From 1bad0c7bb8362a0f662d39f74470ea203c54bed3 Mon Sep 17 00:00:00 2001 From: Clint Thomon Date: Sat, 15 Aug 2026 13:54:18 -0500 Subject: [PATCH 01/30] chore(sync): port Manage365 upstream-sync process, tooling, and history to monorepo --- Tools/Start-UpstreamSyncCycle.ps1 | 92 + Tools/Update-Version.ps1 | 59 + .../MONOREPO_MIGRATION_20260815.md | 43 + docs/upstream-sync/PROCESS.md | 172 + docs/upstream-sync/README.md | 17 + .../APPLIED_COMMITS_CIPP_API_20260617.md | 81 + .../BASELINES_INTAKE_20260814.md | 25 + .../BATCH7_VALIDATION_CIPP_API_20260617.md | 256 + .../CIPP_API_SYNC_CHECKPOINT_20260617.md | 198 + ...CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md | 193 + .../CUSTOM_FEATURE_MAP_20260617.md | 275 + .../DEFERRED_REVIEW_CIPP_API_20260617.md | 464 ++ .../FIRST_PASS_REPORT_20260617.md | 249 + .../history-cipp-api/MCP_INTAKE_20260803.md | 47 + docs/upstream-sync/history-cipp-api/README.md | 13 + .../history-cipp-api/SYNC_20260701.md | 9 + .../history-cipp-api/SYNC_20260803.md | 60 + .../history-cipp-api/SYNC_20260814.md | 66 + .../UPSTREAM_DELTA_CIPP_20260814.md | 33 + .../UPSTREAM_DELTA_CIPP_API_20260617.md | 358 ++ .../UPSTREAM_DELTA_CIPP_API_20260727.md | 107 + .../UPSTREAM_DELTA_CIPP_API_20260803.md | 48 + .../UPSTREAM_DELTA_CIPP_API_20260814.md | 38 + .../UPSTREAM_SYNC_CIPP_API_20260617.md | 5713 +++++++++++++++++ .../USERREPORTEDPHISHING_API_20260617.md | 84 + ...RREPORTEDPHISHING_FINAL_STATUS_20260617.md | 98 + ...SERREPORTEDPHISHING_POST_MERGE_20260617.md | 212 + ...PORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md | 300 + .../APPLIED_COMMITS_CIPP_20260617.md | 75 + .../APPLIED_COMMITS_CIPP_CYCLE2_20260617.md | 97 + .../history-cipp/BASELINES_INTAKE_20260814.md | 25 + .../history-cipp/BEC_INTAKE_20260715.md | 64 + .../CIPP_SYNC_CHECKPOINT_20260617.md | 123 + .../COPILOT_AI_INTAKE_20260715.md | 84 + .../CUSTOM_FEATURE_MAP_20260617.md | 266 + .../EXCHANGE_FAMILY_INTAKE_20260715.md | 84 + .../FIRST_PASS_REPORT_20260617.md | 249 + .../history-cipp/MCP_INTAKE_20260803.md | 47 + .../MEMDEVICES_COMPONENTS_INTAKE_20260715.md | 105 + .../history-cipp/ODDSENDS_INTAKE_20260715.md | 87 + docs/upstream-sync/history-cipp/PROCESS.md | 276 + docs/upstream-sync/history-cipp/README.md | 55 + .../history-cipp/SAMCERT_INTAKE_20260715.md | 87 + .../SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md | 114 + .../history-cipp/SPO_SUITE_INTAKE_20260715.md | 141 + .../SSO_FAMILY_DECISION_20260715.md | 83 + .../history-cipp/SYNC_20260701.md | 78 + .../history-cipp/SYNC_20260713.md | 128 + .../history-cipp/SYNC_20260727.md | 106 + .../history-cipp/SYNC_20260728.md | 135 + .../history-cipp/SYNC_20260803.md | 60 + .../history-cipp/SYNC_20260814.md | 66 + .../UPSTREAM_DELTA_CIPP_20260617.md | 286 + .../UPSTREAM_DELTA_CIPP_20260727.md | 77 + .../UPSTREAM_DELTA_CIPP_20260803.md | 45 + .../UPSTREAM_DELTA_CIPP_20260814.md | 33 + .../UPSTREAM_SYNC_CIPP_20260617.md | 4382 +++++++++++++ ...SERACTIONS_NESTEDGROUPS_INTAKE_20260715.md | 65 + .../USERREPORTEDPHISHING_FRONTEND_20260617.md | 73 + ...EDPHISHING_FRONTEND_POST_MERGE_20260617.md | 64 + 60 files changed, 16970 insertions(+) create mode 100644 Tools/Start-UpstreamSyncCycle.ps1 create mode 100644 Tools/Update-Version.ps1 create mode 100644 docs/upstream-sync/MONOREPO_MIGRATION_20260815.md create mode 100644 docs/upstream-sync/PROCESS.md create mode 100644 docs/upstream-sync/README.md create mode 100644 docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md create mode 100644 docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md create mode 100644 docs/upstream-sync/history-cipp-api/README.md create mode 100644 docs/upstream-sync/history-cipp-api/SYNC_20260701.md create mode 100644 docs/upstream-sync/history-cipp-api/SYNC_20260803.md create mode 100644 docs/upstream-sync/history-cipp-api/SYNC_20260814.md create mode 100644 docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md create mode 100644 docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md create mode 100644 docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md create mode 100644 docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md create mode 100644 docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md create mode 100644 docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md create mode 100644 docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md create mode 100644 docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md create mode 100644 docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md create mode 100644 docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md create mode 100644 docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md create mode 100644 docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md create mode 100644 docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md create mode 100644 docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/PROCESS.md create mode 100644 docs/upstream-sync/history-cipp/README.md create mode 100644 docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md create mode 100644 docs/upstream-sync/history-cipp/SYNC_20260701.md create mode 100644 docs/upstream-sync/history-cipp/SYNC_20260713.md create mode 100644 docs/upstream-sync/history-cipp/SYNC_20260727.md create mode 100644 docs/upstream-sync/history-cipp/SYNC_20260728.md create mode 100644 docs/upstream-sync/history-cipp/SYNC_20260803.md create mode 100644 docs/upstream-sync/history-cipp/SYNC_20260814.md create mode 100644 docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md create mode 100644 docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md create mode 100644 docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md create mode 100644 docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md create mode 100644 docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md create mode 100644 docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md create mode 100644 docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md create mode 100644 docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md diff --git a/Tools/Start-UpstreamSyncCycle.ps1 b/Tools/Start-UpstreamSyncCycle.ps1 new file mode 100644 index 0000000000..d421945e84 --- /dev/null +++ b/Tools/Start-UpstreamSyncCycle.ps1 @@ -0,0 +1,92 @@ +<# +.SYNOPSIS + Start a Manage365 upstream sync cycle — fetch, tag backup, create sync branch, print delta stats. + +.DESCRIPTION + Monorepo edition. Manage365 tracks the CyberDrain CIPP monorepo (frontend + backend in one + repo) as `upstream`. This replaces the two-repo (CIPP / CIPP-API) cycle script from the + pre-monorepo era; those histories live under docs/upstream-sync/history-cipp{,-api}/. + +.PARAMETER SyncBase + Optional commit SHA to measure delta from (default: current main tip before branch switch) + +.PARAMETER DateStamp + Optional YYYYMMDD (default: today) + +.EXAMPLE + ./Tools/Start-UpstreamSyncCycle.ps1 +#> +[CmdletBinding()] +param( + [string]$SyncBase, + + [string]$DateStamp = (Get-Date -Format 'yyyyMMdd') +) + +$ErrorActionPreference = 'Stop' + +$prod = 'main' +$upstreamRef = 'upstream/main' +$slug = 'manage365' + +Write-Host '=== Manage365 upstream sync: monorepo ===' -ForegroundColor Cyan +Write-Host "Date stamp: $DateStamp" + +if (-not (git rev-parse --git-dir 2>$null)) { + throw 'Not a git repository. Run from the Manage365 repo root.' +} + +$status = git status --porcelain +if ($status) { + Write-Warning 'Working tree is not clean:' + Write-Host $status + throw 'Commit or stash changes before starting a sync cycle.' +} + +Write-Host 'Fetching upstream...' +git fetch upstream 2>&1 | Out-Host + +$tip = (git rev-parse $prod).Trim() +if (-not $SyncBase) { $SyncBase = $tip } + +$backupTag = "backup/pre-upstream-sync-$slug-$DateStamp" +$syncBranch = "manage365/upstream-sync-$DateStamp" + +Write-Host '' +Write-Host "Production branch: $prod @ $tip" +Write-Host "Sync base: $SyncBase" +Write-Host "Upstream: $upstreamRef @ $(git rev-parse $upstreamRef)" + +$counts = (git rev-list --left-right --count "$prod...$upstreamRef").Trim() -split '\s+' +Write-Host "Ahead of upstream: $($counts[0])" +Write-Host "Behind upstream: $($counts[1])" + +$deltaCount = (git rev-list --count "$SyncBase..$upstreamRef").Trim() +Write-Host "Commits to review (since sync base): $deltaCount" + +Write-Host '' +Write-Host "Creating backup tag: $backupTag" +git tag $backupTag $tip 2>$null +if ($LASTEXITCODE -ne 0) { + Write-Warning "Tag may already exist: $backupTag" +} + +$existing = git branch --list $syncBranch +if ($existing) { + Write-Warning "Branch already exists: $syncBranch — checking out" + git checkout $syncBranch +} else { + Write-Host "Creating sync branch: $syncBranch from $prod" + git checkout -b $syncBranch $prod +} + +Write-Host '' +Write-Host 'Next steps:' -ForegroundColor Green +Write-Host ' 1. Read docs/upstream-sync/PROCESS.md' +Write-Host " 2. Generate UPSTREAM_DELTA_$DateStamp.md (git log $SyncBase..$upstreamRef)" +Write-Host ' 3. Triage commits — Apply / Adapt / Defer / Skip' +Write-Host ' 4. Cherry-pick mini-batches on this branch' +Write-Host " 5. Write SYNC_CHECKPOINT_$DateStamp.md when done" +Write-Host '' +Write-Host 'Sample inventory command:' +Write-Host " git log --oneline $SyncBase..$upstreamRef" -ForegroundColor DarkGray diff --git a/Tools/Update-Version.ps1 b/Tools/Update-Version.ps1 new file mode 100644 index 0000000000..6f0a1fc71a --- /dev/null +++ b/Tools/Update-Version.ps1 @@ -0,0 +1,59 @@ +<# +.SYNOPSIS + Bump version tracking files after a Manage365 upstream intake (monorepo edition). + +.DESCRIPTION + Updates the upstream baseline version used by GetVersion / GetCippAlerts out-of-date checks + and the Manage365 fork release shown in Application Settings. + + Files written: + frontend/public/version.json — upstream baseline (dev source; the Docker image + build overwrites out/version.json from the + APP_VERSION build arg, so pass the same value + there when building a release image) + frontend/package.json — upstream baseline + backend/version_latest.txt — upstream baseline + frontend/public/manage365-version.json — Manage365 release + baseline (flows into the + static export untouched) + +.PARAMETER UpstreamVersion + CIPP upstream baseline absorbed (e.g. 10.8.5). + +.PARAMETER Manage365Version + Optional Manage365 fork release (e.g. 5.33.0). + +.EXAMPLE + ./Tools/Update-Version.ps1 -UpstreamVersion 10.8.5 -Manage365Version 5.33.0 +#> +[CmdletBinding()] +param( + [Parameter(Mandatory = $true)] + [string]$UpstreamVersion, + + [string]$Manage365Version +) + +Set-Location (Get-Item $PSScriptRoot).Parent.FullName + +Set-Content 'backend/version_latest.txt' -Value $UpstreamVersion -NoNewline + +$VersionJson = @{ version = $UpstreamVersion } | ConvertTo-Json +Set-Content 'frontend/public/version.json' -Value $VersionJson + +$Package = Get-Content frontend/package.json -Raw | ConvertFrom-Json +$Package.version = $UpstreamVersion +$Package | ConvertTo-Json -Depth 10 | Set-Content frontend/package.json + +if ($Manage365Version) { + $Manage365Json = @{ + version = $Manage365Version + upstreamBaseline = $UpstreamVersion + } | ConvertTo-Json + Set-Content 'frontend/public/manage365-version.json' -Value $Manage365Json +} + +Write-Host "Upstream baseline set to $UpstreamVersion" +if ($Manage365Version) { + Write-Host "Manage365 release set to $Manage365Version" +} +Write-Host "Remember: pass APP_VERSION=$UpstreamVersion when building the container image, then deploy it." diff --git a/docs/upstream-sync/MONOREPO_MIGRATION_20260815.md b/docs/upstream-sync/MONOREPO_MIGRATION_20260815.md new file mode 100644 index 0000000000..93b88f619f --- /dev/null +++ b/docs/upstream-sync/MONOREPO_MIGRATION_20260815.md @@ -0,0 +1,43 @@ +# Monorepo Migration — 2026-08-15 + +Migration of Manage365 customizations (branding + features) from the two-repo forks +(`Celeratec/CIPP` @ v5.33.0 / upstream 10.8.5, `Celeratec/CIPP-API` @ upstream 10.8.5) +into this monorepo (base: CyberDrain CIPP monorepo v10.8.5, Craft container runtime). + +- **Branch:** `manage365/monorepo-migration-20260815` +- **Base:** `main` @ `04e249350` (docs: document Manage365 5.33.0 / upstream 10.8.5 in README) +- **Upstream remote:** `upstream` → CyberDrain/CIPP (monorepo), fetched 2026-08-15 +- **Source repos:** `~/Documents/GitHub/CIPP` (frontend fork), `~/Documents/GitHub/CIPP-API` (backend fork) + +## Porting rules used + +1. Net-new backend endpoints land in `backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/` + with `.FUNCTIONALITY Entrypoint` + `.ROLE` help comments. +2. Net-new activity workers (`Push-*`) land in `backend/Modules/CIPPActivityTriggers/`. +3. Queue/orchestration wiring goes through the Craft bridges (`Add-CippQueueMessage`, + `Start-CIPPOrchestrator`) — no `Push-OutputBinding`, no Durable client calls, no + processor-slot offload. +4. Frontend pages/components port path-for-path into `frontend/src/`. +5. Auth-sensitive code must tolerate the EasyAuth `/.auth/me` array shape (upstream + `PrivateRoute` already does; ported code must not regress it). +6. Where the fork was *behind* upstream (SSO, CIPP users, container management, + branding-settings backend, `Initialize-CIPPAuth`), the upstream monorepo version wins. +7. Dropped as obsolete: `staticwebapp.config.json`, SWA deploy workflow, function-app slot + workflows (`master_cippbefno*`), `Start-CIPPProcessorQueue` processor-slot model, + `Set-CippApiAuth` EasyAuth/ARM hacks, `profile.ps1` / `host.json` mods, vendored + `MicrosoftTeams/7.4.0` module (pending Teams V2 decision). + +## Phase status + +| Phase | Status | Notes | +|-------|--------|-------| +| 0 — Foundation | in progress | upstream remote added; sync tooling/docs ported; local container smoke pending | +| 1 — Branding & identity | pending | | +| 2 — Feature verticals (all A–I selected) | pending | Order: E, F, H, B, G, D, C, A, I | +| 3 — Cross-cutting UI | pending | | +| 4 — Hooked logic | pending | | +| 5 — Cutover | pending | production migration is a separate operational step | + +## Tranche log + +(filled in as tranches land) diff --git a/docs/upstream-sync/PROCESS.md b/docs/upstream-sync/PROCESS.md new file mode 100644 index 0000000000..7aacdb4a14 --- /dev/null +++ b/docs/upstream-sync/PROCESS.md @@ -0,0 +1,172 @@ +# Manage365 Upstream Sync Process (Monorepo) + +This document defines how Manage365 reviews the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) on a regular cadence and ports advantageous changes **without** overwriting fork-specific features. + +Manage365 previously tracked the split `KelvinTegelaar/CIPP` and `KelvinTegelaar/CIPP-API` repos. Those cycles (through v10.8.5 / Manage365 v5.33.0, August 2026) are archived under [history-cipp/](./history-cipp/) and [history-cipp-api/](./history-cipp-api/). The principles are unchanged; only the mechanics moved to a single repo and a container deployment. + +**Related artifacts** + +| Document | Purpose | +|----------|---------| +| [history-cipp/CUSTOM_FEATURE_MAP_20260617.md](./history-cipp/CUSTOM_FEATURE_MAP_20260617.md) | Protected fork areas — refresh each cycle | +| [history-cipp/PROCESS.md](./history-cipp/PROCESS.md) | Pre-monorepo (two-repo) edition of this process | +| [README.md](./README.md) | Index of cycle-specific tracking docs | + +--- + +## Principles + +1. **Selective intake, not wholesale merge** — cherry-pick or surgical port; never blind `Sync fork → Discard commits`. +2. **Fork features are protected by default** — see `CUSTOM_FEATURE_MAP`. When in doubt, adapt upstream logic into fork files instead of replacing them. +3. **Frontend + backend move together** — the monorepo makes this natural: a feature's `frontend/` and `backend/` changes ship in the same branch, or the whole feature is deferred. +4. **Explicit approval gates** — no production merge without review checklist and version bump. +5. **GitHub "Sync fork" badge is cosmetic** — a large behind-count is expected with selective intake. + +--- + +## Cadence + +| Cycle type | When | Duration | Goal | +|------------|------|----------|------| +| **Light delta** | Monthly (or when upstream patch releases) | 2–4 hours | Low-risk bugfixes, data JSON, tests, isolated endpoints | +| **Major cycle** | Quarterly (or after upstream minor) | 1–3 days | Full delta inventory, feature intake decisions, dependency review | +| **Feature intake** | As needed (backlog) | 1–5 days each | New upstream capabilities — design first, then port | +| **Hotfix** | Within 48h of critical upstream security fix | Hours | Cherry-pick specific SHA(s), fast deploy | + +--- + +## Cycle workflow + +```mermaid +flowchart TD + A[0. Plan] --> B[1. Protect] + B --> C[2. Inventory] + C --> D[3. Triage] + D --> E[4. Apply mini-batches] + E --> F[5. Verify] + F --> G[6. Checkpoint + PR] + G --> H[7. Version + deploy] + H --> I[8. Close cycle] +``` + +### Phase 0 — Plan + +- [ ] Decide cycle type (light / major / feature intake / hotfix) +- [ ] Record last sync base SHA (from previous checkpoint or tag) +- [ ] For **feature intake**: complete design Q&A before coding + +### Phase 1 — Protect + +```powershell +# From the repo root +./Tools/Start-UpstreamSyncCycle.ps1 +``` + +- [ ] Backup tag on `main` tip (`backup/pre-upstream-sync-manage365-YYYYMMDD`) +- [ ] Sync branch created (`manage365/upstream-sync-YYYYMMDD`); never commit directly to `main` during review +- [ ] Working tree clean + +### Phase 2 — Inventory + +```bash +git log --oneline BASE..upstream/main +git rev-list --left-right --count main...upstream/main +``` + +Generate (or update agent-assisted): + +- `UPSTREAM_DELTA_YYYYMMDD.md` — commits since last base +- Refresh `CUSTOM_FEATURE_MAP_YYYYMMDD.md` if protected areas changed + +### Phase 3 — Triage + +Classify **every candidate** into one outcome: + +| Outcome | Meaning | +|---------|---------| +| **Apply** | Clean cherry-pick or copy; no protected-path conflict | +| **Adapt** | Port logic surgically; do not replace whole fork files | +| **Already implemented** | Fork already has equivalent behavior — document evidence | +| **Defer** | Worth doing later; needs design or conflict resolution | +| **Skip** | Wrong for fork (hosted-only, removes customization, low value) | + +**Protected-path rule:** If any file in `CUSTOM_FEATURE_MAP` is touched, outcome must be **Adapt** or **Defer** — never blind **Apply**. + +### Phase 4 — Apply mini-batches + +- Work in batches of **3–5 commits**, low-risk first +- Order: tests → data JSON → isolated bugfixes → shared components → protected areas last +- After each batch: build/test (see Phase 5) +- Record in `APPLIED_COMMITS_YYYYMMDD.md` (upstream SHA | fork SHA | outcome | notes) +- If cherry-pick conflicts: abort, switch to **Adapt** manual port + +### Phase 5 — Verify + +**Frontend** + +```bash +cd frontend && yarn build +``` + +**Backend** — as applicable: + +- Pester tests for touched modules (`backend/Tests`, `backend/Modules/*/Tests`) +- Local container smoke via `build/docker-compose-all.yml` (`docker compose -p cipp -f build/docker-compose-all.yml up --pull always --watch`) for changed endpoints + +**Manual smoke** (adjust per cycle): + +- Applied standards / drift +- Quarantine + email troubleshooter (protected) +- Top-nav search + dashboard v2 +- Any feature touched in this cycle + +### Phase 6 — Checkpoint + PR + +Write `SYNC_CHECKPOINT_YYYYMMDD.md` with: + +- Branch name, base SHA, tip SHA, backup tag +- Mini-batches table (upstream → outcome) +- Applied / adapted / deferred / skipped lists +- Known concerns and follow-ups +- **Recommendation:** ready for PR / needs more work / stop + +### Phase 7 — Version + deploy + +After merge to `main`: + +```powershell +./Tools/Update-Version.ps1 -UpstreamVersion 10.8.5 -Manage365Version 5.33.0 +``` + +- [ ] Bump `frontend/public/version.json` + `frontend/public/manage365-version.json` + `frontend/package.json` + `backend/version_latest.txt` (via script) +- [ ] Update README **Upstream Integration** section +- [ ] Build and push the container image, passing the upstream baseline as `APP_VERSION` (`build/Dockerfile` injects it into `out/version.json`) +- [ ] Deploy the image to the App Service container (staging slot first if configured) +- [ ] Confirm Application Settings → version page shows green / no false out-of-date toasts + +### Phase 8 — Close cycle + +- [ ] Tag sync completion: `sync/manage365-YYYYMMDD` on merged tip +- [ ] Record new **sync base SHA** in checkpoint (becomes next cycle's `BASE`) +- [ ] Archive deferred items into next cycle's triage queue + +--- + +## Decision guide: merge vs cherry-pick vs adapt + +| Situation | Action | +|-----------|--------| +| Upstream fix in a file we never customized | Cherry-pick **Apply** | +| Upstream changed same file as fork (CippDataTable, applied-standards, quarantine) | **Adapt** surgical diff | +| Upstream new feature, no fork overlap | Port files + wire nav/API | +| Upstream dependency major bump | **Major cycle** only; full build/test | +| Full upstream merge | Separate project; conflict marathon; not default | + +--- + +## Revision history + +| Date | Change | +|------|--------| +| 2026-06-09 | Initial formal process (two-repo era; see history-cipp/PROCESS.md) | +| 2026-08-15 | Monorepo edition — single repo, container deploy, Craft runtime | diff --git a/docs/upstream-sync/README.md b/docs/upstream-sync/README.md new file mode 100644 index 0000000000..400e277e2d --- /dev/null +++ b/docs/upstream-sync/README.md @@ -0,0 +1,17 @@ +# Upstream Sync Tracking + +Cycle-specific tracking documents for Manage365's selective intake from the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP). + +- **[PROCESS.md](./PROCESS.md)** — the sync process (monorepo edition). Start here. +- **`UPSTREAM_DELTA_YYYYMMDD.md`** — commit inventory for a cycle +- **`SYNC_CHECKPOINT_YYYYMMDD.md`** — cycle results and next sync base +- **`APPLIED_COMMITS_YYYYMMDD.md`** — per-commit outcomes + +## Pre-monorepo history + +Before August 2026, Manage365 tracked the split `KelvinTegelaar/CIPP` and `KelvinTegelaar/CIPP-API` repos and deployed to Azure Static Web Apps + Function App slots. Those cycle documents are preserved: + +- [history-cipp/](./history-cipp/) — frontend (CIPP) cycles through v10.8.5 / Manage365 v5.33.0 +- [history-cipp-api/](./history-cipp-api/) — backend (CIPP-API) cycles through v10.8.5 + +The migration of Manage365 customizations into this monorepo is documented in [MONOREPO_MIGRATION_20260815.md](./MONOREPO_MIGRATION_20260815.md). diff --git a/docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md new file mode 100644 index 0000000000..77f88df39a --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/APPLIED_COMMITS_CIPP_API_20260617.md @@ -0,0 +1,81 @@ +# Applied Commits Tracking — CIPP-API (Backend) + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-api-20260617` +Backup tag: `backup/pre-upstream-sync-cipp-api-20260617` + +Branch tip (after Batch 8): `5aba18061` + +## Summary + +| Status | Count | +|--------|-------| +| Applied cleanly | 11 | +| Applied with adaptation | 4 | +| Applied with adaptation (partial) | 0 | +| Skipped | 0 | +| Deferred (pending decision/adaptation) | 3 | +| Already implemented | 5 | +| Review complete | See `DEFERRED_REVIEW_CIPP_API_20260617.md` | + +## Commit Log + +| Upstream SHA | Applied SHA | Status | Reason | Files | Tests | Notes | +|--------------|-------------|--------|--------|-------|-------|-------| +| `2b4412449f1905c0bd8d5f89e93dcdeaac736d39` | `365937de821318968bda27b9b44180160afef4b1` | Applied cleanly | Low-risk test/helper addition; no custom overlap | `Modules/CIPPCore/Private/Get-CIPPLevenshteinDistance.ps1`, `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | Pester: 34 passed (`Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1`) | Cherry-pick `-x` succeeded with no conflicts | +| `133f929555f5d26a17757802d22ceaa8b3f6b926` | `05f48e4fb` | Applied with adaptation | Partial apply only — Levenshtein test path fallback; skipped fuzzy-match test file | `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | Pester: 34 passed (Levenshtein), 13 passed (`Tests/Tools`) | Full cherry-pick conflicted on modify/delete of `Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1` (not in fork). Skipped fuzzy-match test path change and did not add upstream fuzzy-match helper. Added `Public/Tools/` → `Private/` path fallback per upstream intent. | +| `6aa66c744b8c755f48b75044ca5c876e9e2c90e3` | `1784ccb993fdb316e37bf768168941deeea587f2` | Applied cleanly | Custom test alert-on-status feature; no protected-area overlap | `Invoke-AddCustomScript.ps1`, `Invoke-CippTestCustomScripts.ps1` | Pester: 47 passed (Levenshtein + `Tests/Tools` regression) | Adds configurable `AlertStatuses` for custom script test failures. No dedicated Pester suite for custom scripts. | +| `ee0b82294a849bf992ec3ff7ce09b517f4e17fba` | — | Deferred | **Conflict:** upstream modifies `CippReportingDB` cleanup rule; block absent in fork | `Start-TableCleanup.ps1` | Not run | Deferred review: **Skip cherry-pick** — needs product decision on cache TTL, not missing feature. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §A. | +| `fdf313e5cfb08b2da7bba256201daf2de9ba15ff` | — | Deferred | **Conflict:** removes `PartitionKey eq 'Search'` on `CippReportingDB` cleanup; block absent | `Start-TableCleanup.ps1` | Not run | Deferred review: **Skip cherry-pick** — unfiltered 30-day delete unsafe verbatim. See §A. | +| `5ccf15a9197c67cb8fdde40606dd7b26a476ae1a` | `5d08be470412057bc8cba5fee192e374eacbe8fb` | Applied cleanly | Intune policy definition fallback when bulk Graph returns non-200; no protected-area overlap | `Invoke-ListIntunePolicy.ps1` | Pester: 47/47 passed (Levenshtein + `Tests/Tools` regression) | Adds template-based fallback for missing `settingDefinitions` on configuration policies. No Intune-specific Pester suite. | +| `9ba48711c614be8e2452ffff2e539b5b1a11b534` | `a091f6f42` | Applied cleanly | Fixes Intune compliance check-in default (130→120) to match max validator | `Config/standards.json`, `Invoke-CIPPStandardIntuneComplianceSettings.ps1` | Batch regression: 47/47 passed | Default was invalid (130 > max 120). Standards config change only. | +| `897dfaa4f07443e0f05f8f2aefa5b0a92fc91a9c` | `69e5f37d9` | Applied cleanly | Standards bugfix #5997 — verify spam filter rule is Enabled; re-enable if Disabled | `Invoke-CIPPStandardSpamFilterPolicy.ps1` | Batch regression: 47/47 passed | Uses `New-ExoRequest` in standards deploy path (not quarantine/message trace HTTP endpoints). | +| `23c8994da9a523a6fbce594181f0c74e5fb1a69e` | `d1a696258` | Applied cleanly | Typo fix #5990 — Edge toolbar unpinned state `hidden` → `default_hidden` | `Invoke-CIPPStandardDeployCheckChromeExtension.ps1` | Batch regression: 47/47 passed | Single-line standards constant fix. | +| `4214bc7de39c563d0979b2717239e9acda4752e7` | — | Already implemented | Merge commit (#2054) whose substantive change is upstream `5ccf15a9`, already applied as `5d08be470` | `Invoke-ListIntunePolicy.ps1` (same 34-line fix) | Not run | Did not cherry-pick merge commit. Superseded by prior batch 2 apply of `5ccf15a9`. | +| `57b7de1f31bcffa3ebc3ba1f05d5d47fa1b6bffe` | — | Deferred | **Conflict:** rename inside usage-tracking block absent in fork | `Invoke-ListIntuneTemplates.ps1` | Not run | Deferred review: **Skip** — frontend uses neither property. See §B. | +| `ecbc9a50ac0584e0d0ce59259214ebe6d9cf525a` | `6698dded1` | Applied cleanly | Graceful skip + Warning log when standard function missing from CIPPStandards module | `CIPPActivityTriggers/.../Push-CIPPStandard.ps1`, `CIPPCore/.../Push-CIPPStandard.ps1` (mirror) | Batch regression: 47/47 passed | Upstream cherry-pick to ActivityTriggers; **Adapted mirror fix to CIPPCore** in follow-up commit. Changes failure mode from invoke error to early return with Warning. | +| `781930205c67fc17a5ca887755361987a407012a` | `b6ced9be6` | Applied cleanly | Fixes `$Item` variable shadowing in orchestrator batch retrieval loop | `CIPPActivityTriggers/.../Push-OrchestratorBatchItems.ps1`, `CIPPCore/.../Push-OrchestratorBatchItems.ps1` (mirror) | Batch regression: 47/47 passed | Upstream cherry-pick to ActivityTriggers; **Adapted mirror fix to CIPPCore** in follow-up commit. Renames inner loop variable to `$BatchItem`. | +| `785e71c530a39b46f56cea7c598f7d609d8a8518` | — | Deferred | **Conflict:** fork `"$null"` string locale vs upstream Graph locale/language fix | `Set-CIPPDefaultAPDeploymentProfile.ps1` | Not run | Deferred review: **Needs product decision**. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §C. | +| `95d48d1fe90a2e57c7459afa1330290ef659ff02` | `7bccfcdb5` | Applied cleanly | Copilot Readiness test uses correct desktop activations cache field | `Invoke-CippTestCopilotReady003.ps1` | Batch regression: 47/47 passed | Tests-only; 1 file. | +| `f5f7ae7064404c314d6cd5694ee1260d1e543c0f` | `55e95d467` | Applied cleanly | Dedup batch table writes by PartitionKey+RowKey; scope test discovery to CIPPTests module | `Add-CIPPAzDataTableEntity.ps1`, `Invoke-CIPPTestCollection.ps1` | Batch regression: 47/47 passed | Prevents duplicate test result rows. Table dedup affects all small-entity batch writes — monitor for side effects. | +| `ddc264a771b27807a35d12fd3645d4693b4a21f8` | `29750b377` | Applied with adaptation | Manual 100→500 licensed-user display cap in fork GenericTest002 implementation | `Invoke-CippTestGenericTest002.ps1` | Batch 7 regression: 47/47 passed | Batch 7 adapted apply — no cherry-pick. Upstream commit is cap-only; fork retains LicenseOverview cache logic. | +| `64836c02a801a3718c2bd2e598bcf206c973541d` | — | Already implemented | Equivalent logic on `master` as `d9a8c33b5` (`LastScheduledTime` scheduled-task rerun detection) | `Test-CIPPRerun.ps1` | Not run | Deferred review 2026-06-17: skip cherry-pick. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §E. | +| `2ab0e0e27c77d146301b427365e0d305e813137d` | — | Already implemented | Equivalent logic on `master` as `76b390f1a` (`Add-Member -Force` on rerun cache entities) | `Test-CIPPRerun.ps1` | Not run | Deferred review 2026-06-17: skip cherry-pick. See `DEFERRED_REVIEW_CIPP_API_20260617.md` §E. | +| `cbcc61b5afd8c7ea9bb9bef1da7878465afc5610` | — | Already implemented | ORCA103 test fix already present from v10.5.2 intake (`2699da195 Fixes ORCA103`) | `Invoke-CippTestORCA103.ps1` | Not run | Cherry-pick produced empty patch; skipped. | +| `503eac5bdb6322f1e42b8e90cc48ab9f3b4c4c5b` | `29750b377` | Applied with adaptation (test-only) | CIS 1.3.4 reads `AppsAndServices` cache first with Settings fallback; cache hunk skipped — fork bulk fetch already implements `AppsAndServices` type | `Invoke-CippTestCIS_1_3_4.ps1` | Batch 7 regression: 47/47 passed | Did not modify `Set-CIPPDBCacheSettings.ps1`. See deferred review §F. | +| `961462f346d5b8fe357dc322e550dee95a644232` | `29750b377` + Batch 8 | Applied with adaptation | Role-assignment test fixes — `RoleAssignmentScheduleInstances` + role member discovery | `Invoke-CippTestCIS_1_1_1.ps1` (Batch 7), `Invoke-CippTestCIS_1_1_2.ps1`, `Invoke-CippTestCIS_1_1_3.ps1`, `Invoke-CippTestCIS_1_1_4.ps1`, `Invoke-CippTestZTNA21782.ps1` (Batch 8) | Pester 47/47 after each file | Batch 7: CIS_1_1_1 uses `Get-CippDbRole`. Batch 8: CIS_1_1_2/3 use GA `members` + schedule instances; CIS_1_1_4 mirrors CIS_1_1_1 privileged discovery; ZTNA21782 filters privileged principals only, preserves fork markdown output. No live-tenant Pester for individual CIPPTests — requires cached Roles/Users/UserRegistrationDetails. | +| `fd6e30f62fb209f2b706b359bd1b91f5ef368081` | `610cb089b` | Applied cleanly | Narrow standards bugfix — read/write `azureADRegistration.allowedToRegister` instead of `azureADJoin.allowedToJoin`; skip remediate when `isAdminConfigurable` is false | `Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` | Batch regression: 47/47 passed | Device registration standard only. Log message wording updated. Validate intuneRestrictUserDeviceRegistration deploy in test tenant. | + +## Proposed Next 10 Low-Risk Candidates + +| Priority | SHA | Title | Files | Risk | Why safe | Dependencies | +|----------|-----|-------|-------|------|----------|--------------| +| 1 | `95d48d1f` | Fix desktop activations copilot ready test | 1 test | Low | Tests-only | None — **applied** | +| 2 | `ddc264a7` | Update Invoke-CippTestGenericTest002.ps1 | 1 test | Low | Tests-only | **Deferred — conflict** | +| 3 | `f5f7ae70` | fixes duplicate test calls | 2 (test infra) | Low | Test dedup + module-scoped discovery | None — **applied** | +| 4 | `64836c02` | fix: rerun detection on scheduled tasks | 1 | Low | Scheduled-task rerun fix | Pair with `2ab0e0e2`; **deferred — conflict** | +| 5 | `2ab0e0e2` | fix: rerun issue | 1 | Low | Refines Test-CIPPRerun | After `64836c02` review | +| 6 | `0640f07c` | Fixes ORCA179 | 1 test | Low | ORCA test-only | May overlap v10.5.2 ORCA intake — verify first | +| 7 | `503eac5b` | fix: apps and services test | 2 | Low | CIS test + cache settings | Cache touch — review diff | +| 8 | `fd6e30f6` | fix(standards): azureADRegistration target | 1 standard | Low-Med | Isolated standards bugfix | Standards deploy behavior change | +| 9 | `961462f3` | fix: role assignment checks | 5 tests | Low | Test assertion fixes | 5 files but tests-only | +| 10 | `55ddb18b` | Update Invoke-ExecTestRun.ps1 | 1 | Low-Med | Test runner endpoint | 55-line diff — inspect before apply | + +## Batch 8 Validation (2026-06-17) + +| File | Pester after change | Live tenant | +|------|---------------------|-------------| +| `Invoke-CippTestCIS_1_1_2.ps1` | 47/47 passed | Requires Roles, Users, RoleAssignmentScheduleInstances cache | +| `Invoke-CippTestCIS_1_1_3.ps1` | 47/47 passed | Requires Roles, RoleAssignmentScheduleInstances cache | +| `Invoke-CippTestCIS_1_1_4.ps1` | 47/47 passed | Requires Get-CippDbRole, Users, RoleAssignmentScheduleInstances cache | +| `Invoke-CippTestZTNA21782.ps1` | 47/47 passed | Requires UserRegistrationDetails, Roles, RoleAssignmentScheduleInstances cache | + +## Next Steps + +1. **Batch 8 complete** — all `961462f3` role-assignment test adaptations applied. +2. **Product decisions:** `CippReportingDB` retention (`ee0b8229`/`fdf313e5`), Autopilot language (`785e71c5`), Intune template usage feature (`57b7de1f` chain). +3. **Tenant smoke test:** Run CIS 1.1.x and ZTNA21782 against a tenant with refreshed cache to validate role member + PIM schedule discovery. +4. **Skip permanently:** rerun commits (`64836c02`, `2ab0e0e2`), template rename (`57b7de1f`), AppsAndServices cache hunk (`503eac5b`). +5. **Smoke test:** `intuneRestrictUserDeviceRegistration` (`610cb089b`) — checklist in deferred review doc. +6. **Follow-up:** Mirror or remove stale `CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` duplicate; stale `CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1` mirror may need sync review. +7. CIPP frontend parked at `3c0ef6904` checkpoint — resume mini-batch 3 when ready. diff --git a/docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md b/docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md new file mode 100644 index 0000000000..f25c2fe520 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/BASELINES_INTAKE_20260814.md @@ -0,0 +1,25 @@ +# Baselines Feature Intake — 2026-08-14 + +Cycle type: **Feature intake** within major 10.8.x sync. Per [PROCESS.md](PROCESS.md). + +## Feature: Baselines (drift-first engine) + +- Upstream refs: `Modules/CIPPCore/Public/Baselines/*` (29), `Set-CippBaselineRunContext.ps1`, `Start-CIPPBaselineOrchestrator`, HTTP Baseline* entrypoints, `Config/BaselineStandards/**`, FE `src/pages/tenant/baselines/**` + `CippBaselines/*`, FeatureFlags `Baselines`, timer `9f2c7b1e-4a6d-4c3f-8b9a-5e1d2f7c0a44` +- Fork gap: no baselines pages/APIs/modules +- Protected conflicts: Applied Standards / drift UI — baselines are **parallel**, not a replacement; Adapt any shared Intune compare helpers +- Scope: **capability** on existing SWA + Function App Durable — no Craft, no EasyAuth migration +- Hosting: Azure Tables (`Baselines`, `BaselineRollouts`, `BaselineAlignment`, history/trend/locks) + existing `Start-CIPPOrchestrator` / standards processor slot +- Flag behavior: `Enabled: false` by default; flag gates **scheduled timer only**; pages/on-demand work when flag off (upstream design). Manage365 keeps flag off until smoke; optionally hide nav until enabled +- Phases: design → API modules/config/HTTP/orch → FE pages/components → verify → PR → deploy → enable flag after smoke +- Approval: [x] design (approved via major-cycle plan execute) [x] implement [ ] deploy (enable) + +## Branding (sibling Adapt) + +- Upstream: `ListBrandingSettings`, `ListBrandingPresets`, `Get-CIPPBranding*`, PDF cover helpers +- Fork: keep Manage365 `CippBrandingSettings` / `customBranding`; surgical merge only — do not wipe branding UX + +## Explicit non-goals + +- Replacing Applied Standards with Baselines +- Enabling Baselines timer in production by default +- Porting SSO/container nav that co-landed in 10.8 diff --git a/docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md new file mode 100644 index 0000000000..f5918214b7 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/BATCH7_VALIDATION_CIPP_API_20260617.md @@ -0,0 +1,256 @@ +# Batch 7 Validation Checklist — CIPP-API + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-api-20260617` +Batch commit: `29750b377` (adapted test fixes) +Prerequisite doc: `DEFERRED_REVIEW_CIPP_API_20260617.md` + +**Gate:** Section A and Section B live validation **completed 2026-06-17**. Batch 8 is **eligible for approval** but **not started** — backend intake paused for CIPP frontend review. + +--- + +## Validation Results Summary (2026-06-17) + +Live validation executed against non-production deployed sync branch (`29750b377` batch 7 + prior batches). Operator sign-off recorded below. + +| Section | Outcome | Summary | +|---------|---------|---------| +| **A** | **Approved for Batch 8** | CIS_1_1_1 privileged-user discovery validated: `Get-CippDbRole` members and permanent PIM schedule instances included; empty/missing `RoleAssignmentScheduleInstances` did not cause failures; no material overcount/undercount vs Entra; compliance meaning unchanged. | +| **B** | **Approved** | Standard reads/writes `azureADRegistration.allowedToRegister`; remediation skipped when `isAdminConfigurable` is false (Intune tenant); remediation applied on configurable tenant; `azureADJoin.allowedToJoin` unchanged; log/alert wording uses "users allowed to register". | +| **C** | **Passed 47/47** | Pester regression on branch tip (see Section C). | + +**Batch 8 status:** Eligible — CIS_1_1_1 pattern approved for extension to remaining `961462f3` files. **Not started** (paused for frontend upstream review). + +## Prerequisites + +| Item | Detail | +|------|--------| +| Deploy target | Sync branch deployed to a **non-production** Function App, or local harness with SAM auth to test tenants | +| Cache freshness | Run tenant cache refresh (`Set-CIPPDBCache*` / CIPPDB cache orchestration) on validation tenants before CIS tests | +| Baseline (optional) | Pre–Batch 7 CIS_1_1_1 result export or screenshot from same tenant, if available | +| Permissions | Operator access to CIPP tenant tests UI and (for standard validation) Standards deploy or log review | + +Record validation date, operator, tenant IDs, and environment on each section sign-off. + +--- + +## A. CIS_1_1_1 Role Assignment Behavior + +**Goal:** Confirm Batch 7 privileged-user discovery is correct before applying the same pattern to `CIS_1_1_2`, `CIS_1_1_3`, `CIS_1_1_4`, and `ZTNA21782`. + +**Changed file:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1` +**Applied in:** `29750b377` + +### Tenant selection + +Use at least one tenant that has: + +- [x] At least one **permanent** privileged directory role holder (e.g. Global Administrator assigned outside PIM-only eligibility) +- [x] If possible, at least one **PIM** scenario (eligible and/or active assignment with `assignmentType = Assigned` and no `endDateTime`) +- [x] Cached `Roles`, `Users`, and ideally `RoleAssignmentScheduleInstances` populated + +Suggested tenant profiles: + +| Profile | Purpose | +|---------|---------| +| **Tenant A** | Mixed permanent GA + PIM-eligible admins | +| **Tenant B** | Small tenant, permanent admins only, no PIM | +| **Tenant C** (optional) | Tenant with empty/missing `RoleAssignmentScheduleInstances` cache | + +### Pre-run: cache and manual spot checks + +- [x] Refresh CIPPDB cache for the validation tenant(s) +- [x] Confirm cache types exist (via CIPP test data or logs): + - `Roles` (with `members` on privileged roles) + - `Users` + - `RoleAssignmentScheduleInstances` (may be empty on Tenant C — that is a valid test case) + +**Optional PowerShell spot check** (same tenant, after cache refresh): + +```powershell +$Tenant = '' + +$Roles = Get-CippDbRole -TenantFilter $Tenant -IncludePrivilegedRoles +$ScheduleInstances = Get-CIPPTestData -TenantFilter $Tenant -Type 'RoleAssignmentScheduleInstances' +$Users = Get-CIPPTestData -TenantFilter $Tenant -Type 'Users' + +# Expect: $Roles non-null with privileged role template IDs and members +$Roles | Select-Object displayName, RoletemplateId, @{n='MemberCount';e={@($_.members).Count}} + +# Expect: permanent PIM assignments where present +$ScheduleInstances | Where-Object { + $_.assignmentType -eq 'Assigned' -and $null -eq $_.endDateTime +} | Select-Object principalId, roleDefinitionId, assignmentType +``` + +### Run CIS_1_1_1 + +- [x] Execute CIS_1_1_1 from CIPP Tests UI (or test runner) for each validation tenant +- [x] Capture: **Status**, **Result markdown**, privileged user count, non-compliant user list (if Failed) + +### Validation criteria + +| # | Check | Pass? | Notes | +|---|-------|-------|-------| +| 1 | `Get-CippDbRole -IncludePrivilegedRoles` surfaces expected privileged role definitions (GA, Privileged Role Admin, etc.) | ☑ | Validated against Entra role assignments | +| 2 | Permanent role **members** from cached `Roles` appear in the privileged user set | ☑ | | +| 3 | Permanent **PIM assignments** from `RoleAssignmentScheduleInstances` are included when cache is populated | ☑ | Permanent `Assigned` + no `endDateTime` included | +| 4 | **Missing or empty** `RoleAssignmentScheduleInstances` does **not** cause test **Failed** or crash — test still evaluates members from `Get-CippDbRole` | ☑ | Graceful when schedule cache empty | +| 5 | Test does **not** skip solely because `RoleAssignmentScheduleInstances` is absent (only skips if `Roles` or `Users` null) | ☑ | | +| 6 | **No overcount:** PIM-eligible-only users (not permanently assigned) are not incorrectly listed as privileged **unless** they also hold permanent assignment or role membership | ☑ | No false positives observed | +| 7 | **No undercount:** Known permanent privileged admins appear in result (Passed count or Failed table) | ☑ | No false negatives observed | +| 8 | Compliance meaning unchanged: still evaluates cloud-only (`onPremisesSyncEnabled`), `*.onmicrosoft.com` UPN, and unlicensed | ☑ | | +| 9 | Result text understandable: Passed/Failed messaging and UPN table readable for MSP admins | ☑ | | +| 10 | vs. baseline (if available): material change in pass/fail is **explained** by PIM/member discovery improvement, not a regression | ☑ | Expected improvement vs legacy `RoleAssignments` cache | + +### Sign-off — CIS_1_1_1 + +| Field | Value | +|-------|-------| +| Validated by | Operator (live tenant validation) | +| Date | 2026-06-17 | +| Tenant(s) | Non-production validation tenant(s) with permanent privileged admins and PIM scenarios | +| Outcome | ☑ Approved for Batch 8 ☐ Blocked — see concerns | +| Concerns | None — ready to extend role logic to CIS_1_1_2+ when backend intake resumes | + +--- + +## B. intuneRestrictUserDeviceRegistration Standard + +**Goal:** Validate already-applied upstream fix `fd6e30f6` / `610cb089b` (batch 6). + +**Runtime file:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` +**Applied in:** `610cb089b` + +> **Note:** A stale duplicate exists under `Modules/CIPPCore/Public/Standards/` (still references `azureADJoin`). Standards deploy uses **`CIPPStandards`** module only — validate against deployed `CIPPStandards` code path. + +### Tenant selection + +| Profile | Expected `isAdminConfigurable` | Purpose | +|---------|-------------------------------|---------| +| **Tenant D** | Intune enabled → often `false` | Remediation skip path | +| **Tenant E** | `true` (no Intune or configurable registration) | Remediation apply path | +| **Tenant F** (optional) | Known `allowedToRegister` state | Alert/report accuracy | + +### Pre-run: capture Graph baseline + +For each tenant, record **before** running the standard: + +```powershell +$Tenant = '' +$Policy = Invoke-MgGraphRequest -Method GET -Uri 'https://graph.microsoft.com/beta/policies/deviceRegistrationPolicy' -Headers @{ 'ConsistencyLevel' = 'eventual' } +# Or use CIPP Graph helper equivalent + +# Record: +$Policy.azureADRegistration.allowedToRegister.'@odata.type' +$Policy.azureADRegistration.isAdminConfigurable +$Policy.azureADJoin.allowedToJoin.'@odata.type' # should remain unchanged by this standard +``` + +- [x] Baseline captured for Tenant D +- [x] Baseline captured for Tenant E + +### Test scenarios + +#### Scenario 1 — Intune tenant (remediation skip) + +- [x] Assign standard with **remediate ON**, `disableUserDeviceRegistration = true` +- [x] Confirm `azureADRegistration.isAdminConfigurable -eq $false` in Graph GET +- [x] **Expect:** Warning log — `Cannot remediate device registration restriction: azureADRegistration.isAdminConfigurable is false...` +- [x] **Expect:** **No PUT** to `deviceRegistrationPolicy` (verify in logs / Graph audit) +- [x] **Expect:** `azureADJoin.allowedToJoin` **unchanged** from baseline + +#### Scenario 2 — Configurable tenant (remediation apply) + +- [x] Tenant with `isAdminConfigurable = true` +- [x] Run remediate with desired disable/enable setting +- [x] **Expect:** PUT updates **`azureADRegistration.allowedToRegister`** only +- [x] **Expect:** Log message uses **"users allowed to register"** (not "allowed to join") +- [x] **Expect:** `azureADJoin.allowedToJoin` **unchanged** unless separately configured outside this standard + +#### Scenario 3 — Alert mode + +- [x] Run with **alert ON**, remediate OFF +- [x] **Expect:** Alert/compare uses `azureADRegistration.allowedToRegister.@odata.type` +- [x] **Expect:** Alert text references **"users allowed to register"** + +#### Scenario 4 — Report / BPA + +- [x] Run with **report ON** +- [x] **Expect:** `intuneRestrictUserDeviceRegistration` BPA field reflects registration policy state + +### Validation criteria + +| # | Check | Pass? | Notes | +|---|-------|-------|-------| +| 1 | Standard **reads** `azureADRegistration.allowedToRegister` | ☑ | | +| 2 | Standard **does not write** `azureADJoin.allowedToJoin` | ☑ | Before/after Graph GET unchanged for join policy | +| 3 | Remediation **skipped** when `isAdminConfigurable` is false | ☑ | Intune-enabled tenant | +| 4 | Remediation **applies** when configurable and state mismatches | ☑ | Configurable tenant | +| 5 | Log/alert wording says **"users allowed to register"** | ☑ | | +| 6 | No unintended device **join** policy changes | ☑ | | + +### Rollback reference + +If validation fails or rollback required: revert commit `610cb089b` on sync branch and redeploy. Document tenant policy state before re-running old logic (old code incorrectly targeted `azureADJoin`). + +### Sign-off — intuneRestrictUserDeviceRegistration + +| Field | Value | +|-------|-------| +| Validated by | Operator (live tenant validation) | +| Date | 2026-06-17 | +| Tenant(s) | Intune-enabled tenant (remediation skip) + configurable registration tenant (remediation apply) | +| Outcome | ☑ Approved ☐ Blocked — see concerns | +| Concerns | None — safe for production merge path once frontend sync plan completes | + +--- + +## C. Existing Regression (Automated) + +Run from repo root on sync branch: + +```powershell +Invoke-Pester -Path Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1,Tests/Tools -Output Detailed +``` + +| Check | Pass? | Notes | +|-------|-------|-------| +| All tests pass (expected **47/47**) | ☑ | Confirmed 2026-06-17 on branch through checkpoint tip | +| No new failures vs. Batch 7 baseline | ☑ | | + +**Last run (Batch 7):** 47 passed, 0 failed — 2026-06-17 + +Re-run after any deploy or before merging sync branch to production. + +--- + +## Overall gate for Batch 8 + +Batch 8 prerequisites **met** (2026-06-17): + +- [x] Section A signed off **Approved for Batch 8** +- [x] Section B signed off **Approved** +- [x] Section C regression green on current branch tip + +**Status:** Batch 8 is **eligible** but **not started** — backend intake paused for CIPP frontend upstream review. + +### Batch 8 scope (after approval) + +Adapt **one file at a time** from upstream `961462f3`: + +1. `Invoke-CippTestCIS_1_1_2.ps1` +2. `Invoke-CippTestCIS_1_1_3.ps1` +3. `Invoke-CippTestCIS_1_1_4.ps1` +4. `Invoke-CippTestZTNA21782.ps1` + +Use the same privileged-role discovery pattern validated in CIS_1_1_1. Stop on conflict or unexpected pass/fail drift. + +--- + +## Related documents + +| Document | Purpose | +|----------|---------| +| `DEFERRED_REVIEW_CIPP_API_20260617.md` | Full deferred commit analysis | +| `APPLIED_COMMITS_CIPP_API_20260617.md` | Cherry-pick / adaptation tracking | diff --git a/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md new file mode 100644 index 0000000000..cd4de44474 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_CHECKPOINT_20260617.md @@ -0,0 +1,198 @@ +# CIPP-API Upstream Sync Checkpoint + +Generated: 2026-06-17 +Status: **Validation complete — Batch 8 eligible, not started. Backend intake paused for CIPP frontend review.** + +--- + +## Branch and Base + +| Field | Value | +|-------|-------| +| **Sync branch** | `manage365/upstream-sync-cipp-api-20260617` | +| **Branch tip** | `a166b2035` — `docs: add CIPP-API upstream sync checkpoint` (validation docs updated in follow-up commit) | +| **Production base (`master`)** | `de78a343e` — `refactor: enhance quarantine message retrieval and filtering` | +| **Backup tag (pre-sync)** | `backup/pre-upstream-sync-cipp-api-20260617` | +| **Upstream remote** | `KelvinTegelaar/CIPP-API` (`upstream/master`) | +| **Commits on sync branch (since base)** | 25 (includes code cherry-picks, adapted applies, and sync documentation) | +| **Working tree** | Clean | + +**Not pushed:** Sync branch and backup tag remain local unless explicitly approved. + +--- + +## Batches Completed (1–7) + +Upstream work was applied selectively via cherry-pick (`-x`) or manual adaptation. No blind merges. + +| Batch | Scope | Outcome | +|-------|-------|---------| +| **1** | Levenshtein helper + tests; custom test alert statuses | 2 clean, 1 adapted partial | +| **2** | Intune policy OData fallback; table cleanup (deferred) | 1 clean; 2 deferred; 1 superseded | +| **3** | Standards fixes (compliance default, spam filter, Chrome extension) | 3 clean; 1 deferred (Intune template usage rename) | +| **4** | Standards/batch orchestrator safeguards | 2 clean (+ CIPPCore mirror); 1 deferred (Autopilot language) | +| **5** | Copilot test fix; test dedup infra | 2 clean; 3 deferred/superseded | +| **6** | Device registration standard fix; apps/services + role tests (deferred) | 1 clean; 2 deferred | +| **7** | Adapted test fixes only (no cherry-picks) | 3 upstream intents applied manually; partial role test | + +Regression baseline throughout: **Pester 47/47** (`Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + `Tests/Tools`). + +--- + +## Commits Applied Cleanly + +| Upstream | Applied SHA | Summary | +|----------|-------------|---------| +| `2b441244` | `365937de8` | Levenshtein distance function + tests | +| `6aa66c74` | `1784ccb99` | Custom test configurable alert statuses | +| `5ccf15a9` | `5d08be470` | Intune policy definition OData fallback | +| `9ba48711` | `a091f6f42` | Intune compliance check-in default 130→120 | +| `897dfaa4` | `69e5f37d9` | Spam filter rule Enabled verification (#5997) | +| `23c8994d` | `d1a696258` | Chrome extension toolbar state typo (#5990) | +| `ecbc9a50` | `6698dded1` | Missing standard function graceful skip | +| `78193020` | `b6ced9be6` | Orchestrator batch `$Item` shadowing fix | +| `95d48d1f` | `7bccfcdb5` | Copilot desktop activations cache field | +| `f5f7ae70` | `55e95d467` | Test dedup + CIPPTests-scoped discovery | +| `fd6e30f6` | `610cb089b` | `intuneRestrictUserDeviceRegistration` → `azureADRegistration.allowedToRegister` | + +**Count:** 11 upstream commits applied cleanly. + +**Follow-up mirrors (fork maintenance, not separate upstream SHAs):** `8c60b61f8` mirrored batch 4 safeguards to `CIPPCore`. + +--- + +## Commits Applied With Adaptation + +| Upstream | Applied SHA | Adaptation | +|----------|-------------|------------| +| `133f9295` | `05f48e4fb` | Levenshtein test path fallback only; skipped fuzzy-match test file absent in fork | +| `ddc264a7` | `29750b377` | GenericTest002 display cap 100→500 (4 lines); fork retains LicenseOverview logic | +| `503eac5b` | `29750b377` | **Test-only:** CIS 1.3.4 reads `AppsAndServices` cache first; cache hunk skipped (fork bulk fetch already present) | +| `961462f3` | `29750b377` | **Partial:** `CIS_1_1_1` only — `Get-CippDbRole` + `RoleAssignmentScheduleInstances` privileged user discovery | + +**Count:** 4 upstream intents (3 full/partial adaptations in batch 7 commit `29750b377`). + +--- + +## Commits Already Implemented or Superseded + +| Upstream | Reason | +|----------|--------| +| `4214bc7d` | Merge commit; substantive change is `5ccf15a9` (already applied) | +| `64836c02` | Equivalent on `master` as `d9a8c33b5` (rerun scheduled-task detection) | +| `2ab0e0e2` | Equivalent on `master` as `76b390f1a` (rerun `Add-Member -Force` fix) | +| `cbcc61b5` | ORCA103 fix already from v10.5.2 intake (`2699da195`) | +| `503eac5b` (cache portion) | Fork `Set-CIPPDBCacheSettings.ps1` already caches `AppsAndServices` via bulk Graph | + +**Count:** 5 upstream commits marked superseded/already present (cache portion of `503eac5b` tracked separately from test adaptation). + +--- + +## Commits Deferred + +| Upstream | Title / area | Recommendation | Blocker | +|----------|--------------|----------------|---------| +| `ee0b8229` | CippReportingDB cleanup 30 days | Skip cherry-pick; needs custom TTL design | Product decision | +| `fdf313e5` | CippReportingDB remove partition filter | Skip cherry-pick; unfiltered 30-day delete unsafe verbatim | Product decision | +| `57b7de1f` | Intune template `usedInTemplates` → `usage` | Skip; usage feature + UI absent | Product decision | +| `785e71c5` | Autopilot user-select / os-default | Needs product decision | Behavior change risk | +| `961462f3` (remainder) | Role assignment tests | Partial apply done; **4 files remain** | **Batch 8 eligible** — CIS_1_1_1 validated 2026-06-17 | + +**Count:** 5 upstream commit records deferred (including partial `961462f3`). + +--- + +## Product Decisions Still Required + +| Topic | Upstream commits | Question | +|-------|------------------|----------| +| **CippReportingDB cleanup policy** | `ee0b8229`, `fdf313e5` | Should tenant cache rows auto-expire? If yes, define Manage365-specific retention — do not adopt upstream unfiltered 30-day rule. | +| **Autopilot user-select / os-default** | `785e71c5` | Adopt upstream Graph locale/language semantics? Fork currently sends literal `"$null"` string; may affect existing deployment profiles. | +| **Intune template usage tracking** | `57b7de1f` (+ upstream usage block) | Import full template ↔ standards usage feature and UI column, or skip permanently? | + +See `DEFERRED_REVIEW_CIPP_API_20260617.md` for full analysis. + +--- + +## Validation Status + +Checklist: `BATCH7_VALIDATION_CIPP_API_20260617.md` + +| Section | Item | Status | +|---------|------|--------| +| **A** | CIS_1_1_1 role assignment behavior | **Completed** — Approved for Batch 8 (2026-06-17) | +| **B** | `intuneRestrictUserDeviceRegistration` (`610cb089b`) | **Completed** — Approved (2026-06-17) | +| **C** | Pester regression | **Passed 47/47** (2026-06-17) | + +**Gate:** Batch 8 is **eligible for approval** but **not started**. Backend intake paused for CIPP frontend upstream review. See `BATCH7_VALIDATION_CIPP_API_20260617.md` for sign-off details. + +--- + +## Batch 8 Gate (Explicit) + +CIS_1_1_1 live validation **approved** (Section A, 2026-06-17). Batch 8 **may proceed** when backend intake resumes: + +- `Invoke-CippTestCIS_1_1_2.ps1` +- `Invoke-CippTestCIS_1_1_3.ps1` +- `Invoke-CippTestCIS_1_1_4.ps1` +- `Invoke-CippTestZTNA21782.ps1` + +Upstream source: remainder of `961462f3`. Apply **one file at a time**. + +**Current status:** **Not started** — paused for CIPP frontend upstream review per operator direction. + +--- + +## Merge Readiness + +| Criterion | Status | +|-----------|--------| +| Automated regression (Section C) | ✅ Passed 47/47 | +| CIS_1_1_1 live validation (Section A) | ✅ Completed — Approved for Batch 8 | +| Device registration standard validation (Section B) | ✅ Completed — Approved | +| Batch 8 role tests | ⏸ Eligible, not started | +| Product decisions (cleanup, Autopilot, template usage) | ❌ Open | +| CIPP frontend upstream sync | 🔄 In progress (review phase) | + +**Verdict:** **Not ready to merge to production** until CIPP frontend sync plan progresses and product decisions resolved. Backend validation gate for Batch 8 is **cleared**. + +--- + +## Protected Areas — No Regressions Observed + +Custom fork areas were not overwritten during batches 1–7: + +- Quarantine Portal 5.13.0 (`cacheQuarantineMessages` cleanup, query helpers) +- Manage365 branding / version tooling +- Email Troubleshooter +- Tenant workflows and navigation customizations + +--- + +## Related Documentation + +| Document | Purpose | +|----------|---------| +| `UPSTREAM_SYNC_CIPP_API_20260617.md` | Full 315-commit upstream inventory | +| `APPLIED_COMMITS_CIPP_API_20260617.md` | Per-commit tracking table | +| `DEFERRED_REVIEW_CIPP_API_20260617.md` | Deferred conflict analysis (sections A–G) | +| `BATCH7_VALIDATION_CIPP_API_20260617.md` | Live validation checklist | +| `CUSTOM_FEATURE_MAP_20260617.md` | Protected custom feature inventory | + +--- + +## Recommended Next Action + +1. **CIPP frontend:** Begin cautious upstream intake review on `manage365/upstream-sync-cipp-20260617` (see frontend inventory). +2. **CIPP-API Batch 8:** Resume only after frontend review checkpoint — adapt remaining `961462f3` files one at a time. +3. **Product decisions:** Resolve CippReportingDB TTL, Autopilot language, Intune template usage before related cherry-picks. +4. **Production merge:** After frontend sync + open product decisions; backend Sections A/B validation complete. + +--- + +## Checkpoint History + +| Date | Event | +|------|-------| +| 2026-06-17 | Batches 1–7 complete; deferred review and validation checklist committed; sync paused at validation gate | +| 2026-06-17 | Sections A and B live validation completed; Batch 8 eligible; backend intake paused for frontend review | diff --git a/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md new file mode 100644 index 0000000000..b59263b7e4 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/CIPP_API_SYNC_FINAL_CHECKPOINT_20260617.md @@ -0,0 +1,193 @@ +# CIPP-API Upstream Sync — Final Checkpoint + +Generated: 2026-06-17 +Status: **Batch 8 complete — sync branch ready for PR/review into `master`** + +--- + +## 1. Branch / Base / Tip + +| Field | Value | +|-------|-------| +| **Sync branch** | `manage365/upstream-sync-cipp-api-20260617` | +| **Production base (`master`)** | `de78a343e1b8074afcbb417b344a6325704b94ee` — `refactor: enhance quarantine message retrieval and filtering` | +| **Branch tip** | `792d516edaedf11748f563ea1bac8af4e07a3721` — `docs: set API branch tip after Batch 8` | +| **Batch 8 code commit** | `5aba180616f806d8a99bd3948b2a1e7da9d7673e` — `test: adapt remaining role assignment checks for Manage365` | +| **Backup tag (pre-sync)** | `backup/pre-upstream-sync-cipp-api-20260617` (local, not pushed) | +| **Upstream remote** | `KelvinTegelaar/CIPP-API` (`upstream/master`) | +| **Working tree** | Clean | +| **Pushed to remote** | No — branch and tags remain local unless explicitly approved | + +--- + +## 2. Batches Completed + +Upstream work applied selectively via cherry-pick (`-x`) or manual adaptation. No blind merges. + +| Batch | Scope | Outcome | +|-------|-------|---------| +| **1** | Levenshtein helper + tests; custom test alert statuses | 2 clean, 1 adapted partial | +| **2** | Intune policy OData fallback; table cleanup (deferred) | 1 clean; 2 deferred; 1 superseded | +| **3** | Standards fixes (compliance default, spam filter, Chrome extension) | 3 clean; 1 deferred (Intune template usage rename) | +| **4** | Standards/batch orchestrator safeguards | 2 clean (+ CIPPCore mirror); 1 deferred (Autopilot language) | +| **5** | Copilot test fix; test dedup infra | 2 clean; 3 deferred/superseded | +| **6** | Device registration standard fix | 1 clean | +| **7** | Adapted test fixes (GenericTest002 cap, CIS 1.3.4, CIS_1_1_1 role discovery) | 3 upstream intents in `29750b377`; Sections A/B/C validation completed | +| **8** | Remaining `961462f3` role-assignment tests | 4 files adapted in `5aba18061`; Pester 47/47 after each file | + +--- + +## 3. Totals + +| Category | Count | Notes | +|----------|-------|-------| +| **Applied cleanly** | **11** | Cherry-pick `-x` or direct apply with no fork adaptation | +| **Applied with adaptation** | **4** | `133f9295` (Levenshtein test path), `ddc264a7` (GenericTest002 cap), `503eac5b` (CIS 1.3.4 test-only), `961462f3` (CIS_1_1_1–1_1_4 + ZTNA21782 role discovery) | +| **Already implemented / superseded** | **5** | `4214bc7d`, `64836c02`, `2ab0e0e2`, `cbcc61b5`, `503eac5b` cache hunk (fork bulk fetch already present) | +| **Skipped / deferred** | **4** | Product decisions or permanent skip — see §9 | + +**961462f3 status:** Fully adapted across all five test files: + +- `Invoke-CippTestCIS_1_1_1.ps1` (Batch 7 — `Get-CippDbRole` + schedule instances) +- `Invoke-CippTestCIS_1_1_2.ps1` (Batch 8 — GA members + schedule instances) +- `Invoke-CippTestCIS_1_1_3.ps1` (Batch 8 — GA member HashSet count) +- `Invoke-CippTestCIS_1_1_4.ps1` (Batch 8 — CIS_1_1_1 privileged discovery pattern) +- `Invoke-CippTestZTNA21782.ps1` (Batch 8 — privileged-only principal map) + +--- + +## 4. Tests Run and Results + +| Test scope | Command | Result | +|------------|---------|--------| +| **Regression baseline** | `Invoke-Pester -Path Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1,Tests/Tools -Output Detailed` | **47/47 passed** after every batch and after each Batch 8 file | +| **Levenshtein only** | `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | 34 passed (Batch 1) | +| **Individual CIPPTests** | No dedicated Pester suite | Requires live tenant cache — see smoke tests below | + +Batch 8 per-file regression: + +| File | Pester after change | +|------|---------------------| +| `Invoke-CippTestCIS_1_1_2.ps1` | 47/47 | +| `Invoke-CippTestCIS_1_1_3.ps1` | 47/47 | +| `Invoke-CippTestCIS_1_1_4.ps1` | 47/47 | +| `Invoke-CippTestZTNA21782.ps1` | 47/47 | + +--- + +## 5. Live Validation Completed + +Checklist: `BATCH7_VALIDATION_CIPP_API_20260617.md` + +| Section | Item | Status | Date | +|---------|------|--------|------| +| **A** | CIS_1_1_1 role assignment behavior (`Get-CippDbRole` + `RoleAssignmentScheduleInstances`) | **Approved** — pattern validated for Batch 8 extension | 2026-06-17 | +| **B** | `intuneRestrictUserDeviceRegistration` (`610cb089b`) — `azureADRegistration.allowedToRegister` | **Approved** | 2026-06-17 | +| **C** | Pester regression on branch tip | **Passed 47/47** | 2026-06-17 | + +**Not yet live-validated:** CIS_1_1_2, CIS_1_1_3, CIS_1_1_4, ZTNA21782 post–Batch 8 (recommended smoke tests in §12). + +--- + +## 6. Remaining Product Decisions + +| Topic | Upstream commits | Recommendation | +|-------|------------------|----------------| +| **CippReportingDB cleanup policy** | `ee0b8229`, `fdf313e5` | Skip cherry-pick until Manage365 defines cache TTL; do not adopt upstream unfiltered 30-day delete | +| **Autopilot user-select / os-default language** | `785e71c5` | Needs product decision — fork sends literal `"$null"` string; upstream uses Graph locale semantics | +| **Intune template usage tracking** | `57b7de1f` (+ upstream usage block) | Skip permanently unless full usage feature + UI imported | + +See `DEFERRED_REVIEW_CIPP_API_20260617.md` for full analysis (sections A–G). + +**Already on master (no cherry-pick needed):** `64836c02`, `2ab0e0e2` (rerun detection fixes). + +--- + +## 7. Known Concerns + +| Concern | Detail | +|---------|--------| +| **ZTNA21782 behavior change** | Batch 8 filters **privileged roles only** (via role members + PIM schedule instances). Results may differ from pre-sync logic that matched all role assignments. Smoke test recommended before production. | +| **Stale CIPPCore ZTNA duplicate** | `CIPPCore/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1` still has old logic. **Not updated** — active test path is `Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1`. Consider mirror cleanup in a follow-up housekeeping PR. | +| **Start-TableCleanup / CippReportingDB** | Upstream cleanup commits (`ee0b8229`, `fdf313e5`) **not imported** — requires product decision on retention policy. | +| **Autopilot language fix** | `785e71c5` **not imported** — requires product decision on locale/language behavior for deployment profiles. | +| **Stale standards duplicate** | `CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` may duplicate ActivityTriggers/CIPPCore mirror — review on merge. | + +--- + +## 8. Protected Areas — No Regressions Observed + +Custom fork areas were not overwritten during batches 1–8: + +- Quarantine Portal 5.13.0 (`cacheQuarantineMessages` cleanup, query helpers) +- Manage365 branding / version tooling +- Email Troubleshooter +- Tenant workflows and navigation customizations + +--- + +## 9. Merge Recommendation + +**Ready for PR/review into `master`**, pending: + +1. Final code review of sync branch diff (`de78a343e..792d516ed`) +2. Optional smoke tests for Batch 8 role-assignment tests (§12) +3. Acknowledgment of open product decisions (no blocker for merge of already-applied work) + +| Criterion | Status | +|-----------|--------| +| Automated regression (Section C) | ✅ 47/47 | +| CIS_1_1_1 live validation (Section A) | ✅ Approved | +| Device registration standard (Section B) | ✅ Approved | +| Batch 8 role tests (`961462f3`) | ✅ Applied; live smoke optional | +| Product decisions (cleanup, Autopilot, template usage) | ⏸ Open — intentionally deferred | +| CIPP frontend sync | 🔄 Parked at `3c0ef6904` — separate PR track | + +**Verdict:** Backend upstream sync intake is **complete for planned scope**. Open PR for review; do not merge to production without optional smoke tests and reviewer sign-off. + +--- + +## 10. Suggested Smoke Tests Before Production + +Run against non-production tenants with refreshed CIPPDB cache: + +1. **CIS_1_1_1 through CIS_1_1_4** — Tenant with known permanent privileged roles and PIM schedule instances; confirm privileged user counts match Entra expectations. +2. **ZTNA21782** — Tenant with known privileged and non-privileged role holders; confirm only privileged users appear in results and phishing-resistant method detection is correct. +3. **`intuneRestrictUserDeviceRegistration`** — Intune-enabled tenant; confirm read/write of `azureADRegistration.allowedToRegister` and skip when `isAdminConfigurable` is false. +4. **Custom Test AlertStatuses** — If frontend (`manage365/upstream-sync-cipp-20260617`) and API branches tested together: create/edit custom script with multi-status alerts; confirm API stores and test runner honors `AlertStatuses`. + +--- + +## 11. Next Recommended Upstream-Sync Work + +| Option | Action | +|--------|--------| +| **A (recommended)** | Open PRs for completed sync branches — CIPP-API (`792d516ed`) and CIPP frontend (`3c0ef6904`) — for review; pause further cherry-picks until merged or rebased | +| **B** | Resume CIPP frontend mini-batch 3 (adapted `b1902421` tab margin, shape JSON commits) on `manage365/upstream-sync-cipp-20260617` | +| **C** | Housekeeping PR — remove or sync stale `CIPPCore` mirrors (ZTNA21782 test, standards duplicate) | +| **D** | Product decision sessions — CippReportingDB TTL, Autopilot language, Intune template usage | + +**No further upstream cherry-picks** on the API sync branch until PR review completes or operator directs next intake batch. + +--- + +## Related Documentation + +| Document | Purpose | +|----------|---------| +| `UPSTREAM_SYNC_CIPP_API_20260617.md` | Full upstream inventory | +| `APPLIED_COMMITS_CIPP_API_20260617.md` | Per-commit tracking table | +| `DEFERRED_REVIEW_CIPP_API_20260617.md` | Deferred conflict analysis | +| `BATCH7_VALIDATION_CIPP_API_20260617.md` | Live validation checklist (Sections A–C) | +| `CIPP_API_SYNC_CHECKPOINT_20260617.md` | Pre–Batch 8 checkpoint (superseded by this document) | +| `CIPP_SYNC_CHECKPOINT_20260617.md` | CIPP frontend checkpoint (companion repo) | + +--- + +## Checkpoint History + +| Date | Event | +|------|-------| +| 2026-06-17 | Batches 1–7 complete; Sections A/B/C validation passed | +| 2026-06-17 | Batch 8 complete — all `961462f3` role-assignment tests adapted; Pester 47/47 | +| 2026-06-17 | **Final checkpoint** — sync branch ready for PR/review | diff --git a/docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md b/docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md new file mode 100644 index 0000000000..2e97795fd8 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/CUSTOM_FEATURE_MAP_20260617.md @@ -0,0 +1,275 @@ +# Custom Feature Map — Manage365/CIPP + +Generated: 2026-06-17 11:21 + +Purpose: Protected areas that must not be overwritten during upstream sync. + +## Git State at Generation Time + +| Repo | Branch | Tip | Upstream behind | +|------|--------|-----|-----------------| +| CIPP | `main` | `f2d87612e` | 241 commits (`upstream/main`) | +| CIPP-API | `master` | `de78a343e` | 315 commits (`upstream/master`) | + +## Protected Custom Areas + +### Manage365 Branding & Versioning + +**Purpose:** Fork identity, version display, OAuth branding, release tooling separate from upstream version.json + +**Risk if overwritten:** Critical — overwriting removes product identity and version tracking + +**Upstream overlap likelihood:** High — upstream touches version.json, settings pages, logo, README regularly + +**Notes for conflict resolution:** Preserve manage365-version.json as primary display version. Update-Version.ps1 writes both upstream and Manage365 versions. Get-CippAlerts includes Manage365-specific upstream drift alerts. + +**CIPP files:** +- `public/manage365-version.json` +- `public/version.json` +- `Tools/Update-Version.ps1` +- `src/components/CippSettings/CippVersionProperties.jsx` +- `src/components/logo.js` +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/components/ReleaseNotesDialog.js` +- `README.md` + +**CIPP-API files:** +- `version_latest.txt` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1` + +--- + +### Quarantine Portal 5.13.0 + +**Purpose:** Advanced quarantine management UI, shared components, server-side filtering, export, bulk actions, lazy detail loading + +**Risk if overwritten:** Critical — major custom feature set beyond upstream + +**Upstream overlap likelihood:** Very High — upstream actively changes quarantine endpoints and UI + +**Notes for conflict resolution:** Uses EXO PowerShell not Graph. manualPagination, post-filters, 7d default window, export cap 5k. Never auto-resolve conflicts toward upstream. + +**CIPP files:** +- `src/components/CippComponents/quarantine/` +- `src/pages/email/administration/quarantine/index.js` +- `Tests/Shapes/GetMailQuarantineMessage.json` +- `Tests/Shapes/ListQuarantinePolicy.json` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1` +- `Modules/CIPPCore/Public/Tools/Get-CippQuarantineInputValue.ps1` +- `Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineStringArray.ps1` +- `Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineReleaseStatusApiValue.ps1` +- `Modules/CIPPCore/Public/Tools/ConvertTo-CippQuarantineDisplayObject.ps1` +- `Modules/CIPPCore/Public/Tools/Invoke-CippQuarantineExoRequest.ps1` +- `Modules/CIPPCore/Public/Tools/Get-CippQuarantinePagedResults.ps1` +- `Modules/CIPPCore/Public/Tools/Apply-CippQuarantinePostFilters.ps1` + (helpers split one-function-per-file 2026-07-01: CIPPCore exports by file basename, + so co-located functions were invisible to CIPPHTTP/CIPPActivityTriggers callers) +- `Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1` +- `Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `docs/QUARANTINE_FEATURES.md` +- `Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1` +- `Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1` + +--- + +### Email Troubleshooter Enhancements + +**Purpose:** Integrated quarantine tab, trace presets, bulk refresh fixes, shared quarantine UI in troubleshooter context + +**Risk if overwritten:** High — tightly coupled to quarantine shared module + +**Upstream overlap likelihood:** High — upstream changes email tools and troubleshooting pages + +**Notes for conflict resolution:** ExecEmailTroubleshoot reuses Build-CIPPQuarantineQueryParams. Preserve trace/EML preset behavior. + +**CIPP files:** +- `src/pages/email/troubleshooting/email-troubleshooter/index.js` +- `src/pages/email/troubleshooting/message-viewer/index.js` +- `docs/superpowers/plans/2026-03-21-email-troubleshooter.md` +- `docs/superpowers/specs/2026-03-21-email-troubleshooter-design.md` + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1` + +--- + +### Custom Tenant Workflows + +**Purpose:** Tenant management, GDAP onboarding, tenant mode deployment, configuration backup/restore + +**Risk if overwritten:** High — core MSP workflow customizations + +**Upstream overlap likelihood:** Medium-High — upstream frequently updates tenant admin pages + +**Notes for conflict resolution:** Includes license capability presets, CA template package tags, group-based licensing, excludeFromAlert. + +**CIPP files:** +- `src/components/CippWizard/` +- `src/pages/tenant/manage/` +- `src/pages/tenant/gdap-management/` +- `src/pages/cipp/advanced/super-admin/tenant-mode.js` +- `src/pages/cipp/settings/tenants.js` +- `src/pages/onboarding.js` +- `src/pages/onboardingv2.js` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tenant/Get-CIPPTenantAlignment.ps1` *(may not exist)* +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ListTenantAlignment.ps1` *(may not exist)* + +--- + +### Navigation & Search UX + +**Purpose:** Hybrid universal search in top nav, frosted glass styling, dashboard v2 routing, custom breadcrumbs + +**Risk if overwritten:** High — visible UX differentiators + +**Upstream overlap likelihood:** High — upstream changes nav, search, dashboard frequently + +**Notes for conflict resolution:** Removed legacy dashboard v1. Redirect /dashboardv1 → dashboardv2. Hybrid search preserved over upstream CippCentralSearch removal. + +**CIPP files:** +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CippBreadcrumbNav.jsx` +- `src/pages/_app.js` + +--- + +### Custom Permissions & Roles + +**Purpose:** CIPP role management, SAM deployment, super-admin settings + +**Risk if overwritten:** Critical — auth/authorization changes can lock out admins + +**Upstream overlap likelihood:** Medium — upstream changes role checks and SAM manifest + +**Notes for conflict resolution:** Any SAMManifest.json changes require CPV refresh to client tenants. + +**CIPP files:** +- `src/pages/cipp/advanced/super-admin/cipp-roles/` +- `src/components/CippSettings/CippRoleAddEdit.jsx` +- `src/components/CippWizard/CippSAMDeploy.jsx` + +**CIPP-API files:** +- `lib/data/SAMManifest.json` *(may not exist)* + +--- + +### Manage365-Specific API Behavior + +**Purpose:** Custom transport rules, alert messaging, mailbox restrictions + +**Risk if overwritten:** High — tenant-specific automation + +**Upstream overlap likelihood:** Low-Medium + +**Notes for conflict resolution:** Manage365 - Block External Outbound transport rule auto-creation. + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1` + +--- + +### Standards & Compliance Customizations + +**Purpose:** CIS 7.0 renumbering, ORCA fixes intake, applied standards license warnings, template handling + +**Risk if overwritten:** Medium-High — affects compliance reporting + +**Upstream overlap likelihood:** High — upstream actively updates standards + +**Notes for conflict resolution:** Recent v10.5.2 intake included ORCA fixes — verify not duplicated when cherry-picking. + +**CIPP files:** +- `src/data/standards.json` +- `src/components/CippStandards/` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Standards/` +- `Modules/CIPPStandards/Public/Standards/` + +--- + +### Data Table & UI Performance + +**Purpose:** CippDataTable optimizations with card view preserved, table search fixes + +**Risk if overwritten:** Medium — shared component used everywhere + +**Upstream overlap likelihood:** High + +**Notes for conflict resolution:** cf721215c ported upstream table optimizations without losing card view. + +**CIPP files:** +- `src/components/CippTable/` + +--- + +### OAuth & Auth Flow + +**Purpose:** BroadcastChannel for popup auth completion, OAuth grace period + +**Risk if overwritten:** High — login failures if broken + +**Upstream overlap likelihood:** Medium + +**Notes for conflict resolution:** c81921ce7 OAuth broadcast channel — preserve over upstream auth changes. + +**CIPP files:** +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/pages/_app.js` + +--- + +## Recent Custom Commits (post v10.5.2 intake baseline) + +These commits on production branches represent work done AFTER the last upstream intake and are especially protected: + +### CIPP (`main` since `pre-upstream-merge-v1052-20260617`) + +- `f2d87612e chore: update dependencies and remove pnpm lock file` +- `fba60b9f5 chore: update quarantine management features and version bump` +- `349eb5e9f chore: upstream v10.5.2 intake — quarantine pagination and version bump` +- `34dc2cff6 manual pagination support for Invoke-ListMailQuarantine` + +### CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`) + +- `de78a343e refactor: enhance quarantine message retrieval and filtering` +- `bff606d1d chore: upstream v10.5.2 intake — ORCA fixes, standards, quarantine, version bump` +- `5c748cd80 fix: add early template filter when supplied` +- `ab0b292c5 manual pagination support for Invoke-ListMailQuarantine` +- `684a78c3e bulk request next link following` +- `76b390f1a fix: rerun issue` +- `103815550 Fixes ORCA244` +- `3626847a1 Fixes ORCA235` +- `171f8a341 Fixes ORCA242` +- `8bb7b1c3e Fixes ORCA233_1` +- `2699da195 Fixes ORCA103` +- `47c28390b Fixes ORCA113` +- `8d3fbc49d Update policy based on MS and Orca guidance` +- `2f083afbb Fixes ORCA179` +- `794a13ed2 Fix for ORCA107 and add Exchange Global Quarantine policy to cache` +- `95d8f78ed Fix ORCA104` +- `982621d14 Update Invoke-ListTenantAlignment.ps1` +- `a0418fdfc Update Invoke-ListTenantAlignment.ps1` +- `d9a8c33b5 fix: rerun detection on scheduled tasks` + +## Conflict Resolution Rules + +1. **Never** auto-resolve toward upstream for files in this map +2. **Preserve** Manage365 branding, quarantine portal, and email troubleshooter behavior +3. **Integrate** upstream bug fixes only when they don't regress custom behavior +4. **Pause** for approval on any commit touching High-risk areas above +5. **Document** every adaptation in APPLIED_COMMITS tracking files diff --git a/docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md new file mode 100644 index 0000000000..b650080bbd --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/DEFERRED_REVIEW_CIPP_API_20260617.md @@ -0,0 +1,464 @@ +# Deferred Conflict Review — CIPP-API Upstream Sync + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-api-20260617` +Baseline: `master` @ `de78a343e` +Regression baseline: **47/47 passed** (Levenshtein + `Tests/Tools`) after batches 1–6 + +This document completes the deferred-conflict review pass requested before any further cherry-picks. **No new upstream commits were applied** during this review. + +--- + +## Executive Summary + +Of the **9 deferred upstream commits**, review concludes: + +| Outcome | Count | Commits | +|---------|-------|---------| +| **Already implemented** | 3 | `64836c02`, `2ab0e0e2`, `503eac5b` (cache portion) | +| **Apply with adaptation** | 3 | `ddc264a7`, `503eac5b` (CIS test only), `961462f3` | +| **Skip (cherry-pick not applicable)** | 2 | `ee0b8229`, `fdf313e5` | +| **Skip (feature absent / rename-only)** | 1 | `57b7de1f` | +| **Needs product decision** | 1 | `785e71c5` | + +**Key findings** + +1. **`CippReportingDB` cleanup (`ee0b8229` / `fdf313e5`)** — The fork **does** use `CippReportingDB` heavily as the tenant cache table, but **does not** have upstream’s timer cleanup block. Upstream’s final rule (`fdf313e5`) deletes **all** rows older than 30 days with **no partition filter**. That is a data-retention/product decision, not a missing-feature deferral. **Do not cherry-pick these commits verbatim.