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>use_classic_parameter_flow</td><td>true</td></tr><tr><td>user_acl</td><td>true</td></tr></tbody></table> |
 | TemplateVersion<br><i>create, write</i>                  | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>archived</td><td>true</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>created_by</td><td>true</td></tr><tr><td>created_by_avatar_url</td><td>false</td></tr><tr><td>created_by_name</td><td>false</td></tr><tr><td>created_by_username</td><td>false</td></tr><tr><td>external_auth_providers</td><td>false</td></tr><tr><td>has_ai_task</td><td>false</td></tr><tr><td>has_external_agent</td><td>false</td></tr><tr><td>id</td><td>true</td></tr><tr><td>job_id</td><td>false</td></tr><tr><td>message</td><td>false</td></tr><tr><td>name</td><td>true</td></tr><tr><td>organization_id</td><td>false</td></tr><tr><td>readme</td><td>true</td></tr><tr><td>source_example_id</td><td>false</td></tr><tr><td>template_id</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
 | User<br><i>create, write, delete</i>                     | <table><thead><tr><th>Field</th><th>Tracked</th></tr></thead><tbody> | <tr><td>avatar_url</td><td>false</td></tr><tr><td>created_at</td><td>false</td></tr><tr><td>deleted</td><td>true</td></tr><tr><td>email</td><td>true</td></tr><tr><td>github_com_user_id</td><td>false</td></tr><tr><td>hashed_one_time_passcode</td><td>false</td></tr><tr><td>hashed_password</td><td>true</td></tr><tr><td>id</td><td>true</td></tr><tr><td>is_system</td><td>true</td></tr><tr><td>last_seen_at</td><td>false</td></tr><tr><td>login_type</td><td>true</td></tr><tr><td>name</td><td>true</td></tr><tr><td>one_time_passcode_expires_at</td><td>true</td></tr><tr><td>quiet_hours_schedule</td><td>true</td></tr><tr><td>rbac_roles</td><td>true</td></tr><tr><td>status</td><td>true</td></tr><tr><td>updated_at</td><td>false</td></tr><tr><td>username</td><td>true</td></tr></tbody></table>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 4c8fcba929505..526deff93138f 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -7367,6 +7367,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `idp_sync_settings_role`         |
 | `workspace_agent`                |
 | `workspace_app`                  |
+| `task`                           |
 
 ## codersdk.Response
 
diff --git a/enterprise/audit/table.go b/enterprise/audit/table.go
index 8cba29f2e9196..9b887b30ef517 100644
--- a/enterprise/audit/table.go
+++ b/enterprise/audit/table.go
@@ -27,6 +27,7 @@ var AuditActionMap = map[string][]codersdk.AuditAction{
 	"Group":           {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
 	"APIKey":          {codersdk.AuditActionLogin, codersdk.AuditActionLogout, codersdk.AuditActionRegister, codersdk.AuditActionCreate, codersdk.AuditActionDelete},
 	"License":         {codersdk.AuditActionCreate, codersdk.AuditActionDelete},
+	"Task":            {codersdk.AuditActionCreate, codersdk.AuditActionWrite, codersdk.AuditActionDelete},
 }
 
 type Action string
@@ -347,6 +348,18 @@ var auditableResourcesTypes = map[any]map[string]Action{
 		"field":   ActionTrack,
 		"mapping": ActionTrack,
 	},
+	&database.TaskTable{}: {
+		"id":                  ActionTrack,
+		"organization_id":     ActionIgnore, // Never changes.
+		"owner_id":            ActionTrack,
+		"name":                ActionTrack,
+		"workspace_id":        ActionTrack,
+		"template_version_id": ActionTrack,
+		"template_parameters": ActionTrack,
+		"prompt":              ActionTrack,
+		"created_at":          ActionIgnore, // Never changes.
+		"deleted_at":          ActionIgnore, // Changes, but is implicit when a delete event is fired.
+	},
 }
 
 // auditMap converts a map of struct pointers to a map of struct names as
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index c84e4ed054b6a..71329fb318ce6 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -3060,6 +3060,7 @@ export type ResourceType =
 	| "organization"
 	| "organization_member"
 	| "prebuilds_settings"
+	| "task"
 	| "template"
 	| "template_version"
 	| "user"
@@ -3087,6 +3088,7 @@ export const ResourceTypes: ResourceType[] = [
 	"organization",
 	"organization_member",
 	"prebuilds_settings",
+	"task",
 	"template",
 	"template_version",
 	"user",

From 82945cfb1667deef65cc53f4f43db356c46c0b1c Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Wed, 15 Oct 2025 19:34:33 +0300
Subject: [PATCH 134/298] fix(coderd/database): add missing columns to tasks
 with status (#20311)

Updates coder/internal#976
---
 cli/exp_task_status_test.go                   |   1 +
 coderd/aitasks.go                             |  10 +
 coderd/apidoc/docs.go                         |  11 +
 coderd/apidoc/swagger.json                    |  11 +
 coderd/database/dump.sql                      |   5 +-
 ..._add_columns_to_tasks_with_status.down.sql |  72 +++
 ...82_add_columns_to_tasks_with_status.up.sql |  74 +++
 coderd/database/models.go                     |  25 +-
 coderd/database/querier_test.go               | 426 +++++++++++-------
 coderd/database/queries.sql.go                |  15 +-
 coderd/database/sqlc.yaml                     |   3 +
 codersdk/aitasks.go                           |   2 +
 docs/reference/api/schemas.md                 |  12 +
 site/src/api/typesGenerated.ts                |   2 +
 site/src/testHelpers/entities.ts              |   2 +
 15 files changed, 502 insertions(+), 169 deletions(-)
 create mode 100644 coderd/database/migrations/000382_add_columns_to_tasks_with_status.down.sql
 create mode 100644 coderd/database/migrations/000382_add_columns_to_tasks_with_status.up.sql

diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index be62a76476d35..1e255c05b95bc 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -193,6 +193,7 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "workspace_agent_id": null,
   "workspace_agent_lifecycle": null,
   "workspace_agent_health": null,
+  "workspace_app_id": null,
   "initial_prompt": "",
   "status": "running",
   "current_state": {
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 6bb706d1a5b54..95ad8008e88ca 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -268,6 +268,14 @@ func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Tas
 		}
 	}
 
+	var appID uuid.NullUUID
+	if ws.LatestBuild.AITaskSidebarAppID != nil {
+		appID = uuid.NullUUID{
+			Valid: true,
+			UUID:  *ws.LatestBuild.AITaskSidebarAppID,
+		}
+	}
+
 	return codersdk.Task{
 		ID:                      ws.ID,
 		OrganizationID:          ws.OrganizationID,
@@ -279,9 +287,11 @@ func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Tas
 		TemplateDisplayName:     ws.TemplateDisplayName,
 		TemplateIcon:            ws.TemplateIcon,
 		WorkspaceID:             uuid.NullUUID{Valid: true, UUID: ws.ID},
+		WorkspaceBuildNumber:    ws.LatestBuild.BuildNumber,
 		WorkspaceAgentID:        taskAgentID,
 		WorkspaceAgentLifecycle: taskAgentLifecycle,
 		WorkspaceAgentHealth:    taskAgentHealth,
+		WorkspaceAppID:          appID,
 		CreatedAt:               ws.CreatedAt,
 		UpdatedAt:               ws.UpdatedAt,
 		InitialPrompt:           initialPrompt,
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 0fc64ef9b0d18..b3bad21329fda 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -17613,6 +17613,17 @@ const docTemplate = `{
                 "workspace_agent_lifecycle": {
                     "$ref": "#/definitions/codersdk.WorkspaceAgentLifecycle"
                 },
+                "workspace_app_id": {
+                    "format": "uuid",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/uuid.NullUUID"
+                        }
+                    ]
+                },
+                "workspace_build_number": {
+                    "type": "integer"
+                },
                 "workspace_id": {
                     "format": "uuid",
                     "allOf": [
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 867e5e5818e88..a3319a947156d 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -16121,6 +16121,17 @@
 				"workspace_agent_lifecycle": {
 					"$ref": "#/definitions/codersdk.WorkspaceAgentLifecycle"
 				},
+				"workspace_app_id": {
+					"format": "uuid",
+					"allOf": [
+						{
+							"$ref": "#/definitions/uuid.NullUUID"
+						}
+					]
+				},
+				"workspace_build_number": {
+					"type": "integer"
+				},
 				"workspace_id": {
 					"format": "uuid",
 					"allOf": [
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 71e2845d1c245..8b5700e58d1f3 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -1971,7 +1971,10 @@ CREATE VIEW tasks_with_status AS
                 ELSE 'unknown'::task_status
             END
             ELSE 'unknown'::task_status
-        END AS status
+        END AS status,
+    task_app.workspace_build_number,
+    task_app.workspace_agent_id,
+    task_app.workspace_app_id
    FROM ((((tasks
      LEFT JOIN LATERAL ( SELECT task_app_1.workspace_build_number,
             task_app_1.workspace_agent_id,
diff --git a/coderd/database/migrations/000382_add_columns_to_tasks_with_status.down.sql b/coderd/database/migrations/000382_add_columns_to_tasks_with_status.down.sql
new file mode 100644
index 0000000000000..c9cd9c866510d
--- /dev/null
+++ b/coderd/database/migrations/000382_add_columns_to_tasks_with_status.down.sql
@@ -0,0 +1,72 @@
+DROP VIEW IF EXISTS tasks_with_status;
+
+-- Restore from 00037_add_columns_to_tasks_with_status.up.sql.
+CREATE VIEW
+	tasks_with_status
+AS
+	SELECT
+		tasks.*,
+		CASE
+			WHEN tasks.workspace_id IS NULL OR latest_build.job_status IS NULL THEN 'pending'::task_status
+
+			WHEN latest_build.job_status = 'failed' THEN 'error'::task_status
+
+			WHEN latest_build.transition IN ('stop', 'delete')
+				AND latest_build.job_status = 'succeeded' THEN 'paused'::task_status
+
+			WHEN latest_build.transition = 'start'
+				AND latest_build.job_status = 'pending' THEN 'initializing'::task_status
+
+			WHEN latest_build.transition = 'start' AND latest_build.job_status IN ('running', 'succeeded') THEN
+				CASE
+					WHEN agent_status.none THEN 'initializing'::task_status
+					WHEN agent_status.connecting THEN 'initializing'::task_status
+					WHEN agent_status.connected THEN
+						CASE
+							WHEN app_status.any_unhealthy THEN 'error'::task_status
+							WHEN app_status.any_initializing THEN 'initializing'::task_status
+							WHEN app_status.all_healthy_or_disabled THEN 'active'::task_status
+							ELSE 'unknown'::task_status
+						END
+					ELSE 'unknown'::task_status
+				END
+
+			ELSE 'unknown'::task_status
+		END AS status
+	FROM
+		tasks
+	LEFT JOIN LATERAL (
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps task_app
+		WHERE task_id = tasks.id
+		ORDER BY workspace_build_number DESC
+		LIMIT 1
+	) task_app ON TRUE
+	LEFT JOIN LATERAL (
+		SELECT
+			workspace_build.transition,
+			provisioner_job.job_status,
+			workspace_build.job_id
+		FROM workspace_builds workspace_build
+		JOIN provisioner_jobs provisioner_job ON provisioner_job.id = workspace_build.job_id
+		WHERE workspace_build.workspace_id = tasks.workspace_id
+			AND workspace_build.build_number = task_app.workspace_build_number
+	) latest_build ON TRUE
+	CROSS JOIN LATERAL (
+		SELECT
+			COUNT(*) = 0 AS none,
+			bool_or(workspace_agent.lifecycle_state IN ('created', 'starting')) AS connecting,
+			bool_and(workspace_agent.lifecycle_state = 'ready') AS connected
+		FROM workspace_agents workspace_agent
+		WHERE workspace_agent.id = task_app.workspace_agent_id
+	) agent_status
+	CROSS JOIN LATERAL (
+		SELECT
+			bool_or(workspace_app.health = 'unhealthy') AS any_unhealthy,
+			bool_or(workspace_app.health = 'initializing') AS any_initializing,
+			bool_and(workspace_app.health IN ('healthy', 'disabled')) AS all_healthy_or_disabled
+		FROM workspace_apps workspace_app
+		WHERE workspace_app.id = task_app.workspace_app_id
+	) app_status
+	WHERE
+		tasks.deleted_at IS NULL;
diff --git a/coderd/database/migrations/000382_add_columns_to_tasks_with_status.up.sql b/coderd/database/migrations/000382_add_columns_to_tasks_with_status.up.sql
new file mode 100644
index 0000000000000..4d949384c0d08
--- /dev/null
+++ b/coderd/database/migrations/000382_add_columns_to_tasks_with_status.up.sql
@@ -0,0 +1,74 @@
+-- Drop view from 00037_add_columns_to_tasks_with_status.up.sql.
+DROP VIEW IF EXISTS tasks_with_status;
+
+-- Add task_app columns.
+CREATE VIEW
+	tasks_with_status
+AS
+	SELECT
+		tasks.*,
+		CASE
+			WHEN tasks.workspace_id IS NULL OR latest_build.job_status IS NULL THEN 'pending'::task_status
+
+			WHEN latest_build.job_status = 'failed' THEN 'error'::task_status
+
+			WHEN latest_build.transition IN ('stop', 'delete')
+				AND latest_build.job_status = 'succeeded' THEN 'paused'::task_status
+
+			WHEN latest_build.transition = 'start'
+				AND latest_build.job_status = 'pending' THEN 'initializing'::task_status
+
+			WHEN latest_build.transition = 'start' AND latest_build.job_status IN ('running', 'succeeded') THEN
+				CASE
+					WHEN agent_status.none THEN 'initializing'::task_status
+					WHEN agent_status.connecting THEN 'initializing'::task_status
+					WHEN agent_status.connected THEN
+						CASE
+							WHEN app_status.any_unhealthy THEN 'error'::task_status
+							WHEN app_status.any_initializing THEN 'initializing'::task_status
+							WHEN app_status.all_healthy_or_disabled THEN 'active'::task_status
+							ELSE 'unknown'::task_status
+						END
+					ELSE 'unknown'::task_status
+				END
+
+			ELSE 'unknown'::task_status
+		END AS status,
+		task_app.*
+	FROM
+		tasks
+	LEFT JOIN LATERAL (
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps task_app
+		WHERE task_id = tasks.id
+		ORDER BY workspace_build_number DESC
+		LIMIT 1
+	) task_app ON TRUE
+	LEFT JOIN LATERAL (
+		SELECT
+			workspace_build.transition,
+			provisioner_job.job_status,
+			workspace_build.job_id
+		FROM workspace_builds workspace_build
+		JOIN provisioner_jobs provisioner_job ON provisioner_job.id = workspace_build.job_id
+		WHERE workspace_build.workspace_id = tasks.workspace_id
+			AND workspace_build.build_number = task_app.workspace_build_number
+	) latest_build ON TRUE
+	CROSS JOIN LATERAL (
+		SELECT
+			COUNT(*) = 0 AS none,
+			bool_or(workspace_agent.lifecycle_state IN ('created', 'starting')) AS connecting,
+			bool_and(workspace_agent.lifecycle_state = 'ready') AS connected
+		FROM workspace_agents workspace_agent
+		WHERE workspace_agent.id = task_app.workspace_agent_id
+	) agent_status
+	CROSS JOIN LATERAL (
+		SELECT
+			bool_or(workspace_app.health = 'unhealthy') AS any_unhealthy,
+			bool_or(workspace_app.health = 'initializing') AS any_initializing,
+			bool_and(workspace_app.health IN ('healthy', 'disabled')) AS all_healthy_or_disabled
+		FROM workspace_apps workspace_app
+		WHERE workspace_app.id = task_app.workspace_app_id
+	) app_status
+	WHERE
+		tasks.deleted_at IS NULL;
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 741d70f9d2680..8b0b6a97aa066 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -4200,17 +4200,20 @@ type TailnetTunnel struct {
 }
 
 type Task struct {
-	ID                 uuid.UUID       `db:"id" json:"id"`
-	OrganizationID     uuid.UUID       `db:"organization_id" json:"organization_id"`
-	OwnerID            uuid.UUID       `db:"owner_id" json:"owner_id"`
-	Name               string          `db:"name" json:"name"`
-	WorkspaceID        uuid.NullUUID   `db:"workspace_id" json:"workspace_id"`
-	TemplateVersionID  uuid.UUID       `db:"template_version_id" json:"template_version_id"`
-	TemplateParameters json.RawMessage `db:"template_parameters" json:"template_parameters"`
-	Prompt             string          `db:"prompt" json:"prompt"`
-	CreatedAt          time.Time       `db:"created_at" json:"created_at"`
-	DeletedAt          sql.NullTime    `db:"deleted_at" json:"deleted_at"`
-	Status             TaskStatus      `db:"status" json:"status"`
+	ID                   uuid.UUID       `db:"id" json:"id"`
+	OrganizationID       uuid.UUID       `db:"organization_id" json:"organization_id"`
+	OwnerID              uuid.UUID       `db:"owner_id" json:"owner_id"`
+	Name                 string          `db:"name" json:"name"`
+	WorkspaceID          uuid.NullUUID   `db:"workspace_id" json:"workspace_id"`
+	TemplateVersionID    uuid.UUID       `db:"template_version_id" json:"template_version_id"`
+	TemplateParameters   json.RawMessage `db:"template_parameters" json:"template_parameters"`
+	Prompt               string          `db:"prompt" json:"prompt"`
+	CreatedAt            time.Time       `db:"created_at" json:"created_at"`
+	DeletedAt            sql.NullTime    `db:"deleted_at" json:"deleted_at"`
+	Status               TaskStatus      `db:"status" json:"status"`
+	WorkspaceBuildNumber sql.NullInt32   `db:"workspace_build_number" json:"workspace_build_number"`
+	WorkspaceAgentID     uuid.NullUUID   `db:"workspace_agent_id" json:"workspace_agent_id"`
+	WorkspaceAppID       uuid.NullUUID   `db:"workspace_app_id" json:"workspace_app_id"`
 }
 
 type TaskTable struct {
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 9db6f585fbaa3..aca6156904eb9 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -6813,193 +6813,284 @@ func TestTasksWithStatusView(t *testing.T) {
 	}
 
 	tests := []struct {
-		name            string
-		buildStatus     database.ProvisionerJobStatus
-		buildTransition database.WorkspaceTransition
-		agentState      database.WorkspaceAgentLifecycleState
-		appHealths      []database.WorkspaceAppHealth
-		expectedStatus  database.TaskStatus
-		description     string
+		name                      string
+		buildStatus               database.ProvisionerJobStatus
+		buildTransition           database.WorkspaceTransition
+		agentState                database.WorkspaceAgentLifecycleState
+		appHealths                []database.WorkspaceAppHealth
+		expectedStatus            database.TaskStatus
+		description               string
+		expectBuildNumberValid    bool
+		expectBuildNumber         int32
+		expectWorkspaceAgentValid bool
+		expectWorkspaceAppValid   bool
 	}{
 		{
-			name:           "NoWorkspace",
-			expectedStatus: "pending",
-			description:    "Task with no workspace assigned",
+			name:                      "NoWorkspace",
+			expectedStatus:            "pending",
+			description:               "Task with no workspace assigned",
+			expectBuildNumberValid:    false,
+			expectWorkspaceAgentValid: false,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "FailedBuild",
-			buildStatus:     database.ProvisionerJobStatusFailed,
-			buildTransition: database.WorkspaceTransitionStart,
-			expectedStatus:  database.TaskStatusError,
-			description:     "Latest workspace build failed",
+			name:                      "FailedBuild",
+			buildStatus:               database.ProvisionerJobStatusFailed,
+			buildTransition:           database.WorkspaceTransitionStart,
+			expectedStatus:            database.TaskStatusError,
+			description:               "Latest workspace build failed",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: false,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "StoppedWorkspace",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStop,
-			expectedStatus:  database.TaskStatusPaused,
-			description:     "Workspace is stopped",
+			name:                      "StoppedWorkspace",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStop,
+			expectedStatus:            database.TaskStatusPaused,
+			description:               "Workspace is stopped",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: false,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "DeletedWorkspace",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionDelete,
-			expectedStatus:  database.TaskStatusPaused,
-			description:     "Workspace is deleted",
+			name:                      "DeletedWorkspace",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionDelete,
+			expectedStatus:            database.TaskStatusPaused,
+			description:               "Workspace is deleted",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: false,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "PendingStart",
-			buildStatus:     database.ProvisionerJobStatusPending,
-			buildTransition: database.WorkspaceTransitionStart,
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Workspace build is starting (pending)",
+			name:                      "PendingStart",
+			buildStatus:               database.ProvisionerJobStatusPending,
+			buildTransition:           database.WorkspaceTransitionStart,
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Workspace build is starting (pending)",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: false,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "RunningStart",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Workspace build is starting (running)",
+			name:                      "RunningStart",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Workspace build is starting (running)",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: false,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "StartingAgent",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateStarting,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Workspace is running but agent is starting",
+			name:                      "StartingAgent",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateStarting,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Workspace is running but agent is starting",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "CreatedAgent",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateCreated,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Workspace is running but agent is created",
+			name:                      "CreatedAgent",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateCreated,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Workspace is running but agent is created",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "ReadyAgentInitializingApp",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Agent is ready but app is initializing",
+			name:                      "ReadyAgentInitializingApp",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Agent is ready but app is initializing",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "ReadyAgentHealthyApp",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy},
-			expectedStatus:  database.TaskStatusActive,
-			description:     "Agent is ready and app is healthy",
+			name:                      "ReadyAgentHealthyApp",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy},
+			expectedStatus:            database.TaskStatusActive,
+			description:               "Agent is ready and app is healthy",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "ReadyAgentDisabledApp",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthDisabled},
-			expectedStatus:  database.TaskStatusActive,
-			description:     "Agent is ready and app health checking is disabled",
+			name:                      "ReadyAgentDisabledApp",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthDisabled},
+			expectedStatus:            database.TaskStatusActive,
+			description:               "Agent is ready and app health checking is disabled",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "ReadyAgentUnhealthyApp",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthUnhealthy},
-			expectedStatus:  database.TaskStatusError,
-			description:     "Agent is ready but app is unhealthy",
+			name:                      "ReadyAgentUnhealthyApp",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthUnhealthy},
+			expectedStatus:            database.TaskStatusError,
+			description:               "Agent is ready but app is unhealthy",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "AgentStartTimeout",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateStartTimeout,
-			expectedStatus:  database.TaskStatusUnknown,
-			description:     "Agent start timed out",
+			name:                      "AgentStartTimeout",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateStartTimeout,
+			expectedStatus:            database.TaskStatusUnknown,
+			description:               "Agent start timed out",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "AgentStartError",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateStartError,
-			expectedStatus:  database.TaskStatusUnknown,
-			description:     "Agent failed to start",
+			name:                      "AgentStartError",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateStartError,
+			expectedStatus:            database.TaskStatusUnknown,
+			description:               "Agent failed to start",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "AgentShuttingDown",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateShuttingDown,
-			expectedStatus:  database.TaskStatusUnknown,
-			description:     "Agent is shutting down",
+			name:                      "AgentShuttingDown",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateShuttingDown,
+			expectedStatus:            database.TaskStatusUnknown,
+			description:               "Agent is shutting down",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "AgentOff",
-			buildStatus:     database.ProvisionerJobStatusSucceeded,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateOff,
-			expectedStatus:  database.TaskStatusUnknown,
-			description:     "Agent is off",
+			name:                      "AgentOff",
+			buildStatus:               database.ProvisionerJobStatusSucceeded,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateOff,
+			expectedStatus:            database.TaskStatusUnknown,
+			description:               "Agent is off",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   false,
 		},
 		{
-			name:            "RunningJobReadyAgentHealthyApp",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy},
-			expectedStatus:  database.TaskStatusActive,
-			description:     "Running job with ready agent and healthy app should be active",
+			name:                      "RunningJobReadyAgentHealthyApp",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy},
+			expectedStatus:            database.TaskStatusActive,
+			description:               "Running job with ready agent and healthy app should be active",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "RunningJobReadyAgentInitializingApp",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Running job with ready agent but initializing app should be initializing",
+			name:                      "RunningJobReadyAgentInitializingApp",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Running job with ready agent but initializing app should be initializing",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "RunningJobReadyAgentUnhealthyApp",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthUnhealthy},
-			expectedStatus:  database.TaskStatusError,
-			description:     "Running job with ready agent but unhealthy app should be error",
+			name:                      "RunningJobReadyAgentUnhealthyApp",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthUnhealthy},
+			expectedStatus:            database.TaskStatusError,
+			description:               "Running job with ready agent but unhealthy app should be error",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "RunningJobConnectingAgent",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateStarting,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
-			expectedStatus:  database.TaskStatusInitializing,
-			description:     "Running job with connecting agent should be initializing",
+			name:                      "RunningJobConnectingAgent",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateStarting,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthInitializing},
+			expectedStatus:            database.TaskStatusInitializing,
+			description:               "Running job with connecting agent should be initializing",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "RunningJobReadyAgentDisabledApp",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthDisabled},
-			expectedStatus:  database.TaskStatusActive,
-			description:     "Running job with ready agent and disabled app health checking should be active",
+			name:                      "RunningJobReadyAgentDisabledApp",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthDisabled},
+			expectedStatus:            database.TaskStatusActive,
+			description:               "Running job with ready agent and disabled app health checking should be active",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 		{
-			name:            "RunningJobReadyAgentHealthyTaskAppUnhealthyOtherAppIsOK",
-			buildStatus:     database.ProvisionerJobStatusRunning,
-			buildTransition: database.WorkspaceTransitionStart,
-			agentState:      database.WorkspaceAgentLifecycleStateReady,
-			appHealths:      []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy, database.WorkspaceAppHealthUnhealthy},
-			expectedStatus:  database.TaskStatusActive,
-			description:     "Running job with ready agent and multiple healthy apps should be active",
+			name:                      "RunningJobReadyAgentHealthyTaskAppUnhealthyOtherAppIsOK",
+			buildStatus:               database.ProvisionerJobStatusRunning,
+			buildTransition:           database.WorkspaceTransitionStart,
+			agentState:                database.WorkspaceAgentLifecycleStateReady,
+			appHealths:                []database.WorkspaceAppHealth{database.WorkspaceAppHealthHealthy, database.WorkspaceAppHealthUnhealthy},
+			expectedStatus:            database.TaskStatusActive,
+			description:               "Running job with ready agent and multiple healthy apps should be active",
+			expectBuildNumberValid:    true,
+			expectBuildNumber:         1,
+			expectWorkspaceAgentValid: true,
+			expectWorkspaceAppValid:   true,
 		},
 	}
 
@@ -7018,7 +7109,22 @@ func TestTasksWithStatusView(t *testing.T) {
 			got, err := db.GetTaskByID(ctx, task.ID)
 			require.NoError(t, err)
 
-			require.Equal(t, tt.expectedStatus, got.Status, "unexpected status for test case: %s", tt.description)
+			require.Equal(t, tt.expectedStatus, got.Status)
+
+			require.Equal(t, tt.expectBuildNumberValid, got.WorkspaceBuildNumber.Valid)
+			if tt.expectBuildNumberValid {
+				require.Equal(t, tt.expectBuildNumber, got.WorkspaceBuildNumber.Int32)
+			}
+
+			require.Equal(t, tt.expectWorkspaceAgentValid, got.WorkspaceAgentID.Valid)
+			if tt.expectWorkspaceAgentValid {
+				require.NotEqual(t, uuid.Nil, got.WorkspaceAgentID.UUID)
+			}
+
+			require.Equal(t, tt.expectWorkspaceAppValid, got.WorkspaceAppID.Valid)
+			if tt.expectWorkspaceAppValid {
+				require.NotEqual(t, uuid.Nil, got.WorkspaceAppID.UUID)
+			}
 		})
 	}
 }
@@ -7095,11 +7201,14 @@ func TestGetTaskByWorkspaceID(t *testing.T) {
 
 			ctx := testutil.Context(t, testutil.WaitLong)
 
-			_, err := db.GetTaskByWorkspaceID(ctx, workspace.ID)
+			task, err := db.GetTaskByWorkspaceID(ctx, workspace.ID)
 			if tt.wantErr {
 				require.Error(t, err)
 			} else {
 				require.NoError(t, err)
+				require.False(t, task.WorkspaceBuildNumber.Valid)
+				require.False(t, task.WorkspaceAgentID.Valid)
+				require.False(t, task.WorkspaceAppID.Valid)
 			}
 		})
 	}
@@ -7354,7 +7463,7 @@ func TestListTasks(t *testing.T) {
 		})
 		pj := dbgen.ProvisionerJob(t, db, ps, database.ProvisionerJob{})
 		sidebarAppID := uuid.New()
-		_ = dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
+		wb := dbgen.WorkspaceBuild(t, db, database.WorkspaceBuild{
 			JobID:             pj.ID,
 			TemplateVersionID: tv.ID,
 			WorkspaceID:       ws.ID,
@@ -7377,9 +7486,10 @@ func TestListTasks(t *testing.T) {
 			WorkspaceID:       uuid.NullUUID{UUID: ws.ID, Valid: true},
 		})
 		_ = dbgen.TaskWorkspaceApp(t, db, database.TaskWorkspaceApp{
-			TaskID:           tsk.ID,
-			WorkspaceAgentID: uuid.NullUUID{Valid: true, UUID: agt.ID},
-			WorkspaceAppID:   uuid.NullUUID{Valid: true, UUID: wa.ID},
+			TaskID:               tsk.ID,
+			WorkspaceBuildNumber: wb.BuildNumber,
+			WorkspaceAgentID:     uuid.NullUUID{Valid: true, UUID: agt.ID},
+			WorkspaceAppID:       uuid.NullUUID{Valid: true, UUID: wa.ID},
 		})
 		t.Logf("task_id:%s owner_id:%s org_id:%s", tsk.ID, ownerID, orgID)
 		return tsk
@@ -7441,11 +7551,19 @@ func TestListTasks(t *testing.T) {
 			t.Parallel()
 			ctx := testutil.Context(t, testutil.WaitShort)
 			tasks, err := db.ListTasks(ctx, tc.filter)
-			if assert.NoError(t, err) {
-				require.Len(t, tasks, len(tc.expectIDs))
-				for idx, eid := range tc.expectIDs {
-					assert.Equal(t, eid.String(), tasks[idx].ID.String())
-				}
+			require.NoError(t, err)
+			require.Len(t, tasks, len(tc.expectIDs))
+
+			for idx, eid := range tc.expectIDs {
+				task := tasks[idx]
+				assert.Equal(t, eid, task.ID, "task ID mismatch at index %d", idx)
+
+				require.True(t, task.WorkspaceBuildNumber.Valid)
+				require.Greater(t, task.WorkspaceBuildNumber.Int32, int32(0))
+				require.True(t, task.WorkspaceAgentID.Valid)
+				require.NotEqual(t, uuid.Nil, task.WorkspaceAgentID.UUID)
+				require.True(t, task.WorkspaceAppID.Valid)
+				require.NotEqual(t, uuid.Nil, task.WorkspaceAppID.UUID)
 			}
 		})
 	}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 558ace2fbe1af..9319416c56001 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12508,7 +12508,7 @@ func (q *sqlQuerier) UpsertTailnetTunnel(ctx context.Context, arg UpsertTailnetT
 }
 
 const getTaskByID = `-- name: GetTaskByID :one
-SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status FROM tasks_with_status WHERE id = $1::uuid
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status WHERE id = $1::uuid
 `
 
 func (q *sqlQuerier) GetTaskByID(ctx context.Context, id uuid.UUID) (Task, error) {
@@ -12526,12 +12526,15 @@ func (q *sqlQuerier) GetTaskByID(ctx context.Context, id uuid.UUID) (Task, error
 		&i.CreatedAt,
 		&i.DeletedAt,
 		&i.Status,
+		&i.WorkspaceBuildNumber,
+		&i.WorkspaceAgentID,
+		&i.WorkspaceAppID,
 	)
 	return i, err
 }
 
 const getTaskByWorkspaceID = `-- name: GetTaskByWorkspaceID :one
-SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status FROM tasks_with_status WHERE workspace_id = $1::uuid
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status WHERE workspace_id = $1::uuid
 `
 
 func (q *sqlQuerier) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (Task, error) {
@@ -12549,6 +12552,9 @@ func (q *sqlQuerier) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.
 		&i.CreatedAt,
 		&i.DeletedAt,
 		&i.Status,
+		&i.WorkspaceBuildNumber,
+		&i.WorkspaceAgentID,
+		&i.WorkspaceAppID,
 	)
 	return i, err
 }
@@ -12600,7 +12606,7 @@ func (q *sqlQuerier) InsertTask(ctx context.Context, arg InsertTaskParams) (Task
 }
 
 const listTasks = `-- name: ListTasks :many
-SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status FROM tasks_with_status tws
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status tws
 WHERE tws.deleted_at IS NULL
 AND CASE WHEN $1::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = $1::UUID ELSE TRUE END
 AND CASE WHEN $2::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = $2::UUID ELSE TRUE END
@@ -12633,6 +12639,9 @@ func (q *sqlQuerier) ListTasks(ctx context.Context, arg ListTasksParams) ([]Task
 			&i.CreatedAt,
 			&i.DeletedAt,
 			&i.Status,
+			&i.WorkspaceBuildNumber,
+			&i.WorkspaceAgentID,
+			&i.WorkspaceAppID,
 		); err != nil {
 			return nil, err
 		}
diff --git a/coderd/database/sqlc.yaml b/coderd/database/sqlc.yaml
index d12a7d399c203..af700c14519be 100644
--- a/coderd/database/sqlc.yaml
+++ b/coderd/database/sqlc.yaml
@@ -103,6 +103,9 @@ sql:
           - column: "user_links.claims"
             go_type:
               type: "UserLinkClaims"
+          # Workaround for sqlc not interpreting the left join correctly.
+          - column: "tasks_with_status.workspace_build_number"
+            go_type: "database/sql.NullInt32"
         rename:
           group_member: GroupMemberTable
           group_members_expanded: GroupMember
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index 21efb15b5313e..67e68daa706cf 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -116,9 +116,11 @@ type Task struct {
 	TemplateDisplayName     string                   `json:"template_display_name" table:"template display name"`
 	TemplateIcon            string                   `json:"template_icon" table:"template icon"`
 	WorkspaceID             uuid.NullUUID            `json:"workspace_id" format:"uuid" table:"workspace id"`
+	WorkspaceBuildNumber    int32                    `json:"workspace_build_number,omitempty" table:"workspace build number"`
 	WorkspaceAgentID        uuid.NullUUID            `json:"workspace_agent_id" format:"uuid" table:"workspace agent id"`
 	WorkspaceAgentLifecycle *WorkspaceAgentLifecycle `json:"workspace_agent_lifecycle" table:"workspace agent lifecycle"`
 	WorkspaceAgentHealth    *WorkspaceAgentHealth    `json:"workspace_agent_health" table:"workspace agent health"`
+	WorkspaceAppID          uuid.NullUUID            `json:"workspace_app_id" format:"uuid" table:"workspace app id"`
 	InitialPrompt           string                   `json:"initial_prompt" table:"initial prompt"`
 	Status                  WorkspaceStatus          `json:"status" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"status"`
 	CurrentState            *TaskStateEntry          `json:"current_state" table:"cs,recursive_inline"`
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 526deff93138f..8d16d63a5ea51 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -312,6 +312,11 @@
         "valid": true
       },
       "workspace_agent_lifecycle": "created",
+      "workspace_app_id": {
+        "uuid": "string",
+        "valid": true
+      },
+      "workspace_build_number": 0,
       "workspace_id": {
         "uuid": "string",
         "valid": true
@@ -7705,6 +7710,11 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
     "valid": true
   },
   "workspace_agent_lifecycle": "created",
+  "workspace_app_id": {
+    "uuid": "string",
+    "valid": true
+  },
+  "workspace_build_number": 0,
   "workspace_id": {
     "uuid": "string",
     "valid": true
@@ -7733,6 +7743,8 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `workspace_agent_health`    | [codersdk.WorkspaceAgentHealth](#codersdkworkspaceagenthealth)       | false    |              |             |
 | `workspace_agent_id`        | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
 | `workspace_agent_lifecycle` | [codersdk.WorkspaceAgentLifecycle](#codersdkworkspaceagentlifecycle) | false    |              |             |
+| `workspace_app_id`          | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
+| `workspace_build_number`    | integer                                                              | false    |              |             |
 | `workspace_id`              | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
 
 #### Enumerated Values
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 71329fb318ce6..1deb951b79f60 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -3348,9 +3348,11 @@ export interface Task {
 	readonly template_display_name: string;
 	readonly template_icon: string;
 	readonly workspace_id: string | null;
+	readonly workspace_build_number?: number;
 	readonly workspace_agent_id: string | null;
 	readonly workspace_agent_lifecycle: WorkspaceAgentLifecycle | null;
 	readonly workspace_agent_health: WorkspaceAgentHealth | null;
+	readonly workspace_app_id: string | null;
 	readonly initial_prompt: string;
 	readonly status: WorkspaceStatus;
 	readonly current_state: TaskStateEntry | null;
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 0b8d87f8111ef..17e8c68315918 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -5028,9 +5028,11 @@ export const MockTask: TypesGen.Task = {
 	template_display_name: MockTemplate.display_name,
 	template_icon: MockTemplate.icon,
 	workspace_id: MockWorkspace.id,
+	workspace_build_number: MockWorkspaceBuild.build_number,
 	workspace_agent_id: MockWorkspaceAgent.id,
 	workspace_agent_lifecycle: MockWorkspaceAgent.lifecycle_state,
 	workspace_agent_health: MockWorkspaceAgent.health,
+	workspace_app_id: MockWorkspaceApp.id,
 	initial_prompt: "Perform some task",
 	status: "running",
 	current_state: {

From cc4127405b52a8ba66be3613d7510232a656c024 Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Wed, 15 Oct 2025 18:22:12 +0100
Subject: [PATCH 135/298] chore(dogfood): update claude-code module (#20191)

## Description

Update `claude_code` module `system_prompt` variable in template "Write
Coder on Coder". Claude-code module now incorporates Coder's inner
system prompt for proper integration with task reporting.

Related to PRs:
* https://github.com/coder/coder/pull/20053
* https://github.com/coder/registry/pull/443 and
https://github.com/coder/registry/pull/461

---------

Co-authored-by: Atif Ali <atif@coder.com>
---
 dogfood/coder/main.tf | 23 -----------------------
 1 file changed, 23 deletions(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index b17f0f94e179f..a16bbc74b02aa 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -813,7 +813,6 @@ resource "coder_metadata" "container_info" {
 
 locals {
   claude_system_prompt = <<-EOT
-    <system>
     -- Framing --
     You are a helpful Coding assistant. Aim to autonomously investigate
     and solve issues the user gives you and test your work, whenever possible.
@@ -822,7 +821,6 @@ locals {
     but opt for autonomy.
 
     -- Tool Selection --
-    - coder_report_task: providing status updates or requesting user input.
     - playwright: previewing your changes after you made them
       to confirm it worked as expected
     -	desktop-commander - use only for commands that keep running
@@ -834,33 +832,12 @@ locals {
     - Stays running? → desktop-commander
     - Finishes immediately? → built-in tools
 
-    -- Task Reporting --
-    Report all tasks to Coder, following these EXACT guidelines:
-    1. Be granular. If you are investigating with multiple steps, report each step
-    to coder.
-    2. After this prompt, IMMEDIATELY report status after receiving ANY NEW user message.
-    Do not report any status related with this system prompt.
-    3. Use "state": "working" when actively processing WITHOUT needing
-    additional user input
-    4. Use "state": "complete" only when finished with a task
-    5. Use "state": "failure" when you need ANY user input, lack sufficient
-    details, or encounter blockers
-
-    In your summary:
-    - Be specific about what you're doing
-    - Clearly indicate what information you need from the user when in
-    "failure" state
-    - Keep it under 160 characters
-    - Make it actionable
-
     -- Context --
     There is an existing application in the current directory.
     Be sure to read CLAUDE.md before making any changes.
 
     This is a real-world production application. As such, make sure to think carefully, use TODO lists, and plan carefully before making changes.
-    </system>
   EOT
-
 }
 
 module "claude-code" {

From df738abccd31b7f3aa8c0ffe03f45bfcb6b9a506 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 15 Oct 2025 14:22:31 -0300
Subject: [PATCH 136/298] chore: remove MUI icons (#20318)

---
 biome.jsonc                                   |  1 -
 site/package.json                             |  1 -
 site/pnpm-lock.yaml                           | 22 -------------------
 site/src/pages/LoginPage/OAuthSignInForm.tsx  |  4 ++--
 site/src/pages/SetupPage/SetupPageView.tsx    |  9 ++------
 site/src/pages/TaskPage/TaskStatusLink.tsx    |  4 ++--
 .../SecurityPage/SingleSignOnSection.tsx      |  6 ++---
 .../UsersPage/UsersTable/UsersTableBody.tsx   |  4 ++--
 site/src/theme/light/mui.ts                   |  9 --------
 site/src/theme/mui.ts                         | 10 ---------
 10 files changed, 11 insertions(+), 59 deletions(-)

diff --git a/biome.jsonc b/biome.jsonc
index 9d369e6dab6df..42a920eeeaf77 100644
--- a/biome.jsonc
+++ b/biome.jsonc
@@ -45,7 +45,6 @@
 					"options": {
 						"paths": {
 							"@mui/material": "Use @mui/material/<name> instead. See: https://material-ui.com/guides/minimizing-bundle-size/.",
-							"@mui/icons-material": "Use @mui/icons-material/<name> instead. See: https://material-ui.com/guides/minimizing-bundle-size/.",
 							"@mui/material/Avatar": "Use components/Avatar/Avatar instead.",
 							"@mui/material/Alert": "Use components/Alert/Alert instead.",
 							"@mui/material/Popover": "Use components/Popover/Popover instead.",
diff --git a/site/package.json b/site/package.json
index 62b2b8dd64981..bbabb4e1d444a 100644
--- a/site/package.json
+++ b/site/package.json
@@ -47,7 +47,6 @@
 		"@fontsource/jetbrains-mono": "5.2.5",
 		"@fontsource/source-code-pro": "5.2.5",
 		"@monaco-editor/react": "4.7.0",
-		"@mui/icons-material": "5.18.0",
 		"@mui/material": "5.18.0",
 		"@mui/system": "5.18.0",
 		"@mui/utils": "5.17.1",
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index e788524025aeb..96373e373f23b 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -55,9 +55,6 @@ importers:
       '@monaco-editor/react':
         specifier: 4.7.0
         version: 4.7.0(monaco-editor@0.53.0)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@mui/icons-material':
-        specifier: 5.18.0
-        version: 5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)
       '@mui/material':
         specifier: 5.18.0
         version: 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
@@ -1378,17 +1375,6 @@ packages:
   '@mui/core-downloads-tracker@5.18.0':
     resolution: {integrity: sha512-jbhwoQ1AY200PSSOrNXmrFCaSDSJWP7qk6urkTmIirvRXDROkqe+QwcLlUiw/PrREwsIF/vm3/dAXvjlMHF0RA==, tarball: https://registry.npmjs.org/@mui/core-downloads-tracker/-/core-downloads-tracker-5.18.0.tgz}
 
-  '@mui/icons-material@5.18.0':
-    resolution: {integrity: sha512-1s0vEZj5XFXDMmz3Arl/R7IncFqJ+WQ95LDp1roHWGDE2oCO3IS4/hmiOv1/8SD9r6B7tv9GLiqVZYHo+6PkTg==, tarball: https://registry.npmjs.org/@mui/icons-material/-/icons-material-5.18.0.tgz}
-    engines: {node: '>=12.0.0'}
-    peerDependencies:
-      '@mui/material': ^5.0.0
-      '@types/react': ^17.0.0 || ^18.0.0 || ^19.0.0
-      react: ^17.0.0 || ^18.0.0 || ^19.0.0
-    peerDependenciesMeta:
-      '@types/react':
-        optional: true
-
   '@mui/material@5.18.0':
     resolution: {integrity: sha512-bbH/HaJZpFtXGvWg3TsBWG4eyt3gah3E7nCNU8GLyRjVoWcA91Vm/T+sjHfUcwgJSw9iLtucfHBoq+qW/T30aA==, tarball: https://registry.npmjs.org/@mui/material/-/material-5.18.0.tgz}
     engines: {node: '>=12.0.0'}
@@ -7595,14 +7581,6 @@ snapshots:
 
   '@mui/core-downloads-tracker@5.18.0': {}
 
-  '@mui/icons-material@5.18.0(@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(@types/react@19.1.17)(react@19.1.1)':
-    dependencies:
-      '@babel/runtime': 7.26.10
-      '@mui/material': 5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      react: 19.1.1
-    optionalDependencies:
-      '@types/react': 19.1.17
-
   '@mui/material@5.18.0(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@emotion/styled@11.14.1(@emotion/react@11.14.0(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react@19.1.1))(@types/react@19.1.17)(react-dom@19.1.1(react@19.1.1))(react@19.1.1)':
     dependencies:
       '@babel/runtime': 7.26.10
diff --git a/site/src/pages/LoginPage/OAuthSignInForm.tsx b/site/src/pages/LoginPage/OAuthSignInForm.tsx
index e2c08caf69f35..9cf90c9a83b7c 100644
--- a/site/src/pages/LoginPage/OAuthSignInForm.tsx
+++ b/site/src/pages/LoginPage/OAuthSignInForm.tsx
@@ -1,7 +1,7 @@
-import GitHubIcon from "@mui/icons-material/GitHub";
 import { visuallyHidden } from "@mui/utils";
 import type { AuthMethods } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
+import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import { KeyIcon } from "lucide-react";
 import { type FC, useId } from "react";
 import { Language } from "./Language";
@@ -33,7 +33,7 @@ export const OAuthSignInForm: FC<OAuthSignInFormProps> = ({
 							redirectTo,
 						)}`}
 					>
-						<GitHubIcon />
+						<ExternalImage src="/icon/github.svg" />
 						{Language.githubSignIn}
 					</a>
 				</Button>
diff --git a/site/src/pages/SetupPage/SetupPageView.tsx b/site/src/pages/SetupPage/SetupPageView.tsx
index 57534ddbe74cd..28e750bfb31dc 100644
--- a/site/src/pages/SetupPage/SetupPageView.tsx
+++ b/site/src/pages/SetupPage/SetupPageView.tsx
@@ -1,4 +1,3 @@
-import GitHubIcon from "@mui/icons-material/GitHub";
 import AlertTitle from "@mui/material/AlertTitle";
 import Autocomplete from "@mui/material/Autocomplete";
 import Checkbox from "@mui/material/Checkbox";
@@ -10,6 +9,7 @@ import type * as TypesGen from "api/typesGenerated";
 import { isAxiosError } from "axios";
 import { Alert, AlertDetail } from "components/Alert/Alert";
 import { Button } from "components/Button/Button";
+import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import { FormFields, VerticalForm } from "components/Form/Form";
 import { CoderIcon } from "components/Icons/CoderIcon";
 import { PasswordField } from "components/PasswordField/PasswordField";
@@ -98,11 +98,6 @@ const numberOfDevelopersOptions = [
 	"2500+",
 ];
 
-const iconStyles = {
-	width: 16,
-	height: 16,
-};
-
 interface SetupPageViewProps {
 	onSubmit: (firstUser: TypesGen.CreateFirstUserRequest) => void;
 	error?: unknown;
@@ -174,7 +169,7 @@ export const SetupPageView: FC<SetupPageViewProps> = ({
 						<>
 							<Button className="w-full" asChild type="submit" size="lg">
 								<a href="/api/v2/users/oauth2/github/callback">
-									<GitHubIcon css={iconStyles} />
+									<ExternalImage src="/icon/github.svg" />
 									{Language.githubCreate}
 								</a>
 							</Button>
diff --git a/site/src/pages/TaskPage/TaskStatusLink.tsx b/site/src/pages/TaskPage/TaskStatusLink.tsx
index 7fbc74d937d23..c7f53e0a3ef15 100644
--- a/site/src/pages/TaskPage/TaskStatusLink.tsx
+++ b/site/src/pages/TaskPage/TaskStatusLink.tsx
@@ -1,5 +1,5 @@
-import GitHub from "@mui/icons-material/GitHub";
 import { Button } from "components/Button/Button";
+import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import {
 	BugIcon,
 	ExternalLinkIcon,
@@ -41,7 +41,7 @@ export const TaskStatusLink: FC<TaskStatusLinkProps> = ({ uri }) => {
 								: `${org}/${repo} issue`;
 							break;
 						default:
-							icon = <GitHub />;
+							icon = <ExternalImage src="/icon/github.svg" />;
 							if (org && repo) {
 								label = `${org}/${repo}`;
 							}
diff --git a/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx b/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx
index 58a4e0e73e1c7..d8f1a51f13d2b 100644
--- a/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx
+++ b/site/src/pages/UserSettingsPage/SecurityPage/SingleSignOnSection.tsx
@@ -1,5 +1,4 @@
 import { useTheme } from "@emotion/react";
-import GitHubIcon from "@mui/icons-material/GitHub";
 import Link from "@mui/material/Link";
 import TextField from "@mui/material/TextField";
 import { API } from "api/api";
@@ -13,6 +12,7 @@ import type {
 import { Button } from "components/Button/Button";
 import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
 import { EmptyState } from "components/EmptyState/EmptyState";
+import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import { Stack } from "components/Stack/Stack";
 import { CircleCheck as CircleCheckIcon, KeyIcon } from "lucide-react";
 import { type FC, useState } from "react";
@@ -155,7 +155,7 @@ export const SingleSignOnSection: FC<SingleSignOnSectionProps> = ({
 									disabled={isUpdating}
 									onClick={() => openConfirmation("github")}
 								>
-									<GitHubIcon />
+									<ExternalImage src="/icon/github.svg" />
 									GitHub
 								</Button>
 							)}
@@ -204,7 +204,7 @@ export const SingleSignOnSection: FC<SingleSignOnSectionProps> = ({
 							</span>
 							<div css={{ marginLeft: "auto", lineHeight: 1 }}>
 								{userLoginType.login_type === "github" ? (
-									<GitHubIcon css={{ width: 16, height: 16 }} />
+									<ExternalImage src="/icon/github.svg" />
 								) : (
 									<OIDCIcon oidcAuth={authMethods.oidc} />
 								)}
diff --git a/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx b/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
index a070ad7913a68..c605928dbb059 100644
--- a/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
+++ b/site/src/pages/UsersPage/UsersTable/UsersTableBody.tsx
@@ -1,5 +1,4 @@
 import type { Interpolation, Theme } from "@emotion/react";
-import GitHub from "@mui/icons-material/GitHub";
 import Skeleton from "@mui/material/Skeleton";
 import type { GroupsByUserId } from "api/queries/groups";
 import type * as TypesGen from "api/typesGenerated";
@@ -16,6 +15,7 @@ import {
 	DropdownMenuTrigger,
 } from "components/DropdownMenu/DropdownMenu";
 import { EmptyState } from "components/EmptyState/EmptyState";
+import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import { LastSeen } from "components/LastSeen/LastSeen";
 import { TableCell, TableRow } from "components/Table/Table";
 import {
@@ -269,7 +269,7 @@ const LoginType: FC<LoginTypeProps> = ({ authMethods, value }) => {
 		icon = <BanIcon css={styles.icon} />;
 	} else if (value === "github") {
 		displayName = "GitHub";
-		icon = <GitHub css={styles.icon} />;
+		icon = <ExternalImage src="/icon/github.svg" css={styles.icon} />;
 	} else if (value === "token") {
 		displayName = "Token";
 		icon = <KeyIcon css={styles.icon} />;
diff --git a/site/src/theme/light/mui.ts b/site/src/theme/light/mui.ts
index 8fe2e25b6ca0d..d504bcdf77173 100644
--- a/site/src/theme/light/mui.ts
+++ b/site/src/theme/light/mui.ts
@@ -186,15 +186,6 @@ const muiTheme = createTheme({
 				}),
 			},
 		},
-		MuiIconButton: {
-			styleOverrides: {
-				root: {
-					"&.Mui-focusVisible": {
-						boxShadow: `0 0 0 2px ${tw.blue[600]}`,
-					},
-				},
-			},
-		},
 	},
 });
 
diff --git a/site/src/theme/mui.ts b/site/src/theme/mui.ts
index f7b5ab1bc52ab..95b66520b52f9 100644
--- a/site/src/theme/mui.ts
+++ b/site/src/theme/mui.ts
@@ -322,14 +322,4 @@ export const components = {
 			},
 		},
 	},
-
-	MuiIconButton: {
-		styleOverrides: {
-			root: {
-				"&.Mui-focusVisible": {
-					boxShadow: `0 0 0 2px ${tw.blue[400]}`,
-				},
-			},
-		},
-	},
 } satisfies ThemeOptions["components"];

From 6b990bda52d8909669b2ecef556d0c0a8af4785c Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 15 Oct 2025 14:23:49 -0300
Subject: [PATCH 137/298] fix: minor visual fixes in the tasks table (#20317)

- Fix table size for failure and empty states
- Add skeleton for the "Delete" action in the table row

Fixes https://github.com/coder/coder/issues/20281
---
 site/src/pages/TasksPage/TasksTable.tsx | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/site/src/pages/TasksPage/TasksTable.tsx b/site/src/pages/TasksPage/TasksTable.tsx
index c9ff75bb36ddc..8af0039b63911 100644
--- a/site/src/pages/TasksPage/TasksTable.tsx
+++ b/site/src/pages/TasksPage/TasksTable.tsx
@@ -74,7 +74,7 @@ type TasksErrorBodyProps = {
 const TasksErrorBody: FC<TasksErrorBodyProps> = ({ error, onRetry }) => {
 	return (
 		<TableRow>
-			<TableCell colSpan={4} className="text-center">
+			<TableCell colSpan={5} className="text-center">
 				<div className="rounded-lg w-full min-h-80 flex items-center justify-center">
 					<div className="flex flex-col items-center">
 						<h3 className="m-0 font-medium text-content-primary text-base">
@@ -97,7 +97,7 @@ const TasksErrorBody: FC<TasksErrorBodyProps> = ({ error, onRetry }) => {
 const TasksEmpty: FC = () => {
 	return (
 		<TableRow>
-			<TableCell colSpan={4} className="text-center">
+			<TableCell colSpan={5} className="text-center">
 				<div className="w-full min-h-80 p-4 flex items-center justify-center">
 					<div className="flex flex-col items-center">
 						<h3 className="m-0 font-medium text-content-primary text-base">
@@ -216,6 +216,11 @@ const TasksSkeleton: FC = () => {
 				<TableCell>
 					<AvatarDataSkeleton />
 				</TableCell>
+				<TableCell>
+					<div className="flex justify-end items-center">
+						<Skeleton className="size-8" />
+					</div>
+				</TableCell>
 			</TableRowSkeleton>
 		</TableLoaderSkeleton>
 	);

From 91d4f8b59ba2f020dbd053d58629f0093938a2ad Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 15 Oct 2025 14:24:40 -0300
Subject: [PATCH 138/298] fix: use the selected version to check external auth
 (#20316)

Fixes https://github.com/coder/coder/issues/20315
---
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   | 60 ++++++++++++++++++-
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   | 21 ++++---
 2 files changed, 69 insertions(+), 12 deletions(-)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index 5577ff6d9046c..918df28d6171f 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -243,7 +243,6 @@ export const SelectTemplateVersion: Story = {
 export const OnError: Story = {
 	decorators: [withGlobalSnackbar],
 	beforeEach: () => {
-		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
 		spyOn(API, "getTemplate").mockResolvedValue(MockTemplate);
 		spyOn(API.experimental, "getTasks").mockResolvedValue(MockTasks);
 		spyOn(API.experimental, "createTask").mockRejectedValue(
@@ -349,3 +348,62 @@ export const ExternalAuthError: Story = {
 		});
 	},
 };
+
+const tmplWithExternalAuth = {
+	...MockTemplateVersion,
+	id: "2",
+	name: "With external",
+};
+
+export const CheckExternalAuthOnChangingVersions: Story = {
+	args: {
+		templates: [
+			{
+				...MockTemplate,
+				active_version_id: tmplWithExternalAuth.id,
+			},
+		],
+	},
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersions").mockResolvedValue([
+			{
+				...MockTemplateVersion,
+				id: "1",
+				name: "No external",
+			},
+			tmplWithExternalAuth,
+		]);
+		spyOn(API, "getTemplateVersionExternalAuth").mockImplementation(
+			(versionId: string) => {
+				return Promise.resolve(
+					versionId === tmplWithExternalAuth.id
+						? [MockTemplateVersionExternalAuthGithub]
+						: [],
+				);
+			},
+		);
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("Renders external authentication", async () => {
+			await canvas.findByRole("button", { name: /connect to github/i });
+		});
+
+		await step("Change into version without external auth", async () => {
+			const body = within(canvasElement.ownerDocument.body);
+			const versionSelect = await canvas.findByLabelText(/template version/i);
+			await userEvent.click(versionSelect);
+			const versionOption = await body.findByRole("option", {
+				name: /no external/i,
+			});
+			await userEvent.click(versionOption);
+		});
+
+		await step("Don't render external authentication", async () => {
+			expect(
+				canvas.queryByRole("button", { name: /connect to github/i }),
+			).not.toBeInTheDocument();
+		});
+	},
+};
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index 1e9c2d2f49653..643d9713a9864 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -150,13 +150,6 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 		(t) => t.id === selectedTemplateId,
 	) as Template;
 
-	const {
-		externalAuth,
-		externalAuthError,
-		isPollingExternalAuth,
-		isLoadingExternalAuth,
-	} = useExternalAuth(selectedTemplate.active_version_id);
-
 	// Template versions
 	const [selectedVersionId, setSelectedVersionId] = useState(
 		selectedTemplate.active_version_id,
@@ -192,6 +185,12 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 	}, [presetPrompt]);
 
 	// External Auth
+	const {
+		externalAuth,
+		externalAuthError,
+		isPollingExternalAuth,
+		isLoadingExternalAuth,
+	} = useExternalAuth(selectedVersionId);
 	const missedExternalAuth = externalAuth?.filter(
 		(auth) => !auth.optional && !auth.authenticated,
 	);
@@ -361,7 +360,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 					<div className="flex items-center gap-2">
 						{missedExternalAuth && (
 							<ExternalAuthButtons
-								template={selectedTemplate}
+								versionId={selectedVersionId}
 								missedExternalAuth={missedExternalAuth}
 							/>
 						)}
@@ -408,19 +407,19 @@ const PromptSelectTrigger: FC<SelectTriggerProps> = ({
 };
 
 type ExternalAuthButtonProps = {
-	template: Template;
+	versionId: string;
 	missedExternalAuth: TemplateVersionExternalAuth[];
 };
 
 const ExternalAuthButtons: FC<ExternalAuthButtonProps> = ({
-	template,
+	versionId,
 	missedExternalAuth,
 }) => {
 	const {
 		startPollingExternalAuth,
 		isPollingExternalAuth,
 		externalAuthPollingState,
-	} = useExternalAuth(template.active_version_id);
+	} = useExternalAuth(versionId);
 	const shouldRetry = externalAuthPollingState === "abandoned";
 
 	return missedExternalAuth.map((auth) => {

From 1c8ee5cb88fa3722e738383476de3da88c2076c4 Mon Sep 17 00:00:00 2001
From: yyefimov <m4euge@gmail.com>
Date: Wed, 15 Oct 2025 13:37:37 -0400
Subject: [PATCH 139/298] fix(coderd): support string type for oidc response's
 expires_in json property (#20152)

Some versions of Azure AD return expires_in property as string. Use
json.Number to accept either integer or string and then convert to
int64.
Helpful links:

https://learn.microsoft.com/en-us/answers/questions/2337020/azure-ad-token-endpoint-returns-expires-in-as-stri

https://feedback.azure.com/d365community/idea/7772fd95-26e6-ec11-a81b-0022484ee92d
---
 coderd/oauthpki/oidcpki.go | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/coderd/oauthpki/oidcpki.go b/coderd/oauthpki/oidcpki.go
index fa1c3854af1dd..76f8d59c88cce 100644
--- a/coderd/oauthpki/oidcpki.go
+++ b/coderd/oauthpki/oidcpki.go
@@ -222,8 +222,9 @@ func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
 		RefreshToken string `json:"refresh_token,omitempty"`
 
 		// Extra fields returned by the refresh that are needed
-		IDToken   string `json:"id_token"`
-		ExpiresIn int64  `json:"expires_in"` // relative seconds from now
+		IDToken   string      `json:"id_token"`
+		ExpiresIn json.Number `json:"expires_in"` // relative seconds from now, use Number since Azure AD might return string
+
 		// error fields
 		// https://datatracker.ietf.org/doc/html/rfc6749#section-5.2
 		ErrorCode        string `json:"error"`
@@ -256,8 +257,13 @@ func (src *jwtTokenSource) Token() (*oauth2.Token, error) {
 		RefreshToken: tokenRes.RefreshToken,
 	}
 
-	if secs := tokenRes.ExpiresIn; secs > 0 {
-		newToken.Expiry = time.Now().Add(time.Duration(secs) * time.Second)
+	expiresIn, convertErr := tokenRes.ExpiresIn.Int64()
+	if convertErr != nil {
+		return nil, xerrors.Errorf("oauth2: cannot convert expires_in to int64: %w", convertErr)
+	}
+
+	if expiresIn > 0 {
+		newToken.Expiry = time.Now().Add(time.Duration(expiresIn) * time.Second)
 	}
 
 	// ID token is a JWT token. We can decode it to get the expiry.

From 9bef5de30d8921bdeeec5ff02f14fdd7d1d932d7 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Wed, 15 Oct 2025 20:23:29 +0100
Subject: [PATCH 140/298] chore: upgrade coder/clistat to v1.1.1 (#20322)

coder/clistat v1.1.1 contains a bug fix
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index a4c53bd6ac606..6a59e061b2834 100644
--- a/go.mod
+++ b/go.mod
@@ -462,7 +462,7 @@ require (
 	sigs.k8s.io/yaml v1.5.0 // indirect
 )
 
-require github.com/coder/clistat v1.1.0
+require github.com/coder/clistat v1.1.1
 
 require github.com/SherClockHolmes/webpush-go v1.4.0
 
diff --git a/go.sum b/go.sum
index e86141f3a6491..0bbf3ba6041b4 100644
--- a/go.sum
+++ b/go.sum
@@ -919,8 +919,8 @@ github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945/go.mod h1:d1AMFw81rUgrGHuZzWdPNhkY0G8w7pvLNLYF0e3ceC4=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41 h1:SBN/DA63+ZHwuWwPHPYoCZ/KLAjHv5g4h2MS4f2/MTI=
 github.com/coder/bubbletea v1.2.2-0.20241212190825-007a1cdb2c41/go.mod h1:I9ULxr64UaOSUv7hcb3nX4kowodJCVS7vt7VVJk/kW4=
-github.com/coder/clistat v1.1.0 h1:RTCLX+0/Uur/qFHSlbT2lKen+fWdicSlT9AMaF5jZWs=
-github.com/coder/clistat v1.1.0/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
+github.com/coder/clistat v1.1.1 h1:T45dlwr7fSmjLPGLk7QRKgynnDeMOPoraHSGtLIHY3s=
+github.com/coder/clistat v1.1.1/go.mod h1:F+gLef+F9chVrleq808RBxdaoq52R4VLopuLdAsh8Y4=
 github.com/coder/flog v1.1.0 h1:kbAes1ai8fIS5OeV+QAnKBQE22ty1jRF/mcAwHpLBa4=
 github.com/coder/flog v1.1.0/go.mod h1:UQlQvrkJBvnRGo69Le8E24Tcl5SJleAAR7gYEHzAmdQ=
 github.com/coder/glog v1.0.1-0.20220322161911-7365fe7f2cd1/go.mod h1:EWib/APOK0SL3dFbYqvxE3UYd8E6s1ouQ7iEp/0LWV4=

From 41de4ad91a8903680af4c9e58b6e7ee7debf03ad Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Wed, 15 Oct 2025 13:21:20 -0800
Subject: [PATCH 141/298] feat: add task send and logs MCP tools (#20230)

Closes https://github.com/coder/internal/issues/776
---
 coderd/database/dbfake/dbfake.go |  10 +-
 codersdk/toolsdk/toolsdk.go      | 107 ++++++++++++
 codersdk/toolsdk/toolsdk_test.go | 271 ++++++++++++++++++++++++++++++-
 3 files changed, 380 insertions(+), 8 deletions(-)

diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
index a4742a09fff6c..1479dfb198944 100644
--- a/coderd/database/dbfake/dbfake.go
+++ b/coderd/database/dbfake/dbfake.go
@@ -119,17 +119,21 @@ func (b WorkspaceBuildBuilder) WithAgent(mutations ...func([]*sdkproto.Agent) []
 	return b
 }
 
-func (b WorkspaceBuildBuilder) WithTask() WorkspaceBuildBuilder {
+func (b WorkspaceBuildBuilder) WithTask(seed *sdkproto.App) WorkspaceBuildBuilder {
 	//nolint: revive // returns modified struct
 	b.taskAppID = uuid.New()
+	if seed == nil {
+		seed = &sdkproto.App{}
+	}
 	return b.Params(database.WorkspaceBuildParameter{
 		Name:  codersdk.AITaskPromptParameterName,
 		Value: "list me",
 	}).WithAgent(func(a []*sdkproto.Agent) []*sdkproto.Agent {
 		a[0].Apps = []*sdkproto.App{
 			{
-				Id:   b.taskAppID.String(),
-				Slug: "vcode",
+				Id:   takeFirst(seed.Id, b.taskAppID.String()),
+				Slug: takeFirst(seed.Slug, "vcode"),
+				Url:  takeFirst(seed.Url, ""),
 			},
 		}
 		return a
diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index c8228e51049d9..566b2fcaf9d64 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -55,6 +55,8 @@ const (
 	ToolNameDeleteTask                  = "coder_delete_task"
 	ToolNameListTasks                   = "coder_list_tasks"
 	ToolNameGetTaskStatus               = "coder_get_task_status"
+	ToolNameSendTaskInput               = "coder_send_task_input"
+	ToolNameGetTaskLogs                 = "coder_get_task_logs"
 )
 
 func NewDeps(client *codersdk.Client, opts ...func(*Deps)) (Deps, error) {
@@ -233,6 +235,8 @@ var All = []GenericTool{
 	DeleteTask.Generic(),
 	ListTasks.Generic(),
 	GetTaskStatus.Generic(),
+	SendTaskInput.Generic(),
+	GetTaskLogs.Generic(),
 }
 
 type ReportTaskArgs struct {
@@ -2033,6 +2037,97 @@ var GetTaskStatus = Tool[GetTaskStatusArgs, GetTaskStatusResponse]{
 	},
 }
 
+type SendTaskInputArgs struct {
+	TaskID string `json:"task_id"`
+	Input  string `json:"input"`
+}
+
+var SendTaskInput = Tool[SendTaskInputArgs, codersdk.Response]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameSendTaskInput,
+		Description: `Send input to a running task.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"task_id": map[string]any{
+					"type":        "string",
+					"description": taskIDDescription("prompt"),
+				},
+				"input": map[string]any{
+					"type":        "string",
+					"description": "The input to send to the task.",
+				},
+			},
+			Required: []string{"task_id", "input"},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args SendTaskInputArgs) (codersdk.Response, error) {
+		if args.TaskID == "" {
+			return codersdk.Response{}, xerrors.New("task_id is required")
+		}
+
+		if args.Input == "" {
+			return codersdk.Response{}, xerrors.New("input is required")
+		}
+
+		expClient := codersdk.NewExperimentalClient(deps.coderClient)
+		id, owner, err := resolveTaskID(ctx, deps.coderClient, args.TaskID)
+		if err != nil {
+			return codersdk.Response{}, err
+		}
+
+		err = expClient.TaskSend(ctx, owner, id, codersdk.TaskSendRequest{
+			Input: args.Input,
+		})
+		if err != nil {
+			return codersdk.Response{}, xerrors.Errorf("send task input %q: %w", args.TaskID, err)
+		}
+
+		return codersdk.Response{
+			Message: "Input sent to task successfully.",
+		}, nil
+	},
+}
+
+type GetTaskLogsArgs struct {
+	TaskID string `json:"task_id"`
+}
+
+var GetTaskLogs = Tool[GetTaskLogsArgs, codersdk.TaskLogsResponse]{
+	Tool: aisdk.Tool{
+		Name:        ToolNameGetTaskLogs,
+		Description: `Get the logs of a task.`,
+		Schema: aisdk.Schema{
+			Properties: map[string]any{
+				"task_id": map[string]any{
+					"type":        "string",
+					"description": taskIDDescription("query"),
+				},
+			},
+			Required: []string{"task_id"},
+		},
+	},
+	UserClientOptional: true,
+	Handler: func(ctx context.Context, deps Deps, args GetTaskLogsArgs) (codersdk.TaskLogsResponse, error) {
+		if args.TaskID == "" {
+			return codersdk.TaskLogsResponse{}, xerrors.New("task_id is required")
+		}
+
+		expClient := codersdk.NewExperimentalClient(deps.coderClient)
+		id, owner, err := resolveTaskID(ctx, deps.coderClient, args.TaskID)
+		if err != nil {
+			return codersdk.TaskLogsResponse{}, err
+		}
+
+		logs, err := expClient.TaskLogs(ctx, owner, id)
+		if err != nil {
+			return codersdk.TaskLogsResponse{}, xerrors.Errorf("get task logs %q: %w", args.TaskID, err)
+		}
+
+		return logs, nil
+	},
+}
+
 // normalizedNamedWorkspace normalizes the workspace name before getting the
 // workspace by name.
 func normalizedNamedWorkspace(ctx context.Context, client *codersdk.Client, name string) (codersdk.Workspace, error) {
@@ -2110,3 +2205,15 @@ func taskIDDescription(action string) string {
 func userDescription(action string) string {
 	return fmt.Sprintf("Username or ID of the user for which to %s. Omit or use the `me` keyword to %s for the authenticated user.", action, action)
 }
+
+func resolveTaskID(ctx context.Context, coderClient *codersdk.Client, taskID string) (uuid.UUID, string, error) {
+	id, err := uuid.Parse(taskID)
+	if err == nil {
+		return id, codersdk.Me, nil
+	}
+	ws, err := normalizedNamedWorkspace(ctx, coderClient, taskID)
+	if err != nil {
+		return uuid.UUID{}, codersdk.Me, xerrors.Errorf("get task workspace %q: %w", taskID, err)
+	}
+	return ws.ID, ws.OwnerName, nil
+}
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index 1bc17fabb31e2..c87a5e0358904 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -5,6 +5,8 @@ import (
 	"database/sql"
 	"encoding/json"
 	"fmt"
+	"net/http"
+	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -21,12 +23,14 @@ import (
 
 	"github.com/coder/aisdk-go"
 
+	agentapi "github.com/coder/agentapi-sdk-go"
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agenttest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbfake"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/coder/v2/codersdk/toolsdk"
@@ -896,7 +900,7 @@ func TestTools(t *testing.T) {
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask().Do()
+		}).WithTask(nil).Do()
 
 		// nolint:gocritic // This is in a test package and does not end up in the build
 		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
@@ -904,7 +908,7 @@ func TestTools(t *testing.T) {
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask().Do()
+		}).WithTask(nil).Do()
 
 		tests := []struct {
 			name  string
@@ -991,7 +995,7 @@ func TestTools(t *testing.T) {
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask().Do()
+		}).WithTask(nil).Do()
 
 		// These tasks should show up.
 		for i := range 5 {
@@ -1007,7 +1011,7 @@ func TestTools(t *testing.T) {
 				OrganizationID: owner.OrganizationID,
 				OwnerID:        taskUser.ID,
 				TemplateID:     aiTV.Template.ID,
-			}).Seed(database.WorkspaceBuild{Transition: transition}).WithTask().Do()
+			}).Seed(database.WorkspaceBuild{Transition: transition}).WithTask(nil).Do()
 		}
 
 		tests := []struct {
@@ -1079,7 +1083,7 @@ func TestTools(t *testing.T) {
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask().Do()
+		}).WithTask(nil).Do()
 
 		tests := []struct {
 			name     string
@@ -1287,6 +1291,263 @@ func TestTools(t *testing.T) {
 			})
 		}
 	})
+
+	t.Run("SendTaskInput", func(t *testing.T) {
+		t.Parallel()
+
+		// Start a fake AgentAPI that accepts GET /status and POST /message.
+		srv := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			if r.Method == http.MethodGet && r.URL.Path == "/status" {
+				httpapi.Write(r.Context(), rw, http.StatusOK, agentapi.GetStatusResponse{
+					Status: agentapi.StatusStable,
+				})
+				return
+			}
+			if r.Method == http.MethodPost && r.URL.Path == "/message" {
+				rw.Header().Set("Content-Type", "application/json")
+
+				var req agentapi.PostMessageParams
+				ok := httpapi.Read(r.Context(), rw, r, &req)
+				assert.True(t, ok, "failed to read request")
+
+				assert.Equal(t, req.Content, "frob the baz")
+				assert.Equal(t, req.Type, agentapi.MessageTypeUser)
+
+				httpapi.Write(r.Context(), rw, http.StatusOK, agentapi.PostMessageResponse{
+					Ok: true,
+				})
+				return
+			}
+			rw.WriteHeader(http.StatusInternalServerError)
+		}))
+		t.Cleanup(srv.Close)
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      member.ID,
+			HasAITask: sql.NullBool{
+				Bool:  true,
+				Valid: true,
+			},
+		}).Do()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		ws := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "send-task-input",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+			TemplateID:     aiTV.Template.ID,
+		}).WithTask(&proto.App{Url: srv.URL}).Do()
+
+		_ = agenttest.New(t, client.URL, ws.AgentToken)
+		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.Workspace.ID).Wait()
+
+		tests := []struct {
+			name  string
+			args  toolsdk.SendTaskInputArgs
+			error string
+		}{
+			{
+				name: "ByUUID",
+				args: toolsdk.SendTaskInputArgs{
+					TaskID: ws.Workspace.ID.String(),
+					Input:  "frob the baz",
+				},
+			},
+			{
+				name: "ByWorkspaceIdentifier",
+				args: toolsdk.SendTaskInputArgs{
+					TaskID: "send-task-input",
+					Input:  "frob the baz",
+				},
+			},
+			{
+				name:  "NoID",
+				args:  toolsdk.SendTaskInputArgs{},
+				error: "task_id is required",
+			},
+			{
+				name: "NoInput",
+				args: toolsdk.SendTaskInputArgs{
+					TaskID: "send-task-input",
+				},
+				error: "input is required",
+			},
+			{
+				name: "NoTaskByID",
+				args: toolsdk.SendTaskInputArgs{
+					TaskID: uuid.New().String(),
+					Input:  "this is ignored",
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "NoTaskByWorkspaceIdentifier",
+				args: toolsdk.SendTaskInputArgs{
+					TaskID: "non-existent",
+					Input:  "this is ignored",
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "ExistsButNotATask",
+				args: toolsdk.SendTaskInputArgs{
+					TaskID: r.Workspace.ID.String(),
+					Input:  "this is ignored",
+				},
+				error: "Task is not configured with a sidebar app",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(memberClient)
+				require.NoError(t, err)
+
+				_, err = testTool(t, toolsdk.SendTaskInput, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+				}
+			})
+		}
+	})
+
+	t.Run("GetTaskLogs", func(t *testing.T) {
+		t.Parallel()
+
+		messages := []agentapi.Message{
+			{
+				Id:      0,
+				Content: "welcome",
+				Role:    agentapi.RoleAgent,
+			},
+			{
+				Id:      1,
+				Content: "frob the dazzle",
+				Role:    agentapi.RoleUser,
+			},
+			{
+				Id:      2,
+				Content: "frob dazzled",
+				Role:    agentapi.RoleAgent,
+			},
+		}
+
+		// Start a fake AgentAPI that returns some messages.
+		srv := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			if r.Method == http.MethodGet && r.URL.Path == "/messages" {
+				httpapi.Write(r.Context(), rw, http.StatusOK, agentapi.GetMessagesResponse{
+					Messages: messages,
+				})
+				return
+			}
+			rw.WriteHeader(http.StatusInternalServerError)
+		}))
+		t.Cleanup(srv.Close)
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
+			OrganizationID: owner.OrganizationID,
+			CreatedBy:      member.ID,
+			HasAITask: sql.NullBool{
+				Bool:  true,
+				Valid: true,
+			},
+		}).Do()
+
+		// nolint:gocritic // This is in a test package and does not end up in the build
+		ws := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "get-task-logs",
+			OrganizationID: owner.OrganizationID,
+			OwnerID:        member.ID,
+			TemplateID:     aiTV.Template.ID,
+		}).WithTask(&proto.App{Url: srv.URL}).Do()
+
+		_ = agenttest.New(t, client.URL, ws.AgentToken)
+		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.Workspace.ID).Wait()
+
+		tests := []struct {
+			name     string
+			args     toolsdk.GetTaskLogsArgs
+			expected []agentapi.Message
+			error    string
+		}{
+			{
+				name: "ByUUID",
+				args: toolsdk.GetTaskLogsArgs{
+					TaskID: ws.Workspace.ID.String(),
+				},
+				expected: messages,
+			},
+			{
+				name: "ByWorkspaceIdentifier",
+				args: toolsdk.GetTaskLogsArgs{
+					TaskID: "get-task-logs",
+				},
+				expected: messages,
+			},
+			{
+				name:  "NoID",
+				args:  toolsdk.GetTaskLogsArgs{},
+				error: "task_id is required",
+			},
+			{
+				name: "NoTaskByID",
+				args: toolsdk.GetTaskLogsArgs{
+					TaskID: uuid.New().String(),
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "NoTaskByWorkspaceIdentifier",
+				args: toolsdk.GetTaskLogsArgs{
+					TaskID: "non-existent",
+				},
+				error: "Resource not found",
+			},
+			{
+				name: "ExistsButNotATask",
+				args: toolsdk.GetTaskLogsArgs{
+					TaskID: r.Workspace.ID.String(),
+				},
+				error: "Task is not configured with a sidebar app",
+			},
+		}
+
+		for _, tt := range tests {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				tb, err := toolsdk.NewDeps(memberClient)
+				require.NoError(t, err)
+
+				res, err := testTool(t, toolsdk.GetTaskLogs, tb, tt.args)
+				if tt.error != "" {
+					require.Error(t, err)
+					require.ErrorContains(t, err, tt.error)
+				} else {
+					require.NoError(t, err)
+					require.Len(t, res.Logs, len(tt.expected))
+					for i, msg := range tt.expected {
+						require.Equal(t, msg.Id, int64(res.Logs[i].ID))
+						require.Equal(t, msg.Content, res.Logs[i].Content)
+						if msg.Role == agentapi.RoleUser {
+							require.Equal(t, codersdk.TaskLogTypeInput, res.Logs[i].Type)
+						} else {
+							require.Equal(t, codersdk.TaskLogTypeOutput, res.Logs[i].Type)
+						}
+						require.Equal(t, msg.Time, res.Logs[i].Time)
+					}
+				}
+			})
+		}
+	})
 }
 
 // TestedTools keeps track of which tools have been tested.

From 5887867e9bce0e690760148fc9d1121275b2a328 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Thu, 16 Oct 2025 18:39:06 +1100
Subject: [PATCH 142/298] chore: rework wsproxy mesh tests to avoid flakes
 (#20296)

- Attempts pings twice per replicasync callback in wsproxy
- Reworks the test setup code to be more lenient and retry proxy
registration on failure

Closes coder/internal#957
---
 enterprise/wsproxy/wsproxy.go               |  28 ++-
 enterprise/wsproxy/wsproxy_test.go          | 204 +++++++++++++-------
 enterprise/wsproxy/wsproxysdk/wsproxysdk.go |   6 +-
 3 files changed, 159 insertions(+), 79 deletions(-)

diff --git a/enterprise/wsproxy/wsproxy.go b/enterprise/wsproxy/wsproxy.go
index 94b1802959987..734f6b2b594c8 100644
--- a/enterprise/wsproxy/wsproxy.go
+++ b/enterprise/wsproxy/wsproxy.go
@@ -436,8 +436,8 @@ func New(ctx context.Context, opts *Options) (*Server, error) {
 	return s, nil
 }
 
-func (s *Server) RegisterNow() error {
-	_, err := s.registerLoop.RegisterNow()
+func (s *Server) RegisterNow(ctx context.Context) error {
+	_, err := s.registerLoop.RegisterNow(ctx)
 	return err
 }
 
@@ -521,7 +521,7 @@ func pingSiblingReplicas(ctx context.Context, logger slog.Logger, sf *singleflig
 		errs := make(chan error, len(replicas))
 		for _, peer := range replicas {
 			go func(peer codersdk.Replica) {
-				err := replicasync.PingPeerReplica(ctx, client, peer.RelayAddress)
+				err := pingReplica(ctx, client, peer)
 				if err != nil {
 					errs <- xerrors.Errorf("ping sibling replica %s (%s): %w", peer.Hostname, peer.RelayAddress, err)
 					logger.Warn(ctx, "failed to ping sibling replica, this could happen if the replica has shutdown",
@@ -553,6 +553,28 @@ func pingSiblingReplicas(ctx context.Context, logger slog.Logger, sf *singleflig
 	return errStrInterface.(string)
 }
 
+// pingReplica pings a replica over it's internal relay address to ensure it's
+// reachable and alive for health purposes. It will try to ping the replica
+// twice if the first ping fails, with a short delay between attempts.
+func pingReplica(ctx context.Context, client http.Client, replica codersdk.Replica) error {
+	const attempts = 2
+	var err error
+	for i := 0; i < attempts; i++ {
+		err = replicasync.PingPeerReplica(ctx, client, replica.RelayAddress)
+		if err == nil {
+			return nil
+		}
+		if i < attempts-1 {
+			select {
+			case <-ctx.Done():
+				return ctx.Err()
+			case <-time.After(1 * time.Second):
+			}
+		}
+	}
+	return err
+}
+
 func (s *Server) handleRegisterFailure(err error) {
 	if s.ctx.Err() != nil {
 		return
diff --git a/enterprise/wsproxy/wsproxy_test.go b/enterprise/wsproxy/wsproxy_test.go
index 03245999350cd..c876db113ea60 100644
--- a/enterprise/wsproxy/wsproxy_test.go
+++ b/enterprise/wsproxy/wsproxy_test.go
@@ -9,6 +9,7 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/url"
+	"sync"
 	"testing"
 	"time"
 
@@ -35,6 +36,7 @@ import (
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
 	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/coderd"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
 	"github.com/coder/coder/v2/enterprise/coderd/license"
 	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
@@ -464,6 +466,7 @@ func TestDERPMesh(t *testing.T) {
 		"*",
 	}
 
+	ctx := testutil.Context(t, testutil.WaitLong)
 	client, closer, api, _ := coderdenttest.NewWithAPI(t, &coderdenttest.Options{
 		Options: &coderdtest.Options{
 			DeploymentValues:         deploymentValues,
@@ -494,35 +497,21 @@ func TestDERPMesh(t *testing.T) {
 	require.NoError(t, err)
 
 	// Create 3 proxy replicas.
-	const count = 3
-	var (
-		sessionToken = ""
-		proxies      = [count]coderdenttest.WorkspaceProxy{}
-		derpURLs     = [count]string{}
-	)
-	for i := range proxies {
-		proxies[i] = coderdenttest.NewWorkspaceProxyReplica(t, api, client, &coderdenttest.ProxyOptions{
-			Name:     "best-proxy",
-			Token:    sessionToken,
-			ProxyURL: proxyURL,
-		})
-		if i == 0 {
-			sessionToken = proxies[i].Options.ProxySessionToken
-		}
-
-		derpURL := *proxies[i].ServerURL
+	proxies := createProxyReplicas(ctx, t, &createProxyReplicasOptions{
+		API:        api,
+		Client:     client,
+		Name:       "best-proxy",
+		ProxyURL:   proxyURL,
+		ProxyToken: "", // will be generated automatically
+		Count:      3,
+	})
+	derpURLs := make([]string, len(proxies))
+	for i, proxy := range proxies {
+		derpURL := *proxy.ServerURL
 		derpURL.Path = "/derp"
 		derpURLs[i] = derpURL.String()
 	}
 
-	// Force all proxies to re-register immediately. This ensures the DERP mesh
-	// is up-to-date. In production this will happen automatically after about
-	// 15 seconds.
-	for i, proxy := range proxies {
-		err := proxy.RegisterNow()
-		require.NoErrorf(t, err, "failed to force proxy %d to re-register", i)
-	}
-
 	// Generate cases. We have a case for:
 	// - Each proxy to itself.
 	// - Each proxy to each other proxy (one way, no duplicates).
@@ -533,7 +522,7 @@ func TestDERPMesh(t *testing.T) {
 			cases = append(cases, [2]string{derpURL, derpURLs[j]})
 		}
 	}
-	require.Len(t, cases, (count*(count+1))/2) // triangle number
+	require.Len(t, cases, (len(proxies)*(len(proxies)+1))/2) // triangle number
 
 	for i, c := range cases {
 		i, c := i, c
@@ -598,7 +587,6 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 	}
 
 	t.Run("ProbeOK", func(t *testing.T) {
-		t.Skip("flaky test: https://github.com/coder/internal/issues/957")
 		t.Parallel()
 
 		deploymentValues := coderdtest.DeploymentValues(t)
@@ -642,51 +630,14 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		require.NoError(t, err)
 
 		// Create 6 proxy replicas.
-		const count = 6
-		var (
-			sessionToken    = ""
-			proxies         = [count]coderdenttest.WorkspaceProxy{}
-			replicaPingDone = [count]bool{}
-		)
-		for i := range proxies {
-			proxies[i] = coderdenttest.NewWorkspaceProxyReplica(t, api, client, &coderdenttest.ProxyOptions{
-				Name:     "proxy-1",
-				Token:    sessionToken,
-				ProxyURL: proxyURL,
-				ReplicaPingCallback: func(replicas []codersdk.Replica, err string) {
-					if len(replicas) != count-1 {
-						// Still warming up...
-						return
-					}
-					replicaPingDone[i] = true
-					assert.Emptyf(t, err, "replica %d ping callback error", i)
-				},
-			})
-			if i == 0 {
-				sessionToken = proxies[i].Options.ProxySessionToken
-			}
-		}
-
-		// Force all proxies to re-register immediately. This ensures the DERP
-		// mesh is up-to-date. In production this will happen automatically
-		// after about 15 seconds.
-		for i, proxy := range proxies {
-			err := proxy.RegisterNow()
-			require.NoErrorf(t, err, "failed to force proxy %d to re-register", i)
-		}
-
-		// Ensure that all proxies have pinged.
-		require.Eventually(t, func() bool {
-			ok := true
-			for i := range proxies {
-				if !replicaPingDone[i] {
-					t.Logf("replica %d has not pinged yet", i)
-					ok = false
-				}
-			}
-			return ok
-		}, testutil.WaitLong, testutil.IntervalSlow)
-		t.Log("all replicas have pinged")
+		proxies := createProxyReplicas(ctx, t, &createProxyReplicasOptions{
+			API:        api,
+			Client:     client,
+			Name:       "proxy-1",
+			ProxyURL:   proxyURL,
+			ProxyToken: "", // will be generated automatically
+			Count:      6,
+		})
 
 		// Check they're all healthy according to /healthz-report.
 		httpClient := &http.Client{}
@@ -771,7 +722,7 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		}
 
 		// Force the proxy to re-register immediately.
-		err = proxy.RegisterNow()
+		err = proxy.RegisterNow(ctx)
 		require.NoError(t, err, "failed to force proxy to re-register")
 
 		// Wait for the ping to fail.
@@ -855,7 +806,7 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 
 		// Force the proxy to re-register and wait for the ping to fail.
 		for {
-			err = proxy.RegisterNow()
+			err = proxy.RegisterNow(ctx)
 			require.NoError(t, err, "failed to force proxy to re-register")
 
 			pingRes := testutil.TryReceive(ctx, t, replicaPingRes)
@@ -891,7 +842,7 @@ func TestWorkspaceProxyDERPMeshProbe(t *testing.T) {
 		// Force the proxy to re-register and wait for the ping to be skipped
 		// because there are no more siblings.
 		for {
-			err = proxy.RegisterNow()
+			err = proxy.RegisterNow(ctx)
 			require.NoError(t, err, "failed to force proxy to re-register")
 
 			replicaErr := testutil.TryReceive(ctx, t, replicaPingRes)
@@ -1170,3 +1121,106 @@ func testDERPSend(t *testing.T, ctx context.Context, dstKey key.NodePublic, dstC
 		require.NoError(t, err, "send message via DERP")
 	}
 }
+
+type createProxyReplicasOptions struct {
+	API    *coderd.API
+	Client *codersdk.Client
+
+	Name     string
+	ProxyURL *url.URL
+	// If ProxyToken is not provided, a new workspace proxy region will be
+	// created automatically using the API client.
+	ProxyToken string
+	Count      int
+}
+
+// createProxyReplicas creates and runs a set of proxy replicas and ensures that
+// they are all functioning correctly and aware of each other with no errors.
+func createProxyReplicas(ctx context.Context, t *testing.T, opts *createProxyReplicasOptions) []coderdenttest.WorkspaceProxy {
+	t.Helper()
+
+	var (
+		proxies = make([]coderdenttest.WorkspaceProxy, opts.Count)
+		// replicaPingSuccessful tracks whether the replica ping callback
+		// was called with no errors for each replica.
+		replicaPingMutex      sync.Mutex
+		replicaPingSuccessful = make([]bool, opts.Count)
+	)
+	for i := range proxies {
+		proxies[i] = coderdenttest.NewWorkspaceProxyReplica(t, opts.API, opts.Client, &coderdenttest.ProxyOptions{
+			Name:     opts.Name,
+			Token:    opts.ProxyToken,
+			ProxyURL: opts.ProxyURL,
+			ReplicaPingCallback: func(siblings []codersdk.Replica, err string) {
+				t.Logf("got wsproxy ping callback: i=%d, siblings=%v, err=%s", i, len(siblings), err)
+
+				replicaPingMutex.Lock()
+				defer replicaPingMutex.Unlock()
+				// The replica only "successfully" pinged if it has the
+				// correct number of siblings and no error.
+				replicaPingSuccessful[i] = len(siblings) == opts.Count-1 && err == ""
+			},
+		})
+		if i == 0 {
+			// The first proxy will have a new token if we just created a new
+			// proxy region.
+			opts.ProxyToken = proxies[i].Options.ProxySessionToken
+		}
+	}
+
+	// Force all proxies to re-register immediately. This ensures the DERP
+	// mesh is up-to-date. In production this will happen automatically
+	// after about 15 seconds.
+	for i, proxy := range proxies {
+		err := proxy.RegisterNow(ctx)
+		require.NoErrorf(t, err, "failed to force proxy %d to re-register", i)
+	}
+
+	// Ensure that all proxies have pinged successfully. If replicas haven't
+	// successfully pinged yet, force them to re-register again. We don't
+	// use require.Eventually here because it runs the condition function in
+	// a goroutine.
+	ticker := time.NewTicker(testutil.IntervalSlow)
+	defer ticker.Stop()
+	for {
+		var (
+			ok = true
+			wg sync.WaitGroup
+		)
+
+		// Copy the replicaPingSuccessful slice to a local variable so we can
+		// view the state of all proxies at the same point in time.
+		replicaPingSuccessfulCopy := make([]bool, len(replicaPingSuccessful))
+		replicaPingMutex.Lock()
+		copy(replicaPingSuccessfulCopy, replicaPingSuccessful)
+		replicaPingMutex.Unlock()
+
+		for i, proxy := range proxies {
+			success := replicaPingSuccessfulCopy[i]
+			if !success {
+				t.Logf("replica %d has not successfully pinged yet", i)
+				ok = false
+
+				// Retry registration on this proxy.
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					err := proxy.RegisterNow(ctx)
+					t.Logf("replica %d re-registered: err=%v", i, err)
+				}()
+			}
+		}
+		wg.Wait()
+		if ok {
+			break
+		}
+		select {
+		case <-ctx.Done():
+			t.Fatal("proxies did not ping successfully in time:", ctx.Err())
+		case <-ticker.C:
+		}
+	}
+	t.Log("all replicas have pinged successfully")
+
+	return proxies
+}
diff --git a/enterprise/wsproxy/wsproxysdk/wsproxysdk.go b/enterprise/wsproxy/wsproxysdk/wsproxysdk.go
index d768a919f4624..443baa815942b 100644
--- a/enterprise/wsproxy/wsproxysdk/wsproxysdk.go
+++ b/enterprise/wsproxy/wsproxysdk/wsproxysdk.go
@@ -404,15 +404,19 @@ func (l *RegisterWorkspaceProxyLoop) Start(ctx context.Context) (RegisterWorkspa
 
 // RegisterNow asks the registration loop to register immediately. A timeout of
 // 2x the attempt timeout is used to wait for the response.
-func (l *RegisterWorkspaceProxyLoop) RegisterNow() (RegisterWorkspaceProxyResponse, error) {
+func (l *RegisterWorkspaceProxyLoop) RegisterNow(ctx context.Context) (RegisterWorkspaceProxyResponse, error) {
 	// The channel is closed by the loop after sending the response.
 	respCh := make(chan RegisterWorkspaceProxyResponse, 1)
 	select {
+	case <-ctx.Done():
+		return RegisterWorkspaceProxyResponse{}, ctx.Err()
 	case <-l.done:
 		return RegisterWorkspaceProxyResponse{}, xerrors.New("proxy registration loop closed")
 	case l.runLoopNow <- respCh:
 	}
 	select {
+	case <-ctx.Done():
+		return RegisterWorkspaceProxyResponse{}, ctx.Err()
 	case <-l.done:
 		return RegisterWorkspaceProxyResponse{}, xerrors.New("proxy registration loop closed")
 	case resp := <-respCh:

From 275602ce618183b86a1f5deefb084a88696157b8 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Thu, 16 Oct 2025 09:42:25 +0100
Subject: [PATCH 143/298] ci: include coder-provisioner-tagged-prebuilds in
 deploy.yaml (#20320)

Add reconciliation and rollout for coder-provisioner-tagged-prebuilds
deployment

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
---
 .github/workflows/deploy.yaml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 895fd32ec9851..38936826261f5 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -121,6 +121,8 @@ jobs:
           flux --namespace flux-system reconcile source chart coder-coder-provisioner
           flux --namespace coder reconcile helmrelease coder
           flux --namespace coder reconcile helmrelease coder-provisioner
+          flux --namespace coder reconcile helmrelease coder-provisioner-tagged
+          flux --namespace coder reconcile helmrelease coder-provisioner-tagged-prebuilds
 
       # Just updating Flux is usually not enough. The Helm release may get
       # redeployed, but unless something causes the Deployment to update the
@@ -136,6 +138,8 @@ jobs:
           kubectl --namespace coder rollout status deployment/coder-provisioner
           kubectl --namespace coder rollout restart deployment/coder-provisioner-tagged
           kubectl --namespace coder rollout status deployment/coder-provisioner-tagged
+          kubectl --namespace coder rollout restart deployment/coder-provisioner-tagged-prebuilds
+          kubectl --namespace coder rollout status deployment/coder-provisioner-tagged-prebuilds
 
   deploy-wsproxies:
     runs-on: ubuntu-latest

From 3fa438f80e19e673395f2efa07251121b8802c0b Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Thu, 16 Oct 2025 10:08:34 +0100
Subject: [PATCH 144/298] chore(dogfood): add prebuild coder_workspace_tags
 (#20308)

## Description

Add a `coder_workspace_tags` data block to the Write Coder on Coder
template that conditionally includes the tag `is_prebuild=true` when the
provisioner job is a prebuild (workspace_build) job.

Related internal [PR](https://github.com/coder/dogfood/pull/201) updated
the dogfood deployment with a dedicated pool of provisioner daemons
configured with this tag.
As a result, prebuild-related jobs are now routed exclusively to this
pool, preventing them from competing with user-initiated workspace jobs.

This has been successfully tested internally in dogfood with template
`ssncf-prebuilds-coder`
---
 dogfood/coder/main.tf | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index a16bbc74b02aa..ae4569a5d6e39 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -269,6 +269,13 @@ data "coder_workspace_tags" "tags" {
   }
 }
 
+data "coder_workspace_tags" "prebuild" {
+  count = data.coder_workspace_owner.me.name == "prebuilds" ? 1 : 0
+  tags = {
+    "is_prebuild" = "true"
+  }
+}
+
 data "coder_parameter" "ide_choices" {
   type        = "list(string)"
   name        = "Select IDEs"

From 0faee8e913110e4460fe462b6b6230dc290533ac Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Thu, 16 Oct 2025 10:21:08 +0100
Subject: [PATCH 145/298] feat(coderd): notify on task completion/failure
 (#20327)

Adds notifications on task transitions to completed or failure state.

Authored by Claude, I reviewed it and it appears to be legit.
---
 coderd/aitasks_test.go                        | 58 +++++++++++++
 ...ted_failed_notification_templates.down.sql |  5 ++
 ...leted_failed_notification_templates.up.sql | 63 ++++++++++++++
 coderd/notifications/events.go                |  6 +-
 coderd/notifications/notifications_test.go    | 28 ++++++
 .../smtp/TemplateTaskCompleted.html.golden    | 84 ++++++++++++++++++
 .../smtp/TemplateTaskFailed.html.golden       | 85 +++++++++++++++++++
 .../webhook/TemplateTaskCompleted.json.golden | 33 +++++++
 .../webhook/TemplateTaskFailed.json.golden    | 33 +++++++
 coderd/workspaceagents.go                     |  4 +
 10 files changed, 397 insertions(+), 2 deletions(-)
 create mode 100644 coderd/database/migrations/000383_add_task_completed_failed_notification_templates.down.sql
 create mode 100644 coderd/database/migrations/000383_add_task_completed_failed_notification_templates.up.sql
 create mode 100644 coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
 create mode 100644 coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
 create mode 100644 coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskCompleted.json.golden
 create mode 100644 coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskFailed.json.golden

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 4172cccda6851..646e8ab33fd51 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -1061,6 +1061,64 @@ func TestTasksNotification(t *testing.T) {
 			notificationTemplate: notifications.TemplateTaskIdle,
 			taskPrompt:           "This is a very long task prompt that should be truncated to 160 characters. Lorem ipsum dolor sit amet, consectetur adipiscing elit. Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.",
 		},
+		// Should send TemplateTaskCompleted when the AI task transitions to 'Complete'.
+		{
+			name:                 "TemplateTaskCompleted",
+			latestAppStatuses:    []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateWorking},
+			newAppStatus:         codersdk.WorkspaceAppStatusStateComplete,
+			isAITask:             true,
+			isNotificationSent:   true,
+			notificationTemplate: notifications.TemplateTaskCompleted,
+			taskPrompt:           "TemplateTaskCompleted",
+		},
+		// Should send TemplateTaskFailed when the AI task transitions to 'Failure'.
+		{
+			name:                 "TemplateTaskFailed",
+			latestAppStatuses:    []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateWorking},
+			newAppStatus:         codersdk.WorkspaceAppStatusStateFailure,
+			isAITask:             true,
+			isNotificationSent:   true,
+			notificationTemplate: notifications.TemplateTaskFailed,
+			taskPrompt:           "TemplateTaskFailed",
+		},
+		// Should send TemplateTaskCompleted when the AI task transitions from 'Idle' to 'Complete'.
+		{
+			name:                 "TemplateTaskCompletedFromIdle",
+			latestAppStatuses:    []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateIdle},
+			newAppStatus:         codersdk.WorkspaceAppStatusStateComplete,
+			isAITask:             true,
+			isNotificationSent:   true,
+			notificationTemplate: notifications.TemplateTaskCompleted,
+			taskPrompt:           "TemplateTaskCompletedFromIdle",
+		},
+		// Should send TemplateTaskFailed when the AI task transitions from 'Idle' to 'Failure'.
+		{
+			name:                 "TemplateTaskFailedFromIdle",
+			latestAppStatuses:    []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateIdle},
+			newAppStatus:         codersdk.WorkspaceAppStatusStateFailure,
+			isAITask:             true,
+			isNotificationSent:   true,
+			notificationTemplate: notifications.TemplateTaskFailed,
+			taskPrompt:           "TemplateTaskFailedFromIdle",
+		},
+		// Should NOT send notification when transitioning from 'Complete' to 'Complete' (no change).
+		{
+			name:               "NoNotificationCompleteToComplete",
+			latestAppStatuses:  []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateComplete},
+			newAppStatus:       codersdk.WorkspaceAppStatusStateComplete,
+			isAITask:           true,
+			isNotificationSent: false,
+			taskPrompt:         "NoNotificationCompleteToComplete",
+		},
+		// Should NOT send notification when transitioning from 'Failure' to 'Failure' (no change).
+		{
+			name:               "NoNotificationFailureToFailure",
+			latestAppStatuses:  []codersdk.WorkspaceAppStatusState{codersdk.WorkspaceAppStatusStateFailure},
+			newAppStatus:       codersdk.WorkspaceAppStatusStateFailure,
+			isAITask:           true,
+			isNotificationSent: false,
+			taskPrompt:         "NoNotificationFailureToFailure",
+		},
 	} {
 		t.Run(tc.name, func(t *testing.T) {
 			t.Parallel()
diff --git a/coderd/database/migrations/000383_add_task_completed_failed_notification_templates.down.sql b/coderd/database/migrations/000383_add_task_completed_failed_notification_templates.down.sql
new file mode 100644
index 0000000000000..9a87362653f31
--- /dev/null
+++ b/coderd/database/migrations/000383_add_task_completed_failed_notification_templates.down.sql
@@ -0,0 +1,5 @@
+-- Remove Task 'completed' transition template notification
+DELETE FROM notification_templates WHERE id = '8c5a4d12-9f7e-4b3a-a1c8-6e4f2d9b5a7c';
+
+-- Remove Task 'failed' transition template notification
+DELETE FROM notification_templates WHERE id = '3b7e8f1a-4c2d-49a6-b5e9-7f3a1c8d6b4e';
diff --git a/coderd/database/migrations/000383_add_task_completed_failed_notification_templates.up.sql b/coderd/database/migrations/000383_add_task_completed_failed_notification_templates.up.sql
new file mode 100644
index 0000000000000..a9d6b01103088
--- /dev/null
+++ b/coderd/database/migrations/000383_add_task_completed_failed_notification_templates.up.sql
@@ -0,0 +1,63 @@
+-- Task transition to 'complete' status
+INSERT INTO notification_templates (
+	id,
+	name,
+	title_template,
+	body_template,
+	actions,
+	"group",
+	method,
+	kind,
+	enabled_by_default
+) VALUES (
+			 '8c5a4d12-9f7e-4b3a-a1c8-6e4f2d9b5a7c',
+			 'Task Completed',
+			 E'Task ''{{.Labels.workspace}}'' completed',
+			 E'The task ''{{.Labels.task}}'' has completed successfully.',
+			 '[
+				 {
+					 "label": "View task",
+					 "url": "{{base_url}}/tasks/{{.UserUsername}}/{{.Labels.workspace}}"
+				 },
+				 {
+					 "label": "View workspace",
+					 "url": "{{base_url}}/@{{.UserUsername}}/{{.Labels.workspace}}"
+				 }
+			 ]'::jsonb,
+			 'Task Events',
+			 NULL,
+			 'system'::notification_template_kind,
+			 true
+		 );
+
+-- Task transition to 'failed' status
+INSERT INTO notification_templates (
+	id,
+	name,
+	title_template,
+	body_template,
+	actions,
+	"group",
+	method,
+	kind,
+	enabled_by_default
+) VALUES (
+			 '3b7e8f1a-4c2d-49a6-b5e9-7f3a1c8d6b4e',
+			 'Task Failed',
+			 E'Task ''{{.Labels.workspace}}'' failed',
+			 E'The task ''{{.Labels.task}}'' has failed. Check the logs for more details.',
+			 '[
+				 {
+					 "label": "View task",
+					 "url": "{{base_url}}/tasks/{{.UserUsername}}/{{.Labels.workspace}}"
+				 },
+				 {
+					 "label": "View workspace",
+					 "url": "{{base_url}}/@{{.UserUsername}}/{{.Labels.workspace}}"
+				 }
+			 ]'::jsonb,
+			 'Task Events',
+			 NULL,
+			 'system'::notification_template_kind,
+			 true
+		 );
diff --git a/coderd/notifications/events.go b/coderd/notifications/events.go
index 12adcfbb08b37..83e8e990a338a 100644
--- a/coderd/notifications/events.go
+++ b/coderd/notifications/events.go
@@ -55,6 +55,8 @@ var (
 
 // Task-related events.
 var (
-	TemplateTaskWorking = uuid.MustParse("bd4b7168-d05e-4e19-ad0f-3593b77aa90f")
-	TemplateTaskIdle    = uuid.MustParse("d4a6271c-cced-4ed0-84ad-afd02a9c7799")
+	TemplateTaskWorking   = uuid.MustParse("bd4b7168-d05e-4e19-ad0f-3593b77aa90f")
+	TemplateTaskIdle      = uuid.MustParse("d4a6271c-cced-4ed0-84ad-afd02a9c7799")
+	TemplateTaskCompleted = uuid.MustParse("8c5a4d12-9f7e-4b3a-a1c8-6e4f2d9b5a7c")
+	TemplateTaskFailed    = uuid.MustParse("3b7e8f1a-4c2d-49a6-b5e9-7f3a1c8d6b4e")
 )
diff --git a/coderd/notifications/notifications_test.go b/coderd/notifications/notifications_test.go
index 9689e6467db97..d3d9ff2b85736 100644
--- a/coderd/notifications/notifications_test.go
+++ b/coderd/notifications/notifications_test.go
@@ -1301,6 +1301,34 @@ func TestNotificationTemplates_Golden(t *testing.T) {
 				Data: map[string]any{},
 			},
 		},
+		{
+			name: "TemplateTaskCompleted",
+			id:   notifications.TemplateTaskCompleted,
+			payload: types.MessagePayload{
+				UserName:     "Bobby",
+				UserEmail:    "bobby@coder.com",
+				UserUsername: "bobby",
+				Labels: map[string]string{
+					"task":      "my-task",
+					"workspace": "my-workspace",
+				},
+				Data: map[string]any{},
+			},
+		},
+		{
+			name: "TemplateTaskFailed",
+			id:   notifications.TemplateTaskFailed,
+			payload: types.MessagePayload{
+				UserName:     "Bobby",
+				UserEmail:    "bobby@coder.com",
+				UserUsername: "bobby",
+				Labels: map[string]string{
+					"task":      "my-task",
+					"workspace": "my-workspace",
+				},
+				Data: map[string]any{},
+			},
+		},
 	}
 
 	// We must have a test case for every notification_template. This is enforced below:
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
new file mode 100644
index 0000000000000..769d5595dbc3e
--- /dev/null
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskCompleted.html.golden
@@ -0,0 +1,84 @@
+From: system@coder.com
+To: bobby@coder.com
+Subject: Task 'my-workspace' completed
+Message-Id: 02ee4935-73be-4fa1-a290-ff9999026b13@blush-whale-48
+Date: Fri, 11 Oct 2024 09:03:06 +0000
+Content-Type: multipart/alternative;  boundary=bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4
+MIME-Version: 1.0
+
+--bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4
+Content-Transfer-Encoding: quoted-printable
+Content-Type: text/plain; charset=UTF-8
+
+Hi Bobby,
+
+The task 'my-task' has completed successfully.
+
+
+View task: http://test.com/tasks/bobby/my-workspace
+
+View workspace: http://test.com/@bobby/my-workspace
+
+--bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4
+Content-Transfer-Encoding: quoted-printable
+Content-Type: text/html; charset=UTF-8
+
+<!doctype html>
+<html lang=3D"en">
+  <head>
+    <meta charset=3D"UTF-8" />
+    <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=
+=3D1.0" />
+    <title>Task 'my-workspace' completed</title>
+  </head>
+  <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-=
+ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel=
+l', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif; color: #020617=
+; background: #f8fafc;">
+    <div style=3D"max-width: 600px; margin: 20px auto; padding: 60px; borde=
+r: 1px solid #e2e8f0; border-radius: 8px; background-color: #fff; text-alig=
+n: left; font-size: 14px; line-height: 1.5;">
+      <div style=3D"text-align: center;">
+        <img src=3D"https://coder.com/coder-logo-horizontal.png" alt=3D"Cod=
+er Logo" style=3D"height: 40px;" />
+      </div>
+      <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m=
+argin: 8px 0 32px; line-height: 1.5;">
+        Task 'my-workspace' completed
+      </h1>
+      <div style=3D"line-height: 1.5;">
+        <p>Hi Bobby,</p>
+        <p>The task &lsquo;my-task&rsquo; has completed successfully.</p>
+      </div>
+      <div style=3D"text-align: center; margin-top: 32px;">
+       =20
+        <a href=3D"http://test.com/tasks/bobby/my-workspace" style=3D"displ=
+ay: inline-block; padding: 13px 24px; background-color: #020617; color: #f8=
+fafc; text-decoration: none; border-radius: 8px; margin: 0 4px;">
+          View task
+        </a>
+       =20
+        <a href=3D"http://test.com/@bobby/my-workspace" style=3D"display: i=
+nline-block; padding: 13px 24px; background-color: #020617; color: #f8fafc;=
+ text-decoration: none; border-radius: 8px; margin: 0 4px;">
+          View workspace
+        </a>
+       =20
+      </div>
+      <div style=3D"border-top: 1px solid #e2e8f0; color: #475569; font-siz=
+e: 12px; margin-top: 64px; padding-top: 24px; line-height: 1.6;">
+        <p>&copy;&nbsp;2024&nbsp;Coder. All rights reserved&nbsp;-&nbsp;<a =
+href=3D"http://test.com" style=3D"color: #2563eb; text-decoration: none;">h=
+ttp://test.com</a></p>
+        <p><a href=3D"http://test.com/settings/notifications" style=3D"colo=
+r: #2563eb; text-decoration: none;">Click here to manage your notification =
+settings</a></p>
+        <p><a href=3D"http://test.com/settings/notifications?disabled=3D8c5=
+a4d12-9f7e-4b3a-a1c8-6e4f2d9b5a7c" style=3D"color: #2563eb; text-decoration=
+: none;">Stop receiving emails like this</a></p>
+      </div>
+    </div>
+  </body>
+</html>
+
+--bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4--
diff --git a/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
new file mode 100644
index 0000000000000..5d0879bc82da2
--- /dev/null
+++ b/coderd/notifications/testdata/rendered-templates/smtp/TemplateTaskFailed.html.golden
@@ -0,0 +1,85 @@
+From: system@coder.com
+To: bobby@coder.com
+Subject: Task 'my-workspace' failed
+Message-Id: 02ee4935-73be-4fa1-a290-ff9999026b13@blush-whale-48
+Date: Fri, 11 Oct 2024 09:03:06 +0000
+Content-Type: multipart/alternative;  boundary=bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4
+MIME-Version: 1.0
+
+--bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4
+Content-Transfer-Encoding: quoted-printable
+Content-Type: text/plain; charset=UTF-8
+
+Hi Bobby,
+
+The task 'my-task' has failed. Check the logs for more details.
+
+
+View task: http://test.com/tasks/bobby/my-workspace
+
+View workspace: http://test.com/@bobby/my-workspace
+
+--bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4
+Content-Transfer-Encoding: quoted-printable
+Content-Type: text/html; charset=UTF-8
+
+<!doctype html>
+<html lang=3D"en">
+  <head>
+    <meta charset=3D"UTF-8" />
+    <meta name=3D"viewport" content=3D"width=3Ddevice-width, initial-scale=
+=3D1.0" />
+    <title>Task 'my-workspace' failed</title>
+  </head>
+  <body style=3D"margin: 0; padding: 0; font-family: -apple-system, system-=
+ui, BlinkMacSystemFont, 'Segoe UI', 'Roboto', 'Oxygen', 'Ubuntu', 'Cantarel=
+l', 'Fira Sans', 'Droid Sans', 'Helvetica Neue', sans-serif; color: #020617=
+; background: #f8fafc;">
+    <div style=3D"max-width: 600px; margin: 20px auto; padding: 60px; borde=
+r: 1px solid #e2e8f0; border-radius: 8px; background-color: #fff; text-alig=
+n: left; font-size: 14px; line-height: 1.5;">
+      <div style=3D"text-align: center;">
+        <img src=3D"https://coder.com/coder-logo-horizontal.png" alt=3D"Cod=
+er Logo" style=3D"height: 40px;" />
+      </div>
+      <h1 style=3D"text-align: center; font-size: 24px; font-weight: 400; m=
+argin: 8px 0 32px; line-height: 1.5;">
+        Task 'my-workspace' failed
+      </h1>
+      <div style=3D"line-height: 1.5;">
+        <p>Hi Bobby,</p>
+        <p>The task &lsquo;my-task&rsquo; has failed. Check the logs for mo=
+re details.</p>
+      </div>
+      <div style=3D"text-align: center; margin-top: 32px;">
+       =20
+        <a href=3D"http://test.com/tasks/bobby/my-workspace" style=3D"displ=
+ay: inline-block; padding: 13px 24px; background-color: #020617; color: #f8=
+fafc; text-decoration: none; border-radius: 8px; margin: 0 4px;">
+          View task
+        </a>
+       =20
+        <a href=3D"http://test.com/@bobby/my-workspace" style=3D"display: i=
+nline-block; padding: 13px 24px; background-color: #020617; color: #f8fafc;=
+ text-decoration: none; border-radius: 8px; margin: 0 4px;">
+          View workspace
+        </a>
+       =20
+      </div>
+      <div style=3D"border-top: 1px solid #e2e8f0; color: #475569; font-siz=
+e: 12px; margin-top: 64px; padding-top: 24px; line-height: 1.6;">
+        <p>&copy;&nbsp;2024&nbsp;Coder. All rights reserved&nbsp;-&nbsp;<a =
+href=3D"http://test.com" style=3D"color: #2563eb; text-decoration: none;">h=
+ttp://test.com</a></p>
+        <p><a href=3D"http://test.com/settings/notifications" style=3D"colo=
+r: #2563eb; text-decoration: none;">Click here to manage your notification =
+settings</a></p>
+        <p><a href=3D"http://test.com/settings/notifications?disabled=3D3b7=
+e8f1a-4c2d-49a6-b5e9-7f3a1c8d6b4e" style=3D"color: #2563eb; text-decoration=
+: none;">Stop receiving emails like this</a></p>
+      </div>
+    </div>
+  </body>
+</html>
+
+--bbe61b741255b6098bb6b3c1f41b885773df633cb18d2a3002b68e4bc9c4--
diff --git a/coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskCompleted.json.golden b/coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskCompleted.json.golden
new file mode 100644
index 0000000000000..2336bf3162f59
--- /dev/null
+++ b/coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskCompleted.json.golden
@@ -0,0 +1,33 @@
+{
+  "_version": "1.1",
+  "msg_id": "00000000-0000-0000-0000-000000000000",
+  "payload": {
+    "_version": "1.2",
+    "notification_name": "Task Completed",
+    "notification_template_id": "00000000-0000-0000-0000-000000000000",
+    "user_id": "00000000-0000-0000-0000-000000000000",
+    "user_email": "bobby@coder.com",
+    "user_name": "Bobby",
+    "user_username": "bobby",
+    "actions": [
+      {
+        "label": "View task",
+        "url": "http://test.com/tasks/bobby/my-workspace"
+      },
+      {
+        "label": "View workspace",
+        "url": "http://test.com/@bobby/my-workspace"
+      }
+    ],
+    "labels": {
+      "task": "my-task",
+      "workspace": "my-workspace"
+    },
+    "data": {},
+    "targets": null
+  },
+  "title": "Task 'my-workspace' completed",
+  "title_markdown": "Task 'my-workspace' completed",
+  "body": "The task 'my-task' has completed successfully.",
+  "body_markdown": "The task 'my-task' has completed successfully."
+}
\ No newline at end of file
diff --git a/coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskFailed.json.golden b/coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskFailed.json.golden
new file mode 100644
index 0000000000000..44788581a02b3
--- /dev/null
+++ b/coderd/notifications/testdata/rendered-templates/webhook/TemplateTaskFailed.json.golden
@@ -0,0 +1,33 @@
+{
+  "_version": "1.1",
+  "msg_id": "00000000-0000-0000-0000-000000000000",
+  "payload": {
+    "_version": "1.2",
+    "notification_name": "Task Failed",
+    "notification_template_id": "00000000-0000-0000-0000-000000000000",
+    "user_id": "00000000-0000-0000-0000-000000000000",
+    "user_email": "bobby@coder.com",
+    "user_name": "Bobby",
+    "user_username": "bobby",
+    "actions": [
+      {
+        "label": "View task",
+        "url": "http://test.com/tasks/bobby/my-workspace"
+      },
+      {
+        "label": "View workspace",
+        "url": "http://test.com/@bobby/my-workspace"
+      }
+    ],
+    "labels": {
+      "task": "my-task",
+      "workspace": "my-workspace"
+    },
+    "data": {},
+    "targets": null
+  },
+  "title": "Task 'my-workspace' failed",
+  "title_markdown": "Task 'my-workspace' failed",
+  "body": "The task 'my-task' has failed. Check the logs for more details.",
+  "body_markdown": "The task 'my-task' has failed. Check the logs for more details."
+}
\ No newline at end of file
diff --git a/coderd/workspaceagents.go b/coderd/workspaceagents.go
index 51654380e59db..23046dab28e15 100644
--- a/coderd/workspaceagents.go
+++ b/coderd/workspaceagents.go
@@ -452,6 +452,10 @@ func (api *API) enqueueAITaskStateNotification(
 		notificationTemplate = notifications.TemplateTaskWorking
 	case codersdk.WorkspaceAppStatusStateIdle:
 		notificationTemplate = notifications.TemplateTaskIdle
+	case codersdk.WorkspaceAppStatusStateComplete:
+		notificationTemplate = notifications.TemplateTaskCompleted
+	case codersdk.WorkspaceAppStatusStateFailure:
+		notificationTemplate = notifications.TemplateTaskFailed
 	default:
 		// Not a notifiable state, do nothing
 		return

From 104aa19014ebfeeb72fa80f0000f8d743c51bda6 Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Thu, 16 Oct 2025 11:22:48 +0100
Subject: [PATCH 146/298] chore(docs): improve prebuild provsioners section
 (#20321)

## Description

Follow-up from: https://github.com/coder/coder/pull/20305 to include a
note about `coder_workspace_tags` being cumulative and a new step to
validate the status of the prebuild provisioners.
Fix steps formatting.
---
 .../templates/extending-templates/prebuilt-workspaces.md  | 8 ++++++--
 .../admin/templates/extending-templates/workspace-tags.md | 3 +++
 2 files changed, 9 insertions(+), 2 deletions(-)

diff --git a/docs/admin/templates/extending-templates/prebuilt-workspaces.md b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
index 10722c1b26a21..df99bd8c0a903 100644
--- a/docs/admin/templates/extending-templates/prebuilt-workspaces.md
+++ b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
@@ -379,6 +379,7 @@ This keeps other provisioners available to handle user-initiated jobs.
 
 1) Create a provisioner key with a prebuild tag (e.g., `is_prebuild=true`).
 Provisioner keys are org-scoped and their tags are inferred automatically by provisioner daemons that use the key.
+**Note:** `coder_workspace_tags` are cumulative, so if your template already defines provisioner tags, you will need to create the provisioner key with the same tags plus the `is_prebuild=true` tag so that prebuild jobs correctly match the dedicated prebuild pool.
 See [Scoped Key](../../provisioners/index.md#scoped-key-recommended) for instructions on how to create a provisioner key.
 
 2) Deploy a separate provisioner pool using that key (for example, via the [Helm coder-provisioner chart](https://github.com/coder/coder/pkgs/container/chart%2Fcoder-provisioner)).
@@ -412,12 +413,15 @@ Follow these steps:
 
 1) Publish the new template version.
 
-2) Wait for the prebuilds reconciliation loop to run.
+2) Validate the status of the prebuild provisioners.
+Check the Provisioners page in the Coder dashboard or run the [`coder provisioner list`](../../../reference/cli/provisioner_list.md) CLI command to ensure all prebuild provisioners are up to date and the tags are properly set.
+
+3) Wait for the prebuilds reconciliation loop to run.
 The loop frequency is controlled by the configuration value [`CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL`](../../../reference/cli/server.md#--workspace-prebuilds-reconciliation-interval).
 When the loop runs, it will provision prebuilds for the new template version and deprovision prebuilds for the previous version.
 Both provisioning and deprovisioning jobs for prebuilds should display the tag `is_prebuild=true`.
 
-3) Create a new workspace from a preset.
+4) Create a new workspace from a preset.
 Whether the preset uses a prebuild pool or not, the resulting job should not include the `is_prebuild=true` tag.
 This confirms that only prebuild-related jobs are routed to the dedicated prebuild provisioner pool.
 
diff --git a/docs/admin/templates/extending-templates/workspace-tags.md b/docs/admin/templates/extending-templates/workspace-tags.md
index 7a5aca5179d01..279d01adcf84f 100644
--- a/docs/admin/templates/extending-templates/workspace-tags.md
+++ b/docs/admin/templates/extending-templates/workspace-tags.md
@@ -74,6 +74,9 @@ that every tag set is associated with at least one healthy provisioner.
 > [!NOTE]
 > It may be useful to run at least one provisioner with no additional
 > tag restrictions that is able to take on any job.
+>
+> `coder_workspace_tags` are cumulative.
+> Jobs will only match provisioners that have all tags defined in both your template configuration and `coder_workspace_tags`.
 
 ### Parameters types
 

From 038e23b82c03c17cf811c8361b9449d0fceb07de Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Thu, 16 Oct 2025 16:20:36 +0500
Subject: [PATCH 147/298] chore(dogfood): remove extra ENV variable for claude
 code auth (#20337)

---
 dogfood/coder/main.tf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index ae4569a5d6e39..d6085ab36a8e5 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -479,8 +479,8 @@ resource "coder_agent" "dev" {
   dir  = local.repo_dir
   env = {
     OIDC_TOKEN : data.coder_workspace_owner.me.oidc_access_token,
+    # To Enable AI Bridge integration
     ANTHROPIC_BASE_URL : "https://dev.coder.com/api/experimental/aibridge/anthropic",
-    ANTHROPIC_AUTH_TOKEN : data.coder_workspace_owner.me.session_token
   }
   startup_script_behavior = "blocking"
 
@@ -855,7 +855,7 @@ module "claude-code" {
   workdir             = local.repo_dir
   claude_code_version = "latest"
   order               = 999
-  claude_api_key      = data.coder_workspace_owner.me.session_token
+  claude_api_key      = data.coder_workspace_owner.me.session_token # To Enable AI Bridge integration
   agentapi_version    = "latest"
 
   system_prompt       = local.claude_system_prompt

From a53a5682d51d35e3d2f62a7fa8c93e22db2f3103 Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Thu, 16 Oct 2025 12:07:17 -0500
Subject: [PATCH 148/298] chore: update coder/guts to v1.6.0 (#20346)

- Removes redudant generic type parameters
- Removes unexported values from generted output
---
 go.mod                         |  2 +-
 go.sum                         |  4 ++--
 site/src/api/typesGenerated.ts | 29 +----------------------------
 3 files changed, 4 insertions(+), 31 deletions(-)

diff --git a/go.mod b/go.mod
index 6a59e061b2834..228d3a83ff6fd 100644
--- a/go.mod
+++ b/go.mod
@@ -96,7 +96,7 @@ require (
 	github.com/chromedp/chromedp v0.14.1
 	github.com/cli/safeexec v1.0.1
 	github.com/coder/flog v1.1.0
-	github.com/coder/guts v1.5.0
+	github.com/coder/guts v1.6.0
 	github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0
 	github.com/coder/quartz v0.2.1
 	github.com/coder/retry v1.5.1
diff --git a/go.sum b/go.sum
index 0bbf3ba6041b4..0f97c2e7186bd 100644
--- a/go.sum
+++ b/go.sum
@@ -928,8 +928,8 @@ github.com/coder/go-httpstat v0.0.0-20230801153223-321c88088322 h1:m0lPZjlQ7vdVp
 github.com/coder/go-httpstat v0.0.0-20230801153223-321c88088322/go.mod h1:rOLFDDVKVFiDqZFXoteXc97YXx7kFi9kYqR+2ETPkLQ=
 github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136 h1:0RgB61LcNs24WOxc3PBvygSNTQurm0PYPujJjLLOzs0=
 github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136/go.mod h1:VkD1P761nykiq75dz+4iFqIQIZka189tx1BQLOp0Skc=
-github.com/coder/guts v1.5.0 h1:a94apf7xMf5jDdg1bIHzncbRiTn3+BvBZgrFSDbUnyI=
-github.com/coder/guts v1.5.0/go.mod h1:0Sbv5Kp83u1Nl7MIQiV2zmacJ3o02I341bkWkjWXSUQ=
+github.com/coder/guts v1.6.0 h1:N7zotzWubbT49kiH/RENHNQglW68tyMYymMU452q9yg=
+github.com/coder/guts v1.6.0/go.mod h1:FaECwB632JE8nYi7nrKfO0PVjbOl4+hSWupKO2Z99JI=
 github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151 h1:YAxwg3lraGNRwoQ18H7R7n+wsCqNve7Brdvj0F1rDnU=
 github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 1deb951b79f60..f6679d3d31442 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -1811,7 +1811,7 @@ export interface HealthcheckReport {
 }
 
 // From codersdk/idpsync.go
-export interface IDPSyncMapping<ResourceIdType extends string | string> {
+export interface IDPSyncMapping<ResourceIdType extends string> {
 	readonly Given: string;
 	readonly Gets: ResourceIdType;
 }
@@ -4666,30 +4666,3 @@ export interface WorkspacesResponse {
 	readonly workspaces: readonly Workspace[];
 	readonly count: number;
 }
-
-// From codersdk/deployment.go
-export const annotationEnterpriseKey = "enterprise";
-
-// From codersdk/deployment.go
-export const annotationExternalProxies = "external_workspace_proxies";
-
-// From codersdk/deployment.go
-export const annotationFormatDuration = "format_duration";
-
-// From codersdk/deployment.go
-export const annotationSecretKey = "secret";
-
-// From codersdk/insights.go
-export const insightsTimeLayout = "2006-01-02T15:04:05Z07:00";
-
-// From codersdk/notifications.go
-export const maxCustomNotificationMessageLen = 2000;
-
-// From codersdk/notifications.go
-export const maxCustomNotificationTitleLen = 120;
-
-// From healthsdk/interfaces.go
-export const safeMTU = 1378;
-
-// From codersdk/workspacedisplaystatus.go
-export const unknownStatus = "Unknown";

From 9f3b2cddb1c7a355bffb8ea56d193158851f3e25 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Thu, 16 Oct 2025 19:04:23 +0000
Subject: [PATCH 149/298] fix(dogfood): revert unpin of containerd.io and pin
 docker-ce (#20349)

Previously we unpinned the containerd.io package since the dogfood
template image build was failing due to docker-ce requiring a newer
version of containerd.io. The build was fixed, but some dogfood machines
experienced docker-in-docker problems again because their OS version
didn't have the fixed containerd.io packages available.

This PR first reverts the unpinning of the containerd.io package, and
pins the docker-ce major version for compatibility with the
containerd.io package version we have pinned. Newer versions of
docker-ce have a higher min version of containerd.io. While the
underlying issue that caused us to pin containerd.io is fixed in newer
versions, we can't yet remove the pin because some machines running
dogfood are not yet updated to a version of Linux that have a version of
the fixed package (e.g. ubuntu 20.04).
---
 dogfood/coder/files/etc/apt/preferences.d/containerd | 6 ++++++
 dogfood/coder/files/etc/apt/preferences.d/docker     | 4 ++++
 2 files changed, 10 insertions(+)
 create mode 100644 dogfood/coder/files/etc/apt/preferences.d/containerd

diff --git a/dogfood/coder/files/etc/apt/preferences.d/containerd b/dogfood/coder/files/etc/apt/preferences.d/containerd
new file mode 100644
index 0000000000000..ab0b8f9891aa2
--- /dev/null
+++ b/dogfood/coder/files/etc/apt/preferences.d/containerd
@@ -0,0 +1,6 @@
+# Ref: https://github.com/nestybox/sysbox/issues/879
+# We need to pin containerd to a specific version to avoid breaking
+# Docker-in-Docker.
+Package: containerd.io
+Pin: version 1.7.23-1
+Pin-Priority: 1001
diff --git a/dogfood/coder/files/etc/apt/preferences.d/docker b/dogfood/coder/files/etc/apt/preferences.d/docker
index a92c0abb03d7c..91dcb2b37f643 100644
--- a/dogfood/coder/files/etc/apt/preferences.d/docker
+++ b/dogfood/coder/files/etc/apt/preferences.d/docker
@@ -4,8 +4,12 @@ Pin: origin download.docker.com
 Pin-Priority: 1
 
 # Docker Community Edition
+# We need to pin docker-ce to a specific version because containerd is pinned
+# to an older version. Newer major versions of docker-ce require a version of
+# containerd.io greater than our pinned version.
 Package: docker-ce
 Pin: origin download.docker.com
+Pin: version 5:27.*
 Pin-Priority: 500
 
 # Docker command-line tool

From 5119db3cd264db95e4e402e19401bc6b1e0403d4 Mon Sep 17 00:00:00 2001
From: "blink-so[bot]" <211532188+blink-so[bot]@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:24:45 -0400
Subject: [PATCH 150/298] feat: underline links in announcement banner for
 better visibility (#20166)

## Overview

Links in announcement banners are now underlined to make them visually
distinguishable without requiring users to hover over them.

Context:
[Slack](https://codercom.slack.com/archives/C0989BZU23T/p1759503061267819)

## Changes

- Added `text-decoration: underline` to links in the announcement banner
component

---------

Co-authored-by: blink-so[bot] <211532188+blink-so[bot]@users.noreply.github.com>
Co-authored-by: blink-so[bot] <157993532+blink-so[bot]@users.noreply.github.com>
Co-authored-by: Michael Smith <michaelsmith@coder.com>
---
 site/e2e/tests/deployment/appearance.spec.ts  |  5 +--
 .../AnnouncementBannerView.tsx                | 32 +++----------------
 .../AnnouncementBanners.tsx                   |  8 ++++-
 3 files changed, 15 insertions(+), 30 deletions(-)

diff --git a/site/e2e/tests/deployment/appearance.spec.ts b/site/e2e/tests/deployment/appearance.spec.ts
index c2b129c632cb3..83b743814e70e 100644
--- a/site/e2e/tests/deployment/appearance.spec.ts
+++ b/site/e2e/tests/deployment/appearance.spec.ts
@@ -83,6 +83,7 @@ test("set service banner", async ({ page }) => {
 	await page.goto("/workspaces", { waitUntil: "domcontentloaded" });
 	await expectUrl(page).toHavePathName("/workspaces");
 
-	const bar = page.locator("div.service-banner", { hasText: message });
-	await expect(bar).toBeVisible();
+	const banner = page.getByTestId("service-banner");
+	await expect(banner).toBeVisible();
+	await expect(banner).toHaveText(message);
 });
diff --git a/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBannerView.tsx b/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBannerView.tsx
index 84df0b97960f3..f26e85709da3b 100644
--- a/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBannerView.tsx
+++ b/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBannerView.tsx
@@ -1,29 +1,24 @@
-import { css, type Interpolation, type Theme } from "@emotion/react";
 import { InlineMarkdown } from "components/Markdown/Markdown";
 import type { FC } from "react";
 import { readableForegroundColor } from "utils/colors";
 
 interface AnnouncementBannerViewProps {
-	message?: string;
-	backgroundColor?: string;
+	message: string;
+	backgroundColor: string;
 }
 
 export const AnnouncementBannerView: FC<AnnouncementBannerViewProps> = ({
 	message,
 	backgroundColor,
 }) => {
-	if (!message || !backgroundColor) {
-		return null;
-	}
-
 	return (
 		<div
-			css={styles.banner}
+			className="p-3 flex items-center"
 			style={{ backgroundColor }}
-			className="service-banner"
+			data-test-id="service-banner"
 		>
 			<div
-				css={styles.wrapper}
+				className="mx-auto font-normal [&_a]:text-inherit [&_a]:underline"
 				style={{ color: readableForegroundColor(backgroundColor) }}
 			>
 				<InlineMarkdown>{message}</InlineMarkdown>
@@ -31,20 +26,3 @@ export const AnnouncementBannerView: FC<AnnouncementBannerViewProps> = ({
 		</div>
 	);
 };
-
-const styles = {
-	banner: css`
-    padding: 12px;
-    display: flex;
-    align-items: center;
-  `,
-	wrapper: css`
-    margin-right: auto;
-    margin-left: auto;
-    font-weight: 400;
-
-    & a {
-      color: inherit;
-    }
-  `,
-} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBanners.tsx b/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBanners.tsx
index a962c291d1a35..1e4411edf7811 100644
--- a/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBanners.tsx
+++ b/site/src/modules/dashboard/AnnouncementBanners/AnnouncementBanners.tsx
@@ -1,3 +1,4 @@
+import type { BannerConfig } from "api/typesGenerated";
 import { useDashboard } from "modules/dashboard/useDashboard";
 import type { FC } from "react";
 import { AnnouncementBannerView } from "./AnnouncementBannerView";
@@ -15,7 +16,12 @@ export const AnnouncementBanners: FC = () => {
 	return (
 		<>
 			{announcementBanners
-				.filter((banner) => banner.enabled)
+				.filter(
+					(banner): banner is Required<BannerConfig> =>
+						banner.enabled &&
+						Boolean(banner.message) &&
+						Boolean(banner.background_color),
+				)
 				.map((banner) => (
 					<AnnouncementBannerView
 						key={banner.message}

From ef51e7d07ae2bebc180dee64a70d8accfcbf8c81 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Fri, 17 Oct 2025 01:11:18 +0500
Subject: [PATCH 151/298] chore(docs): update numbered lists to be consistent
 (#20350)

---
 .../prebuilt-workspaces.md                    | 60 +++++++++----------
 1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/docs/admin/templates/extending-templates/prebuilt-workspaces.md b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
index df99bd8c0a903..20560075e38e0 100644
--- a/docs/admin/templates/extending-templates/prebuilt-workspaces.md
+++ b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
@@ -377,27 +377,27 @@ This keeps other provisioners available to handle user-initiated jobs.
 
 #### Setup
 
-1) Create a provisioner key with a prebuild tag (e.g., `is_prebuild=true`).
-Provisioner keys are org-scoped and their tags are inferred automatically by provisioner daemons that use the key.
-**Note:** `coder_workspace_tags` are cumulative, so if your template already defines provisioner tags, you will need to create the provisioner key with the same tags plus the `is_prebuild=true` tag so that prebuild jobs correctly match the dedicated prebuild pool.
-See [Scoped Key](../../provisioners/index.md#scoped-key-recommended) for instructions on how to create a provisioner key.
-
-2) Deploy a separate provisioner pool using that key (for example, via the [Helm coder-provisioner chart](https://github.com/coder/coder/pkgs/container/chart%2Fcoder-provisioner)).
-Daemons in this pool will only execute jobs that include all of the tags specified in their provisioner key.
-See [External provisioners](../../provisioners/index.md) for environment-specific deployment examples.
-
-3) Update the template to conditionally add the prebuild tag for prebuild jobs.
-
-```hcl
-data "coder_workspace_tags" "prebuilds" {
-  count = data.coder_workspace_owner.me.name == "prebuilds" ? 1 : 0
-  tags = {
-    "is_prebuild" = "true"
-  }
-}
-```
+1. Create a provisioner key with a prebuild tag (e.g., `is_prebuild=true`).
+    Provisioner keys are org-scoped and their tags are inferred automatically by provisioner daemons that use the key.
+    **Note:** `coder_workspace_tags` are cumulative, so if your template already defines provisioner tags, you will need to create the provisioner key with the same tags plus the `is_prebuild=true` tag so that prebuild jobs correctly match the dedicated prebuild pool.
+    See [Scoped Key](../../provisioners/index.md#scoped-key-recommended) for instructions on how to create a provisioner key.
+
+1. Deploy a separate provisioner pool using that key (for example, via the [Helm coder-provisioner chart](https://github.com/coder/coder/pkgs/container/chart%2Fcoder-provisioner)).
+    Daemons in this pool will only execute jobs that include all of the tags specified in their provisioner key.
+    See [External provisioners](../../provisioners/index.md) for environment-specific deployment examples.
+
+1. Update the template to conditionally add the prebuild tag for prebuild jobs.
+
+    ```hcl
+    data "coder_workspace_tags" "prebuilds" {
+      count = data.coder_workspace_owner.me.name == "prebuilds" ? 1 : 0
+      tags = {
+        "is_prebuild" = "true"
+      }
+    }
+    ```
 
-Prebuild workspaces are a special type of workspace owned by the system user `prebuilds`.
+Prebuild workspaces are a special type of workspace owned by the system user `prebuild`.
 The value `data.coder_workspace_owner.me.name` returns the name of the workspace owner, for prebuild workspaces, this value is `"prebuild"`.
 Because the condition evaluates based on the workspace owner, provisioning or deprovisioning prebuilds automatically applies the prebuild tag, whereas regular jobs (like workspace creation or template import) do not.
 
@@ -411,19 +411,19 @@ Because the condition evaluates based on the workspace owner, provisioning or de
 To confirm that prebuild jobs are correctly routed to the new provisioner pool, use the Provisioner Jobs dashboard or the [`coder provisioner jobs list`](../../../reference/cli/provisioner_jobs_list.md) CLI command to inspect job metadata and tags.
 Follow these steps:
 
-1) Publish the new template version.
+1. Publish the new template version.
 
-2) Validate the status of the prebuild provisioners.
-Check the Provisioners page in the Coder dashboard or run the [`coder provisioner list`](../../../reference/cli/provisioner_list.md) CLI command to ensure all prebuild provisioners are up to date and the tags are properly set.
+1. Validate the status of the prebuild provisioners.
+    Check the Provisioners page in the Coder dashboard or run the [`coder provisioner list`](../../../reference/cli/provisioner_list.md) CLI command to ensure all prebuild provisioners are up to date and the tags are properly set.
 
-3) Wait for the prebuilds reconciliation loop to run.
-The loop frequency is controlled by the configuration value [`CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL`](../../../reference/cli/server.md#--workspace-prebuilds-reconciliation-interval).
-When the loop runs, it will provision prebuilds for the new template version and deprovision prebuilds for the previous version.
-Both provisioning and deprovisioning jobs for prebuilds should display the tag `is_prebuild=true`.
+1. Wait for the prebuilds reconciliation loop to run.
+    The loop frequency is controlled by the configuration value [`CODER_WORKSPACE_PREBUILDS_RECONCILIATION_INTERVAL`](../../../reference/cli/server.md#--workspace-prebuilds-reconciliation-interval).
+    When the loop runs, it will provision prebuilds for the new template version and deprovision prebuilds for the previous version.
+    Both provisioning and deprovisioning jobs for prebuilds should display the tag `is_prebuild=true`.
 
-4) Create a new workspace from a preset.
-Whether the preset uses a prebuild pool or not, the resulting job should not include the `is_prebuild=true` tag.
-This confirms that only prebuild-related jobs are routed to the dedicated prebuild provisioner pool.
+1. Create a new workspace from a preset.
+    Whether the preset uses a prebuild pool or not, the resulting job should not include the `is_prebuild=true` tag.
+    This confirms that only prebuild-related jobs are routed to the dedicated prebuild provisioner pool.
 
 ### Monitoring and observability
 

From f3d950d9177846ff1fdfc4b070524a642f8c737a Mon Sep 17 00:00:00 2001
From: david-fraley <67079030+david-fraley@users.noreply.github.com>
Date: Thu, 16 Oct 2025 15:11:38 -0500
Subject: [PATCH 152/298] chore: update release calendar (#20351)

---
 docs/install/kubernetes.md     | 8 ++++----
 docs/install/rancher.md        | 4 ++--
 docs/install/releases/index.md | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md
index 61ccf0a668dda..40f1df2fed504 100644
--- a/docs/install/kubernetes.md
+++ b/docs/install/kubernetes.md
@@ -136,7 +136,7 @@ We support two release channels: mainline and stable - read the
     helm install coder coder-v2/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.27.0
+        --version 2.27.1
     ```
 
   - **OCI Registry**
@@ -147,7 +147,7 @@ We support two release channels: mainline and stable - read the
     helm install coder oci://ghcr.io/coder/chart/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.27.0
+        --version 2.27.1
     ```
 
 - **Stable** Coder release:
@@ -160,7 +160,7 @@ We support two release channels: mainline and stable - read the
     helm install coder coder-v2/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.26.1
+        --version 2.26.2
     ```
 
   - **OCI Registry**
@@ -171,7 +171,7 @@ We support two release channels: mainline and stable - read the
     helm install coder oci://ghcr.io/coder/chart/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.26.1
+        --version 2.26.2
     ```
 
 You can watch Coder start up by running `kubectl get pods -n coder`. Once Coder
diff --git a/docs/install/rancher.md b/docs/install/rancher.md
index 20e73f0a86940..ab0148b0cf846 100644
--- a/docs/install/rancher.md
+++ b/docs/install/rancher.md
@@ -134,8 +134,8 @@ kubectl create secret generic coder-db-url -n coder \
 
 1. Select a Coder version:
 
-   - **Mainline**: `2.27.0`
-   - **Stable**: `2.26.1`
+   - **Mainline**: `2.27.1`
+   - **Stable**: `2.26.2`
 
    Learn more about release channels in the [Releases documentation](./releases/index.md).
 
diff --git a/docs/install/releases/index.md b/docs/install/releases/index.md
index 2b7b985076562..ee2fc28950950 100644
--- a/docs/install/releases/index.md
+++ b/docs/install/releases/index.md
@@ -61,8 +61,8 @@ pages.
 | [2.23](https://coder.com/changelog/coder-2-23) | June 03, 2025      | Not Supported    | [v2.23.5](https://github.com/coder/coder/releases/tag/v2.23.5) |
 | [2.24](https://coder.com/changelog/coder-2-24) | July 01, 2025      | Not Supported    | [v2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4) |
 | [2.25](https://coder.com/changelog/coder-2-25) | August 05, 2025    | Security Support | [v2.25.3](https://github.com/coder/coder/releases/tag/v2.25.3) |
-| [2.26](https://coder.com/changelog/coder-2-26) | September 03, 2025 | Stable           | [v2.26.1](https://github.com/coder/coder/releases/tag/v2.26.1) |
-| [2.27](https://coder.com/changelog/coder-2-27) | October 02, 2025   | Mainline         | [v2.27.0](https://github.com/coder/coder/releases/tag/v2.27.0) |
+| [2.26](https://coder.com/changelog/coder-2-26) | September 03, 2025 | Stable           | [v2.26.2](https://github.com/coder/coder/releases/tag/v2.26.2) |
+| [2.27](https://coder.com/changelog/coder-2-27) | October 02, 2025   | Mainline         | [v2.27.1](https://github.com/coder/coder/releases/tag/v2.27.1) |
 | 2.28                                           |                    | Not Released     | N/A                                                            |
 <!-- RELEASE_CALENDAR_END -->
 

From 14e80022c9fb8114bd2474686058f7f46b762dc7 Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Fri, 17 Oct 2025 10:34:55 +0100
Subject: [PATCH 153/298] fix(docs): fix 'prebuilds' system user typo (#20356)

## Description

Fix typo on documentation regarding system user `prebuilds`.
---
 .../templates/extending-templates/prebuilt-workspaces.md      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/admin/templates/extending-templates/prebuilt-workspaces.md b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
index 20560075e38e0..748fc40c98d9c 100644
--- a/docs/admin/templates/extending-templates/prebuilt-workspaces.md
+++ b/docs/admin/templates/extending-templates/prebuilt-workspaces.md
@@ -397,8 +397,8 @@ This keeps other provisioners available to handle user-initiated jobs.
     }
     ```
 
-Prebuild workspaces are a special type of workspace owned by the system user `prebuild`.
-The value `data.coder_workspace_owner.me.name` returns the name of the workspace owner, for prebuild workspaces, this value is `"prebuild"`.
+Prebuild workspaces are a special type of workspace owned by the system user `prebuilds`.
+The value `data.coder_workspace_owner.me.name` returns the name of the workspace owner, for prebuild workspaces, this value is `"prebuilds"`.
 Because the condition evaluates based on the workspace owner, provisioning or deprovisioning prebuilds automatically applies the prebuild tag, whereas regular jobs (like workspace creation or template import) do not.
 
 > [!NOTE]

From dc6e50d6b742e9d54248c50e3133f42103c1468e Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 17 Oct 2025 10:48:56 +0100
Subject: [PATCH 154/298] feat(coderd/telemetry): add telemetry for database
 Tasks (#20279)

Adds Tasks to telemetry snapshots

Co-authored-by: Mathias Fredriksson <mafredri@gmail.com>
---
 coderd/database/dbgen/dbgen.go                |  9 ++-
 coderd/database/querier_test.go               |  4 +-
 .../provisionerdserver_test.go                |  6 +-
 coderd/telemetry/telemetry.go                 | 60 +++++++++++++++++++
 coderd/telemetry/telemetry_test.go            | 30 ++++++++++
 5 files changed, 102 insertions(+), 7 deletions(-)

diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index e00ff31b9602b..713cb53b6d296 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -1561,7 +1561,7 @@ func AIBridgeToolUsage(t testing.TB, db database.Store, seed database.InsertAIBr
 	return toolUsage
 }
 
-func Task(t testing.TB, db database.Store, orig database.TaskTable) database.TaskTable {
+func Task(t testing.TB, db database.Store, orig database.TaskTable) database.Task {
 	t.Helper()
 
 	parameters := orig.TemplateParameters
@@ -1581,7 +1581,12 @@ func Task(t testing.TB, db database.Store, orig database.TaskTable) database.Tas
 	})
 	require.NoError(t, err, "failed to insert task")
 
-	return task
+	// Return the Task from the view instead of the TaskTable
+	fetched, err := db.GetTaskByID(genCtx, task.ID)
+	require.NoError(t, err, "failed to fetch task")
+	require.Equal(t, task.ID, fetched.ID)
+
+	return fetched
 }
 
 func TaskWorkspaceApp(t testing.TB, db database.Store, orig database.TaskWorkspaceApp) database.TaskWorkspaceApp {
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index aca6156904eb9..5c894f98e9957 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -6709,7 +6709,7 @@ func TestTasksWithStatusView(t *testing.T) {
 		buildTransition database.WorkspaceTransition,
 		agentState database.WorkspaceAgentLifecycleState,
 		appHealths []database.WorkspaceAppHealth,
-	) database.TaskTable {
+	) database.Task {
 		t.Helper()
 
 		template := dbgen.Template(t, db, database.Template{
@@ -7455,7 +7455,7 @@ func TestListTasks(t *testing.T) {
 	})
 
 	// Helper function to create a task
-	createTask := func(orgID, ownerID uuid.UUID) database.TaskTable {
+	createTask := func(orgID, ownerID uuid.UUID) database.Task {
 		ws := dbgen.Workspace(t, db, database.WorkspaceTable{
 			OrganizationID: orgID,
 			OwnerID:        ownerID,
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
index 0cfb83faa4465..6cd490190b502 100644
--- a/coderd/provisionerdserver/provisionerdserver_test.go
+++ b/coderd/provisionerdserver/provisionerdserver_test.go
@@ -3003,9 +3003,9 @@ func TestCompleteJob(t *testing.T) {
 						OwnerID:        user.ID,
 						OrganizationID: pd.OrganizationID,
 					})
-					var taskTable database.TaskTable
+					var genTask database.Task
 					if tc.isTask {
-						taskTable = dbgen.Task(t, db, database.TaskTable{
+						genTask = dbgen.Task(t, db, database.TaskTable{
 							OwnerID:           user.ID,
 							OrganizationID:    pd.OrganizationID,
 							WorkspaceID:       uuid.NullUUID{UUID: workspaceTable.ID, Valid: true},
@@ -3081,7 +3081,7 @@ func TestCompleteJob(t *testing.T) {
 					require.Equal(t, tc.expectHasAiTask, build.HasAITask.Bool)
 
 					if tc.isTask {
-						task, err := db.GetTaskByID(ctx, taskTable.ID)
+						task, err := db.GetTaskByID(ctx, genTask.ID)
 						require.NoError(t, err)
 						require.Equal(t, tc.expectTaskStatus, task.Status)
 					}
diff --git a/coderd/telemetry/telemetry.go b/coderd/telemetry/telemetry.go
index 75b432022bafc..37e41fcd70c62 100644
--- a/coderd/telemetry/telemetry.go
+++ b/coderd/telemetry/telemetry.go
@@ -730,6 +730,19 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 		}
 		return nil
 	})
+	eg.Go(func() error {
+		dbTasks, err := r.options.Database.ListTasks(ctx, database.ListTasksParams{
+			OwnerID:        uuid.Nil,
+			OrganizationID: uuid.Nil,
+		})
+		if err != nil {
+			return err
+		}
+		for _, dbTask := range dbTasks {
+			snapshot.Tasks = append(snapshot.Tasks, ConvertTask(dbTask))
+		}
+		return nil
+	})
 
 	err := eg.Wait()
 	if err != nil {
@@ -1205,6 +1218,7 @@ type Snapshot struct {
 	Workspaces                           []Workspace                           `json:"workspaces"`
 	NetworkEvents                        []NetworkEvent                        `json:"network_events"`
 	Organizations                        []Organization                        `json:"organizations"`
+	Tasks                                []Task                                `json:"tasks"`
 	TelemetryItems                       []TelemetryItem                       `json:"telemetry_items"`
 	UserTailnetConnections               []UserTailnetConnection               `json:"user_tailnet_connections"`
 	PrebuiltWorkspaces                   []PrebuiltWorkspace                   `json:"prebuilt_workspaces"`
@@ -1753,6 +1767,52 @@ type Organization struct {
 	CreatedAt time.Time `json:"created_at"`
 }
 
+type Task struct {
+	ID                   string    `json:"id"`
+	OrganizationID       string    `json:"organization_id"`
+	OwnerID              string    `json:"owner_id"`
+	Name                 string    `json:"name"`
+	WorkspaceID          *string   `json:"workspace_id"`
+	WorkspaceBuildNumber *int64    `json:"workspace_build_number"`
+	WorkspaceAgentID     *string   `json:"workspace_agent_id"`
+	WorkspaceAppID       *string   `json:"workspace_app_id"`
+	TemplateVersionID    string    `json:"template_version_id"`
+	PromptHash           string    `json:"prompt_hash"` // Prompt is hashed for privacy.
+	CreatedAt            time.Time `json:"created_at"`
+	Status               string    `json:"status"`
+}
+
+// ConvertTask anonymizes a Task.
+func ConvertTask(task database.Task) Task {
+	t := &Task{
+		ID:                   task.ID.String(),
+		OrganizationID:       task.OrganizationID.String(),
+		OwnerID:              task.OwnerID.String(),
+		Name:                 task.Name,
+		WorkspaceID:          nil,
+		WorkspaceBuildNumber: nil,
+		WorkspaceAgentID:     nil,
+		WorkspaceAppID:       nil,
+		TemplateVersionID:    task.TemplateVersionID.String(),
+		PromptHash:           fmt.Sprintf("%x", sha256.Sum256([]byte(task.Prompt))),
+		CreatedAt:            task.CreatedAt,
+		Status:               string(task.Status),
+	}
+	if task.WorkspaceID.Valid {
+		t.WorkspaceID = ptr.Ref(task.WorkspaceID.UUID.String())
+	}
+	if task.WorkspaceBuildNumber.Valid {
+		t.WorkspaceBuildNumber = ptr.Ref(int64(task.WorkspaceBuildNumber.Int32))
+	}
+	if task.WorkspaceAgentID.Valid {
+		t.WorkspaceAgentID = ptr.Ref(task.WorkspaceAgentID.UUID.String())
+	}
+	if task.WorkspaceAppID.Valid {
+		t.WorkspaceAppID = ptr.Ref(task.WorkspaceAppID.UUID.String())
+	}
+	return *t
+}
+
 type telemetryItemKey string
 
 // The comment below gets rid of the warning that the name "TelemetryItemKey" has
diff --git a/coderd/telemetry/telemetry_test.go b/coderd/telemetry/telemetry_test.go
index 5508a7d8816f5..a48bdee299658 100644
--- a/coderd/telemetry/telemetry_test.go
+++ b/coderd/telemetry/telemetry_test.go
@@ -151,6 +151,20 @@ func TestTelemetry(t *testing.T) {
 			HasAITask:          sql.NullBool{Valid: true, Bool: true},
 			AITaskSidebarAppID: uuid.NullUUID{Valid: true, UUID: taskWsApp.ID},
 		})
+		task := dbgen.Task(t, db, database.TaskTable{
+			OwnerID:            user.ID,
+			OrganizationID:     org.ID,
+			WorkspaceID:        uuid.NullUUID{Valid: true, UUID: taskWs.ID},
+			TemplateVersionID:  taskTV.ID,
+			Prompt:             "example prompt",
+			TemplateParameters: json.RawMessage(`{"foo": "bar"}`),
+		})
+		taskWA := dbgen.TaskWorkspaceApp(t, db, database.TaskWorkspaceApp{
+			TaskID:               task.ID,
+			WorkspaceAgentID:     uuid.NullUUID{Valid: true, UUID: taskWsAgent.ID},
+			WorkspaceAppID:       uuid.NullUUID{Valid: true, UUID: taskWsApp.ID},
+			WorkspaceBuildNumber: taskWB.BuildNumber,
+		})
 
 		group := dbgen.Group(t, db, database.Group{
 			OrganizationID: org.ID,
@@ -220,6 +234,22 @@ func TestTelemetry(t *testing.T) {
 		require.Len(t, wsa.Subsystems, 2)
 		require.Equal(t, string(database.WorkspaceAgentSubsystemEnvbox), wsa.Subsystems[0])
 		require.Equal(t, string(database.WorkspaceAgentSubsystemExectrace), wsa.Subsystems[1])
+		require.Len(t, snapshot.Tasks, 1)
+		for _, snapTask := range snapshot.Tasks {
+			assert.Equal(t, task.ID.String(), snapTask.ID)
+			assert.Equal(t, task.OrganizationID.String(), snapTask.OrganizationID)
+			assert.Equal(t, task.OwnerID.String(), snapTask.OwnerID)
+			assert.Equal(t, task.Name, snapTask.Name)
+			if assert.True(t, task.WorkspaceID.Valid) {
+				assert.Equal(t, task.WorkspaceID.UUID.String(), *snapTask.WorkspaceID)
+			}
+			assert.EqualValues(t, taskWA.WorkspaceBuildNumber, *snapTask.WorkspaceBuildNumber)
+			assert.Equal(t, taskWA.WorkspaceAgentID.UUID.String(), *snapTask.WorkspaceAgentID)
+			assert.Equal(t, taskWA.WorkspaceAppID.UUID.String(), *snapTask.WorkspaceAppID)
+			assert.Equal(t, task.TemplateVersionID.String(), snapTask.TemplateVersionID)
+			assert.Equal(t, "e196fe22e61cfa32d8c38749e0ce348108bb4cae29e2c36cdcce7e77faa9eb5f", snapTask.PromptHash)
+			assert.Equal(t, task.CreatedAt.UTC(), snapTask.CreatedAt.UTC())
+		}
 
 		require.True(t, slices.ContainsFunc(snapshot.TemplateVersions, func(ttv telemetry.TemplateVersion) bool {
 			if ttv.ID != taskTV.ID {

From a1fa5c8c969f036123f01eaa221efacf26634834 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Fri, 17 Oct 2025 11:24:37 +0100
Subject: [PATCH 155/298] fix(site): disable task prompt submit button when
 prompt empty (#20357)

Disable the submit button by default in the task creation form, it is only enabled once the prompt field is non empty
---
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   | 31 +++++++++++++++++++
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   |  2 +-
 2 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index 918df28d6171f..453017dfa869f 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -72,6 +72,37 @@ export const ReadOnlyPresetPrompt: Story = {
 	},
 };
 
+export const SubmitEnabledWhenPromptNotEmpty: Story = {
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		const prompt = await canvas.findByLabelText(/prompt/i);
+		await userEvent.type(prompt, MockNewTaskData.prompt);
+
+		const submitButton = canvas.getByRole("button", { name: /run task/i });
+		expect(submitButton).toBeEnabled();
+	},
+};
+
+export const SubmitDisabledWhenPromptEmpty: Story = {
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+
+		await step("No prompt", async () => {
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			expect(submitButton).toBeDisabled();
+		});
+
+		await step("Whitespace prompt", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			await userEvent.type(prompt, "   ");
+
+			const submitButton = canvas.getByRole("button", { name: /run task/i });
+			expect(submitButton).toBeDisabled();
+		});
+	},
+};
+
 export const OnSuccess: Story = {
 	decorators: [withGlobalSnackbar],
 	parameters: {
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index 643d9713a9864..a3ed3b427bb05 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -368,7 +368,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 						<Button
 							size="icon"
 							type="submit"
-							disabled={isMissingExternalAuth}
+							disabled={prompt.trim().length === 0 || isMissingExternalAuth}
 							className="rounded-full disabled:bg-surface-invert-primary disabled:opacity-70"
 						>
 							<Spinner

From e8f0e3e4c5c7557fb2c2ce54b64c5ae56b948866 Mon Sep 17 00:00:00 2001
From: Rafael Rodriguez <rafrdz@github.com>
Date: Fri, 17 Oct 2025 05:42:26 -0500
Subject: [PATCH 156/298] feat: add backoff to workspace agent polling (#20157)

## Summary

In this pull request we're adding a simple backoff to the workspace
agent polling. This backoff is being added to address seemingly random
cases of elevated number of calls that we've seen to the
`api/v2/workspaceagent/{agent_id}` endpoint.

For more information on the investigation, see:
https://github.com/coder/internal/issues/725

### Changes

- Updated the polling to use predefined progressive intervals for
polling instead of continuously polling every 500ms

### Testing

- Added a test for the function used to calculate the progressive
polling interval

Co-authored-by: Spike Curtis <spike@coder.com>
---
 cli/cliui/agent.go      | 27 ++++++++++++++++++++++++++-
 cli/cliui/agent_test.go | 28 ++++++++++++++++++++++++++++
 2 files changed, 54 insertions(+), 1 deletion(-)

diff --git a/cli/cliui/agent.go b/cli/cliui/agent.go
index 3bb6fee7be769..b6262bdf631fe 100644
--- a/cli/cliui/agent.go
+++ b/cli/cliui/agent.go
@@ -53,6 +53,9 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 		t := time.NewTimer(0)
 		defer t.Stop()
 
+		startTime := time.Now()
+		baseInterval := opts.FetchInterval
+
 		for {
 			select {
 			case <-ctx.Done():
@@ -68,7 +71,11 @@ func Agent(ctx context.Context, writer io.Writer, agentID uuid.UUID, opts AgentO
 					return
 				}
 				fetchedAgent <- fetchAgent{agent: agent}
-				t.Reset(opts.FetchInterval)
+
+				// Adjust the interval based on how long we've been waiting.
+				elapsed := time.Since(startTime)
+				currentInterval := GetProgressiveInterval(baseInterval, elapsed)
+				t.Reset(currentInterval)
 			}
 		}
 	}()
@@ -293,6 +300,24 @@ func safeDuration(sw *stageWriter, a, b *time.Time) time.Duration {
 	return a.Sub(*b)
 }
 
+// GetProgressiveInterval returns an interval that increases over time.
+// The interval starts at baseInterval and increases to
+// a maximum of baseInterval * 16 over time.
+func GetProgressiveInterval(baseInterval time.Duration, elapsed time.Duration) time.Duration {
+	switch {
+	case elapsed < 60*time.Second:
+		return baseInterval // 500ms for first 60 seconds
+	case elapsed < 2*time.Minute:
+		return baseInterval * 2 // 1s for next 1 minute
+	case elapsed < 5*time.Minute:
+		return baseInterval * 4 // 2s for next 3 minutes
+	case elapsed < 10*time.Minute:
+		return baseInterval * 8 // 4s for next 5 minutes
+	default:
+		return baseInterval * 16 // 8s after 10 minutes
+	}
+}
+
 type closeFunc func() error
 
 func (c closeFunc) Close() error {
diff --git a/cli/cliui/agent_test.go b/cli/cliui/agent_test.go
index 7c3b71a204c3d..7e5ea692f7821 100644
--- a/cli/cliui/agent_test.go
+++ b/cli/cliui/agent_test.go
@@ -866,3 +866,31 @@ func TestConnDiagnostics(t *testing.T) {
 		})
 	}
 }
+
+func TestGetProgressiveInterval(t *testing.T) {
+	t.Parallel()
+
+	baseInterval := 500 * time.Millisecond
+
+	testCases := []struct {
+		name     string
+		elapsed  time.Duration
+		expected time.Duration
+	}{
+		{"first_minute", 30 * time.Second, baseInterval},
+		{"second_minute", 90 * time.Second, baseInterval * 2},
+		{"third_to_fifth_minute", 3 * time.Minute, baseInterval * 4},
+		{"sixth_to_tenth_minute", 7 * time.Minute, baseInterval * 8},
+		{"after_ten_minutes", 15 * time.Minute, baseInterval * 16},
+		{"boundary_first_minute", 59 * time.Second, baseInterval},
+		{"boundary_second_minute", 61 * time.Second, baseInterval * 2},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+			result := cliui.GetProgressiveInterval(baseInterval, tc.elapsed)
+			require.Equal(t, tc.expected, result)
+		})
+	}
+}

From 9ee3a9174c9265eaa2372e05be0162bad4eca3ad Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 17 Oct 2025 12:28:45 +0100
Subject: [PATCH 157/298] chore(cli): add integration-style test for exp task
 logs and send (#20345)

Adds some coderd integration tests for `coder exp tasks (send|logs)`.
The actual agentapi interaction is faked out. I figure we don't want to
actually start a real agentapi instance here.

Authored by Claude with some manual cleanup.
---
 cli/exp_task_logs_test.go | 325 ++++++++++++++++++--------------------
 cli/exp_task_send_test.go | 294 +++++++++++++++++-----------------
 cli/exp_task_test.go      | 202 +++++++++++++++++++++++
 3 files changed, 504 insertions(+), 317 deletions(-)
 create mode 100644 cli/exp_task_test.go

diff --git a/cli/exp_task_logs_test.go b/cli/exp_task_logs_test.go
index 5dc3a995810e2..69905aa434af0 100644
--- a/cli/exp_task_logs_test.go
+++ b/cli/exp_task_logs_test.go
@@ -1,11 +1,8 @@
 package cli_test
 
 import (
-	"context"
 	"encoding/json"
-	"fmt"
 	"net/http"
-	"net/http/httptest"
 	"strings"
 	"testing"
 	"time"
@@ -14,7 +11,10 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	agentapisdk "github.com/coder/agentapi-sdk-go"
+
 	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/testutil"
@@ -23,178 +23,165 @@ import (
 func Test_TaskLogs(t *testing.T) {
 	t.Parallel()
 
-	var (
-		clock = time.Date(2025, 8, 26, 12, 34, 56, 0, time.UTC)
-
-		taskID   = uuid.MustParse("11111111-1111-1111-1111-111111111111")
-		taskName = "task-workspace"
-
-		taskLogs = []codersdk.TaskLogEntry{
-			{
-				ID:      0,
-				Content: "What is 1 + 1?",
-				Type:    codersdk.TaskLogTypeInput,
-				Time:    clock,
-			},
-			{
-				ID:      1,
-				Content: "2",
-				Type:    codersdk.TaskLogTypeOutput,
-				Time:    clock.Add(1 * time.Second),
-			},
-		}
-	)
-
-	tests := []struct {
-		args        []string
-		expectTable string
-		expectLogs  []codersdk.TaskLogEntry
-		expectError string
-		handler     func(t *testing.T, ctx context.Context) http.HandlerFunc
-	}{
-		{
-			args:       []string{taskName, "--output", "json"},
-			expectLogs: taskLogs,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/v2/users/me/workspace/%s", taskName):
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: taskID,
-						})
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/logs", taskID.String()):
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.TaskLogsResponse{
-							Logs: taskLogs,
-						})
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args:       []string{taskID.String(), "--output", "json"},
-			expectLogs: taskLogs,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/logs", taskID.String()):
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.TaskLogsResponse{
-							Logs: taskLogs,
-						})
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args: []string{taskID.String()},
-			expectTable: `
-TYPE    CONTENT
-input   What is 1 + 1?
-output  2`,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/logs", taskID.String()):
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.TaskLogsResponse{
-							Logs: taskLogs,
-						})
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
+	testMessages := []agentapisdk.Message{
 		{
-			args:        []string{"doesnotexist"},
-			expectError: httpapi.ResourceNotFoundResponse.Message,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/doesnotexist":
-						httpapi.ResourceNotFound(w)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
+			Id:      0,
+			Role:    agentapisdk.RoleUser,
+			Content: "What is 1 + 1?",
+			Time:    time.Now().Add(-2 * time.Minute),
 		},
 		{
-			args:        []string{uuid.Nil.String()}, // uuid does not exist
-			expectError: httpapi.ResourceNotFoundResponse.Message,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/logs", uuid.Nil.String()):
-						httpapi.ResourceNotFound(w)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
+			Id:      1,
+			Role:    agentapisdk.RoleAgent,
+			Content: "2",
+			Time:    time.Now().Add(-1 * time.Minute),
 		},
-		{
-			args:        []string{"err-fetching-logs"},
-			expectError: assert.AnError.Error(),
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/err-fetching-logs":
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: taskID,
-						})
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/logs", taskID.String()):
-						httpapi.InternalServerError(w, assert.AnError)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
+	}
+
+	t.Run("ByWorkspaceName_JSON", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
+		userClient := client // user already has access to their own workspace
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "logs", workspace.Name, "--output", "json")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+
+		var logs []codersdk.TaskLogEntry
+		err = json.NewDecoder(strings.NewReader(stdout.String())).Decode(&logs)
+		require.NoError(t, err)
+
+		require.Len(t, logs, 2)
+		require.Equal(t, "What is 1 + 1?", logs[0].Content)
+		require.Equal(t, codersdk.TaskLogTypeInput, logs[0].Type)
+		require.Equal(t, "2", logs[1].Content)
+		require.Equal(t, codersdk.TaskLogTypeOutput, logs[1].Type)
+	})
+
+	t.Run("ByWorkspaceID_JSON", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
+		userClient := client
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "logs", workspace.ID.String(), "--output", "json")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+
+		var logs []codersdk.TaskLogEntry
+		err = json.NewDecoder(strings.NewReader(stdout.String())).Decode(&logs)
+		require.NoError(t, err)
+
+		require.Len(t, logs, 2)
+		require.Equal(t, "What is 1 + 1?", logs[0].Content)
+		require.Equal(t, codersdk.TaskLogTypeInput, logs[0].Type)
+		require.Equal(t, "2", logs[1].Content)
+		require.Equal(t, codersdk.TaskLogTypeOutput, logs[1].Type)
+	})
+
+	t.Run("ByWorkspaceID_Table", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
+		userClient := client
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "logs", workspace.ID.String())
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+
+		output := stdout.String()
+		require.Contains(t, output, "What is 1 + 1?")
+		require.Contains(t, output, "2")
+		require.Contains(t, output, "input")
+		require.Contains(t, output, "output")
+	})
+
+	t.Run("WorkspaceNotFound_ByName", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "logs", "doesnotexist")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.Error(t, err)
+		require.ErrorContains(t, err, httpapi.ResourceNotFoundResponse.Message)
+	})
+
+	t.Run("WorkspaceNotFound_ByID", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "logs", uuid.Nil.String())
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.Error(t, err)
+		require.ErrorContains(t, err, httpapi.ResourceNotFoundResponse.Message)
+	})
+
+	t.Run("ErrorFetchingLogs", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsErr(assert.AnError))
+		userClient := client
+
+		inv, root := clitest.New(t, "exp", "task", "logs", workspace.ID.String())
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.ErrorContains(t, err, assert.AnError.Error())
+	})
+}
+
+func fakeAgentAPITaskLogsOK(messages []agentapisdk.Message) map[string]http.HandlerFunc {
+	return map[string]http.HandlerFunc{
+		"/messages": func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"messages": messages,
+			})
 		},
 	}
+}
 
-	for _, tt := range tests {
-		t.Run(strings.Join(tt.args, ","), func(t *testing.T) {
-			t.Parallel()
-
-			var (
-				ctx    = testutil.Context(t, testutil.WaitShort)
-				srv    = httptest.NewServer(tt.handler(t, ctx))
-				client = codersdk.New(testutil.MustURL(t, srv.URL))
-				args   = []string{"exp", "task", "logs"}
-				stdout strings.Builder
-				err    error
-			)
-
-			t.Cleanup(srv.Close)
-
-			inv, root := clitest.New(t, append(args, tt.args...)...)
-			inv.Stdout = &stdout
-			inv.Stderr = &stdout
-			clitest.SetupConfig(t, client, root)
-
-			err = inv.WithContext(ctx).Run()
-			if tt.expectError == "" {
-				assert.NoError(t, err)
-			} else {
-				assert.ErrorContains(t, err, tt.expectError)
-			}
-
-			if tt.expectTable != "" {
-				if diff := tableDiff(tt.expectTable, stdout.String()); diff != "" {
-					t.Errorf("unexpected output diff (-want +got):\n%s", diff)
-				}
-			}
-
-			if tt.expectLogs != nil {
-				var logs []codersdk.TaskLogEntry
-				err = json.NewDecoder(strings.NewReader(stdout.String())).Decode(&logs)
-				require.NoError(t, err)
-
-				assert.Equal(t, tt.expectLogs, logs)
-			}
-		})
+func fakeAgentAPITaskLogsErr(err error) map[string]http.HandlerFunc {
+	return map[string]http.HandlerFunc{
+		"/messages": func(w http.ResponseWriter, r *http.Request) {
+			w.WriteHeader(http.StatusInternalServerError)
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]interface{}{
+				"error": err.Error(),
+			})
+		},
 	}
 }
diff --git a/cli/exp_task_send_test.go b/cli/exp_task_send_test.go
index 1d7b863f5f91e..cb8ee74d06398 100644
--- a/cli/exp_task_send_test.go
+++ b/cli/exp_task_send_test.go
@@ -1,173 +1,171 @@
 package cli_test
 
 import (
-	"context"
-	"fmt"
+	"encoding/json"
 	"net/http"
-	"net/http/httptest"
 	"strings"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	agentapisdk "github.com/coder/agentapi-sdk-go"
 
 	"github.com/coder/coder/v2/cli/clitest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/httpapi"
-	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/testutil"
 )
 
 func Test_TaskSend(t *testing.T) {
 	t.Parallel()
 
-	var (
-		taskName = "task-workspace"
-		taskID   = uuid.MustParse("11111111-1111-1111-1111-111111111111")
-	)
-
-	tests := []struct {
-		args        []string
-		stdin       string
-		expectError string
-		handler     func(t *testing.T, ctx context.Context) http.HandlerFunc
-	}{
-		{
-			args: []string{taskName, "carry on with the task"},
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/v2/users/me/workspace/%s", taskName):
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: taskID,
-						})
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/send", taskID.String()):
-						var req codersdk.TaskSendRequest
-						if !httpapi.Read(ctx, w, r, &req) {
-							return
-						}
-
-						assert.Equal(t, "carry on with the task", req.Input)
-
-						httpapi.Write(ctx, w, http.StatusNoContent, nil)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args: []string{taskID.String(), "carry on with the task"},
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/send", taskID.String()):
-						var req codersdk.TaskSendRequest
-						if !httpapi.Read(ctx, w, r, &req) {
-							return
-						}
-
-						assert.Equal(t, "carry on with the task", req.Input)
-
-						httpapi.Write(ctx, w, http.StatusNoContent, nil)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args:  []string{taskName, "--stdin"},
-			stdin: "carry on with the task",
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/v2/users/me/workspace/%s", taskName):
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: taskID,
-						})
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/send", taskID.String()):
-						var req codersdk.TaskSendRequest
-						if !httpapi.Read(ctx, w, r, &req) {
-							return
-						}
-
-						assert.Equal(t, "carry on with the task", req.Input)
-
-						httpapi.Write(ctx, w, http.StatusNoContent, nil)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args:        []string{"doesnotexist", "some task input"},
-			expectError: httpapi.ResourceNotFoundResponse.Message,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/doesnotexist":
-						httpapi.ResourceNotFound(w)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args:        []string{uuid.Nil.String(), "some task input"},
-			expectError: httpapi.ResourceNotFoundResponse.Message,
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/send", uuid.Nil.String()):
-						httpapi.ResourceNotFound(w)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
+	t.Run("ByWorkspaceName_WithArgument", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
+		userClient := client
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "send", workspace.Name, "carry on with the task")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+	})
+
+	t.Run("ByWorkspaceID_WithArgument", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
+		userClient := client
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "send", workspace.ID.String(), "carry on with the task")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+	})
+
+	t.Run("ByWorkspaceName_WithStdin", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
+		userClient := client
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "send", workspace.Name, "--stdin")
+		inv.Stdout = &stdout
+		inv.Stdin = strings.NewReader("carry on with the task")
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+	})
+
+	t.Run("WorkspaceNotFound_ByName", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "send", "doesnotexist", "some task input")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.Error(t, err)
+		require.ErrorContains(t, err, httpapi.ResourceNotFoundResponse.Message)
+	})
+
+	t.Run("WorkspaceNotFound_ByID", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "send", uuid.Nil.String(), "some task input")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.Error(t, err)
+		require.ErrorContains(t, err, httpapi.ResourceNotFoundResponse.Message)
+	})
+
+	t.Run("SendError", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		userClient, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendErr(t, assert.AnError))
+
+		var stdout strings.Builder
+		inv, root := clitest.New(t, "exp", "task", "send", workspace.Name, "some task input")
+		inv.Stdout = &stdout
+		clitest.SetupConfig(t, userClient, root)
+
+		err := inv.WithContext(ctx).Run()
+		require.ErrorContains(t, err, assert.AnError.Error())
+	})
+}
+
+func fakeAgentAPITaskSendOK(t *testing.T, expectMessage, returnMessage string) map[string]http.HandlerFunc {
+	return map[string]http.HandlerFunc{
+		"/status": func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				"status": "stable",
+			})
 		},
-		{
-			args:        []string{uuid.Nil.String(), "some task input"},
-			expectError: assert.AnError.Error(),
-			handler: func(t *testing.T, ctx context.Context) http.HandlerFunc {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case fmt.Sprintf("/api/experimental/tasks/me/%s/send", uuid.Nil.String()):
-						httpapi.InternalServerError(w, assert.AnError)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
+		"/message": func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			var msg agentapisdk.PostMessageParams
+			if err := json.NewDecoder(r.Body).Decode(&msg); err != nil {
+				http.Error(w, err.Error(), http.StatusBadRequest)
+				return
+			}
+			assert.Equal(t, expectMessage, msg.Content)
+			message := agentapisdk.Message{
+				Id:      999,
+				Role:    agentapisdk.RoleAgent,
+				Content: returnMessage,
+				Time:    time.Now(),
+			}
+			_ = json.NewEncoder(w).Encode(message)
 		},
 	}
+}
 
-	for _, tt := range tests {
-		t.Run(strings.Join(tt.args, ","), func(t *testing.T) {
-			t.Parallel()
-
-			var (
-				ctx    = testutil.Context(t, testutil.WaitShort)
-				srv    = httptest.NewServer(tt.handler(t, ctx))
-				client = codersdk.New(testutil.MustURL(t, srv.URL))
-				args   = []string{"exp", "task", "send"}
-				err    error
-			)
-
-			t.Cleanup(srv.Close)
-
-			inv, root := clitest.New(t, append(args, tt.args...)...)
-			inv.Stdin = strings.NewReader(tt.stdin)
-			clitest.SetupConfig(t, client, root)
-
-			err = inv.WithContext(ctx).Run()
-			if tt.expectError == "" {
-				assert.NoError(t, err)
-			} else {
-				assert.ErrorContains(t, err, tt.expectError)
+func fakeAgentAPITaskSendErr(t *testing.T, returnErr error) map[string]http.HandlerFunc {
+	return map[string]http.HandlerFunc{
+		"/status": func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(map[string]string{
+				"status": "stable",
+			})
+		},
+		"/message": func(w http.ResponseWriter, r *http.Request) {
+			if r.Method != http.MethodPost {
+				http.Error(w, "Method not allowed", http.StatusMethodNotAllowed)
+				return
 			}
-		})
+			w.WriteHeader(http.StatusInternalServerError)
+			_, _ = w.Write([]byte(returnErr.Error()))
+		},
 	}
 }
diff --git a/cli/exp_task_test.go b/cli/exp_task_test.go
new file mode 100644
index 0000000000000..4cf99e1dd45ad
--- /dev/null
+++ b/cli/exp_task_test.go
@@ -0,0 +1,202 @@
+package cli_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"sync"
+	"testing"
+
+	"github.com/google/uuid"
+
+	"github.com/coder/coder/v2/agent"
+	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/codersdk/agentsdk"
+	"github.com/coder/coder/v2/provisioner/echo"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+)
+
+// setupCLITaskTest creates a test workspace with an AI task template and agent,
+// with a fake agent API configured with the provided set of handlers.
+// Returns the user client and workspace.
+func setupCLITaskTest(ctx context.Context, t *testing.T, agentAPIHandlers map[string]http.HandlerFunc) (*codersdk.Client, codersdk.Workspace) {
+	t.Helper()
+
+	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+	owner := coderdtest.CreateFirstUser(t, client)
+	userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+	fakeAPI := startFakeAgentAPI(t, agentAPIHandlers)
+
+	authToken := uuid.NewString()
+	template := createAITaskTemplate(t, client, owner.OrganizationID, withSidebarURL(fakeAPI.URL()), withAgentToken(authToken))
+
+	wantPrompt := "test prompt"
+	workspace := coderdtest.CreateWorkspace(t, userClient, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
+		req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
+			{Name: codersdk.AITaskPromptParameterName, Value: wantPrompt},
+		}
+	})
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(authToken))
+	_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
+		o.Client = agentClient
+	})
+
+	coderdtest.NewWorkspaceAgentWaiter(t, client, workspace.ID).
+		WaitFor(coderdtest.AgentsReady)
+
+	return userClient, workspace
+}
+
+// createAITaskTemplate creates a template configured for AI tasks with a sidebar app.
+func createAITaskTemplate(t *testing.T, client *codersdk.Client, orgID uuid.UUID, opts ...aiTemplateOpt) codersdk.Template {
+	t.Helper()
+
+	opt := aiTemplateOpts{
+		authToken: uuid.NewString(),
+	}
+	for _, o := range opts {
+		o(&opt)
+	}
+
+	taskAppID := uuid.New()
+	version := coderdtest.CreateTemplateVersion(t, client, orgID, &echo.Responses{
+		Parse: echo.ParseComplete,
+		ProvisionPlan: []*proto.Response{
+			{
+				Type: &proto.Response_Plan{
+					Plan: &proto.PlanComplete{
+						Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
+						HasAiTasks: true,
+					},
+				},
+			},
+		},
+		ProvisionApply: []*proto.Response{
+			{
+				Type: &proto.Response_Apply{
+					Apply: &proto.ApplyComplete{
+						Resources: []*proto.Resource{
+							{
+								Name: "example",
+								Type: "aws_instance",
+								Agents: []*proto.Agent{
+									{
+										Id:   uuid.NewString(),
+										Name: "example",
+										Auth: &proto.Agent_Token{
+											Token: opt.authToken,
+										},
+										Apps: []*proto.App{
+											{
+												Id:          taskAppID.String(),
+												Slug:        "task-sidebar",
+												DisplayName: "Task Sidebar",
+												Url:         opt.appURL,
+											},
+										},
+									},
+								},
+							},
+						},
+						AiTasks: []*proto.AITask{
+							{
+								SidebarApp: &proto.AITaskSidebarApp{
+									Id: taskAppID.String(),
+								},
+							},
+						},
+					},
+				},
+			},
+		},
+	})
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	template := coderdtest.CreateTemplate(t, client, orgID, version.ID)
+
+	return template
+}
+
+// fakeAgentAPI implements a fake AgentAPI HTTP server for testing.
+type fakeAgentAPI struct {
+	t        *testing.T
+	server   *httptest.Server
+	handlers map[string]http.HandlerFunc
+	called   map[string]bool
+	mu       sync.Mutex
+}
+
+// startFakeAgentAPI starts an HTTP server that implements the AgentAPI endpoints.
+// handlers is a map of path -> handler function.
+func startFakeAgentAPI(t *testing.T, handlers map[string]http.HandlerFunc) *fakeAgentAPI {
+	t.Helper()
+
+	fake := &fakeAgentAPI{
+		t:        t,
+		handlers: handlers,
+		called:   make(map[string]bool),
+	}
+
+	mux := http.NewServeMux()
+
+	// Register all provided handlers with call tracking
+	for path, handler := range handlers {
+		mux.HandleFunc(path, func(w http.ResponseWriter, r *http.Request) {
+			fake.mu.Lock()
+			fake.called[path] = true
+			fake.mu.Unlock()
+			handler(w, r)
+		})
+	}
+
+	knownEndpoints := []string{"/status", "/messages", "/message"}
+	for _, endpoint := range knownEndpoints {
+		if handlers[endpoint] == nil {
+			endpoint := endpoint // capture loop variable
+			mux.HandleFunc(endpoint, func(w http.ResponseWriter, r *http.Request) {
+				t.Fatalf("unexpected call to %s %s - no handler defined", r.Method, endpoint)
+			})
+		}
+	}
+	// Default handler for unknown endpoints should cause the test to fail.
+	mux.HandleFunc("/", func(w http.ResponseWriter, r *http.Request) {
+		t.Fatalf("unexpected call to %s %s - no handler defined", r.Method, r.URL.Path)
+	})
+
+	fake.server = httptest.NewServer(mux)
+
+	// Register cleanup to check that all defined handlers were called
+	t.Cleanup(func() {
+		fake.server.Close()
+		fake.mu.Lock()
+		for path := range handlers {
+			if !fake.called[path] {
+				t.Errorf("handler for %s was defined but never called", path)
+			}
+		}
+	})
+	return fake
+}
+
+func (f *fakeAgentAPI) URL() string {
+	return f.server.URL
+}
+
+type aiTemplateOpts struct {
+	appURL    string
+	authToken string
+}
+
+type aiTemplateOpt func(*aiTemplateOpts)
+
+func withSidebarURL(url string) aiTemplateOpt {
+	return func(o *aiTemplateOpts) { o.appURL = url }
+}
+
+func withAgentToken(token string) aiTemplateOpt {
+	return func(o *aiTemplateOpts) { o.authToken = token }
+}

From 1a104751e4414649ccbee269cc34ad341954c4a1 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 17 Oct 2025 13:45:11 +0100
Subject: [PATCH 158/298] chore(coderd): use WorkspaceAgentWaiter.WithContext
 in aitasks_test.go (#20360)

Fixes https://github.com/coder/internal/issues/1067

- Adds `WorkspaceAgentWaiter.WithContext()`
- Updates usage of `WorkspaceAgentWaiter` in `aitasks_test.go` with
context bumped to `testutil.WaitMedium`

Authored by Claude with manual review and updates.
---
 coderd/aitasks_test.go          |  6 +++---
 coderd/coderdtest/coderdtest.go | 34 ++++++++++++++++++++++++---------
 2 files changed, 28 insertions(+), 12 deletions(-)

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 646e8ab33fd51..28d444014bdd5 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -519,9 +519,9 @@ func TestTasks(t *testing.T) {
 			_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
 				o.Client = agentClient
 			})
-			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WaitFor(coderdtest.AgentsReady)
 
 			ctx := testutil.Context(t, testutil.WaitMedium)
+			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
 
 			// Lookup the sidebar app ID.
 			w, err := client.Workspace(ctx, ws.ID)
@@ -712,7 +712,7 @@ func TestTasks(t *testing.T) {
 			_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
 				o.Client = agentClient
 			})
-			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WaitFor(coderdtest.AgentsReady)
+			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
 
 			// Omit sidebar app health as undefined is OK.
 
@@ -762,7 +762,7 @@ func TestTasks(t *testing.T) {
 			_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
 				o.Client = agentClient
 			})
-			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WaitFor(coderdtest.AgentsReady)
+			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
 
 			exp := codersdk.NewExperimentalClient(client)
 			_, err := exp.TaskLogs(ctx, "me", ws.ID)
diff --git a/coderd/coderdtest/coderdtest.go b/coderd/coderdtest/coderdtest.go
index ab1c641c0c27d..463ee888f6f22 100644
--- a/coderd/coderdtest/coderdtest.go
+++ b/coderd/coderdtest/coderdtest.go
@@ -1128,6 +1128,7 @@ type WorkspaceAgentWaiter struct {
 	workspaceID      uuid.UUID
 	agentNames       []string
 	resourcesMatcher func([]codersdk.WorkspaceResource) bool
+	ctx              context.Context
 }
 
 // NewWorkspaceAgentWaiter returns an object that waits for agents to connect when
@@ -1156,6 +1157,14 @@ func (w WorkspaceAgentWaiter) MatchResources(m func([]codersdk.WorkspaceResource
 	return w
 }
 
+// WithContext instructs the waiter to use the provided context for all operations.
+// If not specified, the waiter will create its own context with testutil.WaitLong timeout.
+func (w WorkspaceAgentWaiter) WithContext(ctx context.Context) WorkspaceAgentWaiter {
+	//nolint: revive // returns modified struct
+	w.ctx = ctx
+	return w
+}
+
 // WaitForAgentFn represents a boolean assertion to be made against each agent
 // that a given WorkspaceAgentWaited knows about. Each WaitForAgentFn should apply
 // the check to a single agent, but it should be named for plural, because `func (w WorkspaceAgentWaiter) WaitFor`
@@ -1176,6 +1185,8 @@ func AgentsNotReady(agent codersdk.WorkspaceAgent) bool {
 	return !AgentsReady(agent)
 }
 
+// WaitFor waits for the given criteria and fails the test if they are not met before the
+// waiter's context is canceled.
 func (w WorkspaceAgentWaiter) WaitFor(criteria ...WaitForAgentFn) {
 	w.t.Helper()
 
@@ -1184,11 +1195,13 @@ func (w WorkspaceAgentWaiter) WaitFor(criteria ...WaitForAgentFn) {
 		agentNamesMap[name] = struct{}{}
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-	defer cancel()
+	ctx := w.ctx
+	if w.ctx == nil {
+		ctx = testutil.Context(w.t, testutil.WaitLong)
+	}
 
 	w.t.Logf("waiting for workspace agents (workspace %s)", w.workspaceID)
-	require.Eventually(w.t, func() bool {
+	testutil.Eventually(ctx, w.t, func(ctx context.Context) bool {
 		var err error
 		workspace, err := w.client.Workspace(ctx, w.workspaceID)
 		if err != nil {
@@ -1216,10 +1229,11 @@ func (w WorkspaceAgentWaiter) WaitFor(criteria ...WaitForAgentFn) {
 			}
 		}
 		return true
-	}, testutil.WaitLong, testutil.IntervalMedium)
+	}, testutil.IntervalMedium)
 }
 
-// Wait waits for the agent(s) to connect and fails the test if they do not within testutil.WaitLong
+// Wait waits for the agent(s) to connect and fails the test if they do not connect before the
+// waiter's context is canceled.
 func (w WorkspaceAgentWaiter) Wait() []codersdk.WorkspaceResource {
 	w.t.Helper()
 
@@ -1228,12 +1242,14 @@ func (w WorkspaceAgentWaiter) Wait() []codersdk.WorkspaceResource {
 		agentNamesMap[name] = struct{}{}
 	}
 
-	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
-	defer cancel()
+	ctx := w.ctx
+	if w.ctx == nil {
+		ctx = testutil.Context(w.t, testutil.WaitLong)
+	}
 
 	w.t.Logf("waiting for workspace agents (workspace %s)", w.workspaceID)
 	var resources []codersdk.WorkspaceResource
-	require.Eventually(w.t, func() bool {
+	testutil.Eventually(ctx, w.t, func(ctx context.Context) bool {
 		var err error
 		workspace, err := w.client.Workspace(ctx, w.workspaceID)
 		if err != nil {
@@ -1265,7 +1281,7 @@ func (w WorkspaceAgentWaiter) Wait() []codersdk.WorkspaceResource {
 			return true
 		}
 		return w.resourcesMatcher(resources)
-	}, testutil.WaitLong, testutil.IntervalMedium)
+	}, testutil.IntervalMedium)
 	w.t.Logf("got workspace agents (workspace %s)", w.workspaceID)
 	return resources
 }

From 16a863eab6630ccc17ba07574216628b9d843dea Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Fri, 17 Oct 2025 09:52:49 -0300
Subject: [PATCH 159/298] chore: make chart styles consistent (#20343)

---
 .../LicensesSettingsPage/LicenseSeatConsumptionChart.tsx      | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseSeatConsumptionChart.tsx b/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseSeatConsumptionChart.tsx
index 3f91f58b8d678..537de99d702a6 100644
--- a/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseSeatConsumptionChart.tsx
+++ b/site/src/pages/DeploymentSettingsPage/LicensesSettingsPage/LicenseSeatConsumptionChart.tsx
@@ -28,7 +28,7 @@ import { docs } from "utils/docs";
 const chartConfig = {
 	users: {
 		label: "Users",
-		color: "hsl(var(--highlight-green))",
+		color: "hsl(var(--highlight-purple))",
 	},
 } satisfies ChartConfig;
 
@@ -207,7 +207,7 @@ export const LicenseSeatConsumptionChart: FC<
 
 									<Area
 										dataKey="users"
-										type="natural"
+										type="linear"
 										fill="url(#fillUsers)"
 										fillOpacity={0.4}
 										stroke="var(--color-users)"

From 09a41f3d1f464b995023eb387f4ab57276f1618f Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Fri, 17 Oct 2025 09:56:07 -0300
Subject: [PATCH 160/298] fix: clear prompt after task creation (#20344)

Fix https://github.com/coder/coder/issues/20255
---
 site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx | 5 +++++
 site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx         | 1 +
 2 files changed, 6 insertions(+)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index 453017dfa869f..3c7025fa7682d 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -145,6 +145,11 @@ export const OnSuccess: Story = {
 			const successMessage = await body.findByText(/task created/i);
 			expect(successMessage).toBeInTheDocument();
 		});
+
+		await step("Clears prompt", async () => {
+			const prompt = await canvas.findByLabelText(/prompt/i);
+			expect(prompt).toHaveValue("");
+		});
 	},
 };
 
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index a3ed3b427bb05..1d074010f03c9 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -232,6 +232,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 			await createTaskMutation.mutateAsync({
 				prompt,
 			});
+			setPrompt("");
 		} catch (error) {
 			const message = getErrorMessage(error, "Error creating task");
 			const detail = getErrorDetail(error) ?? "Please try again";

From a833b7af9d608e444a5dc9bd4899ee1d87ca3759 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Fri, 17 Oct 2025 09:57:02 -0300
Subject: [PATCH 161/298] fix: use AvatarData in OAuth2AppsSettings (#20342)

**Before:**
<img width="1624" height="967" alt="Screenshot 2025-10-16 at 10 16 19"
src="https://github.com/user-attachments/assets/7b3ebf4f-4096-41b6-b8f2-f1aa94a7ac87"
/>

**After:**
<img width="1624" height="967" alt="Screenshot 2025-10-16 at 10 16 26"
src="https://github.com/user-attachments/assets/a8d25ed4-1e40-4191-8d29-396121836443"
/>
---
 .../OAuth2AppsSettingsPageView.tsx                       | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
index da72549e420e4..3c40874ef453f 100644
--- a/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
+++ b/site/src/pages/DeploymentSettingsPage/OAuth2AppsSettingsPage/OAuth2AppsSettingsPageView.tsx
@@ -2,6 +2,7 @@ import { useTheme } from "@emotion/react";
 import type * as TypesGen from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { Avatar } from "components/Avatar/Avatar";
+import { AvatarData } from "components/Avatar/AvatarData";
 import { Button } from "components/Button/Button";
 import {
 	SettingsHeader,
@@ -101,10 +102,10 @@ const OAuth2AppRow: FC<OAuth2AppRowProps> = ({ app }) => {
 	return (
 		<TableRow key={app.id} data-testid={`app-${app.id}`} {...clickableProps}>
 			<TableCell>
-				<Stack direction="row" spacing={1}>
-					<Avatar variant="icon" src={app.icon} fallback={app.name} />
-					<span className="font-semibold">{app.name}</span>
-				</Stack>
+				<AvatarData
+					avatar={<Avatar variant="icon" src={app.icon} fallback={app.name} />}
+					title={app.name}
+				/>
 			</TableCell>
 
 			<TableCell>

From 838fbc18dc58ae69f9e73b3d6f62760fd7188cf5 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Fri, 17 Oct 2025 09:59:22 -0300
Subject: [PATCH 162/298] fix: improve options table reading (#20341)

From @chrifro

- text-sm regular for the body text (24px line height)
- text-sm bold and white font for the headline

**Before:**

<img width="1624" height="967" alt="Screenshot 2025-10-16 at 10 08 19"
src="https://github.com/user-attachments/assets/b0ef6aef-57b6-43d0-921b-8028c58866f0"
/>


**After:**

<img width="1624" height="967" alt="Screenshot 2025-10-16 at 10 10 27"
src="https://github.com/user-attachments/assets/f39526f3-f0cc-4678-83b3-84bf4161b5be"
/>
---
 .../pages/DeploymentSettingsPage/Option.tsx   | 19 ++++----------
 .../DeploymentSettingsPage/OptionsTable.tsx   | 25 ++-----------------
 2 files changed, 7 insertions(+), 37 deletions(-)

diff --git a/site/src/pages/DeploymentSettingsPage/Option.tsx b/site/src/pages/DeploymentSettingsPage/Option.tsx
index 3dd61750d1251..ae13db003c41e 100644
--- a/site/src/pages/DeploymentSettingsPage/Option.tsx
+++ b/site/src/pages/DeploymentSettingsPage/Option.tsx
@@ -5,26 +5,17 @@ import type { FC, HTMLAttributes, PropsWithChildren } from "react";
 import { MONOSPACE_FONT_FAMILY } from "theme/constants";
 
 export const OptionName: FC<PropsWithChildren> = ({ children }) => {
-	return <span css={{ display: "block" }}>{children}</span>;
-};
-
-export const OptionDescription: FC<PropsWithChildren> = ({ children }) => {
-	const theme = useTheme();
-
 	return (
-		<span
-			css={{
-				display: "block",
-				color: theme.palette.text.secondary,
-				fontSize: 14,
-				marginTop: 4,
-			}}
-		>
+		<span className="block text-sm font-medium text-content-primary">
 			{children}
 		</span>
 	);
 };
 
+export const OptionDescription: FC<PropsWithChildren> = ({ children }) => {
+	return <span className="text-sm font-normal">{children}</span>;
+};
+
 interface OptionValueProps {
 	children?: boolean | number | string | string[] | Record<string, boolean>;
 }
diff --git a/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx b/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx
index 11b5182e566cc..ddc426612490e 100644
--- a/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx
+++ b/site/src/pages/DeploymentSettingsPage/OptionsTable.tsx
@@ -1,4 +1,3 @@
-import { css } from "@emotion/react";
 import type { SerpentOption } from "api/typesGenerated";
 import {
 	Table,
@@ -29,20 +28,7 @@ const OptionsTable: FC<OptionsTableProps> = ({ options, additionalValues }) => {
 	}
 
 	return (
-		<Table
-			className="options-table"
-			css={css`
-          & td {
-            padding-top: 24px;
-            padding-bottom: 24px;
-          }
-
-          & td:last-child,
-          & th:last-child {
-            padding-left: 32px;
-          }
-        `}
-		>
+		<Table className="options-table">
 			<TableHeader>
 				<TableRow>
 					<TableHead className="w-1/2">Option</TableHead>
@@ -56,14 +42,7 @@ const OptionsTable: FC<OptionsTableProps> = ({ options, additionalValues }) => {
 							<TableCell>
 								<OptionName>{option.name}</OptionName>
 								<OptionDescription>{option.description}</OptionDescription>
-								<div
-									css={{
-										marginTop: 24,
-										display: "flex",
-										flexWrap: "wrap",
-										gap: 8,
-									}}
-								>
+								<div className="pt-2 flex flex-wrap gap-2">
 									{option.flag && (
 										<OptionConfig isSource={option.value_source === "flag"}>
 											<OptionConfigFlag>CLI</OptionConfigFlag>

From a6461ab7ff99725c287748d4e62b48b6f9518268 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Fri, 17 Oct 2025 09:59:58 -0300
Subject: [PATCH 163/298] feat: improve template version select ux (#20347)

**Improvements:**
- Sort by creation date DESC
- Show which version is active
- Add tooltip

**Demo:**


https://github.com/user-attachments/assets/1030c8a6-870f-42f0-be97-87c9f3392d3f

Close https://github.com/coder/internal/issues/1057
---
 site/src/components/Select/Select.tsx         |  8 +-
 .../PromptSelectTrigger.stories.tsx           | 36 +++++++++
 .../tasks/TaskPrompt/PromptSelectTrigger.tsx  | 41 ++++++++++
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   | 60 +++-----------
 .../TemplateVersionSelect.stories.tsx         | 80 +++++++++++++++++++
 .../TaskPrompt/TemplateVersionSelect.tsx      | 65 +++++++++++++++
 6 files changed, 238 insertions(+), 52 deletions(-)
 create mode 100644 site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.stories.tsx
 create mode 100644 site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.tsx
 create mode 100644 site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.stories.tsx
 create mode 100644 site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.tsx

diff --git a/site/src/components/Select/Select.tsx b/site/src/components/Select/Select.tsx
index 3d2f8ffc3b706..f9261629e93c7 100644
--- a/site/src/components/Select/Select.tsx
+++ b/site/src/components/Select/Select.tsx
@@ -13,11 +13,13 @@ export const SelectGroup = SelectPrimitive.Group;
 
 export const SelectValue = SelectPrimitive.Value;
 
+export type SelectTriggerProps = React.ComponentPropsWithoutRef<
+	typeof SelectPrimitive.Trigger
+>;
+
 export const SelectTrigger = React.forwardRef<
 	React.ElementRef<typeof SelectPrimitive.Trigger>,
-	React.ComponentPropsWithoutRef<typeof SelectPrimitive.Trigger> & {
-		id?: string;
-	}
+	SelectTriggerProps
 >(({ className, children, id, ...props }, ref) => (
 	<SelectPrimitive.Trigger
 		ref={ref}
diff --git a/site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.stories.tsx b/site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.stories.tsx
new file mode 100644
index 0000000000000..b86903d50c24c
--- /dev/null
+++ b/site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.stories.tsx
@@ -0,0 +1,36 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { Select, SelectContent, SelectItem } from "components/Select/Select";
+import { userEvent, within } from "storybook/test";
+import { PromptSelectTrigger } from "./PromptSelectTrigger";
+
+const meta: Meta<typeof PromptSelectTrigger> = {
+	title: "modules/tasks/TaskPrompt/PromptSelectTrigger",
+	component: PromptSelectTrigger,
+	args: {
+		children: "Select a version",
+		tooltip: "Template version",
+	},
+	render: (args) => (
+		<Select>
+			<PromptSelectTrigger {...args} />
+			<SelectContent>
+				<SelectItem value="version-1">Version 1</SelectItem>
+				<SelectItem value="version-2">Version 2</SelectItem>
+				<SelectItem value="version-3">Version 3</SelectItem>
+			</SelectContent>
+		</Select>
+	),
+};
+
+export default meta;
+type Story = StoryObj<typeof PromptSelectTrigger>;
+
+export const Closed: Story = {};
+
+export const Open: Story = {
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+		const trigger = canvas.getByRole("combobox");
+		await userEvent.click(trigger);
+	},
+};
diff --git a/site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.tsx b/site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.tsx
new file mode 100644
index 0000000000000..1a2a044a72b77
--- /dev/null
+++ b/site/src/modules/tasks/TaskPrompt/PromptSelectTrigger.tsx
@@ -0,0 +1,41 @@
+import {
+	SelectTrigger,
+	type SelectTriggerProps,
+} from "components/Select/Select";
+import {
+	Tooltip,
+	TooltipContent,
+	TooltipProvider,
+	TooltipTrigger,
+} from "components/Tooltip/Tooltip";
+import type { FC } from "react";
+import { cn } from "utils/cn";
+
+type PromptSelectTriggerProps = SelectTriggerProps & {
+	tooltip: string;
+};
+
+export const PromptSelectTrigger: FC<PromptSelectTriggerProps> = ({
+	className,
+	tooltip,
+	...props
+}) => {
+	return (
+		<TooltipProvider>
+			<Tooltip>
+				<TooltipTrigger asChild>
+					<SelectTrigger
+						{...props}
+						className={cn([
+							className,
+							`w-auto border-0 bg-surface-secondary text-sm text-content-primary gap-2 px-3
+							[&_svg]:text-inherit cursor-pointer hover:bg-surface-quaternary rounded-full
+							h-8 data-[state=open]:bg-surface-tertiary`,
+						])}
+					/>
+				</TooltipTrigger>
+				<TooltipContent>{tooltip}</TooltipContent>
+			</Tooltip>
+		</TooltipProvider>
+	);
+};
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index 1d074010f03c9..706b3480c00da 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -1,10 +1,6 @@
-import type { SelectTriggerProps } from "@radix-ui/react-select";
 import { API } from "api/api";
 import { getErrorDetail, getErrorMessage } from "api/errors";
-import {
-	templateVersionPresets,
-	templateVersions,
-} from "api/queries/templates";
+import { templateVersionPresets } from "api/queries/templates";
 import type {
 	Preset,
 	Task,
@@ -20,7 +16,6 @@ import {
 	Select,
 	SelectContent,
 	SelectItem,
-	SelectTrigger,
 	SelectValue,
 } from "components/Select/Select";
 import { Skeleton } from "components/Skeleton/Skeleton";
@@ -40,8 +35,9 @@ import { useMutation, useQuery, useQueryClient } from "react-query";
 import TextareaAutosize, {
 	type TextareaAutosizeProps,
 } from "react-textarea-autosize";
-import { cn } from "utils/cn";
 import { docs } from "utils/docs";
+import { PromptSelectTrigger } from "./PromptSelectTrigger";
+import { TemplateVersionSelect } from "./TemplateVersionSelect";
 
 type TaskPromptProps = {
 	templates: Template[] | undefined;
@@ -154,10 +150,6 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 	const [selectedVersionId, setSelectedVersionId] = useState(
 		selectedTemplate.active_version_id,
 	);
-	const versionsQuery = useQuery({
-		...templateVersions(selectedTemplate.id),
-		enabled: permissions.updateTemplates,
-	});
 	useEffect(() => {
 		setSelectedVersionId(selectedTemplate.active_version_id);
 	}, [selectedTemplate]);
@@ -280,7 +272,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 								defaultValue={templates[0].id}
 								required
 							>
-								<PromptSelectTrigger id="templateID">
+								<PromptSelectTrigger id="templateID" tooltip="Template">
 									<SelectValue placeholder="Select a template" />
 								</PromptSelectTrigger>
 								<SelectContent>
@@ -297,30 +289,17 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 							</Select>
 						</div>
 
-						{versionsQuery.data && (
+						{permissions.updateTemplates && (
 							<div>
 								<label htmlFor="versionId" className="sr-only">
 									Template version
 								</label>
-								<Select
-									name="versionId"
-									onValueChange={(value) => setSelectedVersionId(value)}
+								<TemplateVersionSelect
+									templateId={selectedTemplateId}
+									activeVersionId={selectedTemplate.active_version_id}
 									value={selectedVersionId}
-									required
-								>
-									<PromptSelectTrigger id="versionId">
-										<SelectValue placeholder="Select a version" />
-									</PromptSelectTrigger>
-									<SelectContent>
-										{versionsQuery.data.map((version) => {
-											return (
-												<SelectItem value={version.id} key={version.id}>
-													{version.name}
-												</SelectItem>
-											);
-										})}
-									</SelectContent>
-								</Select>
+									onValueChange={setSelectedVersionId}
+								/>
 							</div>
 						)}
 
@@ -340,7 +319,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 										value={selectedPresetId}
 										onValueChange={setSelectedPresetId}
 									>
-										<PromptSelectTrigger id="presetID">
+										<PromptSelectTrigger id="presetID" tooltip="Preset">
 											<SelectValue placeholder="Select a preset" />
 										</PromptSelectTrigger>
 										<SelectContent>
@@ -390,23 +369,6 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 	);
 };
 
-const PromptSelectTrigger: FC<SelectTriggerProps> = ({
-	className,
-	...props
-}) => {
-	return (
-		<SelectTrigger
-			{...props}
-			className={cn([
-				className,
-				`border-0 bg-surface-secondary text-sm text-content-primary gap-2 px-3
-				[&_svg]:text-inherit cursor-pointer hover:bg-surface-quaternary rounded-full
-				h-8 data-[state=open]:bg-surface-tertiary`,
-			])}
-		/>
-	);
-};
-
 type ExternalAuthButtonProps = {
 	versionId: string;
 	missedExternalAuth: TemplateVersionExternalAuth[];
diff --git a/site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.stories.tsx b/site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.stories.tsx
new file mode 100644
index 0000000000000..8c37edc301fa7
--- /dev/null
+++ b/site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.stories.tsx
@@ -0,0 +1,80 @@
+import { MockTemplate, MockTemplateVersion } from "testHelpers/entities";
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { API } from "api/api";
+import { useState } from "react";
+import { spyOn, userEvent, within } from "storybook/test";
+import { daysAgo } from "utils/time";
+import { TemplateVersionSelect } from "./TemplateVersionSelect";
+
+const meta: Meta<typeof TemplateVersionSelect> = {
+	title: "modules/tasks/TaskPrompt/TemplateVersionSelect",
+	component: TemplateVersionSelect,
+	args: {
+		activeVersionId: MockTemplateVersion.id,
+		templateId: MockTemplate.id,
+		value: MockTemplateVersion.id,
+	},
+	render: ({ value: defaultValue, ...args }) => {
+		const [value, setValue] = useState(defaultValue);
+		return (
+			<TemplateVersionSelect {...args} value={value} onValueChange={setValue} />
+		);
+	},
+};
+
+export default meta;
+type Story = StoryObj<typeof TemplateVersionSelect>;
+
+const MockVersions = [
+	{
+		...MockTemplateVersion,
+		id: "v1.0.0",
+		name: "v1.0.0",
+		created_at: daysAgo(3),
+	},
+	{
+		...MockTemplateVersion,
+		id: "v2.0.0",
+		name: "v2.0.0",
+		created_at: daysAgo(2),
+	},
+	{
+		...MockTemplateVersion,
+		id: "v3.0.0",
+		name: "v3.0.0",
+		created_at: daysAgo(1),
+	},
+];
+
+export const Loading: Story = {
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersions").mockImplementation(() => {
+			return new Promise(() => {});
+		});
+	},
+};
+
+export const Loaded: Story = {
+	args: {
+		activeVersionId: MockVersions[2].id,
+		value: MockVersions[2].id,
+	},
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersions").mockResolvedValue(MockVersions);
+	},
+};
+
+export const Open: Story = {
+	args: {
+		activeVersionId: MockVersions[2].id,
+		value: MockVersions[2].id,
+	},
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersions").mockResolvedValue(MockVersions);
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+		const trigger = await canvas.findByRole("combobox");
+		await userEvent.click(trigger);
+	},
+};
diff --git a/site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.tsx b/site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.tsx
new file mode 100644
index 0000000000000..8e81a5ba1d835
--- /dev/null
+++ b/site/src/modules/tasks/TaskPrompt/TemplateVersionSelect.tsx
@@ -0,0 +1,65 @@
+import { templateVersions } from "api/queries/templates";
+import { Badge } from "components/Badge/Badge";
+import {
+	Select,
+	SelectContent,
+	SelectItem,
+	SelectValue,
+} from "components/Select/Select";
+import { Skeleton } from "components/Skeleton/Skeleton";
+import type { FC } from "react";
+import { useQuery } from "react-query";
+import { PromptSelectTrigger } from "./PromptSelectTrigger";
+
+type TemplateVersionSelectProps = {
+	value: string;
+	templateId: string;
+	activeVersionId: string;
+	onValueChange: (value: string) => void;
+};
+
+export const TemplateVersionSelect: FC<TemplateVersionSelectProps> = ({
+	templateId,
+	activeVersionId,
+	...props
+}) => {
+	const { data: versions } = useQuery({
+		...templateVersions(templateId),
+		select: (versions) =>
+			versions
+				.filter((v) => !v.archived)
+				.toSorted((a, b) => {
+					return (
+						new Date(b.created_at).getTime() - new Date(a.created_at).getTime()
+					);
+				}),
+	});
+
+	if (!versions) {
+		return <Skeleton className="w-28 h-8 rounded-full" />;
+	}
+
+	return (
+		<Select name="versionId" {...props}>
+			<PromptSelectTrigger id="versionId" tooltip="Template version">
+				<SelectValue placeholder="Select a version" />
+			</PromptSelectTrigger>
+			<SelectContent>
+				{versions.map((version) => {
+					return (
+						<SelectItem value={version.id} key={version.id}>
+							<span className="flex items-center gap-2">
+								{version.name}
+								{activeVersionId === version.id && (
+									<Badge size="xs" variant="green">
+										Active
+									</Badge>
+								)}
+							</span>
+						</SelectItem>
+					);
+				})}
+			</SelectContent>
+		</Select>
+	);
+};

From aec3e9e5abf12b8a4c373a7e3e6a6a30232ab030 Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Fri, 17 Oct 2025 08:40:56 -0500
Subject: [PATCH 164/298] chore: include codersdk comments in typescript output
 (#20348)

Some comments are likely still omitted as guts does not cover all cases
right now. And some cases are omitted because the output format is
ambiguous on how best to format it.
---
 go.mod                         |    2 +-
 go.sum                         |    4 +-
 scripts/apitypings/main.go     |    3 +
 site/src/api/typesGenerated.ts | 1914 +++++++++++++++++++++++++++++++-
 4 files changed, 1896 insertions(+), 27 deletions(-)

diff --git a/go.mod b/go.mod
index 228d3a83ff6fd..7e0338253a7ac 100644
--- a/go.mod
+++ b/go.mod
@@ -96,7 +96,7 @@ require (
 	github.com/chromedp/chromedp v0.14.1
 	github.com/cli/safeexec v1.0.1
 	github.com/coder/flog v1.1.0
-	github.com/coder/guts v1.6.0
+	github.com/coder/guts v1.6.1
 	github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0
 	github.com/coder/quartz v0.2.1
 	github.com/coder/retry v1.5.1
diff --git a/go.sum b/go.sum
index 0f97c2e7186bd..2dbaf7d2e0747 100644
--- a/go.sum
+++ b/go.sum
@@ -928,8 +928,8 @@ github.com/coder/go-httpstat v0.0.0-20230801153223-321c88088322 h1:m0lPZjlQ7vdVp
 github.com/coder/go-httpstat v0.0.0-20230801153223-321c88088322/go.mod h1:rOLFDDVKVFiDqZFXoteXc97YXx7kFi9kYqR+2ETPkLQ=
 github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136 h1:0RgB61LcNs24WOxc3PBvygSNTQurm0PYPujJjLLOzs0=
 github.com/coder/go-scim/pkg/v2 v2.0.0-20230221055123-1d63c1222136/go.mod h1:VkD1P761nykiq75dz+4iFqIQIZka189tx1BQLOp0Skc=
-github.com/coder/guts v1.6.0 h1:N7zotzWubbT49kiH/RENHNQglW68tyMYymMU452q9yg=
-github.com/coder/guts v1.6.0/go.mod h1:FaECwB632JE8nYi7nrKfO0PVjbOl4+hSWupKO2Z99JI=
+github.com/coder/guts v1.6.1 h1:bMVBtDNP/1gW58NFRBdzStAQzXlveMrLAnORpwE9tYo=
+github.com/coder/guts v1.6.1/go.mod h1:FaECwB632JE8nYi7nrKfO0PVjbOl4+hSWupKO2Z99JI=
 github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151 h1:YAxwg3lraGNRwoQ18H7R7n+wsCqNve7Brdvj0F1rDnU=
 github.com/coder/pq v1.10.5-0.20250807075151-6ad9b0a25151/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0 h1:3A0ES21Ke+FxEM8CXx9n47SZOKOpgSE1bbJzlE4qPVs=
diff --git a/scripts/apitypings/main.go b/scripts/apitypings/main.go
index c820bc4e1dec1..65483a34bc9a8 100644
--- a/scripts/apitypings/main.go
+++ b/scripts/apitypings/main.go
@@ -17,6 +17,9 @@ func main() {
 		log.Fatalf("new convert: %v", err)
 	}
 
+	// Include golang comments to typescript output.
+	gen.PreserveComments()
+
 	generateDirectories := map[string]string{
 		"github.com/coder/coder/v2/codersdk":                  "",
 		"github.com/coder/coder/v2/coderd/healthcheck/health": "Health",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index f6679d3d31442..dee5eac22b436 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -1,6 +1,10 @@
 // Code generated by 'guts'. DO NOT EDIT.
 
 // From codersdk/templates.go
+/**
+ * ACLAvailable is a list of users and groups that can be added to a template
+ * ACL.
+ */
 export interface ACLAvailable {
 	readonly users: readonly ReducedUser[];
 	readonly groups: readonly Group[];
@@ -88,20 +92,42 @@ export interface AIConfig {
 }
 
 // From codersdk/aitasks.go
+/**
+ * AITaskPromptParameterName is the name of the parameter used to pass prompts
+ * to AI tasks.
+ *
+ * Experimental: This value is experimental and may change in the future.
+ */
 export const AITaskPromptParameterName = "AI Prompt";
 
 // From codersdk/aitasks.go
+/**
+ * AITasksPromptsResponse represents the response from the AITaskPrompts method.
+ *
+ * Experimental: This method is experimental and may change in the future.
+ */
 export interface AITasksPromptsResponse {
+	/**
+	 * Prompts is a map of workspace build IDs to prompts.
+	 */
 	readonly prompts: Record<string, string>;
 }
 
 // From codersdk/allowlist.go
+/**
+ * APIAllowListTarget represents a single allow-list entry using the canonical
+ * string form "<resource_type>:<id>". The wildcard symbol "*" is treated as a
+ * permissive match for either side.
+ */
 export interface APIAllowListTarget {
 	readonly type: RBACResource;
 	readonly id: string;
 }
 
 // From codersdk/apikey.go
+/**
+ * APIKey: do not ever return the HashedSecret
+ */
 export interface APIKey {
 	readonly id: string;
 	readonly user_id: string;
@@ -110,7 +136,7 @@ export interface APIKey {
 	readonly created_at: string;
 	readonly updated_at: string;
 	readonly login_type: LoginType;
-	readonly scope: APIKeyScope;
+	readonly scope: APIKeyScope; // Deprecated: use Scopes instead.
 	readonly scopes: readonly APIKeyScope[];
 	readonly token_name: string;
 	readonly lifetime_seconds: number;
@@ -516,7 +542,13 @@ export interface APIKeyWithOwner extends APIKey {
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * AccessURLReport shows the results of performing a HTTP_GET to the /healthz endpoint through the configured access URL.
+ */
 export interface AccessURLReport extends BaseReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly access_url: string;
 	readonly reachable: boolean;
@@ -551,9 +583,19 @@ export interface AgentScriptTiming {
 }
 
 // From codersdk/templates.go
+/**
+ * AgentStatsReportResponse is returned for each report
+ * request by the agent.
+ */
 export interface AgentStatsReportResponse {
 	readonly num_comms: number;
+	/**
+	 * RxBytes is the number of received bytes.
+	 */
 	readonly rx_bytes: number;
+	/**
+	 * TxBytes is the number of transmitted bytes.
+	 */
 	readonly tx_bytes: number;
 }
 
@@ -568,6 +610,9 @@ export const AgentSubsystems: AgentSubsystem[] = [
 
 // From codersdk/deployment.go
 export interface AppHostResponse {
+	/**
+	 * Host is the externally accessible URL for the Coder instance.
+	 */
 	readonly host: string;
 }
 
@@ -576,6 +621,9 @@ export interface AppearanceConfig {
 	readonly application_name: string;
 	readonly logo_url: string;
 	readonly docs_url: string;
+	/**
+	 * Deprecated: ServiceBanner has been replaced by AnnouncementBanners.
+	 */
 	readonly service_banner: BannerConfig;
 	readonly announcement_banners: readonly BannerConfig[];
 	readonly support_links?: readonly LinkConfig[];
@@ -583,6 +631,10 @@ export interface AppearanceConfig {
 
 // From codersdk/templates.go
 export interface ArchiveTemplateVersionsRequest {
+	/**
+	 * By default, only failed versions are archived. Set this to true
+	 * to archive all unused versions regardless of job status.
+	 */
 	readonly all: boolean;
 }
 
@@ -595,6 +647,9 @@ export interface ArchiveTemplateVersionsResponse {
 // From codersdk/roles.go
 export interface AssignableRoles extends Role {
 	readonly assignable: boolean;
+	/**
+	 * BuiltIn roles are immutable
+	 */
 	readonly built_in: boolean;
 }
 
@@ -651,6 +706,9 @@ export interface AuditLog {
 	readonly user_agent: string;
 	readonly resource_type: ResourceType;
 	readonly resource_id: string;
+	/**
+	 * ResourceTarget is the name of the resource.
+	 */
 	readonly resource_target: string;
 	readonly resource_icon: string;
 	readonly action: AuditAction;
@@ -660,6 +718,9 @@ export interface AuditLog {
 	readonly description: string;
 	readonly resource_link: string;
 	readonly is_deleted: boolean;
+	/**
+	 * Deprecated: Use 'organization.id' instead.
+	 */
 	readonly organization_id: string;
 	readonly organization?: MinimalOrganization;
 	readonly user: User | null;
@@ -682,6 +743,9 @@ export interface AuthMethod {
 }
 
 // From codersdk/users.go
+/**
+ * AuthMethods contains authentication method information like whether they are enabled or not or custom text, etc.
+ */
 export interface AuthMethods {
 	readonly terms_of_service_url?: string;
 	readonly password: AuthMethod;
@@ -690,22 +754,76 @@ export interface AuthMethods {
 }
 
 // From codersdk/authorization.go
+/**
+ * AuthorizationCheck is used to check if the currently authenticated user (or the specified user) can do a given action to a given set of objects.
+ *
+ * @Description AuthorizationCheck is used to check if the currently authenticated user (or the specified user) can do a given action to a given set of objects.
+ */
 export interface AuthorizationCheck {
+	/**
+	 * Object can represent a "set" of objects, such as: all workspaces in an organization, all workspaces owned by me, and all workspaces across the entire product.
+	 * When defining an object, use the most specific language when possible to
+	 * produce the smallest set. Meaning to set as many fields on 'Object' as
+	 * you can. Example, if you want to check if you can update all workspaces
+	 * owned by 'me', try to also add an 'OrganizationID' to the settings.
+	 * Omitting the 'OrganizationID' could produce the incorrect value, as
+	 * workspaces have both `user` and `organization` owners.
+	 */
 	readonly object: AuthorizationObject;
 	readonly action: RBACAction;
 }
 
 // From codersdk/authorization.go
+/**
+ * AuthorizationObject can represent a "set" of objects, such as: all workspaces in an organization, all workspaces owned by me,
+ * all workspaces across the entire product.
+ *
+ * @Description AuthorizationObject can represent a "set" of objects, such as: all workspaces in an organization, all workspaces owned by me,
+ * @Description all workspaces across the entire product.
+ */
 export interface AuthorizationObject {
+	/**
+	 * ResourceType is the name of the resource.
+	 * `./coderd/rbac/object.go` has the list of valid resource types.
+	 */
 	readonly resource_type: RBACResource;
+	/**
+	 * OwnerID (optional) adds the set constraint to all resources owned by a given user.
+	 */
 	readonly owner_id?: string;
+	/**
+	 * OrganizationID (optional) adds the set constraint to all resources owned by a given organization.
+	 */
 	readonly organization_id?: string;
+	/**
+	 * ResourceID (optional) reduces the set to a singular resource. This assigns
+	 * a resource ID to the resource type, eg: a single workspace.
+	 * The rbac library will not fetch the resource from the database, so if you
+	 * are using this option, you should also set the owner ID and organization ID
+	 * if possible. Be as specific as possible using all the fields relevant.
+	 */
 	readonly resource_id?: string;
+	/**
+	 * AnyOrgOwner (optional) will disregard the org_owner when checking for permissions.
+	 * This cannot be set to true if the OrganizationID is set.
+	 */
 	readonly any_org?: boolean;
 }
 
 // From codersdk/authorization.go
+/**
+ * AuthorizationRequest is a structure instead of a map because
+ * go-playground/validate can only validate structs. If you attempt to pass
+ * a map into `httpapi.Read`, you will get an invalid type error.
+ */
 export interface AuthorizationRequest {
+	/**
+	 * Checks is a map keyed with an arbitrary string to a permission check.
+	 * The key can be any string that is helpful to the caller, and allows
+	 * multiple permission checks to be run in a single request.
+	 * The key ensures that each permission check has the same key in the
+	 * response.
+	 */
 	readonly checks: Record<string, AuthorizationCheck>;
 }
 
@@ -718,6 +836,10 @@ export type AutomaticUpdates = "always" | "never";
 export const AutomaticUpdateses: AutomaticUpdates[] = ["always", "never"];
 
 // From codersdk/deployment.go
+/**
+ * AvailableExperiments is an expandable type that returns all safe experiments
+ * available to be used with a deployment.
+ */
 export interface AvailableExperiments {
 	readonly safe: readonly Experiment[];
 }
@@ -730,6 +852,9 @@ export interface BannerConfig {
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * BaseReport holds fields common to various health reports.
+ */
 export interface BaseReport {
 	readonly error?: string;
 	readonly severity: HealthSeverity;
@@ -738,16 +863,51 @@ export interface BaseReport {
 }
 
 // From codersdk/deployment.go
+/**
+ * BuildInfoResponse contains build information for this instance of Coder.
+ */
 export interface BuildInfoResponse {
+	/**
+	 * ExternalURL references the current Coder version.
+	 * For production builds, this will link directly to a release. For development builds, this will link to a commit.
+	 */
 	readonly external_url: string;
+	/**
+	 * Version returns the semantic version of the build.
+	 */
 	readonly version: string;
+	/**
+	 * DashboardURL is the URL to hit the deployment's dashboard.
+	 * For external workspace proxies, this is the coderd they are connected
+	 * to.
+	 */
 	readonly dashboard_url: string;
+	/**
+	 * Telemetry is a boolean that indicates whether telemetry is enabled.
+	 */
 	readonly telemetry: boolean;
 	readonly workspace_proxy: boolean;
+	/**
+	 * AgentAPIVersion is the current version of the Agent API (back versions
+	 * MAY still be supported).
+	 */
 	readonly agent_api_version: string;
+	/**
+	 * ProvisionerAPIVersion is the current version of the Provisioner API
+	 */
 	readonly provisioner_api_version: string;
+	/**
+	 * UpgradeMessage is the message displayed to users when an outdated client
+	 * is detected.
+	 */
 	readonly upgrade_message: string;
+	/**
+	 * DeploymentID is the unique identifier for this deployment.
+	 */
 	readonly deployment_id: string;
+	/**
+	 * WebPushPublicKey is the public key for push notifications via Web Push.
+	 */
 	readonly webpush_public_key?: string;
 }
 
@@ -776,12 +936,25 @@ export const BuildReasons: BuildReason[] = [
 ];
 
 // From codersdk/client.go
+/**
+ * BuildVersionHeader contains build information of Coder.
+ */
 export const BuildVersionHeader = "X-Coder-Build-Version";
 
 // From codersdk/client.go
+/**
+ * BypassRatelimitHeader is the custom header to use to bypass ratelimits.
+ * Only owners can bypass rate limits. This is typically used for scale testing.
+ * nolint: gosec
+ */
 export const BypassRatelimitHeader = "X-Coder-Bypass-Ratelimit";
 
 // From codersdk/client.go
+/**
+ * CLITelemetryHeader contains a base64-encoded representation of the CLI
+ * command that was invoked to produce the request. It is for internal use
+ * only.
+ */
 export const CLITelemetryHeader = "Coder-CLI-Telemetry";
 
 // From codersdk/cors_behavior.go
@@ -791,6 +964,9 @@ export const CORSBehaviors: CORSBehavior[] = ["passthru", "simple"];
 
 // From codersdk/workspacebuilds.go
 export interface CancelWorkspaceBuildParams {
+	/**
+	 * ExpectStatus ensures the build is in the expected status before canceling.
+	 */
 	readonly expect_status?: CancelWorkspaceBuildStatus;
 }
 
@@ -803,6 +979,9 @@ export const CancelWorkspaceBuildStatuses: CancelWorkspaceBuildStatus[] = [
 ];
 
 // From codersdk/users.go
+/**
+ * ChangePasswordWithOneTimePasscodeRequest enables callers to change their password when they've forgotten it.
+ */
 export interface ChangePasswordWithOneTimePasscodeRequest {
 	readonly email: string;
 	readonly password: string;
@@ -810,9 +989,16 @@ export interface ChangePasswordWithOneTimePasscodeRequest {
 }
 
 // From codersdk/client.go
+/**
+ * CoderDesktopTelemetryHeader contains a JSON-encoded representation of Desktop telemetry
+ * fields, including device ID, OS, and Desktop version.
+ */
 export const CoderDesktopTelemetryHeader = "Coder-Desktop-Telemetry";
 
 // From codersdk/insights.go
+/**
+ * ConnectionLatency shows the latency for a connection.
+ */
 export interface ConnectionLatency {
 	readonly p50: number;
 	readonly p95: number;
@@ -830,7 +1016,19 @@ export interface ConnectionLog {
 	readonly agent_name: string;
 	readonly ip?: string;
 	readonly type: ConnectionType;
+	/**
+	 * WebInfo is only set when `type` is one of:
+	 * - `ConnectionTypePortForwarding`
+	 * - `ConnectionTypeWorkspaceApp`
+	 */
 	readonly web_info?: ConnectionLogWebInfo;
+	/**
+	 * SSHInfo is only set when `type` is one of:
+	 * - `ConnectionTypeSSH`
+	 * - `ConnectionTypeReconnectingPTY`
+	 * - `ConnectionTypeVSCode`
+	 * - `ConnectionTypeJetBrains`
+	 */
 	readonly ssh_info?: ConnectionLogSSHInfo;
 }
 
@@ -843,8 +1041,20 @@ export interface ConnectionLogResponse {
 // From codersdk/connectionlog.go
 export interface ConnectionLogSSHInfo {
 	readonly connection_id: string;
+	/**
+	 * DisconnectTime is omitted if a disconnect event with the same connection ID
+	 * has not yet been seen.
+	 */
 	readonly disconnect_time?: string;
+	/**
+	 * DisconnectReason is omitted if a disconnect event with the same connection ID
+	 * has not yet been seen.
+	 */
 	readonly disconnect_reason?: string;
+	/**
+	 * ExitCode is the exit code of the SSH session. It is omitted if a
+	 * disconnect event with the same connection ID has not yet been seen.
+	 */
 	readonly exit_code?: number;
 }
 
@@ -859,8 +1069,14 @@ export const ConnectionLogStatuses: ConnectionLogStatus[] = [
 // From codersdk/connectionlog.go
 export interface ConnectionLogWebInfo {
 	readonly user_agent: string;
+	/**
+	 * User is omitted if the connection event was from an unauthenticated user.
+	 */
 	readonly user: User | null;
 	readonly slug_or_port: string;
+	/**
+	 * StatusCode is the HTTP status code of the request.
+	 */
 	readonly status_code: number;
 }
 
@@ -895,6 +1111,9 @@ export const ContentTypeZip = "application/zip";
 
 // From codersdk/users.go
 export interface ConvertLoginRequest {
+	/**
+	 * ToType is the login type to convert to.
+	 */
 	readonly to_type: LoginType;
 	readonly password: string;
 }
@@ -910,6 +1129,9 @@ export interface CreateFirstUserRequest {
 }
 
 // From codersdk/users.go
+/**
+ * CreateFirstUserResponse contains IDs for newly created user info.
+ */
 export interface CreateFirstUserResponse {
 	readonly user_id: string;
 	readonly organization_id: string;
@@ -937,6 +1159,9 @@ export interface CreateGroupRequest {
 // From codersdk/organizations.go
 export interface CreateOrganizationRequest {
 	readonly name: string;
+	/**
+	 * DisplayName will default to the same value as `Name` if not provided.
+	 */
 	readonly display_name?: string;
 	readonly description?: string;
 	readonly icon?: string;
@@ -954,6 +1179,11 @@ export interface CreateProvisionerKeyResponse {
 }
 
 // From codersdk/aitasks.go
+/**
+ * CreateTaskRequest represents the request to create a new task.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface CreateTaskRequest {
 	readonly template_version_id: string;
 	readonly template_version_preset_id?: string;
@@ -962,30 +1192,127 @@ export interface CreateTaskRequest {
 }
 
 // From codersdk/organizations.go
+/**
+ * CreateTemplateRequest provides options when creating a template.
+ */
 export interface CreateTemplateRequest {
+	/**
+	 * Name is the name of the template.
+	 */
 	readonly name: string;
+	/**
+	 * DisplayName is the displayed name of the template.
+	 */
 	readonly display_name?: string;
+	/**
+	 * Description is a description of what the template contains. It must be
+	 * less than 128 bytes.
+	 */
 	readonly description?: string;
+	/**
+	 * Icon is a relative path or external URL that specifies
+	 * an icon to be displayed in the dashboard.
+	 */
 	readonly icon?: string;
+	/**
+	 * VersionID is an in-progress or completed job to use as an initial version
+	 * of the template.
+	 *
+	 * This is required on creation to enable a user-flow of validating a
+	 * template works. There is no reason the data-model cannot support empty
+	 * templates, but it doesn't make sense for users.
+	 */
 	readonly template_version_id: string;
+	/**
+	 * DefaultTTLMillis allows optionally specifying the default TTL
+	 * for all workspaces created from this template.
+	 */
 	readonly default_ttl_ms?: number;
+	/**
+	 * ActivityBumpMillis allows optionally specifying the activity bump
+	 * duration for all workspaces created from this template. Defaults to 1h
+	 * but can be set to 0 to disable activity bumping.
+	 */
 	readonly activity_bump_ms?: number;
+	/**
+	 * AutostopRequirement allows optionally specifying the autostop requirement
+	 * for workspaces created from this template. This is an enterprise feature.
+	 */
 	readonly autostop_requirement?: TemplateAutostopRequirement;
+	/**
+	 * AutostartRequirement allows optionally specifying the autostart allowed days
+	 * for workspaces created from this template. This is an enterprise feature.
+	 */
 	readonly autostart_requirement?: TemplateAutostartRequirement;
+	/**
+	 * Allow users to cancel in-progress workspace jobs.
+	 * *bool as the default value is "true".
+	 */
 	readonly allow_user_cancel_workspace_jobs: boolean | null;
+	/**
+	 * AllowUserAutostart allows users to set a schedule for autostarting their
+	 * workspace. By default this is true. This can only be disabled when using
+	 * an enterprise license.
+	 */
 	readonly allow_user_autostart?: boolean;
+	/**
+	 * AllowUserAutostop allows users to set a custom workspace TTL to use in
+	 * place of the template's DefaultTTL field. By default this is true. If
+	 * false, the DefaultTTL will always be used. This can only be disabled when
+	 * using an enterprise license.
+	 */
 	readonly allow_user_autostop?: boolean;
+	/**
+	 * FailureTTLMillis allows optionally specifying the max lifetime before Coder
+	 * stops all resources for failed workspaces created from this template.
+	 */
 	readonly failure_ttl_ms?: number;
+	/**
+	 * TimeTilDormantMillis allows optionally specifying the max lifetime before Coder
+	 * locks inactive workspaces created from this template.
+	 */
 	readonly dormant_ttl_ms?: number;
+	/**
+	 * TimeTilDormantAutoDeleteMillis allows optionally specifying the max lifetime before Coder
+	 * permanently deletes dormant workspaces created from this template.
+	 */
 	readonly delete_ttl_ms?: number;
+	/**
+	 * DisableEveryoneGroupAccess allows optionally disabling the default
+	 * behavior of granting the 'everyone' group access to use the template.
+	 * If this is set to true, the template will not be available to all users,
+	 * and must be explicitly granted to users or groups in the permissions settings
+	 * of the template.
+	 */
 	readonly disable_everyone_group_access: boolean;
+	/**
+	 * RequireActiveVersion mandates that workspaces are built with the active
+	 * template version.
+	 */
 	readonly require_active_version: boolean;
+	/**
+	 * MaxPortShareLevel allows optionally specifying the maximum port share level
+	 * for workspaces created from the template.
+	 */
 	readonly max_port_share_level: WorkspaceAgentPortShareLevel | null;
+	/**
+	 * UseClassicParameterFlow allows optionally specifying whether
+	 * the template should use the classic parameter flow. The default if unset is
+	 * true, and is why `*bool` is used here. When dynamic parameters becomes
+	 * the default, this will default to false.
+	 */
 	readonly template_use_classic_parameter_flow?: boolean;
+	/**
+	 * CORSBehavior allows optionally specifying the CORS behavior for all shared ports.
+	 */
 	readonly cors_behavior: CORSBehavior | null;
 }
 
 // From codersdk/templateversions.go
+/**
+ * CreateTemplateVersionDryRunRequest defines the request parameters for
+ * CreateTemplateVersionDryRun.
+ */
 export interface CreateTemplateVersionDryRunRequest {
 	readonly workspace_name: string;
 	readonly rich_parameter_values: readonly WorkspaceBuildParameter[];
@@ -993,9 +1320,15 @@ export interface CreateTemplateVersionDryRunRequest {
 }
 
 // From codersdk/organizations.go
+/**
+ * CreateTemplateVersionRequest enables callers to create a new Template Version.
+ */
 export interface CreateTemplateVersionRequest {
 	readonly name?: string;
 	readonly message?: string;
+	/**
+	 * TemplateID optionally associates a version with a template.
+	 */
 	readonly template_id?: string;
 	readonly storage_method: ProvisionerStorageMethod;
 	readonly file_id?: string;
@@ -1020,7 +1353,7 @@ export interface CreateTestAuditLogRequest {
 // From codersdk/apikey.go
 export interface CreateTokenRequest {
 	readonly lifetime: number;
-	readonly scope?: APIKeyScope;
+	readonly scope?: APIKeyScope; // Deprecated: use Scopes instead.
 	readonly scopes?: readonly APIKeyScope[];
 	readonly token_name: string;
 	readonly allow_list?: readonly APIAllowListTarget[];
@@ -1032,8 +1365,17 @@ export interface CreateUserRequestWithOrgs {
 	readonly username: string;
 	readonly name: string;
 	readonly password: string;
+	/**
+	 * UserLoginType defaults to LoginTypePassword.
+	 */
 	readonly login_type: LoginType;
+	/**
+	 * UserStatus defaults to UserStatusDormant.
+	 */
 	readonly user_status: UserStatus | null;
+	/**
+	 * OrganizationIDs is a list of organization IDs that the user should be a member of.
+	 */
 	readonly organization_ids: readonly string[];
 }
 
@@ -1054,15 +1396,35 @@ export const CreateWorkspaceBuildReasons: CreateWorkspaceBuildReason[] = [
 ];
 
 // From codersdk/workspaces.go
+/**
+ * CreateWorkspaceBuildRequest provides options to update the latest workspace build.
+ */
 export interface CreateWorkspaceBuildRequest {
 	readonly template_version_id?: string;
 	readonly transition: WorkspaceTransition;
 	readonly dry_run?: boolean;
 	readonly state?: string;
+	/**
+	 * Orphan may be set for the Destroy transition.
+	 */
 	readonly orphan?: boolean;
+	/**
+	 * ParameterValues are optional. It will write params to the 'workspace' scope.
+	 * This will overwrite any existing parameters with the same name.
+	 * This will not delete old params not included in this list.
+	 */
 	readonly rich_parameter_values?: readonly WorkspaceBuildParameter[];
+	/**
+	 * Log level changes the default logging verbosity of a provider ("info" if empty).
+	 */
 	readonly log_level?: ProvisionerLogLevel;
+	/**
+	 * TemplateVersionPresetID is the ID of the template version preset to use for the build.
+	 */
 	readonly template_version_preset_id?: string;
+	/**
+	 * Reason sets the reason for the workspace build.
+	 */
 	readonly reason?: CreateWorkspaceBuildReason;
 }
 
@@ -1074,12 +1436,36 @@ export interface CreateWorkspaceProxyRequest {
 }
 
 // From codersdk/organizations.go
+/**
+ * CreateWorkspaceRequest provides options for creating a new workspace.
+ * Either TemplateID or TemplateVersionID must be specified. They cannot both be present.
+ * @Description CreateWorkspaceRequest provides options for creating a new workspace.
+ * @Description Only one of TemplateID or TemplateVersionID can be specified, not both.
+ * @Description If TemplateID is specified, the active version of the template will be used.
+ * @Description Workspace names:
+ * @Description - Must start with a letter or number
+ * @Description - Can only contain letters, numbers, and hyphens
+ * @Description - Cannot contain spaces or special characters
+ * @Description - Cannot be named `new` or `create`
+ * @Description - Must be unique within your workspaces
+ * @Description - Maximum length of 32 characters
+ */
 export interface CreateWorkspaceRequest {
+	/**
+	 * TemplateID specifies which template should be used for creating the workspace.
+	 */
 	readonly template_id?: string;
+	/**
+	 * TemplateVersionID can be used to specify a specific version of a template for creating the workspace.
+	 */
 	readonly template_version_id?: string;
 	readonly name: string;
 	readonly autostart_schedule?: string;
 	readonly ttl_ms?: number;
+	/**
+	 * RichParameterValues allows for additional parameters to be provided
+	 * during the initial provision.
+	 */
 	readonly rich_parameter_values?: readonly WorkspaceBuildParameter[];
 	readonly automatic_updates?: AutomaticUpdates;
 	readonly template_version_preset_id?: string;
@@ -1120,16 +1506,26 @@ export interface CustomNotificationRequest {
 }
 
 // From codersdk/roles.go
+/**
+ * CustomRoleRequest is used to edit custom roles.
+ */
 export interface CustomRoleRequest {
 	readonly name: string;
 	readonly display_name: string;
 	readonly site_permissions: readonly Permission[];
+	/**
+	 * OrganizationPermissions are specific to the organization the role belongs to.
+	 */
 	readonly organization_permissions: readonly Permission[];
 	readonly user_permissions: readonly Permission[];
 }
 
 // From codersdk/deployment.go
 export interface DAUEntry {
+	/**
+	 * Date is a string formatted as 2024-01-31.
+	 * Timezone and time information is not included.
+	 */
 	readonly date: string;
 	readonly amount: number;
 }
@@ -1160,7 +1556,13 @@ export interface DERPConfig {
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * DERPHealthReport includes health details of each configured DERP/STUN region.
+ */
 export interface DERPHealthReport extends BaseReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly regions: Record<number, DERPRegionReport | null>;
 	readonly netcheck?: NetcheckReport;
@@ -1169,7 +1571,13 @@ export interface DERPHealthReport extends BaseReport {
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * DERPHealthReport includes health details of a single node in a single region.
+ */
 export interface DERPNodeReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly severity: HealthSeverity;
 	readonly warnings: readonly HealthMessage[];
@@ -1192,7 +1600,13 @@ export interface DERPRegion {
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * DERPHealthReport includes health details of each node in a single region.
+ */
 export interface DERPRegionReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly severity: HealthSeverity;
 	readonly warnings: readonly HealthMessage[];
@@ -1222,7 +1636,13 @@ export interface DangerousConfig {
 export const DatabaseNotReachable = "database not reachable";
 
 // From healthsdk/healthsdk.go
+/**
+ * DatabaseReport shows the results of pinging the configured database.Conn.
+ */
 export interface DatabaseReport extends BaseReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly reachable: boolean;
 	readonly latency: string;
@@ -1232,6 +1652,9 @@ export interface DatabaseReport extends BaseReport {
 
 // From codersdk/externalauth.go
 export interface DeleteExternalAuthByIDResponse {
+	/**
+	 * TokenRevoked set to true if token revocation was attempted and was successful
+	 */
 	readonly token_revoked: boolean;
 	readonly token_revocation_error?: string;
 }
@@ -1248,6 +1671,9 @@ export interface DeleteWorkspaceAgentPortShareRequest {
 }
 
 // From codersdk/deployment.go
+/**
+ * DeploymentConfig contains both the deployment values and how they're set.
+ */
 export interface DeploymentConfig {
 	readonly config?: DeploymentValues;
 	readonly options?: SerpentOptionSet;
@@ -1255,20 +1681,37 @@ export interface DeploymentConfig {
 
 // From codersdk/deployment.go
 export interface DeploymentStats {
+	/**
+	 * AggregatedFrom is the time in which stats are aggregated from.
+	 * This might be back in time a specific duration or interval.
+	 */
 	readonly aggregated_from: string;
+	/**
+	 * CollectedAt is the time in which stats are collected at.
+	 */
 	readonly collected_at: string;
+	/**
+	 * NextUpdateAt is the time when the next batch of stats will
+	 * be updated.
+	 */
 	readonly next_update_at: string;
 	readonly workspaces: WorkspaceDeploymentStats;
 	readonly session_count: SessionCountDeploymentStats;
 }
 
 // From codersdk/deployment.go
+/**
+ * DeploymentValues is the central configuration values the coder server.
+ */
 export interface DeploymentValues {
 	readonly verbose?: boolean;
 	readonly access_url?: string;
 	readonly wildcard_access_url?: string;
 	readonly docs_url?: string;
 	readonly redirect_to_access_url?: boolean;
+	/**
+	 * HTTPAddress is a string because it may be set to zero to disable.
+	 */
 	readonly http_address?: string;
 	readonly autobuild_poll_interval?: number;
 	readonly job_hang_detector_interval?: number;
@@ -1327,6 +1770,9 @@ export interface DeploymentValues {
 	readonly ai?: AIConfig;
 	readonly config?: string;
 	readonly write_config?: boolean;
+	/**
+	 * Deprecated: Use HTTPAddress or TLS.Address instead.
+	 */
 	readonly address?: string;
 }
 
@@ -1361,8 +1807,15 @@ export const DisplayApps: DisplayApp[] = [
 
 // From codersdk/parameters.go
 export interface DynamicParametersRequest {
+	/**
+	 * ID identifies the request. The response contains the same
+	 * ID so that the client can match it to the request.
+	 */
 	readonly id: number;
 	readonly inputs: Record<string, string>;
+	/**
+	 * OwnerID if uuid.Nil, it defaults to `codersdk.Me`
+	 */
 	readonly owner_id?: string;
 }
 
@@ -1412,6 +1865,9 @@ export interface Entitlements {
 }
 
 // From codersdk/client.go
+/**
+ * EntitlementsWarnings contains active warnings for the user's entitlements.
+ */
 export const EntitlementsWarningHeader = "X-Coder-Entitlements-Warning";
 
 // From codersdk/deployment.go
@@ -1444,6 +1900,9 @@ export interface ExternalAPIKeyScopes {
 }
 
 // From codersdk/workspaces.go
+/**
+ * ExternalAgentCredentials contains the credentials needed for an external agent to connect to Coder.
+ */
 export interface ExternalAgentCredentials {
 	readonly command: string;
 	readonly agent_token: string;
@@ -1455,9 +1914,21 @@ export interface ExternalAuth {
 	readonly device: boolean;
 	readonly display_name: string;
 	readonly supports_revocation: boolean;
+	/**
+	 * User is the user that authenticated with the provider.
+	 */
 	readonly user: ExternalAuthUser | null;
+	/**
+	 * AppInstallable is true if the request for app installs was successful.
+	 */
 	readonly app_installable: boolean;
+	/**
+	 * AppInstallations are the installations that the user has access to.
+	 */
 	readonly installations: readonly ExternalAuthAppInstallation[];
+	/**
+	 * AppInstallURL is the URL to install the app.
+	 */
 	readonly app_install_url: string;
 }
 
@@ -1470,8 +1941,15 @@ export interface ExternalAuthAppInstallation {
 
 // From codersdk/deployment.go
 export interface ExternalAuthConfig {
+	/**
+	 * Type is the type of external auth config.
+	 */
 	readonly type: string;
 	readonly client_id: string;
+	/**
+	 * ID is a unique identifier for the auth config.
+	 * It defaults to `type` when not provided.
+	 */
 	readonly id: string;
 	readonly auth_url: string;
 	readonly token_url: string;
@@ -1486,12 +1964,30 @@ export interface ExternalAuthConfig {
 	readonly mcp_url: string;
 	readonly mcp_tool_allow_regex: string;
 	readonly mcp_tool_deny_regex: string;
+	/**
+	 * Regex allows API requesters to match an auth config by
+	 * a string (e.g. coder.com) instead of by it's type.
+	 *
+	 * Git clone makes use of this by parsing the URL from:
+	 * 'Username for "https://github.com":'
+	 * And sending it to the Coder server to match against the Regex.
+	 */
 	readonly regex: string;
+	/**
+	 * DisplayName is shown in the UI to identify the auth config.
+	 */
 	readonly display_name: string;
+	/**
+	 * DisplayIcon is a URL to an icon to display in the UI.
+	 */
 	readonly display_icon: string;
 }
 
 // From codersdk/externalauth.go
+/**
+ * ExternalAuthDevice is the response from the device authorization endpoint.
+ * See: https://tools.ietf.org/html/rfc8628#section-3.2
+ */
 export interface ExternalAuthDevice {
 	readonly device_code: string;
 	readonly user_code: string;
@@ -1506,6 +2002,11 @@ export interface ExternalAuthDeviceExchange {
 }
 
 // From codersdk/externalauth.go
+/**
+ * ExternalAuthLink is a link between a user and an external auth provider.
+ * It excludes information that requires a token to access, so can be statically
+ * built from the database and configs.
+ */
 export interface ExternalAuthLink {
 	readonly provider_id: string;
 	readonly created_at: string;
@@ -1517,6 +2018,9 @@ export interface ExternalAuthLink {
 }
 
 // From codersdk/externalauth.go
+/**
+ * ExternalAuthLinkProvider are the static details of a provider.
+ */
 export interface ExternalAuthLinkProvider {
 	readonly id: string;
 	readonly type: string;
@@ -1543,7 +2047,23 @@ export interface Feature {
 	readonly enabled: boolean;
 	readonly limit?: number;
 	readonly actual?: number;
+	/**
+	 * SoftLimit is the soft limit of the feature, and is only used for showing
+	 * included limits in the dashboard. No license validation or warnings are
+	 * generated from this value.
+	 */
 	readonly soft_limit?: number;
+	/**
+	 * UsagePeriod denotes that the usage is a counter that accumulates over
+	 * this period (and most likely resets with the issuance of the next
+	 * license).
+	 *
+	 * These dates are determined from the license that this entitlement comes
+	 * from, see enterprise/coderd/license/license.go.
+	 *
+	 * Only certain features set these fields:
+	 * - FeatureManagedAgentLimit
+	 */
 	readonly usage_period?: UsagePeriod;
 }
 
@@ -1608,6 +2128,10 @@ export const FeatureSets: FeatureSet[] = ["enterprise", "", "premium"];
 export const FormatZip = "zip";
 
 // From codersdk/parameters.go
+/**
+ * FriendlyDiagnostic == previewtypes.FriendlyDiagnostic
+ * Copied to avoid import deps
+ */
 export interface FriendlyDiagnostic {
 	readonly severity: DiagnosticSeverityString;
 	readonly summary: string;
@@ -1616,6 +2140,9 @@ export interface FriendlyDiagnostic {
 }
 
 // From codersdk/apikey.go
+/**
+ * GenerateAPIKeyResponse contains an API key for a user.
+ */
 export interface GenerateAPIKeyResponse {
 	readonly key: string;
 }
@@ -1647,6 +2174,11 @@ export interface GitSSHKey {
 	readonly user_id: string;
 	readonly created_at: string;
 	readonly updated_at: string;
+	/**
+	 * PublicKey is the SSH public key in OpenSSH format.
+	 * Example: "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID3OmYJvT7q1cF1azbybYy0OZ9yrXfA+M6Lr4vzX5zlp\n"
+	 * Note: The key includes a trailing newline (\n).
+	 */
 	readonly public_key: string;
 }
 
@@ -1663,6 +2195,11 @@ export interface Group {
 	readonly display_name: string;
 	readonly organization_id: string;
 	readonly members: readonly ReducedUser[];
+	/**
+	 * How many members are in this group. Shows the total count,
+	 * even if the user is not authorized to read group member details.
+	 * May be greater than `len(Group.Members)`.
+	 */
 	readonly total_member_count: number;
 	readonly avatar_url: string;
 	readonly quota_allowance: number;
@@ -1673,8 +2210,18 @@ export interface Group {
 
 // From codersdk/groups.go
 export interface GroupArguments {
+	/**
+	 * Organization can be an org UUID or name
+	 */
 	readonly Organization: string;
+	/**
+	 * HasMember can be a user uuid or username
+	 */
 	readonly HasMember: string;
+	/**
+	 * GroupIDs is a list of group UUIDs to filter by.
+	 * If not set, all groups will be returned.
+	 */
 	readonly GroupIDs: readonly string[];
 }
 
@@ -1685,10 +2232,33 @@ export const GroupSources: GroupSource[] = ["oidc", "user"];
 
 // From codersdk/idpsync.go
 export interface GroupSyncSettings {
+	/**
+	 * Field is the name of the claim field that specifies what groups a user
+	 * should be in. If empty, no groups will be synced.
+	 */
 	readonly field: string;
+	/**
+	 * Mapping is a map from OIDC groups to Coder group IDs
+	 */
 	readonly mapping: Record<string, string[]>;
+	/**
+	 * RegexFilter is a regular expression that filters the groups returned by
+	 * the OIDC provider. Any group not matched by this regex will be ignored.
+	 * If the group filter is nil, then no group filtering will occur.
+	 */
 	readonly regex_filter: string | null;
+	/**
+	 * AutoCreateMissing controls whether groups returned by the OIDC provider
+	 * are automatically created in Coder if they are missing.
+	 */
 	readonly auto_create_missing_groups: boolean;
+	/**
+	 * LegacyNameMapping is deprecated. It remaps an IDP group name to
+	 * a Coder group name. Since configuration is now done at runtime,
+	 * group IDs are used to account for group renames.
+	 * For legacy configurations, this config option has to remain.
+	 * Deprecated: Use Mapping instead.
+	 */
 	readonly legacy_group_name_mapping?: Record<string, string>;
 }
 
@@ -1750,6 +2320,9 @@ export const HealthCodes: HealthCode[] = [
 ];
 
 // From health/model.go
+/**
+ * @typescript-generate Message
+ */
 export interface HealthMessage {
 	readonly code: HealthCode;
 	readonly message: string;
@@ -1785,21 +2358,46 @@ export const HealthSeveritys: HealthSeverity[] = ["error", "ok", "warning"];
 
 // From codersdk/workspaceapps.go
 export interface Healthcheck {
+	/**
+	 * URL specifies the endpoint to check for the app health.
+	 */
 	readonly url: string;
+	/**
+	 * Interval specifies the seconds between each health check.
+	 */
 	readonly interval: number;
+	/**
+	 * Threshold specifies the number of consecutive failed health checks before returning "unhealthy".
+	 */
 	readonly threshold: number;
 }
 
 // From codersdk/deployment.go
+/**
+ * HealthcheckConfig contains configuration for healthchecks.
+ */
 export interface HealthcheckConfig {
 	readonly refresh: number;
 	readonly threshold_database: number;
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * HealthcheckReport contains information about the health status of a Coder deployment.
+ */
 export interface HealthcheckReport {
+	/**
+	 * Time is the time the report was generated at.
+	 */
 	readonly time: string;
+	/**
+	 * Healthy is true if the report returns no errors.
+	 * Deprecated: use `Severity` instead
+	 */
 	readonly healthy: boolean;
+	/**
+	 * Severity indicates the status of Coder health.
+	 */
 	readonly severity: HealthSeverity;
 	readonly derp: DERPHealthReport;
 	readonly access_url: AccessURLReport;
@@ -1807,12 +2405,21 @@ export interface HealthcheckReport {
 	readonly database: DatabaseReport;
 	readonly workspace_proxy: WorkspaceProxyReport;
 	readonly provisioner_daemons: ProvisionerDaemonsReport;
+	/**
+	 * The Coder version of the server that the report was generated on.
+	 */
 	readonly coder_version: string;
 }
 
 // From codersdk/idpsync.go
 export interface IDPSyncMapping<ResourceIdType extends string> {
+	/**
+	 * The IdP claim the user has
+	 */
 	readonly Given: string;
+	/**
+	 * The ID of the Coder resource the user should be added to
+	 */
 	readonly Gets: ResourceIdType;
 }
 
@@ -1858,6 +2465,9 @@ export const InsightsReportIntervals: InsightsReportInterval[] = [
 
 // From codersdk/workspaceagents.go
 export interface IssueReconnectingPTYSignedTokenRequest {
+	/**
+	 * URL is the URL of the reconnecting-pty endpoint you are connecting to.
+	 */
 	readonly url: string;
 	readonly agentID: string;
 }
@@ -1877,6 +2487,12 @@ export interface License {
 	readonly id: number;
 	readonly uuid: string;
 	readonly uploaded_at: string;
+	/**
+	 * Claims are the JWT claims asserted by the license.  Here we use
+	 * a generic string map to ensure that all data from the server is
+	 * parsed verbatim, not just the fields this version of Coder
+	 * understands.
+	 */
 	// empty interface{} type, falling back to unknown
 	readonly claims: Record<string, unknown>;
 }
@@ -1912,6 +2528,12 @@ export interface ListInboxNotificationsResponse {
 // From codersdk/externalauth.go
 export interface ListUserExternalAuthResponse {
 	readonly providers: readonly ExternalAuthLinkProvider[];
+	/**
+	 * Links are all the authenticated links for the user.
+	 * If a link has a provider ID that does not exist, then that provider
+	 * is no longer configured, rendering it unusable. It is still valuable
+	 * to include these links so that the user can unlink them.
+	 */
 	readonly links: readonly ExternalAuthLink[];
 }
 
@@ -1952,20 +2574,45 @@ export const LoginTypes: LoginType[] = [
 ];
 
 // From codersdk/users.go
+/**
+ * LoginWithPasswordRequest enables callers to authenticate with email and password.
+ */
 export interface LoginWithPasswordRequest {
 	readonly email: string;
 	readonly password: string;
 }
 
 // From codersdk/users.go
+/**
+ * LoginWithPasswordResponse contains a session token for the newly authenticated user.
+ */
 export interface LoginWithPasswordResponse {
 	readonly session_token: string;
 }
 
 // From codersdk/provisionerdaemons.go
+/**
+ * MatchedProvisioners represents the number of provisioner daemons
+ * available to take a job at a specific point in time.
+ * Introduced in Coder version 2.18.0.
+ */
 export interface MatchedProvisioners {
+	/**
+	 * Count is the number of provisioner daemons that matched the given
+	 * tags. If the count is 0, it means no provisioner daemons matched the
+	 * requested tags.
+	 */
 	readonly count: number;
+	/**
+	 * Available is the number of provisioner daemons that are available to
+	 * take jobs. This may be less than the count if some provisioners are
+	 * busy or have been stopped.
+	 */
 	readonly available: number;
+	/**
+	 * MostRecentlySeen is the most recently seen time of the set of matched
+	 * provisioners. If no provisioners matched, this field will be null.
+	 */
 	readonly most_recently_seen?: string;
 }
 
@@ -1978,6 +2625,10 @@ export interface MinimalOrganization {
 }
 
 // From codersdk/users.go
+/**
+ * MinimalUser is the minimal information needed to identify a user and show
+ * them on the UI.
+ */
 export interface MinimalUser {
 	readonly id: string;
 	readonly username: string;
@@ -1985,25 +2636,53 @@ export interface MinimalUser {
 }
 
 // From netcheck/netcheck.go
+/**
+ * Report contains the result of a single netcheck.
+ */
 export interface NetcheckReport {
-	readonly UDP: boolean;
-	readonly IPv6: boolean;
-	readonly IPv4: boolean;
-	readonly IPv6CanSend: boolean;
-	readonly IPv4CanSend: boolean;
-	readonly OSHasIPv6: boolean;
-	readonly ICMPv4: boolean;
+	readonly UDP: boolean; // a UDP STUN round trip completed
+	readonly IPv6: boolean; // an IPv6 STUN round trip completed
+	readonly IPv4: boolean; // an IPv4 STUN round trip completed
+	readonly IPv6CanSend: boolean; // an IPv6 packet was able to be sent
+	readonly IPv4CanSend: boolean; // an IPv4 packet was able to be sent
+	readonly OSHasIPv6: boolean; // could bind a socket to ::1
+	readonly ICMPv4: boolean; // an ICMPv4 round trip completed
+	/**
+	 * MappingVariesByDestIP is whether STUN results depend which
+	 * STUN server you're talking to (on IPv4).
+	 */
 	readonly MappingVariesByDestIP: boolean | null;
+	/**
+	 * HairPinning is whether the router supports communicating
+	 * between two local devices through the NATted public IP address
+	 * (on IPv4).
+	 */
 	readonly HairPinning: boolean | null;
+	/**
+	 * UPnP is whether UPnP appears present on the LAN.
+	 * Empty means not checked.
+	 */
 	readonly UPnP: boolean | null;
+	/**
+	 * PMP is whether NAT-PMP appears present on the LAN.
+	 * Empty means not checked.
+	 */
 	readonly PMP: boolean | null;
+	/**
+	 * PCP is whether PCP appears present on the LAN.
+	 * Empty means not checked.
+	 */
 	readonly PCP: boolean | null;
-	readonly PreferredDERP: number;
-	readonly RegionLatency: Record<number, number>;
-	readonly RegionV4Latency: Record<number, number>;
-	readonly RegionV6Latency: Record<number, number>;
-	readonly GlobalV4: string;
-	readonly GlobalV6: string;
+	readonly PreferredDERP: number; // or 0 for unknown
+	readonly RegionLatency: Record<number, number>; // keyed by DERP Region ID
+	readonly RegionV4Latency: Record<number, number>; // keyed by DERP Region ID
+	readonly RegionV6Latency: Record<number, number>; // keyed by DERP Region ID
+	readonly GlobalV4: string; // ip:port of global IPv4
+	readonly GlobalV6: string; // [ip]:port of global IPv6
+	/**
+	 * CaptivePortal is set when we think there's a captive portal that is
+	 * intercepting HTTP traffic.
+	 */
 	readonly CaptivePortal: boolean | null;
 }
 
@@ -2035,45 +2714,139 @@ export interface NotificationTemplate {
 
 // From codersdk/deployment.go
 export interface NotificationsConfig {
+	/**
+	 * The upper limit of attempts to send a notification.
+	 */
 	readonly max_send_attempts: number;
+	/**
+	 * The minimum time between retries.
+	 */
 	readonly retry_interval: number;
+	/**
+	 * The notifications system buffers message updates in memory to ease pressure on the database.
+	 * This option controls how often it synchronizes its state with the database. The shorter this value the
+	 * lower the change of state inconsistency in a non-graceful shutdown - but it also increases load on the
+	 * database. It is recommended to keep this option at its default value.
+	 */
 	readonly sync_interval: number;
+	/**
+	 * The notifications system buffers message updates in memory to ease pressure on the database.
+	 * This option controls how many updates are kept in memory. The lower this value the
+	 * lower the change of state inconsistency in a non-graceful shutdown - but it also increases load on the
+	 * database. It is recommended to keep this option at its default value.
+	 */
 	readonly sync_buffer_size: number;
+	/**
+	 * How long a notifier should lease a message. This is effectively how long a notification is 'owned'
+	 * by a notifier, and once this period expires it will be available for lease by another notifier. Leasing
+	 * is important in order for multiple running notifiers to not pick the same messages to deliver concurrently.
+	 * This lease period will only expire if a notifier shuts down ungracefully; a dispatch of the notification
+	 * releases the lease.
+	 */
 	readonly lease_period: number;
+	/**
+	 * How many notifications a notifier should lease per fetch interval.
+	 */
 	readonly lease_count: number;
+	/**
+	 * How often to query the database for queued notifications.
+	 */
 	readonly fetch_interval: number;
+	/**
+	 * Which delivery method to use (available options: 'smtp', 'webhook').
+	 */
 	readonly method: string;
+	/**
+	 * How long to wait while a notification is being sent before giving up.
+	 */
 	readonly dispatch_timeout: number;
+	/**
+	 * SMTP settings.
+	 */
 	readonly email: NotificationsEmailConfig;
+	/**
+	 * Webhook settings.
+	 */
 	readonly webhook: NotificationsWebhookConfig;
+	/**
+	 * Inbox settings.
+	 */
 	readonly inbox: NotificationsInboxConfig;
 }
 
 // From codersdk/deployment.go
 export interface NotificationsEmailAuthConfig {
+	/**
+	 * Identity for PLAIN auth.
+	 */
 	readonly identity: string;
+	/**
+	 * Username for LOGIN/PLAIN auth.
+	 */
 	readonly username: string;
+	/**
+	 * Password for LOGIN/PLAIN auth.
+	 */
 	readonly password: string;
+	/**
+	 * File from which to load the password for LOGIN/PLAIN auth.
+	 */
 	readonly password_file: string;
 }
 
 // From codersdk/deployment.go
 export interface NotificationsEmailConfig {
+	/**
+	 * The sender's address.
+	 */
 	readonly from: string;
+	/**
+	 * The intermediary SMTP host through which emails are sent (host:port).
+	 */
 	readonly smarthost: string;
+	/**
+	 * The hostname identifying the SMTP server.
+	 */
 	readonly hello: string;
+	/**
+	 * Authentication details.
+	 */
 	readonly auth: NotificationsEmailAuthConfig;
+	/**
+	 * TLS details.
+	 */
 	readonly tls: NotificationsEmailTLSConfig;
+	/**
+	 * ForceTLS causes a TLS connection to be attempted.
+	 */
 	readonly force_tls: boolean;
 }
 
 // From codersdk/deployment.go
 export interface NotificationsEmailTLSConfig {
+	/**
+	 * StartTLS attempts to upgrade plain connections to TLS.
+	 */
 	readonly start_tls: boolean;
+	/**
+	 * ServerName to verify the hostname for the targets.
+	 */
 	readonly server_name: string;
+	/**
+	 * InsecureSkipVerify skips target certificate validation.
+	 */
 	readonly insecure_skip_verify: boolean;
+	/**
+	 * CAFile specifies the location of the CA certificate to use.
+	 */
 	readonly ca_file: string;
+	/**
+	 * CertFile specifies the location of the certificate to use.
+	 */
 	readonly cert_file: string;
+	/**
+	 * KeyFile specifies the location of the key to use.
+	 */
 	readonly key_file: string;
 }
 
@@ -2089,10 +2862,16 @@ export interface NotificationsSettings {
 
 // From codersdk/deployment.go
 export interface NotificationsWebhookConfig {
+	/**
+	 * The URL to which the payload will be sent with an HTTP POST request.
+	 */
 	readonly endpoint: string;
 }
 
 // From codersdk/parameters.go
+/**
+ * NullHCLString == `previewtypes.NullHCLString`.
+ */
 export interface NullHCLString {
 	readonly value: string;
 	readonly valid: boolean;
@@ -2102,10 +2881,16 @@ export interface NullHCLString {
 export interface OAuth2AppEndpoints {
 	readonly authorization: string;
 	readonly token: string;
+	/**
+	 * DeviceAuth is optional.
+	 */
 	readonly device_authorization: string;
 }
 
 // From codersdk/oauth2.go
+/**
+ * OAuth2AuthorizationServerMetadata represents RFC 8414 OAuth 2.0 Authorization Server Metadata
+ */
 export interface OAuth2AuthorizationServerMetadata {
 	readonly issuer: string;
 	readonly authorization_endpoint: string;
@@ -2119,6 +2904,10 @@ export interface OAuth2AuthorizationServerMetadata {
 }
 
 // From codersdk/oauth2.go
+/**
+ * OAuth2ClientConfiguration represents RFC 7592 Client Configuration (for GET/PUT operations)
+ * Same as OAuth2ClientRegistrationResponse but without client_secret in GET responses
+ */
 export interface OAuth2ClientConfiguration {
 	readonly client_id: string;
 	readonly client_id_issued_at: number;
@@ -2143,6 +2932,9 @@ export interface OAuth2ClientConfiguration {
 }
 
 // From codersdk/oauth2.go
+/**
+ * OAuth2ClientRegistrationRequest represents RFC 7591 Dynamic Client Registration Request
+ */
 export interface OAuth2ClientRegistrationRequest {
 	readonly redirect_uris?: readonly string[];
 	readonly client_name?: string;
@@ -2163,6 +2955,9 @@ export interface OAuth2ClientRegistrationRequest {
 }
 
 // From codersdk/oauth2.go
+/**
+ * OAuth2ClientRegistrationResponse represents RFC 7591 Dynamic Client Registration Response
+ */
 export interface OAuth2ClientRegistrationResponse {
 	readonly client_id: string;
 	readonly client_secret?: string;
@@ -2211,6 +3006,9 @@ export interface OAuth2GithubConfig {
 }
 
 // From codersdk/oauth2.go
+/**
+ * OAuth2ProtectedResourceMetadata represents RFC 9728 OAuth 2.0 Protected Resource Metadata
+ */
 export interface OAuth2ProtectedResourceMetadata {
 	readonly resource: string;
 	readonly authorization_servers: readonly string[];
@@ -2224,6 +3022,11 @@ export interface OAuth2ProviderApp {
 	readonly name: string;
 	readonly callback_url: string;
 	readonly icon: string;
+	/**
+	 * Endpoints are included in the app response for easier discovery. The OAuth2
+	 * spec does not have a defined place to find these (for comparison, OIDC has
+	 * a '/.well-known/openid-configuration' endpoint).
+	 */
 	readonly endpoints: OAuth2AppEndpoints;
 }
 
@@ -2261,9 +3064,15 @@ export const OAuth2ProviderResponseTypes: OAuth2ProviderResponseType[] = [
 ];
 
 // From codersdk/client.go
+/**
+ * OAuth2RedirectCookie is the name of the cookie that stores the oauth2 redirect.
+ */
 export const OAuth2RedirectCookie = "oauth_redirect";
 
 // From codersdk/client.go
+/**
+ * OAuth2StateCookie is the name of the cookie that stores the oauth2 state.
+ */
 export const OAuth2StateCookie = "oauth_state";
 
 // From codersdk/users.go
@@ -2285,6 +3094,9 @@ export interface OIDCConfig {
 	readonly allow_signups: boolean;
 	readonly client_id: string;
 	readonly client_secret: string;
+	/**
+	 * ClientKeyFile & ClientCertFile are used in place of ClientSecret for PKI auth.
+	 */
 	readonly client_key_file: string;
 	readonly client_cert_file: string;
 	readonly email_domain: string;
@@ -2295,7 +3107,20 @@ export interface OIDCConfig {
 	readonly name_field: string;
 	readonly email_field: string;
 	readonly auth_url_params: SerpentStruct<Record<string, string>>;
+	/**
+	 * IgnoreUserInfo & UserInfoFromAccessToken are mutually exclusive. Only 1
+	 * can be set to true. Ideally this would be an enum with 3 states, ['none',
+	 * 'userinfo', 'access_token']. However, for backward compatibility,
+	 * `ignore_user_info` must remain. And `access_token` is a niche, non-spec
+	 * compliant edge case. So it's use is rare, and should not be advised.
+	 */
 	readonly ignore_user_info: boolean;
+	/**
+	 * UserInfoFromAccessToken as mentioned above is an edge case. This allows
+	 * sourcing the user_info from the access token itself instead of a user_info
+	 * endpoint. This assumes the access token is a valid JWT with a set of claims to
+	 * be merged with the id_token.
+	 */
 	readonly source_user_info_from_access_token: boolean;
 	readonly organization_field: string;
 	readonly organization_mapping: SerpentStruct<Record<string, string[]>>;
@@ -2325,6 +3150,9 @@ export const OptionTypes: OptionType[] = [
 ];
 
 // From codersdk/organizations.go
+/**
+ * Organization is the JSON representation of a Coder organization.
+ */
 export interface Organization extends MinimalOrganization {
 	readonly description: string;
 	readonly created_at: string;
@@ -2378,8 +3206,20 @@ export interface OrganizationProvisionerJobsOptions {
 
 // From codersdk/idpsync.go
 export interface OrganizationSyncSettings {
+	/**
+	 * Field selects the claim field to be used as the created user's
+	 * organizations. If the field is the empty string, then no organization
+	 * updates will ever come from the OIDC provider.
+	 */
 	readonly field: string;
+	/**
+	 * Mapping maps from an OIDC claim --> Coder organization uuid
+	 */
 	readonly mapping: Record<string, string[]>;
+	/**
+	 * AssignDefault will ensure the default org is always included
+	 * for every user, regardless of their claims. This preserves legacy behavior.
+	 */
 	readonly organization_assign_default: boolean;
 }
 
@@ -2396,9 +3236,30 @@ export interface PaginatedMembersResponse {
 }
 
 // From codersdk/pagination.go
+/**
+ * Pagination sets pagination options for the endpoints that support it.
+ */
 export interface Pagination {
+	/**
+	 * AfterID returns all or up to Limit results after the given
+	 * UUID. This option can be used with or as an alternative to
+	 * Offset for better performance. To use it as an alternative,
+	 * set AfterID to the last UUID returned by the previous
+	 * request.
+	 */
 	readonly after_id?: string;
+	/**
+	 * Limit sets the maximum number of users to be returned
+	 * in a single page. If the limit is <= 0, there is no limit
+	 * and all users are returned.
+	 */
 	readonly limit?: number;
+	/**
+	 * Offset is used to indicate which page to return. An offset of 0
+	 * returns the first 'limit' number of users.
+	 * To get the next page, use offset=<limit>*<page_number>.
+	 * Offset is 0 indexed, so the first record sits at offset 0.
+	 */
 	readonly offset?: number;
 }
 
@@ -2438,6 +3299,9 @@ export interface PatchGroupIDPSyncConfigRequest {
 }
 
 // From codersdk/idpsync.go
+/**
+ * If the same mapping is present in both Add and Remove, Remove will take presidence.
+ */
 export interface PatchGroupIDPSyncMappingRequest {
 	readonly Add: readonly IDPSyncMapping<string>[];
 	readonly Remove: readonly IDPSyncMapping<string>[];
@@ -2460,6 +3324,9 @@ export interface PatchOrganizationIDPSyncConfigRequest {
 }
 
 // From codersdk/idpsync.go
+/**
+ * If the same mapping is present in both Add and Remove, Remove will take presidence.
+ */
 export interface PatchOrganizationIDPSyncMappingRequest {
 	readonly Add: readonly IDPSyncMapping<string>[];
 	readonly Remove: readonly IDPSyncMapping<string>[];
@@ -2471,6 +3338,9 @@ export interface PatchRoleIDPSyncConfigRequest {
 }
 
 // From codersdk/idpsync.go
+/**
+ * If the same mapping is present in both Add and Remove, Remove will take presidence.
+ */
 export interface PatchRoleIDPSyncMappingRequest {
 	readonly Add: readonly IDPSyncMapping<string>[];
 	readonly Remove: readonly IDPSyncMapping<string>[];
@@ -2492,10 +3362,21 @@ export interface PatchWorkspaceProxy {
 }
 
 // From codersdk/client.go
+/**
+ * PathAppSessionTokenCookie is the name of the cookie that stores an
+ * application-scoped API token on workspace proxy path app domains.
+ *nolint:gosec
+ */
 export const PathAppSessionTokenCookie = "coder_path_app_session_token";
 
 // From codersdk/roles.go
+/**
+ * Permission is the format passed into the rego.
+ */
 export interface Permission {
+	/**
+	 * Negate makes this a negative permission
+	 */
 	readonly negate: boolean;
 	readonly resource_type: RBACResource;
 	readonly action: RBACAction;
@@ -2527,9 +3408,26 @@ export interface PprofConfig {
 
 // From codersdk/deployment.go
 export interface PrebuildsConfig {
+	/**
+	 * ReconciliationInterval defines how often the workspace prebuilds state should be reconciled.
+	 */
 	readonly reconciliation_interval: number;
+	/**
+	 * ReconciliationBackoffInterval specifies the amount of time to increase the backoff interval
+	 * when errors occur during reconciliation.
+	 */
 	readonly reconciliation_backoff_interval: number;
+	/**
+	 * ReconciliationBackoffLookback determines the time window to look back when calculating
+	 * the number of failed prebuilds, which influences the backoff strategy.
+	 */
 	readonly reconciliation_backoff_lookback: number;
+	/**
+	 * FailureHardLimit defines the maximum number of consecutive failed prebuild attempts allowed
+	 * before a preset is considered to be in a hard limit state. When a preset hits this limit,
+	 * no new prebuilds will be created until the limit is reset.
+	 * FailureHardLimit is disabled when set to zero.
+	 */
 	readonly failure_hard_limit: number;
 }
 
@@ -2575,6 +3473,9 @@ export interface PreviewParameterData {
 	readonly options: readonly PreviewParameterOption[];
 	readonly validations: readonly PreviewParameterValidation[];
 	readonly required: boolean;
+	/**
+	 * legacy_variable_name was removed (= 14)
+	 */
 	readonly order: number;
 	readonly ephemeral: boolean;
 }
@@ -2598,6 +3499,9 @@ export interface PreviewParameterStyling {
 // From codersdk/parameters.go
 export interface PreviewParameterValidation {
 	readonly validation_error: string;
+	/**
+	 * All validation attributes are optional.
+	 */
 	readonly validation_regex: string | null;
 	readonly validation_min: number | null;
 	readonly validation_max: number | null;
@@ -2615,6 +3519,9 @@ export interface PrometheusConfig {
 
 // From codersdk/deployment.go
 export interface ProvisionerConfig {
+	/**
+	 * Daemons is the number of built-in terraform provisioners.
+	 */
 	readonly daemons: number;
 	readonly daemon_types: string;
 	readonly daemon_poll_interval: number;
@@ -2635,6 +3542,9 @@ export interface ProvisionerDaemon {
 	readonly api_version: string;
 	readonly provisioners: readonly ProvisionerType[];
 	readonly tags: Record<string, string>;
+	/**
+	 * Optional fields.
+	 */
 	readonly key_name: string | null;
 	readonly status: ProvisionerDaemonStatus | null;
 	readonly current_job: ProvisionerDaemonJob | null;
@@ -2651,9 +3561,15 @@ export interface ProvisionerDaemonJob {
 }
 
 // From codersdk/client.go
+/**
+ * ProvisionerDaemonKey contains the authentication key for an external provisioner daemon
+ */
 export const ProvisionerDaemonKey = "Coder-Provisioner-Daemon-Key";
 
 // From codersdk/client.go
+/**
+ * ProvisionerDaemonPSK contains the authentication pre-shared key for an external provisioner daemon
+ */
 export const ProvisionerDaemonPSK = "Coder-Provisioner-Daemon-PSK";
 
 // From codersdk/provisionerdaemons.go
@@ -2666,6 +3582,9 @@ export const ProvisionerDaemonStatuses: ProvisionerDaemonStatus[] = [
 ];
 
 // From healthsdk/healthsdk.go
+/**
+ * ProvisionerDaemonsReport includes health details of each connected provisioner daemon.
+ */
 export interface ProvisionerDaemonsReport extends BaseReport {
 	readonly items: readonly ProvisionerDaemonsReportItem[];
 }
@@ -2677,6 +3596,9 @@ export interface ProvisionerDaemonsReportItem {
 }
 
 // From codersdk/provisionerdaemons.go
+/**
+ * ProvisionerJob describes the job executed by the provisioning daemon.
+ */
 export interface ProvisionerJob {
 	readonly id: string;
 	readonly created_at: string;
@@ -2702,6 +3624,9 @@ export interface ProvisionerJob {
 }
 
 // From codersdk/provisionerdaemons.go
+/**
+ * ProvisionerJobInput represents the input for the job.
+ */
 export interface ProvisionerJobInput {
 	readonly template_version_id?: string;
 	readonly workspace_build_id?: string;
@@ -2709,6 +3634,9 @@ export interface ProvisionerJobInput {
 }
 
 // From codersdk/provisionerdaemons.go
+/**
+ * ProvisionerJobLog represents the provisioner log entry annotated with source and level.
+ */
 export interface ProvisionerJobLog {
 	readonly id: number;
 	readonly created_at: string;
@@ -2719,6 +3647,9 @@ export interface ProvisionerJobLog {
 }
 
 // From codersdk/provisionerdaemons.go
+/**
+ * ProvisionerJobMetadata contains metadata for the job.
+ */
 export interface ProvisionerJobMetadata {
 	readonly template_version_name: string;
 	readonly template_id: string;
@@ -2824,8 +3755,19 @@ export type ProvisionerType = "echo" | "terraform";
 export const ProvisionerTypes: ProvisionerType[] = ["echo", "terraform"];
 
 // From codersdk/workspaceproxy.go
+/**
+ * ProxyHealthReport is a report of the health of the workspace proxy.
+ * A healthy report will have no errors. Warnings are not fatal.
+ */
 export interface ProxyHealthReport {
+	/**
+	 * Errors are problems that prevent the workspace proxy from being healthy
+	 */
 	readonly errors: readonly string[];
+	/**
+	 * Warnings do not prevent the workspace proxy from being healthy, but
+	 * should be addressed.
+	 */
 	readonly warnings: readonly string[];
 }
 
@@ -2844,6 +3786,10 @@ export const ProxyHealthStatuses: ProxyHealthStatus[] = [
 ];
 
 // From codersdk/workspaces.go
+/**
+ * PutExtendWorkspaceRequest is a request to extend the deadline of
+ * the active workspace build.
+ */
 export interface PutExtendWorkspaceRequest {
 	readonly deadline: string;
 }
@@ -2990,6 +3936,12 @@ export interface RateLimitConfig {
 }
 
 // From codersdk/users.go
+/**
+ * ReducedUser omits role and organization information. Roles are deduced from
+ * the user's site and organization roles. This requires fetching the user's
+ * organizational memberships. Fetching that is more expensive, and not usually
+ * required by the frontend.
+ */
 export interface ReducedUser extends MinimalUser {
 	readonly name?: string;
 	readonly email: string;
@@ -2998,6 +3950,10 @@ export interface ReducedUser extends MinimalUser {
 	readonly last_seen_at?: string;
 	readonly status: UserStatus;
 	readonly login_type: LoginType;
+	/**
+	 * Deprecated: this value should be retrieved from
+	 * `codersdk.UserPreferenceSettings` instead.
+	 */
 	readonly theme_preference?: string;
 }
 
@@ -3008,7 +3964,18 @@ export interface Region {
 	readonly display_name: string;
 	readonly icon_url: string;
 	readonly healthy: boolean;
+	/**
+	 * PathAppURL is the URL to the base path for path apps. Optional
+	 * unless wildcard_hostname is set.
+	 * E.g. https://us.example.com
+	 */
 	readonly path_app_url: string;
+	/**
+	 * WildcardHostname is the wildcard hostname for subdomain apps.
+	 * E.g. *.us.example.com
+	 * E.g. *--suffix.au.example.com
+	 * Optional. Does not need to be on the same domain as PathAppURL.
+	 */
 	readonly wildcard_hostname: string;
 }
 
@@ -3022,16 +3989,40 @@ export interface RegionsResponse<R extends RegionTypes> {
 
 // From codersdk/replicas.go
 export interface Replica {
+	/**
+	 * ID is the unique identifier for the replica.
+	 */
 	readonly id: string;
+	/**
+	 * Hostname is the hostname of the replica.
+	 */
 	readonly hostname: string;
+	/**
+	 * CreatedAt is the timestamp when the replica was first seen.
+	 */
 	readonly created_at: string;
+	/**
+	 * RelayAddress is the accessible address to relay DERP connections.
+	 */
 	readonly relay_address: string;
+	/**
+	 * RegionID is the region of the replica.
+	 */
 	readonly region_id: number;
+	/**
+	 * Error is the replica error.
+	 */
 	readonly error: string;
+	/**
+	 * DatabaseLatency is the latency in microseconds to the database.
+	 */
 	readonly database_latency: number;
 }
 
 // From codersdk/users.go
+/**
+ * RequestOneTimePasscodeRequest enables callers to request a one-time-passcode to change their password.
+ */
 export interface RequestOneTimePasscodeRequest {
 	readonly email: string;
 }
@@ -3100,76 +4091,165 @@ export const ResourceTypes: ResourceType[] = [
 ];
 
 // From codersdk/client.go
+/**
+ * Response represents a generic HTTP response.
+ */
 export interface Response {
+	/**
+	 * Message is an actionable message that depicts actions the request took.
+	 * These messages should be fully formed sentences with proper punctuation.
+	 * Examples:
+	 * - "A user has been created."
+	 * - "Failed to create a user."
+	 */
 	readonly message: string;
+	/**
+	 * Detail is a debug message that provides further insight into why the
+	 * action failed. This information can be technical and a regular golang
+	 * err.Error() text.
+	 * - "database: too many open connections"
+	 * - "stat: too many open files"
+	 */
 	readonly detail?: string;
+	/**
+	 * Validations are form field-specific friendly error messages. They will be
+	 * shown on a form field in the UI. These can also be used to add additional
+	 * context if there is a set of errors in the primary 'Message'.
+	 */
 	readonly validations?: readonly ValidationError[];
 }
 
 // From codersdk/roles.go
+/**
+ * Role is a longer form of SlimRole that includes permissions details.
+ */
 export interface Role {
 	readonly name: string;
 	readonly organization_id?: string;
 	readonly display_name: string;
 	readonly site_permissions: readonly Permission[];
+	/**
+	 * OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.
+	 */
 	readonly organization_permissions: readonly Permission[];
 	readonly user_permissions: readonly Permission[];
 }
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleAuditor = "auditor";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleMember = "member";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOrganizationAdmin = "organization-admin";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOrganizationAuditor = "organization-auditor";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOrganizationMember = "organization-member";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOrganizationTemplateAdmin = "organization-template-admin";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOrganizationUserAdmin = "organization-user-admin";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOrganizationWorkspaceCreationBan =
 	"organization-workspace-creation-ban";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleOwner = "owner";
 
 // From codersdk/idpsync.go
 export interface RoleSyncSettings {
+	/**
+	 * Field is the name of the claim field that specifies what organization roles
+	 * a user should be given. If empty, no roles will be synced.
+	 */
 	readonly field: string;
+	/**
+	 * Mapping is a map from OIDC groups to Coder organization roles.
+	 */
 	readonly mapping: Record<string, string[]>;
 }
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleTemplateAdmin = "template-admin";
 
 // From codersdk/rbacroles.go
+/**
+ * Ideally this roles would be generated from the rbac/roles.go package.
+ */
 export const RoleUserAdmin = "user-admin";
 
 // From codersdk/deployment.go
+/**
+ * SSHConfig is configuration the cli & vscode extension use for configuring
+ * ssh connections.
+ */
 export interface SSHConfig {
+	/**
+	 * DeploymentName is the config-ssh Hostname prefix
+	 */
 	readonly DeploymentName: string;
+	/**
+	 * SSHConfigOptions are additional options to add to the ssh config file.
+	 * This will override defaults.
+	 */
 	readonly SSHConfigOptions: string;
 }
 
 // From codersdk/deployment.go
 export interface SSHConfigResponse {
+	/**
+	 * HostnamePrefix is the prefix we append to workspace names for SSH hostnames.
+	 * Deprecated: use HostnameSuffix instead.
+	 */
 	readonly hostname_prefix: string;
+	/**
+	 * HostnameSuffix is the suffix to append to workspace names for SSH hostnames.
+	 */
 	readonly hostname_suffix: string;
 	readonly ssh_config_options: Record<string, string>;
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * STUNReport contains information about a given node's STUN capabilities.
+ */
 export interface STUNReport {
 	readonly Enabled: boolean;
 	readonly CanSTUN: boolean;
@@ -3177,9 +4257,16 @@ export interface STUNReport {
 }
 
 // From serpent/serpent.go
+/**
+ * Annotations is an arbitrary key-mapping used to extend the Option and Command types.
+ * Its methods won't panic if the map is nil.
+ */
 export type SerpentAnnotations = Record<string, string>;
 
 // From serpent/serpent.go
+/**
+ * Group describes a hierarchy of groups that an option or command belongs to.
+ */
 export interface SerpentGroup {
 	readonly parent?: SerpentGroup;
 	readonly name?: string;
@@ -3188,26 +4275,71 @@ export interface SerpentGroup {
 }
 
 // From serpent/option.go
+/**
+ * Option is a configuration option for a CLI application.
+ */
 export interface SerpentOption {
 	readonly name?: string;
 	readonly description?: string;
+	/**
+	 * Required means this value must be set by some means. It requires
+	 * `ValueSource != ValueSourceNone`
+	 * If `Default` is set, then `Required` is ignored.
+	 */
 	readonly required?: boolean;
+	/**
+	 * Flag is the long name of the flag used to configure this option. If unset,
+	 * flag configuring is disabled.
+	 */
 	readonly flag?: string;
+	/**
+	 * FlagShorthand is the one-character shorthand for the flag. If unset, no
+	 * shorthand is used.
+	 */
 	readonly flag_shorthand?: string;
+	/**
+	 * Env is the environment variable used to configure this option. If unset,
+	 * environment configuring is disabled.
+	 */
 	readonly env?: string;
+	/**
+	 * YAML is the YAML key used to configure this option. If unset, YAML
+	 * configuring is disabled.
+	 */
 	readonly yaml?: string;
+	/**
+	 * Default is parsed into Value if set.
+	 */
 	readonly default?: string;
+	/**
+	 * Value includes the types listed in values.go.
+	 */
 	// interface type, falling back to unknown
 	// this is likely an enum in an external package "github.com/spf13/pflag.Value"
 	readonly value?: unknown;
+	/**
+	 * Annotations enable extensions to serpent higher up in the stack. It's useful for
+	 * help formatting and documentation generation.
+	 */
 	readonly annotations?: SerpentAnnotations;
+	/**
+	 * Group is a group hierarchy that helps organize this option in help, configs
+	 * and other documentation.
+	 */
 	readonly group?: SerpentGroup;
+	/**
+	 * UseInstead is a list of options that should be used instead of this one.
+	 * The field is used to generate a deprecation warning.
+	 */
 	readonly use_instead?: readonly SerpentOption[];
 	readonly hidden?: boolean;
 	readonly value_source?: SerpentValueSource;
 }
 
 // From serpent/option.go
+/**
+ * OptionSet is a group of options that can be applied to a command.
+ */
 export type SerpentOptionSet = readonly SerpentOption[];
 
 // From serpent/values.go
@@ -3217,8 +4349,26 @@ export type SerpentStruct<T> = T;
 export type SerpentValueSource = string;
 
 // From derp/derp_client.go
+/**
+ * ServerInfoMessage is sent by the server upon first connect.
+ */
 export interface ServerInfoMessage {
+	/**
+	 * TokenBucketBytesPerSecond is how many bytes per second the
+	 * server says it will accept, including all framing bytes.
+	 *
+	 * Zero means unspecified. There might be a limit, but the
+	 * client need not try to respect it.
+	 */
 	readonly TokenBucketBytesPerSecond: number;
+	/**
+	 * TokenBucketBytesBurst is how many bytes the server will
+	 * allow to burst, temporarily violating
+	 * TokenBucketBytesPerSecond.
+	 *
+	 * Zero means unspecified. There might be a limit, but the
+	 * client need not try to respect it.
+	 */
 	readonly TokenBucketBytesBurst: number;
 }
 
@@ -3239,6 +4389,9 @@ export const ServerSentEventTypes: ServerSentEventType[] = [
 ];
 
 // From codersdk/deployment.go
+/**
+ * Deprecated: ServiceBannerConfig has been renamed to BannerConfig.
+ */
 export interface ServiceBannerConfig {
 	readonly enabled: boolean;
 	readonly message?: string;
@@ -3254,9 +4407,39 @@ export interface SessionCountDeploymentStats {
 }
 
 // From codersdk/deployment.go
+/**
+ * SessionLifetime refers to "sessions" authenticating into Coderd. Coder has
+ * multiple different session types: api keys, tokens, workspace app tokens,
+ * agent tokens, etc. This configuration struct should be used to group all
+ * settings referring to any of these session lifetime controls.
+ * TODO: These config options were created back when coder only had api keys.
+ * Today, the config is ambigously used for all of them. For example:
+ * - cli based api keys ignore all settings
+ * - login uses the default lifetime, not the MaximumTokenDuration
+ * - Tokens use the Default & MaximumTokenDuration
+ * - ... etc ...
+ * The rational behind each decision is undocumented. The naming behind these
+ * config options is also confusing without any clear documentation.
+ * 'CreateAPIKey' is used to make all sessions, and it's parameters are just
+ * 'LifetimeSeconds' and 'DefaultLifetime'. Which does not directly correlate to
+ * the config options here.
+ */
 export interface SessionLifetime {
+	/**
+	 * DisableExpiryRefresh will disable automatically refreshing api
+	 * keys when they are used from the api. This means the api key lifetime at
+	 * creation is the lifetime of the api key.
+	 */
 	readonly disable_expiry_refresh?: boolean;
+	/**
+	 * DefaultDuration is only for browser, workspace app and oauth sessions.
+	 */
 	readonly default_duration: number;
+	/**
+	 * RefreshDefaultDuration is the default lifetime for OAuth2 refresh tokens.
+	 * This should generally be longer than access token lifetimes to allow
+	 * refreshing after access token expiry.
+	 */
 	readonly refresh_default_duration?: number;
 	readonly default_token_lifetime?: number;
 	readonly max_token_lifetime?: number;
@@ -3264,15 +4447,39 @@ export interface SessionLifetime {
 }
 
 // From codersdk/client.go
+/**
+ * SessionTokenHeader is the custom header to use for authentication.
+ */
 export const SessionTokenHeader = "Coder-Session-Token";
 
 // From codersdk/client.go
+/**
+ * SignedAppTokenCookie is the name of the cookie that stores a temporary
+ * JWT that can be used to authenticate instead of the app session token.
+ *nolint:gosec
+ */
 export const SignedAppTokenCookie = "coder_signed_app_token";
 
 // From codersdk/client.go
+/**
+ * SignedAppTokenQueryParameter is the name of the query parameter that
+ * stores a temporary JWT that can be used to authenticate instead of the
+ * session token. This is only acceptable on reconnecting-pty requests, not
+ * apps.
+ *
+ * It has a random suffix to avoid conflict with user query parameters on
+ * apps.
+ *nolint:gosec
+ */
 export const SignedAppTokenQueryParameter = "coder_signed_app_token_23db1dde";
 
 // From codersdk/roles.go
+/**
+ * SlimRole omits permission information from a role.
+ * At present, this is because our apis do not return permission information,
+ * and it would require extra db calls to fetch this information. The UI does
+ * not need it, so most api calls will use this structure that omits information.
+ */
 export interface SlimRole {
 	readonly name: string;
 	readonly display_name: string;
@@ -3280,6 +4487,15 @@ export interface SlimRole {
 }
 
 // From codersdk/client.go
+/**
+ * SubdomainAppSessionTokenCookie is the name of the cookie that stores an
+ * application-scoped API token on subdomain app domains (both the primary
+ * and proxies).
+ *
+ * To avoid conflicts between multiple proxies, we append an underscore and
+ * a hash suffix to the cookie name.
+ *nolint:gosec
+ */
 export const SubdomainAppSessionTokenCookie =
 	"coder_subdomain_app_session_token";
 
@@ -3310,33 +4526,165 @@ export interface TLSConfig {
 }
 
 // From tailcfg/derpmap.go
+/**
+ * DERPNode describes a DERP packet relay node running within a DERPRegion.
+ */
 export interface TailDERPNode {
+	/**
+	 * Name is a unique node name (across all regions).
+	 * It is not a host name.
+	 * It's typically of the form "1b", "2a", "3b", etc. (region
+	 * ID + suffix within that region)
+	 */
 	readonly Name: string;
+	/**
+	 * RegionID is the RegionID of the DERPRegion that this node
+	 * is running in.
+	 */
 	readonly RegionID: number;
+	/**
+	 * HostName is the DERP node's hostname.
+	 *
+	 * It is required but need not be unique; multiple nodes may
+	 * have the same HostName but vary in configuration otherwise.
+	 */
 	readonly HostName: string;
+	/**
+	 * CertName optionally specifies the expected TLS cert common
+	 * name. If empty, HostName is used. If CertName is non-empty,
+	 * HostName is only used for the TCP dial (if IPv4/IPv6 are
+	 * not present) + TLS ClientHello.
+	 */
 	readonly CertName?: string;
+	/**
+	 * IPv4 optionally forces an IPv4 address to use, instead of using DNS.
+	 * If empty, A record(s) from DNS lookups of HostName are used.
+	 * If the string is not an IPv4 address, IPv4 is not used; the
+	 * conventional string to disable IPv4 (and not use DNS) is
+	 * "none".
+	 */
 	readonly IPv4?: string;
+	/**
+	 * IPv6 optionally forces an IPv6 address to use, instead of using DNS.
+	 * If empty, AAAA record(s) from DNS lookups of HostName are used.
+	 * If the string is not an IPv6 address, IPv6 is not used; the
+	 * conventional string to disable IPv6 (and not use DNS) is
+	 * "none".
+	 */
 	readonly IPv6?: string;
+	/**
+	 * Port optionally specifies a STUN port to use.
+	 * Zero means 3478.
+	 * To disable STUN on this node, use -1.
+	 */
 	readonly STUNPort?: number;
+	/**
+	 * STUNOnly marks a node as only a STUN server and not a DERP
+	 * server.
+	 */
 	readonly STUNOnly?: boolean;
+	/**
+	 * DERPPort optionally provides an alternate TLS port number
+	 * for the DERP HTTPS server.
+	 *
+	 * If zero, 443 is used.
+	 */
 	readonly DERPPort?: number;
+	/**
+	 * InsecureForTests is used by unit tests to disable TLS verification.
+	 * It should not be set by users.
+	 */
 	readonly InsecureForTests?: boolean;
+	/**
+	 * ForceHTTP is used by unit tests to force HTTP.
+	 * It should not be set by users.
+	 */
 	readonly ForceHTTP?: boolean;
+	/**
+	 * STUNTestIP is used in tests to override the STUN server's IP.
+	 * If empty, it's assumed to be the same as the DERP server.
+	 */
 	readonly STUNTestIP?: string;
+	/**
+	 * CanPort80 specifies whether this DERP node is accessible over HTTP
+	 * on port 80 specifically. This is used for captive portal checks.
+	 */
 	readonly CanPort80?: boolean;
 }
 
 // From tailcfg/derpmap.go
+/**
+ * DERPRegion is a geographic region running DERP relay node(s).
+ *
+ * Client nodes discover which region they're closest to, advertise
+ * that "home" DERP region (previously called "home node", when there
+ * was only 1 node per region) and maintain a persistent connection
+ * that region as long as it's the closest. Client nodes will further
+ * connect to other regions as necessary to communicate with peers
+ * advertising other regions as their homes.
+ */
 export interface TailDERPRegion {
+	/**
+	 * EmbeddedRelay is true when the region is bundled with the Coder
+	 * control plane.
+	 */
 	readonly EmbeddedRelay: boolean;
+	/**
+	 * RegionID is a unique integer for a geographic region.
+	 *
+	 * It corresponds to the legacy derpN.tailscale.com hostnames
+	 * used by older clients. (Older clients will continue to resolve
+	 * derpN.tailscale.com when contacting peers, rather than use
+	 * the server-provided DERPMap)
+	 *
+	 * RegionIDs must be non-zero, positive, and guaranteed to fit
+	 * in a JavaScript number.
+	 *
+	 * RegionIDs in range 900-999 are reserved for end users to run their
+	 * own DERP nodes.
+	 */
 	readonly RegionID: number;
+	/**
+	 * RegionCode is a short name for the region. It's usually a popular
+	 * city or airport code in the region: "nyc", "sf", "sin",
+	 * "fra", etc.
+	 */
 	readonly RegionCode: string;
+	/**
+	 * RegionName is a long English name for the region: "New York City",
+	 * "San Francisco", "Singapore", "Frankfurt", etc.
+	 */
 	readonly RegionName: string;
+	/**
+	 * Avoid is whether the client should avoid picking this as its home
+	 * region. The region should only be used if a peer is there.
+	 * Clients already using this region as their home should migrate
+	 * away to a new region without Avoid set.
+	 */
 	readonly Avoid?: boolean;
+	/**
+	 * Nodes are the DERP nodes running in this region, in
+	 * priority order for the current client. Client TLS
+	 * connections should ideally only go to the first entry
+	 * (falling back to the second if necessary). STUN packets
+	 * should go to the first 1 or 2.
+	 *
+	 * If nodes within a region route packets amongst themselves,
+	 * but not to other regions. That said, each user/domain
+	 * should get a the same preferred node order, so if all nodes
+	 * for a user/network pick the first one (as they should, when
+	 * things are healthy), the inter-cluster routing is minimal
+	 * to zero.
+	 */
 	readonly Nodes: readonly TailDERPNode[];
 }
 
 // From codersdk/aitasks.go
+/**
+ * Task represents a task.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface Task {
 	readonly id: string;
 	readonly organization_id: string;
@@ -3361,6 +4709,11 @@ export interface Task {
 }
 
 // From codersdk/aitasks.go
+/**
+ * TaskLogEntry represents a single log entry for a task.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface TaskLogEntry {
 	readonly id: number;
 	readonly content: string;
@@ -3374,11 +4727,21 @@ export type TaskLogType = "input" | "output";
 export const TaskLogTypes: TaskLogType[] = ["input", "output"];
 
 // From codersdk/aitasks.go
+/**
+ * TaskLogsResponse contains the logs for a task.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface TaskLogsResponse {
 	readonly logs: readonly TaskLogEntry[];
 }
 
 // From codersdk/aitasks.go
+/**
+ * TaskSendRequest is used to send task input to the tasks sidebar app.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface TaskSendRequest {
 	readonly input: string;
 }
@@ -3387,6 +4750,11 @@ export interface TaskSendRequest {
 export type TaskState = "complete" | "failed" | "idle" | "working";
 
 // From codersdk/aitasks.go
+/**
+ * TaskStateEntry represents a single entry in the task's state history.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface TaskStateEntry {
 	readonly timestamp: string;
 	readonly state: TaskState;
@@ -3402,7 +4770,15 @@ export const TaskStates: TaskState[] = [
 ];
 
 // From codersdk/aitasks.go
+/**
+ * TasksFilter filters the list of tasks.
+ *
+ * Experimental: This type is experimental and may change in the future.
+ */
 export interface TasksFilter {
+	/**
+	 * Owner can be a username, UUID, or "me".
+	 */
 	readonly owner?: string;
 }
 
@@ -3414,6 +4790,10 @@ export interface TelemetryConfig {
 }
 
 // From codersdk/templates.go
+/**
+ * Template is the JSON representation of a Coder template. This type matches the
+ * database object for now, but is abstracted for ease of change later on.
+ */
 export interface Template {
 	readonly id: string;
 	readonly created_at: string;
@@ -3426,6 +4806,9 @@ export interface Template {
 	readonly display_name: string;
 	readonly provisioner: ProvisionerType;
 	readonly active_version_id: string;
+	/**
+	 * ActiveUserCount is set to -1 when loading.
+	 */
 	readonly active_user_count: number;
 	readonly build_time_stats: TemplateBuildTimeStats;
 	readonly description: string;
@@ -3434,16 +4817,35 @@ export interface Template {
 	readonly icon: string;
 	readonly default_ttl_ms: number;
 	readonly activity_bump_ms: number;
+	/**
+	 * AutostopRequirement and AutostartRequirement are enterprise features. Its
+	 * value is only used if your license is entitled to use the advanced template
+	 * scheduling feature.
+	 */
 	readonly autostop_requirement: TemplateAutostopRequirement;
 	readonly autostart_requirement: TemplateAutostartRequirement;
 	readonly created_by_id: string;
 	readonly created_by_name: string;
+	/**
+	 * AllowUserAutostart and AllowUserAutostop are enterprise-only. Their
+	 * values are only used if your license is entitled to use the advanced
+	 * template scheduling feature.
+	 */
 	readonly allow_user_autostart: boolean;
 	readonly allow_user_autostop: boolean;
 	readonly allow_user_cancel_workspace_jobs: boolean;
+	/**
+	 * FailureTTLMillis, TimeTilDormantMillis, and TimeTilDormantAutoDeleteMillis are enterprise-only. Their
+	 * values are used if your license is entitled to use the advanced
+	 * template scheduling feature.
+	 */
 	readonly failure_ttl_ms: number;
 	readonly time_til_dormant_ms: number;
 	readonly time_til_dormant_autodelete_ms: number;
+	/**
+	 * RequireActiveVersion mandates that workspaces are built with the active
+	 * template version.
+	 */
 	readonly require_active_version: boolean;
 	readonly max_port_share_level: WorkspaceAgentPortShareLevel;
 	readonly cors_behavior: CORSBehavior;
@@ -3457,6 +4859,9 @@ export interface TemplateACL {
 }
 
 // From codersdk/insights.go
+/**
+ * TemplateAppUsage shows the usage of an app for one or more templates.
+ */
 export interface TemplateAppUsage {
 	readonly template_ids: readonly string[];
 	readonly type: TemplateAppsType;
@@ -3474,12 +4879,32 @@ export const TemplateAppsTypes: TemplateAppsType[] = ["app", "builtin"];
 
 // From codersdk/templates.go
 export interface TemplateAutostartRequirement {
+	/**
+	 * DaysOfWeek is a list of days of the week in which autostart is allowed
+	 * to happen. If no days are specified, autostart is not allowed.
+	 */
 	readonly days_of_week: readonly string[];
 }
 
 // From codersdk/templates.go
 export interface TemplateAutostopRequirement {
+	/**
+	 * DaysOfWeek is a list of days of the week on which restarts are required.
+	 * Restarts happen within the user's quiet hours (in their configured
+	 * timezone). If no days are specified, restarts are not required. Weekdays
+	 * cannot be specified twice.
+	 *
+	 * Restarts will only happen on weekdays in this list on weeks which line up
+	 * with Weeks.
+	 */
 	readonly days_of_week: readonly string[];
+	/**
+	 * Weeks is the number of weeks between required restarts. Weeks are synced
+	 * across all workspaces (and Coder deployments) using modulo math on a
+	 * hardcoded epoch week of January 2nd, 2023 (the first Monday of 2023).
+	 * Values of 0 or 1 indicate weekly restarts. Values of 2 indicate
+	 * fortnightly restarts, etc.
+	 */
 	readonly weeks: number;
 }
 
@@ -3490,18 +4915,33 @@ export type TemplateBuildTimeStats = Record<
 >;
 
 // From codersdk/insights.go
+/**
+ * Enums define the display name of the builtin app reported.
+ */
 export const TemplateBuiltinAppDisplayNameJetBrains = "JetBrains";
 
 // From codersdk/insights.go
+/**
+ * Enums define the display name of the builtin app reported.
+ */
 export const TemplateBuiltinAppDisplayNameSFTP = "SFTP";
 
 // From codersdk/insights.go
+/**
+ * Enums define the display name of the builtin app reported.
+ */
 export const TemplateBuiltinAppDisplayNameSSH = "SSH";
 
 // From codersdk/insights.go
+/**
+ * Enums define the display name of the builtin app reported.
+ */
 export const TemplateBuiltinAppDisplayNameVSCode = "Visual Studio Code";
 
 // From codersdk/insights.go
+/**
+ * Enums define the display name of the builtin app reported.
+ */
 export const TemplateBuiltinAppDisplayNameWebTerminal = "Web Terminal";
 
 // From codersdk/templates.go
@@ -3526,6 +4966,10 @@ export interface TemplateGroup extends Group {
 }
 
 // From codersdk/insights.go
+/**
+ * TemplateInsightsIntervalReport is the report from the template insights
+ * endpoint for a specific interval.
+ */
 export interface TemplateInsightsIntervalReport {
 	readonly start_time: string;
 	readonly end_time: string;
@@ -3535,6 +4979,9 @@ export interface TemplateInsightsIntervalReport {
 }
 
 // From codersdk/insights.go
+/**
+ * TemplateInsightsReport is the report from the template insights endpoint.
+ */
 export interface TemplateInsightsReport {
 	readonly start_time: string;
 	readonly end_time: string;
@@ -3554,6 +5001,9 @@ export interface TemplateInsightsRequest {
 }
 
 // From codersdk/insights.go
+/**
+ * TemplateInsightsResponse is the response from the template insights endpoint.
+ */
 export interface TemplateInsightsResponse {
 	readonly report?: TemplateInsightsReport;
 	readonly interval_reports?: readonly TemplateInsightsIntervalReport[];
@@ -3568,6 +5018,10 @@ export const TemplateInsightsSections: TemplateInsightsSection[] = [
 ];
 
 // From codersdk/insights.go
+/**
+ * TemplateParameterUsage shows the usage of a parameter for one or more
+ * templates.
+ */
 export interface TemplateParameterUsage {
 	readonly template_ids: readonly string[];
 	readonly display_name: string;
@@ -3579,6 +5033,10 @@ export interface TemplateParameterUsage {
 }
 
 // From codersdk/insights.go
+/**
+ * TemplateParameterValue shows the usage of a parameter value for one or more
+ * templates.
+ */
 export interface TemplateParameterValue {
 	readonly value: string;
 	readonly count: number;
@@ -3595,6 +5053,9 @@ export interface TemplateUser extends User {
 }
 
 // From codersdk/templateversions.go
+/**
+ * TemplateVersion represents a single version of a template.
+ */
 export interface TemplateVersion {
 	readonly id: string;
 	readonly template_id?: string;
@@ -3624,12 +5085,19 @@ export interface TemplateVersionExternalAuth {
 }
 
 // From codersdk/templateversions.go
+/**
+ * TemplateVersionParameter represents a parameter for a template version.
+ */
 export interface TemplateVersionParameter {
 	readonly name: string;
 	readonly display_name?: string;
 	readonly description: string;
 	readonly description_plaintext: string;
 	readonly type: string;
+	/**
+	 * FormType has an enum value of empty string, `""`.
+	 * Keep the leading comma in the enums struct tag.
+	 */
 	readonly form_type: string;
 	readonly mutable: boolean;
 	readonly default_value: string;
@@ -3645,6 +5113,9 @@ export interface TemplateVersionParameter {
 }
 
 // From codersdk/templateversions.go
+/**
+ * TemplateVersionParameterOption represents a selectable option for a template parameter.
+ */
 export interface TemplateVersionParameterOption {
 	readonly name: string;
 	readonly description: string;
@@ -3653,6 +5124,9 @@ export interface TemplateVersionParameterOption {
 }
 
 // From codersdk/templateversions.go
+/**
+ * TemplateVersionVariable represents a managed template variable.
+ */
 export interface TemplateVersionVariable {
 	readonly name: string;
 	readonly description: string;
@@ -3671,6 +5145,10 @@ export const TemplateVersionWarnings: TemplateVersionWarning[] = [
 ];
 
 // From codersdk/templates.go
+/**
+ * TemplateVersionsByTemplateRequest defines the request parameters for
+ * TemplateVersionsByTemplate.
+ */
 export interface TemplateVersionsByTemplateRequest extends Pagination {
 	readonly template_id: string;
 	readonly include_archived: boolean;
@@ -3747,14 +5225,29 @@ export interface UpdateActiveTemplateVersion {
 export interface UpdateAppearanceConfig {
 	readonly application_name: string;
 	readonly logo_url: string;
+	/**
+	 * Deprecated: ServiceBanner has been replaced by AnnouncementBanners.
+	 */
 	readonly service_banner: BannerConfig;
 	readonly announcement_banners: readonly BannerConfig[];
 }
 
 // From codersdk/updatecheck.go
+/**
+ * UpdateCheckResponse contains information on the latest release of Coder.
+ */
 export interface UpdateCheckResponse {
+	/**
+	 * Current indicates whether the server version is the same as the latest.
+	 */
 	readonly current: boolean;
+	/**
+	 * Version is the semantic version for the latest release of Coder.
+	 */
 	readonly version: string;
+	/**
+	 * URL to download the latest release of Coder.
+	 */
 	readonly url: string;
 }
 
@@ -3794,7 +5287,17 @@ export interface UpdateRoles {
 
 // From codersdk/templates.go
 export interface UpdateTemplateACL {
+	/**
+	 * UserPerms is a mapping from valid user UUIDs to the template role they
+	 * should be granted. To remove a user from the template, use "" as the role
+	 * (available as a constant named codersdk.TemplateRoleDeleted)
+	 */
 	readonly user_perms?: Record<string, TemplateRole>;
+	/**
+	 * GroupPerms is a mapping from valid group UUIDs to the template role they
+	 * should be granted. To remove a group from the template, use "" as the role
+	 * (available as a constant named codersdk.TemplateRoleDeleted)
+	 */
 	readonly group_perms?: Record<string, TemplateRole>;
 }
 
@@ -3805,7 +5308,17 @@ export interface UpdateTemplateMeta {
 	readonly description?: string;
 	readonly icon?: string;
 	readonly default_ttl_ms?: number;
+	/**
+	 * ActivityBumpMillis allows optionally specifying the activity bump
+	 * duration for all workspaces created from this template. Defaults to 1h
+	 * but can be set to 0 to disable activity bumping.
+	 */
 	readonly activity_bump_ms?: number;
+	/**
+	 * AutostopRequirement and AutostartRequirement can only be set if your license
+	 * includes the advanced template scheduling feature. If you attempt to set this
+	 * value while unlicensed, it will be ignored.
+	 */
 	readonly autostop_requirement?: TemplateAutostopRequirement;
 	readonly autostart_requirement?: TemplateAutostartRequirement;
 	readonly allow_user_autostart?: boolean;
@@ -3814,13 +5327,49 @@ export interface UpdateTemplateMeta {
 	readonly failure_ttl_ms?: number;
 	readonly time_til_dormant_ms?: number;
 	readonly time_til_dormant_autodelete_ms?: number;
+	/**
+	 * UpdateWorkspaceLastUsedAt updates the last_used_at field of workspaces
+	 * spawned from the template. This is useful for preventing workspaces being
+	 * immediately locked when updating the inactivity_ttl field to a new, shorter
+	 * value.
+	 */
 	readonly update_workspace_last_used_at: boolean;
+	/**
+	 * UpdateWorkspaceDormant updates the dormant_at field of workspaces spawned
+	 * from the template. This is useful for preventing dormant workspaces being immediately
+	 * deleted when updating the dormant_ttl field to a new, shorter value.
+	 */
 	readonly update_workspace_dormant_at: boolean;
+	/**
+	 * RequireActiveVersion mandates workspaces built using this template
+	 * use the active version of the template. This option has no
+	 * effect on template admins.
+	 */
 	readonly require_active_version?: boolean;
+	/**
+	 * DeprecationMessage if set, will mark the template as deprecated and block
+	 * any new workspaces from using this template.
+	 * If passed an empty string, will remove the deprecated message, making
+	 * the template usable for new workspaces again.
+	 */
 	readonly deprecation_message?: string;
+	/**
+	 * DisableEveryoneGroupAccess allows optionally disabling the default
+	 * behavior of granting the 'everyone' group access to use the template.
+	 * If this is set to true, the template will not be available to all users,
+	 * and must be explicitly granted to users or groups in the permissions settings
+	 * of the template.
+	 */
 	readonly disable_everyone_group_access: boolean;
 	readonly max_port_share_level?: WorkspaceAgentPortShareLevel;
 	readonly cors_behavior?: CORSBehavior;
+	/**
+	 * UseClassicParameterFlow is a flag that switches the default behavior to use the classic
+	 * parameter flow when creating a workspace. This only affects deployments with the experiment
+	 * "dynamic-parameters" enabled. This setting will live for a period after the experiment is
+	 * made the default.
+	 * An "opt-out" is present in case the new feature breaks some existing templates.
+	 */
 	readonly use_classic_parameter_flow?: boolean;
 }
 
@@ -3849,26 +5398,64 @@ export interface UpdateUserProfileRequest {
 
 // From codersdk/users.go
 export interface UpdateUserQuietHoursScheduleRequest {
+	/**
+	 * Schedule is a cron expression that defines when the user's quiet hours
+	 * window is. Schedule must not be empty. For new users, the schedule is set
+	 * to 2am in their browser or computer's timezone. The schedule denotes the
+	 * beginning of a 4 hour window where the workspace is allowed to
+	 * automatically stop or restart due to maintenance or template schedule.
+	 *
+	 * The schedule must be daily with a single time, and should have a timezone
+	 * specified via a CRON_TZ prefix (otherwise UTC will be used).
+	 *
+	 * If the schedule is empty, the user will be updated to use the default
+	 * schedule.
+	 */
 	readonly schedule: string;
 }
 
 // From codersdk/workspaces.go
 export interface UpdateWorkspaceACL {
+	/**
+	 * UserRoles is a mapping from valid user UUIDs to the workspace role they
+	 * should be granted. To remove a user from the workspace, use "" as the role
+	 * (available as a constant named codersdk.WorkspaceRoleDeleted)
+	 */
 	readonly user_roles?: Record<string, WorkspaceRole>;
+	/**
+	 * GroupRoles is a mapping from valid group UUIDs to the workspace role they
+	 * should be granted. To remove a group from the workspace, use "" as the role
+	 * (available as a constant named codersdk.WorkspaceRoleDeleted)
+	 */
 	readonly group_roles?: Record<string, WorkspaceRole>;
 }
 
 // From codersdk/workspaces.go
+/**
+ * UpdateWorkspaceAutomaticUpdatesRequest is a request to updates a workspace's automatic updates setting.
+ */
 export interface UpdateWorkspaceAutomaticUpdatesRequest {
 	readonly automatic_updates: AutomaticUpdates;
 }
 
 // From codersdk/workspaces.go
+/**
+ * UpdateWorkspaceAutostartRequest is a request to update a workspace's autostart schedule.
+ */
 export interface UpdateWorkspaceAutostartRequest {
+	/**
+	 * Schedule is expected to be of the form `CRON_TZ=<IANA Timezone> <min> <hour> * * <dow>`
+	 * Example: `CRON_TZ=US/Central 30 9 * * 1-5` represents 0930 in the timezone US/Central
+	 * on weekdays (Mon-Fri). `CRON_TZ` defaults to UTC if not present.
+	 */
 	readonly schedule?: string;
 }
 
 // From codersdk/workspaces.go
+/**
+ * UpdateWorkspaceDormancy is a request to activate or make a workspace dormant.
+ * A value of false will activate a dormant workspace.
+ */
 export interface UpdateWorkspaceDormancy {
 	readonly dormant: boolean;
 }
@@ -3885,11 +5472,17 @@ export interface UpdateWorkspaceRequest {
 }
 
 // From codersdk/workspaces.go
+/**
+ * UpdateWorkspaceTTLRequest is a request to update a workspace's TTL.
+ */
 export interface UpdateWorkspaceTTLRequest {
 	readonly ttl_ms: number | null;
 }
 
 // From codersdk/files.go
+/**
+ * UploadResponse contains the hash to reference the uploaded file.
+ */
 export interface UploadResponse {
 	readonly hash: string;
 }
@@ -3920,12 +5513,18 @@ export interface UsagePeriod {
 }
 
 // From codersdk/users.go
+/**
+ * User represents a user in Coder.
+ */
 export interface User extends ReducedUser {
 	readonly organization_ids: readonly string[];
 	readonly roles: readonly SlimRole[];
 }
 
 // From codersdk/insights.go
+/**
+ * UserActivity shows the session time for a user.
+ */
 export interface UserActivity {
 	readonly template_ids: readonly string[];
 	readonly user_id: string;
@@ -3935,6 +5534,10 @@ export interface UserActivity {
 }
 
 // From codersdk/insights.go
+/**
+ * UserActivityInsightsReport is the report from the user activity insights
+ * endpoint.
+ */
 export interface UserActivityInsightsReport {
 	readonly start_time: string;
 	readonly end_time: string;
@@ -3950,6 +5553,10 @@ export interface UserActivityInsightsRequest {
 }
 
 // From codersdk/insights.go
+/**
+ * UserActivityInsightsResponse is the response from the user activity insights
+ * endpoint.
+ */
 export interface UserActivityInsightsResponse {
 	readonly report: UserActivityInsightsReport;
 }
@@ -3961,6 +5568,9 @@ export interface UserAppearanceSettings {
 }
 
 // From codersdk/insights.go
+/**
+ * UserLatency shows the connection latency for a user.
+ */
 export interface UserLatency {
 	readonly template_ids: readonly string[];
 	readonly user_id: string;
@@ -3970,6 +5580,10 @@ export interface UserLatency {
 }
 
 // From codersdk/insights.go
+/**
+ * UserLatencyInsightsReport is the report from the user latency insights
+ * endpoint.
+ */
 export interface UserLatencyInsightsReport {
 	readonly start_time: string;
 	readonly end_time: string;
@@ -3985,6 +5599,10 @@ export interface UserLatencyInsightsRequest {
 }
 
 // From codersdk/insights.go
+/**
+ * UserLatencyInsightsResponse is the response from the user latency insights
+ * endpoint.
+ */
 export interface UserLatencyInsightsResponse {
 	readonly report: UserLatencyInsightsReport;
 }
@@ -4009,10 +5627,26 @@ export interface UserQuietHoursScheduleConfig {
 // From codersdk/users.go
 export interface UserQuietHoursScheduleResponse {
 	readonly raw_schedule: string;
+	/**
+	 * UserSet is true if the user has set their own quiet hours schedule. If
+	 * false, the user is using the default schedule.
+	 */
 	readonly user_set: boolean;
+	/**
+	 * UserCanSet is true if the user is allowed to set their own quiet hours
+	 * schedule. If false, the user cannot set a custom schedule and the default
+	 * schedule will always be used.
+	 */
 	readonly user_can_set: boolean;
-	readonly time: string;
-	readonly timezone: string;
+	/**
+	 * Time is the time of day that the quiet hours window starts in the given
+	 * Timezone each day.
+	 */
+	readonly time: string; // HH:mm (24-hour)
+	readonly timezone: string; // raw format from the cron expression, UTC if unspecified
+	/**
+	 * Next is the next time that the quiet hours window will start.
+	 */
 	readonly next: string;
 }
 
@@ -4050,6 +5684,9 @@ export interface ValidateUserPasswordResponse {
 }
 
 // From codersdk/client.go
+/**
+ * ValidationError represents a scoped error to a user input.
+ */
 export interface ValidationError {
 	readonly field: string;
 	readonly detail: string;
@@ -4091,18 +5728,31 @@ export interface WebpushSubscription {
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * WebsocketReport shows if the configured access URL allows establishing WebSocket connections.
+ */
 export interface WebsocketReport extends BaseReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly body: string;
 	readonly code: number;
 }
 
 // From codersdk/workspaces.go
+/**
+ * Workspace is a deployment of a template. It references a specific
+ * version and can be updated.
+ */
 export interface Workspace {
 	readonly id: string;
 	readonly created_at: string;
 	readonly updated_at: string;
 	readonly owner_id: string;
+	/**
+	 * OwnerName is the username of the owner of the workspace.
+	 */
 	readonly owner_name: string;
 	readonly owner_avatar_url: string;
 	readonly organization_id: string;
@@ -4122,13 +5772,35 @@ export interface Workspace {
 	readonly autostart_schedule?: string;
 	readonly ttl_ms?: number;
 	readonly last_used_at: string;
+	/**
+	 * DeletingAt indicates the time at which the workspace will be permanently deleted.
+	 * A workspace is eligible for deletion if it is dormant (a non-nil dormant_at value)
+	 * and a value has been specified for time_til_dormant_autodelete on its template.
+	 */
 	readonly deleting_at: string | null;
+	/**
+	 * DormantAt being non-nil indicates a workspace that is dormant.
+	 * A dormant workspace is no longer accessible must be activated.
+	 * It is subject to deletion if it breaches
+	 * the duration of the time_til_ field on its template.
+	 */
 	readonly dormant_at: string | null;
+	/**
+	 * Health shows the health of the workspace and information about
+	 * what is causing an unhealthy status.
+	 */
 	readonly health: WorkspaceHealth;
 	readonly automatic_updates: AutomaticUpdates;
 	readonly allow_renames: boolean;
 	readonly favorite: boolean;
 	readonly next_start_at: string | null;
+	/**
+	 * IsPrebuild indicates whether the workspace is a prebuilt workspace.
+	 * Prebuilt workspaces are owned by the prebuilds system user and have specific behavior,
+	 * such as being managed differently from regular workspaces.
+	 * Once a prebuilt workspace is claimed by a user, it transitions to a regular workspace,
+	 * and IsPrebuild returns false.
+	 */
 	readonly is_prebuild: boolean;
 }
 
@@ -4164,44 +5836,111 @@ export interface WorkspaceAgent {
 	readonly version: string;
 	readonly api_version: string;
 	readonly apps: readonly WorkspaceApp[];
+	/**
+	 * DERPLatency is mapped by region name (e.g. "New York City", "Seattle").
+	 */
 	readonly latency?: Record<string, DERPRegion>;
 	readonly connection_timeout_seconds: number;
 	readonly troubleshooting_url: string;
 	readonly subsystems: readonly AgentSubsystem[];
-	readonly health: WorkspaceAgentHealth;
+	readonly health: WorkspaceAgentHealth; // Health reports the health of the agent.
 	readonly display_apps: readonly DisplayApp[];
 	readonly log_sources: readonly WorkspaceAgentLogSource[];
 	readonly scripts: readonly WorkspaceAgentScript[];
+	/**
+	 * StartupScriptBehavior is a legacy field that is deprecated in favor
+	 * of the `coder_script` resource. It's only referenced by old clients.
+	 * Deprecated: Remove in the future!
+	 */
 	readonly startup_script_behavior: WorkspaceAgentStartupScriptBehavior;
 }
 
 // From codersdk/workspaceagents.go
+/**
+ * WorkspaceAgentContainer describes a devcontainer of some sort
+ * that is visible to the workspace agent. This struct is an abstraction
+ * of potentially multiple implementations, and the fields will be
+ * somewhat implementation-dependent.
+ */
 export interface WorkspaceAgentContainer {
+	/**
+	 * CreatedAt is the time the container was created.
+	 */
 	readonly created_at: string;
+	/**
+	 * ID is the unique identifier of the container.
+	 */
 	readonly id: string;
+	/**
+	 * FriendlyName is the human-readable name of the container.
+	 */
 	readonly name: string;
+	/**
+	 * Image is the name of the container image.
+	 */
 	readonly image: string;
+	/**
+	 * Labels is a map of key-value pairs of container labels.
+	 */
 	readonly labels: Record<string, string>;
+	/**
+	 * Running is true if the container is currently running.
+	 */
 	readonly running: boolean;
+	/**
+	 * Ports includes ports exposed by the container.
+	 */
 	readonly ports: readonly WorkspaceAgentContainerPort[];
+	/**
+	 * Status is the current status of the container. This is somewhat
+	 * implementation-dependent, but should generally be a human-readable
+	 * string.
+	 */
 	readonly status: string;
+	/**
+	 * Volumes is a map of "things" mounted into the container. Again, this
+	 * is somewhat implementation-dependent.
+	 */
 	readonly volumes: Record<string, string>;
 }
 
 // From codersdk/workspaceagents.go
+/**
+ * WorkspaceAgentContainerPort describes a port as exposed by a container.
+ */
 export interface WorkspaceAgentContainerPort {
+	/**
+	 * Port is the port number *inside* the container.
+	 */
 	readonly port: number;
+	/**
+	 * Network is the network protocol used by the port (tcp, udp, etc).
+	 */
 	readonly network: string;
+	/**
+	 * HostIP is the IP address of the host interface to which the port is
+	 * bound. Note that this can be an IPv4 or IPv6 address.
+	 */
 	readonly host_ip?: string;
+	/**
+	 * HostPort is the port number *outside* the container.
+	 */
 	readonly host_port?: number;
 }
 
 // From codersdk/workspaceagents.go
+/**
+ * WorkspaceAgentDevcontainer defines the location of a devcontainer
+ * configuration in a workspace that is visible to the workspace agent.
+ */
 export interface WorkspaceAgentDevcontainer {
 	readonly id: string;
 	readonly name: string;
 	readonly workspace_folder: string;
 	readonly config_path?: string;
+	/**
+	 * Additional runtime fields.
+	 */
 	readonly status: WorkspaceAgentDevcontainerStatus;
 	readonly dirty: boolean;
 	readonly container?: WorkspaceAgentContainer;
@@ -4210,6 +5949,10 @@ export interface WorkspaceAgentDevcontainer {
 }
 
 // From codersdk/workspaceagents.go
+/**
+ * WorkspaceAgentDevcontainerAgent represents the sub agent for a
+ * devcontainer.
+ */
 export interface WorkspaceAgentDevcontainerAgent {
 	readonly id: string;
 	readonly name: string;
@@ -4228,8 +5971,8 @@ export const WorkspaceAgentDevcontainerStatuses: WorkspaceAgentDevcontainerStatu
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentHealth {
-	readonly healthy: boolean;
-	readonly reason?: string;
+	readonly healthy: boolean; // Healthy is true if the agent is healthy.
+	readonly reason?: string; // Reason is a human-readable explanation of the agent's health. It is empty if Healthy is true.
 }
 
 // From codersdk/workspaceagents.go
@@ -4257,21 +6000,41 @@ export const WorkspaceAgentLifecycles: WorkspaceAgentLifecycle[] = [
 ];
 
 // From codersdk/workspaceagents.go
+/**
+ * WorkspaceAgentListContainersResponse is the response to the list containers
+ * request.
+ */
 export interface WorkspaceAgentListContainersResponse {
+	/**
+	 * Devcontainers is a list of devcontainers visible to the workspace agent.
+	 */
 	readonly devcontainers: readonly WorkspaceAgentDevcontainer[];
+	/**
+	 * Containers is a list of containers visible to the workspace agent.
+	 */
 	readonly containers: readonly WorkspaceAgentContainer[];
+	/**
+	 * Warnings is a list of warnings that may have occurred during the
+	 * process of listing containers. This should not include fatal errors.
+	 */
 	readonly warnings?: readonly string[];
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentListeningPort {
-	readonly process_name: string;
-	readonly network: string;
+	readonly process_name: string; // may be empty
+	readonly network: string; // only "tcp" at the moment
 	readonly port: number;
 }
 
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentListeningPortsResponse {
+	/**
+	 * If there are no ports in the list, nothing should be displayed in the UI.
+	 * There must not be a "no ports available" message or anything similar, as
+	 * there will always be no ports displayed on platforms where our port
+	 * detection logic is unsupported.
+	 */
 	readonly ports: readonly WorkspaceAgentListeningPort[];
 }
 
@@ -4300,6 +6063,11 @@ export interface WorkspaceAgentMetadata {
 }
 
 // From codersdk/workspaceagents.go
+/**
+ * WorkspaceAgentMetadataDescription is a description of dynamic metadata the agent should report
+ * back to coderd. It is provided via the `metadata` list in the `coder_agent`
+ * block.
+ */
 export interface WorkspaceAgentMetadataDescription {
 	readonly display_name: string;
 	readonly key: string;
@@ -4311,6 +6079,10 @@ export interface WorkspaceAgentMetadataDescription {
 // From codersdk/workspaceagents.go
 export interface WorkspaceAgentMetadataResult {
 	readonly collected_at: string;
+	/**
+	 * Age is the number of seconds since the metadata was collected.
+	 * It is provided in addition to CollectedAt to protect against clock skew.
+	 */
 	readonly age: number;
 	readonly value: string;
 	readonly error: string;
@@ -4387,21 +6159,58 @@ export const WorkspaceAgentStatuses: WorkspaceAgentStatus[] = [
 // From codersdk/workspaceapps.go
 export interface WorkspaceApp {
 	readonly id: string;
+	/**
+	 * URL is the address being proxied to inside the workspace.
+	 * If external is specified, this will be opened on the client.
+	 */
 	readonly url?: string;
+	/**
+	 * External specifies whether the URL should be opened externally on
+	 * the client or not.
+	 */
 	readonly external: boolean;
+	/**
+	 * Slug is a unique identifier within the agent.
+	 */
 	readonly slug: string;
+	/**
+	 * DisplayName is a friendly name for the app.
+	 */
 	readonly display_name?: string;
 	readonly command?: string;
+	/**
+	 * Icon is a relative path or external URL that specifies
+	 * an icon to be displayed in the dashboard.
+	 */
 	readonly icon?: string;
+	/**
+	 * Subdomain denotes whether the app should be accessed via a path on the
+	 * `coder server` or via a hostname-based dev URL. If this is set to true
+	 * and there is no app wildcard configured on the server, the app will not
+	 * be accessible in the UI.
+	 */
 	readonly subdomain: boolean;
+	/**
+	 * SubdomainName is the application domain exposed on the `coder server`.
+	 */
 	readonly subdomain_name?: string;
 	readonly sharing_level: WorkspaceAppSharingLevel;
+	/**
+	 * Healthcheck specifies the configuration for checking app health.
+	 */
 	readonly healthcheck?: Healthcheck;
 	readonly health: WorkspaceAppHealth;
 	readonly group?: string;
 	readonly hidden: boolean;
 	readonly open_in: WorkspaceAppOpenIn;
+	/**
+	 * Tooltip is an optional markdown supported field that is displayed
+	 * when hovering over workspace apps in the UI.
+	 */
 	readonly tooltip?: string;
+	/**
+	 * Statuses is a list of statuses for the app.
+	 */
 	readonly statuses: readonly WorkspaceAppStatus[];
 }
 
@@ -4447,8 +6256,21 @@ export interface WorkspaceAppStatus {
 	readonly app_id: string;
 	readonly state: WorkspaceAppStatusState;
 	readonly message: string;
+	/**
+	 * URI is the URI of the resource that the status is for.
+	 * e.g. https://github.com/org/repo/pull/123
+	 * e.g. file:///path/to/file
+	 */
 	readonly uri: string;
+	/**
+	 * Deprecated: This field is unused and will be removed in a future version.
+	 * Icon is an external URL to an icon that will be rendered in the UI.
+	 */
 	readonly icon: string;
+	/**
+	 * Deprecated: This field is unused and will be removed in a future version.
+	 * NeedsUserAttention specifies whether the status needs user attention.
+	 */
 	readonly needs_user_attention: boolean;
 }
 
@@ -4467,6 +6289,10 @@ export const WorkspaceAppStatusStates: WorkspaceAppStatusState[] = [
 ];
 
 // From codersdk/workspacebuilds.go
+/**
+ * WorkspaceBuild is an at-point representation of a workspace state.
+ * BuildNumbers start at 1 and increase by 1 for each subsequent build
+ */
 export interface WorkspaceBuild {
 	readonly id: string;
 	readonly created_at: string;
@@ -4474,6 +6300,9 @@ export interface WorkspaceBuild {
 	readonly workspace_id: string;
 	readonly workspace_name: string;
 	readonly workspace_owner_id: string;
+	/**
+	 * WorkspaceOwnerName is the username of the owner of the workspace.
+	 */
 	readonly workspace_owner_name: string;
 	readonly workspace_owner_avatar_url?: string;
 	readonly template_version_id: string;
@@ -4497,6 +6326,9 @@ export interface WorkspaceBuild {
 }
 
 // From codersdk/workspacebuilds.go
+/**
+ * WorkspaceBuildParameter represents a parameter specific for a workspace build.
+ */
 export interface WorkspaceBuildParameter {
 	readonly name: string;
 	readonly value: string;
@@ -4505,6 +6337,10 @@ export interface WorkspaceBuildParameter {
 // From codersdk/workspacebuilds.go
 export interface WorkspaceBuildTimings {
 	readonly provisioner_timings: readonly ProvisionerTiming[];
+	/**
+	 * TODO: Consolidate agent-related timing metrics into a single struct when
+	 * updating the API version
+	 */
 	readonly agent_script_timings: readonly AgentScriptTiming[];
 	readonly agent_connection_timings: readonly AgentConnectionTiming[];
 }
@@ -4534,6 +6370,9 @@ export interface WorkspaceDeploymentStats {
 
 // From codersdk/workspaces.go
 export interface WorkspaceFilter {
+	/**
+	 * FilterQuery supports a raw filter query string
+	 */
 	readonly q?: string;
 }
 
@@ -4544,8 +6383,8 @@ export interface WorkspaceGroup extends Group {
 
 // From codersdk/workspaces.go
 export interface WorkspaceHealth {
-	readonly healthy: boolean;
-	readonly failing_agents: readonly string[];
+	readonly healthy: boolean; // Healthy is true if the workspace is healthy.
+	readonly failing_agents: readonly string[]; // FailingAgents lists the IDs of the agents that are failing, if any.
 }
 
 // From codersdk/workspaces.go
@@ -4557,6 +6396,11 @@ export interface WorkspaceOptions {
 export interface WorkspaceProxy extends Region {
 	readonly derp_enabled: boolean;
 	readonly derp_only: boolean;
+	/**
+	 * Status is the latest status check of the proxy. This will be empty for deleted
+	 * proxies. This value can be used to determine if a workspace proxy is healthy
+	 * and ready to use.
+	 */
 	readonly status?: WorkspaceProxyStatus;
 	readonly created_at: string;
 	readonly updated_at: string;
@@ -4566,12 +6410,24 @@ export interface WorkspaceProxy extends Region {
 
 // From codersdk/deployment.go
 export interface WorkspaceProxyBuildInfo {
+	/**
+	 * TODO: @emyrk what should we include here?
+	 */
 	readonly workspace_proxy: boolean;
+	/**
+	 * DashboardURL is the URL of the coderd this proxy is connected to.
+	 */
 	readonly dashboard_url: string;
 }
 
 // From healthsdk/healthsdk.go
+/**
+ * WorkspaceProxyReport includes health details of each connected workspace proxy.
+ */
 export interface WorkspaceProxyReport extends BaseReport {
+	/**
+	 * Healthy is deprecated and left for backward compatibility purposes, use `Severity` instead.
+	 */
 	readonly healthy: boolean;
 	readonly workspace_proxies: RegionsResponse<WorkspaceProxy>;
 }
@@ -4579,6 +6435,9 @@ export interface WorkspaceProxyReport extends BaseReport {
 // From codersdk/workspaceproxy.go
 export interface WorkspaceProxyStatus {
 	readonly status: ProxyHealthStatus;
+	/**
+	 * Report provides more information about the health of the workspace proxy.
+	 */
 	readonly report?: ProxyHealthReport;
 	readonly checked_at: string;
 }
@@ -4590,6 +6449,10 @@ export interface WorkspaceQuota {
 }
 
 // From codersdk/workspacebuilds.go
+/**
+ * WorkspaceResource describes resources used to create a workspace, for instance:
+ * containers, images, volumes.
+ */
 export interface WorkspaceResource {
 	readonly id: string;
 	readonly created_at: string;
@@ -4605,6 +6468,9 @@ export interface WorkspaceResource {
 }
 
 // From codersdk/workspacebuilds.go
+/**
+ * WorkspaceResourceMetadata annotates the workspace resource with custom key-value pairs.
+ */
 export interface WorkspaceResourceMetadata {
 	readonly key: string;
 	readonly value: string;

From cfbbcfc65a7dc7fad52e73ff3de0e2e6aa9e3f1b Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Fri, 17 Oct 2025 17:43:00 +0100
Subject: [PATCH 165/298] chore(dogfood): use pre-release terraform provider
 (#20365)

Set the terraform provider version to `2.12.0-pre0` so we can dogfood it
before releasing. This provider version contains an update to the
`coder_ai_task` resource in preparation for the upcoming 2.28 Coder
release.
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index d6085ab36a8e5..f9b6250726a82 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     coder = {
       source  = "coder/coder"
-      version = "~> 2.9"
+      version = "= 2.12.0-pre0"
     }
     docker = {
       source  = "kreuzwerker/docker"

From f6526b789a77c9c0eccef9874a9e505cb0158674 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 17 Oct 2025 18:11:31 +0100
Subject: [PATCH 166/298] feat(site): make TaskPrompt PromptTextarea read-only
 when submitting (#20363)

- Makes the text area of TaskPrompt read-only when submitting
- Adds a "scanning" animation to the textarea on submit.
---
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   | 29 +++++++++++++
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   | 41 ++++++++++++++-----
 site/tailwind.config.js                       |  8 ++++
 3 files changed, 67 insertions(+), 11 deletions(-)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index 3c7025fa7682d..bac6c41aab999 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -103,6 +103,35 @@ export const SubmitDisabledWhenPromptEmpty: Story = {
 	},
 };
 
+export const Submitting: Story = {
+	decorators: [withGlobalSnackbar],
+	beforeEach: () => {
+		spyOn(API.experimental, "createTask").mockImplementation(
+			() =>
+				// Never resolve to keep the component in the submitting state for visual testing.
+				new Promise(() => {}),
+		);
+	},
+	play: async ({ canvasElement }) => {
+		const canvas = within(canvasElement);
+
+		const prompt = await canvas.findByLabelText(/prompt/i);
+		await userEvent.type(
+			prompt,
+			"Lorem ipsum dolor sit amet, consectetur adipiscing elit.{enter}{enter}Sed do eiusmod tempor incididunt ut labore et dolore magna aliqua.",
+		);
+
+		const submitButton = canvas.getByRole("button", { name: /run task/i });
+		await waitFor(() => expect(submitButton).toBeEnabled());
+		await userEvent.click(submitButton);
+	},
+	parameters: {
+		chromatic: {
+			disableSnapshot: true,
+		},
+	},
+};
+
 export const OnSuccess: Story = {
 	decorators: [withGlobalSnackbar],
 	parameters: {
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index 706b3480c00da..580b520d2c858 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -259,6 +259,7 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 					value={prompt}
 					onChange={(e) => setPrompt(e.target.value)}
 					readOnly={isPromptReadOnly}
+					isSubmitting={createTaskMutation.isPending}
 				/>
 				<div className="flex items-center justify-between pt-2">
 					<div className="flex items-center gap-1">
@@ -457,17 +458,35 @@ async function createTaskWithLatestTemplateVersion(
 	});
 }
 
-const PromptTextarea: FC<TextareaAutosizeProps> = (props) => {
+type PromptTextareaProps = TextareaAutosizeProps & {
+	isSubmitting?: boolean;
+};
+
+const PromptTextarea: FC<PromptTextareaProps> = ({
+	isSubmitting,
+	...props
+}) => {
 	return (
-		<TextareaAutosize
-			{...props}
-			required
-			id="prompt"
-			name="prompt"
-			placeholder="Prompt your AI agent to start a task..."
-			className={`border-0 px-3 py-2 resize-none w-full h-full bg-transparent rounded-lg
-						outline-none flex min-h-24 text-sm shadow-sm text-content-primary
-						placeholder:text-content-secondary md:text-sm ${props.readOnly ? "opacity-60 cursor-not-allowed" : ""}`}
-		/>
+		<div className="relative">
+			<TextareaAutosize
+				{...props}
+				required
+				id="prompt"
+				name="prompt"
+				placeholder="Prompt your AI agent to start a task..."
+				className={`border-0 px-3 py-2 resize-none w-full h-full bg-transparent rounded-lg
+							outline-none flex min-h-24 text-sm shadow-sm text-content-primary
+							placeholder:text-content-secondary md:text-sm ${props.readOnly || isSubmitting ? "opacity-60 cursor-not-allowed" : ""}`}
+			/>
+			{isSubmitting && (
+				<div className="absolute inset-0 pointer-events-none overflow-hidden">
+					<div
+						className={`absolute top-0 w-0.5 h-full
+						bg-green-400/90 animate-caret-scan rounded-sm
+						shadow-[-15px_0_15px_rgba(0,255,0,0.9),-30px_0_30px_rgba(0,255,0,0.7),-45px_0_45px_rgba(0,255,0,0.5),-60px_0_60px_rgba(0,255,0,0.3)]`}
+					/>
+				</div>
+			)}
+		</div>
 	);
 };
diff --git a/site/tailwind.config.js b/site/tailwind.config.js
index 1250122bb29b9..d7293ee2d6501 100644
--- a/site/tailwind.config.js
+++ b/site/tailwind.config.js
@@ -83,6 +83,14 @@ module.exports = {
 					"75%": { opacity: 0.3 },
 					"100%": { opacity: 0.2 },
 				},
+				"caret-scan": {
+					"0%": { left: "0%" },
+					"100%": { left: "100%" },
+				},
+			},
+			animation: {
+				loading: "loading 2s ease-in-out infinite alternate",
+				"caret-scan": "caret-scan 3s ease-in-out infinite",
 			},
 		},
 	},

From b0a045cba05907699db0c15a2884f29774742794 Mon Sep 17 00:00:00 2001
From: Benjamin Peinhardt <61021968+bcpeinhardt@users.noreply.github.com>
Date: Fri, 17 Oct 2025 13:09:50 -0500
Subject: [PATCH 167/298] chore: add tasks-docker first in starter templates
 list (#20169)

This PR:
- Adds the tasks-docker template to the embeded template examples
- Makes the tasks-docker template the leading template on the
starter-templates page
- Makes the tasks-docker template the leading template on the featured
templates list (in `EmptyTemplates`)

closes https://github.com/coder/coder/issues/19718



https://github.com/user-attachments/assets/c582d8c0-a32b-48c4-886b-93a052a965a5

---------

Co-authored-by: Claude <noreply@anthropic.com>
---
 .../coder_templates_init_--help.golden        |   2 +-
 docs/reference/cli/templates_init.md          |   6 +-
 examples/examples.gen.json                    |  14 +
 examples/examples.go                          |   1 +
 examples/templates/tasks-docker/README.md     |  87 ++++
 examples/templates/tasks-docker/main.tf       | 376 ++++++++++++++++++
 .../StarterTemplates.tsx                      |  32 +-
 .../pages/TemplatesPage/EmptyTemplates.tsx    |  21 +-
 site/src/theme/externalImages.ts              |   1 +
 site/src/theme/icons.json                     |   1 +
 site/static/icon/tasks.svg                    |   5 +
 11 files changed, 511 insertions(+), 35 deletions(-)
 create mode 100644 examples/templates/tasks-docker/README.md
 create mode 100644 examples/templates/tasks-docker/main.tf
 create mode 100644 site/static/icon/tasks.svg

diff --git a/cli/testdata/coder_templates_init_--help.golden b/cli/testdata/coder_templates_init_--help.golden
index d44db24aee27b..44be7a95293f4 100644
--- a/cli/testdata/coder_templates_init_--help.golden
+++ b/cli/testdata/coder_templates_init_--help.golden
@@ -6,7 +6,7 @@ USAGE:
   Get started with a templated template.
 