** + +2. **Rerun fixes (`64836c02` / `2ab0e0e2`)** — Already present on `master` via `d9a8c33b5` and `76b390f1a` (same file, equivalent logic including `LastScheduledTime` and `Add-Member -Force`). Mark superseded. + +3. **Apps and services (`503eac5b`)** — Fork cache is **ahead** of upstream (bulk Graph fetch + dedicated `AppsAndServices` type). Only the **CIS 1.3.4 test** adaptation is still useful. + +4. **Role assignment tests (`961462f3`)** — Fork CIS 1.1.x tests still use legacy `RoleAssignments` cache; upstream’s PIM-aware `Get-CippDbRole` + `RoleAssignmentScheduleInstances` pattern is **not** equivalent and should be adapted file-by-file. Supporting helpers/cache already exist in the fork. + +5. **Applied standard `fd6e30f6` / `610cb089b`** — Correctly applied in **`CIPPStandards`** (runtime module). Stale duplicate under `Modules/CIPPCore/Public/Standards/` still targets `azureADJoin`; mirror or remove in a follow-up (non-blocking for deploy path). + +--- + +## Per-Commit Decision Table + +| Upstream SHA | Title | Recommendation | Risk | Protected M365? | Upstream-only deps? | +|--------------|-------|----------------|------|-----------------|---------------------| +| `ee0b8229` | fix: change cleanup to 30 days | **Skip** (needs custom design, not cherry-pick) | **High** if applied blindly | Yes — `Start-TableCleanup.ps1` (+ custom quarantine rule) | No — block absent in fork | +| `fdf313e5` | fix: remove partitionkey | **Skip** (same; dangerous as-is) | **High** | Yes — same file | No | +| `57b7de1f` | Rename usedInTemplates → usage | **Skip** | Low | No | Yes — full usage-tracking block missing | +| `785e71c5` | fix user select | **Needs product decision** | **Medium** | No (Autopilot profile) | No | +| `ddc264a7` | Update GenericTest002 | **Apply with adaptation** | Low | No | No | +| `64836c02` | rerun detection on scheduled tasks | **Already implemented** | — | No | No | +| `2ab0e0e2` | fix: rerun issue | **Already implemented** | — | No | No | +| `503eac5b` | fix: apps and services test | **Already implemented** (cache) / **Apply with adaptation** (CIS test) | Low | No — cache structure | No | +| `961462f3` | fix: role assignment checks | **Apply with adaptation** (defer until dedicated batch) | Medium | No — CIS/ZTNA tests only | No — `Get-CippDbRole` exists | +| `fd6e30f6` | azureADRegistration standard fix | **Applied** (`610cb089b`) — validate in tenant | Medium | Yes — standards | No | + +--- + +## A. CippReportingDB Cleanup Commits + +**Commits:** `ee0b8229`, `fdf313e5` +**File:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +### What upstream changed + +| Commit | Change | +|--------|--------| +| `ee0b8229` | On existing `CippReportingDB` cleanup rule: `AddHours(-30)` → `AddDays(-30)` (fixes a typo — 30 hours was almost certainly meant to be 30 days). Filter still `PartitionKey eq 'Search'`. | +| `fdf313e5` | Removes `PartitionKey eq 'Search'` filter entirely. Final upstream rule: delete **all** `CippReportingDB` entities with `Timestamp` older than 30 days. | + +Upstream current `master` places this rule **second** in the batch (after `webhookTable`), before `AuditLogSearches`. + +### What our fork currently does + +- **No** `CippReportingDB` entry in `Start-TableCleanup.ps1`. +- **Does** use `CippReportingDB` extensively as the **primary tenant-scoped read cache** (`Add-CIPPDbItem`, `New-CIPPDbRequest`, nightly `Set-CIPPDBCache*` functions). Partition keys are **tenant IDs**, not `'Search'`. +- **Does** clean `AuditLogSearches` with `PartitionKey eq 'Search'` at **12 hours** (line 22–27) — separate table from `CippReportingDB`. +- **Custom protected rule:** `cacheQuarantineMessages` 1-day retention (Manage365 quarantine portal). + +No fork code writes `PartitionKey = 'Search'` into `CippReportingDB`. Search-partition entities live in `AuditLogSearches` / audit webhook flows. + +### Conflict cause + +Cherry-pick expects an existing `CippReportingDB` cleanup block to modify. Block never existed in the fork (diverged before upstream added it, or fork never adopted upstream reporting-DB timer cleanup). + +### Risk assessment + +| Action | Risk | +|--------|------| +| Cherry-pick `ee0b8229` alone | N/A — nothing to patch | +| Add upstream block with `Search` partition only | **Low effect** — likely no-op (no such rows in our table) | +| Add upstream block after `fdf313e5` (no partition filter, 30-day TTL) | **High** — deletes **all** tenant cache snapshots older than 30 days across every partition. Nightly refresh usually rewrites cache, but failed/inactive tenants or long-lived row keys could cause standards/tests to skip until manual cache refresh. | + +### Protected Manage365 areas + +Touches `Start-TableCleanup.ps1` — **protected** (custom quarantine cleanup must be preserved). + +### Upstream-only dependencies + +None — table and cache infrastructure exist in fork; only the **timer retention policy** is missing. + +### Recommendation + +**Skip both commits as cherry-picks.** This is **not** “defer until reporting DB feature chain arrives” — the cache table is already central to the fork. Instead: + +1. **Product decision:** Should `CippReportingDB` rows ever expire automatically? If yes, define Manage365-specific retention (e.g., tenant-partition scoped, align with cache refresh cadence, exclude `-Count` rows, etc.). +2. **Do not** add upstream’s post-`fdf313e5` rule verbatim. +3. If retention is desired later, implement a **new adapted block** — do not replay `ee0b8229` → `fdf313e5` sequence. + +--- + +## B. Intune Templates Property Rename + +**Commit:** `57b7de1f` +**File:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1` + +### What upstream changed + +Single-line rename inside a **~60-line standards usage-tracking block** (not in fork): + +```powershell +# upstream (inside StandardsTemplateV2 lookup loop) +$Tpl | Add-Member -NotePropertyName 'usage' -NotePropertyValue @($Usage) -Force +# was: usedInTemplates +``` + +### What our fork currently does + +Fork `Invoke-ListIntuneTemplates.ps1` (98 lines) lists templates from Azure Table `templates` partition — **no** `$Usage` computation, **no** `usedInTemplates` or `usage` property on returned objects. + +### Frontend expectation (CIPP `main` @ sync baseline) + +File: `src/pages/endpoint/MEM/list-templates/index.js` + +```javascript +const simpleColumns = ["displayName", "isSynced", "package", "description", "Type"]; +``` + +Repo-wide search: **no** references to `usedInTemplates` or template-level `.usage`. Unrelated `usageLocation` fields exist elsewhere. + +**Conclusion:** Frontend expects **neither** `usedInTemplates` **nor** `usage`. + +### Conflict cause + +Rename sits inside upstream-only usage block; fork file ends before that block. + +### Is upstream’s larger usage-tracking block required? + +**Yes.** The rename alone is meaningless without: + +- Standards template cross-reference (`StandardsTemplateV2` / package tags) +- Population of `$Usage` array per template GUID + +### Recommendation + +**Skip permanently** unless Manage365 intentionally imports the full Intune template ↔ standards usage feature (API + UI column). Renaming in isolation provides no value. + +**Risk:** Low +**Protected areas:** No +**Defer until feature chain:** Only if product wants usage column in MEM templates UI — treat as a **feature import**, not a bugfix cherry-pick. + +--- + +## C. Autopilot User-Select Behavior + +**Commit:** `785e71c5` +**File:** `Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1` + +### Fork behavior (current) + +```powershell +if ($Language -in @('user-select', 'os-default')) { $Language = "$null" } +# ... +'locale' = "$($Language)" # JSON serializes as string "$null" for both modes +``` + +Both `user-select` and `os-default` become the **literal string** `"$null"` in the Graph body (PowerShell double-quoted expansion of `$null`). + +### Upstream behavior + +```powershell +if ($Language -eq 'os-default') { $Language = $null } +# locale = "$($Language)" → omitted/null for os-default +if ($Language -eq 'user-select') { + $ObjBody.locale = '' + $ObjBody | Add-Member -Name 'language' -Value '' -Force +} +``` + +- **`os-default`** → `$null` locale (OS default during OOBE) +- **`user-select`** → empty `locale` + empty `language` (user chooses during OOBE; Graph treats empty string differently from null) + +### Safety analysis + +| Mode | Fork (likely Graph effect) | Upstream (intended) | Safer | +|------|---------------------------|---------------------|-------| +| `os-default` | String `"$null"` in locale | Null / omitted locale | **Upstream** | +| `user-select` | Same string `"$null"` | Empty locale + language | **Upstream** | + +Fork behavior is almost certainly **incorrect** for both modes — `"$null"` is not a valid locale tag and may confuse Autopilot OOBE language selection. + +**Behavior change risk:** Tenants with profiles already created under fork logic may have `"$null"` stored as locale. PATCH after fix could change OOBE language behavior on **profile update** (not retroactive on enrolled devices until profile reapplied). + +### Recommendation + +**Needs product decision** before apply. + +- **Technical direction:** Upstream fix aligns with Graph API semantics; fork `"$null"` string is a bug. +- **Operational concern:** Audit existing Autopilot deployment profiles for `"$null"` locale before mass remediate; communicate to clients using `user-select` / `os-default`. +- **Do not apply** until stakeholders accept potential profile locale migration. + +**Risk:** Medium +**Protected areas:** No (shared Autopilot helper, not quarantine/custom branding) + +--- + +## D. Generic Test Conflict + +**Commit:** `ddc264a7` +**File:** `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest002.ps1` + +### What upstream changed + +Display cap only: **100 → 500** licensed users in markdown output (4 lines). + +### What our fork currently does + +Fork implementation **diverged** (LicenseOverview cache, `UserLicenseMap` hashtable, string `$Result` vs upstream `StringBuilder`) but **still uses cap 100** at lines 57–61. + +Cherry-pick conflict is structural (different surrounding code), not logical opposition. + +### Recommendation + +**Apply with adaptation** — manual 4-line change; no need for full cherry-pick. + +**Minimal patch:** + +```powershell +# line ~57 +if ($DisplayCount -ge 500) { break } +# line ~60-61 +if ($UserLicenseMap.Count -gt 500) { + $Result += "`n*Showing 500 of $($UserLicenseMap.Count) licensed users.*`n" +``` + +**Risk:** Low (informational test output only) +**Protected areas:** No + +--- + +## E. Rerun Logic (Combined Review) + +**Commits:** `64836c02`, `2ab0e0e2` +**File:** `Modules/CIPPCore/Public/Test-CIPPRerun.ps1` + +### What upstream changed + +| Commit | Change | +|--------|--------| +| `64836c02` | Track `LastScheduledTime`; when `$BaseTime` differs from cached value, treat as new execution (fixes scheduled-task rerun false positives). | +| `2ab0e0e2` | Use `Add-Member -Force` instead of direct property assignment on table entities (Azure Table entity objects). | + +### What our fork currently does + +`Test-CIPPRerun.ps1` on sync branch **already contains both behaviors** (lines 66–79, `Add-Member -Force` pattern throughout). + +Present on `master` before sync branch: + +- `d9a8c33b5` — fix: rerun detection on scheduled tasks +- `76b390f1a` — fix: rerun issue + +`git diff 64836c02 HEAD -- Test-CIPPRerun.ps1` shows only the `Add-Member` delta (already applied). `git diff 2ab0e0e2 HEAD` is empty. + +### Conflict cause at cherry-pick time + +Fork already had v10.5.2-intake equivalents; upstream SHAs patch an older baseline → conflict, not missing logic. + +### Recommendation + +**Already implemented** — mark superseded in tracking; **skip** cherry-picks. + +**Risk if re-applied:** Low conflict noise; no functional gain +**v10.5.2 intake:** Compatible — fixes were absorbed pre-sync + +--- + +## F. Apps and Services Cache / Test + +**Commit:** `503eac5b` +**Files:** `Set-CIPPDBCacheSettings.ps1`, `Invoke-CippTestCIS_1_3_4.ps1` + +### What upstream changed + +1. **Cache:** Separate `New-GraphGetRequest` to `/admin/appsAndServices` → `Add-CIPPDbItem -Type 'AppsAndServices'`. +2. **Test:** Read `AppsAndServices` type first; fall back to nested object in `Settings` cache; stricter property presence check. + +### What our fork currently does + +**Cache (`Set-CIPPDBCacheSettings.ps1`):** Already caches `AppsAndServices` via **bulk Graph request** (lines 28–66), plus `FormsSettings` — **more complete** than upstream commit. + +**Test (`Invoke-CippTestCIS_1_3_4.ps1`):** Still reads **only** `Settings` cache and extracts `appsAndServices` child — upstream test improvement **not** yet applied. + +### Does CIS 1.3.4 need the dedicated cache type? + +**Not strictly** — fork bulk cache also writes `Settings` with full directory settings. Test can pass today **if** `appsAndServices` appears in Settings payload. + +**Adapted test still valuable:** Prefer dedicated `AppsAndServices` type (already populated) with Settings fallback — matches upstream intent and avoids false skips if Settings shape changes. + +### Conflict cause + +Fork restructured cache function (bulk + Forms); upstream added sequential block → textual conflict. Feature not missing. + +### Recommendation + +| Part | Action | +|------|--------| +| Cache portion of `503eac5b` | **Already implemented differently** — skip | +| CIS test portion | **Apply with adaptation** (manual merge of test file only) | + +**Minimal patch for `Invoke-CippTestCIS_1_3_4.ps1`:** Replace Settings-only lookup with upstream’s AppsAndServices-first + fallback + property guard (see `503eac5b` diff). + +**Risk:** Low +**Protected areas:** No (standard cache file, not quarantine) + +--- + +## G. Role Assignment Checks + +**Commit:** `961462f3` +**Files:** `Invoke-CippTestCIS_1_1_1.ps1`, `_1_1_2`, `_1_1_3`, `_1_1_4`, `Invoke-CippTestZTNA21782.ps1` + +### What upstream changed + +Replaces legacy `RoleAssignments` cache joins with: + +- `Get-CippDbRole -IncludePrivilegedRoles` (role members from DB role objects) +- `RoleAssignmentScheduleInstances` cache (PIM permanent assignments, `assignmentType -eq 'Assigned'`, no `endDateTime`) +- HashSet-based privileged user ID aggregation + +### What our fork currently does + +| File | Fork pattern | +|------|--------------| +| CIS 1.1.1–1.1.4 | `Get-CIPPTestData -Type 'Roles'` + `RoleAssignments` + `-in` filters | +| ZTNA21782 | `RoleAssignments` join with `UserRegistrationDetails` | +| Other ZTNA tests (21815, 21816, etc.) | **Already** use `Get-CippDbRole` + `RoleAssignmentScheduleInstances` | + +Fork **has** `Get-CippDbRole`, `Get-CippDbRoleMembers`, `Set-CIPPDBCacheRoleAssignmentScheduleInstances` — infrastructure exists; CIS 1.1.x not migrated. + +### Equivalent logic? + +**No.** Legacy `RoleAssignments` can miss PIM schedule nuances and uses different role ID fields (`roleDefinitionId` vs `roleTemplateId`). Upstream fix addresses false negatives/positives for privileged user detection. + +### Conflict cause + +Partial migration — fork ZTNA tests updated in v10.5.2 intake; CIS 1.1.x left on old pattern; upstream patch overlaps both → 4/5 file conflicts. + +### Recommendation + +**Apply with adaptation** in a dedicated batch — **file-by-file manual merge**, do not blind cherry-pick. + +Suggested order: `CIS_1_1_1` → `_1_1_2` → `_1_1_3` → `_1_1_4` → `ZTNA21782` (mirror patterns from existing `Invoke-CippTestZTNA21816.ps1`). + +**Risk:** Medium (test assertions only; may change pass/fail for tenants using PIM) +**Protected areas:** No +**Dependencies:** Ensure `RoleAssignmentScheduleInstances` cache refresh runs (`Set-CIPPDBCacheRoleAssignmentScheduleInstances`). + +--- + +## Applied Standard Validation: `fd6e30f6` / `610cb089b` + +**File (runtime):** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` +**Applied SHA:** `610cb089b` (batch 6, clean cherry-pick) + +### What changed + +| Before | After | +|--------|-------| +| Read/write `azureADJoin.allowedToJoin` | Read/write `azureADRegistration.allowedToRegister` | +| Always remediate | Skip remediate when `azureADRegistration.isAdminConfigurable -eq $false` (common when Intune enabled) | + +### Is the `azureADRegistration` change safe? + +**Yes, technically correct.** Standard name and helptext describe **device registration**, not Entra join. Prior behavior targeted the wrong Graph sub-object and could report/remediate the wrong policy surface. + +**Caveats:** + +1. **Intune-enabled tenants:** Remediation skipped with Warning — alert/report still evaluate `azureADRegistration` state. Operators may see alerts they cannot auto-remediate (expected). +2. **Stale duplicate:** `Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` still uses `azureADJoin` — **not invoked** by `Push-CIPPStandard` (loads `CIPPStandards` module). Schedule mirror cleanup to avoid future confusion. + +### Rollback concern + +Revert `610cb089b` restores incorrect `azureADJoin` targeting. If remediation ran on a tenant **before** apply, re-running old code would again write join policy instead of registration policy — document tenant state if rollback needed. + +### Live-tenant smoke test steps + +1. **Pre-check:** `GET beta/policies/deviceRegistrationPolicy` — note `azureADRegistration.allowedToRegister.@odata.type` and `isAdminConfigurable`. +2. **Tenant without Intune** (or `isAdminConfigurable = true`): + - Enable standard with remediate ON, `disableUserDeviceRegistration = true`. + - Confirm PUT sets `azureADRegistration.allowedToRegister` to `#microsoft.graph.noDeviceRegistrationMembership`. + - Confirm `azureADJoin.allowedToJoin` unchanged unless separately configured. +3. **Intune-enabled tenant** (`isAdminConfigurable = false`): + - Run remediate — expect **Warning** skip, no PUT. + - Alert/report modes still produce meaningful compare output. +4. **Disable path:** Set `disableUserDeviceRegistration = false` — verify `#microsoft.graph.allDeviceRegistrationMembership` when remediate allowed. +5. **Log review:** Search `Standards` API logs for updated message strings (“users allowed to register”). + +--- + +## Recommended Next Adapted-Apply Batch (max 3 commits) + +| Priority | Item | Action | Rationale | +|----------|------|--------|-----------| +| 1 | `ddc264a7` | Manual 4-line cap 100→500 | Trivial, zero conflict risk, tests-only | +| 2 | `503eac5b` (test only) | Manual merge `Invoke-CippTestCIS_1_3_4.ps1` | Cache already done; improves test resilience | +| 3 | `961462f3` | Adapted file-by-file (start `CIS_1_1_1`) | Real correctness fix; use existing `Get-CippDbRole` infra | + +**Do not include** in next batch: cleanup commits, template rename, Autopilot language (pending decision), rerun commits (done). + +--- + +## Recommended Skips + +| SHA | Reason | +|-----|--------| +| `ee0b8229` | No block to patch; wrong to add without retention design | +| `fdf313e5` | Blanket 30-day delete on entire cache table — unsafe verbatim | +| `57b7de1f` | Rename-only; usage feature + UI absent | +| `64836c02` | Superseded by `d9a8c33b5` on master | +| `2ab0e0e2` | Superseded by `76b390f1a` on master | +| `503eac5b` (cache hunk) | Fork bulk implementation already superior | + +--- + +## Product Decisions Needed + +1. **`CippReportingDB` retention** — Should cache rows auto-expire? If yes, define partition/type scope and TTL (not upstream’s unfiltered 30-day rule). +2. **Autopilot `user-select` / `os-default` (`785e71c5`)** — Accept upstream Graph semantics and plan audit of existing profiles with `"$null"` locale? +3. **Intune template usage tracking** — Import full upstream usage block + UI column, or permanently skip `57b7de1f` chain? + +--- + +## Smoke Test Checklist — Applied Standards Changes + +### `intuneRestrictUserDeviceRegistration` (`610cb089b`) + +- [ ] Graph GET deviceRegistrationPolicy on test tenant — capture before state +- [ ] Remediate ON, non-Intune tenant — verify `azureADRegistration.allowedToRegister` changes +- [ ] Remediate ON, Intune tenant — verify skip + Warning (no PUT) +- [ ] Alert mode — alert fires when registration policy mismatches desired state +- [ ] Report/BPA — `intuneRestrictUserDeviceRegistration` field reflects new read path +- [ ] Confirm `azureADJoin.allowedToJoin` not modified by standard run +- [ ] Rollback plan documented if revert required + +### Post–batch 7 (when adapted applies land) + +- [ ] Run GenericTest002 on tenant with >100 licensed users — confirm 500 cap +- [ ] CIS 1.3.4 — pass/skip with AppsAndServices cache only (Settings fallback) +- [ ] CIS 1.1.1 — compare results before/after on tenant with PIM GA assignments +- [ ] Full regression: `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + `Tests/Tools` (47 tests) + +--- + +## Document History + +| Date | Action | +|------|--------| +| 2026-06-17 | Initial deferred review complete; cherry-picks remain paused pending approval of batch 7 plan | diff --git a/docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md b/docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md new file mode 100644 index 0000000000..dbd078e04d --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/FIRST_PASS_REPORT_20260617.md @@ -0,0 +1,249 @@ +# Upstream Sync — First Pass Inspection Report + +Generated: 2026-06-17 +Phase: **Setup complete — CIPP-API cherry-picks in progress** + +--- + +## 1. Git State Summary + +### CIPP (Frontend) + +| Item | Value | +|------|-------| +| Current branch | `main` | +| Working tree | Clean | +| vs origin | Ahead by 1 commit (unpushed) | +| Current tip | `f2d87612e` — chore: update dependencies and remove pnpm lock file | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP.git` ✓ | +| Upstream tracking branch | `upstream/main` | +| Upstream tip | `0d8ca9d2f` — Merge pull request #6153 from KelvinTegelaar/dev | +| Merge base | `0710355e2` | +| **Commits behind upstream** | **241** | + +### CIPP-API (Backend) + +| Item | Value | +|------|-------| +| Current branch | `master` | +| Working tree | Clean | +| vs origin | Up to date | +| Current tip | `de78a343e` — refactor: enhance quarantine message retrieval and filtering | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP-API.git` ✓ | +| Upstream tracking branch | `upstream/master` | +| Upstream tip | `5a0ddb29c` — Dev to hotfix (#2088) | +| Merge base | `6871d267e` | +| **Commits behind upstream** | **315** | + +### Remotes (both repos) + +| Remote | CIPP | CIPP-API | +|--------|------|----------| +| `origin` | `Celeratec/CIPP.git` | `Celeratec/CIPP-API.git` | +| `upstream` | `KelvinTegelaar/CIPP.git` | `KelvinTegelaar/CIPP-API.git` | + +Upstream fetch completed successfully during this inspection. + +--- + +## 2. Protective Setup + +## 2. Protective Setup + +Sync branches and backup tags created on 2026-06-17: + +| Repo | Production branch | Backup tag | Sync branch | +|------|-------------------|------------|-------------| +| CIPP | `main` @ pushed tip | `backup/pre-upstream-sync-cipp-20260617` | `manage365/upstream-sync-cipp-20260617` | +| CIPP-API | `master` | `backup/pre-upstream-sync-cipp-api-20260617` | `manage365/upstream-sync-cipp-api-20260617` | + +Tags and sync branches are local only (not pushed to origin unless approved). + +--- + +--- + +## 3. Documents Generated + +| Document | Location | +|----------|----------| +| CIPP upstream inventory (241 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_20260617.md` | +| CIPP-API upstream inventory (315 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_API_20260617.md` | +| Custom feature map | `docs/upstream-sync/CUSTOM_FEATURE_MAP_20260617.md` (both repos) | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_20260617.md` | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_API_20260617.md` | + +--- + +## 4. Inventory Statistics + +### CIPP — 241 upstream commits + +| Risk | Count | +|------|-------| +| Low | 11 | +| Medium | 80 | +| High | 150 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 200 | +| Cherry-pick with adaptation | 30 | +| Cherry-pick (clean) | 11 | + +**Notable buckets:** 136 dependency/build, 157 potentially breaking, 15 touch protected custom areas. + +### CIPP-API — 315 upstream commits + +| Risk | Count | +|------|-------| +| Low | 48 | +| Medium | 37 | +| High | 230 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 228 | +| Cherry-pick with adaptation | 39 | +| Cherry-pick (clean) | 48 | + +**Notable buckets:** 49 tests-only, 216 dependency/build tagged, 11 touch protected custom areas. + +--- + +## 5. Custom Features at Risk + +See `CUSTOM_FEATURE_MAP_20260617.md` for full detail. Highest-risk protected areas: + +1. **Quarantine Portal 5.13.0** — Very high upstream overlap; 20+ custom API files + shared frontend module +2. **Manage365 Branding/Versioning** — `manage365-version.json`, dual version tooling, drift alerts +3. **Email Troubleshooter** — Shares quarantine components; `Invoke-ExecEmailTroubleshoot.ps1` +4. **Navigation/Search UX** — Hybrid top-nav search, dashboard v2 routing (upstream changes nav frequently) +5. **Tenant Workflows** — GDAP, tenant mode, alignment with custom license/CA template logic +6. **OAuth Auth Flow** — BroadcastChannel popup completion (custom, not upstream) + +**Recent post-intake commits (especially protected):** + +CIPP (`main` since `pre-upstream-merge-v1052-20260617`): +- Quarantine management features + version bump +- v10.5.2 intake (quarantine pagination) +- manual pagination for ListMailQuarantine +- Dependency update (unpushed on main) + +CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`): +- Quarantine message retrieval refactor +- v10.5.2 intake (ORCA fixes, standards, quarantine) +- ORCA standards fixes (ORCA103–244) +- Tenant alignment updates + +--- + +## 6. First Pass Results + +| Metric | CIPP | CIPP-API | Total | +|--------|------|----------|-------| +| Upstream commits reviewed | 241 | 315 | **556** | +| Applied | 0 | 0 | 0 | +| Adapted | 0 | 0 | 0 | +| Skipped | 0 | 0 | 0 | +| Deferred | 0 | 0 | 0 | +| Conflicts encountered | 0 | 0 | 0 | +| Tests run | 0 | 0 | 0 | + +--- + +## 7. Recommended First Batch (Low-Risk) + +Apply **only after** creating sync branches and backup tags. Review each commit against `CUSTOM_FEATURE_MAP` before cherry-picking. + +### CIPP-API — Start here (more clean test/bugfix commits) + +Priority order — tests and isolated bugfixes with ≤2 files, no protected-path overlap: + +| # | SHA | Title | Category | +|---|-----|-------|----------| +| 1 | `2b441244` | feat: Add Levenshtein distance function and tests | Tests | +| 2 | `133f9295` | test: fix helper paths after tools folder move | Tests | +| 3 | `6aa66c74` | Custom Test - Alert on X statuses | Tests | +| 4 | `ee0b8229` | fix: change cleanup to 30 days | Bugfix | +| 5 | `fdf313e5` | fix: remove partitionkey | Bugfix | +| 6 | `ecbc9a50` | fix: Add error handling for missing standard functions | Bugfix | +| 7 | `57b7de1f` | fix: Rename 'usedInTemplates' to 'usage' | Bugfix | +| 8 | `23c8994d` | fixes defaultr_hidden vs hidden #5990 | Bugfix | +| 9 | `897dfaa4` | fixed #5997 | Bugfix | +| 10 | `5ccf15a9` | fix: missing odata path error in returned json | Bugfix | +| 11 | `9ba48711` | correct incorrect default value | Bugfix | +| 12 | `4214bc7d` | Fix: Fix missing OData path error in JSON response (#2054) | Bugfix | +| 13 | `71afcdd2` | ExoTransportConfig cache type - fix for missing data | Tests | + +**Checkpoint before:** `1aa55cff` (Intune standard change detection), `affac9d0` (standards run errors), `12bb4f69` (caching cleanup) — these touch standards/cache and need review. + +### CIPP — Smaller first batch (many upstream commits are dependency/build) + +| # | SHA | Title | Category | Notes | +|---|-----|-------|----------|-------| +| 1 | `98d5d94a` | Custom Test - Alert on X statuses | Tests | Low overlap | +| 2 | `1e59d2d4` | Update ListTests.json | Tests | Verify shape compatibility | +| 3 | `e3ed1818` | fix alert mode | Bugfix | 1 file | +| 4 | `60a50738` | fixes tenantfilter property | Bugfix | Review tenant context | +| 5 | `0a8252e3` | fix: version encoding | Bugfix | **Checkpoint** — touches version | +| 6 | `707873e3` | fix: Fix tab title showing as undefined | Bugfix | UI, low risk | +| 7 | `89abbf50` | fix: improve stale issue and close messages | Bugfix | GitHub workflow | +| 8 | `5709f856` | fix: update terminology Temporary Access Password | Bugfix | i18n only | + +**Skip/defer in CIPP first batch:** +- `983b48a1` / `bde8ad3c` — worktrees cleanup (may already exist on `fix/remove-claude-worktrees` branch; verify) +- `c8d61c07` — JIT admin fix (**Already implemented differently** at `7e1bab525`) +- `1ea0324e` — search-on-load fix (verify against our table search fix at `18c21fc6b`) +- `f768330c` — CIS standards tag move (**conflicts with our CIS 7.0 renumbering**) +- `fe4bd7f9` — alltenants sync (review tenant context) +- All Dependabot / package.json commits — **explicit approval required** + +--- + +## 8. Commits Requiring Approval Before Any Apply + +Any upstream commit touching these areas must pause for review (see inventory Notes column for full list): + +- Quarantine / spamfilter / `Build-CIPPQuarantineQueryParams` +- Email Troubleshooter / `ExecEmailTroubleshoot` +- Exchange Online / mailbox / transport +- Authentication / OAuth / SAM / roles / `SAMManifest.json` +- Tenant switching / tenantFilter / GDAP / alignment +- Branding / version.json / manage365-version +- Navigation / config.js / top-nav +- Shared API helpers (`New-GraphPostRequest`, etc.) +- Dependency upgrades / build tooling +- Large refactors (>5 files or "refactor" in title) + +--- + +## 9. Known Risks + +1. **Prior partial intake** — v10.5 / v10.5.2 selective intake already applied many upstream commits with adaptation. Some inventory commits may be **already implemented differently** (e.g., JIT admin, table search, quarantine pagination). +2. **High dependency churn in CIPP** — 136 of 241 commits touch package.json/CI; batching these blindly risks breaking the SWA build. +3. **Standards divergence** — CIS 7.0 renumbering and ORCA fixes on our side may conflict with upstream standards.json changes. +4. **Quarantine active development** — Both forks and upstream are changing quarantine simultaneously; highest conflict risk. +5. **Unpushed CIPP commit** — `main` is 1 commit ahead of origin (`f2d87612e` dependency update); push or include in sync branch baseline. + +--- + +## 10. Recommended Next Steps + +1. **Approve** creation of sync branches + backup tags (commands in §2) +2. **Review** this report and the first-batch table +3. **Begin CIPP-API** with test-only commits (`2b441244`, `133f9295`, `6aa66c74`) +4. **Run Pester** after each API batch: `Invoke-Pester -Path Tests/Tools,Tests/Endpoint -Output Detailed` +5. **CIPP second** — start with test commits, defer all dependency bumps +6. **Schedule checkpoint reviews** for quarantine, auth, tenant, and standards batches + +--- + +## 11. Remaining Manual Decisions + +- [ ] Confirm date stamp for sync branches (`20260617` vs `20260617` — branch history uses 20260617) +- [ ] Push unpushed CIPP commit before sync branch creation? +- [ ] Whether to skip upstream commits already implemented differently (JIT admin, search fixes) +- [ ] Dependency upgrade strategy — individual bumps vs grouped batch with build verification +- [ ] Standards/ORCA commits — merge vs skip given recent v10.5.2 intake +- [ ] Quarantine upstream delta — full diff review before any quarantine cherry-picks diff --git a/docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md b/docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md new file mode 100644 index 0000000000..15fc7b34be --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/MCP_INTAKE_20260803.md @@ -0,0 +1,47 @@ +# MCP Feature Intake — 2026-08-03 + +Cycle type: **Feature intake** per [PROCESS.md](PROCESS.md). + +## Feature: MCP Server (internal team) + +- Upstream refs: `Invoke-ExecMcp.ps1`, `Modules/CIPPCore/Public/MCP/*`, `Set-CIPPMCPClientApp.ps1`, `Config/openapi.json`, MCPAllowed wiring in ApiClient + auth +- Fork gap: Feature flag `MCPServer` existed (disabled) and `New-CippCoreRequest` already mapped MCP principals; missing endpoint, MCP helpers, OpenAPI spec, UI toggle +- Protected conflicts: Adapt `Set-CippApiAuth` / `CippApiClientManagement` — preserve SWA auth path and Manage365 branding (do not take CIPPNG/SSO EasyAuth rewrite) +- Scope: **capability only** — `MCPServer` remains **Enabled: false** until ops validates; internal team use +- Phases: backend → frontend → tab hygiene → verify → PR +- Approval: [x] design [x] implement [x] deploy (enable flag after smoke) + +## Also in this intake + +- Super-admin tab hygiene: removed 404 links for CIPP Users, SSO, Container Management from `tabOptions.json` +- Container management / logs / worker health: **not** intaken (Craft bridges required) +- Teams V2: **unchanged deferred** + +## Taken + +### CIPP-API + +- `Modules/CIPPCore/Public/MCP/{Get-CippMcpSpec,Get-CippMcpToolList,Get-CippMcpToolResult}.ps1` +- `Modules/CIPPHTTP/.../CIPP/MCP/Invoke-ExecMcp.ps1` +- `Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1` +- `Config/openapi.json` (upstream baseline for tool projection) +- `Get-CippApiClient` projects `MCPAllowed` +- `Invoke-ExecApiClient` persists MCPAllowed, configures MCP app on enable, SaveToAzure passes `McpClientIds` + PRM scope app setting +- `Set-CippApiAuth` gains optional `-McpClientIds` host/appId audiences (fork ARM path kept) + +### CIPP + +- `CippApiClientManagement.jsx`: MCPAllowed switch + warning, MCP API URL chip, table column +- `super-admin/tabOptions.json`: dropped CIPP Users / SSO / Container Management tabs + +## Enablement (post-deploy) + +1. Deploy all Function slots + SWA +2. Create/enable an API client with **MCP Access Allowed**, then **Save to Azure** +3. Toggle feature flag **MCP Server** on in CIPP settings / Feature Flags +4. Smoke: POST `tools/list` then one `.Read` tool via MCP client against `/api/ExecMcp` + +## Verification + +- PowerShell AST parse: all new/changed MCP and auth files OK +- `MCPServer.Enabled` remains `false` in `Config/FeatureFlags.json` diff --git a/docs/upstream-sync/history-cipp-api/README.md b/docs/upstream-sync/history-cipp-api/README.md new file mode 100644 index 0000000000..476d1030ca --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/README.md @@ -0,0 +1,13 @@ +# Upstream sync (CIPP-API) + +Manage365 upstream sync process is documented in the **CIPP** repo: + +**[../../CIPP/docs/upstream-sync/PROCESS.md](../../CIPP/docs/upstream-sync/PROCESS.md)** (sibling repo when checked out as `GitHub/CIPP` + `GitHub/CIPP-API`) + +Start a backend cycle from this repo root: + +```powershell +../CIPP/Tools/Start-UpstreamSyncCycle.ps1 -Repo CIPP-API +``` + +Cycle-specific API docs for June 2026 live in this folder (`CIPP_API_SYNC_CHECKPOINT_*.md`, etc.). diff --git a/docs/upstream-sync/history-cipp-api/SYNC_20260701.md b/docs/upstream-sync/history-cipp-api/SYNC_20260701.md new file mode 100644 index 0000000000..1876775045 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/SYNC_20260701.md @@ -0,0 +1,9 @@ +# Upstream Sync Checkpoint — July 1, 2026 (Light Delta) + +Baseline moved: CIPP-API **10.5.2 → 10.5.6**. 56 commits applied on +`manage365/upstream-sync-cipp-api-20260701` (backup tag `backup/pre-upstream-sync-cipp-api-20260701`). + +Full details (taken/deferred/adapted, both repos) live in the CIPP repo: +`docs/upstream-sync/SYNC_20260701.md`. + +Verification: PowerShell parser clean on all 81 changed script files; JSON valid; no conflict markers. diff --git a/docs/upstream-sync/history-cipp-api/SYNC_20260803.md b/docs/upstream-sync/history-cipp-api/SYNC_20260803.md new file mode 100644 index 0000000000..018ea52bd2 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/SYNC_20260803.md @@ -0,0 +1,60 @@ +# Upstream Sync Checkpoint — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP (frontend) | 10.7.3 (`d72c1e21b`) | **10.7.5** | `upstream/main` @ `274880fd0` | +| CIPP-API | 10.7.3 (`f1b2c93d5`) | **10.7.5** | `upstream/master` @ `245d9d35b` | + +Branches: `manage365/upstream-sync-cipp-20260803` / +`manage365/upstream-sync-cipp-api-20260803`. +Backup tags: `backup/pre-upstream-sync-cipp-20260803` / +`backup/pre-upstream-sync-cipp-api-20260803`. + +Delta docs: [UPSTREAM_DELTA_CIPP_20260803.md](./UPSTREAM_DELTA_CIPP_20260803.md), +CIPP-API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260803.md`. + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | AzBobbyTables 3.6.2 + `Add`/`Get`/`Remove-CIPPAzDataTableEntity` + call-site renames + ConversionTable | **Apply** | +| 2 | Intune template drift helpers (`Get-CIPPIntunePolicyName`, `Merge-CIPPIntuneTemplateIdentity`, `Select-CIPPIntuneAvailableSetting`), standard/compare updates, SafeLinks, Get-CIPPDrift Microsoft-managed skip | **Apply** (31/31 Intune helper Pester) | +| 3 | `disableNesting` (New-CIPPGroup + FE form), EditGroup `AddDevice` + MEM device action + adapted groups edit dialog, SAM `RoleManagement.Read.Exchange` Scope | **Adapt** (preserved fork groupType/mailNickname + redesigned edit page) | +| 4–5 | Snooze Reason (FE+API), default Home test suite, partner webhook stale-URL + `Get-CIPPHostname`, M365Licenses.json, audit log V2 + webhook tests | **Apply / Adapt** (21/21 `Test-CIPPAuditLogRules` Pester) | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO preconsent / `CippSSOSettings` / `Invoke-ExecSSOSetup` | **Skip** | SSO family — SWA/Craft (2026-07-15 decision) | +| `CippAppServiceDomains` / `ExecAppServiceDomains` | **Defer** | No App Service custom-domain hosting in fork | +| `Start-SchedulerOrchestrator` `$ValidTypes` destructive cleanup | **Still defer** | Carryover from 07-28 | +| Teams V2, MCP, Worker health, container management, Purview DLP | Unchanged backlog | See PROCESS.md Feature intake backlog | + +## Verification + +- Frontend: `npm run build` — pass +- Pester: Intune helpers 31/31; `Test-CIPPAuditLogRules` 21/21 +- AST parse: all newly ported `.ps1` files OK +- SAMManifest JSON valid after Scope union-merge + +## Versions + +- Manage365 **5.30.0 → 5.31.0**; upstream baseline **10.7.3 → 10.7.5** +- API `version_latest.txt` and `Config/version_latest.txt` both **10.7.5** + +## Post-deploy actions + +1. Deploy Static Web App +2. Deploy **all** Function App slots (AzBobbyTables + CIPPCore changes) +3. **CPV refresh** — new Graph delegated Scope `RoleManagement.Read.Exchange` (`3bc15058-…`) +4. Smoke: Intune template drift, MEM device Add-to-Group, group create with disableNesting, partner webhook page, snooze with reason + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `274880fd0` (upstream/main) | +| CIPP-API | `245d9d35b` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp-api/SYNC_20260814.md b/docs/upstream-sync/history-cipp-api/SYNC_20260814.md new file mode 100644 index 0000000000..f2a8e2fe67 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/SYNC_20260814.md @@ -0,0 +1,66 @@ +# Upstream Sync Checkpoint — 2026-08-14 + +Cycle type: **Major** (upstream **10.7.5 → 10.8.5**; plan scoped as 10.8.4, tip advanced). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP | 10.7.5 (`274880fd0`) | **10.8.5** | `upstream/main` @ `a1b620403` | +| CIPP-API | 10.7.5 (`245d9d35b`) | **10.8.5** | `upstream/master` @ `e02ac3724` | + +Branches: `manage365/upstream-sync-cipp-20260814` / +`manage365/upstream-sync-cipp-api-20260814`. +Backup tags: `backup/pre-upstream-sync-cipp-20260814` / +`backup/pre-upstream-sync-cipp-api-20260814`. + +Delta: [UPSTREAM_DELTA_CIPP_20260814.md](./UPSTREAM_DELTA_CIPP_20260814.md), +API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260814.md`. +Baselines: [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md). + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | ConversionTable, ListSecureScoreReport + Get-CIPPSecureScoreReport, FE securescore + AllTenants helpers | **Apply / Adapt** | +| 2 | ListIntuneApprovalRequests + alert + retry; BitLocker search page + nested ExecBitlockerSearch; FE MAA + BitLocker nav | **Apply** | +| 3 | ListRoles (nested), ListTenantAllowBlockList (Spamfilter), TABL helpers, ExecSetDefaultMFAMethod, CA/EXO PowerShell/DisableM365GroupUsers standards | **Apply** | +| 4 | Baselines modules (29) + Set-CippBaselineRunContext + orch + activities + 9 HTTP + BaselineStandards (81) + FeatureFlags/Timers (flag **off**) + FE pages/components; nav commented | **Feature intake** | +| 5 | ListBrandingSettings/Presets + Get-CIPPBranding*; ListCommunityRepoTemplates + catalog/CippTemplateCatalog (nav not fully rewired) | **Apply (partial)** | +| — | M365Licenses.json | **Apply** | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO / authentication nav / container-management / ForcedSsoMigration | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After ports settle | +| Full BEC / user detail rewrite; Default MFA **UI** wire into fork user page | **Defer Adapt** | API ported; FE surgical later | +| Full community-repos index.js rework | **Defer Adapt** | Catalog API + page present | +| Full branding settings JSX replace | **Defer Adapt** | List APIs ported; keep Manage365 branding UI | +| CVE report rewrite | **Skip** | Fork removed CVE surface on origin | +| Teams V2 | Unchanged deferred | | +| PublicMcpRegister | **Defer** | MCP already intaken separately | + +## Verification + +- PowerShell AST: Baselines/*.ps1 + key new HTTP entrypoints OK +- `Baselines.Enabled` = **false** in FeatureFlags +- SAMManifest: no new permission IDs this cycle + +## Versions + +- Manage365 **5.32.2 → 5.33.0**; upstream baseline **10.7.5 → 10.8.5** +- API `version_latest.txt` / `Config/version_latest.txt` → **10.8.5** + +## Post-deploy + +1. Deploy SWA + **all** Function slots (esp. standards processor for baseline timer when enabled) +2. Smoke: MAA Requests, BitLocker search, Secure Score, `/tenant/baselines` (direct URL) +3. Enable `Baselines` flag only after orchestrator smoke +4. Optional: uncomment Baselines nav in `src/layouts/config.js` + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `a1b620403` (upstream/main) | +| CIPP-API | `e02ac3724` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md new file mode 100644 index 0000000000..be8a8ad841 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_20260814.md @@ -0,0 +1,33 @@ +# Upstream Delta — CIPP (frontend) — 2026-08-14 + +Cycle: **Major** — upstream **10.7.5 → 10.8.5** (plan drafted as 10.8.4; tip advanced). + +| | SHA / version | +|--|--| +| Last sync base | `274880fd0` (upstream tip at 10.7.5) | +| Upstream tip | `a1b620403` (`upstream/main`, **10.8.5**) | +| Fork production at cycle start | `68dda9809` (`origin/main`) | +| Sync branch | `manage365/upstream-sync-cipp-20260814` | +| Backup tag | `backup/pre-upstream-sync-cipp-20260814` | + +Noise excluded from triage: `public/intune-definitions/**` churn, bulk Vitest scaffolding (port only if a batch needs it). + +## Triage themes + +| Theme | Outcome | Notes | +|-------|---------|-------| +| Baselines pages (`src/pages/tenant/baselines/**`, `CippBaselines/*`) | **Feature intake** | Pair with API; flag off; nav commented upstream — wire carefully | +| Branding settings/PDF presets | **Adapt** | Preserve Manage365 `CippBrandingSettings` / `customBranding` | +| Intune approval requests | **Apply** | New page + API | +| BitLocker search page | **Apply** | New route; search helper already in fork | +| Secure Score report / AllTenants | **Adapt** | Pair with `ListSecureScoreReport` | +| Default MFA method on user page | **Adapt** | Surgical into fork user detail | +| Community repos catalog | **Adapt** | Large FE rework — surgical | +| BEC / user detail | **Adapt** | Protected-rich fork UI | +| Auth nav → authentication/container-management, SSO dialogs | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After feature ports | +| CippDataTable / top-nav / standards accordion | **Adapt only** | Protected | + +## Protected map refresh note + +Still authoritative: [CUSTOM_FEATURE_MAP_20260617.md](./CUSTOM_FEATURE_MAP_20260617.md). This cycle adds: Baselines parallel to Applied Standards (do not replace drift UI); branding Adapt-not-replace; skip auth nav split. diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md new file mode 100644 index 0000000000..5a803c2df5 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260617.md @@ -0,0 +1,358 @@ +# Upstream Delta Inventory — CIPP-API (Backend) + +Generated: 2026-06-17 +Production branch: `master` @ `88ddf5da5` +Upstream: `KelvinTegelaar/CIPP-API` @ `5a0ddb29c` + +## Delta summary + +| Metric | Count | +|--------|-------| +| Fork-only commits (ahead of upstream) | 436 | +| Upstream commits not in `master` (behind) | 315 | +| Upstream commits since sync base `de78a343e` | 315 | + +**Interpretation:** The branch is behind upstream by design after the first selective sync (~31 commits merged). Remaining delta is expected unpicked upstream work plus items explicitly deferred. + +### Recommendation distribution + +- **Cherry-pick with review:** 254 +- **Already applied (sync 2026-06-17):** 19 +- **Skip or Defer:** 17 +- **Cherry-pick:** 15 +- **Defer:** 10 + +### Risk distribution + +- **Medium:** 247 +- **Low:** 45 +- **High:** 23 + +## Carried-forward deferred items (from sync 2026-06-17) + +| Item | Status | +|------|--------| +| UserReportedPhishing backend + `ThreatSubmission.ReadWrite.All` | Defer — paired import | +| Autopilot user-select / os-default / locale (`785e71c5`) | Needs product decision | +| CippReportingDB cleanup (`ee0b8229`, `fdf313e5`) | Needs product decision | +| Intune template usage tracking (`57b7de1f` chain) | Defer — feature absent in fork | + +## Commit inventory + +| SHA | Title | Author | Date | Risk | Area | Protected overlap | Recommendation | Dependency notes | Files | +|-----|-------|--------|------|------|------|-------------------|----------------|------------------|-------| +| `5a0ddb29` | Dev to hotfix (#2088) | John Duprey | 2026-06-10 | Medium | General | None | Cherry-pick with review | | | +| `8f2198e7` | chore: bump version to 10.5.2 | John Duprey | 2026-06-10 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | host.json, version_latest.txt | +| `e9bc5ad5` | fix: add early template filter when supplied | John Duprey | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 | +| `abcbb60a` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-06-10 | Medium | General | None | Cherry-pick with review | | | +| `f37d68ad` | Fixes ORCA235 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1 | +| `28ba94b4` | Fixes ORCA242 | Zacgoose | 2026-06-11 | Medium | General, Tests | None | Cherry-pick — test-only | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoProtectionAlert.ps1 (+1) | +| `2851db0f` | Fixes ORCA233_1 | Zacgoose | 2026-06-11 | Medium | General, Tests | None | Cherry-pick — test-only | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoInboundConnector.ps1 (+1) | +| `cbcc61b5` | Fixes ORCA103 | Zacgoose | 2026-06-11 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1 | +| `a556b98b` | Fixes ORCA113 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1 | +| `db3de75a` | Fixes ORCA244 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1 | +| `0640f07c` | Fixes ORCA179 | Zacgoose | 2026-06-11 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1 | +| `238001c1` | Update policy based on MS and Orca guidance | Zacgoose | 2026-06-11 | Low | Standards deploy, Tests | None | Cherry-pick — test-only | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1, Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1 | +| `2ab0e0e2` | fix: rerun issue | John Duprey | 2026-06-10 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Public/Test-CIPPRerun.ps1 | +| `8cd8d1d9` | Fix for ORCA107 and add Exchange Global Quarantine policy to cache | Zacgoose | 2026-06-10 | High | General, Tests | Quarantine | Skip or Defer — protected-area overlap | | Config/CIPPDBCacheTypes.json, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1, Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1 | +| `cc84a49d` | Fix ORCA104 | Zacgoose | 2026-06-10 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1 | +| `9f0bacd6` | manual pagination support for Invoke-ListMailQuarantine | Zacgoose | 2026-06-10 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 | +| `83b13034` | bulk request next link following | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1 | +| `b8fefcfd` | Update Invoke-ExecMcp.ps1 | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1 | +| `e8d13427` | audit log detailed logging for debugging | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1, Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1 | +| `a0a79852` | Update Invoke-ListTenantAlignment.ps1 | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 | +| `9dd0e567` | Update Invoke-ListTenantAlignment.ps1 | Zacgoose | 2026-06-10 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1 | +| `64836c02` | fix: rerun detection on scheduled tasks | John Duprey | 2026-06-09 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Public/Test-CIPPRerun.ps1 | +| `14346161` | Dev to hotfix (#2085) | John Duprey | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `39e1a34e` | chore: bump version to 10.5.1 | John Duprey | 2026-06-09 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | host.json, version_latest.txt | +| `6c897f52` | fixes group addition in user page and vacation mode | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1, Modules/CIPPCore/Public/New-CIPPUserTask.ps1 | +| `2511c6e5` | add limits for tools copilot studio | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1 | +| `8f1069cf` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `280b3b9d` | fix: add CippExtensions to allowlist | John Duprey | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1, Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, profile.ps1 | +| `b79c296f` | sherweb migration fixes | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1, Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1 (+2) | +| `2925643d` | push endpoint over to export job endpoint | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-IntuneReportExportSubmit.ps1, Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-IntuneReportExportOrchestrator.ps1 (+1) | +| `c215631c` | Fix: Message trace role and variable casing in message trace function (#2083) | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `2138ec6d` | Fix: Improve conversion for EnableAutoTrim setting (#2084) | KelvinTegelaar | 2026-06-09 | Medium | General | None | Cherry-pick with review | | | +| `3f9aab05` | api version file fixes | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Config/version_latest.txt, Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1 | +| `3e33fdb1` | fix: more robust conversion for EnableAutoTrim setting | Bobby | 2026-06-08 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 | +| `c0f663ca` | fix: update role and fix variable casing in message trace function | Bobby | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1 | +| `fc76e111` | sso app repair and fix migration failures | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Add-CIPPSSOAppSecret.ps1, Modules/CIPPCore/Public/Authentication/New-CIPPSSOApp.ps1, Modules/CIPPCore/Public/Authentication/Set-CIPPSSOStoredCredentials.ps1 (+1) | +| `b36a32b0` | shuffle file locations | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/MCP/Get-CippMcpSpec.ps1, Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1, Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1 (+1) | +| `4f8bc79c` | Dev to release (#2081) | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review | | | +| `a52f002d` | 10.5.0 version up | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | version_latest.txt | +| `e4455d3f` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review | | | +| `bfb0c17a` | tools update | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review | | Tools/Configuration/1.6.0/Configuration.psd1, Tools/Configuration/1.6.0/Configuration.psm1, Tools/Configuration/1.6.0/PSGetModuleInfo.xml (+7) | +| `34112ffd` | temporary 1 day to clear old ips | KelvinTegelaar | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1 | +| `64f30df6` | Update Start-DurableCleanup.ps1 | Zacgoose | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1 | +| `2a63cfc7` | Update Get-CIPPAlertQuotaUsed.ps1 | Zacgoose | 2026-06-08 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1 | +| `ddc264a7` | Update Invoke-CippTestGenericTest002.ps1 | Zacgoose | 2026-06-08 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest002.ps1 | +| `d3d98923` | cache middleware changes | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1, Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1, Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1 (+3) | +| `336909e8` | extra module dep | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Tools/Build-DevApiModules.ps1, Tools/Metadata/1.5.7/Metadata.psd1, Tools/Metadata/1.5.7/Metadata.psm1 (+1) | +| `431d2929` | extra module dep | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Tools/Build-DevApiModules.ps1, Tools/Configuration/1.6.0/Configuration.psd1, Tools/Configuration/1.6.0/Configuration.psm1 (+1) | +| `65ba7a78` | embed module into pipeline actions | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | | Tools/Build-DevApiModules.ps1, Tools/ModuleBuilder/3.1.8/ModuleBuilder.psd1, Tools/ModuleBuilder/3.1.8/ModuleBuilder.psm1 (+2) | +| `5df315b6` | improved open api spec for ai | KelvinTegelaar | 2026-06-06 | Medium | General | None | Cherry-pick with review — single file | | openapi.json | +| `da10bf92` | renumber for cis7 | KelvinTegelaar | 2026-06-06 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.md, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.md (+296) | +| `d817b6d2` | fix: cis test 1_3_5 | John Duprey | 2026-06-05 | Medium | General, Tests | None | Cherry-pick — test-only | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_5.ps1 | +| `ee1884f7` | add permissions for new settings endpoint | John Duprey | 2026-06-05 | High | Permissions/build | SAM/permissions manifest | Defer — SAM permission chain review required | | Config/SAMManifest.json | +| `503eac5b` | fix: apps and services test | John Duprey | 2026-06-05 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_4.ps1 | +| `961462f3` | fix: role assignment checks | John Duprey | 2026-06-05 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1 (+2) | +| `f0f361d4` | restart helper | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1, Modules/CIPPCore/Public/Functions/Request-CIPPRestart.ps1 (+2) | +| `612ba54c` | Update Get-CIPPTenantAlignment.ps1 | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1 | +| `c040658a` | Update FeatureFlags.json | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Config/FeatureFlags.json | +| `ed47810f` | Update Test-CIPPAccess.ps1 | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `f7f51cc1` | remove duplicate non gated cache collection items | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1 | +| `2b093c37` | fixes issue with CA compare and a weird blank line | KelvinTegelaar | 2026-06-05 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 | +| `9cab0663` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1 | +| `4435ea38` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1, Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 (+1) | +| `2b3a1c81` | Fix for manually run standards being excluded from applied standards report page | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1 | +| `3fa0ee6c` | Pipe character escaping in names | Zacgoose | 2026-06-05 | Medium | General, Tests | None | Cherry-pick — test-only | | Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1, Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest004.ps1, Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest005.ps1 (+1) | +| `90e45ead` | pass timing to stop queue rerun protection drift | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1 | +| `2bbcfcc8` | This endpoint is silly, we are going to manually try paging | Zacgoose | 2026-06-05 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1 | +| `d4ddd3d6` | fix: additional protections for choco app deployment | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1 | +| `c5849381` | fix: fallback to app version if one is not specified | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Assert-CippVersion.ps1 | +| `c5d15588` | fix: version check | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Assert-CippVersion.ps1 | +| `65659c21` | fix: remove headers parameter from scheduler details/list | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1 | +| `7902097a` | add missing return | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1 | +| `3ca58875` | updated descriptions. | KelvinTegelaar | 2026-06-04 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAdminPortalLicenses.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListApiTest.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1 (+157) | +| `4909e9c2` | dbcache desc | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1 | +| `6a1c3733` | fixes issue with all tenants retrieval | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1 | +| `c7cebfeb` | better descriptions | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1 | +| `53db433c` | better descriptions | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 (+18) | +| `ae921278` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `2b3a7bb5` | resolves #6096 | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1 | +| `a8e7aa5e` | Feat: Add Email as alternate login ID standard (#2075) | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `593911e1` | Feat: Add Invoke-ExecSetCASMailbox function for CAS settings management (#2076) | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `9a176cc7` | feat: Add Group-Based Licensing support (#2063) | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | | +| `adba8fa7` | add excludeFromAlert to licenses. | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1 (+5) | +| `4288bd80` | exclude partner tenant | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1, Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCreateDefaultGroups.ps1 (+1) | +| `bc6aee43` | fix: quarantine deny action | John Duprey | 2026-06-03 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1 | +| `77073ba3` | role change | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 | +| `7800b3cb` | Fix | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `72c277d7` | Allow MCP client | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1 | +| `23506364` | add tot non-ng | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `49e8af8b` | feat: add Invoke-ExecSetCASMailbox function for CAS settings management | Bobby | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1 | +| `ec2eb836` | add logging to mcp reation. | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `0cd6f9d2` | MCP client updates to support client auth | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1, Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `6fc7d357` | Revert custom well known | KelvinTegelaar | 2026-06-03 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | CIPPHttpTrigger/function.json, CIPPWellKnown/function.json, Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1 (+4) | +| `5c81043c` | change resource usage to craft well known | KelvinTegelaar | 2026-06-03 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | CIPPHttpTrigger/function.json, CIPPWellKnown/function.json, Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1 (+4) | +| `1fc42631` | feat: add Email as alternate login ID standard | Bobby | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1 | +| `a2c2524c` | oauth prm | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `3e99e667` | add mcp allowed | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Get-CippApiClient.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `a9be2729` | Update Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 | Zacgoose | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 | +| `64efbd97` | Apply multiple fixes to the add member to exo groups flow including adding new users with auto retry | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1, Modules/CIPPCore/Public/New-CIPPUserTask.ps1 | +| `2edc7592` | Handle PendingAcceptance guests and update reporting | Zacgoose | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1 | +| `058da5e0` | rework mail contact standard and lazy load modules when needed | Zacgoose | 2026-06-03 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 | +| `6eeb31b4` | Pluralize standard name and continue on error | Zacgoose | 2026-06-03 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1 | +| `1167ff5b` | caching bump | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review | | Shared/CIPPSharp/CIPPTestDataCache.cs, Shared/CIPPSharp/bin/CIPPSharp.dll | +| `55ddb18b` | Update Invoke-ExecTestRun.ps1 | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1 | +| `3f842abc` | fix: explicitly remove tenant from the table instead of using -cleanold | John Duprey | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1 | +| `3f9dbd9f` | new licence report endpoint and revert old endpoint | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLicenses.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensesReport.ps1 | +| `28752144` | unique | KelvinTegelaar | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1 | +| `2492ad4f` | customsubject fix | KelvinTegelaar | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 | +| `5a3b4259` | fix: Update endpoint roles to use Autopilot.Read (#2068) | KelvinTegelaar | 2026-06-02 | Medium | General | None | Defer — Autopilot language/locale (product decision) | | | +| `0c54cd16` | fix: move New-CIPPCoreRequest back to CIPPCore | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 | +| `55a97db2` | added logging | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1 | +| `0c5d2bb8` | Fix TenantAllowBlockListTemplate always reporting non-compliant (#2069) | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `256e9fc4` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `235bd855` | fix: validate and sanitize msp/choco app params | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/ConvertTo-CIPPSafePwshArg.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1 | +| `468fb307` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `ac338417` | add featureflag for mcp | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Config/FeatureFlags.json | +| `a9797cd9` | chore: cleanup redundant tenant check in listexorequest | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1 | +| `139b0c60` | fix: sanitize more odata paths for tables | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1 (+2) | +| `679c3905` | fix: validate token exchange url is microsoft | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 | +| `648127f7` | fix: role for EditIntunePolicy | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1 | +| `3c19e629` | fix: ip restriction logic | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `a40683c5` | fix: access issues related to undefined roles | John Duprey | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1 | +| `9d8f1a0d` | correct incorrect pathing | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1 | +| `f3393cb9` | Update Invoke-ExecUniversalSearchV2.ps1 | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1 | +| `4b4a2d1d` | Update Set-CIPPDBCacheSharePointSiteUsage.ps1 | Zacgoose | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1 | +| `c16557ff` | Guarding for cache collection items | Zacgoose | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1 | +| `54a3a082` | api auth save and get changes | Zacgoose | 2026-06-01 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1, Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `fad627f8` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review | | | +| `72f7882f` | fixes another add member | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `acf4bf33` | Add or update the Azure App Service build and deployment workflow config | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | .github/workflows/dev_cippjta72.yml | +| `2a2851b5` | sso auth | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1 | +| `26a87b27` | add-member force | KelvinTegelaar | 2026-06-01 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1 | +| `8341f49d` | Test | KelvinTegelaar | 2026-05-31 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpSpec.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolList.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolResult.ps1 (+1) | +| `44780652` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-31 | Medium | General | None | Cherry-pick with review | | | +| `7b341600` | update openapi spec with generated one | KelvinTegelaar | 2026-05-31 | Medium | General | None | Cherry-pick with review — single file | | openapi.json | +| `999f0283` | Fix TenantAllowBlockListTemplate always reporting non-compliant | Chris Dewey | 2026-05-31 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1 | +| `518855cc` | test optimisation | Zacgoose | 2026-05-30 | Low | Tests | None | Cherry-pick — test-only | | Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1, Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1 (+30) | +| `dd8952e4` | reduce memory | Zacgoose | 2026-05-30 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLogs.ps1 | +| `11e613aa` | cleanup | Zacgoose | 2026-05-30 | Medium | General, Tests | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1, Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 | +| `7caadb22` | fixes | Zacgoose | 2026-05-30 | Medium | General | None | Cherry-pick with review | | Shared/CIPPSharp/CIPPSharp.csproj, Shared/CIPPSharp/bin/CIPPSharp.dll | +| `f5f37368` | Optimize CIPP DB orchestration | Zacgoose | 2026-05-30 | Medium | General, Tests | None | Cherry-pick — test-only | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1 (+204) | +| `2ed3f94c` | chore: remove write host | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1 | +| `da7bd8c4` | chore: add devsecrets to restricted tables | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1 | +| `c69e2ce1` | fix: allow for command without .value | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1 | +| `c18bda87` | fix: optimize checks | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1 | +| `38e3ae9e` | chore: block arbitrary cmdlets not in CIPP modules | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1, Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1, Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1 | +| `e98445f2` | chore: sanitize cippid in public webhooks | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-PublicWebhooks.ps1 | +| `0fd3315b` | chore: disable cippcommand action | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1 | +| `a17137cb` | chore: remove cipp processor queue | John Duprey | 2026-05-29 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPProcessorQueue.ps1 | +| `e3d57cf0` | Update Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | Zacgoose | 2026-05-29 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | +| `e0f45f20` | Backup excluded tenants config | Zacgoose | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/New-CIPPBackup.ps1 | +| `3f03634f` | Update Initialize-CIPPAuth.ps1 | Zacgoose | 2026-05-29 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 | +| `1ac506d7` | fix: update endpoint roles to use Autopilot.Read | Bobby | 2026-05-28 | Medium | General | None | Defer — Autopilot language/locale (product decision) | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 | +| `1f9fb1fd` | test invocation optimisations | Zacgoose | 2026-05-28 | Medium | General, Tests | None | Cherry-pick with review | | Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1, Shared/CIPPSharp/CIPPTestDataCache.cs (+1) | +| `55fea61a` | Feat: Add online archive report functionality for mailboxes (#2067) | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review | | | +| `a1179a21` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review | | | +| `fc080e4a` | new auth methods single standard | KelvinTegelaar | 2026-05-28 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1 | +| `0cdc2e81` | new auth methods single standard | KelvinTegelaar | 2026-05-28 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1 | +| `99dd88c5` | optimisation | Zacgoose | 2026-05-28 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1 (+5) | +| `25e2b0f2` | tweaks | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1 | +| `25fcdc1c` | add 404 detection for non-existing roles | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 | +| `aefa69b0` | add compliance admin by default | KelvinTegelaar | 2026-05-28 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1, Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1 | +| `5b7c5a96` | Update Invoke-ListWorkerHealth.ps1 | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1 | +| `e41d5322` | Update Add-CIPPDbItem.ps1 | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Add-CIPPDbItem.ps1 | +| `0ebb1880` | implement autopatch | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1 | +| `829ced81` | feat(mailboxes): cache mailbox and archive usage metrics | Bobby | 2026-05-27 | Medium | General | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1 | +| `e563aea9` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | | | +| `bdd86024` | Add version cleanup | KelvinTegelaar | 2026-05-27 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSPOVersionCleanup.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 | +| `8a536fe8` | Fix: Update terminology from "Temporary Access Password" to "Temporary Access Pass" (#2066) | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | | | +| `b7c72180` | fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" | Bobby | 2026-05-27 | Medium | General, Standards config | None | Cherry-pick with review | | Config/standards.json, Modules/CIPPCore/Public/New-CIPPTAP.ps1 | +| `b7d4f5e2` | Sharepoint management functionality. | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1 | +| `f85963b7` | Sharepoint management functionality. | KelvinTegelaar | 2026-05-27 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/Get-CIPPSPOSite.ps1, Modules/CIPPCore/Public/Set-CIPPSPOSite.ps1, Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1 (+2) | +| `c5a8a207` | smart lockout standard | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1 | +| `c5b0e592` | smart lockout standard | KelvinTegelaar | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1 | +| `49153019` | use top 500 to minimise requests | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1 | +| `7d3b480e` | Update Invoke-CIPPStandardDefenderCompliancePolicy.ps1 | Zacgoose | 2026-05-27 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1 | +| `122aec8f` | fix for template id casing | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1 | +| `a6fdfe23` | Make all tenants list for SPO sites fast | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageReport.ps1 | +| `95d48d1f` | Fix for desktop activations copilot ready test | Zacgoose | 2026-05-27 | Low | Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1 | +| `5561a5b1` | Fix: tenant groups cache issue (#2065) | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | | | +| `22902b0b` | api fixes | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/New-CIPPAPIConfig.ps1, Modules/CIPPCore/Public/Authentication/Repair-CippApiIdentifierUri.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1 | +| `49d629e5` | Update Get-CippApiAuth.ps1 | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1 | +| `359633a4` | fix: ensure tenant groups skips cache so they dont alternate anymore when refreshed | Bobby | 2026-05-26 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantDetails.ps1 | +| `97dc672c` | user sync | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UserSyncTimer.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1 (+1) | +| `e6b800b1` | remove rerun from alert | Zacgoose | 2026-05-26 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1 | +| `59a0e15d` | update application content type handling | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review | | Shared/CIPPSharp/CIPPRestClient.cs, Shared/CIPPSharp/bin/CIPPSharp.dll | +| `1e63ebf0` | Update Invoke-CIPPStandardsharingDomainRestriction.ps1 | Zacgoose | 2026-05-26 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1 | +| `71afcdd2` | ExoTransportConfig cache type - fix for missing data used in test suites | Zacgoose | 2026-05-26 | Medium | General, Standards deploy, Tests | None | Cherry-pick — test-only | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoTransportConfig.ps1 (+3) | +| `443e16a3` | feat: ability to add/remove nested groups in group memberships (#2056) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `a7b7d4da` | feat: Add Apple ADE and Android enrollment profile endpoints (#2053) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `4214bc7d` | Fix: Fix missing OData path error in JSON response (#2054) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Already applied (sync 2026-06-17) | | | +| `a7e30d7a` | feat: Add DLP via DCS standard (#2062) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `05ce60f3` | Feat: Add function to remove users from admin roles (#2064) | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `46015ce7` | Add APv2 profile | KelvinTegelaar | 2026-05-25 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1 | +| `cb31997c` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | | +| `d854e22d` | feat: add function to remove users from admin roles | Bobby | 2026-05-25 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1 | +| `08b972cc` | timezone changes | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPTimezone.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1 | +| `a0dab59a` | domain fixes | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-GetTenantDomains.ps1 | +| `f09ce56a` | Update New-TeamsRequest.ps1 | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1 | +| `03abdad4` | add global var showing | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1 | +| `33512c39` | FIDO2 profile standards | KelvinTegelaar | 2026-05-25 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1 | +| `c81b6a5c` | add filtering | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1 | +| `08ab039c` | add filtering | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1 | +| `df847779` | implement standards template deployment for intune apps | KelvinTegelaar | 2026-05-24 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1, Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1 | +| `fa5f4de6` | remove sso setup from featureflag | John Duprey | 2026-05-24 | Medium | General | None | Cherry-pick with review — single file | | Config/FeatureFlags.json | +| `9bb2f6bc` | Update Build-DevApiModules.ps1 | Zacgoose | 2026-05-24 | Medium | General | None | Cherry-pick with review — single file | | Tools/Build-DevApiModules.ps1 | +| `dcf382aa` | Update Build-DevApiModules.ps1 | Zacgoose | 2026-05-24 | Medium | General | None | Cherry-pick with review — single file | | Tools/Build-DevApiModules.ps1 | +| `4ab85c75` | CIPP Hosted Notices | Zacgoose | 2026-05-24 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1 | +| `77a4be64` | fixes #6027 | KelvinTegelaar | 2026-05-23 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1 | +| `7fbb8edf` | Feat: Split Intune device join and registration standards (#2057) | KelvinTegelaar | 2026-05-23 | Medium | General | None | Cherry-pick with review | | | +| `bb2ebc6a` | fix: Add missing options for Windows Hello standard (#2061) | KelvinTegelaar | 2026-05-23 | Medium | General | None | Cherry-pick with review | | | +| `a89c2b93` | Add Group-Based Licensing support | Luis Mengel | 2026-05-23 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPGroup.ps1, Modules/CIPPCore/Public/Remove-CIPPGroup.ps1, Modules/CIPPCore/Public/Set-CIPPGroupLicense.ps1 (+3) | +| `cfa144d6` | Update Invoke-ListWorkerHealth.ps1 | Zacgoose | 2026-05-22 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1 | +| `1e02bfcb` | feat(standards): add DLP via DCS standard | Bobby | 2026-05-20 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1 | +| `9fce7e77` | feat: add in missing options for Windows Hello standard | Bobby | 2026-05-20 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1 | +| `73f83719` | add logging to geoip lookip | Zacgoose | 2026-05-19 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1 | +| `9ba48711` | correct incorrect default value | Zacgoose | 2026-05-19 | Low | Standards config, Standards deploy | None | Already applied (sync 2026-06-17) | | Config/standards.json, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1 | +| `e3e82cd9` | Cache Security Defaults | Zacgoose | 2026-05-19 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1 | +| `6b8ebd48` | refactor calls to use new onepass method to store DB data | Zacgoose | 2026-05-19 | High | General | Quarantine | Skip or Defer — protected-area overlap | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAppRoleAssignments.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheApps.ps1 (+83) | +| `1b1ee689` | cache PowerShell enabled status and use cached data for standard | Zacgoose | 2026-05-19 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1 | +| `ab5e5155` | Switch to app auth for authentication changes standard | Zacgoose | 2026-05-18 | Medium | General, Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1 | +| `d7cda8a3` | Update Initialize-CIPPAuth.ps1 | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 | +| `ab83a2bb` | Update Update-CIPPSAMRedirectUri.ps1 | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Authentication/Update-CIPPSAMRedirectUri.ps1 | +| `90b6457d` | Add AutoExpandingArchiveScope property showing org-level vs mailbox-level enablement | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1 | +| `c67bc8dd` | feat(standards): add intuneRestrictUserDeviceJoin standard | Bobby | 2026-05-15 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1 | +| `fd6e30f6` | fix(standards): target azureADRegistration in intuneRestrictUserDeviceRegistration | Bobby | 2026-05-15 | Low | Standards deploy | None | Already applied (sync 2026-06-17) | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1 | +| `7ae35c2b` | post exec tweaks for dedupe queue names | Zacgoose | 2026-05-15 | Medium | General, Tests | None | Cherry-pick with review | | Config/FeatureFlags.json, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheApplyBatch.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsApplyBatch.ps1 (+3) | +| `5289a309` | feat: ability to add/remove nested groups in group memberships | Integrated Solutions | 2026-05-15 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListUsersAndGroups.ps1 | +| `5901014f` | Merge pull request #100 from KelvinTegelaar/dev | Integrated Solutions | 2026-05-15 | Medium | General | None | Cherry-pick with review | | | +| `5ccf15a9` | fix: missing odata path error in the returned json | Bobby | 2026-05-14 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1 | +| `ee0398db` | feat(endpoint): add Apple ADE and Android enrollment profile listing and deletion endpoints | Bobby | 2026-05-14 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecRemoveEnrollmentProfile.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1 (+1) | +| `bc7de0c1` | when running a standard manually still process all standards for precedence overrides | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 | +| `dbd7fcb3` | logging improvements | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1 | +| `b4a52152` | Fix tenant group scope cache | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review | | Config/FeatureFlags.json, Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1 | +| `c097631e` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | Zacgoose | 2026-05-14 | Medium | General | None | Cherry-pick with review | | | +| `f5f7ae70` | fixes duplicate test calls in some cases | Zacgoose | 2026-05-14 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1, Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1 | +| `e060fa22` | implements #5981 | KelvinTegelaar | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1, Modules/CIPPCore/Public/New-CIPPCATemplate.ps1 | +| `b1363008` | #5997 | KelvinTegelaar | 2026-05-13 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1 | +| `897dfaa4` | fixed #5997 | KelvinTegelaar | 2026-05-13 | Low | Standards deploy | None | Already applied (sync 2026-06-17) | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1 | +| `9011dd63` | Nice CA policy editor and template creator/editor | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCreateCATemplate.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecEditCAPolicyFull.ps1 | +| `d480cf74` | Add Apps and SP to universal search | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Search-CIPPDbData.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1 | +| `2d33e020` | strip return characters | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1 | +| `93c80812` | skip replacement if not value set for variable | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Get-CIPPTextReplacement.ps1 | +| `3adade45` | Featureflag configs and timer changes | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Config/CIPPTimers.json, Config/FeatureFlags.json, Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1 (+2) | +| `2dbc4803` | auth configs | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | | Config/FeatureFlags.json, Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1, Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1 (+12) | +| `2c5d0c9a` | feat: Add license capability presets (#2040) | KelvinTegelaar | 2026-05-12 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | +| `6a81a086` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | | | +| `785e71c5` | fix user select | KelvinTegelaar | 2026-05-12 | Medium | General | None | Defer — Autopilot language/locale (product decision) | | Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1 | +| `78193020` | fix name | John Duprey | 2026-05-12 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-OrchestratorBatchItems.ps1 | +| `5f864e3f` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | | | +| `35437558` | Update Viva standard | Zacgoose | 2026-05-12 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1 | +| `ddb498fe` | chore: bump version to 10.4.5 | John Duprey | 2026-05-12 | High | General, Permissions/build | Build/host config | Skip or Defer — protected-area overlap | | host.json, version_latest.txt | +| `2869564f` | Add AlertUserReportPhising | KelvinTegelaar | 2026-05-12 | High | General, Permissions/build | SAM/permissions manifest | Defer — paired with frontend + ThreatSubmission SAM/CPV | | Config/SAMManifest.json, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1 | +| `ad0d096c` | OneDrive Sharing disable | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Invoke-CIPPOffboardingJob.ps1, Modules/CIPPCore/Public/Set-CIPPOneDriveSharing.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1 (+1) | +| `23c8994d` | fixes defaultr_hidden vs hidden #5990 | KelvinTegelaar | 2026-05-12 | Low | Standards deploy | None | Already applied (sync 2026-06-17) | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1 | +| `7fd7d097` | fixes sharepoint response stuff | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1 | +| `57b7de1f` | fix: Rename 'usedInTemplates' property to 'usage' for clarity in Invoke-ListIntuneTemplates | John Duprey | 2026-05-12 | Medium | General | None | Defer — Intune template usage tracking | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 | +| `ecbc9a50` | fix: Add error handling for missing standard functions in Push-CIPPStandard | John Duprey | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1 | +| `f5702f41` | feat: Enhance Invoke-ListIntuneTemplates to include usage tracking for standards templates | John Duprey | 2026-05-11 | Medium | General | None | Defer — Intune template usage tracking | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1 | +| `bc4abb53` | feat: add DefenderForOffice365 preset to license tests | Bobby | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1 (+3) | +| `21526416` | fix: add the presets to the rest of the standards | Bobby | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneApplications.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAssignmentFilters.ps1 (+8) | +| `5995ad77` | Merge branch 'dev' into testlicense-presets | Kristian Kjærgård | 2026-05-11 | High | Documentation, General, Standards deploy | Quarantine | Skip or Defer — protected-area overlap | | .github/instructions/standards.instructions.md, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1 (+120) | +| `12bb4f69` | Fix: Fix cleanup mistake in caching functions (#2048) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `affac9d0` | Fix/standards run errors (#2037) | KelvinTegelaar | 2026-05-11 | Low | Standards deploy | None | Cherry-pick with review | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 (+2) | +| `0c633110` | fix: fix my cleanup mistake | Bobby | 2026-05-11 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSites.ps1 | +| `ddf0a4c6` | feat: Add allTenants support for Teams SharePoint pages (#2022) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 | +| `d996babb` | Merge branch 'dev' of https://github.com/kris6673/CIPP-API into alltenants-SP | Bobby | 2026-05-11 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 | +| `75699ff1` | feat: Add fuzzy matching for Intune policies using Levenshtein distance (#1945) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `b0232eca` | Feat conditional access policy package tags (#1979) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `fdf313e5` | fix: remove partitionkey | John Duprey | 2026-05-11 | High | Reporting DB cleanup | None | Defer — CippReportingDB cleanup policy (product decision) | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 | +| `59da6e6b` | Merge branch 'dev' into testlicense-presets | Kristian Kjærgård | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1, Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1, Modules/CIPPCore/Public/Get-CIPPDrift.ps1 (+8) | +| `d8be4455` | Merge branch 'dev' into levenshtein-distance | Kristian Kjærgård | 2026-05-11 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 | +| `dd413bfe` | Add AAD Premium license gate to ExternalMFATrusted standard (#2046) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `b6c2a436` | Feat: Add support for AllTenants in Intune pages (#2021) | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1 | +| `ee0b8229` | fix: change cleanup to 30 days | John Duprey | 2026-05-11 | High | Reporting DB cleanup | None | Defer — CippReportingDB cleanup policy (product decision) | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 | +| `0c045c72` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | | | +| `1aa55cff` | fix: intune standard change detection queries | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1 | +| `5f3b26e5` | tablecleanup update | KelvinTegelaar | 2026-05-11 | High | Reporting DB cleanup | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1 | +| `2753661e` | implements #5986 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1 | +| `c29746a1` | eclusions everywhere | KelvinTegelaar | 2026-05-11 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1, Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 (+2) | +| `377b83e6` | HVE user management and cache | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Config/CIPPDBCacheTypes.json, Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1, Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheHVEAccounts.ps1 (+2) | +| `61bac43f` | Greatly speed up listing of intune policies for alltenants | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Add-CIPPDbItem.ps1, Modules/CIPPCore/Public/Get-CIPPIntunePolicyReport.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1 | +| `f87f7da9` | implemenets #5948 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1 | +| `6a96bab8` | Update Invoke-ListLicenses.ps1 | Zacgoose | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1 | +| `dad97f7c` | Restore Invoke-AddCustomScript.ps1 | James Tarran | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 | +| `dc3f0f45` | Merge branch 'dev' into Feat-Conditional-access-policy-package-tags | James Tarran | 2026-05-11 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1 | +| `6aa66c74` | Custom Test - Alert on X statuses | Zacgoose | 2026-05-11 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1, Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1 | +| `be25c764` | Squashed commit of the following: | James Tarran | 2026-05-11 | High | Documentation, General, Permissions/build | Build/host config; Quarantine | Defer — SAM permission chain review required | | .github/instructions/auth-model.instructions.md, .github/instructions/cippdb.instructions.md, .github/workflows/PR_Branch_Check.yml (+900) | +| `61c938aa` | standards use function | KelvinTegelaar | 2026-05-10 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1 | +| `ec7f5649` | Single deployment from function now that its all rigged up | KelvinTegelaar | 2026-05-10 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/ConvertTo-CIPPComplianceSetParams.ps1, Modules/CIPPCore/Public/Set-CIPPDlpCompliancePolicy.ps1, Modules/CIPPCore/Public/Set-CIPPRetentionCompliancePolicy.ps1 (+9) | +| `96727eb4` | fixes to purview setup | KelvinTegelaar | 2026-05-10 | Medium | General, Standards config, Standards deploy | None | Cherry-pick with review | | Config/standards.json, Modules/CIPPCore/Public/Format-CIPPCompliancePolicyParams.ps1, Modules/CIPPCore/Public/New-CIPPSitRulePackXml.ps1 (+11) | +| `a187a17a` | set warn to true. | KelvinTegelaar | 2026-05-10 | Low | Standards deploy | None | Cherry-pick with review | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1 (+1) | +| `b7f32e7a` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev | KelvinTegelaar | 2026-05-10 | Medium | General | None | Cherry-pick with review | | | +| `07f29839` | purview adding | KelvinTegelaar | 2026-05-10 | Medium | General, Standards config, Standards deploy | None | Cherry-pick with review | | Config/standards.json, Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1 (+10) | +| `9683b790` | Fix standards run errors for Retention and MDO standards | Brian Simpson | 2026-05-03 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1 (+3) | +| `b8b26a27` | Update standards docs URLs to alignment/templates path | Brian Simpson | 2026-05-03 | High | Documentation, General, Standards deploy | Quarantine | Skip or Defer — protected-area overlap | | .github/instructions/standards.instructions.md, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1 (+179) | +| `106f7463` | Add AAD Premium license gate to ExternalMFATrusted standard | Brian Simpson | 2026-05-08 | Low | Standards deploy | None | Cherry-pick with review — isolated standard | | Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1 | +| `daa8d242` | Merge pull request #95 from KelvinTegelaar/dev | Integrated Solutions | 2026-05-05 | Medium | General | None | Cherry-pick with review | | | +| `29685d69` | feat(api): add license capability presets | Bobby | 2026-05-04 | High | Documentation, General, Standards deploy | Quarantine | Skip or Defer — protected-area overlap | | .github/agents/CIPP-Alert-Agent.md, .github/agents/CIPP-Standards-Agent.md, .github/instructions/alerts.instructions.md (+135) | +| `7e9f7192` | feat: Add allTenants support for all the Teams SharePoint pages | Bobby | 2026-04-26 | Medium | General | None | Cherry-pick with review | | Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1, Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1, Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1 (+13) | +| `2a2772b4` | feat: add allTenants support for multiple intune pages | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review | | Modules/CIPPCore/Public/Get-CIPPAssignmentFilterReport.ps1, Modules/CIPPCore/Public/Get-CIPPIntuneAppProtectionPolicyReport.ps1, Modules/CIPPCore/Public/Get-CIPPIntuneApplicationReport.ps1 (+17) | +| `e210c484` | Merge branch 'dev' into Feat-Conditional-access-policy-package-tags | James Tarran | 2026-04-22 | Medium | General | None | Cherry-pick with review | | | +| `886e9b33` | Merge branch 'dev' into Feat-Conditional-access-policy-package-tags | James Tarran | 2026-04-22 | High | General, Standards deploy | Build/host config | Skip or Defer — protected-area overlap | | Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1, Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListCAtemplates.ps1 (+1) | +| `1dd59c5c` | Merge pull request #46 from KelvinTegelaar/dev | pull[bot] | 2026-04-21 | Medium | General | None | Cherry-pick with review | | | +| `6c1da764` | Merge pull request #45 from KelvinTegelaar/dev | pull[bot] | 2026-04-21 | Medium | General | None | Cherry-pick with review | | | +| `631cb269` | Merge pull request #44 from KelvinTegelaar/dev | pull[bot] | 2026-04-20 | Medium | General | None | Cherry-pick with review | | | +| `133f9295` | test: fix helper paths after tools folder move | Bobby | 2026-04-16 | Low | Tests | None | Already applied (sync 2026-06-17) | | Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1, Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1 | +| `7c524eda` | Merge remote-tracking branch 'upstream/dev' into levenshtein-distance | Bobby | 2026-04-16 | Medium | General, Standards deploy | None | Cherry-pick with review | | Modules/CIPPCore/Public/Tools/Find-CIPPFuzzyPolicyMatch.ps1, Modules/CIPPCore/Public/Tools/Get-CIPPLevenshteinDistance.ps1, Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 | +| `131a95ac` | Merge pull request #93 from KelvinTegelaar/dev | Integrated Solutions | 2026-04-15 | Medium | General | None | Cherry-pick with review | | | +| `5d43bea7` | Use template displayName for labels | James Tarran | 2026-04-03 | Medium | General | None | Cherry-pick with review — single file | | Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1 | +| `5ef7bbc0` | Add support for CA template package tags | James Tarran | 2026-04-03 | High | General, Standards deploy | Build/host config | Skip or Defer — protected-area overlap | | Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1, Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListCAtemplates.ps1, Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1 (+3) | +| `54b9af07` | feat: add configurable fuzzy Intune policy matching for standards deployments | Bobby | 2026-03-20 | Medium | General, Standards deploy, Tests | None | Cherry-pick — test-only | | Modules/CIPPCore/Private/Find-CIPPFuzzyPolicyMatch.ps1, Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1, Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1 (+1) | +| `2b441244` | feat: Add Levenshtein distance function and tests | Kristian Kjærgård | 2026-03-20 | Medium | General, Tests | None | Already applied (sync 2026-06-17) | | Modules/CIPPCore/Private/Get-CIPPLevenshteinDistance.ps1, Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1 | +| `b0e1f0c9` | Merge pull request #89 from KelvinTegelaar/dev | Integrated Solutions | 2026-03-20 | Medium | General | None | Cherry-pick with review | | | +| `c8419545` | Merge pull request #85 from KelvinTegelaar/dev | Integrated Solutions | 2026-03-10 | Medium | General | None | Cherry-pick with review | | | diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md new file mode 100644 index 0000000000..2394ad01d2 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260727.md @@ -0,0 +1,107 @@ +# Upstream Delta — CIPP-API — 2026-07-27 + +Cycle type: **Major delta** (upstream 10.6.1 → **10.7.2**). +Sync base: tag `10.6.1` (last cycle July 13) → `upstream/master` @ `d63b7fae3`. +86 commits in range (72 non-merge + release squashes). + +## Structural change upstream + +Upstream development moved to the **CyberDrain org**. Releases 10.7.0 +(`edd3481be`), 10.7.1 (`9d43278ec`) and 10.7.2 (`d63b7fae3`) each landed on +master as **single-parent squash commits** on top of the individually merged +dev commits. Triage therefore splits into: + +1. **True commits** (2026-07-13 → 07-21) — cherry-pickable individually. +2. **Squash-only content** (10.7.x) — ported as path-scoped diffs vs + `upstream/master` per feature area. + +Headline squash content: SAM/auth access-scope rework, **removal of the +vendored `Modules/MicrosoftTeams` module** (139 files, ~477k lines) replaced by +a direct `New-TeamsRequestV2` API layer, SharePoint permissions +report/editor family, SharePoint templated deployments hardening, Intune app +template deploy standard, CIPPSharp REST client. + +## Triage — Apply (cherry-pick, low/medium risk) + +| Upstream | Subject | Notes | +|---|---|---| +| `b2985a6f0` | assignments default append | Fork adapted Set-CIPPAssignedPolicy/Application (direction-scoped) — watch conflicts | +| `ad9caf3ff` | OneDrive root permissions cache boilerplate | New files; previously deferred, now cheap | +| `610ec61e7` | Get-GraphToken AppCache drift | Fork took upstream Get-GraphToken at SAM-cert intake | +| `176d43baa` | partner webhook external URI | | +| `5b42363cd` | nudge-mfa group targeting + auth method selection | New Set-CIPPRegistrationCampaign + ExecRegistrationCampaign; FE pair `ffbca69a5` | +| `2da187218` | snooze to new permission | Fork has snooze endpoints | +| `8f1dd767a` | smart lockout normalize | standards.json part = curated adapt | +| `25f38c58f` | CISA EXO 1.4.1 output | | +| `285685273` | ORCA121 ZAP actions | | +| `2bc0c8e26` | retention days integer cast | | +| `45bd6c996` | test data field projection + CIPPSharp | Fork CIPPSharp aligned upstream | +| `98f0778d8` | CIS/ZTNA test field refs | | +| `003e39f6b` | drift Intune name pairings + tests | | +| `01242ff57` | Set-CIPPUser group routing | Fork has Set-CIPPUser | +| `9368bca07` | SharePoint tests | With SP-templates family | +| `eddef9284` | Set-CIPPSAMAdminRoles cleanup | | +| `ffab43e1a`+`077c0689d` | Site (in)activity cache + report + single lookup | CIPPDBCacheTypes.json adapt; FE pair `bfc83afd7` | +| `996e75c98` | CPV retry guard removal | | +| `ed577f689` | quota alert mailbox types | FE pair `3ac0596f0` | +| `9b5bdd844` | schema extension status | | +| `fd245427d` | app-approval linked permission set | FE pair `3bea4e3b2` | +| `cb1876962` | TeamsDisableResourceAccounts standard | FE pair `0b879d130` | +| `ffd1d69ec` | CA template licenseAvailable P2 | | +| `1072570b5` | DisableM365GroupUsers AllowedToCreateGroups | FE pair `1f4dc9175` | +| `532fff7c6` | MAM deviceAppManagement endpoints | Set-CIPPAssignedPolicy fork-adapted — adapt | +| `1cfa4bfbf` | stale alert cutoff | | +| `0c13c98d0` | writeback reset synced user | | +| `7403b2f60` | community repo #6319 | | +| `6413f0325`+`2ddca8eaa` | JSON validation CI | FE pair `c259fe4ea` | +| `d348de650` | CSP license / Sherweb #6390 | FE pair `b4373e540` | +| `99787a04a` | drift: exclude SP admin center deviations | | +| `4ee94dcba` | GDAP age group in tenant groups | FE pair `341b4555e` | +| `206f9b155` | shadow AI tools alert | FE pair `01180c005` | +| `e704077c8` | audit log token denial = disable | Fork has V2 pipeline | +| `06025c8c6` | QuarantineRequestAlert write-alert typo | Standards file, not quarantine portal | +| `9e518828c` | CA GuestsOrExternalUsers spelling | | +| `ac5a198d8` | standards remediation error logging (13 auth-method standards) | | +| `b4133f874` | Intune false App Protection drift | | +| `784cff5af` | preserve @odata.type on synced App Protection | | +| `951f831f5` | Sherweb migration stop after disable | | +| `15efd3dbb` | inactive licensed users alert enrichment | | +| `7d16571f7` | PWdisplayAppInformation self-check | | +| `a27aff5f4` | CA guests selector constant | | +| `f4dd2a772` | Teams switches default $false | Uses existing New-TeamsRequest (v1) — fine | +| `e0060db51` | compare policy null results | FE pair `c4bf26c4d` | +| `32c387893`+`9609ac929`+`e569d2fc2` | SharePoint templated deployments v1 + steps + skip-exists | New AsyncDeployment framework; FE pair `fcf936ddd`+`84584329f` | +| `d14159589` | autopilot profile name validation | FE pair `da107ebf2` | +| `986de0254` | standards.json align | Adapt into curated fork standards.json | +| `ba8232e2f` | PIM role cache app token | SAMManifest merge (protected) + CPV note | +| `e247438fc` | copilot policy permissions | SAMManifest merge (protected) + CPV note; fork took Copilot intake 07-15 | +| `8cde47ba5` | skip SharingLinks in DB cache run | Push-CIPPDBCacheData fork-custom — adapt | +| `5a08c2c5f` | IDictionary request inputs | Take ListMailboxes half; skip MCP half (no MCP module) | + +## Triage — squash-only content to port by path diff + +| Area | Outcome | Notes | +|---|---|---| +| SharePoint permissions family (`Push-DBCacheSharePointPermissionsBatch`, `Push-StoreSharePointPermissions`, `Set-CIPPDBCacheSharePointPermissions`, `Resolve-CIPPSharePointPermissionScope`, `Set-CIPPSharePointObjectPermission`, `Get-CIPPSharePointErrorMessage`, `New-CIPPSharepointSite`, `New-CIPPSharePointLibrary`, `Invoke-ListSharePointPermissions`, `Invoke-ListSitePermissions`, `Invoke-ListSiteRoleDefinitions`, `Invoke-ListSiteUserAccess`, `Invoke-ExecRemoveLibraryPermission`, `Invoke-ExecSetLibraryInheritance`, `Invoke-ExecSetLibraryPermission`) | **Apply** | Mostly new files; SAM cert prereq already in fork; FE pair = permissions-report page + PDF components | +| SP templated deployments squash hardening (`Invoke-CIPPSharePointTemplateDeploy`, `Invoke-ExecSharePointTemplate`, `Push-ExecSharePointTemplateDeploy`, `Invoke-ListSharePointTemplates`) | **Apply** | Take at upstream tip state | +| `Invoke-CIPPStandardDisableInactiveUsers` (new standard) | **Apply** | + curated standards.json entry | +| Intune app template deploy (`New-CIPPIntuneAppDeployment`, `Get-CIPPOfficeAppBody`, `Invoke-CIPPStandardIntuneAppTemplateDeploy`, `Invoke-AddOfficeApp`, `Invoke-AddStoreApp`) | **Apply** | New standard family | +| `Invoke-CIPPStandardIntuneTemplate` squash changes | **Apply** | Diff-port | +| Teams V2 (`New-TeamsRequestV2`, Teams Voice endpoints, Cs* DBCache setters, **MicrosoftTeams module deletion**) | **Defer — feature intake** | Fork has ~20 standards + DBCache on vendored module; needs dedicated migration + smoke tests | +| SAM/auth access-scope rework (`Get-CippRequestContext`, `Initialize-CippRequestContext`, access-scope cache family, `Test-CIPPAccess`, `Set-CIPPAccessRole`, `New-CippCoreRequest`, GraphHelper touch-ups) | **Defer — feature intake** | Auth-critical protected area; pairs with SSO/CIPP-user family already in backlog | +| `Invoke-ExecAppServiceDomains` + custom-domains UI | **Defer** | Self-host oriented; super-admin pages family already deferred | +| CIPPSharp `CIPPRestClient.cs` + binary | **Defer** | Bundled with auth rework | + +## Triage — Skip / Already implemented / Deferred (unchanged families) + +| Upstream | Outcome | Reason | +|---|---|---| +| `24db2c55c`+`9c9208669` | Skip | NinjaOne CVE group added then reverted — net zero | +| `32ab1c860`, `bc7ace6da`, `98d824463` (version part) | Skip | version_latest.txt bumps (fork versioning protected) | +| `98d824463` host.json change | Review | Check diff during batch E | +| `8c4cf8d94` | Skip | MCP module not in fork (deferred family) | +| `096abcf5b`, `bcc920892` (FE) | Defer | SSO family — planned intake | +| `835972e1a`, `6bd008143`, `cf9fc1d2f` | Skip | Container management — fork has no container endpoints (Azure Functions hosting) | +| `f697a54c6` | Defer | DLP advanced-rule files not in fork (Purview DLP family deferred) | +| `b183e48b3` | Skip | Get-CIPPCVEReport not in fork (CVE management family deferred) | +| 10.7.2 squash | Skip | version_latest.txt only | diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md new file mode 100644 index 0000000000..0a99ec99e4 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260803.md @@ -0,0 +1,48 @@ +# Upstream Delta — CIPP-API — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). +Sync base: `f1b2c93d5` (upstream/master at 07-28 cycle) → `upstream/master` @ `245d9d35b`. +Branch: `manage365/upstream-sync-cipp-api-20260803` +Backup tag: `backup/pre-upstream-sync-cipp-api-20260803` + +3 merge commits (CyberDrain #103, #115, #132). Large surface: AzBobbyTables upgrade, +Intune template drift fixes, audit-log V2, groups/device membership, SSO/custom-domain +additions (skipped). + +## Commits + +| SHA | Date | Subject | +|-----|------|---------| +| `019f62b7a` | 2026-07-29 | Merge PR #103 from CyberDrain/dev | +| `82ab2621f` | 2026-07-29 | Merge PR #115 from CyberDrain/dev | +| `245d9d35b` | 2026-07-30 | Merge PR #132 from CyberDrain/dev → **10.7.5** | + +## Triage — Apply + +| Theme | Paths | Notes | +|---|---|---| +| AzBobbyTables 3.6.2 | `Modules/AzBobbyTables/3.6.2/**` | Drop 3.6.0 if present; fork has 3.4.0/3.5.1 | +| Table wrappers | `Add-CIPPAzDataTableEntity.ps1`, `Get-CIPPAzDatatableEntity.ps1`, new `Remove-CIPPAzDataTableEntity.ps1` | Thin wrappers over large-entity cmdlets | +| Call-site renames | Many `Remove-AzDataTableEntity` → `Remove-CIPPAzDataTableEntity` | Mechanical after wrappers land | +| ConversionTable | `Config/ConversionTable.csv` | Data-only | +| Intune template drift | `Get-CIPPIntunePolicyName`, `Merge-CIPPIntuneTemplateIdentity`, `Select-CIPPIntuneAvailableSetting`, `Invoke-CIPPStandardIntuneTemplate`, `Set-CIPPIntunePolicy`, `Compare-CIPPIntuneObject`, `Repair-CIPPIntuneTemplateNesting`, `Invoke-ExecCompareIntunePolicy` + tests | High value | +| Groups | `New-CIPPGroup.ps1` (`disableNesting`), `Invoke-EditGroup.ps1` (`AddDevice`) | Pair with FE | +| Audit log V2 | `Test-CIPPAuditLogRules`, `Push-AuditLogDownloadV2`, `Push-AuditLogTenantProcessV2`, related + webhook tests | Apply with Pester | +| SafeLinks | `Invoke-CIPPStandardSafeLinksPolicy.ps1` | Low risk | +| Partner webhook | `Invoke-ExecPartnerWebhook.ps1` + new `Get-CIPPHostname.ps1` | Adapt — SWA-safe without SSO | +| SAM | `Config/SAMManifest.json` Scope `3bc15058-…` | Union-merge; CPV after deploy | + +## Triage — Skip / Defer + +| Theme | Outcome | Why | +|---|---|---| +| `Update-CIPPSSOPreconsent.ps1`, `Initialize-CIPPAuth` SSO hook, `Invoke-ExecSSOSetup`, SSO tests | **Skip** | SSO family — SWA lockout / Craft | +| `Invoke-ExecAppServiceDomains.ps1` | **Defer** | No App Service custom-domain UI in fork | +| `Start-SchedulerOrchestrator` `$ValidTypes` destructive cleanup | **Still defer** | Carryover from 07-28 | +| `version_latest.txt` | **Chore** | Bump with Manage365 release at end | + +## Deferred feature backlog (unchanged stance) + +SSO/CIPP Users Skip · MCP Planned (design first) · Worker health Deferred · Teams V2 Defer · +Custom domains Defer · Container Skip · Purview DLP next feature intake · Custom Test Alerting +after CLM settle. diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md new file mode 100644 index 0000000000..35c403163b --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_DELTA_CIPP_API_20260814.md @@ -0,0 +1,38 @@ +# Upstream Delta — CIPP-API — 2026-08-14 + +Cycle: **Major** — upstream **10.7.5 → 10.8.5**. + +| | SHA / version | +|--|--| +| Last sync base | `245d9d35b` | +| Upstream tip | `e02ac3724` (`upstream/master`, **10.8.5**) | +| Fork production at cycle start | `b5f73e2c9` | +| Sync branch | `manage365/upstream-sync-cipp-api-20260814` | +| Backup tag | `backup/pre-upstream-sync-cipp-api-20260814` | + +`Config/SAMManifest.json`: **no new permission IDs** required for planned Apply/Baselines batches (existing Roles/UserAuth/BitLocker scopes suffice). + +## New HTTP entrypoints (selected) + +| Endpoint | Outcome | +|----------|---------| +| `ListIntuneApprovalRequests` | Apply | +| `ListSecureScoreReport` | Apply | +| `ListTenantAllowBlockList` (Spamfilter path) | Adapt/Apply over fork flat | +| `ListRoles` (nested rewrite) | Adapt | +| `ExecSetDefaultMFAMethod` | Apply | +| `ListBrandingSettings` / `ListBrandingPresets` | Adapt with branding intake | +| Baseline List/Add/Run/Stage/Override/Alignment/Remove + ListBaselineStandards | Feature intake | +| `ListCommunityRepoTemplates` | Adapt | +| `PublicMcpRegister` | Defer/skip unless needed (MCP already intaken) | +| SSO / AppService / Container / WorkerHealth | Skip | + +## Baselines backend bundle + +- `Modules/CIPPCore/Public/Baselines/*.ps1` (29) + `Set-CippBaselineRunContext.ps1` +- Orchestrator `Start-CIPPBaselineOrchestrator` + activities `Push-CIPPBaselineStandard`, `Push-CIPPBaselineCacheRefresh` +- `Config/BaselineStandards/**` (~81 JSON) +- Feature flag `Baselines` (Enabled: false) + timer `9f2c7b1e-…` +- Helpers if missing: `Get-CIPPIntuneCompareExclusions`, `Get-CIPPIntunePolicyGraphPath` + +SWA-safe: Durable + Azure Tables only (no Craft). diff --git a/docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md b/docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md new file mode 100644 index 0000000000..ab76069756 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/UPSTREAM_SYNC_CIPP_API_20260617.md @@ -0,0 +1,5713 @@ +# Upstream Sync Inventory — CIPP-API (Backend) + +Generated: 2026-06-17 11:21 + +## Summary + +| Field | Value | +|-------|-------| +| Our branch tip | `de78a343e1b8074afcbb417b344a6325704b94ee` | +| Upstream branch | `upstream/master` | +| Upstream tip | `5a0ddb29c3770525813aefea5e356fc56b088eeb` | +| Merge base | `6871d267ebec580b5097f44e7623c0d71c2c5581` | +| Commits to review | **315** | + +### Risk Distribution + +- **Low**: 48 +- **Medium**: 37 +- **High**: 230 + +### Recommendation Distribution + +- **Needs manual review**: 228 +- **Cherry-pick**: 48 +- **Cherry-pick with adaptation**: 39 + +### Review Buckets + +- **Potentially breaking changes**: 236 +- **Dependency/build changes**: 216 +- **Tests-only**: 49 +- **Other**: 21 +- **Bug fixes**: 8 +- **Security fixes**: 4 +- **Documentation-only**: 4 +- **Tenant management changes**: 4 +- **Authentication/permissions changes**: 4 +- **Exchange/Email changes**: 3 +- **Intune changes**: 2 + +--- + +## Commit Inventory + +### 1. `c8419545` — Merge pull request #85 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `c84195451eeb8c3a5033fe9b13a0cc238f2d657f` | +| Author | Integrated Solutions | +| Date | 2026-03-10 09:02:26 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 2. `b0e1f0c9` — Merge pull request #89 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `b0e1f0c9bf991e7abb6a40b3d3ead2e33be1c97e` | +| Author | Integrated Solutions | +| Date | 2026-03-20 09:47:35 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 3. `2b441244` — feat: Add Levenshtein distance function and tests + +| Field | Value | +|-------|-------| +| SHA | `2b4412449f1905c0bd8d5f89e93dcdeaac736d39` | +| Author | Kristian Kjærgård | +| Date | 2026-03-20 14:00:40 +0100 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Private/Get-CIPPLevenshteinDistance.ps1`, `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + +--- + +### 4. `54b9af07` — feat: add configurable fuzzy Intune policy matching for standards deployments + +| Field | Value | +|-------|-------| +| SHA | `54b9af07ddd21f9af745dd9fd6480e71cb13c7d5` | +| Author | Bobby | +| Date | 2026-03-20 20:29:47 +0100 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Private/Find-CIPPFuzzyPolicyMatch.ps1`, `Modules/CIPPCore/Public/Set-CIPPIntunePolicy.ps1`, `Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardIntuneTemplate.ps1`, `Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1` + +--- + +### 5. `5ef7bbc0` — Add support for CA template package tags + +| Field | Value | +|-------|-------| +| SHA | `5ef7bbc019961bc9019aa239a0c4f89f31780d50` | +| Author | James Tarran | +| Date | 2026-04-03 09:06:35 +0100 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ExecSetPackageTag.ps1`, `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ListCAtemplates.ps1`, `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1`, `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1`, `Modules/CIPPCore/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1` + +--- + +### 6. `5d43bea7` — Use template displayName for labels + +| Field | Value | +|-------|-------| +| SHA | `5d43bea7d24ba8832650aff443743526d2796357` | +| Author | James Tarran | +| Date | 2026-04-03 16:41:22 +0100 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1` + +--- + +### 7. `131a95ac` — Merge pull request #93 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `131a95ac9ce54fc37123dccf8efa810ed5ed09e3` | +| Author | Integrated Solutions | +| Date | 2026-04-15 14:38:50 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 8. `7c524eda` — Merge remote-tracking branch 'upstream/dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `7c524edaefaedb5946e23cd2d2d80e2ffc716fa3` | +| Author | Bobby | +| Date | 2026-04-16 12:35:06 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 9. `133f9295` — test: fix helper paths after tools folder move + +| Field | Value | +|-------|-------| +| SHA | `133f929555f5d26a17757802d22ceaa8b3f6b926` | +| Author | Bobby | +| Date | 2026-04-16 12:38:41 +0200 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Tests/Private/Find-CIPPFuzzyPolicyMatch.Tests.ps1`, `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` + +--- + +### 10. `631cb269` — Merge pull request #44 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `631cb2690239d9823abc996a5864ad8837facdb7` | +| Author | pull[bot] | +| Date | 2026-04-20 17:36:34 +0000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 11. `6c1da764` — Merge pull request #45 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `6c1da7642d064ea5e6fc6e0bc24c15d59285c246` | +| Author | pull[bot] | +| Date | 2026-04-21 05:36:29 +0000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 12. `1dd59c5c` — Merge pull request #46 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `1dd59c5cc0be2e5a76e5afd638b6102d7f9d674d` | +| Author | pull[bot] | +| Date | 2026-04-21 11:36:33 +0000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 13. `886e9b33` — Merge branch 'dev' into Feat-Conditional-access-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `886e9b331531cf255b7d0ee0f22175121331e9a6` | +| Author | James Tarran | +| Date | 2026-04-22 08:44:29 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 14. `e210c484` — Merge branch 'dev' into Feat-Conditional-access-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `e210c484d0788780e07a9c5fac00256e382a8a9e` | +| Author | James Tarran | +| Date | 2026-04-22 08:47:13 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 15. `2a2772b4` — feat: add allTenants support for multiple intune pages + +| Field | Value | +|-------|-------| +| SHA | `2a2772b424c958f2fab0d4fd6131c8e5e31f3203` | +| Author | Bobby | +| Date | 2026-04-25 01:32:32 +0200 | +| Files changed | 20 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPAssignmentFilterReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneAppProtectionPolicyReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneApplicationReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneCompliancePolicyReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneReusableSettingsReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntuneScriptReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPManagedDevicesReport.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneApplications.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAssignmentFilters.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneCompliancePolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneReusableSettings.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneScripts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1` … (+5 more) + +--- + +### 16. `7e9f7192` — feat: Add allTenants support for all the Teams SharePoint pages + +| Field | Value | +|-------|-------| +| SHA | `7e9f7192d35568af060d0152e77458ea58930bcf` | +| Author | Bobby | +| Date | 2026-04-26 19:13:53 +0200 | +| Files changed | 16 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1`, `Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPTeamsActivityReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPTeamsReport.ps1`, `Modules/CIPPCore/Public/Get-CIPPTeamsVoiceReport.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSites.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheTeams.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheTeamsActivity.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheTeamsVoice.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeams.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsActivity.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListTeamsVoice.ps1` … (+1 more) + +--- + +### 17. `29685d69` — feat(api): add license capability presets + +| Field | Value | +|-------|-------| +| SHA | `29685d69b00fcc1cb774ae60600cd7607d2520b1` | +| Author | Bobby | +| Date | 2026-05-04 22:54:54 +0200 | +| Files changed | 138 | +| Risk | **High** | +| Area | Docs | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Permissions/Roles/Auth; Buckets: Documentation-only, Potentially breaking changes | + +**Files:** `.github/agents/CIPP-Alert-Agent.md`, `.github/agents/CIPP-Standards-Agent.md`, `.github/instructions/alerts.instructions.md`, `.github/instructions/cippdb.instructions.md`, `.github/instructions/standards.instructions.md`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertIntunePolicyConflicts.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1`, `Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1`, `Modules/CIPPCore/Public/Test-CIPPAccessTenant.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDlpCompliancePolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntunePolicies.ps1` … (+123 more) + +--- + +### 18. `daa8d242` — Merge pull request #95 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `daa8d2424300e2cacbb4a8ca22fd34dbebe43641` | +| Author | Integrated Solutions | +| Date | 2026-05-05 14:39:04 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 19. `106f7463` — Add AAD Premium license gate to ExternalMFATrusted standard + +| Field | Value | +|-------|-------| +| SHA | `106f7463478cab7e254eef55fd686badecdbf40b` | +| Author | Brian Simpson | +| Date | 2026-05-08 12:53:49 -0500 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1` + +--- + +### 20. `b8b26a27` — Update standards docs URLs to alignment/templates path + +| Field | Value | +|-------|-------| +| SHA | `b8b26a2768a4eba69a7e8ccb69664e8292de3c5a` | +| Author | Brian Simpson | +| Date | 2026-05-03 11:34:58 -0500 | +| Files changed | 182 | +| Risk | **High** | +| Area | Docs | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Permissions/Roles/Auth; Buckets: Documentation-only, Potentially breaking changes | + +**Files:** `.github/instructions/standards.instructions.md`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardActivityBasedTimeout.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDKIM.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAddDMARCToMOERA.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAdminSSPR.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAnonReportDisable.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiPhishPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAntiSpamSafeList.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppDeploy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAppManagementPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAssignmentFilterTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuditLog.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsPolicyMigration.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthMethodsSettings.ps1` … (+167 more) + +--- + +### 21. `9683b790` — Fix standards run errors for Retention and MDO standards + +| Field | Value | +|-------|-------| +| SHA | `9683b79002ef95d7b070e5729f8edeee6098475b` | +| Author | Brian Simpson | +| Date | 2026-05-03 11:35:26 -0500 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionPolicyTag.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1` + +--- + +### 22. `07f29839` — purview adding + +| Field | Value | +|-------|-------| +| SHA | `07f2983924a0075e46abff211b781593d9b7c6cf` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:26:02 +0200 | +| Files changed | 13 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoType.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabel.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 23. `b7f32e7a` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `b7f32e7ae720b8c4e7ab1be0ff060d6ab7ca86cf` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:26:06 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 24. `a187a17a` — set warn to true. + +| Field | Value | +|-------|-------| +| SHA | `a187a17a3ac8670df9d4d6ad7b722024834e818e` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 13:50:19 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 25. `96727eb4` — fixes to purview setup + +| Field | Value | +|-------|-------| +| SHA | `96727eb4922a5eb3277b44a81b3f8f57a52fbaa3` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 14:49:13 +0200 | +| Files changed | 14 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPCore/Public/Format-CIPPCompliancePolicyParams.ps1`, `Modules/CIPPCore/Public/New-CIPPSitRulePackXml.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoType.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabel.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabelTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 26. `ec7f5649` — Single deployment from function now that its all rigged up + +| Field | Value | +|-------|-------| +| SHA | `ec7f5649f70b0df55c21da4580b23aa636960719` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 22:12:56 +0200 | +| Files changed | 12 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/ConvertTo-CIPPComplianceSetParams.ps1`, `Modules/CIPPCore/Public/Set-CIPPDlpCompliancePolicy.ps1`, `Modules/CIPPCore/Public/Set-CIPPRetentionCompliancePolicy.ps1`, `Modules/CIPPCore/Public/Set-CIPPSensitiveInfoType.ps1`, `Modules/CIPPCore/Public/Set-CIPPSensitivityLabel.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-DLP/Invoke-AddDlpCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-Retention/Invoke-AddRetentionCompliancePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SIT/Invoke-AddSensitiveInfoType.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Security/Compliance-SensitivityLabel/Invoke-AddSensitivityLabel.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardRetentionCompliancePolicyTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 27. `61c938aa` — standards use function + +| Field | Value | +|-------|-------| +| SHA | `61c938aabf2ddf5d6718647f2ddc721d42ecab61` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 22:14:32 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitiveInfoTypeTemplate.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSensitivityLabelTemplate.ps1` + +--- + +### 28. `be25c764` — Squashed commit of the following: + +| Field | Value | +|-------|-------| +| SHA | `be25c76405478de24fc6018cb187375d9b1ab873` | +| Author | James Tarran | +| Date | 2026-05-11 14:48:10 +0100 | +| Files changed | 903 | +| Risk | **High** | +| Area | Docs | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Tenant Workflows, Permissions/Roles/Auth, Custom API Endpoints, Standards/Alignment Custom; Buckets: Documentation-only, Potentially breaking changes | + +**Files:** `.github/instructions/auth-model.instructions.md`, `.github/instructions/cippdb.instructions.md`, `.github/workflows/PR_Branch_Check.yml`, `.github/workflows/publish_release.yml`, `.github/workflows/upload_dev.yml`, `.gitignore`, `Config/CIPPDBCacheTypes.json`, `Config/CIPPTimers.json`, `Config/CommunityRepos.json`, `Config/SAMManifest.json`, `Config/TemplateEmail.html`, `Config/cipp-roles.json`, `Config/intuneCollection.json`, `Config/standards.json`, `Config/version_latest.txt` … (+888 more) + +--- + +### 29. `6aa66c74` — Custom Test - Alert on X statuses + +| Field | Value | +|-------|-------| +| SHA | `6aa66c744b8c755f48b75044ca5c876e9e2c90e3` | +| Author | Zacgoose | +| Date | 2026-05-11 21:49:47 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1`, `Modules/CIPPTests/Public/Tests/Custom/Invoke-CippTestCustomScripts.ps1` + +--- + +### 30. `dc3f0f45` — Merge branch 'dev' into Feat-Conditional-access-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `dc3f0f458131bfc256b3ab938aeeadc8cf4d4e6f` | +| Author | James Tarran | +| Date | 2026-05-11 14:55:06 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 31. `dad97f7c` — Restore Invoke-AddCustomScript.ps1 + +| Field | Value | +|-------|-------| +| SHA | `dad97f7c19da50facd311f1a225699621010be64` | +| Author | James Tarran | +| Date | 2026-05-11 14:59:06 +0100 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tools/Custom-Scripts/Invoke-AddCustomScript.ps1` + +--- + +### 32. `6a96bab8` — Update Invoke-ListLicenses.ps1 + +| Field | Value | +|-------|-------| +| SHA | `6a96bab87febde97fd8abd188f35cc8850bc6ef7` | +| Author | Zacgoose | +| Date | 2026-05-11 23:14:58 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicenses.ps1` + +--- + +### 33. `f87f7da9` — implemenets #5948 + +| Field | Value | +|-------|-------| +| SHA | `f87f7da97aeb2dc21b45647151fa2d62ca9366de` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:58:56 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1` + +--- + +### 34. `61bac43f` — Greatly speed up listing of intune policies for alltenants + +| Field | Value | +|-------|-------| +| SHA | `61bac43f6551f1af488b8372dffd04718bc39b86` | +| Author | Zacgoose | +| Date | 2026-05-12 02:03:13 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPDbItem.ps1`, `Modules/CIPPCore/Public/Get-CIPPIntunePolicyReport.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecRemoveMailboxRule.ps1` + +--- + +### 35. `377b83e6` — HVE user management and cache + +| Field | Value | +|-------|-------| +| SHA | `377b83e68241023ee4440b0836fdd86600abcf1a` | +| Author | Zacgoose | +| Date | 2026-05-12 02:05:12 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheHVEAccounts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecHVEUser.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1` + +--- + +### 36. `c29746a1` — eclusions everywhere + +| Field | Value | +|-------|-------| +| SHA | `c29746a16c2cf84b7908f94039c70317aaaf1988` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:13:43 +0200 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1`, `Modules/CIPPCore/Public/Set-CIPPAssignedApplication.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddOfficeApp.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ExecAssignApp.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1` + +--- + +### 37. `2753661e` — implements #5986 + +| Field | Value | +|-------|-------| +| SHA | `2753661e99deccb851c92738a9e54b1d416514fe` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:04 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-EditTenantAllowBlockListTemplate.ps1` + +--- + +### 38. `5f3b26e5` — tablecleanup update + +| Field | Value | +|-------|-------| +| SHA | `5f3b26e5a5192fb34757d5518f53a0dc1ff8b450` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:02:00 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +--- + +### 39. `1aa55cff` — fix: intune standard change detection queries + +| Field | Value | +|-------|-------| +| SHA | `1aa55cffb7ad70e9a11a4b2e70f8feeb80e775fe` | +| Author | John Duprey | +| Date | 2026-05-11 15:02:46 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1` + +--- + +### 40. `0c045c72` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `0c045c7272f56be6bb812a38580a521ff8a2696c` | +| Author | John Duprey | +| Date | 2026-05-11 15:02:53 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 41. `ee0b8229` — fix: change cleanup to 30 days + +| Field | Value | +|-------|-------| +| SHA | `ee0b82294a849bf992ec3ff7ce09b517f4e17fba` | +| Author | John Duprey | +| Date | 2026-05-11 15:05:40 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +--- + +### 42. `b6c2a436` — Feat: Add support for AllTenants in Intune pages (#2021) + +| Field | Value | +|-------|-------| +| SHA | `b6c2a4360917ecd1150da3ea9a643749319748ed` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:12:56 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 43. `dd413bfe` — Add AAD Premium license gate to ExternalMFATrusted standard (#2046) + +| Field | Value | +|-------|-------| +| SHA | `dd413bfe119e48b011f65ddcc377e250decd93d4` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:14:06 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 44. `d8be4455` — Merge branch 'dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `d8be4455b25bb488529e62bceee689ff6ea30a58` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:20:31 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 45. `59da6e6b` — Merge branch 'dev' into testlicense-presets + +| Field | Value | +|-------|-------| +| SHA | `59da6e6b312467bce245585d321fd0ce6cc64546` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:21:21 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** (none) + +--- + +### 46. `fdf313e5` — fix: remove partitionkey + +| Field | Value | +|-------|-------| +| SHA | `fdf313e5cfb08b2da7bba256201daf2de9ba15ff` | +| Author | John Duprey | +| Date | 2026-05-11 15:23:32 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-TableCleanup.ps1` + +--- + +### 47. `b0232eca` — Feat conditional access policy package tags (#1979) + +| Field | Value | +|-------|-------| +| SHA | `b0232eca376e913a1c8705a6a53cccb4b4fa20a4` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:28:49 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 48. `75699ff1` — feat: Add fuzzy matching for Intune policies using Levenshtein distance (#1945) + +| Field | Value | +|-------|-------| +| SHA | `75699ff1b967bd314ed0e9c06cf219ebcbb19dcc` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:33:25 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 49. `d996babb` — Merge branch 'dev' of https://github.com/kris6673/CIPP-API into alltenants-SP + +| Field | Value | +|-------|-------| +| SHA | `d996babb5590423e7b48116a809df541ee6ec01e` | +| Author | Bobby | +| Date | 2026-05-11 21:26:15 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 50. `ddf0a4c6` — feat: Add allTenants support for Teams SharePoint pages (#2022) + +| Field | Value | +|-------|-------| +| SHA | `ddf0a4c628b9172be770066bfe3d0a9d0e5afe76` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:37:30 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 51. `0c633110` — fix: fix my cleanup mistake + +| Field | Value | +|-------|-------| +| SHA | `0c6331101751d4d598a6796c58b32743c77fff29` | +| Author | Bobby | +| Date | 2026-05-11 21:46:45 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPSitesReport.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSites.ps1` + +--- + +### 52. `affac9d0` — Fix/standards run errors (#2037) + +| Field | Value | +|-------|-------| +| SHA | `affac9d0978c5e30b3da8b6b852fcf1d1f23b5bd` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:47:38 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 53. `12bb4f69` — Fix: Fix cleanup mistake in caching functions (#2048) + +| Field | Value | +|-------|-------| +| SHA | `12bb4f69566a2a81aeddafcaffdbf02eec0b5cee` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:48:16 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 54. `5995ad77` — Merge branch 'dev' into testlicense-presets + +| Field | Value | +|-------|-------| +| SHA | `5995ad7778c9e0f6a4e9e350302b06f6306aa1b9` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:51:47 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** (none) + +--- + +### 55. `21526416` — fix: add the presets to the rest of the standards + +| Field | Value | +|-------|-------| +| SHA | `2152641640709ecfe211f3c38752edad0d3f5f13` | +| Author | Bobby | +| Date | 2026-05-11 22:01:50 +0200 | +| Files changed | 11 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAppProtectionPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneApplications.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneAssignmentFilters.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneCompliancePolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneReusableSettings.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheIntuneScripts.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutoAddProxy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmptyFilterIPAllowList.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnforcePrivateGroups.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardExternalMFATrusted.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTeamsZAP.ps1` + +--- + +### 56. `bc4abb53` — feat: add DefenderForOffice365 preset to license tests + +| Field | Value | +|-------|-------| +| SHA | `bc4abb53441d530ef84896da8f2a8414b744840c` | +| Author | Bobby | +| Date | 2026-05-11 22:23:28 +0200 | +| Files changed | 6 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Functions/Test-CIPPStandardLicense.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoPresetSecurityPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAtpPolicyForO365.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeAttachmentPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSafeLinksTemplatePolicy.ps1` + +--- + +### 57. `f5702f41` — feat: Enhance Invoke-ListIntuneTemplates to include usage tracking for standards templates + +| Field | Value | +|-------|-------| +| SHA | `f5702f41f1fa33ab7cfa8be9989c913d88d7d880` | +| Author | John Duprey | +| Date | 2026-05-11 23:57:27 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1` + +--- + +### 58. `ecbc9a50` — fix: Add error handling for missing standard functions in Push-CIPPStandard + +| Field | Value | +|-------|-------| +| SHA | `ecbc9a50ac0584e0d0ce59259214ebe6d9cf525a` | +| Author | John Duprey | +| Date | 2026-05-11 23:58:56 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1` + +--- + +### 59. `57b7de1f` — fix: Rename 'usedInTemplates' property to 'usage' for clarity in Invoke-ListIntuneTemplates + +| Field | Value | +|-------|-------| +| SHA | `57b7de1f31bcffa3ebc3ba1f05d5d47fa1b6bffe` | +| Author | John Duprey | +| Date | 2026-05-12 00:07:30 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneTemplates.ps1` + +--- + +### 60. `7fd7d097` — fixes sharepoint response stuff + +| Field | Value | +|-------|-------| +| SHA | `7fd7d097882ad258695905e15c19addd288d493c` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 14:28:11 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ListSites.ps1` + +--- + +### 61. `23c8994d` — fixes defaultr_hidden vs hidden #5990 + +| Field | Value | +|-------|-------| +| SHA | `23c8994da9a523a6fbce594181f0c74e5fb1a69e` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 14:33:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1` + +--- + +### 62. `ad0d096c` — OneDrive Sharing disable + +| Field | Value | +|-------|-------| +| SHA | `ad0d096c727ec2b881f0ea8a4e5ff33a8950f0a8` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:03:49 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Invoke-CIPPOffboardingJob.ps1`, `Modules/CIPPCore/Public/Set-CIPPOneDriveSharing.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecBECRemediate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSetOneDriveSharing.ps1` + +--- + +### 63. `2869564f` — Add AlertUserReportPhising + +| Field | Value | +|-------|-------| +| SHA | `2869564fb904deced3eb5c076f19519db12c3769` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:32:19 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/SAMManifest.json`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` + +--- + +### 64. `ddb498fe` — chore: bump version to 10.4.5 + +| Field | Value | +|-------|-------| +| SHA | `ddb498fe81df0262aa834db9617ed08dad38aeed` | +| Author | John Duprey | +| Date | 2026-05-12 11:32:15 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `host.json`, `version_latest.txt` + +--- + +### 65. `35437558` — Update Viva standard + +| Field | Value | +|-------|-------| +| SHA | `35437558e4699479e303f4245fe14d3e258cdba2` | +| Author | Zacgoose | +| Date | 2026-05-12 23:39:36 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableViva.ps1` + +--- + +### 66. `5f864e3f` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `5f864e3ff517b8e292ce0d7bb7d6080ea297c2cf` | +| Author | Zacgoose | +| Date | 2026-05-12 23:39:38 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 67. `78193020` — fix name + +| Field | Value | +|-------|-------| +| SHA | `781930205c67fc17a5ca887755361987a407012a` | +| Author | John Duprey | +| Date | 2026-05-12 12:20:47 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-OrchestratorBatchItems.ps1` + +--- + +### 68. `785e71c5` — fix user select + +| Field | Value | +|-------|-------| +| SHA | `785e71c530a39b46f56cea7c598f7d609d8a8518` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 18:26:46 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPDefaultAPDeploymentProfile.ps1` + +--- + +### 69. `6a81a086` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `6a81a086d4b109ae6d59dc73b6b47308091e5f64` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 18:26:48 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 70. `2c5d0c9a` — feat: Add license capability presets (#2040) + +| Field | Value | +|-------|-------| +| SHA | `2c5d0c9a9c3df6447e8ae17f17aa929c7457fb82` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 20:24:52 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 71. `2dbc4803` — auth configs + +| Field | Value | +|-------|-------| +| SHA | `2dbc480336773976fb1140194c4c5de348afe170` | +| Author | Zacgoose | +| Date | 2026-05-13 04:19:45 +0800 | +| Files changed | 15 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/FeatureFlags.json`, `Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1`, `Modules/CIPPCore/Public/Authentication/New-CIPPSSOApp.ps1`, `Modules/CIPPCore/Public/Authentication/Remove-CIPPMigrationAppSetting.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1`, `Modules/CIPPCore/Public/Authentication/Update-CIPPSSORedirectUri.ps1`, `Modules/CIPPCore/Public/GraphHelper/Update-AppManagementPolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSSOSetup.ps1` + +--- + +### 72. `3adade45` — Featureflag configs and timer changes + +| Field | Value | +|-------|-------| +| SHA | `3adade45c14529810607f8a251d56a9c2c0ac44b` | +| Author | Zacgoose | +| Date | 2026-05-13 14:21:10 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Config/FeatureFlags.json`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1`, `Modules/CIPPCore/Public/Get-CIPPFeatureFlag.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1` + +--- + +### 73. `93c80812` — skip replacement if not value set for variable + +| Field | Value | +|-------|-------| +| SHA | `93c80812f29762f375ed0ea28b03e59f8d956017` | +| Author | Zacgoose | +| Date | 2026-05-13 15:52:56 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPTextReplacement.ps1` + +--- + +### 74. `2d33e020` — strip return characters + +| Field | Value | +|-------|-------| +| SHA | `2d33e020ee90330209b90a1538b419c3a71ab4c2` | +| Author | Zacgoose | +| Date | 2026-05-13 16:47:18 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPAlertTemplate.ps1` + +--- + +### 75. `d480cf74` — Add Apps and SP to universal search + +| Field | Value | +|-------|-------| +| SHA | `d480cf74f7bea7180136c74d1e351b4b93b7d06a` | +| Author | Zacgoose | +| Date | 2026-05-13 17:06:47 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Search-CIPPDbData.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1` + +--- + +### 76. `9011dd63` — Nice CA policy editor and template creator/editor + +| Field | Value | +|-------|-------| +| SHA | `9011dd63e2a4ac6aef393aab54893b791e06caa0` | +| Author | Zacgoose | +| Date | 2026-05-13 18:53:59 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecCreateCATemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Conditional/Invoke-ExecEditCAPolicyFull.ps1` + +--- + +### 77. `897dfaa4` — fixed #5997 + +| Field | Value | +|-------|-------| +| SHA | `897dfaa4f07443e0f05f8f2aefa5b0a92fc91a9c` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:18:48 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1` + +--- + +### 78. `b1363008` — #5997 + +| Field | Value | +|-------|-------| +| SHA | `b1363008db683132524711ec2932afe9a12f0342` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:19:03 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1` + +--- + +### 79. `e060fa22` — implements #5981 + +| Field | Value | +|-------|-------| +| SHA | `e060fa22b10156d59bed43c7b22f965a768379e5` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:47:17 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1`, `Modules/CIPPCore/Public/New-CIPPCATemplate.ps1` + +--- + +### 80. `f5f7ae70` — fixes duplicate test calls in some cases + +| Field | Value | +|-------|-------| +| SHA | `f5f7ae7064404c314d6cd5694ee1260d1e543c0f` | +| Author | Zacgoose | +| Date | 2026-05-14 15:09:35 +1000 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPAzDataTableEntity.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1` + +--- + +### 81. `c097631e` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `c097631e9c9a30468a858e222256894c9a95122c` | +| Author | Zacgoose | +| Date | 2026-05-14 15:09:50 +1000 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 82. `b4a52152` — Fix tenant group scope cache + +| Field | Value | +|-------|-------| +| SHA | `b4a5215251751201733eb04fda5a464e462b88d8` | +| Author | Zacgoose | +| Date | 2026-05-14 15:37:16 +1000 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/FeatureFlags.json`, `Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1` + +--- + +### 83. `dbd7fcb3` — logging improvements + +| Field | Value | +|-------|-------| +| SHA | `dbd7fcb3486342ae02f5cc914343052a7bdec645` | +| Author | Zacgoose | +| Date | 2026-05-14 18:09:21 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1` + +--- + +### 84. `bc7de0c1` — when running a standard manually still process all standards for precedence overrides + +| Field | Value | +|-------|-------| +| SHA | `bc7de0c1a41134baa87c8d45ee2f13fb8d96b979` | +| Author | Zacgoose | +| Date | 2026-05-14 18:09:59 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1` + +--- + +### 85. `ee0398db` — feat(endpoint): add Apple ADE and Android enrollment profile listing and deletion endpoints + +| Field | Value | +|-------|-------| +| SHA | `ee0398db8fb1dc0f3e068d57044486d90b03c992` | +| Author | Bobby | +| Date | 2026-05-14 11:28:32 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ExecRemoveEnrollmentProfile.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1`, `cspell.json` + +--- + +### 86. `5ccf15a9` — fix: missing odata path error in the returned json + +| Field | Value | +|-------|-------| +| SHA | `5ccf15a9197c67cb8fdde40606dd7b26a476ae1a` | +| Author | Bobby | +| Date | 2026-05-14 20:23:40 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1` + +--- + +### 87. `5901014f` — Merge pull request #100 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `5901014f4622cc7a47a923716a2974df1f8e0923` | +| Author | Integrated Solutions | +| Date | 2026-05-15 11:39:46 +1000 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 88. `5289a309` — feat: ability to add/remove nested groups in group memberships + +| Field | Value | +|-------|-------| +| SHA | `5289a3092d34df70035ab12a2cc70daabeb2e77f` | +| Author | Integrated Solutions | +| Date | 2026-05-15 15:57:00 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListUsersAndGroups.ps1` + +--- + +### 89. `7ae35c2b` — post exec tweaks for dedupe queue names + +| Field | Value | +|-------|-------| +| SHA | `7ae35c2bd5c8f11169722651e69c18224dc8fde8` | +| Author | Zacgoose | +| Date | 2026-05-15 02:28:44 -0500 | +| Files changed | 6 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Config/FeatureFlags.json`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheApplyBatch.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsApplyBatch.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1` + +--- + +### 90. `fd6e30f6` — fix(standards): target azureADRegistration in intuneRestrictUserDeviceRegistration + +| Field | Value | +|-------|-------| +| SHA | `fd6e30f62fb209f2b706b359bd1b91f5ef368081` | +| Author | Bobby | +| Date | 2026-05-15 20:29:45 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceRegistration.ps1` + +--- + +### 91. `c67bc8dd` — feat(standards): add intuneRestrictUserDeviceJoin standard + +| Field | Value | +|-------|-------| +| SHA | `c67bc8dd9b892ebfaeaf80a9037941d46d53d745` | +| Author | Bobby | +| Date | 2026-05-15 20:29:46 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardintuneRestrictUserDeviceJoin.ps1` + +--- + +### 92. `90b6457d` — Add AutoExpandingArchiveScope property showing org-level vs mailbox-level enablement + +| Field | Value | +|-------|-------| +| SHA | `90b6457d590ea6f6b96c62e8e0315ccd1f56f640` | +| Author | Zacgoose | +| Date | 2026-05-18 07:16:57 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1` + +--- + +### 93. `ab83a2bb` — Update Update-CIPPSAMRedirectUri.ps1 + +| Field | Value | +|-------|-------| +| SHA | `ab83a2bb5dbcfba32770827466b17a882398898d` | +| Author | Zacgoose | +| Date | 2026-05-18 07:56:08 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Update-CIPPSAMRedirectUri.ps1` + +--- + +### 94. `d7cda8a3` — Update Initialize-CIPPAuth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `d7cda8a309a9c133e98de54257482bb4ef399abc` | +| Author | Zacgoose | +| Date | 2026-05-18 07:57:41 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1` + +--- + +### 95. `ab5e5155` — Switch to app auth for authentication changes standard + +| Field | Value | +|-------|-------| +| SHA | `ab5e5155681acb8e14994a80fd287a17f1aa3544` | +| Author | Zacgoose | +| Date | 2026-05-18 09:24:48 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPWdisplayAppInformationRequiredState.ps1` + +--- + +### 96. `1b1ee689` — cache PowerShell enabled status and use cached data for standard + +| Field | Value | +|-------|-------| +| SHA | `1b1ee689e9442896d9767f1cba736d6aa8b5d56f` | +| Author | Zacgoose | +| Date | 2026-05-19 07:20:16 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableExchangeOnlinePowerShell.ps1` + +--- + +### 97. `6b8ebd48` — refactor calls to use new onepass method to store DB data + +| Field | Value | +|-------|-------| +| SHA | `6b8ebd4814625fa4902844dca619cb6deb1720eb` | +| Author | Zacgoose | +| Date | 2026-05-19 07:40:37 -0400 | +| Files changed | 86 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Tenant Workflows, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAdminConsentRequestPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAppRoleAssignments.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheApps.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAuthenticationFlowsPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAuthenticationMethodsPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheAuthorizationPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheB2BManagementPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheBitlockerKeys.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotReadinessActivity.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUsageUserDetail.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUserCountSummary.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCopilotUserCountTrend.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCredentialUserRegistrationDetails.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheCrossTenantAccessPolicy.ps1` … (+71 more) + +--- + +### 98. `e3e82cd9` — Cache Security Defaults + +| Field | Value | +|-------|-------| +| SHA | `e3e82cd95b9597706f1edc3ccde5776695abe820` | +| Author | Zacgoose | +| Date | 2026-05-19 07:51:16 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPCAPolicy.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheConditionalAccessPolicies.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1` + +--- + +### 99. `9ba48711` — correct incorrect default value + +| Field | Value | +|-------|-------| +| SHA | `9ba48711c614be8e2452ffff2e539b5b1a11b534` | +| Author | Zacgoose | +| Date | 2026-05-19 10:01:24 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneComplianceSettings.ps1` + +--- + +### 100. `73f83719` — add logging to geoip lookip + +| Field | Value | +|-------|-------| +| SHA | `73f83719d8d6123db9e450248f55dc97acfdc0ea` | +| Author | Zacgoose | +| Date | 2026-05-19 10:01:41 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1` + +--- + +### 101. `9fce7e77` — feat: add in missing options for Windows Hello standard + +| Field | Value | +|-------|-------| +| SHA | `9fce7e77b7d7cf29692fa3aa869a373e076f7658` | +| Author | Bobby | +| Date | 2026-05-20 22:10:20 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnrollmentWindowsHelloForBusinessConfiguration.ps1` + +--- + +### 102. `1e02bfcb` — feat(standards): add DLP via DCS standard + +| Field | Value | +|-------|-------| +| SHA | `1e02bfcb198406e9caa408acad12d79c7646ce6f` | +| Author | Bobby | +| Date | 2026-05-20 23:42:04 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDlpViaDcsEnabled.ps1` + +--- + +### 103. `cfa144d6` — Update Invoke-ListWorkerHealth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `cfa144d6b00b6641720c18bde34537227965a7fd` | +| Author | Zacgoose | +| Date | 2026-05-22 12:51:10 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1` + +--- + +### 104. `a89c2b93` — Add Group-Based Licensing support + +| Field | Value | +|-------|-------| +| SHA | `a89c2b9333ba7a1bca50fda53145894835de8f80` | +| Author | Luis Mengel | +| Date | 2026-05-23 15:20:47 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPGroup.ps1`, `Modules/CIPPCore/Public/Remove-CIPPGroup.ps1`, `Modules/CIPPCore/Public/Set-CIPPGroupLicense.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-AddGroupTemplate.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-EditGroup.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroupTemplates.ps1` + +--- + +### 105. `bb2ebc6a` — fix: Add missing options for Windows Hello standard (#2061) + +| Field | Value | +|-------|-------| +| SHA | `bb2ebc6a76533e893d88fd024b7f73529cc764a0` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:41:12 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 106. `7fbb8edf` — Feat: Split Intune device join and registration standards (#2057) + +| Field | Value | +|-------|-------| +| SHA | `7fbb8edfed242ac6c80d7e684102df20bc6bce02` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:42:43 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** (none) + +--- + +### 107. `77a4be64` — fixes #6027 + +| Field | Value | +|-------|-------| +| SHA | `77a4be6499e8e93d41a932983f03799275071893` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 18:10:15 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1` + +--- + +### 108. `4ab85c75` — CIPP Hosted Notices + +| Field | Value | +|-------|-------| +| SHA | `4ab85c751fe6aad0c93d41ce43eb1e7755ae12c4` | +| Author | Zacgoose | +| Date | 2026-05-24 09:13:56 +1000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1` + +--- + +### 109. `dcf382aa` — Update Build-DevApiModules.ps1 + +| Field | Value | +|-------|-------| +| SHA | `dcf382aaa03539256b17454a49371ac7fda6485e` | +| Author | Zacgoose | +| Date | 2026-05-24 09:33:25 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1` + +--- + +### 110. `9bb2f6bc` — Update Build-DevApiModules.ps1 + +| Field | Value | +|-------|-------| +| SHA | `9bb2f6bc962c1fbb89801b6e50295407672ca829` | +| Author | Zacgoose | +| Date | 2026-05-24 09:38:26 +1000 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1` + +--- + +### 111. `fa5f4de6` — remove sso setup from featureflag + +| Field | Value | +|-------|-------| +| SHA | `fa5f4de6f54e7efc2473687e705d5b6caf20b1aa` | +| Author | John Duprey | +| Date | 2026-05-24 14:46:53 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Settings | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `Config/FeatureFlags.json` + +--- + +### 112. `df847779` — implement standards template deployment for intune apps + +| Field | Value | +|-------|-------| +| SHA | `df8477792bb4970416689b732c43a95e3537be7b` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 22:41:08 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Applications/Push-UploadApplication.ps1`, `Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardIntuneAppTemplateDeploy.ps1` + +--- + +### 113. `08ab039c` — add filtering + +| Field | Value | +|-------|-------| +| SHA | `08ab039ccdaa149d3c0698d1dba627acd668ee58` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:22:59 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1` + +--- + +### 114. `c81b6a5c` — add filtering + +| Field | Value | +|-------|-------| +| SHA | `c81b6a5c57a49d9dfec2728706fb7cc2098d5dfa` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:23:02 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppCertificateExpiry.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAppSecretExpiry.ps1` + +--- + +### 115. `33512c39` — FIDO2 profile standards + +| Field | Value | +|-------|-------| +| SHA | `33512c39360bd618749adf423d132b764e62db1f` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:34:04 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardFIDO2PasskeyProfiles.ps1` + +--- + +### 116. `03abdad4` — add global var showing + +| Field | Value | +|-------|-------| +| SHA | `03abdad414c58c3a3502068465c1ff6441fcc140` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:58:21 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCippReplacemap.ps1` + +--- + +### 117. `f09ce56a` — Update New-TeamsRequest.ps1 + +| Field | Value | +|-------|-------| +| SHA | `f09ce56acc6efba45ee1cb0b9dcbcf43c1224ac5` | +| Author | Zacgoose | +| Date | 2026-05-25 11:58:16 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/GraphHelper/New-TeamsRequest.ps1` + +--- + +### 118. `a0dab59a` — domain fixes + +| Field | Value | +|-------|-------| +| SHA | `a0dab59a9091949721e42bd2f4c8cf78acc927cc` | +| Author | Zacgoose | +| Date | 2026-05-25 14:35:20 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-DomainAnalyserTenant.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Domain Analyser/Push-GetTenantDomains.ps1` + +--- + +### 119. `08b972cc` — timezone changes + +| Field | Value | +|-------|-------| +| SHA | `08b972ccac96794551db5c6dca9c2135914144e3` | +| Author | Zacgoose | +| Date | 2026-05-25 15:33:49 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPTimezone.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTimeSettings.ps1` + +--- + +### 120. `d854e22d` — feat: add function to remove users from admin roles + +| Field | Value | +|-------|-------| +| SHA | `d854e22d853449c8f45b44ed31c5e385508aba55` | +| Author | Bobby | +| Date | 2026-05-25 11:49:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ExecRemoveAdminRole.ps1` + +--- + +### 121. `cb31997c` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `cb31997c9c07694c84a072d49b6910db20e80c07` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 12:24:15 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 122. `46015ce7` — Add APv2 profile + +| Field | Value | +|-------|-------| +| SHA | `46015ce7394fb954d357f8ebf26ef77a827626ad` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:29:29 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDevicePrepProfile.ps1` + +--- + +### 123. `05ce60f3` — Feat: Add function to remove users from admin roles (#2064) + +| Field | Value | +|-------|-------| +| SHA | `05ce60f365de65170d3aa37ca2287b94678361b5` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:31:38 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 124. `a7e30d7a` — feat: Add DLP via DCS standard (#2062) + +| Field | Value | +|-------|-------| +| SHA | `a7e30d7a7f63662b40e3daad87d6de971fc7fbfc` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:32:45 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 125. `4214bc7d` — Fix: Fix missing OData path error in JSON response (#2054) + +| Field | Value | +|-------|-------| +| SHA | `4214bc7de39c563d0979b2717239e9acda4752e7` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:34:33 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 126. `a7b7d4da` — feat: Add Apple ADE and Android enrollment profile endpoints (#2053) + +| Field | Value | +|-------|-------| +| SHA | `a7b7d4daeca7b247fa017d722b29e019f0d8f885` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:35:47 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** (none) + +--- + +### 127. `443e16a3` — feat: ability to add/remove nested groups in group memberships (#2056) + +| Field | Value | +|-------|-------| +| SHA | `443e16a34e7b0c72cc513000b69b852987b8fe04` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 22:43:43 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 128. `71afcdd2` — ExoTransportConfig cache type - fix for missing data used in test suites + +| Field | Value | +|-------|-------| +| SHA | `71afcdd2be483a31473fcadaf239888671548787` | +| Author | Zacgoose | +| Date | 2026-05-26 11:54:49 +0800 | +| Files changed | 6 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoTransportConfig.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableBasicAuthSMTP.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardMessageExpiration.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_6_5_4.ps1` + +--- + +### 129. `1e63ebf0` — Update Invoke-CIPPStandardsharingDomainRestriction.ps1 + +| Field | Value | +|-------|-------| +| SHA | `1e63ebf0fc6b61a4873d4eb2f4f1b389f034676a` | +| Author | Zacgoose | +| Date | 2026-05-26 15:09:22 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardsharingDomainRestriction.ps1` + +--- + +### 130. `59a0e15d` — update application content type handling + +| Field | Value | +|-------|-------| +| SHA | `59a0e15d1c11b1c8c33e0d04f3f6cd9dd96e23b0` | +| Author | Zacgoose | +| Date | 2026-05-26 15:12:33 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Shared/CIPPSharp/CIPPRestClient.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 131. `e6b800b1` — remove rerun from alert + +| Field | Value | +|-------|-------| +| SHA | `e6b800b1c93bd1236bef7c6aacd194f4de8289f7` | +| Author | Zacgoose | +| Date | 2026-05-26 15:34:21 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuarantineReleaseRequests.ps1` + +--- + +### 132. `97dc672c` — user sync + +| Field | Value | +|-------|-------| +| SHA | `97dc672c748a5152c5a7438588f6ab6847b4ac26` | +| Author | Zacgoose | +| Date | 2026-05-26 23:33:37 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-UserSyncTimer.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCIPPUsers.ps1` + +--- + +### 133. `359633a4` — fix: ensure tenant groups skips cache so they dont alternate anymore when refreshed + +| Field | Value | +|-------|-------| +| SHA | `359633a42f5c208fd3b7e85f5903833e96e9c1c4` | +| Author | Bobby | +| Date | 2026-05-26 17:58:54 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Tenant/Invoke-ListTenantDetails.ps1` + +--- + +### 134. `49d629e5` — Update Get-CippApiAuth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `49d629e51778c237f1e5fb4580493e32eb93937c` | +| Author | Zacgoose | +| Date | 2026-05-27 00:31:43 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1` + +--- + +### 135. `22902b0b` — api fixes + +| Field | Value | +|-------|-------| +| SHA | `22902b0b81b33f8785715fd37ad176e60afade3b` | +| Author | Zacgoose | +| Date | 2026-05-27 01:51:03 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/New-CIPPAPIConfig.ps1`, `Modules/CIPPCore/Public/Authentication/Repair-CippApiIdentifierUri.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 136. `5561a5b1` — Fix: tenant groups cache issue (#2065) + +| Field | Value | +|-------|-------| +| SHA | `5561a5b1363311d67761ec65644a23476d5ceb41` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 01:09:31 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 137. `95d48d1f` — Fix for desktop activations copilot ready test + +| Field | Value | +|-------|-------| +| SHA | `95d48d1fe90a2e57c7459afa1330290ef659ff02` | +| Author | Zacgoose | +| Date | 2026-05-27 13:58:17 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady003.ps1` + +--- + +### 138. `a6fdfe23` — Make all tenants list for SPO sites fast + +| Field | Value | +|-------|-------| +| SHA | `a6fdfe23eb387354bb0c1bd461e8d807e06dcee5` | +| Author | Zacgoose | +| Date | 2026-05-27 13:59:27 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPSharePointSiteUsageReport.ps1` + +--- + +### 139. `122aec8f` — fix for template id casing + +| Field | Value | +|-------|-------| +| SHA | `122aec8f757ac9e96e515b19cd5965c7d8f3e5d3` | +| Author | Zacgoose | +| Date | 2026-05-27 15:00:16 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ExecStandardsRun.ps1` + +--- + +### 140. `7d3b480e` — Update Invoke-CIPPStandardDefenderCompliancePolicy.ps1 + +| Field | Value | +|-------|-------| +| SHA | `7d3b480edb21d46cea9ae0d21196eab2c670b358` | +| Author | Zacgoose | +| Date | 2026-05-27 16:29:11 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDefenderCompliancePolicy.ps1` + +--- + +### 141. `49153019` — use top 500 to minimise requests + +| Field | Value | +|-------|-------| +| SHA | `491530194c73d6fea5256666d3b46a93ce83a74c` | +| Author | Zacgoose | +| Date | 2026-05-27 16:41:48 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertNewRiskyUsers.ps1` + +--- + +### 142. `c5b0e592` — smart lockout standard + +| Field | Value | +|-------|-------| +| SHA | `c5b0e59221366cb68a8233590fbc38ee3e5321c6` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 14:23:59 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1` + +--- + +### 143. `c5a8a207` — smart lockout standard + +| Field | Value | +|-------|-------| +| SHA | `c5a8a20739f1cc1265dbb6f0d8cf399e63df51b4` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 14:24:02 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSmartLockout.ps1` + +--- + +### 144. `f85963b7` — Sharepoint management functionality. + +| Field | Value | +|-------|-------| +| SHA | `f85963b72168e37d8820de7a7f469240dc968fd0` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 17:03:21 +0200 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPSPOSite.ps1`, `Modules/CIPPCore/Public/Set-CIPPSPOSite.ps1`, `Modules/CIPPCore/Public/Set-CIPPSPOTenant.ps1`, `Modules/CIPPCore/Public/Start-CIPPSiteVersionCleanup.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 145. `b7d4f5e2` — Sharepoint management functionality. + +| Field | Value | +|-------|-------| +| SHA | `b7d4f5e2ca653947ec0ffb8f6403f1ba7407eb6b` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 17:03:26 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 146. `b7c72180` — fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" + +| Field | Value | +|-------|-------| +| SHA | `b7c72180ac5963a3c41211bc2a14e1a9a6bce796` | +| Author | Bobby | +| Date | 2026-05-27 17:11:35 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/standards.json`, `Modules/CIPPCore/Public/New-CIPPTAP.ps1` + +--- + +### 147. `8a536fe8` — Fix: Update terminology from "Temporary Access Password" to "Temporary Access Pass" (#2066) + +| Field | Value | +|-------|-------| +| SHA | `8a536fe8b906400e6401947c94aeff40c5884dd6` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 18:56:01 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 148. `bdd86024` — Add version cleanup + +| Field | Value | +|-------|-------| +| SHA | `bdd86024c2b7de08eacc764076ef13b66b87fcca` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:44 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Teams-Sharepoint/Invoke-ExecSPOVersionCleanup.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 149. `e563aea9` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `e563aea970d41ad282f7ef587f849097086b5c89` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:55 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 150. `829ced81` — feat(mailboxes): cache mailbox and archive usage metrics + +| Field | Value | +|-------|-------| +| SHA | `829ced812ed7c07f63842f63eb6d91f84e326594` | +| Author | Bobby | +| Date | 2026-05-27 22:43:03 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheMailboxes.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1` + +--- + +### 151. `0ebb1880` — implement autopatch + +| Field | Value | +|-------|-------| +| SHA | `0ebb18803a9580b06c7bfedd4b07103e2ab2da41` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 23:50:41 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAutopatchGroup.ps1` + +--- + +### 152. `e41d5322` — Update Add-CIPPDbItem.ps1 + +| Field | Value | +|-------|-------| +| SHA | `e41d5322c698c331c3740b6d9d8d62ceec818971` | +| Author | Zacgoose | +| Date | 2026-05-28 12:49:03 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPDbItem.ps1` + +--- + +### 153. `5b7c5a96` — Update Invoke-ListWorkerHealth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `5b7c5a964b81876324525794b66387574d583c2b` | +| Author | Zacgoose | +| Date | 2026-05-28 13:56:30 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1` + +--- + +### 154. `aefa69b0` — add compliance admin by default + +| Field | Value | +|-------|-------| +| SHA | `aefa69b052ed5d74d0a965f9918ac358f44a668d` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 12:31:02 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/GraphHelper/Get-NormalizedError.ps1`, `Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1` + +--- + +### 155. `25fcdc1c` — add 404 detection for non-existing roles + +| Field | Value | +|-------|-------| +| SHA | `25fcdc1cf1ba33c650e1030ba0b6aa46e4a743eb` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 13:16:55 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPSAMAdminRoles.ps1` + +--- + +### 156. `25e2b0f2` — tweaks + +| Field | Value | +|-------|-------| +| SHA | `25e2b0f2cfa9f73ab3e61d630574b0fe91ce9498` | +| Author | Zacgoose | +| Date | 2026-05-28 20:50:50 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertAdminPassword.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1` + +--- + +### 157. `99dd88c5` — optimisation + +| Field | Value | +|-------|-------| +| SHA | `99dd88c54197a92ba31c5f03b312c7931bac936b` | +| Author | Zacgoose | +| Date | 2026-05-28 21:00:14 +0800 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/BPA/Push-BPACollectData.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderMalware.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertDefenderStatus.ps1`, `Modules/CIPPCore/Public/Add-CIPPBPAField.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Autopilot/Invoke-AddAPDevice.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardBranding.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardPhishProtection.ps1`, `Modules/CippExtensions/Public/New-CippExtAlert.ps1` + +--- + +### 158. `0cdc2e81` — new auth methods single standard + +| Field | Value | +|-------|-------| +| SHA | `0cdc2e813bf8e713b8f0402f4735ff93b695e6ca` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:15 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Set-CIPPAuthenticationPolicy.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1` + +--- + +### 159. `fc080e4a` — new auth methods single standard + +| Field | Value | +|-------|-------| +| SHA | `fc080e4afdecd4076e5a68fe581c75515ce34f26` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:19 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardAuthenticationMethods.ps1` + +--- + +### 160. `a1179a21` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `a1179a21a4a78cea0e68715ff383095e7e77e1e8` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:20 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 161. `55fea61a` — Feat: Add online archive report functionality for mailboxes (#2067) + +| Field | Value | +|-------|-------| +| SHA | `55fea61a0667b35c9ca1302fb8f609322d9b45e2` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 16:21:11 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 162. `1f9fb1fd` — test invocation optimisations + +| Field | Value | +|-------|-------| +| SHA | `1f9fb1fd96197138746753ebede0ed11c6df92cc` | +| Author | Zacgoose | +| Date | 2026-05-28 23:44:50 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListWorkerHealth.ps1`, `Shared/CIPPSharp/CIPPTestDataCache.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 163. `1ac506d7` — fix: update endpoint roles to use Autopilot.Read + +| Field | Value | +|-------|-------| +| SHA | `1ac506d73e26a4f6f12653ff5cc3b797064b582d` | +| Author | Bobby | +| Date | 2026-05-28 21:23:47 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAndroidEnrollmentProfiles.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppleEnrollmentProfiles.ps1` + +--- + +### 164. `3f03634f` — Update Initialize-CIPPAuth.ps1 + +| Field | Value | +|-------|-------| +| SHA | `3f03634f66cfaf0abd9fce128e5f6e0167d68c8f` | +| Author | Zacgoose | +| Date | 2026-05-29 08:11:21 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1` + +--- + +### 165. `e0f45f20` — Backup excluded tenants config + +| Field | Value | +|-------|-------| +| SHA | `e0f45f2035c77c7b8916a605a8d2e13ccd1c80d9` | +| Author | Zacgoose | +| Date | 2026-05-29 14:41:44 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPBackup.ps1` + +--- + +### 166. `e3d57cf0` — Update Invoke-CIPPStandardDeployCheckChromeExtension.ps1 + +| Field | Value | +|-------|-------| +| SHA | `e3d57cf0ae0ef981173205cf0eaa6d5b26e3f371` | +| Author | Zacgoose | +| Date | 2026-05-29 17:43:32 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployCheckChromeExtension.ps1` + +--- + +### 167. `a17137cb` — chore: remove cipp processor queue + +| Field | Value | +|-------|-------| +| SHA | `a17137cbe0abe8418d43791ed751300b0ed84723` | +| Author | John Duprey | +| Date | 2026-05-29 14:19:45 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPProcessorQueue.ps1` + +--- + +### 168. `0fd3315b` — chore: disable cippcommand action + +| Field | Value | +|-------|-------| +| SHA | `0fd3315b9d405ed4d459ac3c8f740a640fb74099` | +| Author | John Duprey | +| Date | 2026-05-29 14:31:14 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1` + +--- + +### 169. `e98445f2` — chore: sanitize cippid in public webhooks + +| Field | Value | +|-------|-------| +| SHA | `e98445f25614437873439fe27a2b0f0e95d5dc69` | +| Author | John Duprey | +| Date | 2026-05-29 15:07:33 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Alerts/Invoke-PublicWebhooks.ps1` + +--- + +### 170. `38e3ae9e` — chore: block arbitrary cmdlets not in CIPP modules + +| Field | Value | +|-------|-------| +| SHA | `38e3ae9e070ba05968a07647d137efc0ae2491b3` | +| Author | John Duprey | +| Date | 2026-05-29 15:27:21 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1`, `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `Modules/CIPPCore/Public/Tools/Get-CIPPSchedulerBlockedCommands.ps1` + +--- + +### 171. `c18bda87` — fix: optimize checks + +| Field | Value | +|-------|-------| +| SHA | `c18bda8795693324d834f54fe9235959e0e3372f` | +| Author | John Duprey | +| Date | 2026-05-29 15:31:19 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1` + +--- + +### 172. `c69e2ce1` — fix: allow for command without .value + +| Field | Value | +|-------|-------| +| SHA | `c69e2ce19d7c8c0df0cd2c4f2de9db936da5c736` | +| Author | John Duprey | +| Date | 2026-05-29 15:33:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1` + +--- + +### 173. `da7bd8c4` — chore: add devsecrets to restricted tables + +| Field | Value | +|-------|-------| +| SHA | `da7bd8c459ab0e75abbcc9a0be96224848a11284` | +| Author | John Duprey | +| Date | 2026-05-29 15:43:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecRestoreBackup.ps1` + +--- + +### 174. `2ed3f94c` — chore: remove write host + +| Field | Value | +|-------|-------| +| SHA | `2ed3f94c91dcfabbc1dbd773c25120bc712801d7` | +| Author | John Duprey | +| Date | 2026-05-29 15:44:24 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1` + +--- + +### 175. `f5f37368` — Optimize CIPP DB orchestration + +| Field | Value | +|-------|-------| +| SHA | `f5f373681cd6e48c3b27b7140d46115c18f828a7` | +| Author | Zacgoose | +| Date | 2026-05-30 12:18:36 +0800 | +| Files changed | 207 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTestsList.ps1`, `Modules/CIPPCore/Public/Add-CIPPDbItem.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1`, `Modules/CIPPCore/Public/Get-CIPPDbItem.ps1`, `Modules/CIPPCore/Public/Get-CIPPDomainAnalyser.ps1`, `Modules/CIPPCore/Public/Get-CippDbRole.ps1`, `Modules/CIPPCore/Public/Get-CippDbRoleMembers.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1`, `Modules/CIPPCore/Public/New-CIPPDbRequest.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDbCacheTestData.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1` … (+192 more) + +--- + +### 176. `7caadb22` — fixes + +| Field | Value | +|-------|-------| +| SHA | `7caadb22cd4a5525adf2959f158301836e8ba0ce` | +| Author | Zacgoose | +| Date | 2026-05-30 14:42:49 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Shared/CIPPSharp/CIPPSharp.csproj`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 177. `11e613aa` — cleanup + +| Field | Value | +|-------|-------| +| SHA | `11e613aab2d6886caa68e5ceb80f39e0a25293f0` | +| Author | Zacgoose | +| Date | 2026-05-30 15:55:25 +0800 | +| Files changed | 3 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/CIPPDBCache/Push-ExecCIPPDBCache.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Tests/Push-CIPPTest.ps1`, `Modules/CIPPCore/Public/Invoke-CIPPTestCollection.ps1` + +--- + +### 178. `dd8952e4` — reduce memory + +| Field | Value | +|-------|-------| +| SHA | `dd8952e4e9b458a33ba232d09d5103df9267016f` | +| Author | Zacgoose | +| Date | 2026-05-30 18:57:49 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-SchedulerCIPPNotifications.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLogs.ps1` + +--- + +### 179. `518855cc` — test optimisation + +| Field | Value | +|-------|-------| +| SHA | `518855cc2af7527eea203002c643ef0a687caeb0` | +| Author | Zacgoose | +| Date | 2026-05-30 23:27:13 +0800 | +| Files changed | 33 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_5.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_2_1_9.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_4_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_5_2_3_4.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_8_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CISA/Identity/Invoke-CippTestCISAMSEXO111.ps1`, `Modules/CIPPTests/Public/Tests/CopilotReadiness/Identity/Invoke-CippTestCopilotReady015.ps1`, `Modules/CIPPTests/Public/Tests/EIDSCA/Identity/Invoke-CippTestEIDSCAAS04.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest004.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest005.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest006.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest007.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest008.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest011.ps1` … (+18 more) + +--- + +### 180. `999f0283` — Fix TenantAllowBlockListTemplate always reporting non-compliant + +| Field | Value | +|-------|-------| +| SHA | `999f0283f8a7e273cd34c48978b6ff8cefef7ddb` | +| Author | Chris Dewey | +| Date | 2026-05-31 12:20:16 +0100 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardTenantAllowBlockListTemplate.ps1` + +--- + +### 181. `7b341600` — update openapi spec with generated one + +| Field | Value | +|-------|-------| +| SHA | `7b341600ea66916a6393af4882ed9e2e55a58a51` | +| Author | KelvinTegelaar | +| Date | 2026-05-31 22:52:53 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `openapi.json` + +--- + +### 182. `44780652` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `44780652e874f77b413ecbf15053873d1ab66036` | +| Author | KelvinTegelaar | +| Date | 2026-05-31 22:53:22 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 183. `8341f49d` — Test + +| Field | Value | +|-------|-------| +| SHA | `8341f49d863900a36070225eb9c39b0813c91c94` | +| Author | KelvinTegelaar | +| Date | 2026-05-31 23:15:16 +0200 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpSpec.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolList.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Get-CippMcpToolResult.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 184. `26a87b27` — add-member force + +| Field | Value | +|-------|-------| +| SHA | `26a87b279488aa2375d055e1aefbf5c20f33004a` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 00:49:42 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 185. `2a2851b5` — sso auth + +| Field | Value | +|-------|-------| +| SHA | `2a2851b57a7a19f2105f2d892cab3c1b94df953d` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 00:58:30 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1` + +--- + +### 186. `acf4bf33` — Add or update the Azure App Service build and deployment workflow config + +| Field | Value | +|-------|-------| +| SHA | `acf4bf337f4545c5fc5fce2b93c540023c100c91` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 01:05:53 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.github/workflows/dev_cippjta72.yml` + +--- + +### 187. `72f7882f` — fixes another add member + +| Field | Value | +|-------|-------| +| SHA | `72f7882fe5c042f4e05353e8fe27a10c6d4a5456` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 01:16:02 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 188. `fad627f8` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `fad627f85ab6b1b3541c3d0c5de18649c358a7bf` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 01:16:04 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 189. `54a3a082` — api auth save and get changes + +| Field | Value | +|-------|-------| +| SHA | `54a3a0821de35a718357f26c98be908f3bbf1a7b` | +| Author | Zacgoose | +| Date | 2026-06-01 12:39:14 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Get-CippApiAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 190. `c16557ff` — Guarding for cache collection items + +| Field | Value | +|-------|-------| +| SHA | `c16557ff6587406decf70f6d47d7fe3014da473b` | +| Author | Zacgoose | +| Date | 2026-06-01 22:26:01 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheOneDriveUsage.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1` + +--- + +### 191. `4b4a2d1d` — Update Set-CIPPDBCacheSharePointSiteUsage.ps1 + +| Field | Value | +|-------|-------| +| SHA | `4b4a2d1d7e97aa30525e84a11ef3fc8c89d9dae9` | +| Author | Zacgoose | +| Date | 2026-06-01 23:01:23 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSharePointSiteUsage.ps1` + +--- + +### 192. `f3393cb9` — Update Invoke-ExecUniversalSearchV2.ps1 + +| Field | Value | +|-------|-------| +| SHA | `f3393cb9b163ff916b8882dbaaaaf981d3ae80c8` | +| Author | Zacgoose | +| Date | 2026-06-02 00:09:02 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecUniversalSearchV2.ps1` + +--- + +### 193. `9d8f1a0d` — correct incorrect pathing + +| Field | Value | +|-------|-------| +| SHA | `9d8f1a0dafc1dff686e1501e0bdf9e493b3dea3b` | +| Author | Zacgoose | +| Date | 2026-06-02 00:12:25 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPW32ScriptApplication.ps1` + +--- + +### 194. `a40683c5` — fix: access issues related to undefined roles + +| Field | Value | +|-------|-------| +| SHA | `a40683c560c66ebcd4164515fda9bcf68715bc37` | +| Author | John Duprey | +| Date | 2026-06-01 13:51:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 195. `3c19e629` — fix: ip restriction logic + +| Field | Value | +|-------|-------| +| SHA | `3c19e6299a87afa75b05726e2609e9b6da2734d8` | +| Author | John Duprey | +| Date | 2026-06-01 13:59:15 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 196. `648127f7` — fix: role for EditIntunePolicy + +| Field | Value | +|-------|-------| +| SHA | `648127f731f598547988e5dd3c581ae1eef225e1` | +| Author | John Duprey | +| Date | 2026-06-01 14:01:03 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-EditIntunePolicy.ps1` + +--- + +### 197. `679c3905` — fix: validate token exchange url is microsoft + +| Field | Value | +|-------|-------| +| SHA | `679c390558470782a3b6badc7942484049840817` | +| Author | John Duprey | +| Date | 2026-06-01 14:13:52 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecTokenExchange.ps1` + +--- + +### 198. `139b0c60` — fix: sanitize more odata paths for tables + +| Field | Value | +|-------|-------| +| SHA | `139b0c606ac3d6ed23af64001ab25bd4d70c0806` | +| Author | John Duprey | +| Date | 2026-06-01 14:30:43 -0400 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecWebhookSubscriptions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListKnownIPDb.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/GDAP/Invoke-ListGDAPInvite.ps1` + +--- + +### 199. `a9797cd9` — chore: cleanup redundant tenant check in listexorequest + +| Field | Value | +|-------|-------| +| SHA | `a9797cd95bb25a536e1172b3e2595c6fc8c592ea` | +| Author | John Duprey | +| Date | 2026-06-01 14:41:56 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListExoRequest.ps1` + +--- + +### 200. `ac338417` — add featureflag for mcp + +| Field | Value | +|-------|-------| +| SHA | `ac3384171d30463c06baff35679b63d33959585a` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 21:05:23 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Settings | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `Config/FeatureFlags.json` + +--- + +### 201. `468fb307` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `468fb30702f3e6ae2fdd39a751319a4de2648c9f` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 21:05:25 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 202. `235bd855` — fix: validate and sanitize msp/choco app params + +| Field | Value | +|-------|-------| +| SHA | `235bd855f2eb1e041198a767926bd70b5f279849` | +| Author | John Duprey | +| Date | 2026-06-01 15:07:38 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/ConvertTo-CIPPSafePwshArg.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddMSPApp.ps1` + +--- + +### 203. `256e9fc4` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `256e9fc4762663bd50f4eaa886a069ca0c7810c0` | +| Author | John Duprey | +| Date | 2026-06-01 15:16:54 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 204. `0c5d2bb8` — Fix TenantAllowBlockListTemplate always reporting non-compliant (#2069) + +| Field | Value | +|-------|-------| +| SHA | `0c5d2bb8f9b105c933ce717edd2a768c32309749` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 22:51:46 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 205. `55a97db2` — added logging + +| Field | Value | +|-------|-------| +| SHA | `55a97db2c4165b456b2c210d9bf0eff3c5f364bd` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 23:31:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1` + +--- + +### 206. `0c54cd16` — fix: move New-CIPPCoreRequest back to CIPPCore + +| Field | Value | +|-------|-------| +| SHA | `0c54cd16abf70bbebcd5711acf308e66bdfc8847` | +| Author | John Duprey | +| Date | 2026-06-01 18:21:07 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1` + +--- + +### 207. `5a3b4259` — fix: Update endpoint roles to use Autopilot.Read (#2068) + +| Field | Value | +|-------|-------| +| SHA | `5a3b42599f2005ffe20ea5629b7ae7eb35cdbbd1` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:24:06 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 208. `2492ad4f` — customsubject fix + +| Field | Value | +|-------|-------| +| SHA | `2492ad4ffa3c17c8d79a8e8e7b0e09e6e969a0ba` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:44:44 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Webhooks/Invoke-CIPPWebhookProcessing.ps1` + +--- + +### 209. `28752144` — unique + +| Field | Value | +|-------|-------| +| SHA | `287521447902e5611303f14e46045279b0abeca7` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:47:14 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CippExtensions/Public/NinjaOne/Invoke-NinjaOneTenantSync.ps1` + +--- + +### 210. `3f9dbd9f` — new licence report endpoint and revert old endpoint + +| Field | Value | +|-------|-------| +| SHA | `3f9dbd9fcbc26fb671950ba00162f89ebade7472` | +| Author | Zacgoose | +| Date | 2026-06-02 07:30:18 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListLicenses.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListLicensesReport.ps1` + +--- + +### 211. `3f842abc` — fix: explicitly remove tenant from the table instead of using -cleanold + +| Field | Value | +|-------|-------| +| SHA | `3f842abc805d82fcd12f3d526b1dd66fa5cb9764` | +| Author | John Duprey | +| Date | 2026-06-02 10:13:12 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ExecOffboardTenant.ps1` + +--- + +### 212. `55ddb18b` — Update Invoke-ExecTestRun.ps1 + +| Field | Value | +|-------|-------| +| SHA | `55ddb18b23e73d0ed21f12c7ceadb40d87822c7a` | +| Author | Zacgoose | +| Date | 2026-06-03 07:12:50 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ExecTestRun.ps1` + +--- + +### 213. `1167ff5b` — caching bump + +| Field | Value | +|-------|-------| +| SHA | `1167ff5bd293fccad0a5c51919c85449982636fc` | +| Author | Zacgoose | +| Date | 2026-06-03 08:09:45 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Shared/CIPPSharp/CIPPTestDataCache.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 214. `6eeb31b4` — Pluralize standard name and continue on error + +| Field | Value | +|-------|-------| +| SHA | `6eeb31b4661478bf527d3ef1fa3543f99d18f60a` | +| Author | Zacgoose | +| Date | 2026-06-03 12:12:23 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1` + +--- + +### 215. `058da5e0` — rework mail contact standard and lazy load modules when needed + +| Field | Value | +|-------|-------| +| SHA | `058da5e0d615c944b4cc6a11878a1d4602c3397d` | +| Author | Zacgoose | +| Date | 2026-06-03 12:51:53 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDeployContactTemplates.ps1` + +--- + +### 216. `2edc7592` — Handle PendingAcceptance guests and update reporting + +| Field | Value | +|-------|-------| +| SHA | `2edc759287485c1e4cec76e345a04323457a63c3` | +| Author | Zacgoose | +| Date | 2026-06-03 14:11:33 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardDisableGuests.ps1` + +--- + +### 217. `64efbd97` — Apply multiple fixes to the add member to exo groups flow including adding new users with auto retry + +| Field | Value | +|-------|-------| +| SHA | `64efbd97477f8fe0ce907f7534c253d6b7239d01` | +| Author | Zacgoose | +| Date | 2026-06-03 14:38:32 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1`, `Modules/CIPPCore/Public/New-CIPPUserTask.ps1` + +--- + +### 218. `a9be2729` — Update Invoke-CIPPStandardEnableExchangeCloudManagement.ps1 + +| Field | Value | +|-------|-------| +| SHA | `a9be2729d883ffeceb8c6eaf06998fc4e6175c40` | +| Author | Zacgoose | +| Date | 2026-06-03 14:39:44 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEnableExchangeCloudManagement.ps1` + +--- + +### 219. `3e99e667` — add mcp allowed + +| Field | Value | +|-------|-------| +| SHA | `3e99e667d8fe5e6326cc465fa45264df817e5938` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 13:37:04 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Get-CippApiClient.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 220. `a2c2524c` — oauth prm + +| Field | Value | +|-------|-------| +| SHA | `a2c2524c02ad0a6e66440beef1091f7a05714808` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 16:16:02 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 221. `1fc42631` — feat: add Email as alternate login ID standard + +| Field | Value | +|-------|-------| +| SHA | `1fc4263123219960af1ec87558f8cd73b7a62a7f` | +| Author | Bobby | +| Date | 2026-06-03 16:54:13 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardEmailAsAlternateLoginId.ps1` + +--- + +### 222. `5c81043c` — change resource usage to craft well known + +| Field | Value | +|-------|-------| +| SHA | `5c81043c08757d3b340414b9fe2d865c1a1ca612` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 17:41:01 +0200 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `CIPPHttpTrigger/function.json`, `CIPPWellKnown/function.json`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1`, `Modules/CippEntrypoints/CippEntrypoints.psm1`, `host.json` + +--- + +### 223. `6fc7d357` — Revert custom well known + +| Field | Value | +|-------|-------| +| SHA | `6fc7d357ee34ea694b96028815d2f9eacfc715e5` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 18:18:49 +0200 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `CIPPHttpTrigger/function.json`, `CIPPWellKnown/function.json`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOEasyAuth.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1`, `Modules/CippEntrypoints/CippEntrypoints.psm1`, `host.json` + +--- + +### 224. `0cd6f9d2` — MCP client updates to support client auth + +| Field | Value | +|-------|-------| +| SHA | `0cd6f9d2d630e1c9561103fa4f3c1fefa95d33a5` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 19:25:55 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 225. `ec2eb836` — add logging to mcp reation. + +| Field | Value | +|-------|-------| +| SHA | `ec2eb836f775584f85f06de10d8ad53d59e07334` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 20:05:50 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecApiClient.ps1` + +--- + +### 226. `49e8af8b` — feat: add Invoke-ExecSetCASMailbox function for CAS settings management + +| Field | Value | +|-------|-------| +| SHA | `49e8af8b9d9b867c9a44f12bfc536c02890e4af7` | +| Author | Bobby | +| Date | 2026-06-03 19:24:52 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetCASMailbox.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxCAS.ps1` + +--- + +### 227. `23506364` — add tot non-ng + +| Field | Value | +|-------|-------| +| SHA | `235063643757177c83cc380d14af2464f921f897` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 20:38:08 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Set-CippApiAuth.ps1` + +--- + +### 228. `72c277d7` — Allow MCP client + +| Field | Value | +|-------|-------| +| SHA | `72c277d77f26595a99f65af7726029e6ea87e362` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 20:56:18 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 229. `7800b3cb` — Fix + +| Field | Value | +|-------|-------| +| SHA | `7800b3cb14db994b1867a4f6f5bb1116e818e336` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 21:22:27 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 230. `77073ba3` — role change + +| Field | Value | +|-------|-------| +| SHA | `77073ba369222e427671f8c75ba07facfbb08a2e` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 23:49:53 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1` + +--- + +### 231. `bc6aee43` — fix: quarantine deny action + +| Field | Value | +|-------|-------| +| SHA | `bc6aee43b74cd0672d858b9d31effbda6283847a` | +| Author | John Duprey | +| Date | 2026-06-03 21:33:32 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1` + +--- + +### 232. `4288bd80` — exclude partner tenant + +| Field | Value | +|-------|-------| +| SHA | `4288bd80f1d901e73c9054c887f8b9d3d2068da3` | +| Author | Zacgoose | +| Date | 2026-06-04 16:04:01 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/TenantGroups/Get-TenantGroups.ps1`, `Modules/CIPPCore/Public/TenantGroups/Update-CIPPDynamicTenantGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecCreateDefaultGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecTenantGroup.ps1` + +--- + +### 233. `adba8fa7` — add excludeFromAlert to licenses. + +| Field | Value | +|-------|-------| +| SHA | `adba8fa7febc74db4fe15f8e06941a9ce3d58540` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:21:33 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertExpiringLicenses.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertOverusedLicenses.ps1`, `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUnusedLicenses.ps1`, `Modules/CIPPCore/Public/Get-CIPPLicenseOverview.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecExcludeLicenses.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListExcludedLicenses.ps1`, `Modules/CippExtensions/Public/Extension Functions/Sync-CippExtensionData.ps1`, `Modules/CippExtensions/Public/Gradient/New-GradientServiceSyncRun.ps1` + +--- + +### 234. `9a176cc7` — feat: Add Group-Based Licensing support (#2063) + +| Field | Value | +|-------|-------| +| SHA | `9a176cc7b6a3177b1ff04d8261273b6a863ff9ca` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:26:32 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 235. `593911e1` — Feat: Add Invoke-ExecSetCASMailbox function for CAS settings management (#2076) + +| Field | Value | +|-------|-------| +| SHA | `593911e1ca62e68f21ee7ed971b39d63b1818406` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:36:51 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 236. `a8e7aa5e` — Feat: Add Email as alternate login ID standard (#2075) + +| Field | Value | +|-------|-------| +| SHA | `a8e7aa5eac2e442cb7354faa214420d9bede3379` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:37:04 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 237. `2b3a7bb5` — resolves #6096 + +| Field | Value | +|-------|-------| +| SHA | `2b3a7bb50bc8c42c79dd9147baa46ef9e2e2ae1f` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:40:42 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-EditUser.ps1` + +--- + +### 238. `ae921278` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `ae921278dbba126ac8aad7c25bb5cc2b00dbd5a6` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:40:44 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 239. `53db433c` — better descriptions + +| Field | Value | +|-------|-------| +| SHA | `53db433cdee8008bd93188053151e692abdba4e0` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 13:49:57 +0200 | +| Files changed | 21 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxRules.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListMailboxes.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListmailboxPermissions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Reports/Invoke-ListMailboxForwarding.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-ListApps.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAppProtectionPolicies.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListAssignmentFilters.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListCompliancePolicies.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntunePolicy.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneReusableSettings.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/MEM/Invoke-ListIntuneScript.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Groups/Invoke-ListGroups.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Reports/Invoke-ListMFAUsers.ps1` … (+6 more) + +--- + +### 240. `c7cebfeb` — better descriptions + +| Field | Value | +|-------|-------| +| SHA | `c7cebfeb4ff1cb4565926cf653b62c92a96cd505` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 13:50:07 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListCalendarPermissions.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ListHVEAccounts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Reports/Invoke-ListOAuthApps.ps1` + +--- + +### 241. `6a1c3733` — fixes issue with all tenants retrieval + +| Field | Value | +|-------|-------| +| SHA | `6a1c373363007e65c6cd2cac5ee6bd568d608c3e` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 15:08:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1` + +--- + +### 242. `4909e9c2` — dbcache desc + +| Field | Value | +|-------|-------| +| SHA | `4909e9c2094e9ad497d2c5decfe3f3d1070f6a26` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 15:09:37 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Invoke-ListDBCache.ps1` + +--- + +### 243. `3ca58875` — updated descriptions. + +| Field | Value | +|-------|-------| +| SHA | `3ca58875ac346e65937655ced8cf044603df75ca` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 15:17:52 +0200 | +| Files changed | 160 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal, Tenant Workflows, Permissions/Roles/Auth, Standards/Alignment Custom; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListAdminPortalLicenses.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListApiTest.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListCustomDataMappings.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDiagnosticsPresets.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListDirectoryObjects.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListFeatureFlags.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphBulkRequest.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListGraphRequest.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-ListSnoozedAlerts.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/invoke-ListEmptyResults.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Extensions/Invoke-ListExtensionSync.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListCIPPUsers.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ListContainerLogs.ps1` … (+145 more) + +--- + +### 244. `7902097a` — add missing return + +| Field | Value | +|-------|-------| +| SHA | `7902097acf76faf4ee0b6a80f2dff8cf2b0c3abd` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 22:07:50 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecUpdateRefreshToken.ps1` + +--- + +### 245. `65659c21` — fix: remove headers parameter from scheduler details/list + +| Field | Value | +|-------|-------| +| SHA | `65659c21ffad84702b6a6f62e83a39a6e59a42d9` | +| Author | John Duprey | +| Date | 2026-06-04 16:23:35 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItemDetails.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Scheduler/Invoke-ListScheduledItems.ps1` + +--- + +### 246. `c5d15588` — fix: version check + +| Field | Value | +|-------|-------| +| SHA | `c5d15588e31b2591514b2682d6301e9a60559c0a` | +| Author | John Duprey | +| Date | 2026-06-04 19:59:00 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Assert-CippVersion.ps1` + +--- + +### 247. `c5849381` — fix: fallback to app version if one is not specified + +| Field | Value | +|-------|-------| +| SHA | `c5849381984688f46eeb6c71e0f6ffc59acde285` | +| Author | John Duprey | +| Date | 2026-06-04 20:20:08 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Assert-CippVersion.ps1` + +--- + +### 248. `d4ddd3d6` — fix: additional protections for choco app deployment + +| Field | Value | +|-------|-------| +| SHA | `d4ddd3d6ff34f7a214bc58eae32eb7477b7b076e` | +| Author | John Duprey | +| Date | 2026-06-04 23:12:34 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/New-CIPPIntuneAppDeployment.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Endpoint/Applications/Invoke-AddChocoApp.ps1` + +--- + +### 249. `2bbcfcc8` — This endpoint is silly, we are going to manually try paging + +| Field | Value | +|-------|-------| +| SHA | `2bbcfcc825d0081fe7add434e41ee02ab3dbb468` | +| Author | Zacgoose | +| Date | 2026-06-05 16:50:55 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` + +--- + +### 250. `90e45ead` — pass timing to stop queue rerun protection drift + +| Field | Value | +|-------|-------| +| SHA | `90e45eadaac33b4991b18038c78a3a44e161a05e` | +| Author | Zacgoose | +| Date | 2026-06-05 17:51:43 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandard.ps1`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Standards/Push-CIPPStandardsList.ps1` + +--- + +### 251. `3fa0ee6c` — Pipe character escaping in names + +| Field | Value | +|-------|-------| +| SHA | `3fa0ee6c412cec4e9a6a3dade4befa21dcffc885` | +| Author | Zacgoose | +| Date | 2026-06-05 18:20:42 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Tools/Push-ExecGenerateReportBuilderReport.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest004.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest005.ps1`, `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest006.ps1` + +--- + +### 252. `2b3a1c81` — Fix for manually run standards being excluded from applied standards report page + +| Field | Value | +|-------|-------| +| SHA | `2b3a1c818be171adbd6526f1069447a43f1801b0` | +| Author | Zacgoose | +| Date | 2026-06-05 18:27:17 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListStandardsCompare.ps1` + +--- + +### 253. `4435ea38` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `4435ea380685a4bad5a9e7506aba54f0cfc861ae` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:04 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1`, `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-listStandardTemplates.ps1` + +--- + +### 254. `9cab0663` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `9cab066385d0b71f0879a0a438e0e6ed4949a698` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:13 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1`, `Modules/CIPPCore/Public/Get-CIPPDrift.ps1` + +--- + +### 255. `2b093c37` — fixes issue with CA compare and a weird blank line + +| Field | Value | +|-------|-------| +| SHA | `2b093c37ad3444f546efec5ad157270e7b540ba9` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:36:39 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardConditionalAccessTemplate.ps1` + +--- + +### 256. `f7f51cc1` — remove duplicate non gated cache collection items + +| Field | Value | +|-------|-------| +| SHA | `f7f51cc192a3e11238deef55a38ed6e43dfaa076` | +| Author | Zacgoose | +| Date | 2026-06-05 21:00:58 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-CIPPDBCacheData.ps1` + +--- + +### 257. `ed47810f` — Update Test-CIPPAccess.ps1 + +| Field | Value | +|-------|-------| +| SHA | `ed47810fdf281fc4366eb76fea9fb843c8cdd108` | +| Author | Zacgoose | +| Date | 2026-06-05 21:47:33 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Test-CIPPAccess.ps1` + +--- + +### 258. `c040658a` — Update FeatureFlags.json + +| Field | Value | +|-------|-------| +| SHA | `c040658ade0890d26514364d2d1f7ff5a4b528fe` | +| Author | Zacgoose | +| Date | 2026-06-05 21:59:25 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Settings | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `Config/FeatureFlags.json` + +--- + +### 259. `612ba54c` — Update Get-CIPPTenantAlignment.ps1 + +| Field | Value | +|-------|-------| +| SHA | `612ba54ca20e033be1dd5977efd3720f57b97f18` | +| Author | Zacgoose | +| Date | 2026-06-05 22:44:44 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Functions/Get-CIPPTenantAlignment.ps1` + +--- + +### 260. `f0f361d4` — restart helper + +| Field | Value | +|-------|-------| +| SHA | `f0f361d4b40b9bbab1116eb4aeb8c781afca57f1` | +| Author | Zacgoose | +| Date | 2026-06-05 23:28:22 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Initialize-CIPPAuth.ps1`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-ContainerUpdateCheck.ps1`, `Modules/CIPPCore/Public/Functions/Request-CIPPRestart.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Settings/Invoke-ExecContainerManagement.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSSOSetup.ps1` + +--- + +### 261. `961462f3` — fix: role assignment checks + +| Field | Value | +|-------|-------| +| SHA | `961462f346d5b8fe357dc322e550dee95a644232` | +| Author | John Duprey | +| Date | 2026-06-05 12:05:46 -0400 | +| Files changed | 5 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1`, `Modules/CIPPTests/Public/Tests/ZTNA/Identity/Invoke-CippTestZTNA21782.ps1` + +--- + +### 262. `503eac5b` — fix: apps and services test + +| Field | Value | +|-------|-------| +| SHA | `503eac5bdb6322f1e42b8e90cc48ab9f3b4c4c5b` | +| Author | John Duprey | +| Date | 2026-06-05 12:18:30 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_4.ps1` + +--- + +### 263. `ee1884f7` — add permissions for new settings endpoint + +| Field | Value | +|-------|-------| +| SHA | `ee1884f7cc5e32fe77ae90d35028f5dfc0761e23` | +| Author | John Duprey | +| Date | 2026-06-05 12:22:09 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `Config/SAMManifest.json` + +--- + +### 264. `d817b6d2` — fix: cis test 1_3_5 + +| Field | Value | +|-------|-------| +| SHA | `d817b6d2815abb63cd81c4ffcc31d5deb15b35a2` | +| Author | John Duprey | +| Date | 2026-06-05 12:45:31 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheSettings.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_5.ps1` + +--- + +### 265. `da10bf92` — renumber for cis7 + +| Field | Value | +|-------|-------| +| SHA | `da10bf92a82e9c791d2c32f6dd0b7b057baac067` | +| Author | KelvinTegelaar | +| Date | 2026-06-06 00:46:28 +0200 | +| Files changed | 299 | +| Risk | **Low** | +| Area | Docs | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Medium | +| Notes | Buckets: Documentation-only | + +**Files:** `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_3.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_1_4.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_2_2.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.md`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_1.ps1`, `Modules/CIPPTests/Public/Tests/CIS/Identity/Invoke-CippTestCIS_1_3_2.md` … (+284 more) + +--- + +### 266. `5df315b6` — improved open api spec for ai + +| Field | Value | +|-------|-------| +| SHA | `5df315b6c86356251eb341fbdb6aac773daf9e7d` | +| Author | KelvinTegelaar | +| Date | 2026-06-06 21:00:02 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `openapi.json` + +--- + +### 267. `65ba7a78` — embed module into pipeline actions + +| Field | Value | +|-------|-------| +| SHA | `65ba7a7880657dd81d745ba677a7c57f27f7ee50` | +| Author | Zacgoose | +| Date | 2026-06-07 13:24:52 +0800 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psd1`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psm1`, `Tools/ModuleBuilder/3.1.8/PSGetModuleInfo.xml`, `Tools/ModuleBuilder/3.1.8/en-US/about_ModuleBuilder.help.txt` + +--- + +### 268. `431d2929` — extra module dep + +| Field | Value | +|-------|-------| +| SHA | `431d29296def585602ede34296810881bc4d1d94` | +| Author | Zacgoose | +| Date | 2026-06-07 13:30:34 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1`, `Tools/Configuration/1.6.0/Configuration.psd1`, `Tools/Configuration/1.6.0/Configuration.psm1`, `Tools/Configuration/1.6.0/PSGetModuleInfo.xml` + +--- + +### 269. `336909e8` — extra module dep + +| Field | Value | +|-------|-------| +| SHA | `336909e8837a835b113a92d6db94b4b23d83e678` | +| Author | Zacgoose | +| Date | 2026-06-07 13:32:43 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Build-DevApiModules.ps1`, `Tools/Metadata/1.5.7/Metadata.psd1`, `Tools/Metadata/1.5.7/Metadata.psm1`, `Tools/Metadata/1.5.7/PSGetModuleInfo.xml` + +--- + +### 270. `d3d98923` — cache middleware changes + +| Field | Value | +|-------|-------| +| SHA | `d3d989239922033360844a522ef1c930b4949c9e` | +| Author | Zacgoose | +| Date | 2026-06-07 14:56:27 +0800 | +| Files changed | 6 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/HTTP Functions/New-CippCoreRequest.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-CIPPDBTestsRun.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-UserTasksOrchestrator.ps1`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1`, `Shared/CIPPSharp/CIPPTestDataCache.cs`, `Shared/CIPPSharp/bin/CIPPSharp.dll` + +--- + +### 271. `ddc264a7` — Update Invoke-CippTestGenericTest002.ps1 + +| Field | Value | +|-------|-------| +| SHA | `ddc264a771b27807a35d12fd3645d4693b4a21f8` | +| Author | Zacgoose | +| Date | 2026-06-08 12:49:44 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/GenericTests/Identity/Invoke-CippTestGenericTest002.ps1` + +--- + +### 272. `2a63cfc7` — Update Get-CIPPAlertQuotaUsed.ps1 + +| Field | Value | +|-------|-------| +| SHA | `2a63cfc7eb0e457762a8fa3c50b9121821becb12` | +| Author | Zacgoose | +| Date | 2026-06-08 13:27:58 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertQuotaUsed.ps1` + +--- + +### 273. `64f30df6` — Update Start-DurableCleanup.ps1 + +| Field | Value | +|-------|-------| +| SHA | `64f30df6a54328ba3e886cd83d5b7417fb153ff2` | +| Author | Zacgoose | +| Date | 2026-06-08 14:51:46 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-DurableCleanup.ps1` + +--- + +### 274. `34112ffd` — temporary 1 day to clear old ips + +| Field | Value | +|-------|-------| +| SHA | `34112ffd912693d51f62e1f98e12a5009fc556fd` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:30:26 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Get-CIPPGeoIPLocation.ps1` + +--- + +### 275. `bfb0c17a` — tools update + +| Field | Value | +|-------|-------| +| SHA | `bfb0c17a9ccd997e71218c4e5e71c68868fbd941` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:31:26 +0200 | +| Files changed | 10 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Tools/Configuration/1.6.0/Configuration.psd1`, `Tools/Configuration/1.6.0/Configuration.psm1`, `Tools/Configuration/1.6.0/PSGetModuleInfo.xml`, `Tools/Metadata/1.5.7/Metadata.psd1`, `Tools/Metadata/1.5.7/Metadata.psm1`, `Tools/Metadata/1.5.7/PSGetModuleInfo.xml`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psd1`, `Tools/ModuleBuilder/3.1.8/ModuleBuilder.psm1`, `Tools/ModuleBuilder/3.1.8/PSGetModuleInfo.xml`, `Tools/ModuleBuilder/3.1.8/en-US/about_ModuleBuilder.help.txt` + +--- + +### 276. `e4455d3f` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `e4455d3f176fdab57e3d0ff12f421894cf20246c` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:31:28 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 277. `a52f002d` — 10.5.0 version up + +| Field | Value | +|-------|-------| +| SHA | `a52f002d5601c521998d84ca65544d561154e48e` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:32:50 +0200 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `version_latest.txt` + +--- + +### 278. `4f8bc79c` — Dev to release (#2081) + +| Field | Value | +|-------|-------| +| SHA | `4f8bc79cec338f08dfc3374f95e014b42fbfe157` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 14:25:19 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 279. `b36a32b0` — shuffle file locations + +| Field | Value | +|-------|-------| +| SHA | `b36a32b0a89397e211cd681ac62669efb79c79c5` | +| Author | Zacgoose | +| Date | 2026-06-09 00:04:52 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/MCP/Get-CippMcpSpec.ps1`, `Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1`, `Modules/CIPPCore/Public/MCP/Get-CippMcpToolResult.ps1`, `Modules/CIPPHTTP/Public/Invoke-ListObjectHistory.ps1` + +--- + +### 280. `fc76e111` — sso app repair and fix migration failures + +| Field | Value | +|-------|-------| +| SHA | `fc76e111b828b514e5abdd5fbe43a2fa90740468` | +| Author | Zacgoose | +| Date | 2026-06-09 01:03:56 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Authentication/Add-CIPPSSOAppSecret.ps1`, `Modules/CIPPCore/Public/Authentication/New-CIPPSSOApp.ps1`, `Modules/CIPPCore/Public/Authentication/Set-CIPPSSOStoredCredentials.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Setup/Invoke-ExecSSOSetup.ps1` + +--- + +### 281. `c0f663ca` — fix: update role and fix variable casing in message trace function + +| Field | Value | +|-------|-------| +| SHA | `c0f663ca436572f4a88571553d03a13b5ad9fc01` | +| Author | Bobby | +| Date | 2026-06-08 22:49:25 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ListMessageTrace.ps1` + +--- + +### 282. `3e33fdb1` — fix: more robust conversion for EnableAutoTrim setting + +| Field | Value | +|-------|-------| +| SHA | `3e33fdb15b67daa52c8bb0651b737193787d5371` | +| Author | Bobby | +| Date | 2026-06-08 23:59:05 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSPOVersionControl.ps1` + +--- + +### 283. `3f9aab05` — api version file fixes + +| Field | Value | +|-------|-------| +| SHA | `3f9aab05b0c73759016aef39ba6cd62416b92d0b` | +| Author | Zacgoose | +| Date | 2026-06-09 13:40:29 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/version_latest.txt`, `Modules/CIPPCore/Public/Authentication/Get-CippAllowedPermissions.ps1`, `Modules/CIPPCore/Public/Entrypoints/Timer Functions/Start-CIPPStatsTimer.ps1` + +--- + +### 284. `2138ec6d` — Fix: Improve conversion for EnableAutoTrim setting (#2084) + +| Field | Value | +|-------|-------| +| SHA | `2138ec6d13f531bce2f61b1dc3f110dd75935ce9` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 10:26:37 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 285. `c215631c` — Fix: Message trace role and variable casing in message trace function (#2083) + +| Field | Value | +|-------|-------| +| SHA | `c215631c31f850630553c44f7e3aa5a78f4e1b7b` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 10:26:54 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 286. `2925643d` — push endpoint over to export job endpoint + +| Field | Value | +|-------|-------| +| SHA | `2925643d2f15f3a6d551a85a60255fbaae4d5e9c` | +| Author | Zacgoose | +| Date | 2026-06-09 17:09:03 +0800 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Config/CIPPTimers.json`, `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-IntuneReportExportSubmit.ps1`, `Modules/CIPPCore/Public/Entrypoints/Orchestrator Functions/Start-IntuneReportExportOrchestrator.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheDetectedApps.ps1` + +--- + +### 287. `b79c296f` — sherweb migration fixes + +| Field | Value | +|-------|-------| +| SHA | `b79c296f0344bdd0783568896ced47bbce8380d4` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 13:57:18 +0200 | +| Files changed | 5 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1`, `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `Modules/CippExtensions/Public/Extension Functions/Register-CippExtensionScheduledTasks.ps1`, `Modules/CippExtensions/Public/Sherweb/Invoke-SherwebMigration.ps1`, `Modules/CippExtensions/Public/Sherweb/Test-SherwebMigrationAccounts.ps1` + +--- + +### 288. `280b3b9d` — fix: add CippExtensions to allowlist + +| Field | Value | +|-------|-------| +| SHA | `280b3b9d08578311a60d3baf501984b205356fb6` | +| Author | John Duprey | +| Date | 2026-06-09 07:57:29 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ExecScheduledCommand.ps1`, `Modules/CIPPCore/Public/Add-CIPPScheduledTask.ps1`, `profile.ps1` + +--- + +### 289. `8f1069cf` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `8f1069cf56b4647c42b6e0538682b338d89824af` | +| Author | John Duprey | +| Date | 2026-06-09 07:57:31 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 290. `2511c6e5` — add limits for tools copilot studio + +| Field | Value | +|-------|-------| +| SHA | `2511c6e56640e03ed49000f7133cc027fcea1717` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:50:17 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/MCP/Get-CippMcpToolList.ps1`, `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 291. `6c897f52` — fixes group addition in user page and vacation mode + +| Field | Value | +|-------|-------| +| SHA | `6c897f52f26b6a3a75c5a042b18e140f8e44d13c` | +| Author | Zacgoose | +| Date | 2026-06-09 21:17:48 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Add-CIPPGroupMember.ps1`, `Modules/CIPPCore/Public/New-CIPPUserTask.ps1` + +--- + +### 292. `39e1a34e` — chore: bump version to 10.5.1 + +| Field | Value | +|-------|-------| +| SHA | `39e1a34e3d33a7657f10c1d21eda71190596cdee` | +| Author | John Duprey | +| Date | 2026-06-09 10:35:41 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `host.json`, `version_latest.txt` + +--- + +### 293. `14346161` — Dev to hotfix (#2085) + +| Field | Value | +|-------|-------| +| SHA | `143461619d6f95588c7725c5110b915a2e676797` | +| Author | John Duprey | +| Date | 2026-06-09 10:39:33 -0400 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 294. `64836c02` — fix: rerun detection on scheduled tasks + +| Field | Value | +|-------|-------| +| SHA | `64836c02a801a3718c2bd2e598bcf206c973541d` | +| Author | John Duprey | +| Date | 2026-06-09 12:15:57 -0400 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Test-CIPPRerun.ps1` + +--- + +### 295. `9dd0e567` — Update Invoke-ListTenantAlignment.ps1 + +| Field | Value | +|-------|-------| +| SHA | `9dd0e56750810b7a85ef4fb079dbf6725b2b6ce0` | +| Author | Zacgoose | +| Date | 2026-06-10 14:27:26 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1` + +--- + +### 296. `a0a79852` — Update Invoke-ListTenantAlignment.ps1 + +| Field | Value | +|-------|-------| +| SHA | `a0a79852f89fb82c0f5bab15822b46870198956e` | +| Author | Zacgoose | +| Date | 2026-06-10 14:45:31 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Standards/Invoke-ListTenantAlignment.ps1` + +--- + +### 297. `e8d13427` — audit log detailed logging for debugging + +| Field | Value | +|-------|-------| +| SHA | `e8d1342774427bee3572ebcb9f2aad8c0d30c800` | +| Author | Zacgoose | +| Date | 2026-06-10 15:03:18 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/AuditLogs/New-CippAuditLogSearch.ps1`, `Modules/CIPPCore/Public/GraphHelper/New-GraphPOSTRequest.ps1` + +--- + +### 298. `b8fefcfd` — Update Invoke-ExecMcp.ps1 + +| Field | Value | +|-------|-------| +| SHA | `b8fefcfdd085b5f25782f7f3da70324252f3c630` | +| Author | Zacgoose | +| Date | 2026-06-10 15:20:53 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/MCP/Invoke-ExecMcp.ps1` + +--- + +### 299. `83b13034` — bulk request next link following + +| Field | Value | +|-------|-------| +| SHA | `83b130347aa81fb373cb77de32583dab9628e2e8` | +| Author | Zacgoose | +| Date | 2026-06-10 22:33:53 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/GraphHelper/New-ExoBulkRequest.ps1` + +--- + +### 300. `9f0bacd6` — manual pagination support for Invoke-ListMailQuarantine + +| Field | Value | +|-------|-------| +| SHA | `9f0bacd62c74d6e65ee0f51623884569de2eb8c1` | +| Author | Zacgoose | +| Date | 2026-06-10 22:49:50 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` + +--- + +### 301. `cc84a49d` — Fix ORCA104 + +| Field | Value | +|-------|-------| +| SHA | `cc84a49df1633a1b5de2dfdeda991f9d8b7b660c` | +| Author | Zacgoose | +| Date | 2026-06-10 23:22:58 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA104.ps1` + +--- + +### 302. `8cd8d1d9` — Fix for ORCA107 and add Exchange Global Quarantine policy to cache + +| Field | Value | +|-------|-------| +| SHA | `8cd8d1d94e51ce793d79567822483073715392ad` | +| Author | Zacgoose | +| Date | 2026-06-10 23:51:56 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Tests | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Tests-only, Potentially breaking changes | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoQuarantinePolicy.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA107.ps1` + +--- + +### 303. `2ab0e0e2` — fix: rerun issue + +| Field | Value | +|-------|-------| +| SHA | `2ab0e0e27c77d146301b427365e0d305e813137d` | +| Author | John Duprey | +| Date | 2026-06-10 12:06:17 -0400 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPCore/Public/Test-CIPPRerun.ps1` + +--- + +### 304. `238001c1` — Update policy based on MS and Orca guidance + +| Field | Value | +|-------|-------| +| SHA | `238001c13e0d62a7f13b00d46c99c7be82c11cad` | +| Author | Zacgoose | +| Date | 2026-06-11 00:13:53 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPStandards/Public/Standards/Invoke-CIPPStandardSpamFilterPolicy.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA102.ps1` + +--- + +### 305. `0640f07c` — Fixes ORCA179 + +| Field | Value | +|-------|-------| +| SHA | `0640f07ccdf22a8294a91502def41b987be84ab5` | +| Author | Zacgoose | +| Date | 2026-06-11 00:25:11 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA179.ps1` + +--- + +### 306. `db3de75a` — Fixes ORCA244 + +| Field | Value | +|-------|-------| +| SHA | `db3de75a6c6fc7cbf6e1c775ffb485e9ca2a215d` | +| Author | Zacgoose | +| Date | 2026-06-11 00:26:36 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA244.ps1` + +--- + +### 307. `a556b98b` — Fixes ORCA113 + +| Field | Value | +|-------|-------| +| SHA | `a556b98bdbd08fb9d97df79ae8c79f4d47011e39` | +| Author | Zacgoose | +| Date | 2026-06-11 00:34:47 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA113.ps1` + +--- + +### 308. `cbcc61b5` — Fixes ORCA103 + +| Field | Value | +|-------|-------| +| SHA | `cbcc61b5afd8c7ea9bb9bef1da7878465afc5610` | +| Author | Zacgoose | +| Date | 2026-06-11 00:48:34 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA103.ps1` + +--- + +### 309. `2851db0f` — Fixes ORCA233_1 + +| Field | Value | +|-------|-------| +| SHA | `2851db0f52d88c4a7b5ee0d1a739a7d9d95ea27b` | +| Author | Zacgoose | +| Date | 2026-06-11 01:17:20 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoInboundConnector.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA233_1.ps1` + +--- + +### 310. `28ba94b4` — Fixes ORCA242 + +| Field | Value | +|-------|-------| +| SHA | `28ba94b43709b89dee2a349742f68c1df5ac1bf8` | +| Author | Zacgoose | +| Date | 2026-06-11 01:17:33 +0800 | +| Files changed | 4 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Config/CIPPDBCacheTypes.json`, `Modules/CIPPCore/Public/Invoke-CIPPDBCacheCollection.ps1`, `Modules/CIPPDB/Public/DBCache/Set-CIPPDBCacheExoProtectionAlert.ps1`, `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA242.ps1` + +--- + +### 311. `f37d68ad` — Fixes ORCA235 + +| Field | Value | +|-------|-------| +| SHA | `f37d68adfa17516f05cb9422fe01da589252ada9` | +| Author | Zacgoose | +| Date | 2026-06-11 01:26:09 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Modules/CIPPTests/Public/Tests/ORCA/Identity/Invoke-CippTestORCA235.ps1` + +--- + +### 312. `abcbb60a` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP-API into dev + +| Field | Value | +|-------|-------| +| SHA | `abcbb60a5890f91b1d9c92be83ff5d4f2a72bdd2` | +| Author | John Duprey | +| Date | 2026-06-10 14:51:00 -0400 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 313. `e9bc5ad5` — fix: add early template filter when supplied + +| Field | Value | +|-------|-------| +| SHA | `e9bc5ad50bce44db439e9d271c37a0ec5b47a5ac` | +| Author | John Duprey | +| Date | 2026-06-10 16:51:47 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `Modules/CIPPCore/Public/Standards/Get-CIPPStandards.ps1` + +--- + +### 314. `8f2198e7` — chore: bump version to 10.5.2 + +| Field | Value | +|-------|-------| +| SHA | `8f2198e7cf303ec2726066c95a4ebacb55e75f27` | +| Author | John Duprey | +| Date | 2026-06-10 17:02:38 -0400 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `host.json`, `version_latest.txt` + +--- + +### 315. `5a0ddb29` — Dev to hotfix (#2088) + +| Field | Value | +|-------|-------| +| SHA | `5a0ddb29c3770525813aefea5e356fc56b088eeb` | +| Author | John Duprey | +| Date | 2026-06-10 17:25:40 -0400 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md new file mode 100644 index 0000000000..aeab217c78 --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_API_20260617.md @@ -0,0 +1,84 @@ +# UserReportedPhishing API — Upstream Import + +Generated: 2026-06-17 +Branch: `manage365/userreportedphishing-api-20260617` +Backup tag: `backup/pre-userreportedphishing-api-20260617` → `15df6c850` +Base: `master` @ `15df6c850` (docs: upstream delta inventory) + +## Upstream Commit + +| Field | Value | +|-------|-------| +| SHA | `2869564fb` (short: `2869564f`) | +| Title | Add AlertUserReportPhising | +| Author | KelvinTegelaar | +| Date | 2026-05-12 | + +## Pre-Apply Verification + +`git show --stat 2869564f` — 2 files, 51 insertions: + +- `Config/SAMManifest.json` +- `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` + +No quarantine, Email Troubleshooter, tenant switching, auth flow, `Start-TableCleanup`, or unrelated standards files touched. + +## Apply Result + +| Status | Detail | +|--------|--------| +| **Applied with adaptation** | Cherry-pick `-x` conflicted on `Config/SAMManifest.json` (fork has additional Graph Role permissions after upstream insertion point). Resolved by keeping all fork permissions and appending the new Role at end of Microsoft Graph `resourceAccess`. Alert handler applied cleanly. | + +Applied commit on branch: cherry-pick of `2869564f` (amended to include lib/data manifest parity + this doc). + +## Files Changed + +| File | Change | +|------|--------| +| `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` | **Added** — alert entrypoint | +| `Config/SAMManifest.json` | **Updated** — Graph application permission | +| `Modules/CIPPCore/lib/data/SAMManifest.json` | **Updated** — same permission for fork manifest parity | +| `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` | **Added** — this tracking doc | + +## Permission Added + +| GUID | Type | Permission | Translator | +|------|------|------------|------------| +| `d72bdbf4-a59b-405c-8b04-5995895819ac` | Role (Application) | `ThreatSubmission.ReadWrite.All` | Present in `Config/PermissionsTranslator.json` and `Modules/CIPPCore/lib/data/PermissionsTranslator.json` | + +**CPV/SAM:** `Get-CippSamPermissions` reads `Config/SAMManifest.json`. After merge, run Manage365 CPV permission refresh so client tenants receive `ThreatSubmission.ReadWrite.All` on the CIPP service principal. App registration in MSP tenant must also expose this permission (verify before prod deploy). + +## Implementation Notes + +- Alert follows CIPPAlerts pattern: `.FUNCTIONALITY Entrypoint`, `Write-AlertTrace`, try/catch with `Write-AlertMessage`. +- Uses app-only Graph: `New-GraphGetRequest ... -AsApp $true` against beta `security/threatSubmission/emailThreats`. +- Filters to user-reported submissions only (`source -eq 'user'`). +- Default lookback: 24 hours (`HoursBack` configurable via alert input). + +## Tests + +| Suite | Result | +|-------|--------| +| `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | 34 passed | +| `Tests/Tools` | 13 passed | +| **Total** | **47/47 passed** | + +No dedicated SAM manifest shape tests in repo. + +## Frontend Dependency + +**Pending** — do not add CIPP frontend `7054bfc4` (`src/data/alerts.json` `UserReportedPhishing` entry) until: + +1. This API branch is reviewed and merged +2. SAM/CPV permission push path is confirmed in non-prod +3. Non-prod alert smoke test passes (or is explicitly waived) + +Alert name mapping when frontend is added: `UserReportedPhishing` → `Get-CIPPAlertUserReportedPhishing`. + +## Next Steps + +1. Open PR from `manage365/userreportedphishing-api-20260617` → `master` +2. Review SAM diff and confirm MSP app registration includes `ThreatSubmission.ReadWrite.All` +3. Merge API PR; trigger CPV permission update +4. Smoke test alert in non-prod tenant (Graph beta emailThreats + user source filter) +5. Then import frontend `7054bfc4` on paired CIPP branch diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md new file mode 100644 index 0000000000..f6371fc54b --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_FINAL_STATUS_20260617.md @@ -0,0 +1,98 @@ +# UserReportedPhishing — Final Paired Workstream Status + +Generated: 2026-06-17 +Repos: Celeratec/CIPP-API + Celeratec/CIPP + +## Workstream Summary + +Paired upstream import of UserReportedPhishing alert support is **code-complete** on both repos. Operational rollout to production tenants is **partially complete** — backend validated; frontend exposed; first-tenant scheduler enablement pending. + +| Phase | Status | +|-------|--------| +| CIPP-API backend (PR #2) | **Merged** | +| SAM manifest + permission | **Merged** | +| CPV/consent validation | **Clean** (pre-frontend) | +| Backend smoke test | **Clean** (pre-frontend) | +| CIPP frontend (PR #9) | **Merged** | +| First-tenant SchedulerConfig enablement | **Not performed** | +| Global/bulk enablement | **Blocked** until one clean run documented | + +--- + +## CIPP-API + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP-API/pull/2 | +| **Merge commit** | `4b00ffeb6` | +| **Feature commit** | `7fed45fd7` | +| **Master tip (docs)** | `61278a254` (rollout runbook) + post-merge docs | +| **Backup tag** | `backup/pre-userreportedphishing-api-20260617` → `15df6c850` | + +**Delivered:** + +- `Get-CIPPAlertUserReportedPhishing` alert handler +- `ThreatSubmission.ReadWrite.All` in `Config/SAMManifest.json` and `Modules/CIPPCore/lib/data/SAMManifest.json` +- Pester regression: 47/47 passed +- Rollout runbook: `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md` + +**Validation completed before frontend exposure:** + +- SAM table merge and CPV path exercised +- Admin consent confirmed in test context +- Handler smoke test: `Get-CIPPAlertUserReportedPhishing -InputValue @{ HoursBack = 24 }` — clean + +--- + +## CIPP (Frontend) + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP/pull/9 | +| **Merge commit** | `7050757b2` | +| **Feature commit** | `5b3ef362c` | +| **Backup tag** | `backup/pre-userreportedphishing-frontend-20260617` | + +**Delivered:** + +- `UserReportedPhishing` entry in `src/data/alerts.json` +- `HoursBack` input, `recommendedRunInterval: 4h` +- Maps to backend via `Get-CIPPAlertUserReportedPhishing` + +Upstream commit: `7054bfc4` (previously deferred in Cycle 1 sync until API rollout validated). + +--- + +## Remaining Operational Step + +**One-tenant SchedulerConfig enablement and production scheduler run validation.