 OPTIONS:
-      --id aws-devcontainer|aws-linux|aws-windows|azure-linux|digitalocean-linux|docker|docker-devcontainer|docker-envbuilder|gcp-devcontainer|gcp-linux|gcp-vm-container|gcp-windows|kubernetes|kubernetes-devcontainer|nomad-docker|scratch
+      --id aws-devcontainer|aws-linux|aws-windows|azure-linux|digitalocean-linux|docker|docker-devcontainer|docker-envbuilder|gcp-devcontainer|gcp-linux|gcp-vm-container|gcp-windows|kubernetes|kubernetes-devcontainer|nomad-docker|scratch|tasks-docker
           Specify a given example template by ID.
 
 ———
diff --git a/docs/reference/cli/templates_init.md b/docs/reference/cli/templates_init.md
index 7613144e66018..3ac28749ad5e4 100644
--- a/docs/reference/cli/templates_init.md
+++ b/docs/reference/cli/templates_init.md
@@ -13,8 +13,8 @@ coder templates init [flags] [directory]
 
 ### --id
 
-|      |                                                                                                                                                                                                                                                                |
-|------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| Type | <code>aws-devcontainer\|aws-linux\|aws-windows\|azure-linux\|digitalocean-linux\|docker\|docker-devcontainer\|docker-envbuilder\|gcp-devcontainer\|gcp-linux\|gcp-vm-container\|gcp-windows\|kubernetes\|kubernetes-devcontainer\|nomad-docker\|scratch</code> |
+|      |                                                                                                                                                                                                                                                                              |
+|------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| Type | <code>aws-devcontainer\|aws-linux\|aws-windows\|azure-linux\|digitalocean-linux\|docker\|docker-devcontainer\|docker-envbuilder\|gcp-devcontainer\|gcp-linux\|gcp-vm-container\|gcp-windows\|kubernetes\|kubernetes-devcontainer\|nomad-docker\|scratch\|tasks-docker</code> |
 
 Specify a given example template by ID.
diff --git a/examples/examples.gen.json b/examples/examples.gen.json
index c891389568a55..432e6d3f51ea6 100644
--- a/examples/examples.gen.json
+++ b/examples/examples.gen.json
@@ -205,5 +205,19 @@
 		"icon": "/emojis/1f4e6.png",
 		"tags": [],
 		"markdown": "\n# A minimal Scaffolding for a Coder Template\n\nUse this starter template as a basis to create your own unique template from scratch.\n"
+	},
+	{
+		"id": "tasks-docker",
+		"url": "",
+		"name": "Tasks on Docker",
+		"description": "Run Coder Tasks on Docker with an example application",
+		"icon": "/icon/tasks.svg",
+		"tags": [
+			"docker",
+			"container",
+			"ai",
+			"tasks"
+		],
+		"markdown": "\n# Run Coder Tasks on Docker\n\nThis is an example template for running [Coder Tasks](https://coder.com/docs/ai-coder/tasks), Claude Code, along with a [real world application](https://realworld-docs.netlify.app/).\n\n![Tasks](../../.images/tasks-screenshot.png)\n\nThis is a fantastic starting point for working with AI agents with Coder Tasks. Try prompts such as:\n\n- \"Make the background color blue\"\n- \"Add a dark mode\"\n- \"Rewrite the entire backend in Go\"\n\n## Included in this template\n\nThis template is designed to be an example and a reference for building other templates with Coder Tasks. You can always run Coder Tasks on different infrastructure (e.g. as on Kubernetes, VMs) and with your own GitHub repositories, MCP servers, images, etc.\n\nAdditionally, this template uses our [Claude Code](https://registry.coder.com/modules/coder/claude-code) module, but [other agents](https://registry.coder.com/modules?search=tag%3Aagent) or even [custom agents](https://coder.com/docs/ai-coder/custom-agents) can be used in its place.\n\nThis template uses a [Workspace Preset](https://coder.com/docs/admin/templates/extending-templates/parameters#workspace-presets) that pre-defines:\n\n- Universal Container Image (e.g. contains Node.js, Java, Python, Ruby, etc)\n- MCP servers (desktop-commander for long-running logs, playwright for previewing changes)\n- System prompt and [repository](https://github.com/coder-contrib/realworld-django-rest-framework-angular) for the AI agent\n- Startup script to initialize the repository and start the development server\n\n## Add this template to your Coder deployment\n\nYou can also add this template to your Coder deployment and begin tinkering right away!\n\n### Prerequisites\n\n- Coder installed (see [our docs](https://coder.com/docs/install)), ideally a Linux VM with Docker\n- Anthropic API Key (or access to Anthropic models via Bedrock or Vertex, see [Claude Code docs](https://docs.anthropic.com/en/docs/claude-code/third-party-integrations))\n- Access to a Docker socket\n  - If on the local VM, ensure the `coder` user is added to the Docker group (docs)\n\n    ```sh\n    # Add coder user to Docker group\n    sudo adduser coder docker\n    \n    # Restart Coder server\n    sudo systemctl restart coder\n    \n    # Test Docker\n    sudo -u coder docker ps\n    ```\n\n  - If on a remote VM, see the [Docker Terraform provider documentation](https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs#remote-hosts) to configure a remote host\n\nTo import this template into Coder, first create a template from \"Scratch\" in the template editor.\n\nVisit this URL for your Coder deployment:\n\n```sh\nhttps://coder.example.com/templates/new?exampleId=scratch\n```\n\nAfter creating the template, paste the contents from [main.tf](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/tasks-docker/main.tf) into the template editor and save.\n\nAlternatively, you can use the Coder CLI to [push the template](https://coder.com/docs/reference/cli/templates_push)\n\n```sh\n# Download the CLI\ncurl -L https://coder.com/install.sh | sh\n\n# Log in to your deployment\ncoder login https://coder.example.com\n\n# Clone the registry\ngit clone https://github.com/coder/registry\ncd registry\n\n# Navigate to this template\ncd registry/coder-labs/templates/tasks-docker\n\n# Push the template\ncoder templates push\n```\n"
 	}
 ]
diff --git a/examples/examples.go b/examples/examples.go
index 7deff18f5f9ad..8490267b7fe28 100644
--- a/examples/examples.go
+++ b/examples/examples.go
@@ -40,6 +40,7 @@ var (
 	//go:embed templates/kubernetes-devcontainer
 	//go:embed templates/nomad-docker
 	//go:embed templates/scratch
+	//go:embed templates/tasks-docker
 	files embed.FS
 
 	exampleBasePath = "https://github.com/coder/coder/tree/main/examples/templates/"
diff --git a/examples/templates/tasks-docker/README.md b/examples/templates/tasks-docker/README.md
new file mode 100644
index 0000000000000..02262e5d6989c
--- /dev/null
+++ b/examples/templates/tasks-docker/README.md
@@ -0,0 +1,87 @@
+---
+display_name: Tasks on Docker
+description: Run Coder Tasks on Docker with an example application
+icon: ../../../site/static/icon/tasks.svg
+verified: false
+tags: [docker, container, ai, tasks]
+maintainer_github: coder
+---
+
+# Run Coder Tasks on Docker
+
+This is an example template for running [Coder Tasks](https://coder.com/docs/ai-coder/tasks), Claude Code, along with a [real world application](https://realworld-docs.netlify.app/).
+
+![Tasks](../../.images/tasks-screenshot.png)
+
+This is a fantastic starting point for working with AI agents with Coder Tasks. Try prompts such as:
+
+- "Make the background color blue"
+- "Add a dark mode"
+- "Rewrite the entire backend in Go"
+
+## Included in this template
+
+This template is designed to be an example and a reference for building other templates with Coder Tasks. You can always run Coder Tasks on different infrastructure (e.g. as on Kubernetes, VMs) and with your own GitHub repositories, MCP servers, images, etc.
+
+Additionally, this template uses our [Claude Code](https://registry.coder.com/modules/coder/claude-code) module, but [other agents](https://registry.coder.com/modules?search=tag%3Aagent) or even [custom agents](https://coder.com/docs/ai-coder/custom-agents) can be used in its place.
+
+This template uses a [Workspace Preset](https://coder.com/docs/admin/templates/extending-templates/parameters#workspace-presets) that pre-defines:
+
+- Universal Container Image (e.g. contains Node.js, Java, Python, Ruby, etc)
+- MCP servers (desktop-commander for long-running logs, playwright for previewing changes)
+- System prompt and [repository](https://github.com/coder-contrib/realworld-django-rest-framework-angular) for the AI agent
+- Startup script to initialize the repository and start the development server
+
+## Add this template to your Coder deployment
+
+You can also add this template to your Coder deployment and begin tinkering right away!
+
+### Prerequisites
+
+- Coder installed (see [our docs](https://coder.com/docs/install)), ideally a Linux VM with Docker
+- Anthropic API Key (or access to Anthropic models via Bedrock or Vertex, see [Claude Code docs](https://docs.anthropic.com/en/docs/claude-code/third-party-integrations))
+- Access to a Docker socket
+  - If on the local VM, ensure the `coder` user is added to the Docker group (docs)
+
+    ```sh
+    # Add coder user to Docker group
+    sudo adduser coder docker
+    
+    # Restart Coder server
+    sudo systemctl restart coder
+    
+    # Test Docker
+    sudo -u coder docker ps
+    ```
+
+  - If on a remote VM, see the [Docker Terraform provider documentation](https://registry.terraform.io/providers/kreuzwerker/docker/latest/docs#remote-hosts) to configure a remote host
+
+To import this template into Coder, first create a template from "Scratch" in the template editor.
+
+Visit this URL for your Coder deployment:
+
+```sh
+https://coder.example.com/templates/new?exampleId=scratch
+```
+
+After creating the template, paste the contents from [main.tf](https://github.com/coder/registry/blob/main/registry/coder-labs/templates/tasks-docker/main.tf) into the template editor and save.
+
+Alternatively, you can use the Coder CLI to [push the template](https://coder.com/docs/reference/cli/templates_push)
+
+```sh
+# Download the CLI
+curl -L https://coder.com/install.sh | sh
+
+# Log in to your deployment
+coder login https://coder.example.com
+
+# Clone the registry
+git clone https://github.com/coder/registry
+cd registry
+
+# Navigate to this template
+cd registry/coder-labs/templates/tasks-docker
+
+# Push the template
+coder templates push
+```
diff --git a/examples/templates/tasks-docker/main.tf b/examples/templates/tasks-docker/main.tf
new file mode 100644
index 0000000000000..c0a165fccbc4b
--- /dev/null
+++ b/examples/templates/tasks-docker/main.tf
@@ -0,0 +1,376 @@
+terraform {
+  required_providers {
+    coder = {
+      source = "coder/coder"
+    }
+    docker = {
+      source = "kreuzwerker/docker"
+    }
+  }
+}
+
+# This template requires a valid Docker socket
+# However, you can reference our Kubernetes/VM
+# example templates and adapt the Claude Code module
+# 
+# see: https://registry.coder.com/templates 
+provider "docker" {}
+
+# The Claude Code module does the automatic task reporting
+# Other agent modules: https://registry.coder.com/modules?search=agent
+# Or use a custom agent:  
+module "claude-code" {
+  count               = data.coder_workspace.me.start_count
+  source              = "registry.coder.com/coder/claude-code/coder"
+  version             = "3.0.0"
+  agent_id            = coder_agent.main.id
+  workdir             = "/home/coder/projects"
+  order               = 999
+  claude_api_key      = ""
+  ai_prompt           = data.coder_parameter.ai_prompt.value
+  system_prompt       = data.coder_parameter.system_prompt.value
+  model               = "sonnet"
+  permission_mode     = "plan"
+  post_install_script = data.coder_parameter.setup_script.value
+}
+
+# We are using presets to set the prompts, image, and set up instructions
+# See https://coder.com/docs/admin/templates/extending-templates/parameters#workspace-presets
+data "coder_workspace_preset" "default" {
+  name    = "Real World App: Angular + Django"
+  default = true
+  parameters = {
+    "system_prompt" = <<-EOT
+      -- Framing --
+      You are a helpful assistant that can help with code. You are running inside a Coder Workspace and provide status updates to the user via Coder MCP. Stay on track, feel free to debug, but when the original plan fails, do not choose a different route/architecture without checking the user first.
+
+      -- Tool Selection --
+      - playwright: previewing your changes after you made them
+        to confirm it worked as expected
+	    -	desktop-commander - use only for commands that keep running
+        (servers, dev watchers, GUI apps).
+      -	Built-in tools - use for everything else:
+       (file operations, git commands, builds & installs, one-off shell commands)
+	    
+      Remember this decision rule:
+      - Stays running? → desktop-commander
+      - Finishes immediately? → built-in tools
+      
+      -- Context --
+      There is an existing app and tmux dev server running on port 8000. Be sure to read it's CLAUDE.md (./realworld-django-rest-framework-angular/CLAUDE.md) to learn more about it. 
+
+      Since this app is for demo purposes and the user is previewing the homepage and subsequent pages, aim to make the first visual change/prototype very quickly so the user can preview it, then focus on backend or logic which can be a more involved, long-running architecture plan.
+
+    EOT
+
+    "setup_script"    = <<-EOT
+    # Set up projects dir
+    mkdir -p /home/coder/projects
+    cd $HOME/projects
+
+    # Packages: Install additional packages
+    sudo apt-get update && sudo apt-get install -y tmux
+    if ! command -v google-chrome >/dev/null 2>&1; then
+      yes | npx playwright install chrome
+    fi
+
+    # MCP: Install and configure MCP Servers
+    npm install -g @wonderwhy-er/desktop-commander
+    claude mcp add playwright npx -- @playwright/mcp@latest --headless --isolated --no-sandbox
+    claude mcp add desktop-commander desktop-commander
+
+    # Repo: Clone and pull changes from the git repository
+    if [ ! -d "realworld-django-rest-framework-angular" ]; then
+      git clone https://github.com/coder-contrib/realworld-django-rest-framework-angular.git
+    else
+      cd realworld-django-rest-framework-angular
+      git fetch
+      # Check for uncommitted changes
+      if git diff-index --quiet HEAD -- && \
+        [ -z "$(git status --porcelain --untracked-files=no)" ] && \
+        [ -z "$(git log --branches --not --remotes)" ]; then
+        echo "Repo is clean. Pulling latest changes..."
+        git pull
+      else
+        echo "Repo has uncommitted or unpushed changes. Skipping pull."
+      fi
+
+      cd ..
+    fi
+
+    # Initialize: Start the development server
+    cd realworld-django-rest-framework-angular && ./start-dev.sh
+    EOT
+    "preview_port"    = "4200"
+    "container_image" = "codercom/example-universal:ubuntu"
+  }
+
+  # Pre-builds is a Coder Premium
+  # feature to speed up workspace creation
+  # 
+  # see https://coder.com/docs/admin/templates/extending-templates/prebuilt-workspaces
+  # prebuilds {
+  #   instances = 1
+  #   expiration_policy {
+  #      ttl = 86400  # Time (in seconds) after which unclaimed prebuilds are expired (1 day)
+  #  }
+  # }
+}
+
+# Advanced parameters (these are all set via preset)
+data "coder_parameter" "system_prompt" {
+  name         = "system_prompt"
+  display_name = "System Prompt"
+  type         = "string"
+  form_type    = "textarea"
+  description  = "System prompt for the agent with generalized instructions"
+  mutable      = false
+}
+data "coder_parameter" "ai_prompt" {
+  type        = "string"
+  name        = "AI Prompt"
+  default     = ""
+  description = "Write a prompt for Claude Code"
+  mutable     = true
+}
+data "coder_parameter" "setup_script" {
+  name         = "setup_script"
+  display_name = "Setup Script"
+  type         = "string"
+  form_type    = "textarea"
+  description  = "Script to run before running the agent"
+  mutable      = false
+}
+data "coder_parameter" "container_image" {
+  name         = "container_image"
+  display_name = "Container Image"
+  type         = "string"
+  default      = "codercom/example-universal:ubuntu"
+  mutable      = false
+}
+data "coder_parameter" "preview_port" {
+  name         = "preview_port"
+  display_name = "Preview Port"
+  description  = "The port the web app is running to preview in Tasks"
+  type         = "number"
+  default      = "3000"
+  mutable      = false
+}
+
+data "coder_provisioner" "me" {}
+data "coder_workspace" "me" {}
+data "coder_workspace_owner" "me" {}
+
+resource "coder_agent" "main" {
+  arch           = data.coder_provisioner.me.arch
+  os             = "linux"
+  startup_script = <<-EOT
+    set -e
+    # Prepare user home with default files on first start.
+    if [ ! -f ~/.init_done ]; then
+      cp -rT /etc/skel ~
+      touch ~/.init_done
+    fi
+  EOT
+
+  # These environment variables allow you to make Git commits right away after creating a
+  # workspace. Note that they take precedence over configuration defined in ~/.gitconfig!
+  # You can remove this block if you'd prefer to configure Git manually or using
+  # dotfiles. (see docs/dotfiles.md)
+  env = {
+    GIT_AUTHOR_NAME     = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
+    GIT_AUTHOR_EMAIL    = "${data.coder_workspace_owner.me.email}"
+    GIT_COMMITTER_NAME  = coalesce(data.coder_workspace_owner.me.full_name, data.coder_workspace_owner.me.name)
+    GIT_COMMITTER_EMAIL = "${data.coder_workspace_owner.me.email}"
+  }
+
+  # The following metadata blocks are optional. They are used to display
+  # information about your workspace in the dashboard. You can remove them
+  # if you don't want to display any information.
+  # For basic resources, you can use the `coder stat` command.
+  # If you need more control, you can write your own script.
+  metadata {
+    display_name = "CPU Usage"
+    key          = "0_cpu_usage"
+    script       = "coder stat cpu"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "RAM Usage"
+    key          = "1_ram_usage"
+    script       = "coder stat mem"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Home Disk"
+    key          = "3_home_disk"
+    script       = "coder stat disk --path $${HOME}"
+    interval     = 60
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "CPU Usage (Host)"
+    key          = "4_cpu_usage_host"
+    script       = "coder stat cpu --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Memory Usage (Host)"
+    key          = "5_mem_usage_host"
+    script       = "coder stat mem --host"
+    interval     = 10
+    timeout      = 1
+  }
+
+  metadata {
+    display_name = "Load Average (Host)"
+    key          = "6_load_host"
+    # get load avg scaled by number of cores
+    script   = <<EOT
+      echo "`cat /proc/loadavg | awk '{ print $1 }'` `nproc`" | awk '{ printf "%0.2f", $1/$2 }'
+    EOT
+    interval = 60
+    timeout  = 1
+  }
+
+  metadata {
+    display_name = "Swap Usage (Host)"
+    key          = "7_swap_host"
+    script       = <<EOT
+      free -b | awk '/^Swap/ { printf("%.1f/%.1f", $3/1024.0/1024.0/1024.0, $2/1024.0/1024.0/1024.0) }'
+    EOT
+    interval     = 10
+    timeout      = 1
+  }
+}
+
+# See https://registry.coder.com/modules/coder/code-server
+module "code-server" {
+  count  = data.coder_workspace.me.start_count
+  folder = "/home/coder/projects"
+  source = "registry.coder.com/coder/code-server/coder"
+
+  settings = {
+    "workbench.colorTheme" : "Default Dark Modern"
+  }
+
+  # This ensures that the latest non-breaking version of the module gets downloaded, you can also pin the module version to prevent breaking changes in production.
+  version = "~> 1.0"
+
+  agent_id = coder_agent.main.id
+  order    = 1
+}
+
+module "windsurf" {
+  count    = data.coder_workspace.me.start_count
+  source   = "registry.coder.com/coder/windsurf/coder"
+  version  = "1.1.0"
+  agent_id = coder_agent.main.id
+}
+
+module "cursor" {
+  count    = data.coder_workspace.me.start_count
+  source   = "registry.coder.com/coder/cursor/coder"
+  version  = "1.2.0"
+  agent_id = coder_agent.main.id
+}
+
+module "jetbrains" {
+  count      = data.coder_workspace.me.start_count
+  source     = "registry.coder.com/coder/jetbrains/coder"
+  version    = "~> 1.0"
+  agent_id   = coder_agent.main.id
+  agent_name = "main"
+  folder     = "/home/coder/projects"
+}
+
+resource "docker_volume" "home_volume" {
+  name = "coder-${data.coder_workspace.me.id}-home"
+  # Protect the volume from being deleted due to changes in attributes.
+  lifecycle {
+    ignore_changes = all
+  }
+  # Add labels in Docker to keep track of orphan resources.
+  labels {
+    label = "coder.owner"
+    value = data.coder_workspace_owner.me.name
+  }
+  labels {
+    label = "coder.owner_id"
+    value = data.coder_workspace_owner.me.id
+  }
+  labels {
+    label = "coder.workspace_id"
+    value = data.coder_workspace.me.id
+  }
+  # This field becomes outdated if the workspace is renamed but can
+  # be useful for debugging or cleaning out dangling volumes.
+  labels {
+    label = "coder.workspace_name_at_creation"
+    value = data.coder_workspace.me.name
+  }
+}
+
+resource "coder_app" "preview" {
+  agent_id     = coder_agent.main.id
+  slug         = "preview"
+  display_name = "Preview your app"
+  icon         = "${data.coder_workspace.me.access_url}/emojis/1f50e.png"
+  url          = "http://localhost:${data.coder_parameter.preview_port.value}"
+  share        = "authenticated"
+  subdomain    = true
+  open_in      = "tab"
+  order        = 0
+  healthcheck {
+    url       = "http://localhost:${data.coder_parameter.preview_port.value}/"
+    interval  = 5
+    threshold = 15
+  }
+}
+
+resource "docker_container" "workspace" {
+  count = data.coder_workspace.me.start_count
+  image = data.coder_parameter.container_image.value
+  # Uses lower() to avoid Docker restriction on container names.
+  name = "coder-${data.coder_workspace_owner.me.name}-${lower(data.coder_workspace.me.name)}"
+  # Hostname makes the shell more user friendly: coder@my-workspace:~$
+  hostname = data.coder_workspace.me.name
+  user     = "coder"
+  # Use the docker gateway if the access URL is 127.0.0.1
+  entrypoint = ["sh", "-c", replace(coder_agent.main.init_script, "/localhost|127\\.0\\.0\\.1/", "host.docker.internal")]
+  env        = ["CODER_AGENT_TOKEN=${coder_agent.main.token}"]
+  host {
+    host = "host.docker.internal"
+    ip   = "host-gateway"
+  }
+  volumes {
+    container_path = "/home/coder"
+    volume_name    = docker_volume.home_volume.name
+    read_only      = false
+  }
+
+  # Add labels in Docker to keep track of orphan resources.
+  labels {
+    label = "coder.owner"
+    value = data.coder_workspace_owner.me.name
+  }
+  labels {
+    label = "coder.owner_id"
+    value = data.coder_workspace_owner.me.id
+  }
+  labels {
+    label = "coder.workspace_id"
+    value = data.coder_workspace.me.id
+  }
+  labels {
+    label = "coder.workspace_name"
+    value = data.coder_workspace.me.name
+  }
+}
\ No newline at end of file
diff --git a/site/src/pages/CreateTemplateGalleryPage/StarterTemplates.tsx b/site/src/pages/CreateTemplateGalleryPage/StarterTemplates.tsx
index 6cc78bf83754d..7f7171af551dd 100644
--- a/site/src/pages/CreateTemplateGalleryPage/StarterTemplates.tsx
+++ b/site/src/pages/CreateTemplateGalleryPage/StarterTemplates.tsx
@@ -23,18 +23,28 @@ const selectTags = (starterTemplatesByTag: StarterTemplatesByTag) => {
 };
 
 const sortVisibleTemplates = (templates: TemplateExample[]) => {
-	// The docker template should be the first template in the list,
-	// as it's the easiest way to get started with Coder.
-	const dockerTemplateId = "docker";
-	return [...templates].sort((a, b) => {
-		if (a.id === dockerTemplateId) {
-			return -1;
-		}
-		if (b.id === dockerTemplateId) {
-			return 1;
+	// The tasks-docker template should be first, as it's the easiest way to
+	// get started with Coder. The docker template should be second.
+	const featuredTemplateIds = ["tasks-docker", "docker"];
+
+	const featuredTemplates: TemplateExample[] = [];
+	for (const id of featuredTemplateIds) {
+		for (const template of templates) {
+			if (id === template.id) {
+				featuredTemplates.push(template);
+			}
 		}
-		return a.name.localeCompare(b.name);
-	});
+	}
+
+	const nonFeaturedTemplates = templates
+		.filter((template) => {
+			return !featuredTemplateIds.includes(template.id);
+		})
+		.sort((a, b) => {
+			return a.name.localeCompare(b.name);
+		});
+
+	return [...featuredTemplates, ...nonFeaturedTemplates];
 };
 
 interface StarterTemplatesProps {
diff --git a/site/src/pages/TemplatesPage/EmptyTemplates.tsx b/site/src/pages/TemplatesPage/EmptyTemplates.tsx
index 1c3ec0bff549b..72a47c3417d5e 100644
--- a/site/src/pages/TemplatesPage/EmptyTemplates.tsx
+++ b/site/src/pages/TemplatesPage/EmptyTemplates.tsx
@@ -1,4 +1,3 @@
-import type { Interpolation, Theme } from "@emotion/react";
 import Link from "@mui/material/Link";
 import type { TemplateExample } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
@@ -12,6 +11,7 @@ import { docs } from "utils/docs";
 
 // Those are from https://github.com/coder/coder/tree/main/examples/templates
 const featuredExampleIds = [
+	"tasks-docker",
 	"docker",
 	"kubernetes",
 	"aws-linux",
@@ -91,28 +91,9 @@ export const EmptyTemplates: FC<EmptyTemplatesProps> = ({
 
 	return (
 		<TableEmpty
-			className="pb-0"
 			message="Create a Template"
 			description="Contact your Coder administrator to create a template. You can share the code below."
 			cta={<CodeExample secret={false} code="coder templates init" />}
-			image={
-				<div css={styles.emptyImage}>
-					<img src="/featured/templates.webp" alt="" />
-				</div>
-			}
 		/>
 	);
 };
-
-const styles = {
-	emptyImage: {
-		maxWidth: "50%",
-		height: 320,
-		overflow: "hidden",
-		opacity: 0.85,
-
-		"& img": {
-			maxWidth: "100%",
-		},
-	},
-} satisfies Record<string, Interpolation<Theme>>;
diff --git a/site/src/theme/externalImages.ts b/site/src/theme/externalImages.ts
index df260d99838ed..0efae3419e1da 100644
--- a/site/src/theme/externalImages.ts
+++ b/site/src/theme/externalImages.ts
@@ -166,4 +166,5 @@ export const defaultParametersForBuiltinIcons = new Map<string, string>([
 	["/icon/widgets.svg", "monochrome"],
 	["/icon/windsurf.svg", "monochrome"],
 	["/icon/zed.svg", "monochrome"],
+	["/icon/tasks.svg", "monochrome"],
 ]);
diff --git a/site/src/theme/icons.json b/site/src/theme/icons.json
index 546cdaeb4c8de..3686eb8a5d8ea 100644
--- a/site/src/theme/icons.json
+++ b/site/src/theme/icons.json
@@ -110,6 +110,7 @@
 	"slack.svg",
 	"sourcegraph-amp.svg",
 	"swift.svg",
+	"tasks.svg",
 	"tensorflow.svg",
 	"terminal.svg",
 	"theia.svg",
diff --git a/site/static/icon/tasks.svg b/site/static/icon/tasks.svg
new file mode 100644
index 0000000000000..67088c4200204
--- /dev/null
+++ b/site/static/icon/tasks.svg
@@ -0,0 +1,5 @@
+<svg width="120" height="120" viewBox="0 0 120 120" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M66.1403 24.9315H106.4V33.5714H14.6005V99.3601H106.4V33.5714L115 33.5682V107.997L14.591 108V99.3695H6V24.9409H14.0531V24.9346L57.5399 24.9315V12H66.1403V24.9315Z" fill="white"/>
+    <path d="M77.94 57.3044V70.2485H69.3521V57.3044H77.94Z" fill="white"/>
+    <path d="M52.1701 57.3044V70.2485H43.5822V57.3044H52.1701Z" fill="white"/>
+</svg>

From 141ef23c81264d5a2ebbd3b733406d5aa3ff20ca Mon Sep 17 00:00:00 2001
From: Callum Styan <callumstyan@gmail.com>
Date: Fri, 17 Oct 2025 13:40:10 -0700
Subject: [PATCH 168/298] fix: introduce dedicated queries for workspaces and
 workspace agents metrics (#19786)

aid in differentiation between sources of calls to `GetWorkspaces` but introducing new queries for metrics specific use cases

---------

Signed-off-by: Callum Styan <callumstyan@gmail.com>
---
 coderd/database/dbauthz/dbauthz.go            |  14 ++
 coderd/database/dbauthz/dbauthz_test.go       |   9 +
 coderd/database/dbmetrics/querymetrics.go     |  14 ++
 coderd/database/dbmock/dbmock.go              |  30 ++++
 coderd/database/querier.go                    |   2 +
 coderd/database/queries.sql.go                | 154 ++++++++++++++++++
 coderd/database/queries/workspaceagents.sql   |  23 +++
 coderd/database/queries/workspaces.sql        |  20 +++
 coderd/prometheusmetrics/prometheusmetrics.go | 115 ++++++-------
 .../prometheusmetrics_test.go                 |   1 +
 10 files changed, 313 insertions(+), 69 deletions(-)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index c291464604375..519684eb7cf9c 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -3552,6 +3552,13 @@ func (q *querier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, createdAt
 	return q.db.GetWorkspaceAgentsCreatedAfter(ctx, createdAt)
 }
 
+func (q *querier) GetWorkspaceAgentsForMetrics(ctx context.Context) ([]database.GetWorkspaceAgentsForMetricsRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace); err != nil {
+		return nil, err
+	}
+	return q.db.GetWorkspaceAgentsForMetrics(ctx)
+}
+
 func (q *querier) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgent, error) {
 	workspace, err := q.GetWorkspaceByID(ctx, workspaceID)
 	if err != nil {
@@ -3857,6 +3864,13 @@ func (q *querier) GetWorkspacesEligibleForTransition(ctx context.Context, now ti
 	return q.db.GetWorkspacesEligibleForTransition(ctx, now)
 }
 
+func (q *querier) GetWorkspacesForWorkspaceMetrics(ctx context.Context) ([]database.GetWorkspacesForWorkspaceMetricsRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace); err != nil {
+		return nil, err
+	}
+	return q.db.GetWorkspacesForWorkspaceMetrics(ctx)
+}
+
 func (q *querier) InsertAIBridgeInterception(ctx context.Context, arg database.InsertAIBridgeInterceptionParams) (database.AIBridgeInterception, error) {
 	return insert(q.log, q.auth, rbac.ResourceAibridgeInterception.WithOwner(arg.InitiatorID.String()), q.db.InsertAIBridgeInterception)(ctx, arg)
 }
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index f65a65c3228b5..989f9c866b6e9 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -1689,6 +1689,15 @@ func (s *MethodTestSuite) TestWorkspace() {
 		// No asserts here because SQLFilter.
 		check.Args(arg).Asserts()
 	}))
+	s.Run("GetWorkspaceAgentsForMetrics", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		row := testutil.Fake(s.T(), faker, database.GetWorkspaceAgentsForMetricsRow{})
+		dbm.EXPECT().GetWorkspaceAgentsForMetrics(gomock.Any()).Return([]database.GetWorkspaceAgentsForMetricsRow{row}, nil).AnyTimes()
+		check.Args().Asserts(rbac.ResourceWorkspace, policy.ActionRead).Returns([]database.GetWorkspaceAgentsForMetricsRow{row})
+	}))
+	s.Run("GetWorkspacesForWorkspaceMetrics", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+		dbm.EXPECT().GetWorkspacesForWorkspaceMetrics(gomock.Any()).Return([]database.GetWorkspacesForWorkspaceMetricsRow{}, nil).AnyTimes()
+		check.Args().Asserts(rbac.ResourceWorkspace, policy.ActionRead)
+	}))
 	s.Run("GetAuthorizedWorkspaces", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 		arg := database.GetWorkspacesParams{}
 		dbm.EXPECT().GetAuthorizedWorkspaces(gomock.Any(), arg, gomock.Any()).Return([]database.GetWorkspacesRow{}, nil).AnyTimes()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 675cc81b01148..d5995222c3d4d 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -1972,6 +1972,13 @@ func (m queryMetricsStore) GetWorkspaceAgentsCreatedAfter(ctx context.Context, c
 	return agents, err
 }
 
+func (m queryMetricsStore) GetWorkspaceAgentsForMetrics(ctx context.Context) ([]database.GetWorkspaceAgentsForMetricsRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetWorkspaceAgentsForMetrics(ctx)
+	m.queryLatencies.WithLabelValues("GetWorkspaceAgentsForMetrics").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgent, error) {
 	start := time.Now()
 	agents, err := m.s.GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx, workspaceID)
@@ -2224,6 +2231,13 @@ func (m queryMetricsStore) GetWorkspacesEligibleForTransition(ctx context.Contex
 	return workspaces, err
 }
 
+func (m queryMetricsStore) GetWorkspacesForWorkspaceMetrics(ctx context.Context) ([]database.GetWorkspacesForWorkspaceMetricsRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetWorkspacesForWorkspaceMetrics(ctx)
+	m.queryLatencies.WithLabelValues("GetWorkspacesForWorkspaceMetrics").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) InsertAIBridgeInterception(ctx context.Context, arg database.InsertAIBridgeInterceptionParams) (database.AIBridgeInterception, error) {
 	start := time.Now()
 	r0, r1 := m.s.InsertAIBridgeInterception(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index d6e07b77dab43..51a06fa35e00c 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -4199,6 +4199,21 @@ func (mr *MockStoreMockRecorder) GetWorkspaceAgentsCreatedAfter(ctx, createdAt a
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentsCreatedAfter", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentsCreatedAfter), ctx, createdAt)
 }
 
+// GetWorkspaceAgentsForMetrics mocks base method.
+func (m *MockStore) GetWorkspaceAgentsForMetrics(ctx context.Context) ([]database.GetWorkspaceAgentsForMetricsRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWorkspaceAgentsForMetrics", ctx)
+	ret0, _ := ret[0].([]database.GetWorkspaceAgentsForMetricsRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetWorkspaceAgentsForMetrics indicates an expected call of GetWorkspaceAgentsForMetrics.
+func (mr *MockStoreMockRecorder) GetWorkspaceAgentsForMetrics(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspaceAgentsForMetrics", reflect.TypeOf((*MockStore)(nil).GetWorkspaceAgentsForMetrics), ctx)
+}
+
 // GetWorkspaceAgentsInLatestBuildByWorkspaceID mocks base method.
 func (m *MockStore) GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) ([]database.WorkspaceAgent, error) {
 	m.ctrl.T.Helper()
@@ -4739,6 +4754,21 @@ func (mr *MockStoreMockRecorder) GetWorkspacesEligibleForTransition(ctx, now any
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspacesEligibleForTransition", reflect.TypeOf((*MockStore)(nil).GetWorkspacesEligibleForTransition), ctx, now)
 }
 
+// GetWorkspacesForWorkspaceMetrics mocks base method.
+func (m *MockStore) GetWorkspacesForWorkspaceMetrics(ctx context.Context) ([]database.GetWorkspacesForWorkspaceMetricsRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetWorkspacesForWorkspaceMetrics", ctx)
+	ret0, _ := ret[0].([]database.GetWorkspacesForWorkspaceMetricsRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetWorkspacesForWorkspaceMetrics indicates an expected call of GetWorkspacesForWorkspaceMetrics.
+func (mr *MockStoreMockRecorder) GetWorkspacesForWorkspaceMetrics(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetWorkspacesForWorkspaceMetrics", reflect.TypeOf((*MockStore)(nil).GetWorkspacesForWorkspaceMetrics), ctx)
+}
+
 // InTx mocks base method.
 func (m *MockStore) InTx(arg0 func(database.Store) error, arg1 *database.TxOptions) error {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 097d8901ddedc..3ea3c912f8ccf 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -464,6 +464,7 @@ type sqlcQuerier interface {
 	GetWorkspaceAgentsByResourceIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAgent, error)
 	GetWorkspaceAgentsByWorkspaceAndBuildNumber(ctx context.Context, arg GetWorkspaceAgentsByWorkspaceAndBuildNumberParams) ([]WorkspaceAgent, error)
 	GetWorkspaceAgentsCreatedAfter(ctx context.Context, createdAt time.Time) ([]WorkspaceAgent, error)
+	GetWorkspaceAgentsForMetrics(ctx context.Context) ([]GetWorkspaceAgentsForMetricsRow, error)
 	GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) ([]WorkspaceAgent, error)
 	GetWorkspaceAppByAgentIDAndSlug(ctx context.Context, arg GetWorkspaceAppByAgentIDAndSlugParams) (WorkspaceApp, error)
 	GetWorkspaceAppStatusesByAppIDs(ctx context.Context, ids []uuid.UUID) ([]WorkspaceAppStatus, error)
@@ -510,6 +511,7 @@ type sqlcQuerier interface {
 	GetWorkspacesAndAgentsByOwnerID(ctx context.Context, ownerID uuid.UUID) ([]GetWorkspacesAndAgentsByOwnerIDRow, error)
 	GetWorkspacesByTemplateID(ctx context.Context, templateID uuid.UUID) ([]WorkspaceTable, error)
 	GetWorkspacesEligibleForTransition(ctx context.Context, now time.Time) ([]GetWorkspacesEligibleForTransitionRow, error)
+	GetWorkspacesForWorkspaceMetrics(ctx context.Context) ([]GetWorkspacesForWorkspaceMetricsRow, error)
 	InsertAIBridgeInterception(ctx context.Context, arg InsertAIBridgeInterceptionParams) (AIBridgeInterception, error)
 	InsertAIBridgeTokenUsage(ctx context.Context, arg InsertAIBridgeTokenUsageParams) (AIBridgeTokenUsage, error)
 	InsertAIBridgeToolUsage(ctx context.Context, arg InsertAIBridgeToolUsageParams) (AIBridgeToolUsage, error)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 9319416c56001..f62066954daf8 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -17645,6 +17645,102 @@ func (q *sqlQuerier) GetWorkspaceAgentsCreatedAfter(ctx context.Context, created
 	return items, nil
 }
 
+const getWorkspaceAgentsForMetrics = `-- name: GetWorkspaceAgentsForMetrics :many
+SELECT
+    w.id as workspace_id,
+    w.name as workspace_name,
+    u.username as owner_username,
+    t.name as template_name,
+    tv.name as template_version_name,
+    workspace_agents.id, workspace_agents.created_at, workspace_agents.updated_at, workspace_agents.name, workspace_agents.first_connected_at, workspace_agents.last_connected_at, workspace_agents.disconnected_at, workspace_agents.resource_id, workspace_agents.auth_token, workspace_agents.auth_instance_id, workspace_agents.architecture, workspace_agents.environment_variables, workspace_agents.operating_system, workspace_agents.instance_metadata, workspace_agents.resource_metadata, workspace_agents.directory, workspace_agents.version, workspace_agents.last_connected_replica_id, workspace_agents.connection_timeout_seconds, workspace_agents.troubleshooting_url, workspace_agents.motd_file, workspace_agents.lifecycle_state, workspace_agents.expanded_directory, workspace_agents.logs_length, workspace_agents.logs_overflowed, workspace_agents.started_at, workspace_agents.ready_at, workspace_agents.subsystems, workspace_agents.display_apps, workspace_agents.api_version, workspace_agents.display_order, workspace_agents.parent_id, workspace_agents.api_key_scope, workspace_agents.deleted
+FROM workspaces w
+JOIN users u ON w.owner_id = u.id
+JOIN templates t ON w.template_id = t.id
+JOIN workspace_builds wb ON w.id = wb.workspace_id
+LEFT JOIN template_versions tv ON wb.template_version_id = tv.id
+JOIN workspace_resources wr ON wb.job_id = wr.job_id
+JOIN workspace_agents ON wr.id = workspace_agents.resource_id
+WHERE w.deleted = false
+AND wb.build_number = (
+    SELECT MAX(wb2.build_number)
+    FROM workspace_builds wb2
+    WHERE wb2.workspace_id = w.id
+)
+AND workspace_agents.deleted = FALSE
+`
+
+type GetWorkspaceAgentsForMetricsRow struct {
+	WorkspaceID         uuid.UUID      `db:"workspace_id" json:"workspace_id"`
+	WorkspaceName       string         `db:"workspace_name" json:"workspace_name"`
+	OwnerUsername       string         `db:"owner_username" json:"owner_username"`
+	TemplateName        string         `db:"template_name" json:"template_name"`
+	TemplateVersionName sql.NullString `db:"template_version_name" json:"template_version_name"`
+	WorkspaceAgent      WorkspaceAgent `db:"workspace_agent" json:"workspace_agent"`
+}
+
+func (q *sqlQuerier) GetWorkspaceAgentsForMetrics(ctx context.Context) ([]GetWorkspaceAgentsForMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getWorkspaceAgentsForMetrics)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []GetWorkspaceAgentsForMetricsRow
+	for rows.Next() {
+		var i GetWorkspaceAgentsForMetricsRow
+		if err := rows.Scan(
+			&i.WorkspaceID,
+			&i.WorkspaceName,
+			&i.OwnerUsername,
+			&i.TemplateName,
+			&i.TemplateVersionName,
+			&i.WorkspaceAgent.ID,
+			&i.WorkspaceAgent.CreatedAt,
+			&i.WorkspaceAgent.UpdatedAt,
+			&i.WorkspaceAgent.Name,
+			&i.WorkspaceAgent.FirstConnectedAt,
+			&i.WorkspaceAgent.LastConnectedAt,
+			&i.WorkspaceAgent.DisconnectedAt,
+			&i.WorkspaceAgent.ResourceID,
+			&i.WorkspaceAgent.AuthToken,
+			&i.WorkspaceAgent.AuthInstanceID,
+			&i.WorkspaceAgent.Architecture,
+			&i.WorkspaceAgent.EnvironmentVariables,
+			&i.WorkspaceAgent.OperatingSystem,
+			&i.WorkspaceAgent.InstanceMetadata,
+			&i.WorkspaceAgent.ResourceMetadata,
+			&i.WorkspaceAgent.Directory,
+			&i.WorkspaceAgent.Version,
+			&i.WorkspaceAgent.LastConnectedReplicaID,
+			&i.WorkspaceAgent.ConnectionTimeoutSeconds,
+			&i.WorkspaceAgent.TroubleshootingURL,
+			&i.WorkspaceAgent.MOTDFile,
+			&i.WorkspaceAgent.LifecycleState,
+			&i.WorkspaceAgent.ExpandedDirectory,
+			&i.WorkspaceAgent.LogsLength,
+			&i.WorkspaceAgent.LogsOverflowed,
+			&i.WorkspaceAgent.StartedAt,
+			&i.WorkspaceAgent.ReadyAt,
+			pq.Array(&i.WorkspaceAgent.Subsystems),
+			pq.Array(&i.WorkspaceAgent.DisplayApps),
+			&i.WorkspaceAgent.APIVersion,
+			&i.WorkspaceAgent.DisplayOrder,
+			&i.WorkspaceAgent.ParentID,
+			&i.WorkspaceAgent.APIKeyScope,
+			&i.WorkspaceAgent.Deleted,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getWorkspaceAgentsInLatestBuildByWorkspaceID = `-- name: GetWorkspaceAgentsInLatestBuildByWorkspaceID :many
 SELECT
 	workspace_agents.id, workspace_agents.created_at, workspace_agents.updated_at, workspace_agents.name, workspace_agents.first_connected_at, workspace_agents.last_connected_at, workspace_agents.disconnected_at, workspace_agents.resource_id, workspace_agents.auth_token, workspace_agents.auth_instance_id, workspace_agents.architecture, workspace_agents.environment_variables, workspace_agents.operating_system, workspace_agents.instance_metadata, workspace_agents.resource_metadata, workspace_agents.directory, workspace_agents.version, workspace_agents.last_connected_replica_id, workspace_agents.connection_timeout_seconds, workspace_agents.troubleshooting_url, workspace_agents.motd_file, workspace_agents.lifecycle_state, workspace_agents.expanded_directory, workspace_agents.logs_length, workspace_agents.logs_overflowed, workspace_agents.started_at, workspace_agents.ready_at, workspace_agents.subsystems, workspace_agents.display_apps, workspace_agents.api_version, workspace_agents.display_order, workspace_agents.parent_id, workspace_agents.api_key_scope, workspace_agents.deleted
@@ -22354,6 +22450,64 @@ func (q *sqlQuerier) GetWorkspacesEligibleForTransition(ctx context.Context, now
 	return items, nil
 }
 
+const getWorkspacesForWorkspaceMetrics = `-- name: GetWorkspacesForWorkspaceMetrics :many
+SELECT
+    u.username as owner_username,
+    t.name as template_name,
+    tv.name as template_version_name,
+    pj.job_status as latest_build_status,
+    wb.transition as latest_build_transition
+FROM workspaces w
+JOIN users u ON w.owner_id = u.id
+JOIN templates t ON w.template_id = t.id
+JOIN workspace_builds wb ON w.id = wb.workspace_id
+JOIN provisioner_jobs pj ON wb.job_id = pj.id
+LEFT JOIN template_versions tv ON wb.template_version_id = tv.id
+WHERE w.deleted = false
+AND wb.build_number = (
+    SELECT MAX(wb2.build_number)
+    FROM workspace_builds wb2
+    WHERE wb2.workspace_id = w.id
+)
+`
+
+type GetWorkspacesForWorkspaceMetricsRow struct {
+	OwnerUsername         string               `db:"owner_username" json:"owner_username"`
+	TemplateName          string               `db:"template_name" json:"template_name"`
+	TemplateVersionName   sql.NullString       `db:"template_version_name" json:"template_version_name"`
+	LatestBuildStatus     ProvisionerJobStatus `db:"latest_build_status" json:"latest_build_status"`
+	LatestBuildTransition WorkspaceTransition  `db:"latest_build_transition" json:"latest_build_transition"`
+}
+
+func (q *sqlQuerier) GetWorkspacesForWorkspaceMetrics(ctx context.Context) ([]GetWorkspacesForWorkspaceMetricsRow, error) {
+	rows, err := q.db.QueryContext(ctx, getWorkspacesForWorkspaceMetrics)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []GetWorkspacesForWorkspaceMetricsRow
+	for rows.Next() {
+		var i GetWorkspacesForWorkspaceMetricsRow
+		if err := rows.Scan(
+			&i.OwnerUsername,
+			&i.TemplateName,
+			&i.TemplateVersionName,
+			&i.LatestBuildStatus,
+			&i.LatestBuildTransition,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const insertWorkspace = `-- name: InsertWorkspace :one
 INSERT INTO
 	workspaces (
diff --git a/coderd/database/queries/workspaceagents.sql b/coderd/database/queries/workspaceagents.sql
index c67435d7cbd06..cc59e96544778 100644
--- a/coderd/database/queries/workspaceagents.sql
+++ b/coderd/database/queries/workspaceagents.sql
@@ -365,3 +365,26 @@ WHERE
 	id = $1
 	AND parent_id IS NOT NULL
 	AND deleted = FALSE;
+
+-- name: GetWorkspaceAgentsForMetrics :many
+SELECT
+    w.id as workspace_id,
+    w.name as workspace_name,
+    u.username as owner_username,
+    t.name as template_name,
+    tv.name as template_version_name,
+    sqlc.embed(workspace_agents)
+FROM workspaces w
+JOIN users u ON w.owner_id = u.id
+JOIN templates t ON w.template_id = t.id
+JOIN workspace_builds wb ON w.id = wb.workspace_id
+LEFT JOIN template_versions tv ON wb.template_version_id = tv.id
+JOIN workspace_resources wr ON wb.job_id = wr.job_id
+JOIN workspace_agents ON wr.id = workspace_agents.resource_id
+WHERE w.deleted = false
+AND wb.build_number = (
+    SELECT MAX(wb2.build_number)
+    FROM workspace_builds wb2
+    WHERE wb2.workspace_id = w.id
+)
+AND workspace_agents.deleted = FALSE;
diff --git a/coderd/database/queries/workspaces.sql b/coderd/database/queries/workspaces.sql
index 7ab67e98e41e6..8ccc69b9a813c 100644
--- a/coderd/database/queries/workspaces.sql
+++ b/coderd/database/queries/workspaces.sql
@@ -983,3 +983,23 @@ WHERE
 	AND fsb.initiator_id != 'c42fdf75-3097-471c-8c33-fb52454d81c0'::uuid
 GROUP BY t.name, COALESCE(tvp.name, ''), o.name
 ORDER BY t.name, preset_name, o.name;
+
+-- name: GetWorkspacesForWorkspaceMetrics :many
+SELECT
+    u.username as owner_username,
+    t.name as template_name,
+    tv.name as template_version_name,
+    pj.job_status as latest_build_status,
+    wb.transition as latest_build_transition
+FROM workspaces w
+JOIN users u ON w.owner_id = u.id
+JOIN templates t ON w.template_id = t.id
+JOIN workspace_builds wb ON w.id = wb.workspace_id
+JOIN provisioner_jobs pj ON wb.job_id = pj.id
+LEFT JOIN template_versions tv ON wb.template_version_id = tv.id
+WHERE w.deleted = false
+AND wb.build_number = (
+    SELECT MAX(wb2.build_number)
+    FROM workspace_builds wb2
+    WHERE wb2.workspace_id = w.id
+);
diff --git a/coderd/prometheusmetrics/prometheusmetrics.go b/coderd/prometheusmetrics/prometheusmetrics.go
index ed55e4598dc21..525ec66c5a78a 100644
--- a/coderd/prometheusmetrics/prometheusmetrics.go
+++ b/coderd/prometheusmetrics/prometheusmetrics.go
@@ -181,10 +181,8 @@ func Workspaces(ctx context.Context, logger slog.Logger, registerer prometheus.R
 	done := make(chan struct{})
 
 	updateWorkspaceMetrics := func() {
-		ws, err := db.GetWorkspaces(ctx, database.GetWorkspacesParams{
-			Deleted:     false,
-			WithSummary: false,
-		})
+		// Don't count deleted workspaces as part of these metrics.
+		ws, err := db.GetWorkspacesForWorkspaceMetrics(ctx)
 		if err != nil {
 			if errors.Is(err, sql.ErrNoRows) {
 				workspaceLatestBuildTotals.Reset()
@@ -346,87 +344,66 @@ func Agents(ctx context.Context, logger slog.Logger, registerer prometheus.Regis
 			timer := prometheus.NewTimer(metricsCollectorAgents)
 			derpMap := derpMapFn()
 
-			workspaceRows, err := db.GetWorkspaces(ctx, database.GetWorkspacesParams{
-				AgentInactiveDisconnectTimeoutSeconds: int64(agentInactiveDisconnectTimeout.Seconds()),
-			})
+			workspaceAgents, err := db.GetWorkspaceAgentsForMetrics(ctx)
 			if err != nil {
-				logger.Error(ctx, "can't get workspace rows", slog.Error(err))
+				logger.Error(ctx, "can't get workspace agents", slog.Error(err))
 				goto done
 			}
 
-			for _, workspace := range workspaceRows {
-				templateName := workspace.TemplateName
-				templateVersionName := workspace.TemplateVersionName.String
-				if !workspace.TemplateVersionName.Valid {
+			for _, agent := range workspaceAgents {
+				// Collect information about agents
+				templateVersionName := agent.TemplateVersionName.String
+				if !agent.TemplateVersionName.Valid {
 					templateVersionName = "unknown"
 				}
+				agentsGauge.WithLabelValues(VectorOperationAdd, 1, agent.OwnerUsername, agent.WorkspaceName, agent.TemplateName, templateVersionName)
 
-				// username :=
+				connectionStatus := agent.WorkspaceAgent.Status(agentInactiveDisconnectTimeout)
+				node := (*coordinator.Load()).Node(agent.WorkspaceAgent.ID)
 
-				agents, err := db.GetWorkspaceAgentsInLatestBuildByWorkspaceID(ctx, workspace.ID)
-				if err != nil {
-					logger.Error(ctx, "can't get workspace agents", slog.F("workspace_id", workspace.ID), slog.Error(err))
-					agentsGauge.WithLabelValues(VectorOperationAdd, 0, workspace.OwnerUsername, workspace.Name, templateName, templateVersionName)
-					continue
+				tailnetNode := "unknown"
+				if node != nil {
+					tailnetNode = node.ID.String()
 				}
 
-				if len(agents) == 0 {
-					logger.Debug(ctx, "workspace agents are unavailable", slog.F("workspace_id", workspace.ID))
-					agentsGauge.WithLabelValues(VectorOperationAdd, 0, workspace.OwnerUsername, workspace.Name, templateName, templateVersionName)
-					continue
-				}
-
-				for _, agent := range agents {
-					// Collect information about agents
-					agentsGauge.WithLabelValues(VectorOperationAdd, 1, workspace.OwnerUsername, workspace.Name, templateName, templateVersionName)
-
-					connectionStatus := agent.Status(agentInactiveDisconnectTimeout)
-					node := (*coordinator.Load()).Node(agent.ID)
-
-					tailnetNode := "unknown"
-					if node != nil {
-						tailnetNode = node.ID.String()
-					}
-
-					agentsConnectionsGauge.WithLabelValues(VectorOperationSet, 1, agent.Name, workspace.OwnerUsername, workspace.Name, string(connectionStatus.Status), string(agent.LifecycleState), tailnetNode)
-
-					if node == nil {
-						logger.Debug(ctx, "can't read in-memory node for agent", slog.F("agent_id", agent.ID))
-					} else {
-						// Collect information about connection latencies
-						for rawRegion, latency := range node.DERPLatency {
-							regionParts := strings.SplitN(rawRegion, "-", 2)
-							regionID, err := strconv.Atoi(regionParts[0])
-							if err != nil {
-								logger.Error(ctx, "can't convert DERP region", slog.F("agent_id", agent.ID), slog.F("raw_region", rawRegion), slog.Error(err))
-								continue
-							}
+				agentsConnectionsGauge.WithLabelValues(VectorOperationSet, 1, agent.WorkspaceAgent.Name, agent.OwnerUsername, agent.WorkspaceName, string(connectionStatus.Status), string(agent.WorkspaceAgent.LifecycleState), tailnetNode)
+
+				if node == nil {
+					logger.Debug(ctx, "can't read in-memory node for agent", slog.F("agent_id", agent.WorkspaceAgent.ID))
+				} else {
+					// Collect information about connection latencies
+					for rawRegion, latency := range node.DERPLatency {
+						regionParts := strings.SplitN(rawRegion, "-", 2)
+						regionID, err := strconv.Atoi(regionParts[0])
+						if err != nil {
+							logger.Error(ctx, "can't convert DERP region", slog.F("agent_id", agent.WorkspaceAgent.ID), slog.F("raw_region", rawRegion), slog.Error(err))
+							continue
+						}
 
-							region, found := derpMap.Regions[regionID]
-							if !found {
-								// It's possible that a workspace agent is using an old DERPMap
-								// and reports regions that do not exist. If that's the case,
-								// report the region as unknown!
-								region = &tailcfg.DERPRegion{
-									RegionID:   regionID,
-									RegionName: fmt.Sprintf("Unnamed %d", regionID),
-								}
+						region, found := derpMap.Regions[regionID]
+						if !found {
+							// It's possible that a workspace agent is using an old DERPMap
+							// and reports regions that do not exist. If that's the case,
+							// report the region as unknown!
+							region = &tailcfg.DERPRegion{
+								RegionID:   regionID,
+								RegionName: fmt.Sprintf("Unnamed %d", regionID),
 							}
-
-							agentsConnectionLatenciesGauge.WithLabelValues(VectorOperationSet, latency, agent.Name, workspace.OwnerUsername, workspace.Name, region.RegionName, fmt.Sprintf("%v", node.PreferredDERP == regionID))
 						}
-					}
 
-					// Collect information about registered applications
-					apps, err := db.GetWorkspaceAppsByAgentID(ctx, agent.ID)
-					if err != nil && !errors.Is(err, sql.ErrNoRows) {
-						logger.Error(ctx, "can't get workspace apps", slog.F("agent_id", agent.ID), slog.Error(err))
-						continue
+						agentsConnectionLatenciesGauge.WithLabelValues(VectorOperationSet, latency, agent.WorkspaceAgent.Name, agent.OwnerUsername, agent.WorkspaceName, region.RegionName, fmt.Sprintf("%v", node.PreferredDERP == regionID))
 					}
+				}
 
-					for _, app := range apps {
-						agentsAppsGauge.WithLabelValues(VectorOperationAdd, 1, agent.Name, workspace.OwnerUsername, workspace.Name, app.DisplayName, string(app.Health))
-					}
+				// Collect information about registered applications
+				apps, err := db.GetWorkspaceAppsByAgentID(ctx, agent.WorkspaceAgent.ID)
+				if err != nil && !errors.Is(err, sql.ErrNoRows) {
+					logger.Error(ctx, "can't get workspace apps", slog.F("agent_id", agent.WorkspaceAgent.ID), slog.Error(err))
+					continue
+				}
+
+				for _, app := range apps {
+					agentsAppsGauge.WithLabelValues(VectorOperationAdd, 1, agent.WorkspaceAgent.Name, agent.OwnerUsername, agent.WorkspaceName, app.DisplayName, string(app.Health))
 				}
 			}
 
diff --git a/coderd/prometheusmetrics/prometheusmetrics_test.go b/coderd/prometheusmetrics/prometheusmetrics_test.go
index e75f86e51b55c..0d115e0840473 100644
--- a/coderd/prometheusmetrics/prometheusmetrics_test.go
+++ b/coderd/prometheusmetrics/prometheusmetrics_test.go
@@ -291,6 +291,7 @@ func TestWorkspaceLatestBuildTotals(t *testing.T) {
 					}
 
 					for _, metric := range m.Metric {
+						fmt.Printf("metric: %+v\n", metric)
 						count, ok := tc.Status[codersdk.ProvisionerJobStatus(metric.Label[0].GetValue())]
 						if metric.Gauge.GetValue() == 0 {
 							continue

From cbaa97cb784b3df4dc9592243534a56c882e1fad Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Fri, 17 Oct 2025 14:18:50 -0800
Subject: [PATCH 169/298] feat: add copy on ctrl/command+shift+c and selection
 to web terminal (#20129)

Closes https://github.com/coder/coder/issues/20044
---
 site/src/pages/TerminalPage/TerminalPage.tsx | 48 ++++++++++++++++++--
 1 file changed, 44 insertions(+), 4 deletions(-)

diff --git a/site/src/pages/TerminalPage/TerminalPage.tsx b/site/src/pages/TerminalPage/TerminalPage.tsx
index 6e45ed8dce1b4..ed8f9ffa1373b 100644
--- a/site/src/pages/TerminalPage/TerminalPage.tsx
+++ b/site/src/pages/TerminalPage/TerminalPage.tsx
@@ -14,6 +14,7 @@ import {
 } from "api/queries/workspaces";
 import { useProxy } from "contexts/ProxyContext";
 import { ThemeOverride } from "contexts/ThemeProvider";
+import { useClipboard } from "hooks/useClipboard";
 import { useEmbeddedMetadata } from "hooks/useEmbeddedMetadata";
 import { type FC, useCallback, useEffect, useRef, useState } from "react";
 import { useQuery } from "react-query";
@@ -80,6 +81,8 @@ const TerminalPage: FC = () => {
 	const config = useQuery(deploymentConfig());
 	const renderer = config.data?.config.web_terminal_renderer;
 
+	const { copyToClipboard } = useClipboard();
+
 	// Periodically report workspace usage.
 	useQuery(
 		workspaceUsage({
@@ -147,12 +150,21 @@ const TerminalPage: FC = () => {
 			}),
 		);
 
-		// Make shift+enter send ^[^M (escaped carriage return).  Applications
-		// typically take this to mean to insert a literal newline.  There is no way
-		// to remove this handler, so we must attach it once and rely on a ref to
-		// send it to the current socket.
+		const isMac = navigator.platform.match("Mac");
+
+		const copySelection = () => {
+			const selection = terminal.getSelection();
+			if (selection) {
+				copyToClipboard(selection);
+			}
+		};
+
+		// There is no way to remove this handler, so we must attach it once and
+		// rely on a ref to send it to the current socket.
 		const escapedCarriageReturn = "\x1b\r";
 		terminal.attachCustomKeyEventHandler((ev) => {
+			// Make shift+enter send ^[^M (escaped carriage return).  Applications
+			// typically take this to mean to insert a literal newline.
 			if (ev.shiftKey && ev.key === "Enter") {
 				if (ev.type === "keydown") {
 					websocketRef.current?.send(
@@ -163,9 +175,36 @@ const TerminalPage: FC = () => {
 				}
 				return false;
 			}
+			// Make ctrl+shift+c (command+shift+c on macOS) copy the selected text.
+			// By default this usually launches the browser dev tools, but users
+			// expect this keybinding to copy when in the context of the web terminal.
+			if ((isMac ? ev.metaKey : ev.ctrlKey) && ev.shiftKey && ev.key === "C") {
+				ev.preventDefault();
+				if (ev.type === "keydown") {
+					copySelection();
+				}
+				return false;
+			}
 			return true;
 		});
 
+		// Copy using the clipboard API on selection.  This selected text will go
+		// into the clipboard, not the primary selection, as the browser does not
+		// give us an API to set the primary selection (only relevant to systems
+		// that have this distinction, like X11).
+		//
+		// We could bind the middle mouse button to paste from the clipboard to
+		// compensate, but then we would break pasting selections from external
+		// applications into the web terminal.  Not sure which tradeoff is worse; it
+		// probably varies between users.
+		//
+		// In other words, this copied text can be pasted with a keybinding
+		// (typically ctrl+v, ctrl+shift+v, or shift+insert), but *not* with the
+		// middle mouse button.
+		terminal.onSelectionChange(() => {
+			copySelection();
+		});
+
 		terminal.open(terminalWrapperRef.current);
 
 		// We have to fit twice here. It's unknown why, but the first fit will
@@ -189,6 +228,7 @@ const TerminalPage: FC = () => {
 		renderer,
 		theme.palette.background.default,
 		currentTerminalFont,
+		copyToClipboard,
 	]);
 
 	// Updates the reconnection token into the URL if necessary.

From 1a766a271f22a83395c4dec6fc456b23384d8e16 Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Sat, 18 Oct 2025 07:25:27 +0200
Subject: [PATCH 170/298] fix: replace blink with ci-flake-bot agent (#20368)

---
 .github/workflows/ci.yaml               | 2 +-
 .github/workflows/nightly-gauntlet.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index eb2ba62e6b764..e9f7045cf220e 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1537,7 +1537,7 @@ jobs:
     steps:
       - name: Send Slack notification
         run: |
-          ESCAPED_PROMPT=$(printf "%s" "<@U08TJ4YNCA3> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
+          ESCAPED_PROMPT=$(printf "%s" "<@A09M3J8FK1U> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
           curl -X POST -H 'Content-type: application/json' \
           --data '{
             "blocks": [
diff --git a/.github/workflows/nightly-gauntlet.yaml b/.github/workflows/nightly-gauntlet.yaml
index 6000a0f79e4b0..a79ed6dcd28b9 100644
--- a/.github/workflows/nightly-gauntlet.yaml
+++ b/.github/workflows/nightly-gauntlet.yaml
@@ -170,7 +170,7 @@ jobs:
     steps:
       - name: Send Slack notification
         run: |
-          ESCAPED_PROMPT=$(printf "%s" "<@U08TJ4YNCA3> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
+          ESCAPED_PROMPT=$(printf "%s" "<@A09M3J8FK1U> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
           curl -X POST -H 'Content-type: application/json' \
           --data '{
             "blocks": [

From 251f7877432f7be49b924e507cf33fccf7663f61 Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Sun, 19 Oct 2025 13:20:48 +0200
Subject: [PATCH 171/298] fix: normalize oauth2 scope parsing (#20359)

---
 coderd/oauth2provider/authorize.go            |   2 +-
 coderd/oauth2provider/tokens.go               |   3 +
 coderd/oauth2provider/tokens_internal_test.go | 363 ++++++++++++++++++
 3 files changed, 367 insertions(+), 1 deletion(-)
 create mode 100644 coderd/oauth2provider/tokens_internal_test.go

diff --git a/coderd/oauth2provider/authorize.go b/coderd/oauth2provider/authorize.go
index 4100b82306384..d6b05fc51673f 100644
--- a/coderd/oauth2provider/authorize.go
+++ b/coderd/oauth2provider/authorize.go
@@ -40,7 +40,7 @@ func extractAuthorizeParams(r *http.Request, callbackURL *url.URL) (authorizePar
 		clientID:            p.String(vals, "", "client_id"),
 		redirectURL:         p.RedirectURL(vals, callbackURL, "redirect_uri"),
 		responseType:        httpapi.ParseCustom(p, vals, "", "response_type", httpapi.ParseEnum[codersdk.OAuth2ProviderResponseType]),
-		scope:               p.Strings(vals, []string{}, "scope"),
+		scope:               strings.Fields(strings.TrimSpace(p.String(vals, "", "scope"))),
 		state:               p.String(vals, "", "state"),
 		resource:            p.String(vals, "", "resource"),
 		codeChallenge:       p.String(vals, "", "code_challenge"),
diff --git a/coderd/oauth2provider/tokens.go b/coderd/oauth2provider/tokens.go
index ac29d26ea5a56..78fd15fc3262a 100644
--- a/coderd/oauth2provider/tokens.go
+++ b/coderd/oauth2provider/tokens.go
@@ -8,6 +8,7 @@ import (
 	"net/http"
 	"net/url"
 	"slices"
+	"strings"
 	"time"
 
 	"github.com/google/uuid"
@@ -47,6 +48,7 @@ type tokenParams struct {
 	refreshToken string
 	codeVerifier string // PKCE verifier
 	resource     string // RFC 8707 resource for token binding
+	scopes       []string
 }
 
 func extractTokenParams(r *http.Request, callbackURL *url.URL) (tokenParams, []codersdk.ValidationError, error) {
@@ -75,6 +77,7 @@ func extractTokenParams(r *http.Request, callbackURL *url.URL) (tokenParams, []c
 		refreshToken: p.String(vals, "", "refresh_token"),
 		codeVerifier: p.String(vals, "", "code_verifier"),
 		resource:     p.String(vals, "", "resource"),
+		scopes:       strings.Fields(strings.TrimSpace(p.String(vals, "", "scope"))),
 	}
 	// Validate resource parameter syntax (RFC 8707): must be absolute URI without fragment
 	if err := validateResourceParameter(params.resource); err != nil {
diff --git a/coderd/oauth2provider/tokens_internal_test.go b/coderd/oauth2provider/tokens_internal_test.go
new file mode 100644
index 0000000000000..09dcd49f34d38
--- /dev/null
+++ b/coderd/oauth2provider/tokens_internal_test.go
@@ -0,0 +1,363 @@
+package oauth2provider
+
+import (
+	"net/http"
+	"net/url"
+	"testing"
+
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/codersdk"
+)
+
+// TestExtractTokenParams_Scopes tests OAuth2 scope parameter parsing
+// to ensure RFC 6749 compliance where scopes are space-delimited
+func TestExtractTokenParams_Scopes(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name           string
+		scopeParam     string   // Raw query param value (before URL encoding)
+		expectedScopes []string // Expected parsed scope slice
+		description    string   // Test case description
+	}{
+		{
+			name:           "SpaceSeparatedTwoScopes",
+			scopeParam:     "coder:workspace.create coder:workspace.operate",
+			expectedScopes: []string{"coder:workspace.create", "coder:workspace.operate"},
+			description:    "RFC 6749 compliant: space-separated scopes",
+		},
+		{
+			name:           "SpaceSeparatedThreeScopes",
+			scopeParam:     "scope1 scope2 scope3",
+			expectedScopes: []string{"scope1", "scope2", "scope3"},
+			description:    "Multiple space-separated scopes",
+		},
+		{
+			name:           "SingleScope",
+			scopeParam:     "coder:workspace.create",
+			expectedScopes: []string{"coder:workspace.create"},
+			description:    "Single scope without spaces",
+		},
+		{
+			name:           "EmptyScope",
+			scopeParam:     "",
+			expectedScopes: []string{},
+			description:    "Empty scope parameter",
+		},
+		{
+			name:           "MultipleSpaces",
+			scopeParam:     "scope1  scope2   scope3",
+			expectedScopes: []string{"scope1", "scope2", "scope3"},
+			description:    "Multiple consecutive spaces should be handled gracefully",
+		},
+		{
+			name:           "LeadingAndTrailingSpaces",
+			scopeParam:     " scope1 scope2 ",
+			expectedScopes: []string{"scope1", "scope2"},
+			description:    "Leading and trailing spaces should be trimmed",
+		},
+		{
+			name:           "ColonInScope",
+			scopeParam:     "coder:workspace:read coder:workspace:write",
+			expectedScopes: []string{"coder:workspace:read", "coder:workspace:write"},
+			description:    "Scopes with colons (common pattern)",
+		},
+		{
+			name:           "DotInScope",
+			scopeParam:     "workspace.create workspace.delete",
+			expectedScopes: []string{"workspace.create", "workspace.delete"},
+			description:    "Scopes with dots (common pattern)",
+		},
+		{
+			name:           "HyphenInScope",
+			scopeParam:     "workspace-read workspace-write",
+			expectedScopes: []string{"workspace-read", "workspace-write"},
+			description:    "Scopes with hyphens",
+		},
+		{
+			name:           "UnderscoreInScope",
+			scopeParam:     "workspace_create workspace_delete",
+			expectedScopes: []string{"workspace_create", "workspace_delete"},
+			description:    "Scopes with underscores",
+		},
+		{
+			name:           "OpenIDScopes",
+			scopeParam:     "openid profile email",
+			expectedScopes: []string{"openid", "profile", "email"},
+			description:    "Common OpenID Connect scopes",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			// Create a mock request with the scope parameter
+			callbackURL, err := url.Parse("http://localhost:3000/callback")
+			require.NoError(t, err)
+
+			// Build form values (simulating POST request body)
+			form := url.Values{}
+			form.Set("grant_type", "authorization_code")
+			form.Set("client_id", "test-client")
+			form.Set("client_secret", "test-secret")
+			form.Set("code", "test-code")
+			if tc.scopeParam != "" {
+				form.Set("scope", tc.scopeParam)
+			}
+
+			// Create request with form data already parsed
+			// Set PostForm and Form directly to bypass the need for a request body
+			req := &http.Request{
+				Method:   http.MethodPost,
+				PostForm: form,
+				Form:     form, // Form is the combination of PostForm and URL query
+			}
+
+			// Extract token params
+			params, validationErrs, err := extractTokenParams(req, callbackURL)
+
+			// Verify no errors occurred
+			require.NoError(t, err, "extractTokenParams should not return error for: %s", tc.description)
+			require.Empty(t, validationErrs, "should have no validation errors for: %s", tc.description)
+
+			// Verify scopes match expected
+			require.Equal(t, tc.expectedScopes, params.scopes, "scope parsing failed for: %s", tc.description)
+		})
+	}
+}
+
+// TestExtractTokenParams_ScopesURLEncoded tests that URL-encoded space-separated
+// scopes are correctly decoded and parsed
+func TestExtractTokenParams_ScopesURLEncoded(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name           string
+		rawQuery       string   // Raw query string with URL encoding
+		expectedScopes []string // Expected parsed scope slice
+	}{
+		{
+			name:           "PlusEncodedSpaces",
+			rawQuery:       "grant_type=authorization_code&client_id=test&client_secret=secret&code=code&scope=scope1+scope2+scope3",
+			expectedScopes: []string{"scope1", "scope2", "scope3"},
+		},
+		{
+			name:           "PercentEncodedSpaces",
+			rawQuery:       "grant_type=authorization_code&client_id=test&client_secret=secret&code=code&scope=scope1%20scope2%20scope3",
+			expectedScopes: []string{"scope1", "scope2", "scope3"},
+		},
+		{
+			name:           "MixedEncoding",
+			rawQuery:       "grant_type=authorization_code&client_id=test&client_secret=secret&code=code&scope=scope1+scope2%20scope3",
+			expectedScopes: []string{"scope1", "scope2", "scope3"},
+		},
+		{
+			name:           "ColonEncodedInScope",
+			rawQuery:       "grant_type=authorization_code&client_id=test&client_secret=secret&code=code&scope=coder%3Aworkspace.create+coder%3Aworkspace.operate",
+			expectedScopes: []string{"coder:workspace.create", "coder:workspace.operate"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			callbackURL, err := url.Parse("http://localhost:3000/callback")
+			require.NoError(t, err)
+
+			// Parse the raw query string
+			values, err := url.ParseQuery(tc.rawQuery)
+			require.NoError(t, err)
+
+			// Create request with form data already parsed
+			req := &http.Request{
+				Method:   http.MethodPost,
+				PostForm: values,
+				Form:     values,
+			}
+
+			// Extract token params
+			params, validationErrs, err := extractTokenParams(req, callbackURL)
+
+			// Verify no errors
+			require.NoError(t, err)
+			require.Empty(t, validationErrs)
+
+			// Verify scopes
+			require.Equal(t, tc.expectedScopes, params.scopes)
+		})
+	}
+}
+
+// TestExtractTokenParams_ScopesEdgeCases tests edge cases in scope parsing
+func TestExtractTokenParams_ScopesEdgeCases(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name           string
+		setupForm      func() url.Values
+		expectedScopes []string
+		description    string
+	}{
+		{
+			name: "NoScopeParameter",
+			setupForm: func() url.Values {
+				form := url.Values{}
+				form.Set("grant_type", "authorization_code")
+				form.Set("client_id", "test-client")
+				form.Set("client_secret", "test-secret")
+				form.Set("code", "test-code")
+				return form
+			},
+			expectedScopes: []string{},
+			description:    "Missing scope parameter should default to empty slice",
+		},
+		{
+			name: "OnlySpaces",
+			setupForm: func() url.Values {
+				form := url.Values{}
+				form.Set("grant_type", "authorization_code")
+				form.Set("client_id", "test-client")
+				form.Set("client_secret", "test-secret")
+				form.Set("code", "test-code")
+				form.Set("scope", "   ")
+				return form
+			},
+			expectedScopes: []string{},
+			description:    "Scope with only spaces should result in empty slice",
+		},
+		{
+			name: "VeryLongScopeName",
+			setupForm: func() url.Values {
+				longScope := "coder:workspace:project:resource:action:create:read:write:delete:admin"
+				form := url.Values{}
+				form.Set("grant_type", "authorization_code")
+				form.Set("client_id", "test-client")
+				form.Set("client_secret", "test-secret")
+				form.Set("code", "test-code")
+				form.Set("scope", longScope)
+				return form
+			},
+			expectedScopes: []string{"coder:workspace:project:resource:action:create:read:write:delete:admin"},
+			description:    "Very long scope names should be handled",
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			callbackURL, err := url.Parse("http://localhost:3000/callback")
+			require.NoError(t, err)
+
+			form := tc.setupForm()
+			req := &http.Request{
+				Method:   http.MethodPost,
+				PostForm: form,
+				Form:     form,
+			}
+
+			params, validationErrs, err := extractTokenParams(req, callbackURL)
+
+			require.NoError(t, err, "extractTokenParams should not error for: %s", tc.description)
+			require.Empty(t, validationErrs)
+			require.Equal(t, tc.expectedScopes, params.scopes, "scope mismatch for: %s", tc.description)
+		})
+	}
+}
+
+// TestExtractAuthorizeParams_Scopes tests scope parsing in the authorization endpoint
+func TestExtractAuthorizeParams_Scopes(t *testing.T) {
+	t.Parallel()
+
+	testCases := []struct {
+		name           string
+		scopeParam     string
+		expectedScopes []string
+	}{
+		{
+			name:           "SpaceSeparated",
+			scopeParam:     "openid profile email",
+			expectedScopes: []string{"openid", "profile", "email"},
+		},
+		{
+			name:           "SingleScope",
+			scopeParam:     "openid",
+			expectedScopes: []string{"openid"},
+		},
+		{
+			name:           "EmptyScope",
+			scopeParam:     "",
+			expectedScopes: []string{},
+		},
+		{
+			name:           "CoderScopes",
+			scopeParam:     "coder:workspace.create coder:workspace.read coder:workspace.delete",
+			expectedScopes: []string{"coder:workspace.create", "coder:workspace.read", "coder:workspace.delete"},
+		},
+	}
+
+	for _, tc := range testCases {
+		t.Run(tc.name, func(t *testing.T) {
+			t.Parallel()
+
+			callbackURL, err := url.Parse("http://localhost:3000/callback")
+			require.NoError(t, err)
+
+			// Build query parameters for GET request
+			query := url.Values{}
+			query.Set("response_type", "code")
+			query.Set("client_id", "test-client")
+			query.Set("redirect_uri", "http://localhost:3000/callback")
+			if tc.scopeParam != "" {
+				query.Set("scope", tc.scopeParam)
+			}
+
+			// Create request with query parameters
+			reqURL, err := url.Parse("http://localhost:8080/oauth2/authorize?" + query.Encode())
+			require.NoError(t, err)
+
+			req := &http.Request{
+				Method: http.MethodGet,
+				URL:    reqURL,
+			}
+
+			// Extract authorize params
+			params, validationErrs, err := extractAuthorizeParams(req, callbackURL)
+
+			require.NoError(t, err)
+			require.Empty(t, validationErrs)
+			require.Equal(t, tc.expectedScopes, params.scope)
+		})
+	}
+}
+
+// TestRefreshTokenGrant_Scopes tests that scopes can be requested during refresh
+func TestRefreshTokenGrant_Scopes(t *testing.T) {
+	t.Parallel()
+
+	// Test that refresh token requests can include scope parameter
+	// per RFC 6749 Section 6
+	form := url.Values{}
+	form.Set("grant_type", "refresh_token")
+	form.Set("refresh_token", "test-refresh-token")
+	form.Set("scope", "reduced:scope subset:scope")
+
+	callbackURL, err := url.Parse("http://localhost:3000/callback")
+	require.NoError(t, err)
+
+	req := &http.Request{
+		Method:   http.MethodPost,
+		PostForm: form,
+		Form:     form,
+	}
+
+	params, validationErrs, err := extractTokenParams(req, callbackURL)
+
+	require.NoError(t, err)
+	require.Empty(t, validationErrs)
+	require.Equal(t, codersdk.OAuth2ProviderGrantTypeRefreshToken, params.grantType)
+	require.Equal(t, []string{"reduced:scope", "subset:scope"}, params.scopes)
+}

From 784592a2dc6371bece2e6a7464f2886bc3ab1e89 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 00:26:39 +0000
Subject: [PATCH 172/298] chore: bump coder/git-clone/coder from 1.1.2 to 1.2.0
 in /dogfood/coder (#20374)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/git-clone/coder&package-manager=terraform&previous-version=1.1.2&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index f9b6250726a82..faafba7e59d2b 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -371,7 +371,7 @@ module "git-config" {
 module "git-clone" {
   count    = data.coder_workspace.me.start_count
   source   = "dev.registry.coder.com/coder/git-clone/coder"
-  version  = "1.1.2"
+  version  = "1.2.0"
   agent_id = coder_agent.dev.id
   url      = "https://github.com/coder/coder"
   base_dir = local.repo_base_dir

From e92b4fe13d8786ce986b832e10070d3bf0ed2247 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 00:26:54 +0000
Subject: [PATCH 173/298] chore: bump coder/claude-code/coder from 3.1.0 to
 3.1.1 in /dogfood/coder (#20375)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/claude-code/coder&package-manager=terraform&previous-version=3.1.0&new-version=3.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index faafba7e59d2b..15ae86199026e 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -850,7 +850,7 @@ locals {
 module "claude-code" {
   count               = local.has_ai_prompt ? data.coder_workspace.me.start_count : 0
   source              = "dev.registry.coder.com/coder/claude-code/coder"
-  version             = "3.1.0"
+  version             = "3.1.1"
   agent_id            = coder_agent.dev.id
   workdir             = local.repo_dir
   claude_code_version = "latest"

From a13f29ff954a5178482d35b95d47fb939e7e2a93 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 00:33:04 +0000
Subject: [PATCH 174/298] chore: bump coder/cursor/coder from 1.2.0 to 1.3.2 in
 /examples/templates/tasks-docker (#20377)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/cursor/coder&package-manager=terraform&previous-version=1.2.0&new-version=1.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/templates/tasks-docker/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/templates/tasks-docker/main.tf b/examples/templates/tasks-docker/main.tf
index c0a165fccbc4b..3096e872681ab 100644
--- a/examples/templates/tasks-docker/main.tf
+++ b/examples/templates/tasks-docker/main.tf
@@ -278,7 +278,7 @@ module "windsurf" {
 module "cursor" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/cursor/coder"
-  version  = "1.2.0"
+  version  = "1.3.2"
   agent_id = coder_agent.main.id
 }
 

From 88851d248c2163f96d2d3af3c0c72c25e2e25dca Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Mon, 20 Oct 2025 13:26:17 +0400
Subject: [PATCH 175/298] feat: add tracing and prometheus options to exp
 scaletest dynamic-parameters (#20354)

Adds prometheus server and tracing to `coder exp scaletest dynamic-parameters`

part of https://github.com/coder/internal/issues/912
---
 cli/exp_scaletest_dynamicparameters.go | 64 +++++++++++++++++++++++---
 1 file changed, 58 insertions(+), 6 deletions(-)

diff --git a/cli/exp_scaletest_dynamicparameters.go b/cli/exp_scaletest_dynamicparameters.go
index fc0b949c9106e..2998be2e3fe8d 100644
--- a/cli/exp_scaletest_dynamicparameters.go
+++ b/cli/exp_scaletest_dynamicparameters.go
@@ -4,16 +4,20 @@ package cli
 
 import (
 	"fmt"
+	"net/http"
+	"time"
 
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/sloghuman"
+	"github.com/coder/serpent"
 
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/scaletest/dynamicparameters"
 	"github.com/coder/coder/v2/scaletest/harness"
-	"github.com/coder/serpent"
 )
 
 const (
@@ -21,8 +25,12 @@ const (
 )
 
 func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
-	var templateName string
-	var numEvals int64
+	var (
+		templateName    string
+		numEvals        int64
+		tracingFlags    = &scaletestTracingFlags{}
+		prometheusFlags = &scaletestPrometheusFlags{}
+	)
 	orgContext := NewOrganizationContext()
 	output := &scaletestOutputFlags{}
 
@@ -51,15 +59,50 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 				return err
 			}
 
+			_, err = requireAdmin(ctx, client)
+			if err != nil {
+				return err
+			}
+
+			client.HTTPClient = &http.Client{
+				Transport: &codersdk.HeaderTransport{
+					Transport: http.DefaultTransport,
+					Header: map[string][]string{
+						codersdk.BypassRatelimitHeader: {"true"},
+					},
+				},
+			}
+
+			reg := prometheus.NewRegistry()
+			metrics := dynamicparameters.NewMetrics(reg, "concurrent_evaluations")
+
 			logger := slog.Make(sloghuman.Sink(inv.Stdout)).Leveled(slog.LevelDebug)
+			prometheusSrvClose := ServeHandler(ctx, logger, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}), prometheusFlags.Address, "prometheus")
+			defer prometheusSrvClose()
+
+			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
+			if err != nil {
+				return xerrors.Errorf("create tracer provider: %w", err)
+			}
+			defer func() {
+				// Allow time for traces to flush even if command context is
+				// canceled. This is a no-op if tracing is not enabled.
+				_, _ = fmt.Fprintln(inv.Stderr, "\nUploading traces...")
+				if err := closeTracing(ctx); err != nil {
+					_, _ = fmt.Fprintf(inv.Stderr, "\nError uploading traces: %+v\n", err)
+				}
+				// Wait for prometheus metrics to be scraped
+				_, _ = fmt.Fprintf(inv.Stderr, "Waiting %s for prometheus metrics to be scraped\n", prometheusFlags.Wait)
+				<-time.After(prometheusFlags.Wait)
+			}()
+			tracer := tracerProvider.Tracer(scaletestTracerName)
+
 			partitions, err := dynamicparameters.SetupPartitions(ctx, client, org.ID, templateName, numEvals, logger)
 			if err != nil {
 				return xerrors.Errorf("setup dynamic parameters partitions: %w", err)
 			}
 
 			th := harness.NewTestHarness(harness.ConcurrentExecutionStrategy{}, harness.ConcurrentExecutionStrategy{})
-			reg := prometheus.NewRegistry()
-			metrics := dynamicparameters.NewMetrics(reg, "concurrent_evaluations")
 
 			for i, part := range partitions {
 				for j := range part.ConcurrentEvaluations {
@@ -68,7 +111,14 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 						Metrics:           metrics,
 						MetricLabelValues: []string{fmt.Sprintf("%d", part.ConcurrentEvaluations)},
 					}
-					runner := dynamicparameters.NewRunner(client, cfg)
+					var runner harness.Runnable = dynamicparameters.NewRunner(client, cfg)
+					if tracingEnabled {
+						runner = &runnableTraceWrapper{
+							tracer:   tracer,
+							spanName: fmt.Sprintf("%s/%d/%d", dynamicParametersTestName, i, j),
+							runner:   runner,
+						}
+					}
 					th.AddRun(dynamicParametersTestName, fmt.Sprintf("%d/%d", j, i), runner)
 				}
 			}
@@ -106,5 +156,7 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 	}
 	orgContext.AttachOptions(cmd)
 	output.attach(&cmd.Options)
+	tracingFlags.attach(&cmd.Options)
+	prometheusFlags.attach(&cmd.Options)
 	return cmd
 }

From c1f8465de6d8fc2c0b704eb27554fcf4004f5fe6 Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Mon, 20 Oct 2025 11:33:45 +0100
Subject: [PATCH 176/298] fix: add missing provisionerd metrics to docs
 (#20358)

## Description

Add missing provisionerd metrics to Prometheus documentation:
* `coderd_provisionerd_num_daemons`: The number of provisioner daemons.
* `coderd_provisionerd_workspace_build_timings_seconds`: The time taken
for a workspace to build.

Related to internal thread:
https://codercom.slack.com/archives/C07GRNNRW03/p1760642020583019
---
 docs/admin/integrations/prometheus.md |  2 ++
 scripts/metricsdocgen/metrics         | 20 ++++++++++++++++++--
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/docs/admin/integrations/prometheus.md b/docs/admin/integrations/prometheus.md
index 47fbc575c7c2e..f3820bdd298dd 100644
--- a/docs/admin/integrations/prometheus.md
+++ b/docs/admin/integrations/prometheus.md
@@ -146,6 +146,8 @@ deployment. They will always be available from the agent.
 | `coderd_prebuilt_workspace_claim_duration_seconds`            | histogram | Time to claim a prebuilt workspace by organization, template, and preset.                                                        | `organization_name` `preset_name` `template_name`                                    |
 | `coderd_provisionerd_job_timings_seconds`                     | histogram | The provisioner job time duration in seconds.                                                                                    | `provisioner` `status`                                                               |
 | `coderd_provisionerd_jobs_current`                            | gauge     | The number of currently running provisioner jobs.                                                                                | `provisioner`                                                                        |
+| `coderd_provisionerd_num_daemons`                             | gauge     | The number of provisioner daemons.                                                                                               |                                                                                      |
+| `coderd_provisionerd_workspace_build_timings_seconds`         | histogram | The time taken for a workspace to build.                                                                                         | `status` `template_name` `template_version` `workspace_transition`                   |
 | `coderd_workspace_builds_total`                               | counter   | The number of workspaces started, updated, or deleted.                                                                           | `action` `owner_email` `status` `template_name` `template_version` `workspace_name`  |
 | `coderd_workspace_creation_duration_seconds`                  | histogram | Time to create a workspace by organization, template, preset, and type (regular or prebuild).                                    | `organization_name` `preset_name` `template_name` `type`                             |
 | `coderd_workspace_creation_total`                             | counter   | Total regular (non-prebuilt) workspace creations by organization, template, and preset.                                          | `organization_name` `preset_name` `template_name`                                    |
diff --git a/scripts/metricsdocgen/metrics b/scripts/metricsdocgen/metrics
index 20e24d9caa136..ba9a991fc2a06 100644
--- a/scripts/metricsdocgen/metrics
+++ b/scripts/metricsdocgen/metrics
@@ -707,6 +707,22 @@ coderd_provisionerd_job_timings_seconds_count{provisioner="terraform",status="su
 # HELP coderd_provisionerd_jobs_current The number of currently running provisioner jobs.
 # TYPE coderd_provisionerd_jobs_current gauge
 coderd_provisionerd_jobs_current{provisioner="terraform"} 0
+# HELP coderd_provisionerd_num_daemons The number of provisioner daemons.
+# TYPE coderd_provisionerd_num_daemons gauge
+coderd_provisionerd_num_daemons 3
+# HELP coderd_provisionerd_workspace_build_timings_seconds The time taken for a workspace to build.
+# TYPE coderd_provisionerd_workspace_build_timings_seconds histogram
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="1"} 0
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="10"} 0
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="30"} 0
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="60"} 1
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="300"} 1
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="600"} 1
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="1800"} 1
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="3600"} 1
+coderd_provisionerd_workspace_build_timings_seconds_bucket{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START",le="+Inf"} 1
+coderd_provisionerd_workspace_build_timings_seconds_sum{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START"} 31.042659852
+coderd_provisionerd_workspace_build_timings_seconds_count{status="success",template_name="docker",template_version="gallant_wright0",workspace_transition="START"} 1
 # HELP coderd_workspace_latest_build_status The current workspace statuses by template, transition, and owner.
 # TYPE coderd_workspace_latest_build_status gauge
 coderd_workspace_latest_build_status{status="failed",template_name="docker",template_version="sweet_gould9",workspace_owner="admin",workspace_transition="stop"} 1
@@ -729,8 +745,8 @@ coderd_workspace_creation_duration_seconds_bucket{organization_name="{organizati
 coderd_workspace_creation_duration_seconds_bucket{organization_name="{organization}",preset_name="Falkenstein",template_name="docker",type="prebuild",le="1800"} 1
 coderd_workspace_creation_duration_seconds_bucket{organization_name="{organization}",preset_name="Falkenstein",template_name="docker",type="prebuild",le="3600"} 1
 coderd_workspace_creation_duration_seconds_bucket{organization_name="{organization}",preset_name="Falkenstein",template_name="docker",type="prebuild",le="+Inf"} 1
-coderd_workspace_creation_duration_seconds_sum{organization_name="{organization}",preset_name="Falkenstein",template_name="template-example",type="prebuild"} 4.406214
-coderd_workspace_creation_duration_seconds_count{organization_name="{organization}",preset_name="Falkenstein",template_name="template-example",type="prebuild"} 1
+coderd_workspace_creation_duration_seconds_sum{organization_name="{organization}",preset_name="Falkenstein",template_name="docker",type="prebuild"} 4.406214
+coderd_workspace_creation_duration_seconds_count{organization_name="{organization}",preset_name="Falkenstein",template_name="docker",type="prebuild"} 1
 # HELP coderd_prebuilt_workspace_claim_duration_seconds Time to claim a prebuilt workspace by organization, template, and preset.
 # TYPE coderd_prebuilt_workspace_claim_duration_seconds histogram
 coderd_prebuilt_workspace_claim_duration_seconds_bucket{organization_name="{organization}",preset_name="Falkenstein",template_name="docker",le="1"} 0

From 712d0361929cfaef8e50905f83a465437c8361a7 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 11:41:54 +0000
Subject: [PATCH 177/298] chore(examples/templates/tasks-docker): bump
 claude-code (#20378)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/claude-code/coder&package-manager=terraform&previous-version=3.0.0&new-version=3.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/templates/tasks-docker/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/templates/tasks-docker/main.tf b/examples/templates/tasks-docker/main.tf
index 3096e872681ab..7caac0cce5dce 100644
--- a/examples/templates/tasks-docker/main.tf
+++ b/examples/templates/tasks-docker/main.tf
@@ -22,7 +22,7 @@ provider "docker" {}
 module "claude-code" {
   count               = data.coder_workspace.me.start_count
   source              = "registry.coder.com/coder/claude-code/coder"
-  version             = "3.0.0"
+  version             = "3.1.1"
   agent_id            = coder_agent.main.id
   workdir             = "/home/coder/projects"
   order               = 999

From 0c2288d8020cc8e96cb0b4fb3a1e7a29d80671c9 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 11:43:10 +0000
Subject: [PATCH 178/298] chore(examples/templates/tasks-docker): bump windsurf
 module (#20376)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/windsurf/coder&package-manager=terraform&previous-version=1.1.0&new-version=1.2.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/templates/tasks-docker/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/templates/tasks-docker/main.tf b/examples/templates/tasks-docker/main.tf
index 7caac0cce5dce..186c5f2a86746 100644
--- a/examples/templates/tasks-docker/main.tf
+++ b/examples/templates/tasks-docker/main.tf
@@ -271,7 +271,7 @@ module "code-server" {
 module "windsurf" {
   count    = data.coder_workspace.me.start_count
   source   = "registry.coder.com/coder/windsurf/coder"
-  version  = "1.1.0"
+  version  = "1.2.0"
   agent_id = coder_agent.main.id
 }
 

From 2e45236d316286e8fc11b4071d5d93ba27d5a9b2 Mon Sep 17 00:00:00 2001
From: david-fraley <67079030+david-fraley@users.noreply.github.com>
Date: Mon, 20 Oct 2025 06:49:06 -0500
Subject: [PATCH 179/298] docs: add warning around macOS install (#20253)

---
 docs/install/index.md | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/docs/install/index.md b/docs/install/index.md
index 2fc04c186a128..b7ba22da090ff 100644
--- a/docs/install/index.md
+++ b/docs/install/index.md
@@ -27,6 +27,23 @@ curl -L https://coder.com/install.sh | sh
 Refer to [GitHub releases](https://github.com/coder/coder/releases) for
 alternate installation methods (e.g. standalone binaries, system packages).
 
+> [!Warning]
+> If you're using an Apple Silicon Mac with ARM64 architecture, so M1/M2/M3/M4, you'll need to use an external PostgreSQL Database using the following commands:
+
+``` bash
+# Install PostgreSQL
+brew install postgresql@16
+
+# Start PostgreSQL
+brew services start postgresql@16
+
+# Create database
+createdb coder
+
+# Run Coder with external database
+coder server --postgres-url="postgres://$(whoami)@localhost/coder?sslmode=disable"
+```
+
 ## Windows
 
 If you plan to use the built-in PostgreSQL database, ensure that the

From 66f1603f6a1d6a934129305f6655768359449eda Mon Sep 17 00:00:00 2001
From: Michael Suchacz <203725896+ibetitsmike@users.noreply.github.com>
Date: Mon, 20 Oct 2025 23:53:23 +0200
Subject: [PATCH 180/298] fix: replace ci-flake-bot app-id with slack's user id
 (#20379)

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
---
 .github/workflows/ci.yaml               | 2 +-
 .github/workflows/nightly-gauntlet.yaml | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index e9f7045cf220e..4199b64f6b683 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -1537,7 +1537,7 @@ jobs:
     steps:
       - name: Send Slack notification
         run: |
-          ESCAPED_PROMPT=$(printf "%s" "<@A09M3J8FK1U> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
+          ESCAPED_PROMPT=$(printf "%s" "<@U09LQ75AHKR> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
           curl -X POST -H 'Content-type: application/json' \
           --data '{
             "blocks": [
diff --git a/.github/workflows/nightly-gauntlet.yaml b/.github/workflows/nightly-gauntlet.yaml
index a79ed6dcd28b9..f27e703800086 100644
--- a/.github/workflows/nightly-gauntlet.yaml
+++ b/.github/workflows/nightly-gauntlet.yaml
@@ -170,7 +170,7 @@ jobs:
     steps:
       - name: Send Slack notification
         run: |
-          ESCAPED_PROMPT=$(printf "%s" "<@A09M3J8FK1U> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
+          ESCAPED_PROMPT=$(printf "%s" "<@U09LQ75AHKR> $BLINK_CI_FAILURE_PROMPT" | jq -Rsa .)
           curl -X POST -H 'Content-type: application/json' \
           --data '{
             "blocks": [

From b022ccefa7b59a4aff4f291aa436175696b155f0 Mon Sep 17 00:00:00 2001
From: Brett Kolodny <brettkolodny@gmail.com>
Date: Mon, 20 Oct 2025 18:28:10 -0400
Subject: [PATCH 181/298] feat: add new `workspace:share` action type (#20198)

Closes
[coder/internal#1012](https://github.com/coder/internal/issues/1012)
---
 coderd/apidoc/docs.go                         |  6 ++++
 coderd/apidoc/swagger.json                    |  6 ++++
 coderd/database/dbauthz/dbauthz.go            |  6 ++--
 coderd/database/dbauthz/dbauthz_test.go       |  6 ++--
 coderd/database/dump.sql                      |  4 ++-
 .../000384_add_workspace_share_scope.down.sql |  3 ++
 .../000384_add_workspace_share_scope.up.sql   |  2 ++
 coderd/database/models.go                     |  8 ++++-
 coderd/rbac/object_gen.go                     |  3 ++
 coderd/rbac/policy/policy.go                  |  5 +++
 coderd/rbac/roles_test.go                     | 33 +++++++++++++++++++
 coderd/rbac/scopes_constants_gen.go           |  6 ++++
 codersdk/apikey_scopes_gen.go                 |  2 ++
 codersdk/rbacresources_gen.go                 |  5 +--
 docs/reference/api/members.md                 |  5 +++
 docs/reference/api/schemas.md                 |  3 ++
 site/src/api/rbacresourcesGenerated.ts        |  2 ++
 site/src/api/typesGenerated.ts                |  6 ++++
 18 files changed, 101 insertions(+), 10 deletions(-)
 create mode 100644 coderd/database/migrations/000384_add_workspace_share_scope.down.sql
 create mode 100644 coderd/database/migrations/000384_add_workspace_share_scope.up.sql

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index b3bad21329fda..f6a15f4c44d51 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11971,6 +11971,7 @@ const docTemplate = `{
                 "workspace:delete",
                 "workspace:delete_agent",
                 "workspace:read",
+                "workspace:share",
                 "workspace:ssh",
                 "workspace:start",
                 "workspace:stop",
@@ -11988,6 +11989,7 @@ const docTemplate = `{
                 "workspace_dormant:delete",
                 "workspace_dormant:delete_agent",
                 "workspace_dormant:read",
+                "workspace_dormant:share",
                 "workspace_dormant:ssh",
                 "workspace_dormant:start",
                 "workspace_dormant:stop",
@@ -12167,6 +12169,7 @@ const docTemplate = `{
                 "APIKeyScopeWorkspaceDelete",
                 "APIKeyScopeWorkspaceDeleteAgent",
                 "APIKeyScopeWorkspaceRead",
+                "APIKeyScopeWorkspaceShare",
                 "APIKeyScopeWorkspaceSsh",
                 "APIKeyScopeWorkspaceStart",
                 "APIKeyScopeWorkspaceStop",
@@ -12184,6 +12187,7 @@ const docTemplate = `{
                 "APIKeyScopeWorkspaceDormantDelete",
                 "APIKeyScopeWorkspaceDormantDeleteAgent",
                 "APIKeyScopeWorkspaceDormantRead",
+                "APIKeyScopeWorkspaceDormantShare",
                 "APIKeyScopeWorkspaceDormantSsh",
                 "APIKeyScopeWorkspaceDormantStart",
                 "APIKeyScopeWorkspaceDormantStop",
@@ -16926,6 +16930,7 @@ const docTemplate = `{
                 "read",
                 "read_personal",
                 "ssh",
+                "share",
                 "unassign",
                 "update",
                 "update_personal",
@@ -16944,6 +16949,7 @@ const docTemplate = `{
                 "ActionRead",
                 "ActionReadPersonal",
                 "ActionSSH",
+                "ActionShare",
                 "ActionUnassign",
                 "ActionUpdate",
                 "ActionUpdatePersonal",
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index a3319a947156d..780f89d876f28 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10675,6 +10675,7 @@
 				"workspace:delete",
 				"workspace:delete_agent",
 				"workspace:read",
+				"workspace:share",
 				"workspace:ssh",
 				"workspace:start",
 				"workspace:stop",
@@ -10692,6 +10693,7 @@
 				"workspace_dormant:delete",
 				"workspace_dormant:delete_agent",
 				"workspace_dormant:read",
+				"workspace_dormant:share",
 				"workspace_dormant:ssh",
 				"workspace_dormant:start",
 				"workspace_dormant:stop",
@@ -10871,6 +10873,7 @@
 				"APIKeyScopeWorkspaceDelete",
 				"APIKeyScopeWorkspaceDeleteAgent",
 				"APIKeyScopeWorkspaceRead",
+				"APIKeyScopeWorkspaceShare",
 				"APIKeyScopeWorkspaceSsh",
 				"APIKeyScopeWorkspaceStart",
 				"APIKeyScopeWorkspaceStop",
@@ -10888,6 +10891,7 @@
 				"APIKeyScopeWorkspaceDormantDelete",
 				"APIKeyScopeWorkspaceDormantDeleteAgent",
 				"APIKeyScopeWorkspaceDormantRead",
+				"APIKeyScopeWorkspaceDormantShare",
 				"APIKeyScopeWorkspaceDormantSsh",
 				"APIKeyScopeWorkspaceDormantStart",
 				"APIKeyScopeWorkspaceDormantStop",
@@ -15448,6 +15452,7 @@
 				"read",
 				"read_personal",
 				"ssh",
+				"share",
 				"unassign",
 				"update",
 				"update_personal",
@@ -15466,6 +15471,7 @@
 				"ActionRead",
 				"ActionReadPersonal",
 				"ActionSSH",
+				"ActionShare",
 				"ActionUnassign",
 				"ActionUpdate",
 				"ActionUpdatePersonal",
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 519684eb7cf9c..e7899eee30a7c 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -1792,7 +1792,7 @@ func (q *querier) DeleteWorkspaceACLByID(ctx context.Context, id uuid.UUID) erro
 		return w.WorkspaceTable(), nil
 	}
 
-	return fetchAndExec(q.log, q.auth, policy.ActionUpdate, fetch, q.db.DeleteWorkspaceACLByID)(ctx, id)
+	return fetchAndExec(q.log, q.auth, policy.ActionShare, fetch, q.db.DeleteWorkspaceACLByID)(ctx, id)
 }
 
 func (q *querier) DeleteWorkspaceAgentPortShare(ctx context.Context, arg database.DeleteWorkspaceAgentPortShareParams) error {
@@ -3388,7 +3388,7 @@ func (q *querier) GetWorkspaceACLByID(ctx context.Context, id uuid.UUID) (databa
 	if err != nil {
 		return database.GetWorkspaceACLByIDRow{}, err
 	}
-	if err := q.authorizeContext(ctx, policy.ActionCreate, workspace); err != nil {
+	if err := q.authorizeContext(ctx, policy.ActionShare, workspace); err != nil {
 		return database.GetWorkspaceACLByIDRow{}, err
 	}
 	return q.db.GetWorkspaceACLByID(ctx, id)
@@ -5312,7 +5312,7 @@ func (q *querier) UpdateWorkspaceACLByID(ctx context.Context, arg database.Updat
 		return w.WorkspaceTable(), nil
 	}
 
-	return fetchAndExec(q.log, q.auth, policy.ActionCreate, fetch, q.db.UpdateWorkspaceACLByID)(ctx, arg)
+	return fetchAndExec(q.log, q.auth, policy.ActionShare, fetch, q.db.UpdateWorkspaceACLByID)(ctx, arg)
 }
 
 func (q *querier) UpdateWorkspaceAgentConnectionByID(ctx context.Context, arg database.UpdateWorkspaceAgentConnectionByIDParams) error {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 989f9c866b6e9..01e19237295ee 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -1732,20 +1732,20 @@ func (s *MethodTestSuite) TestWorkspace() {
 		ws := testutil.Fake(s.T(), faker, database.Workspace{})
 		dbM.EXPECT().GetWorkspaceByID(gomock.Any(), ws.ID).Return(ws, nil).AnyTimes()
 		dbM.EXPECT().GetWorkspaceACLByID(gomock.Any(), ws.ID).Return(database.GetWorkspaceACLByIDRow{}, nil).AnyTimes()
-		check.Args(ws.ID).Asserts(ws, policy.ActionCreate)
+		check.Args(ws.ID).Asserts(ws, policy.ActionShare)
 	}))
 	s.Run("UpdateWorkspaceACLByID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		w := testutil.Fake(s.T(), faker, database.Workspace{})
 		arg := database.UpdateWorkspaceACLByIDParams{ID: w.ID}
 		dbm.EXPECT().GetWorkspaceByID(gomock.Any(), w.ID).Return(w, nil).AnyTimes()
 		dbm.EXPECT().UpdateWorkspaceACLByID(gomock.Any(), arg).Return(nil).AnyTimes()
-		check.Args(arg).Asserts(w, policy.ActionCreate)
+		check.Args(arg).Asserts(w, policy.ActionShare)
 	}))
 	s.Run("DeleteWorkspaceACLByID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		w := testutil.Fake(s.T(), faker, database.Workspace{})
 		dbm.EXPECT().GetWorkspaceByID(gomock.Any(), w.ID).Return(w, nil).AnyTimes()
 		dbm.EXPECT().DeleteWorkspaceACLByID(gomock.Any(), w.ID).Return(nil).AnyTimes()
-		check.Args(w.ID).Asserts(w, policy.ActionUpdate)
+		check.Args(w.ID).Asserts(w, policy.ActionShare)
 	}))
 	s.Run("GetLatestWorkspaceBuildByWorkspaceID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		w := testutil.Fake(s.T(), faker, database.Workspace{})
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 8b5700e58d1f3..323b595c10713 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -202,7 +202,9 @@ CREATE TYPE api_key_scope AS ENUM (
     'task:read',
     'task:update',
     'task:delete',
-    'task:*'
+    'task:*',
+    'workspace:share',
+    'workspace_dormant:share'
 );
 
 CREATE TYPE app_sharing_level AS ENUM (
diff --git a/coderd/database/migrations/000384_add_workspace_share_scope.down.sql b/coderd/database/migrations/000384_add_workspace_share_scope.down.sql
new file mode 100644
index 0000000000000..46aa4042e02cf
--- /dev/null
+++ b/coderd/database/migrations/000384_add_workspace_share_scope.down.sql
@@ -0,0 +1,3 @@
+-- No-op: keep enum values to avoid dependency churn.
+-- If strict removal is required, create a new enum type without these values,
+-- cast columns, drop the old type, and rename.
diff --git a/coderd/database/migrations/000384_add_workspace_share_scope.up.sql b/coderd/database/migrations/000384_add_workspace_share_scope.up.sql
new file mode 100644
index 0000000000000..e27f2e9ab18fa
--- /dev/null
+++ b/coderd/database/migrations/000384_add_workspace_share_scope.up.sql
@@ -0,0 +1,2 @@
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace:share';
+ALTER TYPE api_key_scope ADD VALUE IF NOT EXISTS 'workspace_dormant:share';
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 8b0b6a97aa066..2d02d2c14d051 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -211,6 +211,8 @@ const (
 	ApiKeyScopeTaskUpdate                          APIKeyScope = "task:update"
 	ApiKeyScopeTaskDelete                          APIKeyScope = "task:delete"
 	ApiKeyScopeTask                                APIKeyScope = "task:*"
+	ApiKeyScopeWorkspaceShare                      APIKeyScope = "workspace:share"
+	ApiKeyScopeWorkspaceDormantShare               APIKeyScope = "workspace_dormant:share"
 )
 
 func (e *APIKeyScope) Scan(src interface{}) error {
@@ -441,7 +443,9 @@ func (e APIKeyScope) Valid() bool {
 		ApiKeyScopeTaskRead,
 		ApiKeyScopeTaskUpdate,
 		ApiKeyScopeTaskDelete,
-		ApiKeyScopeTask:
+		ApiKeyScopeTask,
+		ApiKeyScopeWorkspaceShare,
+		ApiKeyScopeWorkspaceDormantShare:
 		return true
 	}
 	return false
@@ -641,6 +645,8 @@ func AllAPIKeyScopeValues() []APIKeyScope {
 		ApiKeyScopeTaskUpdate,
 		ApiKeyScopeTaskDelete,
 		ApiKeyScopeTask,
+		ApiKeyScopeWorkspaceShare,
+		ApiKeyScopeWorkspaceDormantShare,
 	}
 }
 
diff --git a/coderd/rbac/object_gen.go b/coderd/rbac/object_gen.go
index 9efaa0bfe1e14..c71b74d496330 100644
--- a/coderd/rbac/object_gen.go
+++ b/coderd/rbac/object_gen.go
@@ -356,6 +356,7 @@ var (
 	//  - "ActionDelete" :: delete workspace
 	//  - "ActionDeleteAgent" :: delete an existing workspace agent
 	//  - "ActionRead" :: read workspace data to view on the UI
+	//  - "ActionShare" :: share a workspace with other users or groups
 	//  - "ActionSSH" :: ssh into a given workspace
 	//  - "ActionWorkspaceStart" :: allows starting a workspace
 	//  - "ActionWorkspaceStop" :: allows stopping a workspace
@@ -388,6 +389,7 @@ var (
 	//  - "ActionDelete" :: delete workspace
 	//  - "ActionDeleteAgent" :: delete an existing workspace agent
 	//  - "ActionRead" :: read workspace data to view on the UI
+	//  - "ActionShare" :: share a workspace with other users or groups
 	//  - "ActionSSH" :: ssh into a given workspace
 	//  - "ActionWorkspaceStart" :: allows starting a workspace
 	//  - "ActionWorkspaceStop" :: allows stopping a workspace
@@ -465,6 +467,7 @@ func AllActions() []policy.Action {
 		policy.ActionRead,
 		policy.ActionReadPersonal,
 		policy.ActionSSH,
+		policy.ActionShare,
 		policy.ActionUnassign,
 		policy.ActionUpdate,
 		policy.ActionUpdatePersonal,
diff --git a/coderd/rbac/policy/policy.go b/coderd/rbac/policy/policy.go
index cdc91a134a086..8c4e2abaaad2d 100644
--- a/coderd/rbac/policy/policy.go
+++ b/coderd/rbac/policy/policy.go
@@ -27,6 +27,8 @@ const (
 
 	ActionCreateAgent Action = "create_agent"
 	ActionDeleteAgent Action = "delete_agent"
+
+	ActionShare Action = "share"
 )
 
 type PermissionDefinition struct {
@@ -61,6 +63,9 @@ var workspaceActions = map[Action]ActionDefinition{
 
 	ActionCreateAgent: "create a new workspace agent",
 	ActionDeleteAgent: "delete an existing workspace agent",
+
+	// Sharing a workspace
+	ActionShare: "share a workspace with other users or groups",
 }
 
 var taskActions = map[Action]ActionDefinition{
diff --git a/coderd/rbac/roles_test.go b/coderd/rbac/roles_test.go
index d5bf2e2af81ef..8ea0a9642f035 100644
--- a/coderd/rbac/roles_test.go
+++ b/coderd/rbac/roles_test.go
@@ -235,6 +235,39 @@ func TestRolePermissions(t *testing.T) {
 				false: {setOtherOrg, memberMe, userAdmin, templateAdmin, orgTemplateAdmin, orgUserAdmin, orgAuditor, orgMemberMeBanWorkspace},
 			},
 		},
+		{
+			Name:    "ShareMyWorkspace",
+			Actions: []policy.Action{policy.ActionShare},
+			Resource: rbac.ResourceWorkspace.
+				WithID(workspaceID).
+				InOrg(orgID).
+				WithOwner(currentUser.String()),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {owner, orgMemberMe, orgAdmin, orgMemberMeBanWorkspace},
+				false: {
+					memberMe, setOtherOrg,
+					templateAdmin, userAdmin,
+					orgTemplateAdmin, orgUserAdmin, orgAuditor,
+				},
+			},
+		},
+		{
+			Name:    "ShareWorkspaceDormant",
+			Actions: []policy.Action{policy.ActionShare},
+			Resource: rbac.ResourceWorkspaceDormant.
+				WithID(uuid.New()).
+				InOrg(orgID).
+				WithOwner(memberMe.Actor.ID),
+			AuthorizeMap: map[bool][]hasAuthSubjects{
+				true: {},
+				false: {
+					orgMemberMe, orgAdmin, owner, setOtherOrg,
+					userAdmin, memberMe,
+					templateAdmin, orgTemplateAdmin, orgUserAdmin, orgAuditor,
+					orgMemberMeBanWorkspace,
+				},
+			},
+		},
 		{
 			Name:     "Templates",
 			Actions:  []policy.Action{policy.ActionCreate, policy.ActionUpdate, policy.ActionDelete},
diff --git a/coderd/rbac/scopes_constants_gen.go b/coderd/rbac/scopes_constants_gen.go
index a81ccf7be49f8..2bd058b5b1007 100644
--- a/coderd/rbac/scopes_constants_gen.go
+++ b/coderd/rbac/scopes_constants_gen.go
@@ -127,6 +127,7 @@ const (
 	ScopeWorkspaceDelete                     ScopeName = "workspace:delete"
 	ScopeWorkspaceDeleteAgent                ScopeName = "workspace:delete_agent"
 	ScopeWorkspaceRead                       ScopeName = "workspace:read"
+	ScopeWorkspaceShare                      ScopeName = "workspace:share"
 	ScopeWorkspaceSsh                        ScopeName = "workspace:ssh"
 	ScopeWorkspaceStart                      ScopeName = "workspace:start"
 	ScopeWorkspaceStop                       ScopeName = "workspace:stop"
@@ -141,6 +142,7 @@ const (
 	ScopeWorkspaceDormantDelete              ScopeName = "workspace_dormant:delete"
 	ScopeWorkspaceDormantDeleteAgent         ScopeName = "workspace_dormant:delete_agent"
 	ScopeWorkspaceDormantRead                ScopeName = "workspace_dormant:read"
+	ScopeWorkspaceDormantShare               ScopeName = "workspace_dormant:share"
 	ScopeWorkspaceDormantSsh                 ScopeName = "workspace_dormant:ssh"
 	ScopeWorkspaceDormantStart               ScopeName = "workspace_dormant:start"
 	ScopeWorkspaceDormantStop                ScopeName = "workspace_dormant:stop"
@@ -280,6 +282,7 @@ func (e ScopeName) Valid() bool {
 		ScopeWorkspaceDelete,
 		ScopeWorkspaceDeleteAgent,
 		ScopeWorkspaceRead,
+		ScopeWorkspaceShare,
 		ScopeWorkspaceSsh,
 		ScopeWorkspaceStart,
 		ScopeWorkspaceStop,
@@ -294,6 +297,7 @@ func (e ScopeName) Valid() bool {
 		ScopeWorkspaceDormantDelete,
 		ScopeWorkspaceDormantDeleteAgent,
 		ScopeWorkspaceDormantRead,
+		ScopeWorkspaceDormantShare,
 		ScopeWorkspaceDormantSsh,
 		ScopeWorkspaceDormantStart,
 		ScopeWorkspaceDormantStop,
@@ -434,6 +438,7 @@ func AllScopeNameValues() []ScopeName {
 		ScopeWorkspaceDelete,
 		ScopeWorkspaceDeleteAgent,
 		ScopeWorkspaceRead,
+		ScopeWorkspaceShare,
 		ScopeWorkspaceSsh,
 		ScopeWorkspaceStart,
 		ScopeWorkspaceStop,
@@ -448,6 +453,7 @@ func AllScopeNameValues() []ScopeName {
 		ScopeWorkspaceDormantDelete,
 		ScopeWorkspaceDormantDeleteAgent,
 		ScopeWorkspaceDormantRead,
+		ScopeWorkspaceDormantShare,
 		ScopeWorkspaceDormantSsh,
 		ScopeWorkspaceDormantStart,
 		ScopeWorkspaceDormantStop,
diff --git a/codersdk/apikey_scopes_gen.go b/codersdk/apikey_scopes_gen.go
index d0e88bb2d6894..df7fe96c4585e 100644
--- a/codersdk/apikey_scopes_gen.go
+++ b/codersdk/apikey_scopes_gen.go
@@ -172,6 +172,7 @@ const (
 	APIKeyScopeWorkspaceDelete                     APIKeyScope = "workspace:delete"
 	APIKeyScopeWorkspaceDeleteAgent                APIKeyScope = "workspace:delete_agent"
 	APIKeyScopeWorkspaceRead                       APIKeyScope = "workspace:read"
+	APIKeyScopeWorkspaceShare                      APIKeyScope = "workspace:share"
 	APIKeyScopeWorkspaceSsh                        APIKeyScope = "workspace:ssh"
 	APIKeyScopeWorkspaceStart                      APIKeyScope = "workspace:start"
 	APIKeyScopeWorkspaceStop                       APIKeyScope = "workspace:stop"
@@ -189,6 +190,7 @@ const (
 	APIKeyScopeWorkspaceDormantDelete              APIKeyScope = "workspace_dormant:delete"
 	APIKeyScopeWorkspaceDormantDeleteAgent         APIKeyScope = "workspace_dormant:delete_agent"
 	APIKeyScopeWorkspaceDormantRead                APIKeyScope = "workspace_dormant:read"
+	APIKeyScopeWorkspaceDormantShare               APIKeyScope = "workspace_dormant:share"
 	APIKeyScopeWorkspaceDormantSsh                 APIKeyScope = "workspace_dormant:ssh"
 	APIKeyScopeWorkspaceDormantStart               APIKeyScope = "workspace_dormant:start"
 	APIKeyScopeWorkspaceDormantStop                APIKeyScope = "workspace_dormant:stop"
diff --git a/codersdk/rbacresources_gen.go b/codersdk/rbacresources_gen.go
index a48b688a7aff2..b6f8e778ee760 100644
--- a/codersdk/rbacresources_gen.go
+++ b/codersdk/rbacresources_gen.go
@@ -60,6 +60,7 @@ const (
 	ActionRead               RBACAction = "read"
 	ActionReadPersonal       RBACAction = "read_personal"
 	ActionSSH                RBACAction = "ssh"
+	ActionShare              RBACAction = "share"
 	ActionUnassign           RBACAction = "unassign"
 	ActionUpdate             RBACAction = "update"
 	ActionUpdatePersonal     RBACAction = "update_personal"
@@ -109,9 +110,9 @@ var RBACResourceActions = map[RBACResource][]RBACAction{
 	ResourceUser:                          {ActionCreate, ActionDelete, ActionRead, ActionReadPersonal, ActionUpdate, ActionUpdatePersonal},
 	ResourceUserSecret:                    {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
 	ResourceWebpushSubscription:           {ActionCreate, ActionDelete, ActionRead},
-	ResourceWorkspace:                     {ActionApplicationConnect, ActionCreate, ActionCreateAgent, ActionDelete, ActionDeleteAgent, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
+	ResourceWorkspace:                     {ActionApplicationConnect, ActionCreate, ActionCreateAgent, ActionDelete, ActionDeleteAgent, ActionRead, ActionShare, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
 	ResourceWorkspaceAgentDevcontainers:   {ActionCreate},
 	ResourceWorkspaceAgentResourceMonitor: {ActionCreate, ActionRead, ActionUpdate},
-	ResourceWorkspaceDormant:              {ActionApplicationConnect, ActionCreate, ActionCreateAgent, ActionDelete, ActionDeleteAgent, ActionRead, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
+	ResourceWorkspaceDormant:              {ActionApplicationConnect, ActionCreate, ActionCreateAgent, ActionDelete, ActionDeleteAgent, ActionRead, ActionShare, ActionSSH, ActionWorkspaceStart, ActionWorkspaceStop, ActionUpdate},
 	ResourceWorkspaceProxy:                {ActionCreate, ActionDelete, ActionRead, ActionUpdate},
 }
diff --git a/docs/reference/api/members.md b/docs/reference/api/members.md
index 8fac25e9770ff..532b15ec793d7 100644
--- a/docs/reference/api/members.md
+++ b/docs/reference/api/members.md
@@ -175,6 +175,7 @@ Status Code **200**
 | `action`        | `read`                             |
 | `action`        | `read_personal`                    |
 | `action`        | `ssh`                              |
+| `action`        | `share`                            |
 | `action`        | `unassign`                         |
 | `action`        | `update`                           |
 | `action`        | `update_personal`                  |
@@ -349,6 +350,7 @@ Status Code **200**
 | `action`        | `read`                             |
 | `action`        | `read_personal`                    |
 | `action`        | `ssh`                              |
+| `action`        | `share`                            |
 | `action`        | `unassign`                         |
 | `action`        | `update`                           |
 | `action`        | `update_personal`                  |
@@ -523,6 +525,7 @@ Status Code **200**
 | `action`        | `read`                             |
 | `action`        | `read_personal`                    |
 | `action`        | `ssh`                              |
+| `action`        | `share`                            |
 | `action`        | `unassign`                         |
 | `action`        | `update`                           |
 | `action`        | `update_personal`                  |
@@ -666,6 +669,7 @@ Status Code **200**
 | `action`        | `read`                             |
 | `action`        | `read_personal`                    |
 | `action`        | `ssh`                              |
+| `action`        | `share`                            |
 | `action`        | `unassign`                         |
 | `action`        | `update`                           |
 | `action`        | `update_personal`                  |
@@ -1031,6 +1035,7 @@ Status Code **200**
 | `action`        | `read`                             |
 | `action`        | `read_personal`                    |
 | `action`        | `ssh`                              |
+| `action`        | `share`                            |
 | `action`        | `unassign`                         |
 | `action`        | `update`                           |
 | `action`        | `update_personal`                  |
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 8d16d63a5ea51..440f2dca0a59a 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -953,6 +953,7 @@
 | `workspace:delete`                        |
 | `workspace:delete_agent`                  |
 | `workspace:read`                          |
+| `workspace:share`                         |
 | `workspace:ssh`                           |
 | `workspace:start`                         |
 | `workspace:stop`                          |
@@ -970,6 +971,7 @@
 | `workspace_dormant:delete`                |
 | `workspace_dormant:delete_agent`          |
 | `workspace_dormant:read`                  |
+| `workspace_dormant:share`                 |
 | `workspace_dormant:ssh`                   |
 | `workspace_dormant:start`                 |
 | `workspace_dormant:stop`                  |
@@ -7069,6 +7071,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `read`                |
 | `read_personal`       |
 | `ssh`                 |
+| `share`               |
 | `unassign`            |
 | `update`              |
 | `update_personal`     |
diff --git a/site/src/api/rbacresourcesGenerated.ts b/site/src/api/rbacresourcesGenerated.ts
index 0f62160563dd2..ff7501665bb14 100644
--- a/site/src/api/rbacresourcesGenerated.ts
+++ b/site/src/api/rbacresourcesGenerated.ts
@@ -201,6 +201,7 @@ export const RBACResourceActions: Partial<
 		delete: "delete workspace",
 		delete_agent: "delete an existing workspace agent",
 		read: "read workspace data to view on the UI",
+		share: "share a workspace with other users or groups",
 		ssh: "ssh into a given workspace",
 		start: "allows starting a workspace",
 		stop: "allows stopping a workspace",
@@ -221,6 +222,7 @@ export const RBACResourceActions: Partial<
 		delete: "delete workspace",
 		delete_agent: "delete an existing workspace agent",
 		read: "read workspace data to view on the UI",
+		share: "share a workspace with other users or groups",
 		ssh: "ssh into a given workspace",
 		start: "allows starting a workspace",
 		stop: "allows stopping a workspace",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index dee5eac22b436..e15ccd917d548 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -324,6 +324,7 @@ export type APIKeyScope =
 	| "workspace_dormant:delete"
 	| "workspace_dormant:delete_agent"
 	| "workspace_dormant:read"
+	| "workspace_dormant:share"
 	| "workspace_dormant:ssh"
 	| "workspace_dormant:start"
 	| "workspace_dormant:stop"
@@ -334,6 +335,7 @@ export type APIKeyScope =
 	| "workspace_proxy:read"
 	| "workspace_proxy:update"
 	| "workspace:read"
+	| "workspace:share"
 	| "workspace:ssh"
 	| "workspace:start"
 	| "workspace:stop"
@@ -520,6 +522,7 @@ export const APIKeyScopes: APIKeyScope[] = [
 	"workspace_dormant:delete",
 	"workspace_dormant:delete_agent",
 	"workspace_dormant:read",
+	"workspace_dormant:share",
 	"workspace_dormant:ssh",
 	"workspace_dormant:start",
 	"workspace_dormant:stop",
@@ -530,6 +533,7 @@ export const APIKeyScopes: APIKeyScope[] = [
 	"workspace_proxy:read",
 	"workspace_proxy:update",
 	"workspace:read",
+	"workspace:share",
 	"workspace:ssh",
 	"workspace:start",
 	"workspace:stop",
@@ -3812,6 +3816,7 @@ export type RBACAction =
 	| "read"
 	| "read_personal"
 	| "ssh"
+	| "share"
 	| "unassign"
 	| "update"
 	| "update_personal"
@@ -3830,6 +3835,7 @@ export const RBACActions: RBACAction[] = [
 	"read",
 	"read_personal",
 	"ssh",
+	"share",
 	"unassign",
 	"update",
 	"update_personal",

From 6a3bf6ff537aa5a64bff0dd14d9aad35172d0b60 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 20 Oct 2025 23:02:40 +0000
Subject: [PATCH 182/298] chore: bump vite from 7.1.7 to 7.1.11 in /site
 (#20392)

Bumps [vite](https://github.com/vitejs/vite/tree/HEAD/packages/vite)
from 7.1.7 to 7.1.11.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/releases">vite's
releases</a>.</em></p>
<blockquote>
<h2>v7.1.11</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.1.11/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v7.1.10</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.1.10/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v7.1.9</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.1.9/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
<h2>v7.1.8</h2>
<p>Please refer to <a
href="https://github.com/vitejs/vite/blob/v7.1.8/packages/vite/CHANGELOG.md">CHANGELOG.md</a>
for details.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/vitejs/vite/blob/main/packages/vite/CHANGELOG.md">vite's
changelog</a>.</em></p>
<blockquote>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.1.10...v7.1.11">7.1.11</a>
(2025-10-20)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>dev:</strong> trim trailing slash before
<code>server.fs.deny</code> check (<a
href="https://redirect.github.com/vitejs/vite/issues/20968">#20968</a>)
(<a
href="https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed">f479cc5</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/20966">#20966</a>)
(<a
href="https://github.com/vitejs/vite/commit/6fb41a260bda443685e719ea4765d3faca3db944">6fb41a2</a>)</li>
</ul>
<h3>Code Refactoring</h3>
<ul>
<li>use subpath imports for types module reference (<a
href="https://redirect.github.com/vitejs/vite/issues/20921">#20921</a>)
(<a
href="https://github.com/vitejs/vite/commit/d0094af639d9ebbb51d4e00910b74f23eb8fe131">d0094af</a>)</li>
</ul>
<h3>Build System</h3>
<ul>
<li>remove cjs reference in files field (<a
href="https://redirect.github.com/vitejs/vite/issues/20945">#20945</a>)
(<a
href="https://github.com/vitejs/vite/commit/ef411cee2696af3ba791879fdae9aad165f178b2">ef411ce</a>)</li>
<li>remove hash from built filenames (<a
href="https://redirect.github.com/vitejs/vite/issues/20946">#20946</a>)
(<a
href="https://github.com/vitejs/vite/commit/a81730754d655d1371ce0f4354af1c84e12f9f2d">a817307</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.1.9...v7.1.10">7.1.10</a>
(2025-10-14)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>css:</strong> avoid duplicate style for server rendered
stylesheet link and client inline style during dev (<a
href="https://redirect.github.com/vitejs/vite/issues/20767">#20767</a>)
(<a
href="https://github.com/vitejs/vite/commit/3a92bc79b306a01b8aaf37f80b2239eaf6e488e7">3a92bc7</a>)</li>
<li><strong>css:</strong> respect emitAssets when cssCodeSplit=false (<a
href="https://redirect.github.com/vitejs/vite/issues/20883">#20883</a>)
(<a
href="https://github.com/vitejs/vite/commit/d3e7eeefa91e1992f47694d16fe4dbe708c4d80e">d3e7eee</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://github.com/vitejs/vite/commit/879de86935a31b4e47ab907ddd859366518ce268">879de86</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/20894">#20894</a>)
(<a
href="https://github.com/vitejs/vite/commit/3213f90ff0d8f274bcec65f40aac6dfcff1ac244">3213f90</a>)</li>
<li><strong>dev:</strong> allow aliases starting with <code>//</code>
(<a
href="https://redirect.github.com/vitejs/vite/issues/20760">#20760</a>)
(<a
href="https://github.com/vitejs/vite/commit/b95fa2aa7564eda4c9f05ee7616a2dbada35e463">b95fa2a</a>)</li>
<li><strong>dev:</strong> remove timestamp query consistently (<a
href="https://redirect.github.com/vitejs/vite/issues/20887">#20887</a>)
(<a
href="https://github.com/vitejs/vite/commit/6537d15591619d7e1cfc1e50599bec16cd88340f">6537d15</a>)</li>
<li><strong>esbuild:</strong> inject esbuild helpers correctly for
esbuild 0.25.9+ (<a
href="https://redirect.github.com/vitejs/vite/issues/20906">#20906</a>)
(<a
href="https://github.com/vitejs/vite/commit/446eb386329ef682d614c77958a542f2dc222880">446eb38</a>)</li>
<li>normalize path before calling <code>fileToBuiltUrl</code> (<a
href="https://redirect.github.com/vitejs/vite/issues/20898">#20898</a>)
(<a
href="https://github.com/vitejs/vite/commit/73b6d243e0398ee5d8d44c7d24162f4a0f4b1cf1">73b6d24</a>)</li>
<li>preserve original sourcemap file field when combining sourcemaps (<a
href="https://redirect.github.com/vitejs/vite/issues/20926">#20926</a>)
(<a
href="https://github.com/vitejs/vite/commit/c714776aa1dcc24299a81c1495cbcbb1b1ef1dd3">c714776</a>)</li>
</ul>
<h3>Documentation</h3>
<ul>
<li>correct <code>WebSocket</code> spelling (<a
href="https://redirect.github.com/vitejs/vite/issues/20890">#20890</a>)
(<a
href="https://github.com/vitejs/vite/commit/29e98dc3efe35efbd978523367c05db7d2e7a278">29e98dc</a>)</li>
</ul>
<h3>Miscellaneous Chores</h3>
<ul>
<li><strong>deps:</strong> update rolldown-related dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/20923">#20923</a>)
(<a
href="https://github.com/vitejs/vite/commit/a5e3b064fa7ca981cb6f15f8e88806b36a99b8bf">a5e3b06</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.1.8...v7.1.9">7.1.9</a>
(2025-10-03)<!-- raw HTML omitted --></h2>
<h3>Reverts</h3>
<ul>
<li><strong>server:</strong> drain stdin when not interactive (<a
href="https://redirect.github.com/vitejs/vite/issues/20885">#20885</a>)
(<a
href="https://github.com/vitejs/vite/commit/12d72b0538ef1540bfb0f1dd8a44b75deaa3464e">12d72b0</a>)</li>
</ul>
<h2><!-- raw HTML omitted --><a
href="https://github.com/vitejs/vite/compare/v7.1.7...v7.1.8">7.1.8</a>
(2025-10-02)<!-- raw HTML omitted --></h2>
<h3>Bug Fixes</h3>
<ul>
<li><strong>css:</strong> improve url escape characters handling (<a
href="https://redirect.github.com/vitejs/vite/issues/20847">#20847</a>)
(<a
href="https://github.com/vitejs/vite/commit/24a61a3f5404279e91f7ceebf7449a5e874f9d56">24a61a3</a>)</li>
<li><strong>deps:</strong> update all non-major dependencies (<a
href="https://redirect.github.com/vitejs/vite/issues/20855">#20855</a>)
(<a
href="https://github.com/vitejs/vite/commit/788a183afce57de13f5656f0cf42cdf6fdc3ebaa">788a183</a>)</li>
<li><strong>deps:</strong> update artichokie to 0.4.2 (<a
href="https://redirect.github.com/vitejs/vite/issues/20864">#20864</a>)
(<a
href="https://github.com/vitejs/vite/commit/e670799e123dca78e1a63aeb06dbadade3d5ab51">e670799</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/vitejs/vite/commit/8b69c9e32c3606ae375a1333cd38e91848d27781"><code>8b69c9e</code></a>
release: v7.1.11</li>
<li><a
href="https://github.com/vitejs/vite/commit/f479cc57c425ed41ceb434fecebd63931b1ed4ed"><code>f479cc5</code></a>
fix(dev): trim trailing slash before <code>server.fs.deny</code> check
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20968">#20968</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/6fb41a260bda443685e719ea4765d3faca3db944"><code>6fb41a2</code></a>
chore(deps): update all non-major dependencies (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20966">#20966</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/a81730754d655d1371ce0f4354af1c84e12f9f2d"><code>a817307</code></a>
build: remove hash from built filenames (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20946">#20946</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/ef411cee2696af3ba791879fdae9aad165f178b2"><code>ef411ce</code></a>
build: remove cjs reference in files field (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20945">#20945</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/d0094af639d9ebbb51d4e00910b74f23eb8fe131"><code>d0094af</code></a>
refactor: use subpath imports for types module reference (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20921">#20921</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/ed4a0dc9132dc8436760dbd04825e29a57946369"><code>ed4a0dc</code></a>
release: v7.1.10</li>
<li><a
href="https://github.com/vitejs/vite/commit/c714776aa1dcc24299a81c1495cbcbb1b1ef1dd3"><code>c714776</code></a>
fix: preserve original sourcemap file field when combining sourcemaps
(<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20926">#20926</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/446eb386329ef682d614c77958a542f2dc222880"><code>446eb38</code></a>
fix(esbuild): inject esbuild helpers correctly for esbuild 0.25.9+ (<a
href="https://github.com/vitejs/vite/tree/HEAD/packages/vite/issues/20906">#20906</a>)</li>
<li><a
href="https://github.com/vitejs/vite/commit/879de86935a31b4e47ab907ddd859366518ce268"><code>879de86</code></a>
fix(deps): update all non-major dependencies</li>
<li>Additional commits viewable in <a
href="https://github.com/vitejs/vite/commits/v7.1.11/packages/vite">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=vite&package-manager=npm_and_yarn&previous-version=7.1.7&new-version=7.1.11)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/coder/coder/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 site/package.json   |   2 +-
 site/pnpm-lock.yaml | 518 ++++++++++++++++++++++----------------------
 2 files changed, 260 insertions(+), 260 deletions(-)

diff --git a/site/package.json b/site/package.json
index bbabb4e1d444a..7b74cfae58254 100644
--- a/site/package.json
+++ b/site/package.json
@@ -179,7 +179,7 @@
 		"tailwindcss": "3.4.18",
 		"ts-proto": "1.181.2",
 		"typescript": "5.6.3",
-		"vite": "7.1.7",
+		"vite": "7.1.11",
 		"vite-plugin-checker": "0.11.0"
 	},
 	"browserslist": [
diff --git a/site/pnpm-lock.yaml b/site/pnpm-lock.yaml
index 96373e373f23b..c70eff146bcee 100644
--- a/site/pnpm-lock.yaml
+++ b/site/pnpm-lock.yaml
@@ -280,7 +280,7 @@ importers:
         version: 2.2.4
       '@chromatic-com/storybook':
         specifier: 4.1.0
-        version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+        version: 4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@octokit/types':
         specifier: 12.3.0
         version: 12.3.0
@@ -289,16 +289,16 @@ importers:
         version: 1.50.1
       '@storybook/addon-docs':
         specifier: 9.1.2
-        version: 9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+        version: 9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/addon-links':
         specifier: 9.1.2
-        version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+        version: 9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/addon-themes':
         specifier: 9.1.2
-        version: 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+        version: 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/react-vite':
         specifier: 9.1.2
-        version: 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+        version: 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.5)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       '@swc/core':
         specifier: 1.3.38
         version: 1.3.38
@@ -376,7 +376,7 @@ importers:
         version: 9.0.2
       '@vitejs/plugin-react':
         specifier: 5.0.4
-        version: 5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+        version: 5.0.4(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       autoprefixer:
         specifier: 10.4.21
         version: 10.4.21(postcss@8.5.6)
@@ -424,7 +424,7 @@ importers:
         version: 7.4.0
       rollup-plugin-visualizer:
         specifier: 5.14.0
-        version: 5.14.0(rollup@4.52.3)
+        version: 5.14.0(rollup@4.52.5)
       rxjs:
         specifier: 7.8.1
         version: 7.8.1
@@ -433,10 +433,10 @@ importers:
         version: 1.17.0
       storybook:
         specifier: 9.1.2
-        version: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+        version: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       storybook-addon-remix-react-router:
         specifier: 5.0.0
-        version: 5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+        version: 5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       tailwindcss:
         specifier: 3.4.18
         version: 3.4.18(yaml@2.7.0)
@@ -447,11 +447,11 @@ importers:
         specifier: 5.6.3
         version: 5.6.3
       vite:
-        specifier: 7.1.7
-        version: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+        specifier: 7.1.11
+        version: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
       vite-plugin-checker:
         specifier: 0.11.0
-        version: 0.11.0(@biomejs/biome@2.2.4)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+        version: 0.11.0(@biomejs/biome@2.2.4)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
 
 packages:
 
@@ -802,8 +802,8 @@ packages:
   '@emotion/weak-memoize@0.4.0':
     resolution: {integrity: sha512-snKqtPW01tN0ui7yu9rGv69aJXr/a/Ywvl11sUjNtEcRc+ng/mQriFL0wLXMef74iHa/EkftbDzU9F8iFbH+zg==, tarball: https://registry.npmjs.org/@emotion/weak-memoize/-/weak-memoize-0.4.0.tgz}
 
-  '@esbuild/aix-ppc64@0.25.10':
-    resolution: {integrity: sha512-0NFWnA+7l41irNuaSVlLfgNT12caWJVLzp5eAVhZ0z1qpxbockccEt3s+149rE64VUI3Ml2zt8Nv5JVc4QXTsw==, tarball: https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.10.tgz}
+  '@esbuild/aix-ppc64@0.25.11':
+    resolution: {integrity: sha512-Xt1dOL13m8u0WE8iplx9Ibbm+hFAO0GsU2P34UNoDGvZYkY8ifSiy6Zuc1lYxfG7svWE2fzqCUmFp5HCn51gJg==, tarball: https://registry.npmjs.org/@esbuild/aix-ppc64/-/aix-ppc64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [aix]
@@ -814,8 +814,8 @@ packages:
     cpu: [ppc64]
     os: [aix]
 
-  '@esbuild/android-arm64@0.25.10':
-    resolution: {integrity: sha512-LSQa7eDahypv/VO6WKohZGPSJDq5OVOo3UoFR1E4t4Gj1W7zEQMUhI+lo81H+DtB+kP+tDgBp+M4oNCwp6kffg==, tarball: https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.10.tgz}
+  '@esbuild/android-arm64@0.25.11':
+    resolution: {integrity: sha512-9slpyFBc4FPPz48+f6jyiXOx/Y4v34TUeDDXJpZqAWQn/08lKGeD8aDp9TMn9jDz2CiEuHwfhRmGBvpnd/PWIQ==, tarball: https://registry.npmjs.org/@esbuild/android-arm64/-/android-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [android]
@@ -826,8 +826,8 @@ packages:
     cpu: [arm64]
     os: [android]
 
-  '@esbuild/android-arm@0.25.10':
-    resolution: {integrity: sha512-dQAxF1dW1C3zpeCDc5KqIYuZ1tgAdRXNoZP7vkBIRtKZPYe2xVr/d3SkirklCHudW1B45tGiUlz2pUWDfbDD4w==, tarball: https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.10.tgz}
+  '@esbuild/android-arm@0.25.11':
+    resolution: {integrity: sha512-uoa7dU+Dt3HYsethkJ1k6Z9YdcHjTrSb5NUy66ZfZaSV8hEYGD5ZHbEMXnqLFlbBflLsl89Zke7CAdDJ4JI+Gg==, tarball: https://registry.npmjs.org/@esbuild/android-arm/-/android-arm-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [android]
@@ -838,8 +838,8 @@ packages:
     cpu: [arm]
     os: [android]
 
-  '@esbuild/android-x64@0.25.10':
-    resolution: {integrity: sha512-MiC9CWdPrfhibcXwr39p9ha1x0lZJ9KaVfvzA0Wxwz9ETX4v5CHfF09bx935nHlhi+MxhA63dKRRQLiVgSUtEg==, tarball: https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.10.tgz}
+  '@esbuild/android-x64@0.25.11':
+    resolution: {integrity: sha512-Sgiab4xBjPU1QoPEIqS3Xx+R2lezu0LKIEcYe6pftr56PqPygbB7+szVnzoShbx64MUupqoE0KyRlN7gezbl8g==, tarball: https://registry.npmjs.org/@esbuild/android-x64/-/android-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [android]
@@ -850,8 +850,8 @@ packages:
     cpu: [x64]
     os: [android]
 
-  '@esbuild/darwin-arm64@0.25.10':
-    resolution: {integrity: sha512-JC74bdXcQEpW9KkV326WpZZjLguSZ3DfS8wrrvPMHgQOIEIG/sPXEN/V8IssoJhbefLRcRqw6RQH2NnpdprtMA==, tarball: https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.10.tgz}
+  '@esbuild/darwin-arm64@0.25.11':
+    resolution: {integrity: sha512-VekY0PBCukppoQrycFxUqkCojnTQhdec0vevUL/EDOCnXd9LKWqD/bHwMPzigIJXPhC59Vd1WFIL57SKs2mg4w==, tarball: https://registry.npmjs.org/@esbuild/darwin-arm64/-/darwin-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [darwin]
@@ -862,8 +862,8 @@ packages:
     cpu: [arm64]
     os: [darwin]
 
-  '@esbuild/darwin-x64@0.25.10':
-    resolution: {integrity: sha512-tguWg1olF6DGqzws97pKZ8G2L7Ig1vjDmGTwcTuYHbuU6TTjJe5FXbgs5C1BBzHbJ2bo1m3WkQDbWO2PvamRcg==, tarball: https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.10.tgz}
+  '@esbuild/darwin-x64@0.25.11':
+    resolution: {integrity: sha512-+hfp3yfBalNEpTGp9loYgbknjR695HkqtY3d3/JjSRUyPg/xd6q+mQqIb5qdywnDxRZykIHs3axEqU6l1+oWEQ==, tarball: https://registry.npmjs.org/@esbuild/darwin-x64/-/darwin-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [darwin]
@@ -874,8 +874,8 @@ packages:
     cpu: [x64]
     os: [darwin]
 
-  '@esbuild/freebsd-arm64@0.25.10':
-    resolution: {integrity: sha512-3ZioSQSg1HT2N05YxeJWYR+Libe3bREVSdWhEEgExWaDtyFbbXWb49QgPvFH8u03vUPX10JhJPcz7s9t9+boWg==, tarball: https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.10.tgz}
+  '@esbuild/freebsd-arm64@0.25.11':
+    resolution: {integrity: sha512-CmKjrnayyTJF2eVuO//uSjl/K3KsMIeYeyN7FyDBjsR3lnSJHaXlVoAK8DZa7lXWChbuOk7NjAc7ygAwrnPBhA==, tarball: https://registry.npmjs.org/@esbuild/freebsd-arm64/-/freebsd-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [freebsd]
@@ -886,8 +886,8 @@ packages:
     cpu: [arm64]
     os: [freebsd]
 
-  '@esbuild/freebsd-x64@0.25.10':
-    resolution: {integrity: sha512-LLgJfHJk014Aa4anGDbh8bmI5Lk+QidDmGzuC2D+vP7mv/GeSN+H39zOf7pN5N8p059FcOfs2bVlrRr4SK9WxA==, tarball: https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.10.tgz}
+  '@esbuild/freebsd-x64@0.25.11':
+    resolution: {integrity: sha512-Dyq+5oscTJvMaYPvW3x3FLpi2+gSZTCE/1ffdwuM6G1ARang/mb3jvjxs0mw6n3Lsw84ocfo9CrNMqc5lTfGOw==, tarball: https://registry.npmjs.org/@esbuild/freebsd-x64/-/freebsd-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [freebsd]
@@ -898,8 +898,8 @@ packages:
     cpu: [x64]
     os: [freebsd]
 
-  '@esbuild/linux-arm64@0.25.10':
-    resolution: {integrity: sha512-5luJWN6YKBsawd5f9i4+c+geYiVEw20FVW5x0v1kEMWNq8UctFjDiMATBxLvmmHA4bf7F6hTRaJgtghFr9iziQ==, tarball: https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.10.tgz}
+  '@esbuild/linux-arm64@0.25.11':
+    resolution: {integrity: sha512-Qr8AzcplUhGvdyUF08A1kHU3Vr2O88xxP0Tm8GcdVOUm25XYcMPp2YqSVHbLuXzYQMf9Bh/iKx7YPqECs6ffLA==, tarball: https://registry.npmjs.org/@esbuild/linux-arm64/-/linux-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [linux]
@@ -910,8 +910,8 @@ packages:
     cpu: [arm64]
     os: [linux]
 
-  '@esbuild/linux-arm@0.25.10':
-    resolution: {integrity: sha512-oR31GtBTFYCqEBALI9r6WxoU/ZofZl962pouZRTEYECvNF/dtXKku8YXcJkhgK/beU+zedXfIzHijSRapJY3vg==, tarball: https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.10.tgz}
+  '@esbuild/linux-arm@0.25.11':
+    resolution: {integrity: sha512-TBMv6B4kCfrGJ8cUPo7vd6NECZH/8hPpBHHlYI3qzoYFvWu2AdTvZNuU/7hsbKWqu/COU7NIK12dHAAqBLLXgw==, tarball: https://registry.npmjs.org/@esbuild/linux-arm/-/linux-arm-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm]
     os: [linux]
@@ -922,8 +922,8 @@ packages:
     cpu: [arm]
     os: [linux]
 
-  '@esbuild/linux-ia32@0.25.10':
-    resolution: {integrity: sha512-NrSCx2Kim3EnnWgS4Txn0QGt0Xipoumb6z6sUtl5bOEZIVKhzfyp/Lyw4C1DIYvzeW/5mWYPBFJU3a/8Yr75DQ==, tarball: https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.10.tgz}
+  '@esbuild/linux-ia32@0.25.11':
+    resolution: {integrity: sha512-TmnJg8BMGPehs5JKrCLqyWTVAvielc615jbkOirATQvWWB1NMXY77oLMzsUjRLa0+ngecEmDGqt5jiDC6bfvOw==, tarball: https://registry.npmjs.org/@esbuild/linux-ia32/-/linux-ia32-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [linux]
@@ -934,8 +934,8 @@ packages:
     cpu: [ia32]
     os: [linux]
 
-  '@esbuild/linux-loong64@0.25.10':
-    resolution: {integrity: sha512-xoSphrd4AZda8+rUDDfD9J6FUMjrkTz8itpTITM4/xgerAZZcFW7Dv+sun7333IfKxGG8gAq+3NbfEMJfiY+Eg==, tarball: https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.10.tgz}
+  '@esbuild/linux-loong64@0.25.11':
+    resolution: {integrity: sha512-DIGXL2+gvDaXlaq8xruNXUJdT5tF+SBbJQKbWy/0J7OhU8gOHOzKmGIlfTTl6nHaCOoipxQbuJi7O++ldrxgMw==, tarball: https://registry.npmjs.org/@esbuild/linux-loong64/-/linux-loong64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [loong64]
     os: [linux]
@@ -946,8 +946,8 @@ packages:
     cpu: [loong64]
     os: [linux]
 
-  '@esbuild/linux-mips64el@0.25.10':
-    resolution: {integrity: sha512-ab6eiuCwoMmYDyTnyptoKkVS3k8fy/1Uvq7Dj5czXI6DF2GqD2ToInBI0SHOp5/X1BdZ26RKc5+qjQNGRBelRA==, tarball: https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.10.tgz}
+  '@esbuild/linux-mips64el@0.25.11':
+    resolution: {integrity: sha512-Osx1nALUJu4pU43o9OyjSCXokFkFbyzjXb6VhGIJZQ5JZi8ylCQ9/LFagolPsHtgw6himDSyb5ETSfmp4rpiKQ==, tarball: https://registry.npmjs.org/@esbuild/linux-mips64el/-/linux-mips64el-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [mips64el]
     os: [linux]
@@ -958,8 +958,8 @@ packages:
     cpu: [mips64el]
     os: [linux]
 
-  '@esbuild/linux-ppc64@0.25.10':
-    resolution: {integrity: sha512-NLinzzOgZQsGpsTkEbdJTCanwA5/wozN9dSgEl12haXJBzMTpssebuXR42bthOF3z7zXFWH1AmvWunUCkBE4EA==, tarball: https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.10.tgz}
+  '@esbuild/linux-ppc64@0.25.11':
+    resolution: {integrity: sha512-nbLFgsQQEsBa8XSgSTSlrnBSrpoWh7ioFDUmwo158gIm5NNP+17IYmNWzaIzWmgCxq56vfr34xGkOcZ7jX6CPw==, tarball: https://registry.npmjs.org/@esbuild/linux-ppc64/-/linux-ppc64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [ppc64]
     os: [linux]
@@ -970,8 +970,8 @@ packages:
     cpu: [ppc64]
     os: [linux]
 
-  '@esbuild/linux-riscv64@0.25.10':
-    resolution: {integrity: sha512-FE557XdZDrtX8NMIeA8LBJX3dC2M8VGXwfrQWU7LB5SLOajfJIxmSdyL/gU1m64Zs9CBKvm4UAuBp5aJ8OgnrA==, tarball: https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.10.tgz}
+  '@esbuild/linux-riscv64@0.25.11':
+    resolution: {integrity: sha512-HfyAmqZi9uBAbgKYP1yGuI7tSREXwIb438q0nqvlpxAOs3XnZ8RsisRfmVsgV486NdjD7Mw2UrFSw51lzUk1ww==, tarball: https://registry.npmjs.org/@esbuild/linux-riscv64/-/linux-riscv64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [riscv64]
     os: [linux]
@@ -982,8 +982,8 @@ packages:
     cpu: [riscv64]
     os: [linux]
 
-  '@esbuild/linux-s390x@0.25.10':
-    resolution: {integrity: sha512-3BBSbgzuB9ajLoVZk0mGu+EHlBwkusRmeNYdqmznmMc9zGASFjSsxgkNsqmXugpPk00gJ0JNKh/97nxmjctdew==, tarball: https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.10.tgz}
+  '@esbuild/linux-s390x@0.25.11':
+    resolution: {integrity: sha512-HjLqVgSSYnVXRisyfmzsH6mXqyvj0SA7pG5g+9W7ESgwA70AXYNpfKBqh1KbTxmQVaYxpzA/SvlB9oclGPbApw==, tarball: https://registry.npmjs.org/@esbuild/linux-s390x/-/linux-s390x-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [s390x]
     os: [linux]
@@ -994,8 +994,8 @@ packages:
     cpu: [s390x]
     os: [linux]
 
-  '@esbuild/linux-x64@0.25.10':
-    resolution: {integrity: sha512-QSX81KhFoZGwenVyPoberggdW1nrQZSvfVDAIUXr3WqLRZGZqWk/P4T8p2SP+de2Sr5HPcvjhcJzEiulKgnxtA==, tarball: https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.10.tgz}
+  '@esbuild/linux-x64@0.25.11':
+    resolution: {integrity: sha512-HSFAT4+WYjIhrHxKBwGmOOSpphjYkcswF449j6EjsjbinTZbp8PJtjsVK1XFJStdzXdy/jaddAep2FGY+wyFAQ==, tarball: https://registry.npmjs.org/@esbuild/linux-x64/-/linux-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [linux]
@@ -1006,8 +1006,8 @@ packages:
     cpu: [x64]
     os: [linux]
 
-  '@esbuild/netbsd-arm64@0.25.10':
-    resolution: {integrity: sha512-AKQM3gfYfSW8XRk8DdMCzaLUFB15dTrZfnX8WXQoOUpUBQ+NaAFCP1kPS/ykbbGYz7rxn0WS48/81l9hFl3u4A==, tarball: https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.10.tgz}
+  '@esbuild/netbsd-arm64@0.25.11':
+    resolution: {integrity: sha512-hr9Oxj1Fa4r04dNpWr3P8QKVVsjQhqrMSUzZzf+LZcYjZNqhA3IAfPQdEh1FLVUJSiu6sgAwp3OmwBfbFgG2Xg==, tarball: https://registry.npmjs.org/@esbuild/netbsd-arm64/-/netbsd-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [netbsd]
@@ -1018,8 +1018,8 @@ packages:
     cpu: [arm64]
     os: [netbsd]
 
-  '@esbuild/netbsd-x64@0.25.10':
-    resolution: {integrity: sha512-7RTytDPGU6fek/hWuN9qQpeGPBZFfB4zZgcz2VK2Z5VpdUxEI8JKYsg3JfO0n/Z1E/6l05n0unDCNc4HnhQGig==, tarball: https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.10.tgz}
+  '@esbuild/netbsd-x64@0.25.11':
+    resolution: {integrity: sha512-u7tKA+qbzBydyj0vgpu+5h5AeudxOAGncb8N6C9Kh1N4n7wU1Xw1JDApsRjpShRpXRQlJLb9wY28ELpwdPcZ7A==, tarball: https://registry.npmjs.org/@esbuild/netbsd-x64/-/netbsd-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [netbsd]
@@ -1030,8 +1030,8 @@ packages:
     cpu: [x64]
     os: [netbsd]
 
-  '@esbuild/openbsd-arm64@0.25.10':
-    resolution: {integrity: sha512-5Se0VM9Wtq797YFn+dLimf2Zx6McttsH2olUBsDml+lm0GOCRVebRWUvDtkY4BWYv/3NgzS8b/UM3jQNh5hYyw==, tarball: https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.10.tgz}
+  '@esbuild/openbsd-arm64@0.25.11':
+    resolution: {integrity: sha512-Qq6YHhayieor3DxFOoYM1q0q1uMFYb7cSpLD2qzDSvK1NAvqFi8Xgivv0cFC6J+hWVw2teCYltyy9/m/14ryHg==, tarball: https://registry.npmjs.org/@esbuild/openbsd-arm64/-/openbsd-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openbsd]
@@ -1042,8 +1042,8 @@ packages:
     cpu: [arm64]
     os: [openbsd]
 
-  '@esbuild/openbsd-x64@0.25.10':
-    resolution: {integrity: sha512-XkA4frq1TLj4bEMB+2HnI0+4RnjbuGZfet2gs/LNs5Hc7D89ZQBHQ0gL2ND6Lzu1+QVkjp3x1gIcPKzRNP8bXw==, tarball: https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.10.tgz}
+  '@esbuild/openbsd-x64@0.25.11':
+    resolution: {integrity: sha512-CN+7c++kkbrckTOz5hrehxWN7uIhFFlmS/hqziSFVWpAzpWrQoAG4chH+nN3Be+Kzv/uuo7zhX716x3Sn2Jduw==, tarball: https://registry.npmjs.org/@esbuild/openbsd-x64/-/openbsd-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [openbsd]
@@ -1054,14 +1054,14 @@ packages:
     cpu: [x64]
     os: [openbsd]
 
-  '@esbuild/openharmony-arm64@0.25.10':
-    resolution: {integrity: sha512-AVTSBhTX8Y/Fz6OmIVBip9tJzZEUcY8WLh7I59+upa5/GPhh2/aM6bvOMQySspnCCHvFi79kMtdJS1w0DXAeag==, tarball: https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.10.tgz}
+  '@esbuild/openharmony-arm64@0.25.11':
+    resolution: {integrity: sha512-rOREuNIQgaiR+9QuNkbkxubbp8MSO9rONmwP5nKncnWJ9v5jQ4JxFnLu4zDSRPf3x4u+2VN4pM4RdyIzDty/wQ==, tarball: https://registry.npmjs.org/@esbuild/openharmony-arm64/-/openharmony-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [openharmony]
 
-  '@esbuild/sunos-x64@0.25.10':
-    resolution: {integrity: sha512-fswk3XT0Uf2pGJmOpDB7yknqhVkJQkAQOcW/ccVOtfx05LkbWOaRAtn5SaqXypeKQra1QaEa841PgrSL9ubSPQ==, tarball: https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.10.tgz}
+  '@esbuild/sunos-x64@0.25.11':
+    resolution: {integrity: sha512-nq2xdYaWxyg9DcIyXkZhcYulC6pQ2FuCgem3LI92IwMgIZ69KHeY8T4Y88pcwoLIjbed8n36CyKoYRDygNSGhA==, tarball: https://registry.npmjs.org/@esbuild/sunos-x64/-/sunos-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [sunos]
@@ -1072,8 +1072,8 @@ packages:
     cpu: [x64]
     os: [sunos]
 
-  '@esbuild/win32-arm64@0.25.10':
-    resolution: {integrity: sha512-ah+9b59KDTSfpaCg6VdJoOQvKjI33nTaQr4UluQwW7aEwZQsbMCfTmfEO4VyewOxx4RaDT/xCy9ra2GPWmO7Kw==, tarball: https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.10.tgz}
+  '@esbuild/win32-arm64@0.25.11':
+    resolution: {integrity: sha512-3XxECOWJq1qMZ3MN8srCJ/QfoLpL+VaxD/WfNRm1O3B4+AZ/BnLVgFbUV3eiRYDMXetciH16dwPbbHqwe1uU0Q==, tarball: https://registry.npmjs.org/@esbuild/win32-arm64/-/win32-arm64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [arm64]
     os: [win32]
@@ -1084,8 +1084,8 @@ packages:
     cpu: [arm64]
     os: [win32]
 
-  '@esbuild/win32-ia32@0.25.10':
-    resolution: {integrity: sha512-QHPDbKkrGO8/cz9LKVnJU22HOi4pxZnZhhA2HYHez5Pz4JeffhDjf85E57Oyco163GnzNCVkZK0b/n4Y0UHcSw==, tarball: https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.10.tgz}
+  '@esbuild/win32-ia32@0.25.11':
+    resolution: {integrity: sha512-3ukss6gb9XZ8TlRyJlgLn17ecsK4NSQTmdIXRASVsiS2sQ6zPPZklNJT5GR5tE/MUarymmy8kCEf5xPCNCqVOA==, tarball: https://registry.npmjs.org/@esbuild/win32-ia32/-/win32-ia32-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [ia32]
     os: [win32]
@@ -1096,8 +1096,8 @@ packages:
     cpu: [ia32]
     os: [win32]
 
-  '@esbuild/win32-x64@0.25.10':
-    resolution: {integrity: sha512-9KpxSVFCu0iK1owoez6aC/s/EdUQLDN3adTxGCqxMVhrPDj6bt5dbrHDXUuq+Bs2vATFBBrQS5vdQ/Ed2P+nbw==, tarball: https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.10.tgz}
+  '@esbuild/win32-x64@0.25.11':
+    resolution: {integrity: sha512-D7Hpz6A2L4hzsRpPaCYkQnGOotdUpDzSGRIv9I+1ITdHROSFUWW95ZPZWQmGka1Fg7W3zFJowyn9WGwMJ0+KPA==, tarball: https://registry.npmjs.org/@esbuild/win32-x64/-/win32-x64-0.25.11.tgz}
     engines: {node: '>=18'}
     cpu: [x64]
     os: [win32]
@@ -2438,113 +2438,113 @@ packages:
       rollup:
         optional: true
 
-  '@rollup/rollup-android-arm-eabi@4.52.3':
-    resolution: {integrity: sha512-h6cqHGZ6VdnwliFG1NXvMPTy/9PS3h8oLh7ImwR+kl+oYnQizgjxsONmmPSb2C66RksfkfIxEVtDSEcJiO0tqw==, tarball: https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.52.3.tgz}
+  '@rollup/rollup-android-arm-eabi@4.52.5':
+    resolution: {integrity: sha512-8c1vW4ocv3UOMp9K+gToY5zL2XiiVw3k7f1ksf4yO1FlDFQ1C2u72iACFnSOceJFsWskc2WZNqeRhFRPzv+wtQ==, tarball: https://registry.npmjs.org/@rollup/rollup-android-arm-eabi/-/rollup-android-arm-eabi-4.52.5.tgz}
     cpu: [arm]
     os: [android]
 
-  '@rollup/rollup-android-arm64@4.52.3':
-    resolution: {integrity: sha512-wd+u7SLT/u6knklV/ifG7gr5Qy4GUbH2hMWcDauPFJzmCZUAJ8L2bTkVXC2niOIxp8lk3iH/QX8kSrUxVZrOVw==, tarball: https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.52.3.tgz}
+  '@rollup/rollup-android-arm64@4.52.5':
+    resolution: {integrity: sha512-mQGfsIEFcu21mvqkEKKu2dYmtuSZOBMmAl5CFlPGLY94Vlcm+zWApK7F/eocsNzp8tKmbeBP8yXyAbx0XHsFNA==, tarball: https://registry.npmjs.org/@rollup/rollup-android-arm64/-/rollup-android-arm64-4.52.5.tgz}
     cpu: [arm64]
     os: [android]
 
-  '@rollup/rollup-darwin-arm64@4.52.3':
-    resolution: {integrity: sha512-lj9ViATR1SsqycwFkJCtYfQTheBdvlWJqzqxwc9f2qrcVrQaF/gCuBRTiTolkRWS6KvNxSk4KHZWG7tDktLgjg==, tarball: https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.52.3.tgz}
+  '@rollup/rollup-darwin-arm64@4.52.5':
+    resolution: {integrity: sha512-takF3CR71mCAGA+v794QUZ0b6ZSrgJkArC+gUiG6LB6TQty9T0Mqh3m2ImRBOxS2IeYBo4lKWIieSvnEk2OQWA==, tarball: https://registry.npmjs.org/@rollup/rollup-darwin-arm64/-/rollup-darwin-arm64-4.52.5.tgz}
     cpu: [arm64]
     os: [darwin]
 
-  '@rollup/rollup-darwin-x64@4.52.3':
-    resolution: {integrity: sha512-+Dyo7O1KUmIsbzx1l+4V4tvEVnVQqMOIYtrxK7ncLSknl1xnMHLgn7gddJVrYPNZfEB8CIi3hK8gq8bDhb3h5A==, tarball: https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.52.3.tgz}
+  '@rollup/rollup-darwin-x64@4.52.5':
+    resolution: {integrity: sha512-W901Pla8Ya95WpxDn//VF9K9u2JbocwV/v75TE0YIHNTbhqUTv9w4VuQ9MaWlNOkkEfFwkdNhXgcLqPSmHy0fA==, tarball: https://registry.npmjs.org/@rollup/rollup-darwin-x64/-/rollup-darwin-x64-4.52.5.tgz}
     cpu: [x64]
     os: [darwin]
 
-  '@rollup/rollup-freebsd-arm64@4.52.3':
-    resolution: {integrity: sha512-u9Xg2FavYbD30g3DSfNhxgNrxhi6xVG4Y6i9Ur1C7xUuGDW3banRbXj+qgnIrwRN4KeJ396jchwy9bCIzbyBEQ==, tarball: https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.52.3.tgz}
+  '@rollup/rollup-freebsd-arm64@4.52.5':
+    resolution: {integrity: sha512-QofO7i7JycsYOWxe0GFqhLmF6l1TqBswJMvICnRUjqCx8b47MTo46W8AoeQwiokAx3zVryVnxtBMcGcnX12LvA==, tarball: https://registry.npmjs.org/@rollup/rollup-freebsd-arm64/-/rollup-freebsd-arm64-4.52.5.tgz}
     cpu: [arm64]
     os: [freebsd]
 
-  '@rollup/rollup-freebsd-x64@4.52.3':
-    resolution: {integrity: sha512-5M8kyi/OX96wtD5qJR89a/3x5x8x5inXBZO04JWhkQb2JWavOWfjgkdvUqibGJeNNaz1/Z1PPza5/tAPXICI6A==, tarball: https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.52.3.tgz}
+  '@rollup/rollup-freebsd-x64@4.52.5':
+    resolution: {integrity: sha512-jr21b/99ew8ujZubPo9skbrItHEIE50WdV86cdSoRkKtmWa+DDr6fu2c/xyRT0F/WazZpam6kk7IHBerSL7LDQ==, tarball: https://registry.npmjs.org/@rollup/rollup-freebsd-x64/-/rollup-freebsd-x64-4.52.5.tgz}
     cpu: [x64]
     os: [freebsd]
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.3':
-    resolution: {integrity: sha512-IoerZJ4l1wRMopEHRKOO16e04iXRDyZFZnNZKrWeNquh5d6bucjezgd+OxG03mOMTnS1x7hilzb3uURPkJ0OfA==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.52.3.tgz}
+  '@rollup/rollup-linux-arm-gnueabihf@4.52.5':
+    resolution: {integrity: sha512-PsNAbcyv9CcecAUagQefwX8fQn9LQ4nZkpDboBOttmyffnInRy8R8dSg6hxxl2Re5QhHBf6FYIDhIj5v982ATQ==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm-gnueabihf/-/rollup-linux-arm-gnueabihf-4.52.5.tgz}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.3':
-    resolution: {integrity: sha512-ZYdtqgHTDfvrJHSh3W22TvjWxwOgc3ThK/XjgcNGP2DIwFIPeAPNsQxrJO5XqleSlgDux2VAoWQ5iJrtaC1TbA==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.52.3.tgz}
+  '@rollup/rollup-linux-arm-musleabihf@4.52.5':
+    resolution: {integrity: sha512-Fw4tysRutyQc/wwkmcyoqFtJhh0u31K+Q6jYjeicsGJJ7bbEq8LwPWV/w0cnzOqR2m694/Af6hpFayLJZkG2VQ==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm-musleabihf/-/rollup-linux-arm-musleabihf-4.52.5.tgz}
     cpu: [arm]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.3':
-    resolution: {integrity: sha512-NcViG7A0YtuFDA6xWSgmFb6iPFzHlf5vcqb2p0lGEbT+gjrEEz8nC/EeDHvx6mnGXnGCC1SeVV+8u+smj0CeGQ==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.52.3.tgz}
+  '@rollup/rollup-linux-arm64-gnu@4.52.5':
+    resolution: {integrity: sha512-a+3wVnAYdQClOTlyapKmyI6BLPAFYs0JM8HRpgYZQO02rMR09ZcV9LbQB+NL6sljzG38869YqThrRnfPMCDtZg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm64-gnu/-/rollup-linux-arm64-gnu-4.52.5.tgz}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-arm64-musl@4.52.3':
-    resolution: {integrity: sha512-d3pY7LWno6SYNXRm6Ebsq0DJGoiLXTb83AIPCXl9fmtIQs/rXoS8SJxxUNtFbJ5MiOvs+7y34np77+9l4nfFMw==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.52.3.tgz}
+  '@rollup/rollup-linux-arm64-musl@4.52.5':
+    resolution: {integrity: sha512-AvttBOMwO9Pcuuf7m9PkC1PUIKsfaAJ4AYhy944qeTJgQOqJYJ9oVl2nYgY7Rk0mkbsuOpCAYSs6wLYB2Xiw0Q==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-arm64-musl/-/rollup-linux-arm64-musl-4.52.5.tgz}
     cpu: [arm64]
     os: [linux]
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.3':
-    resolution: {integrity: sha512-3y5GA0JkBuirLqmjwAKwB0keDlI6JfGYduMlJD/Rl7fvb4Ni8iKdQs1eiunMZJhwDWdCvrcqXRY++VEBbvk6Eg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.52.3.tgz}
+  '@rollup/rollup-linux-loong64-gnu@4.52.5':
+    resolution: {integrity: sha512-DkDk8pmXQV2wVrF6oq5tONK6UHLz/XcEVow4JTTerdeV1uqPeHxwcg7aFsfnSm9L+OO8WJsWotKM2JJPMWrQtA==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-loong64-gnu/-/rollup-linux-loong64-gnu-4.52.5.tgz}
     cpu: [loong64]
     os: [linux]
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.3':
-    resolution: {integrity: sha512-AUUH65a0p3Q0Yfm5oD2KVgzTKgwPyp9DSXc3UA7DtxhEb/WSPfbG4wqXeSN62OG5gSo18em4xv6dbfcUGXcagw==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.52.3.tgz}
+  '@rollup/rollup-linux-ppc64-gnu@4.52.5':
+    resolution: {integrity: sha512-W/b9ZN/U9+hPQVvlGwjzi+Wy4xdoH2I8EjaCkMvzpI7wJUs8sWJ03Rq96jRnHkSrcHTpQe8h5Tg3ZzUPGauvAw==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-ppc64-gnu/-/rollup-linux-ppc64-gnu-4.52.5.tgz}
     cpu: [ppc64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.3':
-    resolution: {integrity: sha512-1makPhFFVBqZE+XFg3Dkq+IkQ7JvmUrwwqaYBL2CE+ZpxPaqkGaiWFEWVGyvTwZace6WLJHwjVh/+CXbKDGPmg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.52.3.tgz}
+  '@rollup/rollup-linux-riscv64-gnu@4.52.5':
+    resolution: {integrity: sha512-sjQLr9BW7R/ZiXnQiWPkErNfLMkkWIoCz7YMn27HldKsADEKa5WYdobaa1hmN6slu9oWQbB6/jFpJ+P2IkVrmw==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-riscv64-gnu/-/rollup-linux-riscv64-gnu-4.52.5.tgz}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.3':
-    resolution: {integrity: sha512-OOFJa28dxfl8kLOPMUOQBCO6z3X2SAfzIE276fwT52uXDWUS178KWq0pL7d6p1kz7pkzA0yQwtqL0dEPoVcRWg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.52.3.tgz}
+  '@rollup/rollup-linux-riscv64-musl@4.52.5':
+    resolution: {integrity: sha512-hq3jU/kGyjXWTvAh2awn8oHroCbrPm8JqM7RUpKjalIRWWXE01CQOf/tUNWNHjmbMHg/hmNCwc/Pz3k1T/j/Lg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-riscv64-musl/-/rollup-linux-riscv64-musl-4.52.5.tgz}
     cpu: [riscv64]
     os: [linux]
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.3':
-    resolution: {integrity: sha512-jMdsML2VI5l+V7cKfZx3ak+SLlJ8fKvLJ0Eoa4b9/vCUrzXKgoKxvHqvJ/mkWhFiyp88nCkM5S2v6nIwRtPcgg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.52.3.tgz}
+  '@rollup/rollup-linux-s390x-gnu@4.52.5':
+    resolution: {integrity: sha512-gn8kHOrku8D4NGHMK1Y7NA7INQTRdVOntt1OCYypZPRt6skGbddska44K8iocdpxHTMMNui5oH4elPH4QOLrFQ==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-s390x-gnu/-/rollup-linux-s390x-gnu-4.52.5.tgz}
     cpu: [s390x]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-gnu@4.52.3':
-    resolution: {integrity: sha512-tPgGd6bY2M2LJTA1uGq8fkSPK8ZLYjDjY+ZLK9WHncCnfIz29LIXIqUgzCR0hIefzy6Hpbe8Th5WOSwTM8E7LA==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.3.tgz}
+  '@rollup/rollup-linux-x64-gnu@4.52.5':
+    resolution: {integrity: sha512-hXGLYpdhiNElzN770+H2nlx+jRog8TyynpTVzdlc6bndktjKWyZyiCsuDAlpd+j+W+WNqfcyAWz9HxxIGfZm1Q==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-x64-gnu/-/rollup-linux-x64-gnu-4.52.5.tgz}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-linux-x64-musl@4.52.3':
-    resolution: {integrity: sha512-BCFkJjgk+WFzP+tcSMXq77ymAPIxsX9lFJWs+2JzuZTLtksJ2o5hvgTdIcZ5+oKzUDMwI0PfWzRBYAydAHF2Mw==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.52.3.tgz}
+  '@rollup/rollup-linux-x64-musl@4.52.5':
+    resolution: {integrity: sha512-arCGIcuNKjBoKAXD+y7XomR9gY6Mw7HnFBv5Rw7wQRvwYLR7gBAgV7Mb2QTyjXfTveBNFAtPt46/36vV9STLNg==, tarball: https://registry.npmjs.org/@rollup/rollup-linux-x64-musl/-/rollup-linux-x64-musl-4.52.5.tgz}
     cpu: [x64]
     os: [linux]
 
-  '@rollup/rollup-openharmony-arm64@4.52.3':
-    resolution: {integrity: sha512-KTD/EqjZF3yvRaWUJdD1cW+IQBk4fbQaHYJUmP8N4XoKFZilVL8cobFSTDnjTtxWJQ3JYaMgF4nObY/+nYkumA==, tarball: https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.52.3.tgz}
+  '@rollup/rollup-openharmony-arm64@4.52.5':
+    resolution: {integrity: sha512-QoFqB6+/9Rly/RiPjaomPLmR/13cgkIGfA40LHly9zcH1S0bN2HVFYk3a1eAyHQyjs3ZJYlXvIGtcCs5tko9Cw==, tarball: https://registry.npmjs.org/@rollup/rollup-openharmony-arm64/-/rollup-openharmony-arm64-4.52.5.tgz}
     cpu: [arm64]
     os: [openharmony]
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.3':
-    resolution: {integrity: sha512-+zteHZdoUYLkyYKObGHieibUFLbttX2r+58l27XZauq0tcWYYuKUwY2wjeCN9oK1Um2YgH2ibd6cnX/wFD7DuA==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.52.3.tgz}
+  '@rollup/rollup-win32-arm64-msvc@4.52.5':
+    resolution: {integrity: sha512-w0cDWVR6MlTstla1cIfOGyl8+qb93FlAVutcor14Gf5Md5ap5ySfQ7R9S/NjNaMLSFdUnKGEasmVnu3lCMqB7w==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-arm64-msvc/-/rollup-win32-arm64-msvc-4.52.5.tgz}
     cpu: [arm64]
     os: [win32]
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.3':
-    resolution: {integrity: sha512-of1iHkTQSo3kr6dTIRX6t81uj/c/b15HXVsPcEElN5sS859qHrOepM5p9G41Hah+CTqSh2r8Bm56dL2z9UQQ7g==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.52.3.tgz}
+  '@rollup/rollup-win32-ia32-msvc@4.52.5':
+    resolution: {integrity: sha512-Aufdpzp7DpOTULJCuvzqcItSGDH73pF3ko/f+ckJhxQyHtp67rHw3HMNxoIdDMUITJESNE6a8uh4Lo4SLouOUg==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-ia32-msvc/-/rollup-win32-ia32-msvc-4.52.5.tgz}
     cpu: [ia32]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-gnu@4.52.3':
-    resolution: {integrity: sha512-s0hybmlHb56mWVZQj8ra9048/WZTPLILKxcvcq+8awSZmyiSUZjjem1AhU3Tf4ZKpYhK4mg36HtHDOe8QJS5PQ==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.52.3.tgz}
+  '@rollup/rollup-win32-x64-gnu@4.52.5':
+    resolution: {integrity: sha512-UGBUGPFp1vkj6p8wCRraqNhqwX/4kNQPS57BCFc8wYh0g94iVIW33wJtQAx3G7vrjjNtRaxiMUylM0ktp/TRSQ==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-x64-gnu/-/rollup-win32-x64-gnu-4.52.5.tgz}
     cpu: [x64]
     os: [win32]
 
-  '@rollup/rollup-win32-x64-msvc@4.52.3':
-    resolution: {integrity: sha512-zGIbEVVXVtauFgl3MRwGWEN36P5ZGenHRMgNw88X5wEhEBpq0XrMEZwOn07+ICrwM17XO5xfMZqh0OldCH5VTA==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.52.3.tgz}
+  '@rollup/rollup-win32-x64-msvc@4.52.5':
+    resolution: {integrity: sha512-TAcgQh2sSkykPRWLrdyy2AiceMckNf5loITqXxFI5VuQjS5tSuw3WlwdN8qv8vzjLAUTvYaH/mVjSFpbkFbpTg==, tarball: https://registry.npmjs.org/@rollup/rollup-win32-x64-msvc/-/rollup-win32-x64-msvc-4.52.5.tgz}
     cpu: [x64]
     os: [win32]
 
@@ -3896,8 +3896,8 @@ packages:
     peerDependencies:
       esbuild: ^0.25.0
 
-  esbuild@0.25.10:
-    resolution: {integrity: sha512-9RiGKvCwaqxO2owP61uQ4BgNborAQskMR6QusfWzQqv7AZOg5oGehdY2pRJMTKuwxd1IDBP4rSbI5lHzU7SMsQ==, tarball: https://registry.npmjs.org/esbuild/-/esbuild-0.25.10.tgz}
+  esbuild@0.25.11:
+    resolution: {integrity: sha512-KohQwyzrKTQmhXDW1PjCv3Tyspn9n5GcY2RTDqeORIdIJY8yKIF7sTSopFmn/wpMPW4rdPXI0UE5LJLuq3bx0Q==, tarball: https://registry.npmjs.org/esbuild/-/esbuild-0.25.11.tgz}
     engines: {node: '>=18'}
     hasBin: true
 
@@ -5780,8 +5780,8 @@ packages:
       rollup:
         optional: true
 
-  rollup@4.52.3:
-    resolution: {integrity: sha512-RIDh866U8agLgiIcdpB+COKnlCreHJLfIhWC3LVflku5YHfpnsIKigRZeFfMfCc4dVcqNVfQQ5gO/afOck064A==, tarball: https://registry.npmjs.org/rollup/-/rollup-4.52.3.tgz}
+  rollup@4.52.5:
+    resolution: {integrity: sha512-3GuObel8h7Kqdjt0gxkEzaifHTqLVW56Y/bjN7PSQtkKr0w3V/QYSdt6QWYtd7A1xUtYQigtdUfgj1RvWVtorw==, tarball: https://registry.npmjs.org/rollup/-/rollup-4.52.5.tgz}
     engines: {node: '>=18.0.0', npm: '>=8.0.0'}
     hasBin: true
 
@@ -6404,8 +6404,8 @@ packages:
       vue-tsc:
         optional: true
 
-  vite@7.1.7:
-    resolution: {integrity: sha512-VbA8ScMvAISJNJVbRDTJdCwqQoAareR/wutevKanhR2/1EkoXVZVkkORaYm/tNVCjP/UDTKtcw3bAkwOUdedmA==, tarball: https://registry.npmjs.org/vite/-/vite-7.1.7.tgz}
+  vite@7.1.11:
+    resolution: {integrity: sha512-uzcxnSDVjAopEUjljkWh8EIrg6tlzrjFUfMcR1EVsRDGwf/ccef0qQPRyOrROwhrTDaApueq+ja+KLPlzR/zdg==, tarball: https://registry.npmjs.org/vite/-/vite-7.1.11.tgz}
     engines: {node: ^20.19.0 || >=22.12.0}
     hasBin: true
     peerDependencies:
@@ -6882,13 +6882,13 @@ snapshots:
       '@types/tough-cookie': 4.0.5
       tough-cookie: 4.1.4
 
-  '@chromatic-com/storybook@4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
+  '@chromatic-com/storybook@4.1.0(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       '@neoconfetti/react': 1.0.0
       chromatic: 12.2.0
       filesize: 10.1.2
       jsonfile: 6.1.0
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       strip-ansi: 7.1.0
     transitivePeerDependencies:
       - '@chromatic-com/cypress'
@@ -7015,154 +7015,154 @@ snapshots:
 
   '@emotion/weak-memoize@0.4.0': {}
 
-  '@esbuild/aix-ppc64@0.25.10':
+  '@esbuild/aix-ppc64@0.25.11':
     optional: true
 
   '@esbuild/aix-ppc64@0.25.3':
     optional: true
 
-  '@esbuild/android-arm64@0.25.10':
+  '@esbuild/android-arm64@0.25.11':
     optional: true
 
   '@esbuild/android-arm64@0.25.3':
     optional: true
 
-  '@esbuild/android-arm@0.25.10':
+  '@esbuild/android-arm@0.25.11':
     optional: true
 
   '@esbuild/android-arm@0.25.3':
     optional: true
 
-  '@esbuild/android-x64@0.25.10':
+  '@esbuild/android-x64@0.25.11':
     optional: true
 
   '@esbuild/android-x64@0.25.3':
     optional: true
 
-  '@esbuild/darwin-arm64@0.25.10':
+  '@esbuild/darwin-arm64@0.25.11':
     optional: true
 
   '@esbuild/darwin-arm64@0.25.3':
     optional: true
 
-  '@esbuild/darwin-x64@0.25.10':
+  '@esbuild/darwin-x64@0.25.11':
     optional: true
 
   '@esbuild/darwin-x64@0.25.3':
     optional: true
 
-  '@esbuild/freebsd-arm64@0.25.10':
+  '@esbuild/freebsd-arm64@0.25.11':
     optional: true
 
   '@esbuild/freebsd-arm64@0.25.3':
     optional: true
 
-  '@esbuild/freebsd-x64@0.25.10':
+  '@esbuild/freebsd-x64@0.25.11':
     optional: true
 
   '@esbuild/freebsd-x64@0.25.3':
     optional: true
 
-  '@esbuild/linux-arm64@0.25.10':
+  '@esbuild/linux-arm64@0.25.11':
     optional: true
 
   '@esbuild/linux-arm64@0.25.3':
     optional: true
 
-  '@esbuild/linux-arm@0.25.10':
+  '@esbuild/linux-arm@0.25.11':
     optional: true
 
   '@esbuild/linux-arm@0.25.3':
     optional: true
 
-  '@esbuild/linux-ia32@0.25.10':
+  '@esbuild/linux-ia32@0.25.11':
     optional: true
 
   '@esbuild/linux-ia32@0.25.3':
     optional: true
 
-  '@esbuild/linux-loong64@0.25.10':
+  '@esbuild/linux-loong64@0.25.11':
     optional: true
 
   '@esbuild/linux-loong64@0.25.3':
     optional: true
 
-  '@esbuild/linux-mips64el@0.25.10':
+  '@esbuild/linux-mips64el@0.25.11':
     optional: true
 
   '@esbuild/linux-mips64el@0.25.3':
     optional: true
 
-  '@esbuild/linux-ppc64@0.25.10':
+  '@esbuild/linux-ppc64@0.25.11':
     optional: true
 
   '@esbuild/linux-ppc64@0.25.3':
     optional: true
 
-  '@esbuild/linux-riscv64@0.25.10':
+  '@esbuild/linux-riscv64@0.25.11':
     optional: true
 
   '@esbuild/linux-riscv64@0.25.3':
     optional: true
 
-  '@esbuild/linux-s390x@0.25.10':
+  '@esbuild/linux-s390x@0.25.11':
     optional: true
 
   '@esbuild/linux-s390x@0.25.3':
     optional: true
 
-  '@esbuild/linux-x64@0.25.10':
+  '@esbuild/linux-x64@0.25.11':
     optional: true
 
   '@esbuild/linux-x64@0.25.3':
     optional: true
 
-  '@esbuild/netbsd-arm64@0.25.10':
+  '@esbuild/netbsd-arm64@0.25.11':
     optional: true
 
   '@esbuild/netbsd-arm64@0.25.3':
     optional: true
 
-  '@esbuild/netbsd-x64@0.25.10':
+  '@esbuild/netbsd-x64@0.25.11':
     optional: true
 
   '@esbuild/netbsd-x64@0.25.3':
     optional: true
 
-  '@esbuild/openbsd-arm64@0.25.10':
+  '@esbuild/openbsd-arm64@0.25.11':
     optional: true
 
   '@esbuild/openbsd-arm64@0.25.3':
     optional: true
 
-  '@esbuild/openbsd-x64@0.25.10':
+  '@esbuild/openbsd-x64@0.25.11':
     optional: true
 
   '@esbuild/openbsd-x64@0.25.3':
     optional: true
 
-  '@esbuild/openharmony-arm64@0.25.10':
+  '@esbuild/openharmony-arm64@0.25.11':
     optional: true
 
-  '@esbuild/sunos-x64@0.25.10':
+  '@esbuild/sunos-x64@0.25.11':
     optional: true
 
   '@esbuild/sunos-x64@0.25.3':
     optional: true
 
-  '@esbuild/win32-arm64@0.25.10':
+  '@esbuild/win32-arm64@0.25.11':
     optional: true
 
   '@esbuild/win32-arm64@0.25.3':
     optional: true
 
-  '@esbuild/win32-ia32@0.25.10':
+  '@esbuild/win32-ia32@0.25.11':
     optional: true
 
   '@esbuild/win32-ia32@0.25.3':
     optional: true
 
-  '@esbuild/win32-x64@0.25.10':
+  '@esbuild/win32-x64@0.25.11':
     optional: true
 
   '@esbuild/win32-x64@0.25.3':
@@ -7500,12 +7500,12 @@ snapshots:
       '@types/yargs': 17.0.33
       chalk: 4.1.2
 
-  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
+  '@joshwooding/vite-plugin-react-docgen-typescript@0.6.1(typescript@5.6.3)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
       glob: 10.4.5
       magic-string: 0.30.17
       react-docgen-typescript: 2.2.2(typescript@5.6.3)
-      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+      vite: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
     optionalDependencies:
       typescript: 5.6.3
 
@@ -8556,78 +8556,78 @@ snapshots:
 
   '@rolldown/pluginutils@1.0.0-beta.38': {}
 
-  '@rollup/pluginutils@5.0.5(rollup@4.52.3)':
+  '@rollup/pluginutils@5.0.5(rollup@4.52.5)':
     dependencies:
       '@types/estree': 1.0.7
       estree-walker: 2.0.2
       picomatch: 2.3.1
     optionalDependencies:
-      rollup: 4.52.3
+      rollup: 4.52.5
 
-  '@rollup/rollup-android-arm-eabi@4.52.3':
+  '@rollup/rollup-android-arm-eabi@4.52.5':
     optional: true
 
-  '@rollup/rollup-android-arm64@4.52.3':
+  '@rollup/rollup-android-arm64@4.52.5':
     optional: true
 
-  '@rollup/rollup-darwin-arm64@4.52.3':
+  '@rollup/rollup-darwin-arm64@4.52.5':
     optional: true
 
-  '@rollup/rollup-darwin-x64@4.52.3':
+  '@rollup/rollup-darwin-x64@4.52.5':
     optional: true
 
-  '@rollup/rollup-freebsd-arm64@4.52.3':
+  '@rollup/rollup-freebsd-arm64@4.52.5':
     optional: true
 
-  '@rollup/rollup-freebsd-x64@4.52.3':
+  '@rollup/rollup-freebsd-x64@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-arm-gnueabihf@4.52.3':
+  '@rollup/rollup-linux-arm-gnueabihf@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-arm-musleabihf@4.52.3':
+  '@rollup/rollup-linux-arm-musleabihf@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-arm64-gnu@4.52.3':
+  '@rollup/rollup-linux-arm64-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-arm64-musl@4.52.3':
+  '@rollup/rollup-linux-arm64-musl@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-loong64-gnu@4.52.3':
+  '@rollup/rollup-linux-loong64-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-ppc64-gnu@4.52.3':
+  '@rollup/rollup-linux-ppc64-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-gnu@4.52.3':
+  '@rollup/rollup-linux-riscv64-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-riscv64-musl@4.52.3':
+  '@rollup/rollup-linux-riscv64-musl@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-s390x-gnu@4.52.3':
+  '@rollup/rollup-linux-s390x-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-x64-gnu@4.52.3':
+  '@rollup/rollup-linux-x64-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-linux-x64-musl@4.52.3':
+  '@rollup/rollup-linux-x64-musl@4.52.5':
     optional: true
 
-  '@rollup/rollup-openharmony-arm64@4.52.3':
+  '@rollup/rollup-openharmony-arm64@4.52.5':
     optional: true
 
-  '@rollup/rollup-win32-arm64-msvc@4.52.3':
+  '@rollup/rollup-win32-arm64-msvc@4.52.5':
     optional: true
 
-  '@rollup/rollup-win32-ia32-msvc@4.52.3':
+  '@rollup/rollup-win32-ia32-msvc@4.52.5':
     optional: true
 
-  '@rollup/rollup-win32-x64-gnu@4.52.3':
+  '@rollup/rollup-win32-x64-gnu@4.52.5':
     optional: true
 
-  '@rollup/rollup-win32-x64-msvc@4.52.3':
+  '@rollup/rollup-win32-x64-msvc@4.52.5':
     optional: true
 
   '@sinclair/typebox@0.27.8': {}
@@ -8640,41 +8640,41 @@ snapshots:
     dependencies:
       '@sinonjs/commons': 3.0.0
 
-  '@storybook/addon-docs@9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
+  '@storybook/addon-docs@9.1.2(@types/react@19.1.17)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       '@mdx-js/react': 3.0.1(@types/react@19.1.17)(react@19.1.1)
-      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       '@storybook/icons': 1.4.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       ts-dedent: 2.2.0
     transitivePeerDependencies:
       - '@types/react'
 
-  '@storybook/addon-links@9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
+  '@storybook/addon-links@9.1.2(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       '@storybook/global': 5.0.0
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
     optionalDependencies:
       react: 19.1.1
 
-  '@storybook/addon-themes@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
+  '@storybook/addon-themes@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       ts-dedent: 2.2.0
 
-  '@storybook/builder-vite@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
+  '@storybook/builder-vite@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
-      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      '@storybook/csf-plugin': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       ts-dedent: 2.2.0
-      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+      vite: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
 
-  '@storybook/csf-plugin@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
+  '@storybook/csf-plugin@9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       unplugin: 1.5.0
 
   '@storybook/global@5.0.0': {}
@@ -8684,39 +8684,39 @@ snapshots:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  '@storybook/react-dom-shim@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
+  '@storybook/react-dom-shim@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))':
     dependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
 
-  '@storybook/react-vite@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.3)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
+  '@storybook/react-vite@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(rollup@4.52.5)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
-      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
-      '@rollup/pluginutils': 5.0.5(rollup@4.52.3)
-      '@storybook/builder-vite': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
-      '@storybook/react': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)
+      '@joshwooding/vite-plugin-react-docgen-typescript': 0.6.1(typescript@5.6.3)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      '@rollup/pluginutils': 5.0.5(rollup@4.52.5)
+      '@storybook/builder-vite': 9.1.2(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      '@storybook/react': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)
       find-up: 7.0.0
       magic-string: 0.30.17
       react: 19.1.1
       react-docgen: 8.0.0
       react-dom: 19.1.1(react@19.1.1)
       resolve: 1.22.10
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       tsconfig-paths: 4.2.0
-      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+      vite: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
     transitivePeerDependencies:
       - rollup
       - supports-color
       - typescript
 
-  '@storybook/react@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)':
+  '@storybook/react@9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))(typescript@5.6.3)':
     dependencies:
       '@storybook/global': 5.0.0
-      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
+      '@storybook/react-dom-shim': 9.1.2(react-dom@19.1.1(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)))
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
     optionalDependencies:
       typescript: 5.6.3
 
@@ -9158,7 +9158,7 @@ snapshots:
 
   '@ungap/structured-clone@1.3.0': {}
 
-  '@vitejs/plugin-react@5.0.4(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
+  '@vitejs/plugin-react@5.0.4(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
       '@babel/core': 7.28.4
       '@babel/plugin-transform-react-jsx-self': 7.27.1(@babel/core@7.28.4)
@@ -9166,7 +9166,7 @@ snapshots:
       '@rolldown/pluginutils': 1.0.0-beta.38
       '@types/babel__core': 7.20.5
       react-refresh: 0.17.0
-      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+      vite: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
     transitivePeerDependencies:
       - supports-color
 
@@ -9178,14 +9178,14 @@ snapshots:
       chai: 5.2.1
       tinyrainbow: 2.0.0
 
-  '@vitest/mocker@3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
+  '@vitest/mocker@3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))':
     dependencies:
       '@vitest/spy': 3.2.4
       estree-walker: 3.0.3
       magic-string: 0.30.17
     optionalDependencies:
       msw: 2.4.8(typescript@5.6.3)
-      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+      vite: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
 
   '@vitest/pretty-format@3.2.4':
     dependencies:
@@ -9994,34 +9994,34 @@ snapshots:
     transitivePeerDependencies:
       - supports-color
 
-  esbuild@0.25.10:
+  esbuild@0.25.11:
     optionalDependencies:
-      '@esbuild/aix-ppc64': 0.25.10
-      '@esbuild/android-arm': 0.25.10
-      '@esbuild/android-arm64': 0.25.10
-      '@esbuild/android-x64': 0.25.10
-      '@esbuild/darwin-arm64': 0.25.10
-      '@esbuild/darwin-x64': 0.25.10
-      '@esbuild/freebsd-arm64': 0.25.10
-      '@esbuild/freebsd-x64': 0.25.10
-      '@esbuild/linux-arm': 0.25.10
-      '@esbuild/linux-arm64': 0.25.10
-      '@esbuild/linux-ia32': 0.25.10
-      '@esbuild/linux-loong64': 0.25.10
-      '@esbuild/linux-mips64el': 0.25.10
-      '@esbuild/linux-ppc64': 0.25.10
-      '@esbuild/linux-riscv64': 0.25.10
-      '@esbuild/linux-s390x': 0.25.10
-      '@esbuild/linux-x64': 0.25.10
-      '@esbuild/netbsd-arm64': 0.25.10
-      '@esbuild/netbsd-x64': 0.25.10
-      '@esbuild/openbsd-arm64': 0.25.10
-      '@esbuild/openbsd-x64': 0.25.10
-      '@esbuild/openharmony-arm64': 0.25.10
-      '@esbuild/sunos-x64': 0.25.10
-      '@esbuild/win32-arm64': 0.25.10
-      '@esbuild/win32-ia32': 0.25.10
-      '@esbuild/win32-x64': 0.25.10
+      '@esbuild/aix-ppc64': 0.25.11
+      '@esbuild/android-arm': 0.25.11
+      '@esbuild/android-arm64': 0.25.11
+      '@esbuild/android-x64': 0.25.11
+      '@esbuild/darwin-arm64': 0.25.11
+      '@esbuild/darwin-x64': 0.25.11
+      '@esbuild/freebsd-arm64': 0.25.11
+      '@esbuild/freebsd-x64': 0.25.11
+      '@esbuild/linux-arm': 0.25.11
+      '@esbuild/linux-arm64': 0.25.11
+      '@esbuild/linux-ia32': 0.25.11
+      '@esbuild/linux-loong64': 0.25.11
+      '@esbuild/linux-mips64el': 0.25.11
+      '@esbuild/linux-ppc64': 0.25.11
+      '@esbuild/linux-riscv64': 0.25.11
+      '@esbuild/linux-s390x': 0.25.11
+      '@esbuild/linux-x64': 0.25.11
+      '@esbuild/netbsd-arm64': 0.25.11
+      '@esbuild/netbsd-x64': 0.25.11
+      '@esbuild/openbsd-arm64': 0.25.11
+      '@esbuild/openbsd-x64': 0.25.11
+      '@esbuild/openharmony-arm64': 0.25.11
+      '@esbuild/sunos-x64': 0.25.11
+      '@esbuild/win32-arm64': 0.25.11
+      '@esbuild/win32-ia32': 0.25.11
+      '@esbuild/win32-x64': 0.25.11
 
   esbuild@0.25.3:
     optionalDependencies:
@@ -12486,41 +12486,41 @@ snapshots:
       glob: 7.2.3
     optional: true
 
-  rollup-plugin-visualizer@5.14.0(rollup@4.52.3):
+  rollup-plugin-visualizer@5.14.0(rollup@4.52.5):
     dependencies:
       open: 8.4.2
       picomatch: 4.0.2
       source-map: 0.7.4
       yargs: 17.7.2
     optionalDependencies:
-      rollup: 4.52.3
+      rollup: 4.52.5
 
-  rollup@4.52.3:
+  rollup@4.52.5:
     dependencies:
       '@types/estree': 1.0.8
     optionalDependencies:
-      '@rollup/rollup-android-arm-eabi': 4.52.3
-      '@rollup/rollup-android-arm64': 4.52.3
-      '@rollup/rollup-darwin-arm64': 4.52.3
-      '@rollup/rollup-darwin-x64': 4.52.3
-      '@rollup/rollup-freebsd-arm64': 4.52.3
-      '@rollup/rollup-freebsd-x64': 4.52.3
-      '@rollup/rollup-linux-arm-gnueabihf': 4.52.3
-      '@rollup/rollup-linux-arm-musleabihf': 4.52.3
-      '@rollup/rollup-linux-arm64-gnu': 4.52.3
-      '@rollup/rollup-linux-arm64-musl': 4.52.3
-      '@rollup/rollup-linux-loong64-gnu': 4.52.3
-      '@rollup/rollup-linux-ppc64-gnu': 4.52.3
-      '@rollup/rollup-linux-riscv64-gnu': 4.52.3
-      '@rollup/rollup-linux-riscv64-musl': 4.52.3
-      '@rollup/rollup-linux-s390x-gnu': 4.52.3
-      '@rollup/rollup-linux-x64-gnu': 4.52.3
-      '@rollup/rollup-linux-x64-musl': 4.52.3
-      '@rollup/rollup-openharmony-arm64': 4.52.3
-      '@rollup/rollup-win32-arm64-msvc': 4.52.3
-      '@rollup/rollup-win32-ia32-msvc': 4.52.3
-      '@rollup/rollup-win32-x64-gnu': 4.52.3
-      '@rollup/rollup-win32-x64-msvc': 4.52.3
+      '@rollup/rollup-android-arm-eabi': 4.52.5
+      '@rollup/rollup-android-arm64': 4.52.5
+      '@rollup/rollup-darwin-arm64': 4.52.5
+      '@rollup/rollup-darwin-x64': 4.52.5
+      '@rollup/rollup-freebsd-arm64': 4.52.5
+      '@rollup/rollup-freebsd-x64': 4.52.5
+      '@rollup/rollup-linux-arm-gnueabihf': 4.52.5
+      '@rollup/rollup-linux-arm-musleabihf': 4.52.5
+      '@rollup/rollup-linux-arm64-gnu': 4.52.5
+      '@rollup/rollup-linux-arm64-musl': 4.52.5
+      '@rollup/rollup-linux-loong64-gnu': 4.52.5
+      '@rollup/rollup-linux-ppc64-gnu': 4.52.5
+      '@rollup/rollup-linux-riscv64-gnu': 4.52.5
+      '@rollup/rollup-linux-riscv64-musl': 4.52.5
+      '@rollup/rollup-linux-s390x-gnu': 4.52.5
+      '@rollup/rollup-linux-x64-gnu': 4.52.5
+      '@rollup/rollup-linux-x64-musl': 4.52.5
+      '@rollup/rollup-openharmony-arm64': 4.52.5
+      '@rollup/rollup-win32-arm64-msvc': 4.52.5
+      '@rollup/rollup-win32-ia32-msvc': 4.52.5
+      '@rollup/rollup-win32-x64-gnu': 4.52.5
+      '@rollup/rollup-win32-x64-msvc': 4.52.5
       fsevents: 2.3.3
 
   run-parallel@1.2.0:
@@ -12680,24 +12680,24 @@ snapshots:
     dependencies:
       internal-slot: 1.0.6
 
-  storybook-addon-remix-react-router@5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))):
+  storybook-addon-remix-react-router@5.0.0(react-dom@19.1.1(react@19.1.1))(react-router@7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1))(react@19.1.1)(storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))):
     dependencies:
       '@mjackson/form-data-parser': 0.4.0
       compare-versions: 6.1.0
       react-inspector: 6.0.2(react@19.1.1)
       react-router: 7.8.0(react-dom@19.1.1(react@19.1.1))(react@19.1.1)
-      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      storybook: 9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
     optionalDependencies:
       react: 19.1.1
       react-dom: 19.1.1(react@19.1.1)
 
-  storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
+  storybook@9.1.2(@testing-library/dom@10.4.0)(msw@2.4.8(typescript@5.6.3))(prettier@3.4.1)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
     dependencies:
       '@storybook/global': 5.0.0
       '@testing-library/jest-dom': 6.6.3
       '@testing-library/user-event': 14.6.1(@testing-library/dom@10.4.0)
       '@vitest/expect': 3.2.4
-      '@vitest/mocker': 3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
+      '@vitest/mocker': 3.2.4(msw@2.4.8(typescript@5.6.3))(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0))
       '@vitest/spy': 3.2.4
       better-opn: 3.0.2
       esbuild: 0.25.3
@@ -13142,7 +13142,7 @@ snapshots:
       d3-time: 3.1.0
       d3-timer: 3.0.1
 
-  vite-plugin-checker@0.11.0(@biomejs/biome@2.2.4)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
+  vite-plugin-checker@0.11.0(@biomejs/biome@2.2.4)(eslint@8.52.0)(optionator@0.9.3)(typescript@5.6.3)(vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)):
     dependencies:
       '@babel/code-frame': 7.27.1
       chokidar: 4.0.3
@@ -13151,7 +13151,7 @@ snapshots:
       picomatch: 4.0.3
       tiny-invariant: 1.3.3
       tinyglobby: 0.2.15
-      vite: 7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
+      vite: 7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0)
       vscode-uri: 3.1.0
     optionalDependencies:
       '@biomejs/biome': 2.2.4
@@ -13159,13 +13159,13 @@ snapshots:
       optionator: 0.9.3
       typescript: 5.6.3
 
-  vite@7.1.7(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0):
+  vite@7.1.11(@types/node@20.17.16)(jiti@1.21.7)(yaml@2.7.0):
     dependencies:
-      esbuild: 0.25.10
+      esbuild: 0.25.11
       fdir: 6.5.0(picomatch@4.0.3)
       picomatch: 4.0.3
       postcss: 8.5.6
-      rollup: 4.52.3
+      rollup: 4.52.5
       tinyglobby: 0.2.15
     optionalDependencies:
       '@types/node': 20.17.16

From 5a18cf4c861e7944c34e3c3ce42e957e8321c4ac Mon Sep 17 00:00:00 2001
From: Callum Styan <callumstyan@gmail.com>
Date: Mon, 20 Oct 2025 18:51:15 -0700
Subject: [PATCH 183/298] fix: remove unintentionally added print in test code
 (#20391)

accidentally added in https://github.com/coder/coder/pull/19786

Signed-off-by: Callum Styan <callumstyan@gmail.com>
---
 coderd/prometheusmetrics/prometheusmetrics_test.go | 1 -
 1 file changed, 1 deletion(-)

diff --git a/coderd/prometheusmetrics/prometheusmetrics_test.go b/coderd/prometheusmetrics/prometheusmetrics_test.go
index 0d115e0840473..e75f86e51b55c 100644
--- a/coderd/prometheusmetrics/prometheusmetrics_test.go
+++ b/coderd/prometheusmetrics/prometheusmetrics_test.go
@@ -291,7 +291,6 @@ func TestWorkspaceLatestBuildTotals(t *testing.T) {
 					}
 
 					for _, metric := range m.Metric {
-						fmt.Printf("metric: %+v\n", metric)
 						count, ok := tc.Status[codersdk.ProvisionerJobStatus(metric.Label[0].GetValue())]
 						if metric.Gauge.GetValue() == 0 {
 							continue

From 0652b18ebcb5a9a1abf4428a8d94fcd55fc86b7d Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Tue, 21 Oct 2025 14:13:11 +1100
Subject: [PATCH 184/298] feat: mount pprof and metrics to /api/v2/debug for
 admins (#20353)

Adds the following debug routes for people with the `debug_info:read`
permission:
- `/api/v2/debug/pprof` for `net/http/pprof`
    - `/`
    - `/cmdline`
    - `/profile`
    - `/symbol`
    - `/trace`
    - `/*`
- `/api/v2/debug/metrics` for Prometheus metrics
---
 coderd/apidoc/docs.go              | 132 +++++++++++++++++++++++++++++
 coderd/apidoc/swagger.json         | 120 ++++++++++++++++++++++++++
 coderd/coderd.go                   |  40 ++++++++-
 coderd/coderdtest/swaggerparser.go |   5 +-
 coderd/debug.go                    |  54 ++++++++++++
 5 files changed, 348 insertions(+), 3 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index f6a15f4c44d51..95413dff67d98 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -954,6 +954,138 @@ const docTemplate = `{
                 }
             }
         },
+        "/debug/metrics": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Debug"
+                ],
+                "summary": "Debug metrics",
+                "operationId": "debug-metrics",
+                "responses": {
+                    "200": {
+                        "description": "OK"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
+        "/debug/pprof": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Debug"
+                ],
+                "summary": "Debug pprof index",
+                "operationId": "debug-pprof-index",
+                "responses": {
+                    "200": {
+                        "description": "OK"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
+        "/debug/pprof/cmdline": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Debug"
+                ],
+                "summary": "Debug pprof cmdline",
+                "operationId": "debug-pprof-cmdline",
+                "responses": {
+                    "200": {
+                        "description": "OK"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
+        "/debug/pprof/profile": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Debug"
+                ],
+                "summary": "Debug pprof profile",
+                "operationId": "debug-pprof-profile",
+                "responses": {
+                    "200": {
+                        "description": "OK"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
+        "/debug/pprof/symbol": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Debug"
+                ],
+                "summary": "Debug pprof symbol",
+                "operationId": "debug-pprof-symbol",
+                "responses": {
+                    "200": {
+                        "description": "OK"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
+        "/debug/pprof/trace": {
+            "get": {
+                "security": [
+                    {
+                        "CoderSessionToken": []
+                    }
+                ],
+                "tags": [
+                    "Debug"
+                ],
+                "summary": "Debug pprof trace",
+                "operationId": "debug-pprof-trace",
+                "responses": {
+                    "200": {
+                        "description": "OK"
+                    }
+                },
+                "x-apidocgen": {
+                    "skip": true
+                }
+            }
+        },
         "/debug/tailnet": {
             "get": {
                 "security": [
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 780f89d876f28..a3f57d4fa4d12 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -840,6 +840,126 @@
 				}
 			}
 		},
+		"/debug/metrics": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Debug"],
+				"summary": "Debug metrics",
+				"operationId": "debug-metrics",
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"x-apidocgen": {
+					"skip": true
+				}
+			}
+		},
+		"/debug/pprof": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Debug"],
+				"summary": "Debug pprof index",
+				"operationId": "debug-pprof-index",
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"x-apidocgen": {
+					"skip": true
+				}
+			}
+		},
+		"/debug/pprof/cmdline": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Debug"],
+				"summary": "Debug pprof cmdline",
+				"operationId": "debug-pprof-cmdline",
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"x-apidocgen": {
+					"skip": true
+				}
+			}
+		},
+		"/debug/pprof/profile": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Debug"],
+				"summary": "Debug pprof profile",
+				"operationId": "debug-pprof-profile",
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"x-apidocgen": {
+					"skip": true
+				}
+			}
+		},
+		"/debug/pprof/symbol": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Debug"],
+				"summary": "Debug pprof symbol",
+				"operationId": "debug-pprof-symbol",
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"x-apidocgen": {
+					"skip": true
+				}
+			}
+		},
+		"/debug/pprof/trace": {
+			"get": {
+				"security": [
+					{
+						"CoderSessionToken": []
+					}
+				],
+				"tags": ["Debug"],
+				"summary": "Debug pprof trace",
+				"operationId": "debug-pprof-trace",
+				"responses": {
+					"200": {
+						"description": "OK"
+					}
+				},
+				"x-apidocgen": {
+					"skip": true
+				}
+			}
+		},
 		"/debug/tailnet": {
 			"get": {
 				"security": [
diff --git a/coderd/coderd.go b/coderd/coderd.go
index 15f2767c22916..122018f96d72f 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -11,6 +11,7 @@ import (
 	"fmt"
 	"io"
 	"net/http"
+	httppprof "net/http/pprof"
 	"net/url"
 	"path/filepath"
 	"regexp"
@@ -32,6 +33,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/klauspost/compress/zstd"
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
 	httpSwagger "github.com/swaggo/http-swagger/v2"
 	"go.opentelemetry.io/otel/trace"
 	"golang.org/x/xerrors"
@@ -1512,7 +1514,8 @@ func New(options *Options) *API {
 		r.Route("/debug", func(r chi.Router) {
 			r.Use(
 				apiKeyMiddleware,
-				// Ensure only owners can access debug endpoints.
+				// Ensure only users with the debug_info:read (e.g. only owners)
+				// can view debug endpoints.
 				func(next http.Handler) http.Handler {
 					return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 						if !api.Authorize(r, policy.ActionRead, rbac.ResourceDebugInfo) {
@@ -1545,6 +1548,41 @@ func New(options *Options) *API {
 				})
 			}
 			r.Method("GET", "/expvar", expvar.Handler()) // contains DERP metrics as well as cmdline and memstats
+
+			r.Route("/pprof", func(r chi.Router) {
+				r.Use(func(next http.Handler) http.Handler {
+					// Some of the pprof handlers strip the `/debug/pprof`
+					// prefix, so we need to strip our additional prefix as
+					// well.
+					return http.StripPrefix("/api/v2", next)
+				})
+
+				// Serve the index HTML page.
+				r.Get("/", func(w http.ResponseWriter, r *http.Request) {
+					// Redirect to include a trailing slash, otherwise links on
+					// the generated HTML page will be broken.
+					if !strings.HasSuffix(r.URL.Path, "/") {
+						http.Redirect(w, r, "/api/v2/debug/pprof/", http.StatusTemporaryRedirect)
+						return
+					}
+					httppprof.Index(w, r)
+				})
+
+				// Handle any out of the box pprof handlers that don't get
+				// dealt with by the default index handler. See httppprof.init.
+				r.Get("/cmdline", httppprof.Cmdline)
+				r.Get("/profile", httppprof.Profile)
+				r.Get("/symbol", httppprof.Symbol)
+				r.Get("/trace", httppprof.Trace)
+
+				// Index will handle any standard and custom runtime/pprof
+				// profiles.
+				r.Get("/*", httppprof.Index)
+			})
+
+			r.Get("/metrics", promhttp.InstrumentMetricHandler(
+				options.PrometheusRegistry, promhttp.HandlerFor(options.PrometheusRegistry, promhttp.HandlerOpts{}),
+			).ServeHTTP)
 		})
 		// Manage OAuth2 applications that can use Coder as an OAuth2 provider.
 		r.Route("/oauth2-provider", func(r chi.Router) {
diff --git a/coderd/coderdtest/swaggerparser.go b/coderd/coderdtest/swaggerparser.go
index 4a0b6744a9082..cac6fdf7a9278 100644
--- a/coderd/coderdtest/swaggerparser.go
+++ b/coderd/coderdtest/swaggerparser.go
@@ -160,8 +160,9 @@ func VerifySwaggerDefinitions(t *testing.T, router chi.Router, swaggerComments [
 		t.Run(method+" "+route, func(t *testing.T) {
 			t.Parallel()
 
-			// This route is for compatibility purposes and is not documented.
-			if route == "/workspaceagents/me/metadata" {
+			// Wildcard routes break the swaggo parser, so we do not document
+			// them.
+			if strings.HasSuffix(route, "/*") {
 				return
 			}
 
diff --git a/coderd/debug.go b/coderd/debug.go
index 64c7c9e632d0a..4c0eff7f3366f 100644
--- a/coderd/debug.go
+++ b/coderd/debug.go
@@ -325,3 +325,57 @@ func loadDismissedHealthchecks(ctx context.Context, db database.Store, logger sl
 	}
 	return dismissedHealthchecks
 }
+
+// @Summary Debug pprof index
+// @ID debug-pprof-index
+// @Security CoderSessionToken
+// @Success 200
+// @Tags Debug
+// @Router /debug/pprof [get]
+// @x-apidocgen {"skip": true}
+func _debugPprofIndex(http.ResponseWriter, *http.Request) {} //nolint:unused
+
+// @Summary Debug pprof cmdline
+// @ID debug-pprof-cmdline
+// @Security CoderSessionToken
+// @Success 200
+// @Tags Debug
+// @Router /debug/pprof/cmdline [get]
+// @x-apidocgen {"skip": true}
+func _debugPprofCmdline(http.ResponseWriter, *http.Request) {} //nolint:unused
+
+// @Summary Debug pprof profile
+// @ID debug-pprof-profile
+// @Security CoderSessionToken
+// @Success 200
+// @Tags Debug
+// @Router /debug/pprof/profile [get]
+// @x-apidocgen {"skip": true}
+func _debugPprofProfile(http.ResponseWriter, *http.Request) {} //nolint:unused
+
+// @Summary Debug pprof symbol
+// @ID debug-pprof-symbol
+// @Security CoderSessionToken
+// @Success 200
+// @Tags Debug
+// @Router /debug/pprof/symbol [get]
+// @x-apidocgen {"skip": true}
+func _debugPprofSymbol(http.ResponseWriter, *http.Request) {} //nolint:unused
+
+// @Summary Debug pprof trace
+// @ID debug-pprof-trace
+// @Security CoderSessionToken
+// @Success 200
+// @Tags Debug
+// @Router /debug/pprof/trace [get]
+// @x-apidocgen {"skip": true}
+func _debugPprofTrace(http.ResponseWriter, *http.Request) {} //nolint:unused
+
+// @Summary Debug metrics
+// @ID debug-metrics
+// @Security CoderSessionToken
+// @Success 200
+// @Tags Debug
+// @Router /debug/metrics [get]
+// @x-apidocgen {"skip": true}
+func _debugMetrics(http.ResponseWriter, *http.Request) {} //nolint:unused

From ccf0b348726370bcf42adab28957d153b1c9eb4a Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Tue, 21 Oct 2025 08:48:21 +0400
Subject: [PATCH 185/298] docs: create WIP 10k scale doc (#20213)

Adds a new document for our ongoing efforts achieving 10k user scale. The content is caveated as work in progress, but represents what we have tested so far.

closes: https://github.com/coder/internal/issues/1025
---
 .../validated-architectures/10k-users.md      | 108 ++++++++++++++++++
 .../validated-architectures/index.md          |   2 +
 docs/manifest.json                            |   5 +
 3 files changed, 115 insertions(+)
 create mode 100644 docs/admin/infrastructure/validated-architectures/10k-users.md

diff --git a/docs/admin/infrastructure/validated-architectures/10k-users.md b/docs/admin/infrastructure/validated-architectures/10k-users.md
new file mode 100644
index 0000000000000..e6413711188f7
--- /dev/null
+++ b/docs/admin/infrastructure/validated-architectures/10k-users.md
@@ -0,0 +1,108 @@
+# Reference Architecture: up to 10,000 users
+
+> [!CAUTION]
+> This page is a work in progress.
+>
+> We are actively testing different load profiles for this user target and will be updating
+> recommendations. Use these recommendations as a starting point, but monitor your cluster resource
+> utilization and adjust.
+
+The 10,000 users architecture targets large-scale enterprises with development
+teams in multiple geographic regions.
+
+**Geographic Distribution**: For these tests we deploy on 3 cloud-managed Kubernetes clusters in
+the following regions:
+
+1. USA - Primary - Coderd collocated with the PostgreSQL database deployment.
+2. Europe - Workspace Proxies
+3. Asia - Workspace Proxies
+
+**High Availability**: Typically, such scale requires a fully-managed HA
+PostgreSQL service, and all Coder observability features enabled for operational
+purposes.
+
+**Observability**: Deploy monitoring solutions to gather Prometheus metrics and
+visualize them with Grafana to gain detailed insights into infrastructure and
+application behavior. This allows operators to respond quickly to incidents and
+continuously improve the reliability and performance of the platform.
+
+## Testing Methodology
+
+### Workspace Network Traffic
+
+6000 concurrent workspaces (2000 per region), each sending 10 kB/s application traffic.
+
+Test procedure:
+
+1. Create workspaces. This happens simultaneously in each region with 200 provisioners (and thus 600 concurrent builds).
+2. Wait 5 minutes to establish baselines for metrics.
+3. Generate 10 kB/s traffic to each workspace (originating within the same region & cluster).
+
+After, we examine the Coderd, Workspace Proxy, and Database metrics to look for issues.
+
+### API Request Traffic
+
+To be determined.
+
+## Hardware recommendations
+
+### Coderd
+
+These are deployed in the Primary region only.
+
+| vCPU Limit     | Memory Limit | Replicas | GCP Node Pool Machine Type |
+|----------------|--------------|----------|----------------------------|
+| 4 vCPU (4000m) | 12 GiB       | 10       | `c2d-standard-16`          |
+
+### Provisioners
+
+These are deployed in each of the 3 regions.
+
+| vCPU Limit      | Memory Limit | Replicas | GCP Node Pool Machine Type |
+|-----------------|--------------|----------|----------------------------|
+| 0.1 vCPU (100m) | 1 GiB        | 200      | `c2d-standard-16`          |
+
+**Footnotes**:
+
+- Each provisioner handles a single concurrent build, so this configuration implies 200 concurrent
+  workspace builds per region.
+- Provisioners are run as a separate Kubernetes Deployment from Coderd, although they may
+  share the same node pool.
+- Separate provisioners into different namespaces in favor of zero-trust or
+  multi-cloud deployments.
+
+### Workspace Proxies
+
+These are deployed in the non-Primary regions only.
+
+| vCPU Limit     | Memory Limit | Replicas | GCP Node Pool Machine Type |
+|----------------|--------------|----------|----------------------------|
+| 4 vCPU (4000m) | 12 GiB       | 10       | `c2d-standard-16`          |
+
+**Footnotes**:
+
+- Our testing implies this is somewhat overspecced for the loads we have tried. We are in process of revising these numbers.
+
+### Workspaces
+
+These numbers are for each of the 3 regions. We recommend that you use a separate node pool for user Workspaces.
+
+| Users       | Node capacity        | Replicas                      | GCP              | AWS          | Azure             |
+|-------------|----------------------|-------------------------------|------------------|--------------|-------------------|
+| Up to 3,000 | 8 vCPU, 32 GB memory | 256 nodes, 12 workspaces each | `t2d-standard-8` | `m5.2xlarge` | `Standard_D8s_v3` |
+
+**Footnotes**:
+
+- Assumed that a workspace user needs 2 GB memory to perform
+- Maximum number of Kubernetes workspace pods per node: 256
+- As workspace nodes can be distributed between regions, on-premises networks
+  and cloud areas, consider different namespaces in favor of zero-trust or
+  multi-cloud deployments.
+
+### Database nodes
+
+We conducted our test using the `db-custom-16-61440` tier on Google Cloud SQL.
+
+**Footnotes**:
+
+- This database tier was only just able to keep up with 600 concurrent builds in our tests.
diff --git a/docs/admin/infrastructure/validated-architectures/index.md b/docs/admin/infrastructure/validated-architectures/index.md
index 6bd18f7f3c132..59602f22bc47a 100644
--- a/docs/admin/infrastructure/validated-architectures/index.md
+++ b/docs/admin/infrastructure/validated-architectures/index.md
@@ -220,6 +220,8 @@ For sizing recommendations, see the below reference architectures:
 
 - [Up to 3,000 users](3k-users.md)
 
+- DRAFT: [Up to 10,000 users](10k-users.md)
+
 ### AWS Instance Types
 
 For production AWS deployments, we recommend using non-burstable instance types,
diff --git a/docs/manifest.json b/docs/manifest.json
index 023479cad22bb..5b01b6e9da995 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -391,6 +391,11 @@
 									"title": "Up to 3,000 Users",
 									"description": "Enterprise-scale architecture recommendations for Coder deployments that support up to 3,000 users",
 									"path": "./admin/infrastructure/validated-architectures/3k-users.md"
+								},
+								{
+									"title": "Up to 10,000 Users",
+									"description": "Enterprise-scale architecture recommendations for Coder deployments that support up to 10,000 users",
+									"path": "./admin/infrastructure/validated-architectures/10k-users.md"
 								}
 							]
 						},

From 77e8d2b8874c61751cbd983fb0544572b5c4a6c2 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Tue, 21 Oct 2025 08:58:04 +0400
Subject: [PATCH 186/298] feat: add configurable timeouts to exp scaletest
 dynamic-parameters (#20355)

Adds timeout configuration to `exp scaletest dynamic-parameters`

closes: https://github.com/coder/internal/issues/912
---
 cli/exp_scaletest_dynamicparameters.go | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/cli/exp_scaletest_dynamicparameters.go b/cli/exp_scaletest_dynamicparameters.go
index 2998be2e3fe8d..3c6922a8d4dd6 100644
--- a/cli/exp_scaletest_dynamicparameters.go
+++ b/cli/exp_scaletest_dynamicparameters.go
@@ -30,6 +30,8 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 		numEvals        int64
 		tracingFlags    = &scaletestTracingFlags{}
 		prometheusFlags = &scaletestPrometheusFlags{}
+		// This test requires unlimited concurrency
+		timeoutStrategy = &timeoutFlags{}
 	)
 	orgContext := NewOrganizationContext()
 	output := &scaletestOutputFlags{}
@@ -102,7 +104,10 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 				return xerrors.Errorf("setup dynamic parameters partitions: %w", err)
 			}
 
-			th := harness.NewTestHarness(harness.ConcurrentExecutionStrategy{}, harness.ConcurrentExecutionStrategy{})
+			th := harness.NewTestHarness(
+				timeoutStrategy.wrapStrategy(harness.ConcurrentExecutionStrategy{}),
+				// there is no cleanup since it's just a connection that we sever.
+				nil)
 
 			for i, part := range partitions {
 				for j := range part.ConcurrentEvaluations {
@@ -123,7 +128,9 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 				}
 			}
 
-			err = th.Run(ctx)
+			testCtx, testCancel := timeoutStrategy.toContext(ctx)
+			defer testCancel()
+			err = th.Run(testCtx)
 			if err != nil {
 				return xerrors.Errorf("run test harness: %w", err)
 			}
@@ -158,5 +165,6 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 	output.attach(&cmd.Options)
 	tracingFlags.attach(&cmd.Options)
 	prometheusFlags.attach(&cmd.Options)
+	timeoutStrategy.attach(&cmd.Options)
 	return cmd
 }

From 01ff28db116f94a45eff08b3ee338ecf50fe96eb Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Tue, 21 Oct 2025 12:35:28 +0100
Subject: [PATCH 187/298] chore: update to terraform-provider-coder v2.12.0
 (#20386)

Update the `terraform-provider-coder` to v2.12.0
---
 dogfood/coder/main.tf                   |  2 +-
 go.mod                                  |  9 ++++----
 go.sum                                  | 28 ++++++++++++-------------
 provisioner/terraform/provision_test.go |  2 +-
 4 files changed, 20 insertions(+), 21 deletions(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 15ae86199026e..0811b7b30d1da 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -2,7 +2,7 @@ terraform {
   required_providers {
     coder = {
       source  = "coder/coder"
-      version = "= 2.12.0-pre0"
+      version = ">= 2.12.0"
     }
     docker = {
       source  = "kreuzwerker/docker"
diff --git a/go.mod b/go.mod
index 7e0338253a7ac..630dba5a17280 100644
--- a/go.mod
+++ b/go.mod
@@ -101,7 +101,7 @@ require (
 	github.com/coder/quartz v0.2.1
 	github.com/coder/retry v1.5.1
 	github.com/coder/serpent v0.10.0
-	github.com/coder/terraform-provider-coder/v2 v2.12.0-pre0
+	github.com/coder/terraform-provider-coder/v2 v2.12.0
 	github.com/coder/websocket v1.8.13
 	github.com/coder/wgtunnel v0.1.13-0.20240522110300-ade90dfb2da0
 	github.com/coreos/go-oidc/v3 v3.16.0
@@ -197,7 +197,7 @@ require (
 	go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516
 	golang.org/x/crypto v0.42.0
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621
-	golang.org/x/mod v0.28.0
+	golang.org/x/mod v0.29.0
 	golang.org/x/net v0.45.0
 	golang.org/x/oauth2 v0.31.0
 	golang.org/x/sync v0.17.0
@@ -338,9 +338,9 @@ require (
 	github.com/hashicorp/hcl v1.0.1-vault-7 // indirect
 	github.com/hashicorp/hcl/v2 v2.24.0
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-plugin-go v0.27.0 // indirect
+	github.com/hashicorp/terraform-plugin-go v0.29.0 // indirect
 	github.com/hashicorp/terraform-plugin-log v0.9.0 // indirect
-	github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 // indirect
+	github.com/hashicorp/terraform-plugin-sdk/v2 v2.38.1 // indirect
 	github.com/hdevalence/ed25519consensus v0.1.0 // indirect
 	github.com/illarion/gonotify v1.0.1 // indirect
 	github.com/insomniacslk/dhcp v0.0.0-20231206064809-8c70d406f6d2 // indirect
@@ -379,7 +379,6 @@ require (
 	github.com/muesli/reflow v0.3.0 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/niklasfasching/go-org v1.9.1 // indirect
-	github.com/oklog/run v1.1.0 // indirect
 	github.com/opencontainers/go-digest v1.0.0 // indirect
 	github.com/opencontainers/image-spec v1.1.1 // indirect
 	github.com/opencontainers/runc v1.2.3 // indirect
diff --git a/go.sum b/go.sum
index 2dbaf7d2e0747..403c68703f9eb 100644
--- a/go.sum
+++ b/go.sum
@@ -948,8 +948,8 @@ github.com/coder/tailscale v1.1.1-0.20250829055706-6eafe0f9199e h1:9RKGKzGLHtTvV
 github.com/coder/tailscale v1.1.1-0.20250829055706-6eafe0f9199e/go.mod h1:jU9T1vEs+DOs8NtGp1F2PT0/TOGVwtg/JCCKYRgvMOs=
 github.com/coder/terraform-config-inspect v0.0.0-20250107175719-6d06d90c630e h1:JNLPDi2P73laR1oAclY6jWzAbucf70ASAvf5mh2cME0=
 github.com/coder/terraform-config-inspect v0.0.0-20250107175719-6d06d90c630e/go.mod h1:Gz/z9Hbn+4KSp8A2FBtNszfLSdT2Tn/uAKGuVqqWmDI=
-github.com/coder/terraform-provider-coder/v2 v2.12.0-pre0 h1:Jcp/NCDfrYtsVlXOr4pEZ9EBtTbKTA/HeToIOI0nx4k=
-github.com/coder/terraform-provider-coder/v2 v2.12.0-pre0/go.mod h1:q0cAdlM1cafFGQ8Vug5kwU+34S+wtJsqylxTjVXX+rw=
+github.com/coder/terraform-provider-coder/v2 v2.12.0 h1:guxDoZdBRfZqAgVlsJ+TLvV2uIBQ4RelsRpSPOT84tk=
+github.com/coder/terraform-provider-coder/v2 v2.12.0/go.mod h1:4LVPWatHaTAdQS1v5A0pVn3g8XkNKkQ/xh+U2oXr/o0=
 github.com/coder/trivy v0.0.0-20250807211036-0bb0acd620a8 h1:VYB/6cIIKsVkwXOAWbqpj4Ux+WwF/XTnRyvHcwfHZ7A=
 github.com/coder/trivy v0.0.0-20250807211036-0bb0acd620a8/go.mod h1:O73tP+UvJlI2GQZD060Jt0sf+6alKcGAgORh6sgB0+M=
 github.com/coder/websocket v1.8.13 h1:f3QZdXy7uGVz+4uCJy2nTZyM0yTBj8yANEHhqlXZ9FE=
@@ -1377,8 +1377,8 @@ github.com/hashicorp/go-hclog v1.6.3 h1:Qr2kF+eVWjTiYmU7Y31tYlP1h0q/X3Nl3tPGdaB1
 github.com/hashicorp/go-hclog v1.6.3/go.mod h1:W4Qnvbt70Wk/zYJryRzDRU/4r0kIg0PVHBcfoyhpF5M=
 github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
-github.com/hashicorp/go-plugin v1.6.3 h1:xgHB+ZUSYeuJi96WtxEjzi23uh7YQpznjGh0U0UUrwg=
-github.com/hashicorp/go-plugin v1.6.3/go.mod h1:MRobyh+Wc/nYy1V4KAXUiYfzxoYhs7V1mlH1Z7iY2h0=
+github.com/hashicorp/go-plugin v1.7.0 h1:YghfQH/0QmPNc/AZMTFE3ac8fipZyZECHdDPshfk+mA=
+github.com/hashicorp/go-plugin v1.7.0/go.mod h1:BExt6KEaIYx804z8k4gRzRLEvxKVb+kn0NMcihqOqb8=
 github.com/hashicorp/go-reap v0.0.0-20170704170343-bf58d8a43e7b h1:3GrpnZQBxcMj1gCXQLelfjCT1D5MPGTuGMKHVzSIH6A=
 github.com/hashicorp/go-reap v0.0.0-20170704170343-bf58d8a43e7b/go.mod h1:qIFzeFcJU3OIFk/7JreWXcUjFmcCaeHTH9KoNyHYVCs=
 github.com/hashicorp/go-retryablehttp v0.7.8 h1:ylXZWnqa7Lhqpk0L1P1LzDtGcCR0rPVUrx/c8Unxc48=
@@ -1404,18 +1404,18 @@ github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQx
 github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.23.0 h1:MUiBM1s0CNlRFsCLJuM5wXZrzA3MnPYEsiXmzATMW/I=
-github.com/hashicorp/terraform-exec v0.23.0/go.mod h1:mA+qnx1R8eePycfwKkCRk3Wy65mwInvlpAeOwmA7vlY=
+github.com/hashicorp/terraform-exec v0.23.1 h1:diK5NSSDXDKqHEOIQefBMu9ny+FhzwlwV0xgUTB7VTo=
+github.com/hashicorp/terraform-exec v0.23.1/go.mod h1:e4ZEg9BJDRaSalGm2z8vvrPONt0XWG0/tXpmzYTf+dM=
 github.com/hashicorp/terraform-json v0.27.2 h1:BwGuzM6iUPqf9JYM/Z4AF1OJ5VVJEEzoKST/tRDBJKU=
 github.com/hashicorp/terraform-json v0.27.2/go.mod h1:GzPLJ1PLdUG5xL6xn1OXWIjteQRT2CNT9o/6A9mi9hE=
-github.com/hashicorp/terraform-plugin-go v0.27.0 h1:ujykws/fWIdsi6oTUT5Or4ukvEan4aN9lY+LOxVP8EE=
-github.com/hashicorp/terraform-plugin-go v0.27.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o=
+github.com/hashicorp/terraform-plugin-go v0.29.0 h1:1nXKl/nSpaYIUBU1IG/EsDOX0vv+9JxAltQyDMpq5mU=
+github.com/hashicorp/terraform-plugin-go v0.29.0/go.mod h1:vYZbIyvxyy0FWSmDHChCqKvI40cFTDGSb3D8D70i9GM=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
 github.com/hashicorp/terraform-plugin-log v0.9.0/go.mod h1:rKL8egZQ/eXSyDqzLUuwUYLVdlYeamldAHSxjUFADow=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 h1:NFPMacTrY/IdcIcnUB+7hsore1ZaRWU9cnB6jFoBnIM=
-github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0/go.mod h1:QYmYnLfsosrxjCnGY1p9c7Zj6n9thnEE+7RObeYs3fA=
-github.com/hashicorp/terraform-registry-address v0.2.5 h1:2GTftHqmUhVOeuu9CW3kwDkRe4pcBDq0uuK5VJngU1M=
-github.com/hashicorp/terraform-registry-address v0.2.5/go.mod h1:PpzXWINwB5kuVS5CA7m1+eO2f1jKb5ZDIxrOPfpnGkg=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.38.1 h1:mlAq/OrMlg04IuJT7NpefI1wwtdpWudnEmjuQs04t/4=
+github.com/hashicorp/terraform-plugin-sdk/v2 v2.38.1/go.mod h1:GQhpKVvvuwzD79e8/NZ+xzj+ZpWovdPAe8nfV/skwNU=
+github.com/hashicorp/terraform-registry-address v0.4.0 h1:S1yCGomj30Sao4l5BMPjTGZmCNzuv7/GDTDX99E9gTk=
+github.com/hashicorp/terraform-registry-address v0.4.0/go.mod h1:LRS1Ay0+mAiRkUyltGT+UHWkIqTFvigGn/LbMshfflE=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
 github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
 github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
@@ -2114,8 +2114,8 @@ golang.org/x/mod v0.9.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.12.0/go.mod h1:iBbtSCu2XBx23ZKBPSOrRkjjQPZFPuis4dIYUhu/chs=
 golang.org/x/mod v0.15.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
 golang.org/x/mod v0.17.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
-golang.org/x/mod v0.28.0 h1:gQBtGhjxykdjY9YhZpSlZIsbnaE2+PgjfLWUQTnoZ1U=
-golang.org/x/mod v0.28.0/go.mod h1:yfB/L0NOf/kmEbXjzCPOx1iK1fRutOydrCMsqRhEBxI=
+golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA=
+golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w=
 golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
 golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
diff --git a/provisioner/terraform/provision_test.go b/provisioner/terraform/provision_test.go
index bf85404265c98..450dd04b061a6 100644
--- a/provisioner/terraform/provision_test.go
+++ b/provisioner/terraform/provision_test.go
@@ -1144,7 +1144,7 @@ func TestProvision(t *testing.T) {
 					required_providers {
 						coder = {
 							source  = "coder/coder"
-							version = "= 2.12.0-pre0"
+							version = ">= 2.12.0"
 						}
 					}
 				}

From ea261a1f7cf209512af9ae69e757ed18687574ab Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Tue, 21 Oct 2025 22:50:00 +1100
Subject: [PATCH 188/298] chore: add offset-based pagination support to
 aibridge list endpoint (#20393)

Necessary for the frontend to be able to paginate easily. Cursor
pagination is good for fetching all events, but doesn't play very well
when a pagination component gets involved.

Adds support for `?offset=x` to the existing endpoint. The cursor-based
pagination (`?after_id=x`) is still supported. The two pagination modes
are mutually exclusive, and are documented as such. If both are
supplied, the request will be rejected.

Also adds a `total` property to the response that contains the full
count of items matching the filter. We already have indices in place so
I don't think this will impact performance (or we can revisit it before
GA).
---
 coderd/apidoc/docs.go                     |  11 ++-
 coderd/apidoc/swagger.json                |  11 ++-
 coderd/database/dbauthz/dbauthz.go        |  15 ++++
 coderd/database/dbauthz/dbauthz_test.go   |  14 +++
 coderd/database/dbmetrics/querymetrics.go |  14 +++
 coderd/database/dbmock/dbmock.go          |  30 +++++++
 coderd/database/modelqueries.go           |  41 +++++++++
 coderd/database/querier.go                |   1 +
 coderd/database/queries.sql.go            |  60 ++++++++++++-
 coderd/database/queries/aibridge.sql      |  35 ++++++++
 coderd/searchquery/search.go              |   4 +-
 codersdk/aibridge.go                      |   1 +
 docs/reference/api/aibridge.md            |   6 +-
 docs/reference/api/schemas.md             |   4 +-
 enterprise/coderd/aibridge.go             |  28 ++++--
 enterprise/coderd/aibridge_test.go        | 100 ++++++++++++++--------
 site/src/api/typesGenerated.ts            |   1 +
 17 files changed, 328 insertions(+), 48 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 95413dff67d98..8046cab6c5464 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -115,9 +115,15 @@ const docTemplate = `{
                     },
                     {
                         "type": "string",
-                        "description": "Cursor pagination after ID",
+                        "description": "Cursor pagination after ID (cannot be used with offset)",
                         "name": "after_id",
                         "in": "query"
+                    },
+                    {
+                        "type": "integer",
+                        "description": "Offset pagination (cannot be used with after_id)",
+                        "name": "offset",
+                        "in": "query"
                     }
                 ],
                 "responses": {
@@ -11727,6 +11733,9 @@ const docTemplate = `{
                     "items": {
                         "$ref": "#/definitions/codersdk.AIBridgeInterception"
                     }
+                },
+                "total": {
+                    "type": "integer"
                 }
             }
         },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index a3f57d4fa4d12..d5b625a2e631b 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -91,9 +91,15 @@
 					},
 					{
 						"type": "string",
-						"description": "Cursor pagination after ID",
+						"description": "Cursor pagination after ID (cannot be used with offset)",
 						"name": "after_id",
 						"in": "query"
+					},
+					{
+						"type": "integer",
+						"description": "Offset pagination (cannot be used with after_id)",
+						"name": "offset",
+						"in": "query"
 					}
 				],
 				"responses": {
@@ -10427,6 +10433,9 @@
 					"items": {
 						"$ref": "#/definitions/codersdk.AIBridgeInterception"
 					}
+				},
+				"total": {
+					"type": "integer"
 				}
 			}
 		},
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index e7899eee30a7c..ccd6151e88bbd 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -1436,6 +1436,14 @@ func (q *querier) CleanTailnetTunnels(ctx context.Context) error {
 	return q.db.CleanTailnetTunnels(ctx)
 }
 
+func (q *querier) CountAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams) (int64, error) {
+	prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAibridgeInterception.Type)
+	if err != nil {
+		return 0, xerrors.Errorf("(dev error) prepare sql filter: %w", err)
+	}
+	return q.db.CountAuthorizedAIBridgeInterceptions(ctx, arg, prep)
+}
+
 func (q *querier) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
 	// Shortcut if the user is an owner. The SQL filter is noticeable,
 	// and this is an easy win for owners. Which is the common case.
@@ -5868,3 +5876,10 @@ func (q *querier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg d
 	// database.Store interface, so dbauthz needs to implement it.
 	return q.ListAIBridgeInterceptions(ctx, arg)
 }
+
+func (q *querier) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams, _ rbac.PreparedAuthorized) (int64, error) {
+	// TODO: Delete this function, all CountAIBridgeInterceptions should be authorized. For now just call CountAIBridgeInterceptions on the authz querier.
+	// This cannot be deleted for now because it's included in the
+	// database.Store interface, so dbauthz needs to implement it.
+	return q.CountAIBridgeInterceptions(ctx, arg)
+}
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 01e19237295ee..1137aa250d789 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -4549,6 +4549,20 @@ func (s *MethodTestSuite) TestAIBridge() {
 		check.Args(params, emptyPreparedAuthorized{}).Asserts()
 	}))
 
+	s.Run("CountAIBridgeInterceptions", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		params := database.CountAIBridgeInterceptionsParams{}
+		db.EXPECT().CountAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return(int64(0), nil).AnyTimes()
+		// No asserts here because SQLFilter.
+		check.Args(params).Asserts()
+	}))
+
+	s.Run("CountAuthorizedAIBridgeInterceptions", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		params := database.CountAIBridgeInterceptionsParams{}
+		db.EXPECT().CountAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return(int64(0), nil).AnyTimes()
+		// No asserts here because SQLFilter.
+		check.Args(params, emptyPreparedAuthorized{}).Asserts()
+	}))
+
 	s.Run("ListAIBridgeTokenUsagesByInterceptionIDs", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		ids := []uuid.UUID{{1}}
 		db.EXPECT().ListAIBridgeTokenUsagesByInterceptionIDs(gomock.Any(), ids).Return([]database.AIBridgeTokenUsage{}, nil).AnyTimes()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index d5995222c3d4d..cdcc675c918ae 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -187,6 +187,13 @@ func (m queryMetricsStore) CleanTailnetTunnels(ctx context.Context) error {
 	return r0
 }
 
+func (m queryMetricsStore) CountAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams) (int64, error) {
+	start := time.Now()
+	r0, r1 := m.s.CountAIBridgeInterceptions(ctx, arg)
+	m.queryLatencies.WithLabelValues("CountAIBridgeInterceptions").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
 	start := time.Now()
 	r0, r1 := m.s.CountAuditLogs(ctx, arg)
@@ -3721,3 +3728,10 @@ func (m queryMetricsStore) ListAuthorizedAIBridgeInterceptions(ctx context.Conte
 	m.queryLatencies.WithLabelValues("ListAuthorizedAIBridgeInterceptions").Observe(time.Since(start).Seconds())
 	return r0, r1
 }
+
+func (m queryMetricsStore) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error) {
+	start := time.Now()
+	r0, r1 := m.s.CountAuthorizedAIBridgeInterceptions(ctx, arg, prepared)
+	m.queryLatencies.WithLabelValues("CountAuthorizedAIBridgeInterceptions").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 51a06fa35e00c..89099b6e7142f 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -248,6 +248,21 @@ func (mr *MockStoreMockRecorder) CleanTailnetTunnels(ctx any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CleanTailnetTunnels", reflect.TypeOf((*MockStore)(nil).CleanTailnetTunnels), ctx)
 }
 
+// CountAIBridgeInterceptions mocks base method.
+func (m *MockStore) CountAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAIBridgeInterceptions", ctx, arg)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAIBridgeInterceptions indicates an expected call of CountAIBridgeInterceptions.
+func (mr *MockStoreMockRecorder) CountAIBridgeInterceptions(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAIBridgeInterceptions", reflect.TypeOf((*MockStore)(nil).CountAIBridgeInterceptions), ctx, arg)
+}
+
 // CountAuditLogs mocks base method.
 func (m *MockStore) CountAuditLogs(ctx context.Context, arg database.CountAuditLogsParams) (int64, error) {
 	m.ctrl.T.Helper()
@@ -263,6 +278,21 @@ func (mr *MockStoreMockRecorder) CountAuditLogs(ctx, arg any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAuditLogs", reflect.TypeOf((*MockStore)(nil).CountAuditLogs), ctx, arg)
 }
 
+// CountAuthorizedAIBridgeInterceptions mocks base method.
+func (m *MockStore) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountAuthorizedAIBridgeInterceptions", ctx, arg, prepared)
+	ret0, _ := ret[0].(int64)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountAuthorizedAIBridgeInterceptions indicates an expected call of CountAuthorizedAIBridgeInterceptions.
+func (mr *MockStoreMockRecorder) CountAuthorizedAIBridgeInterceptions(ctx, arg, prepared any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountAuthorizedAIBridgeInterceptions", reflect.TypeOf((*MockStore)(nil).CountAuthorizedAIBridgeInterceptions), ctx, arg, prepared)
+}
+
 // CountAuthorizedAuditLogs mocks base method.
 func (m *MockStore) CountAuthorizedAuditLogs(ctx context.Context, arg database.CountAuditLogsParams, prepared rbac.PreparedAuthorized) (int64, error) {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
index 8e2d74fb8ffec..654dfb8b37b1d 100644
--- a/coderd/database/modelqueries.go
+++ b/coderd/database/modelqueries.go
@@ -764,6 +764,7 @@ func (q *sqlQuerier) CountAuthorizedConnectionLogs(ctx context.Context, arg Coun
 
 type aibridgeQuerier interface {
 	ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error)
+	CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error)
 }
 
 func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error) {
@@ -786,6 +787,7 @@ func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, ar
 		arg.Provider,
 		arg.Model,
 		arg.AfterID,
+		arg.Offset,
 		arg.Limit,
 	)
 	if err != nil {
@@ -816,6 +818,45 @@ func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, ar
 	return items, nil
 }
 
+func (q *sqlQuerier) CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error) {
+	authorizedFilter, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
+		VariableConverter: regosql.AIBridgeInterceptionConverter(),
+	})
+	if err != nil {
+		return 0, xerrors.Errorf("compile authorized filter: %w", err)
+	}
+	filtered, err := insertAuthorizedFilter(countAIBridgeInterceptions, fmt.Sprintf(" AND %s", authorizedFilter))
+	if err != nil {
+		return 0, xerrors.Errorf("insert authorized filter: %w", err)
+	}
+
+	query := fmt.Sprintf("-- name: CountAuthorizedAIBridgeInterceptions :one\n%s", filtered)
+	rows, err := q.db.QueryContext(ctx, query,
+		arg.StartedAfter,
+		arg.StartedBefore,
+		arg.InitiatorID,
+		arg.Provider,
+		arg.Model,
+	)
+	if err != nil {
+		return 0, err
+	}
+	defer rows.Close()
+	var count int64
+	for rows.Next() {
+		if err := rows.Scan(&count); err != nil {
+			return 0, err
+		}
+	}
+	if err := rows.Close(); err != nil {
+		return 0, err
+	}
+	if err := rows.Err(); err != nil {
+		return 0, err
+	}
+	return count, nil
+}
+
 func insertAuthorizedFilter(query string, replaceWith string) (string, error) {
 	if !strings.Contains(query, authorizedQueryPlaceholder) {
 		return "", xerrors.Errorf("query does not contain authorized replace string, this is not an authorized query")
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 3ea3c912f8ccf..3e2d655f44495 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -65,6 +65,7 @@ type sqlcQuerier interface {
 	CleanTailnetCoordinators(ctx context.Context) error
 	CleanTailnetLostPeers(ctx context.Context) error
 	CleanTailnetTunnels(ctx context.Context) error
+	CountAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams) (int64, error)
 	CountAuditLogs(ctx context.Context, arg CountAuditLogsParams) (int64, error)
 	CountConnectionLogs(ctx context.Context, arg CountConnectionLogsParams) (int64, error)
 	// CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by preset ID and transition.
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index f62066954daf8..c0fd6eb64dc6d 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -111,6 +111,61 @@ func (q *sqlQuerier) ActivityBumpWorkspace(ctx context.Context, arg ActivityBump
 	return err
 }
 
+const countAIBridgeInterceptions = `-- name: CountAIBridgeInterceptions :one
+SELECT
+	COUNT(*)
+FROM
+	aibridge_interceptions
+WHERE
+	-- Filter by time frame
+	CASE
+		WHEN $1::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at >= $1::timestamptz
+		ELSE true
+	END
+	AND CASE
+		WHEN $2::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at <= $2::timestamptz
+		ELSE true
+	END
+	-- Filter initiator_id
+	AND CASE
+		WHEN $3::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN aibridge_interceptions.initiator_id = $3::uuid
+		ELSE true
+	END
+	-- Filter provider
+	AND CASE
+		WHEN $4::text != '' THEN aibridge_interceptions.provider = $4::text
+		ELSE true
+	END
+	-- Filter model
+	AND CASE
+		WHEN $5::text != '' THEN aibridge_interceptions.model = $5::text
+		ELSE true
+	END
+	-- Authorize Filter clause will be injected below in ListAuthorizedAIBridgeInterceptions
+	-- @authorize_filter
+`
+
+type CountAIBridgeInterceptionsParams struct {
+	StartedAfter  time.Time `db:"started_after" json:"started_after"`
+	StartedBefore time.Time `db:"started_before" json:"started_before"`
+	InitiatorID   uuid.UUID `db:"initiator_id" json:"initiator_id"`
+	Provider      string    `db:"provider" json:"provider"`
+	Model         string    `db:"model" json:"model"`
+}
+
+func (q *sqlQuerier) CountAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams) (int64, error) {
+	row := q.db.QueryRowContext(ctx, countAIBridgeInterceptions,
+		arg.StartedAfter,
+		arg.StartedBefore,
+		arg.InitiatorID,
+		arg.Provider,
+		arg.Model,
+	)
+	var count int64
+	err := row.Scan(&count)
+	return count, err
+}
+
 const getAIBridgeInterceptionByID = `-- name: GetAIBridgeInterceptionByID :one
 SELECT
 	id, initiator_id, provider, model, started_at, metadata
@@ -522,7 +577,8 @@ WHERE
 ORDER BY
 	aibridge_interceptions.started_at DESC,
 	aibridge_interceptions.id DESC
-LIMIT COALESCE(NULLIF($7::integer, 0), 100)
+LIMIT COALESCE(NULLIF($8::integer, 0), 100)
+OFFSET $7
 `
 
 type ListAIBridgeInterceptionsParams struct {
@@ -532,6 +588,7 @@ type ListAIBridgeInterceptionsParams struct {
 	Provider      string    `db:"provider" json:"provider"`
 	Model         string    `db:"model" json:"model"`
 	AfterID       uuid.UUID `db:"after_id" json:"after_id"`
+	Offset        int32     `db:"offset_" json:"offset_"`
 	Limit         int32     `db:"limit_" json:"limit_"`
 }
 
@@ -543,6 +600,7 @@ func (q *sqlQuerier) ListAIBridgeInterceptions(ctx context.Context, arg ListAIBr
 		arg.Provider,
 		arg.Model,
 		arg.AfterID,
+		arg.Offset,
 		arg.Limit,
 	)
 	if err != nil {
diff --git a/coderd/database/queries/aibridge.sql b/coderd/database/queries/aibridge.sql
index 79d41defd54af..32e0246447ce7 100644
--- a/coderd/database/queries/aibridge.sql
+++ b/coderd/database/queries/aibridge.sql
@@ -75,6 +75,40 @@ ORDER BY
 	created_at ASC,
 	id ASC;
 
+-- name: CountAIBridgeInterceptions :one
+SELECT
+	COUNT(*)
+FROM
+	aibridge_interceptions
+WHERE
+	-- Filter by time frame
+	CASE
+		WHEN @started_after::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at >= @started_after::timestamptz
+		ELSE true
+	END
+	AND CASE
+		WHEN @started_before::timestamptz != '0001-01-01 00:00:00+00'::timestamptz THEN aibridge_interceptions.started_at <= @started_before::timestamptz
+		ELSE true
+	END
+	-- Filter initiator_id
+	AND CASE
+		WHEN @initiator_id::uuid != '00000000-0000-0000-0000-000000000000'::uuid THEN aibridge_interceptions.initiator_id = @initiator_id::uuid
+		ELSE true
+	END
+	-- Filter provider
+	AND CASE
+		WHEN @provider::text != '' THEN aibridge_interceptions.provider = @provider::text
+		ELSE true
+	END
+	-- Filter model
+	AND CASE
+		WHEN @model::text != '' THEN aibridge_interceptions.model = @model::text
+		ELSE true
+	END
+	-- Authorize Filter clause will be injected below in ListAuthorizedAIBridgeInterceptions
+	-- @authorize_filter
+;
+
 -- name: ListAIBridgeInterceptions :many
 SELECT
 	*
@@ -127,6 +161,7 @@ ORDER BY
 	aibridge_interceptions.started_at DESC,
 	aibridge_interceptions.id DESC
 LIMIT COALESCE(NULLIF(@limit_::integer, 0), 100)
+OFFSET @offset_
 ;
 
 -- name: ListAIBridgeTokenUsagesByInterceptionIDs :many
diff --git a/coderd/searchquery/search.go b/coderd/searchquery/search.go
index d07203a0293c0..3b34edacef28f 100644
--- a/coderd/searchquery/search.go
+++ b/coderd/searchquery/search.go
@@ -355,6 +355,8 @@ func AIBridgeInterceptions(ctx context.Context, db database.Store, query string,
 		AfterID: page.AfterID,
 		// #nosec G115 - Safe conversion for pagination limit which is expected to be within int32 range
 		Limit: int32(page.Limit),
+		// #nosec G115 - Safe conversion for pagination offset which is expected to be within int32 range
+		Offset: int32(page.Offset),
 	}
 
 	if query == "" {
@@ -363,7 +365,7 @@ func AIBridgeInterceptions(ctx context.Context, db database.Store, query string,
 
 	values, errors := searchTerms(query, func(term string, values url.Values) error {
 		// Default to the initiating user
-		values.Add("user", term)
+		values.Add("initiator", term)
 		return nil
 	})
 	if len(errors) > 0 {
diff --git a/codersdk/aibridge.go b/codersdk/aibridge.go
index 3101dab383ad1..05f1e1a6fc936 100644
--- a/codersdk/aibridge.go
+++ b/codersdk/aibridge.go
@@ -56,6 +56,7 @@ type AIBridgeToolUsage struct {
 }
 
 type AIBridgeListInterceptionsResponse struct {
+	Total   int64                  `json:"total"`
 	Results []AIBridgeInterception `json:"results"`
 }
 
diff --git a/docs/reference/api/aibridge.md b/docs/reference/api/aibridge.md
index 6c929a3fa9383..35af663993f66 100644
--- a/docs/reference/api/aibridge.md
+++ b/docs/reference/api/aibridge.md
@@ -19,7 +19,8 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/intercepti
 |------------|-------|---------|----------|------------------------------------------------------------------------------------------------------------------------|
 | `q`        | query | string  | false    | Search query in the format `key:value`. Available keys are: initiator, provider, model, started_after, started_before. |
 | `limit`    | query | integer | false    | Page limit                                                                                                             |
-| `after_id` | query | string  | false    | Cursor pagination after ID                                                                                             |
+| `after_id` | query | string  | false    | Cursor pagination after ID (cannot be used with offset)                                                                |
+| `offset`   | query | integer | false    | Offset pagination (cannot be used with after_id)                                                                       |
 
 ### Example responses
 
@@ -83,7 +84,8 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/intercepti
         }
       ]
     }
-  ]
+  ],
+  "total": 0
 }
 ```
 
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 440f2dca0a59a..91a894528ea02 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -566,7 +566,8 @@
         }
       ]
     }
-  ]
+  ],
+  "total": 0
 }
 ```
 
@@ -575,6 +576,7 @@
 | Name      | Type                                                                    | Required | Restrictions | Description |
 |-----------|-------------------------------------------------------------------------|----------|--------------|-------------|
 | `results` | array of [codersdk.AIBridgeInterception](#codersdkaibridgeinterception) | false    |              |             |
+| `total`   | integer                                                                 | false    |              |             |
 
 ## codersdk.AIBridgeOpenAIConfig
 
diff --git a/enterprise/coderd/aibridge.go b/enterprise/coderd/aibridge.go
index 2917603c235d6..878e8ac74163e 100644
--- a/enterprise/coderd/aibridge.go
+++ b/enterprise/coderd/aibridge.go
@@ -33,7 +33,8 @@ const (
 // @Tags AIBridge
 // @Param q query string false "Search query in the format `key:value`. Available keys are: initiator, provider, model, started_after, started_before."
 // @Param limit query int false "Page limit"
-// @Param after_id query string false "Cursor pagination after ID"
+// @Param after_id query string false "Cursor pagination after ID (cannot be used with offset)"
+// @Param offset query int false "Offset pagination (cannot be used with after_id)"
 // @Success 200 {object} codersdk.AIBridgeListInterceptionsResponse
 // @Router /api/experimental/aibridge/interceptions [get]
 func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Request) {
@@ -44,10 +45,10 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 	if !ok {
 		return
 	}
-	if page.Offset != 0 {
+	if page.AfterID != uuid.Nil && page.Offset != 0 {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: "Offset pagination is not supported.",
-			Detail:  "Offset pagination is not supported for AIBridge interceptions. Use cursor pagination instead with after_id.",
+			Message: "Query parameters have invalid values.",
+			Detail:  "Cannot use both after_id and offset pagination in the same request.",
 		})
 		return
 	}
@@ -72,7 +73,10 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 		return
 	}
 
-	var rows []database.AIBridgeInterception
+	var (
+		count int64
+		rows  []database.AIBridgeInterception
+	)
 	err := api.Database.InTx(func(db database.Store) error {
 		// Ensure the after_id interception exists and is visible to the user.
 		if page.AfterID != uuid.Nil {
@@ -83,6 +87,19 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 		}
 
 		var err error
+		// Get the full count of authorized interceptions matching the filter
+		// for pagination purposes.
+		count, err = db.CountAIBridgeInterceptions(ctx, database.CountAIBridgeInterceptionsParams{
+			StartedAfter:  filter.StartedAfter,
+			StartedBefore: filter.StartedBefore,
+			InitiatorID:   filter.InitiatorID,
+			Provider:      filter.Provider,
+			Model:         filter.Model,
+		})
+		if err != nil {
+			return xerrors.Errorf("count authorized aibridge interceptions: %w", err)
+		}
+
 		// This only returns authorized interceptions (when using dbauthz).
 		rows, err = db.ListAIBridgeInterceptions(ctx, filter)
 		if err != nil {
@@ -110,6 +127,7 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 	}
 
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.AIBridgeListInterceptionsResponse{
+		Total:   count,
 		Results: items,
 	})
 }
diff --git a/enterprise/coderd/aibridge_test.go b/enterprise/coderd/aibridge_test.go
index 8babf2324deeb..4d8cac139de0c 100644
--- a/enterprise/coderd/aibridge_test.go
+++ b/enterprise/coderd/aibridge_test.go
@@ -196,42 +196,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			allInterceptionIDs = append(allInterceptionIDs, interception.ID)
 		}
 
-		// Get all interceptions one by one from the API using cursor
-		// pagination.
-		getAllInterceptionsOneByOne := func() []uuid.UUID {
-			interceptionIDs := []uuid.UUID{}
-			for {
-				afterID := uuid.Nil
-				if len(interceptionIDs) > 0 {
-					afterID = interceptionIDs[len(interceptionIDs)-1]
-				}
-				res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
-					Pagination: codersdk.Pagination{
-						AfterID: afterID,
-						Limit:   1,
-					},
-				})
-				require.NoError(t, err)
-				if len(res.Results) == 0 {
-					break
-				}
-				require.Len(t, res.Results, 1)
-				interceptionIDs = append(interceptionIDs, res.Results[0].ID)
-			}
-			return interceptionIDs
-		}
-
-		// First attempt: get all interceptions one by one.
-		gotInterceptionIDs1 := getAllInterceptionsOneByOne()
-		// We should have all of the interceptions returned:
-		require.ElementsMatch(t, allInterceptionIDs, gotInterceptionIDs1)
-
-		// Second attempt: get all interceptions one by one again.
-		gotInterceptionIDs2 := getAllInterceptionsOneByOne()
-		// They should be returned in the exact same order.
-		require.Equal(t, gotInterceptionIDs1, gotInterceptionIDs2)
-
-		// Try to get an invalid limit.
+		// Try to fetch with an invalid limit.
 		res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
 			Pagination: codersdk.Pagination{
 				Limit: 1001,
@@ -241,6 +206,66 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		require.ErrorAs(t, err, &sdkErr)
 		require.Contains(t, sdkErr.Message, "Invalid pagination limit value.")
 		require.Empty(t, res.Results)
+
+		// Try to fetch with both after_id and offset pagination.
+		res, err = experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
+			Pagination: codersdk.Pagination{
+				AfterID: allInterceptionIDs[0],
+				Offset:  1,
+			},
+		})
+		require.ErrorAs(t, err, &sdkErr)
+		require.Contains(t, sdkErr.Message, "Query parameters have invalid values")
+		require.Contains(t, sdkErr.Detail, "Cannot use both after_id and offset pagination in the same request.")
+
+		// Iterate over all interceptions using both cursor and offset
+		// pagination modes.
+		for _, paginationMode := range []string{"after_id", "offset"} {
+			t.Run(paginationMode, func(t *testing.T) {
+				t.Parallel()
+
+				ctx := testutil.Context(t, testutil.WaitLong)
+
+				// Get all interceptions one by one using the given pagination
+				// mode.
+				getAllInterceptionsOneByOne := func() []uuid.UUID {
+					interceptionIDs := []uuid.UUID{}
+					for {
+						pagination := codersdk.Pagination{
+							Limit: 1,
+						}
+						if paginationMode == "after_id" {
+							if len(interceptionIDs) > 0 {
+								pagination.AfterID = interceptionIDs[len(interceptionIDs)-1]
+							}
+						} else {
+							pagination.Offset = len(interceptionIDs)
+						}
+						res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
+							Pagination: pagination,
+						})
+						require.NoError(t, err)
+						if len(res.Results) == 0 {
+							break
+						}
+						require.EqualValues(t, len(allInterceptionIDs), res.Total)
+						require.Len(t, res.Results, 1)
+						interceptionIDs = append(interceptionIDs, res.Results[0].ID)
+					}
+					return interceptionIDs
+				}
+
+				// First attempt: get all interceptions one by one.
+				gotInterceptionIDs1 := getAllInterceptionsOneByOne()
+				// We should have all of the interceptions returned:
+				require.ElementsMatch(t, allInterceptionIDs, gotInterceptionIDs1)
+
+				// Second attempt: get all interceptions one by one again.
+				gotInterceptionIDs2 := getAllInterceptionsOneByOne()
+				// They should be returned in the exact same order.
+				require.Equal(t, gotInterceptionIDs1, gotInterceptionIDs2)
+			})
+		}
 	})
 
 	t.Run("Authorized", func(t *testing.T) {
@@ -276,6 +301,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		// Admin can see all interceptions.
 		res, err := adminExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
+		require.EqualValues(t, 2, res.Total)
 		require.Len(t, res.Results, 2)
 		require.Equal(t, i1.ID, res.Results[0].ID)
 		require.Equal(t, i2.ID, res.Results[1].ID)
@@ -283,6 +309,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		// Second user can only see their own interceptions.
 		res, err = secondUserExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
+		require.EqualValues(t, 1, res.Total)
 		require.Len(t, res.Results, 1)
 		require.Equal(t, i2.ID, res.Results[0].ID)
 	})
@@ -436,6 +463,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				ctx := testutil.Context(t, testutil.WaitLong)
 				res, err := experimentalClient.AIBridgeListInterceptions(ctx, tc.filter)
 				require.NoError(t, err)
+				require.EqualValues(t, len(tc.want), res.Total)
 				// We just compare UUID strings for the sake of this test.
 				wantIDs := make([]string, len(tc.want))
 				for i, r := range tc.want {
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index e15ccd917d548..732fbb5af073e 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -39,6 +39,7 @@ export interface AIBridgeInterception {
 
 // From codersdk/aibridge.go
 export interface AIBridgeListInterceptionsResponse {
+	readonly total: number;
 	readonly results: readonly AIBridgeInterception[];
 }
 

From c2dcf9348ace6de45d97e2e4e92bf5f31dc98e45 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 11:54:31 +0000
Subject: [PATCH 189/298] chore: bump the x group across 1 directory with 6
 updates (#20395)

Bumps the x group with 4 updates in the / directory:
[golang.org/x/crypto](https://github.com/golang/crypto),
[golang.org/x/net](https://github.com/golang/net),
[golang.org/x/oauth2](https://github.com/golang/oauth2) and
[golang.org/x/tools](https://github.com/golang/tools).