** + +Operator checklist: + +1. Confirm CIPP-API `master` and CIPP `main` (PR #9) deployed to target environment. +2. Enable `UserReportedPhishing` for **one test tenant** only (`HoursBack: 24`). +3. Wait for or trigger scheduler run (`recommendedRunInterval: 4h`). +4. Confirm alert trace output or clean no-op; no permission errors. +5. Document result (date, tenant, outcome). +6. **Do not bulk-enable globally** until step 5 is complete. + +--- + +## Documentation Index + +| Doc | Repo | Purpose | +|-----|------|---------| +| `USERREPORTEDPHISHING_API_20260617.md` | CIPP-API | Upstream import tracking | +| `USERREPORTEDPHISHING_POST_MERGE_20260617.md` | CIPP-API | Post-merge API validation record | +| `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md` | CIPP-API | Operator SAM/CPV/smoke runbook | +| `USERREPORTEDPHISHING_FINAL_STATUS_20260617.md` | CIPP-API | This paired completion status | +| `USERREPORTEDPHISHING_FRONTEND_20260617.md` | CIPP | Frontend import tracking | +| `USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md` | CIPP | Frontend post-merge status | + +--- + +## Safety Notes + +- Handler can remain dormant until SchedulerConfig enables the alert per tenant. +- Requires `ThreatSubmission.ReadWrite.All` on CIPP service principal in each tenant where enabled. +- Backup tags retained on both repos for rollback reference. diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md new file mode 100644 index 0000000000..13da0397de --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_POST_MERGE_20260617.md @@ -0,0 +1,212 @@ +# UserReportedPhishing API — Post-Merge Validation + +Generated: 2026-06-17 +Repo: Celeratec/CIPP-API +Master tip: `4b00ffeb6` + +## Merge Summary + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP-API/pull/2 | +| **Merge commit** | `4b00ffeb6` | +| **Feature commit** | `7fed45fd7` | +| **Title** | Add user reported phishing alert backend | +| **Backup tag (retained)** | `backup/pre-userreportedphishing-api-20260617` → `15df6c850` | + +## Files Merged + +| File | Change | +|------|--------| +| `Modules/CIPPAlerts/Public/Alerts/Get-CIPPAlertUserReportedPhishing.ps1` | New alert handler | +| `Config/SAMManifest.json` | +1 Graph application Role | +| `Modules/CIPPCore/lib/data/SAMManifest.json` | +1 Graph application Role (fork parity) | +| `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` | Import tracking doc | + +## Pester Regression + +| Suite | Result | +|-------|--------| +| `Tests/Private/Get-CIPPLevenshteinDistance.Tests.ps1` | 34 passed | +| `Tests/Tools` | 13 passed | +| **Total (post-merge re-run)** | **47/47 passed** | + +## SAM Manifest Status + +| Item | Status | +|------|--------| +| Permission GUID | `d72bdbf4-a59b-405c-8b04-5995895819ac` | +| Permission name | `ThreatSubmission.ReadWrite.All` | +| Graph resource app ID | `00000003-0000-0000-c000-000000000000` | +| Permission type | Role (Application) | +| In `Config/SAMManifest.json` | Yes | +| In `Modules/CIPPCore/lib/data/SAMManifest.json` | Yes | +| `PermissionsTranslator.json` mapping | Already present (no change required) | +| Roles removed vs pre-merge | **None** (append-only) | +| Roles added vs pre-merge | ThreatSubmission only (both manifests) | + +### Pre-existing SAM parity gap (unchanged by this PR) + +`Config/SAMManifest.json` contains Graph Role `7e05723c-0bb0-42da-be95-ae9f08a6e53c` that `Modules/CIPPCore/lib/data/SAMManifest.json` lacks. This PR did **not** widen the gap — both manifests received the same new permission. CPV runtime reads **`Config/SAMManifest.json`** via `Get-CippSamPermissions`. + +Graph Role counts after merge: Config **62**, lib/data **61**. + +## Frontend Status + +**Still deferred.** Do not add CIPP frontend `7054bfc4` (`src/data/alerts.json` `UserReportedPhishing` entry) until SAM/CPV rollout, tenant consent, and non-prod backend smoke test are complete (or explicitly waived). + +--- + +## Task 2 — SAM / CPV Permission Rollout Path + +### How permissions flow in this fork + +```text +Config/SAMManifest.json + │ + ▼ +Get-CippSamPermissions ← compares manifest vs AppPermissions table + │ + ├── MissingPermissions diff (dry-run signal) + │ + ▼ +Update-CippSamPermissions ← Invoke-ExecPermissionRepair (MSP table merge) + │ + ▼ +AppPermissions table (CIPP-SAM) + │ + ▼ +Start-UpdatePermissionsOrchestrator ← Invoke-ExecCPVRefresh (tenant push) + │ + ▼ +Push-UpdatePermissionsQueue per tenant + │ + ├── Add-CIPPApplicationPermission (CIPPDefaults → app Roles) + └── Add-CIPPDelegatedPermission +``` + +**Note:** `Modules/CIPPCore/lib/data/SAMManifest.json` is maintained for fork parity but is **not** read by `Get-CippSamPermissions`. Only `Config/SAMManifest.json` drives CPV. + +### Dry-run / read-only validation (recommended before any push) + +No dedicated `-WhatIf` / dry-run flag exists on CPV orchestration. Use these **read-only** steps in non-prod Manage365/CIPP: + +| Step | Endpoint / function | Purpose | +|------|---------------------|---------| +| 1 | `Invoke-ExecSAMAppPermissions` (GET, default action) | Returns `Get-CippSamPermissions` output including `MissingPermissions` | +| 2 | CIPP Settings → Access Check / `Test-CIPPAccessPermissions` | Surfaces missing SAM permissions and tenants needing CPV refresh | +| 3 | Local static validation (below) | Confirms manifest JSON, GUID, translator, no regressions | + +**Expected dry-run signal after deploy:** `MissingPermissions` for Microsoft Graph should include: + +```json +{ + "id": "d72bdbf4-a59b-405c-8b04-5995895819ac", + "value": "ThreatSubmission.ReadWrite.All" +} +``` + +until `Update-CippSamPermissions` merges it into the `AppPermissions` table. + +### Static validation (local, 2026-06-17) + +Executed against `master` @ `4b00ffeb6` without Azure connectivity: + +| Check | Result | +|-------|--------| +| Config JSON valid | Pass | +| lib/data JSON valid | Pass | +| Target GUID in Config | Pass | +| Target GUID in lib/data | Pass | +| Permission type Role | Pass | +| Graph resource app ID | Pass | +| PermissionsTranslator maps GUID → `ThreatSubmission.ReadWrite.All` | Pass | +| Config roles removed vs pre-merge | **None** | +| lib/data roles removed vs pre-merge | **None** | +| Config roles added | `d72bdbf4-...` only | +| lib/data roles added | `d72bdbf4-...` only | +| Pre-existing Config-only role `7e05723c-...` preserved | Pass | + +### Production push steps (operator — not executed in this session) + +Requires explicit approval and non-prod validation first: + +1. **Deploy** `master` @ `4b00ffeb6` to non-prod Function App. +2. **MSP SAM table merge:** CIPP Settings → Permission Repair (`Invoke-ExecPermissionRepair` / `Update-CippSamPermissions`). +3. **Verify** `ExecSAMAppPermissions` GET shows no missing Graph application permissions (or ThreatSubmission absent from `MissingPermissions`). +4. **CPV refresh (single test tenant first):** `Invoke-ExecCPVPermissions` for one internal tenant, or `Invoke-ExecCPVRefresh` for orchestrated rollout after test-tenant success. +5. **Confirm** CIPP service principal in test tenant has `ThreatSubmission.ReadWrite.All` app role assignment on Microsoft Graph resource SP. +6. **Prod rollout** only after non-prod smoke test passes. + +**Not run:** `Start-UpdatePermissionsOrchestrator` / tenant-wide CPV push (production side effect). + +--- + +## Task 3 — Test Tenant Readiness + +**Status: BLOCKED — requires deployed non-prod Function App** + +This validation session had no Azure Function App runtime, SAM tokens, or tenant credentials. Operator must complete in non-prod: + +| Check | How | +|-------|-----| +| Service principal can receive permission | Entra → Enterprise apps → CIPP SAM app → Permissions; confirm `ThreatSubmission.ReadWrite.All` listed | +| Admin consent completable | Grant admin consent in test tenant after CPV push | +| Existing permissions intact | Compare app role assignments before/after CPV on Graph resource SP | +| Graph beta endpoint reachable | App-only GET `https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$top=1` in test tenant | + +Suggested tenant: internal/non-production managed tenant with Defender for Office 365 reporting enabled. + +--- + +## Task 4 — Backend Smoke Test + +**Status: BLOCKED — requires deployed non-prod Function App** + +Safest execution paths (do **not** enable frontend alert globally): + +### Option A — Direct function invoke (non-prod only) + +```powershell +# After SAM auth and module import in Function App context or local harness with CIPPRootPath set +Get-CIPPAlertUserReportedPhishing -TenantFilter '' -InputValue @{ HoursBack = 24 } +``` + +### Option B — Scheduler bridge (only if alert enabled in SchedulerConfig for test tenant) + +`Push-SchedulerAlert` calls `Get-CIPPAlertUserReportedPhishing` when `UserReportedPhishing` is enabled in tenant alert config. **Do not enable globally** — use Option A or a one-off scheduler row for test tenant only. + +### Expected outcomes + +| Scenario | Expected | +|----------|----------| +| No user submissions in window | No alert trace; no fatal error | +| User submissions exist | `Write-AlertTrace` output with filtered records | +| Missing consent | Explicit Graph permission error via `Write-AlertMessage`; attributable to missing `ThreatSubmission.ReadWrite.All`, not code failure | + +**Not executed in this session.** + +--- + +## Frontend Gate Decision + +| Question | Answer | +|----------|--------| +| Can frontend alert proceed? | **No** | +| Blockers | (1) Non-prod deploy of merged API not confirmed in this session; (2) `Update-CippSamPermissions` + CPV push not run; (3) Test tenant consent not verified; (4) `Get-CIPPAlertUserReportedPhishing` live smoke test not run | + +### Unblock sequence + +1. Deploy `master` to non-prod Function App +2. Run SAM permission repair (MSP) → confirm ThreatSubmission in AppPermissions table +3. CPV refresh on one test tenant → grant admin consent +4. Smoke test handler (Option A above) +5. Operator sign-off or explicit waiver +6. Then open CIPP frontend PR for `7054bfc4` + +--- + +## Related Docs + +- Import tracking: `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` +- Upstream delta: `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260617.md` diff --git a/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md new file mode 100644 index 0000000000..fc787f042b --- /dev/null +++ b/docs/upstream-sync/history-cipp-api/USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md @@ -0,0 +1,300 @@ +# UserReportedPhishing — Operational Rollout Runbook + +Generated: 2026-06-17 +Repo: Celeratec/CIPP-API +Related: PR #2 (merged), `USERREPORTEDPHISHING_POST_MERGE_20260617.md` + +Operator runbook for SAM/CPV permission rollout and backend smoke test **before** enabling the CIPP frontend alert (`7054bfc4`). + +--- + +## 1. Current Status + +| Item | Status | +|------|--------| +| API handler merged | Yes — `Get-CIPPAlertUserReportedPhishing` on `master` | +| Frontend alert enabled | **No** — `UserReportedPhishing` not in CIPP `alerts.json` | +| SAM manifest (Config) | `ThreatSubmission.ReadWrite.All` added | +| SAM manifest (lib/data) | Same permission added (fork parity copy) | +| CPV runtime manifest source | **`Config/SAMManifest.json`** via `Get-CippSamPermissions` | +| lib/data manifest | Parity copy only — **not** read by CPV | +| PermissionsTranslator | GUID already mapped — no change required | +| Production permission push | **Not executed** | +| Live backend smoke test | **Not executed** | +| Backup tag | `backup/pre-userreportedphishing-api-20260617` → `15df6c850` | + +**Master commits of record:** + +| SHA | Description | +|-----|-------------| +| `4b00ffeb6` | Merge PR #2 | +| `7fed45fd7` | Feature: alert handler + SAM manifests | +| `7b6ea11ff` | Post-merge validation doc | + +--- + +## 2. Permission Details + +| Field | Value | +|-------|--------| +| **Permission name** | `ThreatSubmission.ReadWrite.All` | +| **GUID** | `d72bdbf4-a59b-405c-8b04-5995895819ac` | +| **Resource** | Microsoft Graph | +| **Resource App ID** | `00000003-0000-0000-c000-000000000000` | +| **Type** | Application / Role | + +**Graph API used by alert handler:** + +```http +GET https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?$filter=createdDateTime ge {Since} +Authorization: Bearer {app-only token} +``` + +Handler filters results to `source -eq 'user'`. + +--- + +## 3. Pre-Flight Read-Only Checks + +> **Safe:** These steps do not modify permissions or push CPV to tenants. + +### Prerequisites + +1. Deploy current `master` (includes PR #2) to **non-prod** Function App first. +2. Confirm MSP app registration exposes `ThreatSubmission.ReadWrite.All` in Entra (App registration → API permissions). + +### Check A — SAM manifest diff (Manage365 / CIPP UI) + +**UI:** CIPP → Advanced → Super Admin → **SAM App Permissions** +(`src/pages/cipp/advanced/super-admin/sam-app-permissions.js`) + +**API (read-only GET):** + +```http +GET /api/ExecSAMAppPermissions +``` + +**PowerShell equivalent (Function App Kudu / debug session with modules loaded):** + +```powershell +Get-CippSamPermissions +# Inspect: .MissingPermissions.'00000003-0000-0000-c000-000000000000'.applicationPermissions +``` + +**Expected before SAM table repair:** + +- `MissingPermissions` for Microsoft Graph may include: + +```json +{ + "id": "d72bdbf4-a59b-405c-8b04-5995895819ac", + "value": "ThreatSubmission.ReadWrite.All" +} +``` + +This is normal until `Update-CippSamPermissions` merges the manifest into the `AppPermissions` table. + +### Check B — Access permissions report + +**UI:** CIPP → Settings → **Permission Check** (Permissions tab) + +**API:** + +```http +POST /api/ExecAccessChecks?Type=Permissions&SkipCache=true +``` + +Runs `Test-CIPPAccessPermissions`, which calls `Get-CippSamPermissions` and reports: + +- `MissingPermissions` — SAM permissions not yet in AppPermissions table +- `CPVRefreshList` — tenants whose CPV timestamp is older than last SAM update +- `ErrorMessages` — auth/SAM configuration issues + +**Expected before repair:** + +- ThreatSubmission may appear under `MissingPermissions` +- Message may indicate tenants need CPV refresh (expected until rollout completes) + +### Check C — Local static validation (no Azure) + +From repo root on any machine: + +```powershell +$GraphAppId = '00000003-0000-0000-c000-000000000000' +$Guid = 'd72bdbf4-a59b-405c-8b04-5995895819ac' +$cfg = Get-Content Config/SAMManifest.json -Raw | ConvertFrom-Json +$graph = $cfg.requiredResourceAccess | Where-Object resourceAppId -eq $GraphAppId +$graph.resourceAccess | Where-Object { $_.id -eq $Guid -and $_.type -eq 'Role' } +``` + +Should return one Role entry. Repeat against `Modules/CIPPCore/lib/data/SAMManifest.json` for parity confirmation. + +--- + +## 4. Production-Side-Effect Steps + +> **WARNING:** Steps below modify MSP SAM configuration and/or tenant service principal permissions. +> **Require explicit operator approval** before execution. Complete Section 3 first. + +### Step 1 — SAM table merge (MSP partner tenant) + +Merges manifest permissions into Azure Table `AppPermissions` (`CIPP-SAM` row). + +**UI:** Permission Check → **Add Missing Permissions** button +**API:** + +```http +POST /api/ExecPermissionRepair +Content-Type: application/json + +{} +``` + +**Function:** `Update-CippSamPermissions` + +**Verify after:** + +```http +GET /api/ExecSAMAppPermissions +``` + +ThreatSubmission should be **absent** from `MissingPermissions`. + +### Step 2 — CPV refresh (test tenant first) + +**Preferred:** Single tenant before orchestrated rollout. + +**UI:** Tenant → CPV / Permissions refresh (or tenant settings equivalent) +**API (single tenant):** + +```http +POST /api/ExecCPVPermissions +Content-Type: application/json + +{ "tenantFilter": "" } +``` + +**Function:** `Set-CIPPCPVConsent` + `Add-CIPPApplicationPermission` + `Add-CIPPDelegatedPermission` + +**Tenant-wide orchestrator (use only after test tenant succeeds):** + +```http +POST /api/ExecCPVRefresh +Content-Type: application/json + +{} +``` + +**Function:** `Start-UpdatePermissionsOrchestrator` → `Push-UpdatePermissionsQueue` per tenant + +Internally calls `Add-CIPPApplicationPermission -RequiredResourceAccess 'CIPPDefaults'`, which reads merged permissions from `Get-CippSamPermissions -NoDiff` and grants missing app roles on the CIPP service principal in each tenant. + +### Step 3 — Admin consent (test tenant) + +After CPV push, in the **test tenant** Entra portal: + +1. Enterprise applications → CIPP SAM application +2. Permissions → confirm `ThreatSubmission.ReadWrite.All` appears +3. Grant admin consent if prompted +4. Verify existing application permissions unchanged except the new grant + +--- + +## 5. Test Tenant Smoke Plan + +Use **one** internal/non-production managed tenant with Defender reporting enabled. + +### 5.1 Permission validation + +| Step | Pass criteria | +|------|---------------| +| CPV push completed | No Failed results for ThreatSubmission grant | +| Entra SP permissions | `ThreatSubmission.ReadWrite.All` listed under Application permissions | +| Admin consent | Granted without removing existing roles | +| Existing permissions | Spot-check Graph app role assignments count ≥ pre-rollout count | + +### 5.2 Direct Graph probe (app-only) + +In Function App context or authenticated harness: + +```powershell +$Tenant = '' +$Since = (Get-Date).AddHours(-24).ToUniversalTime().ToString('yyyy-MM-ddTHH:mm:ssZ') +$Uri = "https://graph.microsoft.com/beta/security/threatSubmission/emailThreats?`$filter=createdDateTime ge $Since&`$top=1" +New-GraphGetRequest -uri $Uri -tenantid $Tenant -AsApp $true +``` + +| Result | Meaning | +|--------|---------| +| 200 + array (possibly empty) | Permission and endpoint OK | +| 403 / Authorization_RequestDenied | Missing consent or app registration permission | +| Other 4xx | Investigate; likely not handler bug | + +### 5.3 Alert handler smoke + +**Do not** enable `UserReportedPhishing` in global SchedulerConfig. + +```powershell +Get-CIPPAlertUserReportedPhishing -TenantFilter '' -InputValue @{ HoursBack = 24 } +``` + +| Scenario | Expected | +|----------|----------| +| No user submissions in window | Completes without fatal error; no `Write-AlertTrace` output | +| User-reported submissions exist | `Write-AlertTrace` with filtered records (`source = user`) | +| Missing consent | `Write-AlertMessage` with explicit Graph permission error — **not** unhandled exception | + +### 5.4 Sign-off + +Record: date, operator, tenant ID/domain, Graph probe result, handler result. +Attach to this runbook or `USERREPORTEDPHISHING_POST_MERGE_20260617.md`. + +--- + +## 6. Frontend Gate + +Frontend CIPP commit **`7054bfc4`** (`src/data/alerts.json` → `UserReportedPhishing`) remains **blocked** until **all** of: + +- [ ] API deployed to target environment +- [ ] SAM table merge completed (`ExecPermissionRepair`) +- [ ] CPV refresh completed on test tenant (then prod rollout as approved) +- [ ] Test tenant admin consent confirmed +- [ ] Backend smoke test passed **or explicitly waived** + +Alert name mapping when enabled: `UserReportedPhishing` → `Get-CIPPAlertUserReportedPhishing`. + +--- + +## 7. Rollback / Safety + +| Control | Guidance | +|---------|----------| +| Dormant handler | Safe — backend function exists but produces no user-visible alerts without frontend + scheduler config | +| Scheduler config | **Do not** globally enable `UserReportedPhishing` until smoke test passes | +| Permission rollback | Removing app role assignment in tenant Entra is manual; test on one tenant before prod-wide CPV | +| Code rollback | Backup tag `backup/pre-userreportedphishing-api-20260617` marks pre-feature `master` (`15df6c850`); revert only if handler causes harm | +| Frontend | Keep `7054bfc4` out of CIPP until backend rollout sign-off | + +### Pre-existing manifest parity note + +`Config/SAMManifest.json` contains Graph Role `7e05723c-0bb0-42da-be95-ae9f08a6e53c` not present in `lib/data/SAMManifest.json`. This predates UserReportedPhishing and does not block rollout (CPV uses Config only). Address separately if full parity is required. + +--- + +## Quick Reference — Operator Command Summary + +| Action | Method | Side effects | +|--------|--------|--------------| +| Read SAM diff | `GET /api/ExecSAMAppPermissions` | None | +| Read access report | `POST /api/ExecAccessChecks?Type=Permissions&SkipCache=true` | None | +| Merge SAM table | `POST /api/ExecPermissionRepair` | **Yes** — MSP table | +| CPV single tenant | `POST /api/ExecCPVPermissions` + `{ tenantFilter }` | **Yes** — one tenant | +| CPV all tenants | `POST /api/ExecCPVRefresh` | **Yes** — all eligible tenants | +| Smoke handler | `Get-CIPPAlertUserReportedPhishing -TenantFilter ... -InputValue @{ HoursBack = 24 }` | Read-only Graph query | + +--- + +## Related Docs + +- `docs/upstream-sync/USERREPORTEDPHISHING_API_20260617.md` — import tracking +- `docs/upstream-sync/USERREPORTEDPHISHING_POST_MERGE_20260617.md` — post-merge validation record diff --git a/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md new file mode 100644 index 0000000000..214b56a32d --- /dev/null +++ b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_20260617.md @@ -0,0 +1,75 @@ +# Applied Commits Tracking — CIPP (Frontend) + +Generated: 2026-06-17 +Branch: `manage365/upstream-sync-cipp-20260617` +Backup tag: `backup/pre-upstream-sync-cipp-20260617` +Branch tip: latest on `manage365/upstream-sync-cipp-20260617` (checkpoint pass complete) + +## Summary + +| Status | Count | +|--------|-------| +| Applied cleanly | 7 | +| Applied with adaptation | 3 | +| Deferred / reverted from branch | 1 | +| Reverted (formatting-only / no net change) | 1 | +| Already implemented | 5 | +| Skipped (conflict) | 1 | +| Conflicts | 4 (`b1902421`, `1e7aef11`, `2e9b9fd5`, `d7e8b0b5` cherry-pick) | + +Mini-batch 1: `1e59d2d4`, `98d5d94a` applied; `c8d61c07` reverted after review. +Mini-batch 2: `7a85827e` applied; `cfbf3508`, `db57e52a` already present; `b1902421` conflict. +Mini-batch 3: `1cd1ef72` adapted manually (two commits); `4b9efd82`, `3734adee` cherry-picked on retry. +Mini-batch 4: `0c32a84e` cherry-picked cleanly; `1e7aef11` adapted after conflict; `7054bfc4` deferred (see below). +Post batch 4: `2e9b9fd5` drawer guard adapted after cherry-pick conflict. +Mini-batch 5: `d7e8b0b5` + `1cb6a11c` already implemented in fork `377ce394b`; verified parity, no code delta. + +## Commit Log + +| Upstream SHA | Applied SHA | Status | Reason | Files | Tests | Notes | +|--------------|-------------|--------|--------|-------|-------|-------| +| `1e59d2d43fab463a709d1dac2477f45cfacdfae6` | `623ac8590` | Applied cleanly | Shape test baseline update only | `Tests/Shapes/ListTests.json` | JSON parse OK | Adds `ExoTransportConfig` to ListTests shape. | +| `98d5d94a0d122d5fbc7380d5abe5cb02fba366fd` | `f3c917c1a` | Applied cleanly | Custom test alert-on-status UI; pairs with API `6aa66c74` | `src/pages/tools/custom-tests/add.jsx` | Static review | `AlertStatuses` multi-select gated on `AlertOnFailure`. | +| `c8d61c0757853359cde98f9a00e6e3ba6fe6e98e` | `aebf6ada5` → reverted `af5c9a905` | Already implemented before sync; reverted noisy formatting-only cherry-pick | JIT admin autocomplete creatable guard | `src/pages/identity/administration/jit-admin/add.jsx` | Static review post-revert | Fork already had `creatable={false}` on all five autocomplete fields. | +| `cfbf3508e1ede8b51ef6daff780356ea0379f083` | — | Already implemented | Duplicate `appliesToTest` merge | `src/data/standards.json` | JSON compare | Skipped cherry-pick. | +| `db57e52a207f3e9d77974832978d88963859bf83` | — | Already implemented | TemplateList optional + non-creatable | `src/data/standards.json` | JSON compare | Skipped cherry-pick. | +| `b19024214e96bd207640c5e63dcefb38d408e161` | — | Skipped (conflict) | Tab layout first-tab margin | `HeaderedTabbedLayout.jsx`, `TabbedLayout.jsx` | Not applied | Layout conflict; needs adapted apply. | +| `7a85827ef1072955a48cb1d48c3ce2aafe3ab88d` | `bb5150d99` | Applied cleanly | Bulk patch wizard contact/UPN fields | `src/pages/identity/administration/users/patch-wizard.jsx` | Static review | Cherry-pick `-x` succeeded. | +| `1cd1ef7223672170bdce1fffe88d8bb4ddb903d9` | `dc44bd9d1` + `1688fbca0` | Applied with adaptation (fully adapted) | TAP audit log template filter | `src/data/AuditLogTemplates.json` | JSON parse OK | Cherry-pick conflicted; manual adaptation: (1) `like` `"*"` → `"*PassId*"`; (2) duplicate `ne []` SecuredAccessPassData filter removed. | +| `4b9efd827d27a3498eca51b444934a99e78c634f` | `dce16f09c` | Applied cleanly | Licenses report `apiDataKey="Results"` | `src/pages/tenant/reports/list-licenses/index.js` | Static review | Cherry-pick `-x` succeeded on mini-batch 3 retry. | +| `3734adeeaec92e6d83974590c36a9e91bf024a98` | `7a6c71950` | Applied cleanly | User defaults license label casing | `src/pages/tenant/manage/user-defaults.js` | Static review | Cherry-pick `-x` succeeded; `AvailableUnits` → `availableUnits`. | +| `7054bfc42d67a7f3d86b23b036057ba98559d488` | `de565d5f9` → reverted `b0fcc3129` | **Deferred / reverted from frontend branch** | UserReportedPhishing alert definition | `src/data/alerts.json` | JSON parse OK | Cherry-picked in mini-batch 4, then removed: matching CIPP-API handler `Get-CIPPAlertUserReportedPhishing.ps1` and `ThreatSubmission.ReadWrite.All` SAM/CPV chain not imported yet. **Revisit only as paired frontend + CIPP-API feature import.** | +| `1e7aef11995feb42e9872ec4aefac39fc7ba67c5` | `ad8f64688` | Applied with adaptation | Quota alert run intervals `4h` → `1d` | `src/data/alerts.json` | JSON parse OK | Cherry-pick conflicted on fork `QuotaUsed` `multipleInput` schema; manually set SharePointQuota and OneDriveQuota to `1d`. QuotaUsed already `1d`. | +| `0c32a84eb21d3df3a719427b54d10821a94b40a4` | `52cf36559` | Applied cleanly | Hudu extension portal link toggles | `src/data/Extensions.json` | JSON parse OK | Data-only switches: Partner Center, Defender, Compliance (Purview). No navigation/branding changes. | +| `2e9b9fd508f2e9ae6fddffa9f03db7c8edb22881` | `ac59795fb` | Applied with adaptation | Hide open button when drawer is controlled | `CippTenantAllowBlockListTemplateDrawer.jsx` | Static review | Cherry-pick conflicted: fork lacks upstream `editData`/`isEditMode` controlled-drawer stack (`bc412396b`). Adapted: optional `drawerVisible: controlledDrawerVisible` prop + `controlledDrawerVisible === undefined` guard only. Uncontrolled page usage unchanged. | +| `d7e8b0b569c3f9243ff7e09a326ed74ccbd3a046` | `377ce394b` | **Already implemented** | Toggle button size/sx on alignment page | `standards/alignment/index.js` | Static review | Incorporated when fork ported by-standard view (`377ce394b`). Cherry-pick `-x` conflicted (formatting-only); verified identical `MuiToggleButton-root` sx on tenant filter and view-mode toggles. | +| `1cb6a11cf22c446b952976f5200f5a3f3df689f5` | `377ce394b` | **Already implemented** | Standard name retrieval priority | `standards/alignment/index.js` | Static review | `hasExactMatch` + label/`row.standardName`/`standardKey` fallback chain already present in `377ce394b`. No code delta on sync branch. | + +## Mini-batch 5 Validation — Standards Alignment Pair (2026-06-17) + +| Check | Result | +|-------|--------| +| Pre-check protected areas | Both commits touch only `src/pages/tenant/standards/alignment/index.js` — no protected overlap | +| `d7e8b0b5` cherry-pick | Conflict — fork already has toggle sx (`py: 0.25`, `px: 1`, `fontSize: 0.75rem`) on both ToggleButtonGroups | +| `1cb6a11c` cherry-pick | Not attempted separately — same file; logic already present | +| Toggle buttons | Still render; only size/style sx applied; no behavior change | +| Standard name retrieval | `hasExactMatch ? (label ?? row.standardName ?? key) : (row.standardName ?? label ?? key)` — safe fallbacks when fields missing | +| Data fetching / tenant / permissions | Unchanged | +| Full frontend build/lint | Not run — known pre-existing dependency blockers | + +## Proposed Next Candidates (post-checkpoint) + +| Priority | SHA | Title | Notes | +|----------|-----|-------|-------| +| 1 | `7054bfc4` + API pair | UserReportedPhishing alert | Paired with CIPP-API handler + SAM permission | +| 2 | `b1902421` | Tab layout first-tab margin | Adapted manual apply only | +| 3 | `bc412396b` / `20e2f554d` | Allow/block list edit mode | Full controlled-drawer stack | +| 4 | `4c0c058f` | Alerts schema change | Higher risk — review before apply | + +**Exclude:** `16b4503f`, dependency/build/search/table commits unless explicitly approved. + +## Next Steps + +1. Final code-review-only pass on sync branch diff vs `main`. +2. Open CIPP frontend PR paired with CIPP-API PR #1 review. +3. Do not continue upstream picks without explicit approval per candidate. diff --git a/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md new file mode 100644 index 0000000000..0783efac4e --- /dev/null +++ b/docs/upstream-sync/history-cipp/APPLIED_COMMITS_CIPP_CYCLE2_20260617.md @@ -0,0 +1,97 @@ +# CIPP Frontend — Upstream Sync Cycle 2 Mini-Batch (2026-06-17) + +**Branch:** `manage365/upstream-sync-cipp-cycle2-20260617` +**Base:** `main` @ `c88e7c9edc3dc8d14cf208884a8f69b9d0775bd2` +**Backup tag:** `backup/pre-upstream-sync-cipp-cycle2-20260617` (created) +**Pushed:** No + +## Summary + +| SHA | Subject | Status | Notes | +|-----|---------|--------|-------| +| `c15d1d0d` | fix: sherweb integration conditional fields | **Skipped (conflict)** | `Extensions.json` merge conflict — local fork has no Sherweb integration block; upstream patch targets Sherweb conditional `.value` field paths | +| `f768330c` | fix(standards): move CIS 5.1.4.1 and SMB1001 (2.8) tags to join standard | **Skipped (conflict / already implemented)** | Cherry-pick conflict on `standards.json`. Local `standards.intuneRestrictUserDeviceJoin` already carries `CIS_5_1_4_1` / `SMB1001_2_8` tags; registration standard tags already empty (CIS version string differs: local `CIS M365 7.0.0` vs upstream `6.0.1`) | +| `5709f856` | fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" | **Applied (adapted)** | Manual UI-text port in `CippUserActions.jsx` only (label + confirmText). `standards.json` TAP strings already correct — **Already implemented**, no file change | + +**Applied commits:** `5709f856` (adapted, partial scope) +**Branch tip after cycle:** see `git log -1` on branch (code + docs) + +## Pre-checks (protected areas) + +All three commits touched only `src/data/Extensions.json`, `src/data/standards.json`, and/or `src/components/CippComponents/CippUserActions.jsx`. None modified Quarantine, Email Troubleshooter, branding/manage365-version, tenant switching, auth, navigation, `package.json`, ApiCall helpers, or dashboard v2. + +## Per-commit detail + +### `c15d1d0d` — Sherweb Extensions conditional fields + +- **Files:** `src/data/Extensions.json` +- **Protected-area check:** Pass +- **Action:** `git cherry-pick -x c15d1d0d` → **CONFLICT** in `src/data/Extensions.json` +- **Resolution:** Stopped per policy; `git cherry-pick --abort` +- **Do not retry** in cycle 2 without Sherweb block present. + +### `f768330c` — standards.json tag fix (CIS / SMB1001 join vs registration) + +- **Files:** `src/data/standards.json` +- **Protected-area check:** Pass +- **Action:** `git cherry-pick -x f768330c` → **CONFLICT** in `standards.json` +- **Resolution:** Stopped per policy; `git cherry-pick --abort` +- **Equivalence:** Tag move appears already reflected on `main` with updated CIS catalog version. +- **Do not retry** in cycle 2. + +### `5709f856` — TAP terminology + +- **Files (upstream):** `src/components/CippComponents/CippUserActions.jsx`, `src/data/standards.json` +- **Protected-area check:** Pass (component not in protected list) +- **Action:** Cherry-pick failed (conflict); **manual adapted apply** on 2026-06-17 +- **Changes:** + - `CippUserActions.jsx`: `Create Temporary Access Password` → `Create Temporary Access Pass`; confirm dialog wording updated to match + - `standards.json`: no edit — TAP labels/help already use "Temporary Access Pass" +- **Validation:** Diff limited to two user-visible strings; no logic, API URL, permissions, or field changes + +## JSON validation (post-cycle, working tree) + +Validated with `python3 -m json.tool` equivalent (`json.load`): + +| File | Result | +|------|--------| +| `src/data/Extensions.json` | OK | +| `src/data/standards.json` | OK | +| `src/data/AuditLogTemplates.json` | OK | + +## TAP terminology sweep (2026-06-17) + +Repo-wide search for user-facing legacy TAP wording in `src/` (excluding docs). + +### Findings + +| Location | String | Action | +|----------|--------|--------| +| `CippUserActions.jsx` | Create / confirm TAP strings | **Already fixed** (`943e57f11`, upstream `5709f856` adapted) | +| `users/index.js` `mobileQuickActions` | `Create Temporary Access Password` | **Fixed** → `Create Temporary Access Pass` (`722b2a025`) | +| `standards.json`, `AuditLogTemplates.json` | Temporary Access Pass | **Already correct** | +| `jit-admin/*.jsx` | `Generate TAP`, `UseTAP`, field names | **Left unchanged** — internal/API identifiers or standard TAP acronym | +| `/api/ExecCreateTAP` | endpoint path | **Left unchanged** — not a user-facing label | + +### Wording change (`722b2a025`) + +| File | Before | After | +|------|--------|-------| +| `users/index.js` | `"Create Temporary Access Password"` | `"Create Temporary Access Pass"` | + +### Validation + +- Single string in `mobileQuickActions`; no logic, permissions, or API changes. +- Matches `CippUserActions` action label so mobile quick-action filter works. +- No remaining user-facing `Temporary Access Password` in `src/`. + +## CIPP-API cycle 2 (paused) + +Branch `manage365/upstream-sync-cipp-api-cycle2-20260617` paused docs-only; ORCA mini-batches all empty/already implemented. No further ORCA/DB-cache work without explicit approval. + +## Issues / next steps + +1. **Sherweb (`c15d1d0d`):** Deferred — requires upstream Sherweb `Extensions.json` block. +2. **Standards tags (`f768330c`):** Deferred / satisfied on fork. +3. **PR:** Two small UI terminology commits ready — recommend opening a **small CIPP PR** now, or continue batching from delta inventory. + diff --git a/docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md b/docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md new file mode 100644 index 0000000000..f25c2fe520 --- /dev/null +++ b/docs/upstream-sync/history-cipp/BASELINES_INTAKE_20260814.md @@ -0,0 +1,25 @@ +# Baselines Feature Intake — 2026-08-14 + +Cycle type: **Feature intake** within major 10.8.x sync. Per [PROCESS.md](PROCESS.md). + +## Feature: Baselines (drift-first engine) + +- Upstream refs: `Modules/CIPPCore/Public/Baselines/*` (29), `Set-CippBaselineRunContext.ps1`, `Start-CIPPBaselineOrchestrator`, HTTP Baseline* entrypoints, `Config/BaselineStandards/**`, FE `src/pages/tenant/baselines/**` + `CippBaselines/*`, FeatureFlags `Baselines`, timer `9f2c7b1e-4a6d-4c3f-8b9a-5e1d2f7c0a44` +- Fork gap: no baselines pages/APIs/modules +- Protected conflicts: Applied Standards / drift UI — baselines are **parallel**, not a replacement; Adapt any shared Intune compare helpers +- Scope: **capability** on existing SWA + Function App Durable — no Craft, no EasyAuth migration +- Hosting: Azure Tables (`Baselines`, `BaselineRollouts`, `BaselineAlignment`, history/trend/locks) + existing `Start-CIPPOrchestrator` / standards processor slot +- Flag behavior: `Enabled: false` by default; flag gates **scheduled timer only**; pages/on-demand work when flag off (upstream design). Manage365 keeps flag off until smoke; optionally hide nav until enabled +- Phases: design → API modules/config/HTTP/orch → FE pages/components → verify → PR → deploy → enable flag after smoke +- Approval: [x] design (approved via major-cycle plan execute) [x] implement [ ] deploy (enable) + +## Branding (sibling Adapt) + +- Upstream: `ListBrandingSettings`, `ListBrandingPresets`, `Get-CIPPBranding*`, PDF cover helpers +- Fork: keep Manage365 `CippBrandingSettings` / `customBranding`; surgical merge only — do not wipe branding UX + +## Explicit non-goals + +- Replacing Applied Standards with Baselines +- Enabling Baselines timer in production by default +- Porting SSO/container nav that co-landed in 10.8 diff --git a/docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md new file mode 100644 index 0000000000..187eeccfb6 --- /dev/null +++ b/docs/upstream-sync/history-cipp/BEC_INTAKE_20260715.md @@ -0,0 +1,64 @@ +# BEC (Compromise Remediation) Intake — July 15, 2026 + +Cycle type: **Feature intake** per [PROCESS.md](PROCESS.md). + +Upstream commits taken — frontend: `8359da60e` (sent messages check), `488541e0a` (recent inbox +rule changes), `a445e3981` (trusted/blocked senders checks), `cb81f1a07` (collapsible compact +check cards), `c1fb0f92a` (senders/sent-emails as tables). API: `15dc7816e` / `f95046cbe` +(inbox rule changes in `Push-BECRun`), plus retained `42087aefc` (message trace) which the fork +partially had. + +Fork version bumped **5.19.0 → 5.20.0** (upstream baseline unchanged at 10.6.1). + +## Taken + +### CIPP-API — `Push-BECRun.ps1` (both `CIPPActivityTriggers` and `CIPPCore` copies) + +- **Copies resynced.** The `CIPPCore` copy — the one the fork's `profile.ps1` actually loads — + was stale and missing the entire `SentMessages` (message trace) block, so the Sent Messages + data was never produced in production. Both copies are now identical. +- **Inbox rule changes** (upstream): a separate user-scoped `Search-UnifiedAuditLog` for + `New-InboxRule` / `Set-InboxRule` / `Remove-InboxRule` / `UpdateInboxRules`, surfaced as + `InboxRuleChanges`. Existing rules gain a `RecentlyChanged` flag when their name matches a + 7-day audit event. +- **Better failure logging** (upstream): rules/trace failures log through `Write-LogMessage` + with normalized errors; the error entity now carries `ExtractedAt`. +- **Fork customization preserved:** the extra `MailboxLogin` / `UserLoggedIn` operations in the + 7-day tenant-wide audit search. +- **Manage365 addition — safelist backend.** Upstream's UI ships a "Trusted & Blocked Senders" + check (Check 8) but **no upstream branch produces the fields** (`TrustedSenders`, + `BlockedSenders`, `SafelistChanges`) — upstream's check renders empty today. We implemented + the producer: `Get-MailboxJunkEmailConfiguration` for the current trusted/blocked lists and a + user-scoped audit search for `Set-MailboxJunkEmailConfiguration` events (7 days) shaped as + `{ Operation, UserKey, Date, Trusted, Blocked }` to match what the UI and PDF report render. + Watch for upstream shipping their own producer later; theirs should supersede ours if shapes + match. + +### CIPP — Compromise Remediation UI + +- **`bec.jsx`** — merged upstream's compact accordion layout into the fork's page: every check + is now a collapsed accordion with a count chip (amber when findings exist), lists cap at 300px + with scrolling, sent messages and trusted/blocked senders render as `CippDataTable` tables. + New content: inbox rule changes sub-section in Check 1 with `RecentlyChanged` sorting/labels, + Sent Messages (Check 5), Trusted & Blocked Senders (Check 8) with safelist change history. + Checks renumbered to match upstream (MFA 6, Passwords 7). + **Fork customizations preserved:** no-user-selected / user-not-found / loading-skeleton page + states, header `userActions`, `CippTimeAgo` subtitle, responsive grid (`xs`/`md` sizes), + theme-aware loading banner, memoized check card. +- **`BECRemediationReportButton.js`** — adopted upstream wholesale (fork's copy was an older + upstream version with no customizations). The PDF report now covers inbox rule changes and + trusted/blocked senders, and both feed the threat score. +- **`CippButtonCard.jsx`** — accordion header now stretches (`flexGrow: 1`) so check titles can + right-align their chips, and the stray divider between a collapsed accordion summary and its + details was removed (upstream change). Fork's hover-shadow interaction kept. + +## Verification + +- `yarn build` (Node 22): pass, no lint errors on the three touched frontend files. +- PowerShell parser on both `Push-BECRun.ps1` copies: 0 errors. +- `package.json` / `yarn.lock` intact after build (rm-removal holding). + +## Deferred + +- `c1fb0f92a`'s removal of per-item icons in favor of chips was taken; no part of the BEC family + remains deferred. diff --git a/docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md b/docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md new file mode 100644 index 0000000000..7106ab91ec --- /dev/null +++ b/docs/upstream-sync/history-cipp/CIPP_SYNC_CHECKPOINT_20260617.md @@ -0,0 +1,123 @@ +# CIPP Frontend Sync Checkpoint — 2026-06-17 + +## Branch + +| Field | Value | +|-------|-------| +| Branch | `manage365/upstream-sync-cipp-20260617` | +| Base | `main` @ `f2d87612ec80b9be24c303137c9604590992b144` | +| Tip | Latest — `docs: update CIPP frontend sync checkpoint` (run `git rev-parse HEAD` on branch) | +| Backup tag | `backup/pre-upstream-sync-cipp-20260617` (local, not pushed) | +| Working tree | Clean | +| Remote push | Nothing pushed | + +## Mini-batches Completed + +### Mini-batch 1 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `1e59d2d4` | Update ListTests.json | Applied → `623ac8590` | +| `98d5d94a` | Custom Test — Alert on X statuses | Applied → `f3c917c1a` | +| `c8d61c07` | JIT admin — remove creatable | Already implemented; noisy cherry-pick reverted → `af5c9a905` | + +### Mini-batch 2 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `cfbf3508` | Remove duplicate appliesToTest | Already implemented — skipped | +| `db57e52a` | TemplateList optional/non-creatable | Already implemented — skipped | +| `b1902421` | Tab layout first-tab margin | Skipped/deferred — layout conflict | +| `7a85827e` | Bulk patch wizard contact/UPN | Applied → `bb5150d99` | + +### Mini-batch 3 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `1cd1ef72` | TAP audit log template filter | Adapted → `dc44bd9d1` + `1688fbca0` | +| `4b9efd82` | Licenses report apiDataKey | Applied → `dce16f09c` | +| `3734adee` | User defaults license label | Applied → `7a6c71950` | + +### Mini-batch 4 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `7054bfc4` | UserReportedPhishing alert | Applied → `de565d5f9`, then deferred → `b0fcc3129` | +| `1e7aef11` | Quota alert intervals | Adapted → `ad8f64688` | +| `0c32a84e` | Extensions portal links | Applied → `52cf36559` | + +### Post mini-batch 4 + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `2e9b9fd5` | Drawer button guard | Adapted → `ac59795fb` | + +### Mini-batch 5 — Standards alignment pair + +| Upstream | Title | Outcome | +|----------|-------|---------| +| `d7e8b0b5` | Toggle button size | Already implemented in `377ce394b` — verified parity | +| `1cb6a11c` | Standard name retrieval | Already implemented in `377ce394b` — verified parity | + +## Applied Commits (sync branch code) + +| Upstream | Applied SHA | Files | +|----------|-------------|-------| +| `1e59d2d4` | `623ac8590` | `Tests/Shapes/ListTests.json` | +| `98d5d94a` | `f3c917c1a` | `src/pages/tools/custom-tests/add.jsx` | +| `7a85827e` | `bb5150d99` | `src/pages/identity/administration/users/patch-wizard.jsx` | +| `1cd1ef72` | `dc44bd9d1`, `1688fbca0` | `src/data/AuditLogTemplates.json` | +| `4b9efd82` | `dce16f09c` | `src/pages/tenant/reports/list-licenses/index.js` | +| `3734adee` | `7a6c71950` | `src/pages/tenant/manage/user-defaults.js` | +| `1e7aef11` | `ad8f64688` | `src/data/alerts.json` | +| `0c32a84e` | `52cf36559` | `src/data/Extensions.json` | +| `2e9b9fd5` | `ac59795fb` | `CippTenantAllowBlockListTemplateDrawer.jsx` | + +## Adapted Commits + +| Upstream | Applied SHA | Adaptation | +|----------|-------------|------------| +| `1cd1ef72` | `dc44bd9d1` + `1688fbca0` | Manual TAP filter: `*PassId*` + remove duplicate `ne []` | +| `1e7aef11` | `ad8f64688` | Quota intervals only; fork `QuotaUsed` schema differs | +| `2e9b9fd5` | `ac59795fb` | Partial guard without full controlled/edit drawer stack | + +## Already Implemented (pre-sync or prior fork port) + +| Upstream / Fork | Title | Evidence | +|-----------------|-------|----------| +| `c8d61c07` | JIT creatable guard | Five `creatable={false}` on JIT admin autocompletes | +| `cfbf3508` | Duplicate appliesToTest | Single merged `appliesToTest` in standards.json | +| `db57e52a` | TemplateList optional/non-creatable | CA TemplateList already configured | +| `377ce394b` | By-standard alignment view + fixes | Includes `d7e8b0b5` toggle sx and `1cb6a11c` name retrieval | + +## Reverted / Deferred + +| Upstream | Applied then reverted | Reason | +|----------|----------------------|--------| +| `c8d61c07` | `aebf6ada5` → `af5c9a905` | Formatting-only cherry-pick; already implemented | +| `7054bfc4` | `de565d5f9` → `b0fcc3129` | No matching CIPP-API handler or ThreatSubmission SAM chain | + +## Skipped (conflict — not applied) + +| Upstream | Title | Reason | +|----------|-------|--------| +| `b1902421` | Tab layout first-tab margin | Layout conflict in tab components | + +## Known Concerns + +1. **UserReportedPhishing deferred** — Revisit only as paired frontend (`7054bfc4`) + CIPP-API (`Get-CIPPAlertUserReportedPhishing.ps1`, `ThreatSubmission.ReadWrite.All` SAM/CPV). +2. **`b1902421` tab margin** — Still deferred; needs adapted manual apply in fork responsive layout. +3. **`7a85827e` patch wizard** — Smoke test UPN suffix rebuild and bulk contact updates in a test tenant. +4. **Drawer guard partial** — `2e9b9fd5` adapted without full upstream controlled/edit drawer stack (`bc412396b` / `20e2f554d`). +5. **Build/lint** — Full frontend build/lint not validated; known pre-existing dependency/tooling blockers may remain. + +## Recommendation + +**Ready for frontend PR review** after a final code-review-only pass on the branch diff vs `main`. + +Do **not** continue upstream cherry-picks without explicit approval per candidate. Remaining isolated picks (`b1902421`, `7054bfc4`+API, allow/block edit mode, `4c0c058f`) should be triaged individually. + +## Tracking Docs + +- `docs/upstream-sync/APPLIED_COMMITS_CIPP_20260617.md` +- `docs/upstream-sync/UPSTREAM_SYNC_CIPP_20260617.md` diff --git a/docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md new file mode 100644 index 0000000000..8eae08dab6 --- /dev/null +++ b/docs/upstream-sync/history-cipp/COPILOT_AI_INTAKE_20260715.md @@ -0,0 +1,84 @@ +# Copilot & AI Feature Intake — 2026-07-15 + +Dedicated feature intake cycle: ports the upstream **Copilot & AI** feature family +(deferred in the 2026-07-13 major sync) into Manage365, plus the upstream +**CIPP-API 10.6.2 hotfix**. + +- Frontend branch: `manage365/copilot-intake-20260715` (backup tag `backup/pre-copilot-intake-20260715`) +- API branch: `manage365/copilot-intake-20260715` (backup tag `backup/pre-copilot-intake-20260715`) +- Fork version: **5.18.0** (upstream baseline 10.6.1 frontend / 10.6.2 API) + +## CIPP-API — Copilot & AI + +Ported from upstream tip (files were near-fully additive, so taken wholesale +rather than by cherry-pick chain): + +| Area | Files | +| --- | --- | +| Shadow AI catalog | `Config/ShadowAI.json` (curated, PR-editable AI tool catalog) | +| HTTP endpoints | `Invoke-ListShadowAI`, `Invoke-ExecShadowAISanction`, `Invoke-ListCopilotSettings`, `Invoke-ExecCopilotSettings`, `Invoke-ListCopilotUsage`, `Invoke-ListAgent365Packages`, `Invoke-ListAgent365PackageDetail` (all under `Tenant/Standards`) | +| Standards | `Invoke-CIPPStandardCopilotSettings`, `Invoke-CIPPStandardCopilotLimitedMode` + their `Config/standards.json` entries (cat: "Copilot (M365) Standards") | +| DB cache setters | Refreshed the four `Set-CIPPDBCacheCopilot*` functions to upstream tip (consolidated `-AddCount` call pattern) | + +Already present from the 2026-07-13 sync (no action needed): CopilotReadiness +test suite (17 tests), the four Copilot DB cache types in +`Config/CIPPDBCacheTypes.json`, and the `CopilotUsage` group in +`Invoke-CIPPDBCacheCollection.ps1`. + +### SAM Manifest permissions added (both `Config/SAMManifest.json` and `Modules/CIPPCore/lib/data/SAMManifest.json`) + +| Permission | GUID | Type | +| --- | --- | --- | +| CopilotPackages.ReadWrite.All | `ed31732f-9495-47ed-ba3b-4ed0948c1c64` | Role | +| CopilotPackages.Read.All | `72f0655d-6228-4ddc-8e1b-164973b9213b` | Role | +| CopilotPolicySettings.Read | `556d5e2e-1081-4452-8147-26c3a1b06f58` | Role | + +**Action required:** add these three application permissions to the SAM app +registration in the MSP tenant and run a CPV refresh so they reach client +tenants. Graph endpoints used are `/beta/copilot/admin/*` and +`/beta/copilot/reports/*`. + +### Dependencies verified in fork + +`New-CIPPDbRequest`, `Get-CIPPDbItem -CountsOnly`, `Add-CIPPDbItem -AddCount`, +and the `DetectedApps` / `ServicePrincipals` / `OAuth2PermissionGrants` caches +all exist. Shadow AI sign-in enrichment degrades gracefully without Entra P1. + +## CIPP-API — 10.6.2 hotfix intake + +Cherry-picked from upstream `Dev to hf (#2140)`: + +- `610ec61e7` fix(graph): reconcile AppCache app id drift — merged into the + fork's `Get-GraphToken.ps1` **preserving the fork's shared token cache / + lock wrapper**; only the AppCache-vs-KeyVault reconcile block was adopted. +- `176d43baa` force external uri to be partner center (partner webhooks) +- `2da187218` move snooze endpoints to new `CIPP.AlertSnooze.*` permission +- Version bumped to **10.6.2** (`version_latest.txt` + `Config/version_latest.txt`) + +Skipped: + +- `ad9caf3ff` OneDrive root permissions cache — upstream marks it + "boilerplate, not implemented yet"; revisit when upstream wires it up. +- `8c4cf8d94` MCP resolver fix — fork has no MCP module yet (MCP intake still + deferred). + +## CIPP frontend — Copilot & AI + +- Ported all six pages under `src/pages/copilot/` (Shadow AI Discovery, + Copilot Settings, Agent365 Packages, Adoption / Trend / User Activity + reports) and `src/components/ShadowAIReportButton.js` from upstream tip. +- Added the **Copilot & AI** menu section to `src/layouts/config.js` between + Security & Compliance and Email & Exchange (upstream placement), restyled to + the fork's double-quote convention; added `SparklesIcon` import. +- All page dependencies (CippTablePage, CippChartCard, CippInfoBar, + CippApiDialog, CippOffCanvas, CippJSONView, use-dialog) already exist in the + fork. + +## Verification + +- `yarn build` (Node 22): success, all six `/copilot/*` routes emitted; + `package.json` / `yarn.lock` intact after build (per the 20260713 build + script fix). +- PowerShell parse check on all 13 added/changed API files plus + `Get-GraphToken.ps1`: clean. +- `Config/standards.json` and both SAM manifests validated as JSON. diff --git a/docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md b/docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md new file mode 100644 index 0000000000..385900e0ac --- /dev/null +++ b/docs/upstream-sync/history-cipp/CUSTOM_FEATURE_MAP_20260617.md @@ -0,0 +1,266 @@ +# Custom Feature Map — Manage365/CIPP + +Generated: 2026-06-17 11:21 + +Purpose: Protected areas that must not be overwritten during upstream sync. + +## Git State at Generation Time + +| Repo | Branch | Tip | Upstream behind | +|------|--------|-----|-----------------| +| CIPP | `main` | `f2d87612e` | 241 commits (`upstream/main`) | +| CIPP-API | `master` | `de78a343e` | 315 commits (`upstream/master`) | + +## Protected Custom Areas + +### Manage365 Branding & Versioning + +**Purpose:** Fork identity, version display, OAuth branding, release tooling separate from upstream version.json + +**Risk if overwritten:** Critical — overwriting removes product identity and version tracking + +**Upstream overlap likelihood:** High — upstream touches version.json, settings pages, logo, README regularly + +**Notes for conflict resolution:** Preserve manage365-version.json as primary display version. Update-Version.ps1 writes both upstream and Manage365 versions. Get-CippAlerts includes Manage365-specific upstream drift alerts. + +**CIPP files:** +- `public/manage365-version.json` +- `public/version.json` +- `Tools/Update-Version.ps1` +- `src/components/CippSettings/CippVersionProperties.jsx` +- `src/components/logo.js` +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/components/ReleaseNotesDialog.js` +- `README.md` + +**CIPP-API files:** +- `version_latest.txt` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetCippAlerts.ps1` + +--- + +### Quarantine Portal 5.13.0 + +**Purpose:** Advanced quarantine management UI, shared components, server-side filtering, export, bulk actions, lazy detail loading + +**Risk if overwritten:** Critical — major custom feature set beyond upstream + +**Upstream overlap likelihood:** Very High — upstream actively changes quarantine endpoints and UI + +**Notes for conflict resolution:** Uses EXO PowerShell not Graph. manualPagination, post-filters, 7d default window, export cap 5k. Never auto-resolve conflicts toward upstream. + +**CIPP files:** +- `src/components/CippComponents/quarantine/` +- `src/pages/email/administration/quarantine/index.js` +- `Tests/Shapes/GetMailQuarantineMessage.json` +- `Tests/Shapes/ListQuarantinePolicy.json` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tools/Build-CIPPQuarantineQueryParams.ps1` +- `Tests/Tools/Build-CIPPQuarantineQueryParams.Tests.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ListMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-GetMailQuarantineMessage.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExportMailQuarantine.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecQuarantineManagement.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Spamfilter/Invoke-ExecMailboxSafeSender.ps1` +- `Modules/CIPPCore/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `Modules/CIPPActivityTriggers/Public/Entrypoints/Activity Triggers/Push-ListMailQuarantineAllTenants.ps1` +- `docs/QUARANTINE_FEATURES.md` +- `Tests/Endpoint/Invoke-GetMailQuarantineMessage.Tests.ps1` +- `Tests/Endpoint/Invoke-ExportMailQuarantine.Tests.ps1` + +--- + +### Email Troubleshooter Enhancements + +**Purpose:** Integrated quarantine tab, trace presets, bulk refresh fixes, shared quarantine UI in troubleshooter context + +**Risk if overwritten:** High — tightly coupled to quarantine shared module + +**Upstream overlap likelihood:** High — upstream changes email tools and troubleshooting pages + +**Notes for conflict resolution:** ExecEmailTroubleshoot reuses Build-CIPPQuarantineQueryParams. Preserve trace/EML preset behavior. + +**CIPP files:** +- `src/pages/email/troubleshooting/email-troubleshooter/index.js` +- `src/pages/email/troubleshooting/message-viewer/index.js` +- `docs/superpowers/plans/2026-03-21-email-troubleshooter.md` +- `docs/superpowers/specs/2026-03-21-email-troubleshooter-design.md` + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Tools/Invoke-ExecEmailTroubleshoot.ps1` + +--- + +### Custom Tenant Workflows + +**Purpose:** Tenant management, GDAP onboarding, tenant mode deployment, configuration backup/restore + +**Risk if overwritten:** High — core MSP workflow customizations + +**Upstream overlap likelihood:** Medium-High — upstream frequently updates tenant admin pages + +**Notes for conflict resolution:** Includes license capability presets, CA template package tags, group-based licensing, excludeFromAlert. + +**CIPP files:** +- `src/components/CippWizard/` +- `src/pages/tenant/manage/` +- `src/pages/tenant/gdap-management/` +- `src/pages/cipp/advanced/super-admin/tenant-mode.js` +- `src/pages/cipp/settings/tenants.js` +- `src/pages/onboarding.js` +- `src/pages/onboardingv2.js` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Tenant/Get-CIPPTenantAlignment.ps1` *(may not exist)* +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Tenant/Administration/Invoke-ListTenantAlignment.ps1` *(may not exist)* + +--- + +### Navigation & Search UX + +**Purpose:** Hybrid universal search in top nav, frosted glass styling, dashboard v2 routing, custom breadcrumbs + +**Risk if overwritten:** High — visible UX differentiators + +**Upstream overlap likelihood:** High — upstream changes nav, search, dashboard frequently + +**Notes for conflict resolution:** Removed legacy dashboard v1. Redirect /dashboardv1 → dashboardv2. Hybrid search preserved over upstream CippCentralSearch removal. + +**CIPP files:** +- `src/layouts/top-nav.js` +- `src/layouts/config.js` +- `src/components/CippComponents/CippBreadcrumbNav.jsx` +- `src/pages/_app.js` + +--- + +### Custom Permissions & Roles + +**Purpose:** CIPP role management, SAM deployment, super-admin settings + +**Risk if overwritten:** Critical — auth/authorization changes can lock out admins + +**Upstream overlap likelihood:** Medium — upstream changes role checks and SAM manifest + +**Notes for conflict resolution:** Any SAMManifest.json changes require CPV refresh to client tenants. + +**CIPP files:** +- `src/pages/cipp/advanced/super-admin/cipp-roles/` +- `src/components/CippSettings/CippRoleAddEdit.jsx` +- `src/components/CippWizard/CippSAMDeploy.jsx` + +**CIPP-API files:** +- `lib/data/SAMManifest.json` *(may not exist)* + +--- + +### Manage365-Specific API Behavior + +**Purpose:** Custom transport rules, alert messaging, mailbox restrictions + +**Risk if overwritten:** High — tenant-specific automation + +**Upstream overlap likelihood:** Low-Medium + +**Notes for conflict resolution:** Manage365 - Block External Outbound transport rule auto-creation. + +**CIPP-API files:** +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Email-Exchange/Administration/Invoke-ExecSetMailboxRestriction.ps1` +- `Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/Identity/Administration/Users/Invoke-ListUserMailboxDetails.ps1` + +--- + +### Standards & Compliance Customizations + +**Purpose:** CIS 7.0 renumbering, ORCA fixes intake, applied standards license warnings, template handling + +**Risk if overwritten:** Medium-High — affects compliance reporting + +**Upstream overlap likelihood:** High — upstream actively updates standards + +**Notes for conflict resolution:** Recent v10.5.2 intake included ORCA fixes — verify not duplicated when cherry-picking. + +**CIPP files:** +- `src/data/standards.json` +- `src/components/CippStandards/` + +**CIPP-API files:** +- `Modules/CIPPCore/Public/Standards/` +- `Modules/CIPPStandards/Public/Standards/` + +--- + +### Data Table & UI Performance + +**Purpose:** CippDataTable optimizations with card view preserved, table search fixes + +**Risk if overwritten:** Medium — shared component used everywhere + +**Upstream overlap likelihood:** High + +**Notes for conflict resolution:** cf721215c ported upstream table optimizations without losing card view. + +**CIPP files:** +- `src/components/CippTable/` + +--- + +### OAuth & Auth Flow + +**Purpose:** BroadcastChannel for popup auth completion, OAuth grace period + +**Risk if overwritten:** High — login failures if broken + +**Upstream overlap likelihood:** Medium + +**Notes for conflict resolution:** c81921ce7 OAuth broadcast channel — preserve over upstream auth changes. + +**CIPP files:** +- `src/components/CippComponents/CIPPM365OAuthButton.jsx` +- `src/pages/_app.js` + +--- + +## Recent Custom Commits (post v10.5.2 intake baseline) + +These commits on production branches represent work done AFTER the last upstream intake and are especially protected: + +### CIPP (`main` since `pre-upstream-merge-v1052-20260617`) + +- `f2d87612e chore: update dependencies and remove pnpm lock file` +- `fba60b9f5 chore: update quarantine management features and version bump` +- `349eb5e9f chore: upstream v10.5.2 intake — quarantine pagination and version bump` +- `34dc2cff6 manual pagination support for Invoke-ListMailQuarantine` + +### CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`) + +- `de78a343e refactor: enhance quarantine message retrieval and filtering` +- `bff606d1d chore: upstream v10.5.2 intake — ORCA fixes, standards, quarantine, version bump` +- `5c748cd80 fix: add early template filter when supplied` +- `ab0b292c5 manual pagination support for Invoke-ListMailQuarantine` +- `684a78c3e bulk request next link following` +- `76b390f1a fix: rerun issue` +- `103815550 Fixes ORCA244` +- `3626847a1 Fixes ORCA235` +- `171f8a341 Fixes ORCA242` +- `8bb7b1c3e Fixes ORCA233_1` +- `2699da195 Fixes ORCA103` +- `47c28390b Fixes ORCA113` +- `8d3fbc49d Update policy based on MS and Orca guidance` +- `2f083afbb Fixes ORCA179` +- `794a13ed2 Fix for ORCA107 and add Exchange Global Quarantine policy to cache` +- `95d8f78ed Fix ORCA104` +- `982621d14 Update Invoke-ListTenantAlignment.ps1` +- `a0418fdfc Update Invoke-ListTenantAlignment.ps1` +- `d9a8c33b5 fix: rerun detection on scheduled tasks` + +## Conflict Resolution Rules + +1. **Never** auto-resolve toward upstream for files in this map +2. **Preserve** Manage365 branding, quarantine portal, and email troubleshooter behavior +3. **Integrate** upstream bug fixes only when they don't regress custom behavior +4. **Pause** for approval on any commit touching High-risk areas above +5. **Document** every adaptation in APPLIED_COMMITS tracking files diff --git a/docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md new file mode 100644 index 0000000000..4b6f9abbf8 --- /dev/null +++ b/docs/upstream-sync/history-cipp/EXCHANGE_FAMILY_INTAKE_20260715.md @@ -0,0 +1,84 @@ +# Exchange/Mailbox Family Intake — 2026-07-15 + +Feature intake of the deferred upstream Exchange/mailbox page family (8 frontend commits) plus +their API dependencies. Fork frontend version bumped **5.20.0 → 5.21.0**. + +## Upstream commits taken + +| Commit | Summary | How it landed | +|---|---|---| +| `ed025994c` | Encode UPN + surface report errors in Mailbox Access card | Merged into fork `exchange.jsx` (guest `#EXT#` fix) | +| `6433cd3a2` | Merge Entra ID and Exchange proxy addresses, show drift | Merged into fork `exchange.jsx` | +| `fc446f8d0` | Opt-in mail-enabled security groups in permission dialogs, grouped picker | Dialogs adopted wholesale; page logic merged | +| `553e4cfc2` | Lint churn | **Skipped** (formatting only) | +| `a3d25bfbb` | Bulk remove mailbox permissions on report page | Page adopted wholesale (upstream version) | +| `605990cdb` | Mailbox Access card on exchange page | Merged into fork `exchange.jsx` | +| `b1838ab84` | Show SMTP auth state on user tab | Adapted to fork's interactive protocols card | +| `afca350cb` | Navigation links on dashboard cards | Adapted to fork's rewritten cards | + +## Frontend (CIPP) + +- **`src/pages/identity/administration/users/user/exchange.jsx`** (heavily customized in fork — surgical merge): + - New **Mailbox Access** banner card (inverse of Mailbox Permissions) fed from the cached + permission report, with per-row bulk removal. UPN is URL-encoded so guest users work; an + error state distinguishes "report failed to load" from "no access". + - **Proxy Addresses** card now merges Entra ID `proxyAddresses` with Exchange + `EmailAddresses` and shows a `Source` column ("Entra ID & Exchange" / "Entra ID only" / + "Exchange only") so directory drift is visible. Make Primary / Remove restricted to + `Type === "Alias"` rows. Alias actions also refresh the mailbox query. + - Permission pickers now have an opt-in **"Include mail-enabled security groups"** switch + (state resets when all dialogs close); options are grouped (System Users / Users / + Mail-enabled Security Groups). Groups query only fires when toggled on. + - **Preserved fork customizations**: `mail`-based recipient values with `.filter(user.mail)` + in calendar/contact pickers, memoized subtitle, `getPermissionInfo` resolver, all fork-only + cards (mailbox rules, junk email config) and layout sections. +- **Permission dialogs** (`CippMailboxPermissionsDialog`, `CippCalendarPermissionsDialog`, + `CippContactPermissionsDialog`): adopted upstream wholesale (fork copies were stale upstream + versions, no customizations). They render the include-groups switch and grouped autocomplete. +- **`src/pages/email/reports/mailbox-permissions/index.js`**: adopted upstream wholesale. Now + uses the shared `useCippReportDB` hook and adds **Bulk Remove Mailbox Permissions** actions in + both By User and By Mailbox views (grouped per tenant so AllTenants selections work). Fork's + bespoke sync/queue-tracker UI is superseded by the hook's controls. +- **`src/components/CippComponents/CippReportDBControls.jsx`**: adopted upstream wholesale + (per-tenant cache override + `Types: 'None'` on plain mailbox cache syncs). No fork-only + commits existed on this file. +- **`src/components/CippCards/CippExchangeInfoCard.jsx`** (fork's interactive rewrite — + adapted, not replaced): added **SMTP Auth** chip to the Legacy Protocols section. + `SmtpClientAuthenticationDisabled` is inverted in EXO: `false` = basic auth enabled (red, + clickable to disable), `true` = disabled (neutral), `null` = follows org default (neutral, + not clickable). "Disable Both" button now keys off IMAP/POP only. +- **Dashboard cards** (`AuthMethodCard`, `MFACard`, `SecureScoreCard`, `LicenseCard`): card + header titles are now clickable links to their report pages (mfa-report, securescore, + list-licenses). Fork's `LicenseCard` bars deep-link to the licenses report filtered on that + license. `CippSankey` renders `node.label ?? node.id` (upstream unique-id fix support). +- **`src/pages/tenant/reports/list-licenses/index.js`**: parses `?filters=` from the URL into + `initialFilters` for deep links. Still uses fork's `/api/ListLicenses` (upstream's + `ListLicensesReport` remains deferred). + +## API (CIPP-API) + +- **`Invoke-ExecModifyMBPerms.ps1`**: adopted upstream's refactor — permission-level → cmdlet + mapping now delegates to `Set-CIPPMailboxPermission -AsCmdletObject` (single source of + truth), and successful FullAccess/SendAs/SendOnBehalf ops call + `Sync-CIPPMailboxPermissionCache` so the cached report stays current after bulk changes + (required by the new bulk-remove UI). **Preserved fork's guest-UPN retry**: on + `InvalidExternalUserIdException` the op retries with the Entra object ID, now via a shared + `Invoke-ExoRequestWithGuestRetry` helper used in the bulk-result, fallback, and single-op + paths. +- **`Invoke-ExecSetCASMailbox.ps1`**: legacy (fork card) caller path now accepts `SMTP`, + mapping to `SmtpClientAuthenticationDisabled` with inverted boolean. +- `Sync-CIPPMailboxPermissionCache` and `Set-CIPPMailboxPermission -AsCmdletObject` already + existed in the fork (identical / near-identical to upstream); `ListMailboxPermissions` + already supported `ByUser`/`UseReportDB`. No SAM manifest changes needed. + +## Verification + +- All changed frontend files lint-clean; `yarn build` passes (67s). +- Both changed API files pass PowerShell parser validation. +- Backup tags: `backup/pre-exchange-intake-20260715` in both repos. + +## Still deferred from this family's neighborhood + +- `ListLicensesReport` API (`2f02befcd`) — fork keeps `/api/ListLicenses`. +- Upstream's Sankey-based `LicenseCard` — fork keeps its progress-bar rewrite. +- UserActions family, nested group memberships, MEM devices pages (separate intakes). diff --git a/docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md b/docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md new file mode 100644 index 0000000000..814bfca770 --- /dev/null +++ b/docs/upstream-sync/history-cipp/FIRST_PASS_REPORT_20260617.md @@ -0,0 +1,249 @@ +# Upstream Sync — First Pass Inspection Report + +Generated: 2026-06-17 +Phase: **Setup complete — CIPP-API cherry-picks in progress** + +--- + +## 1. Git State Summary + +### CIPP (Frontend) + +| Item | Value | +|------|-------| +| Current branch | `main` | +| Working tree | Clean | +| vs origin | Ahead by 1 commit (unpushed) | +| Current tip | `f2d87612e` — chore: update dependencies and remove pnpm lock file | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP.git` ✓ | +| Upstream tracking branch | `upstream/main` | +| Upstream tip | `0d8ca9d2f` — Merge pull request #6153 from KelvinTegelaar/dev | +| Merge base | `0710355e2` | +| **Commits behind upstream** | **241** | + +### CIPP-API (Backend) + +| Item | Value | +|------|-------| +| Current branch | `master` | +| Working tree | Clean | +| vs origin | Up to date | +| Current tip | `de78a343e` — refactor: enhance quarantine message retrieval and filtering | +| Upstream remote | `upstream` → `KelvinTegelaar/CIPP-API.git` ✓ | +| Upstream tracking branch | `upstream/master` | +| Upstream tip | `5a0ddb29c` — Dev to hotfix (#2088) | +| Merge base | `6871d267e` | +| **Commits behind upstream** | **315** | + +### Remotes (both repos) + +| Remote | CIPP | CIPP-API | +|--------|------|----------| +| `origin` | `Celeratec/CIPP.git` | `Celeratec/CIPP-API.git` | +| `upstream` | `KelvinTegelaar/CIPP.git` | `KelvinTegelaar/CIPP-API.git` | + +Upstream fetch completed successfully during this inspection. + +--- + +## 2. Protective Setup + +## 2. Protective Setup + +Sync branches and backup tags created on 2026-06-17: + +| Repo | Production branch | Backup tag | Sync branch | +|------|-------------------|------------|-------------| +| CIPP | `main` @ pushed tip | `backup/pre-upstream-sync-cipp-20260617` | `manage365/upstream-sync-cipp-20260617` | +| CIPP-API | `master` | `backup/pre-upstream-sync-cipp-api-20260617` | `manage365/upstream-sync-cipp-api-20260617` | + +Tags and sync branches are local only (not pushed to origin unless approved). + +--- + +--- + +## 3. Documents Generated + +| Document | Location | +|----------|----------| +| CIPP upstream inventory (241 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_20260617.md` | +| CIPP-API upstream inventory (315 commits) | `docs/upstream-sync/UPSTREAM_SYNC_CIPP_API_20260617.md` | +| Custom feature map | `docs/upstream-sync/CUSTOM_FEATURE_MAP_20260617.md` (both repos) | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_20260617.md` | +| Applied commits tracker (empty) | `docs/upstream-sync/APPLIED_COMMITS_CIPP_API_20260617.md` | + +--- + +## 4. Inventory Statistics + +### CIPP — 241 upstream commits + +| Risk | Count | +|------|-------| +| Low | 11 | +| Medium | 80 | +| High | 150 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 200 | +| Cherry-pick with adaptation | 30 | +| Cherry-pick (clean) | 11 | + +**Notable buckets:** 136 dependency/build, 157 potentially breaking, 15 touch protected custom areas. + +### CIPP-API — 315 upstream commits + +| Risk | Count | +|------|-------| +| Low | 48 | +| Medium | 37 | +| High | 230 | + +| Recommendation | Count | +|----------------|-------| +| Needs manual review | 228 | +| Cherry-pick with adaptation | 39 | +| Cherry-pick (clean) | 48 | + +**Notable buckets:** 49 tests-only, 216 dependency/build tagged, 11 touch protected custom areas. + +--- + +## 5. Custom Features at Risk + +See `CUSTOM_FEATURE_MAP_20260617.md` for full detail. Highest-risk protected areas: + +1. **Quarantine Portal 5.13.0** — Very high upstream overlap; 20+ custom API files + shared frontend module +2. **Manage365 Branding/Versioning** — `manage365-version.json`, dual version tooling, drift alerts +3. **Email Troubleshooter** — Shares quarantine components; `Invoke-ExecEmailTroubleshoot.ps1` +4. **Navigation/Search UX** — Hybrid top-nav search, dashboard v2 routing (upstream changes nav frequently) +5. **Tenant Workflows** — GDAP, tenant mode, alignment with custom license/CA template logic +6. **OAuth Auth Flow** — BroadcastChannel popup completion (custom, not upstream) + +**Recent post-intake commits (especially protected):** + +CIPP (`main` since `pre-upstream-merge-v1052-20260617`): +- Quarantine management features + version bump +- v10.5.2 intake (quarantine pagination) +- manual pagination for ListMailQuarantine +- Dependency update (unpushed on main) + +CIPP-API (`master` since `pre-upstream-merge-v1052-20260617`): +- Quarantine message retrieval refactor +- v10.5.2 intake (ORCA fixes, standards, quarantine) +- ORCA standards fixes (ORCA103–244) +- Tenant alignment updates + +--- + +## 6. First Pass Results + +| Metric | CIPP | CIPP-API | Total | +|--------|------|----------|-------| +| Upstream commits reviewed | 241 | 315 | **556** | +| Applied | 0 | 0 | 0 | +| Adapted | 0 | 0 | 0 | +| Skipped | 0 | 0 | 0 | +| Deferred | 0 | 0 | 0 | +| Conflicts encountered | 0 | 0 | 0 | +| Tests run | 0 | 0 | 0 | + +--- + +## 7. Recommended First Batch (Low-Risk) + +Apply **only after** creating sync branches and backup tags. Review each commit against `CUSTOM_FEATURE_MAP` before cherry-picking. + +### CIPP-API — Start here (more clean test/bugfix commits) + +Priority order — tests and isolated bugfixes with ≤2 files, no protected-path overlap: + +| # | SHA | Title | Category | +|---|-----|-------|----------| +| 1 | `2b441244` | feat: Add Levenshtein distance function and tests | Tests | +| 2 | `133f9295` | test: fix helper paths after tools folder move | Tests | +| 3 | `6aa66c74` | Custom Test - Alert on X statuses | Tests | +| 4 | `ee0b8229` | fix: change cleanup to 30 days | Bugfix | +| 5 | `fdf313e5` | fix: remove partitionkey | Bugfix | +| 6 | `ecbc9a50` | fix: Add error handling for missing standard functions | Bugfix | +| 7 | `57b7de1f` | fix: Rename 'usedInTemplates' to 'usage' | Bugfix | +| 8 | `23c8994d` | fixes defaultr_hidden vs hidden #5990 | Bugfix | +| 9 | `897dfaa4` | fixed #5997 | Bugfix | +| 10 | `5ccf15a9` | fix: missing odata path error in returned json | Bugfix | +| 11 | `9ba48711` | correct incorrect default value | Bugfix | +| 12 | `4214bc7d` | Fix: Fix missing OData path error in JSON response (#2054) | Bugfix | +| 13 | `71afcdd2` | ExoTransportConfig cache type - fix for missing data | Tests | + +**Checkpoint before:** `1aa55cff` (Intune standard change detection), `affac9d0` (standards