Updates `golang.org/x/crypto` from 0.42.0 to 0.43.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/crypto/commit/627cb894b6b2021e34c4ad4af4c0a963127491e4"><code>627cb89</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/crypto/commit/dca4914afe94ebd485672b06b9a120e18b452533"><code>dca4914</code></a>
acme: fix autocert TestHTTPHandlerDefaultFallback</li>
<li><a
href="https://github.com/golang/crypto/commit/1336e21bd6f39d1ab82ca6412693849c2d120e1d"><code>1336e21</code></a>
x509roots/fallback: update bundle</li>
<li><a
href="https://github.com/golang/crypto/commit/2beaa59a3c994e5d01b6d58dc348dcd6d814ef26"><code>2beaa59</code></a>
ssh: add VerifiedPublicKeyCallback</li>
<li><a
href="https://github.com/golang/crypto/commit/66c3d8ce714c31eb5a8adb6c931b4e29f5bebcf5"><code>66c3d8c</code></a>
ssh: add support for FIPS mode</li>
<li><a
href="https://github.com/golang/crypto/commit/ddb4e80c6ad38c8a94001924a6ff8424f5cae369"><code>ddb4e80</code></a>
ssh: remove custom contains, use slices.Contains</li>
<li><a
href="https://github.com/golang/crypto/commit/f4d47b0db5875e61dd52acdb63be800177ab48bb"><code>f4d47b0</code></a>
ssh: return clearer error when signature algorithm is used as key
format</li>
<li><a
href="https://github.com/golang/crypto/commit/96dc232fbd7928e9c23da42e770c8b79a2348d86"><code>96dc232</code></a>
x509roots/fallback/bundle: add bundle package to export root certs</li>
<li><a
href="https://github.com/golang/crypto/commit/8c9ba318361080ea198c7461b6db621022d0a88e"><code>8c9ba31</code></a>
all: freeze and deprecate more packages</li>
<li><a
href="https://github.com/golang/crypto/commit/559e062ce8bfd6a39925294620b50906ca2a6f95"><code>559e062</code></a>
ssh/agent: return an error for unexpected message types</li>
<li>See full diff in <a
href="https://github.com/golang/crypto/compare/v0.42.0...v0.43.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/net` from 0.45.0 to 0.46.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/net/commit/2002a064a49010d8b881673c73f04e0b741e7c32"><code>2002a06</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/net/compare/v0.45.0...v0.46.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/oauth2` from 0.31.0 to 0.32.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/oauth2/commit/792c8776358f0c8689d84eef0d0c966937d560fb"><code>792c877</code></a>
oauth2: use strings.Builder instead of bytes.Buffer</li>
<li>See full diff in <a
href="https://github.com/golang/oauth2/compare/v0.31.0...v0.32.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/term` from 0.35.0 to 0.36.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/term/commit/3a0828a6667fd19fb680702513ff01f7afe76772"><code>3a0828a</code></a>
go.mod: update golang.org/x dependencies</li>
<li>See full diff in <a
href="https://github.com/golang/term/compare/v0.35.0...v0.36.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/text` from 0.29.0 to 0.30.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/text/commit/c6abd0305e90ada9293824462268d0ec20d02e5e"><code>c6abd03</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/text/commit/42f038dad6d204bacd83c23ca0f312d8866039ce"><code>42f038d</code></a>
x/text: fix nil dereference in gotext extract</li>
<li><a
href="https://github.com/golang/text/commit/a42f0e2da638996f313ef6dbbe3a4435533fbd97"><code>a42f0e2</code></a>
all: use built-in max/min to simplify the code</li>
<li>See full diff in <a
href="https://github.com/golang/text/compare/v0.29.0...v0.30.0">compare
view</a></li>
</ul>
</details>
<br />

Updates `golang.org/x/tools` from 0.37.0 to 0.38.0
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/golang/tools/commit/a22b5e8a9b8d2234e1e960ec2473e4011f012a6b"><code>a22b5e8</code></a>
go.mod: update golang.org/x dependencies</li>
<li><a
href="https://github.com/golang/tools/commit/4bbcc9fd127ab0b2b4269a698e979a41b59af5e6"><code>4bbcc9f</code></a>
all: use reflect.TypeFor instead of reflect.TypeOf when we have known
the type</li>
<li><a
href="https://github.com/golang/tools/commit/122c93afe11828e293bd624e3336c4b65dc33bd2"><code>122c93a</code></a>
internal/refactor: AddImport: remove unnecessary result</li>
<li><a
href="https://github.com/golang/tools/commit/76aace8abc696a6fb2c70cda65ebaf415c7ff4ad"><code>76aace8</code></a>
internal/analysisinternal: rationalize</li>
<li><a
href="https://github.com/golang/tools/commit/8cf2d63f232bdbbb191d19cb87cce87d5865e582"><code>8cf2d63</code></a>
gopls/internal/golang: add condition for enabling package move</li>
<li><a
href="https://github.com/golang/tools/commit/1f054fd59ccbdd283a18ab05c2fa61acec2a1148"><code>1f054fd</code></a>
x/tools: downgrade token.FileSet parameters to token.File</li>
<li><a
href="https://github.com/golang/tools/commit/44e71e5c407511a1d884d7179a1872476915f5eb"><code>44e71e5</code></a>
go/analysis/passes/printf: check anonymous functions too</li>
<li><a
href="https://github.com/golang/tools/commit/9095e9b831fff42b9aede2f024756cb4889bde17"><code>9095e9b</code></a>
internal/analysisinternal: extract DeleteVar</li>
<li><a
href="https://github.com/golang/tools/commit/62a1b26b1af98d6e3646141ccfdb6a94669271e0"><code>62a1b26</code></a>
internal/analysisinternal: IsChildOf(Cursor, edge.Kind) bool</li>
<li><a
href="https://github.com/golang/tools/commit/d32fb5053d825eb2082c24a38bd98e20bb4cd302"><code>d32fb50</code></a>
internal/analysisinternal: export EnclosingFile</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/tools/compare/v0.37.0...v0.38.0">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 12 ++++++------
 go.sum | 24 ++++++++++++------------
 2 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/go.mod b/go.mod
index 630dba5a17280..f9d19cabd649f 100644
--- a/go.mod
+++ b/go.mod
@@ -195,16 +195,16 @@ require (
 	go.uber.org/goleak v1.3.1-0.20240429205332-517bace7cc29
 	go.uber.org/mock v0.6.0
 	go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516
-	golang.org/x/crypto v0.42.0
+	golang.org/x/crypto v0.43.0
 	golang.org/x/exp v0.0.0-20250911091902-df9299821621
 	golang.org/x/mod v0.29.0
-	golang.org/x/net v0.45.0
-	golang.org/x/oauth2 v0.31.0
+	golang.org/x/net v0.46.0
+	golang.org/x/oauth2 v0.32.0
 	golang.org/x/sync v0.17.0
 	golang.org/x/sys v0.37.0
-	golang.org/x/term v0.35.0
-	golang.org/x/text v0.29.0
-	golang.org/x/tools v0.37.0
+	golang.org/x/term v0.36.0
+	golang.org/x/text v0.30.0
+	golang.org/x/tools v0.38.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
 	google.golang.org/api v0.252.0
 	google.golang.org/grpc v1.76.0
diff --git a/go.sum b/go.sum
index 403c68703f9eb..d20dda4b94113 100644
--- a/go.sum
+++ b/go.sum
@@ -2048,8 +2048,8 @@ golang.org/x/crypto v0.19.0/go.mod h1:Iy9bg/ha4yyC70EfRS8jz+B6ybOBKMaSxLj6P6oBDf
 golang.org/x/crypto v0.23.0/go.mod h1:CKFgDieR+mRhux2Lsu27y0fO304Db0wZe70UKqHu0v8=
 golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
 golang.org/x/crypto v0.32.0/go.mod h1:ZnnJkOaASj8g0AjIduWNlq2NRxL0PlBrbKVyZ6V/Ugc=
-golang.org/x/crypto v0.42.0 h1:chiH31gIWm57EkTXpwnqf8qeuMUi0yekh6mT2AvFlqI=
-golang.org/x/crypto v0.42.0/go.mod h1:4+rDnOTJhQCx2q7/j6rAN5XDw8kPjeaXEUR2eL94ix8=
+golang.org/x/crypto v0.43.0 h1:dduJYIi3A3KOfdGOHX8AVZ/jGiyPa3IbBozJ5kNuE04=
+golang.org/x/crypto v0.43.0/go.mod h1:BFbav4mRNlXJL4wNeejLpWxB7wMbc79PdRGhWKncxR0=
 golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
 golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
@@ -2178,8 +2178,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk=
 golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44=
 golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM=
 golang.org/x/net v0.34.0/go.mod h1:di0qlW3YNM5oh6GqDGQr92MyTozJPmybPK4Ev/Gm31k=
-golang.org/x/net v0.45.0 h1:RLBg5JKixCy82FtLJpeNlVM0nrSqpCRYzVU1n8kj0tM=
-golang.org/x/net v0.45.0/go.mod h1:ECOoLqd5U3Lhyeyo/QDCEVQ4sNgYsqvCZ722XogGieY=
+golang.org/x/net v0.46.0 h1:giFlY12I07fugqwPuWJi68oOnpfqFnJIJzaIIm2JVV4=
+golang.org/x/net v0.46.0/go.mod h1:Q9BGdFy1y4nkUwiLvT5qtyhAnEHgnQ/zd8PfU6nc210=
 golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
 golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
 golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
@@ -2209,8 +2209,8 @@ golang.org/x/oauth2 v0.4.0/go.mod h1:RznEsdpjGAINPTOF0UH/t+xJ75L18YO3Ho6Pyn+uRec
 golang.org/x/oauth2 v0.5.0/go.mod h1:9/XBHVqLaWO3/BRHs5jbpYCnOZVjj5V0ndyaAM7KB4I=
 golang.org/x/oauth2 v0.6.0/go.mod h1:ycmewcwgD4Rpr3eZJLSB4Kyyljb3qDh40vJ8STE5HKw=
 golang.org/x/oauth2 v0.7.0/go.mod h1:hPLQkd9LyjfXTiRohC/41GhcFqxisoUQ99sCUOHO9x4=
-golang.org/x/oauth2 v0.31.0 h1:8Fq0yVZLh4j4YA47vHKFTa9Ew5XIrCP8LC6UeNZnLxo=
-golang.org/x/oauth2 v0.31.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
+golang.org/x/oauth2 v0.32.0 h1:jsCblLleRMDrxMN29H3z/k1KliIvpLgCkE6R8FXXNgY=
+golang.org/x/oauth2 v0.32.0/go.mod h1:lzm5WQJQwKZ3nwavOZ3IS5Aulzxi68dUSgRHujetwEA=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -2350,8 +2350,8 @@ golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
 golang.org/x/term v0.20.0/go.mod h1:8UkIAJTvZgivsXaD6/pH6U9ecQzZ45awqEOzuCvwpFY=
 golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
 golang.org/x/term v0.28.0/go.mod h1:Sw/lC2IAUZ92udQNf3WodGtn4k/XoLyZoh8v/8uiwek=
-golang.org/x/term v0.35.0 h1:bZBVKBudEyhRcajGcNc3jIfWPqV4y/Kt2XcoigOWtDQ=
-golang.org/x/term v0.35.0/go.mod h1:TPGtkTLesOwf2DE8CgVYiZinHAOuy5AYUYT1lENIZnA=
+golang.org/x/term v0.36.0 h1:zMPR+aF8gfksFprF/Nc/rd1wRS1EI6nDBGyWAvDzx2Q=
+golang.org/x/term v0.36.0/go.mod h1:Qu394IJq6V6dCBRgwqshf3mPF85AqzYEzofzRdZkWss=
 golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
@@ -2374,8 +2374,8 @@ golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
 golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
 golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
-golang.org/x/text v0.29.0 h1:1neNs90w9YzJ9BocxfsQNHKuAT4pkghyXc4nhZ6sJvk=
-golang.org/x/text v0.29.0/go.mod h1:7MhJOA9CD2qZyOKYazxdYMF85OwPdEr9jTtBpO7ydH4=
+golang.org/x/text v0.30.0 h1:yznKA/E9zq54KzlzBEAWn1NXSQ8DIp/NYMy88xJjl4k=
+golang.org/x/text v0.30.0/go.mod h1:yDdHFIX9t+tORqspjENWgzaCVXgk0yYnYuSZ8UzzBVM=
 golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
@@ -2449,8 +2449,8 @@ golang.org/x/tools v0.6.0/go.mod h1:Xwgl3UAJ/d3gWutnCtw505GrjyAbvKui8lOU390QaIU=
 golang.org/x/tools v0.7.0/go.mod h1:4pg6aUX35JBAogB10C9AtvVL+qowtN4pT3CGSQex14s=
 golang.org/x/tools v0.13.0/go.mod h1:HvlwmtVNQAhOuCjW7xxvovg8wbNq7LwfXh/k7wXUl58=
 golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk=
-golang.org/x/tools v0.37.0 h1:DVSRzp7FwePZW356yEAChSdNcQo6Nsp+fex1SUW09lE=
-golang.org/x/tools v0.37.0/go.mod h1:MBN5QPQtLMHVdvsbtarmTNukZDdgwdwlO5qGacAzF0w=
+golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ=
+golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

From 650dc860bdc77bcfbe6c1b3f417dc6847f6582c2 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Tue, 21 Oct 2025 12:08:33 +0000
Subject: [PATCH 190/298] chore: bump github.com/gohugoio/hugo from 0.150.0 to
 0.151.2 (#20382)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.150.0 to 0.151.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.151.2</h2>
<h2>What's Changed</h2>
<ul>
<li>parser/pageparser: Add a testcase for nested shortcodes of the same
name 989454a52 <a href="https://github.com/bep"><code>@​bep</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14054">#14054</a></li>
<li>parser/pageparser: Fix shortcode nesting regression 1e91e4652 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14054">#14054</a></li>
</ul>
<h2>v0.151.1</h2>
<p>This release is mostly motivated by some upstream security fixes:</p>
<ul>
<li>Upgrade from Go 1.25.1 to Go 1.25.3 which comes with <a
href="https://github.com/golang/go/issues?q=milestone%3AGo1.25.2%20label%3ASecurity">10
security fixes</a>.</li>
<li>Go's <code>net/html</code> package also has one <a
href="https://github.com/golang/net/commit/59706cdaa8f95502fdec64b67b4c61d6ca58727d">security
patch</a></li>
</ul>
<p>I, <a href="https://github.com/bep"><code>@​bep</code></a>, have
inspected the above issues, and none of them seem to be relevant for
Hugo, but we understand that many want to have a clean security
report.</p>
<h2>Bug fixes</h2>
<ul>
<li>tpl: Fix strings/truncate CJK handling 88aea5668 <a
href="https://github.com/oishikazuo"><code>@​oishikazuo</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14039">#14039</a></li>
<li>parser/pagerparser: Fix closing shortcode error handling when
repeated a133393ed <a
href="https://github.com/bep"><code>@​bep</code></a></li>
</ul>
<h2>Improvements</h2>
<ul>
<li>Upgrade Go to 1.25.3 e2fb0b0e8 <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>create/skeletons: Wrap section and home lists with section tags
29cf87444 <a
href="https://github.com/imomaliev"><code>@​imomaliev</code></a></li>
<li>markup/goldmark: Align blockquote default output with Goldmark
1b4dd436d <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14046">#14046</a></li>
<li>parser/pageparser: Store shortcode names as unique.Handle[string] to
save memory allocations 4414ef73f <a
href="https://github.com/bep"><code>@​bep</code></a></li>
<li>testscripts: Make test assertion less specific 9197debbf <a
href="https://github.com/bep"><code>@​bep</code></a></li>
</ul>
<h2>Dependency Updates</h2>
<ul>
<li>build(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to
0.6.0 f4c11571b <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump golang.org/x/image from 0.30.0 to 0.32.0 54075acc2
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump github.com/evanw/esbuild from 0.25.10 to 0.25.11
8b52303e3 <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 3d45d30a4
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
<li>build(deps): bump golang.org/x/mod from 0.28.0 to 0.29.0 095157cd6
<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]</li>
</ul>
<h2>v0.151.0</h2>
<p>Some notable new features in Hugo v0.151.0 are:</p>
<ul>
<li>New <a
href="https://gohugo.io/functions/transform/htmltomarkdown/">transform.HTMLToMarkdown</a>
template function. One possible use case would be to provide <a
href="https://llmstxt.org/">LLM friendly content</a>.</li>
<li>Hugo now reports OSC 9;4 progress when building; progress
bars/indicators are supported by terminals such as <a
href="https://ghostty.org/docs/install/release-notes/1-2-0#graphical-progress-bars">Ghostty</a>
on Macos and Linux, Windows terminal.</li>
<li>Several new <a
href="https://gohugo.io/configuration/markup/#footnote">config
options</a> for Markdown foot notes.</li>
</ul>
<h2>Note</h2>
<ul>
<li>transform/livereloadinject: Skip livereload.js injection if no tags
found (note) 7fd6762c1 <a
href="https://github.com/AndrewChubatiuk"><code>@​AndrewChubatiuk</code></a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/a3574f6f70c9b272e3de53cf976018ee3ff16fd1"><code>a3574f6</code></a>
releaser: Bump versions for release of 0.151.2</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/989454a52d2646e75313ad311da94e6ad7d5f55a"><code>989454a</code></a>
parser/pageparser: Add a testcase for nested shortcodes of the same
name</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/1e91e46520e980a15a46beeb6d5ae846e17a9144"><code>1e91e46</code></a>
parser/pageparser: Fix shortcode nesting regression</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/8a57d0f15fd8d39cbc5df4da5bf6a5baab109e1c"><code>8a57d0f</code></a>
testscripts: Add and improve commands tests for static mounts</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/b76c50ac184e408f1200da72bcd3794856922b0a"><code>b76c50a</code></a>
releaser: Prepare repository for 0.152.0-DEV</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/1cdd17882c28a9f23278d38ef03b403954cfb1e5"><code>1cdd178</code></a>
releaser: Bump versions for release of 0.151.1</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/e2fb0b0e80193c3e3f31f1cfa931c321ffee1d55"><code>e2fb0b0</code></a>
Upgrade Go to 1.25.3</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/88aea56683ec1e469e97c0771c0c01a15010c7c2"><code>88aea56</code></a>
tpl: Fix strings/truncate CJK handling</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/f4c11571bb0b1d5b5cb3d7b66a4fdca808f71cb8"><code>f4c1157</code></a>
build(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to
0.6.0</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/54075acc29f9f504878e237df5851ee3269e8ca9"><code>54075ac</code></a>
build(deps): bump golang.org/x/image from 0.30.0 to 0.32.0</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.150.0...v0.151.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.150.0&new-version=0.151.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 14 +++++++-------
 go.sum | 48 ++++++++++++++++++++++++++----------------------
 2 files changed, 33 insertions(+), 29 deletions(-)

diff --git a/go.mod b/go.mod
index f9d19cabd649f..590a87ae4f3ee 100644
--- a/go.mod
+++ b/go.mod
@@ -127,7 +127,7 @@ require (
 	github.com/go-logr/logr v1.4.3
 	github.com/go-playground/validator/v10 v10.28.0
 	github.com/gofrs/flock v0.13.0
-	github.com/gohugoio/hugo v0.150.0
+	github.com/gohugoio/hugo v0.151.2
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/golang-migrate/migrate/v4 v4.19.0
 	github.com/gomarkdown/markdown v0.0.0-20240930133441-72d49d9543d8
@@ -172,7 +172,7 @@ require (
 	github.com/robfig/cron/v3 v3.0.1
 	github.com/shirou/gopsutil/v4 v4.25.5
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
-	github.com/spf13/afero v1.14.0
+	github.com/spf13/afero v1.15.0
 	github.com/spf13/pflag v1.0.7
 	github.com/sqlc-dev/pqtype v0.3.0
 	github.com/stretchr/testify v1.11.1
@@ -255,13 +255,13 @@ require (
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.1-0.20221118154546-54df44f2176c // indirect
 	github.com/atotto/clipboard v0.1.4 // indirect
-	github.com/aws/aws-sdk-go-v2 v1.39.0
+	github.com/aws/aws-sdk-go-v2 v1.39.2
 	github.com/aws/aws-sdk-go-v2/config v1.31.3
 	github.com/aws/aws-sdk-go-v2/credentials v1.18.7 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 // indirect
 	github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.2
-	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 // indirect
-	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 // indirect
+	github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 // indirect
 	github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 // indirect
 	github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 // indirect
@@ -274,7 +274,7 @@ require (
 	github.com/beorn7/perks v1.0.1 // indirect
 	github.com/bep/godartsass/v2 v2.5.0 // indirect
 	github.com/bep/golibsass v1.2.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.9.0 // indirect
+	github.com/bmatcuk/doublestar/v4 v4.9.1 // indirect
 	github.com/charmbracelet/x/ansi v0.8.0 // indirect
 	github.com/charmbracelet/x/term v0.2.1 // indirect
 	github.com/chromedp/sysutil v1.1.0 // indirect
@@ -315,7 +315,7 @@ require (
 	github.com/gobwas/ws v1.4.0 // indirect
 	github.com/godbus/dbus/v5 v5.1.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/gohugoio/hashstructure v0.5.0 // indirect
+	github.com/gohugoio/hashstructure v0.6.0 // indirect
 	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
diff --git a/go.sum b/go.sum
index d20dda4b94113..f6fb4cbd526df 100644
--- a/go.sum
+++ b/go.sum
@@ -676,6 +676,10 @@ github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.53.0/go.mod h1:jUZ5LYlw40WMd07qxcQJD5M40aUxrfwqQX1g7zxYnrQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0 h1:Ron4zCA/yk6U7WOBXhTJcDpsUBG9npumK6xw2auFltQ=
 github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.53.0/go.mod h1:cSgYe11MCNYunTnRXrKiR/tHc0eoKjICUuWpNZoVCOo=
+github.com/JohannesKaufmann/dom v0.2.0 h1:1bragmEb19K8lHAqgFgqCpiPCFEZMTXzOIEjuxkUfLQ=
+github.com/JohannesKaufmann/dom v0.2.0/go.mod h1:57iSUl5RKric4bUkgos4zu6Xt5LMHUnw3TF1l5CbGZo=
+github.com/JohannesKaufmann/html-to-markdown/v2 v2.4.0 h1:C0/TerKdQX9Y9pbYi1EsLr5LDNANsqunyI/btpyfCg8=
+github.com/JohannesKaufmann/html-to-markdown/v2 v2.4.0/go.mod h1:OLaKh+giepO8j7teevrNwiy/fwf8LXgoc9g7rwaE1jk=
 github.com/JohnCGriffin/overflow v0.0.0-20211019200055-46fa312c352c/go.mod h1:X0CRv0ky0k6m906ixxpzmDRLvX58TFUKS2eePweuyxk=
 github.com/KyleBanks/depth v1.2.1 h1:5h8fQADFrWtarTdtDudMmGsC7GPbOAu6RVB3ffsVFHc=
 github.com/KyleBanks/depth v1.2.1/go.mod h1:jzSb9d0L43HxTQfT+oSA1EEp2q+ne2uh6XgeJcm8brE=
@@ -758,8 +762,8 @@ github.com/awalterschulze/gographviz v2.0.3+incompatible/go.mod h1:GEV5wmg4YquNw
 github.com/aws/aws-sdk-go v1.44.122/go.mod h1:y4AeaBuwd2Lk+GepC1E9v0qOiTws0MIWAX4oIKwKHZo=
 github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE=
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
-github.com/aws/aws-sdk-go-v2 v1.39.0 h1:xm5WV/2L4emMRmMjHFykqiA4M/ra0DJVSWUkDyBjbg4=
-github.com/aws/aws-sdk-go-v2 v1.39.0/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I=
+github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
 github.com/aws/aws-sdk-go-v2/config v1.31.3 h1:RIb3yr/+PZ18YYNe6MDiG/3jVoJrPmdoCARwNkMGvco=
 github.com/aws/aws-sdk-go-v2/config v1.31.3/go.mod h1:jjgx1n7x0FAKl6TnakqrpkHWWKcX3xfWtdnIJs5K9CE=
 github.com/aws/aws-sdk-go-v2/credentials v1.18.7 h1:zqg4OMrKj+t5HlswDApgvAHjxKtlduKS7KicXB+7RLg=
@@ -768,10 +772,10 @@ github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 h1:lpdMwTzmuDLkgW7086jE94H
 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4/go.mod h1:9xzb8/SV62W6gHQGC/8rrvgNXU6ZoYM3sAIJCIrXJxY=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.2 h1:QbFjOdplTkOgviHNKyTW/TZpvIYhD6lqEc3tkIvqMoQ=
 github.com/aws/aws-sdk-go-v2/feature/rds/auth v1.6.2/go.mod h1:d0pTYUeTv5/tPSlbPZZQSqssM158jZBs02jx2LDslM8=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 h1:IdCLsiiIj5YJ3AFevsewURCPV+YWUlOW8JiPhoAy8vg=
-github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4/go.mod h1:l4bdfCD7XyyZA9BolKBo1eLqgaJxl0/x91PL4Yqe0ao=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 h1:j7vjtr1YIssWQOMeOWRbh3z8g2oY/xPjnZH2gLY4sGw=
-github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4/go.mod h1:yDmJgqOiH4EA8Hndnv4KwAo8jCGTSnM5ASG1nBI+toA=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9 h1:se2vOWGD3dWQUtfn4wEjRQJb1HK1XsNIt825gskZ970=
+github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.9/go.mod h1:hijCGH2VfbZQxqCDN7bwz/4dzxV+hkyhjawAtdPWKZA=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9 h1:6RBnKZLkJM4hQ+kN6E7yWFveOTg8NLPHAkqrs4ZPlTU=
+github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.9/go.mod h1:V9rQKRmK7AWuEsOMnHzKj8WyrIir1yUJbZxDuZLFvXI=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 h1:bIqFDwgGXXN1Kpp99pDOdKMTTb5d2KyU5X/BZxjOkRo=
 github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3/go.mod h1:H5O/EsxDWyU+LP/V8i5sm8cxoZgc2fdNR9bxlOFrQTo=
 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 h1:6+lZi2JeGKtCraAj1rpoZfKqnQ9SptseRZioejfUOLM=
@@ -828,8 +832,8 @@ github.com/bep/tmc v0.5.1 h1:CsQnSC6MsomH64gw0cT5f+EwQDcvZz4AazKunFwTpuI=
 github.com/bep/tmc v0.5.1/go.mod h1:tGYHN8fS85aJPhDLgXETVKp+PR382OvFi2+q2GkGsq0=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d h1:xDfNPAt8lFiC1UJrqV3uuy861HCTo708pDMbjHHdCas=
 github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d/go.mod h1:6QX/PXZ00z/TKoufEY6K/a0k6AhaJrQKdFe6OfVXsa4=
-github.com/bmatcuk/doublestar/v4 v4.9.0 h1:DBvuZxjdKkRP/dr4GVV4w2fnmrk5Hxc90T51LZjv0JA=
-github.com/bmatcuk/doublestar/v4 v4.9.0/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
+github.com/bmatcuk/doublestar/v4 v4.9.1 h1:X8jg9rRZmJd4yRy7ZeNDRnM+T3ZfHv15JiBJ/avrEXE=
+github.com/bmatcuk/doublestar/v4 v4.9.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bool64/shared v0.1.5 h1:fp3eUhBsrSjNCQPcSdQqZxxh9bBwrYiZ+zOKFkM0/2E=
 github.com/bool64/shared v0.1.5/go.mod h1:081yz68YC9jeFB3+Bbmno2RFWvGKv1lPKkMP6MHJlPs=
 github.com/boombuler/barcode v1.0.0/go.mod h1:paBWMcWSl3LHKBqUq+rly7CNSldXjb2rDl3JlRe0mD8=
@@ -1064,8 +1068,8 @@ github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f h1:Y/CXytFA4m6
 github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f/go.mod h1:vw97MGsxSvLiUE2X8qFplwetxpGLQrlU1Q9AUEIzCaM=
 github.com/esiqveland/notify v0.13.3 h1:QCMw6o1n+6rl+oLUfg8P1IIDSFsDEb2WlXvVvIJbI/o=
 github.com/esiqveland/notify v0.13.3/go.mod h1:hesw/IRYTO0x99u1JPweAl4+5mwXJibQVUcP0Iu5ORE=
-github.com/evanw/esbuild v0.25.9 h1:aU7GVC4lxJGC1AyaPwySWjSIaNLAdVEEuq3chD0Khxs=
-github.com/evanw/esbuild v0.25.9/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
+github.com/evanw/esbuild v0.25.11 h1:NGtezc+xk+Mti4fgWaoD3dncZNCzcTA+r0BxMV3Koyw=
+github.com/evanw/esbuild v0.25.11/go.mod h1:D2vIQZqV/vIf/VRHtViaUtViZmG7o+kKmlBfVQuRi48=
 github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM=
@@ -1195,12 +1199,12 @@ github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
 github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e h1:QArsSubW7eDh8APMXkByjQWvuljwPGAGQpJEFn0F0wY=
 github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e/go.mod h1:3Ltoo9Banwq0gOtcOwxuHG6omk+AwsQPADyw2vQYOJQ=
-github.com/gohugoio/hashstructure v0.5.0 h1:G2fjSBU36RdwEJBWJ+919ERvOVqAg9tfcYp47K9swqg=
-github.com/gohugoio/hashstructure v0.5.0/go.mod h1:Ser0TniXuu/eauYmrwM4o64EBvySxNzITEOLlm4igec=
-github.com/gohugoio/httpcache v0.7.0 h1:ukPnn04Rgvx48JIinZvZetBfHaWE7I01JR2Q2RrQ3Vs=
-github.com/gohugoio/httpcache v0.7.0/go.mod h1:fMlPrdY/vVJhAriLZnrF5QpN3BNAcoBClgAyQd+lGFI=
-github.com/gohugoio/hugo v0.150.0 h1:0IUwsfgF38m/VXA7e1+aii0cF7XgLAFcWgBKWlShIQY=
-github.com/gohugoio/hugo v0.150.0/go.mod h1:+c6VffXGahbNCe/wTQ05FkKMjT/fZqN6Gq3tgBfUhNw=
+github.com/gohugoio/hashstructure v0.6.0 h1:7wMB/2CfXoThFYhdWRGv3u3rUM761Cq29CxUW+NltUg=
+github.com/gohugoio/hashstructure v0.6.0/go.mod h1:lapVLk9XidheHG1IQ4ZSbyYrXcaILU1ZEP/+vno5rBQ=
+github.com/gohugoio/httpcache v0.8.0 h1:hNdsmGSELztetYCsPVgjA960zSa4dfEqqF/SficorCU=
+github.com/gohugoio/httpcache v0.8.0/go.mod h1:fMlPrdY/vVJhAriLZnrF5QpN3BNAcoBClgAyQd+lGFI=
+github.com/gohugoio/hugo v0.151.2 h1:HZ5V/oQnldrffqEAkUsnd6bgq8ZtEOzF0xox2+zuT3k=
+github.com/gohugoio/hugo v0.151.2/go.mod h1:7QPFu7oOioiXlmy9hfgnhCg3LixGXthnZQmmBUdjs/4=
 github.com/gohugoio/hugo-goldmark-extensions/extras v0.5.0 h1:dco+7YiOryRoPOMXwwaf+kktZSCtlFtreNdiJbETvYE=
 github.com/gohugoio/hugo-goldmark-extensions/extras v0.5.0/go.mod h1:CRrxQTKeM3imw+UoS4EHKyrqB7Zp6sAJiqHit+aMGTE=
 github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.3.1 h1:nUzXfRTszLliZuN0JTKeunXTRaiFX6ksaWP0puLLYAY=
@@ -1637,8 +1641,8 @@ github.com/olekukonko/errors v1.1.0 h1:RNuGIh15QdDenh+hNvKrJkmxxjV4hcS50Db478Ou5
 github.com/olekukonko/errors v1.1.0/go.mod h1:ppzxA5jBKcO1vIpCXQ9ZqgDh8iwODz6OXIGKU8r5m4Y=
 github.com/olekukonko/ll v0.0.9 h1:Y+1YqDfVkqMWuEQMclsF9HUR5+a82+dxJuL1HHSRpxI=
 github.com/olekukonko/ll v0.0.9/go.mod h1:En+sEW0JNETl26+K8eZ6/W4UQ7CYSrrgg/EdIYT2H8g=
-github.com/olekukonko/tablewriter v1.0.9 h1:XGwRsYLC2bY7bNd93Dk51bcPZksWZmLYuaTHR0FqfL8=
-github.com/olekukonko/tablewriter v1.0.9/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
+github.com/olekukonko/tablewriter v1.1.0 h1:N0LHrshF4T39KvI96fn6GT8HEjXRXYNDrDjKFDB7RIY=
+github.com/olekukonko/tablewriter v1.1.0/go.mod h1:5c+EBPeSqvXnLLgkm9isDdzR3wjfBkHR9Nhfp3NWrzo=
 github.com/open-policy-agent/opa v1.6.0 h1:/S/cnNQJ2MUMNzizHPbisTWBHowmLkPrugY5jjkPlRQ=
 github.com/open-policy-agent/opa v1.6.0/go.mod h1:zFmw4P+W62+CWGYRDDswfVYSCnPo6oYaktQnfIaRFC4=
 github.com/open-telemetry/opentelemetry-collector-contrib/pkg/sampling v0.120.1 h1:lK/3zr73guK9apbXTcnDnYrC0YCQ25V3CIULYz3k2xU=
@@ -1822,8 +1826,8 @@ github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
 github.com/tc-hib/winres v0.2.1/go.mod h1:C/JaNhH3KBvhNKVbvdlDWkbMDO9H4fKKDaN7/07SSuk=
 github.com/tchap/go-patricia/v2 v2.3.2 h1:xTHFutuitO2zqKAQ5rCROYgUb7Or/+IC3fts9/Yc7nM=
 github.com/tchap/go-patricia/v2 v2.3.2/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
-github.com/tdewolff/minify/v2 v2.24.2 h1:vnY3nTulEAbCAAlxTxPPDkzG24rsq31SOzp63yT+7mo=
-github.com/tdewolff/minify/v2 v2.24.2/go.mod h1:1JrCtoZXaDbqioQZfk3Jdmr0GPJKiU7c1Apmb+7tCeE=
+github.com/tdewolff/minify/v2 v2.24.3 h1:BaKgWSFLKbKDiUskbeRgbe2n5d1Ci1x3cN/eXna8zOA=
+github.com/tdewolff/minify/v2 v2.24.3/go.mod h1:1JrCtoZXaDbqioQZfk3Jdmr0GPJKiU7c1Apmb+7tCeE=
 github.com/tdewolff/parse/v2 v2.8.3 h1:5VbvtJ83cfb289A1HzRA9sf02iT8YyUwN84ezjkdY1I=
 github.com/tdewolff/parse/v2 v2.8.3/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
 github.com/tdewolff/test v1.0.11 h1:FdLbwQVHxqG16SlkGveC0JVyrJN62COWTRyUFzfbtBE=
@@ -2080,8 +2084,8 @@ golang.org/x/image v0.0.0-20210607152325-775e3b0c77b9/go.mod h1:023OzeP/+EPmXeap
 golang.org/x/image v0.0.0-20210628002857-a66eb6448b8d/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
 golang.org/x/image v0.0.0-20211028202545-6944b10bf410/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
 golang.org/x/image v0.0.0-20220302094943-723b81ca9867/go.mod h1:023OzeP/+EPmXeapQh35lcL3II3LrY8Ic+EFFKVhULM=
-golang.org/x/image v0.30.0 h1:jD5RhkmVAnjqaCUXfbGBrn3lpxbknfN9w2UhHHU+5B4=
-golang.org/x/image v0.30.0/go.mod h1:SAEUTxCCMWSrJcCy/4HwavEsfZZJlYxeHLc6tTiAe/c=
+golang.org/x/image v0.32.0 h1:6lZQWq75h7L5IWNk0r+SCpUJ6tUVd3v4ZHnbRKLkUDQ=
+golang.org/x/image v0.32.0/go.mod h1:/R37rrQmKXtO6tYXAjtDLwQgFLHmhW+V6ayXlxzP2Pc=
 golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
 golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
 golang.org/x/lint v0.0.0-20190301231843-5614ed5bae6f/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=

From 86f0f39863a27040acd17dd6bc354cc6a430df7c Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Tue, 21 Oct 2025 09:15:37 -0500
Subject: [PATCH 191/298] chore: make authz recorder opt in (#20310)

The authz recorder is causing a lot of memory to be allocated, and is a
memory leak for websocket connections.

This change makes it opt-in on a per request basis (ontop of `isDev`).
To get the authz headers, use `Copy as cURL` on chrome and append the
header `x-authz-checks=true`.
---
 coderd/apidoc/docs.go          |  3 +++
 coderd/apidoc/swagger.json     |  3 +++
 coderd/coderd.go               |  2 +-
 coderd/httpmw/authz.go         | 23 +++++++++++++++++------
 codersdk/deployment.go         | 14 ++++++++++++++
 docs/reference/api/general.md  |  1 +
 docs/reference/api/schemas.md  |  3 +++
 site/src/api/typesGenerated.ts |  1 +
 8 files changed, 43 insertions(+), 7 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 8046cab6c5464..6c5cb1506faea 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -13977,6 +13977,9 @@ const docTemplate = `{
                 "docs_url": {
                     "$ref": "#/definitions/serpent.URL"
                 },
+                "enable_authz_recording": {
+                    "type": "boolean"
+                },
                 "enable_terraform_debug_mode": {
                     "type": "boolean"
                 },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index d5b625a2e631b..1b492d7649e65 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -12595,6 +12595,9 @@
 				"docs_url": {
 					"$ref": "#/definitions/serpent.URL"
 				},
+				"enable_authz_recording": {
+					"type": "boolean"
+				},
 				"enable_terraform_debug_mode": {
 					"type": "boolean"
 				},
diff --git a/coderd/coderd.go b/coderd/coderd.go
index 122018f96d72f..dd8d053624783 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -493,7 +493,7 @@ func New(options *Options) *API {
 	// We add this middleware early, to make sure that authorization checks made
 	// by other middleware get recorded.
 	if buildinfo.IsDev() {
-		r.Use(httpmw.RecordAuthzChecks)
+		r.Use(httpmw.RecordAuthzChecks(options.DeploymentValues.EnableAuthzRecording.Value()))
 	}
 
 	ctx, cancel := context.WithCancel(context.Background())
diff --git a/coderd/httpmw/authz.go b/coderd/httpmw/authz.go
index 9f1f397c858e0..758f95cad28a9 100644
--- a/coderd/httpmw/authz.go
+++ b/coderd/httpmw/authz.go
@@ -4,6 +4,7 @@ package httpmw
 
 import (
 	"net/http"
+	"strconv"
 
 	"github.com/go-chi/chi/v5"
 
@@ -39,14 +40,24 @@ func AsAuthzSystem(mws ...func(http.Handler) http.Handler) func(http.Handler) ht
 	}
 }
 
-// RecordAuthzChecks enables recording all of the authorization checks that
+// RecordAuthzChecks enables recording all the authorization checks that
 // occurred in the processing of a request. This is mostly helpful for debugging
 // and understanding what permissions are required for a given action.
 //
+// Can either be toggled on by a deployment wide configuration value, or opt-in on
+// a per-request basis by setting the `x-record-authz-checks` header to a truthy value.
+//
 // Requires using a Recorder Authorizer.
-func RecordAuthzChecks(next http.Handler) http.Handler {
-	return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
-		r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
-		next.ServeHTTP(rw, r)
-	})
+//
+//nolint:revive
+func RecordAuthzChecks(always bool) func(next http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			if enabled, _ := strconv.ParseBool(r.Header.Get("x-record-authz-checks")); enabled || always {
+				r = r.WithContext(rbac.WithAuthzCheckRecorder(r.Context()))
+			}
+
+			next.ServeHTTP(rw, r)
+		})
+	}
 }
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 9549b0b98eb2f..008ae6e2b93b1 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -487,6 +487,7 @@ type DeploymentValues struct {
 	Sessions                        SessionLifetime                      `json:"session_lifetime,omitempty" typescript:",notnull"`
 	DisablePasswordAuth             serpent.Bool                         `json:"disable_password_auth,omitempty" typescript:",notnull"`
 	Support                         SupportConfig                        `json:"support,omitempty" typescript:",notnull"`
+	EnableAuthzRecording            serpent.Bool                         `json:"enable_authz_recording,omitempty" typescript:",notnull"`
 	ExternalAuthConfigs             serpent.Struct[[]ExternalAuthConfig] `json:"external_auth,omitempty" typescript:",notnull"`
 	SSHConfig                       SSHConfig                            `json:"config_ssh,omitempty" typescript:",notnull"`
 	WgtunnelHost                    serpent.String                       `json:"wgtunnel_host,omitempty" typescript:",notnull"`
@@ -3293,6 +3294,19 @@ Write out the current server config as YAML to stdout.`,
 			YAML:        "key",
 			Hidden:      true,
 		},
+		{
+			Name: "Enable Authorization Recordings",
+			Description: "All api requests will have a header including all authorization calls made during the request. " +
+				"This is used for debugging purposes and only available for dev builds.",
+			Required: false,
+			Flag:     "enable-authz-recordings",
+			Env:      "CODER_ENABLE_AUTHZ_RECORDINGS",
+			Default:  "false",
+			Value:    &c.EnableAuthzRecording,
+			// Do not show this option ever. It is a developer tool only, and not to be
+			// used externally.
+			Hidden: true,
+		},
 	}
 
 	return opts
diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md
index a89376db38dba..0f3330da790cc 100644
--- a/docs/reference/api/general.md
+++ b/docs/reference/api/general.md
@@ -237,6 +237,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
       "scheme": "string",
       "user": {}
     },
+    "enable_authz_recording": true,
     "enable_terraform_debug_mode": true,
     "ephemeral_deployment": true,
     "experiments": [
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 91a894528ea02..654dc0f45bfb3 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -2892,6 +2892,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
       "scheme": "string",
       "user": {}
     },
+    "enable_authz_recording": true,
     "enable_terraform_debug_mode": true,
     "ephemeral_deployment": true,
     "experiments": [
@@ -3397,6 +3398,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
     "scheme": "string",
     "user": {}
   },
+  "enable_authz_recording": true,
   "enable_terraform_debug_mode": true,
   "ephemeral_deployment": true,
   "experiments": [
@@ -3731,6 +3733,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
 | `disable_password_auth`              | boolean                                                                                              | false    |              |                                                                    |
 | `disable_path_apps`                  | boolean                                                                                              | false    |              |                                                                    |
 | `docs_url`                           | [serpent.URL](#serpenturl)                                                                           | false    |              |                                                                    |
+| `enable_authz_recording`             | boolean                                                                                              | false    |              |                                                                    |
 | `enable_terraform_debug_mode`        | boolean                                                                                              | false    |              |                                                                    |
 | `ephemeral_deployment`               | boolean                                                                                              | false    |              |                                                                    |
 | `experiments`                        | array of string                                                                                      | false    |              |                                                                    |
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 732fbb5af073e..932f72a383058 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -1755,6 +1755,7 @@ export interface DeploymentValues {
 	readonly session_lifetime?: SessionLifetime;
 	readonly disable_password_auth?: boolean;
 	readonly support?: SupportConfig;
+	readonly enable_authz_recording?: boolean;
 	readonly external_auth?: SerpentStruct<ExternalAuthConfig[]>;
 	readonly config_ssh?: SSHConfig;
 	readonly wgtunnel_host?: string;

From 87ce021035272c02cf3d9f3981618a7efd465b6d Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Tue, 21 Oct 2025 14:39:17 -0300
Subject: [PATCH 192/298] fix: centralize warning message in static error
 (#20389)

- Centralize warning message in static error
- Change a few typography styles to match coder/coder

**Before:**

<img width="1624" height="967" alt="Screenshot 2025-10-20 at 14 35 56"
src="https://github.com/user-attachments/assets/5f0b36cb-47f5-4c34-9a08-41f356bcc860"
/>

**After:**

<img width="1624" height="967" alt="Screenshot 2025-10-20 at 14 35 48"
src="https://github.com/user-attachments/assets/aa3fe961-3d12-4288-9e65-2736ec856dfc"
/>

Fixes https://github.com/coder/coder/issues/20369
---
 site/static/error.html | 354 ++++++++++++++++++++---------------------
 1 file changed, 173 insertions(+), 181 deletions(-)

diff --git a/site/static/error.html b/site/static/error.html
index 405ee59d48b60..af723ebcd101d 100644
--- a/site/static/error.html
+++ b/site/static/error.html
@@ -1,187 +1,179 @@
 {{/*
-  This template is used by application handlers to render friendly error pages
-  when there is a proxy error (for example, when the target app isn't running).
+	This template is used by application handlers to render friendly error pages
+	when there is a proxy error (for example, when the target app isn't running).
 
-  Since it is served from subdomains, both on proxies and the primary, it MUST
-  NOT access any external resources. It must be entirely self-contained. This
-  includes anything in `/static` or `/icon`, as these are not served from
-  subdomains.
+	Since it is served from subdomains, both on proxies and the primary, it MUST
+	NOT access any external resources. It must be entirely self-contained. This
+	includes anything in `/static` or `/icon`, as these are not served from
+	subdomains.
 */}}
 <!doctype html>
 <html lang="en">
-  <head>
-    <meta charset="UTF-8" />
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta name="viewport" content="width=device-width, initial-scale=1.0" />
-    <title>
-      {{- if not .Error.HideStatus }}{{ .Error.Status }} - {{end}}{{
-      .Error.Title }}
-    </title>
-    <style>
-      * {
-        padding: 0;
-        margin: 0;
-        box-sizing: border-box;
-      }
-
-      html,
-      body {
-        background-color: #05060b;
-        color: #f7f9fd;
-        display: flex;
-        align-items: center;
-        justify-content: center;
-        font-family: sans-serif;
-        font-size: 16px;
-        height: 100%;
-      }
-
-      .container {
-        --side-padding: 24px;
-        width: 100%;
-        max-width: calc(500px + var(--side-padding) * 2);
-        padding: 0 var(--side-padding);
-        text-align: center;
-      }
-
-      .coder-svg {
-        width: 80px;
-        margin-bottom: 24px;
-      }
-
-      h1 {
-        font-weight: 700;
-        font-size: 36px;
-        margin-bottom: 8px;
-      }
-
-      p,
-      li {
-        color: #b2bfd7;
-        line-height: 140%;
-      }
-
-      .warning li {
-        text-align: left;
-        padding-top: 10px;
-        margin-left: 30px;
-      }
-
-      .button-group {
-        display: flex;
-        align-items: center;
-        justify-content: center;
-        gap: 12px;
-        margin-top: 24px;
-      }
-
-      .button-group a,
-      .button-group button {
-        display: inline-flex;
-        align-items: center;
-        justify-content: center;
-        padding: 6px 16px;
-        border-radius: 4px;
-        border: 1px solid #2c3854;
-        text-decoration: none;
-        background: none;
-        font-size: inherit;
-        color: inherit;
-        width: 200px;
-        height: 42px;
-        cursor: pointer;
-      }
-
-      .button-group a:hover,
-      .button-group button:hover {
-        border-color: hsl(222, 31%, 40%);
-      }
-
-      .warning {
-        margin-top: 24px;
-        border: 1px solid rgb(243, 140, 89);
-        background: rgb(13, 19, 33);
-        width: calc(520px + var(--side-padding) * 2);
-        /* Recenter */
-        margin-left: calc(-1 * (100px + var(--side-padding)));
-        padding: 10px;
-      }
-
-      .warning-title {
-        display: inline-flex;
-        align-self: center;
-        align-items: center;
-      }
-
-      .svg-icon svg {
-        height: 1em;
-        width: 1em;
-      }
-
-      .warning-title h3 {
-        margin-left: 10px;
-      }
-    </style>
-  </head>
-  <body>
-    <div class="container">
-      {{/*
-        DO NOT LOAD AN EXTERNAL IMAGE HERE. See the comment at the top of
-        this file for more details.
-      */}}
-      <svg
-        class="coder-svg"
-        viewBox="0 0 66 48"
-        fill="none"
-        xmlns="http://www.w3.org/2000/svg"
-      >
-        <path d="M18.996 7C29.9934 7.00003 36.1588 12.5745 36.3671 20.7799L26.8691 21.0919C26.6191 16.5433 22.8492 13.5554 18.996 13.6445C13.7055 13.756 9.78938 17.5243 9.78934 23.5C9.78934 29.4757 13.7054 33.1773 18.996 33.1773C22.8492 33.177 26.5357 30.323 26.9524 25.7743L36.4503 25.9974C36.2004 34.3365 29.6602 40 18.996 40C8.33164 40 0 33.5338 0 23.5C3.90577e-05 13.4216 7.9984 7 18.996 7ZM66 7.97504V39.1914H41.0058V7.97504H66Z" fill="white" />
-      </svg>
-
-      <h1>
-        {{- if not .Error.HideStatus }}{{ .Error.Status }} - {{end}}{{
-        .Error.Title }}
-      </h1>
-      {{- if .Error.RenderDescriptionMarkdown }} {{ .ErrorDescriptionHTML }} {{
-      else }}
-      <p>{{ .Error.Description }}</p>
-      {{ end }} {{- if .Error.AdditionalInfo }}
-      <br />
-      <p>{{ .Error.AdditionalInfo }}</p>
-      {{ end }} {{- if .Error.Warnings }}
-      <div class="warning">
-        <div class="warning-title">
-          <svg
-            height="1em"
-            width="auto"
-            focusable="false"
-            aria-hidden="true"
-            viewBox="0 0 24 24"
-          >
-            <path
-              fill="#e66828"
-              d="M12 5.99L19.53 19H4.47L12 5.99M12 2L1 21h22L12 2zm1 14h-2v2h2v-2zm0-6h-2v4h2v-4z"
-            ></path>
-          </svg>
-          <h3>Warnings</h3>
-        </div>
-        <ul>
-          {{ range $i, $v := .Error.Warnings }}
-          <li>{{ $v }}</li>
-          {{ end }}
-        </ul>
-      </div>
-      {{ end }}
-      <div class="button-group">
-        {{- if and .Error.AdditionalButtonText .Error.AdditionalButtonLink }}
-        <a href="{{ .Error.AdditionalButtonLink }}"
-          >{{ .Error.AdditionalButtonText }}</a
-        >
-        {{ end }} {{- if .Error.RetryEnabled }}
-        <button onclick="window.location.reload()">Retry</button>
-        {{ end }}
-        <a href="{{ .Error.DashboardURL }}">Back to site</a>
-      </div>
-    </div>
-  </body>
+	<head>
+		<meta charset="UTF-8" />
+		<meta http-equiv="X-UA-Compatible" content="IE=edge" />
+		<meta name="viewport" content="width=device-width, initial-scale=1.0" />
+		<title>
+			{{- if not .Error.HideStatus }}{{ .Error.Status }} - {{end}}{{
+			.Error.Title }}
+		</title>
+		<style>
+			* {
+				padding: 0;
+				margin: 0;
+				box-sizing: border-box;
+			}
+
+			html,
+			body {
+				background-color: #05060b;
+				color: #a1a1aa;
+				display: flex;
+				align-items: center;
+				justify-content: center;
+				font-family: sans-serif;
+				font-size: 16px;
+				height: 100%;
+			}
+
+			header {
+				text-align: center;
+			}
+
+			.container {
+				--side-padding: 24px;
+				width: 100%;
+				max-width: calc(500px + var(--side-padding) * 2);
+				padding: 0 var(--side-padding);
+			}
+
+			.coder-svg {
+				width: 80px;
+				margin-bottom: 24px;
+			}
+
+			h1 {
+				font-size: 24px;
+				margin-bottom: 8px;
+				font-weight: 400;
+				color: white;
+			}
+
+			p,
+			li {
+				line-height: 140%;
+				font-size: 14px;
+			}
+
+
+			.button-group {
+				display: flex;
+				align-items: center;
+				justify-content: center;
+				gap: 12px;
+				margin-top: 24px;
+			}
+
+			.button-group a,
+			.button-group button {
+				display: inline-flex;
+				align-items: center;
+				justify-content: center;
+				padding: 6px 16px;
+				border-radius: 4px;
+				border: 1px solid #2c3854;
+				text-decoration: none;
+				background: none;
+				font-size: inherit;
+				color: inherit;
+				width: 200px;
+				height: 42px;
+				cursor: pointer;
+			}
+
+			.button-group a:hover,
+			.button-group button:hover {
+				border-color: hsl(222, 31%, 40%);
+			}
+
+			.warning {
+				margin-top: 24px;
+				border: 1px solid rgb(243, 140, 89);
+				background: rgb(13, 19, 33);
+				width: 100%;
+				padding: 24px;
+			}
+
+			.warning-title {
+				display: inline-flex;
+				align-self: center;
+				align-items: center;
+			}
+
+			.warning-title h3 {
+				margin-left: 12px;
+				font-size: 16px;
+				font-weight: 500;
+				color: white;
+			}
+
+			.warning li {
+				padding-top: 10px;
+				margin-left: 30px;
+			}
+		</style>
+	</head>
+
+	<body>
+		<div class="container">
+			<header>
+				{{/*
+					DO NOT LOAD AN EXTERNAL IMAGE HERE. See the comment at the top of
+					this file for more details.
+				*/}}
+				<svg class="coder-svg" viewBox="0 0 66 48" fill="none" xmlns="http://www.w3.org/2000/svg">
+					<path
+						d="M18.996 7C29.9934 7.00003 36.1588 12.5745 36.3671 20.7799L26.8691 21.0919C26.6191 16.5433 22.8492 13.5554 18.996 13.6445C13.7055 13.756 9.78938 17.5243 9.78934 23.5C9.78934 29.4757 13.7054 33.1773 18.996 33.1773C22.8492 33.177 26.5357 30.323 26.9524 25.7743L36.4503 25.9974C36.2004 34.3365 29.6602 40 18.996 40C8.33164 40 0 33.5338 0 23.5C3.90577e-05 13.4216 7.9984 7 18.996 7ZM66 7.97504V39.1914H41.0058V7.97504H66Z"
+						fill="white" />
+				</svg>
+
+				<h1>
+					{{- if not .Error.HideStatus }}{{ .Error.Status }} - {{end}}{{
+					.Error.Title }}
+				</h1>
+				{{- if .Error.RenderDescriptionMarkdown }} {{ .ErrorDescriptionHTML }} {{
+				else }}
+				<p>{{ .Error.Description }}</p>
+				{{ end }} {{- if .Error.AdditionalInfo }}
+				<br />
+				<p>{{ .Error.AdditionalInfo }}</p>
+				{{ end }}
+			</header>
+
+			{{- if .Error.Warnings }}
+			<div class="warning">
+				<div class="warning-title">
+					<svg height="1em" width="auto" focusable="false" aria-hidden="true" viewBox="0 0 24 24">
+						<path fill="#e66828" d="M12 5.99L19.53 19H4.47L12 5.99M12 2L1 21h22L12 2zm1 14h-2v2h2v-2zm0-6h-2v4h2v-4z">
+						</path>
+					</svg>
+					<h3>Warnings</h3>
+				</div>
+				<ul>
+					{{ range $i, $v := .Error.Warnings }}
+					<li>{{ $v }}</li>
+					{{ end }}
+				</ul>
+			</div>
+			{{ end }}
+			<div class="button-group">
+				{{- if and .Error.AdditionalButtonText .Error.AdditionalButtonLink }}
+				<a href="{{ .Error.AdditionalButtonLink }}">{{ .Error.AdditionalButtonText }}</a>
+				{{ end }} {{- if .Error.RetryEnabled }}
+				<button onclick="window.location.reload()">Retry</button>
+				{{ end }}
+				<a href="{{ .Error.DashboardURL }}">Back to site</a>
+			</div>
+		</div>
+	</body>
 </html>

From e73f9d356bfdcebef225c7bfdc6915e4f79cfef7 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Tue, 21 Oct 2025 18:52:17 +0000
Subject: [PATCH 193/298] fix: retry embedded postgres port allocation (#20371)

Sometimes tests would fail because the port embedded postgres tries to
use is already in use. This is because there's no way to tell postgres
to use an ephemeral port in tests. This change adds retries to starting
embedded postgres when the port is not explicitly defined (e.g. tests) which
should rid of, or at least significantly reduce, these flakes.

https://github.com/coder/internal/issues/658
---
 cli/server.go | 114 +++++++++++++++++++++++++++++++++-----------------
 1 file changed, 75 insertions(+), 39 deletions(-)

diff --git a/cli/server.go b/cli/server.go
index 6edd14b7d5f1f..b12f5e0189c47 100644
--- a/cli/server.go
+++ b/cli/server.go
@@ -29,6 +29,7 @@ import (
 	"strings"
 	"sync"
 	"sync/atomic"
+	"testing"
 	"time"
 
 	"github.com/charmbracelet/lipgloss"
@@ -1377,6 +1378,7 @@ func IsLocalURL(ctx context.Context, u *url.URL) (bool, error) {
 }
 
 func shutdownWithTimeout(shutdown func(context.Context) error, timeout time.Duration) error {
+	// nolint:gocritic // The magic number is parameterized.
 	ctx, cancel := context.WithTimeout(context.Background(), timeout)
 	defer cancel()
 	return shutdown(ctx)
@@ -2134,50 +2136,83 @@ func startBuiltinPostgres(ctx context.Context, cfg config.Root, logger slog.Logg
 		return "", nil, xerrors.New("The built-in PostgreSQL cannot run as the root user. Create a non-root user and run again!")
 	}
 
-	// Ensure a password and port have been generated!
-	connectionURL, err := embeddedPostgresURL(cfg)
-	if err != nil {
-		return "", nil, err
-	}
-	pgPassword, err := cfg.PostgresPassword().Read()
-	if err != nil {
-		return "", nil, xerrors.Errorf("read postgres password: %w", err)
-	}
-	pgPortRaw, err := cfg.PostgresPort().Read()
-	if err != nil {
-		return "", nil, xerrors.Errorf("read postgres port: %w", err)
-	}
-	pgPort, err := strconv.ParseUint(pgPortRaw, 10, 16)
-	if err != nil {
-		return "", nil, xerrors.Errorf("parse postgres port: %w", err)
-	}
-
 	cachePath := filepath.Join(cfg.PostgresPath(), "cache")
 	if customCacheDir != "" {
 		cachePath = filepath.Join(customCacheDir, "postgres")
 	}
 	stdlibLogger := slog.Stdlib(ctx, logger.Named("postgres"), slog.LevelDebug)
-	ep := embeddedpostgres.NewDatabase(
-		embeddedpostgres.DefaultConfig().
-			Version(embeddedpostgres.V13).
-			BinariesPath(filepath.Join(cfg.PostgresPath(), "bin")).
-			// Default BinaryRepositoryURL repo1.maven.org is flaky.
-			BinaryRepositoryURL("https://repo.maven.apache.org/maven2").
-			DataPath(filepath.Join(cfg.PostgresPath(), "data")).
-			RuntimePath(filepath.Join(cfg.PostgresPath(), "runtime")).
-			CachePath(cachePath).
-			Username("coder").
-			Password(pgPassword).
-			Database("coder").
-			Encoding("UTF8").
-			Port(uint32(pgPort)).
-			Logger(stdlibLogger.Writer()),
-	)
-	err = ep.Start()
-	if err != nil {
-		return "", nil, xerrors.Errorf("Failed to start built-in PostgreSQL. Optionally, specify an external deployment with `--postgres-url`: %w", err)
+
+	// If the port is not defined, an available port will be found dynamically.
+	maxAttempts := 1
+	_, err = cfg.PostgresPort().Read()
+	retryPortDiscovery := errors.Is(err, os.ErrNotExist) && testing.Testing()
+	if retryPortDiscovery {
+		// There is no way to tell Postgres to use an ephemeral port, so in order to avoid
+		// flaky tests in CI we need to retry EmbeddedPostgres.Start in case of a race
+		// condition where the port we quickly listen on and close in embeddedPostgresURL()
+		// is not free by the time the embedded postgres starts up. This maximum_should
+		// cover most cases where port conflicts occur in CI and cause flaky tests.
+		maxAttempts = 3
+	}
+
+	var startErr error
+	for attempt := 0; attempt < maxAttempts; attempt++ {
+		// Ensure a password and port have been generated.
+		connectionURL, err := embeddedPostgresURL(cfg)
+		if err != nil {
+			return "", nil, err
+		}
+		pgPassword, err := cfg.PostgresPassword().Read()
+		if err != nil {
+			return "", nil, xerrors.Errorf("read postgres password: %w", err)
+		}
+		pgPortRaw, err := cfg.PostgresPort().Read()
+		if err != nil {
+			return "", nil, xerrors.Errorf("read postgres port: %w", err)
+		}
+		pgPort, err := strconv.ParseUint(pgPortRaw, 10, 16)
+		if err != nil {
+			return "", nil, xerrors.Errorf("parse postgres port: %w", err)
+		}
+
+		ep := embeddedpostgres.NewDatabase(
+			embeddedpostgres.DefaultConfig().
+				Version(embeddedpostgres.V13).
+				BinariesPath(filepath.Join(cfg.PostgresPath(), "bin")).
+				// Default BinaryRepositoryURL repo1.maven.org is flaky.
+				BinaryRepositoryURL("https://repo.maven.apache.org/maven2").
+				DataPath(filepath.Join(cfg.PostgresPath(), "data")).
+				RuntimePath(filepath.Join(cfg.PostgresPath(), "runtime")).
+				CachePath(cachePath).
+				Username("coder").
+				Password(pgPassword).
+				Database("coder").
+				Encoding("UTF8").
+				Port(uint32(pgPort)).
+				Logger(stdlibLogger.Writer()),
+		)
+
+		startErr = ep.Start()
+		if startErr == nil {
+			return connectionURL, ep.Stop, nil
+		}
+
+		logger.Warn(ctx, "failed to start embedded postgres",
+			slog.F("attempt", attempt+1),
+			slog.F("max_attempts", maxAttempts),
+			slog.F("port", pgPort),
+			slog.Error(startErr),
+		)
+
+		if retryPortDiscovery {
+			// Since a retry is needed, we wipe the port stored here at the beginning of the loop.
+			_ = cfg.PostgresPort().Delete()
+		}
 	}
-	return connectionURL, ep.Stop, nil
+
+	return "", nil, xerrors.Errorf("failed to start built-in PostgreSQL after %d attempts. "+
+		"Optionally, specify an external deployment. See https://coder.com/docs/tutorials/external-database "+
+		"for more details: %w", maxAttempts, startErr)
 }
 
 func ConfigureHTTPClient(ctx context.Context, clientCertFile, clientKeyFile string, tlsClientCAFile string) (context.Context, *http.Client, error) {
@@ -2286,7 +2321,7 @@ func ConnectToPostgres(ctx context.Context, logger slog.Logger, driver string, d
 	var err error
 	var sqlDB *sql.DB
 	dbNeedsClosing := true
-	// Try to connect for 30 seconds.
+	// nolint:gocritic // Try to connect for 30 seconds.
 	ctx, cancel := context.WithTimeout(ctx, 30*time.Second)
 	defer cancel()
 
@@ -2382,6 +2417,7 @@ func ConnectToPostgres(ctx context.Context, logger slog.Logger, driver string, d
 }
 
 func pingPostgres(ctx context.Context, db *sql.DB) error {
+	// nolint:gocritic // This is a reasonable magic number for a ping timeout.
 	ctx, cancel := context.WithTimeout(ctx, 5*time.Second)
 	defer cancel()
 	return db.PingContext(ctx)

From 9da60a9dc5835937a210f982296d892257efe9f8 Mon Sep 17 00:00:00 2001
From: Zach <3724288+zedkipp@users.noreply.github.com>
Date: Tue, 21 Oct 2025 21:10:47 +0000
Subject: [PATCH 194/298] chore: migrate from tenv linter to usetesting linter
 (#20401)

The tenv linter is deprecated in favor of usetesting which offers a
superset of lint checks. This message is seen when running `make lint`

```
[nix-shell:~/src/coder]$ make lint
<snip>
WARN The linter 'tenv' is deprecated (since v1.64.0) due to: Duplicate feature in another linter. Replaced by usetesting.
<snip>
```


This change swaps out the deprecated tenv linter for the usetesting linter,
and configures it for linting parity.


https://github.com/coder/coder/issues/20398
---
 .golangci.yaml            | 12 +++++++++++-
 coderd/util/tz/tz_test.go |  5 +----
 2 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/.golangci.yaml b/.golangci.yaml
index aeebaf47e29a6..f03007f81e847 100644
--- a/.golangci.yaml
+++ b/.golangci.yaml
@@ -169,6 +169,16 @@ linters-settings:
       - name: var-declaration
       - name: var-naming
       - name: waitgroup-by-value
+  usetesting:
+    # Only os-setenv is enabled because we migrated to usetesting from another linter that
+    # only covered os-setenv.
+    os-setenv: true
+    os-create-temp: false
+    os-mkdir-temp: false
+    os-temp-dir: false
+    os-chdir: false
+    context-background: false
+    context-todo: false
 
   # irrelevant as of Go v1.22: https://go.dev/blog/loopvar-preview
   govet:
@@ -252,7 +262,6 @@ linters:
     # - wastedassign
 
     - staticcheck
-    - tenv
     # In Go, it's possible for a package to test it's internal functionality
     # without testing any exported functions. This is enabled to promote
     # decomposing a package before testing it's internals. A function caller
@@ -265,4 +274,5 @@ linters:
     - typecheck
     - unconvert
     - unused
+    - usetesting
     - dupl
diff --git a/coderd/util/tz/tz_test.go b/coderd/util/tz/tz_test.go
index a0e7971bd7492..57d2d660ec34a 100644
--- a/coderd/util/tz/tz_test.go
+++ b/coderd/util/tz/tz_test.go
@@ -35,12 +35,9 @@ func Test_TimezoneIANA(t *testing.T) {
 			// This test can be flaky on some Windows runners :(
 			t.Skip("This test is flaky under Windows.")
 		}
-		oldEnv, found := os.LookupEnv("TZ")
+		_, found := os.LookupEnv("TZ")
 		if found {
 			require.NoError(t, os.Unsetenv("TZ"))
-			t.Cleanup(func() {
-				_ = os.Setenv("TZ", oldEnv)
-			})
 		}
 
 		zone, err := tz.TimezoneIANA()

From 69c2c405127b38703a4f8e7096e3f993f7ec4994 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Wed, 22 Oct 2025 16:18:31 +1100
Subject: [PATCH 195/298] chore: add user details to aibridge interception list
 endpoint (#20397)

- Adds FK from `aibridge_interceptions.initiator_id` to `users.id`
- This is enforced by deleting any rows that don't have any users. Since
this is an experimental feature AND coder never deletes user rows I
think this is acceptable.
- Adds `name` as a property on `codersdk.MinimalUser`
- This matches the `visible_users` view in the database. I'm unsure why
`name` wasn't already included given that `username` is.
- Adds a new `initiator` field to `codersdk.AIBridgeInterception` which
contains `codersdk.MinimalUser` (ID, username, name, avatar URL)
- Removes `initiator_id` from `codersdk.AIBridgeInterception`
    - Should be fine since we're still in early access
---
 cli/sharing_test.go                           |  4 +
 cli/testdata/coder_users_list_--help.golden   |  2 +-
 coderd/apidoc/docs.go                         | 11 ++-
 coderd/apidoc/swagger.json                    | 11 ++-
 coderd/database/db2sdk/db2sdk.go              | 15 +++-
 coderd/database/dbauthz/dbauthz.go            |  4 +-
 coderd/database/dbauthz/dbauthz_test.go       |  4 +-
 coderd/database/dbmetrics/querymetrics.go     |  4 +-
 coderd/database/dbmock/dbmock.go              |  8 +-
 coderd/database/dump.sql                      |  3 +
 coderd/database/foreign_key_constraint.go     |  1 +
 .../migrations/000385_aibridge_fks.down.sql   |  0
 .../migrations/000385_aibridge_fks.up.sql     | 49 +++++++++++
 .../testdata/fixtures/000370_aibridge.up.sql  | 81 ++++++++++++++++++-
 coderd/database/modelqueries.go               | 24 +++---
 coderd/database/querier.go                    |  2 +-
 coderd/database/queries.sql.go                | 32 +++++---
 coderd/database/queries/aibridge.sql          |  5 +-
 coderd/templateversions.go                    |  1 +
 codersdk/aibridge.go                          |  2 +-
 codersdk/users.go                             |  2 +-
 docs/reference/api/aibridge.md                |  7 +-
 docs/reference/api/schemas.md                 | 22 ++++-
 docs/reference/api/templates.md               |  9 +++
 docs/reference/api/workspaces.md              |  1 +
 docs/reference/cli/users_list.md              |  8 +-
 enterprise/coderd/aibridge.go                 | 14 +++-
 enterprise/coderd/aibridge_test.go            | 76 ++++++++++++-----
 site/src/api/typesGenerated.ts                |  4 +-
 vpn/client_test.go                            |  1 +
 30 files changed, 329 insertions(+), 78 deletions(-)
 create mode 100644 coderd/database/migrations/000385_aibridge_fks.down.sql
 create mode 100644 coderd/database/migrations/000385_aibridge_fks.up.sql

diff --git a/cli/sharing_test.go b/cli/sharing_test.go
index 71e153c64e4f6..19e185347027b 100644
--- a/cli/sharing_test.go
+++ b/cli/sharing_test.go
@@ -54,6 +54,7 @@ func TestSharingShare(t *testing.T) {
 			MinimalUser: codersdk.MinimalUser{
 				ID:        toShareWithUser.ID,
 				Username:  toShareWithUser.Username,
+				Name:      toShareWithUser.Name,
 				AvatarURL: toShareWithUser.AvatarURL,
 			},
 			Role: codersdk.WorkspaceRole("use"),
@@ -103,6 +104,7 @@ func TestSharingShare(t *testing.T) {
 			MinimalUser: codersdk.MinimalUser{
 				ID:        toShareWithUser1.ID,
 				Username:  toShareWithUser1.Username,
+				Name:      toShareWithUser1.Name,
 				AvatarURL: toShareWithUser1.AvatarURL,
 			},
 			Role: codersdk.WorkspaceRoleUse,
@@ -111,6 +113,7 @@ func TestSharingShare(t *testing.T) {
 			MinimalUser: codersdk.MinimalUser{
 				ID:        toShareWithUser2.ID,
 				Username:  toShareWithUser2.Username,
+				Name:      toShareWithUser2.Name,
 				AvatarURL: toShareWithUser2.AvatarURL,
 			},
 			Role: codersdk.WorkspaceRoleUse,
@@ -155,6 +158,7 @@ func TestSharingShare(t *testing.T) {
 			MinimalUser: codersdk.MinimalUser{
 				ID:        toShareWithUser.ID,
 				Username:  toShareWithUser.Username,
+				Name:      toShareWithUser.Name,
 				AvatarURL: toShareWithUser.AvatarURL,
 			},
 			Role: codersdk.WorkspaceRoleAdmin,
diff --git a/cli/testdata/coder_users_list_--help.golden b/cli/testdata/coder_users_list_--help.golden
index 22c1fe172faf5..e446d63a36d7f 100644
--- a/cli/testdata/coder_users_list_--help.golden
+++ b/cli/testdata/coder_users_list_--help.golden
@@ -8,7 +8,7 @@ USAGE:
   Aliases: ls
 
 OPTIONS:
-  -c, --column [id|username|email|created at|updated at|status] (default: username,email,created at,status)
+  -c, --column [id|username|name|email|created at|updated at|status] (default: username,email,created at,status)
           Columns to display in table output.
 
       --github-user-id int
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 6c5cb1506faea..585cc22710b61 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11687,9 +11687,8 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
-                "initiator_id": {
-                    "type": "string",
-                    "format": "uuid"
+                "initiator": {
+                    "$ref": "#/definitions/codersdk.MinimalUser"
                 },
                 "metadata": {
                     "type": "object",
@@ -15071,6 +15070,9 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
+                "name": {
+                    "type": "string"
+                },
                 "username": {
                     "type": "string"
                 }
@@ -20895,6 +20897,9 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
+                "name": {
+                    "type": "string"
+                },
                 "role": {
                     "enum": [
                         "admin",
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 1b492d7649e65..ac25626a03b2b 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10387,9 +10387,8 @@
 					"type": "string",
 					"format": "uuid"
 				},
-				"initiator_id": {
-					"type": "string",
-					"format": "uuid"
+				"initiator": {
+					"$ref": "#/definitions/codersdk.MinimalUser"
 				},
 				"metadata": {
 					"type": "object",
@@ -13633,6 +13632,9 @@
 					"type": "string",
 					"format": "uuid"
 				},
+				"name": {
+					"type": "string"
+				},
 				"username": {
 					"type": "string"
 				}
@@ -19211,6 +19213,9 @@
 					"type": "string",
 					"format": "uuid"
 				},
+				"name": {
+					"type": "string"
+				},
 				"role": {
 					"enum": ["admin", "use"],
 					"allOf": [
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index f28fa00407622..77ddcbbf4aecb 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -189,6 +189,16 @@ func MinimalUser(user database.User) codersdk.MinimalUser {
 	return codersdk.MinimalUser{
 		ID:        user.ID,
 		Username:  user.Username,
+		Name:      user.Name,
+		AvatarURL: user.AvatarURL,
+	}
+}
+
+func MinimalUserFromVisibleUser(user database.VisibleUser) codersdk.MinimalUser {
+	return codersdk.MinimalUser{
+		ID:        user.ID,
+		Username:  user.Username,
+		Name:      user.Name,
 		AvatarURL: user.AvatarURL,
 	}
 }
@@ -197,7 +207,6 @@ func ReducedUser(user database.User) codersdk.ReducedUser {
 	return codersdk.ReducedUser{
 		MinimalUser: MinimalUser(user),
 		Email:       user.Email,
-		Name:        user.Name,
 		CreatedAt:   user.CreatedAt,
 		UpdatedAt:   user.UpdatedAt,
 		LastSeenAt:  user.LastSeenAt,
@@ -927,7 +936,7 @@ func PreviewParameterValidation(v *previewtypes.ParameterValidation) codersdk.Pr
 	}
 }
 
-func AIBridgeInterception(interception database.AIBridgeInterception, tokenUsages []database.AIBridgeTokenUsage, userPrompts []database.AIBridgeUserPrompt, toolUsages []database.AIBridgeToolUsage) codersdk.AIBridgeInterception {
+func AIBridgeInterception(interception database.AIBridgeInterception, initiator database.VisibleUser, tokenUsages []database.AIBridgeTokenUsage, userPrompts []database.AIBridgeUserPrompt, toolUsages []database.AIBridgeToolUsage) codersdk.AIBridgeInterception {
 	sdkTokenUsages := List(tokenUsages, AIBridgeTokenUsage)
 	sort.Slice(sdkTokenUsages, func(i, j int) bool {
 		// created_at ASC
@@ -945,7 +954,7 @@ func AIBridgeInterception(interception database.AIBridgeInterception, tokenUsage
 	})
 	return codersdk.AIBridgeInterception{
 		ID:          interception.ID,
-		InitiatorID: interception.InitiatorID,
+		Initiator:   MinimalUserFromVisibleUser(initiator),
 		Provider:    interception.Provider,
 		Model:       interception.Model,
 		Metadata:    jsonOrEmptyMap(interception.Metadata),
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index ccd6151e88bbd..f1b262047ab7b 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -4461,7 +4461,7 @@ func (q *querier) InsertWorkspaceResourceMetadata(ctx context.Context, arg datab
 	return q.db.InsertWorkspaceResourceMetadata(ctx, arg)
 }
 
-func (q *querier) ListAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams) ([]database.AIBridgeInterception, error) {
+func (q *querier) ListAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams) ([]database.ListAIBridgeInterceptionsRow, error) {
 	prep, err := prepareSQLFilter(ctx, q.auth, policy.ActionRead, rbac.ResourceAibridgeInterception.Type)
 	if err != nil {
 		return nil, xerrors.Errorf("(dev error) prepare sql filter: %w", err)
@@ -5870,7 +5870,7 @@ func (q *querier) CountAuthorizedConnectionLogs(ctx context.Context, arg databas
 	return q.CountConnectionLogs(ctx, arg)
 }
 
-func (q *querier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams, _ rbac.PreparedAuthorized) ([]database.AIBridgeInterception, error) {
+func (q *querier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams, _ rbac.PreparedAuthorized) ([]database.ListAIBridgeInterceptionsRow, error) {
 	// TODO: Delete this function, all ListAIBridgeInterceptions should be authorized. For now just call ListAIBridgeInterceptions on the authz querier.
 	// This cannot be deleted for now because it's included in the
 	// database.Store interface, so dbauthz needs to implement it.
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 1137aa250d789..feb78215c5d29 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -4537,14 +4537,14 @@ func (s *MethodTestSuite) TestAIBridge() {
 
 	s.Run("ListAIBridgeInterceptions", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		params := database.ListAIBridgeInterceptionsParams{}
-		db.EXPECT().ListAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return([]database.AIBridgeInterception{}, nil).AnyTimes()
+		db.EXPECT().ListAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return([]database.ListAIBridgeInterceptionsRow{}, nil).AnyTimes()
 		// No asserts here because SQLFilter.
 		check.Args(params).Asserts()
 	}))
 
 	s.Run("ListAuthorizedAIBridgeInterceptions", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		params := database.ListAIBridgeInterceptionsParams{}
-		db.EXPECT().ListAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return([]database.AIBridgeInterception{}, nil).AnyTimes()
+		db.EXPECT().ListAuthorizedAIBridgeInterceptions(gomock.Any(), params, gomock.Any()).Return([]database.ListAIBridgeInterceptionsRow{}, nil).AnyTimes()
 		// No asserts here because SQLFilter.
 		check.Args(params, emptyPreparedAuthorized{}).Asserts()
 	}))
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index cdcc675c918ae..9b678a8e278d0 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -2714,7 +2714,7 @@ func (m queryMetricsStore) InsertWorkspaceResourceMetadata(ctx context.Context,
 	return metadata, err
 }
 
-func (m queryMetricsStore) ListAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams) ([]database.AIBridgeInterception, error) {
+func (m queryMetricsStore) ListAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams) ([]database.ListAIBridgeInterceptionsRow, error) {
 	start := time.Now()
 	r0, r1 := m.s.ListAIBridgeInterceptions(ctx, arg)
 	m.queryLatencies.WithLabelValues("ListAIBridgeInterceptions").Observe(time.Since(start).Seconds())
@@ -3722,7 +3722,7 @@ func (m queryMetricsStore) CountAuthorizedConnectionLogs(ctx context.Context, ar
 	return r0, r1
 }
 
-func (m queryMetricsStore) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]database.AIBridgeInterception, error) {
+func (m queryMetricsStore) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]database.ListAIBridgeInterceptionsRow, error) {
 	start := time.Now()
 	r0, r1 := m.s.ListAuthorizedAIBridgeInterceptions(ctx, arg, prepared)
 	m.queryLatencies.WithLabelValues("ListAuthorizedAIBridgeInterceptions").Observe(time.Since(start).Seconds())
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 89099b6e7142f..06b7f7ae3efe9 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -5804,10 +5804,10 @@ func (mr *MockStoreMockRecorder) InsertWorkspaceResourceMetadata(ctx, arg any) *
 }
 
 // ListAIBridgeInterceptions mocks base method.
-func (m *MockStore) ListAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams) ([]database.AIBridgeInterception, error) {
+func (m *MockStore) ListAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams) ([]database.ListAIBridgeInterceptionsRow, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ListAIBridgeInterceptions", ctx, arg)
-	ret0, _ := ret[0].([]database.AIBridgeInterception)
+	ret0, _ := ret[0].([]database.ListAIBridgeInterceptionsRow)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
@@ -5864,10 +5864,10 @@ func (mr *MockStoreMockRecorder) ListAIBridgeUserPromptsByInterceptionIDs(ctx, i
 }
 
 // ListAuthorizedAIBridgeInterceptions mocks base method.
-func (m *MockStore) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]database.AIBridgeInterception, error) {
+func (m *MockStore) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg database.ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]database.ListAIBridgeInterceptionsRow, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "ListAuthorizedAIBridgeInterceptions", ctx, arg, prepared)
-	ret0, _ := ret[0].([]database.AIBridgeInterception)
+	ret0, _ := ret[0].([]database.ListAIBridgeInterceptionsRow)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 323b595c10713..a01ddb8d1fa7d 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -3511,6 +3511,9 @@ COMMENT ON TRIGGER workspace_agent_name_unique_trigger ON workspace_agents IS 'U
 the uniqueness requirement. A trigger allows us to enforce uniqueness going
 forward without requiring a migration to clean up historical data.';
 
+ALTER TABLE ONLY aibridge_interceptions
+    ADD CONSTRAINT aibridge_interceptions_initiator_id_fkey FOREIGN KEY (initiator_id) REFERENCES users(id);
+
 ALTER TABLE ONLY api_keys
     ADD CONSTRAINT api_keys_user_id_uuid_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 
diff --git a/coderd/database/foreign_key_constraint.go b/coderd/database/foreign_key_constraint.go
index 4c629797d11d7..6737275dd340e 100644
--- a/coderd/database/foreign_key_constraint.go
+++ b/coderd/database/foreign_key_constraint.go
@@ -6,6 +6,7 @@ type ForeignKeyConstraint string
 
 // ForeignKeyConstraint enums.
 const (
+	ForeignKeyAibridgeInterceptionsInitiatorID                    ForeignKeyConstraint = "aibridge_interceptions_initiator_id_fkey"                        // ALTER TABLE ONLY aibridge_interceptions ADD CONSTRAINT aibridge_interceptions_initiator_id_fkey FOREIGN KEY (initiator_id) REFERENCES users(id);
 	ForeignKeyAPIKeysUserIDUUID                                   ForeignKeyConstraint = "api_keys_user_id_uuid_fkey"                                      // ALTER TABLE ONLY api_keys ADD CONSTRAINT api_keys_user_id_uuid_fkey FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE;
 	ForeignKeyConnectionLogsOrganizationID                        ForeignKeyConstraint = "connection_logs_organization_id_fkey"                            // ALTER TABLE ONLY connection_logs ADD CONSTRAINT connection_logs_organization_id_fkey FOREIGN KEY (organization_id) REFERENCES organizations(id) ON DELETE CASCADE;
 	ForeignKeyConnectionLogsWorkspaceID                           ForeignKeyConstraint = "connection_logs_workspace_id_fkey"                               // ALTER TABLE ONLY connection_logs ADD CONSTRAINT connection_logs_workspace_id_fkey FOREIGN KEY (workspace_id) REFERENCES workspaces(id) ON DELETE CASCADE;
diff --git a/coderd/database/migrations/000385_aibridge_fks.down.sql b/coderd/database/migrations/000385_aibridge_fks.down.sql
new file mode 100644
index 0000000000000..e69de29bb2d1d
diff --git a/coderd/database/migrations/000385_aibridge_fks.up.sql b/coderd/database/migrations/000385_aibridge_fks.up.sql
new file mode 100644
index 0000000000000..cc9cfbfdd93e4
--- /dev/null
+++ b/coderd/database/migrations/000385_aibridge_fks.up.sql
@@ -0,0 +1,49 @@
+-- We didn't add an FK as a premature optimization when the aibridge tables were
+-- added, but for the initiator_id it's pretty annoying not having a strong
+-- reference.
+--
+-- Since the aibridge feature is still in early access, we're going to add the
+-- FK and drop any rows that violate it (which should be none). This isn't a
+-- very efficient migration, but since the feature is behind an experimental
+-- flag, it shouldn't have any impact on deployments that aren't using the
+-- feature.
+
+-- Step 1: Add FK without validating it
+ALTER TABLE aibridge_interceptions
+    ADD CONSTRAINT aibridge_interceptions_initiator_id_fkey
+    FOREIGN KEY (initiator_id)
+    REFERENCES users(id)
+    -- We can't:
+    -- - Cascade delete because this is an auditing feature, and it also
+    --   wouldn't delete related aibridge rows since we don't FK them.
+    -- - Set null because you can't correlate to the original user ID if the
+    --   user somehow gets deleted.
+    --
+    -- So we just use the default and don't do anything. This will result in a
+    -- deferred constraint violation error when the user is deleted.
+    --
+    -- In Coder, we don't delete user rows ever, so this should never happen
+    -- unless an admin manually deletes a user with SQL.
+    ON DELETE NO ACTION
+    -- Delay validation of existing data until after we've dropped rows that
+    -- violate the FK.
+    NOT VALID;
+
+-- Step 2: Drop existing interceptions that violate the FK.
+DELETE FROM aibridge_interceptions
+WHERE initiator_id NOT IN (SELECT id FROM users);
+
+-- Step 3: Drop existing rows from other tables that no longer have a valid
+--         interception in the database.
+DELETE FROM aibridge_token_usages
+WHERE interception_id NOT IN (SELECT id FROM aibridge_interceptions);
+
+DELETE FROM aibridge_user_prompts
+WHERE interception_id NOT IN (SELECT id FROM aibridge_interceptions);
+
+DELETE FROM aibridge_tool_usages
+WHERE interception_id NOT IN (SELECT id FROM aibridge_interceptions);
+
+-- Step 4: Validate the FK
+ALTER TABLE aibridge_interceptions
+    VALIDATE CONSTRAINT aibridge_interceptions_initiator_id_fkey;
diff --git a/coderd/database/migrations/testdata/fixtures/000370_aibridge.up.sql b/coderd/database/migrations/testdata/fixtures/000370_aibridge.up.sql
index 0a66555eea0f1..ef49405ae6f73 100644
--- a/coderd/database/migrations/testdata/fixtures/000370_aibridge.up.sql
+++ b/coderd/database/migrations/testdata/fixtures/000370_aibridge.up.sql
@@ -8,7 +8,7 @@ INSERT INTO
     )
 VALUES (
         'be003e1e-b38f-43bf-847d-928074dd0aa8',
-        '30095c71-380b-457a-8995-97b8ee6e5307',
+        '30095c71-380b-457a-8995-97b8ee6e5307', -- admin@coder.com, from 000022_initial_v0.6.6.up.sql
         'openai',
         'gpt-5',
         '2025-09-15 12:45:13.921148+00'
@@ -77,3 +77,82 @@ VALUES (
         '{}',
         '2025-09-15 12:45:21.674335+00'
     );
+
+-- For a later migration, we'll add an invalid interception without a valid
+-- initiator_id.
+INSERT INTO
+    aibridge_interceptions (
+        id,
+        initiator_id,
+        provider,
+        model,
+        started_at
+    )
+VALUES (
+        'c6d29c6e-26a3-4137-bb2e-9dfeef3c1c26',
+        'cab8d56a-8922-4999-81a9-046b43ac1312', -- user does not exist
+        'openai',
+        'gpt-5',
+        '2025-09-15 12:45:13.921148+00'
+    );
+INSERT INTO
+    aibridge_token_usages (
+        id,
+        interception_id,
+        provider_response_id,
+        input_tokens,
+        output_tokens,
+        metadata,
+        created_at
+    )
+VALUES (
+        '5650db6c-0b7c-49e3-bb26-9b2ba0107e11',
+        'c6d29c6e-26a3-4137-bb2e-9dfeef3c1c26',
+        'chatcmpl-CG2s28QlpKIoooUtXuLTmGbdtyS1k',
+        10950,
+        118,
+        '{}',
+        '2025-09-15 12:45:21.674413+00'
+    );
+INSERT INTO
+    aibridge_user_prompts (
+        id,
+        interception_id,
+        provider_response_id,
+        prompt,
+        metadata,
+        created_at
+    )
+VALUES (
+        '1e76cb5b-7c34-4160-b604-a4256f856169',
+        'c6d29c6e-26a3-4137-bb2e-9dfeef3c1c26',
+        'chatcmpl-CG2s28QlpKIoooUtXuLTmGbdtyS1k',
+        'how many workspaces do i have',
+        '{}',
+        '2025-09-15 12:45:21.674335+00'
+    );
+INSERT INTO
+    aibridge_tool_usages (
+        id,
+        interception_id,
+        provider_response_id,
+        tool,
+        server_url,
+        input,
+        injected,
+        invocation_error,
+        metadata,
+        created_at
+    )
+VALUES (
+        '351b440f-d605-4f37-8ceb-011f0377b695',
+        'c6d29c6e-26a3-4137-bb2e-9dfeef3c1c26',
+        'chatcmpl-CG2s28QlpKIoooUtXuLTmGbdtyS1k',
+        'coder_list_workspaces',
+        'http://localhost:3000/api/experimental/mcp/http',
+        '{}',
+        true,
+        NULL,
+        '{}',
+        '2025-09-15 12:45:21.674413+00'
+    );
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
index 654dfb8b37b1d..1400893a26fc3 100644
--- a/coderd/database/modelqueries.go
+++ b/coderd/database/modelqueries.go
@@ -763,11 +763,11 @@ func (q *sqlQuerier) CountAuthorizedConnectionLogs(ctx context.Context, arg Coun
 }
 
 type aibridgeQuerier interface {
-	ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error)
+	ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]ListAIBridgeInterceptionsRow, error)
 	CountAuthorizedAIBridgeInterceptions(ctx context.Context, arg CountAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) (int64, error)
 }
 
-func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]AIBridgeInterception, error) {
+func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams, prepared rbac.PreparedAuthorized) ([]ListAIBridgeInterceptionsRow, error) {
 	authorizedFilter, err := prepared.CompileToSQL(ctx, regosql.ConvertConfig{
 		VariableConverter: regosql.AIBridgeInterceptionConverter(),
 	})
@@ -794,16 +794,20 @@ func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, ar
 		return nil, err
 	}
 	defer rows.Close()
-	var items []AIBridgeInterception
+	var items []ListAIBridgeInterceptionsRow
 	for rows.Next() {
-		var i AIBridgeInterception
+		var i ListAIBridgeInterceptionsRow
 		if err := rows.Scan(
-			&i.ID,
-			&i.InitiatorID,
-			&i.Provider,
-			&i.Model,
-			&i.StartedAt,
-			&i.Metadata,
+			&i.AIBridgeInterception.ID,
+			&i.AIBridgeInterception.InitiatorID,
+			&i.AIBridgeInterception.Provider,
+			&i.AIBridgeInterception.Model,
+			&i.AIBridgeInterception.StartedAt,
+			&i.AIBridgeInterception.Metadata,
+			&i.VisibleUser.ID,
+			&i.VisibleUser.Username,
+			&i.VisibleUser.Name,
+			&i.VisibleUser.AvatarURL,
 		); err != nil {
 			return nil, err
 		}
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 3e2d655f44495..3a832752977d5 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -592,7 +592,7 @@ type sqlcQuerier interface {
 	InsertWorkspaceProxy(ctx context.Context, arg InsertWorkspaceProxyParams) (WorkspaceProxy, error)
 	InsertWorkspaceResource(ctx context.Context, arg InsertWorkspaceResourceParams) (WorkspaceResource, error)
 	InsertWorkspaceResourceMetadata(ctx context.Context, arg InsertWorkspaceResourceMetadataParams) ([]WorkspaceResourceMetadatum, error)
-	ListAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams) ([]AIBridgeInterception, error)
+	ListAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams) ([]ListAIBridgeInterceptionsRow, error)
 	ListAIBridgeTokenUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeTokenUsage, error)
 	ListAIBridgeToolUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeToolUsage, error)
 	ListAIBridgeUserPromptsByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeUserPrompt, error)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index c0fd6eb64dc6d..5b4cf7b21e079 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -528,9 +528,12 @@ func (q *sqlQuerier) InsertAIBridgeUserPrompt(ctx context.Context, arg InsertAIB
 
 const listAIBridgeInterceptions = `-- name: ListAIBridgeInterceptions :many
 SELECT
-	id, initiator_id, provider, model, started_at, metadata
+	aibridge_interceptions.id, aibridge_interceptions.initiator_id, aibridge_interceptions.provider, aibridge_interceptions.model, aibridge_interceptions.started_at, aibridge_interceptions.metadata,
+	visible_users.id, visible_users.username, visible_users.name, visible_users.avatar_url
 FROM
 	aibridge_interceptions
+JOIN
+	visible_users ON visible_users.id = aibridge_interceptions.initiator_id
 WHERE
 	-- Filter by time frame
 	CASE
@@ -592,7 +595,12 @@ type ListAIBridgeInterceptionsParams struct {
 	Limit         int32     `db:"limit_" json:"limit_"`
 }
 
-func (q *sqlQuerier) ListAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams) ([]AIBridgeInterception, error) {
+type ListAIBridgeInterceptionsRow struct {
+	AIBridgeInterception AIBridgeInterception `db:"aibridge_interception" json:"aibridge_interception"`
+	VisibleUser          VisibleUser          `db:"visible_user" json:"visible_user"`
+}
+
+func (q *sqlQuerier) ListAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams) ([]ListAIBridgeInterceptionsRow, error) {
 	rows, err := q.db.QueryContext(ctx, listAIBridgeInterceptions,
 		arg.StartedAfter,
 		arg.StartedBefore,
@@ -607,16 +615,20 @@ func (q *sqlQuerier) ListAIBridgeInterceptions(ctx context.Context, arg ListAIBr
 		return nil, err
 	}
 	defer rows.Close()
-	var items []AIBridgeInterception
+	var items []ListAIBridgeInterceptionsRow
 	for rows.Next() {
-		var i AIBridgeInterception
+		var i ListAIBridgeInterceptionsRow
 		if err := rows.Scan(
-			&i.ID,
-			&i.InitiatorID,
-			&i.Provider,
-			&i.Model,
-			&i.StartedAt,
-			&i.Metadata,
+			&i.AIBridgeInterception.ID,
+			&i.AIBridgeInterception.InitiatorID,
+			&i.AIBridgeInterception.Provider,
+			&i.AIBridgeInterception.Model,
+			&i.AIBridgeInterception.StartedAt,
+			&i.AIBridgeInterception.Metadata,
+			&i.VisibleUser.ID,
+			&i.VisibleUser.Username,
+			&i.VisibleUser.Name,
+			&i.VisibleUser.AvatarURL,
 		); err != nil {
 			return nil, err
 		}
diff --git a/coderd/database/queries/aibridge.sql b/coderd/database/queries/aibridge.sql
index 32e0246447ce7..3a3b63b84831c 100644
--- a/coderd/database/queries/aibridge.sql
+++ b/coderd/database/queries/aibridge.sql
@@ -111,9 +111,12 @@ WHERE
 
 -- name: ListAIBridgeInterceptions :many
 SELECT
-	*
+	sqlc.embed(aibridge_interceptions),
+	sqlc.embed(visible_users)
 FROM
 	aibridge_interceptions
+JOIN
+	visible_users ON visible_users.id = aibridge_interceptions.initiator_id
 WHERE
 	-- Filter by time frame
 	CASE
diff --git a/coderd/templateversions.go b/coderd/templateversions.go
index 17a4d9b451e9c..2e959702fbde5 100644
--- a/coderd/templateversions.go
+++ b/coderd/templateversions.go
@@ -1958,6 +1958,7 @@ func convertTemplateVersion(version database.TemplateVersion, job codersdk.Provi
 		CreatedBy: codersdk.MinimalUser{
 			ID:        version.CreatedBy,
 			Username:  version.CreatedByUsername,
+			Name:      version.CreatedByName,
 			AvatarURL: version.CreatedByAvatarURL,
 		},
 		Archived:            version.Archived,
diff --git a/codersdk/aibridge.go b/codersdk/aibridge.go
index 05f1e1a6fc936..0a6e85c94782c 100644
--- a/codersdk/aibridge.go
+++ b/codersdk/aibridge.go
@@ -13,7 +13,7 @@ import (
 
 type AIBridgeInterception struct {
 	ID          uuid.UUID            `json:"id" format:"uuid"`
-	InitiatorID uuid.UUID            `json:"initiator_id" format:"uuid"`
+	Initiator   MinimalUser          `json:"initiator"`
 	Provider    string               `json:"provider"`
 	Model       string               `json:"model"`
 	Metadata    map[string]any       `json:"metadata"`
diff --git a/codersdk/users.go b/codersdk/users.go
index 266ef8c59873e..44464f9476ddd 100644
--- a/codersdk/users.go
+++ b/codersdk/users.go
@@ -41,6 +41,7 @@ type UsersRequest struct {
 type MinimalUser struct {
 	ID        uuid.UUID `json:"id" validate:"required" table:"id" format:"uuid"`
 	Username  string    `json:"username" validate:"required" table:"username,default_sort"`
+	Name      string    `json:"name,omitempty" table:"name"`
 	AvatarURL string    `json:"avatar_url,omitempty" format:"uri"`
 }
 
@@ -50,7 +51,6 @@ type MinimalUser struct {
 // required by the frontend.
 type ReducedUser struct {
 	MinimalUser `table:"m,recursive_inline"`
-	Name        string    `json:"name,omitempty"`
 	Email       string    `json:"email" validate:"required" table:"email" format:"email"`
 	CreatedAt   time.Time `json:"created_at" validate:"required" table:"created at" format:"date-time"`
 	UpdatedAt   time.Time `json:"updated_at" table:"updated at" format:"date-time"`
diff --git a/docs/reference/api/aibridge.md b/docs/reference/api/aibridge.md
index 35af663993f66..54f408ec23995 100644
--- a/docs/reference/api/aibridge.md
+++ b/docs/reference/api/aibridge.md
@@ -31,7 +31,12 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/intercepti
   "results": [
     {
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
+      "initiator": {
+        "avatar_url": "http://example.com",
+        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+        "name": "string",
+        "username": "string"
+      },
       "metadata": {
         "property1": null,
         "property2": null
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 654dc0f45bfb3..a36199a6f6be0 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -436,7 +436,12 @@
 ```json
 {
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-  "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
+  "initiator": {
+    "avatar_url": "http://example.com",
+    "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
+    "username": "string"
+  },
   "metadata": {
     "property1": null,
     "property2": null
@@ -496,7 +501,7 @@
 | Name               | Type                                                                | Required | Restrictions | Description |
 |--------------------|---------------------------------------------------------------------|----------|--------------|-------------|
 | `id`               | string                                                              | false    |              |             |
-| `initiator_id`     | string                                                              | false    |              |             |
+| `initiator`        | [codersdk.MinimalUser](#codersdkminimaluser)                        | false    |              |             |
 | `metadata`         | object                                                              | false    |              |             |
 | » `[any property]` | any                                                                 | false    |              |             |
 | `model`            | string                                                              | false    |              |             |
@@ -513,7 +518,12 @@
   "results": [
     {
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-      "initiator_id": "06588898-9a84-4b35-ba8f-f9cbd64946f3",
+      "initiator": {
+        "avatar_url": "http://example.com",
+        "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+        "name": "string",
+        "username": "string"
+      },
       "metadata": {
         "property1": null,
         "property2": null
@@ -4947,6 +4957,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 {
   "avatar_url": "http://example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "name": "string",
   "username": "string"
 }
 ```
@@ -4957,6 +4968,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 |--------------|--------|----------|--------------|-------------|
 | `avatar_url` | string | false    |              |             |
 | `id`         | string | true     |              |             |
+| `name`       | string | false    |              |             |
 | `username`   | string | true     |              |             |
 
 ## codersdk.NotificationMethodsResponse
@@ -8558,6 +8570,7 @@ Restarts will only happen on weekdays in this list on weeks which line up with W
   "created_by": {
     "avatar_url": "http://example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
     "username": "string"
   },
   "has_external_agent": true,
@@ -10129,6 +10142,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     {
       "avatar_url": "http://example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "name": "string",
       "role": "admin",
       "username": "string"
     }
@@ -11769,6 +11783,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 {
   "avatar_url": "http://example.com",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+  "name": "string",
   "role": "admin",
   "username": "string"
 }
@@ -11780,6 +11795,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 |--------------|--------------------------------------------------|----------|--------------|-------------|
 | `avatar_url` | string                                           | false    |              |             |
 | `id`         | string                                           | true     |              |             |
+| `name`       | string                                           | false    |              |             |
 | `role`       | [codersdk.WorkspaceRole](#codersdkworkspacerole) | false    |              |             |
 | `username`   | string                                           | true     |              |             |
 
diff --git a/docs/reference/api/templates.md b/docs/reference/api/templates.md
index 9d69949ac7cf9..2c516f4788b4d 100644
--- a/docs/reference/api/templates.md
+++ b/docs/reference/api/templates.md
@@ -460,6 +460,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
   "created_by": {
     "avatar_url": "http://example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
     "username": "string"
   },
   "has_external_agent": true,
@@ -561,6 +562,7 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/templat
   "created_by": {
     "avatar_url": "http://example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
     "username": "string"
   },
   "has_external_agent": true,
@@ -686,6 +688,7 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/templa
   "created_by": {
     "avatar_url": "http://example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
     "username": "string"
   },
   "has_external_agent": true,
@@ -1294,6 +1297,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions \
     "created_by": {
       "avatar_url": "http://example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "name": "string",
       "username": "string"
     },
     "has_external_agent": true,
@@ -1374,6 +1378,7 @@ Status Code **200**
 | `» created_by`              | [codersdk.MinimalUser](schemas.md#codersdkminimaluser)                       | false    |              |                                                                                                                                                                     |
 | `»» avatar_url`             | string(uri)                                                                  | false    |              |                                                                                                                                                                     |
 | `»» id`                     | string(uuid)                                                                 | true     |              |                                                                                                                                                                     |
+| `»» name`                   | string                                                                       | false    |              |                                                                                                                                                                     |
 | `»» username`               | string                                                                       | true     |              |                                                                                                                                                                     |
 | `» has_external_agent`      | boolean                                                                      | false    |              |                                                                                                                                                                     |
 | `» id`                      | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
@@ -1579,6 +1584,7 @@ curl -X GET http://coder-server:8080/api/v2/templates/{template}/versions/{templ
     "created_by": {
       "avatar_url": "http://example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "name": "string",
       "username": "string"
     },
     "has_external_agent": true,
@@ -1659,6 +1665,7 @@ Status Code **200**
 | `» created_by`              | [codersdk.MinimalUser](schemas.md#codersdkminimaluser)                       | false    |              |                                                                                                                                                                     |
 | `»» avatar_url`             | string(uri)                                                                  | false    |              |                                                                                                                                                                     |
 | `»» id`                     | string(uuid)                                                                 | true     |              |                                                                                                                                                                     |
+| `»» name`                   | string                                                                       | false    |              |                                                                                                                                                                     |
 | `»» username`               | string                                                                       | true     |              |                                                                                                                                                                     |
 | `» has_external_agent`      | boolean                                                                      | false    |              |                                                                                                                                                                     |
 | `» id`                      | string(uuid)                                                                 | false    |              |                                                                                                                                                                     |
@@ -1754,6 +1761,7 @@ curl -X GET http://coder-server:8080/api/v2/templateversions/{templateversion} \
   "created_by": {
     "avatar_url": "http://example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
     "username": "string"
   },
   "has_external_agent": true,
@@ -1864,6 +1872,7 @@ curl -X PATCH http://coder-server:8080/api/v2/templateversions/{templateversion}
   "created_by": {
     "avatar_url": "http://example.com",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+    "name": "string",
     "username": "string"
   },
   "has_external_agent": true,
diff --git a/docs/reference/api/workspaces.md b/docs/reference/api/workspaces.md
index e2a95613ed263..86c04f79c413c 100644
--- a/docs/reference/api/workspaces.md
+++ b/docs/reference/api/workspaces.md
@@ -1588,6 +1588,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/acl \
     {
       "avatar_url": "http://example.com",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "name": "string",
       "role": "admin",
       "username": "string"
     }
diff --git a/docs/reference/cli/users_list.md b/docs/reference/cli/users_list.md
index 93122e7741072..7217a8267b760 100644
--- a/docs/reference/cli/users_list.md
+++ b/docs/reference/cli/users_list.md
@@ -25,10 +25,10 @@ Filter users by their GitHub user ID.
 
 ### -c, --column
 
-|         |                                                                    |
-|---------|--------------------------------------------------------------------|
-| Type    | <code>[id\|username\|email\|created at\|updated at\|status]</code> |
-| Default | <code>username,email,created at,status</code>                      |
+|         |                                                                          |
+|---------|--------------------------------------------------------------------------|
+| Type    | <code>[id\|username\|name\|email\|created at\|updated at\|status]</code> |
+| Default | <code>username,email,created at,status</code>                            |
 
 Columns to display in table output.
 
diff --git a/enterprise/coderd/aibridge.go b/enterprise/coderd/aibridge.go
index 878e8ac74163e..2c28745c95a8a 100644
--- a/enterprise/coderd/aibridge.go
+++ b/enterprise/coderd/aibridge.go
@@ -75,7 +75,7 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 
 	var (
 		count int64
-		rows  []database.AIBridgeInterception
+		rows  []database.ListAIBridgeInterceptionsRow
 	)
 	err := api.Database.InTx(func(db database.Store) error {
 		// Ensure the after_id interception exists and is visible to the user.
@@ -132,10 +132,10 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 	})
 }
 
-func populatedAndConvertAIBridgeInterceptions(ctx context.Context, db database.Store, dbInterceptions []database.AIBridgeInterception) ([]codersdk.AIBridgeInterception, error) {
+func populatedAndConvertAIBridgeInterceptions(ctx context.Context, db database.Store, dbInterceptions []database.ListAIBridgeInterceptionsRow) ([]codersdk.AIBridgeInterception, error) {
 	ids := make([]uuid.UUID, len(dbInterceptions))
 	for i, row := range dbInterceptions {
-		ids[i] = row.ID
+		ids[i] = row.AIBridgeInterception.ID
 	}
 
 	//nolint:gocritic // This is a system function until we implement a join for aibridge interceptions. AIBridge interception subresources use the same authorization call as their parent.
@@ -170,7 +170,13 @@ func populatedAndConvertAIBridgeInterceptions(ctx context.Context, db database.S
 
 	items := make([]codersdk.AIBridgeInterception, len(dbInterceptions))
 	for i, row := range dbInterceptions {
-		items[i] = db2sdk.AIBridgeInterception(row, tokenUsagesMap[row.ID], userPromptsMap[row.ID], toolUsagesMap[row.ID])
+		items[i] = db2sdk.AIBridgeInterception(
+			row.AIBridgeInterception,
+			row.VisibleUser,
+			tokenUsagesMap[row.AIBridgeInterception.ID],
+			userPromptsMap[row.AIBridgeInterception.ID],
+			toolUsagesMap[row.AIBridgeInterception.ID],
+		)
 	}
 
 	return items, nil
diff --git a/enterprise/coderd/aibridge_test.go b/enterprise/coderd/aibridge_test.go
index 4d8cac139de0c..232cfd7072e77 100644
--- a/enterprise/coderd/aibridge_test.go
+++ b/enterprise/coderd/aibridge_test.go
@@ -72,7 +72,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		t.Parallel()
 		dv := coderdtest.DeploymentValues(t)
 		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
-		client, db, _ := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
+		client, db, firstUser := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
 			},
@@ -85,10 +85,28 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		experimentalClient := codersdk.NewExperimentalClient(client)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
+		user1, err := client.User(ctx, codersdk.Me)
+		require.NoError(t, err)
+		user1Visible := database.VisibleUser{
+			ID:        user1.ID,
+			Username:  user1.Username,
+			Name:      user1.Name,
+			AvatarURL: user1.AvatarURL,
+		}
+
+		_, user2 := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
+		user2Visible := database.VisibleUser{
+			ID:        user2.ID,
+			Username:  user2.Username,
+			Name:      user2.Name,
+			AvatarURL: user2.AvatarURL,
+		}
+
 		// Insert a bunch of test data.
 		now := dbtime.Now()
 		i1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
-			StartedAt: now.Add(-time.Hour),
+			InitiatorID: user1.ID,
+			StartedAt:   now.Add(-time.Hour),
 		})
 		i1tok1 := dbgen.AIBridgeTokenUsage(t, db, database.InsertAIBridgeTokenUsageParams{
 			InterceptionID: i1.ID,
@@ -115,14 +133,15 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			CreatedAt:      now.Add(-time.Minute),
 		})
 		i2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
-			StartedAt: now,
+			InitiatorID: user2.ID,
+			StartedAt:   now,
 		})
 
 		// Convert to SDK types for response comparison.
 		// You may notice that the ordering of the inner arrays are ASC, this is
 		// intentional.
-		i1SDK := db2sdk.AIBridgeInterception(i1, []database.AIBridgeTokenUsage{i1tok2, i1tok1}, []database.AIBridgeUserPrompt{i1up2, i1up1}, []database.AIBridgeToolUsage{i1tool2, i1tool1})
-		i2SDK := db2sdk.AIBridgeInterception(i2, nil, nil, nil)
+		i1SDK := db2sdk.AIBridgeInterception(i1, user1Visible, []database.AIBridgeTokenUsage{i1tok2, i1tok1}, []database.AIBridgeUserPrompt{i1up2, i1up1}, []database.AIBridgeToolUsage{i1tool2, i1tool1})
+		i2SDK := db2sdk.AIBridgeInterception(i2, user2Visible, nil, nil, nil)
 
 		res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
@@ -158,7 +177,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 
 		dv := coderdtest.DeploymentValues(t)
 		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
-		client, db, _ := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
+		client, db, firstUser := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
 			},
@@ -178,8 +197,9 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		now := dbtime.Now()
 		for i := range 10 {
 			interception := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
-				ID:        uuid.UUID{byte(i)},
-				StartedAt: now,
+				ID:          uuid.UUID{byte(i)},
+				InitiatorID: firstUser.UserID,
+				StartedAt:   now,
 			})
 			allInterceptionIDs = append(allInterceptionIDs, interception.ID)
 		}
@@ -190,8 +210,9 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			require.NoError(t, err)
 			randomOffsetDur := time.Duration(randomOffset) * time.Second
 			interception := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
-				ID:        uuid.UUID{byte(i + 10)},
-				StartedAt: now.Add(randomOffsetDur),
+				ID:          uuid.UUID{byte(i + 10)},
+				InitiatorID: firstUser.UserID,
+				StartedAt:   now.Add(randomOffsetDur),
 			})
 			allInterceptionIDs = append(allInterceptionIDs, interception.ID)
 		}
@@ -329,27 +350,44 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			},
 		})
 		experimentalClient := codersdk.NewExperimentalClient(client)
-		_, secondUser := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		user1, err := client.User(ctx, codersdk.Me)
+		require.NoError(t, err)
+		user1Visible := database.VisibleUser{
+			ID:        user1.ID,
+			Username:  user1.Username,
+			Name:      user1.Name,
+			AvatarURL: user1.AvatarURL,
+		}
+
+		_, user2 := coderdtest.CreateAnotherUser(t, client, firstUser.OrganizationID)
+		user2Visible := database.VisibleUser{
+			ID:        user2.ID,
+			Username:  user2.Username,
+			Name:      user2.Name,
+			AvatarURL: user2.AvatarURL,
+		}
 
 		// Insert a bunch of test data with varying filterable fields.
 		now := dbtime.Now()
 		i1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			ID:          uuid.MustParse("00000000-0000-0000-0000-000000000001"),
-			InitiatorID: firstUser.UserID,
+			InitiatorID: user1.ID,
 			Provider:    "one",
 			Model:       "one",
 			StartedAt:   now,
 		})
 		i2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			ID:          uuid.MustParse("00000000-0000-0000-0000-000000000002"),
-			InitiatorID: firstUser.UserID,
+			InitiatorID: user1.ID,
 			Provider:    "two",
 			Model:       "two",
 			StartedAt:   now.Add(-time.Hour),
 		})
 		i3 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			ID:          uuid.MustParse("00000000-0000-0000-0000-000000000003"),
-			InitiatorID: secondUser.ID,
+			InitiatorID: user2.ID,
 			Provider:    "three",
 			Model:       "three",
 			StartedAt:   now.Add(-2 * time.Hour),
@@ -357,9 +395,9 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 
 		// Convert to SDK types for response comparison. We don't care about the
 		// inner arrays for this test.
-		i1SDK := db2sdk.AIBridgeInterception(i1, nil, nil, nil)
-		i2SDK := db2sdk.AIBridgeInterception(i2, nil, nil, nil)
-		i3SDK := db2sdk.AIBridgeInterception(i3, nil, nil, nil)
+		i1SDK := db2sdk.AIBridgeInterception(i1, user1Visible, nil, nil, nil)
+		i2SDK := db2sdk.AIBridgeInterception(i2, user1Visible, nil, nil, nil)
+		i3SDK := db2sdk.AIBridgeInterception(i3, user2Visible, nil, nil, nil)
 
 		cases := []struct {
 			name   string
@@ -383,12 +421,12 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			},
 			{
 				name:   "Initiator/UserID",
-				filter: codersdk.AIBridgeListInterceptionsFilter{Initiator: secondUser.ID.String()},
+				filter: codersdk.AIBridgeListInterceptionsFilter{Initiator: user2.ID.String()},
 				want:   []codersdk.AIBridgeInterception{i3SDK},
 			},
 			{
 				name:   "Initiator/Username",
-				filter: codersdk.AIBridgeListInterceptionsFilter{Initiator: secondUser.Username},
+				filter: codersdk.AIBridgeListInterceptionsFilter{Initiator: user2.Username},
 				want:   []codersdk.AIBridgeInterception{i3SDK},
 			},
 			{
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 932f72a383058..65b1d2d3e5302 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -26,7 +26,7 @@ export interface AIBridgeConfig {
 // From codersdk/aibridge.go
 export interface AIBridgeInterception {
 	readonly id: string;
-	readonly initiator_id: string;
+	readonly initiator: MinimalUser;
 	readonly provider: string;
 	readonly model: string;
 	// empty interface{} type, falling back to unknown
@@ -2638,6 +2638,7 @@ export interface MinimalOrganization {
 export interface MinimalUser {
 	readonly id: string;
 	readonly username: string;
+	readonly name?: string;
 	readonly avatar_url?: string;
 }
 
@@ -3951,7 +3952,6 @@ export interface RateLimitConfig {
  * required by the frontend.
  */
 export interface ReducedUser extends MinimalUser {
-	readonly name?: string;
 	readonly email: string;
 	readonly created_at: string;
 	readonly updated_at: string;
diff --git a/vpn/client_test.go b/vpn/client_test.go
index dd359afd0a44b..396f9b67623a6 100644
--- a/vpn/client_test.go
+++ b/vpn/client_test.go
@@ -102,6 +102,7 @@ func TestClient_WorkspaceUpdates(t *testing.T) {
 							MinimalUser: codersdk.MinimalUser{
 								ID:       userID,
 								Username: "rootbeer",
+								Name:     "Root Beer",
 							},
 						},
 					})

From f64ac8f5f7e2c01450b09eda5f660dfa42380350 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Wed, 22 Oct 2025 12:10:06 +0300
Subject: [PATCH 196/298] chore(scripts/rules.go): ignore db imports in
 _test.go files (#20406)

This change allows us to stop adding the following for every invokation:

```
//nolint:gocritic // This is in a test package and does not end up in the build
```
---
 scripts/rules.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/scripts/rules.go b/scripts/rules.go
index 7fd3c0ca445c9..0a7c75925d1f9 100644
--- a/scripts/rules.go
+++ b/scripts/rules.go
@@ -133,7 +133,10 @@ func databaseImport(m dsl.Matcher) {
 	m.Import("github.com/coder/coder/v2/coderd/database")
 	m.Match("database.$_").
 		Report("Do not import any database types into codersdk").
-		Where(m.File().PkgPath.Matches("github.com/coder/coder/v2/codersdk"))
+		Where(
+			m.File().PkgPath.Matches("github.com/coder/coder/v2/codersdk") &&
+				!m.File().Name.Matches(`_test\.go$`),
+		)
 }
 
 // publishInTransaction detects calls to Publish inside database transactions

From 7bbeef4999effe635da511876409447ca58014e0 Mon Sep 17 00:00:00 2001
From: Kacper Sawicki <kacper@coder.com>
Date: Wed, 22 Oct 2025 11:14:49 +0200
Subject: [PATCH 197/298] feat(cli): add mock SMTP server for testing scaletest
 notifications (#20221)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

This PR adds a fake SMTP server for scale testing. It collects emails sent during tests, which you can then check using the HTTP API.

#### Changes
- Added mock SMTP server
- Added `coder scaletest smtp` CLI command
- Implemented HTTP API endpoints to retrieve messages by email
- Added auto-purge to prevent memory issues

#### HTTP API Endpoints
- `GET /messages?email=<email>` – Get messages sent to an email address
- `POST /purge` – Clear all messages from memory

The HTTP API parses raw email messages to extract the **date**, **subject**, and **notification ID**.

Notification IDs are sent in emails like this:
```html
<p>
  <a href="http://127.0.0.1:3000/settings/notifications?disabled=4e19c0ac-94e1-4532-9515-d1801aa283b2"
     style="color: #2563eb; text-decoration: none;">
    Stop receiving emails like this
  </a>
</p>
```

#### CLI
```bash
coder scaletest smtp --host localhost --port 33199 --api-port 8080 --purge-at-count 1000
```

**Flags:**
- `--host`: Host for the mock SMTP and API server (default: localhost)
- `--port`: Port for the mock SMTP server (random if not specified)
- `--api-port`: Port for the HTTP API server (random if not specified)
- `--purge-at-count`: Max number of messages before auto-purging (default: 100000)
---
 cli/exp_scaletest.go              |   1 +
 cli/exp_scaletest_smtp.go         | 112 ++++++++++++++
 scaletest/smtpmock/server.go      | 247 ++++++++++++++++++++++++++++++
 scaletest/smtpmock/server_test.go | 203 ++++++++++++++++++++++++
 4 files changed, 563 insertions(+)
 create mode 100644 cli/exp_scaletest_smtp.go
 create mode 100644 scaletest/smtpmock/server.go
 create mode 100644 scaletest/smtpmock/server_test.go

diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index fc21d47fdb7c7..2515012b2864c 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -66,6 +66,7 @@ func (r *RootCmd) scaletestCmd() *serpent.Command {
 			r.scaletestWorkspaceTraffic(),
 			r.scaletestAutostart(),
 			r.scaletestNotifications(),
+			r.scaletestSMTP(),
 		},
 	}
 
diff --git a/cli/exp_scaletest_smtp.go b/cli/exp_scaletest_smtp.go
new file mode 100644
index 0000000000000..3713005de56dc
--- /dev/null
+++ b/cli/exp_scaletest_smtp.go
@@ -0,0 +1,112 @@
+//go:build !slim
+
+package cli
+
+import (
+	"fmt"
+	"os/signal"
+	"time"
+
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+	"cdr.dev/slog/sloggers/sloghuman"
+	"github.com/coder/coder/v2/scaletest/smtpmock"
+	"github.com/coder/serpent"
+)
+
+func (*RootCmd) scaletestSMTP() *serpent.Command {
+	var (
+		hostAddress  string
+		smtpPort     int64
+		apiPort      int64
+		purgeAtCount int64
+	)
+	cmd := &serpent.Command{
+		Use:   "smtp",
+		Short: "Start a mock SMTP server for testing",
+		Long: `Start a mock SMTP server with an HTTP API server that can be used to purge
+messages and get messages by email.`,
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+			notifyCtx, stop := signal.NotifyContext(ctx, StopSignals...)
+			defer stop()
+			ctx = notifyCtx
+
+			logger := slog.Make(sloghuman.Sink(inv.Stderr)).Leveled(slog.LevelInfo)
+			config := smtpmock.Config{
+				HostAddress: hostAddress,
+				SMTPPort:    int(smtpPort),
+				APIPort:     int(apiPort),
+				Logger:      logger,
+			}
+			srv := new(smtpmock.Server)
+
+			if err := srv.Start(ctx, config); err != nil {
+				return xerrors.Errorf("start mock SMTP server: %w", err)
+			}
+			defer func() {
+				_ = srv.Stop()
+			}()
+
+			_, _ = fmt.Fprintf(inv.Stdout, "Mock SMTP server started on %s\n", srv.SMTPAddress())
+			_, _ = fmt.Fprintf(inv.Stdout, "HTTP API server started on %s\n", srv.APIAddress())
+			if purgeAtCount > 0 {
+				_, _ = fmt.Fprintf(inv.Stdout, "  Auto-purge when message count reaches %d\n", purgeAtCount)
+			}
+
+			ticker := time.NewTicker(10 * time.Second)
+			defer ticker.Stop()
+
+			for {
+				select {
+				case <-ctx.Done():
+					_, _ = fmt.Fprintf(inv.Stdout, "\nTotal messages received since last purge: %d\n", srv.MessageCount())
+					return nil
+				case <-ticker.C:
+					count := srv.MessageCount()
+					if count > 0 {
+						_, _ = fmt.Fprintf(inv.Stdout, "Messages received: %d\n", count)
+					}
+
+					if purgeAtCount > 0 && int64(count) >= purgeAtCount {
+						_, _ = fmt.Fprintf(inv.Stdout, "Message count (%d) reached threshold (%d). Purging...\n", count, purgeAtCount)
+						srv.Purge()
+						continue
+					}
+				}
+			}
+		},
+	}
+
+	cmd.Options = []serpent.Option{
+		{
+			Flag:        "host-address",
+			Env:         "CODER_SCALETEST_SMTP_HOST_ADDRESS",
+			Default:     "localhost",
+			Description: "Host address to bind the mock SMTP and API servers.",
+			Value:       serpent.StringOf(&hostAddress),
+		},
+		{
+			Flag:        "smtp-port",
+			Env:         "CODER_SCALETEST_SMTP_PORT",
+			Description: "Port for the mock SMTP server. Uses a random port if not specified.",
+			Value:       serpent.Int64Of(&smtpPort),
+		},
+		{
+			Flag:        "api-port",
+			Env:         "CODER_SCALETEST_SMTP_API_PORT",
+			Description: "Port for the HTTP API server. Uses a random port if not specified.",
+			Value:       serpent.Int64Of(&apiPort),
+		},
+		{
+			Flag:        "purge-at-count",
+			Env:         "CODER_SCALETEST_SMTP_PURGE_AT_COUNT",
+			Default:     "100000",
+			Description: "Maximum number of messages to keep before auto-purging. Set to 0 to disable.",
+			Value:       serpent.Int64Of(&purgeAtCount),
+		},
+	}
+
+	return cmd
+}
diff --git a/scaletest/smtpmock/server.go b/scaletest/smtpmock/server.go
new file mode 100644
index 0000000000000..26f5b65ffbfb5
--- /dev/null
+++ b/scaletest/smtpmock/server.go
@@ -0,0 +1,247 @@
+package smtpmock
+
+import (
+	"bufio"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"mime/quotedprintable"
+	"net"
+	"net/http"
+	"net/mail"
+	"regexp"
+	"slices"
+	"strings"
+	"time"
+
+	"github.com/google/uuid"
+	smtpmocklib "github.com/mocktools/go-smtp-mock/v2"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+)
+
+// Server wraps the SMTP mock server and provides an HTTP API to retrieve emails.
+type Server struct {
+	smtpServer   *smtpmocklib.Server
+	httpServer   *http.Server
+	httpListener net.Listener
+	logger       slog.Logger
+
+	hostAddress string
+	smtpPort    int
+	apiPort     int
+}
+
+type Config struct {
+	HostAddress string
+	SMTPPort    int
+	APIPort     int
+	Logger      slog.Logger
+}
+
+type EmailSummary struct {
+	Subject                string    `json:"subject"`
+	Date                   time.Time `json:"date"`
+	NotificationTemplateID uuid.UUID `json:"notification_template_id,omitempty"`
+}
+
+var notificationTemplateIDRegex = regexp.MustCompile(`notifications\?disabled=([a-f0-9-]+)`)
+
+func (s *Server) Start(ctx context.Context, cfg Config) error {
+	s.hostAddress = cfg.HostAddress
+	s.smtpPort = cfg.SMTPPort
+	s.apiPort = cfg.APIPort
+	s.logger = cfg.Logger
+
+	s.smtpServer = smtpmocklib.New(smtpmocklib.ConfigurationAttr{
+		LogToStdout:       false,
+		LogServerActivity: true,
+		HostAddress:       s.hostAddress,
+		PortNumber:        s.smtpPort,
+	})
+	if err := s.smtpServer.Start(); err != nil {
+		return xerrors.Errorf("start SMTP server: %w", err)
+	}
+	s.smtpPort = s.smtpServer.PortNumber()
+
+	if err := s.startAPIServer(ctx); err != nil {
+		_ = s.smtpServer.Stop()
+		return xerrors.Errorf("start API server: %w", err)
+	}
+
+	return nil
+}
+
+func (s *Server) Stop() error {
+	var httpErr, smtpErr error
+
+	if s.httpServer != nil {
+		shutdownCtx, cancel := context.WithTimeout(context.Background(), 5*time.Second)
+		defer cancel()
+		if err := s.httpServer.Shutdown(shutdownCtx); err != nil {
+			httpErr = xerrors.Errorf("shutdown HTTP server: %w", err)
+		}
+	}
+
+	if s.smtpServer != nil {
+		if err := s.smtpServer.Stop(); err != nil {
+			smtpErr = xerrors.Errorf("stop SMTP server: %w", err)
+		}
+	}
+
+	return errors.Join(httpErr, smtpErr)
+}
+
+func (s *Server) SMTPAddress() string {
+	return fmt.Sprintf("%s:%d", s.hostAddress, s.smtpPort)
+}
+
+func (s *Server) APIAddress() string {
+	return fmt.Sprintf("http://%s:%d", s.hostAddress, s.apiPort)
+}
+
+func (s *Server) MessageCount() int {
+	if s.smtpServer == nil {
+		return 0
+	}
+	return len(s.smtpServer.Messages())
+}
+
+func (s *Server) Purge() {
+	if s.smtpServer != nil {
+		s.smtpServer.MessagesAndPurge()
+	}
+}
+
+func (s *Server) startAPIServer(ctx context.Context) error {
+	mux := http.NewServeMux()
+	mux.HandleFunc("POST /purge", s.handlePurge)
+	mux.HandleFunc("GET /messages", s.handleMessages)
+
+	s.httpServer = &http.Server{
+		Handler:           mux,
+		ReadHeaderTimeout: 10 * time.Second,
+	}
+
+	listener, err := net.Listen("tcp", fmt.Sprintf("%s:%d", s.hostAddress, s.apiPort))
+	if err != nil {
+		return xerrors.Errorf("listen on %s:%d: %w", s.hostAddress, s.apiPort, err)
+	}
+	s.httpListener = listener
+
+	tcpAddr, valid := listener.Addr().(*net.TCPAddr)
+	if !valid {
+		err := listener.Close()
+		if err != nil {
+			s.logger.Error(ctx, "failed to close listener", slog.Error(err))
+		}
+		return xerrors.Errorf("listener returned invalid address: %T", listener.Addr())
+	}
+	s.apiPort = tcpAddr.Port
+
+	go func() {
+		if err := s.httpServer.Serve(listener); err != nil && !errors.Is(err, http.ErrServerClosed) {
+			s.logger.Error(ctx, "http API server error", slog.Error(err))
+		}
+	}()
+
+	return nil
+}
+
+func (s *Server) handlePurge(w http.ResponseWriter, _ *http.Request) {
+	s.smtpServer.MessagesAndPurge()
+	w.WriteHeader(http.StatusOK)
+}
+
+func (s *Server) handleMessages(w http.ResponseWriter, r *http.Request) {
+	email := r.URL.Query().Get("email")
+	msgs := s.smtpServer.Messages()
+
+	var summaries []EmailSummary
+	for _, msg := range msgs {
+		recipients := msg.RcpttoRequestResponse()
+		if !matchesRecipient(recipients, email) {
+			continue
+		}
+
+		summary, err := parseEmailSummary(msg.MsgRequest())
+		if err != nil {
+			s.logger.Warn(r.Context(), "failed to parse email summary", slog.Error(err))
+			continue
+		}
+		summaries = append(summaries, summary)
+	}
+
+	w.Header().Set("Content-Type", "application/json")
+	if err := json.NewEncoder(w).Encode(summaries); err != nil {
+		s.logger.Warn(r.Context(), "failed to encode JSON response", slog.Error(err))
+	}
+}
+
+func matchesRecipient(recipients [][]string, email string) bool {
+	if email == "" {
+		return true
+	}
+	return slices.ContainsFunc(recipients, func(rcptPair []string) bool {
+		if len(rcptPair) == 0 {
+			return false
+		}
+
+		addrPart, ok := strings.CutPrefix(rcptPair[0], "RCPT TO:")
+		if !ok {
+			return false
+		}
+
+		addr, err := mail.ParseAddress(addrPart)
+		if err != nil {
+			return false
+		}
+
+		return strings.EqualFold(addr.Address, email)
+	})
+}
+
+func parseEmailSummary(message string) (EmailSummary, error) {
+	var summary EmailSummary
+
+	// Decode quoted-printable message
+	reader := quotedprintable.NewReader(strings.NewReader(message))
+	content, err := io.ReadAll(reader)
+	if err != nil {
+		return summary, xerrors.Errorf("decode email content: %w", err)
+	}
+
+	contentStr := string(content)
+	scanner := bufio.NewScanner(strings.NewReader(contentStr))
+
+	// Extract Subject and Date from headers.
+	// Date is used to measure latency.
+	for scanner.Scan() {
+		line := scanner.Text()
+		if line == "" {
+			break
+		}
+		if prefix, found := strings.CutPrefix(line, "Subject: "); found {
+			summary.Subject = prefix
+		} else if prefix, found := strings.CutPrefix(line, "Date: "); found {
+			if parsedDate, err := time.Parse(time.RFC1123Z, prefix); err == nil {
+				summary.Date = parsedDate
+			}
+		}
+	}
+
+	// Extract notification ID from decoded email content
+	// Notification ID is present in the email footer like this
+	// <p><a href="http://127.0.0.1:3000/settings/notifications?disabled=4e19c0ac-94e1-4532-9515-d1801aa283b2" style="color: #2563eb; text-decoration: none;">Stop receiving emails like this</a></p>
+	if matches := notificationTemplateIDRegex.FindStringSubmatch(contentStr); len(matches) > 1 {
+		summary.NotificationTemplateID, err = uuid.Parse(matches[1])
+		if err != nil {
+			return summary, xerrors.Errorf("parse notification ID: %w", err)
+		}
+	}
+
+	return summary, nil
+}
diff --git a/scaletest/smtpmock/server_test.go b/scaletest/smtpmock/server_test.go
new file mode 100644
index 0000000000000..7136c5ab9ee59
--- /dev/null
+++ b/scaletest/smtpmock/server_test.go
@@ -0,0 +1,203 @@
+package smtpmock_test
+
+import (
+	"context"
+	"encoding/json"
+	"fmt"
+	"net/http"
+	"net/smtp"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"cdr.dev/slog/sloggers/slogtest"
+	"github.com/coder/coder/v2/scaletest/smtpmock"
+	"github.com/coder/coder/v2/testutil"
+)
+
+func TestServer_StartStop(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	srv := new(smtpmock.Server)
+	err := srv.Start(ctx, smtpmock.Config{
+		HostAddress: "127.0.0.1",
+		SMTPPort:    0,
+		APIPort:     0,
+		Logger:      slogtest.Make(t, nil),
+	})
+	require.NoError(t, err)
+	require.NotEmpty(t, srv.SMTPAddress())
+	require.NotEmpty(t, srv.APIAddress())
+
+	err = srv.Stop()
+	require.NoError(t, err)
+}
+
+func TestServer_SendAndReceiveEmail(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	srv := new(smtpmock.Server)
+	err := srv.Start(ctx, smtpmock.Config{
+		HostAddress: "127.0.0.1",
+		SMTPPort:    0,
+		APIPort:     0,
+		Logger:      slogtest.Make(t, nil),
+	})
+	require.NoError(t, err)
+	defer srv.Stop()
+
+	err = sendTestEmail(srv.SMTPAddress(), "test@example.com", "Test Subject", "Test Body")
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		return srv.MessageCount() == 1
+	}, testutil.WaitShort, testutil.IntervalMedium)
+
+	url := fmt.Sprintf("%s/messages", srv.APIAddress())
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	require.NoError(t, err)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	var summaries []smtpmock.EmailSummary
+	err = json.NewDecoder(resp.Body).Decode(&summaries)
+	require.NoError(t, err)
+	require.Len(t, summaries, 1)
+	require.Equal(t, "Test Subject", summaries[0].Subject)
+}
+
+func TestServer_FilterByEmail(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	srv := new(smtpmock.Server)
+	err := srv.Start(ctx, smtpmock.Config{
+		HostAddress: "127.0.0.1",
+		SMTPPort:    0,
+		APIPort:     0,
+		Logger:      slogtest.Make(t, nil),
+	})
+	require.NoError(t, err)
+	defer srv.Stop()
+
+	err = sendTestEmail(srv.SMTPAddress(), "admin@coder.com", "Email for admin", "Body 1")
+	require.NoError(t, err)
+
+	err = sendTestEmail(srv.SMTPAddress(), "test-user@coder.com", "Email for test-user", "Body 2")
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		return srv.MessageCount() == 2
+	}, testutil.WaitShort, testutil.IntervalMedium)
+
+	url := fmt.Sprintf("%s/messages?email=admin@coder.com", srv.APIAddress())
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	require.NoError(t, err)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	var summaries []smtpmock.EmailSummary
+	err = json.NewDecoder(resp.Body).Decode(&summaries)
+	require.NoError(t, err)
+	require.Len(t, summaries, 1)
+	require.Equal(t, "Email for admin", summaries[0].Subject)
+}
+
+func TestServer_NotificationTemplateID(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	srv := new(smtpmock.Server)
+	err := srv.Start(ctx, smtpmock.Config{
+		HostAddress: "127.0.0.1",
+		SMTPPort:    0,
+		APIPort:     0,
+		Logger:      slogtest.Make(t, nil),
+	})
+	require.NoError(t, err)
+	defer srv.Stop()
+
+	notificationID := uuid.New()
+	body := fmt.Sprintf(`<p><a href=3D"http://127.0.0.1:3000/settings/notifications?disabled=3D%s">Unsubscribe</a></p>`, notificationID.String())
+
+	err = sendTestEmail(srv.SMTPAddress(), "test-user@coder.com", "Notification", body)
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		return srv.MessageCount() == 1
+	}, testutil.WaitShort, testutil.IntervalMedium)
+
+	url := fmt.Sprintf("%s/messages", srv.APIAddress())
+	req, err := http.NewRequestWithContext(ctx, http.MethodGet, url, nil)
+	require.NoError(t, err)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+
+	var summaries []smtpmock.EmailSummary
+	err = json.NewDecoder(resp.Body).Decode(&summaries)
+	require.NoError(t, err)
+	require.Len(t, summaries, 1)
+	require.Equal(t, notificationID, summaries[0].NotificationTemplateID)
+}
+
+func TestServer_Purge(t *testing.T) {
+	t.Parallel()
+
+	ctx := context.Background()
+	srv := new(smtpmock.Server)
+	err := srv.Start(ctx, smtpmock.Config{
+		HostAddress: "127.0.0.1",
+		SMTPPort:    0,
+		APIPort:     0,
+		Logger:      slogtest.Make(t, nil),
+	})
+	require.NoError(t, err)
+	defer srv.Stop()
+
+	err = sendTestEmail(srv.SMTPAddress(), "test-user@coder.com", "Test", "Body")
+	require.NoError(t, err)
+
+	require.Eventually(t, func() bool {
+		return srv.MessageCount() == 1
+	}, testutil.WaitShort, testutil.IntervalMedium)
+
+	url := fmt.Sprintf("%s/purge", srv.APIAddress())
+	req, err := http.NewRequestWithContext(ctx, http.MethodPost, url, nil)
+	require.NoError(t, err)
+
+	resp, err := http.DefaultClient.Do(req)
+	require.NoError(t, err)
+	defer resp.Body.Close()
+	require.Equal(t, http.StatusOK, resp.StatusCode)
+
+	require.Equal(t, 0, srv.MessageCount())
+}
+
+func sendTestEmail(smtpAddr, to, subject, body string) error {
+	from := "noreply@coder.com"
+	now := time.Now().Format(time.RFC1123Z)
+
+	msg := strings.Builder{}
+	_, _ = msg.WriteString(fmt.Sprintf("From: %s\r\n", from))
+	_, _ = msg.WriteString(fmt.Sprintf("To: %s\r\n", to))
+	_, _ = msg.WriteString(fmt.Sprintf("Subject: %s\r\n", subject))
+	_, _ = msg.WriteString(fmt.Sprintf("Date: %s\r\n", now))
+	_, _ = msg.WriteString("Content-Type: text/html; charset=UTF-8\r\n")
+	_, _ = msg.WriteString("\r\n")
+	_, _ = msg.WriteString(body)
+
+	return smtp.SendMail(smtpAddr, nil, from, []string{to}, []byte(msg.String()))
+}

From 1230cacf7876fb11be87cf2147a2e6e84056f52d Mon Sep 17 00:00:00 2001
From: Kacper Sawicki <kacper@coder.com>
Date: Wed, 22 Oct 2025 12:09:35 +0200
Subject: [PATCH 198/298] feat(scaletest): extend notifications runner with
 smtp support (#20222)

This PR extends the scaletest notification runner with SMTP support.

If the `--smtp-api-url` flag is provided, the runner will also watch for SMTP notifications using the specified URL.

#### Changes
- Added a new watcher to retrieve emails sent to the runner user
- Tracked WebSocket and SMTP latencies separately
- Updated metrics to include `notification_id` and `notification_type` labels

#### CLI Flags
- `--smtp-api-url`: Address of the SMTP mock HTTP API used to retrieve email notifications

#### Metrics
- `notification_delivery_latency_seconds` now includes:
  - `notification_id`
  - `notification_type` (`websocket` or `smtp`)
---
 cli/exp_scaletest.go                | 335 +--------------------
 cli/exp_scaletest_notifications.go  | 447 ++++++++++++++++++++++++++++
 scaletest/notifications/config.go   |   8 +-
 scaletest/notifications/metrics.go  |  33 +-
 scaletest/notifications/run.go      | 195 ++++++++++--
 scaletest/notifications/run_test.go | 288 ++++++++++++------
 6 files changed, 845 insertions(+), 461 deletions(-)
 create mode 100644 cli/exp_scaletest_notifications.go

diff --git a/cli/exp_scaletest.go b/cli/exp_scaletest.go
index 2515012b2864c..559ffbebd165d 100644
--- a/cli/exp_scaletest.go
+++ b/cli/exp_scaletest.go
@@ -29,7 +29,6 @@ import (
 
 	"github.com/coder/coder/v2/cli/cliui"
 	"github.com/coder/coder/v2/coderd/httpapi"
-	notificationsLib "github.com/coder/coder/v2/coderd/notifications"
 	"github.com/coder/coder/v2/coderd/tracing"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
@@ -40,7 +39,6 @@ import (
 	"github.com/coder/coder/v2/scaletest/dashboard"
 	"github.com/coder/coder/v2/scaletest/harness"
 	"github.com/coder/coder/v2/scaletest/loadtestutil"
-	"github.com/coder/coder/v2/scaletest/notifications"
 	"github.com/coder/coder/v2/scaletest/reconnectingpty"
 	"github.com/coder/coder/v2/scaletest/workspacebuild"
 	"github.com/coder/coder/v2/scaletest/workspacetraffic"
@@ -1922,259 +1920,6 @@ func (r *RootCmd) scaletestAutostart() *serpent.Command {
 	return cmd
 }
 
-func (r *RootCmd) scaletestNotifications() *serpent.Command {
-	var (
-		userCount           int64
-		ownerUserPercentage float64
-		notificationTimeout time.Duration
-		dialTimeout         time.Duration
-		noCleanup           bool
-
-		tracingFlags = &scaletestTracingFlags{}
-
-		// This test requires unlimited concurrency.
-		timeoutStrategy = &timeoutFlags{}
-		cleanupStrategy = newScaletestCleanupStrategy()
-		output          = &scaletestOutputFlags{}
-		prometheusFlags = &scaletestPrometheusFlags{}
-	)
-
-	cmd := &serpent.Command{
-		Use:   "notifications",
-		Short: "Simulate notification delivery by creating many users listening to notifications.",
-		Handler: func(inv *serpent.Invocation) error {
-			ctx := inv.Context()
-			client, err := r.InitClient(inv)
-			if err != nil {
-				return err
-			}
-
-			notifyCtx, stop := signal.NotifyContext(ctx, StopSignals...)
-			defer stop()
-			ctx = notifyCtx
-
-			me, err := requireAdmin(ctx, client)
-			if err != nil {
-				return err
-			}
-
-			client.HTTPClient = &http.Client{
-				Transport: &codersdk.HeaderTransport{
-					Transport: http.DefaultTransport,
-					Header: map[string][]string{
-						codersdk.BypassRatelimitHeader: {"true"},
-					},
-				},
-			}
-
-			if userCount <= 0 {
-				return xerrors.Errorf("--user-count must be greater than 0")
-			}
-
-			if ownerUserPercentage < 0 || ownerUserPercentage > 100 {
-				return xerrors.Errorf("--owner-user-percentage must be between 0 and 100")
-			}
-
-			ownerUserCount := int64(float64(userCount) * ownerUserPercentage / 100)
-			if ownerUserCount == 0 && ownerUserPercentage > 0 {
-				ownerUserCount = 1
-			}
-			regularUserCount := userCount - ownerUserCount
-
-			_, _ = fmt.Fprintf(inv.Stderr, "Distribution plan:\n")
-			_, _ = fmt.Fprintf(inv.Stderr, "  Total users: %d\n", userCount)
-			_, _ = fmt.Fprintf(inv.Stderr, "  Owner users: %d (%.1f%%)\n", ownerUserCount, ownerUserPercentage)
-			_, _ = fmt.Fprintf(inv.Stderr, "  Regular users: %d (%.1f%%)\n", regularUserCount, 100.0-ownerUserPercentage)
-
-			outputs, err := output.parse()
-			if err != nil {
-				return xerrors.Errorf("could not parse --output flags")
-			}
-
-			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
-			if err != nil {
-				return xerrors.Errorf("create tracer provider: %w", err)
-			}
-			tracer := tracerProvider.Tracer(scaletestTracerName)
-
-			reg := prometheus.NewRegistry()
-			metrics := notifications.NewMetrics(reg)
-
-			logger := inv.Logger
-			prometheusSrvClose := ServeHandler(ctx, logger, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}), prometheusFlags.Address, "prometheus")
-			defer prometheusSrvClose()
-
-			defer func() {
-				_, _ = fmt.Fprintln(inv.Stderr, "\nUploading traces...")
-				if err := closeTracing(ctx); err != nil {
-					_, _ = fmt.Fprintf(inv.Stderr, "\nError uploading traces: %+v\n", err)
-				}
-				// Wait for prometheus metrics to be scraped
-				_, _ = fmt.Fprintf(inv.Stderr, "Waiting %s for prometheus metrics to be scraped\n", prometheusFlags.Wait)
-				<-time.After(prometheusFlags.Wait)
-			}()
-
-			_, _ = fmt.Fprintln(inv.Stderr, "Creating users...")
-
-			dialBarrier := &sync.WaitGroup{}
-			ownerWatchBarrier := &sync.WaitGroup{}
-			dialBarrier.Add(int(userCount))
-			ownerWatchBarrier.Add(int(ownerUserCount))
-
-			expectedNotifications := map[uuid.UUID]chan time.Time{
-				notificationsLib.TemplateUserAccountCreated: make(chan time.Time, 1),
-				notificationsLib.TemplateUserAccountDeleted: make(chan time.Time, 1),
-			}
-
-			configs := make([]notifications.Config, 0, userCount)
-			for range ownerUserCount {
-				config := notifications.Config{
-					User: createusers.Config{
-						OrganizationID: me.OrganizationIDs[0],
-					},
-					Roles:                 []string{codersdk.RoleOwner},
-					NotificationTimeout:   notificationTimeout,
-					DialTimeout:           dialTimeout,
-					DialBarrier:           dialBarrier,
-					ReceivingWatchBarrier: ownerWatchBarrier,
-					ExpectedNotifications: expectedNotifications,
-					Metrics:               metrics,
-				}
-				if err := config.Validate(); err != nil {
-					return xerrors.Errorf("validate config: %w", err)
-				}
-				configs = append(configs, config)
-			}
-			for range regularUserCount {
-				config := notifications.Config{
-					User: createusers.Config{
-						OrganizationID: me.OrganizationIDs[0],
-					},
-					Roles:                 []string{},
-					NotificationTimeout:   notificationTimeout,
-					DialTimeout:           dialTimeout,
-					DialBarrier:           dialBarrier,
-					ReceivingWatchBarrier: ownerWatchBarrier,
-					Metrics:               metrics,
-				}
-				if err := config.Validate(); err != nil {
-					return xerrors.Errorf("validate config: %w", err)
-				}
-				configs = append(configs, config)
-			}
-
-			go triggerUserNotifications(
-				ctx,
-				logger,
-				client,
-				me.OrganizationIDs[0],
-				dialBarrier,
-				dialTimeout,
-				expectedNotifications,
-			)
-
-			th := harness.NewTestHarness(timeoutStrategy.wrapStrategy(harness.ConcurrentExecutionStrategy{}), cleanupStrategy.toStrategy())
-
-			for i, config := range configs {
-				id := strconv.Itoa(i)
-				name := fmt.Sprintf("notifications-%s", id)
-				var runner harness.Runnable = notifications.NewRunner(client, config)
-				if tracingEnabled {
-					runner = &runnableTraceWrapper{
-						tracer:   tracer,
-						spanName: name,
-						runner:   runner,
-					}
-				}
-
-				th.AddRun(name, id, runner)
-			}
-
-			_, _ = fmt.Fprintln(inv.Stderr, "Running notification delivery scaletest...")
-			testCtx, testCancel := timeoutStrategy.toContext(ctx)
-			defer testCancel()
-			err = th.Run(testCtx)
-			if err != nil {
-				return xerrors.Errorf("run test harness (harness failure, not a test failure): %w", err)
-			}
-
-			// If the command was interrupted, skip stats.
-			if notifyCtx.Err() != nil {
-				return notifyCtx.Err()
-			}
-
-			res := th.Results()
-			for _, o := range outputs {
-				err = o.write(res, inv.Stdout)
-				if err != nil {
-					return xerrors.Errorf("write output %q to %q: %w", o.format, o.path, err)
-				}
-			}
-
-			if !noCleanup {
-				_, _ = fmt.Fprintln(inv.Stderr, "\nCleaning up...")
-				cleanupCtx, cleanupCancel := cleanupStrategy.toContext(ctx)
-				defer cleanupCancel()
-				err = th.Cleanup(cleanupCtx)
-				if err != nil {
-					return xerrors.Errorf("cleanup tests: %w", err)
-				}
-			}
-
-			if res.TotalFail > 0 {
-				return xerrors.New("load test failed, see above for more details")
-			}
-
-			return nil
-		},
-	}
-
-	cmd.Options = serpent.OptionSet{
-		{
-			Flag:          "user-count",
-			FlagShorthand: "c",
-			Env:           "CODER_SCALETEST_NOTIFICATION_USER_COUNT",
-			Description:   "Required: Total number of users to create.",
-			Value:         serpent.Int64Of(&userCount),
-			Required:      true,
-		},
-		{
-			Flag:        "owner-user-percentage",
-			Env:         "CODER_SCALETEST_NOTIFICATION_OWNER_USER_PERCENTAGE",
-			Default:     "20.0",
-			Description: "Percentage of users to assign Owner role to (0-100).",
-			Value:       serpent.Float64Of(&ownerUserPercentage),
-		},
-		{
-			Flag:        "notification-timeout",
-			Env:         "CODER_SCALETEST_NOTIFICATION_TIMEOUT",
-			Default:     "5m",
-			Description: "How long to wait for notifications after triggering.",
-			Value:       serpent.DurationOf(&notificationTimeout),
-		},
-		{
-			Flag:        "dial-timeout",
-			Env:         "CODER_SCALETEST_DIAL_TIMEOUT",
-			Default:     "2m",
-			Description: "Timeout for dialing the notification websocket endpoint.",
-			Value:       serpent.DurationOf(&dialTimeout),
-		},
-		{
-			Flag:        "no-cleanup",
-			Env:         "CODER_SCALETEST_NO_CLEANUP",
-			Description: "Do not clean up resources after the test completes.",
-			Value:       serpent.BoolOf(&noCleanup),
-		},
-	}
-
-	tracingFlags.attach(&cmd.Options)
-	timeoutStrategy.attach(&cmd.Options)
-	cleanupStrategy.attach(&cmd.Options)
-	output.attach(&cmd.Options)
-	prometheusFlags.attach(&cmd.Options)
-	return cmd
-}
-
 type runnableTraceWrapper struct {
 	tracer   trace.Tracer
 	spanName string
@@ -2184,8 +1929,9 @@ type runnableTraceWrapper struct {
 }
 
 var (
-	_ harness.Runnable  = &runnableTraceWrapper{}
-	_ harness.Cleanable = &runnableTraceWrapper{}
+	_ harness.Runnable    = &runnableTraceWrapper{}
+	_ harness.Cleanable   = &runnableTraceWrapper{}
+	_ harness.Collectable = &runnableTraceWrapper{}
 )
 
 func (r *runnableTraceWrapper) Run(ctx context.Context, id string, logs io.Writer) error {
@@ -2227,6 +1973,14 @@ func (r *runnableTraceWrapper) Cleanup(ctx context.Context, id string, logs io.W
 	return c.Cleanup(ctx, id, logs)
 }
 
+func (r *runnableTraceWrapper) GetMetrics() map[string]any {
+	c, ok := r.runner.(harness.Collectable)
+	if !ok {
+		return nil
+	}
+	return c.GetMetrics()
+}
+
 func getScaletestWorkspaces(ctx context.Context, client *codersdk.Client, owner, template string) ([]codersdk.Workspace, int, error) {
 	var (
 		pageNumber = 0
@@ -2375,73 +2129,6 @@ func parseTargetRange(name, targets string) (start, end int, err error) {
 	return start, end, nil
 }
 
-// triggerUserNotifications waits for all test users to connect,
-// then creates and deletes a test user to trigger notification events for testing.
-func triggerUserNotifications(
-	ctx context.Context,
-	logger slog.Logger,
-	client *codersdk.Client,
-	orgID uuid.UUID,
-	dialBarrier *sync.WaitGroup,
-	dialTimeout time.Duration,
-	expectedNotifications map[uuid.UUID]chan time.Time,
-) {
-	logger.Info(ctx, "waiting for all users to connect")
-
-	// Wait for all users to connect
-	waitCtx, cancel := context.WithTimeout(ctx, dialTimeout+30*time.Second)
-	defer cancel()
-
-	done := make(chan struct{})
-	go func() {
-		dialBarrier.Wait()
-		close(done)
-	}()
-
-	select {
-	case <-done:
-		logger.Info(ctx, "all users connected")
-	case <-waitCtx.Done():
-		if waitCtx.Err() == context.DeadlineExceeded {
-			logger.Error(ctx, "timeout waiting for users to connect")
-		} else {
-			logger.Info(ctx, "context canceled while waiting for users")
-		}
-		return
-	}
-
-	const (
-		triggerUsername = "scaletest-trigger-user"
-		triggerEmail    = "scaletest-trigger@example.com"
-	)
-
-	logger.Info(ctx, "creating test user to test notifications",
-		slog.F("username", triggerUsername),
-		slog.F("email", triggerEmail),
-		slog.F("org_id", orgID))
-
-	testUser, err := client.CreateUserWithOrgs(ctx, codersdk.CreateUserRequestWithOrgs{
-		OrganizationIDs: []uuid.UUID{orgID},
-		Username:        triggerUsername,
-		Email:           triggerEmail,
-		Password:        "test-password-123",
-	})
-	if err != nil {
-		logger.Error(ctx, "create test user", slog.Error(err))
-		return
-	}
-	expectedNotifications[notificationsLib.TemplateUserAccountCreated] <- time.Now()
-
-	err = client.DeleteUser(ctx, testUser.ID)
-	if err != nil {
-		logger.Error(ctx, "delete test user", slog.Error(err))
-		return
-	}
-	expectedNotifications[notificationsLib.TemplateUserAccountDeleted] <- time.Now()
-	close(expectedNotifications[notificationsLib.TemplateUserAccountCreated])
-	close(expectedNotifications[notificationsLib.TemplateUserAccountDeleted])
-}
-
 func createWorkspaceAppConfig(client *codersdk.Client, appHost, app string, workspace codersdk.Workspace, agent codersdk.WorkspaceAgent) (workspacetraffic.AppConfig, error) {
 	if app == "" {
 		return workspacetraffic.AppConfig{}, nil
diff --git a/cli/exp_scaletest_notifications.go b/cli/exp_scaletest_notifications.go
new file mode 100644
index 0000000000000..1ea47858933f1
--- /dev/null
+++ b/cli/exp_scaletest_notifications.go
@@ -0,0 +1,447 @@
+//go:build !slim
+
+package cli
+
+import (
+	"context"
+	"fmt"
+	"net/http"
+	"os/signal"
+	"strconv"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/google/uuid"
+	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promhttp"
+	"golang.org/x/xerrors"
+
+	"cdr.dev/slog"
+
+	notificationsLib "github.com/coder/coder/v2/coderd/notifications"
+	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/scaletest/createusers"
+	"github.com/coder/coder/v2/scaletest/harness"
+	"github.com/coder/coder/v2/scaletest/notifications"
+	"github.com/coder/serpent"
+)
+
+func (r *RootCmd) scaletestNotifications() *serpent.Command {
+	var (
+		userCount           int64
+		ownerUserPercentage float64
+		notificationTimeout time.Duration
+		dialTimeout         time.Duration
+		noCleanup           bool
+		smtpAPIURL          string
+
+		tracingFlags = &scaletestTracingFlags{}
+
+		// This test requires unlimited concurrency.
+		timeoutStrategy = &timeoutFlags{}
+		cleanupStrategy = newScaletestCleanupStrategy()
+		output          = &scaletestOutputFlags{}
+		prometheusFlags = &scaletestPrometheusFlags{}
+	)
+
+	cmd := &serpent.Command{
+		Use:   "notifications",
+		Short: "Simulate notification delivery by creating many users listening to notifications.",
+		Handler: func(inv *serpent.Invocation) error {
+			ctx := inv.Context()
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return err
+			}
+
+			notifyCtx, stop := signal.NotifyContext(ctx, StopSignals...)
+			defer stop()
+			ctx = notifyCtx
+
+			me, err := requireAdmin(ctx, client)
+			if err != nil {
+				return err
+			}
+
+			client.HTTPClient = &http.Client{
+				Transport: &codersdk.HeaderTransport{
+					Transport: http.DefaultTransport,
+					Header: map[string][]string{
+						codersdk.BypassRatelimitHeader: {"true"},
+					},
+				},
+			}
+
+			if userCount <= 0 {
+				return xerrors.Errorf("--user-count must be greater than 0")
+			}
+
+			if ownerUserPercentage < 0 || ownerUserPercentage > 100 {
+				return xerrors.Errorf("--owner-user-percentage must be between 0 and 100")
+			}
+
+			if smtpAPIURL != "" && !strings.HasPrefix(smtpAPIURL, "http://") && !strings.HasPrefix(smtpAPIURL, "https://") {
+				return xerrors.Errorf("--smtp-api-url must start with http:// or https://")
+			}
+
+			ownerUserCount := int64(float64(userCount) * ownerUserPercentage / 100)
+			if ownerUserCount == 0 && ownerUserPercentage > 0 {
+				ownerUserCount = 1
+			}
+			regularUserCount := userCount - ownerUserCount
+
+			_, _ = fmt.Fprintf(inv.Stderr, "Distribution plan:\n")
+			_, _ = fmt.Fprintf(inv.Stderr, "  Total users: %d\n", userCount)
+			_, _ = fmt.Fprintf(inv.Stderr, "  Owner users: %d (%.1f%%)\n", ownerUserCount, ownerUserPercentage)
+			_, _ = fmt.Fprintf(inv.Stderr, "  Regular users: %d (%.1f%%)\n", regularUserCount, 100.0-ownerUserPercentage)
+
+			outputs, err := output.parse()
+			if err != nil {
+				return xerrors.Errorf("could not parse --output flags")
+			}
+
+			tracerProvider, closeTracing, tracingEnabled, err := tracingFlags.provider(ctx)
+			if err != nil {
+				return xerrors.Errorf("create tracer provider: %w", err)
+			}
+			tracer := tracerProvider.Tracer(scaletestTracerName)
+
+			reg := prometheus.NewRegistry()
+			metrics := notifications.NewMetrics(reg)
+
+			logger := inv.Logger
+			prometheusSrvClose := ServeHandler(ctx, logger, promhttp.HandlerFor(reg, promhttp.HandlerOpts{}), prometheusFlags.Address, "prometheus")
+			defer prometheusSrvClose()
+
+			defer func() {
+				_, _ = fmt.Fprintln(inv.Stderr, "\nUploading traces...")
+				if err := closeTracing(ctx); err != nil {
+					_, _ = fmt.Fprintf(inv.Stderr, "\nError uploading traces: %+v\n", err)
+				}
+				// Wait for prometheus metrics to be scraped
+				_, _ = fmt.Fprintf(inv.Stderr, "Waiting %s for prometheus metrics to be scraped\n", prometheusFlags.Wait)
+				<-time.After(prometheusFlags.Wait)
+			}()
+
+			_, _ = fmt.Fprintln(inv.Stderr, "Creating users...")
+
+			dialBarrier := &sync.WaitGroup{}
+			ownerWatchBarrier := &sync.WaitGroup{}
+			dialBarrier.Add(int(userCount))
+			ownerWatchBarrier.Add(int(ownerUserCount))
+
+			expectedNotificationIDs := map[uuid.UUID]struct{}{
+				notificationsLib.TemplateUserAccountCreated: {},
+				notificationsLib.TemplateUserAccountDeleted: {},
+			}
+
+			triggerTimes := make(map[uuid.UUID]chan time.Time, len(expectedNotificationIDs))
+			for id := range expectedNotificationIDs {
+				triggerTimes[id] = make(chan time.Time, 1)
+			}
+
+			configs := make([]notifications.Config, 0, userCount)
+			for range ownerUserCount {
+				config := notifications.Config{
+					User: createusers.Config{
+						OrganizationID: me.OrganizationIDs[0],
+					},
+					Roles:                    []string{codersdk.RoleOwner},
+					NotificationTimeout:      notificationTimeout,
+					DialTimeout:              dialTimeout,
+					DialBarrier:              dialBarrier,
+					ReceivingWatchBarrier:    ownerWatchBarrier,
+					ExpectedNotificationsIDs: expectedNotificationIDs,
+					Metrics:                  metrics,
+					SMTPApiURL:               smtpAPIURL,
+				}
+				if err := config.Validate(); err != nil {
+					return xerrors.Errorf("validate config: %w", err)
+				}
+				configs = append(configs, config)
+			}
+			for range regularUserCount {
+				config := notifications.Config{
+					User: createusers.Config{
+						OrganizationID: me.OrganizationIDs[0],
+					},
+					Roles:                 []string{},
+					NotificationTimeout:   notificationTimeout,
+					DialTimeout:           dialTimeout,
+					DialBarrier:           dialBarrier,
+					ReceivingWatchBarrier: ownerWatchBarrier,
+					Metrics:               metrics,
+					SMTPApiURL:            smtpAPIURL,
+				}
+				if err := config.Validate(); err != nil {
+					return xerrors.Errorf("validate config: %w", err)
+				}
+				configs = append(configs, config)
+			}
+
+			go triggerUserNotifications(
+				ctx,
+				logger,
+				client,
+				me.OrganizationIDs[0],
+				dialBarrier,
+				dialTimeout,
+				triggerTimes,
+			)
+
+			th := harness.NewTestHarness(timeoutStrategy.wrapStrategy(harness.ConcurrentExecutionStrategy{}), cleanupStrategy.toStrategy())
+
+			for i, config := range configs {
+				id := strconv.Itoa(i)
+				name := fmt.Sprintf("notifications-%s", id)
+				var runner harness.Runnable = notifications.NewRunner(client, config)
+				if tracingEnabled {
+					runner = &runnableTraceWrapper{
+						tracer:   tracer,
+						spanName: name,
+						runner:   runner,
+					}
+				}
+
+				th.AddRun(name, id, runner)
+			}
+
+			_, _ = fmt.Fprintln(inv.Stderr, "Running notification delivery scaletest...")
+			testCtx, testCancel := timeoutStrategy.toContext(ctx)
+			defer testCancel()
+			err = th.Run(testCtx)
+			if err != nil {
+				return xerrors.Errorf("run test harness (harness failure, not a test failure): %w", err)
+			}
+
+			// If the command was interrupted, skip stats.
+			if notifyCtx.Err() != nil {
+				return notifyCtx.Err()
+			}
+
+			res := th.Results()
+
+			if err := computeNotificationLatencies(ctx, logger, triggerTimes, res, metrics); err != nil {
+				return xerrors.Errorf("compute notification latencies: %w", err)
+			}
+
+			for _, o := range outputs {
+				err = o.write(res, inv.Stdout)
+				if err != nil {
+					return xerrors.Errorf("write output %q to %q: %w", o.format, o.path, err)
+				}
+			}
+
+			if !noCleanup {
+				_, _ = fmt.Fprintln(inv.Stderr, "\nCleaning up...")
+				cleanupCtx, cleanupCancel := cleanupStrategy.toContext(ctx)
+				defer cleanupCancel()
+				err = th.Cleanup(cleanupCtx)
+				if err != nil {
+					return xerrors.Errorf("cleanup tests: %w", err)
+				}
+			}
+
+			if res.TotalFail > 0 {
+				return xerrors.New("load test failed, see above for more details")
+			}
+
+			return nil
+		},
+	}
+
+	cmd.Options = serpent.OptionSet{
+		{
+			Flag:          "user-count",
+			FlagShorthand: "c",
+			Env:           "CODER_SCALETEST_NOTIFICATION_USER_COUNT",
+			Description:   "Required: Total number of users to create.",
+			Value:         serpent.Int64Of(&userCount),
+			Required:      true,
+		},
+		{
+			Flag:        "owner-user-percentage",
+			Env:         "CODER_SCALETEST_NOTIFICATION_OWNER_USER_PERCENTAGE",
+			Default:     "20.0",
+			Description: "Percentage of users to assign Owner role to (0-100).",
+			Value:       serpent.Float64Of(&ownerUserPercentage),
+		},
+		{
+			Flag:        "notification-timeout",
+			Env:         "CODER_SCALETEST_NOTIFICATION_TIMEOUT",
+			Default:     "5m",
+			Description: "How long to wait for notifications after triggering.",
+			Value:       serpent.DurationOf(&notificationTimeout),
+		},
+		{
+			Flag:        "dial-timeout",
+			Env:         "CODER_SCALETEST_DIAL_TIMEOUT",
+			Default:     "2m",
+			Description: "Timeout for dialing the notification websocket endpoint.",
+			Value:       serpent.DurationOf(&dialTimeout),
+		},
+		{
+			Flag:        "no-cleanup",
+			Env:         "CODER_SCALETEST_NO_CLEANUP",
+			Description: "Do not clean up resources after the test completes.",
+			Value:       serpent.BoolOf(&noCleanup),
+		},
+		{
+			Flag:        "smtp-api-url",
+			Env:         "CODER_SCALETEST_SMTP_API_URL",
+			Description: "SMTP mock HTTP API address.",
+			Value:       serpent.StringOf(&smtpAPIURL),
+		},
+	}
+
+	tracingFlags.attach(&cmd.Options)
+	timeoutStrategy.attach(&cmd.Options)
+	cleanupStrategy.attach(&cmd.Options)
+	output.attach(&cmd.Options)
+	prometheusFlags.attach(&cmd.Options)
+	return cmd
+}
+
+func computeNotificationLatencies(
+	ctx context.Context,
+	logger slog.Logger,
+	expectedNotifications map[uuid.UUID]chan time.Time,
+	results harness.Results,
+	metrics *notifications.Metrics,
+) error {
+	triggerTimes := make(map[uuid.UUID]time.Time)
+	for notificationID, triggerTimeChan := range expectedNotifications {
+		select {
+		case triggerTime := <-triggerTimeChan:
+			triggerTimes[notificationID] = triggerTime
+			logger.Info(ctx, "received trigger time",
+				slog.F("notification_id", notificationID),
+				slog.F("trigger_time", triggerTime))
+		default:
+			logger.Warn(ctx, "no trigger time received for notification",
+				slog.F("notification_id", notificationID))
+		}
+	}
+
+	if len(triggerTimes) == 0 {
+		logger.Warn(ctx, "no trigger times available, skipping latency computation")
+		return nil
+	}
+
+	var totalLatencies int
+	for runID, runResult := range results.Runs {
+		if runResult.Error != nil {
+			logger.Debug(ctx, "skipping failed run for latency computation",
+				slog.F("run_id", runID))
+			continue
+		}
+
+		if runResult.Metrics == nil {
+			continue
+		}
+
+		// Process websocket notifications.
+		if wsReceiptTimes, ok := runResult.Metrics[notifications.WebsocketNotificationReceiptTimeMetric].(map[uuid.UUID]time.Time); ok {
+			for notificationID, receiptTime := range wsReceiptTimes {
+				if triggerTime, ok := triggerTimes[notificationID]; ok {
+					latency := receiptTime.Sub(triggerTime)
+					metrics.RecordLatency(latency, notificationID.String(), notifications.NotificationTypeWebsocket)
+					totalLatencies++
+					logger.Debug(ctx, "computed websocket latency",
+						slog.F("run_id", runID),
+						slog.F("notification_id", notificationID),
+						slog.F("latency", latency))
+				}
+			}
+		}
+
+		// Process SMTP notifications
+		if smtpReceiptTimes, ok := runResult.Metrics[notifications.SMTPNotificationReceiptTimeMetric].(map[uuid.UUID]time.Time); ok {
+			for notificationID, receiptTime := range smtpReceiptTimes {
+				if triggerTime, ok := triggerTimes[notificationID]; ok {
+					latency := receiptTime.Sub(triggerTime)
+					metrics.RecordLatency(latency, notificationID.String(), notifications.NotificationTypeSMTP)
+					totalLatencies++
+					logger.Debug(ctx, "computed SMTP latency",
+						slog.F("run_id", runID),
+						slog.F("notification_id", notificationID),
+						slog.F("latency", latency))
+				}
+			}
+		}
+	}
+
+	logger.Info(ctx, "finished computing notification latencies",
+		slog.F("total_runs", results.TotalRuns),
+		slog.F("total_latencies_computed", totalLatencies))
+
+	return nil
+}
+
+// triggerUserNotifications waits for all test users to connect,
+// then creates and deletes a test user to trigger notification events for testing.
+func triggerUserNotifications(
+	ctx context.Context,
+	logger slog.Logger,
+	client *codersdk.Client,
+	orgID uuid.UUID,
+	dialBarrier *sync.WaitGroup,
+	dialTimeout time.Duration,
+	expectedNotifications map[uuid.UUID]chan time.Time,
+) {
+	logger.Info(ctx, "waiting for all users to connect")
+
+	// Wait for all users to connect
+	waitCtx, cancel := context.WithTimeout(ctx, dialTimeout+30*time.Second)
+	defer cancel()
+
+	done := make(chan struct{})
+	go func() {
+		dialBarrier.Wait()
+		close(done)
+	}()
+
+	select {
+	case <-done:
+		logger.Info(ctx, "all users connected")
+	case <-waitCtx.Done():
+		if waitCtx.Err() == context.DeadlineExceeded {
+			logger.Error(ctx, "timeout waiting for users to connect")
+		} else {
+			logger.Info(ctx, "context canceled while waiting for users")
+		}
+		return
+	}
+
+	const (
+		triggerUsername = "scaletest-trigger-user"
+		triggerEmail    = "scaletest-trigger@example.com"
+	)
+
+	logger.Info(ctx, "creating test user to test notifications",
+		slog.F("username", triggerUsername),
+		slog.F("email", triggerEmail),
+		slog.F("org_id", orgID))
+
+	testUser, err := client.CreateUserWithOrgs(ctx, codersdk.CreateUserRequestWithOrgs{
+		OrganizationIDs: []uuid.UUID{orgID},
+		Username:        triggerUsername,
+		Email:           triggerEmail,
+		Password:        "test-password-123",
+	})
+	if err != nil {
+		logger.Error(ctx, "create test user", slog.Error(err))
+		return
+	}
+	expectedNotifications[notificationsLib.TemplateUserAccountCreated] <- time.Now()
+
+	err = client.DeleteUser(ctx, testUser.ID)
+	if err != nil {
+		logger.Error(ctx, "delete test user", slog.Error(err))
+		return
+	}
+	expectedNotifications[notificationsLib.TemplateUserAccountDeleted] <- time.Now()
+	close(expectedNotifications[notificationsLib.TemplateUserAccountCreated])
+	close(expectedNotifications[notificationsLib.TemplateUserAccountDeleted])
+}
diff --git a/scaletest/notifications/config.go b/scaletest/notifications/config.go
index ac1c6da49a01b..ac8daeb9ef9cb 100644
--- a/scaletest/notifications/config.go
+++ b/scaletest/notifications/config.go
@@ -24,9 +24,8 @@ type Config struct {
 	// DialTimeout is how long to wait for websocket connection.
 	DialTimeout time.Duration `json:"dial_timeout"`
 
-	// ExpectedNotifications maps notification template IDs to channels
-	// that receive the trigger time for each notification.
-	ExpectedNotifications map[uuid.UUID]chan time.Time `json:"-"`
+	// ExpectedNotificationsIDs is the list of notification template IDs to expect.
+	ExpectedNotificationsIDs map[uuid.UUID]struct{} `json:"-"`
 
 	Metrics *Metrics `json:"-"`
 
@@ -35,6 +34,9 @@ type Config struct {
 
 	// ReceivingWatchBarrier is the barrier for receiving users. Regular users wait on this to disconnect after receiving users complete.
 	ReceivingWatchBarrier *sync.WaitGroup `json:"-"`
+
+	// SMTPApiUrl is the URL of the SMTP mock HTTP API
+	SMTPApiURL string `json:"smtp_api_url"`
 }
 
 func (c Config) Validate() error {
diff --git a/scaletest/notifications/metrics.go b/scaletest/notifications/metrics.go
index c9e7374250b24..0bf3ebad74044 100644
--- a/scaletest/notifications/metrics.go
+++ b/scaletest/notifications/metrics.go
@@ -6,10 +6,16 @@ import (
 	"github.com/prometheus/client_golang/prometheus"
 )
 
+type NotificationType string
+
+const (
+	NotificationTypeWebsocket NotificationType = "websocket"
+	NotificationTypeSMTP      NotificationType = "smtp"
+)
+
 type Metrics struct {
 	notificationLatency *prometheus.HistogramVec
 	notificationErrors  *prometheus.CounterVec
-	missedNotifications *prometheus.CounterVec
 }
 
 func NewMetrics(reg prometheus.Registerer) *Metrics {
@@ -22,37 +28,26 @@ func NewMetrics(reg prometheus.Registerer) *Metrics {
 		Subsystem: "scaletest",
 		Name:      "notification_delivery_latency_seconds",
 		Help:      "Time between notification-creating action and receipt of notification by client",
-	}, []string{"username", "notification_type"})
+	}, []string{"notification_id", "notification_type"})
 	errors := prometheus.NewCounterVec(prometheus.CounterOpts{
 		Namespace: "coderd",
 		Subsystem: "scaletest",
 		Name:      "notification_delivery_errors_total",
 		Help:      "Total number of notification delivery errors",
-	}, []string{"username", "action"})
-	missed := prometheus.NewCounterVec(prometheus.CounterOpts{
-		Namespace: "coderd",
-		Subsystem: "scaletest",
-		Name:      "notification_delivery_missed_total",
-		Help:      "Total number of missed notifications",
-	}, []string{"username"})
+	}, []string{"action"})
 
-	reg.MustRegister(latency, errors, missed)
+	reg.MustRegister(latency, errors)
 
 	return &Metrics{
 		notificationLatency: latency,
 		notificationErrors:  errors,
-		missedNotifications: missed,
 	}
 }
 
-func (m *Metrics) RecordLatency(latency time.Duration, username, notificationType string) {
-	m.notificationLatency.WithLabelValues(username, notificationType).Observe(latency.Seconds())
-}
-
-func (m *Metrics) AddError(username, action string) {
-	m.notificationErrors.WithLabelValues(username, action).Inc()
+func (m *Metrics) RecordLatency(latency time.Duration, notificationID string, notificationType NotificationType) {
+	m.notificationLatency.WithLabelValues(notificationID, string(notificationType)).Observe(latency.Seconds())
 }
 
-func (m *Metrics) RecordMissed(username string) {
-	m.missedNotifications.WithLabelValues(username).Inc()
+func (m *Metrics) AddError(action string) {
+	m.notificationErrors.WithLabelValues(action).Inc()
 }
diff --git a/scaletest/notifications/run.go b/scaletest/notifications/run.go
index d3d68e78acb42..abe844574659e 100644
--- a/scaletest/notifications/run.go
+++ b/scaletest/notifications/run.go
@@ -3,12 +3,16 @@ package notifications
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
+	"maps"
 	"net/http"
+	"sync"
 	"time"
 
 	"github.com/google/uuid"
+	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
@@ -19,6 +23,8 @@ import (
 	"github.com/coder/coder/v2/scaletest/createusers"
 	"github.com/coder/coder/v2/scaletest/harness"
 	"github.com/coder/coder/v2/scaletest/loadtestutil"
+	"github.com/coder/coder/v2/scaletest/smtpmock"
+	"github.com/coder/quartz"
 	"github.com/coder/websocket"
 )
 
@@ -28,18 +34,32 @@ type Runner struct {
 
 	createUserRunner *createusers.Runner
 
-	// notificationLatencies stores the latency for each notification type
-	notificationLatencies map[uuid.UUID]time.Duration
+	// websocketReceiptTimes stores the receipt time for websocket notifications
+	websocketReceiptTimes   map[uuid.UUID]time.Time
+	websocketReceiptTimesMu sync.RWMutex
+
+	// smtpReceiptTimes stores the receipt time for SMTP notifications
+	smtpReceiptTimes   map[uuid.UUID]time.Time
+	smtpReceiptTimesMu sync.RWMutex
+
+	clock quartz.Clock
 }
 
 func NewRunner(client *codersdk.Client, cfg Config) *Runner {
 	return &Runner{
 		client:                client,
 		cfg:                   cfg,
-		notificationLatencies: make(map[uuid.UUID]time.Duration),
+		websocketReceiptTimes: make(map[uuid.UUID]time.Time),
+		smtpReceiptTimes:      make(map[uuid.UUID]time.Time),
+		clock:                 quartz.NewReal(),
 	}
 }
 
+func (r *Runner) WithClock(clock quartz.Clock) *Runner {
+	r.clock = clock
+	return r
+}
+
 var (
 	_ harness.Runnable    = &Runner{}
 	_ harness.Cleanable   = &Runner{}
@@ -59,7 +79,7 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 
 	reachedReceivingWatchBarrier := false
 	defer func() {
-		if len(r.cfg.ExpectedNotifications) > 0 && !reachedReceivingWatchBarrier {
+		if len(r.cfg.ExpectedNotificationsIDs) > 0 && !reachedReceivingWatchBarrier {
 			r.cfg.ReceivingWatchBarrier.Done()
 		}
 	}()
@@ -72,7 +92,7 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 	r.createUserRunner = createusers.NewRunner(r.client, r.cfg.User)
 	newUserAndToken, err := r.createUserRunner.RunReturningUser(ctx, id, logs)
 	if err != nil {
-		r.cfg.Metrics.AddError("", "create_user")
+		r.cfg.Metrics.AddError("create_user")
 		return xerrors.Errorf("create user: %w", err)
 	}
 	newUser := newUserAndToken.User
@@ -90,7 +110,7 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 			Roles: r.cfg.Roles,
 		})
 		if err != nil {
-			r.cfg.Metrics.AddError(newUser.Username, "assign_roles")
+			r.cfg.Metrics.AddError("assign_roles")
 			return xerrors.Errorf("assign roles: %w", err)
 		}
 	}
@@ -101,7 +121,7 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 	defer cancel()
 
 	logger.Info(ctx, "connecting to notification websocket")
-	conn, err := r.dialNotificationWebsocket(dialCtx, newUserClient, newUser, logger)
+	conn, err := r.dialNotificationWebsocket(dialCtx, newUserClient, logger)
 	if err != nil {
 		return xerrors.Errorf("dial notification websocket: %w", err)
 	}
@@ -112,7 +132,7 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 	r.cfg.DialBarrier.Done()
 	r.cfg.DialBarrier.Wait()
 
-	if len(r.cfg.ExpectedNotifications) == 0 {
+	if len(r.cfg.ExpectedNotificationsIDs) == 0 {
 		logger.Info(ctx, "maintaining websocket connection, waiting for receiving users to complete")
 
 		// Wait for receiving users to complete
@@ -136,7 +156,20 @@ func (r *Runner) Run(ctx context.Context, id string, logs io.Writer) error {
 	watchCtx, cancel := context.WithTimeout(ctx, r.cfg.NotificationTimeout)
 	defer cancel()
 
-	if err := r.watchNotifications(watchCtx, conn, newUser, logger, r.cfg.ExpectedNotifications); err != nil {
+	eg, egCtx := errgroup.WithContext(watchCtx)
+
+	eg.Go(func() error {
+		return r.watchNotifications(egCtx, conn, newUser, logger, r.cfg.ExpectedNotificationsIDs)
+	})
+
+	if r.cfg.SMTPApiURL != "" {
+		logger.Info(ctx, "running SMTP notification watcher")
+		eg.Go(func() error {
+			return r.watchNotificationsSMTP(egCtx, newUser, logger, r.cfg.ExpectedNotificationsIDs)
+		})
+	}
+
+	if err := eg.Wait(); err != nil {
 		return xerrors.Errorf("notification watch failed: %w", err)
 	}
 
@@ -157,19 +190,31 @@ func (r *Runner) Cleanup(ctx context.Context, id string, logs io.Writer) error {
 	return nil
 }
 
-const NotificationDeliveryLatencyMetric = "notification_delivery_latency_seconds"
+const (
+	WebsocketNotificationReceiptTimeMetric = "notification_websocket_receipt_time"
+	SMTPNotificationReceiptTimeMetric      = "notification_smtp_receipt_time"
+)
 
 func (r *Runner) GetMetrics() map[string]any {
+	r.websocketReceiptTimesMu.RLock()
+	websocketReceiptTimes := maps.Clone(r.websocketReceiptTimes)
+	r.websocketReceiptTimesMu.RUnlock()
+
+	r.smtpReceiptTimesMu.RLock()
+	smtpReceiptTimes := maps.Clone(r.smtpReceiptTimes)
+	r.smtpReceiptTimesMu.RUnlock()
+
 	return map[string]any{
-		NotificationDeliveryLatencyMetric: r.notificationLatencies,
+		WebsocketNotificationReceiptTimeMetric: websocketReceiptTimes,
+		SMTPNotificationReceiptTimeMetric:      smtpReceiptTimes,
 	}
 }
 
-func (r *Runner) dialNotificationWebsocket(ctx context.Context, client *codersdk.Client, user codersdk.User, logger slog.Logger) (*websocket.Conn, error) {
+func (r *Runner) dialNotificationWebsocket(ctx context.Context, client *codersdk.Client, logger slog.Logger) (*websocket.Conn, error) {
 	u, err := client.URL.Parse("/api/v2/notifications/inbox/watch")
 	if err != nil {
 		logger.Error(ctx, "parse notification URL", slog.Error(err))
-		r.cfg.Metrics.AddError(user.Username, "parse_url")
+		r.cfg.Metrics.AddError("parse_url")
 		return nil, xerrors.Errorf("parse notification URL: %w", err)
 	}
 
@@ -186,7 +231,7 @@ func (r *Runner) dialNotificationWebsocket(ctx context.Context, client *codersdk
 			}
 		}
 		logger.Error(ctx, "dial notification websocket", slog.Error(err))
-		r.cfg.Metrics.AddError(user.Username, "dial")
+		r.cfg.Metrics.AddError("dial")
 		return nil, xerrors.Errorf("dial notification websocket: %w", err)
 	}
 
@@ -195,7 +240,7 @@ func (r *Runner) dialNotificationWebsocket(ctx context.Context, client *codersdk
 
 // watchNotifications reads notifications from the websocket and returns error or nil
 // once all expected notifications are received.
-func (r *Runner) watchNotifications(ctx context.Context, conn *websocket.Conn, user codersdk.User, logger slog.Logger, expectedNotifications map[uuid.UUID]chan time.Time) error {
+func (r *Runner) watchNotifications(ctx context.Context, conn *websocket.Conn, user codersdk.User, logger slog.Logger, expectedNotifications map[uuid.UUID]struct{}) error {
 	logger.Info(ctx, "waiting for notifications",
 		slog.F("username", user.Username),
 		slog.F("expected_count", len(expectedNotifications)))
@@ -217,28 +262,23 @@ func (r *Runner) watchNotifications(ctx context.Context, conn *websocket.Conn, u
 		notif, err := readNotification(ctx, conn)
 		if err != nil {
 			logger.Error(ctx, "read notification", slog.Error(err))
-			r.cfg.Metrics.AddError(user.Username, "read_notification")
+			r.cfg.Metrics.AddError("read_notification_websocket")
 			return xerrors.Errorf("read notification: %w", err)
 		}
 
 		templateID := notif.Notification.TemplateID
-		if triggerTimeChan, exists := expectedNotifications[templateID]; exists {
-			if _, exists := receivedNotifications[templateID]; !exists {
+		if _, exists := expectedNotifications[templateID]; exists {
+			if _, received := receivedNotifications[templateID]; !received {
 				receiptTime := time.Now()
-				select {
-				case triggerTime := <-triggerTimeChan:
-					latency := receiptTime.Sub(triggerTime)
-					r.notificationLatencies[templateID] = latency
-					r.cfg.Metrics.RecordLatency(latency, user.Username, templateID.String())
-					receivedNotifications[templateID] = struct{}{}
-
-					logger.Info(ctx, "received expected notification",
-						slog.F("template_id", templateID),
-						slog.F("title", notif.Notification.Title),
-						slog.F("latency", latency))
-				case <-ctx.Done():
-					return xerrors.Errorf("context canceled while waiting for trigger time: %w", ctx.Err())
-				}
+				r.websocketReceiptTimesMu.Lock()
+				r.websocketReceiptTimes[templateID] = receiptTime
+				r.websocketReceiptTimesMu.Unlock()
+				receivedNotifications[templateID] = struct{}{}
+
+				logger.Info(ctx, "received expected notification",
+					slog.F("template_id", templateID),
+					slog.F("title", notif.Notification.Title),
+					slog.F("receipt_time", receiptTime))
 			}
 		} else {
 			logger.Debug(ctx, "received notification not being tested",
@@ -248,6 +288,97 @@ func (r *Runner) watchNotifications(ctx context.Context, conn *websocket.Conn, u
 	}
 }
 
+// watchNotificationsSMTP polls the SMTP HTTP API for notifications and returns error or nil
+// once all expected notifications are received.
+func (r *Runner) watchNotificationsSMTP(ctx context.Context, user codersdk.User, logger slog.Logger, expectedNotifications map[uuid.UUID]struct{}) error {
+	logger.Info(ctx, "polling SMTP API for notifications",
+		slog.F("email", user.Email),
+		slog.F("expected_count", len(expectedNotifications)),
+	)
+	receivedNotifications := make(map[uuid.UUID]struct{})
+
+	apiURL := fmt.Sprintf("%s/messages?email=%s", r.cfg.SMTPApiURL, user.Email)
+	httpClient := &http.Client{
+		Timeout: 10 * time.Second,
+	}
+
+	const smtpPollInterval = 2 * time.Second
+	done := xerrors.New("done")
+
+	tkr := r.clock.TickerFunc(ctx, smtpPollInterval, func() error {
+		req, err := http.NewRequestWithContext(ctx, http.MethodGet, apiURL, nil)
+		if err != nil {
+			logger.Error(ctx, "create SMTP API request", slog.Error(err))
+			r.cfg.Metrics.AddError("smtp_create_request")
+			return xerrors.Errorf("create SMTP API request: %w", err)
+		}
+
+		resp, err := httpClient.Do(req)
+		if err != nil {
+			logger.Error(ctx, "poll smtp api for notifications", slog.Error(err))
+			r.cfg.Metrics.AddError("smtp_poll")
+			return xerrors.Errorf("poll smtp api: %w", err)
+		}
+
+		if resp.StatusCode != http.StatusOK {
+			_ = resp.Body.Close()
+			logger.Error(ctx, "smtp api returned non-200 status", slog.F("status", resp.StatusCode))
+			r.cfg.Metrics.AddError("smtp_bad_status")
+			return xerrors.Errorf("smtp api returned status %d", resp.StatusCode)
+		}
+
+		var summaries []smtpmock.EmailSummary
+		if err := json.NewDecoder(resp.Body).Decode(&summaries); err != nil {
+			_ = resp.Body.Close()
+			logger.Error(ctx, "decode smtp api response", slog.Error(err))
+			r.cfg.Metrics.AddError("smtp_decode")
+			return xerrors.Errorf("decode smtp api response: %w", err)
+		}
+		_ = resp.Body.Close()
+
+		// Process each email summary
+		for _, summary := range summaries {
+			notificationID := summary.NotificationTemplateID
+			if notificationID == uuid.Nil {
+				continue
+			}
+
+			if _, exists := expectedNotifications[notificationID]; exists {
+				if _, received := receivedNotifications[notificationID]; !received {
+					receiptTime := summary.Date
+					if receiptTime.IsZero() {
+						receiptTime = time.Now()
+					}
+
+					r.smtpReceiptTimesMu.Lock()
+					r.smtpReceiptTimes[notificationID] = receiptTime
+					r.smtpReceiptTimesMu.Unlock()
+					receivedNotifications[notificationID] = struct{}{}
+
+					logger.Info(ctx, "received expected notification via SMTP",
+						slog.F("notification_id", notificationID),
+						slog.F("subject", summary.Subject),
+						slog.F("receipt_time", receiptTime))
+				}
+			}
+		}
+
+		if len(receivedNotifications) == len(expectedNotifications) {
+			logger.Info(ctx, "received all expected notifications via SMTP")
+			return done
+		}
+
+		return nil
+	}, "smtp")
+
+	err := tkr.Wait()
+	if errors.Is(err, done) {
+		return nil
+	}
+
+	return err
+}
+
 func readNotification(ctx context.Context, conn *websocket.Conn) (codersdk.GetInboxNotificationResponse, error) {
 	_, message, err := conn.Read(ctx)
 	if err != nil {
diff --git a/scaletest/notifications/run_test.go b/scaletest/notifications/run_test.go
index e94e6d82eab56..1e198e9edd91d 100644
--- a/scaletest/notifications/run_test.go
+++ b/scaletest/notifications/run_test.go
@@ -1,7 +1,11 @@
 package notifications_test
 
 import (
+	"context"
+	"encoding/json"
 	"io"
+	"net/http"
+	"net/http/httptest"
 	"strconv"
 	"sync"
 	"testing"
@@ -9,22 +13,19 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
-	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"golang.org/x/sync/errgroup"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/serpent"
 
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
-	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	notificationsLib "github.com/coder/coder/v2/coderd/notifications"
 	"github.com/coder/coder/v2/coderd/notifications/dispatch"
+	"github.com/coder/coder/v2/coderd/notifications/types"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/scaletest/createusers"
 	"github.com/coder/coder/v2/scaletest/notifications"
+	"github.com/coder/coder/v2/scaletest/smtpmock"
 	"github.com/coder/coder/v2/testutil"
 	"github.com/coder/quartz"
 )
@@ -36,39 +37,11 @@ func TestRun(t *testing.T) {
 	logger := testutil.Logger(t)
 	db, ps := dbtestutil.NewDB(t)
 
-	// Setup notifications manager with inbox handler
-	cfg := defaultNotificationsConfig(database.NotificationMethodSmtp)
-	mgr, err := notificationsLib.NewManager(
-		cfg,
-		db,
-		ps,
-		defaultHelpers(),
-		notificationsLib.NewMetrics(prometheus.NewRegistry()),
-		logger.Named("manager"),
-	)
-	require.NoError(t, err)
-
-	mgr.WithHandlers(map[database.NotificationMethod]notificationsLib.Handler{
-		database.NotificationMethodInbox: dispatch.NewInboxHandler(logger.Named("inbox"), db, ps),
-	})
-	t.Cleanup(func() {
-		assert.NoError(t, mgr.Stop(dbauthz.AsNotifier(ctx)))
-	})
-	mgr.Run(dbauthz.AsNotifier(ctx))
-
-	enqueuer, err := notificationsLib.NewStoreEnqueuer(
-		cfg,
-		db,
-		defaultHelpers(),
-		logger.Named("enqueuer"),
-		quartz.NewReal(),
-	)
-	require.NoError(t, err)
+	inboxHandler := dispatch.NewInboxHandler(logger.Named("inbox"), db, ps)
 
 	client := coderdtest.New(t, &coderdtest.Options{
-		Database:              db,
-		Pubsub:                ps,
-		NotificationsEnqueuer: enqueuer,
+		Database: db,
+		Pubsub:   ps,
 	})
 	firstUser := coderdtest.CreateFirstUser(t, client)
 
@@ -82,30 +55,184 @@ func TestRun(t *testing.T) {
 
 	eg, runCtx := errgroup.WithContext(ctx)
 
-	expectedNotifications := map[uuid.UUID]chan time.Time{
-		notificationsLib.TemplateUserAccountCreated: make(chan time.Time, 1),
-		notificationsLib.TemplateUserAccountDeleted: make(chan time.Time, 1),
+	expectedNotificationsIDs := map[uuid.UUID]struct{}{
+		notificationsLib.TemplateUserAccountCreated: {},
+		notificationsLib.TemplateUserAccountDeleted: {},
 	}
 
 	// Start receiving runners who will receive notifications
 	receivingRunners := make([]*notifications.Runner, 0, numReceivingUsers)
 	for i := range numReceivingUsers {
+		runnerCfg := notifications.Config{
+			User: createusers.Config{
+				OrganizationID: firstUser.OrganizationID,
+				Username:       "receiving-user-" + strconv.Itoa(i),
+			},
+			Roles:                    []string{codersdk.RoleOwner},
+			NotificationTimeout:      testutil.WaitLong,
+			DialTimeout:              testutil.WaitLong,
+			Metrics:                  metrics,
+			DialBarrier:              dialBarrier,
+			ReceivingWatchBarrier:    receivingWatchBarrier,
+			ExpectedNotificationsIDs: expectedNotificationsIDs,
+		}
+		err := runnerCfg.Validate()
+		require.NoError(t, err)
+
+		runner := notifications.NewRunner(client, runnerCfg)
+		receivingRunners = append(receivingRunners, runner)
+		eg.Go(func() error {
+			return runner.Run(runCtx, "receiving-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+
+	// Start regular user runners who will maintain websocket connections
+	regularRunners := make([]*notifications.Runner, 0, numRegularUsers)
+	for i := range numRegularUsers {
 		runnerCfg := notifications.Config{
 			User: createusers.Config{
 				OrganizationID: firstUser.OrganizationID,
 			},
-			Roles:                 []string{codersdk.RoleOwner},
+			Roles:                 []string{},
 			NotificationTimeout:   testutil.WaitLong,
 			DialTimeout:           testutil.WaitLong,
 			Metrics:               metrics,
 			DialBarrier:           dialBarrier,
 			ReceivingWatchBarrier: receivingWatchBarrier,
-			ExpectedNotifications: expectedNotifications,
 		}
 		err := runnerCfg.Validate()
 		require.NoError(t, err)
 
 		runner := notifications.NewRunner(client, runnerCfg)
+		regularRunners = append(regularRunners, runner)
+		eg.Go(func() error {
+			return runner.Run(runCtx, "regular-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+
+	// Trigger notifications by creating and deleting a user
+	eg.Go(func() error {
+		// Wait for all runners to connect
+		dialBarrier.Wait()
+
+		for i := 0; i < numReceivingUsers; i++ {
+			err := sendInboxNotification(runCtx, t, db, inboxHandler, "receiving-user-"+strconv.Itoa(i), notificationsLib.TemplateUserAccountCreated)
+			require.NoError(t, err)
+			err = sendInboxNotification(runCtx, t, db, inboxHandler, "receiving-user-"+strconv.Itoa(i), notificationsLib.TemplateUserAccountDeleted)
+			require.NoError(t, err)
+		}
+
+		return nil
+	})
+
+	err := eg.Wait()
+	require.NoError(t, err, "runner execution should complete successfully")
+
+	cleanupEg, cleanupCtx := errgroup.WithContext(ctx)
+	for i, runner := range receivingRunners {
+		cleanupEg.Go(func() error {
+			return runner.Cleanup(cleanupCtx, "receiving-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+	for i, runner := range regularRunners {
+		cleanupEg.Go(func() error {
+			return runner.Cleanup(cleanupCtx, "regular-"+strconv.Itoa(i), io.Discard)
+		})
+	}
+	err = cleanupEg.Wait()
+	require.NoError(t, err)
+
+	users, err := client.Users(ctx, codersdk.UsersRequest{})
+	require.NoError(t, err)
+	require.Len(t, users.Users, 1)
+	require.Equal(t, firstUser.UserID, users.Users[0].ID)
+
+	for _, runner := range receivingRunners {
+		metrics := runner.GetMetrics()
+		websocketReceiptTimes := metrics[notifications.WebsocketNotificationReceiptTimeMetric].(map[uuid.UUID]time.Time)
+
+		require.Contains(t, websocketReceiptTimes, notificationsLib.TemplateUserAccountCreated)
+		require.Contains(t, websocketReceiptTimes, notificationsLib.TemplateUserAccountDeleted)
+	}
+}
+
+func TestRunWithSMTP(t *testing.T) {
+	t.Parallel()
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+	logger := testutil.Logger(t)
+	db, ps := dbtestutil.NewDB(t)
+
+	inboxHandler := dispatch.NewInboxHandler(logger.Named("inbox"), db, ps)
+
+	client := coderdtest.New(t, &coderdtest.Options{
+		Database: db,
+		Pubsub:   ps,
+	})
+	firstUser := coderdtest.CreateFirstUser(t, client)
+
+	smtpAPIMux := http.NewServeMux()
+	smtpAPIMux.HandleFunc("/messages", func(w http.ResponseWriter, r *http.Request) {
+		summaries := []smtpmock.EmailSummary{
+			{
+				Subject:                "TemplateUserAccountCreated",
+				Date:                   time.Now(),
+				NotificationTemplateID: notificationsLib.TemplateUserAccountCreated,
+			},
+			{
+				Subject:                "TemplateUserAccountDeleted",
+				Date:                   time.Now(),
+				NotificationTemplateID: notificationsLib.TemplateUserAccountDeleted,
+			},
+		}
+
+		w.Header().Set("Content-Type", "application/json")
+		_ = json.NewEncoder(w).Encode(summaries)
+	})
+
+	smtpAPIServer := httptest.NewServer(smtpAPIMux)
+	defer smtpAPIServer.Close()
+
+	const numReceivingUsers = 2
+	const numRegularUsers = 2
+	dialBarrier := new(sync.WaitGroup)
+	receivingWatchBarrier := new(sync.WaitGroup)
+	dialBarrier.Add(numReceivingUsers + numRegularUsers)
+	receivingWatchBarrier.Add(numReceivingUsers)
+	metrics := notifications.NewMetrics(prometheus.NewRegistry())
+
+	eg, runCtx := errgroup.WithContext(ctx)
+
+	expectedNotificationsIDs := map[uuid.UUID]struct{}{
+		notificationsLib.TemplateUserAccountCreated: {},
+		notificationsLib.TemplateUserAccountDeleted: {},
+	}
+
+	mClock := quartz.NewMock(t)
+	smtpTrap := mClock.Trap().TickerFunc("smtp")
+	defer smtpTrap.Close()
+
+	// Start receiving runners who will receive notifications
+	receivingRunners := make([]*notifications.Runner, 0, numReceivingUsers)
+	for i := range numReceivingUsers {
+		runnerCfg := notifications.Config{
+			User: createusers.Config{
+				OrganizationID: firstUser.OrganizationID,
+				Username:       "receiving-user-" + strconv.Itoa(i),
+			},
+			Roles:                    []string{codersdk.RoleOwner},
+			NotificationTimeout:      testutil.WaitLong,
+			DialTimeout:              testutil.WaitLong,
+			Metrics:                  metrics,
+			DialBarrier:              dialBarrier,
+			ReceivingWatchBarrier:    receivingWatchBarrier,
+			ExpectedNotificationsIDs: expectedNotificationsIDs,
+			SMTPApiURL:               smtpAPIServer.URL,
+		}
+		err := runnerCfg.Validate()
+		require.NoError(t, err)
+
+		runner := notifications.NewRunner(client, runnerCfg).WithClock(mClock)
 		receivingRunners = append(receivingRunners, runner)
 		eg.Go(func() error {
 			return runner.Run(runCtx, "receiving-"+strconv.Itoa(i), io.Discard)
@@ -141,32 +268,25 @@ func TestRun(t *testing.T) {
 		// Wait for all runners to connect
 		dialBarrier.Wait()
 
-		createTime := time.Now()
-		newUser, err := client.CreateUserWithOrgs(runCtx, codersdk.CreateUserRequestWithOrgs{
-			OrganizationIDs: []uuid.UUID{firstUser.OrganizationID},
-			Email:           "test-user@coder.com",
-			Username:        "test-user",
-			Password:        "SomeSecurePassword!",
-		})
-		if err != nil {
-			return xerrors.Errorf("create test user: %w", err)
+		for i := 0; i < numReceivingUsers; i++ {
+			smtpTrap.MustWait(runCtx).MustRelease(runCtx)
 		}
-		expectedNotifications[notificationsLib.TemplateUserAccountCreated] <- createTime
 
-		deleteTime := time.Now()
-		if err := client.DeleteUser(runCtx, newUser.ID); err != nil {
-			return xerrors.Errorf("delete test user: %w", err)
+		for i := 0; i < numReceivingUsers; i++ {
+			err := sendInboxNotification(runCtx, t, db, inboxHandler, "receiving-user-"+strconv.Itoa(i), notificationsLib.TemplateUserAccountCreated)
+			require.NoError(t, err)
+			err = sendInboxNotification(runCtx, t, db, inboxHandler, "receiving-user-"+strconv.Itoa(i), notificationsLib.TemplateUserAccountDeleted)
+			require.NoError(t, err)
 		}
-		expectedNotifications[notificationsLib.TemplateUserAccountDeleted] <- deleteTime
 
-		close(expectedNotifications[notificationsLib.TemplateUserAccountCreated])
-		close(expectedNotifications[notificationsLib.TemplateUserAccountDeleted])
+		_, w := mClock.AdvanceNext()
+		w.MustWait(runCtx)
 
 		return nil
 	})
 
-	err = eg.Wait()
-	require.NoError(t, err, "runner execution should complete successfully")
+	err := eg.Wait()
+	require.NoError(t, err, "runner execution with SMTP should complete successfully")
 
 	cleanupEg, cleanupCtx := errgroup.WithContext(ctx)
 	for i, runner := range receivingRunners {
@@ -187,35 +307,37 @@ func TestRun(t *testing.T) {
 	require.Len(t, users.Users, 1)
 	require.Equal(t, firstUser.UserID, users.Users[0].ID)
 
+	// Verify that notifications were received via both websocket and SMTP
 	for _, runner := range receivingRunners {
-		runnerMetrics := runner.GetMetrics()[notifications.NotificationDeliveryLatencyMetric].(map[uuid.UUID]time.Duration)
-		require.Contains(t, runnerMetrics, notificationsLib.TemplateUserAccountCreated)
-		require.Contains(t, runnerMetrics, notificationsLib.TemplateUserAccountDeleted)
+		metrics := runner.GetMetrics()
+		websocketReceiptTimes := metrics[notifications.WebsocketNotificationReceiptTimeMetric].(map[uuid.UUID]time.Time)
+		smtpReceiptTimes := metrics[notifications.SMTPNotificationReceiptTimeMetric].(map[uuid.UUID]time.Time)
+
+		require.Contains(t, websocketReceiptTimes, notificationsLib.TemplateUserAccountCreated)
+		require.Contains(t, websocketReceiptTimes, notificationsLib.TemplateUserAccountDeleted)
+		require.Contains(t, smtpReceiptTimes, notificationsLib.TemplateUserAccountCreated)
+		require.Contains(t, smtpReceiptTimes, notificationsLib.TemplateUserAccountDeleted)
 	}
 }
 
-func defaultNotificationsConfig(method database.NotificationMethod) codersdk.NotificationsConfig {
-	return codersdk.NotificationsConfig{
-		Method:              serpent.String(method),
-		MaxSendAttempts:     5,
-		FetchInterval:       serpent.Duration(time.Millisecond * 100),
-		StoreSyncInterval:   serpent.Duration(time.Millisecond * 200),
-		LeasePeriod:         serpent.Duration(time.Second * 10),
-		DispatchTimeout:     serpent.Duration(time.Second * 5),
-		RetryInterval:       serpent.Duration(time.Millisecond * 50),
-		LeaseCount:          10,
-		StoreSyncBufferSize: 50,
-		Inbox: codersdk.NotificationsInboxConfig{
-			Enabled: serpent.Bool(true),
-		},
+func sendInboxNotification(ctx context.Context, t *testing.T, db database.Store, inboxHandler *dispatch.InboxHandler, username string, templateID uuid.UUID) error {
+	user, err := db.GetUserByEmailOrUsername(ctx, database.GetUserByEmailOrUsernameParams{
+		Username: username,
+	})
+	require.NoError(t, err)
+
+	dispatchFunc, err := inboxHandler.Dispatcher(types.MessagePayload{
+		UserID:                 user.ID.String(),
+		NotificationTemplateID: templateID.String(),
+	}, "", "", nil)
+	if err != nil {
+		return err
 	}
-}
 
-func defaultHelpers() map[string]any {
-	return map[string]any{
-		"base_url":     func() string { return "http://test.com" },
-		"current_year": func() string { return "2024" },
-		"logo_url":     func() string { return "https://coder.com/coder-logo-horizontal.png" },
-		"app_name":     func() string { return "Coder" },
+	_, err = dispatchFunc(ctx, uuid.New())
+	if err != nil {
+		return err
 	}
+
+	return nil
 }

From aa689cbb394ea4378b577a3fc29d30faac33a014 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Wed, 22 Oct 2025 10:16:53 -0300
Subject: [PATCH 199/298] feat: add terminal in the task page (#20396)

**Demo:**

<img width="1624" height="967" alt="Screenshot 2025-10-21 at 10 45 24"
src="https://github.com/user-attachments/assets/b0ae724f-055a-4b13-b2a6-f11f4432de9b"
/>

Closes https://github.com/coder/internal/issues/1077
---
 site/src/pages/TaskPage/TaskAppIframe.tsx | 24 +++++---
 site/src/pages/TaskPage/TaskApps.tsx      | 69 +++++++++++++++++------
 2 files changed, 68 insertions(+), 25 deletions(-)

diff --git a/site/src/pages/TaskPage/TaskAppIframe.tsx b/site/src/pages/TaskPage/TaskAppIframe.tsx
index e1803948c4ed9..e66c8009d0e62 100644
--- a/site/src/pages/TaskPage/TaskAppIframe.tsx
+++ b/site/src/pages/TaskPage/TaskAppIframe.tsx
@@ -10,7 +10,7 @@ import { useProxy } from "contexts/ProxyContext";
 import { EllipsisVertical, ExternalLinkIcon, HouseIcon } from "lucide-react";
 import { useAppLink } from "modules/apps/useAppLink";
 import type { Task, WorkspaceAppWithAgent } from "modules/tasks/tasks";
-import { type FC, useRef } from "react";
+import { type FC, type HTMLProps, useRef } from "react";
 import { Link as RouterLink } from "react-router";
 import { cn } from "utils/cn";
 import { TaskWildcardWarning } from "./TaskWildcardWarning";
@@ -85,14 +85,7 @@ export const TaskAppIFrame: FC<TaskAppIFrameProps> = ({
 			)}
 
 			{app.health === "healthy" || app.health === "disabled" ? (
-				<iframe
-					ref={frameRef}
-					src={link.href}
-					title={link.label}
-					loading="eager"
-					className={"w-full h-full border-0"}
-					allow="clipboard-read; clipboard-write"
-				/>
+				<TaskIframe ref={frameRef} src={link.href} title={link.label} />
 			) : app.health === "unhealthy" ? (
 				<div className="w-full h-full flex flex-col items-center justify-center p-4">
 					<h3 className="m-0 font-medium text-content-primary text-base text-center">
@@ -145,3 +138,16 @@ export const TaskAppIFrame: FC<TaskAppIFrameProps> = ({
 		</div>
 	);
 };
+
+type TaskIframeProps = HTMLProps<HTMLIFrameElement>;
+
+export const TaskIframe: FC<TaskIframeProps> = ({ className, ...props }) => {
+	return (
+		<iframe
+			loading="eager"
+			className={cn("w-full h-full border-0", className)}
+			allow="clipboard-read; clipboard-write"
+			{...props}
+		/>
+	);
+};
diff --git a/site/src/pages/TaskPage/TaskApps.tsx b/site/src/pages/TaskPage/TaskApps.tsx
index 6a2d925e421ac..77d757b343243 100644
--- a/site/src/pages/TaskPage/TaskApps.tsx
+++ b/site/src/pages/TaskPage/TaskApps.tsx
@@ -9,24 +9,26 @@ import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import { InfoTooltip } from "components/InfoTooltip/InfoTooltip";
 import { Link } from "components/Link/Link";
 import { ScrollArea, ScrollBar } from "components/ScrollArea/ScrollArea";
-import { ChevronDownIcon, LayoutGridIcon } from "lucide-react";
+import { ChevronDownIcon, LayoutGridIcon, TerminalIcon } from "lucide-react";
+import { getTerminalHref } from "modules/apps/apps";
 import { useAppLink } from "modules/apps/useAppLink";
 import {
 	getTaskApps,
 	type Task,
 	type WorkspaceAppWithAgent,
 } from "modules/tasks/tasks";
-import type React from "react";
 import { type FC, useState } from "react";
-import { Link as RouterLink } from "react-router";
+import { type LinkProps, Link as RouterLink } from "react-router";
 import { cn } from "utils/cn";
 import { docs } from "utils/docs";
-import { TaskAppIFrame } from "./TaskAppIframe";
+import { TaskAppIFrame, TaskIframe } from "./TaskAppIframe";
 
 type TaskAppsProps = {
 	task: Task;
 };
 
+const TERMINAL_TAB_ID = "terminal";
+
 export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 	const apps = getTaskApps(task).filter(
 		// The Chat UI app will be displayed in the sidebar, so we don't want to
@@ -39,6 +41,13 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 	const [activeAppId, setActiveAppId] = useState(embeddedApps.at(0)?.id);
 	const hasAvailableAppsToDisplay =
 		embeddedApps.length > 0 || externalApps.length > 0;
+	const taskAgent = apps.at(0)?.agent;
+	const terminalHref = getTerminalHref({
+		username: task.workspace.owner_name,
+		workspace: task.workspace.name,
+		agent: taskAgent?.name,
+	});
+	const isTerminalActive = activeAppId === TERMINAL_TAB_ID;
 
 	return (
 		<main className="flex flex-col h-full">
@@ -58,6 +67,17 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 									}}
 								/>
 							))}
+							<TaskTab
+								to={terminalHref}
+								active={isTerminalActive}
+								onClick={(e) => {
+									e.preventDefault();
+									setActiveAppId(TERMINAL_TAB_ID);
+								}}
+							>
+								<TerminalIcon />
+								Terminal
+							</TaskTab>
 						</div>
 						<ScrollBar orientation="horizontal" className="h-2" />
 					</ScrollArea>
@@ -78,6 +98,14 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 							task={task}
 						/>
 					))}
+
+					<TaskIframe
+						src={terminalHref}
+						title="Terminal"
+						className={cn({
+							hidden: !isTerminalActive,
+						})}
+					/>
 				</div>
 			) : (
 				<div className="mx-auto my-auto flex flex-col items-center">
@@ -161,11 +189,30 @@ const TaskAppTab: FC<TaskAppTabProps> = ({ task, app, active, onClick }) => {
 		workspace: task.workspace,
 	});
 
+	return (
+		<TaskTab active={active} to={link.href} onClick={onClick}>
+			{app.icon ? <ExternalImage src={app.icon} /> : <LayoutGridIcon />}
+			{link.label}
+			{app.health === "unhealthy" && (
+				<InfoTooltip
+					title="This app is unhealthy."
+					message="The health check failed."
+					type="warning"
+				/>
+			)}
+		</TaskTab>
+	);
+};
+
+type TaskTabProps = LinkProps & {
+	active: boolean;
+};
+
+const TaskTab: FC<TaskTabProps> = ({ active, ...routerLinkProps }) => {
 	return (
 		<Button
 			size="sm"
 			variant="subtle"
-			key={app.id}
 			asChild
 			className={cn([
 				"px-3",
@@ -176,17 +223,7 @@ const TaskAppTab: FC<TaskAppTabProps> = ({ task, app, active, onClick }) => {
 				{ "opacity-75 hover:opacity-100": !active },
 			])}
 		>
-			<RouterLink to={link.href} onClick={onClick}>
-				{app.icon ? <ExternalImage src={app.icon} /> : <LayoutGridIcon />}
-				{link.label}
-				{app.health === "unhealthy" && (
-					<InfoTooltip
-						title="This app is unhealthy."
-						message="The health check failed."
-						type="warning"
-					/>
-				)}
-			</RouterLink>
+			<RouterLink {...routerLinkProps} />
 		</Button>
 	);
 };

From f2a410566c60acfcae17a5adfb8d6fc758860fea Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Wed, 22 Oct 2025 15:35:16 +0200
Subject: [PATCH 200/298] feat: add support buttons (#20339)

Fixes: https://github.com/coder/coder/issues/16804
---
 coderd/apidoc/docs.go                         | 10 ++-
 coderd/apidoc/swagger.json                    |  6 +-
 codersdk/deployment.go                        | 11 ++--
 docs/reference/api/enterprise.md              |  1 +
 docs/reference/api/general.md                 |  1 +
 docs/reference/api/schemas.md                 | 30 ++++++---
 enterprise/coderd/appearance_test.go          | 11 ++++
 site/src/api/typesGenerated.ts                |  1 +
 site/src/modules/dashboard/Navbar/Navbar.tsx  |  9 ++-
 .../dashboard/Navbar/NavbarView.stories.tsx   | 62 ++++++++++++++++++
 .../dashboard/Navbar/NavbarView.test.tsx      |  4 ++
 .../modules/dashboard/Navbar/NavbarView.tsx   | 48 +++++++++++++-
 .../modules/dashboard/Navbar/SupportIcon.tsx  | 39 ++++++++++++
 .../Navbar/UserDropdown/UserDropdown.tsx      |  2 +-
 .../UserDropdown/UserDropdownContent.test.tsx | 12 +++-
 .../UserDropdown/UserDropdownContent.tsx      | 63 ++++---------------
 16 files changed, 237 insertions(+), 73 deletions(-)
 create mode 100644 site/src/modules/dashboard/Navbar/SupportIcon.tsx

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 585cc22710b61..c086141a9bd03 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -14897,7 +14897,15 @@ const docTemplate = `{
                     "enum": [
                         "bug",
                         "chat",
-                        "docs"
+                        "docs",
+                        "star"
+                    ]
+                },
+                "location": {
+                    "type": "string",
+                    "enum": [
+                        "navbar",
+                        "dropdown"
                     ]
                 },
                 "name": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index ac25626a03b2b..3edb176257122 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -13489,7 +13489,11 @@
 			"properties": {
 				"icon": {
 					"type": "string",
-					"enum": ["bug", "chat", "docs"]
+					"enum": ["bug", "chat", "docs", "star"]
+				},
+				"location": {
+					"type": "string",
+					"enum": ["navbar", "dropdown"]
 				},
 				"name": {
 					"type": "string"
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 008ae6e2b93b1..be9131a46798a 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -984,9 +984,10 @@ func DefaultSupportLinks(docsURL string) []LinkConfig {
 			Icon:   "bug",
 		},
 		{
-			Name:   "Join the Coder Discord",
-			Target: "https://coder.com/chat?utm_source=coder&utm_medium=coder&utm_campaign=server-footer",
-			Icon:   "chat",
+			Name:     "Join the Coder Discord",
+			Target:   "https://discord.gg/coder",
+			Icon:     "chat",
+			Location: "navbar",
 		},
 		{
 			Name:   "Star the Repo",
@@ -3339,7 +3340,9 @@ type SupportConfig struct {
 type LinkConfig struct {
 	Name   string `json:"name" yaml:"name"`
 	Target string `json:"target" yaml:"target"`
-	Icon   string `json:"icon" yaml:"icon" enums:"bug,chat,docs"`
+	Icon   string `json:"icon" yaml:"icon" enums:"bug,chat,docs,star"`
+
+	Location string `json:"location,omitempty" yaml:"location,omitempty" enums:"navbar,dropdown"`
 }
 
 // Validate checks cross-field constraints for deployment values.
diff --git a/docs/reference/api/enterprise.md b/docs/reference/api/enterprise.md
index b6043544d4766..1ec87e0000220 100644
--- a/docs/reference/api/enterprise.md
+++ b/docs/reference/api/enterprise.md
@@ -120,6 +120,7 @@ curl -X GET http://coder-server:8080/api/v2/appearance \
   "support_links": [
     {
       "icon": "bug",
+      "location": "navbar",
       "name": "string",
       "target": "string"
     }
diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md
index 0f3330da790cc..ad15e8fac2ae3 100644
--- a/docs/reference/api/general.md
+++ b/docs/reference/api/general.md
@@ -473,6 +473,7 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
         "value": [
           {
             "icon": "bug",
+            "location": "navbar",
             "name": "string",
             "target": "string"
           }
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index a36199a6f6be0..12fca35a848c0 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -1110,6 +1110,7 @@
   "support_links": [
     {
       "icon": "bug",
+      "location": "navbar",
       "name": "string",
       "target": "string"
     }
@@ -3138,6 +3139,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
         "value": [
           {
             "icon": "bug",
+            "location": "navbar",
             "name": "string",
             "target": "string"
           }
@@ -3644,6 +3646,7 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
       "value": [
         {
           "icon": "bug",
+          "location": "navbar",
           "name": "string",
           "target": "string"
         }
@@ -4752,6 +4755,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 ```json
 {
   "icon": "bug",
+  "location": "navbar",
   "name": "string",
   "target": "string"
 }
@@ -4759,19 +4763,23 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 
 ### Properties
 
-| Name     | Type   | Required | Restrictions | Description |
-|----------|--------|----------|--------------|-------------|
-| `icon`   | string | false    |              |             |
-| `name`   | string | false    |              |             |
-| `target` | string | false    |              |             |
+| Name       | Type   | Required | Restrictions | Description |
+|------------|--------|----------|--------------|-------------|
+| `icon`     | string | false    |              |             |
+| `location` | string | false    |              |             |
+| `name`     | string | false    |              |             |
+| `target`   | string | false    |              |             |
 
 #### Enumerated Values
 
-| Property | Value  |
-|----------|--------|
-| `icon`   | `bug`  |
-| `icon`   | `chat` |
-| `icon`   | `docs` |
+| Property   | Value      |
+|------------|------------|
+| `icon`     | `bug`      |
+| `icon`     | `chat`     |
+| `icon`     | `docs`     |
+| `icon`     | `star`     |
+| `location` | `navbar`   |
+| `location` | `dropdown` |
 
 ## codersdk.ListInboxNotificationsResponse
 
@@ -7625,6 +7633,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
     "value": [
       {
         "icon": "bug",
+        "location": "navbar",
         "name": "string",
         "target": "string"
       }
@@ -13685,6 +13694,7 @@ None
   "value": [
     {
       "icon": "bug",
+      "location": "navbar",
       "name": "string",
       "target": "string"
     }
diff --git a/enterprise/coderd/appearance_test.go b/enterprise/coderd/appearance_test.go
index 81ba7eddc7354..8255dd4c8aa8c 100644
--- a/enterprise/coderd/appearance_test.go
+++ b/enterprise/coderd/appearance_test.go
@@ -201,6 +201,17 @@ func TestCustomSupportLinks(t *testing.T) {
 			Target: "http://second-link-2",
 			Icon:   "bug",
 		},
+		{
+			Name:     "First button",
+			Target:   "http://first-button-1",
+			Icon:     "bug",
+			Location: "navbar",
+		},
+		{
+			Name:   "Third link",
+			Target: "http://third-link-3",
+			Icon:   "star",
+		},
 	}
 	cfg := coderdtest.DeploymentValues(t)
 	cfg.Support.Links = serpent.Struct[[]codersdk.LinkConfig]{
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 65b1d2d3e5302..91b685c0f53c7 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -2515,6 +2515,7 @@ export interface LinkConfig {
 	readonly name: string;
 	readonly target: string;
 	readonly icon: string;
+	readonly location?: string;
 }
 
 // From codersdk/inboxnotification.go
diff --git a/site/src/modules/dashboard/Navbar/Navbar.tsx b/site/src/modules/dashboard/Navbar/Navbar.tsx
index 8db0252c0059d..012053341e976 100644
--- a/site/src/modules/dashboard/Navbar/Navbar.tsx
+++ b/site/src/modules/dashboard/Navbar/Navbar.tsx
@@ -1,4 +1,5 @@
 import { buildInfo } from "api/queries/buildInfo";
+import type { LinkConfig } from "api/typesGenerated";
 import { useProxy } from "contexts/ProxyContext";
 import { useAuthenticated } from "hooks";
 import { useEmbeddedMetadata } from "hooks/useEmbeddedMetadata";
@@ -25,12 +26,18 @@ export const Navbar: FC = () => {
 	const canViewConnectionLog =
 		featureVisibility.connection_log && permissions.viewAnyConnectionLog;
 
+	const uniqueLinks = new Map<string, LinkConfig>();
+	for (const link of appearance.support_links ?? []) {
+		if (!uniqueLinks.has(link.name)) {
+			uniqueLinks.set(link.name, link);
+		}
+	}
 	return (
 		<NavbarView
 			user={me}
 			logo_url={appearance.logo_url}
 			buildInfo={buildInfoQuery.data}
-			supportLinks={appearance.support_links}
+			supportLinks={Array.from(uniqueLinks.values())}
 			onSignOut={signOut}
 			canViewDeployment={canViewDeployment}
 			canViewOrganizations={canViewOrganizations}
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx b/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
index 6b44ab0911024..6428656745e55 100644
--- a/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
+++ b/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
@@ -33,6 +33,7 @@ const meta: Meta<typeof NavbarView> = {
 		canViewDeployment: true,
 		canViewHealth: true,
 		canViewOrganizations: true,
+		supportLinks: [],
 	},
 	decorators: [withDashboardProvider],
 };
@@ -129,3 +130,64 @@ export const IdleTasks: Story = {
 		],
 	},
 };
+
+export const SupportLinks: Story = {
+	args: {
+		user: MockUserMember,
+		canViewAuditLog: false,
+		canViewDeployment: false,
+		canViewHealth: false,
+		canViewOrganizations: false,
+		supportLinks: [
+			{
+				name: "This is a bug",
+				icon: "bug",
+				target: "#",
+			},
+			{
+				name: "This is a star",
+				icon: "star",
+				target: "#",
+				location: "navbar",
+			},
+			{
+				name: "This is a chat",
+				icon: "chat",
+				target: "#",
+				location: "navbar",
+			},
+			{
+				name: "No icon here",
+				icon: "",
+				target: "#",
+				location: "navbar",
+			},
+			{
+				name: "No icon here too",
+				icon: "",
+				target: "#",
+			},
+		],
+	},
+};
+
+export const DefaultSupportLinks: Story = {
+	args: {
+		user: MockUserMember,
+		canViewAuditLog: false,
+		canViewDeployment: false,
+		canViewHealth: false,
+		canViewOrganizations: false,
+		supportLinks: [
+			{ icon: "docs", name: "Documentation", target: "" },
+			{ icon: "bug", name: "Report a bug", target: "" },
+			{
+				icon: "chat",
+				name: "Join the Coder Discord",
+				target: "",
+				location: "navbar",
+			},
+			{ icon: "star", name: "Star the Repo", target: "" },
+		],
+	},
+};
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.test.tsx b/site/src/modules/dashboard/Navbar/NavbarView.test.tsx
index 9d011089ba6c5..f313b6aa2b33e 100644
--- a/site/src/modules/dashboard/Navbar/NavbarView.test.tsx
+++ b/site/src/modules/dashboard/Navbar/NavbarView.test.tsx
@@ -34,6 +34,7 @@ describe("NavbarView", () => {
 				canViewHealth
 				canViewAuditLog
 				canViewConnectionLog
+				supportLinks={[]}
 			/>,
 		);
 		const workspacesLink =
@@ -52,6 +53,7 @@ describe("NavbarView", () => {
 				canViewHealth
 				canViewAuditLog
 				canViewConnectionLog
+				supportLinks={[]}
 			/>,
 		);
 		const templatesLink =
@@ -70,6 +72,7 @@ describe("NavbarView", () => {
 				canViewHealth
 				canViewAuditLog
 				canViewConnectionLog
+				supportLinks={[]}
 			/>,
 		);
 		const deploymentMenu = await screen.findByText("Admin settings");
@@ -89,6 +92,7 @@ describe("NavbarView", () => {
 				canViewHealth
 				canViewAuditLog
 				canViewConnectionLog
+				supportLinks={[]}
 			/>,
 		);
 		const deploymentMenu = await screen.findByText("Admin settings");
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.tsx b/site/src/modules/dashboard/Navbar/NavbarView.tsx
index 0cafaa8fdd46f..a4107f0b8485c 100644
--- a/site/src/modules/dashboard/Navbar/NavbarView.tsx
+++ b/site/src/modules/dashboard/Navbar/NavbarView.tsx
@@ -21,13 +21,14 @@ import { cn } from "utils/cn";
 import { DeploymentDropdown } from "./DeploymentDropdown";
 import { MobileMenu } from "./MobileMenu";
 import { ProxyMenu } from "./ProxyMenu";
+import { SupportIcon } from "./SupportIcon";
 import { UserDropdown } from "./UserDropdown/UserDropdown";
 
 interface NavbarViewProps {
 	logo_url?: string;
 	user: TypesGen.User;
 	buildInfo?: TypesGen.BuildInfoResponse;
-	supportLinks?: readonly TypesGen.LinkConfig[];
+	supportLinks: readonly TypesGen.LinkConfig[];
 	onSignOut: () => void;
 	canViewDeployment: boolean;
 	canViewOrganizations: boolean;
@@ -71,6 +72,16 @@ export const NavbarView: FC<NavbarViewProps> = ({
 			<NavItems className="ml-4" user={user} />
 
 			<div className="flex items-center gap-3 ml-auto">
+				{supportLinks.filter(isNavbarLink).map((link) => (
+					<div key={link.name} className="hidden md:block">
+						<SupportButton
+							name={link.name}
+							target={link.target}
+							icon={link.icon}
+						/>
+					</div>
+				))}
+
 				{proxyContextValue && (
 					<div className="hidden md:block">
 						<ProxyMenu proxyContextValue={proxyContextValue} />
@@ -121,7 +132,7 @@ export const NavbarView: FC<NavbarViewProps> = ({
 					<UserDropdown
 						user={user}
 						buildInfo={buildInfo}
-						supportLinks={supportLinks}
+						supportLinks={supportLinks?.filter((link) => !isNavbarLink(link))}
 						onSignOut={onSignOut}
 					/>
 				</div>
@@ -240,3 +251,36 @@ const TasksNavItem: FC<TasksNavItemProps> = ({ user }) => {
 function idleTasksLabel(count: number) {
 	return `You have ${count} ${count === 1 ? "task" : "tasks"} waiting for input`;
 }
+
+function isNavbarLink(link: TypesGen.LinkConfig): boolean {
+	return link.location === "navbar";
+}
+
+interface SupportButtonProps {
+	name: string;
+	target: string;
+	icon: string;
+	location?: string;
+}
+
+const SupportButton: FC<SupportButtonProps> = ({ name, target, icon }) => {
+	return (
+		<Button asChild variant="outline">
+			<a
+				href={target}
+				target="_blank"
+				rel="noreferrer"
+				className="inline-block"
+			>
+				{icon && (
+					<SupportIcon
+						icon={icon}
+						className={"size-5 text-content-secondary"}
+					/>
+				)}
+				{name}
+				<span className="sr-only"> (link opens in new tab)</span>
+			</a>
+		</Button>
+	);
+};
diff --git a/site/src/modules/dashboard/Navbar/SupportIcon.tsx b/site/src/modules/dashboard/Navbar/SupportIcon.tsx
new file mode 100644
index 0000000000000..6c32f03aea67a
--- /dev/null
+++ b/site/src/modules/dashboard/Navbar/SupportIcon.tsx
@@ -0,0 +1,39 @@
+import type { SvgIconProps } from "@mui/material/SvgIcon";
+import { ExternalImage } from "components/ExternalImage/ExternalImage";
+import { BookOpenTextIcon, BugIcon, MessageSquareIcon } from "lucide-react";
+import type { FC } from "react";
+
+interface SupportIconProps {
+	icon: string;
+	className?: string;
+}
+
+export const SupportIcon: FC<SupportIconProps> = ({ icon, className }) => {
+	switch (icon) {
+		case "bug":
+			return <BugIcon className={className} />;
+		case "chat":
+			return <MessageSquareIcon className={className} />;
+		case "docs":
+			return <BookOpenTextIcon className={className} />;
+		case "star":
+			return <GithubStar className={className} />;
+		default:
+			return <ExternalImage src={icon} className={className} />;
+	}
+};
+
+const GithubStar: FC<SvgIconProps> = (props) => (
+	<svg
+		aria-hidden="true"
+		height="16"
+		viewBox="0 0 16 16"
+		version="1.1"
+		width="16"
+		data-view-component="true"
+		fill="currentColor"
+		{...props}
+	>
+		<path d="M8 .25a.75.75 0 0 1 .673.418l1.882 3.815 4.21.612a.75.75 0 0 1 .416 1.279l-3.046 2.97.719 4.192a.751.751 0 0 1-1.088.791L8 12.347l-3.766 1.98a.75.75 0 0 1-1.088-.79l.72-4.194L.818 6.374a.75.75 0 0 1 .416-1.28l4.21-.611L7.327.668A.75.75 0 0 1 8 .25Z" />
+	</svg>
+);
diff --git a/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdown.tsx b/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdown.tsx
index 6240a68c9509e..4c796ee436d47 100644
--- a/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdown.tsx
+++ b/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdown.tsx
@@ -11,7 +11,7 @@ import { UserDropdownContent } from "./UserDropdownContent";
 interface UserDropdownProps {
 	user: TypesGen.User;
 	buildInfo?: TypesGen.BuildInfoResponse;
-	supportLinks?: readonly TypesGen.LinkConfig[];
+	supportLinks: readonly TypesGen.LinkConfig[];
 	onSignOut: () => void;
 }
 
diff --git a/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx b/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx
index 70e2f35c941e1..1d25d894eacb6 100644
--- a/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx
+++ b/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.test.tsx
@@ -8,7 +8,11 @@ describe("UserDropdownContent", () => {
 	it("has the correct link for the account item", async () => {
 		render(
 			<Popover>
-				<UserDropdownContent user={MockUserOwner} onSignOut={jest.fn()} />
+				<UserDropdownContent
+					user={MockUserOwner}
+					onSignOut={jest.fn()}
+					supportLinks={[]}
+				/>
 			</Popover>,
 		);
 		await waitForLoaderToBeRemoved();
@@ -25,7 +29,11 @@ describe("UserDropdownContent", () => {
 		const onSignOut = jest.fn();
 		render(
 			<Popover>
-				<UserDropdownContent user={MockUserOwner} onSignOut={onSignOut} />
+				<UserDropdownContent
+					user={MockUserOwner}
+					onSignOut={onSignOut}
+					supportLinks={[]}
+				/>
 			</Popover>,
 		);
 		await waitForLoaderToBeRemoved();
diff --git a/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.tsx b/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.tsx
index fd0636da3d457..b56c1c67deadd 100644
--- a/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.tsx
+++ b/site/src/modules/dashboard/Navbar/UserDropdown/UserDropdownContent.tsx
@@ -6,24 +6,20 @@ import {
 } from "@emotion/react";
 import Divider from "@mui/material/Divider";
 import MenuItem from "@mui/material/MenuItem";
-import type { SvgIconProps } from "@mui/material/SvgIcon";
 import Tooltip from "@mui/material/Tooltip";
 import { PopoverClose } from "@radix-ui/react-popover";
 import type * as TypesGen from "api/typesGenerated";
 import { CopyButton } from "components/CopyButton/CopyButton";
-import { ExternalImage } from "components/ExternalImage/ExternalImage";
 import { Stack } from "components/Stack/Stack";
 import {
-	BookOpenTextIcon,
-	BugIcon,
 	CircleUserIcon,
 	LogOutIcon,
-	MessageSquareIcon,
 	MonitorDownIcon,
 	SquareArrowOutUpRightIcon,
 } from "lucide-react";
-import type { FC, JSX } from "react";
+import type { FC } from "react";
 import { Link } from "react-router";
+import { SupportIcon } from "../SupportIcon";
 
 export const Language = {
 	accountLabel: "Account",
@@ -34,7 +30,7 @@ export const Language = {
 interface UserDropdownContentProps {
 	user: TypesGen.User;
 	buildInfo?: TypesGen.BuildInfoResponse;
-	supportLinks?: readonly TypesGen.LinkConfig[];
+	supportLinks: readonly TypesGen.LinkConfig[];
 	onSignOut: () => void;
 }
 
@@ -44,26 +40,6 @@ export const UserDropdownContent: FC<UserDropdownContentProps> = ({
 	supportLinks,
 	onSignOut,
 }) => {
-	const renderMenuIcon = (icon: string): JSX.Element => {
-		switch (icon) {
-			case "bug":
-				return <BugIcon css={styles.menuItemIcon} />;
-			case "chat":
-				return <MessageSquareIcon css={styles.menuItemIcon} />;
-			case "docs":
-				return <BookOpenTextIcon css={styles.menuItemIcon} />;
-			case "star":
-				return <GithubStar css={styles.menuItemIcon} />;
-			default:
-				return (
-					<ExternalImage
-						src={icon}
-						css={{ maxWidth: "20px", maxHeight: "20px" }}
-					/>
-				);
-		}
-	};
-
 	return (
 		<div>
 			<Stack css={styles.info} spacing={0}>
@@ -76,7 +52,7 @@ export const UserDropdownContent: FC<UserDropdownContentProps> = ({
 			<Link to="/install" css={styles.link}>
 				<PopoverClose asChild>
 					<MenuItem css={styles.menuItem}>
-						<MonitorDownIcon css={styles.menuItemIcon} />
+						<MonitorDownIcon className="size-5 text-content-secondary" />
 						<span css={styles.menuItemText}>Install CLI</span>
 					</MenuItem>
 				</PopoverClose>
@@ -85,14 +61,14 @@ export const UserDropdownContent: FC<UserDropdownContentProps> = ({
 			<Link to="/settings/account" css={styles.link}>
 				<PopoverClose asChild>
 					<MenuItem css={styles.menuItem}>
-						<CircleUserIcon css={styles.menuItemIcon} />
+						<CircleUserIcon className="size-5 text-content-secondary" />
 						<span css={styles.menuItemText}>{Language.accountLabel}</span>
 					</MenuItem>
 				</PopoverClose>
 			</Link>
 
 			<MenuItem css={styles.menuItem} onClick={onSignOut}>
-				<LogOutIcon css={styles.menuItemIcon} />
+				<LogOutIcon className="size-5 text-content-secondary" />
 				<span css={styles.menuItemText}>{Language.signOutLabel}</span>
 			</MenuItem>
 
@@ -109,7 +85,12 @@ export const UserDropdownContent: FC<UserDropdownContentProps> = ({
 						>
 							<PopoverClose asChild>
 								<MenuItem css={styles.menuItem}>
-									{renderMenuIcon(link.icon)}
+									{link.icon && (
+										<SupportIcon
+											icon={link.icon}
+											className="size-5 text-content-secondary"
+										/>
+									)}
 									<span css={styles.menuItemText}>{link.name}</span>
 								</MenuItem>
 							</PopoverClose>
@@ -152,21 +133,6 @@ export const UserDropdownContent: FC<UserDropdownContentProps> = ({
 	);
 };
 
-const GithubStar: FC<SvgIconProps> = (props) => (
-	<svg
-		aria-hidden="true"
-		height="16"
-		viewBox="0 0 16 16"
-		version="1.1"
-		width="16"
-		data-view-component="true"
-		fill="currentColor"
-		{...props}
-	>
-		<path d="M8 .25a.75.75 0 0 1 .673.418l1.882 3.815 4.21.612a.75.75 0 0 1 .416 1.279l-3.046 2.97.719 4.192a.751.751 0 0 1-1.088.791L8 12.347l-3.766 1.98a.75.75 0 0 1-1.088-.79l.72-4.194L.818 6.374a.75.75 0 0 1 .416-1.28l4.21-.611L7.327.668A.75.75 0 0 1 8 .25Z" />
-	</svg>
-);
-
 const styles = {
 	info: (theme) => [
 		theme.typography.body2 as CSSObject,
@@ -196,11 +162,6 @@ const styles = {
 			transition: background-color 0.3s ease;
 		}
 	`,
-	menuItemIcon: (theme) => ({
-		color: theme.palette.text.secondary,
-		width: 20,
-		height: 20,
-	}),
 	menuItemText: {
 		fontSize: 14,
 	},

From 823b14aa343f29d11392c6ccd02a1c6f43ca57d1 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Wed, 22 Oct 2025 18:55:54 +0500
Subject: [PATCH 201/298] docs: add base URLs and authentication section to AI
 Bridge (#20404)

Co-authored-by: Danny Kopping <danny@coder.com>
---
 docs/ai-coder/ai-bridge.md | 38 ++++++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/docs/ai-coder/ai-bridge.md b/docs/ai-coder/ai-bridge.md
index 0a9ebeba81f63..c7cfbe7d85ea2 100644
--- a/docs/ai-coder/ai-bridge.md
+++ b/docs/ai-coder/ai-bridge.md
@@ -81,6 +81,44 @@ Bridge is compatible with _[Google Vertex AI](https://cloud.google.com/vertex-ai
 > [!NOTE]
 > See [Supported APIs](#supported-apis) section below for a comprehensive list.
 
+## Client Configuration
+
+Once AI Bridge is enabled on the server, your users need to configure their AI coding tools to use it. This section explains how users should configure their clients to connect to AI Bridge.
+
+### Setting Base URLs
+
+The exact configuration method varies by client — some use environment variables, others use configuration files or UI settings:
+
+- **OpenAI-compatible clients**: Set the base URL (commonly via the `OPENAI_BASE_URL` environment variable) to `https://coder.example.com/api/experimental/aibridge/openai/v1`
+- **Anthropic-compatible clients**: Set the base URL (commonly via the `ANTHROPIC_BASE_URL` environment variable) to `https://coder.example.com/api/experimental/aibridge/anthropic`
+
+Replace `coder.example.com` with your actual Coder deployment URL.
+
+### Authentication
+
+Instead of distributing provider-specific API keys (OpenAI/Anthropic keys) to users, they authenticate to AI Bridge using their **Coder session token** or **API key**:
+
+- **OpenAI clients**: Users set `OPENAI_API_KEY` to their Coder session token or API key
+- **Anthropic clients**: Users set `ANTHROPIC_API_KEY` to their Coder session token or API key
+
+Users can generate a Coder API key using:
+
+```sh
+coder tokens create
+```
+
+Template admins can pre-configure authentication in templates using [`data.coder_workspace_owner.me.session_token`](https://registry.terraform.io/providers/coder/coder/latest/docs/data-sources/workspace_owner#session_token-1) to automatically configure the workspace owner's credentials.
+
+#### Compatibility Notes
+
+Most AI coding assistants that support custom base URLs can work with AI Bridge. However, client-specific configuration requirements vary:
+
+- Some clients require specific URL formats (e.g. try removing the `/v1` suffix)
+- Some clients may proxy requests through their own servers, limiting compatibility (e.g. Cursor)
+- Some clients may not support custom base URLs at all (e.g. Copilot CLI, Sourcegraph Amp)
+
+Consult your specific AI client's documentation for details on configuring custom API endpoints.
+
 ## Collected Data
 
 Bridge collects:

From caeca1097b4bc239f48d2e6dae356b2ae70c41a7 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Wed, 22 Oct 2025 16:12:36 +0200
Subject: [PATCH 202/298] chore: refactor license validation (#20411)

---
 .../coderd/coderdenttest/coderdenttest.go     |  6 ++-
 enterprise/coderd/license/license.go          | 12 ++++-
 enterprise/coderd/licenses_test.go            | 50 +++++++++++++++++++
 3 files changed, 65 insertions(+), 3 deletions(-)

diff --git a/enterprise/coderd/coderdenttest/coderdenttest.go b/enterprise/coderd/coderdenttest/coderdenttest.go
index ce9050992eb92..a31d1d495bb6e 100644
--- a/enterprise/coderd/coderdenttest/coderdenttest.go
+++ b/enterprise/coderd/coderdenttest/coderdenttest.go
@@ -186,6 +186,8 @@ type LicenseOptions struct {
 	// past.
 	IssuedAt time.Time
 	Features license.Features
+
+	AllowEmpty bool
 }
 
 func (opts *LicenseOptions) WithIssuedAt(now time.Time) *LicenseOptions {
@@ -276,10 +278,10 @@ func GenerateLicense(t *testing.T, options LicenseOptions) string {
 		issuedAt = time.Now().Add(-time.Minute)
 	}
 
-	if options.AccountType == "" {
+	if !options.AllowEmpty && options.AccountType == "" {
 		options.AccountType = license.AccountTypeSalesforce
 	}
-	if options.AccountID == "" {
+	if !options.AllowEmpty && options.AccountID == "" {
 		options.AccountID = "test-account-id"
 	}
 
diff --git a/enterprise/coderd/license/license.go b/enterprise/coderd/license/license.go
index 40d14c294cda1..7fbac30fae744 100644
--- a/enterprise/coderd/license/license.go
+++ b/enterprise/coderd/license/license.go
@@ -612,6 +612,8 @@ var (
 	ErrMissingLicenseExpires = xerrors.New("license has invalid or missing license_expires claim")
 	ErrMissingExp            = xerrors.New("license has invalid or missing exp (expires at) claim")
 	ErrMultipleIssues        = xerrors.New("license has multiple issues; contact support")
+	ErrMissingAccountType    = xerrors.New("license must contain valid account type")
+	ErrMissingAccountID      = xerrors.New("license must contain valid account ID")
 )
 
 type Features map[codersdk.FeatureName]int64
@@ -696,12 +698,20 @@ func validateClaims(tok *jwt.Token) (*Claims, error) {
 		if claims.NotBefore == nil {
 			return nil, ErrMissingNotBefore
 		}
-		if claims.LicenseExpires == nil {
+
+		yearsHardLimit := time.Now().Add(5 /* years */ * 365 * 24 * time.Hour)
+		if claims.LicenseExpires == nil || claims.LicenseExpires.Time.After(yearsHardLimit) {
 			return nil, ErrMissingLicenseExpires
 		}
 		if claims.ExpiresAt == nil {
 			return nil, ErrMissingExp
 		}
+		if claims.AccountType == "" {
+			return nil, ErrMissingAccountType
+		}
+		if claims.AccountID == "" {
+			return nil, ErrMissingAccountID
+		}
 		return claims, nil
 	}
 	return nil, xerrors.New("unable to parse Claims")
diff --git a/enterprise/coderd/licenses_test.go b/enterprise/coderd/licenses_test.go
index bbd6ef717fe8e..fbcbbf654ed09 100644
--- a/enterprise/coderd/licenses_test.go
+++ b/enterprise/coderd/licenses_test.go
@@ -54,6 +54,56 @@ func TestPostLicense(t *testing.T) {
 		require.Contains(t, errResp.Message, "License cannot be used on this deployment!")
 	})
 
+	t.Run("InvalidAccountID", func(t *testing.T) {
+		t.Parallel()
+		// The generated deployment will start out with a different deployment ID.
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		license := coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
+			AllowEmpty: true,
+			AccountID:  "",
+		})
+		_, err := client.AddLicense(context.Background(), codersdk.AddLicenseRequest{
+			License: license,
+		})
+		errResp := &codersdk.Error{}
+		require.ErrorAs(t, err, &errResp)
+		require.Equal(t, http.StatusBadRequest, errResp.StatusCode())
+		require.Contains(t, errResp.Message, "Invalid license")
+	})
+
+	t.Run("InvalidAccountType", func(t *testing.T) {
+		t.Parallel()
+		// The generated deployment will start out with a different deployment ID.
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		license := coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
+			AllowEmpty:  true,
+			AccountType: "",
+		})
+		_, err := client.AddLicense(context.Background(), codersdk.AddLicenseRequest{
+			License: license,
+		})
+		errResp := &codersdk.Error{}
+		require.ErrorAs(t, err, &errResp)
+		require.Equal(t, http.StatusBadRequest, errResp.StatusCode())
+		require.Contains(t, errResp.Message, "Invalid license")
+	})
+
+	t.Run("InvalidLicenseExpires", func(t *testing.T) {
+		t.Parallel()
+		// The generated deployment will start out with a different deployment ID.
+		client, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})
+		license := coderdenttest.GenerateLicense(t, coderdenttest.LicenseOptions{
+			GraceAt: time.Unix(99999999999, 0),
+		})
+		_, err := client.AddLicense(context.Background(), codersdk.AddLicenseRequest{
+			License: license,
+		})
+		errResp := &codersdk.Error{}
+		require.ErrorAs(t, err, &errResp)
+		require.Equal(t, http.StatusBadRequest, errResp.StatusCode())
+		require.Contains(t, errResp.Message, "Invalid license")
+	})
+
 	t.Run("Unauthorized", func(t *testing.T) {
 		t.Parallel()
 		client, _ := coderdenttest.New(t, &coderdenttest.Options{DontAddLicense: true})

From df3b1bb6c7e0380db01fb8a78293c98b91373daf Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Wed, 22 Oct 2025 19:57:46 +0500
Subject: [PATCH 203/298] revert: "chore(dogfood) remove extra ENV variable for
 claude code auth" (#20413)

---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 0811b7b30d1da..3b7da5f5157a1 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -479,8 +479,8 @@ resource "coder_agent" "dev" {
   dir  = local.repo_dir
   env = {
     OIDC_TOKEN : data.coder_workspace_owner.me.oidc_access_token,
-    # To Enable AI Bridge integration
     ANTHROPIC_BASE_URL : "https://dev.coder.com/api/experimental/aibridge/anthropic",
+    ANTHROPIC_AUTH_TOKEN : data.coder_workspace_owner.me.session_token
   }
   startup_script_behavior = "blocking"
 

From 5ecab7b5f077d02caf6b068660d393f715dffbe6 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 22 Oct 2025 16:02:21 +0100
Subject: [PATCH 204/298] chore(cli): add single CRUD-style test for tasks
 (#20385)

Adds a single CRUD-style test for tasks CLI using a single `coderdtest` instance.
---
 cli/exp_task_test.go | 218 +++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 218 insertions(+)

diff --git a/cli/exp_task_test.go b/cli/exp_task_test.go
index 4cf99e1dd45ad..b8b70516ffc9a 100644
--- a/cli/exp_task_test.go
+++ b/cli/exp_task_test.go
@@ -2,22 +2,240 @@ package cli_test
 
 import (
 	"context"
+	"encoding/json"
 	"net/http"
 	"net/http/httptest"
+	"slices"
+	"strings"
 	"sync"
 	"testing"
+	"time"
 
 	"github.com/google/uuid"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
+
+	agentapisdk "github.com/coder/agentapi-sdk-go"
 
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agenttest"
+	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
+	"github.com/coder/coder/v2/coderd/util/ptr"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/coder/v2/provisioner/echo"
 	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
+// This test performs an integration-style test for tasks functionality.
+//
+//nolint:tparallel // The sub-tests of this test must be run sequentially.
+func Test_Tasks(t *testing.T) {
+	t.Parallel()
+
+	// Given: a template configured for tasks
+	var (
+		ctx           = testutil.Context(t, testutil.WaitLong)
+		client        = coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner         = coderdtest.CreateFirstUser(t, client)
+		userClient, _ = coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		initMsg       = agentapisdk.Message{
+			Content: "test task input for " + t.Name(),
+			Id:      0,
+			Role:    "user",
+			Time:    time.Now().UTC(),
+		}
+		authToken    = uuid.NewString()
+		echoAgentAPI = startFakeAgentAPI(t, fakeAgentAPIEcho(ctx, t, initMsg, "hello"))
+		taskTpl      = createAITaskTemplate(t, client, owner.OrganizationID, withAgentToken(authToken), withSidebarURL(echoAgentAPI.URL()))
+		taskName     = strings.ReplaceAll(testutil.GetRandomName(t), "_", "-")
+	)
+
+	//nolint:paralleltest // The sub-tests of this test must be run sequentially.
+	for _, tc := range []struct {
+		name     string
+		cmdArgs  []string
+		assertFn func(stdout string, userClient *codersdk.Client)
+	}{
+		{
+			name:    "create task",
+			cmdArgs: []string{"exp", "task", "create", "test task input for " + t.Name(), "--name", taskName, "--template", taskTpl.Name},
+			assertFn: func(stdout string, userClient *codersdk.Client) {
+				require.Contains(t, stdout, taskName, "task name should be in output")
+			},
+		},
+		{
+			name:    "list tasks after create",
+			cmdArgs: []string{"exp", "task", "list", "--output", "json"},
+			assertFn: func(stdout string, userClient *codersdk.Client) {
+				var tasks []codersdk.Task
+				err := json.NewDecoder(strings.NewReader(stdout)).Decode(&tasks)
+				require.NoError(t, err, "list output should unmarshal properly")
+				require.Len(t, tasks, 1, "expected one task")
+				require.Equal(t, taskName, tasks[0].Name, "task name should match")
+				require.Equal(t, initMsg.Content, tasks[0].InitialPrompt, "initial prompt should match")
+				require.True(t, tasks[0].WorkspaceID.Valid, "workspace should be created")
+				// For the next test, we need to wait for the workspace to be healthy
+				ws := coderdtest.MustWorkspace(t, userClient, tasks[0].WorkspaceID.UUID)
+				coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+				agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(authToken))
+				_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
+					o.Client = agentClient
+				})
+				coderdtest.NewWorkspaceAgentWaiter(t, userClient, tasks[0].WorkspaceID.UUID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
+			},
+		},
+		{
+			name:    "get task status after create",
+			cmdArgs: []string{"exp", "task", "status", taskName, "--output", "json"},
+			assertFn: func(stdout string, userClient *codersdk.Client) {
+				var task codersdk.Task
+				require.NoError(t, json.NewDecoder(strings.NewReader(stdout)).Decode(&task), "should unmarshal task status")
+				require.Equal(t, task.Name, taskName, "task name should match")
+				// NOTE: task status changes type, this is so this test works with both old and new model
+				require.Contains(t, []string{"active", "running"}, string(task.Status), "task should be active")
+			},
+		},
+		{
+			name:    "send task message",
+			cmdArgs: []string{"exp", "task", "send", taskName, "hello"},
+			// Assertions for this happen in the fake agent API handler.
+		},
+		{
+			name:    "read task logs",
+			cmdArgs: []string{"exp", "task", "logs", taskName, "--output", "json"},
+			assertFn: func(stdout string, userClient *codersdk.Client) {
+				var logs []codersdk.TaskLogEntry
+				require.NoError(t, json.NewDecoder(strings.NewReader(stdout)).Decode(&logs), "should unmarshal task logs")
+				require.Len(t, logs, 3, "should have 3 logs")
+				require.Equal(t, logs[0].Content, initMsg.Content, "first message should be the init message")
+				require.Equal(t, logs[0].Type, codersdk.TaskLogTypeInput, "first message should be an input")
+				require.Equal(t, logs[1].Content, "hello", "second message should be the sent message")
+				require.Equal(t, logs[1].Type, codersdk.TaskLogTypeInput, "second message should be an input")
+				require.Equal(t, logs[2].Content, "hello", "third message should be the echoed message")
+				require.Equal(t, logs[2].Type, codersdk.TaskLogTypeOutput, "third message should be an output")
+			},
+		},
+		{
+			name:    "delete task",
+			cmdArgs: []string{"exp", "task", "delete", taskName, "--yes"},
+			assertFn: func(stdout string, userClient *codersdk.Client) {
+				// The task should eventually no longer show up in the list of tasks
+				testutil.Eventually(ctx, t, func(ctx context.Context) bool {
+					expClient := codersdk.NewExperimentalClient(userClient)
+					tasks, err := expClient.Tasks(ctx, &codersdk.TasksFilter{})
+					if !assert.NoError(t, err) {
+						return false
+					}
+					return slices.IndexFunc(tasks, func(task codersdk.Task) bool {
+						return task.Name == taskName
+					}) == -1
+				}, testutil.IntervalMedium)
+			},
+		},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			var stdout strings.Builder
+			inv, root := clitest.New(t, tc.cmdArgs...)
+			inv.Stdout = &stdout
+			clitest.SetupConfig(t, userClient, root)
+			require.NoError(t, inv.WithContext(ctx).Run())
+			if tc.assertFn != nil {
+				tc.assertFn(stdout.String(), userClient)
+			}
+		})
+	}
+}
+
+func fakeAgentAPIEcho(ctx context.Context, t testing.TB, initMsg agentapisdk.Message, want ...string) map[string]http.HandlerFunc {
+	t.Helper()
+	var mmu sync.RWMutex
+	msgs := []agentapisdk.Message{initMsg}
+	wantCpy := make([]string, len(want))
+	copy(wantCpy, want)
+	t.Cleanup(func() {
+		mmu.Lock()
+		defer mmu.Unlock()
+		if !t.Failed() {
+			assert.Empty(t, wantCpy, "not all expected messages received: missing %v", wantCpy)
+		}
+	})
+	writeAgentAPIError := func(w http.ResponseWriter, err error, status int) {
+		w.WriteHeader(status)
+		_ = json.NewEncoder(w).Encode(agentapisdk.ErrorModel{
+			Errors: ptr.Ref([]agentapisdk.ErrorDetail{
+				{
+					Message: ptr.Ref(err.Error()),
+				},
+			}),
+		})
+	}
+	return map[string]http.HandlerFunc{
+		"/status": func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			_ = json.NewEncoder(w).Encode(agentapisdk.GetStatusResponse{
+				Status: "stable",
+			})
+		},
+		"/messages": func(w http.ResponseWriter, r *http.Request) {
+			w.Header().Set("Content-Type", "application/json")
+			mmu.RLock()
+			defer mmu.RUnlock()
+			bs, err := json.Marshal(agentapisdk.GetMessagesResponse{
+				Messages: msgs,
+			})
+			if err != nil {
+				writeAgentAPIError(w, err, http.StatusBadRequest)
+				return
+			}
+			_, _ = w.Write(bs)
+		},
+		"/message": func(w http.ResponseWriter, r *http.Request) {
+			mmu.Lock()
+			defer mmu.Unlock()
+			var params agentapisdk.PostMessageParams
+			w.Header().Set("Content-Type", "application/json")
+			err := json.NewDecoder(r.Body).Decode(&params)
+			if !assert.NoError(t, err, "decode message") {
+				writeAgentAPIError(w, err, http.StatusBadRequest)
+				return
+			}
+
+			if len(wantCpy) == 0 {
+				assert.Fail(t, "unexpected message", "received message %v, but no more expected messages", params)
+				writeAgentAPIError(w, xerrors.New("no more expected messages"), http.StatusBadRequest)
+				return
+			}
+			exp := wantCpy[0]
+			wantCpy = wantCpy[1:]
+
+			if !assert.Equal(t, exp, params.Content, "message content mismatch") {
+				writeAgentAPIError(w, xerrors.New("unexpected message content: expected "+exp+", got "+params.Content), http.StatusBadRequest)
+				return
+			}
+
+			msgs = append(msgs, agentapisdk.Message{
+				Id:      int64(len(msgs) + 1),
+				Content: params.Content,
+				Role:    agentapisdk.RoleUser,
+				Time:    time.Now().UTC(),
+			})
+			msgs = append(msgs, agentapisdk.Message{
+				Id:      int64(len(msgs) + 1),
+				Content: params.Content,
+				Role:    agentapisdk.RoleAgent,
+				Time:    time.Now().UTC(),
+			})
+			assert.NoError(t, json.NewEncoder(w).Encode(agentapisdk.PostMessageResponse{
+				Ok: true,
+			}))
+		},
+	}
+}
+
 // setupCLITaskTest creates a test workspace with an AI task template and agent,
 // with a fake agent API configured with the provided set of handlers.
 // Returns the user client and workspace.

From 9730c86f17e45059e438d12b827ff3a765821503 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 22 Oct 2025 17:15:12 +0100
Subject: [PATCH 205/298] chore(compose.yaml): allow overriding CODER_REPO
 (#20419)

Allows running a vendored version of Coder in our `compose.yaml` as
follows:

```
CODER_REPO=my.repo.tld/mycoder/coder CODER_VERSION=my-tag docker compose up
```

Also allows running the current "dogfood" version of Coder as follows:

```
CODER_REPO=ghcr.io/coder/coder-preview CODER_VERSION=dogfood docker compose up
```
---
 compose.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/compose.yaml b/compose.yaml
index 409ecda158c1b..6bb78b6123a4a 100644
--- a/compose.yaml
+++ b/compose.yaml
@@ -2,7 +2,7 @@ services:
   coder:
     # This MUST be stable for our documentation and
     # other automations.
-    image: ghcr.io/coder/coder:${CODER_VERSION:-latest}
+    image: ${CODER_REPO:-ghcr.io/coder/coder}:${CODER_VERSION:-latest}
     ports:
       - "7080:7080"
     environment:

From da31a4bed994a79e0c1127c1cb297a6eb10c1299 Mon Sep 17 00:00:00 2001
From: Jiachen Jiang <jcjiang42@gmail.com>
Date: Wed, 22 Oct 2025 09:32:15 -0700
Subject: [PATCH 206/298] docs: edit Boundary documentation to reflect current
 functionality (#20403)

---
 docs/ai-coder/agent-boundary.md | 141 ++++++++------------------------
 docs/manifest.json              |   2 +-
 2 files changed, 36 insertions(+), 107 deletions(-)

diff --git a/docs/ai-coder/agent-boundary.md b/docs/ai-coder/agent-boundary.md
index e7605d1481bea..36e36a08b6d2f 100644
--- a/docs/ai-coder/agent-boundary.md
+++ b/docs/ai-coder/agent-boundary.md
@@ -4,118 +4,47 @@ Agent Boundaries are process-level firewalls that restrict and audit what autono
 
 ![Screenshot of Agent Boundaries blocking a process](../images/guides/ai-agents/boundary.png)Example of Agent Boundaries blocking a process.
 
-The easiest way to use Agent Boundaries is through existing Coder modules, such as the [Claude Code module](https://registry.coder.com/modules/coder/claude-code). It can also be ran directly in the terminal by installing the [CLI](https://github.com/coder/boundary).
-
-> [!NOTE]
-> The Coder Boundary CLI is free and open source. Integrations with the core product, such as with modules offering stronger isolation, are available to Coder Premium customers.
-
 ## Supported Agents
 
-Boundary supports the securing of any terminal-based agent, including your own custom agents.
+Agent Boundaries support the securing of any terminal-based agent, including your own custom agents.
 
 ## Features
 
-Boundaries extend Coder's trusted workspaces with a defense-in-depth model that detects and prevents destructive actions without reducing productivity by slowing down workflows or blocking automation. They offer the following features:
-
-- _Policy-driven access controls_: limit what an agent can access (repos, registries, APIs, files, commands)
-- _Network policy enforcement_: block domains, subnets, or HTTP verbs to prevent exfiltration
-- _Audit-ready_: centralize logs, exportable for compliance, with full visibility into agent actions
+Agent Boundaries offer network policy enforcement, which blocks domains and HTTP verbs to prevent exfiltration, and writes logs to the workspace.
 
 ## Getting Started with Boundary
 
-For Early Access, users can use Agent Boundaries through its [open source CLI](https://github.com/coder/boundary), which can be run to wrap any process or invoked through rules in a YAML file.
-
-### Wrap the agent process with the Boundary CLI
-
-Users can also run Boundary directly in your workspace and configure it per template or per script. While free tier users won't get centralized policy management or the deeper, "strong isolation," they can still enforce per workspace network rules and log decisions locally.
-
-1. Install the [binary](https://github.com/coder/boundary) into the workspace image or at start-up. You can do so with the following command:
-
-    ```hcl
-    curl -fsSL https://raw.githubusercontent.com/coder/boundary/main/install.sh | bash
-    ```
-
-1. Use the included `Makefile` to build your project. Here are a few example commands:
-
-    ```hcl
-    make build          # Build for current platform
-    make build-all      # Build for all platforms
-    make test           # Run tests
-    make test-coverage  # Run tests with coverage
-    make clean          # Clean build artifacts
-    make fmt            # Format code
-    make lint           # Lint code
-    ```
-
-From here, there are two ways to integrate the open source Boundary CLI into a workspace.
-
-#### Wrap a command inline with flags
-
-1. Wrap the tool you want to guard. Below are some examples of usage:
-
-    ```hcl
-    # Allow only requests to github.com
-    boundary --allow "github.com" -- curl https://github.com
-
-    # Allow full access to GitHub issues API, but only GET/HEAD elsewhere on GitHub
-    boundary \
-    --allow "github.com/api/issues/*" \
-    --allow "GET,HEAD github.com" \
-    -- npm install
-
-    # Default deny-all: everything is blocked unless explicitly allowed
-    boundary -- curl https://example.com
-    ```
-
-    Additional information, such as Allow Rules, can be found in the [repository README](https://github.com/coder/boundary).
-
-#### Use a config file (YAML) to set rules
-
-Another option is to define rules in a YAML file, which only needs to be invoked once as opposed to through flags with each command.
-
-1. Create a YAML file to store rules that will be applied to all `boundary` commands run in the Workspace. In this example, we call it `boundary.yaml`.
-    A config example can be seen below:
-
-    ```hcl
-    allow:
-
-    - domain: [github.com](http://github.com)
-        
-        path: /api/issues/*
-        
-    - domain: [github.com](http://github.com)
-        
-        methods: [GET, HEAD]
-    ```
-
-1. Run a `boundary` command. For example:
-
-    ```hcl
-    boundary run --config ./boundary.yaml -- claude
-    ```
-
-    You will notice that the rules are automatically applied without any need for additional customization.
-
-### Unprivileged vs. Privileged Mode
-
-There are two approaches you can take to secure your agentic workflows with Agent Boundary.  
-
-#### Unprivileged Mode
-
-In this case, a specific agent process or tool (for example, Claude Code or a CLI agent) runs inside of a constrained sandbox. This is the default mode in which Boundary will operate in and does not require root access.  
-
-Agents are prevented from reaching restricted domains or exfiltrating data, without blocking the rest of the dev's environment.  
-
-This is the fastest way to add real guardrails, but a determined user could still operate a tool outside of Boundary restrictions because the broader environment allows it. This mode relies on tools respecting certain settings, like HTTP proxies, and can lead to silent failures if a tool bypasses them.
-
-#### Privileged Mode
-
-In this case, boundaries are enforced at the level of the environment that the agent lives in. These are workspace- or session-level controls, including how the developer connects to it.  
-
-Currently, this must be turned on with a flag and ran with higher-level permissions such as root access or `CapNetAdmin`.
-
-In addition to process-level egress rules, privileged mode locks down all pathways that could bypass policy, such as restricting or disabling SSH tunnels or parallel unbound IDEs. This delivers deterministic, policy-as-code enforcement and offers the highest assurance for regulated environments, but results in slightly more friction for mixed human-and-agent workflows.
-
-### Opting out of Boundary
+The easiest way to use Agent Boundaries is through existing Coder modules, such as the [Claude Code module](https://registry.coder.com/modules/coder/claude-code). It can also be ran directly in the terminal by installing the [CLI](https://github.com/coder/boundary).
 
-If you tried Boundary through a Coder module and decided you don't want to use it, you can turn it off by setting the flag to `boundary_enabled=false`.
+Below is an example of how to configure Agent Boundaries for usage in your workspace.
+
+```tf
+module "claude-code" {
+  source              = "dev.registry.coder.com/coder/claude-code/coder"
+  enable_boundary     = true
+  boundary_version    = "main"
+  boundary_log_dir    = "/tmp/boundary_logs" 
+  boundary_log_level  = "WARN"
+  boundary_additional_allowed_urls = ["GET *google.com"]
+  boundary_proxy_port = "8087"
+  version             = "3.2.1"
+}
+```
+
+- `boundary_version` defines what version of Boundary is being applied. This is set to `main`, which points to the main branch of `coder/boundary`.
+- `boundary_log_dir` is the directory where log files are written to when the workspace spins up.
+- `boundary_log_level` defines the verbosity at which requests are logged. Boundary uses the following verbosity levels:
+  - `WARN`: logs only requests that have been blocked by Boundary
+  - `INFO`: logs all requests at a high level
+  - `DEBUG`: logs all requests in detail
+- `boundary_additional_allowed_urls`: defines the URLs that the agent can access, in additional to the default URLs required for the agent to work
+  - `github.com` means only the specific domain is allowed
+  - `*.github.com` means only the subdomains are allowed - the specific domain is excluded
+  - `*github.com` means both the specific domain and all subdomains are allowed
+  - You can also also filter on methods, hostnames, and paths - for example, `GET,HEAD *github.com/coder`.
+
+You can also run Agent Boundaries directly in your workspace and configure it per template. You can do so by installing the [binary](https://github.com/coder/boundary) into the workspace image or at start-up. You can do so with the following command:
+
+```hcl
+curl -fsSL https://raw.githubusercontent.com/coder/boundary/main/install.sh | bash
+ ```
diff --git a/docs/manifest.json b/docs/manifest.json
index 5b01b6e9da995..622190945bb30 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -917,7 +917,7 @@
 					"title": "Agent Boundaries",
 					"description": "Understanding Agent Boundaries in Coder Tasks",
 					"path": "./ai-coder/agent-boundary.md",
-					"state": ["beta"]
+					"state": ["early access"]
 				},
 				{
 					"title": "AI Bridge",

From 48f77d0c019a48a2396bfc1da668999eebfff736 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= <pawel@coder.com>
Date: Wed, 22 Oct 2025 19:36:01 +0200
Subject: [PATCH 207/298] chore: bump coder/aibridge to v0.1.4 (#20424)

Solves https://github.com/coder/aibridge/issues/19
+ https://github.com/coder/aibridge/pull/34
and https://github.com/coder/aibridge/pull/21
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 590a87ae4f3ee..da858b69843d5 100644
--- a/go.mod
+++ b/go.mod
@@ -477,7 +477,7 @@ require (
 	github.com/anthropics/anthropic-sdk-go v1.13.0
 	github.com/brianvoe/gofakeit/v7 v7.8.0
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
-	github.com/coder/aibridge v0.1.3
+	github.com/coder/aibridge v0.1.4
 	github.com/coder/aisdk-go v0.0.9
 	github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945
 	github.com/coder/preview v1.0.4
diff --git a/go.sum b/go.sum
index f6fb4cbd526df..c12acdbe48a77 100644
--- a/go.sum
+++ b/go.sum
@@ -915,8 +915,8 @@ github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225 h1:tRIViZ5JRmzdOEo5wUWngaGEFBG8OaE1o2GIHN5ujJ8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225/go.mod h1:rNLVpYgEVeu1Zk29K64z6Od8RBP9DwqCu9OfCzh8MR4=
-github.com/coder/aibridge v0.1.3 h1:7A9RQaHQUjtse47ShF3kBj2hMmT1R7BEFgiyByr8Vvc=
-github.com/coder/aibridge v0.1.3/go.mod h1:GWc0Owtlzz5iMHosDm6FhbO+SoG5W+VeOKyP9p9g9ZM=
+github.com/coder/aibridge v0.1.4 h1:MCbrq33RCrk6v16ZbQnabfUVaCAOmJR4mPwc+UvagQs=
+github.com/coder/aibridge v0.1.4/go.mod h1:Q5MCfKMcKYmYl4qH1Zd0rltmPaUBPKFvIPs2k9q6qeY=
 github.com/coder/aisdk-go v0.0.9 h1:Vzo/k2qwVGLTR10ESDeP2Ecek1SdPfZlEjtTfMveiVo=
 github.com/coder/aisdk-go v0.0.9/go.mod h1:KF6/Vkono0FJJOtWtveh5j7yfNrSctVTpwgweYWSp5M=
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3+5B+v5KdYvORs4YNfDPci0zCs+pC0=

From 5f97ad098825c6b363131bd3f5133ea968205963 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Wed, 22 Oct 2025 19:42:20 +0200
Subject: [PATCH 208/298] chore: move discord button to menu (#20425)

Related: https://github.com/coder/coder/pull/20339
---
 codersdk/deployment.go | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index be9131a46798a..2f6f6bba03697 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -984,10 +984,9 @@ func DefaultSupportLinks(docsURL string) []LinkConfig {
 			Icon:   "bug",
 		},
 		{
-			Name:     "Join the Coder Discord",
-			Target:   "https://discord.gg/coder",
-			Icon:     "chat",
-			Location: "navbar",
+			Name:   "Join the Coder Discord",
+			Target: "https://discord.gg/coder",
+			Icon:   "chat",
 		},
 		{
 			Name:   "Star the Repo",

From 4bd7c7b7e08a9113db0e5c0bbb40ba140acfcd53 Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Wed, 22 Oct 2025 15:18:42 -0500
Subject: [PATCH 209/298] feat: implement oauth2 RFC 7009 token revocation
 endpoint (#20362)

Adds RFC 7009 token revocation endpoint
---
 coderd/apidoc/docs.go                 |  42 ++++++
 coderd/apidoc/swagger.json            |  38 +++++
 coderd/coderd.go                      |  10 ++
 coderd/database/db2sdk/db2sdk.go      |   3 +
 coderd/database/dbauthz/dbauthz.go    |  34 +++++
 coderd/oauth2.go                      |  13 ++
 coderd/oauth2_test.go                 |  77 +++++++++-
 coderd/oauth2provider/registration.go |  31 +---
 coderd/oauth2provider/revoke.go       | 199 ++++++++++++++++++++++++++
 coderd/oauth2provider/secrets.go      |  63 ++++++--
 coderd/oauth2provider/tokens.go       |  18 +--
 coderd/rbac/authz.go                  |   1 +
 codersdk/oauth2.go                    |  22 +++
 docs/reference/api/enterprise.md      |  49 ++++++-
 docs/reference/api/schemas.md         |   7 +-
 site/src/api/typesGenerated.ts        |   1 +
 site/src/testHelpers/entities.ts      |   1 +
 17 files changed, 552 insertions(+), 57 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index c086141a9bd03..fed42d7550f37 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -3082,6 +3082,45 @@ const docTemplate = `{
                 }
             }
         },
+        "/oauth2/revoke": {
+            "post": {
+                "consumes": [
+                    "application/x-www-form-urlencoded"
+                ],
+                "tags": [
+                    "Enterprise"
+                ],
+                "summary": "Revoke OAuth2 tokens (RFC 7009).",
+                "operationId": "oauth2-token-revocation",
+                "parameters": [
+                    {
+                        "type": "string",
+                        "description": "Client ID for authentication",
+                        "name": "client_id",
+                        "in": "formData",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "description": "The token to revoke",
+                        "name": "token",
+                        "in": "formData",
+                        "required": true
+                    },
+                    {
+                        "type": "string",
+                        "description": "Hint about token type (access_token or refresh_token)",
+                        "name": "token_type_hint",
+                        "in": "formData"
+                    }
+                ],
+                "responses": {
+                    "200": {
+                        "description": "Token successfully revoked"
+                    }
+                }
+            }
+        },
         "/oauth2/tokens": {
             "post": {
                 "produces": [
@@ -15353,6 +15392,9 @@ const docTemplate = `{
                 },
                 "token": {
                     "type": "string"
+                },
+                "token_revoke": {
+                    "type": "string"
                 }
             }
         },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 3edb176257122..6b37aa45c7671 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -2720,6 +2720,41 @@
 				}
 			}
 		},
+		"/oauth2/revoke": {
+			"post": {
+				"consumes": ["application/x-www-form-urlencoded"],
+				"tags": ["Enterprise"],
+				"summary": "Revoke OAuth2 tokens (RFC 7009).",
+				"operationId": "oauth2-token-revocation",
+				"parameters": [
+					{
+						"type": "string",
+						"description": "Client ID for authentication",
+						"name": "client_id",
+						"in": "formData",
+						"required": true
+					},
+					{
+						"type": "string",
+						"description": "The token to revoke",
+						"name": "token",
+						"in": "formData",
+						"required": true
+					},
+					{
+						"type": "string",
+						"description": "Hint about token type (access_token or refresh_token)",
+						"name": "token_type_hint",
+						"in": "formData"
+					}
+				],
+				"responses": {
+					"200": {
+						"description": "Token successfully revoked"
+					}
+				}
+			}
+		},
 		"/oauth2/tokens": {
 			"post": {
 				"produces": ["application/json"],
@@ -13911,6 +13946,9 @@
 				},
 				"token": {
 					"type": "string"
+				},
+				"token_revoke": {
+					"type": "string"
 				}
 			}
 		},
diff --git a/coderd/coderd.go b/coderd/coderd.go
index dd8d053624783..fd1cdccff3e00 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -985,6 +985,16 @@ func New(options *Options) *API {
 			r.Post("/", api.postOAuth2ProviderAppToken())
 		})
 
+		// RFC 7009 Token Revocation Endpoint
+		r.Route("/revoke", func(r chi.Router) {
+			r.Use(
+				// RFC 7009 endpoint uses OAuth2 client authentication, not API key
+				httpmw.AsAuthzSystem(httpmw.ExtractOAuth2ProviderAppWithOAuth2Errors(options.Database)),
+			)
+			// POST /revoke is the standard OAuth2 token revocation endpoint per RFC 7009
+			r.Post("/", api.revokeOAuth2Token())
+		})
+
 		// RFC 7591 Dynamic Client Registration - Public endpoint
 		r.Post("/register", api.postOAuth2ClientRegistration())
 
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index 77ddcbbf4aecb..a58d7967e6a8a 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -383,6 +383,9 @@ func OAuth2ProviderApp(accessURL *url.URL, dbApp database.OAuth2ProviderApp) cod
 			}).String(),
 			// We do not currently support DeviceAuth.
 			DeviceAuth: "",
+			TokenRevoke: accessURL.ResolveReference(&url.URL{
+				Path: "/oauth2/revoke",
+			}).String(),
 		},
 	}
 }
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index f1b262047ab7b..2025b15376103 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -446,6 +446,34 @@ var (
 		Scope: rbac.ScopeAll,
 	}.WithCachedASTValue()
 
+	subjectSystemOAuth2 = rbac.Subject{
+		Type:         rbac.SubjectTypeSystemOAuth,
+		FriendlyName: "System OAuth2",
+		ID:           uuid.Nil.String(),
+		Roles: rbac.Roles([]rbac.Role{
+			{
+				Identifier:  rbac.RoleIdentifier{Name: "system-oauth2"},
+				DisplayName: "System OAuth2",
+				Site: rbac.Permissions(map[string][]policy.Action{
+					// OAuth2 resources - full CRUD permissions
+					rbac.ResourceOauth2App.Type:          rbac.ResourceOauth2App.AvailableActions(),
+					rbac.ResourceOauth2AppSecret.Type:    rbac.ResourceOauth2AppSecret.AvailableActions(),
+					rbac.ResourceOauth2AppCodeToken.Type: rbac.ResourceOauth2AppCodeToken.AvailableActions(),
+
+					// API key permissions needed for OAuth2 token revocation
+					rbac.ResourceApiKey.Type: {policy.ActionRead, policy.ActionDelete},
+
+					// Minimal read permissions that might be needed for OAuth2 operations
+					rbac.ResourceUser.Type:         {policy.ActionRead},
+					rbac.ResourceOrganization.Type: {policy.ActionRead},
+				}),
+				User:    []rbac.Permission{},
+				ByOrgID: map[string]rbac.OrgPermissions{},
+			},
+		}),
+		Scope: rbac.ScopeAll,
+	}.WithCachedASTValue()
+
 	subjectSystemReadProvisionerDaemons = rbac.Subject{
 		Type:         rbac.SubjectTypeSystemReadProvisionerDaemons,
 		FriendlyName: "Provisioner Daemons Reader",
@@ -643,6 +671,12 @@ func AsSystemRestricted(ctx context.Context) context.Context {
 	return As(ctx, subjectSystemRestricted)
 }
 
+// AsSystemOAuth2 returns a context with an actor that has permissions
+// required for OAuth2 provider operations (token revocation, device codes, registration).
+func AsSystemOAuth2(ctx context.Context) context.Context {
+	return As(ctx, subjectSystemOAuth2)
+}
+
 // AsSystemReadProvisionerDaemons returns a context with an actor that has permissions
 // to read provisioner daemons.
 func AsSystemReadProvisionerDaemons(ctx context.Context) context.Context {
diff --git a/coderd/oauth2.go b/coderd/oauth2.go
index 1e28f9b65bbb8..ac0c87545ead9 100644
--- a/coderd/oauth2.go
+++ b/coderd/oauth2.go
@@ -160,6 +160,19 @@ func (api *API) deleteOAuth2ProviderAppTokens() http.HandlerFunc {
 	return oauth2provider.RevokeApp(api.Database)
 }
 
+// @Summary Revoke OAuth2 tokens (RFC 7009).
+// @ID oauth2-token-revocation
+// @Accept x-www-form-urlencoded
+// @Tags Enterprise
+// @Param client_id formData string true "Client ID for authentication"
+// @Param token formData string true "The token to revoke"
+// @Param token_type_hint formData string false "Hint about token type (access_token or refresh_token)"
+// @Success 200 "Token successfully revoked"
+// @Router /oauth2/revoke [post]
+func (api *API) revokeOAuth2Token() http.HandlerFunc {
+	return oauth2provider.RevokeToken(api.Database, api.Logger)
+}
+
 // @Summary OAuth2 authorization server metadata.
 // @ID oauth2-authorization-server-metadata
 // @Produce json
diff --git a/coderd/oauth2_test.go b/coderd/oauth2_test.go
index d5755b695d393..c03dcf7e3a27d 100644
--- a/coderd/oauth2_test.go
+++ b/coderd/oauth2_test.go
@@ -720,7 +720,7 @@ func TestOAuth2ProviderRevoke(t *testing.T) {
 			},
 		},
 		{
-			name: "DeleteToken",
+			name: "DeleteApp",
 			fn: func(ctx context.Context, client *codersdk.Client, s exchangeSetup) {
 				err := client.RevokeOAuth2ProviderApp(ctx, s.app.ID)
 				require.NoError(t, err)
@@ -1603,5 +1603,80 @@ func TestOAuth2RegistrationAccessToken(t *testing.T) {
 	})
 }
 
+// TestOAuth2CoderClient verfies a codersdk client can be used with an oauth client.
+func TestOAuth2CoderClient(t *testing.T) {
+	t.Parallel()
+
+	owner := coderdtest.New(t, nil)
+	first := coderdtest.CreateFirstUser(t, owner)
+
+	// Setup an oauth app
+	ctx := testutil.Context(t, testutil.WaitLong)
+	app, err := owner.PostOAuth2ProviderApp(ctx, codersdk.PostOAuth2ProviderAppRequest{
+		Name:        "new-app",
+		CallbackURL: "http://localhost",
+	})
+	require.NoError(t, err)
+
+	appsecret, err := owner.PostOAuth2ProviderAppSecret(ctx, app.ID)
+	require.NoError(t, err)
+
+	cfg := &oauth2.Config{
+		ClientID:     app.ID.String(),
+		ClientSecret: appsecret.ClientSecretFull,
+		Endpoint: oauth2.Endpoint{
+			AuthURL:       app.Endpoints.Authorization,
+			DeviceAuthURL: app.Endpoints.DeviceAuth,
+			TokenURL:      app.Endpoints.Token,
+			AuthStyle:     oauth2.AuthStyleInParams,
+		},
+		RedirectURL: app.CallbackURL,
+		Scopes:      []string{},
+	}
+
+	// Make a new user
+	client, user := coderdtest.CreateAnotherUser(t, owner, first.OrganizationID)
+
+	// Do an OAuth2 token exchange and get a new client with an oauth token
+	state := uuid.NewString()
+
+	// Get an OAuth2 code for a token exchange
+	code, err := oidctest.OAuth2GetCode(
+		cfg.AuthCodeURL(state),
+		func(req *http.Request) (*http.Response, error) {
+			// Change to POST to simulate the form submission
+			req.Method = http.MethodPost
+
+			// Prevent automatic redirect following
+			client.HTTPClient.CheckRedirect = func(req *http.Request, via []*http.Request) error {
+				return http.ErrUseLastResponse
+			}
+			return client.Request(ctx, req.Method, req.URL.String(), nil)
+		},
+	)
+	require.NoError(t, err)
+
+	token, err := cfg.Exchange(ctx, code)
+	require.NoError(t, err)
+
+	// Use the oauth client's authentication
+	// TODO: The SDK could probably support this with a better syntax/api.
+	oauthClient := oauth2.NewClient(ctx, oauth2.StaticTokenSource(token))
+	usingOauth := codersdk.New(owner.URL)
+	usingOauth.HTTPClient = oauthClient
+
+	me, err := usingOauth.User(ctx, codersdk.Me)
+	require.NoError(t, err)
+	require.Equal(t, user.ID, me.ID)
+
+	// Revoking the refresh token should prevent further access
+	// Revoking the refresh also invalidates the associated access token.
+	err = usingOauth.RevokeOAuth2Token(ctx, app.ID, token.RefreshToken)
+	require.NoError(t, err)
+
+	_, err = usingOauth.User(ctx, codersdk.Me)
+	require.Error(t, err)
+}
+
 // NOTE: OAuth2 client registration validation tests have been migrated to
 // oauth2provider/validation_test.go for better separation of concerns
diff --git a/coderd/oauth2provider/registration.go b/coderd/oauth2provider/registration.go
index 63d2de4f48394..c433cae8ff8ca 100644
--- a/coderd/oauth2provider/registration.go
+++ b/coderd/oauth2provider/registration.go
@@ -26,12 +26,6 @@ import (
 	"github.com/coder/coder/v2/cryptorand"
 )
 
-// Constants for OAuth2 secret generation (RFC 7591)
-const (
-	secretLength        = 40 // Length of the actual secret part
-	displaySecretLength = 6  // Length of visible part in UI (last 6 characters)
-)
-
 // CreateDynamicClientRegistration returns an http.HandlerFunc that handles POST /oauth2/register
 func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, auditor *audit.Auditor, logger slog.Logger) http.HandlerFunc {
 	return func(rw http.ResponseWriter, r *http.Request) {
@@ -121,7 +115,7 @@ func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, audi
 		}
 
 		// Create client secret - parse the formatted secret to get components
-		parsedSecret, err := parseFormattedSecret(clientSecret)
+		parsedSecret, err := ParseFormattedSecret(clientSecret)
 		if err != nil {
 			writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
 				"server_error", "Failed to parse generated secret")
@@ -132,7 +126,7 @@ func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, audi
 		_, err = db.InsertOAuth2ProviderAppSecret(dbauthz.AsSystemRestricted(ctx), database.InsertOAuth2ProviderAppSecretParams{
 			ID:            uuid.New(),
 			CreatedAt:     now,
-			SecretPrefix:  []byte(parsedSecret.prefix),
+			SecretPrefix:  []byte(parsedSecret.Prefix),
 			HashedSecret:  []byte(hashedSecret),
 			DisplaySecret: createDisplaySecret(clientSecret),
 			AppID:         clientID,
@@ -551,27 +545,6 @@ func writeOAuth2RegistrationError(_ context.Context, rw http.ResponseWriter, sta
 	_ = json.NewEncoder(rw).Encode(errorResponse)
 }
 
-// parsedSecret represents the components of a formatted OAuth2 secret
-type parsedSecret struct {
-	prefix string
-	secret string
-}
-
-// parseFormattedSecret parses a formatted secret like "coder_prefix_secret"
-func parseFormattedSecret(secret string) (parsedSecret, error) {
-	parts := strings.Split(secret, "_")
-	if len(parts) != 3 {
-		return parsedSecret{}, xerrors.Errorf("incorrect number of parts: %d", len(parts))
-	}
-	if parts[0] != "coder" {
-		return parsedSecret{}, xerrors.Errorf("incorrect scheme: %s", parts[0])
-	}
-	return parsedSecret{
-		prefix: parts[1],
-		secret: parts[2],
-	}, nil
-}
-
 // createDisplaySecret creates a display version of the secret showing only the last few characters
 func createDisplaySecret(secret string) string {
 	if len(secret) <= displaySecretLength {
diff --git a/coderd/oauth2provider/revoke.go b/coderd/oauth2provider/revoke.go
index 243ce750288bb..2dbe4827b15ee 100644
--- a/coderd/oauth2provider/revoke.go
+++ b/coderd/oauth2provider/revoke.go
@@ -1,15 +1,214 @@
 package oauth2provider
 
 import (
+	"context"
+	"crypto/sha256"
+	"crypto/subtle"
 	"database/sql"
 	"errors"
 	"net/http"
+	"strings"
 
+	"golang.org/x/xerrors"
+
+	"github.com/google/uuid"
+
+	"cdr.dev/slog"
 	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/coderd/userpassword"
 )
 
+var (
+	// ErrTokenNotBelongsToClient is returned when a token does not belong to the requesting client
+	ErrTokenNotBelongsToClient = xerrors.New("token does not belong to requesting client")
+	// ErrInvalidTokenFormat is returned when a token has an invalid format
+	ErrInvalidTokenFormat = xerrors.New("invalid token format")
+)
+
+// RevokeToken implements RFC 7009 OAuth2 Token Revocation
+// Authentication is unique for this endpoint in that it does not use the
+// standard token authentication middleware. Instead, it expects the token that
+// is being revoked to be valid.
+// TODO: Currently the token validation occurs in the revocation logic itself.
+// This code should be refactored to share token validation logic with other parts
+// of the OAuth2 provider/http middleware.
+func RevokeToken(db database.Store, logger slog.Logger) http.HandlerFunc {
+	return func(rw http.ResponseWriter, r *http.Request) {
+		ctx := r.Context()
+		app := httpmw.OAuth2ProviderApp(r)
+
+		// RFC 7009 requires POST method with application/x-www-form-urlencoded
+		if r.Method != http.MethodPost {
+			httpapi.WriteOAuth2Error(ctx, rw, http.StatusMethodNotAllowed, "invalid_request", "Method not allowed")
+			return
+		}
+
+		if err := r.ParseForm(); err != nil {
+			httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", "Invalid form data")
+			return
+		}
+
+		// RFC 7009 requires 'token' parameter
+		token := r.Form.Get("token")
+		if token == "" {
+			httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", "Missing token parameter")
+			return
+		}
+
+		// Determine if this is a refresh token (starts with "coder_") or API key
+		// APIKeys do not have the SecretIdentifier prefix.
+		const coderPrefix = SecretIdentifier + "_"
+		isRefreshToken := strings.HasPrefix(token, coderPrefix)
+
+		// Revoke the token with ownership verification
+		err := db.InTx(func(tx database.Store) error {
+			if isRefreshToken {
+				// Handle refresh token revocation
+				return revokeRefreshTokenInTx(ctx, tx, token, app.ID)
+			}
+			// Handle API key revocation
+			return revokeAPIKeyInTx(ctx, tx, token, app.ID)
+		}, nil)
+		if err != nil {
+			if errors.Is(err, ErrTokenNotBelongsToClient) {
+				// RFC 7009: Return success even if token doesn't belong to client (don't reveal token existence)
+				logger.Debug(ctx, "token revocation failed: token does not belong to requesting client",
+					slog.F("client_id", app.ID.String()),
+					slog.F("app_name", app.Name))
+				rw.WriteHeader(http.StatusOK)
+				return
+			}
+			if errors.Is(err, ErrInvalidTokenFormat) {
+				// Invalid token format should return 400 bad request
+				logger.Debug(ctx, "token revocation failed: invalid token format",
+					slog.F("client_id", app.ID.String()),
+					slog.F("app_name", app.Name))
+				httpapi.WriteOAuth2Error(ctx, rw, http.StatusBadRequest, "invalid_request", "Invalid token format")
+				return
+			}
+			logger.Error(ctx, "token revocation failed with internal server error",
+				slog.Error(err),
+				slog.F("client_id", app.ID.String()),
+				slog.F("app_name", app.Name))
+			httpapi.WriteOAuth2Error(ctx, rw, http.StatusInternalServerError, "server_error", "Internal server error")
+			return
+		}
+
+		// RFC 7009: successful revocation returns HTTP 200
+		rw.WriteHeader(http.StatusOK)
+	}
+}
+
+func revokeRefreshTokenInTx(ctx context.Context, db database.Store, token string, appID uuid.UUID) error {
+	// Parse the refresh token using the existing function
+	parsedToken, err := ParseFormattedSecret(token)
+	if err != nil {
+		return ErrInvalidTokenFormat
+	}
+
+	// Try to find refresh token by prefix
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	dbToken, err := db.GetOAuth2ProviderAppTokenByPrefix(dbauthz.AsSystemOAuth2(ctx), []byte(parsedToken.Prefix))
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// Token not found - return success per RFC 7009 (don't reveal token existence)
+			return nil
+		}
+		return xerrors.Errorf("get oauth2 provider app token by prefix: %w", err)
+	}
+
+	equal, err := userpassword.Compare(string(dbToken.RefreshHash), parsedToken.Secret)
+	if err != nil {
+		return xerrors.Errorf("invalid refresh token: %w", err)
+	}
+	if !equal {
+		return xerrors.Errorf("invalid refresh token")
+	}
+
+	// Verify ownership
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	appSecret, err := db.GetOAuth2ProviderAppSecretByID(dbauthz.AsSystemOAuth2(ctx), dbToken.AppSecretID)
+	if err != nil {
+		return xerrors.Errorf("get oauth2 provider app secret: %w", err)
+	}
+	if appSecret.AppID != appID {
+		return ErrTokenNotBelongsToClient
+	}
+
+	// Delete the associated API key, which should cascade to remove the refresh token
+	// According to RFC 7009, when a refresh token is revoked, associated access tokens should be invalidated
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	err = db.DeleteAPIKeyByID(dbauthz.AsSystemOAuth2(ctx), dbToken.APIKeyID)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return xerrors.Errorf("delete api key: %w", err)
+	}
+
+	return nil
+}
+
+func revokeAPIKeyInTx(ctx context.Context, db database.Store, token string, appID uuid.UUID) error {
+	keyID, secret, err := httpmw.SplitAPIToken(token)
+	if err != nil {
+		return ErrInvalidTokenFormat
+	}
+
+	// Get the API key
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	apiKey, err := db.GetAPIKeyByID(dbauthz.AsSystemOAuth2(ctx), keyID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// API key not found - return success per RFC 7009 (don't reveal token existence)
+			return nil
+		}
+		return xerrors.Errorf("get api key by id: %w", err)
+	}
+
+	// Checking to see if the provided secret matches the stored hashed secret
+	hashedSecret := sha256.Sum256([]byte(secret))
+	if subtle.ConstantTimeCompare(apiKey.HashedSecret, hashedSecret[:]) != 1 {
+		return xerrors.Errorf("invalid api key")
+	}
+
+	// Verify the API key was created by OAuth2
+	if apiKey.LoginType != database.LoginTypeOAuth2ProviderApp {
+		return xerrors.New("api key is not an oauth2 token")
+	}
+
+	// Find the associated OAuth2 token to verify ownership
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	dbToken, err := db.GetOAuth2ProviderAppTokenByAPIKeyID(dbauthz.AsSystemOAuth2(ctx), apiKey.ID)
+	if err != nil {
+		if errors.Is(err, sql.ErrNoRows) {
+			// No associated OAuth2 token - return success per RFC 7009
+			return nil
+		}
+		return xerrors.Errorf("get oauth2 provider app token by api key id: %w", err)
+	}
+
+	// Verify the token belongs to the requesting app
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	appSecret, err := db.GetOAuth2ProviderAppSecretByID(dbauthz.AsSystemOAuth2(ctx), dbToken.AppSecretID)
+	if err != nil {
+		return xerrors.Errorf("get oauth2 provider app secret for api key verification: %w", err)
+	}
+
+	if appSecret.AppID != appID {
+		return ErrTokenNotBelongsToClient
+	}
+
+	// Delete the API key
+	//nolint:gocritic // Using AsSystemOAuth2 for OAuth2 public token revocation endpoint
+	err = db.DeleteAPIKeyByID(dbauthz.AsSystemOAuth2(ctx), apiKey.ID)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return xerrors.Errorf("delete api key for revocation: %w", err)
+	}
+
+	return nil
+}
+
 func RevokeApp(db database.Store) http.HandlerFunc {
 	return func(rw http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()
diff --git a/coderd/oauth2provider/secrets.go b/coderd/oauth2provider/secrets.go
index a360c0b325c89..56c5231b25efc 100644
--- a/coderd/oauth2provider/secrets.go
+++ b/coderd/oauth2provider/secrets.go
@@ -2,32 +2,68 @@ package oauth2provider
 
 import (
 	"fmt"
+	"strings"
+
+	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/coderd/userpassword"
 	"github.com/coder/coder/v2/cryptorand"
 )
 
+const (
+	// SecretIdentifier is the prefix added to all generated secrets.
+	SecretIdentifier = "coder"
+)
+
+// Constants for OAuth2 secret generation
+const (
+	secretLength        = 40 // Length of the actual secret part
+	displaySecretLength = 6  // Length of visible part in UI (last 6 characters)
+)
+
+type HashedAppSecret struct {
+	AppSecret
+	// Hashed is the server stored hash(secret,salt,...). Used for verifying a
+	// secret.
+	Hashed string
+}
+
 type AppSecret struct {
 	// Formatted contains the secret. This value is owned by the client, not the
 	// server.  It is formatted to include the prefix.
 	Formatted string
+	// Secret is the raw secret value. This value should only be known to the client.
+	Secret string
 	// Prefix is the ID of this secret owned by the server. When a client uses a
 	// secret, this is the matching string to do a lookup on the hashed value.  We
 	// cannot use the hashed value directly because the server does not store the
 	// salt.
 	Prefix string
-	// Hashed is the server stored hash(secret,salt,...). Used for verifying a
-	// secret.
-	Hashed string
+}
+
+// ParseFormattedSecret parses a formatted secret like "coder_<prefix>_<secret"
+func ParseFormattedSecret(formatted string) (AppSecret, error) {
+	parts := strings.Split(formatted, "_")
+	if len(parts) != 3 {
+		return AppSecret{}, xerrors.Errorf("incorrect number of parts: %d", len(parts))
+	}
+	if parts[0] != SecretIdentifier {
+		return AppSecret{}, xerrors.Errorf("incorrect scheme: %s", parts[0])
+	}
+	return AppSecret{
+		Formatted: formatted,
+		Prefix:    parts[1],
+		Secret:    parts[2],
+	}, nil
 }
 
 // GenerateSecret generates a secret to be used as a client secret, refresh
 // token, or authorization code.
-func GenerateSecret() (AppSecret, error) {
+func GenerateSecret() (HashedAppSecret, error) {
 	// 40 characters matches the length of GitHub's client secrets.
-	secret, err := cryptorand.String(40)
+	secret, err := cryptorand.String(secretLength)
 	if err != nil {
-		return AppSecret{}, err
+		return HashedAppSecret{}, err
 	}
 
 	// This ID is prefixed to the secret so it can be used to look up the secret
@@ -35,17 +71,20 @@ func GenerateSecret() (AppSecret, error) {
 	// will not have the salt.
 	prefix, err := cryptorand.String(10)
 	if err != nil {
-		return AppSecret{}, err
+		return HashedAppSecret{}, err
 	}
 
 	hashed, err := userpassword.Hash(secret)
 	if err != nil {
-		return AppSecret{}, err
+		return HashedAppSecret{}, err
 	}
 
-	return AppSecret{
-		Formatted: fmt.Sprintf("coder_%s_%s", prefix, secret),
-		Prefix:    prefix,
-		Hashed:    hashed,
+	return HashedAppSecret{
+		AppSecret: AppSecret{
+			Formatted: fmt.Sprintf("%s_%s_%s", SecretIdentifier, prefix, secret),
+			Secret:    secret,
+			Prefix:    prefix,
+		},
+		Hashed: hashed,
 	}, nil
 }
diff --git a/coderd/oauth2provider/tokens.go b/coderd/oauth2provider/tokens.go
index 78fd15fc3262a..94b24cca25186 100644
--- a/coderd/oauth2provider/tokens.go
+++ b/coderd/oauth2provider/tokens.go
@@ -185,19 +185,19 @@ func Tokens(db database.Store, lifetimes codersdk.SessionLifetime) http.HandlerF
 
 func authorizationCodeGrant(ctx context.Context, db database.Store, app database.OAuth2ProviderApp, lifetimes codersdk.SessionLifetime, params tokenParams) (oauth2.Token, error) {
 	// Validate the client secret.
-	secret, err := parseFormattedSecret(params.clientSecret)
+	secret, err := ParseFormattedSecret(params.clientSecret)
 	if err != nil {
 		return oauth2.Token{}, errBadSecret
 	}
 	//nolint:gocritic // Users cannot read secrets so we must use the system.
-	dbSecret, err := db.GetOAuth2ProviderAppSecretByPrefix(dbauthz.AsSystemRestricted(ctx), []byte(secret.prefix))
+	dbSecret, err := db.GetOAuth2ProviderAppSecretByPrefix(dbauthz.AsSystemRestricted(ctx), []byte(secret.Prefix))
 	if errors.Is(err, sql.ErrNoRows) {
 		return oauth2.Token{}, errBadSecret
 	}
 	if err != nil {
 		return oauth2.Token{}, err
 	}
-	equal, err := userpassword.Compare(string(dbSecret.HashedSecret), secret.secret)
+	equal, err := userpassword.Compare(string(dbSecret.HashedSecret), secret.Secret)
 	if err != nil {
 		return oauth2.Token{}, xerrors.Errorf("unable to compare secret: %w", err)
 	}
@@ -206,19 +206,19 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 	}
 
 	// Validate the authorization code.
-	code, err := parseFormattedSecret(params.code)
+	code, err := ParseFormattedSecret(params.code)
 	if err != nil {
 		return oauth2.Token{}, errBadCode
 	}
 	//nolint:gocritic // There is no user yet so we must use the system.
-	dbCode, err := db.GetOAuth2ProviderAppCodeByPrefix(dbauthz.AsSystemRestricted(ctx), []byte(code.prefix))
+	dbCode, err := db.GetOAuth2ProviderAppCodeByPrefix(dbauthz.AsSystemRestricted(ctx), []byte(code.Prefix))
 	if errors.Is(err, sql.ErrNoRows) {
 		return oauth2.Token{}, errBadCode
 	}
 	if err != nil {
 		return oauth2.Token{}, err
 	}
-	equal, err = userpassword.Compare(string(dbCode.HashedSecret), code.secret)
+	equal, err = userpassword.Compare(string(dbCode.HashedSecret), code.Secret)
 	if err != nil {
 		return oauth2.Token{}, xerrors.Errorf("unable to compare code: %w", err)
 	}
@@ -344,19 +344,19 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 
 func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAuth2ProviderApp, lifetimes codersdk.SessionLifetime, params tokenParams) (oauth2.Token, error) {
 	// Validate the token.
-	token, err := parseFormattedSecret(params.refreshToken)
+	token, err := ParseFormattedSecret(params.refreshToken)
 	if err != nil {
 		return oauth2.Token{}, errBadToken
 	}
 	//nolint:gocritic // There is no user yet so we must use the system.
-	dbToken, err := db.GetOAuth2ProviderAppTokenByPrefix(dbauthz.AsSystemRestricted(ctx), []byte(token.prefix))
+	dbToken, err := db.GetOAuth2ProviderAppTokenByPrefix(dbauthz.AsSystemRestricted(ctx), []byte(token.Prefix))
 	if errors.Is(err, sql.ErrNoRows) {
 		return oauth2.Token{}, errBadToken
 	}
 	if err != nil {
 		return oauth2.Token{}, err
 	}
-	equal, err := userpassword.Compare(string(dbToken.RefreshHash), token.secret)
+	equal, err := userpassword.Compare(string(dbToken.RefreshHash), token.Secret)
 	if err != nil {
 		return oauth2.Token{}, xerrors.Errorf("unable to compare token: %w", err)
 	}
diff --git a/coderd/rbac/authz.go b/coderd/rbac/authz.go
index 0715a8ead7783..a231419292525 100644
--- a/coderd/rbac/authz.go
+++ b/coderd/rbac/authz.go
@@ -73,6 +73,7 @@ const (
 	SubjectTypePrebuildsOrchestrator        SubjectType = "prebuilds_orchestrator"
 	SubjectTypeSystemReadProvisionerDaemons SubjectType = "system_read_provisioner_daemons"
 	SubjectTypeSystemRestricted             SubjectType = "system_restricted"
+	SubjectTypeSystemOAuth                  SubjectType = "system_oauth"
 	SubjectTypeNotifier                     SubjectType = "notifier"
 	SubjectTypeSubAgentAPI                  SubjectType = "sub_agent_api"
 	SubjectTypeFileReader                   SubjectType = "file_reader"
diff --git a/codersdk/oauth2.go b/codersdk/oauth2.go
index c2c59ed599190..c514a1b712c5f 100644
--- a/codersdk/oauth2.go
+++ b/codersdk/oauth2.go
@@ -7,6 +7,7 @@ import (
 	"fmt"
 	"net/http"
 	"net/url"
+	"strings"
 
 	"github.com/google/uuid"
 )
@@ -26,6 +27,7 @@ type OAuth2ProviderApp struct {
 type OAuth2AppEndpoints struct {
 	Authorization string `json:"authorization"`
 	Token         string `json:"token"`
+	TokenRevoke   string `json:"token_revoke"`
 	// DeviceAuth is optional.
 	DeviceAuth string `json:"device_authorization"`
 }
@@ -212,6 +214,26 @@ func (e OAuth2ProviderResponseType) Valid() bool {
 	return false
 }
 
+// RevokeOAuth2Token revokes a specific OAuth2 token using RFC 7009 token revocation.
+func (c *Client) RevokeOAuth2Token(ctx context.Context, clientID uuid.UUID, token string) error {
+	form := url.Values{}
+	form.Set("token", token)
+	// Client authentication is handled via the client_id in the app middleware
+	form.Set("client_id", clientID.String())
+
+	res, err := c.Request(ctx, http.MethodPost, "/oauth2/revoke", strings.NewReader(form.Encode()), func(r *http.Request) {
+		r.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	})
+	if err != nil {
+		return err
+	}
+	defer res.Body.Close()
+	if res.StatusCode != http.StatusOK {
+		return ReadBodyAsError(res)
+	}
+	return nil
+}
+
 // RevokeOAuth2ProviderApp completely revokes an app's access for the
 // authenticated user.
 func (c *Client) RevokeOAuth2ProviderApp(ctx context.Context, appID uuid.UUID) error {
diff --git a/docs/reference/api/enterprise.md b/docs/reference/api/enterprise.md
index 1ec87e0000220..cc208c27ed790 100644
--- a/docs/reference/api/enterprise.md
+++ b/docs/reference/api/enterprise.md
@@ -809,7 +809,8 @@ curl -X GET http://coder-server:8080/api/v2/oauth2-provider/apps \
     "endpoints": {
       "authorization": "string",
       "device_authorization": "string",
-      "token": "string"
+      "token": "string",
+      "token_revoke": "string"
     },
     "icon": "string",
     "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
@@ -836,6 +837,7 @@ Status Code **200**
 | `»» authorization`        | string                                                               | false    |              |                                                                                                                                                                                                         |
 | `»» device_authorization` | string                                                               | false    |              | Device authorization is optional.                                                                                                                                                                       |
 | `»» token`                | string                                                               | false    |              |                                                                                                                                                                                                         |
+| `»» token_revoke`         | string                                                               | false    |              |                                                                                                                                                                                                         |
 | `» icon`                  | string                                                               | false    |              |                                                                                                                                                                                                         |
 | `» id`                    | string(uuid)                                                         | false    |              |                                                                                                                                                                                                         |
 | `» name`                  | string                                                               | false    |              |                                                                                                                                                                                                         |
@@ -882,7 +884,8 @@ curl -X POST http://coder-server:8080/api/v2/oauth2-provider/apps \
   "endpoints": {
     "authorization": "string",
     "device_authorization": "string",
-    "token": "string"
+    "token": "string",
+    "token_revoke": "string"
   },
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
@@ -927,7 +930,8 @@ curl -X GET http://coder-server:8080/api/v2/oauth2-provider/apps/{app} \
   "endpoints": {
     "authorization": "string",
     "device_authorization": "string",
-    "token": "string"
+    "token": "string",
+    "token_revoke": "string"
   },
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
@@ -984,7 +988,8 @@ curl -X PUT http://coder-server:8080/api/v2/oauth2-provider/apps/{app} \
   "endpoints": {
     "authorization": "string",
     "device_authorization": "string",
-    "token": "string"
+    "token": "string",
+    "token_revoke": "string"
   },
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
@@ -1500,6 +1505,42 @@ curl -X POST http://coder-server:8080/api/v2/oauth2/register \
 |--------|--------------------------------------------------------------|-------------|--------------------------------------------------------------------------------------------------|
 | 201    | [Created](https://tools.ietf.org/html/rfc7231#section-6.3.2) | Created     | [codersdk.OAuth2ClientRegistrationResponse](schemas.md#codersdkoauth2clientregistrationresponse) |
 
+## Revoke OAuth2 tokens (RFC 7009)
+
+### Code samples
+
+```shell
+# Example request using curl
+curl -X POST http://coder-server:8080/api/v2/oauth2/revoke \
+
+```
+
+`POST /oauth2/revoke`
+
+> Body parameter
+
+```yaml
+client_id: string
+token: string
+token_type_hint: string
+
+```
+
+### Parameters
+
+| Name                | In   | Type   | Required | Description                                           |
+|---------------------|------|--------|----------|-------------------------------------------------------|
+| `body`              | body | object | true     |                                                       |
+| `» client_id`       | body | string | true     | Client ID for authentication                          |
+| `» token`           | body | string | true     | The token to revoke                                   |
+| `» token_type_hint` | body | string | false    | Hint about token type (access_token or refresh_token) |
+
+### Responses
+
+| Status | Meaning                                                 | Description                | Schema |
+|--------|---------------------------------------------------------|----------------------------|--------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | Token successfully revoked |        |
+
 ## OAuth2 token exchange
 
 ### Code samples
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 12fca35a848c0..86efc00f52e8d 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -5272,7 +5272,8 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 {
   "authorization": "string",
   "device_authorization": "string",
-  "token": "string"
+  "token": "string",
+  "token_revoke": "string"
 }
 ```
 
@@ -5283,6 +5284,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `authorization`        | string | false    |              |                                   |
 | `device_authorization` | string | false    |              | Device authorization is optional. |
 | `token`                | string | false    |              |                                   |
+| `token_revoke`         | string | false    |              |                                   |
 
 ## codersdk.OAuth2AuthorizationServerMetadata
 
@@ -5594,7 +5596,8 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "endpoints": {
     "authorization": "string",
     "device_authorization": "string",
-    "token": "string"
+    "token": "string",
+    "token_revoke": "string"
   },
   "icon": "string",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 91b685c0f53c7..f5e11dbefcc2c 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -2889,6 +2889,7 @@ export interface NullHCLString {
 export interface OAuth2AppEndpoints {
 	readonly authorization: string;
 	readonly token: string;
+	readonly token_revoke: string;
 	/**
 	 * DeviceAuth is optional.
 	 */
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 17e8c68315918..2b3ff41dda820 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -4528,6 +4528,7 @@ export const MockOAuth2ProviderApps: TypesGen.OAuth2ProviderApp[] = [
 			authorization: "http://localhost:3001/oauth2/authorize",
 			token: "http://localhost:3001/oauth2/token",
 			device_authorization: "",
+			token_revoke: "http://localhost:3001/oauth2/revoke",
 		},
 	},
 ];

From d455f6ea2bcd548d9d5ba000885731e629a6086f Mon Sep 17 00:00:00 2001
From: Jake Howell <jake@hwll.me>
Date: Thu, 23 Oct 2025 13:19:12 +1100
Subject: [PATCH 210/298] fix: rename `total` to `count` in
 `AIBridgeListInterceptionsResponse` (#20410)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Thanks to the great work in #20393, we’ve successfully introduced
offset-based pagination for this endpoint. However, the frontend expects
a `count` field in the response rather than `total`. This PR updates the
response payload to rename the returned key to `count` for consistency
with frontend expectations and existing API patterns.

This is necessary to unblock the work in #20331
---
 coderd/apidoc/docs.go              | 6 +++---
 coderd/apidoc/swagger.json         | 6 +++---
 codersdk/aibridge.go               | 2 +-
 docs/reference/api/aibridge.md     | 4 ++--
 docs/reference/api/schemas.md      | 6 +++---
 enterprise/coderd/aibridge.go      | 2 +-
 enterprise/coderd/aibridge_test.go | 8 ++++----
 site/src/api/typesGenerated.ts     | 2 +-
 8 files changed, 18 insertions(+), 18 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index fed42d7550f37..04c3935d0a26d 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11766,14 +11766,14 @@ const docTemplate = `{
         "codersdk.AIBridgeListInterceptionsResponse": {
             "type": "object",
             "properties": {
+                "count": {
+                    "type": "integer"
+                },
                 "results": {
                     "type": "array",
                     "items": {
                         "$ref": "#/definitions/codersdk.AIBridgeInterception"
                     }
-                },
-                "total": {
-                    "type": "integer"
                 }
             }
         },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 6b37aa45c7671..c1c6fd2d23a66 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10462,14 +10462,14 @@
 		"codersdk.AIBridgeListInterceptionsResponse": {
 			"type": "object",
 			"properties": {
+				"count": {
+					"type": "integer"
+				},
 				"results": {
 					"type": "array",
 					"items": {
 						"$ref": "#/definitions/codersdk.AIBridgeInterception"
 					}
-				},
-				"total": {
-					"type": "integer"
 				}
 			}
 		},
diff --git a/codersdk/aibridge.go b/codersdk/aibridge.go
index 0a6e85c94782c..afe0e19f78831 100644
--- a/codersdk/aibridge.go
+++ b/codersdk/aibridge.go
@@ -56,7 +56,7 @@ type AIBridgeToolUsage struct {
 }
 
 type AIBridgeListInterceptionsResponse struct {
-	Total   int64                  `json:"total"`
+	Count   int64                  `json:"count"`
 	Results []AIBridgeInterception `json:"results"`
 }
 
diff --git a/docs/reference/api/aibridge.md b/docs/reference/api/aibridge.md
index 54f408ec23995..2a2dd16ea93fe 100644
--- a/docs/reference/api/aibridge.md
+++ b/docs/reference/api/aibridge.md
@@ -28,6 +28,7 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/intercepti
 
 ```json
 {
+  "count": 0,
   "results": [
     {
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
@@ -89,8 +90,7 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/intercepti
         }
       ]
     }
-  ],
-  "total": 0
+  ]
 }
 ```
 
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 86efc00f52e8d..cd0daad963110 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -515,6 +515,7 @@
 
 ```json
 {
+  "count": 0,
   "results": [
     {
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
@@ -576,8 +577,7 @@
         }
       ]
     }
-  ],
-  "total": 0
+  ]
 }
 ```
 
@@ -585,8 +585,8 @@
 
 | Name      | Type                                                                    | Required | Restrictions | Description |
 |-----------|-------------------------------------------------------------------------|----------|--------------|-------------|
+| `count`   | integer                                                                 | false    |              |             |
 | `results` | array of [codersdk.AIBridgeInterception](#codersdkaibridgeinterception) | false    |              |             |
-| `total`   | integer                                                                 | false    |              |             |
 
 ## codersdk.AIBridgeOpenAIConfig
 
diff --git a/enterprise/coderd/aibridge.go b/enterprise/coderd/aibridge.go
index 2c28745c95a8a..dab93d8992a79 100644
--- a/enterprise/coderd/aibridge.go
+++ b/enterprise/coderd/aibridge.go
@@ -127,7 +127,7 @@ func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Reques
 	}
 
 	httpapi.Write(ctx, rw, http.StatusOK, codersdk.AIBridgeListInterceptionsResponse{
-		Total:   count,
+		Count:   count,
 		Results: items,
 	})
 }
diff --git a/enterprise/coderd/aibridge_test.go b/enterprise/coderd/aibridge_test.go
index 232cfd7072e77..5de1df5b60681 100644
--- a/enterprise/coderd/aibridge_test.go
+++ b/enterprise/coderd/aibridge_test.go
@@ -269,7 +269,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 						if len(res.Results) == 0 {
 							break
 						}
-						require.EqualValues(t, len(allInterceptionIDs), res.Total)
+						require.EqualValues(t, len(allInterceptionIDs), res.Count)
 						require.Len(t, res.Results, 1)
 						interceptionIDs = append(interceptionIDs, res.Results[0].ID)
 					}
@@ -322,7 +322,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		// Admin can see all interceptions.
 		res, err := adminExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
-		require.EqualValues(t, 2, res.Total)
+		require.EqualValues(t, 2, res.Count)
 		require.Len(t, res.Results, 2)
 		require.Equal(t, i1.ID, res.Results[0].ID)
 		require.Equal(t, i2.ID, res.Results[1].ID)
@@ -330,7 +330,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		// Second user can only see their own interceptions.
 		res, err = secondUserExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
-		require.EqualValues(t, 1, res.Total)
+		require.EqualValues(t, 1, res.Count)
 		require.Len(t, res.Results, 1)
 		require.Equal(t, i2.ID, res.Results[0].ID)
 	})
@@ -501,7 +501,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				ctx := testutil.Context(t, testutil.WaitLong)
 				res, err := experimentalClient.AIBridgeListInterceptions(ctx, tc.filter)
 				require.NoError(t, err)
-				require.EqualValues(t, len(tc.want), res.Total)
+				require.EqualValues(t, len(tc.want), res.Count)
 				// We just compare UUID strings for the sake of this test.
 				wantIDs := make([]string, len(tc.want))
 				for i, r := range tc.want {
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index f5e11dbefcc2c..449fc01d55aa7 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -39,7 +39,7 @@ export interface AIBridgeInterception {
 
 // From codersdk/aibridge.go
 export interface AIBridgeListInterceptionsResponse {
-	readonly total: number;
+	readonly count: number;
 	readonly results: readonly AIBridgeInterception[];
 }
 

From 70cc3dd14ac08a36ec6e0d38e24a180e1b2974a7 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Thu, 23 Oct 2025 09:55:19 +0100
Subject: [PATCH 211/298] ci(.github/workflows/traiage.yaml): use coder
 template with no preset (#20428)

Standardize on using the Write Coder on Coder template for the traiage
workflow.
---
 .github/workflows/traiage.yaml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 2749e07a4f63f..369743d864fbd 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -13,12 +13,12 @@ on:
       template_name:
         description: "Coder template to use for workspace"
         required: true
-        default: "traiage"
+        default: "coder"
         type: string
       template_preset:
         description: "Template preset to use"
         required: true
-        default: "Default"
+        default: "none"
         type: string
       prefix:
         description: "Prefix for workspace name"
@@ -66,8 +66,8 @@ jobs:
           GITHUB_EVENT_USER_ID: ${{ github.event.sender.id }}
           GITHUB_EVENT_USER_LOGIN: ${{ github.event.sender.login }}
           INPUTS_ISSUE_URL: ${{ inputs.issue_url }}
-          INPUTS_TEMPLATE_NAME: ${{ inputs.template_name || 'traiage' }}
-          INPUTS_TEMPLATE_PRESET: ${{ inputs.template_preset || 'Default'}}
+          INPUTS_TEMPLATE_NAME: ${{ inputs.template_name || 'coder' }}
+          INPUTS_TEMPLATE_PRESET: ${{ inputs.template_preset || 'none'}}
           INPUTS_PREFIX: ${{ inputs.prefix || 'traiage' }}
           GH_TOKEN: ${{ github.token }}
         run: |

From 4244b20823ecffae600c0dfe249986ff13c19d8f Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= <pawel@coder.com>
Date: Thu, 23 Oct 2025 13:29:05 +0200
Subject: [PATCH 212/298] feat: add ended_at column to aibridge_interceptions
 table (#20432)

Needed for marking interceptions as done
(https://github.com/coder/internal/issues/1051).
---
 coderd/database/dump.sql                             |  3 ++-
 .../000386_aibridge_interceptions_ended_at.down.sql  |  1 +
 .../000386_aibridge_interceptions_ended_at.up.sql    |  1 +
 coderd/database/modelqueries.go                      |  1 +
 coderd/database/models.go                            |  1 +
 coderd/database/queries.sql.go                       | 12 ++++++++----
 6 files changed, 14 insertions(+), 5 deletions(-)
 create mode 100644 coderd/database/migrations/000386_aibridge_interceptions_ended_at.down.sql
 create mode 100644 coderd/database/migrations/000386_aibridge_interceptions_ended_at.up.sql

diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index a01ddb8d1fa7d..11f668d2fca2e 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -1055,7 +1055,8 @@ CREATE TABLE aibridge_interceptions (
     provider text NOT NULL,
     model text NOT NULL,
     started_at timestamp with time zone NOT NULL,
-    metadata jsonb
+    metadata jsonb,
+    ended_at timestamp with time zone
 );
 
 COMMENT ON TABLE aibridge_interceptions IS 'Audit log of requests intercepted by AI Bridge';
diff --git a/coderd/database/migrations/000386_aibridge_interceptions_ended_at.down.sql b/coderd/database/migrations/000386_aibridge_interceptions_ended_at.down.sql
new file mode 100644
index 0000000000000..f578deb23c4c0
--- /dev/null
+++ b/coderd/database/migrations/000386_aibridge_interceptions_ended_at.down.sql
@@ -0,0 +1 @@
+ALTER TABLE aibridge_interceptions DROP COLUMN ended_at;
diff --git a/coderd/database/migrations/000386_aibridge_interceptions_ended_at.up.sql b/coderd/database/migrations/000386_aibridge_interceptions_ended_at.up.sql
new file mode 100644
index 0000000000000..e4cca7e5a5c56
--- /dev/null
+++ b/coderd/database/migrations/000386_aibridge_interceptions_ended_at.up.sql
@@ -0,0 +1 @@
+ALTER TABLE aibridge_interceptions ADD COLUMN ended_at TIMESTAMP WITH TIME ZONE DEFAULT NULL;
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
index 1400893a26fc3..c9c7879627684 100644
--- a/coderd/database/modelqueries.go
+++ b/coderd/database/modelqueries.go
@@ -804,6 +804,7 @@ func (q *sqlQuerier) ListAuthorizedAIBridgeInterceptions(ctx context.Context, ar
 			&i.AIBridgeInterception.Model,
 			&i.AIBridgeInterception.StartedAt,
 			&i.AIBridgeInterception.Metadata,
+			&i.AIBridgeInterception.EndedAt,
 			&i.VisibleUser.ID,
 			&i.VisibleUser.Username,
 			&i.VisibleUser.Name,
diff --git a/coderd/database/models.go b/coderd/database/models.go
index 2d02d2c14d051..fe9b04755bd43 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -3613,6 +3613,7 @@ type AIBridgeInterception struct {
 	Model       string                `db:"model" json:"model"`
 	StartedAt   time.Time             `db:"started_at" json:"started_at"`
 	Metadata    pqtype.NullRawMessage `db:"metadata" json:"metadata"`
+	EndedAt     sql.NullTime          `db:"ended_at" json:"ended_at"`
 }
 
 // Audit log of tokens used by intercepted requests in AI Bridge
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 5b4cf7b21e079..524394c1e2d96 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -168,7 +168,7 @@ func (q *sqlQuerier) CountAIBridgeInterceptions(ctx context.Context, arg CountAI
 
 const getAIBridgeInterceptionByID = `-- name: GetAIBridgeInterceptionByID :one
 SELECT
-	id, initiator_id, provider, model, started_at, metadata
+	id, initiator_id, provider, model, started_at, metadata, ended_at
 FROM
 	aibridge_interceptions
 WHERE
@@ -185,13 +185,14 @@ func (q *sqlQuerier) GetAIBridgeInterceptionByID(ctx context.Context, id uuid.UU
 		&i.Model,
 		&i.StartedAt,
 		&i.Metadata,
+		&i.EndedAt,
 	)
 	return i, err
 }
 
 const getAIBridgeInterceptions = `-- name: GetAIBridgeInterceptions :many
 SELECT
-	id, initiator_id, provider, model, started_at, metadata
+	id, initiator_id, provider, model, started_at, metadata, ended_at
 FROM
 	aibridge_interceptions
 `
@@ -212,6 +213,7 @@ func (q *sqlQuerier) GetAIBridgeInterceptions(ctx context.Context) ([]AIBridgeIn
 			&i.Model,
 			&i.StartedAt,
 			&i.Metadata,
+			&i.EndedAt,
 		); err != nil {
 			return nil, err
 		}
@@ -361,7 +363,7 @@ INSERT INTO aibridge_interceptions (
 ) VALUES (
 	$1, $2, $3, $4, COALESCE($5::jsonb, '{}'::jsonb), $6
 )
-RETURNING id, initiator_id, provider, model, started_at, metadata
+RETURNING id, initiator_id, provider, model, started_at, metadata, ended_at
 `
 
 type InsertAIBridgeInterceptionParams struct {
@@ -390,6 +392,7 @@ func (q *sqlQuerier) InsertAIBridgeInterception(ctx context.Context, arg InsertA
 		&i.Model,
 		&i.StartedAt,
 		&i.Metadata,
+		&i.EndedAt,
 	)
 	return i, err
 }
@@ -528,7 +531,7 @@ func (q *sqlQuerier) InsertAIBridgeUserPrompt(ctx context.Context, arg InsertAIB
 
 const listAIBridgeInterceptions = `-- name: ListAIBridgeInterceptions :many
 SELECT
-	aibridge_interceptions.id, aibridge_interceptions.initiator_id, aibridge_interceptions.provider, aibridge_interceptions.model, aibridge_interceptions.started_at, aibridge_interceptions.metadata,
+	aibridge_interceptions.id, aibridge_interceptions.initiator_id, aibridge_interceptions.provider, aibridge_interceptions.model, aibridge_interceptions.started_at, aibridge_interceptions.metadata, aibridge_interceptions.ended_at,
 	visible_users.id, visible_users.username, visible_users.name, visible_users.avatar_url
 FROM
 	aibridge_interceptions
@@ -625,6 +628,7 @@ func (q *sqlQuerier) ListAIBridgeInterceptions(ctx context.Context, arg ListAIBr
 			&i.AIBridgeInterception.Model,
 			&i.AIBridgeInterception.StartedAt,
 			&i.AIBridgeInterception.Metadata,
+			&i.AIBridgeInterception.EndedAt,
 			&i.VisibleUser.ID,
 			&i.VisibleUser.Username,
 			&i.VisibleUser.Name,

From e62c5db678d0ec86a657ec5aad25896ea58e0301 Mon Sep 17 00:00:00 2001
From: Hugo Dutka <hugo@coder.com>
Date: Thu, 23 Oct 2025 14:24:54 +0200
Subject: [PATCH 213/298] chore: remove references to
 dbtestutil.WillUsePostgres (#20436)

Addresses https://github.com/coder/internal/issues/758.

This PR only cleans up dead code, it makes no changes to test logic.
---
 cli/delete_test.go                            |  6 --
 cli/server_regenerate_vapid_keypair_test.go   |  3 -
 cli/server_test.go                            | 11 ---
 coderd/aitasks_test.go                        |  5 --
 coderd/autobuild/lifecycle_executor_test.go   |  8 ---
 coderd/database/db_test.go                    |  4 --
 coderd/database/dbauthz/dbauthz_test.go       |  3 +-
 coderd/database/dbauthz/setup_test.go         | 18 -----
 coderd/database/dbrollup/dbrollup_test.go     |  4 --
 coderd/database/dbtestutil/db.go              | 11 ---
 coderd/database/dbtestutil/postgres_test.go   | 15 ----
 coderd/database/pubsub/pubsub_test.go         |  6 --
 coderd/database/querier_test.go               | 28 --------
 coderd/notifications/metrics_test.go          | 10 ---
 coderd/notifications/notifications_test.go    | 54 --------------
 coderd/templates_test.go                      |  4 --
 coderd/templateversions_test.go               |  3 -
 coderd/workspacebuilds_test.go                | 16 ++---
 coderd/workspaces_test.go                     |  7 +-
 coderd/workspacestats/tracker_test.go         |  3 -
 enterprise/cli/server_dbcrypt_test.go         |  4 --
 enterprise/coderd/coderd_test.go              |  8 ---
 enterprise/coderd/notifications_test.go       | 17 -----
 .../coderd/prebuilds/membership_test.go       |  9 ---
 .../coderd/prebuilds/metricscollector_test.go | 12 ----
 enterprise/coderd/replicas_test.go            |  4 +-
 enterprise/coderd/workspaceagents_test.go     |  4 --
 enterprise/coderd/workspacequota_test.go      |  4 --
 enterprise/coderd/workspaces_test.go          | 16 -----
 enterprise/tailnet/handshaker_test.go         |  8 +--
 enterprise/tailnet/multiagent_test.go         | 21 ------
 enterprise/tailnet/pgcoord_internal_test.go   |  8 +--
 enterprise/tailnet/pgcoord_test.go            | 72 ++++---------------
 33 files changed, 26 insertions(+), 380 deletions(-)

diff --git a/cli/delete_test.go b/cli/delete_test.go
index 2e550d74849ab..271f5342ea91c 100644
--- a/cli/delete_test.go
+++ b/cli/delete_test.go
@@ -185,9 +185,6 @@ func TestDelete(t *testing.T) {
 
 	t.Run("WarnNoProvisioners", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
 
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
@@ -228,9 +225,6 @@ func TestDelete(t *testing.T) {
 
 	t.Run("Prebuilt workspace delete permissions", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
 
 		// Setup
 		db, pb := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
diff --git a/cli/server_regenerate_vapid_keypair_test.go b/cli/server_regenerate_vapid_keypair_test.go
index cbaff3681df11..6c9603e00929c 100644
--- a/cli/server_regenerate_vapid_keypair_test.go
+++ b/cli/server_regenerate_vapid_keypair_test.go
@@ -17,9 +17,6 @@ import (
 
 func TestRegenerateVapidKeypair(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test is only supported on postgres")
-	}
 
 	t.Run("NoExistingVAPIDKeys", func(t *testing.T) {
 		t.Parallel()
diff --git a/cli/server_test.go b/cli/server_test.go
index 0748786765cb8..d6278fc7669c0 100644
--- a/cli/server_test.go
+++ b/cli/server_test.go
@@ -348,9 +348,6 @@ func TestServer(t *testing.T) {
 
 		runGitHubProviderTest := func(t *testing.T, tc testCase) {
 			t.Parallel()
-			if !dbtestutil.WillUsePostgres() {
-				t.Skip("test requires postgres")
-			}
 
 			ctx, cancelFunc := context.WithCancel(testutil.Context(t, testutil.WaitLong))
 			defer cancelFunc()
@@ -2142,10 +2139,6 @@ func TestServerYAMLConfig(t *testing.T) {
 func TestConnectToPostgres(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test does not make sense without postgres")
-	}
-
 	t.Run("Migrate", func(t *testing.T) {
 		t.Parallel()
 
@@ -2256,10 +2249,6 @@ type runServerOpts struct {
 func TestServer_TelemetryDisabled_FinalReport(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	telemetryServerURL, deployment, snapshot := mockTelemetryServer(t)
 	dbConnURL, err := dbtestutil.Open(t)
 	require.NoError(t, err)
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 28d444014bdd5..895936a76085d 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -22,7 +22,6 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbfake"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
-	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/notifications"
 	"github.com/coder/coder/v2/coderd/notifications/notificationstest"
@@ -54,10 +53,6 @@ func TestAITasksPrompts(t *testing.T) {
 	t.Run("MultipleBuilds", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("This test checks RBAC, which is not supported in the in-memory database")
-		}
-
 		adminClient := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		first := coderdtest.CreateFirstUser(t, adminClient)
 		memberClient, _ := coderdtest.CreateAnotherUser(t, adminClient, first.OrganizationID)
diff --git a/coderd/autobuild/lifecycle_executor_test.go b/coderd/autobuild/lifecycle_executor_test.go
index 1bd50564b6b9b..263a9e7e13c77 100644
--- a/coderd/autobuild/lifecycle_executor_test.go
+++ b/coderd/autobuild/lifecycle_executor_test.go
@@ -776,10 +776,6 @@ func TestExecutorWorkspaceAutostopNoWaitChangedMyMind(t *testing.T) {
 }
 
 func TestExecutorAutostartMultipleOK(t *testing.T) {
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip(`This test only really works when using a "real" database, similar to a HA setup`)
-	}
-
 	t.Parallel()
 
 	var (
@@ -1259,10 +1255,6 @@ func TestNotifications(t *testing.T) {
 func TestExecutorPrebuilds(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	// Prebuild workspaces should not be autostopped when the deadline is reached.
 	// After being claimed, the workspace should stop at the deadline.
 	t.Run("OnlyStopsAfterClaimed", func(t *testing.T) {
diff --git a/coderd/database/db_test.go b/coderd/database/db_test.go
index f9442942e53e1..68b60a788fd3d 100644
--- a/coderd/database/db_test.go
+++ b/coderd/database/db_test.go
@@ -85,10 +85,6 @@ func TestNestedInTx(t *testing.T) {
 func testSQLDB(t testing.TB) *sql.DB {
 	t.Helper()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	connection, err := dbtestutil.Open(t)
 	require.NoError(t, err)
 
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index feb78215c5d29..93e26ae51480f 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -2946,7 +2946,6 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 		dbm.EXPECT().GetParameterSchemasByJobID(gomock.Any(), jobID).Return([]database.ParameterSchema{}, nil).AnyTimes()
 		check.Args(jobID).
 			Asserts(tpl, policy.ActionRead).
-			ErrorsWithInMemDB(sql.ErrNoRows).
 			Returns([]database.ParameterSchema{})
 	}))
 	s.Run("GetWorkspaceAppsByAgentIDs", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
@@ -3189,7 +3188,7 @@ func (s *MethodTestSuite) TestSystemFunctions() {
 	}))
 	s.Run("GetAppSecurityKey", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 		dbm.EXPECT().GetAppSecurityKey(gomock.Any()).Return("", sql.ErrNoRows).AnyTimes()
-		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).ErrorsWithPG(sql.ErrNoRows)
+		check.Args().Asserts(rbac.ResourceSystem, policy.ActionRead).Errors(sql.ErrNoRows)
 	}))
 	s.Run("UpsertAppSecurityKey", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 		dbm.EXPECT().UpsertAppSecurityKey(gomock.Any(), "foo").Return(nil).AnyTimes()
diff --git a/coderd/database/dbauthz/setup_test.go b/coderd/database/dbauthz/setup_test.go
index 6a3f1a2b3fe62..91fb68e1a1f3f 100644
--- a/coderd/database/dbauthz/setup_test.go
+++ b/coderd/database/dbauthz/setup_test.go
@@ -430,24 +430,6 @@ func (m *expects) Errors(err error) *expects {
 	return m
 }
 
-// ErrorsWithPG is optional. If it is never called, it will not be asserted.
-// It will only be asserted if the test is running with a Postgres database.
-func (m *expects) ErrorsWithPG(err error) *expects {
-	if dbtestutil.WillUsePostgres() {
-		return m.Errors(err)
-	}
-	return m
-}
-
-// ErrorsWithInMemDB is optional. If it is never called, it will not be asserted.
-// It will only be asserted if the test is running with an in-memory database.
-func (m *expects) ErrorsWithInMemDB(err error) *expects {
-	if !dbtestutil.WillUsePostgres() {
-		return m.Errors(err)
-	}
-	return m
-}
-
 func (m *expects) FailSystemObjectChecks() *expects {
 	return m.WithSuccessAuthorizer(func(ctx context.Context, subject rbac.Subject, action policy.Action, obj rbac.Object) error {
 		if obj.Type == rbac.ResourceSystem.Type {
diff --git a/coderd/database/dbrollup/dbrollup_test.go b/coderd/database/dbrollup/dbrollup_test.go
index 2c727a6ca101a..c0417cd63134c 100644
--- a/coderd/database/dbrollup/dbrollup_test.go
+++ b/coderd/database/dbrollup/dbrollup_test.go
@@ -52,10 +52,6 @@ func (w *wrapUpsertDB) UpsertTemplateUsageStats(ctx context.Context) error {
 func TestRollup_TwoInstancesUseLocking(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("Skipping test; only works with PostgreSQL.")
-	}
-
 	db, ps := dbtestutil.NewDB(t, dbtestutil.WithDumpOnFailure())
 	logger := testutil.Logger(t)
 
diff --git a/coderd/database/dbtestutil/db.go b/coderd/database/dbtestutil/db.go
index b4ddc491f3781..3d636e6833131 100644
--- a/coderd/database/dbtestutil/db.go
+++ b/coderd/database/dbtestutil/db.go
@@ -23,13 +23,6 @@ import (
 	"github.com/coder/coder/v2/testutil"
 )
 
-// WillUsePostgres returns true if a call to NewDB() will return a real, postgres-backed Store and Pubsub.
-// TODO(hugodutka): since we removed the in-memory database, this is always true,
-// and we need to remove this function. https://github.com/coder/internal/issues/758
-func WillUsePostgres() bool {
-	return true
-}
-
 type options struct {
 	fixedTimezone string
 	dumpOnFailure bool
@@ -75,10 +68,6 @@ func withReturnSQLDB(f func(*sql.DB)) Option {
 func NewDBWithSQLDB(t testing.TB, opts ...Option) (database.Store, pubsub.Pubsub, *sql.DB) {
 	t.Helper()
 
-	if !WillUsePostgres() {
-		t.Fatal("cannot use NewDBWithSQLDB without PostgreSQL, consider adding `if !dbtestutil.WillUsePostgres() { t.Skip() }` to this test")
-	}
-
 	var sqlDB *sql.DB
 	opts = append(opts, withReturnSQLDB(func(db *sql.DB) {
 		sqlDB = db
diff --git a/coderd/database/dbtestutil/postgres_test.go b/coderd/database/dbtestutil/postgres_test.go
index e653895f8e961..ecf18c9cfdecb 100644
--- a/coderd/database/dbtestutil/postgres_test.go
+++ b/coderd/database/dbtestutil/postgres_test.go
@@ -20,9 +20,6 @@ func TestMain(m *testing.M) {
 
 func TestOpen(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
 
 	connect, err := dbtestutil.Open(t)
 	require.NoError(t, err)
@@ -37,9 +34,6 @@ func TestOpen(t *testing.T) {
 
 func TestOpen_InvalidDBFrom(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
 
 	_, err := dbtestutil.Open(t, dbtestutil.WithDBFrom("__invalid__"))
 	require.Error(t, err)
@@ -49,9 +43,6 @@ func TestOpen_InvalidDBFrom(t *testing.T) {
 
 func TestOpen_ValidDBFrom(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
 
 	// first check if we can create a new template db
 	dsn, err := dbtestutil.Open(t, dbtestutil.WithDBFrom(""))
@@ -115,9 +106,6 @@ func TestOpen_ValidDBFrom(t *testing.T) {
 func TestOpen_Panic(t *testing.T) {
 	t.Skip("unskip this to manually test that we don't leak a database into postgres")
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
 
 	_, err := dbtestutil.Open(t)
 	require.NoError(t, err)
@@ -127,9 +115,6 @@ func TestOpen_Panic(t *testing.T) {
 func TestOpen_Timeout(t *testing.T) {
 	t.Skip("unskip this and set a short timeout to manually test that we don't leak a database into postgres")
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
 
 	_, err := dbtestutil.Open(t)
 	require.NoError(t, err)
diff --git a/coderd/database/pubsub/pubsub_test.go b/coderd/database/pubsub/pubsub_test.go
index 4f4a387276355..79ce80ea5448e 100644
--- a/coderd/database/pubsub/pubsub_test.go
+++ b/coderd/database/pubsub/pubsub_test.go
@@ -19,9 +19,6 @@ import (
 
 func TestPGPubsub_Metrics(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := testutil.Logger(t)
 	connectionURL, err := dbtestutil.Open(t)
@@ -122,9 +119,6 @@ func TestPGPubsub_Metrics(t *testing.T) {
 
 func TestPGPubsubDriver(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	ctx := testutil.Context(t, testutil.WaitLong)
 	logger := slogtest.Make(t, &slogtest.Options{
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 5c894f98e9957..5d57684c0e682 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -3742,9 +3742,6 @@ func TestGetProvisionerJobsByIDsWithQueuePosition(t *testing.T) {
 
 func TestGetProvisionerJobsByIDsWithQueuePosition_MixedStatuses(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.SkipNow()
-	}
 
 	db, _ := dbtestutil.NewDB(t)
 	now := dbtime.Now()
@@ -4084,10 +4081,6 @@ func TestGetUserStatusCounts(t *testing.T) {
 	t.Parallel()
 	t.Skip("https://github.com/coder/internal/issues/464")
 
-	if !dbtestutil.WillUsePostgres() {
-		t.SkipNow()
-	}
-
 	timezones := []string{
 		"Canada/Newfoundland",
 		"Africa/Johannesburg",
@@ -4625,10 +4618,6 @@ func TestGetUserStatusCounts(t *testing.T) {
 func TestOrganizationDeleteTrigger(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.SkipNow()
-	}
-
 	t.Run("WorkspaceExists", func(t *testing.T) {
 		t.Parallel()
 		db, _ := dbtestutil.NewDB(t)
@@ -4942,9 +4931,6 @@ func createPrebuiltWorkspace(
 
 func TestWorkspacePrebuildsView(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.SkipNow()
-	}
 
 	now := dbtime.Now()
 	orgID := uuid.New()
@@ -5046,9 +5032,6 @@ func TestWorkspacePrebuildsView(t *testing.T) {
 
 func TestGetPresetsBackoff(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.SkipNow()
-	}
 
 	now := dbtime.Now()
 	orgID := uuid.New()
@@ -5565,9 +5548,6 @@ func TestGetPresetsBackoff(t *testing.T) {
 
 func TestGetPresetsAtFailureLimit(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.SkipNow()
-	}
 
 	now := dbtime.Now()
 	hourBefore := now.Add(-time.Hour)
@@ -5871,10 +5851,6 @@ func TestGetPresetsAtFailureLimit(t *testing.T) {
 func TestWorkspaceAgentNameUniqueTrigger(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test makes use of a database trigger not implemented in dbmem")
-	}
-
 	createWorkspaceWithAgent := func(t *testing.T, db database.Store, org database.Organization, agentName string) (database.WorkspaceBuild, database.WorkspaceResource, database.WorkspaceAgent) {
 		t.Helper()
 
@@ -6141,10 +6117,6 @@ func requireUsersMatch(t testing.TB, expected []database.User, found []database.
 func TestGetRunningPrebuiltWorkspaces(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("Test requires PostgreSQL for complex queries")
-	}
-
 	ctx := testutil.Context(t, testutil.WaitLong)
 	db, _ := dbtestutil.NewDB(t)
 	now := dbtime.Now()
diff --git a/coderd/notifications/metrics_test.go b/coderd/notifications/metrics_test.go
index 6ba6635a50c4c..975a6db0dd02b 100644
--- a/coderd/notifications/metrics_test.go
+++ b/coderd/notifications/metrics_test.go
@@ -33,9 +33,6 @@ func TestMetrics(t *testing.T) {
 	t.Parallel()
 
 	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
 
 	ctx := dbauthz.AsSystemRestricted(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
@@ -390,13 +387,6 @@ func TestInflightDispatchesMetric(t *testing.T) {
 
 func TestCustomMethodMetricCollection(t *testing.T) {
 	t.Parallel()
-
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		// UpdateNotificationTemplateMethodByID only makes sense with a real database.
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	ctx := dbauthz.AsSystemRestricted(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)
diff --git a/coderd/notifications/notifications_test.go b/coderd/notifications/notifications_test.go
index d3d9ff2b85736..d395bd748cd5a 100644
--- a/coderd/notifications/notifications_test.go
+++ b/coderd/notifications/notifications_test.go
@@ -66,11 +66,6 @@ func TestMain(m *testing.M) {
 func TestBasicNotificationRoundtrip(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)
@@ -278,11 +273,6 @@ func TestWebhookDispatch(t *testing.T) {
 func TestBackpressure(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	store, pubsub := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitShort))
@@ -407,11 +397,6 @@ func TestBackpressure(t *testing.T) {
 func TestRetries(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	const maxAttempts = 3
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
@@ -507,11 +492,6 @@ func TestRetries(t *testing.T) {
 func TestExpiredLeaseIsRequeued(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)
@@ -751,10 +731,6 @@ func enumerateAllTemplates(t *testing.T) ([]string, error) {
 func TestNotificationTemplates_Golden(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on the notification templates added by migrations in the database")
-	}
-
 	const (
 		username = "bob"
 		password = "🤫"
@@ -1705,10 +1681,6 @@ func normalizeGoldenWebhook(content []byte) []byte {
 func TestDisabledByDefaultBeforeEnqueue(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it is testing business-logic implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, _ := dbtestutil.NewDB(t)
 	logbuf := strings.Builder{}
@@ -1732,11 +1704,6 @@ func TestDisabledByDefaultBeforeEnqueue(t *testing.T) {
 func TestDisabledBeforeEnqueue(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it is testing business-logic implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, _ := dbtestutil.NewDB(t)
 	logbuf := strings.Builder{}
@@ -1771,11 +1738,6 @@ func TestDisabledBeforeEnqueue(t *testing.T) {
 func TestDisabledAfterEnqueue(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it is testing business-logic implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)
@@ -1827,11 +1789,6 @@ func TestDisabledAfterEnqueue(t *testing.T) {
 func TestCustomNotificationMethod(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)
@@ -1929,12 +1886,6 @@ func TestCustomNotificationMethod(t *testing.T) {
 func TestNotificationsTemplates(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		// Notification system templates are only served from the database and not dbmem at this time.
-		t.Skip("This test requires postgres; it relies on business-logic only implemented in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	api := coderdtest.New(t, createOpts(t))
 
@@ -1966,11 +1917,6 @@ func createOpts(t *testing.T) *coderdtest.Options {
 func TestNotificationDuplicates(t *testing.T) {
 	t.Parallel()
 
-	// SETUP
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("This test requires postgres; it is testing the dedupe hash trigger in the database")
-	}
-
 	ctx := dbauthz.AsNotifier(testutil.Context(t, testutil.WaitSuperLong))
 	store, pubsub := dbtestutil.NewDB(t)
 	logbuf := strings.Builder{}
diff --git a/coderd/templates_test.go b/coderd/templates_test.go
index c470dd17c664a..df50b28ab861e 100644
--- a/coderd/templates_test.go
+++ b/coderd/templates_test.go
@@ -944,10 +944,6 @@ func TestPatchTemplateMeta(t *testing.T) {
 	t.Run("AlreadyExists", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("This test requires Postgres constraints")
-		}
-
 		ownerClient := coderdtest.New(t, nil)
 		owner := coderdtest.CreateFirstUser(t, ownerClient)
 		client, _ := coderdtest.CreateAnotherUser(t, ownerClient, owner.OrganizationID, rbac.ScopedRoleOrgTemplateAdmin(owner.OrganizationID))
diff --git a/coderd/templateversions_test.go b/coderd/templateversions_test.go
index 48f690d26d2eb..f282f8420b52e 100644
--- a/coderd/templateversions_test.go
+++ b/coderd/templateversions_test.go
@@ -1422,9 +1422,6 @@ func TestTemplateVersionDryRun(t *testing.T) {
 
 	t.Run("Pending", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
 
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closer := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
diff --git a/coderd/workspacebuilds_test.go b/coderd/workspacebuilds_test.go
index 2c518a95e53a6..f857296db1a5c 100644
--- a/coderd/workspacebuilds_test.go
+++ b/coderd/workspacebuilds_test.go
@@ -634,9 +634,7 @@ func TestPatchCancelWorkspaceBuild(t *testing.T) {
 
 	t.Run("Cancel with expect_state=pending", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
+
 		// Given: a coderd instance with a provisioner daemon
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
@@ -732,9 +730,7 @@ func TestPatchCancelWorkspaceBuild(t *testing.T) {
 
 	t.Run("Cancel with expect_state=running when job is pending - should fail with 412", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
+
 		// Given: a coderd instance with a provisioner daemon
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
@@ -1731,9 +1727,7 @@ func TestPostWorkspaceBuild(t *testing.T) {
 
 	t.Run("NoProvisionersAvailable", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
+
 		// Given: a coderd instance with a provisioner daemon
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
@@ -1777,9 +1771,7 @@ func TestPostWorkspaceBuild(t *testing.T) {
 
 	t.Run("AllProvisionersStale", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
+
 		// Given: a coderd instance with a provisioner daemon
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
diff --git a/coderd/workspaces_test.go b/coderd/workspaces_test.go
index 3a24eafde1a95..51134dce27951 100644
--- a/coderd/workspaces_test.go
+++ b/coderd/workspaces_test.go
@@ -1240,9 +1240,7 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 
 	t.Run("NoProvisionersAvailable", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
+
 		// Given: a coderd instance with a provisioner daemon
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
 		client, closeDaemon := coderdtest.NewWithProvisionerCloser(t, &coderdtest.Options{
@@ -1283,9 +1281,6 @@ func TestPostWorkspacesByOrganization(t *testing.T) {
 
 	t.Run("AllProvisionersStale", func(t *testing.T) {
 		t.Parallel()
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test requires postgres")
-		}
 
 		// Given: a coderd instance with a provisioner daemon
 		store, ps, db := dbtestutil.NewDBWithSQLDB(t)
diff --git a/coderd/workspacestats/tracker_test.go b/coderd/workspacestats/tracker_test.go
index 2803e5a5322b3..fde8c9f2dad90 100644
--- a/coderd/workspacestats/tracker_test.go
+++ b/coderd/workspacestats/tracker_test.go
@@ -110,9 +110,6 @@ func TestTracker(t *testing.T) {
 // This test performs a more 'integration-style' test with multiple instances.
 func TestTracker_MultipleInstances(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test only makes sense with postgres")
-	}
 
 	// Given we have two coderd instances connected to the same database
 	var (
diff --git a/enterprise/cli/server_dbcrypt_test.go b/enterprise/cli/server_dbcrypt_test.go
index 06851dd0a2eaf..b50b8c0c504cb 100644
--- a/enterprise/cli/server_dbcrypt_test.go
+++ b/enterprise/cli/server_dbcrypt_test.go
@@ -24,10 +24,6 @@ import (
 //
 // nolint: paralleltest // use of t.Setenv
 func TestServerDBCrypt(t *testing.T) {
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires a postgres instance")
-	}
-
 	ctx, cancel := context.WithCancel(context.Background())
 	t.Cleanup(cancel)
 
diff --git a/enterprise/coderd/coderd_test.go b/enterprise/coderd/coderd_test.go
index 00bb3e59e616a..c3e6e1579fe91 100644
--- a/enterprise/coderd/coderd_test.go
+++ b/enterprise/coderd/coderd_test.go
@@ -79,10 +79,6 @@ func TestEntitlements(t *testing.T) {
 		require.Equal(t, fmt.Sprintf("%p", api.Entitlements), fmt.Sprintf("%p", api.AGPL.Entitlements))
 	})
 	t.Run("FullLicense", func(t *testing.T) {
-		// PGCoordinator requires a real postgres
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("test only with postgres")
-		}
 		t.Parallel()
 		adminClient, _ := coderdenttest.New(t, &coderdenttest.Options{
 			AuditLogging:   true,
@@ -882,10 +878,6 @@ func (s *restartableTestServer) startWithFirstUser(t *testing.T) (client *coders
 func TestConn_CoordinatorRollingRestart(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
-
 	// Although DERP will have connection issues until the connection is
 	// reestablished, any open connections should be maintained.
 	//
diff --git a/enterprise/coderd/notifications_test.go b/enterprise/coderd/notifications_test.go
index 77b057bf41657..571ed4ced00dd 100644
--- a/enterprise/coderd/notifications_test.go
+++ b/enterprise/coderd/notifications_test.go
@@ -12,7 +12,6 @@ import (
 
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
-	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/coderd/notifications"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
@@ -36,10 +35,6 @@ func TestUpdateNotificationTemplateMethod(t *testing.T) {
 	t.Run("Happy path", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("This test requires postgres; it relies on read from and writing to the notification_templates table")
-		}
-
 		ctx := testutil.Context(t, testutil.WaitSuperLong)
 		api, _ := coderdenttest.New(t, createOpts(t))
 
@@ -67,10 +62,6 @@ func TestUpdateNotificationTemplateMethod(t *testing.T) {
 	t.Run("Insufficient permissions", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("This test requires postgres; it relies on read from and writing to the notification_templates table")
-		}
-
 		ctx := testutil.Context(t, testutil.WaitSuperLong)
 
 		// Given: the first user which has an "owner" role, and another user which does not.
@@ -91,10 +82,6 @@ func TestUpdateNotificationTemplateMethod(t *testing.T) {
 	t.Run("Invalid notification method", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("This test requires postgres; it relies on read from and writing to the notification_templates table")
-		}
-
 		ctx := testutil.Context(t, testutil.WaitSuperLong)
 
 		// Given: the first user which has an "owner" role
@@ -120,10 +107,6 @@ func TestUpdateNotificationTemplateMethod(t *testing.T) {
 	t.Run("Not modified", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("This test requires postgres; it relies on read from and writing to the notification_templates table")
-		}
-
 		ctx := testutil.Context(t, testutil.WaitSuperLong)
 		api, _ := coderdenttest.New(t, createOpts(t))
 
diff --git a/enterprise/coderd/prebuilds/membership_test.go b/enterprise/coderd/prebuilds/membership_test.go
index 80e2f907349ae..55d6557b12495 100644
--- a/enterprise/coderd/prebuilds/membership_test.go
+++ b/enterprise/coderd/prebuilds/membership_test.go
@@ -15,7 +15,6 @@ import (
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
-	"github.com/coder/coder/v2/coderd/database/dbtestutil"
 	"github.com/coder/coder/v2/enterprise/coderd/prebuilds"
 	"github.com/coder/coder/v2/testutil"
 )
@@ -91,14 +90,6 @@ func TestReconcileAll(t *testing.T) {
 							unrelatedOrg := dbgen.Organization(t, db, database.Organization{})
 							targetOrg := dbgen.Organization(t, db, database.Organization{})
 
-							if !dbtestutil.WillUsePostgres() {
-								// dbmem doesn't ensure membership to the default organization
-								dbgen.OrganizationMember(t, db, database.OrganizationMember{
-									OrganizationID: defaultOrg.ID,
-									UserID:         database.PrebuildsSystemUserID,
-								})
-							}
-
 							// Ensure membership to unrelated org.
 							dbgen.OrganizationMember(t, db, database.OrganizationMember{OrganizationID: unrelatedOrg.ID, UserID: database.PrebuildsSystemUserID})
 
diff --git a/enterprise/coderd/prebuilds/metricscollector_test.go b/enterprise/coderd/prebuilds/metricscollector_test.go
index b852079beb2af..f9584e9ec2c25 100644
--- a/enterprise/coderd/prebuilds/metricscollector_test.go
+++ b/enterprise/coderd/prebuilds/metricscollector_test.go
@@ -30,10 +30,6 @@ import (
 func TestMetricsCollector(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	type metricCheck struct {
 		name      string
 		value     *float64
@@ -298,10 +294,6 @@ func TestMetricsCollector(t *testing.T) {
 func TestMetricsCollector_DuplicateTemplateNames(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	type metricCheck struct {
 		name      string
 		value     *float64
@@ -478,10 +470,6 @@ func findAllMetricSeries(metricsFamilies []*prometheus_client.MetricFamily, labe
 func TestMetricsCollector_ReconciliationPausedMetric(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	t.Run("reconciliation_not_paused", func(t *testing.T) {
 		t.Parallel()
 
diff --git a/enterprise/coderd/replicas_test.go b/enterprise/coderd/replicas_test.go
index 5a56817b19409..4b16f7bb70b91 100644
--- a/enterprise/coderd/replicas_test.go
+++ b/enterprise/coderd/replicas_test.go
@@ -20,9 +20,7 @@ import (
 
 func TestReplicas(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("only test with real postgres")
-	}
+
 	t.Run("ErrorWithoutLicense", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
diff --git a/enterprise/coderd/workspaceagents_test.go b/enterprise/coderd/workspaceagents_test.go
index 917d44dff2d48..2e4690bc961a9 100644
--- a/enterprise/coderd/workspaceagents_test.go
+++ b/enterprise/coderd/workspaceagents_test.go
@@ -89,10 +89,6 @@ func TestBlockNonBrowser(t *testing.T) {
 func TestReinitializeAgent(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("dbmem cannot currently claim a workspace")
-	}
-
 	if runtime.GOOS == "windows" {
 		t.Skip("test startup script is not supported on windows")
 	}
diff --git a/enterprise/coderd/workspacequota_test.go b/enterprise/coderd/workspacequota_test.go
index 186af3a787d94..937aa8d57433a 100644
--- a/enterprise/coderd/workspacequota_test.go
+++ b/enterprise/coderd/workspacequota_test.go
@@ -660,10 +660,6 @@ func TestWorkspaceQuota(t *testing.T) {
 func TestWorkspaceSerialization(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("Serialization errors only occur in postgres")
-	}
-
 	db, _ := dbtestutil.NewDB(t)
 
 	user := dbgen.User(t, db, database.User{})
diff --git a/enterprise/coderd/workspaces_test.go b/enterprise/coderd/workspaces_test.go
index 25fa1527d894e..5201e613f7a1d 100644
--- a/enterprise/coderd/workspaces_test.go
+++ b/enterprise/coderd/workspaces_test.go
@@ -534,10 +534,6 @@ func TestCreateUserWorkspace(t *testing.T) {
 	t.Run("ClaimPrebuild", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("dbmem cannot currently claim a workspace")
-		}
-
 		client, db, user := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: coderdtest.DeploymentValues(t),
@@ -845,10 +841,6 @@ func TestWorkspaceAutobuild(t *testing.T) {
 	t.Run("NoDeadlock", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skipf("Skipping non-postgres run")
-		}
-
 		var (
 			ticker      = make(chan time.Time)
 			statCh      = make(chan autobuild.Stats)
@@ -1654,10 +1646,6 @@ func TestWorkspaceAutobuild(t *testing.T) {
 	t.Run("NextStartAtIsNullifiedOnScheduleChange", func(t *testing.T) {
 		t.Parallel()
 
-		if !dbtestutil.WillUsePostgres() {
-			t.Skip("this test uses triggers so does not work with dbmem.go")
-		}
-
 		var (
 			tickCh  = make(chan time.Time)
 			statsCh = make(chan autobuild.Stats)
@@ -1781,10 +1769,6 @@ func TestTemplateDoesNotAllowUserAutostop(t *testing.T) {
 func TestPrebuildsAutobuild(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("this test requires postgres")
-	}
-
 	getRunningPrebuilds := func(
 		t *testing.T,
 		ctx context.Context,
diff --git a/enterprise/tailnet/handshaker_test.go b/enterprise/tailnet/handshaker_test.go
index 523f20ea122da..dbb05418e3827 100644
--- a/enterprise/tailnet/handshaker_test.go
+++ b/enterprise/tailnet/handshaker_test.go
@@ -14,9 +14,7 @@ import (
 
 func TestPGCoordinator_ReadyForHandshake_OK(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -30,9 +28,7 @@ func TestPGCoordinator_ReadyForHandshake_OK(t *testing.T) {
 
 func TestPGCoordinator_ReadyForHandshake_NoPermission(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
diff --git a/enterprise/tailnet/multiagent_test.go b/enterprise/tailnet/multiagent_test.go
index fe3c3eaee04d3..c79f11153a166 100644
--- a/enterprise/tailnet/multiagent_test.go
+++ b/enterprise/tailnet/multiagent_test.go
@@ -23,9 +23,6 @@ import (
 //	            +--------+
 func TestPGCoordinator_MultiAgent(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
@@ -60,9 +57,6 @@ func TestPGCoordinator_MultiAgent(t *testing.T) {
 
 func TestPGCoordinator_MultiAgent_CoordClose(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
@@ -90,9 +84,6 @@ func TestPGCoordinator_MultiAgent_CoordClose(t *testing.T) {
 //	            +--------+
 func TestPGCoordinator_MultiAgent_UnsubscribeRace(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
@@ -135,9 +126,6 @@ func TestPGCoordinator_MultiAgent_UnsubscribeRace(t *testing.T) {
 //	            +--------+
 func TestPGCoordinator_MultiAgent_Unsubscribe(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
@@ -197,9 +185,6 @@ func TestPGCoordinator_MultiAgent_Unsubscribe(t *testing.T) {
 //	            +--------+
 func TestPGCoordinator_MultiAgent_MultiCoordinator(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
@@ -247,9 +232,6 @@ func TestPGCoordinator_MultiAgent_MultiCoordinator(t *testing.T) {
 //	            +--------+
 func TestPGCoordinator_MultiAgent_MultiCoordinator_UpdateBeforeSubscribe(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
@@ -299,9 +281,6 @@ func TestPGCoordinator_MultiAgent_MultiCoordinator_UpdateBeforeSubscribe(t *test
 //	            +--------+
 func TestPGCoordinator_MultiAgent_TwoAgents(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
 
 	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true}).Leveled(slog.LevelDebug)
 	store, ps := dbtestutil.NewDB(t)
diff --git a/enterprise/tailnet/pgcoord_internal_test.go b/enterprise/tailnet/pgcoord_internal_test.go
index dacf61e42acde..88dbe245f062a 100644
--- a/enterprise/tailnet/pgcoord_internal_test.go
+++ b/enterprise/tailnet/pgcoord_internal_test.go
@@ -163,9 +163,7 @@ func TestHeartbeats_LostCoordinator_MarkLost(t *testing.T) {
 // that is, clean up peers and associated tunnels that have been lost for over 24 hours.
 func TestLostPeerCleanupQueries(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, _, sqlDB := dbtestutil.NewDBWithSQLDB(t, dbtestutil.WithDumpOnFailure())
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 	defer cancel()
@@ -326,9 +324,7 @@ func TestDebugTemplate(t *testing.T) {
 
 func TestGetDebug(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, _ := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 	defer cancel()
diff --git a/enterprise/tailnet/pgcoord_test.go b/enterprise/tailnet/pgcoord_test.go
index 7923ffdb81519..eee64f75f4ea3 100644
--- a/enterprise/tailnet/pgcoord_test.go
+++ b/enterprise/tailnet/pgcoord_test.go
@@ -36,9 +36,7 @@ func TestMain(m *testing.M) {
 
 func TestPGCoordinatorSingle_ClientWithoutAgent(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -71,9 +69,7 @@ func TestPGCoordinatorSingle_ClientWithoutAgent(t *testing.T) {
 
 func TestPGCoordinatorSingle_AgentWithoutClients(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -105,9 +101,7 @@ func TestPGCoordinatorSingle_AgentWithoutClients(t *testing.T) {
 
 func TestPGCoordinatorSingle_AgentInvalidIP(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -132,9 +126,7 @@ func TestPGCoordinatorSingle_AgentInvalidIP(t *testing.T) {
 
 func TestPGCoordinatorSingle_AgentInvalidIPBits(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -160,9 +152,7 @@ func TestPGCoordinatorSingle_AgentInvalidIPBits(t *testing.T) {
 
 func TestPGCoordinatorSingle_AgentValidIP(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -199,9 +189,7 @@ func TestPGCoordinatorSingle_AgentValidIP(t *testing.T) {
 
 func TestPGCoordinatorSingle_AgentWithClient(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -248,9 +236,7 @@ func TestPGCoordinatorSingle_AgentWithClient(t *testing.T) {
 
 func TestPGCoordinatorSingle_MissedHeartbeats(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
 	defer cancel()
@@ -333,9 +319,7 @@ func TestPGCoordinatorSingle_MissedHeartbeats(t *testing.T) {
 
 func TestPGCoordinatorSingle_MissedHeartbeats_NoDrop(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -379,9 +363,7 @@ func TestPGCoordinatorSingle_MissedHeartbeats_NoDrop(t *testing.T) {
 
 func TestPGCoordinatorSingle_SendsHeartbeats(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -429,9 +411,7 @@ func TestPGCoordinatorSingle_SendsHeartbeats(t *testing.T) {
 //	            +---------+
 func TestPGCoordinatorDual_Mainline(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -527,9 +507,7 @@ func TestPGCoordinatorDual_Mainline(t *testing.T) {
 //	            +---------+
 func TestPGCoordinator_MultiCoordinatorAgent(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -695,9 +673,7 @@ func TestPGCoordinator_Node_Empty(t *testing.T) {
 // do this now, but it's schematically possible, so we should make sure it doesn't break anything.
 func TestPGCoordinator_BidirectionalTunnels(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -710,9 +686,7 @@ func TestPGCoordinator_BidirectionalTunnels(t *testing.T) {
 
 func TestPGCoordinator_GracefulDisconnect(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -725,9 +699,7 @@ func TestPGCoordinator_GracefulDisconnect(t *testing.T) {
 
 func TestPGCoordinator_Lost(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -740,9 +712,7 @@ func TestPGCoordinator_Lost(t *testing.T) {
 
 func TestPGCoordinator_NoDeleteOnClose(t *testing.T) {
 	t.Parallel()
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
+
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -795,10 +765,6 @@ func TestPGCoordinator_NoDeleteOnClose(t *testing.T) {
 func TestPGCoordinatorDual_FailedHeartbeat(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
-
 	dburl, err := dbtestutil.Open(t)
 	require.NoError(t, err)
 
@@ -861,10 +827,6 @@ func TestPGCoordinatorDual_FailedHeartbeat(t *testing.T) {
 func TestPGCoordinatorDual_PeerReconnect(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
-
 	store, ps := dbtestutil.NewDB(t)
 	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitSuperLong)
 	defer cancel()
@@ -918,10 +880,6 @@ func TestPGCoordinatorDual_PeerReconnect(t *testing.T) {
 func TestPGCoordinatorPropogatedPeerContext(t *testing.T) {
 	t.Parallel()
 
-	if !dbtestutil.WillUsePostgres() {
-		t.Skip("test only with postgres")
-	}
-
 	ctx := testutil.Context(t, testutil.WaitMedium)
 	store, ps := dbtestutil.NewDB(t)
 	logger := testutil.Logger(t)

From 0f342ecc042ca759513dc2947b2a51b304cd4043 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Thu, 23 Oct 2025 16:49:09 +0400
Subject: [PATCH 214/298] feat: add provisioner tags to dynamic-parameters
 scaletest (#20435)

Since `coder exp scaletest dynamic-parameters` ends up creating template versions, provisioner tags may be required to create the template versions.

On our own scaletest clusters, we tag every provisioner, so an untagged template version won't build and won't get imported.
---
 cli/exp_scaletest_dynamicparameters.go        | 13 +++++-
 scaletest/dynamicparameters/template.go       | 42 ++++++++++---------
 .../template_internal_test.go                 | 18 ++++----
 3 files changed, 46 insertions(+), 27 deletions(-)

diff --git a/cli/exp_scaletest_dynamicparameters.go b/cli/exp_scaletest_dynamicparameters.go
index 3c6922a8d4dd6..31b6766ac6acf 100644
--- a/cli/exp_scaletest_dynamicparameters.go
+++ b/cli/exp_scaletest_dynamicparameters.go
@@ -27,6 +27,7 @@ const (
 func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 	var (
 		templateName    string
+		provisionerTags []string
 		numEvals        int64
 		tracingFlags    = &scaletestTracingFlags{}
 		prometheusFlags = &scaletestPrometheusFlags{}
@@ -56,6 +57,11 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 				return xerrors.Errorf("template cannot be empty")
 			}
 
+			tags, err := ParseProvisionerTags(provisionerTags)
+			if err != nil {
+				return err
+			}
+
 			org, err := orgContext.Selected(inv, client)
 			if err != nil {
 				return err
@@ -99,7 +105,7 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 			}()
 			tracer := tracerProvider.Tracer(scaletestTracerName)
 
-			partitions, err := dynamicparameters.SetupPartitions(ctx, client, org.ID, templateName, numEvals, logger)
+			partitions, err := dynamicparameters.SetupPartitions(ctx, client, org.ID, templateName, tags, numEvals, logger)
 			if err != nil {
 				return xerrors.Errorf("setup dynamic parameters partitions: %w", err)
 			}
@@ -160,6 +166,11 @@ func (r *RootCmd) scaletestDynamicParameters() *serpent.Command {
 			Default:     "100",
 			Value:       serpent.Int64Of(&numEvals),
 		},
+		{
+			Flag:        "provisioner-tag",
+			Description: "Specify a set of tags to target provisioner daemons.",
+			Value:       serpent.StringArrayOf(&provisionerTags),
+		},
 	}
 	orgContext.AttachOptions(cmd)
 	output.attach(&cmd.Options)
diff --git a/scaletest/dynamicparameters/template.go b/scaletest/dynamicparameters/template.go
index 9e7d8bc97f867..5faf67e531320 100644
--- a/scaletest/dynamicparameters/template.go
+++ b/scaletest/dynamicparameters/template.go
@@ -168,12 +168,13 @@ type SDKForDynamicParametersSetup interface {
 // partitioner is an internal struct to hold context and arguments for partition setup
 // and to provide methods for all sub-steps.
 type partitioner struct {
-	ctx          context.Context
-	client       SDKForDynamicParametersSetup
-	orgID        uuid.UUID
-	templateName string
-	numEvals     int64
-	logger       slog.Logger
+	ctx             context.Context
+	client          SDKForDynamicParametersSetup
+	orgID           uuid.UUID
+	templateName    string
+	provisionerTags map[string]string
+	numEvals        int64
+	logger          slog.Logger
 
 	// for testing
 	clock quartz.Clock
@@ -181,17 +182,19 @@ type partitioner struct {
 
 func SetupPartitions(
 	ctx context.Context, client SDKForDynamicParametersSetup,
-	orgID uuid.UUID, templateName string, numEvals int64,
+	orgID uuid.UUID, templateName string, provisionerTags map[string]string,
+	numEvals int64,
 	logger slog.Logger,
 ) ([]Partition, error) {
 	p := &partitioner{
-		ctx:          ctx,
-		client:       client,
-		orgID:        orgID,
-		templateName: templateName,
-		numEvals:     numEvals,
-		logger:       logger,
-		clock:        quartz.NewReal(),
+		ctx:             ctx,
+		client:          client,
+		orgID:           orgID,
+		templateName:    templateName,
+		provisionerTags: provisionerTags,
+		numEvals:        numEvals,
+		logger:          logger,
+		clock:           quartz.NewReal(),
 	}
 	return p.run()
 }
@@ -272,11 +275,12 @@ func (p *partitioner) createTemplateVersion(templateID uuid.UUID) (codersdk.Temp
 
 	// Create template version
 	versionReq := codersdk.CreateTemplateVersionRequest{
-		TemplateID:    templateID,
-		FileID:        uploadResp.ID,
-		Message:       "Initial version for scaletest dynamic parameters",
-		StorageMethod: codersdk.ProvisionerStorageMethodFile,
-		Provisioner:   codersdk.ProvisionerTypeTerraform,
+		TemplateID:      templateID,
+		FileID:          uploadResp.ID,
+		Message:         "Initial version for scaletest dynamic parameters",
+		StorageMethod:   codersdk.ProvisionerStorageMethodFile,
+		Provisioner:     codersdk.ProvisionerTypeTerraform,
+		ProvisionerTags: p.provisionerTags,
 	}
 	version, err := p.client.CreateTemplateVersion(p.ctx, p.orgID, versionReq)
 	if err != nil {
diff --git a/scaletest/dynamicparameters/template_internal_test.go b/scaletest/dynamicparameters/template_internal_test.go
index 0b000a4c74981..6b1230eeae75e 100644
--- a/scaletest/dynamicparameters/template_internal_test.go
+++ b/scaletest/dynamicparameters/template_internal_test.go
@@ -70,6 +70,7 @@ func TestSetupPartitions_TemplateExists(t *testing.T) {
 		t:                        t,
 		expectedTemplateName:     "test-template",
 		expectedOrgID:            orgID,
+		expectedTags:             map[string]string{"foo": "bar"},
 		matchedProvisioners:      1,
 		templateVersionJobStatus: codersdk.ProvisionerJobSucceeded,
 	}
@@ -77,13 +78,14 @@ func TestSetupPartitions_TemplateExists(t *testing.T) {
 	trap := mClock.Trap().TickerFunc("waitForTemplateVersionJobs")
 	defer trap.Close()
 	uut := partitioner{
-		ctx:          ctx,
-		client:       fClient,
-		orgID:        orgID,
-		templateName: "test-template",
-		numEvals:     600,
-		logger:       logger,
-		clock:        mClock,
+		ctx:             ctx,
+		client:          fClient,
+		orgID:           orgID,
+		templateName:    "test-template",
+		provisionerTags: map[string]string{"foo": "bar"},
+		numEvals:        600,
+		logger:          logger,
+		clock:           mClock,
 	}
 	var partitions []Partition
 	errCh := make(chan error, 1)
@@ -234,6 +236,7 @@ type fakeClient struct {
 	expectedOrgID        uuid.UUID
 	templateByNameError  error
 
+	expectedTags             map[string]string
 	matchedProvisioners      int
 	templateVersionJobStatus codersdk.ProvisionerJobStatus
 
@@ -270,6 +273,7 @@ func (f *fakeClient) CreateTemplate(ctx context.Context, orgID uuid.UUID, create
 
 func (f *fakeClient) CreateTemplateVersion(ctx context.Context, orgID uuid.UUID, createReq codersdk.CreateTemplateVersionRequest) (codersdk.TemplateVersion, error) {
 	f.templateVersionsCount++
+	require.Equal(f.t, f.expectedTags, createReq.ProvisionerTags)
 	return codersdk.TemplateVersion{
 		ID:                  uuid.New(),
 		Name:                f.expectedTemplateName,

From 5c802c26279e5e2e03652695ae95b7f341e6fede Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 19:12:09 +0300
Subject: [PATCH 215/298] feat(coderd): use task data model when creating a new
 task (#20275)

Updates coder/internal#976
---
 cli/exp_task_delete_test.go               |   2 +
 cli/exp_task_list.go                      |   4 +-
 cli/exp_task_list_test.go                 |   2 +
 cli/exp_task_logs_test.go                 |   2 +
 cli/exp_task_send_test.go                 |   2 +
 cli/exp_task_status.go                    |   4 +-
 cli/exp_task_status_test.go               |  48 ++---
 cli/exp_task_test.go                      |   2 +
 coderd/aitasks.go                         | 213 ++++++++++++++++----
 coderd/aitasks_test.go                    | 233 +++++++++++++++++++++-
 coderd/apidoc/docs.go                     |  58 +++++-
 coderd/apidoc/swagger.json                |  58 +++++-
 coderd/database/dbauthz/dbauthz.go        |  24 +++
 coderd/database/dbauthz/dbauthz_test.go   |  14 ++
 coderd/database/dbmetrics/querymetrics.go |   7 +
 coderd/database/dbmock/dbmock.go          |  15 ++
 coderd/database/querier.go                |   1 +
 coderd/database/querier_test.go           | 184 +++++++++++++++++
 coderd/database/queries.sql.go            |  43 ++++
 coderd/database/queries/tasks.sql         |  19 ++
 coderd/workspaces.go                      |  37 +++-
 codersdk/aitasks.go                       |  30 ++-
 codersdk/toolsdk/toolsdk.go               |  10 +-
 codersdk/toolsdk/toolsdk_test.go          |  31 ++-
 docs/reference/api/schemas.md             |  61 ++++--
 site/src/api/typesGenerated.ts            |  22 +-
 site/src/testHelpers/entities.ts          |   4 +-
 27 files changed, 1006 insertions(+), 124 deletions(-)

diff --git a/cli/exp_task_delete_test.go b/cli/exp_task_delete_test.go
index 0b288c4ca3379..d41899067e5e2 100644
--- a/cli/exp_task_delete_test.go
+++ b/cli/exp_task_delete_test.go
@@ -22,6 +22,8 @@ import (
 func TestExpTaskDelete(t *testing.T) {
 	t.Parallel()
 
+	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 	type testCounters struct {
 		deleteCalls  atomic.Int64
 		nameResolves atomic.Int64
diff --git a/cli/exp_task_list.go b/cli/exp_task_list.go
index e4d558e35d611..442718814b0c5 100644
--- a/cli/exp_task_list.go
+++ b/cli/exp_task_list.go
@@ -142,8 +142,8 @@ func (r *RootCmd) taskList() *serpent.Command {
 			}
 
 			tasks, err := exp.Tasks(ctx, &codersdk.TasksFilter{
-				Owner:  targetUser,
-				Status: statusFilter,
+				Owner:           targetUser,
+				WorkspaceStatus: statusFilter,
 			})
 			if err != nil {
 				return xerrors.Errorf("list tasks: %w", err)
diff --git a/cli/exp_task_list_test.go b/cli/exp_task_list_test.go
index 2761588a3859e..f8f20eacaf264 100644
--- a/cli/exp_task_list_test.go
+++ b/cli/exp_task_list_test.go
@@ -97,6 +97,8 @@ func makeAITask(t *testing.T, db database.Store, orgID, adminID, ownerID uuid.UU
 func TestExpTaskList(t *testing.T) {
 	t.Parallel()
 
+	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 	t.Run("NoTasks_Table", func(t *testing.T) {
 		t.Parallel()
 
diff --git a/cli/exp_task_logs_test.go b/cli/exp_task_logs_test.go
index 69905aa434af0..3bf8fb91e72d9 100644
--- a/cli/exp_task_logs_test.go
+++ b/cli/exp_task_logs_test.go
@@ -23,6 +23,8 @@ import (
 func Test_TaskLogs(t *testing.T) {
 	t.Parallel()
 
+	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 	testMessages := []agentapisdk.Message{
 		{
 			Id:      0,
diff --git a/cli/exp_task_send_test.go b/cli/exp_task_send_test.go
index cb8ee74d06398..26d62ba5f6903 100644
--- a/cli/exp_task_send_test.go
+++ b/cli/exp_task_send_test.go
@@ -22,6 +22,8 @@ import (
 func Test_TaskSend(t *testing.T) {
 	t.Parallel()
 
+	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 	t.Run("ByWorkspaceName_WithArgument", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
diff --git a/cli/exp_task_status.go b/cli/exp_task_status.go
index a43fd4feedfe2..336efc1a999f6 100644
--- a/cli/exp_task_status.go
+++ b/cli/exp_task_status.go
@@ -152,7 +152,7 @@ func (r *RootCmd) taskStatus() *serpent.Command {
 }
 
 func taskWatchIsEnded(task codersdk.Task) bool {
-	if task.Status == codersdk.WorkspaceStatusStopped {
+	if task.WorkspaceStatus == codersdk.WorkspaceStatusStopped {
 		return true
 	}
 	if task.WorkspaceAgentHealth == nil || !task.WorkspaceAgentHealth.Healthy {
@@ -189,7 +189,7 @@ func toStatusRow(task codersdk.Task) taskStatusRow {
 		Task:       task,
 		ChangedAgo: time.Since(task.UpdatedAt).Truncate(time.Second).String() + " ago",
 		Timestamp:  task.UpdatedAt,
-		TaskStatus: string(task.Status),
+		TaskStatus: string(task.WorkspaceStatus),
 	}
 	tsr.Healthy = task.WorkspaceAgentHealth != nil &&
 		task.WorkspaceAgentHealth.Healthy &&
diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index 1e255c05b95bc..2ae31ad33c558 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -24,6 +24,8 @@ import (
 func Test_TaskStatus(t *testing.T) {
 	t.Parallel()
 
+	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 	for _, tc := range []struct {
 		args         []string
 		expectOutput string
@@ -75,10 +77,10 @@ func Test_TaskStatus(t *testing.T) {
 						})
 					case "/api/experimental/tasks/me/11111111-1111-1111-1111-111111111111":
 						httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
-							ID:        uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-							Status:    codersdk.WorkspaceStatusRunning,
-							CreatedAt: now,
-							UpdatedAt: now,
+							ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+							WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+							CreatedAt:       now,
+							UpdatedAt:       now,
 							CurrentState: &codersdk.TaskStateEntry{
 								State:     codersdk.TaskStateWorking,
 								Timestamp: now,
@@ -115,10 +117,10 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 						switch calls.Load() {
 						case 0:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
-								ID:        uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-								Status:    codersdk.WorkspaceStatusPending,
-								CreatedAt: now.Add(-5 * time.Second),
-								UpdatedAt: now.Add(-5 * time.Second),
+								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+								WorkspaceStatus: codersdk.WorkspaceStatusPending,
+								CreatedAt:       now.Add(-5 * time.Second),
+								UpdatedAt:       now.Add(-5 * time.Second),
 								WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
 									Healthy: true,
 								},
@@ -126,9 +128,9 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 							})
 						case 1:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
-								ID:        uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-								Status:    codersdk.WorkspaceStatusRunning,
-								CreatedAt: now.Add(-5 * time.Second),
+								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+								WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+								CreatedAt:       now.Add(-5 * time.Second),
 								WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
 									Healthy: true,
 								},
@@ -137,10 +139,10 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 							})
 						case 2:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
-								ID:        uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-								Status:    codersdk.WorkspaceStatusRunning,
-								CreatedAt: now.Add(-5 * time.Second),
-								UpdatedAt: now.Add(-4 * time.Second),
+								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+								WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+								CreatedAt:       now.Add(-5 * time.Second),
+								UpdatedAt:       now.Add(-4 * time.Second),
 								WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
 									Healthy: true,
 								},
@@ -153,10 +155,10 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 							})
 						case 3:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
-								ID:        uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-								Status:    codersdk.WorkspaceStatusRunning,
-								CreatedAt: now.Add(-5 * time.Second),
-								UpdatedAt: now.Add(-4 * time.Second),
+								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+								WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+								CreatedAt:       now.Add(-5 * time.Second),
+								UpdatedAt:       now.Add(-4 * time.Second),
 								WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
 									Healthy: true,
 								},
@@ -215,10 +217,10 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 						})
 					case "/api/experimental/tasks/me/11111111-1111-1111-1111-111111111111":
 						httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
-							ID:        uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-							Status:    codersdk.WorkspaceStatusRunning,
-							CreatedAt: ts,
-							UpdatedAt: ts,
+							ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+							WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+							CreatedAt:       ts,
+							UpdatedAt:       ts,
 							CurrentState: &codersdk.TaskStateEntry{
 								State:     codersdk.TaskStateWorking,
 								Timestamp: ts.Add(time.Second),
diff --git a/cli/exp_task_test.go b/cli/exp_task_test.go
index b8b70516ffc9a..55ee458fb252d 100644
--- a/cli/exp_task_test.go
+++ b/cli/exp_task_test.go
@@ -36,6 +36,8 @@ import (
 func Test_Tasks(t *testing.T) {
 	t.Parallel()
 
+	t.Skip("TODO(mafredri): Remove, fixed up-stack!")
+
 	// Given: a template configured for tasks
 	var (
 		ctx           = testutil.Context(t, testutil.WaitLong)
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 95ad8008e88ca..4fd49d73eeeca 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -3,7 +3,6 @@ package coderd
 import (
 	"context"
 	"database/sql"
-	"errors"
 	"fmt"
 	"net"
 	"net/http"
@@ -18,6 +17,7 @@ import (
 	"cdr.dev/slog"
 	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpapi/httperror"
 	"github.com/coder/coder/v2/coderd/httpmw"
@@ -96,31 +96,54 @@ func (api *API) aiTasksPrompts(rw http.ResponseWriter, r *http.Request) {
 // This endpoint creates a new task for the given user.
 func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 	var (
-		ctx     = r.Context()
-		apiKey  = httpmw.APIKey(r)
-		auditor = api.Auditor.Load()
-		mems    = httpmw.OrganizationMembersParam(r)
+		ctx              = r.Context()
+		apiKey           = httpmw.APIKey(r)
+		auditor          = api.Auditor.Load()
+		mems             = httpmw.OrganizationMembersParam(r)
+		taskResourceInfo = audit.AdditionalFields{}
 	)
 
+	if mems.User != nil {
+		taskResourceInfo.WorkspaceOwner = mems.User.Username
+	}
+
+	aReq, commitAudit := audit.InitRequest[database.TaskTable](rw, &audit.RequestParams{
+		Audit:            *auditor,
+		Log:              api.Logger,
+		Request:          r,
+		Action:           database.AuditActionCreate,
+		AdditionalFields: taskResourceInfo,
+	})
+
+	defer commitAudit()
+
 	var req codersdk.CreateTaskRequest
 	if !httpapi.Read(ctx, rw, r, &req) {
 		return
 	}
 
-	hasAITask, err := api.Database.GetTemplateVersionHasAITask(ctx, req.TemplateVersionID)
+	// Fetch the template version to verify access and whether or not it has an
+	// AI task.
+	templateVersion, err := api.Database.GetTemplateVersionByID(ctx, req.TemplateVersionID)
 	if err != nil {
-		if errors.Is(err, sql.ErrNoRows) || rbac.IsUnauthorizedError(err) {
-			httpapi.ResourceNotFound(rw)
+		if httpapi.Is404Error(err) {
+			// Avoid using httpapi.ResourceNotFound() here because this is an
+			// input error and 404 would be confusing.
+			httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+				Message: "Template version not found or you do not have access to this resource",
+			})
 			return
 		}
-
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching whether the template version has an AI task.",
+			Message: "Internal error fetching template version.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	if !hasAITask {
+
+	aReq.UpdateOrganizationID(templateVersion.OrganizationID)
+
+	if !templateVersion.HasAITask.Valid || !templateVersion.HasAITask.Bool {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
 			Message: fmt.Sprintf(`Template does not have required parameter %q`, codersdk.AITaskPromptParameterName),
 		})
@@ -177,23 +200,12 @@ func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 	} else {
 		// A task can still be created if the caller can read the organization
 		// member. The organization is required, which can be sourced from the
-		// template.
+		// templateVersion.
 		//
-		// TODO: This code gets called twice for each workspace build request.
-		//   This is inefficient and costs at most 2 extra RTTs to the DB.
-		//   This can be optimized. It exists as it is now for code simplicity.
-		//   The most common case is to create a workspace for 'Me'. Which does
-		//   not enter this code branch.
-		template, err := requestTemplate(ctx, createReq, api.Database)
-		if err != nil {
-			httperror.WriteResponseError(ctx, rw, err)
-			return
-		}
-
 		// If the caller can find the organization membership in the same org
 		// as the template, then they can continue.
 		orgIndex := slices.IndexFunc(mems.Memberships, func(mem httpmw.OrganizationMember) bool {
-			return mem.OrganizationID == template.OrganizationID
+			return mem.OrganizationID == templateVersion.OrganizationID
 		})
 		if orgIndex == -1 {
 			httpapi.ResourceNotFound(rw)
@@ -206,26 +218,148 @@ func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 			Username:  member.Username,
 			AvatarURL: member.AvatarURL,
 		}
+
+		// Update workspace owner information for audit in case it changed.
+		taskResourceInfo.WorkspaceOwner = owner.Username
 	}
 
-	aReq, commitAudit := audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{
-		Audit:   *auditor,
-		Log:     api.Logger,
-		Request: r,
-		Action:  database.AuditActionCreate,
-		AdditionalFields: audit.AdditionalFields{
-			WorkspaceOwner: owner.Username,
+	// Track insert from preCreateInTX.
+	var dbTaskTable database.TaskTable
+
+	// Ensure an audit log is created for the workspace creation event.
+	aReqWS, commitAuditWS := audit.InitRequest[database.WorkspaceTable](rw, &audit.RequestParams{
+		Audit:            *auditor,
+		Log:              api.Logger,
+		Request:          r,
+		Action:           database.AuditActionCreate,
+		AdditionalFields: taskResourceInfo,
+		OrganizationID:   templateVersion.OrganizationID,
+	})
+	defer commitAuditWS()
+
+	workspace, err := createWorkspace(ctx, aReqWS, apiKey.UserID, api, owner, createReq, r, &createWorkspaceOptions{
+		// Before creating the workspace, ensure that this task can be created.
+		preCreateInTX: func(ctx context.Context, tx database.Store) error {
+			// Create task record in the database before creating the workspace so that
+			// we can request that the workspace be linked to it after creation.
+			dbTaskTable, err = tx.InsertTask(ctx, database.InsertTaskParams{
+				OrganizationID:     templateVersion.OrganizationID,
+				OwnerID:            owner.ID,
+				Name:               taskName,
+				WorkspaceID:        uuid.NullUUID{}, // Will be set after workspace creation.
+				TemplateVersionID:  templateVersion.ID,
+				TemplateParameters: []byte("{}"),
+				Prompt:             req.Input,
+				CreatedAt:          dbtime.Time(api.Clock.Now()),
+			})
+			if err != nil {
+				return httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{
+					Message: "Internal error creating task.",
+					Detail:  err.Error(),
+				})
+			}
+			return nil
+		},
+		// After the workspace is created, ensure that the task is linked to it.
+		postCreateInTX: func(ctx context.Context, tx database.Store, workspace database.Workspace) error {
+			// Update the task record with the workspace ID after creation.
+			dbTaskTable, err = tx.UpdateTaskWorkspaceID(ctx, database.UpdateTaskWorkspaceIDParams{
+				ID: dbTaskTable.ID,
+				WorkspaceID: uuid.NullUUID{
+					UUID:  workspace.ID,
+					Valid: true,
+				},
+			})
+			if err != nil {
+				return httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{
+					Message: "Internal error updating task.",
+					Detail:  err.Error(),
+				})
+			}
+			return nil
 		},
 	})
-	defer commitAudit()
-	w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, createReq, r)
 	if err != nil {
 		httperror.WriteResponseError(ctx, rw, err)
 		return
 	}
 
-	task := taskFromWorkspace(w, req.Input)
-	httpapi.Write(ctx, rw, http.StatusCreated, task)
+	aReq.New = dbTaskTable
+
+	// Fetch the task to get the additional columns from the view.
+	dbTask, err := api.Database.GetTaskByID(ctx, dbTaskTable.ID)
+	if err != nil {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching task.",
+			Detail:  err.Error(),
+		})
+		return
+	}
+
+	httpapi.Write(ctx, rw, http.StatusCreated, taskFromDBTaskAndWorkspace(dbTask, workspace))
+}
+
+// taskFromDBTaskAndWorkspace creates a codersdk.Task response from the task
+// database record and workspace.
+func taskFromDBTaskAndWorkspace(dbTask database.Task, ws codersdk.Workspace) codersdk.Task {
+	var taskAgentLifecycle *codersdk.WorkspaceAgentLifecycle
+	var taskAgentHealth *codersdk.WorkspaceAgentHealth
+
+	// If we have an agent ID from the task, find the agent details in the
+	// workspace.
+	if dbTask.WorkspaceAgentID.Valid {
+	findTaskAgentLoop:
+		for _, resource := range ws.LatestBuild.Resources {
+			for _, agent := range resource.Agents {
+				if agent.ID == dbTask.WorkspaceAgentID.UUID {
+					taskAgentLifecycle = &agent.LifecycleState
+					taskAgentHealth = &agent.Health
+					break findTaskAgentLoop
+				}
+			}
+		}
+	}
+
+	// Ignore 'latest app status' if it is older than the latest build and the
+	// latest build is a 'start' transition. This ensures that you don't show a
+	// stale app status from a previous build. For stop transitions, there is
+	// still value in showing the latest app status.
+	var currentState *codersdk.TaskStateEntry
+	if ws.LatestAppStatus != nil {
+		if ws.LatestBuild.Transition != codersdk.WorkspaceTransitionStart || ws.LatestAppStatus.CreatedAt.After(ws.LatestBuild.CreatedAt) {
+			currentState = &codersdk.TaskStateEntry{
+				Timestamp: ws.LatestAppStatus.CreatedAt,
+				State:     codersdk.TaskState(ws.LatestAppStatus.State),
+				Message:   ws.LatestAppStatus.Message,
+				URI:       ws.LatestAppStatus.URI,
+			}
+		}
+	}
+
+	return codersdk.Task{
+		ID:                      dbTask.ID,
+		OrganizationID:          dbTask.OrganizationID,
+		OwnerID:                 dbTask.OwnerID,
+		OwnerName:               ws.OwnerName,
+		Name:                    dbTask.Name,
+		TemplateID:              ws.TemplateID,
+		TemplateVersionID:       dbTask.TemplateVersionID,
+		TemplateName:            ws.TemplateName,
+		TemplateDisplayName:     ws.TemplateDisplayName,
+		TemplateIcon:            ws.TemplateIcon,
+		WorkspaceID:             dbTask.WorkspaceID,
+		WorkspaceBuildNumber:    dbTask.WorkspaceBuildNumber.Int32,
+		WorkspaceStatus:         ws.LatestBuild.Status,
+		WorkspaceAgentID:        dbTask.WorkspaceAgentID,
+		WorkspaceAgentLifecycle: taskAgentLifecycle,
+		WorkspaceAgentHealth:    taskAgentHealth,
+		WorkspaceAppID:          dbTask.WorkspaceAppID,
+		InitialPrompt:           dbTask.Prompt,
+		Status:                  codersdk.TaskStatus(dbTask.Status),
+		CurrentState:            currentState,
+		CreatedAt:               dbTask.CreatedAt,
+		UpdatedAt:               ws.UpdatedAt,
+	}
 }
 
 func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Task {
@@ -253,9 +387,10 @@ func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Tas
 		}
 	}
 
-	// Ignore 'latest app status' if it is older than the latest build and the latest build is a 'start' transition.
-	// This ensures that you don't show a stale app status from a previous build.
-	// For stop transitions, there is still value in showing the latest app status.
+	// Ignore 'latest app status' if it is older than the latest build and the
+	// latest build is a 'start' transition. This ensures that you don't show a
+	// stale app status from a previous build. For stop transitions, there is
+	// still value in showing the latest app status.
 	var currentState *codersdk.TaskStateEntry
 	if ws.LatestAppStatus != nil {
 		if ws.LatestBuild.Transition != codersdk.WorkspaceTransitionStart || ws.LatestAppStatus.CreatedAt.After(ws.LatestBuild.CreatedAt) {
@@ -295,7 +430,7 @@ func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Tas
 		CreatedAt:               ws.CreatedAt,
 		UpdatedAt:               ws.UpdatedAt,
 		InitialPrompt:           initialPrompt,
-		Status:                  ws.LatestBuild.Status,
+		WorkspaceStatus:         ws.LatestBuild.Status,
 		CurrentState:            currentState,
 	}
 }
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 895936a76085d..d0ff421c5237a 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -240,6 +240,8 @@ func TestTasks(t *testing.T) {
 	t.Run("List", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		ctx := testutil.Context(t, testutil.WaitLong)
@@ -266,12 +268,14 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, workspace.Name, got.Name, "task name should map from workspace name")
 		assert.Equal(t, workspace.ID, got.WorkspaceID.UUID, "workspace id should match")
 		// Status should be populated via app status or workspace status mapping.
-		assert.NotEmpty(t, got.Status, "task status should not be empty")
+		assert.NotEmpty(t, got.WorkspaceStatus, "task status should not be empty")
 	})
 
 	t.Run("Get", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		var (
 			client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			ctx        = testutil.Context(t, testutil.WaitLong)
@@ -315,7 +319,7 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, workspace.Name, task.Name, "task name should map from workspace name")
 		assert.Equal(t, wantPrompt, task.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, workspace.ID, task.WorkspaceID.UUID, "workspace id should match")
-		assert.NotEmpty(t, task.Status, "task status should not be empty")
+		assert.NotEmpty(t, task.WorkspaceStatus, "task status should not be empty")
 
 		// Stop the workspace
 		coderdtest.MustTransitionWorkspace(t, client, workspace.ID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionStop)
@@ -339,6 +343,8 @@ func TestTasks(t *testing.T) {
 	t.Run("Delete", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		t.Run("OK", func(t *testing.T) {
 			t.Parallel()
 
@@ -354,7 +360,8 @@ func TestTasks(t *testing.T) {
 				Input:             "delete me",
 			})
 			require.NoError(t, err)
-			ws, err := client.Workspace(ctx, task.ID)
+			require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
+			ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
 			require.NoError(t, err)
 			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
@@ -363,7 +370,7 @@ func TestTasks(t *testing.T) {
 
 			// Poll until the workspace is deleted.
 			for {
-				dws, derr := client.DeletedWorkspace(ctx, task.ID)
+				dws, derr := client.DeletedWorkspace(ctx, task.WorkspaceID.UUID)
 				if derr == nil && dws.LatestBuild.Status == codersdk.WorkspaceStatusDeleted {
 					break
 				}
@@ -434,7 +441,8 @@ func TestTasks(t *testing.T) {
 				Input:             "delete me not",
 			})
 			require.NoError(t, err)
-			ws, err := client.Workspace(ctx, task.ID)
+			require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
+			ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
 			require.NoError(t, err)
 			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
@@ -458,6 +466,8 @@ func TestTasks(t *testing.T) {
 	t.Run("Send", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		t.Run("IntegrationOK", func(t *testing.T) {
 			t.Parallel()
 
@@ -645,6 +655,8 @@ func TestTasks(t *testing.T) {
 	t.Run("Logs", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		t.Run("OK", func(t *testing.T) {
 			t.Parallel()
 
@@ -791,7 +803,7 @@ func TestTasksCreate(t *testing.T) {
 			ProvisionApply: echo.ApplyComplete,
 			ProvisionPlan: []*proto.Response{
 				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
-					Parameters: []*proto.RichParameter{{Name: "AI Prompt", Type: "string"}},
+					Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
 					HasAiTasks: true,
 				}}},
 			},
@@ -864,7 +876,7 @@ func TestTasksCreate(t *testing.T) {
 						ProvisionApply: echo.ApplyComplete,
 						ProvisionPlan: []*proto.Response{
 							{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
-								Parameters: []*proto.RichParameter{{Name: "AI Prompt", Type: "string"}},
+								Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
 								HasAiTasks: true,
 							}}},
 						},
@@ -960,7 +972,212 @@ func TestTasksCreate(t *testing.T) {
 		var sdkErr *codersdk.Error
 		require.Error(t, err)
 		require.ErrorAsf(t, err, &sdkErr, "error should be of type *codersdk.Error")
-		assert.Equal(t, http.StatusNotFound, sdkErr.StatusCode())
+		assert.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
+	})
+
+	t.Run("TaskTableCreatedAndLinked", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx        = testutil.Context(t, testutil.WaitShort)
+			taskPrompt = "Create a REST API"
+		)
+
+		client, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+
+		// Create a template with AI task support to test the new task data model.
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan: []*proto.Response{
+				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
+					HasAiTasks: true,
+				}}},
+			},
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		expClient := codersdk.NewExperimentalClient(client)
+
+		task, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             taskPrompt,
+		})
+		require.NoError(t, err)
+		require.True(t, task.WorkspaceID.Valid)
+
+		ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+		require.NoError(t, err)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+
+		// Verify that the task was created in the tasks table with the correct
+		// fields. This ensures the data model properly separates task records
+		// from workspace records.
+		dbCtx := dbauthz.AsSystemRestricted(ctx)
+		dbTask, err := db.GetTaskByID(dbCtx, task.ID)
+		require.NoError(t, err)
+		assert.Equal(t, user.OrganizationID, dbTask.OrganizationID)
+		assert.Equal(t, user.UserID, dbTask.OwnerID)
+		assert.Equal(t, task.Name, dbTask.Name)
+		assert.True(t, dbTask.WorkspaceID.Valid)
+		assert.Equal(t, ws.ID, dbTask.WorkspaceID.UUID)
+		assert.Equal(t, version.ID, dbTask.TemplateVersionID)
+		assert.Equal(t, taskPrompt, dbTask.Prompt)
+		assert.False(t, dbTask.DeletedAt.Valid)
+
+		// Verify the bidirectional relationship works by looking up the task
+		// via workspace ID.
+		dbTaskByWs, err := db.GetTaskByWorkspaceID(dbCtx, ws.ID)
+		require.NoError(t, err)
+		assert.Equal(t, dbTask.ID, dbTaskByWs.ID)
+	})
+
+	t.Run("TaskWithCustomName", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx        = testutil.Context(t, testutil.WaitShort)
+			taskPrompt = "Build a dashboard"
+			taskName   = "my-custom-task"
+		)
+
+		client, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan: []*proto.Response{
+				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
+					HasAiTasks: true,
+				}}},
+			},
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		expClient := codersdk.NewExperimentalClient(client)
+
+		task, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             taskPrompt,
+			Name:              taskName,
+		})
+		require.NoError(t, err)
+		require.Equal(t, taskName, task.Name)
+
+		// Verify the custom name is preserved in the database record.
+		dbCtx := dbauthz.AsSystemRestricted(ctx)
+		dbTask, err := db.GetTaskByID(dbCtx, task.ID)
+		require.NoError(t, err)
+		assert.Equal(t, taskName, dbTask.Name)
+	})
+
+	t.Run("MultipleTasksForSameUser", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		client, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+
+		version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan: []*proto.Response{
+				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
+					HasAiTasks: true,
+				}}},
+			},
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+		expClient := codersdk.NewExperimentalClient(client)
+
+		task1, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             "First task",
+			Name:              "task-1",
+		})
+		require.NoError(t, err)
+
+		task2, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             "Second task",
+			Name:              "task-2",
+		})
+		require.NoError(t, err)
+
+		// Verify both tasks are stored independently and can be listed together.
+		dbCtx := dbauthz.AsSystemRestricted(ctx)
+		tasks, err := db.ListTasks(dbCtx, database.ListTasksParams{
+			OwnerID:        user.UserID,
+			OrganizationID: uuid.Nil,
+		})
+		require.NoError(t, err)
+		require.GreaterOrEqual(t, len(tasks), 2)
+
+		taskIDs := make(map[uuid.UUID]bool)
+		for _, task := range tasks {
+			taskIDs[task.ID] = true
+		}
+		assert.True(t, taskIDs[task1.ID], "task1 should be in the list")
+		assert.True(t, taskIDs[task2.ID], "task2 should be in the list")
+	})
+
+	t.Run("TaskLinkedToCorrectTemplateVersion", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		client, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		user := coderdtest.CreateFirstUser(t, client)
+
+		version1 := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan: []*proto.Response{
+				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
+					HasAiTasks: true,
+				}}},
+			},
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version1.ID)
+		template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version1.ID)
+
+		version2 := coderdtest.UpdateTemplateVersion(t, client, user.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan: []*proto.Response{
+				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Parameters: []*proto.RichParameter{{Name: codersdk.AITaskPromptParameterName, Type: "string"}},
+					HasAiTasks: true,
+				}}},
+			},
+		}, template.ID)
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version2.ID)
+
+		expClient := codersdk.NewExperimentalClient(client)
+
+		// Create a task using version 2 to verify the template_version_id is
+		// stored correctly.
+		task, err := expClient.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: version2.ID,
+			Input:             "Use version 2",
+		})
+		require.NoError(t, err)
+
+		// Verify the task references the correct template version, not just the
+		// active one.
+		dbCtx := dbauthz.AsSystemRestricted(ctx)
+		dbTask, err := db.GetTaskByID(dbCtx, task.ID)
+		require.NoError(t, err)
+		assert.Equal(t, version2.ID, dbTask.TemplateVersionID, "task should be linked to version 2")
 	})
 }
 
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 04c3935d0a26d..e7afae463bb62 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -17768,19 +17768,15 @@ const docTemplate = `{
                 "status": {
                     "enum": [
                         "pending",
-                        "starting",
-                        "running",
-                        "stopping",
-                        "stopped",
-                        "failed",
-                        "canceling",
-                        "canceled",
-                        "deleting",
-                        "deleted"
+                        "initializing",
+                        "active",
+                        "paused",
+                        "unknown",
+                        "error"
                     ],
                     "allOf": [
                         {
-                            "$ref": "#/definitions/codersdk.WorkspaceStatus"
+                            "$ref": "#/definitions/codersdk.TaskStatus"
                         }
                     ]
                 },
@@ -17797,6 +17793,10 @@ const docTemplate = `{
                 "template_name": {
                     "type": "string"
                 },
+                "template_version_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
                 "updated_at": {
                     "type": "string",
                     "format": "date-time"
@@ -17833,6 +17833,25 @@ const docTemplate = `{
                             "$ref": "#/definitions/uuid.NullUUID"
                         }
                     ]
+                },
+                "workspace_status": {
+                    "enum": [
+                        "pending",
+                        "starting",
+                        "running",
+                        "stopping",
+                        "stopped",
+                        "failed",
+                        "canceling",
+                        "canceled",
+                        "deleting",
+                        "deleted"
+                    ],
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/codersdk.WorkspaceStatus"
+                        }
+                    ]
                 }
             }
         },
@@ -17917,6 +17936,25 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.TaskStatus": {
+            "type": "string",
+            "enum": [
+                "pending",
+                "initializing",
+                "active",
+                "paused",
+                "unknown",
+                "error"
+            ],
+            "x-enum-varnames": [
+                "TaskStatusPending",
+                "TaskStatusInitializing",
+                "TaskStatusActive",
+                "TaskStatusPaused",
+                "TaskStatusUnknown",
+                "TaskStatusError"
+            ]
+        },
         "codersdk.TelemetryConfig": {
             "type": "object",
             "properties": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index c1c6fd2d23a66..9c7c217b3d854 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -16256,19 +16256,15 @@
 				"status": {
 					"enum": [
 						"pending",
-						"starting",
-						"running",
-						"stopping",
-						"stopped",
-						"failed",
-						"canceling",
-						"canceled",
-						"deleting",
-						"deleted"
+						"initializing",
+						"active",
+						"paused",
+						"unknown",
+						"error"
 					],
 					"allOf": [
 						{
-							"$ref": "#/definitions/codersdk.WorkspaceStatus"
+							"$ref": "#/definitions/codersdk.TaskStatus"
 						}
 					]
 				},
@@ -16285,6 +16281,10 @@
 				"template_name": {
 					"type": "string"
 				},
+				"template_version_id": {
+					"type": "string",
+					"format": "uuid"
+				},
 				"updated_at": {
 					"type": "string",
 					"format": "date-time"
@@ -16321,6 +16321,25 @@
 							"$ref": "#/definitions/uuid.NullUUID"
 						}
 					]
+				},
+				"workspace_status": {
+					"enum": [
+						"pending",
+						"starting",
+						"running",
+						"stopping",
+						"stopped",
+						"failed",
+						"canceling",
+						"canceled",
+						"deleting",
+						"deleted"
+					],
+					"allOf": [
+						{
+							"$ref": "#/definitions/codersdk.WorkspaceStatus"
+						}
+					]
 				}
 			}
 		},
@@ -16394,6 +16413,25 @@
 				}
 			}
 		},
+		"codersdk.TaskStatus": {
+			"type": "string",
+			"enum": [
+				"pending",
+				"initializing",
+				"active",
+				"paused",
+				"unknown",
+				"error"
+			],
+			"x-enum-varnames": [
+				"TaskStatusPending",
+				"TaskStatusInitializing",
+				"TaskStatusActive",
+				"TaskStatusPaused",
+				"TaskStatusUnknown",
+				"TaskStatusError"
+			]
+		},
 		"codersdk.TelemetryConfig": {
 			"type": "object",
 			"properties": {
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 2025b15376103..110e63f92804c 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -5009,6 +5009,30 @@ func (q *querier) UpdateTailnetPeerStatusByCoordinator(ctx context.Context, arg
 	return q.db.UpdateTailnetPeerStatusByCoordinator(ctx, arg)
 }
 
+func (q *querier) UpdateTaskWorkspaceID(ctx context.Context, arg database.UpdateTaskWorkspaceIDParams) (database.TaskTable, error) {
+	// An actor is allowed to update the workspace ID of a task if they are the
+	// owner of the task and workspace or have the appropriate permissions.
+	task, err := q.db.GetTaskByID(ctx, arg.ID)
+	if err != nil {
+		return database.TaskTable{}, err
+	}
+
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, task.RBACObject()); err != nil {
+		return database.TaskTable{}, err
+	}
+
+	ws, err := q.db.GetWorkspaceByID(ctx, arg.WorkspaceID.UUID)
+	if err != nil {
+		return database.TaskTable{}, err
+	}
+
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, ws.RBACObject()); err != nil {
+		return database.TaskTable{}, err
+	}
+
+	return q.db.UpdateTaskWorkspaceID(ctx, arg)
+}
+
 func (q *querier) UpdateTemplateACLByID(ctx context.Context, arg database.UpdateTemplateACLByIDParams) error {
 	fetch := func(ctx context.Context, arg database.UpdateTemplateACLByIDParams) (database.Template, error) {
 		return q.db.GetTemplateByID(ctx, arg.ID)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 93e26ae51480f..94970e4657c2f 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -2395,6 +2395,20 @@ func (s *MethodTestSuite) TestTasks() {
 
 		check.Args(arg).Asserts(task, policy.ActionUpdate).Returns(database.TaskWorkspaceApp{})
 	}))
+	s.Run("UpdateTaskWorkspaceID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		task := testutil.Fake(s.T(), faker, database.Task{})
+		ws := testutil.Fake(s.T(), faker, database.Workspace{})
+		arg := database.UpdateTaskWorkspaceIDParams{
+			ID:          task.ID,
+			WorkspaceID: uuid.NullUUID{UUID: ws.ID, Valid: true},
+		}
+
+		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
+		dbm.EXPECT().GetWorkspaceByID(gomock.Any(), ws.ID).Return(ws, nil).AnyTimes()
+		dbm.EXPECT().UpdateTaskWorkspaceID(gomock.Any(), arg).Return(database.TaskTable{}, nil).AnyTimes()
+
+		check.Args(arg).Asserts(task, policy.ActionUpdate, ws, policy.ActionUpdate).Returns(database.TaskTable{})
+	}))
 	s.Run("GetTaskByWorkspaceID", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		task := testutil.Fake(s.T(), faker, database.Task{})
 		task.WorkspaceID = uuid.NullUUID{UUID: uuid.New(), Valid: true}
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 9b678a8e278d0..8f5efaa853994 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -3064,6 +3064,13 @@ func (m queryMetricsStore) UpdateTailnetPeerStatusByCoordinator(ctx context.Cont
 	return r0
 }
 
+func (m queryMetricsStore) UpdateTaskWorkspaceID(ctx context.Context, arg database.UpdateTaskWorkspaceIDParams) (database.TaskTable, error) {
+	start := time.Now()
+	r0, r1 := m.s.UpdateTaskWorkspaceID(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdateTaskWorkspaceID").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) UpdateTemplateACLByID(ctx context.Context, arg database.UpdateTemplateACLByIDParams) error {
 	start := time.Now()
 	err := m.s.UpdateTemplateACLByID(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 06b7f7ae3efe9..acaa2a8c5e8be 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -6578,6 +6578,21 @@ func (mr *MockStoreMockRecorder) UpdateTailnetPeerStatusByCoordinator(ctx, arg a
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTailnetPeerStatusByCoordinator", reflect.TypeOf((*MockStore)(nil).UpdateTailnetPeerStatusByCoordinator), ctx, arg)
 }
 
+// UpdateTaskWorkspaceID mocks base method.
+func (m *MockStore) UpdateTaskWorkspaceID(ctx context.Context, arg database.UpdateTaskWorkspaceIDParams) (database.TaskTable, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateTaskWorkspaceID", ctx, arg)
+	ret0, _ := ret[0].(database.TaskTable)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateTaskWorkspaceID indicates an expected call of UpdateTaskWorkspaceID.
+func (mr *MockStoreMockRecorder) UpdateTaskWorkspaceID(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateTaskWorkspaceID", reflect.TypeOf((*MockStore)(nil).UpdateTaskWorkspaceID), ctx, arg)
+}
+
 // UpdateTemplateACLByID mocks base method.
 func (m *MockStore) UpdateTemplateACLByID(ctx context.Context, arg database.UpdateTemplateACLByIDParams) error {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 3a832752977d5..f625fc0b09483 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -657,6 +657,7 @@ type sqlcQuerier interface {
 	UpdateProvisionerJobWithCompleteWithStartedAtByID(ctx context.Context, arg UpdateProvisionerJobWithCompleteWithStartedAtByIDParams) error
 	UpdateReplica(ctx context.Context, arg UpdateReplicaParams) (Replica, error)
 	UpdateTailnetPeerStatusByCoordinator(ctx context.Context, arg UpdateTailnetPeerStatusByCoordinatorParams) error
+	UpdateTaskWorkspaceID(ctx context.Context, arg UpdateTaskWorkspaceIDParams) (TaskTable, error)
 	UpdateTemplateACLByID(ctx context.Context, arg UpdateTemplateACLByIDParams) error
 	UpdateTemplateAccessControlByID(ctx context.Context, arg UpdateTemplateAccessControlByIDParams) error
 	UpdateTemplateActiveVersionByID(ctx context.Context, arg UpdateTemplateActiveVersionByIDParams) error
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index 5d57684c0e682..b9878478a92ef 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -7540,3 +7540,187 @@ func TestListTasks(t *testing.T) {
 		})
 	}
 }
+
+func TestUpdateTaskWorkspaceID(t *testing.T) {
+	t.Parallel()
+
+	db, _ := dbtestutil.NewDB(t)
+
+	// Create organization, users, template, and template version.
+	org := dbgen.Organization(t, db, database.Organization{})
+	user := dbgen.User(t, db, database.User{})
+	template := dbgen.Template(t, db, database.Template{
+		OrganizationID: org.ID,
+		CreatedBy:      user.ID,
+	})
+	templateVersion := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+		OrganizationID: org.ID,
+		TemplateID:     uuid.NullUUID{Valid: true, UUID: template.ID},
+		CreatedBy:      user.ID,
+	})
+
+	// Create another template for mismatch test.
+	template2 := dbgen.Template(t, db, database.Template{
+		OrganizationID: org.ID,
+		CreatedBy:      user.ID,
+	})
+
+	tests := []struct {
+		name      string
+		setupTask func(t *testing.T) database.Task
+		setupWS   func(t *testing.T) database.WorkspaceTable
+		wantErr   bool
+		wantNoRow bool
+	}{
+		{
+			name: "successful update with matching template",
+			setupTask: func(t *testing.T) database.Task {
+				return dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:    org.ID,
+					OwnerID:           user.ID,
+					Name:              testutil.GetRandomName(t),
+					WorkspaceID:       uuid.NullUUID{},
+					TemplateVersionID: templateVersion.ID,
+					Prompt:            "Test prompt",
+				})
+			},
+			setupWS: func(t *testing.T) database.WorkspaceTable {
+				return dbgen.Workspace(t, db, database.WorkspaceTable{
+					OrganizationID: org.ID,
+					OwnerID:        user.ID,
+					TemplateID:     template.ID,
+				})
+			},
+			wantErr:   false,
+			wantNoRow: false,
+		},
+		{
+			name: "task already has workspace_id",
+			setupTask: func(t *testing.T) database.Task {
+				existingWS := dbgen.Workspace(t, db, database.WorkspaceTable{
+					OrganizationID: org.ID,
+					OwnerID:        user.ID,
+					TemplateID:     template.ID,
+				})
+				return dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:    org.ID,
+					OwnerID:           user.ID,
+					Name:              testutil.GetRandomName(t),
+					WorkspaceID:       uuid.NullUUID{Valid: true, UUID: existingWS.ID},
+					TemplateVersionID: templateVersion.ID,
+					Prompt:            "Test prompt",
+				})
+			},
+			setupWS: func(t *testing.T) database.WorkspaceTable {
+				return dbgen.Workspace(t, db, database.WorkspaceTable{
+					OrganizationID: org.ID,
+					OwnerID:        user.ID,
+					TemplateID:     template.ID,
+				})
+			},
+			wantErr:   false,
+			wantNoRow: true, // No row should be returned because WHERE condition fails.
+		},
+		{
+			name: "template mismatch between task and workspace",
+			setupTask: func(t *testing.T) database.Task {
+				return dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:    org.ID,
+					OwnerID:           user.ID,
+					Name:              testutil.GetRandomName(t),
+					WorkspaceID:       uuid.NullUUID{}, // NULL workspace_id
+					TemplateVersionID: templateVersion.ID,
+					Prompt:            "Test prompt",
+				})
+			},
+			setupWS: func(t *testing.T) database.WorkspaceTable {
+				return dbgen.Workspace(t, db, database.WorkspaceTable{
+					OrganizationID: org.ID,
+					OwnerID:        user.ID,
+					TemplateID:     template2.ID, // Different template, JOIN will fail.
+				})
+			},
+			wantErr:   false,
+			wantNoRow: true, // No row should be returned because JOIN condition fails.
+		},
+		{
+			name: "task does not exist",
+			setupTask: func(t *testing.T) database.Task {
+				return database.Task{
+					ID: uuid.New(), // Non-existent task ID.
+				}
+			},
+			setupWS: func(t *testing.T) database.WorkspaceTable {
+				return dbgen.Workspace(t, db, database.WorkspaceTable{
+					OrganizationID: org.ID,
+					OwnerID:        user.ID,
+					TemplateID:     template.ID,
+				})
+			},
+			wantErr:   false,
+			wantNoRow: true,
+		},
+		{
+			name: "workspace does not exist",
+			setupTask: func(t *testing.T) database.Task {
+				return dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:    org.ID,
+					OwnerID:           user.ID,
+					Name:              testutil.GetRandomName(t),
+					WorkspaceID:       uuid.NullUUID{},
+					TemplateVersionID: templateVersion.ID,
+					Prompt:            "Test prompt",
+				})
+			},
+			setupWS: func(t *testing.T) database.WorkspaceTable {
+				return database.WorkspaceTable{
+					ID: uuid.New(), // Non-existent workspace ID.
+				}
+			},
+			wantErr:   false,
+			wantNoRow: true,
+		},
+	}
+
+	for _, tt := range tests {
+		tt := tt
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+
+			ctx := testutil.Context(t, testutil.WaitShort)
+
+			task := tt.setupTask(t)
+			workspace := tt.setupWS(t)
+
+			updatedTask, err := db.UpdateTaskWorkspaceID(ctx, database.UpdateTaskWorkspaceIDParams{
+				ID:          task.ID,
+				WorkspaceID: uuid.NullUUID{Valid: true, UUID: workspace.ID},
+			})
+
+			if tt.wantErr {
+				require.Error(t, err)
+				return
+			}
+
+			if tt.wantNoRow {
+				require.ErrorIs(t, err, sql.ErrNoRows)
+				return
+			}
+
+			require.NoError(t, err)
+			require.Equal(t, task.ID, updatedTask.ID)
+			require.True(t, updatedTask.WorkspaceID.Valid)
+			require.Equal(t, workspace.ID, updatedTask.WorkspaceID.UUID)
+			require.Equal(t, task.OrganizationID, updatedTask.OrganizationID)
+			require.Equal(t, task.OwnerID, updatedTask.OwnerID)
+			require.Equal(t, task.Name, updatedTask.Name)
+			require.Equal(t, task.TemplateVersionID, updatedTask.TemplateVersionID)
+
+			// Verify the update persisted by fetching the task again.
+			fetchedTask, err := db.GetTaskByID(ctx, task.ID)
+			require.NoError(t, err)
+			require.True(t, fetchedTask.WorkspaceID.Valid)
+			require.Equal(t, workspace.ID, fetchedTask.WorkspaceID.UUID)
+		})
+	}
+}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 524394c1e2d96..77f3ae50d346c 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12730,6 +12730,49 @@ func (q *sqlQuerier) ListTasks(ctx context.Context, arg ListTasksParams) ([]Task
 	return items, nil
 }
 
+const updateTaskWorkspaceID = `-- name: UpdateTaskWorkspaceID :one
+UPDATE
+	tasks
+SET
+	workspace_id = $2
+FROM
+	workspaces w
+JOIN
+	template_versions tv
+ON
+	tv.template_id = w.template_id
+WHERE
+	tasks.id = $1
+	AND tasks.workspace_id IS NULL
+	AND w.id = $2
+	AND tv.id = tasks.template_version_id
+RETURNING
+	tasks.id, tasks.organization_id, tasks.owner_id, tasks.name, tasks.workspace_id, tasks.template_version_id, tasks.template_parameters, tasks.prompt, tasks.created_at, tasks.deleted_at
+`
+
+type UpdateTaskWorkspaceIDParams struct {
+	ID          uuid.UUID     `db:"id" json:"id"`
+	WorkspaceID uuid.NullUUID `db:"workspace_id" json:"workspace_id"`
+}
+
+func (q *sqlQuerier) UpdateTaskWorkspaceID(ctx context.Context, arg UpdateTaskWorkspaceIDParams) (TaskTable, error) {
+	row := q.db.QueryRowContext(ctx, updateTaskWorkspaceID, arg.ID, arg.WorkspaceID)
+	var i TaskTable
+	err := row.Scan(
+		&i.ID,
+		&i.OrganizationID,
+		&i.OwnerID,
+		&i.Name,
+		&i.WorkspaceID,
+		&i.TemplateVersionID,
+		&i.TemplateParameters,
+		&i.Prompt,
+		&i.CreatedAt,
+		&i.DeletedAt,
+	)
+	return i, err
+}
+
 const upsertTaskWorkspaceApp = `-- name: UpsertTaskWorkspaceApp :one
 INSERT INTO task_workspace_apps
 	(task_id, workspace_build_number, workspace_agent_id, workspace_app_id)
diff --git a/coderd/database/queries/tasks.sql b/coderd/database/queries/tasks.sql
index 0ce0b6f85fe0a..5e466ea10fdd4 100644
--- a/coderd/database/queries/tasks.sql
+++ b/coderd/database/queries/tasks.sql
@@ -5,6 +5,25 @@ VALUES
 	(gen_random_uuid(), $1, $2, $3, $4, $5, $6, $7, $8)
 RETURNING *;
 
+-- name: UpdateTaskWorkspaceID :one
+UPDATE
+	tasks
+SET
+	workspace_id = $2
+FROM
+	workspaces w
+JOIN
+	template_versions tv
+ON
+	tv.template_id = w.template_id
+WHERE
+	tasks.id = $1
+	AND tasks.workspace_id IS NULL
+	AND w.id = $2
+	AND tv.id = tasks.template_version_id
+RETURNING
+	tasks.*;
+
 -- name: UpsertTaskWorkspaceApp :one
 INSERT INTO task_workspace_apps
 	(task_id, workspace_build_number, workspace_agent_id, workspace_app_id)
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
index d67fa2ef4b5a7..e8b7ff51530c3 100644
--- a/coderd/workspaces.go
+++ b/coderd/workspaces.go
@@ -388,7 +388,7 @@ func (api *API) postWorkspacesByOrganization(rw http.ResponseWriter, r *http.Req
 		AvatarURL: member.AvatarURL,
 	}
 
-	w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, req, r)
+	w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, req, r, nil)
 	if err != nil {
 		httperror.WriteResponseError(ctx, rw, err)
 		return
@@ -484,7 +484,7 @@ func (api *API) postUserWorkspaces(rw http.ResponseWriter, r *http.Request) {
 
 	defer commitAudit()
 
-	w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, req, r)
+	w, err := createWorkspace(ctx, aReq, apiKey.UserID, api, owner, req, r, nil)
 	if err != nil {
 		httperror.WriteResponseError(ctx, rw, err)
 		return
@@ -499,6 +499,15 @@ type workspaceOwner struct {
 	AvatarURL string
 }
 
+type createWorkspaceOptions struct {
+	// preCreateInTX is a function that is called within the transaction, before
+	// the workspace is created.
+	preCreateInTX func(ctx context.Context, tx database.Store) error
+	// postCreateInTX is a function that is called within the transaction, after
+	// the workspace is created but before the workspace build is created.
+	postCreateInTX func(ctx context.Context, tx database.Store, workspace database.Workspace) error
+}
+
 func createWorkspace(
 	ctx context.Context,
 	auditReq *audit.Request[database.WorkspaceTable],
@@ -507,7 +516,12 @@ func createWorkspace(
 	owner workspaceOwner,
 	req codersdk.CreateWorkspaceRequest,
 	r *http.Request,
+	opts *createWorkspaceOptions,
 ) (codersdk.Workspace, error) {
+	if opts == nil {
+		opts = &createWorkspaceOptions{}
+	}
+
 	template, err := requestTemplate(ctx, req, api.Database)
 	if err != nil {
 		return codersdk.Workspace{}, err
@@ -636,6 +650,16 @@ func createWorkspace(
 			claimedWorkspace *database.Workspace
 		)
 
+		// If a preCreate hook is provided, execute it before creating or
+		// claiming the workspace. This can be used to perform additional
+		// setup or validation before the workspace is created (e.g. task
+		// creation).
+		if opts.preCreateInTX != nil {
+			if err := opts.preCreateInTX(ctx, db); err != nil {
+				return xerrors.Errorf("workspace preCreate failed: %w", err)
+			}
+		}
+
 		// Use injected Clock to allow time mocking in tests
 		now := dbtime.Time(api.Clock.Now())
 
@@ -729,6 +753,15 @@ func createWorkspace(
 			return xerrors.Errorf("get workspace by ID: %w", err)
 		}
 
+		// If the postCreate hook is provided, execute it. This can be used to
+		// perform additional actions after the workspace has been created, like
+		// linking the workspace to a task.
+		if opts.postCreateInTX != nil {
+			if err := opts.postCreateInTX(ctx, db, workspace); err != nil {
+				return xerrors.Errorf("workspace postCreate failed: %w", err)
+			}
+		}
+
 		builder := wsbuilder.New(workspace, database.WorkspaceTransitionStart, *api.BuildUsageChecker.Load()).
 			Reason(database.BuildReasonInitiator).
 			Initiator(initiatorID).
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index 67e68daa706cf..8232d80dc44aa 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -89,6 +89,20 @@ func (c *ExperimentalClient) CreateTask(ctx context.Context, user string, reques
 	return task, nil
 }
 
+// TaskStatus represents the status of a task.
+//
+// Experimental: This type is experimental and may change in the future.
+type TaskStatus string
+
+const (
+	TaskStatusPending      TaskStatus = "pending"
+	TaskStatusInitializing TaskStatus = "initializing"
+	TaskStatusActive       TaskStatus = "active"
+	TaskStatusPaused       TaskStatus = "paused"
+	TaskStatusUnknown      TaskStatus = "unknown"
+	TaskStatusError        TaskStatus = "error"
+)
+
 // TaskState represents the high-level lifecycle of a task.
 //
 // Experimental: This type is experimental and may change in the future.
@@ -112,17 +126,19 @@ type Task struct {
 	OwnerName               string                   `json:"owner_name" table:"owner name"`
 	Name                    string                   `json:"name" table:"name,default_sort"`
 	TemplateID              uuid.UUID                `json:"template_id" format:"uuid" table:"template id"`
+	TemplateVersionID       uuid.UUID                `json:"template_version_id" format:"uuid" table:"template version id"`
 	TemplateName            string                   `json:"template_name" table:"template name"`
 	TemplateDisplayName     string                   `json:"template_display_name" table:"template display name"`
 	TemplateIcon            string                   `json:"template_icon" table:"template icon"`
 	WorkspaceID             uuid.NullUUID            `json:"workspace_id" format:"uuid" table:"workspace id"`
+	WorkspaceStatus         WorkspaceStatus          `json:"workspace_status,omitempty" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"status"`
 	WorkspaceBuildNumber    int32                    `json:"workspace_build_number,omitempty" table:"workspace build number"`
 	WorkspaceAgentID        uuid.NullUUID            `json:"workspace_agent_id" format:"uuid" table:"workspace agent id"`
 	WorkspaceAgentLifecycle *WorkspaceAgentLifecycle `json:"workspace_agent_lifecycle" table:"workspace agent lifecycle"`
 	WorkspaceAgentHealth    *WorkspaceAgentHealth    `json:"workspace_agent_health" table:"workspace agent health"`
 	WorkspaceAppID          uuid.NullUUID            `json:"workspace_app_id" format:"uuid" table:"workspace app id"`
 	InitialPrompt           string                   `json:"initial_prompt" table:"initial prompt"`
-	Status                  WorkspaceStatus          `json:"status" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"status"`
+	Status                  TaskStatus               `json:"status" enums:"pending,initializing,active,paused,unknown,error" table:"task status"`
 	CurrentState            *TaskStateEntry          `json:"current_state" table:"cs,recursive_inline"`
 	CreatedAt               time.Time                `json:"created_at" format:"date-time" table:"created at"`
 	UpdatedAt               time.Time                `json:"updated_at" format:"date-time" table:"updated at"`
@@ -144,8 +160,14 @@ type TaskStateEntry struct {
 type TasksFilter struct {
 	// Owner can be a username, UUID, or "me".
 	Owner string `json:"owner,omitempty"`
-	// Status is a task status.
-	Status string `json:"status,omitempty" typescript:"-"`
+	// Status filters the tasks by their status.
+	//
+	// TODO(mafredri): Enable this field.
+	// Status TaskStatus `json:"status,omitempty"`
+	// WorkspaceStatus is a workspace status to filter by.
+	//
+	// Deprecated: Use TaskStatus instead.
+	WorkspaceStatus string `json:"workspace_status,omitempty" typescript:"-"`
 	// Offset is the number of tasks to skip before returning results.
 	Offset int `json:"offset,omitempty" typescript:"-"`
 	// Limit is a limit on the number of tasks returned.
@@ -162,7 +184,7 @@ func (c *ExperimentalClient) Tasks(ctx context.Context, filter *TasksFilter) ([]
 
 	var wsFilter WorkspaceFilter
 	wsFilter.Owner = filter.Owner
-	wsFilter.Status = filter.Status
+	wsFilter.Status = filter.WorkspaceStatus
 	page := Pagination{
 		Offset: filter.Offset,
 		Limit:  filter.Limit,
diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index 566b2fcaf9d64..e82511b46bc05 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -1938,8 +1938,8 @@ var DeleteTask = Tool[DeleteTaskArgs, codersdk.Response]{
 }
 
 type ListTasksArgs struct {
-	Status string `json:"status"`
-	User   string `json:"user"`
+	WorkspaceStatus string `json:"status"`
+	User            string `json:"user"`
 }
 
 type ListTasksResponse struct {
@@ -1972,8 +1972,8 @@ var ListTasks = Tool[ListTasksArgs, ListTasksResponse]{
 
 		expClient := codersdk.NewExperimentalClient(deps.coderClient)
 		tasks, err := expClient.Tasks(ctx, &codersdk.TasksFilter{
-			Owner:  args.User,
-			Status: args.Status,
+			Owner:           args.User,
+			WorkspaceStatus: args.WorkspaceStatus,
 		})
 		if err != nil {
 			return ListTasksResponse{}, xerrors.Errorf("list tasks: %w", err)
@@ -2031,7 +2031,7 @@ var GetTaskStatus = Tool[GetTaskStatusArgs, GetTaskStatusResponse]{
 		}
 
 		return GetTaskStatusResponse{
-			Status: task.Status,
+			Status: task.WorkspaceStatus,
 			State:  task.CurrentState,
 		}, nil
 	},
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index c87a5e0358904..973ffea109b67 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -797,7 +797,7 @@ func TestTools(t *testing.T) {
 		}
 	})
 
-	t.Run("WorkspaceCreateTask", func(t *testing.T) {
+	t.Run("CreateTask", func(t *testing.T) {
 		t.Parallel()
 
 		presetID := uuid.New()
@@ -884,6 +884,8 @@ func TestTools(t *testing.T) {
 	t.Run("WorkspaceDeleteTask", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		// nolint:gocritic // This is in a test package and does not end up in the build
 		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
 			OrganizationID: owner.OrganizationID,
@@ -976,6 +978,8 @@ func TestTools(t *testing.T) {
 	t.Run("WorkspaceListTasks", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		taskClient, taskUser := coderdtest.CreateAnotherUserMutators(t, client, owner.OrganizationID, nil)
 
 		// nolint:gocritic // This is in a test package and does not end up in the build
@@ -1034,7 +1038,7 @@ func TestTools(t *testing.T) {
 			{
 				name: "ListFiltered",
 				args: toolsdk.ListTasksArgs{
-					Status: "stopped",
+					WorkspaceStatus: "stopped",
 				},
 				expected: []string{
 					"list-task-workspace-0",
@@ -1067,6 +1071,8 @@ func TestTools(t *testing.T) {
 	t.Run("WorkspaceGetTask", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		// nolint:gocritic // This is in a test package and does not end up in the build
 		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
 			OrganizationID: owner.OrganizationID,
@@ -1295,6 +1301,8 @@ func TestTools(t *testing.T) {
 	t.Run("SendTaskInput", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		// Start a fake AgentAPI that accepts GET /status and POST /message.
 		srv := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			if r.Method == http.MethodGet && r.URL.Path == "/status" {
@@ -1421,6 +1429,8 @@ func TestTools(t *testing.T) {
 	t.Run("GetTaskLogs", func(t *testing.T) {
 		t.Parallel()
 
+		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+
 		messages := []agentapi.Message{
 			{
 				Id:      0,
@@ -1767,6 +1777,23 @@ func TestMain(m *testing.M) {
 			if runtime.GOOS == "windows" && tool.Name == "coder_workspace_bash" {
 				continue
 			}
+			ignored := false
+			for _, ignore := range []string{
+				"coder_delete_task",
+				"coder_list_tasks",
+				"coder_get_task_status",
+				"coder_send_task_input",
+				"coder_get_task_logs",
+				"coder_get_task_logs",
+			} {
+				if ignore == tool.Name {
+					ignored = true
+					break
+				}
+			}
+			if ignored {
+				continue
+			}
 			untested = append(untested, tool.Name)
 		}
 	}
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index cd0daad963110..014170ca4a56c 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -302,6 +302,7 @@
       "template_icon": "string",
       "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
       "template_name": "string",
+      "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
       "updated_at": "2019-08-24T14:15:22Z",
       "workspace_agent_health": {
         "healthy": false,
@@ -320,7 +321,8 @@
       "workspace_id": {
         "uuid": "string",
         "valid": true
-      }
+      },
+      "workspace_status": "pending"
     }
   ]
 }
@@ -7732,6 +7734,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "template_icon": "string",
   "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
   "template_name": "string",
+  "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "updated_at": "2019-08-24T14:15:22Z",
   "workspace_agent_health": {
     "healthy": false,
@@ -7750,7 +7753,8 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "workspace_id": {
     "uuid": "string",
     "valid": true
-  }
+  },
+  "workspace_status": "pending"
 }
 ```
 
@@ -7766,11 +7770,12 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `organization_id`           | string                                                               | false    |              |             |
 | `owner_id`                  | string                                                               | false    |              |             |
 | `owner_name`                | string                                                               | false    |              |             |
-| `status`                    | [codersdk.WorkspaceStatus](#codersdkworkspacestatus)                 | false    |              |             |
+| `status`                    | [codersdk.TaskStatus](#codersdktaskstatus)                           | false    |              |             |
 | `template_display_name`     | string                                                               | false    |              |             |
 | `template_icon`             | string                                                               | false    |              |             |
 | `template_id`               | string                                                               | false    |              |             |
 | `template_name`             | string                                                               | false    |              |             |
+| `template_version_id`       | string                                                               | false    |              |             |
 | `updated_at`                | string                                                               | false    |              |             |
 | `workspace_agent_health`    | [codersdk.WorkspaceAgentHealth](#codersdkworkspaceagenthealth)       | false    |              |             |
 | `workspace_agent_id`        | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
@@ -7778,21 +7783,28 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `workspace_app_id`          | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
 | `workspace_build_number`    | integer                                                              | false    |              |             |
 | `workspace_id`              | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
+| `workspace_status`          | [codersdk.WorkspaceStatus](#codersdkworkspacestatus)                 | false    |              |             |
 
 #### Enumerated Values
 
-| Property | Value       |
-|----------|-------------|
-| `status` | `pending`   |
-| `status` | `starting`  |
-| `status` | `running`   |
-| `status` | `stopping`  |
-| `status` | `stopped`   |
-| `status` | `failed`    |
-| `status` | `canceling` |
-| `status` | `canceled`  |
-| `status` | `deleting`  |
-| `status` | `deleted`   |
+| Property           | Value          |
+|--------------------|----------------|
+| `status`           | `pending`      |
+| `status`           | `initializing` |
+| `status`           | `active`       |
+| `status`           | `paused`       |
+| `status`           | `unknown`      |
+| `status`           | `error`        |
+| `workspace_status` | `pending`      |
+| `workspace_status` | `starting`     |
+| `workspace_status` | `running`      |
+| `workspace_status` | `stopping`     |
+| `workspace_status` | `stopped`      |
+| `workspace_status` | `failed`       |
+| `workspace_status` | `canceling`    |
+| `workspace_status` | `canceled`     |
+| `workspace_status` | `deleting`     |
+| `workspace_status` | `deleted`      |
 
 ## codersdk.TaskLogEntry
 
@@ -7901,6 +7913,25 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `timestamp` | string                                   | false    |              |             |
 | `uri`       | string                                   | false    |              |             |
 
+## codersdk.TaskStatus
+
+```json
+"pending"
+```
+
+### Properties
+
+#### Enumerated Values
+
+| Value          |
+|----------------|
+| `pending`      |
+| `initializing` |
+| `active`       |
+| `paused`       |
+| `unknown`      |
+| `error`        |
+
 ## codersdk.TelemetryConfig
 
 ```json
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 449fc01d55aa7..8e95dfd0904c6 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -4702,17 +4702,19 @@ export interface Task {
 	readonly owner_name: string;
 	readonly name: string;
 	readonly template_id: string;
+	readonly template_version_id: string;
 	readonly template_name: string;
 	readonly template_display_name: string;
 	readonly template_icon: string;
 	readonly workspace_id: string | null;
+	readonly workspace_status?: WorkspaceStatus;
 	readonly workspace_build_number?: number;
 	readonly workspace_agent_id: string | null;
 	readonly workspace_agent_lifecycle: WorkspaceAgentLifecycle | null;
 	readonly workspace_agent_health: WorkspaceAgentHealth | null;
 	readonly workspace_app_id: string | null;
 	readonly initial_prompt: string;
-	readonly status: WorkspaceStatus;
+	readonly status: TaskStatus;
 	readonly current_state: TaskStateEntry | null;
 	readonly created_at: string;
 	readonly updated_at: string;
@@ -4779,6 +4781,24 @@ export const TaskStates: TaskState[] = [
 	"working",
 ];
 
+// From codersdk/aitasks.go
+export type TaskStatus =
+	| "active"
+	| "error"
+	| "initializing"
+	| "paused"
+	| "pending"
+	| "unknown";
+
+export const TaskStatuses: TaskStatus[] = [
+	"active",
+	"error",
+	"initializing",
+	"paused",
+	"pending",
+	"unknown",
+];
+
 // From codersdk/aitasks.go
 /**
  * TasksFilter filters the list of tasks.
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 2b3ff41dda820..f68224768359a 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -5028,14 +5028,16 @@ export const MockTask: TypesGen.Task = {
 	template_name: MockTemplate.name,
 	template_display_name: MockTemplate.display_name,
 	template_icon: MockTemplate.icon,
+	template_version_id: MockTemplateVersion.id,
 	workspace_id: MockWorkspace.id,
+	workspace_status: "running",
 	workspace_build_number: MockWorkspaceBuild.build_number,
 	workspace_agent_id: MockWorkspaceAgent.id,
 	workspace_agent_lifecycle: MockWorkspaceAgent.lifecycle_state,
 	workspace_agent_health: MockWorkspaceAgent.health,
 	workspace_app_id: MockWorkspaceApp.id,
 	initial_prompt: "Perform some task",
-	status: "running",
+	status: "active",
 	current_state: {
 		timestamp: "2022-05-17T17:39:01.382927298Z",
 		state: "idle",

From 8daf4f35b10f83d9a62ca8f6b19fbc9da95c9113 Mon Sep 17 00:00:00 2001
From: DevCats <christofer@coder.com>
Date: Thu, 23 Oct 2025 11:14:35 -0500
Subject: [PATCH 216/298] feat: add copyparty icon (#20440)

copy of #20415 since ci wont run on fork currently
---
 site/src/theme/externalImages.ts | 1 +
 site/src/theme/icons.json        | 1 +
 site/static/icon/copyparty.svg   | 1 +
 3 files changed, 3 insertions(+)
 create mode 100644 site/static/icon/copyparty.svg

diff --git a/site/src/theme/externalImages.ts b/site/src/theme/externalImages.ts
index 0efae3419e1da..9ef27c43ed774 100644
--- a/site/src/theme/externalImages.ts
+++ b/site/src/theme/externalImages.ts
@@ -149,6 +149,7 @@ export const defaultParametersForBuiltinIcons = new Map<string, string>([
 	["/icon/aws-monochrome.svg", "monochrome"],
 	["/icon/coder.svg", "monochrome"],
 	["/icon/container.svg", "monochrome"],
+	["/icon/copyparty.svg", "blackWithColor"],
 	["/icon/database.svg", "monochrome"],
 	["/icon/docker-white.svg", "monochrome"],
 	["/icon/folder.svg", "monochrome"],
diff --git a/site/src/theme/icons.json b/site/src/theme/icons.json
index 3686eb8a5d8ea..a45b84f1207f1 100644
--- a/site/src/theme/icons.json
+++ b/site/src/theme/icons.json
@@ -27,6 +27,7 @@
 	"conda.svg",
 	"confluence.svg",
 	"container.svg",
+	"copyparty.svg",
 	"cpp.svg",
 	"cursor.svg",
 	"database.svg",
diff --git a/site/static/icon/copyparty.svg b/site/static/icon/copyparty.svg
new file mode 100644
index 0000000000000..0442541291475
--- /dev/null
+++ b/site/static/icon/copyparty.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" width="300mm" height="207mm" viewBox="0 0 300 207"><defs><linearGradient id="a"><stop offset="0" style="stop-color:#fc5;stop-opacity:1"/><stop offset=".2" style="stop-color:#fc0;stop-opacity:1"/><stop offset="1" style="stop-color:#f80;stop-opacity:1"/></linearGradient><linearGradient xlink:href="#a" id="b" x1="15" x2="15" y1="15" y2="143" gradientUnits="userSpaceOnUse"/></defs><rect width="300" height="205" rx="12" ry="12" style="fill:#333"/><rect width="270" height="128" x="15" y="15" rx="8" ry="8" style="fill:url(#b)"/><rect width="172" height="52" x="64" y="72" rx="26" ry="26" style="fill:#333"/><circle cx="91" cy="98" r="18" style="fill:#ccc"/><circle cx="209" cy="98" r="18" style="fill:#ccc"/><path d="m48 207 10-39c1.79-6.2 5.6-7.8 12-8 60-1 100-1 160 0 6.4.2 10 1.8 12 8l10 39z" style="fill:#737373;stroke-width:1px"/><path d="M63.5 50.9q-.85.93-4.73 2.3-3.6 1.3-4.4 1.3-3.3 0-5.1-2.1-1.75-2-1.75-5.36 0-4.6 3.76-7.64 3.3-2.7 7.3-2.7.4 0 .93.74.54.7.54 1.16 0 2.06-2.2 2.7-1.36.4-4.04 1.16-2.2 1.16-2.2 4.4 0 3.2 2.9 3.2h.85q.54 0 1.44-.16 1.1-.23 2.9-.74 1.8-.54 2.13-.54.4 0 1.75.6zM87.6 45q0 4.2-3.7 6.95-3.2 2.3-6.87 2.3-3.4 0-6-2.6-2.5-2.6-2.5-6 0-3.6 3.14-6.64 3.2-3 6.8-3 3.5 0 6.3 2.76 2.83 2.76 2.83 6.25zm-3.4.16q0-2.25-1.75-3.7-1.7-1.5-4-1.5-.1 0-1.6 1.6-1.44 1.55-2.44 1.55-.6 0-.8-.3-1.16 2.3-1.16 3 0 2.25 2.13 3.4 1.6.9 3.6.9t3.76-1.1q2.25-1.4 2.25-3.84zM112.8 46.8q0 2.8-1.9 4.4-1.8 1.5-4.7 1.5-.7 0-2.7-.4-1.9-.4-2.6-.4-2.1 0-2.1 2.64 0 .85.23 2.6.2 1.75.2 2.6 0 1.9-.77 2.83-1.44 0-3-.85-1.46-9.5-1.46-12 0-3.65 1.75-8.1 2.37-6.05 6.45-6.05 3.7 0 7.3 4.1 3.3 3.84 3.3 7.14zm-3.8.2q-.6-2.2-2.6-4.4-2.3-2.5-4.3-2.5-1.3 0-2.33 2.2-.9 1.8-.9 3.26 0 .47.38 1.24.43.8.85.8 1.1 0 3.2.3t3.2.3q.3 0 1.3-.4 1-.47 1.3-.74zM133 40q-2.1 4.1-3.2 7-.1.3-1.6 4.5-.4 1.36-1 4.2-.5 2.83-1 4.2-1 2.83-2.3 2.64-1.4-.2-1.6-1.6v-.5q0-.16.3-1.5 1-5.04 1-6.44 0-.54-.1-.74-1.4-2.44-4.1-7.4-2.7-4.97-2.4-7.7 1.5-1.36 2.1-1.36.4 0 1.1.6.6.6.7 1.1.8 6.2 4.9 11.1 1-1.8 1.8-4.04.5-1.4 1.6-4.15 1.9-4.46 3.4-4.46.2 0 .4.1.9.3 1.3 2.8zM157.5 48q0 2.8-1.9 4.4-1.8 1.5-4.7 1.5-.7 0-2.7-.4-1.9-.4-2.6-.4-2 0-2 2.64 0 .85.2 2.6t.2 2.6q0 1.9-.7 2.83-1.5 0-3-.85-1.5-9.5-1.5-11.95 0-3.65 1.8-8.1 2.3-6.05 6.4-6.05 3.7 0 7.2 4.1 3.3 3.84 3.3 7.14zm-3.8.2q-.6-2.2-2.6-4.4-2.3-2.5-4.3-2.5-1.3 0-2.3 2.2-.9 1.8-.9 3.26 0 .47.4 1.24.4.8.8.8 1.1 0 3.2.3t3.2.3q.3 0 1.3-.4 1-.47 1.3-.74zM182 53.3q0 .9-.6 1.5t-1.4.6q-1.6 0-3-.9-1.4-.93-2.1-2.3-.7-.1-1.5.85-.9 1.16-1.1 1.24-1.2.54-3.9.54-2.2 0-3.9-2.44-1.5-2.13-1.5-4 0-3.4 3.4-6.4 3.2-2.9 6.7-2.9.9 0 1.7.6.8.6.8 1.44 0 .54-.4 1.1 2.4.9 2.4 2.83 0 .35-.1 1.05-.1.7-.1 1.05 0 .4.1.6.5 1.3 2.5 3.4 1.9 1.9 1.9 2.2zm-8.1-10.1q-.4 0-1.1-.1-.8-.16-1.1-.16-1.3 0-3.2 1.94-1.9 1.94-1.9 3.3 0 .8.7 1.8.9 1.3 2.2 1.3 2.6 0 3.5-2.9.5-2.6 1-5.16zM203.8 42.4q-.4.4-1.5.4-.9 0-2.5-.3-1.7-.3-2.5-.3-4.7 0-5.5 6.9-.3 3.1-.4 3.3-.4 1-1.7 2.3h-1.1q-.7-1.2-1.3-4.1-.6-2.76-.6-4.27 0-1.16.1-1.5.2-.54 1-.54.3 0 .6.3l.4.3q1.9-3.53 3.1-4.6 1.8-1.7 5.1-1.7 1.4 0 3.6.9 2.8 1.16 3.3 2.8zM229.5 37.16q.3.8.3 1.44 0 1.86-2.4 1.86-1 0-3.5-.5-2.5-.54-3.4-.54-1.3 0-1.5.1-.4.2-.4 1.2 0 2.2.6 6.9.7 5.86 1.6 6.13-.4.35-.4 1.1-1.2.7-2.6.7-1.4 0-2-3.9-.2-1.36-.5-7.76-.2-4.6-.8-5.5-.3-.47-4.3-.35-1 0-1.6.1h-.3q-.8 0-1.2-.7-.5-1.3-.5-1.4 0-1.44 4.1-2 1.6-.16 4.7-.5 0-.85-.1-2.56v-2.6q0-4.35 2.1-4.35.5 0 1.1.6.6.6.6 1.1v7.9q1.1 1.2 5 1.7t5.3 1.86zM251.2 40.2q-2 4.1-3.2 7l-1.5 4.5q-.5 1.36-1 4.2-.5 2.83-1 4.2-1 2.83-2.4 2.64-1.4-.2-1.5-1.6-.1-.2-.1-.5 0-.16.3-1.5 1.1-5.04 1.1-6.44 0-.54-.1-.74-1.4-2.44-4.1-7.4-2.7-4.97-2.4-7.7 1.4-1.36 2.1-1.36.4 0 1 .6t.7 1.1q.9 6.2 4.9 11.1 1-1.8 1.9-4.04.5-1.4 1.6-4.15 1.8-4.46 3.4-4.46.2 0 .4.1.8.3 1.2 2.8zM111.4 83.335l-9.526 5.5 2.5 4.33 9.526-5.5zm-33.775 19.5-9.526 5.5 2.5 4.33 9.526-5.5zM88.5 73v11h5V73Zm0 39v11h5v-11ZM68.1 87.665l9.526 5.5 2.5-4.33-9.526-5.5zm33.775 19.5 9.527 5.5 2.5-4.33-9.527-5.5z" style="fill:#333"/><path d="m111.4 83.335-9.526 5.5 2.5 4.33 9.526-5.5zm-33.775 19.5-9.526 5.5 2.5 4.33 9.526-5.5zM88.5 73v11h5V73Zm0 39v11h5v-11ZM68.1 87.665l9.526 5.5 2.5-4.33-9.526-5.5zm33.775 19.5 9.527 5.5 2.5-4.33-9.527-5.5z" style="fill:#333" transform="rotate(30 150 318.19)"/></svg>
\ No newline at end of file

From 79728c30faaf5a1994be5e170aef4e2aaab6082f Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 19:29:23 +0300
Subject: [PATCH 217/298] chore(coderd/database/migrations): migrate tasks to
 new data model (#20434)

Updates coder/internal#976
Closes coder/internal#1078
---
 .../000387_migrate_task_workspaces.down.sql   |   3 +
 .../000387_migrate_task_workspaces.up.sql     | 113 +++++
 coderd/database/migrations/migrate_test.go    | 413 ++++++++++++++++++
 3 files changed, 529 insertions(+)
 create mode 100644 coderd/database/migrations/000387_migrate_task_workspaces.down.sql
 create mode 100644 coderd/database/migrations/000387_migrate_task_workspaces.up.sql

diff --git a/coderd/database/migrations/000387_migrate_task_workspaces.down.sql b/coderd/database/migrations/000387_migrate_task_workspaces.down.sql
new file mode 100644
index 0000000000000..b26683717106f
--- /dev/null
+++ b/coderd/database/migrations/000387_migrate_task_workspaces.down.sql
@@ -0,0 +1,3 @@
+-- No-op: This migration is not reversible as it transforms existing data into
+-- a new schema. Rolling back would require deleting tasks and potentially
+-- losing data.
diff --git a/coderd/database/migrations/000387_migrate_task_workspaces.up.sql b/coderd/database/migrations/000387_migrate_task_workspaces.up.sql
new file mode 100644
index 0000000000000..8c09cfe44dc37
--- /dev/null
+++ b/coderd/database/migrations/000387_migrate_task_workspaces.up.sql
@@ -0,0 +1,113 @@
+-- Migrate existing task workspaces to the new tasks data model. This migration
+-- identifies workspaces that were created as tasks (has_ai_task = true) and
+-- populates the tasks and task_workspace_apps tables with their data.
+
+-- Step 1: Create tasks from workspaces with has_ai_task TRUE in their latest build.
+INSERT INTO tasks (
+	id,
+	organization_id,
+	owner_id,
+	name,
+	workspace_id,
+	template_version_id,
+	template_parameters,
+	prompt,
+	created_at,
+	deleted_at
+)
+SELECT
+	gen_random_uuid() AS id,
+	w.organization_id,
+	w.owner_id,
+	w.name,
+	w.id AS workspace_id,
+	latest_task_build.template_version_id,
+	COALESCE(params.template_parameters, '{}'::jsonb) AS template_parameters,
+	COALESCE(ai_prompt.value, '') AS prompt,
+	w.created_at,
+	CASE WHEN w.deleted = true THEN w.deleting_at ELSE NULL END AS deleted_at
+FROM workspaces w
+INNER JOIN LATERAL (
+	-- Find the latest build for this workspace that has has_ai_task = true.
+	SELECT
+		wb.template_version_id
+	FROM workspace_builds wb
+	WHERE wb.workspace_id = w.id
+		AND wb.has_ai_task = true
+	ORDER BY wb.build_number DESC
+	LIMIT 1
+) latest_task_build ON true
+LEFT JOIN LATERAL (
+	-- Find the latest build that has a non-empty AI Prompt parameter.
+	SELECT
+		wb.id
+	FROM workspace_builds wb
+	WHERE wb.workspace_id = w.id
+		AND EXISTS (
+			SELECT 1
+			FROM workspace_build_parameters wbp
+			WHERE wbp.workspace_build_id = wb.id
+				AND wbp.name = 'AI Prompt'
+				AND wbp.value != ''
+		)
+	ORDER BY wb.build_number DESC
+	LIMIT 1
+) latest_prompt_build ON true
+LEFT JOIN LATERAL (
+	-- Extract the AI Prompt parameter value from the prompt build.
+	SELECT wbp.value
+	FROM workspace_build_parameters wbp
+	WHERE wbp.workspace_build_id = latest_prompt_build.id
+		AND wbp.name = 'AI Prompt'
+	LIMIT 1
+) ai_prompt ON true
+LEFT JOIN LATERAL (
+	-- Aggregate all other parameters (excluding AI Prompt) from the prompt build.
+	SELECT jsonb_object_agg(wbp.name, wbp.value) AS template_parameters
+	FROM workspace_build_parameters wbp
+	WHERE wbp.workspace_build_id = latest_prompt_build.id
+		AND wbp.name != 'AI Prompt'
+) params ON true
+WHERE
+	-- Skip deleted workspaces because of duplicate name.
+	w.deleted = false
+	-- Safe-guard, do not create tasks for workspaces that are already tasks.
+	AND NOT EXISTS (
+		SELECT 1
+		FROM tasks t
+		WHERE t.workspace_id = w.id
+	);
+
+-- Step 2: Populate task_workspace_apps table with build/agent/app information.
+INSERT INTO task_workspace_apps (
+	task_id,
+	workspace_build_number,
+	workspace_agent_id,
+	workspace_app_id
+)
+SELECT
+	t.id AS task_id,
+	latest_build.build_number AS workspace_build_number,
+	sidebar_app.agent_id AS workspace_agent_id,
+	sidebar_app.id AS workspace_app_id
+FROM tasks t
+INNER JOIN LATERAL (
+	-- Find the latest build for this tasks workspace.
+	SELECT
+		wb.build_number,
+		wb.ai_task_sidebar_app_id
+	FROM workspace_builds wb
+	WHERE wb.workspace_id = t.workspace_id
+	ORDER BY wb.build_number DESC
+	LIMIT 1
+) latest_build ON true
+-- Get the sidebar app (optional, can be NULL).
+LEFT JOIN workspace_apps sidebar_app
+	ON sidebar_app.id = latest_build.ai_task_sidebar_app_id
+WHERE
+	-- Safe-guard, do not create for existing tasks.
+	NOT EXISTS (
+		SELECT 1
+		FROM task_workspace_apps twa
+		WHERE twa.task_id = t.id
+	);
diff --git a/coderd/database/migrations/migrate_test.go b/coderd/database/migrations/migrate_test.go
index f31a3adb0eb3b..7bab30c0d45e7 100644
--- a/coderd/database/migrations/migrate_test.go
+++ b/coderd/database/migrations/migrate_test.go
@@ -469,3 +469,416 @@ func TestMigration000362AggregateUsageEvents(t *testing.T) {
 		require.JSONEq(t, string(expectedDailyRows[i].usageData), string(row.UsageData))
 	}
 }
+
+func TestMigration000387MigrateTaskWorkspaces(t *testing.T) {
+	t.Parallel()
+
+	// This test verifies the migration of task workspaces to the new tasks data model.
+	// Test cases:
+	//
+	// Task 1 (ws1) - Basic case:
+	//   - Single build with has_ai_task=true, prompt, and parameters
+	//   - Verifies: all task fields are populated correctly
+	//
+	// Task 2 (ws2) - No AI Prompt parameter:
+	//   - Single build with has_ai_task=true but NO AI Prompt parameter
+	//   - Verifies: prompt defaults to empty string (tests LEFT JOIN for optional prompt)
+	//
+	// Task 3 (ws3) - Latest build is stop:
+	//   - Build 1: start with agents/apps and prompt
+	//   - Build 2: stop build (references same app via ai_task_sidebar_app_id)
+	//   - Verifies: twa uses latest build number with agents/apps from that build's ai_task_sidebar_app_id
+	//
+	// Antagonists - Should NOT be migrated:
+	//   - Regular workspace without has_ai_task flag
+	//   - Deleted workspace (w.deleted = true)
+
+	const migrationVersion = 387
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+	sqlDB := testSQLDB(t)
+
+	// Migrate up to the migration before the task workspace migration.
+	next, err := migrations.Stepper(sqlDB)
+	require.NoError(t, err)
+	for {
+		version, more, err := next()
+		require.NoError(t, err)
+		if !more {
+			t.Fatalf("migration %d not found", migrationVersion)
+		}
+		if version == migrationVersion-1 {
+			break
+		}
+	}
+
+	now := time.Now().UTC().Truncate(time.Microsecond)
+	deletingAt := now.Add(24 * time.Hour).Truncate(time.Microsecond)
+
+	// Define all IDs upfront.
+	orgID := uuid.New()
+	userID := uuid.New()
+	templateID := uuid.New()
+	templateVersionID := uuid.New()
+	templateJobID := uuid.New()
+
+	// Task workspace 1: basic case with prompt and parameters.
+	ws1ID := uuid.New()
+	ws1Build1JobID := uuid.New()
+	ws1Build1ID := uuid.New()
+	ws1Resource1ID := uuid.New()
+	ws1Agent1ID := uuid.New()
+	ws1App1ID := uuid.New()
+
+	// Task workspace 2: no AI Prompt parameter.
+	ws2ID := uuid.New()
+	ws2Build1JobID := uuid.New()
+	ws2Build1ID := uuid.New()
+	ws2Resource1ID := uuid.New()
+	ws2Agent1ID := uuid.New()
+	ws2App1ID := uuid.New()
+
+	// Task workspace 3: has both start and stop builds.
+	ws3ID := uuid.New()
+	ws3Build1JobID := uuid.New()
+	ws3Build1ID := uuid.New()
+	ws3Resource1ID := uuid.New()
+	ws3Agent1ID := uuid.New()
+	ws3App1ID := uuid.New()
+	ws3Build2JobID := uuid.New()
+	ws3Build2ID := uuid.New()
+	ws3Resource2ID := uuid.New()
+
+	// Antagonist 1: deleted workspace.
+	wsAntDeletedID := uuid.New()
+	wsAntDeletedBuild1JobID := uuid.New()
+	wsAntDeletedBuild1ID := uuid.New()
+	wsAntDeletedResource1ID := uuid.New()
+	wsAntDeletedAgent1ID := uuid.New()
+	wsAntDeletedApp1ID := uuid.New()
+
+	// Antagonist 2: regular workspace without has_ai_task.
+	wsAntID := uuid.New()
+	wsAntBuild1JobID := uuid.New()
+	wsAntBuild1ID := uuid.New()
+
+	// Create all fixtures in a single transaction.
+	tx, err := sqlDB.BeginTx(ctx, nil)
+	require.NoError(t, err)
+	defer tx.Rollback()
+
+	// Execute fixture setup as individual statements.
+	fixtures := []struct {
+		query string
+		args  []any
+	}{
+		// Setup organization, user, and template.
+		{
+			`INSERT INTO organizations (id, name, display_name, description, created_at, updated_at) VALUES ($1, $2, $3, $4, $5, $6)`,
+			[]any{orgID, "test-org", "Test Org", "Test Org", now, now},
+		},
+		{
+			`INSERT INTO users (id, username, email, hashed_password, created_at, updated_at, status, rbac_roles, login_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+			[]any{userID, "testuser", "test@example.com", []byte{}, now, now, "active", []byte("{}"), "password"},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{templateJobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "template_version_import", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO template_versions (id, organization_id, name, readme, created_at, updated_at, job_id, created_by) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+			[]any{templateVersionID, orgID, "v1.0", "Test template", now, now, templateJobID, userID},
+		},
+		{
+			`INSERT INTO templates (id, organization_id, name, created_at, updated_at, provisioner, active_version_id, created_by) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`,
+			[]any{templateID, orgID, "test-template", now, now, "terraform", templateVersionID, userID},
+		},
+		{
+			`UPDATE template_versions SET template_id = $1 WHERE id = $2`,
+			[]any{templateID, templateVersionID},
+		},
+
+		// Task workspace 1 is a normal start build.
+		{
+			`INSERT INTO workspaces (id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, last_used_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+			[]any{ws1ID, now, now, userID, orgID, templateID, false, "task-ws-1", now},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{ws1Build1JobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "workspace_build", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO workspace_resources (id, created_at, job_id, transition, type, name, hide, icon, daily_cost, instance_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws1Resource1ID, now, ws1Build1JobID, "start", "docker_container", "main", false, "", 0, ""},
+		},
+		{
+			`INSERT INTO workspace_agents (id, created_at, updated_at, name, resource_id, auth_token, architecture, operating_system, directory, connection_timeout_seconds, lifecycle_state, logs_length, logs_overflowed) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
+			[]any{ws1Agent1ID, now, now, "agent1", ws1Resource1ID, uuid.New(), "amd64", "linux", "/home/coder", 120, "ready", 0, false},
+		},
+		{
+			`INSERT INTO workspace_apps (id, created_at, agent_id, slug, display_name, icon, command, url, subdomain, external) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws1App1ID, now, ws1Agent1ID, "code-server", "Code Server", "", "", "http://localhost:8080", false, false},
+		},
+		{
+			`INSERT INTO workspace_builds (id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline, has_ai_task, ai_task_sidebar_app_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
+			[]any{ws1Build1ID, now, now, ws1ID, templateVersionID, 1, "start", userID, []byte{}, ws1Build1JobID, now.Add(8 * time.Hour), "initiator", 0, now.Add(8 * time.Hour), true, ws1App1ID},
+		},
+		{
+			`INSERT INTO workspace_build_parameters (workspace_build_id, name, value) VALUES ($1, $2, $3)`,
+			[]any{ws1Build1ID, "AI Prompt", "Build a web server"},
+		},
+		{
+			`INSERT INTO workspace_build_parameters (workspace_build_id, name, value) VALUES ($1, $2, $3)`,
+			[]any{ws1Build1ID, "region", "us-east-1"},
+		},
+		{
+			`INSERT INTO workspace_build_parameters (workspace_build_id, name, value) VALUES ($1, $2, $3)`,
+			[]any{ws1Build1ID, "instance_type", "t2.micro"},
+		},
+
+		// Task workspace 2: no AI Prompt parameter (tests LEFT JOIN).
+		{
+			`INSERT INTO workspaces (id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, last_used_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+			[]any{ws2ID, now, now, userID, orgID, templateID, false, "task-ws-2-no-prompt", now},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{ws2Build1JobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "workspace_build", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO workspace_resources (id, created_at, job_id, transition, type, name, hide, icon, daily_cost, instance_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws2Resource1ID, now, ws2Build1JobID, "start", "docker_container", "main", false, "", 0, ""},
+		},
+		{
+			`INSERT INTO workspace_agents (id, created_at, updated_at, name, resource_id, auth_token, architecture, operating_system, directory, connection_timeout_seconds, lifecycle_state, logs_length, logs_overflowed) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
+			[]any{ws2Agent1ID, now, now, "agent2", ws2Resource1ID, uuid.New(), "amd64", "linux", "/home/coder", 120, "ready", 0, false},
+		},
+		{
+			`INSERT INTO workspace_apps (id, created_at, agent_id, slug, display_name, icon, command, url, subdomain, external) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws2App1ID, now, ws2Agent1ID, "terminal", "Terminal", "", "", "http://localhost:3000", false, false},
+		},
+		{
+			`INSERT INTO workspace_builds (id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline, has_ai_task, ai_task_sidebar_app_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
+			[]any{ws2Build1ID, now, now, ws2ID, templateVersionID, 1, "start", userID, []byte{}, ws2Build1JobID, now.Add(8 * time.Hour), "initiator", 0, now.Add(8 * time.Hour), true, ws2App1ID},
+		},
+		// Note: No AI Prompt parameter for ws2 - this tests the LEFT JOIN for optional prompt.
+
+		// Task workspace 3: has both start and stop builds.
+		{
+			`INSERT INTO workspaces (id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, last_used_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+			[]any{ws3ID, now, now, userID, orgID, templateID, false, "task-ws-3-stop", now},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{ws3Build1JobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "workspace_build", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO workspace_resources (id, created_at, job_id, transition, type, name, hide, icon, daily_cost, instance_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws3Resource1ID, now, ws3Build1JobID, "start", "docker_container", "main", false, "", 0, ""},
+		},
+		{
+			`INSERT INTO workspace_agents (id, created_at, updated_at, name, resource_id, auth_token, architecture, operating_system, directory, connection_timeout_seconds, lifecycle_state, logs_length, logs_overflowed) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
+			[]any{ws3Agent1ID, now, now, "agent3", ws3Resource1ID, uuid.New(), "amd64", "linux", "/home/coder", 120, "ready", 0, false},
+		},
+		{
+			`INSERT INTO workspace_apps (id, created_at, agent_id, slug, display_name, icon, command, url, subdomain, external) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws3App1ID, now, ws3Agent1ID, "app3", "App3", "", "", "http://localhost:5000", false, false},
+		},
+		{
+			`INSERT INTO workspace_builds (id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline, has_ai_task, ai_task_sidebar_app_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
+			[]any{ws3Build1ID, now, now, ws3ID, templateVersionID, 1, "start", userID, []byte{}, ws3Build1JobID, now.Add(8 * time.Hour), "initiator", 0, now.Add(8 * time.Hour), true, ws3App1ID},
+		},
+		{
+			`INSERT INTO workspace_build_parameters (workspace_build_id, name, value) VALUES ($1, $2, $3)`,
+			[]any{ws3Build1ID, "AI Prompt", "Task with stop build"},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{ws3Build2JobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "workspace_build", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO workspace_resources (id, created_at, job_id, transition, type, name, hide, icon, daily_cost, instance_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{ws3Resource2ID, now, ws3Build2JobID, "stop", "docker_container", "main", false, "", 0, ""},
+		},
+		{
+			`INSERT INTO workspace_builds (id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline, has_ai_task, ai_task_sidebar_app_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
+			[]any{ws3Build2ID, now, now, ws3ID, templateVersionID, 2, "stop", userID, []byte{}, ws3Build2JobID, now.Add(8 * time.Hour), "initiator", 0, now.Add(8 * time.Hour), true, ws3App1ID},
+		},
+
+		// Antagonist 1: deleted workspace.
+		{
+			`INSERT INTO workspaces (id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, last_used_at, deleting_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{wsAntDeletedID, now, now, userID, orgID, templateID, true, "deleted-task-workspace", now, deletingAt},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{wsAntDeletedBuild1JobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "workspace_build", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO workspace_resources (id, created_at, job_id, transition, type, name, hide, icon, daily_cost, instance_type) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{wsAntDeletedResource1ID, now, wsAntDeletedBuild1JobID, "start", "docker_container", "main", false, "", 0, ""},
+		},
+		{
+			`INSERT INTO workspace_agents (id, created_at, updated_at, name, resource_id, auth_token, architecture, operating_system, directory, connection_timeout_seconds, lifecycle_state, logs_length, logs_overflowed) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13)`,
+			[]any{wsAntDeletedAgent1ID, now, now, "agent-deleted", wsAntDeletedResource1ID, uuid.New(), "amd64", "linux", "/home/coder", 120, "ready", 0, false},
+		},
+		{
+			`INSERT INTO workspace_apps (id, created_at, agent_id, slug, display_name, icon, command, url, subdomain, external) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10)`,
+			[]any{wsAntDeletedApp1ID, now, wsAntDeletedAgent1ID, "app-deleted", "AppDeleted", "", "", "http://localhost:6000", false, false},
+		},
+		{
+			`INSERT INTO workspace_builds (id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline, has_ai_task, ai_task_sidebar_app_id) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14, $15, $16)`,
+			[]any{wsAntDeletedBuild1ID, now, now, wsAntDeletedID, templateVersionID, 1, "start", userID, []byte{}, wsAntDeletedBuild1JobID, now.Add(8 * time.Hour), "initiator", 0, now.Add(8 * time.Hour), true, wsAntDeletedApp1ID},
+		},
+		{
+			`INSERT INTO workspace_build_parameters (workspace_build_id, name, value) VALUES ($1, $2, $3)`,
+			[]any{wsAntDeletedBuild1ID, "AI Prompt", "Should not migrate deleted"},
+		},
+
+		// Antagonist 2: regular workspace without has_ai_task.
+		{
+			`INSERT INTO workspaces (id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, last_used_at) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9)`,
+			[]any{wsAntID, now, now, userID, orgID, templateID, false, "regular-workspace", now},
+		},
+		{
+			`INSERT INTO provisioner_jobs (id, created_at, updated_at, started_at, completed_at, error, organization_id, initiator_id, provisioner, storage_method, file_id, type, input, tags) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{wsAntBuild1JobID, now, now, now, now, "", orgID, userID, "terraform", "file", uuid.New(), "workspace_build", []byte("{}"), []byte("{}")},
+		},
+		{
+			`INSERT INTO workspace_builds (id, created_at, updated_at, workspace_id, template_version_id, build_number, transition, initiator_id, provisioner_state, job_id, deadline, reason, daily_cost, max_deadline) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9, $10, $11, $12, $13, $14)`,
+			[]any{wsAntBuild1ID, now, now, wsAntID, templateVersionID, 1, "start", userID, []byte{}, wsAntBuild1JobID, now.Add(8 * time.Hour), "initiator", 0, now.Add(8 * time.Hour)},
+		},
+	}
+
+	for _, fixture := range fixtures {
+		_, err = tx.ExecContext(ctx, fixture.query, fixture.args...)
+		require.NoError(t, err)
+	}
+
+	err = tx.Commit()
+	require.NoError(t, err)
+
+	// Run the migration.
+	version, _, err := next()
+	require.NoError(t, err)
+	require.EqualValues(t, migrationVersion, version)
+
+	// Should have exactly 3 tasks (not antagonists).
+	var taskCount int
+	err = sqlDB.QueryRowContext(ctx, "SELECT COUNT(*) FROM tasks").Scan(&taskCount)
+	require.NoError(t, err)
+	require.Equal(t, 3, taskCount, "should have created 3 tasks from workspaces")
+
+	// Verify task 1, normal start build.
+	var task1 struct {
+		id                 uuid.UUID
+		name               string
+		workspaceID        uuid.UUID
+		templateVersionID  uuid.UUID
+		prompt             string
+		templateParameters []byte
+		createdAt          time.Time
+		deletedAt          *time.Time
+	}
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT id, name, workspace_id, template_version_id, prompt, template_parameters, created_at, deleted_at
+		FROM tasks WHERE workspace_id = $1
+	`, ws1ID).Scan(&task1.id, &task1.name, &task1.workspaceID, &task1.templateVersionID, &task1.prompt, &task1.templateParameters, &task1.createdAt, &task1.deletedAt)
+	require.NoError(t, err)
+	require.Equal(t, "task-ws-1", task1.name)
+	require.Equal(t, "Build a web server", task1.prompt)
+	require.JSONEq(t, `{"region":"us-east-1","instance_type":"t2.micro"}`, string(task1.templateParameters))
+	require.Nil(t, task1.deletedAt)
+
+	// Verify task_workspace_apps for task 1.
+	var twa1 struct {
+		buildNumber int32
+		agentID     uuid.UUID
+		appID       uuid.UUID
+	}
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps WHERE task_id = $1
+	`, task1.id).Scan(&twa1.buildNumber, &twa1.agentID, &twa1.appID)
+	require.NoError(t, err)
+	require.Equal(t, int32(1), twa1.buildNumber)
+	require.Equal(t, ws1Agent1ID, twa1.agentID)
+	require.Equal(t, ws1App1ID, twa1.appID)
+
+	// Verify task 2, no AI Prompt parameter.
+	var task2 struct {
+		id                 uuid.UUID
+		name               string
+		prompt             string
+		templateParameters []byte
+		deletedAt          *time.Time
+	}
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT id, name, prompt, template_parameters, deleted_at
+		FROM tasks WHERE workspace_id = $1
+	`, ws2ID).Scan(&task2.id, &task2.name, &task2.prompt, &task2.templateParameters, &task2.deletedAt)
+	require.NoError(t, err)
+	require.Equal(t, "task-ws-2-no-prompt", task2.name)
+	require.Equal(t, "", task2.prompt, "prompt should be empty string when no AI Prompt parameter")
+	require.JSONEq(t, `{}`, string(task2.templateParameters), "no parameters")
+	require.Nil(t, task2.deletedAt)
+
+	// Verify task_workspace_apps for task 2.
+	var twa2 struct {
+		buildNumber int32
+		agentID     uuid.UUID
+		appID       uuid.UUID
+	}
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps WHERE task_id = $1
+	`, task2.id).Scan(&twa2.buildNumber, &twa2.agentID, &twa2.appID)
+	require.NoError(t, err)
+	require.Equal(t, int32(1), twa2.buildNumber)
+	require.Equal(t, ws2Agent1ID, twa2.agentID)
+	require.Equal(t, ws2App1ID, twa2.appID)
+
+	// Verify task 3, has both start and stop builds.
+	var task3 struct {
+		id                 uuid.UUID
+		name               string
+		prompt             string
+		templateParameters []byte
+		templateVersionID  uuid.UUID
+		deletedAt          *time.Time
+	}
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT id, name, prompt, template_parameters, template_version_id, deleted_at
+		FROM tasks WHERE workspace_id = $1
+	`, ws3ID).Scan(&task3.id, &task3.name, &task3.prompt, &task3.templateParameters, &task3.templateVersionID, &task3.deletedAt)
+	require.NoError(t, err)
+	require.Equal(t, "task-ws-3-stop", task3.name)
+	require.Equal(t, "Task with stop build", task3.prompt)
+	require.JSONEq(t, `{}`, string(task3.templateParameters), "no other parameters")
+	require.Equal(t, templateVersionID, task3.templateVersionID)
+	require.Nil(t, task3.deletedAt)
+
+	// Verify task_workspace_apps for task 3 uses latest build and its ai_task_sidebar_app_id.
+	var twa3 struct {
+		buildNumber int32
+		agentID     uuid.UUID
+		appID       uuid.UUID
+	}
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps WHERE task_id = $1
+	`, task3.id).Scan(&twa3.buildNumber, &twa3.agentID, &twa3.appID)
+	require.NoError(t, err)
+	require.Equal(t, int32(2), twa3.buildNumber, "should use latest build number")
+	require.Equal(t, ws3Agent1ID, twa3.agentID, "should use agent from latest build's ai_task_sidebar_app_id")
+	require.Equal(t, ws3App1ID, twa3.appID, "should use app from latest build's ai_task_sidebar_app_id")
+
+	// Verify antagonists should NOT be migrated.
+	var antCount int
+	err = sqlDB.QueryRowContext(ctx, `
+		SELECT COUNT(*) FROM tasks
+		WHERE workspace_id IN ($1, $2)
+	`, wsAntDeletedID, wsAntID).Scan(&antCount)
+	require.NoError(t, err)
+	require.Equal(t, 0, antCount, "antagonist workspaces (deleted and regular) should not be migrated")
+}

From 98554605247985d5d17388e2d95f9abecc83ec51 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 19:45:18 +0300
Subject: [PATCH 218/298] feat(coderd): use new data model for task delete
 (#20334)

Updates coder/internal#976
---
 cli/exp_task_delete_test.go               |   2 -
 coderd/aitasks.go                         | 122 ++++++++++------------
 coderd/aitasks_test.go                    |   2 -
 coderd/apidoc/docs.go                     |  14 +--
 coderd/apidoc/swagger.json                |  14 +--
 coderd/coderd.go                          |  12 ++-
 coderd/database/dbauthz/dbauthz.go        |  13 +++
 coderd/database/dbauthz/dbauthz_test.go   |  10 ++
 coderd/database/dbmetrics/querymetrics.go |   7 ++
 coderd/database/dbmock/dbmock.go          |  15 +++
 coderd/database/querier.go                |   1 +
 coderd/database/queries.sql.go            |  33 ++++++
 coderd/database/queries/tasks.sql         |   9 ++
 coderd/httpmw/taskparam.go                |  57 ++++++++++
 coderd/httpmw/taskparam_test.go           | 120 +++++++++++++++++++++
 docs/reference/api/experimental.md        |  24 ++---
 16 files changed, 354 insertions(+), 101 deletions(-)
 create mode 100644 coderd/httpmw/taskparam.go
 create mode 100644 coderd/httpmw/taskparam_test.go

diff --git a/cli/exp_task_delete_test.go b/cli/exp_task_delete_test.go
index d41899067e5e2..0b288c4ca3379 100644
--- a/cli/exp_task_delete_test.go
+++ b/cli/exp_task_delete_test.go
@@ -22,8 +22,6 @@ import (
 func TestExpTaskDelete(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 	type testCounters struct {
 		deleteCalls  atomic.Int64
 		nameResolves atomic.Int64
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 4fd49d73eeeca..2accd3671221e 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -593,9 +593,9 @@ func (api *API) tasksList(rw http.ResponseWriter, r *http.Request) {
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
-// @Param id path string true "Task ID" format(uuid)
+// @Param task path string true "Task ID" format(uuid)
 // @Success 200 {object} codersdk.Task
-// @Router /api/experimental/tasks/{user}/{id} [get]
+// @Router /api/experimental/tasks/{user}/{task} [get]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskGet is an experimental endpoint to fetch a single AI task by ID
@@ -605,7 +605,7 @@ func (api *API) taskGet(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
 
-	idStr := chi.URLParam(r, "id")
+	idStr := chi.URLParam(r, "task")
 	taskID, err := uuid.Parse(idStr)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -710,83 +710,71 @@ func (api *API) taskGet(rw http.ResponseWriter, r *http.Request) {
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
-// @Param id path string true "Task ID" format(uuid)
+// @Param task path string true "Task ID" format(uuid)
 // @Success 202 "Task deletion initiated"
-// @Router /api/experimental/tasks/{user}/{id} [delete]
+// @Router /api/experimental/tasks/{user}/{task} [delete]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
-// taskDelete is an experimental endpoint to delete a task by ID (workspace ID).
+// taskDelete is an experimental endpoint to delete a task by ID.
 // It creates a delete workspace build and returns 202 Accepted if the build was
 // created.
 func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
+	task := httpmw.TaskParam(r)
 
-	idStr := chi.URLParam(r, "id")
-	taskID, err := uuid.Parse(idStr)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("Invalid UUID %q for task ID.", idStr),
-		})
-		return
-	}
+	now := api.Clock.Now()
 
-	// For now, taskID = workspaceID, once we have a task data model in
-	// the DB, we can change this lookup.
-	workspaceID := taskID
-	workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceID)
-	if httpapi.Is404Error(err) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace.",
-			Detail:  err.Error(),
-		})
-		return
+	if task.WorkspaceID.Valid {
+		workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
+		if err != nil {
+			if httpapi.Is404Error(err) {
+				httpapi.ResourceNotFound(rw)
+				return
+			}
+			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+				Message: "Internal error fetching task workspace before deleting task.",
+				Detail:  err.Error(),
+			})
+			return
+		}
+
+		// Construct a request to the workspace build creation handler to
+		// initiate deletion.
+		buildReq := codersdk.CreateWorkspaceBuildRequest{
+			Transition: codersdk.WorkspaceTransitionDelete,
+			Reason:     "Deleted via tasks API",
+		}
+
+		_, err = api.postWorkspaceBuildsInternal(
+			ctx,
+			apiKey,
+			workspace,
+			buildReq,
+			func(action policy.Action, object rbac.Objecter) bool {
+				return api.Authorize(r, action, object)
+			},
+			audit.WorkspaceBuildBaggageFromRequest(r),
+		)
+		if err != nil {
+			httperror.WriteWorkspaceBuildError(ctx, rw, err)
+			return
+		}
 	}
 
-	data, err := api.workspaceData(ctx, []database.Workspace{workspace})
+	_, err := api.Database.DeleteTask(ctx, database.DeleteTaskParams{
+		ID:        task.ID,
+		DeletedAt: dbtime.Time(now),
+	})
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace resources.",
+			Message: "Failed to delete task",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	if len(data.builds) == 0 || len(data.templates) == 0 {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-	if data.builds[0].HasAITask == nil || !*data.builds[0].HasAITask {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
-
-	// Construct a request to the workspace build creation handler to
-	// initiate deletion.
-	buildReq := codersdk.CreateWorkspaceBuildRequest{
-		Transition: codersdk.WorkspaceTransitionDelete,
-		Reason:     "Deleted via tasks API",
-	}
-
-	_, err = api.postWorkspaceBuildsInternal(
-		ctx,
-		apiKey,
-		workspace,
-		buildReq,
-		func(action policy.Action, object rbac.Objecter) bool {
-			return api.Authorize(r, action, object)
-		},
-		audit.WorkspaceBuildBaggageFromRequest(r),
-	)
-	if err != nil {
-		httperror.WriteWorkspaceBuildError(ctx, rw, err)
-		return
-	}
 
-	// Delete build created successfully.
+	// Task deleted and delete build created successfully.
 	rw.WriteHeader(http.StatusAccepted)
 }
 
@@ -796,10 +784,10 @@ func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
-// @Param id path string true "Task ID" format(uuid)
+// @Param task path string true "Task ID" format(uuid)
 // @Param request body codersdk.TaskSendRequest true "Task input request"
 // @Success 204 "Input sent successfully"
-// @Router /api/experimental/tasks/{user}/{id}/send [post]
+// @Router /api/experimental/tasks/{user}/{task}/send [post]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskSend submits task input to the tasks sidebar app by dialing the agent
@@ -808,7 +796,7 @@ func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 
-	idStr := chi.URLParam(r, "id")
+	idStr := chi.URLParam(r, "task")
 	taskID, err := uuid.Parse(idStr)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
@@ -878,9 +866,9 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param user path string true "Username, user ID, or 'me' for the authenticated user"
-// @Param id path string true "Task ID" format(uuid)
+// @Param task path string true "Task ID" format(uuid)
 // @Success 200 {object} codersdk.TaskLogsResponse
-// @Router /api/experimental/tasks/{user}/{id}/logs [get]
+// @Router /api/experimental/tasks/{user}/{task}/logs [get]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskLogs reads task output by dialing the agent directly over the tailnet.
@@ -888,7 +876,7 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 
-	idStr := chi.URLParam(r, "id")
+	idStr := chi.URLParam(r, "task")
 	taskID, err := uuid.Parse(idStr)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index d0ff421c5237a..5623eb307673d 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -343,8 +343,6 @@ func TestTasks(t *testing.T) {
 	t.Run("Delete", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		t.Run("OK", func(t *testing.T) {
 			t.Parallel()
 
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index e7afae463bb62..d6ba1d081d413 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -229,7 +229,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/api/experimental/tasks/{user}/{id}": {
+        "/api/experimental/tasks/{user}/{task}": {
             "get": {
                 "security": [
                     {
@@ -253,7 +253,7 @@ const docTemplate = `{
                         "type": "string",
                         "format": "uuid",
                         "description": "Task ID",
-                        "name": "id",
+                        "name": "task",
                         "in": "path",
                         "required": true
                     }
@@ -290,7 +290,7 @@ const docTemplate = `{
                         "type": "string",
                         "format": "uuid",
                         "description": "Task ID",
-                        "name": "id",
+                        "name": "task",
                         "in": "path",
                         "required": true
                     }
@@ -302,7 +302,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/api/experimental/tasks/{user}/{id}/logs": {
+        "/api/experimental/tasks/{user}/{task}/logs": {
             "get": {
                 "security": [
                     {
@@ -326,7 +326,7 @@ const docTemplate = `{
                         "type": "string",
                         "format": "uuid",
                         "description": "Task ID",
-                        "name": "id",
+                        "name": "task",
                         "in": "path",
                         "required": true
                     }
@@ -341,7 +341,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/api/experimental/tasks/{user}/{id}/send": {
+        "/api/experimental/tasks/{user}/{task}/send": {
             "post": {
                 "security": [
                     {
@@ -365,7 +365,7 @@ const docTemplate = `{
                         "type": "string",
                         "format": "uuid",
                         "description": "Task ID",
-                        "name": "id",
+                        "name": "task",
                         "in": "path",
                         "required": true
                     },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 9c7c217b3d854..bf363ba78b80e 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -201,7 +201,7 @@
 				}
 			}
 		},
-		"/api/experimental/tasks/{user}/{id}": {
+		"/api/experimental/tasks/{user}/{task}": {
 			"get": {
 				"security": [
 					{
@@ -223,7 +223,7 @@
 						"type": "string",
 						"format": "uuid",
 						"description": "Task ID",
-						"name": "id",
+						"name": "task",
 						"in": "path",
 						"required": true
 					}
@@ -258,7 +258,7 @@
 						"type": "string",
 						"format": "uuid",
 						"description": "Task ID",
-						"name": "id",
+						"name": "task",
 						"in": "path",
 						"required": true
 					}
@@ -270,7 +270,7 @@
 				}
 			}
 		},
-		"/api/experimental/tasks/{user}/{id}/logs": {
+		"/api/experimental/tasks/{user}/{task}/logs": {
 			"get": {
 				"security": [
 					{
@@ -292,7 +292,7 @@
 						"type": "string",
 						"format": "uuid",
 						"description": "Task ID",
-						"name": "id",
+						"name": "task",
 						"in": "path",
 						"required": true
 					}
@@ -307,7 +307,7 @@
 				}
 			}
 		},
-		"/api/experimental/tasks/{user}/{id}/send": {
+		"/api/experimental/tasks/{user}/{task}/send": {
 			"post": {
 				"security": [
 					{
@@ -329,7 +329,7 @@
 						"type": "string",
 						"format": "uuid",
 						"description": "Task ID",
-						"name": "id",
+						"name": "task",
 						"in": "path",
 						"required": true
 					},
diff --git a/coderd/coderd.go b/coderd/coderd.go
index fd1cdccff3e00..a1f94bfa6fee7 100644
--- a/coderd/coderd.go
+++ b/coderd/coderd.go
@@ -1032,11 +1032,15 @@ func New(options *Options) *API {
 
 			r.Route("/{user}", func(r chi.Router) {
 				r.Use(httpmw.ExtractOrganizationMembersParam(options.Database, api.HTTPAuth.Authorize))
-				r.Get("/{id}", api.taskGet)
-				r.Delete("/{id}", api.taskDelete)
-				r.Post("/{id}/send", api.taskSend)
-				r.Get("/{id}/logs", api.taskLogs)
 				r.Post("/", api.tasksCreate)
+
+				r.Route("/{task}", func(r chi.Router) {
+					r.Use(httpmw.ExtractTaskParam(options.Database))
+					r.Get("/", api.taskGet)
+					r.Delete("/", api.taskDelete)
+					r.Post("/send", api.taskSend)
+					r.Get("/logs", api.taskLogs)
+				})
 			})
 		})
 		r.Route("/mcp", func(r chi.Router) {
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 110e63f92804c..52089e55c594a 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -1798,6 +1798,19 @@ func (q *querier) DeleteTailnetTunnel(ctx context.Context, arg database.DeleteTa
 	return q.db.DeleteTailnetTunnel(ctx, arg)
 }
 
+func (q *querier) DeleteTask(ctx context.Context, arg database.DeleteTaskParams) (database.TaskTable, error) {
+	task, err := q.db.GetTaskByID(ctx, arg.ID)
+	if err != nil {
+		return database.TaskTable{}, err
+	}
+
+	if err := q.authorizeContext(ctx, policy.ActionDelete, task.RBACObject()); err != nil {
+		return database.TaskTable{}, err
+	}
+
+	return q.db.DeleteTask(ctx, arg)
+}
+
 func (q *querier) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
 	// First get the secret to check ownership
 	secret, err := q.GetUserSecret(ctx, id)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 94970e4657c2f..070da4f2782af 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -2362,6 +2362,16 @@ func (s *MethodTestSuite) TestTasks() {
 		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
 		check.Args(task.ID).Asserts(task, policy.ActionRead).Returns(task)
 	}))
+	s.Run("DeleteTask", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		task := testutil.Fake(s.T(), faker, database.Task{})
+		arg := database.DeleteTaskParams{
+			ID:        task.ID,
+			DeletedAt: dbtime.Now(),
+		}
+		dbm.EXPECT().GetTaskByID(gomock.Any(), task.ID).Return(task, nil).AnyTimes()
+		dbm.EXPECT().DeleteTask(gomock.Any(), arg).Return(database.TaskTable{}, nil).AnyTimes()
+		check.Args(arg).Asserts(task, policy.ActionDelete).Returns(database.TaskTable{})
+	}))
 	s.Run("InsertTask", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		tpl := testutil.Fake(s.T(), faker, database.Template{})
 		tv := testutil.Fake(s.T(), faker, database.TemplateVersion{
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 8f5efaa853994..a61d05cdef18a 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -474,6 +474,13 @@ func (m queryMetricsStore) DeleteTailnetTunnel(ctx context.Context, arg database
 	return r0, r1
 }
 
+func (m queryMetricsStore) DeleteTask(ctx context.Context, arg database.DeleteTaskParams) (database.TaskTable, error) {
+	start := time.Now()
+	r0, r1 := m.s.DeleteTask(ctx, arg)
+	m.queryLatencies.WithLabelValues("DeleteTask").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
 	start := time.Now()
 	r0 := m.s.DeleteUserSecret(ctx, id)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index acaa2a8c5e8be..157883c6dfd87 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -880,6 +880,21 @@ func (mr *MockStoreMockRecorder) DeleteTailnetTunnel(ctx, arg any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteTailnetTunnel", reflect.TypeOf((*MockStore)(nil).DeleteTailnetTunnel), ctx, arg)
 }
 
+// DeleteTask mocks base method.
+func (m *MockStore) DeleteTask(ctx context.Context, arg database.DeleteTaskParams) (database.TaskTable, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteTask", ctx, arg)
+	ret0, _ := ret[0].(database.TaskTable)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// DeleteTask indicates an expected call of DeleteTask.
+func (mr *MockStoreMockRecorder) DeleteTask(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteTask", reflect.TypeOf((*MockStore)(nil).DeleteTask), ctx, arg)
+}
+
 // DeleteUserSecret mocks base method.
 func (m *MockStore) DeleteUserSecret(ctx context.Context, id uuid.UUID) error {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index f625fc0b09483..a1c612078008d 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -120,6 +120,7 @@ type sqlcQuerier interface {
 	DeleteTailnetClientSubscription(ctx context.Context, arg DeleteTailnetClientSubscriptionParams) error
 	DeleteTailnetPeer(ctx context.Context, arg DeleteTailnetPeerParams) (DeleteTailnetPeerRow, error)
 	DeleteTailnetTunnel(ctx context.Context, arg DeleteTailnetTunnelParams) (DeleteTailnetTunnelRow, error)
+	DeleteTask(ctx context.Context, arg DeleteTaskParams) (TaskTable, error)
 	DeleteUserSecret(ctx context.Context, id uuid.UUID) error
 	DeleteWebpushSubscriptionByUserIDAndEndpoint(ctx context.Context, arg DeleteWebpushSubscriptionByUserIDAndEndpointParams) error
 	DeleteWebpushSubscriptions(ctx context.Context, ids []uuid.UUID) error
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 77f3ae50d346c..55bb5953d350e 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12581,6 +12581,39 @@ func (q *sqlQuerier) UpsertTailnetTunnel(ctx context.Context, arg UpsertTailnetT
 	return i, err
 }
 
+const deleteTask = `-- name: DeleteTask :one
+UPDATE tasks
+SET
+	deleted_at = $1::timestamptz
+WHERE
+	id = $2::uuid
+	AND deleted_at IS NULL
+RETURNING id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at
+`
+
+type DeleteTaskParams struct {
+	DeletedAt time.Time `db:"deleted_at" json:"deleted_at"`
+	ID        uuid.UUID `db:"id" json:"id"`
+}
+
+func (q *sqlQuerier) DeleteTask(ctx context.Context, arg DeleteTaskParams) (TaskTable, error) {
+	row := q.db.QueryRowContext(ctx, deleteTask, arg.DeletedAt, arg.ID)
+	var i TaskTable
+	err := row.Scan(
+		&i.ID,
+		&i.OrganizationID,
+		&i.OwnerID,
+		&i.Name,
+		&i.WorkspaceID,
+		&i.TemplateVersionID,
+		&i.TemplateParameters,
+		&i.Prompt,
+		&i.CreatedAt,
+		&i.DeletedAt,
+	)
+	return i, err
+}
+
 const getTaskByID = `-- name: GetTaskByID :one
 SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status WHERE id = $1::uuid
 `
diff --git a/coderd/database/queries/tasks.sql b/coderd/database/queries/tasks.sql
index 5e466ea10fdd4..9e83a9f87aaef 100644
--- a/coderd/database/queries/tasks.sql
+++ b/coderd/database/queries/tasks.sql
@@ -47,3 +47,12 @@ WHERE tws.deleted_at IS NULL
 AND CASE WHEN @owner_id::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = @owner_id::UUID ELSE TRUE END
 AND CASE WHEN @organization_id::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = @organization_id::UUID ELSE TRUE END
 ORDER BY tws.created_at DESC;
+
+-- name: DeleteTask :one
+UPDATE tasks
+SET
+	deleted_at = @deleted_at::timestamptz
+WHERE
+	id = @id::uuid
+	AND deleted_at IS NULL
+RETURNING *;
diff --git a/coderd/httpmw/taskparam.go b/coderd/httpmw/taskparam.go
new file mode 100644
index 0000000000000..6ecc888b378fe
--- /dev/null
+++ b/coderd/httpmw/taskparam.go
@@ -0,0 +1,57 @@
+package httpmw
+
+import (
+	"context"
+	"net/http"
+
+	"cdr.dev/slog"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/httpapi"
+	"github.com/coder/coder/v2/coderd/httpmw/loggermw"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+type taskParamContextKey struct{}
+
+// TaskParam returns the task from the ExtractTaskParam handler.
+func TaskParam(r *http.Request) database.Task {
+	task, ok := r.Context().Value(taskParamContextKey{}).(database.Task)
+	if !ok {
+		panic("developer error: task param middleware not provided")
+	}
+	return task
+}
+
+// ExtractTaskParam grabs a task from the "task" URL parameter by UUID.
+func ExtractTaskParam(db database.Store) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
+			ctx := r.Context()
+			taskID, parsed := ParseUUIDParam(rw, r, "task")
+			if !parsed {
+				return
+			}
+			task, err := db.GetTaskByID(ctx, taskID)
+			if err != nil {
+				if httpapi.Is404Error(err) {
+					httpapi.ResourceNotFound(rw)
+					return
+				}
+				httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+					Message: "Internal error fetching task.",
+					Detail:  err.Error(),
+				})
+				return
+			}
+
+			ctx = context.WithValue(ctx, taskParamContextKey{}, task)
+
+			if rlogger := loggermw.RequestLoggerFromContext(ctx); rlogger != nil {
+				rlogger.WithFields(slog.F("task_id", task.ID), slog.F("task_name", task.Name))
+			}
+
+			next.ServeHTTP(rw, r.WithContext(ctx))
+		})
+	}
+}
diff --git a/coderd/httpmw/taskparam_test.go b/coderd/httpmw/taskparam_test.go
new file mode 100644
index 0000000000000..559ccc2a2df2d
--- /dev/null
+++ b/coderd/httpmw/taskparam_test.go
@@ -0,0 +1,120 @@
+package httpmw_test
+
+import (
+	"context"
+	"net/http"
+	"net/http/httptest"
+	"testing"
+
+	"github.com/go-chi/chi/v5"
+	"github.com/google/uuid"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/httpmw"
+	"github.com/coder/coder/v2/codersdk"
+)
+
+func TestTaskParam(t *testing.T) {
+	t.Parallel()
+
+	setup := func(db database.Store) (*http.Request, database.User) {
+		user := dbgen.User(t, db, database.User{})
+		_, token := dbgen.APIKey(t, db, database.APIKey{
+			UserID: user.ID,
+		})
+
+		r := httptest.NewRequest("GET", "/", nil)
+		r.Header.Set(codersdk.SessionTokenHeader, token)
+
+		ctx := chi.NewRouteContext()
+		ctx.URLParams.Add("user", "me")
+		r = r.WithContext(context.WithValue(r.Context(), chi.RouteCtxKey, ctx))
+		return r, user
+	}
+
+	t.Run("None", func(t *testing.T) {
+		t.Parallel()
+		db, _ := dbtestutil.NewDB(t)
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractTaskParam(db))
+		rtr.Get("/", nil)
+		r, _ := setup(db)
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusBadRequest, res.StatusCode)
+	})
+
+	t.Run("NotFound", func(t *testing.T) {
+		t.Parallel()
+		db, _ := dbtestutil.NewDB(t)
+		rtr := chi.NewRouter()
+		rtr.Use(httpmw.ExtractTaskParam(db))
+		rtr.Get("/", nil)
+		r, _ := setup(db)
+		chi.RouteContext(r.Context()).URLParams.Add("task", uuid.NewString())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusNotFound, res.StatusCode)
+	})
+
+	t.Run("Found", func(t *testing.T) {
+		t.Parallel()
+		db, _ := dbtestutil.NewDB(t)
+		rtr := chi.NewRouter()
+		rtr.Use(
+			httpmw.ExtractAPIKeyMW(httpmw.ExtractAPIKeyConfig{
+				DB:              db,
+				RedirectToLogin: false,
+			}),
+			httpmw.ExtractTaskParam(db),
+		)
+		rtr.Get("/", func(rw http.ResponseWriter, r *http.Request) {
+			_ = httpmw.TaskParam(r)
+			rw.WriteHeader(http.StatusOK)
+		})
+		r, user := setup(db)
+		org := dbgen.Organization(t, db, database.Organization{})
+		tpl := dbgen.Template(t, db, database.Template{
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+		})
+		tv := dbgen.TemplateVersion(t, db, database.TemplateVersion{
+			TemplateID: uuid.NullUUID{
+				UUID:  tpl.ID,
+				Valid: true,
+			},
+			OrganizationID: org.ID,
+			CreatedBy:      user.ID,
+		})
+		workspace := dbgen.Workspace(t, db, database.WorkspaceTable{
+			OwnerID:        user.ID,
+			Name:           "test-workspace",
+			OrganizationID: org.ID,
+			TemplateID:     tpl.ID,
+		})
+		task := dbgen.Task(t, db, database.TaskTable{
+			Name:              "test-task",
+			OrganizationID:    org.ID,
+			OwnerID:           user.ID,
+			TemplateVersionID: tv.ID,
+			WorkspaceID:       uuid.NullUUID{UUID: workspace.ID, Valid: true},
+			Prompt:            "test prompt",
+		})
+		chi.RouteContext(r.Context()).URLParams.Add("task", task.ID.String())
+		rw := httptest.NewRecorder()
+		rtr.ServeHTTP(rw, r)
+
+		res := rw.Result()
+		defer res.Body.Close()
+		require.Equal(t, http.StatusOK, res.StatusCode)
+	})
+}
diff --git a/docs/reference/api/experimental.md b/docs/reference/api/experimental.md
index edf6b729d83a8..e164e37aa5cb9 100644
--- a/docs/reference/api/experimental.md
+++ b/docs/reference/api/experimental.md
@@ -84,19 +84,19 @@ To perform this operation, you must be authenticated. [Learn more](authenticatio
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id} \
+curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{task} \
   -H 'Accept: */*' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`GET /api/experimental/tasks/{user}/{id}`
+`GET /api/experimental/tasks/{user}/{task}`
 
 ### Parameters
 
 | Name   | In   | Type         | Required | Description                                           |
 |--------|------|--------------|----------|-------------------------------------------------------|
 | `user` | path | string       | true     | Username, user ID, or 'me' for the authenticated user |
-| `id`   | path | string(uuid) | true     | Task ID                                               |
+| `task` | path | string(uuid) | true     | Task ID                                               |
 
 ### Example responses
 
@@ -116,18 +116,18 @@ To perform this operation, you must be authenticated. [Learn more](authenticatio
 
 ```shell
 # Example request using curl
-curl -X DELETE http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id} \
+curl -X DELETE http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{task} \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`DELETE /api/experimental/tasks/{user}/{id}`
+`DELETE /api/experimental/tasks/{user}/{task}`
 
 ### Parameters
 
 | Name   | In   | Type         | Required | Description                                           |
 |--------|------|--------------|----------|-------------------------------------------------------|
 | `user` | path | string       | true     | Username, user ID, or 'me' for the authenticated user |
-| `id`   | path | string(uuid) | true     | Task ID                                               |
+| `task` | path | string(uuid) | true     | Task ID                                               |
 
 ### Responses
 
@@ -143,19 +143,19 @@ To perform this operation, you must be authenticated. [Learn more](authenticatio
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id}/logs \
+curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{task}/logs \
   -H 'Accept: */*' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`GET /api/experimental/tasks/{user}/{id}/logs`
+`GET /api/experimental/tasks/{user}/{task}/logs`
 
 ### Parameters
 
 | Name   | In   | Type         | Required | Description                                           |
 |--------|------|--------------|----------|-------------------------------------------------------|
 | `user` | path | string       | true     | Username, user ID, or 'me' for the authenticated user |
-| `id`   | path | string(uuid) | true     | Task ID                                               |
+| `task` | path | string(uuid) | true     | Task ID                                               |
 
 ### Example responses
 
@@ -175,12 +175,12 @@ To perform this operation, you must be authenticated. [Learn more](authenticatio
 
 ```shell
 # Example request using curl
-curl -X POST http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id}/send \
+curl -X POST http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{task}/send \
   -H 'Content-Type: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`POST /api/experimental/tasks/{user}/{id}/send`
+`POST /api/experimental/tasks/{user}/{task}/send`
 
 > Body parameter
 
@@ -195,7 +195,7 @@ curl -X POST http://coder-server:8080/api/v2/api/experimental/tasks/{user}/{id}/
 | Name   | In   | Type                                                           | Required | Description                                           |
 |--------|------|----------------------------------------------------------------|----------|-------------------------------------------------------|
 | `user` | path | string                                                         | true     | Username, user ID, or 'me' for the authenticated user |
-| `id`   | path | string(uuid)                                                   | true     | Task ID                                               |
+| `task` | path | string(uuid)                                                   | true     | Task ID                                               |
 | `body` | body | [codersdk.TaskSendRequest](schemas.md#codersdktasksendrequest) | true     | Task input request                                    |
 
 ### Responses

From c6f63990cf00ba74b8108e0f36929c5aff48084c Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 19:58:47 +0300
Subject: [PATCH 219/298] feat(coderd): use task data model when fetching a
 task (#20380)

Updates coder/internal#976
---
 cli/exp_task_status_test.go | 19 +++++++++--
 coderd/aitasks.go           | 64 +++++++------------------------------
 coderd/aitasks_test.go      | 51 ++++++++++++++++-------------
 3 files changed, 56 insertions(+), 78 deletions(-)

diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index 2ae31ad33c558..d5b4e0a9d668b 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -24,8 +24,6 @@ import (
 func Test_TaskStatus(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 	for _, tc := range []struct {
 		args         []string
 		expectOutput string
@@ -90,7 +88,9 @@ func Test_TaskStatus(t *testing.T) {
 								Healthy: true,
 							},
 							WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
+							Status:                  codersdk.TaskStatusActive,
 						})
+						return
 					default:
 						t.Errorf("unexpected path: %s", r.URL.Path)
 					}
@@ -125,7 +125,9 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 									Healthy: true,
 								},
 								WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
+								Status:                  codersdk.TaskStatusPending,
 							})
+							return
 						case 1:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
 								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
@@ -136,7 +138,9 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 								},
 								WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
 								UpdatedAt:               now.Add(-4 * time.Second),
+								Status:                  codersdk.TaskStatusActive,
 							})
+							return
 						case 2:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
 								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
@@ -152,7 +156,9 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 									Timestamp: now.Add(-3 * time.Second),
 									Message:   "Reticulating splines...",
 								},
+								Status: codersdk.TaskStatusActive,
 							})
+							return
 						case 3:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
 								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
@@ -168,13 +174,16 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 									Timestamp: now.Add(-2 * time.Second),
 									Message:   "Splines reticulated successfully!",
 								},
+								Status: codersdk.TaskStatusActive,
 							})
+							return
 						default:
 							httpapi.InternalServerError(w, xerrors.New("too many calls!"))
 							return
 						}
 					default:
 						httpapi.InternalServerError(w, xerrors.Errorf("unexpected path: %q", r.URL.Path))
+						return
 					}
 				}
 			},
@@ -188,16 +197,18 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "owner_name": "",
   "name": "",
   "template_id": "00000000-0000-0000-0000-000000000000",
+  "template_version_id": "00000000-0000-0000-0000-000000000000",
   "template_name": "",
   "template_display_name": "",
   "template_icon": "",
   "workspace_id": null,
+  "workspace_status": "running",
   "workspace_agent_id": null,
   "workspace_agent_lifecycle": null,
   "workspace_agent_health": null,
   "workspace_app_id": null,
   "initial_prompt": "",
-  "status": "running",
+  "status": "active",
   "current_state": {
     "timestamp": "2025-08-26T12:34:57Z",
     "state": "working",
@@ -226,7 +237,9 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 								Timestamp: ts.Add(time.Second),
 								Message:   "Thinking furiously...",
 							},
+							Status: codersdk.TaskStatusActive,
 						})
+						return
 					default:
 						t.Errorf("unexpected path: %s", r.URL.Path)
 					}
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 2accd3671221e..2f3dd74ad2414 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -25,7 +25,6 @@ import (
 	"github.com/coder/coder/v2/coderd/rbac/policy"
 	"github.com/coder/coder/v2/coderd/searchquery"
 	"github.com/coder/coder/v2/coderd/taskname"
-	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
 
 	aiagentapi "github.com/coder/agentapi-sdk-go"
@@ -604,25 +603,22 @@ func (api *API) tasksList(rw http.ResponseWriter, r *http.Request) {
 func (api *API) taskGet(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
+	task := httpmw.TaskParam(r)
 
-	idStr := chi.URLParam(r, "task")
-	taskID, err := uuid.Parse(idStr)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("Invalid UUID %q for task ID.", idStr),
+	if !task.WorkspaceID.Valid {
+		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
+			Message: "Internal error fetching task.",
+			Detail:  "Task workspace ID is invalid.",
 		})
 		return
 	}
 
-	// For now, taskID = workspaceID, once we have a task data model in
-	// the DB, we can change this lookup.
-	workspaceID := taskID
-	workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceID)
-	if httpapi.Is404Error(err) {
-		httpapi.ResourceNotFound(rw)
-		return
-	}
+	workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
 	if err != nil {
+		if httpapi.Is404Error(err) {
+			httpapi.ResourceNotFound(rw)
+			return
+		}
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error fetching workspace.",
 			Detail:  err.Error(),
@@ -642,34 +638,6 @@ func (api *API) taskGet(rw http.ResponseWriter, r *http.Request) {
 		httpapi.ResourceNotFound(rw)
 		return
 	}
-	if data.builds[0].HasAITask == nil || !*data.builds[0].HasAITask {
-		// TODO(DanielleMaywood):
-		// This is a temporary workaround. When a task has just been created, but
-		// not yet provisioned, the workspace build will not have `HasAITask` set.
-		//
-		// When we reach this code flow, it is _either_ because the workspace is
-		// not a task, or it is a task that has not yet been provisioned. This
-		// endpoint should rarely be called with a non-task workspace so we
-		// should be fine with this extra database call to check if it has the
-		// special "AI Task" parameter.
-		parameters, err := api.Database.GetWorkspaceBuildParameters(ctx, data.builds[0].ID)
-		if err != nil {
-			httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-				Message: "Internal error fetching workspace build parameters.",
-				Detail:  err.Error(),
-			})
-			return
-		}
-
-		_, hasAITask := slice.Find(parameters, func(t database.WorkspaceBuildParameter) bool {
-			return t.Name == codersdk.AITaskPromptParameterName
-		})
-
-		if !hasAITask {
-			httpapi.ResourceNotFound(rw)
-			return
-		}
-	}
 
 	appStatus := codersdk.WorkspaceAppStatus{}
 	if len(data.appStatuses) > 0 {
@@ -692,16 +660,8 @@ func (api *API) taskGet(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	tasks, err := api.tasksFromWorkspaces(ctx, []codersdk.Workspace{ws})
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching task prompt and state.",
-			Detail:  err.Error(),
-		})
-		return
-	}
-
-	httpapi.Write(ctx, rw, http.StatusOK, tasks[0])
+	taskResp := taskFromDBTaskAndWorkspace(task, ws)
+	httpapi.Write(ctx, rw, http.StatusOK, taskResp)
 }
 
 // @Summary Delete AI task by ID
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 5623eb307673d..c7db4f58c6e68 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -274,24 +274,27 @@ func TestTasks(t *testing.T) {
 	t.Run("Get", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		var (
 			client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			ctx        = testutil.Context(t, testutil.WaitLong)
 			user       = coderdtest.CreateFirstUser(t, client)
 			template   = createAITemplate(t, client, user)
-			// Create a workspace (task) with a specific prompt.
 			wantPrompt = "review my code"
-			workspace  = coderdtest.CreateWorkspace(t, client, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-				req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-					{Name: codersdk.AITaskPromptParameterName, Value: wantPrompt},
-				}
-			})
+			exp        = codersdk.NewExperimentalClient(client)
 		)
 
-		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
-		ws := coderdtest.MustWorkspace(t, client, workspace.ID)
+		task, err := exp.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             wantPrompt,
+		})
+		require.NoError(t, err)
+		require.True(t, task.WorkspaceID.Valid)
+
+		// Get the workspace and wait for it to be ready.
+		ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+		require.NoError(t, err)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+		ws = coderdtest.MustWorkspace(t, client, task.WorkspaceID.UUID)
 		// Assert invariant: the workspace has exactly one resource with one agent with one app.
 		require.Len(t, ws.LatestBuild.Resources, 1)
 		require.Len(t, ws.LatestBuild.Resources[0].Agents, 1)
@@ -299,9 +302,9 @@ func TestTasks(t *testing.T) {
 		taskAppID := ws.LatestBuild.Resources[0].Agents[0].Apps[0].ID
 
 		// Insert an app status for the workspace
-		_, err := db.InsertWorkspaceAppStatus(dbauthz.AsSystemRestricted(ctx), database.InsertWorkspaceAppStatusParams{
+		_, err = db.InsertWorkspaceAppStatus(dbauthz.AsSystemRestricted(ctx), database.InsertWorkspaceAppStatusParams{
 			ID:          uuid.New(),
-			WorkspaceID: workspace.ID,
+			WorkspaceID: task.WorkspaceID.UUID,
 			CreatedAt:   dbtime.Now(),
 			AgentID:     agentID,
 			AppID:       taskAppID,
@@ -311,31 +314,33 @@ func TestTasks(t *testing.T) {
 		require.NoError(t, err)
 
 		// Fetch the task by ID via experimental API and verify fields.
-		exp := codersdk.NewExperimentalClient(client)
-		task, err := exp.TaskByID(ctx, workspace.ID)
+		updated, err := exp.TaskByID(ctx, task.ID)
 		require.NoError(t, err)
 
-		assert.Equal(t, workspace.ID, task.ID, "task ID should match workspace ID")
-		assert.Equal(t, workspace.Name, task.Name, "task name should map from workspace name")
-		assert.Equal(t, wantPrompt, task.InitialPrompt, "task prompt should match the AI Prompt parameter")
-		assert.Equal(t, workspace.ID, task.WorkspaceID.UUID, "workspace id should match")
-		assert.NotEmpty(t, task.WorkspaceStatus, "task status should not be empty")
+		assert.Equal(t, task.ID, updated.ID, "task ID should match")
+		assert.Equal(t, task.Name, updated.Name, "task name should match")
+		assert.Equal(t, wantPrompt, updated.InitialPrompt, "task prompt should match the AI Prompt parameter")
+		assert.Equal(t, task.WorkspaceID.UUID, updated.WorkspaceID.UUID, "workspace id should match")
+		assert.Equal(t, ws.LatestBuild.BuildNumber, updated.WorkspaceBuildNumber, "workspace build number should match")
+		assert.Equal(t, agentID, updated.WorkspaceAgentID.UUID, "workspace agent id should match")
+		assert.Equal(t, taskAppID, updated.WorkspaceAppID.UUID, "workspace app id should match")
+		assert.NotEmpty(t, updated.WorkspaceStatus, "task status should not be empty")
 
 		// Stop the workspace
-		coderdtest.MustTransitionWorkspace(t, client, workspace.ID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionStop)
+		coderdtest.MustTransitionWorkspace(t, client, task.WorkspaceID.UUID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionStop)
 
 		// Verify that the previous status still remains
-		updated, err := exp.TaskByID(ctx, workspace.ID)
+		updated, err = exp.TaskByID(ctx, task.ID)
 		require.NoError(t, err)
 		assert.NotNil(t, updated.CurrentState, "current state should not be nil")
 		assert.Equal(t, "all done", updated.CurrentState.Message)
 		assert.Equal(t, codersdk.TaskStateComplete, updated.CurrentState.State)
 
 		// Start the workspace again
-		coderdtest.MustTransitionWorkspace(t, client, workspace.ID, codersdk.WorkspaceTransitionStop, codersdk.WorkspaceTransitionStart)
+		coderdtest.MustTransitionWorkspace(t, client, task.WorkspaceID.UUID, codersdk.WorkspaceTransitionStop, codersdk.WorkspaceTransitionStart)
 
 		// Verify that the status from the previous build is no longer present
-		updated, err = exp.TaskByID(ctx, workspace.ID)
+		updated, err = exp.TaskByID(ctx, task.ID)
 		require.NoError(t, err)
 		assert.Nil(t, updated.CurrentState, "current state should be nil")
 	})

From 1cb2ac65e58acad77d66fc25fb02175997597e0d Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Thu, 23 Oct 2025 22:02:34 +0500
Subject: [PATCH 220/298] chore: remove a redundant letter from docs (#20443)

---
 docs/user-guides/workspace-access/remote-desktops.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/user-guides/workspace-access/remote-desktops.md b/docs/user-guides/workspace-access/remote-desktops.md
index 71d5944020d34..f07589a53993f 100644
--- a/docs/user-guides/workspace-access/remote-desktops.md
+++ b/docs/user-guides/workspace-access/remote-desktops.md
@@ -64,7 +64,7 @@ coder port-forward <workspace-name> --tcp 3399:3389
 Then, connect to your workspace via RDP at `localhost:3399`.
 ![windows-rdp](../../images/user-guides/remote-desktops/windows_rdp_client.png)
 
-</div>s
+</div>
 
 > [!NOTE]
 > Some versions of Windows, including Windows Server 2022, do not communicate correctly over UDP when using Coder Connect because they do not respect the maximum transmission unit (MTU) of the link. When this happens, the RDP client will appear to connect, but displays a blank screen.

From 2c6cbf15e275bf29aa276f5c9c5873525a3abade Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 20:10:50 +0300
Subject: [PATCH 221/298] feat(coderd): use task data model for send/logs
 (#20381)

Updates coder/internal#976
---
 cli/exp_task_logs_test.go |   2 +-
 cli/exp_task_send_test.go |   2 +-
 coderd/aitasks.go         | 106 ++++-------
 coderd/aitasks_test.go    | 389 ++++++++++++++++++--------------------
 4 files changed, 220 insertions(+), 279 deletions(-)

diff --git a/cli/exp_task_logs_test.go b/cli/exp_task_logs_test.go
index 3bf8fb91e72d9..5137c8b40fa56 100644
--- a/cli/exp_task_logs_test.go
+++ b/cli/exp_task_logs_test.go
@@ -23,7 +23,7 @@ import (
 func Test_TaskLogs(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+	t.Skip("TODO(mafredri): Remove, fixed up-stack!")
 
 	testMessages := []agentapisdk.Message{
 		{
diff --git a/cli/exp_task_send_test.go b/cli/exp_task_send_test.go
index 26d62ba5f6903..26b69b992dd25 100644
--- a/cli/exp_task_send_test.go
+++ b/cli/exp_task_send_test.go
@@ -22,7 +22,7 @@ import (
 func Test_TaskSend(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+	t.Skip("TODO(mafredri): Remove, fixed up-stack!")
 
 	t.Run("ByWorkspaceName_WithArgument", func(t *testing.T) {
 		t.Parallel()
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 2f3dd74ad2414..e5f5260a2463d 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -11,7 +11,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/go-chi/chi/v5"
 	"github.com/google/uuid"
 
 	"cdr.dev/slog"
@@ -755,15 +754,7 @@ func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 // workspace and validate the sidebar app health.
 func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-
-	idStr := chi.URLParam(r, "task")
-	taskID, err := uuid.Parse(idStr)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("Invalid UUID %q for task ID.", idStr),
-		})
-		return
-	}
+	task := httpmw.TaskParam(r)
 
 	var req codersdk.TaskSendRequest
 	if !httpapi.Read(ctx, rw, r, &req) {
@@ -776,7 +767,7 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if err = api.authAndDoWithTaskSidebarAppClient(r, taskID, func(ctx context.Context, client *http.Client, appURL *url.URL) error {
+	if err := api.authAndDoWithTaskAppClient(r, task, func(ctx context.Context, client *http.Client, appURL *url.URL) error {
 		agentAPIClient, err := aiagentapi.NewClient(appURL.String(), aiagentapi.WithHTTPClient(client))
 		if err != nil {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
@@ -835,18 +826,10 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 // We enforce ApplicationConnect RBAC on the workspace and validate the sidebar app health.
 func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
-
-	idStr := chi.URLParam(r, "task")
-	taskID, err := uuid.Parse(idStr)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf("Invalid UUID %q for task ID.", idStr),
-		})
-		return
-	}
+	task := httpmw.TaskParam(r)
 
 	var out codersdk.TaskLogsResponse
-	if err := api.authAndDoWithTaskSidebarAppClient(r, taskID, func(ctx context.Context, client *http.Client, appURL *url.URL) error {
+	if err := api.authAndDoWithTaskAppClient(r, task, func(ctx context.Context, client *http.Client, appURL *url.URL) error {
 		agentAPIClient, err := aiagentapi.NewClient(appURL.String(), aiagentapi.WithHTTPClient(client))
 		if err != nil {
 			return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
@@ -894,7 +877,7 @@ func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 	httpapi.Write(ctx, rw, http.StatusOK, out)
 }
 
-// authAndDoWithTaskSidebarAppClient centralizes the shared logic to:
+// authAndDoWithTaskAppClient centralizes the shared logic to:
 //
 //   - Fetch the task workspace
 //   - Authorize ApplicationConnect on the workspace
@@ -903,15 +886,31 @@ func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 //
 // The provided callback receives the context, an HTTP client that dials via the
 // agent, and the base app URL (as a value URL) to perform any request.
-func (api *API) authAndDoWithTaskSidebarAppClient(
+func (api *API) authAndDoWithTaskAppClient(
 	r *http.Request,
-	taskID uuid.UUID,
+	task database.Task,
 	do func(ctx context.Context, client *http.Client, appURL *url.URL) error,
 ) error {
 	ctx := r.Context()
 
-	workspaceID := taskID
-	workspace, err := api.Database.GetWorkspaceByID(ctx, workspaceID)
+	if task.Status != database.TaskStatusActive {
+		return httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
+			Message: "Task status must be active.",
+			Detail:  fmt.Sprintf("Task status is %q, it must be %q to interact with the task.", task.Status, codersdk.TaskStatusActive),
+		})
+	}
+	if !task.WorkspaceID.Valid {
+		return httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
+			Message: "Task does not have a workspace.",
+		})
+	}
+	if !task.WorkspaceAppID.Valid {
+		return httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
+			Message: "Task does not have a workspace app.",
+		})
+	}
+
+	workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
 	if err != nil {
 		if httpapi.Is404Error(err) {
 			return httperror.ErrResourceNotFound
@@ -927,65 +926,30 @@ func (api *API) authAndDoWithTaskSidebarAppClient(
 		return httperror.ErrResourceNotFound
 	}
 
-	data, err := api.workspaceData(ctx, []database.Workspace{workspace})
+	apps, err := api.Database.GetWorkspaceAppsByAgentID(ctx, task.WorkspaceAgentID.UUID)
 	if err != nil {
 		return httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error fetching workspace resources.",
 			Detail:  err.Error(),
 		})
 	}
-	if len(data.builds) == 0 || len(data.templates) == 0 {
-		return httperror.ErrResourceNotFound
-	}
-	build := data.builds[0]
-	if build.HasAITask == nil || !*build.HasAITask || build.AITaskSidebarAppID == nil || *build.AITaskSidebarAppID == uuid.Nil {
-		return httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
-			Message: "Task is not configured with a sidebar app.",
-		})
-	}
 
-	// Find the sidebar app details to get the URL and validate app health.
-	sidebarAppID := *build.AITaskSidebarAppID
-	agentID, sidebarApp, ok := func() (uuid.UUID, codersdk.WorkspaceApp, bool) {
-		for _, res := range build.Resources {
-			for _, agent := range res.Agents {
-				for _, app := range agent.Apps {
-					if app.ID == sidebarAppID {
-						return agent.ID, app, true
-					}
-				}
-			}
+	var app *database.WorkspaceApp
+	for _, a := range apps {
+		if a.ID == task.WorkspaceAppID.UUID {
+			app = &a
+			break
 		}
-		return uuid.Nil, codersdk.WorkspaceApp{}, false
-	}()
-	if !ok {
-		return httperror.NewResponseError(http.StatusBadRequest, codersdk.Response{
-			Message: "Task sidebar app not found in latest build.",
-		})
-	}
-
-	// Return an informative error if the app isn't healthy rather than trying
-	// and failing.
-	switch sidebarApp.Health {
-	case codersdk.WorkspaceAppHealthDisabled:
-		// No health check, pass through.
-	case codersdk.WorkspaceAppHealthInitializing:
-		return httperror.NewResponseError(http.StatusServiceUnavailable, codersdk.Response{
-			Message: "Task sidebar app is initializing. Try again shortly.",
-		})
-	case codersdk.WorkspaceAppHealthUnhealthy:
-		return httperror.NewResponseError(http.StatusServiceUnavailable, codersdk.Response{
-			Message: "Task sidebar app is unhealthy.",
-		})
 	}
 
 	// Build the direct app URL and dial the agent.
-	if sidebarApp.URL == "" {
+	appURL := app.Url.String
+	if appURL == "" {
 		return httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{
 			Message: "Task sidebar app URL is not configured.",
 		})
 	}
-	parsedURL, err := url.Parse(sidebarApp.URL)
+	parsedURL, err := url.Parse(appURL)
 	if err != nil {
 		return httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{
 			Message: "Internal error parsing task app URL.",
@@ -1000,7 +964,7 @@ func (api *API) authAndDoWithTaskSidebarAppClient(
 
 	dialCtx, dialCancel := context.WithTimeout(ctx, time.Second*30)
 	defer dialCancel()
-	agentConn, release, err := api.agentProvider.AgentConn(dialCtx, agentID)
+	agentConn, release, err := api.agentProvider.AgentConn(dialCtx, task.WorkspaceAgentID.UUID)
 	if err != nil {
 		return httperror.NewResponseError(http.StatusBadGateway, codersdk.Response{
 			Message: "Failed to reach task app endpoint.",
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index c7db4f58c6e68..c88785c858453 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -2,7 +2,7 @@ package coderd_test
 
 import (
 	"database/sql"
-	"fmt"
+	"encoding/json"
 	"io"
 	"net/http"
 	"net/http/httptest"
@@ -15,6 +15,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
+	agentapisdk "github.com/coder/agentapi-sdk-go"
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agenttest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
@@ -210,8 +211,8 @@ func TestTasks(t *testing.T) {
 											Apps: []*proto.App{
 												{
 													Id:          taskAppID.String(),
-													Slug:        "task-sidebar",
-													DisplayName: "Task Sidebar",
+													Slug:        "task-app",
+													DisplayName: "Task App",
 													Url:         opt.appURL,
 												},
 											},
@@ -221,9 +222,7 @@ func TestTasks(t *testing.T) {
 							},
 							AiTasks: []*proto.AITask{
 								{
-									SidebarApp: &proto.AITaskSidebarApp{
-										Id: taskAppID.String(),
-									},
+									AppId: taskAppID.String(),
 								},
 							},
 						},
@@ -469,41 +468,40 @@ func TestTasks(t *testing.T) {
 	t.Run("Send", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		t.Run("IntegrationOK", func(t *testing.T) {
 			t.Parallel()
 
-			client, _, api := coderdtest.NewWithAPI(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			owner := coderdtest.CreateFirstUser(t, client)
-			userClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
-
-			createStatusResponse := func(status string) string {
-				return `
-					{
-						"$schema": "http://localhost:3284/schemas/StatusResponseBody.json",
-						"status": "` + status + `"
-					}
-				`
-			}
-			statusResponse := createStatusResponse("stable")
+			statusResponse := agentapisdk.StatusStable
 
 			// Start a fake AgentAPI that accepts GET /status and POST /message.
 			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 				if r.Method == http.MethodGet && r.URL.Path == "/status" {
 					w.Header().Set("Content-Type", "application/json")
+					resp := agentapisdk.GetStatusResponse{
+						Status: statusResponse,
+					}
+					respBytes, err := json.Marshal(resp)
+					assert.NoError(t, err)
 					w.WriteHeader(http.StatusOK)
-					_, _ = fmt.Fprint(w, statusResponse)
+					w.Write(respBytes)
 					return
 				}
 				if r.Method == http.MethodPost && r.URL.Path == "/message" {
 					w.Header().Set("Content-Type", "application/json")
 
 					b, _ := io.ReadAll(r.Body)
-					assert.Equal(t, `{"content":"Hello, Agent!","type":"user"}`, string(b), "expected message content")
+					expectedReq := agentapisdk.PostMessageParams{
+						Content: "Hello, Agent!",
+						Type:    agentapisdk.MessageTypeUser,
+					}
+					expectedBytes, _ := json.Marshal(expectedReq)
+					assert.Equal(t, string(expectedBytes), string(b), "expected message content")
 
+					resp := agentapisdk.PostMessageResponse{Ok: true}
+					respBytes, err := json.Marshal(resp)
+					assert.NoError(t, err)
 					w.WriteHeader(http.StatusOK)
-					io.WriteString(w, `{"ok": true}`)
+					w.Write(respBytes)
 					return
 				}
 				w.WriteHeader(http.StatusInternalServerError)
@@ -511,103 +509,105 @@ func TestTasks(t *testing.T) {
 			defer srv.Close()
 
 			// Create an AI-capable template whose sidebar app points to our fake AgentAPI.
-			authToken := uuid.NewString()
-			template := createAITemplate(t, client, owner, withSidebarURL(srv.URL), withAgentToken(authToken))
+			var (
+				client, db     = coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+				ctx            = testutil.Context(t, testutil.WaitLong)
+				owner          = coderdtest.CreateFirstUser(t, client)
+				userClient, _  = coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+				agentAuthToken = uuid.NewString()
+				template       = createAITemplate(t, client, owner, withAgentToken(agentAuthToken), withSidebarURL(srv.URL))
+				exp            = codersdk.NewExperimentalClient(userClient)
+			)
 
-			// Create a workspace (task) from the AI-capable template.
-			ws := coderdtest.CreateWorkspace(t, userClient, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-				req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-					{Name: codersdk.AITaskPromptParameterName, Value: "send a message"},
-				}
+			task, err := exp.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+				TemplateVersionID: template.ActiveVersionID,
+				Input:             "send me food",
 			})
-			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+			require.NoError(t, err)
+			require.True(t, task.WorkspaceID.Valid)
+
+			// Get the workspace and wait for it to be ready.
+			ws, err := userClient.Workspace(ctx, task.WorkspaceID.UUID)
+			require.NoError(t, err)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, userClient, ws.LatestBuild.ID)
+
+			// Fetch the task by ID via experimental API and verify fields.
+			task, err = exp.TaskByID(ctx, task.ID)
+			require.NoError(t, err)
+			require.NotZero(t, task.WorkspaceBuildNumber)
+			require.True(t, task.WorkspaceAgentID.Valid)
+			require.True(t, task.WorkspaceAppID.Valid)
+
+			// Insert an app status for the workspace
+			_, err = db.InsertWorkspaceAppStatus(dbauthz.AsSystemRestricted(ctx), database.InsertWorkspaceAppStatusParams{
+				ID:          uuid.New(),
+				WorkspaceID: task.WorkspaceID.UUID,
+				CreatedAt:   dbtime.Now(),
+				AgentID:     task.WorkspaceAgentID.UUID,
+				AppID:       task.WorkspaceAppID.UUID,
+				State:       database.WorkspaceAppStatusStateComplete,
+				Message:     "all done",
+			})
+			require.NoError(t, err)
 
 			// Start a fake agent so the workspace agent is connected before sending the message.
-			agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(authToken))
-			_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
+			agentClient := agentsdk.New(userClient.URL, agentsdk.WithFixedToken(agentAuthToken))
+			_ = agenttest.New(t, userClient.URL, agentAuthToken, func(o *agent.Options) {
 				o.Client = agentClient
 			})
+			coderdtest.NewWorkspaceAgentWaiter(t, userClient, ws.ID).WaitFor(coderdtest.AgentsReady)
 
-			ctx := testutil.Context(t, testutil.WaitMedium)
-			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
-
-			// Lookup the sidebar app ID.
-			w, err := client.Workspace(ctx, ws.ID)
+			// Fetch the task by ID via experimental API and verify fields.
+			task, err = exp.TaskByID(ctx, task.ID)
 			require.NoError(t, err)
-			var sidebarAppID uuid.UUID
-			for _, res := range w.LatestBuild.Resources {
-				for _, ag := range res.Agents {
-					for _, app := range ag.Apps {
-						if app.Slug == "task-sidebar" {
-							sidebarAppID = app.ID
-						}
-					}
-				}
-			}
-			require.NotEqual(t, uuid.Nil, sidebarAppID)
 
 			// Make the sidebar app unhealthy initially.
-			err = api.Database.UpdateWorkspaceAppHealthByID(dbauthz.AsSystemRestricted(ctx), database.UpdateWorkspaceAppHealthByIDParams{
-				ID:     sidebarAppID,
+			err = db.UpdateWorkspaceAppHealthByID(dbauthz.AsSystemRestricted(ctx), database.UpdateWorkspaceAppHealthByIDParams{
+				ID:     task.WorkspaceAppID.UUID,
 				Health: database.WorkspaceAppHealthUnhealthy,
 			})
 			require.NoError(t, err)
 
-			exp := codersdk.NewExperimentalClient(userClient)
-			err = exp.TaskSend(ctx, "me", ws.ID, codersdk.TaskSendRequest{
+			err = exp.TaskSend(ctx, "me", task.ID, codersdk.TaskSendRequest{
 				Input: "Hello, Agent!",
 			})
 			require.Error(t, err, "wanted error due to unhealthy sidebar app")
 
 			// Make the sidebar app healthy.
-			err = api.Database.UpdateWorkspaceAppHealthByID(dbauthz.AsSystemRestricted(ctx), database.UpdateWorkspaceAppHealthByIDParams{
-				ID:     sidebarAppID,
+			err = db.UpdateWorkspaceAppHealthByID(dbauthz.AsSystemRestricted(ctx), database.UpdateWorkspaceAppHealthByIDParams{
+				ID:     task.WorkspaceAppID.UUID,
 				Health: database.WorkspaceAppHealthHealthy,
 			})
 			require.NoError(t, err)
 
-			statusResponse = createStatusResponse("bad")
+			statusResponse = agentapisdk.AgentStatus("bad")
 
-			err = exp.TaskSend(ctx, "me", ws.ID, codersdk.TaskSendRequest{
+			err = exp.TaskSend(ctx, "me", task.ID, codersdk.TaskSendRequest{
 				Input: "Hello, Agent!",
 			})
 			require.Error(t, err, "wanted error due to bad status")
 
-			statusResponse = createStatusResponse("stable")
+			statusResponse = agentapisdk.StatusStable
 
-			// Send task input to the tasks sidebar app and expect 204.e
-			err = exp.TaskSend(ctx, "me", ws.ID, codersdk.TaskSendRequest{
-				Input: "Hello, Agent!",
+			//nolint:tparallel // Not intended to run in parallel.
+			t.Run("SendOK", func(t *testing.T) {
+				err = exp.TaskSend(ctx, "me", task.ID, codersdk.TaskSendRequest{
+					Input: "Hello, Agent!",
+				})
+				require.NoError(t, err, "wanted no error due to healthy sidebar app and stable status")
 			})
-			require.NoError(t, err, "wanted no error due to healthy sidebar app and stable status")
-		})
-
-		t.Run("MissingContent", func(t *testing.T) {
-			t.Parallel()
-
-			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			ctx := testutil.Context(t, testutil.WaitLong)
 
-			template := createAITemplate(t, client, user)
-
-			// Create a workspace (task).
-			ws := coderdtest.CreateWorkspace(t, client, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-				req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-					{Name: codersdk.AITaskPromptParameterName, Value: "do work"},
-				}
-			})
-			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+			//nolint:tparallel // Not intended to run in parallel.
+			t.Run("MissingContent", func(t *testing.T) {
+				err = exp.TaskSend(ctx, "me", task.ID, codersdk.TaskSendRequest{
+					Input: "",
+				})
+				require.Error(t, err, "wanted error due to missing content")
 
-			exp := codersdk.NewExperimentalClient(client)
-			err := exp.TaskSend(ctx, "me", ws.ID, codersdk.TaskSendRequest{
-				Input: "",
+				var sdkErr *codersdk.Error
+				require.ErrorAs(t, err, &sdkErr)
+				require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
 			})
-
-			var sdkErr *codersdk.Error
-			require.Error(t, err)
-			require.ErrorAs(t, err, &sdkErr)
-			require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
 		})
 
 		t.Run("TaskNotFound", func(t *testing.T) {
@@ -627,108 +627,112 @@ func TestTasks(t *testing.T) {
 			require.ErrorAs(t, err, &sdkErr)
 			require.Equal(t, http.StatusNotFound, sdkErr.StatusCode())
 		})
-
-		t.Run("NotATask", func(t *testing.T) {
-			t.Parallel()
-
-			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			user := coderdtest.CreateFirstUser(t, client)
-			ctx := testutil.Context(t, testutil.WaitShort)
-
-			// Create a template without AI tasks.
-			version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
-			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
-			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
-
-			ws := coderdtest.CreateWorkspace(t, client, template.ID)
-			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
-
-			exp := codersdk.NewExperimentalClient(client)
-			err := exp.TaskSend(ctx, "me", ws.ID, codersdk.TaskSendRequest{
-				Input: "hello",
-			})
-
-			var sdkErr *codersdk.Error
-			require.Error(t, err)
-			require.ErrorAs(t, err, &sdkErr)
-			require.Equal(t, http.StatusBadRequest, sdkErr.StatusCode())
-		})
 	})
 
 	t.Run("Logs", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
+		messageResponseData := agentapisdk.GetMessagesResponse{
+			Messages: []agentapisdk.Message{
+				{
+					Id:      0,
+					Content: "Welcome, user!",
+					Role:    agentapisdk.RoleAgent,
+					Time:    time.Date(2025, 9, 25, 10, 42, 48, 0, time.UTC),
+				},
+				{
+					Id:      1,
+					Content: "Hello, agent!",
+					Role:    agentapisdk.RoleUser,
+					Time:    time.Date(2025, 9, 25, 10, 46, 42, 0, time.UTC),
+				},
+				{
+					Id:      2,
+					Content: "What would you like to work on today?",
+					Role:    agentapisdk.RoleAgent,
+					Time:    time.Date(2025, 9, 25, 10, 46, 50, 0, time.UTC),
+				},
+			},
+		}
+		messageResponseBytes, err := json.Marshal(messageResponseData)
+		require.NoError(t, err)
+		messageResponse := string(messageResponseBytes)
 
-		t.Run("OK", func(t *testing.T) {
-			t.Parallel()
+		var shouldReturnError bool
 
-			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			owner := coderdtest.CreateFirstUser(t, client)
-			ctx := testutil.Context(t, testutil.WaitLong)
+		// Fake AgentAPI that returns a couple of messages or an error.
+		srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if shouldReturnError {
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = io.WriteString(w, "boom")
+				return
+			}
+			if r.Method == http.MethodGet && r.URL.Path == "/messages" {
+				w.Header().Set("Content-Type", "application/json")
+				w.WriteHeader(http.StatusOK)
+				io.WriteString(w, messageResponse)
+				return
+			}
+			w.WriteHeader(http.StatusNotFound)
+		}))
+		defer srv.Close()
 
-			messageResponse := `
-				{
-					"$schema": "http://localhost:3284/schemas/MessagesResponseBody.json",
-					"messages": [
-						{
-							"id": 0,
-							"content": "Welcome, user!",
-							"role": "agent",
-							"time": "2025-09-25T10:42:48.751774125Z"
-						},
-						{
-							"id": 1,
-							"content": "Hello, agent!",
-							"role": "user",
-							"time": "2025-09-25T10:46:42.880996296Z"
-						},
-						{
-							"id": 2,
-							"content": "What would you like to work on today?",
-							"role": "agent",
-							"time": "2025-09-25T10:46:50.747761102Z"
-						}
-					]
-				}
-			`
+		// Create an AI-capable template whose sidebar app points to our fake AgentAPI.
+		var (
+			client, db     = coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			ctx            = testutil.Context(t, testutil.WaitLong)
+			owner          = coderdtest.CreateFirstUser(t, client)
+			agentAuthToken = uuid.NewString()
+			template       = createAITemplate(t, client, owner, withAgentToken(agentAuthToken), withSidebarURL(srv.URL))
+			exp            = codersdk.NewExperimentalClient(client)
+		)
 
-			// Fake AgentAPI that returns a couple of messages.
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				if r.Method == http.MethodGet && r.URL.Path == "/messages" {
-					w.Header().Set("Content-Type", "application/json")
-					w.WriteHeader(http.StatusOK)
-					io.WriteString(w, messageResponse)
-					return
-				}
-				w.WriteHeader(http.StatusNotFound)
-			}))
-			t.Cleanup(srv.Close)
+		task, err := exp.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             "show logs",
+		})
+		require.NoError(t, err)
+		require.True(t, task.WorkspaceID.Valid)
 
-			// Template pointing sidebar app to our fake AgentAPI.
-			authToken := uuid.NewString()
-			template := createAITemplate(t, client, owner, withSidebarURL(srv.URL), withAgentToken(authToken))
+		// Get the workspace and wait for it to be ready.
+		ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+		require.NoError(t, err)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
-			// Create task workspace.
-			ws := coderdtest.CreateWorkspace(t, client, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-				req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-					{Name: codersdk.AITaskPromptParameterName, Value: "show logs"},
-				}
-			})
-			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+		// Fetch the task by ID via experimental API and verify fields.
+		task, err = exp.TaskByID(ctx, task.ID)
+		require.NoError(t, err)
+		require.NotZero(t, task.WorkspaceBuildNumber)
+		require.True(t, task.WorkspaceAgentID.Valid)
+		require.True(t, task.WorkspaceAppID.Valid)
 
-			// Start a fake agent.
-			agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(authToken))
-			_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
-				o.Client = agentClient
-			})
-			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
+		// Insert an app status for the workspace
+		_, err = db.InsertWorkspaceAppStatus(dbauthz.AsSystemRestricted(ctx), database.InsertWorkspaceAppStatusParams{
+			ID:          uuid.New(),
+			WorkspaceID: task.WorkspaceID.UUID,
+			CreatedAt:   dbtime.Now(),
+			AgentID:     task.WorkspaceAgentID.UUID,
+			AppID:       task.WorkspaceAppID.UUID,
+			State:       database.WorkspaceAppStatusStateComplete,
+			Message:     "all done",
+		})
+		require.NoError(t, err)
 
-			// Omit sidebar app health as undefined is OK.
+		// Start a fake agent so the workspace agent is connected before fetching logs.
+		agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(agentAuthToken))
+		_ = agenttest.New(t, client.URL, agentAuthToken, func(o *agent.Options) {
+			o.Client = agentClient
+		})
+		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WaitFor(coderdtest.AgentsReady)
 
+		// Fetch the task by ID via experimental API and verify fields.
+		task, err = exp.TaskByID(ctx, task.ID)
+		require.NoError(t, err)
+
+		//nolint:tparallel // Not intended to run in parallel.
+		t.Run("OK", func(t *testing.T) {
 			// Fetch logs.
-			exp := codersdk.NewExperimentalClient(client)
-			resp, err := exp.TaskLogs(ctx, "me", ws.ID)
+			resp, err := exp.TaskLogs(ctx, "me", task.ID)
 			require.NoError(t, err)
 			require.Len(t, resp.Logs, 3)
 			assert.Equal(t, 0, resp.Logs[0].ID)
@@ -744,38 +748,11 @@ func TestTasks(t *testing.T) {
 			assert.Equal(t, "What would you like to work on today?", resp.Logs[2].Content)
 		})
 
+		//nolint:tparallel // Not intended to run in parallel.
 		t.Run("UpstreamError", func(t *testing.T) {
-			t.Parallel()
-
-			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
-			owner := coderdtest.CreateFirstUser(t, client)
-			ctx := testutil.Context(t, testutil.WaitShort)
-
-			// Fake AgentAPI that returns 500 for messages.
-			srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
-				w.WriteHeader(http.StatusInternalServerError)
-				_, _ = io.WriteString(w, "boom")
-			}))
-			t.Cleanup(srv.Close)
-
-			authToken := uuid.NewString()
-			template := createAITemplate(t, client, owner, withSidebarURL(srv.URL), withAgentToken(authToken))
-			ws := coderdtest.CreateWorkspace(t, client, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-				req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-					{Name: codersdk.AITaskPromptParameterName, Value: "show logs"},
-				}
-			})
-			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
-
-			// Start fake agent.
-			agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(authToken))
-			_ = agenttest.New(t, client.URL, authToken, func(o *agent.Options) {
-				o.Client = agentClient
-			})
-			coderdtest.NewWorkspaceAgentWaiter(t, client, ws.ID).WithContext(ctx).WaitFor(coderdtest.AgentsReady)
-
-			exp := codersdk.NewExperimentalClient(client)
-			_, err := exp.TaskLogs(ctx, "me", ws.ID)
+			shouldReturnError = true
+			t.Cleanup(func() { shouldReturnError = false })
+			_, err := exp.TaskLogs(ctx, "me", task.ID)
 
 			var sdkErr *codersdk.Error
 			require.Error(t, err)

From a106d67c07c7dc326ccce5a4eafc2e534412acd9 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 20:22:51 +0300
Subject: [PATCH 222/298] feat(coderd): use task data model for list (#20394)

Updates coder/internal#976
---
 cli/exp_task_delete.go             |  44 ++----
 cli/exp_task_delete_test.go        |  58 +++++---
 cli/exp_task_list.go               |   9 +-
 cli/exp_task_list_test.go          |  45 ++++--
 cli/exp_task_logs.go               |  22 +--
 cli/exp_task_logs_test.go          |  28 ++--
 cli/exp_task_send.go               |  22 +--
 cli/exp_task_send_test.go          |  28 ++--
 cli/exp_task_status.go             |  18 +--
 cli/exp_task_status_test.go        | 146 +++++++++++++------
 cli/exp_task_test.go               |  22 +--
 coderd/aitasks.go                  | 220 +++++++---------------------
 coderd/aitasks_test.go             |  29 ++--
 coderd/apidoc/docs.go              |  25 +---
 coderd/apidoc/swagger.json         |  25 +---
 coderd/database/dbfake/dbfake.go   |  69 ++++++++-
 coderd/database/queries.sql.go     |   4 +-
 coderd/database/queries/tasks.sql  |   1 +
 coderd/searchquery/search.go       |  37 +++++
 coderd/searchquery/search_test.go  | 196 +++++++++++++++++++++++++
 coderd/telemetry/telemetry.go      |   1 +
 codersdk/aitasks.go                | 130 ++++++++++++++---
 codersdk/aitasks_internal_test.go  |  75 ++++++++++
 codersdk/toolsdk/bash.go           |  17 ++-
 codersdk/toolsdk/toolsdk.go        |  76 +++-------
 codersdk/toolsdk/toolsdk_test.go   | 221 +++++++++++++++++------------
 docs/reference/api/experimental.md |   9 +-
 site/src/api/typesGenerated.ts     |  12 ++
 28 files changed, 976 insertions(+), 613 deletions(-)
 create mode 100644 codersdk/aitasks_internal_test.go

diff --git a/cli/exp_task_delete.go b/cli/exp_task_delete.go
index 43675057bde79..1611e4196e6c0 100644
--- a/cli/exp_task_delete.go
+++ b/cli/exp_task_delete.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
 	"github.com/coder/pretty"
@@ -47,43 +46,19 @@ func (r *RootCmd) taskDelete() *serpent.Command {
 			}
 			exp := codersdk.NewExperimentalClient(client)
 
-			type toDelete struct {
-				ID      uuid.UUID
-				Owner   string
-				Display string
-			}
-
-			var items []toDelete
+			var tasks []codersdk.Task
 			for _, identifier := range inv.Args {
-				identifier = strings.TrimSpace(identifier)
-				if identifier == "" {
-					return xerrors.New("task identifier cannot be empty or whitespace")
-				}
-
-				// Check task identifier, try UUID first.
-				if id, err := uuid.Parse(identifier); err == nil {
-					task, err := exp.TaskByID(ctx, id)
-					if err != nil {
-						return xerrors.Errorf("resolve task %q: %w", identifier, err)
-					}
-					display := fmt.Sprintf("%s/%s", task.OwnerName, task.Name)
-					items = append(items, toDelete{ID: id, Display: display, Owner: task.OwnerName})
-					continue
-				}
-
-				// Non-UUID, treat as a workspace identifier (name or owner/name).
-				ws, err := namedWorkspace(ctx, client, identifier)
+				task, err := exp.TaskByIdentifier(ctx, identifier)
 				if err != nil {
 					return xerrors.Errorf("resolve task %q: %w", identifier, err)
 				}
-				display := ws.FullName()
-				items = append(items, toDelete{ID: ws.ID, Display: display, Owner: ws.OwnerName})
+				tasks = append(tasks, task)
 			}
 
 			// Confirm deletion of the tasks.
 			var displayList []string
-			for _, it := range items {
-				displayList = append(displayList, it.Display)
+			for _, task := range tasks {
+				displayList = append(displayList, fmt.Sprintf("%s/%s", task.OwnerName, task.Name))
 			}
 			_, err = cliui.Prompt(inv, cliui.PromptOptions{
 				Text:      fmt.Sprintf("Delete these tasks: %s?", pretty.Sprint(cliui.DefaultStyles.Code, strings.Join(displayList, ", "))),
@@ -94,12 +69,13 @@ func (r *RootCmd) taskDelete() *serpent.Command {
 				return err
 			}
 
-			for _, item := range items {
-				if err := exp.DeleteTask(ctx, item.Owner, item.ID); err != nil {
-					return xerrors.Errorf("delete task %q: %w", item.Display, err)
+			for i, task := range tasks {
+				display := displayList[i]
+				if err := exp.DeleteTask(ctx, task.OwnerName, task.ID); err != nil {
+					return xerrors.Errorf("delete task %q: %w", display, err)
 				}
 				_, _ = fmt.Fprintln(
-					inv.Stdout, "Deleted task "+pretty.Sprint(cliui.DefaultStyles.Keyword, item.Display)+" at "+cliui.Timestamp(time.Now()),
+					inv.Stdout, "Deleted task "+pretty.Sprint(cliui.DefaultStyles.Keyword, display)+" at "+cliui.Timestamp(time.Now()),
 				)
 			}
 
diff --git a/cli/exp_task_delete_test.go b/cli/exp_task_delete_test.go
index 0b288c4ca3379..e90ee8c5b19ba 100644
--- a/cli/exp_task_delete_test.go
+++ b/cli/exp_task_delete_test.go
@@ -56,12 +56,18 @@ func TestExpTaskDelete(t *testing.T) {
 				taskID := uuid.MustParse(id1)
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch {
-					case r.Method == http.MethodGet && r.URL.Path == "/api/v2/users/me/workspace/exists":
+					case r.Method == http.MethodGet && r.URL.Path == "/api/experimental/tasks" && r.URL.Query().Get("q") == "owner:\"me\"":
 						c.nameResolves.Add(1)
-						httpapi.Write(r.Context(), w, http.StatusOK, codersdk.Workspace{
-							ID:        taskID,
-							Name:      "exists",
-							OwnerName: "me",
+						httpapi.Write(r.Context(), w, http.StatusOK, struct {
+							Tasks []codersdk.Task `json:"tasks"`
+							Count int             `json:"count"`
+						}{
+							Tasks: []codersdk.Task{{
+								ID:        taskID,
+								Name:      "exists",
+								OwnerName: "me",
+							}},
+							Count: 1,
 						})
 					case r.Method == http.MethodDelete && r.URL.Path == "/api/experimental/tasks/me/"+id1:
 						c.deleteCalls.Add(1)
@@ -104,12 +110,18 @@ func TestExpTaskDelete(t *testing.T) {
 				firstID := uuid.MustParse(id3)
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch {
-					case r.Method == http.MethodGet && r.URL.Path == "/api/v2/users/me/workspace/first":
+					case r.Method == http.MethodGet && r.URL.Path == "/api/experimental/tasks" && r.URL.Query().Get("q") == "owner:\"me\"":
 						c.nameResolves.Add(1)
-						httpapi.Write(r.Context(), w, http.StatusOK, codersdk.Workspace{
-							ID:        firstID,
-							Name:      "first",
-							OwnerName: "me",
+						httpapi.Write(r.Context(), w, http.StatusOK, struct {
+							Tasks []codersdk.Task `json:"tasks"`
+							Count int             `json:"count"`
+						}{
+							Tasks: []codersdk.Task{{
+								ID:        firstID,
+								Name:      "first",
+								OwnerName: "me",
+							}},
+							Count: 1,
 						})
 					case r.Method == http.MethodGet && r.URL.Path == "/api/experimental/tasks/me/"+id4:
 						httpapi.Write(r.Context(), w, http.StatusOK, codersdk.Task{
@@ -139,8 +151,14 @@ func TestExpTaskDelete(t *testing.T) {
 			buildHandler: func(_ *testCounters) http.HandlerFunc {
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch {
-					case r.Method == http.MethodGet && r.URL.Path == "/api/v2/users/me/workspace/doesnotexist":
-						httpapi.ResourceNotFound(w)
+					case r.Method == http.MethodGet && r.URL.Path == "/api/experimental/tasks" && r.URL.Query().Get("q") == "owner:\"me\"":
+						httpapi.Write(r.Context(), w, http.StatusOK, struct {
+							Tasks []codersdk.Task `json:"tasks"`
+							Count int             `json:"count"`
+						}{
+							Tasks: []codersdk.Task{},
+							Count: 0,
+						})
 					default:
 						httpapi.InternalServerError(w, xerrors.New("unwanted path: "+r.Method+" "+r.URL.Path))
 					}
@@ -156,12 +174,18 @@ func TestExpTaskDelete(t *testing.T) {
 				taskID := uuid.MustParse(id5)
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch {
-					case r.Method == http.MethodGet && r.URL.Path == "/api/v2/users/me/workspace/bad":
+					case r.Method == http.MethodGet && r.URL.Path == "/api/experimental/tasks" && r.URL.Query().Get("q") == "owner:\"me\"":
 						c.nameResolves.Add(1)
-						httpapi.Write(r.Context(), w, http.StatusOK, codersdk.Workspace{
-							ID:        taskID,
-							Name:      "bad",
-							OwnerName: "me",
+						httpapi.Write(r.Context(), w, http.StatusOK, struct {
+							Tasks []codersdk.Task `json:"tasks"`
+							Count int             `json:"count"`
+						}{
+							Tasks: []codersdk.Task{{
+								ID:        taskID,
+								Name:      "bad",
+								OwnerName: "me",
+							}},
+							Count: 1,
 						})
 					case r.Method == http.MethodDelete && r.URL.Path == "/api/experimental/tasks/me/"+id5:
 						httpapi.InternalServerError(w, xerrors.New("boom"))
diff --git a/cli/exp_task_list.go b/cli/exp_task_list.go
index 442718814b0c5..89b313a1f49c5 100644
--- a/cli/exp_task_list.go
+++ b/cli/exp_task_list.go
@@ -8,6 +8,7 @@ import (
 	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/serpent"
 )
@@ -98,10 +99,10 @@ func (r *RootCmd) taskList() *serpent.Command {
 		Options: serpent.OptionSet{
 			{
 				Name:        "status",
-				Description: "Filter by task status (e.g. running, failed, etc).",
+				Description: "Filter by task status.",
 				Flag:        "status",
 				Default:     "",
-				Value:       serpent.StringOf(&statusFilter),
+				Value:       serpent.EnumOf(&statusFilter, slice.ToStrings(codersdk.AllTaskStatuses())...),
 			},
 			{
 				Name:          "all",
@@ -142,8 +143,8 @@ func (r *RootCmd) taskList() *serpent.Command {
 			}
 
 			tasks, err := exp.Tasks(ctx, &codersdk.TasksFilter{
-				Owner:           targetUser,
-				WorkspaceStatus: statusFilter,
+				Owner:  targetUser,
+				Status: codersdk.TaskStatus(statusFilter),
 			})
 			if err != nil {
 				return xerrors.Errorf("list tasks: %w", err)
diff --git a/cli/exp_task_list_test.go b/cli/exp_task_list_test.go
index f8f20eacaf264..d1e0862dc793b 100644
--- a/cli/exp_task_list_test.go
+++ b/cli/exp_task_list_test.go
@@ -22,6 +22,7 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbfake"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/pty/ptytest"
@@ -29,7 +30,7 @@ import (
 )
 
 // makeAITask creates an AI-task workspace.
-func makeAITask(t *testing.T, db database.Store, orgID, adminID, ownerID uuid.UUID, transition database.WorkspaceTransition, prompt string) (workspace database.WorkspaceTable) {
+func makeAITask(t *testing.T, db database.Store, orgID, adminID, ownerID uuid.UUID, transition database.WorkspaceTransition, prompt string) database.Task {
 	t.Helper()
 
 	tv := dbfake.TemplateVersion(t, db).
@@ -91,14 +92,32 @@ func makeAITask(t *testing.T, db database.Store, orgID, adminID, ownerID uuid.UU
 	)
 	require.NoError(t, err)
 
-	return build.Workspace
+	// Create a task record in the tasks table for the new data model.
+	task := dbgen.Task(t, db, database.TaskTable{
+		OrganizationID:     orgID,
+		OwnerID:            ownerID,
+		Name:               build.Workspace.Name,
+		WorkspaceID:        uuid.NullUUID{UUID: build.Workspace.ID, Valid: true},
+		TemplateVersionID:  tv.TemplateVersion.ID,
+		TemplateParameters: []byte("{}"),
+		Prompt:             prompt,
+		CreatedAt:          dbtime.Now(),
+	})
+
+	// Link the task to the workspace app.
+	dbgen.TaskWorkspaceApp(t, db, database.TaskWorkspaceApp{
+		TaskID:               task.ID,
+		WorkspaceBuildNumber: build.Build.BuildNumber,
+		WorkspaceAgentID:     uuid.NullUUID{UUID: agentID, Valid: true},
+		WorkspaceAppID:       uuid.NullUUID{UUID: app.ID, Valid: true},
+	})
+
+	return task
 }
 
 func TestExpTaskList(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 	t.Run("NoTasks_Table", func(t *testing.T) {
 		t.Parallel()
 
@@ -130,7 +149,7 @@ func TestExpTaskList(t *testing.T) {
 		memberClient, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		wantPrompt := "build me a web app"
-		ws := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, wantPrompt)
+		task := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, wantPrompt)
 
 		inv, root := clitest.New(t, "exp", "task", "list", "--column", "id,name,status,initial prompt")
 		clitest.SetupConfig(t, memberClient, root)
@@ -142,7 +161,7 @@ func TestExpTaskList(t *testing.T) {
 		require.NoError(t, err)
 
 		// Validate the table includes the task and status.
-		pty.ExpectMatch(ws.Name)
+		pty.ExpectMatch(task.Name)
 		pty.ExpectMatch("running")
 		pty.ExpectMatch(wantPrompt)
 	})
@@ -157,11 +176,11 @@ func TestExpTaskList(t *testing.T) {
 		memberClient, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		// Create two AI tasks: one running, one stopped.
-		running := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "keep me running")
-		stopped := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStop, "stop me please")
+		runningTask := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "keep me running")
+		stoppedTask := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStop, "stop me please")
 
 		// Use JSON output to reliably validate filtering.
-		inv, root := clitest.New(t, "exp", "task", "list", "--status=stopped", "--output=json")
+		inv, root := clitest.New(t, "exp", "task", "list", "--status=paused", "--output=json")
 		clitest.SetupConfig(t, memberClient, root)
 
 		ctx := testutil.Context(t, testutil.WaitShort)
@@ -177,8 +196,8 @@ func TestExpTaskList(t *testing.T) {
 
 		// Only the stopped task is returned.
 		require.Len(t, tasks, 1, "expected one task after filtering")
-		require.Equal(t, stopped.ID, tasks[0].ID)
-		require.NotEqual(t, running.ID, tasks[0].ID)
+		require.Equal(t, stoppedTask.ID, tasks[0].ID)
+		require.NotEqual(t, runningTask.ID, tasks[0].ID)
 	})
 
 	t.Run("UserFlag_Me_Table", func(t *testing.T) {
@@ -190,7 +209,7 @@ func TestExpTaskList(t *testing.T) {
 		_, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		_ = makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "other-task")
-		ws := makeAITask(t, db, owner.OrganizationID, owner.UserID, owner.UserID, database.WorkspaceTransitionStart, "me-task")
+		task := makeAITask(t, db, owner.OrganizationID, owner.UserID, owner.UserID, database.WorkspaceTransitionStart, "me-task")
 
 		inv, root := clitest.New(t, "exp", "task", "list", "--user", "me")
 		//nolint:gocritic // Owner client is intended here smoke test the member task not showing up.
@@ -202,7 +221,7 @@ func TestExpTaskList(t *testing.T) {
 		err := inv.WithContext(ctx).Run()
 		require.NoError(t, err)
 
-		pty.ExpectMatch(ws.Name)
+		pty.ExpectMatch(task.Name)
 	})
 
 	t.Run("Quiet", func(t *testing.T) {
diff --git a/cli/exp_task_logs.go b/cli/exp_task_logs.go
index 6c99df3edf7aa..d1d4a826cd9ce 100644
--- a/cli/exp_task_logs.go
+++ b/cli/exp_task_logs.go
@@ -3,7 +3,6 @@ package cli
 import (
 	"fmt"
 
-	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/cli/cliui"
@@ -41,24 +40,17 @@ func (r *RootCmd) taskLogs() *serpent.Command {
 			}
 
 			var (
-				ctx    = inv.Context()
-				exp    = codersdk.NewExperimentalClient(client)
-				task   = inv.Args[0]
-				taskID uuid.UUID
+				ctx        = inv.Context()
+				exp        = codersdk.NewExperimentalClient(client)
+				identifier = inv.Args[0]
 			)
 
-			if id, err := uuid.Parse(task); err == nil {
-				taskID = id
-			} else {
-				ws, err := namedWorkspace(ctx, client, task)
-				if err != nil {
-					return xerrors.Errorf("resolve task %q: %w", task, err)
-				}
-
-				taskID = ws.ID
+			task, err := exp.TaskByIdentifier(ctx, identifier)
+			if err != nil {
+				return xerrors.Errorf("resolve task %q: %w", identifier, err)
 			}
 
-			logs, err := exp.TaskLogs(ctx, codersdk.Me, taskID)
+			logs, err := exp.TaskLogs(ctx, codersdk.Me, task.ID)
 			if err != nil {
 				return xerrors.Errorf("get task logs: %w", err)
 			}
diff --git a/cli/exp_task_logs_test.go b/cli/exp_task_logs_test.go
index 5137c8b40fa56..859ff135d0d63 100644
--- a/cli/exp_task_logs_test.go
+++ b/cli/exp_task_logs_test.go
@@ -23,8 +23,6 @@ import (
 func Test_TaskLogs(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed up-stack!")
-
 	testMessages := []agentapisdk.Message{
 		{
 			Id:      0,
@@ -40,15 +38,15 @@ func Test_TaskLogs(t *testing.T) {
 		},
 	}
 
-	t.Run("ByWorkspaceName_JSON", func(t *testing.T) {
+	t.Run("ByTaskName_JSON", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
 		userClient := client // user already has access to their own workspace
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "logs", workspace.Name, "--output", "json")
+		inv, root := clitest.New(t, "exp", "task", "logs", task.Name, "--output", "json")
 		inv.Stdout = &stdout
 		clitest.SetupConfig(t, userClient, root)
 
@@ -66,15 +64,15 @@ func Test_TaskLogs(t *testing.T) {
 		require.Equal(t, codersdk.TaskLogTypeOutput, logs[1].Type)
 	})
 
-	t.Run("ByWorkspaceID_JSON", func(t *testing.T) {
+	t.Run("ByTaskID_JSON", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
 		userClient := client
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "logs", workspace.ID.String(), "--output", "json")
+		inv, root := clitest.New(t, "exp", "task", "logs", task.ID.String(), "--output", "json")
 		inv.Stdout = &stdout
 		clitest.SetupConfig(t, userClient, root)
 
@@ -92,15 +90,15 @@ func Test_TaskLogs(t *testing.T) {
 		require.Equal(t, codersdk.TaskLogTypeOutput, logs[1].Type)
 	})
 
-	t.Run("ByWorkspaceID_Table", func(t *testing.T) {
+	t.Run("ByTaskID_Table", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsOK(testMessages))
 		userClient := client
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "logs", workspace.ID.String())
+		inv, root := clitest.New(t, "exp", "task", "logs", task.ID.String())
 		inv.Stdout = &stdout
 		clitest.SetupConfig(t, userClient, root)
 
@@ -114,7 +112,7 @@ func Test_TaskLogs(t *testing.T) {
 		require.Contains(t, output, "output")
 	})
 
-	t.Run("WorkspaceNotFound_ByName", func(t *testing.T) {
+	t.Run("TaskNotFound_ByName", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
@@ -132,7 +130,7 @@ func Test_TaskLogs(t *testing.T) {
 		require.ErrorContains(t, err, httpapi.ResourceNotFoundResponse.Message)
 	})
 
-	t.Run("WorkspaceNotFound_ByID", func(t *testing.T) {
+	t.Run("TaskNotFound_ByID", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
@@ -154,10 +152,10 @@ func Test_TaskLogs(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsErr(assert.AnError))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskLogsErr(assert.AnError))
 		userClient := client
 
-		inv, root := clitest.New(t, "exp", "task", "logs", workspace.ID.String())
+		inv, root := clitest.New(t, "exp", "task", "logs", task.ID.String())
 		clitest.SetupConfig(t, userClient, root)
 
 		err := inv.WithContext(ctx).Run()
diff --git a/cli/exp_task_send.go b/cli/exp_task_send.go
index 4d9e10bbddae5..e8985d55d97da 100644
--- a/cli/exp_task_send.go
+++ b/cli/exp_task_send.go
@@ -3,7 +3,6 @@ package cli
 import (
 	"io"
 
-	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/codersdk"
@@ -39,12 +38,11 @@ func (r *RootCmd) taskSend() *serpent.Command {
 			}
 
 			var (
-				ctx  = inv.Context()
-				exp  = codersdk.NewExperimentalClient(client)
-				task = inv.Args[0]
+				ctx        = inv.Context()
+				exp        = codersdk.NewExperimentalClient(client)
+				identifier = inv.Args[0]
 
 				taskInput string
-				taskID    uuid.UUID
 			)
 
 			if stdin {
@@ -62,18 +60,12 @@ func (r *RootCmd) taskSend() *serpent.Command {
 				taskInput = inv.Args[1]
 			}
 
-			if id, err := uuid.Parse(task); err == nil {
-				taskID = id
-			} else {
-				ws, err := namedWorkspace(ctx, client, task)
-				if err != nil {
-					return xerrors.Errorf("resolve task: %w", err)
-				}
-
-				taskID = ws.ID
+			task, err := exp.TaskByIdentifier(ctx, identifier)
+			if err != nil {
+				return xerrors.Errorf("resolve task: %w", err)
 			}
 
-			if err = exp.TaskSend(ctx, codersdk.Me, taskID, codersdk.TaskSendRequest{Input: taskInput}); err != nil {
+			if err = exp.TaskSend(ctx, codersdk.Me, task.ID, codersdk.TaskSendRequest{Input: taskInput}); err != nil {
 				return xerrors.Errorf("send input to task: %w", err)
 			}
 
diff --git a/cli/exp_task_send_test.go b/cli/exp_task_send_test.go
index 26b69b992dd25..3529cf2e0b9b5 100644
--- a/cli/exp_task_send_test.go
+++ b/cli/exp_task_send_test.go
@@ -22,17 +22,15 @@ import (
 func Test_TaskSend(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed up-stack!")
-
-	t.Run("ByWorkspaceName_WithArgument", func(t *testing.T) {
+	t.Run("ByTaskName_WithArgument", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
 		userClient := client
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "send", workspace.Name, "carry on with the task")
+		inv, root := clitest.New(t, "exp", "task", "send", task.Name, "carry on with the task")
 		inv.Stdout = &stdout
 		clitest.SetupConfig(t, userClient, root)
 
@@ -40,15 +38,15 @@ func Test_TaskSend(t *testing.T) {
 		require.NoError(t, err)
 	})
 
-	t.Run("ByWorkspaceID_WithArgument", func(t *testing.T) {
+	t.Run("ByTaskID_WithArgument", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
 		userClient := client
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "send", workspace.ID.String(), "carry on with the task")
+		inv, root := clitest.New(t, "exp", "task", "send", task.ID.String(), "carry on with the task")
 		inv.Stdout = &stdout
 		clitest.SetupConfig(t, userClient, root)
 
@@ -56,15 +54,15 @@ func Test_TaskSend(t *testing.T) {
 		require.NoError(t, err)
 	})
 
-	t.Run("ByWorkspaceName_WithStdin", func(t *testing.T) {
+	t.Run("ByTaskName_WithStdin", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		client, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
+		client, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendOK(t, "carry on with the task", "you got it"))
 		userClient := client
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "send", workspace.Name, "--stdin")
+		inv, root := clitest.New(t, "exp", "task", "send", task.Name, "--stdin")
 		inv.Stdout = &stdout
 		inv.Stdin = strings.NewReader("carry on with the task")
 		clitest.SetupConfig(t, userClient, root)
@@ -73,7 +71,7 @@ func Test_TaskSend(t *testing.T) {
 		require.NoError(t, err)
 	})
 
-	t.Run("WorkspaceNotFound_ByName", func(t *testing.T) {
+	t.Run("TaskNotFound_ByName", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
@@ -91,7 +89,7 @@ func Test_TaskSend(t *testing.T) {
 		require.ErrorContains(t, err, httpapi.ResourceNotFoundResponse.Message)
 	})
 
-	t.Run("WorkspaceNotFound_ByID", func(t *testing.T) {
+	t.Run("TaskNotFound_ByID", func(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
@@ -113,10 +111,10 @@ func Test_TaskSend(t *testing.T) {
 		t.Parallel()
 		ctx := testutil.Context(t, testutil.WaitLong)
 
-		userClient, workspace := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendErr(t, assert.AnError))
+		userClient, task := setupCLITaskTest(ctx, t, fakeAgentAPITaskSendErr(t, assert.AnError))
 
 		var stdout strings.Builder
-		inv, root := clitest.New(t, "exp", "task", "send", workspace.Name, "some task input")
+		inv, root := clitest.New(t, "exp", "task", "send", task.Name, "some task input")
 		inv.Stdout = &stdout
 		clitest.SetupConfig(t, userClient, root)
 
diff --git a/cli/exp_task_status.go b/cli/exp_task_status.go
index 336efc1a999f6..f34812657a964 100644
--- a/cli/exp_task_status.go
+++ b/cli/exp_task_status.go
@@ -5,7 +5,6 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/cli/cliui"
@@ -84,21 +83,10 @@ func (r *RootCmd) taskStatus() *serpent.Command {
 			}
 
 			ctx := i.Context()
-			ec := codersdk.NewExperimentalClient(client)
+			exp := codersdk.NewExperimentalClient(client)
 			identifier := i.Args[0]
 
-			taskID, err := uuid.Parse(identifier)
-			if err != nil {
-				// Try to resolve the task as a named workspace
-				// TODO: right now tasks are still "workspaces" under the hood.
-				// We should update this once we have a proper task model.
-				ws, err := namedWorkspace(ctx, client, identifier)
-				if err != nil {
-					return err
-				}
-				taskID = ws.ID
-			}
-			task, err := ec.TaskByID(ctx, taskID)
+			task, err := exp.TaskByIdentifier(ctx, identifier)
 			if err != nil {
 				return err
 			}
@@ -119,7 +107,7 @@ func (r *RootCmd) taskStatus() *serpent.Command {
 			// TODO: implement streaming updates instead of polling
 			lastStatusRow := tsr
 			for range t.C {
-				task, err := ec.TaskByID(ctx, taskID)
+				task, err := exp.TaskByID(ctx, task.ID)
 				if err != nil {
 					return err
 				}
diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index d5b4e0a9d668b..01b2a8379d6bd 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -36,26 +36,17 @@ func Test_TaskStatus(t *testing.T) {
 			hf: func(ctx context.Context, _ time.Time) func(w http.ResponseWriter, r *http.Request) {
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/doesnotexist":
-						httpapi.ResourceNotFound(w)
-					default:
-						t.Errorf("unexpected path: %s", r.URL.Path)
-					}
-				}
-			},
-		},
-		{
-			args:        []string{"err-fetching-workspace"},
-			expectError: assert.AnError.Error(),
-			hf: func(ctx context.Context, _ time.Time) func(w http.ResponseWriter, r *http.Request) {
-				return func(w http.ResponseWriter, r *http.Request) {
-					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/err-fetching-workspace":
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-						})
-					case "/api/experimental/tasks/me/11111111-1111-1111-1111-111111111111":
-						httpapi.InternalServerError(w, assert.AnError)
+					case "/api/experimental/tasks":
+						if r.URL.Query().Get("q") == "owner:\"me\"" {
+							httpapi.Write(ctx, w, http.StatusOK, struct {
+								Tasks []codersdk.Task `json:"tasks"`
+								Count int             `json:"count"`
+							}{
+								Tasks: []codersdk.Task{},
+								Count: 0,
+							})
+							return
+						}
 					default:
 						t.Errorf("unexpected path: %s", r.URL.Path)
 					}
@@ -69,10 +60,34 @@ func Test_TaskStatus(t *testing.T) {
 			hf: func(ctx context.Context, now time.Time) func(w http.ResponseWriter, r *http.Request) {
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/exists":
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-						})
+					case "/api/experimental/tasks":
+						if r.URL.Query().Get("q") == "owner:\"me\"" {
+							httpapi.Write(ctx, w, http.StatusOK, struct {
+								Tasks []codersdk.Task `json:"tasks"`
+								Count int             `json:"count"`
+							}{
+								Tasks: []codersdk.Task{{
+									ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+									Name:            "exists",
+									OwnerName:       "me",
+									WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+									CreatedAt:       now,
+									UpdatedAt:       now,
+									CurrentState: &codersdk.TaskStateEntry{
+										State:     codersdk.TaskStateWorking,
+										Timestamp: now,
+										Message:   "Thinking furiously...",
+									},
+									WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
+										Healthy: true,
+									},
+									WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
+									Status:                  codersdk.TaskStatusActive,
+								}},
+								Count: 1,
+							})
+							return
+						}
 					case "/api/experimental/tasks/me/11111111-1111-1111-1111-111111111111":
 						httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
 							ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
@@ -101,31 +116,54 @@ func Test_TaskStatus(t *testing.T) {
 			args: []string{"exists", "--watch"},
 			expectOutput: `
 STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
+5s ago         pending  true
 4s ago         running  true
 3s ago         running  true     working  Reticulating splines...
 2s ago         running  true     complete  Splines reticulated successfully!`,
 			hf: func(ctx context.Context, now time.Time) func(http.ResponseWriter, *http.Request) {
 				var calls atomic.Int64
 				return func(w http.ResponseWriter, r *http.Request) {
-					defer calls.Add(1)
 					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/exists":
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-						})
+					case "/api/experimental/tasks":
+						if r.URL.Query().Get("q") == "owner:\"me\"" {
+							// Return initial task state for --watch test
+							httpapi.Write(ctx, w, http.StatusOK, struct {
+								Tasks []codersdk.Task `json:"tasks"`
+								Count int             `json:"count"`
+							}{
+								Tasks: []codersdk.Task{{
+									ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+									Name:            "exists",
+									OwnerName:       "me",
+									WorkspaceStatus: codersdk.WorkspaceStatusPending,
+									CreatedAt:       now.Add(-5 * time.Second),
+									UpdatedAt:       now.Add(-5 * time.Second),
+									WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
+										Healthy: true,
+									},
+									WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
+									Status:                  codersdk.TaskStatusPending,
+								}},
+								Count: 1,
+							})
+							return
+						}
 					case "/api/experimental/tasks/me/11111111-1111-1111-1111-111111111111":
+						defer calls.Add(1)
 						switch calls.Load() {
 						case 0:
 							httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
 								ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-								WorkspaceStatus: codersdk.WorkspaceStatusPending,
+								Name:            "exists",
+								OwnerName:       "me",
+								WorkspaceStatus: codersdk.WorkspaceStatusRunning,
 								CreatedAt:       now.Add(-5 * time.Second),
-								UpdatedAt:       now.Add(-5 * time.Second),
+								UpdatedAt:       now.Add(-4 * time.Second),
 								WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
 									Healthy: true,
 								},
 								WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
-								Status:                  codersdk.TaskStatusPending,
+								Status:                  codersdk.TaskStatusInitializing,
 							})
 							return
 						case 1:
@@ -194,8 +232,8 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "id": "11111111-1111-1111-1111-111111111111",
   "organization_id": "00000000-0000-0000-0000-000000000000",
   "owner_id": "00000000-0000-0000-0000-000000000000",
-  "owner_name": "",
-  "name": "",
+  "owner_name": "me",
+  "name": "exists",
   "template_id": "00000000-0000-0000-0000-000000000000",
   "template_version_id": "00000000-0000-0000-0000-000000000000",
   "template_name": "",
@@ -204,8 +242,10 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "workspace_id": null,
   "workspace_status": "running",
   "workspace_agent_id": null,
-  "workspace_agent_lifecycle": null,
-  "workspace_agent_health": null,
+  "workspace_agent_lifecycle": "ready",
+  "workspace_agent_health": {
+    "healthy": true
+  },
   "workspace_app_id": null,
   "initial_prompt": "",
   "status": "active",
@@ -218,14 +258,38 @@ STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
   "created_at": "2025-08-26T12:34:56Z",
   "updated_at": "2025-08-26T12:34:56Z"
 }`,
-			hf: func(ctx context.Context, _ time.Time) func(w http.ResponseWriter, r *http.Request) {
+			hf: func(ctx context.Context, now time.Time) func(http.ResponseWriter, *http.Request) {
 				ts := time.Date(2025, 8, 26, 12, 34, 56, 0, time.UTC)
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch r.URL.Path {
-					case "/api/v2/users/me/workspace/exists":
-						httpapi.Write(ctx, w, http.StatusOK, codersdk.Workspace{
-							ID: uuid.MustParse("11111111-1111-1111-1111-111111111111"),
-						})
+					case "/api/experimental/tasks":
+						if r.URL.Query().Get("q") == "owner:\"me\"" {
+							httpapi.Write(ctx, w, http.StatusOK, struct {
+								Tasks []codersdk.Task `json:"tasks"`
+								Count int             `json:"count"`
+							}{
+								Tasks: []codersdk.Task{{
+									ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
+									Name:            "exists",
+									OwnerName:       "me",
+									WorkspaceStatus: codersdk.WorkspaceStatusRunning,
+									CreatedAt:       ts,
+									UpdatedAt:       ts,
+									CurrentState: &codersdk.TaskStateEntry{
+										State:     codersdk.TaskStateWorking,
+										Timestamp: ts.Add(time.Second),
+										Message:   "Thinking furiously...",
+									},
+									WorkspaceAgentHealth: &codersdk.WorkspaceAgentHealth{
+										Healthy: true,
+									},
+									WorkspaceAgentLifecycle: ptr.Ref(codersdk.WorkspaceAgentLifecycleReady),
+									Status:                  codersdk.TaskStatusActive,
+								}},
+								Count: 1,
+							})
+							return
+						}
 					case "/api/experimental/tasks/me/11111111-1111-1111-1111-111111111111":
 						httpapi.Write(ctx, w, http.StatusOK, codersdk.Task{
 							ID:              uuid.MustParse("11111111-1111-1111-1111-111111111111"),
diff --git a/cli/exp_task_test.go b/cli/exp_task_test.go
index 55ee458fb252d..82457ec748763 100644
--- a/cli/exp_task_test.go
+++ b/cli/exp_task_test.go
@@ -17,7 +17,6 @@ import (
 	"golang.org/x/xerrors"
 
 	agentapisdk "github.com/coder/agentapi-sdk-go"
-
 	"github.com/coder/coder/v2/agent"
 	"github.com/coder/coder/v2/agent/agenttest"
 	"github.com/coder/coder/v2/cli/clitest"
@@ -36,8 +35,6 @@ import (
 func Test_Tasks(t *testing.T) {
 	t.Parallel()
 
-	t.Skip("TODO(mafredri): Remove, fixed up-stack!")
-
 	// Given: a template configured for tasks
 	var (
 		ctx           = testutil.Context(t, testutil.WaitLong)
@@ -241,7 +238,7 @@ func fakeAgentAPIEcho(ctx context.Context, t testing.TB, initMsg agentapisdk.Mes
 // setupCLITaskTest creates a test workspace with an AI task template and agent,
 // with a fake agent API configured with the provided set of handlers.
 // Returns the user client and workspace.
-func setupCLITaskTest(ctx context.Context, t *testing.T, agentAPIHandlers map[string]http.HandlerFunc) (*codersdk.Client, codersdk.Workspace) {
+func setupCLITaskTest(ctx context.Context, t *testing.T, agentAPIHandlers map[string]http.HandlerFunc) (*codersdk.Client, codersdk.Task) {
 	t.Helper()
 
 	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
@@ -254,11 +251,18 @@ func setupCLITaskTest(ctx context.Context, t *testing.T, agentAPIHandlers map[st
 	template := createAITaskTemplate(t, client, owner.OrganizationID, withSidebarURL(fakeAPI.URL()), withAgentToken(authToken))
 
 	wantPrompt := "test prompt"
-	workspace := coderdtest.CreateWorkspace(t, userClient, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-		req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-			{Name: codersdk.AITaskPromptParameterName, Value: wantPrompt},
-		}
+	exp := codersdk.NewExperimentalClient(userClient)
+	task, err := exp.CreateTask(ctx, codersdk.Me, codersdk.CreateTaskRequest{
+		TemplateVersionID: template.ActiveVersionID,
+		Input:             wantPrompt,
+		Name:              "test-task",
 	})
+	require.NoError(t, err)
+
+	// Wait for the task's underlying workspace to be built
+	require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
+	workspace, err := userClient.Workspace(ctx, task.WorkspaceID.UUID)
+	require.NoError(t, err)
 	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 	agentClient := agentsdk.New(client.URL, agentsdk.WithFixedToken(authToken))
@@ -269,7 +273,7 @@ func setupCLITaskTest(ctx context.Context, t *testing.T, agentAPIHandlers map[st
 	coderdtest.NewWorkspaceAgentWaiter(t, client, workspace.ID).
 		WaitFor(coderdtest.AgentsReady)
 
-	return userClient, workspace
+	return userClient, task
 }
 
 // createAITaskTemplate creates a template configured for AI tasks with a sidebar app.
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index e5f5260a2463d..272bdba9c1048 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -2,7 +2,6 @@ package coderd
 
 import (
 	"context"
-	"database/sql"
 	"fmt"
 	"net"
 	"net/http"
@@ -12,6 +11,7 @@ import (
 	"time"
 
 	"github.com/google/uuid"
+	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
 	"github.com/coder/coder/v2/coderd/audit"
@@ -360,107 +360,6 @@ func taskFromDBTaskAndWorkspace(dbTask database.Task, ws codersdk.Workspace) cod
 	}
 }
 
-func taskFromWorkspace(ws codersdk.Workspace, initialPrompt string) codersdk.Task {
-	// TODO(DanielleMaywood):
-	// This just picks up the first agent it discovers.
-	// This approach _might_ break when a task has multiple agents,
-	// depending on which agent was found first.
-	//
-	// We explicitly do not have support for running tasks
-	// inside of a sub agent at the moment, so we can be sure
-	// that any sub agents are not the agent we're looking for.
-	var taskAgentID uuid.NullUUID
-	var taskAgentLifecycle *codersdk.WorkspaceAgentLifecycle
-	var taskAgentHealth *codersdk.WorkspaceAgentHealth
-	for _, resource := range ws.LatestBuild.Resources {
-		for _, agent := range resource.Agents {
-			if agent.ParentID.Valid {
-				continue
-			}
-
-			taskAgentID = uuid.NullUUID{Valid: true, UUID: agent.ID}
-			taskAgentLifecycle = &agent.LifecycleState
-			taskAgentHealth = &agent.Health
-			break
-		}
-	}
-
-	// Ignore 'latest app status' if it is older than the latest build and the
-	// latest build is a 'start' transition. This ensures that you don't show a
-	// stale app status from a previous build. For stop transitions, there is
-	// still value in showing the latest app status.
-	var currentState *codersdk.TaskStateEntry
-	if ws.LatestAppStatus != nil {
-		if ws.LatestBuild.Transition != codersdk.WorkspaceTransitionStart || ws.LatestAppStatus.CreatedAt.After(ws.LatestBuild.CreatedAt) {
-			currentState = &codersdk.TaskStateEntry{
-				Timestamp: ws.LatestAppStatus.CreatedAt,
-				State:     codersdk.TaskState(ws.LatestAppStatus.State),
-				Message:   ws.LatestAppStatus.Message,
-				URI:       ws.LatestAppStatus.URI,
-			}
-		}
-	}
-
-	var appID uuid.NullUUID
-	if ws.LatestBuild.AITaskSidebarAppID != nil {
-		appID = uuid.NullUUID{
-			Valid: true,
-			UUID:  *ws.LatestBuild.AITaskSidebarAppID,
-		}
-	}
-
-	return codersdk.Task{
-		ID:                      ws.ID,
-		OrganizationID:          ws.OrganizationID,
-		OwnerID:                 ws.OwnerID,
-		OwnerName:               ws.OwnerName,
-		Name:                    ws.Name,
-		TemplateID:              ws.TemplateID,
-		TemplateName:            ws.TemplateName,
-		TemplateDisplayName:     ws.TemplateDisplayName,
-		TemplateIcon:            ws.TemplateIcon,
-		WorkspaceID:             uuid.NullUUID{Valid: true, UUID: ws.ID},
-		WorkspaceBuildNumber:    ws.LatestBuild.BuildNumber,
-		WorkspaceAgentID:        taskAgentID,
-		WorkspaceAgentLifecycle: taskAgentLifecycle,
-		WorkspaceAgentHealth:    taskAgentHealth,
-		WorkspaceAppID:          appID,
-		CreatedAt:               ws.CreatedAt,
-		UpdatedAt:               ws.UpdatedAt,
-		InitialPrompt:           initialPrompt,
-		WorkspaceStatus:         ws.LatestBuild.Status,
-		CurrentState:            currentState,
-	}
-}
-
-// tasksFromWorkspaces converts a slice of API workspaces into tasks, fetching
-// prompts and mapping status/state. This method enforces that only AI task
-// workspaces are given.
-func (api *API) tasksFromWorkspaces(ctx context.Context, apiWorkspaces []codersdk.Workspace) ([]codersdk.Task, error) {
-	// Fetch prompts for each workspace build and map by build ID.
-	buildIDs := make([]uuid.UUID, 0, len(apiWorkspaces))
-	for _, ws := range apiWorkspaces {
-		buildIDs = append(buildIDs, ws.LatestBuild.ID)
-	}
-	parameters, err := api.Database.GetWorkspaceBuildParametersByBuildIDs(ctx, buildIDs)
-	if err != nil {
-		return nil, err
-	}
-	promptsByBuildID := make(map[uuid.UUID]string, len(parameters))
-	for _, p := range parameters {
-		if p.Name == codersdk.AITaskPromptParameterName {
-			promptsByBuildID[p.WorkspaceBuildID] = p.Value
-		}
-	}
-
-	tasks := make([]codersdk.Task, 0, len(apiWorkspaces))
-	for _, ws := range apiWorkspaces {
-		tasks = append(tasks, taskFromWorkspace(ws, promptsByBuildID[ws.LatestBuild.ID]))
-	}
-
-	return tasks, nil
-}
-
 // tasksListResponse wraps a list of experimental tasks.
 //
 // Experimental: Response shape is experimental and may change.
@@ -474,115 +373,102 @@ type tasksListResponse struct {
 // @ID list-tasks
 // @Security CoderSessionToken
 // @Tags Experimental
-// @Param q query string false "Search query for filtering tasks"
-// @Param after_id query string false "Return tasks after this ID for pagination"
-// @Param limit query int false "Maximum number of tasks to return" minimum(1) maximum(100) default(25)
-// @Param offset query int false "Offset for pagination" minimum(0) default(0)
+// @Param q query string false "Search query for filtering tasks. Supports: owner:<username/uuid/me>, organization:<org-name/uuid>, status:<status>"
 // @Success 200 {object} coderd.tasksListResponse
 // @Router /api/experimental/tasks [get]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
-// tasksList is an experimental endpoint to list AI tasks by mapping
-// workspaces to a task-shaped response.
+// tasksList is an experimental endpoint to list tasks.
 func (api *API) tasksList(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
 
-	// Support standard pagination/filters for workspaces.
-	page, ok := ParsePagination(rw, r)
-	if !ok {
-		return
-	}
+	// Parse query parameters for filtering tasks.
 	queryStr := r.URL.Query().Get("q")
-	filter, errs := searchquery.Workspaces(ctx, api.Database, queryStr, page, api.AgentInactiveDisconnectTimeout)
+	filter, errs := searchquery.Tasks(ctx, api.Database, queryStr, apiKey.UserID)
 	if len(errs) > 0 {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message:     "Invalid workspace search query.",
+			Message:     "Invalid task search query.",
 			Validations: errs,
 		})
 		return
 	}
 
-	// Ensure that we only include AI task workspaces in the results.
-	filter.HasAITask = sql.NullBool{Valid: true, Bool: true}
-
-	if filter.OwnerUsername == "me" {
-		filter.OwnerID = apiKey.UserID
-		filter.OwnerUsername = ""
-	}
-
-	prepared, err := api.HTTPAuth.AuthorizeSQLFilter(r, policy.ActionRead, rbac.ResourceWorkspace.Type)
+	// Fetch all tasks matching the filters from the database.
+	dbTasks, err := api.Database.ListTasks(ctx, filter)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error preparing sql filter.",
+			Message: "Internal error fetching tasks.",
 			Detail:  err.Error(),
 		})
 		return
 	}
 
-	// Order with requester's favorites first, include summary row.
-	filter.RequesterID = apiKey.UserID
-	filter.WithSummary = true
-
-	workspaceRows, err := api.Database.GetAuthorizedWorkspaces(ctx, filter, prepared)
+	tasks, err := api.convertTasks(ctx, apiKey.UserID, dbTasks)
 	if err != nil {
 		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspaces.",
+			Message: "Internal error converting tasks.",
 			Detail:  err.Error(),
 		})
 		return
 	}
-	if len(workspaceRows) == 0 {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspaces.",
-			Detail:  "Workspace summary row is missing.",
-		})
-		return
+
+	httpapi.Write(ctx, rw, http.StatusOK, tasksListResponse{
+		Tasks: tasks,
+		Count: len(tasks),
+	})
+}
+
+// convertTasks converts database tasks to API tasks, enriching them with
+// workspace information.
+func (api *API) convertTasks(ctx context.Context, requesterID uuid.UUID, dbTasks []database.Task) ([]codersdk.Task, error) {
+	if len(dbTasks) == 0 {
+		return []codersdk.Task{}, nil
 	}
-	if len(workspaceRows) == 1 {
-		httpapi.Write(ctx, rw, http.StatusOK, tasksListResponse{
-			Tasks: []codersdk.Task{},
-			Count: 0,
-		})
-		return
+
+	// Prepare to batch fetch workspaces.
+	workspaceIDs := make([]uuid.UUID, 0, len(dbTasks))
+	for _, task := range dbTasks {
+		if !task.WorkspaceID.Valid {
+			return nil, xerrors.New("task has no workspace ID")
+		}
+		workspaceIDs = append(workspaceIDs, task.WorkspaceID.UUID)
 	}
 
-	// Skip summary row.
-	workspaceRows = workspaceRows[:len(workspaceRows)-1]
+	// Fetch workspaces for tasks that have workspaces.
+	workspaceRows, err := api.Database.GetWorkspaces(ctx, database.GetWorkspacesParams{
+		WorkspaceIds: workspaceIDs,
+	})
+	if err != nil {
+		return nil, xerrors.Errorf("fetch workspaces: %w", err)
+	}
 
 	workspaces := database.ConvertWorkspaceRows(workspaceRows)
 
 	// Gather associated data and convert to API workspaces.
 	data, err := api.workspaceData(ctx, workspaces)
 	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching workspace resources.",
-			Detail:  err.Error(),
-		})
-		return
+		return nil, xerrors.Errorf("fetch workspace data: %w", err)
 	}
-	apiWorkspaces, err := convertWorkspaces(apiKey.UserID, workspaces, data)
+
+	apiWorkspaces, err := convertWorkspaces(requesterID, workspaces, data)
 	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error converting workspaces.",
-			Detail:  err.Error(),
-		})
-		return
+		return nil, xerrors.Errorf("convert workspaces: %w", err)
 	}
 
-	tasks, err := api.tasksFromWorkspaces(ctx, apiWorkspaces)
-	if err != nil {
-		httpapi.Write(ctx, rw, http.StatusInternalServerError, codersdk.Response{
-			Message: "Internal error fetching task prompts and states.",
-			Detail:  err.Error(),
-		})
-		return
+	workspacesByID := make(map[uuid.UUID]codersdk.Workspace)
+	for _, ws := range apiWorkspaces {
+		workspacesByID[ws.ID] = ws
 	}
 
-	httpapi.Write(ctx, rw, http.StatusOK, tasksListResponse{
-		Tasks: tasks,
-		Count: len(tasks),
-	})
+	// Convert tasks to SDK format.
+	result := make([]codersdk.Task, 0, len(dbTasks))
+	for _, dbTask := range dbTasks {
+		task := taskFromDBTaskAndWorkspace(dbTask, workspacesByID[dbTask.WorkspaceID.UUID])
+		result = append(result, task)
+	}
+
+	return result, nil
 }
 
 // @Summary Get AI task by ID
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index c88785c858453..10b33f4ab957b 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -239,35 +239,38 @@ func TestTasks(t *testing.T) {
 	t.Run("List", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 		user := coderdtest.CreateFirstUser(t, client)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
 		template := createAITemplate(t, client, user)
 
-		// Create a workspace (task) with a specific prompt.
+		// Create a task with a specific prompt using the new data model.
 		wantPrompt := "build me a web app"
-		workspace := coderdtest.CreateWorkspace(t, client, template.ID, func(req *codersdk.CreateWorkspaceRequest) {
-			req.RichParameterValues = []codersdk.WorkspaceBuildParameter{
-				{Name: codersdk.AITaskPromptParameterName, Value: wantPrompt},
-			}
+		exp := codersdk.NewExperimentalClient(client)
+		task, err := exp.CreateTask(ctx, codersdk.Me, codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             wantPrompt,
 		})
+		require.NoError(t, err)
+		require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
+
+		// Wait for the workspace to be built.
+		workspace, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+		require.NoError(t, err)
 		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// List tasks via experimental API and verify the prompt and status mapping.
-		exp := codersdk.NewExperimentalClient(client)
 		tasks, err := exp.Tasks(ctx, &codersdk.TasksFilter{Owner: codersdk.Me})
 		require.NoError(t, err)
 
-		got, ok := slice.Find(tasks, func(task codersdk.Task) bool { return task.ID == workspace.ID })
+		got, ok := slice.Find(tasks, func(t codersdk.Task) bool { return t.ID == task.ID })
 		require.True(t, ok, "task should be found in the list")
 		assert.Equal(t, wantPrompt, got.InitialPrompt, "task prompt should match the AI Prompt parameter")
-		assert.Equal(t, workspace.Name, got.Name, "task name should map from workspace name")
-		assert.Equal(t, workspace.ID, got.WorkspaceID.UUID, "workspace id should match")
-		// Status should be populated via app status or workspace status mapping.
-		assert.NotEmpty(t, got.WorkspaceStatus, "task status should not be empty")
+		assert.Equal(t, task.WorkspaceID.UUID, got.WorkspaceID.UUID, "workspace id should match")
+		// Status should be populated via the tasks_with_status view.
+		assert.NotEmpty(t, got.Status, "task status should not be empty")
+		assert.NotEmpty(t, got.WorkspaceStatus, "workspace status should not be empty")
 	})
 
 	t.Run("Get", func(t *testing.T) {
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index d6ba1d081d413..669c753b2498d 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -151,32 +151,9 @@ const docTemplate = `{
                 "parameters": [
                     {
                         "type": "string",
-                        "description": "Search query for filtering tasks",
+                        "description": "Search query for filtering tasks. Supports: owner:\u003cusername/uuid/me\u003e, organization:\u003corg-name/uuid\u003e, status:\u003cstatus\u003e",
                         "name": "q",
                         "in": "query"
-                    },
-                    {
-                        "type": "string",
-                        "description": "Return tasks after this ID for pagination",
-                        "name": "after_id",
-                        "in": "query"
-                    },
-                    {
-                        "maximum": 100,
-                        "minimum": 1,
-                        "type": "integer",
-                        "default": 25,
-                        "description": "Maximum number of tasks to return",
-                        "name": "limit",
-                        "in": "query"
-                    },
-                    {
-                        "minimum": 0,
-                        "type": "integer",
-                        "default": 0,
-                        "description": "Offset for pagination",
-                        "name": "offset",
-                        "in": "query"
                     }
                 ],
                 "responses": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index bf363ba78b80e..ba019ba82d574 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -125,32 +125,9 @@
 				"parameters": [
 					{
 						"type": "string",
-						"description": "Search query for filtering tasks",
+						"description": "Search query for filtering tasks. Supports: owner:\u003cusername/uuid/me\u003e, organization:\u003corg-name/uuid\u003e, status:\u003cstatus\u003e",
 						"name": "q",
 						"in": "query"
-					},
-					{
-						"type": "string",
-						"description": "Return tasks after this ID for pagination",
-						"name": "after_id",
-						"in": "query"
-					},
-					{
-						"maximum": 100,
-						"minimum": 1,
-						"type": "integer",
-						"default": 25,
-						"description": "Maximum number of tasks to return",
-						"name": "limit",
-						"in": "query"
-					},
-					{
-						"minimum": 0,
-						"type": "integer",
-						"default": 0,
-						"description": "Offset for pagination",
-						"name": "offset",
-						"in": "query"
 					}
 				],
 				"responses": {
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
index 1479dfb198944..9eaf1afb93a15 100644
--- a/coderd/database/dbfake/dbfake.go
+++ b/coderd/database/dbfake/dbfake.go
@@ -120,19 +120,23 @@ func (b WorkspaceBuildBuilder) WithAgent(mutations ...func([]*sdkproto.Agent) []
 }
 
 func (b WorkspaceBuildBuilder) WithTask(seed *sdkproto.App) WorkspaceBuildBuilder {
-	//nolint: revive // returns modified struct
-	b.taskAppID = uuid.New()
 	if seed == nil {
 		seed = &sdkproto.App{}
 	}
+
+	var err error
+	//nolint: revive // returns modified struct
+	b.taskAppID, err = uuid.Parse(takeFirst(seed.Id, uuid.NewString()))
+	require.NoError(b.t, err)
+
 	return b.Params(database.WorkspaceBuildParameter{
 		Name:  codersdk.AITaskPromptParameterName,
 		Value: "list me",
 	}).WithAgent(func(a []*sdkproto.Agent) []*sdkproto.Agent {
 		a[0].Apps = []*sdkproto.App{
 			{
-				Id:   takeFirst(seed.Id, b.taskAppID.String()),
-				Slug: takeFirst(seed.Slug, "vcode"),
+				Id:   b.taskAppID.String(),
+				Slug: takeFirst(seed.Slug, "task-app"),
 				Url:  takeFirst(seed.Url, ""),
 			},
 		}
@@ -195,11 +199,11 @@ func (b WorkspaceBuildBuilder) Do() WorkspaceResponse {
 	if b.ws.ID == uuid.Nil {
 		// nolint: revive
 		b.ws = dbgen.Workspace(b.t, b.db, b.ws)
-		resp.Workspace = b.ws
 		b.logger.Debug(context.Background(), "created workspace",
-			slog.F("name", resp.Workspace.Name),
-			slog.F("workspace_id", resp.Workspace.ID))
+			slog.F("name", b.ws.Name),
+			slog.F("workspace_id", b.ws.ID))
 	}
+	resp.Workspace = b.ws
 	b.seed.WorkspaceID = b.ws.ID
 	b.seed.InitiatorID = takeFirst(b.seed.InitiatorID, b.ws.OwnerID)
 
@@ -273,6 +277,30 @@ func (b WorkspaceBuildBuilder) Do() WorkspaceResponse {
 		slog.F("workspace_id", resp.Workspace.ID),
 		slog.F("build_number", resp.Build.BuildNumber))
 
+	// If this is a task workspace, link it to the workspace build.
+	task, err := b.db.GetTaskByWorkspaceID(ownerCtx, resp.Workspace.ID)
+	if err != nil {
+		if b.taskAppID != uuid.Nil {
+			require.Fail(b.t, "task app configured but failed to get task by workspace id", err)
+		}
+	} else {
+		if b.taskAppID == uuid.Nil {
+			require.Fail(b.t, "task app not configured but workspace is a task workspace")
+		}
+
+		app := mustWorkspaceAppByWorkspaceAndBuildAndAppID(ownerCtx, b.t, b.db, resp.Workspace.ID, resp.Build.BuildNumber, b.taskAppID)
+		_, err = b.db.UpsertTaskWorkspaceApp(ownerCtx, database.UpsertTaskWorkspaceAppParams{
+			TaskID:               task.ID,
+			WorkspaceBuildNumber: resp.Build.BuildNumber,
+			WorkspaceAgentID:     uuid.NullUUID{UUID: app.AgentID, Valid: true},
+			WorkspaceAppID:       uuid.NullUUID{UUID: app.ID, Valid: true},
+		})
+		require.NoError(b.t, err, "upsert task workspace app")
+		b.logger.Debug(context.Background(), "linked task to workspace build",
+			slog.F("task_id", task.ID),
+			slog.F("build_number", resp.Build.BuildNumber))
+	}
+
 	for i := range b.params {
 		b.params[i].WorkspaceBuildID = resp.Build.ID
 	}
@@ -623,3 +651,30 @@ func takeFirst[Value comparable](values ...Value) Value {
 		return v != empty
 	})
 }
+
+// mustWorkspaceAppByWorkspaceAndBuildAndAppID finds a workspace app by
+// workspace ID, build number, and app ID. It returns the workspace app
+// if found, otherwise fails the test.
+func mustWorkspaceAppByWorkspaceAndBuildAndAppID(ctx context.Context, t testing.TB, db database.Store, workspaceID uuid.UUID, buildNumber int32, appID uuid.UUID) database.WorkspaceApp {
+	t.Helper()
+
+	agents, err := db.GetWorkspaceAgentsByWorkspaceAndBuildNumber(ctx, database.GetWorkspaceAgentsByWorkspaceAndBuildNumberParams{
+		WorkspaceID: workspaceID,
+		BuildNumber: buildNumber,
+	})
+	require.NoError(t, err, "get workspace agents")
+	require.NotEmpty(t, agents, "no agents found for workspace")
+
+	for _, agent := range agents {
+		apps, err := db.GetWorkspaceAppsByAgentID(ctx, agent.ID)
+		require.NoError(t, err, "get workspace apps")
+		for _, app := range apps {
+			if app.ID == appID {
+				return app
+			}
+		}
+	}
+
+	require.FailNow(t, "could not find workspace app", "workspaceID=%s buildNumber=%d appID=%s", workspaceID, buildNumber, appID)
+	return database.WorkspaceApp{} // Unreachable.
+}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 55bb5953d350e..d257d571c0240 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12717,16 +12717,18 @@ SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, t
 WHERE tws.deleted_at IS NULL
 AND CASE WHEN $1::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = $1::UUID ELSE TRUE END
 AND CASE WHEN $2::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = $2::UUID ELSE TRUE END
+AND CASE WHEN $3::text != '' THEN tws.status = $3::task_status ELSE TRUE END
 ORDER BY tws.created_at DESC
 `
 
 type ListTasksParams struct {
 	OwnerID        uuid.UUID `db:"owner_id" json:"owner_id"`
 	OrganizationID uuid.UUID `db:"organization_id" json:"organization_id"`
+	Status         string    `db:"status" json:"status"`
 }
 
 func (q *sqlQuerier) ListTasks(ctx context.Context, arg ListTasksParams) ([]Task, error) {
-	rows, err := q.db.QueryContext(ctx, listTasks, arg.OwnerID, arg.OrganizationID)
+	rows, err := q.db.QueryContext(ctx, listTasks, arg.OwnerID, arg.OrganizationID, arg.Status)
 	if err != nil {
 		return nil, err
 	}
diff --git a/coderd/database/queries/tasks.sql b/coderd/database/queries/tasks.sql
index 9e83a9f87aaef..6c076b8ccaacf 100644
--- a/coderd/database/queries/tasks.sql
+++ b/coderd/database/queries/tasks.sql
@@ -46,6 +46,7 @@ SELECT * FROM tasks_with_status tws
 WHERE tws.deleted_at IS NULL
 AND CASE WHEN @owner_id::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = @owner_id::UUID ELSE TRUE END
 AND CASE WHEN @organization_id::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = @organization_id::UUID ELSE TRUE END
+AND CASE WHEN @status::text != '' THEN tws.status = @status::task_status ELSE TRUE END
 ORDER BY tws.created_at DESC;
 
 -- name: DeleteTask :one
diff --git a/coderd/searchquery/search.go b/coderd/searchquery/search.go
index 3b34edacef28f..59ec3e04923ff 100644
--- a/coderd/searchquery/search.go
+++ b/coderd/searchquery/search.go
@@ -391,6 +391,43 @@ func AIBridgeInterceptions(ctx context.Context, db database.Store, query string,
 	return filter, parser.Errors
 }
 
+// Tasks parses a search query for tasks.
+//
+// Supported query parameters:
+//   - owner: string (username, UUID, or 'me' for current user)
+//   - organization: string (organization UUID or name)
+//   - status: string (pending, initializing, active, paused, error, unknown)
+func Tasks(ctx context.Context, db database.Store, query string, actorID uuid.UUID) (database.ListTasksParams, []codersdk.ValidationError) {
+	filter := database.ListTasksParams{
+		OwnerID:        uuid.Nil,
+		OrganizationID: uuid.Nil,
+		Status:         "",
+	}
+
+	if query == "" {
+		return filter, nil
+	}
+
+	// Always lowercase for all searches.
+	query = strings.ToLower(query)
+	values, errors := searchTerms(query, func(term string, values url.Values) error {
+		// Default unqualified terms to owner
+		values.Add("owner", term)
+		return nil
+	})
+	if len(errors) > 0 {
+		return filter, errors
+	}
+
+	parser := httpapi.NewQueryParamParser()
+	filter.OwnerID = parseUser(ctx, db, parser, values, "owner", actorID)
+	filter.OrganizationID = parseOrganization(ctx, db, parser, values, "organization")
+	filter.Status = parser.String(values, "", "status")
+
+	parser.ErrorExcessParams(values)
+	return filter, parser.Errors
+}
+
 func searchTerms(query string, defaultKey func(term string, values url.Values) error) (url.Values, []codersdk.ValidationError) {
 	searchValues := make(url.Values)
 
diff --git a/coderd/searchquery/search_test.go b/coderd/searchquery/search_test.go
index 84d4509d0ec60..44ae9d1021159 100644
--- a/coderd/searchquery/search_test.go
+++ b/coderd/searchquery/search_test.go
@@ -944,3 +944,199 @@ func TestSearchTemplates(t *testing.T) {
 		})
 	}
 }
+
+func TestSearchTasks(t *testing.T) {
+	t.Parallel()
+
+	userID := uuid.MustParse("10000000-0000-0000-0000-000000000001")
+	orgID := uuid.MustParse("20000000-0000-0000-0000-000000000001")
+
+	testCases := []struct {
+		Name                  string
+		Query                 string
+		ActorID               uuid.UUID
+		Expected              database.ListTasksParams
+		ExpectedErrorContains string
+		Setup                 func(t *testing.T, db database.Store)
+	}{
+		{
+			Name:     "Empty",
+			Query:    "",
+			Expected: database.ListTasksParams{},
+		},
+		{
+			Name:  "OwnerUsername",
+			Query: "owner:alice",
+			Setup: func(t *testing.T, db database.Store) {
+				dbgen.User(t, db, database.User{
+					ID:       userID,
+					Username: "alice",
+				})
+			},
+			Expected: database.ListTasksParams{
+				OwnerID: userID,
+			},
+		},
+		{
+			Name:    "OwnerMe",
+			Query:   "owner:me",
+			ActorID: userID,
+			Expected: database.ListTasksParams{
+				OwnerID: userID,
+			},
+		},
+		{
+			Name:  "OwnerUUID",
+			Query: fmt.Sprintf("owner:%s", userID),
+			Expected: database.ListTasksParams{
+				OwnerID: userID,
+			},
+		},
+		{
+			Name:  "StatusActive",
+			Query: "status:active",
+			Expected: database.ListTasksParams{
+				Status: "active",
+			},
+		},
+		{
+			Name:  "StatusPending",
+			Query: "status:pending",
+			Expected: database.ListTasksParams{
+				Status: "pending",
+			},
+		},
+		{
+			Name:  "Organization",
+			Query: "organization:acme",
+			Setup: func(t *testing.T, db database.Store) {
+				dbgen.Organization(t, db, database.Organization{
+					ID:   orgID,
+					Name: "acme",
+				})
+			},
+			Expected: database.ListTasksParams{
+				OrganizationID: orgID,
+			},
+		},
+		{
+			Name:  "OrganizationUUID",
+			Query: fmt.Sprintf("organization:%s", orgID),
+			Expected: database.ListTasksParams{
+				OrganizationID: orgID,
+			},
+		},
+		{
+			Name:  "Combined",
+			Query: "owner:alice organization:acme status:active",
+			Setup: func(t *testing.T, db database.Store) {
+				dbgen.Organization(t, db, database.Organization{
+					ID:   orgID,
+					Name: "acme",
+				})
+				dbgen.User(t, db, database.User{
+					ID:       userID,
+					Username: "alice",
+				})
+			},
+			Expected: database.ListTasksParams{
+				OwnerID:        userID,
+				OrganizationID: orgID,
+				Status:         "active",
+			},
+		},
+		{
+			Name:  "QuotedOwner",
+			Query: `owner:"alice"`,
+			Setup: func(t *testing.T, db database.Store) {
+				dbgen.User(t, db, database.User{
+					ID:       userID,
+					Username: "alice",
+				})
+			},
+			Expected: database.ListTasksParams{
+				OwnerID: userID,
+			},
+		},
+		{
+			Name:  "QuotedStatus",
+			Query: `status:"pending"`,
+			Expected: database.ListTasksParams{
+				Status: "pending",
+			},
+		},
+		{
+			Name:  "DefaultToOwner",
+			Query: "alice",
+			Setup: func(t *testing.T, db database.Store) {
+				dbgen.User(t, db, database.User{
+					ID:       userID,
+					Username: "alice",
+				})
+			},
+			Expected: database.ListTasksParams{
+				OwnerID: userID,
+			},
+		},
+		{
+			Name:                  "InvalidOwner",
+			Query:                 "owner:nonexistent",
+			ExpectedErrorContains: "does not exist",
+		},
+		{
+			Name:                  "InvalidOrganization",
+			Query:                 "organization:nonexistent",
+			ExpectedErrorContains: "does not exist",
+		},
+		{
+			Name:  "ExtraParam",
+			Query: "owner:alice invalid:param",
+			Setup: func(t *testing.T, db database.Store) {
+				dbgen.User(t, db, database.User{
+					ID:       userID,
+					Username: "alice",
+				})
+			},
+			ExpectedErrorContains: "is not a valid query param",
+		},
+		{
+			Name:                  "ExtraColon",
+			Query:                 "owner:alice:extra",
+			ExpectedErrorContains: "can only contain 1 ':'",
+		},
+		{
+			Name:                  "PrefixColon",
+			Query:                 ":owner",
+			ExpectedErrorContains: "cannot start or end with ':'",
+		},
+		{
+			Name:                  "SuffixColon",
+			Query:                 "owner:",
+			ExpectedErrorContains: "cannot start or end with ':'",
+		},
+	}
+
+	for _, c := range testCases {
+		t.Run(c.Name, func(t *testing.T) {
+			t.Parallel()
+			db, _ := dbtestutil.NewDB(t)
+
+			if c.Setup != nil {
+				c.Setup(t, db)
+			}
+
+			values, errs := searchquery.Tasks(context.Background(), db, c.Query, c.ActorID)
+			if c.ExpectedErrorContains != "" {
+				require.True(t, len(errs) > 0, "expect some errors")
+				var s strings.Builder
+				for _, err := range errs {
+					_, _ = s.WriteString(fmt.Sprintf("%s: %s\n", err.Field, err.Detail))
+				}
+				require.Contains(t, s.String(), c.ExpectedErrorContains)
+			} else {
+				require.Len(t, errs, 0, "expected no error")
+				require.Equal(t, c.Expected, values, "expected values")
+			}
+		})
+	}
+}
diff --git a/coderd/telemetry/telemetry.go b/coderd/telemetry/telemetry.go
index 37e41fcd70c62..1526f51f167e8 100644
--- a/coderd/telemetry/telemetry.go
+++ b/coderd/telemetry/telemetry.go
@@ -734,6 +734,7 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 		dbTasks, err := r.options.Database.ListTasks(ctx, database.ListTasksParams{
 			OwnerID:        uuid.Nil,
 			OrganizationID: uuid.Nil,
+			Status:         "",
 		})
 		if err != nil {
 			return err
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index 8232d80dc44aa..b5c7fa5aa9604 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -103,6 +103,17 @@ const (
 	TaskStatusError        TaskStatus = "error"
 )
 
+func AllTaskStatuses() []TaskStatus {
+	return []TaskStatus{
+		TaskStatusPending,
+		TaskStatusInitializing,
+		TaskStatusActive,
+		TaskStatusPaused,
+		TaskStatusError,
+		TaskStatusUnknown,
+	}
+}
+
 // TaskState represents the high-level lifecycle of a task.
 //
 // Experimental: This type is experimental and may change in the future.
@@ -160,18 +171,37 @@ type TaskStateEntry struct {
 type TasksFilter struct {
 	// Owner can be a username, UUID, or "me".
 	Owner string `json:"owner,omitempty"`
-	// Status filters the tasks by their status.
-	//
-	// TODO(mafredri): Enable this field.
-	// Status TaskStatus `json:"status,omitempty"`
-	// WorkspaceStatus is a workspace status to filter by.
-	//
-	// Deprecated: Use TaskStatus instead.
-	WorkspaceStatus string `json:"workspace_status,omitempty" typescript:"-"`
-	// Offset is the number of tasks to skip before returning results.
-	Offset int `json:"offset,omitempty" typescript:"-"`
-	// Limit is a limit on the number of tasks returned.
-	Limit int `json:"limit,omitempty" typescript:"-"`
+	// Organization can be an organization name or UUID.
+	Organization string `json:"organization,omitempty"`
+	// Status filters the tasks by their task status.
+	Status TaskStatus `json:"status,omitempty"`
+	// FilterQuery allows specifying a raw filter query.
+	FilterQuery string `json:"filter_query,omitempty"`
+}
+
+func (f TasksFilter) asRequestOption() RequestOption {
+	return func(r *http.Request) {
+		var params []string
+		// Make sure all user input is quoted to ensure it's parsed as a single
+		// string.
+		if f.Owner != "" {
+			params = append(params, fmt.Sprintf("owner:%q", f.Owner))
+		}
+		if f.Organization != "" {
+			params = append(params, fmt.Sprintf("organization:%q", f.Organization))
+		}
+		if f.Status != "" {
+			params = append(params, fmt.Sprintf("status:%q", string(f.Status)))
+		}
+		if f.FilterQuery != "" {
+			// If custom stuff is added, just add it on here.
+			params = append(params, f.FilterQuery)
+		}
+
+		q := r.URL.Query()
+		q.Set("q", strings.Join(params, " "))
+		r.URL.RawQuery = q.Encode()
+	}
 }
 
 // Tasks lists all tasks belonging to the user or specified owner.
@@ -182,15 +212,7 @@ func (c *ExperimentalClient) Tasks(ctx context.Context, filter *TasksFilter) ([]
 		filter = &TasksFilter{}
 	}
 
-	var wsFilter WorkspaceFilter
-	wsFilter.Owner = filter.Owner
-	wsFilter.Status = filter.WorkspaceStatus
-	page := Pagination{
-		Offset: filter.Offset,
-		Limit:  filter.Limit,
-	}
-
-	res, err := c.Request(ctx, http.MethodGet, "/api/experimental/tasks", nil, wsFilter.asRequestOption(), page.asRequestOption())
+	res, err := c.Request(ctx, http.MethodGet, "/api/experimental/tasks", nil, filter.asRequestOption())
 	if err != nil {
 		return nil, err
 	}
@@ -233,6 +255,72 @@ func (c *ExperimentalClient) TaskByID(ctx context.Context, id uuid.UUID) (Task,
 	return task, nil
 }
 
+func splitTaskIdentifier(identifier string) (owner string, taskName string, err error) {
+	parts := strings.Split(identifier, "/")
+
+	switch len(parts) {
+	case 1:
+		owner = Me
+		taskName = parts[0]
+	case 2:
+		owner = parts[0]
+		taskName = parts[1]
+	default:
+		return "", "", xerrors.Errorf("invalid task identifier: %q", identifier)
+	}
+	return owner, taskName, nil
+}
+
+// TaskByIdentifier fetches and returns a task by an identifier, which may be
+// either a UUID, a name (for a task owned by the current user), or a
+// "user/task" combination, where user is either a username or UUID.
+//
+// Since there is no TaskByOwnerAndName endpoint yet, this function uses the
+// list endpoint with filtering when a name is provided.
+func (c *ExperimentalClient) TaskByIdentifier(ctx context.Context, identifier string) (Task, error) {
+	identifier = strings.TrimSpace(identifier)
+
+	// Try parsing as UUID first.
+	if taskID, err := uuid.Parse(identifier); err == nil {
+		return c.TaskByID(ctx, taskID)
+	}
+
+	// Not a UUID, treat as identifier.
+	owner, taskName, err := splitTaskIdentifier(identifier)
+	if err != nil {
+		return Task{}, err
+	}
+
+	tasks, err := c.Tasks(ctx, &TasksFilter{
+		Owner: owner,
+	})
+	if err != nil {
+		return Task{}, xerrors.Errorf("list tasks for owner %q: %w", owner, err)
+	}
+
+	if taskID, err := uuid.Parse(taskName); err == nil {
+		// Find task by ID.
+		for _, task := range tasks {
+			if task.ID == taskID {
+				return task, nil
+			}
+		}
+	} else {
+		// Find task by name.
+		for _, task := range tasks {
+			if task.Name == taskName {
+				return task, nil
+			}
+		}
+	}
+
+	// Mimic resource not found from API.
+	var notFoundErr error = &Error{
+		Response: Response{Message: "Resource not found or you do not have access to this resource"},
+	}
+	return Task{}, xerrors.Errorf("task %q not found for owner %q: %w", taskName, owner, notFoundErr)
+}
+
 // DeleteTask deletes a task by its ID.
 //
 // Experimental: This method is experimental and may change in the future.
diff --git a/codersdk/aitasks_internal_test.go b/codersdk/aitasks_internal_test.go
new file mode 100644
index 0000000000000..b10a8659a64e2
--- /dev/null
+++ b/codersdk/aitasks_internal_test.go
@@ -0,0 +1,75 @@
+package codersdk
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func Test_splitTaskIdentifier(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name          string
+		identifier    string
+		expectedOwner string
+		expectedTask  string
+		expectErr     bool
+	}{
+		{
+			name:          "bare task name",
+			identifier:    "mytask",
+			expectedOwner: Me,
+			expectedTask:  "mytask",
+			expectErr:     false,
+		},
+		{
+			name:          "owner/task format",
+			identifier:    "alice/her-task",
+			expectedOwner: "alice",
+			expectedTask:  "her-task",
+			expectErr:     false,
+		},
+		{
+			name:          "uuid/task format",
+			identifier:    "550e8400-e29b-41d4-a716-446655440000/task1",
+			expectedOwner: "550e8400-e29b-41d4-a716-446655440000",
+			expectedTask:  "task1",
+			expectErr:     false,
+		},
+		{
+			name:          "owner/uuid format",
+			identifier:    "alice/3abe1dcf-cd87-4078-8b54-c0e2058ad2e2",
+			expectedOwner: "alice",
+			expectedTask:  "3abe1dcf-cd87-4078-8b54-c0e2058ad2e2",
+			expectErr:     false,
+		},
+		{
+			name:       "too many slashes",
+			identifier: "owner/task/extra",
+			expectErr:  true,
+		},
+		{
+			name:          "empty parts acceptable",
+			identifier:    "/task",
+			expectedOwner: "",
+			expectedTask:  "task",
+			expectErr:     false,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			t.Parallel()
+			owner, taskName, err := splitTaskIdentifier(tt.identifier)
+			if tt.expectErr {
+				require.Error(t, err)
+			} else {
+				require.NoError(t, err)
+				assert.Equal(t, tt.expectedOwner, owner)
+				assert.Equal(t, tt.expectedTask, taskName)
+			}
+		})
+	}
+}
diff --git a/codersdk/toolsdk/bash.go b/codersdk/toolsdk/bash.go
index 7497363c2a54e..55b3dd58bcdfb 100644
--- a/codersdk/toolsdk/bash.go
+++ b/codersdk/toolsdk/bash.go
@@ -266,20 +266,25 @@ func getWorkspaceAgent(workspace codersdk.Workspace, agentName string) (codersdk
 	return codersdk.WorkspaceAgent{}, xerrors.Errorf("multiple agents found, please specify the agent name, available agents: %v", availableNames)
 }
 
-// namedWorkspace gets a workspace by owner/name or just name
-func namedWorkspace(ctx context.Context, client *codersdk.Client, identifier string) (codersdk.Workspace, error) {
-	// Parse owner and workspace name
+func splitNameAndOwner(identifier string) (name string, owner string) {
+	// Parse owner and name (workspace, task).
 	parts := strings.SplitN(identifier, "/", 2)
-	var owner, workspaceName string
 
 	if len(parts) == 2 {
 		owner = parts[0]
-		workspaceName = parts[1]
+		name = parts[1]
 	} else {
 		owner = "me"
-		workspaceName = identifier
+		name = identifier
 	}
 
+	return name, owner
+}
+
+// namedWorkspace gets a workspace by owner/name or just name
+func namedWorkspace(ctx context.Context, client *codersdk.Client, identifier string) (codersdk.Workspace, error) {
+	workspaceName, owner := splitNameAndOwner(identifier)
+
 	// Handle -- separator format (convert to / format)
 	if strings.Contains(identifier, "--") && !strings.Contains(identifier, "/") {
 		dashParts := strings.SplitN(identifier, "--", 2)
diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index e82511b46bc05..43ed6ab98ac3c 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -1909,24 +1909,12 @@ var DeleteTask = Tool[DeleteTaskArgs, codersdk.Response]{
 
 		expClient := codersdk.NewExperimentalClient(deps.coderClient)
 
-		var owner string
-		id, err := uuid.Parse(args.TaskID)
-		if err == nil {
-			task, err := expClient.TaskByID(ctx, id)
-			if err != nil {
-				return codersdk.Response{}, xerrors.Errorf("get task %q: %w", args.TaskID, err)
-			}
-			owner = task.OwnerName
-		} else {
-			ws, err := normalizedNamedWorkspace(ctx, deps.coderClient, args.TaskID)
-			if err != nil {
-				return codersdk.Response{}, xerrors.Errorf("get task workspace %q: %w", args.TaskID, err)
-			}
-			owner = ws.OwnerName
-			id = ws.ID
+		task, err := expClient.TaskByIdentifier(ctx, args.TaskID)
+		if err != nil {
+			return codersdk.Response{}, xerrors.Errorf("resolve task: %w", err)
 		}
 
-		err = expClient.DeleteTask(ctx, owner, id)
+		err = expClient.DeleteTask(ctx, task.OwnerName, task.ID)
 		if err != nil {
 			return codersdk.Response{}, xerrors.Errorf("delete task: %w", err)
 		}
@@ -1938,8 +1926,8 @@ var DeleteTask = Tool[DeleteTaskArgs, codersdk.Response]{
 }
 
 type ListTasksArgs struct {
-	WorkspaceStatus string `json:"status"`
-	User            string `json:"user"`
+	Status codersdk.TaskStatus `json:"status"`
+	User   string              `json:"user"`
 }
 
 type ListTasksResponse struct {
@@ -1972,8 +1960,8 @@ var ListTasks = Tool[ListTasksArgs, ListTasksResponse]{
 
 		expClient := codersdk.NewExperimentalClient(deps.coderClient)
 		tasks, err := expClient.Tasks(ctx, &codersdk.TasksFilter{
-			Owner:           args.User,
-			WorkspaceStatus: args.WorkspaceStatus,
+			Owner:  args.User,
+			Status: args.Status,
 		})
 		if err != nil {
 			return ListTasksResponse{}, xerrors.Errorf("list tasks: %w", err)
@@ -1990,7 +1978,7 @@ type GetTaskStatusArgs struct {
 }
 
 type GetTaskStatusResponse struct {
-	Status codersdk.WorkspaceStatus `json:"status"`
+	Status codersdk.TaskStatus      `json:"status"`
 	State  *codersdk.TaskStateEntry `json:"state"`
 }
 
@@ -2016,22 +2004,13 @@ var GetTaskStatus = Tool[GetTaskStatusArgs, GetTaskStatusResponse]{
 
 		expClient := codersdk.NewExperimentalClient(deps.coderClient)
 
-		id, err := uuid.Parse(args.TaskID)
-		if err != nil {
-			ws, err := normalizedNamedWorkspace(ctx, deps.coderClient, args.TaskID)
-			if err != nil {
-				return GetTaskStatusResponse{}, xerrors.Errorf("get task workspace %q: %w", args.TaskID, err)
-			}
-			id = ws.ID
-		}
-
-		task, err := expClient.TaskByID(ctx, id)
+		task, err := expClient.TaskByIdentifier(ctx, args.TaskID)
 		if err != nil {
-			return GetTaskStatusResponse{}, xerrors.Errorf("get task %q: %w", args.TaskID, err)
+			return GetTaskStatusResponse{}, xerrors.Errorf("resolve task %q: %w", args.TaskID, err)
 		}
 
 		return GetTaskStatusResponse{
-			Status: task.WorkspaceStatus,
+			Status: task.Status,
 			State:  task.CurrentState,
 		}, nil
 	},
@@ -2071,12 +2050,13 @@ var SendTaskInput = Tool[SendTaskInputArgs, codersdk.Response]{
 		}
 
 		expClient := codersdk.NewExperimentalClient(deps.coderClient)
-		id, owner, err := resolveTaskID(ctx, deps.coderClient, args.TaskID)
+
+		task, err := expClient.TaskByIdentifier(ctx, args.TaskID)
 		if err != nil {
-			return codersdk.Response{}, err
+			return codersdk.Response{}, xerrors.Errorf("resolve task %q: %w", args.TaskID, err)
 		}
 
-		err = expClient.TaskSend(ctx, owner, id, codersdk.TaskSendRequest{
+		err = expClient.TaskSend(ctx, task.OwnerName, task.ID, codersdk.TaskSendRequest{
 			Input: args.Input,
 		})
 		if err != nil {
@@ -2114,12 +2094,13 @@ var GetTaskLogs = Tool[GetTaskLogsArgs, codersdk.TaskLogsResponse]{
 		}
 
 		expClient := codersdk.NewExperimentalClient(deps.coderClient)
-		id, owner, err := resolveTaskID(ctx, deps.coderClient, args.TaskID)
+
+		task, err := expClient.TaskByIdentifier(ctx, args.TaskID)
 		if err != nil {
 			return codersdk.TaskLogsResponse{}, err
 		}
 
-		logs, err := expClient.TaskLogs(ctx, owner, id)
+		logs, err := expClient.TaskLogs(ctx, task.OwnerName, task.ID)
 		if err != nil {
 			return codersdk.TaskLogsResponse{}, xerrors.Errorf("get task logs %q: %w", args.TaskID, err)
 		}
@@ -2128,13 +2109,6 @@ var GetTaskLogs = Tool[GetTaskLogsArgs, codersdk.TaskLogsResponse]{
 	},
 }
 
-// normalizedNamedWorkspace normalizes the workspace name before getting the
-// workspace by name.
-func normalizedNamedWorkspace(ctx context.Context, client *codersdk.Client, name string) (codersdk.Workspace, error) {
-	// Maybe namedWorkspace should itself call NormalizeWorkspaceInput?
-	return namedWorkspace(ctx, client, NormalizeWorkspaceInput(name))
-}
-
 // NormalizeWorkspaceInput converts workspace name input to standard format.
 // Handles the following input formats:
 //   - workspace                    → workspace
@@ -2205,15 +2179,3 @@ func taskIDDescription(action string) string {
 func userDescription(action string) string {
 	return fmt.Sprintf("Username or ID of the user for which to %s. Omit or use the `me` keyword to %s for the authenticated user.", action, action)
 }
-
-func resolveTaskID(ctx context.Context, coderClient *codersdk.Client, taskID string) (uuid.UUID, string, error) {
-	id, err := uuid.Parse(taskID)
-	if err == nil {
-		return id, codersdk.Me, nil
-	}
-	ws, err := normalizedNamedWorkspace(ctx, coderClient, taskID)
-	if err != nil {
-		return uuid.UUID{}, codersdk.Me, xerrors.Errorf("get task workspace %q: %w", taskID, err)
-	}
-	return ws.ID, ws.OwnerName, nil
-}
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index 973ffea109b67..44da500400e5e 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -35,6 +35,7 @@ import (
 	"github.com/coder/coder/v2/codersdk/agentsdk"
 	"github.com/coder/coder/v2/codersdk/toolsdk"
 	"github.com/coder/coder/v2/codersdk/workspacesdk"
+	"github.com/coder/coder/v2/provisioner/echo"
 	"github.com/coder/coder/v2/provisionersdk/proto"
 	"github.com/coder/coder/v2/testutil"
 )
@@ -881,11 +882,9 @@ func TestTools(t *testing.T) {
 		}
 	})
 
-	t.Run("WorkspaceDeleteTask", func(t *testing.T) {
+	t.Run("DeleteTask", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		// nolint:gocritic // This is in a test package and does not end up in the build
 		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
 			OrganizationID: owner.OrganizationID,
@@ -896,21 +895,37 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		ws1 := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+		ws1Table := dbgen.Workspace(t, store, database.WorkspaceTable{
 			Name:           "delete-task-workspace-1",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask(nil).Do()
+		})
+		task1 := dbgen.Task(t, store, database.TaskTable{
+			OrganizationID:    owner.OrganizationID,
+			OwnerID:           member.ID,
+			Name:              ws1Table.Name,
+			WorkspaceID:       uuid.NullUUID{UUID: ws1Table.ID, Valid: true},
+			TemplateVersionID: aiTV.TemplateVersion.ID,
+			Prompt:            "delete task 1",
+		})
+		_ = dbfake.WorkspaceBuild(t, store, ws1Table).WithTask(nil).Do()
 
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+		ws2Table := dbgen.Workspace(t, store, database.WorkspaceTable{
 			Name:           "delete-task-workspace-2",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask(nil).Do()
+		})
+		task2 := dbgen.Task(t, store, database.TaskTable{
+			OrganizationID:    owner.OrganizationID,
+			OwnerID:           member.ID,
+			Name:              ws2Table.Name,
+			WorkspaceID:       uuid.NullUUID{UUID: ws2Table.ID, Valid: true},
+			TemplateVersionID: aiTV.TemplateVersion.ID,
+			Prompt:            "delete task 2",
+		})
+		_ = dbfake.WorkspaceBuild(t, store, ws2Table).WithTask(nil).Do()
 
 		tests := []struct {
 			name  string
@@ -920,13 +935,13 @@ func TestTools(t *testing.T) {
 			{
 				name: "ByUUID",
 				args: toolsdk.DeleteTaskArgs{
-					TaskID: ws1.Workspace.ID.String(),
+					TaskID: task1.ID.String(),
 				},
 			},
 			{
-				name: "ByWorkspaceIdentifier",
+				name: "ByIdentifier",
 				args: toolsdk.DeleteTaskArgs{
-					TaskID: "delete-task-workspace-2",
+					TaskID: task2.Name,
 				},
 			},
 			{
@@ -975,47 +990,64 @@ func TestTools(t *testing.T) {
 		}
 	})
 
-	t.Run("WorkspaceListTasks", func(t *testing.T) {
+	t.Run("ListTasks", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
-		taskClient, taskUser := coderdtest.CreateAnotherUserMutators(t, client, owner.OrganizationID, nil)
-
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
-			OrganizationID: owner.OrganizationID,
-			CreatedBy:      owner.UserID,
-			HasAITask: sql.NullBool{
-				Bool:  true,
-				Valid: true,
+		ctx := testutil.Context(t, testutil.WaitLong)
+		client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+		owner := coderdtest.CreateFirstUser(t, client)
+		_, member := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+		taskClient, _ := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
+
+		// Create a template with AI task support using the proper flow.
+		version := coderdtest.CreateTemplateVersion(t, client, owner.OrganizationID, &echo.Responses{
+			Parse:          echo.ParseComplete,
+			ProvisionApply: echo.ApplyComplete,
+			ProvisionPlan: []*proto.Response{
+				{Type: &proto.Response_Plan{Plan: &proto.PlanComplete{
+					Parameters: []*proto.RichParameter{{Name: "AI Prompt", Type: "string"}},
+					HasAiTasks: true,
+				}}},
 			},
-		}).Do()
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, owner.OrganizationID, version.ID)
+
+		expClient := codersdk.NewExperimentalClient(client)
+		taskExpClient := codersdk.NewExperimentalClient(taskClient)
 
 		// This task should not show up since listing is user-scoped.
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
-			Name:           "list-task-workspace-member",
-			OrganizationID: owner.OrganizationID,
-			OwnerID:        member.ID,
-			TemplateID:     aiTV.Template.ID,
-		}).WithTask(nil).Do()
+		_, err := expClient.CreateTask(ctx, member.Username, codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             "task for member",
+			Name:              "list-task-workspace-member",
+		})
+		require.NoError(t, err)
 
-		// These tasks should show up.
+		// Create tasks for taskUser. These should show up in the list.
 		for i := range 5 {
-			// nolint:gocritic // This is in a test package and does not end up in the build
-			var transition database.WorkspaceTransition
+			taskName := fmt.Sprintf("list-task-workspace-%d", i)
+			task, err := taskExpClient.CreateTask(ctx, codersdk.Me, codersdk.CreateTaskRequest{
+				TemplateVersionID: template.ActiveVersionID,
+				Input:             fmt.Sprintf("task %d", i),
+				Name:              taskName,
+			})
+			require.NoError(t, err)
+			require.True(t, task.WorkspaceID.Valid, "task should have workspace ID")
+
+			// For the first task, stop the workspace to make it paused.
 			if i == 0 {
-				// nolint:gocritic // This is in a test package and does not end up in the build
-				transition = database.WorkspaceTransitionStop
+				ws, err := taskClient.Workspace(ctx, task.WorkspaceID.UUID)
+				require.NoError(t, err)
+				coderdtest.AwaitWorkspaceBuildJobCompleted(t, taskClient, ws.LatestBuild.ID)
+
+				// Stop the workspace to set task status to paused.
+				build, err := taskClient.CreateWorkspaceBuild(ctx, task.WorkspaceID.UUID, codersdk.CreateWorkspaceBuildRequest{
+					Transition: codersdk.WorkspaceTransitionStop,
+				})
+				require.NoError(t, err)
+				coderdtest.AwaitWorkspaceBuildJobCompleted(t, taskClient, build.ID)
 			}
-			// nolint:gocritic // This is in a test package and does not end up in the build
-			_ = dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
-				Name:           fmt.Sprintf("list-task-workspace-%d", i),
-				OrganizationID: owner.OrganizationID,
-				OwnerID:        taskUser.ID,
-				TemplateID:     aiTV.Template.ID,
-			}).Seed(database.WorkspaceBuild{Transition: transition}).WithTask(nil).Do()
 		}
 
 		tests := []struct {
@@ -1038,7 +1070,7 @@ func TestTools(t *testing.T) {
 			{
 				name: "ListFiltered",
 				args: toolsdk.ListTasksArgs{
-					WorkspaceStatus: "stopped",
+					Status: codersdk.TaskStatusPaused,
 				},
 				expected: []string{
 					"list-task-workspace-0",
@@ -1068,11 +1100,9 @@ func TestTools(t *testing.T) {
 		}
 	})
 
-	t.Run("WorkspaceGetTask", func(t *testing.T) {
+	t.Run("GetTask", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		// nolint:gocritic // This is in a test package and does not end up in the build
 		aiTV := dbfake.TemplateVersion(t, store).Seed(database.TemplateVersion{
 			OrganizationID: owner.OrganizationID,
@@ -1083,33 +1113,41 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		ws1 := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+		ws1Table := dbgen.Workspace(t, store, database.WorkspaceTable{
 			Name:           "get-task-workspace-1",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask(nil).Do()
+		})
+		task := dbgen.Task(t, store, database.TaskTable{
+			OrganizationID:    owner.OrganizationID,
+			OwnerID:           member.ID,
+			Name:              "get-task-1",
+			WorkspaceID:       uuid.NullUUID{UUID: ws1Table.ID, Valid: true},
+			TemplateVersionID: aiTV.TemplateVersion.ID,
+			Prompt:            "get task",
+		})
+		_ = dbfake.WorkspaceBuild(t, store, ws1Table).WithTask(nil).Do()
 
 		tests := []struct {
 			name     string
 			args     toolsdk.GetTaskStatusArgs
-			expected codersdk.WorkspaceStatus
+			expected codersdk.TaskStatus
 			error    string
 		}{
 			{
 				name: "ByUUID",
 				args: toolsdk.GetTaskStatusArgs{
-					TaskID: ws1.Workspace.ID.String(),
+					TaskID: task.ID.String(),
 				},
-				expected: codersdk.WorkspaceStatusRunning,
+				expected: codersdk.TaskStatusInitializing,
 			},
 			{
-				name: "ByWorkspaceIdentifier",
+				name: "ByIdentifier",
 				args: toolsdk.GetTaskStatusArgs{
-					TaskID: "get-task-workspace-1",
+					TaskID: task.Name,
 				},
-				expected: codersdk.WorkspaceStatusRunning,
+				expected: codersdk.TaskStatusInitializing,
 			},
 			{
 				name:  "NoID",
@@ -1301,8 +1339,6 @@ func TestTools(t *testing.T) {
 	t.Run("SendTaskInput", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		// Start a fake AgentAPI that accepts GET /status and POST /message.
 		srv := httptest.NewServer(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 			if r.Method == http.MethodGet && r.URL.Path == "/status" {
@@ -1340,13 +1376,21 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		ws := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
-			Name:           "send-task-input",
+		wsTable := dbgen.Workspace(t, store, database.WorkspaceTable{
+			Name:           "send-task-input-ws",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask(&proto.App{Url: srv.URL}).Do()
+		})
+		task := dbgen.Task(t, store, database.TaskTable{
+			OrganizationID:    owner.OrganizationID,
+			OwnerID:           member.ID,
+			Name:              "send-task-input",
+			WorkspaceID:       uuid.NullUUID{UUID: wsTable.ID, Valid: true},
+			TemplateVersionID: aiTV.TemplateVersion.ID,
+			Prompt:            "send task input",
+		})
+		ws := dbfake.WorkspaceBuild(t, store, wsTable).WithTask(&proto.App{Url: srv.URL}).Do()
 
 		_ = agenttest.New(t, client.URL, ws.AgentToken)
 		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.Workspace.ID).Wait()
@@ -1359,14 +1403,14 @@ func TestTools(t *testing.T) {
 			{
 				name: "ByUUID",
 				args: toolsdk.SendTaskInputArgs{
-					TaskID: ws.Workspace.ID.String(),
+					TaskID: task.ID.String(),
 					Input:  "frob the baz",
 				},
 			},
 			{
-				name: "ByWorkspaceIdentifier",
+				name: "ByIdentifier",
 				args: toolsdk.SendTaskInputArgs{
-					TaskID: "send-task-input",
+					TaskID: task.Name,
 					Input:  "frob the baz",
 				},
 			},
@@ -1404,7 +1448,7 @@ func TestTools(t *testing.T) {
 					TaskID: r.Workspace.ID.String(),
 					Input:  "this is ignored",
 				},
-				error: "Task is not configured with a sidebar app",
+				error: "Resource not found",
 			},
 		}
 
@@ -1429,8 +1473,6 @@ func TestTools(t *testing.T) {
 	t.Run("GetTaskLogs", func(t *testing.T) {
 		t.Parallel()
 
-		t.Skip("TODO(mafredri): Remove, fixed down-stack!")
-
 		messages := []agentapi.Message{
 			{
 				Id:      0,
@@ -1471,13 +1513,21 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		// nolint:gocritic // This is in a test package and does not end up in the build
-		ws := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
-			Name:           "get-task-logs",
+		wsTable := dbgen.Workspace(t, store, database.WorkspaceTable{
+			Name:           "get-task-logs-ws",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		}).WithTask(&proto.App{Url: srv.URL}).Do()
+		})
+		task := dbgen.Task(t, store, database.TaskTable{
+			OrganizationID:    owner.OrganizationID,
+			OwnerID:           member.ID,
+			Name:              "get-task-logs",
+			WorkspaceID:       uuid.NullUUID{UUID: wsTable.ID, Valid: true},
+			TemplateVersionID: aiTV.TemplateVersion.ID,
+			Prompt:            "get task logs",
+		})
+		ws := dbfake.WorkspaceBuild(t, store, wsTable).WithTask(&proto.App{Url: srv.URL}).Do()
 
 		_ = agenttest.New(t, client.URL, ws.AgentToken)
 		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.Workspace.ID).Wait()
@@ -1491,14 +1541,14 @@ func TestTools(t *testing.T) {
 			{
 				name: "ByUUID",
 				args: toolsdk.GetTaskLogsArgs{
-					TaskID: ws.Workspace.ID.String(),
+					TaskID: task.ID.String(),
 				},
 				expected: messages,
 			},
 			{
-				name: "ByWorkspaceIdentifier",
+				name: "ByIdentifier",
 				args: toolsdk.GetTaskLogsArgs{
-					TaskID: "get-task-logs",
+					TaskID: task.Name,
 				},
 				expected: messages,
 			},
@@ -1526,7 +1576,7 @@ func TestTools(t *testing.T) {
 				args: toolsdk.GetTaskLogsArgs{
 					TaskID: r.Workspace.ID.String(),
 				},
-				error: "Task is not configured with a sidebar app",
+				error: "Resource not found",
 			},
 		}
 
@@ -1777,23 +1827,6 @@ func TestMain(m *testing.M) {
 			if runtime.GOOS == "windows" && tool.Name == "coder_workspace_bash" {
 				continue
 			}
-			ignored := false
-			for _, ignore := range []string{
-				"coder_delete_task",
-				"coder_list_tasks",
-				"coder_get_task_status",
-				"coder_send_task_input",
-				"coder_get_task_logs",
-				"coder_get_task_logs",
-			} {
-				if ignore == tool.Name {
-					ignored = true
-					break
-				}
-			}
-			if ignored {
-				continue
-			}
 			untested = append(untested, tool.Name)
 		}
 	}
diff --git a/docs/reference/api/experimental.md b/docs/reference/api/experimental.md
index e164e37aa5cb9..3bb5fb03c780e 100644
--- a/docs/reference/api/experimental.md
+++ b/docs/reference/api/experimental.md
@@ -15,12 +15,9 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks \
 
 ### Parameters
 
-| Name       | In    | Type    | Required | Description                               |
-|------------|-------|---------|----------|-------------------------------------------|
-| `q`        | query | string  | false    | Search query for filtering tasks          |
-| `after_id` | query | string  | false    | Return tasks after this ID for pagination |
-| `limit`    | query | integer | false    | Maximum number of tasks to return         |
-| `offset`   | query | integer | false    | Offset for pagination                     |
+| Name | In    | Type   | Required | Description                                                                                                         |
+|------|-------|--------|----------|---------------------------------------------------------------------------------------------------------------------|
+| `q`  | query | string | false    | Search query for filtering tasks. Supports: owner:<username/uuid/me>, organization:<org-name/uuid>, status:<status> |
 
 ### Example responses
 
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 8e95dfd0904c6..7427ef006603a 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -4810,6 +4810,18 @@ export interface TasksFilter {
 	 * Owner can be a username, UUID, or "me".
 	 */
 	readonly owner?: string;
+	/**
+	 * Organization can be an organization name or UUID.
+	 */
+	readonly organization?: string;
+	/**
+	 * Status filters the tasks by their task status.
+	 */
+	readonly status?: TaskStatus;
+	/**
+	 * FilterQuery allows specifying a raw filter query.
+	 */
+	readonly filter_query?: string;
 }
 
 // From codersdk/deployment.go

From 6187acff8a5d2280feb4dfd62cc70dfb6c412b50 Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Thu, 23 Oct 2025 20:28:27 +0300
Subject: [PATCH 223/298] chore(codersdk): document TaskStatus and TaskState
 (#20441)

Updates coder/internal#976
---
 codersdk/aitasks.go | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index b5c7fa5aa9604..318caa3d17484 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -95,12 +95,25 @@ func (c *ExperimentalClient) CreateTask(ctx context.Context, user string, reques
 type TaskStatus string
 
 const (
-	TaskStatusPending      TaskStatus = "pending"
+	// TaskStatusPending indicates the task has been created but no workspace
+	// has been provisioned yet, or the workspace build job status is unknown.
+	TaskStatusPending TaskStatus = "pending"
+	// TaskStatusInitializing indicates the workspace build is pending/running,
+	// the agent is connecting, or apps are initializing.
 	TaskStatusInitializing TaskStatus = "initializing"
-	TaskStatusActive       TaskStatus = "active"
-	TaskStatusPaused       TaskStatus = "paused"
-	TaskStatusUnknown      TaskStatus = "unknown"
-	TaskStatusError        TaskStatus = "error"
+	// TaskStatusActive indicates the task's workspace is running with a
+	// successful start transition, the agent is connected, and all workspace
+	// apps are either healthy or disabled.
+	TaskStatusActive TaskStatus = "active"
+	// TaskStatusPaused indicates the task's workspace has been stopped or
+	// deleted (stop/delete transition with successful job status).
+	TaskStatusPaused TaskStatus = "paused"
+	// TaskStatusUnknown indicates the task's status cannot be determined
+	// based on the workspace build, agent lifecycle, or app health states.
+	TaskStatusUnknown TaskStatus = "unknown"
+	// TaskStatusError indicates the task's workspace build job has failed,
+	// or the workspace apps are reporting unhealthy status.
+	TaskStatusError TaskStatus = "error"
 )
 
 func AllTaskStatuses() []TaskStatus {
@@ -121,10 +134,18 @@ type TaskState string
 
 // TaskState enums.
 const (
-	TaskStateWorking  TaskState = "working"
-	TaskStateIdle     TaskState = "idle"
+	// TaskStateWorking indicates the AI agent is actively processing work.
+	// Reported when the agent is performing actions or the screen is changing.
+	TaskStateWorking TaskState = "working"
+	// TaskStateIdle indicates the AI agent's screen is stable and no work
+	// is being performed. Reported automatically by the screen watcher.
+	TaskStateIdle TaskState = "idle"
+	// TaskStateComplete indicates the AI agent has successfully completed
+	// the task. Reported via the workspace app status.
 	TaskStateComplete TaskState = "complete"
-	TaskStateFailed   TaskState = "failed"
+	// TaskStateFailed indicates the AI agent reported a failure state.
+	// Reported via the workspace app status.
+	TaskStateFailed TaskState = "failed"
 )
 
 // Task represents a task.