run errors), `12bb4f69` (caching cleanup) — these touch standards/cache and need review. + +### CIPP — Smaller first batch (many upstream commits are dependency/build) + +| # | SHA | Title | Category | Notes | +|---|-----|-------|----------|-------| +| 1 | `98d5d94a` | Custom Test - Alert on X statuses | Tests | Low overlap | +| 2 | `1e59d2d4` | Update ListTests.json | Tests | Verify shape compatibility | +| 3 | `e3ed1818` | fix alert mode | Bugfix | 1 file | +| 4 | `60a50738` | fixes tenantfilter property | Bugfix | Review tenant context | +| 5 | `0a8252e3` | fix: version encoding | Bugfix | **Checkpoint** — touches version | +| 6 | `707873e3` | fix: Fix tab title showing as undefined | Bugfix | UI, low risk | +| 7 | `89abbf50` | fix: improve stale issue and close messages | Bugfix | GitHub workflow | +| 8 | `5709f856` | fix: update terminology Temporary Access Password | Bugfix | i18n only | + +**Skip/defer in CIPP first batch:** +- `983b48a1` / `bde8ad3c` — worktrees cleanup (may already exist on `fix/remove-claude-worktrees` branch; verify) +- `c8d61c07` — JIT admin fix (**Already implemented differently** at `7e1bab525`) +- `1ea0324e` — search-on-load fix (verify against our table search fix at `18c21fc6b`) +- `f768330c` — CIS standards tag move (**conflicts with our CIS 7.0 renumbering**) +- `fe4bd7f9` — alltenants sync (review tenant context) +- All Dependabot / package.json commits — **explicit approval required** + +--- + +## 8. Commits Requiring Approval Before Any Apply + +Any upstream commit touching these areas must pause for review (see inventory Notes column for full list): + +- Quarantine / spamfilter / `Build-CIPPQuarantineQueryParams` +- Email Troubleshooter / `ExecEmailTroubleshoot` +- Exchange Online / mailbox / transport +- Authentication / OAuth / SAM / roles / `SAMManifest.json` +- Tenant switching / tenantFilter / GDAP / alignment +- Branding / version.json / manage365-version +- Navigation / config.js / top-nav +- Shared API helpers (`New-GraphPostRequest`, etc.) +- Dependency upgrades / build tooling +- Large refactors (>5 files or "refactor" in title) + +--- + +## 9. Known Risks + +1. **Prior partial intake** — v10.5 / v10.5.2 selective intake already applied many upstream commits with adaptation. Some inventory commits may be **already implemented differently** (e.g., JIT admin, table search, quarantine pagination). +2. **High dependency churn in CIPP** — 136 of 241 commits touch package.json/CI; batching these blindly risks breaking the SWA build. +3. **Standards divergence** — CIS 7.0 renumbering and ORCA fixes on our side may conflict with upstream standards.json changes. +4. **Quarantine active development** — Both forks and upstream are changing quarantine simultaneously; highest conflict risk. +5. **Unpushed CIPP commit** — `main` is 1 commit ahead of origin (`f2d87612e` dependency update); push or include in sync branch baseline. + +--- + +## 10. Recommended Next Steps + +1. **Approve** creation of sync branches + backup tags (commands in §2) +2. **Review** this report and the first-batch table +3. **Begin CIPP-API** with test-only commits (`2b441244`, `133f9295`, `6aa66c74`) +4. **Run Pester** after each API batch: `Invoke-Pester -Path Tests/Tools,Tests/Endpoint -Output Detailed` +5. **CIPP second** — start with test commits, defer all dependency bumps +6. **Schedule checkpoint reviews** for quarantine, auth, tenant, and standards batches + +--- + +## 11. Remaining Manual Decisions + +- [ ] Confirm date stamp for sync branches (`20260617` vs `20260617` — branch history uses 20260617) +- [ ] Push unpushed CIPP commit before sync branch creation? +- [ ] Whether to skip upstream commits already implemented differently (JIT admin, search fixes) +- [ ] Dependency upgrade strategy — individual bumps vs grouped batch with build verification +- [ ] Standards/ORCA commits — merge vs skip given recent v10.5.2 intake +- [ ] Quarantine upstream delta — full diff review before any quarantine cherry-picks diff --git a/docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md b/docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md new file mode 100644 index 0000000000..28ba7286c3 --- /dev/null +++ b/docs/upstream-sync/history-cipp/MCP_INTAKE_20260803.md @@ -0,0 +1,47 @@ +# MCP Feature Intake — 2026-08-03 + +Cycle type: **Feature intake** per [PROCESS.md](PROCESS.md). + +## Feature: MCP Server (internal team) + +- Upstream refs: `Invoke-ExecMcp.ps1`, `Modules/CIPPCore/Public/MCP/*`, `Set-CIPPMCPClientApp.ps1`, `Config/openapi.json`, MCPAllowed wiring in ApiClient + auth +- Fork gap: Feature flag `MCPServer` existed (disabled) and `New-CippCoreRequest` already mapped MCP principals; missing endpoint, MCP helpers, OpenAPI spec, UI toggle +- Protected conflicts: Adapt `Set-CippApiAuth` / `CippApiClientManagement` — preserve SWA auth path and Manage365 branding (do not take CIPPNG/SSO EasyAuth rewrite) +- Scope: **capability only** — `MCPServer` remains **Enabled: false** until ops validates; internal team use +- Phases: backend → frontend → tab hygiene → verify → PR +- Approval: [x] design [x] implement [x] deploy (enable flag after smoke) + +## Also in this intake + +- Super-admin tab hygiene: removed 404 links for CIPP Users, SSO, Container Management from `tabOptions.json` +- Container management / logs / worker health: **not** intaken (Craft bridges required) +- Teams V2: **unchanged deferred** + +## Taken + +### CIPP-API + +- `Modules/CIPPCore/Public/MCP/{Get-CippMcpSpec,Get-CippMcpToolList,Get-CippMcpToolResult}.ps1` +- `Modules/CIPPHTTP/.../CIPP/MCP/Invoke-ExecMcp.ps1` +- `Modules/CIPPCore/Public/Authentication/Set-CIPPMCPClientApp.ps1` +- `Config/openapi.json` (upstream baseline for tool projection) +- `Get-CippApiClient` projects `MCPAllowed` +- `Invoke-ExecApiClient` persists MCPAllowed, configures MCP app on enable, SaveToAzure passes `McpClientIds` + PRM scope app setting +- `Set-CippApiAuth` gains optional `-McpClientIds` host/appId audiences (fork ARM path kept) + +### CIPP + +- `CippApiClientManagement.jsx`: MCPAllowed switch + warning, MCP API URL chip, table column +- `super-admin/tabOptions.json`: dropped CIPP Users / SSO / Container Management tabs + +## Enablement (post-deploy) + +1. Deploy all Function slots + SWA +2. Create/enable an API client with **MCP Access Allowed**, then **Save to Azure** +3. Toggle feature flag **MCP Server** on in CIPP settings / Feature Flags +4. Smoke: POST `tools/list` then one `.Read` tool via MCP client against `/api/ExecMcp` + +## Verification + +- PowerShell AST parse: all new/changed MCP and auth files OK +- `MCPServer.Enabled` remains `false` in `Config/FeatureFlags.json` diff --git a/docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md new file mode 100644 index 0000000000..007fb8ef41 --- /dev/null +++ b/docs/upstream-sync/history-cipp/MEMDEVICES_COMPONENTS_INTAKE_20260715.md @@ -0,0 +1,105 @@ +# MEM Devices + Small Component Fixes Intake — 2026-07-15 + +**Type:** Feature intake (batch) +**Upstream baseline:** 10.6.1 (commits from upstream/main, late June – early July 2026) +**Fork version:** 5.22.0 → 5.23.0 +**Backup tag:** `backup/pre-memdevices-intake-20260715` +**Branch:** `manage365/memdevices-intake-20260715` + +## Upstream commits covered + +| Commit | Subject | Disposition | +| --- | --- | --- | +| `35a019f65` | Disable broken "Generate logs and ship to MEM" action | Taken (commented out, both pages) | +| `eb1935152` | refactor(devices): dedupe Intune device actions | Adapted — shared component built from the fork's richer action list | +| `b6d2de4d7` | chore: linting (device detail page) | Skipped — pure reformatting of a file we did not adopt wholesale | +| `9fd979ec9` | Defanged URL rendering fix | Taken | +| `690f7720a` | Bar chart tooltip/color fix | Taken | +| `0a3fe87d2` | Stable EMPTY_ARRAY default for `data` prop | Taken | +| `04d89c427` | Tenant correction on action click (#6268) | Taken (adapted to fork's categorized menu) | +| `0fc6459db` | Clear stale dialog results on reopen (#6265) | Taken (ApiDialog only; ApiResults diff was pure formatting) | +| `c4608b26c` | Search placeholder "Search input" → "Search..." | Skipped — fork already uses "Search items…" | + +## Changes + +### New shared component: `CippIntuneDeviceActions.jsx` + +Upstream deduplicated the ~19 Intune device actions that were copy-pasted between +the MEM devices list page and the View Device detail page. We adopted the same +shape (`getIntuneDeviceActions({ tenantFilter })`) but built the array from the +**fork's** action list, which is a superset of upstream's: + +- `category` (view/edit/manage/security/danger) driving the fork's grouped action menus +- `quickAction` flags for the table page's quick-action buttons +- The fork-only "View in Entra" link action +- Broken "Generate logs and ship to MEM" commented out per upstream `35a019f65` + +Both pages now consume the shared list: + +- `src/pages/endpoint/MEM/devices/index.js` — replaced the ~390-line inline array; unused icon imports removed. +- `src/pages/endpoint/MEM/devices/device/index.jsx` — replaced its ~370-line copy. This is a small + behavior upgrade for the detail page: its copy had drifted (still listed the broken + Generate-logs action, lacked quick-action flags). Link-type actions (`View Device`, + `View in Intune`, `View in Entra`) are filtered out of the detail page's ActionsMenu by + `components/actions-menu.js`, and the page header keeps its own View in Intune button, + so the `[id]` placeholder links never render there. + +### `src/utils/get-cipp-formatting.js` + +Strings starting with `http` are now only rendered as links when they parse as a +real absolute http(s) URL. Defanged URLs (e.g. `https[:]//bad.com` from Check) +previously rendered as links relative to the CIPP instance; they now show as +plain text with a copy button. + +### `src/components/CippCards/CippChartCard.jsx` + +Bar charts now use a single named series with `xaxis.categories` + +`plotOptions.bar.distributed`, so tooltips show the category name instead of +"series-1" and per-bar colors are preserved. Legend dots use modulo color +cycling to match ApexCharts. Fork customizations (customColors, compact, +horizontal layout, header icon) untouched. + +### `src/components/CippTable/CippDataTable.js` + +- `data = EMPTY_ARRAY` module-level default so an undefined `data` prop doesn't + create a fresh `[]` each render and loop the static-data sync effect. +- Row action clicks in AllTenants mode now only switch to the row's tenant for + immediately-executing paths (noConfirm customFunction, customComponent). The + standard dialog flow no longer eagerly switches, so cancelling a dialog no + longer leaves the wrong tenant selected (upstream #6268). Adapted into the + fork's categorized action menu. + +### `src/components/CippComponents/CippApiDialog.jsx` + +New effect on dialog open: clears streamed partial results, resets the POST +mutation, and clears the GET request state so a reopened dialog never shows +stale output from a previous action (upstream #6265). The fork already cleared +`partialResults` on close, but React Query retained the last mutation/query +result while the component stayed mounted. + +## Fork customizations preserved + +- MEM devices list page: card view, NinjaOne enrichment, compliance/ownership chips, + quick actions config, custom offcanvas hero — all untouched (only the actions array moved). +- Device detail page: header buttons, compliance/apps/groups tabs, property lists — untouched. +- Chart card: all fork layout props preserved. +- DataTable: fork's categorized menus, card view, sorting helpers preserved; changes were surgical. +- Toolbar search placeholder kept as the fork's "Search items…". + +## Verification + +- ESLint on all touched files: 0 errors (pre-existing exhaustive-deps warnings only). +- `yarn build`: passed (67s). + +## Still deferred (frontend) + +- Scheduled user edit UI, Dashboard Alerts card +- config.js menu changes, top-nav tweaks, PrivateRoute/login tweaks +- Shadow AI report button removal, tenant metrics grid style, build optimisations +- Container management, dependency bumps + +## Still deferred (API) + +- Custom Test Alerting overhaul, MCP support, Purview DLP standard, + Intune policy sync / device app collection, IP lookup + audit log improvements, + and the remaining small items listed in USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md. diff --git a/docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md new file mode 100644 index 0000000000..d3525305ca --- /dev/null +++ b/docs/upstream-sync/history-cipp/ODDSENDS_INTAKE_20260715.md @@ -0,0 +1,87 @@ +# Odds & Ends Intake (menu/config, deps, build) — 2026-07-15 + +**Type:** Light intake (batch) +**Upstream baseline:** 10.6.1 +**Fork version:** 5.24.0 → 5.25.0 +**Backup tag:** `backup/pre-oddsends-intake-20260715` +**Branch:** `manage365/oddsends-intake-20260715` + +## Upstream commits covered + +| Commit | Subject | Disposition | +| --- | --- | --- | +| `2d50bf858` | Add missing permission for Device Management menu | Taken | +| `612ef72b8` | Broaden menu section permissions | Taken (all four sections) | +| `c38010f5e` | `scope: 'global'` on Application Templates | Skipped — fork's menu does not have that item/scope pattern in nativeMenuItems | +| `2d0b8f271` | Nav tooltips + keyboard shortcut hints | Taken (adapted to fork top-nav) | +| `907075a91` | Build optimisations | Partially taken — build-trace skip only (see below) | +| Dependency bumps | react-query family, apexcharts, mui-tiptap, reduxjs/toolkit, dompurify | Taken | +| Blob upload action bump | GitHub Actions | Skipped — fork's SWA workflow doesn't use that action | + +## Changes + +### Menu permission fixes (`src/layouts/config.js`) + +Section-level menu permissions were narrower than their children, so users holding +only the child permission couldn't see the section at all: + +- **Device Management**: added `Endpoint.Device.*` (children use it for Managed Devices) +- **Transport**: added `Exchange.Connector.*` (Connectors / Connector Templates) +- **Spam Filter**: added `Exchange.ConnectionFilter.*` (Connection Filter items) +- **Resource Management**: added `Exchange.Room.*` (Rooms / Room Lists) + +### Top-nav polish (`src/layouts/top-nav.js`) + +- Both search icon buttons now use proper MUI `Tooltip`s with `aria-label`s + (previously plain `title` attributes). +- The "Manage365 Search" dialog title shows keyboard shortcut hints + (Pages: Ctrl/Cmd+K · Users: Ctrl/Cmd+Shift+F). + +### Build optimisation (`scripts/skip-export-build-traces.mjs` + `package.json`) + +Adopted upstream's Next.js build-trace skip: for `output: 'export'` builds Next +still runs @vercel/nft "Collecting build traces" even though the result is never +used without a server runtime. The script idempotently patches the installed Next +build to skip it. **Measured: build went from ~67s to ~24s locally.** + +Importantly, upstream's build script includes `rm -rf package.json yarn.lock` +(their SWA workaround that previously caused the fork's "deleted files" incident); +the fork's build script does **not** re-add that — only the trace-skip was taken: + +``` +"build": "node scripts/skip-export-build-traces.mjs && next build --webpack" +``` + +The script warns and proceeds unpatched if Next internals change, so CI can never +break from this. + +The rest of `907075a91` (lazy rich-text field extraction from CippFormComponent, +prism highlighter split, license/standards data modules, intuneCollection move) +touches heavily customized fork files and is **deferred** for a dedicated pass. + +### Dependency bumps (`package.json`) + +Aligned with upstream 10.6.x versions: + +- `@reduxjs/toolkit` ^2.11.2 → ^2.12.0 +- `@tanstack/react-query` / `-devtools` / `-persist-client` → ^5.101.2 (kept in lockstep) +- `apexcharts` 5.10.4 → 5.16.0, `react-apexcharts` 2.1.0 → 2.1.1 +- `mui-tiptap` ^1.30.0 → ^1.31.0 +- `dompurify` added as a **direct** dependency (^3.4.11) — it was imported in + several files but only resolved via the `resolutions` pin / transitive deps + +`yarn install` regenerated the lockfile cleanly. + +## Verification + +- ESLint on config.js/top-nav.js: no new problems (2 errors + 2 warnings pre-exist + on the clean tree — React Compiler memoization notes). +- `yarn build`: passed in 24s (trace skip confirmed active in output). + +## Still deferred + +- Remainder of `907075a91` (code-splitting refactors) +- Shadow AI report button changes (`6a1d7de99`), tenant metrics grid style (`495f38808`) +- PrivateRoute/login tweaks, container management +- API: Custom Test Alerting overhaul, MCP support, Purview DLP standard, Intune + policy sync, IP lookup + audit log improvements, Sherweb diff --git a/docs/upstream-sync/history-cipp/PROCESS.md b/docs/upstream-sync/history-cipp/PROCESS.md new file mode 100644 index 0000000000..e2db26cbef --- /dev/null +++ b/docs/upstream-sync/history-cipp/PROCESS.md @@ -0,0 +1,276 @@ +# Manage365 Upstream Sync Process + +This document defines how Manage365 reviews [KelvinTegelaar/CIPP](https://github.com/KelvinTegelaar/CIPP) and [KelvinTegelaar/CIPP-API](https://github.com/KelvinTegelaar/CIPP-API) on a regular cadence and ports advantageous changes **without** overwriting fork-specific features. + +**Related artifacts** + +| Document | Purpose | +|----------|---------| +| [CUSTOM_FEATURE_MAP_*.md](./CUSTOM_FEATURE_MAP_20260617.md) | Protected fork areas — refresh each cycle | +| [FIRST_PASS_REPORT_*.md](./FIRST_PASS_REPORT_20260617.md) | Example first-pass inspection output | +| [UPSTREAM_DELTA_*.md](./UPSTREAM_DELTA_CIPP_20260617.md) | Example delta since last sync base | +| [CIPP_SYNC_CHECKPOINT_*.md](./CIPP_SYNC_CHECKPOINT_20260617.md) | Example cycle checkpoint | +| [README.md](./README.md) | Index of cycle-specific tracking docs | + +--- + +## Principles + +1. **Selective intake, not wholesale merge** — cherry-pick or surgical port; never blind `Sync fork → Discard commits`. +2. **Fork features are protected by default** — see `CUSTOM_FEATURE_MAP`. When in doubt, adapt upstream logic into fork files instead of replacing them. +3. **Frontend + API move together** — if a feature needs both repos, plan and ship as a pair (or defer both). +4. **Explicit approval gates** — no production merge without review checklist and version bump. +5. **GitHub “Sync fork” badge is cosmetic** — a large behind-count is expected with selective intake. + +--- + +## Cadence + +| Cycle type | When | Duration | Goal | +|------------|------|----------|------| +| **Light delta** | Monthly (or when upstream patch releases) | 2–4 hours | Low-risk bugfixes, data JSON, tests, isolated endpoints | +| **Major cycle** | Quarterly (or after upstream minor e.g. v10.5 → v10.6) | 1–3 days | Full delta inventory, feature intake decisions, dependency review | +| **Feature intake** | As needed (backlog) | 1–5 days each | New upstream capabilities (e.g. SSO, MCP) — design first, then port | +| **Hotfix** | Within 48h of critical upstream security fix | Hours | Cherry-pick specific SHA(s), fast deploy | + +**Suggested calendar** + +- **1st week of month** — light delta review (optional skip if no upstream activity) +- **First month of quarter** — major cycle for both repos +- **Backlog grooming** — add upstream features to intake queue (see [Feature intake backlog](#feature-intake-backlog)) + +--- + +## Roles + +| Role | Responsibility | +|------|----------------| +| **Sync lead** | Runs cycle, owns checkpoint docs, approves apply/defer | +| **Reviewer** | Second pair of eyes on high-risk or protected-path changes | +| **Deployer** | Version bump, SWA + all Function App slot deploys | + +One person can fill all roles on a small team; the checklist still applies. + +--- + +## Cycle workflow (both repos) + +Each cycle uses the same phases. Run **CIPP-API first** when changes are backend-heavy; run in parallel only for independent JSON/test commits. + +```mermaid +flowchart TD + A[0. Plan] --> B[1. Protect] + B --> C[2. Inventory] + C --> D[3. Triage] + D --> E[4. Apply mini-batches] + E --> F[5. Verify] + F --> G[6. Checkpoint + PR] + G --> H[7. Version + deploy] + H --> I[8. Close cycle] +``` + +### Phase 0 — Plan + +- [ ] Decide cycle type (light / major / feature intake / hotfix) +- [ ] Record last sync base SHAs (from previous checkpoint or tag) +- [ ] For **feature intake**: complete design Q&A before coding (self-hosted SSO, MCP scope, etc.) + +### Phase 1 — Protect + +```powershell +# From each repo root — or use Tools/Start-UpstreamSyncCycle.ps1 in CIPP +$date = Get-Date -Format 'yyyyMMdd' +git fetch upstream +git tag "backup/pre-upstream-sync--$date" main # or master for API +git checkout -b "manage365/upstream-sync--$date" +``` + +- [ ] Backup tag on production branch tip +- [ ] Sync branch created (never commit directly to `main` / `master` during review) +- [ ] Working tree clean + +### Phase 2 — Inventory + +```bash +# Commits since last sync base (replace BASE with checkpoint merge-base or tag) +git log --oneline BASE..upstream/main # CIPP +git log --oneline BASE..upstream/master # CIPP-API + +# Divergence counts +git rev-list --left-right --count main...upstream/main +``` + +Generate (or update agent-assisted): + +- `UPSTREAM_DELTA_CIPP_YYYYMMDD.md` — commits since last base +- `UPSTREAM_DELTA_CIPP_API_YYYYMMDD.md` +- Refresh `CUSTOM_FEATURE_MAP_YYYYMMDD.md` if protected areas changed + +### Phase 3 — Triage + +Classify **every candidate** into one outcome: + +| Outcome | Meaning | +|---------|---------| +| **Apply** | Clean cherry-pick or copy; no protected-path conflict | +| **Adapt** | Port logic surgically; do not replace whole fork files | +| **Already implemented** | Fork already has equivalent behavior — document evidence | +| **Defer** | Worth doing later; needs design, API pair, or conflict resolution | +| **Skip** | Wrong for fork (hosted-only, removes customization, low value) | + +**Risk tags:** Low | Medium | High +**Area tags:** Security, Exchange, Intune, Standards, Auth, Nav/UI, Dependencies, Tests, Data/JSON + +**Protected-path rule:** If any file in `CUSTOM_FEATURE_MAP` is touched, outcome must be **Adapt** or **Defer** — never blind **Apply**. + +**Pairing rule:** Frontend-only or API-only commits are OK alone; cross-cutting features require both sides in the same release or explicit deferral. + +### Phase 4 — Apply mini-batches + +- Work in batches of **3–5 commits**, low-risk first +- Order: tests → data JSON → isolated bugfixes → shared components → protected areas last +- After each batch: build/test (see Phase 5) +- Record in `APPLIED_COMMITS_*_YYYYMMDD.md`: + + | Upstream SHA | Fork SHA | Outcome | Notes | + +- If cherry-pick conflicts: abort, switch to **Adapt** manual port +- **Do not continue** after a batch failure without fixing or deferring + +### Phase 5 — Verify + +**Frontend (CIPP)** + +```bash +npx next build --webpack +``` + +**Backend (CIPP-API)** — as applicable: + +- Pester tests for touched modules +- Local function host smoke test for changed endpoints + +**Manual smoke** (adjust per cycle): + +- Applied standards / drift +- Quarantine + email troubleshooter (protected) +- Top-nav search + dashboard v2 +- Tenant auth methods +- Any feature touched in this cycle + +### Phase 6 — Checkpoint + PR + +Write `CIPP_SYNC_CHECKPOINT_YYYYMMDD.md` (and API equivalent) with: + +- Branch name, base SHA, tip SHA, backup tag +- Mini-batches table (upstream → outcome) +- Applied / adapted / deferred / skipped lists +- Known concerns and follow-ups +- **Recommendation:** ready for PR / needs more work / stop + +PR requirements: + +- [ ] Summary references checkpoint doc +- [ ] Lists deferred items explicitly +- [ ] No unrelated changes +- [ ] Reviewer sign-off for High-risk or protected-path adapts + +### Phase 7 — Version + deploy + +After merge to `main` / `master`: + +```powershell +# CIPP — set upstream baseline + Manage365 release +./Tools/Update-Version.ps1 -UpstreamVersion 10.5.1 -Manage365Version 5.12.15 + +# CIPP-API — edit both files to same upstream baseline +# version_latest.txt +# Config/version_latest.txt +``` + +- [ ] Bump `public/version.json` + `manage365-version.json` (via script) +- [ ] Bump API `version_latest.txt` (both paths) +- [ ] Update README **Upstream Integration** section +- [ ] Deploy Static Web App +- [ ] Deploy **all** Function App slots (main, processor, standards, audit, user tasks) +- [ ] Confirm Application Settings → version page shows green / no false out-of-date toasts + +### Phase 8 — Close cycle + +- [ ] Tag sync completion: `sync/cipp-YYYYMMDD` / `sync/cipp-api-YYYYMMDD` on merged tip +- [ ] Record new **sync base SHA** in checkpoint (becomes next cycle's `BASE`) +- [ ] Archive deferred items into next cycle's triage queue +- [ ] Update feature intake backlog status + +--- + +## Feature intake backlog + +Use this for **new upstream capabilities** (not small delta fixes). Each item gets a short design before implementation. + +| Feature | Status | Design | Notes | +|---------|--------|--------|-------| +| Instance SSO (self-hosted, capability-only) | Planned | Pending spec | Super Admin SSO page + backend; no prod migration until chosen | +| MCP (internal team) | **Intaken** (flag off) | [MCP_INTAKE_20260803.md](./MCP_INTAKE_20260803.md) | API client toggle + ExecMcp; enable `MCPServer` after smoke | +| Baselines (drift-first engine) | **Intaken** (flag off) | [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md) | Timer gated; pages at `/tenant/baselines`; enable after orch smoke | +| Worker health page | Deferred | — | Needs WorkerMetricsBridge (Craft) | +| CIPP Users / Container super-admin pages | Hygiene done | — | 404 tabs removed from `tabOptions.json`; full pages still deferred | +| Teams V2 | Deferred | — | Large blast radius; module removal needs dedicated migration | + +**Intake template** (copy for new rows): + +```markdown +## Feature: [name] +- Upstream refs: [commits / files] +- Fork gap: [what we lack] +- Protected conflicts: [from CUSTOM_FEATURE_MAP] +- Scope: [capability vs migrate-now] +- Phases: [backend → frontend → verify] +- Approval: [ ] design [ ] implement [ ] deploy +``` + +--- + +## Decision guide: merge vs cherry-pick vs adapt + +| Situation | Action | +|-----------|--------| +| Upstream fix in a file we never customized | Cherry-pick **Apply** | +| Upstream changed same file as fork (CippDataTable, applied-standards, quarantine) | **Adapt** surgical diff | +| Upstream new feature, no fork overlap | Port files + wire nav/API | +| Upstream dependency major bump | **Major cycle** only; full build/test | +| GitHub “238 commits behind” | Ignore unless doing intentional merge for git hygiene | +| Full upstream merge | Separate project; conflict marathon; not default | + +--- + +## Agent / Cursor usage + +When asking an agent to help with upstream sync: + +1. Point it at this file and the latest `CUSTOM_FEATURE_MAP`. +2. Specify cycle type and **do not reduce fork functionality**. +3. Require checkpoint doc updates per mini-batch. +4. Use rule: `.cursor/rules/upstream-sync.mdc` + +--- + +## Quick start (new cycle today) + +```powershell +cd /path/to/CIPP +./Tools/Start-UpstreamSyncCycle.ps1 -Repo CIPP + +cd /path/to/CIPP-API +./Tools/Start-UpstreamSyncCycle.ps1 -Repo CIPP-API +``` + +Then run Phase 2 inventory commands and triage into `UPSTREAM_DELTA_*_YYYYMMDD.md`. + +--- + +## Revision history + +| Date | Change | +|------|--------| +| 2026-06-09 | Initial formal process (documents practice from June 2026 v10.5 intake + sync branches) | diff --git a/docs/upstream-sync/history-cipp/README.md b/docs/upstream-sync/history-cipp/README.md new file mode 100644 index 0000000000..5d1204f9bc --- /dev/null +++ b/docs/upstream-sync/history-cipp/README.md @@ -0,0 +1,55 @@ +# Upstream sync documentation + +Manage365 tracks upstream CIPP changes here. **Start with [PROCESS.md](./PROCESS.md)** for the repeatable cadence and checklist. + +## Active process + +| Doc | Description | +|-----|-------------| +| [PROCESS.md](./PROCESS.md) | **Master workflow** — cadence, phases, triage, version bump, deploy | + +## August 2026 cycles + +| Doc | Repo | Description | +|-----|------|-------------| +| [SYNC_20260814.md](./SYNC_20260814.md) | Both | **Latest** — 10.8.5 major: Baselines intake, MAA, BitLocker search, Secure Score report | +| [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md) | Both | Baselines feature intake (flag off) | +| [UPSTREAM_DELTA_CIPP_20260814.md](./UPSTREAM_DELTA_CIPP_20260814.md) | CIPP | Frontend triage for the 08-14 cycle | +| [MCP_INTAKE_20260803.md](./MCP_INTAKE_20260803.md) | Both | MCP feature intake + super-admin tab hygiene (Manage365 5.32.0) | +| [SYNC_20260803.md](./SYNC_20260803.md) | Both | 10.7.5 light/medium delta: AzBobbyTables 3.6.2, Intune drift, groups/devices, audit V2 | +| [UPSTREAM_DELTA_CIPP_20260803.md](./UPSTREAM_DELTA_CIPP_20260803.md) | CIPP | Frontend triage for the 08-03 cycle | + +## July 2026 cycles + +| Doc | Repo | Description | +|-----|------|-------------| +| [SYNC_20260728.md](./SYNC_20260728.md) | Both | 10.7.3 hotfix: cross-tenant cache leak (`Select-CippAllowedTenantData`) | +| [SYNC_20260727.md](./SYNC_20260727.md) | Both | 10.7.2 major delta — SharePoint permissions reports, templated deployments, policy compare | +| [UPSTREAM_DELTA_CIPP_20260727.md](./UPSTREAM_DELTA_CIPP_20260727.md) | CIPP | Delta triage for the 07-27 cycle | +| [SYNC_20260713.md](./SYNC_20260713.md) | Both | 10.6.1 baseline + feature intake series | +| [SYNC_20260701.md](./SYNC_20260701.md) | Both | 10.5.5 baseline | + +Individual feature-intake docs from the 07-15 series (`*_INTAKE_20260715.md`) are also in +this directory. + +## June 2026 cycle (reference) + +| Doc | Repo | Description | +|-----|------|-------------| +| [FIRST_PASS_REPORT_20260617.md](./FIRST_PASS_REPORT_20260617.md) | Both | Initial inspection | +| [CUSTOM_FEATURE_MAP_20260617.md](./CUSTOM_FEATURE_MAP_20260617.md) | Both | Protected fork areas | +| [UPSTREAM_SYNC_CIPP_20260617.md](./UPSTREAM_SYNC_CIPP_20260617.md) | CIPP | Full commit inventory | +| [UPSTREAM_DELTA_CIPP_20260617.md](./UPSTREAM_DELTA_CIPP_20260617.md) | CIPP | Delta since sync base | +| [CIPP_SYNC_CHECKPOINT_20260617.md](./CIPP_SYNC_CHECKPOINT_20260617.md) | CIPP | Cycle checkpoint | +| [APPLIED_COMMITS_CIPP_20260617.md](./APPLIED_COMMITS_CIPP_20260617.md) | CIPP | Applied tracker | +| [APPLIED_COMMITS_CIPP_CYCLE2_20260617.md](./APPLIED_COMMITS_CIPP_CYCLE2_20260617.md) | CIPP | Cycle 2 tracker | + +CIPP-API cycle docs live in the **CIPP-API** repo under `docs/upstream-sync/`. + +## Naming convention + +New cycle files use `YYYYMMDD` suffix: + +- `UPSTREAM_DELTA_CIPP_YYYYMMDD.md` +- `CIPP_SYNC_CHECKPOINT_YYYYMMDD.md` +- `APPLIED_COMMITS_CIPP_YYYYMMDD.md` diff --git a/docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md new file mode 100644 index 0000000000..d3fb73305d --- /dev/null +++ b/docs/upstream-sync/history-cipp/SAMCERT_INTAKE_20260715.md @@ -0,0 +1,87 @@ +# SAM Certificate Authentication Intake — 2026-07-15 + +Dedicated feature intake: ports the upstream **SAM certificate authentication** +family (8 commits from 2026-07-09 plus follow-up fixes) into Manage365. This is +the foundational auth change that unblocks the deferred SharePoint site +management suite and parts of the SSO family. + +- API branch: `manage365/samcert-intake-20260715` (backup tag `backup/pre-samcert-intake-20260715`) +- Frontend: **no changes required** — upstream has no SAM-cert UI; the + certificate is managed by the API (setup wizard, weekly timer, and + `Invoke-ExecSAMCertificate` via ExecCippFunction). + +## What this adds + +Certificate-based app authentication alongside the existing client secret: + +- **Provisioning:** `Get-CIPPAuthentication` now preloads the SAM certificate + PFX from Key Vault (secret name `SAMCertificate`) and provisions one on first + run (guarded to at most once per process to prevent recursion loops). + `Invoke-ExecCreateSAMApp` also creates the certificate during initial setup. +- **Rotation:** `Start-UpdateTokensTimer` renews the certificate when close to + expiry, alongside the existing secret rotation. +- **Usage:** `Get-GraphToken`, `New-GraphGetRequest`, `New-GraphPOSTRequest`, + and `New-ExoRequest` accept an opt-in `-UseCertificate` switch. App-only uses + `Get-GraphTokenFromCert`; delegated keeps the refresh token but authenticates + the app with a signed JWT assertion (`New-CIPPCertificateAssertion`) instead + of the client secret. +- **App management policy:** `Update-AppManagementPolicy` now also exempts the + CIPP app from `asymmetricKeyLifetime` / `trustedCertificateAuthority` + restrictions so the 1-year self-signed certificate can be attached. + +**No existing call sites pass `-UseCertificate`** — the only upstream consumers +are the deferred SharePoint suite endpoints, so current auth behavior is +unchanged. The visible behavior change is one-time certificate provisioning on +authentication load (non-fatal on failure; retried weekly). + +## Files ported (upstream tip, wholesale) + +New: +- `Get-CIPPSAMCertificate`, `New-CIPPSAMCertificate`, `Set-CIPPSAMCertificate`, + `Update-CIPPSAMCertificate`, `Update-CIPPSAMCertificateEnvCache` +- `GraphHelper/New-CIPPCertificateAssertion` +- `Get-CippKeyVaultName`, `Get-CippOffloadSuffix` (single source of truth for + vault name; fixes the dashed-instance-name truncation bug) +- HTTP endpoint `Invoke-ExecSAMCertificate` (ROLE: `CIPP.AppSettings.ReadWrite`) + +Updated: +- `Get-GraphToken`, `Get-GraphTokenFromCert` (now shared-token-cache aware — + upstream's version is a superset of the fork's; verified the fork had no + unique lines beyond superseded keyvault-name derivation) +- `New-GraphGetRequest` (also brings `-Stream` / `-SkipValueExtraction` + pagination options), `New-GraphPOSTRequest`, `New-ExoRequest` +- `Get-CIPPAuthentication` (cert preload/provision + provision-loop fix + `5ae417185`), `Get/Set/Remove-CippKeyVaultSecret` (use `Get-CippKeyVaultName`, + skip KV 404 retries) +- `Start-UpdateTokensTimer`, `Update-AppManagementPolicy`, + `Invoke-ExecCreateSAMApp`, `Invoke-ExecCippFunction`, + `Get-CIPPSchedulerBlockedCommands` (cert functions blocked from scheduler) + +Removed: +- Stale duplicate `Modules/CIPPCore/Private/Get-CIPPSchedulerBlockedCommands.ps1` + (upstream keeps only the `Public/Tools` copy; fork copy had no unique entries) + +## Not taken (same upstream commit range) + +- `Set-CIPPDBCacheSharePointSharingLinks` streaming/OOM commits (`e7ed3a226`, + `6c86428cc`, `82ac60ee9`) — that cache setter is part of the deferred + SharePoint suite and does not exist in the fork. + +## Deployment notes + +- No SAM manifest / CPV changes required — the certificate is a credential on + the existing app registration, not a new permission. +- The Function App's managed identity must retain Key Vault set/get rights + (already required for secret rotation). +- On first run after deploy, expect an Info log "No SAM certificate found, + provisioning one now" and a new `SAMCertificate` secret in Key Vault. + +## Verification + +- PowerShell parse check on all 23 changed/added files: clean. +- Dependency scan: all helpers referenced by the new functions + (`Get-CIPPAzIdentityToken`, `Get-CippOffloadSuffix`, KV helpers, Graph + helpers) present in fork; `Get-CIPPAzIdentityToken` verified byte-identical + to upstream. +- `CIPPCore` exports via wildcard + recursive dot-sourcing, so new files are + picked up automatically. diff --git a/docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md new file mode 100644 index 0000000000..175d8dd1dc --- /dev/null +++ b/docs/upstream-sync/history-cipp/SCHEDULEDEDIT_ALERTS_INTAKE_20260715.md @@ -0,0 +1,114 @@ +# Scheduled User Edit + Dashboard Alerts Card Intake — 2026-07-15 + +**Type:** Feature intake (batch) +**Upstream baseline:** 10.6.1 (commits from upstream main, late June – early July 2026) +**Fork version:** 5.23.0 → 5.24.0 +**Backup tags:** `backup/pre-schedulededit-alerts-intake-20260715` (CIPP), `backup/pre-schedulededit-intake-20260715` (CIPP-API) +**Branches:** `manage365/schedulededit-alerts-intake-20260715` (CIPP), `manage365/schedulededit-intake-20260715` (CIPP-API) + +## Upstream commits covered + +| Commit | Repo | Subject | Disposition | +| --- | --- | --- | --- | +| `506d75ab2` | CIPP | edit user schedule (show scheduling on edit form) | Taken (adapted to fork's FormSection layout) | +| `7b3514493` | CIPP | improve user data handling / clearable fields | Already integrated in an earlier intake — no action | +| `3db7206d0` / PR #6260 | CIPP | Alerts card on dashboard | Taken | +| `0fc6459db` (remainder) | CIPP | Bulk-result rollup in CippApiResults (#6265) | Taken (missed in the previous intake — see note) | +| upstream `Invoke-EditUser` refactor + `Set-CIPPUser` | CIPP-API | Schedulable user edits | Taken (Set-CIPPUser built from the fork's richer edit logic) | + +> Note: in the MEM devices intake, the `CippApiResults.jsx` part of `0fc6459db` was +> dismissed as formatting-only based on a prettier diff that silently produced empty +> output (broken `.prettierrc` reference — the repo uses `.prettierrc.json`). Re-diffing +> with the correct config surfaced a real feature: per-action grouping of bulk results +> plus a summary alert ("X of Y actions failed"). That is now included here. + +## Changes — CIPP (frontend) + +### Dashboard Alerts card + +- `src/components/CippComponents/AlertsOverviewCard.jsx` — **new**, adopted upstream + wholesale. Shows fired alert instances for the selected tenant: active alerts on + top (snoozable per item), snoozed alerts greyed at the bottom with time remaining + and who snoozed them. +- `src/utils/format-alert-item.js` — **new**, adopted upstream wholesale. Humanizes + alert cmdlet names and extracts display fields from alert items. +- `src/components/CippComponents/CippAlertSnoozeDialog.jsx` — adopted upstream + wholesale (fork copy was an older upstream revision with no fork-only commits). + Now renders a structured field preview via `format-alert-item` instead of a + single-line string. +- `src/pages/dashboardv2/index.js` — full-width Alerts section inserted between the + Tenant Overview and Identity sections, matching upstream placement. All fork + dashboard customizations (dynamic imports, portals menu, report toolbar) untouched. +- Backend endpoints required by the card (`ListAlertResults`, `ListSnoozedAlerts`, + `ExecRemoveSnooze`, `ExecSnoozeAlert`) already exist in the fork's API. + +### Scheduled user edit + +- `src/components/CippFormPages/CippAddEditUser.jsx` — the Scheduling section now + renders for both add and edit, with mode-appropriate labels ("Schedule this user + edit for later"). Fork's FormSection layout preserved (upstream's flat layout not + adopted). +- `src/pages/identity/administration/users/user/edit.jsx` — no change needed; the + fork already had the dirtyFields/clearProperties handling from upstream + `7b3514493`, plus its own license-name mapping. + +### Bulk result rollup + +- `src/components/CippComponents/CippApiResults.jsx` — results are tagged with the + index of the bulk action they came from (`groupIndex`); when more than one action + ran, a summary alert is shown ("All N actions completed successfully" / "X of N + actions failed, Y succeeded"). Fork's detail toggles, CSV download, and table + dialog untouched. + +## Changes — CIPP-API + +### `Modules/CIPPCore/Public/Set-CIPPUser.ps1` (new) + +Upstream extracted the user-edit logic out of `Invoke-EditUser` into a shared +`Set-CIPPUser` so scheduled tasks can run the same code. The fork's version is +built from the **fork's** `Invoke-EditUser` body, preserving: + +- Granular `$BodyToship` construction (only non-null fields PATCHed; hashtable style) +- `clearProperties` explicit-clear support (null scalars / empty collections) +- UPN/mail/proxyAddress conflict lookup with actionable error details +- License short-circuit when assignments already match, `businessPhones` filtering, + `otherMails` normalization, `UserDisplay` fallback logging + +Upstream's Sherweb license block was not carried over (Sherweb intake still deferred). + +### `Invoke-EditUser.ps1` (rewritten as thin wrapper) + +- Keeps the fork's no-user-ID 400 guard. +- `Scheduled.Enabled` requests now create a scheduled task via + `Add-CIPPScheduledTask` (Command = `Set-CIPPUser`, `DisallowDuplicateName`), + honoring `Scheduled.date`, `reference`, and webhook/email/PSA post-execution. +- Immediate edits delegate to `Set-CIPPUser`. + +### Tests + +- `Tests/Endpoint/Invoke-EditUser.Tests.ps1` updated to dot-source `Set-CIPPUser.ps1`. + All 5 clear-vs-omit tests pass. + +## Verification + +- Pester: 5/5 passed (`Invoke-EditUser.Tests.ps1`). +- PowerShell parse check: both changed .ps1 files clean. +- ESLint: no new errors (one pre-existing `set-state-in-effect` error in + CippApiResults exists on the clean tree too). +- `yarn build`: passed (66s, node 22.13.0 — note node 24 fails the engine check). + +## iCloud sync note + +Two more " 2" duplicate files appeared during this intake (checkpoint doc and +CippIntuneDeviceActions from the previous intake). Both were byte-identical and +deleted. Repos remain inside `~/Documents` (iCloud-synced); moving them is still +recommended. + +## Still deferred + +- **Frontend:** config.js menu changes, top-nav tweaks, PrivateRoute/login tweaks, + Shadow AI report button removal, tenant metrics grid style, build optimisations, + container management, dependency bumps. +- **API:** Custom Test Alerting overhaul, MCP support, Purview DLP standard, Intune + policy sync / device app collection, IP lookup + audit log improvements, Sherweb, + and the remaining small items listed in prior checkpoint docs. diff --git a/docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md new file mode 100644 index 0000000000..e0d4ba8dea --- /dev/null +++ b/docs/upstream-sync/history-cipp/SPO_SUITE_INTAKE_20260715.md @@ -0,0 +1,141 @@ +# SharePoint Site Management Suite Intake — 2026-07-15 + +Dedicated feature intake: ports the upstream **SharePoint site management +suite** (7 API commits from 2026-07-09/10 plus the sharing-links streaming +fixes) into Manage365. This was the largest deferred family and depends on the +SAM certificate authentication intake completed earlier the same day — +certificate app-only tokens are what let SharePoint REST `_api/web/*` calls run +without a delegated token. + +- API branch: `manage365/spo-intake-20260715` (backup tag `backup/pre-spo-intake-20260715`) +- Frontend branch: `manage365/spo-intake-20260715` (backup tag `backup/pre-spo-intake-20260715`) +- Fork frontend version bumped to **5.19.0** (upstream baseline unchanged at 10.6.1 / API 10.6.2) + +## What this adds + +### API — net-new endpoints (upstream tip, wholesale) + +- **Sharing report:** `Invoke-ListSharePointSharing`, + `Invoke-ExecRemoveSharingLink`, `Invoke-ExecBulkRemoveSharingLinks` +- **Sharing links cache:** `Set-CIPPDBCacheSharePointSharingLinks` (includes + upstream's streaming/OOM fixes `e7ed3a226`/`6c86428cc`/`82ac60ee9`) plus its + activity workers `Push-DBCacheSharePointSiteSharingLinks` and + `Push-StoreSharePointSharingLinks` +- **External users:** `Get-CIPPSPOExternalUsers` (CSOM GetExternalUsers — + includes legacy spo:guest identities with no Entra object), + `Invoke-ListSharePointExternalUsers`, `Invoke-ExecRemoveSPOExternalUser` +- **Full site user removal:** `Remove-CIPPSPOSiteUser`, + `Invoke-ExecRemoveSiteUser` (removes a user from every site group and direct + permission grant at once) +- **Item-level recycle bin:** `Invoke-ListSiteRecycleBin`, + `Invoke-ExecRestoreRecycleBinItems` (new CIPP permission family + `Sharepoint.SiteRecycleBin.Read` / `.ReadWrite`) +- **Libraries:** `Invoke-ListSiteLibraries`, `Invoke-ExecSetLibraryPermission` +- **Version cleanup:** `Invoke-ExecSPOVersionCleanup` (fork already had + `Invoke-ListSPOVersionCleanup`) + +### API — merged with fork customizations + +- **`Invoke-ExecSetSharePointMember`** — adopted upstream's role-group model + (Owners/Members/Visitors via `associated*group` REST with `-UseCertificate + -AsApp $true`; group-connected sites keep managing Owners/Members through the + M365 group) while preserving the fork's protections: + - guest-UPN safety: prefers the picker's Entra object ID and encodes `#` as + `%23` in filter lookups (upstream used `/users/$UPN` paths that break on + `#EXT#`) + - single-quote escaping in the group OData lookup + - ensureuser force-add to the User Information List after group add (so new + members appear immediately in the members table) + - classified error messages (CPV token / cert-missing / access-denied + guidance for `CippApiResults`) +- **`Invoke-ListSiteMembers`** — adopted upstream's rewrite: real role-group + membership via cert REST, M365-group claim expansion through Graph, site + admins flagged, guest detection, with automatic fallback to the fork's old + User Information List approach when the cert/REST path is unavailable. +- **`Invoke-ExecSetSiteProperties`** — adopted upstream's version (superset of + fork's): filters group-connected sites to the supported property subset and + reports skipped properties. +- **`Push-ExecDeleteSharepointSite`** (fork's queued delete worker, both module + copies) — kept the fork's background-queue architecture, template protection, + and hub-site unregister, and applied upstream's auth findings: + - fixed a latent bug where `-extraHeaders` was passed to + `New-GraphPOSTRequest`, which has no such parameter (the POST calls would + fail at parameter binding) + - `SPO.Tenant` GET keeps `odata-version: 4.0` and now uses cert app-only + - manager POST endpoints no longer receive `odata-version` (SPO rejects it + with an "Elevated context" pipeline error) + - `SPSiteManager/delete` now uses `-UseCertificate -AsApp $true` (denies + delegated tokens with E_ACCESSDENIED) +- **`Push-CIPPDBCacheData`** (both module copies) — added the SharePoint + license gate + `SharePointSharingLinks` as its own activity (heavy: scans + every drive, spawns a child orchestrator). The CIPPCore copy previously had + no SharePoint group task at all; it now dispatches the grouped SharePoint + collection too. +- **`Config/CIPPDBCacheTypes.json`** — added the `SharePointSharingLinks` + entry; removed a pre-existing duplicate `SharePointSiteUsage` entry. +- `$MemberType` in ExecSetSharePointMember additionally reads + `$Request.Body.MemberType` so flat table-action mappings (site-details page) + can pass the member type without an addedFields object. + +### Frontend + +- **SharePoint Sites page (fork's customized page, actions added/updated):** + - Add Member: site role picker (Members/Owners/Visitors) + - Remove Member: now driven by `ListSiteMembers` (real role membership, + shows the member's role and dedupes) + - New: Remove User From Site, Revoke Sharing Links (Anonymous/External/All + scopes), Edit Site (consolidated property editor with prefill), Set + Library Permission, Start Version Cleanup Job, Check Cleanup Job Status, + item-level Recycle Bin dialog + - Off-canvas members table switched from the User Information List to + `ListSiteMembers` (role/type/guest/admin columns) + - Fork's existing quick actions (Lock/Unlock, Set Sharing Policy, Set + Storage Quota, Live Storage, Create Team from Site) untouched +- **Site Details page:** members table switched to `ListSiteMembers`; Remove + Member action now passes the member's role group and type +- **New pages:** `/teams-share/sharing-report` (charts + revoke links) and + `/teams-share/external-users` (tenant-wide external user inventory with + remove/purge actions), both wholesale from upstream +- **New components:** `CippEditSitePropertiesForm`, `CippSiteRecycleBinDialog` +- **Menu:** Sharing Report + External Users added to the SharePoint section + +### Kept fork implementations (upstream equivalents skipped) + +- **Deleted sites family** — fork's `Invoke-ListDeletedSites`, + `Invoke-ExecRestoreDeletedSite`, `Invoke-ExecRemoveDeletedSite` and the + `/teams-share/sharepoint/recycle-bin` page stay. Upstream's + `Get-CIPPSPODeletedSites` / `Restore-CIPPSPODeletedSite` / + `deleted-sites.js` were not taken (fork's version has feature parity plus + permanent-delete, which upstream lacks). +- Fork's per-property `ExecSetSiteProperty` quick actions remain alongside the + new consolidated Edit Site dialog. + +## Permissions + +- SharePoint `Sites.FullControl.All` application permission + (`678536fe-1083-478a-9c59-b99265e6b0d3` on `00000003-0000-0ff1-ce00-000000000000`) + was already present in both fork SAM manifests — no manifest change needed. + A CPV refresh is still recommended so client tenants pick up the SharePoint + app-only consent for the certificate token path. +- New CIPP RBAC roles surface automatically from the endpoint `.ROLE` + docstrings: `Sharepoint.SiteRecycleBin.Read` / `.ReadWrite`. + +## Deferred (unchanged) + +- `Invoke-ExecSetOneDriveSharing` (separate "OneDrive Sharing disable" commit) +- OneDrive root permissions cache (from the 10.6.2 hotfix range) +- License capability presets commit `29685d69b` (touches 140+ files; the + sharing-links task addition was adapted to the fork's existing license-check + style instead) + +## Verification + +- PowerShell parse check on all 25 changed/added API files: clean. +- Dependency scan of new functions: all referenced helpers + (`Get-SharePointAdminLink`, `Start-CIPPOrchestrator`, `New-GraphBulkRequest`, + KV/Graph helpers, `Get-CIPPIdentityLabel`/`Test-CIPPExternalIdentity` + defined in the sharing workers) resolve in the fork. +- `Config/CIPPDBCacheTypes.json` validates as JSON. +- Frontend production build (`yarn build`, Node 22): clean; new routes + `sharing-report.html` and `external-users.html` emitted. +- No linter errors on the seven touched frontend files. diff --git a/docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md b/docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md new file mode 100644 index 0000000000..5d2d02fcfc --- /dev/null +++ b/docs/upstream-sync/history-cipp/SSO_FAMILY_DECISION_20260715.md @@ -0,0 +1,83 @@ +# SSO / CIPP Users Family — Deferral Decision — July 15, 2026 + +Cycle type: **Feature intake (evaluated, declined)** per [PROCESS.md](PROCESS.md). + +The SSO / CIPP-user family was the largest remaining deferred item after the Copilot & AI, +SAM certificate, and SharePoint suite intakes. This cycle inventoried it fully and concluded it +**cannot be safely intaken** under Manage365's current hosting architecture. One standalone fix +from the same commit window was taken. + +## What the family is + +Upstream commits inventoried (CIPP-API): `2a2851b57` (sso auth), `fc76e111b` (app repair + +migration failures), `d2e54ee85` (app password policy), `168a11032` (manual cred input), +`405c55d08` (redirect URI), `9520792f4` (stats timer migration status), `fa5f4de6f` (feature +flag removal), plus the `be25c7640` squash that introduced `Invoke-ExecSSOSetup`, +`Invoke-ListCIPPUsers` / `Invoke-ExecCIPPUsers`, and `Start-UserSyncTimer`. + +Frontend counterparts: `src/pages/cipp/advanced/super-admin/sso.js`, `cipp-users.js`, +`CippSSOSettings.jsx`, `SsoMigrationDialog.jsx`, `ForcedSsoMigrationDialog.jsx`, and the +`unauthenticated.js` rewrite. + +Purpose: migrate CIPP instances **off Azure Static Web Apps built-in auth** onto a dedicated +CIPP-SSO Entra app with **EasyAuth configured directly on the app host**, with CIPP user/role +management moving from SWA invitations to an `allowedUsers` table synced from partner-tenant +Entra groups. + +## Why it was declined + +1. **Hard dependency on upstream's "Craft" container runtime.** Core files call + `[Craft.Services.AppLifecycleBridge]` / `[Craft.Services.AuthBridge]` — C# bridges that exist + only inside upstream's new hosted container image. They are **not** part of `CIPPSharp`. + Upstream's `Initialize-CIPPAuth.ps1` calls `AppLifecycleBridge::IsEasyAuthConfigured()` + unguarded at the top of warmup; adopting it would throw on every cold start of our Function + App. (The fork already carries a few `Craft.Services.*` call sites from earlier syncs, but all + are gated behind `$env:CIPPNG -eq 'true'` or try/catch, so they are inert.) +2. **The CIPP Users page would be a no-op.** `ExecCIPPUsers`/`ListCIPPUsers` manage the + `allowedUsers` table, but the only thing that *enforces* that table at auth time is + `Craft.Services.AuthBridge` inside the container host. Under our SWA auth, roles come from SWA + invitations plus Entra-group resolution in `Test-CIPPAccessUserRole` (which we already have, + identical to upstream). Shipping the page would present a user-management UI that silently + does nothing. +3. **Production lockout risk.** `Set-CIPPSSOEasyAuth` rewrites `authsettingsV2` on the live + Function App (`$env:WEBSITE_SITE_NAME`) via ARM, and the `Migrate` action in + `Invoke-ExecSSOSetup` is designed to move a SWA-authenticated instance onto EasyAuth. Running + any part of that against Manage365's SWA + linked Function App deployment risks breaking the + SWA→API auth handoff and locking us out. + +## Revisit condition + +Revisit **only** if/when Manage365 deliberately migrates hosting off SWA auth (e.g. upstream +fully deprecates the SWA model, or we adopt their container/self-host layout). At that point +this family is the migration path, not an optional feature — plan it as an infrastructure +change with rollback, not a code intake. + +Also skipped from the same window: + +- `Update-CIPPSAMRedirectUri` switch to `-AsApp $true` — depends on app-only + `Application.ReadWrite` behavior we haven't validated against our SAM app; the fork's + delegated version works today. +- `Start-CIPPStatsTimer` SSO-migration status fields — meaningless without the SSO stack. +- `Initialize-CIPPTimezone`, `Get-CIPPManagedIdentityResourceId`, + `Remove-CIPPMigrationAppSetting`, `Repair-CippApiIdentifierUri`, `Request-CIPPRestart` — + SSO/Craft support helpers with no consumer in the fork. + +## Taken (standalone fix from the same window) + +- **`Invoke-CIPPStandardDisableGuests` — PendingAcceptance handling** (upstream `2edc75928`): + guests who never redeemed their invite (`externalUserState -eq 'PendingAcceptance'`) are now + disabled once the invite is older than the threshold, alerts break counts into stale sign-ins + vs unredeemed invites, and the report fields gained `GuestsStaleSignInCount` / + `GuestsPendingAcceptanceCount` / `GuestsPendingAcceptanceDetails`. The `standards.json` entry + was already identical between fork and upstream, so this is a pure `.ps1` update. + +## Verification + +- PowerShell parser on the changed file: 0 errors. +- No frontend changes this cycle; no build needed. + +## Remaining deferred families (unchanged priority candidates) + +With SSO ruled out, the largest still-compatible deferred items are the BEC UI family, the +Exchange/mailbox page family, Custom Test Alerting overhaul, Intune Policy sync / device app +collection, scheduled user edit UI, and nested group memberships. diff --git a/docs/upstream-sync/history-cipp/SYNC_20260701.md b/docs/upstream-sync/history-cipp/SYNC_20260701.md new file mode 100644 index 0000000000..2e75b5bb58 --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260701.md @@ -0,0 +1,78 @@ +# Upstream Sync Checkpoint — July 1, 2026 (Light Delta) + +Cycle type: **Light delta** per [PROCESS.md](PROCESS.md). +Baseline moved: CIPP **10.5.2 → 10.5.5**, CIPP-API **10.5.2 → 10.5.6**. + +- CIPP: 42 commits applied on `manage365/upstream-sync-cipp-20260701` (backup tag `backup/pre-upstream-sync-cipp-20260701`) +- CIPP-API: 56 commits applied on `manage365/upstream-sync-cipp-api-20260701` (backup tag `backup/pre-upstream-sync-cipp-api-20260701`) + +## Verification + +- `yarn build` (Node 22.13.0): pass +- PowerShell parser on 81 changed `.ps1/.psd1` files: 0 errors +- JSON validation on all changed `.json` files: pass +- No stray conflict markers + +## Taken (highlights) + +### CIPP-API (10.5.2 → 10.5.6) + +- **Offboarding request validation** — new `Test-CIPPOffboardingRequest` rejects malformed payloads with 400 instead of silently no-oping. Extended to also accept fork-style `{ userPrincipalName }` user objects. +- **User-agent / task / standard contexts** — `Get-CippUserAgent`, `Set-CippUserAgentContext` for attributable Graph request user agents; fixes standards/scheduled-task logging. +- **Spam filter policy custom-name fixes** — matches legacy/default policy names only when no custom name is set; skips rule remediation for the built-in `Default` policy. +- **Email OTP for B2B guests** — `Set-CIPPAuthenticationPolicy` now supports `allowExternalIdToUseEmailOtp` and group exclusions (standard file itself not taken — fork does not have the new single AuthenticationMethods standard). +- **Intune policy clone + edit name/description endpoints** (`AddIntunePolicyClone`, improved `EditIntunePolicy` with odata-type normalization and settings-catalog `name` handling). +- **Mailbox rule removal hardening** for duplicate aliases (`MailboxObjectId` passthrough). +- **Excluded licenses**: `IncludeExcluded` list parameter + `ShowInLicenseDropdown` property. +- **Custom Test Engine CLM runtime**, ZTNA test expansion, run-standard logging fixes. +- **Permission repair improvements**, API client RBAC checks before creation, GDAP role mapping repair. +- Misc: New Licence updates, password generator wordlist cleanup, nextLink validation, release-notes owner/repo hardcode, NinjaOne sync moved to Reporting DB, table cleanup fixes, duplicate Intune standards fixes, CA template deployment logging, blank value fixes, EXO request fixes (incl. reverts), SharePoint Multi-Geo quota fix, Secure Score control update scoping. + +### CIPP (10.5.2 → 10.5.5) + +- **Timestamp parsing** — new `parseCippDate` util treats epoch-seconds values correctly in `CippTimeAgo`, `CippDataTable` sorting, and `getCippFormatting` (adapted into fork-protected files). +- **Intune policy actions** — Clone Policy and Edit Name & Description actions (ported in fork style into customized `CippIntunePolicyActions.jsx`). +- **Excluded licenses** — `IncludeExcluded` in license selectors; show/hide-in-dropdown actions on Excluded Licenses page. +- **ISO 639-1 / 3166-1 autocompletes** — new `LanguageCodeMultiSelect` / `CountryCodeMultiSelect` form types for spam filter block lists (adapted; fork keeps its own autoComplete case, new types recurse into it). +- **Contact fixes** — template creation/editing, edit page phone serialization + explicit-null clearing, `preserveNullValues` support in `CippFormPage`. +- **49GB shared mailbox conversion warning** in offboarding wizard (surgically ported into fork's customized wizard). +- **ListUsers → ListGraphRequest** migration for autopilot devices, business voice, room lists (fork's OneDrive page already migrated). +- **Teams default visibility now Private**, hideBulk on compliance actions, CA import/deploy drawer fixes, dynamic group nesting, phishing-resistant MFA card fix, permission repair UI, GDAP repair action, colliding query keys fix, "Selected Deviations" label, bookmark cleanup, alerts/M365Licenses/CIPPDBCacheTypes/standards.json data updates, `userType` column on Users list, `encodeURIComponent` on version alert query. + +## Deferred (revisit next cycle) + +### CIPP-API + +| Item | Reason | +|------|--------| +| Purview DLP Policy standard (`a9b3e404e`) | Large feature; conflicts with fork DLP files — needs dedicated intake | +| Custom Test Alerting overhaul (`0c3d4ba7e`, `05f5f1fce`) | Conflicts in ExecTestRun/custom scripts; test after CLM runtime settles | +| Intune Policy sync / device app collection (`a2dec4281`, `10f24789c`) | Conflicts; depends on Intune report-export orchestrator not in fork | +| IP lookup + Audit Log improvements (`eac806c72`) | Conflicts with fork audit log processing | +| 90-day cache cleanup (`739d3785d`), RG name resolution (`f690b6df4`) | Conflicts; low urgency | +| APISpec move to Config (`b560d158b`), stats props (`a938c36bf`), allowed modules (`5153adc62`) | Structural; fork layout differs | +| MTD role standard (`a8143b4b2` API side + standards.json) | standards.json conflict — pair with frontend intake | +| Schema-backed standards repair (`2c63d3174`), drift logging (`ee92936ef`), sensitivity label fixes (`5392acf40`), SPO version cleanup job (`151ef4649`), github template id sync (`d2655de84`), contact template deployment (`45b96d6af`), ListLicensesReport (`2f02befcd`), requirements clarification (`7dea7f40f`), write-information fix (`07ba3d02b`), files check (`484bff838`), App Insights toggle (`04b3e124a`), permissions removal (`116429034`), json-from-frontend (`e2b092bdd`), move file (`b75c1fe90`), timer start earlier (`d2e88c5a9`) | Conflicts with fork files or depend on deferred features | + +### CIPP + +| Item | Reason | +|------|--------| +| PrivateRoute/login tweaks (`539ef35d3`, `a79f4100e`, `5e8a4d941`, `e9e0147c4`) | Fork has custom fast-path PrivateRoute + unauthenticated page; revisit with SSO intake | +| SPO version cleanup UI (`5426c48b0`, `ca78e05c8`) | Backend pair deferred | +| Tenant metrics grid responsive style (`495f38808`) | Fork intentionally uses compact style | +| Build optimisations (`907075a91`) | Whole-tree refactor (standards-data, license catalog utils); fork-protected files | +| Copilot menu + pages (`cd773184c` / API `114f3c7f5`, `4160b5160`, `83c77358f`, `0a3409a5f`) | New feature area — schedule as feature intake | +| CIPP Users page (`cacd07688`), user auth/sync logic (API `920e3a1c3`), Initialize-CIPPAuth (`3cd0b3f5c`, `00597e40a`), SSO password policy (`d2e54ee85`), redirect uri patch (`504c21ae3`) | SSO/CIPP-user feature family — part of planned SSO intake | +| Container management (`024c3daaa`, `c12962d60`, `cc7e46839`) | Fork does not use container management | +| Dependency bumps (react-query-devtools, mui-tiptap, apexcharts, reduxjs/toolkit, dompurify, blob upload action) | Take deliberately with regression testing, not via cherry-pick | + +## Fork customizations verified intact + +- `CippDataTable` mobile card view (timestamp fix applied surgically) +- Custom offboarding wizard with risk coaching (49GB warning added inside it) +- Custom users index (mobile-aware; userType column added) +- Custom contacts edit page (Container layout preserved) +- `CippFormComponent` autoComplete row-placeholder substitution (new ISO types recurse into it) +- Custom PrivateRoute fast path, custom top-nav (bookmark hook cleanup applied; top-nav untouched) +- Fork error-guidance pattern in quarantine/guest-invite flows (untouched this cycle) diff --git a/docs/upstream-sync/history-cipp/SYNC_20260713.md b/docs/upstream-sync/history-cipp/SYNC_20260713.md new file mode 100644 index 0000000000..b9c1d4138d --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260713.md @@ -0,0 +1,128 @@ +# Upstream Sync Checkpoint — July 13, 2026 (Major Delta) + +Cycle type: **Major delta** per [PROCESS.md](PROCESS.md) — upstream shipped a full release cycle +(10.5.x → **10.6.1**, 187 API commits / 156 frontend commits inventoried, plus follow-ups). + +Baseline moved: CIPP **10.5.5 → 10.6.1**, CIPP-API **10.5.6 → 10.6.1**. + +- CIPP: 76 commits applied on `manage365/upstream-sync-cipp-20260713` (backup tag `backup/pre-upstream-sync-cipp-20260713`) +- CIPP-API: 119 commits applied on `manage365/upstream-sync-cipp-api-20260713` (backup tag `backup/pre-upstream-sync-cipp-api-20260713`) + +## Verification + +- `yarn build` (Node 22.13.0): pass +- PowerShell parser on 248 changed `.ps1/.psm1` files: 0 errors +- JSON validation on all changed `.json` files: pass +- No stray conflict markers +- `package.json` / `yarn.lock` disappearing mystery **solved**: upstream's build script ends with + `rm -rf package.json yarn.lock` (added in upstream `5b31bb6ea`, Mar 2025, for their Azure SWA + deploy flow). Every local `yarn build` deleted both files, and `git add -A` then committed the + deletions (this cycle's `e6f9dd989`, and June 24's `4e1c7d049`). Fixed by dropping the `rm` + from the fork's build script — safe because our SWA workflow deploys `out/` with + `skip_app_build: true`, so the root `package.json` never reaches Oryx. Watch for upstream + re-introducing the `rm` when cherry-picking future `package.json` changes. + +## Taken (highlights) + +### CIPP-API (10.5.6 → 10.6.1) + +- **Audit log V2 planner** — full rework for resilience: `Start-AuditLogPlannerV2` timers + (replaces old orchestrator entries in `Config/CIPPTimers.json`; fork processor queue timer kept), + manual search fixes, log-collection payload updates. +- **Direction-scoped Intune group assignment** — `Set-CIPPAssignedPolicy` / + `Set-CIPPAssignedApplication` accept `ExcludeGroupIds`/`ExcludeGroupNames` and an assignment + direction so Replace can edit one direction without wiping the other; square-bracket escaping in + group name matching. +- **Clearable fields in user edit** — `Invoke-EditUser` explicit `clearProperties` whitelist, + adapted into the fork's hashtable-based `$BodyToShip` (nulls for scalars, empty arrays for collections). +- **Group member handling** — enhanced add/remove logging with group names (fork's + already-a-member tolerance preserved); sec-group add fix; mail-enabled security group removal + during license removal (fork's actionable error messages preserved). +- **Auth method sub-settings** — `Set-CIPPAuthenticationPolicy` supports SMS/Voice/QRCodePin + sub-settings; upstream Email OTP implementation absorbed (already carried fork's B2B params). +- **SMTP client auth state** in `Invoke-ListUserMailboxDetails` (fork's BlockExternalInbound/ + Outbound fields preserved; AutoExpandingArchiveScope skipped). +- **Drift management** — stale-entry pruning, valid-standard tracking, package-map CA tag lookup, + template depth fix, deleted-template row cleanup. +- **CIPPSharp** aligned with upstream master (source + binary; no fork customizations existed). +- **Permission/RBAC hardening** — `Get-CippHttpPermissions`, role dedupe scoping, `.None` + exclusion, base-name permission matching, upstream's permission-repair reverts. +- **Group templates**: email aliases + hide-from-GAL support. +- Misc: EXO error preservation, JSON escaping for Intune policies, Graph POST retry-reason + logging, table read retry, AzBobbyTables bump, token timer secret cleanup, extension alert + watermark fix, DMARC onmicrosoft skip, BEC message trace, incident severity endpoint, Rogue App + List, ACSC Essential Eight test suite, test runner/scaffolder, OpenAPI enrichment, backup + replication, vacation-mode/offboarding fixes, curated `standards.json` refresh (upstream tip + minus standards without fork implementations). + +### CIPP (10.5.5 → 10.6.1) + +- **Audit log search UI** — upstream's rewritten searches page (V2 pipeline pairing), manual + searches restored, tabOptions update; legacy coverage page removed with upstream. +- **Intune assignment pickers** — include/exclude group pickers + assignment direction radio on + policy, script, and application assign actions (fork's color-coded action categories preserved); + per-field `condition` support in `CippApiDialog` (auto-merged). +- **User template switching fix** — template-driven fields are replaced/cleared on switch instead + of lingering (adapted into fork's FormSection-styled `CippAddEditUser`); array-notation + + business phone template fixes; `calculatedGroupType` passed on group add/remove options. +- **Clearable profile fields** — edit-user page reports actively-emptied fields via + `clearProperties` (dirty-field tracking with `useFormState`), pairing with the API change. +- **JIT admin roles** — dedicated `JitAdminRoles.json` (replaces GDAP catalog reuse), current + Entra role names, Microsoft 365 / Entra Backup roles added. +- **Entra terminology sweep** — Azure AD → Microsoft Entra in UI labels, GDAP role catalog, + device trust/join state rendering, managedDevice translation keys; Compliance Portal → Purview + Portal renames. +- **Backup replication card** + `ReplicationScopeCard` on settings/backup. +- **Group templates**: email aliases + hide-from-GAL fields integrated into fork's redesigned + add-group form (distribution + mail-enabled security). +- **Alerts/PSA UX family** — PSA Ticket Strategy on alert form, HaloPSA integration clarity, + helperText styling, audit alert presets for external forwarding/Exchange admin elevation. +- **Reports** — shared mailbox enabled report with allTenants + ReportDB, HVEAccounts cache type, + incident Set Severity + resolving comment, vacation mode task details, drift management + improvements, app registration improvements, delivery insights + paste input mode. +- Misc: `util-columnsFromAPI` refactor (fork's skipRecursion + prototype-pollution guard + reapplied), TabbedLayout advanced-tab gating, room calendar processing options, default calendar + permission warning, CippAutocomplete tenant-scoped query keys, bulk-action row counts, CA + session-control editing fix, stale Entra devices remediation action, standards/alerts JSON + refreshes. + +## Deferred (revisit next cycle / feature intake) + +Carried forward from July 1 (see [SYNC_20260701.md](SYNC_20260701.md)) plus new this cycle: + +### CIPP-API + +| Item | Reason | +|------|--------| +| SAM certificate auth family (`da30ffcad`, `bf76f2bd6`, `2e636ca54`, `5f2a3e3ec`, `2b3ec21dd`, `e7ed3a226`, `6c86428cc`, `82ac60ee9`) | Foundational auth change — dedicated feature intake with staged rollout | +| SharePoint full site management suite (`d50b71747`, `0fe9645a1`, `2bc15bf02`, `2e8531cf1`, `06d0bd80f`, `559036d6f`, `aa7e060b6`) | Depends on SAM cert auth; fork has protected non-group member management | +| Copilot feature area (`114f3c7f5`, `4160b5160`, `83c77358f`, `0a3409a5f`) | New feature area — schedule as feature intake | +| SSO / CIPP user family (`920e3a1c3`, `3cd0b3f5c`, `00597e40a`, `d2e54ee85`, `504c21ae3`) | Planned SSO intake (phases already scoped) | +| `915355cb9` Set-CIPPUser refactor of EditUser | Fork's custom `Invoke-EditUser.ps1`; needed for scheduled user *edits* — pair with next cycle | +| Purview DLP standard, Custom Test Alerting overhaul, Intune policy sync, IP lookup/audit improvements, cache cleanup, RG resolution, APISpec move, MTD role standard, schema-backed standards repair, sensitivity label color family, Sherweb API client fix | Same reasons as July 1 checkpoint | + +### CIPP + +| Item | Reason | +|------|--------| +| Scheduled user *edit* UI (`506d75ab2`) | Requires API `Set-CIPPUser` refactor (deferred above) | +| BEC UI family (`c1fb0f92a`, `cb81f1a07`, `a445e3981`, `8359da60e`, `488541e0a`) | Fork has 6 custom BEC commits incl. retry logic — adapt as a unit | +| Dashboard Alerts card (`3db7206d0`) | Fork dashboard has 18 custom commits; API endpoint (`93ea8ca12`) already taken | +| SharePoint UI family (deleted sites, external users, edit site properties, sharing report) | API dependencies on SAM cert auth | +| Exchange/mailbox page family (`ed025994c`, `6433cd3a2`, `fc446f8d0`, `553e4cfc2`, `a3d25bfbb`, `605990cdb`, `b1838ab84`, `afca350cb`) | Fork has 11–15 custom commits on these files — adapt as a unit | +| UserActions family (`01cff98d1`, `af1fe13ff`, `22f153f48`, `f66e74a07`) | Fork has 18 custom commits on `CippUserActions.jsx` | +| Nested group memberships (`456662835`, `1e60e5f2b`) | Fork `groups/edit.jsx` has group-based licensing customization | +| MEM devices page (`35a019f65`, `b6d2de4d7`, `eb1935152`), get-cipp-formatting (`9fd979ec9`), TableToptoolbar (`c4608b26c`), ChartCard (`690f7720a`), ApiDialog (`f543ba8cb`), config.js menu changes (`c38010f5e`, `2d50bf858`, `612ef72b8`), top-nav (`2d0b8f271`), DataTable (`0a3fe87d2`, `04d89c427`), ApiResults (`0fc6459db`) | Protected/heavily customized fork files — selective adaptation only | +| Shadow AI report button removal (`6a1d7de99`), coverage page removal already taken | — | +| PrivateRoute/login tweaks, SPO version cleanup UI, tenant metrics grid style, build optimisations, Copilot pages, CIPP Users page, container management, dependency bumps | Same reasons as July 1 checkpoint | + +## Fork customizations verified intact + +- `CippDataTable` mobile card view; custom users index; custom contacts edit page +- Custom offboarding wizard with risk coaching +- `CippFormComponent` autoComplete row-placeholder substitution +- Custom PrivateRoute fast path and top-nav +- Color-coded action categories (preserved through every adapted actions file) +- SharePoint non-group member management + guest `#EXT#` handling +- Fork error-guidance pattern (`CippApiResults` classification) +- Curated `standards.json` (upstream standards without fork implementations excluded) diff --git a/docs/upstream-sync/history-cipp/SYNC_20260727.md b/docs/upstream-sync/history-cipp/SYNC_20260727.md new file mode 100644 index 0000000000..0571cd66ae --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260727.md @@ -0,0 +1,106 @@ +# Upstream Sync Checkpoint — 2026-07-27 + +Cycle type: **Major delta**. Baseline moved: + +| Repo | From | To | Upstream ref | +|---|---|---|---| +| CIPP (frontend) | 10.6.1 (`17ed2b396`) | **10.7.2** | `upstream/main` @ `44ac45831` | +| CIPP-API | 10.6.1 (tag) | **10.7.2** | `upstream/master` @ `d63b7fae3` | + +Branches: `manage365/upstream-sync-cipp-20260727` / `manage365/upstream-sync-cipp-api-20260727`. +Backup tags: `backup/pre-upstream-sync-cipp-20260727` / `backup/pre-upstream-sync-cipp-api-20260727`. +Triage detail: `UPSTREAM_DELTA_CIPP_20260727.md` (this repo) and `UPSTREAM_DELTA_CIPP_API_20260727.md` (API repo). + +## Structural note + +Upstream moved to the **CyberDrain org**; releases 10.7.0–10.7.2 landed as +single-parent squash commits. Cycle was executed as: (1) cherry-pick true +commits individually, (2) port squash-only content per accepted feature area +via path-scoped diffs against the upstream tip. + +## Applied + +- **CIPP-API**: 54 commits on the sync branch (cherry-picks + squash ports). +- **CIPP**: 29 commits on the sync branch (cherry-picks + squash port + icon fix). + +### Highlights (both repos) + +- **SharePoint permissions report family** — new permissions-report page, PDF + report primitives (`CippPdf/`), `PermissionsReportButton`/`SharingReportButton`, + `CippLibraryPermissionsDialog` (Manage Permissions), `CippCheckUserAccessDialog` + (Check User Access) wired into the fork's `useCippSiteActions` hook. +- **SharePoint templated deployments v1 + hardening** — template builder, + deploy drawer with live job progress (new opt-in `jobProgress` prop grafted + into the fork's protected `CippApiResults`), `CippMultiQueueTracker`, + `CippQueryRefreshButton`, template schemas, nav entries. +- **Sharing report risk analytics** — anonymous-edit/never-expiring links, + folder shares, external recipients (page taken wholesale; verified verbatim + upstream-derived, no fork customization). +- **Policy compare** — new `CippPolicyDiffTable`/`CippPolicyCompareDialog`; + compare-policies page refactored onto the shared table, fork branding and + single-result fix preserved. +- **401 flash fix** — adapted surgically into the fork's fast-path + `PrivateRoute` (loading guard) + `authmecipp` persistence exclusion in `_app.js`. +- **Custom test save/run UX** — `useCippFormPageActions` context added to the + fork's `CippFormPage` (fork submit tooltip/cleaned-values pipeline kept). +- **Intune** — fuzzy policy matching (`Find-CIPPFuzzyPolicyMatch` + + levenshteinDistance), app template deploy standard, MAM endpoint fixes, + @odata.type preservation, append-default assignments. +- **Standards** — SmartLockout (Enforce), DisableInactiveUsers, + IntuneAppTemplateDeploy, NudgeMFA group targeting/registration campaign, + DisableM365GroupUsers AllowedGroupName/CreateGroup, ConditionalAccessTemplate + report/warn enabled, SPOVersionControl validators, Copilot settings/limited + mode surfaced in FE (API implementations exist from 07-15 intake). +- **Identity** — password writeback for synced-user resets (fork's password + parameter kept), reset-password helper text, group updates routed by + effective type. +- **Site (in)activity cache and report**, mailbox quota alert types, shadow AI + alerting, GDAP roles/age-group updates, CISA/ORCA/ZTNA test fixes. + +### Curated/protected merges + +- `Config/standards.json` (API) and `src/data/standards.json` (FE): union-merged, + fork formatting preserved (text-level edits, no reserialization). +- `Config/SAMManifest.json` / `PermissionsTranslator.json`: union merges (PIM + + CopilotPolicySettings permissions). CPV refresh required after deploy. +- Fork nav (`layouts/config.js`), `CippUserActions`, `CippAddEditUser`, + mailboxes and teams-activity pages: fork versions kept, upstream changes + applied surgically. + +## Skipped / Deferred (see delta docs for full list) + +- Sherweb migration tasks, CSP license page actions (fork excludes Sherweb/CSP). +- Container management (`CippContainerManagement`) — not in fork. +- Teams V2 (`New-TeamsRequestV2` + vendored MicrosoftTeams module removal) — deferred, large blast radius. +- SSO dialogs / forced SSO migration — deferred (SSO family intake). +- `custom-domains.js` + `ExecAppServiceDomains` — deferred. +- Upstream CI workflows (fork uses its own Azure SWA workflow), version bumps, + dashboard v1. +- `CippAnonymizedReportAlert` on mailboxes/teams-activity pages — partial: alert + component taken, integration into those two fork-customized pages deferred. + +## Cleanup + +- Removed 10 tracked `" 2"` Finder-duplicate files in CIPP-API from the 07-15 + Copilot intake (duplicate .ps1 files define functions twice at module load). + +## Verification + +- `yarn build` (Node 22.13.0): pass — all pages incl. new + permissions-report / sharepoint-templates / compare-policies routes. +- PowerShell AST parse of all 138 changed API .ps1 files: pass. +- JSON validation Config/* both repos: pass (pre-existing BOM on two + TransportRuleTemplate files and intentionally-empty blank.json noted, not + from this cycle). +- ESLint on all hand-merged files: clean. + +## Versions + +- Manage365 5.27.0 → **5.28.0**; upstream baseline 10.6.1 → **10.7.2** + (`package.json`, `public/version.json`, `public/manage365-version.json`, + API `version_latest.txt`). + +## Post-deploy actions + +1. CPV refresh to push new SAM permissions (PIM RoleManagement, Copilot policy) to client tenants. +2. Smoke test: SP permissions report, SP template deploy (job progress), sharing report sync, login flow (401 flash), reset password on a synced user. diff --git a/docs/upstream-sync/history-cipp/SYNC_20260728.md b/docs/upstream-sync/history-cipp/SYNC_20260728.md new file mode 100644 index 0000000000..1f0017533f --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260728.md @@ -0,0 +1,135 @@ +# Upstream Sync Checkpoint — 2026-07-28 + +Cycle type: **Hotfix** (critical upstream tenant-isolation fix). Baseline moved: + +| Repo | From | To | Upstream ref | +|---|---|---|---| +| CIPP (frontend) | 10.7.2 (`44ac45831`) | **10.7.3** | `upstream/main` @ `d72c1e21b` | +| CIPP-API | 10.7.2 (`d63b7fae3`) | **10.7.3** | `upstream/master` @ `f1b2c93d5` | + +Branches: `manage365/upstream-sync-cipp-20260727` (frontend, carries the action-menu +work) / `manage365/upstream-hotfix-cipp-api-20260728`. +Backup tag: `backup/pre-upstream-hotfix-cipp-api-20260728`. + +## Why this cycle exists + +Upstream shipped 10.7.3 as a **cross-tenant data leak fix**. A family of cached +`List*`/`Exec*List` endpoints reads a global cache table by `PartitionKey` and returns +the rows directly. On a cache hit `Get-Tenants` is never called, so the +`$script:CippAllowedTenantsStorage` scope that normally narrows a tenant-restricted +custom role was never applied — a restricted caller invoking one of these with +`tenantFilter=AllTenants` received **every managed tenant's data**. + +Affected surfaces: users, mailbox rules, transport rules, quarantine, MFA and basic-auth +reports, conditional access policies, licenses, JIT admin, Lighthouse device compliance, +and security alerts / incidents / MDO alerts. + +## Frontend delta: none + +`44ac45831..d72c1e21b` touches only `package.json` and `public/version.json`. There is no +frontend code in 10.7.3 — the entire fix is backend. The frontend branch therefore carries +only the baseline bump plus this cycle's own fork work (action-menu categories). + +## Applied — CIPP-API (6 commits) + +| Batch | Upstream | Outcome | Notes | +|---|---|---|---| +| 1 | PR #99, #100 | **Apply** (new files) | `Select-CippAllowedTenantData.ps1`, `Get-CippRequestContext.ps1`, `Tests/Private/Select-CippAllowedTenantData.Tests.ps1` | +| 2 | PR #99, #100 | **Apply** | JIT admin, alerts, incidents, MDO alerts — byte-identical to upstream, no fork customization | +| 3 | PR #99, #100 | **Adapt** | mailbox rules, transport rules, basic auth, MFA users, CA policies, Lighthouse compliance, ListUsers — all fork-customized, only the narrowing line ported | +| 4 | PR #99, #100 | **Adapt** | quarantine (protected) + licenses (path divergence) | +| 5 | PR #99, #100 | **Apply / Adapt** | four PSScriptAnalyzer suppressions | +| 6 | — | **Chore** | baseline → 10.7.3 | + +### Protected-path adaptations + +- **`Invoke-ListMailQuarantine.ps1`** is in the protected Quarantine Portal area. Only the + AllTenants cache-read line changed (`$Messages = $Rows` gained the narrowing pipe). + Pagination, post-filters, the 7d window and the export path are untouched. Narrowing + happens before rows are expanded, so returned counts stay consistent. +- **`Invoke-ListLicenses.ps1`** lives at `Tenant/Reports/` in the fork but at the + `HTTP Functions` root upstream. Applying upstream's file would have added a second copy + and defined the function twice at module load — the same duplicate-file class of bug the + 07-27 cycle cleaned up. Ported into the fork's path instead. +- **`Invoke-ListUsers.ps1`** cannot be narrowed: the deprecated `cacheusers` blob has no + reliable per-tenant column. A restricted caller now receives the existing deprecation + message instead of every tenant's users; unrestricted callers keep legacy behavior. + +### Module placement + +Both new helpers went to `Modules/CIPPCore/Public/Authentication/`, matching upstream's +explicit warning: `$script:CippAllowedTenantsStorage` is an AsyncLocal in **CIPPCore** +module scope, so a copy living in CIPPHTTP would read that module's own permanently-empty +variable and silently filter nothing. Verified before porting: + +- The fork's `Modules/CIPPCore/.../New-CippCoreRequest.ps1` defines all four storage slots + (`CippInvocationIdStorage`, `CippAllowedTenantsStorage`, `CippAllowedGroupsStorage`, + `CippUserRolesStorage`), so `Get-CippRequestContext` works verbatim. +- `Get-Tenants` exists only in CIPPCore and is already called from 75 CIPPHTTP endpoints, + confirming cross-module calls resolve the slot correctly. + +## Already implemented + +- **`Start-AuditLogIngestionV2.ps1`** — upstream added `RowKey` to two + `Get-CIPPAzDataTableEntity -Property` lists. The fork already passes + `@('PartitionKey', 'RowKey')` for the CacheWebhooks read and does not use `-Property` at + all for the ledger read (fetches all properties), so the fix is already satisfied. + +## Deferred + +- **`Start-SchedulerOrchestrator.ps1`** — upstream adds a `$ValidTypes` guard that + **deletes** legacy `Alert` partition rows via `Remove-AzDataTableEntity`. Destructive + against fork SchedulerConfig data; needs a review of what the fork actually stores in + that partition before adopting. Not security-related. +- **`Get-AuthorisedRequest.ps1`** — upstream changed `$Uri -like '*/organization'` to + `$Uri -match '/organization(\?