From 906149317dfc7412c74462252240e0cb3b694be6 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Thu, 23 Oct 2025 22:26:21 +0200
Subject: [PATCH 224/298] docs: document location property for support links
 (#20445)

---
 docs/admin/setup/appearance.md | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/docs/admin/setup/appearance.md b/docs/admin/setup/appearance.md
index 38c85a5439d89..66dbc2587e78e 100644
--- a/docs/admin/setup/appearance.md
+++ b/docs/admin/setup/appearance.md
@@ -57,7 +57,18 @@ server.
 
 The link icons are optional, and can be set to any url or
 [builtin icon](../templates/extending-templates/icons.md#bundled-icons),
-additionally `bug`, `chat`, and `docs` are available as three special icons.
+additionally `bug`, `chat`, `docs`, and `star` are available as special icons.
+
+### Location
+
+The `location` property is optional and determines where the support link will
+be displayed:
+
+- `navbar` - displays the link as a button in the top navigation bar
+- `dropdown` - displays the link in the user dropdown menu (default)
+
+If the `location` property is not specified, the link will be displayed in the
+user dropdown menu.
 
 ### Configuration
 
@@ -77,7 +88,7 @@ coder:
         "https://codercom.slack.com/archives/C014JH42DBJ", "icon":
         "/icon/slack.svg"},
          {"name": "Hello Discord", "target": "https://discord.gg/coder", "icon":
-        "/icon/discord.svg"},
+        "/icon/discord.svg", "location": "navbar"},
          {"name": "Hello Foobar", "target": "https://foo.com/bar", "icon":
         "/emojis/1f3e1.png"}]
 ```
@@ -88,12 +99,12 @@ if running as a system service, set an environment variable
 `CODER_SUPPORT_LINKS` in `/etc/coder.d/coder.env` as follows,
 
 ```env
-CODER_SUPPORT_LINKS='[{"name": "Hello GitHub", "target": "https://github.com/coder/coder", "icon": "bug"}, {"name": "Hello Slack", "target": "https://codercom.slack.com/archives/C014JH42DBJ", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/slack.svg"}, {"name": "Hello Discord", "target": "https://discord.gg/coder", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/discord.svg"}, {"name": "Hello Foobar", "target": "https://discord.gg/coder", "icon": "/emojis/1f3e1.png"}]'
+CODER_SUPPORT_LINKS='[{"name": "Hello GitHub", "target": "https://github.com/coder/coder", "icon": "bug"}, {"name": "Hello Slack", "target": "https://codercom.slack.com/archives/C014JH42DBJ", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/slack.svg"}, {"name": "Hello Discord", "target": "https://discord.gg/coder", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/discord.svg", "location": "navbar"}, {"name": "Hello Foobar", "target": "https://discord.gg/coder", "icon": "/emojis/1f3e1.png"}]'
 ```
 
 For CLI, use,
 
 ```shell
-export CODER_SUPPORT_LINKS='[{"name": "Hello GitHub", "target": "https://github.com/coder/coder", "icon": "bug"}, {"name": "Hello Slack", "target": "https://codercom.slack.com/archives/C014JH42DBJ", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/slack.svg"}, {"name": "Hello Discord", "target": "https://discord.gg/coder", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/discord.svg"}, {"name": "Hello Foobar", "target": "https://discord.gg/coder", "icon": "/emojis/1f3e1.png"}]'
+export CODER_SUPPORT_LINKS='[{"name": "Hello GitHub", "target": "https://github.com/coder/coder", "icon": "bug"}, {"name": "Hello Slack", "target": "https://codercom.slack.com/archives/C014JH42DBJ", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/slack.svg"}, {"name": "Hello Discord", "target": "https://discord.gg/coder", "icon": "https://raw.githubusercontent.com/coder/coder/main/site/static/icon/discord.svg", "location": "navbar"}, {"name": "Hello Foobar", "target": "https://discord.gg/coder", "icon": "/emojis/1f3e1.png"}]'
 coder-server
 ```

From 13ca9ead3a8269ca68104ea75af584d33c385d26 Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Thu, 23 Oct 2025 15:38:49 -0500
Subject: [PATCH 225/298] chore!: ensure consistent secret token generation and
 hashing (#20388)

This PR uses the same sha256 hashing technique as we use for APIKeys. So
now all randomly generated secrets will be hashed with sha256 for
consistency.

This is a breaking change for the oauth tokens. Since oauth is only
allowed for dev builds and experimental, this is ok.
---
 coderd/apidoc/docs.go                         |  5 +-
 coderd/apidoc/swagger.json                    |  5 +-
 coderd/apikey/apikey.go                       | 43 +++++++++++------
 coderd/apikey/apikey_test.go                  | 19 ++++++--
 coderd/database/dbauthz/dbauthz.go            |  2 +-
 coderd/database/dbauthz/dbauthz_test.go       |  4 +-
 coderd/database/dbgen/dbgen.go                | 17 ++++---
 coderd/database/dbmetrics/querymetrics.go     |  3 +-
 coderd/database/dbmock/dbmock.go              |  3 +-
 coderd/database/dump.sql                      |  2 +-
 ...8_oauth_app_byte_reg_access_token.down.sql |  4 ++
 ...388_oauth_app_byte_reg_access_token.up.sql |  4 ++
 coderd/database/models.go                     |  2 +-
 coderd/database/querier.go                    |  3 +-
 coderd/database/queries.sql.go                |  4 +-
 coderd/httpmw/apikey.go                       |  6 +--
 coderd/httpmw/apikey_test.go                  | 15 +++---
 coderd/httpmw/authorize_test.go               |  8 +---
 coderd/httpmw/workspaceparam_test.go          | 10 ++--
 coderd/httpmw/workspaceproxy.go               |  6 +--
 coderd/oauth2_test.go                         |  2 +-
 coderd/oauth2provider/app_secrets.go          |  2 +-
 coderd/oauth2provider/apps.go                 |  2 +-
 coderd/oauth2provider/authorize.go            |  2 +-
 coderd/oauth2provider/registration.go         | 40 +++++-----------
 coderd/oauth2provider/revoke.go               |  7 +--
 coderd/oauth2provider/secrets.go              | 13 ++---
 coderd/oauth2provider/tokens.go               | 25 ++++------
 coderd/provisionerkey/provisionerkey.go       | 10 ++--
 codersdk/oauth2.go                            |  2 +-
 docs/reference/api/enterprise.md              |  8 +++-
 docs/reference/api/schemas.md                 | 48 ++++++++++---------
 enterprise/coderd/workspaceproxy.go           |  9 ++--
 .../x/aibridgedserver/aibridgedserver.go      |  6 +--
 .../x/aibridgedserver/aibridgedserver_test.go |  7 ++-
 35 files changed, 169 insertions(+), 179 deletions(-)
 create mode 100644 coderd/database/migrations/000388_oauth_app_byte_reg_access_token.down.sql
 create mode 100644 coderd/database/migrations/000388_oauth_app_byte_reg_access_token.up.sql

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 669c753b2498d..7dc3f969fa879 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -15471,7 +15471,10 @@ const docTemplate = `{
                     }
                 },
                 "registration_access_token": {
-                    "type": "string"
+                    "type": "array",
+                    "items": {
+                        "type": "integer"
+                    }
                 },
                 "registration_client_uri": {
                     "type": "string"
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index ba019ba82d574..a1b00293be3f0 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -14025,7 +14025,10 @@
 					}
 				},
 				"registration_access_token": {
-					"type": "string"
+					"type": "array",
+					"items": {
+						"type": "integer"
+					}
 				},
 				"registration_client_uri": {
 					"type": "string"
diff --git a/coderd/apikey/apikey.go b/coderd/apikey/apikey.go
index 0dd874b340a90..89bbb7ca536d8 100644
--- a/coderd/apikey/apikey.go
+++ b/coderd/apikey/apikey.go
@@ -2,6 +2,7 @@ package apikey
 
 import (
 	"crypto/sha256"
+	"crypto/subtle"
 	"fmt"
 	"net"
 	"time"
@@ -44,12 +45,17 @@ type CreateParams struct {
 // database representation. It is the responsibility of the caller to insert it
 // into the database.
 func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error) {
-	keyID, keySecret, err := generateKey()
+	// Length of an API Key ID.
+	keyID, err := cryptorand.String(10)
 	if err != nil {
-		return database.InsertAPIKeyParams{}, "", xerrors.Errorf("generate API key: %w", err)
+		return database.InsertAPIKeyParams{}, "", xerrors.Errorf("generate API key ID: %w", err)
 	}
 
-	hashed := sha256.Sum256([]byte(keySecret))
+	// Length of an API Key secret.
+	keySecret, hashedSecret, err := GenerateSecret(22)
+	if err != nil {
+		return database.InsertAPIKeyParams{}, "", xerrors.Errorf("generate API key secret: %w", err)
+	}
 
 	// Default expires at to now+lifetime, or use the configured value if not
 	// set.
@@ -120,7 +126,7 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 		ExpiresAt:    params.ExpiresAt.UTC(),
 		CreatedAt:    dbtime.Now(),
 		UpdatedAt:    dbtime.Now(),
-		HashedSecret: hashed[:],
+		HashedSecret: hashedSecret,
 		LoginType:    params.LoginType,
 		Scopes:       scopes,
 		AllowList:    params.AllowList,
@@ -128,17 +134,24 @@ func Generate(params CreateParams) (database.InsertAPIKeyParams, string, error)
 	}, token, nil
 }
 
-// generateKey a new ID and secret for an API key.
-func generateKey() (id string, secret string, err error) {
-	// Length of an API Key ID.
-	id, err = cryptorand.String(10)
-	if err != nil {
-		return "", "", err
-	}
-	// Length of an API Key secret.
-	secret, err = cryptorand.String(22)
+func GenerateSecret(length int) (secret string, hashed []byte, err error) {
+	secret, err = cryptorand.String(length)
 	if err != nil {
-		return "", "", err
+		return "", nil, err
 	}
-	return id, secret, nil
+	hash := HashSecret(secret)
+	return secret, hash, nil
+}
+
+// ValidateHash compares a secret against an expected hashed secret.
+func ValidateHash(hashedSecret []byte, secret string) bool {
+	hash := HashSecret(secret)
+	return subtle.ConstantTimeCompare(hashedSecret, hash) == 1
+}
+
+// HashSecret is the single function used to hash API key secrets.
+// Use this to ensure a consistent hashing algorithm.
+func HashSecret(secret string) []byte {
+	hash := sha256.Sum256([]byte(secret))
+	return hash[:]
 }
diff --git a/coderd/apikey/apikey_test.go b/coderd/apikey/apikey_test.go
index 1f5de3aa18a49..aa17a02561eeb 100644
--- a/coderd/apikey/apikey_test.go
+++ b/coderd/apikey/apikey_test.go
@@ -1,7 +1,6 @@
 package apikey_test
 
 import (
-	"crypto/sha256"
 	"strings"
 	"testing"
 	"time"
@@ -126,8 +125,8 @@ func TestGenerate(t *testing.T) {
 			require.Equal(t, key.ID, keytokens[0])
 
 			// Assert that the hashed secret is correct.
-			hashed := sha256.Sum256([]byte(keytokens[1]))
-			assert.ElementsMatch(t, hashed, key.HashedSecret)
+			equal := apikey.ValidateHash(key.HashedSecret, keytokens[1])
+			require.True(t, equal, "valid secret")
 
 			assert.Equal(t, tc.params.UserID, key.UserID)
 			assert.WithinDuration(t, dbtime.Now(), key.CreatedAt, time.Second*5)
@@ -173,3 +172,17 @@ func TestGenerate(t *testing.T) {
 		})
 	}
 }
+
+// TestInvalid just ensures the false case is asserted by some tests.
+// Otherwise, a function that just `returns true` might pass all tests incorrectly.
+func TestInvalid(t *testing.T) {
+	t.Parallel()
+
+	require.Falsef(t, apikey.ValidateHash([]byte{}, "secret"), "empty hash")
+
+	secret, hash, err := apikey.GenerateSecret(10)
+	require.NoError(t, err)
+
+	require.Falsef(t, apikey.ValidateHash(hash, secret+"_"), "different secret")
+	require.Falsef(t, apikey.ValidateHash(hash[:len(hash)-1], secret), "different hash length")
+}
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 52089e55c594a..16bc364a42a3c 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -2475,7 +2475,7 @@ func (q *querier) GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (d
 	return q.db.GetOAuth2ProviderAppByID(ctx, id)
 }
 
-func (q *querier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+func (q *querier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken []byte) (database.OAuth2ProviderApp, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOauth2App); err != nil {
 		return database.OAuth2ProviderApp{}, err
 	}
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 070da4f2782af..ca82390984a18 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -3925,9 +3925,9 @@ func (s *MethodTestSuite) TestOAuth2ProviderApps() {
 	}))
 	s.Run("GetOAuth2ProviderAppByRegistrationToken", s.Subtest(func(db database.Store, check *expects) {
 		app := dbgen.OAuth2ProviderApp(s.T(), db, database.OAuth2ProviderApp{
-			RegistrationAccessToken: sql.NullString{String: "test-token", Valid: true},
+			RegistrationAccessToken: []byte("test-token"),
 		})
-		check.Args(sql.NullString{String: "test-token", Valid: true}).Asserts(rbac.ResourceOauth2App, policy.ActionRead).Returns(app)
+		check.Args([]byte("test-token")).Asserts(rbac.ResourceOauth2App, policy.ActionRead).Returns(app)
 	}))
 }
 
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index 713cb53b6d296..0f38dd1f93105 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -3,7 +3,6 @@ package dbgen
 import (
 	"context"
 	"crypto/rand"
-	"crypto/sha256"
 	"database/sql"
 	"encoding/hex"
 	"encoding/json"
@@ -20,6 +19,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"golang.org/x/xerrors"
 
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/db2sdk"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
@@ -161,8 +161,8 @@ func Template(t testing.TB, db database.Store, seed database.Template) database.
 
 func APIKey(t testing.TB, db database.Store, seed database.APIKey, munge ...func(*database.InsertAPIKeyParams)) (key database.APIKey, token string) {
 	id, _ := cryptorand.String(10)
-	secret, _ := cryptorand.String(22)
-	hashed := sha256.Sum256([]byte(secret))
+	secret, hashed, err := apikey.GenerateSecret(22)
+	require.NoError(t, err)
 
 	ip := seed.IPAddress
 	if !ip.Valid {
@@ -179,7 +179,7 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey, munge ...func
 		ID: takeFirst(seed.ID, id),
 		// 0 defaults to 86400 at the db layer
 		LifetimeSeconds: takeFirst(seed.LifetimeSeconds, 0),
-		HashedSecret:    takeFirstSlice(seed.HashedSecret, hashed[:]),
+		HashedSecret:    takeFirstSlice(seed.HashedSecret, hashed),
 		IPAddress:       ip,
 		UserID:          takeFirst(seed.UserID, uuid.New()),
 		LastUsed:        takeFirst(seed.LastUsed, dbtime.Now()),
@@ -194,7 +194,7 @@ func APIKey(t testing.TB, db database.Store, seed database.APIKey, munge ...func
 	for _, fn := range munge {
 		fn(&params)
 	}
-	key, err := db.InsertAPIKey(genCtx, params)
+	key, err = db.InsertAPIKey(genCtx, params)
 	require.NoError(t, err, "insert api key")
 	return key, fmt.Sprintf("%s-%s", key.ID, secret)
 }
@@ -980,16 +980,15 @@ func WorkspaceResourceMetadatums(t testing.TB, db database.Store, seed database.
 }
 
 func WorkspaceProxy(t testing.TB, db database.Store, orig database.WorkspaceProxy) (database.WorkspaceProxy, string) {
-	secret, err := cryptorand.HexString(64)
+	secret, hashedSecret, err := apikey.GenerateSecret(64)
 	require.NoError(t, err, "generate secret")
-	hashedSecret := sha256.Sum256([]byte(secret))
 
 	proxy, err := db.InsertWorkspaceProxy(genCtx, database.InsertWorkspaceProxyParams{
 		ID:                takeFirst(orig.ID, uuid.New()),
 		Name:              takeFirst(orig.Name, testutil.GetRandomName(t)),
 		DisplayName:       takeFirst(orig.DisplayName, testutil.GetRandomName(t)),
 		Icon:              takeFirst(orig.Icon, testutil.GetRandomName(t)),
-		TokenHashedSecret: hashedSecret[:],
+		TokenHashedSecret: hashedSecret,
 		CreatedAt:         takeFirst(orig.CreatedAt, dbtime.Now()),
 		UpdatedAt:         takeFirst(orig.UpdatedAt, dbtime.Now()),
 		DerpEnabled:       takeFirst(orig.DerpEnabled, false),
@@ -1259,7 +1258,7 @@ func OAuth2ProviderApp(t testing.TB, db database.Store, seed database.OAuth2Prov
 		Jwks:                    seed.Jwks, // pqtype.NullRawMessage{} is not comparable, use existing value
 		SoftwareID:              takeFirst(seed.SoftwareID, sql.NullString{}),
 		SoftwareVersion:         takeFirst(seed.SoftwareVersion, sql.NullString{}),
-		RegistrationAccessToken: takeFirst(seed.RegistrationAccessToken, sql.NullString{}),
+		RegistrationAccessToken: seed.RegistrationAccessToken,
 		RegistrationClientUri:   takeFirst(seed.RegistrationClientUri, sql.NullString{}),
 	})
 	require.NoError(t, err, "insert oauth2 app")
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index a61d05cdef18a..79c8a01d67dd8 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -5,7 +5,6 @@ package dbmetrics
 
 import (
 	"context"
-	"database/sql"
 	"slices"
 	"time"
 
@@ -1104,7 +1103,7 @@ func (m queryMetricsStore) GetOAuth2ProviderAppByID(ctx context.Context, id uuid
 	return r0, r1
 }
 
-func (m queryMetricsStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+func (m queryMetricsStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken []byte) (database.OAuth2ProviderApp, error) {
 	start := time.Now()
 	r0, r1 := m.s.GetOAuth2ProviderAppByRegistrationToken(ctx, registrationAccessToken)
 	m.queryLatencies.WithLabelValues("GetOAuth2ProviderAppByRegistrationToken").Observe(time.Since(start).Seconds())
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 157883c6dfd87..a16ba47e721aa 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -11,7 +11,6 @@ package dbmock
 
 import (
 	context "context"
-	sql "database/sql"
 	reflect "reflect"
 	time "time"
 
@@ -2325,7 +2324,7 @@ func (mr *MockStoreMockRecorder) GetOAuth2ProviderAppByID(ctx, id any) *gomock.C
 }
 
 // GetOAuth2ProviderAppByRegistrationToken mocks base method.
-func (m *MockStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (database.OAuth2ProviderApp, error) {
+func (m *MockStore) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken []byte) (database.OAuth2ProviderApp, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "GetOAuth2ProviderAppByRegistrationToken", ctx, registrationAccessToken)
 	ret0, _ := ret[0].(database.OAuth2ProviderApp)
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 11f668d2fca2e..de55f8117f4d8 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -1537,7 +1537,7 @@ CREATE TABLE oauth2_provider_apps (
     jwks jsonb,
     software_id text,
     software_version text,
-    registration_access_token text,
+    registration_access_token bytea,
     registration_client_uri text
 );
 
diff --git a/coderd/database/migrations/000388_oauth_app_byte_reg_access_token.down.sql b/coderd/database/migrations/000388_oauth_app_byte_reg_access_token.down.sql
new file mode 100644
index 0000000000000..3e56dbf873511
--- /dev/null
+++ b/coderd/database/migrations/000388_oauth_app_byte_reg_access_token.down.sql
@@ -0,0 +1,4 @@
+ALTER TABLE oauth2_provider_apps
+	ALTER COLUMN registration_access_token
+		SET DATA TYPE text
+		USING encode(registration_access_token, 'escape');
diff --git a/coderd/database/migrations/000388_oauth_app_byte_reg_access_token.up.sql b/coderd/database/migrations/000388_oauth_app_byte_reg_access_token.up.sql
new file mode 100644
index 0000000000000..b278fed80e4ff
--- /dev/null
+++ b/coderd/database/migrations/000388_oauth_app_byte_reg_access_token.up.sql
@@ -0,0 +1,4 @@
+ALTER TABLE oauth2_provider_apps
+	ALTER COLUMN registration_access_token
+		SET DATA TYPE bytea
+		USING decode(registration_access_token, 'escape');
diff --git a/coderd/database/models.go b/coderd/database/models.go
index fe9b04755bd43..d5db3a3819e17 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -3956,7 +3956,7 @@ type OAuth2ProviderApp struct {
 	// RFC 7591: Version of the client software
 	SoftwareVersion sql.NullString `db:"software_version" json:"software_version"`
 	// RFC 7592: Hashed registration access token for client management
-	RegistrationAccessToken sql.NullString `db:"registration_access_token" json:"registration_access_token"`
+	RegistrationAccessToken []byte `db:"registration_access_token" json:"registration_access_token"`
 	// RFC 7592: URI for client configuration endpoint
 	RegistrationClientUri sql.NullString `db:"registration_client_uri" json:"registration_client_uri"`
 }
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index a1c612078008d..c6ae87dbc52f6 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -6,7 +6,6 @@ package database
 
 import (
 	"context"
-	"database/sql"
 	"time"
 
 	"github.com/google/uuid"
@@ -246,7 +245,7 @@ type sqlcQuerier interface {
 	// RFC 7591/7592 Dynamic Client Registration queries
 	GetOAuth2ProviderAppByClientID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error)
 	GetOAuth2ProviderAppByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderApp, error)
-	GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (OAuth2ProviderApp, error)
+	GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken []byte) (OAuth2ProviderApp, error)
 	GetOAuth2ProviderAppCodeByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppCode, error)
 	GetOAuth2ProviderAppCodeByPrefix(ctx context.Context, secretPrefix []byte) (OAuth2ProviderAppCode, error)
 	GetOAuth2ProviderAppSecretByID(ctx context.Context, id uuid.UUID) (OAuth2ProviderAppSecret, error)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index d257d571c0240..c5b8caba37ced 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -6206,7 +6206,7 @@ const getOAuth2ProviderAppByRegistrationToken = `-- name: GetOAuth2ProviderAppBy
 SELECT id, created_at, updated_at, name, icon, callback_url, redirect_uris, client_type, dynamically_registered, client_id_issued_at, client_secret_expires_at, grant_types, response_types, token_endpoint_auth_method, scope, contacts, client_uri, logo_uri, tos_uri, policy_uri, jwks_uri, jwks, software_id, software_version, registration_access_token, registration_client_uri FROM oauth2_provider_apps WHERE registration_access_token = $1
 `
 
-func (q *sqlQuerier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken sql.NullString) (OAuth2ProviderApp, error) {
+func (q *sqlQuerier) GetOAuth2ProviderAppByRegistrationToken(ctx context.Context, registrationAccessToken []byte) (OAuth2ProviderApp, error) {
 	row := q.db.QueryRowContext(ctx, getOAuth2ProviderAppByRegistrationToken, registrationAccessToken)
 	var i OAuth2ProviderApp
 	err := row.Scan(
@@ -6607,7 +6607,7 @@ type InsertOAuth2ProviderAppParams struct {
 	Jwks                    pqtype.NullRawMessage `db:"jwks" json:"jwks"`
 	SoftwareID              sql.NullString        `db:"software_id" json:"software_id"`
 	SoftwareVersion         sql.NullString        `db:"software_version" json:"software_version"`
-	RegistrationAccessToken sql.NullString        `db:"registration_access_token" json:"registration_access_token"`
+	RegistrationAccessToken []byte                `db:"registration_access_token" json:"registration_access_token"`
 	RegistrationClientUri   sql.NullString        `db:"registration_client_uri" json:"registration_client_uri"`
 }
 
diff --git a/coderd/httpmw/apikey.go b/coderd/httpmw/apikey.go
index 08b835ccc6630..29296fea59f5b 100644
--- a/coderd/httpmw/apikey.go
+++ b/coderd/httpmw/apikey.go
@@ -2,8 +2,6 @@ package httpmw
 
 import (
 	"context"
-	"crypto/sha256"
-	"crypto/subtle"
 	"database/sql"
 	"errors"
 	"fmt"
@@ -20,6 +18,7 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
@@ -188,8 +187,7 @@ func APIKeyFromRequest(ctx context.Context, db database.Store, sessionTokenFunc
 	}
 
 	// Checking to see if the secret is valid.
-	hashedSecret := sha256.Sum256([]byte(keySecret))
-	if subtle.ConstantTimeCompare(key.HashedSecret, hashedSecret[:]) != 1 {
+	if !apikey.ValidateHash(key.HashedSecret, keySecret) {
 		return nil, codersdk.Response{
 			Message: SignedOutErrorMessage,
 			Detail:  "API key secret is invalid.",
diff --git a/coderd/httpmw/apikey_test.go b/coderd/httpmw/apikey_test.go
index 6e00b7a4535e2..020dc28e60139 100644
--- a/coderd/httpmw/apikey_test.go
+++ b/coderd/httpmw/apikey_test.go
@@ -19,6 +19,7 @@ import (
 	"golang.org/x/exp/slices"
 	"golang.org/x/oauth2"
 
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
@@ -32,10 +33,10 @@ import (
 	"github.com/coder/coder/v2/testutil"
 )
 
-func randomAPIKeyParts() (id string, secret string) {
+func randomAPIKeyParts() (id string, secret string, hashedSecret []byte) {
 	id, _ = cryptorand.String(10)
-	secret, _ = cryptorand.String(22)
-	return id, secret
+	secret, hashedSecret, _ = apikey.GenerateSecret(22)
+	return id, secret, hashedSecret
 }
 
 func TestAPIKey(t *testing.T) {
@@ -171,10 +172,10 @@ func TestAPIKey(t *testing.T) {
 	t.Run("NotFound", func(t *testing.T) {
 		t.Parallel()
 		var (
-			db, _      = dbtestutil.NewDB(t)
-			id, secret = randomAPIKeyParts()
-			r          = httptest.NewRequest("GET", "/", nil)
-			rw         = httptest.NewRecorder()
+			db, _         = dbtestutil.NewDB(t)
+			id, secret, _ = randomAPIKeyParts()
+			r             = httptest.NewRequest("GET", "/", nil)
+			rw            = httptest.NewRecorder()
 		)
 		r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
 
diff --git a/coderd/httpmw/authorize_test.go b/coderd/httpmw/authorize_test.go
index 030f23935ef83..529ba94774539 100644
--- a/coderd/httpmw/authorize_test.go
+++ b/coderd/httpmw/authorize_test.go
@@ -2,7 +2,6 @@ package httpmw_test
 
 import (
 	"context"
-	"crypto/sha256"
 	"fmt"
 	"net"
 	"net/http"
@@ -142,10 +141,7 @@ func TestExtractUserRoles(t *testing.T) {
 }
 
 func addUser(t *testing.T, db database.Store, roles ...string) (database.User, string) {
-	var (
-		id, secret = randomAPIKeyParts()
-		hashed     = sha256.Sum256([]byte(secret))
-	)
+	id, secret, hashed := randomAPIKeyParts()
 	if roles == nil {
 		roles = []string{}
 	}
@@ -169,7 +165,7 @@ func addUser(t *testing.T, db database.Store, roles ...string) (database.User, s
 	_, err = db.InsertAPIKey(context.Background(), database.InsertAPIKeyParams{
 		ID:           id,
 		UserID:       user.ID,
-		HashedSecret: hashed[:],
+		HashedSecret: hashed,
 		LastUsed:     dbtime.Now(),
 		ExpiresAt:    dbtime.Now().Add(time.Minute),
 		LoginType:    database.LoginTypePassword,
diff --git a/coderd/httpmw/workspaceparam_test.go b/coderd/httpmw/workspaceparam_test.go
index 7b9871ce6dc41..e83cbe437e9ac 100644
--- a/coderd/httpmw/workspaceparam_test.go
+++ b/coderd/httpmw/workspaceparam_test.go
@@ -2,7 +2,6 @@ package httpmw_test
 
 import (
 	"context"
-	"crypto/sha256"
 	"encoding/json"
 	"fmt"
 	"net"
@@ -31,10 +30,7 @@ func TestWorkspaceParam(t *testing.T) {
 	t.Parallel()
 
 	setup := func(db database.Store) (*http.Request, database.User) {
-		var (
-			id, secret = randomAPIKeyParts()
-			hashed     = sha256.Sum256([]byte(secret))
-		)
+		id, secret, hashed := randomAPIKeyParts()
 		r := httptest.NewRequest("GET", "/", nil)
 		r.Header.Set(codersdk.SessionTokenHeader, fmt.Sprintf("%s-%s", id, secret))
 
@@ -44,7 +40,7 @@ func TestWorkspaceParam(t *testing.T) {
 		user, err := db.InsertUser(r.Context(), database.InsertUserParams{
 			ID:             userID,
 			Email:          "testaccount@coder.com",
-			HashedPassword: hashed[:],
+			HashedPassword: hashed,
 			Username:       username,
 			CreatedAt:      dbtime.Now(),
 			UpdatedAt:      dbtime.Now(),
@@ -63,7 +59,7 @@ func TestWorkspaceParam(t *testing.T) {
 		_, err = db.InsertAPIKey(r.Context(), database.InsertAPIKeyParams{
 			ID:           id,
 			UserID:       user.ID,
-			HashedSecret: hashed[:],
+			HashedSecret: hashed,
 			LastUsed:     dbtime.Now(),
 			ExpiresAt:    dbtime.Now().Add(time.Minute),
 			LoginType:    database.LoginTypePassword,
diff --git a/coderd/httpmw/workspaceproxy.go b/coderd/httpmw/workspaceproxy.go
index 1f2de1ed46160..39f665210b66f 100644
--- a/coderd/httpmw/workspaceproxy.go
+++ b/coderd/httpmw/workspaceproxy.go
@@ -2,8 +2,6 @@ package httpmw
 
 import (
 	"context"
-	"crypto/sha256"
-	"crypto/subtle"
 	"database/sql"
 	"net/http"
 	"strings"
@@ -12,6 +10,7 @@ import (
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/httpapi"
@@ -125,8 +124,7 @@ func ExtractWorkspaceProxy(opts ExtractWorkspaceProxyConfig) func(http.Handler)
 			}
 
 			// Do a subtle constant time comparison of the hash of the secret.
-			hashedSecret := sha256.Sum256([]byte(secret))
-			if subtle.ConstantTimeCompare(proxy.TokenHashedSecret, hashedSecret[:]) != 1 {
+			if !apikey.ValidateHash(proxy.TokenHashedSecret, secret) {
 				httpapi.Write(ctx, w, http.StatusUnauthorized, codersdk.Response{
 					Message: "Invalid external proxy token",
 					Detail:  "Invalid proxy token secret.",
diff --git a/coderd/oauth2_test.go b/coderd/oauth2_test.go
index c03dcf7e3a27d..72564a2a0d85e 100644
--- a/coderd/oauth2_test.go
+++ b/coderd/oauth2_test.go
@@ -620,7 +620,7 @@ func TestOAuth2ProviderTokenRefresh(t *testing.T) {
 				CreatedAt:   dbtime.Now(),
 				ExpiresAt:   expires,
 				HashPrefix:  []byte(token.Prefix),
-				RefreshHash: []byte(token.Hashed),
+				RefreshHash: token.Hashed,
 				AppSecretID: secret.ID,
 				APIKeyID:    newKey.ID,
 				UserID:      user.ID,
diff --git a/coderd/oauth2provider/app_secrets.go b/coderd/oauth2provider/app_secrets.go
index 5549ece4266f2..3eff684123c0e 100644
--- a/coderd/oauth2provider/app_secrets.go
+++ b/coderd/oauth2provider/app_secrets.go
@@ -66,7 +66,7 @@ func CreateAppSecret(db database.Store, auditor *audit.Auditor, logger slog.Logg
 			ID:           uuid.New(),
 			CreatedAt:    dbtime.Now(),
 			SecretPrefix: []byte(secret.Prefix),
-			HashedSecret: []byte(secret.Hashed),
+			HashedSecret: secret.Hashed,
 			// DisplaySecret is the last six characters of the original unhashed secret.
 			// This is done so they can be differentiated and it matches how GitHub
 			// displays their client secrets.
diff --git a/coderd/oauth2provider/apps.go b/coderd/oauth2provider/apps.go
index 74bafb851ef1a..81ff8b0e24095 100644
--- a/coderd/oauth2provider/apps.go
+++ b/coderd/oauth2provider/apps.go
@@ -110,7 +110,7 @@ func CreateApp(db database.Store, accessURL *url.URL, auditor *audit.Auditor, lo
 			Jwks:                    pqtype.NullRawMessage{},
 			SoftwareID:              sql.NullString{},
 			SoftwareVersion:         sql.NullString{},
-			RegistrationAccessToken: sql.NullString{},
+			RegistrationAccessToken: nil,
 			RegistrationClientUri:   sql.NullString{},
 		})
 		if err != nil {
diff --git a/coderd/oauth2provider/authorize.go b/coderd/oauth2provider/authorize.go
index d6b05fc51673f..d738e781e8a34 100644
--- a/coderd/oauth2provider/authorize.go
+++ b/coderd/oauth2provider/authorize.go
@@ -165,7 +165,7 @@ func ProcessAuthorize(db database.Store) http.HandlerFunc {
 				// has left) then they can just retry immediately and get a new code.
 				ExpiresAt:           dbtime.Now().Add(time.Duration(10) * time.Minute),
 				SecretPrefix:        []byte(code.Prefix),
-				HashedSecret:        []byte(code.Hashed),
+				HashedSecret:        code.Hashed,
 				AppID:               app.ID,
 				UserID:              apiKey.UserID,
 				ResourceUri:         sql.NullString{String: params.resource, Valid: params.resource != ""},
diff --git a/coderd/oauth2provider/registration.go b/coderd/oauth2provider/registration.go
index c433cae8ff8ca..807c39371d8a4 100644
--- a/coderd/oauth2provider/registration.go
+++ b/coderd/oauth2provider/registration.go
@@ -15,15 +15,14 @@ import (
 	"golang.org/x/xerrors"
 
 	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/apikey"
 
 	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/httpapi"
-	"github.com/coder/coder/v2/coderd/userpassword"
 	"github.com/coder/coder/v2/codersdk"
-	"github.com/coder/coder/v2/cryptorand"
 )
 
 // CreateDynamicClientRegistration returns an http.HandlerFunc that handles POST /oauth2/register
@@ -100,7 +99,7 @@ func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, audi
 			Jwks:                    pqtype.NullRawMessage{RawMessage: req.JWKS, Valid: len(req.JWKS) > 0},
 			SoftwareID:              sql.NullString{String: req.SoftwareID, Valid: req.SoftwareID != ""},
 			SoftwareVersion:         sql.NullString{String: req.SoftwareVersion, Valid: req.SoftwareVersion != ""},
-			RegistrationAccessToken: sql.NullString{String: hashedRegToken, Valid: true},
+			RegistrationAccessToken: hashedRegToken,
 			RegistrationClientUri:   sql.NullString{String: fmt.Sprintf("%s/oauth2/clients/%s", accessURL.String(), clientID), Valid: true},
 		})
 		if err != nil {
@@ -127,7 +126,7 @@ func CreateDynamicClientRegistration(db database.Store, accessURL *url.URL, audi
 			ID:            uuid.New(),
 			CreatedAt:     now,
 			SecretPrefix:  []byte(parsedSecret.Prefix),
-			HashedSecret:  []byte(hashedSecret),
+			HashedSecret:  hashedSecret,
 			DisplaySecret: createDisplaySecret(clientSecret),
 			AppID:         clientID,
 		})
@@ -224,7 +223,7 @@ func GetClientConfiguration(db database.Store) http.HandlerFunc {
 			TokenEndpointAuthMethod: app.TokenEndpointAuthMethod.String,
 			Scope:                   app.Scope.String,
 			Contacts:                app.Contacts,
-			RegistrationAccessToken: "", // RFC 7592: Not returned in GET responses for security
+			RegistrationAccessToken: nil, // RFC 7592: Not returned in GET responses for security
 			RegistrationClientURI:   app.RegistrationClientUri.String,
 		}
 
@@ -348,7 +347,7 @@ func UpdateClientConfiguration(db database.Store, auditor *audit.Auditor, logger
 			TokenEndpointAuthMethod: updatedApp.TokenEndpointAuthMethod.String,
 			Scope:                   updatedApp.Scope.String,
 			Contacts:                updatedApp.Contacts,
-			RegistrationAccessToken: updatedApp.RegistrationAccessToken.String,
+			RegistrationAccessToken: updatedApp.RegistrationAccessToken,
 			RegistrationClientURI:   updatedApp.RegistrationClientUri.String,
 		}
 
@@ -476,20 +475,14 @@ func RequireRegistrationAccessToken(db database.Store) func(http.Handler) http.H
 			}
 
 			// Verify the registration access token
-			if !app.RegistrationAccessToken.Valid {
+			if len(app.RegistrationAccessToken) == 0 {
 				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
 					"server_error", "Client has no registration access token")
 				return
 			}
 
 			// Compare the provided token with the stored hash
-			valid, err := userpassword.Compare(app.RegistrationAccessToken.String, token)
-			if err != nil {
-				writeOAuth2RegistrationError(ctx, rw, http.StatusInternalServerError,
-					"server_error", "Failed to verify registration access token")
-				return
-			}
-			if !valid {
+			if !apikey.ValidateHash(app.RegistrationAccessToken, token) {
 				writeOAuth2RegistrationError(ctx, rw, http.StatusUnauthorized,
 					"invalid_token", "Invalid registration access token")
 				return
@@ -504,30 +497,19 @@ func RequireRegistrationAccessToken(db database.Store) func(http.Handler) http.H
 // Helper functions for RFC 7591 Dynamic Client Registration
 
 // generateClientCredentials generates a client secret for OAuth2 apps
-func generateClientCredentials() (plaintext, hashed string, err error) {
+func generateClientCredentials() (plaintext string, hashed []byte, err error) {
 	// Use the same pattern as existing OAuth2 app secrets
 	secret, err := GenerateSecret()
 	if err != nil {
-		return "", "", xerrors.Errorf("generate secret: %w", err)
+		return "", nil, xerrors.Errorf("generate secret: %w", err)
 	}
 
 	return secret.Formatted, secret.Hashed, nil
 }
 
 // generateRegistrationAccessToken generates a registration access token for RFC 7592
-func generateRegistrationAccessToken() (plaintext, hashed string, err error) {
-	token, err := cryptorand.String(secretLength)
-	if err != nil {
-		return "", "", xerrors.Errorf("generate registration token: %w", err)
-	}
-
-	// Hash the token for storage
-	hashedToken, err := userpassword.Hash(token)
-	if err != nil {
-		return "", "", xerrors.Errorf("hash registration token: %w", err)
-	}
-
-	return token, hashedToken, nil
+func generateRegistrationAccessToken() (plaintext string, hashed []byte, err error) {
+	return apikey.GenerateSecret(secretLength)
 }
 
 // writeOAuth2RegistrationError writes RFC 7591 compliant error responses
diff --git a/coderd/oauth2provider/revoke.go b/coderd/oauth2provider/revoke.go
index 2dbe4827b15ee..19f3fb803a88c 100644
--- a/coderd/oauth2provider/revoke.go
+++ b/coderd/oauth2provider/revoke.go
@@ -14,11 +14,11 @@ import (
 	"github.com/google/uuid"
 
 	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpmw"
-	"github.com/coder/coder/v2/coderd/userpassword"
 )
 
 var (
@@ -120,10 +120,7 @@ func revokeRefreshTokenInTx(ctx context.Context, db database.Store, token string
 		return xerrors.Errorf("get oauth2 provider app token by prefix: %w", err)
 	}
 
-	equal, err := userpassword.Compare(string(dbToken.RefreshHash), parsedToken.Secret)
-	if err != nil {
-		return xerrors.Errorf("invalid refresh token: %w", err)
-	}
+	equal := apikey.ValidateHash(dbToken.RefreshHash, parsedToken.Secret)
 	if !equal {
 		return xerrors.Errorf("invalid refresh token")
 	}
diff --git a/coderd/oauth2provider/secrets.go b/coderd/oauth2provider/secrets.go
index 56c5231b25efc..ee6a7b315d843 100644
--- a/coderd/oauth2provider/secrets.go
+++ b/coderd/oauth2provider/secrets.go
@@ -6,7 +6,7 @@ import (
 
 	"golang.org/x/xerrors"
 
-	"github.com/coder/coder/v2/coderd/userpassword"
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/cryptorand"
 )
 
@@ -25,7 +25,7 @@ type HashedAppSecret struct {
 	AppSecret
 	// Hashed is the server stored hash(secret,salt,...). Used for verifying a
 	// secret.
-	Hashed string
+	Hashed []byte
 }
 
 type AppSecret struct {
@@ -61,7 +61,7 @@ func ParseFormattedSecret(formatted string) (AppSecret, error) {
 // token, or authorization code.
 func GenerateSecret() (HashedAppSecret, error) {
 	// 40 characters matches the length of GitHub's client secrets.
-	secret, err := cryptorand.String(secretLength)
+	secret, hashedSecret, err := apikey.GenerateSecret(40)
 	if err != nil {
 		return HashedAppSecret{}, err
 	}
@@ -74,17 +74,12 @@ func GenerateSecret() (HashedAppSecret, error) {
 		return HashedAppSecret{}, err
 	}
 
-	hashed, err := userpassword.Hash(secret)
-	if err != nil {
-		return HashedAppSecret{}, err
-	}
-
 	return HashedAppSecret{
 		AppSecret: AppSecret{
 			Formatted: fmt.Sprintf("%s_%s_%s", SecretIdentifier, prefix, secret),
 			Secret:    secret,
 			Prefix:    prefix,
 		},
-		Hashed: hashed,
+		Hashed: hashedSecret,
 	}, nil
 }
diff --git a/coderd/oauth2provider/tokens.go b/coderd/oauth2provider/tokens.go
index 94b24cca25186..d0f1aad1051b4 100644
--- a/coderd/oauth2provider/tokens.go
+++ b/coderd/oauth2provider/tokens.go
@@ -22,7 +22,6 @@ import (
 	"github.com/coder/coder/v2/coderd/httpapi"
 	"github.com/coder/coder/v2/coderd/httpmw"
 	"github.com/coder/coder/v2/coderd/rbac"
-	"github.com/coder/coder/v2/coderd/userpassword"
 	"github.com/coder/coder/v2/codersdk"
 )
 
@@ -197,11 +196,9 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 	if err != nil {
 		return oauth2.Token{}, err
 	}
-	equal, err := userpassword.Compare(string(dbSecret.HashedSecret), secret.Secret)
-	if err != nil {
-		return oauth2.Token{}, xerrors.Errorf("unable to compare secret: %w", err)
-	}
-	if !equal {
+
+	equalSecret := apikey.ValidateHash(dbSecret.HashedSecret, secret.Secret)
+	if !equalSecret {
 		return oauth2.Token{}, errBadSecret
 	}
 
@@ -218,11 +215,8 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 	if err != nil {
 		return oauth2.Token{}, err
 	}
-	equal, err = userpassword.Compare(string(dbCode.HashedSecret), code.Secret)
-	if err != nil {
-		return oauth2.Token{}, xerrors.Errorf("unable to compare code: %w", err)
-	}
-	if !equal {
+	equalCode := apikey.ValidateHash(dbCode.HashedSecret, code.Secret)
+	if !equalCode {
 		return oauth2.Token{}, errBadCode
 	}
 
@@ -318,7 +312,7 @@ func authorizationCodeGrant(ctx context.Context, db database.Store, app database
 			CreatedAt:   dbtime.Now(),
 			ExpiresAt:   refreshExpiresAt,
 			HashPrefix:  []byte(refreshToken.Prefix),
-			RefreshHash: []byte(refreshToken.Hashed),
+			RefreshHash: refreshToken.Hashed,
 			AppSecretID: dbSecret.ID,
 			APIKeyID:    newKey.ID,
 			UserID:      dbCode.UserID,
@@ -356,10 +350,7 @@ func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAut
 	if err != nil {
 		return oauth2.Token{}, err
 	}
-	equal, err := userpassword.Compare(string(dbToken.RefreshHash), token.Secret)
-	if err != nil {
-		return oauth2.Token{}, xerrors.Errorf("unable to compare token: %w", err)
-	}
+	equal := apikey.ValidateHash(dbToken.RefreshHash, token.Secret)
 	if !equal {
 		return oauth2.Token{}, errBadToken
 	}
@@ -434,7 +425,7 @@ func refreshTokenGrant(ctx context.Context, db database.Store, app database.OAut
 			CreatedAt:   dbtime.Now(),
 			ExpiresAt:   refreshExpiresAt,
 			HashPrefix:  []byte(refreshToken.Prefix),
-			RefreshHash: []byte(refreshToken.Hashed),
+			RefreshHash: refreshToken.Hashed,
 			AppSecretID: dbToken.AppSecretID,
 			APIKeyID:    newKey.ID,
 			UserID:      dbToken.UserID,
diff --git a/coderd/provisionerkey/provisionerkey.go b/coderd/provisionerkey/provisionerkey.go
index bfd70fb0295e0..046222658eb2e 100644
--- a/coderd/provisionerkey/provisionerkey.go
+++ b/coderd/provisionerkey/provisionerkey.go
@@ -1,15 +1,14 @@
 package provisionerkey
 
 import (
-	"crypto/sha256"
 	"crypto/subtle"
 
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
-	"github.com/coder/coder/v2/cryptorand"
 )
 
 const (
@@ -17,7 +16,7 @@ const (
 )
 
 func New(organizationID uuid.UUID, name string, tags map[string]string) (database.InsertProvisionerKeyParams, string, error) {
-	secret, err := cryptorand.String(secretLength)
+	secret, hashed, err := apikey.GenerateSecret(secretLength)
 	if err != nil {
 		return database.InsertProvisionerKeyParams{}, "", xerrors.Errorf("generate secret: %w", err)
 	}
@@ -31,7 +30,7 @@ func New(organizationID uuid.UUID, name string, tags map[string]string) (databas
 		CreatedAt:      dbtime.Now(),
 		OrganizationID: organizationID,
 		Name:           name,
-		HashedSecret:   HashSecret(secret),
+		HashedSecret:   hashed,
 		Tags:           tags,
 	}, secret, nil
 }
@@ -45,8 +44,7 @@ func Validate(token string) error {
 }
 
 func HashSecret(secret string) []byte {
-	h := sha256.Sum256([]byte(secret))
-	return h[:]
+	return apikey.HashSecret(secret)
 }
 
 func Compare(a []byte, b []byte) bool {
diff --git a/codersdk/oauth2.go b/codersdk/oauth2.go
index c514a1b712c5f..79b2186480b9c 100644
--- a/codersdk/oauth2.go
+++ b/codersdk/oauth2.go
@@ -486,6 +486,6 @@ type OAuth2ClientConfiguration struct {
 	TokenEndpointAuthMethod string          `json:"token_endpoint_auth_method"`
 	Scope                   string          `json:"scope,omitempty"`
 	Contacts                []string        `json:"contacts,omitempty"`
-	RegistrationAccessToken string          `json:"registration_access_token"`
+	RegistrationAccessToken []byte          `json:"registration_access_token"`
 	RegistrationClientURI   string          `json:"registration_client_uri"`
 }
diff --git a/docs/reference/api/enterprise.md b/docs/reference/api/enterprise.md
index cc208c27ed790..131223e38e5f4 100644
--- a/docs/reference/api/enterprise.md
+++ b/docs/reference/api/enterprise.md
@@ -1274,7 +1274,9 @@ curl -X GET http://coder-server:8080/api/v2/oauth2/clients/{client_id} \
   "redirect_uris": [
     "string"
   ],
-  "registration_access_token": "string",
+  "registration_access_token": [
+    0
+  ],
   "registration_client_uri": "string",
   "response_types": [
     "string"
@@ -1368,7 +1370,9 @@ curl -X PUT http://coder-server:8080/api/v2/oauth2/clients/{client_id} \
   "redirect_uris": [
     "string"
   ],
-  "registration_access_token": "string",
+  "registration_access_token": [
+    0
+  ],
   "registration_client_uri": "string",
   "response_types": [
     "string"
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 014170ca4a56c..3bdf92a119fb1 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -5350,7 +5350,9 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "redirect_uris": [
     "string"
   ],
-  "registration_access_token": "string",
+  "registration_access_token": [
+    0
+  ],
   "registration_client_uri": "string",
   "response_types": [
     "string"
@@ -5365,28 +5367,28 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 
 ### Properties
 
-| Name                         | Type            | Required | Restrictions | Description |
-|------------------------------|-----------------|----------|--------------|-------------|
-| `client_id`                  | string          | false    |              |             |
-| `client_id_issued_at`        | integer         | false    |              |             |
-| `client_name`                | string          | false    |              |             |
-| `client_secret_expires_at`   | integer         | false    |              |             |
-| `client_uri`                 | string          | false    |              |             |
-| `contacts`                   | array of string | false    |              |             |
-| `grant_types`                | array of string | false    |              |             |
-| `jwks`                       | object          | false    |              |             |
-| `jwks_uri`                   | string          | false    |              |             |
-| `logo_uri`                   | string          | false    |              |             |
-| `policy_uri`                 | string          | false    |              |             |
-| `redirect_uris`              | array of string | false    |              |             |
-| `registration_access_token`  | string          | false    |              |             |
-| `registration_client_uri`    | string          | false    |              |             |
-| `response_types`             | array of string | false    |              |             |
-| `scope`                      | string          | false    |              |             |
-| `software_id`                | string          | false    |              |             |
-| `software_version`           | string          | false    |              |             |
-| `token_endpoint_auth_method` | string          | false    |              |             |
-| `tos_uri`                    | string          | false    |              |             |
+| Name                         | Type             | Required | Restrictions | Description |
+|------------------------------|------------------|----------|--------------|-------------|
+| `client_id`                  | string           | false    |              |             |
+| `client_id_issued_at`        | integer          | false    |              |             |
+| `client_name`                | string           | false    |              |             |
+| `client_secret_expires_at`   | integer          | false    |              |             |
+| `client_uri`                 | string           | false    |              |             |
+| `contacts`                   | array of string  | false    |              |             |
+| `grant_types`                | array of string  | false    |              |             |
+| `jwks`                       | object           | false    |              |             |
+| `jwks_uri`                   | string           | false    |              |             |
+| `logo_uri`                   | string           | false    |              |             |
+| `policy_uri`                 | string           | false    |              |             |
+| `redirect_uris`              | array of string  | false    |              |             |
+| `registration_access_token`  | array of integer | false    |              |             |
+| `registration_client_uri`    | string           | false    |              |             |
+| `response_types`             | array of string  | false    |              |             |
+| `scope`                      | string           | false    |              |             |
+| `software_id`                | string           | false    |              |             |
+| `software_version`           | string           | false    |              |             |
+| `token_endpoint_auth_method` | string           | false    |              |             |
+| `tos_uri`                    | string           | false    |              |             |
 
 ## codersdk.OAuth2ClientRegistrationRequest
 
diff --git a/enterprise/coderd/workspaceproxy.go b/enterprise/coderd/workspaceproxy.go
index 2ebee9d93f9e8..4f3ce12056617 100644
--- a/enterprise/coderd/workspaceproxy.go
+++ b/enterprise/coderd/workspaceproxy.go
@@ -2,7 +2,6 @@ package coderd
 
 import (
 	"context"
-	"crypto/sha256"
 	"database/sql"
 	"fmt"
 	"net/http"
@@ -16,6 +15,7 @@ import (
 
 	"cdr.dev/slog"
 	agpl "github.com/coder/coder/v2/coderd"
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/db2sdk"
@@ -28,7 +28,6 @@ import (
 	"github.com/coder/coder/v2/coderd/workspaceapps"
 	"github.com/coder/coder/v2/coderd/workspaceapps/appurl"
 	"github.com/coder/coder/v2/codersdk"
-	"github.com/coder/coder/v2/cryptorand"
 	"github.com/coder/coder/v2/enterprise/coderd/proxyhealth"
 	"github.com/coder/coder/v2/enterprise/replicasync"
 	"github.com/coder/coder/v2/enterprise/wsproxy/wsproxysdk"
@@ -934,13 +933,13 @@ func (api *API) reconnectingPTYSignedToken(rw http.ResponseWriter, r *http.Reque
 }
 
 func generateWorkspaceProxyToken(id uuid.UUID) (token string, hashed []byte, err error) {
-	secret, err := cryptorand.HexString(64)
+	secret, hashedSecret, err := apikey.GenerateSecret(64)
 	if err != nil {
 		return "", nil, xerrors.Errorf("generate token: %w", err)
 	}
-	hashedSecret := sha256.Sum256([]byte(secret))
+
 	fullToken := fmt.Sprintf("%s:%s", id, secret)
-	return fullToken, hashedSecret[:], nil
+	return fullToken, hashedSecret, nil
 }
 
 func convertProxies(p []database.WorkspaceProxy, statuses map[uuid.UUID]proxyhealth.ProxyStatus) []codersdk.WorkspaceProxy {
diff --git a/enterprise/x/aibridgedserver/aibridgedserver.go b/enterprise/x/aibridgedserver/aibridgedserver.go
index ee79cd15f07d1..e766e696222d7 100644
--- a/enterprise/x/aibridgedserver/aibridgedserver.go
+++ b/enterprise/x/aibridgedserver/aibridgedserver.go
@@ -2,8 +2,6 @@ package aibridgedserver
 
 import (
 	"context"
-	"crypto/sha256"
-	"crypto/subtle"
 	"database/sql"
 	"encoding/json"
 	"net/url"
@@ -17,6 +15,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 
 	"cdr.dev/slog"
+	"github.com/coder/coder/v2/coderd/apikey"
 
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
@@ -358,8 +357,7 @@ func (s *Server) IsAuthorized(ctx context.Context, in *proto.IsAuthorizedRequest
 	}
 
 	// Key secret matches.
-	hashedSecret := sha256.Sum256([]byte(keySecret))
-	if subtle.ConstantTimeCompare(key.HashedSecret, hashedSecret[:]) != 1 {
+	if !apikey.ValidateHash(key.HashedSecret, keySecret) {
 		return nil, ErrInvalidKey
 	}
 
diff --git a/enterprise/x/aibridgedserver/aibridgedserver_test.go b/enterprise/x/aibridgedserver/aibridgedserver_test.go
index 03fec9398bae4..fc8f8e8afd25b 100644
--- a/enterprise/x/aibridgedserver/aibridgedserver_test.go
+++ b/enterprise/x/aibridgedserver/aibridgedserver_test.go
@@ -2,7 +2,6 @@ package aibridgedserver_test
 
 import (
 	"context"
-	"crypto/sha256"
 	"database/sql"
 	"encoding/json"
 	"fmt"
@@ -21,6 +20,7 @@ import (
 	"google.golang.org/protobuf/types/known/structpb"
 	"google.golang.org/protobuf/types/known/timestamppb"
 
+	"github.com/coder/coder/v2/coderd/apikey"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbmock"
 	"github.com/coder/coder/v2/coderd/database/dbtime"
@@ -138,13 +138,12 @@ func TestAuthorization(t *testing.T) {
 			}
 
 			keyID, _ := cryptorand.String(10)
-			keySecret, _ := cryptorand.String(22)
+			keySecret, keySecretHashed, _ := apikey.GenerateSecret(22)
 			token := fmt.Sprintf("%s-%s", keyID, keySecret)
-			keySecretHashed := sha256.Sum256([]byte(keySecret))
 			apiKey := database.APIKey{
 				ID:              keyID,
 				LifetimeSeconds: 86400, // default in db
-				HashedSecret:    keySecretHashed[:],
+				HashedSecret:    keySecretHashed,
 				IPAddress: pqtype.Inet{
 					IPNet: net.IPNet{
 						IP:   net.IPv4(127, 0, 0, 1),

From 86ef3fb4974322048f933cd38491764837810a93 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Fri, 24 Oct 2025 14:06:25 +1100
Subject: [PATCH 226/298] test: fix flake in TestAgent_Metrics_SSH (#20447)

Closes https://github.com/coder/internal/issues/921

The flake in the linked issue was caused by the startup script taking longer than 1 second in CI. The existing conditional, that the startup script duration was under a second, was incorrect; the correct conditional is that the metric exists with the `success` label set to `true`.
---
 agent/agent_test.go | 106 ++++++++++++++++++++++++++++++++------------
 1 file changed, 78 insertions(+), 28 deletions(-)

diff --git a/agent/agent_test.go b/agent/agent_test.go
index ca0018076728e..b62a3e4425392 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -3481,16 +3481,31 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 	err = session.Shell()
 	require.NoError(t, err)
 
-	expected := []*proto.Stats_Metric{
+	expected := []struct {
+		Name    string
+		Type    proto.Stats_Metric_Type
+		CheckFn func(float64) error
+		Labels  []*proto.Stats_Metric_Label
+	}{
 		{
-			Name:  "agent_reconnecting_pty_connections_total",
-			Type:  proto.Stats_Metric_COUNTER,
-			Value: 0,
+			Name: "agent_reconnecting_pty_connections_total",
+			Type: proto.Stats_Metric_COUNTER,
+			CheckFn: func(v float64) error {
+				if v == 0 {
+					return nil
+				}
+				return xerrors.Errorf("expected 0, got %f", v)
+			},
 		},
 		{
-			Name:  "agent_sessions_total",
-			Type:  proto.Stats_Metric_COUNTER,
-			Value: 1,
+			Name: "agent_sessions_total",
+			Type: proto.Stats_Metric_COUNTER,
+			CheckFn: func(v float64) error {
+				if v == 1 {
+					return nil
+				}
+				return xerrors.Errorf("expected 1, got %f", v)
+			},
 			Labels: []*proto.Stats_Metric_Label{
 				{
 					Name:  "magic_type",
@@ -3503,24 +3518,44 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 			},
 		},
 		{
-			Name:  "agent_ssh_server_failed_connections_total",
-			Type:  proto.Stats_Metric_COUNTER,
-			Value: 0,
+			Name: "agent_ssh_server_failed_connections_total",
+			Type: proto.Stats_Metric_COUNTER,
+			CheckFn: func(v float64) error {
+				if v == 0 {
+					return nil
+				}
+				return xerrors.Errorf("expected 0, got %f", v)
+			},
 		},
 		{
-			Name:  "agent_ssh_server_sftp_connections_total",
-			Type:  proto.Stats_Metric_COUNTER,
-			Value: 0,
+			Name: "agent_ssh_server_sftp_connections_total",
+			Type: proto.Stats_Metric_COUNTER,
+			CheckFn: func(v float64) error {
+				if v == 0 {
+					return nil
+				}
+				return xerrors.Errorf("expected 0, got %f", v)
+			},
 		},
 		{
-			Name:  "agent_ssh_server_sftp_server_errors_total",
-			Type:  proto.Stats_Metric_COUNTER,
-			Value: 0,
+			Name: "agent_ssh_server_sftp_server_errors_total",
+			Type: proto.Stats_Metric_COUNTER,
+			CheckFn: func(v float64) error {
+				if v == 0 {
+					return nil
+				}
+				return xerrors.Errorf("expected 0, got %f", v)
+			},
 		},
 		{
-			Name:  "coderd_agentstats_currently_reachable_peers",
-			Type:  proto.Stats_Metric_GAUGE,
-			Value: 1,
+			Name: "coderd_agentstats_currently_reachable_peers",
+			Type: proto.Stats_Metric_GAUGE,
+			CheckFn: func(v float64) error {
+				if v == 1 {
+					return nil
+				}
+				return xerrors.Errorf("expected 1, got %f", v)
+			},
 			Labels: []*proto.Stats_Metric_Label{
 				{
 					Name:  "connection_type",
@@ -3529,9 +3564,14 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 			},
 		},
 		{
-			Name:  "coderd_agentstats_currently_reachable_peers",
-			Type:  proto.Stats_Metric_GAUGE,
-			Value: 0,
+			Name: "coderd_agentstats_currently_reachable_peers",
+			Type: proto.Stats_Metric_GAUGE,
+			CheckFn: func(f float64) error {
+				if f == 0 {
+					return nil
+				}
+				return xerrors.Errorf("expected 0, got %f", f)
+			},
 			Labels: []*proto.Stats_Metric_Label{
 				{
 					Name:  "connection_type",
@@ -3540,9 +3580,20 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 			},
 		},
 		{
-			Name:  "coderd_agentstats_startup_script_seconds",
-			Type:  proto.Stats_Metric_GAUGE,
-			Value: 1,
+			Name: "coderd_agentstats_startup_script_seconds",
+			Type: proto.Stats_Metric_GAUGE,
+			CheckFn: func(f float64) error {
+				if f >= 0 {
+					return nil
+				}
+				return xerrors.Errorf("expected >= 0, got %f", f)
+			},
+			Labels: []*proto.Stats_Metric_Label{
+				{
+					Name:  "success",
+					Value: "true",
+				},
+			},
 		},
 	}
 
@@ -3564,11 +3615,10 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 		for _, m := range mf.GetMetric() {
 			assert.Equal(t, expected[i].Name, mf.GetName())
 			assert.Equal(t, expected[i].Type.String(), mf.GetType().String())
-			// Value is max expected
 			if expected[i].Type == proto.Stats_Metric_GAUGE {
-				assert.GreaterOrEqualf(t, expected[i].Value, m.GetGauge().GetValue(), "expected %s to be greater than or equal to %f, got %f", expected[i].Name, expected[i].Value, m.GetGauge().GetValue())
+				assert.NoError(t, expected[i].CheckFn(m.GetGauge().GetValue()), "check fn for %s failed", expected[i].Name)
 			} else if expected[i].Type == proto.Stats_Metric_COUNTER {
-				assert.GreaterOrEqualf(t, expected[i].Value, m.GetCounter().GetValue(), "expected %s to be greater than or equal to %f, got %f", expected[i].Name, expected[i].Value, m.GetCounter().GetValue())
+				assert.NoError(t, expected[i].CheckFn(m.GetCounter().GetValue()), "check fn for %s failed", expected[i].Name)
 			}
 			for j, lbl := range expected[i].Labels {
 				assert.Equal(t, m.GetLabel()[j], &promgo.LabelPair{

From 33b42fca7a80304b73921d4ac80a7d194b48e4f1 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Fri, 24 Oct 2025 17:28:57 +1100
Subject: [PATCH 227/298] test: fix flake in TestAgent_Metrics_SSH (#20450)

Second flake for this test today :face_exhaling:.

Flake seen here, though I couldn't replicate this locally, some CI
exclusive networking issue.

https://github.com/coder/coder/actions/runs/18770305895/job/53553517887?pr=20448
```
    agent_test.go:3619:
        	Error Trace:	/home/runner/work/coder/coder/agent/agent_test.go:3619
        	Error:      	Received unexpected error:
        	            	expected 1, got 0.000000:
        	            	    github.com/coder/coder/v2/agent_test.TestAgent_Metrics_SSH.func7
        	            	        /home/runner/work/coder/coder/agent/agent_test.go:3557
        	Test:       	TestAgent_Metrics_SSH
        	Messages:   	check fn for coderd_agentstats_currently_reachable_peers failed
```
This value is incremented by a successful ping to the peer from the
agent, which is dependent on all the networking code, which I think is
definitely out of scope of this test for agent metrics. So, we'll just
assert that the metrics exist with the correct labels (`derp`, `p2p`)
---
 agent/agent_test.go | 23 ++++++++---------------
 1 file changed, 8 insertions(+), 15 deletions(-)

diff --git a/agent/agent_test.go b/agent/agent_test.go
index b62a3e4425392..d4d40b56bb92e 100644
--- a/agent/agent_test.go
+++ b/agent/agent_test.go
@@ -3462,11 +3462,7 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 	registry := prometheus.NewRegistry()
 
 	//nolint:dogsled
-	conn, _, _, _, _ := setupAgent(t, agentsdk.Manifest{
-		// Make sure we always get a DERP connection for
-		// currently_reachable_peers.
-		DisableDirectConnections: true,
-	}, 0, func(_ *agenttest.Client, o *agent.Options) {
+	conn, _, _, _, _ := setupAgent(t, agentsdk.Manifest{}, 0, func(_ *agenttest.Client, o *agent.Options) {
 		o.PrometheusRegistry = registry
 	})
 
@@ -3550,11 +3546,11 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 		{
 			Name: "coderd_agentstats_currently_reachable_peers",
 			Type: proto.Stats_Metric_GAUGE,
-			CheckFn: func(v float64) error {
-				if v == 1 {
-					return nil
-				}
-				return xerrors.Errorf("expected 1, got %f", v)
+			CheckFn: func(float64) error {
+				// We can't reliably ping a peer here, and networking is out of
+				// scope of this test, so we just test that the metric exists
+				// with the correct labels.
+				return nil
 			},
 			Labels: []*proto.Stats_Metric_Label{
 				{
@@ -3566,11 +3562,8 @@ func TestAgent_Metrics_SSH(t *testing.T) {
 		{
 			Name: "coderd_agentstats_currently_reachable_peers",
 			Type: proto.Stats_Metric_GAUGE,
-			CheckFn: func(f float64) error {
-				if f == 0 {
-					return nil
-				}
-				return xerrors.Errorf("expected 0, got %f", f)
+			CheckFn: func(float64) error {
+				return nil
 			},
 			Labels: []*proto.Stats_Metric_Label{
 				{

From e13a34c145be675cb70a1c4b7b1b2e913cee2791 Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Fri, 24 Oct 2025 17:53:18 +1100
Subject: [PATCH 228/298] chore: bump coder/serpent to fix shell completions
 bug (#20448)

Brings in the fix described in https://github.com/coder/serpent/pull/27
---
 go.mod |  8 ++++----
 go.sum | 16 ++++++++--------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/go.mod b/go.mod
index da858b69843d5..22297ca4c789b 100644
--- a/go.mod
+++ b/go.mod
@@ -100,7 +100,7 @@ require (
 	github.com/coder/pretty v0.0.0-20230908205945-e89ba86370e0
 	github.com/coder/quartz v0.2.1
 	github.com/coder/retry v1.5.1
-	github.com/coder/serpent v0.10.0
+	github.com/coder/serpent v0.11.0
 	github.com/coder/terraform-provider-coder/v2 v2.12.0
 	github.com/coder/websocket v1.8.13
 	github.com/coder/wgtunnel v0.1.13-0.20240522110300-ade90dfb2da0
@@ -173,7 +173,7 @@ require (
 	github.com/shirou/gopsutil/v4 v4.25.5
 	github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966
 	github.com/spf13/afero v1.15.0
-	github.com/spf13/pflag v1.0.7
+	github.com/spf13/pflag v1.0.10
 	github.com/sqlc-dev/pqtype v0.3.0
 	github.com/stretchr/testify v1.11.1
 	github.com/swaggo/http-swagger/v2 v2.0.1
@@ -196,7 +196,7 @@ require (
 	go.uber.org/mock v0.6.0
 	go4.org/netipx v0.0.0-20230728180743-ad4cb58a6516
 	golang.org/x/crypto v0.43.0
-	golang.org/x/exp v0.0.0-20250911091902-df9299821621
+	golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
 	golang.org/x/mod v0.29.0
 	golang.org/x/net v0.46.0
 	golang.org/x/oauth2 v0.32.0
@@ -353,7 +353,7 @@ require (
 	github.com/kr/fs v0.1.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/leodido/go-urn v1.4.0 // indirect
-	github.com/lucasb-eyer/go-colorful v1.2.0 // indirect
+	github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
 	github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 // indirect
 	github.com/mailru/easyjson v0.9.1 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
diff --git a/go.sum b/go.sum
index c12acdbe48a77..b5344eff068ee 100644
--- a/go.sum
+++ b/go.sum
@@ -944,8 +944,8 @@ github.com/coder/quartz v0.2.1 h1:QgQ2Vc1+mvzewg2uD/nj8MJ9p9gE+QhGJm+Z+NGnrSE=
 github.com/coder/quartz v0.2.1/go.mod h1:vsiCc+AHViMKH2CQpGIpFgdHIEQsxwm8yCscqKmzbRA=
 github.com/coder/retry v1.5.1 h1:iWu8YnD8YqHs3XwqrqsjoBTAVqT9ml6z9ViJ2wlMiqc=
 github.com/coder/retry v1.5.1/go.mod h1:blHMk9vs6LkoRT9ZHyuZo360cufXEhrxqvEzeMtRGoY=
-github.com/coder/serpent v0.10.0 h1:ofVk9FJXSek+SmL3yVE3GoArP83M+1tX+H7S4t8BSuM=
-github.com/coder/serpent v0.10.0/go.mod h1:cZFW6/fP+kE9nd/oRkEHJpG6sXCtQ+AX7WMMEHv0Y3Q=
+github.com/coder/serpent v0.11.0 h1:VKIIbBg0ManopqqDsutBGf7YYTUXsPQgBx//m1SJQ90=
+github.com/coder/serpent v0.11.0/go.mod h1:cZFW6/fP+kE9nd/oRkEHJpG6sXCtQ+AX7WMMEHv0Y3Q=
 github.com/coder/ssh v0.0.0-20231128192721-70855dedb788 h1:YoUSJ19E8AtuUFVYBpXuOD6a/zVP3rcxezNsoDseTUw=
 github.com/coder/ssh v0.0.0-20231128192721-70855dedb788/go.mod h1:aGQbuCLyhRLMzZF067xc84Lh7JDs1FKwCmF1Crl9dxQ=
 github.com/coder/tailscale v1.1.1-0.20250829055706-6eafe0f9199e h1:9RKGKzGLHtTvVBQublzDGtCtal3cXP13diCHoAIGPeI=
@@ -1520,8 +1520,8 @@ github.com/leodido/go-urn v1.4.0 h1:WT9HwE9SGECu3lg4d/dIA+jxlljEa1/ffXKmRjqdmIQ=
 github.com/leodido/go-urn v1.4.0/go.mod h1:bvxc+MVxLKB4z00jd1z+Dvzr47oO32F/QSNjSBOlFxI=
 github.com/liamg/memoryfs v1.6.0 h1:jAFec2HI1PgMTem5gR7UT8zi9u4BfG5jorCRlLH06W8=
 github.com/liamg/memoryfs v1.6.0/go.mod h1:z7mfqXFQS8eSeBBsFjYLlxYRMRyiPktytvYCYTb3BSk=
-github.com/lucasb-eyer/go-colorful v1.2.0 h1:1nnpGOrhyZZuNyfu1QjKiUICQ74+3FNCN69Aj6K7nkY=
-github.com/lucasb-eyer/go-colorful v1.2.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
+github.com/lucasb-eyer/go-colorful v1.3.0 h1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=
+github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0=
 github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35 h1:PpXWgLPs+Fqr325bN2FD2ISlRRztXibcX6e8f5FR5Dc=
 github.com/lufia/plan9stats v0.0.0-20250317134145-8bc96cf8fc35/go.mod h1:autxFIvghDt3jPTLoqZ9OZ7s9qTGNAWmYCjVFWPX/zg=
 github.com/lyft/protoc-gen-star v0.6.0/go.mod h1:TGAoBVkt8w7MPG72TrKIu85MIdXwDuzJYeZuUPFPNwA=
@@ -1776,8 +1776,8 @@ github.com/spaolacci/murmur3 v1.1.0/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2
 github.com/spf13/cast v1.10.0 h1:h2x0u2shc1QuLHfxi+cTJvs30+ZAHOGRic8uyGTDWxY=
 github.com/spf13/cast v1.10.0/go.mod h1:jNfB8QC9IA6ZuY2ZjDp0KtFO2LZZlg4S/7bzP6qqeHo=
 github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqqNjLnInEg4=
-github.com/spf13/pflag v1.0.7 h1:vN6T9TfwStFPFM5XzjsvmzZkLuaLX+HS+0SeFLRgU6M=
-github.com/spf13/pflag v1.0.7/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
+github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
 github.com/spiffe/go-spiffe/v2 v2.5.0/go.mod h1:P+NxobPc6wXhVtINNtFjNWGBTreew1GBUCwT2wPmb7g=
 github.com/sqlc-dev/pqtype v0.3.0 h1:b09TewZ3cSnO5+M1Kqq05y0+OjqIptxELaSayg7bmqk=
@@ -2069,8 +2069,8 @@ golang.org/x/exp v0.0.0-20200119233911-0405dc783f0a/go.mod h1:2RIsYlXP63K8oxa1u0
 golang.org/x/exp v0.0.0-20200207192155-f17229e696bd/go.mod h1:J/WKrq2StrnmMY6+EHIKF9dgMWnmCNThgcyBT1FY9mM=
 golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6/go.mod h1:3jZMyOhIsHpP37uCMkUooju7aAi5cS1Q23tOzKc+0MU=
 golang.org/x/exp v0.0.0-20220827204233-334a2380cb91/go.mod h1:cyybsKvd6eL0RnXn6p/Grxp8F5bW7iYuBgsNCOHpMYE=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621 h1:2id6c1/gto0kaHYyrixvknJ8tUK/Qs5IsmBtrc+FtgU=
-golang.org/x/exp v0.0.0-20250911091902-df9299821621/go.mod h1:TwQYMMnGpvZyc+JpB/UAuTNIsVJifOlSkrZkhcvpVUk=
+golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY=
+golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70=
 golang.org/x/image v0.0.0-20180708004352-c73c2afc3b81/go.mod h1:ux5Hcp/YLpHSI86hEcLt0YII63i6oz57MZXIpbrjZUs=
 golang.org/x/image v0.0.0-20190227222117-0694c2d4d067/go.mod h1:kZ7UVZpmo3dzQBMxlp+ypCbDeSB+sBbTgSJuh5dn5js=
 golang.org/x/image v0.0.0-20190802002840-cff245a6509b/go.mod h1:FeLwcggjj3mMvU+oOTbSwawSJRM1uh48EjtB4UJZlP0=

From 5a31c590e6c2420efdba3047b46d81f23836e0c8 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Fri, 24 Oct 2025 09:43:48 +0100
Subject: [PATCH 229/298] fix(coderd/provisionerdserver): pipe through task id
 and prompt (#20408)

Pipes through the Task's ID and prompt into the provisioner. This is
required to support the new `coder_ai_task.prompt` field and modified
`coder_ai_task.id` field.
---
 coderd/provisionerdserver/provisionerdserver.go   | 15 ++++++---------
 .../provisionerdserver/provisionerdserver_test.go | 12 ++++++++++++
 2 files changed, 18 insertions(+), 9 deletions(-)

diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
index 8e07eb4dc5e3c..bf7741bdc260f 100644
--- a/coderd/provisionerdserver/provisionerdserver.go
+++ b/coderd/provisionerdserver/provisionerdserver.go
@@ -597,13 +597,10 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 			return nil, failJob(fmt.Sprintf("get workspace build parameters: %s", err))
 		}
 
-		// TODO(DanielleMaywood):
-		// Plumb a task prompt into this when we have the new data-model ready
-		var taskPrompt string
-
-		// TODO(DanielleMaywood):
-		// Plumb a task ID into this when we have the new data-model ready
-		var taskID string
+		task, err := s.Database.GetTaskByWorkspaceID(ctx, workspaceBuild.WorkspaceID)
+		if err != nil && !errors.Is(err, sql.ErrNoRows) {
+			return nil, xerrors.Errorf("get task by workspace id: %w", err)
+		}
 
 		dbExternalAuthProviders := []database.ExternalAuthProvider{}
 		err = json.Unmarshal(templateVersion.ExternalAuthProviders, &dbExternalAuthProviders)
@@ -729,8 +726,8 @@ func (s *server) acquireProtoJob(ctx context.Context, job database.ProvisionerJo
 					WorkspaceOwnerRbacRoles:       ownerRbacRoles,
 					RunningAgentAuthTokens:        runningAgentAuthTokens,
 					PrebuiltWorkspaceBuildStage:   input.PrebuiltWorkspaceBuildStage,
-					TaskId:                        taskID,
-					TaskPrompt:                    taskPrompt,
+					TaskId:                        task.ID.String(),
+					TaskPrompt:                    task.Prompt,
 				},
 				LogLevel: input.LogLevel,
 			},
diff --git a/coderd/provisionerdserver/provisionerdserver_test.go b/coderd/provisionerdserver/provisionerdserver_test.go
index 6cd490190b502..8d55e1529289f 100644
--- a/coderd/provisionerdserver/provisionerdserver_test.go
+++ b/coderd/provisionerdserver/provisionerdserver_test.go
@@ -334,6 +334,16 @@ func TestAcquireJob(t *testing.T) {
 					Transition:        database.WorkspaceTransitionStart,
 					Reason:            database.BuildReasonInitiator,
 				})
+				task := dbgen.Task(t, db, database.TaskTable{
+					OrganizationID:     pd.OrganizationID,
+					OwnerID:            user.ID,
+					WorkspaceID:        uuid.NullUUID{Valid: true, UUID: workspace.ID},
+					TemplateVersionID:  version.ID,
+					TemplateParameters: json.RawMessage("{}"),
+					Prompt:             "Build me a REST API",
+					CreatedAt:          dbtime.Now(),
+					DeletedAt:          sql.NullTime{},
+				})
 
 				var agent database.WorkspaceAgent
 				if prebuiltWorkspaceBuildStage == sdkproto.PrebuiltWorkspaceBuildStage_CLAIM {
@@ -446,6 +456,8 @@ func TestAcquireJob(t *testing.T) {
 					WorkspaceBuildId:              build.ID.String(),
 					WorkspaceOwnerLoginType:       string(user.LoginType),
 					WorkspaceOwnerRbacRoles:       []*sdkproto.Role{{Name: rbac.RoleOrgMember(), OrgId: pd.OrganizationID.String()}, {Name: "member", OrgId: ""}, {Name: rbac.RoleOrgAuditor(), OrgId: pd.OrganizationID.String()}},
+					TaskId:                        task.ID.String(),
+					TaskPrompt:                    task.Prompt,
 				}
 				if prebuiltWorkspaceBuildStage == sdkproto.PrebuiltWorkspaceBuildStage_CLAIM {
 					// For claimed prebuilds, we expect the prebuild state to be set to CLAIM

From 40e1784846b6e2a847db03b6a23c867a4027cd97 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Fri, 24 Oct 2025 10:44:46 +0200
Subject: [PATCH 230/298] feat(provisioner): warn when .terraform.lock.hcl is
 modified during init (#20451)

Fixes: https://github.com/coder/coder/pull/20451
---
 provisioner/terraform/executor.go             | 30 ++++++++++++-
 .../terraform/executor_internal_test.go       | 45 +++++++++++++++++++
 2 files changed, 74 insertions(+), 1 deletion(-)

diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
index 8940a1708bf19..67922d0ffbd48 100644
--- a/provisioner/terraform/executor.go
+++ b/provisioner/terraform/executor.go
@@ -6,6 +6,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"hash/crc32"
 	"io"
 	"os"
 	"os/exec"
@@ -220,6 +221,10 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 	e.mut.Lock()
 	defer e.mut.Unlock()
 
+	// Record lock file checksum before init
+	lockFilePath := filepath.Join(e.workdir, ".terraform.lock.hcl")
+	preInitChecksum := checksumFileCRC32(ctx, e.logger, lockFilePath)
+
 	outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
 	errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
 	defer func() {
@@ -246,7 +251,30 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 			return &textFileBusyError{exitErr: exitErr, stderr: errBuf.b.String()}
 		}
 	}
-	return err
+	if err != nil {
+		return err
+	}
+
+	// Check if lock file was modified
+	postInitChecksum := checksumFileCRC32(ctx, e.logger, lockFilePath)
+	if preInitChecksum != 0 && postInitChecksum != 0 && preInitChecksum != postInitChecksum {
+		e.logger.Warn(ctx, fmt.Sprintf(".terraform.lock.hcl was modified during init. This means provider hashes "+
+			"are missing for the current platform (%s_%s). Update the lock file with:\n\n"+
+			"  terraform providers lock -platform=linux_amd64 -platform=linux_arm64 "+
+			"-platform=darwin_amd64 -platform=darwin_arm64 -platform=windows_amd64\n",
+			runtime.GOOS, runtime.GOARCH),
+		)
+	}
+	return nil
+}
+
+func checksumFileCRC32(ctx context.Context, logger slog.Logger, path string) uint32 {
+	content, err := os.ReadFile(path)
+	if err != nil {
+		logger.Debug(ctx, "file %s does not exist or can't be read, skip checksum calculation")
+		return 0
+	}
+	return crc32.ChecksumIEEE(content)
 }
 
 func getPlanFilePath(workdir string) string {
diff --git a/provisioner/terraform/executor_internal_test.go b/provisioner/terraform/executor_internal_test.go
index a39d8758893b8..04d57a1e4c9f1 100644
--- a/provisioner/terraform/executor_internal_test.go
+++ b/provisioner/terraform/executor_internal_test.go
@@ -2,12 +2,14 @@ package terraform
 
 import (
 	"encoding/json"
+	"os"
 	"testing"
 
 	tfjson "github.com/hashicorp/terraform-json"
 	"github.com/stretchr/testify/require"
 
 	"github.com/coder/coder/v2/provisionersdk/proto"
+	"github.com/coder/coder/v2/testutil"
 )
 
 type mockLogger struct {
@@ -171,3 +173,46 @@ func TestOnlyDataResources(t *testing.T) {
 		})
 	}
 }
+
+func TestChecksumFileCRC32(t *testing.T) {
+	t.Parallel()
+
+	t.Run("file exists", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		logger := testutil.Logger(t)
+
+		tmpfile, err := os.CreateTemp("", "lockfile-*.hcl")
+		require.NoError(t, err)
+		defer os.Remove(tmpfile.Name())
+
+		content := []byte("provider \"aws\" { version = \"5.0.0\" }")
+		_, err = tmpfile.Write(content)
+		require.NoError(t, err)
+		tmpfile.Close()
+
+		// Calculate checksum - expected value for this specific content
+		expectedChecksum := uint32(0x08f39f51)
+		checksum := checksumFileCRC32(ctx, logger, tmpfile.Name())
+		require.Equal(t, expectedChecksum, checksum)
+
+		// Modify file
+		err = os.WriteFile(tmpfile.Name(), []byte("modified content"), 0o600)
+		require.NoError(t, err)
+
+		// Checksum should be different
+		modifiedChecksum := checksumFileCRC32(ctx, logger, tmpfile.Name())
+		require.NotEqual(t, expectedChecksum, modifiedChecksum)
+	})
+
+	t.Run("file does not exist", func(t *testing.T) {
+		t.Parallel()
+
+		ctx := testutil.Context(t, testutil.WaitShort)
+		logger := testutil.Logger(t)
+
+		checksum := checksumFileCRC32(ctx, logger, "/nonexistent/file.hcl")
+		require.Zero(t, checksum)
+	})
+}

From e8e31dcb2cd7e6c1e184268bbdccf24be30a003b Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Fri, 24 Oct 2025 12:38:47 +0300
Subject: [PATCH 231/298] fix(cli): use correct task status in list/status
 output (#20453)

---
 cli/cliui/table.go          | 27 +++++++++-----
 cli/cliui/table_test.go     | 72 +++++++++++++++++++++++++++++++++++++
 cli/exp_task_list_test.go   | 16 ++++-----
 cli/exp_task_status.go      | 33 +++++++++--------
 cli/exp_task_status_test.go | 14 ++++----
 cli/exp_task_test.go        |  3 +-
 codersdk/aitasks.go         |  6 ++--
 7 files changed, 127 insertions(+), 44 deletions(-)

diff --git a/cli/cliui/table.go b/cli/cliui/table.go
index 478bbe2260f91..c82854802224d 100644
--- a/cli/cliui/table.go
+++ b/cli/cliui/table.go
@@ -296,22 +296,23 @@ func renderTable(out any, sort string, headers table.Row, filterColumns []string
 // returned. If the table tag is malformed, an error is returned.
 //
 // The returned name is transformed from "snake_case" to "normal text".
-func parseTableStructTag(field reflect.StructField) (name string, defaultSort, noSortOpt, recursive, skipParentName bool, err error) {
+func parseTableStructTag(field reflect.StructField) (name string, defaultSort, noSortOpt, recursive, skipParentName, emptyNil bool, err error) {
 	tags, err := structtag.Parse(string(field.Tag))
 	if err != nil {
-		return "", false, false, false, false, xerrors.Errorf("parse struct field tag %q: %w", string(field.Tag), err)
+		return "", false, false, false, false, false, xerrors.Errorf("parse struct field tag %q: %w", string(field.Tag), err)
 	}
 
 	tag, err := tags.Get("table")
 	if err != nil || tag.Name == "-" {
 		// tags.Get only returns an error if the tag is not found.
-		return "", false, false, false, false, nil
+		return "", false, false, false, false, false, nil
 	}
 
 	defaultSortOpt := false
 	noSortOpt = false
 	recursiveOpt := false
 	skipParentNameOpt := false
+	emptyNilOpt := false
 	for _, opt := range tag.Options {
 		switch opt {
 		case "default_sort":
@@ -326,12 +327,14 @@ func parseTableStructTag(field reflect.StructField) (name string, defaultSort, n
 			// make sure the child name is unique across all nested structs in the parent.
 			recursiveOpt = true
 			skipParentNameOpt = true
+		case "empty_nil":
+			emptyNilOpt = true
 		default:
-			return "", false, false, false, false, xerrors.Errorf("unknown option %q in struct field tag", opt)
+			return "", false, false, false, false, false, xerrors.Errorf("unknown option %q in struct field tag", opt)
 		}
 	}
 
-	return strings.ReplaceAll(tag.Name, "_", " "), defaultSortOpt, noSortOpt, recursiveOpt, skipParentNameOpt, nil
+	return strings.ReplaceAll(tag.Name, "_", " "), defaultSortOpt, noSortOpt, recursiveOpt, skipParentNameOpt, emptyNilOpt, nil
 }
 
 func isStructOrStructPointer(t reflect.Type) bool {
@@ -358,7 +361,7 @@ func typeToTableHeaders(t reflect.Type, requireDefault bool) ([]string, string,
 	noSortOpt := false
 	for i := 0; i < t.NumField(); i++ {
 		field := t.Field(i)
-		name, defaultSort, noSort, recursive, skip, err := parseTableStructTag(field)
+		name, defaultSort, noSort, recursive, skip, _, err := parseTableStructTag(field)
 		if err != nil {
 			return nil, "", xerrors.Errorf("parse struct tags for field %q in type %q: %w", field.Name, t.String(), err)
 		}
@@ -435,7 +438,7 @@ func valueToTableMap(val reflect.Value) (map[string]any, error) {
 	for i := 0; i < val.NumField(); i++ {
 		field := val.Type().Field(i)
 		fieldVal := val.Field(i)
-		name, _, _, recursive, skip, err := parseTableStructTag(field)
+		name, _, _, recursive, skip, emptyNil, err := parseTableStructTag(field)
 		if err != nil {
 			return nil, xerrors.Errorf("parse struct tags for field %q in type %T: %w", field.Name, val, err)
 		}
@@ -443,8 +446,14 @@ func valueToTableMap(val reflect.Value) (map[string]any, error) {
 			continue
 		}
 
-		// Recurse if it's a struct.
 		fieldType := field.Type
+
+		// If empty_nil is set and this is a nil pointer, use a zero value.
+		if emptyNil && fieldVal.Kind() == reflect.Pointer && fieldVal.IsNil() {
+			fieldVal = reflect.New(fieldType.Elem())
+		}
+
+		// Recurse if it's a struct.
 		if recursive {
 			if !isStructOrStructPointer(fieldType) {
 				return nil, xerrors.Errorf("field %q in type %q is marked as recursive but does not contain a struct or a pointer to a struct", field.Name, fieldType.String())
@@ -467,7 +476,7 @@ func valueToTableMap(val reflect.Value) (map[string]any, error) {
 		}
 
 		// Otherwise, we just use the field value.
-		row[name] = val.Field(i).Interface()
+		row[name] = fieldVal.Interface()
 	}
 
 	return row, nil
diff --git a/cli/cliui/table_test.go b/cli/cliui/table_test.go
index 4e82707f3fec8..424b9c9a7d6f3 100644
--- a/cli/cliui/table_test.go
+++ b/cli/cliui/table_test.go
@@ -400,6 +400,78 @@ foo   <nil>      10  [a, b, c]  foo1               11  foo2        12         fo
 			})
 		})
 	})
+
+	t.Run("EmptyNil", func(t *testing.T) {
+		t.Parallel()
+
+		type emptyNilTest struct {
+			Name           string  `table:"name,default_sort"`
+			EmptyOnNil     *string `table:"empty_on_nil,empty_nil"`
+			NormalBehavior *string `table:"normal_behavior"`
+		}
+
+		value := "value"
+		in := []emptyNilTest{
+			{
+				Name:           "has_value",
+				EmptyOnNil:     &value,
+				NormalBehavior: &value,
+			},
+			{
+				Name:           "has_nil",
+				EmptyOnNil:     nil,
+				NormalBehavior: nil,
+			},
+		}
+
+		expected := `
+NAME       EMPTY ON NIL  NORMAL BEHAVIOR
+has_nil                  <nil>
+has_value  value         value
+		`
+
+		out, err := cliui.DisplayTable(in, "", nil)
+		log.Println("rendered table:\n" + out)
+		require.NoError(t, err)
+		compareTables(t, expected, out)
+	})
+
+	t.Run("EmptyNilWithRecursiveInline", func(t *testing.T) {
+		t.Parallel()
+
+		type nestedData struct {
+			Name string `table:"name"`
+		}
+
+		type inlineTest struct {
+			Nested *nestedData `table:"ignored,recursive_inline,empty_nil"`
+			Count  int         `table:"count,default_sort"`
+		}
+
+		in := []inlineTest{
+			{
+				Nested: &nestedData{
+					Name: "alice",
+				},
+				Count: 1,
+			},
+			{
+				Nested: nil,
+				Count:  2,
+			},
+		}
+
+		expected := `
+NAME   COUNT
+alice  1
+       2
+		`
+
+		out, err := cliui.DisplayTable(in, "", nil)
+		log.Println("rendered table:\n" + out)
+		require.NoError(t, err)
+		compareTables(t, expected, out)
+	})
 }
 
 // compareTables normalizes the incoming table lines
diff --git a/cli/exp_task_list_test.go b/cli/exp_task_list_test.go
index d1e0862dc793b..d297310dc4fc3 100644
--- a/cli/exp_task_list_test.go
+++ b/cli/exp_task_list_test.go
@@ -162,7 +162,7 @@ func TestExpTaskList(t *testing.T) {
 
 		// Validate the table includes the task and status.
 		pty.ExpectMatch(task.Name)
-		pty.ExpectMatch("running")
+		pty.ExpectMatch("initializing")
 		pty.ExpectMatch(wantPrompt)
 	})
 
@@ -175,9 +175,9 @@ func TestExpTaskList(t *testing.T) {
 		owner := coderdtest.CreateFirstUser(t, client)
 		memberClient, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
-		// Create two AI tasks: one running, one stopped.
-		runningTask := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "keep me running")
-		stoppedTask := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStop, "stop me please")
+		// Create two AI tasks: one initializing, one paused.
+		initializingTask := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "keep me initializing")
+		pausedTask := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStop, "stop me please")
 
 		// Use JSON output to reliably validate filtering.
 		inv, root := clitest.New(t, "exp", "task", "list", "--status=paused", "--output=json")
@@ -194,10 +194,10 @@ func TestExpTaskList(t *testing.T) {
 		var tasks []codersdk.Task
 		require.NoError(t, json.Unmarshal(stdout.Bytes(), &tasks))
 
-		// Only the stopped task is returned.
+		// Only the paused task is returned.
 		require.Len(t, tasks, 1, "expected one task after filtering")
-		require.Equal(t, stoppedTask.ID, tasks[0].ID)
-		require.NotEqual(t, runningTask.ID, tasks[0].ID)
+		require.Equal(t, pausedTask.ID, tasks[0].ID)
+		require.NotEqual(t, initializingTask.ID, tasks[0].ID)
 	})
 
 	t.Run("UserFlag_Me_Table", func(t *testing.T) {
@@ -234,7 +234,7 @@ func TestExpTaskList(t *testing.T) {
 		memberClient, memberUser := coderdtest.CreateAnotherUser(t, client, owner.OrganizationID)
 
 		// Given: We have two tasks
-		task1 := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "keep me running")
+		task1 := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStart, "keep me active")
 		task2 := makeAITask(t, db, owner.OrganizationID, owner.UserID, memberUser.ID, database.WorkspaceTransitionStop, "stop me please")
 
 		// Given: We add the `--quiet` flag
diff --git a/cli/exp_task_status.go b/cli/exp_task_status.go
index f34812657a964..1bd77f5f7f5b3 100644
--- a/cli/exp_task_status.go
+++ b/cli/exp_task_status.go
@@ -156,28 +156,21 @@ func taskWatchIsEnded(task codersdk.Task) bool {
 }
 
 type taskStatusRow struct {
-	codersdk.Task `table:"-"`
-	ChangedAgo    string    `json:"-" table:"state changed,default_sort"`
-	Timestamp     time.Time `json:"-" table:"-"`
-	TaskStatus    string    `json:"-" table:"status"`
-	Healthy       bool      `json:"-" table:"healthy"`
-	TaskState     string    `json:"-" table:"state"`
-	Message       string    `json:"-" table:"message"`
+	codersdk.Task `table:"r,recursive_inline"`
+	ChangedAgo    string `json:"-" table:"state changed"`
+	Healthy       bool   `json:"-" table:"healthy"`
 }
 
 func taskStatusRowEqual(r1, r2 taskStatusRow) bool {
-	return r1.TaskStatus == r2.TaskStatus &&
+	return r1.Status == r2.Status &&
 		r1.Healthy == r2.Healthy &&
-		r1.TaskState == r2.TaskState &&
-		r1.Message == r2.Message
+		taskStateEqual(r1.CurrentState, r2.CurrentState)
 }
 
 func toStatusRow(task codersdk.Task) taskStatusRow {
 	tsr := taskStatusRow{
 		Task:       task,
 		ChangedAgo: time.Since(task.UpdatedAt).Truncate(time.Second).String() + " ago",
-		Timestamp:  task.UpdatedAt,
-		TaskStatus: string(task.WorkspaceStatus),
 	}
 	tsr.Healthy = task.WorkspaceAgentHealth != nil &&
 		task.WorkspaceAgentHealth.Healthy &&
@@ -187,9 +180,19 @@ func toStatusRow(task codersdk.Task) taskStatusRow {
 
 	if task.CurrentState != nil {
 		tsr.ChangedAgo = time.Since(task.CurrentState.Timestamp).Truncate(time.Second).String() + " ago"
-		tsr.Timestamp = task.CurrentState.Timestamp
-		tsr.TaskState = string(task.CurrentState.State)
-		tsr.Message = task.CurrentState.Message
 	}
 	return tsr
 }
+
+func taskStateEqual(se1, se2 *codersdk.TaskStateEntry) bool {
+	var s1, m1, s2, m2 string
+	if se1 != nil {
+		s1 = string(se1.State)
+		m1 = se1.Message
+	}
+	if se2 != nil {
+		s2 = string(se2.State)
+		m2 = se2.Message
+	}
+	return s1 == s2 && m1 == m2
+}
diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index 01b2a8379d6bd..ae6f1db29d8c7 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -55,8 +55,8 @@ func Test_TaskStatus(t *testing.T) {
 		},
 		{
 			args: []string{"exists"},
-			expectOutput: `STATE CHANGED  STATUS   HEALTHY  STATE    MESSAGE
-0s ago         running  true     working  Thinking furiously...`,
+			expectOutput: `STATE CHANGED  STATUS  HEALTHY  STATE    MESSAGE
+0s ago         active  true     working  Thinking furiously...`,
 			hf: func(ctx context.Context, now time.Time) func(w http.ResponseWriter, r *http.Request) {
 				return func(w http.ResponseWriter, r *http.Request) {
 					switch r.URL.Path {
@@ -114,12 +114,12 @@ func Test_TaskStatus(t *testing.T) {
 		},
 		{
 			args: []string{"exists", "--watch"},
-			expectOutput: `
-STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
+			expectOutput: `STATE CHANGED  STATUS   HEALTHY  STATE  MESSAGE
 5s ago         pending  true
-4s ago         running  true
-3s ago         running  true     working  Reticulating splines...
-2s ago         running  true     complete  Splines reticulated successfully!`,
+4s ago         initializing  true
+4s ago         active  true
+3s ago         active  true     working  Reticulating splines...
+2s ago         active  true     complete  Splines reticulated successfully!`,
 			hf: func(ctx context.Context, now time.Time) func(http.ResponseWriter, *http.Request) {
 				var calls atomic.Int64
 				return func(w http.ResponseWriter, r *http.Request) {
diff --git a/cli/exp_task_test.go b/cli/exp_task_test.go
index 82457ec748763..d2d3728aeb280 100644
--- a/cli/exp_task_test.go
+++ b/cli/exp_task_test.go
@@ -94,8 +94,7 @@ func Test_Tasks(t *testing.T) {
 				var task codersdk.Task
 				require.NoError(t, json.NewDecoder(strings.NewReader(stdout)).Decode(&task), "should unmarshal task status")
 				require.Equal(t, task.Name, taskName, "task name should match")
-				// NOTE: task status changes type, this is so this test works with both old and new model
-				require.Contains(t, []string{"active", "running"}, string(task.Status), "task should be active")
+				require.Equal(t, codersdk.TaskStatusActive, task.Status, "task should be active")
 			},
 		},
 		{
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index 318caa3d17484..bf55cd6eda5f3 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -163,15 +163,15 @@ type Task struct {
 	TemplateDisplayName     string                   `json:"template_display_name" table:"template display name"`
 	TemplateIcon            string                   `json:"template_icon" table:"template icon"`
 	WorkspaceID             uuid.NullUUID            `json:"workspace_id" format:"uuid" table:"workspace id"`
-	WorkspaceStatus         WorkspaceStatus          `json:"workspace_status,omitempty" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"status"`
+	WorkspaceStatus         WorkspaceStatus          `json:"workspace_status,omitempty" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"workspace status"`
 	WorkspaceBuildNumber    int32                    `json:"workspace_build_number,omitempty" table:"workspace build number"`
 	WorkspaceAgentID        uuid.NullUUID            `json:"workspace_agent_id" format:"uuid" table:"workspace agent id"`
 	WorkspaceAgentLifecycle *WorkspaceAgentLifecycle `json:"workspace_agent_lifecycle" table:"workspace agent lifecycle"`
 	WorkspaceAgentHealth    *WorkspaceAgentHealth    `json:"workspace_agent_health" table:"workspace agent health"`
 	WorkspaceAppID          uuid.NullUUID            `json:"workspace_app_id" format:"uuid" table:"workspace app id"`
 	InitialPrompt           string                   `json:"initial_prompt" table:"initial prompt"`
-	Status                  TaskStatus               `json:"status" enums:"pending,initializing,active,paused,unknown,error" table:"task status"`
-	CurrentState            *TaskStateEntry          `json:"current_state" table:"cs,recursive_inline"`
+	Status                  TaskStatus               `json:"status" enums:"pending,initializing,active,paused,unknown,error" table:"status"`
+	CurrentState            *TaskStateEntry          `json:"current_state" table:"cs,recursive_inline,empty_nil"`
 	CreatedAt               time.Time                `json:"created_at" format:"date-time" table:"created at"`
 	UpdatedAt               time.Time                `json:"updated_at" format:"date-time" table:"updated at"`
 }

From e60112e54fc6a7988da80ad91ba62ffceebdd53d Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Fri, 24 Oct 2025 10:57:32 +0100
Subject: [PATCH 232/298] chore(coderd): introduce TaskAppID and deprecate
 AITaskSidebarAppID (#20336)

As we're moving away from the SidebarAppID nomenclature, this PR
introduces a new `TaskAppID` field to `codersdk.WorkspaceBuild` and
deprecates the `AITaskSidebarAppID` field. They both contain the same
value.
---
 coderd/aitasks.go                            | 10 +++++-----
 coderd/apidoc/docs.go                        |  5 +++++
 coderd/apidoc/swagger.json                   |  5 +++++
 coderd/workspacebuilds.go                    |  7 ++++---
 codersdk/workspacebuilds.go                  |  6 ++++--
 docs/reference/api/builds.md                 |  8 +++++++-
 docs/reference/api/schemas.md                |  6 +++++-
 docs/reference/api/workspaces.md             |  6 ++++++
 site/src/api/typesGenerated.ts               |  4 ++++
 site/src/pages/TaskPage/TaskApps.tsx         |  2 +-
 site/src/pages/TaskPage/TaskPage.stories.tsx |  4 ++--
 site/src/pages/TaskPage/TaskPage.tsx         |  2 +-
 12 files changed, 49 insertions(+), 16 deletions(-)

diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 272bdba9c1048..0ad1bffc30e2d 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -635,9 +635,9 @@ func (api *API) taskDelete(rw http.ResponseWriter, r *http.Request) {
 // @Router /api/experimental/tasks/{user}/{task}/send [post]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
-// taskSend submits task input to the tasks sidebar app by dialing the agent
+// taskSend submits task input to the task app by dialing the agent
 // directly over the tailnet. We enforce ApplicationConnect RBAC on the
-// workspace and validate the sidebar app health.
+// workspace and validate the task app health.
 func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	task := httpmw.TaskParam(r)
@@ -709,7 +709,7 @@ func (api *API) taskSend(rw http.ResponseWriter, r *http.Request) {
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
 // taskLogs reads task output by dialing the agent directly over the tailnet.
-// We enforce ApplicationConnect RBAC on the workspace and validate the sidebar app health.
+// We enforce ApplicationConnect RBAC on the workspace and validate the task app health.
 func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	task := httpmw.TaskParam(r)
@@ -767,7 +767,7 @@ func (api *API) taskLogs(rw http.ResponseWriter, r *http.Request) {
 //
 //   - Fetch the task workspace
 //   - Authorize ApplicationConnect on the workspace
-//   - Validate the AI task and sidebar app health
+//   - Validate the AI task and task app health
 //   - Dial the agent and construct an HTTP client to the apps loopback URL
 //
 // The provided callback receives the context, an HTTP client that dials via the
@@ -832,7 +832,7 @@ func (api *API) authAndDoWithTaskAppClient(
 	appURL := app.Url.String
 	if appURL == "" {
 		return httperror.NewResponseError(http.StatusInternalServerError, codersdk.Response{
-			Message: "Task sidebar app URL is not configured.",
+			Message: "Task app URL is not configured.",
 		})
 	}
 	parsedURL, err := url.Parse(appURL)
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 7dc3f969fa879..d3ad637f7dc4b 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -20462,6 +20462,7 @@ const docTemplate = `{
             "type": "object",
             "properties": {
                 "ai_task_sidebar_app_id": {
+                    "description": "Deprecated: This field has been replaced with ` + "`" + `TaskAppID` + "`" + `",
                     "type": "string",
                     "format": "uuid"
                 },
@@ -20543,6 +20544,10 @@ const docTemplate = `{
                         }
                     ]
                 },
+                "task_app_id": {
+                    "type": "string",
+                    "format": "uuid"
+                },
                 "template_version_id": {
                     "type": "string",
                     "format": "uuid"
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index a1b00293be3f0..21468a92f6187 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -18796,6 +18796,7 @@
 			"type": "object",
 			"properties": {
 				"ai_task_sidebar_app_id": {
+					"description": "Deprecated: This field has been replaced with `TaskAppID`",
 					"type": "string",
 					"format": "uuid"
 				},
@@ -18873,6 +18874,10 @@
 						}
 					]
 				},
+				"task_app_id": {
+					"type": "string",
+					"format": "uuid"
+				},
 				"template_version_id": {
 					"type": "string",
 					"format": "uuid"
diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go
index b6409d8ed781d..1e3020376041b 100644
--- a/coderd/workspacebuilds.go
+++ b/coderd/workspacebuilds.go
@@ -1181,9 +1181,9 @@ func (api *API) convertWorkspaceBuild(
 	if build.HasAITask.Valid {
 		hasAITask = &build.HasAITask.Bool
 	}
-	var aiTasksSidebarAppID *uuid.UUID
+	var taskAppID *uuid.UUID
 	if build.AITaskSidebarAppID.Valid {
-		aiTasksSidebarAppID = &build.AITaskSidebarAppID.UUID
+		taskAppID = &build.AITaskSidebarAppID.UUID
 	}
 
 	var hasExternalAgent *bool
@@ -1218,7 +1218,8 @@ func (api *API) convertWorkspaceBuild(
 		MatchedProvisioners:     &matchedProvisioners,
 		TemplateVersionPresetID: presetID,
 		HasAITask:               hasAITask,
-		AITaskSidebarAppID:      aiTasksSidebarAppID,
+		AITaskSidebarAppID:      taskAppID,
+		TaskAppID:               taskAppID,
 		HasExternalAgent:        hasExternalAgent,
 	}, nil
 }
diff --git a/codersdk/workspacebuilds.go b/codersdk/workspacebuilds.go
index bb9511178c7f4..fee4c114b7eae 100644
--- a/codersdk/workspacebuilds.go
+++ b/codersdk/workspacebuilds.go
@@ -89,8 +89,10 @@ type WorkspaceBuild struct {
 	MatchedProvisioners     *MatchedProvisioners `json:"matched_provisioners,omitempty"`
 	TemplateVersionPresetID *uuid.UUID           `json:"template_version_preset_id" format:"uuid"`
 	HasAITask               *bool                `json:"has_ai_task,omitempty"`
-	AITaskSidebarAppID      *uuid.UUID           `json:"ai_task_sidebar_app_id,omitempty" format:"uuid"`
-	HasExternalAgent        *bool                `json:"has_external_agent,omitempty"`
+	// Deprecated: This field has been replaced with `TaskAppID`
+	AITaskSidebarAppID *uuid.UUID `json:"ai_task_sidebar_app_id,omitempty" format:"uuid"`
+	TaskAppID          *uuid.UUID `json:"task_app_id,omitempty" format:"uuid"`
+	HasExternalAgent   *bool      `json:"has_external_agent,omitempty"`
 }
 
 // WorkspaceResource describes resources used to create a workspace, for instance:
diff --git a/docs/reference/api/builds.md b/docs/reference/api/builds.md
index 41df0b9efaf30..ea207f84eab39 100644
--- a/docs/reference/api/builds.md
+++ b/docs/reference/api/builds.md
@@ -222,6 +222,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
     }
   ],
   "status": "pending",
+  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -463,6 +464,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
     }
   ],
   "status": "pending",
+  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1195,6 +1197,7 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
     }
   ],
   "status": "pending",
+  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1509,6 +1512,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1536,7 +1540,7 @@ Status Code **200**
 | Name                             | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
 |----------------------------------|--------------------------------------------------------------------------------------------------------|----------|--------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `[array item]`                   | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `» ai_task_sidebar_app_id`       | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
+| `» ai_task_sidebar_app_id`       | string(uuid)                                                                                           | false    |              | Deprecated: This field has been replaced with `TaskAppID`                                                                                                                                                                                      |
 | `» build_number`                 | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
 | `» created_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
 | `» daily_cost`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
@@ -1687,6 +1691,7 @@ Status Code **200**
 | `»» type`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
 | `»» workspace_transition`        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
 | `» status`                       | [codersdk.WorkspaceStatus](schemas.md#codersdkworkspacestatus)                                         | false    |              |                                                                                                                                                                                                                                                |
+| `» task_app_id`                  | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
 | `» template_version_id`          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
 | `» template_version_name`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
 | `» template_version_preset_id`   | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
@@ -2008,6 +2013,7 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
     }
   ],
   "status": "pending",
+  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 3bdf92a119fb1..88d295d53e79d 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -10074,6 +10074,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -11243,6 +11244,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     }
   ],
   "status": "pending",
+  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -11260,7 +11262,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 | Name                         | Type                                                              | Required | Restrictions | Description                                                         |
 |------------------------------|-------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------|
-| `ai_task_sidebar_app_id`     | string                                                            | false    |              |                                                                     |
+| `ai_task_sidebar_app_id`     | string                                                            | false    |              | Deprecated: This field has been replaced with `TaskAppID`           |
 | `build_number`               | integer                                                           | false    |              |                                                                     |
 | `created_at`                 | string                                                            | false    |              |                                                                     |
 | `daily_cost`                 | integer                                                           | false    |              |                                                                     |
@@ -11276,6 +11278,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `reason`                     | [codersdk.BuildReason](#codersdkbuildreason)                      | false    |              |                                                                     |
 | `resources`                  | array of [codersdk.WorkspaceResource](#codersdkworkspaceresource) | false    |              |                                                                     |
 | `status`                     | [codersdk.WorkspaceStatus](#codersdkworkspacestatus)              | false    |              |                                                                     |
+| `task_app_id`                | string                                                            | false    |              |                                                                     |
 | `template_version_id`        | string                                                            | false    |              |                                                                     |
 | `template_version_name`      | string                                                            | false    |              |                                                                     |
 | `template_version_preset_id` | string                                                            | false    |              |                                                                     |
@@ -12065,6 +12068,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           }
         ],
         "status": "pending",
+        "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
         "template_version_name": "string",
         "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
diff --git a/docs/reference/api/workspaces.md b/docs/reference/api/workspaces.md
index 86c04f79c413c..91ab23f9260e9 100644
--- a/docs/reference/api/workspaces.md
+++ b/docs/reference/api/workspaces.md
@@ -277,6 +277,7 @@ of the template will be used.
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -568,6 +569,7 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -884,6 +886,7 @@ of the template will be used.
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1161,6 +1164,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
           }
         ],
         "status": "pending",
+        "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
         "template_version_name": "string",
         "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1453,6 +1457,7 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -2004,6 +2009,7 @@ curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/dormant \
       }
     ],
     "status": "pending",
+    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 7427ef006603a..cee71ca6a9243 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -6363,7 +6363,11 @@ export interface WorkspaceBuild {
 	readonly matched_provisioners?: MatchedProvisioners;
 	readonly template_version_preset_id: string | null;
 	readonly has_ai_task?: boolean;
+	/**
+	 * Deprecated: This field has been replaced with `TaskAppID`
+	 */
 	readonly ai_task_sidebar_app_id?: string;
+	readonly task_app_id?: string;
 	readonly has_external_agent?: boolean;
 }
 
diff --git a/site/src/pages/TaskPage/TaskApps.tsx b/site/src/pages/TaskPage/TaskApps.tsx
index 77d757b343243..4bc575cf06f2b 100644
--- a/site/src/pages/TaskPage/TaskApps.tsx
+++ b/site/src/pages/TaskPage/TaskApps.tsx
@@ -34,7 +34,7 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 		// The Chat UI app will be displayed in the sidebar, so we don't want to
 		// show it as a web app.
 		(app) =>
-			app.id !== task.workspace.latest_build.ai_task_sidebar_app_id &&
+			app.id !== task.workspace.latest_build.task_app_id &&
 			app.health !== "disabled",
 	);
 	const [embeddedApps, externalApps] = splitEmbeddedAndExternalApps(apps);
diff --git a/site/src/pages/TaskPage/TaskPage.stories.tsx b/site/src/pages/TaskPage/TaskPage.stories.tsx
index f1a0d3d05b727..d101f59e8f4ea 100644
--- a/site/src/pages/TaskPage/TaskPage.stories.tsx
+++ b/site/src/pages/TaskPage/TaskPage.stories.tsx
@@ -190,7 +190,7 @@ export const SidebarAppNotFound: Story = {
 				...workspace,
 				latest_build: {
 					...workspace.latest_build,
-					ai_task_sidebar_app_id: "non-existent-app-id",
+					task_app_id: "non-existent-app-id",
 				},
 			},
 		});
@@ -497,7 +497,7 @@ function mockTaskWorkspace(
 		latest_build: {
 			...MockWorkspace.latest_build,
 			has_ai_task: true,
-			ai_task_sidebar_app_id: sidebarApp.id,
+			task_app_id: sidebarApp.id,
 			resources: [
 				{
 					...MockWorkspaceResource,
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index 1b4b2c1c38d56..4eb95b506558f 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -143,7 +143,7 @@ const TaskPage = () => {
 		content = <TaskStartingAgent agent={agent} />;
 	} else {
 		const chatApp = getTaskApps(task).find(
-			(app) => app.id === task.workspace.latest_build.ai_task_sidebar_app_id,
+			(app) => app.id === task.workspace.latest_build.task_app_id,
 		);
 		content = (
 			<PanelGroup autoSaveId="task" direction="horizontal">

From fb9d8e303020d861760b1cf0098fe68a112a0dbc Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Fri, 24 Oct 2025 12:18:19 +0200
Subject: [PATCH 233/298] feat(cli): warn user if setting autostart on
 workspace with template-level autostart (#20454)

Fixes: https://github.com/coder/coder/issues/15619
---
 cli/schedule.go      | 16 +++++++++++
 cli/schedule_test.go | 64 ++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 80 insertions(+)

diff --git a/cli/schedule.go b/cli/schedule.go
index 15f837bc16779..a4b02d6d8be9e 100644
--- a/cli/schedule.go
+++ b/cli/schedule.go
@@ -176,6 +176,22 @@ func (r *RootCmd) scheduleStart() *serpent.Command {
 				}
 
 				schedStr = ptr.Ref(sched.String())
+
+				// Check if the template has autostart requirements that may conflict
+				// with the user's schedule.
+				template, err := client.Template(inv.Context(), workspace.TemplateID)
+				if err != nil {
+					return xerrors.Errorf("get template: %w", err)
+				}
+
+				if len(template.AutostartRequirement.DaysOfWeek) > 0 {
+					_, _ = fmt.Fprintf(
+						inv.Stderr,
+						"Warning: your workspace template restricts autostart to the following days: %s.\n"+
+							"Your workspace may only autostart on these days.\n",
+						strings.Join(template.AutostartRequirement.DaysOfWeek, ", "),
+					)
+				}
 			}
 
 			err = client.UpdateWorkspaceAutostart(inv.Context(), workspace.ID, codersdk.UpdateWorkspaceAutostartRequest{
diff --git a/cli/schedule_test.go b/cli/schedule_test.go
index b161f41cbcebc..bc473279f7ca4 100644
--- a/cli/schedule_test.go
+++ b/cli/schedule_test.go
@@ -373,3 +373,67 @@ func TestScheduleOverride(t *testing.T) {
 		})
 	}
 }
+
+//nolint:paralleltest // t.Setenv
+func TestScheduleStart_TemplateAutostartRequirement(t *testing.T) {
+	t.Setenv("TZ", "UTC")
+	loc, err := tz.TimezoneIANA()
+	require.NoError(t, err)
+	require.Equal(t, "UTC", loc.String())
+
+	client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+	user := coderdtest.CreateFirstUser(t, client)
+
+	version := coderdtest.CreateTemplateVersion(t, client, user.OrganizationID, nil)
+	coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+	template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
+
+	// Update template to have autostart requirement
+	// Note: In AGPL, this will be ignored and all days will be allowed (enterprise feature).
+	template, err = client.UpdateTemplateMeta(context.Background(), template.ID, codersdk.UpdateTemplateMeta{
+		AutostartRequirement: &codersdk.TemplateAutostartRequirement{
+			DaysOfWeek: []string{"monday", "wednesday", "friday"},
+		},
+	})
+	require.NoError(t, err)
+
+	// Verify the template - in AGPL, AutostartRequirement will have all days (enterprise feature)
+	template, err = client.Template(context.Background(), template.ID)
+	require.NoError(t, err)
+	require.NotEmpty(t, template.AutostartRequirement.DaysOfWeek, "template should have autostart requirement days")
+
+	workspace := coderdtest.CreateWorkspace(t, client, template.ID)
+	coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+	t.Run("ShowsWarning", func(t *testing.T) {
+		// When: user sets autostart schedule
+		inv, root := clitest.New(t,
+			"schedule", "start", workspace.Name, "9:30AM", "Mon-Fri",
+		)
+		clitest.SetupConfig(t, client, root)
+		pty := ptytest.New(t).Attach(inv)
+		require.NoError(t, inv.Run())
+
+		// Then: warning should be shown
+		// In AGPL, this will show all days (enterprise feature defaults to all days allowed)
+		pty.ExpectMatch("Warning")
+		pty.ExpectMatch("may only autostart")
+	})
+
+	t.Run("NoWarningWhenManual", func(t *testing.T) {
+		// When: user sets manual schedule
+		inv, root := clitest.New(t,
+			"schedule", "start", workspace.Name, "manual",
+		)
+		clitest.SetupConfig(t, client, root)
+
+		var stderrBuf bytes.Buffer
+		inv.Stderr = &stderrBuf
+
+		require.NoError(t, inv.Run())
+
+		// Then: no warning should be shown on stderr
+		stderrOutput := stderrBuf.String()
+		require.NotContains(t, stderrOutput, "Warning")
+	})
+}

From f947a341036341cf25e1338601fbae654995d234 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 24 Oct 2025 16:06:44 +0500
Subject: [PATCH 234/298] ci: bump the github-actions group across 1 directory
 with 15 updates (#20384)

Co-authored-by: github-actions[bot]
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: M Atif Ali <atif@coder.com>
Co-authored-by: Ethan Dickson <ethan@coder.com>
---
 .github/workflows/ci.yaml          | 10 +++++-----
 .github/workflows/deploy.yaml      |  4 ++--
 .github/workflows/docker-base.yaml |  2 +-
 .github/workflows/docs-ci.yaml     |  2 +-
 .github/workflows/dogfood.yaml     |  2 +-
 .github/workflows/pr-deploy.yaml   | 10 +++++-----
 .github/workflows/release.yaml     |  4 ++--
 .github/workflows/scorecard.yml    |  4 ++--
 .github/workflows/security.yaml    |  6 +++---
 .github/workflows/stale.yaml       |  2 +-
 .github/workflows/traiage.yaml     |  2 +-
 .github/workflows/weekly-docs.yaml |  2 +-
 coderd/rbac/authz.go               |  2 +-
 docs/install/cli.md                |  2 +-
 14 files changed, 27 insertions(+), 27 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4199b64f6b683..acd6a58f53cbb 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -181,7 +181,7 @@ jobs:
           echo "LINT_CACHE_DIR=$dir" >> "$GITHUB_ENV"
 
       - name: golangci-lint cache
-        uses: actions/cache@0400d5f644dc74513175e3cd8d07132dd4860809 # v4.2.4
+        uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
         with:
           path: |
             ${{ env.LINT_CACHE_DIR }}
@@ -191,7 +191,7 @@ jobs:
 
       # Check for any typos
       - name: Check for typos
-        uses: crate-ci/typos@85f62a8a84f939ae994ab3763f01a0296d61a7ee # v1.36.2
+        uses: crate-ci/typos@80c8a4945eec0f6d464eaf9e65ed98ef085283d1 # v1.38.1
         with:
           config: .github/workflows/typos.toml
 
@@ -806,7 +806,7 @@ jobs:
       # the check to pass. This is desired in PRs, but not in mainline.
       - name: Publish to Chromatic (non-mainline)
         if: github.ref != 'refs/heads/main' && github.repository_owner == 'coder'
-        uses: chromaui/action@20c7e42e1b2f6becd5d188df9acb02f3e2f51519 # v13.2.0
+        uses: chromaui/action@4ffe736a2a8262ea28067ff05a13b635ba31ec05 # v13.3.0
         env:
           NODE_OPTIONS: "--max_old_space_size=4096"
           STORYBOOK: true
@@ -838,7 +838,7 @@ jobs:
       # infinitely "in progress" in mainline unless we re-review each build.
       - name: Publish to Chromatic (mainline)
         if: github.ref == 'refs/heads/main' && github.repository_owner == 'coder'
-        uses: chromaui/action@20c7e42e1b2f6becd5d188df9acb02f3e2f51519 # v13.2.0
+        uses: chromaui/action@4ffe736a2a8262ea28067ff05a13b635ba31ec05 # v13.3.0
         env:
           NODE_OPTIONS: "--max_old_space_size=4096"
           STORYBOOK: true
@@ -1123,7 +1123,7 @@ jobs:
           persist-credentials: false
 
       - name: GHCR Login
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 38936826261f5..30d9e384149fa 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -76,7 +76,7 @@ jobs:
           persist-credentials: false
 
       - name: GHCR Login
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -92,7 +92,7 @@ jobs:
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
 
       - name: Set up Flux CLI
-        uses: fluxcd/flux2/action@6bf37f6a560fd84982d67f853162e4b3c2235edb # v2.6.4
+        uses: fluxcd/flux2/action@4a15fa6a023259353ef750acf1c98fe88407d4d0 # v2.7.2
         with:
           # Keep this and the github action up to date with the version of flux installed in dogfood cluster
           version: "2.7.0"
diff --git a/.github/workflows/docker-base.yaml b/.github/workflows/docker-base.yaml
index a62d43d0b6a6c..2998aae1b5a79 100644
--- a/.github/workflows/docker-base.yaml
+++ b/.github/workflows/docker-base.yaml
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
 
       - name: Docker login
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
diff --git a/.github/workflows/docs-ci.yaml b/.github/workflows/docs-ci.yaml
index eb64a35ffa3f4..a4f593d425f8a 100644
--- a/.github/workflows/docs-ci.yaml
+++ b/.github/workflows/docs-ci.yaml
@@ -30,7 +30,7 @@ jobs:
       - name: Setup Node
         uses: ./.github/actions/setup-node
 
-      - uses: tj-actions/changed-files@4563c729c555b4141fac99c80f699f571219b836 # v45.0.7
+      - uses: tj-actions/changed-files@d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 # v45.0.7
         id: changed-files
         with:
           files: |
diff --git a/.github/workflows/dogfood.yaml b/.github/workflows/dogfood.yaml
index 5793b64616703..780cef6e0cc6d 100644
--- a/.github/workflows/dogfood.yaml
+++ b/.github/workflows/dogfood.yaml
@@ -82,7 +82,7 @@ jobs:
 
       - name: Login to DockerHub
         if: github.ref == 'refs/heads/main'
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_PASSWORD }}
diff --git a/.github/workflows/pr-deploy.yaml b/.github/workflows/pr-deploy.yaml
index 1fd4351503b9c..eb0eb296923c3 100644
--- a/.github/workflows/pr-deploy.yaml
+++ b/.github/workflows/pr-deploy.yaml
@@ -189,7 +189,7 @@ jobs:
           egress-policy: audit
 
       - name: Find Comment
-        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
         id: fc
         with:
           issue-number: ${{ needs.get_info.outputs.PR_NUMBER }}
@@ -199,7 +199,7 @@ jobs:
 
       - name: Comment on PR
         id: comment_id
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           comment-id: ${{ steps.fc.outputs.comment-id }}
           issue-number: ${{ needs.get_info.outputs.PR_NUMBER }}
@@ -248,7 +248,7 @@ jobs:
         uses: ./.github/actions/setup-sqlc
 
       - name: GHCR Login
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -491,7 +491,7 @@ jobs:
           PASSWORD: ${{ steps.setup_deployment.outputs.password }}
 
       - name: Find Comment
-        uses: peter-evans/find-comment@3eae4d37986fb5a8592848f6a574fdf654e61f9e # v3.1.0
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
         id: fc
         with:
           issue-number: ${{ env.PR_NUMBER }}
@@ -500,7 +500,7 @@ jobs:
           direction: last
 
       - name: Comment on PR
-        uses: peter-evans/create-or-update-comment@71345be0265236311c031f5c7866368bd1eff043 # v4.0.0
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         env:
           STATUS: ${{ needs.get_info.outputs.NEW == 'true' && 'Created' || 'Updated' }}
         with:
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index cdd2ae96ffcb4..a91b9b8c6519f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -239,7 +239,7 @@ jobs:
           cat "$CODER_RELEASE_NOTES_FILE"
 
       - name: Docker Login
-        uses: docker/login-action@184bdaa0721073962dff0199f1fb9940f07167d1 # v3.5.0
+        uses: docker/login-action@5e57cd118135c172c3672efd75eb46360885c0ef # v3.6.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -785,7 +785,7 @@ jobs:
 
       - name: Send repository-dispatch event
         if: ${{ !inputs.dry_run }}
-        uses: peter-evans/repository-dispatch@ff45666b9427631e3450c54a1bcbee4d9ff4d7c0 # v3.0.0
+        uses: peter-evans/repository-dispatch@5fc4efd1a4797ddb68ffd0714a238564e4cc0e6f # v4.0.0
         with:
           token: ${{ secrets.CDRCI_GITHUB_TOKEN }}
           repository: coder/packages
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index ba366fb72428c..279556bce6ff7 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -30,7 +30,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@05b42c624433fc40578a4040d5cf5e36ddca8cde # v2.4.2
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif
@@ -47,6 +47,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index c9debc6c87f66..927d7a161151f 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -40,7 +40,7 @@ jobs:
         uses: ./.github/actions/setup-go
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
         with:
           languages: go, javascript
 
@@ -50,7 +50,7 @@ jobs:
           rm Makefile
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
 
       - name: Send Slack notification on failure
         if: ${{ failure() }}
@@ -154,7 +154,7 @@ jobs:
           severity: "CRITICAL,HIGH"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@192325c86100d080feab897ff886c34abd4c83a3 # v3.29.5
+        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
         with:
           sarif_file: trivy-results.sarif
           category: "Trivy"
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index 15b3996ab61eb..e7555523dd6bb 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -23,7 +23,7 @@ jobs:
           egress-policy: audit
 
       - name: stale
-        uses: actions/stale@3a9db7e6a41a89f618792c92c0e97cc736e1b13f # v10.0.0
+        uses: actions/stale@5f858e3efba33a5ca4407a664cc011ad407f2008 # v10.1.0
         with:
           stale-issue-label: "stale"
           stale-pr-label: "stale"
diff --git a/.github/workflows/traiage.yaml b/.github/workflows/traiage.yaml
index 369743d864fbd..8560af091d348 100644
--- a/.github/workflows/traiage.yaml
+++ b/.github/workflows/traiage.yaml
@@ -168,7 +168,7 @@ jobs:
           echo "coder_username=${coder_username}" >> "${GITHUB_OUTPUT}"
 
       - name: Checkout repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           persist-credentials: false
           fetch-depth: 0
diff --git a/.github/workflows/weekly-docs.yaml b/.github/workflows/weekly-docs.yaml
index 85e5ce58e0ee0..a7ae448902d0c 100644
--- a/.github/workflows/weekly-docs.yaml
+++ b/.github/workflows/weekly-docs.yaml
@@ -31,7 +31,7 @@ jobs:
           persist-credentials: false
 
       - name: Check Markdown links
-        uses: umbrelladocs/action-linkspector@874d01cae9fd488e3077b08952093235bd626977 # v1.3.7
+        uses: umbrelladocs/action-linkspector@652f85bc57bb1e7d4327260decc10aa68f7694c3 # v1.4.0
         id: markdown-link-check
         # checks all markdown files from /docs including all subfolders
         with:
diff --git a/coderd/rbac/authz.go b/coderd/rbac/authz.go
index a231419292525..2f39cf32a7df9 100644
--- a/coderd/rbac/authz.go
+++ b/coderd/rbac/authz.go
@@ -711,7 +711,7 @@ func (a *authorizedSQLFilter) SQLString() string {
 type authCache struct {
 	// cache is a cache of hashed Authorize inputs to the result of the Authorize
 	// call.
-	// determistic function.
+	// deterministic function.
 	cache *tlru.Cache[[32]byte, error]
 
 	authz Authorizer
diff --git a/docs/install/cli.md b/docs/install/cli.md
index bb70d89c6a724..38e7d2ede9f93 100644
--- a/docs/install/cli.md
+++ b/docs/install/cli.md
@@ -64,7 +64,7 @@ Every Coder server hosts CLI binaries for all supported platforms. You can run a
 script to download the appropriate CLI for your machine from your Coder
 deployment.
 
-![Install Coder binary from your deplyment](../images/install/install_from_deployment.png)
+![Install Coder binary from your deployment](../images/install/install_from_deployment.png)
 
 This script works within air-gapped deployments and ensures that the version of
 the CLI you have installed on your machine matches the version of the server.

From f684831f56b074516295847bdc8a6ccc9e74c4bb Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Fri, 24 Oct 2025 12:33:56 +0100
Subject: [PATCH 235/298] feat: add allow list to API keys (#19972)

Add API key allow list to the SDK

This PR adds an allow list to API keys in the SDK. The allow list is a list of targets that the API key is allowed to access. If the allow list is empty, a default allow list with a single entry that allows access to all resources is created.

The changes include:

- Adding a default allow list when generating an API key if none is provided
- Adding allow list to the API key response in the SDK
- Converting database allow list entries to SDK format in the API response
- Adding tests to verify the default allow list behavior



Fixes #19854
---
 coderd/apidoc/docs.go                         |   6 +
 coderd/apidoc/swagger.json                    |   6 +
 coderd/apikey_test.go                         |   6 +
 coderd/database/check_constraint.go           |   1 +
 coderd/database/db2sdk/db2sdk.go              |   7 ++
 coderd/database/dump.sql                      |   3 +-
 ...388_api_key_allow_list_constraint.down.sql |   3 +
 ...00388_api_key_allow_list_constraint.up.sql |  10 ++
 coderd/users.go                               |   1 +
 codersdk/apikey.go                            |  23 ++--
 docs/reference/api/schemas.md                 |  33 +++---
 docs/reference/api/users.md                   | 107 ++++++++++++++----
 site/src/api/typesGenerated.ts                |   1 +
 site/src/testHelpers/entities.ts              |   2 +
 14 files changed, 162 insertions(+), 47 deletions(-)
 create mode 100644 coderd/database/migrations/000388_api_key_allow_list_constraint.down.sql
 create mode 100644 coderd/database/migrations/000388_api_key_allow_list_constraint.up.sql

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index d3ad637f7dc4b..b4110e3a4cba7 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11894,6 +11894,12 @@ const docTemplate = `{
                 "user_id"
             ],
             "properties": {
+                "allow_list": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.APIAllowListTarget"
+                    }
+                },
                 "created_at": {
                     "type": "string",
                     "format": "date-time"
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 21468a92f6187..5d0f5de4e456c 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10590,6 +10590,12 @@
 				"user_id"
 			],
 			"properties": {
+				"allow_list": {
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.APIAllowListTarget"
+					}
+				},
 				"created_at": {
 					"type": "string",
 					"format": "date-time"
diff --git a/coderd/apikey_test.go b/coderd/apikey_test.go
index f980706d6ef6e..65feb1c9cb808 100644
--- a/coderd/apikey_test.go
+++ b/coderd/apikey_test.go
@@ -51,6 +51,8 @@ func TestTokenCRUD(t *testing.T) {
 	require.Greater(t, keys[0].ExpiresAt, time.Now().Add(time.Hour*24*6))
 	require.Less(t, keys[0].ExpiresAt, time.Now().Add(time.Hour*24*8))
 	require.Equal(t, codersdk.APIKeyScopeAll, keys[0].Scope)
+	require.Len(t, keys[0].AllowList, 1)
+	require.Equal(t, "*:*", keys[0].AllowList[0].String())
 
 	// no update
 
@@ -86,6 +88,8 @@ func TestTokenScoped(t *testing.T) {
 	require.EqualValues(t, len(keys), 1)
 	require.Contains(t, res.Key, keys[0].ID)
 	require.Equal(t, keys[0].Scope, codersdk.APIKeyScopeApplicationConnect)
+	require.Len(t, keys[0].AllowList, 1)
+	require.Equal(t, "*:*", keys[0].AllowList[0].String())
 }
 
 // Ensure backward-compat: when a token is created using the legacy singular
@@ -132,6 +136,8 @@ func TestTokenLegacySingularScopeCompat(t *testing.T) {
 			require.Len(t, keys, 1)
 			require.Equal(t, tc.scope, keys[0].Scope)
 			require.ElementsMatch(t, keys[0].Scopes, tc.scopes)
+			require.Len(t, keys[0].AllowList, 1)
+			require.Equal(t, "*:*", keys[0].AllowList[0].String())
 		})
 	}
 }
diff --git a/coderd/database/check_constraint.go b/coderd/database/check_constraint.go
index e80307ffc463c..d84802b9882af 100644
--- a/coderd/database/check_constraint.go
+++ b/coderd/database/check_constraint.go
@@ -6,6 +6,7 @@ type CheckConstraint string
 
 // CheckConstraint enums.
 const (
+	CheckAPIKeysAllowListNotEmpty                  CheckConstraint = "api_keys_allow_list_not_empty"                    // api_keys
 	CheckOneTimePasscodeSet                        CheckConstraint = "one_time_passcode_set"                            // users
 	CheckUsersUsernameMinLength                    CheckConstraint = "users_username_min_length"                        // users
 	CheckMaxProvisionerLogsLength                  CheckConstraint = "max_provisioner_logs_length"                      // provisioner_jobs
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index a58d7967e6a8a..4c1e3da1a4471 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -51,6 +51,13 @@ func ListLazy[F any, T any](convert func(F) T) func(list []F) []T {
 	}
 }
 
+func APIAllowListTarget(entry rbac.AllowListElement) codersdk.APIAllowListTarget {
+	return codersdk.APIAllowListTarget{
+		Type: codersdk.RBACResource(entry.Type),
+		ID:   entry.ID,
+	}
+}
+
 type ExternalAuthMeta struct {
 	Authenticated bool
 	ValidateError string
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index de55f8117f4d8..17ba8442f42e7 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -1126,7 +1126,8 @@ CREATE TABLE api_keys (
     ip_address inet DEFAULT '0.0.0.0'::inet NOT NULL,
     token_name text DEFAULT ''::text NOT NULL,
     scopes api_key_scope[] NOT NULL,
-    allow_list text[] NOT NULL
+    allow_list text[] NOT NULL,
+    CONSTRAINT api_keys_allow_list_not_empty CHECK ((array_length(allow_list, 1) > 0))
 );
 
 COMMENT ON COLUMN api_keys.hashed_secret IS 'hashed_secret contains a SHA256 hash of the key secret. This is considered a secret and MUST NOT be returned from the API as it is used for API key encryption in app proxying code.';
diff --git a/coderd/database/migrations/000388_api_key_allow_list_constraint.down.sql b/coderd/database/migrations/000388_api_key_allow_list_constraint.down.sql
new file mode 100644
index 0000000000000..aa6aa87f10522
--- /dev/null
+++ b/coderd/database/migrations/000388_api_key_allow_list_constraint.down.sql
@@ -0,0 +1,3 @@
+-- Drop all CHECK constraints added in the up migration
+ALTER TABLE api_keys
+DROP CONSTRAINT api_keys_allow_list_not_empty;
diff --git a/coderd/database/migrations/000388_api_key_allow_list_constraint.up.sql b/coderd/database/migrations/000388_api_key_allow_list_constraint.up.sql
new file mode 100644
index 0000000000000..6dc46b522be92
--- /dev/null
+++ b/coderd/database/migrations/000388_api_key_allow_list_constraint.up.sql
@@ -0,0 +1,10 @@
+-- Defensively update any API keys with empty allow_list to have default '*:*'
+-- This ensures all existing keys have at least one entry before adding the constraint
+UPDATE api_keys
+SET allow_list = ARRAY['*:*']
+WHERE allow_list = ARRAY[]::text[] OR array_length(allow_list, 1) IS NULL;
+
+-- Add CHECK constraint to ensure allow_list array is never empty
+ALTER TABLE api_keys
+ADD CONSTRAINT api_keys_allow_list_not_empty
+CHECK (array_length(allow_list, 1) > 0);
diff --git a/coderd/users.go b/coderd/users.go
index e24790e7455e7..30fa7bf7cabeb 100644
--- a/coderd/users.go
+++ b/coderd/users.go
@@ -1608,5 +1608,6 @@ func convertAPIKey(k database.APIKey) codersdk.APIKey {
 		Scopes:          scopes,
 		LifetimeSeconds: k.LifetimeSeconds,
 		TokenName:       k.TokenName,
+		AllowList:       db2sdk.List(k.AllowList, db2sdk.APIAllowListTarget),
 	}
 }
diff --git a/codersdk/apikey.go b/codersdk/apikey.go
index ff5d749151e8f..a5b622c73afe4 100644
--- a/codersdk/apikey.go
+++ b/codersdk/apikey.go
@@ -12,17 +12,18 @@ import (
 
 // APIKey: do not ever return the HashedSecret
 type APIKey struct {
-	ID              string        `json:"id" validate:"required"`
-	UserID          uuid.UUID     `json:"user_id" validate:"required" format:"uuid"`
-	LastUsed        time.Time     `json:"last_used" validate:"required" format:"date-time"`
-	ExpiresAt       time.Time     `json:"expires_at" validate:"required" format:"date-time"`
-	CreatedAt       time.Time     `json:"created_at" validate:"required" format:"date-time"`
-	UpdatedAt       time.Time     `json:"updated_at" validate:"required" format:"date-time"`
-	LoginType       LoginType     `json:"login_type" validate:"required" enums:"password,github,oidc,token"`
-	Scope           APIKeyScope   `json:"scope" enums:"all,application_connect"` // Deprecated: use Scopes instead.
-	Scopes          []APIKeyScope `json:"scopes"`
-	TokenName       string        `json:"token_name" validate:"required"`
-	LifetimeSeconds int64         `json:"lifetime_seconds" validate:"required"`
+	ID              string               `json:"id" validate:"required"`
+	UserID          uuid.UUID            `json:"user_id" validate:"required" format:"uuid"`
+	LastUsed        time.Time            `json:"last_used" validate:"required" format:"date-time"`
+	ExpiresAt       time.Time            `json:"expires_at" validate:"required" format:"date-time"`
+	CreatedAt       time.Time            `json:"created_at" validate:"required" format:"date-time"`
+	UpdatedAt       time.Time            `json:"updated_at" validate:"required" format:"date-time"`
+	LoginType       LoginType            `json:"login_type" validate:"required" enums:"password,github,oidc,token"`
+	Scope           APIKeyScope          `json:"scope" enums:"all,application_connect"` // Deprecated: use Scopes instead.
+	Scopes          []APIKeyScope        `json:"scopes"`
+	TokenName       string               `json:"token_name" validate:"required"`
+	LifetimeSeconds int64                `json:"lifetime_seconds" validate:"required"`
+	AllowList       []APIAllowListTarget `json:"allow_list"`
 }
 
 // LoginType is the type of login used to create the API key.
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 88d295d53e79d..5688fb5972b68 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -744,6 +744,12 @@
 
 ```json
 {
+  "allow_list": [
+    {
+      "id": "string",
+      "type": "*"
+    }
+  ],
   "created_at": "2019-08-24T14:15:22Z",
   "expires_at": "2019-08-24T14:15:22Z",
   "id": "string",
@@ -762,19 +768,20 @@
 
 ### Properties
 
-| Name               | Type                                                  | Required | Restrictions | Description                     |
-|--------------------|-------------------------------------------------------|----------|--------------|---------------------------------|
-| `created_at`       | string                                                | true     |              |                                 |
-| `expires_at`       | string                                                | true     |              |                                 |
-| `id`               | string                                                | true     |              |                                 |
-| `last_used`        | string                                                | true     |              |                                 |
-| `lifetime_seconds` | integer                                               | true     |              |                                 |
-| `login_type`       | [codersdk.LoginType](#codersdklogintype)              | true     |              |                                 |
-| `scope`            | [codersdk.APIKeyScope](#codersdkapikeyscope)          | false    |              | Deprecated: use Scopes instead. |
-| `scopes`           | array of [codersdk.APIKeyScope](#codersdkapikeyscope) | false    |              |                                 |
-| `token_name`       | string                                                | true     |              |                                 |
-| `updated_at`       | string                                                | true     |              |                                 |
-| `user_id`          | string                                                | true     |              |                                 |
+| Name               | Type                                                                | Required | Restrictions | Description                     |
+|--------------------|---------------------------------------------------------------------|----------|--------------|---------------------------------|
+| `allow_list`       | array of [codersdk.APIAllowListTarget](#codersdkapiallowlisttarget) | false    |              |                                 |
+| `created_at`       | string                                                              | true     |              |                                 |
+| `expires_at`       | string                                                              | true     |              |                                 |
+| `id`               | string                                                              | true     |              |                                 |
+| `last_used`        | string                                                              | true     |              |                                 |
+| `lifetime_seconds` | integer                                                             | true     |              |                                 |
+| `login_type`       | [codersdk.LoginType](#codersdklogintype)                            | true     |              |                                 |
+| `scope`            | [codersdk.APIKeyScope](#codersdkapikeyscope)                        | false    |              | Deprecated: use Scopes instead. |
+| `scopes`           | array of [codersdk.APIKeyScope](#codersdkapikeyscope)               | false    |              |                                 |
+| `token_name`       | string                                                              | true     |              |                                 |
+| `updated_at`       | string                                                              | true     |              |                                 |
+| `user_id`          | string                                                              | true     |              |                                 |
 
 #### Enumerated Values
 
diff --git a/docs/reference/api/users.md b/docs/reference/api/users.md
index 0cfdd07c742dc..857d619398ff9 100644
--- a/docs/reference/api/users.md
+++ b/docs/reference/api/users.md
@@ -757,6 +757,12 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/tokens \
 ```json
 [
   {
+    "allow_list": [
+      {
+        "id": "string",
+        "type": "*"
+      }
+    ],
     "created_at": "2019-08-24T14:15:22Z",
     "expires_at": "2019-08-24T14:15:22Z",
     "id": "string",
@@ -784,31 +790,76 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/tokens \
 
 Status Code **200**
 
-| Name                 | Type                                                   | Required | Restrictions | Description                     |
-|----------------------|--------------------------------------------------------|----------|--------------|---------------------------------|
-| `[array item]`       | array                                                  | false    |              |                                 |
-| `» created_at`       | string(date-time)                                      | true     |              |                                 |
-| `» expires_at`       | string(date-time)                                      | true     |              |                                 |
-| `» id`               | string                                                 | true     |              |                                 |
-| `» last_used`        | string(date-time)                                      | true     |              |                                 |
-| `» lifetime_seconds` | integer                                                | true     |              |                                 |
-| `» login_type`       | [codersdk.LoginType](schemas.md#codersdklogintype)     | true     |              |                                 |
-| `» scope`            | [codersdk.APIKeyScope](schemas.md#codersdkapikeyscope) | false    |              | Deprecated: use Scopes instead. |
-| `» scopes`           | array                                                  | false    |              |                                 |
-| `» token_name`       | string                                                 | true     |              |                                 |
-| `» updated_at`       | string(date-time)                                      | true     |              |                                 |
-| `» user_id`          | string(uuid)                                           | true     |              |                                 |
+| Name                 | Type                                                     | Required | Restrictions | Description                     |
+|----------------------|----------------------------------------------------------|----------|--------------|---------------------------------|
+| `[array item]`       | array                                                    | false    |              |                                 |
+| `» allow_list`       | array                                                    | false    |              |                                 |
+| `»» id`              | string                                                   | false    |              |                                 |
+| `»» type`            | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                 |
+| `» created_at`       | string(date-time)                                        | true     |              |                                 |
+| `» expires_at`       | string(date-time)                                        | true     |              |                                 |
+| `» id`               | string                                                   | true     |              |                                 |
+| `» last_used`        | string(date-time)                                        | true     |              |                                 |
+| `» lifetime_seconds` | integer                                                  | true     |              |                                 |
+| `» login_type`       | [codersdk.LoginType](schemas.md#codersdklogintype)       | true     |              |                                 |
+| `» scope`            | [codersdk.APIKeyScope](schemas.md#codersdkapikeyscope)   | false    |              | Deprecated: use Scopes instead. |
+| `» scopes`           | array                                                    | false    |              |                                 |
+| `» token_name`       | string                                                   | true     |              |                                 |
+| `» updated_at`       | string(date-time)                                        | true     |              |                                 |
+| `» user_id`          | string(uuid)                                             | true     |              |                                 |
 
 #### Enumerated Values
 
-| Property     | Value                 |
-|--------------|-----------------------|
-| `login_type` | `password`            |
-| `login_type` | `github`              |
-| `login_type` | `oidc`                |
-| `login_type` | `token`               |
-| `scope`      | `all`                 |
-| `scope`      | `application_connect` |
+| Property     | Value                              |
+|--------------|------------------------------------|
+| `type`       | `*`                                |
+| `type`       | `aibridge_interception`            |
+| `type`       | `api_key`                          |
+| `type`       | `assign_org_role`                  |
+| `type`       | `assign_role`                      |
+| `type`       | `audit_log`                        |
+| `type`       | `connection_log`                   |
+| `type`       | `crypto_key`                       |
+| `type`       | `debug_info`                       |
+| `type`       | `deployment_config`                |
+| `type`       | `deployment_stats`                 |
+| `type`       | `file`                             |
+| `type`       | `group`                            |
+| `type`       | `group_member`                     |
+| `type`       | `idpsync_settings`                 |
+| `type`       | `inbox_notification`               |
+| `type`       | `license`                          |
+| `type`       | `notification_message`             |
+| `type`       | `notification_preference`          |
+| `type`       | `notification_template`            |
+| `type`       | `oauth2_app`                       |
+| `type`       | `oauth2_app_code_token`            |
+| `type`       | `oauth2_app_secret`                |
+| `type`       | `organization`                     |
+| `type`       | `organization_member`              |
+| `type`       | `prebuilt_workspace`               |
+| `type`       | `provisioner_daemon`               |
+| `type`       | `provisioner_jobs`                 |
+| `type`       | `replicas`                         |
+| `type`       | `system`                           |
+| `type`       | `tailnet_coordinator`              |
+| `type`       | `task`                             |
+| `type`       | `template`                         |
+| `type`       | `usage_event`                      |
+| `type`       | `user`                             |
+| `type`       | `user_secret`                      |
+| `type`       | `webpush_subscription`             |
+| `type`       | `workspace`                        |
+| `type`       | `workspace_agent_devcontainers`    |
+| `type`       | `workspace_agent_resource_monitor` |
+| `type`       | `workspace_dormant`                |
+| `type`       | `workspace_proxy`                  |
+| `login_type` | `password`                         |
+| `login_type` | `github`                           |
+| `login_type` | `oidc`                             |
+| `login_type` | `token`                            |
+| `scope`      | `all`                              |
+| `scope`      | `application_connect`              |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
@@ -896,6 +947,12 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/tokens/{keyname} \
 
 ```json
 {
+  "allow_list": [
+    {
+      "id": "string",
+      "type": "*"
+    }
+  ],
   "created_at": "2019-08-24T14:15:22Z",
   "expires_at": "2019-08-24T14:15:22Z",
   "id": "string",
@@ -946,6 +1003,12 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/keys/{keyid} \
 
 ```json
 {
+  "allow_list": [
+    {
+      "id": "string",
+      "type": "*"
+    }
+  ],
   "created_at": "2019-08-24T14:15:22Z",
   "expires_at": "2019-08-24T14:15:22Z",
   "id": "string",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index cee71ca6a9243..a3bfcbbed4851 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -141,6 +141,7 @@ export interface APIKey {
 	readonly scopes: readonly APIKeyScope[];
 	readonly token_name: string;
 	readonly lifetime_seconds: number;
+	readonly allow_list: readonly APIAllowListTarget[];
 }
 
 // From codersdk/apikey.go
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index f68224768359a..c0f11f2f133f0 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -85,6 +85,7 @@ export const MockToken: TypesGen.APIKeyWithOwner = {
 	login_type: "token",
 	scope: "all",
 	scopes: ["coder:all"],
+	allow_list: [{ type: "*", id: "*" }],
 	lifetime_seconds: 2592000,
 	token_name: "token-one",
 	username: "admin",
@@ -102,6 +103,7 @@ export const MockTokens: TypesGen.APIKeyWithOwner[] = [
 		login_type: "token",
 		scope: "all",
 		scopes: ["coder:all"],
+		allow_list: [{ type: "*", id: "*" }],
 		lifetime_seconds: 2592000,
 		token_name: "token-two",
 		username: "admin",

From c6e551f5380877922749f56180030026cd543bfa Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Fri, 24 Oct 2025 12:54:51 +0100
Subject: [PATCH 236/298] fix: renumber api key allow list migration (#20457)

---
 ...int.down.sql => 000389_api_key_allow_list_constraint.down.sql} | 0
 ...straint.up.sql => 000389_api_key_allow_list_constraint.up.sql} | 0
 2 files changed, 0 insertions(+), 0 deletions(-)
 rename coderd/database/migrations/{000388_api_key_allow_list_constraint.down.sql => 000389_api_key_allow_list_constraint.down.sql} (100%)
 rename coderd/database/migrations/{000388_api_key_allow_list_constraint.up.sql => 000389_api_key_allow_list_constraint.up.sql} (100%)

diff --git a/coderd/database/migrations/000388_api_key_allow_list_constraint.down.sql b/coderd/database/migrations/000389_api_key_allow_list_constraint.down.sql
similarity index 100%
rename from coderd/database/migrations/000388_api_key_allow_list_constraint.down.sql
rename to coderd/database/migrations/000389_api_key_allow_list_constraint.down.sql
diff --git a/coderd/database/migrations/000388_api_key_allow_list_constraint.up.sql b/coderd/database/migrations/000389_api_key_allow_list_constraint.up.sql
similarity index 100%
rename from coderd/database/migrations/000388_api_key_allow_list_constraint.up.sql
rename to coderd/database/migrations/000389_api_key_allow_list_constraint.up.sql

From 51d3abb9043db8b61f74b0c7d370d9a69c0cbf0b Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Fri, 24 Oct 2025 16:45:19 +0300
Subject: [PATCH 237/298] feat(site): use new task data model and endpoints
 (#20431)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Updates the UI to use the new API endpoints for tasks and use its new
data model.

Disclaimer: Since the base data model for tasks changed, we had to do a
quite large refactor and I'm sorry for that 🙏, but you'll notice most of
the changes are to adjust the types.

Closes coder/internal#976

---------

Co-authored-by: Bruno Quaresma <bruno_nonato_quaresma@hotmail.com>
---
 cli/exp_task_status_test.go                   |   1 +
 coderd/aitasks.go                             |  14 +-
 coderd/aitasks_test.go                        |   2 +
 coderd/apidoc/docs.go                         |  36 ++-
 coderd/apidoc/swagger.json                    |  36 ++-
 codersdk/aitasks.go                           |  17 +-
 docs/reference/api/experimental.md            |   6 +-
 docs/reference/api/schemas.md                 | 122 +++++----
 site/src/api/api.ts                           |  46 ++--
 site/src/api/typesGenerated.ts                |  13 +
 .../dashboard/Navbar/NavbarView.stories.tsx   |  36 +--
 .../modules/dashboard/Navbar/NavbarView.tsx   |   7 +-
 .../TaskDeleteDialog.stories.tsx              |   8 +-
 .../TaskDeleteDialog/TaskDeleteDialog.tsx     |   5 +-
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   |  24 +-
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   |   3 +-
 .../tasks/TaskStatus/TaskStatus.stories.tsx   |  52 ++++
 .../modules/tasks/TaskStatus/TaskStatus.tsx   |  41 +++
 .../TasksSidebar/TasksSidebar.stories.tsx     |   7 +-
 .../tasks/TasksSidebar/TasksSidebar.tsx       |  75 ++---
 site/src/modules/tasks/{tasks.ts => apps.ts}  |  13 +-
 site/src/pages/TaskPage/TaskAppIframe.tsx     |  12 +-
 site/src/pages/TaskPage/TaskApps.stories.tsx  |  49 ++--
 site/src/pages/TaskPage/TaskApps.tsx          |  50 ++--
 site/src/pages/TaskPage/TaskPage.stories.tsx  | 257 ++++++++----------
 site/src/pages/TaskPage/TaskPage.tsx          | 135 ++++-----
 site/src/pages/TaskPage/TaskTopbar.tsx        |  22 +-
 .../src/pages/TasksPage/TasksPage.stories.tsx |  29 +-
 site/src/pages/TasksPage/TasksPage.tsx        |  26 +-
 site/src/pages/TasksPage/TasksTable.tsx       |  46 ++--
 site/src/router.tsx                           |   2 +-
 site/src/testHelpers/entities.ts              |  72 ++---
 32 files changed, 606 insertions(+), 658 deletions(-)
 create mode 100644 site/src/modules/tasks/TaskStatus/TaskStatus.stories.tsx
 create mode 100644 site/src/modules/tasks/TaskStatus/TaskStatus.tsx
 rename site/src/modules/tasks/{tasks.ts => apps.ts} (55%)

diff --git a/cli/exp_task_status_test.go b/cli/exp_task_status_test.go
index ae6f1db29d8c7..f15222d51b0fb 100644
--- a/cli/exp_task_status_test.go
+++ b/cli/exp_task_status_test.go
@@ -240,6 +240,7 @@ func Test_TaskStatus(t *testing.T) {
   "template_display_name": "",
   "template_icon": "",
   "workspace_id": null,
+  "workspace_name": "",
   "workspace_status": "running",
   "workspace_agent_id": null,
   "workspace_agent_lifecycle": "ready",
diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 0ad1bffc30e2d..1d06daeae96c0 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -339,6 +339,7 @@ func taskFromDBTaskAndWorkspace(dbTask database.Task, ws codersdk.Workspace) cod
 		OrganizationID:          dbTask.OrganizationID,
 		OwnerID:                 dbTask.OwnerID,
 		OwnerName:               ws.OwnerName,
+		OwnerAvatarURL:          ws.OwnerAvatarURL,
 		Name:                    dbTask.Name,
 		TemplateID:              ws.TemplateID,
 		TemplateVersionID:       dbTask.TemplateVersionID,
@@ -346,6 +347,7 @@ func taskFromDBTaskAndWorkspace(dbTask database.Task, ws codersdk.Workspace) cod
 		TemplateDisplayName:     ws.TemplateDisplayName,
 		TemplateIcon:            ws.TemplateIcon,
 		WorkspaceID:             dbTask.WorkspaceID,
+		WorkspaceName:           ws.Name,
 		WorkspaceBuildNumber:    dbTask.WorkspaceBuildNumber.Int32,
 		WorkspaceStatus:         ws.LatestBuild.Status,
 		WorkspaceAgentID:        dbTask.WorkspaceAgentID,
@@ -360,21 +362,13 @@ func taskFromDBTaskAndWorkspace(dbTask database.Task, ws codersdk.Workspace) cod
 	}
 }
 
-// tasksListResponse wraps a list of experimental tasks.
-//
-// Experimental: Response shape is experimental and may change.
-type tasksListResponse struct {
-	Tasks []codersdk.Task `json:"tasks"`
-	Count int             `json:"count"`
-}
-
 // @Summary List AI tasks
 // @Description: EXPERIMENTAL: this endpoint is experimental and not guaranteed to be stable.
 // @ID list-tasks
 // @Security CoderSessionToken
 // @Tags Experimental
 // @Param q query string false "Search query for filtering tasks. Supports: owner:<username/uuid/me>, organization:<org-name/uuid>, status:<status>"
-// @Success 200 {object} coderd.tasksListResponse
+// @Success 200 {object} codersdk.TasksListResponse
 // @Router /api/experimental/tasks [get]
 //
 // EXPERIMENTAL: This endpoint is experimental and not guaranteed to be stable.
@@ -413,7 +407,7 @@ func (api *API) tasksList(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	httpapi.Write(ctx, rw, http.StatusOK, tasksListResponse{
+	httpapi.Write(ctx, rw, http.StatusOK, codersdk.TasksListResponse{
 		Tasks: tasks,
 		Count: len(tasks),
 	})
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 10b33f4ab957b..491194ffd9483 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -268,6 +268,7 @@ func TestTasks(t *testing.T) {
 		require.True(t, ok, "task should be found in the list")
 		assert.Equal(t, wantPrompt, got.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, task.WorkspaceID.UUID, got.WorkspaceID.UUID, "workspace id should match")
+		assert.Equal(t, task.WorkspaceName, got.WorkspaceName, "workspace name should match")
 		// Status should be populated via the tasks_with_status view.
 		assert.NotEmpty(t, got.Status, "task status should not be empty")
 		assert.NotEmpty(t, got.WorkspaceStatus, "workspace status should not be empty")
@@ -323,6 +324,7 @@ func TestTasks(t *testing.T) {
 		assert.Equal(t, task.Name, updated.Name, "task name should match")
 		assert.Equal(t, wantPrompt, updated.InitialPrompt, "task prompt should match the AI Prompt parameter")
 		assert.Equal(t, task.WorkspaceID.UUID, updated.WorkspaceID.UUID, "workspace id should match")
+		assert.Equal(t, task.WorkspaceName, updated.WorkspaceName, "workspace name should match")
 		assert.Equal(t, ws.LatestBuild.BuildNumber, updated.WorkspaceBuildNumber, "workspace build number should match")
 		assert.Equal(t, agentID, updated.WorkspaceAgentID.UUID, "workspace agent id should match")
 		assert.Equal(t, taskAppID, updated.WorkspaceAppID.UUID, "workspace app id should match")
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index b4110e3a4cba7..b8f4b7301c73f 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -160,7 +160,7 @@ const docTemplate = `{
                     "200": {
                         "description": "OK",
                         "schema": {
-                            "$ref": "#/definitions/coderd.tasksListResponse"
+                            "$ref": "#/definitions/codersdk.TasksListResponse"
                         }
                     }
                 }
@@ -11640,20 +11640,6 @@ const docTemplate = `{
                 }
             }
         },
-        "coderd.tasksListResponse": {
-            "type": "object",
-            "properties": {
-                "count": {
-                    "type": "integer"
-                },
-                "tasks": {
-                    "type": "array",
-                    "items": {
-                        "$ref": "#/definitions/codersdk.Task"
-                    }
-                }
-            }
-        },
         "codersdk.ACLAvailable": {
             "type": "object",
             "properties": {
@@ -17744,6 +17730,9 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
+                "owner_avatar_url": {
+                    "type": "string"
+                },
                 "owner_id": {
                     "type": "string",
                     "format": "uuid"
@@ -17820,6 +17809,9 @@ const docTemplate = `{
                         }
                     ]
                 },
+                "workspace_name": {
+                    "type": "string"
+                },
                 "workspace_status": {
                     "enum": [
                         "pending",
@@ -17941,6 +17933,20 @@ const docTemplate = `{
                 "TaskStatusError"
             ]
         },
+        "codersdk.TasksListResponse": {
+            "type": "object",
+            "properties": {
+                "count": {
+                    "type": "integer"
+                },
+                "tasks": {
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.Task"
+                    }
+                }
+            }
+        },
         "codersdk.TelemetryConfig": {
             "type": "object",
             "properties": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 5d0f5de4e456c..909a0d539441e 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -134,7 +134,7 @@
 					"200": {
 						"description": "OK",
 						"schema": {
-							"$ref": "#/definitions/coderd.tasksListResponse"
+							"$ref": "#/definitions/codersdk.TasksListResponse"
 						}
 					}
 				}
@@ -10336,20 +10336,6 @@
 				}
 			}
 		},
-		"coderd.tasksListResponse": {
-			"type": "object",
-			"properties": {
-				"count": {
-					"type": "integer"
-				},
-				"tasks": {
-					"type": "array",
-					"items": {
-						"$ref": "#/definitions/codersdk.Task"
-					}
-				}
-			}
-		},
 		"codersdk.ACLAvailable": {
 			"type": "object",
 			"properties": {
@@ -16232,6 +16218,9 @@
 					"type": "string",
 					"format": "uuid"
 				},
+				"owner_avatar_url": {
+					"type": "string"
+				},
 				"owner_id": {
 					"type": "string",
 					"format": "uuid"
@@ -16308,6 +16297,9 @@
 						}
 					]
 				},
+				"workspace_name": {
+					"type": "string"
+				},
 				"workspace_status": {
 					"enum": [
 						"pending",
@@ -16418,6 +16410,20 @@
 				"TaskStatusError"
 			]
 		},
+		"codersdk.TasksListResponse": {
+			"type": "object",
+			"properties": {
+				"count": {
+					"type": "integer"
+				},
+				"tasks": {
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.Task"
+					}
+				}
+			}
+		},
 		"codersdk.TelemetryConfig": {
 			"type": "object",
 			"properties": {
diff --git a/codersdk/aitasks.go b/codersdk/aitasks.go
index bf55cd6eda5f3..9f390202e4fd2 100644
--- a/codersdk/aitasks.go
+++ b/codersdk/aitasks.go
@@ -156,6 +156,7 @@ type Task struct {
 	OrganizationID          uuid.UUID                `json:"organization_id" format:"uuid" table:"organization id"`
 	OwnerID                 uuid.UUID                `json:"owner_id" format:"uuid" table:"owner id"`
 	OwnerName               string                   `json:"owner_name" table:"owner name"`
+	OwnerAvatarURL          string                   `json:"owner_avatar_url,omitempty" table:"owner avatar url"`
 	Name                    string                   `json:"name" table:"name,default_sort"`
 	TemplateID              uuid.UUID                `json:"template_id" format:"uuid" table:"template id"`
 	TemplateVersionID       uuid.UUID                `json:"template_version_id" format:"uuid" table:"template version id"`
@@ -163,6 +164,7 @@ type Task struct {
 	TemplateDisplayName     string                   `json:"template_display_name" table:"template display name"`
 	TemplateIcon            string                   `json:"template_icon" table:"template icon"`
 	WorkspaceID             uuid.NullUUID            `json:"workspace_id" format:"uuid" table:"workspace id"`
+	WorkspaceName           string                   `json:"workspace_name" table:"workspace name"`
 	WorkspaceStatus         WorkspaceStatus          `json:"workspace_status,omitempty" enums:"pending,starting,running,stopping,stopped,failed,canceling,canceled,deleting,deleted" table:"workspace status"`
 	WorkspaceBuildNumber    int32                    `json:"workspace_build_number,omitempty" table:"workspace build number"`
 	WorkspaceAgentID        uuid.NullUUID            `json:"workspace_agent_id" format:"uuid" table:"workspace agent id"`
@@ -200,6 +202,14 @@ type TasksFilter struct {
 	FilterQuery string `json:"filter_query,omitempty"`
 }
 
+// TaskListResponse is the response shape for tasks list.
+//
+// Experimental response shape for tasks list (server returns []Task).
+type TasksListResponse struct {
+	Tasks []Task `json:"tasks"`
+	Count int    `json:"count"`
+}
+
 func (f TasksFilter) asRequestOption() RequestOption {
 	return func(r *http.Request) {
 		var params []string
@@ -242,12 +252,7 @@ func (c *ExperimentalClient) Tasks(ctx context.Context, filter *TasksFilter) ([]
 		return nil, ReadBodyAsError(res)
 	}
 
-	// Experimental response shape for tasks list (server returns []Task).
-	type tasksListResponse struct {
-		Tasks []Task `json:"tasks"`
-		Count int    `json:"count"`
-	}
-	var tres tasksListResponse
+	var tres TasksListResponse
 	if err := json.NewDecoder(res.Body).Decode(&tres); err != nil {
 		return nil, err
 	}
diff --git a/docs/reference/api/experimental.md b/docs/reference/api/experimental.md
index 3bb5fb03c780e..34ad224bd3538 100644
--- a/docs/reference/api/experimental.md
+++ b/docs/reference/api/experimental.md
@@ -25,9 +25,9 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/tasks \
 
 ### Responses
 
-| Status | Meaning                                                 | Description | Schema                                                         |
-|--------|---------------------------------------------------------|-------------|----------------------------------------------------------------|
-| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [coderd.tasksListResponse](schemas.md#coderdtaskslistresponse) |
+| Status | Meaning                                                 | Description | Schema                                                             |
+|--------|---------------------------------------------------------|-------------|--------------------------------------------------------------------|
+| 200    | [OK](https://tools.ietf.org/html/rfc7231#section-6.3.1) | OK          | [codersdk.TasksListResponse](schemas.md#codersdktaskslistresponse) |
 
 To perform this operation, you must be authenticated. [Learn more](authentication.md).
 
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 5688fb5972b68..8945bdf1a6558 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -277,64 +277,6 @@
 |--------------|--------|----------|--------------|-------------|
 | `csp-report` | object | false    |              |             |
 
-## coderd.tasksListResponse
-
-```json
-{
-  "count": 0,
-  "tasks": [
-    {
-      "created_at": "2019-08-24T14:15:22Z",
-      "current_state": {
-        "message": "string",
-        "state": "working",
-        "timestamp": "2019-08-24T14:15:22Z",
-        "uri": "string"
-      },
-      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
-      "initial_prompt": "string",
-      "name": "string",
-      "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
-      "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
-      "owner_name": "string",
-      "status": "pending",
-      "template_display_name": "string",
-      "template_icon": "string",
-      "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
-      "template_name": "string",
-      "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
-      "updated_at": "2019-08-24T14:15:22Z",
-      "workspace_agent_health": {
-        "healthy": false,
-        "reason": "agent has lost connection"
-      },
-      "workspace_agent_id": {
-        "uuid": "string",
-        "valid": true
-      },
-      "workspace_agent_lifecycle": "created",
-      "workspace_app_id": {
-        "uuid": "string",
-        "valid": true
-      },
-      "workspace_build_number": 0,
-      "workspace_id": {
-        "uuid": "string",
-        "valid": true
-      },
-      "workspace_status": "pending"
-    }
-  ]
-}
-```
-
-### Properties
-
-| Name    | Type                                    | Required | Restrictions | Description |
-|---------|-----------------------------------------|----------|--------------|-------------|
-| `count` | integer                                 | false    |              |             |
-| `tasks` | array of [codersdk.Task](#codersdktask) | false    |              |             |
-
 ## codersdk.ACLAvailable
 
 ```json
@@ -7736,6 +7678,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "initial_prompt": "string",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+  "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
   "status": "pending",
@@ -7763,6 +7706,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
     "uuid": "string",
     "valid": true
   },
+  "workspace_name": "string",
   "workspace_status": "pending"
 }
 ```
@@ -7777,6 +7721,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `initial_prompt`            | string                                                               | false    |              |             |
 | `name`                      | string                                                               | false    |              |             |
 | `organization_id`           | string                                                               | false    |              |             |
+| `owner_avatar_url`          | string                                                               | false    |              |             |
 | `owner_id`                  | string                                                               | false    |              |             |
 | `owner_name`                | string                                                               | false    |              |             |
 | `status`                    | [codersdk.TaskStatus](#codersdktaskstatus)                           | false    |              |             |
@@ -7792,6 +7737,7 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `workspace_app_id`          | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
 | `workspace_build_number`    | integer                                                              | false    |              |             |
 | `workspace_id`              | [uuid.NullUUID](#uuidnulluuid)                                       | false    |              |             |
+| `workspace_name`            | string                                                               | false    |              |             |
 | `workspace_status`          | [codersdk.WorkspaceStatus](#codersdkworkspacestatus)                 | false    |              |             |
 
 #### Enumerated Values
@@ -7941,6 +7887,66 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 | `unknown`      |
 | `error`        |
 
+## codersdk.TasksListResponse
+
+```json
+{
+  "count": 0,
+  "tasks": [
+    {
+      "created_at": "2019-08-24T14:15:22Z",
+      "current_state": {
+        "message": "string",
+        "state": "working",
+        "timestamp": "2019-08-24T14:15:22Z",
+        "uri": "string"
+      },
+      "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
+      "initial_prompt": "string",
+      "name": "string",
+      "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+      "owner_avatar_url": "string",
+      "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
+      "owner_name": "string",
+      "status": "pending",
+      "template_display_name": "string",
+      "template_icon": "string",
+      "template_id": "c6d67e98-83ea-49f0-8812-e4abae2b68bc",
+      "template_name": "string",
+      "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
+      "updated_at": "2019-08-24T14:15:22Z",
+      "workspace_agent_health": {
+        "healthy": false,
+        "reason": "agent has lost connection"
+      },
+      "workspace_agent_id": {
+        "uuid": "string",
+        "valid": true
+      },
+      "workspace_agent_lifecycle": "created",
+      "workspace_app_id": {
+        "uuid": "string",
+        "valid": true
+      },
+      "workspace_build_number": 0,
+      "workspace_id": {
+        "uuid": "string",
+        "valid": true
+      },
+      "workspace_name": "string",
+      "workspace_status": "pending"
+    }
+  ]
+}
+```
+
+### Properties
+
+| Name    | Type                                    | Required | Restrictions | Description |
+|---------|-----------------------------------------|----------|--------------|-------------|
+| `count` | integer                                 | false    |              |             |
+| `tasks` | array of [codersdk.Task](#codersdktask) | false    |              |             |
+
 ## codersdk.TelemetryConfig
 
 ```json
diff --git a/site/src/api/api.ts b/site/src/api/api.ts
index a5c9148b017a0..04bf78538a343 100644
--- a/site/src/api/api.ts
+++ b/site/src/api/api.ts
@@ -21,7 +21,6 @@
  */
 import globalAxios, { type AxiosInstance, isAxiosError } from "axios";
 import type dayjs from "dayjs";
-import type { Task } from "modules/tasks/tasks";
 import userAgentParser from "ua-parser-js";
 import { delay } from "../utils/delay";
 import { OneWayWebSocket } from "../utils/OneWayWebSocket";
@@ -426,10 +425,6 @@ export type GetProvisionerDaemonsParams = {
 	offline?: boolean;
 };
 
-export type TasksFilter = {
-	username?: string;
-};
-
 /**
  * This is the container for all API methods. It's split off to make it more
  * clear where API methods should go, but it is eventually merged into the Api
@@ -2712,28 +2707,35 @@ class ExperimentalApiMethods {
 		return response.data;
 	};
 
-	getTasks = async (filter: TasksFilter): Promise<Task[]> => {
-		const queryExpressions = ["has-ai-task:true"];
-
-		if (filter.username) {
-			queryExpressions.push(`owner:${filter.username}`);
+	getTasks = async (
+		filter: TypesGen.TasksFilter,
+	): Promise<readonly TypesGen.Task[]> => {
+		const query: string[] = [];
+		if (filter.owner) {
+			query.push(`owner:${filter.owner}`);
+		}
+		if (filter.status) {
+			query.push(`status:${filter.status}`);
 		}
 
-		const res = await API.getWorkspaces({
-			q: queryExpressions.join(" "),
-		});
-		// Exclude prebuild workspaces as they are not user-facing.
-		const workspaces = res.workspaces.filter(
-			(workspace) => !workspace.is_prebuild,
+		const res = await this.axios.get<TypesGen.TasksListResponse>(
+			"/api/experimental/tasks",
+			{
+				params: {
+					q: query.join(", "),
+				},
+			},
 		);
-		const prompts = await API.experimental.getAITasksPrompts(
-			workspaces.map((workspace) => workspace.latest_build.id),
+
+		return res.data.tasks;
+	};
+
+	getTask = async (user: string, id: string): Promise<TypesGen.Task> => {
+		const response = await this.axios.get<TypesGen.Task>(
+			`/api/experimental/tasks/${user}/${id}`,
 		);
 
-		return workspaces.map((workspace) => ({
-			workspace,
-			prompt: prompts.prompts[workspace.latest_build.id],
-		}));
+		return response.data;
 	};
 
 	deleteTask = async (user: string, id: string): Promise<void> => {
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index a3bfcbbed4851..0bcd2ba6cc7b2 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -4701,6 +4701,7 @@ export interface Task {
 	readonly organization_id: string;
 	readonly owner_id: string;
 	readonly owner_name: string;
+	readonly owner_avatar_url?: string;
 	readonly name: string;
 	readonly template_id: string;
 	readonly template_version_id: string;
@@ -4708,6 +4709,7 @@ export interface Task {
 	readonly template_display_name: string;
 	readonly template_icon: string;
 	readonly workspace_id: string | null;
+	readonly workspace_name: string;
 	readonly workspace_status?: WorkspaceStatus;
 	readonly workspace_build_number?: number;
 	readonly workspace_agent_id: string | null;
@@ -4825,6 +4827,17 @@ export interface TasksFilter {
 	readonly filter_query?: string;
 }
 
+// From codersdk/aitasks.go
+/**
+ * TaskListResponse is the response shape for tasks list.
+ *
+ * Experimental response shape for tasks list (server returns []Task).
+ */
+export interface TasksListResponse {
+	readonly tasks: readonly Task[];
+	readonly count: number;
+}
+
 // From codersdk/deployment.go
 export interface TelemetryConfig {
 	readonly enable: boolean;
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx b/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
index 6428656745e55..d9f65c9a2aa6f 100644
--- a/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
+++ b/site/src/modules/dashboard/Navbar/NavbarView.stories.tsx
@@ -1,17 +1,13 @@
 import { chromaticWithTablet } from "testHelpers/chromatic";
-import {
-	MockUserMember,
-	MockUserOwner,
-	MockWorkspace,
-	MockWorkspaceAppStatus,
-} from "testHelpers/entities";
+import { MockTasks, MockUserMember, MockUserOwner } from "testHelpers/entities";
 import { withDashboardProvider } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import type { TasksFilter } from "api/typesGenerated";
 import { userEvent, within } from "storybook/test";
 import { NavbarView } from "./NavbarView";
 
-const tasksFilter = {
-	username: MockUserOwner.username,
+const tasksFilter: TasksFilter = {
+	owner: MockUserOwner.username,
 };
 
 const meta: Meta<typeof NavbarView> = {
@@ -103,29 +99,7 @@ export const IdleTasks: Story = {
 		queries: [
 			{
 				key: ["tasks", tasksFilter],
-				data: [
-					{
-						prompt: "Task 1",
-						workspace: {
-							...MockWorkspace,
-							latest_app_status: {
-								...MockWorkspaceAppStatus,
-								state: "idle",
-							},
-						},
-					},
-					{
-						prompt: "Task 2",
-						workspace: MockWorkspace,
-					},
-					{
-						prompt: "Task 3",
-						workspace: {
-							...MockWorkspace,
-							latest_app_status: MockWorkspaceAppStatus,
-						},
-					},
-				],
+				data: MockTasks,
 			},
 		],
 	},
diff --git a/site/src/modules/dashboard/Navbar/NavbarView.tsx b/site/src/modules/dashboard/Navbar/NavbarView.tsx
index a4107f0b8485c..eb7b8afe5c923 100644
--- a/site/src/modules/dashboard/Navbar/NavbarView.tsx
+++ b/site/src/modules/dashboard/Navbar/NavbarView.tsx
@@ -200,8 +200,8 @@ const TasksNavItem: FC<TasksNavItemProps> = ({ user }) => {
 			process.env.NODE_ENV === "development" ||
 			process.env.STORYBOOK,
 	);
-	const filter = {
-		username: user.username,
+	const filter: TypesGen.TasksFilter = {
+		owner: user.username,
 	};
 	const { data: idleCount } = useQuery({
 		queryKey: ["tasks", filter],
@@ -211,8 +211,7 @@ const TasksNavItem: FC<TasksNavItemProps> = ({ user }) => {
 		refetchOnWindowFocus: true,
 		initialData: [],
 		select: (data) =>
-			data.filter((task) => task.workspace.latest_app_status?.state === "idle")
-				.length,
+			data.filter((task) => task.current_state?.state === "idle").length,
 	});
 
 	if (!canSeeTasks) {
diff --git a/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx
index e595c26a7884e..faf4894ec7a7c 100644
--- a/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx
+++ b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.stories.tsx
@@ -1,4 +1,4 @@
-import { MockTasks, MockWorkspace } from "testHelpers/entities";
+import { MockTask } from "testHelpers/entities";
 import { withGlobalSnackbar } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { API } from "api/api";
@@ -18,7 +18,7 @@ export const DeleteTaskSuccess: Story = {
 	decorators: [withGlobalSnackbar],
 	args: {
 		open: true,
-		task: { prompt: "My Task", workspace: MockWorkspace },
+		task: MockTask,
 		onClose: () => {},
 	},
 	parameters: {
@@ -40,8 +40,8 @@ export const DeleteTaskSuccess: Story = {
 			await step("Confirm delete", async () => {
 				await waitFor(() => {
 					expect(API.experimental.deleteTask).toHaveBeenCalledWith(
-						MockTasks[0].workspace.owner_name,
-						MockTasks[0].workspace.id,
+						MockTask.owner_name,
+						MockTask.id,
 					);
 				});
 			});
diff --git a/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx
index b5bac134a66e4..2e8dc14ce7b3c 100644
--- a/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx
+++ b/site/src/modules/tasks/TaskDeleteDialog/TaskDeleteDialog.tsx
@@ -1,10 +1,10 @@
 import { API } from "api/api";
 import { getErrorDetail, getErrorMessage } from "api/errors";
+import type { Task } from "api/typesGenerated";
 import { ConfirmDialog } from "components/Dialogs/ConfirmDialog/ConfirmDialog";
 import { displayError, displaySuccess } from "components/GlobalSnackbar/utils";
 import type { FC } from "react";
 import { QueryClient, useMutation } from "react-query";
-import type { Task } from "../tasks";
 
 type TaskDeleteDialogProps = {
 	open: boolean;
@@ -20,8 +20,7 @@ export const TaskDeleteDialog: FC<TaskDeleteDialogProps> = ({
 }) => {
 	const queryClient = new QueryClient();
 	const deleteTaskMutation = useMutation({
-		mutationFn: () =>
-			API.experimental.deleteTask(task.workspace.owner_name, task.workspace.id),
+		mutationFn: () => API.experimental.deleteTask(task.owner_name, task.id),
 		onSuccess: async () => {
 			await queryClient.invalidateQueries({ queryKey: ["tasks"] });
 		},
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index bac6c41aab999..9572c68c75259 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -1,6 +1,5 @@
 import {
 	MockAIPromptPresets,
-	MockNewTaskData,
 	MockPresets,
 	MockTask,
 	MockTasks,
@@ -14,10 +13,19 @@ import {
 import { withAuthProvider, withGlobalSnackbar } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { API } from "api/api";
+import type { Task } from "api/typesGenerated";
 import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
 import type TasksPage from "../../../pages/TasksPage/TasksPage";
 import { TaskPrompt } from "./TaskPrompt";
 
+const MockNewTaskData: Task = {
+	...MockTask,
+	current_state: {
+		...MockTask.current_state,
+		message: "Task created successfully!",
+	},
+};
+
 const meta: Meta<typeof TasksPage> = {
 	title: "modules/tasks/TaskPrompt",
 	component: TaskPrompt,
@@ -77,7 +85,7 @@ export const SubmitEnabledWhenPromptNotEmpty: Story = {
 		const canvas = within(canvasElement);
 
 		const prompt = await canvas.findByLabelText(/prompt/i);
-		await userEvent.type(prompt, MockNewTaskData.prompt);
+		await userEvent.type(prompt, MockNewTaskData.initial_prompt);
 
 		const submitButton = canvas.getByRole("button", { name: /run task/i });
 		expect(submitButton).toBeEnabled();
@@ -152,7 +160,7 @@ export const OnSuccess: Story = {
 
 		await step("Run task", async () => {
 			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
+			await userEvent.type(prompt, MockNewTaskData.initial_prompt);
 			const submitButton = canvas.getByRole("button", { name: /run task/i });
 			await waitFor(() => expect(submitButton).toBeEnabled());
 			await userEvent.click(submitButton);
@@ -162,7 +170,7 @@ export const OnSuccess: Story = {
 			expect(API.experimental.createTask).toHaveBeenCalledWith(
 				MockUserOwner.id,
 				{
-					input: MockNewTaskData.prompt,
+					input: MockNewTaskData.initial_prompt,
 					template_version_id: `${MockTemplate.active_version_id}-latest`,
 					template_version_preset_id: undefined,
 				},
@@ -267,7 +275,7 @@ export const SelectTemplateVersion: Story = {
 
 		await step("Fill prompt", async () => {
 			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
+			await userEvent.type(prompt, MockNewTaskData.initial_prompt);
 		});
 
 		await step("Select version", async () => {
@@ -290,7 +298,7 @@ export const SelectTemplateVersion: Story = {
 			expect(API.experimental.createTask).toHaveBeenCalledWith(
 				MockUserOwner.id,
 				{
-					input: MockNewTaskData.prompt,
+					input: MockNewTaskData.initial_prompt,
 					template_version_id: "test-template-version-2",
 					template_version_preset_id: undefined,
 				},
@@ -375,7 +383,7 @@ export const MissingExternalAuth: Story = {
 
 		await step("Submit is disabled", async () => {
 			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
+			await userEvent.type(prompt, MockNewTaskData.initial_prompt);
 			const submitButton = canvas.getByRole("button", { name: /run task/i });
 			expect(submitButton).toBeDisabled();
 		});
@@ -403,7 +411,7 @@ export const ExternalAuthError: Story = {
 
 		await step("Submit is disabled", async () => {
 			const prompt = await canvas.findByLabelText(/prompt/i);
-			await userEvent.type(prompt, MockNewTaskData.prompt);
+			await userEvent.type(prompt, MockNewTaskData.initial_prompt);
 			const submitButton = canvas.getByRole("button", { name: /run task/i });
 			expect(submitButton).toBeDisabled();
 		});
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index 580b520d2c858..b40f3253a8e93 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -29,7 +29,6 @@ import {
 import { useAuthenticated } from "hooks/useAuthenticated";
 import { useExternalAuth } from "hooks/useExternalAuth";
 import { ArrowUpIcon, RedoIcon, RotateCcwIcon } from "lucide-react";
-import { AI_PROMPT_PARAMETER_NAME } from "modules/tasks/tasks";
 import { type FC, useEffect, useState } from "react";
 import { useMutation, useQuery, useQueryClient } from "react-query";
 import TextareaAutosize, {
@@ -39,6 +38,8 @@ import { docs } from "utils/docs";
 import { PromptSelectTrigger } from "./PromptSelectTrigger";
 import { TemplateVersionSelect } from "./TemplateVersionSelect";
 
+const AI_PROMPT_PARAMETER_NAME = "AI Prompt";
+
 type TaskPromptProps = {
 	templates: Template[] | undefined;
 	error: unknown;
diff --git a/site/src/modules/tasks/TaskStatus/TaskStatus.stories.tsx b/site/src/modules/tasks/TaskStatus/TaskStatus.stories.tsx
new file mode 100644
index 0000000000000..9d20b357dd7f6
--- /dev/null
+++ b/site/src/modules/tasks/TaskStatus/TaskStatus.stories.tsx
@@ -0,0 +1,52 @@
+import type { Meta, StoryObj } from "@storybook/react-vite";
+import { TaskStatus } from "./TaskStatus";
+
+const meta: Meta<typeof TaskStatus> = {
+	title: "modules/tasks/TaskStatus",
+	component: TaskStatus,
+};
+
+export default meta;
+type Story = StoryObj<typeof TaskStatus>;
+
+export const Active: Story = {
+	args: {
+		status: "active",
+		stateMessage: "Task is running smoothly",
+	},
+};
+
+export const Failed: Story = {
+	args: {
+		status: "error",
+		stateMessage: "Task encountered an error",
+	},
+};
+
+export const Initializing: Story = {
+	args: {
+		status: "initializing",
+		stateMessage: "Task is initializing",
+	},
+};
+
+export const Pending: Story = {
+	args: {
+		status: "pending",
+		stateMessage: "Task is pending",
+	},
+};
+
+export const Paused: Story = {
+	args: {
+		status: "paused",
+		stateMessage: "Task is paused",
+	},
+};
+
+export const Unknown: Story = {
+	args: {
+		status: "unknown",
+		stateMessage: "Task status is unknown",
+	},
+};
diff --git a/site/src/modules/tasks/TaskStatus/TaskStatus.tsx b/site/src/modules/tasks/TaskStatus/TaskStatus.tsx
new file mode 100644
index 0000000000000..81204dee44536
--- /dev/null
+++ b/site/src/modules/tasks/TaskStatus/TaskStatus.tsx
@@ -0,0 +1,41 @@
+import type * as TypesGen from "api/typesGenerated";
+import {
+	StatusIndicator,
+	StatusIndicatorDot,
+	type StatusIndicatorProps,
+} from "components/StatusIndicator/StatusIndicator";
+import type { FC } from "react";
+
+type TaskStatusProps = {
+	status: TypesGen.TaskStatus;
+	stateMessage: string;
+};
+
+export const taskStatusToStatusIndicatorVariant: Record<
+	TypesGen.TaskStatus,
+	StatusIndicatorProps["variant"]
+> = {
+	active: "success",
+	error: "failed",
+	initializing: "pending",
+	pending: "pending",
+	paused: "inactive",
+	unknown: "warning",
+};
+
+export const TaskStatus: FC<TaskStatusProps> = ({ status, stateMessage }) => {
+	return (
+		<StatusIndicator
+			variant={taskStatusToStatusIndicatorVariant[status]}
+			className="items-start"
+		>
+			<StatusIndicatorDot className="mt-1" />
+			<div className="flex flex-col">
+				<span className="[&:first-letter]:uppercase">{status}</span>
+				<span className="text-xs font-normal text-content-secondary truncate max-w-sm">
+					{stateMessage}
+				</span>
+			</div>
+		</StatusIndicator>
+	);
+};
diff --git a/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx b/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx
index 11fb2c54bbbb1..7af5fa6b471c0 100644
--- a/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx
+++ b/site/src/modules/tasks/TasksSidebar/TasksSidebar.stories.tsx
@@ -19,13 +19,14 @@ const meta: Meta<typeof TasksSidebar> = {
 		},
 		reactRouter: reactRouterParameters({
 			location: {
-				path: `/tasks/${MockTasks[0].workspace.name}`,
+				path: `/tasks/${MockTasks[0].owner_name}/${MockTasks[0].id}`,
 				pathParams: {
-					workspace: MockTasks[0].workspace.name,
+					owner_name: MockTasks[0].owner_name,
+					taskId: MockTasks[0].id,
 				},
 			},
 			routing: [
-				{ path: "/tasks/:workspace", useStoryElement: true },
+				{ path: "/tasks/:username/:taskId", useStoryElement: true },
 				{ path: "/tasks", element: <div>Tasks Index Page</div> },
 			],
 		}),
diff --git a/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx b/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx
index b63366e1b98cc..eddbfa6f3f55e 100644
--- a/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx
+++ b/site/src/modules/tasks/TasksSidebar/TasksSidebar.tsx
@@ -1,6 +1,6 @@
 import { API } from "api/api";
 import { getErrorMessage } from "api/errors";
-import { cva } from "class-variance-authority";
+import type { Task, TasksFilter } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import {
 	DropdownMenu,
@@ -12,6 +12,7 @@ import {
 import { CoderIcon } from "components/Icons/CoderIcon";
 import { ScrollArea } from "components/ScrollArea/ScrollArea";
 import { Skeleton } from "components/Skeleton/Skeleton";
+import { StatusIndicatorDot } from "components/StatusIndicator/StatusIndicator";
 import {
 	Tooltip,
 	TooltipContent,
@@ -21,18 +22,18 @@ import {
 import { useAuthenticated } from "hooks";
 import { useSearchParamsKey } from "hooks/useSearchParamsKey";
 import { EditIcon, EllipsisIcon, PanelLeftIcon, TrashIcon } from "lucide-react";
-import type { Task } from "modules/tasks/tasks";
 import { type FC, useState } from "react";
 import { useQuery } from "react-query";
 import { Link as RouterLink, useNavigate, useParams } from "react-router";
 import { cn } from "utils/cn";
 import { TaskDeleteDialog } from "../TaskDeleteDialog/TaskDeleteDialog";
+import { taskStatusToStatusIndicatorVariant } from "../TaskStatus/TaskStatus";
 import { UserCombobox } from "./UserCombobox";
 
 export const TasksSidebar: FC = () => {
 	const { user, permissions } = useAuthenticated();
-	const usernameParam = useSearchParamsKey({
-		key: "username",
+	const ownerParam = useSearchParamsKey({
+		key: "owner",
 		defaultValue: user.username,
 	});
 
@@ -42,11 +43,11 @@ export const TasksSidebar: FC = () => {
 		<div
 			className={cn(
 				"h-full bg-surface-secondary w-full max-w-80",
-				"border-solid border-0 border-r transition-all",
+				"border-solid border-0 border-r transition-all flex flex-col",
 				{ "max-w-14": isCollapsed },
 			)}
 		>
-			<div className="p-3 flex flex-col flex-1 gap-6">
+			<div className="p-3 flex flex-col gap-6">
 				<div className="flex items-center place-content-between">
 					{!isCollapsed && (
 						<Button
@@ -109,29 +110,29 @@ export const TasksSidebar: FC = () => {
 
 				{!isCollapsed && permissions.viewAllUsers && (
 					<UserCombobox
-						value={usernameParam.value}
+						value={ownerParam.value}
 						onValueChange={(username) => {
-							if (username === usernameParam.value) {
-								usernameParam.setValue("");
+							if (username === ownerParam.value) {
+								ownerParam.setValue("");
 								return;
 							}
-							usernameParam.setValue(username);
+							ownerParam.setValue(username);
 						}}
 					/>
 				)}
 			</div>
 
-			{!isCollapsed && <TasksSidebarGroup username={usernameParam.value} />}
+			{!isCollapsed && <TasksSidebarGroup owner={ownerParam.value} />}
 		</div>
 	);
 };
 
 type TasksSidebarGroupProps = {
-	username: string;
+	owner: string;
 };
 
-const TasksSidebarGroup: FC<TasksSidebarGroupProps> = ({ username }) => {
-	const filter = { username };
+const TasksSidebarGroup: FC<TasksSidebarGroupProps> = ({ owner }) => {
+	const filter: TasksFilter = { owner };
 	const tasksQuery = useQuery({
 		queryKey: ["tasks", filter],
 		queryFn: () => API.experimental.getTasks(filter),
@@ -139,14 +140,14 @@ const TasksSidebarGroup: FC<TasksSidebarGroupProps> = ({ username }) => {
 	});
 
 	return (
-		<ScrollArea>
+		<ScrollArea className="flex-1">
 			<div className="flex flex-col gap-2 p-3">
 				<div className="text-content-secondary text-xs">Tasks</div>
 				<div className="flex flex-col flex-1 gap-1">
 					{tasksQuery.data ? (
 						tasksQuery.data.length > 0 ? (
-							tasksQuery.data.map((t) => (
-								<TaskSidebarMenuItem key={t.workspace.id} task={t} />
+							tasksQuery.data.map((task) => (
+								<TaskSidebarMenuItem key={task.id} task={task} />
 							))
 						) : (
 							<div className="text-content-secondary text-xs p-4 border-border border-solid rounded text-center">
@@ -175,8 +176,8 @@ type TaskSidebarMenuItemProps = {
 };
 
 const TaskSidebarMenuItem: FC<TaskSidebarMenuItemProps> = ({ task }) => {
-	const { workspace } = useParams<{ workspace: string }>();
-	const isActive = task.workspace.name === workspace;
+	const { taskId } = useParams<{ taskId: string }>();
+	const isActive = task.id === taskId;
 	const [isDeleteDialogOpen, setIsDeleteDialogOpen] = useState(false);
 	const navigate = useNavigate();
 
@@ -197,12 +198,12 @@ const TaskSidebarMenuItem: FC<TaskSidebarMenuItemProps> = ({ task }) => {
 			>
 				<RouterLink
 					to={{
-						pathname: `/tasks/${task.workspace.owner_name}/${task.workspace.name}`,
+						pathname: `/tasks/${task.owner_name}/${task.id}`,
 						search: window.location.search,
 					}}
 				>
 					<TaskSidebarMenuItemStatus task={task} />
-					<span className="truncate">{task.workspace.name}</span>
+					<span className="truncate">{task.name}</span>
 					<DropdownMenu>
 						<DropdownMenuTrigger asChild>
 							<Button
@@ -256,40 +257,18 @@ const TaskSidebarMenuItem: FC<TaskSidebarMenuItemProps> = ({ task }) => {
 	);
 };
 
-const taskStatusVariants = cva("block size-2 rounded-full shrink-0", {
-	variants: {
-		state: {
-			default: "border border-content-secondary border-solid",
-			complete: "bg-content-success",
-			failure: "bg-content-destructive",
-			idle: "bg-content-secondary",
-			working: "bg-highlight-sky",
-		},
-	},
-	defaultVariants: {
-		state: "default",
-	},
-});
-
 const TaskSidebarMenuItemStatus: FC<{ task: Task }> = ({ task }) => {
-	const statusText = task.workspace.latest_app_status
-		? task.workspace.latest_app_status.state
-		: "No activity yet";
-
 	return (
 		<TooltipProvider>
 			<Tooltip>
 				<TooltipTrigger asChild>
-					<div
-						className={taskStatusVariants({
-							state: task.workspace.latest_app_status?.state ?? "default",
-						})}
-					>
-						<span className="sr-only">{statusText}</span>
-					</div>
+					<StatusIndicatorDot
+						variant={taskStatusToStatusIndicatorVariant[task.status]}
+						aria-label={task.status}
+					/>
 				</TooltipTrigger>
 				<TooltipContent className="first-letter:capitalize">
-					{statusText}
+					{task.status}
 				</TooltipContent>
 			</Tooltip>
 		</TooltipProvider>
diff --git a/site/src/modules/tasks/tasks.ts b/site/src/modules/tasks/apps.ts
similarity index 55%
rename from site/src/modules/tasks/tasks.ts
rename to site/src/modules/tasks/apps.ts
index 135586626e324..99aba32cc4660 100644
--- a/site/src/modules/tasks/tasks.ts
+++ b/site/src/modules/tasks/apps.ts
@@ -4,19 +4,14 @@ import type {
 	WorkspaceApp,
 } from "api/typesGenerated";
 
-export const AI_PROMPT_PARAMETER_NAME = "AI Prompt";
-
-export type Task = {
-	workspace: Workspace;
-	prompt: string;
-};
-
 export type WorkspaceAppWithAgent = WorkspaceApp & {
 	agent: WorkspaceAgent;
 };
 
-export function getTaskApps(task: Task): WorkspaceAppWithAgent[] {
-	return task.workspace.latest_build.resources
+export function getAllAppsWithAgent(
+	workspace: Workspace,
+): WorkspaceAppWithAgent[] {
+	return workspace.latest_build.resources
 		.flatMap((r) => r.agents ?? [])
 		.flatMap((agent) =>
 			agent.apps.map((app) => ({
diff --git a/site/src/pages/TaskPage/TaskAppIframe.tsx b/site/src/pages/TaskPage/TaskAppIframe.tsx
index e66c8009d0e62..1c458ac7d26b1 100644
--- a/site/src/pages/TaskPage/TaskAppIframe.tsx
+++ b/site/src/pages/TaskPage/TaskAppIframe.tsx
@@ -1,3 +1,4 @@
+import type { Workspace } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import {
 	DropdownMenu,
@@ -9,26 +10,26 @@ import { Spinner } from "components/Spinner/Spinner";
 import { useProxy } from "contexts/ProxyContext";
 import { EllipsisVertical, ExternalLinkIcon, HouseIcon } from "lucide-react";
 import { useAppLink } from "modules/apps/useAppLink";
-import type { Task, WorkspaceAppWithAgent } from "modules/tasks/tasks";
+import type { WorkspaceAppWithAgent } from "modules/tasks/apps";
 import { type FC, type HTMLProps, useRef } from "react";
 import { Link as RouterLink } from "react-router";
 import { cn } from "utils/cn";
 import { TaskWildcardWarning } from "./TaskWildcardWarning";
 
 type TaskAppIFrameProps = {
-	task: Task;
+	workspace: Workspace;
 	app: WorkspaceAppWithAgent;
 	active: boolean;
 };
 
 export const TaskAppIFrame: FC<TaskAppIFrameProps> = ({
-	task,
+	workspace,
 	app,
 	active,
 }) => {
 	const link = useAppLink(app, {
 		agent: app.agent,
-		workspace: task.workspace,
+		workspace,
 	});
 	const proxy = useProxy();
 	const frameRef = useRef<HTMLIFrameElement>(null);
@@ -115,8 +116,7 @@ export const TaskAppIFrame: FC<TaskAppIFrameProps> = ({
 								<code className="font-mono text-content-primary select-all">
 									/tmp/coder-agent.log
 								</code>{" "}
-								inside your workspace "{task.workspace.name}" for more
-								information.
+								inside your workspace "{workspace.name}" for more information.
 							</li>
 						</ul>
 					</div>
diff --git a/site/src/pages/TaskPage/TaskApps.stories.tsx b/site/src/pages/TaskPage/TaskApps.stories.tsx
index 02256d82cce32..752c52cfde423 100644
--- a/site/src/pages/TaskPage/TaskApps.stories.tsx
+++ b/site/src/pages/TaskPage/TaskApps.stories.tsx
@@ -1,6 +1,5 @@
 import {
 	MockPrimaryWorkspaceProxy,
-	MockTasks,
 	MockUserOwner,
 	MockWorkspace,
 	MockWorkspaceAgent,
@@ -9,10 +8,9 @@ import {
 } from "testHelpers/entities";
 import { withAuthProvider, withProxyProvider } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
-import type { WorkspaceApp } from "api/typesGenerated";
+import type { Workspace, WorkspaceApp } from "api/typesGenerated";
 import { getPreferredProxy } from "contexts/ProxyContext";
 import kebabCase from "lodash/kebabCase";
-import type { Task } from "modules/tasks/tasks";
 import { TaskApps } from "./TaskApps";
 
 const mockExternalApp: WorkspaceApp = {
@@ -35,25 +33,25 @@ type Story = StoryObj<typeof TaskApps>;
 
 export const NoEmbeddedApps: Story = {
 	args: {
-		task: mockTask([]),
+		workspace: mockWorkspaceWithApps([]),
 	},
 };
 
 export const WithExternalAppsOnly: Story = {
 	args: {
-		task: mockTask([mockExternalApp]),
+		workspace: mockWorkspaceWithApps([mockExternalApp]),
 	},
 };
 
 export const WithEmbeddedApps: Story = {
 	args: {
-		task: mockTask([mockEmbeddedApp()]),
+		workspace: mockWorkspaceWithApps([mockEmbeddedApp()]),
 	},
 };
 
 export const WithMixedApps: Story = {
 	args: {
-		task: mockTask([mockEmbeddedApp(), mockExternalApp]),
+		workspace: mockWorkspaceWithApps([mockEmbeddedApp(), mockExternalApp]),
 	},
 };
 
@@ -71,7 +69,7 @@ export const WithWildcardWarning: Story = {
 		user: MockUserOwner,
 	},
 	args: {
-		task: mockTask([
+		workspace: mockWorkspaceWithApps([
 			{
 				...mockEmbeddedApp(),
 				subdomain: true,
@@ -82,7 +80,7 @@ export const WithWildcardWarning: Story = {
 
 export const WithManyEmbeddedApps: Story = {
 	args: {
-		task: mockTask([
+		workspace: mockWorkspaceWithApps([
 			mockEmbeddedApp("Code Server"),
 			mockEmbeddedApp("Jupyter Notebook"),
 			mockEmbeddedApp("Web Terminal"),
@@ -108,25 +106,22 @@ function mockEmbeddedApp(name = MockWorkspaceApp.display_name): WorkspaceApp {
 	};
 }
 
-function mockTask(apps: WorkspaceApp[]): Task {
+function mockWorkspaceWithApps(apps: WorkspaceApp[]): Workspace {
 	return {
-		...MockTasks[0],
-		workspace: {
-			...MockWorkspace,
-			latest_build: {
-				...MockWorkspace.latest_build,
-				resources: [
-					{
-						...MockWorkspace.latest_build.resources[0],
-						agents: [
-							{
-								...MockWorkspaceAgent,
-								apps,
-							},
-						],
-					},
-				],
-			},
+		...MockWorkspace,
+		latest_build: {
+			...MockWorkspace.latest_build,
+			resources: [
+				{
+					...MockWorkspace.latest_build.resources[0],
+					agents: [
+						{
+							...MockWorkspaceAgent,
+							apps,
+						},
+					],
+				},
+			],
 		},
 	};
 }
diff --git a/site/src/pages/TaskPage/TaskApps.tsx b/site/src/pages/TaskPage/TaskApps.tsx
index 4bc575cf06f2b..2f05145bca46a 100644
--- a/site/src/pages/TaskPage/TaskApps.tsx
+++ b/site/src/pages/TaskPage/TaskApps.tsx
@@ -1,3 +1,4 @@
+import type { Workspace } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import {
 	DropdownMenu,
@@ -13,10 +14,9 @@ import { ChevronDownIcon, LayoutGridIcon, TerminalIcon } from "lucide-react";
 import { getTerminalHref } from "modules/apps/apps";
 import { useAppLink } from "modules/apps/useAppLink";
 import {
-	getTaskApps,
-	type Task,
+	getAllAppsWithAgent,
 	type WorkspaceAppWithAgent,
-} from "modules/tasks/tasks";
+} from "modules/tasks/apps";
 import { type FC, useState } from "react";
 import { type LinkProps, Link as RouterLink } from "react-router";
 import { cn } from "utils/cn";
@@ -24,17 +24,17 @@ import { docs } from "utils/docs";
 import { TaskAppIFrame, TaskIframe } from "./TaskAppIframe";
 
 type TaskAppsProps = {
-	task: Task;
+	workspace: Workspace;
 };
 
 const TERMINAL_TAB_ID = "terminal";
 
-export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
-	const apps = getTaskApps(task).filter(
+export const TaskApps: FC<TaskAppsProps> = ({ workspace }) => {
+	const apps = getAllAppsWithAgent(workspace).filter(
 		// The Chat UI app will be displayed in the sidebar, so we don't want to
 		// show it as a web app.
 		(app) =>
-			app.id !== task.workspace.latest_build.task_app_id &&
+			app.id !== workspace.latest_build.task_app_id &&
 			app.health !== "disabled",
 	);
 	const [embeddedApps, externalApps] = splitEmbeddedAndExternalApps(apps);
@@ -43,8 +43,8 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 		embeddedApps.length > 0 || externalApps.length > 0;
 	const taskAgent = apps.at(0)?.agent;
 	const terminalHref = getTerminalHref({
-		username: task.workspace.owner_name,
-		workspace: task.workspace.name,
+		username: workspace.owner_name,
+		workspace: workspace.name,
 		agent: taskAgent?.name,
 	});
 	const isTerminalActive = activeAppId === TERMINAL_TAB_ID;
@@ -58,7 +58,7 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 							{embeddedApps.map((app) => (
 								<TaskAppTab
 									key={app.id}
-									task={task}
+									workspace={workspace}
 									app={app}
 									active={app.id === activeAppId}
 									onClick={(e) => {
@@ -83,7 +83,10 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 					</ScrollArea>
 
 					{externalApps.length > 0 && (
-						<ExternalAppsDropdown task={task} externalApps={externalApps} />
+						<ExternalAppsDropdown
+							workspace={workspace}
+							externalApps={externalApps}
+						/>
 					)}
 				</div>
 			)}
@@ -95,7 +98,7 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 							key={app.id}
 							active={activeAppId === app.id}
 							app={app}
-							task={task}
+							workspace={workspace}
 						/>
 					))}
 
@@ -130,12 +133,12 @@ export const TaskApps: FC<TaskAppsProps> = ({ task }) => {
 };
 
 type ExternalAppsDropdownProps = {
-	task: Task;
+	workspace: Workspace;
 	externalApps: WorkspaceAppWithAgent[];
 };
 
 const ExternalAppsDropdown: FC<ExternalAppsDropdownProps> = ({
-	task,
+	workspace,
 	externalApps,
 }) => {
 	return (
@@ -149,7 +152,7 @@ const ExternalAppsDropdown: FC<ExternalAppsDropdownProps> = ({
 				</DropdownMenuTrigger>
 				<DropdownMenuContent>
 					{externalApps.map((app) => (
-						<ExternalAppMenuItem key={app.id} app={app} task={task} />
+						<ExternalAppMenuItem key={app.id} app={app} workspace={workspace} />
 					))}
 				</DropdownMenuContent>
 			</DropdownMenu>
@@ -159,11 +162,11 @@ const ExternalAppsDropdown: FC<ExternalAppsDropdownProps> = ({
 
 const ExternalAppMenuItem: FC<{
 	app: WorkspaceAppWithAgent;
-	task: Task;
-}> = ({ app, task }) => {
+	workspace: Workspace;
+}> = ({ app, workspace }) => {
 	const link = useAppLink(app, {
 		agent: app.agent,
-		workspace: task.workspace,
+		workspace,
 	});
 
 	return (
@@ -177,16 +180,21 @@ const ExternalAppMenuItem: FC<{
 };
 
 type TaskAppTabProps = {
-	task: Task;
+	workspace: Workspace;
 	app: WorkspaceAppWithAgent;
 	active: boolean;
 	onClick: (e: React.MouseEvent<HTMLAnchorElement>) => void;
 };
 
-const TaskAppTab: FC<TaskAppTabProps> = ({ task, app, active, onClick }) => {
+const TaskAppTab: FC<TaskAppTabProps> = ({
+	workspace,
+	app,
+	active,
+	onClick,
+}) => {
 	const link = useAppLink(app, {
 		agent: app.agent,
-		workspace: task.workspace,
+		workspace,
 	});
 
 	return (
diff --git a/site/src/pages/TaskPage/TaskPage.stories.tsx b/site/src/pages/TaskPage/TaskPage.stories.tsx
index d101f59e8f4ea..730aa1b1734a0 100644
--- a/site/src/pages/TaskPage/TaskPage.stories.tsx
+++ b/site/src/pages/TaskPage/TaskPage.stories.tsx
@@ -2,6 +2,7 @@ import {
 	MockFailedWorkspace,
 	MockStartingWorkspace,
 	MockStoppedWorkspace,
+	MockTask,
 	MockTasks,
 	MockUserOwner,
 	MockWorkspace,
@@ -24,7 +25,7 @@ import { API } from "api/api";
 import type { Workspace, WorkspaceApp } from "api/typesGenerated";
 import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
 import { reactRouterParameters } from "storybook-addon-remix-react-router";
-import TaskPage, { data, WorkspaceDoesNotHaveAITaskError } from "./TaskPage";
+import TaskPage from "./TaskPage";
 
 const MockClaudeCodeApp: WorkspaceApp = {
 	...MockWorkspaceApp,
@@ -71,10 +72,10 @@ const meta: Meta<typeof TaskPage> = {
 		reactRouter: reactRouterParameters({
 			location: {
 				pathParams: {
-					workspace: MockTasks[0].workspace.name,
+					taskId: MockTasks[0].id,
 				},
 			},
-			routing: { path: "/tasks/:workspace" },
+			routing: { path: "/tasks/:taskId" },
 		}),
 	},
 };
@@ -82,17 +83,26 @@ const meta: Meta<typeof TaskPage> = {
 export default meta;
 type Story = StoryObj<typeof TaskPage>;
 
-export const Loading: Story = {
+export const LoadingTask: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockImplementation(
-			() => new Promise((_res) => 1000 * 60 * 60),
+		spyOn(API.experimental, "getTask").mockImplementation(
+			() => new Promise(() => {}),
 		);
 	},
 };
 
-export const LoadingError: Story = {
+export const LoadingWorkspace: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockRejectedValue(
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockImplementation(
+			() => new Promise(() => {}),
+		);
+	},
+};
+
+export const LoadingTaskError: Story = {
+	beforeEach: () => {
+		spyOn(API.experimental, "getTask").mockRejectedValue(
 			mockApiError({
 				message: "Failed to load task",
 				detail: "You don't have permission to access this resource.",
@@ -101,58 +111,66 @@ export const LoadingError: Story = {
 	},
 };
 
+export const LoadingWorkspaceError: Story = {
+	beforeEach: () => {
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockRejectedValue(
+			mockApiError({
+				message: "Failed to load workspace",
+				detail: "You don't have permission to access this resource.",
+			}),
+		);
+	},
+};
+
 export const WaitingOnBuild: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: MockStartingWorkspace,
-		});
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockStartingWorkspace,
+		);
 	},
 };
 
 export const FailedBuild: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: MockFailedWorkspace,
-		});
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockFailedWorkspace,
+		);
 	},
 };
 
 export const TerminatedBuild: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: MockStoppedWorkspace,
-		});
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockStoppedWorkspace,
+		);
 	},
 };
 
 export const TerminatedBuildWithStatus: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: {
-				...MockStoppedWorkspace,
-				latest_app_status: MockWorkspaceAppStatus,
-			},
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue({
+			...MockStoppedWorkspace,
+			latest_app_status: MockWorkspaceAppStatus,
 		});
 	},
 };
 
 export const WaitingStartupScripts: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: {
-				...MockWorkspace,
-				latest_build: {
-					...MockWorkspace.latest_build,
-					has_ai_task: true,
-					resources: [
-						{ ...MockWorkspaceResource, agents: [MockWorkspaceAgentStarting] },
-					],
-				},
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue({
+			...MockWorkspace,
+			latest_build: {
+				...MockWorkspace.latest_build,
+				has_ai_task: true,
+				resources: [
+					{ ...MockWorkspaceResource, agents: [MockWorkspaceAgentStarting] },
+				],
 			},
 		});
 	},
@@ -184,14 +202,12 @@ export const WaitingStartupScripts: Story = {
 export const SidebarAppNotFound: Story = {
 	beforeEach: () => {
 		const workspace = mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp);
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: {
-				...workspace,
-				latest_build: {
-					...workspace.latest_build,
-					task_app_id: "non-existent-app-id",
-				},
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue({
+			...workspace,
+			latest_build: {
+				...workspace.latest_build,
+				task_app_id: "non-existent-app-id",
 			},
 		});
 	},
@@ -199,98 +215,87 @@ export const SidebarAppNotFound: Story = {
 
 export const SidebarAppHealthDisabled: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(
 				{
 					...MockClaudeCodeApp,
 					health: "disabled",
 				},
 				MockVSCodeApp,
 			),
-		});
+		);
 	},
 };
 
 export const SidebarAppInitializing: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(
 				{
 					...MockClaudeCodeApp,
 					health: "initializing",
 				},
 				MockVSCodeApp,
 			),
-		});
+		);
 	},
 };
 
 export const SidebarAppHealthy: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(
 				{
 					...MockClaudeCodeApp,
 					health: "healthy",
 				},
 				MockVSCodeApp,
 			),
-		});
+		);
 	},
 };
 
 export const SidebarAppUnhealthy: Story = {
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(
 				{
 					...MockClaudeCodeApp,
 					health: "unhealthy",
 				},
 				MockVSCodeApp,
 			),
-		});
+		);
 	},
 };
 
 const mainAppHealthStory = (health: WorkspaceApp["health"]) => ({
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(MockClaudeCodeApp, {
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(MockClaudeCodeApp, {
 				...MockVSCodeApp,
 				health,
 			}),
-		});
+		);
 	},
 });
 
 export const MainAppHealthy: Story = mainAppHealthStory("healthy");
 export const MainAppInitializing: Story = mainAppHealthStory("initializing");
 export const MainAppUnhealthy: Story = mainAppHealthStory("unhealthy");
-export const MainAppHealthUnknown: Story = mainAppHealthStory(
-	"unknown" as unknown as WorkspaceApp["health"],
-);
-
-export const BuildNoAITask: Story = {
-	beforeEach: () => {
-		spyOn(data, "fetchTask").mockImplementation(() => {
-			throw new WorkspaceDoesNotHaveAITaskError(MockWorkspace);
-		});
-	},
-};
 
 export const Active: Story = {
 	decorators: [withProxyProvider()],
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp),
-		});
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp),
+		);
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
@@ -308,10 +313,10 @@ export const Active: Story = {
 export const ActivePreview: Story = {
 	decorators: [withProxyProvider()],
 	beforeEach: () => {
-		spyOn(data, "fetchTask").mockResolvedValue({
-			prompt: "Create competitors page",
-			workspace: mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp),
-		});
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp),
+		);
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
@@ -323,6 +328,10 @@ export const ActivePreview: Story = {
 export const WorkspaceStarting: Story = {
 	decorators: [withGlobalSnackbar],
 	beforeEach: () => {
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockStoppedWorkspace,
+		);
 		spyOn(API, "startWorkspace").mockResolvedValue(
 			MockStartingWorkspace.latest_build,
 		);
@@ -332,33 +341,13 @@ export const WorkspaceStarting: Story = {
 			location: {
 				pathParams: {
 					username: MockStoppedWorkspace.owner_name,
-					workspace: MockStoppedWorkspace.name,
+					taskId: MockTask.id,
 				},
 			},
 			routing: {
-				path: "/tasks/:username/:workspace",
+				path: "/tasks/:username/:taskId",
 			},
 		}),
-		queries: [
-			{
-				key: [
-					"tasks",
-					MockStoppedWorkspace.owner_name,
-					MockStoppedWorkspace.name,
-				],
-				data: {
-					prompt: "Create competitors page",
-					workspace: MockStoppedWorkspace,
-				},
-			},
-			{
-				key: ["workspace", MockStoppedWorkspace.id, "parameters"],
-				data: {
-					templateVersionRichParameters: [],
-					buildParameters: [],
-				},
-			},
-		],
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
@@ -377,6 +366,10 @@ export const WorkspaceStarting: Story = {
 export const WorkspaceStartFailure: Story = {
 	decorators: [withGlobalSnackbar],
 	beforeEach: () => {
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockStoppedWorkspace,
+		);
 		spyOn(API, "startWorkspace").mockRejectedValue(
 			new Error("Some unexpected error"),
 		);
@@ -386,33 +379,13 @@ export const WorkspaceStartFailure: Story = {
 			location: {
 				pathParams: {
 					username: MockStoppedWorkspace.owner_name,
-					workspace: MockStoppedWorkspace.name,
+					taskId: MockTask.id,
 				},
 			},
 			routing: {
-				path: "/tasks/:username/:workspace",
+				path: "/tasks/:username/:taskId",
 			},
 		}),
-		queries: [
-			{
-				key: [
-					"tasks",
-					MockStoppedWorkspace.owner_name,
-					MockStoppedWorkspace.name,
-				],
-				data: {
-					prompt: "Create competitors page",
-					workspace: MockStoppedWorkspace,
-				},
-			},
-			{
-				key: ["workspace", MockStoppedWorkspace.id, "parameters"],
-				data: {
-					templateVersionRichParameters: [],
-					buildParameters: [],
-				},
-			},
-		],
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
@@ -431,6 +404,10 @@ export const WorkspaceStartFailure: Story = {
 
 export const WorkspaceStartFailureWithDialog: Story = {
 	beforeEach: () => {
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockStoppedWorkspace,
+		);
 		spyOn(API, "startWorkspace").mockRejectedValue({
 			...mockApiError({
 				message: "Bad Request",
@@ -444,33 +421,13 @@ export const WorkspaceStartFailureWithDialog: Story = {
 			location: {
 				pathParams: {
 					username: MockStoppedWorkspace.owner_name,
-					workspace: MockStoppedWorkspace.name,
+					taskId: MockTask.id,
 				},
 			},
 			routing: {
-				path: "/tasks/:username/:workspace",
+				path: "/tasks/:username/:taskId",
 			},
 		}),
-		queries: [
-			{
-				key: [
-					"tasks",
-					MockStoppedWorkspace.owner_name,
-					MockStoppedWorkspace.name,
-				],
-				data: {
-					prompt: "Create competitors page",
-					workspace: MockStoppedWorkspace,
-				},
-			},
-			{
-				key: ["workspace", MockStoppedWorkspace.id, "parameters"],
-				data: {
-					templateVersionRichParameters: [],
-					buildParameters: [],
-				},
-			},
-		],
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index 4eb95b506558f..f136a16ceb4c4 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -1,7 +1,10 @@
 import { API } from "api/api";
 import { getErrorDetail, getErrorMessage, isApiError } from "api/errors";
 import { template as templateQueryOptions } from "api/queries/templates";
-import { startWorkspace } from "api/queries/workspaces";
+import {
+	startWorkspace,
+	workspaceByOwnerAndName,
+} from "api/queries/workspaces";
 import type {
 	Workspace,
 	WorkspaceAgent,
@@ -18,12 +21,8 @@ import { useWorkspaceBuildLogs } from "hooks/useWorkspaceBuildLogs";
 import { ArrowLeftIcon, RotateCcwIcon } from "lucide-react";
 import { AgentLogs } from "modules/resources/AgentLogs/AgentLogs";
 import { useAgentLogs } from "modules/resources/useAgentLogs";
+import { getAllAppsWithAgent } from "modules/tasks/apps";
 import { TasksSidebar } from "modules/tasks/TasksSidebar/TasksSidebar";
-import {
-	AI_PROMPT_PARAMETER_NAME,
-	getTaskApps,
-	type Task,
-} from "modules/tasks/tasks";
 import { WorkspaceErrorDialog } from "modules/workspaces/ErrorDialog/WorkspaceErrorDialog";
 import { WorkspaceBuildLogs } from "modules/workspaces/WorkspaceBuildLogs/WorkspaceBuildLogs";
 import {
@@ -56,20 +55,26 @@ const TaskPageLayout: FC<PropsWithChildren> = ({ children }) => {
 };
 
 const TaskPage = () => {
-	const { workspace: workspaceName, username } = useParams() as {
-		workspace: string;
+	const { task: taskId, username } = useParams() as {
+		task: string;
 		username: string;
 	};
-	const {
-		data: task,
-		error,
-		refetch,
-	} = useQuery({
-		queryKey: ["tasks", username, workspaceName],
-		queryFn: () => data.fetchTask(username, workspaceName),
-		refetchInterval: 5_000,
+	const { data: task, ...taskQuery } = useQuery({
+		queryKey: ["tasks", username, taskId],
+		queryFn: () => API.experimental.getTask(username, taskId),
+		refetchInterval: ({ state }) => {
+			return state.error ? false : 5_000;
+		},
 	});
-
+	const { data: workspace, ...workspaceQuery } = useQuery({
+		...workspaceByOwnerAndName(username, task?.workspace_name ?? ""),
+		enabled: task !== undefined,
+		refetchInterval: ({ state }) => {
+			return state.error ? false : 5_000;
+		},
+	});
+	const refetch = taskQuery.error ? taskQuery.refetch : workspaceQuery.refetch;
+	const error = taskQuery.error ?? workspaceQuery.error;
 	const waitingStatuses: WorkspaceStatus[] = ["starting", "pending"];
 
 	if (error) {
@@ -103,7 +108,7 @@ const TaskPage = () => {
 		);
 	}
 
-	if (!task) {
+	if (!task || !workspace) {
 		return (
 			<TaskPageLayout>
 				<title>{pageTitle("Loading task")}</title>
@@ -113,11 +118,11 @@ const TaskPage = () => {
 	}
 
 	let content: ReactNode = null;
-	const agent = selectAgent(task);
+	const agent = selectAgent(workspace);
 
-	if (waitingStatuses.includes(task.workspace.latest_build.status)) {
-		content = <TaskBuildingWorkspace task={task} />;
-	} else if (task.workspace.latest_build.status === "failed") {
+	if (waitingStatuses.includes(workspace.latest_build.status)) {
+		content = <BuildingWorkspace workspace={workspace} />;
+	} else if (workspace.latest_build.status === "failed") {
 		content = (
 			<div className="w-full min-h-80 flex items-center justify-center">
 				<div className="flex flex-col items-center">
@@ -129,7 +134,7 @@ const TaskPage = () => {
 					</span>
 					<Button size="sm" variant="outline" asChild className="mt-4">
 						<RouterLink
-							to={`/@${task.workspace.owner_name}/${task.workspace.name}/builds/${task.workspace.latest_build.build_number}`}
+							to={`/@${workspace.owner_name}/${workspace.name}/builds/${workspace.latest_build.build_number}`}
 						>
 							View logs
 						</RouterLink>
@@ -137,19 +142,19 @@ const TaskPage = () => {
 				</div>
 			</div>
 		);
-	} else if (task.workspace.latest_build.status !== "running") {
-		content = <WorkspaceNotRunning task={task} />;
+	} else if (workspace.latest_build.status !== "running") {
+		content = <WorkspaceNotRunning workspace={workspace} />;
 	} else if (agent && ["created", "starting"].includes(agent.lifecycle_state)) {
 		content = <TaskStartingAgent agent={agent} />;
 	} else {
-		const chatApp = getTaskApps(task).find(
-			(app) => app.id === task.workspace.latest_build.task_app_id,
+		const chatApp = getAllAppsWithAgent(workspace).find(
+			(app) => app.id === workspace.latest_build.task_app_id,
 		);
 		content = (
 			<PanelGroup autoSaveId="task" direction="horizontal">
 				<Panel defaultSize={25} minSize={20}>
 					{chatApp ? (
-						<TaskAppIFrame active task={task} app={chatApp} />
+						<TaskAppIFrame active workspace={workspace} app={chatApp} />
 					) : (
 						<div className="h-full flex items-center justify-center p-6 text-center">
 							<div className="flex flex-col items-center">
@@ -168,7 +173,7 @@ const TaskPage = () => {
 					<div className="w-1 bg-border h-full hover:bg-border-hover transition-all relative" />
 				</PanelResizeHandle>
 				<Panel className="[&>*]:h-full">
-					<TaskApps task={task} />
+					<TaskApps workspace={workspace} />
 				</Panel>
 			</PanelGroup>
 		);
@@ -176,9 +181,9 @@ const TaskPage = () => {
 
 	return (
 		<TaskPageLayout>
-			<title>{pageTitle(task.workspace.name)}</title>
+			<title>{pageTitle(task.name)}</title>
 
-			<TaskTopbar task={task} />
+			<TaskTopbar task={task} workspace={workspace} />
 			{content}
 		</TaskPageLayout>
 	);
@@ -187,19 +192,19 @@ const TaskPage = () => {
 export default TaskPage;
 
 type WorkspaceNotRunningProps = {
-	task: Task;
+	workspace: Workspace;
 };
 
-const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ task }) => {
+const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ workspace }) => {
 	const queryClient = useQueryClient();
 
 	const { data: parameters } = useQuery({
-		queryKey: ["workspace", task.workspace.id, "parameters"],
-		queryFn: () => API.getWorkspaceParameters(task.workspace),
+		queryKey: ["workspace", workspace.id, "parameters"],
+		queryFn: () => API.getWorkspaceParameters(workspace),
 	});
 
 	const mutateStartWorkspace = useMutation({
-		...startWorkspace(task?.workspace, queryClient),
+		...startWorkspace(workspace, queryClient),
 		onError: (error: unknown) => {
 			if (!isApiError(error)) {
 				displayError(getErrorMessage(error, "Failed to build workspace."));
@@ -248,27 +253,27 @@ const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ task }) => {
 				error={apiError}
 				onClose={mutateStartWorkspace.reset}
 				showDetail={true}
-				workspaceOwner={task.workspace.owner_name}
-				workspaceName={task.workspace.name}
-				templateVersionId={task.workspace.latest_build.template_version_id}
+				workspaceOwner={workspace.owner_name}
+				workspaceName={workspace.name}
+				templateVersionId={workspace.latest_build.template_version_id}
 				isDeleting={false}
 			/>
 		</Margins>
 	);
 };
 
-type TaskBuildingWorkspaceProps = { task: Task };
+type BuildingWorkspaceProps = { workspace: Workspace };
 
-const TaskBuildingWorkspace: FC<TaskBuildingWorkspaceProps> = ({ task }) => {
+const BuildingWorkspace: FC<BuildingWorkspaceProps> = ({ workspace }) => {
 	const { data: template } = useQuery(
-		templateQueryOptions(task.workspace.template_id),
+		templateQueryOptions(workspace.template_id),
 	);
 
-	const buildLogs = useWorkspaceBuildLogs(task?.workspace.latest_build.id);
+	const buildLogs = useWorkspaceBuildLogs(workspace.latest_build.id);
 
 	// If no template yet, use an indeterminate progress bar.
 	const transitionStats = (template &&
-		getActiveTransitionStats(template, task.workspace)) || {
+		getActiveTransitionStats(template, workspace)) || {
 		P50: 0,
 		P95: null,
 	};
@@ -303,7 +308,7 @@ const TaskBuildingWorkspace: FC<TaskBuildingWorkspaceProps> = ({ task }) => {
 
 					<div className="w-full max-w-screen-lg flex flex-col gap-4 overflow-hidden">
 						<WorkspaceBuildProgress
-							workspace={task.workspace}
+							workspace={workspace}
 							transitionStats={transitionStats}
 							variant="task"
 						/>
@@ -376,44 +381,8 @@ const TaskStartingAgent: FC<TaskStartingAgentProps> = ({ agent }) => {
 	);
 };
 
-export class WorkspaceDoesNotHaveAITaskError extends Error {
-	constructor(workspace: Workspace) {
-		super(
-			`Workspace ${workspace.owner_name}/${workspace.name} is not running an AI task`,
-		);
-		this.name = "WorkspaceDoesNotHaveAITaskError";
-	}
-}
-
-export const data = {
-	fetchTask: async (workspaceOwnerUsername: string, workspaceName: string) => {
-		const workspace = await API.getWorkspaceByOwnerAndName(
-			workspaceOwnerUsername,
-			workspaceName,
-		);
-		if (
-			workspace.latest_build.job.completed_at &&
-			!workspace.latest_build.has_ai_task
-		) {
-			throw new WorkspaceDoesNotHaveAITaskError(workspace);
-		}
-
-		const parameters = await API.getWorkspaceBuildParameters(
-			workspace.latest_build.id,
-		);
-		const prompt =
-			parameters.find((p) => p.name === AI_PROMPT_PARAMETER_NAME)?.value ??
-			"Unknown prompt";
-
-		return {
-			workspace,
-			prompt,
-		} satisfies Task;
-	},
-};
-
-function selectAgent(task: Task) {
-	const agents = task.workspace.latest_build.resources
+function selectAgent(workspace: Workspace) {
+	const agents = workspace.latest_build.resources
 		.flatMap((r) => r.agents)
 		.filter((a) => !!a);
 
diff --git a/site/src/pages/TaskPage/TaskTopbar.tsx b/site/src/pages/TaskPage/TaskTopbar.tsx
index 989e1b6473416..3d22631ae14b8 100644
--- a/site/src/pages/TaskPage/TaskTopbar.tsx
+++ b/site/src/pages/TaskPage/TaskTopbar.tsx
@@ -1,3 +1,4 @@
+import type { Task, Workspace } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import {
 	Tooltip,
@@ -13,14 +14,13 @@ import {
 	LaptopMinimalIcon,
 	TerminalIcon,
 } from "lucide-react";
-import type { Task } from "modules/tasks/tasks";
 import type { FC } from "react";
 import { Link as RouterLink } from "react-router";
 import { TaskStatusLink } from "./TaskStatusLink";
 
-type TaskTopbarProps = { task: Task };
+type TaskTopbarProps = { task: Task; workspace: Workspace };
 
-export const TaskTopbar: FC<TaskTopbarProps> = ({ task }) => {
+export const TaskTopbar: FC<TaskTopbarProps> = ({ task, workspace }) => {
 	return (
 		<header className="flex flex-shrink-0 items-center p-3 border-solid border-border border-0 border-b">
 			<TooltipProvider>
@@ -37,13 +37,11 @@ export const TaskTopbar: FC<TaskTopbarProps> = ({ task }) => {
 				</Tooltip>
 			</TooltipProvider>
 
-			<h1 className="m-0 pl-2 text-base font-medium truncate">
-				{task.workspace.name}
-			</h1>
+			<h1 className="m-0 pl-2 text-base font-medium truncate">{task.name}</h1>
 
-			{task.workspace.latest_app_status?.uri && (
+			{task.current_state?.uri && (
 				<div className="flex items-center gap-2 flex-wrap ml-4">
-					<TaskStatusLink uri={task.workspace.latest_app_status.uri} />
+					<TaskStatusLink uri={task.current_state.uri} />
 				</div>
 			)}
 
@@ -58,17 +56,15 @@ export const TaskTopbar: FC<TaskTopbarProps> = ({ task }) => {
 						</TooltipTrigger>
 						<TooltipContent className="max-w-xs bg-surface-secondary p-4">
 							<p className="m-0 mb-2 select-all text-sm font-normal text-content-primary leading-snug">
-								{task.prompt}
+								{task.initial_prompt}
 							</p>
-							<CopyPromptButton prompt={task.prompt} />
+							<CopyPromptButton prompt={task.initial_prompt} />
 						</TooltipContent>
 					</Tooltip>
 				</TooltipProvider>
 
 				<Button asChild variant="outline" size="sm">
-					<RouterLink
-						to={`/@${task.workspace.owner_name}/${task.workspace.name}`}
-					>
+					<RouterLink to={`/@${workspace.owner_name}/${workspace.name}`}>
 						<LaptopMinimalIcon />
 						Workspace
 					</RouterLink>
diff --git a/site/src/pages/TasksPage/TasksPage.stories.tsx b/site/src/pages/TasksPage/TasksPage.stories.tsx
index fed841e0e6c6d..9bc3a82ad05d9 100644
--- a/site/src/pages/TasksPage/TasksPage.stories.tsx
+++ b/site/src/pages/TasksPage/TasksPage.stories.tsx
@@ -105,26 +105,6 @@ export const LoadedTasks: Story = {
 	},
 };
 
-export const LoadedTasksWaitingForInput: Story = {
-	beforeEach: () => {
-		const [firstTask, ...otherTasks] = MockTasks;
-		spyOn(API, "getTemplates").mockResolvedValue([MockTemplate]);
-		spyOn(API.experimental, "getTasks").mockResolvedValue([
-			{
-				...firstTask,
-				workspace: {
-					...firstTask.workspace,
-					latest_app_status: {
-						...firstTask.workspace.latest_app_status,
-						state: "idle",
-					},
-				},
-			},
-			...otherTasks,
-		]);
-	},
-};
-
 export const LoadedTasksWaitingForInputTab: Story = {
 	beforeEach: () => {
 		const [firstTask, ...otherTasks] = MockTasks;
@@ -132,12 +112,9 @@ export const LoadedTasksWaitingForInputTab: Story = {
 		spyOn(API.experimental, "getTasks").mockResolvedValue([
 			{
 				...firstTask,
-				workspace: {
-					...firstTask.workspace,
-					latest_app_status: {
-						...firstTask.workspace.latest_app_status,
-						state: "idle" as const,
-					},
+				current_state: {
+					...firstTask.current_state,
+					state: "idle",
 				},
 			},
 			...otherTasks,
diff --git a/site/src/pages/TasksPage/TasksPage.tsx b/site/src/pages/TasksPage/TasksPage.tsx
index 06da02a278953..0d7dee5bb7ace 100644
--- a/site/src/pages/TasksPage/TasksPage.tsx
+++ b/site/src/pages/TasksPage/TasksPage.tsx
@@ -1,5 +1,6 @@
-import { API, type TasksFilter } from "api/api";
+import { API } from "api/api";
 import { templates } from "api/queries/templates";
+import type { TasksFilter } from "api/typesGenerated";
 import { Badge } from "components/Badge/Badge";
 import { Button, type ButtonProps } from "components/Button/Button";
 import { FeatureStageBadge } from "components/FeatureStageBadge/FeatureStageBadge";
@@ -27,8 +28,8 @@ const TasksPage: FC = () => {
 	);
 
 	const { user, permissions } = useAuthenticated();
-	const userFilter = useSearchParamsKey({
-		key: "username",
+	const ownerFilter = useSearchParamsKey({
+		key: "owner",
 		defaultValue: user.username,
 	});
 	const tab = useSearchParamsKey({
@@ -36,24 +37,15 @@ const TasksPage: FC = () => {
 		defaultValue: "all",
 	});
 	const filter: TasksFilter = {
-		username: userFilter.value,
+		owner: ownerFilter.value,
 	};
 	const tasksQuery = useQuery({
 		queryKey: ["tasks", filter],
 		queryFn: () => API.experimental.getTasks(filter),
 		refetchInterval: 10_000,
-		// TODO: Switch to sorting by latest_status_app.created_at once it’s reliable.
-		// Currently, it doesn’t always update fast enough for a good UX, so we’re
-		// temporarily sorting by workspace.created_at instead.
-		select: (tasks) =>
-			tasks.toSorted(
-				(a, b) =>
-					new Date(b.workspace.created_at).getTime() -
-					new Date(a.workspace.created_at).getTime(),
-			),
 	});
 	const idleTasks = tasksQuery.data?.filter(
-		(task) => task.workspace.latest_app_status?.state === "idle",
+		(task) => task.current_state?.state === "idle",
 	);
 	const displayedTasks =
 		tab.value === "waiting-for-input" ? idleTasks : tasksQuery.data;
@@ -105,10 +97,10 @@ const TasksPage: FC = () => {
 									</div>
 
 									<UsersCombobox
-										value={userFilter.value}
+										value={ownerFilter.value}
 										onValueChange={(username) => {
-											userFilter.setValue(
-												username === userFilter.value ? "" : username,
+											ownerFilter.setValue(
+												username === ownerFilter.value ? "" : username,
 											);
 										}}
 									/>
diff --git a/site/src/pages/TasksPage/TasksTable.tsx b/site/src/pages/TasksPage/TasksTable.tsx
index 8af0039b63911..be0700c815dc1 100644
--- a/site/src/pages/TasksPage/TasksTable.tsx
+++ b/site/src/pages/TasksPage/TasksTable.tsx
@@ -1,4 +1,5 @@
 import { getErrorDetail, getErrorMessage } from "api/errors";
+import type { Task } from "api/typesGenerated";
 import { Avatar } from "components/Avatar/Avatar";
 import { AvatarData } from "components/Avatar/AvatarData";
 import { AvatarDataSkeleton } from "components/Avatar/AvatarDataSkeleton";
@@ -24,15 +25,13 @@ import {
 } from "components/Tooltip/Tooltip";
 import { RotateCcwIcon, TrashIcon } from "lucide-react";
 import { TaskDeleteDialog } from "modules/tasks/TaskDeleteDialog/TaskDeleteDialog";
-import type { Task } from "modules/tasks/tasks";
-import { WorkspaceAppStatus } from "modules/workspaces/WorkspaceAppStatus/WorkspaceAppStatus";
-import { WorkspaceStatus } from "modules/workspaces/WorkspaceStatus/WorkspaceStatus";
+import { TaskStatus } from "modules/tasks/TaskStatus/TaskStatus";
 import { type FC, type ReactNode, useState } from "react";
 import { Link as RouterLink } from "react-router";
 import { relativeTime } from "utils/time";
 
 type TasksTableProps = {
-	tasks: Task[] | undefined;
+	tasks: readonly Task[] | undefined;
 	error: unknown;
 	onRetry: () => void;
 };
@@ -47,7 +46,7 @@ export const TasksTable: FC<TasksTableProps> = ({ tasks, error, onRetry }) => {
 	} else if (tasks.length === 0) {
 		body = <TasksEmpty />;
 	} else {
-		body = tasks.map((task) => <TaskRow key={task.workspace.id} task={task} />);
+		body = tasks.map((task) => <TaskRow key={task.id} task={task} />);
 	}
 
 	return (
@@ -55,8 +54,7 @@ export const TasksTable: FC<TasksTableProps> = ({ tasks, error, onRetry }) => {
 			<TableHeader>
 				<TableRow>
 					<TableHead>Task</TableHead>
-					<TableHead>Agent status</TableHead>
-					<TableHead>Workspace status</TableHead>
+					<TableHead>Status</TableHead>
 					<TableHead>Created by</TableHead>
 					<TableHead />
 				</TableRow>
@@ -74,7 +72,7 @@ type TasksErrorBodyProps = {
 const TasksErrorBody: FC<TasksErrorBodyProps> = ({ error, onRetry }) => {
 	return (
 		<TableRow>
-			<TableCell colSpan={5} className="text-center">
+			<TableCell colSpan={999} className="text-center">
 				<div className="rounded-lg w-full min-h-80 flex items-center justify-center">
 					<div className="flex flex-col items-center">
 						<h3 className="m-0 font-medium text-content-primary text-base">
@@ -97,7 +95,7 @@ const TasksErrorBody: FC<TasksErrorBodyProps> = ({ error, onRetry }) => {
 const TasksEmpty: FC = () => {
 	return (
 		<TableRow>
-			<TableCell colSpan={5} className="text-center">
+			<TableCell colSpan={999} className="text-center">
 				<div className="w-full min-h-80 p-4 flex items-center justify-center">
 					<div className="flex flex-col items-center">
 						<h3 className="m-0 font-medium text-content-primary text-base">
@@ -117,21 +115,20 @@ type TaskRowProps = { task: Task };
 
 const TaskRow: FC<TaskRowProps> = ({ task }) => {
 	const [isDeleteDialogOpen, setIsDeleteDialogOpen] = useState(false);
-	const templateDisplayName =
-		task.workspace.template_display_name ?? task.workspace.template_name;
+	const templateDisplayName = task.template_display_name ?? task.template_name;
 
 	return (
 		<>
-			<TableRow key={task.workspace.id} className="relative" hover>
+			<TableRow className="relative" hover>
 				<TableCell>
 					<AvatarData
 						title={
 							<>
 								<span className="block max-w-[520px] overflow-hidden text-ellipsis whitespace-nowrap">
-									{task.prompt}
+									{task.initial_prompt}
 								</span>
 								<RouterLink
-									to={`/tasks/${task.workspace.owner_name}/${task.workspace.name}`}
+									to={`/tasks/${task.owner_name}/${task.id}`}
 									className="absolute inset-0"
 								>
 									<span className="sr-only">Access task</span>
@@ -143,30 +140,28 @@ const TaskRow: FC<TaskRowProps> = ({ task }) => {
 							<Avatar
 								size="lg"
 								variant="icon"
-								src={task.workspace.template_icon}
+								src={task.template_icon}
 								fallback={templateDisplayName}
 							/>
 						}
 					/>
 				</TableCell>
 				<TableCell>
-					<WorkspaceAppStatus
-						disabled={task.workspace.latest_build.status !== "running"}
-						status={task.workspace.latest_app_status}
+					<TaskStatus
+						status={task.status}
+						stateMessage={task.current_state?.message || "No message available"}
 					/>
 				</TableCell>
-				<TableCell>
-					<WorkspaceStatus workspace={task.workspace} />
-				</TableCell>
+
 				<TableCell>
 					<AvatarData
-						title={task.workspace.owner_name}
+						title={task.owner_name}
 						subtitle={
 							<span className="block first-letter:uppercase">
-								{relativeTime(new Date(task.workspace.created_at))}
+								{relativeTime(new Date(task.created_at))}
 							</span>
 						}
-						src={task.workspace.owner_avatar_url}
+						src={task.owner_avatar_url}
 					/>
 				</TableCell>
 				<TableCell className="text-right">
@@ -210,9 +205,6 @@ const TasksSkeleton: FC = () => {
 				<TableCell>
 					<Skeleton className="w-[100px] h-6" />
 				</TableCell>
-				<TableCell>
-					<Skeleton className="w-[100px] h-6" />
-				</TableCell>
 				<TableCell>
 					<AvatarDataSkeleton />
 				</TableCell>
diff --git a/site/src/router.tsx b/site/src/router.tsx
index 6aaefb77d8731..c0da37b6810ec 100644
--- a/site/src/router.tsx
+++ b/site/src/router.tsx
@@ -597,7 +597,7 @@ export const router = createBrowserRouter(
 				/>
 				<Route path="/cli-auth" element={<CliAuthPage />} />
 				<Route path="/icons" element={<IconsPage />} />
-				<Route path="/tasks/:username/:workspace" element={<TaskPage />} />
+				<Route path="/tasks/:username/:taskId" element={<TaskPage />} />
 			</Route>
 		</Route>,
 	),
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index c0f11f2f133f0..18eb661ea72e3 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -4984,54 +4984,20 @@ export const MockAIPromptPresets: TypesGen.Preset[] = [
 	},
 ];
 
-// Mock Tasks for AI Tasks page
-export const MockTasks = [
-	{
-		workspace: {
-			...MockWorkspace,
-			name: "create-competitors-page",
-			latest_app_status: MockWorkspaceAppStatus,
-		},
-		prompt: "Create competitors page",
-	},
-	{
-		workspace: {
-			...MockWorkspace,
-			id: "workspace-2",
-			name: "fix-avatar-size",
-			latest_app_status: {
-				...MockWorkspaceAppStatus,
-				message: "Avatar size fixed!",
-			},
-		},
-		prompt: "Fix user avatar size",
-	},
-	{
-		workspace: {
-			...MockWorkspace,
-			id: "workspace-3",
-			name: "fix-accessibility-issues",
-			latest_app_status: {
-				...MockWorkspaceAppStatus,
-				message: "Accessibility issues fixed!",
-			},
-		},
-		prompt: "Fix accessibility issues",
-	},
-];
-
-export const MockTask: TypesGen.Task = {
+export const MockTask = {
 	id: "test-task",
 	name: "task-wild-test-123",
 	organization_id: MockOrganization.id,
 	owner_id: MockUserOwner.id,
 	owner_name: MockUserOwner.username,
+	owner_avatar_url: MockUserOwner.avatar_url,
 	template_id: MockTemplate.id,
 	template_name: MockTemplate.name,
 	template_display_name: MockTemplate.display_name,
 	template_icon: MockTemplate.icon,
 	template_version_id: MockTemplateVersion.id,
 	workspace_id: MockWorkspace.id,
+	workspace_name: MockWorkspace.name,
 	workspace_status: "running",
 	workspace_build_number: MockWorkspaceBuild.build_number,
 	workspace_agent_id: MockWorkspaceAgent.id,
@@ -5048,16 +5014,28 @@ export const MockTask: TypesGen.Task = {
 	},
 	created_at: "2022-05-17T17:39:01.382927298Z",
 	updated_at: "2022-05-17T17:39:01.382927298Z",
-};
+} satisfies TypesGen.Task;
 
-export const MockNewTaskData = {
-	prompt: "Create a new task",
-	workspace: {
-		...MockWorkspace,
-		id: "workspace-4",
-		latest_app_status: {
-			...MockWorkspaceAppStatus,
-			message: "Task created successfully!",
+export const MockTasks = [
+	MockTask,
+	{
+		...MockTask,
+		id: "task-2",
+		name: "fix-avatar-size",
+		current_state: {
+			...MockTask.current_state,
+			message: "Avatar size fixed!",
+			state: "complete",
 		},
 	},
-};
+	{
+		...MockTask,
+		id: "task-3",
+		name: "fix-accessibility-issues",
+		current_state: {
+			...MockTask.current_state,
+			message: "Accessibility issues fixed!",
+			state: "complete",
+		},
+	},
+] satisfies TypesGen.Task[];

From 6c621364f8c5c82eb9f8e8dc9a9d2105f9cabd6e Mon Sep 17 00:00:00 2001
From: Sas Swart <sas.swart.cdk@gmail.com>
Date: Fri, 24 Oct 2025 16:18:16 +0200
Subject: [PATCH 238/298] feat: add a dependency management graph for agents
 (#20208)

Relates to https://github.com/coder/internal/issues/1093

This is the first of N pull requests to allow coder script ordering.
It introduces what is for now dead code, but paves the way for various
interfaces that allow coder scripts and other processes to depend on one
another via CLI commands and terraform configurations.

The next step is to add reactivity to the graph, such that changes in
the status of one vertex will propagate and allow other vertices to
change their own statuses.

Concurrency and stress testing yield the following:

CPU Profile:
<img width="1512" height="862" alt="Screenshot 2025-10-17 at 10 38 52"
src="https://github.com/user-attachments/assets/f46cf1a2-a0b2-4c02-81a0-069798108ee5"
/>

Mem Profile:
<img width="1512" height="862" alt="Screenshot 2025-10-17 at 10 38 01"
src="https://github.com/user-attachments/assets/45be1235-fff6-45ba-a50d-db9880377bd0"
/>

Predictably, lock contention and memory allocation are the largest
components of this system under stress. Nothing seems untoward.
---
 .gitignore                                    |   3 +
 Makefile                                      |   5 +
 agent/unit/graph.go                           | 174 +++++++
 agent/unit/graph_test.go                      | 454 ++++++++++++++++++
 agent/unit/testdata/Cycle.golden              |   8 +
 .../testdata/ForwardAndReverseEdges.golden    |  10 +
 .../MultipleDependenciesSameStatus.golden     |  12 +
 agent/unit/testdata/SelfReference.golden      |   4 +
 go.mod                                        |   1 +
 9 files changed, 671 insertions(+)
 create mode 100644 agent/unit/graph.go
 create mode 100644 agent/unit/graph_test.go
 create mode 100644 agent/unit/testdata/Cycle.golden
 create mode 100644 agent/unit/testdata/ForwardAndReverseEdges.golden
 create mode 100644 agent/unit/testdata/MultipleDependenciesSameStatus.golden
 create mode 100644 agent/unit/testdata/SelfReference.golden

diff --git a/.gitignore b/.gitignore
index 5aa08b2512527..86f70cc3afd3e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -12,6 +12,9 @@ node_modules/
 vendor/
 yarn-error.log
 
+# Test output files
+test-output/
+
 # VSCode settings.
 **/.vscode/*
 # Allow VSCode recommendations and default settings in project root.
diff --git a/Makefile b/Makefile
index 8b17b88e2069e..93b0245a8a01f 100644
--- a/Makefile
+++ b/Makefile
@@ -676,6 +676,7 @@ gen/db: $(DB_GEN_FILES)
 .PHONY: gen/db
 
 gen/golden-files: \
+	agent/unit/testdata/.gen-golden \
 	cli/testdata/.gen-golden \
 	coderd/.gen-golden \
 	coderd/notifications/.gen-golden \
@@ -952,6 +953,10 @@ clean/golden-files:
 		-type f -name '*.golden' -delete
 .PHONY: clean/golden-files
 
+agent/unit/testdata/.gen-golden: $(wildcard agent/unit/testdata/*.golden) $(GO_SRC_FILES) $(wildcard agent/unit/*_test.go)
+	TZ=UTC go test ./agent/unit -run="TestGraph" -update
+	touch "$@"
+
 cli/testdata/.gen-golden: $(wildcard cli/testdata/*.golden) $(wildcard cli/*.tpl) $(GO_SRC_FILES) $(wildcard cli/*_test.go)
 	TZ=UTC go test ./cli -run="Test(CommandHelp|ServerYAML|ErrorExamples|.*Golden)" -update
 	touch "$@"
diff --git a/agent/unit/graph.go b/agent/unit/graph.go
new file mode 100644
index 0000000000000..3d8a6703addf2
--- /dev/null
+++ b/agent/unit/graph.go
@@ -0,0 +1,174 @@
+package unit
+
+import (
+	"fmt"
+	"sync"
+
+	"golang.org/x/xerrors"
+	"gonum.org/v1/gonum/graph/encoding/dot"
+	"gonum.org/v1/gonum/graph/simple"
+	"gonum.org/v1/gonum/graph/topo"
+)
+
+// Graph provides a bidirectional interface over gonum's directed graph implementation.
+// While the underlying gonum graph is directed, we overlay bidirectional semantics
+// by distinguishing between forward and reverse edges. Wanting and being wanted by
+// other units are related but different concepts that have different graph traversal
+// implications when Units update their status.
+//
+// The graph stores edge types to represent different relationships between units,
+// allowing for domain-specific semantics beyond simple connectivity.
+type Graph[EdgeType, VertexType comparable] struct {
+	mu sync.RWMutex
+	// The underlying gonum graph. It stores vertices and edges without knowing about the types of the vertices and edges.
+	gonumGraph *simple.DirectedGraph
+	// Maps vertices to their IDs so that a gonum vertex ID can be used to lookup the vertex type.
+	vertexToID map[VertexType]int64
+	// Maps vertex IDs to their types so that a vertex type can be used to lookup the gonum vertex ID.
+	idToVertex map[int64]VertexType
+	// The next ID to assign to a vertex.
+	nextID int64
+	// Store edge types by "fromID->toID" key. This is used to lookup the edge type for a given edge.
+	edgeTypes map[string]EdgeType
+}
+
+// Edge is a convenience type for representing an edge in the graph.
+// It encapsulates the from and to vertices and the edge type itself.
+type Edge[EdgeType, VertexType comparable] struct {
+	From VertexType
+	To   VertexType
+	Edge EdgeType
+}
+
+// AddEdge adds an edge to the graph. It initializes the graph and metadata on first use,
+// checks for cycles, and adds the edge to the gonum graph.
+func (g *Graph[EdgeType, VertexType]) AddEdge(from, to VertexType, edge EdgeType) error {
+	g.mu.Lock()
+	defer g.mu.Unlock()
+
+	if g.gonumGraph == nil {
+		g.gonumGraph = simple.NewDirectedGraph()
+		g.vertexToID = make(map[VertexType]int64)
+		g.idToVertex = make(map[int64]VertexType)
+		g.edgeTypes = make(map[string]EdgeType)
+		g.nextID = 1
+	}
+
+	fromID := g.getOrCreateVertexID(from)
+	toID := g.getOrCreateVertexID(to)
+
+	if g.canReach(to, from) {
+		return xerrors.Errorf("adding edge (%v -> %v) would create a cycle", from, to)
+	}
+
+	g.gonumGraph.SetEdge(simple.Edge{F: simple.Node(fromID), T: simple.Node(toID)})
+
+	edgeKey := fmt.Sprintf("%d->%d", fromID, toID)
+	g.edgeTypes[edgeKey] = edge
+
+	return nil
+}
+
+// GetForwardAdjacentVertices returns all the edges that originate from the given vertex.
+func (g *Graph[EdgeType, VertexType]) GetForwardAdjacentVertices(from VertexType) []Edge[EdgeType, VertexType] {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+
+	fromID, exists := g.vertexToID[from]
+	if !exists {
+		return []Edge[EdgeType, VertexType]{}
+	}
+
+	edges := []Edge[EdgeType, VertexType]{}
+	toNodes := g.gonumGraph.From(fromID)
+	for toNodes.Next() {
+		toID := toNodes.Node().ID()
+		to := g.idToVertex[toID]
+
+		// Get the edge type
+		edgeKey := fmt.Sprintf("%d->%d", fromID, toID)
+		edgeType := g.edgeTypes[edgeKey]
+
+		edges = append(edges, Edge[EdgeType, VertexType]{From: from, To: to, Edge: edgeType})
+	}
+
+	return edges
+}
+
+// GetReverseAdjacentVertices returns all the edges that terminate at the given vertex.
+func (g *Graph[EdgeType, VertexType]) GetReverseAdjacentVertices(to VertexType) []Edge[EdgeType, VertexType] {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+
+	toID, exists := g.vertexToID[to]
+	if !exists {
+		return []Edge[EdgeType, VertexType]{}
+	}
+
+	edges := []Edge[EdgeType, VertexType]{}
+	fromNodes := g.gonumGraph.To(toID)
+	for fromNodes.Next() {
+		fromID := fromNodes.Node().ID()
+		from := g.idToVertex[fromID]
+
+		// Get the edge type
+		edgeKey := fmt.Sprintf("%d->%d", fromID, toID)
+		edgeType := g.edgeTypes[edgeKey]
+
+		edges = append(edges, Edge[EdgeType, VertexType]{From: from, To: to, Edge: edgeType})
+	}
+
+	return edges
+}
+
+// getOrCreateVertexID returns the ID for a vertex, creating it if it doesn't exist.
+func (g *Graph[EdgeType, VertexType]) getOrCreateVertexID(vertex VertexType) int64 {
+	if id, exists := g.vertexToID[vertex]; exists {
+		return id
+	}
+
+	id := g.nextID
+	g.nextID++
+	g.vertexToID[vertex] = id
+	g.idToVertex[id] = vertex
+
+	// Add the node to the gonum graph
+	g.gonumGraph.AddNode(simple.Node(id))
+
+	return id
+}
+
+// canReach checks if there is a path from the start vertex to the end vertex.
+func (g *Graph[EdgeType, VertexType]) canReach(start, end VertexType) bool {
+	if start == end {
+		return true
+	}
+
+	startID, startExists := g.vertexToID[start]
+	endID, endExists := g.vertexToID[end]
+
+	if !startExists || !endExists {
+		return false
+	}
+
+	// Use gonum's built-in path existence check
+	return topo.PathExistsIn(g.gonumGraph, simple.Node(startID), simple.Node(endID))
+}
+
+// ToDOT exports the graph to DOT format for visualization
+func (g *Graph[EdgeType, VertexType]) ToDOT(name string) (string, error) {
+	g.mu.RLock()
+	defer g.mu.RUnlock()
+
+	if g.gonumGraph == nil {
+		return "", xerrors.New("graph is not initialized")
+	}
+
+	// Marshal the graph to DOT format
+	dotBytes, err := dot.Marshal(g.gonumGraph, name, "", "  ")
+	if err != nil {
+		return "", xerrors.Errorf("failed to marshal graph to DOT: %w", err)
+	}
+
+	return string(dotBytes), nil
+}
diff --git a/agent/unit/graph_test.go b/agent/unit/graph_test.go
new file mode 100644
index 0000000000000..3c76756aee88c
--- /dev/null
+++ b/agent/unit/graph_test.go
@@ -0,0 +1,454 @@
+// Package unit_test provides tests for the unit package.
+//
+// DOT Graph Testing:
+// The graph tests use golden files for DOT representation verification.
+// To update the golden files:
+// make gen/golden-files
+//
+// The golden files contain the expected DOT representation and can be easily
+// inspected, version controlled, and updated when the graph structure changes.
+package unit_test
+
+import (
+	"bytes"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sync"
+	"testing"
+
+	"github.com/google/go-cmp/cmp"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+
+	"github.com/coder/coder/v2/agent/unit"
+	"github.com/coder/coder/v2/cryptorand"
+)
+
+type testGraphEdge string
+
+const (
+	testEdgeStarted   testGraphEdge = "started"
+	testEdgeCompleted testGraphEdge = "completed"
+)
+
+type testGraphVertex struct {
+	Name string
+}
+
+type (
+	testGraph = unit.Graph[testGraphEdge, *testGraphVertex]
+	testEdge  = unit.Edge[testGraphEdge, *testGraphVertex]
+)
+
+// randInt generates a random integer in the range [0, limit).
+func randInt(limit int) int {
+	if limit <= 0 {
+		return 0
+	}
+	n, err := cryptorand.Int63n(int64(limit))
+	if err != nil {
+		return 0
+	}
+	return int(n)
+}
+
+// UpdateGoldenFiles indicates golden files should be updated.
+// To update the golden files:
+// make gen/golden-files
+var UpdateGoldenFiles = flag.Bool("update", false, "update .golden files")
+
+// assertDOTGraph requires that the graph's DOT representation matches the golden file
+func assertDOTGraph(t *testing.T, graph *testGraph, goldenName string) {
+	t.Helper()
+
+	dot, err := graph.ToDOT(goldenName)
+	require.NoError(t, err)
+
+	goldenFile := filepath.Join("testdata", goldenName+".golden")
+	if *UpdateGoldenFiles {
+		t.Logf("update golden file for: %q: %s", goldenName, goldenFile)
+		err := os.MkdirAll(filepath.Dir(goldenFile), 0o755)
+		require.NoError(t, err, "want no error creating golden file directory")
+		err = os.WriteFile(goldenFile, []byte(dot), 0o600)
+		require.NoError(t, err, "update golden file")
+	}
+
+	expected, err := os.ReadFile(goldenFile)
+	require.NoError(t, err, "read golden file, run \"make gen/golden-files\" and commit the changes")
+
+	// Normalize line endings for cross-platform compatibility
+	expected = normalizeLineEndings(expected)
+	normalizedDot := normalizeLineEndings([]byte(dot))
+
+	assert.Empty(t, cmp.Diff(string(expected), string(normalizedDot)), "golden file mismatch (-want +got): %s, run \"make gen/golden-files\", verify and commit the changes", goldenFile)
+}
+
+// normalizeLineEndings ensures that all line endings are normalized to \n.
+// Required for Windows compatibility.
+func normalizeLineEndings(content []byte) []byte {
+	content = bytes.ReplaceAll(content, []byte("\r\n"), []byte("\n"))
+	content = bytes.ReplaceAll(content, []byte("\r"), []byte("\n"))
+	return content
+}
+
+func TestGraph(t *testing.T) {
+	t.Parallel()
+
+	testFuncs := map[string]func(t *testing.T) *unit.Graph[testGraphEdge, *testGraphVertex]{
+		"ForwardAndReverseEdges": func(t *testing.T) *unit.Graph[testGraphEdge, *testGraphVertex] {
+			graph := &unit.Graph[testGraphEdge, *testGraphVertex]{}
+			unit1 := &testGraphVertex{Name: "unit1"}
+			unit2 := &testGraphVertex{Name: "unit2"}
+			unit3 := &testGraphVertex{Name: "unit3"}
+			err := graph.AddEdge(unit1, unit2, testEdgeCompleted)
+			require.NoError(t, err)
+			err = graph.AddEdge(unit1, unit3, testEdgeStarted)
+			require.NoError(t, err)
+
+			// Check for forward edge
+			vertices := graph.GetForwardAdjacentVertices(unit1)
+			require.Len(t, vertices, 2)
+			// Unit 1 depends on the completion of Unit2
+			require.Contains(t, vertices, testEdge{
+				From: unit1,
+				To:   unit2,
+				Edge: testEdgeCompleted,
+			})
+			// Unit 1 depends on the start of Unit3
+			require.Contains(t, vertices, testEdge{
+				From: unit1,
+				To:   unit3,
+				Edge: testEdgeStarted,
+			})
+
+			// Check for reverse edges
+			unit2ReverseEdges := graph.GetReverseAdjacentVertices(unit2)
+			require.Len(t, unit2ReverseEdges, 1)
+			// Unit 2 must be completed before Unit 1 can start
+			require.Contains(t, unit2ReverseEdges, testEdge{
+				From: unit1,
+				To:   unit2,
+				Edge: testEdgeCompleted,
+			})
+
+			unit3ReverseEdges := graph.GetReverseAdjacentVertices(unit3)
+			require.Len(t, unit3ReverseEdges, 1)
+			// Unit 3 must be started before Unit 1 can complete
+			require.Contains(t, unit3ReverseEdges, testEdge{
+				From: unit1,
+				To:   unit3,
+				Edge: testEdgeStarted,
+			})
+
+			return graph
+		},
+		"SelfReference": func(t *testing.T) *testGraph {
+			graph := &testGraph{}
+			unit1 := &testGraphVertex{Name: "unit1"}
+			err := graph.AddEdge(unit1, unit1, testEdgeCompleted)
+			require.Error(t, err)
+			require.ErrorContains(t, err, fmt.Sprintf("adding edge (%v -> %v) would create a cycle", unit1, unit1))
+
+			return graph
+		},
+		"Cycle": func(t *testing.T) *testGraph {
+			graph := &testGraph{}
+			unit1 := &testGraphVertex{Name: "unit1"}
+			unit2 := &testGraphVertex{Name: "unit2"}
+			err := graph.AddEdge(unit1, unit2, testEdgeCompleted)
+			require.NoError(t, err)
+			err = graph.AddEdge(unit2, unit1, testEdgeStarted)
+			require.Error(t, err)
+			require.ErrorContains(t, err, fmt.Sprintf("adding edge (%v -> %v) would create a cycle", unit2, unit1))
+
+			return graph
+		},
+		"MultipleDependenciesSameStatus": func(t *testing.T) *testGraph {
+			graph := &testGraph{}
+			unit1 := &testGraphVertex{Name: "unit1"}
+			unit2 := &testGraphVertex{Name: "unit2"}
+			unit3 := &testGraphVertex{Name: "unit3"}
+			unit4 := &testGraphVertex{Name: "unit4"}
+
+			// Unit1 depends on completion of both unit2 and unit3 (same status type)
+			err := graph.AddEdge(unit1, unit2, testEdgeCompleted)
+			require.NoError(t, err)
+			err = graph.AddEdge(unit1, unit3, testEdgeCompleted)
+			require.NoError(t, err)
+
+			// Unit1 also depends on starting of unit4 (different status type)
+			err = graph.AddEdge(unit1, unit4, testEdgeStarted)
+			require.NoError(t, err)
+
+			// Check that unit1 has 3 forward dependencies
+			forwardEdges := graph.GetForwardAdjacentVertices(unit1)
+			require.Len(t, forwardEdges, 3)
+
+			// Verify all expected dependencies exist
+			expectedDependencies := []testEdge{
+				{From: unit1, To: unit2, Edge: testEdgeCompleted},
+				{From: unit1, To: unit3, Edge: testEdgeCompleted},
+				{From: unit1, To: unit4, Edge: testEdgeStarted},
+			}
+
+			for _, expected := range expectedDependencies {
+				require.Contains(t, forwardEdges, expected)
+			}
+
+			// Check reverse dependencies
+			unit2ReverseEdges := graph.GetReverseAdjacentVertices(unit2)
+			require.Len(t, unit2ReverseEdges, 1)
+			require.Contains(t, unit2ReverseEdges, testEdge{
+				From: unit1, To: unit2, Edge: testEdgeCompleted,
+			})
+
+			unit3ReverseEdges := graph.GetReverseAdjacentVertices(unit3)
+			require.Len(t, unit3ReverseEdges, 1)
+			require.Contains(t, unit3ReverseEdges, testEdge{
+				From: unit1, To: unit3, Edge: testEdgeCompleted,
+			})
+
+			unit4ReverseEdges := graph.GetReverseAdjacentVertices(unit4)
+			require.Len(t, unit4ReverseEdges, 1)
+			require.Contains(t, unit4ReverseEdges, testEdge{
+				From: unit1, To: unit4, Edge: testEdgeStarted,
+			})
+
+			return graph
+		},
+	}
+
+	for testName, testFunc := range testFuncs {
+		var graph *testGraph
+		t.Run(testName, func(t *testing.T) {
+			t.Parallel()
+			graph = testFunc(t)
+			assertDOTGraph(t, graph, testName)
+		})
+	}
+}
+
+func TestGraphThreadSafety(t *testing.T) {
+	t.Parallel()
+
+	t.Run("ConcurrentReadWrite", func(t *testing.T) {
+		t.Parallel()
+
+		graph := &testGraph{}
+		var wg sync.WaitGroup
+		const numWriters = 50
+		const numReaders = 100
+		const operationsPerWriter = 1000
+		const operationsPerReader = 2000
+
+		barrier := make(chan struct{})
+		// Launch writers
+		for i := 0; i < numWriters; i++ {
+			wg.Add(1)
+			go func(writerID int) {
+				defer wg.Done()
+				<-barrier
+				for j := 0; j < operationsPerWriter; j++ {
+					from := &testGraphVertex{Name: fmt.Sprintf("writer-%d-%d", writerID, j)}
+					to := &testGraphVertex{Name: fmt.Sprintf("writer-%d-%d", writerID, j+1)}
+					graph.AddEdge(from, to, testEdgeCompleted)
+				}
+			}(i)
+		}
+
+		// Launch readers
+		readerResults := make([]struct {
+			panicked  bool
+			readCount int
+		}, numReaders)
+
+		for i := 0; i < numReaders; i++ {
+			wg.Add(1)
+			go func(readerID int) {
+				defer wg.Done()
+				<-barrier
+				defer func() {
+					if r := recover(); r != nil {
+						readerResults[readerID].panicked = true
+					}
+				}()
+
+				readCount := 0
+				for j := 0; j < operationsPerReader; j++ {
+					// Create a test vertex and read
+					testUnit := &testGraphVertex{Name: fmt.Sprintf("test-reader-%d-%d", readerID, j)}
+					forwardEdges := graph.GetForwardAdjacentVertices(testUnit)
+					reverseEdges := graph.GetReverseAdjacentVertices(testUnit)
+
+					// Just verify no panics (results may be nil for non-existent vertices)
+					_ = forwardEdges
+					_ = reverseEdges
+					readCount++
+				}
+				readerResults[readerID].readCount = readCount
+			}(i)
+		}
+
+		close(barrier)
+		wg.Wait()
+
+		// Verify no panics occurred in readers
+		for i, result := range readerResults {
+			require.False(t, result.panicked, "reader %d panicked", i)
+			require.Equal(t, operationsPerReader, result.readCount, "reader %d should have performed expected reads", i)
+		}
+	})
+
+	t.Run("ConcurrentCycleDetection", func(t *testing.T) {
+		t.Parallel()
+
+		graph := &testGraph{}
+
+		// Pre-create chain: A→B→C→D
+		unitA := &testGraphVertex{Name: "A"}
+		unitB := &testGraphVertex{Name: "B"}
+		unitC := &testGraphVertex{Name: "C"}
+		unitD := &testGraphVertex{Name: "D"}
+
+		err := graph.AddEdge(unitA, unitB, testEdgeCompleted)
+		require.NoError(t, err)
+		err = graph.AddEdge(unitB, unitC, testEdgeCompleted)
+		require.NoError(t, err)
+		err = graph.AddEdge(unitC, unitD, testEdgeCompleted)
+		require.NoError(t, err)
+
+		barrier := make(chan struct{})
+		var wg sync.WaitGroup
+		const numGoroutines = 50
+		cycleErrors := make([]error, numGoroutines)
+
+		// Launch goroutines trying to add D→A (creates cycle)
+		for i := 0; i < numGoroutines; i++ {
+			wg.Add(1)
+			go func(goroutineID int) {
+				defer wg.Done()
+				<-barrier
+				err := graph.AddEdge(unitD, unitA, testEdgeCompleted)
+				cycleErrors[goroutineID] = err
+			}(i)
+		}
+
+		close(barrier)
+		wg.Wait()
+
+		// Verify all attempts correctly returned cycle error
+		for i, err := range cycleErrors {
+			require.Error(t, err, "goroutine %d should have detected cycle", i)
+			require.Contains(t, err.Error(), "would create a cycle")
+		}
+
+		// Verify graph remains valid (original chain intact)
+		dot, err := graph.ToDOT("test")
+		require.NoError(t, err)
+		require.NotEmpty(t, dot)
+	})
+
+	t.Run("ConcurrentToDOT", func(t *testing.T) {
+		t.Parallel()
+
+		graph := &testGraph{}
+
+		// Pre-populate graph
+		for i := 0; i < 20; i++ {
+			from := &testGraphVertex{Name: fmt.Sprintf("dot-unit-%d", i)}
+			to := &testGraphVertex{Name: fmt.Sprintf("dot-unit-%d", i+1)}
+			err := graph.AddEdge(from, to, testEdgeCompleted)
+			require.NoError(t, err)
+		}
+
+		barrier := make(chan struct{})
+		var wg sync.WaitGroup
+		const numReaders = 100
+		const numWriters = 20
+		dotResults := make([]string, numReaders)
+
+		// Launch readers calling ToDOT
+		dotErrors := make([]error, numReaders)
+		for i := 0; i < numReaders; i++ {
+			wg.Add(1)
+			go func(readerID int) {
+				defer wg.Done()
+				<-barrier
+				dot, err := graph.ToDOT(fmt.Sprintf("test-%d", readerID))
+				dotErrors[readerID] = err
+				if err == nil {
+					dotResults[readerID] = dot
+				}
+			}(i)
+		}
+
+		// Launch writers adding edges
+		for i := 0; i < numWriters; i++ {
+			wg.Add(1)
+			go func(writerID int) {
+				defer wg.Done()
+				<-barrier
+				from := &testGraphVertex{Name: fmt.Sprintf("writer-dot-%d", writerID)}
+				to := &testGraphVertex{Name: fmt.Sprintf("writer-dot-target-%d", writerID)}
+				graph.AddEdge(from, to, testEdgeCompleted)
+			}(i)
+		}
+
+		close(barrier)
+		wg.Wait()
+
+		// Verify no errors occurred during DOT generation
+		for i, err := range dotErrors {
+			require.NoError(t, err, "DOT generation error at index %d", i)
+		}
+
+		// Verify all DOT results are valid
+		for i, dot := range dotResults {
+			require.NotEmpty(t, dot, "DOT result %d should not be empty", i)
+		}
+	})
+}
+
+func BenchmarkGraph_ConcurrentMixedOperations(b *testing.B) {
+	graph := &testGraph{}
+	var wg sync.WaitGroup
+	const numGoroutines = 200
+
+	b.ResetTimer()
+	for i := 0; i < b.N; i++ {
+		// Launch goroutines performing random operations
+		for j := 0; j < numGoroutines; j++ {
+			wg.Add(1)
+			go func(goroutineID int) {
+				defer wg.Done()
+				operationCount := 0
+
+				for operationCount < 50 {
+					operation := float32(randInt(100)) / 100.0
+
+					if operation < 0.6 { // 60% reads
+						// Read operation
+						testUnit := &testGraphVertex{Name: fmt.Sprintf("bench-read-%d-%d", goroutineID, operationCount)}
+						forwardEdges := graph.GetForwardAdjacentVertices(testUnit)
+						reverseEdges := graph.GetReverseAdjacentVertices(testUnit)
+
+						// Just verify no panics (results may be nil for non-existent vertices)
+						_ = forwardEdges
+						_ = reverseEdges
+					} else { // 40% writes
+						// Write operation
+						from := &testGraphVertex{Name: fmt.Sprintf("bench-write-%d-%d", goroutineID, operationCount)}
+						to := &testGraphVertex{Name: fmt.Sprintf("bench-write-target-%d-%d", goroutineID, operationCount)}
+						graph.AddEdge(from, to, testEdgeCompleted)
+					}
+
+					operationCount++
+				}
+			}(j)
+		}
+
+		wg.Wait()
+	}
+}
diff --git a/agent/unit/testdata/Cycle.golden b/agent/unit/testdata/Cycle.golden
new file mode 100644
index 0000000000000..6fb842460101c
--- /dev/null
+++ b/agent/unit/testdata/Cycle.golden
@@ -0,0 +1,8 @@
+strict digraph Cycle {
+  // Node definitions.
+  1;
+  2;
+
+  // Edge definitions.
+  1 -> 2;
+}
\ No newline at end of file
diff --git a/agent/unit/testdata/ForwardAndReverseEdges.golden b/agent/unit/testdata/ForwardAndReverseEdges.golden
new file mode 100644
index 0000000000000..36cf2218fbbc2
--- /dev/null
+++ b/agent/unit/testdata/ForwardAndReverseEdges.golden
@@ -0,0 +1,10 @@
+strict digraph ForwardAndReverseEdges {
+  // Node definitions.
+  1;
+  2;
+  3;
+
+  // Edge definitions.
+  1 -> 2;
+  1 -> 3;
+}
\ No newline at end of file
diff --git a/agent/unit/testdata/MultipleDependenciesSameStatus.golden b/agent/unit/testdata/MultipleDependenciesSameStatus.golden
new file mode 100644
index 0000000000000..af7cbb71e0e22
--- /dev/null
+++ b/agent/unit/testdata/MultipleDependenciesSameStatus.golden
@@ -0,0 +1,12 @@
+strict digraph MultipleDependenciesSameStatus {
+  // Node definitions.
+  1;
+  2;
+  3;
+  4;
+
+  // Edge definitions.
+  1 -> 2;
+  1 -> 3;
+  1 -> 4;
+}
\ No newline at end of file
diff --git a/agent/unit/testdata/SelfReference.golden b/agent/unit/testdata/SelfReference.golden
new file mode 100644
index 0000000000000..d0d036d6fb66a
--- /dev/null
+++ b/agent/unit/testdata/SelfReference.golden
@@ -0,0 +1,4 @@
+strict digraph SelfReference {
+  // Node definitions.
+  1;
+}
\ No newline at end of file
diff --git a/go.mod b/go.mod
index 22297ca4c789b..ba9380112d91d 100644
--- a/go.mod
+++ b/go.mod
@@ -486,6 +486,7 @@ require (
 	github.com/go-git/go-git/v5 v5.16.2
 	github.com/icholy/replace v0.6.0
 	github.com/mark3labs/mcp-go v0.38.0
+	gonum.org/v1/gonum v0.16.0
 )
 
 require (

From c301a0d80475b06446f975f8026d610f034ec669 Mon Sep 17 00:00:00 2001
From: Marcin Tojek <mtojek@users.noreply.github.com>
Date: Fri, 24 Oct 2025 16:24:53 +0200
Subject: [PATCH 239/298] docs: add comprehensive Web Terminal documentation
 (#20458)

Fixes: https://github.com/coder/coder/issues/19119
---
 docs/manifest.json                            |   5 +
 docs/user-guides/workspace-access/index.md    |  11 +-
 .../workspace-access/web-terminal.md          | 236 ++++++++++++++++++
 3 files changed, 249 insertions(+), 3 deletions(-)
 create mode 100644 docs/user-guides/workspace-access/web-terminal.md

diff --git a/docs/manifest.json b/docs/manifest.json
index 622190945bb30..8f624cb7f220c 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -209,6 +209,11 @@
 							"description": "Use VSCode with Coder in the desktop or browser",
 							"path": "./user-guides/workspace-access/vscode.md"
 						},
+						{
+							"title": "Web Terminal",
+							"description": "Use the browser-based terminal to access your workspace",
+							"path": "./user-guides/workspace-access/web-terminal.md"
+						},
 						{
 							"title": "JetBrains IDEs",
 							"description": "Use JetBrains IDEs with Coder",
diff --git a/docs/user-guides/workspace-access/index.md b/docs/user-guides/workspace-access/index.md
index 266e76e94757f..53b1583dac4b2 100644
--- a/docs/user-guides/workspace-access/index.md
+++ b/docs/user-guides/workspace-access/index.md
@@ -12,13 +12,18 @@ dashboard.
 
 ![Workspace View](../../images/user-guides/workspace-view-connection-annotated.png)
 
-## Terminal
+## Web Terminal
 
-The terminal is implicitly enabled in Coder and allows you to access your
-workspace through the shell environment set by your template.
+The Web Terminal is a browser-based terminal that provides instant access to
+your workspace's shell environment. It uses [xterm.js](https://xtermjs.org/)
+and WebSocket technology for a responsive terminal experience with features
+like persistent sessions, Unicode support, and clickable URLs.
 
 ![Terminal Access](../../images/user-guides/terminal-access.png)
 
+Read the complete [Web Terminal documentation](./web-terminal.md) for
+customization options, keyboard shortcuts, and troubleshooting guides.
+
 ## SSH
 
 ### Through with the CLI
diff --git a/docs/user-guides/workspace-access/web-terminal.md b/docs/user-guides/workspace-access/web-terminal.md
new file mode 100644
index 0000000000000..93c364c2894d3
--- /dev/null
+++ b/docs/user-guides/workspace-access/web-terminal.md
@@ -0,0 +1,236 @@
+# Web Terminal
+
+The Web Terminal is a browser-based terminal interface that provides instant
+access to your workspace's shell environment directly from the Coder dashboard.
+It's automatically enabled for all workspaces and requires no additional
+configuration.
+
+![Terminal Access](../../images/user-guides/terminal-access.png)
+
+## Overview
+
+The Web Terminal leverages [xterm.js](https://xtermjs.org/), an industry-standard
+terminal emulator, combined with WebSocket technology to provide a responsive
+and feature-rich terminal experience in your browser.
+
+### Key Features
+
+- **Instant Access**: Click the terminal icon in your workspace to open a shell
+  session
+- **Persistent Sessions**: Sessions are maintained using reconnection tokens,
+  allowing you to resume your terminal even after page refreshes or network
+  interruptions
+- **Full Unicode Support**: Displays international characters and emojis
+  correctly
+- **Clickable Links**: Automatically detects and makes URLs clickable
+- **Copy/Paste Support**: Select text to automatically copy it to your clipboard
+- **Multiple Rendering Options**: Choose between different rendering engines for
+  optimal performance
+
+## Accessing the Terminal
+
+### From the Dashboard
+
+1. Navigate to your workspace in the Coder dashboard
+2. Click the **Terminal** button or icon
+3. The terminal will open in a new browser tab or window
+
+The terminal automatically connects to your workspace agent using an optimized
+WebSocket connection.
+
+### Direct URL Access
+
+You can also bookmark or share direct terminal URLs:
+
+```text
+https://coder.example.com/@username/workspace-name/terminal
+```
+
+To access a specific agent in a multi-agent workspace:
+
+```text
+https://coder.example.com/@username/workspace-name.agent-name/terminal
+```
+
+## Architecture
+
+### How It Works
+
+The Web Terminal creates a persistent connection between your browser and the
+workspace:
+
+1. **Browser**: Renders the terminal using xterm.js
+2. **WebSocket**: Maintains a persistent, low-latency connection
+3. **Coder Server**: Routes traffic between browser and workspace
+4. **Workspace Agent**: Manages the pseudo-terminal (PTY) session
+5. **Shell Process**: Your actual bash/zsh/fish shell
+
+The connection flow is: Browser ↔ WebSocket ↔ Coder Server ↔ Workspace Agent ↔ Shell Process
+
+### Reconnection & Persistence
+
+The terminal uses reconnection tokens to maintain session state:
+
+- Each terminal session has a unique UUID
+- If the connection drops, the same token is used to reconnect
+- The workspace agent buffers output during disconnections
+- Your shell session continues running even when the browser is closed
+
+## Customization
+
+### Font Selection
+
+You can customize the terminal font through your user settings:
+
+1. Click your avatar in the top-right corner
+2. Select **Settings** → **Appearance**
+3. Choose from available fonts:
+   - **IBM Plex Mono** (default)
+   - **Fira Code** (with ligatures)
+   - **JetBrains Mono**
+   - **Source Code Pro**
+
+The font change applies immediately to all open terminal sessions.
+
+### Rendering Engine
+
+Administrators can configure the terminal renderer for performance optimization:
+
+```yaml
+# In your Coder deployment configuration
+webTerminalRenderer: "canvas"  # Options: canvas, webgl, dom
+```
+
+Or via environment variable:
+
+```bash
+CODER_WEB_TERMINAL_RENDERER=canvas
+```
+
+**Renderer Options:**
+
+- **`canvas`** (default): Best compatibility, good performance on most systems
+- **`webgl`**: Hardware-accelerated, ideal for high-refresh terminals and
+  complex rendering
+- **`dom`**: Fallback option, useful for accessibility tools or older browsers
+
+> **Note:** The renderer setting is deployment-wide and requires a Coder server
+> restart to take effect.
+
+## Keyboard Shortcuts
+
+The Web Terminal supports standard terminal keybindings:
+
+| Shortcut                            | Action                    |
+|-------------------------------------|---------------------------|
+| `Ctrl+Shift+C` (Mac: `Cmd+Shift+C`) | Copy selected text        |
+| `Ctrl+Shift+V` (Mac: `Cmd+Shift+V`) | Paste from clipboard      |
+| `Shift+Enter`                       | Insert literal newline    |
+| `Ctrl+C`                            | Send interrupt (SIGINT)   |
+| `Ctrl+D`                            | Send EOF / exit shell     |
+| `Ctrl+Z`                            | Suspend process (SIGTSTP) |
+
+### Copy/Paste Behavior
+
+- **Auto-copy**: Selecting text automatically copies it to your clipboard
+- **Paste**: Use the standard paste shortcut or middle-click (on Linux/X11)
+- **Browser permissions**: First paste may prompt for clipboard access
+
+## URL Handling
+
+The terminal automatically detects URLs and makes them clickable. When you click
+a URL:
+
+- **External URLs** (e.g., `https://example.com`) open in a new tab
+- **Localhost URLs** (e.g., `http://localhost:3000`) are automatically
+  port-forwarded through Coder's [port forwarding](./port-forwarding.md) system
+- **Port-forwarded URLs** use your configured workspace proxy
+
+This makes it seamless to open development servers running in your workspace.
+
+## Advanced Usage
+
+### Custom Commands
+
+You can open a terminal with a specific command by adding a query parameter:
+
+```text
+https://coder.example.com/@user/workspace/terminal?command=htop
+```
+
+This will execute `htop` immediately when the terminal opens.
+
+### Container Selection
+
+For workspaces with multiple Docker containers, specify which container to
+connect to:
+
+```text
+https://coder.example.com/@user/workspace/terminal?container=sidecar
+```
+
+You can also specify the container user:
+
+```text
+https://coder.example.com/@user/workspace/terminal?container=app&container_user=node
+```
+
+> **Note:** This feature only works with Docker containers.
+
+### Debug Mode
+
+Enable debug information to monitor connection latency:
+
+```text
+https://coder.example.com/@user/workspace/terminal?debug
+```
+
+This displays the current latency to your selected workspace proxy in the
+bottom-right corner.
+
+## Configuration File Support
+
+The Web Terminal uses xterm.js under the hood, which is configured
+programmatically rather than through a configuration file. However, you can
+customize various aspects:
+
+### User-Side Customization
+
+End-users can customize:
+
+- **Font family** via Settings → Appearance
+- **Shell environment** via dotfiles or shell rc files
+- **TERM variable** is automatically set to `xterm-256color`
+
+### Shell Configuration
+
+The terminal respects your shell's configuration files:
+
+```bash
+# ~/.bashrc or ~/.zshrc
+export PS1="\u@\h:\w\$ "  # Custom prompt
+alias ll="ls -lah"         # Custom aliases
+
+# Set terminal colors
+export CTERM=xterm-256color
+```
+
+## Troubleshooting
+
+### Connection Issues
+
+If the terminal fails to connect:
+
+1. **Check workspace status**: Ensure your workspace is running
+2. **Verify agent health**: Look for agent connection warnings
+3. **Network issues**: Check if WebSockets are blocked by your firewall/proxy
+4. **Browser console**: Open DevTools to see WebSocket error messages
+
+### Display Issues
+
+If characters or colors appear incorrect:
+
+1. **Unicode support**: Ensure your shell locale is set correctly (`locale -a`)
+2. **Terminal type**: The terminal sets `TERM=xterm-256color` automatically
+3. **Color schemes**: Some applications may not render correctly in dark mode
+4. **Font rendering**: Try switching terminal fonts in your appearance settings

From f6e86c6fdb68e5428a087b33437aab4808a98722 Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Fri, 24 Oct 2025 15:27:49 +0100
Subject: [PATCH 240/298] feat: cancel pending prebuilds from non-active
 template versions (#20387)

## Description

This PR introduces an optimization to automatically cancel pending
prebuild-related jobs from non-active template versions in the
reconciliation loop.

## Problem

Currently, when a template is configured with more prebuild instances
than available provisioners, the provisioner queue can become flooded
with pending prebuild jobs. This issue is worsened when
provisioning/deprovisioning operations take a long time.

When the prebuild reconciliation loop generates jobs faster than
provisioners can process them, pending jobs accumulate in the queue.
Since prebuilt workspaces should always run the latest active template
version, pending prebuild jobs from non-active versions become obsolete
once a new version is promoted.

## Solution

The reconciliation loop cancels pending prebuild-related jobs from
non-active template versions that match the following criteria:

* Build number: 1 (initial build created by the reconciliation loop)
* Job status: `pending`
* Not yet picked up by a provisioner (`worker_id` is `NULL`)
* Owned by the prebuilds system user
* Workspace transition: `start`

This prevents the queue from being cluttered with stale prebuild jobs
that would provision workspaces on an outdated template version that
would consequently need to be deprovisioned.

## Changes

* Added new SQL query `CountPendingNonActivePrebuilds` to identify
presets with pending jobs from non-active versions
* Added new SQL query `UpdatePrebuildProvisionerJobWithCancel` to cancel
jobs for a specific preset
* New reconciliation action type `ActionTypeCancelPending` handles the
cancellation logic
* Cancellation is non-blocking: failures to cancel prebuild jobs are
logged as errors and don't prevent other reconciliation actions

## Follow-up PR

Canceling pending prebuild jobs leaves workspaces in a Canceled state.
While no Terraform resources need to be destroyed (since jobs were
canceled before provisioning started), these database records should
still be cleaned up. This will be addressed in a follow-up PR.

Closes: https://github.com/coder/coder/issues/20242
---
 coderd/database/dbauthz/dbauthz.go            |  15 +
 coderd/database/dbauthz/dbauthz_test.go       |  14 +
 coderd/database/dbfake/dbfake.go              |  49 +-
 coderd/database/dbmetrics/querymetrics.go     |  14 +
 coderd/database/dbmock/dbmock.go              |  30 +
 coderd/database/querier.go                    |   8 +-
 coderd/database/queries.sql.go                | 113 +++-
 coderd/database/queries/prebuilds.sql         |  55 +-
 coderd/prebuilds/global_snapshot.go           |  17 +-
 coderd/prebuilds/preset_snapshot.go           |  42 +-
 coderd/prebuilds/preset_snapshot_test.go      |  97 ++-
 enterprise/coderd/prebuilds/reconcile.go      |  50 +-
 enterprise/coderd/prebuilds/reconcile_test.go | 575 +++++++++++++++++-
 13 files changed, 1016 insertions(+), 63 deletions(-)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 16bc364a42a3c..4397ddfee3226 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -1512,6 +1512,13 @@ func (q *querier) CountInProgressPrebuilds(ctx context.Context) ([]database.Coun
 	return q.db.CountInProgressPrebuilds(ctx)
 }
 
+func (q *querier) CountPendingNonActivePrebuilds(ctx context.Context) ([]database.CountPendingNonActivePrebuildsRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceWorkspace.All()); err != nil {
+		return nil, err
+	}
+	return q.db.CountPendingNonActivePrebuilds(ctx)
+}
+
 func (q *querier) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceInboxNotification.WithOwner(userID.String())); err != nil {
 		return 0, err
@@ -4875,6 +4882,14 @@ func (q *querier) UpdateOrganizationDeletedByID(ctx context.Context, arg databas
 	return deleteQ(q.log, q.auth, q.db.GetOrganizationByID, deleteF)(ctx, arg.ID)
 }
 
+func (q *querier) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+	// Prebuild operation for canceling pending prebuild jobs from non-active template versions
+	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourcePrebuiltWorkspace); err != nil {
+		return []uuid.UUID{}, err
+	}
+	return q.db.UpdatePrebuildProvisionerJobWithCancel(ctx, arg)
+}
+
 func (q *querier) UpdatePresetPrebuildStatus(ctx context.Context, arg database.UpdatePresetPrebuildStatusParams) error {
 	preset, err := q.db.GetPresetByID(ctx, arg.PresetID)
 	if err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index ca82390984a18..465bd679052c5 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -641,6 +641,16 @@ func (s *MethodTestSuite) TestProvisionerJob() {
 		dbm.EXPECT().UpdateProvisionerJobWithCancelByID(gomock.Any(), arg).Return(nil).AnyTimes()
 		check.Args(arg).Asserts(v.RBACObject(tpl), []policy.Action{policy.ActionRead, policy.ActionUpdate}).Returns()
 	}))
+	s.Run("UpdatePrebuildProvisionerJobWithCancel", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		arg := database.UpdatePrebuildProvisionerJobWithCancelParams{
+			PresetID: uuid.NullUUID{UUID: uuid.New(), Valid: true},
+			Now:      dbtime.Now(),
+		}
+		jobIDs := []uuid.UUID{uuid.New(), uuid.New()}
+
+		dbm.EXPECT().UpdatePrebuildProvisionerJobWithCancel(gomock.Any(), arg).Return(jobIDs, nil).AnyTimes()
+		check.Args(arg).Asserts(rbac.ResourcePrebuiltWorkspace, policy.ActionUpdate).Returns(jobIDs)
+	}))
 	s.Run("GetProvisionerJobsByIDs", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		org := testutil.Fake(s.T(), faker, database.Organization{})
 		org2 := testutil.Fake(s.T(), faker, database.Organization{})
@@ -3758,6 +3768,10 @@ func (s *MethodTestSuite) TestPrebuilds() {
 		dbm.EXPECT().CountInProgressPrebuilds(gomock.Any()).Return([]database.CountInProgressPrebuildsRow{}, nil).AnyTimes()
 		check.Args().Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead)
 	}))
+	s.Run("CountPendingNonActivePrebuilds", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
+		dbm.EXPECT().CountPendingNonActivePrebuilds(gomock.Any()).Return([]database.CountPendingNonActivePrebuildsRow{}, nil).AnyTimes()
+		check.Args().Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead)
+	}))
 	s.Run("GetPresetsAtFailureLimit", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 		dbm.EXPECT().GetPresetsAtFailureLimit(gomock.Any(), int64(0)).Return([]database.GetPresetsAtFailureLimitRow{}, nil).AnyTimes()
 		check.Args(int64(0)).Asserts(rbac.ResourceTemplate.All(), policy.ActionViewInsights)
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
index 9eaf1afb93a15..cf94812cfde3d 100644
--- a/coderd/database/dbfake/dbfake.go
+++ b/coderd/database/dbfake/dbfake.go
@@ -55,14 +55,10 @@ type WorkspaceBuildBuilder struct {
 	resources  []*sdkproto.Resource
 	params     []database.WorkspaceBuildParameter
 	agentToken string
-	dispo      workspaceBuildDisposition
+	jobStatus  database.ProvisionerJobStatus
 	taskAppID  uuid.UUID
 }
 
-type workspaceBuildDisposition struct {
-	starting bool
-}
-
 // WorkspaceBuild generates a workspace build for the provided workspace.
 // Pass a database.Workspace{} with a nil ID to also generate a new workspace.
 // Omitting the template ID on a workspace will also generate a new template
@@ -145,8 +141,17 @@ func (b WorkspaceBuildBuilder) WithTask(seed *sdkproto.App) WorkspaceBuildBuilde
 }
 
 func (b WorkspaceBuildBuilder) Starting() WorkspaceBuildBuilder {
-	//nolint: revive // returns modified struct
-	b.dispo.starting = true
+	b.jobStatus = database.ProvisionerJobStatusRunning
+	return b
+}
+
+func (b WorkspaceBuildBuilder) Pending() WorkspaceBuildBuilder {
+	b.jobStatus = database.ProvisionerJobStatusPending
+	return b
+}
+
+func (b WorkspaceBuildBuilder) Canceled() WorkspaceBuildBuilder {
+	b.jobStatus = database.ProvisionerJobStatusCanceled
 	return b
 }
 
@@ -231,7 +236,11 @@ func (b WorkspaceBuildBuilder) Do() WorkspaceResponse {
 	require.NoError(b.t, err, "insert job")
 	b.logger.Debug(context.Background(), "inserted provisioner job", slog.F("job_id", job.ID))
 
-	if b.dispo.starting {
+	switch b.jobStatus {
+	case database.ProvisionerJobStatusPending:
+		// Provisioner jobs are created in 'pending' status
+		b.logger.Debug(context.Background(), "pending the provisioner job")
+	case database.ProvisionerJobStatusRunning:
 		// might need to do this multiple times if we got a template version
 		// import job as well
 		b.logger.Debug(context.Background(), "looping to acquire provisioner job")
@@ -255,7 +264,23 @@ func (b WorkspaceBuildBuilder) Do() WorkspaceResponse {
 				break
 			}
 		}
-	} else {
+	case database.ProvisionerJobStatusCanceled:
+		// Set provisioner job status to 'canceled'
+		b.logger.Debug(context.Background(), "canceling the provisioner job")
+		err = b.db.UpdateProvisionerJobWithCancelByID(ownerCtx, database.UpdateProvisionerJobWithCancelByIDParams{
+			ID: jobID,
+			CanceledAt: sql.NullTime{
+				Time:  dbtime.Now(),
+				Valid: true,
+			},
+			CompletedAt: sql.NullTime{
+				Time:  dbtime.Now(),
+				Valid: true,
+			},
+		})
+		require.NoError(b.t, err, "cancel job")
+	default:
+		// By default, consider jobs in 'succeeded' status
 		b.logger.Debug(context.Background(), "completing the provisioner job")
 		err = b.db.UpdateProvisionerJobWithCompleteByID(ownerCtx, database.UpdateProvisionerJobWithCompleteByIDParams{
 			ID:        job.ID,
@@ -571,6 +596,12 @@ func (t TemplateVersionBuilder) Do() TemplateVersionResponse {
 		t.params[i] = dbgen.TemplateVersionParameter(t.t, t.db, param)
 	}
 
+	// Update response with template and version
+	if resp.Template.ID == uuid.Nil && version.TemplateID.Valid {
+		template, err := t.db.GetTemplateByID(ownerCtx, version.TemplateID.UUID)
+		require.NoError(t.t, err)
+		resp.Template = template
+	}
 	resp.TemplateVersion = version
 	return resp
 }
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 79c8a01d67dd8..9f0589178f2ff 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -214,6 +214,13 @@ func (m queryMetricsStore) CountInProgressPrebuilds(ctx context.Context) ([]data
 	return r0, r1
 }
 
+func (m queryMetricsStore) CountPendingNonActivePrebuilds(ctx context.Context) ([]database.CountPendingNonActivePrebuildsRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.CountPendingNonActivePrebuilds(ctx)
+	m.queryLatencies.WithLabelValues("CountPendingNonActivePrebuilds").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
 	start := time.Now()
 	r0, r1 := m.s.CountUnreadInboxNotificationsByUserID(ctx, userID)
@@ -3000,6 +3007,13 @@ func (m queryMetricsStore) UpdateOrganizationDeletedByID(ctx context.Context, ar
 	return r0
 }
 
+func (m queryMetricsStore) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+	start := time.Now()
+	r0, r1 := m.s.UpdatePrebuildProvisionerJobWithCancel(ctx, arg)
+	m.queryLatencies.WithLabelValues("UpdatePrebuildProvisionerJobWithCancel").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) UpdatePresetPrebuildStatus(ctx context.Context, arg database.UpdatePresetPrebuildStatusParams) error {
 	start := time.Now()
 	r0 := m.s.UpdatePresetPrebuildStatus(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index a16ba47e721aa..237fc3d0ebf0e 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -352,6 +352,21 @@ func (mr *MockStoreMockRecorder) CountInProgressPrebuilds(ctx any) *gomock.Call
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountInProgressPrebuilds", reflect.TypeOf((*MockStore)(nil).CountInProgressPrebuilds), ctx)
 }
 
+// CountPendingNonActivePrebuilds mocks base method.
+func (m *MockStore) CountPendingNonActivePrebuilds(ctx context.Context) ([]database.CountPendingNonActivePrebuildsRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CountPendingNonActivePrebuilds", ctx)
+	ret0, _ := ret[0].([]database.CountPendingNonActivePrebuildsRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CountPendingNonActivePrebuilds indicates an expected call of CountPendingNonActivePrebuilds.
+func (mr *MockStoreMockRecorder) CountPendingNonActivePrebuilds(ctx any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CountPendingNonActivePrebuilds", reflect.TypeOf((*MockStore)(nil).CountPendingNonActivePrebuilds), ctx)
+}
+
 // CountUnreadInboxNotificationsByUserID mocks base method.
 func (m *MockStore) CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error) {
 	m.ctrl.T.Helper()
@@ -6451,6 +6466,21 @@ func (mr *MockStoreMockRecorder) UpdateOrganizationDeletedByID(ctx, arg any) *go
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateOrganizationDeletedByID", reflect.TypeOf((*MockStore)(nil).UpdateOrganizationDeletedByID), ctx, arg)
 }
 
+// UpdatePrebuildProvisionerJobWithCancel mocks base method.
+func (m *MockStore) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdatePrebuildProvisionerJobWithCancel", ctx, arg)
+	ret0, _ := ret[0].([]uuid.UUID)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdatePrebuildProvisionerJobWithCancel indicates an expected call of UpdatePrebuildProvisionerJobWithCancel.
+func (mr *MockStoreMockRecorder) UpdatePrebuildProvisionerJobWithCancel(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdatePrebuildProvisionerJobWithCancel", reflect.TypeOf((*MockStore)(nil).UpdatePrebuildProvisionerJobWithCancel), ctx, arg)
+}
+
 // UpdatePresetPrebuildStatus mocks base method.
 func (m *MockStore) UpdatePresetPrebuildStatus(ctx context.Context, arg database.UpdatePresetPrebuildStatusParams) error {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index c6ae87dbc52f6..5744796abc862 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -68,8 +68,10 @@ type sqlcQuerier interface {
 	CountAuditLogs(ctx context.Context, arg CountAuditLogsParams) (int64, error)
 	CountConnectionLogs(ctx context.Context, arg CountConnectionLogsParams) (int64, error)
 	// CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by preset ID and transition.
-	// Prebuild considered in-progress if it's in the "starting", "stopping", or "deleting" state.
+	// Prebuild considered in-progress if it's in the "pending", "starting", "stopping", or "deleting" state.
 	CountInProgressPrebuilds(ctx context.Context) ([]CountInProgressPrebuildsRow, error)
+	// CountPendingNonActivePrebuilds returns the number of pending prebuilds for non-active template versions
+	CountPendingNonActivePrebuilds(ctx context.Context) ([]CountPendingNonActivePrebuildsRow, error)
 	CountUnreadInboxNotificationsByUserID(ctx context.Context, userID uuid.UUID) (int64, error)
 	CreateUserSecret(ctx context.Context, arg CreateUserSecretParams) (UserSecret, error)
 	CustomRoles(ctx context.Context, arg CustomRolesParams) ([]CustomRole, error)
@@ -647,6 +649,10 @@ type sqlcQuerier interface {
 	UpdateOAuth2ProviderAppSecretByID(ctx context.Context, arg UpdateOAuth2ProviderAppSecretByIDParams) (OAuth2ProviderAppSecret, error)
 	UpdateOrganization(ctx context.Context, arg UpdateOrganizationParams) (Organization, error)
 	UpdateOrganizationDeletedByID(ctx context.Context, arg UpdateOrganizationDeletedByIDParams) error
+	// Cancels all pending provisioner jobs for prebuilt workspaces on a specific preset from an
+	// inactive template version.
+	// This is an optimization to clean up stale pending jobs.
+	UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error)
 	UpdatePresetPrebuildStatus(ctx context.Context, arg UpdatePresetPrebuildStatusParams) error
 	UpdateProvisionerDaemonLastSeenAt(ctx context.Context, arg UpdateProvisionerDaemonLastSeenAtParams) error
 	UpdateProvisionerJobByID(ctx context.Context, arg UpdateProvisionerJobByIDParams) error
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index c5b8caba37ced..94fdc03d322b4 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -7924,7 +7924,7 @@ type CountInProgressPrebuildsRow struct {
 }
 
 // CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by preset ID and transition.
-// Prebuild considered in-progress if it's in the "starting", "stopping", or "deleting" state.
+// Prebuild considered in-progress if it's in the "pending", "starting", "stopping", or "deleting" state.
 func (q *sqlQuerier) CountInProgressPrebuilds(ctx context.Context) ([]CountInProgressPrebuildsRow, error) {
 	rows, err := q.db.QueryContext(ctx, countInProgressPrebuilds)
 	if err != nil {
@@ -7954,6 +7954,58 @@ func (q *sqlQuerier) CountInProgressPrebuilds(ctx context.Context) ([]CountInPro
 	return items, nil
 }
 
+const countPendingNonActivePrebuilds = `-- name: CountPendingNonActivePrebuilds :many
+SELECT
+	wpb.template_version_preset_id AS preset_id,
+	COUNT(*)::int AS count
+FROM workspace_prebuild_builds wpb
+INNER JOIN provisioner_jobs pj ON pj.id = wpb.job_id
+INNER JOIN workspaces w ON w.id = wpb.workspace_id
+INNER JOIN templates t ON t.id = w.template_id
+WHERE
+	wpb.template_version_id != t.active_version_id
+	-- Only considers initial builds, i.e. created by the reconciliation loop
+	AND wpb.build_number = 1
+	-- Only consider 'start' transitions (provisioning), not 'stop'/'delete' (deprovisioning)
+	-- Deprovisioning jobs should complete naturally as they're already cleaning up resources
+	AND wpb.transition = 'start'::workspace_transition
+	-- Pending jobs that have not yet been picked up by a provisioner
+	AND pj.job_status = 'pending'::provisioner_job_status
+	AND pj.worker_id IS NULL
+	AND pj.canceled_at IS NULL
+	AND pj.completed_at IS NULL
+GROUP BY wpb.template_version_preset_id
+`
+
+type CountPendingNonActivePrebuildsRow struct {
+	PresetID uuid.NullUUID `db:"preset_id" json:"preset_id"`
+	Count    int32         `db:"count" json:"count"`
+}
+
+// CountPendingNonActivePrebuilds returns the number of pending prebuilds for non-active template versions
+func (q *sqlQuerier) CountPendingNonActivePrebuilds(ctx context.Context) ([]CountPendingNonActivePrebuildsRow, error) {
+	rows, err := q.db.QueryContext(ctx, countPendingNonActivePrebuilds)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []CountPendingNonActivePrebuildsRow
+	for rows.Next() {
+		var i CountPendingNonActivePrebuildsRow
+		if err := rows.Scan(&i.PresetID, &i.Count); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const findMatchingPresetID = `-- name: FindMatchingPresetID :one
 WITH provided_params AS (
 	SELECT
@@ -8396,6 +8448,65 @@ func (q *sqlQuerier) GetTemplatePresetsWithPrebuilds(ctx context.Context, templa
 	return items, nil
 }
 
+const updatePrebuildProvisionerJobWithCancel = `-- name: UpdatePrebuildProvisionerJobWithCancel :many
+UPDATE provisioner_jobs
+SET
+	canceled_at = $1::timestamptz,
+	completed_at = $1::timestamptz
+WHERE id IN (
+	SELECT pj.id
+	FROM provisioner_jobs pj
+	INNER JOIN workspace_prebuild_builds wpb ON wpb.job_id = pj.id
+	INNER JOIN workspaces w ON w.id = wpb.workspace_id
+	INNER JOIN templates t ON t.id = w.template_id
+	WHERE
+		wpb.template_version_id != t.active_version_id
+		AND wpb.template_version_preset_id = $2
+		-- Only considers initial builds, i.e. created by the reconciliation loop
+		AND wpb.build_number = 1
+		-- Only consider 'start' transitions (provisioning), not 'stop'/'delete' (deprovisioning)
+		-- Deprovisioning jobs should complete naturally as they're already cleaning up resources
+		AND wpb.transition = 'start'::workspace_transition
+		-- Pending jobs that have not yet been picked up by a provisioner
+		AND pj.job_status = 'pending'::provisioner_job_status
+		AND pj.worker_id IS NULL
+		AND pj.canceled_at IS NULL
+		AND pj.completed_at IS NULL
+)
+RETURNING id
+`
+
+type UpdatePrebuildProvisionerJobWithCancelParams struct {
+	Now      time.Time     `db:"now" json:"now"`
+	PresetID uuid.NullUUID `db:"preset_id" json:"preset_id"`
+}
+
+// Cancels all pending provisioner jobs for prebuilt workspaces on a specific preset from an
+// inactive template version.
+// This is an optimization to clean up stale pending jobs.
+func (q *sqlQuerier) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+	rows, err := q.db.QueryContext(ctx, updatePrebuildProvisionerJobWithCancel, arg.Now, arg.PresetID)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []uuid.UUID
+	for rows.Next() {
+		var id uuid.UUID
+		if err := rows.Scan(&id); err != nil {
+			return nil, err
+		}
+		items = append(items, id)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getActivePresetPrebuildSchedules = `-- name: GetActivePresetPrebuildSchedules :many
 SELECT
 	tvpps.id, tvpps.preset_id, tvpps.cron_expression, tvpps.desired_instances
diff --git a/coderd/database/queries/prebuilds.sql b/coderd/database/queries/prebuilds.sql
index 2ad7f41d41fea..6c5520c9da7e1 100644
--- a/coderd/database/queries/prebuilds.sql
+++ b/coderd/database/queries/prebuilds.sql
@@ -121,7 +121,7 @@ ORDER BY latest_prebuilds.id;
 
 -- name: CountInProgressPrebuilds :many
 -- CountInProgressPrebuilds returns the number of in-progress prebuilds, grouped by preset ID and transition.
--- Prebuild considered in-progress if it's in the "starting", "stopping", or "deleting" state.
+-- Prebuild considered in-progress if it's in the "pending", "starting", "stopping", or "deleting" state.
 SELECT t.id AS template_id, wpb.template_version_id, wpb.transition, COUNT(wpb.transition)::int AS count, wlb.template_version_preset_id as preset_id
 FROM workspace_latest_builds wlb
 		INNER JOIN workspace_prebuild_builds wpb ON wpb.id = wlb.id
@@ -272,3 +272,56 @@ FROM preset_matches pm
 WHERE pm.total_preset_params = pm.matching_params  -- All preset parameters must match
 ORDER BY pm.total_preset_params DESC               -- Return the preset with the most parameters
 LIMIT 1;
+
+-- name: CountPendingNonActivePrebuilds :many
+-- CountPendingNonActivePrebuilds returns the number of pending prebuilds for non-active template versions
+SELECT
+	wpb.template_version_preset_id AS preset_id,
+	COUNT(*)::int AS count
+FROM workspace_prebuild_builds wpb
+INNER JOIN provisioner_jobs pj ON pj.id = wpb.job_id
+INNER JOIN workspaces w ON w.id = wpb.workspace_id
+INNER JOIN templates t ON t.id = w.template_id
+WHERE
+	wpb.template_version_id != t.active_version_id
+	-- Only considers initial builds, i.e. created by the reconciliation loop
+	AND wpb.build_number = 1
+	-- Only consider 'start' transitions (provisioning), not 'stop'/'delete' (deprovisioning)
+	-- Deprovisioning jobs should complete naturally as they're already cleaning up resources
+	AND wpb.transition = 'start'::workspace_transition
+	-- Pending jobs that have not yet been picked up by a provisioner
+	AND pj.job_status = 'pending'::provisioner_job_status
+	AND pj.worker_id IS NULL
+	AND pj.canceled_at IS NULL
+	AND pj.completed_at IS NULL
+GROUP BY wpb.template_version_preset_id;
+
+-- name: UpdatePrebuildProvisionerJobWithCancel :many
+-- Cancels all pending provisioner jobs for prebuilt workspaces on a specific preset from an
+-- inactive template version.
+-- This is an optimization to clean up stale pending jobs.
+UPDATE provisioner_jobs
+SET
+	canceled_at = @now::timestamptz,
+	completed_at = @now::timestamptz
+WHERE id IN (
+	SELECT pj.id
+	FROM provisioner_jobs pj
+	INNER JOIN workspace_prebuild_builds wpb ON wpb.job_id = pj.id
+	INNER JOIN workspaces w ON w.id = wpb.workspace_id
+	INNER JOIN templates t ON t.id = w.template_id
+	WHERE
+		wpb.template_version_id != t.active_version_id
+		AND wpb.template_version_preset_id = @preset_id
+		-- Only considers initial builds, i.e. created by the reconciliation loop
+		AND wpb.build_number = 1
+		-- Only consider 'start' transitions (provisioning), not 'stop'/'delete' (deprovisioning)
+		-- Deprovisioning jobs should complete naturally as they're already cleaning up resources
+		AND wpb.transition = 'start'::workspace_transition
+		-- Pending jobs that have not yet been picked up by a provisioner
+		AND pj.job_status = 'pending'::provisioner_job_status
+		AND pj.worker_id IS NULL
+		AND pj.canceled_at IS NULL
+		AND pj.completed_at IS NULL
+)
+RETURNING id;
diff --git a/coderd/prebuilds/global_snapshot.go b/coderd/prebuilds/global_snapshot.go
index f8fb873739ae3..3c7ec24f5644b 100644
--- a/coderd/prebuilds/global_snapshot.go
+++ b/coderd/prebuilds/global_snapshot.go
@@ -8,10 +8,9 @@ import (
 
 	"cdr.dev/slog"
 
-	"github.com/coder/quartz"
-
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/quartz"
 )
 
 // GlobalSnapshot represents a full point-in-time snapshot of state relating to prebuilds across all templates.
@@ -20,6 +19,7 @@ type GlobalSnapshot struct {
 	PrebuildSchedules     []database.TemplateVersionPresetPrebuildSchedule
 	RunningPrebuilds      []database.GetRunningPrebuiltWorkspacesRow
 	PrebuildsInProgress   []database.CountInProgressPrebuildsRow
+	PendingPrebuilds      []database.CountPendingNonActivePrebuildsRow
 	Backoffs              []database.GetPresetsBackoffRow
 	HardLimitedPresetsMap map[uuid.UUID]database.GetPresetsAtFailureLimitRow
 	clock                 quartz.Clock
@@ -31,6 +31,7 @@ func NewGlobalSnapshot(
 	prebuildSchedules []database.TemplateVersionPresetPrebuildSchedule,
 	runningPrebuilds []database.GetRunningPrebuiltWorkspacesRow,
 	prebuildsInProgress []database.CountInProgressPrebuildsRow,
+	pendingPrebuilds []database.CountPendingNonActivePrebuildsRow,
 	backoffs []database.GetPresetsBackoffRow,
 	hardLimitedPresets []database.GetPresetsAtFailureLimitRow,
 	clock quartz.Clock,
@@ -46,6 +47,7 @@ func NewGlobalSnapshot(
 		PrebuildSchedules:     prebuildSchedules,
 		RunningPrebuilds:      runningPrebuilds,
 		PrebuildsInProgress:   prebuildsInProgress,
+		PendingPrebuilds:      pendingPrebuilds,
 		Backoffs:              backoffs,
 		HardLimitedPresetsMap: hardLimitedPresetsMap,
 		clock:                 clock,
@@ -76,10 +78,20 @@ func (s GlobalSnapshot) FilterByPreset(presetID uuid.UUID) (*PresetSnapshot, err
 	// Separate running workspaces into non-expired and expired based on the preset's TTL
 	nonExpired, expired := filterExpiredWorkspaces(preset, running)
 
+	// Includes in-progress prebuilds only for active template versions.
+	// In-progress prebuilds correspond to workspace statuses: 'pending', 'starting', 'stopping', and 'deleting'
 	inProgress := slice.Filter(s.PrebuildsInProgress, func(prebuild database.CountInProgressPrebuildsRow) bool {
 		return prebuild.PresetID.UUID == preset.ID
 	})
 
+	// Includes count of pending prebuilds only for non-active template versions
+	pendingCount := 0
+	if found, ok := slice.Find(s.PendingPrebuilds, func(prebuild database.CountPendingNonActivePrebuildsRow) bool {
+		return prebuild.PresetID.UUID == preset.ID
+	}); ok {
+		pendingCount = int(found.Count)
+	}
+
 	var backoffPtr *database.GetPresetsBackoffRow
 	backoff, found := slice.Find(s.Backoffs, func(row database.GetPresetsBackoffRow) bool {
 		return row.PresetID == preset.ID
@@ -96,6 +108,7 @@ func (s GlobalSnapshot) FilterByPreset(presetID uuid.UUID) (*PresetSnapshot, err
 		nonExpired,
 		expired,
 		inProgress,
+		pendingCount,
 		backoffPtr,
 		isHardLimited,
 		s.clock,
diff --git a/coderd/prebuilds/preset_snapshot.go b/coderd/prebuilds/preset_snapshot.go
index be9299c8f5bdf..04f4cd1a83ff1 100644
--- a/coderd/prebuilds/preset_snapshot.go
+++ b/coderd/prebuilds/preset_snapshot.go
@@ -34,6 +34,9 @@ const (
 
 	// ActionTypeBackoff indicates that prebuild creation should be delayed.
 	ActionTypeBackoff
+
+	// ActionTypeCancelPending indicates that pending prebuilds should be canceled.
+	ActionTypeCancelPending
 )
 
 // PresetSnapshot is a filtered view of GlobalSnapshot focused on a single preset.
@@ -49,6 +52,7 @@ type PresetSnapshot struct {
 	Running           []database.GetRunningPrebuiltWorkspacesRow
 	Expired           []database.GetRunningPrebuiltWorkspacesRow
 	InProgress        []database.CountInProgressPrebuildsRow
+	PendingCount      int
 	Backoff           *database.GetPresetsBackoffRow
 	IsHardLimited     bool
 	clock             quartz.Clock
@@ -61,6 +65,7 @@ func NewPresetSnapshot(
 	running []database.GetRunningPrebuiltWorkspacesRow,
 	expired []database.GetRunningPrebuiltWorkspacesRow,
 	inProgress []database.CountInProgressPrebuildsRow,
+	pendingCount int,
 	backoff *database.GetPresetsBackoffRow,
 	isHardLimited bool,
 	clock quartz.Clock,
@@ -72,6 +77,7 @@ func NewPresetSnapshot(
 		Running:           running,
 		Expired:           expired,
 		InProgress:        inProgress,
+		PendingCount:      pendingCount,
 		Backoff:           backoff,
 		IsHardLimited:     isHardLimited,
 		clock:             clock,
@@ -115,7 +121,7 @@ type ReconciliationActions struct {
 }
 
 func (ra *ReconciliationActions) IsNoop() bool {
-	return ra.Create == 0 && len(ra.DeleteIDs) == 0 && ra.BackoffUntil.IsZero()
+	return ra.ActionType != ActionTypeCancelPending && ra.Create == 0 && len(ra.DeleteIDs) == 0 && ra.BackoffUntil.IsZero()
 }
 
 // MatchesCron interprets a cron spec as a continuous time range,
@@ -345,18 +351,30 @@ func (p PresetSnapshot) handleActiveTemplateVersion() (actions []*Reconciliation
 	return actions, nil
 }
 
-// handleInactiveTemplateVersion deletes all running prebuilds except those already being deleted
-// to avoid duplicate deletion attempts.
-func (p PresetSnapshot) handleInactiveTemplateVersion() ([]*ReconciliationActions, error) {
-	prebuildsToDelete := len(p.Running)
-	deleteIDs := p.getOldestPrebuildIDs(prebuildsToDelete)
+// handleInactiveTemplateVersion handles prebuilds from inactive template versions:
+//  1. If the preset has pending prebuild jobs from an inactive template version, create a cancel reconciliation action.
+//     This cancels all pending prebuild jobs for this preset's template version.
+//  2. If the preset has prebuilt workspaces currently running from an inactive template version,
+//     create a delete reconciliation action to remove all running prebuilt workspaces.
+func (p PresetSnapshot) handleInactiveTemplateVersion() (actions []*ReconciliationActions, err error) {
+	// Cancel pending initial prebuild jobs from inactive version
+	if p.PendingCount > 0 {
+		actions = append(actions,
+			&ReconciliationActions{
+				ActionType: ActionTypeCancelPending,
+			})
+	}
 
-	return []*ReconciliationActions{
-		{
-			ActionType: ActionTypeDelete,
-			DeleteIDs:  deleteIDs,
-		},
-	}, nil
+	// Delete prebuilds running in inactive version
+	deleteIDs := p.getOldestPrebuildIDs(len(p.Running))
+	if len(deleteIDs) > 0 {
+		actions = append(actions,
+			&ReconciliationActions{
+				ActionType: ActionTypeDelete,
+				DeleteIDs:  deleteIDs,
+			})
+	}
+	return actions, nil
 }
 
 // needsBackoffPeriod checks if we should delay prebuild creation due to recent failures.
diff --git a/coderd/prebuilds/preset_snapshot_test.go b/coderd/prebuilds/preset_snapshot_test.go
index 8a1a10451323a..c32a84777d069 100644
--- a/coderd/prebuilds/preset_snapshot_test.go
+++ b/coderd/prebuilds/preset_snapshot_test.go
@@ -6,16 +6,14 @@ import (
 	"testing"
 	"time"
 
-	"github.com/coder/coder/v2/testutil"
-
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/quartz"
-
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/prebuilds"
+	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/quartz"
 )
 
 type options struct {
@@ -86,7 +84,7 @@ func TestNoPrebuilds(t *testing.T) {
 		preset(true, 0, current),
 	}
 
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, nil, nil, nil, clock, testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, nil, nil, nil, nil, clock, testutil.Logger(t))
 	ps, err := snapshot.FilterByPreset(current.presetID)
 	require.NoError(t, err)
 
@@ -108,7 +106,7 @@ func TestNetNew(t *testing.T) {
 		preset(true, 1, current),
 	}
 
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, nil, nil, nil, clock, testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, nil, nil, nil, nil, clock, testutil.Logger(t))
 	ps, err := snapshot.FilterByPreset(current.presetID)
 	require.NoError(t, err)
 
@@ -150,7 +148,7 @@ func TestOutdatedPrebuilds(t *testing.T) {
 	var inProgress []database.CountInProgressPrebuildsRow
 
 	// WHEN: calculating the outdated preset's state.
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, quartz.NewMock(t), testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, nil, quartz.NewMock(t), testutil.Logger(t))
 	ps, err := snapshot.FilterByPreset(outdated.presetID)
 	require.NoError(t, err)
 
@@ -216,7 +214,7 @@ func TestDeleteOutdatedPrebuilds(t *testing.T) {
 	}
 
 	// WHEN: calculating the outdated preset's state.
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, quartz.NewMock(t), testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, nil, quartz.NewMock(t), testutil.Logger(t))
 	ps, err := snapshot.FilterByPreset(outdated.presetID)
 	require.NoError(t, err)
 
@@ -238,6 +236,74 @@ func TestDeleteOutdatedPrebuilds(t *testing.T) {
 	}, actions)
 }
 
+func TestCancelPendingPrebuilds(t *testing.T) {
+	t.Parallel()
+
+	// Setup
+	current := opts[optionSet3]
+	clock := quartz.NewMock(t)
+
+	t.Run("CancelPendingPrebuildsNonActiveVersion", func(t *testing.T) {
+		t.Parallel()
+
+		// Given: a preset from a non-active version
+		defaultPreset := preset(false, 0, current)
+		presets := []database.GetTemplatePresetsWithPrebuildsRow{
+			defaultPreset,
+		}
+
+		// Given: 2 pending prebuilt workspaces for the preset
+		pending := []database.CountPendingNonActivePrebuildsRow{{
+			PresetID: uuid.NullUUID{
+				UUID:  defaultPreset.ID,
+				Valid: true,
+			},
+			Count: 2,
+		}}
+
+		// When: calculating the current preset's state
+		snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, nil, pending, nil, nil, clock, testutil.Logger(t))
+		ps, err := snapshot.FilterByPreset(current.presetID)
+		require.NoError(t, err)
+
+		// Then: it should create a cancel reconciliation action
+		actions, err := ps.CalculateActions(backoffInterval)
+		require.NoError(t, err)
+		expectedAction := []*prebuilds.ReconciliationActions{{ActionType: prebuilds.ActionTypeCancelPending}}
+		require.Equal(t, expectedAction, actions)
+	})
+
+	t.Run("NotCancelPendingPrebuildsActiveVersion", func(t *testing.T) {
+		t.Parallel()
+
+		// Given: a preset from an active version
+		defaultPreset := preset(true, 0, current)
+		presets := []database.GetTemplatePresetsWithPrebuildsRow{
+			defaultPreset,
+		}
+
+		// Given: 2 pending prebuilt workspaces for the preset
+		pending := []database.CountPendingNonActivePrebuildsRow{{
+			PresetID: uuid.NullUUID{
+				UUID:  defaultPreset.ID,
+				Valid: true,
+			},
+			Count: 2,
+		}}
+
+		// When: calculating the current preset's state
+		snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, nil, pending, nil, nil, clock, testutil.Logger(t))
+		ps, err := snapshot.FilterByPreset(current.presetID)
+		require.NoError(t, err)
+
+		// Then: it should not create a cancel reconciliation action
+		actions, err := ps.CalculateActions(backoffInterval)
+		require.NoError(t, err)
+		var expectedAction []*prebuilds.ReconciliationActions
+		require.Equal(t, expectedAction, actions)
+	})
+}
+
 // A new template version is created with a preset with prebuilds configured; while a prebuild is provisioning up or down,
 // the calculated actions should indicate the state correctly.
 func TestInProgressActions(t *testing.T) {
@@ -460,7 +526,7 @@ func TestInProgressActions(t *testing.T) {
 			}
 
 			// WHEN: calculating the current preset's state.
-			snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, quartz.NewMock(t), testutil.Logger(t))
+			snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, nil, quartz.NewMock(t), testutil.Logger(t))
 			ps, err := snapshot.FilterByPreset(current.presetID)
 			require.NoError(t, err)
 
@@ -503,7 +569,7 @@ func TestExtraneous(t *testing.T) {
 	var inProgress []database.CountInProgressPrebuildsRow
 
 	// WHEN: calculating the current preset's state.
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, quartz.NewMock(t), testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, nil, quartz.NewMock(t), testutil.Logger(t))
 	ps, err := snapshot.FilterByPreset(current.presetID)
 	require.NoError(t, err)
 
@@ -683,7 +749,7 @@ func TestExpiredPrebuilds(t *testing.T) {
 			}
 
 			// WHEN: calculating the current preset's state.
-			snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, nil, nil, nil, clock, testutil.Logger(t))
+			snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, nil, nil, nil, nil, clock, testutil.Logger(t))
 			ps, err := snapshot.FilterByPreset(current.presetID)
 			require.NoError(t, err)
 
@@ -719,7 +785,7 @@ func TestDeprecated(t *testing.T) {
 	var inProgress []database.CountInProgressPrebuildsRow
 
 	// WHEN: calculating the current preset's state.
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, quartz.NewMock(t), testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, nil, nil, quartz.NewMock(t), testutil.Logger(t))
 	ps, err := snapshot.FilterByPreset(current.presetID)
 	require.NoError(t, err)
 
@@ -772,7 +838,7 @@ func TestLatestBuildFailed(t *testing.T) {
 	}
 
 	// WHEN: calculating the current preset's state.
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, backoffs, nil, clock, testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, running, inProgress, nil, backoffs, nil, clock, testutil.Logger(t))
 	psCurrent, err := snapshot.FilterByPreset(current.presetID)
 	require.NoError(t, err)
 
@@ -865,7 +931,7 @@ func TestMultiplePresetsPerTemplateVersion(t *testing.T) {
 		},
 	}
 
-	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, inProgress, nil, nil, clock, testutil.Logger(t))
+	snapshot := prebuilds.NewGlobalSnapshot(presets, nil, nil, inProgress, nil, nil, nil, clock, testutil.Logger(t))
 
 	// Nothing has to be created for preset 1.
 	{
@@ -985,7 +1051,7 @@ func TestPrebuildScheduling(t *testing.T) {
 				schedule(presets[1].ID, "* 14-16 * * 1-5", 5),
 			}
 
-			snapshot := prebuilds.NewGlobalSnapshot(presets, schedules, nil, nil, nil, nil, clock, testutil.Logger(t))
+			snapshot := prebuilds.NewGlobalSnapshot(presets, schedules, nil, nil, nil, nil, nil, clock, testutil.Logger(t))
 
 			// Check 1st preset.
 			{
@@ -1093,6 +1159,7 @@ func TestCalculateDesiredInstances(t *testing.T) {
 			nil,
 			nil,
 			nil,
+			0,
 			nil,
 			false,
 			quartz.NewMock(t),
diff --git a/enterprise/coderd/prebuilds/reconcile.go b/enterprise/coderd/prebuilds/reconcile.go
index 214d1643bb228..ceb16061bd7a7 100644
--- a/enterprise/coderd/prebuilds/reconcile.go
+++ b/enterprise/coderd/prebuilds/reconcile.go
@@ -12,10 +12,13 @@ import (
 	"sync/atomic"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	"github.com/prometheus/client_golang/prometheus"
+	"golang.org/x/sync/errgroup"
+	"golang.org/x/xerrors"
 
-	"github.com/coder/quartz"
+	"cdr.dev/slog"
 
 	"github.com/coder/coder/v2/coderd/audit"
 	"github.com/coder/coder/v2/coderd/database"
@@ -30,12 +33,7 @@ import (
 	"github.com/coder/coder/v2/coderd/wsbuilder"
 	"github.com/coder/coder/v2/codersdk"
 	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
-
-	"cdr.dev/slog"
-
-	"github.com/google/uuid"
-	"golang.org/x/sync/errgroup"
-	"golang.org/x/xerrors"
+	"github.com/coder/quartz"
 )
 
 type StoreReconciler struct {
@@ -412,6 +410,11 @@ func (c *StoreReconciler) SnapshotState(ctx context.Context, store database.Stor
 			return xerrors.Errorf("failed to get prebuilds in progress: %w", err)
 		}
 
+		allPendingPrebuilds, err := db.CountPendingNonActivePrebuilds(ctx)
+		if err != nil {
+			return xerrors.Errorf("failed to get pending prebuilds: %w", err)
+		}
+
 		presetsBackoff, err := db.GetPresetsBackoff(ctx, c.clock.Now().Add(-c.cfg.ReconciliationBackoffLookback.Value()))
 		if err != nil {
 			return xerrors.Errorf("failed to get backoffs for presets: %w", err)
@@ -427,6 +430,7 @@ func (c *StoreReconciler) SnapshotState(ctx context.Context, store database.Stor
 			presetPrebuildSchedules,
 			allRunningPrebuilds,
 			allPrebuildsInProgress,
+			allPendingPrebuilds,
 			presetsBackoff,
 			hardLimitedPresets,
 			c.clock,
@@ -581,6 +585,8 @@ func (c *StoreReconciler) executeReconciliationAction(ctx context.Context, logge
 		levelFn = logger.Info
 	case action.ActionType == prebuilds.ActionTypeDelete && len(action.DeleteIDs) > 0:
 		levelFn = logger.Info
+	case action.ActionType == prebuilds.ActionTypeCancelPending:
+		levelFn = logger.Info
 	}
 
 	switch action.ActionType {
@@ -635,6 +641,36 @@ func (c *StoreReconciler) executeReconciliationAction(ctx context.Context, logge
 
 		return multiErr.ErrorOrNil()
 
+	case prebuilds.ActionTypeCancelPending:
+		// Cancel pending prebuild jobs from non-active template versions to avoid
+		// provisioning obsolete workspaces that would immediately be deprovisioned.
+		// This uses a criteria-based update to ensure only jobs that are still pending
+		// at execution time are canceled, avoiding race conditions where jobs may have
+		// transitioned to running status between query and update.
+		canceledJobs, err := c.store.UpdatePrebuildProvisionerJobWithCancel(
+			ctx,
+			database.UpdatePrebuildProvisionerJobWithCancelParams{
+				Now: c.clock.Now(),
+				PresetID: uuid.NullUUID{
+					UUID:  ps.Preset.ID,
+					Valid: true,
+				},
+			})
+		if err != nil {
+			logger.Error(ctx, "failed to cancel pending prebuild jobs",
+				slog.F("template_version_id", ps.Preset.TemplateVersionID.String()),
+				slog.F("preset_id", ps.Preset.ID),
+				slog.Error(err))
+			return err
+		}
+		if len(canceledJobs) > 0 {
+			logger.Info(ctx, "canceled pending prebuild jobs for inactive version",
+				slog.F("template_version_id", ps.Preset.TemplateVersionID.String()),
+				slog.F("preset_id", ps.Preset.ID),
+				slog.F("count", len(canceledJobs)))
+		}
+		return nil
+
 	default:
 		return xerrors.Errorf("unknown action type: %v", action.ActionType)
 	}
diff --git a/enterprise/coderd/prebuilds/reconcile_test.go b/enterprise/coderd/prebuilds/reconcile_test.go
index 413d61ddbbc6a..33b99145d8e12 100644
--- a/enterprise/coderd/prebuilds/reconcile_test.go
+++ b/enterprise/coderd/prebuilds/reconcile_test.go
@@ -9,36 +9,35 @@ import (
 	"testing"
 	"time"
 
+	"github.com/google/uuid"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
-	"golang.org/x/xerrors"
-
-	"github.com/coder/coder/v2/coderd/coderdtest"
-	"github.com/coder/coder/v2/coderd/database/dbtime"
-	"github.com/coder/coder/v2/coderd/files"
-	"github.com/coder/coder/v2/coderd/notifications"
-	"github.com/coder/coder/v2/coderd/notifications/notificationstest"
-	"github.com/coder/coder/v2/coderd/util/slice"
-	"github.com/coder/coder/v2/coderd/wsbuilder"
-	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
-
-	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
+	"golang.org/x/xerrors"
 	"tailscale.com/types/ptr"
 
 	"cdr.dev/slog"
 	"cdr.dev/slog/sloggers/slogtest"
-	"github.com/coder/quartz"
-
-	"github.com/coder/serpent"
 
+	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/coderd/database/dbfake"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
 	"github.com/coder/coder/v2/coderd/database/dbtestutil"
+	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/database/pubsub"
+	"github.com/coder/coder/v2/coderd/files"
+	"github.com/coder/coder/v2/coderd/notifications"
+	"github.com/coder/coder/v2/coderd/notifications/notificationstest"
+	"github.com/coder/coder/v2/coderd/rbac"
+	"github.com/coder/coder/v2/coderd/util/slice"
+	"github.com/coder/coder/v2/coderd/wsbuilder"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd/prebuilds"
+	sdkproto "github.com/coder/coder/v2/provisionersdk/proto"
 	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/quartz"
+	"github.com/coder/serpent"
 )
 
 func TestNoReconciliationActionsIfNoPresets(t *testing.T) {
@@ -1783,6 +1782,552 @@ func TestExpiredPrebuildsMultipleActions(t *testing.T) {
 	}
 }
 
+func TestCancelPendingPrebuilds(t *testing.T) {
+	t.Parallel()
+
+	t.Run("CancelPendingPrebuilds", func(t *testing.T) {
+		t.Parallel()
+
+		for _, tt := range []struct {
+			name       string
+			setupBuild func(
+				t *testing.T,
+				db database.Store,
+				client *codersdk.Client,
+				orgID uuid.UUID,
+				templateID uuid.UUID,
+				templateVersionID uuid.UUID,
+				presetID uuid.NullUUID,
+			) dbfake.WorkspaceResponse
+			activeTemplateVersion bool
+			previouslyCanceled    bool
+			previouslyCompleted   bool
+			shouldCancel          bool
+		}{
+			// Should cancel pending prebuild-related jobs from a non-active template version
+			{
+				name: "CancelsPendingPrebuildJobNonActiveVersion",
+				// Given: a pending prebuild job
+				setupBuild: func(t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Pending().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          true,
+			},
+			// Should not cancel pending prebuild-related jobs from an active template version
+			{
+				name: "DoesNotCancelPendingPrebuildJobActiveVersion",
+				// Given: a pending prebuild job
+				setupBuild: func(t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Pending().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: true,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          false,
+			},
+			// Should not cancel pending prebuild-related jobs associated to a second workspace build
+			{
+				name: "DoesNotCancelPendingPrebuildJobSecondBuild",
+				// Given: a pending prebuild job associated to a second workspace build
+				setupBuild: func(t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Pending().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						BuildNumber:             int32(2),
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          false,
+			},
+			// Should not cancel pending prebuild-related jobs of a different template
+			{
+				name: "DoesNotCancelPrebuildJobDifferentTemplate",
+				// Given: a pending prebuild job belonging to a different template
+				setupBuild: func(
+					t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     uuid.Nil,
+					}).Pending().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          false,
+			},
+			// Should not cancel pending user workspace build jobs
+			{
+				name: "DoesNotCancelUserWorkspaceJob",
+				// Given: a pending user workspace build job
+				setupBuild: func(
+					t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					_, member := coderdtest.CreateAnotherUser(t, client, orgID, rbac.RoleMember())
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        member.ID,
+						OrganizationID: orgID,
+						TemplateID:     uuid.Nil,
+					}).Pending().Seed(database.WorkspaceBuild{
+						InitiatorID:             member.ID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          false,
+			},
+			// Should not cancel pending prebuild-related jobs with a delete transition
+			{
+				name: "DoesNotCancelPrebuildJobDeleteTransition",
+				// Given: a pending prebuild job with a delete transition
+				setupBuild: func(
+					t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Pending().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						Transition:              database.WorkspaceTransitionDelete,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          false,
+			},
+			// Should not cancel prebuild-related jobs already being processed by a provisioner
+			{
+				name: "DoesNotCancelRunningPrebuildJob",
+				// Given: a running prebuild job
+				setupBuild: func(
+					t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Starting().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   false,
+				shouldCancel:          false,
+			},
+			// Should not cancel already canceled prebuild-related jobs
+			{
+				name: "DoesNotCancelCanceledPrebuildJob",
+				// Given: a canceled prebuild job
+				setupBuild: func(
+					t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Canceled().Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				shouldCancel:          false,
+				previouslyCanceled:    true,
+				previouslyCompleted:   true,
+			},
+			// Should not cancel completed prebuild-related jobs
+			{
+				name: "DoesNotCancelCompletedPrebuildJob",
+				// Given: a completed prebuild job
+				setupBuild: func(
+					t *testing.T,
+					db database.Store,
+					client *codersdk.Client,
+					orgID uuid.UUID,
+					templateID uuid.UUID,
+					templateVersionID uuid.UUID,
+					presetID uuid.NullUUID,
+				) dbfake.WorkspaceResponse {
+					return dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+						OwnerID:        database.PrebuildsSystemUserID,
+						OrganizationID: orgID,
+						TemplateID:     templateID,
+					}).Seed(database.WorkspaceBuild{
+						InitiatorID:             database.PrebuildsSystemUserID,
+						TemplateVersionID:       templateVersionID,
+						TemplateVersionPresetID: presetID,
+					}).Do()
+				},
+				activeTemplateVersion: false,
+				shouldCancel:          false,
+				previouslyCanceled:    false,
+				previouslyCompleted:   true,
+			},
+		} {
+			t.Run(tt.name, func(t *testing.T) {
+				t.Parallel()
+
+				// Set the clock to Monday, January 1st, 2024 at 8:00 AM UTC to keep the test deterministic
+				clock := quartz.NewMock(t)
+				clock.Set(time.Date(2024, 1, 1, 8, 0, 0, 0, time.UTC))
+
+				ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+				defer cancel()
+
+				// Setup
+				db, ps := dbtestutil.NewDB(t)
+				client, _, _ := coderdtest.NewWithAPI(t, &coderdtest.Options{
+					// Explicitly not including provisioner daemons, as we don't want the jobs to be processed
+					// Jobs operations will be simulated via the database model
+					IncludeProvisionerDaemon: false,
+					Database:                 db,
+					Pubsub:                   ps,
+					Clock:                    clock,
+				})
+				fakeEnqueuer := newFakeEnqueuer()
+				registry := prometheus.NewRegistry()
+				cache := files.New(registry, &coderdtest.FakeAuthorizer{})
+				logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+				reconciler := prebuilds.NewStoreReconciler(db, ps, cache, codersdk.PrebuildsConfig{}, logger, clock, registry, fakeEnqueuer, newNoopUsageCheckerPtr())
+				owner := coderdtest.CreateFirstUser(t, client)
+
+				// Given: a template with a version containing a preset with 1 prebuild instance
+				nonActivePresetID := uuid.NullUUID{
+					UUID:  uuid.New(),
+					Valid: true,
+				}
+				nonActiveTemplateVersion := dbfake.TemplateVersion(t, db).Seed(database.TemplateVersion{
+					OrganizationID: owner.OrganizationID,
+					CreatedBy:      owner.UserID,
+				}).Preset(database.TemplateVersionPreset{
+					ID: nonActivePresetID.UUID,
+					DesiredInstances: sql.NullInt32{
+						Int32: 1,
+						Valid: true,
+					},
+				}).Do()
+				templateID := nonActiveTemplateVersion.Template.ID
+
+				// Given: a new active template version
+				activePresetID := uuid.NullUUID{
+					UUID:  uuid.New(),
+					Valid: true,
+				}
+				activeTemplateVersion := dbfake.TemplateVersion(t, db).Seed(database.TemplateVersion{
+					OrganizationID: owner.OrganizationID,
+					CreatedBy:      owner.UserID,
+					TemplateID: uuid.NullUUID{
+						UUID:  templateID,
+						Valid: true,
+					},
+				}).Preset(database.TemplateVersionPreset{
+					ID: activePresetID.UUID,
+					DesiredInstances: sql.NullInt32{
+						Int32: 1,
+						Valid: true,
+					},
+				}).SkipCreateTemplate().Do()
+
+				var workspace dbfake.WorkspaceResponse
+				if tt.activeTemplateVersion {
+					// Given: a prebuilt workspace, workspace build and respective provisioner job from an
+					// active template version
+					workspace = tt.setupBuild(t, db, client,
+						owner.OrganizationID, templateID, activeTemplateVersion.TemplateVersion.ID, activePresetID)
+				} else {
+					// Given: a prebuilt workspace, workspace build and respective provisioner job from a
+					// non-active template version
+					workspace = tt.setupBuild(t, db, client,
+						owner.OrganizationID, templateID, nonActiveTemplateVersion.TemplateVersion.ID, nonActivePresetID)
+				}
+
+				// Given: the new template version is promoted to active
+				err := db.UpdateTemplateActiveVersionByID(ctx, database.UpdateTemplateActiveVersionByIDParams{
+					ID:              templateID,
+					ActiveVersionID: activeTemplateVersion.TemplateVersion.ID,
+				})
+				require.NoError(t, err)
+
+				// When: the reconciliation loop is triggered
+				require.NoError(t, reconciler.ReconcileAll(ctx))
+
+				if tt.shouldCancel {
+					// Then: the prebuild related jobs from non-active version should be canceled
+					cancelledJob, err := db.GetProvisionerJobByID(ctx, workspace.Build.JobID)
+					require.NoError(t, err)
+					require.Equal(t, clock.Now().UTC(), cancelledJob.CanceledAt.Time.UTC())
+					require.Equal(t, clock.Now().UTC(), cancelledJob.CompletedAt.Time.UTC())
+					require.Equal(t, database.ProvisionerJobStatusCanceled, cancelledJob.JobStatus)
+				} else {
+					// Then: the provisioner job should not be canceled
+					job, err := db.GetProvisionerJobByID(ctx, workspace.Build.JobID)
+					require.NoError(t, err)
+					if !tt.previouslyCanceled {
+						require.Zero(t, job.CanceledAt.Time.UTC())
+						require.NotEqual(t, database.ProvisionerJobStatusCanceled, job.JobStatus)
+					}
+					if !tt.previouslyCompleted {
+						require.Zero(t, job.CompletedAt.Time.UTC())
+					}
+				}
+			})
+		}
+	})
+
+	t.Run("CancelPendingPrebuildsMultipleTemplates", func(t *testing.T) {
+		t.Parallel()
+
+		createTemplateVersionWithPreset := func(
+			t *testing.T,
+			db database.Store,
+			orgID uuid.UUID,
+			userID uuid.UUID,
+			templateID uuid.UUID,
+			prebuiltInstances int32,
+		) (uuid.UUID, uuid.UUID, uuid.UUID) {
+			templatePreset := uuid.NullUUID{
+				UUID:  uuid.New(),
+				Valid: true,
+			}
+			templateVersion := dbfake.TemplateVersion(t, db).Seed(database.TemplateVersion{
+				OrganizationID: orgID,
+				CreatedBy:      userID,
+				TemplateID: uuid.NullUUID{
+					UUID:  templateID,
+					Valid: true,
+				},
+			}).Preset(database.TemplateVersionPreset{
+				ID: templatePreset.UUID,
+				DesiredInstances: sql.NullInt32{
+					Int32: prebuiltInstances,
+					Valid: true,
+				},
+			}).Do()
+
+			return templateVersion.Template.ID, templateVersion.TemplateVersion.ID, templatePreset.UUID
+		}
+
+		setupPrebuilds := func(
+			t *testing.T,
+			db database.Store,
+			orgID uuid.UUID,
+			templateID uuid.UUID,
+			versionID uuid.UUID,
+			presetID uuid.UUID,
+			count int,
+			pending bool,
+		) []dbfake.WorkspaceResponse {
+			prebuilds := make([]dbfake.WorkspaceResponse, count)
+			for i := range count {
+				builder := dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{
+					OwnerID:        database.PrebuildsSystemUserID,
+					OrganizationID: orgID,
+					TemplateID:     templateID,
+				})
+
+				if pending {
+					builder = builder.Pending()
+				}
+
+				prebuilds[i] = builder.Seed(database.WorkspaceBuild{
+					InitiatorID:       database.PrebuildsSystemUserID,
+					TemplateVersionID: versionID,
+					TemplateVersionPresetID: uuid.NullUUID{
+						UUID:  presetID,
+						Valid: true,
+					},
+				}).Do()
+			}
+
+			return prebuilds
+		}
+
+		checkIfJobCanceled := func(
+			t *testing.T,
+			clock *quartz.Mock,
+			ctx context.Context,
+			db database.Store,
+			shouldBeCanceled bool,
+			prebuilds []dbfake.WorkspaceResponse,
+		) {
+			for _, prebuild := range prebuilds {
+				job, err := db.GetProvisionerJobByID(ctx, prebuild.Build.JobID)
+				require.NoError(t, err)
+
+				if shouldBeCanceled {
+					require.Equal(t, database.ProvisionerJobStatusCanceled, job.JobStatus)
+					require.Equal(t, clock.Now().UTC(), job.CanceledAt.Time.UTC())
+					require.Equal(t, clock.Now().UTC(), job.CompletedAt.Time.UTC())
+				} else {
+					require.NotEqual(t, database.ProvisionerJobStatusCanceled, job.JobStatus)
+					require.Zero(t, job.CanceledAt.Time.UTC())
+				}
+			}
+		}
+
+		// Set the clock to Monday, January 1st, 2024 at 8:00 AM UTC to keep the test deterministic
+		clock := quartz.NewMock(t)
+		clock.Set(time.Date(2024, 1, 1, 8, 0, 0, 0, time.UTC))
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitLong)
+		defer cancel()
+
+		// Setup
+		db, ps := dbtestutil.NewDB(t)
+		client, _, _ := coderdtest.NewWithAPI(t, &coderdtest.Options{
+			// Explicitly not including provisioner daemons, as we don't want the jobs to be processed
+			// Jobs operations will be simulated via the database model
+			IncludeProvisionerDaemon: false,
+			Database:                 db,
+			Pubsub:                   ps,
+			Clock:                    clock,
+		})
+		fakeEnqueuer := newFakeEnqueuer()
+		registry := prometheus.NewRegistry()
+		cache := files.New(registry, &coderdtest.FakeAuthorizer{})
+		logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+		reconciler := prebuilds.NewStoreReconciler(db, ps, cache, codersdk.PrebuildsConfig{}, logger, clock, registry, fakeEnqueuer, newNoopUsageCheckerPtr())
+		owner := coderdtest.CreateFirstUser(t, client)
+
+		// Given: template A with 2 versions
+		// Given: template A version v1: with a preset with 5 instances (2 running, 3 pending)
+		templateAID, templateAVersion1ID, templateAVersion1PresetID := createTemplateVersionWithPreset(t, db, owner.OrganizationID, owner.UserID, uuid.Nil, 5)
+		templateAVersion1Running := setupPrebuilds(t, db, owner.OrganizationID, templateAID, templateAVersion1ID, templateAVersion1PresetID, 2, false)
+		templateAVersion1Pending := setupPrebuilds(t, db, owner.OrganizationID, templateAID, templateAVersion1ID, templateAVersion1PresetID, 3, true)
+		// Given: template A version v2 (active version): with a preset with 2 instances (1 running, 1 pending)
+		_, templateAVersion2ID, templateAVersion2PresetID := createTemplateVersionWithPreset(t, db, owner.OrganizationID, owner.UserID, templateAID, 2)
+		templateAVersion2Running := setupPrebuilds(t, db, owner.OrganizationID, templateAID, templateAVersion2ID, templateAVersion2PresetID, 1, false)
+		templateAVersion2Pending := setupPrebuilds(t, db, owner.OrganizationID, templateAID, templateAVersion2ID, templateAVersion2PresetID, 1, true)
+
+		// Given: template B with 3 versions
+		// Given: template B version v1: with a preset with 3 instances (1 running, 2 pending)
+		templateBID, templateBVersion1ID, templateBVersion1PresetID := createTemplateVersionWithPreset(t, db, owner.OrganizationID, owner.UserID, uuid.Nil, 3)
+		templateBVersion1Running := setupPrebuilds(t, db, owner.OrganizationID, templateBID, templateBVersion1ID, templateBVersion1PresetID, 1, false)
+		templateBVersion1Pending := setupPrebuilds(t, db, owner.OrganizationID, templateBID, templateBVersion1ID, templateBVersion1PresetID, 2, true)
+		// Given: template B version v2: with a preset with 2 instances (2 pending)
+		_, templateBVersion2ID, templateBVersion2PresetID := createTemplateVersionWithPreset(t, db, owner.OrganizationID, owner.UserID, templateBID, 2)
+		templateBVersion2Pending := setupPrebuilds(t, db, owner.OrganizationID, templateBID, templateBVersion2ID, templateBVersion2PresetID, 2, true)
+		// Given: template B version v3 (active version): with a preset with 2 instances (1 running, 1 pending)
+		_, templateBVersion3ID, templateBVersion3PresetID := createTemplateVersionWithPreset(t, db, owner.OrganizationID, owner.UserID, templateBID, 2)
+		templateBVersion3Running := setupPrebuilds(t, db, owner.OrganizationID, templateBID, templateBVersion3ID, templateBVersion3PresetID, 1, false)
+		templateBVersion3Pending := setupPrebuilds(t, db, owner.OrganizationID, templateBID, templateBVersion3ID, templateBVersion3PresetID, 1, true)
+
+		// When: the reconciliation loop is executed
+		require.NoError(t, reconciler.ReconcileAll(ctx))
+
+		// Then: template A version 1 running workspaces should not be canceled
+		checkIfJobCanceled(t, clock, ctx, db, false, templateAVersion1Running)
+		// Then: template A version 1 pending workspaces should be canceled
+		checkIfJobCanceled(t, clock, ctx, db, true, templateAVersion1Pending)
+		// Then: template A version 2 running and pending workspaces should not be canceled
+		checkIfJobCanceled(t, clock, ctx, db, false, templateAVersion2Running)
+		checkIfJobCanceled(t, clock, ctx, db, false, templateAVersion2Pending)
+
+		// Then: template B version 1 running workspaces should not be canceled
+		checkIfJobCanceled(t, clock, ctx, db, false, templateBVersion1Running)
+		// Then: template B version 1 pending workspaces should be canceled
+		checkIfJobCanceled(t, clock, ctx, db, true, templateBVersion1Pending)
+		// Then: template B version 2 pending workspaces should be canceled
+		checkIfJobCanceled(t, clock, ctx, db, true, templateBVersion2Pending)
+		// Then: template B version 3 running and pending workspaces should not be canceled
+		checkIfJobCanceled(t, clock, ctx, db, false, templateBVersion3Running)
+		checkIfJobCanceled(t, clock, ctx, db, false, templateBVersion3Pending)
+	})
+}
+
 func newNoopEnqueuer() *notifications.NoopEnqueuer {
 	return notifications.NewNoopEnqueuer()
 }

From cd0a2849d0cb32b80b293afbf243308a7a34cab8 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Fri, 24 Oct 2025 11:56:57 -0300
Subject: [PATCH 241/298] fix: fix URL parameter for task (#20463)

---
 site/src/pages/TaskPage/TaskPage.stories.tsx | 13 +++++++++++--
 site/src/pages/TaskPage/TaskPage.tsx         |  4 ++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/site/src/pages/TaskPage/TaskPage.stories.tsx b/site/src/pages/TaskPage/TaskPage.stories.tsx
index 730aa1b1734a0..19003eb621699 100644
--- a/site/src/pages/TaskPage/TaskPage.stories.tsx
+++ b/site/src/pages/TaskPage/TaskPage.stories.tsx
@@ -72,10 +72,11 @@ const meta: Meta<typeof TaskPage> = {
 		reactRouter: reactRouterParameters({
 			location: {
 				pathParams: {
-					taskId: MockTasks[0].id,
+					username: MockTask.owner_name,
+					taskId: MockTask.id,
 				},
 			},
-			routing: { path: "/tasks/:taskId" },
+			routing: { path: "/tasks/:username/:taskId" },
 		}),
 	},
 };
@@ -89,6 +90,14 @@ export const LoadingTask: Story = {
 			() => new Promise(() => {}),
 		);
 	},
+	play: async () => {
+		await waitFor(() => {
+			expect(API.experimental.getTask).toHaveBeenCalledWith(
+				MockTask.owner_name,
+				MockTask.id,
+			);
+		});
+	},
 };
 
 export const LoadingWorkspace: Story = {
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index f136a16ceb4c4..9724c09f5d2cd 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -55,8 +55,8 @@ const TaskPageLayout: FC<PropsWithChildren> = ({ children }) => {
 };
 
 const TaskPage = () => {
-	const { task: taskId, username } = useParams() as {
-		task: string;
+	const { taskId, username } = useParams() as {
+		taskId: string;
 		username: string;
 	};
 	const { data: task, ...taskQuery } = useQuery({

From 7bad7e35ae947cb3a0c7e8276fc221944f793334 Mon Sep 17 00:00:00 2001
From: Jaayden Halko <jaayden.halko@gmail.com>
Date: Fri, 24 Oct 2025 16:05:18 +0100
Subject: [PATCH 242/298] chore: update claude markdown docs (#20446)

Suggesting some improvements for claude code and tasks usage. See
comments inline.

---------

Co-authored-by: Dean Sheather <dean@deansheather.com>
---
 .claude/docs/TROUBLESHOOTING.md | 12 +++++--
 .claude/docs/WORKFLOWS.md       | 10 ++++--
 CLAUDE.md                       | 59 ++++++++++++++++++++++-----------
 3 files changed, 57 insertions(+), 24 deletions(-)

diff --git a/.claude/docs/TROUBLESHOOTING.md b/.claude/docs/TROUBLESHOOTING.md
index 28851b5b640f0..1788d5df84a94 100644
--- a/.claude/docs/TROUBLESHOOTING.md
+++ b/.claude/docs/TROUBLESHOOTING.md
@@ -91,6 +91,9 @@
 
 ## Systematic Debugging Approach
 
+YOU MUST ALWAYS find the root cause of any issue you are debugging
+YOU MUST NEVER fix a symptom or add a workaround instead of finding a root cause, even if it is faster.
+
 ### Multi-Issue Problem Solving
 
 When facing multiple failing tests or complex integration issues:
@@ -98,16 +101,21 @@ When facing multiple failing tests or complex integration issues:
 1. **Identify Root Causes**:
    - Run failing tests individually to isolate issues
    - Use LSP tools to trace through call chains
-   - Check both compilation and runtime errors
+   - Read Error Messages Carefully: Check both compilation and runtime errors
+   - Reproduce Consistently: Ensure you can reliably reproduce the issue before investigating
+   - Check Recent Changes: What changed that could have caused this? Git diff, recent commits, etc.
+   - When You Don't Know: Say "I don't understand X" rather than pretending to know
 
 2. **Fix in Logical Order**:
    - Address compilation issues first (imports, syntax)
    - Fix authorization and RBAC issues next
    - Resolve business logic and validation issues
    - Handle edge cases and race conditions last
+   - IF your first fix doesn't work, STOP and re-analyze rather than adding more fixes
 
 3. **Verification Strategy**:
-   - Test each fix individually before moving to next issue
+   - Always Test each fix individually before moving to next issue
+   - Verify Before Continuing: Did your test work? If not, form new hypothesis - don't add more fixes
    - Use `make lint` and `make gen` after database changes
    - Verify RFC compliance with actual specifications
    - Run comprehensive test suites before considering complete
diff --git a/.claude/docs/WORKFLOWS.md b/.claude/docs/WORKFLOWS.md
index 8fc43002bba7d..4e9dfb78599ee 100644
--- a/.claude/docs/WORKFLOWS.md
+++ b/.claude/docs/WORKFLOWS.md
@@ -40,11 +40,15 @@
 - Use proper error types
 - Pattern: `xerrors.Errorf("failed to X: %w", err)`
 
-### Naming Conventions
+## Naming Conventions
 
-- Use clear, descriptive names
-- Abbreviate only when obvious
+- Names MUST tell what code does, not how it's implemented or its history
 - Follow Go and TypeScript naming conventions
+- When changing code, never document the old behavior or the behavior change
+- NEVER use implementation details in names (e.g., "ZodValidator", "MCPWrapper", "JSONParser")
+- NEVER use temporal/historical context in names (e.g., "LegacyHandler", "UnifiedTool", "ImprovedInterface", "EnhancedParser")
+- NEVER use pattern names unless they add clarity (e.g., prefer "Tool" over "ToolFactory")
+- Abbreviate only when obvious
 
 ### Comments
 
diff --git a/CLAUDE.md b/CLAUDE.md
index 3de33a5466054..e6d8f0bcf9a29 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -1,11 +1,41 @@
 # Coder Development Guidelines
 
+You are an experienced, pragmatic software engineer. You don't over-engineer a solution when a simple one is possible.
+Rule #1: If you want exception to ANY rule, YOU MUST STOP and get explicit permission first. BREAKING THE LETTER OR SPIRIT OF THE RULES IS FAILURE.
+
+## Foundational rules
+
+- Doing it right is better than doing it fast. You are not in a rush. NEVER skip steps or take shortcuts.
+- Tedious, systematic work is often the correct solution. Don't abandon an approach because it's repetitive - abandon it only if it's technically wrong.
+- Honesty is a core value.
+
+## Our relationship
+
+- Act as a critical peer reviewer. Your job is to disagree with me when I'm wrong, not to please me. Prioritize accuracy and reasoning over agreement.
+- YOU MUST speak up immediately when you don't know something or we're in over our heads
+- YOU MUST call out bad ideas, unreasonable expectations, and mistakes - I depend on this
+- NEVER be agreeable just to be nice - I NEED your HONEST technical judgment
+- NEVER write the phrase "You're absolutely right!"  You are not a sycophant. We're working together because I value your opinion. Do not agree with me unless you can justify it with evidence or reasoning.
+- YOU MUST ALWAYS STOP and ask for clarification rather than making assumptions.
+- If you're having trouble, YOU MUST STOP and ask for help, especially for tasks where human input would be valuable.
+- When you disagree with my approach, YOU MUST push back. Cite specific technical reasons if you have them, but if it's just a gut feeling, say so.
+- If you're uncomfortable pushing back out loud, just say "Houston, we have a problem". I'll know what you mean
+- We discuss architectutral decisions (framework changes, major refactoring, system design) together before implementation. Routine fixes and clear implementations don't need discussion.
+
+## Proactiveness
+
+When asked to do something, just do it - including obvious follow-up actions needed to complete the task properly.
+Only pause to ask for confirmation when:
+
+- Multiple valid approaches exist and the choice matters
+- The action would delete or significantly restructure existing code
+- You genuinely don't understand what's being asked
+- Your partner asked a question (answer the question, don't jump to implementation)
+
 @.claude/docs/WORKFLOWS.md
-@.cursorrules
-@README.md
 @package.json
 
-## 🚀 Essential Commands
+## Essential Commands
 
 | Task              | Command                  | Notes                            |
 |-------------------|--------------------------|----------------------------------|
@@ -21,22 +51,13 @@
 | **Format**        | `make fmt`               | Auto-format code                 |
 | **Clean**         | `make clean`             | Clean build artifacts            |
 
-### Frontend Commands (site directory)
-
-- `pnpm build` - Build frontend
-- `pnpm dev` - Run development server
-- `pnpm check` - Run code checks
-- `pnpm format` - Format frontend code
-- `pnpm lint` - Lint frontend code
-- `pnpm test` - Run frontend tests
-
 ### Documentation Commands
 
 - `pnpm run format-docs` - Format markdown tables in docs
 - `pnpm run lint-docs` - Lint and fix markdown files
 - `pnpm run storybook` - Run Storybook (from site directory)
 
-## 🔧 Critical Patterns
+## Critical Patterns
 
 ### Database Changes (ALWAYS FOLLOW)
 
@@ -78,7 +99,7 @@ app, err := api.Database.GetOAuth2ProviderAppByClientID(dbauthz.AsSystemRestrict
 app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID)
 ```
 
-## 📋 Quick Reference
+## Quick Reference
 
 ### Full workflows available in imported WORKFLOWS.md
 
@@ -88,14 +109,14 @@ app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID)
 - [ ] Check if feature touches database - you'll need migrations
 - [ ] Check if feature touches audit logs - update `enterprise/audit/table.go`
 
-## 🏗️ Architecture
+## Architecture
 
 - **coderd**: Main API service
 - **provisionerd**: Infrastructure provisioning
 - **Agents**: Workspace services (SSH, port forwarding)
 - **Database**: PostgreSQL with `dbauthz` authorization
 
-## 🧪 Testing
+## Testing
 
 ### Race Condition Prevention
 
@@ -112,21 +133,21 @@ app, err := api.Database.GetOAuth2ProviderAppByClientID(ctx, clientID)
 NEVER use `time.Sleep` to mitigate timing issues. If an issue
 seems like it should use `time.Sleep`, read through https://github.com/coder/quartz and specifically the [README](https://github.com/coder/quartz/blob/main/README.md) to better understand how to handle timing issues.
 
-## 🎯 Code Style
+## Code Style
 
 ### Detailed guidelines in imported WORKFLOWS.md
 
 - Follow [Uber Go Style Guide](https://github.com/uber-go/guide/blob/master/style.md)
 - Commit format: `type(scope): message`
 
-## 📚 Detailed Development Guides
+## Detailed Development Guides
 
 @.claude/docs/OAUTH2.md
 @.claude/docs/TESTING.md
 @.claude/docs/TROUBLESHOOTING.md
 @.claude/docs/DATABASE.md
 
-## 🚨 Common Pitfalls
+## Common Pitfalls
 
 1. **Audit table errors** → Update `enterprise/audit/table.go`
 2. **OAuth2 errors** → Return RFC-compliant format

From b8a0f97cab2ef464b95d24ea979f3b954bf8d873 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Fri, 24 Oct 2025 18:19:05 +0100
Subject: [PATCH 243/298] chore(coderd): add test for deleting task with no
 workspace (#20466)

---
 coderd/aitasks_test.go | 43 ++++++++++++++++++++++++++++++++----------
 1 file changed, 33 insertions(+), 10 deletions(-)

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 491194ffd9483..80af3e993e97a 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -1,6 +1,7 @@
 package coderd_test
 
 import (
+	"context"
 	"database/sql"
 	"encoding/json"
 	"io"
@@ -376,18 +377,14 @@ func TestTasks(t *testing.T) {
 			require.NoError(t, err, "delete task request should be accepted")
 
 			// Poll until the workspace is deleted.
-			for {
+			testutil.Eventually(ctx, t, func(ctx context.Context) (done bool) {
 				dws, derr := client.DeletedWorkspace(ctx, task.WorkspaceID.UUID)
-				if derr == nil && dws.LatestBuild.Status == codersdk.WorkspaceStatusDeleted {
-					break
+				if !assert.NoError(t, derr, "expected to fetch deleted workspace before deadline") {
+					return false
 				}
-				if ctx.Err() != nil {
-					require.NoError(t, derr, "expected to fetch deleted workspace before deadline")
-					require.Equal(t, codersdk.WorkspaceStatusDeleted, dws.LatestBuild.Status, "workspace should be deleted before deadline")
-					break
-				}
-				time.Sleep(testutil.IntervalMedium)
-			}
+				t.Logf("workspace latest_build status: %q", dws.LatestBuild.Status)
+				return dws.LatestBuild.Status == codersdk.WorkspaceStatusDeleted
+			}, testutil.IntervalMedium, "workspace should be deleted before deadline")
 		})
 
 		t.Run("NotFound", func(t *testing.T) {
@@ -468,6 +465,32 @@ func TestTasks(t *testing.T) {
 				t.Fatalf("unexpected status code: %d (expected 403 or 404)", authErr.StatusCode())
 			}
 		})
+
+		t.Run("NoWorkspace", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			user := coderdtest.CreateFirstUser(t, client)
+			template := createAITemplate(t, client, user)
+			ctx := testutil.Context(t, testutil.WaitLong)
+			exp := codersdk.NewExperimentalClient(client)
+			task, err := exp.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+				TemplateVersionID: template.ActiveVersionID,
+				Input:             "delete me",
+			})
+			require.NoError(t, err)
+			require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
+			ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+			require.NoError(t, err)
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+			// Delete the task workspace
+			coderdtest.MustTransitionWorkspace(t, client, ws.ID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionDelete)
+			// We should still be able to fetch the task after deleting its workspace
+			task, err = exp.TaskByID(ctx, task.ID)
+			require.NoError(t, err, "fetching a task should still work after deleting its related workspace")
+			err = exp.DeleteTask(ctx, task.OwnerID.String(), task.ID)
+			require.NoError(t, err, "should be possible to delete a task with no workspace")
+		})
 	})
 
 	t.Run("Send", func(t *testing.T) {

From 87045fc27ba7e8efeae58f7e2b3c0bf428b2740b Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Sat, 25 Oct 2025 00:03:16 +0500
Subject: [PATCH 244/298] chore(dogfood): update claude-code module version to
 3.3.1 (#20467)

---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 3b7da5f5157a1..dfb97a7e21065 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -850,7 +850,7 @@ locals {
 module "claude-code" {
   count               = local.has_ai_prompt ? data.coder_workspace.me.start_count : 0
   source              = "dev.registry.coder.com/coder/claude-code/coder"
-  version             = "3.1.1"
+  version             = "3.3.1"
   agent_id            = coder_agent.dev.id
   workdir             = local.repo_dir
   claude_code_version = "latest"

From b89093031e0fb3c78c598ddabec767a0660dded8 Mon Sep 17 00:00:00 2001
From: Faur Ioan-Aurel <fioan89@gmail.com>
Date: Sat, 25 Oct 2025 06:05:03 +0300
Subject: [PATCH 245/298] fix: initialize pseudo console with default size for
 SSH sessions (#20472)

Resolved an invalid parameter error (-2147024809) during PTY creation on
Windows 11 22H2 (but not only) when connecting via JetBrains Toolbox
which spawns the native SSH client with `-tt` forcing PTY allocation
even though there is no "terminal" on the client side to query its size.

CreatePseudoConsole doesn't accept a 0x0 (zero width and zero height)
console size and unfortunately, there is NO explicit documentation in
the official Microsoft documentation that states the minimum valid
values or explicitly prohibits 0x0.

Looking at real-world implementations in the search results, all
examples use reasonable non-zero values.

I tested this with a local Windows VM registered to dev.coder.com i.e.
externally managed workspace.

Fixes: #20468
---
 pty/pty_windows.go | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/pty/pty_windows.go b/pty/pty_windows.go
index 93fea12019627..987ef02eb281d 100644
--- a/pty/pty_windows.go
+++ b/pty/pty_windows.go
@@ -54,10 +54,19 @@ func newPty(opt ...Option) (*ptyWindows, error) {
 		return nil, err
 	}
 
-	consoleSize := uintptr(80) + (uintptr(80) << 16)
+	// Default dimensions
+	width, height := 80, 80
 	if opts.sshReq != nil {
-		consoleSize = uintptr(opts.sshReq.Window.Width) + (uintptr(opts.sshReq.Window.Height) << 16)
+		if w := opts.sshReq.Window.Width; w > 0 && w <= 65535 {
+			width = w
+		}
+		if h := opts.sshReq.Window.Height; h > 0 && h <= 65535 {
+			height = h
+		}
 	}
+
+	consoleSize := uintptr(width) + (uintptr(height) << 16)
+
 	ret, _, err := procCreatePseudoConsole.Call(
 		consoleSize,
 		uintptr(pty.inputRead.Fd()),

From 9780d0295cd9b67bf0dd31c191e618d526c63781 Mon Sep 17 00:00:00 2001
From: Atif Ali <atif@coder.com>
Date: Mon, 27 Oct 2025 05:13:26 +0500
Subject: [PATCH 246/298] feat(cli): add dynamic completions for ssh command
 (#20171)

Adds CompletionHandler to the ssh command that dynamically suggests
workspace and agent targets based on the user's running workspaces.

Features:
- Suggests workspace name for single-agent workspaces
- Suggests agent.workspace format for all agents in multi-agent
workspaces
- Only shows running workspaces (matches immediate availability)
- Alphabetically sorted completions for better UX

Tests cover single-agent, multi-agent, and network error scenarios.

Amp-Thread-ID:
https://ampcode.com/threads/T-d137d343-53f3-4ece-be5a-584249bbd9e8

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->

closes #20158

Demo:


https://github.com/user-attachments/assets/e1000463-ded6-4bc9-b013-61780453f019

---------

Co-authored-by: Ethan Dickson <ethan@coder.com>
---
 cli/ssh.go      | 45 +++++++++++++++++++++++
 cli/ssh_test.go | 96 +++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 141 insertions(+)

diff --git a/cli/ssh.go b/cli/ssh.go
index 323d2913ae370..b1d66f28a4605 100644
--- a/cli/ssh.go
+++ b/cli/ssh.go
@@ -109,6 +109,51 @@ func (r *RootCmd) ssh() *serpent.Command {
 				}
 			},
 		),
+		CompletionHandler: func(inv *serpent.Invocation) []string {
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return []string{}
+			}
+
+			res, err := client.Workspaces(inv.Context(), codersdk.WorkspaceFilter{
+				Owner: codersdk.Me,
+			})
+			if err != nil {
+				return []string{}
+			}
+
+			var mu sync.Mutex
+			var completions []string
+			var wg sync.WaitGroup
+			for _, ws := range res.Workspaces {
+				wg.Add(1)
+				go func() {
+					defer wg.Done()
+					resources, err := client.TemplateVersionResources(inv.Context(), ws.LatestBuild.TemplateVersionID)
+					if err != nil {
+						return
+					}
+					var agents []codersdk.WorkspaceAgent
+					for _, resource := range resources {
+						agents = append(agents, resource.Agents...)
+					}
+
+					mu.Lock()
+					defer mu.Unlock()
+					if len(agents) == 1 {
+						completions = append(completions, ws.Name)
+					} else {
+						for _, agent := range agents {
+							completions = append(completions, fmt.Sprintf("%s.%s", ws.Name, agent.Name))
+						}
+					}
+				}()
+			}
+			wg.Wait()
+
+			slices.Sort(completions)
+			return completions
+		},
 		Handler: func(inv *serpent.Invocation) (retErr error) {
 			client, err := r.InitClient(inv)
 			if err != nil {
diff --git a/cli/ssh_test.go b/cli/ssh_test.go
index 652e0e9c01996..7ce9d85258fa0 100644
--- a/cli/ssh_test.go
+++ b/cli/ssh_test.go
@@ -2447,3 +2447,99 @@ func tempDirUnixSocket(t *testing.T) string {
 
 	return t.TempDir()
 }
+
+func TestSSH_Completion(t *testing.T) {
+	t.Parallel()
+
+	t.Run("SingleAgent", func(t *testing.T) {
+		t.Parallel()
+
+		client, workspace, agentToken := setupWorkspaceForAgent(t)
+		_ = agenttest.New(t, client.URL, agentToken)
+		coderdtest.AwaitWorkspaceAgents(t, client, workspace.ID)
+
+		var stdout bytes.Buffer
+		inv, root := clitest.New(t, "ssh", "")
+		inv.Stdout = &stdout
+		inv.Environ.Set("COMPLETION_MODE", "1")
+		clitest.SetupConfig(t, client, root)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+		defer cancel()
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+
+		// For single-agent workspaces, the only completion should be the
+		// bare workspace name.
+		output := stdout.String()
+		t.Logf("Completion output: %q", output)
+		require.Contains(t, output, workspace.Name)
+	})
+
+	t.Run("MultiAgent", func(t *testing.T) {
+		t.Parallel()
+
+		client, store := coderdtest.NewWithDatabase(t, nil)
+		first := coderdtest.CreateFirstUser(t, client)
+		userClient, user := coderdtest.CreateAnotherUserMutators(t, client, first.OrganizationID, nil, func(r *codersdk.CreateUserRequestWithOrgs) {
+			r.Username = "multiuser"
+		})
+
+		r := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
+			Name:           "multiworkspace",
+			OrganizationID: first.OrganizationID,
+			OwnerID:        user.ID,
+		}).WithAgent(func(agents []*proto.Agent) []*proto.Agent {
+			return []*proto.Agent{
+				{
+					Name: "agent1",
+					Auth: &proto.Agent_Token{},
+				},
+				{
+					Name: "agent2",
+					Auth: &proto.Agent_Token{},
+				},
+			}
+		}).Do()
+
+		var stdout bytes.Buffer
+		inv, root := clitest.New(t, "ssh", "")
+		inv.Stdout = &stdout
+		inv.Environ.Set("COMPLETION_MODE", "1")
+		clitest.SetupConfig(t, userClient, root)
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitMedium)
+		defer cancel()
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+
+		// For multi-agent workspaces, completions should include the
+		// workspace.agent format but NOT the bare workspace name.
+		output := stdout.String()
+		t.Logf("Completion output: %q", output)
+		lines := strings.Split(strings.TrimSpace(output), "\n")
+		require.NotContains(t, lines, r.Workspace.Name)
+		require.Contains(t, output, r.Workspace.Name+".agent1")
+		require.Contains(t, output, r.Workspace.Name+".agent2")
+	})
+
+	t.Run("NetworkError", func(t *testing.T) {
+		t.Parallel()
+
+		var stdout bytes.Buffer
+		inv, _ := clitest.New(t, "ssh", "")
+		inv.Stdout = &stdout
+		inv.Environ.Set("COMPLETION_MODE", "1")
+
+		ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+		defer cancel()
+
+		err := inv.WithContext(ctx).Run()
+		require.NoError(t, err)
+
+		output := stdout.String()
+		require.Empty(t, output)
+	})
+}

From 5743149396b571f12afe03cce47ead3b8ec3fb33 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 00:27:02 +0000
Subject: [PATCH 247/298] chore: bump coder/zed/coder from 1.1.0 to 1.1.1 in
 /dogfood/coder (#20485)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/zed/coder&package-manager=terraform&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index dfb97a7e21065..0d1cfe4401d3f 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -451,7 +451,7 @@ module "windsurf" {
 module "zed" {
   count      = contains(jsondecode(data.coder_parameter.ide_choices.value), "zed") ? data.coder_workspace.me.start_count : 0
   source     = "dev.registry.coder.com/coder/zed/coder"
-  version    = "1.1.0"
+  version    = "1.1.1"
   agent_id   = coder_agent.dev.id
   agent_name = "dev"
   folder     = local.repo_dir

From c8538769a297dee7fd9b872c5de046de935a1a0c Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 00:27:07 +0000
Subject: [PATCH 248/298] chore: bump coder/claude-code/coder from 3.3.1 to
 3.3.2 in /dogfood/coder (#20484)

[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=coder/claude-code/coder&package-manager=terraform&previous-version=3.3.1&new-version=3.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 dogfood/coder/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 0d1cfe4401d3f..05ec4a6a2e975 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -850,7 +850,7 @@ locals {
 module "claude-code" {
   count               = local.has_ai_prompt ? data.coder_workspace.me.start_count : 0
   source              = "dev.registry.coder.com/coder/claude-code/coder"
-  version             = "3.3.1"
+  version             = "3.3.2"
   agent_id            = coder_agent.dev.id
   workdir             = local.repo_dir
   claude_code_version = "latest"

From 10ef5933f4a3394c6ead8199bbffd7a57df8a6ae Mon Sep 17 00:00:00 2001
From: Max Bretschneider <54221876+brtmax@users.noreply.github.com>
Date: Mon, 27 Oct 2025 01:51:42 +0100
Subject: [PATCH 249/298] chore(examples/templates): remove deleted
 vscode-server-template (#20480)

The list of community templates contained a template called
vscode-server-template which links to a hijacked accounts repository.
https://github.com/KozmikNano/vscode-server-template

I removed it from the list
---
 examples/templates/community-templates.md | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/examples/templates/community-templates.md b/examples/templates/community-templates.md
index 86bc9bce174ba..23d2f51807a70 100644
--- a/examples/templates/community-templates.md
+++ b/examples/templates/community-templates.md
@@ -23,9 +23,6 @@ templates.
   and API examples.
 - [bpmct/coder-templates](https://github.com/bpmct/coder-templates) -
   Kubernetes, OpenStack, podman, Docker, VM, AWS, Google Cloud, Azure templates.
-- [kozmiknano/vscode-server-template](https://github.com/KozmikNano/vscode-server-template) -
-  Run the full VS Code server within docker! (Built-in settings sync and
-  Microsoft Marketplace enabled)
 - [atnomoverflow/coder-template](https://github.com/atnomoverflow/coder-template) -
   Kubernetes template that install VS code server Rstudio jupyter and also set
   ssh access to gitlab (Works also on self managed gitlab).

From f3f83540dfbb5adf3fa7c03f8c5d0e3127434879 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 04:23:07 +0000
Subject: [PATCH 250/298] chore: bump coder/claude-code/coder from 3.1.1 to
 3.3.2 in /examples/templates/tasks-docker (#20486)

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 examples/templates/tasks-docker/main.tf | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/examples/templates/tasks-docker/main.tf b/examples/templates/tasks-docker/main.tf
index 186c5f2a86746..8a457584a4674 100644
--- a/examples/templates/tasks-docker/main.tf
+++ b/examples/templates/tasks-docker/main.tf
@@ -22,7 +22,7 @@ provider "docker" {}
 module "claude-code" {
   count               = data.coder_workspace.me.start_count
   source              = "registry.coder.com/coder/claude-code/coder"
-  version             = "3.1.1"
+  version             = "3.3.2"
   agent_id            = coder_agent.main.id
   workdir             = "/home/coder/projects"
   order               = 999

From 6318520501789511c52377498821fb25943f183d Mon Sep 17 00:00:00 2001
From: Ethan <39577870+ethanndickson@users.noreply.github.com>
Date: Mon, 27 Oct 2025 16:59:31 +1100
Subject: [PATCH 251/298] fix(cli/ssh): avoid swallowing unexpected http status
 codes (#20487)

If you were to somehow get a 401, or some other unexpected HTTP status code when following a workspace's build logs, `coder ssh` would swallow the error, and give you a different error that didn't make sense.
In this case I was getting a 401 on `/templateversions/{templateversion}/dry-run/{jobID}/logs` , but the CLI error would say the workspace had no agents.

I ran into the 401 when running a scaletest, and then whilst attempting to reproduce the issue locally, I ran  `coder ssh` from one build of Coder that used `coder_session_token` as the session token cookie name, whilst the other build used `dev_coder_session_token` (as set by `develop.sh`). For reference, the CLI uses cookies when following the build logs.
---
 cli/ssh.go | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/cli/ssh.go b/cli/ssh.go
index b1d66f28a4605..37000da1786de 100644
--- a/cli/ssh.go
+++ b/cli/ssh.go
@@ -951,6 +951,8 @@ func GetWorkspaceAndAgent(ctx context.Context, inv *serpent.Invocation, client *
 					return codersdk.Workspace{}, codersdk.WorkspaceAgent{}, nil, xerrors.Errorf("start workspace with active template version: %w", err)
 				}
 				_, _ = fmt.Fprintln(inv.Stdout, "Unable to start the workspace with template version from last build. Your workspace has been updated to the current active template version.")
+			default:
+				return codersdk.Workspace{}, codersdk.WorkspaceAgent{}, nil, xerrors.Errorf("start workspace with current template version: %w", err)
 			}
 		} else if err != nil {
 			return codersdk.Workspace{}, codersdk.WorkspaceAgent{}, nil, xerrors.Errorf("start workspace with current template version: %w", err)

From 50ba223aa1c4428891346fd6c22c889ca7562e45 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= <pawel@coder.com>
Date: Mon, 27 Oct 2025 09:51:37 +0100
Subject: [PATCH 252/298] feat: add db query for setting interception ended_at
 field (#20437)

Adds UpdateAIBridgeInterceptionEnded query to mark interceptions as
done.
Needed for https://github.com/coder/internal/issues/1051
---
 coderd/apidoc/docs.go                     |  4 ++
 coderd/apidoc/swagger.json                |  4 ++
 coderd/database/db2sdk/db2sdk.go          |  6 ++-
 coderd/database/dbauthz/dbauthz.go        |  7 +++
 coderd/database/dbauthz/dbauthz_test.go   |  9 ++++
 coderd/database/dbgen/dbgen.go            |  9 +++-
 coderd/database/dbmetrics/querymetrics.go |  7 +++
 coderd/database/dbmock/dbmock.go          | 15 ++++++
 coderd/database/querier.go                |  1 +
 coderd/database/querier_test.go           | 65 +++++++++++++++++++++++
 coderd/database/queries.sql.go            | 29 ++++++++++
 coderd/database/queries/aibridge.sql      |  8 +++
 codersdk/aibridge.go                      |  1 +
 docs/reference/api/aibridge.md            |  1 +
 docs/reference/api/schemas.md             |  3 ++
 enterprise/cli/exp_aibridge_test.go       | 24 ++++-----
 enterprise/coderd/aibridge_test.go        | 25 +++++----
 site/src/api/typesGenerated.ts            |  1 +
 18 files changed, 196 insertions(+), 23 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index b8f4b7301c73f..c0cf84224c764 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11685,6 +11685,10 @@ const docTemplate = `{
         "codersdk.AIBridgeInterception": {
             "type": "object",
             "properties": {
+                "ended_at": {
+                    "type": "string",
+                    "format": "date-time"
+                },
                 "id": {
                     "type": "string",
                     "format": "uuid"
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 909a0d539441e..0c7a865112cff 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10381,6 +10381,10 @@
 		"codersdk.AIBridgeInterception": {
 			"type": "object",
 			"properties": {
+				"ended_at": {
+					"type": "string",
+					"format": "date-time"
+				},
 				"id": {
 					"type": "string",
 					"format": "uuid"
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index 4c1e3da1a4471..c7594d00254ae 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -962,7 +962,7 @@ func AIBridgeInterception(interception database.AIBridgeInterception, initiator
 		// created_at ASC
 		return sdkToolUsages[i].CreatedAt.Before(sdkToolUsages[j].CreatedAt)
 	})
-	return codersdk.AIBridgeInterception{
+	intc := codersdk.AIBridgeInterception{
 		ID:          interception.ID,
 		Initiator:   MinimalUserFromVisibleUser(initiator),
 		Provider:    interception.Provider,
@@ -973,6 +973,10 @@ func AIBridgeInterception(interception database.AIBridgeInterception, initiator
 		UserPrompts: sdkUserPrompts,
 		ToolUsages:  sdkToolUsages,
 	}
+	if interception.EndedAt.Valid {
+		intc.EndedAt = &interception.EndedAt.Time
+	}
+	return intc
 }
 
 func AIBridgeTokenUsage(usage database.AIBridgeTokenUsage) codersdk.AIBridgeTokenUsage {
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 4397ddfee3226..4dc0fb93e3b5d 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -4711,6 +4711,13 @@ func (q *querier) UnfavoriteWorkspace(ctx context.Context, id uuid.UUID) error {
 	return update(q.log, q.auth, fetch, q.db.UnfavoriteWorkspace)(ctx, id)
 }
 
+func (q *querier) UpdateAIBridgeInterceptionEnded(ctx context.Context, params database.UpdateAIBridgeInterceptionEndedParams) (database.AIBridgeInterception, error) {
+	if err := q.authorizeAIBridgeInterceptionAction(ctx, policy.ActionUpdate, params.ID); err != nil {
+		return database.AIBridgeInterception{}, err
+	}
+	return q.db.UpdateAIBridgeInterceptionEnded(ctx, params)
+}
+
 func (q *querier) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateAPIKeyByIDParams) error {
 	fetch := func(ctx context.Context, arg database.UpdateAPIKeyByIDParams) (database.APIKey, error) {
 		return q.db.GetAPIKeyByID(ctx, arg.ID)
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 465bd679052c5..c7a0b2bb70c3e 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -4617,4 +4617,13 @@ func (s *MethodTestSuite) TestAIBridge() {
 		db.EXPECT().ListAIBridgeToolUsagesByInterceptionIDs(gomock.Any(), ids).Return([]database.AIBridgeToolUsage{}, nil).AnyTimes()
 		check.Args(ids).Asserts(rbac.ResourceSystem, policy.ActionRead).Returns([]database.AIBridgeToolUsage{})
 	}))
+
+	s.Run("UpdateAIBridgeInterceptionEnded", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		intcID := uuid.UUID{1}
+		params := database.UpdateAIBridgeInterceptionEndedParams{ID: intcID}
+		intc := testutil.Fake(s.T(), faker, database.AIBridgeInterception{ID: intcID})
+		db.EXPECT().GetAIBridgeInterceptionByID(gomock.Any(), intcID).Return(intc, nil).AnyTimes() // Validation.
+		db.EXPECT().UpdateAIBridgeInterceptionEnded(gomock.Any(), params).Return(intc, nil).AnyTimes()
+		check.Args(params).Asserts(intc, policy.ActionUpdate).Returns(intc)
+	}))
 }
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index 0f38dd1f93105..0a62911223c6f 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -1495,7 +1495,7 @@ func ClaimPrebuild(
 	return claimedWorkspace
 }
 
-func AIBridgeInterception(t testing.TB, db database.Store, seed database.InsertAIBridgeInterceptionParams) database.AIBridgeInterception {
+func AIBridgeInterception(t testing.TB, db database.Store, seed database.InsertAIBridgeInterceptionParams, endedAt *time.Time) database.AIBridgeInterception {
 	interception, err := db.InsertAIBridgeInterception(genCtx, database.InsertAIBridgeInterceptionParams{
 		ID:          takeFirst(seed.ID, uuid.New()),
 		InitiatorID: takeFirst(seed.InitiatorID, uuid.New()),
@@ -1504,6 +1504,13 @@ func AIBridgeInterception(t testing.TB, db database.Store, seed database.InsertA
 		Metadata:    takeFirstSlice(seed.Metadata, json.RawMessage("{}")),
 		StartedAt:   takeFirst(seed.StartedAt, dbtime.Now()),
 	})
+	if endedAt != nil {
+		interception, err = db.UpdateAIBridgeInterceptionEnded(genCtx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      interception.ID,
+			EndedAt: *endedAt,
+		})
+		require.NoError(t, err, "insert aibridge interception")
+	}
 	require.NoError(t, err, "insert aibridge interception")
 	return interception
 }
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 9f0589178f2ff..57396cd31ba30 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -2888,6 +2888,13 @@ func (m queryMetricsStore) UnfavoriteWorkspace(ctx context.Context, arg uuid.UUI
 	return r0
 }
 
+func (m queryMetricsStore) UpdateAIBridgeInterceptionEnded(ctx context.Context, id database.UpdateAIBridgeInterceptionEndedParams) (database.AIBridgeInterception, error) {
+	start := time.Now()
+	r0, r1 := m.s.UpdateAIBridgeInterceptionEnded(ctx, id)
+	m.queryLatencies.WithLabelValues("UpdateAIBridgeInterceptionEnded").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateAPIKeyByIDParams) error {
 	start := time.Now()
 	err := m.s.UpdateAPIKeyByID(ctx, arg)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 237fc3d0ebf0e..a558c41dacdb9 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -6216,6 +6216,21 @@ func (mr *MockStoreMockRecorder) UnfavoriteWorkspace(ctx, id any) *gomock.Call {
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UnfavoriteWorkspace", reflect.TypeOf((*MockStore)(nil).UnfavoriteWorkspace), ctx, id)
 }
 
+// UpdateAIBridgeInterceptionEnded mocks base method.
+func (m *MockStore) UpdateAIBridgeInterceptionEnded(ctx context.Context, arg database.UpdateAIBridgeInterceptionEndedParams) (database.AIBridgeInterception, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "UpdateAIBridgeInterceptionEnded", ctx, arg)
+	ret0, _ := ret[0].(database.AIBridgeInterception)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// UpdateAIBridgeInterceptionEnded indicates an expected call of UpdateAIBridgeInterceptionEnded.
+func (mr *MockStoreMockRecorder) UpdateAIBridgeInterceptionEnded(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "UpdateAIBridgeInterceptionEnded", reflect.TypeOf((*MockStore)(nil).UpdateAIBridgeInterceptionEnded), ctx, arg)
+}
+
 // UpdateAPIKeyByID mocks base method.
 func (m *MockStore) UpdateAPIKeyByID(ctx context.Context, arg database.UpdateAPIKeyByIDParams) error {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 5744796abc862..617959cb5bb5c 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -632,6 +632,7 @@ type sqlcQuerier interface {
 	// This will always work regardless of the current state of the template version.
 	UnarchiveTemplateVersion(ctx context.Context, arg UnarchiveTemplateVersionParams) error
 	UnfavoriteWorkspace(ctx context.Context, id uuid.UUID) error
+	UpdateAIBridgeInterceptionEnded(ctx context.Context, arg UpdateAIBridgeInterceptionEndedParams) (AIBridgeInterception, error)
 	UpdateAPIKeyByID(ctx context.Context, arg UpdateAPIKeyByIDParams) error
 	UpdateCryptoKeyDeletesAt(ctx context.Context, arg UpdateCryptoKeyDeletesAtParams) (CryptoKey, error)
 	UpdateCustomRole(ctx context.Context, arg UpdateCustomRoleParams) (CustomRole, error)
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index b9878478a92ef..e1b6cbd7adfda 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -7724,3 +7724,68 @@ func TestUpdateTaskWorkspaceID(t *testing.T) {
 		})
 	}
 }
+
+func TestUpdateAIBridgeInterceptionEnded(t *testing.T) {
+	t.Parallel()
+	db, _ := dbtestutil.NewDB(t)
+
+	t.Run("NonExistingInterception", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		got, err := db.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      uuid.New(),
+			EndedAt: time.Now(),
+		})
+		require.ErrorContains(t, err, "no rows in result set")
+		require.EqualValues(t, database.AIBridgeInterception{}, got)
+	})
+
+	t.Run("OK", func(t *testing.T) {
+		t.Parallel()
+		ctx := testutil.Context(t, testutil.WaitLong)
+
+		user := dbgen.User(t, db, database.User{})
+		interceptions := []database.AIBridgeInterception{}
+
+		for _, uid := range []uuid.UUID{{1}, {2}, {3}} {
+			insertParams := database.InsertAIBridgeInterceptionParams{
+				ID:          uid,
+				InitiatorID: user.ID,
+				Metadata:    json.RawMessage("{}"),
+			}
+
+			intc, err := db.InsertAIBridgeInterception(ctx, insertParams)
+			require.NoError(t, err)
+			require.Equal(t, uid, intc.ID)
+			require.False(t, intc.EndedAt.Valid)
+			interceptions = append(interceptions, intc)
+		}
+
+		intc0 := interceptions[0]
+		endedAt := time.Now()
+		// Mark first interception as done
+		updated, err := db.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      intc0.ID,
+			EndedAt: endedAt,
+		})
+		require.NoError(t, err)
+		require.EqualValues(t, updated.ID, intc0.ID)
+		require.True(t, updated.EndedAt.Valid)
+		require.WithinDuration(t, endedAt, updated.EndedAt.Time, 5*time.Second)
+
+		// Updating first interception again should fail
+		updated, err = db.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      intc0.ID,
+			EndedAt: endedAt.Add(time.Hour),
+		})
+		require.ErrorIs(t, err, sql.ErrNoRows)
+
+		// Other interceptions should not have ended_at set
+		for _, intc := range interceptions[1:] {
+			got, err := db.GetAIBridgeInterceptionByID(ctx, intc.ID)
+			require.NoError(t, err)
+			require.False(t, got.EndedAt.Valid)
+		}
+	})
+}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 94fdc03d322b4..d7bb027628fd5 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -778,6 +778,35 @@ func (q *sqlQuerier) ListAIBridgeUserPromptsByInterceptionIDs(ctx context.Contex
 	return items, nil
 }
 
+const updateAIBridgeInterceptionEnded = `-- name: UpdateAIBridgeInterceptionEnded :one
+UPDATE aibridge_interceptions
+	SET ended_at = $1::timestamptz
+WHERE
+	id = $2::uuid
+	AND ended_at IS NULL
+RETURNING id, initiator_id, provider, model, started_at, metadata, ended_at
+`
+
+type UpdateAIBridgeInterceptionEndedParams struct {
+	EndedAt time.Time `db:"ended_at" json:"ended_at"`
+	ID      uuid.UUID `db:"id" json:"id"`
+}
+
+func (q *sqlQuerier) UpdateAIBridgeInterceptionEnded(ctx context.Context, arg UpdateAIBridgeInterceptionEndedParams) (AIBridgeInterception, error) {
+	row := q.db.QueryRowContext(ctx, updateAIBridgeInterceptionEnded, arg.EndedAt, arg.ID)
+	var i AIBridgeInterception
+	err := row.Scan(
+		&i.ID,
+		&i.InitiatorID,
+		&i.Provider,
+		&i.Model,
+		&i.StartedAt,
+		&i.Metadata,
+		&i.EndedAt,
+	)
+	return i, err
+}
+
 const deleteAPIKeyByID = `-- name: DeleteAPIKeyByID :exec
 DELETE FROM
 	api_keys
diff --git a/coderd/database/queries/aibridge.sql b/coderd/database/queries/aibridge.sql
index 3a3b63b84831c..e32eb0ec29e3b 100644
--- a/coderd/database/queries/aibridge.sql
+++ b/coderd/database/queries/aibridge.sql
@@ -6,6 +6,14 @@ INSERT INTO aibridge_interceptions (
 )
 RETURNING *;
 
+-- name: UpdateAIBridgeInterceptionEnded :one
+UPDATE aibridge_interceptions
+	SET ended_at = @ended_at::timestamptz
+WHERE
+	id = @id::uuid
+	AND ended_at IS NULL
+RETURNING *;
+
 -- name: InsertAIBridgeTokenUsage :one
 INSERT INTO aibridge_token_usages (
   id, interception_id, provider_response_id, input_tokens, output_tokens, metadata, created_at
diff --git a/codersdk/aibridge.go b/codersdk/aibridge.go
index afe0e19f78831..b627f5e9d5ef7 100644
--- a/codersdk/aibridge.go
+++ b/codersdk/aibridge.go
@@ -18,6 +18,7 @@ type AIBridgeInterception struct {
 	Model       string               `json:"model"`
 	Metadata    map[string]any       `json:"metadata"`
 	StartedAt   time.Time            `json:"started_at" format:"date-time"`
+	EndedAt     *time.Time           `json:"ended_at" format:"date-time"`
 	TokenUsages []AIBridgeTokenUsage `json:"token_usages"`
 	UserPrompts []AIBridgeUserPrompt `json:"user_prompts"`
 	ToolUsages  []AIBridgeToolUsage  `json:"tool_usages"`
diff --git a/docs/reference/api/aibridge.md b/docs/reference/api/aibridge.md
index 2a2dd16ea93fe..d2be736eb32b2 100644
--- a/docs/reference/api/aibridge.md
+++ b/docs/reference/api/aibridge.md
@@ -31,6 +31,7 @@ curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/intercepti
   "count": 0,
   "results": [
     {
+      "ended_at": "2019-08-24T14:15:22Z",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "initiator": {
         "avatar_url": "http://example.com",
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 8945bdf1a6558..cb3345e67c122 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -379,6 +379,7 @@
 
 ```json
 {
+  "ended_at": "2019-08-24T14:15:22Z",
   "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
   "initiator": {
     "avatar_url": "http://example.com",
@@ -444,6 +445,7 @@
 
 | Name               | Type                                                                | Required | Restrictions | Description |
 |--------------------|---------------------------------------------------------------------|----------|--------------|-------------|
+| `ended_at`         | string                                                              | false    |              |             |
 | `id`               | string                                                              | false    |              |             |
 | `initiator`        | [codersdk.MinimalUser](#codersdkminimaluser)                        | false    |              |             |
 | `metadata`         | object                                                              | false    |              |             |
@@ -462,6 +464,7 @@
   "count": 0,
   "results": [
     {
+      "ended_at": "2019-08-24T14:15:22Z",
       "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",
       "initiator": {
         "avatar_url": "http://example.com",
diff --git a/enterprise/cli/exp_aibridge_test.go b/enterprise/cli/exp_aibridge_test.go
index 64b7eef698f27..466d6b3df8246 100644
--- a/enterprise/cli/exp_aibridge_test.go
+++ b/enterprise/cli/exp_aibridge_test.go
@@ -43,16 +43,16 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		interception1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: member.ID,
 			StartedAt:   now.Add(-time.Hour),
-		})
+		}, &now)
 		interception2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: member.ID,
 			StartedAt:   now,
-		})
+		}, nil)
 		// Should not be returned because the user can't see it.
 		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: owner.UserID,
 			StartedAt:   now.Add(-2 * time.Hour),
-		})
+		}, nil)
 
 		args := []string{
 			"exp",
@@ -99,7 +99,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			Provider:    "real-provider",
 			Model:       "real-model",
 			StartedAt:   now,
-		})
+		}, nil)
 
 		// These interceptions should not be returned since they don't match the
 		// filters.
@@ -108,33 +108,33 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			Provider:    goodInterception.Provider,
 			Model:       goodInterception.Model,
 			StartedAt:   goodInterception.StartedAt,
-		})
+		}, nil)
 		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: goodInterception.InitiatorID,
 			Provider:    "bad-provider",
 			Model:       goodInterception.Model,
 			StartedAt:   goodInterception.StartedAt,
-		})
+		}, nil)
 		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: goodInterception.InitiatorID,
 			Provider:    goodInterception.Provider,
 			Model:       "bad-model",
 			StartedAt:   goodInterception.StartedAt,
-		})
+		}, nil)
 		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: goodInterception.InitiatorID,
 			Provider:    goodInterception.Provider,
 			Model:       goodInterception.Model,
 			// Violates the started after filter.
 			StartedAt: now.Add(-2 * time.Hour),
-		})
+		}, nil)
 		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: goodInterception.InitiatorID,
 			Provider:    goodInterception.Provider,
 			Model:       goodInterception.Model,
 			// Violates the started before filter.
 			StartedAt: now.Add(2 * time.Hour),
-		})
+		}, nil)
 
 		args := []string{
 			"exp",
@@ -181,15 +181,15 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		firstInterception := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: member.ID,
 			StartedAt:   now,
-		})
+		}, nil)
 		returnedInterception := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: member.ID,
 			StartedAt:   now.Add(-time.Hour),
-		})
+		}, &now)
 		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: member.ID,
 			StartedAt:   now.Add(-2 * time.Hour),
-		})
+		}, nil)
 
 		args := []string{
 			"exp",
diff --git a/enterprise/coderd/aibridge_test.go b/enterprise/coderd/aibridge_test.go
index 5de1df5b60681..abaf82dbe85f8 100644
--- a/enterprise/coderd/aibridge_test.go
+++ b/enterprise/coderd/aibridge_test.go
@@ -107,7 +107,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		i1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: user1.ID,
 			StartedAt:   now.Add(-time.Hour),
-		})
+		}, nil)
 		i1tok1 := dbgen.AIBridgeTokenUsage(t, db, database.InsertAIBridgeTokenUsageParams{
 			InterceptionID: i1.ID,
 			CreatedAt:      now,
@@ -135,7 +135,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		i2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: user2.ID,
 			StartedAt:   now,
-		})
+		}, &now)
 
 		// Convert to SDK types for response comparison.
 		// You may notice that the ordering of the inner arrays are ASC, this is
@@ -169,6 +169,13 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		res.Results[1].ToolUsages[0].CreatedAt = i1SDK.ToolUsages[0].CreatedAt
 		res.Results[1].ToolUsages[1].CreatedAt = i1SDK.ToolUsages[1].CreatedAt
 
+		// Time comparison
+		require.Len(t, res.Results, 2)
+		require.Equal(t, res.Results[0].ID, i2SDK.ID)
+		require.NotNil(t, now, res.Results[0].EndedAt)
+		require.WithinDuration(t, now, *res.Results[0].EndedAt, 5*time.Second)
+		res.Results[0].EndedAt = i2SDK.EndedAt
+
 		require.Equal(t, []codersdk.AIBridgeInterception{i2SDK, i1SDK}, res.Results)
 	})
 
@@ -200,7 +207,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				ID:          uuid.UUID{byte(i)},
 				InitiatorID: firstUser.UserID,
 				StartedAt:   now,
-			})
+			}, &now)
 			allInterceptionIDs = append(allInterceptionIDs, interception.ID)
 		}
 
@@ -213,7 +220,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				ID:          uuid.UUID{byte(i + 10)},
 				InitiatorID: firstUser.UserID,
 				StartedAt:   now.Add(randomOffsetDur),
-			})
+			}, nil)
 			allInterceptionIDs = append(allInterceptionIDs, interception.ID)
 		}
 
@@ -313,11 +320,11 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		i1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: firstUser.UserID,
 			StartedAt:   now,
-		})
+		}, nil)
 		i2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			InitiatorID: secondUser.ID,
 			StartedAt:   now.Add(-time.Hour),
-		})
+		}, &now)
 
 		// Admin can see all interceptions.
 		res, err := adminExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
@@ -377,21 +384,21 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			Provider:    "one",
 			Model:       "one",
 			StartedAt:   now,
-		})
+		}, nil)
 		i2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			ID:          uuid.MustParse("00000000-0000-0000-0000-000000000002"),
 			InitiatorID: user1.ID,
 			Provider:    "two",
 			Model:       "two",
 			StartedAt:   now.Add(-time.Hour),
-		})
+		}, &now)
 		i3 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
 			ID:          uuid.MustParse("00000000-0000-0000-0000-000000000003"),
 			InitiatorID: user2.ID,
 			Provider:    "three",
 			Model:       "three",
 			StartedAt:   now.Add(-2 * time.Hour),
-		})
+		}, &now)
 
 		// Convert to SDK types for response comparison. We don't care about the
 		// inner arrays for this test.
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 0bcd2ba6cc7b2..5e9bc73975da6 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -32,6 +32,7 @@ export interface AIBridgeInterception {
 	// empty interface{} type, falling back to unknown
 	readonly metadata: Record<string, unknown>;
 	readonly started_at: string;
+	readonly ended_at: string | null;
 	readonly token_usages: readonly AIBridgeTokenUsage[];
 	readonly user_prompts: readonly AIBridgeUserPrompt[];
 	readonly tool_usages: readonly AIBridgeToolUsage[];

From af3ff825a1aef7630b9dbab306f536d3c5f8b788 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Mon, 27 Oct 2025 14:31:32 +0400
Subject: [PATCH 253/298] test: track postgres database creation by package and
 test name (#20492)

Adds columns to track package and test name to test_databases table, and populates them as databases are created using the Broker.

In order to seamlessly work with existing `coder_database` databases with the old schema, the SQL that creates the table and columns is additive and idempotent, so we run it every time we initialize the Broker (once per test binary execution).

We include a transaction level advisorly lock to prevent deadlocks before attempting to alter the schema. I was seeing deadlocks without this.
---
 Makefile                                      |  5 ++
 coderd/database/dbtestutil/broker.go          | 57 +++++++++++++++++--
 .../dbtestutil/broker_internal_test.go        | 13 +++++
 coderd/database/dbtestutil/coder_testing.sql  | 10 ++++
 4 files changed, 79 insertions(+), 6 deletions(-)
 create mode 100644 coderd/database/dbtestutil/broker_internal_test.go

diff --git a/Makefile b/Makefile
index 93b0245a8a01f..7f21f1fa6da04 100644
--- a/Makefile
+++ b/Makefile
@@ -1182,3 +1182,8 @@ endif
 
 dogfood/coder/nix.hash: flake.nix flake.lock
 	sha256sum flake.nix flake.lock >./dogfood/coder/nix.hash
+
+# Count the number of test databases created per test package.
+count-test-databases:
+	PGPASSWORD=postgres psql -h localhost -U postgres -d coder_testing -P pager=off -c 'SELECT test_package, count(*) as count from test_databases GROUP BY test_package ORDER BY count DESC'
+.PHONY: count-test-databases
diff --git a/coderd/database/dbtestutil/broker.go b/coderd/database/dbtestutil/broker.go
index 8a0d47b7b121d..158a44cbc997c 100644
--- a/coderd/database/dbtestutil/broker.go
+++ b/coderd/database/dbtestutil/broker.go
@@ -6,6 +6,8 @@ import (
 	_ "embed"
 	"fmt"
 	"os"
+	"runtime"
+	"strings"
 	"sync"
 	"time"
 
@@ -45,6 +47,8 @@ func (b *Broker) Create(t TBSubset, opts ...OpenOption) (ConnectionParams, error
 		host     = defaultConnectionParams.Host
 		port     = defaultConnectionParams.Port
 	)
+	packageName := getTestPackageName(t)
+	testName := t.Name()
 
 	// Use a time-based prefix to make it easier to find the database
 	// when debugging.
@@ -55,9 +59,9 @@ func (b *Broker) Create(t TBSubset, opts ...OpenOption) (ConnectionParams, error
 	}
 	dbName := now + "_" + dbSuffix
 
-	// TODO: add package and test name
 	_, err = b.coderTestingDB.Exec(
-		"INSERT INTO test_databases (name, process_uuid) VALUES ($1, $2)", dbName, b.uuid)
+		"INSERT INTO test_databases (name, process_uuid, test_package, test_name) VALUES ($1, $2, $3, $4)",
+		dbName, b.uuid, packageName, testName)
 	if err != nil {
 		return ConnectionParams{}, xerrors.Errorf("insert test_database row: %w", err)
 	}
@@ -104,10 +108,10 @@ func (b *Broker) clean(t TBSubset, dbName string) func() {
 func (b *Broker) init(t TBSubset) error {
 	b.Lock()
 	defer b.Unlock()
-	b.refCount++
-	t.Cleanup(b.decRef)
 	if b.coderTestingDB != nil {
 		// already initialized
+		b.refCount++
+		t.Cleanup(b.decRef)
 		return nil
 	}
 
@@ -124,8 +128,8 @@ func (b *Broker) init(t TBSubset) error {
 		return xerrors.Errorf("open postgres connection: %w", err)
 	}
 
-	// creating the db can succeed even if the database doesn't exist. Ping it to find out.
-	err = coderTestingDB.Ping()
+	// coderTestingSQLInit is idempotent, so we can run it every time.
+	_, err = coderTestingDB.Exec(coderTestingSQLInit)
 	var pqErr *pq.Error
 	if xerrors.As(err, &pqErr) && pqErr.Code == "3D000" {
 		// database does not exist.
@@ -145,6 +149,8 @@ func (b *Broker) init(t TBSubset) error {
 		return xerrors.Errorf("ping '%s' database: %w", CoderTestingDBName, err)
 	}
 	b.coderTestingDB = coderTestingDB
+	b.refCount++
+	t.Cleanup(b.decRef)
 
 	if b.uuid == uuid.Nil {
 		b.uuid = uuid.New()
@@ -186,3 +192,42 @@ func (b *Broker) decRef() {
 		b.coderTestingDB = nil
 	}
 }
+
+// getTestPackageName returns the package name of the test that called it.
+func getTestPackageName(t TBSubset) string {
+	packageName := "unknown"
+	// Ask runtime.Callers for up to 100 program counters, including runtime.Callers itself.
+	pc := make([]uintptr, 100)
+	n := runtime.Callers(0, pc)
+	if n == 0 {
+		// No PCs available. This can happen if the first argument to
+		// runtime.Callers is large.
+		//
+		// Return now to avoid processing the zero Frame that would
+		// otherwise be returned by frames.Next below.
+		t.Logf("could not determine test package name: no PCs available")
+		return packageName
+	}
+
+	pc = pc[:n] // pass only valid pcs to runtime.CallersFrames
+	frames := runtime.CallersFrames(pc)
+
+	// Loop to get frames.
+	// A fixed number of PCs can expand to an indefinite number of Frames.
+	for {
+		frame, more := frames.Next()
+
+		if strings.HasPrefix(frame.Function, "github.com/coder/coder/v2/") {
+			packageName = strings.SplitN(strings.TrimPrefix(frame.Function, "github.com/coder/coder/v2/"), ".", 2)[0]
+		}
+		if strings.HasPrefix(frame.Function, "testing") {
+			break
+		}
+
+		// Check whether there are more frames to process after this one.
+		if !more {
+			break
+		}
+	}
+	return packageName
+}
diff --git a/coderd/database/dbtestutil/broker_internal_test.go b/coderd/database/dbtestutil/broker_internal_test.go
new file mode 100644
index 0000000000000..944ae2a4770d6
--- /dev/null
+++ b/coderd/database/dbtestutil/broker_internal_test.go
@@ -0,0 +1,13 @@
+package dbtestutil
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/require"
+)
+
+func TestGetTestPackageName(t *testing.T) {
+	t.Parallel()
+	packageName := getTestPackageName(t)
+	require.Equal(t, "coderd/database/dbtestutil", packageName)
+}
diff --git a/coderd/database/dbtestutil/coder_testing.sql b/coderd/database/dbtestutil/coder_testing.sql
index edaab486c847a..453b38d2d4510 100644
--- a/coderd/database/dbtestutil/coder_testing.sql
+++ b/coderd/database/dbtestutil/coder_testing.sql
@@ -1,3 +1,6 @@
+BEGIN TRANSACTION;
+SELECT pg_advisory_xact_lock(7283699);
+
 CREATE TABLE IF NOT EXISTS test_databases (
 	name text PRIMARY KEY,
 	created_at timestamp with time zone NOT NULL DEFAULT CURRENT_TIMESTAMP,
@@ -6,3 +9,10 @@ CREATE TABLE IF NOT EXISTS test_databases (
 );
 
 CREATE INDEX IF NOT EXISTS test_databases_process_uuid ON test_databases (process_uuid, dropped_at);
+
+ALTER TABLE test_databases ADD COLUMN IF NOT EXISTS test_name text;
+COMMENT ON COLUMN test_databases.test_name IS 'Name of the test that created the database';
+ALTER TABLE test_databases ADD COLUMN IF NOT EXISTS test_package text;
+COMMENT ON COLUMN test_databases.test_package IS 'Package of the test that created the database';
+
+COMMIT;

From 277b2d21cab8baefcf9abb26ca2b391cb0fe60bd Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 12:08:59 +0000
Subject: [PATCH 254/298] chore: bump github.com/gohugoio/hugo from 0.151.2 to
 0.152.2 (#20495)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/gohugoio/hugo](https://github.com/gohugoio/hugo) from
0.151.2 to 0.152.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gohugoio/hugo/releases">github.com/gohugoio/hugo's
releases</a>.</em></p>
<blockquote>
<h2>v0.152.2</h2>
<p>In <code>v0.152.0</code> we tightened the source validation for <a
href="https://gohugo.io/configuration/module/#mounts">file mounts</a>.
We always said that <em>project mounts can mount with absolute
file/directorynames, modules/themes are restricted to relative</em>. In
<code>v0.152.0</code> we narrowed module/themes mounts to be local,
which made the setup in the bug report listed below fail:</p>
<pre lang="toml"><code>[[module.mounts]]
source = '../../node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
</code></pre>
<p>One part of this is security. But the construct above is
<em>usually</em> very odd (the project uses files in a theme/module, not
the other way around) and not very portable. But the example above
demonstrates a valid exception, that we now have added support for in a
portable way. The above example now works as it did before
<code>v0.152.0</code>, but going forward you can also write:</p>
<pre lang="toml"><code>[[module.mounts]]
source = 'node_modules/bootstrap'
target = 'assets/vendor/bootstrap'
</code></pre>
<p>We now have the <code>node_modules</code> as a special case: For
themes/modules we first check if the mounted source exists locally, if
not we try relative to the project root.</p>
<h2>What's Changed</h2>
<ul>
<li>deps: Update github.com/tdewolff/minify v2.24.4 =&gt; v2.24.5
1c8c21e45 <a
href="https://github.com/jmooring"><code>@​jmooring</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14086">#14086</a></li>
<li>hugofs: Make node_modules a &quot;special case&quot; mount 809ebe01f
<a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14089">#14089</a></li>
<li>github: Fix typo in stale PR message 08a0679a8 <a
href="https://github.com/jordelver"><code>@​jordelver</code></a></li>
</ul>
<h2>v0.152.1</h2>
<p>These fixes are are all related to the YAML library upgrade in <a
href="https://github.com/gohugoio/hugo/releases/tag/v0.152.0">v0.152.0</a>.</p>
<ul>
<li>Expand the numeric conversions to template funcs/methods e08278d16
<a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14079">#14079</a></li>
<li>Fix where with uint64 df4f80d54 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14081">#14081</a></li>
<li>Fix it so YAML integer types can be used where Go int types are
expected d4c78885a <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14079">#14079</a></li>
<li>tpl/compare: Fix compare/sort of uint64s 29e2c2fa9 <a
href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/14078">#14078</a></li>
<li>Fix &quot;assignment to entry in nil map&quot; on empty YAML config
files 0579afc3c <a href="https://github.com/bep"><code>@​bep</code></a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14074">#14074</a></li>
</ul>
<h2>v0.152.0</h2>
<p>The big new thing and the motivation behind this release is the
upgrade to a more modern YAML library in <a
href="https://github.com/goccy"><code>@​goccy</code></a> 's <a
href="https://github.com/goccy/go-yaml">github.com/goccy/go-yaml</a>.
It's been a surprisingly long and winding road to get here. <strong>Note
that this upgrade comes with some minor breaking changes, most notably
that the old YAML 1.1 spec listed a set of strings that, when unquoted,
were treated as boolean <code>true</code> or
<code>false</code>.</strong> So if you're using any of the values in the
table below as booleans, you need to adjust your YAML, but I suspect
that fixing this very surprising behavior will fix more issues than it
introduces. A big new thing with this new YAML library is the support
for <a
href="https://www.linode.com/docs/guides/yaml-anchors-aliases-overrides-extensions/">YAML
anchors and aliases</a> which helps to reduce duplication in e.g. your
configuration. There are some examples in Hugo's <a
href="https://github.com/gohugoio/hugo/blob/master/hugoreleaser.yaml">release
build configuration</a> and in the <a
href="https://github.com/gohugoio/hugo/blob/master/.circleci/config.yml">Hugo's
CI release setup</a>.</p>
<table>
<thead>
<tr>
<th align="left">Values</th>
<th align="left">Old meaning</th>
<th align="left">New meaning</th>
</tr>
</thead>
<tbody>
<tr>
<td align="left"><code>yes</code>, <code>Yes</code>, <code>YES</code>,
<code>y</code>, <code>Y</code>, <code>on</code>, <code>On</code>,
<code>ON</code></td>
<td align="left"><code>true</code> (bool)</td>
<td align="left"><code>yes</code>, <code>Yes</code>, <code>YES</code>,
<code>y</code>, <code>Y</code>, <code>on</code>, <code>On</code>,
<code>ON</code> (string)</td>
</tr>
<tr>
<td align="left"><code>no</code>, <code>No</code>, <code>NO</code>,
<code>n</code>, <code>N</code>, <code>off</code>, <code>Off</code>,
<code>OFF</code></td>
<td align="left"><code>false</code> (bool)</td>
<td align="left"><code>no</code>, <code>No</code>, <code>NO</code>,
<code>n</code>, <code>N</code>, <code>off</code>, <code>Off</code>,
<code>OFF</code> (string)</td>
</tr>
</tbody>
</table>
<h2>Note</h2>
<ul>
<li>Replace to gopkg.in/yaml with github.com/goccy/go-yaml (note)
a3d954846 <a href="https://github.com/bep"><code>@​bep</code></a> <a
href="https://redirect.github.com/gohugoio/hugo/issues/8822">#8822</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/13043">#13043</a>
<a
href="https://redirect.github.com/gohugoio/hugo/issues/14053">#14053</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gohugoio/hugo/commit/6abdacad3f3fe944ea42177844469139e81feda6"><code>6abdaca</code></a>
releaser: Bump versions for release of 0.152.2</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/1c8c21e45eb7d87c1038b3f3b9ea87b82a11c867"><code>1c8c21e</code></a>
deps: Update github.com/tdewolff/minify v2.24.4 =&gt; v2.24.5</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/809ebe01fa954a44a48c265f0c9a4e4845b9a0f8"><code>809ebe0</code></a>
hugofs: Make node_modules a &quot;special case&quot; mount</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/08a0679a895678b38f1324ae78503fd32ec22996"><code>08a0679</code></a>
github: Fix typo in stale PR message</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/524b98665b64f206f14879ffe29c64f413592a2f"><code>524b986</code></a>
releaser: Prepare repository for 0.153.0-DEV</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/5869cbddd88590563c2b7b400e804ccc7d2cb697"><code>5869cbd</code></a>
releaser: Bump versions for release of 0.152.1</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/e08278d165399bd2d7d7331d966129a2faa268b2"><code>e08278d</code></a>
Expand the numeric conversions to template funcs/methods</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/df4f80d54f389407d935a0388707be2bf888d882"><code>df4f80d</code></a>
Fix where with uint64</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/d4c78885ae4cb7c488ea2ed399aa57f0861f44cb"><code>d4c7888</code></a>
Fix it so YAML integer types can be used where Go int types are
expected</li>
<li><a
href="https://github.com/gohugoio/hugo/commit/29e2c2fa92b10c1250376913558448e838e390fe"><code>29e2c2f</code></a>
tpl/compare: Fix compare/sort of uint64s</li>
<li>Additional commits viewable in <a
href="https://github.com/gohugoio/hugo/compare/v0.151.2...v0.152.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/gohugoio/hugo&package-manager=go_modules&previous-version=0.151.2&new-version=0.152.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod |  6 +++---
 go.sum | 19 ++++++++++---------
 2 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/go.mod b/go.mod
index ba9380112d91d..6d97a99d84b37 100644
--- a/go.mod
+++ b/go.mod
@@ -127,7 +127,7 @@ require (
 	github.com/go-logr/logr v1.4.3
 	github.com/go-playground/validator/v10 v10.28.0
 	github.com/gofrs/flock v0.13.0
-	github.com/gohugoio/hugo v0.151.2
+	github.com/gohugoio/hugo v0.152.2
 	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/golang-migrate/migrate/v4 v4.19.0
 	github.com/gomarkdown/markdown v0.0.0-20240930133441-72d49d9543d8
@@ -411,7 +411,7 @@ require (
 	github.com/tailscale/wireguard-go v0.0.0-20231121184858-cc193a0b3272
 	github.com/tchap/go-patricia/v2 v2.3.2 // indirect
 	github.com/tcnksm/go-httpstat v0.2.0 // indirect
-	github.com/tdewolff/parse/v2 v2.8.3 // indirect
+	github.com/tdewolff/parse/v2 v2.8.5-0.20251020133559-0efcf90bef1a // indirect
 	github.com/tidwall/match v1.2.0 // indirect
 	github.com/tidwall/pretty v1.2.1 // indirect
 	github.com/tinylib/msgp v1.2.5 // indirect
@@ -455,7 +455,6 @@ require (
 	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	howett.net/plist v1.0.0 // indirect
 	kernel.org/pub/linux/libs/security/libcap/psx v1.2.73 // indirect
 	sigs.k8s.io/yaml v1.5.0 // indirect
@@ -522,6 +521,7 @@ require (
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
 	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-sql-driver/mysql v1.9.3 // indirect
+	github.com/goccy/go-yaml v1.18.0 // indirect
 	github.com/google/go-containerregistry v0.20.6 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/hashicorp/go-getter v1.7.9 // indirect
diff --git a/go.sum b/go.sum
index b5344eff068ee..1c72f83e0f9cb 100644
--- a/go.sum
+++ b/go.sum
@@ -1104,7 +1104,6 @@ github.com/gen2brain/beeep v0.11.1 h1:EbSIhrQZFDj1K2fzlMpAYlFOzV8YuNe721A58XcCTY
 github.com/gen2brain/beeep v0.11.1/go.mod h1:jQVvuwnLuwOcdctHn/uyh8horSBNJ8uGb9Cn2W4tvoc=
 github.com/getkin/kin-openapi v0.133.0 h1:pJdmNohVIJ97r4AUFtEXRXwESr8b0bD721u/Tz6k8PQ=
 github.com/getkin/kin-openapi v0.133.0/go.mod h1:boAciF6cXk5FhPqe/NQeBTeenbjqU4LhWBf09ILVvWE=
-github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/github/fakeca v0.1.0 h1:Km/MVOFvclqxPM9dZBC4+QE564nU4gz4iZ0D9pMw28I=
 github.com/github/fakeca v0.1.0/go.mod h1:+bormgoGMMuamOscx7N91aOuUST7wdaJ2rNjeohylyo=
@@ -1189,6 +1188,8 @@ github.com/gobwas/pool v0.2.1/go.mod h1:q8bcK0KcYlCgd9e7WYLm9LpyS+YeLd8JVDW6Wezm
 github.com/gobwas/ws v1.4.0 h1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=
 github.com/gobwas/ws v1.4.0/go.mod h1:G3gNqMNtPppf5XUz7O4shetPpcZ1VJ7zt18dlUeakrc=
 github.com/goccy/go-json v0.9.11/go.mod h1:6MelG93GURQebXPDq3khkgXZkazVtN9CRI+MGFi0w8I=
+github.com/goccy/go-yaml v1.18.0 h1:8W7wMFS12Pcas7KU+VVkaiCng+kG8QiFeFwzFb+rwuw=
+github.com/goccy/go-yaml v1.18.0/go.mod h1:XBurs7gK8ATbW4ZPGKgcbrY1Br56PdM69F7LkFRi1kA=
 github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
 github.com/godbus/dbus/v5 v5.1.0/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
 github.com/gofrs/flock v0.13.0 h1:95JolYOvGMqeH31+FC7D2+uULf6mG61mEZ/A8dRYMzw=
@@ -1197,14 +1198,14 @@ github.com/gofrs/uuid v4.4.0+incompatible h1:3qXRTX8/NbyulANqlc0lchS1gqAVxRgsuW1
 github.com/gofrs/uuid v4.4.0+incompatible/go.mod h1:b2aQJv3Z4Fp6yNu3cdSllBxTCLRxnplIgP/c0N/04lM=
 github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
 github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
-github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e h1:QArsSubW7eDh8APMXkByjQWvuljwPGAGQpJEFn0F0wY=
-github.com/gohugoio/go-i18n/v2 v2.1.3-0.20230805085216-e63c13218d0e/go.mod h1:3Ltoo9Banwq0gOtcOwxuHG6omk+AwsQPADyw2vQYOJQ=
+github.com/gohugoio/go-i18n/v2 v2.1.3-0.20251018145728-cfcc22d823c6 h1:pxlAea9eRwuAnt/zKbGqlFO2ZszpIe24YpOVLf+N+4I=
+github.com/gohugoio/go-i18n/v2 v2.1.3-0.20251018145728-cfcc22d823c6/go.mod h1:m5hu1im5Qc7LDycVLvee6MPobJiRLBYHklypFJR0/aE=
 github.com/gohugoio/hashstructure v0.6.0 h1:7wMB/2CfXoThFYhdWRGv3u3rUM761Cq29CxUW+NltUg=
 github.com/gohugoio/hashstructure v0.6.0/go.mod h1:lapVLk9XidheHG1IQ4ZSbyYrXcaILU1ZEP/+vno5rBQ=
 github.com/gohugoio/httpcache v0.8.0 h1:hNdsmGSELztetYCsPVgjA960zSa4dfEqqF/SficorCU=
 github.com/gohugoio/httpcache v0.8.0/go.mod h1:fMlPrdY/vVJhAriLZnrF5QpN3BNAcoBClgAyQd+lGFI=
-github.com/gohugoio/hugo v0.151.2 h1:HZ5V/oQnldrffqEAkUsnd6bgq8ZtEOzF0xox2+zuT3k=
-github.com/gohugoio/hugo v0.151.2/go.mod h1:7QPFu7oOioiXlmy9hfgnhCg3LixGXthnZQmmBUdjs/4=
+github.com/gohugoio/hugo v0.152.2 h1:k++AvrUCjFbq8lzzKRG5JizSwsBT/ARg6mMUXFDC5OA=
+github.com/gohugoio/hugo v0.152.2/go.mod h1:eGE2cUADtMLFnb66WSlMJSNXXFrU6lLiYgDSP6H/Fm0=
 github.com/gohugoio/hugo-goldmark-extensions/extras v0.5.0 h1:dco+7YiOryRoPOMXwwaf+kktZSCtlFtreNdiJbETvYE=
 github.com/gohugoio/hugo-goldmark-extensions/extras v0.5.0/go.mod h1:CRrxQTKeM3imw+UoS4EHKyrqB7Zp6sAJiqHit+aMGTE=
 github.com/gohugoio/hugo-goldmark-extensions/passthrough v0.3.1 h1:nUzXfRTszLliZuN0JTKeunXTRaiFX6ksaWP0puLLYAY=
@@ -1826,10 +1827,10 @@ github.com/tc-hib/winres v0.2.1 h1:YDE0FiP0VmtRaDn7+aaChp1KiF4owBiJa5l964l5ujA=
 github.com/tc-hib/winres v0.2.1/go.mod h1:C/JaNhH3KBvhNKVbvdlDWkbMDO9H4fKKDaN7/07SSuk=
 github.com/tchap/go-patricia/v2 v2.3.2 h1:xTHFutuitO2zqKAQ5rCROYgUb7Or/+IC3fts9/Yc7nM=
 github.com/tchap/go-patricia/v2 v2.3.2/go.mod h1:VZRHKAb53DLaG+nA9EaYYiaEx6YztwDlLElMsnSHD4k=
-github.com/tdewolff/minify/v2 v2.24.3 h1:BaKgWSFLKbKDiUskbeRgbe2n5d1Ci1x3cN/eXna8zOA=
-github.com/tdewolff/minify/v2 v2.24.3/go.mod h1:1JrCtoZXaDbqioQZfk3Jdmr0GPJKiU7c1Apmb+7tCeE=
-github.com/tdewolff/parse/v2 v2.8.3 h1:5VbvtJ83cfb289A1HzRA9sf02iT8YyUwN84ezjkdY1I=
-github.com/tdewolff/parse/v2 v2.8.3/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
+github.com/tdewolff/minify/v2 v2.24.5 h1:ytxthX3xSxrK3Xx5B38flg5moCKs/dB8VwiD/RzJViU=
+github.com/tdewolff/minify/v2 v2.24.5/go.mod h1:q09KtNnVai7TyEzGEZeWPAnK+c8Z+NI8prCXZW652bo=
+github.com/tdewolff/parse/v2 v2.8.5-0.20251020133559-0efcf90bef1a h1:Rmq+utdraciok/97XHRweYdsAo/M4LOswpCboo3yvN4=
+github.com/tdewolff/parse/v2 v2.8.5-0.20251020133559-0efcf90bef1a/go.mod h1:Hwlni2tiVNKyzR1o6nUs4FOF07URA+JLBLd6dlIXYqo=
 github.com/tdewolff/test v1.0.11 h1:FdLbwQVHxqG16SlkGveC0JVyrJN62COWTRyUFzfbtBE=
 github.com/tdewolff/test v1.0.11/go.mod h1:XPuWBzvdUzhCuxWO1ojpXsyzsA5bFoS3tO/Q3kFuTG8=
 github.com/testcontainers/testcontainers-go v0.38.0 h1:d7uEapLcv2P8AvH8ahLqDMMxda2W9gQN1nRbHS28HBw=

From 10d2844cce89cc7e736b7a9eb06173d76091b8b8 Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 12:14:51 +0000
Subject: [PATCH 255/298] chore: bump github.com/valyala/fasthttp from 1.67.0
 to 1.68.0 (#20496)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps [github.com/valyala/fasthttp](https://github.com/valyala/fasthttp)
from 1.67.0 to 1.68.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/valyala/fasthttp/releases">github.com/valyala/fasthttp's
releases</a>.</em></p>
<blockquote>
<h2>v1.68.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Fix named return bugs by <a
href="https://github.com/erikdubbelboer"><code>@​erikdubbelboer</code></a>
in <a
href="https://github.com/valyala/fasthttp/commit/1b8c5593da699309522dee00ad1d6c913482a0f3">https://github.com/valyala/fasthttp/commit/1b8c5593da699309522dee00ad1d6c913482a0f3</a></li>
<li>chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2087">valyala/fasthttp#2087</a></li>
<li>chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2086">valyala/fasthttp#2086</a></li>
<li>chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2085">valyala/fasthttp#2085</a></li>
<li>chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2088">valyala/fasthttp#2088</a></li>
<li>chore(deps): bump github.com/klauspost/compress from 1.18.0 to
1.18.1 by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot]
in <a
href="https://redirect.github.com/valyala/fasthttp/pull/2089">valyala/fasthttp#2089</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/valyala/fasthttp/compare/v1.67.0...v1.68.0">https://github.com/valyala/fasthttp/compare/v1.67.0...v1.68.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/valyala/fasthttp/commit/1b8c5593da699309522dee00ad1d6c913482a0f3"><code>1b8c559</code></a>
Fix named return bugs</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/9ca62939848ed5b186d9b1a696c9de3d76e037ce"><code>9ca6293</code></a>
chore(deps): bump github.com/klauspost/compress from 1.18.0 to 1.18.1
(<a
href="https://redirect.github.com/valyala/fasthttp/issues/2089">#2089</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/77468f66c6618d8ca3d5d183d1aaf55cc5395f2c"><code>77468f6</code></a>
chore(deps): bump securego/gosec from 2.22.9 to 2.22.10 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2088">#2088</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/3a2fdec290176325d5432245facf04ef25674f46"><code>3a2fdec</code></a>
chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2085">#2085</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/59f58c07bec79a5eb65928defdf37ec247504e65"><code>59f58c0</code></a>
chore(deps): bump golang.org/x/crypto from 0.42.0 to 0.43.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2086">#2086</a>)</li>
<li><a
href="https://github.com/valyala/fasthttp/commit/dbfb82aabe6074ab83033941103f890ae09dabbd"><code>dbfb82a</code></a>
chore(deps): bump golang.org/x/sys from 0.36.0 to 0.37.0 (<a
href="https://redirect.github.com/valyala/fasthttp/issues/2087">#2087</a>)</li>
<li>See full diff in <a
href="https://github.com/valyala/fasthttp/compare/v1.67.0...v1.68.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/valyala/fasthttp&package-manager=go_modules&previous-version=1.67.0&new-version=1.68.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod | 4 ++--
 go.sum | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/go.mod b/go.mod
index 6d97a99d84b37..93fca9be191ae 100644
--- a/go.mod
+++ b/go.mod
@@ -149,7 +149,7 @@ require (
 	github.com/justinas/nosurf v1.2.0
 	github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
 	github.com/kirsle/configdir v0.0.0-20170128060238-e45d2f54772f
-	github.com/klauspost/compress v1.18.0
+	github.com/klauspost/compress v1.18.1
 	github.com/lib/pq v1.10.9
 	github.com/mattn/go-isatty v0.0.20
 	github.com/mitchellh/go-wordwrap v1.0.1
@@ -181,7 +181,7 @@ require (
 	github.com/tidwall/gjson v1.18.0
 	github.com/u-root/u-root v0.14.0
 	github.com/unrolled/secure v1.17.0
-	github.com/valyala/fasthttp v1.67.0
+	github.com/valyala/fasthttp v1.68.0
 	github.com/wagslane/go-password-validator v0.3.0
 	github.com/zclconf/go-cty-yaml v1.1.0
 	go.mozilla.org/pkcs7 v0.9.0
diff --git a/go.sum b/go.sum
index 1c72f83e0f9cb..685d461a5557a 100644
--- a/go.sum
+++ b/go.sum
@@ -1487,8 +1487,8 @@ github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+o
 github.com/klauspost/asmfmt v1.3.2/go.mod h1:AG8TuvYojzulgDAMCnYn50l/5QV3Bs/tp6j0HLHbNSE=
 github.com/klauspost/compress v1.15.9/go.mod h1:PhcZ0MbTNciWF3rruxRgKxI5NkcHHrHUDtV4Yw2GlzU=
 github.com/klauspost/compress v1.15.11/go.mod h1:QPwzmACJjUTFsnSHH934V6woptycfrDDJnH7hvFVbGM=
-github.com/klauspost/compress v1.18.0 h1:c/Cqfb0r+Yi+JtIEq73FWXVkRonBlf0CRNYc8Zttxdo=
-github.com/klauspost/compress v1.18.0/go.mod h1:2Pp+KzxcywXVXMr50+X0Q/Lsb43OQHYWRCY2AiWywWQ=
+github.com/klauspost/compress v1.18.1 h1:bcSGx7UbpBqMChDtsF28Lw6v/G94LPrrbMbdC3JH2co=
+github.com/klauspost/compress v1.18.1/go.mod h1:ZQFFVG+MdnR0P+l6wpXgIL4NTtwiKIdBnrBd8Nrxr+0=
 github.com/klauspost/cpuid/v2 v2.0.9/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.2.10 h1:tBs3QSyvjDyFTq3uoc/9xFpCuOsJQFNPiAhYdw2skhE=
 github.com/klauspost/cpuid/v2 v2.2.10/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -1871,8 +1871,8 @@ github.com/unrolled/secure v1.17.0 h1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbW
 github.com/unrolled/secure v1.17.0/go.mod h1:BmF5hyM6tXczk3MpQkFf1hpKSRqCyhqcbiQtiAF7+40=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
-github.com/valyala/fasthttp v1.67.0 h1:tqKlJMUP6iuNG8hGjK/s9J4kadH7HLV4ijEcPGsezac=
-github.com/valyala/fasthttp v1.67.0/go.mod h1:qYSIpqt/0XNmShgo/8Aq8E3UYWVVwNS2QYmzd8WIEPM=
+github.com/valyala/fasthttp v1.68.0 h1:v12Nx16iepr8r9ySOwqI+5RBJ/DqTxhOy1HrHoDFnok=
+github.com/valyala/fasthttp v1.68.0/go.mod h1:5EXiRfYQAoiO/khu4oU9VISC/eVY6JqmSpPJoHCKsz4=
 github.com/vektah/gqlparser/v2 v2.5.28 h1:bIulcl3LF69ba6EiZVGD88y4MkM+Jxrf3P2MX8xLRkY=
 github.com/vektah/gqlparser/v2 v2.5.28/go.mod h1:D1/VCZtV3LPnQrcPBeR/q5jkSQIPti0uYCP/RI0gIeo=
 github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=

From dd92fbc83ca7b9821ae0a7300e958c75b97bbfbe Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 12:21:34 +0000
Subject: [PATCH 256/298] chore: bump google.golang.org/api from 0.252.0 to
 0.253.0 (#20497)

Bumps
[google.golang.org/api](https://github.com/googleapis/google-api-go-client)
from 0.252.0 to 0.253.0.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/releases">google.golang.org/api's
releases</a>.</em></p>
<blockquote>
<h2>v0.253.0</h2>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.252.0...v0.253.0">0.253.0</a>
(2025-10-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3337">#3337</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40f2752ec3e2075ceada92b8dcc3f6b2e465bb8d">40f2752</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3339">#3339</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/d1ef9766c46dcf687ee1711cc921b8162af47275">d1ef976</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3340">#3340</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/580c65f00246810dadf22d103614c9dbaaaf93af">580c65f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3341">#3341</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9d031c42291eef4e164462c979beafb7b2133155">9d031c4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3342">#3342</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ca2b9ad85a1e1889fbed2c33f3e1e6cd7dac014b">ca2b9ad</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3344">#3344</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/844753e402286005aa20ad8defb7eece1d4aea0c">844753e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3345">#3345</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3de8a5b1f08d0b14773636ed984e9f4c62d097cc">3de8a5b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3346">#3346</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/a590b9a89840c418a5dd1a426ef91ab740ac536e">a590b9a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3347">#3347</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40ca8fedda58c6b2f68a0e8b5be325628f4a0c09">40ca8fe</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/googleapis/google-api-go-client/blob/main/CHANGES.md">google.golang.org/api's
changelog</a>.</em></p>
<blockquote>
<h2><a
href="https://github.com/googleapis/google-api-go-client/compare/v0.252.0...v0.253.0">0.253.0</a>
(2025-10-22)</h2>
<h3>Features</h3>
<ul>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3337">#3337</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40f2752ec3e2075ceada92b8dcc3f6b2e465bb8d">40f2752</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3339">#3339</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/d1ef9766c46dcf687ee1711cc921b8162af47275">d1ef976</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3340">#3340</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/580c65f00246810dadf22d103614c9dbaaaf93af">580c65f</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3341">#3341</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/9d031c42291eef4e164462c979beafb7b2133155">9d031c4</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3342">#3342</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/ca2b9ad85a1e1889fbed2c33f3e1e6cd7dac014b">ca2b9ad</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3344">#3344</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/844753e402286005aa20ad8defb7eece1d4aea0c">844753e</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3345">#3345</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/3de8a5b1f08d0b14773636ed984e9f4c62d097cc">3de8a5b</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3346">#3346</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/a590b9a89840c418a5dd1a426ef91ab740ac536e">a590b9a</a>)</li>
<li><strong>all:</strong> Auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3347">#3347</a>)
(<a
href="https://github.com/googleapis/google-api-go-client/commit/40ca8fedda58c6b2f68a0e8b5be325628f4a0c09">40ca8fe</a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/bf0e302fbeb1339d0ee44171a3db421fe4a50eb2"><code>bf0e302</code></a>
chore(main): release 0.253.0 (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3338">#3338</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/40ca8fedda58c6b2f68a0e8b5be325628f4a0c09"><code>40ca8fe</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3347">#3347</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/a590b9a89840c418a5dd1a426ef91ab740ac536e"><code>a590b9a</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3346">#3346</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/3de8a5b1f08d0b14773636ed984e9f4c62d097cc"><code>3de8a5b</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3345">#3345</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/8012a7b9bfe04c4089d1f7f3fac4f553221f3067"><code>8012a7b</code></a>
chore(all): update all (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3343">#3343</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/844753e402286005aa20ad8defb7eece1d4aea0c"><code>844753e</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3344">#3344</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/ca2b9ad85a1e1889fbed2c33f3e1e6cd7dac014b"><code>ca2b9ad</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3342">#3342</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/9d031c42291eef4e164462c979beafb7b2133155"><code>9d031c4</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3341">#3341</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/580c65f00246810dadf22d103614c9dbaaaf93af"><code>580c65f</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3340">#3340</a>)</li>
<li><a
href="https://github.com/googleapis/google-api-go-client/commit/d1ef9766c46dcf687ee1711cc921b8162af47275"><code>d1ef976</code></a>
feat(all): auto-regenerate discovery clients (<a
href="https://redirect.github.com/googleapis/google-api-go-client/issues/3339">#3339</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/googleapis/google-api-go-client/compare/v0.252.0...v0.253.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google.golang.org/api&package-manager=go_modules&previous-version=0.252.0&new-version=0.253.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 go.mod |  6 +++---
 go.sum | 12 ++++++------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/go.mod b/go.mod
index 93fca9be191ae..07b5214d87854 100644
--- a/go.mod
+++ b/go.mod
@@ -206,7 +206,7 @@ require (
 	golang.org/x/text v0.30.0
 	golang.org/x/tools v0.38.0
 	golang.org/x/xerrors v0.0.0-20240903120638-7835f813f4da
-	google.golang.org/api v0.252.0
+	google.golang.org/api v0.253.0
 	google.golang.org/grpc v1.76.0
 	google.golang.org/protobuf v1.36.10
 	gopkg.in/DataDog/dd-trace-go.v1 v1.74.0
@@ -446,14 +446,14 @@ require (
 	go.uber.org/multierr v1.11.0 // indirect
 	go.uber.org/zap v1.27.0 // indirect
 	go4.org/mem v0.0.0-20220726221520-4f986261bf13 // indirect
-	golang.org/x/time v0.13.0 // indirect
+	golang.org/x/time v0.14.0 // indirect
 	golang.zx2c4.com/wintun v0.0.0-20230126152724-0fa3db229ce2
 	golang.zx2c4.com/wireguard/wgctrl v0.0.0-20230429144221-925a1e7659e6 // indirect
 	golang.zx2c4.com/wireguard/windows v0.5.3 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
 	google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20251014184007-4626949a642f // indirect
 	gopkg.in/ini.v1 v1.67.0 // indirect
 	howett.net/plist v1.0.0 // indirect
 	kernel.org/pub/linux/libs/security/libcap/psx v1.2.73 // indirect
diff --git a/go.sum b/go.sum
index 685d461a5557a..66fb4220d2f43 100644
--- a/go.sum
+++ b/go.sum
@@ -2387,8 +2387,8 @@ golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxb
 golang.org/x/time v0.0.0-20220922220347-f3bd1da661af/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.1.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
 golang.org/x/time v0.3.0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ=
-golang.org/x/time v0.13.0 h1:eUlYslOIt32DgYD6utsuUeHs4d7AsEYLuIAdg7FlYgI=
-golang.org/x/time v0.13.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
+golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI=
+golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4=
 golang.org/x/tools v0.0.0-20180525024113-a5b4c53f6e8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
 golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@@ -2539,8 +2539,8 @@ google.golang.org/api v0.108.0/go.mod h1:2Ts0XTHNVWxypznxWOYUeI4g3WdP9Pk2Qk58+a/
 google.golang.org/api v0.110.0/go.mod h1:7FC4Vvx1Mooxh8C5HWjzZHcavuS2f6pmJpZx60ca7iI=
 google.golang.org/api v0.111.0/go.mod h1:qtFHvU9mhgTJegR31csQ+rwxyUTHOKFqCKWp1J0fdw0=
 google.golang.org/api v0.114.0/go.mod h1:ifYI2ZsFK6/uGddGfAD5BMxlnkBqCmqHSDUVi45N5Yg=
-google.golang.org/api v0.252.0 h1:xfKJeAJaMwb8OC9fesr369rjciQ704AjU/psjkKURSI=
-google.golang.org/api v0.252.0/go.mod h1:dnHOv81x5RAmumZ7BWLShB/u7JZNeyalImxHmtTHxqw=
+google.golang.org/api v0.253.0 h1:apU86Eq9Q2eQco3NsUYFpVTfy7DwemojL7LmbAj7g/I=
+google.golang.org/api v0.253.0/go.mod h1:PX09ad0r/4du83vZVAaGg7OaeyGnaUmT/CYPNvtLCbw=
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
 google.golang.org/appengine v1.5.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
@@ -2685,8 +2685,8 @@ google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79 h1:Nt6z9UHqSlIdIGJ
 google.golang.org/genproto v0.0.0-20250715232539-7130f93afb79/go.mod h1:kTmlBHMPqR5uCZPBvwa2B18mvubkjyY3CRLI0c6fj0s=
 google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b h1:ULiyYQ0FdsJhwwZUwbaXpZF5yUE3h+RA+gxvBu37ucc=
 google.golang.org/genproto/googleapis/api v0.0.0-20250804133106-a7a43d27e69b/go.mod h1:oDOGiMSXHL4sDTJvFvIB9nRQCGdLP1o/iVaqQK8zB+M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797 h1:CirRxTOwnRWVLKzDNrs0CXAaVozJoR4G9xvdRecrdpk=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20251002232023-7c0ddcbb5797/go.mod h1:HSkG/KdJWusxU1F6CNrwNDjBMgisKxGnc5dAZfT0mjQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251014184007-4626949a642f h1:1FTH6cpXFsENbPR5Bu8NQddPSaUUE6NA2XdZdDSAJK4=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20251014184007-4626949a642f/go.mod h1:7i2o+ce6H/6BluujYR+kqX3GKH+dChPTQU19wjRPiGk=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
 google.golang.org/grpc v1.21.1/go.mod h1:oYelfM1adQP15Ek0mdvEgi9Df8B9CZIaU1084ijfRaM=

From a1161b79a74c64e8438033698a043c8fc724edfc Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Mon, 27 Oct 2025 12:25:24 +0000
Subject: [PATCH 257/298] ci: bump the github-actions group with 7 updates
 (#20498)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Bumps the github-actions group with 7 updates:

| Package | From | To |
| --- | --- | --- |
| [actions/upload-artifact](https://github.com/actions/upload-artifact)
| `4.6.2` | `5.0.0` |
| [chromaui/action](https://github.com/chromaui/action) | `13.3.0` |
`13.3.2` |
|
[actions/download-artifact](https://github.com/actions/download-artifact)
| `5.0.0` | `6.0.0` |
|
[tj-actions/changed-files](https://github.com/tj-actions/changed-files)
| `d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449` |
`dbf178ceecb9304128c8e0648591d71208c6e2c9` |
|
[nixbuild/nix-quick-install-action](https://github.com/nixbuild/nix-quick-install-action)
| `33` | `34` |
| [github/codeql-action](https://github.com/github/codeql-action) |
`4.30.9` | `4.31.0` |
|
[Mattraks/delete-workflow-runs](https://github.com/mattraks/delete-workflow-runs)
| `2.0.6` | `2.1.0` |

Updates `actions/upload-artifact` from 4.6.2 to 5.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/upload-artifact/releases">actions/upload-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v5.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node
<code>v24.x</code>. This is not a breaking change per-se but we're
treating it as such.</p>
<ul>
<li>Update README.md by <a
href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li>Update README.md by <a
href="https://github.com/nebuk89"><code>@​nebuk89</code></a> in <a
href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li>Readme: spell out the first use of GHES by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li>Update GHES guidance to include reference to Node 20 version by <a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
in <a
href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v5.0.0</code> by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/upload-artifact/pull/734">actions/upload-artifact#734</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/681">actions/upload-artifact#681</a></li>
<li><a href="https://github.com/nebuk89"><code>@​nebuk89</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/712">actions/upload-artifact#712</a></li>
<li><a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/727">actions/upload-artifact#727</a></li>
<li><a
href="https://github.com/patrikpolyak"><code>@​patrikpolyak</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/upload-artifact/pull/725">actions/upload-artifact#725</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/upload-artifact/compare/v4...v5.0.0">https://github.com/actions/upload-artifact/compare/v4...v5.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/upload-artifact/commit/330a01c490aca151604b8cf639adc76d48f6c5d4"><code>330a01c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/734">#734</a>
from actions/danwkennedy/prepare-5.0.0</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/03f282445299bbefc96171af272a984663b63a26"><code>03f2824</code></a>
Update <code>github.dep.yml</code></li>
<li><a
href="https://github.com/actions/upload-artifact/commit/905a1ecb5915b264cbc519e4eb415b5d82916018"><code>905a1ec</code></a>
Prepare <code>v5.0.0</code></li>
<li><a
href="https://github.com/actions/upload-artifact/commit/2d9f9cdfa99fedaddba68e9b5b5c281eca26cc63"><code>2d9f9cd</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/725">#725</a>
from patrikpolyak/patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/9687587dec67f2a8bc69104e183d311c42af6d6f"><code>9687587</code></a>
Merge branch 'main' into patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/2848b2cda0e5190984587ec6bb1f36730ca78d50"><code>2848b2c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/727">#727</a>
from danwkennedy/patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/9b511775fd9ce8c5710b38eea671f856de0e70a7"><code>9b51177</code></a>
Spell out the first use of GHES</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/cd231ca1eda77976a84805c4194a1954f56b0727"><code>cd231ca</code></a>
Update GHES guidance to include reference to Node 20 version</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/de65e23aa2b7e23d713bb51fbfcb6d502f8667d8"><code>de65e23</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/upload-artifact/issues/712">#712</a>
from actions/nebuk89-patch-1</li>
<li><a
href="https://github.com/actions/upload-artifact/commit/8747d8cd7632611ad6060b528f3e0f654c98869c"><code>8747d8c</code></a>
Update README.md</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/upload-artifact/compare/ea165f8d65b6e75b540449e92b4886f43607fa02...330a01c490aca151604b8cf639adc76d48f6c5d4">compare
view</a></li>
</ul>
</details>
<br />

Updates `chromaui/action` from 13.3.0 to 13.3.2
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/chromaui/action/commit/bc2d84ad2b60813a67d995c5582d696104a19383"><code>bc2d84a</code></a>
v13.3.2</li>
<li><a
href="https://github.com/chromaui/action/commit/1c807fb41f4db007b022d0806c09a94dce7b5ff6"><code>1c807fb</code></a>
v13.3.1</li>
<li>See full diff in <a
href="https://github.com/chromaui/action/compare/4ffe736a2a8262ea28067ff05a13b635ba31ec05...bc2d84ad2b60813a67d995c5582d696104a19383">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/download-artifact` from 5.0.0 to 6.0.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v6.0.0</h2>
<h2>What's Changed</h2>
<p><strong>BREAKING CHANGE:</strong> this update supports Node
<code>v24.x</code>. This is not a breaking change per-se but we're
treating it as such.</p>
<ul>
<li>Update README for download-artifact v5 changes by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/417">actions/download-artifact#417</a></li>
<li>Update README with artifact extraction details by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/424">actions/download-artifact#424</a></li>
<li>Readme: spell out the first use of GHES by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
<li>Bump <code>@actions/artifact</code> to <code>v4.0.0</code></li>
<li>Prepare <code>v6.0.0</code> by <a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a> in
<a
href="https://redirect.github.com/actions/download-artifact/pull/438">actions/download-artifact#438</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/danwkennedy"><code>@​danwkennedy</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/431">actions/download-artifact#431</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v5...v6.0.0">https://github.com/actions/download-artifact/compare/v5...v6.0.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53"><code>018cc2c</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/438">#438</a>
from actions/danwkennedy/prepare-6.0.0</li>
<li><a
href="https://github.com/actions/download-artifact/commit/815651c680ffe1c95719d0ed08aba1a2f9d5c177"><code>815651c</code></a>
Revert &quot;Remove <code>github.dep.yml</code>&quot;</li>
<li><a
href="https://github.com/actions/download-artifact/commit/bb3a066a8babc8ed7b3e4218896c548fe34e7115"><code>bb3a066</code></a>
Remove <code>github.dep.yml</code></li>
<li><a
href="https://github.com/actions/download-artifact/commit/fa1ce46bbd11b8387539af12741055a76dfdf804"><code>fa1ce46</code></a>
Prepare <code>v6.0.0</code></li>
<li><a
href="https://github.com/actions/download-artifact/commit/4a24838f3d5601fd639834081e118c2995d51e1c"><code>4a24838</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/431">#431</a>
from danwkennedy/patch-1</li>
<li><a
href="https://github.com/actions/download-artifact/commit/5e3251c4ff5a32e4cf8dd4adaee0e692365237ae"><code>5e3251c</code></a>
Readme: spell out the first use of GHES</li>
<li><a
href="https://github.com/actions/download-artifact/commit/abefc31eafcfbdf6c5336127c1346fdae79ff41c"><code>abefc31</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/424">#424</a>
from actions/yacaovsnc/update_readme</li>
<li><a
href="https://github.com/actions/download-artifact/commit/ac43a6070aa7db8a41e756e7a2846221edca7027"><code>ac43a60</code></a>
Update README with artifact extraction details</li>
<li><a
href="https://github.com/actions/download-artifact/commit/de96f4613b77ec03b5cf633e7c350c32bd3c5660"><code>de96f46</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/417">#417</a>
from actions/yacaovsnc/update_readme</li>
<li><a
href="https://github.com/actions/download-artifact/commit/7993cb44e9052f2f08f9b828ae5ef3ecca7d2ac7"><code>7993cb4</code></a>
Remove migration guide for artifact download changes</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-artifact/compare/634f93cb2916e3fdff6788551b99b062d0335ce0...018cc2cf5baa6db3ef3c5f8a56943fffe632ef53">compare
view</a></li>
</ul>
</details>
<br />

Updates `tj-actions/changed-files` from
d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 to
dbf178ceecb9304128c8e0648591d71208c6e2c9
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/tj-actions/changed-files/blob/main/HISTORY.md">tj-actions/changed-files's
changelog</a>.</em></p>
<blockquote>
<h1>Changelog</h1>
<h1><a
href="https://github.com/tj-actions/changed-files/compare/v46.0.5...v47.0.0">47.0.0</a>
- (2025-09-13)</h1>
<h2><!-- raw HTML omitted -->🚀 Features</h2>
<ul>
<li>Add any_added to outputs (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2567">#2567</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/c260d49a827b5eb266673bed7871c5d3ee9b5aef">c260d49</a>)
- (Jellyfrog)</li>
</ul>
<h2><!-- raw HTML omitted -->➖ Remove</h2>
<ul>
<li>Commit and push step from build job (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2538">#2538</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/be393a90381e27c9fec2c8c2e02b00f005710145">be393a9</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->🔄 Update</h2>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2592">#2592</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/3dbc1e181273d808ccff822a6e00cf18b6628ef0">3dbc1e1</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2591">#2591</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/b1ccff8c0892ad141d7d2de6f31e526a9dad931f">b1ccff8</a>)
- (github-actions[bot])</p>
<ul>
<li>Updated README.md (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2574">#2574</a>)</li>
</ul>
<p>Co-authored-by: github-actions[bot]
&lt;41898282+github-actions[bot]<a
href="https://github.com/users"><code>@​users</code></a>.noreply.github.com&gt;
(<a
href="https://github.com/tj-actions/changed-files/commit/050a3d3360d29711ee9d8210fc639d902d23ad07">050a3d3</a>)
- (github-actions[bot])</p>
<h2><!-- raw HTML omitted -->📚 Documentation</h2>
<ul>
<li>Update link to glob patterns (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2590">#2590</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/a892f50f7a7187bc288633c09230b09ce7ad8fd0">a892f50</a>)
- (Tonye Jack)</li>
<li>Add Jellyfrog as a contributor for code, and doc (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2573">#2573</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/f000a9b97f254f9590ff26f651cccde827ad36da">f000a9b</a>)
- (allcontributors[bot])</li>
</ul>
<h2><!-- raw HTML omitted -->🧪 Testing</h2>
<ul>
<li>Manual triggered workflows (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2637">#2637</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/c2ca2493190021783138cb8aac49bcee14b4bb89">c2ca249</a>)
- (Tonye Jack)</li>
</ul>
<h2><!-- raw HTML omitted -->⚙️ Miscellaneous Tasks</h2>
<ul>
<li><strong>deps-dev:</strong> Bump jest from 30.0.5 to 30.1.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2655">#2655</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/9a6755550a331fdcc8ec45443738933f8fa22eea">9a67555</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.1.0 to 2.2.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2660">#2660</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/b67e30df88f43e244f4e83775e5ad8335114fb95">b67e30d</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.30.2 to
3.30.3 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2661">#2661</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/62aef422ffa195474d80d73387535cf4622b2824">62aef42</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.11 to
3.30.2 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2659">#2659</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e874f3cddd0f54ae776e6995ae6dae4cf40fd3d3">e874f3c</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/setup-node from 4.4.0 to 5.0.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2656">#2656</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/8c14441336bb3d84fd6b7fa83b6d7201c740baf5">8c14441</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.3.0 to 24.3.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2657">#2657</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e995ac4be5be2bcb6e29556edc51fb63aca6b49b">e995ac4</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.2.1 to 24.3.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2649">#2649</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/3b04099b21072562f07469c10deb182b24236ca9">3b04099</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.9 to
3.29.11 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2651">#2651</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/e7b6c977e51984988e3cc1d6b18abe2a3ba8daaa">e7b6c97</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump tj-actions/git-cliff from 2.0.2 to 2.1.0
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2648">#2648</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/765d62bc041415a5b494ef13d02d566128b25973">765d62b</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.8 to
3.29.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2647">#2647</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/2036da178f85576f1940fedb74bb93a36cd89ab7">2036da1</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump github/codeql-action from 3.29.7 to
3.29.8 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2644">#2644</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/239aef84a5502c79a1cea96e495d17588c66c659">239aef8</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.2.0 to 24.2.1 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2645">#2645</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/a7d5f5f4919b6dbc6d3a3689887964361e8dd88f">a7d5f5f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/checkout from 4.2.2 to 5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2646">#2646</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/5107f3abcc0c3737db51e2949f181e2c197d4d5b">5107f3a</a>)
- (dependabot[bot])</li>
<li><strong>deps-dev:</strong> Bump <code>@​types/node</code> from
24.1.0 to 24.2.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2640">#2640</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/f963b3f3562b00b6d2dd25efc390eb04e51ef6c6">f963b3f</a>)
- (dependabot[bot])</li>
<li><strong>deps:</strong> Bump actions/download-artifact from 4.3.0 to
5.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2641">#2641</a>)
(<a
href="https://github.com/tj-actions/changed-files/commit/f956744105e18d78bba3844a1199ce43d6503017">f956744</a>)
- (dependabot[bot])</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/tj-actions/changed-files/commit/dbf178ceecb9304128c8e0648591d71208c6e2c9"><code>dbf178c</code></a>
chore(deps): bump actions/setup-node from 5.0.0 to 6.0.0 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2690">#2690</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/19002623031eba72900680c5deed5ee6333dbc12"><code>1900262</code></a>
chore(deps): bump github/codeql-action from 3.30.6 to 4.30.9 (<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2693">#2693</a>)</li>
<li><a
href="https://github.com/tj-actions/changed-files/commit/27e5d78f9b6a61e3160a2fe263cca91675c08fa0"><code>27e5d78</code></a>
chore(deps-dev): bump <code>@​types/node</code> from 24.6.2 to 24.9.1
(<a
href="https://redirect.github.com/tj-actions/changed-files/issues/2695">#2695</a>)</li>
<li>See full diff in <a
href="https://github.com/tj-actions/changed-files/compare/d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449...dbf178ceecb9304128c8e0648591d71208c6e2c9">compare
view</a></li>
</ul>
</details>
<br />

Updates `nixbuild/nix-quick-install-action` from 33 to 34
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/nixbuild/nix-quick-install-action/releases">nixbuild/nix-quick-install-action's
releases</a>.</em></p>
<blockquote>
<h2>nixbuild/nix-quick-install-action@v34</h2>
<h2>Changes</h2>
<ul>
<li>
<p>Update Nix versions: 2.31.0 -&gt; 2.31.2, 2.30.0 -&gt; 2.30.3, 2.29.1
-&gt; 2.29.2, 2.28.4 -&gt; 2.28.5.</p>
</li>
<li>
<p>Bump default Nix version: 2.29.1 -&gt; 2.29.2</p>
</li>
</ul>
<h2>Supported Nix Versions on x86_64-linux runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
<li>2.3.18</li>
</ul>
<h2>Supported Nix Versions on aarch64-linux runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
</ul>
<h2>Supported Nix Versions on x86_64-darwin runners</h2>
<ul>
<li>2.31.2</li>
<li>2.30.3</li>
<li>2.29.2</li>
<li>2.28.5</li>
<li>2.26.4</li>
<li>2.24.15</li>
<li>2.3.18</li>
</ul>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/nixbuild/nix-quick-install-action/blob/master/RELEASE">nixbuild/nix-quick-install-action's
changelog</a>.</em></p>
<blockquote>
<p>v34</p>
<h2>Changes</h2>
<ul>
<li>
<p>Update Nix versions: 2.31.0 -&gt; 2.31.2, 2.30.0 -&gt; 2.30.3, 2.29.1
-&gt; 2.29.2, 2.28.4 -&gt; 2.28.5.</p>
</li>
<li>
<p>Bump default Nix version: 2.29.1 -&gt; 2.29.2</p>
</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035"><code>2c9db80</code></a>
Release v34</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/6dd8039259767bef94d598f79b506a92ee991ff8"><code>6dd8039</code></a>
ci: Fix versions</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/a7214c23df4e59da80e6e71503e1f766444fb1e2"><code>a7214c2</code></a>
Fix default version</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/efda085bcade238a03bdbd41f224f08d4ef362e9"><code>efda085</code></a>
Bump Nix versions</li>
<li><a
href="https://github.com/nixbuild/nix-quick-install-action/commit/b644e5e09df2afc194ad86b2a8467b701d15c606"><code>b644e5e</code></a>
Update README and workflows for v33</li>
<li>See full diff in <a
href="https://github.com/nixbuild/nix-quick-install-action/compare/1f095fee853b33114486cfdeae62fa099cda35a9...2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035">compare
view</a></li>
</ul>
</details>
<br />

Updates `github/codeql-action` from 4.30.9 to 4.31.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/releases">github/codeql-action's
releases</a>.</em></p>
<blockquote>
<h2>v4.31.0</h2>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or
<code>upload-sarif</code> actions, the CodeQL Action automatically
performs post-processing steps to prepare the data for the upload.
Previously, these post-processing steps were only performed before an
upload took place. We are now changing this so that the post-processing
steps will always be performed, even when the SARIF files are not
uploaded. This does not change anything for the
<code>upload-sarif</code> action. For <code>analyze</code>, this may
affect Advanced Setup for CodeQL users who specify a value other than
<code>always</code> for the <code>upload</code> input. <a
href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<p>See the full <a
href="https://github.com/github/codeql-action/blob/v4.31.0/CHANGELOG.md">CHANGELOG.md</a>
for more information.</p>
</blockquote>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action's
changelog</a>.</em></p>
<blockquote>
<h1>CodeQL Action Changelog</h1>
<p>See the <a
href="https://github.com/github/codeql-action/releases">releases
page</a> for the relevant changes to the CodeQL CLI and language
packs.</p>
<h2>[UNRELEASED]</h2>
<p>No user facing changes.</p>
<h2>4.31.0 - 24 Oct 2025</h2>
<ul>
<li>Bump minimum CodeQL bundle version to 2.17.6. <a
href="https://redirect.github.com/github/codeql-action/pull/3223">#3223</a></li>
<li>When SARIF files are uploaded by the <code>analyze</code> or
<code>upload-sarif</code> actions, the CodeQL Action automatically
performs post-processing steps to prepare the data for the upload.
Previously, these post-processing steps were only performed before an
upload took place. We are now changing this so that the post-processing
steps will always be performed, even when the SARIF files are not
uploaded. This does not change anything for the
<code>upload-sarif</code> action. For <code>analyze</code>, this may
affect Advanced Setup for CodeQL users who specify a value other than
<code>always</code> for the <code>upload</code> input. <a
href="https://redirect.github.com/github/codeql-action/pull/3222">#3222</a></li>
</ul>
<h2>4.30.9 - 17 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.3. <a
href="https://redirect.github.com/github/codeql-action/pull/3205">#3205</a></li>
<li>Experimental: A new <code>setup-codeql</code> action has been added
which is similar to <code>init</code>, except it only installs the
CodeQL CLI and does not initialize a database. Do not use this in
production as it is part of an internal experiment and subject to change
at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3204">#3204</a></li>
</ul>
<h2>4.30.8 - 10 Oct 2025</h2>
<p>No user facing changes.</p>
<h2>4.30.7 - 06 Oct 2025</h2>
<ul>
<li>[v4+ only] The CodeQL Action now runs on Node.js v24. <a
href="https://redirect.github.com/github/codeql-action/pull/3169">#3169</a></li>
</ul>
<h2>3.30.6 - 02 Oct 2025</h2>
<ul>
<li>Update default CodeQL bundle version to 2.23.2. <a
href="https://redirect.github.com/github/codeql-action/pull/3168">#3168</a></li>
</ul>
<h2>3.30.5 - 26 Sep 2025</h2>
<ul>
<li>We fixed a bug that was introduced in <code>3.30.4</code> with
<code>upload-sarif</code> which resulted in files without a
<code>.sarif</code> extension not getting uploaded. <a
href="https://redirect.github.com/github/codeql-action/pull/3160">#3160</a></li>
</ul>
<h2>3.30.4 - 25 Sep 2025</h2>
<ul>
<li>We have improved the CodeQL Action's ability to validate that the
workflow it is used in does not use different versions of the CodeQL
Action for different workflow steps. Mixing different versions of the
CodeQL Action in the same workflow is unsupported and can lead to
unpredictable results. A warning will now be emitted from the
<code>codeql-action/init</code> step if different versions of the CodeQL
Action are detected in the workflow file. Additionally, an error will
now be thrown by the other CodeQL Action steps if they load a
configuration file that was generated by a different version of the
<code>codeql-action/init</code> step. <a
href="https://redirect.github.com/github/codeql-action/pull/3099">#3099</a>
and <a
href="https://redirect.github.com/github/codeql-action/pull/3100">#3100</a></li>
<li>We added support for reducing the size of dependency caches for Java
analyses, which will reduce cache usage and speed up workflows. This
will be enabled automatically at a later time. <a
href="https://redirect.github.com/github/codeql-action/pull/3107">#3107</a></li>
<li>You can now run the latest CodeQL nightly bundle by passing
<code>tools: nightly</code> to the <code>init</code> action. In general,
the nightly bundle is unstable and we only recommend running it when
directed by GitHub staff. <a
href="https://redirect.github.com/github/codeql-action/pull/3130">#3130</a></li>
<li>Update default CodeQL bundle version to 2.23.1. <a
href="https://redirect.github.com/github/codeql-action/pull/3118">#3118</a></li>
</ul>
<h2>3.30.3 - 10 Sep 2025</h2>
<p>No user facing changes.</p>
<h2>3.30.2 - 09 Sep 2025</h2>
<ul>
<li>Fixed a bug which could cause language autodetection to fail. <a
href="https://redirect.github.com/github/codeql-action/pull/3084">#3084</a></li>
<li>Experimental: The <code>quality-queries</code> input that was added
in <code>3.29.2</code> as part of an internal experiment is now
deprecated and will be removed in an upcoming version of the CodeQL
Action. It has been superseded by a new <code>analysis-kinds</code>
input, which is part of the same internal experiment. Do not use this in
production as it is subject to change at any time. <a
href="https://redirect.github.com/github/codeql-action/pull/3064">#3064</a></li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/github/codeql-action/commit/4e94bd11f71e507f7f87df81788dff88d1dacbfb"><code>4e94bd1</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3235">#3235</a>
from github/update-v4.31.0-1d36546c1</li>
<li><a
href="https://github.com/github/codeql-action/commit/8f11182164f2181cc5608a575e3c7ef3bc4a9cd1"><code>8f11182</code></a>
Update changelog for v4.31.0</li>
<li><a
href="https://github.com/github/codeql-action/commit/1d36546c1419dc613cdb4b7fde46b1c81643ccbe"><code>1d36546</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3234">#3234</a>
from github/mbg/changelog/post-processing</li>
<li><a
href="https://github.com/github/codeql-action/commit/08ada26e6a4768939d6da6a5e23ae69052948fd7"><code>08ada26</code></a>
Add changelog entry for post-processing change</li>
<li><a
href="https://github.com/github/codeql-action/commit/b843cbeed03550ed4937992fa96258262e955178"><code>b843cbe</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3233">#3233</a>
from github/mbg/getOptionalEnvVar</li>
<li><a
href="https://github.com/github/codeql-action/commit/1ecd56391940567d00fd07e34b4ca7b75dadd92a"><code>1ecd563</code></a>
Use <code>getOptionalEnvVar</code> in
<code>writePostProcessedFiles</code></li>
<li><a
href="https://github.com/github/codeql-action/commit/e57680792076a32e6f147ccf58374517ea645a31"><code>e576807</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3223">#3223</a>
from github/henrymercer/bump-minimum</li>
<li><a
href="https://github.com/github/codeql-action/commit/ad3567666919ea4249d02a26c230ea8e0daef410"><code>ad35676</code></a>
Add <code>getOptionalEnvVar</code> function</li>
<li><a
href="https://github.com/github/codeql-action/commit/d75645b13f453e29a7f3c3f316babb725e644d0a"><code>d75645b</code></a>
Merge pull request <a
href="https://redirect.github.com/github/codeql-action/issues/3222">#3222</a>
from github/mbg/upload-lib/post-process</li>
<li><a
href="https://github.com/github/codeql-action/commit/710606cc35e2444ba84bdf7702dcb481f7380ae7"><code>710606c</code></a>
Check that <code>outputPath</code> is non-empty</li>
<li>Additional commits viewable in <a
href="https://github.com/github/codeql-action/compare/16140ae1a102900babc80a33c44059580f687047...4e94bd11f71e507f7f87df81788dff88d1dacbfb">compare
view</a></li>
</ul>
</details>
<br />

Updates `Mattraks/delete-workflow-runs` from 2.0.6 to 2.1.0
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/mattraks/delete-workflow-runs/releases">Mattraks/delete-workflow-runs's
releases</a>.</em></p>
<blockquote>
<h2>v2.1.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md with contents: read permission by <a
href="https://github.com/jonaslindstr"><code>@​jonaslindstr</code></a>
in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/19">Mattraks/delete-workflow-runs#19</a></li>
<li>Deletes workflow runs that do not have an existing workflow by <a
href="https://github.com/watercable76"><code>@​watercable76</code></a>
in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/20">Mattraks/delete-workflow-runs#20</a></li>
<li>Quick note about GHE <code>baseUrl</code> config by <a
href="https://github.com/kquinsland"><code>@​kquinsland</code></a> in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/32">Mattraks/delete-workflow-runs#32</a></li>
<li>Added try/catch blocks to catch each error individually by <a
href="https://github.com/marcelovani"><code>@​marcelovani</code></a> in
<a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/35">Mattraks/delete-workflow-runs#35</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/jonaslindstr"><code>@​jonaslindstr</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/19">Mattraks/delete-workflow-runs#19</a></li>
<li><a
href="https://github.com/watercable76"><code>@​watercable76</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/20">Mattraks/delete-workflow-runs#20</a></li>
<li><a
href="https://github.com/kquinsland"><code>@​kquinsland</code></a> made
their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/32">Mattraks/delete-workflow-runs#32</a></li>
<li><a
href="https://github.com/marcelovani"><code>@​marcelovani</code></a>
made their first contribution in <a
href="https://redirect.github.com/Mattraks/delete-workflow-runs/pull/35">Mattraks/delete-workflow-runs#35</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/Mattraks/delete-workflow-runs/compare/v2.0.6...v2.1.0">https://github.com/Mattraks/delete-workflow-runs/compare/v2.0.6...v2.1.0</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/ab482449ba468316e9a8801e092d0405715c5e6d"><code>ab48244</code></a>
version v2.1.0</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/feeb82053ea847a97fe4ee2aa314c94eac0eff04"><code>feeb820</code></a>
Undo previous changes.</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/c61e04ec70740b989bdb168af9c948f2172856d8"><code>c61e04e</code></a>
Added another try/catch block</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/f93a693640fbced9f6b9026397406572c0dddcec"><code>f93a693</code></a>
Added another try/catch block</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/f40e9cd01093f8470cb92e70a971329a1c6b5ca1"><code>f40e9cd</code></a>
Removed condition that is limiting deletion</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/0a28a6b9d4f62e5b211056ceead85cc6776403eb"><code>0a28a6b</code></a>
Display debug messages</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/cb572387c439bdadffcac5fdba1f5fae3374309f"><code>cb57238</code></a>
Display all workflows</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/8859caa93697386bdb136521cca778eb9427e800"><code>8859caa</code></a>
Quick note about GHE <code>baseUrl</code> config</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/4c9f24749b7996562658e3d6e10662489e22caca"><code>4c9f247</code></a>
Added better check to verify runs to be deleted, and some logging</li>
<li><a
href="https://github.com/Mattraks/delete-workflow-runs/commit/20682956720600a468c346b81c1965bfc2312d70"><code>2068295</code></a>
Deletes workflow runs that do not have an existing workflow</li>
<li>Additional commits viewable in <a
href="https://github.com/mattraks/delete-workflow-runs/compare/39f0bbed25d76b34de5594dceab824811479e5de...ab482449ba468316e9a8801e092d0405715c5e6d">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/ci.yaml       | 16 ++++++++--------
 .github/workflows/docs-ci.yaml  |  2 +-
 .github/workflows/dogfood.yaml  |  2 +-
 .github/workflows/release.yaml  |  8 ++++----
 .github/workflows/scorecard.yml |  4 ++--
 .github/workflows/security.yaml |  8 ++++----
 .github/workflows/stale.yaml    |  4 ++--
 7 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index acd6a58f53cbb..4b9b037e13f6b 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -500,7 +500,7 @@ jobs:
           make test
 
       - name: Upload failed test db dumps
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: failed-test-db-dump-${{matrix.os}}
           path: "**/*.test.sql"
@@ -762,7 +762,7 @@ jobs:
 
       - name: Upload Playwright Failed Tests
         if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: failed-test-videos${{ matrix.variant.premium && '-premium' || '' }}
           path: ./site/test-results/**/*.webm
@@ -770,7 +770,7 @@ jobs:
 
       - name: Upload pprof dumps
         if: always() && github.actor != 'dependabot[bot]' && runner.os == 'Linux' && !github.event.pull_request.head.repo.fork
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: debug-pprof-dumps${{ matrix.variant.premium && '-premium' || ''  }}
           path: ./site/test-results/**/debug-pprof-*.txt
@@ -806,7 +806,7 @@ jobs:
       # the check to pass. This is desired in PRs, but not in mainline.
       - name: Publish to Chromatic (non-mainline)
         if: github.ref != 'refs/heads/main' && github.repository_owner == 'coder'
-        uses: chromaui/action@4ffe736a2a8262ea28067ff05a13b635ba31ec05 # v13.3.0
+        uses: chromaui/action@bc2d84ad2b60813a67d995c5582d696104a19383 # v13.3.2
         env:
           NODE_OPTIONS: "--max_old_space_size=4096"
           STORYBOOK: true
@@ -838,7 +838,7 @@ jobs:
       # infinitely "in progress" in mainline unless we re-review each build.
       - name: Publish to Chromatic (mainline)
         if: github.ref == 'refs/heads/main' && github.repository_owner == 'coder'
-        uses: chromaui/action@4ffe736a2a8262ea28067ff05a13b635ba31ec05 # v13.3.0
+        uses: chromaui/action@bc2d84ad2b60813a67d995c5582d696104a19383 # v13.3.2
         env:
           NODE_OPTIONS: "--max_old_space_size=4096"
           STORYBOOK: true
@@ -1036,7 +1036,7 @@ jobs:
 
       - name: Upload build artifacts
         if: ${{ github.repository_owner == 'coder' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')) }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: dylibs
           path: |
@@ -1201,7 +1201,7 @@ jobs:
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
 
       - name: Download dylibs
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: dylibs
           path: ./build
@@ -1468,7 +1468,7 @@ jobs:
 
       - name: Upload build artifacts
         if: github.ref == 'refs/heads/main'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: coder
           path: |
diff --git a/.github/workflows/docs-ci.yaml b/.github/workflows/docs-ci.yaml
index a4f593d425f8a..749bdce9b25c3 100644
--- a/.github/workflows/docs-ci.yaml
+++ b/.github/workflows/docs-ci.yaml
@@ -30,7 +30,7 @@ jobs:
       - name: Setup Node
         uses: ./.github/actions/setup-node
 
-      - uses: tj-actions/changed-files@d03a93c0dbfac6d6dd6a0d8a5e7daff992b07449 # v45.0.7
+      - uses: tj-actions/changed-files@dbf178ceecb9304128c8e0648591d71208c6e2c9 # v45.0.7
         id: changed-files
         with:
           files: |
diff --git a/.github/workflows/dogfood.yaml b/.github/workflows/dogfood.yaml
index 780cef6e0cc6d..2f47132ae43f0 100644
--- a/.github/workflows/dogfood.yaml
+++ b/.github/workflows/dogfood.yaml
@@ -36,7 +36,7 @@ jobs:
           persist-credentials: false
 
       - name: Setup Nix
-        uses: nixbuild/nix-quick-install-action@1f095fee853b33114486cfdeae62fa099cda35a9 # v33
+        uses: nixbuild/nix-quick-install-action@2c9db80fb984ceb1bcaa77cdda3fdf8cfba92035 # v34
         with:
           # Pinning to 2.28 here, as Nix gets a "error: [json.exception.type_error.302] type must be array, but is string"
           # on version 2.29 and above.
diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index a91b9b8c6519f..7c06701836714 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -131,7 +131,7 @@ jobs:
           AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
 
       - name: Upload build artifacts
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: dylibs
           path: |
@@ -327,7 +327,7 @@ jobs:
         uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1
 
       - name: Download dylibs
-        uses: actions/download-artifact@634f93cb2916e3fdff6788551b99b062d0335ce0 # v5.0.0
+        uses: actions/download-artifact@018cc2cf5baa6db3ef3c5f8a56943fffe632ef53 # v6.0.0
         with:
           name: dylibs
           path: ./build
@@ -761,7 +761,7 @@ jobs:
 
       - name: Upload artifacts to actions (if dry-run)
         if: ${{ inputs.dry_run }}
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: release-artifacts
           path: |
@@ -777,7 +777,7 @@ jobs:
 
       - name: Upload latest sbom artifact to actions (if dry-run)
         if: inputs.dry_run && steps.build_docker.outputs.created_latest_tag == 'true'
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: latest-sbom-artifact
           path: ./coder_latest_sbom.spdx.json
diff --git a/.github/workflows/scorecard.yml b/.github/workflows/scorecard.yml
index 279556bce6ff7..c18b2d09a8233 100644
--- a/.github/workflows/scorecard.yml
+++ b/.github/workflows/scorecard.yml
@@ -39,7 +39,7 @@ jobs:
 
       # Upload the results as artifacts.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: SARIF file
           path: results.sarif
@@ -47,6 +47,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
+        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
         with:
           sarif_file: results.sarif
diff --git a/.github/workflows/security.yaml b/.github/workflows/security.yaml
index 927d7a161151f..21452b0b89f6f 100644
--- a/.github/workflows/security.yaml
+++ b/.github/workflows/security.yaml
@@ -40,7 +40,7 @@ jobs:
         uses: ./.github/actions/setup-go
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
+        uses: github/codeql-action/init@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
         with:
           languages: go, javascript
 
@@ -50,7 +50,7 @@ jobs:
           rm Makefile
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
+        uses: github/codeql-action/analyze@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
 
       - name: Send Slack notification on failure
         if: ${{ failure() }}
@@ -154,13 +154,13 @@ jobs:
           severity: "CRITICAL,HIGH"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@16140ae1a102900babc80a33c44059580f687047 # v3.29.5
+        uses: github/codeql-action/upload-sarif@4e94bd11f71e507f7f87df81788dff88d1dacbfb # v3.29.5
         with:
           sarif_file: trivy-results.sarif
           category: "Trivy"
 
       - name: Upload Trivy scan results as an artifact
-        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
+        uses: actions/upload-artifact@330a01c490aca151604b8cf639adc76d48f6c5d4 # v5.0.0
         with:
           name: trivy
           path: trivy-results.sarif
diff --git a/.github/workflows/stale.yaml b/.github/workflows/stale.yaml
index e7555523dd6bb..75fb201bd5753 100644
--- a/.github/workflows/stale.yaml
+++ b/.github/workflows/stale.yaml
@@ -125,7 +125,7 @@ jobs:
           egress-policy: audit
 
       - name: Delete PR Cleanup workflow runs
-        uses: Mattraks/delete-workflow-runs@39f0bbed25d76b34de5594dceab824811479e5de # v2.0.6
+        uses: Mattraks/delete-workflow-runs@ab482449ba468316e9a8801e092d0405715c5e6d # v2.1.0
         with:
           token: ${{ github.token }}
           repository: ${{ github.repository }}
@@ -134,7 +134,7 @@ jobs:
           delete_workflow_pattern: pr-cleanup.yaml
 
       - name: Delete PR Deploy workflow skipped runs
-        uses: Mattraks/delete-workflow-runs@39f0bbed25d76b34de5594dceab824811479e5de # v2.0.6
+        uses: Mattraks/delete-workflow-runs@ab482449ba468316e9a8801e092d0405715c5e6d # v2.1.0
         with:
           token: ${{ github.token }}
           repository: ${{ github.repository }}

From ffe22a0ffce1c3cc54138a4bedf7e907c98915f6 Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Mon, 27 Oct 2025 10:09:52 -0500
Subject: [PATCH 258/298] chore: show build timeline regardless of agent
 scripts count (#20470)

---
 .../WorkspaceTimings.stories.tsx              | 44 +++++++++++++++++++
 .../WorkspaceTiming/WorkspaceTimings.tsx      |  4 +-
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.stories.tsx b/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.stories.tsx
index 9c8ce12168631..f82f1ccae5975 100644
--- a/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.stories.tsx
+++ b/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.stories.tsx
@@ -277,3 +277,47 @@ export const InvalidTimeRange: Story = {
 		],
 	},
 };
+
+// A template with no agent scripts.
+export const NoAgentScripts: Story = {
+	args: {
+		provisionerTimings: [
+			{
+				...WorkspaceTimingsResponse.provisioner_timings[0],
+				stage: "init",
+				started_at: "2025-01-01T00:00:00Z",
+				ended_at: "2025-01-01T00:01:00Z",
+			},
+			{
+				...WorkspaceTimingsResponse.provisioner_timings[0],
+				stage: "plan",
+				started_at: "2025-01-01T00:01:00Z",
+				ended_at: "0001-01-01T00:00:00Z",
+			},
+			{
+				...WorkspaceTimingsResponse.provisioner_timings[0],
+				stage: "graph",
+				started_at: "0001-01-01T00:00:00Z",
+				ended_at: "2025-01-01T00:03:00Z",
+			},
+			{
+				...WorkspaceTimingsResponse.provisioner_timings[0],
+				stage: "apply",
+				started_at: "2025-01-01T00:03:00Z",
+				ended_at: "2025-01-01T00:04:00Z",
+			},
+		],
+		agentConnectionTimings: [
+			{
+				started_at: "2025-01-01T00:05:00Z",
+				ended_at: "2025-01-01T00:06:00Z",
+				stage: "connect",
+				workspace_agent_id: "67e37a9d-ccac-497e-8f48-4093bcc4f3e7",
+				workspace_agent_name: "main",
+			},
+		],
+		agentScriptTimings: [
+			// No agent scripts in the template
+		],
+	},
+};
diff --git a/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx b/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx
index 7614013c9bfbf..b4cffd4d719d3 100644
--- a/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx
+++ b/site/src/modules/workspaces/WorkspaceTiming/WorkspaceTimings.tsx
@@ -69,8 +69,10 @@ export const WorkspaceTimings: FC<WorkspaceTimingsProps> = ({
 	// filled in different moments.
 	const isLoading = [
 		provisionerTimings,
-		agentScriptTimings,
 		agentConnectionTimings,
+		// agentScriptTimings might be an empty array if there are no scripts to run.
+		// Only provisionerTimings and agentConnectionTimings are guaranteed to have
+		// at least one entry.
 	].some((t) => t.length === 0);
 
 	// Each agent connection timing is a stage in the timeline to make it easier

From d0fb4599f0fd064a726e60eefa4f7fa1282e3f1c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Pawe=C5=82=20Banaszewski?= <pawel@coder.com>
Date: Mon, 27 Oct 2025 16:38:00 +0100
Subject: [PATCH 259/298] feat: add RecordInterceptionEnded rpc (#20494)

Adds RPC that marks interception as completed.
Added to aibridge in https://github.com/coder/aibridge/pull/43

fixes https://github.com/coder/internal/issues/1051
---
 enterprise/x/aibridged/aibridged_test.go      |   1 +
 .../x/aibridged/aibridgedmock/clientmock.go   |  15 +
 enterprise/x/aibridged/proto/aibridged.pb.go  | 724 +++++++++++-------
 enterprise/x/aibridged/proto/aibridged.proto  |   8 +
 .../x/aibridged/proto/aibridged_drpc.pb.go    |  46 +-
 enterprise/x/aibridged/translator.go          |   8 +
 .../x/aibridgedserver/aibridgedserver.go      |  21 +
 .../x/aibridgedserver/aibridgedserver_test.go |  54 ++
 go.mod                                        |   2 +-
 go.sum                                        |   4 +-
 10 files changed, 584 insertions(+), 299 deletions(-)

diff --git a/enterprise/x/aibridged/aibridged_test.go b/enterprise/x/aibridged/aibridged_test.go
index 32ef4870623ee..84e493090563c 100644
--- a/enterprise/x/aibridged/aibridged_test.go
+++ b/enterprise/x/aibridged/aibridged_test.go
@@ -305,6 +305,7 @@ func TestRouting(t *testing.T) {
 				interceptionID = in.GetId()
 				return &proto.RecordInterceptionResponse{}, nil
 			})
+			client.EXPECT().RecordInterceptionEnded(gomock.Any(), gomock.Any()).Times(tc.expectedHits)
 
 			// Given: aibridged is started.
 			srv, err := aibridged.New(t.Context(), pool, func(ctx context.Context) (aibridged.DRPCClient, error) {
diff --git a/enterprise/x/aibridged/aibridgedmock/clientmock.go b/enterprise/x/aibridged/aibridgedmock/clientmock.go
index 2210051689402..c49a385451a8e 100644
--- a/enterprise/x/aibridged/aibridgedmock/clientmock.go
+++ b/enterprise/x/aibridged/aibridgedmock/clientmock.go
@@ -116,6 +116,21 @@ func (mr *MockDRPCClientMockRecorder) RecordInterception(ctx, in any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RecordInterception", reflect.TypeOf((*MockDRPCClient)(nil).RecordInterception), ctx, in)
 }
 
+// RecordInterceptionEnded mocks base method.
+func (m *MockDRPCClient) RecordInterceptionEnded(ctx context.Context, in *proto.RecordInterceptionEndedRequest) (*proto.RecordInterceptionEndedResponse, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "RecordInterceptionEnded", ctx, in)
+	ret0, _ := ret[0].(*proto.RecordInterceptionEndedResponse)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// RecordInterceptionEnded indicates an expected call of RecordInterceptionEnded.
+func (mr *MockDRPCClientMockRecorder) RecordInterceptionEnded(ctx, in any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "RecordInterceptionEnded", reflect.TypeOf((*MockDRPCClient)(nil).RecordInterceptionEnded), ctx, in)
+}
+
 // RecordPromptUsage mocks base method.
 func (m *MockDRPCClient) RecordPromptUsage(ctx context.Context, in *proto.RecordPromptUsageRequest) (*proto.RecordPromptUsageResponse, error) {
 	m.ctrl.T.Helper()
diff --git a/enterprise/x/aibridged/proto/aibridged.pb.go b/enterprise/x/aibridged/proto/aibridged.pb.go
index e88d0d1a9aee9..41d31563b4043 100644
--- a/enterprise/x/aibridged/proto/aibridged.pb.go
+++ b/enterprise/x/aibridged/proto/aibridged.pb.go
@@ -147,6 +147,99 @@ func (*RecordInterceptionResponse) Descriptor() ([]byte, []int) {
 	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{1}
 }
 
+type RecordInterceptionEndedRequest struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+
+	Id      string                 `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"` // UUID.
+	EndedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=ended_at,json=endedAt,proto3" json:"ended_at,omitempty"`
+}
+
+func (x *RecordInterceptionEndedRequest) Reset() {
+	*x = RecordInterceptionEndedRequest{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RecordInterceptionEndedRequest) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordInterceptionEndedRequest) ProtoMessage() {}
+
+func (x *RecordInterceptionEndedRequest) ProtoReflect() protoreflect.Message {
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordInterceptionEndedRequest.ProtoReflect.Descriptor instead.
+func (*RecordInterceptionEndedRequest) Descriptor() ([]byte, []int) {
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{2}
+}
+
+func (x *RecordInterceptionEndedRequest) GetId() string {
+	if x != nil {
+		return x.Id
+	}
+	return ""
+}
+
+func (x *RecordInterceptionEndedRequest) GetEndedAt() *timestamppb.Timestamp {
+	if x != nil {
+		return x.EndedAt
+	}
+	return nil
+}
+
+type RecordInterceptionEndedResponse struct {
+	state         protoimpl.MessageState
+	sizeCache     protoimpl.SizeCache
+	unknownFields protoimpl.UnknownFields
+}
+
+func (x *RecordInterceptionEndedResponse) Reset() {
+	*x = RecordInterceptionEndedResponse{}
+	if protoimpl.UnsafeEnabled {
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3]
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		ms.StoreMessageInfo(mi)
+	}
+}
+
+func (x *RecordInterceptionEndedResponse) String() string {
+	return protoimpl.X.MessageStringOf(x)
+}
+
+func (*RecordInterceptionEndedResponse) ProtoMessage() {}
+
+func (x *RecordInterceptionEndedResponse) ProtoReflect() protoreflect.Message {
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3]
+	if protoimpl.UnsafeEnabled && x != nil {
+		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
+		if ms.LoadMessageInfo() == nil {
+			ms.StoreMessageInfo(mi)
+		}
+		return ms
+	}
+	return mi.MessageOf(x)
+}
+
+// Deprecated: Use RecordInterceptionEndedResponse.ProtoReflect.Descriptor instead.
+func (*RecordInterceptionEndedResponse) Descriptor() ([]byte, []int) {
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{3}
+}
+
 type RecordTokenUsageRequest struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -163,7 +256,7 @@ type RecordTokenUsageRequest struct {
 func (x *RecordTokenUsageRequest) Reset() {
 	*x = RecordTokenUsageRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -176,7 +269,7 @@ func (x *RecordTokenUsageRequest) String() string {
 func (*RecordTokenUsageRequest) ProtoMessage() {}
 
 func (x *RecordTokenUsageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -189,7 +282,7 @@ func (x *RecordTokenUsageRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordTokenUsageRequest.ProtoReflect.Descriptor instead.
 func (*RecordTokenUsageRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{2}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *RecordTokenUsageRequest) GetInterceptionId() string {
@@ -243,7 +336,7 @@ type RecordTokenUsageResponse struct {
 func (x *RecordTokenUsageResponse) Reset() {
 	*x = RecordTokenUsageResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -256,7 +349,7 @@ func (x *RecordTokenUsageResponse) String() string {
 func (*RecordTokenUsageResponse) ProtoMessage() {}
 
 func (x *RecordTokenUsageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -269,7 +362,7 @@ func (x *RecordTokenUsageResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordTokenUsageResponse.ProtoReflect.Descriptor instead.
 func (*RecordTokenUsageResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{3}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{5}
 }
 
 type RecordPromptUsageRequest struct {
@@ -287,7 +380,7 @@ type RecordPromptUsageRequest struct {
 func (x *RecordPromptUsageRequest) Reset() {
 	*x = RecordPromptUsageRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -300,7 +393,7 @@ func (x *RecordPromptUsageRequest) String() string {
 func (*RecordPromptUsageRequest) ProtoMessage() {}
 
 func (x *RecordPromptUsageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -313,7 +406,7 @@ func (x *RecordPromptUsageRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordPromptUsageRequest.ProtoReflect.Descriptor instead.
 func (*RecordPromptUsageRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{4}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *RecordPromptUsageRequest) GetInterceptionId() string {
@@ -360,7 +453,7 @@ type RecordPromptUsageResponse struct {
 func (x *RecordPromptUsageResponse) Reset() {
 	*x = RecordPromptUsageResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -373,7 +466,7 @@ func (x *RecordPromptUsageResponse) String() string {
 func (*RecordPromptUsageResponse) ProtoMessage() {}
 
 func (x *RecordPromptUsageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -386,7 +479,7 @@ func (x *RecordPromptUsageResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordPromptUsageResponse.ProtoReflect.Descriptor instead.
 func (*RecordPromptUsageResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{5}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{7}
 }
 
 type RecordToolUsageRequest struct {
@@ -408,7 +501,7 @@ type RecordToolUsageRequest struct {
 func (x *RecordToolUsageRequest) Reset() {
 	*x = RecordToolUsageRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -421,7 +514,7 @@ func (x *RecordToolUsageRequest) String() string {
 func (*RecordToolUsageRequest) ProtoMessage() {}
 
 func (x *RecordToolUsageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -434,7 +527,7 @@ func (x *RecordToolUsageRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordToolUsageRequest.ProtoReflect.Descriptor instead.
 func (*RecordToolUsageRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{6}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *RecordToolUsageRequest) GetInterceptionId() string {
@@ -509,7 +602,7 @@ type RecordToolUsageResponse struct {
 func (x *RecordToolUsageResponse) Reset() {
 	*x = RecordToolUsageResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -522,7 +615,7 @@ func (x *RecordToolUsageResponse) String() string {
 func (*RecordToolUsageResponse) ProtoMessage() {}
 
 func (x *RecordToolUsageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -535,7 +628,7 @@ func (x *RecordToolUsageResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordToolUsageResponse.ProtoReflect.Descriptor instead.
 func (*RecordToolUsageResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{7}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{9}
 }
 
 type GetMCPServerConfigsRequest struct {
@@ -549,7 +642,7 @@ type GetMCPServerConfigsRequest struct {
 func (x *GetMCPServerConfigsRequest) Reset() {
 	*x = GetMCPServerConfigsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -562,7 +655,7 @@ func (x *GetMCPServerConfigsRequest) String() string {
 func (*GetMCPServerConfigsRequest) ProtoMessage() {}
 
 func (x *GetMCPServerConfigsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -575,7 +668,7 @@ func (x *GetMCPServerConfigsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetMCPServerConfigsRequest.ProtoReflect.Descriptor instead.
 func (*GetMCPServerConfigsRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{8}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *GetMCPServerConfigsRequest) GetUserId() string {
@@ -597,7 +690,7 @@ type GetMCPServerConfigsResponse struct {
 func (x *GetMCPServerConfigsResponse) Reset() {
 	*x = GetMCPServerConfigsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -610,7 +703,7 @@ func (x *GetMCPServerConfigsResponse) String() string {
 func (*GetMCPServerConfigsResponse) ProtoMessage() {}
 
 func (x *GetMCPServerConfigsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -623,7 +716,7 @@ func (x *GetMCPServerConfigsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetMCPServerConfigsResponse.ProtoReflect.Descriptor instead.
 func (*GetMCPServerConfigsResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{9}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *GetMCPServerConfigsResponse) GetCoderMcpConfig() *MCPServerConfig {
@@ -654,7 +747,7 @@ type MCPServerConfig struct {
 func (x *MCPServerConfig) Reset() {
 	*x = MCPServerConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -667,7 +760,7 @@ func (x *MCPServerConfig) String() string {
 func (*MCPServerConfig) ProtoMessage() {}
 
 func (x *MCPServerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -680,7 +773,7 @@ func (x *MCPServerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MCPServerConfig.ProtoReflect.Descriptor instead.
 func (*MCPServerConfig) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{10}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *MCPServerConfig) GetId() string {
@@ -723,7 +816,7 @@ type GetMCPServerAccessTokensBatchRequest struct {
 func (x *GetMCPServerAccessTokensBatchRequest) Reset() {
 	*x = GetMCPServerAccessTokensBatchRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -736,7 +829,7 @@ func (x *GetMCPServerAccessTokensBatchRequest) String() string {
 func (*GetMCPServerAccessTokensBatchRequest) ProtoMessage() {}
 
 func (x *GetMCPServerAccessTokensBatchRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -749,7 +842,7 @@ func (x *GetMCPServerAccessTokensBatchRequest) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use GetMCPServerAccessTokensBatchRequest.ProtoReflect.Descriptor instead.
 func (*GetMCPServerAccessTokensBatchRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{11}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *GetMCPServerAccessTokensBatchRequest) GetUserId() string {
@@ -780,7 +873,7 @@ type GetMCPServerAccessTokensBatchResponse struct {
 func (x *GetMCPServerAccessTokensBatchResponse) Reset() {
 	*x = GetMCPServerAccessTokensBatchResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -793,7 +886,7 @@ func (x *GetMCPServerAccessTokensBatchResponse) String() string {
 func (*GetMCPServerAccessTokensBatchResponse) ProtoMessage() {}
 
 func (x *GetMCPServerAccessTokensBatchResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -806,7 +899,7 @@ func (x *GetMCPServerAccessTokensBatchResponse) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use GetMCPServerAccessTokensBatchResponse.ProtoReflect.Descriptor instead.
 func (*GetMCPServerAccessTokensBatchResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{12}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *GetMCPServerAccessTokensBatchResponse) GetAccessTokens() map[string]string {
@@ -834,7 +927,7 @@ type IsAuthorizedRequest struct {
 func (x *IsAuthorizedRequest) Reset() {
 	*x = IsAuthorizedRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -847,7 +940,7 @@ func (x *IsAuthorizedRequest) String() string {
 func (*IsAuthorizedRequest) ProtoMessage() {}
 
 func (x *IsAuthorizedRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -860,7 +953,7 @@ func (x *IsAuthorizedRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IsAuthorizedRequest.ProtoReflect.Descriptor instead.
 func (*IsAuthorizedRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{13}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *IsAuthorizedRequest) GetKey() string {
@@ -881,7 +974,7 @@ type IsAuthorizedResponse struct {
 func (x *IsAuthorizedResponse) Reset() {
 	*x = IsAuthorizedResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14]
+		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -894,7 +987,7 @@ func (x *IsAuthorizedResponse) String() string {
 func (*IsAuthorizedResponse) ProtoMessage() {}
 
 func (x *IsAuthorizedResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14]
+	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -907,7 +1000,7 @@ func (x *IsAuthorizedResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IsAuthorizedResponse.ProtoReflect.Descriptor instead.
 func (*IsAuthorizedResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{14}
+	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *IsAuthorizedResponse) GetOwnerId() string {
@@ -950,192 +1043,208 @@ var file_enterprise_x_aibridged_proto_aibridged_proto_rawDesc = []byte{
 	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
 	0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1c,
 	0x0a, 0x1a, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xf9, 0x02, 0x0a,
-	0x17, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49,
-	0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x70, 0x75,
-	0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b,
-	0x69, 0x6e, 0x70, 0x75, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x6f,
-	0x75, 0x74, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01,
-	0x28, 0x03, 0x52, 0x0c, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73,
-	0x12, 0x48, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72,
-	0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
-	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
-	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61,
-	0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75,
-	0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1a, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x22, 0xcb, 0x02, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50,
-	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65,
-	0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d, 0x73,
-	0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x73, 0x67, 0x49,
-	0x64, 0x12, 0x16, 0x0a, 0x06, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x06, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x12, 0x49, 0x0a, 0x08, 0x6d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74,
-	0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74,
-	0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
-	0x61, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
-	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
-	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a,
-	0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
-	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
-	0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
-	0x38, 0x01, 0x22, 0x1b, 0x0a, 0x19, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d,
-	0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22,
-	0xed, 0x03, 0x0a, 0x16, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e,
-	0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x22, 0x0a, 0x0a, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00,
-	0x52, 0x09, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x12,
-	0x0a, 0x04, 0x74, 0x6f, 0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x6f,
-	0x6f, 0x6c, 0x12, 0x14, 0x0a, 0x05, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x05, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x6a, 0x65,
-	0x63, 0x74, 0x65, 0x64, 0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x69, 0x6e, 0x6a, 0x65,
-	0x63, 0x74, 0x65, 0x64, 0x12, 0x2e, 0x0a, 0x10, 0x69, 0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74, 0x69,
-	0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01,
-	0x52, 0x0f, 0x69, 0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f,
-	0x72, 0x88, 0x01, 0x01, 0x12, 0x47, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x08, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52,
+	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x67, 0x0a, 0x1e,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e,
+	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x35,
+	0x0a, 0x08, 0x65, 0x6e, 0x64, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
+	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
+	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x07, 0x65, 0x6e,
+	0x64, 0x65, 0x64, 0x41, 0x74, 0x22, 0x21, 0x0a, 0x1f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49,
+	0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xf9, 0x02, 0x0a, 0x17, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a,
+	0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d,
+	0x73, 0x67, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x69, 0x6e, 0x70, 0x75,
+	0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x6f, 0x75, 0x74, 0x70, 0x75,
+	0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c,
+	0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x48, 0x0a, 0x08,
+	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b,
+	0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
+	0x64, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
+	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
+	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41,
+	0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x3a, 0x02, 0x38, 0x01, 0x22, 0x1a, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
+	0x22, 0xcb, 0x02, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70,
+	0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a,
+	0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64,
+	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70,
+	0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x16, 0x0a,
+	0x06, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x12, 0x49, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
+	0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
+	0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
+	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a,
+	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1b,
+	0x0a, 0x19, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73,
+	0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xed, 0x03, 0x0a, 0x16,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63,
+	0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
+	0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x22, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x73, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x6f,
+	0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x6f, 0x6f, 0x6c, 0x12, 0x14,
+	0x0a, 0x05, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x69,
+	0x6e, 0x70, 0x75, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64,
+	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64,
+	0x12, 0x2e, 0x0a, 0x10, 0x69, 0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e,
+	0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x88, 0x01, 0x01,
+	0x12, 0x47, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x08, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65,
+	0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
+	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
+	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61,
+	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x76, 0x6f, 0x63,
+	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x19, 0x0a, 0x17, 0x52,
 	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a,
-	0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28,
-	0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63,
-	0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61,
-	0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76,
-	0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f,
-	0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x69,
-	0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22,
-	0x19, 0x0a, 0x17, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61,
-	0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x35, 0x0a, 0x1a, 0x47, 0x65,
-	0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72,
-	0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49,
-	0x64, 0x22, 0xb2, 0x01, 0x0a, 0x1b, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x12, 0x40, 0x0a, 0x10, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x2e, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x52, 0x0e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e,
-	0x66, 0x69, 0x67, 0x12, 0x51, 0x0a, 0x19, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f,
-	0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73,
-	0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4d,
-	0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x16,
-	0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x63, 0x70, 0x43,
-	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x22, 0x85, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72,
-	0x6c, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x28, 0x0a, 0x10,
-	0x74, 0x6f, 0x6f, 0x6c, 0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x72, 0x65, 0x67, 0x65, 0x78,
-	0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6f, 0x6c, 0x41, 0x6c, 0x6c, 0x6f,
-	0x77, 0x52, 0x65, 0x67, 0x65, 0x78, 0x12, 0x26, 0x0a, 0x0f, 0x74, 0x6f, 0x6f, 0x6c, 0x5f, 0x64,
-	0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65, 0x67, 0x65, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0d, 0x74, 0x6f, 0x6f, 0x6c, 0x44, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x67, 0x65, 0x78, 0x22, 0x72,
-	0x0a, 0x24, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69,
-	0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12,
-	0x31, 0x0a, 0x15, 0x6d, 0x63, 0x70, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x5f, 0x69, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12,
-	0x6d, 0x63, 0x70, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x49,
-	0x64, 0x73, 0x22, 0xda, 0x02, 0x0a, 0x25, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72,
-	0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42,
-	0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x0d,
-	0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20,
-	0x03, 0x28, 0x0b, 0x32, 0x3e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d,
-	0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73,
-	0x65, 0x2e, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x52, 0x0c, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
-	0x73, 0x12, 0x50, 0x0a, 0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28,
-	0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e,
-	0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x65, 0x72, 0x72,
-	0x6f, 0x72, 0x73, 0x1a, 0x3f, 0x0a, 0x11, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x1a, 0x39, 0x0a, 0x0b, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x45, 0x6e,
-	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22,
-	0x27, 0x0a, 0x13, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x22, 0x31, 0x0a, 0x14, 0x49, 0x73, 0x41, 0x75,
-	0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x19, 0x0a, 0x08, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x07, 0x6f, 0x77, 0x6e, 0x65, 0x72, 0x49, 0x64, 0x32, 0xe4, 0x02, 0x0a, 0x08,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x65, 0x72, 0x12, 0x59, 0x0a, 0x12, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74,
-	0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49,
-	0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f,
-	0x6e, 0x73, 0x65, 0x12, 0x53, 0x0a, 0x10, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65,
-	0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x56, 0x0a, 0x11, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1f, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d,
-	0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x20,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f,
-	0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x12, 0x50, 0x0a, 0x0f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x12, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e,
-	0x73, 0x65, 0x32, 0xeb, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x75, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x5c, 0x0a, 0x13, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x12, 0x21, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x22, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70,
-	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7a, 0x0a, 0x1d, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73,
-	0x42, 0x61, 0x74, 0x63, 0x68, 0x12, 0x2b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x35, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0xb2, 0x01,
+	0x0a, 0x1b, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a,
+	0x10, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
+	0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
+	0x0e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
+	0x51, 0x0a, 0x19, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68,
+	0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03,
+	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4d, 0x43, 0x50, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x16, 0x65, 0x78, 0x74, 0x65,
+	0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x73, 0x22, 0x85, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x28, 0x0a, 0x10, 0x74, 0x6f, 0x6f, 0x6c,
+	0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x72, 0x65, 0x67, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6f, 0x6c, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x67,
+	0x65, 0x78, 0x12, 0x26, 0x0a, 0x0f, 0x74, 0x6f, 0x6f, 0x6c, 0x5f, 0x64, 0x65, 0x6e, 0x79, 0x5f,
+	0x72, 0x65, 0x67, 0x65, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x74, 0x6f, 0x6f,
+	0x6c, 0x44, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x67, 0x65, 0x78, 0x22, 0x72, 0x0a, 0x24, 0x47, 0x65,
 	0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
 	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43,
-	0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x32, 0x55, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x72, 0x12, 0x47,
-	0x0a, 0x0c, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x12, 0x1a,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
-	0x7a, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52,
-	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x2b, 0x5a, 0x29, 0x67, 0x69, 0x74, 0x68, 0x75,
-	0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65,
-	0x72, 0x2f, 0x76, 0x32, 0x2f, 0x61, 0x69, 0x62, 0x72, 0x69, 0x64, 0x67, 0x65, 0x64, 0x2f, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
+	0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x31, 0x0a, 0x15, 0x6d,
+	0x63, 0x70, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x5f, 0x69, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x6d, 0x63, 0x70, 0x53,
+	0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x49, 0x64, 0x73, 0x22, 0xda,
+	0x02, 0x0a, 0x25, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
+	0x3e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73,
+	0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
+	0x0c, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x50, 0x0a,
+	0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61,
+	0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x6f,
+	0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x1a,
+	0x3f, 0x0a, 0x11, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
+	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
+	0x1a, 0x39, 0x0a, 0x0b, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
+	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
+	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x27, 0x0a, 0x13, 0x49,
+	0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x22, 0x31, 0x0a, 0x14, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08,
+	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
+	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x49, 0x64, 0x32, 0xce, 0x03, 0x0a, 0x08, 0x52, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x65, 0x72, 0x12, 0x59, 0x0a, 0x12, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e,
+	0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72,
+	0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
+	0x68, 0x0a, 0x17, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x12, 0x25, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
+	0x74, 0x1a, 0x26, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65,
+	0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x53, 0x0a, 0x10, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1e, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e,
+	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x56,
+	0x0a, 0x11, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73,
+	0x61, 0x67, 0x65, 0x12, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f,
+	0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x50, 0x0a, 0x0f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xeb, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50,
+	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x5c, 0x0a, 0x13,
+	0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x73, 0x12, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d,
+	0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47,
+	0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
+	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7a, 0x0a, 0x1d, 0x47, 0x65,
+	0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x12, 0x2b, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63,
+	0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x55, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x72, 0x12, 0x47, 0x0a, 0x0c, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
+	0x69, 0x7a, 0x65, 0x64, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41,
+	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x1a, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f,
+	0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x2b, 0x5a,
+	0x29, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65,
+	0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x61, 0x69, 0x62, 0x72, 0x69,
+	0x64, 0x67, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x33,
 }
 
 var (
@@ -1150,68 +1259,73 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP() []byte {
 	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescData
 }
 
-var file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes = make([]protoimpl.MessageInfo, 21)
+var file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
 var file_enterprise_x_aibridged_proto_aibridged_proto_goTypes = []interface{}{
 	(*RecordInterceptionRequest)(nil),             // 0: proto.RecordInterceptionRequest
 	(*RecordInterceptionResponse)(nil),            // 1: proto.RecordInterceptionResponse
-	(*RecordTokenUsageRequest)(nil),               // 2: proto.RecordTokenUsageRequest
-	(*RecordTokenUsageResponse)(nil),              // 3: proto.RecordTokenUsageResponse
-	(*RecordPromptUsageRequest)(nil),              // 4: proto.RecordPromptUsageRequest
-	(*RecordPromptUsageResponse)(nil),             // 5: proto.RecordPromptUsageResponse
-	(*RecordToolUsageRequest)(nil),                // 6: proto.RecordToolUsageRequest
-	(*RecordToolUsageResponse)(nil),               // 7: proto.RecordToolUsageResponse
-	(*GetMCPServerConfigsRequest)(nil),            // 8: proto.GetMCPServerConfigsRequest
-	(*GetMCPServerConfigsResponse)(nil),           // 9: proto.GetMCPServerConfigsResponse
-	(*MCPServerConfig)(nil),                       // 10: proto.MCPServerConfig
-	(*GetMCPServerAccessTokensBatchRequest)(nil),  // 11: proto.GetMCPServerAccessTokensBatchRequest
-	(*GetMCPServerAccessTokensBatchResponse)(nil), // 12: proto.GetMCPServerAccessTokensBatchResponse
-	(*IsAuthorizedRequest)(nil),                   // 13: proto.IsAuthorizedRequest
-	(*IsAuthorizedResponse)(nil),                  // 14: proto.IsAuthorizedResponse
-	nil,                                           // 15: proto.RecordInterceptionRequest.MetadataEntry
-	nil,                                           // 16: proto.RecordTokenUsageRequest.MetadataEntry
-	nil,                                           // 17: proto.RecordPromptUsageRequest.MetadataEntry
-	nil,                                           // 18: proto.RecordToolUsageRequest.MetadataEntry
-	nil,                                           // 19: proto.GetMCPServerAccessTokensBatchResponse.AccessTokensEntry
-	nil,                                           // 20: proto.GetMCPServerAccessTokensBatchResponse.ErrorsEntry
-	(*timestamppb.Timestamp)(nil),                 // 21: google.protobuf.Timestamp
-	(*anypb.Any)(nil),                             // 22: google.protobuf.Any
+	(*RecordInterceptionEndedRequest)(nil),        // 2: proto.RecordInterceptionEndedRequest
+	(*RecordInterceptionEndedResponse)(nil),       // 3: proto.RecordInterceptionEndedResponse
+	(*RecordTokenUsageRequest)(nil),               // 4: proto.RecordTokenUsageRequest
+	(*RecordTokenUsageResponse)(nil),              // 5: proto.RecordTokenUsageResponse
+	(*RecordPromptUsageRequest)(nil),              // 6: proto.RecordPromptUsageRequest
+	(*RecordPromptUsageResponse)(nil),             // 7: proto.RecordPromptUsageResponse
+	(*RecordToolUsageRequest)(nil),                // 8: proto.RecordToolUsageRequest
+	(*RecordToolUsageResponse)(nil),               // 9: proto.RecordToolUsageResponse
+	(*GetMCPServerConfigsRequest)(nil),            // 10: proto.GetMCPServerConfigsRequest
+	(*GetMCPServerConfigsResponse)(nil),           // 11: proto.GetMCPServerConfigsResponse
+	(*MCPServerConfig)(nil),                       // 12: proto.MCPServerConfig
+	(*GetMCPServerAccessTokensBatchRequest)(nil),  // 13: proto.GetMCPServerAccessTokensBatchRequest
+	(*GetMCPServerAccessTokensBatchResponse)(nil), // 14: proto.GetMCPServerAccessTokensBatchResponse
+	(*IsAuthorizedRequest)(nil),                   // 15: proto.IsAuthorizedRequest
+	(*IsAuthorizedResponse)(nil),                  // 16: proto.IsAuthorizedResponse
+	nil,                                           // 17: proto.RecordInterceptionRequest.MetadataEntry
+	nil,                                           // 18: proto.RecordTokenUsageRequest.MetadataEntry
+	nil,                                           // 19: proto.RecordPromptUsageRequest.MetadataEntry
+	nil,                                           // 20: proto.RecordToolUsageRequest.MetadataEntry
+	nil,                                           // 21: proto.GetMCPServerAccessTokensBatchResponse.AccessTokensEntry
+	nil,                                           // 22: proto.GetMCPServerAccessTokensBatchResponse.ErrorsEntry
+	(*timestamppb.Timestamp)(nil),                 // 23: google.protobuf.Timestamp
+	(*anypb.Any)(nil),                             // 24: google.protobuf.Any
 }
 var file_enterprise_x_aibridged_proto_aibridged_proto_depIdxs = []int32{
-	15, // 0: proto.RecordInterceptionRequest.metadata:type_name -> proto.RecordInterceptionRequest.MetadataEntry
-	21, // 1: proto.RecordInterceptionRequest.started_at:type_name -> google.protobuf.Timestamp
-	16, // 2: proto.RecordTokenUsageRequest.metadata:type_name -> proto.RecordTokenUsageRequest.MetadataEntry
-	21, // 3: proto.RecordTokenUsageRequest.created_at:type_name -> google.protobuf.Timestamp
-	17, // 4: proto.RecordPromptUsageRequest.metadata:type_name -> proto.RecordPromptUsageRequest.MetadataEntry
-	21, // 5: proto.RecordPromptUsageRequest.created_at:type_name -> google.protobuf.Timestamp
-	18, // 6: proto.RecordToolUsageRequest.metadata:type_name -> proto.RecordToolUsageRequest.MetadataEntry
-	21, // 7: proto.RecordToolUsageRequest.created_at:type_name -> google.protobuf.Timestamp
-	10, // 8: proto.GetMCPServerConfigsResponse.coder_mcp_config:type_name -> proto.MCPServerConfig
-	10, // 9: proto.GetMCPServerConfigsResponse.external_auth_mcp_configs:type_name -> proto.MCPServerConfig
-	19, // 10: proto.GetMCPServerAccessTokensBatchResponse.access_tokens:type_name -> proto.GetMCPServerAccessTokensBatchResponse.AccessTokensEntry
-	20, // 11: proto.GetMCPServerAccessTokensBatchResponse.errors:type_name -> proto.GetMCPServerAccessTokensBatchResponse.ErrorsEntry
-	22, // 12: proto.RecordInterceptionRequest.MetadataEntry.value:type_name -> google.protobuf.Any
-	22, // 13: proto.RecordTokenUsageRequest.MetadataEntry.value:type_name -> google.protobuf.Any
-	22, // 14: proto.RecordPromptUsageRequest.MetadataEntry.value:type_name -> google.protobuf.Any
-	22, // 15: proto.RecordToolUsageRequest.MetadataEntry.value:type_name -> google.protobuf.Any
-	0,  // 16: proto.Recorder.RecordInterception:input_type -> proto.RecordInterceptionRequest
-	2,  // 17: proto.Recorder.RecordTokenUsage:input_type -> proto.RecordTokenUsageRequest
-	4,  // 18: proto.Recorder.RecordPromptUsage:input_type -> proto.RecordPromptUsageRequest
-	6,  // 19: proto.Recorder.RecordToolUsage:input_type -> proto.RecordToolUsageRequest
-	8,  // 20: proto.MCPConfigurator.GetMCPServerConfigs:input_type -> proto.GetMCPServerConfigsRequest
-	11, // 21: proto.MCPConfigurator.GetMCPServerAccessTokensBatch:input_type -> proto.GetMCPServerAccessTokensBatchRequest
-	13, // 22: proto.Authorizer.IsAuthorized:input_type -> proto.IsAuthorizedRequest
-	1,  // 23: proto.Recorder.RecordInterception:output_type -> proto.RecordInterceptionResponse
-	3,  // 24: proto.Recorder.RecordTokenUsage:output_type -> proto.RecordTokenUsageResponse
-	5,  // 25: proto.Recorder.RecordPromptUsage:output_type -> proto.RecordPromptUsageResponse
-	7,  // 26: proto.Recorder.RecordToolUsage:output_type -> proto.RecordToolUsageResponse
-	9,  // 27: proto.MCPConfigurator.GetMCPServerConfigs:output_type -> proto.GetMCPServerConfigsResponse
-	12, // 28: proto.MCPConfigurator.GetMCPServerAccessTokensBatch:output_type -> proto.GetMCPServerAccessTokensBatchResponse
-	14, // 29: proto.Authorizer.IsAuthorized:output_type -> proto.IsAuthorizedResponse
-	23, // [23:30] is the sub-list for method output_type
-	16, // [16:23] is the sub-list for method input_type
-	16, // [16:16] is the sub-list for extension type_name
-	16, // [16:16] is the sub-list for extension extendee
-	0,  // [0:16] is the sub-list for field type_name
+	17, // 0: proto.RecordInterceptionRequest.metadata:type_name -> proto.RecordInterceptionRequest.MetadataEntry
+	23, // 1: proto.RecordInterceptionRequest.started_at:type_name -> google.protobuf.Timestamp
+	23, // 2: proto.RecordInterceptionEndedRequest.ended_at:type_name -> google.protobuf.Timestamp
+	18, // 3: proto.RecordTokenUsageRequest.metadata:type_name -> proto.RecordTokenUsageRequest.MetadataEntry
+	23, // 4: proto.RecordTokenUsageRequest.created_at:type_name -> google.protobuf.Timestamp
+	19, // 5: proto.RecordPromptUsageRequest.metadata:type_name -> proto.RecordPromptUsageRequest.MetadataEntry
+	23, // 6: proto.RecordPromptUsageRequest.created_at:type_name -> google.protobuf.Timestamp
+	20, // 7: proto.RecordToolUsageRequest.metadata:type_name -> proto.RecordToolUsageRequest.MetadataEntry
+	23, // 8: proto.RecordToolUsageRequest.created_at:type_name -> google.protobuf.Timestamp
+	12, // 9: proto.GetMCPServerConfigsResponse.coder_mcp_config:type_name -> proto.MCPServerConfig
+	12, // 10: proto.GetMCPServerConfigsResponse.external_auth_mcp_configs:type_name -> proto.MCPServerConfig
+	21, // 11: proto.GetMCPServerAccessTokensBatchResponse.access_tokens:type_name -> proto.GetMCPServerAccessTokensBatchResponse.AccessTokensEntry
+	22, // 12: proto.GetMCPServerAccessTokensBatchResponse.errors:type_name -> proto.GetMCPServerAccessTokensBatchResponse.ErrorsEntry
+	24, // 13: proto.RecordInterceptionRequest.MetadataEntry.value:type_name -> google.protobuf.Any
+	24, // 14: proto.RecordTokenUsageRequest.MetadataEntry.value:type_name -> google.protobuf.Any
+	24, // 15: proto.RecordPromptUsageRequest.MetadataEntry.value:type_name -> google.protobuf.Any
+	24, // 16: proto.RecordToolUsageRequest.MetadataEntry.value:type_name -> google.protobuf.Any
+	0,  // 17: proto.Recorder.RecordInterception:input_type -> proto.RecordInterceptionRequest
+	2,  // 18: proto.Recorder.RecordInterceptionEnded:input_type -> proto.RecordInterceptionEndedRequest
+	4,  // 19: proto.Recorder.RecordTokenUsage:input_type -> proto.RecordTokenUsageRequest
+	6,  // 20: proto.Recorder.RecordPromptUsage:input_type -> proto.RecordPromptUsageRequest
+	8,  // 21: proto.Recorder.RecordToolUsage:input_type -> proto.RecordToolUsageRequest
+	10, // 22: proto.MCPConfigurator.GetMCPServerConfigs:input_type -> proto.GetMCPServerConfigsRequest
+	13, // 23: proto.MCPConfigurator.GetMCPServerAccessTokensBatch:input_type -> proto.GetMCPServerAccessTokensBatchRequest
+	15, // 24: proto.Authorizer.IsAuthorized:input_type -> proto.IsAuthorizedRequest
+	1,  // 25: proto.Recorder.RecordInterception:output_type -> proto.RecordInterceptionResponse
+	3,  // 26: proto.Recorder.RecordInterceptionEnded:output_type -> proto.RecordInterceptionEndedResponse
+	5,  // 27: proto.Recorder.RecordTokenUsage:output_type -> proto.RecordTokenUsageResponse
+	7,  // 28: proto.Recorder.RecordPromptUsage:output_type -> proto.RecordPromptUsageResponse
+	9,  // 29: proto.Recorder.RecordToolUsage:output_type -> proto.RecordToolUsageResponse
+	11, // 30: proto.MCPConfigurator.GetMCPServerConfigs:output_type -> proto.GetMCPServerConfigsResponse
+	14, // 31: proto.MCPConfigurator.GetMCPServerAccessTokensBatch:output_type -> proto.GetMCPServerAccessTokensBatchResponse
+	16, // 32: proto.Authorizer.IsAuthorized:output_type -> proto.IsAuthorizedResponse
+	25, // [25:33] is the sub-list for method output_type
+	17, // [17:25] is the sub-list for method input_type
+	17, // [17:17] is the sub-list for extension type_name
+	17, // [17:17] is the sub-list for extension extendee
+	0,  // [0:17] is the sub-list for field type_name
 }
 
 func init() { file_enterprise_x_aibridged_proto_aibridged_proto_init() }
@@ -1245,7 +1359,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordTokenUsageRequest); i {
+			switch v := v.(*RecordInterceptionEndedRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1257,7 +1371,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordTokenUsageResponse); i {
+			switch v := v.(*RecordInterceptionEndedResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1269,7 +1383,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordPromptUsageRequest); i {
+			switch v := v.(*RecordTokenUsageRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1281,7 +1395,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordPromptUsageResponse); i {
+			switch v := v.(*RecordTokenUsageResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1293,7 +1407,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordToolUsageRequest); i {
+			switch v := v.(*RecordPromptUsageRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1305,7 +1419,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*RecordToolUsageResponse); i {
+			switch v := v.(*RecordPromptUsageResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1317,7 +1431,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMCPServerConfigsRequest); i {
+			switch v := v.(*RecordToolUsageRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1329,7 +1443,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMCPServerConfigsResponse); i {
+			switch v := v.(*RecordToolUsageResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1341,7 +1455,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*MCPServerConfig); i {
+			switch v := v.(*GetMCPServerConfigsRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1353,7 +1467,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMCPServerAccessTokensBatchRequest); i {
+			switch v := v.(*GetMCPServerConfigsResponse); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1365,7 +1479,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*GetMCPServerAccessTokensBatchResponse); i {
+			switch v := v.(*MCPServerConfig); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1377,7 +1491,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
-			switch v := v.(*IsAuthorizedRequest); i {
+			switch v := v.(*GetMCPServerAccessTokensBatchRequest); i {
 			case 0:
 				return &v.state
 			case 1:
@@ -1389,6 +1503,30 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*GetMCPServerAccessTokensBatchResponse); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+			switch v := v.(*IsAuthorizedRequest); i {
+			case 0:
+				return &v.state
+			case 1:
+				return &v.sizeCache
+			case 2:
+				return &v.unknownFields
+			default:
+				return nil
+			}
+		}
+		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*IsAuthorizedResponse); i {
 			case 0:
 				return &v.state
@@ -1401,14 +1539,14 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 	}
-	file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6].OneofWrappers = []interface{}{}
+	file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
 			RawDescriptor: file_enterprise_x_aibridged_proto_aibridged_proto_rawDesc,
 			NumEnums:      0,
-			NumMessages:   21,
+			NumMessages:   23,
 			NumExtensions: 0,
 			NumServices:   3,
 		},
diff --git a/enterprise/x/aibridged/proto/aibridged.proto b/enterprise/x/aibridged/proto/aibridged.proto
index 21e09fc8152db..01ab07c8be40d 100644
--- a/enterprise/x/aibridged/proto/aibridged.proto
+++ b/enterprise/x/aibridged/proto/aibridged.proto
@@ -11,6 +11,7 @@ service Recorder {
   // RecordInterception creates a new interception record to which all other sub-resources
   // (token, prompt, tool uses) will be related.
   rpc RecordInterception(RecordInterceptionRequest) returns (RecordInterceptionResponse);
+  rpc RecordInterceptionEnded(RecordInterceptionEndedRequest) returns (RecordInterceptionEndedResponse);
   rpc RecordTokenUsage(RecordTokenUsageRequest) returns (RecordTokenUsageResponse);
   rpc RecordPromptUsage(RecordPromptUsageRequest) returns (RecordPromptUsageResponse);
   rpc RecordToolUsage(RecordToolUsageRequest) returns (RecordToolUsageResponse);
@@ -45,6 +46,13 @@ message RecordInterceptionRequest {
 
 message RecordInterceptionResponse {}
 
+message RecordInterceptionEndedRequest {
+  string id = 1; // UUID.
+  google.protobuf.Timestamp ended_at = 2;
+}
+
+message RecordInterceptionEndedResponse {}
+
 message RecordTokenUsageRequest {
   string interception_id = 1; // UUID.
   string msg_id = 2; // ID provided by provider.
diff --git a/enterprise/x/aibridged/proto/aibridged_drpc.pb.go b/enterprise/x/aibridged/proto/aibridged_drpc.pb.go
index 37c2cc71ff459..4c7cb3c190764 100644
--- a/enterprise/x/aibridged/proto/aibridged_drpc.pb.go
+++ b/enterprise/x/aibridged/proto/aibridged_drpc.pb.go
@@ -39,6 +39,7 @@ type DRPCRecorderClient interface {
 	DRPCConn() drpc.Conn
 
 	RecordInterception(ctx context.Context, in *RecordInterceptionRequest) (*RecordInterceptionResponse, error)
+	RecordInterceptionEnded(ctx context.Context, in *RecordInterceptionEndedRequest) (*RecordInterceptionEndedResponse, error)
 	RecordTokenUsage(ctx context.Context, in *RecordTokenUsageRequest) (*RecordTokenUsageResponse, error)
 	RecordPromptUsage(ctx context.Context, in *RecordPromptUsageRequest) (*RecordPromptUsageResponse, error)
 	RecordToolUsage(ctx context.Context, in *RecordToolUsageRequest) (*RecordToolUsageResponse, error)
@@ -63,6 +64,15 @@ func (c *drpcRecorderClient) RecordInterception(ctx context.Context, in *RecordI
 	return out, nil
 }
 
+func (c *drpcRecorderClient) RecordInterceptionEnded(ctx context.Context, in *RecordInterceptionEndedRequest) (*RecordInterceptionEndedResponse, error) {
+	out := new(RecordInterceptionEndedResponse)
+	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordInterceptionEnded", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	if err != nil {
+		return nil, err
+	}
+	return out, nil
+}
+
 func (c *drpcRecorderClient) RecordTokenUsage(ctx context.Context, in *RecordTokenUsageRequest) (*RecordTokenUsageResponse, error) {
 	out := new(RecordTokenUsageResponse)
 	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordTokenUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
@@ -92,6 +102,7 @@ func (c *drpcRecorderClient) RecordToolUsage(ctx context.Context, in *RecordTool
 
 type DRPCRecorderServer interface {
 	RecordInterception(context.Context, *RecordInterceptionRequest) (*RecordInterceptionResponse, error)
+	RecordInterceptionEnded(context.Context, *RecordInterceptionEndedRequest) (*RecordInterceptionEndedResponse, error)
 	RecordTokenUsage(context.Context, *RecordTokenUsageRequest) (*RecordTokenUsageResponse, error)
 	RecordPromptUsage(context.Context, *RecordPromptUsageRequest) (*RecordPromptUsageResponse, error)
 	RecordToolUsage(context.Context, *RecordToolUsageRequest) (*RecordToolUsageResponse, error)
@@ -103,6 +114,10 @@ func (s *DRPCRecorderUnimplementedServer) RecordInterception(context.Context, *R
 	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
 }
 
+func (s *DRPCRecorderUnimplementedServer) RecordInterceptionEnded(context.Context, *RecordInterceptionEndedRequest) (*RecordInterceptionEndedResponse, error) {
+	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
+}
+
 func (s *DRPCRecorderUnimplementedServer) RecordTokenUsage(context.Context, *RecordTokenUsageRequest) (*RecordTokenUsageResponse, error) {
 	return nil, drpcerr.WithCode(errors.New("Unimplemented"), drpcerr.Unimplemented)
 }
@@ -117,7 +132,7 @@ func (s *DRPCRecorderUnimplementedServer) RecordToolUsage(context.Context, *Reco
 
 type DRPCRecorderDescription struct{}
 
-func (DRPCRecorderDescription) NumMethods() int { return 4 }
+func (DRPCRecorderDescription) NumMethods() int { return 5 }
 
 func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
@@ -131,6 +146,15 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 					)
 			}, DRPCRecorderServer.RecordInterception, true
 	case 1:
+		return "/proto.Recorder/RecordInterceptionEnded", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
+				return srv.(DRPCRecorderServer).
+					RecordInterceptionEnded(
+						ctx,
+						in1.(*RecordInterceptionEndedRequest),
+					)
+			}, DRPCRecorderServer.RecordInterceptionEnded, true
+	case 2:
 		return "/proto.Recorder/RecordTokenUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
@@ -139,7 +163,7 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 						in1.(*RecordTokenUsageRequest),
 					)
 			}, DRPCRecorderServer.RecordTokenUsage, true
-	case 2:
+	case 3:
 		return "/proto.Recorder/RecordPromptUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
@@ -148,7 +172,7 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 						in1.(*RecordPromptUsageRequest),
 					)
 			}, DRPCRecorderServer.RecordPromptUsage, true
-	case 3:
+	case 4:
 		return "/proto.Recorder/RecordToolUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
@@ -182,6 +206,22 @@ func (x *drpcRecorder_RecordInterceptionStream) SendAndClose(m *RecordIntercepti
 	return x.CloseSend()
 }
 
+type DRPCRecorder_RecordInterceptionEndedStream interface {
+	drpc.Stream
+	SendAndClose(*RecordInterceptionEndedResponse) error
+}
+
+type drpcRecorder_RecordInterceptionEndedStream struct {
+	drpc.Stream
+}
+
+func (x *drpcRecorder_RecordInterceptionEndedStream) SendAndClose(m *RecordInterceptionEndedResponse) error {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+		return err
+	}
+	return x.CloseSend()
+}
+
 type DRPCRecorder_RecordTokenUsageStream interface {
 	drpc.Stream
 	SendAndClose(*RecordTokenUsageResponse) error
diff --git a/enterprise/x/aibridged/translator.go b/enterprise/x/aibridged/translator.go
index 57d574f1bfd68..bfc39d834ad2c 100644
--- a/enterprise/x/aibridged/translator.go
+++ b/enterprise/x/aibridged/translator.go
@@ -35,6 +35,14 @@ func (t *recorderTranslation) RecordInterception(ctx context.Context, req *aibri
 	return err
 }
 
+func (t *recorderTranslation) RecordInterceptionEnded(ctx context.Context, req *aibridge.InterceptionRecordEnded) error {
+	_, err := t.client.RecordInterceptionEnded(ctx, &proto.RecordInterceptionEndedRequest{
+		Id:      req.ID,
+		EndedAt: timestamppb.New(req.EndedAt),
+	})
+	return err
+}
+
 func (t *recorderTranslation) RecordPromptUsage(ctx context.Context, req *aibridge.PromptUsageRecord) error {
 	_, err := t.client.RecordPromptUsage(ctx, &proto.RecordPromptUsageRequest{
 		InterceptionId: req.InterceptionID,
diff --git a/enterprise/x/aibridgedserver/aibridgedserver.go b/enterprise/x/aibridgedserver/aibridgedserver.go
index e766e696222d7..2c5e3ff71c072 100644
--- a/enterprise/x/aibridgedserver/aibridgedserver.go
+++ b/enterprise/x/aibridgedserver/aibridgedserver.go
@@ -55,6 +55,7 @@ type store interface {
 	InsertAIBridgeTokenUsage(ctx context.Context, arg database.InsertAIBridgeTokenUsageParams) (database.AIBridgeTokenUsage, error)
 	InsertAIBridgeUserPrompt(ctx context.Context, arg database.InsertAIBridgeUserPromptParams) (database.AIBridgeUserPrompt, error)
 	InsertAIBridgeToolUsage(ctx context.Context, arg database.InsertAIBridgeToolUsageParams) (database.AIBridgeToolUsage, error)
+	UpdateAIBridgeInterceptionEnded(ctx context.Context, intcID database.UpdateAIBridgeInterceptionEndedParams) (database.AIBridgeInterception, error)
 
 	// MCPConfigurator-related queries.
 	GetExternalAuthLinksByUserID(ctx context.Context, userID uuid.UUID) ([]database.ExternalAuthLink, error)
@@ -129,6 +130,26 @@ func (s *Server) RecordInterception(ctx context.Context, in *proto.RecordInterce
 	return &proto.RecordInterceptionResponse{}, nil
 }
 
+func (s *Server) RecordInterceptionEnded(ctx context.Context, in *proto.RecordInterceptionEndedRequest) (*proto.RecordInterceptionEndedResponse, error) {
+	//nolint:gocritic // AIBridged has specific authz rules.
+	ctx = dbauthz.AsAIBridged(ctx)
+
+	intcID, err := uuid.Parse(in.GetId())
+	if err != nil {
+		return nil, xerrors.Errorf("invalid interception ID %q: %w", in.GetId(), err)
+	}
+
+	_, err = s.store.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+		ID:      intcID,
+		EndedAt: in.EndedAt.AsTime(),
+	})
+	if err != nil {
+		return nil, xerrors.Errorf("end interception: %w", err)
+	}
+
+	return &proto.RecordInterceptionEndedResponse{}, nil
+}
+
 func (s *Server) RecordTokenUsage(ctx context.Context, in *proto.RecordTokenUsageRequest) (*proto.RecordTokenUsageResponse, error) {
 	//nolint:gocritic // AIBridged has specific authz rules.
 	ctx = dbauthz.AsAIBridged(ctx)
diff --git a/enterprise/x/aibridgedserver/aibridgedserver_test.go b/enterprise/x/aibridgedserver/aibridgedserver_test.go
index fc8f8e8afd25b..4f9f892bc886a 100644
--- a/enterprise/x/aibridgedserver/aibridgedserver_test.go
+++ b/enterprise/x/aibridgedserver/aibridgedserver_test.go
@@ -423,6 +423,60 @@ func TestRecordInterception(t *testing.T) {
 	)
 }
 
+func TestRecordInterceptionEnded(t *testing.T) {
+	t.Parallel()
+
+	testRecordMethod(t,
+		func(srv *aibridgedserver.Server, ctx context.Context, req *proto.RecordInterceptionEndedRequest) (*proto.RecordInterceptionEndedResponse, error) {
+			return srv.RecordInterceptionEnded(ctx, req)
+		},
+		[]testRecordMethodCase[*proto.RecordInterceptionEndedRequest]{
+			{
+				name: "ok",
+				request: &proto.RecordInterceptionEndedRequest{
+					Id:      uuid.UUID{1}.String(),
+					EndedAt: timestamppb.Now(),
+				},
+				setupMocks: func(t *testing.T, db *dbmock.MockStore, req *proto.RecordInterceptionEndedRequest) {
+					interceptionID, err := uuid.Parse(req.GetId())
+					assert.NoError(t, err, "parse interception UUID")
+
+					db.EXPECT().UpdateAIBridgeInterceptionEnded(gomock.Any(), database.UpdateAIBridgeInterceptionEndedParams{
+						ID:      interceptionID,
+						EndedAt: req.EndedAt.AsTime(),
+					}).Return(database.AIBridgeInterception{
+						ID:          interceptionID,
+						InitiatorID: uuid.UUID{2},
+						Provider:    "prov",
+						Model:       "mod",
+						StartedAt:   time.Now(),
+						EndedAt:     sql.NullTime{Time: req.EndedAt.AsTime(), Valid: true},
+					}, nil)
+				},
+			},
+			{
+				name: "bad_uuid_error",
+				request: &proto.RecordInterceptionEndedRequest{
+					Id: "this-is-not-uuid",
+				},
+				setupMocks:  func(t *testing.T, db *dbmock.MockStore, req *proto.RecordInterceptionEndedRequest) {},
+				expectedErr: "invalid interception ID",
+			},
+			{
+				name: "database_error",
+				request: &proto.RecordInterceptionEndedRequest{
+					Id:      uuid.UUID{1}.String(),
+					EndedAt: timestamppb.Now(),
+				},
+				setupMocks: func(t *testing.T, db *dbmock.MockStore, req *proto.RecordInterceptionEndedRequest) {
+					db.EXPECT().UpdateAIBridgeInterceptionEnded(gomock.Any(), gomock.Any()).Return(database.AIBridgeInterception{}, sql.ErrConnDone)
+				},
+				expectedErr: "end interception: " + sql.ErrConnDone.Error(),
+			},
+		},
+	)
+}
+
 func TestRecordTokenUsage(t *testing.T) {
 	t.Parallel()
 
diff --git a/go.mod b/go.mod
index 07b5214d87854..3f4bf60c15ce3 100644
--- a/go.mod
+++ b/go.mod
@@ -476,7 +476,7 @@ require (
 	github.com/anthropics/anthropic-sdk-go v1.13.0
 	github.com/brianvoe/gofakeit/v7 v7.8.0
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
-	github.com/coder/aibridge v0.1.4
+	github.com/coder/aibridge v0.1.5
 	github.com/coder/aisdk-go v0.0.9
 	github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945
 	github.com/coder/preview v1.0.4
diff --git a/go.sum b/go.sum
index 66fb4220d2f43..ee37485533080 100644
--- a/go.sum
+++ b/go.sum
@@ -915,8 +915,8 @@ github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225 h1:tRIViZ5JRmzdOEo5wUWngaGEFBG8OaE1o2GIHN5ujJ8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225/go.mod h1:rNLVpYgEVeu1Zk29K64z6Od8RBP9DwqCu9OfCzh8MR4=
-github.com/coder/aibridge v0.1.4 h1:MCbrq33RCrk6v16ZbQnabfUVaCAOmJR4mPwc+UvagQs=
-github.com/coder/aibridge v0.1.4/go.mod h1:Q5MCfKMcKYmYl4qH1Zd0rltmPaUBPKFvIPs2k9q6qeY=
+github.com/coder/aibridge v0.1.5 h1:uSrltfLZWF2qOaq9RDzJW/26Ow1wMFwcwObBM0WikME=
+github.com/coder/aibridge v0.1.5/go.mod h1:Q5MCfKMcKYmYl4qH1Zd0rltmPaUBPKFvIPs2k9q6qeY=
 github.com/coder/aisdk-go v0.0.9 h1:Vzo/k2qwVGLTR10ESDeP2Ecek1SdPfZlEjtTfMveiVo=
 github.com/coder/aisdk-go v0.0.9/go.mod h1:KF6/Vkono0FJJOtWtveh5j7yfNrSctVTpwgweYWSp5M=
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3+5B+v5KdYvORs4YNfDPci0zCs+pC0=

From 90b64c5e040d7db8c78b9ce49079f51aeccc7d77 Mon Sep 17 00:00:00 2001
From: Bruno Quaresma <bruno@coder.com>
Date: Mon, 27 Oct 2025 12:47:44 -0300
Subject: [PATCH 260/298] chore: remove unecessary API.getWorkspaceParameters
 (#20462)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

I initially created `API.getWorkspaceParameters` to group two related
requests, but after revisiting the implementation, I realized this
abstraction doesn’t add much value. It also prevents us from taking full
advantage of React Query’s built-in caching and invalidation.

So instead of grouping them, I removed the helper and replaced it with
separate queries — this simplifies the flow and lets React Query handle
caching more efficiently.

Related to
https://github.com/coder/coder/pull/20431#discussion_r2457010137
---
 site/src/api/api.ts                           | 13 ---
 site/src/api/queries/templates.ts             |  8 +-
 site/src/api/queries/workspaceBuilds.ts       |  2 +-
 site/src/pages/TaskPage/TaskPage.tsx          | 10 +-
 .../BuildParametersPopover.tsx                | 20 ++--
 .../WorkspaceActions/DebugButton.stories.tsx  | 23 ++++-
 .../WorkspaceActions/RetryButton.stories.tsx  | 45 +++++----
 .../WorkspacePage/WorkspacePage.test.tsx      | 25 +++--
 .../WorkspaceParametersPage.stories.tsx       | 91 +++++++++----------
 .../WorkspaceParametersPage.tsx               | 63 +++++++------
 10 files changed, 160 insertions(+), 140 deletions(-)

diff --git a/site/src/api/api.ts b/site/src/api/api.ts
index 04bf78538a343..4c02a96fe2129 100644
--- a/site/src/api/api.ts
+++ b/site/src/api/api.ts
@@ -2385,19 +2385,6 @@ class ApiMethods {
 		return response.data;
 	};
 
-	getWorkspaceParameters = async (workspace: TypesGen.Workspace) => {
-		const latestBuild = workspace.latest_build;
-		const [templateVersionRichParameters, buildParameters] = await Promise.all([
-			this.getTemplateVersionRichParameters(latestBuild.template_version_id),
-			this.getWorkspaceBuildParameters(latestBuild.id),
-		]);
-
-		return {
-			templateVersionRichParameters,
-			buildParameters,
-		};
-	};
-
 	getInsightsUserLatency = async (
 		filters: InsightsParams,
 	): Promise<TypesGen.UserLatencyInsightsResponse> => {
diff --git a/site/src/api/queries/templates.ts b/site/src/api/queries/templates.ts
index 8c3b294f7fad8..686611cb6cd41 100644
--- a/site/src/api/queries/templates.ts
+++ b/site/src/api/queries/templates.ts
@@ -249,9 +249,15 @@ export const templateVersionLogs = (versionId: string) => {
 	};
 };
 
+export const richParametersKey = (versionId: string) => [
+	templateVersionRoot,
+	versionId,
+	"richParameters",
+];
+
 export const richParameters = (versionId: string) => {
 	return {
-		queryKey: [templateVersionRoot, versionId, "richParameters"],
+		queryKey: richParametersKey(versionId),
 		queryFn: () => API.getTemplateVersionRichParameters(versionId),
 	};
 };
diff --git a/site/src/api/queries/workspaceBuilds.ts b/site/src/api/queries/workspaceBuilds.ts
index 8f5e088b3a400..4617d988e3c8c 100644
--- a/site/src/api/queries/workspaceBuilds.ts
+++ b/site/src/api/queries/workspaceBuilds.ts
@@ -6,7 +6,7 @@ import type {
 } from "api/typesGenerated";
 import type { QueryOptions, UseInfiniteQueryOptions } from "react-query";
 
-function workspaceBuildParametersKey(workspaceBuildId: string) {
+export function workspaceBuildParametersKey(workspaceBuildId: string) {
 	return ["workspaceBuilds", workspaceBuildId, "parameters"] as const;
 }
 
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index 9724c09f5d2cd..17cdc8b6861d7 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -1,6 +1,7 @@
 import { API } from "api/api";
 import { getErrorDetail, getErrorMessage, isApiError } from "api/errors";
 import { template as templateQueryOptions } from "api/queries/templates";
+import { workspaceBuildParameters } from "api/queries/workspaceBuilds";
 import {
 	startWorkspace,
 	workspaceByOwnerAndName,
@@ -198,10 +199,9 @@ type WorkspaceNotRunningProps = {
 const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ workspace }) => {
 	const queryClient = useQueryClient();
 
-	const { data: parameters } = useQuery({
-		queryKey: ["workspace", workspace.id, "parameters"],
-		queryFn: () => API.getWorkspaceParameters(workspace),
-	});
+	const { data: buildParameters } = useQuery(
+		workspaceBuildParameters(workspace.latest_build.id),
+	);
 
 	const mutateStartWorkspace = useMutation({
 		...startWorkspace(workspace, queryClient),
@@ -237,7 +237,7 @@ const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ workspace }) => {
 							disabled={isWaitingForStart}
 							onClick={() => {
 								mutateStartWorkspace.mutate({
-									buildParameters: parameters?.buildParameters,
+									buildParameters,
 								});
 							}}
 						>
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx
index 557ea2d9be470..a39dcd949c642 100644
--- a/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/BuildParametersPopover.tsx
@@ -1,6 +1,7 @@
 import { useTheme } from "@emotion/react";
 import visuallyHidden from "@mui/utils/visuallyHidden";
-import { API } from "api/api";
+import { richParameters } from "api/queries/templates";
+import { workspaceBuildParameters } from "api/queries/workspaceBuilds";
 import type {
 	TemplateVersionParameter,
 	Workspace,
@@ -48,12 +49,15 @@ export const BuildParametersPopover: FC<BuildParametersPopoverProps> = ({
 	onSubmit,
 }) => {
 	const [isOpen, setIsOpen] = useState(false);
-	const { data: parameters } = useQuery({
-		queryKey: ["workspace", workspace.id, "parameters"],
-		queryFn: () => API.getWorkspaceParameters(workspace),
-	});
-	const ephemeralParameters = parameters
-		? parameters.templateVersionRichParameters.filter((p) => p.ephemeral)
+	const build = workspace.latest_build;
+	const { data: templateVersionParameters } = useQuery(
+		richParameters(build.template_version_id),
+	);
+	const { data: buildParameters } = useQuery(
+		workspaceBuildParameters(build.id),
+	);
+	const ephemeralParameters = templateVersionParameters
+		? templateVersionParameters.filter((p) => p.ephemeral)
 		: undefined;
 
 	return (
@@ -75,7 +79,7 @@ export const BuildParametersPopover: FC<BuildParametersPopoverProps> = ({
 				<BuildParametersPopoverContent
 					workspace={workspace}
 					ephemeralParameters={ephemeralParameters}
-					buildParameters={parameters?.buildParameters}
+					buildParameters={buildParameters}
 					onSubmit={onSubmit}
 					setIsOpen={setIsOpen}
 				/>
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/DebugButton.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/DebugButton.stories.tsx
index c611031cbe527..e7d3bc04c46f0 100644
--- a/site/src/pages/WorkspacePage/WorkspaceActions/DebugButton.stories.tsx
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/DebugButton.stories.tsx
@@ -1,5 +1,10 @@
-import { MockWorkspace } from "testHelpers/entities";
+import {
+	MockTemplateVersionParameter1,
+	MockWorkspace,
+} from "testHelpers/entities";
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { richParametersKey } from "api/queries/templates";
+import { workspaceBuildParametersKey } from "api/queries/workspaceBuilds";
 import { expect, screen, userEvent, waitFor } from "storybook/test";
 import { DebugButton } from "./DebugButton";
 
@@ -21,8 +26,12 @@ export const WithBuildParameters: Story = {
 	parameters: {
 		queries: [
 			{
-				key: ["workspace", MockWorkspace.id, "parameters"],
-				data: { templateVersionRichParameters: [], buildParameters: [] },
+				key: richParametersKey(MockWorkspace.latest_build.template_version_id),
+				data: [],
+			},
+			{
+				key: workspaceBuildParametersKey(MockWorkspace.latest_build.id),
+				data: [],
 			},
 		],
 	},
@@ -36,8 +45,12 @@ export const WithOpenBuildParameters: Story = {
 	parameters: {
 		queries: [
 			{
-				key: ["workspace", MockWorkspace.id, "parameters"],
-				data: { templateVersionRichParameters: [], buildParameters: [] },
+				key: richParametersKey(MockWorkspace.latest_build.template_version_id),
+				data: [MockTemplateVersionParameter1],
+			},
+			{
+				key: workspaceBuildParametersKey(MockWorkspace.latest_build.id),
+				data: [],
 			},
 		],
 	},
diff --git a/site/src/pages/WorkspacePage/WorkspaceActions/RetryButton.stories.tsx b/site/src/pages/WorkspacePage/WorkspaceActions/RetryButton.stories.tsx
index b369603880942..2b85ae75b1066 100644
--- a/site/src/pages/WorkspacePage/WorkspaceActions/RetryButton.stories.tsx
+++ b/site/src/pages/WorkspacePage/WorkspaceActions/RetryButton.stories.tsx
@@ -1,9 +1,12 @@
 import {
 	MockNonClassicParameterFlowWorkspace,
+	MockTemplateVersionParameter1,
 	MockTemplateVersionParameter6,
 	MockWorkspace,
 } from "testHelpers/entities";
 import type { Meta, StoryObj } from "@storybook/react-vite";
+import { richParametersKey } from "api/queries/templates";
+import { workspaceBuildParametersKey } from "api/queries/workspaceBuilds";
 import { expect, screen, userEvent, waitFor } from "storybook/test";
 import { RetryButton } from "./RetryButton";
 
@@ -25,8 +28,12 @@ export const WithBuildParameters: Story = {
 	parameters: {
 		queries: [
 			{
-				key: ["workspace", MockWorkspace.id, "parameters"],
-				data: { templateVersionRichParameters: [], buildParameters: [] },
+				key: richParametersKey(MockWorkspace.latest_build.template_version_id),
+				data: [],
+			},
+			{
+				key: workspaceBuildParametersKey(MockWorkspace.latest_build.id),
+				data: [],
 			},
 		],
 	},
@@ -40,8 +47,12 @@ export const WithOpenBuildParameters: Story = {
 	parameters: {
 		queries: [
 			{
-				key: ["workspace", MockWorkspace.id, "parameters"],
-				data: { templateVersionRichParameters: [], buildParameters: [] },
+				key: richParametersKey(MockWorkspace.latest_build.template_version_id),
+				data: [MockTemplateVersionParameter1],
+			},
+			{
+				key: workspaceBuildParametersKey(MockWorkspace.latest_build.id),
+				data: [],
 			},
 		],
 	},
@@ -63,11 +74,12 @@ export const WithOpenEphemeralBuildParameters: Story = {
 	parameters: {
 		queries: [
 			{
-				key: ["workspace", MockWorkspace.id, "parameters"],
-				data: {
-					templateVersionRichParameters: [MockTemplateVersionParameter6],
-					buildParameters: [],
-				},
+				key: richParametersKey(MockWorkspace.latest_build.template_version_id),
+				data: [MockTemplateVersionParameter6],
+			},
+			{
+				key: workspaceBuildParametersKey(MockWorkspace.latest_build.id),
+				data: [],
 			},
 		],
 	},
@@ -91,15 +103,12 @@ export const WithOpenEphemeralBuildParametersNotClassic: Story = {
 	parameters: {
 		queries: [
 			{
-				key: [
-					"workspace",
-					MockNonClassicParameterFlowWorkspace.id,
-					"parameters",
-				],
-				data: {
-					templateVersionRichParameters: [MockTemplateVersionParameter6],
-					buildParameters: [],
-				},
+				key: richParametersKey(MockWorkspace.latest_build.template_version_id),
+				data: [MockTemplateVersionParameter6],
+			},
+			{
+				key: workspaceBuildParametersKey(MockWorkspace.latest_build.id),
+				data: [],
 			},
 		],
 	},
diff --git a/site/src/pages/WorkspacePage/WorkspacePage.test.tsx b/site/src/pages/WorkspacePage/WorkspacePage.test.tsx
index c204a3bb9df6b..8551de709ff4f 100644
--- a/site/src/pages/WorkspacePage/WorkspacePage.test.tsx
+++ b/site/src/pages/WorkspacePage/WorkspacePage.test.tsx
@@ -47,7 +47,6 @@ const renderWorkspacePage = async (
 ) => {
 	jest.spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	jest.spyOn(API, "getTemplate").mockResolvedValueOnce(MockTemplate);
-	jest.spyOn(API, "getTemplateVersionRichParameters").mockResolvedValueOnce([]);
 	jest
 		.spyOn(API, "getDeploymentConfig")
 		.mockResolvedValueOnce(MockDeploymentConfig);
@@ -380,18 +379,18 @@ describe("WorkspacePage", () => {
 
 	it("restart the workspace with one time parameters when having the confirmation dialog", async () => {
 		localStorage.removeItem(`${MockUserOwner.id}_ignoredWarnings`);
-		jest.spyOn(API, "getWorkspaceParameters").mockResolvedValue({
-			templateVersionRichParameters: [
-				{
-					...MockTemplateVersionParameter1,
-					ephemeral: true,
-					name: "rebuild",
-					description: "Rebuild",
-					required: false,
-				},
-			],
-			buildParameters: [{ name: "rebuild", value: "false" }],
-		});
+		jest.spyOn(API, "getTemplateVersionRichParameters").mockResolvedValue([
+			{
+				...MockTemplateVersionParameter1,
+				ephemeral: true,
+				name: "rebuild",
+				description: "Rebuild",
+				required: false,
+			},
+		]);
+		jest
+			.spyOn(API, "getWorkspaceBuildParameters")
+			.mockResolvedValue([{ name: "rebuild", value: "false" }]);
 		const restartWorkspaceSpy = jest.spyOn(API, "restartWorkspace");
 		const user = userEvent.setup();
 		await renderWorkspacePage(MockWorkspace);
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx
index 16fa4819763af..cbeee6be232aa 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.stories.tsx
@@ -21,22 +21,19 @@ const meta: Meta<typeof WorkspaceParametersPageView> = {
 		workspace: MockWorkspace,
 		canChangeVersions: true,
 		onCancel: action("onCancel"),
-
-		data: {
-			buildParameters: [
-				MockWorkspaceBuildParameter1,
-				MockWorkspaceBuildParameter2,
-				MockWorkspaceBuildParameter3,
-			],
-			templateVersionRichParameters: [
-				MockTemplateVersionParameter1,
-				MockTemplateVersionParameter2,
-				{
-					...MockTemplateVersionParameter3,
-					mutable: false,
-				},
-			],
-		},
+		buildParameters: [
+			MockWorkspaceBuildParameter1,
+			MockWorkspaceBuildParameter2,
+			MockWorkspaceBuildParameter3,
+		],
+		templateVersionParameters: [
+			MockTemplateVersionParameter1,
+			MockTemplateVersionParameter2,
+			{
+				...MockTemplateVersionParameter3,
+				mutable: false,
+			},
+		],
 	},
 };
 
@@ -47,10 +44,8 @@ const Example: Story = {};
 
 export const Empty: Story = {
 	args: {
-		data: {
-			buildParameters: [],
-			templateVersionRichParameters: [],
-		},
+		buildParameters: [],
+		templateVersionParameters: [],
 	},
 };
 
@@ -58,21 +53,19 @@ export const RequireActiveVersionNoChangeVersion: Story = {
 	args: {
 		workspace: MockOutdatedStoppedWorkspaceRequireActiveVersion,
 		canChangeVersions: false,
-		data: {
-			buildParameters: [
-				MockWorkspaceBuildParameter1,
-				MockWorkspaceBuildParameter2,
-				MockWorkspaceBuildParameter3,
-			],
-			templateVersionRichParameters: [
-				MockTemplateVersionParameter1,
-				MockTemplateVersionParameter2,
-				{
-					...MockTemplateVersionParameter3,
-					mutable: false,
-				},
-			],
-		},
+		buildParameters: [
+			MockWorkspaceBuildParameter1,
+			MockWorkspaceBuildParameter2,
+			MockWorkspaceBuildParameter3,
+		],
+		templateVersionParameters: [
+			MockTemplateVersionParameter1,
+			MockTemplateVersionParameter2,
+			{
+				...MockTemplateVersionParameter3,
+				mutable: false,
+			},
+		],
 	},
 };
 
@@ -80,21 +73,19 @@ export const RequireActiveVersionCanChangeVersion: Story = {
 	args: {
 		workspace: MockOutdatedStoppedWorkspaceRequireActiveVersion,
 		canChangeVersions: true,
-		data: {
-			buildParameters: [
-				MockWorkspaceBuildParameter1,
-				MockWorkspaceBuildParameter2,
-				MockWorkspaceBuildParameter3,
-			],
-			templateVersionRichParameters: [
-				MockTemplateVersionParameter1,
-				MockTemplateVersionParameter2,
-				{
-					...MockTemplateVersionParameter3,
-					mutable: false,
-				},
-			],
-		},
+		buildParameters: [
+			MockWorkspaceBuildParameter1,
+			MockWorkspaceBuildParameter2,
+			MockWorkspaceBuildParameter3,
+		],
+		templateVersionParameters: [
+			MockTemplateVersionParameter1,
+			MockTemplateVersionParameter2,
+			{
+				...MockTemplateVersionParameter3,
+				mutable: false,
+			},
+		],
 	},
 };
 
diff --git a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx
index cdf1412dafe99..db67b52429fa1 100644
--- a/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx
+++ b/site/src/pages/WorkspaceSettingsPage/WorkspaceParametersPage/WorkspaceParametersPage.tsx
@@ -1,7 +1,13 @@
 import { API } from "api/api";
 import { isApiValidationError } from "api/errors";
 import { checkAuthorization } from "api/queries/authCheck";
-import type { Workspace, WorkspaceBuildParameter } from "api/typesGenerated";
+import { richParameters } from "api/queries/templates";
+import { workspaceBuildParameters } from "api/queries/workspaceBuilds";
+import type {
+	TemplateVersionParameter,
+	Workspace,
+	WorkspaceBuildParameter,
+} from "api/typesGenerated";
 import { ErrorAlert } from "components/Alert/ErrorAlert";
 import { Button } from "components/Button/Button";
 import { EmptyState } from "components/EmptyState/EmptyState";
@@ -24,10 +30,13 @@ import {
 
 const WorkspaceParametersPage: FC = () => {
 	const workspace = useWorkspaceSettings();
-	const parameters = useQuery({
-		queryKey: ["workspace", workspace.id, "parameters"],
-		queryFn: () => API.getWorkspaceParameters(workspace),
-	});
+	const build = workspace.latest_build;
+	const { data: templateVersionParameters } = useQuery(
+		richParameters(build.template_version_id),
+	);
+	const { data: buildParameters } = useQuery(
+		workspaceBuildParameters(build.id),
+	);
 	const navigate = useNavigate();
 	const updateParameters = useMutation({
 		mutationFn: (buildParameters: WorkspaceBuildParameter[]) =>
@@ -75,30 +84,30 @@ const WorkspaceParametersPage: FC = () => {
 
 			<WorkspaceParametersPageView
 				workspace={workspace}
+				templateVersionParameters={templateVersionParameters}
+				buildParameters={buildParameters}
 				canChangeVersions={canChangeVersions}
 				templatePermissions={templatePermissions}
-				data={parameters.data}
 				submitError={updateParameters.error}
 				isSubmitting={updateParameters.isPending}
 				onSubmit={(values) => {
-					if (!parameters.data) {
+					if (!templateVersionParameters) {
 						return;
 					}
 					// When updating the parameters, the API does not accept immutable
 					// values so we need to filter them
-					const onlyMultableValues =
-						parameters.data.templateVersionRichParameters
-							.filter((p) => p.mutable)
-							.map((p) => {
-								const value = values.rich_parameter_values.find(
-									(v) => v.name === p.name,
-								);
-								if (!value) {
-									throw new Error(`Missing value for parameter ${p.name}`);
-								}
-								return value;
-							});
-					updateParameters.mutate(onlyMultableValues);
+					const onlyMutableValues = templateVersionParameters
+						.filter((p) => p.mutable)
+						.map((p) => {
+							const value = values.rich_parameter_values.find(
+								(v) => v.name === p.name,
+							);
+							if (!value) {
+								throw new Error(`Missing value for parameter ${p.name}`);
+							}
+							return value;
+						});
+					updateParameters.mutate(onlyMutableValues);
 				}}
 				onCancel={() => {
 					navigate("../..");
@@ -112,7 +121,8 @@ type WorkspaceParametersPageViewProps = {
 	workspace: Workspace;
 	canChangeVersions: boolean;
 	templatePermissions: { canUpdateTemplate: boolean } | undefined;
-	data: Awaited<ReturnType<typeof API.getWorkspaceParameters>> | undefined;
+	templateVersionParameters?: TemplateVersionParameter[];
+	buildParameters?: WorkspaceBuildParameter[];
 	submitError: unknown;
 	isSubmitting: boolean;
 	onSubmit: (formValues: WorkspaceParametersFormValues) => void;
@@ -125,7 +135,8 @@ export const WorkspaceParametersPageView: FC<
 	workspace,
 	canChangeVersions,
 	templatePermissions,
-	data,
+	templateVersionParameters,
+	buildParameters,
 	submitError,
 	onSubmit,
 	isSubmitting,
@@ -143,17 +154,17 @@ export const WorkspaceParametersPageView: FC<
 				<ErrorAlert error={submitError} css={{ marginBottom: 48 }} />
 			) : null}
 
-			{data ? (
-				data.templateVersionRichParameters.length > 0 ? (
+			{templateVersionParameters && buildParameters ? (
+				templateVersionParameters.length > 0 ? (
 					<WorkspaceParametersForm
 						workspace={workspace}
 						canChangeVersions={canChangeVersions}
 						templatePermissions={templatePermissions}
-						autofillParams={data.buildParameters.map((p) => ({
+						autofillParams={buildParameters.map((p) => ({
 							...p,
 							source: "active_build",
 						}))}
-						templateVersionRichParameters={data.templateVersionRichParameters}
+						templateVersionRichParameters={templateVersionParameters}
 						error={submitError}
 						isSubmitting={isSubmitting}
 						onSubmit={onSubmit}

From d9c40d61c20c9a549d7865e2cf6e98942bb81477 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Mon, 27 Oct 2025 10:01:30 -0600
Subject: [PATCH 261/298] refactor: clean up policy.rego (#20366)

---
 coderd/rbac/POLICY.md   | 104 ++++++++
 coderd/rbac/README.md   |  20 +-
 coderd/rbac/policy.rego | 521 ++++++++++++++++++++--------------------
 3 files changed, 377 insertions(+), 268 deletions(-)
 create mode 100644 coderd/rbac/POLICY.md

diff --git a/coderd/rbac/POLICY.md b/coderd/rbac/POLICY.md
new file mode 100644
index 0000000000000..b3ebdfe9d939f
--- /dev/null
+++ b/coderd/rbac/POLICY.md
@@ -0,0 +1,104 @@
+# Rego authorization policy
+
+## Code style
+
+It's a good idea to consult the [Rego style guide](https://docs.styra.com/opa/rego-style-guide). The "Variables and Data Types" section in particular has some helpful and non-obvious advice in it.
+
+## Debugging
+
+Open Policy Agent provides a CLI and a playground that can be used for evaluating, formatting, testing, and linting policies.
+
+### CLI
+
+Below are some helpful commands you can use for debugging.
+
+For full evaluation, run:
+
+```sh
+opa eval --format=pretty 'data.authz.allow' -d policy.rego  -i input.json
+```
+
+For partial evaluation, run:
+
+```sh
+opa eval --partial --format=pretty 'data.authz.allow' -d policy.rego \
+	--unknowns input.object.owner --unknowns input.object.org_owner \
+	--unknowns input.object.acl_user_list --unknowns input.object.acl_group_list \
+	-i input.json
+```
+
+### Playground
+
+Use the [Open Policy Agent Playground](https://play.openpolicyagent.org/) while editing to getting linting, code formatting, and help debugging!
+
+You can use the contents of input.json as a starting point for your own testing input. Paste the contents of policy.rego into the left-hand side of the playground, and the contents of input.json into the "Input" section. Click "Evaluate" and you should see something like the following in the output.
+
+```json
+{
+	"allow": true,
+	"check_scope_allow_list": true,
+	"org": 0,
+	"org_member": 0,
+	"org_memberships": [],
+	"permission_allow": true,
+	"role_allow": true,
+	"scope_allow": true,
+	"scope_org": 0,
+	"scope_org_member": 0,
+	"scope_site": 1,
+	"scope_user": 0,
+	"site": 1,
+	"user": 0
+}
+```
+
+## Levels
+
+Permissions are evaluated at four levels: site, user, org, org_member.
+
+For each level, two checks are performed:
+- Do the subject's permissions allow them to perform this action?
+- Does the subject's scope allow them to perform this action?
+
+Each of these checks gets a "vote", which must one of three values:
+- -1 to deny (usually because of a negative permission)
+-  0 to abstain (no matching permission)
+-  1 to allow
+
+If a level abstains, then the decision gets deferred to the next level. When
+there is no "next" level to defer to it is equivalent to being denied.
+
+### Scope
+Additionally, each input has a "scope" that can be thought of as a second set of permissions, where each permission belongs to one of the four levels–exactly the same as role permissions. An action is only allowed if it is allowed by both the subject's permissions _and_ their current scope. This is to allow issuing tokens for a subject that have a subset of the full subjects permissions.
+
+For example, you may have a scope like...
+
+```json
+{
+  "by_org_id": {
+    "<org_id>": {
+      "member": [{ "resource_type": "workspace", "action": "*" }]
+    }
+  }
+}
+```
+
+...to limit the token to only accessing workspaces owned by the user within a specific org. This provides some assurances for an admin user, that the token can only access intended resources, rather than having full access to everything.
+
+The final policy decision is determined by evaluating each of these checks in their proper precedence order from the `allow` rule.
+
+## Unknown values
+
+This policy is specifically constructed to compress to a set of queries if 'input.object.owner' and 'input.object.org_owner' are unknown. There is no specific set of rules that will guarantee that this policy has this property, however, there are some tricks. We have tests that enforce this property, so any changes that pass the tests will be okay.
+
+Some general rules to follow:
+
+1. Do not use unknown values in any [comprehensions](https://www.openpolicyagent.org/docs/latest/policy-language/#comprehensions) or iterations.
+
+2. Use the unknown values as minimally as possible.
+
+3. Avoid making code branches based on the value of the unknown field.
+
+Unknown values are like a "set" of possible values (which is why rule 1 usually breaks things).
+
+For example, in the org level rules, we calculate the "vote" for all orgs, rather than just the `input.object.org_owner`. This way, if the `org_owner` changes, then we don't need to recompute any votes; we already have it for the changed value. This means we don't need branching, because the end result is just a lookup table.
diff --git a/coderd/rbac/README.md b/coderd/rbac/README.md
index d7aa89d6dee79..418e63fc261da 100644
--- a/coderd/rbac/README.md
+++ b/coderd/rbac/README.md
@@ -91,15 +91,17 @@ The use case for specifying this type of permission in a role is limited, and do
 Example of a scope for a workspace agent token, using an `allow_list` containing a single resource id.
 
 ```javascript
-    "scope": {
-      "name": "workspace_agent",
-      "display_name": "Workspace_Agent",
-      // The ID of the given workspace the agent token correlates to.
-      "allow_list": ["10d03e62-7703-4df5-a358-4f76577d4e2f"],
-      "site": [/* ... perms ... */],
-      "org": {/* ... perms ... */},
-      "user": [/* ... perms ... */]
-    }
+{
+	"scope": {
+		"name": "workspace_agent",
+		"display_name": "Workspace_Agent",
+		// The ID of the given workspace the agent token correlates to.
+		"allow_list": ["10d03e62-7703-4df5-a358-4f76577d4e2f"],
+		"site": [/* ... perms ... */],
+		"org": {/* ... perms ... */},
+		"user": [/* ... perms ... */]
+	}
+}
 ```
 
 ## OPA (Open Policy Agent)
diff --git a/coderd/rbac/policy.rego b/coderd/rbac/policy.rego
index 0d11ea4cea6f0..d6ab8b371bab4 100644
--- a/coderd/rbac/policy.rego
+++ b/coderd/rbac/policy.rego
@@ -2,213 +2,150 @@ package authz
 
 import rego.v1
 
-# A great playground: https://play.openpolicyagent.org/
-# Helpful cli commands to debug.
-# opa eval --format=pretty 'data.authz.allow' -d policy.rego  -i input.json
-# opa eval --partial --format=pretty 'data.authz.allow' -d policy.rego --unknowns input.object.owner --unknowns input.object.org_owner --unknowns input.object.acl_user_list --unknowns input.object.acl_group_list -i input.json
-
+# Check the POLICY.md file before editing this!
 #
-# This policy is specifically constructed to compress to a set of queries if the
-# object's 'owner' and 'org_owner' fields are unknown. There is no specific set
-# of rules that will guarantee that this policy has this property. However, there
-# are some tricks. A unit test will enforce this property, so any edits that pass
-# the unit test will be ok.
+# https://play.openpolicyagent.org/
 #
-# Tricks: (It's hard to really explain this, fiddling is required)
-# 1. Do not use unknown fields in any comprehension or iteration.
-# 2. Use the unknown fields as minimally as possible.
-# 3. Avoid making code branches based on the value of the unknown field.
-#    Unknown values are like a "set" of possible values.
-#    (This is why rule 1 usually breaks things)
-#    For example:
-#    In the org section, we calculate the 'allow' number for all orgs, rather
-#    than just the input.object.org_owner. This is because if the org_owner
-#    changes, then we don't need to recompute any 'allow' sets. We already have
-#    the 'allow' for the changed value. So the answer is in a lookup table.
-#    The final statement 'num := allow[input.object.org_owner]' does not have
-#    different code branches based on the org_owner. 'num's value does, but
-#    that is the whole point of partial evaluation.
-
-# bool_flip(b) returns the logical negation of a boolean value 'b'.
-# You cannot do 'x := !false', but you can do 'x := bool_flip(false)'
-bool_flip(b) := false if {
-	b
-}
-
-bool_flip(b) := true if {
-	not b
-}
-
-# number(set) maps a set of boolean values to one of the following numbers:
-#  -1: deny (if 'false' value is in the set)		=> set is {true, false} or {false}
-#   0: no decision (if the set is empty)			=> set is {}
-#   1: allow (if only 'true' values are in the set)	=> set is {true}
 
-# Return -1 if the set contains any 'false' value (i.e., an explicit deny)
-number(set) := -1 if {
-	false in set
-}
+#==============================================================================#
+# Site level rules                                                             #
+#==============================================================================#
 
-# Return 0 if the set is empty (no matching permissions)
-number(set) := 0 if {
-	count(set) == 0
-}
+# Site level permissions allow the subject to use that permission on any object.
+# For example, a site-level workspace.read permission means that the subject can
+# see every workspace in the deployment, regardless of organization or owner.
 
-# Return 1 if the set is non-empty and contains no 'false' values (i.e., only allows)
-number(set) := 1 if {
-	not false in set
-	set[_]
-}
+default site := 0
 
-# Permission evaluation is structured into three levels: site, org, and user.
-# For each level, two variables are computed:
-#   - <level>: the decision based on the subject's full set of roles for that level
-#   - scope_<level>: the decision based on the subject's scoped roles for that level
-#
-# Each of these variables is assigned one of three values:
-#   -1 => negative (deny)
-#    0 => abstain (no matching permission)
-#    1 => positive (allow)
-#
-# These values are computed by calling the corresponding <level>_allow functions.
-# The final decision is derived from combining these values (see 'allow' rule).
+site := check_site_permissions(input.subject.roles)
 
-# -------------------
-# Site Level Rules
-# -------------------
+default scope_site := 0
 
-default site := 0
-site := site_allow(input.subject.roles)
+scope_site := check_site_permissions([input.subject.scope])
 
-default scope_site := 0
-scope_site := site_allow([input.subject.scope])
-
-# site_allow receives a list of roles and returns a single number:
-#  -1 if any matching permission denies access
-#   1 if there's at least one allow and no denies
-#   0 if there are no matching permissions
-site_allow(roles) := num if {
-	# allow is a set of boolean values (sets don't contain duplicates)
+check_site_permissions(roles) := vote if {
 	allow := {is_allowed |
-		# Iterate over all site permissions in all roles
+		# Iterate over all site permissions in all roles, and check which ones match
+		# the action and object type.
 		perm := roles[_].site[_]
 		perm.action in [input.action, "*"]
 		perm.resource_type in [input.object.type, "*"]
 
-		# is_allowed is either 'true' or 'false' if a matching permission exists.
+		# If a negative matching permission was found, then we vote to disallow it.
+		# If the permission is not negative, then we vote to allow it.
 		is_allowed := bool_flip(perm.negate)
 	}
-	num := number(allow)
+	vote := to_vote(allow)
 }
 
-# -------------------
-# Org Level Rules
-# -------------------
-
-# org_members is the list of organizations the actor is apart of.
-# TODO: Should there be an org_members for the scope too? Without it,
-#  the membership is determined by the user's roles, not their scope permissions.
-#  So if an owner (who is not an org member) has an org scope, that org scope
-#  will fail to return '1'. Since we assume all non members return '-1' for org
-#  level permissions.
-#  Adding a second org_members set might affect the partial evaluation.
-#  This is being left until org scopes are used.
-org_members := {orgID |
-	input.subject.roles[_].by_org_id[orgID]
+#==============================================================================#
+# Org level rules                                                              #
+#==============================================================================#
+
+# Org level permissions are similar to `site`, except we need to iterate over
+# each organization that the subject is a member of, and check against the
+# organization that the object belongs to.
+# For example, an organization-level workspace.read permission means that the
+# subject can see every workspace in the organization, regardless of owner.
+
+# org_memberships is the set of organizations the subject is apart of.
+org_memberships := {org_id |
+	input.subject.roles[_].by_org_id[org_id]
 }
 
-# 'org' is the same as 'site' except we need to iterate over each organization
-# that the actor is a member of.
+# TODO: Should there be a scope_org_memberships too? Without it, the membership
+# is determined by the user's roles, not their scope permissions.
+#
+# If an owner (who is not an org member) has an org scope, that org scope will
+# fail to return '1', since we assume all non-members return '-1' for org level
+# permissions. Adding a second set of org memberships might affect the partial
+# evaluation. This is being left until org scopes are used.
+
 default org := 0
-org := org_allow(input.subject.roles, "org")
+
+org := check_org_permissions(input.subject.roles, "org")
 
 default scope_org := 0
-scope_org := org_allow([input.subject.scope], "org")
-
-# org_allow_set is a helper function that iterates over all orgs that the actor
-# is a member of. For each organization it sets the numerical allow value
-# for the given object + action if the object is in the organization.
-# The resulting value is a map that looks something like:
-# {"10d03e62-7703-4df5-a358-4f76577d4e2f": 1, "5750d635-82e0-4681-bd44-815b18669d65": 1}
-# The caller can use this output[<object.org_owner>] to get the final allow value.
+
+scope_org := check_org_permissions([input.subject.scope], "org")
+
+# check_all_org_permissions creates a map from org ids to votes at each org
+# level, for each org that the subject is a member of. It doesn't actually check
+# if the object is in the same org. Instead we look up the correct vote from
+# this map based on the object's org id in `check_org_permissions`.
+# For example, the `org_map` will look something like this:
+#
+#   {"<org_id_a>": 1, "<org_id_b>": 0, "<org_id_c>": -1}
+#
+# The caller then uses `output[input.object.org_owner]` to get the correct vote.
 #
-# The reason we calculate this for all orgs, and not just the input.object.org_owner
-# is that sometimes the input.object.org_owner is unknown. In those cases
-# we have a list of org_ids that can we use in a SQL 'WHERE' clause.
-org_allow_set(roles, key) := allow_set if {
-	allow_set := {id: num |
-		id := org_members[_]
-		set := {is_allowed |
-			# Iterate over all org permissions in all roles
-			perm := roles[_].by_org_id[id][key][_]
-			perm.action in [input.action, "*"]
-			perm.resource_type in [input.object.type, "*"]
-
-			# is_allowed is either 'true' or 'false' if a matching permission exists.
-			is_allowed := bool_flip(perm.negate)
-		}
-		num := number(set)
+# We have to create this map, rather than just getting the vote of the object's
+# org id because the org id _might_ be unknown. In order to make sure that this
+# policy compresses down to simple queries we need to keep unknown values out of
+# comprehensions.
+check_all_org_permissions(roles, key) := {org_id: vote |
+	org_id := org_memberships[_]
+	allow := {is_allowed |
+		# Iterate over all site permissions in all roles, and check which ones match
+		# the action and object type.
+		perm := roles[_].by_org_id[org_id][key][_]
+		perm.action in [input.action, "*"]
+		perm.resource_type in [input.object.type, "*"]
+
+		# If a negative matching permission was found, then we vote to disallow it.
+		# If the permission is not negative, then we vote to allow it.
+		is_allowed := bool_flip(perm.negate)
 	}
+	vote := to_vote(allow)
 }
 
-org_allow(roles, key) := num if {
-	# If the object has "any_org" set to true, then use the other
-	# org_allow block.
+# This check handles the case where the org id is known.
+check_org_permissions(roles, key) := vote if {
+	# Disallow setting any_org at the same time as an org id.
 	not input.object.any_org
-	allow := org_allow_set(roles, key)
-
-	# Return only the org value of the input's org.
-	# The reason why we do not do this up front, is that we need to make sure
-	# this policy compresses down to simple queries. One way to ensure this is
-	# to keep unknown values out of comprehensions.
-	# (https://www.openpolicyagent.org/docs/latest/policy-language/#comprehensions)
-	num := allow[input.object.org_owner]
+
+	allow_map := check_all_org_permissions(roles, key)
+
+	# Return only the vote of the object's org.
+	vote := allow_map[input.object.org_owner]
 }
 
-# This block states if "object.any_org" is set to true, then disregard the
-# organization id the object is associated with. Instead, we check if the user
-# can do the action on any organization.
-# This is useful for UI elements when we want to conclude, "Can the user create
-# a new template in any organization?"
-# It is easier than iterating over every organization the user is apart of.
-org_allow(roles, key) := num if {
-	input.object.any_org # if this is false, this code block is not used
-	allow := org_allow_set(roles, key)
-
-	# allow is a map of {"<org_id>": <number>}. We only care about values
-	# that are 1, and ignore the rest.
-	num := number([
-	keep |
-		# for every value in the mapping
-		value := allow[_]
-
-		# only keep values > 0.
-		# 1 = allow, 0 = abstain, -1 = deny
-		# We only need 1 explicit allow to allow the action.
-		# deny's and abstains are intentionally ignored.
-		value > 0
-
-		# result set is a set of [true,false,...]
-		# which "number()" will convert to a number.
-		keep := true
-	])
+# This check handles the case where we want to know if the user has the
+# appropriate permission for any organization, without needing to know which.
+# This is used in several places in the UI to determine if certain parts of the
+# app should be accessible.
+# For example, can the user create a new template in any organization? If yes,
+# then we should show the "New template" button.
+check_org_permissions(roles, key) := vote if {
+	# Require `any_org` to be set
+	input.object.any_org
+
+	allow_map := check_all_org_permissions(roles, key)
+
+	# Since we're checking if the subject has the permission in _any_ org, we're
+	# essentially trying to find the highest vote from any org.
+	vote := max({vote |
+		some vote in allow_map
+	})
 }
 
-# 'org_mem' is set to true if the user is an org member
-# If 'any_org' is set to true, use the other block to determine org membership.
-org_mem if {
+# is_org_member checks if the subject belong to the same organization as the
+# object.
+is_org_member if {
 	not input.object.any_org
 	input.object.org_owner != ""
-	input.object.org_owner in org_members
+	input.object.org_owner in org_memberships
 }
 
-org_mem if {
+# ...if 'any_org' is set to true, we check if the subject is a member of any
+# org.
+is_org_member if {
 	input.object.any_org
-	count(org_members) > 0
+	count(org_memberships) > 0
 }
 
 org_ok if {
-	org_mem
+	is_org_member
 }
 
 # If the object has no organization, then the user is also considered part of
@@ -218,82 +155,63 @@ org_ok if {
 	not input.object.any_org
 }
 
-# -------------------
-# User Level Rules
-# -------------------
+#==============================================================================#
+# User level rules                                                             #
+#==============================================================================#
+
+# User level rules apply to all objects owned by the subject which are not also
+# owned by an org. Permissions for objects which are "jointly" owned by an org
+# instead defer to the org member level rules.
 
-# 'user' is the same as 'site', except it only applies if the user owns the object and
-# the user is apart of the org (if the object has an org).
 default user := 0
-user := user_allow(input.subject.roles)
+
+user := check_user_permissions(input.subject.roles)
 
 default scope_user := 0
-scope_user := user_allow([input.subject.scope])
 
-user_allow(roles) := num if {
-	input.object.owner != ""
-	input.subject.id = input.object.owner
+scope_user := check_user_permissions([input.subject.scope])
+
+check_user_permissions(roles) := vote if {
+	# The object must be owned by the subject.
+	input.subject.id == input.object.owner
 
 	allow := {is_allowed |
-		# Iterate over all user permissions in all roles
+		# Iterate over all user permissions in all roles, and check which ones match
+		# the action and object type.
 		perm := roles[_].user[_]
 		perm.action in [input.action, "*"]
 		perm.resource_type in [input.object.type, "*"]
 
-		# is_allowed is either 'true' or 'false' if a matching permission exists.
+		# If a negative matching permission was found, then we vote to disallow it.
+		# If the permission is not negative, then we vote to allow it.
 		is_allowed := bool_flip(perm.negate)
 	}
-	num := number(allow)
-}
-
-# Scope allow_list is a list of resource (Type, ID) tuples explicitly allowed by the scope.
-# If the list contains `(*,*)`, then all resources are allowed.
-scope_allow_list if {
-	input.subject.scope.allow_list[_] == {"type": "*", "id": "*"}
-}
-
-# This is a shortcut if the allow_list contains (type, *), then allow all IDs of that type.
-scope_allow_list if {
-	input.subject.scope.allow_list[_] == {"type": input.object.type, "id": "*"}
+	vote := to_vote(allow)
 }
 
-# A comprehension that iterates over the allow_list and checks if the
-# (object.type, object.id) is in the allowed ids.
-scope_allow_list if {
-	# If the wildcard is listed in the allow_list, we do not care about the
-	# object.id. This line is included to prevent partial compilations from
-	# ever needing to include the object.id.
-	not {"type": "*", "id": "*"} in input.subject.scope.allow_list
-	# This is equivalent to the above line, as `type` is known at partial query time.
-	not {"type": input.object.type, "id": "*"} in input.subject.scope.allow_list
-
-	# allows_ids is the set of all ids allowed for the given object.type
-	allowed_ids := {allowed_id |
-  		# Iterate over all allow list elements
-  		ele := input.subject.scope.allow_list[_]
-  		ele.type in [input.object.type, "*"]
-      allowed_id := ele.id
-  }
-
-  # Return if the object.id is in the allowed ids
-  # This rule is evaluated at the end so the partial query can use the object.id
-  # against this precomputed set of allowed ids.
-  input.object.id in allowed_ids
-}
+#==============================================================================#
+# Role rules                                                                   #
+#==============================================================================#
 
-# -------------------
-# Role-Specific Rules
-# -------------------
+# role_allow specifies all of the conditions under which a role can grant
+# permission. These rules intentionally use the "unification" operator rather
+# than the equality and inequality operators, because those operators do not
+# work on partial values.
+# https://www.openpolicyagent.org/docs/policy-language#unification-
 
+# Site level authorization
 role_allow if {
 	site = 1
 }
 
+# Org level authorization
 role_allow if {
 	not site = -1
+
 	org = 1
 }
 
+# User level authorization
 role_allow if {
 	not site = -1
 	not org = -1
@@ -301,93 +219,178 @@ role_allow if {
 	# If we are not a member of an org, and the object has an org, then we are
 	# not authorized. This is an "implied -1" for not being in the org.
 	org_ok
+
 	user = 1
 }
 
-# -------------------
-# Scope-Specific Rules
-# -------------------
+#==============================================================================#
+# Scope rules                                                                  #
+#==============================================================================#
 
+# scope_allow specifies all of the conditions under which a scope can grant
+# permission. These rules intentionally use the "unification" (=) operator
+# rather than the equality (==) and inequality (!=) operators, because those
+# operators do not work on partial values.
+# https://www.openpolicyagent.org/docs/policy-language#unification-
+
+# Site level scope enforcement
 scope_allow if {
-	scope_allow_list
+	object_is_included_in_scope_allow_list
 	scope_site = 1
 }
 
+# Org level scope enforcement
 scope_allow if {
-	scope_allow_list
+	# Org member scope permissions must be allowed by the scope, and not denied
+	# by the site. The object *must* be owned by an organization.
+	object_is_included_in_scope_allow_list
 	not scope_site = -1
+
 	scope_org = 1
 }
 
+# User level scope enforcement
 scope_allow if {
-	scope_allow_list
+	# User scope permissions must be allowed by the scope, and not denied
+	# by the site. The object *must not* be owned by an organization.
+	object_is_included_in_scope_allow_list
 	not scope_site = -1
 	not scope_org = -1
 
 	# If we are not a member of an org, and the object has an org, then we are
 	# not authorized. This is an "implied -1" for not being in the org.
 	org_ok
+
 	scope_user = 1
 }
 
-# -------------------
-# ACL-Specific Rules
-# Access Control List
-# -------------------
+# If *.* is allowed, then all objects are in scope.
+object_is_included_in_scope_allow_list if {
+	{"type": "*", "id": "*"} in input.subject.scope.allow_list
+}
+
+# If <type>.* is allowed, then all objects of that type are in scope.
+object_is_included_in_scope_allow_list if {
+	{"type": input.object.type, "id": "*"} in input.subject.scope.allow_list
+}
+
+# Check if the object type and ID match one of the allow list entries.
+object_is_included_in_scope_allow_list if {
+	# Check that the wildcard rules do not apply. This prevents partial inputs
+	# from needing to include `input.object.id`.
+	not {"type": "*", "id": "*"} in input.subject.scope.allow_list
+	not {"type": input.object.type, "id": "*"} in input.subject.scope.allow_list
+
+	# Check which IDs from the allow list match the object type
+	allowed_ids_for_object_type := {it.id |
+		some it in input.subject.scope.allow_list
+		it.type in [input.object.type, "*"]
+	}
+
+	# Check if the input object ID is in the set of allowed IDs for the same
+	# object type. We do this at the end to keep `input.object.id` out of the
+	# comprehension because it might be unknown.
+	input.object.id in allowed_ids_for_object_type
+}
+
+#==============================================================================#
+# ACL rules                                                                    #
+#==============================================================================#
 
 # ACL for users
 acl_allow if {
-	# Should you have to be a member of the org too?
+	# TODO: Should you have to be a member of the org too?
 	perms := input.object.acl_user_list[input.subject.id]
 
-	# Either the input action or wildcard
-	[input.action, "*"][_] in perms
+	# Check if either the action or * is allowed
+	some action in [input.action, "*"]
+	action in perms
 }
 
 # ACL for groups
 acl_allow if {
 	# If there is no organization owner, the object cannot be owned by an
-	# org_scoped team.
-	org_mem
-	group := input.subject.groups[_]
+	# org-scoped group.
+	is_org_member
+	some group in input.subject.groups
 	perms := input.object.acl_group_list[group]
 
-	# Either the input action or wildcard
-	[input.action, "*"][_] in perms
+	# Check if either the action or * is allowed
+	some action in [input.action, "*"]
+	action in perms
 }
 
-# ACL for 'all_users' special group
+# ACL for the special "Everyone" groups
 acl_allow if {
-	org_mem
+	# If there is no organization owner, the object cannot be owned by an
+	# org-scoped group.
+	is_org_member
 	perms := input.object.acl_group_list[input.object.org_owner]
-	[input.action, "*"][_] in perms
+
+	# Check if either the action or * is allowed
+	some action in [input.action, "*"]
+	action in perms
 }
 
-# -------------------
-# Final Allow
-#
-# The 'allow' block is quite simple. Any set with `-1` cascades down in levels.
-# Authorization looks for any `allow` statement that is true. Multiple can be true!
-# Note that the absence of `allow` means "unauthorized".
-# An explicit `"allow": true` is required.
-#
-# Scope is also applied. The default scope is "wildcard:wildcard" allowing
-# all actions. If the scope is not "1", then the action is not authorized.
+#==============================================================================#
+# Allow                                                                        #
+#==============================================================================#
+
+# The `allow` block is quite simple. Any check that voted no will cascade down.
+# Authorization looks for any `allow` statement that is true. Multiple can be
+# true! Note that the absence of `allow` means "unauthorized". An explicit
+# `"allow": true` is required.
 #
-# Allow query:
-#	data.authz.role_allow = true
-#	data.authz.scope_allow = true
-# -------------------
+# We check both the subject's permissions (given by their roles or by ACL) and
+# the subject's scope. (The default scope is "*:*", allowing all actions.) Both
+# a permission check (either from roles or ACL) and the scope check must vote to
+# allow or the action is not authorized.
+
+# A subject can be given permission by a role
+permission_allow if role_allow
+
+# A subject can be given permission by ACL
+permission_allow if acl_allow
 
-# The role or the ACL must allow the action. Scopes can be used to limit,
-# so scope_allow must always be true.
 allow if {
-	role_allow
+	# Must be allowed by the subject's permissions
+	permission_allow
+
+	# ...and allowed by the scope
 	scope_allow
 }
 
-# ACL list must also have the scope_allow to pass
-allow if {
-	acl_allow
-	scope_allow
+#==============================================================================#
+# Utilities                                                                    #
+#==============================================================================#
+
+# bool_flip returns the logical negation of a boolean value. You can't do
+# 'x := not false', but you can do 'x := bool_flip(false)'
+bool_flip(b) := false if {
+	b
+}
+
+bool_flip(b) if {
+	not b
+}
+
+# to_vote gives you a voting value from a set or list of booleans.
+#   {false,..} => deny (-1)
+#   {}         => abstain (0)
+#   {true}     => allow (1)
+
+# Any set which contains a `false` should be considered a vote to deny.
+to_vote(set) := -1 if {
+	false in set
+}
+
+# A set which is empty should be considered abstaining.
+to_vote(set) := 0 if {
+	count(set) == 0
+}
+
+# A set which only contains true should be considered a vote to allow.
+to_vote(set) := 1 if {
+	not false in set
+	true in set
 }

From ed3d6fa9e3ff9c277c92c1a696f3f0d3504c426a Mon Sep 17 00:00:00 2001
From: jesmine <damilolao328@gmail.com>
Date: Mon, 27 Oct 2025 11:03:15 -0500
Subject: [PATCH 262/298] fix(site): preserve file path when building template
 version (#20481)

Fixes issue where clicking Build in the template editor would always
redirect to main.tf instead of keeping the currently open file.

Closes #14130

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
---
 .../TemplateVersionEditorPage.test.tsx        | 33 +++++++++++++++++++
 .../TemplateVersionEditorPage.tsx             | 10 +++---
 2 files changed, 37 insertions(+), 6 deletions(-)

diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
index f4db52b2ef437..f8c316cd001bb 100644
--- a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.test.tsx
@@ -255,6 +255,39 @@ test("The file is uploaded with the correct content type", async () => {
 	);
 });
 
+test("Preserves the currently open file path when building a template version", async () => {
+	const user = userEvent.setup();
+	const { router } = renderWithAuth(<TemplateVersionEditorPage />, {
+		route: `/templates/${MockTemplate.name}/versions/${MockTemplateVersion.name}/edit?path=myfile.tf`,
+		path: "/templates/:template/versions/:version/edit",
+		extraRoutes: [
+			{
+				path: "/templates/:templateId",
+				element: <div></div>,
+			},
+		],
+	});
+
+	const topbar = await screen.findByTestId("topbar");
+
+	const newTemplateVersion: TemplateVersion = {
+		...MockTemplateVersion,
+		id: "new-version-id",
+		name: "new-version",
+	};
+
+	await typeOnEditor("new content", user);
+	await buildTemplateVersion(newTemplateVersion, user, topbar);
+
+	// Verify that the path query parameter is preserved in the URL
+	await waitFor(() => {
+		expect(router.state.location.pathname).toBe(
+			`/templates/${MockTemplate.name}/versions/new-version/edit`,
+		);
+	});
+	expect(router.state.location.search).toBe("?path=myfile.tf");
+});
+
 describe.each([
 	{
 		testName: "Do not ask when template version has no errors",
diff --git a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
index 9f8b7e10b6307..52d52ad0e1df1 100644
--- a/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
+++ b/site/src/pages/TemplateVersionEditorPage/TemplateVersionEditorPage.tsx
@@ -104,12 +104,10 @@ const TemplateVersionEditorPage: FC = () => {
 	};
 
 	const navigateToVersion = (version: TemplateVersion) => {
-		return navigate(
-			`${getLink(linkToTemplate(organizationName, templateName))}/versions/${
-				version.name
-			}/edit`,
-			{ replace: true },
-		);
+		const url = `${getLink(linkToTemplate(organizationName, templateName))}/versions/${
+			version.name
+		}/edit?${searchParams.toString()}`;
+		return navigate(url, { replace: true });
 	};
 
 	const onBuildEnds = (newVersion: TemplateVersion) => {

From cadf1352b459cfd03480beaf344580bd1e56cecf Mon Sep 17 00:00:00 2001
From: Thomas Kosiewski <tk@coder.com>
Date: Mon, 27 Oct 2025 17:07:25 +0100
Subject: [PATCH 263/298] feat: add scoped token support to CLI (#19985)

<!--

If you have used AI to produce some or all of this PR, please ensure you have read our [AI Contribution guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING) before submitting.

-->

Add support for scoped API tokens in CLI

This PR adds CLI support for creating and viewing API tokens with scopes and allow lists. It includes:

- New `--scope` and `--allow` flags for the `tokens create` command
- A new `tokens view` command to display detailed information about a token
- Updated table columns in `tokens list` to show scopes and allow list entries
- Updated help text and examples

These changes enable users to create tokens with limited permissions through the CLI, similar to the existing functionality in the web UI.
---
 cli/allowlistflag.go                          |  78 +++++++++++++
 cli/testdata/coder_tokens_--help.golden       |   5 +
 .../coder_tokens_create_--help.golden         |   6 +
 cli/testdata/coder_tokens_list_--help.golden  |   2 +-
 cli/testdata/coder_tokens_view_--help.golden  |  16 +++
 cli/tokens.go                                 | 108 +++++++++++++++++-
 cli/tokens_test.go                            |  59 +++++++++-
 docs/manifest.json                            |   5 +
 docs/reference/cli/tokens.md                  |  15 ++-
 docs/reference/cli/tokens_create.md           |  16 +++
 docs/reference/cli/tokens_list.md             |   8 +-
 docs/reference/cli/tokens_view.md             |  30 +++++
 12 files changed, 330 insertions(+), 18 deletions(-)
 create mode 100644 cli/allowlistflag.go
 create mode 100644 cli/testdata/coder_tokens_view_--help.golden
 create mode 100644 docs/reference/cli/tokens_view.md

diff --git a/cli/allowlistflag.go b/cli/allowlistflag.go
new file mode 100644
index 0000000000000..208bf24b3ed30
--- /dev/null
+++ b/cli/allowlistflag.go
@@ -0,0 +1,78 @@
+package cli
+
+import (
+	"encoding/csv"
+	"strings"
+
+	"github.com/spf13/pflag"
+	"golang.org/x/xerrors"
+
+	"github.com/coder/coder/v2/codersdk"
+)
+
+var (
+	_ pflag.SliceValue = &AllowListFlag{}
+	_ pflag.Value      = &AllowListFlag{}
+)
+
+// AllowListFlag implements pflag.SliceValue for codersdk.APIAllowListTarget entries.
+type AllowListFlag []codersdk.APIAllowListTarget
+
+func AllowListFlagOf(al *[]codersdk.APIAllowListTarget) *AllowListFlag {
+	return (*AllowListFlag)(al)
+}
+
+func (a AllowListFlag) String() string {
+	return strings.Join(a.GetSlice(), ",")
+}
+
+func (a AllowListFlag) Value() []codersdk.APIAllowListTarget {
+	return []codersdk.APIAllowListTarget(a)
+}
+
+func (AllowListFlag) Type() string { return "allow-list" }
+
+func (a *AllowListFlag) Set(set string) error {
+	values, err := csv.NewReader(strings.NewReader(set)).Read()
+	if err != nil {
+		return xerrors.Errorf("parse allow list entries as csv: %w", err)
+	}
+	for _, v := range values {
+		if err := a.Append(v); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (a *AllowListFlag) Append(value string) error {
+	value = strings.TrimSpace(value)
+	if value == "" {
+		return xerrors.New("allow list entry cannot be empty")
+	}
+	var target codersdk.APIAllowListTarget
+	if err := target.UnmarshalText([]byte(value)); err != nil {
+		return err
+	}
+
+	*a = append(*a, target)
+	return nil
+}
+
+func (a *AllowListFlag) Replace(items []string) error {
+	*a = []codersdk.APIAllowListTarget{}
+	for _, item := range items {
+		if err := a.Append(item); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+func (a *AllowListFlag) GetSlice() []string {
+	out := make([]string, len(*a))
+	for i, entry := range *a {
+		out[i] = entry.String()
+	}
+	return out
+}
diff --git a/cli/testdata/coder_tokens_--help.golden b/cli/testdata/coder_tokens_--help.golden
index 7247c42a4bd1d..fb58dab8b3e69 100644
--- a/cli/testdata/coder_tokens_--help.golden
+++ b/cli/testdata/coder_tokens_--help.golden
@@ -16,6 +16,10 @@ USAGE:
   
        $ coder tokens ls
   
+    - Create a scoped token:
+  
+       $ coder tokens create --scope workspace:read --allow workspace:<uuid>
+  
     - Remove a token by ID:
   
        $ coder tokens rm WuoWs4ZsMX
@@ -24,6 +28,7 @@ SUBCOMMANDS:
     create    Create a token
     list      List tokens
     remove    Delete a token
+    view      Display detailed information about a token
 
 ———
 Run `coder --help` for a list of global options.
diff --git a/cli/testdata/coder_tokens_create_--help.golden b/cli/testdata/coder_tokens_create_--help.golden
index 9399635563a11..6db7a07a27920 100644
--- a/cli/testdata/coder_tokens_create_--help.golden
+++ b/cli/testdata/coder_tokens_create_--help.golden
@@ -6,12 +6,18 @@ USAGE:
   Create a token
 
 OPTIONS:
+      --allow allow-list
+          Repeatable allow-list entry (<type>:<uuid>, e.g. workspace:1234-...).
+
       --lifetime string, $CODER_TOKEN_LIFETIME
           Specify a duration for the lifetime of the token.
 
   -n, --name string, $CODER_TOKEN_NAME
           Specify a human-readable name.
 
+      --scope string-array
+          Repeatable scope to attach to the token (e.g. workspace:read).
+
   -u, --user string, $CODER_TOKEN_USER
           Specify the user to create the token for (Only works if logged in user
           is admin).
diff --git a/cli/testdata/coder_tokens_list_--help.golden b/cli/testdata/coder_tokens_list_--help.golden
index 9ad17fbafb8e6..a3c24bcd0fabe 100644
--- a/cli/testdata/coder_tokens_list_--help.golden
+++ b/cli/testdata/coder_tokens_list_--help.golden
@@ -12,7 +12,7 @@ OPTIONS:
           Specifies whether all users' tokens will be listed or not (must have
           Owner role to see all tokens).
 
-  -c, --column [id|name|last used|expires at|created at|owner] (default: id,name,last used,expires at,created at)
+  -c, --column [id|name|scopes|allow list|last used|expires at|created at|owner] (default: id,name,scopes,allow list,last used,expires at,created at)
           Columns to display in table output.
 
   -o, --output table|json (default: table)
diff --git a/cli/testdata/coder_tokens_view_--help.golden b/cli/testdata/coder_tokens_view_--help.golden
new file mode 100644
index 0000000000000..1bceac32ce52f
--- /dev/null
+++ b/cli/testdata/coder_tokens_view_--help.golden
@@ -0,0 +1,16 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder tokens view [flags] <name|id>
+
+  Display detailed information about a token
+
+OPTIONS:
+  -c, --column [id|name|scopes|allow list|last used|expires at|created at|owner] (default: id,name,scopes,allow list,last used,expires at,created at,owner)
+          Columns to display in table output.
+
+  -o, --output table|json (default: table)
+          Output format.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/cli/tokens.go b/cli/tokens.go
index 5d63f2e1ae841..1c1bcd78a2a1b 100644
--- a/cli/tokens.go
+++ b/cli/tokens.go
@@ -4,12 +4,14 @@ import (
 	"fmt"
 	"os"
 	"slices"
+	"sort"
 	"strings"
 	"time"
 
 	"golang.org/x/xerrors"
 
 	"github.com/coder/coder/v2/cli/cliui"
+	"github.com/coder/coder/v2/coderd/util/slice"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/serpent"
 )
@@ -27,6 +29,10 @@ func (r *RootCmd) tokens() *serpent.Command {
 				Description: "List your tokens",
 				Command:     "coder tokens ls",
 			},
+			Example{
+				Description: "Create a scoped token",
+				Command:     "coder tokens create --scope workspace:read --allow workspace:<uuid>",
+			},
 			Example{
 				Description: "Remove a token by ID",
 				Command:     "coder tokens rm WuoWs4ZsMX",
@@ -39,6 +45,7 @@ func (r *RootCmd) tokens() *serpent.Command {
 		Children: []*serpent.Command{
 			r.createToken(),
 			r.listTokens(),
+			r.viewToken(),
 			r.removeToken(),
 		},
 	}
@@ -50,6 +57,8 @@ func (r *RootCmd) createToken() *serpent.Command {
 		tokenLifetime string
 		name          string
 		user          string
+		scopes        []string
+		allowList     []codersdk.APIAllowListTarget
 	)
 	cmd := &serpent.Command{
 		Use:   "create",
@@ -88,10 +97,18 @@ func (r *RootCmd) createToken() *serpent.Command {
 				}
 			}
 
-			res, err := client.CreateToken(inv.Context(), userID, codersdk.CreateTokenRequest{
+			req := codersdk.CreateTokenRequest{
 				Lifetime:  parsedLifetime,
 				TokenName: name,
-			})
+			}
+			if len(req.Scopes) == 0 {
+				req.Scopes = slice.StringEnums[codersdk.APIKeyScope](scopes)
+			}
+			if len(allowList) > 0 {
+				req.AllowList = append([]codersdk.APIAllowListTarget(nil), allowList...)
+			}
+
+			res, err := client.CreateToken(inv.Context(), userID, req)
 			if err != nil {
 				return xerrors.Errorf("create tokens: %w", err)
 			}
@@ -123,6 +140,16 @@ func (r *RootCmd) createToken() *serpent.Command {
 			Description:   "Specify the user to create the token for (Only works if logged in user is admin).",
 			Value:         serpent.StringOf(&user),
 		},
+		{
+			Flag:        "scope",
+			Description: "Repeatable scope to attach to the token (e.g. workspace:read).",
+			Value:       serpent.StringArrayOf(&scopes),
+		},
+		{
+			Flag:        "allow",
+			Description: "Repeatable allow-list entry (<type>:<uuid>, e.g. workspace:1234-...).",
+			Value:       AllowListFlagOf(&allowList),
+		},
 	}
 
 	return cmd
@@ -136,6 +163,8 @@ type tokenListRow struct {
 	// For table format:
 	ID        string    `json:"-" table:"id,default_sort"`
 	TokenName string    `json:"token_name" table:"name"`
+	Scopes    string    `json:"-" table:"scopes"`
+	Allow     string    `json:"-" table:"allow list"`
 	LastUsed  time.Time `json:"-" table:"last used"`
 	ExpiresAt time.Time `json:"-" table:"expires at"`
 	CreatedAt time.Time `json:"-" table:"created at"`
@@ -143,20 +172,47 @@ type tokenListRow struct {
 }
 
 func tokenListRowFromToken(token codersdk.APIKeyWithOwner) tokenListRow {
+	return tokenListRowFromKey(token.APIKey, token.Username)
+}
+
+func tokenListRowFromKey(token codersdk.APIKey, owner string) tokenListRow {
 	return tokenListRow{
-		APIKey:    token.APIKey,
+		APIKey:    token,
 		ID:        token.ID,
 		TokenName: token.TokenName,
+		Scopes:    joinScopes(token.Scopes),
+		Allow:     joinAllowList(token.AllowList),
 		LastUsed:  token.LastUsed,
 		ExpiresAt: token.ExpiresAt,
 		CreatedAt: token.CreatedAt,
-		Owner:     token.Username,
+		Owner:     owner,
 	}
 }
 
+func joinScopes(scopes []codersdk.APIKeyScope) string {
+	if len(scopes) == 0 {
+		return ""
+	}
+	vals := slice.ToStrings(scopes)
+	sort.Strings(vals)
+	return strings.Join(vals, ", ")
+}
+
+func joinAllowList(entries []codersdk.APIAllowListTarget) string {
+	if len(entries) == 0 {
+		return ""
+	}
+	vals := make([]string, len(entries))
+	for i, entry := range entries {
+		vals[i] = entry.String()
+	}
+	sort.Strings(vals)
+	return strings.Join(vals, ", ")
+}
+
 func (r *RootCmd) listTokens() *serpent.Command {
 	// we only display the 'owner' column if the --all argument is passed in
-	defaultCols := []string{"id", "name", "last used", "expires at", "created at"}
+	defaultCols := []string{"id", "name", "scopes", "allow list", "last used", "expires at", "created at"}
 	if slices.Contains(os.Args, "-a") || slices.Contains(os.Args, "--all") {
 		defaultCols = append(defaultCols, "owner")
 	}
@@ -226,6 +282,48 @@ func (r *RootCmd) listTokens() *serpent.Command {
 	return cmd
 }
 
+func (r *RootCmd) viewToken() *serpent.Command {
+	formatter := cliui.NewOutputFormatter(
+		cliui.TableFormat([]tokenListRow{}, []string{"id", "name", "scopes", "allow list", "last used", "expires at", "created at", "owner"}),
+		cliui.JSONFormat(),
+	)
+
+	cmd := &serpent.Command{
+		Use:   "view <name|id>",
+		Short: "Display detailed information about a token",
+		Middleware: serpent.Chain(
+			serpent.RequireNArgs(1),
+		),
+		Handler: func(inv *serpent.Invocation) error {
+			client, err := r.InitClient(inv)
+			if err != nil {
+				return err
+			}
+
+			tokenName := inv.Args[0]
+			token, err := client.APIKeyByName(inv.Context(), codersdk.Me, tokenName)
+			if err != nil {
+				maybeID := strings.Split(tokenName, "-")[0]
+				token, err = client.APIKeyByID(inv.Context(), codersdk.Me, maybeID)
+				if err != nil {
+					return xerrors.Errorf("fetch api key by name or id: %w", err)
+				}
+			}
+
+			row := tokenListRowFromKey(*token, "")
+			out, err := formatter.Format(inv.Context(), []tokenListRow{row})
+			if err != nil {
+				return err
+			}
+			_, err = fmt.Fprintln(inv.Stdout, out)
+			return err
+		},
+	}
+
+	formatter.AttachOptions(&cmd.Options)
+	return cmd
+}
+
 func (r *RootCmd) removeToken() *serpent.Command {
 	cmd := &serpent.Command{
 		Use:     "remove <name|id|token>",
diff --git a/cli/tokens_test.go b/cli/tokens_test.go
index 0c717bb890f9e..990516aa9ba13 100644
--- a/cli/tokens_test.go
+++ b/cli/tokens_test.go
@@ -4,10 +4,13 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"fmt"
 	"testing"
 
 	"github.com/stretchr/testify/require"
 
+	"github.com/google/uuid"
+
 	"github.com/coder/coder/v2/cli/clitest"
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/codersdk"
@@ -46,6 +49,18 @@ func TestTokens(t *testing.T) {
 	require.NotEmpty(t, res)
 	id := res[:10]
 
+	allowWorkspaceID := uuid.New()
+	allowSpec := fmt.Sprintf("workspace:%s", allowWorkspaceID.String())
+	inv, root = clitest.New(t, "tokens", "create", "--name", "scoped-token", "--scope", string(codersdk.APIKeyScopeWorkspaceRead), "--allow", allowSpec)
+	clitest.SetupConfig(t, client, root)
+	buf = new(bytes.Buffer)
+	inv.Stdout = buf
+	err = inv.WithContext(ctx).Run()
+	require.NoError(t, err)
+	res = buf.String()
+	require.NotEmpty(t, res)
+	scopedTokenID := res[:10]
+
 	// Test creating a token for second user from first user's (admin) session
 	inv, root = clitest.New(t, "tokens", "create", "--name", "token-two", "--user", secondUser.ID.String())
 	clitest.SetupConfig(t, client, root)
@@ -67,7 +82,7 @@ func TestTokens(t *testing.T) {
 	require.NoError(t, err)
 	res = buf.String()
 	require.NotEmpty(t, res)
-	// Result should only contain the token created for the admin user
+	// Result should only contain the tokens created for the admin user
 	require.Contains(t, res, "ID")
 	require.Contains(t, res, "EXPIRES AT")
 	require.Contains(t, res, "CREATED AT")
@@ -76,6 +91,16 @@ func TestTokens(t *testing.T) {
 	// Result should not contain the token created for the second user
 	require.NotContains(t, res, secondTokenID)
 
+	inv, root = clitest.New(t, "tokens", "view", "scoped-token")
+	clitest.SetupConfig(t, client, root)
+	buf = new(bytes.Buffer)
+	inv.Stdout = buf
+	err = inv.WithContext(ctx).Run()
+	require.NoError(t, err)
+	res = buf.String()
+	require.Contains(t, res, string(codersdk.APIKeyScopeWorkspaceRead))
+	require.Contains(t, res, allowSpec)
+
 	// Test listing tokens from the second user's session
 	inv, root = clitest.New(t, "tokens", "ls")
 	clitest.SetupConfig(t, secondUserClient, root)
@@ -101,6 +126,14 @@ func TestTokens(t *testing.T) {
 	// User (non-admin) should not be able to create a token for another user
 	require.Error(t, err)
 
+	inv, root = clitest.New(t, "tokens", "create", "--name", "invalid-allow", "--allow", "badvalue")
+	clitest.SetupConfig(t, client, root)
+	buf = new(bytes.Buffer)
+	inv.Stdout = buf
+	err = inv.WithContext(ctx).Run()
+	require.Error(t, err)
+	require.Contains(t, err.Error(), "invalid allow_list entry")
+
 	inv, root = clitest.New(t, "tokens", "ls", "--output=json")
 	clitest.SetupConfig(t, client, root)
 	buf = new(bytes.Buffer)
@@ -110,8 +143,17 @@ func TestTokens(t *testing.T) {
 
 	var tokens []codersdk.APIKey
 	require.NoError(t, json.Unmarshal(buf.Bytes(), &tokens))
-	require.Len(t, tokens, 1)
-	require.Equal(t, id, tokens[0].ID)
+	require.Len(t, tokens, 2)
+	tokenByName := make(map[string]codersdk.APIKey, len(tokens))
+	for _, tk := range tokens {
+		tokenByName[tk.TokenName] = tk
+	}
+	require.Contains(t, tokenByName, "token-one")
+	require.Contains(t, tokenByName, "scoped-token")
+	scopedToken := tokenByName["scoped-token"]
+	require.Contains(t, scopedToken.Scopes, codersdk.APIKeyScopeWorkspaceRead)
+	require.Len(t, scopedToken.AllowList, 1)
+	require.Equal(t, allowSpec, scopedToken.AllowList[0].String())
 
 	// Delete by name
 	inv, root = clitest.New(t, "tokens", "rm", "token-one")
@@ -135,6 +177,17 @@ func TestTokens(t *testing.T) {
 	require.NotEmpty(t, res)
 	require.Contains(t, res, "deleted")
 
+	// Delete scoped token by ID
+	inv, root = clitest.New(t, "tokens", "rm", scopedTokenID)
+	clitest.SetupConfig(t, client, root)
+	buf = new(bytes.Buffer)
+	inv.Stdout = buf
+	err = inv.WithContext(ctx).Run()
+	require.NoError(t, err)
+	res = buf.String()
+	require.NotEmpty(t, res)
+	require.Contains(t, res, "deleted")
+
 	// Create third token
 	inv, root = clitest.New(t, "tokens", "create", "--name", "token-three")
 	clitest.SetupConfig(t, client, root)
diff --git a/docs/manifest.json b/docs/manifest.json
index 8f624cb7f220c..78a0d38ec949d 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -1798,6 +1798,11 @@
 							"description": "Delete a token",
 							"path": "reference/cli/tokens_remove.md"
 						},
+						{
+							"title": "tokens view",
+							"description": "Display detailed information about a token",
+							"path": "reference/cli/tokens_view.md"
+						},
 						{
 							"title": "unfavorite",
 							"description": "Remove a workspace from your favorites",
diff --git a/docs/reference/cli/tokens.md b/docs/reference/cli/tokens.md
index 36b6575ed323f..fd4369d5e63f0 100644
--- a/docs/reference/cli/tokens.md
+++ b/docs/reference/cli/tokens.md
@@ -25,6 +25,10 @@ Tokens are used to authenticate automated clients to Coder.
 
      $ coder tokens ls
 
+  - Create a scoped token:
+
+     $ coder tokens create --scope workspace:read --allow workspace:<uuid>
+
   - Remove a token by ID:
 
      $ coder tokens rm WuoWs4ZsMX
@@ -32,8 +36,9 @@ Tokens are used to authenticate automated clients to Coder.
 
 ## Subcommands
 
-| Name                                      | Purpose        |
-|-------------------------------------------|----------------|
-| [<code>create</code>](./tokens_create.md) | Create a token |
-| [<code>list</code>](./tokens_list.md)     | List tokens    |
-| [<code>remove</code>](./tokens_remove.md) | Delete a token |
+| Name                                      | Purpose                                    |
+|-------------------------------------------|--------------------------------------------|
+| [<code>create</code>](./tokens_create.md) | Create a token                             |
+| [<code>list</code>](./tokens_list.md)     | List tokens                                |
+| [<code>view</code>](./tokens_view.md)     | Display detailed information about a token |
+| [<code>remove</code>](./tokens_remove.md) | Delete a token                             |
diff --git a/docs/reference/cli/tokens_create.md b/docs/reference/cli/tokens_create.md
index 7ad9699c17c35..d5dd916a46e0e 100644
--- a/docs/reference/cli/tokens_create.md
+++ b/docs/reference/cli/tokens_create.md
@@ -37,3 +37,19 @@ Specify a human-readable name.
 | Environment | <code>$CODER_TOKEN_USER</code> |
 
 Specify the user to create the token for (Only works if logged in user is admin).
+
+### --scope
+
+|      |                           |
+|------|---------------------------|
+| Type | <code>string-array</code> |
+
+Repeatable scope to attach to the token (e.g. workspace:read).
+
+### --allow
+
+|      |                         |
+|------|-------------------------|
+| Type | <code>allow-list</code> |
+
+Repeatable allow-list entry (<type>:<uuid>, e.g. workspace:1234-...).
diff --git a/docs/reference/cli/tokens_list.md b/docs/reference/cli/tokens_list.md
index 150b411855174..53d5e9b7b57c8 100644
--- a/docs/reference/cli/tokens_list.md
+++ b/docs/reference/cli/tokens_list.md
@@ -25,10 +25,10 @@ Specifies whether all users' tokens will be listed or not (must have Owner role
 
 ### -c, --column
 
-|         |                                                                   |
-|---------|-------------------------------------------------------------------|
-| Type    | <code>[id\|name\|last used\|expires at\|created at\|owner]</code> |
-| Default | <code>id,name,last used,expires at,created at</code>              |
+|         |                                                                                       |
+|---------|---------------------------------------------------------------------------------------|
+| Type    | <code>[id\|name\|scopes\|allow list\|last used\|expires at\|created at\|owner]</code> |
+| Default | <code>id,name,scopes,allow list,last used,expires at,created at</code>                |
 
 Columns to display in table output.
 
diff --git a/docs/reference/cli/tokens_view.md b/docs/reference/cli/tokens_view.md
new file mode 100644
index 0000000000000..f5008f5e41092
--- /dev/null
+++ b/docs/reference/cli/tokens_view.md
@@ -0,0 +1,30 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# tokens view
+
+Display detailed information about a token
+
+## Usage
+
+```console
+coder tokens view [flags] <name|id>
+```
+
+## Options
+
+### -c, --column
+
+|         |                                                                                       |
+|---------|---------------------------------------------------------------------------------------|
+| Type    | <code>[id\|name\|scopes\|allow list\|last used\|expires at\|created at\|owner]</code> |
+| Default | <code>id,name,scopes,allow list,last used,expires at,created at,owner</code>          |
+
+Columns to display in table output.
+
+### -o, --output
+
+|         |                          |
+|---------|--------------------------|
+| Type    | <code>table\|json</code> |
+| Default | <code>table</code>       |
+
+Output format.