|$)'`. The fork's partner-URI allowlist **has no + `/organization` clause at all**, so there is nothing to fix; adding the clause would + change which requests are treated as partner-context. Flagged for a deliberate decision + rather than absorbed silently. + +## Skipped + +- **`Test-CIPPAccess.ps1`** — one indentation fix and removal of a trailing period in an + error message. Cosmetic only, in a Critical-risk auth path the fork has customized. Not + worth the diff. + +## Verification + +- **Coverage check:** the fork's `Select-CippAllowedTenantData` call sites were diffed + against upstream's by basename — **12 files, identical call counts**, with licenses at + the fork's path. No upstream call site missed. +- **Fork-only gap check:** audited fork-only endpoints that read a `Cache*` table with + `AllTenants` handling for the same leak class. `Invoke-ExportMailQuarantine.ps1`, + `Invoke-GetMailQuarantineMessage.ps1` and `Invoke-ExecMailboxSafeSender.ps1` do not read + the AllTenants cache, so no fork-specific leak exists. +- **Pester:** `Tests/Private/Select-CippAllowedTenantData.Tests.ps1` — **8/8 pass** against + the fork (restricted scope, customerId vs domain matching, case-insensitivity, partner + rows, unrestricted pass-through, zero `Get-Tenants` calls when unrestricted). +- **AST parse:** all changed `.ps1` files parse clean. +- **Frontend:** `npm run build` pass; ESLint clean. + +## Versions + +- Manage365 5.29.0 → **5.30.0**; upstream baseline 10.7.2 → **10.7.3** + (`package.json`, `public/version.json`, `public/manage365-version.json`, API + `version_latest.txt` **and** `Config/version_latest.txt`). +- `Config/version_latest.txt` had drifted to **10.6.2** while the root file was at 10.7.2; + both are now 10.7.3. +- README "Last synced with upstream" was a cycle stale (still 10.6.1 / v5.25.0 after the + 07-27 cycle shipped 10.7.2); now reflects 10.7.3 / v5.30.0. + +## Post-deploy actions + +1. Deploy **all** Function App slots — the fix is backend-only and every slot loads CIPPCore. +2. No CPV refresh needed: no SAM permission changes this cycle. +3. Smoke test with a **tenant-restricted custom role**: call Users, Mailbox Rules, + Transport Rules, Quarantine, MFA report and CA policies with `tenantFilter=AllTenants` + and confirm only that role's tenants come back. Confirm an unrestricted admin still + sees everything. + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `d72c1e21b` (upstream/main) | +| CIPP-API | `f1b2c93d5` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp/SYNC_20260803.md b/docs/upstream-sync/history-cipp/SYNC_20260803.md new file mode 100644 index 0000000000..ab71aab03a --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260803.md @@ -0,0 +1,60 @@ +# Upstream Sync Checkpoint — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP (frontend) | 10.7.3 (`d72c1e21b`) | **10.7.5** | `upstream/main` @ `274880fd0` | +| CIPP-API | 10.7.3 (`f1b2c93d5`) | **10.7.5** | `upstream/master` @ `245d9d35b` | + +Branches: `manage365/upstream-sync-cipp-20260803` / +`manage365/upstream-sync-cipp-api-20260803`. +Backup tags: `backup/pre-upstream-sync-cipp-20260803` / +`backup/pre-upstream-sync-cipp-api-20260803`. + +Delta docs: [UPSTREAM_DELTA_CIPP_20260803.md](./UPSTREAM_DELTA_CIPP_20260803.md), +CIPP-API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260803.md`. + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | AzBobbyTables 3.6.2 + `Add`/`Get`/`Remove-CIPPAzDataTableEntity` + call-site renames + ConversionTable | **Apply** | +| 2 | Intune template drift helpers (`Get-CIPPIntunePolicyName`, `Merge-CIPPIntuneTemplateIdentity`, `Select-CIPPIntuneAvailableSetting`), standard/compare updates, SafeLinks, Get-CIPPDrift Microsoft-managed skip | **Apply** (31/31 Intune helper Pester) | +| 3 | `disableNesting` (New-CIPPGroup + FE form), EditGroup `AddDevice` + MEM device action + adapted groups edit dialog, SAM `RoleManagement.Read.Exchange` Scope | **Adapt** (preserved fork groupType/mailNickname + redesigned edit page) | +| 4–5 | Snooze Reason (FE+API), default Home test suite, partner webhook stale-URL + `Get-CIPPHostname`, M365Licenses.json, audit log V2 + webhook tests | **Apply / Adapt** (21/21 `Test-CIPPAuditLogRules` Pester) | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO preconsent / `CippSSOSettings` / `Invoke-ExecSSOSetup` | **Skip** | SSO family — SWA/Craft (2026-07-15 decision) | +| `CippAppServiceDomains` / `ExecAppServiceDomains` | **Defer** | No App Service custom-domain hosting in fork | +| `Start-SchedulerOrchestrator` `$ValidTypes` destructive cleanup | **Still defer** | Carryover from 07-28 | +| Teams V2, MCP, Worker health, container management, Purview DLP | Unchanged backlog | See PROCESS.md Feature intake backlog | + +## Verification + +- Frontend: `npm run build` — pass +- Pester: Intune helpers 31/31; `Test-CIPPAuditLogRules` 21/21 +- AST parse: all newly ported `.ps1` files OK +- SAMManifest JSON valid after Scope union-merge + +## Versions + +- Manage365 **5.30.0 → 5.31.0**; upstream baseline **10.7.3 → 10.7.5** +- API `version_latest.txt` and `Config/version_latest.txt` both **10.7.5** + +## Post-deploy actions + +1. Deploy Static Web App +2. Deploy **all** Function App slots (AzBobbyTables + CIPPCore changes) +3. **CPV refresh** — new Graph delegated Scope `RoleManagement.Read.Exchange` (`3bc15058-…`) +4. Smoke: Intune template drift, MEM device Add-to-Group, group create with disableNesting, partner webhook page, snooze with reason + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `274880fd0` (upstream/main) | +| CIPP-API | `245d9d35b` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp/SYNC_20260814.md b/docs/upstream-sync/history-cipp/SYNC_20260814.md new file mode 100644 index 0000000000..f2a8e2fe67 --- /dev/null +++ b/docs/upstream-sync/history-cipp/SYNC_20260814.md @@ -0,0 +1,66 @@ +# Upstream Sync Checkpoint — 2026-08-14 + +Cycle type: **Major** (upstream **10.7.5 → 10.8.5**; plan scoped as 10.8.4, tip advanced). + +| Repo | From | To | Upstream tip | +|---|---|---|---| +| CIPP | 10.7.5 (`274880fd0`) | **10.8.5** | `upstream/main` @ `a1b620403` | +| CIPP-API | 10.7.5 (`245d9d35b`) | **10.8.5** | `upstream/master` @ `e02ac3724` | + +Branches: `manage365/upstream-sync-cipp-20260814` / +`manage365/upstream-sync-cipp-api-20260814`. +Backup tags: `backup/pre-upstream-sync-cipp-20260814` / +`backup/pre-upstream-sync-cipp-api-20260814`. + +Delta: [UPSTREAM_DELTA_CIPP_20260814.md](./UPSTREAM_DELTA_CIPP_20260814.md), +API `docs/upstream-sync/UPSTREAM_DELTA_CIPP_API_20260814.md`. +Baselines: [BASELINES_INTAKE_20260814.md](./BASELINES_INTAKE_20260814.md). + +## Applied + +| Batch | Theme | Outcome | +|---|---|---| +| 1 | ConversionTable, ListSecureScoreReport + Get-CIPPSecureScoreReport, FE securescore + AllTenants helpers | **Apply / Adapt** | +| 2 | ListIntuneApprovalRequests + alert + retry; BitLocker search page + nested ExecBitlockerSearch; FE MAA + BitLocker nav | **Apply** | +| 3 | ListRoles (nested), ListTenantAllowBlockList (Spamfilter), TABL helpers, ExecSetDefaultMFAMethod, CA/EXO PowerShell/DisableM365GroupUsers standards | **Apply** | +| 4 | Baselines modules (29) + Set-CippBaselineRunContext + orch + activities + 9 HTTP + BaselineStandards (81) + FeatureFlags/Timers (flag **off**) + FE pages/components; nav commented | **Feature intake** | +| 5 | ListBrandingSettings/Presets + Get-CIPPBranding*; ListCommunityRepoTemplates + catalog/CippTemplateCatalog (nav not fully rewired) | **Apply (partial)** | +| — | M365Licenses.json | **Apply** | + +## Skipped / Deferred + +| Item | Outcome | Why | +|---|---|---| +| SSO / authentication nav / container-management / ForcedSsoMigration | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After ports settle | +| Full BEC / user detail rewrite; Default MFA **UI** wire into fork user page | **Defer Adapt** | API ported; FE surgical later | +| Full community-repos index.js rework | **Defer Adapt** | Catalog API + page present | +| Full branding settings JSX replace | **Defer Adapt** | List APIs ported; keep Manage365 branding UI | +| CVE report rewrite | **Skip** | Fork removed CVE surface on origin | +| Teams V2 | Unchanged deferred | | +| PublicMcpRegister | **Defer** | MCP already intaken separately | + +## Verification + +- PowerShell AST: Baselines/*.ps1 + key new HTTP entrypoints OK +- `Baselines.Enabled` = **false** in FeatureFlags +- SAMManifest: no new permission IDs this cycle + +## Versions + +- Manage365 **5.32.2 → 5.33.0**; upstream baseline **10.7.5 → 10.8.5** +- API `version_latest.txt` / `Config/version_latest.txt` → **10.8.5** + +## Post-deploy + +1. Deploy SWA + **all** Function slots (esp. standards processor for baseline timer when enabled) +2. Smoke: MAA Requests, BitLocker search, Secure Score, `/tenant/baselines` (direct URL) +3. Enable `Baselines` flag only after orchestrator smoke +4. Optional: uncomment Baselines nav in `src/layouts/config.js` + +## Next cycle base SHAs + +| Repo | Base | +|---|---| +| CIPP | `a1b620403` (upstream/main) | +| CIPP-API | `e02ac3724` (upstream/master) | diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md new file mode 100644 index 0000000000..2d3f1b2633 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260617.md @@ -0,0 +1,286 @@ +# Upstream Delta Inventory — CIPP (Frontend) + +Generated: 2026-06-17 +Production branch: `main` @ `81a5dc53b` +Upstream: `KelvinTegelaar/CIPP` @ `0d8ca9d2f` + +## Delta summary + +| Metric | Count | +|--------|-------| +| Fork-only commits (ahead of upstream) | 602 | +| Upstream commits not in `main` (behind) | 241 | +| Upstream commits since sync base `f2d87612e` | 241 | + +**Interpretation:** The branch is behind upstream by design. The first selective sync merged ~25 commits; the remaining delta is expected unpicked upstream work, not a failed merge. + +### Recommendation distribution + +- **Cherry-pick with review:** 113 +- **Skip:** 41 +- **Skip or Defer:** 40 +- **Cherry-pick:** 28 +- **Already applied (sync 2026-06-17):** 15 +- **Defer:** 4 + +### Risk distribution + +- **Medium:** 146 +- **High:** 61 +- **Low:** 34 + +## Carried-forward deferred items (from sync 2026-06-17) + +| Item | Status | +|------|--------| +| `7054bfc4` UserReportedPhishing frontend alert | Defer until CIPP-API handler + SAM permission | +| `b1902421` tab layout first-tab margin | Defer — layout conflict | +| `bc412396b` / `20e2f554d` allow/block edit/controlled drawer | Defer — partial guard only applied | +| `4c0c058f` alerts schema change | Defer — higher risk | +| Frontend dependency/lint debt | Pre-existing — not sync blocker | + +## Commit inventory + +| SHA | Title | Author | Date | Risk | Area | Protected overlap | Recommendation | Files | +|-----|-------|--------|------|------|------|-------------------|----------------|-------| +| `0d8ca9d2` | Merge pull request #6153 from KelvinTegelaar/dev | John Duprey | 2026-06-10 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `e0b0bdb8` | chore: bump version to 10.5.2 | John Duprey | 2026-06-10 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `a4c56b26` | manual pagination support for Invoke-ListMailQuarantine | Zacgoose | 2026-06-10 | High | Protected feature | Quarantine Portal | Skip or Defer — protected-area overlap | src/pages/email/administration/quarantine/index.js | +| `f4448a56` | Merge pull request #6140 from KelvinTegelaar/dev | John Duprey | 2026-06-09 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `6a2e7b31` | chore: bump version to 10.5.1 | John Duprey | 2026-06-09 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `0e10e08e` | Update index.js | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/teams-share/sharepoint/index.js | +| `ae695a9f` | Update CippAddEditUser.jsx | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippFormPages/CippAddEditUser.jsx | +| `91bb02b4` | Merge pull request #6071 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-virtuoso-4.18.7 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `e53ab04d` | Merge pull request #6074 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-heading-3.22.3 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `87d543d4` | Merge pull request #6075 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-hook-form-7.76.1 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `f1475e8e` | Merge pull request #6073 from KelvinTegelaar/dependabot/npm_and_yarn/dev/axios-1.16.1 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `7ea75e76` | Merge pull request #6072 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-pdf/renderer-4.5.1 | KelvinTegelaar | 2026-06-09 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `8cfb8ca0` | Merge pull request #6138 from JNRavnIT/patch-1 | KelvinTegelaar | 2026-06-09 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `cfbf3508` | Removed dublicate appliesToTest key | JNRavnIT | 2026-06-09 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/standards.json | +| `0de0910a` | Merge pull request #6132 from kris6673/tables-search | KelvinTegelaar | 2026-06-09 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `1ea0324e` | fix: ensure search happens when data is done loading | Bobby | 2026-06-08 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippTable/CippDataTable.js | +| `580b66f9` | repair and fix failed SSO app creations and password addition failures | Zacgoose | 2026-06-09 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/ForcedSsoMigrationDialog.jsx, src/components/CippComponents/SsoMigrationDialog.jsx, src/components/CippSettings/CippSSOSettings.jsx | +| `4521af9d` | Merge pull request #6129 from KelvinTegelaar/dev | KelvinTegelaar | 2026-06-08 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `03048445` | Merge branch 'main' into dev | KelvinTegelaar | 2026-06-08 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `9c82a214` | 10.5.0 version up | KelvinTegelaar | 2026-06-08 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `4df01a60` | Update unauthenticated.js | Zacgoose | 2026-06-08 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/unauthenticated.js | +| `4c0c058f` | Update alerts.json | Zacgoose | 2026-06-08 | Low | Data/config JSON | None | Defer — alerts schema change (higher risk) | src/data/alerts.json | +| `55e8eef2` | Update worker-health.js | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `4c2843c7` | more secure pipeline configuration | Zacgoose | 2026-06-07 | Medium | General | None | Cherry-pick with review | .npmrc, .yarnrc | +| `e90b0ff9` | renumber for cis7 | KelvinTegelaar | 2026-06-06 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `6c968c4b` | fix: bad math | John Duprey | 2026-06-05 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/applied-standards.js | +| `c15d1d0d` | fix: sherweb integration conditional fields | John Duprey | 2026-06-05 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/Extensions.json | +| `8ae6ad1f` | typo | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/ForcedSsoMigrationDialog.jsx, src/components/CippComponents/SsoMigrationDialog.jsx | +| `7b0c8699` | Update SsoMigrationDialog.jsx | Zacgoose | 2026-06-05 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/SsoMigrationDialog.jsx | +| `a4aac4a1` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/applied-standards.js | +| `98a96fcb` | CA expansion for tags | KelvinTegelaar | 2026-06-05 | Medium | General | None | Cherry-pick with review | src/pages/tenant/manage/applied-standards.js, src/pages/tenant/manage/policies-deployed.js | +| `c8d61c07` | fix: JIT admin, remove creatable on autocomplete | John Duprey | 2026-06-04 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/identity/administration/jit-admin/add.jsx | +| `0a8252e3` | fix: version encoding | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippSettings/CippVersionProperties.jsx | +| `4ed6ba02` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CIPPM365OAuthButton.jsx | +| `ffefbbb3` | Use broadcast channel | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CIPPM365OAuthButton.jsx, src/pages/authredirect.js | +| `5b09ef32` | fix: add popup grace period | John Duprey | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CIPPM365OAuthButton.jsx | +| `eb16c27a` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `67039061` | Auth changes to use sedndmessage | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/authredirect.js | +| `b7c051fa` | Auth changes to use sedndmessage | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CIPPM365OAuthButton.jsx, src/pages/authredirect.js | +| `0b4c3314` | Make breadcrumb text and > selectable/copyable | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippBreadcrumbNav.jsx | +| `c0f8e990` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | Zacgoose | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `3daf8b33` | Add named location editing to CA template editor | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippCAPolicyBuilder.jsx, src/pages/tenant/conditional/list-template/create.jsx, src/pages/tenant/conditional/list-template/edit.jsx | +| `02db7307` | Merge pull request #6106 from kris6673/EmailAsAlternateLoginId | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `a9ed024d` | Merge pull request #6110 from kris6673/CAS-stuffs | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `11ecd334` | remove unneeded results key | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippFormLicenseSelector.jsx | +| `cf30b4b1` | add excluded from alerts to licenses | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/settings/licenses.js | +| `a04ed1a6` | Merge pull request #6049 from luimen6/feat/group-license-management | KelvinTegelaar | 2026-06-04 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `72623261` | add excludeFromAlert to licenses. | KelvinTegelaar | 2026-06-04 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/settings/licenses.js | +| `a8048476` | Exclude partner tenant | Zacgoose | 2026-06-04 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippAddEditTenantGroups.jsx, src/pages/tenant/administration/tenants/groups/edit.js | +| `692c67d6` | fix: quarantine deny action | John Duprey | 2026-06-03 | High | Protected feature | Quarantine Portal | Skip or Defer — protected-area overlap | src/pages/email/administration/quarantine/index.js | +| `b2f8f803` | feat: add actions for managing mailbox client access protocols | Bobby | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/email/reports/mailbox-cas-settings/index.js | +| `38ac0c4a` | MCP warning | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippFormComponent.jsx, src/components/CippIntegrations/CippApiClientManagement.jsx | +| `e4009f28` | feat: add Email as alternate login ID standard | Bobby | 2026-06-03 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `51d2828b` | add mcp allowed | KelvinTegelaar | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippIntegrations/CippApiClientManagement.jsx | +| `4d88e456` | Update CippAutocomplete.jsx | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippAutocomplete.jsx | +| `cbd6faef` | Correct report builder permissions | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review | src/pages/tools/report-builder/builder/index.js, src/pages/tools/report-builder/view/index.js | +| `d4570de5` | Update CippReportToolbar.jsx | Zacgoose | 2026-06-03 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippReportToolbar.jsx | +| `069d6d6b` | Merge pull request #6101 from kris6673/stale | KelvinTegelaar | 2026-06-02 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `89abbf50` | fix: improve stale issue and close messages for clarity | Bobby | 2026-06-02 | Medium | General | None | Cherry-pick with review | .github/workflows/Close_Stale_Issues.yml | +| `f1703f04` | Update CippTenantModeDeploy.jsx | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippWizard/CippTenantModeDeploy.jsx | +| `49cda6e0` | Update index.js | Zacgoose | 2026-06-02 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/reports/list-licenses/index.js | +| `d26084fb` | Merge pull request #6080 from kris6673/icons | KelvinTegelaar | 2026-06-02 | Medium | General | None | Cherry-pick with review — isolated UI | src/utils/icon-registry.js | +| `ee6f501e` | Merge pull request #6079 from kris6673/move-ADE | KelvinTegelaar | 2026-06-02 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `3734adee` | Fix template trigger | KelvinTegelaar | 2026-06-01 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/manage/user-defaults.js | +| `e2c39b26` | Update M365Licenses.json | Zacgoose | 2026-06-02 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/M365Licenses.json | +| `6737dcb7` | Licence Universal Search | Zacgoose | 2026-06-02 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippCards/CippUniversalSearchV2.jsx, src/components/CippComponents/CippLicenseDetailsDrawer.jsx, src/data/M365Licenses.json, src/layouts/top-nav.js (+2) | +| `9e44f394` | Update worker-health.js | Zacgoose | 2026-05-30 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `c0bfd7df` | Update standards.json | Zacgoose | 2026-05-29 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `97d77727` | Expose missing standards and allow removal | Zacgoose | 2026-05-29 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippStandards/CippStandardAccordion.jsx | +| `707873e3` | fix: Fix tab title showing as undefined | Bobby | 2026-05-28 | Medium | General | None | Cherry-pick with review | src/pages/email/administration/exchange-retention/policies/index.js, src/pages/email/administration/exchange-retention/tags/index.js | +| `d0405ff4` | feat: Add icons to the tabs and remove dead tab | Bobby | 2026-05-28 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/pages/cipp/advanced/super-admin/tabOptions.json, src/pages/cipp/custom-data/tabOptions.json, src/pages/cipp/settings/tabOptions.json, src/pages/dashboardv2/tabOptions.json (+18) | +| `063550f4` | chore: update tab paths and imports | Bobby | 2026-05-28 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js, src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js, src/pages/endpoint/autopilot/enrollment-profiles/index.js, src/pages/endpoint/autopilot/enrollment-profiles/tabOptions.json (+1) | +| `605ecd82` | fix: move ADE pages | Bobby | 2026-05-28 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/layouts/config.js, src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js, src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js, src/pages/endpoint/autopilot/enrollment-profiles/index.js (+2) | +| `04f8575c` | Merge pull request #6070 from kris6673/6061 | KelvinTegelaar | 2026-05-28 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `8306a660` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-28 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `7e44aff8` | new auth methods single standard | KelvinTegelaar | 2026-05-28 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `ca43bc9e` | Update worker-health.js | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `ab8de98d` | Update worker-health.js | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `b8ece5c4` | Update worker-health.js | Zacgoose | 2026-05-28 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/advanced/worker-health.js | +| `0995677d` | chore(deps): bump react-hook-form from 7.72.0 to 7.76.1 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `c04cd7c9` | chore(deps): bump @tiptap/extension-heading from 3.20.5 to 3.22.3 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `49192881` | chore(deps): bump axios from 1.15.0 to 1.16.1 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `8316c600` | chore(deps): bump @react-pdf/renderer from 4.3.2 to 4.5.1 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `f256c253` | chore(deps): bump react-virtuoso from 4.18.5 to 4.18.7 | dependabot[bot] | 2026-05-28 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `072416dd` | new autopatch standard | KelvinTegelaar | 2026-05-28 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `d0f58cbe` | feat(mailboxes): show mailbox and archive size columns | Bobby | 2026-05-27 | Medium | General | None | Cherry-pick with review | src/pages/email/administration/mailboxes/index.js, src/utils/get-cipp-formatting.js | +| `de035243` | fixes #6065 | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/user-defaults.js | +| `7a408542` | fix query keys | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review | src/pages/security/compliance/dlp/index.js, src/pages/security/compliance/labels/index.js, src/pages/security/compliance/retention/index.js, src/pages/security/compliance/sit/index.js | +| `635548af` | Add version cleanup | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/teams-share/sharepoint/index.js | +| `0abf5523` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-27 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `bf6056ba` | Add version cleanup | KelvinTegelaar | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/teams-share/sharepoint/index.js | +| `4102a13e` | Merge pull request #6064 from kris6673/TAP-typos | KelvinTegelaar | 2026-05-27 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `5709f856` | fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" | Bobby | 2026-05-27 | Medium | Data/config JSON, General | None | Cherry-pick — data-only JSON | src/components/CippComponents/CippUserActions.jsx, src/data/standards.json | +| `0e527e50` | Sharepoint management functionality. | KelvinTegelaar | 2026-05-27 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `de70889f` | smart lockout standard | KelvinTegelaar | 2026-05-27 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `1b7797af` | Update standards.json | Zacgoose | 2026-05-27 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `fe4765e8` | Merge pull request #6059 from kris6673/permaDismiss | KelvinTegelaar | 2026-05-27 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `25f4caed` | feat: add permanent dismissal option for release notes | Bobby | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/ReleaseNotesDialog.js | +| `2f62bae9` | Update CippAuditLogSearchDrawer.jsx | Zacgoose | 2026-05-27 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippAuditLogSearchDrawer.jsx | +| `d28e8ebf` | user sync | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review | src/components/CippSettings/CippRoleAddEdit.jsx, src/components/CippSettings/CippUserManagement.jsx, src/pages/cipp/advanced/super-admin/cipp-users.js | +| `f3c8a79e` | Update yarn.lock | Zacgoose | 2026-05-26 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | yarn.lock | +| `ca150a28` | Better display standards that are missing licenses to be able to work | Zacgoose | 2026-05-26 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/applied-standards.js | +| `1cd1ef72` | Update AuditLogTemplates.json | Zacgoose | 2026-05-26 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/AuditLogTemplates.json | +| `1e59d2d4` | Update ListTests.json | Zacgoose | 2026-05-26 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | Tests/Shapes/ListTests.json | +| `8145f585` | Merge pull request #6056 from KelvinTegelaar/copilot/move-enrollment-profile-tabs | Zacgoose | 2026-05-25 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `02c7a434` | Move EnrollmentProfileTabs to CippComponents folder and update imports | copilot-swe-agent[bot] | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/EnrollmentProfileTabs.jsx, src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js, src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js, src/pages/endpoint/MEM/enrollment-profiles/index.js (+1) | +| `7d1c2096` | Move EnrollmentProfileTabs from pages to components and update imports | copilot-swe-agent[bot] | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/components/EnrollmentProfileTabs.jsx, src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js, src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js, src/pages/endpoint/MEM/enrollment-profiles/index.js (+1) | +| `a2d8f191` | react-dom | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `37778e28` | Merge pull request #6002 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-19.2.6 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `6a51abf3` | demo data | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/contexts/tutorial-context.js, src/data/dashboardv2-demo-data.js | +| `eac59c8a` | add tutorials to easy deployment of steps for Ashe. | KelvinTegelaar | 2026-05-25 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/CippBreadcrumbNav.jsx, src/components/CippComponents/CippSpeedDial.jsx, src/components/CippComponents/CippTutorialDialog.jsx, src/contexts/tutorial-context.js (+3) | +| `ff9af7e0` | add tutorials to easy deployment of steps for Ashe. | KelvinTegelaar | 2026-05-25 | High | Data/config JSON, Dependencies/build, General | Build/dependencies | Skip or Defer — protected-area overlap | package.json, src/components/CippComponents/CippBreadcrumbNav.jsx, src/components/CippComponents/CippSpeedDial.jsx, src/components/CippComponents/CippTutorialDialog.jsx (+10) | +| `8a179d28` | moved autopilot ade etc | KelvinTegelaar | 2026-05-25 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/layouts/config.js, src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js, src/pages/endpoint/MEM/enrollment-profiles/index.js, src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json | +| `83994360` | chore(deps): bump react from 19.2.5 to 19.2.6 | dependabot[bot] | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `0001b6c8` | Merge pull request #5999 from KelvinTegelaar/dependabot/npm_and_yarn/dev/dompurify-3.4.3 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `4ffb7638` | Merge pull request #6000 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-table-3.20.5 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `2e1e3007` | Merge pull request #6001 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/core-3.22.3 | KelvinTegelaar | 2026-05-25 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `ac1190da` | Merge pull request #6003 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-5.100.10 | KelvinTegelaar | 2026-05-25 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `28ec38c1` | Merge pull request #6009 from kris6673/ade | KelvinTegelaar | 2026-05-25 | High | Navigation/layout | None | Cherry-pick with review — isolated UI | src/layouts/config.js | +| `d8c4988d` | Merge pull request #6039 from kris6673/DlpViaDcsEnabled | KelvinTegelaar | 2026-05-25 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `304e0e5a` | Merge pull request #6052 from kris6673/remove-adminroles | KelvinTegelaar | 2026-05-25 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `38e72f99` | Add APv2 profile | KelvinTegelaar | 2026-05-25 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `c1c5693c` | feat: add admin role member removal functionality | Bobby | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/pages/identity/administration/roles/index.js, src/pages/identity/administration/users/user/index.jsx | +| `16b4503f` | login/out testing | Zacgoose | 2026-05-25 | High | Data/config JSON, Navigation/layout | None | Skip — auth/permissions overlap | src/layouts/account-popover.js, staticwebapp.config.json | +| `f591d479` | logout | Zacgoose | 2026-05-25 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/SsoMigrationDialog.jsx, src/layouts/account-popover.js, src/layouts/index.js | +| `c43f6d9a` | Update unauthenticated.js | Zacgoose | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/unauthenticated.js | +| `3bdb9d5b` | add global var showing | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippCustomVariables.jsx | +| `389babe3` | add global var showing | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippCustomVariables.jsx | +| `8097e6ed` | FIDO2 profile standards | KelvinTegelaar | 2026-05-25 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `17bf1f8d` | fixes #5995 | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/manage/user-defaults.js | +| `ee0ab2ab` | add extendedValues | KelvinTegelaar | 2026-05-25 | Medium | General | None | Cherry-pick with review | src/components/CippFormPages/CippAddEditUser.jsx, src/pages/tenant/manage/user-defaults.js | +| `d4f458a1` | Third party text | KelvinTegelaar | 2026-05-24 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/integrations/index.js | +| `30455f27` | third party | KelvinTegelaar | 2026-05-24 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/integrations/index.js | +| `28cafc93` | added third party notice | KelvinTegelaar | 2026-05-24 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/cipp/integrations/index.js | +| `04c63849` | implement standards template deployment for intune apps | KelvinTegelaar | 2026-05-24 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `a3279044` | CIPP Hosted Notices | Zacgoose | 2026-05-24 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/FailedPaymentDialog.jsx, src/components/CippComponents/SubscriptionEndedDialog.jsx, src/layouts/index.js | +| `bde8ad3c` | Merge pull request #6010 from Celeratec/fix/remove-claude-worktrees | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `96686d7e` | Merge pull request #6012 from jonwbstr/magicdash-addoptions | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `fad1cacf` | Merge pull request #6019 from kris6673/split-intune-join-registration | KelvinTegelaar | 2026-05-23 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `5574b477` | Merge pull request #6038 from kris6673/winhello | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `c74966b3` | Merge pull request #6018 from kris6673/bulk-edit | KelvinTegelaar | 2026-05-23 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `a6ae2610` | Add Group-Based Licensing support | Luis Mengel | 2026-05-23 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippFormLicenseSelector.jsx, src/components/CippFormPages/CippAddGroupForm.jsx, src/components/CippFormPages/CippAddGroupTemplateForm.jsx, src/components/CippWizard/CippWizardGroupTemplates.jsx (+2) | +| `131927b9` | Stats | Zacgoose | 2026-05-22 | High | General, Navigation/layout | None | Cherry-pick with review | src/components/PrivateRoute.js, src/layouts/index.js, src/pages/cipp/advanced/worker-health.js | +| `5b5302ca` | feat(standards): add DLP via DCS OWA standard | Bobby | 2026-05-20 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `766a3c52` | feat: add in missing options for Windows Hello standard | Bobby | 2026-05-20 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `fc246a54` | update default value for standard | Zacgoose | 2026-05-19 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `1e7aef11` | Update alerts.json | Zacgoose | 2026-05-19 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/alerts.json | +| `6db7e776` | Delete .claude directory | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review | .claude/worktrees/blissful-golick-d405ab | +| `9d5ce402` | Org auto expanding archive property usage | Zacgoose | 2026-05-18 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippCards/CippExchangeInfoCard.jsx | +| `f768330c` | fix(standards): move CIS 5.1.4.1 and SMB1001 (2.8) tags to join standard | Bobby | 2026-05-15 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `8232e5c1` | feat(standards): add intuneRestrictUserDeviceJoin entry | Bobby | 2026-05-15 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `7a85827e` | feat(users): add bulk update contact and UPN fields | Bobby | 2026-05-15 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/identity/administration/users/patch-wizard.jsx | +| `186a2c6e` | audit log template tweak | Zacgoose | 2026-05-15 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/data/AuditLogTemplates.json, src/layouts/config.js, src/pages/cipp/advanced/worker-health.js | +| `0c32a84e` | Add additional portal links to Invoke-HuduExtensionSync | jwebster@protectedtrust.com | 2026-05-14 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/Extensions.json | +| `983b48a1` | fix: Remove accidentally committed .claude/worktrees directory | Clint Thomon | 2026-05-14 | Medium | General | None | Cherry-pick with review | .claude/worktrees/blissful-golick-d405ab, .gitignore | +| `9b616499` | feat: Migrate to use shared icon registry for string to icon conversion | Bobby | 2026-05-14 | High | Data/config JSON, General, Navigation/layout | Navigation/tenant switching | Skip or Defer — protected-area overlap | src/components/CippCards/CippPropertyListCard.jsx, src/components/CippCards/CippUniversalSearchV2.jsx, src/components/CippComponents/CippTenantSelector.jsx, src/components/bulk-actions-menu.js (+4) | +| `6dab9339` | feat(tabs): support icons in tabbed layouts | Bobby | 2026-05-14 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/layouts/HeaderedTabbedLayout.jsx, src/layouts/TabbedLayout.jsx, src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json, src/utils/icon-registry.js | +| `b1902421` | feat: Bit more margin to make tabbed layout of first item less cramped | Bobby | 2026-05-14 | High | Navigation/layout | None | Defer — layout conflict (b1902421) | src/layouts/HeaderedTabbedLayout.jsx, src/layouts/TabbedLayout.jsx | +| `c9bfe909` | feat(endpoint): add MEM enrollment profiles page (Apple ADE, Android, Autopilot) | Bobby | 2026-05-14 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippCards/CippUniversalSearchV2.jsx, src/components/CippComponents/CippBreadcrumbNav.jsx, src/layouts/config.js, src/pages/endpoint/MEM/enrollment-profiles/EnrollmentProfileTabs.jsx (+4) | +| `db20afa2` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-14 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `12a07270` | comingsoon | KelvinTegelaar | 2026-05-14 | Medium | Data/config JSON, General | None | Cherry-pick with review | public/assets/integrations/autotask.png, public/assets/integrations/connectwise.png, public/assets/integrations/kaseya.svg, src/data/Extensions.json (+1) | +| `b5d48bcd` | logging | Zacgoose | 2026-05-14 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/data/ContainerLogPresets.json, src/pages/cipp/advanced/container-logs.js | +| `fd6a9e36` | Logs | Zacgoose | 2026-05-14 | High | General, Navigation/layout | None | Cherry-pick with review | src/layouts/config.js, src/pages/cipp/advanced/container-logs.js | +| `d392d1cf` | chore(deps): bump @tanstack/react-query from 5.96.2 to 5.100.10 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `2285d39c` | chore(deps): bump @tiptap/core from 3.20.5 to 3.22.3 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `a783d28a` | chore(deps): bump @tiptap/extension-table from 3.20.4 to 3.20.5 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `c9584010` | chore(deps): bump dompurify from 3.4.2 to 3.4.3 | dependabot[bot] | 2026-05-13 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `60a50738` | fixes tenantfilter property | KelvinTegelaar | 2026-05-13 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/email/administration/mailbox-rules/index.js | +| `41efc5b7` | Update CippCAPolicyBuilder.jsx | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippCAPolicyBuilder.jsx | +| `52a47639` | Nice CA policy editor and template creator/editor | Zacgoose | 2026-05-13 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/components/CippComponents/CippCAPolicyBuilder.jsx, src/components/CippComponents/CippTemplateFieldRenderer.jsx, src/data/conditionalAccessSchema.json, src/pages/tenant/conditional/list-policies/edit.jsx (+4) | +| `8551ef5f` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-13 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `ba196dde` | expand side nav slightly for ux | KelvinTegelaar | 2026-05-13 | High | General, Navigation/layout | None | Cherry-pick with review | .claude/worktrees/blissful-golick-d405ab, src/layouts/side-nav.js | +| `72d8658d` | Add Apps and SP to universal search | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review | src/components/CippCards/CippUniversalSearchV2.jsx, src/components/bulk-actions-menu.js | +| `c0946109` | Fix bulk mailbox rule changes | Zacgoose | 2026-05-13 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/identity/administration/users/user/exchange.jsx | +| `36071e54` | Module updates and import changes | Zacgoose | 2026-05-13 | High | Dependencies/build, General, Navigation/layout | Build/dependencies; Navigation/tenant switching | Skip or Defer — protected-area overlap | next.config.js, package.json, src/components/CippCards/CippStandardsDialog.jsx, src/components/CippComponents/CippAppPermissionBuilder.jsx (+9) | +| `19c48eab` | auth options | Zacgoose | 2026-05-13 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/ForcedSsoMigrationDialog.jsx, src/components/CippComponents/SsoMigrationDialog.jsx, src/components/CippIntegrations/CippApiClientManagement.jsx, src/components/CippSettings/CippContainerManagement.jsx (+8) | +| `335e40ad` | Merge pull request #5907 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-persist-client-5.96.2 | KelvinTegelaar | 2026-05-12 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `d00ebb77` | chore: bump version to 10.4.5 | John Duprey | 2026-05-12 | High | Data/config JSON, Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, public/version.json | +| `7054bfc4` | Add AlertUserReportPhising | KelvinTegelaar | 2026-05-12 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/alerts.json | +| `6c55bc42` | OneDrive Sharing disable | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippCards/CippRemediationCard.jsx, src/components/CippComponents/CippOffboardingDefaultSettings.jsx, src/components/CippComponents/CippUserActions.jsx, src/components/CippWizard/CippWizardOffboarding.jsx | +| `63c85df0` | OneDrive Sharing disable | KelvinTegelaar | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippCards/CippRemediationCard.jsx, src/components/CippComponents/CippOffboardingDefaultSettings.jsx, src/components/CippComponents/CippUserActions.jsx, src/components/CippWizard/CippWizardOffboarding.jsx | +| `0a70010e` | fix: update translation keys and adjust template usage references | John Duprey | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippTranslations.jsx, src/pages/endpoint/MEM/list-templates/index.js | +| `4f2d4993` | feat: enhance intune template details display | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippTranslations.jsx, src/pages/endpoint/MEM/list-templates/index.js, src/utils/get-cipp-formatting.js | +| `6cd8c632` | chore: linting | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/standards/alignment/index.js | +| `1cb6a11c` | fix: enhance standard name retrieval logic for better matching | John Duprey | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/standards/alignment/index.js | +| `15939e2b` | feat: improve run standard now UX provide single action with autocomplete to select all tenants in template or individual tenant (expanded from alltenants/groups) | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippFormTemplateTenantSelector.jsx, src/pages/tenant/manage/applied-standards.js, src/pages/tenant/manage/drift.js, src/pages/tenant/manage/driftManagementActions.js (+3) | +| `d7e8b0b5` | fix: tweak toggle button size | John Duprey | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/standards/alignment/index.js | +| `fe4bd7f9` | fix: allow alltenants sync on onedrive/sharepoint | John Duprey | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/pages/teams-share/onedrive/index.js, src/pages/teams-share/sharepoint/index.js | +| `a4915dff` | chore(deps): bump @tanstack/react-query-persist-client | dependabot[bot] | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `7dcb867b` | Merge pull request #5908 from KelvinTegelaar/dependabot/npm_and_yarn/dev/uiw/react-json-view-2.0.0-alpha.42 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `06e16457` | Merge pull request #5904 from KelvinTegelaar/dependabot/npm_and_yarn/dev/recharts-3.8.1 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `cef87445` | Merge pull request #5905 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-devtools-5.96.2 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `7bcd507c` | Merge pull request #5906 from KelvinTegelaar/dependabot/npm_and_yarn/dev/mui-tiptap-1.30.0 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json | +| `4b0800b8` | Merge pull request #5903 from KelvinTegelaar/dependabot/github_actions/dev/actions/setup-node-6.4.0 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | .github/workflows/cipp_frontend_build.yml | +| `0fc7b3c6` | Merge pull request #5921 from kris6673/allTenants-SP | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `ccf4e9cf` | Merge pull request #5685 from kris6673/levenshtein-distance | KelvinTegelaar | 2026-05-11 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `fe722173` | Merge pull request #5794 from TecharyJames/Feat-Conditional-accesss-policy-package-tags | KelvinTegelaar | 2026-05-11 | Medium | Data/config JSON, General | None | Skip — merge commit; cherry-pick substantive commits instead | src/data/standards.json, src/pages/tenant/manage/drift.js | +| `fd23c0df` | Merge branch 'dev' into allTenants-SP | Kristian Kjærgård | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `2f849474` | Merge branch 'dev' into levenshtein-distance | Kristian Kjærgård | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `dd0ba6f1` | Merge pull request #5920 from kris6673/alltenants-intune | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `be88cc9c` | Merge branch 'dev' into levenshtein-distance | Kristian Kjærgård | 2026-05-11 | Medium | Data/config JSON, General | None | Cherry-pick — data-only JSON | src/components/CippStandards/CippStandardAccordion.jsx, src/data/standards.json | +| `5ca3e9ad` | Merge branch 'dev' into alltenants-intune | Bobby | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | src/components/CippComponents/CippReportDBControls.jsx, src/pages/endpoint/MEM/list-policies/index.js | +| `35711f89` | Merge branch 'dev' of https://github.com/kris6673/CIPP into allTenants-SP | Bobby | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | src/pages/teams-share/onedrive/index.js, src/pages/teams-share/sharepoint/index.js | +| `2a1b9128` | Merge pull request #5984 from kris6673/by-standards-view | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `2e9b9fd5` | fixed weird button | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | None | Already applied (sync 2026-06-17) | src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx | +| `8e99c018` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-11 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `bc412396` | implements #5986 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | None | Defer — allow/block controlled drawer stack | src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx, src/pages/email/administration/tenant-allow-block-list-templates/index.js | +| `20e2f554` | implements #5986 | KelvinTegelaar | 2026-05-11 | High | Dependencies/build | None | Defer — allow/block controlled drawer stack | src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx, src/pages/email/administration/tenant-allow-block-list-templates/index.js | +| `da6dc7fa` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | Zacgoose | 2026-05-12 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `08c793d7` | Update manifest.json | Zacgoose | 2026-05-12 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | public/manifest.json | +| `1b77b784` | Update manifest for PWA chrome install option | Zacgoose | 2026-05-12 | Medium | Data/config JSON, General | None | Cherry-pick with review | public/manifest.json, public/sw.js, src/pages/_app.js, src/pages/_document.js | +| `14461b4f` | eclusions everywhere | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippIntunePolicyActions.jsx, src/components/CippWizard/CippIntunePolicy.jsx, src/pages/endpoint/applications/templates/index.js | +| `9cee69d4` | eclusions everywhere | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippAppTemplateDrawer.jsx, src/components/CippComponents/CippApplicationDeployDrawer.jsx, src/components/CippComponents/CippIntunePolicyActions.jsx, src/components/CippComponents/CippPolicyDeployDrawer.jsx (+2) | +| `55dd9cc2` | HVE user page | Zacgoose | 2026-05-12 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/CippHVEUserDrawer.jsx, src/components/CippComponents/CippNotificationForm.jsx, src/data/CIPPDBCacheTypes.json, src/layouts/config.js (+2) | +| `8b79d999` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | Zacgoose | 2026-05-12 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `445820dd` | Better intune policy support for alltenants list | Zacgoose | 2026-05-12 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippIntunePolicyDetails.jsx, src/components/CippFormPages/CippJSONView.jsx | +| `64e40807` | implemenets #5948 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/components/CippComponents/CippApplicationDeployDrawer.jsx | +| `0d42f679` | #5939 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/reports/list-licenses/index.js | +| `cfe8c705` | adds #5939 | KelvinTegelaar | 2026-05-11 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/tenant/reports/list-licenses/index.js | +| `4b9efd82` | Update index.js | Zacgoose | 2026-05-11 | Medium | General | None | Already applied (sync 2026-06-17) | src/pages/tenant/reports/list-licenses/index.js | +| `98d5d94a` | Custom Test - Alert on X statuses | Zacgoose | 2026-05-11 | Low | Tests | None | Already applied (sync 2026-06-17) | src/pages/tools/custom-tests/add.jsx | +| `e3ed1818` | fix alert mode | KelvinTegelaar | 2026-05-10 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/data/standards.json, src/pages/security/compliance/retention/index.js | +| `b8abed94` | Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev | KelvinTegelaar | 2026-05-10 | Medium | General | None | Skip — merge commit; cherry-pick substantive commits instead | | +| `45f1d72b` | purview adding | KelvinTegelaar | 2026-05-10 | High | Data/config JSON, General, Navigation/layout | None | Cherry-pick with review | src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx, src/data/standards.json, src/layouts/config.js, src/pages/security/compliance/dlp-templates/index.js (+7) | +| `b05e0923` | feat(standards): add by-standard alignment summary view | Bobby | 2026-05-08 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippTranslations.jsx, src/components/CippTable/CippDataTable.js, src/components/CippTable/CippDataTableButton.jsx, src/pages/tenant/standards/alignment/index.js (+2) | +| `d7d36a31` | feat: Add allTenants support for all the Teams SharePoint pages | Bobby | 2026-04-26 | Medium | General | None | Cherry-pick with review | src/pages/teams-share/onedrive/index.js, src/pages/teams-share/sharepoint/index.js, src/pages/teams-share/teams/business-voice/index.js, src/pages/teams-share/teams/list-team/index.js (+1) | +| `1707506b` | feat: integrate useCippReportDB for data handling | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review | src/components/CippComponents/CippReportDBControls.jsx, src/pages/endpoint/MEM/assignment-filters/index.js, src/pages/endpoint/MEM/devices/index.js, src/pages/endpoint/MEM/list-appprotection-policies/index.js (+4) | +| `f86925dc` | Merge branch 'dev' of https://github.com/kris6673/CIPP into alltenants-intune | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review — isolated UI | src/pages/endpoint/MEM/list-policies/index.js | +| `a5f2b74b` | feat: add allTenants support for multiple intune pages | Bobby | 2026-04-25 | Medium | General | None | Cherry-pick with review | src/pages/endpoint/MEM/assignment-filters/index.js, src/pages/endpoint/MEM/devices/index.js, src/pages/endpoint/MEM/list-appprotection-policies/index.js, src/pages/endpoint/MEM/list-compliance-policies/index.js (+4) | +| `c3c90afe` | chore(deps): bump @uiw/react-json-view | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `c22177f7` | chore(deps): bump mui-tiptap from 1.29.1 to 1.30.0 | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `93cfed20` | chore(deps): bump @tanstack/react-query-devtools from 5.91.3 to 5.96.2 | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `9ae908d7` | chore(deps): bump recharts from 3.8.0 to 3.8.1 | dependabot[bot] | 2026-04-22 | High | Dependencies/build | Build/dependencies | Skip or Defer — protected-area overlap | package.json, yarn.lock | +| `05b93261` | chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 | dependabot[bot] | 2026-04-22 | Medium | General | None | Cherry-pick with review | .github/workflows/Node_Project_Check.yml, .github/workflows/cipp_dev_build.yml, .github/workflows/cipp_frontend_build.yml | +| `b6438ee3` | Merge branch 'dev' into Feat-Conditional-accesss-policy-package-tags | KelvinTegelaar | 2026-04-04 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `83d657b8` | Lookup CA template names via API | James Tarran | 2026-04-03 | Medium | General | None | Cherry-pick with review | src/pages/tenant/manage/drift.js, src/pages/tenant/manage/policies-deployed.js | +| `db57e52a` | Mark TemplateList as optional and non-creatable | James Tarran | 2026-04-03 | Low | Data/config JSON | None | Already applied (sync 2026-06-17) | src/data/standards.json | +| `5ffd20e1` | Merge remote-tracking branch 'upstream/dev' into Feat-Conditional-accesss-policy-package-tags | James Tarran | 2026-04-03 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | +| `88bc10a5` | Added UI Elements for adding conditional access policies to package tags | James Tarran | 2026-04-02 | Medium | Data/config JSON, General | None | Cherry-pick with review | src/data/standards.json, src/pages/tenant/conditional/list-template/index.js | +| `4fc1b57b` | feat: add warningMessage support standards | Bobby | 2026-03-20 | Medium | Data/config JSON, General | None | Cherry-pick — data-only JSON | src/components/CippStandards/CippStandardAccordion.jsx, src/data/standards.json | +| `7dffc4c6` | feat: add fuzzy match distance setting to Intune template based on Levenshtein distance | Bobby | 2026-03-20 | Low | Data/config JSON | None | Cherry-pick — data-only JSON | src/data/standards.json | diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md new file mode 100644 index 0000000000..809995b237 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260727.md @@ -0,0 +1,77 @@ +# Upstream Delta — CIPP (frontend) — 2026-07-27 + +Cycle type: **Major delta** (upstream 10.6.1 → **10.6.4 + v10.7.0**). +Sync base: `17ed2b396` (upstream/main at last cycle, July 13) → `upstream/main` @ `44ac45831`. +96 commits in range (48 non-merge + release squashes from the CyberDrain org +transition — see API delta doc for the squash mechanics). + +Net delta: 109 files, +7,861 / −590. + +## Triage — Apply (cherry-pick) + +| Upstream | Subject | Notes | +|---|---|---| +| `48595d74c` | default assignment mode append | API pair `b2985a6f0` | +| `ffbca69a5` | registration campaign page + auth-methods tabs | API pair `5b42363cd`; new page | +| `082fe069c` | smart lockout Enforce | standards.json curated adapt | +| `5066c5ff6` | align standards.json with API | curated adapt | +| `0f4ddb085` | setup-node 7 | | +| `f1ce6b543` | prettier 3.9.5 | | +| `7dad7bcab` | diff 9.0.0 | | +| `16ad6b9b2` | restore typescript devDependency | eslint flat config needs it | +| `01d33ac1b` | anonymization alert for report pages | new CippAnonymizedReportAlert + report pages | +| `bfc83afd7` | SP site (in)activity report | API pair `ffab43e1a` | +| `f2f62df42` | custom test save/run UX | | +| `c7b079c97` | offcanvas markdown table scroll | | +| `21003f7af`, `54153656f`, `155b6b073` | GDAPRoles.json additions/fixes | fork still uses GDAPRoles for GDAP invites (JIT uses JitAdminRoles.json) | +| `3ac0596f0` | mailbox quota alert types | API pair `ed577f689` | +| `0b879d130` | resource accounts standard | curated standards.json adapt | +| `3bea4e3b2` | app-approval permission set refresh | API pair `fd245427d` | +| `1f4dc9175` | AllowedToCreateGroups | curated standards.json adapt | +| `c259fe4ea` | JSON validation workflow | | +| `b4373e540` | CSP licenses #6390 | API pair `d348de650` | +| `341b4555e` | GDAP age group option | API pair `4ee94dcba` | +| `01180c005` | shadow AI tools alert (alerts.json + ShadowAIReportButton) | API pair `206f9b155` | +| `c4bf26c4d` | MEM single compare policy result | API pair `e0060db51` | +| `f777572bf` | applicationTemplateId for cloud sync SP | tenants edit | +| `fcf936dd d`+`84584329f` | SharePoint templated deployments v1 + steps | new pages/components/schemas; menu wiring = adapt into fork config.js (protected) | +| `da107ebf2` | autopilot profile display name validation | API pair `d14159589` | +| `c5278d18a` | custom branding fix | inspect against fork branding (protected) before taking | +| `fc6a06db6` | cache buster version | | +| `b599f7ef6`+`bdf0a662f` | container settings | **Skip** — fork has no CippContainerManagement | + +## Triage — Adapt (protected fork files) + +| Upstream | File(s) | Notes | +|---|---|---| +| `ceebe9fcd` | CippAddEditUser.jsx | fork FormSection-styled page | +| `eff527422` | CippUserActions.jsx | 18 fork commits on this file | +| `35e83de15` | PrivateRoute.js | fork fast path — port 401-flash fix surgically | +| `f27ad344d` | settings/tenants.js | fork tenant workflows protected | +| squash | CippApiResults.jsx | fork error-guidance classification — surgical diff | +| squash | config.js / side-nav.js menu entries | fork nav protected — add SP templates / permissions report entries manually | +| squash | standards.json refresh | curated — only standards with fork implementations | + +## Triage — squash-only content (port by path diff, paired with API) + +| Area | Outcome | Notes | +|---|---|---| +| SharePoint permissions report family (`permissions-report` page, CippPdf report primitives, `PermissionsReportButton`, `SharingReportButton`, `CippSharePointPermissionEditor`, `CippLibraryPermissionsDialog`, `CippCheckUserAccessDialog`, sharepoint.svg/teams.svg logos + icons) | **Apply** | pairs with API SP permissions family | +| SP templates (builder, deploy drawer, `CippMultiQueueTracker`, `CippQueryRefreshButton`, sharePointTemplateSchemas.json, teams-share/sharepoint-templates pages) | **Apply** | | +| `CippPolicyCompareDialog` / `CippPolicyDiffTable` + compare-policies page | **Apply** | | +| Copilot pages updates (usage report, settings) | **Apply** | fork took Copilot intake 07-15 | +| Teams business-voice / teams-activity page changes | **Defer** | pairs with deferred API Teams V2 | +| SSO dialogs (`SsoMigrationDialog`, `ForcedSsoMigrationDialog`, `bcc920892`) | **Defer** | SSO family intake | +| `custom-domains.js` super-admin + `CippAppServiceDomains` | **Defer** | with API ExecAppServiceDomains | +| `dashboardv1.js` | **Skip** | fork removed dashboard v1 | +| `dashboardv2`, `CippUserActions`, mailboxes page, `CippAutocomplete`, `CippTenantSelector`, `CippFormPage`, `get-cipp-formatting` squash diffs | **Review individually** | protected/heavily customized — take only clean fixes | + +## Triage — Skip / Already implemented + +| Upstream | Outcome | Reason | +|---|---|---| +| `e502965a5` | Already | fork never had Detect_Duplicate_Issues.yml | +| `1b48ea16b` axios, `18400b05f` dompurify | Already | fork at 1.18.1 / 3.4.12 from July 24 security pass | +| `cc3903ce0`, `88c0487cf` | Skip | version bumps (fork versioning protected) | +| `bcc920892` | Defer | SSO | +| `b599f7ef6`, `bdf0a662f` | Skip | container management not in fork | diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md new file mode 100644 index 0000000000..4cb5e2d7cc --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260803.md @@ -0,0 +1,45 @@ +# Upstream Delta — CIPP (frontend) — 2026-08-03 + +Cycle type: **Light/medium delta** (upstream **10.7.3 → 10.7.5**). +Sync base: `d72c1e21b` (upstream/main at 07-28 cycle) → `upstream/main` @ `274880fd0`. +Branch: `manage365/upstream-sync-cipp-20260803` +Backup tag: `backup/pre-upstream-sync-cipp-20260803` + +3 merge commits (CyberDrain #103, #115, #132). Net: 19 files, +443 / −60. + +## Commits + +| SHA | Date | Subject | +|-----|------|---------| +| `f757a44fe` | 2026-07-29 | Merge PR #103 from CyberDrain/dev | +| `b49e04a51` | 2026-07-29 | Merge PR #115 from CyberDrain/dev | +| `274880fd0` | 2026-07-30 | Merge PR #132 from CyberDrain/dev → **10.7.5** | + +## Triage — Apply + +| Path / theme | Notes | +|---|---| +| `CippAlertSnoozeDialog.jsx`, `snooze-alert.js`, `snoozed-alerts.js` | Optional snooze reason field | +| `CippIntuneDeviceActions.jsx` | "Add to Group" action — pair with API `Invoke-EditGroup` AddDevice | +| `CippAddGroupForm.jsx` | `disableNesting` switch — pair with API `New-CIPPGroup` | +| `preferences.js`, `dashboardv2/*`, `CippReportToolbar.jsx` | Default Home test suite preference | +| `src/data/M365Licenses.json` | License catalog update | +| `partner-webhooks.js` | Stale webhook URL warning — pair with `Get-CIPPHostname` | + +## Triage — Adapt + +| Path | Notes | +|---|---| +| `groups/edit.jsx` | Fork redesigned page — port `disableNesting` surgically, do not replace whole file | + +## Triage — Skip / Defer + +| Path | Outcome | Why | +|---|---|---| +| `CippSSOSettings.jsx` | **Skip** | SSO family — SWA/Craft decision 2026-07-15 | +| `CippAppServiceDomains.jsx` | **Defer** | Fork has no custom-domains page; App Service hosting N/A | +| `package.json` / `version.json` / `manifest.json` | **Chore** | Baseline bump via `Update-Version.ps1` at end | + +## Already present / N/A + +- Fork already has `CippAlertSnoozeDialog`, `CippIntuneDeviceActions`, `CippReportToolbar`, `CippAddGroupForm`, partner-webhooks, preferences, dashboardv2 — taking diffs only. diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md new file mode 100644 index 0000000000..be8a8ad841 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_DELTA_CIPP_20260814.md @@ -0,0 +1,33 @@ +# Upstream Delta — CIPP (frontend) — 2026-08-14 + +Cycle: **Major** — upstream **10.7.5 → 10.8.5** (plan drafted as 10.8.4; tip advanced). + +| | SHA / version | +|--|--| +| Last sync base | `274880fd0` (upstream tip at 10.7.5) | +| Upstream tip | `a1b620403` (`upstream/main`, **10.8.5**) | +| Fork production at cycle start | `68dda9809` (`origin/main`) | +| Sync branch | `manage365/upstream-sync-cipp-20260814` | +| Backup tag | `backup/pre-upstream-sync-cipp-20260814` | + +Noise excluded from triage: `public/intune-definitions/**` churn, bulk Vitest scaffolding (port only if a batch needs it). + +## Triage themes + +| Theme | Outcome | Notes | +|-------|---------|-------| +| Baselines pages (`src/pages/tenant/baselines/**`, `CippBaselines/*`) | **Feature intake** | Pair with API; flag off; nav commented upstream — wire carefully | +| Branding settings/PDF presets | **Adapt** | Preserve Manage365 `CippBrandingSettings` / `customBranding` | +| Intune approval requests | **Apply** | New page + API | +| BitLocker search page | **Apply** | New route; search helper already in fork | +| Secure Score report / AllTenants | **Adapt** | Pair with `ListSecureScoreReport` | +| Default MFA method on user page | **Adapt** | Surgical into fork user detail | +| Community repos catalog | **Adapt** | Large FE rework — surgical | +| BEC / user detail | **Adapt** | Protected-rich fork UI | +| Auth nav → authentication/container-management, SSO dialogs | **Skip** | SWA/Craft | +| Node/jsdom engine bumps, wholesale yarn.lock | **Defer** | After feature ports | +| CippDataTable / top-nav / standards accordion | **Adapt only** | Protected | + +## Protected map refresh note + +Still authoritative: [CUSTOM_FEATURE_MAP_20260617.md](./CUSTOM_FEATURE_MAP_20260617.md). This cycle adds: Baselines parallel to Applied Standards (do not replace drift UI); branding Adapt-not-replace; skip auth nav split. diff --git a/docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md b/docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md new file mode 100644 index 0000000000..41cba07758 --- /dev/null +++ b/docs/upstream-sync/history-cipp/UPSTREAM_SYNC_CIPP_20260617.md @@ -0,0 +1,4382 @@ +# Upstream Sync Inventory — CIPP (Frontend) + +Generated: 2026-06-17 11:21 + +## Summary + +| Field | Value | +|-------|-------| +| Our branch tip | `f2d87612ec80b9be24c303137c9604590992b144` | +| Upstream branch | `upstream/main` | +| Upstream tip | `0d8ca9d2f5f8511413b69a3064e055ac45024f33` | +| Merge base | `0710355e2adac37fffe4c7eef48d6f2c3a04993d` | +| Commits to review | **241** | + +### Risk Distribution + +- **Low**: 11 +- **Medium**: 80 +- **High**: 150 + +### Recommendation Distribution + +- **Needs manual review**: 200 +- **Cherry-pick with adaptation**: 30 +- **Cherry-pick**: 11 + +### Review Buckets + +- **Potentially breaking changes**: 157 +- **Dependency/build changes**: 136 +- **Other**: 44 +- **Tenant management changes**: 20 +- **Intune changes**: 9 +- **UI improvements**: 7 +- **Security fixes**: 6 +- **Exchange/Email changes**: 6 +- **Authentication/permissions changes**: 6 +- **Tests-only**: 4 +- **Bug fixes**: 2 +- **API endpoint changes**: 1 + +--- + +## Commit Inventory + +### 1. `7dffc4c6` — feat: add fuzzy match distance setting to Intune template based on Levenshtein distance + +| Field | Value | +|-------|-------| +| SHA | `7dffc4c64a9de48e0d6f3f59abdcc57f1634c019` | +| Author | Bobby | +| Date | 2026-03-20 20:27:59 +0100 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/data/standards.json` + +--- + +### 2. `4fc1b57b` — feat: add warningMessage support standards + +| Field | Value | +|-------|-------| +| SHA | `4fc1b57b65a49f832db2ded4e15563a21ac1ebfa` | +| Author | Bobby | +| Date | 2026-03-20 20:41:42 +0100 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippStandards/CippStandardAccordion.jsx`, `src/data/standards.json` + +--- + +### 3. `88bc10a5` — Added UI Elements for adding conditional access policies to package tags + +| Field | Value | +|-------|-------| +| SHA | `88bc10a527efe58a986bf96c551c07c74c3f6ab5` | +| Author | James Tarran | +| Date | 2026-04-02 19:03:48 +0100 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/standards.json`, `src/pages/tenant/conditional/list-template/index.js` + +--- + +### 4. `5ffd20e1` — Merge remote-tracking branch 'upstream/dev' into Feat-Conditional-accesss-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `5ffd20e13c0d00dee4af844cff6affc6883c298e` | +| Author | James Tarran | +| Date | 2026-04-03 07:50:17 +0100 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 5. `db57e52a` — Mark TemplateList as optional and non-creatable + +| Field | Value | +|-------|-------| +| SHA | `db57e52a207f3e9d77974832978d88963859bf83` | +| Author | James Tarran | +| Date | 2026-04-03 08:14:19 +0100 | +| Files changed | 1 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** `src/data/standards.json` + +--- + +### 6. `83d657b8` — Lookup CA template names via API + +| Field | Value | +|-------|-------| +| SHA | `83d657b8390afb7853ddcf68e822efc7a92b1b28` | +| Author | James Tarran | +| Date | 2026-04-03 14:07:06 +0100 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/drift.js`, `src/pages/tenant/manage/policies-deployed.js` + +--- + +### 7. `b6438ee3` — Merge branch 'dev' into Feat-Conditional-accesss-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `b6438ee3c9874f2769542e4a9829fe88a87c799b` | +| Author | KelvinTegelaar | +| Date | 2026-04-04 02:14:49 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 8. `05b93261` — chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 + +| Field | Value | +|-------|-------| +| SHA | `05b93261635e0c6c2859581c4be1ce058806b066` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:44:43 +0000 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.github/workflows/Node_Project_Check.yml`, `.github/workflows/cipp_dev_build.yml`, `.github/workflows/cipp_frontend_build.yml` + +--- + +### 9. `9ae908d7` — chore(deps): bump recharts from 3.8.0 to 3.8.1 + +| Field | Value | +|-------|-------| +| SHA | `9ae908d73382e1f4da5ea85c968d9b1eb2a7455c` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:44:47 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 10. `93cfed20` — chore(deps): bump @tanstack/react-query-devtools from 5.91.3 to 5.96.2 + +| Field | Value | +|-------|-------| +| SHA | `93cfed20dca053f6077b1dd6783292847f503f17` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:45:03 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 11. `c22177f7` — chore(deps): bump mui-tiptap from 1.29.1 to 1.30.0 + +| Field | Value | +|-------|-------| +| SHA | `c22177f70624b2780c8079c60977f6aed7035c85` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:45:24 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 12. `c3c90afe` — chore(deps): bump @uiw/react-json-view + +| Field | Value | +|-------|-------| +| SHA | `c3c90afeda02f0dd9d20e7583aef1d7f51cdb284` | +| Author | dependabot[bot] | +| Date | 2026-04-22 23:55:54 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 13. `a5f2b74b` — feat: add allTenants support for multiple intune pages + +| Field | Value | +|-------|-------| +| SHA | `a5f2b74b69fa0e3847666c57dd19e072578b9466` | +| Author | Bobby | +| Date | 2026-04-25 01:32:34 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/endpoint/MEM/assignment-filters/index.js`, `src/pages/endpoint/MEM/devices/index.js`, `src/pages/endpoint/MEM/list-appprotection-policies/index.js`, `src/pages/endpoint/MEM/list-compliance-policies/index.js`, `src/pages/endpoint/MEM/list-policies/index.js`, `src/pages/endpoint/MEM/list-scripts/index.jsx`, `src/pages/endpoint/MEM/reusable-settings/index.js`, `src/pages/endpoint/applications/list/index.js` + +--- + +### 14. `f86925dc` — Merge branch 'dev' of https://github.com/kris6673/CIPP into alltenants-intune + +| Field | Value | +|-------|-------| +| SHA | `f86925dc5ee5d3c8c875ff81577242cc206cf82c` | +| Author | Bobby | +| Date | 2026-04-25 20:57:51 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 15. `1707506b` — feat: integrate useCippReportDB for data handling + +| Field | Value | +|-------|-------| +| SHA | `1707506b0a39fbf7c0154b9608b9d90a69c19331` | +| Author | Bobby | +| Date | 2026-04-25 21:22:00 