From 5a3ceb38f0636e63d273cb64aef230b252b544a5 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Tue, 28 Oct 2025 03:16:41 +1100
Subject: [PATCH 264/298] chore: add aibridge data to telemetry (#20449)

- Adds a new table to keep track of which payloads have already been
reported since we only report for the last clock hour
- Adds a query to gather and aggregate all the data by
provider/model/client

Relates to https://github.com/coder/coder-telemetry-server/issues/27
---
 .gitignore                                    |   2 +
 coderd/database/check_constraint.go           |   1 +
 coderd/database/dbauthz/dbauthz.go            |  28 ++
 coderd/database/dbauthz/dbauthz_test.go       |  22 ++
 coderd/database/dbmetrics/querymetrics.go     |  28 ++
 coderd/database/dbmock/dbmock.go              |  58 +++++
 coderd/database/dbpurge/dbpurge.go            |  10 +
 coderd/database/dbpurge/dbpurge_test.go       |  53 ++++
 coderd/database/dump.sql                      |  17 ++
 .../000390_telemetry_locks.down.sql           |   1 +
 .../migrations/000390_telemetry_locks.up.sql  |  12 +
 .../fixtures/000390_telemetry_locks.up.sql    |   8 +
 coderd/database/models.go                     |   8 +
 coderd/database/querier.go                    |  14 +
 coderd/database/queries.sql.go                | 244 ++++++++++++++++++
 coderd/database/queries/aibridge.sql          | 119 +++++++++
 coderd/database/queries/telemetrylocks.sql    |  17 ++
 coderd/database/unique_constraint.go          |   1 +
 coderd/telemetry/telemetry.go                 | 174 ++++++++++++-
 coderd/telemetry/telemetry_test.go            | 129 ++++++++-
 20 files changed, 940 insertions(+), 6 deletions(-)
 create mode 100644 coderd/database/migrations/000390_telemetry_locks.down.sql
 create mode 100644 coderd/database/migrations/000390_telemetry_locks.up.sql
 create mode 100644 coderd/database/migrations/testdata/fixtures/000390_telemetry_locks.up.sql
 create mode 100644 coderd/database/queries/telemetrylocks.sql

diff --git a/.gitignore b/.gitignore
index 86f70cc3afd3e..9b1edcec2d8f9 100644
--- a/.gitignore
+++ b/.gitignore
@@ -89,3 +89,5 @@ result
 __debug_bin*
 
 **/.claude/settings.local.json
+
+/.env
diff --git a/coderd/database/check_constraint.go b/coderd/database/check_constraint.go
index d84802b9882af..8b1917b7697db 100644
--- a/coderd/database/check_constraint.go
+++ b/coderd/database/check_constraint.go
@@ -14,6 +14,7 @@ const (
 	CheckSubsystemsNotNone                         CheckConstraint = "subsystems_not_none"                              // workspace_agents
 	CheckWorkspaceBuildsAiTaskSidebarAppIDRequired CheckConstraint = "workspace_builds_ai_task_sidebar_app_id_required" // workspace_builds
 	CheckWorkspaceBuildsDeadlineBelowMaxDeadline   CheckConstraint = "workspace_builds_deadline_below_max_deadline"     // workspace_builds
+	CheckTelemetryLockEventTypeConstraint          CheckConstraint = "telemetry_lock_event_type_constraint"             // telemetry_locks
 	CheckValidationMonotonicOrder                  CheckConstraint = "validation_monotonic_order"                       // template_version_parameters
 	CheckUsageEventTypeCheck                       CheckConstraint = "usage_event_type_check"                           // usage_events
 )
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 4dc0fb93e3b5d..74f24a617c410 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -1424,6 +1424,13 @@ func (q *querier) BulkMarkNotificationMessagesSent(ctx context.Context, arg data
 	return q.db.BulkMarkNotificationMessagesSent(ctx, arg)
 }
 
+func (q *querier) CalculateAIBridgeInterceptionsTelemetrySummary(ctx context.Context, arg database.CalculateAIBridgeInterceptionsTelemetrySummaryParams) (database.CalculateAIBridgeInterceptionsTelemetrySummaryRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAibridgeInterception); err != nil {
+		return database.CalculateAIBridgeInterceptionsTelemetrySummaryRow{}, err
+	}
+	return q.db.CalculateAIBridgeInterceptionsTelemetrySummary(ctx, arg)
+}
+
 func (q *querier) ClaimPrebuiltWorkspace(ctx context.Context, arg database.ClaimPrebuiltWorkspaceParams) (database.ClaimPrebuiltWorkspaceRow, error) {
 	empty := database.ClaimPrebuiltWorkspaceRow{}
 
@@ -1723,6 +1730,13 @@ func (q *querier) DeleteOldProvisionerDaemons(ctx context.Context) error {
 	return q.db.DeleteOldProvisionerDaemons(ctx)
 }
 
+func (q *querier) DeleteOldTelemetryLocks(ctx context.Context, beforeTime time.Time) error {
+	if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
+		return err
+	}
+	return q.db.DeleteOldTelemetryLocks(ctx, beforeTime)
+}
+
 func (q *querier) DeleteOldWorkspaceAgentLogs(ctx context.Context, threshold time.Time) error {
 	if err := q.authorizeContext(ctx, policy.ActionDelete, rbac.ResourceSystem); err != nil {
 		return err
@@ -4212,6 +4226,13 @@ func (q *querier) InsertTelemetryItemIfNotExists(ctx context.Context, arg databa
 	return q.db.InsertTelemetryItemIfNotExists(ctx, arg)
 }
 
+func (q *querier) InsertTelemetryLock(ctx context.Context, arg database.InsertTelemetryLockParams) error {
+	if err := q.authorizeContext(ctx, policy.ActionCreate, rbac.ResourceSystem); err != nil {
+		return err
+	}
+	return q.db.InsertTelemetryLock(ctx, arg)
+}
+
 func (q *querier) InsertTemplate(ctx context.Context, arg database.InsertTemplateParams) error {
 	obj := rbac.ResourceTemplate.InOrg(arg.OrganizationID)
 	if err := q.authorizeContext(ctx, policy.ActionCreate, obj); err != nil {
@@ -4523,6 +4544,13 @@ func (q *querier) ListAIBridgeInterceptions(ctx context.Context, arg database.Li
 	return q.db.ListAuthorizedAIBridgeInterceptions(ctx, arg, prep)
 }
 
+func (q *querier) ListAIBridgeInterceptionsTelemetrySummaries(ctx context.Context, arg database.ListAIBridgeInterceptionsTelemetrySummariesParams) ([]database.ListAIBridgeInterceptionsTelemetrySummariesRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceAibridgeInterception); err != nil {
+		return nil, err
+	}
+	return q.db.ListAIBridgeInterceptionsTelemetrySummaries(ctx, arg)
+}
+
 func (q *querier) ListAIBridgeTokenUsagesByInterceptionIDs(ctx context.Context, interceptionIDs []uuid.UUID) ([]database.AIBridgeTokenUsage, error) {
 	// This function is a system function until we implement a join for aibridge interceptions.
 	// Matches the behavior of the workspaces listing endpoint.
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index c7a0b2bb70c3e..8cf622a4347f3 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -4627,3 +4627,25 @@ func (s *MethodTestSuite) TestAIBridge() {
 		check.Args(params).Asserts(intc, policy.ActionUpdate).Returns(intc)
 	}))
 }
+
+func (s *MethodTestSuite) TestTelemetry() {
+	s.Run("InsertTelemetryLock", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		db.EXPECT().InsertTelemetryLock(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+		check.Args(database.InsertTelemetryLockParams{}).Asserts(rbac.ResourceSystem, policy.ActionCreate)
+	}))
+
+	s.Run("DeleteOldTelemetryLocks", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		db.EXPECT().DeleteOldTelemetryLocks(gomock.Any(), gomock.Any()).Return(nil).AnyTimes()
+		check.Args(time.Time{}).Asserts(rbac.ResourceSystem, policy.ActionDelete)
+	}))
+
+	s.Run("ListAIBridgeInterceptionsTelemetrySummaries", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		db.EXPECT().ListAIBridgeInterceptionsTelemetrySummaries(gomock.Any(), gomock.Any()).Return([]database.ListAIBridgeInterceptionsTelemetrySummariesRow{}, nil).AnyTimes()
+		check.Args(database.ListAIBridgeInterceptionsTelemetrySummariesParams{}).Asserts(rbac.ResourceAibridgeInterception, policy.ActionRead)
+	}))
+
+	s.Run("CalculateAIBridgeInterceptionsTelemetrySummary", s.Mocked(func(db *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		db.EXPECT().CalculateAIBridgeInterceptionsTelemetrySummary(gomock.Any(), gomock.Any()).Return(database.CalculateAIBridgeInterceptionsTelemetrySummaryRow{}, nil).AnyTimes()
+		check.Args(database.CalculateAIBridgeInterceptionsTelemetrySummaryParams{}).Asserts(rbac.ResourceAibridgeInterception, policy.ActionRead)
+	}))
+}
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 57396cd31ba30..1bd8fda62470a 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -158,6 +158,13 @@ func (m queryMetricsStore) BulkMarkNotificationMessagesSent(ctx context.Context,
 	return r0, r1
 }
 
+func (m queryMetricsStore) CalculateAIBridgeInterceptionsTelemetrySummary(ctx context.Context, arg database.CalculateAIBridgeInterceptionsTelemetrySummaryParams) (database.CalculateAIBridgeInterceptionsTelemetrySummaryRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.CalculateAIBridgeInterceptionsTelemetrySummary(ctx, arg)
+	m.queryLatencies.WithLabelValues("CalculateAIBridgeInterceptionsTelemetrySummary").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) ClaimPrebuiltWorkspace(ctx context.Context, arg database.ClaimPrebuiltWorkspaceParams) (database.ClaimPrebuiltWorkspaceRow, error) {
 	start := time.Now()
 	r0, r1 := m.s.ClaimPrebuiltWorkspace(ctx, arg)
@@ -403,6 +410,13 @@ func (m queryMetricsStore) DeleteOldProvisionerDaemons(ctx context.Context) erro
 	return r0
 }
 
+func (m queryMetricsStore) DeleteOldTelemetryLocks(ctx context.Context, periodEndingAtBefore time.Time) error {
+	start := time.Now()
+	r0 := m.s.DeleteOldTelemetryLocks(ctx, periodEndingAtBefore)
+	m.queryLatencies.WithLabelValues("DeleteOldTelemetryLocks").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m queryMetricsStore) DeleteOldWorkspaceAgentLogs(ctx context.Context, arg time.Time) error {
 	start := time.Now()
 	r0 := m.s.DeleteOldWorkspaceAgentLogs(ctx, arg)
@@ -2517,6 +2531,13 @@ func (m queryMetricsStore) InsertTelemetryItemIfNotExists(ctx context.Context, a
 	return r0
 }
 
+func (m queryMetricsStore) InsertTelemetryLock(ctx context.Context, arg database.InsertTelemetryLockParams) error {
+	start := time.Now()
+	r0 := m.s.InsertTelemetryLock(ctx, arg)
+	m.queryLatencies.WithLabelValues("InsertTelemetryLock").Observe(time.Since(start).Seconds())
+	return r0
+}
+
 func (m queryMetricsStore) InsertTemplate(ctx context.Context, arg database.InsertTemplateParams) error {
 	start := time.Now()
 	err := m.s.InsertTemplate(ctx, arg)
@@ -2734,6 +2755,13 @@ func (m queryMetricsStore) ListAIBridgeInterceptions(ctx context.Context, arg da
 	return r0, r1
 }
 
+func (m queryMetricsStore) ListAIBridgeInterceptionsTelemetrySummaries(ctx context.Context, arg database.ListAIBridgeInterceptionsTelemetrySummariesParams) ([]database.ListAIBridgeInterceptionsTelemetrySummariesRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.ListAIBridgeInterceptionsTelemetrySummaries(ctx, arg)
+	m.queryLatencies.WithLabelValues("ListAIBridgeInterceptionsTelemetrySummaries").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) ListAIBridgeTokenUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]database.AIBridgeTokenUsage, error) {
 	start := time.Now()
 	r0, r1 := m.s.ListAIBridgeTokenUsagesByInterceptionIDs(ctx, interceptionIds)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index a558c41dacdb9..1983092aa53f0 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -190,6 +190,21 @@ func (mr *MockStoreMockRecorder) BulkMarkNotificationMessagesSent(ctx, arg any)
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "BulkMarkNotificationMessagesSent", reflect.TypeOf((*MockStore)(nil).BulkMarkNotificationMessagesSent), ctx, arg)
 }
 
+// CalculateAIBridgeInterceptionsTelemetrySummary mocks base method.
+func (m *MockStore) CalculateAIBridgeInterceptionsTelemetrySummary(ctx context.Context, arg database.CalculateAIBridgeInterceptionsTelemetrySummaryParams) (database.CalculateAIBridgeInterceptionsTelemetrySummaryRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "CalculateAIBridgeInterceptionsTelemetrySummary", ctx, arg)
+	ret0, _ := ret[0].(database.CalculateAIBridgeInterceptionsTelemetrySummaryRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// CalculateAIBridgeInterceptionsTelemetrySummary indicates an expected call of CalculateAIBridgeInterceptionsTelemetrySummary.
+func (mr *MockStoreMockRecorder) CalculateAIBridgeInterceptionsTelemetrySummary(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "CalculateAIBridgeInterceptionsTelemetrySummary", reflect.TypeOf((*MockStore)(nil).CalculateAIBridgeInterceptionsTelemetrySummary), ctx, arg)
+}
+
 // ClaimPrebuiltWorkspace mocks base method.
 func (m *MockStore) ClaimPrebuiltWorkspace(ctx context.Context, arg database.ClaimPrebuiltWorkspaceParams) (database.ClaimPrebuiltWorkspaceRow, error) {
 	m.ctrl.T.Helper()
@@ -736,6 +751,20 @@ func (mr *MockStoreMockRecorder) DeleteOldProvisionerDaemons(ctx any) *gomock.Ca
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldProvisionerDaemons", reflect.TypeOf((*MockStore)(nil).DeleteOldProvisionerDaemons), ctx)
 }
 
+// DeleteOldTelemetryLocks mocks base method.
+func (m *MockStore) DeleteOldTelemetryLocks(ctx context.Context, periodEndingAtBefore time.Time) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "DeleteOldTelemetryLocks", ctx, periodEndingAtBefore)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// DeleteOldTelemetryLocks indicates an expected call of DeleteOldTelemetryLocks.
+func (mr *MockStoreMockRecorder) DeleteOldTelemetryLocks(ctx, periodEndingAtBefore any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "DeleteOldTelemetryLocks", reflect.TypeOf((*MockStore)(nil).DeleteOldTelemetryLocks), ctx, periodEndingAtBefore)
+}
+
 // DeleteOldWorkspaceAgentLogs mocks base method.
 func (m *MockStore) DeleteOldWorkspaceAgentLogs(ctx context.Context, threshold time.Time) error {
 	m.ctrl.T.Helper()
@@ -5392,6 +5421,20 @@ func (mr *MockStoreMockRecorder) InsertTelemetryItemIfNotExists(ctx, arg any) *g
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertTelemetryItemIfNotExists", reflect.TypeOf((*MockStore)(nil).InsertTelemetryItemIfNotExists), ctx, arg)
 }
 
+// InsertTelemetryLock mocks base method.
+func (m *MockStore) InsertTelemetryLock(ctx context.Context, arg database.InsertTelemetryLockParams) error {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "InsertTelemetryLock", ctx, arg)
+	ret0, _ := ret[0].(error)
+	return ret0
+}
+
+// InsertTelemetryLock indicates an expected call of InsertTelemetryLock.
+func (mr *MockStoreMockRecorder) InsertTelemetryLock(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "InsertTelemetryLock", reflect.TypeOf((*MockStore)(nil).InsertTelemetryLock), ctx, arg)
+}
+
 // InsertTemplate mocks base method.
 func (m *MockStore) InsertTemplate(ctx context.Context, arg database.InsertTemplateParams) error {
 	m.ctrl.T.Helper()
@@ -5847,6 +5890,21 @@ func (mr *MockStoreMockRecorder) ListAIBridgeInterceptions(ctx, arg any) *gomock
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAIBridgeInterceptions", reflect.TypeOf((*MockStore)(nil).ListAIBridgeInterceptions), ctx, arg)
 }
 
+// ListAIBridgeInterceptionsTelemetrySummaries mocks base method.
+func (m *MockStore) ListAIBridgeInterceptionsTelemetrySummaries(ctx context.Context, arg database.ListAIBridgeInterceptionsTelemetrySummariesParams) ([]database.ListAIBridgeInterceptionsTelemetrySummariesRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "ListAIBridgeInterceptionsTelemetrySummaries", ctx, arg)
+	ret0, _ := ret[0].([]database.ListAIBridgeInterceptionsTelemetrySummariesRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// ListAIBridgeInterceptionsTelemetrySummaries indicates an expected call of ListAIBridgeInterceptionsTelemetrySummaries.
+func (mr *MockStoreMockRecorder) ListAIBridgeInterceptionsTelemetrySummaries(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "ListAIBridgeInterceptionsTelemetrySummaries", reflect.TypeOf((*MockStore)(nil).ListAIBridgeInterceptionsTelemetrySummaries), ctx, arg)
+}
+
 // ListAIBridgeTokenUsagesByInterceptionIDs mocks base method.
 func (m *MockStore) ListAIBridgeTokenUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]database.AIBridgeTokenUsage, error) {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/dbpurge/dbpurge.go b/coderd/database/dbpurge/dbpurge.go
index b9e0023f5a6f8..067fe1f0499e3 100644
--- a/coderd/database/dbpurge/dbpurge.go
+++ b/coderd/database/dbpurge/dbpurge.go
@@ -24,6 +24,12 @@ const (
 	// but we won't touch the `connection_logs` table.
 	maxAuditLogConnectionEventAge    = 90 * 24 * time.Hour // 90 days
 	auditLogConnectionEventBatchSize = 1000
+	// Telemetry heartbeats are used to deduplicate events across replicas. We
+	// don't need to persist heartbeat rows for longer than 24 hours, as they
+	// are only used for deduplication across replicas. The time needs to be
+	// long enough to cover the maximum interval of a heartbeat event (currently
+	// 1 hour) plus some buffer.
+	maxTelemetryHeartbeatAge = 24 * time.Hour
 )
 
 // New creates a new periodically purging database instance.
@@ -71,6 +77,10 @@ func New(ctx context.Context, logger slog.Logger, db database.Store, clk quartz.
 			if err := tx.ExpirePrebuildsAPIKeys(ctx, dbtime.Time(start)); err != nil {
 				return xerrors.Errorf("failed to expire prebuilds user api keys: %w", err)
 			}
+			deleteOldTelemetryLocksBefore := start.Add(-maxTelemetryHeartbeatAge)
+			if err := tx.DeleteOldTelemetryLocks(ctx, deleteOldTelemetryLocksBefore); err != nil {
+				return xerrors.Errorf("failed to delete old telemetry locks: %w", err)
+			}
 
 			deleteOldAuditLogConnectionEventsBefore := start.Add(-maxAuditLogConnectionEventAge)
 			if err := tx.DeleteOldAuditLogConnectionEvents(ctx, database.DeleteOldAuditLogConnectionEventsParams{
diff --git a/coderd/database/dbpurge/dbpurge_test.go b/coderd/database/dbpurge/dbpurge_test.go
index 02efd4a81fd14..74bf36639fbb5 100644
--- a/coderd/database/dbpurge/dbpurge_test.go
+++ b/coderd/database/dbpurge/dbpurge_test.go
@@ -704,3 +704,56 @@ func TestExpireOldAPIKeys(t *testing.T) {
 	// Out of an abundance of caution, we do not expire explicitly named prebuilds API keys.
 	assertKeyActive(namedPrebuildsAPIKey.ID)
 }
+
+func TestDeleteOldTelemetryHeartbeats(t *testing.T) {
+	t.Parallel()
+
+	ctx := testutil.Context(t, testutil.WaitLong)
+
+	db, _, sqlDB := dbtestutil.NewDBWithSQLDB(t, dbtestutil.WithDumpOnFailure())
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: true})
+	clk := quartz.NewMock(t)
+	now := clk.Now().UTC()
+
+	// Insert telemetry heartbeats.
+	err := db.InsertTelemetryLock(ctx, database.InsertTelemetryLockParams{
+		EventType:      "aibridge_interceptions_summary",
+		PeriodEndingAt: now.Add(-25 * time.Hour), // should be purged
+	})
+	require.NoError(t, err)
+	err = db.InsertTelemetryLock(ctx, database.InsertTelemetryLockParams{
+		EventType:      "aibridge_interceptions_summary",
+		PeriodEndingAt: now.Add(-23 * time.Hour), // should be kept
+	})
+	require.NoError(t, err)
+	err = db.InsertTelemetryLock(ctx, database.InsertTelemetryLockParams{
+		EventType:      "aibridge_interceptions_summary",
+		PeriodEndingAt: now, // should be kept
+	})
+	require.NoError(t, err)
+
+	done := awaitDoTick(ctx, t, clk)
+	closer := dbpurge.New(ctx, logger, db, clk)
+	defer closer.Close()
+	<-done // doTick() has now run.
+
+	require.Eventuallyf(t, func() bool {
+		// We use an SQL queries directly here because we don't expose queries
+		// for deleting heartbeats in the application code.
+		var totalCount int
+		err := sqlDB.QueryRowContext(ctx, `
+			SELECT COUNT(*) FROM telemetry_locks;
+		`).Scan(&totalCount)
+		assert.NoError(t, err)
+
+		var oldCount int
+		err = sqlDB.QueryRowContext(ctx, `
+			SELECT COUNT(*) FROM telemetry_locks WHERE period_ending_at < $1;
+		`, now.Add(-24*time.Hour)).Scan(&oldCount)
+		assert.NoError(t, err)
+
+		// Expect 2 heartbeats remaining and none older than 24 hours.
+		t.Logf("eventually: total count: %d, old count: %d", totalCount, oldCount)
+		return totalCount == 2 && oldCount == 0
+	}, testutil.WaitShort, testutil.IntervalFast, "it should delete old telemetry heartbeats")
+}
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 17ba8442f42e7..b61b678bba61d 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -2012,6 +2012,18 @@ CREATE TABLE telemetry_items (
     updated_at timestamp with time zone DEFAULT now() NOT NULL
 );
 
+CREATE TABLE telemetry_locks (
+    event_type text NOT NULL,
+    period_ending_at timestamp with time zone NOT NULL,
+    CONSTRAINT telemetry_lock_event_type_constraint CHECK ((event_type = 'aibridge_interceptions_summary'::text))
+);
+
+COMMENT ON TABLE telemetry_locks IS 'Telemetry lock tracking table for deduplication of heartbeat events across replicas.';
+
+COMMENT ON COLUMN telemetry_locks.event_type IS 'The type of event that was sent.';
+
+COMMENT ON COLUMN telemetry_locks.period_ending_at IS 'The heartbeat period end timestamp.';
+
 CREATE TABLE template_usage_stats (
     start_time timestamp with time zone NOT NULL,
     end_time timestamp with time zone NOT NULL,
@@ -3090,6 +3102,9 @@ ALTER TABLE ONLY tasks
 ALTER TABLE ONLY telemetry_items
     ADD CONSTRAINT telemetry_items_pkey PRIMARY KEY (key);
 
+ALTER TABLE ONLY telemetry_locks
+    ADD CONSTRAINT telemetry_locks_pkey PRIMARY KEY (event_type, period_ending_at);
+
 ALTER TABLE ONLY template_usage_stats
     ADD CONSTRAINT template_usage_stats_pkey PRIMARY KEY (start_time, template_id, user_id);
 
@@ -3315,6 +3330,8 @@ CREATE INDEX idx_tailnet_tunnels_dst_id ON tailnet_tunnels USING hash (dst_id);
 
 CREATE INDEX idx_tailnet_tunnels_src_id ON tailnet_tunnels USING hash (src_id);
 
+CREATE INDEX idx_telemetry_locks_period_ending_at ON telemetry_locks USING btree (period_ending_at);
+
 CREATE UNIQUE INDEX idx_template_version_presets_default ON template_version_presets USING btree (template_version_id) WHERE (is_default = true);
 
 CREATE INDEX idx_template_versions_has_ai_task ON template_versions USING btree (has_ai_task);
diff --git a/coderd/database/migrations/000390_telemetry_locks.down.sql b/coderd/database/migrations/000390_telemetry_locks.down.sql
new file mode 100644
index 0000000000000..b9ba97839f3d4
--- /dev/null
+++ b/coderd/database/migrations/000390_telemetry_locks.down.sql
@@ -0,0 +1 @@
+DROP TABLE telemetry_locks;
diff --git a/coderd/database/migrations/000390_telemetry_locks.up.sql b/coderd/database/migrations/000390_telemetry_locks.up.sql
new file mode 100644
index 0000000000000..f791c83ba7d17
--- /dev/null
+++ b/coderd/database/migrations/000390_telemetry_locks.up.sql
@@ -0,0 +1,12 @@
+CREATE TABLE telemetry_locks (
+    event_type TEXT NOT NULL CONSTRAINT telemetry_lock_event_type_constraint CHECK (event_type IN ('aibridge_interceptions_summary')),
+    period_ending_at TIMESTAMP WITH TIME ZONE NOT NULL,
+
+    PRIMARY KEY (event_type, period_ending_at)
+);
+
+COMMENT ON TABLE telemetry_locks IS 'Telemetry lock tracking table for deduplication of heartbeat events across replicas.';
+COMMENT ON COLUMN telemetry_locks.event_type IS 'The type of event that was sent.';
+COMMENT ON COLUMN telemetry_locks.period_ending_at IS 'The heartbeat period end timestamp.';
+
+CREATE INDEX idx_telemetry_locks_period_ending_at ON telemetry_locks (period_ending_at);
diff --git a/coderd/database/migrations/testdata/fixtures/000390_telemetry_locks.up.sql b/coderd/database/migrations/testdata/fixtures/000390_telemetry_locks.up.sql
new file mode 100644
index 0000000000000..f41f45a7325d6
--- /dev/null
+++ b/coderd/database/migrations/testdata/fixtures/000390_telemetry_locks.up.sql
@@ -0,0 +1,8 @@
+INSERT INTO telemetry_locks (
+    event_type,
+    period_ending_at
+)
+VALUES (
+    'aibridge_interceptions_summary',
+    '2025-01-01 00:00:00+00'::timestamptz
+);
diff --git a/coderd/database/models.go b/coderd/database/models.go
index d5db3a3819e17..b3d41b25f9983 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -4250,6 +4250,14 @@ type TelemetryItem struct {
 	UpdatedAt time.Time `db:"updated_at" json:"updated_at"`
 }
 
+// Telemetry lock tracking table for deduplication of heartbeat events across replicas.
+type TelemetryLock struct {
+	// The type of event that was sent.
+	EventType string `db:"event_type" json:"event_type"`
+	// The heartbeat period end timestamp.
+	PeriodEndingAt time.Time `db:"period_ending_at" json:"period_ending_at"`
+}
+
 // Joins in the display name information such as username, avatar, and organization name.
 type Template struct {
 	ID                            uuid.UUID       `db:"id" json:"id"`
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 617959cb5bb5c..2b96823028f61 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -60,6 +60,9 @@ type sqlcQuerier interface {
 	BatchUpdateWorkspaceNextStartAt(ctx context.Context, arg BatchUpdateWorkspaceNextStartAtParams) error
 	BulkMarkNotificationMessagesFailed(ctx context.Context, arg BulkMarkNotificationMessagesFailedParams) (int64, error)
 	BulkMarkNotificationMessagesSent(ctx context.Context, arg BulkMarkNotificationMessagesSentParams) (int64, error)
+	// Calculates the telemetry summary for a given provider, model, and client
+	// combination for telemetry reporting.
+	CalculateAIBridgeInterceptionsTelemetrySummary(ctx context.Context, arg CalculateAIBridgeInterceptionsTelemetrySummaryParams) (CalculateAIBridgeInterceptionsTelemetrySummaryRow, error)
 	ClaimPrebuiltWorkspace(ctx context.Context, arg ClaimPrebuiltWorkspaceParams) (ClaimPrebuiltWorkspaceRow, error)
 	CleanTailnetCoordinators(ctx context.Context) error
 	CleanTailnetLostPeers(ctx context.Context) error
@@ -107,6 +110,8 @@ type sqlcQuerier interface {
 	// A provisioner daemon with "zeroed" last_seen_at column indicates possible
 	// connectivity issues (no provisioner daemon activity since registration).
 	DeleteOldProvisionerDaemons(ctx context.Context) error
+	// Deletes old telemetry locks from the telemetry_locks table.
+	DeleteOldTelemetryLocks(ctx context.Context, periodEndingAtBefore time.Time) error
 	// If an agent hasn't connected in the last 7 days, we purge it's logs.
 	// Exception: if the logs are related to the latest build, we keep those around.
 	// Logs can take up a lot of space, so it's important we clean up frequently.
@@ -559,6 +564,12 @@ type sqlcQuerier interface {
 	InsertReplica(ctx context.Context, arg InsertReplicaParams) (Replica, error)
 	InsertTask(ctx context.Context, arg InsertTaskParams) (TaskTable, error)
 	InsertTelemetryItemIfNotExists(ctx context.Context, arg InsertTelemetryItemIfNotExistsParams) error
+	// Inserts a new lock row into the telemetry_locks table. Replicas should call
+	// this function prior to attempting to generate or publish a heartbeat event to
+	// the telemetry service.
+	// If the query returns a duplicate primary key error, the replica should not
+	// attempt to generate or publish the event to the telemetry service.
+	InsertTelemetryLock(ctx context.Context, arg InsertTelemetryLockParams) error
 	InsertTemplate(ctx context.Context, arg InsertTemplateParams) error
 	InsertTemplateVersion(ctx context.Context, arg InsertTemplateVersionParams) error
 	InsertTemplateVersionParameter(ctx context.Context, arg InsertTemplateVersionParameterParams) (TemplateVersionParameter, error)
@@ -595,6 +606,9 @@ type sqlcQuerier interface {
 	InsertWorkspaceResource(ctx context.Context, arg InsertWorkspaceResourceParams) (WorkspaceResource, error)
 	InsertWorkspaceResourceMetadata(ctx context.Context, arg InsertWorkspaceResourceMetadataParams) ([]WorkspaceResourceMetadatum, error)
 	ListAIBridgeInterceptions(ctx context.Context, arg ListAIBridgeInterceptionsParams) ([]ListAIBridgeInterceptionsRow, error)
+	// Finds all unique AIBridge interception telemetry summaries combinations
+	// (provider, model, client) in the given timeframe for telemetry reporting.
+	ListAIBridgeInterceptionsTelemetrySummaries(ctx context.Context, arg ListAIBridgeInterceptionsTelemetrySummariesParams) ([]ListAIBridgeInterceptionsTelemetrySummariesRow, error)
 	ListAIBridgeTokenUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeTokenUsage, error)
 	ListAIBridgeToolUsagesByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeToolUsage, error)
 	ListAIBridgeUserPromptsByInterceptionIDs(ctx context.Context, interceptionIds []uuid.UUID) ([]AIBridgeUserPrompt, error)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index d7bb027628fd5..e6dfa9afd0919 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -111,6 +111,164 @@ func (q *sqlQuerier) ActivityBumpWorkspace(ctx context.Context, arg ActivityBump
 	return err
 }
 
+const calculateAIBridgeInterceptionsTelemetrySummary = `-- name: CalculateAIBridgeInterceptionsTelemetrySummary :one
+WITH interceptions_in_range AS (
+    -- Get all matching interceptions in the given timeframe.
+    SELECT
+        id,
+        initiator_id,
+        (ended_at - started_at) AS duration
+    FROM
+        aibridge_interceptions
+    WHERE
+        provider = $1::text
+        AND model = $2::text
+        -- TODO: use the client value once we have it (see https://github.com/coder/aibridge/issues/31)
+        AND 'unknown' = $3::text
+        AND ended_at IS NOT NULL -- incomplete interceptions are not included in summaries
+        AND ended_at >= $4::timestamptz
+        AND ended_at < $5::timestamptz
+),
+interception_counts AS (
+    SELECT
+        COUNT(id) AS interception_count,
+        COUNT(DISTINCT initiator_id) AS unique_initiator_count
+    FROM
+        interceptions_in_range
+),
+duration_percentiles AS (
+    SELECT
+        (COALESCE(PERCENTILE_CONT(0.50) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p50_millis,
+        (COALESCE(PERCENTILE_CONT(0.90) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p90_millis,
+        (COALESCE(PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p95_millis,
+        (COALESCE(PERCENTILE_CONT(0.99) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p99_millis
+    FROM
+        interceptions_in_range
+),
+token_aggregates AS (
+    SELECT
+        COALESCE(SUM(tu.input_tokens), 0) AS token_count_input,
+        COALESCE(SUM(tu.output_tokens), 0) AS token_count_output,
+        -- Cached tokens are stored in metadata JSON, extract if available.
+        -- Read tokens may be stored in:
+        -- - cache_read_input (Anthropic)
+        -- - prompt_cached (OpenAI)
+        COALESCE(SUM(
+            COALESCE((tu.metadata->>'cache_read_input')::bigint, 0) +
+            COALESCE((tu.metadata->>'prompt_cached')::bigint, 0)
+        ), 0) AS token_count_cached_read,
+        -- Written tokens may be stored in:
+        -- - cache_creation_input (Anthropic)
+        -- Note that cache_ephemeral_5m_input and cache_ephemeral_1h_input on
+        -- Anthropic are included in the cache_creation_input field.
+        COALESCE(SUM(
+            COALESCE((tu.metadata->>'cache_creation_input')::bigint, 0)
+        ), 0) AS token_count_cached_written,
+        COUNT(tu.id) AS token_usages_count
+    FROM
+        interceptions_in_range i
+    LEFT JOIN
+        aibridge_token_usages tu ON i.id = tu.interception_id
+),
+prompt_aggregates AS (
+    SELECT
+        COUNT(up.id) AS user_prompts_count
+    FROM
+        interceptions_in_range i
+    LEFT JOIN
+        aibridge_user_prompts up ON i.id = up.interception_id
+),
+tool_aggregates AS (
+    SELECT
+        COUNT(tu.id) FILTER (WHERE tu.injected = true) AS tool_calls_count_injected,
+        COUNT(tu.id) FILTER (WHERE tu.injected = false) AS tool_calls_count_non_injected,
+        COUNT(tu.id) FILTER (WHERE tu.injected = true AND tu.invocation_error IS NOT NULL) AS injected_tool_call_error_count
+    FROM
+        interceptions_in_range i
+    LEFT JOIN
+        aibridge_tool_usages tu ON i.id = tu.interception_id
+)
+SELECT
+    ic.interception_count::bigint AS interception_count,
+    dp.interception_duration_p50_millis::bigint AS interception_duration_p50_millis,
+    dp.interception_duration_p90_millis::bigint AS interception_duration_p90_millis,
+    dp.interception_duration_p95_millis::bigint AS interception_duration_p95_millis,
+    dp.interception_duration_p99_millis::bigint AS interception_duration_p99_millis,
+    ic.unique_initiator_count::bigint AS unique_initiator_count,
+    pa.user_prompts_count::bigint AS user_prompts_count,
+    tok_agg.token_usages_count::bigint AS token_usages_count,
+    tok_agg.token_count_input::bigint AS token_count_input,
+    tok_agg.token_count_output::bigint AS token_count_output,
+    tok_agg.token_count_cached_read::bigint AS token_count_cached_read,
+    tok_agg.token_count_cached_written::bigint AS token_count_cached_written,
+    tool_agg.tool_calls_count_injected::bigint AS tool_calls_count_injected,
+    tool_agg.tool_calls_count_non_injected::bigint AS tool_calls_count_non_injected,
+    tool_agg.injected_tool_call_error_count::bigint AS injected_tool_call_error_count
+FROM
+    interception_counts ic,
+    duration_percentiles dp,
+    token_aggregates tok_agg,
+    prompt_aggregates pa,
+    tool_aggregates tool_agg
+`
+
+type CalculateAIBridgeInterceptionsTelemetrySummaryParams struct {
+	Provider      string    `db:"provider" json:"provider"`
+	Model         string    `db:"model" json:"model"`
+	Client        string    `db:"client" json:"client"`
+	EndedAtAfter  time.Time `db:"ended_at_after" json:"ended_at_after"`
+	EndedAtBefore time.Time `db:"ended_at_before" json:"ended_at_before"`
+}
+
+type CalculateAIBridgeInterceptionsTelemetrySummaryRow struct {
+	InterceptionCount             int64 `db:"interception_count" json:"interception_count"`
+	InterceptionDurationP50Millis int64 `db:"interception_duration_p50_millis" json:"interception_duration_p50_millis"`
+	InterceptionDurationP90Millis int64 `db:"interception_duration_p90_millis" json:"interception_duration_p90_millis"`
+	InterceptionDurationP95Millis int64 `db:"interception_duration_p95_millis" json:"interception_duration_p95_millis"`
+	InterceptionDurationP99Millis int64 `db:"interception_duration_p99_millis" json:"interception_duration_p99_millis"`
+	UniqueInitiatorCount          int64 `db:"unique_initiator_count" json:"unique_initiator_count"`
+	UserPromptsCount              int64 `db:"user_prompts_count" json:"user_prompts_count"`
+	TokenUsagesCount              int64 `db:"token_usages_count" json:"token_usages_count"`
+	TokenCountInput               int64 `db:"token_count_input" json:"token_count_input"`
+	TokenCountOutput              int64 `db:"token_count_output" json:"token_count_output"`
+	TokenCountCachedRead          int64 `db:"token_count_cached_read" json:"token_count_cached_read"`
+	TokenCountCachedWritten       int64 `db:"token_count_cached_written" json:"token_count_cached_written"`
+	ToolCallsCountInjected        int64 `db:"tool_calls_count_injected" json:"tool_calls_count_injected"`
+	ToolCallsCountNonInjected     int64 `db:"tool_calls_count_non_injected" json:"tool_calls_count_non_injected"`
+	InjectedToolCallErrorCount    int64 `db:"injected_tool_call_error_count" json:"injected_tool_call_error_count"`
+}
+
+// Calculates the telemetry summary for a given provider, model, and client
+// combination for telemetry reporting.
+func (q *sqlQuerier) CalculateAIBridgeInterceptionsTelemetrySummary(ctx context.Context, arg CalculateAIBridgeInterceptionsTelemetrySummaryParams) (CalculateAIBridgeInterceptionsTelemetrySummaryRow, error) {
+	row := q.db.QueryRowContext(ctx, calculateAIBridgeInterceptionsTelemetrySummary,
+		arg.Provider,
+		arg.Model,
+		arg.Client,
+		arg.EndedAtAfter,
+		arg.EndedAtBefore,
+	)
+	var i CalculateAIBridgeInterceptionsTelemetrySummaryRow
+	err := row.Scan(
+		&i.InterceptionCount,
+		&i.InterceptionDurationP50Millis,
+		&i.InterceptionDurationP90Millis,
+		&i.InterceptionDurationP95Millis,
+		&i.InterceptionDurationP99Millis,
+		&i.UniqueInitiatorCount,
+		&i.UserPromptsCount,
+		&i.TokenUsagesCount,
+		&i.TokenCountInput,
+		&i.TokenCountOutput,
+		&i.TokenCountCachedRead,
+		&i.TokenCountCachedWritten,
+		&i.ToolCallsCountInjected,
+		&i.ToolCallsCountNonInjected,
+		&i.InjectedToolCallErrorCount,
+	)
+	return i, err
+}
+
 const countAIBridgeInterceptions = `-- name: CountAIBridgeInterceptions :one
 SELECT
 	COUNT(*)
@@ -647,6 +805,57 @@ func (q *sqlQuerier) ListAIBridgeInterceptions(ctx context.Context, arg ListAIBr
 	return items, nil
 }
 
+const listAIBridgeInterceptionsTelemetrySummaries = `-- name: ListAIBridgeInterceptionsTelemetrySummaries :many
+SELECT
+    DISTINCT ON (provider, model, client)
+    provider,
+    model,
+    -- TODO: use the client value once we have it (see https://github.com/coder/aibridge/issues/31)
+    'unknown' AS client
+FROM
+    aibridge_interceptions
+WHERE
+    ended_at IS NOT NULL -- incomplete interceptions are not included in summaries
+    AND ended_at >= $1::timestamptz
+    AND ended_at < $2::timestamptz
+`
+
+type ListAIBridgeInterceptionsTelemetrySummariesParams struct {
+	EndedAtAfter  time.Time `db:"ended_at_after" json:"ended_at_after"`
+	EndedAtBefore time.Time `db:"ended_at_before" json:"ended_at_before"`
+}
+
+type ListAIBridgeInterceptionsTelemetrySummariesRow struct {
+	Provider string `db:"provider" json:"provider"`
+	Model    string `db:"model" json:"model"`
+	Client   string `db:"client" json:"client"`
+}
+
+// Finds all unique AIBridge interception telemetry summaries combinations
+// (provider, model, client) in the given timeframe for telemetry reporting.
+func (q *sqlQuerier) ListAIBridgeInterceptionsTelemetrySummaries(ctx context.Context, arg ListAIBridgeInterceptionsTelemetrySummariesParams) ([]ListAIBridgeInterceptionsTelemetrySummariesRow, error) {
+	rows, err := q.db.QueryContext(ctx, listAIBridgeInterceptionsTelemetrySummaries, arg.EndedAtAfter, arg.EndedAtBefore)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []ListAIBridgeInterceptionsTelemetrySummariesRow
+	for rows.Next() {
+		var i ListAIBridgeInterceptionsTelemetrySummariesRow
+		if err := rows.Scan(&i.Provider, &i.Model, &i.Client); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const listAIBridgeTokenUsagesByInterceptionIDs = `-- name: ListAIBridgeTokenUsagesByInterceptionIDs :many
 SELECT
 	id, interception_id, provider_response_id, input_tokens, output_tokens, metadata, created_at
@@ -13064,6 +13273,41 @@ func (q *sqlQuerier) UpsertTelemetryItem(ctx context.Context, arg UpsertTelemetr
 	return err
 }
 
+const deleteOldTelemetryLocks = `-- name: DeleteOldTelemetryLocks :exec
+DELETE FROM
+    telemetry_locks
+WHERE
+    period_ending_at < $1::timestamptz
+`
+
+// Deletes old telemetry locks from the telemetry_locks table.
+func (q *sqlQuerier) DeleteOldTelemetryLocks(ctx context.Context, periodEndingAtBefore time.Time) error {
+	_, err := q.db.ExecContext(ctx, deleteOldTelemetryLocks, periodEndingAtBefore)
+	return err
+}
+
+const insertTelemetryLock = `-- name: InsertTelemetryLock :exec
+INSERT INTO
+    telemetry_locks (event_type, period_ending_at)
+VALUES
+    ($1, $2)
+`
+
+type InsertTelemetryLockParams struct {
+	EventType      string    `db:"event_type" json:"event_type"`
+	PeriodEndingAt time.Time `db:"period_ending_at" json:"period_ending_at"`
+}
+
+// Inserts a new lock row into the telemetry_locks table. Replicas should call
+// this function prior to attempting to generate or publish a heartbeat event to
+// the telemetry service.
+// If the query returns a duplicate primary key error, the replica should not
+// attempt to generate or publish the event to the telemetry service.
+func (q *sqlQuerier) InsertTelemetryLock(ctx context.Context, arg InsertTelemetryLockParams) error {
+	_, err := q.db.ExecContext(ctx, insertTelemetryLock, arg.EventType, arg.PeriodEndingAt)
+	return err
+}
+
 const getTemplateAverageBuildTime = `-- name: GetTemplateAverageBuildTime :one
 WITH build_times AS (
 SELECT
diff --git a/coderd/database/queries/aibridge.sql b/coderd/database/queries/aibridge.sql
index e32eb0ec29e3b..fd5a9868bbaa8 100644
--- a/coderd/database/queries/aibridge.sql
+++ b/coderd/database/queries/aibridge.sql
@@ -207,3 +207,122 @@ WHERE
 ORDER BY
 	created_at ASC,
 	id ASC;
+
+-- name: ListAIBridgeInterceptionsTelemetrySummaries :many
+-- Finds all unique AIBridge interception telemetry summaries combinations
+-- (provider, model, client) in the given timeframe for telemetry reporting.
+SELECT
+    DISTINCT ON (provider, model, client)
+    provider,
+    model,
+    -- TODO: use the client value once we have it (see https://github.com/coder/aibridge/issues/31)
+    'unknown' AS client
+FROM
+    aibridge_interceptions
+WHERE
+    ended_at IS NOT NULL -- incomplete interceptions are not included in summaries
+    AND ended_at >= @ended_at_after::timestamptz
+    AND ended_at < @ended_at_before::timestamptz;
+
+-- name: CalculateAIBridgeInterceptionsTelemetrySummary :one
+-- Calculates the telemetry summary for a given provider, model, and client
+-- combination for telemetry reporting.
+WITH interceptions_in_range AS (
+    -- Get all matching interceptions in the given timeframe.
+    SELECT
+        id,
+        initiator_id,
+        (ended_at - started_at) AS duration
+    FROM
+        aibridge_interceptions
+    WHERE
+        provider = @provider::text
+        AND model = @model::text
+        -- TODO: use the client value once we have it (see https://github.com/coder/aibridge/issues/31)
+        AND 'unknown' = @client::text
+        AND ended_at IS NOT NULL -- incomplete interceptions are not included in summaries
+        AND ended_at >= @ended_at_after::timestamptz
+        AND ended_at < @ended_at_before::timestamptz
+),
+interception_counts AS (
+    SELECT
+        COUNT(id) AS interception_count,
+        COUNT(DISTINCT initiator_id) AS unique_initiator_count
+    FROM
+        interceptions_in_range
+),
+duration_percentiles AS (
+    SELECT
+        (COALESCE(PERCENTILE_CONT(0.50) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p50_millis,
+        (COALESCE(PERCENTILE_CONT(0.90) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p90_millis,
+        (COALESCE(PERCENTILE_CONT(0.95) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p95_millis,
+        (COALESCE(PERCENTILE_CONT(0.99) WITHIN GROUP (ORDER BY EXTRACT(EPOCH FROM duration)), 0) * 1000)::bigint AS interception_duration_p99_millis
+    FROM
+        interceptions_in_range
+),
+token_aggregates AS (
+    SELECT
+        COALESCE(SUM(tu.input_tokens), 0) AS token_count_input,
+        COALESCE(SUM(tu.output_tokens), 0) AS token_count_output,
+        -- Cached tokens are stored in metadata JSON, extract if available.
+        -- Read tokens may be stored in:
+        -- - cache_read_input (Anthropic)
+        -- - prompt_cached (OpenAI)
+        COALESCE(SUM(
+            COALESCE((tu.metadata->>'cache_read_input')::bigint, 0) +
+            COALESCE((tu.metadata->>'prompt_cached')::bigint, 0)
+        ), 0) AS token_count_cached_read,
+        -- Written tokens may be stored in:
+        -- - cache_creation_input (Anthropic)
+        -- Note that cache_ephemeral_5m_input and cache_ephemeral_1h_input on
+        -- Anthropic are included in the cache_creation_input field.
+        COALESCE(SUM(
+            COALESCE((tu.metadata->>'cache_creation_input')::bigint, 0)
+        ), 0) AS token_count_cached_written,
+        COUNT(tu.id) AS token_usages_count
+    FROM
+        interceptions_in_range i
+    LEFT JOIN
+        aibridge_token_usages tu ON i.id = tu.interception_id
+),
+prompt_aggregates AS (
+    SELECT
+        COUNT(up.id) AS user_prompts_count
+    FROM
+        interceptions_in_range i
+    LEFT JOIN
+        aibridge_user_prompts up ON i.id = up.interception_id
+),
+tool_aggregates AS (
+    SELECT
+        COUNT(tu.id) FILTER (WHERE tu.injected = true) AS tool_calls_count_injected,
+        COUNT(tu.id) FILTER (WHERE tu.injected = false) AS tool_calls_count_non_injected,
+        COUNT(tu.id) FILTER (WHERE tu.injected = true AND tu.invocation_error IS NOT NULL) AS injected_tool_call_error_count
+    FROM
+        interceptions_in_range i
+    LEFT JOIN
+        aibridge_tool_usages tu ON i.id = tu.interception_id
+)
+SELECT
+    ic.interception_count::bigint AS interception_count,
+    dp.interception_duration_p50_millis::bigint AS interception_duration_p50_millis,
+    dp.interception_duration_p90_millis::bigint AS interception_duration_p90_millis,
+    dp.interception_duration_p95_millis::bigint AS interception_duration_p95_millis,
+    dp.interception_duration_p99_millis::bigint AS interception_duration_p99_millis,
+    ic.unique_initiator_count::bigint AS unique_initiator_count,
+    pa.user_prompts_count::bigint AS user_prompts_count,
+    tok_agg.token_usages_count::bigint AS token_usages_count,
+    tok_agg.token_count_input::bigint AS token_count_input,
+    tok_agg.token_count_output::bigint AS token_count_output,
+    tok_agg.token_count_cached_read::bigint AS token_count_cached_read,
+    tok_agg.token_count_cached_written::bigint AS token_count_cached_written,
+    tool_agg.tool_calls_count_injected::bigint AS tool_calls_count_injected,
+    tool_agg.tool_calls_count_non_injected::bigint AS tool_calls_count_non_injected,
+    tool_agg.injected_tool_call_error_count::bigint AS injected_tool_call_error_count
+FROM
+    interception_counts ic,
+    duration_percentiles dp,
+    token_aggregates tok_agg,
+    prompt_aggregates pa,
+    tool_aggregates tool_agg
+;
diff --git a/coderd/database/queries/telemetrylocks.sql b/coderd/database/queries/telemetrylocks.sql
new file mode 100644
index 0000000000000..14e9730a69394
--- /dev/null
+++ b/coderd/database/queries/telemetrylocks.sql
@@ -0,0 +1,17 @@
+-- name: InsertTelemetryLock :exec
+-- Inserts a new lock row into the telemetry_locks table. Replicas should call
+-- this function prior to attempting to generate or publish a heartbeat event to
+-- the telemetry service.
+-- If the query returns a duplicate primary key error, the replica should not
+-- attempt to generate or publish the event to the telemetry service.
+INSERT INTO
+    telemetry_locks (event_type, period_ending_at)
+VALUES
+    ($1, $2);
+
+-- name: DeleteOldTelemetryLocks :exec
+-- Deletes old telemetry locks from the telemetry_locks table.
+DELETE FROM
+    telemetry_locks
+WHERE
+    period_ending_at < @period_ending_at_before::timestamptz;
diff --git a/coderd/database/unique_constraint.go b/coderd/database/unique_constraint.go
index 03e2efa0931d2..b804d9a73071e 100644
--- a/coderd/database/unique_constraint.go
+++ b/coderd/database/unique_constraint.go
@@ -62,6 +62,7 @@ const (
 	UniqueTaskWorkspaceAppsPkey                               UniqueConstraint = "task_workspace_apps_pkey"                                        // ALTER TABLE ONLY task_workspace_apps ADD CONSTRAINT task_workspace_apps_pkey PRIMARY KEY (task_id, workspace_build_number);
 	UniqueTasksPkey                                           UniqueConstraint = "tasks_pkey"                                                      // ALTER TABLE ONLY tasks ADD CONSTRAINT tasks_pkey PRIMARY KEY (id);
 	UniqueTelemetryItemsPkey                                  UniqueConstraint = "telemetry_items_pkey"                                            // ALTER TABLE ONLY telemetry_items ADD CONSTRAINT telemetry_items_pkey PRIMARY KEY (key);
+	UniqueTelemetryLocksPkey                                  UniqueConstraint = "telemetry_locks_pkey"                                            // ALTER TABLE ONLY telemetry_locks ADD CONSTRAINT telemetry_locks_pkey PRIMARY KEY (event_type, period_ending_at);
 	UniqueTemplateUsageStatsPkey                              UniqueConstraint = "template_usage_stats_pkey"                                       // ALTER TABLE ONLY template_usage_stats ADD CONSTRAINT template_usage_stats_pkey PRIMARY KEY (start_time, template_id, user_id);
 	UniqueTemplateVersionParametersTemplateVersionIDNameKey   UniqueConstraint = "template_version_parameters_template_version_id_name_key"        // ALTER TABLE ONLY template_version_parameters ADD CONSTRAINT template_version_parameters_template_version_id_name_key UNIQUE (template_version_id, name);
 	UniqueTemplateVersionPresetParametersPkey                 UniqueConstraint = "template_version_preset_parameters_pkey"                         // ALTER TABLE ONLY template_version_preset_parameters ADD CONSTRAINT template_version_preset_parameters_pkey PRIMARY KEY (id);
diff --git a/coderd/telemetry/telemetry.go b/coderd/telemetry/telemetry.go
index 1526f51f167e8..19873f99eeb2f 100644
--- a/coderd/telemetry/telemetry.go
+++ b/coderd/telemetry/telemetry.go
@@ -28,7 +28,6 @@ import (
 	"google.golang.org/protobuf/types/known/wrapperspb"
 
 	"cdr.dev/slog"
-
 	"github.com/coder/coder/v2/buildinfo"
 	clitelemetry "github.com/coder/coder/v2/cli/telemetry"
 	"github.com/coder/coder/v2/coderd/database"
@@ -36,6 +35,7 @@ import (
 	"github.com/coder/coder/v2/coderd/util/ptr"
 	"github.com/coder/coder/v2/codersdk"
 	tailnetproto "github.com/coder/coder/v2/tailnet/proto"
+	"github.com/coder/quartz"
 )
 
 const (
@@ -48,6 +48,7 @@ type Options struct {
 	Disabled bool
 	Database database.Store
 	Logger   slog.Logger
+	Clock    quartz.Clock
 	// URL is an endpoint to direct telemetry towards!
 	URL         *url.URL
 	Experiments codersdk.Experiments
@@ -65,6 +66,9 @@ type Options struct {
 // Duplicate data will be sent, it's on the server-side to index by UUID.
 // Data is anonymized prior to being sent!
 func New(options Options) (Reporter, error) {
+	if options.Clock == nil {
+		options.Clock = quartz.NewReal()
+	}
 	if options.SnapshotFrequency == 0 {
 		// Report once every 30mins by default!
 		options.SnapshotFrequency = 30 * time.Minute
@@ -86,7 +90,7 @@ func New(options Options) (Reporter, error) {
 		options:       options,
 		deploymentURL: deploymentURL,
 		snapshotURL:   snapshotURL,
-		startedAt:     dbtime.Now(),
+		startedAt:     dbtime.Time(options.Clock.Now()).UTC(),
 		client:        &http.Client{},
 	}
 	go reporter.runSnapshotter()
@@ -166,7 +170,7 @@ func (r *remoteReporter) Close() {
 		return
 	}
 	close(r.closed)
-	now := dbtime.Now()
+	now := dbtime.Time(r.options.Clock.Now()).UTC()
 	r.shutdownAt = &now
 	if r.Enabled() {
 		// Report a final collection of telemetry prior to close!
@@ -412,7 +416,7 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 		ctx = r.ctx
 		// For resources that grow in size very quickly (like workspace builds),
 		// we only report events that occurred within the past hour.
-		createdAfter = dbtime.Now().Add(-1 * time.Hour)
+		createdAfter = dbtime.Time(r.options.Clock.Now().Add(-1 * time.Hour)).UTC()
 		eg           errgroup.Group
 		snapshot     = &Snapshot{
 			DeploymentID: r.options.DeploymentID,
@@ -744,6 +748,14 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 		}
 		return nil
 	})
+	eg.Go(func() error {
+		summaries, err := r.generateAIBridgeInterceptionsSummaries(ctx)
+		if err != nil {
+			return xerrors.Errorf("generate AIBridge interceptions telemetry summaries: %w", err)
+		}
+		snapshot.AIBridgeInterceptionsSummaries = summaries
+		return nil
+	})
 
 	err := eg.Wait()
 	if err != nil {
@@ -752,6 +764,76 @@ func (r *remoteReporter) createSnapshot() (*Snapshot, error) {
 	return snapshot, nil
 }
 
+func (r *remoteReporter) generateAIBridgeInterceptionsSummaries(ctx context.Context) ([]AIBridgeInterceptionsSummary, error) {
+	// Get the current timeframe, which is the previous hour.
+	now := dbtime.Time(r.options.Clock.Now()).UTC()
+	endedAtBefore := now.Truncate(time.Hour)
+	endedAtAfter := endedAtBefore.Add(-1 * time.Hour)
+
+	// Note: we don't use a transaction for this function since we do tolerate
+	// some errors, like duplicate lock rows, and we also calculate
+	// summaries in parallel.
+
+	// Claim the heartbeat lock row for this hour.
+	err := r.options.Database.InsertTelemetryLock(ctx, database.InsertTelemetryLockParams{
+		EventType:      "aibridge_interceptions_summary",
+		PeriodEndingAt: endedAtBefore,
+	})
+	if database.IsUniqueViolation(err, database.UniqueTelemetryLocksPkey) {
+		// Another replica has already claimed the lock row for this hour.
+		r.options.Logger.Debug(ctx, "aibridge interceptions telemetry lock already claimed for this hour by another replica, skipping", slog.F("period_ending_at", endedAtBefore))
+		return nil, nil
+	}
+	if err != nil {
+		return nil, xerrors.Errorf("insert AIBridge interceptions telemetry lock (period_ending_at=%q): %w", endedAtBefore, err)
+	}
+
+	// List the summary categories that need to be calculated.
+	summaryCategories, err := r.options.Database.ListAIBridgeInterceptionsTelemetrySummaries(ctx, database.ListAIBridgeInterceptionsTelemetrySummariesParams{
+		EndedAtAfter:  endedAtAfter,  // inclusive
+		EndedAtBefore: endedAtBefore, // exclusive
+	})
+	if err != nil {
+		return nil, xerrors.Errorf("list AIBridge interceptions telemetry summaries (startedAtAfter=%q, endedAtBefore=%q): %w", endedAtAfter, endedAtBefore, err)
+	}
+
+	// Calculate and convert the summaries for all categories.
+	var (
+		eg, egCtx = errgroup.WithContext(ctx)
+		mu        sync.Mutex
+		summaries = make([]AIBridgeInterceptionsSummary, 0, len(summaryCategories))
+	)
+	for _, category := range summaryCategories {
+		eg.Go(func() error {
+			summary, err := r.options.Database.CalculateAIBridgeInterceptionsTelemetrySummary(egCtx, database.CalculateAIBridgeInterceptionsTelemetrySummaryParams{
+				Provider:      category.Provider,
+				Model:         category.Model,
+				Client:        category.Client,
+				EndedAtAfter:  endedAtAfter,
+				EndedAtBefore: endedAtBefore,
+			})
+			if err != nil {
+				return xerrors.Errorf("calculate AIBridge interceptions telemetry summary (provider=%q, model=%q, client=%q, startedAtAfter=%q, endedAtBefore=%q): %w", category.Provider, category.Model, category.Client, endedAtAfter, endedAtBefore, err)
+			}
+
+			// Double check that at least one interception was found in the
+			// timeframe.
+			if summary.InterceptionCount == 0 {
+				return nil
+			}
+
+			converted := ConvertAIBridgeInterceptionsSummary(endedAtBefore, category.Provider, category.Model, category.Client, summary)
+
+			mu.Lock()
+			defer mu.Unlock()
+			summaries = append(summaries, converted)
+			return nil
+		})
+	}
+
+	return summaries, eg.Wait()
+}
+
 // ConvertAPIKey anonymizes an API key.
 func ConvertAPIKey(apiKey database.APIKey) APIKey {
 	a := APIKey{
@@ -1223,6 +1305,7 @@ type Snapshot struct {
 	TelemetryItems                       []TelemetryItem                       `json:"telemetry_items"`
 	UserTailnetConnections               []UserTailnetConnection               `json:"user_tailnet_connections"`
 	PrebuiltWorkspaces                   []PrebuiltWorkspace                   `json:"prebuilt_workspaces"`
+	AIBridgeInterceptionsSummaries       []AIBridgeInterceptionsSummary        `json:"aibridge_interceptions_summaries"`
 }
 
 // Deployment contains information about the host running Coder.
@@ -1859,6 +1942,89 @@ type PrebuiltWorkspace struct {
 	Count     int                        `json:"count"`
 }
 
+type AIBridgeInterceptionsSummaryDurationMillis struct {
+	P50 int64 `json:"p50"`
+	P90 int64 `json:"p90"`
+	P95 int64 `json:"p95"`
+	P99 int64 `json:"p99"`
+}
+
+type AIBridgeInterceptionsSummaryTokenCount struct {
+	Input         int64 `json:"input"`
+	Output        int64 `json:"output"`
+	CachedRead    int64 `json:"cached_read"`
+	CachedWritten int64 `json:"cached_written"`
+}
+
+type AIBridgeInterceptionsSummaryToolCallsCount struct {
+	Injected    int64 `json:"injected"`
+	NonInjected int64 `json:"non_injected"`
+}
+
+// AIBridgeInterceptionsSummary is a summary of aggregated AI Bridge
+// interception data over a period of 1 hour. We send a summary each hour for
+// each unique provider + model + client combination.
+type AIBridgeInterceptionsSummary struct {
+	ID uuid.UUID `json:"id"`
+
+	// The end of the hour for which the summary is taken. This will always be a
+	// UTC timestamp truncated to the hour.
+	Timestamp time.Time `json:"timestamp"`
+	Provider  string    `json:"provider"`
+	Model     string    `json:"model"`
+	Client    string    `json:"client"`
+
+	InterceptionCount          int64                                      `json:"interception_count"`
+	InterceptionDurationMillis AIBridgeInterceptionsSummaryDurationMillis `json:"interception_duration_millis"`
+
+	// Map of route to number of interceptions.
+	// e.g. "/v1/chat/completions:blocking", "/v1/chat/completions:streaming"
+	InterceptionsByRoute map[string]int64 `json:"interceptions_by_route"`
+
+	UniqueInitiatorCount int64 `json:"unique_initiator_count"`
+
+	UserPromptsCount int64 `json:"user_prompts_count"`
+
+	TokenUsagesCount int64                                  `json:"token_usages_count"`
+	TokenCount       AIBridgeInterceptionsSummaryTokenCount `json:"token_count"`
+
+	ToolCallsCount             AIBridgeInterceptionsSummaryToolCallsCount `json:"tool_calls_count"`
+	InjectedToolCallErrorCount int64                                      `json:"injected_tool_call_error_count"`
+}
+
+func ConvertAIBridgeInterceptionsSummary(endTime time.Time, provider, model, client string, summary database.CalculateAIBridgeInterceptionsTelemetrySummaryRow) AIBridgeInterceptionsSummary {
+	return AIBridgeInterceptionsSummary{
+		ID:                uuid.New(),
+		Timestamp:         endTime,
+		Provider:          provider,
+		Model:             model,
+		Client:            client,
+		InterceptionCount: summary.InterceptionCount,
+		InterceptionDurationMillis: AIBridgeInterceptionsSummaryDurationMillis{
+			P50: summary.InterceptionDurationP50Millis,
+			P90: summary.InterceptionDurationP90Millis,
+			P95: summary.InterceptionDurationP95Millis,
+			P99: summary.InterceptionDurationP99Millis,
+		},
+		// TODO: currently we don't track by route
+		InterceptionsByRoute: make(map[string]int64),
+		UniqueInitiatorCount: summary.UniqueInitiatorCount,
+		UserPromptsCount:     summary.UserPromptsCount,
+		TokenUsagesCount:     summary.TokenUsagesCount,
+		TokenCount: AIBridgeInterceptionsSummaryTokenCount{
+			Input:         summary.TokenCountInput,
+			Output:        summary.TokenCountOutput,
+			CachedRead:    summary.TokenCountCachedRead,
+			CachedWritten: summary.TokenCountCachedWritten,
+		},
+		ToolCallsCount: AIBridgeInterceptionsSummaryToolCallsCount{
+			Injected:    summary.ToolCallsCountInjected,
+			NonInjected: summary.ToolCallsCountNonInjected,
+		},
+		InjectedToolCallErrorCount: summary.InjectedToolCallErrorCount,
+	}
+}
+
 type noopReporter struct{}
 
 func (*noopReporter) Report(_ *Snapshot)            {}
diff --git a/coderd/telemetry/telemetry_test.go b/coderd/telemetry/telemetry_test.go
index a48bdee299658..dede229acdacf 100644
--- a/coderd/telemetry/telemetry_test.go
+++ b/coderd/telemetry/telemetry_test.go
@@ -28,6 +28,7 @@ import (
 	"github.com/coder/coder/v2/coderd/telemetry"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/quartz"
 )
 
 func TestMain(m *testing.M) {
@@ -44,6 +45,7 @@ func TestTelemetry(t *testing.T) {
 		db, _ := dbtestutil.NewDB(t)
 
 		ctx := testutil.Context(t, testutil.WaitMedium)
+		now := dbtime.Now()
 
 		org, err := db.GetDefaultOrganization(ctx)
 		require.NoError(t, err)
@@ -208,12 +210,88 @@ func TestTelemetry(t *testing.T) {
 			AgentID: wsagent.ID,
 		})
 
-		_, snapshot := collectSnapshot(ctx, t, db, nil)
+		previousAIBridgeInterceptionPeriod := now.Truncate(time.Hour)
+		user2 := dbgen.User(t, db, database.User{})
+		aiBridgeInterception1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
+			InitiatorID: user.ID,
+			Provider:    "anthropic",
+			Model:       "deanseek",
+			StartedAt:   previousAIBridgeInterceptionPeriod.Add(-30 * time.Minute),
+		}, nil)
+		_ = dbgen.AIBridgeTokenUsage(t, db, database.InsertAIBridgeTokenUsageParams{
+			InterceptionID: aiBridgeInterception1.ID,
+			InputTokens:    100,
+			OutputTokens:   200,
+			Metadata:       json.RawMessage(`{"cache_read_input":300,"cache_creation_input":400}`),
+		})
+		_ = dbgen.AIBridgeUserPrompt(t, db, database.InsertAIBridgeUserPromptParams{
+			InterceptionID: aiBridgeInterception1.ID,
+		})
+		_ = dbgen.AIBridgeToolUsage(t, db, database.InsertAIBridgeToolUsageParams{
+			InterceptionID:  aiBridgeInterception1.ID,
+			Injected:        true,
+			InvocationError: sql.NullString{String: "error1", Valid: true},
+		})
+		_, err = db.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      aiBridgeInterception1.ID,
+			EndedAt: aiBridgeInterception1.StartedAt.Add(1 * time.Minute), // 1 minute duration
+		})
+		require.NoError(t, err)
+		aiBridgeInterception2 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
+			InitiatorID: user2.ID,
+			Provider:    aiBridgeInterception1.Provider,
+			Model:       aiBridgeInterception1.Model,
+			StartedAt:   aiBridgeInterception1.StartedAt,
+		}, nil)
+		_ = dbgen.AIBridgeTokenUsage(t, db, database.InsertAIBridgeTokenUsageParams{
+			InterceptionID: aiBridgeInterception2.ID,
+			InputTokens:    100,
+			OutputTokens:   200,
+			Metadata:       json.RawMessage(`{"cache_read_input":300,"cache_creation_input":400}`),
+		})
+		_ = dbgen.AIBridgeUserPrompt(t, db, database.InsertAIBridgeUserPromptParams{
+			InterceptionID: aiBridgeInterception2.ID,
+		})
+		_ = dbgen.AIBridgeToolUsage(t, db, database.InsertAIBridgeToolUsageParams{
+			InterceptionID: aiBridgeInterception2.ID,
+			Injected:       false,
+		})
+		_, err = db.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      aiBridgeInterception2.ID,
+			EndedAt: aiBridgeInterception2.StartedAt.Add(2 * time.Minute), // 2 minute duration
+		})
+		require.NoError(t, err)
+		aiBridgeInterception3 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
+			InitiatorID: user2.ID,
+			Provider:    "openai",
+			Model:       "gpt-5",
+			StartedAt:   aiBridgeInterception1.StartedAt,
+		}, nil)
+		_, err = db.UpdateAIBridgeInterceptionEnded(ctx, database.UpdateAIBridgeInterceptionEndedParams{
+			ID:      aiBridgeInterception3.ID,
+			EndedAt: aiBridgeInterception3.StartedAt.Add(3 * time.Minute), // 3 minute duration
+		})
+		require.NoError(t, err)
+		_ = dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
+			InitiatorID: user2.ID,
+			Provider:    "openai",
+			Model:       "gpt-5",
+			StartedAt:   aiBridgeInterception1.StartedAt,
+		}, nil)
+		// not ended, so it should not affect summaries
+
+		clock := quartz.NewMock(t)
+		clock.Set(now)
+
+		_, snapshot := collectSnapshot(ctx, t, db, func(opts telemetry.Options) telemetry.Options {
+			opts.Clock = clock
+			return opts
+		})
 		require.Len(t, snapshot.ProvisionerJobs, 2)
 		require.Len(t, snapshot.Licenses, 1)
 		require.Len(t, snapshot.Templates, 2)
 		require.Len(t, snapshot.TemplateVersions, 3)
-		require.Len(t, snapshot.Users, 1)
+		require.Len(t, snapshot.Users, 2)
 		require.Len(t, snapshot.Groups, 2)
 		// 1 member in the everyone group + 1 member in the custom group
 		require.Len(t, snapshot.GroupMembers, 2)
@@ -287,6 +365,53 @@ func TestTelemetry(t *testing.T) {
 		for _, entity := range snapshot.Templates {
 			require.Equal(t, entity.OrganizationID, org.ID)
 		}
+
+		// 2 unique provider + model + client combinations
+		require.Len(t, snapshot.AIBridgeInterceptionsSummaries, 2)
+		snapshot1 := snapshot.AIBridgeInterceptionsSummaries[0]
+		snapshot2 := snapshot.AIBridgeInterceptionsSummaries[1]
+		if snapshot1.Provider != aiBridgeInterception1.Provider {
+			snapshot1, snapshot2 = snapshot2, snapshot1
+		}
+
+		require.Equal(t, snapshot1.Provider, aiBridgeInterception1.Provider)
+		require.Equal(t, snapshot1.Model, aiBridgeInterception1.Model)
+		require.Equal(t, snapshot1.Client, "unknown") // no client info yet
+		require.EqualValues(t, snapshot1.InterceptionCount, 2)
+		require.EqualValues(t, snapshot1.InterceptionsByRoute, map[string]int64{}) // no route info yet
+		require.EqualValues(t, snapshot1.InterceptionDurationMillis.P50, 90_000)
+		require.EqualValues(t, snapshot1.InterceptionDurationMillis.P90, 114_000)
+		require.EqualValues(t, snapshot1.InterceptionDurationMillis.P95, 117_000)
+		require.EqualValues(t, snapshot1.InterceptionDurationMillis.P99, 119_400)
+		require.EqualValues(t, snapshot1.UniqueInitiatorCount, 2)
+		require.EqualValues(t, snapshot1.UserPromptsCount, 2)
+		require.EqualValues(t, snapshot1.TokenUsagesCount, 2)
+		require.EqualValues(t, snapshot1.TokenCount.Input, 200)
+		require.EqualValues(t, snapshot1.TokenCount.Output, 400)
+		require.EqualValues(t, snapshot1.TokenCount.CachedRead, 600)
+		require.EqualValues(t, snapshot1.TokenCount.CachedWritten, 800)
+		require.EqualValues(t, snapshot1.ToolCallsCount.Injected, 1)
+		require.EqualValues(t, snapshot1.ToolCallsCount.NonInjected, 1)
+		require.EqualValues(t, snapshot1.InjectedToolCallErrorCount, 1)
+
+		require.Equal(t, snapshot2.Provider, aiBridgeInterception3.Provider)
+		require.Equal(t, snapshot2.Model, aiBridgeInterception3.Model)
+		require.Equal(t, snapshot2.Client, "unknown") // no client info yet
+		require.EqualValues(t, snapshot2.InterceptionCount, 1)
+		require.EqualValues(t, snapshot2.InterceptionsByRoute, map[string]int64{}) // no route info yet
+		require.EqualValues(t, snapshot2.InterceptionDurationMillis.P50, 180_000)
+		require.EqualValues(t, snapshot2.InterceptionDurationMillis.P90, 180_000)
+		require.EqualValues(t, snapshot2.InterceptionDurationMillis.P95, 180_000)
+		require.EqualValues(t, snapshot2.InterceptionDurationMillis.P99, 180_000)
+		require.EqualValues(t, snapshot2.UniqueInitiatorCount, 1)
+		require.EqualValues(t, snapshot2.UserPromptsCount, 0)
+		require.EqualValues(t, snapshot2.TokenUsagesCount, 0)
+		require.EqualValues(t, snapshot2.TokenCount.Input, 0)
+		require.EqualValues(t, snapshot2.TokenCount.Output, 0)
+		require.EqualValues(t, snapshot2.TokenCount.CachedRead, 0)
+		require.EqualValues(t, snapshot2.TokenCount.CachedWritten, 0)
+		require.EqualValues(t, snapshot2.ToolCallsCount.Injected, 0)
+		require.EqualValues(t, snapshot2.ToolCallsCount.NonInjected, 0)
 	})
 	t.Run("HashedEmail", func(t *testing.T) {
 		t.Parallel()

From d8b1ca70d60021a3cc8f5c8c163b8018e5839bf1 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Mon, 27 Oct 2025 11:55:33 -0600
Subject: [PATCH 265/298] chore: remove @Parkreiner from CODEOWNERS (#20504)

---
 CODEOWNERS | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/CODEOWNERS b/CODEOWNERS
index fde24a9d874ed..a3889d27bf16d 100644
--- a/CODEOWNERS
+++ b/CODEOWNERS
@@ -18,18 +18,6 @@ coderd/rbac/ @Emyrk
 scripts/apitypings/ @Emyrk
 scripts/gensite/ @aslilac
 
-site/ @aslilac @Parkreiner
-site/src/hooks/ @Parkreiner
-# These rules intentionally do not specify any owners. More specific rules
-# override less specific rules, so these files are "ignored" by the site/ rule.
-site/e2e/google/protobuf/timestampGenerated.ts
-site/e2e/provisionerGenerated.ts
-site/src/api/countriesGenerated.ts
-site/src/api/rbacresourcesGenerated.ts
-site/src/api/typesGenerated.ts
-site/src/testHelpers/entities.ts
-site/CLAUDE.md
-
 # The blood and guts of the autostop algorithm, which is quite complex and
 # requires elite ball knowledge of most of the scheduling code to make changes
 # without inadvertently affecting other parts of the codebase.

From c3cbd977f1e8861ab774c43db42685dd8bae319a Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Tue, 28 Oct 2025 01:06:52 +0200
Subject: [PATCH 266/298] fix(coderd/database/dbfake): use transaction for
 workspace builder (#20506)

While investigating a flake I noticed that the dbfake workspace builder
executes all database inserts without a transaction. Since our real
wsbuilder implementation utilizes one it makes sense to do here as well.

For example, our normal workspace <-> build relationship is such that a
workspace cannot exist with at least one build. However, our
GetWorkspaces query left joins workspace builds but has types that are
non-nullable, leading to flakes like coder/internal#1103.
---
 coderd/database/dbfake/dbfake.go | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
index cf94812cfde3d..12c1a28d98d34 100644
--- a/coderd/database/dbfake/dbfake.go
+++ b/coderd/database/dbfake/dbfake.go
@@ -161,6 +161,19 @@ func (b WorkspaceBuildBuilder) Canceled() WorkspaceBuildBuilder {
 // Workspace will be optionally populated if no ID is set on the provided
 // workspace.
 func (b WorkspaceBuildBuilder) Do() WorkspaceResponse {
+	var resp WorkspaceResponse
+	// Use transaction, like real wsbuilder.
+	err := b.db.InTx(func(tx database.Store) error {
+		//nolint:revive // calls do on modified struct
+		b.db = tx
+		resp = b.doInTX()
+		return nil
+	}, nil)
+	require.NoError(b.t, err)
+	return resp
+}
+
+func (b WorkspaceBuildBuilder) doInTX() WorkspaceResponse {
 	b.t.Helper()
 	jobID := uuid.New()
 	b.seed.ID = uuid.New()

From 4f7b279fd8947a25a2e4c6bb5f470b4153847834 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E3=82=B1=E3=82=A4=E3=83=A9?= <mckayla@hey.com>
Date: Mon, 27 Oct 2025 17:14:16 -0600
Subject: [PATCH 267/298] feat: add an organization member permission level
 (#19953)

---
 coderd/apidoc/docs.go                         |  21 ++
 coderd/apidoc/swagger.json                    |  21 ++
 coderd/authorize_test.go                      |  19 +-
 coderd/database/db2sdk/db2sdk.go              |  15 +-
 coderd/database/dbauthz/dbauthz.go            |  48 +++--
 coderd/database/modelmethods.go               |   2 +
 coderd/rbac/README.md                         |  98 +++++++---
 coderd/rbac/astvalue.go                       |   4 +
 coderd/rbac/authz_internal_test.go            | 107 +++++-----
 coderd/rbac/input.json                        |  19 +-
 coderd/rbac/policy.rego                       | 131 ++++++++-----
 coderd/rbac/roles.go                          |  38 +++-
 coderd/rbac/roles_internal_test.go            |  16 +-
 coderd/workspaceapps/db.go                    |  12 +-
 codersdk/roles.go                             |  30 +--
 docs/reference/api/members.md                 | 182 ++++++++++++------
 docs/reference/api/schemas.md                 |  74 ++++---
 enterprise/coderd/roles.go                    |   8 +
 site/e2e/api.ts                               |   1 +
 site/src/api/typesGenerated.ts                |  12 +-
 .../CreateEditRolePageView.tsx                |   8 +-
 .../pages/UsersPage/storybookData/roles.ts    |  12 +-
 site/src/testHelpers/entities.ts              |  37 ++--
 23 files changed, 611 insertions(+), 304 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index c0cf84224c764..a83fdd9b4d592 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -12500,6 +12500,13 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
+                "organization_member_permissions": {
+                    "description": "OrganizationMemberPermissions are specific for the organization in the field 'OrganizationID' above.",
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.Permission"
+                    }
+                },
                 "organization_permissions": {
                     "description": "OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.",
                     "type": "array",
@@ -13723,6 +13730,13 @@ const docTemplate = `{
                 "name": {
                     "type": "string"
                 },
+                "organization_member_permissions": {
+                    "description": "OrganizationMemberPermissions are specific to the organization the role belongs to.",
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.Permission"
+                    }
+                },
                 "organization_permissions": {
                     "description": "OrganizationPermissions are specific to the organization the role belongs to.",
                     "type": "array",
@@ -17490,6 +17504,13 @@ const docTemplate = `{
                     "type": "string",
                     "format": "uuid"
                 },
+                "organization_member_permissions": {
+                    "description": "OrganizationMemberPermissions are specific for the organization in the field 'OrganizationID' above.",
+                    "type": "array",
+                    "items": {
+                        "$ref": "#/definitions/codersdk.Permission"
+                    }
+                },
                 "organization_permissions": {
                     "description": "OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.",
                     "type": "array",
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 0c7a865112cff..f02a2ed7bc585 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -11182,6 +11182,13 @@
 					"type": "string",
 					"format": "uuid"
 				},
+				"organization_member_permissions": {
+					"description": "OrganizationMemberPermissions are specific for the organization in the field 'OrganizationID' above.",
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.Permission"
+					}
+				},
 				"organization_permissions": {
 					"description": "OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.",
 					"type": "array",
@@ -12337,6 +12344,13 @@
 				"name": {
 					"type": "string"
 				},
+				"organization_member_permissions": {
+					"description": "OrganizationMemberPermissions are specific to the organization the role belongs to.",
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.Permission"
+					}
+				},
 				"organization_permissions": {
 					"description": "OrganizationPermissions are specific to the organization the role belongs to.",
 					"type": "array",
@@ -15982,6 +15996,13 @@
 					"type": "string",
 					"format": "uuid"
 				},
+				"organization_member_permissions": {
+					"description": "OrganizationMemberPermissions are specific for the organization in the field 'OrganizationID' above.",
+					"type": "array",
+					"items": {
+						"$ref": "#/definitions/codersdk.Permission"
+					}
+				},
 				"organization_permissions": {
 					"description": "OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.",
 					"type": "array",
diff --git a/coderd/authorize_test.go b/coderd/authorize_test.go
index b8084211de60c..e3ce4b922f7c4 100644
--- a/coderd/authorize_test.go
+++ b/coderd/authorize_test.go
@@ -50,24 +50,25 @@ func TestCheckPermissions(t *testing.T) {
 			},
 			Action: "read",
 		},
-		readMyself: {
+		readOrgWorkspaces: {
 			Object: codersdk.AuthorizationObject{
-				ResourceType: codersdk.ResourceUser,
-				OwnerID:      "me",
+				ResourceType:   codersdk.ResourceWorkspace,
+				OrganizationID: adminUser.OrganizationID.String(),
 			},
 			Action: "read",
 		},
-		readOwnWorkspaces: {
+		readMyself: {
 			Object: codersdk.AuthorizationObject{
-				ResourceType: codersdk.ResourceWorkspace,
+				ResourceType: codersdk.ResourceUser,
 				OwnerID:      "me",
 			},
 			Action: "read",
 		},
-		readOrgWorkspaces: {
+		readOwnWorkspaces: {
 			Object: codersdk.AuthorizationObject{
 				ResourceType:   codersdk.ResourceWorkspace,
 				OrganizationID: adminUser.OrganizationID.String(),
+				OwnerID:        "me",
 			},
 			Action: "read",
 		},
@@ -92,9 +93,9 @@ func TestCheckPermissions(t *testing.T) {
 			UserID: adminUser.UserID,
 			Check: map[string]bool{
 				readAllUsers:           true,
+				readOrgWorkspaces:      true,
 				readMyself:             true,
 				readOwnWorkspaces:      true,
-				readOrgWorkspaces:      true,
 				updateSpecificTemplate: true,
 			},
 		},
@@ -104,9 +105,9 @@ func TestCheckPermissions(t *testing.T) {
 			UserID: orgAdminUser.ID,
 			Check: map[string]bool{
 				readAllUsers:           true,
+				readOrgWorkspaces:      true,
 				readMyself:             true,
 				readOwnWorkspaces:      true,
-				readOrgWorkspaces:      true,
 				updateSpecificTemplate: true,
 			},
 		},
@@ -116,9 +117,9 @@ func TestCheckPermissions(t *testing.T) {
 			UserID: memberUser.ID,
 			Check: map[string]bool{
 				readAllUsers:           false,
+				readOrgWorkspaces:      false,
 				readMyself:             true,
 				readOwnWorkspaces:      true,
-				readOrgWorkspaces:      false,
 				updateSpecificTemplate: false,
 			},
 		},
diff --git a/coderd/database/db2sdk/db2sdk.go b/coderd/database/db2sdk/db2sdk.go
index c7594d00254ae..2e1770d47dc87 100644
--- a/coderd/database/db2sdk/db2sdk.go
+++ b/coderd/database/db2sdk/db2sdk.go
@@ -714,12 +714,13 @@ func RBACRole(role rbac.Role) codersdk.Role {
 
 	orgPerms := role.ByOrgID[slim.OrganizationID]
 	return codersdk.Role{
-		Name:                    slim.Name,
-		OrganizationID:          slim.OrganizationID,
-		DisplayName:             slim.DisplayName,
-		SitePermissions:         List(role.Site, RBACPermission),
-		OrganizationPermissions: List(orgPerms.Org, RBACPermission),
-		UserPermissions:         List(role.User, RBACPermission),
+		Name:                          slim.Name,
+		OrganizationID:                slim.OrganizationID,
+		DisplayName:                   slim.DisplayName,
+		SitePermissions:               List(role.Site, RBACPermission),
+		UserPermissions:               List(role.User, RBACPermission),
+		OrganizationPermissions:       List(orgPerms.Org, RBACPermission),
+		OrganizationMemberPermissions: List(orgPerms.Member, RBACPermission),
 	}
 }
 
@@ -734,8 +735,8 @@ func Role(role database.CustomRole) codersdk.Role {
 		OrganizationID:          orgID,
 		DisplayName:             role.DisplayName,
 		SitePermissions:         List(role.SitePermissions, Permission),
-		OrganizationPermissions: List(role.OrgPermissions, Permission),
 		UserPermissions:         List(role.UserPermissions, Permission),
+		OrganizationPermissions: List(role.OrgPermissions, Permission),
 	}
 }
 
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 74f24a617c410..01d3c4f26ae85 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -395,11 +395,13 @@ var (
 					Identifier:  rbac.RoleIdentifier{Name: "subagentapi"},
 					DisplayName: "Sub Agent API",
 					Site:        []rbac.Permission{},
-					User: rbac.Permissions(map[string][]policy.Action{
-						rbac.ResourceWorkspace.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreateAgent, policy.ActionDeleteAgent},
-					}),
+					User:        []rbac.Permission{},
 					ByOrgID: map[string]rbac.OrgPermissions{
-						orgID.String(): {},
+						orgID.String(): {
+							Member: rbac.Permissions(map[string][]policy.Action{
+								rbac.ResourceWorkspace.Type: {policy.ActionRead, policy.ActionUpdate, policy.ActionCreateAgent, policy.ActionDeleteAgent},
+							}),
+						},
 					},
 				},
 			}),
@@ -1290,14 +1292,17 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
 		return xerrors.Errorf("invalid role: %w", err)
 	}
 
-	if len(rbacRole.ByOrgID) > 0 && len(rbacRole.Site) > 0 {
-		// This is a choice to keep roles simple. If we allow mixing site and org scoped perms, then knowing who can
-		// do what gets more complicated.
-		return xerrors.Errorf("invalid custom role, cannot assign both org and site permissions at the same time")
+	if len(rbacRole.ByOrgID) > 0 && (len(rbacRole.Site) > 0 || len(rbacRole.User) > 0) {
+		// This is a choice to keep roles simple. If we allow mixing site and org
+		// scoped perms, then knowing who can do what gets more complicated. Roles
+		// should either be entirely org-scoped or entirely unrelated to
+		// organizations.
+		return xerrors.Errorf("invalid custom role, cannot assign both org-scoped and site/user permissions at the same time")
 	}
 
 	if len(rbacRole.ByOrgID) > 1 {
-		// Again to avoid more complexity in our roles
+		// Again to avoid more complexity in our roles. Roles are limited to one
+		// organization.
 		return xerrors.Errorf("invalid custom role, cannot assign permissions to more than 1 org at a time")
 	}
 
@@ -1313,7 +1318,18 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
 		for _, orgPerm := range perms.Org {
 			err := q.customRoleEscalationCheck(ctx, act, orgPerm, rbac.Object{OrgID: orgID, Type: orgPerm.ResourceType})
 			if err != nil {
-				return xerrors.Errorf("org=%q: %w", orgID, err)
+				return xerrors.Errorf("org=%q: org: %w", orgID, err)
+			}
+		}
+		for _, memberPerm := range perms.Member {
+			// The person giving the permission should still be required to have
+			// the permissions throughout the org in order to give individuals the
+			// same permission among their own resources, since the role can be given
+			// to anyone. The `Owner` is intentionally omitted from the `Object` to
+			// enforce this.
+			err := q.customRoleEscalationCheck(ctx, act, memberPerm, rbac.Object{OrgID: orgID, Type: memberPerm.ResourceType})
+			if err != nil {
+				return xerrors.Errorf("org=%q: member: %w", orgID, err)
 			}
 		}
 	}
@@ -1331,8 +1347,8 @@ func (q *querier) customRoleCheck(ctx context.Context, role database.CustomRole)
 func (q *querier) authorizeProvisionerJob(ctx context.Context, job database.ProvisionerJob) error {
 	switch job.Type {
 	case database.ProvisionerJobTypeWorkspaceBuild:
-		// Authorized call to get workspace build. If we can read the build, we
-		// can read the job.
+		// Authorized call to get workspace build. If we can read the build, we can
+		// read the job.
 		_, err := q.GetWorkspaceBuildByJobID(ctx, job.ID)
 		if err != nil {
 			return xerrors.Errorf("fetch related workspace build: %w", err)
@@ -1375,8 +1391,8 @@ func (q *querier) ActivityBumpWorkspace(ctx context.Context, arg database.Activi
 }
 
 func (q *querier) AllUserIDs(ctx context.Context, includeSystem bool) ([]uuid.UUID, error) {
-	// Although this technically only reads users, only system-related functions should be
-	// allowed to call this.
+	// Although this technically only reads users, only system-related functions
+	// should be allowed to call this.
 	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceSystem); err != nil {
 		return nil, err
 	}
@@ -1395,8 +1411,8 @@ func (q *querier) ArchiveUnusedTemplateVersions(ctx context.Context, arg databas
 }
 
 func (q *querier) BatchUpdateWorkspaceLastUsedAt(ctx context.Context, arg database.BatchUpdateWorkspaceLastUsedAtParams) error {
-	// Could be any workspace and checking auth to each workspace is overkill for the purpose
-	// of this function.
+	// Could be any workspace and checking auth to each workspace is overkill for
+	// the purpose of this function.
 	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourceWorkspace.All()); err != nil {
 		return err
 	}
diff --git a/coderd/database/modelmethods.go b/coderd/database/modelmethods.go
index a50024f5f7580..b3202342e3ffa 100644
--- a/coderd/database/modelmethods.go
+++ b/coderd/database/modelmethods.go
@@ -208,6 +208,7 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 		for orgID, perms := range expanded.ByOrgID {
 			orgPerms := merged.ByOrgID[orgID]
 			orgPerms.Org = append(orgPerms.Org, perms.Org...)
+			orgPerms.Member = append(orgPerms.Member, perms.Member...)
 			merged.ByOrgID[orgID] = orgPerms
 		}
 		merged.User = append(merged.User, expanded.User...)
@@ -220,6 +221,7 @@ func (s APIKeyScopes) expandRBACScope() (rbac.Scope, error) {
 	merged.User = rbac.DeduplicatePermissions(merged.User)
 	for orgID, perms := range merged.ByOrgID {
 		perms.Org = rbac.DeduplicatePermissions(perms.Org)
+		perms.Member = rbac.DeduplicatePermissions(perms.Member)
 		merged.ByOrgID[orgID] = perms
 	}
 
diff --git a/coderd/rbac/README.md b/coderd/rbac/README.md
index 418e63fc261da..0b4315525c266 100644
--- a/coderd/rbac/README.md
+++ b/coderd/rbac/README.md
@@ -58,22 +58,68 @@ This can be represented by the following truth table, where Y represents _positi
 - `+site.app.*.read`: allowed to perform the `read` action against all objects of type `app` in a given Coder deployment.
 - `-user.workspace.*.create`: user is not allowed to create workspaces.
 
+## Levels
+
+A user can be given (or deprived) a permission at several levels. Currently,
+those levels are:
+
+- Site-wide level
+- Organization level
+- User level
+- Organization member level
+
+The site-wide level is the most authoritative. Any permission granted or denied at the side-wide level is absolute. After checking the site-wide level, depending of if the resource is owned by an organization or not, it will check the other levels.
+
+- If the resource is owned by an organization, the next most authoritative level is the organization level. It acts like the site-wide level, but only for resources within the corresponding organization. The user can use that permission on any resource within that organization.
+  - After the organization level is the member level. This level only applies to resources that are owned by both the organization _and_ the user.
+
+- If the resource is not owned by an organization, the next level to check is the user level. This level only applies to resources owned by the user and that are not owned by any organization.
+
+```
+                 ┌──────────┐
+                 │   Site   │
+                 └─────┬────┘
+            ┌──────────┴───────────┐
+         ┌──┤   Owned by an org?   ├──┐
+         │  └──────────────────────┘  │
+      ┌──┴──┐                      ┌──┴─┐
+      │ Yes │                      │ No │
+      └──┬──┘                      └──┬─┘
+┌────────┴─────────┐            ┌─────┴────┐
+│   Organization   │            │   User   │
+└────────┬─────────┘            └──────────┘
+   ┌─────┴──────┐
+   │   Member   │
+   └────────────┘
+```
+
 ## Roles
 
 A _role_ is a set of permissions. When evaluating a role's permission to form an action, all the relevant permissions for the role are combined at each level. Permissions at a higher level override permissions at a lower level.
 
-The following table shows the per-level role evaluation.
-Y indicates that the role provides positive permissions, N indicates the role provides negative permissions, and _indicates the role does not provide positive or negative permissions. YN_ indicates that the value in the cell does not matter for the access result.
+The following tables show the per-level role evaluation. Y indicates that the role provides positive permissions, N indicates the role provides negative permissions, and _indicates the role does not provide positive or negative permissions. YN_ indicates that the value in the cell does not matter for the access result. The table varies depending on if the resource belongs to an organization or not.
+
+If the resource is owned by an organization, such as a template or a workspace:
+
+| Role (example)           | Site | Org  | OrgMember | Result |
+|--------------------------|------|------|-----------|--------|
+| site-admin               | Y    | YN\_ | YN\_      | Y      |
+| negative-site-permission | N    | YN\_ | YN\_      | N      |
+| org-admin                | \_   | Y    | YN\_      | Y      |
+| non-org-member           | \_   | N    | YN\_      | N      |
+| member-owned             | \_   | \_   | Y         | Y      |
+| not-member-owned         | \_   | \_   | N         | N      |
+| unauthenticated          | \_   | \_   | \_        | N      |
+
+If the resource is not owned by an organization:
 
-| Role (example)  | Site | Org  | User | Result |
-|-----------------|------|------|------|--------|
-| site-admin      | Y    | YN\_ | YN\_ | Y      |
-| no-permission   | N    | YN\_ | YN\_ | N      |
-| org-admin       | \_   | Y    | YN\_ | Y      |
-| non-org-member  | \_   | N    | YN\_ | N      |
-| user            | \_   | \_   | Y    | Y      |
-|                 | \_   | \_   | N    | N      |
-| unauthenticated | \_   | \_   | \_   | N      |
+| Role (example)           | Site | User | Result |
+|--------------------------|------|------|--------|
+| site-admin               | Y    | YN\_ | Y      |
+| negative-site-permission | N    | YN\_ | N      |
+| user-owned               | \_   | Y    | Y      |
+| not-user-owned           | \_   | N    | N      |
+| unauthenticated          | \_   | \_   | N      |
 
 ## Scopes
 
@@ -126,31 +172,31 @@ To learn more about OPA and Rego, see https://www.openpolicyagent.org/docs.
 There are two types of evaluation in OPA:
 
 - **Full evaluation**: Produces a decision that can be enforced.
-This is the default evaluation mode, where OPA evaluates the policy using `input` data that contains all known values and returns output data with the `allow` variable.
+  This is the default evaluation mode, where OPA evaluates the policy using `input` data that contains all known values and returns output data with the `allow` variable.
 - **Partial evaluation**: Produces a new policy that can be evaluated later when the _unknowns_ become _known_.
-This is an optimization in OPA where it evaluates as much of the policy as possible without resolving expressions that depend on _unknown_ values from the `input`.
-To learn more about partial evaluation, see this [OPA blog post](https://blog.openpolicyagent.org/partial-evaluation-162750eaf422).
+  This is an optimization in OPA where it evaluates as much of the policy as possible without resolving expressions that depend on _unknown_ values from the `input`.
+  To learn more about partial evaluation, see this [OPA blog post](https://blog.openpolicyagent.org/partial-evaluation-162750eaf422).
 
 Application of Full and Partial evaluation in `rbac` package:
 
 - **Full Evaluation** is handled by the `RegoAuthorizer.Authorize()` method in [`authz.go`](authz.go).
-This method determines whether a subject (user) can perform a specific action on an object.
-It performs a full evaluation of the Rego policy, which returns the `allow` variable to decide whether access is granted (`true`) or denied (`false` or undefined).
+  This method determines whether a subject (user) can perform a specific action on an object.
+  It performs a full evaluation of the Rego policy, which returns the `allow` variable to decide whether access is granted (`true`) or denied (`false` or undefined).
 - **Partial Evaluation** is handled by the `RegoAuthorizer.Prepare()` method in [`authz.go`](authz.go).
-This method compiles OPA’s partial evaluation queries into `SQL WHERE` clauses.
-These clauses are then used to enforce authorization directly in database queries, rather than in application code.
+  This method compiles OPA’s partial evaluation queries into `SQL WHERE` clauses.
+  These clauses are then used to enforce authorization directly in database queries, rather than in application code.
 
 Authorization Patterns:
 
 - Fetch-then-authorize: an object is first retrieved from the database, and a single authorization check is performed using full evaluation via `Authorize()`.
 - Authorize-while-fetching: Partial evaluation via `Prepare()` is used to inject SQL filters directly into queries, allowing efficient authorization of many objects of the same type.
-`dbauthz` methods that enforce authorization directly in the SQL query are prefixed with `Authorized`, for example, `GetAuthorizedWorkspaces`.
+  `dbauthz` methods that enforce authorization directly in the SQL query are prefixed with `Authorized`, for example, `GetAuthorizedWorkspaces`.
 
 ## Testing
 
 - OPA Playground: https://play.openpolicyagent.org/
 - OPA CLI (`opa eval`): useful for experimenting with different inputs and understanding how the policy behaves under various conditions.
-`opa eval` returns the constraints that must be satisfied for a rule to evaluate to `true`.
+  `opa eval` returns the constraints that must be satisfied for a rule to evaluate to `true`.
   - `opa eval` requires an `input.json` file containing the input data to run the policy against.
     You can generate this file using the [gen_input.go](../../scripts/rbac-authz/gen_input.go) script.
     Note: the script currently produces a fixed input. You may need to tweak it for your specific use case.
@@ -198,12 +244,12 @@ The script [`benchmark_authz.sh`](../../scripts/rbac-authz/benchmark_authz.sh) r
 
 - To run benchmark on the current branch:
 
-    ```bash
-    benchmark_authz.sh --single
-    ```
+  ```bash
+  benchmark_authz.sh --single
+  ```
 
 - To compare benchmarks between 2 branches:
 
-    ```bash
-    benchmark_authz.sh --compare main prebuild_policy
-    ```
+  ```bash
+  benchmark_authz.sh --compare main prebuild_policy
+  ```
diff --git a/coderd/rbac/astvalue.go b/coderd/rbac/astvalue.go
index d207ae888a3f7..bbbbb03622532 100644
--- a/coderd/rbac/astvalue.go
+++ b/coderd/rbac/astvalue.go
@@ -165,6 +165,10 @@ func (role Role) regoValue() ast.Value {
 					ast.StringTerm("org"),
 					ast.NewTerm(regoSlice(p.Org)),
 				},
+				[2]*ast.Term{
+					ast.StringTerm("member"),
+					ast.NewTerm(regoSlice(p.Member)),
+				},
 			),
 		))
 	}
diff --git a/coderd/rbac/authz_internal_test.go b/coderd/rbac/authz_internal_test.go
index 1d52304ba0ed9..c409655d0c4f1 100644
--- a/coderd/rbac/authz_internal_test.go
+++ b/coderd/rbac/authz_internal_test.go
@@ -287,7 +287,7 @@ func TestFilter(t *testing.T) {
 func TestAuthorizeDomain(t *testing.T) {
 	t.Parallel()
 	defOrg := uuid.New()
-	unuseID := uuid.New()
+	unusedID := uuid.New()
 	allUsersGroup := "Everyone"
 
 	// orphanedUser has no organization
@@ -318,21 +318,21 @@ func TestAuthorizeDomain(t *testing.T) {
 
 	testAuthorize(t, "UserACLList", user, []authTestCase{
 		{
-			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACLUserList(map[string][]policy.Action{
+			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(unusedID).WithACLUserList(map[string][]policy.Action{
 				user.ID: ResourceWorkspace.AvailableActions(),
 			}),
 			actions: ResourceWorkspace.AvailableActions(),
 			allow:   true,
 		},
 		{
-			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACLUserList(map[string][]policy.Action{
+			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(unusedID).WithACLUserList(map[string][]policy.Action{
 				user.ID: {policy.WildcardSymbol},
 			}),
 			actions: ResourceWorkspace.AvailableActions(),
 			allow:   true,
 		},
 		{
-			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(unuseID).WithACLUserList(map[string][]policy.Action{
+			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(unusedID).WithACLUserList(map[string][]policy.Action{
 				user.ID: {policy.ActionRead, policy.ActionUpdate},
 			}),
 			actions: []policy.Action{policy.ActionCreate, policy.ActionDelete},
@@ -350,21 +350,21 @@ func TestAuthorizeDomain(t *testing.T) {
 
 	testAuthorize(t, "GroupACLList", user, []authTestCase{
 		{
-			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(defOrg).WithGroupACL(map[string][]policy.Action{
+			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(defOrg).WithGroupACL(map[string][]policy.Action{
 				allUsersGroup: ResourceWorkspace.AvailableActions(),
 			}),
 			actions: ResourceWorkspace.AvailableActions(),
 			allow:   true,
 		},
 		{
-			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(defOrg).WithGroupACL(map[string][]policy.Action{
+			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(defOrg).WithGroupACL(map[string][]policy.Action{
 				allUsersGroup: {policy.WildcardSymbol},
 			}),
 			actions: ResourceWorkspace.AvailableActions(),
 			allow:   true,
 		},
 		{
-			resource: ResourceWorkspace.WithOwner(unuseID.String()).InOrg(defOrg).WithGroupACL(map[string][]policy.Action{
+			resource: ResourceWorkspace.WithOwner(unusedID.String()).InOrg(defOrg).WithGroupACL(map[string][]policy.Action{
 				allUsersGroup: {policy.ActionRead, policy.ActionUpdate},
 			}),
 			actions: []policy.Action{policy.ActionCreate, policy.ActionDelete},
@@ -389,13 +389,14 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.AnyOrganization().WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: true},
 		{resource: ResourceTemplate.AnyOrganization(), actions: []policy.Action{policy.ActionCreate}, allow: false},
 
-		{resource: ResourceWorkspace.WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: true},
+		// No org + me
+		{resource: ResourceWorkspace.WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		{resource: ResourceWorkspace.All(), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + me
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + other user
 		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
@@ -403,8 +404,8 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + other us
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
 	})
@@ -435,8 +436,8 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.All(), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + me
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + other user
 		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
@@ -444,8 +445,8 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + other use
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
 	})
@@ -455,6 +456,7 @@ func TestAuthorizeDomain(t *testing.T) {
 		Scope: must(ExpandScope(ScopeAll)),
 		Roles: Roles{
 			must(RoleByName(ScopedRoleOrgAdmin(defOrg))),
+			must(RoleByName(ScopedRoleOrgMember(defOrg))),
 			must(RoleByName(RoleMember())),
 		},
 	}
@@ -469,13 +471,14 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.InOrg(defOrg), actions: workspaceExceptConnect, allow: true},
 		{resource: ResourceWorkspace.InOrg(defOrg), actions: workspaceConnect, allow: false},
 
-		{resource: ResourceWorkspace.WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: true},
+		// No org + me
+		{resource: ResourceWorkspace.WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		{resource: ResourceWorkspace.All(), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + me
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		// Other org + other user
 		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me"), actions: workspaceExceptConnect, allow: true},
@@ -483,9 +486,9 @@ func TestAuthorizeDomain(t *testing.T) {
 
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
-		// Other org + other use
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		// Other org + other user
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: false},
 
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: false},
 	})
@@ -512,8 +515,8 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.All(), actions: ResourceWorkspace.AvailableActions(), allow: true},
 
 		// Other org + me
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: true},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: true},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID), actions: ResourceWorkspace.AvailableActions(), allow: true},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: true},
 
 		// Other org + other user
 		{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: true},
@@ -521,8 +524,8 @@ func TestAuthorizeDomain(t *testing.T) {
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: true},
 
 		// Other org + other use
-		{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: true},
-		{resource: ResourceWorkspace.InOrg(unuseID), actions: ResourceWorkspace.AvailableActions(), allow: true},
+		{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: true},
+		{resource: ResourceWorkspace.InOrg(unusedID), actions: ResourceWorkspace.AvailableActions(), allow: true},
 
 		{resource: ResourceWorkspace.WithOwner("not-me"), actions: ResourceWorkspace.AvailableActions(), allow: true},
 	})
@@ -546,13 +549,14 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.InOrg(defOrg).WithOwner(user.ID), allow: true},
 			{resource: ResourceWorkspace.InOrg(defOrg), allow: false},
 
-			{resource: ResourceWorkspace.WithOwner(user.ID), allow: true},
+			// No org + me
+			{resource: ResourceWorkspace.WithOwner(user.ID), allow: false},
 
 			{resource: ResourceWorkspace.All(), allow: false},
 
 			// Other org + me
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID), allow: false},
-			{resource: ResourceWorkspace.InOrg(unuseID), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID), allow: false},
 
 			// Other org + other user
 			{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me"), allow: false},
@@ -560,8 +564,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.WithOwner("not-me"), allow: false},
 
 			// Other org + other use
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me"), allow: false},
-			{resource: ResourceWorkspace.InOrg(unuseID), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me"), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID), allow: false},
 
 			{resource: ResourceWorkspace.WithOwner("not-me"), allow: false},
 		}),
@@ -580,8 +584,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.All()},
 
 			// Other org + me
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID)},
-			{resource: ResourceWorkspace.InOrg(unuseID)},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID)},
+			{resource: ResourceWorkspace.InOrg(unusedID)},
 
 			// Other org + other user
 			{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me")},
@@ -589,8 +593,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.WithOwner("not-me")},
 
 			// Other org + other use
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me")},
-			{resource: ResourceWorkspace.InOrg(unuseID)},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me")},
+			{resource: ResourceWorkspace.InOrg(unusedID)},
 
 			{resource: ResourceWorkspace.WithOwner("not-me")},
 		}),
@@ -609,8 +613,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceTemplate.All()},
 
 			// Other org + me
-			{resource: ResourceTemplate.InOrg(unuseID).WithOwner(user.ID)},
-			{resource: ResourceTemplate.InOrg(unuseID)},
+			{resource: ResourceTemplate.InOrg(unusedID).WithOwner(user.ID)},
+			{resource: ResourceTemplate.InOrg(unusedID)},
 
 			// Other org + other user
 			{resource: ResourceTemplate.InOrg(defOrg).WithOwner("not-me")},
@@ -618,8 +622,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceTemplate.WithOwner("not-me")},
 
 			// Other org + other use
-			{resource: ResourceTemplate.InOrg(unuseID).WithOwner("not-me")},
-			{resource: ResourceTemplate.InOrg(unuseID)},
+			{resource: ResourceTemplate.InOrg(unusedID).WithOwner("not-me")},
+			{resource: ResourceTemplate.InOrg(unusedID)},
 
 			{resource: ResourceTemplate.WithOwner("not-me")},
 		}),
@@ -647,6 +651,7 @@ func TestAuthorizeDomain(t *testing.T) {
 							ResourceType: "*",
 							Action:       policy.ActionRead,
 						}},
+						Member: []Permission{},
 					},
 				},
 			},
@@ -668,8 +673,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.All(), allow: false},
 
 			// Other org + me
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID), allow: false},
-			{resource: ResourceWorkspace.InOrg(unuseID), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID), allow: false},
 
 			// Other org + other user
 			{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me"), allow: true},
@@ -677,8 +682,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.WithOwner("not-me"), allow: false},
 
 			// Other org + other use
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me"), allow: false},
-			{resource: ResourceWorkspace.InOrg(unuseID), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me"), allow: false},
+			{resource: ResourceWorkspace.InOrg(unusedID), allow: false},
 
 			{resource: ResourceWorkspace.WithOwner("not-me"), allow: false},
 		}),
@@ -699,8 +704,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.All()},
 
 			// Other org + me
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner(user.ID)},
-			{resource: ResourceWorkspace.InOrg(unuseID)},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner(user.ID)},
+			{resource: ResourceWorkspace.InOrg(unusedID)},
 
 			// Other org + other user
 			{resource: ResourceWorkspace.InOrg(defOrg).WithOwner("not-me")},
@@ -708,8 +713,8 @@ func TestAuthorizeDomain(t *testing.T) {
 			{resource: ResourceWorkspace.WithOwner("not-me")},
 
 			// Other org + other use
-			{resource: ResourceWorkspace.InOrg(unuseID).WithOwner("not-me")},
-			{resource: ResourceWorkspace.InOrg(unuseID)},
+			{resource: ResourceWorkspace.InOrg(unusedID).WithOwner("not-me")},
+			{resource: ResourceWorkspace.InOrg(unusedID)},
 
 			{resource: ResourceWorkspace.WithOwner("not-me")},
 		}))
@@ -737,6 +742,7 @@ func TestAuthorizeLevels(t *testing.T) {
 								Action:       "*",
 							},
 						},
+						Member: []Permission{},
 					},
 				},
 			},
@@ -1150,6 +1156,7 @@ func TestAuthorizeScope(t *testing.T) {
 						Org: Permissions(map[string][]policy.Action{
 							ResourceWorkspace.Type: {policy.ActionRead},
 						}),
+						Member: []Permission{},
 					},
 				},
 			},
@@ -1316,9 +1323,9 @@ type authTestCase struct {
 func testAuthorize(t *testing.T, name string, subject Subject, sets ...[]authTestCase) {
 	t.Helper()
 	authorizer := NewAuthorizer(prometheus.NewRegistry())
-	for _, cases := range sets {
-		for i, c := range cases {
-			caseName := fmt.Sprintf("%s/%d", name, i)
+	for i, cases := range sets {
+		for j, c := range cases {
+			caseName := fmt.Sprintf("%s/Set%d/Case%d", name, i, j)
 			t.Run(caseName, func(t *testing.T) {
 				t.Parallel()
 				for _, a := range c.actions {
diff --git a/coderd/rbac/input.json b/coderd/rbac/input.json
index b71590c789aa0..5b8f1ad98c58c 100644
--- a/coderd/rbac/input.json
+++ b/coderd/rbac/input.json
@@ -23,8 +23,13 @@
 						"action": "*"
 					}
 				],
-				"org": {},
-				"user": []
+				"user": [],
+				"by_org_id": {
+					"bf7b72bd-a2b1-4ef2-962c-1d698e0483f6": {
+						"org": [],
+						"member": []
+					}
+				}
 			}
 		],
 		"groups": ["b617a647-b5d0-4cbe-9e40-26f89710bf18"],
@@ -38,13 +43,19 @@
 					"action": "*"
 				}
 			],
-			"org": {},
 			"user": [],
+			"by_org_id": {
+				"bf7b72bd-a2b1-4ef2-962c-1d698e0483f6": {
+					"org": [],
+					"member": []
+				}
+			},
 			"allow_list": [
 				{
 					"type": "workspace",
 					"id": "*"
-				}]
+				}
+			]
 		}
 	}
 }
diff --git a/coderd/rbac/policy.rego b/coderd/rbac/policy.rego
index d6ab8b371bab4..e8844a22bdbd8 100644
--- a/coderd/rbac/policy.rego
+++ b/coderd/rbac/policy.rego
@@ -38,6 +38,44 @@ check_site_permissions(roles) := vote if {
 	vote := to_vote(allow)
 }
 
+#==============================================================================#
+# User level rules                                                             #
+#==============================================================================#
+
+# User level rules apply to all objects owned by the subject which are not also
+# owned by an org. Permissions for objects which are "jointly" owned by an org
+# instead defer to the org member level rules.
+
+default user := 0
+
+user := check_user_permissions(input.subject.roles)
+
+default scope_user := 0
+
+scope_user := check_user_permissions([input.subject.scope])
+
+check_user_permissions(roles) := vote if {
+	# The object must be owned by the subject.
+	input.subject.id = input.object.owner
+
+	# If there is an org, use org_member permissions instead
+	input.object.org_owner == ""
+	not input.object.any_org
+
+	allow := {is_allowed |
+		# Iterate over all user permissions in all roles, and check which ones match
+		# the action and object type.
+		perm := roles[_].user[_]
+		perm.action in [input.action, "*"]
+		perm.resource_type in [input.object.type, "*"]
+
+		# If a negative matching permission was found, then we vote to disallow it.
+		# If the permission is not negative, then we vote to allow it.
+		is_allowed := bool_flip(perm.negate)
+	}
+	vote := to_vote(allow)
+}
+
 #==============================================================================#
 # Org level rules                                                              #
 #==============================================================================#
@@ -144,49 +182,33 @@ is_org_member if {
 	count(org_memberships) > 0
 }
 
-org_ok if {
-	is_org_member
-}
-
-# If the object has no organization, then the user is also considered part of
-# the non-existent org.
-org_ok if {
-	input.object.org_owner == ""
-	not input.object.any_org
-}
-
 #==============================================================================#
-# User level rules                                                             #
+# Org member level rules                                                       #
 #==============================================================================#
 
-# User level rules apply to all objects owned by the subject which are not also
-# owned by an org. Permissions for objects which are "jointly" owned by an org
-# instead defer to the org member level rules.
-
-default user := 0
-
-user := check_user_permissions(input.subject.roles)
-
-default scope_user := 0
+# Org member level permissions apply to all objects owned by the subject _and_
+# the corresponding org. Permissions for objects which are not owned by an
+# organization instead defer to the user level rules.
+#
+# The rules for this level are very similar to the rules for the organization
+# level, and so we reuse the `check_org_permissions` function from those rules.
 
-scope_user := check_user_permissions([input.subject.scope])
+default org_member := 0
 
-check_user_permissions(roles) := vote if {
-	# The object must be owned by the subject.
-	input.subject.id == input.object.owner
+org_member := vote if {
+	# Object must be jointly owned by the user
+	input.object.owner != ""
+	input.subject.id = input.object.owner
+	vote := check_org_permissions(input.subject.roles, "member")
+}
 
-	allow := {is_allowed |
-		# Iterate over all user permissions in all roles, and check which ones match
-		# the action and object type.
-		perm := roles[_].user[_]
-		perm.action in [input.action, "*"]
-		perm.resource_type in [input.object.type, "*"]
+default scope_org_member := 0
 
-		# If a negative matching permission was found, then we vote to disallow it.
-		# If the permission is not negative, then we vote to allow it.
-		is_allowed := bool_flip(perm.negate)
-	}
-	vote := to_vote(allow)
+scope_org_member := vote if {
+	# Object must be jointly owned by the user
+	input.object.owner != ""
+	input.subject.id = input.object.owner
+	vote := check_org_permissions([input.subject.scope], "member")
 }
 
 #==============================================================================#
@@ -204,6 +226,13 @@ role_allow if {
 	site = 1
 }
 
+# User level authorization
+role_allow if {
+	not site = -1
+
+	user = 1
+}
+
 # Org level authorization
 role_allow if {
 	not site = -1
@@ -211,16 +240,12 @@ role_allow if {
 	org = 1
 }
 
-# User level authorization
+# Org member authorization
 role_allow if {
 	not site = -1
 	not org = -1
 
-	# If we are not a member of an org, and the object has an org, then we are
-	# not authorized. This is an "implied -1" for not being in the org.
-	org_ok
-
-	user = 1
+	org_member = 1
 }
 
 #==============================================================================#
@@ -239,6 +264,16 @@ scope_allow if {
 	scope_site = 1
 }
 
+# User level scope enforcement
+scope_allow if {
+	# User scope permissions must be allowed by the scope, and not denied
+	# by the site. The object *must not* be owned by an organization.
+	object_is_included_in_scope_allow_list
+	not scope_site = -1
+
+	scope_user = 1
+}
+
 # Org level scope enforcement
 scope_allow if {
 	# Org member scope permissions must be allowed by the scope, and not denied
@@ -249,19 +284,15 @@ scope_allow if {
 	scope_org = 1
 }
 
-# User level scope enforcement
+# Org member level scope enforcement
 scope_allow if {
-	# User scope permissions must be allowed by the scope, and not denied
-	# by the site. The object *must not* be owned by an organization.
+	# Org member scope permissions must be allowed by the scope, and not denied
+	# by the site or org. The object *must* be owned by an organization.
 	object_is_included_in_scope_allow_list
 	not scope_site = -1
 	not scope_org = -1
 
-	# If we are not a member of an org, and the object has an org, then we are
-	# not authorized. This is an "implied -1" for not being in the org.
-	org_ok
-
-	scope_user = 1
+	scope_org_member = 1
 }
 
 # If *.* is allowed, then all objects are in scope.
diff --git a/coderd/rbac/roles.go b/coderd/rbac/roles.go
index 27162b7230cb9..91061f1647020 100644
--- a/coderd/rbac/roles.go
+++ b/coderd/rbac/roles.go
@@ -295,15 +295,11 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 			ResourceOauth2App.Type:      {policy.ActionRead},
 			ResourceWorkspaceProxy.Type: {policy.ActionRead},
 		}),
-		User: append(allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceUser, ResourceOrganizationMember),
+		User: append(allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceWorkspace, ResourceUser, ResourceOrganizationMember, ResourceOrganizationMember),
 			Permissions(map[string][]policy.Action{
-				// Reduced permission set on dormant workspaces. No build, ssh, or exec
-				ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent, policy.ActionDeleteAgent},
 				// Users cannot do create/update/delete on themselves, but they
 				// can read their own details.
 				ResourceUser.Type: {policy.ActionRead, policy.ActionReadPersonal, policy.ActionUpdatePersonal},
-				// Can read their own organization member record
-				ResourceOrganizationMember.Type: {policy.ActionRead},
 				// Users can create provisioner daemons scoped to themselves.
 				ResourceProvisionerDaemon.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
 			})...,
@@ -431,6 +427,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 							// Note: even without PrebuiltWorkspace permissions, access is still granted via Workspace permissions.
 							ResourcePrebuiltWorkspace.Type: {policy.ActionUpdate, policy.ActionDelete},
 						})...),
+						Member: []Permission{},
 					},
 				},
 			}
@@ -454,6 +451,16 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 							// Can read available roles.
 							ResourceAssignOrgRole.Type: {policy.ActionRead},
 						}),
+						Member: append(allPermsExcept(ResourceWorkspaceDormant, ResourcePrebuiltWorkspace, ResourceUser, ResourceOrganizationMember),
+							Permissions(map[string][]policy.Action{
+								// Reduced permission set on dormant workspaces. No build, ssh, or exec
+								ResourceWorkspaceDormant.Type: {policy.ActionRead, policy.ActionDelete, policy.ActionCreate, policy.ActionUpdate, policy.ActionWorkspaceStop, policy.ActionCreateAgent, policy.ActionDeleteAgent},
+								// Can read their own organization member record
+								ResourceOrganizationMember.Type: {policy.ActionRead},
+								// Users can create provisioner daemons scoped to themselves.
+								ResourceProvisionerDaemon.Type: {policy.ActionRead, policy.ActionCreate, policy.ActionRead, policy.ActionUpdate},
+							})...,
+						),
 					},
 				},
 			}
@@ -476,6 +483,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 							ResourceOrganization.Type:       {policy.ActionRead},
 							ResourceOrganizationMember.Type: {policy.ActionRead},
 						}),
+						Member: []Permission{},
 					},
 				},
 			}
@@ -502,6 +510,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 							ResourceGroupMember.Type:        ResourceGroupMember.AvailableActions(),
 							ResourceIdpsyncSettings.Type:    {policy.ActionRead, policy.ActionUpdate},
 						}),
+						Member: []Permission{},
 					},
 				},
 			}
@@ -531,6 +540,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 							ResourceProvisionerDaemon.Type: {policy.ActionCreate, policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 							ResourceProvisionerJobs.Type:   {policy.ActionRead, policy.ActionUpdate, policy.ActionCreate},
 						}),
+						Member: []Permission{},
 					},
 				},
 			}
@@ -568,6 +578,7 @@ func ReloadBuiltinRoles(opts *RoleOptions) {
 								Action:       policy.ActionDeleteAgent,
 							},
 						},
+						Member: []Permission{},
 					},
 				},
 			}
@@ -680,9 +691,10 @@ func (perm Permission) Valid() error {
 }
 
 // Role is a set of permissions at multiple levels:
-// - Site level permissions apply EVERYWHERE
-// - Org level permissions apply to EVERYTHING in a given ORG
-// - User level permissions are the lowest
+// - Site permissions apply EVERYWHERE
+// - Org permissions apply to EVERYTHING in a given ORG
+// - User permissions apply to all resources the user owns
+// - OrgMember permissions apply to resources in the given org that the user owns
 // This is the type passed into the rego as a json payload.
 // Users of this package should instead **only** use the role names, and
 // this package will expand the role names into their json payloads.
@@ -703,7 +715,8 @@ type Role struct {
 }
 
 type OrgPermissions struct {
-	Org []Permission `json:"org"`
+	Org    []Permission `json:"org"`
+	Member []Permission `json:"member"`
 }
 
 // Valid will check all it's permissions and ensure they are all correct
@@ -720,7 +733,12 @@ func (role Role) Valid() error {
 	for orgID, orgPermissions := range role.ByOrgID {
 		for _, perm := range orgPermissions.Org {
 			if err := perm.Valid(); err != nil {
-				errs = append(errs, xerrors.Errorf("org=%q: %w", orgID, err))
+				errs = append(errs, xerrors.Errorf("org=%q: org %w", orgID, err))
+			}
+		}
+		for _, perm := range orgPermissions.Member {
+			if err := perm.Valid(); err != nil {
+				errs = append(errs, xerrors.Errorf("org=%q: member: %w", orgID, err))
 			}
 		}
 	}
diff --git a/coderd/rbac/roles_internal_test.go b/coderd/rbac/roles_internal_test.go
index 5f18cac44a7b4..b99791b5a1f5b 100644
--- a/coderd/rbac/roles_internal_test.go
+++ b/coderd/rbac/roles_internal_test.go
@@ -33,10 +33,11 @@ func BenchmarkRBACValueAllocation(b *testing.B) {
 			uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
 			uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
 			uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
-		}).WithACLUserList(map[string][]policy.Action{
-		uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
-		uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
-	})
+		}).
+		WithACLUserList(map[string][]policy.Action{
+			uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
+			uuid.NewString(): {policy.ActionRead, policy.ActionCreate},
+		})
 
 	jsonSubject := authSubject{
 		ID:     actor.ID,
@@ -107,7 +108,7 @@ func TestRegoInputValue(t *testing.T) {
 		t.Parallel()
 
 		// This is the input that would be passed to the rego policy.
-		jsonInput := map[string]interface{}{
+		jsonInput := map[string]any{
 			"subject": authSubject{
 				ID:     actor.ID,
 				Roles:  must(actor.Roles.Expand()),
@@ -138,7 +139,7 @@ func TestRegoInputValue(t *testing.T) {
 		t.Parallel()
 
 		// This is the input that would be passed to the rego policy.
-		jsonInput := map[string]interface{}{
+		jsonInput := map[string]any{
 			"subject": authSubject{
 				ID:     actor.ID,
 				Roles:  must(actor.Roles.Expand()),
@@ -146,7 +147,7 @@ func TestRegoInputValue(t *testing.T) {
 				Scope:  must(actor.Scope.Expand()),
 			},
 			"action": action,
-			"object": map[string]interface{}{
+			"object": map[string]any{
 				"type": obj.Type,
 			},
 		}
@@ -282,5 +283,6 @@ func equalRoles(t *testing.T, a, b Role) {
 		bv, ok := b.ByOrgID[ak]
 		require.True(t, ok, "org permissions missing: %s", ak)
 		require.ElementsMatchf(t, av.Org, bv.Org, "org %s permissions", ak)
+		require.ElementsMatchf(t, av.Member, bv.Member, "member %s permissions", ak)
 	}
 }
diff --git a/coderd/workspaceapps/db.go b/coderd/workspaceapps/db.go
index 337f4fab52f8b..4c24cc9325e46 100644
--- a/coderd/workspaceapps/db.go
+++ b/coderd/workspaceapps/db.go
@@ -324,11 +324,19 @@ func (p *DBTokenProvider) authorizeRequest(ctx context.Context, roles *rbac.Subj
 		// rbacResourceOwned is for the level "authenticated". We still need to
 		// make sure the API key has permissions to connect to the actor's own
 		// workspace. Scopes would prevent this.
-		rbacResourceOwned rbac.Object = rbac.ResourceWorkspace.WithOwner(roles.ID)
+		// TODO: This is an odd repercussion of the org_member permission level.
+		// This Object used to not specify an org restriction, and `InOrg` would
+		// actually have a significantly different meaning (only sharing with
+		// other authenticated users in the same org, whereas the existing behavior
+		// is to share with any authenticated user). Because workspaces are always
+		// jointly owned by an organization, there _must_ be an org restriction on
+		// the object to check the proper permissions. AnyOrg is almost the same,
+		// but technically excludes users who are not in any organization. This is
+		// the closest we can get though without more significant refactoring.
+		rbacResourceOwned rbac.Object = rbac.ResourceWorkspace.WithOwner(roles.ID).AnyOrganization()
 	)
 	if dbReq.AccessMethod == AccessMethodTerminal {
 		rbacAction = policy.ActionSSH
-		rbacResourceOwned = rbac.ResourceWorkspace.WithOwner(roles.ID)
 	}
 
 	// Do a standard RBAC check. This accounts for share level "owner" and any
diff --git a/codersdk/roles.go b/codersdk/roles.go
index f248c38798d19..70162f8f09ba4 100644
--- a/codersdk/roles.go
+++ b/codersdk/roles.go
@@ -56,9 +56,11 @@ type Role struct {
 	OrganizationID  string       `json:"organization_id,omitempty" table:"organization id" format:"uuid"`
 	DisplayName     string       `json:"display_name" table:"display name"`
 	SitePermissions []Permission `json:"site_permissions" table:"site permissions"`
+	UserPermissions []Permission `json:"user_permissions" table:"user permissions"`
 	// OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.
 	OrganizationPermissions []Permission `json:"organization_permissions" table:"organization permissions"`
-	UserPermissions         []Permission `json:"user_permissions" table:"user permissions"`
+	// OrganizationMemberPermissions are specific for the organization in the field 'OrganizationID' above.
+	OrganizationMemberPermissions []Permission `json:"organization_member_permissions" table:"organization member permissions"`
 }
 
 // CustomRoleRequest is used to edit custom roles.
@@ -66,9 +68,11 @@ type CustomRoleRequest struct {
 	Name            string       `json:"name" table:"name,default_sort" validate:"username"`
 	DisplayName     string       `json:"display_name" table:"display name"`
 	SitePermissions []Permission `json:"site_permissions" table:"site permissions"`
+	UserPermissions []Permission `json:"user_permissions" table:"user permissions"`
 	// OrganizationPermissions are specific to the organization the role belongs to.
 	OrganizationPermissions []Permission `json:"organization_permissions" table:"organization permissions"`
-	UserPermissions         []Permission `json:"user_permissions" table:"user permissions"`
+	// OrganizationMemberPermissions are specific to the organization the role belongs to.
+	OrganizationMemberPermissions []Permission `json:"organization_member_permissions" table:"organization member permissions"`
 }
 
 // FullName returns the role name scoped to the organization ID. This is useful if
@@ -85,11 +89,12 @@ func (r Role) FullName() string {
 // CreateOrganizationRole will create a custom organization role
 func (c *Client) CreateOrganizationRole(ctx context.Context, role Role) (Role, error) {
 	req := CustomRoleRequest{
-		Name:                    role.Name,
-		DisplayName:             role.DisplayName,
-		SitePermissions:         role.SitePermissions,
-		OrganizationPermissions: role.OrganizationPermissions,
-		UserPermissions:         role.UserPermissions,
+		Name:                          role.Name,
+		DisplayName:                   role.DisplayName,
+		SitePermissions:               role.SitePermissions,
+		UserPermissions:               role.UserPermissions,
+		OrganizationPermissions:       role.OrganizationPermissions,
+		OrganizationMemberPermissions: role.OrganizationMemberPermissions,
 	}
 
 	res, err := c.Request(ctx, http.MethodPost,
@@ -108,11 +113,12 @@ func (c *Client) CreateOrganizationRole(ctx context.Context, role Role) (Role, e
 // UpdateOrganizationRole will update an existing custom organization role
 func (c *Client) UpdateOrganizationRole(ctx context.Context, role Role) (Role, error) {
 	req := CustomRoleRequest{
-		Name:                    role.Name,
-		DisplayName:             role.DisplayName,
-		SitePermissions:         role.SitePermissions,
-		OrganizationPermissions: role.OrganizationPermissions,
-		UserPermissions:         role.UserPermissions,
+		Name:                          role.Name,
+		DisplayName:                   role.DisplayName,
+		SitePermissions:               role.SitePermissions,
+		UserPermissions:               role.UserPermissions,
+		OrganizationPermissions:       role.OrganizationPermissions,
+		OrganizationMemberPermissions: role.OrganizationMemberPermissions,
 	}
 
 	res, err := c.Request(ctx, http.MethodPut,
diff --git a/docs/reference/api/members.md b/docs/reference/api/members.md
index 532b15ec793d7..a2251a59ba099 100644
--- a/docs/reference/api/members.md
+++ b/docs/reference/api/members.md
@@ -112,6 +112,13 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/members
     "display_name": "string",
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+    "organization_member_permissions": [
+      {
+        "action": "application_connect",
+        "negate": true,
+        "resource_type": "*"
+      }
+    ],
     "organization_permissions": [
       {
         "action": "application_connect",
@@ -147,20 +154,21 @@ curl -X GET http://coder-server:8080/api/v2/organizations/{organization}/members
 
 Status Code **200**
 
-| Name                         | Type                                                     | Required | Restrictions | Description                                                                                     |
-|------------------------------|----------------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `[array item]`               | array                                                    | false    |              |                                                                                                 |
-| `» assignable`               | boolean                                                  | false    |              |                                                                                                 |
-| `» built_in`                 | boolean                                                  | false    |              | Built in roles are immutable                                                                    |
-| `» display_name`             | string                                                   | false    |              |                                                                                                 |
-| `» name`                     | string                                                   | false    |              |                                                                                                 |
-| `» organization_id`          | string(uuid)                                             | false    |              |                                                                                                 |
-| `» organization_permissions` | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `»» action`                  | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                 |
-| `»» negate`                  | boolean                                                  | false    |              | Negate makes this a negative permission                                                         |
-| `»» resource_type`           | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                 |
-| `» site_permissions`         | array                                                    | false    |              |                                                                                                 |
-| `» user_permissions`         | array                                                    | false    |              |                                                                                                 |
+| Name                                | Type                                                     | Required | Restrictions | Description                                                                                            |
+|-------------------------------------|----------------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `[array item]`                      | array                                                    | false    |              |                                                                                                        |
+| `» assignable`                      | boolean                                                  | false    |              |                                                                                                        |
+| `» built_in`                        | boolean                                                  | false    |              | Built in roles are immutable                                                                           |
+| `» display_name`                    | string                                                   | false    |              |                                                                                                        |
+| `» name`                            | string                                                   | false    |              |                                                                                                        |
+| `» organization_id`                 | string(uuid)                                             | false    |              |                                                                                                        |
+| `» organization_member_permissions` | array                                                    | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `»» action`                         | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                        |
+| `»» negate`                         | boolean                                                  | false    |              | Negate makes this a negative permission                                                                |
+| `»» resource_type`                  | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                        |
+| `» organization_permissions`        | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `» site_permissions`                | array                                                    | false    |              |                                                                                                        |
+| `» user_permissions`                | array                                                    | false    |              |                                                                                                        |
 
 #### Enumerated Values
 
@@ -248,6 +256,13 @@ curl -X PUT http://coder-server:8080/api/v2/organizations/{organization}/members
 {
   "display_name": "string",
   "name": "string",
+  "organization_member_permissions": [
+    {
+      "action": "application_connect",
+      "negate": true,
+      "resource_type": "*"
+    }
+  ],
   "organization_permissions": [
     {
       "action": "application_connect",
@@ -289,6 +304,13 @@ curl -X PUT http://coder-server:8080/api/v2/organizations/{organization}/members
     "display_name": "string",
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+    "organization_member_permissions": [
+      {
+        "action": "application_connect",
+        "negate": true,
+        "resource_type": "*"
+      }
+    ],
     "organization_permissions": [
       {
         "action": "application_connect",
@@ -324,18 +346,19 @@ curl -X PUT http://coder-server:8080/api/v2/organizations/{organization}/members
 
 Status Code **200**
 
-| Name                         | Type                                                     | Required | Restrictions | Description                                                                                     |
-|------------------------------|----------------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `[array item]`               | array                                                    | false    |              |                                                                                                 |
-| `» display_name`             | string                                                   | false    |              |                                                                                                 |
-| `» name`                     | string                                                   | false    |              |                                                                                                 |
-| `» organization_id`          | string(uuid)                                             | false    |              |                                                                                                 |
-| `» organization_permissions` | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `»» action`                  | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                 |
-| `»» negate`                  | boolean                                                  | false    |              | Negate makes this a negative permission                                                         |
-| `»» resource_type`           | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                 |
-| `» site_permissions`         | array                                                    | false    |              |                                                                                                 |
-| `» user_permissions`         | array                                                    | false    |              |                                                                                                 |
+| Name                                | Type                                                     | Required | Restrictions | Description                                                                                            |
+|-------------------------------------|----------------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `[array item]`                      | array                                                    | false    |              |                                                                                                        |
+| `» display_name`                    | string                                                   | false    |              |                                                                                                        |
+| `» name`                            | string                                                   | false    |              |                                                                                                        |
+| `» organization_id`                 | string(uuid)                                             | false    |              |                                                                                                        |
+| `» organization_member_permissions` | array                                                    | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `»» action`                         | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                        |
+| `»» negate`                         | boolean                                                  | false    |              | Negate makes this a negative permission                                                                |
+| `»» resource_type`                  | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                        |
+| `» organization_permissions`        | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `» site_permissions`                | array                                                    | false    |              |                                                                                                        |
+| `» user_permissions`                | array                                                    | false    |              |                                                                                                        |
 
 #### Enumerated Values
 
@@ -423,6 +446,13 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
 {
   "display_name": "string",
   "name": "string",
+  "organization_member_permissions": [
+    {
+      "action": "application_connect",
+      "negate": true,
+      "resource_type": "*"
+    }
+  ],
   "organization_permissions": [
     {
       "action": "application_connect",
@@ -464,6 +494,13 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
     "display_name": "string",
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+    "organization_member_permissions": [
+      {
+        "action": "application_connect",
+        "negate": true,
+        "resource_type": "*"
+      }
+    ],
     "organization_permissions": [
       {
         "action": "application_connect",
@@ -499,18 +536,19 @@ curl -X POST http://coder-server:8080/api/v2/organizations/{organization}/member
 
 Status Code **200**
 
-| Name                         | Type                                                     | Required | Restrictions | Description                                                                                     |
-|------------------------------|----------------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `[array item]`               | array                                                    | false    |              |                                                                                                 |
-| `» display_name`             | string                                                   | false    |              |                                                                                                 |
-| `» name`                     | string                                                   | false    |              |                                                                                                 |
-| `» organization_id`          | string(uuid)                                             | false    |              |                                                                                                 |
-| `» organization_permissions` | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `»» action`                  | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                 |
-| `»» negate`                  | boolean                                                  | false    |              | Negate makes this a negative permission                                                         |
-| `»» resource_type`           | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                 |
-| `» site_permissions`         | array                                                    | false    |              |                                                                                                 |
-| `» user_permissions`         | array                                                    | false    |              |                                                                                                 |
+| Name                                | Type                                                     | Required | Restrictions | Description                                                                                            |
+|-------------------------------------|----------------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `[array item]`                      | array                                                    | false    |              |                                                                                                        |
+| `» display_name`                    | string                                                   | false    |              |                                                                                                        |
+| `» name`                            | string                                                   | false    |              |                                                                                                        |
+| `» organization_id`                 | string(uuid)                                             | false    |              |                                                                                                        |
+| `» organization_member_permissions` | array                                                    | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `»» action`                         | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                        |
+| `»» negate`                         | boolean                                                  | false    |              | Negate makes this a negative permission                                                                |
+| `»» resource_type`                  | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                        |
+| `» organization_permissions`        | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `» site_permissions`                | array                                                    | false    |              |                                                                                                        |
+| `» user_permissions`                | array                                                    | false    |              |                                                                                                        |
 
 #### Enumerated Values
 
@@ -608,6 +646,13 @@ curl -X DELETE http://coder-server:8080/api/v2/organizations/{organization}/memb
     "display_name": "string",
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+    "organization_member_permissions": [
+      {
+        "action": "application_connect",
+        "negate": true,
+        "resource_type": "*"
+      }
+    ],
     "organization_permissions": [
       {
         "action": "application_connect",
@@ -643,18 +688,19 @@ curl -X DELETE http://coder-server:8080/api/v2/organizations/{organization}/memb
 
 Status Code **200**
 
-| Name                         | Type                                                     | Required | Restrictions | Description                                                                                     |
-|------------------------------|----------------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `[array item]`               | array                                                    | false    |              |                                                                                                 |
-| `» display_name`             | string                                                   | false    |              |                                                                                                 |
-| `» name`                     | string                                                   | false    |              |                                                                                                 |
-| `» organization_id`          | string(uuid)                                             | false    |              |                                                                                                 |
-| `» organization_permissions` | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `»» action`                  | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                 |
-| `»» negate`                  | boolean                                                  | false    |              | Negate makes this a negative permission                                                         |
-| `»» resource_type`           | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                 |
-| `» site_permissions`         | array                                                    | false    |              |                                                                                                 |
-| `» user_permissions`         | array                                                    | false    |              |                                                                                                 |
+| Name                                | Type                                                     | Required | Restrictions | Description                                                                                            |
+|-------------------------------------|----------------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `[array item]`                      | array                                                    | false    |              |                                                                                                        |
+| `» display_name`                    | string                                                   | false    |              |                                                                                                        |
+| `» name`                            | string                                                   | false    |              |                                                                                                        |
+| `» organization_id`                 | string(uuid)                                             | false    |              |                                                                                                        |
+| `» organization_member_permissions` | array                                                    | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `»» action`                         | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                        |
+| `»» negate`                         | boolean                                                  | false    |              | Negate makes this a negative permission                                                                |
+| `»» resource_type`                  | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                        |
+| `» organization_permissions`        | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `» site_permissions`                | array                                                    | false    |              |                                                                                                        |
+| `» user_permissions`                | array                                                    | false    |              |                                                                                                        |
 
 #### Enumerated Values
 
@@ -972,6 +1018,13 @@ curl -X GET http://coder-server:8080/api/v2/users/roles \
     "display_name": "string",
     "name": "string",
     "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+    "organization_member_permissions": [
+      {
+        "action": "application_connect",
+        "negate": true,
+        "resource_type": "*"
+      }
+    ],
     "organization_permissions": [
       {
         "action": "application_connect",
@@ -1007,20 +1060,21 @@ curl -X GET http://coder-server:8080/api/v2/users/roles \
 
 Status Code **200**
 
-| Name                         | Type                                                     | Required | Restrictions | Description                                                                                     |
-|------------------------------|----------------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `[array item]`               | array                                                    | false    |              |                                                                                                 |
-| `» assignable`               | boolean                                                  | false    |              |                                                                                                 |
-| `» built_in`                 | boolean                                                  | false    |              | Built in roles are immutable                                                                    |
-| `» display_name`             | string                                                   | false    |              |                                                                                                 |
-| `» name`                     | string                                                   | false    |              |                                                                                                 |
-| `» organization_id`          | string(uuid)                                             | false    |              |                                                                                                 |
-| `» organization_permissions` | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `»» action`                  | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                 |
-| `»» negate`                  | boolean                                                  | false    |              | Negate makes this a negative permission                                                         |
-| `»» resource_type`           | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                 |
-| `» site_permissions`         | array                                                    | false    |              |                                                                                                 |
-| `» user_permissions`         | array                                                    | false    |              |                                                                                                 |
+| Name                                | Type                                                     | Required | Restrictions | Description                                                                                            |
+|-------------------------------------|----------------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `[array item]`                      | array                                                    | false    |              |                                                                                                        |
+| `» assignable`                      | boolean                                                  | false    |              |                                                                                                        |
+| `» built_in`                        | boolean                                                  | false    |              | Built in roles are immutable                                                                           |
+| `» display_name`                    | string                                                   | false    |              |                                                                                                        |
+| `» name`                            | string                                                   | false    |              |                                                                                                        |
+| `» organization_id`                 | string(uuid)                                             | false    |              |                                                                                                        |
+| `» organization_member_permissions` | array                                                    | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `»» action`                         | [codersdk.RBACAction](schemas.md#codersdkrbacaction)     | false    |              |                                                                                                        |
+| `»» negate`                         | boolean                                                  | false    |              | Negate makes this a negative permission                                                                |
+| `»» resource_type`                  | [codersdk.RBACResource](schemas.md#codersdkrbacresource) | false    |              |                                                                                                        |
+| `» organization_permissions`        | array                                                    | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `» site_permissions`                | array                                                    | false    |              |                                                                                                        |
+| `» user_permissions`                | array                                                    | false    |              |                                                                                                        |
 
 #### Enumerated Values
 
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index cb3345e67c122..dd1314357ac68 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -1106,6 +1106,13 @@
   "display_name": "string",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+  "organization_member_permissions": [
+    {
+      "action": "application_connect",
+      "negate": true,
+      "resource_type": "*"
+    }
+  ],
   "organization_permissions": [
     {
       "action": "application_connect",
@@ -1132,16 +1139,17 @@
 
 ### Properties
 
-| Name                       | Type                                                | Required | Restrictions | Description                                                                                     |
-|----------------------------|-----------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `assignable`               | boolean                                             | false    |              |                                                                                                 |
-| `built_in`                 | boolean                                             | false    |              | Built in roles are immutable                                                                    |
-| `display_name`             | string                                              | false    |              |                                                                                                 |
-| `name`                     | string                                              | false    |              |                                                                                                 |
-| `organization_id`          | string                                              | false    |              |                                                                                                 |
-| `organization_permissions` | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `site_permissions`         | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                 |
-| `user_permissions`         | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                 |
+| Name                              | Type                                                | Required | Restrictions | Description                                                                                            |
+|-----------------------------------|-----------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `assignable`                      | boolean                                             | false    |              |                                                                                                        |
+| `built_in`                        | boolean                                             | false    |              | Built in roles are immutable                                                                           |
+| `display_name`                    | string                                              | false    |              |                                                                                                        |
+| `name`                            | string                                              | false    |              |                                                                                                        |
+| `organization_id`                 | string                                              | false    |              |                                                                                                        |
+| `organization_member_permissions` | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `organization_permissions`        | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `site_permissions`                | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                        |
+| `user_permissions`                | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                        |
 
 ## codersdk.AuditAction
 
@@ -2491,6 +2499,13 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
 {
   "display_name": "string",
   "name": "string",
+  "organization_member_permissions": [
+    {
+      "action": "application_connect",
+      "negate": true,
+      "resource_type": "*"
+    }
+  ],
   "organization_permissions": [
     {
       "action": "application_connect",
@@ -2517,13 +2532,14 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
 
 ### Properties
 
-| Name                       | Type                                                | Required | Restrictions | Description                                                                    |
-|----------------------------|-----------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------|
-| `display_name`             | string                                              | false    |              |                                                                                |
-| `name`                     | string                                              | false    |              |                                                                                |
-| `organization_permissions` | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization permissions are specific to the organization the role belongs to. |
-| `site_permissions`         | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                |
-| `user_permissions`         | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                |
+| Name                              | Type                                                | Required | Restrictions | Description                                                                           |
+|-----------------------------------|-----------------------------------------------------|----------|--------------|---------------------------------------------------------------------------------------|
+| `display_name`                    | string                                              | false    |              |                                                                                       |
+| `name`                            | string                                              | false    |              |                                                                                       |
+| `organization_member_permissions` | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization member permissions are specific to the organization the role belongs to. |
+| `organization_permissions`        | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization permissions are specific to the organization the role belongs to.        |
+| `site_permissions`                | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                       |
+| `user_permissions`                | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                       |
 
 ## codersdk.DAUEntry
 
@@ -7391,6 +7407,13 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
   "display_name": "string",
   "name": "string",
   "organization_id": "7c60d51f-b44e-4682-87d6-449835ea4de6",
+  "organization_member_permissions": [
+    {
+      "action": "application_connect",
+      "negate": true,
+      "resource_type": "*"
+    }
+  ],
   "organization_permissions": [
     {
       "action": "application_connect",
@@ -7417,14 +7440,15 @@ Only certain features set these fields: - FeatureManagedAgentLimit|
 
 ### Properties
 
-| Name                       | Type                                                | Required | Restrictions | Description                                                                                     |
-|----------------------------|-----------------------------------------------------|----------|--------------|-------------------------------------------------------------------------------------------------|
-| `display_name`             | string                                              | false    |              |                                                                                                 |
-| `name`                     | string                                              | false    |              |                                                                                                 |
-| `organization_id`          | string                                              | false    |              |                                                                                                 |
-| `organization_permissions` | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above. |
-| `site_permissions`         | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                 |
-| `user_permissions`         | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                 |
+| Name                              | Type                                                | Required | Restrictions | Description                                                                                            |
+|-----------------------------------|-----------------------------------------------------|----------|--------------|--------------------------------------------------------------------------------------------------------|
+| `display_name`                    | string                                              | false    |              |                                                                                                        |
+| `name`                            | string                                              | false    |              |                                                                                                        |
+| `organization_id`                 | string                                              | false    |              |                                                                                                        |
+| `organization_member_permissions` | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization member permissions are specific for the organization in the field 'OrganizationID' above. |
+| `organization_permissions`        | array of [codersdk.Permission](#codersdkpermission) | false    |              | Organization permissions are specific for the organization in the field 'OrganizationID' above.        |
+| `site_permissions`                | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                        |
+| `user_permissions`                | array of [codersdk.Permission](#codersdkpermission) | false    |              |                                                                                                        |
 
 ## codersdk.RoleSyncSettings
 
diff --git a/enterprise/coderd/roles.go b/enterprise/coderd/roles.go
index 30432af76c7eb..f103a8d1b06a0 100644
--- a/enterprise/coderd/roles.go
+++ b/enterprise/coderd/roles.go
@@ -311,5 +311,13 @@ func validOrganizationRoleRequest(ctx context.Context, req codersdk.CustomRoleRe
 		return false
 	}
 
+	if len(req.OrganizationMemberPermissions) > 0 {
+		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
+			Message: "Invalid request, not allowed to assign organization member permissions for an organization role.",
+			Detail:  "organization scoped roles may not contain organization member permissions",
+		})
+		return false
+	}
+
 	return true
 }
diff --git a/site/e2e/api.ts b/site/e2e/api.ts
index 0a1765d464b26..92469aa2f177e 100644
--- a/site/e2e/api.ts
+++ b/site/e2e/api.ts
@@ -199,6 +199,7 @@ export const createCustomRole = async (
 			},
 		],
 		user_permissions: [],
+		organization_member_permissions: [],
 	});
 	return role;
 };
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 5e9bc73975da6..ec42dbd82b58b 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -1520,11 +1520,15 @@ export interface CustomRoleRequest {
 	readonly name: string;
 	readonly display_name: string;
 	readonly site_permissions: readonly Permission[];
+	readonly user_permissions: readonly Permission[];
 	/**
 	 * OrganizationPermissions are specific to the organization the role belongs to.
 	 */
 	readonly organization_permissions: readonly Permission[];
-	readonly user_permissions: readonly Permission[];
+	/**
+	 * OrganizationMemberPermissions are specific to the organization the role belongs to.
+	 */
+	readonly organization_member_permissions: readonly Permission[];
 }
 
 // From codersdk/deployment.go
@@ -4140,11 +4144,15 @@ export interface Role {
 	readonly organization_id?: string;
 	readonly display_name: string;
 	readonly site_permissions: readonly Permission[];
+	readonly user_permissions: readonly Permission[];
 	/**
 	 * OrganizationPermissions are specific for the organization in the field 'OrganizationID' above.
 	 */
 	readonly organization_permissions: readonly Permission[];
-	readonly user_permissions: readonly Permission[];
+	/**
+	 * OrganizationMemberPermissions are specific for the organization in the field 'OrganizationID' above.
+	 */
+	readonly organization_member_permissions: readonly Permission[];
 }
 
 // From codersdk/rbacroles.go
diff --git a/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx b/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx
index 97a2030071a45..97299e31f0c54 100644
--- a/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx
+++ b/site/src/pages/OrganizationSettingsPage/CustomRolesPage/CreateEditRolePageView.tsx
@@ -66,9 +66,11 @@ const CreateEditRolePageView: FC<CreateEditRolePageViewProps> = ({
 		initialValues: {
 			name: role?.name || "",
 			display_name: role?.display_name || "",
-			site_permissions: role?.site_permissions || [],
-			organization_permissions: role?.organization_permissions || [],
-			user_permissions: role?.user_permissions || [],
+			site_permissions: role?.site_permissions ?? [],
+			user_permissions: role?.user_permissions ?? [],
+			organization_permissions: role?.organization_permissions ?? [],
+			organization_member_permissions:
+				role?.organization_member_permissions ?? [],
 		},
 		validationSchema,
 		onSubmit,
diff --git a/site/src/pages/UsersPage/storybookData/roles.ts b/site/src/pages/UsersPage/storybookData/roles.ts
index 66228a00f794b..d885d4f695c07 100644
--- a/site/src/pages/UsersPage/storybookData/roles.ts
+++ b/site/src/pages/UsersPage/storybookData/roles.ts
@@ -197,8 +197,9 @@ export const MockRoles: (AssignableRoles | Role)[] = [
 				action: "stop",
 			},
 		],
-		organization_permissions: [],
 		user_permissions: [],
+		organization_permissions: [],
+		organization_member_permissions: [],
 		assignable: true,
 		built_in: true,
 	},
@@ -292,8 +293,9 @@ export const MockRoles: (AssignableRoles | Role)[] = [
 				action: "read",
 			},
 		],
-		organization_permissions: [],
 		user_permissions: [],
+		organization_permissions: [],
+		organization_member_permissions: [],
 		assignable: true,
 		built_in: true,
 	},
@@ -407,8 +409,9 @@ export const MockRoles: (AssignableRoles | Role)[] = [
 				action: "create",
 			},
 		],
-		organization_permissions: [],
 		user_permissions: [],
+		organization_permissions: [],
+		organization_member_permissions: [],
 		assignable: true,
 		built_in: true,
 	},
@@ -462,8 +465,9 @@ export const MockRoles: (AssignableRoles | Role)[] = [
 				action: "read",
 			},
 		],
-		organization_permissions: [],
 		user_permissions: [],
+		organization_permissions: [],
+		organization_member_permissions: [],
 		built_in: true,
 	},
 ];
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index 18eb661ea72e3..a12d91cf51a8e 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -281,45 +281,50 @@ export const MockOwnerRole: TypesGen.Role = {
 	name: "owner",
 	display_name: "Owner",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: "",
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockUserAdminRole: TypesGen.Role = {
 	name: "user_admin",
 	display_name: "User Admin",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: "",
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockTemplateAdminRole: TypesGen.Role = {
 	name: "template_admin",
 	display_name: "Template Admin",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: "",
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockAuditorRole: TypesGen.Role = {
 	name: "auditor",
 	display_name: "Auditor",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: "",
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockWorkspaceCreationBanRole: TypesGen.Role = {
 	name: "organization-workspace-creation-ban",
 	display_name: "Organization Workspace Creation Ban",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: "",
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockMemberRole: TypesGen.SlimRole = {
@@ -331,27 +336,30 @@ export const MockOrganizationAdminRole: TypesGen.Role = {
 	name: "organization-admin",
 	display_name: "Organization Admin",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: MockOrganization.id,
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockOrganizationUserAdminRole: TypesGen.Role = {
 	name: "organization-user-admin",
 	display_name: "Organization User Admin",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: MockOrganization.id,
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockOrganizationTemplateAdminRole: TypesGen.Role = {
 	name: "organization-template-admin",
 	display_name: "Organization Template Admin",
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: MockOrganization.id,
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockOrganizationAuditorRole: TypesGen.AssignableRoles = {
@@ -360,18 +368,20 @@ export const MockOrganizationAuditorRole: TypesGen.AssignableRoles = {
 	assignable: true,
 	built_in: false,
 	site_permissions: [],
-	organization_permissions: [],
 	user_permissions: [],
 	organization_id: MockOrganization.id,
+	organization_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockRoleWithOrgPermissions: TypesGen.AssignableRoles = {
 	name: "my-role-1",
 	display_name: "My Role 1",
-	organization_id: MockOrganization.id,
 	assignable: true,
 	built_in: false,
 	site_permissions: [],
+	user_permissions: [],
+	organization_id: MockOrganization.id,
 	organization_permissions: [
 		{
 			negate: false,
@@ -454,14 +464,15 @@ export const MockRoleWithOrgPermissions: TypesGen.AssignableRoles = {
 			action: "create",
 		},
 	],
-	user_permissions: [],
+	organization_member_permissions: [],
 };
 
 export const MockRole2WithOrgPermissions: TypesGen.Role = {
 	name: "my-role-1",
 	display_name: "My Role 1",
-	organization_id: MockOrganization.id,
 	site_permissions: [],
+	user_permissions: [],
+	organization_id: MockOrganization.id,
 	organization_permissions: [
 		{
 			negate: false,
@@ -469,7 +480,7 @@ export const MockRole2WithOrgPermissions: TypesGen.Role = {
 			action: "create",
 		},
 	],
-	user_permissions: [],
+	organization_member_permissions: [],
 };
 
 // assignableRole takes a role and a boolean. The boolean implies if the

From d18441debeb6765016326ed925123013df3f7f2f Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Mon, 27 Oct 2025 21:38:14 -0600
Subject: [PATCH 268/298] feat: add AWS Bedrock support (#20507)

Depends on https://github.com/coder/aibridge/pull/44

Closes https://github.com/coder/aibridge/issues/28

---------

Signed-off-by: Danny Kopping <danny@coder.com>
---
 cli/testdata/server-config.yaml.golden        | 22 +++++-
 coderd/apidoc/docs.go                         | 23 ++++++
 coderd/apidoc/swagger.json                    | 23 ++++++
 codersdk/deployment.go                        | 70 ++++++++++++++++++-
 docs/reference/api/general.md                 |  7 ++
 docs/reference/api/schemas.md                 | 51 ++++++++++++++
 enterprise/cli/aibridged.go                   | 21 +++++-
 .../x/aibridged/aibridged_integration_test.go |  2 +-
 enterprise/x/aibridged/aibridged_test.go      |  4 +-
 go.mod                                        |  3 +-
 go.sum                                        |  6 +-
 site/src/api/typesGenerated.ts                | 10 +++
 12 files changed, 228 insertions(+), 14 deletions(-)

diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
index 40666c10e8394..cbabf0474f291 100644
--- a/cli/testdata/server-config.yaml.golden
+++ b/cli/testdata/server-config.yaml.golden
@@ -726,7 +726,25 @@ aibridge:
   openai_key: ""
   # The base URL of the Anthropic API.
   # (default: https://api.anthropic.com/, type: string)
-  base_url: https://api.anthropic.com/
+  anthropic_base_url: https://api.anthropic.com/
   # The key to authenticate against the Anthropic API.
   # (default: <unset>, type: string)
-  key: ""
+  anthropic_key: ""
+  # The AWS Bedrock API region.
+  # (default: <unset>, type: string)
+  bedrock_region: ""
+  # The access key to authenticate against the AWS Bedrock API.
+  # (default: <unset>, type: string)
+  bedrock_access_key: ""
+  # The access key secret to use with the access key to authenticate against the AWS
+  # Bedrock API.
+  # (default: <unset>, type: string)
+  bedrock_access_key_secret: ""
+  # The model to use when making requests to the AWS Bedrock API.
+  # (default: global.anthropic.claude-sonnet-4-5-20250929-v1:0, type: string)
+  bedrock_model: global.anthropic.claude-sonnet-4-5-20250929-v1:0
+  # The small fast model to use when making requests to the AWS Bedrock API. Claude
+  # Code uses Haiku-class models to perform background tasks. See
+  # https://docs.claude.com/en/docs/claude-code/settings#environment-variables.
+  # (default: global.anthropic.claude-haiku-4-5-20251001-v1:0, type: string)
+  bedrock_small_fast_model: global.anthropic.claude-haiku-4-5-20251001-v1:0
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index a83fdd9b4d592..45b220eb9d255 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -11668,12 +11668,35 @@ const docTemplate = `{
                 }
             }
         },
+        "codersdk.AIBridgeBedrockConfig": {
+            "type": "object",
+            "properties": {
+                "access_key": {
+                    "type": "string"
+                },
+                "access_key_secret": {
+                    "type": "string"
+                },
+                "model": {
+                    "type": "string"
+                },
+                "region": {
+                    "type": "string"
+                },
+                "small_fast_model": {
+                    "type": "string"
+                }
+            }
+        },
         "codersdk.AIBridgeConfig": {
             "type": "object",
             "properties": {
                 "anthropic": {
                     "$ref": "#/definitions/codersdk.AIBridgeAnthropicConfig"
                 },
+                "bedrock": {
+                    "$ref": "#/definitions/codersdk.AIBridgeBedrockConfig"
+                },
                 "enabled": {
                     "type": "boolean"
                 },
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index f02a2ed7bc585..8e6a0030cb83b 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -10364,12 +10364,35 @@
 				}
 			}
 		},
+		"codersdk.AIBridgeBedrockConfig": {
+			"type": "object",
+			"properties": {
+				"access_key": {
+					"type": "string"
+				},
+				"access_key_secret": {
+					"type": "string"
+				},
+				"model": {
+					"type": "string"
+				},
+				"region": {
+					"type": "string"
+				},
+				"small_fast_model": {
+					"type": "string"
+				}
+			}
+		},
 		"codersdk.AIBridgeConfig": {
 			"type": "object",
 			"properties": {
 				"anthropic": {
 					"$ref": "#/definitions/codersdk.AIBridgeAnthropicConfig"
 				},
+				"bedrock": {
+					"$ref": "#/definitions/codersdk.AIBridgeBedrockConfig"
+				},
 				"enabled": {
 					"type": "boolean"
 				},
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 2f6f6bba03697..97bbb13bedbc7 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -3280,18 +3280,73 @@ Write out the current server config as YAML to stdout.`,
 			Value:       &c.AI.BridgeConfig.Anthropic.BaseURL,
 			Default:     "https://api.anthropic.com/",
 			Group:       &deploymentGroupAIBridge,
-			YAML:        "base_url",
+			YAML:        "anthropic_base_url",
 			Hidden:      true,
 		},
 		{
-			Name:        "AIBridge Anthropic KEY",
+			Name:        "AIBridge Anthropic Key",
 			Description: "The key to authenticate against the Anthropic API.",
 			Flag:        "aibridge-anthropic-key",
 			Env:         "CODER_AIBRIDGE_ANTHROPIC_KEY",
 			Value:       &c.AI.BridgeConfig.Anthropic.Key,
 			Default:     "",
 			Group:       &deploymentGroupAIBridge,
-			YAML:        "key",
+			YAML:        "anthropic_key",
+			Hidden:      true,
+		},
+		{
+			Name:        "AIBridge Bedrock Region",
+			Description: "The AWS Bedrock API region.",
+			Flag:        "aibridge-bedrock-region",
+			Env:         "CODER_AIBRIDGE_BEDROCK_REGION",
+			Value:       &c.AI.BridgeConfig.Bedrock.Region,
+			Default:     "",
+			Group:       &deploymentGroupAIBridge,
+			YAML:        "bedrock_region",
+			Hidden:      true,
+		},
+		{
+			Name:        "AIBridge Bedrock Access Key",
+			Description: "The access key to authenticate against the AWS Bedrock API.",
+			Flag:        "aibridge-bedrock-access-key",
+			Env:         "CODER_AIBRIDGE_BEDROCK_ACCESS_KEY",
+			Value:       &c.AI.BridgeConfig.Bedrock.AccessKey,
+			Default:     "",
+			Group:       &deploymentGroupAIBridge,
+			YAML:        "bedrock_access_key",
+			Hidden:      true,
+		},
+		{
+			Name:        "AIBridge Bedrock Access Key Secret",
+			Description: "The access key secret to use with the access key to authenticate against the AWS Bedrock API.",
+			Flag:        "aibridge-bedrock-access-key-secret",
+			Env:         "CODER_AIBRIDGE_BEDROCK_ACCESS_KEY_SECRET",
+			Value:       &c.AI.BridgeConfig.Bedrock.AccessKeySecret,
+			Default:     "",
+			Group:       &deploymentGroupAIBridge,
+			YAML:        "bedrock_access_key_secret",
+			Hidden:      true,
+		},
+		{
+			Name:        "AIBridge Bedrock Model",
+			Description: "The model to use when making requests to the AWS Bedrock API.",
+			Flag:        "aibridge-bedrock-model",
+			Env:         "CODER_AIBRIDGE_BEDROCK_MODEL",
+			Value:       &c.AI.BridgeConfig.Bedrock.Model,
+			Default:     "global.anthropic.claude-sonnet-4-5-20250929-v1:0", // See https://docs.claude.com/en/api/claude-on-amazon-bedrock#accessing-bedrock.
+			Group:       &deploymentGroupAIBridge,
+			YAML:        "bedrock_model",
+			Hidden:      true,
+		},
+		{
+			Name:        "AIBridge Bedrock Small Fast Model",
+			Description: "The small fast model to use when making requests to the AWS Bedrock API. Claude Code uses Haiku-class models to perform background tasks. See https://docs.claude.com/en/docs/claude-code/settings#environment-variables.",
+			Flag:        "aibridge-bedrock-small-fastmodel",
+			Env:         "CODER_AIBRIDGE_BEDROCK_SMALL_FAST_MODEL",
+			Value:       &c.AI.BridgeConfig.Bedrock.SmallFastModel,
+			Default:     "global.anthropic.claude-haiku-4-5-20251001-v1:0", // See https://docs.claude.com/en/api/claude-on-amazon-bedrock#accessing-bedrock.
+			Group:       &deploymentGroupAIBridge,
+			YAML:        "bedrock_small_fast_model",
 			Hidden:      true,
 		},
 		{
@@ -3316,6 +3371,7 @@ type AIBridgeConfig struct {
 	Enabled   serpent.Bool            `json:"enabled" typescript:",notnull"`
 	OpenAI    AIBridgeOpenAIConfig    `json:"openai" typescript:",notnull"`
 	Anthropic AIBridgeAnthropicConfig `json:"anthropic" typescript:",notnull"`
+	Bedrock   AIBridgeBedrockConfig   `json:"bedrock" typescript:",notnull"`
 }
 
 type AIBridgeOpenAIConfig struct {
@@ -3328,6 +3384,14 @@ type AIBridgeAnthropicConfig struct {
 	Key     serpent.String `json:"key" typescript:",notnull"`
 }
 
+type AIBridgeBedrockConfig struct {
+	Region          serpent.String `json:"region" typescript:",notnull"`
+	AccessKey       serpent.String `json:"access_key" typescript:",notnull"`
+	AccessKeySecret serpent.String `json:"access_key_secret" typescript:",notnull"`
+	Model           serpent.String `json:"model" typescript:",notnull"`
+	SmallFastModel  serpent.String `json:"small_fast_model" typescript:",notnull"`
+}
+
 type AIConfig struct {
 	BridgeConfig AIBridgeConfig `json:"bridge,omitempty"`
 }
diff --git a/docs/reference/api/general.md b/docs/reference/api/general.md
index ad15e8fac2ae3..5718979ae86c2 100644
--- a/docs/reference/api/general.md
+++ b/docs/reference/api/general.md
@@ -167,6 +167,13 @@ curl -X GET http://coder-server:8080/api/v2/deployment/config \
           "base_url": "string",
           "key": "string"
         },
+        "bedrock": {
+          "access_key": "string",
+          "access_key_secret": "string",
+          "model": "string",
+          "region": "string",
+          "small_fast_model": "string"
+        },
         "enabled": true,
         "openai": {
           "base_url": "string",
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index dd1314357ac68..796b4811cc4c1 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -351,6 +351,28 @@
 | `base_url` | string | false    |              |             |
 | `key`      | string | false    |              |             |
 
+## codersdk.AIBridgeBedrockConfig
+
+```json
+{
+  "access_key": "string",
+  "access_key_secret": "string",
+  "model": "string",
+  "region": "string",
+  "small_fast_model": "string"
+}
+```
+
+### Properties
+
+| Name                | Type   | Required | Restrictions | Description |
+|---------------------|--------|----------|--------------|-------------|
+| `access_key`        | string | false    |              |             |
+| `access_key_secret` | string | false    |              |             |
+| `model`             | string | false    |              |             |
+| `region`            | string | false    |              |             |
+| `small_fast_model`  | string | false    |              |             |
+
 ## codersdk.AIBridgeConfig
 
 ```json
@@ -359,6 +381,13 @@
     "base_url": "string",
     "key": "string"
   },
+  "bedrock": {
+    "access_key": "string",
+    "access_key_secret": "string",
+    "model": "string",
+    "region": "string",
+    "small_fast_model": "string"
+  },
   "enabled": true,
   "openai": {
     "base_url": "string",
@@ -372,6 +401,7 @@
 | Name        | Type                                                                 | Required | Restrictions | Description |
 |-------------|----------------------------------------------------------------------|----------|--------------|-------------|
 | `anthropic` | [codersdk.AIBridgeAnthropicConfig](#codersdkaibridgeanthropicconfig) | false    |              |             |
+| `bedrock`   | [codersdk.AIBridgeBedrockConfig](#codersdkaibridgebedrockconfig)     | false    |              |             |
 | `enabled`   | boolean                                                              | false    |              |             |
 | `openai`    | [codersdk.AIBridgeOpenAIConfig](#codersdkaibridgeopenaiconfig)       | false    |              |             |
 
@@ -654,6 +684,13 @@
       "base_url": "string",
       "key": "string"
     },
+    "bedrock": {
+      "access_key": "string",
+      "access_key_secret": "string",
+      "model": "string",
+      "region": "string",
+      "small_fast_model": "string"
+    },
     "enabled": true,
     "openai": {
       "base_url": "string",
@@ -2803,6 +2840,13 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
           "base_url": "string",
           "key": "string"
         },
+        "bedrock": {
+          "access_key": "string",
+          "access_key_secret": "string",
+          "model": "string",
+          "region": "string",
+          "small_fast_model": "string"
+        },
         "enabled": true,
         "openai": {
           "base_url": "string",
@@ -3310,6 +3354,13 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
         "base_url": "string",
         "key": "string"
       },
+      "bedrock": {
+        "access_key": "string",
+        "access_key_secret": "string",
+        "model": "string",
+        "region": "string",
+        "small_fast_model": "string"
+      },
       "enabled": true,
       "openai": {
         "base_url": "string",
diff --git a/enterprise/cli/aibridged.go b/enterprise/cli/aibridged.go
index 9e59327039fc3..17bb5ebe681fa 100644
--- a/enterprise/cli/aibridged.go
+++ b/enterprise/cli/aibridged.go
@@ -8,6 +8,7 @@ import (
 	"golang.org/x/xerrors"
 
 	"github.com/coder/aibridge"
+	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/enterprise/coderd"
 	"github.com/coder/coder/v2/enterprise/x/aibridged"
 )
@@ -20,14 +21,14 @@ func newAIBridgeDaemon(coderAPI *coderd.API) (*aibridged.Server, error) {
 
 	// Setup supported providers.
 	providers := []aibridge.Provider{
-		aibridge.NewOpenAIProvider(aibridge.ProviderConfig{
+		aibridge.NewOpenAIProvider(aibridge.OpenAIConfig{
 			BaseURL: coderAPI.DeploymentValues.AI.BridgeConfig.OpenAI.BaseURL.String(),
 			Key:     coderAPI.DeploymentValues.AI.BridgeConfig.OpenAI.Key.String(),
 		}),
-		aibridge.NewAnthropicProvider(aibridge.ProviderConfig{
+		aibridge.NewAnthropicProvider(aibridge.AnthropicConfig{
 			BaseURL: coderAPI.DeploymentValues.AI.BridgeConfig.Anthropic.BaseURL.String(),
 			Key:     coderAPI.DeploymentValues.AI.BridgeConfig.Anthropic.Key.String(),
-		}),
+		}, getBedrockConfig(coderAPI.DeploymentValues.AI.BridgeConfig.Bedrock)),
 	}
 
 	// Create pool for reusable stateful [aibridge.RequestBridge] instances (one per user).
@@ -45,3 +46,17 @@ func newAIBridgeDaemon(coderAPI *coderd.API) (*aibridged.Server, error) {
 	}
 	return srv, nil
 }
+
+func getBedrockConfig(cfg codersdk.AIBridgeBedrockConfig) *aibridge.AWSBedrockConfig {
+	if cfg.Region.String() == "" && cfg.AccessKey.String() == "" && cfg.AccessKeySecret.String() == "" {
+		return nil
+	}
+
+	return &aibridge.AWSBedrockConfig{
+		Region:          cfg.Region.String(),
+		AccessKey:       cfg.AccessKey.String(),
+		AccessKeySecret: cfg.AccessKeySecret.String(),
+		Model:           cfg.Model.String(),
+		SmallFastModel:  cfg.SmallFastModel.String(),
+	}
+}
diff --git a/enterprise/x/aibridged/aibridged_integration_test.go b/enterprise/x/aibridged/aibridged_integration_test.go
index 69d7627e04c5f..45d47bd1b3507 100644
--- a/enterprise/x/aibridged/aibridged_integration_test.go
+++ b/enterprise/x/aibridged/aibridged_integration_test.go
@@ -164,7 +164,7 @@ func TestIntegration(t *testing.T) {
 	require.NoError(t, err)
 
 	logger := testutil.Logger(t)
-	providers := []aibridge.Provider{aibridge.NewOpenAIProvider(aibridge.ProviderConfig{BaseURL: mockOpenAI.URL})}
+	providers := []aibridge.Provider{aibridge.NewOpenAIProvider(aibridge.OpenAIConfig{BaseURL: mockOpenAI.URL})}
 	pool, err := aibridged.NewCachedBridgePool(aibridged.DefaultPoolOptions, providers, logger)
 	require.NoError(t, err)
 
diff --git a/enterprise/x/aibridged/aibridged_test.go b/enterprise/x/aibridged/aibridged_test.go
index 84e493090563c..967e9aac2bce3 100644
--- a/enterprise/x/aibridged/aibridged_test.go
+++ b/enterprise/x/aibridged/aibridged_test.go
@@ -288,8 +288,8 @@ func TestRouting(t *testing.T) {
 			client := mock.NewMockDRPCClient(ctrl)
 
 			providers := []aibridge.Provider{
-				aibridge.NewOpenAIProvider(aibridge.ProviderConfig{BaseURL: openaiSrv.URL}),
-				aibridge.NewAnthropicProvider(aibridge.ProviderConfig{BaseURL: antSrv.URL}),
+				aibridge.NewOpenAIProvider(aibridge.OpenAIConfig{BaseURL: openaiSrv.URL}),
+				aibridge.NewAnthropicProvider(aibridge.AnthropicConfig{BaseURL: antSrv.URL}, nil),
 			}
 			pool, err := aibridged.NewCachedBridgePool(aibridged.DefaultPoolOptions, providers, logger)
 			require.NoError(t, err)
diff --git a/go.mod b/go.mod
index 3f4bf60c15ce3..d87c8300234c8 100644
--- a/go.mod
+++ b/go.mod
@@ -476,7 +476,7 @@ require (
 	github.com/anthropics/anthropic-sdk-go v1.13.0
 	github.com/brianvoe/gofakeit/v7 v7.8.0
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
-	github.com/coder/aibridge v0.1.5
+	github.com/coder/aibridge v0.1.6
 	github.com/coder/aisdk-go v0.0.9
 	github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945
 	github.com/coder/preview v1.0.4
@@ -509,6 +509,7 @@ require (
 	github.com/aquasecurity/trivy v0.61.1-0.20250407075540-f1329c7ea1aa // indirect
 	github.com/aquasecurity/trivy-checks v1.11.3-0.20250604022615-9a7efa7c9169 // indirect
 	github.com/aws/aws-sdk-go v1.55.7 // indirect
+	github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 // indirect
 	github.com/bahlo/generic-list-go v0.2.0 // indirect
 	github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
 	github.com/buger/jsonparser v1.1.1 // indirect
diff --git a/go.sum b/go.sum
index ee37485533080..2655cb93f2cbd 100644
--- a/go.sum
+++ b/go.sum
@@ -764,6 +764,8 @@ github.com/aws/aws-sdk-go v1.55.7 h1:UJrkFq7es5CShfBwlWAC8DA077vp8PyVbQd3lqLiztE
 github.com/aws/aws-sdk-go v1.55.7/go.mod h1:eRwEWoyTWFMVYVQzKMNHWP5/RV4xIUGMQfXQHfHkpNU=
 github.com/aws/aws-sdk-go-v2 v1.39.2 h1:EJLg8IdbzgeD7xgvZ+I8M1e0fL0ptn/M47lianzth0I=
 github.com/aws/aws-sdk-go-v2 v1.39.2/go.mod h1:sDioUELIUO9Znk23YVmIk86/9DOpkbyyVb1i/gUNFXY=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11 h1:12SpdwU8Djs+YGklkinSSlcrPyj3H4VifVsKf78KbwA=
+github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.6.11/go.mod h1:dd+Lkp6YmMryke+qxW/VnKyhMBDTYP41Q2Bb+6gNZgY=
 github.com/aws/aws-sdk-go-v2/config v1.31.3 h1:RIb3yr/+PZ18YYNe6MDiG/3jVoJrPmdoCARwNkMGvco=
 github.com/aws/aws-sdk-go-v2/config v1.31.3/go.mod h1:jjgx1n7x0FAKl6TnakqrpkHWWKcX3xfWtdnIJs5K9CE=
 github.com/aws/aws-sdk-go-v2/credentials v1.18.7 h1:zqg4OMrKj+t5HlswDApgvAHjxKtlduKS7KicXB+7RLg=
@@ -915,8 +917,8 @@ github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225 h1:tRIViZ5JRmzdOEo5wUWngaGEFBG8OaE1o2GIHN5ujJ8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225/go.mod h1:rNLVpYgEVeu1Zk29K64z6Od8RBP9DwqCu9OfCzh8MR4=
-github.com/coder/aibridge v0.1.5 h1:uSrltfLZWF2qOaq9RDzJW/26Ow1wMFwcwObBM0WikME=
-github.com/coder/aibridge v0.1.5/go.mod h1:Q5MCfKMcKYmYl4qH1Zd0rltmPaUBPKFvIPs2k9q6qeY=
+github.com/coder/aibridge v0.1.6 h1:Ax9hfAQeg+vLeE9M/IMmARuBuGyCuFdMw8bpy72/fD8=
+github.com/coder/aibridge v0.1.6/go.mod h1:7GhrLbzf6uM3sCA7OPaDzvq9QNrCjNuzMy+WgipYwfQ=
 github.com/coder/aisdk-go v0.0.9 h1:Vzo/k2qwVGLTR10ESDeP2Ecek1SdPfZlEjtTfMveiVo=
 github.com/coder/aisdk-go v0.0.9/go.mod h1:KF6/Vkono0FJJOtWtveh5j7yfNrSctVTpwgweYWSp5M=
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3+5B+v5KdYvORs4YNfDPci0zCs+pC0=
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index ec42dbd82b58b..d671cc2bb117e 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -16,11 +16,21 @@ export interface AIBridgeAnthropicConfig {
 	readonly key: string;
 }
 
+// From codersdk/deployment.go
+export interface AIBridgeBedrockConfig {
+	readonly region: string;
+	readonly access_key: string;
+	readonly access_key_secret: string;
+	readonly model: string;
+	readonly small_fast_model: string;
+}
+
 // From codersdk/deployment.go
 export interface AIBridgeConfig {
 	readonly enabled: boolean;
 	readonly openai: AIBridgeOpenAIConfig;
 	readonly anthropic: AIBridgeAnthropicConfig;
+	readonly bedrock: AIBridgeBedrockConfig;
 }
 
 // From codersdk/aibridge.go

From e720afa9d0d4721753abe096ecd16621ae6c53a6 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Tue, 28 Oct 2025 10:11:25 +0400
Subject: [PATCH 269/298] docs: add description of dynamic parameters test
 (#20488)

## Add Dynamic Parameters test procedure to 10k users validated architecture

This PR adds a new test procedure for Dynamic Parameters to the 10k users validated architecture documentation. No changes to the recommended hardware specs as this test case succeeded with no issues.
---
 .../validated-architectures/10k-users.md         | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/docs/admin/infrastructure/validated-architectures/10k-users.md b/docs/admin/infrastructure/validated-architectures/10k-users.md
index e6413711188f7..486ac8192c991 100644
--- a/docs/admin/infrastructure/validated-architectures/10k-users.md
+++ b/docs/admin/infrastructure/validated-architectures/10k-users.md
@@ -40,6 +40,22 @@ Test procedure:
 
 After, we examine the Coderd, Workspace Proxy, and Database metrics to look for issues.
 
+### Dynamic Parameters
+
+1000 connections simulating changing parameters while configuring a new workspace.
+
+Test procedure:
+
+1. Create a template with complex parameter logic and multiple template versions.
+1. Partition the connections among the template versions (forces Coder to process multiple template files)
+1. Simultaneously connect to the dynamic-parameters API websocket endpoint for the template version
+1. Wait for the initial parameter update.
+1. Send a new parameter value that has cascading effects among other parameters.
+1. Wait for the next update.
+
+After, we examine the latency in the initial connection and update, as well as Coderd and Database metrics to look for
+issues.
+
 ### API Request Traffic
 
 To be determined.

From dec6d310a89431b7e14b76481352edb4c33e5116 Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Tue, 28 Oct 2025 17:19:52 +1100
Subject: [PATCH 270/298] fix: avoid bad switch statement in license code
 (#20509)

Noticed this while trying to investigate a flake.

Relates to https://github.com/coder/internal/issues/788
---
 enterprise/coderd/license/license.go | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/enterprise/coderd/license/license.go b/enterprise/coderd/license/license.go
index 7fbac30fae744..e66915f221f5a 100644
--- a/enterprise/coderd/license/license.go
+++ b/enterprise/coderd/license/license.go
@@ -490,15 +490,15 @@ func LicensesEntitlements(
 		if featureArguments.ManagedAgentCountFn != nil {
 			managedAgentCount, err = featureArguments.ManagedAgentCountFn(ctx, agentLimit.UsagePeriod.Start, agentLimit.UsagePeriod.End)
 		}
-		switch {
-		case xerrors.Is(err, context.Canceled) || xerrors.Is(err, context.DeadlineExceeded):
+		if xerrors.Is(err, context.Canceled) || xerrors.Is(err, context.DeadlineExceeded) {
 			// If the context is canceled, we want to bail the entire
 			// LicensesEntitlements call.
 			return entitlements, xerrors.Errorf("get managed agent count: %w", err)
-		case err != nil:
-			entitlements.Errors = append(entitlements.Errors,
-				fmt.Sprintf("Error getting managed agent count: %s", err.Error()))
-		default:
+		}
+		if err != nil {
+			entitlements.Errors = append(entitlements.Errors, fmt.Sprintf("Error getting managed agent count: %s", err.Error()))
+			// no return
+		} else {
 			agentLimit.Actual = &managedAgentCount
 			entitlements.AddFeature(codersdk.FeatureManagedAgentLimit, agentLimit)
 

From 88b7372e7fb8960daae47743927f647709398382 Mon Sep 17 00:00:00 2001
From: Hugo Dutka <hugo@coder.com>
Date: Tue, 28 Oct 2025 12:58:25 +0100
Subject: [PATCH 271/298] chore: remove custom go cache download step from CI
 (#20510)

Since depot added [native support for go
cache](https://depot.dev/docs/cache/reference/gocache), custom cache
download and upload steps are not necessary anymore.
---
 .github/workflows/ci.yaml | 16 +---------------
 1 file changed, 1 insertion(+), 15 deletions(-)

diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml
index 4b9b037e13f6b..96d0ce23953cf 100644
--- a/.github/workflows/ci.yaml
+++ b/.github/workflows/ci.yaml
@@ -376,13 +376,6 @@ jobs:
         id: go-paths
         uses: ./.github/actions/setup-go-paths
 
-      - name: Download Go Build Cache
-        id: download-go-build-cache
-        uses: ./.github/actions/test-cache/download
-        with:
-          key-prefix: test-go-build-${{ runner.os }}-${{ runner.arch }}
-          cache-path: ${{ steps.go-paths.outputs.cached-dirs }}
-
       - name: Setup Go
         uses: ./.github/actions/setup-go
         with:
@@ -390,8 +383,7 @@ jobs:
           # download the toolchain configured in go.mod, so we don't
           # need to reinstall it. It's faster on Windows runners.
           use-preinstalled-go: ${{ runner.os == 'Windows' }}
-          # Cache is already downloaded above
-          use-cache: false
+          use-cache: true
 
       - name: Setup Terraform
         uses: ./.github/actions/setup-tf
@@ -505,12 +497,6 @@ jobs:
           name: failed-test-db-dump-${{matrix.os}}
           path: "**/*.test.sql"
 
-      - name: Upload Go Build Cache
-        uses: ./.github/actions/test-cache/upload
-        with:
-          cache-key: ${{ steps.download-go-build-cache.outputs.cache-key }}
-          cache-path: ${{ steps.go-paths.outputs.cached-dirs }}
-
       - name: Upload Test Cache
         uses: ./.github/actions/test-cache/upload
         with:

From a1fa58ac17c4b0db8891a085ec7aa46612200e4d Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Tue, 28 Oct 2025 14:15:58 +0200
Subject: [PATCH 272/298] fix: update dbgen and dbfake task creation and
 toolsdk test fixtures (#20508)

Depends on #20506
Fixes coder/internal#1103
---
 coderd/aitasks.go                 |  1 +
 coderd/database/dbfake/dbfake.go  | 55 +++++++++++++++++---
 coderd/database/dbgen/dbgen.go    |  1 +
 coderd/database/querier_test.go   |  3 ++
 coderd/database/queries.sql.go    |  4 +-
 coderd/database/queries/tasks.sql |  2 +-
 codersdk/toolsdk/toolsdk_test.go  | 85 +++++++++++--------------------
 7 files changed, 87 insertions(+), 64 deletions(-)

diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 1d06daeae96c0..8601b501963f3 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -241,6 +241,7 @@ func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 			// Create task record in the database before creating the workspace so that
 			// we can request that the workspace be linked to it after creation.
 			dbTaskTable, err = tx.InsertTask(ctx, database.InsertTaskParams{
+				ID:                 uuid.New(),
 				OrganizationID:     templateVersion.OrganizationID,
 				OwnerID:            owner.ID,
 				Name:               taskName,
diff --git a/coderd/database/dbfake/dbfake.go b/coderd/database/dbfake/dbfake.go
index 12c1a28d98d34..b812be6e16a82 100644
--- a/coderd/database/dbfake/dbfake.go
+++ b/coderd/database/dbfake/dbfake.go
@@ -41,6 +41,7 @@ type WorkspaceResponse struct {
 	Build      database.WorkspaceBuild
 	AgentToken string
 	TemplateVersionResponse
+	Task database.Task
 }
 
 // WorkspaceBuildBuilder generates workspace builds and associated
@@ -57,6 +58,7 @@ type WorkspaceBuildBuilder struct {
 	agentToken string
 	jobStatus  database.ProvisionerJobStatus
 	taskAppID  uuid.UUID
+	taskSeed   database.TaskTable
 }
 
 // WorkspaceBuild generates a workspace build for the provided workspace.
@@ -115,25 +117,28 @@ func (b WorkspaceBuildBuilder) WithAgent(mutations ...func([]*sdkproto.Agent) []
 	return b
 }
 
-func (b WorkspaceBuildBuilder) WithTask(seed *sdkproto.App) WorkspaceBuildBuilder {
-	if seed == nil {
-		seed = &sdkproto.App{}
+func (b WorkspaceBuildBuilder) WithTask(taskSeed database.TaskTable, appSeed *sdkproto.App) WorkspaceBuildBuilder {
+	//nolint:revive // returns modified struct
+	b.taskSeed = taskSeed
+
+	if appSeed == nil {
+		appSeed = &sdkproto.App{}
 	}
 
 	var err error
 	//nolint: revive // returns modified struct
-	b.taskAppID, err = uuid.Parse(takeFirst(seed.Id, uuid.NewString()))
+	b.taskAppID, err = uuid.Parse(takeFirst(appSeed.Id, uuid.NewString()))
 	require.NoError(b.t, err)
 
 	return b.Params(database.WorkspaceBuildParameter{
 		Name:  codersdk.AITaskPromptParameterName,
-		Value: "list me",
+		Value: b.taskSeed.Prompt,
 	}).WithAgent(func(a []*sdkproto.Agent) []*sdkproto.Agent {
 		a[0].Apps = []*sdkproto.App{
 			{
 				Id:   b.taskAppID.String(),
-				Slug: takeFirst(seed.Slug, "task-app"),
-				Url:  takeFirst(seed.Url, ""),
+				Slug: takeFirst(appSeed.Slug, "task-app"),
+				Url:  takeFirst(appSeed.Url, ""),
 			},
 		}
 		return a
@@ -225,6 +230,37 @@ func (b WorkspaceBuildBuilder) doInTX() WorkspaceResponse {
 	b.seed.WorkspaceID = b.ws.ID
 	b.seed.InitiatorID = takeFirst(b.seed.InitiatorID, b.ws.OwnerID)
 
+	// If a task was requested, ensure it exists and is associated with this
+	// workspace.
+	if b.taskAppID != uuid.Nil {
+		b.logger.Debug(context.Background(), "creating or updating task", "task_id", b.taskSeed.ID)
+		b.taskSeed.OrganizationID = takeFirst(b.taskSeed.OrganizationID, b.ws.OrganizationID)
+		b.taskSeed.OwnerID = takeFirst(b.taskSeed.OwnerID, b.ws.OwnerID)
+		b.taskSeed.Name = takeFirst(b.taskSeed.Name, b.ws.Name)
+		b.taskSeed.WorkspaceID = uuid.NullUUID{UUID: takeFirst(b.taskSeed.WorkspaceID.UUID, b.ws.ID), Valid: true}
+		b.taskSeed.TemplateVersionID = takeFirst(b.taskSeed.TemplateVersionID, b.seed.TemplateVersionID)
+
+		// Try to fetch existing task and update its workspace ID.
+		if task, err := b.db.GetTaskByID(ownerCtx, b.taskSeed.ID); err == nil {
+			if !task.WorkspaceID.Valid {
+				b.logger.Info(context.Background(), "updating task workspace id", "task_id", b.taskSeed.ID, "workspace_id", b.ws.ID)
+				_, err = b.db.UpdateTaskWorkspaceID(ownerCtx, database.UpdateTaskWorkspaceIDParams{
+					ID:          b.taskSeed.ID,
+					WorkspaceID: uuid.NullUUID{UUID: b.ws.ID, Valid: true},
+				})
+				require.NoError(b.t, err, "update task workspace id")
+			} else if task.WorkspaceID.UUID != b.ws.ID {
+				require.Fail(b.t, "task already has a workspace id, mismatch", task.WorkspaceID.UUID, b.ws.ID)
+			}
+		} else if errors.Is(err, sql.ErrNoRows) {
+			task := dbgen.Task(b.t, b.db, b.taskSeed)
+			b.taskSeed.ID = task.ID
+			b.logger.Info(context.Background(), "created new task", "task_id", b.taskSeed.ID)
+		} else {
+			require.NoError(b.t, err, "get task by id")
+		}
+	}
+
 	// Create a provisioner job for the build!
 	payload, err := json.Marshal(provisionerdserver.WorkspaceProvisionJob{
 		WorkspaceBuildID: b.seed.ID,
@@ -337,6 +373,11 @@ func (b WorkspaceBuildBuilder) doInTX() WorkspaceResponse {
 		b.logger.Debug(context.Background(), "linked task to workspace build",
 			slog.F("task_id", task.ID),
 			slog.F("build_number", resp.Build.BuildNumber))
+
+		// Update task after linking.
+		task, err = b.db.GetTaskByID(ownerCtx, task.ID)
+		require.NoError(b.t, err, "get task by id")
+		resp.Task = task
 	}
 
 	for i := range b.params {
diff --git a/coderd/database/dbgen/dbgen.go b/coderd/database/dbgen/dbgen.go
index 0a62911223c6f..532460700a1e2 100644
--- a/coderd/database/dbgen/dbgen.go
+++ b/coderd/database/dbgen/dbgen.go
@@ -1576,6 +1576,7 @@ func Task(t testing.TB, db database.Store, orig database.TaskTable) database.Tas
 	}
 
 	task, err := db.InsertTask(genCtx, database.InsertTaskParams{
+		ID:                 takeFirst(orig.ID, uuid.New()),
 		OrganizationID:     orig.OrganizationID,
 		OwnerID:            orig.OwnerID,
 		Name:               takeFirst(orig.Name, taskname.GenerateFallback()),
diff --git a/coderd/database/querier_test.go b/coderd/database/querier_test.go
index e1b6cbd7adfda..773f944756576 100644
--- a/coderd/database/querier_test.go
+++ b/coderd/database/querier_test.go
@@ -7248,7 +7248,9 @@ func TestTaskNameUniqueness(t *testing.T) {
 
 			ctx := testutil.Context(t, testutil.WaitShort)
 
+			taskID := uuid.New()
 			task, err := db.InsertTask(ctx, database.InsertTaskParams{
+				ID:                 taskID,
 				OrganizationID:     org.ID,
 				OwnerID:            tt.ownerID,
 				Name:               tt.taskName,
@@ -7263,6 +7265,7 @@ func TestTaskNameUniqueness(t *testing.T) {
 				require.NoError(t, err)
 				require.NotEqual(t, uuid.Nil, task.ID)
 				require.NotEqual(t, task1.ID, task.ID)
+				require.Equal(t, taskID, task.ID)
 			}
 		})
 	}
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index e6dfa9afd0919..8e24ab04c9ce3 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -13019,11 +13019,12 @@ const insertTask = `-- name: InsertTask :one
 INSERT INTO tasks
 	(id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at)
 VALUES
-	(gen_random_uuid(), $1, $2, $3, $4, $5, $6, $7, $8)
+	($1, $2, $3, $4, $5, $6, $7, $8, $9)
 RETURNING id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at
 `
 
 type InsertTaskParams struct {
+	ID                 uuid.UUID       `db:"id" json:"id"`
 	OrganizationID     uuid.UUID       `db:"organization_id" json:"organization_id"`
 	OwnerID            uuid.UUID       `db:"owner_id" json:"owner_id"`
 	Name               string          `db:"name" json:"name"`
@@ -13036,6 +13037,7 @@ type InsertTaskParams struct {
 
 func (q *sqlQuerier) InsertTask(ctx context.Context, arg InsertTaskParams) (TaskTable, error) {
 	row := q.db.QueryRowContext(ctx, insertTask,
+		arg.ID,
 		arg.OrganizationID,
 		arg.OwnerID,
 		arg.Name,
diff --git a/coderd/database/queries/tasks.sql b/coderd/database/queries/tasks.sql
index 6c076b8ccaacf..d0617ad39f4dc 100644
--- a/coderd/database/queries/tasks.sql
+++ b/coderd/database/queries/tasks.sql
@@ -2,7 +2,7 @@
 INSERT INTO tasks
 	(id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at)
 VALUES
-	(gen_random_uuid(), $1, $2, $3, $4, $5, $6, $7, $8)
+	($1, $2, $3, $4, $5, $6, $7, $8, $9)
 RETURNING *;
 
 -- name: UpdateTaskWorkspaceID :one
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index 44da500400e5e..749105f5b85ed 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -895,37 +895,27 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		ws1Table := dbgen.Workspace(t, store, database.WorkspaceTable{
+		build1 := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
 			Name:           "delete-task-workspace-1",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		})
-		task1 := dbgen.Task(t, store, database.TaskTable{
-			OrganizationID:    owner.OrganizationID,
-			OwnerID:           member.ID,
-			Name:              ws1Table.Name,
-			WorkspaceID:       uuid.NullUUID{UUID: ws1Table.ID, Valid: true},
-			TemplateVersionID: aiTV.TemplateVersion.ID,
-			Prompt:            "delete task 1",
-		})
-		_ = dbfake.WorkspaceBuild(t, store, ws1Table).WithTask(nil).Do()
+		}).WithTask(database.TaskTable{
+			Name:   "delete-task-1",
+			Prompt: "delete task 1",
+		}, nil).Do()
+		task1 := build1.Task
 
-		ws2Table := dbgen.Workspace(t, store, database.WorkspaceTable{
+		build2 := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
 			Name:           "delete-task-workspace-2",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		})
-		task2 := dbgen.Task(t, store, database.TaskTable{
-			OrganizationID:    owner.OrganizationID,
-			OwnerID:           member.ID,
-			Name:              ws2Table.Name,
-			WorkspaceID:       uuid.NullUUID{UUID: ws2Table.ID, Valid: true},
-			TemplateVersionID: aiTV.TemplateVersion.ID,
-			Prompt:            "delete task 2",
-		})
-		_ = dbfake.WorkspaceBuild(t, store, ws2Table).WithTask(nil).Do()
+		}).WithTask(database.TaskTable{
+			Name:   "delete-task-2",
+			Prompt: "delete task 2",
+		}, nil).Do()
+		task2 := build2.Task
 
 		tests := []struct {
 			name  string
@@ -1113,21 +1103,16 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		ws1Table := dbgen.Workspace(t, store, database.WorkspaceTable{
+		build := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
 			Name:           "get-task-workspace-1",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		})
-		task := dbgen.Task(t, store, database.TaskTable{
-			OrganizationID:    owner.OrganizationID,
-			OwnerID:           member.ID,
-			Name:              "get-task-1",
-			WorkspaceID:       uuid.NullUUID{UUID: ws1Table.ID, Valid: true},
-			TemplateVersionID: aiTV.TemplateVersion.ID,
-			Prompt:            "get task",
-		})
-		_ = dbfake.WorkspaceBuild(t, store, ws1Table).WithTask(nil).Do()
+		}).WithTask(database.TaskTable{
+			Name:   "get-task-1",
+			Prompt: "get task",
+		}, nil).Do()
+		task := build.Task
 
 		tests := []struct {
 			name     string
@@ -1376,21 +1361,16 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		wsTable := dbgen.Workspace(t, store, database.WorkspaceTable{
+		ws := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
 			Name:           "send-task-input-ws",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		})
-		task := dbgen.Task(t, store, database.TaskTable{
-			OrganizationID:    owner.OrganizationID,
-			OwnerID:           member.ID,
-			Name:              "send-task-input",
-			WorkspaceID:       uuid.NullUUID{UUID: wsTable.ID, Valid: true},
-			TemplateVersionID: aiTV.TemplateVersion.ID,
-			Prompt:            "send task input",
-		})
-		ws := dbfake.WorkspaceBuild(t, store, wsTable).WithTask(&proto.App{Url: srv.URL}).Do()
+		}).WithTask(database.TaskTable{
+			Name:   "send-task-input",
+			Prompt: "send task input",
+		}, &proto.App{Url: srv.URL}).Do()
+		task := ws.Task
 
 		_ = agenttest.New(t, client.URL, ws.AgentToken)
 		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.Workspace.ID).Wait()
@@ -1513,21 +1493,16 @@ func TestTools(t *testing.T) {
 			},
 		}).Do()
 
-		wsTable := dbgen.Workspace(t, store, database.WorkspaceTable{
+		ws := dbfake.WorkspaceBuild(t, store, database.WorkspaceTable{
 			Name:           "get-task-logs-ws",
 			OrganizationID: owner.OrganizationID,
 			OwnerID:        member.ID,
 			TemplateID:     aiTV.Template.ID,
-		})
-		task := dbgen.Task(t, store, database.TaskTable{
-			OrganizationID:    owner.OrganizationID,
-			OwnerID:           member.ID,
-			Name:              "get-task-logs",
-			WorkspaceID:       uuid.NullUUID{UUID: wsTable.ID, Valid: true},
-			TemplateVersionID: aiTV.TemplateVersion.ID,
-			Prompt:            "get task logs",
-		})
-		ws := dbfake.WorkspaceBuild(t, store, wsTable).WithTask(&proto.App{Url: srv.URL}).Do()
+		}).WithTask(database.TaskTable{
+			Name:   "get-task-logs",
+			Prompt: "get task logs",
+		}, &proto.App{Url: srv.URL}).Do()
+		task := ws.Task
 
 		_ = agenttest.New(t, client.URL, ws.AgentToken)
 		coderdtest.NewWorkspaceAgentWaiter(t, client, ws.Workspace.ID).Wait()

From e4e4669feb9f249c8f28794dab0ec32db1d202b7 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Tue, 28 Oct 2025 12:16:42 +0000
Subject: [PATCH 273/298] fix(agent/agentcontainers): remove unneeded default
 branch (#20511)

Closes https://github.com/coder/internal/issues/769

According to the `time.NewTicker` documentation [^1] (which is used
under the hood by https://github.com/coder/quartz) it will automatically
adjust the time interval to make up for slow receivers. This means we
should be safe to drop the default branch.

> NewTicker returns a new Ticker containing a channel that will send the
current time on the channel after each tick. The period of the ticks is
specified by the duration argument. The ticker will adjust the time
interval or drop ticks to make up for slow receivers. The duration d
must be greater than zero; if not, NewTicker will panic.

[^1]: https://pkg.go.dev/time#Ticker
---
 agent/agentcontainers/api.go | 2 --
 1 file changed, 2 deletions(-)

diff --git a/agent/agentcontainers/api.go b/agent/agentcontainers/api.go
index d77d4209cb245..b5a6ed74d597a 100644
--- a/agent/agentcontainers/api.go
+++ b/agent/agentcontainers/api.go
@@ -682,8 +682,6 @@ func (api *API) updaterLoop() {
 			} else {
 				prevErr = nil
 			}
-		default:
-			api.logger.Debug(api.ctx, "updater loop ticker skipped, update in progress")
 		}
 
 		return nil // Always nil to keep the ticker going.

From 659f89e079f9e14bdfedbd8c8149fb006b913385 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Tue, 28 Oct 2025 14:29:29 +0000
Subject: [PATCH 274/298] feat(coderd): add owner-related fields to
 tasks_with_status view (#20471)

Relates to
https://github.com/coder/coder/pull/20431/files#diff-9cfc826a6ce7e77d977b2025482474dd263d12965b2a94479a74c7f1d872b782

If the workspace relating to a task was deleted, most of the
workspace-related fields in `taskFromDBTaskAndWorkspace` will be
zero-valued. However, we can still get information relating to the owner
so that "created by" shows up correctly in the UI.

Updates the `tasks_with_status` view with a join on `visible_users` to
get owner-related info.
---
 coderd/aitasks.go                             |  4 +-
 coderd/database/dump.sql                      | 30 ++++---
 ...391_tasks_with_status_user_fields.down.sql | 74 ++++++++++++++++
 ...00391_tasks_with_status_user_fields.up.sql | 84 +++++++++++++++++++
 coderd/database/models.go                     |  3 +
 coderd/database/queries.sql.go                | 15 +++-
 6 files changed, 194 insertions(+), 16 deletions(-)
 create mode 100644 coderd/database/migrations/000391_tasks_with_status_user_fields.down.sql
 create mode 100644 coderd/database/migrations/000391_tasks_with_status_user_fields.up.sql

diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 8601b501963f3..8415a01454d0a 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -339,8 +339,8 @@ func taskFromDBTaskAndWorkspace(dbTask database.Task, ws codersdk.Workspace) cod
 		ID:                      dbTask.ID,
 		OrganizationID:          dbTask.OrganizationID,
 		OwnerID:                 dbTask.OwnerID,
-		OwnerName:               ws.OwnerName,
-		OwnerAvatarURL:          ws.OwnerAvatarURL,
+		OwnerName:               dbTask.OwnerUsername,
+		OwnerAvatarURL:          dbTask.OwnerAvatarUrl,
 		Name:                    dbTask.Name,
 		TemplateID:              ws.TemplateID,
 		TemplateVersionID:       dbTask.TemplateVersionID,
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index b61b678bba61d..837c657402bf2 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -1828,6 +1828,15 @@ CREATE TABLE tasks (
     deleted_at timestamp with time zone
 );
 
+CREATE VIEW visible_users AS
+ SELECT users.id,
+    users.username,
+    users.name,
+    users.avatar_url
+   FROM users;
+
+COMMENT ON VIEW visible_users IS 'Visible fields of users are allowed to be joined with other tables for including context of other resources.';
+
 CREATE TABLE workspace_agents (
     id uuid NOT NULL,
     created_at timestamp with time zone NOT NULL,
@@ -1978,8 +1987,16 @@ CREATE VIEW tasks_with_status AS
         END AS status,
     task_app.workspace_build_number,
     task_app.workspace_agent_id,
-    task_app.workspace_app_id
-   FROM ((((tasks
+    task_app.workspace_app_id,
+    task_owner.owner_username,
+    task_owner.owner_name,
+    task_owner.owner_avatar_url
+   FROM (((((tasks
+     CROSS JOIN LATERAL ( SELECT vu.username AS owner_username,
+            vu.name AS owner_name,
+            vu.avatar_url AS owner_avatar_url
+           FROM visible_users vu
+          WHERE (vu.id = tasks.owner_id)) task_owner)
      LEFT JOIN LATERAL ( SELECT task_app_1.workspace_build_number,
             task_app_1.workspace_agent_id,
             task_app_1.workspace_app_id
@@ -2210,15 +2227,6 @@ COMMENT ON COLUMN template_versions.external_auth_providers IS 'IDs of External
 
 COMMENT ON COLUMN template_versions.message IS 'Message describing the changes in this version of the template, similar to a Git commit message. Like a commit message, this should be a short, high-level description of the changes in this version of the template. This message is immutable and should not be updated after the fact.';
 
-CREATE VIEW visible_users AS
- SELECT users.id,
-    users.username,
-    users.name,
-    users.avatar_url
-   FROM users;
-
-COMMENT ON VIEW visible_users IS 'Visible fields of users are allowed to be joined with other tables for including context of other resources.';
-
 CREATE VIEW template_version_with_user AS
  SELECT template_versions.id,
     template_versions.template_id,
diff --git a/coderd/database/migrations/000391_tasks_with_status_user_fields.down.sql b/coderd/database/migrations/000391_tasks_with_status_user_fields.down.sql
new file mode 100644
index 0000000000000..ff103d47e0da2
--- /dev/null
+++ b/coderd/database/migrations/000391_tasks_with_status_user_fields.down.sql
@@ -0,0 +1,74 @@
+-- Drop view from 000390_tasks_with_status_user_fields.up.sql.
+DROP VIEW IF EXISTS tasks_with_status;
+
+-- Restore from 000382_add_columns_to_tasks_with_status.up.sql.
+CREATE VIEW
+	tasks_with_status
+AS
+	SELECT
+		tasks.*,
+		CASE
+			WHEN tasks.workspace_id IS NULL OR latest_build.job_status IS NULL THEN 'pending'::task_status
+
+			WHEN latest_build.job_status = 'failed' THEN 'error'::task_status
+
+			WHEN latest_build.transition IN ('stop', 'delete')
+				AND latest_build.job_status = 'succeeded' THEN 'paused'::task_status
+
+			WHEN latest_build.transition = 'start'
+				AND latest_build.job_status = 'pending' THEN 'initializing'::task_status
+
+			WHEN latest_build.transition = 'start' AND latest_build.job_status IN ('running', 'succeeded') THEN
+				CASE
+					WHEN agent_status.none THEN 'initializing'::task_status
+					WHEN agent_status.connecting THEN 'initializing'::task_status
+					WHEN agent_status.connected THEN
+						CASE
+							WHEN app_status.any_unhealthy THEN 'error'::task_status
+							WHEN app_status.any_initializing THEN 'initializing'::task_status
+							WHEN app_status.all_healthy_or_disabled THEN 'active'::task_status
+							ELSE 'unknown'::task_status
+						END
+					ELSE 'unknown'::task_status
+				END
+
+			ELSE 'unknown'::task_status
+		END AS status,
+		task_app.*
+	FROM
+		tasks
+	LEFT JOIN LATERAL (
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps task_app
+		WHERE task_id = tasks.id
+		ORDER BY workspace_build_number DESC
+		LIMIT 1
+	) task_app ON TRUE
+	LEFT JOIN LATERAL (
+		SELECT
+			workspace_build.transition,
+			provisioner_job.job_status,
+			workspace_build.job_id
+		FROM workspace_builds workspace_build
+		JOIN provisioner_jobs provisioner_job ON provisioner_job.id = workspace_build.job_id
+		WHERE workspace_build.workspace_id = tasks.workspace_id
+			AND workspace_build.build_number = task_app.workspace_build_number
+	) latest_build ON TRUE
+	CROSS JOIN LATERAL (
+		SELECT
+			COUNT(*) = 0 AS none,
+			bool_or(workspace_agent.lifecycle_state IN ('created', 'starting')) AS connecting,
+			bool_and(workspace_agent.lifecycle_state = 'ready') AS connected
+		FROM workspace_agents workspace_agent
+		WHERE workspace_agent.id = task_app.workspace_agent_id
+	) agent_status
+	CROSS JOIN LATERAL (
+		SELECT
+			bool_or(workspace_app.health = 'unhealthy') AS any_unhealthy,
+			bool_or(workspace_app.health = 'initializing') AS any_initializing,
+			bool_and(workspace_app.health IN ('healthy', 'disabled')) AS all_healthy_or_disabled
+		FROM workspace_apps workspace_app
+		WHERE workspace_app.id = task_app.workspace_app_id
+	) app_status
+	WHERE
+		tasks.deleted_at IS NULL;
diff --git a/coderd/database/migrations/000391_tasks_with_status_user_fields.up.sql b/coderd/database/migrations/000391_tasks_with_status_user_fields.up.sql
new file mode 100644
index 0000000000000..243772c241bf7
--- /dev/null
+++ b/coderd/database/migrations/000391_tasks_with_status_user_fields.up.sql
@@ -0,0 +1,84 @@
+-- Drop view from 00037_add_columns_to_tasks_with_status.up.sql.
+DROP VIEW IF EXISTS tasks_with_status;
+
+-- Add owner_name, owner_avatar_url columns.
+CREATE VIEW
+	tasks_with_status
+AS
+	SELECT
+		tasks.*,
+		CASE
+			WHEN tasks.workspace_id IS NULL OR latest_build.job_status IS NULL THEN 'pending'::task_status
+
+			WHEN latest_build.job_status = 'failed' THEN 'error'::task_status
+
+			WHEN latest_build.transition IN ('stop', 'delete')
+				AND latest_build.job_status = 'succeeded' THEN 'paused'::task_status
+
+			WHEN latest_build.transition = 'start'
+				AND latest_build.job_status = 'pending' THEN 'initializing'::task_status
+
+			WHEN latest_build.transition = 'start' AND latest_build.job_status IN ('running', 'succeeded') THEN
+				CASE
+					WHEN agent_status.none THEN 'initializing'::task_status
+					WHEN agent_status.connecting THEN 'initializing'::task_status
+					WHEN agent_status.connected THEN
+						CASE
+							WHEN app_status.any_unhealthy THEN 'error'::task_status
+							WHEN app_status.any_initializing THEN 'initializing'::task_status
+							WHEN app_status.all_healthy_or_disabled THEN 'active'::task_status
+							ELSE 'unknown'::task_status
+						END
+					ELSE 'unknown'::task_status
+				END
+
+			ELSE 'unknown'::task_status
+		END AS status,
+		task_app.*,
+		task_owner.*
+	FROM
+		tasks
+	CROSS JOIN LATERAL (
+		SELECT
+			vu.username AS owner_username,
+			vu.name AS owner_name,
+			vu.avatar_url AS owner_avatar_url
+			FROM visible_users vu
+		WHERE vu.id = tasks.owner_id
+	) task_owner
+	LEFT JOIN LATERAL (
+		SELECT workspace_build_number, workspace_agent_id, workspace_app_id
+		FROM task_workspace_apps task_app
+		WHERE task_id = tasks.id
+		ORDER BY workspace_build_number DESC
+		LIMIT 1
+	) task_app ON TRUE
+	LEFT JOIN LATERAL (
+		SELECT
+			workspace_build.transition,
+			provisioner_job.job_status,
+			workspace_build.job_id
+		FROM workspace_builds workspace_build
+		JOIN provisioner_jobs provisioner_job ON provisioner_job.id = workspace_build.job_id
+		WHERE workspace_build.workspace_id = tasks.workspace_id
+			AND workspace_build.build_number = task_app.workspace_build_number
+	) latest_build ON TRUE
+	CROSS JOIN LATERAL (
+		SELECT
+			COUNT(*) = 0 AS none,
+			bool_or(workspace_agent.lifecycle_state IN ('created', 'starting')) AS connecting,
+			bool_and(workspace_agent.lifecycle_state = 'ready') AS connected
+		FROM workspace_agents workspace_agent
+		WHERE workspace_agent.id = task_app.workspace_agent_id
+	) agent_status
+	CROSS JOIN LATERAL (
+		SELECT
+			bool_or(workspace_app.health = 'unhealthy') AS any_unhealthy,
+			bool_or(workspace_app.health = 'initializing') AS any_initializing,
+			bool_and(workspace_app.health IN ('healthy', 'disabled')) AS all_healthy_or_disabled
+		FROM workspace_apps workspace_app
+		WHERE workspace_app.id = task_app.workspace_app_id
+	) app_status
+	WHERE
+		tasks.deleted_at IS NULL;
+
diff --git a/coderd/database/models.go b/coderd/database/models.go
index b3d41b25f9983..e55f3a553721b 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -4221,6 +4221,9 @@ type Task struct {
 	WorkspaceBuildNumber sql.NullInt32   `db:"workspace_build_number" json:"workspace_build_number"`
 	WorkspaceAgentID     uuid.NullUUID   `db:"workspace_agent_id" json:"workspace_agent_id"`
 	WorkspaceAppID       uuid.NullUUID   `db:"workspace_app_id" json:"workspace_app_id"`
+	OwnerUsername        string          `db:"owner_username" json:"owner_username"`
+	OwnerName            string          `db:"owner_name" json:"owner_name"`
+	OwnerAvatarUrl       string          `db:"owner_avatar_url" json:"owner_avatar_url"`
 }
 
 type TaskTable struct {
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 8e24ab04c9ce3..2005f98347c6c 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -12964,7 +12964,7 @@ func (q *sqlQuerier) DeleteTask(ctx context.Context, arg DeleteTaskParams) (Task
 }
 
 const getTaskByID = `-- name: GetTaskByID :one
-SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status WHERE id = $1::uuid
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id, owner_username, owner_name, owner_avatar_url FROM tasks_with_status WHERE id = $1::uuid
 `
 
 func (q *sqlQuerier) GetTaskByID(ctx context.Context, id uuid.UUID) (Task, error) {
@@ -12985,12 +12985,15 @@ func (q *sqlQuerier) GetTaskByID(ctx context.Context, id uuid.UUID) (Task, error
 		&i.WorkspaceBuildNumber,
 		&i.WorkspaceAgentID,
 		&i.WorkspaceAppID,
+		&i.OwnerUsername,
+		&i.OwnerName,
+		&i.OwnerAvatarUrl,
 	)
 	return i, err
 }
 
 const getTaskByWorkspaceID = `-- name: GetTaskByWorkspaceID :one
-SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status WHERE workspace_id = $1::uuid
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id, owner_username, owner_name, owner_avatar_url FROM tasks_with_status WHERE workspace_id = $1::uuid
 `
 
 func (q *sqlQuerier) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.UUID) (Task, error) {
@@ -13011,6 +13014,9 @@ func (q *sqlQuerier) GetTaskByWorkspaceID(ctx context.Context, workspaceID uuid.
 		&i.WorkspaceBuildNumber,
 		&i.WorkspaceAgentID,
 		&i.WorkspaceAppID,
+		&i.OwnerUsername,
+		&i.OwnerName,
+		&i.OwnerAvatarUrl,
 	)
 	return i, err
 }
@@ -13064,7 +13070,7 @@ func (q *sqlQuerier) InsertTask(ctx context.Context, arg InsertTaskParams) (Task
 }
 
 const listTasks = `-- name: ListTasks :many
-SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id FROM tasks_with_status tws
+SELECT id, organization_id, owner_id, name, workspace_id, template_version_id, template_parameters, prompt, created_at, deleted_at, status, workspace_build_number, workspace_agent_id, workspace_app_id, owner_username, owner_name, owner_avatar_url FROM tasks_with_status tws
 WHERE tws.deleted_at IS NULL
 AND CASE WHEN $1::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.owner_id = $1::UUID ELSE TRUE END
 AND CASE WHEN $2::UUID != '00000000-0000-0000-0000-000000000000' THEN tws.organization_id = $2::UUID ELSE TRUE END
@@ -13102,6 +13108,9 @@ func (q *sqlQuerier) ListTasks(ctx context.Context, arg ListTasksParams) ([]Task
 			&i.WorkspaceBuildNumber,
 			&i.WorkspaceAgentID,
 			&i.WorkspaceAppID,
+			&i.OwnerUsername,
+			&i.OwnerName,
+			&i.OwnerAvatarUrl,
 		); err != nil {
 			return nil, err
 		}

From cf93c3417252df08f940a0366c6a3bbac53492d6 Mon Sep 17 00:00:00 2001
From: david-fraley <67079030+david-fraley@users.noreply.github.com>
Date: Tue, 28 Oct 2025 10:15:57 -0500
Subject: [PATCH 275/298] docs: update coder_token_lifetime description to
 include units and examples (#20516)

---
 cli/testdata/coder_tokens_create_--help.golden | 4 +++-
 cli/tokens.go                                  | 2 +-
 docs/reference/cli/tokens_create.md            | 2 +-
 3 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/cli/testdata/coder_tokens_create_--help.golden b/cli/testdata/coder_tokens_create_--help.golden
index 6db7a07a27920..19e9beac20060 100644
--- a/cli/testdata/coder_tokens_create_--help.golden
+++ b/cli/testdata/coder_tokens_create_--help.golden
@@ -10,7 +10,9 @@ OPTIONS:
           Repeatable allow-list entry (<type>:<uuid>, e.g. workspace:1234-...).
 
       --lifetime string, $CODER_TOKEN_LIFETIME
-          Specify a duration for the lifetime of the token.
+          Duration for the token lifetime. Supports standard Go duration units
+          (ns, us, ms, s, m, h) plus d (days) and y (years). Examples: 8h, 30d,
+          1y, 1d12h30m.
 
   -n, --name string, $CODER_TOKEN_NAME
           Specify a human-readable name.
diff --git a/cli/tokens.go b/cli/tokens.go
index 1c1bcd78a2a1b..9316f5de14313 100644
--- a/cli/tokens.go
+++ b/cli/tokens.go
@@ -123,7 +123,7 @@ func (r *RootCmd) createToken() *serpent.Command {
 		{
 			Flag:        "lifetime",
 			Env:         "CODER_TOKEN_LIFETIME",
-			Description: "Specify a duration for the lifetime of the token.",
+			Description: "Duration for the token lifetime. Supports standard Go duration units (ns, us, ms, s, m, h) plus d (days) and y (years). Examples: 8h, 30d, 1y, 1d12h30m.",
 			Value:       serpent.StringOf(&tokenLifetime),
 		},
 		{
diff --git a/docs/reference/cli/tokens_create.md b/docs/reference/cli/tokens_create.md
index d5dd916a46e0e..b15e58cd1304d 100644
--- a/docs/reference/cli/tokens_create.md
+++ b/docs/reference/cli/tokens_create.md
@@ -18,7 +18,7 @@ coder tokens create [flags]
 | Type        | <code>string</code>                |
 | Environment | <code>$CODER_TOKEN_LIFETIME</code> |
 
-Specify a duration for the lifetime of the token.
+Duration for the token lifetime. Supports standard Go duration units (ns, us, ms, s, m, h) plus d (days) and y (years). Examples: 8h, 30d, 1y, 1d12h30m.
 
 ### -n, --name
 

From a1e7e105a43f91229192e63c9bc6d6d9a195c064 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Tue, 28 Oct 2025 17:21:23 +0000
Subject: [PATCH 276/298] chore: disable task notifications by default (#20518)

Relates to https://github.com/coder/internal/issues/1098

Currently task notifications are incredibly noisy. We should disable
them by default for the upcoming release whilst we iron them out.
---
 ...000392_disable_tasks_notifications_by_default.down.sql | 8 ++++++++
 .../000392_disable_tasks_notifications_by_default.up.sql  | 8 ++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 coderd/database/migrations/000392_disable_tasks_notifications_by_default.down.sql
 create mode 100644 coderd/database/migrations/000392_disable_tasks_notifications_by_default.up.sql

diff --git a/coderd/database/migrations/000392_disable_tasks_notifications_by_default.down.sql b/coderd/database/migrations/000392_disable_tasks_notifications_by_default.down.sql
new file mode 100644
index 0000000000000..82fed7bf1d682
--- /dev/null
+++ b/coderd/database/migrations/000392_disable_tasks_notifications_by_default.down.sql
@@ -0,0 +1,8 @@
+UPDATE notification_templates
+SET enabled_by_default = true
+WHERE id IN (
+	'8c5a4d12-9f7e-4b3a-a1c8-6e4f2d9b5a7c',
+	'3b7e8f1a-4c2d-49a6-b5e9-7f3a1c8d6b4e',
+	'bd4b7168-d05e-4e19-ad0f-3593b77aa90f',
+	'd4a6271c-cced-4ed0-84ad-afd02a9c7799'
+);
diff --git a/coderd/database/migrations/000392_disable_tasks_notifications_by_default.up.sql b/coderd/database/migrations/000392_disable_tasks_notifications_by_default.up.sql
new file mode 100644
index 0000000000000..e51c9a57940a7
--- /dev/null
+++ b/coderd/database/migrations/000392_disable_tasks_notifications_by_default.up.sql
@@ -0,0 +1,8 @@
+UPDATE notification_templates
+SET enabled_by_default = false
+WHERE id IN (
+	'8c5a4d12-9f7e-4b3a-a1c8-6e4f2d9b5a7c',
+	'3b7e8f1a-4c2d-49a6-b5e9-7f3a1c8d6b4e',
+	'bd4b7168-d05e-4e19-ad0f-3593b77aa90f',
+	'd4a6271c-cced-4ed0-84ad-afd02a9c7799'
+);

From 45c43d4ec47c492096815c6151b81a7878124f82 Mon Sep 17 00:00:00 2001
From: Callum Styan <callumstyan@gmail.com>
Date: Tue, 28 Oct 2025 13:38:16 -0700
Subject: [PATCH 277/298] fix: refactor agent resource monitoring API to avoid
 excessive calls to DB (#20430)

This should resolve https://github.com/coder/internal/issues/728 by
refactoring the ResourceMonitorAPI struct to only require querying the
resource monitor once for memory and once for volumes, then using the
stored monitors on the API struct from that point on. This should
eliminate the vast majority of calls to `GetWorkspaceByAgentID` and
`FetchVolumesResourceMonitorsUpdatedAfter`/`FetchMemoryResourceMonitorsUpdatedAfter`
(millions of calls per week).

Tests passed, and I ran an instance of coder via a workspace with a
template that added resource monitoring every 10s. Note that this is the
default docker container, so there are other sources of
`GetWorkspaceByAgentID` db queries. Note that this workspace was running
for ~15 minutes at the time I gathered this data.

Over 30s for the `ResourceMonitor` calls:
```
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep ResourceMonitor | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsUpdatedAfter"} 2
100  288k    0  288k    0     0  58.3M      0 --:--:-- --:--:-- --:--:-- 70.4M
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsUpdatedAfter"} 2
coderd_db_query_latencies_seconds_count{query="UpdateMemoryResourceMonitor"} 155
coderd_db_query_latencies_seconds_count{query="UpdateVolumeResourceMonitor"} 155
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep ResourceMonitor | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchMemoryResourceMonitorsUpdatedAfter"} 2
100  288k    0  288k    0     0  34.7M      0 --:--:-- --:--:-- --:--:-- 40.2M
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsByAgentID"} 2
coderd_db_query_latencies_seconds_count{query="FetchVolumesResourceMonitorsUpdatedAfter"} 2
coderd_db_query_latencies_seconds_count{query="UpdateMemoryResourceMonitor"} 158
coderd_db_query_latencies_seconds_count{query="UpdateVolumeResourceMonitor"} 158
```

And over 1m for the `GetWorkspaceAgentByID` calls, the majority are from
the workspace metadata stats updates:
```
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep GetWorkspaceByAgentID | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  284k    0  284k    0     0  42.4M      0 --:--:-- --:--:-- --:--:-- 46.3M
coderd_db_query_latencies_seconds_count{query="GetWorkspaceByAgentID"} 876
coder@callum-coder-2:~/coder$ curl localhost:19090/metrics | grep GetWorkspaceByAgentID | grep count
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  284k    0  284k    0     0  75.4M      0 --:--:-- --:--:-- --:--:-- 92.7M
coderd_db_query_latencies_seconds_count{query="GetWorkspaceByAgentID"} 918
```

---------

Signed-off-by: Callum Styan <callumstyan@gmail.com>
---
 coderd/agentapi/api.go                       |  4 +
 coderd/agentapi/resources_monitoring.go      | 87 ++++++++++++--------
 coderd/agentapi/resources_monitoring_test.go | 26 ++++++
 3 files changed, 82 insertions(+), 35 deletions(-)

diff --git a/coderd/agentapi/api.go b/coderd/agentapi/api.go
index dbcb8ea024914..f8f72a5d0d6ea 100644
--- a/coderd/agentapi/api.go
+++ b/coderd/agentapi/api.go
@@ -239,6 +239,10 @@ func (a *API) Serve(ctx context.Context, l net.Listener) error {
 		return xerrors.Errorf("create agent API server: %w", err)
 	}
 
+	if err := a.ResourcesMonitoringAPI.InitMonitors(ctx); err != nil {
+		return xerrors.Errorf("initialize resource monitoring: %w", err)
+	}
+
 	return server.Serve(ctx, l)
 }
 
diff --git a/coderd/agentapi/resources_monitoring.go b/coderd/agentapi/resources_monitoring.go
index e5ee97e681a58..db0d523192280 100644
--- a/coderd/agentapi/resources_monitoring.go
+++ b/coderd/agentapi/resources_monitoring.go
@@ -5,6 +5,7 @@ import (
 	"database/sql"
 	"errors"
 	"fmt"
+	"sync"
 	"time"
 
 	"golang.org/x/xerrors"
@@ -33,42 +34,60 @@ type ResourcesMonitoringAPI struct {
 
 	Debounce time.Duration
 	Config   resourcesmonitor.Config
+
+	// Cache resource monitors on first call to avoid millions of DB queries per day.
+	memoryMonitor  database.WorkspaceAgentMemoryResourceMonitor
+	volumeMonitors []database.WorkspaceAgentVolumeResourceMonitor
+	monitorsLock   sync.RWMutex
 }
 
-func (a *ResourcesMonitoringAPI) GetResourcesMonitoringConfiguration(ctx context.Context, _ *proto.GetResourcesMonitoringConfigurationRequest) (*proto.GetResourcesMonitoringConfigurationResponse, error) {
-	memoryMonitor, memoryErr := a.Database.FetchMemoryResourceMonitorsByAgentID(ctx, a.AgentID)
-	if memoryErr != nil && !errors.Is(memoryErr, sql.ErrNoRows) {
-		return nil, xerrors.Errorf("failed to fetch memory resource monitor: %w", memoryErr)
+// InitMonitors fetches resource monitors from the database and caches them.
+// This must be called once after creating a ResourcesMonitoringAPI, the context should be
+// the agent per-RPC connection context. If fetching fails with a real error (not sql.ErrNoRows), the
+// connection should be torn down.
+func (a *ResourcesMonitoringAPI) InitMonitors(ctx context.Context) error {
+	memMon, err := a.Database.FetchMemoryResourceMonitorsByAgentID(ctx, a.AgentID)
+	if err != nil && !errors.Is(err, sql.ErrNoRows) {
+		return xerrors.Errorf("fetch memory resource monitor: %w", err)
+	}
+	// If sql.ErrNoRows, memoryMonitor stays as zero value (CreatedAt.IsZero() = true).
+	// Otherwise, store the fetched monitor.
+	if err == nil {
+		a.memoryMonitor = memMon
 	}
 
-	volumeMonitors, err := a.Database.FetchVolumesResourceMonitorsByAgentID(ctx, a.AgentID)
+	volMons, err := a.Database.FetchVolumesResourceMonitorsByAgentID(ctx, a.AgentID)
 	if err != nil {
-		return nil, xerrors.Errorf("failed to fetch volume resource monitors: %w", err)
+		return xerrors.Errorf("fetch volume resource monitors: %w", err)
 	}
+	// 0 length is valid, indicating none configured, since the volume monitors in the DB can be many.
+	a.volumeMonitors = volMons
+
+	return nil
+}
 
+func (a *ResourcesMonitoringAPI) GetResourcesMonitoringConfiguration(_ context.Context, _ *proto.GetResourcesMonitoringConfigurationRequest) (*proto.GetResourcesMonitoringConfigurationResponse, error) {
 	return &proto.GetResourcesMonitoringConfigurationResponse{
 		Config: &proto.GetResourcesMonitoringConfigurationResponse_Config{
 			CollectionIntervalSeconds: int32(a.Config.CollectionInterval.Seconds()),
 			NumDatapoints:             a.Config.NumDatapoints,
 		},
 		Memory: func() *proto.GetResourcesMonitoringConfigurationResponse_Memory {
-			if memoryErr != nil {
+			if a.memoryMonitor.CreatedAt.IsZero() {
 				return nil
 			}
-
 			return &proto.GetResourcesMonitoringConfigurationResponse_Memory{
-				Enabled: memoryMonitor.Enabled,
+				Enabled: a.memoryMonitor.Enabled,
 			}
 		}(),
 		Volumes: func() []*proto.GetResourcesMonitoringConfigurationResponse_Volume {
-			volumes := make([]*proto.GetResourcesMonitoringConfigurationResponse_Volume, 0, len(volumeMonitors))
-			for _, monitor := range volumeMonitors {
+			volumes := make([]*proto.GetResourcesMonitoringConfigurationResponse_Volume, 0, len(a.volumeMonitors))
+			for _, monitor := range a.volumeMonitors {
 				volumes = append(volumes, &proto.GetResourcesMonitoringConfigurationResponse_Volume{
 					Enabled: monitor.Enabled,
 					Path:    monitor.Path,
 				})
 			}
-
 			return volumes
 		}(),
 	}, nil
@@ -77,6 +96,10 @@ func (a *ResourcesMonitoringAPI) GetResourcesMonitoringConfiguration(ctx context
 func (a *ResourcesMonitoringAPI) PushResourcesMonitoringUsage(ctx context.Context, req *proto.PushResourcesMonitoringUsageRequest) (*proto.PushResourcesMonitoringUsageResponse, error) {
 	var err error
 
+	// Lock for the entire push operation since calls are sequential from the agent
+	a.monitorsLock.Lock()
+	defer a.monitorsLock.Unlock()
+
 	if memoryErr := a.monitorMemory(ctx, req.Datapoints); memoryErr != nil {
 		err = errors.Join(err, xerrors.Errorf("monitor memory: %w", memoryErr))
 	}
@@ -89,18 +112,7 @@ func (a *ResourcesMonitoringAPI) PushResourcesMonitoringUsage(ctx context.Contex
 }
 
 func (a *ResourcesMonitoringAPI) monitorMemory(ctx context.Context, datapoints []*proto.PushResourcesMonitoringUsageRequest_Datapoint) error {
-	monitor, err := a.Database.FetchMemoryResourceMonitorsByAgentID(ctx, a.AgentID)
-	if err != nil {
-		// It is valid for an agent to not have a memory monitor, so we
-		// do not want to treat it as an error.
-		if errors.Is(err, sql.ErrNoRows) {
-			return nil
-		}
-
-		return xerrors.Errorf("fetch memory resource monitor: %w", err)
-	}
-
-	if !monitor.Enabled {
+	if !a.memoryMonitor.Enabled {
 		return nil
 	}
 
@@ -109,15 +121,15 @@ func (a *ResourcesMonitoringAPI) monitorMemory(ctx context.Context, datapoints [
 		usageDatapoints = append(usageDatapoints, datapoint.Memory)
 	}
 
-	usageStates := resourcesmonitor.CalculateMemoryUsageStates(monitor, usageDatapoints)
+	usageStates := resourcesmonitor.CalculateMemoryUsageStates(a.memoryMonitor, usageDatapoints)
 
-	oldState := monitor.State
+	oldState := a.memoryMonitor.State
 	newState := resourcesmonitor.NextState(a.Config, oldState, usageStates)
 
-	debouncedUntil, shouldNotify := monitor.Debounce(a.Debounce, a.Clock.Now(), oldState, newState)
+	debouncedUntil, shouldNotify := a.memoryMonitor.Debounce(a.Debounce, a.Clock.Now(), oldState, newState)
 
 	//nolint:gocritic // We need to be able to update the resource monitor here.
-	err = a.Database.UpdateMemoryResourceMonitor(dbauthz.AsResourceMonitor(ctx), database.UpdateMemoryResourceMonitorParams{
+	err := a.Database.UpdateMemoryResourceMonitor(dbauthz.AsResourceMonitor(ctx), database.UpdateMemoryResourceMonitorParams{
 		AgentID:        a.AgentID,
 		State:          newState,
 		UpdatedAt:      dbtime.Time(a.Clock.Now()),
@@ -127,6 +139,11 @@ func (a *ResourcesMonitoringAPI) monitorMemory(ctx context.Context, datapoints [
 		return xerrors.Errorf("update workspace monitor: %w", err)
 	}
 
+	// Update cached state
+	a.memoryMonitor.State = newState
+	a.memoryMonitor.DebouncedUntil = dbtime.Time(debouncedUntil)
+	a.memoryMonitor.UpdatedAt = dbtime.Time(a.Clock.Now())
+
 	if !shouldNotify {
 		return nil
 	}
@@ -143,7 +160,7 @@ func (a *ResourcesMonitoringAPI) monitorMemory(ctx context.Context, datapoints [
 		notifications.TemplateWorkspaceOutOfMemory,
 		map[string]string{
 			"workspace": workspace.Name,
-			"threshold": fmt.Sprintf("%d%%", monitor.Threshold),
+			"threshold": fmt.Sprintf("%d%%", a.memoryMonitor.Threshold),
 		},
 		map[string]any{
 			// NOTE(DanielleMaywood):
@@ -169,14 +186,9 @@ func (a *ResourcesMonitoringAPI) monitorMemory(ctx context.Context, datapoints [
 }
 
 func (a *ResourcesMonitoringAPI) monitorVolumes(ctx context.Context, datapoints []*proto.PushResourcesMonitoringUsageRequest_Datapoint) error {
-	volumeMonitors, err := a.Database.FetchVolumesResourceMonitorsByAgentID(ctx, a.AgentID)
-	if err != nil {
-		return xerrors.Errorf("get or insert volume monitor: %w", err)
-	}
-
 	outOfDiskVolumes := make([]map[string]any, 0)
 
-	for _, monitor := range volumeMonitors {
+	for i, monitor := range a.volumeMonitors {
 		if !monitor.Enabled {
 			continue
 		}
@@ -219,6 +231,11 @@ func (a *ResourcesMonitoringAPI) monitorVolumes(ctx context.Context, datapoints
 		}); err != nil {
 			return xerrors.Errorf("update workspace monitor: %w", err)
 		}
+
+		// Update cached state
+		a.volumeMonitors[i].State = newState
+		a.volumeMonitors[i].DebouncedUntil = dbtime.Time(debouncedUntil)
+		a.volumeMonitors[i].UpdatedAt = dbtime.Time(a.Clock.Now())
 	}
 
 	if len(outOfDiskVolumes) == 0 {
diff --git a/coderd/agentapi/resources_monitoring_test.go b/coderd/agentapi/resources_monitoring_test.go
index c491d3789355b..7b457dd45331a 100644
--- a/coderd/agentapi/resources_monitoring_test.go
+++ b/coderd/agentapi/resources_monitoring_test.go
@@ -101,6 +101,9 @@ func TestMemoryResourceMonitorDebounce(t *testing.T) {
 		Threshold: 80,
 	})
 
+	// Initialize API to fetch and cache the monitors
+	require.NoError(t, api.InitMonitors(context.Background()))
+
 	// When: The monitor is given a state that will trigger NOK
 	_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 		Datapoints: []*agentproto.PushResourcesMonitoringUsageRequest_Datapoint{
@@ -304,6 +307,9 @@ func TestMemoryResourceMonitor(t *testing.T) {
 				Threshold: 80,
 			})
 
+			// Initialize API to fetch and cache the monitors
+			require.NoError(t, api.InitMonitors(context.Background()))
+
 			clock.Set(collectedAt)
 			_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 				Datapoints: datapoints,
@@ -337,6 +343,8 @@ func TestMemoryResourceMonitorMissingData(t *testing.T) {
 			State:     database.WorkspaceAgentMonitorStateOK,
 			Threshold: 80,
 		})
+		// Initialize API to fetch and cache the monitors
+		require.NoError(t, api.InitMonitors(context.Background()))
 
 		// When: A datapoint is missing, surrounded by two NOK datapoints.
 		_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
@@ -387,6 +395,9 @@ func TestMemoryResourceMonitorMissingData(t *testing.T) {
 			Threshold: 80,
 		})
 
+		// Initialize API to fetch and cache the monitors
+		require.NoError(t, api.InitMonitors(context.Background()))
+
 		// When: A datapoint is missing, surrounded by two OK datapoints.
 		_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 			Datapoints: []*agentproto.PushResourcesMonitoringUsageRequest_Datapoint{
@@ -466,6 +477,9 @@ func TestVolumeResourceMonitorDebounce(t *testing.T) {
 		Threshold: 80,
 	})
 
+	// Initialize API to fetch and cache the monitors
+	require.NoError(t, api.InitMonitors(context.Background()))
+
 	// When:
 	//  - First monitor is in a NOK state
 	//  - Second monitor is in an OK state
@@ -742,6 +756,9 @@ func TestVolumeResourceMonitor(t *testing.T) {
 				Threshold: tt.thresholdPercent,
 			})
 
+			// Initialize API to fetch and cache the monitors
+			require.NoError(t, api.InitMonitors(context.Background()))
+
 			clock.Set(collectedAt)
 			_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 				Datapoints: datapoints,
@@ -780,6 +797,9 @@ func TestVolumeResourceMonitorMultiple(t *testing.T) {
 		Threshold: 80,
 	})
 
+	// Initialize API to fetch and cache the monitors
+	require.NoError(t, api.InitMonitors(context.Background()))
+
 	// When: both of them move to a NOK state
 	_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 		Datapoints: []*agentproto.PushResourcesMonitoringUsageRequest_Datapoint{
@@ -832,6 +852,9 @@ func TestVolumeResourceMonitorMissingData(t *testing.T) {
 			Threshold: 80,
 		})
 
+		// Initialize API to fetch and cache the monitors
+		require.NoError(t, api.InitMonitors(context.Background()))
+
 		// When: A datapoint is missing, surrounded by two NOK datapoints.
 		_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 			Datapoints: []*agentproto.PushResourcesMonitoringUsageRequest_Datapoint{
@@ -891,6 +914,9 @@ func TestVolumeResourceMonitorMissingData(t *testing.T) {
 			Threshold: 80,
 		})
 
+		// Initialize API to fetch and cache the monitors
+		require.NoError(t, api.InitMonitors(context.Background()))
+
 		// When: A datapoint is missing, surrounded by two OK datapoints.
 		_, err := api.PushResourcesMonitoringUsage(context.Background(), &agentproto.PushResourcesMonitoringUsageRequest{
 			Datapoints: []*agentproto.PushResourcesMonitoringUsageRequest_Datapoint{

From 924afb753fedcb8c56ab77dcd91c674954841c35 Mon Sep 17 00:00:00 2001
From: Steven Masley <Emyrk@users.noreply.github.com>
Date: Tue, 28 Oct 2025 15:47:52 -0500
Subject: [PATCH 278/298] feat: add more detailed init timings in build
 timeline (#20503)

This uses the `terraform init -json` logs to add more visibility into
the `init` phase of `plan`. The `init` logs omit `ms` precision, so we
have to use `time.Now()` :cry:

Open TF PR: https://github.com/hashicorp/terraform/pull/37818
---
 provisioner/terraform/executor.go             |  43 +++--
 provisioner/terraform/inittimings.go          | 166 ++++++++++++++++++
 provisioner/terraform/provision.go            |   2 +-
 .../timings-aggregation/complete.txtar        |  29 ++-
 .../timings-aggregation/fake-terraform.sh     |  42 +++--
 .../testdata/timings-aggregation/init.txtar   |  41 +++--
 .../timings-aggregation/initupgrade.txtar     |  29 +++
 provisioner/terraform/timings.go              |  37 +++-
 .../terraform/timings_internal_test.go        |   6 +
 provisioner/terraform/timings_test.go         |  14 +-
 10 files changed, 353 insertions(+), 56 deletions(-)
 create mode 100644 provisioner/terraform/inittimings.go
 create mode 100644 provisioner/terraform/testdata/timings-aggregation/initupgrade.txtar

diff --git a/provisioner/terraform/executor.go b/provisioner/terraform/executor.go
index 67922d0ffbd48..5ef7f626f9f58 100644
--- a/provisioner/terraform/executor.go
+++ b/provisioner/terraform/executor.go
@@ -28,7 +28,10 @@ import (
 	"github.com/coder/coder/v2/provisionersdk/proto"
 )
 
-var version170 = version.Must(version.NewVersion("1.7.0"))
+var (
+	version170 = version.Must(version.NewVersion("1.7.0"))
+	version190 = version.Must(version.NewVersion("1.9.0"))
+)
 
 type executor struct {
 	logger     slog.Logger
@@ -225,7 +228,7 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 	lockFilePath := filepath.Join(e.workdir, ".terraform.lock.hcl")
 	preInitChecksum := checksumFileCRC32(ctx, e.logger, lockFilePath)
 
-	outWriter, doneOut := logWriter(logr, proto.LogLevel_DEBUG)
+	outWriter, doneOut := e.provisionLogWriter(logr)
 	errWriter, doneErr := logWriter(logr, proto.LogLevel_ERROR)
 	defer func() {
 		_ = outWriter.Close()
@@ -244,7 +247,16 @@ func (e *executor) init(ctx, killCtx context.Context, logr logSink) error {
 		"-input=false",
 	}
 
-	err := e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)
+	ver, err := e.version(ctx)
+	if err != nil {
+		return xerrors.Errorf("extract version: %w", err)
+	}
+	if ver.GreaterThanOrEqual(version190) {
+		// Added in v1.9.0:
+		args = append(args, "-json")
+	}
+
+	err = e.execWriteOutput(ctx, killCtx, args, e.basicEnv(), outWriter, errBuf)
 	var exitErr *exec.ExitError
 	if xerrors.As(err, &exitErr) {
 		if bytes.Contains(errBuf.b.Bytes(), []byte("text file busy")) {
@@ -809,6 +821,9 @@ func extractTimingSpan(log *terraformProvisionLog) (time.Time, *timingSpan, erro
 		return time.Time{}, nil, xerrors.Errorf("unexpected timing kind: %q", log.Type)
 	}
 
+	// Init logs omit millisecond precision, so using `time.Now` as a fallback
+	// for these logs is more precise than parsing the second precision alone.
+	// https://github.com/hashicorp/terraform/pull/37818
 	ts, err := time.Parse("2006-01-02T15:04:05.000000Z07:00", log.Timestamp)
 	if err != nil {
 		// TODO: log
@@ -816,10 +831,11 @@ func extractTimingSpan(log *terraformProvisionLog) (time.Time, *timingSpan, erro
 	}
 
 	return ts, &timingSpan{
-		kind:     typ,
-		action:   log.Hook.Action,
-		provider: log.Hook.Resource.Provider,
-		resource: log.Hook.Resource.Addr,
+		kind:        typ,
+		messageCode: log.MessageCode,
+		action:      log.Hook.Action,
+		provider:    log.Hook.Resource.Provider,
+		resource:    log.Hook.Resource.Addr,
 	}, nil
 }
 
@@ -842,11 +858,14 @@ func convertTerraformLogLevel(logLevel string, sink logSink) proto.LogLevel {
 }
 
 type terraformProvisionLog struct {
-	Level     string                    `json:"@level"`
-	Message   string                    `json:"@message"`
-	Timestamp string                    `json:"@timestamp"`
-	Type      string                    `json:"type"`
-	Hook      terraformProvisionLogHook `json:"hook"`
+	Level     string `json:"@level"`
+	Message   string `json:"@message"`
+	Timestamp string `json:"@timestamp"`
+	Type      string `json:"type"`
+	// MessageCode is only set for init phase messages after Terraform 1.9.0
+	// This field is not used by plan/apply.
+	MessageCode initMessageCode           `json:"message_code,omitempty"`
+	Hook        terraformProvisionLogHook `json:"hook"`
 
 	Diagnostic *tfjson.Diagnostic `json:"diagnostic,omitempty"`
 }
diff --git a/provisioner/terraform/inittimings.go b/provisioner/terraform/inittimings.go
new file mode 100644
index 0000000000000..e72d237b5268f
--- /dev/null
+++ b/provisioner/terraform/inittimings.go
@@ -0,0 +1,166 @@
+package terraform
+
+import (
+	"slices"
+	"time"
+
+	"github.com/coder/coder/v2/coderd/database"
+	"github.com/coder/coder/v2/provisionersdk/proto"
+)
+
+const (
+	// defaultInitAction is a human-readable action for init timing spans. The coder
+	// frontend displays the action, which would be an empty string if not set to
+	// this constant. Setting it to "load" gives more context to users about what is
+	// happening during init. The init steps either "load" from disk or http.
+	defaultInitAction = "load"
+)
+
+var (
+	// resourceName maps init message codes to human-readable resource names.
+	// This is purely for better readability in the timing spans.
+	resourceName = map[initMessageCode]string{
+		initInitializingBackendMessage:    "backend",
+		initInitializingStateStoreMessage: "backend",
+
+		initInitializingModulesMessage: "modules",
+		initUpgradingModulesMessage:    "modules",
+
+		initInitializingProviderPluginMessage: "provider plugins",
+	}
+
+	// executionOrder is the expected sequential steps during `terraform init`.
+	// Some steps of the init have more than 1 possible "initMessageCode".
+	//
+	// In practice, since Coder has a defined way of running Terraform, only
+	// one code per step is expected. However, this allows for future-proofing
+	// in case Coder adds more Terraform init configurations.
+	executionOrder = [][]initMessageCode{
+		{
+			initInitializingBackendMessage,
+			initInitializingStateStoreMessage, // If using a state store backend
+		},
+		{
+			initInitializingModulesMessage,
+			initUpgradingModulesMessage, // if "-upgrade" flag provided
+		},
+		{initInitializingProviderPluginMessage},
+		{
+			initOutputInitSuccessMessage,
+			initOutputInitSuccessCloudMessage, // If using terraform cloud
+		},
+	}
+)
+
+// ingestInitTiming handles ingesting timing spans from `terraform init` logs.
+// These logs are formatted differently from plan/apply logs, so they need their
+// own ingestion logic.
+//
+// The logs are also less granular, only indicating the start of major init
+// steps, rather than per-resource actions. Since initialization is done
+// serially, we can infer the end time of each stage from the start time of the
+// next stage.
+func (t *timingAggregator) ingestInitTiming(ts time.Time, s *timingSpan) {
+	switch s.messageCode {
+	case initInitializingBackendMessage, initInitializingStateStoreMessage:
+		// Backend loads the tfstate from the backend data source. For coder, this is
+		// always a state file on disk, making it nearly an instantaneous operation.
+		s.start = ts
+		s.state = proto.TimingState_STARTED
+	case initInitializingModulesMessage, initUpgradingModulesMessage:
+		s.start = ts
+		s.state = proto.TimingState_STARTED
+	case initInitializingProviderPluginMessage:
+		s.start = ts
+		s.state = proto.TimingState_STARTED
+	case initOutputInitSuccessMessage, initOutputInitSuccessCloudMessage:
+		// The final message indicates successful completion of init. There is no start
+		// message for this, but we want to continue the pattern such that this completes
+		// the previous stage.
+		s.end = ts
+		s.state = proto.TimingState_COMPLETED
+	default:
+		return
+	}
+
+	// Init logs should be assigned to the init stage.
+	// Ideally the executor could use an `init` stage aggregator directly, but
+	// that would require a larger refactor.
+	s.stage = database.ProvisionerJobTimingStageInit
+	// The default action is an empty string. Set it to "load" for some human readability.
+	s.action = defaultInitAction
+	// Resource name is an empty string. Name it something more useful.
+	s.resource = resourceName[s.messageCode]
+
+	// finishPrevious completes the previous step in the init sequence, if applicable.
+	t.finishPrevious(ts, s)
+
+	t.lookupMu.Lock()
+	// Memoize this span by its unique attributes and the determined state.
+	// This will be used in aggregate() to determine the duration of the resource action.
+	t.stateLookup[s.hashByState(s.state)] = s
+	t.lookupMu.Unlock()
+}
+
+func (t *timingAggregator) finishPrevious(ts time.Time, s *timingSpan) {
+	index := slices.IndexFunc(executionOrder, func(codes []initMessageCode) bool {
+		return slices.Contains(codes, s.messageCode)
+	})
+	if index <= 0 {
+		// If the index is not found or is the first item, nothing to complete.
+		return
+	}
+
+	// Complete the previous message.
+	previousSteps := executionOrder[index-1]
+
+	t.lookupMu.Lock()
+	// Complete the previous step. We are not tracking the state of these steps, so
+	// we cannot tell for sure what the previous step `MessageCode` was. The
+	// aggregator only reports timings that have a start & end. So if we end all
+	// possible previous step `MessageCodes`, the aggregator will only report the one
+	// that was actually started.
+	//
+	// This is a bit of a hack, but it works given the constraints of the init logs.
+	// Ideally we would store more state about the init steps. Or loop over the
+	// stored timings to find the one that was started. This is just simpler and
+	// accomplishes the same goal.
+	for _, step := range previousSteps {
+		cpy := *s
+		cpy.start = time.Time{}
+		cpy.end = ts
+		cpy.messageCode = step
+		cpy.resource = resourceName[step]
+		cpy.state = proto.TimingState_COMPLETED
+		t.stateLookup[cpy.hashByState(cpy.state)] = &cpy
+	}
+
+	t.lookupMu.Unlock()
+}
+
+// mergeInitTimings merges manual init timings with existing timings that are
+// sourced by the logs. This is done because prior to Terraform v1.9, init logs
+// did not have a `-json` formatting option.
+// So before v1.9, the init stage is manually timed outside the `terraform init`.
+// After v1.9, the init stage is timed via logs.
+func mergeInitTimings(manualInit []*proto.Timing, existing []*proto.Timing) []*proto.Timing {
+	initFailed := slices.ContainsFunc(existing, func(timing *proto.Timing) bool {
+		return timing.State == proto.TimingState_FAILED
+	})
+
+	if initFailed {
+		// The init logs do not provide enough information for failed init timings.
+		// So use the manual timings in this case.
+		return append(manualInit, existing...)
+	}
+
+	hasInitStage := slices.ContainsFunc(existing, func(timing *proto.Timing) bool {
+		return timing.Stage == string(database.ProvisionerJobTimingStageInit)
+	})
+
+	if hasInitStage {
+		return existing
+	}
+
+	return append(manualInit, existing...)
+}
diff --git a/provisioner/terraform/provision.go b/provisioner/terraform/provision.go
index c97a583af7c9f..ec9f96c3ed397 100644
--- a/provisioner/terraform/provision.go
+++ b/provisioner/terraform/provision.go
@@ -170,7 +170,7 @@ func (s *server) Plan(
 
 	// Prepend init timings since they occur prior to plan timings.
 	// Order is irrelevant; this is merely indicative.
-	resp.Timings = append(initTimings.aggregate(), resp.Timings...)
+	resp.Timings = mergeInitTimings(initTimings.aggregate(), resp.Timings)
 	resp.Modules = modules
 	return resp
 }
diff --git a/provisioner/terraform/testdata/timings-aggregation/complete.txtar b/provisioner/terraform/testdata/timings-aggregation/complete.txtar
index 40acb9ae06a65..564bbd45bf82a 100644
--- a/provisioner/terraform/testdata/timings-aggregation/complete.txtar
+++ b/provisioner/terraform/testdata/timings-aggregation/complete.txtar
@@ -1,5 +1,27 @@
 A successful build which results in successful plan and apply timings.
-
+-- init --
+{"@level":"info","@message":"Terraform 1.13.3","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.576675-05:00","terraform":"1.13.3","type":"version","ui":"1.2"}
+{"@level":"info","@message":"Initializing the backend...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:29.000000Z","message_code":"initializing_backend_message","type":"init_output"}
+{"@level":"info","@message":"Initializing modules...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:29.000000Z","message_code":"initializing_modules_message","type":"init_output"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/cursor/coder 1.3.2 for cursor...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.780639-05:00","type":"log"}
+{"@level":"info","@message":"- cursor in .terraform/modules/cursor","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.982904-05:00","type":"log"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/jetbrains/coder 1.1.0 for jetbrains...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.039894-05:00","type":"log"}
+{"@level":"info","@message":"- jetbrains in .terraform/modules/jetbrains","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.202355-05:00","type":"log"}
+{"@level":"info","@message":"Downloading git::https://github.com/coder/large-module.git for large-5mb-module...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.202394-05:00","type":"log"}
+{"@level":"info","@message":"- large-5mb-module in .terraform/modules/large-5mb-module","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.799988-05:00","type":"log"}
+{"@level":"info","@message":"Initializing provider plugins...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:31.000000Z","message_code":"initializing_provider_plugin_message","type":"init_output"}
+{"@level":"info","@message":"kreuzwerker/docker: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.801342-05:00","type":"log"}
+{"@level":"info","@message":"hashicorp/http: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.868885-05:00","type":"log"}
+{"@level":"info","@message":"coder/coder: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.894724-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: hashicorp/http v3.5.0...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.081468-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: hashicorp/http v3.5.0 (signed by HashiCorp)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.375580-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: coder/coder v2.11.0...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.869110-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: coder/coder v2.11.0 (signed by a HashiCorp partnerkey_id: 93C75807601AA0EC)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:33.350069-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: kreuzwerker/docker v3.6.2...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:33.572112-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: kreuzwerker/docker v3.6.2 (self-signedkey_id: BD080C4571C6104C)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:34.458153-05:00","type":"log"}
+{"@level":"info","@message":"Partner and community providers are signed by their developers.\nIf you'd like to know more about provider signing, you can read about it here:\nhttps://developer.hashicorp.com/terraform/cli/plugins/signing","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:34.458177-05:00","type":"log"}
+{"@level":"info","@message":"Terraform has been successfully initialized!","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:34.000000Z","message_code":"output_init_success_message","type":"init_output"}
+{"@level":"info","@message":"You may now begin working with Terraform. Try running \"terraform plan\" to see\nany changes that are required for your infrastructure. All Terraform commands\nshould now work.\n\nIf you ever set or change modules or backend configuration for Terraform,\nrerun this command to reinitialize your working directory. If you forget, other\ncommands will detect it and remind you to do so if necessary.","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:34Z","message_code":"output_init_success_cli_message","type":"init_output"}
 -- plan --
 {"@level":"info","@message":"Terraform 1.9.2","@module":"terraform.ui","@timestamp":"2024-08-15T10:26:38.097648+02:00","terraform":"1.9.2","type":"version","ui":"1.2"}
 {"@level":"info","@message":"data.coder_workspace.me: Refreshing...","@module":"terraform.ui","@timestamp":"2024-08-15T10:26:39.194726+02:00","hook":{"resource":{"addr":"data.coder_workspace.me","module":"","resource":"data.coder_workspace.me","implied_provider":"coder","resource_type":"coder_workspace","resource_name":"me","resource_key":null},"action":"read"},"type":"apply_start"}
@@ -30,10 +52,13 @@ A successful build which results in successful plan and apply timings.
 {"@level":"info","@message":"Apply complete! Resources: 4 added, 0 changed, 0 destroyed.","@module":"terraform.ui","@timestamp":"2024-08-15T10:26:40.204593+02:00","changes":{"add":4,"change":0,"import":0,"remove":0,"operation":"apply"},"type":"change_summary"}
 {"@level":"info","@message":"Outputs: 0","@module":"terraform.ui","@timestamp":"2024-08-15T10:26:40.205051+02:00","outputs":{},"type":"outputs"}
 -- timings --
+{"start":"2025-10-22T17:48:29Z","end":"2025-10-22T17:48:31Z","action":"load","resource":"modules","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-22T17:48:29Z","end":"2025-10-22T17:48:29Z","action":"load","resource":"backend","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-22T17:48:31Z","end":"2025-10-22T17:48:34Z","action":"load","resource":"provider plugins","stage":"init","state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.194726Z","end":"2024-08-15T08:26:39.195820Z","action":"read","source":"coder","resource":"data.coder_workspace.me","stage":"plan","state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.194726Z","end":"2024-08-15T08:26:39.195712Z","action":"read","source":"coder","resource":"data.coder_provisioner.me","stage":"plan","state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.194726Z","end":"2024-08-15T08:26:39.195836Z","action":"read","source":"coder","resource":"data.coder_parameter.memory_size","stage":"plan","state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.616546Z","end":"2024-08-15T08:26:39.618045Z","action":"create","source":"coder","resource":"coder_agent.main","stage":"apply","state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.626722Z","end":"2024-08-15T08:26:39.669954Z","action":"create","source":"docker","resource":"docker_image.main","stage":"apply","state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.627335Z","end":"2024-08-15T08:26:39.660616Z","action":"create","source":"docker","resource":"docker_volume.home_volume","stage":"apply","state":"COMPLETED"}
-{"start":"2024-08-15T08:26:39.682223Z","end":"2024-08-15T08:26:40.186482Z","action":"create","source":"docker","resource":"docker_container.workspace[0]","stage":"apply","state":"COMPLETED"}
\ No newline at end of file
+{"start":"2024-08-15T08:26:39.682223Z","end":"2024-08-15T08:26:40.186482Z","action":"create","source":"docker","resource":"docker_container.workspace[0]","stage":"apply","state":"COMPLETED"}
diff --git a/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh b/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh
index 4eb0d11ad0ec6..582df28c62161 100755
--- a/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh
+++ b/provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh
@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/env bash
 
 function terraform_version() {
 	cat <<'EOL'
@@ -58,24 +58,28 @@ EOL
 
 function terraform_init() {
 	cat <<'EOL'
-
-Initializing the backend...
-
-Initializing provider plugins...
-- Reusing previous version of coder/coder from the dependency lock file
-- Reusing previous version of kreuzwerker/docker from the dependency lock file
-- Using previously-installed coder/coder v1.0.1
-- Using previously-installed kreuzwerker/docker v3.0.2
-
-Terraform has been successfully initialized!
-
-You may now begin working with Terraform. Try running "terraform plan" to see
-any changes that are required for your infrastructure. All Terraform commands
-should now work.
-
-If you ever set or change modules or backend configuration for Terraform,
-rerun this command to reinitialize your working directory. If you forget, other
-commands will detect it and remind you to do so if necessary.
+{"@level":"info","@message":"Terraform 1.13.3","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.576675-05:00","terraform":"1.13.3","type":"version","ui":"1.2"}
+{"@level":"info","@message":"Initializing the backend...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:29.000000Z","message_code":"initializing_backend_message","type":"init_output"}
+{"@level":"info","@message":"Initializing modules...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:29.000000Z","message_code":"initializing_modules_message","type":"init_output"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/cursor/coder 1.3.2 for cursor...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.780639-05:00","type":"log"}
+{"@level":"info","@message":"- cursor in .terraform/modules/cursor","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.982904-05:00","type":"log"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/jetbrains/coder 1.1.0 for jetbrains...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.039894-05:00","type":"log"}
+{"@level":"info","@message":"- jetbrains in .terraform/modules/jetbrains","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.202355-05:00","type":"log"}
+{"@level":"info","@message":"Downloading git::https://github.com/coder/large-module.git for large-5mb-module...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.202394-05:00","type":"log"}
+{"@level":"info","@message":"- large-5mb-module in .terraform/modules/large-5mb-module","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.799988-05:00","type":"log"}
+{"@level":"info","@message":"Initializing provider plugins...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:31.000000Z","message_code":"initializing_provider_plugin_message","type":"init_output"}
+{"@level":"info","@message":"kreuzwerker/docker: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.801342-05:00","type":"log"}
+{"@level":"info","@message":"hashicorp/http: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.868885-05:00","type":"log"}
+{"@level":"info","@message":"coder/coder: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.894724-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: hashicorp/http v3.5.0...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.081468-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: hashicorp/http v3.5.0 (signed by HashiCorp)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.375580-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: coder/coder v2.11.0...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.869110-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: coder/coder v2.11.0 (signed by a HashiCorp partnerkey_id: 93C75807601AA0EC)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:33.350069-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: kreuzwerker/docker v3.6.2...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:33.572112-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: kreuzwerker/docker v3.6.2 (self-signedkey_id: BD080C4571C6104C)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:34.458153-05:00","type":"log"}
+{"@level":"info","@message":"Partner and community providers are signed by their developers.\nIf you'd like to know more about provider signing, you can read about it here:\nhttps://developer.hashicorp.com/terraform/cli/plugins/signing","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:34.458177-05:00","type":"log"}
+{"@level":"info","@message":"Terraform has been successfully initialized!","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:34.000000Z","message_code":"output_init_success_message","type":"init_output"}
+{"@level":"info","@message":"You may now begin working with Terraform. Try running \"terraform plan\" to see\nany changes that are required for your infrastructure. All Terraform commands\nshould now work.\n\nIf you ever set or change modules or backend configuration for Terraform,\nrerun this command to reinitialize your working directory. If you forget, other\ncommands will detect it and remind you to do so if necessary.","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:34Z","message_code":"output_init_success_cli_message","type":"init_output"}
 EOL
 }
 
diff --git a/provisioner/terraform/testdata/timings-aggregation/init.txtar b/provisioner/terraform/testdata/timings-aggregation/init.txtar
index df9db78255d51..a4b0f640c6707 100644
--- a/provisioner/terraform/testdata/timings-aggregation/init.txtar
+++ b/provisioner/terraform/testdata/timings-aggregation/init.txtar
@@ -2,8 +2,6 @@ Init produces JSON logs, but not with discrete fields which we can parse.
 It only gained the ability to output JSON logs in v1.9.0 (https://github.com/hashicorp/terraform/blob/v1.9/CHANGELOG.md#190-june-26-2024),
 so I've included the non-JSON logs as well.
 
-Neither one produces any timings.
-
 -- init --
 # Before v1.9.0
 Initializing the backend...
@@ -24,15 +22,30 @@ If you ever set or change modules or backend configuration for Terraform,
 rerun this command to reinitialize your working directory. If you forget, other
 commands will detect it and remind you to do so if necessary.
 
-# After v1.9.0
-{"@level":"info","@message":"Terraform 1.9.2","@module":"terraform.ui","@timestamp":"2024-08-15T09:19:30.835464+02:00","terraform":"1.9.2","type":"version","ui":"1.2"}
-{"@level":"info","@message":"Initializing the backend...","@module":"terraform.ui","@timestamp":"2024-08-15T07:19:30Z","message_code":"initializing_backend_message","type":"init_output"}
-{"@level":"info","@message":"Initializing modules...","@module":"terraform.ui","@timestamp":"2024-08-15T07:19:30Z","message_code":"initializing_modules_message","type":"init_output"}
-{"@level":"info","@message":"Initializing provider plugins...","@module":"terraform.ui","@timestamp":"2024-08-15T07:19:30Z","message_code":"initializing_provider_plugin_message","type":"init_output"}
-{"@level":"info","@message":"coder/coder: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2024-08-15T09:19:30.870861+02:00","type":"log"}
-{"@level":"info","@message":"hashicorp/http: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2024-08-15T09:19:31.282247+02:00","type":"log"}
-{"@level":"info","@message":"coder/coder v1.0.1: Using previously-installed provider version","@module":"terraform.ui","@timestamp":"2024-08-15T09:19:31.466355+02:00","type":"log"}
-{"@level":"info","@message":"hashicorp/http v3.4.4: Using previously-installed provider version","@module":"terraform.ui","@timestamp":"2024-08-15T09:19:31.479221+02:00","type":"log"}
-{"@level":"info","@message":"Terraform has been successfully initialized!","@module":"terraform.ui","@timestamp":"2024-08-15T07:19:31Z","message_code":"output_init_success_message","type":"init_output"}
-{"@level":"info","@message":"You may now begin working with Terraform. Try running \"terraform plan\" to see\nany changes that are required for your infrastructure. All Terraform commands\nshould now work.\n\nIf you ever set or change modules or backend configuration for Terraform,\nrerun this command to reinitialize your working directory. If you forget, other\ncommands will detect it and remind you to do so if necessary.","@module":"terraform.ui","@timestamp":"2024-08-15T07:19:31Z","message_code":"output_init_success_cli_message","type":"init_output"}
--- timings --
\ No newline at end of file
+# After v1.9.0, uncached
+{"@level":"info","@message":"Terraform 1.13.3","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.576675-05:00","terraform":"1.13.3","type":"version","ui":"1.2"}
+{"@level":"info","@message":"Initializing the backend...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:29.000000Z","message_code":"initializing_backend_message","type":"init_output"}
+{"@level":"info","@message":"Initializing modules...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:29.000000Z","message_code":"initializing_modules_message","type":"init_output"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/cursor/coder 1.3.2 for cursor...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.780639-05:00","type":"log"}
+{"@level":"info","@message":"- cursor in .terraform/modules/cursor","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:29.982904-05:00","type":"log"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/jetbrains/coder 1.1.0 for jetbrains...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.039894-05:00","type":"log"}
+{"@level":"info","@message":"- jetbrains in .terraform/modules/jetbrains","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.202355-05:00","type":"log"}
+{"@level":"info","@message":"Downloading git::https://github.com/coder/large-module.git for large-5mb-module...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:30.202394-05:00","type":"log"}
+{"@level":"info","@message":"- large-5mb-module in .terraform/modules/large-5mb-module","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.799988-05:00","type":"log"}
+{"@level":"info","@message":"Initializing provider plugins...","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:31.000000Z","message_code":"initializing_provider_plugin_message","type":"init_output"}
+{"@level":"info","@message":"kreuzwerker/docker: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.801342-05:00","type":"log"}
+{"@level":"info","@message":"hashicorp/http: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.868885-05:00","type":"log"}
+{"@level":"info","@message":"coder/coder: Reusing previous version from the dependency lock file","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:31.894724-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: hashicorp/http v3.5.0...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.081468-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: hashicorp/http v3.5.0 (signed by HashiCorp)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.375580-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: coder/coder v2.11.0...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:32.869110-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: coder/coder v2.11.0 (signed by a HashiCorp partnerkey_id: 93C75807601AA0EC)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:33.350069-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: kreuzwerker/docker v3.6.2...","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:33.572112-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: kreuzwerker/docker v3.6.2 (self-signedkey_id: BD080C4571C6104C)","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:34.458153-05:00","type":"log"}
+{"@level":"info","@message":"Partner and community providers are signed by their developers.\nIf you'd like to know more about provider signing, you can read about it here:\nhttps://developer.hashicorp.com/terraform/cli/plugins/signing","@module":"terraform.ui","@timestamp":"2025-10-22T12:48:34.458177-05:00","type":"log"}
+{"@level":"info","@message":"Terraform has been successfully initialized!","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:34.000000Z","message_code":"output_init_success_message","type":"init_output"}
+{"@level":"info","@message":"You may now begin working with Terraform. Try running \"terraform plan\" to see\nany changes that are required for your infrastructure. All Terraform commands\nshould now work.\n\nIf you ever set or change modules or backend configuration for Terraform,\nrerun this command to reinitialize your working directory. If you forget, other\ncommands will detect it and remind you to do so if necessary.","@module":"terraform.ui","@timestamp":"2025-10-22T17:48:34Z","message_code":"output_init_success_cli_message","type":"init_output"}
+-- timings --
+{"start":"2025-10-22T17:48:29Z","end":"2025-10-22T17:48:31Z","action":"load","resource":"modules","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-22T17:48:29Z","end":"2025-10-22T17:48:29Z","action":"load","resource":"backend","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-22T17:48:31Z","end":"2025-10-22T17:48:34Z","action":"load","resource":"provider plugins","stage":"init","state":"COMPLETED"}
diff --git a/provisioner/terraform/testdata/timings-aggregation/initupgrade.txtar b/provisioner/terraform/testdata/timings-aggregation/initupgrade.txtar
new file mode 100644
index 0000000000000..25472b1a3728e
--- /dev/null
+++ b/provisioner/terraform/testdata/timings-aggregation/initupgrade.txtar
@@ -0,0 +1,29 @@
+# terraform init -upgrade -json
+-- init --
+{"@level":"info","@message":"Terraform 1.13.3","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:51.988373-05:00","terraform":"1.13.3","type":"version","ui":"1.2"}
+{"@level":"info","@message":"Initializing the backend...","@module":"terraform.ui","@timestamp":"2025-10-27T19:00:51.000000Z","message_code":"initializing_backend_message","type":"init_output"}
+{"@level":"info","@message":"Upgrading modules...","@module":"terraform.ui","@timestamp":"2025-10-27T19:00:51.000000Z","message_code":"upgrading_modules_message","type":"init_output"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/cursor/coder 1.3.2 for cursor...","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:52.152388-05:00","type":"log"}
+{"@level":"info","@message":"- cursor in .terraform/modules/cursor","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:52.394592-05:00","type":"log"}
+{"@level":"info","@message":"Downloading registry.coder.com/coder/jetbrains/coder 1.1.0 for jetbrains...","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:52.450002-05:00","type":"log"}
+{"@level":"info","@message":"- jetbrains in .terraform/modules/jetbrains","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:52.686200-05:00","type":"log"}
+{"@level":"info","@message":"Downloading git::https://github.com/coder/large-module.git for large-5mb-module...","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:52.686229-05:00","type":"log"}
+{"@level":"info","@message":"- large-5mb-module in .terraform/modules/large-5mb-module","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:54.298240-05:00","type":"log"}
+{"@level":"info","@message":"Initializing provider plugins...","@module":"terraform.ui","@timestamp":"2025-10-27T19:00:54.000000Z","message_code":"initializing_provider_plugin_message","type":"init_output"}
+{"@level":"info","@message":"Finding matching versions for provider: hashicorp/http, version_constraint: \"\u003e= 3.0.0\"","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:54.299465-05:00","type":"log"}
+{"@level":"info","@message":"Finding matching versions for provider: coder/coder, version_constraint: \"\u003e= 2.5.0, ~\u003e 2.9\"","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:54.364986-05:00","type":"log"}
+{"@level":"info","@message":"Finding matching versions for provider: kreuzwerker/docker, version_constraint: \"~\u003e 3.0\"","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:54.391509-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: hashicorp/http v3.5.0...","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:54.605182-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: hashicorp/http v3.5.0 (signed by HashiCorp)","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:54.892077-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: coder/coder v2.12.0...","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:55.246866-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: coder/coder v2.12.0 (signed by a HashiCorp partnerkey_id: 93C75807601AA0EC)","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:55.641603-05:00","type":"log"}
+{"@level":"info","@message":"Installing provider version: kreuzwerker/docker v3.6.2...","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:55.862015-05:00","type":"log"}
+{"@level":"info","@message":"Installed provider version: kreuzwerker/docker v3.6.2 (self-signedkey_id: BD080C4571C6104C)","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:56.699002-05:00","type":"log"}
+{"@level":"info","@message":"Partner and community providers are signed by their developers.\nIf you'd like to know more about provider signing, you can read about it here:\nhttps://developer.hashicorp.com/terraform/cli/plugins/signing","@module":"terraform.ui","@timestamp":"2025-10-27T14:00:56.699025-05:00","type":"log"}
+{"@level":"info","@message":"Terraform has made some changes to the provider dependency selections recorded\nin the .terraform.lock.hcl file. Review those changes and commit them to your\nversion control system if they represent changes you intended to make.","@module":"terraform.ui","@timestamp":"2025-10-27T19:00:56Z","message_code":"dependencies_lock_changes_info","type":"init_output"}
+{"@level":"info","@message":"Terraform has been successfully initialized!","@module":"terraform.ui","@timestamp":"2025-10-27T19:00:56.000000Z","message_code":"output_init_success_message","type":"init_output"}
+{"@level":"info","@message":"You may now begin working with Terraform. Try running \"terraform plan\" to see\nany changes that are required for your infrastructure. All Terraform commands\nshould now work.\n\nIf you ever set or change modules or backend configuration for Terraform,\nrerun this command to reinitialize your working directory. If you forget, other\ncommands will detect it and remind you to do so if necessary.","@module":"terraform.ui","@timestamp":"2025-10-27T19:00:56Z","message_code":"output_init_success_cli_message","type":"init_output"}
+-- timings --
+{"start":"2025-10-27T19:00:51Z","end":"2025-10-27T19:00:54Z","action":"load","resource":"modules","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-27T19:00:51Z","end":"2025-10-27T19:00:51Z","action":"load","resource":"backend","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-27T19:00:54Z","end":"2025-10-27T19:00:56Z","action":"load","resource":"provider plugins","stage":"init","state":"COMPLETED"}
diff --git a/provisioner/terraform/timings.go b/provisioner/terraform/timings.go
index 370836229dd73..d2fe74239826e 100644
--- a/provisioner/terraform/timings.go
+++ b/provisioner/terraform/timings.go
@@ -48,6 +48,28 @@ const (
 	timingInitOutput timingKind = "init_output"
 )
 
+// Source: https://github.com/hashicorp/terraform/blob/6b73f710f8152ef4808e4de5bdfb35314442f4a5/internal/command/views/init.go#L267-L321
+type initMessageCode string
+
+const (
+	initCopyingConfigurationMessage       initMessageCode = "copying_configuration_message"
+	initEmptyMessage                      initMessageCode = "empty_message"
+	initOutputInitEmptyMessage            initMessageCode = "output_init_empty_message"
+	initOutputInitSuccessMessage          initMessageCode = "output_init_success_message"
+	initOutputInitSuccessCloudMessage     initMessageCode = "output_init_success_cloud_message"
+	initOutputInitSuccessCLIMessage       initMessageCode = "output_init_success_cli_message"
+	initOutputInitSuccessCLICloudMessage  initMessageCode = "output_init_success_cli_cloud_message"
+	initUpgradingModulesMessage           initMessageCode = "upgrading_modules_message"
+	initInitializingTerraformCloudMessage initMessageCode = "initializing_terraform_cloud_message"
+	initInitializingModulesMessage        initMessageCode = "initializing_modules_message"
+	initInitializingBackendMessage        initMessageCode = "initializing_backend_message"
+	initInitializingStateStoreMessage     initMessageCode = "initializing_state_store_message"
+	initDefaultWorkspaceCreatedMessage    initMessageCode = "default_workspace_created_message"
+	initInitializingProviderPluginMessage initMessageCode = "initializing_provider_plugin_message"
+	initLockInfo                          initMessageCode = "lock_info"
+	initDependenciesLockChangesInfo       initMessageCode = "dependencies_lock_changes_info"
+)
+
 type timingAggregator struct {
 	stage database.ProvisionerJobTimingStage
 
@@ -57,7 +79,9 @@ type timingAggregator struct {
 }
 
 type timingSpan struct {
-	kind                       timingKind
+	kind timingKind
+	// messageCode is only present in `terraform init` timings.
+	messageCode                initMessageCode
 	start, end                 time.Time
 	stage                      database.ProvisionerJobTimingStage
 	action, provider, resource string
@@ -94,6 +118,10 @@ func (t *timingAggregator) ingest(ts time.Time, s *timingSpan) {
 	case timingApplyErrored, timingProvisionErrored, timingInitErrored, timingGraphErrored:
 		s.end = ts
 		s.state = proto.TimingState_FAILED
+	case timingInitOutput:
+		// init timings are based on the init message code.
+		t.ingestInitTiming(ts, s)
+		return
 	default:
 		// We just want start/end timings, ignore all other events.
 		return
@@ -182,7 +210,7 @@ func (l timingKind) Valid() bool {
 // if all other attributes are identical.
 func (l timingKind) Category() string {
 	switch l {
-	case timingInitStart, timingInitComplete, timingInitErrored:
+	case timingInitStart, timingInitComplete, timingInitErrored, timingInitOutput:
 		return "init"
 	case timingGraphStart, timingGraphComplete, timingGraphErrored:
 		return "graph"
@@ -201,6 +229,9 @@ func (l timingKind) Category() string {
 // The combination of resource and provider names MUST be unique across entries.
 func (e *timingSpan) hashByState(state proto.TimingState) uint64 {
 	id := fmt.Sprintf("%s:%s:%s:%s:%s", e.kind.Category(), state.String(), e.action, e.resource, e.provider)
+	if e.messageCode != "" {
+		id += ":" + string(e.messageCode)
+	}
 	return xxhash.Sum64String(id)
 }
 
@@ -226,7 +257,7 @@ func createInitTimingsEvent(event timingKind) (time.Time, *timingSpan) {
 		kind:     event,
 		action:   "initializing terraform",
 		provider: "terraform",
-		resource: "state file",
+		resource: "init",
 	}
 }
 
diff --git a/provisioner/terraform/timings_internal_test.go b/provisioner/terraform/timings_internal_test.go
index 95dc47318e2d0..552bec5a1953e 100644
--- a/provisioner/terraform/timings_internal_test.go
+++ b/provisioner/terraform/timings_internal_test.go
@@ -22,6 +22,8 @@ var (
 	inputSimple []byte
 	//go:embed testdata/timings-aggregation/init.txtar
 	inputInit []byte
+	//go:embed testdata/timings-aggregation/initupgrade.txtar
+	inputInitUpgrade []byte
 	//go:embed testdata/timings-aggregation/error.txtar
 	inputError []byte
 	//go:embed testdata/timings-aggregation/complete.txtar
@@ -45,6 +47,10 @@ func TestAggregation(t *testing.T) {
 			name:  "init",
 			input: inputInit,
 		},
+		{
+			name:  "initupgrade",
+			input: inputInitUpgrade,
+		},
 		{
 			name:  "simple",
 			input: inputSimple,
diff --git a/provisioner/terraform/timings_test.go b/provisioner/terraform/timings_test.go
index ec91caf301831..fe167b830ff05 100644
--- a/provisioner/terraform/timings_test.go
+++ b/provisioner/terraform/timings_test.go
@@ -98,6 +98,9 @@ func TestTimingsFromProvision(t *testing.T) {
 
 	// Then: the received timings should match the expected values below.
 	// NOTE: These timings have been encoded to JSON format to make the tests more readable.
+	initTimings := terraform_internal.ParseTimingLines(t, []byte(`{"start":"2025-10-22T17:48:29Z","end":"2025-10-22T17:48:31Z","action":"load","resource":"modules","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-22T17:48:29Z","end":"2025-10-22T17:48:29Z","action":"load","resource":"backend","stage":"init","state":"COMPLETED"}
+{"start":"2025-10-22T17:48:31Z","end":"2025-10-22T17:48:34Z","action":"load","resource":"provider plugins","stage":"init","state":"COMPLETED"}`))
 	planTimings := terraform_internal.ParseTimingLines(t, []byte(`{"start":"2024-08-15T08:26:39.194726Z", "end":"2024-08-15T08:26:39.195836Z", "action":"read", "source":"coder", "resource":"data.coder_parameter.memory_size", "stage":"plan", "state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.194726Z", "end":"2024-08-15T08:26:39.195712Z", "action":"read", "source":"coder", "resource":"data.coder_provisioner.me", "stage":"plan", "state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.194726Z", "end":"2024-08-15T08:26:39.195820Z", "action":"read", "source":"coder", "resource":"data.coder_workspace.me", "stage":"plan", "state":"COMPLETED"}`))
@@ -105,10 +108,10 @@ func TestTimingsFromProvision(t *testing.T) {
 {"start":"2024-08-15T08:26:39.626722Z", "end":"2024-08-15T08:26:39.669954Z", "action":"create", "source":"docker", "resource":"docker_image.main", "stage":"apply", "state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.627335Z", "end":"2024-08-15T08:26:39.660616Z", "action":"create", "source":"docker", "resource":"docker_volume.home_volume", "stage":"apply", "state":"COMPLETED"}
 {"start":"2024-08-15T08:26:39.682223Z", "end":"2024-08-15T08:26:40.186482Z", "action":"create", "source":"docker", "resource":"docker_container.workspace[0]", "stage":"apply", "state":"COMPLETED"}`))
-	initTiming := terraform_internal.ParseTimingLines(t, []byte(`{"start":"2000-01-01T01:01:01.123456Z", "end":"2000-01-01T01:01:01.123456Z", "action":"initializing terraform", "source":"terraform", "resource":"state file", "stage":"init", "state":"COMPLETED"}`))[0]
-	graphTiming := terraform_internal.ParseTimingLines(t, []byte(`{"start":"2000-01-01T01:01:01.123456Z", "end":"2000-01-01T01:01:01.123456Z", "action":"building terraform dependency graph", "source":"terraform", "resource":"state file", "stage":"graph", "state":"COMPLETED"}`))[0]
+	graphTimings := terraform_internal.ParseTimingLines(t, []byte(`{"start":"2000-01-01T01:01:01.123456Z", "end":"2000-01-01T01:01:01.123456Z", "action":"building terraform dependency graph", "source":"terraform", "resource":"state file", "stage":"graph", "state":"COMPLETED"}`))
+	graphTiming := graphTimings[0]
 
-	require.Len(t, timings, len(planTimings)+len(applyTimings)+2)
+	require.Len(t, timings, len(initTimings)+len(planTimings)+len(applyTimings)+len(graphTimings))
 
 	// init/graph timings are computed dynamically during provisioning whereas plan/apply come from the logs (fixtures) in
 	// provisioner/terraform/testdata/timings-aggregation/fake-terraform.sh.
@@ -117,11 +120,12 @@ func TestTimingsFromProvision(t *testing.T) {
 	// We manually override the init/graph timings' timestamps so that the equality check works (all other fields should be as expected).
 	pCursor := 0
 	aCursor := 0
+	iCursor := 0
 	for _, tim := range timings {
 		switch tim.Stage {
 		case string(database.ProvisionerJobTimingStageInit):
-			tim.Start, tim.End = initTiming.Start, initTiming.End
-			require.True(t, terraform_internal.TimingsAreEqual(t, []*proto.Timing{initTiming}, []*proto.Timing{tim}))
+			require.True(t, terraform_internal.TimingsAreEqual(t, []*proto.Timing{initTimings[iCursor]}, []*proto.Timing{tim}))
+			iCursor++
 		case string(database.ProvisionerJobTimingStageGraph):
 			tim.Start, tim.End = graphTiming.Start, graphTiming.End
 			require.True(t, terraform_internal.TimingsAreEqual(t, []*proto.Timing{graphTiming}, []*proto.Timing{tim}))

From f6df4c0ed8b89b96da26368663a1d1358f27c1a6 Mon Sep 17 00:00:00 2001
From: david-fraley <67079030+david-fraley@users.noreply.github.com>
Date: Tue, 28 Oct 2025 16:24:03 -0500
Subject: [PATCH 279/298] docs: update release calendar for new patches
 (#20526)

---
 docs/install/kubernetes.md     | 6 +++---
 docs/install/rancher.md        | 4 ++--
 docs/install/releases/index.md | 4 ++--
 3 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/docs/install/kubernetes.md b/docs/install/kubernetes.md
index 40f1df2fed504..3af2d917b431d 100644
--- a/docs/install/kubernetes.md
+++ b/docs/install/kubernetes.md
@@ -147,7 +147,7 @@ We support two release channels: mainline and stable - read the
     helm install coder oci://ghcr.io/coder/chart/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.27.1
+        --version 2.27.2
     ```
 
 - **Stable** Coder release:
@@ -160,7 +160,7 @@ We support two release channels: mainline and stable - read the
     helm install coder coder-v2/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.26.2
+        --version 2.26.3
     ```
 
   - **OCI Registry**
@@ -171,7 +171,7 @@ We support two release channels: mainline and stable - read the
     helm install coder oci://ghcr.io/coder/chart/coder \
         --namespace coder \
         --values values.yaml \
-        --version 2.26.2
+        --version 2.26.3
     ```
 
 You can watch Coder start up by running `kubectl get pods -n coder`. Once Coder
diff --git a/docs/install/rancher.md b/docs/install/rancher.md
index ab0148b0cf846..aaf9c947dff37 100644
--- a/docs/install/rancher.md
+++ b/docs/install/rancher.md
@@ -134,8 +134,8 @@ kubectl create secret generic coder-db-url -n coder \
 
 1. Select a Coder version:
 
-   - **Mainline**: `2.27.1`
-   - **Stable**: `2.26.2`
+   - **Mainline**: `2.27.2`
+   - **Stable**: `2.26.3`
 
    Learn more about release channels in the [Releases documentation](./releases/index.md).
 
diff --git a/docs/install/releases/index.md b/docs/install/releases/index.md
index ee2fc28950950..afe0cf4e1656c 100644
--- a/docs/install/releases/index.md
+++ b/docs/install/releases/index.md
@@ -61,8 +61,8 @@ pages.
 | [2.23](https://coder.com/changelog/coder-2-23) | June 03, 2025      | Not Supported    | [v2.23.5](https://github.com/coder/coder/releases/tag/v2.23.5) |
 | [2.24](https://coder.com/changelog/coder-2-24) | July 01, 2025      | Not Supported    | [v2.24.4](https://github.com/coder/coder/releases/tag/v2.24.4) |
 | [2.25](https://coder.com/changelog/coder-2-25) | August 05, 2025    | Security Support | [v2.25.3](https://github.com/coder/coder/releases/tag/v2.25.3) |
-| [2.26](https://coder.com/changelog/coder-2-26) | September 03, 2025 | Stable           | [v2.26.2](https://github.com/coder/coder/releases/tag/v2.26.2) |
-| [2.27](https://coder.com/changelog/coder-2-27) | October 02, 2025   | Mainline         | [v2.27.1](https://github.com/coder/coder/releases/tag/v2.27.1) |
+| [2.26](https://coder.com/changelog/coder-2-26) | September 03, 2025 | Stable           | [v2.26.3](https://github.com/coder/coder/releases/tag/v2.26.3) |
+| [2.27](https://coder.com/changelog/coder-2-27) | October 02, 2025   | Mainline         | [v2.27.2](https://github.com/coder/coder/releases/tag/v2.27.2) |
 | 2.28                                           |                    | Not Released     | N/A                                                            |
 <!-- RELEASE_CALENDAR_END -->
 

From 40fc337659bcb05f4247334bf0ddef43366eb998 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Tue, 28 Oct 2025 21:41:02 +0000
Subject: [PATCH 280/298] fix(site): fix react state violation in filetree
 create/update utils (#20483)

---
 site/src/utils/filetree.test.ts | 34 +++++++++++++++++++++------------
 site/src/utils/filetree.ts      |  8 +++++---
 2 files changed, 27 insertions(+), 15 deletions(-)

diff --git a/site/src/utils/filetree.test.ts b/site/src/utils/filetree.test.ts
index f7e3eb48f3ae7..36e88e20982e1 100644
--- a/site/src/utils/filetree.test.ts
+++ b/site/src/utils/filetree.test.ts
@@ -10,18 +10,20 @@ import {
 } from "./filetree";
 
 test("createFile() set file into the file tree", () => {
-	let fileTree: FileTree = {
+	const fileTree: FileTree = {
 		"main.tf": "terraform",
 		images: { "java.Dockerfile": "java dockerfile" },
 	};
-	fileTree = createFile(
+	const updatedFileTree = createFile(
 		"images/python.Dockerfile",
 		fileTree,
 		"python dockerfile",
 	);
-	expect((fileTree.images as FileTree)["python.Dockerfile"]).toEqual(
+	expect((updatedFileTree.images as FileTree)["python.Dockerfile"]).toEqual(
 		"python dockerfile",
 	);
+	// Verify the original FileTree was not modified.
+	expect((fileTree.images as FileTree)["python.Dockerfile"]).toBeUndefined();
 });
 
 test("getFileContent() return the file content from the file tree", () => {
@@ -35,50 +37,56 @@ test("getFileContent() return the file content from the file tree", () => {
 });
 
 test("removeFile() removes a file from a folder", () => {
-	let fileTree: FileTree = {
+	const fileTree: FileTree = {
 		"main.tf": "terraform content",
 		images: {
 			"java.Dockerfile": "java dockerfile",
 			"python.Dockerfile": "python Dockerfile",
 		},
 	};
-	fileTree = removeFile("images/python.Dockerfile", fileTree);
+	const updatedFileTree = removeFile("images/python.Dockerfile", fileTree);
 	const expectedFileTree = {
 		"main.tf": "terraform content",
 		images: {
 			"java.Dockerfile": "java dockerfile",
 		},
 	};
-	expect(expectedFileTree).toEqual(fileTree);
+	expect(updatedFileTree).toEqual(expectedFileTree);
+	// Verify the original FileTree was not modified.
+	expect((fileTree.images as FileTree)["python.Dockerfile"]).toEqual(
+		"python Dockerfile",
+	);
 });
 
 test("removeFile() removes a file from root", () => {
-	let fileTree: FileTree = {
+	const fileTree: FileTree = {
 		"main.tf": "terraform content",
 		images: {
 			"java.Dockerfile": "java dockerfile",
 			"python.Dockerfile": "python Dockerfile",
 		},
 	};
-	fileTree = removeFile("main.tf", fileTree);
+	const updatedFileTree = removeFile("main.tf", fileTree);
 	const expectedFileTree = {
 		images: {
 			"java.Dockerfile": "java dockerfile",
 			"python.Dockerfile": "python Dockerfile",
 		},
 	};
-	expect(expectedFileTree).toEqual(fileTree);
+	expect(updatedFileTree).toEqual(expectedFileTree);
+	// Verify the original FileTree was not modified.
+	expect(fileTree["main.tf"]).toEqual("terraform content");
 });
 
 test("moveFile() moves a file from in file tree", () => {
-	let fileTree: FileTree = {
+	const fileTree: FileTree = {
 		"main.tf": "terraform content",
 		images: {
 			"java.Dockerfile": "java dockerfile",
 			"python.Dockerfile": "python Dockerfile",
 		},
 	};
-	fileTree = moveFile(
+	const updatedFileTree = moveFile(
 		"images/java.Dockerfile",
 		"other/java.Dockerfile",
 		fileTree,
@@ -92,7 +100,9 @@ test("moveFile() moves a file from in file tree", () => {
 			"java.Dockerfile": "java dockerfile",
 		},
 	};
-	expect(fileTree).toEqual(expectedFileTree);
+	expect(updatedFileTree).toEqual(expectedFileTree);
+	// Verify the original FileTree was not modified.
+	expect(fileTree["main.tf"]).toEqual("terraform content");
 });
 
 test("existsFile() returns if there is or not a file", () => {
diff --git a/site/src/utils/filetree.ts b/site/src/utils/filetree.ts
index 2f7d8ea84533b..c67012e21fc17 100644
--- a/site/src/utils/filetree.ts
+++ b/site/src/utils/filetree.ts
@@ -20,7 +20,8 @@ export const createFile = (
 		throw new Error(pathError);
 	}
 
-	return set(fileTree, path.split("/"), value);
+	const updatedFileTree = structuredClone(fileTree);
+	return set(updatedFileTree, path.split("/"), value);
 };
 
 export const validatePath = (
@@ -43,7 +44,8 @@ export const updateFile = (
 	content: FileTree | string,
 	fileTree: FileTree,
 ): FileTree => {
-	return set(fileTree, path.split("/"), content);
+	const updatedFileTree = structuredClone(fileTree);
+	return set(updatedFileTree, path.split("/"), content);
 };
 
 export const existsFile = (path: string, fileTree: FileTree) => {
@@ -51,7 +53,7 @@ export const existsFile = (path: string, fileTree: FileTree) => {
 };
 
 export const removeFile = (path: string, fileTree: FileTree) => {
-	const updatedFileTree = { ...fileTree };
+	const updatedFileTree = structuredClone(fileTree);
 	unset(updatedFileTree, path.split("/"));
 	return updatedFileTree;
 };

From 8b6f55c3123ae28355948d26265c9397d7fe3bb8 Mon Sep 17 00:00:00 2001
From: Asher <ash@coder.com>
Date: Tue, 28 Oct 2025 15:20:20 -0800
Subject: [PATCH 281/298] chore: improve remote mcp workspace and file prompts
 (#20475)

I have been experimenting (via blink) and these seem to have made the
LLM behave more intelligently and consistently when it comes to creating
workspaces and manipulating files.

Partially addresses https://github.com/coder/internal/issues/1047
---
 codersdk/toolsdk/bash.go    | 10 +++++++++-
 codersdk/toolsdk/toolsdk.go | 37 +++++++++++++++++++++++++++++++++----
 2 files changed, 42 insertions(+), 5 deletions(-)

diff --git a/codersdk/toolsdk/bash.go b/codersdk/toolsdk/bash.go
index 55b3dd58bcdfb..8d72f090d7ef0 100644
--- a/codersdk/toolsdk/bash.go
+++ b/codersdk/toolsdk/bash.go
@@ -53,8 +53,16 @@ If the command times out, all output captured up to that point is returned with
 For background commands (background: true), output is captured until the timeout is reached, then the command
 continues running in the background. The captured output is returned as the result.
 
+For file operations (list, write, edit), always prefer the dedicated file tools.
+Do not use bash commands (ls, cat, echo, heredoc, etc.) to list, write, or read
+files when the file tools are available. The bash tool should be used for:
+
+	- Running commands and scripts
+	- Installing packages
+	- Starting services
+	- Executing programs
+
 Examples:
-- workspace: "my-workspace", command: "ls -la"
 - workspace: "john/dev-env", command: "git status", timeout_ms: 30000
 - workspace: "my-workspace", command: "npm run dev", background: true, timeout_ms: 10000
 - workspace: "my-workspace.main", command: "docker ps"`,
diff --git a/codersdk/toolsdk/toolsdk.go b/codersdk/toolsdk/toolsdk.go
index 43ed6ab98ac3c..802b319a5a6b1 100644
--- a/codersdk/toolsdk/toolsdk.go
+++ b/codersdk/toolsdk/toolsdk.go
@@ -353,6 +353,18 @@ var CreateWorkspace = Tool[CreateWorkspaceArgs, codersdk.Workspace]{
 If a user is asking to "test a template", they are typically referring
 to creating a workspace from a template to ensure the infrastructure
 is provisioned correctly and the agent can connect to the control plane.
+
+Before creating a workspace, always confirm the template choice with the user by:
+
+	1. Listing the available templates that match their request.
+	2. Recommending the most relevant option.
+	2. Asking the user to confirm which template to use.
+
+It is important to not create a workspace without confirming the template
+choice with the user.
+
+After creating a workspace, watch the build logs and wait for the workspace to
+be ready before trying to use or connect to the workspace.
 `,
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
@@ -530,8 +542,13 @@ type CreateWorkspaceBuildArgs struct {
 
 var CreateWorkspaceBuild = Tool[CreateWorkspaceBuildArgs, codersdk.WorkspaceBuild]{
 	Tool: aisdk.Tool{
-		Name:        ToolNameCreateWorkspaceBuild,
-		Description: "Create a new workspace build for an existing workspace. Use this to start, stop, or delete.",
+		Name: ToolNameCreateWorkspaceBuild,
+		Description: `Create a new workspace build for an existing workspace. Use this to start, stop, or delete.
+
+After creating a workspace build, watch the build logs and wait for the
+workspace build to complete before trying to start another build or use or
+connect to the workspace.
+`,
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
 				"workspace_id": map[string]any{
@@ -1531,8 +1548,20 @@ type WorkspaceWriteFileArgs struct {
 
 var WorkspaceWriteFile = Tool[WorkspaceWriteFileArgs, codersdk.Response]{
 	Tool: aisdk.Tool{
-		Name:        ToolNameWorkspaceWriteFile,
-		Description: `Write a file in a workspace.`,
+		Name: ToolNameWorkspaceWriteFile,
+		Description: `Write a file in a workspace.
+
+If a file write fails due to syntax errors or encoding issues, do NOT switch
+to using bash commands as a workaround. Instead:
+
+	1. Read the error message carefully to identify the issue
+	2. Fix the content encoding/syntax
+	3. Retry with this tool
+
+The content parameter expects base64-encoded bytes. Ensure your source content
+is correct before encoding it. If you encounter errors, decode and verify the
+content you are trying to write, then re-encode it properly.
+`,
 		Schema: aisdk.Schema{
 			Properties: map[string]any{
 				"workspace": map[string]any{

From 2a22440b0e95fabbe59e2bbd9cddaadf38fd5a4f Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Wed, 29 Oct 2025 13:38:30 -0600
Subject: [PATCH 282/298] chore!: patch release v2.28 to remove `aibridge`
 experiment (#20544)

Includes stack of PRs from https://github.com/coder/coder/pull/20520

---------

Signed-off-by: Danny Kopping <danny@coder.com>
---
 .github/workflows/dogfood.yaml                |   2 +-
 Makefile                                      |  16 +-
 cli/testdata/coder_server_--help.golden       |  35 +
 cli/testdata/server-config.yaml.golden        |   3 +-
 coderd/apidoc/docs.go                         |   9 +-
 coderd/apidoc/swagger.json                    |   9 +-
 codersdk/aibridge.go                          |   4 +-
 codersdk/deployment.go                        |  16 +-
 docs/ai-coder/ai-bridge.md                    |  18 +-
 docs/manifest.json                            |  15 +
 docs/reference/api/aibridge.md                |   4 +-
 docs/reference/api/schemas.md                 |   1 -
 docs/reference/cli/aibridge.md                |  16 +
 docs/reference/cli/aibridge_interceptions.md  |  16 +
 .../cli/aibridge_interceptions_list.md        |  69 ++
 docs/reference/cli/index.md                   |   1 +
 docs/reference/cli/server.md                  | 105 +++
 dogfood/coder/main.tf                         |   2 +-
 enterprise/{x => }/aibridged/aibridged.go     |   2 +-
 .../aibridged/aibridged_integration_test.go   |   2 +-
 .../{x => }/aibridged/aibridged_test.go       |   6 +-
 .../aibridged/aibridgedmock/clientmock.go     |   6 +-
 .../{x => }/aibridged/aibridgedmock/doc.go    |   4 +-
 .../aibridged/aibridgedmock/poolmock.go       |   6 +-
 enterprise/{x => }/aibridged/client.go        |   2 +-
 enterprise/{x => }/aibridged/http.go          |   2 +-
 enterprise/{x => }/aibridged/mcp.go           |   2 +-
 .../{x => }/aibridged/mcp_internal_test.go    |   2 +-
 enterprise/{x => }/aibridged/pool.go          |   0
 enterprise/{x => }/aibridged/pool_test.go     |   4 +-
 .../{x => }/aibridged/proto/aibridged.pb.go   | 627 +++++++++---------
 .../{x => }/aibridged/proto/aibridged.proto   |   0
 .../aibridged/proto/aibridged_drpc.pb.go      |  62 +-
 enterprise/{x => }/aibridged/request.go       |   0
 enterprise/{x => }/aibridged/server.go        |   2 +-
 enterprise/{x => }/aibridged/translator.go    |   2 +-
 enterprise/{x => }/aibridged/utils_test.go    |   0
 .../aibridgedserver/aibridgedserver.go        |   4 +-
 .../aibridgedserver_internal_test.go          |   0
 .../aibridgedserver/aibridgedserver_test.go   |   6 +-
 .../cli/{exp_aibridge.go => aibridge.go}      |   3 +-
 ...{exp_aibridge_test.go => aibridge_test.go} |   6 -
 enterprise/cli/aibridged.go                   |   2 +-
 enterprise/cli/root.go                        |   7 +-
 enterprise/cli/server.go                      |  34 +-
 enterprise/cli/testdata/coder_--help.golden   |   1 +
 .../cli/testdata/coder_aibridge_--help.golden |  12 +
 ...coder_aibridge_interceptions_--help.golden |  12 +
 ..._aibridge_interceptions_list_--help.golden |  37 ++
 .../cli/testdata/coder_server_--help.golden   |  35 +
 enterprise/coderd/aibridge.go                 |   2 +-
 enterprise/coderd/aibridge_test.go            |  37 +-
 enterprise/coderd/aibridged.go                |   6 +-
 enterprise/coderd/coderd.go                   |   9 +-
 site/src/api/typesGenerated.ts                |   2 -
 55 files changed, 787 insertions(+), 500 deletions(-)
 create mode 100644 docs/reference/cli/aibridge.md
 create mode 100644 docs/reference/cli/aibridge_interceptions.md
 create mode 100644 docs/reference/cli/aibridge_interceptions_list.md
 rename enterprise/{x => }/aibridged/aibridged.go (97%)
 rename enterprise/{x => }/aibridged/aibridged_integration_test.go (99%)
 rename enterprise/{x => }/aibridged/aibridged_test.go (98%)
 rename enterprise/{x => }/aibridged/aibridgedmock/clientmock.go (97%)
 rename enterprise/{x => }/aibridged/aibridgedmock/doc.go (52%)
 rename enterprise/{x => }/aibridged/aibridgedmock/poolmock.go (91%)
 rename enterprise/{x => }/aibridged/client.go (90%)
 rename enterprise/{x => }/aibridged/http.go (98%)
 rename enterprise/{x => }/aibridged/mcp.go (99%)
 rename enterprise/{x => }/aibridged/mcp_internal_test.go (95%)
 rename enterprise/{x => }/aibridged/pool.go (100%)
 rename enterprise/{x => }/aibridged/pool_test.go (96%)
 rename enterprise/{x => }/aibridged/proto/aibridged.pb.go (60%)
 rename enterprise/{x => }/aibridged/proto/aibridged.proto (100%)
 rename enterprise/{x => }/aibridged/proto/aibridged_drpc.pb.go (84%)
 rename enterprise/{x => }/aibridged/request.go (100%)
 rename enterprise/{x => }/aibridged/server.go (68%)
 rename enterprise/{x => }/aibridged/translator.go (98%)
 rename enterprise/{x => }/aibridged/utils_test.go (100%)
 rename enterprise/{x => }/aibridgedserver/aibridgedserver.go (99%)
 rename enterprise/{x => }/aibridgedserver/aibridgedserver_internal_test.go (100%)
 rename enterprise/{x => }/aibridgedserver/aibridgedserver_test.go (99%)
 rename enterprise/cli/{exp_aibridge.go => aibridge.go} (97%)
 rename enterprise/cli/{exp_aibridge_test.go => aibridge_test.go} (96%)
 create mode 100644 enterprise/cli/testdata/coder_aibridge_--help.golden
 create mode 100644 enterprise/cli/testdata/coder_aibridge_interceptions_--help.golden
 create mode 100644 enterprise/cli/testdata/coder_aibridge_interceptions_list_--help.golden

diff --git a/.github/workflows/dogfood.yaml b/.github/workflows/dogfood.yaml
index 2f47132ae43f0..e1d4a7a22787a 100644
--- a/.github/workflows/dogfood.yaml
+++ b/.github/workflows/dogfood.yaml
@@ -40,7 +40,7 @@ jobs:
         with:
           # Pinning to 2.28 here, as Nix gets a "error: [json.exception.type_error.302] type must be array, but is string"
           # on version 2.29 and above.
-          nix_version: "2.28.4"
+          nix_version: "2.28.5"
 
       - uses: nix-community/cache-nix-action@135667ec418502fa5a3598af6fb9eb733888ce6a # v6.1.3
         with:
diff --git a/Makefile b/Makefile
index 7f21f1fa6da04..7ecb64975e548 100644
--- a/Makefile
+++ b/Makefile
@@ -636,8 +636,8 @@ TAILNETTEST_MOCKS := \
 	tailnet/tailnettest/subscriptionmock.go
 
 AIBRIDGED_MOCKS := \
-	enterprise/x/aibridged/aibridgedmock/clientmock.go \
-	enterprise/x/aibridged/aibridgedmock/poolmock.go
+	enterprise/aibridged/aibridgedmock/clientmock.go \
+	enterprise/aibridged/aibridgedmock/poolmock.go
 
 GEN_FILES := \
 	tailnet/proto/tailnet.pb.go \
@@ -645,7 +645,7 @@ GEN_FILES := \
 	provisionersdk/proto/provisioner.pb.go \
 	provisionerd/proto/provisionerd.pb.go \
 	vpn/vpn.pb.go \
-	enterprise/x/aibridged/proto/aibridged.pb.go \
+	enterprise/aibridged/proto/aibridged.pb.go \
 	$(DB_GEN_FILES) \
 	$(SITE_GEN_FILES) \
 	coderd/rbac/object_gen.go \
@@ -697,7 +697,7 @@ gen/mark-fresh:
 		provisionersdk/proto/provisioner.pb.go \
 		provisionerd/proto/provisionerd.pb.go \
 		vpn/vpn.pb.go \
-		enterprise/x/aibridged/proto/aibridged.pb.go \
+		enterprise/aibridged/proto/aibridged.pb.go \
 		coderd/database/dump.sql \
 		$(DB_GEN_FILES) \
 		site/src/api/typesGenerated.ts \
@@ -768,8 +768,8 @@ codersdk/workspacesdk/agentconnmock/agentconnmock.go: codersdk/workspacesdk/agen
 	go generate ./codersdk/workspacesdk/agentconnmock/
 	touch "$@"
 
-$(AIBRIDGED_MOCKS): enterprise/x/aibridged/client.go enterprise/x/aibridged/pool.go
-	go generate ./enterprise/x/aibridged/aibridgedmock/
+$(AIBRIDGED_MOCKS): enterprise/aibridged/client.go enterprise/aibridged/pool.go
+	go generate ./enterprise/aibridged/aibridgedmock/
 	touch "$@"
 
 agent/agentcontainers/dcspec/dcspec_gen.go: \
@@ -822,13 +822,13 @@ vpn/vpn.pb.go: vpn/vpn.proto
 		--go_opt=paths=source_relative \
 		./vpn/vpn.proto
 
-enterprise/x/aibridged/proto/aibridged.pb.go: enterprise/x/aibridged/proto/aibridged.proto
+enterprise/aibridged/proto/aibridged.pb.go: enterprise/aibridged/proto/aibridged.proto
 	protoc \
 		--go_out=. \
 		--go_opt=paths=source_relative \
 		--go-drpc_out=. \
 		--go-drpc_opt=paths=source_relative \
-		./enterprise/x/aibridged/proto/aibridged.proto
+		./enterprise/aibridged/proto/aibridged.proto
 
 site/src/api/typesGenerated.ts: site/node_modules/.installed $(wildcard scripts/apitypings/*) $(shell find ./codersdk $(FIND_EXCLUSIONS) -type f -name '*.go')
 	# -C sets the directory for the go run command
diff --git a/cli/testdata/coder_server_--help.golden b/cli/testdata/coder_server_--help.golden
index 447ce1ae4fce2..7e7a7ece0d958 100644
--- a/cli/testdata/coder_server_--help.golden
+++ b/cli/testdata/coder_server_--help.golden
@@ -80,6 +80,41 @@ OPTIONS:
           Periodically check for new releases of Coder and inform the owner. The
           check is performed once per day.
 
+AIBRIDGE OPTIONS: 
+      --aibridge-anthropic-base-url string, $CODER_AIBRIDGE_ANTHROPIC_BASE_URL (default: https://api.anthropic.com/)
+          The base URL of the Anthropic API.
+
+      --aibridge-anthropic-key string, $CODER_AIBRIDGE_ANTHROPIC_KEY
+          The key to authenticate against the Anthropic API.
+
+      --aibridge-bedrock-access-key string, $CODER_AIBRIDGE_BEDROCK_ACCESS_KEY
+          The access key to authenticate against the AWS Bedrock API.
+
+      --aibridge-bedrock-access-key-secret string, $CODER_AIBRIDGE_BEDROCK_ACCESS_KEY_SECRET
+          The access key secret to use with the access key to authenticate
+          against the AWS Bedrock API.
+
+      --aibridge-bedrock-model string, $CODER_AIBRIDGE_BEDROCK_MODEL (default: global.anthropic.claude-sonnet-4-5-20250929-v1:0)
+          The model to use when making requests to the AWS Bedrock API.
+
+      --aibridge-bedrock-region string, $CODER_AIBRIDGE_BEDROCK_REGION
+          The AWS Bedrock API region.
+
+      --aibridge-bedrock-small-fastmodel string, $CODER_AIBRIDGE_BEDROCK_SMALL_FAST_MODEL (default: global.anthropic.claude-haiku-4-5-20251001-v1:0)
+          The small fast model to use when making requests to the AWS Bedrock
+          API. Claude Code uses Haiku-class models to perform background tasks.
+          See
+          https://docs.claude.com/en/docs/claude-code/settings#environment-variables.
+
+      --aibridge-enabled bool, $CODER_AIBRIDGE_ENABLED (default: false)
+          Whether to start an in-memory aibridged instance.
+
+      --aibridge-openai-base-url string, $CODER_AIBRIDGE_OPENAI_BASE_URL (default: https://api.openai.com/v1/)
+          The base URL of the OpenAI API.
+
+      --aibridge-openai-key string, $CODER_AIBRIDGE_OPENAI_KEY
+          The key to authenticate against the OpenAI API.
+
 CLIENT OPTIONS: 
 These options change the behavior of how clients interact with the Coder.
 Clients include the Coder CLI, Coder Desktop, IDE extensions, and the web UI.
diff --git a/cli/testdata/server-config.yaml.golden b/cli/testdata/server-config.yaml.golden
index cbabf0474f291..225c240d9e761 100644
--- a/cli/testdata/server-config.yaml.golden
+++ b/cli/testdata/server-config.yaml.golden
@@ -714,8 +714,7 @@ workspace_prebuilds:
   # (default: 3, type: int)
   failure_hard_limit: 3
 aibridge:
-  # Whether to start an in-memory aibridged instance ("aibridge" experiment must be
-  # enabled, too).
+  # Whether to start an in-memory aibridged instance.
   # (default: false, type: bool)
   enabled: false
   # The base URL of the OpenAI API.
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 45b220eb9d255..344a0299f8405 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -85,7 +85,7 @@ const docTemplate = `{
                 }
             }
         },
-        "/api/experimental/aibridge/interceptions": {
+        "/aibridge/interceptions": {
             "get": {
                 "security": [
                     {
@@ -14316,11 +14316,9 @@ const docTemplate = `{
                 "web-push",
                 "oauth2",
                 "mcp-server-http",
-                "workspace-sharing",
-                "aibridge"
+                "workspace-sharing"
             ],
             "x-enum-comments": {
-                "ExperimentAIBridge": "Enables AI Bridge functionality.",
                 "ExperimentAutoFillParameters": "This should not be taken out of experiments until we have redesigned the feature.",
                 "ExperimentExample": "This isn't used for anything.",
                 "ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.",
@@ -14338,8 +14336,7 @@ const docTemplate = `{
                 "ExperimentWebPush",
                 "ExperimentOAuth2",
                 "ExperimentMCPServerHTTP",
-                "ExperimentWorkspaceSharing",
-                "ExperimentAIBridge"
+                "ExperimentWorkspaceSharing"
             ]
         },
         "codersdk.ExternalAPIKeyScopes": {
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 8e6a0030cb83b..b472f2f4ef53f 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -65,7 +65,7 @@
 				}
 			}
 		},
-		"/api/experimental/aibridge/interceptions": {
+		"/aibridge/interceptions": {
 			"get": {
 				"security": [
 					{
@@ -12923,11 +12923,9 @@
 				"web-push",
 				"oauth2",
 				"mcp-server-http",
-				"workspace-sharing",
-				"aibridge"
+				"workspace-sharing"
 			],
 			"x-enum-comments": {
-				"ExperimentAIBridge": "Enables AI Bridge functionality.",
 				"ExperimentAutoFillParameters": "This should not be taken out of experiments until we have redesigned the feature.",
 				"ExperimentExample": "This isn't used for anything.",
 				"ExperimentMCPServerHTTP": "Enables the MCP HTTP server functionality.",
@@ -12945,8 +12943,7 @@
 				"ExperimentWebPush",
 				"ExperimentOAuth2",
 				"ExperimentMCPServerHTTP",
-				"ExperimentWorkspaceSharing",
-				"ExperimentAIBridge"
+				"ExperimentWorkspaceSharing"
 			]
 		},
 		"codersdk.ExternalAPIKeyScopes": {
diff --git a/codersdk/aibridge.go b/codersdk/aibridge.go
index b627f5e9d5ef7..a322187bb23c3 100644
--- a/codersdk/aibridge.go
+++ b/codersdk/aibridge.go
@@ -113,8 +113,8 @@ func (f AIBridgeListInterceptionsFilter) asRequestOption() RequestOption {
 
 // AIBridgeListInterceptions returns AIBridge interceptions with the given
 // filter.
-func (c *ExperimentalClient) AIBridgeListInterceptions(ctx context.Context, filter AIBridgeListInterceptionsFilter) (AIBridgeListInterceptionsResponse, error) {
-	res, err := c.Request(ctx, http.MethodGet, "/api/experimental/aibridge/interceptions", nil, filter.asRequestOption(), filter.Pagination.asRequestOption(), filter.Pagination.asRequestOption())
+func (c *Client) AIBridgeListInterceptions(ctx context.Context, filter AIBridgeListInterceptionsFilter) (AIBridgeListInterceptionsResponse, error) {
+	res, err := c.Request(ctx, http.MethodGet, "/api/v2/aibridge/interceptions", nil, filter.asRequestOption(), filter.Pagination.asRequestOption(), filter.Pagination.asRequestOption())
 	if err != nil {
 		return AIBridgeListInterceptionsResponse{}, err
 	}
diff --git a/codersdk/deployment.go b/codersdk/deployment.go
index 97bbb13bedbc7..9425a3740f089 100644
--- a/codersdk/deployment.go
+++ b/codersdk/deployment.go
@@ -3241,14 +3241,13 @@ Write out the current server config as YAML to stdout.`,
 		// AIBridge Options
 		{
 			Name:        "AIBridge Enabled",
-			Description: fmt.Sprintf("Whether to start an in-memory aibridged instance (%q experiment must be enabled, too).", ExperimentAIBridge),
+			Description: "Whether to start an in-memory aibridged instance.",
 			Flag:        "aibridge-enabled",
 			Env:         "CODER_AIBRIDGE_ENABLED",
 			Value:       &c.AI.BridgeConfig.Enabled,
 			Default:     "false",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "enabled",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge OpenAI Base URL",
@@ -3259,7 +3258,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "https://api.openai.com/v1/",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "openai_base_url",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge OpenAI Key",
@@ -3270,7 +3268,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "openai_key",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Anthropic Base URL",
@@ -3281,7 +3278,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "https://api.anthropic.com/",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "anthropic_base_url",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Anthropic Key",
@@ -3292,7 +3288,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "anthropic_key",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Bedrock Region",
@@ -3303,7 +3298,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "bedrock_region",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Bedrock Access Key",
@@ -3314,7 +3308,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "bedrock_access_key",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Bedrock Access Key Secret",
@@ -3325,7 +3318,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "",
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "bedrock_access_key_secret",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Bedrock Model",
@@ -3336,7 +3328,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "global.anthropic.claude-sonnet-4-5-20250929-v1:0", // See https://docs.claude.com/en/api/claude-on-amazon-bedrock#accessing-bedrock.
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "bedrock_model",
-			Hidden:      true,
 		},
 		{
 			Name:        "AIBridge Bedrock Small Fast Model",
@@ -3347,7 +3338,6 @@ Write out the current server config as YAML to stdout.`,
 			Default:     "global.anthropic.claude-haiku-4-5-20251001-v1:0", // See https://docs.claude.com/en/api/claude-on-amazon-bedrock#accessing-bedrock.
 			Group:       &deploymentGroupAIBridge,
 			YAML:        "bedrock_small_fast_model",
-			Hidden:      true,
 		},
 		{
 			Name: "Enable Authorization Recordings",
@@ -3645,7 +3635,6 @@ const (
 	ExperimentOAuth2             Experiment = "oauth2"               // Enables OAuth2 provider functionality.
 	ExperimentMCPServerHTTP      Experiment = "mcp-server-http"      // Enables the MCP HTTP server functionality.
 	ExperimentWorkspaceSharing   Experiment = "workspace-sharing"    // Enables updating workspace ACLs for sharing with users and groups.
-	ExperimentAIBridge           Experiment = "aibridge"             // Enables AI Bridge functionality.
 )
 
 func (e Experiment) DisplayName() string {
@@ -3666,8 +3655,6 @@ func (e Experiment) DisplayName() string {
 		return "MCP HTTP Server Functionality"
 	case ExperimentWorkspaceSharing:
 		return "Workspace Sharing"
-	case ExperimentAIBridge:
-		return "AI Bridge"
 	default:
 		// Split on hyphen and convert to title case
 		// e.g. "web-push" -> "Web Push", "mcp-server-http" -> "Mcp Server Http"
@@ -3686,7 +3673,6 @@ var ExperimentsKnown = Experiments{
 	ExperimentOAuth2,
 	ExperimentMCPServerHTTP,
 	ExperimentWorkspaceSharing,
-	ExperimentAIBridge,
 }
 
 // ExperimentsSafe should include all experiments that are safe for
diff --git a/docs/ai-coder/ai-bridge.md b/docs/ai-coder/ai-bridge.md
index c7cfbe7d85ea2..a993cee71319c 100644
--- a/docs/ai-coder/ai-bridge.md
+++ b/docs/ai-coder/ai-bridge.md
@@ -1,8 +1,5 @@
 # AI Bridge
 
-> [!NOTE]
-> AI Bridge is currently an _experimental_ feature.
-
 ![AI bridge diagram](../images/aibridge/aibridge_diagram.png)
 
 Bridge is a smart proxy for AI. It acts as a man-in-the-middle between your users' coding agents / IDEs
@@ -45,17 +42,14 @@ Bridge runs inside the Coder control plane, requiring no separate compute to dep
 
 ### Activation
 
-To enable this feature, activate the `aibridge` experiment using an environment variable or a CLI flag.
-Additionally, you will need to enable Bridge explicitly:
+You will need to enable AI Bridge explicitly:
 
 ```sh
-CODER_EXPERIMENTS="aibridge" CODER_AIBRIDGE_ENABLED=true coder server
+CODER_AIBRIDGE_ENABLED=true coder server
 # or
-coder server --experiments=aibridge --aibridge-enabled=true
+coder server --aibridge-enabled=true
 ```
 
-_If you have other experiments enabled, separate them by commas._
-
 ### Providers
 
 Bridge currently supports OpenAI and Anthropic APIs.
@@ -89,8 +83,8 @@ Once AI Bridge is enabled on the server, your users need to configure their AI c
 
 The exact configuration method varies by client — some use environment variables, others use configuration files or UI settings:
 
-- **OpenAI-compatible clients**: Set the base URL (commonly via the `OPENAI_BASE_URL` environment variable) to `https://coder.example.com/api/experimental/aibridge/openai/v1`
-- **Anthropic-compatible clients**: Set the base URL (commonly via the `ANTHROPIC_BASE_URL` environment variable) to `https://coder.example.com/api/experimental/aibridge/anthropic`
+- **OpenAI-compatible clients**: Set the base URL (commonly via the `OPENAI_BASE_URL` environment variable) to `https://coder.example.com/api/v2/aibridge/openai/v1`
+- **Anthropic-compatible clients**: Set the base URL (commonly via the `ANTHROPIC_BASE_URL` environment variable) to `https://coder.example.com/api/v2/aibridge/anthropic`
 
 Replace `coder.example.com` with your actual Coder deployment URL.
 
@@ -133,7 +127,7 @@ All of these records are associated to an "interception" record, which maps 1:1
 
 These logs can be used to determine usage patterns, track costs, and evaluate tooling adoption.
 
-This data is currently accessible through the API and CLI (experimental), which we advise administrators export to their observability platform of choice. We've configured a Grafana dashboard to display Claude Code usage internally which can be imported as a starting point for your tooling adoption metrics.
+This data is currently accessible through the API and CLI, which we advise administrators export to their observability platform of choice. We've configured a Grafana dashboard to display Claude Code usage internally which can be imported as a starting point for your tooling adoption metrics.
 
 ![User Leaderboard](../images/aibridge/grafana_user_leaderboard.png)
 
diff --git a/docs/manifest.json b/docs/manifest.json
index 78a0d38ec949d..57711406c87d7 100644
--- a/docs/manifest.json
+++ b/docs/manifest.json
@@ -1180,6 +1180,21 @@
 					"path": "./reference/cli/index.md",
 					"icon_path": "./images/icons/terminal.svg",
 					"children": [
+						{
+							"title": "aibridge",
+							"description": "Manage AIBridge.",
+							"path": "reference/cli/aibridge.md"
+						},
+						{
+							"title": "aibridge interceptions",
+							"description": "Manage AIBridge interceptions.",
+							"path": "reference/cli/aibridge_interceptions.md"
+						},
+						{
+							"title": "aibridge interceptions list",
+							"description": "List AIBridge interceptions as JSON.",
+							"path": "reference/cli/aibridge_interceptions_list.md"
+						},
 						{
 							"title": "autoupdate",
 							"description": "Toggle auto-update policy for a workspace",
diff --git a/docs/reference/api/aibridge.md b/docs/reference/api/aibridge.md
index d2be736eb32b2..7e3a23fc5ec21 100644
--- a/docs/reference/api/aibridge.md
+++ b/docs/reference/api/aibridge.md
@@ -6,12 +6,12 @@
 
 ```shell
 # Example request using curl
-curl -X GET http://coder-server:8080/api/v2/api/experimental/aibridge/interceptions \
+curl -X GET http://coder-server:8080/api/v2/aibridge/interceptions \
   -H 'Accept: application/json' \
   -H 'Coder-Session-Token: API_KEY'
 ```
 
-`GET /api/experimental/aibridge/interceptions`
+`GET /aibridge/interceptions`
 
 ### Parameters
 
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 796b4811cc4c1..037c9cfa109bb 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -4059,7 +4059,6 @@ CreateWorkspaceRequest provides options for creating a new workspace. Only one o
 | `oauth2`               |
 | `mcp-server-http`      |
 | `workspace-sharing`    |
-| `aibridge`             |
 
 ## codersdk.ExternalAPIKeyScopes
 
diff --git a/docs/reference/cli/aibridge.md b/docs/reference/cli/aibridge.md
new file mode 100644
index 0000000000000..7b16c5cdc87a8
--- /dev/null
+++ b/docs/reference/cli/aibridge.md
@@ -0,0 +1,16 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# aibridge
+
+Manage AIBridge.
+
+## Usage
+
+```console
+coder aibridge
+```
+
+## Subcommands
+
+| Name                                                      | Purpose                        |
+|-----------------------------------------------------------|--------------------------------|
+| [<code>interceptions</code>](./aibridge_interceptions.md) | Manage AIBridge interceptions. |
diff --git a/docs/reference/cli/aibridge_interceptions.md b/docs/reference/cli/aibridge_interceptions.md
new file mode 100644
index 0000000000000..9cfb3d45a74ea
--- /dev/null
+++ b/docs/reference/cli/aibridge_interceptions.md
@@ -0,0 +1,16 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# aibridge interceptions
+
+Manage AIBridge interceptions.
+
+## Usage
+
+```console
+coder aibridge interceptions
+```
+
+## Subcommands
+
+| Name                                                  | Purpose                              |
+|-------------------------------------------------------|--------------------------------------|
+| [<code>list</code>](./aibridge_interceptions_list.md) | List AIBridge interceptions as JSON. |
diff --git a/docs/reference/cli/aibridge_interceptions_list.md b/docs/reference/cli/aibridge_interceptions_list.md
new file mode 100644
index 0000000000000..7e86cd4968e33
--- /dev/null
+++ b/docs/reference/cli/aibridge_interceptions_list.md
@@ -0,0 +1,69 @@
+<!-- DO NOT EDIT | GENERATED CONTENT -->
+# aibridge interceptions list
+
+List AIBridge interceptions as JSON.
+
+## Usage
+
+```console
+coder aibridge interceptions list [flags]
+```
+
+## Options
+
+### --initiator
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Only return interceptions initiated by this user. Accepts a user ID, username, or "me".
+
+### --started-before
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Only return interceptions started before this time. Must be after 'started-after' if set. Accepts a time in the RFC 3339 format, e.g. "2006-01-02T15:04:05Z07:00".
+
+### --started-after
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Only return interceptions started after this time. Must be before 'started-before' if set. Accepts a time in the RFC 3339 format, e.g. "2006-01-02T15:04:05Z07:00".
+
+### --provider
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Only return interceptions from this provider.
+
+### --model
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+Only return interceptions from this model.
+
+### --after-id
+
+|      |                     |
+|------|---------------------|
+| Type | <code>string</code> |
+
+The ID of the last result on the previous page to use as a pagination cursor.
+
+### --limit
+
+|         |                  |
+|---------|------------------|
+| Type    | <code>int</code> |
+| Default | <code>100</code> |
+
+The limit of results to return. Must be between 1 and 1000.
diff --git a/docs/reference/cli/index.md b/docs/reference/cli/index.md
index c298f8bcb61a2..c1410b4599977 100644
--- a/docs/reference/cli/index.md
+++ b/docs/reference/cli/index.md
@@ -68,6 +68,7 @@ Coder — A tool for provisioning self-hosted development environments with Terr
 | [<code>groups</code>](./groups.md)                           | Manage groups                                                                                                                |
 | [<code>prebuilds</code>](./prebuilds.md)                     | Manage Coder prebuilds                                                                                                       |
 | [<code>external-workspaces</code>](./external-workspaces.md) | Create or manage external workspaces                                                                                         |
+| [<code>aibridge</code>](./aibridge.md)                       | Manage AIBridge.                                                                                                             |
 
 ## Options
 
diff --git a/docs/reference/cli/server.md b/docs/reference/cli/server.md
index bdc424bdd7a8b..e689f7fa28336 100644
--- a/docs/reference/cli/server.md
+++ b/docs/reference/cli/server.md
@@ -1647,3 +1647,108 @@ How often to reconcile workspace prebuilds state.
 | Default     | <code>false</code>                |
 
 Hide AI tasks from the dashboard.
+
+### --aibridge-enabled
+
+|             |                                      |
+|-------------|--------------------------------------|
+| Type        | <code>bool</code>                    |
+| Environment | <code>$CODER_AIBRIDGE_ENABLED</code> |
+| YAML        | <code>aibridge.enabled</code>        |
+| Default     | <code>false</code>                   |
+
+Whether to start an in-memory aibridged instance.
+
+### --aibridge-openai-base-url
+
+|             |                                              |
+|-------------|----------------------------------------------|
+| Type        | <code>string</code>                          |
+| Environment | <code>$CODER_AIBRIDGE_OPENAI_BASE_URL</code> |
+| YAML        | <code>aibridge.openai_base_url</code>        |
+| Default     | <code>https://api.openai.com/v1/</code>      |
+
+The base URL of the OpenAI API.
+
+### --aibridge-openai-key
+
+|             |                                         |
+|-------------|-----------------------------------------|
+| Type        | <code>string</code>                     |
+| Environment | <code>$CODER_AIBRIDGE_OPENAI_KEY</code> |
+| YAML        | <code>aibridge.openai_key</code>        |
+
+The key to authenticate against the OpenAI API.
+
+### --aibridge-anthropic-base-url
+
+|             |                                                 |
+|-------------|-------------------------------------------------|
+| Type        | <code>string</code>                             |
+| Environment | <code>$CODER_AIBRIDGE_ANTHROPIC_BASE_URL</code> |
+| YAML        | <code>aibridge.anthropic_base_url</code>        |
+| Default     | <code>https://api.anthropic.com/</code>         |
+
+The base URL of the Anthropic API.
+
+### --aibridge-anthropic-key
+
+|             |                                            |
+|-------------|--------------------------------------------|
+| Type        | <code>string</code>                        |
+| Environment | <code>$CODER_AIBRIDGE_ANTHROPIC_KEY</code> |
+| YAML        | <code>aibridge.anthropic_key</code>        |
+
+The key to authenticate against the Anthropic API.
+
+### --aibridge-bedrock-region
+
+|             |                                             |
+|-------------|---------------------------------------------|
+| Type        | <code>string</code>                         |
+| Environment | <code>$CODER_AIBRIDGE_BEDROCK_REGION</code> |
+| YAML        | <code>aibridge.bedrock_region</code>        |
+
+The AWS Bedrock API region.
+
+### --aibridge-bedrock-access-key
+
+|             |                                                 |
+|-------------|-------------------------------------------------|
+| Type        | <code>string</code>                             |
+| Environment | <code>$CODER_AIBRIDGE_BEDROCK_ACCESS_KEY</code> |
+| YAML        | <code>aibridge.bedrock_access_key</code>        |
+
+The access key to authenticate against the AWS Bedrock API.
+
+### --aibridge-bedrock-access-key-secret
+
+|             |                                                        |
+|-------------|--------------------------------------------------------|
+| Type        | <code>string</code>                                    |
+| Environment | <code>$CODER_AIBRIDGE_BEDROCK_ACCESS_KEY_SECRET</code> |
+| YAML        | <code>aibridge.bedrock_access_key_secret</code>        |
+
+The access key secret to use with the access key to authenticate against the AWS Bedrock API.
+
+### --aibridge-bedrock-model
+
+|             |                                                               |
+|-------------|---------------------------------------------------------------|
+| Type        | <code>string</code>                                           |
+| Environment | <code>$CODER_AIBRIDGE_BEDROCK_MODEL</code>                    |
+| YAML        | <code>aibridge.bedrock_model</code>                           |
+| Default     | <code>global.anthropic.claude-sonnet-4-5-20250929-v1:0</code> |
+
+The model to use when making requests to the AWS Bedrock API.
+
+### --aibridge-bedrock-small-fastmodel
+
+|             |                                                              |
+|-------------|--------------------------------------------------------------|
+| Type        | <code>string</code>                                          |
+| Environment | <code>$CODER_AIBRIDGE_BEDROCK_SMALL_FAST_MODEL</code>        |
+| YAML        | <code>aibridge.bedrock_small_fast_model</code>               |
+| Default     | <code>global.anthropic.claude-haiku-4-5-20251001-v1:0</code> |
+
+The small fast model to use when making requests to the AWS Bedrock API. Claude Code uses Haiku-class models to perform background tasks. See https://docs.claude.com/en/docs/claude-code/settings#environment-variables.
diff --git a/dogfood/coder/main.tf b/dogfood/coder/main.tf
index 05ec4a6a2e975..37a53349bb903 100644
--- a/dogfood/coder/main.tf
+++ b/dogfood/coder/main.tf
@@ -479,7 +479,7 @@ resource "coder_agent" "dev" {
   dir  = local.repo_dir
   env = {
     OIDC_TOKEN : data.coder_workspace_owner.me.oidc_access_token,
-    ANTHROPIC_BASE_URL : "https://dev.coder.com/api/experimental/aibridge/anthropic",
+    ANTHROPIC_BASE_URL : "https://dev.coder.com/api/v2/aibridge/anthropic",
     ANTHROPIC_AUTH_TOKEN : data.coder_workspace_owner.me.session_token
   }
   startup_script_behavior = "blocking"
diff --git a/enterprise/x/aibridged/aibridged.go b/enterprise/aibridged/aibridged.go
similarity index 97%
rename from enterprise/x/aibridged/aibridged.go
rename to enterprise/aibridged/aibridged.go
index a1fa4022ff960..fcec1629b8701 100644
--- a/enterprise/x/aibridged/aibridged.go
+++ b/enterprise/aibridged/aibridged.go
@@ -19,7 +19,7 @@ var _ io.Closer = &Server{}
 
 // Server provides the AI Bridge functionality.
 // It is responsible for:
-//   - receiving requests on /api/experimental/aibridged/* // TODO: update endpoint once out of experimental
+//   - receiving requests on /api/v2/aibridged/*
 //   - manipulating the requests
 //   - relaying requests to upstream AI services and relaying responses to caller
 //
diff --git a/enterprise/x/aibridged/aibridged_integration_test.go b/enterprise/aibridged/aibridged_integration_test.go
similarity index 99%
rename from enterprise/x/aibridged/aibridged_integration_test.go
rename to enterprise/aibridged/aibridged_integration_test.go
index 45d47bd1b3507..88fa21377f5a2 100644
--- a/enterprise/x/aibridged/aibridged_integration_test.go
+++ b/enterprise/aibridged/aibridged_integration_test.go
@@ -19,8 +19,8 @@ import (
 	"github.com/coder/coder/v2/coderd/database/dbtime"
 	"github.com/coder/coder/v2/coderd/externalauth"
 	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/aibridged"
 	"github.com/coder/coder/v2/enterprise/coderd/coderdenttest"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
 	"github.com/coder/coder/v2/testutil"
 )
 
diff --git a/enterprise/x/aibridged/aibridged_test.go b/enterprise/aibridged/aibridged_test.go
similarity index 98%
rename from enterprise/x/aibridged/aibridged_test.go
rename to enterprise/aibridged/aibridged_test.go
index 967e9aac2bce3..5d38b7f54d18c 100644
--- a/enterprise/x/aibridged/aibridged_test.go
+++ b/enterprise/aibridged/aibridged_test.go
@@ -18,9 +18,9 @@ import (
 	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/aibridge"
 	"github.com/coder/coder/v2/codersdk"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
-	mock "github.com/coder/coder/v2/enterprise/x/aibridged/aibridgedmock"
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged"
+	mock "github.com/coder/coder/v2/enterprise/aibridged/aibridgedmock"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 	"github.com/coder/coder/v2/testutil"
 )
 
diff --git a/enterprise/x/aibridged/aibridgedmock/clientmock.go b/enterprise/aibridged/aibridgedmock/clientmock.go
similarity index 97%
rename from enterprise/x/aibridged/aibridgedmock/clientmock.go
rename to enterprise/aibridged/aibridgedmock/clientmock.go
index c49a385451a8e..2bb7083e10924 100644
--- a/enterprise/x/aibridged/aibridgedmock/clientmock.go
+++ b/enterprise/aibridged/aibridgedmock/clientmock.go
@@ -1,9 +1,9 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/coder/coder/v2/enterprise/x/aibridged (interfaces: DRPCClient)
+// Source: github.com/coder/coder/v2/enterprise/aibridged (interfaces: DRPCClient)
 //
 // Generated by this command:
 //
-//	mockgen -destination ./clientmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/x/aibridged DRPCClient
+//	mockgen -destination ./clientmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/aibridged DRPCClient
 //
 
 // Package aibridgedmock is a generated GoMock package.
@@ -13,7 +13,7 @@ import (
 	context "context"
 	reflect "reflect"
 
-	proto "github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	proto "github.com/coder/coder/v2/enterprise/aibridged/proto"
 	gomock "go.uber.org/mock/gomock"
 	drpc "storj.io/drpc"
 )
diff --git a/enterprise/x/aibridged/aibridgedmock/doc.go b/enterprise/aibridged/aibridgedmock/doc.go
similarity index 52%
rename from enterprise/x/aibridged/aibridgedmock/doc.go
rename to enterprise/aibridged/aibridgedmock/doc.go
index 3d3f56c05574d..9c9c644570463 100644
--- a/enterprise/x/aibridged/aibridgedmock/doc.go
+++ b/enterprise/aibridged/aibridgedmock/doc.go
@@ -1,4 +1,4 @@
 package aibridgedmock
 
-//go:generate mockgen -destination ./clientmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/x/aibridged DRPCClient
-//go:generate mockgen -destination ./poolmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/x/aibridged Pooler
+//go:generate mockgen -destination ./clientmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/aibridged DRPCClient
+//go:generate mockgen -destination ./poolmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/aibridged Pooler
diff --git a/enterprise/x/aibridged/aibridgedmock/poolmock.go b/enterprise/aibridged/aibridgedmock/poolmock.go
similarity index 91%
rename from enterprise/x/aibridged/aibridgedmock/poolmock.go
rename to enterprise/aibridged/aibridgedmock/poolmock.go
index bf3b39ed2a879..fcd941fc7c989 100644
--- a/enterprise/x/aibridged/aibridgedmock/poolmock.go
+++ b/enterprise/aibridged/aibridgedmock/poolmock.go
@@ -1,9 +1,9 @@
 // Code generated by MockGen. DO NOT EDIT.
-// Source: github.com/coder/coder/v2/enterprise/x/aibridged (interfaces: Pooler)
+// Source: github.com/coder/coder/v2/enterprise/aibridged (interfaces: Pooler)
 //
 // Generated by this command:
 //
-//	mockgen -destination ./poolmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/x/aibridged Pooler
+//	mockgen -destination ./poolmock.go -package aibridgedmock github.com/coder/coder/v2/enterprise/aibridged Pooler
 //
 
 // Package aibridgedmock is a generated GoMock package.
@@ -14,7 +14,7 @@ import (
 	http "net/http"
 	reflect "reflect"
 
-	aibridged "github.com/coder/coder/v2/enterprise/x/aibridged"
+	aibridged "github.com/coder/coder/v2/enterprise/aibridged"
 	gomock "go.uber.org/mock/gomock"
 )
 
diff --git a/enterprise/x/aibridged/client.go b/enterprise/aibridged/client.go
similarity index 90%
rename from enterprise/x/aibridged/client.go
rename to enterprise/aibridged/client.go
index 3004a84df9626..60650bf994f28 100644
--- a/enterprise/x/aibridged/client.go
+++ b/enterprise/aibridged/client.go
@@ -5,7 +5,7 @@ import (
 
 	"storj.io/drpc"
 
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 )
 
 type Dialer func(ctx context.Context) (DRPCClient, error)
diff --git a/enterprise/x/aibridged/http.go b/enterprise/aibridged/http.go
similarity index 98%
rename from enterprise/x/aibridged/http.go
rename to enterprise/aibridged/http.go
index 43f4ba7670671..e87238cc7bbc0 100644
--- a/enterprise/x/aibridged/http.go
+++ b/enterprise/aibridged/http.go
@@ -9,7 +9,7 @@ import (
 
 	"cdr.dev/slog"
 	"github.com/coder/aibridge"
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 )
 
 var _ http.Handler = &Server{}
diff --git a/enterprise/x/aibridged/mcp.go b/enterprise/aibridged/mcp.go
similarity index 99%
rename from enterprise/x/aibridged/mcp.go
rename to enterprise/aibridged/mcp.go
index 4b42287e02899..ab6d1d0031d37 100644
--- a/enterprise/x/aibridged/mcp.go
+++ b/enterprise/aibridged/mcp.go
@@ -10,7 +10,7 @@ import (
 
 	"cdr.dev/slog"
 	"github.com/coder/aibridge/mcp"
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 )
 
 var (
diff --git a/enterprise/x/aibridged/mcp_internal_test.go b/enterprise/aibridged/mcp_internal_test.go
similarity index 95%
rename from enterprise/x/aibridged/mcp_internal_test.go
rename to enterprise/aibridged/mcp_internal_test.go
index 20edf79d06bf5..37fb6fe2c25d2 100644
--- a/enterprise/x/aibridged/mcp_internal_test.go
+++ b/enterprise/aibridged/mcp_internal_test.go
@@ -5,7 +5,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 	"github.com/coder/coder/v2/testutil"
 )
 
diff --git a/enterprise/x/aibridged/pool.go b/enterprise/aibridged/pool.go
similarity index 100%
rename from enterprise/x/aibridged/pool.go
rename to enterprise/aibridged/pool.go
diff --git a/enterprise/x/aibridged/pool_test.go b/enterprise/aibridged/pool_test.go
similarity index 96%
rename from enterprise/x/aibridged/pool_test.go
rename to enterprise/aibridged/pool_test.go
index 38cae85da9d92..e3609144f0d59 100644
--- a/enterprise/x/aibridged/pool_test.go
+++ b/enterprise/aibridged/pool_test.go
@@ -13,8 +13,8 @@ import (
 	"cdr.dev/slog/sloggers/slogtest"
 	"github.com/coder/aibridge/mcp"
 	"github.com/coder/aibridge/mcpmock"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
-	mock "github.com/coder/coder/v2/enterprise/x/aibridged/aibridgedmock"
+	"github.com/coder/coder/v2/enterprise/aibridged"
+	mock "github.com/coder/coder/v2/enterprise/aibridged/aibridgedmock"
 )
 
 // TestPool validates the published behavior of [aibridged.CachedBridgePool].
diff --git a/enterprise/x/aibridged/proto/aibridged.pb.go b/enterprise/aibridged/proto/aibridged.pb.go
similarity index 60%
rename from enterprise/x/aibridged/proto/aibridged.pb.go
rename to enterprise/aibridged/proto/aibridged.pb.go
index 41d31563b4043..a13a39ed95245 100644
--- a/enterprise/x/aibridged/proto/aibridged.pb.go
+++ b/enterprise/aibridged/proto/aibridged.pb.go
@@ -2,7 +2,7 @@
 // versions:
 // 	protoc-gen-go v1.30.0
 // 	protoc        v4.23.4
-// source: enterprise/x/aibridged/proto/aibridged.proto
+// source: enterprise/aibridged/proto/aibridged.proto
 
 package proto
 
@@ -38,7 +38,7 @@ type RecordInterceptionRequest struct {
 func (x *RecordInterceptionRequest) Reset() {
 	*x = RecordInterceptionRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[0]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[0]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -51,7 +51,7 @@ func (x *RecordInterceptionRequest) String() string {
 func (*RecordInterceptionRequest) ProtoMessage() {}
 
 func (x *RecordInterceptionRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[0]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[0]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -64,7 +64,7 @@ func (x *RecordInterceptionRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordInterceptionRequest.ProtoReflect.Descriptor instead.
 func (*RecordInterceptionRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{0}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{0}
 }
 
 func (x *RecordInterceptionRequest) GetId() string {
@@ -118,7 +118,7 @@ type RecordInterceptionResponse struct {
 func (x *RecordInterceptionResponse) Reset() {
 	*x = RecordInterceptionResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[1]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[1]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -131,7 +131,7 @@ func (x *RecordInterceptionResponse) String() string {
 func (*RecordInterceptionResponse) ProtoMessage() {}
 
 func (x *RecordInterceptionResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[1]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[1]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -144,7 +144,7 @@ func (x *RecordInterceptionResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordInterceptionResponse.ProtoReflect.Descriptor instead.
 func (*RecordInterceptionResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{1}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{1}
 }
 
 type RecordInterceptionEndedRequest struct {
@@ -159,7 +159,7 @@ type RecordInterceptionEndedRequest struct {
 func (x *RecordInterceptionEndedRequest) Reset() {
 	*x = RecordInterceptionEndedRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[2]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -172,7 +172,7 @@ func (x *RecordInterceptionEndedRequest) String() string {
 func (*RecordInterceptionEndedRequest) ProtoMessage() {}
 
 func (x *RecordInterceptionEndedRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[2]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -185,7 +185,7 @@ func (x *RecordInterceptionEndedRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordInterceptionEndedRequest.ProtoReflect.Descriptor instead.
 func (*RecordInterceptionEndedRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{2}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{2}
 }
 
 func (x *RecordInterceptionEndedRequest) GetId() string {
@@ -211,7 +211,7 @@ type RecordInterceptionEndedResponse struct {
 func (x *RecordInterceptionEndedResponse) Reset() {
 	*x = RecordInterceptionEndedResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[3]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -224,7 +224,7 @@ func (x *RecordInterceptionEndedResponse) String() string {
 func (*RecordInterceptionEndedResponse) ProtoMessage() {}
 
 func (x *RecordInterceptionEndedResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[3]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -237,7 +237,7 @@ func (x *RecordInterceptionEndedResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordInterceptionEndedResponse.ProtoReflect.Descriptor instead.
 func (*RecordInterceptionEndedResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{3}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{3}
 }
 
 type RecordTokenUsageRequest struct {
@@ -256,7 +256,7 @@ type RecordTokenUsageRequest struct {
 func (x *RecordTokenUsageRequest) Reset() {
 	*x = RecordTokenUsageRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[4]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -269,7 +269,7 @@ func (x *RecordTokenUsageRequest) String() string {
 func (*RecordTokenUsageRequest) ProtoMessage() {}
 
 func (x *RecordTokenUsageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[4]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -282,7 +282,7 @@ func (x *RecordTokenUsageRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordTokenUsageRequest.ProtoReflect.Descriptor instead.
 func (*RecordTokenUsageRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{4}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{4}
 }
 
 func (x *RecordTokenUsageRequest) GetInterceptionId() string {
@@ -336,7 +336,7 @@ type RecordTokenUsageResponse struct {
 func (x *RecordTokenUsageResponse) Reset() {
 	*x = RecordTokenUsageResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[5]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -349,7 +349,7 @@ func (x *RecordTokenUsageResponse) String() string {
 func (*RecordTokenUsageResponse) ProtoMessage() {}
 
 func (x *RecordTokenUsageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[5]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -362,7 +362,7 @@ func (x *RecordTokenUsageResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordTokenUsageResponse.ProtoReflect.Descriptor instead.
 func (*RecordTokenUsageResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{5}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{5}
 }
 
 type RecordPromptUsageRequest struct {
@@ -380,7 +380,7 @@ type RecordPromptUsageRequest struct {
 func (x *RecordPromptUsageRequest) Reset() {
 	*x = RecordPromptUsageRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[6]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -393,7 +393,7 @@ func (x *RecordPromptUsageRequest) String() string {
 func (*RecordPromptUsageRequest) ProtoMessage() {}
 
 func (x *RecordPromptUsageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[6]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -406,7 +406,7 @@ func (x *RecordPromptUsageRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordPromptUsageRequest.ProtoReflect.Descriptor instead.
 func (*RecordPromptUsageRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{6}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{6}
 }
 
 func (x *RecordPromptUsageRequest) GetInterceptionId() string {
@@ -453,7 +453,7 @@ type RecordPromptUsageResponse struct {
 func (x *RecordPromptUsageResponse) Reset() {
 	*x = RecordPromptUsageResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[7]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -466,7 +466,7 @@ func (x *RecordPromptUsageResponse) String() string {
 func (*RecordPromptUsageResponse) ProtoMessage() {}
 
 func (x *RecordPromptUsageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[7]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -479,7 +479,7 @@ func (x *RecordPromptUsageResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordPromptUsageResponse.ProtoReflect.Descriptor instead.
 func (*RecordPromptUsageResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{7}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{7}
 }
 
 type RecordToolUsageRequest struct {
@@ -501,7 +501,7 @@ type RecordToolUsageRequest struct {
 func (x *RecordToolUsageRequest) Reset() {
 	*x = RecordToolUsageRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[8]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -514,7 +514,7 @@ func (x *RecordToolUsageRequest) String() string {
 func (*RecordToolUsageRequest) ProtoMessage() {}
 
 func (x *RecordToolUsageRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[8]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -527,7 +527,7 @@ func (x *RecordToolUsageRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordToolUsageRequest.ProtoReflect.Descriptor instead.
 func (*RecordToolUsageRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{8}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{8}
 }
 
 func (x *RecordToolUsageRequest) GetInterceptionId() string {
@@ -602,7 +602,7 @@ type RecordToolUsageResponse struct {
 func (x *RecordToolUsageResponse) Reset() {
 	*x = RecordToolUsageResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[9]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -615,7 +615,7 @@ func (x *RecordToolUsageResponse) String() string {
 func (*RecordToolUsageResponse) ProtoMessage() {}
 
 func (x *RecordToolUsageResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[9]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -628,7 +628,7 @@ func (x *RecordToolUsageResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use RecordToolUsageResponse.ProtoReflect.Descriptor instead.
 func (*RecordToolUsageResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{9}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{9}
 }
 
 type GetMCPServerConfigsRequest struct {
@@ -642,7 +642,7 @@ type GetMCPServerConfigsRequest struct {
 func (x *GetMCPServerConfigsRequest) Reset() {
 	*x = GetMCPServerConfigsRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[10]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -655,7 +655,7 @@ func (x *GetMCPServerConfigsRequest) String() string {
 func (*GetMCPServerConfigsRequest) ProtoMessage() {}
 
 func (x *GetMCPServerConfigsRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[10]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -668,7 +668,7 @@ func (x *GetMCPServerConfigsRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetMCPServerConfigsRequest.ProtoReflect.Descriptor instead.
 func (*GetMCPServerConfigsRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{10}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{10}
 }
 
 func (x *GetMCPServerConfigsRequest) GetUserId() string {
@@ -690,7 +690,7 @@ type GetMCPServerConfigsResponse struct {
 func (x *GetMCPServerConfigsResponse) Reset() {
 	*x = GetMCPServerConfigsResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[11]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -703,7 +703,7 @@ func (x *GetMCPServerConfigsResponse) String() string {
 func (*GetMCPServerConfigsResponse) ProtoMessage() {}
 
 func (x *GetMCPServerConfigsResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[11]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -716,7 +716,7 @@ func (x *GetMCPServerConfigsResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use GetMCPServerConfigsResponse.ProtoReflect.Descriptor instead.
 func (*GetMCPServerConfigsResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{11}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{11}
 }
 
 func (x *GetMCPServerConfigsResponse) GetCoderMcpConfig() *MCPServerConfig {
@@ -747,7 +747,7 @@ type MCPServerConfig struct {
 func (x *MCPServerConfig) Reset() {
 	*x = MCPServerConfig{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[12]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -760,7 +760,7 @@ func (x *MCPServerConfig) String() string {
 func (*MCPServerConfig) ProtoMessage() {}
 
 func (x *MCPServerConfig) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[12]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -773,7 +773,7 @@ func (x *MCPServerConfig) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use MCPServerConfig.ProtoReflect.Descriptor instead.
 func (*MCPServerConfig) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{12}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{12}
 }
 
 func (x *MCPServerConfig) GetId() string {
@@ -816,7 +816,7 @@ type GetMCPServerAccessTokensBatchRequest struct {
 func (x *GetMCPServerAccessTokensBatchRequest) Reset() {
 	*x = GetMCPServerAccessTokensBatchRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[13]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -829,7 +829,7 @@ func (x *GetMCPServerAccessTokensBatchRequest) String() string {
 func (*GetMCPServerAccessTokensBatchRequest) ProtoMessage() {}
 
 func (x *GetMCPServerAccessTokensBatchRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[13]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -842,7 +842,7 @@ func (x *GetMCPServerAccessTokensBatchRequest) ProtoReflect() protoreflect.Messa
 
 // Deprecated: Use GetMCPServerAccessTokensBatchRequest.ProtoReflect.Descriptor instead.
 func (*GetMCPServerAccessTokensBatchRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{13}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{13}
 }
 
 func (x *GetMCPServerAccessTokensBatchRequest) GetUserId() string {
@@ -873,7 +873,7 @@ type GetMCPServerAccessTokensBatchResponse struct {
 func (x *GetMCPServerAccessTokensBatchResponse) Reset() {
 	*x = GetMCPServerAccessTokensBatchResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[14]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -886,7 +886,7 @@ func (x *GetMCPServerAccessTokensBatchResponse) String() string {
 func (*GetMCPServerAccessTokensBatchResponse) ProtoMessage() {}
 
 func (x *GetMCPServerAccessTokensBatchResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[14]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -899,7 +899,7 @@ func (x *GetMCPServerAccessTokensBatchResponse) ProtoReflect() protoreflect.Mess
 
 // Deprecated: Use GetMCPServerAccessTokensBatchResponse.ProtoReflect.Descriptor instead.
 func (*GetMCPServerAccessTokensBatchResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{14}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{14}
 }
 
 func (x *GetMCPServerAccessTokensBatchResponse) GetAccessTokens() map[string]string {
@@ -927,7 +927,7 @@ type IsAuthorizedRequest struct {
 func (x *IsAuthorizedRequest) Reset() {
 	*x = IsAuthorizedRequest{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[15]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[15]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -940,7 +940,7 @@ func (x *IsAuthorizedRequest) String() string {
 func (*IsAuthorizedRequest) ProtoMessage() {}
 
 func (x *IsAuthorizedRequest) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[15]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[15]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -953,7 +953,7 @@ func (x *IsAuthorizedRequest) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IsAuthorizedRequest.ProtoReflect.Descriptor instead.
 func (*IsAuthorizedRequest) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{15}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{15}
 }
 
 func (x *IsAuthorizedRequest) GetKey() string {
@@ -974,7 +974,7 @@ type IsAuthorizedResponse struct {
 func (x *IsAuthorizedResponse) Reset() {
 	*x = IsAuthorizedResponse{}
 	if protoimpl.UnsafeEnabled {
-		mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[16]
+		mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[16]
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		ms.StoreMessageInfo(mi)
 	}
@@ -987,7 +987,7 @@ func (x *IsAuthorizedResponse) String() string {
 func (*IsAuthorizedResponse) ProtoMessage() {}
 
 func (x *IsAuthorizedResponse) ProtoReflect() protoreflect.Message {
-	mi := &file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[16]
+	mi := &file_enterprise_aibridged_proto_aibridged_proto_msgTypes[16]
 	if protoimpl.UnsafeEnabled && x != nil {
 		ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x))
 		if ms.LoadMessageInfo() == nil {
@@ -1000,7 +1000,7 @@ func (x *IsAuthorizedResponse) ProtoReflect() protoreflect.Message {
 
 // Deprecated: Use IsAuthorizedResponse.ProtoReflect.Descriptor instead.
 func (*IsAuthorizedResponse) Descriptor() ([]byte, []int) {
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{16}
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP(), []int{16}
 }
 
 func (x *IsAuthorizedResponse) GetOwnerId() string {
@@ -1010,257 +1010,256 @@ func (x *IsAuthorizedResponse) GetOwnerId() string {
 	return ""
 }
 
-var File_enterprise_x_aibridged_proto_aibridged_proto protoreflect.FileDescriptor
-
-var file_enterprise_x_aibridged_proto_aibridged_proto_rawDesc = []byte{
-	0x0a, 0x2c, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x2f, 0x78, 0x2f, 0x61,
-	0x69, 0x62, 0x72, 0x69, 0x64, 0x67, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61,
-	0x69, 0x62, 0x72, 0x69, 0x64, 0x67, 0x65, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x1a, 0x1f, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75,
-	0x66, 0x2f, 0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x22, 0xda, 0x02, 0x0a, 0x19, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65,
-	0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12,
-	0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12,
-	0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0b, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72,
-	0x49, 0x64, 0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x03,
-	0x20, 0x01, 0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x14,
-	0x0a, 0x05, 0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d,
-	0x6f, 0x64, 0x65, 0x6c, 0x12, 0x4a, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f,
-	0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x12, 0x39, 0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x06,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x09, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1c,
-	0x0a, 0x1a, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x67, 0x0a, 0x1e,
+var File_enterprise_aibridged_proto_aibridged_proto protoreflect.FileDescriptor
+
+var file_enterprise_aibridged_proto_aibridged_proto_rawDesc = []byte{
+	0x0a, 0x2a, 0x65, 0x6e, 0x74, 0x65, 0x72, 0x70, 0x72, 0x69, 0x73, 0x65, 0x2f, 0x61, 0x69, 0x62,
+	0x72, 0x69, 0x64, 0x67, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2f, 0x61, 0x69, 0x62,
+	0x72, 0x69, 0x64, 0x67, 0x65, 0x64, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x12, 0x05, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x1a, 0x19, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2f, 0x61, 0x6e, 0x79, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x1f,
+	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2f,
+	0x74, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x22,
+	0xda, 0x02, 0x0a, 0x19, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63,
+	0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a,
+	0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x21, 0x0a,
+	0x0c, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x0b, 0x69, 0x6e, 0x69, 0x74, 0x69, 0x61, 0x74, 0x6f, 0x72, 0x49, 0x64,
+	0x12, 0x1a, 0x0a, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x18, 0x03, 0x20, 0x01,
+	0x28, 0x09, 0x52, 0x08, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72, 0x12, 0x14, 0x0a, 0x05,
+	0x6d, 0x6f, 0x64, 0x65, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x6f, 0x64,
+	0x65, 0x6c, 0x12, 0x4a, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05,
+	0x20, 0x03, 0x28, 0x0b, 0x32, 0x2e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39,
+	0x0a, 0x0a, 0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09,
+	0x73, 0x74, 0x61, 0x72, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e,
+	0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1c, 0x0a, 0x1a,
 	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69,
-	0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e,
-	0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x35,
-	0x0a, 0x08, 0x65, 0x6e, 0x64, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b,
-	0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62,
-	0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x07, 0x65, 0x6e,
-	0x64, 0x65, 0x64, 0x41, 0x74, 0x22, 0x21, 0x0a, 0x1f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49,
-	0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xf9, 0x02, 0x0a, 0x17, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
+	0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x67, 0x0a, 0x1e, 0x52, 0x65,
+	0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e,
+	0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x0e, 0x0a, 0x02,
+	0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x35, 0x0a, 0x08,
+	0x65, 0x6e, 0x64, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a,
+	0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66,
+	0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x07, 0x65, 0x6e, 0x64, 0x65,
+	0x64, 0x41, 0x74, 0x22, 0x21, 0x0a, 0x1f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74,
+	0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xf9, 0x02, 0x0a, 0x17, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74,
+	0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d,
+	0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x73, 0x67,
+	0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65,
+	0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x54,
+	0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x5f,
+	0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c, 0x6f, 0x75,
+	0x74, 0x70, 0x75, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x48, 0x0a, 0x08, 0x6d, 0x65,
+	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c, 0x2e, 0x70,
+	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e,
+	0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61,
+	0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f,
+	0x61, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c,
+	0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73,
+	0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a,
+	0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02,
+	0x38, 0x01, 0x22, 0x1a, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65,
+	0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xcb,
+	0x02, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55,
+	0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69,
+	0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69,
+	0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x70,
+	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70, 0x72, 0x6f,
+	0x6d, 0x70, 0x74, 0x12, 0x49, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18,
+	0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65,
+	0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45,
+	0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39,
+	0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05, 0x20, 0x01,
+	0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09,
+	0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74,
+	0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65,
+	0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e,
+	0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1b, 0x0a, 0x19,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xed, 0x03, 0x0a, 0x16, 0x52, 0x65,
+	0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
 	0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70,
 	0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69,
 	0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a,
 	0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d,
-	0x73, 0x67, 0x49, 0x64, 0x12, 0x21, 0x0a, 0x0c, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x5f, 0x74, 0x6f,
-	0x6b, 0x65, 0x6e, 0x73, 0x18, 0x03, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0b, 0x69, 0x6e, 0x70, 0x75,
-	0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x23, 0x0a, 0x0d, 0x6f, 0x75, 0x74, 0x70, 0x75,
-	0x74, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x04, 0x20, 0x01, 0x28, 0x03, 0x52, 0x0c,
-	0x6f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x48, 0x0a, 0x08,
-	0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x05, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2c,
-	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b,
-	0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65,
-	0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65,
-	0x64, 0x5f, 0x61, 0x74, 0x18, 0x06, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f,
-	0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d,
-	0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41,
-	0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74,
-	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x3a, 0x02, 0x38, 0x01, 0x22, 0x1a, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f,
-	0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65,
-	0x22, 0xcb, 0x02, 0x0a, 0x18, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70,
-	0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a,
-	0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64,
-	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70,
-	0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12, 0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x16, 0x0a,
-	0x06, 0x70, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x70,
-	0x72, 0x6f, 0x6d, 0x70, 0x74, 0x12, 0x49, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x18, 0x04, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x2d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74,
-	0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x05,
-	0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
-	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70,
-	0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d,
-	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03,
-	0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a,
-	0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x1b,
-	0x0a, 0x19, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0xed, 0x03, 0x0a, 0x16,
-	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x12, 0x27, 0x0a, 0x0f, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63,
-	0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0e, 0x69, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x49, 0x64, 0x12,
-	0x15, 0x0a, 0x06, 0x6d, 0x73, 0x67, 0x5f, 0x69, 0x64, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x05, 0x6d, 0x73, 0x67, 0x49, 0x64, 0x12, 0x22, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x5f, 0x75, 0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x73, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x6f,
-	0x6f, 0x6c, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x6f, 0x6f, 0x6c, 0x12, 0x14,
-	0x0a, 0x05, 0x69, 0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x69,
-	0x6e, 0x70, 0x75, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x18, 0x06, 0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64,
-	0x12, 0x2e, 0x0a, 0x10, 0x69, 0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65,
-	0x72, 0x72, 0x6f, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e,
-	0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x88, 0x01, 0x01,
-	0x12, 0x47, 0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x08, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x2b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
-	0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x2e, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65,
-	0x61, 0x74, 0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e,
-	0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e,
-	0x54, 0x69, 0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74,
-	0x65, 0x64, 0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61,
-	0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65,
-	0x18, 0x02, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61,
-	0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x73, 0x65, 0x72, 0x76,
-	0x65, 0x72, 0x5f, 0x75, 0x72, 0x6c, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x76, 0x6f, 0x63,
-	0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x19, 0x0a, 0x17, 0x52,
-	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x22, 0x35, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50,
-	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18,
-	0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0xb2, 0x01,
-	0x0a, 0x1b, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f,
-	0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a,
-	0x10, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x18, 0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52,
-	0x0e, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12,
-	0x51, 0x0a, 0x19, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68,
-	0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03,
-	0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4d, 0x43, 0x50, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x16, 0x65, 0x78, 0x74, 0x65,
-	0x72, 0x6e, 0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x73, 0x22, 0x85, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x28, 0x0a, 0x10, 0x74, 0x6f, 0x6f, 0x6c,
-	0x5f, 0x61, 0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x72, 0x65, 0x67, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01,
-	0x28, 0x09, 0x52, 0x0e, 0x74, 0x6f, 0x6f, 0x6c, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x67,
-	0x65, 0x78, 0x12, 0x26, 0x0a, 0x0f, 0x74, 0x6f, 0x6f, 0x6c, 0x5f, 0x64, 0x65, 0x6e, 0x79, 0x5f,
-	0x72, 0x65, 0x67, 0x65, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x74, 0x6f, 0x6f,
-	0x6c, 0x44, 0x65, 0x6e, 0x79, 0x52, 0x65, 0x67, 0x65, 0x78, 0x22, 0x72, 0x0a, 0x24, 0x47, 0x65,
-	0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x67, 0x49, 0x64, 0x12, 0x22, 0x0a, 0x0a, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x75,
+	0x72, 0x6c, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09, 0x48, 0x00, 0x52, 0x09, 0x73, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x55, 0x72, 0x6c, 0x88, 0x01, 0x01, 0x12, 0x12, 0x0a, 0x04, 0x74, 0x6f, 0x6f, 0x6c,
+	0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x74, 0x6f, 0x6f, 0x6c, 0x12, 0x14, 0x0a, 0x05,
+	0x69, 0x6e, 0x70, 0x75, 0x74, 0x18, 0x05, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x69, 0x6e, 0x70,
+	0x75, 0x74, 0x12, 0x1a, 0x0a, 0x08, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x18, 0x06,
+	0x20, 0x01, 0x28, 0x08, 0x52, 0x08, 0x69, 0x6e, 0x6a, 0x65, 0x63, 0x74, 0x65, 0x64, 0x12, 0x2e,
+	0x0a, 0x10, 0x69, 0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72,
+	0x6f, 0x72, 0x18, 0x07, 0x20, 0x01, 0x28, 0x09, 0x48, 0x01, 0x52, 0x0f, 0x69, 0x6e, 0x76, 0x6f,
+	0x63, 0x61, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x88, 0x01, 0x01, 0x12, 0x47,
+	0x0a, 0x08, 0x6d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x18, 0x08, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x2b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54,
+	0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x2e,
+	0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x08, 0x6d,
+	0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x12, 0x39, 0x0a, 0x0a, 0x63, 0x72, 0x65, 0x61, 0x74,
+	0x65, 0x64, 0x5f, 0x61, 0x74, 0x18, 0x09, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x1a, 0x2e, 0x67, 0x6f,
+	0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x54, 0x69,
+	0x6d, 0x65, 0x73, 0x74, 0x61, 0x6d, 0x70, 0x52, 0x09, 0x63, 0x72, 0x65, 0x61, 0x74, 0x65, 0x64,
+	0x41, 0x74, 0x1a, 0x51, 0x0a, 0x0d, 0x4d, 0x65, 0x74, 0x61, 0x64, 0x61, 0x74, 0x61, 0x45, 0x6e,
+	0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x2a, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02,
+	0x20, 0x01, 0x28, 0x0b, 0x32, 0x14, 0x2e, 0x67, 0x6f, 0x6f, 0x67, 0x6c, 0x65, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x62, 0x75, 0x66, 0x2e, 0x41, 0x6e, 0x79, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75,
+	0x65, 0x3a, 0x02, 0x38, 0x01, 0x42, 0x0d, 0x0a, 0x0b, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72,
+	0x5f, 0x75, 0x72, 0x6c, 0x42, 0x13, 0x0a, 0x11, 0x5f, 0x69, 0x6e, 0x76, 0x6f, 0x63, 0x61, 0x74,
+	0x69, 0x6f, 0x6e, 0x5f, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x22, 0x19, 0x0a, 0x17, 0x52, 0x65, 0x63,
+	0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x22, 0x35, 0x0a, 0x1a, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65,
+	0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71, 0x75, 0x65,
 	0x73, 0x74, 0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20,
-	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x31, 0x0a, 0x15, 0x6d,
-	0x63, 0x70, 0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x5f, 0x69, 0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x6d, 0x63, 0x70, 0x53,
-	0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x49, 0x64, 0x73, 0x22, 0xda,
-	0x02, 0x0a, 0x25, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41,
-	0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65,
-	0x73, 0x73, 0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32,
-	0x3e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65,
-	0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73,
-	0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x41, 0x63,
-	0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52,
-	0x0c, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x50, 0x0a,
-	0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e,
+	0x01, 0x28, 0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x22, 0xb2, 0x01, 0x0a, 0x1b,
+	0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
+	0x69, 0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x40, 0x0a, 0x10, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x5f, 0x6d, 0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x18,
+	0x01, 0x20, 0x01, 0x28, 0x0b, 0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4d, 0x43,
+	0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x0e, 0x63,
+	0x6f, 0x64, 0x65, 0x72, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x51, 0x0a,
+	0x19, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e, 0x61, 0x6c, 0x5f, 0x61, 0x75, 0x74, 0x68, 0x5f, 0x6d,
+	0x63, 0x70, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b,
+	0x32, 0x16, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76,
+	0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x52, 0x16, 0x65, 0x78, 0x74, 0x65, 0x72, 0x6e,
+	0x61, 0x6c, 0x41, 0x75, 0x74, 0x68, 0x4d, 0x63, 0x70, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73,
+	0x22, 0x85, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x12, 0x0e, 0x0a, 0x02, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x02, 0x69, 0x64, 0x12, 0x10, 0x0a, 0x03, 0x75, 0x72, 0x6c, 0x18, 0x02, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x03, 0x75, 0x72, 0x6c, 0x12, 0x28, 0x0a, 0x10, 0x74, 0x6f, 0x6f, 0x6c, 0x5f, 0x61,
+	0x6c, 0x6c, 0x6f, 0x77, 0x5f, 0x72, 0x65, 0x67, 0x65, 0x78, 0x18, 0x03, 0x20, 0x01, 0x28, 0x09,
+	0x52, 0x0e, 0x74, 0x6f, 0x6f, 0x6c, 0x41, 0x6c, 0x6c, 0x6f, 0x77, 0x52, 0x65, 0x67, 0x65, 0x78,
+	0x12, 0x26, 0x0a, 0x0f, 0x74, 0x6f, 0x6f, 0x6c, 0x5f, 0x64, 0x65, 0x6e, 0x79, 0x5f, 0x72, 0x65,
+	0x67, 0x65, 0x78, 0x18, 0x04, 0x20, 0x01, 0x28, 0x09, 0x52, 0x0d, 0x74, 0x6f, 0x6f, 0x6c, 0x44,
+	0x65, 0x6e, 0x79, 0x52, 0x65, 0x67, 0x65, 0x78, 0x22, 0x72, 0x0a, 0x24, 0x47, 0x65, 0x74, 0x4d,
+	0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
+	0x12, 0x17, 0x0a, 0x07, 0x75, 0x73, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28,
+	0x09, 0x52, 0x06, 0x75, 0x73, 0x65, 0x72, 0x49, 0x64, 0x12, 0x31, 0x0a, 0x15, 0x6d, 0x63, 0x70,
+	0x5f, 0x73, 0x65, 0x72, 0x76, 0x65, 0x72, 0x5f, 0x63, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x5f, 0x69,
+	0x64, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x09, 0x52, 0x12, 0x6d, 0x63, 0x70, 0x53, 0x65, 0x72,
+	0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x49, 0x64, 0x73, 0x22, 0xda, 0x02, 0x0a,
+	0x25, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63,
+	0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x63, 0x0a, 0x0d, 0x61, 0x63, 0x63, 0x65, 0x73, 0x73,
+	0x5f, 0x74, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x18, 0x01, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x3e, 0x2e,
 	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76,
 	0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61,
-	0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x6f,
-	0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x1a,
-	0x3f, 0x0a, 0x11, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45,
-	0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28,
-	0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18,
-	0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01,
-	0x1a, 0x39, 0x0a, 0x0b, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12,
-	0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65,
-	0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09,
-	0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x27, 0x0a, 0x13, 0x49,
-	0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65,
-	0x73, 0x74, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x03, 0x6b, 0x65, 0x79, 0x22, 0x31, 0x0a, 0x14, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08,
-	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07,
-	0x6f, 0x77, 0x6e, 0x65, 0x72, 0x49, 0x64, 0x32, 0xce, 0x03, 0x0a, 0x08, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x65, 0x72, 0x12, 0x59, 0x0a, 0x12, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e,
-	0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70,
-	0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72,
-	0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12,
-	0x68, 0x0a, 0x17, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x12, 0x25, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
-	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73,
-	0x74, 0x1a, 0x26, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65,
-	0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x53, 0x0a, 0x10, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1e, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e,
-	0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65,
-	0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x56,
-	0x0a, 0x11, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73,
-	0x61, 0x67, 0x65, 0x12, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f,
-	0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71,
-	0x75, 0x65, 0x73, 0x74, 0x1a, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63,
-	0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x50, 0x0a, 0x0f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
-	0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67,
-	0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65,
-	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xeb, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50,
-	0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x5c, 0x0a, 0x13,
-	0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66,
-	0x69, 0x67, 0x73, 0x12, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d,
-	0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52,
-	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47,
-	0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69,
-	0x67, 0x73, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7a, 0x0a, 0x1d, 0x47, 0x65,
-	0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73,
-	0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x12, 0x2b, 0x2e, 0x70, 0x72,
+	0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x41, 0x63, 0x63, 0x65,
+	0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x0c, 0x61,
+	0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x12, 0x50, 0x0a, 0x06, 0x65,
+	0x72, 0x72, 0x6f, 0x72, 0x73, 0x18, 0x02, 0x20, 0x03, 0x28, 0x0b, 0x32, 0x38, 0x2e, 0x70, 0x72,
 	0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72,
 	0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63,
-	0x68, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
-	0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63,
-	0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65,
-	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0x55, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x65, 0x72, 0x12, 0x47, 0x0a, 0x0c, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72,
-	0x69, 0x7a, 0x65, 0x64, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41,
+	0x68, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x2e, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73,
+	0x45, 0x6e, 0x74, 0x72, 0x79, 0x52, 0x06, 0x65, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x1a, 0x3f, 0x0a,
+	0x11, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x45, 0x6e, 0x74,
+	0x72, 0x79, 0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52,
+	0x03, 0x6b, 0x65, 0x79, 0x12, 0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20,
+	0x01, 0x28, 0x09, 0x52, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x1a, 0x39,
+	0x0a, 0x0b, 0x45, 0x72, 0x72, 0x6f, 0x72, 0x73, 0x45, 0x6e, 0x74, 0x72, 0x79, 0x12, 0x10, 0x0a,
+	0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b, 0x65, 0x79, 0x12,
+	0x14, 0x0a, 0x05, 0x76, 0x61, 0x6c, 0x75, 0x65, 0x18, 0x02, 0x20, 0x01, 0x28, 0x09, 0x52, 0x05,
+	0x76, 0x61, 0x6c, 0x75, 0x65, 0x3a, 0x02, 0x38, 0x01, 0x22, 0x27, 0x0a, 0x13, 0x49, 0x73, 0x41,
 	0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74,
-	0x1a, 0x1b, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f,
-	0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x2b, 0x5a,
-	0x29, 0x67, 0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65,
-	0x72, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x61, 0x69, 0x62, 0x72, 0x69,
-	0x64, 0x67, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x12, 0x10, 0x0a, 0x03, 0x6b, 0x65, 0x79, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x03, 0x6b,
+	0x65, 0x79, 0x22, 0x31, 0x0a, 0x14, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x19, 0x0a, 0x08, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x5f, 0x69, 0x64, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x6f, 0x77,
+	0x6e, 0x65, 0x72, 0x49, 0x64, 0x32, 0xce, 0x03, 0x0a, 0x08, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x65, 0x72, 0x12, 0x59, 0x0a, 0x12, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65,
+	0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x12, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x21, 0x2e, 0x70, 0x72, 0x6f,
+	0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65,
+	0x70, 0x74, 0x69, 0x6f, 0x6e, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x68, 0x0a,
+	0x17, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x12, 0x25, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f,
+	0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e, 0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74,
+	0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a,
+	0x26, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x49, 0x6e,
+	0x74, 0x65, 0x72, 0x63, 0x65, 0x70, 0x74, 0x69, 0x6f, 0x6e, 0x45, 0x6e, 0x64, 0x65, 0x64, 0x52,
+	0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x53, 0x0a, 0x10, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1e, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55,
+	0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1f, 0x2e, 0x70, 0x72,
+	0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x55,
+	0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x56, 0x0a, 0x11,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67,
+	0x65, 0x12, 0x1f, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64,
+	0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x71, 0x75, 0x65,
+	0x73, 0x74, 0x1a, 0x20, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52, 0x65, 0x63, 0x6f, 0x72,
+	0x64, 0x50, 0x72, 0x6f, 0x6d, 0x70, 0x74, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x12, 0x50, 0x0a, 0x0f, 0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f,
+	0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x12, 0x1d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
+	0x52, 0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1e, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x52,
+	0x65, 0x63, 0x6f, 0x72, 0x64, 0x54, 0x6f, 0x6f, 0x6c, 0x55, 0x73, 0x61, 0x67, 0x65, 0x52, 0x65,
+	0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x32, 0xeb, 0x01, 0x0a, 0x0f, 0x4d, 0x43, 0x50, 0x43, 0x6f,
+	0x6e, 0x66, 0x69, 0x67, 0x75, 0x72, 0x61, 0x74, 0x6f, 0x72, 0x12, 0x5c, 0x0a, 0x13, 0x47, 0x65,
+	0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
+	0x73, 0x12, 0x21, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50,
+	0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73, 0x52, 0x65, 0x71,
+	0x75, 0x65, 0x73, 0x74, 0x1a, 0x22, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47, 0x65, 0x74,
+	0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x73,
+	0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x12, 0x7a, 0x0a, 0x1d, 0x47, 0x65, 0x74, 0x4d,
+	0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73, 0x73, 0x54, 0x6f,
+	0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x12, 0x2b, 0x2e, 0x70, 0x72, 0x6f, 0x74,
+	0x6f, 0x2e, 0x47, 0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63,
+	0x63, 0x65, 0x73, 0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52,
+	0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x2c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x47,
+	0x65, 0x74, 0x4d, 0x43, 0x50, 0x53, 0x65, 0x72, 0x76, 0x65, 0x72, 0x41, 0x63, 0x63, 0x65, 0x73,
+	0x73, 0x54, 0x6f, 0x6b, 0x65, 0x6e, 0x73, 0x42, 0x61, 0x74, 0x63, 0x68, 0x52, 0x65, 0x73, 0x70,
+	0x6f, 0x6e, 0x73, 0x65, 0x32, 0x55, 0x0a, 0x0a, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x72, 0x12, 0x47, 0x0a, 0x0c, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69, 0x7a,
+	0x65, 0x64, 0x12, 0x1a, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74,
+	0x68, 0x6f, 0x72, 0x69, 0x7a, 0x65, 0x64, 0x52, 0x65, 0x71, 0x75, 0x65, 0x73, 0x74, 0x1a, 0x1b,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x49, 0x73, 0x41, 0x75, 0x74, 0x68, 0x6f, 0x72, 0x69,
+	0x7a, 0x65, 0x64, 0x52, 0x65, 0x73, 0x70, 0x6f, 0x6e, 0x73, 0x65, 0x42, 0x2b, 0x5a, 0x29, 0x67,
+	0x69, 0x74, 0x68, 0x75, 0x62, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f,
+	0x63, 0x6f, 0x64, 0x65, 0x72, 0x2f, 0x76, 0x32, 0x2f, 0x61, 0x69, 0x62, 0x72, 0x69, 0x64, 0x67,
+	0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
-	file_enterprise_x_aibridged_proto_aibridged_proto_rawDescOnce sync.Once
-	file_enterprise_x_aibridged_proto_aibridged_proto_rawDescData = file_enterprise_x_aibridged_proto_aibridged_proto_rawDesc
+	file_enterprise_aibridged_proto_aibridged_proto_rawDescOnce sync.Once
+	file_enterprise_aibridged_proto_aibridged_proto_rawDescData = file_enterprise_aibridged_proto_aibridged_proto_rawDesc
 )
 
-func file_enterprise_x_aibridged_proto_aibridged_proto_rawDescGZIP() []byte {
-	file_enterprise_x_aibridged_proto_aibridged_proto_rawDescOnce.Do(func() {
-		file_enterprise_x_aibridged_proto_aibridged_proto_rawDescData = protoimpl.X.CompressGZIP(file_enterprise_x_aibridged_proto_aibridged_proto_rawDescData)
+func file_enterprise_aibridged_proto_aibridged_proto_rawDescGZIP() []byte {
+	file_enterprise_aibridged_proto_aibridged_proto_rawDescOnce.Do(func() {
+		file_enterprise_aibridged_proto_aibridged_proto_rawDescData = protoimpl.X.CompressGZIP(file_enterprise_aibridged_proto_aibridged_proto_rawDescData)
 	})
-	return file_enterprise_x_aibridged_proto_aibridged_proto_rawDescData
+	return file_enterprise_aibridged_proto_aibridged_proto_rawDescData
 }
 
-var file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
-var file_enterprise_x_aibridged_proto_aibridged_proto_goTypes = []interface{}{
+var file_enterprise_aibridged_proto_aibridged_proto_msgTypes = make([]protoimpl.MessageInfo, 23)
+var file_enterprise_aibridged_proto_aibridged_proto_goTypes = []interface{}{
 	(*RecordInterceptionRequest)(nil),             // 0: proto.RecordInterceptionRequest
 	(*RecordInterceptionResponse)(nil),            // 1: proto.RecordInterceptionResponse
 	(*RecordInterceptionEndedRequest)(nil),        // 2: proto.RecordInterceptionEndedRequest
@@ -1287,7 +1286,7 @@ var file_enterprise_x_aibridged_proto_aibridged_proto_goTypes = []interface{}{
 	(*timestamppb.Timestamp)(nil),                 // 23: google.protobuf.Timestamp
 	(*anypb.Any)(nil),                             // 24: google.protobuf.Any
 }
-var file_enterprise_x_aibridged_proto_aibridged_proto_depIdxs = []int32{
+var file_enterprise_aibridged_proto_aibridged_proto_depIdxs = []int32{
 	17, // 0: proto.RecordInterceptionRequest.metadata:type_name -> proto.RecordInterceptionRequest.MetadataEntry
 	23, // 1: proto.RecordInterceptionRequest.started_at:type_name -> google.protobuf.Timestamp
 	23, // 2: proto.RecordInterceptionEndedRequest.ended_at:type_name -> google.protobuf.Timestamp
@@ -1328,13 +1327,13 @@ var file_enterprise_x_aibridged_proto_aibridged_proto_depIdxs = []int32{
 	0,  // [0:17] is the sub-list for field type_name
 }
 
-func init() { file_enterprise_x_aibridged_proto_aibridged_proto_init() }
-func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
-	if File_enterprise_x_aibridged_proto_aibridged_proto != nil {
+func init() { file_enterprise_aibridged_proto_aibridged_proto_init() }
+func file_enterprise_aibridged_proto_aibridged_proto_init() {
+	if File_enterprise_aibridged_proto_aibridged_proto != nil {
 		return
 	}
 	if !protoimpl.UnsafeEnabled {
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[0].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordInterceptionRequest); i {
 			case 0:
 				return &v.state
@@ -1346,7 +1345,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[1].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordInterceptionResponse); i {
 			case 0:
 				return &v.state
@@ -1358,7 +1357,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[2].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordInterceptionEndedRequest); i {
 			case 0:
 				return &v.state
@@ -1370,7 +1369,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[3].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordInterceptionEndedResponse); i {
 			case 0:
 				return &v.state
@@ -1382,7 +1381,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[4].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordTokenUsageRequest); i {
 			case 0:
 				return &v.state
@@ -1394,7 +1393,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[5].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordTokenUsageResponse); i {
 			case 0:
 				return &v.state
@@ -1406,7 +1405,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[6].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordPromptUsageRequest); i {
 			case 0:
 				return &v.state
@@ -1418,7 +1417,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[7].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordPromptUsageResponse); i {
 			case 0:
 				return &v.state
@@ -1430,7 +1429,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[8].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordToolUsageRequest); i {
 			case 0:
 				return &v.state
@@ -1442,7 +1441,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[9].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*RecordToolUsageResponse); i {
 			case 0:
 				return &v.state
@@ -1454,7 +1453,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[10].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetMCPServerConfigsRequest); i {
 			case 0:
 				return &v.state
@@ -1466,7 +1465,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[11].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetMCPServerConfigsResponse); i {
 			case 0:
 				return &v.state
@@ -1478,7 +1477,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[12].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*MCPServerConfig); i {
 			case 0:
 				return &v.state
@@ -1490,7 +1489,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[13].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetMCPServerAccessTokensBatchRequest); i {
 			case 0:
 				return &v.state
@@ -1502,7 +1501,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[14].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*GetMCPServerAccessTokensBatchResponse); i {
 			case 0:
 				return &v.state
@@ -1514,7 +1513,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[15].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*IsAuthorizedRequest); i {
 			case 0:
 				return &v.state
@@ -1526,7 +1525,7 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 				return nil
 			}
 		}
-		file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
+		file_enterprise_aibridged_proto_aibridged_proto_msgTypes[16].Exporter = func(v interface{}, i int) interface{} {
 			switch v := v.(*IsAuthorizedResponse); i {
 			case 0:
 				return &v.state
@@ -1539,23 +1538,23 @@ func file_enterprise_x_aibridged_proto_aibridged_proto_init() {
 			}
 		}
 	}
-	file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes[8].OneofWrappers = []interface{}{}
+	file_enterprise_aibridged_proto_aibridged_proto_msgTypes[8].OneofWrappers = []interface{}{}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{
 			GoPackagePath: reflect.TypeOf(x{}).PkgPath(),
-			RawDescriptor: file_enterprise_x_aibridged_proto_aibridged_proto_rawDesc,
+			RawDescriptor: file_enterprise_aibridged_proto_aibridged_proto_rawDesc,
 			NumEnums:      0,
 			NumMessages:   23,
 			NumExtensions: 0,
 			NumServices:   3,
 		},
-		GoTypes:           file_enterprise_x_aibridged_proto_aibridged_proto_goTypes,
-		DependencyIndexes: file_enterprise_x_aibridged_proto_aibridged_proto_depIdxs,
-		MessageInfos:      file_enterprise_x_aibridged_proto_aibridged_proto_msgTypes,
+		GoTypes:           file_enterprise_aibridged_proto_aibridged_proto_goTypes,
+		DependencyIndexes: file_enterprise_aibridged_proto_aibridged_proto_depIdxs,
+		MessageInfos:      file_enterprise_aibridged_proto_aibridged_proto_msgTypes,
 	}.Build()
-	File_enterprise_x_aibridged_proto_aibridged_proto = out.File
-	file_enterprise_x_aibridged_proto_aibridged_proto_rawDesc = nil
-	file_enterprise_x_aibridged_proto_aibridged_proto_goTypes = nil
-	file_enterprise_x_aibridged_proto_aibridged_proto_depIdxs = nil
+	File_enterprise_aibridged_proto_aibridged_proto = out.File
+	file_enterprise_aibridged_proto_aibridged_proto_rawDesc = nil
+	file_enterprise_aibridged_proto_aibridged_proto_goTypes = nil
+	file_enterprise_aibridged_proto_aibridged_proto_depIdxs = nil
 }
diff --git a/enterprise/x/aibridged/proto/aibridged.proto b/enterprise/aibridged/proto/aibridged.proto
similarity index 100%
rename from enterprise/x/aibridged/proto/aibridged.proto
rename to enterprise/aibridged/proto/aibridged.proto
diff --git a/enterprise/x/aibridged/proto/aibridged_drpc.pb.go b/enterprise/aibridged/proto/aibridged_drpc.pb.go
similarity index 84%
rename from enterprise/x/aibridged/proto/aibridged_drpc.pb.go
rename to enterprise/aibridged/proto/aibridged_drpc.pb.go
index 4c7cb3c190764..1309957d153d5 100644
--- a/enterprise/x/aibridged/proto/aibridged_drpc.pb.go
+++ b/enterprise/aibridged/proto/aibridged_drpc.pb.go
@@ -1,6 +1,6 @@
 // Code generated by protoc-gen-go-drpc. DO NOT EDIT.
 // protoc-gen-go-drpc version: v0.0.34
-// source: enterprise/x/aibridged/proto/aibridged.proto
+// source: enterprise/aibridged/proto/aibridged.proto
 
 package proto
 
@@ -13,25 +13,25 @@ import (
 	drpcerr "storj.io/drpc/drpcerr"
 )
 
-type drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto struct{}
+type drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto struct{}
 
-func (drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto) Marshal(msg drpc.Message) ([]byte, error) {
+func (drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto) Marshal(msg drpc.Message) ([]byte, error) {
 	return proto.Marshal(msg.(proto.Message))
 }
 
-func (drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto) MarshalAppend(buf []byte, msg drpc.Message) ([]byte, error) {
+func (drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto) MarshalAppend(buf []byte, msg drpc.Message) ([]byte, error) {
 	return proto.MarshalOptions{}.MarshalAppend(buf, msg.(proto.Message))
 }
 
-func (drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto) Unmarshal(buf []byte, msg drpc.Message) error {
+func (drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto) Unmarshal(buf []byte, msg drpc.Message) error {
 	return proto.Unmarshal(buf, msg.(proto.Message))
 }
 
-func (drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto) JSONMarshal(msg drpc.Message) ([]byte, error) {
+func (drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto) JSONMarshal(msg drpc.Message) ([]byte, error) {
 	return protojson.Marshal(msg.(proto.Message))
 }
 
-func (drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto) JSONUnmarshal(buf []byte, msg drpc.Message) error {
+func (drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto) JSONUnmarshal(buf []byte, msg drpc.Message) error {
 	return protojson.Unmarshal(buf, msg.(proto.Message))
 }
 
@@ -57,7 +57,7 @@ func (c *drpcRecorderClient) DRPCConn() drpc.Conn { return c.cc }
 
 func (c *drpcRecorderClient) RecordInterception(ctx context.Context, in *RecordInterceptionRequest) (*RecordInterceptionResponse, error) {
 	out := new(RecordInterceptionResponse)
-	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordInterception", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordInterception", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -66,7 +66,7 @@ func (c *drpcRecorderClient) RecordInterception(ctx context.Context, in *RecordI
 
 func (c *drpcRecorderClient) RecordInterceptionEnded(ctx context.Context, in *RecordInterceptionEndedRequest) (*RecordInterceptionEndedResponse, error) {
 	out := new(RecordInterceptionEndedResponse)
-	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordInterceptionEnded", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordInterceptionEnded", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -75,7 +75,7 @@ func (c *drpcRecorderClient) RecordInterceptionEnded(ctx context.Context, in *Re
 
 func (c *drpcRecorderClient) RecordTokenUsage(ctx context.Context, in *RecordTokenUsageRequest) (*RecordTokenUsageResponse, error) {
 	out := new(RecordTokenUsageResponse)
-	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordTokenUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordTokenUsage", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -84,7 +84,7 @@ func (c *drpcRecorderClient) RecordTokenUsage(ctx context.Context, in *RecordTok
 
 func (c *drpcRecorderClient) RecordPromptUsage(ctx context.Context, in *RecordPromptUsageRequest) (*RecordPromptUsageResponse, error) {
 	out := new(RecordPromptUsageResponse)
-	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordPromptUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordPromptUsage", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -93,7 +93,7 @@ func (c *drpcRecorderClient) RecordPromptUsage(ctx context.Context, in *RecordPr
 
 func (c *drpcRecorderClient) RecordToolUsage(ctx context.Context, in *RecordToolUsageRequest) (*RecordToolUsageResponse, error) {
 	out := new(RecordToolUsageResponse)
-	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordToolUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.Recorder/RecordToolUsage", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -137,7 +137,7 @@ func (DRPCRecorderDescription) NumMethods() int { return 5 }
 func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
 	case 0:
-		return "/proto.Recorder/RecordInterception", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.Recorder/RecordInterception", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
 					RecordInterception(
@@ -146,7 +146,7 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 					)
 			}, DRPCRecorderServer.RecordInterception, true
 	case 1:
-		return "/proto.Recorder/RecordInterceptionEnded", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.Recorder/RecordInterceptionEnded", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
 					RecordInterceptionEnded(
@@ -155,7 +155,7 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 					)
 			}, DRPCRecorderServer.RecordInterceptionEnded, true
 	case 2:
-		return "/proto.Recorder/RecordTokenUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.Recorder/RecordTokenUsage", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
 					RecordTokenUsage(
@@ -164,7 +164,7 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 					)
 			}, DRPCRecorderServer.RecordTokenUsage, true
 	case 3:
-		return "/proto.Recorder/RecordPromptUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.Recorder/RecordPromptUsage", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
 					RecordPromptUsage(
@@ -173,7 +173,7 @@ func (DRPCRecorderDescription) Method(n int) (string, drpc.Encoding, drpc.Receiv
 					)
 			}, DRPCRecorderServer.RecordPromptUsage, true
 	case 4:
-		return "/proto.Recorder/RecordToolUsage", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.Recorder/RecordToolUsage", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCRecorderServer).
 					RecordToolUsage(
@@ -200,7 +200,7 @@ type drpcRecorder_RecordInterceptionStream struct {
 }
 
 func (x *drpcRecorder_RecordInterceptionStream) SendAndClose(m *RecordInterceptionResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -216,7 +216,7 @@ type drpcRecorder_RecordInterceptionEndedStream struct {
 }
 
 func (x *drpcRecorder_RecordInterceptionEndedStream) SendAndClose(m *RecordInterceptionEndedResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -232,7 +232,7 @@ type drpcRecorder_RecordTokenUsageStream struct {
 }
 
 func (x *drpcRecorder_RecordTokenUsageStream) SendAndClose(m *RecordTokenUsageResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -248,7 +248,7 @@ type drpcRecorder_RecordPromptUsageStream struct {
 }
 
 func (x *drpcRecorder_RecordPromptUsageStream) SendAndClose(m *RecordPromptUsageResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -264,7 +264,7 @@ type drpcRecorder_RecordToolUsageStream struct {
 }
 
 func (x *drpcRecorder_RecordToolUsageStream) SendAndClose(m *RecordToolUsageResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -289,7 +289,7 @@ func (c *drpcMCPConfiguratorClient) DRPCConn() drpc.Conn { return c.cc }
 
 func (c *drpcMCPConfiguratorClient) GetMCPServerConfigs(ctx context.Context, in *GetMCPServerConfigsRequest) (*GetMCPServerConfigsResponse, error) {
 	out := new(GetMCPServerConfigsResponse)
-	err := c.cc.Invoke(ctx, "/proto.MCPConfigurator/GetMCPServerConfigs", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.MCPConfigurator/GetMCPServerConfigs", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -298,7 +298,7 @@ func (c *drpcMCPConfiguratorClient) GetMCPServerConfigs(ctx context.Context, in
 
 func (c *drpcMCPConfiguratorClient) GetMCPServerAccessTokensBatch(ctx context.Context, in *GetMCPServerAccessTokensBatchRequest) (*GetMCPServerAccessTokensBatchResponse, error) {
 	out := new(GetMCPServerAccessTokensBatchResponse)
-	err := c.cc.Invoke(ctx, "/proto.MCPConfigurator/GetMCPServerAccessTokensBatch", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.MCPConfigurator/GetMCPServerAccessTokensBatch", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -327,7 +327,7 @@ func (DRPCMCPConfiguratorDescription) NumMethods() int { return 2 }
 func (DRPCMCPConfiguratorDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
 	case 0:
-		return "/proto.MCPConfigurator/GetMCPServerConfigs", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.MCPConfigurator/GetMCPServerConfigs", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCMCPConfiguratorServer).
 					GetMCPServerConfigs(
@@ -336,7 +336,7 @@ func (DRPCMCPConfiguratorDescription) Method(n int) (string, drpc.Encoding, drpc
 					)
 			}, DRPCMCPConfiguratorServer.GetMCPServerConfigs, true
 	case 1:
-		return "/proto.MCPConfigurator/GetMCPServerAccessTokensBatch", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.MCPConfigurator/GetMCPServerAccessTokensBatch", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCMCPConfiguratorServer).
 					GetMCPServerAccessTokensBatch(
@@ -363,7 +363,7 @@ type drpcMCPConfigurator_GetMCPServerConfigsStream struct {
 }
 
 func (x *drpcMCPConfigurator_GetMCPServerConfigsStream) SendAndClose(m *GetMCPServerConfigsResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -379,7 +379,7 @@ type drpcMCPConfigurator_GetMCPServerAccessTokensBatchStream struct {
 }
 
 func (x *drpcMCPConfigurator_GetMCPServerAccessTokensBatchStream) SendAndClose(m *GetMCPServerAccessTokensBatchResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
@@ -403,7 +403,7 @@ func (c *drpcAuthorizerClient) DRPCConn() drpc.Conn { return c.cc }
 
 func (c *drpcAuthorizerClient) IsAuthorized(ctx context.Context, in *IsAuthorizedRequest) (*IsAuthorizedResponse, error) {
 	out := new(IsAuthorizedResponse)
-	err := c.cc.Invoke(ctx, "/proto.Authorizer/IsAuthorized", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}, in, out)
+	err := c.cc.Invoke(ctx, "/proto.Authorizer/IsAuthorized", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}, in, out)
 	if err != nil {
 		return nil, err
 	}
@@ -427,7 +427,7 @@ func (DRPCAuthorizerDescription) NumMethods() int { return 1 }
 func (DRPCAuthorizerDescription) Method(n int) (string, drpc.Encoding, drpc.Receiver, interface{}, bool) {
 	switch n {
 	case 0:
-		return "/proto.Authorizer/IsAuthorized", drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{},
+		return "/proto.Authorizer/IsAuthorized", drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{},
 			func(srv interface{}, ctx context.Context, in1, in2 interface{}) (drpc.Message, error) {
 				return srv.(DRPCAuthorizerServer).
 					IsAuthorized(
@@ -454,7 +454,7 @@ type drpcAuthorizer_IsAuthorizedStream struct {
 }
 
 func (x *drpcAuthorizer_IsAuthorizedStream) SendAndClose(m *IsAuthorizedResponse) error {
-	if err := x.MsgSend(m, drpcEncoding_File_enterprise_x_aibridged_proto_aibridged_proto{}); err != nil {
+	if err := x.MsgSend(m, drpcEncoding_File_enterprise_aibridged_proto_aibridged_proto{}); err != nil {
 		return err
 	}
 	return x.CloseSend()
diff --git a/enterprise/x/aibridged/request.go b/enterprise/aibridged/request.go
similarity index 100%
rename from enterprise/x/aibridged/request.go
rename to enterprise/aibridged/request.go
diff --git a/enterprise/x/aibridged/server.go b/enterprise/aibridged/server.go
similarity index 68%
rename from enterprise/x/aibridged/server.go
rename to enterprise/aibridged/server.go
index 713ea2a0cd126..052c94dad4a9e 100644
--- a/enterprise/x/aibridged/server.go
+++ b/enterprise/aibridged/server.go
@@ -1,6 +1,6 @@
 package aibridged
 
-import "github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+import "github.com/coder/coder/v2/enterprise/aibridged/proto"
 
 type DRPCServer interface {
 	proto.DRPCRecorderServer
diff --git a/enterprise/x/aibridged/translator.go b/enterprise/aibridged/translator.go
similarity index 98%
rename from enterprise/x/aibridged/translator.go
rename to enterprise/aibridged/translator.go
index bfc39d834ad2c..f36185715a745 100644
--- a/enterprise/x/aibridged/translator.go
+++ b/enterprise/aibridged/translator.go
@@ -11,7 +11,7 @@ import (
 	"google.golang.org/protobuf/types/known/timestamppb"
 
 	"github.com/coder/coder/v2/coderd/util/ptr"
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 
 	"github.com/coder/aibridge"
 )
diff --git a/enterprise/x/aibridged/utils_test.go b/enterprise/aibridged/utils_test.go
similarity index 100%
rename from enterprise/x/aibridged/utils_test.go
rename to enterprise/aibridged/utils_test.go
diff --git a/enterprise/x/aibridgedserver/aibridgedserver.go b/enterprise/aibridgedserver/aibridgedserver.go
similarity index 99%
rename from enterprise/x/aibridgedserver/aibridgedserver.go
rename to enterprise/aibridgedserver/aibridgedserver.go
index 2c5e3ff71c072..6adf7b793c1d2 100644
--- a/enterprise/x/aibridgedserver/aibridgedserver.go
+++ b/enterprise/aibridgedserver/aibridgedserver.go
@@ -24,8 +24,8 @@ import (
 	"github.com/coder/coder/v2/coderd/httpmw"
 	codermcp "github.com/coder/coder/v2/coderd/mcp"
 	"github.com/coder/coder/v2/codersdk"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridged"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
 )
 
 var (
diff --git a/enterprise/x/aibridgedserver/aibridgedserver_internal_test.go b/enterprise/aibridgedserver/aibridgedserver_internal_test.go
similarity index 100%
rename from enterprise/x/aibridgedserver/aibridgedserver_internal_test.go
rename to enterprise/aibridgedserver/aibridgedserver_internal_test.go
diff --git a/enterprise/x/aibridgedserver/aibridgedserver_test.go b/enterprise/aibridgedserver/aibridgedserver_test.go
similarity index 99%
rename from enterprise/x/aibridgedserver/aibridgedserver_test.go
rename to enterprise/aibridgedserver/aibridgedserver_test.go
index 4f9f892bc886a..27598c79857f1 100644
--- a/enterprise/x/aibridgedserver/aibridgedserver_test.go
+++ b/enterprise/aibridgedserver/aibridgedserver_test.go
@@ -28,9 +28,9 @@ import (
 	codermcp "github.com/coder/coder/v2/coderd/mcp"
 	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/cryptorand"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
-	"github.com/coder/coder/v2/enterprise/x/aibridged/proto"
-	"github.com/coder/coder/v2/enterprise/x/aibridgedserver"
+	"github.com/coder/coder/v2/enterprise/aibridged"
+	"github.com/coder/coder/v2/enterprise/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridgedserver"
 	"github.com/coder/coder/v2/testutil"
 )
 
diff --git a/enterprise/cli/exp_aibridge.go b/enterprise/cli/aibridge.go
similarity index 97%
rename from enterprise/cli/exp_aibridge.go
rename to enterprise/cli/aibridge.go
index 722f7bf239223..90953b6aa2bf2 100644
--- a/enterprise/cli/exp_aibridge.go
+++ b/enterprise/cli/aibridge.go
@@ -134,8 +134,7 @@ func (r *RootCmd) aibridgeInterceptionsList() *serpent.Command {
 				return xerrors.Errorf("limit value must be between 1 and %d", maxInterceptionsLimit)
 			}
 
-			expCli := codersdk.NewExperimentalClient(client)
-			resp, err := expCli.AIBridgeListInterceptions(inv.Context(), codersdk.AIBridgeListInterceptionsFilter{
+			resp, err := client.AIBridgeListInterceptions(inv.Context(), codersdk.AIBridgeListInterceptionsFilter{
 				Pagination: codersdk.Pagination{
 					AfterID: afterID,
 					// #nosec G115 - Checked above.
diff --git a/enterprise/cli/exp_aibridge_test.go b/enterprise/cli/aibridge_test.go
similarity index 96%
rename from enterprise/cli/exp_aibridge_test.go
rename to enterprise/cli/aibridge_test.go
index 466d6b3df8246..a5b48a14e1c38 100644
--- a/enterprise/cli/exp_aibridge_test.go
+++ b/enterprise/cli/aibridge_test.go
@@ -27,7 +27,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		t.Parallel()
 
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, db, owner := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -55,7 +54,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		}, nil)
 
 		args := []string{
-			"exp",
 			"aibridge",
 			"interceptions",
 			"list",
@@ -78,7 +76,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		t.Parallel()
 
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, db, owner := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -137,7 +134,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		}, nil)
 
 		args := []string{
-			"exp",
 			"aibridge",
 			"interceptions",
 			"list",
@@ -164,7 +160,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		t.Parallel()
 
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, db, owner := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -192,7 +187,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		}, nil)
 
 		args := []string{
-			"exp",
 			"aibridge",
 			"interceptions",
 			"list",
diff --git a/enterprise/cli/aibridged.go b/enterprise/cli/aibridged.go
index 17bb5ebe681fa..b2dc3d7725b93 100644
--- a/enterprise/cli/aibridged.go
+++ b/enterprise/cli/aibridged.go
@@ -9,8 +9,8 @@ import (
 
 	"github.com/coder/aibridge"
 	"github.com/coder/coder/v2/codersdk"
+	"github.com/coder/coder/v2/enterprise/aibridged"
 	"github.com/coder/coder/v2/enterprise/coderd"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
 )
 
 func newAIBridgeDaemon(coderAPI *coderd.API) (*aibridged.Server, error) {
diff --git a/enterprise/cli/root.go b/enterprise/cli/root.go
index 3cec11970369e..78858ef48da7b 100644
--- a/enterprise/cli/root.go
+++ b/enterprise/cli/root.go
@@ -25,13 +25,12 @@ func (r *RootCmd) enterpriseOnly() []*serpent.Command {
 		r.prebuilds(),
 		r.provisionerd(),
 		r.externalWorkspaces(),
+		r.aibridge(),
 	}
 }
 
-func (r *RootCmd) enterpriseExperimental() []*serpent.Command {
-	return []*serpent.Command{
-		r.aibridge(),
-	}
+func (*RootCmd) enterpriseExperimental() []*serpent.Command {
+	return []*serpent.Command{}
 }
 
 func (r *RootCmd) EnterpriseSubcommands() []*serpent.Command {
diff --git a/enterprise/cli/server.go b/enterprise/cli/server.go
index ea9f2d3e93825..bc77bc54ba522 100644
--- a/enterprise/cli/server.go
+++ b/enterprise/cli/server.go
@@ -7,7 +7,6 @@ import (
 	"database/sql"
 	"encoding/base64"
 	"errors"
-	"fmt"
 	"io"
 	"net/url"
 
@@ -16,8 +15,8 @@ import (
 	"tailscale.com/types/key"
 
 	"github.com/coder/coder/v2/coderd/database"
-	"github.com/coder/coder/v2/codersdk"
 	"github.com/coder/coder/v2/cryptorand"
+	"github.com/coder/coder/v2/enterprise/aibridged"
 	"github.com/coder/coder/v2/enterprise/audit"
 	"github.com/coder/coder/v2/enterprise/audit/backends"
 	"github.com/coder/coder/v2/enterprise/coderd"
@@ -25,7 +24,6 @@ import (
 	"github.com/coder/coder/v2/enterprise/coderd/usage"
 	"github.com/coder/coder/v2/enterprise/dbcrypt"
 	"github.com/coder/coder/v2/enterprise/trialer"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
 	"github.com/coder/coder/v2/tailnet"
 	"github.com/coder/quartz"
 	"github.com/coder/serpent"
@@ -146,8 +144,6 @@ func (r *RootCmd) Server(_ func()) *serpent.Command {
 		}
 		closers.Add(publisher)
 
-		experiments := agplcoderd.ReadExperiments(options.Logger, options.DeploymentValues.Experiments.Value())
-
 		// In-memory aibridge daemon.
 		// TODO(@deansheather): the lifecycle of the aibridged server is
 		// probably better managed by the enterprise API type itself. Managing
@@ -155,26 +151,18 @@ func (r *RootCmd) Server(_ func()) *serpent.Command {
 		// is not entitled to the feature.
 		var aibridgeDaemon *aibridged.Server
 		if options.DeploymentValues.AI.BridgeConfig.Enabled {
-			if experiments.Enabled(codersdk.ExperimentAIBridge) {
-				aibridgeDaemon, err = newAIBridgeDaemon(api)
-				if err != nil {
-					return nil, nil, xerrors.Errorf("create aibridged: %w", err)
-				}
+			aibridgeDaemon, err = newAIBridgeDaemon(api)
+			if err != nil {
+				return nil, nil, xerrors.Errorf("create aibridged: %w", err)
+			}
 
-				api.RegisterInMemoryAIBridgedHTTPHandler(aibridgeDaemon)
+			api.RegisterInMemoryAIBridgedHTTPHandler(aibridgeDaemon)
 
-				// When running as an in-memory daemon, the HTTP handler is wired into the
-				// coderd API and therefore is subject to its context. Calling Close() on
-				// aibridged will NOT affect in-flight requests but those will be closed once
-				// the API server is itself shutdown.
-				closers.Add(aibridgeDaemon)
-			} else {
-				api.Logger.Warn(ctx, fmt.Sprintf("CODER_AIBRIDGE_ENABLED=true but experiment %q not enabled", codersdk.ExperimentAIBridge))
-			}
-		} else {
-			if experiments.Enabled(codersdk.ExperimentAIBridge) {
-				api.Logger.Warn(ctx, "aibridge experiment enabled but CODER_AIBRIDGE_ENABLED=false")
-			}
+			// When running as an in-memory daemon, the HTTP handler is wired into the
+			// coderd API and therefore is subject to its context. Calling Close() on
+			// aibridged will NOT affect in-flight requests but those will be closed once
+			// the API server is itself shutdown.
+			closers.Add(aibridgeDaemon)
 		}
 
 		return api.AGPL, closers, nil
diff --git a/enterprise/cli/testdata/coder_--help.golden b/enterprise/cli/testdata/coder_--help.golden
index ddb44f78ae524..8424ccac923a2 100644
--- a/enterprise/cli/testdata/coder_--help.golden
+++ b/enterprise/cli/testdata/coder_--help.golden
@@ -14,6 +14,7 @@ USAGE:
        $ coder templates init
 
 SUBCOMMANDS:
+    aibridge               Manage AIBridge.
     external-workspaces    Create or manage external workspaces
     features               List Enterprise features
     groups                 Manage groups
diff --git a/enterprise/cli/testdata/coder_aibridge_--help.golden b/enterprise/cli/testdata/coder_aibridge_--help.golden
new file mode 100644
index 0000000000000..d005ae429ad50
--- /dev/null
+++ b/enterprise/cli/testdata/coder_aibridge_--help.golden
@@ -0,0 +1,12 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder aibridge
+
+  Manage AIBridge.
+
+SUBCOMMANDS:
+    interceptions    Manage AIBridge interceptions.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_aibridge_interceptions_--help.golden b/enterprise/cli/testdata/coder_aibridge_interceptions_--help.golden
new file mode 100644
index 0000000000000..1f3b3af5ad3d3
--- /dev/null
+++ b/enterprise/cli/testdata/coder_aibridge_interceptions_--help.golden
@@ -0,0 +1,12 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder aibridge interceptions
+
+  Manage AIBridge interceptions.
+
+SUBCOMMANDS:
+    list    List AIBridge interceptions as JSON.
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_aibridge_interceptions_list_--help.golden b/enterprise/cli/testdata/coder_aibridge_interceptions_list_--help.golden
new file mode 100644
index 0000000000000..c98fd0019a45a
--- /dev/null
+++ b/enterprise/cli/testdata/coder_aibridge_interceptions_list_--help.golden
@@ -0,0 +1,37 @@
+coder v0.0.0-devel
+
+USAGE:
+  coder aibridge interceptions list [flags]
+
+  List AIBridge interceptions as JSON.
+
+OPTIONS:
+      --after-id string
+          The ID of the last result on the previous page to use as a pagination
+          cursor.
+
+      --initiator string
+          Only return interceptions initiated by this user. Accepts a user ID,
+          username, or "me".
+
+      --limit int (default: 100)
+          The limit of results to return. Must be between 1 and 1000.
+
+      --model string
+          Only return interceptions from this model.
+
+      --provider string
+          Only return interceptions from this provider.
+
+      --started-after string
+          Only return interceptions started after this time. Must be before
+          'started-before' if set. Accepts a time in the RFC 3339 format, e.g.
+          "====[timestamp]=====07:00".
+
+      --started-before string
+          Only return interceptions started before this time. Must be after
+          'started-after' if set. Accepts a time in the RFC 3339 format, e.g.
+          "====[timestamp]=====07:00".
+
+———
+Run `coder --help` for a list of global options.
diff --git a/enterprise/cli/testdata/coder_server_--help.golden b/enterprise/cli/testdata/coder_server_--help.golden
index 162d4214ccc6a..492306c55882d 100644
--- a/enterprise/cli/testdata/coder_server_--help.golden
+++ b/enterprise/cli/testdata/coder_server_--help.golden
@@ -81,6 +81,41 @@ OPTIONS:
           Periodically check for new releases of Coder and inform the owner. The
           check is performed once per day.
 
+AIBRIDGE OPTIONS: 
+      --aibridge-anthropic-base-url string, $CODER_AIBRIDGE_ANTHROPIC_BASE_URL (default: https://api.anthropic.com/)
+          The base URL of the Anthropic API.
+
+      --aibridge-anthropic-key string, $CODER_AIBRIDGE_ANTHROPIC_KEY
+          The key to authenticate against the Anthropic API.
+
+      --aibridge-bedrock-access-key string, $CODER_AIBRIDGE_BEDROCK_ACCESS_KEY
+          The access key to authenticate against the AWS Bedrock API.
+
+      --aibridge-bedrock-access-key-secret string, $CODER_AIBRIDGE_BEDROCK_ACCESS_KEY_SECRET
+          The access key secret to use with the access key to authenticate
+          against the AWS Bedrock API.
+
+      --aibridge-bedrock-model string, $CODER_AIBRIDGE_BEDROCK_MODEL (default: global.anthropic.claude-sonnet-4-5-20250929-v1:0)
+          The model to use when making requests to the AWS Bedrock API.
+
+      --aibridge-bedrock-region string, $CODER_AIBRIDGE_BEDROCK_REGION
+          The AWS Bedrock API region.
+
+      --aibridge-bedrock-small-fastmodel string, $CODER_AIBRIDGE_BEDROCK_SMALL_FAST_MODEL (default: global.anthropic.claude-haiku-4-5-20251001-v1:0)
+          The small fast model to use when making requests to the AWS Bedrock
+          API. Claude Code uses Haiku-class models to perform background tasks.
+          See
+          https://docs.claude.com/en/docs/claude-code/settings#environment-variables.
+
+      --aibridge-enabled bool, $CODER_AIBRIDGE_ENABLED (default: false)
+          Whether to start an in-memory aibridged instance.
+
+      --aibridge-openai-base-url string, $CODER_AIBRIDGE_OPENAI_BASE_URL (default: https://api.openai.com/v1/)
+          The base URL of the OpenAI API.
+
+      --aibridge-openai-key string, $CODER_AIBRIDGE_OPENAI_KEY
+          The key to authenticate against the OpenAI API.
+
 CLIENT OPTIONS: 
 These options change the behavior of how clients interact with the Coder.
 Clients include the Coder CLI, Coder Desktop, IDE extensions, and the web UI.
diff --git a/enterprise/coderd/aibridge.go b/enterprise/coderd/aibridge.go
index dab93d8992a79..bdd2a99166910 100644
--- a/enterprise/coderd/aibridge.go
+++ b/enterprise/coderd/aibridge.go
@@ -36,7 +36,7 @@ const (
 // @Param after_id query string false "Cursor pagination after ID (cannot be used with offset)"
 // @Param offset query int false "Offset pagination (cannot be used with after_id)"
 // @Success 200 {object} codersdk.AIBridgeListInterceptionsResponse
-// @Router /api/experimental/aibridge/interceptions [get]
+// @Router /aibridge/interceptions [get]
 func (api *API) aiBridgeListInterceptions(rw http.ResponseWriter, r *http.Request) {
 	ctx := r.Context()
 	apiKey := httpmw.APIKey(r)
diff --git a/enterprise/coderd/aibridge_test.go b/enterprise/coderd/aibridge_test.go
index abaf82dbe85f8..17e5df56fb65d 100644
--- a/enterprise/coderd/aibridge_test.go
+++ b/enterprise/coderd/aibridge_test.go
@@ -27,7 +27,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		t.Parallel()
 
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, _ := coderdenttest.New(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -37,10 +36,10 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				Features: license.Features{},
 			},
 		})
-		experimentalClient := codersdk.NewExperimentalClient(client)
 
 		ctx := testutil.Context(t, testutil.WaitLong)
-		_, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
+		//nolint:gocritic // Owner role is irrelevant here.
+		_, err := client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		var sdkErr *codersdk.Error
 		require.ErrorAs(t, err, &sdkErr)
 		require.Equal(t, http.StatusForbidden, sdkErr.StatusCode())
@@ -50,7 +49,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 	t.Run("EmptyDB", func(t *testing.T) {
 		t.Parallel()
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, _ := coderdenttest.New(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -61,9 +59,9 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				},
 			},
 		})
-		experimentalClient := codersdk.NewExperimentalClient(client)
 		ctx := testutil.Context(t, testutil.WaitLong)
-		res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
+		//nolint:gocritic // Owner role is irrelevant here.
+		res, err := client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
 		require.Empty(t, res.Results)
 	})
@@ -71,7 +69,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 	t.Run("OK", func(t *testing.T) {
 		t.Parallel()
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, db, firstUser := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -82,7 +79,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				},
 			},
 		})
-		experimentalClient := codersdk.NewExperimentalClient(client)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
 		user1, err := client.User(ctx, codersdk.Me)
@@ -143,7 +139,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		i1SDK := db2sdk.AIBridgeInterception(i1, user1Visible, []database.AIBridgeTokenUsage{i1tok2, i1tok1}, []database.AIBridgeUserPrompt{i1up2, i1up1}, []database.AIBridgeToolUsage{i1tool2, i1tool1})
 		i2SDK := db2sdk.AIBridgeInterception(i2, user2Visible, nil, nil, nil)
 
-		res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
+		res, err := client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
 		require.Len(t, res.Results, 2)
 		require.Equal(t, i2SDK.ID, res.Results[0].ID)
@@ -183,7 +179,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		t.Parallel()
 
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, db, firstUser := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -194,7 +189,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				},
 			},
 		})
-		experimentalClient := codersdk.NewExperimentalClient(client)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
 		allInterceptionIDs := make([]uuid.UUID, 0, 20)
@@ -225,7 +219,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		}
 
 		// Try to fetch with an invalid limit.
-		res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
+		res, err := client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
 			Pagination: codersdk.Pagination{
 				Limit: 1001,
 			},
@@ -236,7 +230,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		require.Empty(t, res.Results)
 
 		// Try to fetch with both after_id and offset pagination.
-		res, err = experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
+		res, err = client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
 			Pagination: codersdk.Pagination{
 				AfterID: allInterceptionIDs[0],
 				Offset:  1,
@@ -269,7 +263,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 						} else {
 							pagination.Offset = len(interceptionIDs)
 						}
-						res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
+						res, err := client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
 							Pagination: pagination,
 						})
 						require.NoError(t, err)
@@ -299,7 +293,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 	t.Run("Authorized", func(t *testing.T) {
 		t.Parallel()
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		adminClient, db, firstUser := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -310,11 +303,9 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				},
 			},
 		})
-		adminExperimentalClient := codersdk.NewExperimentalClient(adminClient)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
 		secondUserClient, secondUser := coderdtest.CreateAnotherUser(t, adminClient, firstUser.OrganizationID)
-		secondUserExperimentalClient := codersdk.NewExperimentalClient(secondUserClient)
 
 		now := dbtime.Now()
 		i1 := dbgen.AIBridgeInterception(t, db, database.InsertAIBridgeInterceptionParams{
@@ -327,7 +318,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		}, &now)
 
 		// Admin can see all interceptions.
-		res, err := adminExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
+		res, err := adminClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
 		require.EqualValues(t, 2, res.Count)
 		require.Len(t, res.Results, 2)
@@ -335,7 +326,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 		require.Equal(t, i2.ID, res.Results[1].ID)
 
 		// Second user can only see their own interceptions.
-		res, err = secondUserExperimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
+		res, err = secondUserClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{})
 		require.NoError(t, err)
 		require.EqualValues(t, 1, res.Count)
 		require.Len(t, res.Results, 1)
@@ -345,7 +336,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 	t.Run("Filter", func(t *testing.T) {
 		t.Parallel()
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, db, firstUser := coderdenttest.NewWithDatabase(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -356,7 +346,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				},
 			},
 		})
-		experimentalClient := codersdk.NewExperimentalClient(client)
 		ctx := testutil.Context(t, testutil.WaitLong)
 
 		user1, err := client.User(ctx, codersdk.Me)
@@ -506,7 +495,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			t.Run(tc.name, func(t *testing.T) {
 				t.Parallel()
 				ctx := testutil.Context(t, testutil.WaitLong)
-				res, err := experimentalClient.AIBridgeListInterceptions(ctx, tc.filter)
+				res, err := client.AIBridgeListInterceptions(ctx, tc.filter)
 				require.NoError(t, err)
 				require.EqualValues(t, len(tc.want), res.Count)
 				// We just compare UUID strings for the sake of this test.
@@ -526,7 +515,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 	t.Run("FilterErrors", func(t *testing.T) {
 		t.Parallel()
 		dv := coderdtest.DeploymentValues(t)
-		dv.Experiments = []string{string(codersdk.ExperimentAIBridge)}
 		client, _ := coderdenttest.New(t, &coderdenttest.Options{
 			Options: &coderdtest.Options{
 				DeploymentValues: dv,
@@ -537,7 +525,6 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 				},
 			},
 		})
-		experimentalClient := codersdk.NewExperimentalClient(client)
 
 		// No need to insert any test data, we're just testing the filter
 		// errors.
@@ -594,7 +581,7 @@ func TestAIBridgeListInterceptions(t *testing.T) {
 			t.Run(tc.name, func(t *testing.T) {
 				t.Parallel()
 				ctx := testutil.Context(t, testutil.WaitLong)
-				res, err := experimentalClient.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
+				res, err := client.AIBridgeListInterceptions(ctx, codersdk.AIBridgeListInterceptionsFilter{
 					FilterQuery: tc.q,
 				})
 				var sdkErr *codersdk.Error
diff --git a/enterprise/coderd/aibridged.go b/enterprise/coderd/aibridged.go
index bf991103b1f52..285575df33862 100644
--- a/enterprise/coderd/aibridged.go
+++ b/enterprise/coderd/aibridged.go
@@ -14,9 +14,9 @@ import (
 
 	"github.com/coder/coder/v2/coderd/tracing"
 	"github.com/coder/coder/v2/codersdk/drpcsdk"
-	"github.com/coder/coder/v2/enterprise/x/aibridged"
-	aibridgedproto "github.com/coder/coder/v2/enterprise/x/aibridged/proto"
-	"github.com/coder/coder/v2/enterprise/x/aibridgedserver"
+	"github.com/coder/coder/v2/enterprise/aibridged"
+	aibridgedproto "github.com/coder/coder/v2/enterprise/aibridged/proto"
+	"github.com/coder/coder/v2/enterprise/aibridgedserver"
 )
 
 // RegisterInMemoryAIBridgedHTTPHandler mounts [aibridged.Server]'s HTTP router onto
diff --git a/enterprise/coderd/coderd.go b/enterprise/coderd/coderd.go
index 7666e8f957fc2..a4adb0479b96b 100644
--- a/enterprise/coderd/coderd.go
+++ b/enterprise/coderd/coderd.go
@@ -226,12 +226,9 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 		return api.refreshEntitlements(ctx)
 	}
 
-	api.AGPL.ExperimentalHandler.Group(func(r chi.Router) {
+	api.AGPL.APIHandler.Group(func(r chi.Router) {
 		r.Route("/aibridge", func(r chi.Router) {
-			r.Use(
-				api.RequireFeatureMW(codersdk.FeatureAIBridge),
-				httpmw.RequireExperimentWithDevBypass(api.AGPL.Experiments, codersdk.ExperimentAIBridge),
-			)
+			r.Use(api.RequireFeatureMW(codersdk.FeatureAIBridge))
 			r.Group(func(r chi.Router) {
 				r.Use(apiKeyMiddleware)
 				r.Get("/interceptions", api.aiBridgeListInterceptions)
@@ -246,7 +243,7 @@ func New(ctx context.Context, options *Options) (_ *API, err error) {
 					})
 					return
 				}
-				http.StripPrefix("/api/experimental/aibridge", api.aibridgedHandler).ServeHTTP(rw, r)
+				http.StripPrefix("/api/v2/aibridge", api.aibridgedHandler).ServeHTTP(rw, r)
 			})
 		})
 	})
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index d671cc2bb117e..b964cf4d05f28 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -1894,7 +1894,6 @@ export const EntitlementsWarningHeader = "X-Coder-Entitlements-Warning";
 
 // From codersdk/deployment.go
 export type Experiment =
-	| "aibridge"
 	| "auto-fill-parameters"
 	| "example"
 	| "mcp-server-http"
@@ -1905,7 +1904,6 @@ export type Experiment =
 	| "workspace-usage";
 
 export const Experiments: Experiment[] = [
-	"aibridge",
 	"auto-fill-parameters",
 	"example",
 	"mcp-server-http",

From d0a2e6d603c18deccd0c8ba8dcd318e12ad6097a Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Wed, 29 Oct 2025 21:08:26 +0000
Subject: [PATCH 283/298] fix: ensure lifecycle executor has sufficient task
 permissions (#20539) (#20560)

We recently made a change to the `wsbuilder` to handle task related
logic. Our test coverage for the lifecycle executor didn't handle this
scenario and so we missed that it had insufficient permissions.

This PR adds `Update` and `Read` permissions for `Task`s in the
lifecycle executor, as well as an autostart/autostop test tailored to
task workspaces to verify the change.

---

This is cherry picked from
https://github.com/coder/coder/commit/06dbadab11760fe5fbf88c5bfcac2c48e11f7862
https://github.com/coder/coder/pull/20539
---
 coderd/autobuild/lifecycle_executor_test.go | 172 ++++++++++++++++++++
 coderd/database/dbauthz/dbauthz.go          |   1 +
 2 files changed, 173 insertions(+)

diff --git a/coderd/autobuild/lifecycle_executor_test.go b/coderd/autobuild/lifecycle_executor_test.go
index 263a9e7e13c77..466c8c40525e1 100644
--- a/coderd/autobuild/lifecycle_executor_test.go
+++ b/coderd/autobuild/lifecycle_executor_test.go
@@ -1764,3 +1764,175 @@ func TestExecutorAutostartSkipsWhenNoProvisionersAvailable(t *testing.T) {
 
 	assert.Len(t, stats.Transitions, 1, "should create builds when provisioners are available")
 }
+
+func TestExecutorTaskWorkspace(t *testing.T) {
+	t.Parallel()
+
+	createTaskTemplate := func(t *testing.T, client *codersdk.Client, orgID uuid.UUID, ctx context.Context, defaultTTL time.Duration) codersdk.Template {
+		t.Helper()
+
+		taskAppID := uuid.New()
+		version := coderdtest.CreateTemplateVersion(t, client, orgID, &echo.Responses{
+			Parse: echo.ParseComplete,
+			ProvisionPlan: []*proto.Response{
+				{
+					Type: &proto.Response_Plan{
+						Plan: &proto.PlanComplete{HasAiTasks: true},
+					},
+				},
+			},
+			ProvisionApply: []*proto.Response{
+				{
+					Type: &proto.Response_Apply{
+						Apply: &proto.ApplyComplete{
+							Resources: []*proto.Resource{
+								{
+									Agents: []*proto.Agent{
+										{
+											Id:   uuid.NewString(),
+											Name: "dev",
+											Auth: &proto.Agent_Token{
+												Token: uuid.NewString(),
+											},
+											Apps: []*proto.App{
+												{
+													Id:   taskAppID.String(),
+													Slug: "task-app",
+												},
+											},
+										},
+									},
+								},
+							},
+							AiTasks: []*proto.AITask{
+								{
+									AppId: taskAppID.String(),
+								},
+							},
+						},
+					},
+				},
+			},
+		})
+		coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
+		template := coderdtest.CreateTemplate(t, client, orgID, version.ID)
+
+		if defaultTTL > 0 {
+			_, err := client.UpdateTemplateMeta(ctx, template.ID, codersdk.UpdateTemplateMeta{
+				DefaultTTLMillis: defaultTTL.Milliseconds(),
+			})
+			require.NoError(t, err)
+		}
+
+		return template
+	}
+
+	createTaskWorkspace := func(t *testing.T, client *codersdk.Client, template codersdk.Template, ctx context.Context, input string) codersdk.Workspace {
+		t.Helper()
+
+		exp := codersdk.NewExperimentalClient(client)
+		task, err := exp.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+			TemplateVersionID: template.ActiveVersionID,
+			Input:             input,
+		})
+		require.NoError(t, err)
+		require.True(t, task.WorkspaceID.Valid, "task should have a workspace")
+
+		workspace, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+		require.NoError(t, err)
+		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
+
+		return workspace
+	}
+
+	t.Run("Autostart", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx        = testutil.Context(t, testutil.WaitShort)
+			sched      = mustSchedule(t, "CRON_TZ=UTC 0 * * * *")
+			tickCh     = make(chan time.Time)
+			statsCh    = make(chan autobuild.Stats)
+			client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
+				AutobuildTicker:          tickCh,
+				IncludeProvisionerDaemon: true,
+				AutobuildStats:           statsCh,
+			})
+			admin = coderdtest.CreateFirstUser(t, client)
+		)
+
+		// Given: A task workspace
+		template := createTaskTemplate(t, client, admin.OrganizationID, ctx, 0)
+		workspace := createTaskWorkspace(t, client, template, ctx, "test task for autostart")
+
+		// Given: The task workspace has an autostart schedule
+		err := client.UpdateWorkspaceAutostart(ctx, workspace.ID, codersdk.UpdateWorkspaceAutostartRequest{
+			Schedule: ptr.Ref(sched.String()),
+		})
+		require.NoError(t, err)
+
+		// Given: That the workspace is in a stopped state.
+		workspace = coderdtest.MustTransitionWorkspace(t, client, workspace.ID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionStop)
+
+		p, err := coderdtest.GetProvisionerForTags(db, time.Now(), workspace.OrganizationID, map[string]string{})
+		require.NoError(t, err)
+
+		// When: the autobuild executor ticks after the scheduled time
+		go func() {
+			tickTime := sched.Next(workspace.LatestBuild.CreatedAt)
+			coderdtest.UpdateProvisionerLastSeenAt(t, db, p.ID, tickTime)
+			tickCh <- tickTime
+			close(tickCh)
+		}()
+
+		// Then: We expect to see a start transition
+		stats := <-statsCh
+		require.Len(t, stats.Transitions, 1, "lifecycle executor should transition the task workspace")
+		assert.Contains(t, stats.Transitions, workspace.ID, "task workspace should be in transitions")
+		assert.Equal(t, database.WorkspaceTransitionStart, stats.Transitions[workspace.ID], "should autostart the workspace")
+		require.Empty(t, stats.Errors, "should have no errors when managing task workspaces")
+	})
+
+	t.Run("Autostop", func(t *testing.T) {
+		t.Parallel()
+
+		var (
+			ctx        = testutil.Context(t, testutil.WaitShort)
+			tickCh     = make(chan time.Time)
+			statsCh    = make(chan autobuild.Stats)
+			client, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
+				AutobuildTicker:          tickCh,
+				IncludeProvisionerDaemon: true,
+				AutobuildStats:           statsCh,
+			})
+			admin = coderdtest.CreateFirstUser(t, client)
+		)
+
+		// Given: A task workspace with an 8 hour deadline
+		template := createTaskTemplate(t, client, admin.OrganizationID, ctx, 8*time.Hour)
+		workspace := createTaskWorkspace(t, client, template, ctx, "test task for autostop")
+
+		// Given: The workspace is currently running
+		workspace = coderdtest.MustWorkspace(t, client, workspace.ID)
+		require.Equal(t, codersdk.WorkspaceTransitionStart, workspace.LatestBuild.Transition)
+		require.NotZero(t, workspace.LatestBuild.Deadline, "workspace should have a deadline for autostop")
+
+		p, err := coderdtest.GetProvisionerForTags(db, time.Now(), workspace.OrganizationID, map[string]string{})
+		require.NoError(t, err)
+
+		// When: the autobuild executor ticks after the deadline
+		go func() {
+			tickTime := workspace.LatestBuild.Deadline.Time.Add(time.Minute)
+			coderdtest.UpdateProvisionerLastSeenAt(t, db, p.ID, tickTime)
+			tickCh <- tickTime
+			close(tickCh)
+		}()
+
+		// Then: We expect to see a stop transition
+		stats := <-statsCh
+		require.Len(t, stats.Transitions, 1, "lifecycle executor should transition the task workspace")
+		assert.Contains(t, stats.Transitions, workspace.ID, "task workspace should be in transitions")
+		assert.Equal(t, database.WorkspaceTransitionStop, stats.Transitions[workspace.ID], "should autostop the workspace")
+		require.Empty(t, stats.Errors, "should have no errors when managing task workspaces")
+	})
+}
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 01d3c4f26ae85..81873efb72d2d 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -254,6 +254,7 @@ var (
 					rbac.ResourceFile.Type:                {policy.ActionRead}, // Required to read terraform files
 					rbac.ResourceNotificationMessage.Type: {policy.ActionCreate, policy.ActionRead},
 					rbac.ResourceSystem.Type:              {policy.WildcardSymbol},
+					rbac.ResourceTask.Type:                {policy.ActionRead, policy.ActionUpdate},
 					rbac.ResourceTemplate.Type:            {policy.ActionRead, policy.ActionUpdate},
 					rbac.ResourceUser.Type:                {policy.ActionRead},
 					rbac.ResourceWorkspace.Type:           {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop},

From ba14acf4e8b955fefb0933f6a3a2164c7b2c7a52 Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Wed, 29 Oct 2025 21:29:54 +0000
Subject: [PATCH 284/298] fix(site): fix disappearing preset selector when
 switching task template (#20514) (#20564)

Ensure we set `selectedPresetId` to `undefined` when we change
`selectedTemplateId` to ensure we don't end up breaking the `<Select>`
component by giving it an invalid preset id.

---

Cherry picked from 9629d873fbc7b9ee00f31e3da339a72bac2aba23 (#20514)
---
 .../tasks/TaskPrompt/TaskPrompt.stories.tsx   | 120 ++++++++++++++++++
 .../modules/tasks/TaskPrompt/TaskPrompt.tsx   |   7 +-
 2 files changed, 126 insertions(+), 1 deletion(-)

diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
index 9572c68c75259..8187ec7500f87 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx
@@ -480,3 +480,123 @@ export const CheckExternalAuthOnChangingVersions: Story = {
 		});
 	},
 };
+
+export const CheckPresetsWhenChangingTemplate: Story = {
+	args: {
+		templates: [
+			{
+				...MockTemplate,
+				id: "claude-code",
+				name: "claude-code",
+				display_name: "Claude Code",
+				active_version_id: "claude-code-version",
+			},
+			{
+				...MockTemplate,
+				id: "codex",
+				name: "codex",
+				display_name: "Codex",
+				active_version_id: "codex-version",
+			},
+		],
+	},
+	beforeEach: () => {
+		spyOn(API, "getTemplateVersionPresets").mockImplementation((versionId) => {
+			if (versionId === "claude-code-version") {
+				return Promise.resolve([
+					{
+						...MockPresets[0],
+						ID: "claude-code-preset-1",
+						Name: "Claude Code Dev",
+					},
+				]);
+			}
+			if (versionId === "codex-version") {
+				return Promise.resolve([
+					{
+						...MockPresets[0],
+						ID: "codex-preset-1",
+						Name: "Codex Dev",
+					},
+				]);
+			}
+			return Promise.resolve([]);
+		});
+		spyOn(API, "getTemplateVersions").mockImplementation((templateId) => {
+			if (templateId === "claude-code") {
+				return Promise.resolve([
+					{
+						...MockTemplateVersion,
+						id: "claude-code-version",
+						name: "claude-code-version",
+					},
+				]);
+			}
+			if (templateId === "codex") {
+				return Promise.resolve([
+					{
+						...MockTemplateVersion,
+						id: "codex-version",
+						name: "codex-version",
+					},
+				]);
+			}
+			return Promise.resolve([]);
+		});
+	},
+	play: async ({ canvasElement, step }) => {
+		const canvas = within(canvasElement);
+		const body = within(canvasElement.ownerDocument.body);
+
+		await step("Presets are initially present", async () => {
+			const presetSelect = await canvas.findByLabelText(/preset/i);
+			await userEvent.click(presetSelect);
+
+			const options = await body.findAllByRole("option");
+			expect(options).toHaveLength(1);
+			expect(options[0]).toContainHTML("Claude Code Dev");
+
+			await userEvent.click(options[0]);
+		});
+
+		await step("Switch template", async () => {
+			const templateSelect = await canvas.findByLabelText(/select template/i);
+			await userEvent.click(templateSelect);
+
+			const codexTemplateOption = await body.findByRole("option", {
+				name: /codex/i,
+			});
+			await userEvent.click(codexTemplateOption);
+		});
+
+		await step("Presets are present in new template", async () => {
+			const presetSelect = await canvas.findByLabelText(/preset/i);
+			await userEvent.click(presetSelect);
+
+			const options = await body.findAllByRole("option");
+			expect(options).toHaveLength(1);
+			expect(options[0]).toContainHTML("Codex Dev");
+
+			await userEvent.click(options[0]);
+		});
+
+		await step("Switch template back", async () => {
+			const templateSelect = await canvas.findByLabelText(/select template/i);
+			await userEvent.click(templateSelect);
+
+			const codexTemplateOption = await body.findByRole("option", {
+				name: /claude code/i,
+			});
+			await userEvent.click(codexTemplateOption);
+		});
+
+		await step("Presets are present in original template", async () => {
+			const presetSelect = await canvas.findByLabelText(/preset/i);
+			await userEvent.click(presetSelect);
+
+			const options = await body.findAllByRole("option");
+			expect(options).toHaveLength(1);
+			expect(options[0]).toContainHTML("Claude Code Dev");
+		});
+	},
+};
diff --git a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
index b40f3253a8e93..677a24eaabf16 100644
--- a/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
+++ b/site/src/modules/tasks/TaskPrompt/TaskPrompt.tsx
@@ -270,7 +270,12 @@ const CreateTaskForm: FC<CreateTaskFormProps> = ({ templates, onSuccess }) => {
 							</label>
 							<Select
 								name="templateID"
-								onValueChange={(value) => setSelectedTemplateId(value)}
+								onValueChange={(value) => {
+									setSelectedTemplateId(value);
+									if (value !== selectedTemplateId) {
+										setSelectedPresetId(undefined);
+									}
+								}}
 								defaultValue={templates[0].id}
 								required
 							>

From 0b5542f9338e1569a11c78a4c2ff3c45ba3ce605 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Wed, 29 Oct 2025 21:45:43 +0000
Subject: [PATCH 285/298] fix: update task link AppStatus using task_id
 (#20543) (#20551)

Fixes https://github.com/coder/coder/issues/20515

Alternative to https://github.com/coder/coder/pull/20519

Adds `task_id` to `workspaces_expanded` view and updates the "View Task"
link in `AppStatuses` component.

NOTE: this contains a migration
(cherry picked from commit 1ebc2176248c4a77e1a3743938a3b9085a4e750e)

<!--

If you have used AI to produce some or all of this PR, please ensure you
have read our [AI Contribution
guidelines](https://coder.com/docs/about/contributing/AI_CONTRIBUTING)
before submitting.

-->
---
 cli/testdata/coder_list_--output_json.golden  |  3 +-
 coderd/aitasks_test.go                        | 12 ++++++
 coderd/apidoc/docs.go                         |  8 ++++
 coderd/apidoc/swagger.json                    |  8 ++++
 coderd/database/dump.sql                      |  8 ++--
 ...00393_workspaces_expanded_task_id.down.sql | 39 +++++++++++++++++
 .../000393_workspaces_expanded_task_id.up.sql | 42 +++++++++++++++++++
 coderd/database/modelqueries.go               |  1 +
 coderd/database/models.go                     |  1 +
 coderd/database/queries.sql.go                | 26 ++++++++----
 coderd/database/queries/workspaces.sql        |  1 +
 coderd/workspaces.go                          |  1 +
 codersdk/workspaces.go                        |  2 +
 docs/reference/api/schemas.md                 |  9 ++++
 docs/reference/api/workspaces.md              | 24 +++++++++++
 site/src/api/typesGenerated.ts                |  4 ++
 .../WorkspacePage/AppStatuses.stories.tsx     | 21 +++++++++-
 site/src/pages/WorkspacePage/AppStatuses.tsx  | 16 ++++---
 .../pages/WorkspacePage/Workspace.stories.tsx |  4 +-
 site/src/testHelpers/entities.ts              |  5 +++
 20 files changed, 213 insertions(+), 22 deletions(-)
 create mode 100644 coderd/database/migrations/000393_workspaces_expanded_task_id.down.sql
 create mode 100644 coderd/database/migrations/000393_workspaces_expanded_task_id.up.sql

diff --git a/cli/testdata/coder_list_--output_json.golden b/cli/testdata/coder_list_--output_json.golden
index 66afcf563dfbd..8da57536338f8 100644
--- a/cli/testdata/coder_list_--output_json.golden
+++ b/cli/testdata/coder_list_--output_json.golden
@@ -90,6 +90,7 @@
     "allow_renames": false,
     "favorite": false,
     "next_start_at": "====[timestamp]=====",
-    "is_prebuild": false
+    "is_prebuild": false,
+    "task_id": null
   }
 ]
diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index 80af3e993e97a..d3b5e240d8301 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -259,6 +259,9 @@ func TestTasks(t *testing.T) {
 		// Wait for the workspace to be built.
 		workspace, err := client.Workspace(ctx, task.WorkspaceID.UUID)
 		require.NoError(t, err)
+		if assert.True(t, workspace.TaskID.Valid, "task id should be set on workspace") {
+			assert.Equal(t, task.ID, workspace.TaskID.UUID, "workspace task id should match")
+		}
 		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, workspace.LatestBuild.ID)
 
 		// List tasks via experimental API and verify the prompt and status mapping.
@@ -297,6 +300,9 @@ func TestTasks(t *testing.T) {
 		// Get the workspace and wait for it to be ready.
 		ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
 		require.NoError(t, err)
+		if assert.True(t, ws.TaskID.Valid, "task id should be set on workspace") {
+			assert.Equal(t, task.ID, ws.TaskID.UUID, "workspace task id should match")
+		}
 		coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 		ws = coderdtest.MustWorkspace(t, client, task.WorkspaceID.UUID)
 		// Assert invariant: the workspace has exactly one resource with one agent with one app.
@@ -371,6 +377,9 @@ func TestTasks(t *testing.T) {
 			require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
 			ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
 			require.NoError(t, err)
+			if assert.True(t, ws.TaskID.Valid, "task id should be set on workspace") {
+				assert.Equal(t, task.ID, ws.TaskID.UUID, "workspace task id should match")
+			}
 			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
 			err = exp.DeleteTask(ctx, "me", task.ID)
@@ -417,6 +426,9 @@ func TestTasks(t *testing.T) {
 			coderdtest.AwaitTemplateVersionJobCompleted(t, client, version.ID)
 			template := coderdtest.CreateTemplate(t, client, user.OrganizationID, version.ID)
 			ws := coderdtest.CreateWorkspace(t, client, template.ID)
+			if assert.False(t, ws.TaskID.Valid, "task id should not be set on non-task workspace") {
+				assert.Zero(t, ws.TaskID, "non-task workspace task id should be empty")
+			}
 			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
 
 			exp := codersdk.NewExperimentalClient(client)
diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index 344a0299f8405..e459b94b3fdaf 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -19712,6 +19712,14 @@ const docTemplate = `{
                     "description": "OwnerName is the username of the owner of the workspace.",
                     "type": "string"
                 },
+                "task_id": {
+                    "description": "TaskID, if set, indicates that the workspace is relevant to the given codersdk.Task.",
+                    "allOf": [
+                        {
+                            "$ref": "#/definitions/uuid.NullUUID"
+                        }
+                    ]
+                },
                 "template_active_version_id": {
                     "type": "string",
                     "format": "uuid"
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index b472f2f4ef53f..8eef9dfb8e0d7 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -18098,6 +18098,14 @@
 					"description": "OwnerName is the username of the owner of the workspace.",
 					"type": "string"
 				},
+				"task_id": {
+					"description": "TaskID, if set, indicates that the workspace is relevant to the given codersdk.Task.",
+					"allOf": [
+						{
+							"$ref": "#/definitions/uuid.NullUUID"
+						}
+					]
+				},
 				"template_active_version_id": {
 					"type": "string",
 					"format": "uuid"
diff --git a/coderd/database/dump.sql b/coderd/database/dump.sql
index 837c657402bf2..8790bd27df693 100644
--- a/coderd/database/dump.sql
+++ b/coderd/database/dump.sql
@@ -2922,11 +2922,13 @@ CREATE VIEW workspaces_expanded AS
     templates.name AS template_name,
     templates.display_name AS template_display_name,
     templates.icon AS template_icon,
-    templates.description AS template_description
-   FROM (((workspaces
+    templates.description AS template_description,
+    tasks.id AS task_id
+   FROM ((((workspaces
      JOIN visible_users ON ((workspaces.owner_id = visible_users.id)))
      JOIN organizations ON ((workspaces.organization_id = organizations.id)))
-     JOIN templates ON ((workspaces.template_id = templates.id)));
+     JOIN templates ON ((workspaces.template_id = templates.id)))
+     LEFT JOIN tasks ON ((workspaces.id = tasks.workspace_id)));
 
 COMMENT ON VIEW workspaces_expanded IS 'Joins in the display name information such as username, avatar, and organization name.';
 
diff --git a/coderd/database/migrations/000393_workspaces_expanded_task_id.down.sql b/coderd/database/migrations/000393_workspaces_expanded_task_id.down.sql
new file mode 100644
index 0000000000000..ed30e6a0f64f3
--- /dev/null
+++ b/coderd/database/migrations/000393_workspaces_expanded_task_id.down.sql
@@ -0,0 +1,39 @@
+DROP VIEW workspaces_expanded;
+
+-- Recreate the view from 000354_workspace_acl.up.sql
+CREATE VIEW workspaces_expanded AS
+	SELECT workspaces.id,
+		workspaces.created_at,
+		workspaces.updated_at,
+		workspaces.owner_id,
+		workspaces.organization_id,
+		workspaces.template_id,
+		workspaces.deleted,
+		workspaces.name,
+		workspaces.autostart_schedule,
+		workspaces.ttl,
+		workspaces.last_used_at,
+		workspaces.dormant_at,
+		workspaces.deleting_at,
+		workspaces.automatic_updates,
+		workspaces.favorite,
+		workspaces.next_start_at,
+		workspaces.group_acl,
+		workspaces.user_acl,
+		visible_users.avatar_url AS owner_avatar_url,
+		visible_users.username AS owner_username,
+		visible_users.name AS owner_name,
+		organizations.name AS organization_name,
+		organizations.display_name AS organization_display_name,
+		organizations.icon AS organization_icon,
+		organizations.description AS organization_description,
+		templates.name AS template_name,
+		templates.display_name AS template_display_name,
+		templates.icon AS template_icon,
+		templates.description AS template_description
+	FROM (((workspaces
+		JOIN visible_users ON ((workspaces.owner_id = visible_users.id)))
+		JOIN organizations ON ((workspaces.organization_id = organizations.id)))
+		JOIN templates ON ((workspaces.template_id = templates.id)));
+
+COMMENT ON VIEW workspaces_expanded IS 'Joins in the display name information such as username, avatar, and organization name.';
diff --git a/coderd/database/migrations/000393_workspaces_expanded_task_id.up.sql b/coderd/database/migrations/000393_workspaces_expanded_task_id.up.sql
new file mode 100644
index 0000000000000..f01354e65bd50
--- /dev/null
+++ b/coderd/database/migrations/000393_workspaces_expanded_task_id.up.sql
@@ -0,0 +1,42 @@
+DROP VIEW workspaces_expanded;
+
+-- Add nullable task_id to workspaces_expanded view
+CREATE VIEW workspaces_expanded AS
+	SELECT workspaces.id,
+		workspaces.created_at,
+		workspaces.updated_at,
+		workspaces.owner_id,
+		workspaces.organization_id,
+		workspaces.template_id,
+		workspaces.deleted,
+		workspaces.name,
+		workspaces.autostart_schedule,
+		workspaces.ttl,
+		workspaces.last_used_at,
+		workspaces.dormant_at,
+		workspaces.deleting_at,
+		workspaces.automatic_updates,
+		workspaces.favorite,
+		workspaces.next_start_at,
+		workspaces.group_acl,
+		workspaces.user_acl,
+		visible_users.avatar_url AS owner_avatar_url,
+		visible_users.username AS owner_username,
+		visible_users.name AS owner_name,
+		organizations.name AS organization_name,
+		organizations.display_name AS organization_display_name,
+		organizations.icon AS organization_icon,
+		organizations.description AS organization_description,
+		templates.name AS template_name,
+		templates.display_name AS template_display_name,
+		templates.icon AS template_icon,
+		templates.description AS template_description,
+		tasks.id AS task_id
+	FROM ((((workspaces
+		JOIN visible_users ON ((workspaces.owner_id = visible_users.id)))
+		JOIN organizations ON ((workspaces.organization_id = organizations.id)))
+		JOIN templates ON ((workspaces.template_id = templates.id)))
+		LEFT JOIN tasks ON ((workspaces.id = tasks.workspace_id)));
+
+COMMENT ON VIEW workspaces_expanded IS 'Joins in the display name information such as username, avatar, and organization name.';
+
diff --git a/coderd/database/modelqueries.go b/coderd/database/modelqueries.go
index c9c7879627684..f9b058a40986e 100644
--- a/coderd/database/modelqueries.go
+++ b/coderd/database/modelqueries.go
@@ -321,6 +321,7 @@ func (q *sqlQuerier) GetAuthorizedWorkspaces(ctx context.Context, arg GetWorkspa
 			&i.TemplateDisplayName,
 			&i.TemplateIcon,
 			&i.TemplateDescription,
+			&i.TaskID,
 			&i.TemplateVersionID,
 			&i.TemplateVersionName,
 			&i.LatestBuildCompletedAt,
diff --git a/coderd/database/models.go b/coderd/database/models.go
index e55f3a553721b..ade3348ba3c69 100644
--- a/coderd/database/models.go
+++ b/coderd/database/models.go
@@ -4663,6 +4663,7 @@ type Workspace struct {
 	TemplateDisplayName     string           `db:"template_display_name" json:"template_display_name"`
 	TemplateIcon            string           `db:"template_icon" json:"template_icon"`
 	TemplateDescription     string           `db:"template_description" json:"template_description"`
+	TaskID                  uuid.NullUUID    `db:"task_id" json:"task_id"`
 }
 
 type WorkspaceAgent struct {
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 2005f98347c6c..0edb4fc709a1a 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -21826,7 +21826,7 @@ func (q *sqlQuerier) GetWorkspaceACLByID(ctx context.Context, id uuid.UUID) (Get
 
 const getWorkspaceByAgentID = `-- name: GetWorkspaceByAgentID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description, task_id
 FROM
 	workspaces_expanded as workspaces
 WHERE
@@ -21887,13 +21887,14 @@ func (q *sqlQuerier) GetWorkspaceByAgentID(ctx context.Context, agentID uuid.UUI
 		&i.TemplateDisplayName,
 		&i.TemplateIcon,
 		&i.TemplateDescription,
+		&i.TaskID,
 	)
 	return i, err
 }
 
 const getWorkspaceByID = `-- name: GetWorkspaceByID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description, task_id
 FROM
 	workspaces_expanded
 WHERE
@@ -21935,13 +21936,14 @@ func (q *sqlQuerier) GetWorkspaceByID(ctx context.Context, id uuid.UUID) (Worksp
 		&i.TemplateDisplayName,
 		&i.TemplateIcon,
 		&i.TemplateDescription,
+		&i.TaskID,
 	)
 	return i, err
 }
 
 const getWorkspaceByOwnerIDAndName = `-- name: GetWorkspaceByOwnerIDAndName :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description, task_id
 FROM
 	workspaces_expanded as workspaces
 WHERE
@@ -21990,13 +21992,14 @@ func (q *sqlQuerier) GetWorkspaceByOwnerIDAndName(ctx context.Context, arg GetWo
 		&i.TemplateDisplayName,
 		&i.TemplateIcon,
 		&i.TemplateDescription,
+		&i.TaskID,
 	)
 	return i, err
 }
 
 const getWorkspaceByResourceID = `-- name: GetWorkspaceByResourceID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description, task_id
 FROM
 	workspaces_expanded as workspaces
 WHERE
@@ -22052,13 +22055,14 @@ func (q *sqlQuerier) GetWorkspaceByResourceID(ctx context.Context, resourceID uu
 		&i.TemplateDisplayName,
 		&i.TemplateIcon,
 		&i.TemplateDescription,
+		&i.TaskID,
 	)
 	return i, err
 }
 
 const getWorkspaceByWorkspaceAppID = `-- name: GetWorkspaceByWorkspaceAppID :one
 SELECT
-	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description
+	id, created_at, updated_at, owner_id, organization_id, template_id, deleted, name, autostart_schedule, ttl, last_used_at, dormant_at, deleting_at, automatic_updates, favorite, next_start_at, group_acl, user_acl, owner_avatar_url, owner_username, owner_name, organization_name, organization_display_name, organization_icon, organization_description, template_name, template_display_name, template_icon, template_description, task_id
 FROM
 	workspaces_expanded as workspaces
 WHERE
@@ -22126,6 +22130,7 @@ func (q *sqlQuerier) GetWorkspaceByWorkspaceAppID(ctx context.Context, workspace
 		&i.TemplateDisplayName,
 		&i.TemplateIcon,
 		&i.TemplateDescription,
+		&i.TaskID,
 	)
 	return i, err
 }
@@ -22175,7 +22180,7 @@ SELECT
 ),
 filtered_workspaces AS (
 SELECT
-	workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.dormant_at, workspaces.deleting_at, workspaces.automatic_updates, workspaces.favorite, workspaces.next_start_at, workspaces.group_acl, workspaces.user_acl, workspaces.owner_avatar_url, workspaces.owner_username, workspaces.owner_name, workspaces.organization_name, workspaces.organization_display_name, workspaces.organization_icon, workspaces.organization_description, workspaces.template_name, workspaces.template_display_name, workspaces.template_icon, workspaces.template_description,
+	workspaces.id, workspaces.created_at, workspaces.updated_at, workspaces.owner_id, workspaces.organization_id, workspaces.template_id, workspaces.deleted, workspaces.name, workspaces.autostart_schedule, workspaces.ttl, workspaces.last_used_at, workspaces.dormant_at, workspaces.deleting_at, workspaces.automatic_updates, workspaces.favorite, workspaces.next_start_at, workspaces.group_acl, workspaces.user_acl, workspaces.owner_avatar_url, workspaces.owner_username, workspaces.owner_name, workspaces.organization_name, workspaces.organization_display_name, workspaces.organization_icon, workspaces.organization_description, workspaces.template_name, workspaces.template_display_name, workspaces.template_icon, workspaces.template_description, workspaces.task_id,
 	latest_build.template_version_id,
 	latest_build.template_version_name,
 	latest_build.completed_at as latest_build_completed_at,
@@ -22466,7 +22471,7 @@ WHERE
 	-- @authorize_filter
 ), filtered_workspaces_order AS (
 	SELECT
-		fw.id, fw.created_at, fw.updated_at, fw.owner_id, fw.organization_id, fw.template_id, fw.deleted, fw.name, fw.autostart_schedule, fw.ttl, fw.last_used_at, fw.dormant_at, fw.deleting_at, fw.automatic_updates, fw.favorite, fw.next_start_at, fw.group_acl, fw.user_acl, fw.owner_avatar_url, fw.owner_username, fw.owner_name, fw.organization_name, fw.organization_display_name, fw.organization_icon, fw.organization_description, fw.template_name, fw.template_display_name, fw.template_icon, fw.template_description, fw.template_version_id, fw.template_version_name, fw.latest_build_completed_at, fw.latest_build_canceled_at, fw.latest_build_error, fw.latest_build_transition, fw.latest_build_status, fw.latest_build_has_ai_task, fw.latest_build_has_external_agent
+		fw.id, fw.created_at, fw.updated_at, fw.owner_id, fw.organization_id, fw.template_id, fw.deleted, fw.name, fw.autostart_schedule, fw.ttl, fw.last_used_at, fw.dormant_at, fw.deleting_at, fw.automatic_updates, fw.favorite, fw.next_start_at, fw.group_acl, fw.user_acl, fw.owner_avatar_url, fw.owner_username, fw.owner_name, fw.organization_name, fw.organization_display_name, fw.organization_icon, fw.organization_description, fw.template_name, fw.template_display_name, fw.template_icon, fw.template_description, fw.task_id, fw.template_version_id, fw.template_version_name, fw.latest_build_completed_at, fw.latest_build_canceled_at, fw.latest_build_error, fw.latest_build_transition, fw.latest_build_status, fw.latest_build_has_ai_task, fw.latest_build_has_external_agent
 	FROM
 		filtered_workspaces fw
 	ORDER BY
@@ -22487,7 +22492,7 @@ WHERE
 		$25
 ), filtered_workspaces_order_with_summary AS (
 	SELECT
-		fwo.id, fwo.created_at, fwo.updated_at, fwo.owner_id, fwo.organization_id, fwo.template_id, fwo.deleted, fwo.name, fwo.autostart_schedule, fwo.ttl, fwo.last_used_at, fwo.dormant_at, fwo.deleting_at, fwo.automatic_updates, fwo.favorite, fwo.next_start_at, fwo.group_acl, fwo.user_acl, fwo.owner_avatar_url, fwo.owner_username, fwo.owner_name, fwo.organization_name, fwo.organization_display_name, fwo.organization_icon, fwo.organization_description, fwo.template_name, fwo.template_display_name, fwo.template_icon, fwo.template_description, fwo.template_version_id, fwo.template_version_name, fwo.latest_build_completed_at, fwo.latest_build_canceled_at, fwo.latest_build_error, fwo.latest_build_transition, fwo.latest_build_status, fwo.latest_build_has_ai_task, fwo.latest_build_has_external_agent
+		fwo.id, fwo.created_at, fwo.updated_at, fwo.owner_id, fwo.organization_id, fwo.template_id, fwo.deleted, fwo.name, fwo.autostart_schedule, fwo.ttl, fwo.last_used_at, fwo.dormant_at, fwo.deleting_at, fwo.automatic_updates, fwo.favorite, fwo.next_start_at, fwo.group_acl, fwo.user_acl, fwo.owner_avatar_url, fwo.owner_username, fwo.owner_name, fwo.organization_name, fwo.organization_display_name, fwo.organization_icon, fwo.organization_description, fwo.template_name, fwo.template_display_name, fwo.template_icon, fwo.template_description, fwo.task_id, fwo.template_version_id, fwo.template_version_name, fwo.latest_build_completed_at, fwo.latest_build_canceled_at, fwo.latest_build_error, fwo.latest_build_transition, fwo.latest_build_status, fwo.latest_build_has_ai_task, fwo.latest_build_has_external_agent
 	FROM
 		filtered_workspaces_order fwo
 	-- Return a technical summary row with total count of workspaces.
@@ -22523,6 +22528,7 @@ WHERE
 		'', -- template_display_name
 		'', -- template_icon
 		'', -- template_description
+		'00000000-0000-0000-0000-000000000000'::uuid, -- task_id
 		-- Extra columns added to ` + "`" + `filtered_workspaces` + "`" + `
 		'00000000-0000-0000-0000-000000000000'::uuid, -- template_version_id
 		'', -- template_version_name
@@ -22542,7 +22548,7 @@ WHERE
 		filtered_workspaces
 )
 SELECT
-	fwos.id, fwos.created_at, fwos.updated_at, fwos.owner_id, fwos.organization_id, fwos.template_id, fwos.deleted, fwos.name, fwos.autostart_schedule, fwos.ttl, fwos.last_used_at, fwos.dormant_at, fwos.deleting_at, fwos.automatic_updates, fwos.favorite, fwos.next_start_at, fwos.group_acl, fwos.user_acl, fwos.owner_avatar_url, fwos.owner_username, fwos.owner_name, fwos.organization_name, fwos.organization_display_name, fwos.organization_icon, fwos.organization_description, fwos.template_name, fwos.template_display_name, fwos.template_icon, fwos.template_description, fwos.template_version_id, fwos.template_version_name, fwos.latest_build_completed_at, fwos.latest_build_canceled_at, fwos.latest_build_error, fwos.latest_build_transition, fwos.latest_build_status, fwos.latest_build_has_ai_task, fwos.latest_build_has_external_agent,
+	fwos.id, fwos.created_at, fwos.updated_at, fwos.owner_id, fwos.organization_id, fwos.template_id, fwos.deleted, fwos.name, fwos.autostart_schedule, fwos.ttl, fwos.last_used_at, fwos.dormant_at, fwos.deleting_at, fwos.automatic_updates, fwos.favorite, fwos.next_start_at, fwos.group_acl, fwos.user_acl, fwos.owner_avatar_url, fwos.owner_username, fwos.owner_name, fwos.organization_name, fwos.organization_display_name, fwos.organization_icon, fwos.organization_description, fwos.template_name, fwos.template_display_name, fwos.template_icon, fwos.template_description, fwos.task_id, fwos.template_version_id, fwos.template_version_name, fwos.latest_build_completed_at, fwos.latest_build_canceled_at, fwos.latest_build_error, fwos.latest_build_transition, fwos.latest_build_status, fwos.latest_build_has_ai_task, fwos.latest_build_has_external_agent,
 	tc.count
 FROM
 	filtered_workspaces_order_with_summary fwos
@@ -22610,6 +22616,7 @@ type GetWorkspacesRow struct {
 	TemplateDisplayName         string               `db:"template_display_name" json:"template_display_name"`
 	TemplateIcon                string               `db:"template_icon" json:"template_icon"`
 	TemplateDescription         string               `db:"template_description" json:"template_description"`
+	TaskID                      uuid.NullUUID        `db:"task_id" json:"task_id"`
 	TemplateVersionID           uuid.UUID            `db:"template_version_id" json:"template_version_id"`
 	TemplateVersionName         sql.NullString       `db:"template_version_name" json:"template_version_name"`
 	LatestBuildCompletedAt      sql.NullTime         `db:"latest_build_completed_at" json:"latest_build_completed_at"`
@@ -22692,6 +22699,7 @@ func (q *sqlQuerier) GetWorkspaces(ctx context.Context, arg GetWorkspacesParams)
 			&i.TemplateDisplayName,
 			&i.TemplateIcon,
 			&i.TemplateDescription,
+			&i.TaskID,
 			&i.TemplateVersionID,
 			&i.TemplateVersionName,
 			&i.LatestBuildCompletedAt,
diff --git a/coderd/database/queries/workspaces.sql b/coderd/database/queries/workspaces.sql
index 8ccc69b9a813c..d48285bb7de9c 100644
--- a/coderd/database/queries/workspaces.sql
+++ b/coderd/database/queries/workspaces.sql
@@ -457,6 +457,7 @@ WHERE
 		'', -- template_display_name
 		'', -- template_icon
 		'', -- template_description
+		'00000000-0000-0000-0000-000000000000'::uuid, -- task_id
 		-- Extra columns added to `filtered_workspaces`
 		'00000000-0000-0000-0000-000000000000'::uuid, -- template_version_id
 		'', -- template_version_name
diff --git a/coderd/workspaces.go b/coderd/workspaces.go
index e8b7ff51530c3..3519442c3e6bf 100644
--- a/coderd/workspaces.go
+++ b/coderd/workspaces.go
@@ -2654,6 +2654,7 @@ func convertWorkspace(
 		Favorite:         requesterFavorite,
 		NextStartAt:      nextStartAt,
 		IsPrebuild:       workspace.IsPrebuild(),
+		TaskID:           workspace.TaskID,
 	}, nil
 }
 
diff --git a/codersdk/workspaces.go b/codersdk/workspaces.go
index f190d58be6bfb..709c9257c8350 100644
--- a/codersdk/workspaces.go
+++ b/codersdk/workspaces.go
@@ -72,6 +72,8 @@ type Workspace struct {
 	// Once a prebuilt workspace is claimed by a user, it transitions to a regular workspace,
 	// and IsPrebuild returns false.
 	IsPrebuild bool `json:"is_prebuild"`
+	// TaskID, if set, indicates that the workspace is relevant to the given codersdk.Task.
+	TaskID uuid.NullUUID `json:"task_id,omitempty"`
 }
 
 func (w Workspace) FullName() string {
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 037c9cfa109bb..4317324f002be 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -10184,6 +10184,10 @@ If the schedule is empty, the user will be updated to use the default schedule.|
   "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "task_id": {
+    "uuid": "string",
+    "valid": true
+  },
   "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
@@ -10222,6 +10226,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `owner_avatar_url`                          | string                                                     | false    |              |                                                                                                                                                                                                                                                                                                                                             |
 | `owner_id`                                  | string                                                     | false    |              |                                                                                                                                                                                                                                                                                                                                             |
 | `owner_name`                                | string                                                     | false    |              | Owner name is the username of the owner of the workspace.                                                                                                                                                                                                                                                                                   |
+| `task_id`                                   | [uuid.NullUUID](#uuidnulluuid)                             | false    |              | Task ID if set, indicates that the workspace is relevant to the given codersdk.Task.                                                                                                                                                                                                                                                        |
 | `template_active_version_id`                | string                                                     | false    |              |                                                                                                                                                                                                                                                                                                                                             |
 | `template_allow_user_cancel_workspace_jobs` | boolean                                                    | false    |              |                                                                                                                                                                                                                                                                                                                                             |
 | `template_display_name`                     | string                                                     | false    |              |                                                                                                                                                                                                                                                                                                                                             |
@@ -12178,6 +12183,10 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       "owner_avatar_url": "string",
       "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
       "owner_name": "string",
+      "task_id": {
+        "uuid": "string",
+        "valid": true
+      },
       "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
       "template_allow_user_cancel_workspace_jobs": true,
       "template_display_name": "string",
diff --git a/docs/reference/api/workspaces.md b/docs/reference/api/workspaces.md
index 91ab23f9260e9..3e52d9e0a2d60 100644
--- a/docs/reference/api/workspaces.md
+++ b/docs/reference/api/workspaces.md
@@ -297,6 +297,10 @@ of the template will be used.
   "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "task_id": {
+    "uuid": "string",
+    "valid": true
+  },
   "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
@@ -589,6 +593,10 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
   "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "task_id": {
+    "uuid": "string",
+    "valid": true
+  },
   "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
@@ -906,6 +914,10 @@ of the template will be used.
   "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "task_id": {
+    "uuid": "string",
+    "valid": true
+  },
   "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
@@ -1184,6 +1196,10 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
       "owner_avatar_url": "string",
       "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
       "owner_name": "string",
+      "task_id": {
+        "uuid": "string",
+        "valid": true
+      },
       "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
       "template_allow_user_cancel_workspace_jobs": true,
       "template_display_name": "string",
@@ -1477,6 +1493,10 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
   "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "task_id": {
+    "uuid": "string",
+    "valid": true
+  },
   "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
@@ -2029,6 +2049,10 @@ curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/dormant \
   "owner_avatar_url": "string",
   "owner_id": "8826ee2e-7933-4665-aef2-2393f84a0d05",
   "owner_name": "string",
+  "task_id": {
+    "uuid": "string",
+    "valid": true
+  },
   "template_active_version_id": "b0da9c29-67d8-4c87-888c-bafe356f7f3c",
   "template_allow_user_cancel_workspace_jobs": true,
   "template_display_name": "string",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index b964cf4d05f28..6d703cbcfe2d6 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -5875,6 +5875,10 @@ export interface Workspace {
 	 * and IsPrebuild returns false.
 	 */
 	readonly is_prebuild: boolean;
+	/**
+	 * TaskID, if set, indicates that the workspace is relevant to the given codersdk.Task.
+	 */
+	readonly task_id?: string;
 }
 
 // From codersdk/workspaces.go
diff --git a/site/src/pages/WorkspacePage/AppStatuses.stories.tsx b/site/src/pages/WorkspacePage/AppStatuses.stories.tsx
index 2e8324aef2e0b..d27e64ae7096f 100644
--- a/site/src/pages/WorkspacePage/AppStatuses.stories.tsx
+++ b/site/src/pages/WorkspacePage/AppStatuses.stories.tsx
@@ -1,5 +1,6 @@
 import {
 	createTimestamp,
+	MockTaskWorkspace,
 	MockWorkspace,
 	MockWorkspaceAgent,
 	MockWorkspaceApp,
@@ -18,7 +19,7 @@ const meta: Meta<typeof AppStatuses> = {
 	args: {
 		referenceDate: new Date("2024-03-26T15:15:00Z"),
 		agent: mockAgent(MockWorkspaceAppStatuses),
-		workspace: MockWorkspace,
+		workspace: MockTaskWorkspace,
 	},
 	decorators: [withProxyProvider()],
 };
@@ -148,6 +149,24 @@ export const MultipleStatuses: Story = {
 	},
 };
 
+export const NoTaskWorkspace: Story = {
+	args: {
+		agent: mockAgent([
+			{
+				...MockWorkspaceAppStatus,
+				id: "status-9",
+				icon: "",
+				message: "status updated via curl",
+				created_at: createTimestamp(5, 15),
+				uri: "",
+				state: "complete" as const,
+			},
+			...MockWorkspaceAppStatuses,
+		]),
+		workspace: MockWorkspace,
+	},
+};
+
 function mockAgent(statuses: WorkspaceAppStatus[]) {
 	return {
 		...MockWorkspaceAgent,
diff --git a/site/src/pages/WorkspacePage/AppStatuses.tsx b/site/src/pages/WorkspacePage/AppStatuses.tsx
index 26f239b627101..2f1845db37031 100644
--- a/site/src/pages/WorkspacePage/AppStatuses.tsx
+++ b/site/src/pages/WorkspacePage/AppStatuses.tsx
@@ -121,12 +121,16 @@ export const AppStatuses: FC<AppStatusesProps> = ({
 							</Button>
 						))}
 
-					<Button asChild size="sm" variant="outline">
-						<RouterLink to={`/tasks/${workspace.owner_name}/${workspace.name}`}>
-							<SquareCheckBigIcon />
-							View task
-						</RouterLink>
-					</Button>
+					{workspace.task_id && (
+						<Button asChild size="sm" variant="outline">
+							<RouterLink
+								to={`/tasks/${workspace.owner_name}/${workspace.task_id}`}
+							>
+								<SquareCheckBigIcon />
+								View task
+							</RouterLink>
+						</Button>
+					)}
 
 					<TooltipProvider>
 						<Tooltip>
diff --git a/site/src/pages/WorkspacePage/Workspace.stories.tsx b/site/src/pages/WorkspacePage/Workspace.stories.tsx
index 5a49e0fa57091..8ae0c1b3095d0 100644
--- a/site/src/pages/WorkspacePage/Workspace.stories.tsx
+++ b/site/src/pages/WorkspacePage/Workspace.stories.tsx
@@ -112,9 +112,9 @@ export const RunningWithChildAgent: Story = {
 export const RunningWithAppStatuses: Story = {
 	args: {
 		workspace: {
-			...Mocks.MockWorkspace,
+			...Mocks.MockTaskWorkspace,
 			latest_build: {
-				...Mocks.MockWorkspace.latest_build,
+				...Mocks.MockTaskWorkspace.latest_build,
 				resources: [
 					{
 						...Mocks.MockWorkspaceResource,
diff --git a/site/src/testHelpers/entities.ts b/site/src/testHelpers/entities.ts
index a12d91cf51a8e..b0ce392fa1feb 100644
--- a/site/src/testHelpers/entities.ts
+++ b/site/src/testHelpers/entities.ts
@@ -5027,6 +5027,11 @@ export const MockTask = {
 	updated_at: "2022-05-17T17:39:01.382927298Z",
 } satisfies TypesGen.Task;
 
+export const MockTaskWorkspace: TypesGen.Workspace = {
+	...MockWorkspace,
+	task_id: MockTask.id,
+};
+
 export const MockTasks = [
 	MockTask,
 	{

From a7b3efb540830f502c14a2fde82cdfe681371810 Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Thu, 30 Oct 2025 10:38:14 +0000
Subject: [PATCH 286/298] feat: delete pending canceled prebuilds (#20499)
 (#20554)

Related to PR: https://github.com/coder/coder/pull/20499

(cherry picked from commit c3e3bb58f2821c94b31bbe8bb750849514b49a5b)
---
 coderd/database/dbauthz/dbauthz.go            |   4 +-
 coderd/database/dbauthz/dbauthz_test.go       |   9 +-
 coderd/database/dbmetrics/querymetrics.go     |   2 +-
 coderd/database/dbmock/dbmock.go              |   4 +-
 coderd/database/querier.go                    |   2 +-
 coderd/database/queries.sql.go                |  38 +++--
 coderd/database/queries/prebuilds.sql         |  16 +-
 enterprise/coderd/prebuilds/reconcile.go      | 144 +++++++++++++-----
 enterprise/coderd/prebuilds/reconcile_test.go |  95 ++++++++----
 9 files changed, 219 insertions(+), 95 deletions(-)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 81873efb72d2d..f169f7eeb13c1 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -4934,10 +4934,10 @@ func (q *querier) UpdateOrganizationDeletedByID(ctx context.Context, arg databas
 	return deleteQ(q.log, q.auth, q.db.GetOrganizationByID, deleteF)(ctx, arg.ID)
 }
 
-func (q *querier) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+func (q *querier) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]database.UpdatePrebuildProvisionerJobWithCancelRow, error) {
 	// Prebuild operation for canceling pending prebuild jobs from non-active template versions
 	if err := q.authorizeContext(ctx, policy.ActionUpdate, rbac.ResourcePrebuiltWorkspace); err != nil {
-		return []uuid.UUID{}, err
+		return []database.UpdatePrebuildProvisionerJobWithCancelRow{}, err
 	}
 	return q.db.UpdatePrebuildProvisionerJobWithCancel(ctx, arg)
 }
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 8cf622a4347f3..63226271f7fa0 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -646,10 +646,13 @@ func (s *MethodTestSuite) TestProvisionerJob() {
 			PresetID: uuid.NullUUID{UUID: uuid.New(), Valid: true},
 			Now:      dbtime.Now(),
 		}
-		jobIDs := []uuid.UUID{uuid.New(), uuid.New()}
+		canceledJobs := []database.UpdatePrebuildProvisionerJobWithCancelRow{
+			{ID: uuid.New(), WorkspaceID: uuid.New(), TemplateID: uuid.New(), TemplateVersionPresetID: uuid.NullUUID{UUID: uuid.New(), Valid: true}},
+			{ID: uuid.New(), WorkspaceID: uuid.New(), TemplateID: uuid.New(), TemplateVersionPresetID: uuid.NullUUID{UUID: uuid.New(), Valid: true}},
+		}
 
-		dbm.EXPECT().UpdatePrebuildProvisionerJobWithCancel(gomock.Any(), arg).Return(jobIDs, nil).AnyTimes()
-		check.Args(arg).Asserts(rbac.ResourcePrebuiltWorkspace, policy.ActionUpdate).Returns(jobIDs)
+		dbm.EXPECT().UpdatePrebuildProvisionerJobWithCancel(gomock.Any(), arg).Return(canceledJobs, nil).AnyTimes()
+		check.Args(arg).Asserts(rbac.ResourcePrebuiltWorkspace, policy.ActionUpdate).Returns(canceledJobs)
 	}))
 	s.Run("GetProvisionerJobsByIDs", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
 		org := testutil.Fake(s.T(), faker, database.Organization{})
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 1bd8fda62470a..1b36a3fa987f2 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -3042,7 +3042,7 @@ func (m queryMetricsStore) UpdateOrganizationDeletedByID(ctx context.Context, ar
 	return r0
 }
 
-func (m queryMetricsStore) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+func (m queryMetricsStore) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]database.UpdatePrebuildProvisionerJobWithCancelRow, error) {
 	start := time.Now()
 	r0, r1 := m.s.UpdatePrebuildProvisionerJobWithCancel(ctx, arg)
 	m.queryLatencies.WithLabelValues("UpdatePrebuildProvisionerJobWithCancel").Observe(time.Since(start).Seconds())
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 1983092aa53f0..0ecd0191cbce1 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -6540,10 +6540,10 @@ func (mr *MockStoreMockRecorder) UpdateOrganizationDeletedByID(ctx, arg any) *go
 }
 
 // UpdatePrebuildProvisionerJobWithCancel mocks base method.
-func (m *MockStore) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+func (m *MockStore) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg database.UpdatePrebuildProvisionerJobWithCancelParams) ([]database.UpdatePrebuildProvisionerJobWithCancelRow, error) {
 	m.ctrl.T.Helper()
 	ret := m.ctrl.Call(m, "UpdatePrebuildProvisionerJobWithCancel", ctx, arg)
-	ret0, _ := ret[0].([]uuid.UUID)
+	ret0, _ := ret[0].([]database.UpdatePrebuildProvisionerJobWithCancelRow)
 	ret1, _ := ret[1].(error)
 	return ret0, ret1
 }
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 2b96823028f61..2aa1cb8650051 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -667,7 +667,7 @@ type sqlcQuerier interface {
 	// Cancels all pending provisioner jobs for prebuilt workspaces on a specific preset from an
 	// inactive template version.
 	// This is an optimization to clean up stale pending jobs.
-	UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error)
+	UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg UpdatePrebuildProvisionerJobWithCancelParams) ([]UpdatePrebuildProvisionerJobWithCancelRow, error)
 	UpdatePresetPrebuildStatus(ctx context.Context, arg UpdatePresetPrebuildStatusParams) error
 	UpdateProvisionerDaemonLastSeenAt(ctx context.Context, arg UpdateProvisionerDaemonLastSeenAtParams) error
 	UpdateProvisionerJobByID(ctx context.Context, arg UpdateProvisionerJobByIDParams) error
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 0edb4fc709a1a..9a9c7d2629dd0 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -8687,12 +8687,8 @@ func (q *sqlQuerier) GetTemplatePresetsWithPrebuilds(ctx context.Context, templa
 }
 
 const updatePrebuildProvisionerJobWithCancel = `-- name: UpdatePrebuildProvisionerJobWithCancel :many
-UPDATE provisioner_jobs
-SET
-	canceled_at = $1::timestamptz,
-	completed_at = $1::timestamptz
-WHERE id IN (
-	SELECT pj.id
+WITH jobs_to_cancel AS (
+	SELECT pj.id, w.id AS workspace_id, w.template_id, wpb.template_version_preset_id
 	FROM provisioner_jobs pj
 	INNER JOIN workspace_prebuild_builds wpb ON wpb.job_id = pj.id
 	INNER JOIN workspaces w ON w.id = wpb.workspace_id
@@ -8711,7 +8707,13 @@ WHERE id IN (
 		AND pj.canceled_at IS NULL
 		AND pj.completed_at IS NULL
 )
-RETURNING id
+UPDATE provisioner_jobs
+SET
+	canceled_at = $1::timestamptz,
+	completed_at = $1::timestamptz
+FROM jobs_to_cancel
+WHERE provisioner_jobs.id = jobs_to_cancel.id
+RETURNING jobs_to_cancel.id, jobs_to_cancel.workspace_id, jobs_to_cancel.template_id, jobs_to_cancel.template_version_preset_id
 `
 
 type UpdatePrebuildProvisionerJobWithCancelParams struct {
@@ -8719,22 +8721,34 @@ type UpdatePrebuildProvisionerJobWithCancelParams struct {
 	PresetID uuid.NullUUID `db:"preset_id" json:"preset_id"`
 }
 
+type UpdatePrebuildProvisionerJobWithCancelRow struct {
+	ID                      uuid.UUID     `db:"id" json:"id"`
+	WorkspaceID             uuid.UUID     `db:"workspace_id" json:"workspace_id"`
+	TemplateID              uuid.UUID     `db:"template_id" json:"template_id"`
+	TemplateVersionPresetID uuid.NullUUID `db:"template_version_preset_id" json:"template_version_preset_id"`
+}
+
 // Cancels all pending provisioner jobs for prebuilt workspaces on a specific preset from an
 // inactive template version.
 // This is an optimization to clean up stale pending jobs.
-func (q *sqlQuerier) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg UpdatePrebuildProvisionerJobWithCancelParams) ([]uuid.UUID, error) {
+func (q *sqlQuerier) UpdatePrebuildProvisionerJobWithCancel(ctx context.Context, arg UpdatePrebuildProvisionerJobWithCancelParams) ([]UpdatePrebuildProvisionerJobWithCancelRow, error) {
 	rows, err := q.db.QueryContext(ctx, updatePrebuildProvisionerJobWithCancel, arg.Now, arg.PresetID)
 	if err != nil {
 		return nil, err
 	}
 	defer rows.Close()
-	var items []uuid.UUID
+	var items []UpdatePrebuildProvisionerJobWithCancelRow
 	for rows.Next() {
-		var id uuid.UUID
-		if err := rows.Scan(&id); err != nil {
+		var i UpdatePrebuildProvisionerJobWithCancelRow
+		if err := rows.Scan(
+			&i.ID,
+			&i.WorkspaceID,
+			&i.TemplateID,
+			&i.TemplateVersionPresetID,
+		); err != nil {
 			return nil, err
 		}
-		items = append(items, id)
+		items = append(items, i)
 	}
 	if err := rows.Close(); err != nil {
 		return nil, err
diff --git a/coderd/database/queries/prebuilds.sql b/coderd/database/queries/prebuilds.sql
index 6c5520c9da7e1..7c060971efba5 100644
--- a/coderd/database/queries/prebuilds.sql
+++ b/coderd/database/queries/prebuilds.sql
@@ -300,12 +300,8 @@ GROUP BY wpb.template_version_preset_id;
 -- Cancels all pending provisioner jobs for prebuilt workspaces on a specific preset from an
 -- inactive template version.
 -- This is an optimization to clean up stale pending jobs.
-UPDATE provisioner_jobs
-SET
-	canceled_at = @now::timestamptz,
-	completed_at = @now::timestamptz
-WHERE id IN (
-	SELECT pj.id
+WITH jobs_to_cancel AS (
+	SELECT pj.id, w.id AS workspace_id, w.template_id, wpb.template_version_preset_id
 	FROM provisioner_jobs pj
 	INNER JOIN workspace_prebuild_builds wpb ON wpb.job_id = pj.id
 	INNER JOIN workspaces w ON w.id = wpb.workspace_id
@@ -324,4 +320,10 @@ WHERE id IN (
 		AND pj.canceled_at IS NULL
 		AND pj.completed_at IS NULL
 )
-RETURNING id;
+UPDATE provisioner_jobs
+SET
+	canceled_at = @now::timestamptz,
+	completed_at = @now::timestamptz
+FROM jobs_to_cancel
+WHERE provisioner_jobs.id = jobs_to_cancel.id
+RETURNING jobs_to_cancel.id, jobs_to_cancel.workspace_id, jobs_to_cancel.template_id, jobs_to_cancel.template_version_preset_id;
diff --git a/enterprise/coderd/prebuilds/reconcile.go b/enterprise/coderd/prebuilds/reconcile.go
index ceb16061bd7a7..5e5eec68ab382 100644
--- a/enterprise/coderd/prebuilds/reconcile.go
+++ b/enterprise/coderd/prebuilds/reconcile.go
@@ -57,6 +57,24 @@ type StoreReconciler struct {
 
 var _ prebuilds.ReconciliationOrchestrator = &StoreReconciler{}
 
+type DeprovisionMode int
+
+const (
+	DeprovisionModeNormal DeprovisionMode = iota
+	DeprovisionModeOrphan
+)
+
+func (d DeprovisionMode) String() string {
+	switch d {
+	case DeprovisionModeOrphan:
+		return "orphan"
+	case DeprovisionModeNormal:
+		return "normal"
+	default:
+		return "unknown"
+	}
+}
+
 func NewStoreReconciler(store database.Store,
 	ps pubsub.Pubsub,
 	fileCache *files.Cache,
@@ -642,34 +660,7 @@ func (c *StoreReconciler) executeReconciliationAction(ctx context.Context, logge
 		return multiErr.ErrorOrNil()
 
 	case prebuilds.ActionTypeCancelPending:
-		// Cancel pending prebuild jobs from non-active template versions to avoid
-		// provisioning obsolete workspaces that would immediately be deprovisioned.
-		// This uses a criteria-based update to ensure only jobs that are still pending
-		// at execution time are canceled, avoiding race conditions where jobs may have
-		// transitioned to running status between query and update.
-		canceledJobs, err := c.store.UpdatePrebuildProvisionerJobWithCancel(
-			ctx,
-			database.UpdatePrebuildProvisionerJobWithCancelParams{
-				Now: c.clock.Now(),
-				PresetID: uuid.NullUUID{
-					UUID:  ps.Preset.ID,
-					Valid: true,
-				},
-			})
-		if err != nil {
-			logger.Error(ctx, "failed to cancel pending prebuild jobs",
-				slog.F("template_version_id", ps.Preset.TemplateVersionID.String()),
-				slog.F("preset_id", ps.Preset.ID),
-				slog.Error(err))
-			return err
-		}
-		if len(canceledJobs) > 0 {
-			logger.Info(ctx, "canceled pending prebuild jobs for inactive version",
-				slog.F("template_version_id", ps.Preset.TemplateVersionID.String()),
-				slog.F("preset_id", ps.Preset.ID),
-				slog.F("count", len(canceledJobs)))
-		}
-		return nil
+		return c.cancelAndOrphanDeletePendingPrebuilds(ctx, ps.Preset.TemplateID, ps.Preset.TemplateVersionID, ps.Preset.ID)
 
 	default:
 		return xerrors.Errorf("unknown action type: %v", action.ActionType)
@@ -717,33 +708,100 @@ func (c *StoreReconciler) createPrebuiltWorkspace(ctx context.Context, prebuiltW
 		c.logger.Info(ctx, "attempting to create prebuild", slog.F("name", name),
 			slog.F("workspace_id", prebuiltWorkspaceID.String()), slog.F("preset_id", presetID.String()))
 
-		return c.provision(ctx, db, prebuiltWorkspaceID, template, presetID, database.WorkspaceTransitionStart, workspace)
+		return c.provision(ctx, db, prebuiltWorkspaceID, template, presetID, database.WorkspaceTransitionStart, workspace, DeprovisionModeNormal)
 	}, &database.TxOptions{
 		Isolation: sql.LevelRepeatableRead,
 		ReadOnly:  false,
 	})
 }
 
-func (c *StoreReconciler) deletePrebuiltWorkspace(ctx context.Context, prebuiltWorkspaceID uuid.UUID, templateID uuid.UUID, presetID uuid.UUID) error {
+// provisionDelete provisions a delete transition for a prebuilt workspace.
+//
+// If mode is DeprovisionModeOrphan, the builder will not send Terraform state to the provisioner.
+// This allows the workspace to be deleted even when no provisioners are available, and is safe
+// when no Terraform resources were actually created (e.g., for pending prebuilds that were canceled
+// before provisioning started).
+//
+// IMPORTANT: This function must be called within a database transaction. It does not create its own transaction.
+// The caller is responsible for managing the transaction boundary via db.InTx().
+func (c *StoreReconciler) provisionDelete(ctx context.Context, db database.Store, workspaceID uuid.UUID, templateID uuid.UUID, presetID uuid.UUID, mode DeprovisionMode) error {
+	workspace, err := db.GetWorkspaceByID(ctx, workspaceID)
+	if err != nil {
+		return xerrors.Errorf("get workspace by ID: %w", err)
+	}
+
+	template, err := db.GetTemplateByID(ctx, templateID)
+	if err != nil {
+		return xerrors.Errorf("failed to get template: %w", err)
+	}
+
+	if workspace.OwnerID != database.PrebuildsSystemUserID {
+		return xerrors.Errorf("prebuilt workspace is not owned by prebuild user anymore, probably it was claimed")
+	}
+
+	c.logger.Info(ctx, "attempting to delete prebuild", slog.F("orphan", mode.String()),
+		slog.F("name", workspace.Name), slog.F("workspace_id", workspaceID.String()), slog.F("preset_id", presetID.String()))
+
+	return c.provision(ctx, db, workspaceID, template, presetID,
+		database.WorkspaceTransitionDelete, workspace, mode)
+}
+
+// cancelAndOrphanDeletePendingPrebuilds cancels pending prebuild jobs from inactive template versions
+// and orphan-deletes their associated workspaces.
+//
+// The cancel operation uses a criteria-based update to ensure only jobs that are still pending at
+// execution time are canceled, avoiding race conditions where jobs may have transitioned to running.
+//
+// Since these jobs were never processed by a provisioner, no Terraform resources were created,
+// making it safe to orphan-delete the workspaces (skipping Terraform destroy).
+func (c *StoreReconciler) cancelAndOrphanDeletePendingPrebuilds(ctx context.Context, templateID uuid.UUID, templateVersionID uuid.UUID, presetID uuid.UUID) error {
 	return c.store.InTx(func(db database.Store) error {
-		workspace, err := db.GetWorkspaceByID(ctx, prebuiltWorkspaceID)
+		canceledJobs, err := db.UpdatePrebuildProvisionerJobWithCancel(
+			ctx,
+			database.UpdatePrebuildProvisionerJobWithCancelParams{
+				Now: c.clock.Now(),
+				PresetID: uuid.NullUUID{
+					UUID:  presetID,
+					Valid: true,
+				},
+			})
 		if err != nil {
-			return xerrors.Errorf("get workspace by ID: %w", err)
+			c.logger.Error(ctx, "failed to cancel pending prebuild jobs",
+				slog.F("template_id", templateID.String()),
+				slog.F("template_version_id", templateVersionID.String()),
+				slog.F("preset_id", presetID.String()),
+				slog.Error(err))
+			return err
 		}
 
-		template, err := db.GetTemplateByID(ctx, templateID)
-		if err != nil {
-			return xerrors.Errorf("failed to get template: %w", err)
+		if len(canceledJobs) > 0 {
+			c.logger.Info(ctx, "canceled pending prebuild jobs for inactive version",
+				slog.F("template_id", templateID.String()),
+				slog.F("template_version_id", templateVersionID.String()),
+				slog.F("preset_id", presetID.String()),
+				slog.F("count", len(canceledJobs)))
 		}
 
-		if workspace.OwnerID != database.PrebuildsSystemUserID {
-			return xerrors.Errorf("prebuilt workspace is not owned by prebuild user anymore, probably it was claimed")
+		var multiErr multierror.Error
+		for _, job := range canceledJobs {
+			err = c.provisionDelete(ctx, db, job.WorkspaceID, job.TemplateID, presetID, DeprovisionModeOrphan)
+			if err != nil {
+				c.logger.Error(ctx, "failed to orphan delete canceled prebuild",
+					slog.F("workspace_id", job.WorkspaceID.String()), slog.Error(err))
+				multiErr.Errors = append(multiErr.Errors, err)
+			}
 		}
 
-		c.logger.Info(ctx, "attempting to delete prebuild",
-			slog.F("workspace_id", prebuiltWorkspaceID.String()), slog.F("preset_id", presetID.String()))
+		return multiErr.ErrorOrNil()
+	}, &database.TxOptions{
+		Isolation: sql.LevelRepeatableRead,
+		ReadOnly:  false,
+	})
+}
 
-		return c.provision(ctx, db, prebuiltWorkspaceID, template, presetID, database.WorkspaceTransitionDelete, workspace)
+func (c *StoreReconciler) deletePrebuiltWorkspace(ctx context.Context, prebuiltWorkspaceID uuid.UUID, templateID uuid.UUID, presetID uuid.UUID) error {
+	return c.store.InTx(func(db database.Store) error {
+		return c.provisionDelete(ctx, db, prebuiltWorkspaceID, templateID, presetID, DeprovisionModeNormal)
 	}, &database.TxOptions{
 		Isolation: sql.LevelRepeatableRead,
 		ReadOnly:  false,
@@ -758,6 +816,7 @@ func (c *StoreReconciler) provision(
 	presetID uuid.UUID,
 	transition database.WorkspaceTransition,
 	workspace database.Workspace,
+	mode DeprovisionMode,
 ) error {
 	tvp, err := db.GetPresetParametersByTemplateVersionID(ctx, template.ActiveVersionID)
 	if err != nil {
@@ -795,6 +854,11 @@ func (c *StoreReconciler) provision(
 		builder = builder.RichParameterValues(params)
 	}
 
+	// Use orphan mode for deletes when no Terraform resources exist
+	if transition == database.WorkspaceTransitionDelete && mode == DeprovisionModeOrphan {
+		builder = builder.Orphan()
+	}
+
 	_, provisionerJob, _, err := builder.Build(
 		ctx,
 		db,
diff --git a/enterprise/coderd/prebuilds/reconcile_test.go b/enterprise/coderd/prebuilds/reconcile_test.go
index 33b99145d8e12..4b359ba9df429 100644
--- a/enterprise/coderd/prebuilds/reconcile_test.go
+++ b/enterprise/coderd/prebuilds/reconcile_test.go
@@ -204,7 +204,10 @@ func TestPrebuildReconciliation(t *testing.T) {
 			templateDeleted:         []bool{false},
 		},
 		{
-			name: "never attempt to interfere with active builds",
+			// TODO(ssncferreira): Investigate why the GetRunningPrebuiltWorkspaces query is returning 0 rows.
+			//   When a template version is inactive (templateVersionActive = false), any prebuilds in the
+			//   database.ProvisionerJobStatusRunning state should be deleted.
+			name: "never attempt to interfere with prebuilds from an active template version",
 			// The workspace builder does not allow scheduling a new build if there is already a build
 			// pending, running, or canceling. As such, we should never attempt to start, stop or delete
 			// such prebuilds. Rather, we should wait for the existing build to complete and reconcile
@@ -215,7 +218,7 @@ func TestPrebuildReconciliation(t *testing.T) {
 				database.ProvisionerJobStatusRunning,
 				database.ProvisionerJobStatusCanceling,
 			},
-			templateVersionActive:   []bool{true, false},
+			templateVersionActive:   []bool{true},
 			shouldDeleteOldPrebuild: ptr.To(false),
 			templateDeleted:         []bool{false},
 		},
@@ -2121,16 +2124,16 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 					},
 				}).SkipCreateTemplate().Do()
 
-				var workspace dbfake.WorkspaceResponse
+				var pendingWorkspace dbfake.WorkspaceResponse
 				if tt.activeTemplateVersion {
 					// Given: a prebuilt workspace, workspace build and respective provisioner job from an
 					// active template version
-					workspace = tt.setupBuild(t, db, client,
+					pendingWorkspace = tt.setupBuild(t, db, client,
 						owner.OrganizationID, templateID, activeTemplateVersion.TemplateVersion.ID, activePresetID)
 				} else {
 					// Given: a prebuilt workspace, workspace build and respective provisioner job from a
 					// non-active template version
-					workspace = tt.setupBuild(t, db, client,
+					pendingWorkspace = tt.setupBuild(t, db, client,
 						owner.OrganizationID, templateID, nonActiveTemplateVersion.TemplateVersion.ID, nonActivePresetID)
 				}
 
@@ -2145,15 +2148,28 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 				require.NoError(t, reconciler.ReconcileAll(ctx))
 
 				if tt.shouldCancel {
-					// Then: the prebuild related jobs from non-active version should be canceled
-					cancelledJob, err := db.GetProvisionerJobByID(ctx, workspace.Build.JobID)
+					// Then: the pending prebuild job from non-active version should be canceled
+					cancelledJob, err := db.GetProvisionerJobByID(ctx, pendingWorkspace.Build.JobID)
 					require.NoError(t, err)
 					require.Equal(t, clock.Now().UTC(), cancelledJob.CanceledAt.Time.UTC())
 					require.Equal(t, clock.Now().UTC(), cancelledJob.CompletedAt.Time.UTC())
 					require.Equal(t, database.ProvisionerJobStatusCanceled, cancelledJob.JobStatus)
+
+					// Then: the workspace should be deleted
+					deletedWorkspace, err := db.GetWorkspaceByID(ctx, pendingWorkspace.Workspace.ID)
+					require.NoError(t, err)
+					require.True(t, deletedWorkspace.Deleted)
+					latestBuild, err := db.GetLatestWorkspaceBuildByWorkspaceID(ctx, deletedWorkspace.ID)
+					require.NoError(t, err)
+					require.Equal(t, database.WorkspaceTransitionDelete, latestBuild.Transition)
+					deleteJob, err := db.GetProvisionerJobByID(ctx, latestBuild.JobID)
+					require.NoError(t, err)
+					require.True(t, deleteJob.CompletedAt.Valid)
+					require.False(t, deleteJob.WorkerID.Valid)
+					require.Equal(t, database.ProvisionerJobStatusSucceeded, deleteJob.JobStatus)
 				} else {
-					// Then: the provisioner job should not be canceled
-					job, err := db.GetProvisionerJobByID(ctx, workspace.Build.JobID)
+					// Then: the pending prebuild job should not be canceled
+					job, err := db.GetProvisionerJobByID(ctx, pendingWorkspace.Build.JobID)
 					require.NoError(t, err)
 					if !tt.previouslyCanceled {
 						require.Zero(t, job.CanceledAt.Time.UTC())
@@ -2162,6 +2178,11 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 					if !tt.previouslyCompleted {
 						require.Zero(t, job.CompletedAt.Time.UTC())
 					}
+
+					// Then: the workspace should not be deleted
+					workspace, err := db.GetWorkspaceByID(ctx, pendingWorkspace.Workspace.ID)
+					require.NoError(t, err)
+					require.False(t, workspace.Deleted)
 				}
 			})
 		}
@@ -2235,25 +2256,45 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 			return prebuilds
 		}
 
-		checkIfJobCanceled := func(
+		checkIfJobCanceledAndDeleted := func(
 			t *testing.T,
 			clock *quartz.Mock,
 			ctx context.Context,
 			db database.Store,
-			shouldBeCanceled bool,
+			shouldBeCanceledAndDeleted bool,
 			prebuilds []dbfake.WorkspaceResponse,
 		) {
 			for _, prebuild := range prebuilds {
-				job, err := db.GetProvisionerJobByID(ctx, prebuild.Build.JobID)
+				pendingJob, err := db.GetProvisionerJobByID(ctx, prebuild.Build.JobID)
 				require.NoError(t, err)
 
-				if shouldBeCanceled {
-					require.Equal(t, database.ProvisionerJobStatusCanceled, job.JobStatus)
-					require.Equal(t, clock.Now().UTC(), job.CanceledAt.Time.UTC())
-					require.Equal(t, clock.Now().UTC(), job.CompletedAt.Time.UTC())
+				if shouldBeCanceledAndDeleted {
+					// Pending job should be canceled
+					require.Equal(t, database.ProvisionerJobStatusCanceled, pendingJob.JobStatus)
+					require.Equal(t, clock.Now().UTC(), pendingJob.CanceledAt.Time.UTC())
+					require.Equal(t, clock.Now().UTC(), pendingJob.CompletedAt.Time.UTC())
+
+					// Workspace should be deleted
+					deletedWorkspace, err := db.GetWorkspaceByID(ctx, prebuild.Workspace.ID)
+					require.NoError(t, err)
+					require.True(t, deletedWorkspace.Deleted)
+					latestBuild, err := db.GetLatestWorkspaceBuildByWorkspaceID(ctx, deletedWorkspace.ID)
+					require.NoError(t, err)
+					require.Equal(t, database.WorkspaceTransitionDelete, latestBuild.Transition)
+					deleteJob, err := db.GetProvisionerJobByID(ctx, latestBuild.JobID)
+					require.NoError(t, err)
+					require.True(t, deleteJob.CompletedAt.Valid)
+					require.False(t, deleteJob.WorkerID.Valid)
+					require.Equal(t, database.ProvisionerJobStatusSucceeded, deleteJob.JobStatus)
 				} else {
-					require.NotEqual(t, database.ProvisionerJobStatusCanceled, job.JobStatus)
-					require.Zero(t, job.CanceledAt.Time.UTC())
+					// Pending job should not be canceled
+					require.NotEqual(t, database.ProvisionerJobStatusCanceled, pendingJob.JobStatus)
+					require.Zero(t, pendingJob.CanceledAt.Time.UTC())
+
+					// Workspace should not be deleted
+					workspace, err := db.GetWorkspaceByID(ctx, prebuild.Workspace.ID)
+					require.NoError(t, err)
+					require.False(t, workspace.Deleted)
 				}
 			}
 		}
@@ -2309,22 +2350,22 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 		require.NoError(t, reconciler.ReconcileAll(ctx))
 
 		// Then: template A version 1 running workspaces should not be canceled
-		checkIfJobCanceled(t, clock, ctx, db, false, templateAVersion1Running)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateAVersion1Running)
 		// Then: template A version 1 pending workspaces should be canceled
-		checkIfJobCanceled(t, clock, ctx, db, true, templateAVersion1Pending)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, true, templateAVersion1Pending)
 		// Then: template A version 2 running and pending workspaces should not be canceled
-		checkIfJobCanceled(t, clock, ctx, db, false, templateAVersion2Running)
-		checkIfJobCanceled(t, clock, ctx, db, false, templateAVersion2Pending)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateAVersion2Running)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateAVersion2Pending)
 
 		// Then: template B version 1 running workspaces should not be canceled
-		checkIfJobCanceled(t, clock, ctx, db, false, templateBVersion1Running)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateBVersion1Running)
 		// Then: template B version 1 pending workspaces should be canceled
-		checkIfJobCanceled(t, clock, ctx, db, true, templateBVersion1Pending)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, true, templateBVersion1Pending)
 		// Then: template B version 2 pending workspaces should be canceled
-		checkIfJobCanceled(t, clock, ctx, db, true, templateBVersion2Pending)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, true, templateBVersion2Pending)
 		// Then: template B version 3 running and pending workspaces should not be canceled
-		checkIfJobCanceled(t, clock, ctx, db, false, templateBVersion3Running)
-		checkIfJobCanceled(t, clock, ctx, db, false, templateBVersion3Pending)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateBVersion3Running)
+		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateBVersion3Pending)
 	})
 }
 

From 2cf4b5c5a2d5757e5a0986084789586b5322583c Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Thu, 30 Oct 2025 10:50:38 +0000
Subject: [PATCH 287/298] perf: optimize prebuilds membership reconciliation to
 check orgs not presets (#20493) (#20555)

Related to PR: https://github.com/coder/coder/pull/20493

(cherry picked from commit 7e8fcb4b0f3a7413ff10941e0e35b1f807566a04)
---
 coderd/database/dbauthz/dbauthz.go            |   7 +
 coderd/database/dbauthz/dbauthz_test.go       |   8 +
 coderd/database/dbmetrics/querymetrics.go     |   7 +
 coderd/database/dbmock/dbmock.go              |  15 +
 coderd/database/querier.go                    |   3 +
 coderd/database/queries.sql.go                |  87 ++++++
 coderd/database/queries/prebuilds.sql         |  44 +++
 enterprise/coderd/prebuilds/membership.go     | 148 +++++-----
 .../coderd/prebuilds/membership_test.go       | 278 +++++++++---------
 enterprise/coderd/prebuilds/reconcile.go      |  12 +-
 10 files changed, 397 insertions(+), 212 deletions(-)

diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index f169f7eeb13c1..1b2a6a5d97590 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -2649,6 +2649,13 @@ func (q *querier) GetOrganizationsByUserID(ctx context.Context, userID database.
 	return fetchWithPostFilter(q.auth, policy.ActionRead, q.db.GetOrganizationsByUserID)(ctx, userID)
 }
 
+func (q *querier) GetOrganizationsWithPrebuildStatus(ctx context.Context, arg database.GetOrganizationsWithPrebuildStatusParams) ([]database.GetOrganizationsWithPrebuildStatusRow, error) {
+	if err := q.authorizeContext(ctx, policy.ActionRead, rbac.ResourceOrganization.All()); err != nil {
+		return nil, err
+	}
+	return q.db.GetOrganizationsWithPrebuildStatus(ctx, arg)
+}
+
 func (q *querier) GetParameterSchemasByJobID(ctx context.Context, jobID uuid.UUID) ([]database.ParameterSchema, error) {
 	version, err := q.db.GetTemplateVersionByJobID(ctx, jobID)
 	if err != nil {
diff --git a/coderd/database/dbauthz/dbauthz_test.go b/coderd/database/dbauthz/dbauthz_test.go
index 63226271f7fa0..32c951fb5c20b 100644
--- a/coderd/database/dbauthz/dbauthz_test.go
+++ b/coderd/database/dbauthz/dbauthz_test.go
@@ -3759,6 +3759,14 @@ func (s *MethodTestSuite) TestPrebuilds() {
 		dbm.EXPECT().GetPrebuildMetrics(gomock.Any()).Return([]database.GetPrebuildMetricsRow{}, nil).AnyTimes()
 		check.Args().Asserts(rbac.ResourceWorkspace.All(), policy.ActionRead)
 	}))
+	s.Run("GetOrganizationsWithPrebuildStatus", s.Mocked(func(dbm *dbmock.MockStore, faker *gofakeit.Faker, check *expects) {
+		arg := database.GetOrganizationsWithPrebuildStatusParams{
+			UserID:    uuid.New(),
+			GroupName: "test",
+		}
+		dbm.EXPECT().GetOrganizationsWithPrebuildStatus(gomock.Any(), arg).Return([]database.GetOrganizationsWithPrebuildStatusRow{}, nil).AnyTimes()
+		check.Args(arg).Asserts(rbac.ResourceOrganization.All(), policy.ActionRead)
+	}))
 	s.Run("GetPrebuildsSettings", s.Mocked(func(dbm *dbmock.MockStore, _ *gofakeit.Faker, check *expects) {
 		dbm.EXPECT().GetPrebuildsSettings(gomock.Any()).Return("{}", nil).AnyTimes()
 		check.Args().Asserts()
diff --git a/coderd/database/dbmetrics/querymetrics.go b/coderd/database/dbmetrics/querymetrics.go
index 1b36a3fa987f2..252f6f9b5ad09 100644
--- a/coderd/database/dbmetrics/querymetrics.go
+++ b/coderd/database/dbmetrics/querymetrics.go
@@ -1243,6 +1243,13 @@ func (m queryMetricsStore) GetOrganizationsByUserID(ctx context.Context, userID
 	return organizations, err
 }
 
+func (m queryMetricsStore) GetOrganizationsWithPrebuildStatus(ctx context.Context, arg database.GetOrganizationsWithPrebuildStatusParams) ([]database.GetOrganizationsWithPrebuildStatusRow, error) {
+	start := time.Now()
+	r0, r1 := m.s.GetOrganizationsWithPrebuildStatus(ctx, arg)
+	m.queryLatencies.WithLabelValues("GetOrganizationsWithPrebuildStatus").Observe(time.Since(start).Seconds())
+	return r0, r1
+}
+
 func (m queryMetricsStore) GetParameterSchemasByJobID(ctx context.Context, jobID uuid.UUID) ([]database.ParameterSchema, error) {
 	start := time.Now()
 	schemas, err := m.s.GetParameterSchemasByJobID(ctx, jobID)
diff --git a/coderd/database/dbmock/dbmock.go b/coderd/database/dbmock/dbmock.go
index 0ecd0191cbce1..af89a987a3203 100644
--- a/coderd/database/dbmock/dbmock.go
+++ b/coderd/database/dbmock/dbmock.go
@@ -2622,6 +2622,21 @@ func (mr *MockStoreMockRecorder) GetOrganizationsByUserID(ctx, arg any) *gomock.
 	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOrganizationsByUserID", reflect.TypeOf((*MockStore)(nil).GetOrganizationsByUserID), ctx, arg)
 }
 
+// GetOrganizationsWithPrebuildStatus mocks base method.
+func (m *MockStore) GetOrganizationsWithPrebuildStatus(ctx context.Context, arg database.GetOrganizationsWithPrebuildStatusParams) ([]database.GetOrganizationsWithPrebuildStatusRow, error) {
+	m.ctrl.T.Helper()
+	ret := m.ctrl.Call(m, "GetOrganizationsWithPrebuildStatus", ctx, arg)
+	ret0, _ := ret[0].([]database.GetOrganizationsWithPrebuildStatusRow)
+	ret1, _ := ret[1].(error)
+	return ret0, ret1
+}
+
+// GetOrganizationsWithPrebuildStatus indicates an expected call of GetOrganizationsWithPrebuildStatus.
+func (mr *MockStoreMockRecorder) GetOrganizationsWithPrebuildStatus(ctx, arg any) *gomock.Call {
+	mr.mock.ctrl.T.Helper()
+	return mr.mock.ctrl.RecordCallWithMethodType(mr.mock, "GetOrganizationsWithPrebuildStatus", reflect.TypeOf((*MockStore)(nil).GetOrganizationsWithPrebuildStatus), ctx, arg)
+}
+
 // GetParameterSchemasByJobID mocks base method.
 func (m *MockStore) GetParameterSchemasByJobID(ctx context.Context, jobID uuid.UUID) ([]database.ParameterSchema, error) {
 	m.ctrl.T.Helper()
diff --git a/coderd/database/querier.go b/coderd/database/querier.go
index 2aa1cb8650051..b1a450939834d 100644
--- a/coderd/database/querier.go
+++ b/coderd/database/querier.go
@@ -269,6 +269,9 @@ type sqlcQuerier interface {
 	GetOrganizationResourceCountByID(ctx context.Context, organizationID uuid.UUID) (GetOrganizationResourceCountByIDRow, error)
 	GetOrganizations(ctx context.Context, arg GetOrganizationsParams) ([]Organization, error)
 	GetOrganizationsByUserID(ctx context.Context, arg GetOrganizationsByUserIDParams) ([]Organization, error)
+	// GetOrganizationsWithPrebuildStatus returns organizations with prebuilds configured and their
+	// membership status for the prebuilds system user (org membership, group existence, group membership).
+	GetOrganizationsWithPrebuildStatus(ctx context.Context, arg GetOrganizationsWithPrebuildStatusParams) ([]GetOrganizationsWithPrebuildStatusRow, error)
 	GetParameterSchemasByJobID(ctx context.Context, jobID uuid.UUID) ([]ParameterSchema, error)
 	GetPrebuildMetrics(ctx context.Context) ([]GetPrebuildMetricsRow, error)
 	GetPrebuildsSettings(ctx context.Context) (string, error)
diff --git a/coderd/database/queries.sql.go b/coderd/database/queries.sql.go
index 9a9c7d2629dd0..ff32a1126792d 100644
--- a/coderd/database/queries.sql.go
+++ b/coderd/database/queries.sql.go
@@ -8285,6 +8285,93 @@ func (q *sqlQuerier) FindMatchingPresetID(ctx context.Context, arg FindMatchingP
 	return template_version_preset_id, err
 }
 
+const getOrganizationsWithPrebuildStatus = `-- name: GetOrganizationsWithPrebuildStatus :many
+WITH orgs_with_prebuilds AS (
+	-- Get unique organizations that have presets with prebuilds configured
+	SELECT DISTINCT o.id, o.name
+	FROM organizations o
+	INNER JOIN templates t ON t.organization_id = o.id
+	INNER JOIN template_versions tv ON tv.template_id = t.id
+	INNER JOIN template_version_presets tvp ON tvp.template_version_id = tv.id
+	WHERE tvp.desired_instances IS NOT NULL
+),
+prebuild_user_membership AS (
+	-- Check if the user is a member of the organizations
+	SELECT om.organization_id
+	FROM organization_members om
+	INNER JOIN orgs_with_prebuilds owp ON owp.id = om.organization_id
+	WHERE om.user_id = $1::uuid
+),
+prebuild_groups AS (
+	-- Check if the organizations have the prebuilds group
+	SELECT g.organization_id, g.id as group_id
+	FROM groups g
+	INNER JOIN orgs_with_prebuilds owp ON owp.id = g.organization_id
+	WHERE g.name = $2::text
+),
+prebuild_group_membership AS (
+	-- Check if the user is in the prebuilds group
+	SELECT pg.organization_id
+	FROM prebuild_groups pg
+	INNER JOIN group_members gm ON gm.group_id = pg.group_id
+	WHERE gm.user_id = $1::uuid
+)
+SELECT
+	owp.id AS organization_id,
+	owp.name AS organization_name,
+	(pum.organization_id IS NOT NULL)::boolean AS has_prebuild_user,
+	pg.group_id AS prebuilds_group_id,
+	(pgm.organization_id IS NOT NULL)::boolean AS has_prebuild_user_in_group
+FROM orgs_with_prebuilds owp
+LEFT JOIN prebuild_groups pg ON pg.organization_id = owp.id
+LEFT JOIN prebuild_user_membership pum ON pum.organization_id = owp.id
+LEFT JOIN prebuild_group_membership pgm ON pgm.organization_id = owp.id
+`
+
+type GetOrganizationsWithPrebuildStatusParams struct {
+	UserID    uuid.UUID `db:"user_id" json:"user_id"`
+	GroupName string    `db:"group_name" json:"group_name"`
+}
+
+type GetOrganizationsWithPrebuildStatusRow struct {
+	OrganizationID         uuid.UUID     `db:"organization_id" json:"organization_id"`
+	OrganizationName       string        `db:"organization_name" json:"organization_name"`
+	HasPrebuildUser        bool          `db:"has_prebuild_user" json:"has_prebuild_user"`
+	PrebuildsGroupID       uuid.NullUUID `db:"prebuilds_group_id" json:"prebuilds_group_id"`
+	HasPrebuildUserInGroup bool          `db:"has_prebuild_user_in_group" json:"has_prebuild_user_in_group"`
+}
+
+// GetOrganizationsWithPrebuildStatus returns organizations with prebuilds configured and their
+// membership status for the prebuilds system user (org membership, group existence, group membership).
+func (q *sqlQuerier) GetOrganizationsWithPrebuildStatus(ctx context.Context, arg GetOrganizationsWithPrebuildStatusParams) ([]GetOrganizationsWithPrebuildStatusRow, error) {
+	rows, err := q.db.QueryContext(ctx, getOrganizationsWithPrebuildStatus, arg.UserID, arg.GroupName)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+	var items []GetOrganizationsWithPrebuildStatusRow
+	for rows.Next() {
+		var i GetOrganizationsWithPrebuildStatusRow
+		if err := rows.Scan(
+			&i.OrganizationID,
+			&i.OrganizationName,
+			&i.HasPrebuildUser,
+			&i.PrebuildsGroupID,
+			&i.HasPrebuildUserInGroup,
+		); err != nil {
+			return nil, err
+		}
+		items = append(items, i)
+	}
+	if err := rows.Close(); err != nil {
+		return nil, err
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+	return items, nil
+}
+
 const getPrebuildMetrics = `-- name: GetPrebuildMetrics :many
 SELECT
 	t.name as template_name,
diff --git a/coderd/database/queries/prebuilds.sql b/coderd/database/queries/prebuilds.sql
index 7c060971efba5..ae70593b269d9 100644
--- a/coderd/database/queries/prebuilds.sql
+++ b/coderd/database/queries/prebuilds.sql
@@ -327,3 +327,47 @@ SET
 FROM jobs_to_cancel
 WHERE provisioner_jobs.id = jobs_to_cancel.id
 RETURNING jobs_to_cancel.id, jobs_to_cancel.workspace_id, jobs_to_cancel.template_id, jobs_to_cancel.template_version_preset_id;
+
+-- name: GetOrganizationsWithPrebuildStatus :many
+-- GetOrganizationsWithPrebuildStatus returns organizations with prebuilds configured and their
+-- membership status for the prebuilds system user (org membership, group existence, group membership).
+WITH orgs_with_prebuilds AS (
+	-- Get unique organizations that have presets with prebuilds configured
+	SELECT DISTINCT o.id, o.name
+	FROM organizations o
+	INNER JOIN templates t ON t.organization_id = o.id
+	INNER JOIN template_versions tv ON tv.template_id = t.id
+	INNER JOIN template_version_presets tvp ON tvp.template_version_id = tv.id
+	WHERE tvp.desired_instances IS NOT NULL
+),
+prebuild_user_membership AS (
+	-- Check if the user is a member of the organizations
+	SELECT om.organization_id
+	FROM organization_members om
+	INNER JOIN orgs_with_prebuilds owp ON owp.id = om.organization_id
+	WHERE om.user_id = @user_id::uuid
+),
+prebuild_groups AS (
+	-- Check if the organizations have the prebuilds group
+	SELECT g.organization_id, g.id as group_id
+	FROM groups g
+	INNER JOIN orgs_with_prebuilds owp ON owp.id = g.organization_id
+	WHERE g.name = @group_name::text
+),
+prebuild_group_membership AS (
+	-- Check if the user is in the prebuilds group
+	SELECT pg.organization_id
+	FROM prebuild_groups pg
+	INNER JOIN group_members gm ON gm.group_id = pg.group_id
+	WHERE gm.user_id = @user_id::uuid
+)
+SELECT
+	owp.id AS organization_id,
+	owp.name AS organization_name,
+	(pum.organization_id IS NOT NULL)::boolean AS has_prebuild_user,
+	pg.group_id AS prebuilds_group_id,
+	(pgm.organization_id IS NOT NULL)::boolean AS has_prebuild_user_in_group
+FROM orgs_with_prebuilds owp
+LEFT JOIN prebuild_groups pg ON pg.organization_id = owp.id
+LEFT JOIN prebuild_user_membership pum ON pum.organization_id = owp.id
+LEFT JOIN prebuild_group_membership pgm ON pgm.organization_id = owp.id;
diff --git a/enterprise/coderd/prebuilds/membership.go b/enterprise/coderd/prebuilds/membership.go
index f843d33f7f106..9436f68737d4a 100644
--- a/enterprise/coderd/prebuilds/membership.go
+++ b/enterprise/coderd/prebuilds/membership.go
@@ -2,12 +2,13 @@ package prebuilds
 
 import (
 	"context"
-	"database/sql"
 	"errors"
 
 	"github.com/google/uuid"
 	"golang.org/x/xerrors"
 
+	"cdr.dev/slog"
+
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/quartz"
 )
@@ -21,114 +22,117 @@ const (
 // organizations for which prebuilt workspaces are requested. This is necessary because our data model requires that such
 // prebuilt workspaces belong to a member of the organization of their eventual claimant.
 type StoreMembershipReconciler struct {
-	store database.Store
-	clock quartz.Clock
+	store  database.Store
+	clock  quartz.Clock
+	logger slog.Logger
 }
 
-func NewStoreMembershipReconciler(store database.Store, clock quartz.Clock) StoreMembershipReconciler {
+func NewStoreMembershipReconciler(store database.Store, clock quartz.Clock, logger slog.Logger) StoreMembershipReconciler {
 	return StoreMembershipReconciler{
-		store: store,
-		clock: clock,
+		store:  store,
+		clock:  clock,
+		logger: logger,
 	}
 }
 
-// ReconcileAll compares the current organization and group memberships of a user to the memberships required
-// in order to create prebuilt workspaces. If the user in question is not yet a member of an organization that
-// needs prebuilt workspaces, ReconcileAll will create the membership required.
+// ReconcileAll ensures the prebuilds system user has the necessary memberships to create prebuilt workspaces.
+// For each organization with prebuilds configured, it ensures:
+// * The user is a member of the organization
+// * A group exists with quota 0
+// * The user is a member of that group
 //
-// To facilitate quota management, ReconcileAll will ensure:
-// * the existence of a group (defined by PrebuiltWorkspacesGroupName) in each organization that needs prebuilt workspaces
-// * that the prebuilds system user belongs to the group in each organization that needs prebuilt workspaces
-// * that the group has a quota of 0 by default, which users can adjust based on their needs.
+// Unique constraint violations are safely ignored (concurrent creation).
 //
 // ReconcileAll does not have an opinion on transaction or lock management. These responsibilities are left to the caller.
-func (s StoreMembershipReconciler) ReconcileAll(ctx context.Context, userID uuid.UUID, presets []database.GetTemplatePresetsWithPrebuildsRow) error {
-	organizationMemberships, err := s.store.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{
-		UserID: userID,
-		Deleted: sql.NullBool{
-			Bool:  false,
-			Valid: true,
-		},
+func (s StoreMembershipReconciler) ReconcileAll(ctx context.Context, userID uuid.UUID, groupName string) error {
+	orgStatuses, err := s.store.GetOrganizationsWithPrebuildStatus(ctx, database.GetOrganizationsWithPrebuildStatusParams{
+		UserID:    userID,
+		GroupName: groupName,
 	})
 	if err != nil {
-		return xerrors.Errorf("determine prebuild organization membership: %w", err)
-	}
-
-	orgMemberships := make(map[uuid.UUID]struct{}, 0)
-	defaultOrg, err := s.store.GetDefaultOrganization(ctx)
-	if err != nil {
-		return xerrors.Errorf("get default organization: %w", err)
-	}
-	orgMemberships[defaultOrg.ID] = struct{}{}
-	for _, o := range organizationMemberships {
-		orgMemberships[o.ID] = struct{}{}
+		return xerrors.Errorf("get organizations with prebuild status: %w", err)
 	}
 
 	var membershipInsertionErrors error
-	for _, preset := range presets {
-		_, alreadyOrgMember := orgMemberships[preset.OrganizationID]
-		if !alreadyOrgMember {
-			// Add the organization to our list of memberships regardless of potential failure below
-			// to avoid a retry that will probably be doomed anyway.
-			orgMemberships[preset.OrganizationID] = struct{}{}
+	for _, orgStatus := range orgStatuses {
+		s.logger.Debug(ctx, "organization prebuild status",
+			slog.F("organization_id", orgStatus.OrganizationID),
+			slog.F("organization_name", orgStatus.OrganizationName),
+			slog.F("has_prebuild_user", orgStatus.HasPrebuildUser),
+			slog.F("has_prebuild_group", orgStatus.PrebuildsGroupID.Valid),
+			slog.F("has_prebuild_user_in_group", orgStatus.HasPrebuildUserInGroup))
 
-			// Insert the missing membership
+		// Add user to org if needed
+		if !orgStatus.HasPrebuildUser {
 			_, err = s.store.InsertOrganizationMember(ctx, database.InsertOrganizationMemberParams{
-				OrganizationID: preset.OrganizationID,
+				OrganizationID: orgStatus.OrganizationID,
 				UserID:         userID,
 				CreatedAt:      s.clock.Now(),
 				UpdatedAt:      s.clock.Now(),
 				Roles:          []string{},
 			})
-			if err != nil {
-				membershipInsertionErrors = errors.Join(membershipInsertionErrors, xerrors.Errorf("insert membership for prebuilt workspaces: %w", err))
+			// Unique violation means organization membership was created after status check, safe to ignore.
+			if err != nil && !database.IsUniqueViolation(err) {
+				membershipInsertionErrors = errors.Join(membershipInsertionErrors, err)
 				continue
 			}
-		}
-
-		// determine whether the org already has a prebuilds group
-		prebuildsGroupExists := true
-		prebuildsGroup, err := s.store.GetGroupByOrgAndName(ctx, database.GetGroupByOrgAndNameParams{
-			OrganizationID: preset.OrganizationID,
-			Name:           PrebuiltWorkspacesGroupName,
-		})
-		if err != nil {
-			if !xerrors.Is(err, sql.ErrNoRows) {
-				membershipInsertionErrors = errors.Join(membershipInsertionErrors, xerrors.Errorf("get prebuilds group: %w", err))
-				continue
+			if err == nil {
+				s.logger.Info(ctx, "added prebuilds user to organization",
+					slog.F("organization_id", orgStatus.OrganizationID),
+					slog.F("organization_name", orgStatus.OrganizationName),
+					slog.F("prebuilds_user", userID.String()))
 			}
-			prebuildsGroupExists = false
 		}
 
-		// if the prebuilds group does not exist, create it
-		if !prebuildsGroupExists {
-			// create a "prebuilds" group in the organization and add the system user to it
-			// this group will have a quota of 0 by default, which users can adjust based on their needs
-			prebuildsGroup, err = s.store.InsertGroup(ctx, database.InsertGroupParams{
+		// Create group if it doesn't exist
+		var groupID uuid.UUID
+		if !orgStatus.PrebuildsGroupID.Valid {
+			// Group doesn't exist, create it
+			group, err := s.store.InsertGroup(ctx, database.InsertGroupParams{
 				ID:             uuid.New(),
 				Name:           PrebuiltWorkspacesGroupName,
 				DisplayName:    PrebuiltWorkspacesGroupDisplayName,
-				OrganizationID: preset.OrganizationID,
+				OrganizationID: orgStatus.OrganizationID,
 				AvatarURL:      "",
-				QuotaAllowance: 0, // Default quota of 0, users should set this based on their needs
+				QuotaAllowance: 0,
 			})
-			if err != nil {
-				membershipInsertionErrors = errors.Join(membershipInsertionErrors, xerrors.Errorf("create prebuilds group: %w", err))
+			// Unique violation means group was created after status check, safe to ignore.
+			if err != nil && !database.IsUniqueViolation(err) {
+				membershipInsertionErrors = errors.Join(membershipInsertionErrors, err)
 				continue
 			}
+			if err == nil {
+				s.logger.Info(ctx, "created prebuilds group in organization",
+					slog.F("organization_id", orgStatus.OrganizationID),
+					slog.F("organization_name", orgStatus.OrganizationName),
+					slog.F("prebuilds_group", group.ID.String()))
+			}
+			groupID = group.ID
+		} else {
+			// Group exists
+			groupID = orgStatus.PrebuildsGroupID.UUID
 		}
 
-		// add the system user to the prebuilds group
-		err = s.store.InsertGroupMember(ctx, database.InsertGroupMemberParams{
-			GroupID: prebuildsGroup.ID,
-			UserID:  userID,
-		})
-		if err != nil {
-			// ignore unique violation errors as the user might already be in the group
-			if !database.IsUniqueViolation(err) {
-				membershipInsertionErrors = errors.Join(membershipInsertionErrors, xerrors.Errorf("add system user to prebuilds group: %w", err))
+		// Add user to group if needed
+		if !orgStatus.HasPrebuildUserInGroup {
+			err = s.store.InsertGroupMember(ctx, database.InsertGroupMemberParams{
+				GroupID: groupID,
+				UserID:  userID,
+			})
+			// Unique violation means group membership was created after status check, safe to ignore.
+			if err != nil && !database.IsUniqueViolation(err) {
+				membershipInsertionErrors = errors.Join(membershipInsertionErrors, err)
+				continue
+			}
+			if err == nil {
+				s.logger.Info(ctx, "added prebuilds user to prebuilds group",
+					slog.F("organization_id", orgStatus.OrganizationID),
+					slog.F("organization_name", orgStatus.OrganizationName),
+					slog.F("prebuilds_user", userID.String()),
+					slog.F("prebuilds_group", groupID.String()))
 			}
 		}
 	}
+
 	return membershipInsertionErrors
 }
diff --git a/enterprise/coderd/prebuilds/membership_test.go b/enterprise/coderd/prebuilds/membership_test.go
index 55d6557b12495..fe4ec26259889 100644
--- a/enterprise/coderd/prebuilds/membership_test.go
+++ b/enterprise/coderd/prebuilds/membership_test.go
@@ -7,16 +7,17 @@ import (
 
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/require"
-	"tailscale.com/types/ptr"
 
-	"github.com/coder/quartz"
+	"cdr.dev/slog/sloggers/slogtest"
 
 	"github.com/coder/coder/v2/coderd/coderdtest"
 	"github.com/coder/coder/v2/coderd/database"
 	"github.com/coder/coder/v2/coderd/database/dbauthz"
+	"github.com/coder/coder/v2/coderd/database/dbfake"
 	"github.com/coder/coder/v2/coderd/database/dbgen"
 	"github.com/coder/coder/v2/enterprise/coderd/prebuilds"
 	"github.com/coder/coder/v2/testutil"
+	"github.com/coder/quartz"
 )
 
 // TestReconcileAll verifies that StoreMembershipReconciler correctly updates membership
@@ -26,169 +27,178 @@ func TestReconcileAll(t *testing.T) {
 
 	clock := quartz.NewMock(t)
 
-	// Helper to build a minimal Preset row belonging to a given org.
-	newPresetRow := func(orgID uuid.UUID) database.GetTemplatePresetsWithPrebuildsRow {
-		return database.GetTemplatePresetsWithPrebuildsRow{
-			ID:             uuid.New(),
-			OrganizationID: orgID,
-		}
-	}
-
 	tests := []struct {
 		name                       string
-		includePreset              []bool
+		includePreset              bool
 		preExistingOrgMembership   []bool
 		preExistingGroup           []bool
 		preExistingGroupMembership []bool
 		// Expected outcomes
-		expectOrgMembershipExists *bool
-		expectGroupExists         *bool
-		expectUserInGroup         *bool
+		expectOrgMembershipExists bool
+		expectGroupExists         bool
+		expectUserInGroup         bool
 	}{
 		{
 			name:                       "if there are no presets, membership reconciliation is a no-op",
-			includePreset:              []bool{false},
+			includePreset:              false,
 			preExistingOrgMembership:   []bool{true, false},
 			preExistingGroup:           []bool{true, false},
 			preExistingGroupMembership: []bool{true, false},
-			expectOrgMembershipExists:  ptr.To(false),
-			expectGroupExists:          ptr.To(false),
+			expectOrgMembershipExists:  false,
+			expectGroupExists:          false,
+			expectUserInGroup:          false,
 		},
 		{
 			name:                       "if there is a preset, then we should enforce org and group membership in all cases",
-			includePreset:              []bool{true},
+			includePreset:              true,
 			preExistingOrgMembership:   []bool{true, false},
 			preExistingGroup:           []bool{true, false},
 			preExistingGroupMembership: []bool{true, false},
-			expectOrgMembershipExists:  ptr.To(true),
-			expectGroupExists:          ptr.To(true),
-			expectUserInGroup:          ptr.To(true),
+			expectOrgMembershipExists:  true,
+			expectGroupExists:          true,
+			expectUserInGroup:          true,
 		},
 	}
 
 	for _, tc := range tests {
 		tc := tc
-		for _, includePreset := range tc.includePreset {
-			includePreset := includePreset
-			for _, preExistingOrgMembership := range tc.preExistingOrgMembership {
-				preExistingOrgMembership := preExistingOrgMembership
-				for _, preExistingGroup := range tc.preExistingGroup {
-					preExistingGroup := preExistingGroup
-					for _, preExistingGroupMembership := range tc.preExistingGroupMembership {
-						preExistingGroupMembership := preExistingGroupMembership
-						t.Run(tc.name, func(t *testing.T) {
-							t.Parallel()
-
-							// nolint:gocritic // Reconciliation happens as prebuilds system user, not a human user.
-							ctx := dbauthz.AsPrebuildsOrchestrator(testutil.Context(t, testutil.WaitLong))
-							_, db := coderdtest.NewWithDatabase(t, nil)
-
-							defaultOrg, err := db.GetDefaultOrganization(ctx)
-							require.NoError(t, err)
-
-							// introduce an unrelated organization to ensure that the membership reconciler doesn't interfere with it.
-							unrelatedOrg := dbgen.Organization(t, db, database.Organization{})
-							targetOrg := dbgen.Organization(t, db, database.Organization{})
-
-							// Ensure membership to unrelated org.
-							dbgen.OrganizationMember(t, db, database.OrganizationMember{OrganizationID: unrelatedOrg.ID, UserID: database.PrebuildsSystemUserID})
-
-							if preExistingOrgMembership {
-								// System user already a member of both orgs.
-								dbgen.OrganizationMember(t, db, database.OrganizationMember{OrganizationID: targetOrg.ID, UserID: database.PrebuildsSystemUserID})
-							}
+		includePreset := tc.includePreset
+		for _, preExistingOrgMembership := range tc.preExistingOrgMembership {
+			preExistingOrgMembership := preExistingOrgMembership
+			for _, preExistingGroup := range tc.preExistingGroup {
+				preExistingGroup := preExistingGroup
+				for _, preExistingGroupMembership := range tc.preExistingGroupMembership {
+					preExistingGroupMembership := preExistingGroupMembership
+					t.Run(tc.name, func(t *testing.T) {
+						t.Parallel()
+
+						// nolint:gocritic // Reconciliation happens as prebuilds system user, not a human user.
+						ctx := dbauthz.AsPrebuildsOrchestrator(testutil.Context(t, testutil.WaitLong))
+						client, db := coderdtest.NewWithDatabase(t, nil)
+						owner := coderdtest.CreateFirstUser(t, client)
+
+						defaultOrg, err := db.GetDefaultOrganization(ctx)
+						require.NoError(t, err)
+
+						// Introduce an unrelated organization to ensure that the membership reconciler doesn't interfere with it.
+						unrelatedOrg := dbgen.Organization(t, db, database.Organization{})
+						dbgen.OrganizationMember(t, db, database.OrganizationMember{OrganizationID: unrelatedOrg.ID, UserID: database.PrebuildsSystemUserID})
+
+						// Organization to test
+						targetOrg := dbgen.Organization(t, db, database.Organization{})
+
+						// Prebuilds system user is a member of the organization
+						if preExistingOrgMembership {
+							dbgen.OrganizationMember(t, db, database.OrganizationMember{OrganizationID: targetOrg.ID, UserID: database.PrebuildsSystemUserID})
+						}
+
+						// Organization has the prebuilds group
+						var prebuildsGroup database.Group
+						if preExistingGroup {
+							prebuildsGroup = dbgen.Group(t, db, database.Group{
+								Name:           prebuilds.PrebuiltWorkspacesGroupName,
+								DisplayName:    prebuilds.PrebuiltWorkspacesGroupDisplayName,
+								OrganizationID: targetOrg.ID,
+								QuotaAllowance: 0,
+							})
 
-							// Create pre-existing prebuilds group if required by test case
-							var prebuildsGroup database.Group
-							if preExistingGroup {
-								prebuildsGroup = dbgen.Group(t, db, database.Group{
-									Name:           prebuilds.PrebuiltWorkspacesGroupName,
-									DisplayName:    prebuilds.PrebuiltWorkspacesGroupDisplayName,
-									OrganizationID: targetOrg.ID,
-									QuotaAllowance: 0,
+							// Add the system user to the group if required by test case
+							if preExistingGroupMembership {
+								dbgen.GroupMember(t, db, database.GroupMemberTable{
+									GroupID: prebuildsGroup.ID,
+									UserID:  database.PrebuildsSystemUserID,
 								})
-
-								// Add the system user to the group if preExistingGroupMembership is true
-								if preExistingGroupMembership {
-									dbgen.GroupMember(t, db, database.GroupMemberTable{
-										GroupID: prebuildsGroup.ID,
-										UserID:  database.PrebuildsSystemUserID,
-									})
-								}
 							}
-
-							presets := []database.GetTemplatePresetsWithPrebuildsRow{newPresetRow(unrelatedOrg.ID)}
-							if includePreset {
-								presets = append(presets, newPresetRow(targetOrg.ID))
-							}
-
-							// Verify memberships before reconciliation.
-							preReconcileMemberships, err := db.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{
-								UserID: database.PrebuildsSystemUserID,
-							})
-							require.NoError(t, err)
-							expectedMembershipsBefore := []uuid.UUID{defaultOrg.ID, unrelatedOrg.ID}
-							if preExistingOrgMembership {
-								expectedMembershipsBefore = append(expectedMembershipsBefore, targetOrg.ID)
-							}
-							require.ElementsMatch(t, expectedMembershipsBefore, extractOrgIDs(preReconcileMemberships))
-
-							// Reconcile
-							reconciler := prebuilds.NewStoreMembershipReconciler(db, clock)
-							require.NoError(t, reconciler.ReconcileAll(ctx, database.PrebuildsSystemUserID, presets))
-
-							// Verify memberships after reconciliation.
-							postReconcileMemberships, err := db.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{
-								UserID: database.PrebuildsSystemUserID,
-							})
+						}
+
+						// Setup unrelated org preset
+						dbfake.TemplateVersion(t, db).Seed(database.TemplateVersion{
+							OrganizationID: unrelatedOrg.ID,
+							CreatedBy:      owner.UserID,
+						}).Preset(database.TemplateVersionPreset{
+							DesiredInstances: sql.NullInt32{
+								Int32: 1,
+								Valid: true,
+							},
+						}).Do()
+
+						// Setup target org preset
+						dbfake.TemplateVersion(t, db).Seed(database.TemplateVersion{
+							OrganizationID: targetOrg.ID,
+							CreatedBy:      owner.UserID,
+						}).Preset(database.TemplateVersionPreset{
+							DesiredInstances: sql.NullInt32{
+								Int32: 0,
+								Valid: includePreset,
+							},
+						}).Do()
+
+						// Verify memberships before reconciliation.
+						preReconcileMemberships, err := db.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{
+							UserID: database.PrebuildsSystemUserID,
+						})
+						require.NoError(t, err)
+						expectedMembershipsBefore := []uuid.UUID{defaultOrg.ID, unrelatedOrg.ID}
+						if preExistingOrgMembership {
+							expectedMembershipsBefore = append(expectedMembershipsBefore, targetOrg.ID)
+						}
+						require.ElementsMatch(t, expectedMembershipsBefore, extractOrgIDs(preReconcileMemberships))
+
+						// Reconcile
+						reconciler := prebuilds.NewStoreMembershipReconciler(db, clock, slogtest.Make(t, nil))
+						require.NoError(t, reconciler.ReconcileAll(ctx, database.PrebuildsSystemUserID, prebuilds.PrebuiltWorkspacesGroupName))
+
+						// Verify memberships after reconciliation.
+						postReconcileMemberships, err := db.GetOrganizationsByUserID(ctx, database.GetOrganizationsByUserIDParams{
+							UserID: database.PrebuildsSystemUserID,
+						})
+						require.NoError(t, err)
+						expectedMembershipsAfter := expectedMembershipsBefore
+						if !preExistingOrgMembership && tc.expectOrgMembershipExists {
+							expectedMembershipsAfter = append(expectedMembershipsAfter, targetOrg.ID)
+						}
+						require.ElementsMatch(t, expectedMembershipsAfter, extractOrgIDs(postReconcileMemberships))
+
+						// Verify prebuilds group behavior based on expected outcomes
+						prebuildsGroup, err = db.GetGroupByOrgAndName(ctx, database.GetGroupByOrgAndNameParams{
+							OrganizationID: targetOrg.ID,
+							Name:           prebuilds.PrebuiltWorkspacesGroupName,
+						})
+						if tc.expectGroupExists {
 							require.NoError(t, err)
-							expectedMembershipsAfter := expectedMembershipsBefore
-							if !preExistingOrgMembership && tc.expectOrgMembershipExists != nil && *tc.expectOrgMembershipExists {
-								expectedMembershipsAfter = append(expectedMembershipsAfter, targetOrg.ID)
-							}
-							require.ElementsMatch(t, expectedMembershipsAfter, extractOrgIDs(postReconcileMemberships))
-
-							// Verify prebuilds group behavior based on expected outcomes
-							prebuildsGroup, err = db.GetGroupByOrgAndName(ctx, database.GetGroupByOrgAndNameParams{
-								OrganizationID: targetOrg.ID,
-								Name:           prebuilds.PrebuiltWorkspacesGroupName,
-							})
-							if tc.expectGroupExists != nil && *tc.expectGroupExists {
+							require.Equal(t, prebuilds.PrebuiltWorkspacesGroupName, prebuildsGroup.Name)
+							require.Equal(t, prebuilds.PrebuiltWorkspacesGroupDisplayName, prebuildsGroup.DisplayName)
+							require.Equal(t, int32(0), prebuildsGroup.QuotaAllowance) // Default quota should be 0
+
+							if tc.expectUserInGroup {
+								// Check that the system user is a member of the prebuilds group
+								groupMembers, err := db.GetGroupMembersByGroupID(ctx, database.GetGroupMembersByGroupIDParams{
+									GroupID:       prebuildsGroup.ID,
+									IncludeSystem: true,
+								})
 								require.NoError(t, err)
-								require.Equal(t, prebuilds.PrebuiltWorkspacesGroupName, prebuildsGroup.Name)
-								require.Equal(t, prebuilds.PrebuiltWorkspacesGroupDisplayName, prebuildsGroup.DisplayName)
-								require.Equal(t, int32(0), prebuildsGroup.QuotaAllowance) // Default quota should be 0
-
-								if tc.expectUserInGroup != nil && *tc.expectUserInGroup {
-									// Check that the system user is a member of the prebuilds group
-									groupMembers, err := db.GetGroupMembersByGroupID(ctx, database.GetGroupMembersByGroupIDParams{
-										GroupID:       prebuildsGroup.ID,
-										IncludeSystem: true,
-									})
-									require.NoError(t, err)
-									require.Len(t, groupMembers, 1)
-									require.Equal(t, database.PrebuildsSystemUserID, groupMembers[0].UserID)
-								}
-
-								// If no preset exists, then we do not enforce group membership:
-								if tc.expectUserInGroup != nil && !*tc.expectUserInGroup {
-									// Check that the system user is NOT a member of the prebuilds group
-									groupMembers, err := db.GetGroupMembersByGroupID(ctx, database.GetGroupMembersByGroupIDParams{
-										GroupID:       prebuildsGroup.ID,
-										IncludeSystem: true,
-									})
-									require.NoError(t, err)
-									require.Len(t, groupMembers, 0)
-								}
+								require.Len(t, groupMembers, 1)
+								require.Equal(t, database.PrebuildsSystemUserID, groupMembers[0].UserID)
 							}
 
-							if !preExistingGroup && tc.expectGroupExists != nil && !*tc.expectGroupExists {
-								// Verify that no prebuilds group exists
-								require.Error(t, err)
-								require.True(t, errors.Is(err, sql.ErrNoRows))
+							// If no preset exists, then we do not enforce group membership:
+							if !tc.expectUserInGroup {
+								// Check that the system user is NOT a member of the prebuilds group
+								groupMembers, err := db.GetGroupMembersByGroupID(ctx, database.GetGroupMembersByGroupIDParams{
+									GroupID:       prebuildsGroup.ID,
+									IncludeSystem: true,
+								})
+								require.NoError(t, err)
+								require.Len(t, groupMembers, 0)
 							}
-						})
-					}
+						}
+
+						if !preExistingGroup && !tc.expectGroupExists {
+							// Verify that no prebuilds group exists
+							require.Error(t, err)
+							require.True(t, errors.Is(err, sql.ErrNoRows))
+						}
+					})
 				}
 			}
 		}
diff --git a/enterprise/coderd/prebuilds/reconcile.go b/enterprise/coderd/prebuilds/reconcile.go
index 5e5eec68ab382..0e658e887b097 100644
--- a/enterprise/coderd/prebuilds/reconcile.go
+++ b/enterprise/coderd/prebuilds/reconcile.go
@@ -298,6 +298,12 @@ func (c *StoreReconciler) ReconcileAll(ctx context.Context) error {
 			return nil
 		}
 
+		membershipReconciler := NewStoreMembershipReconciler(c.store, c.clock, logger)
+		err = membershipReconciler.ReconcileAll(ctx, database.PrebuildsSystemUserID, PrebuiltWorkspacesGroupName)
+		if err != nil {
+			return xerrors.Errorf("reconcile prebuild membership: %w", err)
+		}
+
 		snapshot, err := c.SnapshotState(ctx, c.store)
 		if err != nil {
 			return xerrors.Errorf("determine current snapshot: %w", err)
@@ -310,12 +316,6 @@ func (c *StoreReconciler) ReconcileAll(ctx context.Context) error {
 			return nil
 		}
 
-		membershipReconciler := NewStoreMembershipReconciler(c.store, c.clock)
-		err = membershipReconciler.ReconcileAll(ctx, database.PrebuildsSystemUserID, snapshot.Presets)
-		if err != nil {
-			return xerrors.Errorf("reconcile prebuild membership: %w", err)
-		}
-
 		var eg errgroup.Group
 		// Reconcile presets in parallel. Each preset in its own goroutine.
 		for _, preset := range snapshot.Presets {

From 64240931467d18b7d40275327654986a2040b70d Mon Sep 17 00:00:00 2001
From: Susana Ferreira <susana@coder.com>
Date: Thu, 30 Oct 2025 12:16:19 +0000
Subject: [PATCH 288/298] feat: add prebuilds reconciliation duration metric
 (#20535) (#20581)

Related to PR: https://github.com/coder/coder/pull/20535

(cherry picked from commit aad1b401c12b287c5a33389db991e8e68c92c358)
---
 coderd/prebuilds/api.go                       |   7 +-
 coderd/prebuilds/noop.go                      |   6 +-
 .../coderd/prebuilds/metricscollector_test.go |   6 +-
 enterprise/coderd/prebuilds/reconcile.go      |  36 +++++--
 enterprise/coderd/prebuilds/reconcile_test.go | 101 ++++++++++++++----
 5 files changed, 125 insertions(+), 31 deletions(-)

diff --git a/coderd/prebuilds/api.go b/coderd/prebuilds/api.go
index ed39f2a322776..0deab99416fd5 100644
--- a/coderd/prebuilds/api.go
+++ b/coderd/prebuilds/api.go
@@ -37,13 +37,18 @@ type ReconciliationOrchestrator interface {
 	TrackResourceReplacement(ctx context.Context, workspaceID, buildID uuid.UUID, replacements []*sdkproto.ResourceReplacement)
 }
 
+// ReconcileStats contains statistics about a reconciliation cycle.
+type ReconcileStats struct {
+	Elapsed time.Duration
+}
+
 type Reconciler interface {
 	StateSnapshotter
 
 	// ReconcileAll orchestrates the reconciliation of all prebuilds across all templates.
 	// It takes a global snapshot of the system state and then reconciles each preset
 	// in parallel, creating or deleting prebuilds as needed to reach their desired states.
-	ReconcileAll(ctx context.Context) error
+	ReconcileAll(ctx context.Context) (ReconcileStats, error)
 }
 
 // StateSnapshotter defines the operations necessary to capture workspace prebuilds state.
diff --git a/coderd/prebuilds/noop.go b/coderd/prebuilds/noop.go
index 170b0a12af6fd..0859d428b4796 100644
--- a/coderd/prebuilds/noop.go
+++ b/coderd/prebuilds/noop.go
@@ -17,7 +17,11 @@ func (NoopReconciler) Run(context.Context)         {}
 func (NoopReconciler) Stop(context.Context, error) {}
 func (NoopReconciler) TrackResourceReplacement(context.Context, uuid.UUID, uuid.UUID, []*sdkproto.ResourceReplacement) {
 }
-func (NoopReconciler) ReconcileAll(context.Context) error { return nil }
+
+func (NoopReconciler) ReconcileAll(context.Context) (ReconcileStats, error) {
+	return ReconcileStats{}, nil
+}
+
 func (NoopReconciler) SnapshotState(context.Context, database.Store) (*GlobalSnapshot, error) {
 	return &GlobalSnapshot{}, nil
 }
diff --git a/enterprise/coderd/prebuilds/metricscollector_test.go b/enterprise/coderd/prebuilds/metricscollector_test.go
index f9584e9ec2c25..aa9886fb7ad1b 100644
--- a/enterprise/coderd/prebuilds/metricscollector_test.go
+++ b/enterprise/coderd/prebuilds/metricscollector_test.go
@@ -485,7 +485,7 @@ func TestMetricsCollector_ReconciliationPausedMetric(t *testing.T) {
 		require.NoError(t, err)
 
 		// Run reconciliation to update the metric
-		err = reconciler.ReconcileAll(ctx)
+		_, err = reconciler.ReconcileAll(ctx)
 		require.NoError(t, err)
 
 		// Check that the metric shows reconciliation is not paused
@@ -514,7 +514,7 @@ func TestMetricsCollector_ReconciliationPausedMetric(t *testing.T) {
 		require.NoError(t, err)
 
 		// Run reconciliation to update the metric
-		err = reconciler.ReconcileAll(ctx)
+		_, err = reconciler.ReconcileAll(ctx)
 		require.NoError(t, err)
 
 		// Check that the metric shows reconciliation is paused
@@ -543,7 +543,7 @@ func TestMetricsCollector_ReconciliationPausedMetric(t *testing.T) {
 		require.NoError(t, err)
 
 		// Run reconciliation to update the metric
-		err = reconciler.ReconcileAll(ctx)
+		_, err = reconciler.ReconcileAll(ctx)
 		require.NoError(t, err)
 
 		// Check that the metric shows reconciliation is not paused
diff --git a/enterprise/coderd/prebuilds/reconcile.go b/enterprise/coderd/prebuilds/reconcile.go
index 0e658e887b097..f280436ea98c8 100644
--- a/enterprise/coderd/prebuilds/reconcile.go
+++ b/enterprise/coderd/prebuilds/reconcile.go
@@ -15,6 +15,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/hashicorp/go-multierror"
 	"github.com/prometheus/client_golang/prometheus"
+	"github.com/prometheus/client_golang/prometheus/promauto"
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/xerrors"
 
@@ -44,7 +45,6 @@ type StoreReconciler struct {
 	logger            slog.Logger
 	clock             quartz.Clock
 	registerer        prometheus.Registerer
-	metrics           *MetricsCollector
 	notifEnq          notifications.Enqueuer
 	buildUsageChecker *atomic.Pointer[wsbuilder.UsageChecker]
 
@@ -53,6 +53,11 @@ type StoreReconciler struct {
 	stopped           atomic.Bool
 	done              chan struct{}
 	provisionNotifyCh chan database.ProvisionerJob
+
+	// Prebuild state metrics
+	metrics *MetricsCollector
+	// Operational metrics
+	reconciliationDuration prometheus.Histogram
 }
 
 var _ prebuilds.ReconciliationOrchestrator = &StoreReconciler{}
@@ -105,6 +110,15 @@ func NewStoreReconciler(store database.Store,
 			// If the registerer fails to register the metrics collector, it's not fatal.
 			logger.Error(context.Background(), "failed to register prometheus metrics", slog.Error(err))
 		}
+
+		factory := promauto.With(registerer)
+		reconciler.reconciliationDuration = factory.NewHistogram(prometheus.HistogramOpts{
+			Namespace: "coderd",
+			Subsystem: "prebuilds",
+			Name:      "reconciliation_duration_seconds",
+			Help:      "Duration of each prebuilds reconciliation cycle.",
+			Buckets:   prometheus.DefBuckets,
+		})
 	}
 
 	return reconciler
@@ -176,10 +190,15 @@ func (c *StoreReconciler) Run(ctx context.Context) {
 		//		 instead of waiting for the next reconciliation interval
 		case <-ticker.C:
 			// Trigger a new iteration on each tick.
-			err := c.ReconcileAll(ctx)
+			stats, err := c.ReconcileAll(ctx)
 			if err != nil {
 				c.logger.Error(context.Background(), "reconciliation failed", slog.Error(err))
 			}
+
+			if c.reconciliationDuration != nil {
+				c.reconciliationDuration.Observe(stats.Elapsed.Seconds())
+			}
+			c.logger.Debug(ctx, "reconciliation stats", slog.F("elapsed", stats.Elapsed))
 		case <-ctx.Done():
 			// nolint:gocritic // it's okay to use slog.F() for an error in this case
 			// because we want to differentiate two different types of errors: ctx.Err() and context.Cause()
@@ -263,19 +282,24 @@ func (c *StoreReconciler) Stop(ctx context.Context, cause error) {
 // be reconciled again, leading to another workspace being provisioned. Two workspace builds will be occurring
 // simultaneously for the same preset, but once both jobs have completed the reconciliation loop will notice the
 // extraneous instance and delete it.
-func (c *StoreReconciler) ReconcileAll(ctx context.Context) error {
+func (c *StoreReconciler) ReconcileAll(ctx context.Context) (stats prebuilds.ReconcileStats, err error) {
+	start := c.clock.Now()
+	defer func() {
+		stats.Elapsed = c.clock.Since(start)
+	}()
+
 	logger := c.logger.With(slog.F("reconcile_context", "all"))
 
 	select {
 	case <-ctx.Done():
 		logger.Warn(context.Background(), "reconcile exiting prematurely; context done", slog.Error(ctx.Err()))
-		return nil
+		return stats, nil
 	default:
 	}
 
 	logger.Debug(ctx, "starting reconciliation")
 
-	err := c.WithReconciliationLock(ctx, logger, func(ctx context.Context, _ database.Store) error {
+	err = c.WithReconciliationLock(ctx, logger, func(ctx context.Context, _ database.Store) error {
 		// Check if prebuilds reconciliation is paused
 		settingsJSON, err := c.store.GetPrebuildsSettings(ctx)
 		if err != nil {
@@ -348,7 +372,7 @@ func (c *StoreReconciler) ReconcileAll(ctx context.Context) error {
 		logger.Error(ctx, "failed to reconcile", slog.Error(err))
 	}
 
-	return err
+	return stats, err
 }
 
 func (c *StoreReconciler) reportHardLimitedPresets(snapshot *prebuilds.GlobalSnapshot) {
diff --git a/enterprise/coderd/prebuilds/reconcile_test.go b/enterprise/coderd/prebuilds/reconcile_test.go
index 4b359ba9df429..7548faebd7dab 100644
--- a/enterprise/coderd/prebuilds/reconcile_test.go
+++ b/enterprise/coderd/prebuilds/reconcile_test.go
@@ -72,7 +72,8 @@ func TestNoReconciliationActionsIfNoPresets(t *testing.T) {
 	require.Equal(t, templateVersion, gotTemplateVersion)
 
 	// when we trigger the reconciliation loop for all templates
-	require.NoError(t, controller.ReconcileAll(ctx))
+	_, err = controller.ReconcileAll(ctx)
+	require.NoError(t, err)
 
 	// then no reconciliation actions are taken
 	// because without presets, there are no prebuilds
@@ -126,7 +127,8 @@ func TestNoReconciliationActionsIfNoPrebuilds(t *testing.T) {
 	require.NotEmpty(t, presetParameters)
 
 	// when we trigger the reconciliation loop for all templates
-	require.NoError(t, controller.ReconcileAll(ctx))
+	_, err = controller.ReconcileAll(ctx)
+	require.NoError(t, err)
 
 	// then no reconciliation actions are taken
 	// because without prebuilds, there is nothing to reconcile
@@ -428,7 +430,8 @@ func (tc testCase) run(t *testing.T) {
 		// Run the reconciliation multiple times to ensure idempotency
 		// 8 was arbitrary, but large enough to reasonably trust the result
 		for i := 1; i <= 8; i++ {
-			require.NoErrorf(t, controller.ReconcileAll(ctx), "failed on iteration %d", i)
+			_, err := controller.ReconcileAll(ctx)
+			require.NoErrorf(t, err, "failed on iteration %d", i)
 
 			if tc.shouldCreateNewPrebuild != nil {
 				newPrebuildCount := 0
@@ -542,7 +545,8 @@ func TestMultiplePresetsPerTemplateVersion(t *testing.T) {
 	// Run the reconciliation multiple times to ensure idempotency
 	// 8 was arbitrary, but large enough to reasonably trust the result
 	for i := 1; i <= 8; i++ {
-		require.NoErrorf(t, controller.ReconcileAll(ctx), "failed on iteration %d", i)
+		_, err := controller.ReconcileAll(ctx)
+		require.NoErrorf(t, err, "failed on iteration %d", i)
 
 		newPrebuildCount := 0
 		workspaces, err := db.GetWorkspacesByTemplateID(ctx, template.ID)
@@ -668,7 +672,7 @@ func TestPrebuildScheduling(t *testing.T) {
 				DesiredInstances: 5,
 			})
 
-			err := controller.ReconcileAll(ctx)
+			_, err := controller.ReconcileAll(ctx)
 			require.NoError(t, err)
 
 			// get workspace builds
@@ -751,7 +755,8 @@ func TestInvalidPreset(t *testing.T) {
 	// Run the reconciliation multiple times to ensure idempotency
 	// 8 was arbitrary, but large enough to reasonably trust the result
 	for i := 1; i <= 8; i++ {
-		require.NoErrorf(t, controller.ReconcileAll(ctx), "failed on iteration %d", i)
+		_, err := controller.ReconcileAll(ctx)
+		require.NoErrorf(t, err, "failed on iteration %d", i)
 
 		workspaces, err := db.GetWorkspacesByTemplateID(ctx, template.ID)
 		require.NoError(t, err)
@@ -817,7 +822,8 @@ func TestDeletionOfPrebuiltWorkspaceWithInvalidPreset(t *testing.T) {
 	})
 
 	// Old prebuilt workspace should be deleted.
-	require.NoError(t, controller.ReconcileAll(ctx))
+	_, err = controller.ReconcileAll(ctx)
+	require.NoError(t, err)
 
 	builds, err := db.GetWorkspaceBuildsByWorkspaceID(ctx, database.GetWorkspaceBuildsByWorkspaceIDParams{
 		WorkspaceID: prebuiltWorkspace.ID,
@@ -916,12 +922,15 @@ func TestSkippingHardLimitedPresets(t *testing.T) {
 
 			// Trigger reconciliation to attempt creating a new prebuild.
 			// The outcome depends on whether the hard limit has been reached.
-			require.NoError(t, controller.ReconcileAll(ctx))
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
 
 			// These two additional calls to ReconcileAll should not trigger any notifications.
 			// A notification is only sent once.
-			require.NoError(t, controller.ReconcileAll(ctx))
-			require.NoError(t, controller.ReconcileAll(ctx))
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
 
 			// Verify the final state after reconciliation.
 			workspaces, err = db.GetWorkspacesByTemplateID(ctx, template.ID)
@@ -1093,12 +1102,15 @@ func TestHardLimitedPresetShouldNotBlockDeletion(t *testing.T) {
 
 			// Trigger reconciliation to attempt creating a new prebuild.
 			// The outcome depends on whether the hard limit has been reached.
-			require.NoError(t, controller.ReconcileAll(ctx))
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
 
 			// These two additional calls to ReconcileAll should not trigger any notifications.
 			// A notification is only sent once.
-			require.NoError(t, controller.ReconcileAll(ctx))
-			require.NoError(t, controller.ReconcileAll(ctx))
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
 
 			// Verify the final state after reconciliation.
 			// When hard limit is reached, no new workspace should be created.
@@ -1141,7 +1153,8 @@ func TestHardLimitedPresetShouldNotBlockDeletion(t *testing.T) {
 			}
 
 			// Trigger reconciliation to make sure that successful, but outdated prebuilt workspace will be deleted.
-			require.NoError(t, controller.ReconcileAll(ctx))
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
 
 			workspaces, err = db.GetWorkspacesByTemplateID(ctx, template.ID)
 			require.NoError(t, err)
@@ -1740,7 +1753,8 @@ func TestExpiredPrebuildsMultipleActions(t *testing.T) {
 			}
 
 			// Trigger reconciliation to process expired prebuilds and enforce desired state.
-			require.NoError(t, controller.ReconcileAll(ctx))
+			_, err = controller.ReconcileAll(ctx)
+			require.NoError(t, err)
 
 			// Sort non-expired workspaces by CreatedAt in ascending order (oldest first)
 			sort.Slice(nonExpiredWorkspaces, func(i, j int) bool {
@@ -2145,7 +2159,8 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 				require.NoError(t, err)
 
 				// When: the reconciliation loop is triggered
-				require.NoError(t, reconciler.ReconcileAll(ctx))
+				_, err = reconciler.ReconcileAll(ctx)
+				require.NoError(t, err)
 
 				if tt.shouldCancel {
 					// Then: the pending prebuild job from non-active version should be canceled
@@ -2347,7 +2362,8 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 		templateBVersion3Pending := setupPrebuilds(t, db, owner.OrganizationID, templateBID, templateBVersion3ID, templateBVersion3PresetID, 1, true)
 
 		// When: the reconciliation loop is executed
-		require.NoError(t, reconciler.ReconcileAll(ctx))
+		_, err := reconciler.ReconcileAll(ctx)
+		require.NoError(t, err)
 
 		// Then: template A version 1 running workspaces should not be canceled
 		checkIfJobCanceledAndDeleted(t, clock, ctx, db, false, templateAVersion1Running)
@@ -2369,6 +2385,51 @@ func TestCancelPendingPrebuilds(t *testing.T) {
 	})
 }
 
+func TestReconciliationStats(t *testing.T) {
+	t.Parallel()
+
+	// Setup
+	clock := quartz.NewReal()
+	db, ps := dbtestutil.NewDB(t)
+	client, _, _ := coderdtest.NewWithAPI(t, &coderdtest.Options{
+		Database: db,
+		Pubsub:   ps,
+		Clock:    clock,
+	})
+	fakeEnqueuer := newFakeEnqueuer()
+	registry := prometheus.NewRegistry()
+	cache := files.New(registry, &coderdtest.FakeAuthorizer{})
+	logger := slogtest.Make(t, &slogtest.Options{IgnoreErrors: false}).Leveled(slog.LevelDebug)
+	reconciler := prebuilds.NewStoreReconciler(db, ps, cache, codersdk.PrebuildsConfig{}, logger, clock, registry, fakeEnqueuer, newNoopUsageCheckerPtr())
+	owner := coderdtest.CreateFirstUser(t, client)
+
+	ctx, cancel := context.WithTimeout(context.Background(), testutil.WaitShort)
+	defer cancel()
+
+	// Create a template version with a preset
+	dbfake.TemplateVersion(t, db).Seed(database.TemplateVersion{
+		OrganizationID: owner.OrganizationID,
+		CreatedBy:      owner.UserID,
+	}).Preset(database.TemplateVersionPreset{
+		DesiredInstances: sql.NullInt32{
+			Int32: 1,
+			Valid: true,
+		},
+	}).Do()
+
+	// Verify that ReconcileAll tracks and returns elapsed time
+	start := time.Now()
+	stats, err := reconciler.ReconcileAll(ctx)
+	actualElapsed := time.Since(start)
+	require.NoError(t, err)
+	require.Greater(t, stats.Elapsed, time.Duration(0))
+
+	// Verify stats.Elapsed matches actual execution time
+	require.InDelta(t, actualElapsed.Milliseconds(), stats.Elapsed.Milliseconds(), 100)
+	// Verify reconciliation loop is not unexpectedly slow
+	require.Less(t, stats.Elapsed, 5*time.Second)
+}
+
 func newNoopEnqueuer() *notifications.NoopEnqueuer {
 	return notifications.NewNoopEnqueuer()
 }
@@ -2863,7 +2924,7 @@ func TestReconciliationRespectsPauseSetting(t *testing.T) {
 	_ = setupTestDBPreset(t, db, templateVersionID, 2, "test")
 
 	// Initially, reconciliation should create prebuilds
-	err := reconciler.ReconcileAll(ctx)
+	_, err := reconciler.ReconcileAll(ctx)
 	require.NoError(t, err)
 
 	// Verify that prebuilds were created
@@ -2890,7 +2951,7 @@ func TestReconciliationRespectsPauseSetting(t *testing.T) {
 	require.Len(t, workspaces, 0, "prebuilds should be deleted")
 
 	// Run reconciliation again - it should be paused and not recreate prebuilds
-	err = reconciler.ReconcileAll(ctx)
+	_, err = reconciler.ReconcileAll(ctx)
 	require.NoError(t, err)
 
 	// Verify that no new prebuilds were created because reconciliation is paused
@@ -2903,7 +2964,7 @@ func TestReconciliationRespectsPauseSetting(t *testing.T) {
 	require.NoError(t, err)
 
 	// Run reconciliation again - it should now recreate the prebuilds
-	err = reconciler.ReconcileAll(ctx)
+	_, err = reconciler.ReconcileAll(ctx)
 	require.NoError(t, err)
 
 	// Verify that prebuilds were recreated

From effbe4e52e83ef78bfcbac858fbbaf4751aa854b Mon Sep 17 00:00:00 2001
From: Danielle Maywood <danielle@themaywoods.com>
Date: Thu, 30 Oct 2025 17:02:25 +0000
Subject: [PATCH 289/298] refactor: remove TaskAppID from
 codersdk.WorkspaceBuild (#20583) (#20592)

`TaskAppID` has not yet been shipped. We're dropping this field in favor
of using the same information but from `codersdk.Task`.

---

Cherry picked from d80b5fc8eda9b72e1b793fef627e83b8b36479da
https://github.com/coder/coder/pull/20583
---
 coderd/apidoc/docs.go                        |   6 +-
 coderd/apidoc/swagger.json                   |   6 +-
 coderd/workspacebuilds.go                    |   1 -
 codersdk/workspacebuilds.go                  |   3 +-
 docs/reference/api/builds.md                 |   8 +-
 docs/reference/api/schemas.md                |   6 +-
 docs/reference/api/workspaces.md             |   6 -
 site/src/api/typesGenerated.ts               |   3 +-
 site/src/pages/TaskPage/TaskApps.stories.tsx |  14 +-
 site/src/pages/TaskPage/TaskApps.tsx         |  13 +-
 site/src/pages/TaskPage/TaskPage.stories.tsx | 196 +++++++++----------
 site/src/pages/TaskPage/TaskPage.tsx         |   4 +-
 12 files changed, 121 insertions(+), 145 deletions(-)

diff --git a/coderd/apidoc/docs.go b/coderd/apidoc/docs.go
index e459b94b3fdaf..76a38452552d4 100644
--- a/coderd/apidoc/docs.go
+++ b/coderd/apidoc/docs.go
@@ -20527,7 +20527,7 @@ const docTemplate = `{
             "type": "object",
             "properties": {
                 "ai_task_sidebar_app_id": {
-                    "description": "Deprecated: This field has been replaced with ` + "`" + `TaskAppID` + "`" + `",
+                    "description": "Deprecated: This field has been replaced with ` + "`" + `Task.WorkspaceAppID` + "`" + `",
                     "type": "string",
                     "format": "uuid"
                 },
@@ -20609,10 +20609,6 @@ const docTemplate = `{
                         }
                     ]
                 },
-                "task_app_id": {
-                    "type": "string",
-                    "format": "uuid"
-                },
                 "template_version_id": {
                     "type": "string",
                     "format": "uuid"
diff --git a/coderd/apidoc/swagger.json b/coderd/apidoc/swagger.json
index 8eef9dfb8e0d7..4aec870e77587 100644
--- a/coderd/apidoc/swagger.json
+++ b/coderd/apidoc/swagger.json
@@ -18861,7 +18861,7 @@
 			"type": "object",
 			"properties": {
 				"ai_task_sidebar_app_id": {
-					"description": "Deprecated: This field has been replaced with `TaskAppID`",
+					"description": "Deprecated: This field has been replaced with `Task.WorkspaceAppID`",
 					"type": "string",
 					"format": "uuid"
 				},
@@ -18939,10 +18939,6 @@
 						}
 					]
 				},
-				"task_app_id": {
-					"type": "string",
-					"format": "uuid"
-				},
 				"template_version_id": {
 					"type": "string",
 					"format": "uuid"
diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go
index 1e3020376041b..7918a334339d9 100644
--- a/coderd/workspacebuilds.go
+++ b/coderd/workspacebuilds.go
@@ -1219,7 +1219,6 @@ func (api *API) convertWorkspaceBuild(
 		TemplateVersionPresetID: presetID,
 		HasAITask:               hasAITask,
 		AITaskSidebarAppID:      taskAppID,
-		TaskAppID:               taskAppID,
 		HasExternalAgent:        hasExternalAgent,
 	}, nil
 }
diff --git a/codersdk/workspacebuilds.go b/codersdk/workspacebuilds.go
index fee4c114b7eae..8c38bd5c6469b 100644
--- a/codersdk/workspacebuilds.go
+++ b/codersdk/workspacebuilds.go
@@ -89,9 +89,8 @@ type WorkspaceBuild struct {
 	MatchedProvisioners     *MatchedProvisioners `json:"matched_provisioners,omitempty"`
 	TemplateVersionPresetID *uuid.UUID           `json:"template_version_preset_id" format:"uuid"`
 	HasAITask               *bool                `json:"has_ai_task,omitempty"`
-	// Deprecated: This field has been replaced with `TaskAppID`
+	// Deprecated: This field has been replaced with `Task.WorkspaceAppID`
 	AITaskSidebarAppID *uuid.UUID `json:"ai_task_sidebar_app_id,omitempty" format:"uuid"`
-	TaskAppID          *uuid.UUID `json:"task_app_id,omitempty" format:"uuid"`
 	HasExternalAgent   *bool      `json:"has_external_agent,omitempty"`
 }
 
diff --git a/docs/reference/api/builds.md b/docs/reference/api/builds.md
index ea207f84eab39..82b7cb8365a3e 100644
--- a/docs/reference/api/builds.md
+++ b/docs/reference/api/builds.md
@@ -222,7 +222,6 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
     }
   ],
   "status": "pending",
-  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -464,7 +463,6 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild} \
     }
   ],
   "status": "pending",
-  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1197,7 +1195,6 @@ curl -X GET http://coder-server:8080/api/v2/workspacebuilds/{workspacebuild}/sta
     }
   ],
   "status": "pending",
-  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1512,7 +1509,6 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1540,7 +1536,7 @@ Status Code **200**
 | Name                             | Type                                                                                                   | Required | Restrictions | Description                                                                                                                                                                                                                                    |
 |----------------------------------|--------------------------------------------------------------------------------------------------------|----------|--------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `[array item]`                   | array                                                                                                  | false    |              |                                                                                                                                                                                                                                                |
-| `» ai_task_sidebar_app_id`       | string(uuid)                                                                                           | false    |              | Deprecated: This field has been replaced with `TaskAppID`                                                                                                                                                                                      |
+| `» ai_task_sidebar_app_id`       | string(uuid)                                                                                           | false    |              | Deprecated: This field has been replaced with `Task.WorkspaceAppID`                                                                                                                                                                            |
 | `» build_number`                 | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
 | `» created_at`                   | string(date-time)                                                                                      | false    |              |                                                                                                                                                                                                                                                |
 | `» daily_cost`                   | integer                                                                                                | false    |              |                                                                                                                                                                                                                                                |
@@ -1691,7 +1687,6 @@ Status Code **200**
 | `»» type`                        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
 | `»» workspace_transition`        | [codersdk.WorkspaceTransition](schemas.md#codersdkworkspacetransition)                                 | false    |              |                                                                                                                                                                                                                                                |
 | `» status`                       | [codersdk.WorkspaceStatus](schemas.md#codersdkworkspacestatus)                                         | false    |              |                                                                                                                                                                                                                                                |
-| `» task_app_id`                  | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
 | `» template_version_id`          | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
 | `» template_version_name`        | string                                                                                                 | false    |              |                                                                                                                                                                                                                                                |
 | `» template_version_preset_id`   | string(uuid)                                                                                           | false    |              |                                                                                                                                                                                                                                                |
@@ -2013,7 +2008,6 @@ curl -X POST http://coder-server:8080/api/v2/workspaces/{workspace}/builds \
     }
   ],
   "status": "pending",
-  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
diff --git a/docs/reference/api/schemas.md b/docs/reference/api/schemas.md
index 4317324f002be..5d6a66efafee1 100644
--- a/docs/reference/api/schemas.md
+++ b/docs/reference/api/schemas.md
@@ -10164,7 +10164,6 @@ If the schedule is empty, the user will be updated to use the default schedule.|
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -11339,7 +11338,6 @@ If the schedule is empty, the user will be updated to use the default schedule.|
     }
   ],
   "status": "pending",
-  "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
   "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
   "template_version_name": "string",
   "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -11357,7 +11355,7 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 
 | Name                         | Type                                                              | Required | Restrictions | Description                                                         |
 |------------------------------|-------------------------------------------------------------------|----------|--------------|---------------------------------------------------------------------|
-| `ai_task_sidebar_app_id`     | string                                                            | false    |              | Deprecated: This field has been replaced with `TaskAppID`           |
+| `ai_task_sidebar_app_id`     | string                                                            | false    |              | Deprecated: This field has been replaced with `Task.WorkspaceAppID` |
 | `build_number`               | integer                                                           | false    |              |                                                                     |
 | `created_at`                 | string                                                            | false    |              |                                                                     |
 | `daily_cost`                 | integer                                                           | false    |              |                                                                     |
@@ -11373,7 +11371,6 @@ If the schedule is empty, the user will be updated to use the default schedule.|
 | `reason`                     | [codersdk.BuildReason](#codersdkbuildreason)                      | false    |              |                                                                     |
 | `resources`                  | array of [codersdk.WorkspaceResource](#codersdkworkspaceresource) | false    |              |                                                                     |
 | `status`                     | [codersdk.WorkspaceStatus](#codersdkworkspacestatus)              | false    |              |                                                                     |
-| `task_app_id`                | string                                                            | false    |              |                                                                     |
 | `template_version_id`        | string                                                            | false    |              |                                                                     |
 | `template_version_name`      | string                                                            | false    |              |                                                                     |
 | `template_version_preset_id` | string                                                            | false    |              |                                                                     |
@@ -12163,7 +12160,6 @@ If the schedule is empty, the user will be updated to use the default schedule.|
           }
         ],
         "status": "pending",
-        "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
         "template_version_name": "string",
         "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
diff --git a/docs/reference/api/workspaces.md b/docs/reference/api/workspaces.md
index 3e52d9e0a2d60..4bd188df3daf5 100644
--- a/docs/reference/api/workspaces.md
+++ b/docs/reference/api/workspaces.md
@@ -277,7 +277,6 @@ of the template will be used.
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -573,7 +572,6 @@ curl -X GET http://coder-server:8080/api/v2/users/{user}/workspace/{workspacenam
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -894,7 +892,6 @@ of the template will be used.
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1176,7 +1173,6 @@ curl -X GET http://coder-server:8080/api/v2/workspaces \
           }
         ],
         "status": "pending",
-        "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
         "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
         "template_version_name": "string",
         "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -1473,7 +1469,6 @@ curl -X GET http://coder-server:8080/api/v2/workspaces/{workspace} \
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
@@ -2029,7 +2024,6 @@ curl -X PUT http://coder-server:8080/api/v2/workspaces/{workspace}/dormant \
       }
     ],
     "status": "pending",
-    "task_app_id": "ca438251-3e16-4fae-b9ab-dd3c237c3735",
     "template_version_id": "0ba39c92-1f1b-4c32-aa3e-9925d7713eb1",
     "template_version_name": "string",
     "template_version_preset_id": "512a53a7-30da-446e-a1fc-713c630baff1",
diff --git a/site/src/api/typesGenerated.ts b/site/src/api/typesGenerated.ts
index 6d703cbcfe2d6..8d86362b06227 100644
--- a/site/src/api/typesGenerated.ts
+++ b/site/src/api/typesGenerated.ts
@@ -6399,10 +6399,9 @@ export interface WorkspaceBuild {
 	readonly template_version_preset_id: string | null;
 	readonly has_ai_task?: boolean;
 	/**
-	 * Deprecated: This field has been replaced with `TaskAppID`
+	 * Deprecated: This field has been replaced with `Task.WorkspaceAppID`
 	 */
 	readonly ai_task_sidebar_app_id?: string;
-	readonly task_app_id?: string;
 	readonly has_external_agent?: boolean;
 }
 
diff --git a/site/src/pages/TaskPage/TaskApps.stories.tsx b/site/src/pages/TaskPage/TaskApps.stories.tsx
index 752c52cfde423..dcce3f5949d21 100644
--- a/site/src/pages/TaskPage/TaskApps.stories.tsx
+++ b/site/src/pages/TaskPage/TaskApps.stories.tsx
@@ -1,5 +1,6 @@
 import {
 	MockPrimaryWorkspaceProxy,
+	MockTask,
 	MockUserOwner,
 	MockWorkspace,
 	MockWorkspaceAgent,
@@ -8,7 +9,7 @@ import {
 } from "testHelpers/entities";
 import { withAuthProvider, withProxyProvider } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
-import type { Workspace, WorkspaceApp } from "api/typesGenerated";
+import type { Task, Workspace, WorkspaceApp } from "api/typesGenerated";
 import { getPreferredProxy } from "contexts/ProxyContext";
 import kebabCase from "lodash/kebabCase";
 import { TaskApps } from "./TaskApps";
@@ -19,6 +20,11 @@ const mockExternalApp: WorkspaceApp = {
 	health: "healthy",
 };
 
+const mockTask: Task = {
+	...MockTask,
+	workspace_app_id: null,
+};
+
 const meta: Meta<typeof TaskApps> = {
 	title: "pages/TaskPage/TaskApps",
 	component: TaskApps,
@@ -33,24 +39,28 @@ type Story = StoryObj<typeof TaskApps>;
 
 export const NoEmbeddedApps: Story = {
 	args: {
+		task: mockTask,
 		workspace: mockWorkspaceWithApps([]),
 	},
 };
 
 export const WithExternalAppsOnly: Story = {
 	args: {
+		task: mockTask,
 		workspace: mockWorkspaceWithApps([mockExternalApp]),
 	},
 };
 
 export const WithEmbeddedApps: Story = {
 	args: {
+		task: mockTask,
 		workspace: mockWorkspaceWithApps([mockEmbeddedApp()]),
 	},
 };
 
 export const WithMixedApps: Story = {
 	args: {
+		task: mockTask,
 		workspace: mockWorkspaceWithApps([mockEmbeddedApp(), mockExternalApp]),
 	},
 };
@@ -69,6 +79,7 @@ export const WithWildcardWarning: Story = {
 		user: MockUserOwner,
 	},
 	args: {
+		task: mockTask,
 		workspace: mockWorkspaceWithApps([
 			{
 				...mockEmbeddedApp(),
@@ -80,6 +91,7 @@ export const WithWildcardWarning: Story = {
 
 export const WithManyEmbeddedApps: Story = {
 	args: {
+		task: mockTask,
 		workspace: mockWorkspaceWithApps([
 			mockEmbeddedApp("Code Server"),
 			mockEmbeddedApp("Jupyter Notebook"),
diff --git a/site/src/pages/TaskPage/TaskApps.tsx b/site/src/pages/TaskPage/TaskApps.tsx
index 2f05145bca46a..59ada2181119b 100644
--- a/site/src/pages/TaskPage/TaskApps.tsx
+++ b/site/src/pages/TaskPage/TaskApps.tsx
@@ -1,4 +1,4 @@
-import type { Workspace } from "api/typesGenerated";
+import type { Task, Workspace } from "api/typesGenerated";
 import { Button } from "components/Button/Button";
 import {
 	DropdownMenu,
@@ -24,18 +24,17 @@ import { docs } from "utils/docs";
 import { TaskAppIFrame, TaskIframe } from "./TaskAppIframe";
 
 type TaskAppsProps = {
+	task: Task;
 	workspace: Workspace;
 };
 
 const TERMINAL_TAB_ID = "terminal";
 
-export const TaskApps: FC<TaskAppsProps> = ({ workspace }) => {
+export const TaskApps: FC<TaskAppsProps> = ({ task, workspace }) => {
 	const apps = getAllAppsWithAgent(workspace).filter(
 		// The Chat UI app will be displayed in the sidebar, so we don't want to
 		// show it as a web app.
-		(app) =>
-			app.id !== workspace.latest_build.task_app_id &&
-			app.health !== "disabled",
+		(app) => app.id !== task.workspace_app_id && app.health !== "disabled",
 	);
 	const [embeddedApps, externalApps] = splitEmbeddedAndExternalApps(apps);
 	const [activeAppId, setActiveAppId] = useState(embeddedApps.at(0)?.id);
@@ -43,8 +42,8 @@ export const TaskApps: FC<TaskAppsProps> = ({ workspace }) => {
 		embeddedApps.length > 0 || externalApps.length > 0;
 	const taskAgent = apps.at(0)?.agent;
 	const terminalHref = getTerminalHref({
-		username: workspace.owner_name,
-		workspace: workspace.name,
+		username: task.owner_name,
+		workspace: task.workspace_name,
 		agent: taskAgent?.name,
 	});
 	const isTerminalActive = activeAppId === TERMINAL_TAB_ID;
diff --git a/site/src/pages/TaskPage/TaskPage.stories.tsx b/site/src/pages/TaskPage/TaskPage.stories.tsx
index 19003eb621699..df9129de7f32d 100644
--- a/site/src/pages/TaskPage/TaskPage.stories.tsx
+++ b/site/src/pages/TaskPage/TaskPage.stories.tsx
@@ -22,7 +22,7 @@ import {
 } from "testHelpers/storybook";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { API } from "api/api";
-import type { Workspace, WorkspaceApp } from "api/typesGenerated";
+import type { Task, Workspace, WorkspaceApp } from "api/typesGenerated";
 import { expect, spyOn, userEvent, waitFor, within } from "storybook/test";
 import { reactRouterParameters } from "storybook-addon-remix-react-router";
 import TaskPage from "./TaskPage";
@@ -210,87 +210,70 @@ export const WaitingStartupScripts: Story = {
 
 export const SidebarAppNotFound: Story = {
 	beforeEach: () => {
-		const workspace = mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp);
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue({
-			...workspace,
-			latest_build: {
-				...workspace.latest_build,
-				task_app_id: "non-existent-app-id",
-			},
+		const [task, workspace] = mockTaskWithWorkspace(
+			MockClaudeCodeApp,
+			MockVSCodeApp,
+		);
+		spyOn(API.experimental, "getTask").mockResolvedValue({
+			...task,
+			workspace_app_id: null,
 		});
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 };
 
 export const SidebarAppHealthDisabled: Story = {
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(
-				{
-					...MockClaudeCodeApp,
-					health: "disabled",
-				},
-				MockVSCodeApp,
-			),
+		const [task, workspace] = mockTaskWithWorkspace(
+			{ ...MockClaudeCodeApp, health: "disabled" },
+			MockVSCodeApp,
 		);
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 };
 
 export const SidebarAppInitializing: Story = {
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(
-				{
-					...MockClaudeCodeApp,
-					health: "initializing",
-				},
-				MockVSCodeApp,
-			),
+		const [task, workspace] = mockTaskWithWorkspace(
+			{ ...MockClaudeCodeApp, health: "initializing" },
+			MockVSCodeApp,
 		);
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 };
 
 export const SidebarAppHealthy: Story = {
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(
-				{
-					...MockClaudeCodeApp,
-					health: "healthy",
-				},
-				MockVSCodeApp,
-			),
+		const [task, workspace] = mockTaskWithWorkspace(
+			{ ...MockClaudeCodeApp, health: "healthy" },
+			MockVSCodeApp,
 		);
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 };
 
 export const SidebarAppUnhealthy: Story = {
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(
-				{
-					...MockClaudeCodeApp,
-					health: "unhealthy",
-				},
-				MockVSCodeApp,
-			),
+		const [task, workspace] = mockTaskWithWorkspace(
+			{ ...MockClaudeCodeApp, health: "unhealthy" },
+			MockVSCodeApp,
 		);
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 };
 
 const mainAppHealthStory = (health: WorkspaceApp["health"]) => ({
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(MockClaudeCodeApp, {
-				...MockVSCodeApp,
-				health,
-			}),
-		);
+		const [task, workspace] = mockTaskWithWorkspace(MockClaudeCodeApp, {
+			...MockVSCodeApp,
+			health,
+		});
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 });
 
@@ -301,10 +284,12 @@ export const MainAppUnhealthy: Story = mainAppHealthStory("unhealthy");
 export const Active: Story = {
 	decorators: [withProxyProvider()],
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp),
+		const [task, workspace] = mockTaskWithWorkspace(
+			MockClaudeCodeApp,
+			MockVSCodeApp,
 		);
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
@@ -322,10 +307,12 @@ export const Active: Story = {
 export const ActivePreview: Story = {
 	decorators: [withProxyProvider()],
 	beforeEach: () => {
-		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
-		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
-			mockTaskWorkspace(MockClaudeCodeApp, MockVSCodeApp),
+		const [task, workspace] = mockTaskWithWorkspace(
+			MockClaudeCodeApp,
+			MockVSCodeApp,
 		);
+		spyOn(API.experimental, "getTask").mockResolvedValue(task);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(workspace);
 	},
 	play: async ({ canvasElement }) => {
 		const canvas = within(canvasElement);
@@ -454,51 +441,56 @@ export const WorkspaceStartFailureWithDialog: Story = {
 	},
 };
 
-function mockTaskWorkspace(
+function mockTaskWithWorkspace(
 	sidebarApp: WorkspaceApp,
 	activeApp: WorkspaceApp,
-): Workspace {
-	return {
-		...MockWorkspace,
-		latest_build: {
-			...MockWorkspace.latest_build,
-			has_ai_task: true,
-			task_app_id: sidebarApp.id,
-			resources: [
-				{
-					...MockWorkspaceResource,
-					agents: [
-						{
-							...MockWorkspaceAgentReady,
-							apps: [
-								sidebarApp,
-								activeApp,
-								{
-									...MockWorkspaceApp,
-									slug: "zed",
-									id: "zed",
-									display_name: "Zed",
-									icon: "/icon/zed.svg",
-									health: "healthy",
-								},
-								{
-									...MockWorkspaceApp,
-									slug: "preview",
-									id: "preview",
-									display_name: "Preview",
-									health: "healthy",
-								},
-								{
-									...MockWorkspaceApp,
-									slug: "disabled",
-									id: "disabled",
-									display_name: "Disabled",
-								},
-							],
-						},
-					],
-				},
-			],
+): [Task, Workspace] {
+	return [
+		{
+			...MockTask,
+			workspace_app_id: sidebarApp.id,
+		},
+		{
+			...MockWorkspace,
+			latest_build: {
+				...MockWorkspace.latest_build,
+				has_ai_task: true,
+				resources: [
+					{
+						...MockWorkspaceResource,
+						agents: [
+							{
+								...MockWorkspaceAgentReady,
+								apps: [
+									sidebarApp,
+									activeApp,
+									{
+										...MockWorkspaceApp,
+										slug: "zed",
+										id: "zed",
+										display_name: "Zed",
+										icon: "/icon/zed.svg",
+										health: "healthy",
+									},
+									{
+										...MockWorkspaceApp,
+										slug: "preview",
+										id: "preview",
+										display_name: "Preview",
+										health: "healthy",
+									},
+									{
+										...MockWorkspaceApp,
+										slug: "disabled",
+										id: "disabled",
+										display_name: "Disabled",
+									},
+								],
+							},
+						],
+					},
+				],
+			},
 		},
-	};
+	];
 }
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index 17cdc8b6861d7..793a3b44b12eb 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -149,7 +149,7 @@ const TaskPage = () => {
 		content = <TaskStartingAgent agent={agent} />;
 	} else {
 		const chatApp = getAllAppsWithAgent(workspace).find(
-			(app) => app.id === workspace.latest_build.task_app_id,
+			(app) => app.id === task.workspace_app_id,
 		);
 		content = (
 			<PanelGroup autoSaveId="task" direction="horizontal">
@@ -174,7 +174,7 @@ const TaskPage = () => {
 					<div className="w-1 bg-border h-full hover:bg-border-hover transition-all relative" />
 				</PanelResizeHandle>
 				<Panel className="[&>*]:h-full">
-					<TaskApps workspace={workspace} />
+					<TaskApps task={task} workspace={workspace} />
 				</Panel>
 			</PanelGroup>
 		);

From cb4ea1f3970518d620bde14ea511bf1c4129327a Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Mon, 3 Nov 2025 09:00:42 +0000
Subject: [PATCH 290/298] fix(coderd): fix audit log resource link for tasks
 (#20545) (#20547)

Existing task audit log links were incorrect. As audit log links are
generated on-the-fly, this does not require backfill.

(cherry picked from commit 566146af72a048adcff88a6390205df9181686bf)
---
 coderd/audit.go | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/coderd/audit.go b/coderd/audit.go
index e43ed1c5128ec..3a3237a9fed50 100644
--- a/coderd/audit.go
+++ b/coderd/audit.go
@@ -509,11 +509,11 @@ func (api *API) auditLogResourceLink(ctx context.Context, alog database.GetAudit
 		if err != nil {
 			return ""
 		}
-		workspace, err := api.Database.GetWorkspaceByID(ctx, task.WorkspaceID.UUID)
+		user, err := api.Database.GetUserByID(ctx, task.OwnerID)
 		if err != nil {
 			return ""
 		}
-		return fmt.Sprintf("/tasks/%s/%s", workspace.OwnerName, task.Name)
+		return fmt.Sprintf("/tasks/%s/%s", user.Username, task.ID)
 
 	default:
 		return ""

From d82ba7e3a4e18ad85fda871edc135cf851d58f71 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Mon, 3 Nov 2025 09:01:57 +0000
Subject: [PATCH 291/298] fix(coderd): disallow POSTing a workspace build on a
 deleted workspace (#20584) (#20586)

- Adds a check on /api/v2/workspacebuilds to disallow creating a START
or STOP build if the workspace is deleted.
- DELETEs are still allowed.

(cherry picked from commit 38017010cec19bb0fc5479a7debcc341a5a63a9d)
---
 coderd/workspacebuilds.go      |  9 +++++
 coderd/workspacebuilds_test.go | 62 ++++++++++++++++++++++++++++++++++
 2 files changed, 71 insertions(+)

diff --git a/coderd/workspacebuilds.go b/coderd/workspacebuilds.go
index 7918a334339d9..d064a0ef3f574 100644
--- a/coderd/workspacebuilds.go
+++ b/coderd/workspacebuilds.go
@@ -335,6 +335,15 @@ func (api *API) postWorkspaceBuilds(rw http.ResponseWriter, r *http.Request) {
 		return
 	}
 
+	// We want to allow a delete build for a deleted workspace, but not a start or stop build.
+	if workspace.Deleted && createBuild.Transition != codersdk.WorkspaceTransitionDelete {
+		httpapi.Write(ctx, rw, http.StatusConflict, codersdk.Response{
+			Message: fmt.Sprintf("Cannot %s a deleted workspace!", createBuild.Transition),
+			Detail:  "This workspace has been deleted and cannot be modified.",
+		})
+		return
+	}
+
 	apiBuild, err := api.postWorkspaceBuildsInternal(
 		ctx,
 		apiKey,
diff --git a/coderd/workspacebuilds_test.go b/coderd/workspacebuilds_test.go
index f857296db1a5c..d0ab64b1aeb32 100644
--- a/coderd/workspacebuilds_test.go
+++ b/coderd/workspacebuilds_test.go
@@ -1840,6 +1840,68 @@ func TestPostWorkspaceBuild(t *testing.T) {
 		require.NoError(t, err)
 		require.Equal(t, codersdk.BuildReasonDashboard, build.Reason)
 	})
+	t.Run("DeletedWorkspace", func(t *testing.T) {
+		t.Parallel()
+
+		// Given: a workspace that has already been deleted
+		var (
+			ctx             = testutil.Context(t, testutil.WaitShort)
+			logger          = slogtest.Make(t, &slogtest.Options{}).Leveled(slog.LevelError)
+			adminClient, db = coderdtest.NewWithDatabase(t, &coderdtest.Options{
+				Logger: &logger,
+			})
+			admin                         = coderdtest.CreateFirstUser(t, adminClient)
+			workspaceOwnerClient, member1 = coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID)
+			otherMemberClient, _          = coderdtest.CreateAnotherUser(t, adminClient, admin.OrganizationID)
+			ws                            = dbfake.WorkspaceBuild(t, db, database.WorkspaceTable{OwnerID: member1.ID, OrganizationID: admin.OrganizationID}).
+							Seed(database.WorkspaceBuild{Transition: database.WorkspaceTransitionDelete}).
+							Do()
+		)
+
+		// This needs to be done separately as provisionerd handles marking the workspace as deleted
+		// and we're skipping provisionerd here for speed.
+		require.NoError(t, db.UpdateWorkspaceDeletedByID(dbauthz.AsProvisionerd(ctx), database.UpdateWorkspaceDeletedByIDParams{
+			ID:      ws.Workspace.ID,
+			Deleted: true,
+		}))
+
+		// Assert test invariant: Workspace should be deleted
+		dbWs, err := db.GetWorkspaceByID(dbauthz.AsProvisionerd(ctx), ws.Workspace.ID)
+		require.NoError(t, err)
+		require.True(t, dbWs.Deleted, "workspace should be deleted")
+
+		for _, tc := range []struct {
+			user         *codersdk.Client
+			tr           codersdk.WorkspaceTransition
+			expectStatus int
+		}{
+			// You should not be allowed to mess with a workspace you don't own, regardless of its deleted state.
+			{otherMemberClient, codersdk.WorkspaceTransitionStart, http.StatusNotFound},
+			{otherMemberClient, codersdk.WorkspaceTransitionStop, http.StatusNotFound},
+			{otherMemberClient, codersdk.WorkspaceTransitionDelete, http.StatusNotFound},
+			// Starting or stopping a workspace is not allowed when it is deleted.
+			{workspaceOwnerClient, codersdk.WorkspaceTransitionStart, http.StatusConflict},
+			{workspaceOwnerClient, codersdk.WorkspaceTransitionStop, http.StatusConflict},
+			// We allow a delete just in case a retry is required. In most cases, this will be a no-op.
+			// Note: this is the last test case because it will change the state of the workspace.
+			{workspaceOwnerClient, codersdk.WorkspaceTransitionDelete, http.StatusOK},
+		} {
+			// When: we create a workspace build with the given transition
+			_, err = tc.user.CreateWorkspaceBuild(ctx, ws.Workspace.ID, codersdk.CreateWorkspaceBuildRequest{
+				Transition: tc.tr,
+			})
+
+			// Then: we allow ONLY a delete build for a deleted workspace.
+			if tc.expectStatus < http.StatusBadRequest {
+				require.NoError(t, err, "creating a %s build for a deleted workspace should not error", tc.tr)
+			} else {
+				var apiError *codersdk.Error
+				require.Error(t, err, "creating a %s build for a deleted workspace should return an error", tc.tr)
+				require.ErrorAs(t, err, &apiError)
+				require.Equal(t, tc.expectStatus, apiError.StatusCode())
+			}
+		}
+	})
 }
 
 func TestWorkspaceBuildTimings(t *testing.T) {

From fa43ea8e688bfcf8a7591936274a54d5a0058497 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Mon, 3 Nov 2025 09:41:16 +0000
Subject: [PATCH 292/298] chore: remove brazil fly.io proxy (#20601) (#20645)

(cherry picked from commit 7182c53df7648cd7db8551629226c4a0a1cc8559)

Co-authored-by: Dean Sheather <dean@deansheather.com>
---
 .github/fly-wsproxies/sao-paulo-coder.toml | 34 ----------------------
 .github/workflows/deploy.yaml              |  2 --
 2 files changed, 36 deletions(-)
 delete mode 100644 .github/fly-wsproxies/sao-paulo-coder.toml

diff --git a/.github/fly-wsproxies/sao-paulo-coder.toml b/.github/fly-wsproxies/sao-paulo-coder.toml
deleted file mode 100644
index b6c9b964631ef..0000000000000
--- a/.github/fly-wsproxies/sao-paulo-coder.toml
+++ /dev/null
@@ -1,34 +0,0 @@
-app = "sao-paulo-coder"
-primary_region = "gru"
-
-[experimental]
-  entrypoint = ["/bin/sh", "-c", "CODER_DERP_SERVER_RELAY_URL=\"http://[${FLY_PRIVATE_IP}]:3000\" /opt/coder wsproxy server"]
-  auto_rollback = true
-
-[build]
-  image = "ghcr.io/coder/coder-preview:main"
-
-[env]
-  CODER_ACCESS_URL = "https://sao-paulo.fly.dev.coder.com"
-  CODER_HTTP_ADDRESS = "0.0.0.0:3000"
-  CODER_PRIMARY_ACCESS_URL = "https://dev.coder.com"
-  CODER_WILDCARD_ACCESS_URL = "*--apps.sao-paulo.fly.dev.coder.com"
-  CODER_VERBOSE = "true"
-
-[http_service]
-  internal_port = 3000
-  force_https = true
-  auto_stop_machines = true
-  auto_start_machines = true
-  min_machines_running = 0
-
-# Ref: https://fly.io/docs/reference/configuration/#http_service-concurrency
-[http_service.concurrency]
-  type = "requests"
-  soft_limit = 50
-  hard_limit = 100
-
-[[vm]]
-  cpu_kind = "shared"
-  cpus = 2
-  memory_mb = 512
diff --git a/.github/workflows/deploy.yaml b/.github/workflows/deploy.yaml
index 30d9e384149fa..6ea750a11caac 100644
--- a/.github/workflows/deploy.yaml
+++ b/.github/workflows/deploy.yaml
@@ -163,12 +163,10 @@ jobs:
         run: |
           flyctl deploy --image "$IMAGE" --app paris-coder --config ./.github/fly-wsproxies/paris-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_PARIS" --yes
           flyctl deploy --image "$IMAGE" --app sydney-coder --config ./.github/fly-wsproxies/sydney-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SYDNEY" --yes
-          flyctl deploy --image "$IMAGE" --app sao-paulo-coder --config ./.github/fly-wsproxies/sao-paulo-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_SAO_PAULO" --yes
           flyctl deploy --image "$IMAGE" --app jnb-coder --config ./.github/fly-wsproxies/jnb-coder.toml --env "CODER_PROXY_SESSION_TOKEN=$TOKEN_JNB" --yes
         env:
           FLY_API_TOKEN: ${{ secrets.FLY_API_TOKEN }}
           IMAGE: ${{ inputs.image }}
           TOKEN_PARIS: ${{ secrets.FLY_PARIS_CODER_PROXY_SESSION_TOKEN }}
           TOKEN_SYDNEY: ${{ secrets.FLY_SYDNEY_CODER_PROXY_SESSION_TOKEN }}
-          TOKEN_SAO_PAULO: ${{ secrets.FLY_SAO_PAULO_CODER_PROXY_SESSION_TOKEN }}
           TOKEN_JNB: ${{ secrets.FLY_JNB_CODER_PROXY_SESSION_TOKEN }}

From 563612eb3b3b585a729cabc3555fda5f34dbbb71 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Mon, 3 Nov 2025 10:04:41 +0000
Subject: [PATCH 293/298] fix: delete related task when deleting workspace
 (#20567) (#20585)

* Instead of prompting the user to start a deleted workspace (which is
silly), prompt them to create a new task instead.
* Adds a warning dialog when deleting a workspace related to a task
* Updates provisionerdserver to delete the related task if a workspace
is related to a task

(cherry picked from commit 73dedcc76568436c9c5c6091b849e1093e4f2f85)
---
 coderd/aitasks_test.go                        | 52 ++++++++++++++++---
 coderd/database/dbauthz/dbauthz.go            |  4 +-
 .../provisionerdserver/provisionerdserver.go  |  8 +++
 .../WorkspaceDeleteDialog.stories.tsx         | 12 ++++-
 .../WorkspaceDeleteDialog.tsx                 | 22 +++++++-
 site/src/pages/TaskPage/TaskPage.stories.tsx  | 10 ++++
 site/src/pages/TaskPage/TaskPage.tsx          | 22 +++++++-
 7 files changed, 118 insertions(+), 12 deletions(-)

diff --git a/coderd/aitasks_test.go b/coderd/aitasks_test.go
index d3b5e240d8301..5fb24d7b1f546 100644
--- a/coderd/aitasks_test.go
+++ b/coderd/aitasks_test.go
@@ -478,10 +478,10 @@ func TestTasks(t *testing.T) {
 			}
 		})
 
-		t.Run("NoWorkspace", func(t *testing.T) {
+		t.Run("DeletedWorkspace", func(t *testing.T) {
 			t.Parallel()
 
-			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			client, db := coderdtest.NewWithDatabase(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
 			user := coderdtest.CreateFirstUser(t, client)
 			template := createAITemplate(t, client, user)
 			ctx := testutil.Context(t, testutil.WaitLong)
@@ -495,14 +495,54 @@ func TestTasks(t *testing.T) {
 			ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
 			require.NoError(t, err)
 			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
-			// Delete the task workspace
-			coderdtest.MustTransitionWorkspace(t, client, ws.ID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionDelete)
-			// We should still be able to fetch the task after deleting its workspace
+
+			// Mark the workspace as deleted directly in the database, bypassing provisionerd.
+			require.NoError(t, db.UpdateWorkspaceDeletedByID(dbauthz.AsProvisionerd(ctx), database.UpdateWorkspaceDeletedByIDParams{
+				ID:      ws.ID,
+				Deleted: true,
+			}))
+			// We should still be able to fetch the task if its workspace was deleted.
+			// Provisionerdserver will attempt delete the related task when deleting a workspace.
+			// This test ensures that we can still handle the case where, for some reason, the
+			// task has not been marked as deleted, but the workspace has.
 			task, err = exp.TaskByID(ctx, task.ID)
-			require.NoError(t, err, "fetching a task should still work after deleting its related workspace")
+			require.NoError(t, err, "fetching a task should still work if its related workspace is deleted")
 			err = exp.DeleteTask(ctx, task.OwnerID.String(), task.ID)
 			require.NoError(t, err, "should be possible to delete a task with no workspace")
 		})
+
+		t.Run("DeletingTaskWorkspaceDeletesTask", func(t *testing.T) {
+			t.Parallel()
+
+			client := coderdtest.New(t, &coderdtest.Options{IncludeProvisionerDaemon: true})
+			user := coderdtest.CreateFirstUser(t, client)
+			template := createAITemplate(t, client, user)
+
+			ctx := testutil.Context(t, testutil.WaitLong)
+
+			exp := codersdk.NewExperimentalClient(client)
+			task, err := exp.CreateTask(ctx, "me", codersdk.CreateTaskRequest{
+				TemplateVersionID: template.ActiveVersionID,
+				Input:             "delete me",
+			})
+			require.NoError(t, err)
+			require.True(t, task.WorkspaceID.Valid, "task should have a workspace ID")
+			ws, err := client.Workspace(ctx, task.WorkspaceID.UUID)
+			require.NoError(t, err)
+			if assert.True(t, ws.TaskID.Valid, "task id should be set on workspace") {
+				assert.Equal(t, task.ID, ws.TaskID.UUID, "workspace task id should match")
+			}
+			coderdtest.AwaitWorkspaceBuildJobCompleted(t, client, ws.LatestBuild.ID)
+
+			// When; the task workspace is deleted
+			coderdtest.MustTransitionWorkspace(t, client, ws.ID, codersdk.WorkspaceTransitionStart, codersdk.WorkspaceTransitionDelete)
+			// Then: the task associated with the workspace is also deleted
+			_, err = exp.TaskByID(ctx, task.ID)
+			require.Error(t, err, "expected an error fetching the task")
+			var sdkErr *codersdk.Error
+			require.ErrorAs(t, err, &sdkErr, "expected a codersdk.Error")
+			require.Equal(t, http.StatusNotFound, sdkErr.StatusCode())
+		})
 	})
 
 	t.Run("Send", func(t *testing.T) {
diff --git a/coderd/database/dbauthz/dbauthz.go b/coderd/database/dbauthz/dbauthz.go
index 1b2a6a5d97590..8066ebd0479a1 100644
--- a/coderd/database/dbauthz/dbauthz.go
+++ b/coderd/database/dbauthz/dbauthz.go
@@ -219,8 +219,8 @@ var (
 					rbac.ResourceUser.Type:             {policy.ActionRead, policy.ActionReadPersonal, policy.ActionUpdatePersonal},
 					rbac.ResourceWorkspaceDormant.Type: {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStop},
 					rbac.ResourceWorkspace.Type:        {policy.ActionDelete, policy.ActionRead, policy.ActionUpdate, policy.ActionWorkspaceStart, policy.ActionWorkspaceStop, policy.ActionCreateAgent},
-					// Provisionerd needs to read and update tasks associated with workspaces.
-					rbac.ResourceTask.Type:   {policy.ActionRead, policy.ActionUpdate},
+					// Provisionerd needs to read, update, and delete tasks associated with workspaces.
+					rbac.ResourceTask.Type:   {policy.ActionRead, policy.ActionUpdate, policy.ActionDelete},
 					rbac.ResourceApiKey.Type: {policy.WildcardSymbol},
 					// When org scoped provisioner credentials are implemented,
 					// this can be reduced to read a specific org.
diff --git a/coderd/provisionerdserver/provisionerdserver.go b/coderd/provisionerdserver/provisionerdserver.go
index bf7741bdc260f..2e00796d1cd64 100644
--- a/coderd/provisionerdserver/provisionerdserver.go
+++ b/coderd/provisionerdserver/provisionerdserver.go
@@ -2278,6 +2278,14 @@ func (s *server) completeWorkspaceBuildJob(ctx context.Context, job database.Pro
 		if err != nil {
 			return xerrors.Errorf("update workspace deleted: %w", err)
 		}
+		if workspace.TaskID.Valid {
+			if _, err := db.DeleteTask(ctx, database.DeleteTaskParams{
+				ID:        workspace.TaskID.UUID,
+				DeletedAt: dbtime.Now(),
+			}); err != nil && !errors.Is(err, sql.ErrNoRows) {
+				return xerrors.Errorf("delete task related to workspace: %w", err)
+			}
+		}
 
 		return nil
 	}, nil)
diff --git a/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.stories.tsx b/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.stories.tsx
index b5fcd44b7c9c8..7debfb1ce9d8c 100644
--- a/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.stories.tsx
+++ b/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.stories.tsx
@@ -1,4 +1,8 @@
-import { MockFailedWorkspace, MockWorkspace } from "testHelpers/entities";
+import {
+	MockFailedWorkspace,
+	MockTaskWorkspace,
+	MockWorkspace,
+} from "testHelpers/entities";
 import type { Meta, StoryObj } from "@storybook/react-vite";
 import { daysAgo } from "utils/time";
 import { WorkspaceDeleteDialog } from "./WorkspaceDeleteDialog";
@@ -45,3 +49,9 @@ export const UnhealthyAdminView: Story = {
 		canDeleteFailedWorkspace: true,
 	},
 };
+
+export const WithTask: Story = {
+	args: {
+		workspace: MockTaskWorkspace,
+	},
+};
diff --git a/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.tsx b/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.tsx
index 2cfb74f2765c3..245f95c0f74d8 100644
--- a/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.tsx
+++ b/site/src/modules/workspaces/WorkspaceMoreActions/WorkspaceDeleteDialog.tsx
@@ -56,6 +56,8 @@ export const WorkspaceDeleteDialog: FC<WorkspaceDeleteDialogProps> = ({
 		(workspace.latest_build.status === "failed" ||
 			workspace.latest_build.status === "canceled");
 
+	const hasTask = !!workspace.task_id;
+
 	return (
 		<ConfirmDialog
 			type="delete"
@@ -109,8 +111,24 @@ export const WorkspaceDeleteDialog: FC<WorkspaceDeleteDialogProps> = ({
 								"data-testid": "delete-dialog-name-confirmation",
 							}}
 						/>
+						{hasTask && (
+							<div css={styles.warnContainer}>
+								<div css={{ flexDirection: "column" }}>
+									<p className="info">This workspace is related to a task</p>
+									<span css={{ fontSize: 12, marginTop: 4, display: "block" }}>
+										Deleting this workspace will also delete{" "}
+										<Link
+											href={`/tasks/${workspace.owner_name}/${workspace.task_id}`}
+										>
+											this task
+										</Link>
+										.
+									</span>
+								</div>
+							</div>
+						)}
 						{canOrphan && (
-							<div css={styles.orphanContainer}>
+							<div css={styles.warnContainer}>
 								<div css={{ flexDirection: "column" }}>
 									<Checkbox
 										id="orphan_resources"
@@ -178,7 +196,7 @@ const styles = {
 			color: theme.palette.text.primary,
 		},
 	}),
-	orphanContainer: (theme) => ({
+	warnContainer: (theme) => ({
 		marginTop: 24,
 		display: "flex",
 		backgroundColor: theme.roles.danger.background,
diff --git a/site/src/pages/TaskPage/TaskPage.stories.tsx b/site/src/pages/TaskPage/TaskPage.stories.tsx
index df9129de7f32d..b247a2a16b377 100644
--- a/site/src/pages/TaskPage/TaskPage.stories.tsx
+++ b/site/src/pages/TaskPage/TaskPage.stories.tsx
@@ -1,4 +1,5 @@
 import {
+	MockDeletedWorkspace,
 	MockFailedWorkspace,
 	MockStartingWorkspace,
 	MockStoppedWorkspace,
@@ -169,6 +170,15 @@ export const TerminatedBuildWithStatus: Story = {
 	},
 };
 
+export const DeletedWorkspace: Story = {
+	beforeEach: () => {
+		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
+		spyOn(API, "getWorkspaceByOwnerAndName").mockResolvedValue(
+			MockDeletedWorkspace,
+		);
+	},
+};
+
 export const WaitingStartupScripts: Story = {
 	beforeEach: () => {
 		spyOn(API.experimental, "getTask").mockResolvedValue(MockTask);
diff --git a/site/src/pages/TaskPage/TaskPage.tsx b/site/src/pages/TaskPage/TaskPage.tsx
index 793a3b44b12eb..f57d0e9f1772c 100644
--- a/site/src/pages/TaskPage/TaskPage.tsx
+++ b/site/src/pages/TaskPage/TaskPage.tsx
@@ -221,7 +221,27 @@ const WorkspaceNotRunning: FC<WorkspaceNotRunningProps> = ({ workspace }) => {
 		? mutateStartWorkspace.error
 		: undefined;
 
-	return (
+	const deleted = workspace.latest_build?.transition === ("delete" as const);
+
+	return deleted ? (
+		<Margins>
+			<div className="w-full min-h-80 flex items-center justify-center">
+				<div className="flex flex-col items-center">
+					<h3 className="m-0 font-medium text-content-primary text-base">
+						Task workspace was deleted.
+					</h3>
+					<span className="text-content-secondary text-sm">
+						This task cannot be resumed. Delete this task and create a new one.
+					</span>
+					<Button size="sm" variant="outline" asChild className="mt-4">
+						<RouterLink to="/tasks" data-testid="task-create-new">
+							Create a new task
+						</RouterLink>
+					</Button>
+				</div>
+			</div>
+		</Margins>
+	) : (
 		<Margins>
 			<div className="w-full min-h-80 flex items-center justify-center">
 				<div className="flex flex-col items-center">

From ea0aca0f26f3b32e95ce624e3877acbcaaa7c7ca Mon Sep 17 00:00:00 2001
From: Mathias Fredriksson <mafredri@gmail.com>
Date: Tue, 4 Nov 2025 15:25:58 +0200
Subject: [PATCH 294/298] fix(coderd): fix template ai task check error message
 (#20651) (#20659)

Create task was still mentioning magic prompt parameter when checking
template task validity. This change updates it to only mention validity
of `coder_ai_task` resource.

The previous message is incorrect, would lead to confusion and is
unhelpful.

(cherry picked from commit daad93967ac6c40b6335cdf1108dcf2036e6cc99)
---
 coderd/aitasks.go                | 2 +-
 codersdk/toolsdk/toolsdk_test.go | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/coderd/aitasks.go b/coderd/aitasks.go
index 8415a01454d0a..bf059ea4db95e 100644
--- a/coderd/aitasks.go
+++ b/coderd/aitasks.go
@@ -143,7 +143,7 @@ func (api *API) tasksCreate(rw http.ResponseWriter, r *http.Request) {
 
 	if !templateVersion.HasAITask.Valid || !templateVersion.HasAITask.Bool {
 		httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
-			Message: fmt.Sprintf(`Template does not have required parameter %q`, codersdk.AITaskPromptParameterName),
+			Message: `Template does not have a valid "coder_ai_task" resource.`,
 		})
 		return
 	}
diff --git a/codersdk/toolsdk/toolsdk_test.go b/codersdk/toolsdk/toolsdk_test.go
index 749105f5b85ed..beb3cf4339178 100644
--- a/codersdk/toolsdk/toolsdk_test.go
+++ b/codersdk/toolsdk/toolsdk_test.go
@@ -851,7 +851,7 @@ func TestTools(t *testing.T) {
 					TemplateVersionID: r.TemplateVersion.ID.String(),
 					Input:             "do yet another barrel roll",
 				},
-				error: "Template does not have required parameter \"AI Prompt\"",
+				error: "Template does not have a valid \"coder_ai_task\" resource.",
 			},
 			{
 				name: "WithPreset",
@@ -860,7 +860,7 @@ func TestTools(t *testing.T) {
 					TemplateVersionPresetID: presetID.String(),
 					Input:                   "not enough barrel rolls",
 				},
-				error: "Template does not have required parameter \"AI Prompt\"",
+				error: "Template does not have a valid \"coder_ai_task\" resource.",
 			},
 		}
 

From 1b1e3cb706b899e0779f1561e088ee8cbd3f6aaf Mon Sep 17 00:00:00 2001
From: Dean Sheather <dean@deansheather.com>
Date: Tue, 4 Nov 2025 09:11:37 -0800
Subject: [PATCH 295/298] chore: change managed agent limit (#20664)

(cherry picked from commit b3f651d62f27a762d8f864b6123d111fce4626c0)
---
 enterprise/coderd/license/license.go      | 57 ++++++++++++-----------
 enterprise/coderd/license/license_test.go | 28 +++++------
 2 files changed, 45 insertions(+), 40 deletions(-)

diff --git a/enterprise/coderd/license/license.go b/enterprise/coderd/license/license.go
index e66915f221f5a..3cf23823d2d5d 100644
--- a/enterprise/coderd/license/license.go
+++ b/enterprise/coderd/license/license.go
@@ -262,6 +262,36 @@ func LicensesEntitlements(
 			claims.FeatureSet = codersdk.FeatureSetEnterprise
 		}
 
+		// Temporary: If the license doesn't have a managed agent limit, we add
+		//            a default of 1000 managed agents per deployment for a 100
+		//            year license term.
+		//            This only applies to "Premium" licenses.
+		if claims.FeatureSet == codersdk.FeatureSetPremium {
+			var (
+				// We intentionally use a fixed issue time here, before the
+				// entitlement was added to any new licenses, so any
+				// licenses with the corresponding features actually set
+				// trump this default entitlement, even if they are set to a
+				// smaller value.
+				defaultManagedAgentsIsuedAt         = time.Date(2025, 7, 1, 0, 0, 0, 0, time.UTC)
+				defaultManagedAgentsStart           = defaultManagedAgentsIsuedAt
+				defaultManagedAgentsEnd             = defaultManagedAgentsStart.AddDate(100, 0, 0)
+				defaultManagedAgentsSoftLimit int64 = 1000
+				defaultManagedAgentsHardLimit int64 = 1000
+			)
+			entitlements.AddFeature(codersdk.FeatureManagedAgentLimit, codersdk.Feature{
+				Enabled:     true,
+				Entitlement: entitlement,
+				SoftLimit:   &defaultManagedAgentsSoftLimit,
+				Limit:       &defaultManagedAgentsHardLimit,
+				UsagePeriod: &codersdk.UsagePeriod{
+					IssuedAt: defaultManagedAgentsIsuedAt,
+					Start:    defaultManagedAgentsStart,
+					End:      defaultManagedAgentsEnd,
+				},
+			})
+		}
+
 		// Add all features from the feature set defined.
 		for _, featureName := range claims.FeatureSet.Features() {
 			if _, ok := licenseForbiddenFeatures[featureName]; ok {
@@ -338,33 +368,6 @@ func LicensesEntitlements(
 					Limit:       &featureValue,
 					Actual:      &featureArguments.ActiveUserCount,
 				})
-
-				// Temporary: If the license doesn't have a managed agent limit,
-				//            we add a default of 800 managed agents per user.
-				//            This only applies to "Premium" licenses.
-				if claims.FeatureSet == codersdk.FeatureSetPremium {
-					var (
-						// We intentionally use a fixed issue time here, before the
-						// entitlement was added to any new licenses, so any
-						// licenses with the corresponding features actually set
-						// trump this default entitlement, even if they are set to a
-						// smaller value.
-						issueTime             = time.Date(2025, 7, 1, 0, 0, 0, 0, time.UTC)
-						defaultSoftAgentLimit = 800 * featureValue
-						defaultHardAgentLimit = 1000 * featureValue
-					)
-					entitlements.AddFeature(codersdk.FeatureManagedAgentLimit, codersdk.Feature{
-						Enabled:     true,
-						Entitlement: entitlement,
-						SoftLimit:   &defaultSoftAgentLimit,
-						Limit:       &defaultHardAgentLimit,
-						UsagePeriod: &codersdk.UsagePeriod{
-							IssuedAt: issueTime,
-							Start:    usagePeriodStart,
-							End:      usagePeriodEnd,
-						},
-					})
-				}
 			default:
 				if featureValue <= 0 {
 					// The feature is disabled.
diff --git a/enterprise/coderd/license/license_test.go b/enterprise/coderd/license/license_test.go
index 0e540989b69da..6c53fb3d89f22 100644
--- a/enterprise/coderd/license/license_test.go
+++ b/enterprise/coderd/license/license_test.go
@@ -520,8 +520,8 @@ func TestEntitlements(t *testing.T) {
 	t.Run("Premium", func(t *testing.T) {
 		t.Parallel()
 		const userLimit = 1
-		const expectedAgentSoftLimit = 800 * userLimit
-		const expectedAgentHardLimit = 1000 * userLimit
+		const expectedAgentSoftLimit = 1000
+		const expectedAgentHardLimit = 1000
 
 		db, _ := dbtestutil.NewDB(t)
 		licenseOptions := coderdenttest.LicenseOptions{
@@ -530,9 +530,7 @@ func TestEntitlements(t *testing.T) {
 			ExpiresAt:  dbtime.Now().Add(time.Hour * 24 * 2),
 			FeatureSet: codersdk.FeatureSetPremium,
 			Features: license.Features{
-				// Temporary: allows the default value for the
-				//            managed_agent_limit feature to be used.
-				codersdk.FeatureUserLimit: 1,
+				codersdk.FeatureUserLimit: userLimit,
 			},
 		}
 		_, err := db.InsertLicense(context.Background(), database.InsertLicenseParams{
@@ -557,11 +555,15 @@ func TestEntitlements(t *testing.T) {
 				require.Equal(t, codersdk.EntitlementEntitled, agentEntitlement.Entitlement)
 				require.EqualValues(t, expectedAgentSoftLimit, *agentEntitlement.SoftLimit)
 				require.EqualValues(t, expectedAgentHardLimit, *agentEntitlement.Limit)
+
 				// This might be shocking, but there's a sound reason for this.
 				// See license.go for more details.
-				require.Equal(t, time.Date(2025, 7, 1, 0, 0, 0, 0, time.UTC), agentEntitlement.UsagePeriod.IssuedAt)
-				require.WithinDuration(t, licenseOptions.NotBefore, agentEntitlement.UsagePeriod.Start, time.Second)
-				require.WithinDuration(t, licenseOptions.ExpiresAt, agentEntitlement.UsagePeriod.End, time.Second)
+				agentUsagePeriodIssuedAt := time.Date(2025, 7, 1, 0, 0, 0, 0, time.UTC)
+				agentUsagePeriodStart := agentUsagePeriodIssuedAt
+				agentUsagePeriodEnd := agentUsagePeriodStart.AddDate(100, 0, 0)
+				require.Equal(t, agentUsagePeriodIssuedAt, agentEntitlement.UsagePeriod.IssuedAt)
+				require.WithinDuration(t, agentUsagePeriodStart, agentEntitlement.UsagePeriod.Start, time.Second)
+				require.WithinDuration(t, agentUsagePeriodEnd, agentEntitlement.UsagePeriod.End, time.Second)
 				continue
 			}
 
@@ -1496,14 +1498,14 @@ func TestManagedAgentLimitDefault(t *testing.T) {
 	})
 
 	// "Premium" licenses should receive a default managed agent limit of:
-	// soft = 800 * user_limit
-	// hard = 1000 * user_limit
+	// soft = 1000
+	// hard = 1000
 	t.Run("Premium", func(t *testing.T) {
 		t.Parallel()
 
-		const userLimit = 100
-		const softLimit = 800 * userLimit
-		const hardLimit = 1000 * userLimit
+		const userLimit = 33
+		const softLimit = 1000
+		const hardLimit = 1000
 		lic := database.License{
 			ID:         1,
 			UploadedAt: time.Now(),

From b8ab2d351fbd6b68ca5afe659de89e25c300f3c3 Mon Sep 17 00:00:00 2001
From: Cian Johnston <cian@coder.com>
Date: Mon, 10 Nov 2025 16:56:18 +0000
Subject: [PATCH 296/298] chore: update Go to 1.24.10 (#20684) (#20688)

(cherry picked from commit 81c33756707ce699b9d116d7c3aba0ea2b4c6e5c)

Signed-off-by: Danny Kopping <danny@coder.com>
Co-authored-by: Danny Kopping <danny@coder.com>
---
 .github/actions/setup-go/action.yaml | 2 +-
 dogfood/coder/Dockerfile             | 4 ++--
 go.mod                               | 2 +-
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/actions/setup-go/action.yaml b/.github/actions/setup-go/action.yaml
index 097a1b6cfd119..02b54830cdf61 100644
--- a/.github/actions/setup-go/action.yaml
+++ b/.github/actions/setup-go/action.yaml
@@ -4,7 +4,7 @@ description: |
 inputs:
   version:
     description: "The Go version to use."
-    default: "1.24.6"
+    default: "1.24.10"
   use-preinstalled-go:
     description: "Whether to use preinstalled Go."
     default: "false"
diff --git a/dogfood/coder/Dockerfile b/dogfood/coder/Dockerfile
index 932e2ce9b06a6..1214bd17ca44f 100644
--- a/dogfood/coder/Dockerfile
+++ b/dogfood/coder/Dockerfile
@@ -11,8 +11,8 @@ RUN cargo install jj-cli typos-cli watchexec-cli
 FROM ubuntu:jammy@sha256:4e0171b9275e12d375863f2b3ae9ce00a4c53ddda176bd55868df97ac6f21a6e AS go
 
 # Install Go manually, so that we can control the version
-ARG GO_VERSION=1.24.6
-ARG GO_CHECKSUM="bbca37cc395c974ffa4893ee35819ad23ebb27426df87af92e93a9ec66ef8712"
+ARG GO_VERSION=1.24.10
+ARG GO_CHECKSUM="dd52b974e3d9c5a7bbfb222c685806def6be5d6f7efd10f9caa9ca1fa2f47955"
 
 # Boring Go is needed to build FIPS-compliant binaries.
 RUN apt-get update && \
diff --git a/go.mod b/go.mod
index d87c8300234c8..1d6d85b95062a 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/coder/coder/v2
 
-go 1.24.6
+go 1.24.10
 
 // Required until a v3 of chroma is created to lazily initialize all XML files.
 // None of our dependencies seem to use the registries anyways, so this

From 097e085fcb0b8dbcaa78e3338444d1b0c6af6a90 Mon Sep 17 00:00:00 2001
From: Spike Curtis <spike@coder.com>
Date: Wed, 12 Nov 2025 00:30:09 +0400
Subject: [PATCH 297/298] fix: use correct slog arguments (#20721) (#20723)

Fixes a bad slog.Error() command that didn't wrap the error in
`slog.Error`

(cherry pick form https://github.com/coder/coder/pull/20721)
---
 codersdk/agentsdk/agentsdk.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/codersdk/agentsdk/agentsdk.go b/codersdk/agentsdk/agentsdk.go
index a6c8e5b1ea620..b668ab4a36569 100644
--- a/codersdk/agentsdk/agentsdk.go
+++ b/codersdk/agentsdk/agentsdk.go
@@ -391,7 +391,7 @@ func (i *InstanceIdentitySessionTokenProvider) GetSessionToken() string {
 	defer cancel()
 	resp, err := i.TokenExchanger.exchange(ctx)
 	if err != nil {
-		i.logger.Error(ctx, "failed to exchange session token: %v", err)
+		i.logger.Error(ctx, "failed to exchange session token", slog.Error(err))
 		return ""
 	}
 	i.sessionToken = resp.SessionToken

From 7beb95fd56d2f790502e236b64906f8eefb969bd Mon Sep 17 00:00:00 2001
From: Danny Kopping <danny@coder.com>
Date: Wed, 12 Nov 2025 17:41:49 +0200
Subject: [PATCH 298/298] fix: upgrade aibridge lib to fix cache issue (#20730)
 (#20734)

Backport of #20730

Signed-off-by: Danny Kopping <danny@coder.com>
---
 go.mod | 2 +-
 go.sum | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/go.mod b/go.mod
index 1d6d85b95062a..00c9f2ba71cbe 100644
--- a/go.mod
+++ b/go.mod
@@ -476,7 +476,7 @@ require (
 	github.com/anthropics/anthropic-sdk-go v1.13.0
 	github.com/brianvoe/gofakeit/v7 v7.8.0
 	github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225
-	github.com/coder/aibridge v0.1.6
+	github.com/coder/aibridge v0.1.7
 	github.com/coder/aisdk-go v0.0.9
 	github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945
 	github.com/coder/preview v1.0.4
diff --git a/go.sum b/go.sum
index 2655cb93f2cbd..58992e6cebbdb 100644
--- a/go.sum
+++ b/go.sum
@@ -917,8 +917,8 @@ github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 h1:aQ3y1lwWyqYPiWZThqv
 github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443/go.mod h1:W+zGtBO5Y1IgJhy4+A9GOqVhqLpfZi+vwmdNXUehLA8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225 h1:tRIViZ5JRmzdOEo5wUWngaGEFBG8OaE1o2GIHN5ujJ8=
 github.com/coder/agentapi-sdk-go v0.0.0-20250505131810-560d1d88d225/go.mod h1:rNLVpYgEVeu1Zk29K64z6Od8RBP9DwqCu9OfCzh8MR4=
-github.com/coder/aibridge v0.1.6 h1:Ax9hfAQeg+vLeE9M/IMmARuBuGyCuFdMw8bpy72/fD8=
-github.com/coder/aibridge v0.1.6/go.mod h1:7GhrLbzf6uM3sCA7OPaDzvq9QNrCjNuzMy+WgipYwfQ=
+github.com/coder/aibridge v0.1.7 h1:GTAM8nHawXMeb/pxAIwvzr76dyVGu9hw9qV6Gvpc7nw=
+github.com/coder/aibridge v0.1.7/go.mod h1:7GhrLbzf6uM3sCA7OPaDzvq9QNrCjNuzMy+WgipYwfQ=
 github.com/coder/aisdk-go v0.0.9 h1:Vzo/k2qwVGLTR10ESDeP2Ecek1SdPfZlEjtTfMveiVo=
 github.com/coder/aisdk-go v0.0.9/go.mod h1:KF6/Vkono0FJJOtWtveh5j7yfNrSctVTpwgweYWSp5M=
 github.com/coder/boundary v1.0.1-0.20250925154134-55a44f2a7945 h1:hDUf02kTX8EGR3+5B+v5KdYvORs4YNfDPci0zCs+pC0=