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippReportDBControls.jsx`, `src/pages/endpoint/MEM/assignment-filters/index.js`, `src/pages/endpoint/MEM/devices/index.js`, `src/pages/endpoint/MEM/list-appprotection-policies/index.js`, `src/pages/endpoint/MEM/list-compliance-policies/index.js`, `src/pages/endpoint/MEM/list-scripts/index.jsx`, `src/pages/endpoint/MEM/reusable-settings/index.js`, `src/pages/endpoint/applications/list/index.js` + +--- + +### 16. `d7d36a31` — feat: Add allTenants support for all the Teams SharePoint pages + +| Field | Value | +|-------|-------| +| SHA | `d7d36a31eb86f6b6f011d483862024515f63757d` | +| Author | Bobby | +| Date | 2026-04-26 19:13:54 +0200 | +| Files changed | 5 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/teams-share/onedrive/index.js`, `src/pages/teams-share/sharepoint/index.js`, `src/pages/teams-share/teams/business-voice/index.js`, `src/pages/teams-share/teams/list-team/index.js`, `src/pages/teams-share/teams/teams-activity/index.js` + +--- + +### 17. `b05e0923` — feat(standards): add by-standard alignment summary view + +| Field | Value | +|-------|-------| +| SHA | `b05e0923d8afc286f7ca5591056bf847c8dbd755` | +| Author | Bobby | +| Date | 2026-05-08 22:36:34 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTranslations.jsx`, `src/components/CippTable/CippDataTable.js`, `src/components/CippTable/CippDataTableButton.jsx`, `src/pages/tenant/standards/alignment/index.js`, `src/utils/get-cipp-column-size.js`, `src/utils/get-cipp-formatting.js` + +--- + +### 18. `45f1d72b` — purview adding + +| Field | Value | +|-------|-------| +| SHA | `45f1d72bf7e1376fbc2e4f58ecc39d9a4c3e363b` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:25:58 +0200 | +| Files changed | 11 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippDeployCompliancePolicyDrawer.jsx`, `src/data/standards.json`, `src/layouts/config.js`, `src/pages/security/compliance/dlp-templates/index.js`, `src/pages/security/compliance/dlp/index.js`, `src/pages/security/compliance/labels-templates/index.js`, `src/pages/security/compliance/labels/index.js`, `src/pages/security/compliance/retention-templates/index.js`, `src/pages/security/compliance/retention/index.js`, `src/pages/security/compliance/sit-templates/index.js`, `src/pages/security/compliance/sit/index.js` + +--- + +### 19. `b8abed94` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `b8abed94810020cd90175d56ea268215d990a37f` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 01:26:05 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 20. `e3ed1818` — fix alert mode + +| Field | Value | +|-------|-------| +| SHA | `e3ed181822d69e25889251113ae8b3732b2d492d` | +| Author | KelvinTegelaar | +| Date | 2026-05-10 14:51:51 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** `src/data/standards.json`, `src/pages/security/compliance/retention/index.js` + +--- + +### 21. `98d5d94a` — Custom Test - Alert on X statuses + +| Field | Value | +|-------|-------| +| SHA | `98d5d94a0d122d5fbc7380d5abe5cb02fba366fd` | +| Author | Zacgoose | +| Date | 2026-05-11 21:49:35 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `src/pages/tools/custom-tests/add.jsx` + +--- + +### 22. `4b9efd82` — Update index.js + +| Field | Value | +|-------|-------| +| SHA | `4b9efd827d27a3498eca51b444934a99e78c634f` | +| Author | Zacgoose | +| Date | 2026-05-11 23:14:49 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 23. `cfe8c705` — adds #5939 + +| Field | Value | +|-------|-------| +| SHA | `cfe8c705025c918e34646f68bba815af2a0d04b2` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:51:43 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 24. `0d42f679` — #5939 + +| Field | Value | +|-------|-------| +| SHA | `0d42f6798b69367401c33f692b541faa8f483651` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:51:47 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 25. `64e40807` — implemenets #5948 + +| Field | Value | +|-------|-------| +| SHA | `64e408072e2cea57f098f49acbd84dd3d96187b2` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 19:58:59 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippApplicationDeployDrawer.jsx` + +--- + +### 26. `445820dd` — Better intune policy support for alltenants list + +| Field | Value | +|-------|-------| +| SHA | `445820dddc1438aa87d4b57d523784a9a5f2fb04` | +| Author | Zacgoose | +| Date | 2026-05-12 02:01:46 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippIntunePolicyDetails.jsx`, `src/components/CippFormPages/CippJSONView.jsx` + +--- + +### 27. `8b79d999` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8b79d999788597e35b9e3440db71a98a304aaeaa` | +| Author | Zacgoose | +| Date | 2026-05-12 02:01:48 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 28. `55dd9cc2` — HVE user page + +| Field | Value | +|-------|-------| +| SHA | `55dd9cc22fab7e05f07214f55acc92743faf8829` | +| Author | Zacgoose | +| Date | 2026-05-12 02:04:38 +0800 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippHVEUserDrawer.jsx`, `src/components/CippComponents/CippNotificationForm.jsx`, `src/data/CIPPDBCacheTypes.json`, `src/layouts/config.js`, `src/pages/email/administration/hve-accounts/index.js`, `src/pages/email/administration/mailboxes/index.js` + +--- + +### 29. `9cee69d4` — eclusions everywhere + +| Field | Value | +|-------|-------| +| SHA | `9cee69d460f246f83583316091ba86170f73f172` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:13:45 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAppTemplateDrawer.jsx`, `src/components/CippComponents/CippApplicationDeployDrawer.jsx`, `src/components/CippComponents/CippIntunePolicyActions.jsx`, `src/components/CippComponents/CippPolicyDeployDrawer.jsx`, `src/components/CippWizard/CippIntunePolicy.jsx`, `src/pages/endpoint/applications/templates/index.js` + +--- + +### 30. `14461b4f` — eclusions everywhere + +| Field | Value | +|-------|-------| +| SHA | `14461b4f68c5f6e3214512a575d585439d9cbbd7` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:13:49 +0200 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippIntunePolicyActions.jsx`, `src/components/CippWizard/CippIntunePolicy.jsx`, `src/pages/endpoint/applications/templates/index.js` + +--- + +### 31. `1b77b784` — Update manifest for PWA chrome install option + +| Field | Value | +|-------|-------| +| SHA | `1b77b7843ee3c86e746019d8ce0ecd2ded3ed6cf` | +| Author | Zacgoose | +| Date | 2026-05-12 02:28:27 +0800 | +| Files changed | 4 | +| Risk | **Medium** | +| Area | UI | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: UI improvements | + +**Files:** `public/manifest.json`, `public/sw.js`, `src/pages/_app.js`, `src/pages/_document.js` + +--- + +### 32. `08c793d7` — Update manifest.json + +| Field | Value | +|-------|-------| +| SHA | `08c793d77ab6449bd8ec7bbdebd9535d892d00f6` | +| Author | Zacgoose | +| Date | 2026-05-12 02:28:43 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `public/manifest.json` + +--- + +### 33. `da6dc7fa` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `da6dc7fad7915d6e82a1fd631047dd5047b22487` | +| Author | Zacgoose | +| Date | 2026-05-12 02:29:13 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 34. `20e2f554` — implements #5986 + +| Field | Value | +|-------|-------| +| SHA | `20e2f554df668843e44dc2e88671bb605aab7067` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:01 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx`, `src/pages/email/administration/tenant-allow-block-list-templates/index.js` + +--- + +### 35. `bc412396` — implements #5986 + +| Field | Value | +|-------|-------| +| SHA | `bc412396b99046eb487a838aaf213007f1db568e` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:06 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx`, `src/pages/email/administration/tenant-allow-block-list-templates/index.js` + +--- + +### 36. `8e99c018` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8e99c01866d9f7f6bc78c6517e80db73ab1b0ca8` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:43:08 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 37. `2e9b9fd5` — fixed weird button + +| Field | Value | +|-------|-------| +| SHA | `2e9b9fd508f2e9ae6fddffa9f03db7c8edb22881` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:47:36 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTenantAllowBlockListTemplateDrawer.jsx` + +--- + +### 38. `2a1b9128` — Merge pull request #5984 from kris6673/by-standards-view + +| Field | Value | +|-------|-------| +| SHA | `2a1b9128bb8177ca79e75d6faa078e6fcd84c7a5` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 20:49:29 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 39. `35711f89` — Merge branch 'dev' of https://github.com/kris6673/CIPP into allTenants-SP + +| Field | Value | +|-------|-------| +| SHA | `35711f89238acdd76b53fae5c9830346b5fa99db` | +| Author | Bobby | +| Date | 2026-05-11 20:59:51 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 40. `5ca3e9ad` — Merge branch 'dev' into alltenants-intune + +| Field | Value | +|-------|-------| +| SHA | `5ca3e9ad310e88e92ec7e6b44e54bab52f0ae57c` | +| Author | Bobby | +| Date | 2026-05-11 21:06:50 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 41. `be88cc9c` — Merge branch 'dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `be88cc9c54dd47a989fd3c3af7b4b8ff2fec537e` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:07:15 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 42. `dd0ba6f1` — Merge pull request #5920 from kris6673/alltenants-intune + +| Field | Value | +|-------|-------| +| SHA | `dd0ba6f1b07b33eb18dae67131341d2df35f6b30` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:13:11 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 43. `2f849474` — Merge branch 'dev' into levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `2f849474358af80c5da1a67048800baaf3d4bf4f` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:20:47 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 44. `fd23c0df` — Merge branch 'dev' into allTenants-SP + +| Field | Value | +|-------|-------| +| SHA | `fd23c0df0fd3c63fc7d5f1fc006bb60c8b8b788d` | +| Author | Kristian Kjærgård | +| Date | 2026-05-11 21:21:18 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 45. `fe722173` — Merge pull request #5794 from TecharyJames/Feat-Conditional-accesss-policy-package-tags + +| Field | Value | +|-------|-------| +| SHA | `fe722173a80cb3ab719f90cfe1a49899e710c41c` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:29:08 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** (none) + +--- + +### 46. `ccf4e9cf` — Merge pull request #5685 from kris6673/levenshtein-distance + +| Field | Value | +|-------|-------| +| SHA | `ccf4e9cf01a4158c5cb6cad3264e84b855a3e194` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:33:48 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 47. `0fc7b3c6` — Merge pull request #5921 from kris6673/allTenants-SP + +| Field | Value | +|-------|-------| +| SHA | `0fc7b3c6123916874377ffad15fa6a7b3464a094` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:37:32 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** (none) + +--- + +### 48. `4b0800b8` — Merge pull request #5903 from KelvinTegelaar/dependabot/github_actions/dev/actions/setup-node-6.4.0 + +| Field | Value | +|-------|-------| +| SHA | `4b0800b8371802b36fadf269fe0ab99afa4dbdc0` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:55:32 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 49. `7bcd507c` — Merge pull request #5906 from KelvinTegelaar/dependabot/npm_and_yarn/dev/mui-tiptap-1.30.0 + +| Field | Value | +|-------|-------| +| SHA | `7bcd507c81e29aab1b8d2b9d0ef93c8e91a5c7cf` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:56:26 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 50. `cef87445` — Merge pull request #5905 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-devtools-5.96.2 + +| Field | Value | +|-------|-------| +| SHA | `cef87445b19b8a64c6289f67073dc77fb7d13abc` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:56:35 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 51. `06e16457` — Merge pull request #5904 from KelvinTegelaar/dependabot/npm_and_yarn/dev/recharts-3.8.1 + +| Field | Value | +|-------|-------| +| SHA | `06e16457eb9b9c872f746706eb591acc4834c2fe` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:56:54 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 52. `7dcb867b` — Merge pull request #5908 from KelvinTegelaar/dependabot/npm_and_yarn/dev/uiw/react-json-view-2.0.0-alpha.42 + +| Field | Value | +|-------|-------| +| SHA | `7dcb867bb354653fcfaa9218e81f1bcb96a83ef9` | +| Author | KelvinTegelaar | +| Date | 2026-05-11 21:57:59 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 53. `a4915dff` — chore(deps): bump @tanstack/react-query-persist-client + +| Field | Value | +|-------|-------| +| SHA | `a4915dff719e75be54e3b786b27028b54aadc26d` | +| Author | dependabot[bot] | +| Date | 2026-05-11 20:01:47 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 54. `fe4bd7f9` — fix: allow alltenants sync on onedrive/sharepoint + +| Field | Value | +|-------|-------| +| SHA | `fe4bd7f9cdf6ff5188c8df9078d9b9a8d38ea979` | +| Author | John Duprey | +| Date | 2026-05-11 17:41:08 -0400 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/teams-share/onedrive/index.js`, `src/pages/teams-share/sharepoint/index.js` + +--- + +### 55. `d7e8b0b5` — fix: tweak toggle button size + +| Field | Value | +|-------|-------| +| SHA | `d7e8b0b569c3f9243ff7e09a326ed74ccbd3a046` | +| Author | John Duprey | +| Date | 2026-05-11 19:03:48 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/standards/alignment/index.js` + +--- + +### 56. `15939e2b` — feat: improve run standard now UX provide single action with autocomplete to select all tenants in template or individual tenant (expanded from alltenants/groups) + +| Field | Value | +|-------|-------| +| SHA | `15939e2b9a9a9d229b3f0e33b0fbde1467222016` | +| Author | John Duprey | +| Date | 2026-05-11 22:48:47 -0400 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormTemplateTenantSelector.jsx`, `src/pages/tenant/manage/applied-standards.js`, `src/pages/tenant/manage/drift.js`, `src/pages/tenant/manage/driftManagementActions.js`, `src/pages/tenant/manage/policies-deployed.js`, `src/pages/tenant/standards/templates/index.js`, `src/pages/tenant/standards/templates/template.jsx` + +--- + +### 57. `1cb6a11c` — fix: enhance standard name retrieval logic for better matching + +| Field | Value | +|-------|-------| +| SHA | `1cb6a11cf22c446b952976f5200f5a3f3df689f5` | +| Author | John Duprey | +| Date | 2026-05-11 22:54:17 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/standards/alignment/index.js` + +--- + +### 58. `6cd8c632` — chore: linting + +| Field | Value | +|-------|-------| +| SHA | `6cd8c632cc9273a5fd95b82dba4a99f81b442b59` | +| Author | John Duprey | +| Date | 2026-05-11 23:07:54 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/standards/alignment/index.js` + +--- + +### 59. `4f2d4993` — feat: enhance intune template details display + +| Field | Value | +|-------|-------| +| SHA | `4f2d4993fb2efb983bea8a38de5d527e5d87c369` | +| Author | John Duprey | +| Date | 2026-05-11 23:57:17 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTranslations.jsx`, `src/pages/endpoint/MEM/list-templates/index.js`, `src/utils/get-cipp-formatting.js` + +--- + +### 60. `0a70010e` — fix: update translation keys and adjust template usage references + +| Field | Value | +|-------|-------| +| SHA | `0a70010e2185488a67f91f8e508f67f14f0708df` | +| Author | John Duprey | +| Date | 2026-05-12 00:07:31 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippTranslations.jsx`, `src/pages/endpoint/MEM/list-templates/index.js` + +--- + +### 61. `63c85df0` — OneDrive Sharing disable + +| Field | Value | +|-------|-------| +| SHA | `63c85df03c93f0172b357ccd3be0536f075210da` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:03:50 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippRemediationCard.jsx`, `src/components/CippComponents/CippOffboardingDefaultSettings.jsx`, `src/components/CippComponents/CippUserActions.jsx`, `src/components/CippWizard/CippWizardOffboarding.jsx` + +--- + +### 62. `6c55bc42` — OneDrive Sharing disable + +| Field | Value | +|-------|-------| +| SHA | `6c55bc422c0e8d89c66dbd4de14b595babfd188f` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:03:54 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippRemediationCard.jsx`, `src/components/CippComponents/CippOffboardingDefaultSettings.jsx`, `src/components/CippComponents/CippUserActions.jsx`, `src/components/CippWizard/CippWizardOffboarding.jsx` + +--- + +### 63. `7054bfc4` — Add AlertUserReportPhising + +| Field | Value | +|-------|-------| +| SHA | `7054bfc42d67a7f3d86b23b036057ba98559d488` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 16:32:20 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/alerts.json` + +--- + +### 64. `d00ebb77` — chore: bump version to 10.4.5 + +| Field | Value | +|-------|-------| +| SHA | `d00ebb77ca928c0fe06f5f728a78a459b76dd911` | +| Author | John Duprey | +| Date | 2026-05-12 11:32:16 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 65. `335e40ad` — Merge pull request #5907 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-persist-client-5.96.2 + +| Field | Value | +|-------|-------| +| SHA | `335e40ad0dbdf05dd9453eef6df89901932a2782` | +| Author | KelvinTegelaar | +| Date | 2026-05-12 20:25:37 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 66. `19c48eab` — auth options + +| Field | Value | +|-------|-------| +| SHA | `19c48eabf7ff5779f683b6edf33ca24d9c76dae0` | +| Author | Zacgoose | +| Date | 2026-05-13 04:19:28 +0800 | +| Files changed | 12 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/ForcedSsoMigrationDialog.jsx`, `src/components/CippComponents/SsoMigrationDialog.jsx`, `src/components/CippIntegrations/CippApiClientManagement.jsx`, `src/components/CippSettings/CippContainerManagement.jsx`, `src/components/CippSettings/CippSSOSettings.jsx`, `src/components/CippSettings/CippUserManagement.jsx`, `src/layouts/TabbedLayout.jsx`, `src/layouts/index.js`, `src/pages/cipp/advanced/super-admin/cipp-users.js`, `src/pages/cipp/advanced/super-admin/container.js`, `src/pages/cipp/advanced/super-admin/sso.js`, `src/pages/cipp/advanced/super-admin/tabOptions.json` + +--- + +### 67. `36071e54` — Module updates and import changes + +| Field | Value | +|-------|-------| +| SHA | `36071e5403afe1bf5bc8426e49db987ce23a0bb8` | +| Author | Zacgoose | +| Date | 2026-05-13 14:20:34 +0800 | +| Files changed | 13 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `next.config.js`, `package.json`, `src/components/CippCards/CippStandardsDialog.jsx`, `src/components/CippComponents/CippAppPermissionBuilder.jsx`, `src/components/CippSettings/CippContainerManagement.jsx`, `src/components/CippStandards/CippStandardAccordion.jsx`, `src/components/CippStandards/CippStandardsSideBar.jsx`, `src/components/CippTable/CippDataTable.js`, `src/pages/cipp/advanced/super-admin/container.js`, `src/pages/cipp/settings/features.js`, `src/pages/tenant/standards/bpa-report/view.js`, `src/pages/tenant/standards/templates/template.jsx`, `yarn.lock` + +--- + +### 68. `c0946109` — Fix bulk mailbox rule changes + +| Field | Value | +|-------|-------| +| SHA | `c0946109c91b31ee9699ba7dbf377a8f299b1a55` | +| Author | Zacgoose | +| Date | 2026-05-13 16:47:42 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/identity/administration/users/user/exchange.jsx` + +--- + +### 69. `72d8658d` — Add Apps and SP to universal search + +| Field | Value | +|-------|-------| +| SHA | `72d8658d5ded1c0f47fddeacb3a384c5cbf0e38d` | +| Author | Zacgoose | +| Date | 2026-05-13 17:06:41 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/bulk-actions-menu.js` + +--- + +### 70. `ba196dde` — expand side nav slightly for ux + +| Field | Value | +|-------|-------| +| SHA | `ba196dde059e16c53ee182a7d49eff8292073e27` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 12:07:00 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `.claude/worktrees/blissful-golick-d405ab`, `src/layouts/side-nav.js` + +--- + +### 71. `8551ef5f` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8551ef5fd6d78da756930a5c41d783512063ec13` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 12:07:14 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 72. `52a47639` — Nice CA policy editor and template creator/editor + +| Field | Value | +|-------|-------| +| SHA | `52a4763907144faafc70dfeb439c705679e24dc0` | +| Author | Zacgoose | +| Date | 2026-05-13 18:52:11 +0800 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCAPolicyBuilder.jsx`, `src/components/CippComponents/CippTemplateFieldRenderer.jsx`, `src/data/conditionalAccessSchema.json`, `src/pages/tenant/conditional/list-policies/edit.jsx`, `src/pages/tenant/conditional/list-policies/index.js`, `src/pages/tenant/conditional/list-template/create.jsx`, `src/pages/tenant/conditional/list-template/edit.jsx`, `src/pages/tenant/conditional/list-template/index.js` + +--- + +### 73. `41efc5b7` — Update CippCAPolicyBuilder.jsx + +| Field | Value | +|-------|-------| +| SHA | `41efc5b726d55036beeef036f6d2e2ac7a7e4e80` | +| Author | Zacgoose | +| Date | 2026-05-13 18:54:03 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCAPolicyBuilder.jsx` + +--- + +### 74. `60a50738` — fixes tenantfilter property + +| Field | Value | +|-------|-------| +| SHA | `60a50738fc68fd8b17ea615343f785828c713209` | +| Author | KelvinTegelaar | +| Date | 2026-05-13 21:08:55 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/email/administration/mailbox-rules/index.js` + +--- + +### 75. `c9584010` — chore(deps): bump dompurify from 3.4.2 to 3.4.3 + +| Field | Value | +|-------|-------| +| SHA | `c958401045bf32a2326446cb24b4550e63b15f75` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:43:59 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 76. `a783d28a` — chore(deps): bump @tiptap/extension-table from 3.20.4 to 3.20.5 + +| Field | Value | +|-------|-------| +| SHA | `a783d28ab623dc69767ffd758e5cd140f171f2d5` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:44:16 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 77. `2285d39c` — chore(deps): bump @tiptap/core from 3.20.5 to 3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `2285d39cfdfdbbdffe377fbcc357200763f27e84` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:44:34 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 78. `d392d1cf` — chore(deps): bump @tanstack/react-query from 5.96.2 to 5.100.10 + +| Field | Value | +|-------|-------| +| SHA | `d392d1cfebf3dd1fc82e50e0cc0fda449814d693` | +| Author | dependabot[bot] | +| Date | 2026-05-13 23:45:13 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 79. `fd6a9e36` — Logs + +| Field | Value | +|-------|-------| +| SHA | `fd6a9e36007839cbb51f850ac75b5585726724a0` | +| Author | Zacgoose | +| Date | 2026-05-14 15:38:27 +1000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/layouts/config.js`, `src/pages/cipp/advanced/container-logs.js` + +--- + +### 80. `b5d48bcd` — logging + +| Field | Value | +|-------|-------| +| SHA | `b5d48bcddaed40af6839e15ba7a9907c4b22ad33` | +| Author | Zacgoose | +| Date | 2026-05-14 18:09:04 +1000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/ContainerLogPresets.json`, `src/pages/cipp/advanced/container-logs.js` + +--- + +### 81. `12a07270` — comingsoon + +| Field | Value | +|-------|-------| +| SHA | `12a07270752ea03f3c94eb33f419fdd7336f5985` | +| Author | KelvinTegelaar | +| Date | 2026-05-14 14:34:30 +0200 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `public/assets/integrations/autotask.png`, `public/assets/integrations/connectwise.png`, `public/assets/integrations/kaseya.svg`, `src/data/Extensions.json`, `src/pages/cipp/integrations/index.js` + +--- + +### 82. `db20afa2` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `db20afa205ae565262837d9c43c2fb5ccb3b268a` | +| Author | KelvinTegelaar | +| Date | 2026-05-14 14:34:41 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 83. `c9bfe909` — feat(endpoint): add MEM enrollment profiles page (Apple ADE, Android, Autopilot) + +| Field | Value | +|-------|-------| +| SHA | `c9bfe909582d9cc9d308903d7e74b44c6d926087` | +| Author | Bobby | +| Date | 2026-05-14 10:44:12 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/CippComponents/CippBreadcrumbNav.jsx`, `src/layouts/config.js`, `src/pages/endpoint/MEM/enrollment-profiles/EnrollmentProfileTabs.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json`, `src/pages/endpoint/MEM/enrollment-profiles/windows-autopilot.js` + +--- + +### 84. `b1902421` — feat: Bit more margin to make tabbed layout of first item less cramped + +| Field | Value | +|-------|-------| +| SHA | `b19024214e96bd207640c5e63dcefb38d408e161` | +| Author | Bobby | +| Date | 2026-05-14 16:51:32 +0200 | +| Files changed | 2 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** `src/layouts/HeaderedTabbedLayout.jsx`, `src/layouts/TabbedLayout.jsx` + +--- + +### 85. `6dab9339` — feat(tabs): support icons in tabbed layouts + +| Field | Value | +|-------|-------| +| SHA | `6dab9339978f195dc8e6db35633071da8f16eb8a` | +| Author | Bobby | +| Date | 2026-05-14 17:50:36 +0200 | +| Files changed | 4 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/layouts/HeaderedTabbedLayout.jsx`, `src/layouts/TabbedLayout.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json`, `src/utils/icon-registry.js` + +--- + +### 86. `9b616499` — feat: Migrate to use shared icon registry for string to icon conversion + +| Field | Value | +|-------|-------| +| SHA | `9b6164999145da5dab8cb726cc2b4d6a25cba44b` | +| Author | Bobby | +| Date | 2026-05-14 18:46:23 +0200 | +| Files changed | 8 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippPropertyListCard.jsx`, `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/CippComponents/CippTenantSelector.jsx`, `src/components/bulk-actions-menu.js`, `src/data/portals.json`, `src/layouts/HeaderedTabbedLayout.jsx`, `src/layouts/TabbedLayout.jsx`, `src/utils/icon-registry.js` + +--- + +### 87. `983b48a1` — fix: Remove accidentally committed .claude/worktrees directory + +| Field | Value | +|-------|-------| +| SHA | `983b48a1b1c35c329c9ad8405635c26e6859b0b9` | +| Author | Clint Thomon | +| Date | 2026-05-14 13:59:43 -0500 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.claude/worktrees/blissful-golick-d405ab`, `.gitignore` + +--- + +### 88. `0c32a84e` — Add additional portal links to Invoke-HuduExtensionSync + +| Field | Value | +|-------|-------| +| SHA | `0c32a84eb21d3df3a719427b54d10821a94b40a4` | +| Author | jwebster@protectedtrust.com | +| Date | 2026-05-14 16:26:44 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | API | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: API endpoint changes | + +**Files:** `src/data/Extensions.json` + +--- + +### 89. `186a2c6e` — audit log template tweak + +| Field | Value | +|-------|-------| +| SHA | `186a2c6ea22589ca28f655eba01526ceb74ec2d9` | +| Author | Zacgoose | +| Date | 2026-05-15 02:29:31 -0500 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/AuditLogTemplates.json`, `src/layouts/config.js`, `src/pages/cipp/advanced/worker-health.js` + +--- + +### 90. `7a85827e` — feat(users): add bulk update contact and UPN fields + +| Field | Value | +|-------|-------| +| SHA | `7a85827ef1072955a48cb1d48c3ce2aafe3ab88d` | +| Author | Bobby | +| Date | 2026-05-15 16:34:51 +0200 | +| Files changed | 1 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** `src/pages/identity/administration/users/patch-wizard.jsx` + +--- + +### 91. `8232e5c1` — feat(standards): add intuneRestrictUserDeviceJoin entry + +| Field | Value | +|-------|-------| +| SHA | `8232e5c11b26c897151d6daaaaa74f8288f52110` | +| Author | Bobby | +| Date | 2026-05-15 20:30:01 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/data/standards.json` + +--- + +### 92. `f768330c` — fix(standards): move CIS 5.1.4.1 and SMB1001 (2.8) tags to join standard + +| Field | Value | +|-------|-------| +| SHA | `f768330cd45a2b2e1f6a7cae857b7a5e2ec7d999` | +| Author | Bobby | +| Date | 2026-05-15 20:30:31 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 93. `9d5ce402` — Org auto expanding archive property usage + +| Field | Value | +|-------|-------| +| SHA | `9d5ce40275098a4a442d247fe42541958d08ba88` | +| Author | Zacgoose | +| Date | 2026-05-18 07:27:51 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippExchangeInfoCard.jsx` + +--- + +### 94. `6db7e776` — Delete .claude directory + +| Field | Value | +|-------|-------| +| SHA | `6db7e7760fc02807df809897fcda40b48a8b365b` | +| Author | Zacgoose | +| Date | 2026-05-18 14:37:01 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `.claude/worktrees/blissful-golick-d405ab` + +--- + +### 95. `1e7aef11` — Update alerts.json + +| Field | Value | +|-------|-------| +| SHA | `1e7aef11995feb42e9872ec4aefac39fc7ba67c5` | +| Author | Zacgoose | +| Date | 2026-05-19 08:19:29 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/alerts.json` + +--- + +### 96. `fc246a54` — update default value for standard + +| Field | Value | +|-------|-------| +| SHA | `fc246a54ee6c1720f9d442f4cf22568b53add85d` | +| Author | Zacgoose | +| Date | 2026-05-19 10:02:02 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 97. `766a3c52` — feat: add in missing options for Windows Hello standard + +| Field | Value | +|-------|-------| +| SHA | `766a3c52814dcc09d9170c780b4caa5e59d7a343` | +| Author | Bobby | +| Date | 2026-05-20 22:10:11 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 98. `5b5302ca` — feat(standards): add DLP via DCS OWA standard + +| Field | Value | +|-------|-------| +| SHA | `5b5302ca907b971e86c5ed5fd8c1f56491f796c8` | +| Author | Bobby | +| Date | 2026-05-20 23:18:38 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 99. `131927b9` — Stats + +| Field | Value | +|-------|-------| +| SHA | `131927b943aebebd6844ba986fbcf30fb21ac8bc` | +| Author | Zacgoose | +| Date | 2026-05-22 12:51:00 -0400 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/PrivateRoute.js`, `src/layouts/index.js`, `src/pages/cipp/advanced/worker-health.js` + +--- + +### 100. `a6ae2610` — Add Group-Based Licensing support + +| Field | Value | +|-------|-------| +| SHA | `a6ae2610d2bf4977dc4ff0a63979d32f263cf440` | +| Author | Luis Mengel | +| Date | 2026-05-23 15:21:33 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows, Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormLicenseSelector.jsx`, `src/components/CippFormPages/CippAddGroupForm.jsx`, `src/components/CippFormPages/CippAddGroupTemplateForm.jsx`, `src/components/CippWizard/CippWizardGroupTemplates.jsx`, `src/pages/identity/administration/group-templates/edit.jsx`, `src/pages/identity/administration/groups/edit.jsx` + +--- + +### 101. `c74966b3` — Merge pull request #6018 from kris6673/bulk-edit + +| Field | Value | +|-------|-------| +| SHA | `c74966b3aeb084e181626cc9e7c3b91d05af5350` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:39:33 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 102. `5574b477` — Merge pull request #6038 from kris6673/winhello + +| Field | Value | +|-------|-------| +| SHA | `5574b4779a5ca2600070ce3fc37e939d5a54a466` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:41:22 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 103. `fad1cacf` — Merge pull request #6019 from kris6673/split-intune-join-registration + +| Field | Value | +|-------|-------| +| SHA | `fad1cacfe9936eef973d5dc6b41447e3220376bd` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:42:33 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** (none) + +--- + +### 104. `96686d7e` — Merge pull request #6012 from jonwbstr/magicdash-addoptions + +| Field | Value | +|-------|-------| +| SHA | `96686d7e90cc1dbd88ac6b30bebc74888dac4841` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:46:30 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 105. `bde8ad3c` — Merge pull request #6010 from Celeratec/fix/remove-claude-worktrees + +| Field | Value | +|-------|-------| +| SHA | `bde8ad3cfea1197e04b2dff8ac0b93e944566f7f` | +| Author | KelvinTegelaar | +| Date | 2026-05-23 16:49:24 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** (none) + +--- + +### 106. `a3279044` — CIPP Hosted Notices + +| Field | Value | +|-------|-------| +| SHA | `a32790443fc1297fab6900acc498df9cff107aa0` | +| Author | Zacgoose | +| Date | 2026-05-24 09:13:35 +1000 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/FailedPaymentDialog.jsx`, `src/components/CippComponents/SubscriptionEndedDialog.jsx`, `src/layouts/index.js` + +--- + +### 107. `04c63849` — implement standards template deployment for intune apps + +| Field | Value | +|-------|-------| +| SHA | `04c63849f689bbd2686fb473cbaef1462a1d1b99` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 22:41:10 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/data/standards.json` + +--- + +### 108. `28cafc93` — added third party notice + +| Field | Value | +|-------|-------| +| SHA | `28cafc931d46c705b3481a1e5bd185b39ca8879d` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 23:06:16 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/integrations/index.js` + +--- + +### 109. `30455f27` — third party + +| Field | Value | +|-------|-------| +| SHA | `30455f273d7cfcba5add1012bc260bb789f7c405` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 23:06:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/integrations/index.js` + +--- + +### 110. `d4f458a1` — Third party text + +| Field | Value | +|-------|-------| +| SHA | `d4f458a15b67d7c8cdd8b8095d3a638a040a9dd4` | +| Author | KelvinTegelaar | +| Date | 2026-05-24 23:07:33 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/integrations/index.js` + +--- + +### 111. `ee0ab2ab` — add extendedValues + +| Field | Value | +|-------|-------| +| SHA | `ee0ab2abe3341bd2f0270391f36e781f6f4ef8d2` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:13:35 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippFormPages/CippAddEditUser.jsx`, `src/pages/tenant/manage/user-defaults.js` + +--- + +### 112. `17bf1f8d` — fixes #5995 + +| Field | Value | +|-------|-------| +| SHA | `17bf1f8dbbd6fe16a63fa268c60dfa8fe8a0c053` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 00:14:08 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/user-defaults.js` + +--- + +### 113. `8097e6ed` — FIDO2 profile standards + +| Field | Value | +|-------|-------| +| SHA | `8097e6ede3991b61e65b03bd21496dc55c96bc33` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:34:03 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 114. `389babe3` — add global var showing + +| Field | Value | +|-------|-------| +| SHA | `389babe3e5641be1363afed31b78eddd1a0e3949` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:58:14 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCustomVariables.jsx` + +--- + +### 115. `3bdb9d5b` — add global var showing + +| Field | Value | +|-------|-------| +| SHA | `3bdb9d5b4de432f5a319d2c0e90b43462d4e82f1` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 01:58:18 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCustomVariables.jsx` + +--- + +### 116. `c43f6d9a` — Update unauthenticated.js + +| Field | Value | +|-------|-------| +| SHA | `c43f6d9ab5f013d386dcb52237e61754efe3ee0d` | +| Author | Zacgoose | +| Date | 2026-05-25 08:02:23 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/unauthenticated.js` + +--- + +### 117. `f591d479` — logout + +| Field | Value | +|-------|-------| +| SHA | `f591d4790012f7fd747433f6eb65f1e30f7f6dd6` | +| Author | Zacgoose | +| Date | 2026-05-25 11:10:02 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/SsoMigrationDialog.jsx`, `src/layouts/account-popover.js`, `src/layouts/index.js` + +--- + +### 118. `16b4503f` — login/out testing + +| Field | Value | +|-------|-------| +| SHA | `16b4503f014b4d5b99ff0e49485dcc97544e3cee` | +| Author | Zacgoose | +| Date | 2026-05-25 11:29:56 +0800 | +| Files changed | 2 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `src/layouts/account-popover.js`, `staticwebapp.config.json` + +--- + +### 119. `c1c5693c` — feat: add admin role member removal functionality + +| Field | Value | +|-------|-------| +| SHA | `c1c5693c09ef99c196b80d17b4b8aeb61f1d9852` | +| Author | Bobby | +| Date | 2026-05-25 11:49:27 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/identity/administration/roles/index.js`, `src/pages/identity/administration/users/user/index.jsx` + +--- + +### 120. `38e72f99` — Add APv2 profile + +| Field | Value | +|-------|-------| +| SHA | `38e72f99f64ab21449ad7588becbd2c35fb80646` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:29:31 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 121. `304e0e5a` — Merge pull request #6052 from kris6673/remove-adminroles + +| Field | Value | +|-------|-------| +| SHA | `304e0e5a21017ffd1a384906891cdee6f2bcb472` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:31:34 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 122. `d8c4988d` — Merge pull request #6039 from kris6673/DlpViaDcsEnabled + +| Field | Value | +|-------|-------| +| SHA | `d8c4988d120bfe295699b783912d1987b5faf84c` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:32:40 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 123. `28ec38c1` — Merge pull request #6009 from kris6673/ade + +| Field | Value | +|-------|-------| +| SHA | `28ec38c1c67606d204e23cf26bec9acc11201292` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:35:36 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 124. `ac1190da` — Merge pull request #6003 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tanstack/react-query-5.100.10 + +| Field | Value | +|-------|-------| +| SHA | `ac1190da4417434b740ce99cee3de5f4ad9edc44` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:12 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 125. `2e1e3007` — Merge pull request #6001 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/core-3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `2e1e30074fdc2db898f4449bcd93d69351e05344` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:31 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 126. `4ffb7638` — Merge pull request #6000 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-table-3.20.5 + +| Field | Value | +|-------|-------| +| SHA | `4ffb7638952ef2ad242a073493fa7fb8c49a448d` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:42 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 127. `0001b6c8` — Merge pull request #5999 from KelvinTegelaar/dependabot/npm_and_yarn/dev/dompurify-3.4.3 + +| Field | Value | +|-------|-------| +| SHA | `0001b6c82cb49b7200904f89240c5028da5ef136` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 14:37:58 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 128. `83994360` — chore(deps): bump react from 19.2.5 to 19.2.6 + +| Field | Value | +|-------|-------| +| SHA | `839943607b846de806fb5f0694dd9dc479fcf7df` | +| Author | dependabot[bot] | +| Date | 2026-05-25 12:40:46 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 129. `8a179d28` — moved autopilot ade etc + +| Field | Value | +|-------|-------| +| SHA | `8a179d2886027c1cd9e17eb7277bbe1c6d08ea2a` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 15:05:27 +0200 | +| Files changed | 4 | +| Risk | **High** | +| Area | Intune | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Intune changes, Potentially breaking changes | + +**Files:** `src/layouts/config.js`, `src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/tabOptions.json` + +--- + +### 130. `ff9af7e0` — add tutorials to easy deployment of steps for Ashe. + +| Field | Value | +|-------|-------| +| SHA | `ff9af7e0d8de76f1902de17cd9b4cf7614b3c39d` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 18:30:53 +0200 | +| Files changed | 14 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `src/components/CippComponents/CippBreadcrumbNav.jsx`, `src/components/CippComponents/CippSpeedDial.jsx`, `src/components/CippComponents/CippTutorialDialog.jsx`, `src/contexts/tutorial-context.js`, `src/data/tutorials/dashboard-overview.json`, `src/data/tutorials/getting-started.json`, `src/data/tutorials/tenant-management.json`, `src/layouts/side-nav.js`, `src/layouts/top-nav.js`, `src/pages/_app.js`, `src/pages/dashboardv2/index.js`, `src/styles/tutorial-overrides.css`, `yarn.lock` + +--- + +### 131. `eac59c8a` — add tutorials to easy deployment of steps for Ashe. + +| Field | Value | +|-------|-------| +| SHA | `eac59c8ac8d55c4a2a4f81e3016f64747d85d4fc` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 18:31:00 +0200 | +| Files changed | 7 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippBreadcrumbNav.jsx`, `src/components/CippComponents/CippSpeedDial.jsx`, `src/components/CippComponents/CippTutorialDialog.jsx`, `src/contexts/tutorial-context.js`, `src/layouts/top-nav.js`, `src/pages/dashboardv2/index.js`, `src/styles/tutorial-overrides.css` + +--- + +### 132. `6a51abf3` — demo data + +| Field | Value | +|-------|-------| +| SHA | `6a51abf309207078b9429ed62eaa03eceb8280b3` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 20:37:52 +0200 | +| Files changed | 2 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/contexts/tutorial-context.js`, `src/data/dashboardv2-demo-data.js` + +--- + +### 133. `37778e28` — Merge pull request #6002 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-19.2.6 + +| Field | Value | +|-------|-------| +| SHA | `37778e2872d9b994494603f626c1a4acba3e4c7d` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 21:30:54 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 134. `a2d8f191` — react-dom + +| Field | Value | +|-------|-------| +| SHA | `a2d8f1918f67ed864a57e50e55f8fd3f949774a9` | +| Author | KelvinTegelaar | +| Date | 2026-05-25 21:32:56 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json` + +--- + +### 135. `7d1c2096` — Move EnrollmentProfileTabs from pages to components and update imports + +| Field | Value | +|-------|-------| +| SHA | `7d1c2096f820f505684167d28bf38487534bd5ff` | +| Author | copilot-swe-agent[bot] | +| Date | 2026-05-25 23:09:50 +0000 | +| Files changed | 5 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/components/EnrollmentProfileTabs.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/windows-autopilot.js` + +--- + +### 136. `02c7a434` — Move EnrollmentProfileTabs to CippComponents folder and update imports + +| Field | Value | +|-------|-------| +| SHA | `02c7a4341ca6d9ceb016ed45d10f0e188bce6a26` | +| Author | copilot-swe-agent[bot] | +| Date | 2026-05-25 23:13:28 +0000 | +| Files changed | 5 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/EnrollmentProfileTabs.jsx`, `src/pages/endpoint/MEM/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/MEM/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/MEM/enrollment-profiles/index.js`, `src/pages/endpoint/MEM/enrollment-profiles/windows-autopilot.js` + +--- + +### 137. `8145f585` — Merge pull request #6056 from KelvinTegelaar/copilot/move-enrollment-profile-tabs + +| Field | Value | +|-------|-------| +| SHA | `8145f585d73328645f2354a284bf769405a69092` | +| Author | Zacgoose | +| Date | 2026-05-25 19:14:54 -0400 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 138. `1e59d2d4` — Update ListTests.json + +| Field | Value | +|-------|-------| +| SHA | `1e59d2d43fab463a709d1dac2477f45cfacdfae6` | +| Author | Zacgoose | +| Date | 2026-05-26 11:54:57 +0800 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `Tests/Shapes/ListTests.json` + +--- + +### 139. `1cd1ef72` — Update AuditLogTemplates.json + +| Field | Value | +|-------|-------| +| SHA | `1cd1ef7223672170bdce1fffe88d8bb4ddb903d9` | +| Author | Zacgoose | +| Date | 2026-05-26 12:30:37 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/AuditLogTemplates.json` + +--- + +### 140. `ca150a28` — Better display standards that are missing licenses to be able to work + +| Field | Value | +|-------|-------| +| SHA | `ca150a28cfcb3922d6de42cb4db54f2afcdf6e0e` | +| Author | Zacgoose | +| Date | 2026-05-26 15:08:56 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js` + +--- + +### 141. `f3c8a79e` — Update yarn.lock + +| Field | Value | +|-------|-------| +| SHA | `f3c8a79e42e97ad5b0cad9889ce15e4863f6bef8` | +| Author | Zacgoose | +| Date | 2026-05-26 15:09:04 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `yarn.lock` + +--- + +### 142. `d28e8ebf` — user sync + +| Field | Value | +|-------|-------| +| SHA | `d28e8ebfaa9517e5f2134bb1c339d294096dca91` | +| Author | Zacgoose | +| Date | 2026-05-26 23:33:43 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippSettings/CippRoleAddEdit.jsx`, `src/components/CippSettings/CippUserManagement.jsx`, `src/pages/cipp/advanced/super-admin/cipp-users.js` + +--- + +### 143. `2f62bae9` — Update CippAuditLogSearchDrawer.jsx + +| Field | Value | +|-------|-------| +| SHA | `2f62bae921c333f7a0b72f78ce02aab8b0980d55` | +| Author | Zacgoose | +| Date | 2026-05-27 00:13:18 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAuditLogSearchDrawer.jsx` + +--- + +### 144. `25f4caed` — feat: add permanent dismissal option for release notes + +| Field | Value | +|-------|-------| +| SHA | `25f4caed93e9c722f359ea7d0f6ea3af75843716` | +| Author | Bobby | +| Date | 2026-05-27 00:37:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | UI | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning; Buckets: UI improvements, Potentially breaking changes | + +**Files:** `src/components/ReleaseNotesDialog.js` + +--- + +### 145. `fe4765e8` — Merge pull request #6059 from kris6673/permaDismiss + +| Field | Value | +|-------|-------| +| SHA | `fe4765e892bdd13c890781d8c9311116da355bf5` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 01:09:02 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 146. `1b7797af` — Update standards.json + +| Field | Value | +|-------|-------| +| SHA | `1b7797afd4f4c55e6a44157a87914daf8110068f` | +| Author | Zacgoose | +| Date | 2026-05-27 16:29:15 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 147. `de70889f` — smart lockout standard + +| Field | Value | +|-------|-------| +| SHA | `de70889fe1c4e157ac25eb1ef43751add88056fa` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 14:39:44 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 148. `0e527e50` — Sharepoint management functionality. + +| Field | Value | +|-------|-------| +| SHA | `0e527e50d858628dbe0943c33c0b67b18949d612` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 17:03:29 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 149. `5709f856` — fix: update terminology from "Temporary Access Password" to "Temporary Access Pass" + +| Field | Value | +|-------|-------| +| SHA | `5709f85661a047dad29216739acccf6326c9231b` | +| Author | Bobby | +| Date | 2026-05-27 17:11:46 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippUserActions.jsx`, `src/data/standards.json` + +--- + +### 150. `4102a13e` — Merge pull request #6064 from kris6673/TAP-typos + +| Field | Value | +|-------|-------| +| SHA | `4102a13e6b58656cf4e29a9f36d3930df7a92fa1` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 18:56:03 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 151. `bf6056ba` — Add version cleanup + +| Field | Value | +|-------|-------| +| SHA | `bf6056baf362471dba4ecbb599e0b1c85091b8d0` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:47 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/pages/teams-share/sharepoint/index.js` + +--- + +### 152. `0abf5523` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `0abf5523a012a07f73982ed92a41a7b5e063e005` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:24:57 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 153. `635548af` — Add version cleanup + +| Field | Value | +|-------|-------| +| SHA | `635548afd1d988518d8c392413828aec7e39eda5` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:25:01 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/pages/teams-share/sharepoint/index.js` + +--- + +### 154. `7a408542` — fix query keys + +| Field | Value | +|-------|-------| +| SHA | `7a40854272a60617d57a28570406953a9cca913c` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:37:02 +0200 | +| Files changed | 4 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** `src/pages/security/compliance/dlp/index.js`, `src/pages/security/compliance/labels/index.js`, `src/pages/security/compliance/retention/index.js`, `src/pages/security/compliance/sit/index.js` + +--- + +### 155. `de035243` — fixes #6065 + +| Field | Value | +|-------|-------| +| SHA | `de035243aa1090ac818cc2d02e651007a90723e1` | +| Author | KelvinTegelaar | +| Date | 2026-05-27 20:59:42 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/user-defaults.js` + +--- + +### 156. `d0f58cbe` — feat(mailboxes): show mailbox and archive size columns + +| Field | Value | +|-------|-------| +| SHA | `d0f58cbebd48dbdeaddfcf3af0f68d7b4320bec8` | +| Author | Bobby | +| Date | 2026-05-27 22:43:01 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/mailboxes/index.js`, `src/utils/get-cipp-formatting.js` + +--- + +### 157. `072416dd` — new autopatch standard + +| Field | Value | +|-------|-------| +| SHA | `072416dd95fb955625d466022ebb4a05847e76e3` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 00:54:29 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 158. `f256c253` — chore(deps): bump react-virtuoso from 4.18.5 to 4.18.7 + +| Field | Value | +|-------|-------| +| SHA | `f256c253bff5710aab52bbcb21d64d2775df27b7` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:38:36 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 159. `8316c600` — chore(deps): bump @react-pdf/renderer from 4.3.2 to 4.5.1 + +| Field | Value | +|-------|-------| +| SHA | `8316c600205322891849d6b211f01c7237971c62` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:38:54 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 160. `49192881` — chore(deps): bump axios from 1.15.0 to 1.16.1 + +| Field | Value | +|-------|-------| +| SHA | `49192881a81a4599d990755b85393a767c16acf8` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:39:08 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 161. `c04cd7c9` — chore(deps): bump @tiptap/extension-heading from 3.20.5 to 3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `c04cd7c9f6d2c487440aa334d6d4f3a8c3773f67` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:39:27 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 162. `0995677d` — chore(deps): bump react-hook-form from 7.72.0 to 7.76.1 + +| Field | Value | +|-------|-------| +| SHA | `0995677d8e4f32b35699ffe220c3b8726f015356` | +| Author | dependabot[bot] | +| Date | 2026-05-28 00:39:39 +0000 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `yarn.lock` + +--- + +### 163. `b8ece5c4` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `b8ece5c448ee814f5400dacaaee9a3590c911cde` | +| Author | Zacgoose | +| Date | 2026-05-28 13:56:39 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 164. `ab8de98d` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `ab8de98d1c4c1ce1c8cd200962f13ebeae1416e6` | +| Author | Zacgoose | +| Date | 2026-05-28 15:21:20 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 165. `ca43bc9e` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `ca43bc9e04e0bc662de24be73466f1b9a18044eb` | +| Author | Zacgoose | +| Date | 2026-05-28 20:51:17 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 166. `7e44aff8` — new auth methods single standard + +| Field | Value | +|-------|-------| +| SHA | `7e44aff88a1ff1fbb29e8d3a9fb9aa5c70c1b504` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:13 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 167. `8306a660` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `8306a660288391bfd031b6f51bc45e7de8aa6dc9` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 15:21:21 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 168. `04f8575c` — Merge pull request #6070 from kris6673/6061 + +| Field | Value | +|-------|-------| +| SHA | `04f8575caa54883b3256e920aa840e45d29cba1f` | +| Author | KelvinTegelaar | +| Date | 2026-05-28 16:21:22 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 169. `605ecd82` — fix: move ADE pages + +| Field | Value | +|-------|-------| +| SHA | `605ecd8272e8e6c5d6eaba7692fa0d3ddb22c745` | +| Author | Bobby | +| Date | 2026-05-28 21:13:05 +0200 | +| Files changed | 6 | +| Risk | **High** | +| Area | Intune | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Intune changes, Potentially breaking changes | + +**Files:** `src/layouts/config.js`, `src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/autopilot/enrollment-profiles/index.js`, `src/pages/endpoint/autopilot/enrollment-profiles/tabOptions.json`, `src/pages/endpoint/autopilot/enrollment-profiles/windows-autopilot.js` + +--- + +### 170. `063550f4` — chore: update tab paths and imports + +| Field | Value | +|-------|-------| +| SHA | `063550f430ee43d716ae24a1e7834d10e2aa3014` | +| Author | Bobby | +| Date | 2026-05-28 21:20:53 +0200 | +| Files changed | 5 | +| Risk | **Medium** | +| Area | Intune | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Intune changes | + +**Files:** `src/pages/endpoint/autopilot/enrollment-profiles/android-enterprise.js`, `src/pages/endpoint/autopilot/enrollment-profiles/apple-ade.js`, `src/pages/endpoint/autopilot/enrollment-profiles/index.js`, `src/pages/endpoint/autopilot/enrollment-profiles/tabOptions.json`, `src/pages/endpoint/autopilot/enrollment-profiles/windows-autopilot.js` + +--- + +### 171. `d0405ff4` — feat: Add icons to the tabs and remove dead tab + +| Field | Value | +|-------|-------| +| SHA | `d0405ff45e5ad572438e007734a93f2b5a3b69f0` | +| Author | Bobby | +| Date | 2026-05-28 22:45:31 +0200 | +| Files changed | 22 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/super-admin/tabOptions.json`, `src/pages/cipp/custom-data/tabOptions.json`, `src/pages/cipp/settings/tabOptions.json`, `src/pages/dashboardv2/tabOptions.json`, `src/pages/email/administration/exchange-retention/tabOptions.json`, `src/pages/endpoint/MEM/devices/device/tabOptions.json`, `src/pages/identity/administration/groups/group/tabOptions.json`, `src/pages/identity/administration/users/user/devices.jsx`, `src/pages/identity/administration/users/user/tabOptions.json`, `src/pages/tenant/administration/alert-configuration/tabOptions.json`, `src/pages/tenant/administration/applications/app-registration/tabOptions.json`, `src/pages/tenant/administration/applications/enterprise-app/tabOptions.json`, `src/pages/tenant/administration/applications/tabOptions.json`, `src/pages/tenant/administration/audit-logs/tabOptions.json`, `src/pages/tenant/administration/securescore/tabOptions.json` … (+7 more) + +--- + +### 172. `707873e3` — fix: Fix tab title showing as undefined + +| Field | Value | +|-------|-------| +| SHA | `707873e31e3b9fae7504dea81643f7bf673a1bef` | +| Author | Bobby | +| Date | 2026-05-28 23:24:30 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/exchange-retention/policies/index.js`, `src/pages/email/administration/exchange-retention/tags/index.js` + +--- + +### 173. `97d77727` — Expose missing standards and allow removal + +| Field | Value | +|-------|-------| +| SHA | `97d77727f602177fbb52643ff24697fe4c394717` | +| Author | Zacgoose | +| Date | 2026-05-29 16:31:56 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippStandards/CippStandardAccordion.jsx` + +--- + +### 174. `c0bfd7df` — Update standards.json + +| Field | Value | +|-------|-------| +| SHA | `c0bfd7df29808523b2ab94847fff8b7736681c43` | +| Author | Zacgoose | +| Date | 2026-05-29 17:43:25 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/standards.json` + +--- + +### 175. `9e44f394` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `9e44f394d5d975b69dcc1a096a101ab27720bcf9` | +| Author | Zacgoose | +| Date | 2026-05-30 22:49:02 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 176. `6737dcb7` — Licence Universal Search + +| Field | Value | +|-------|-------| +| SHA | `6737dcb7df0ad4e21a4edf4979dfc2f30e49510f` | +| Author | Zacgoose | +| Date | 2026-06-02 00:08:49 +0800 | +| Files changed | 6 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippCards/CippUniversalSearchV2.jsx`, `src/components/CippComponents/CippLicenseDetailsDrawer.jsx`, `src/data/M365Licenses.json`, `src/layouts/top-nav.js`, `src/utils/get-cipp-license-catalog.js`, `src/utils/icon-registry.js` + +--- + +### 177. `e2c39b26` — Update M365Licenses.json + +| Field | Value | +|-------|-------| +| SHA | `e2c39b26d95394b3095a28f03e9dccb7a8085afa` | +| Author | Zacgoose | +| Date | 2026-06-02 00:09:49 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/M365Licenses.json` + +--- + +### 178. `3734adee` — Fix template trigger + +| Field | Value | +|-------|-------| +| SHA | `3734adeeaec92e6d83974590c36a9e91bf024a98` | +| Author | KelvinTegelaar | +| Date | 2026-06-01 23:44:55 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/user-defaults.js` + +--- + +### 179. `ee6f501e` — Merge pull request #6079 from kris6673/move-ADE + +| Field | Value | +|-------|-------| +| SHA | `ee6f501eadb0069a8260f61ba175767584cb353b` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:23:58 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 180. `d26084fb` — Merge pull request #6080 from kris6673/icons + +| Field | Value | +|-------|-------| +| SHA | `d26084fb3923e10f615506e3585ae1c7027c4a7d` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 00:24:29 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 181. `49cda6e0` — Update index.js + +| Field | Value | +|-------|-------| +| SHA | `49cda6e0b465ad7bb9a0a259a9ee31a2584e0835` | +| Author | Zacgoose | +| Date | 2026-06-02 07:28:27 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Tenant management changes | + +**Files:** `src/pages/tenant/reports/list-licenses/index.js` + +--- + +### 182. `f1703f04` — Update CippTenantModeDeploy.jsx + +| Field | Value | +|-------|-------| +| SHA | `f1703f041f517d7d07ca35074a89743f1991141f` | +| Author | Zacgoose | +| Date | 2026-06-02 15:15:54 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippWizard/CippTenantModeDeploy.jsx` + +--- + +### 183. `89abbf50` — fix: improve stale issue and close messages for clarity + +| Field | Value | +|-------|-------| +| SHA | `89abbf507b2f96ea9a9238536bd95fe99a1b3b37` | +| Author | Bobby | +| Date | 2026-06-02 19:03:13 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.github/workflows/Close_Stale_Issues.yml` + +--- + +### 184. `069d6d6b` — Merge pull request #6101 from kris6673/stale + +| Field | Value | +|-------|-------| +| SHA | `069d6d6bb070af166c583fb59c224e21f16e6263` | +| Author | KelvinTegelaar | +| Date | 2026-06-02 23:40:55 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 185. `d4570de5` — Update CippReportToolbar.jsx + +| Field | Value | +|-------|-------| +| SHA | `d4570de5058eba87c7f9e122a39d41bdedbc401c` | +| Author | Zacgoose | +| Date | 2026-06-03 07:10:49 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippReportToolbar.jsx` + +--- + +### 186. `cbd6faef` — Correct report builder permissions + +| Field | Value | +|-------|-------| +| SHA | `cbd6faefb184a7ee611063726862d2663bb56d4b` | +| Author | Zacgoose | +| Date | 2026-06-03 13:15:25 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/tools/report-builder/builder/index.js`, `src/pages/tools/report-builder/view/index.js` + +--- + +### 187. `4d88e456` — Update CippAutocomplete.jsx + +| Field | Value | +|-------|-------| +| SHA | `4d88e456cf5e581dbbd30cc6e348059e410d7f9c` | +| Author | Zacgoose | +| Date | 2026-06-03 14:49:31 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAutocomplete.jsx` + +--- + +### 188. `51d2828b` — add mcp allowed + +| Field | Value | +|-------|-------| +| SHA | `51d2828b77990f8a3d017d69206c7b0a3df0f832` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 13:37:01 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippIntegrations/CippApiClientManagement.jsx` + +--- + +### 189. `e4009f28` — feat: add Email as alternate login ID standard + +| Field | Value | +|-------|-------| +| SHA | `e4009f28e0aeb0f338cfeeed606b24fec26b05b7` | +| Author | Bobby | +| Date | 2026-06-03 16:54:12 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 190. `38ac0c4a` — MCP warning + +| Field | Value | +|-------|-------| +| SHA | `38ac0c4a46f6c1e5f405bd429bae7accd43a1917` | +| Author | KelvinTegelaar | +| Date | 2026-06-03 19:25:42 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormComponent.jsx`, `src/components/CippIntegrations/CippApiClientManagement.jsx` + +--- + +### 191. `b2f8f803` — feat: add actions for managing mailbox client access protocols + +| Field | Value | +|-------|-------| +| SHA | `b2f8f80372d5c6a28ef57ea373708cd3287f3a8a` | +| Author | Bobby | +| Date | 2026-06-03 19:24:53 +0200 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/email/reports/mailbox-cas-settings/index.js` + +--- + +### 192. `692c67d6` — fix: quarantine deny action + +| Field | Value | +|-------|-------| +| SHA | `692c67d6451811f01fdcd7fd021a9b9273efd233` | +| Author | John Duprey | +| Date | 2026-06-03 21:33:18 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/quarantine/index.js` + +--- + +### 193. `a8048476` — Exclude partner tenant + +| Field | Value | +|-------|-------| +| SHA | `a80484765aea42b43c1e663d0a9a9295f3795ad9` | +| Author | Zacgoose | +| Date | 2026-06-04 16:03:41 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippAddEditTenantGroups.jsx`, `src/pages/tenant/administration/tenants/groups/edit.js` + +--- + +### 194. `72623261` — add excludeFromAlert to licenses. + +| Field | Value | +|-------|-------| +| SHA | `726232611922cf2c302a7e77254ba881e074f4d8` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:21:35 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/settings/licenses.js` + +--- + +### 195. `a04ed1a6` — Merge pull request #6049 from luimen6/feat/group-license-management + +| Field | Value | +|-------|-------| +| SHA | `a04ed1a6e283f55ccaedcd6214a65ad51633077f` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:24:44 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** (none) + +--- + +### 196. `cf30b4b1` — add excluded from alerts to licenses + +| Field | Value | +|-------|-------| +| SHA | `cf30b4b19c0feee4b4429777e51b1c06720d51c0` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:25:03 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/settings/licenses.js` + +--- + +### 197. `11ecd334` — remove unneeded results key + +| Field | Value | +|-------|-------| +| SHA | `11ecd3342338bf46f214a62137d6ad4482410ab3` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:25:26 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Standards/Alignment Custom; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippFormLicenseSelector.jsx` + +--- + +### 198. `a9ed024d` — Merge pull request #6110 from kris6673/CAS-stuffs + +| Field | Value | +|-------|-------| +| SHA | `a9ed024df2737538eedb25ba3d727be386727c10` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:36:45 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 199. `02db7307` — Merge pull request #6106 from kris6673/EmailAsAlternateLoginId + +| Field | Value | +|-------|-------| +| SHA | `02db7307dde8a9ed0e01e0d2a7b8badc7b31c0ed` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 12:37:08 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 200. `3daf8b33` — Add named location editing to CA template editor + +| Field | Value | +|-------|-------| +| SHA | `3daf8b33cad3a4c9df81c87703758cab2d3150aa` | +| Author | Zacgoose | +| Date | 2026-06-04 20:49:15 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippCAPolicyBuilder.jsx`, `src/pages/tenant/conditional/list-template/create.jsx`, `src/pages/tenant/conditional/list-template/edit.jsx` + +--- + +### 201. `c0f8e990` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `c0f8e990e3680d80aa121bfbe0ceaff829dcdcec` | +| Author | Zacgoose | +| Date | 2026-06-04 20:49:18 +0800 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 202. `0b4c3314` — Make breadcrumb text and > selectable/copyable + +| Field | Value | +|-------|-------| +| SHA | `0b4c331444ef004e841ac1c1ba66d5974d1aab5e` | +| Author | Zacgoose | +| Date | 2026-06-04 23:28:04 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Navigation/Menu; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CippBreadcrumbNav.jsx` + +--- + +### 203. `b7c051fa` — Auth changes to use sedndmessage + +| Field | Value | +|-------|-------| +| SHA | `b7c051fa865a06eaf3747be60635740f4837c4ac` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 21:52:25 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CIPPM365OAuthButton.jsx`, `src/pages/authredirect.js` + +--- + +### 204. `67039061` — Auth changes to use sedndmessage + +| Field | Value | +|-------|-------| +| SHA | `67039061cb901709c0cd35b2baa1fca1026cdc1e` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 21:52:28 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/authredirect.js` + +--- + +### 205. `eb16c27a` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `eb16c27aa32198ea5e6e9287860c7f3f84946969` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 21:52:30 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 206. `5b09ef32` — fix: add popup grace period + +| Field | Value | +|-------|-------| +| SHA | `5b09ef3264fef015af58826d1977c75e1960190f` | +| Author | John Duprey | +| Date | 2026-06-04 16:55:52 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CIPPM365OAuthButton.jsx` + +--- + +### 207. `ffefbbb3` — Use broadcast channel + +| Field | Value | +|-------|-------| +| SHA | `ffefbbb337754727297ecec9be79e1e7b16a4b32` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 23:24:15 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning, Permissions/Roles/Auth; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/CIPPM365OAuthButton.jsx`, `src/pages/authredirect.js` + +--- + +### 208. `4ed6ba02` — Merge branch 'dev' of https://github.com/KelvinTegelaar/CIPP into dev + +| Field | Value | +|-------|-------| +| SHA | `4ed6ba02a3ff4f510313e1b9926f3b5012e11393` | +| Author | KelvinTegelaar | +| Date | 2026-06-04 23:25:34 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 209. `0a8252e3` — fix: version encoding + +| Field | Value | +|-------|-------| +| SHA | `0a8252e3a2a954a734f58637179e7eed91dcb16c` | +| Author | John Duprey | +| Date | 2026-06-04 20:15:21 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Manage365 Branding/Versioning; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippSettings/CippVersionProperties.jsx` + +--- + +### 210. `c8d61c07` — fix: JIT admin, remove creatable on autocomplete + +| Field | Value | +|-------|-------| +| SHA | `c8d61c0757853359cde98f9a00e6e3ba6fe6e98e` | +| Author | John Duprey | +| Date | 2026-06-04 23:13:18 -0400 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Bugfix | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Bug fixes | + +**Files:** `src/pages/identity/administration/jit-admin/add.jsx` + +--- + +### 211. `98a96fcb` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `98a96fcbcf72717d266c53eeaca45ab4a074b28a` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:15 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Cherry-pick with adaptation** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js`, `src/pages/tenant/manage/policies-deployed.js` + +--- + +### 212. `a4aac4a1` — CA expansion for tags + +| Field | Value | +|-------|-------| +| SHA | `a4aac4a128a847a5af059c4edc73f66af7014a60` | +| Author | KelvinTegelaar | +| Date | 2026-06-05 13:17:18 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js` + +--- + +### 213. `7b0c8699` — Update SsoMigrationDialog.jsx + +| Field | Value | +|-------|-------| +| SHA | `7b0c86990e1e5765992c31ad0650d1c63fcf7917` | +| Author | Zacgoose | +| Date | 2026-06-05 22:11:18 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/SsoMigrationDialog.jsx` + +--- + +### 214. `8ae6ad1f` — typo + +| Field | Value | +|-------|-------| +| SHA | `8ae6ad1fae73702c180047ba374b491542dc0b4d` | +| Author | Zacgoose | +| Date | 2026-06-05 22:19:13 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/ForcedSsoMigrationDialog.jsx`, `src/components/CippComponents/SsoMigrationDialog.jsx` + +--- + +### 215. `c15d1d0d` — fix: sherweb integration conditional fields + +| Field | Value | +|-------|-------| +| SHA | `c15d1d0df12c5aef9bd1d301a255ef5224c05f7d` | +| Author | John Duprey | +| Date | 2026-06-05 10:41:56 -0400 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Security | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Security fixes | + +**Files:** `src/data/Extensions.json` + +--- + +### 216. `6c968c4b` — fix: bad math + +| Field | Value | +|-------|-------| +| SHA | `6c968c4bd3eb95439caf2c669e63bc7f1dd2fdd7` | +| Author | John Duprey | +| Date | 2026-06-05 14:36:10 -0400 | +| Files changed | 1 | +| Risk | **High** | +| Area | Tenant | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Tenant Workflows; Buckets: Tenant management changes, Potentially breaking changes | + +**Files:** `src/pages/tenant/manage/applied-standards.js` + +--- + +### 217. `e90b0ff9` — renumber for cis7 + +| Field | Value | +|-------|-------| +| SHA | `e90b0ff971de99d70d5ee1e10a98c183dc1f97e7` | +| Author | KelvinTegelaar | +| Date | 2026-06-06 00:46:30 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/data/standards.json` + +--- + +### 218. `4c2843c7` — more secure pipeline configuration + +| Field | Value | +|-------|-------| +| SHA | `4c2843c74331a4af685b700ab82f20b4cdbe33b7` | +| Author | Zacgoose | +| Date | 2026-06-07 13:24:08 +0800 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `.npmrc`, `.yarnrc` + +--- + +### 219. `55e8eef2` — Update worker-health.js + +| Field | Value | +|-------|-------| +| SHA | `55e8eef2399713f966791554ee214f928cb72f81` | +| Author | Zacgoose | +| Date | 2026-06-07 15:06:59 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/pages/cipp/advanced/worker-health.js` + +--- + +### 220. `4c0c058f` — Update alerts.json + +| Field | Value | +|-------|-------| +| SHA | `4c0c058f42dcd7cdb23fb83d64df0884a38493c4` | +| Author | Zacgoose | +| Date | 2026-06-08 13:28:09 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/data/alerts.json` + +--- + +### 221. `4df01a60` — Update unauthenticated.js + +| Field | Value | +|-------|-------| +| SHA | `4df01a60857ef84b8cf7085ddc1684aabc135767` | +| Author | Zacgoose | +| Date | 2026-06-08 14:16:54 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Auth | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Permissions/Roles/Auth; Buckets: Authentication/permissions changes, Potentially breaking changes | + +**Files:** `src/pages/unauthenticated.js` + +--- + +### 222. `9c82a214` — 10.5.0 version up + +| Field | Value | +|-------|-------| +| SHA | `9c82a214263d290a46901fb7f4e804b4bfb573b5` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 11:32:48 +0200 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 223. `03048445` — Merge branch 'main' into dev + +| Field | Value | +|-------|-------| +| SHA | `03048445fc6037f0436363b7cec15ca3baacb7c9` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 12:01:22 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 224. `4521af9d` — Merge pull request #6129 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `4521af9d115e4552f1eafabb94d604bb87415843` | +| Author | KelvinTegelaar | +| Date | 2026-06-08 14:25:04 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 225. `580b66f9` — repair and fix failed SSO app creations and password addition failures + +| Field | Value | +|-------|-------| +| SHA | `580b66f91e2d658e81516e6a7f298fd9688e544c` | +| Author | Zacgoose | +| Date | 2026-06-09 01:03:26 +0800 | +| Files changed | 3 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippComponents/ForcedSsoMigrationDialog.jsx`, `src/components/CippComponents/SsoMigrationDialog.jsx`, `src/components/CippSettings/CippSSOSettings.jsx` + +--- + +### 226. `1ea0324e` — fix: ensure search happens when data is done loading + +| Field | Value | +|-------|-------| +| SHA | `1ea0324e5fe184ba493501e49657910bc21999de` | +| Author | Bobby | +| Date | 2026-06-08 22:56:55 +0200 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippTable/CippDataTable.js` + +--- + +### 227. `0de0910a` — Merge pull request #6132 from kris6673/tables-search + +| Field | Value | +|-------|-------| +| SHA | `0de0910aa769c348e33ac520c72d84e3587f48f9` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 00:12:03 +0200 | +| Files changed | 0 | +| Risk | **Low** | +| Area | UI | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: UI improvements | + +**Files:** (none) + +--- + +### 228. `cfbf3508` — Removed dublicate appliesToTest key + +| Field | Value | +|-------|-------| +| SHA | `cfbf3508e1ede8b51ef6daff780356ea0379f083` | +| Author | JNRavnIT | +| Date | 2026-06-09 10:19:54 +0200 | +| Files changed | 1 | +| Risk | **Low** | +| Area | Tests | +| Recommendation | **Cherry-pick** | +| Conflict likelihood | Low | +| Notes | Buckets: Tests-only | + +**Files:** `src/data/standards.json` + +--- + +### 229. `8cfb8ca0` — Merge pull request #6138 from JNRavnIT/patch-1 + +| Field | Value | +|-------|-------| +| SHA | `8cfb8ca077a920d42556858d1aabe692c1d39748` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 10:24:55 +0200 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 230. `7ea75e76` — Merge pull request #6072 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-pdf/renderer-4.5.1 + +| Field | Value | +|-------|-------| +| SHA | `7ea75e76a5f2efa8332d22ecbad4507613992930` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:20:20 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 231. `f1475e8e` — Merge pull request #6073 from KelvinTegelaar/dependabot/npm_and_yarn/dev/axios-1.16.1 + +| Field | Value | +|-------|-------| +| SHA | `f1475e8e43f1880a34ffb9e4f6bd80838aa9c0ad` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:20:38 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 232. `87d543d4` — Merge pull request #6075 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-hook-form-7.76.1 + +| Field | Value | +|-------|-------| +| SHA | `87d543d43a3881aac46dd99bf4cfb4b4e5acabe2` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:21:07 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 233. `e53ab04d` — Merge pull request #6074 from KelvinTegelaar/dependabot/npm_and_yarn/dev/tiptap/extension-heading-3.22.3 + +| Field | Value | +|-------|-------| +| SHA | `e53ab04dd4d8a93d8fa0983d223c4fb5346207cd` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:21:27 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 234. `91bb02b4` — Merge pull request #6071 from KelvinTegelaar/dependabot/npm_and_yarn/dev/react-virtuoso-4.18.7 + +| Field | Value | +|-------|-------| +| SHA | `91bb02b41faf27a0d586b92a0a7b1abc53540934` | +| Author | KelvinTegelaar | +| Date | 2026-06-09 14:21:35 +0200 | +| Files changed | 0 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** (none) + +--- + +### 235. `ae695a9f` — Update CippAddEditUser.jsx + +| Field | Value | +|-------|-------| +| SHA | `ae695a9f3a1bec6b275b4dbcf4d1cc77abc1a8eb` | +| Author | Zacgoose | +| Date | 2026-06-09 21:48:31 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Build | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `src/components/CippFormPages/CippAddEditUser.jsx` + +--- + +### 236. `0e10e08e` — Update index.js + +| Field | Value | +|-------|-------| +| SHA | `0e10e08eb1826be1912569a3dd6e5e979c3da273` | +| Author | Zacgoose | +| Date | 2026-06-09 21:53:36 +0800 | +| Files changed | 1 | +| Risk | **Medium** | +| Area | Teams | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** `src/pages/teams-share/sharepoint/index.js` + +--- + +### 237. `6a2e7b31` — chore: bump version to 10.5.1 + +| Field | Value | +|-------|-------| +| SHA | `6a2e7b31d1312e0f51f99f2f65b9ae32a5629304` | +| Author | John Duprey | +| Date | 2026-06-09 10:35:24 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 238. `f4448a56` — Merge pull request #6140 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `f4448a56afe9cbbe295450db33698864655359eb` | +| Author | John Duprey | +| Date | 2026-06-09 10:42:04 -0400 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- + +### 239. `a4c56b26` — manual pagination support for Invoke-ListMailQuarantine + +| Field | Value | +|-------|-------| +| SHA | `a4c56b26accd9374cc739dcc46934624fb5d1089` | +| Author | Zacgoose | +| Date | 2026-06-10 22:49:57 +0800 | +| Files changed | 1 | +| Risk | **High** | +| Area | Email | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Custom overlap: Quarantine Portal; Buckets: Exchange/Email changes, Potentially breaking changes | + +**Files:** `src/pages/email/administration/quarantine/index.js` + +--- + +### 240. `e0b0bdb8` — chore: bump version to 10.5.2 + +| Field | Value | +|-------|-------| +| SHA | `e0b0bdb85c9161edce9fa50263682b7a42ed1b44` | +| Author | John Duprey | +| Date | 2026-06-10 17:02:44 -0400 | +| Files changed | 2 | +| Risk | **High** | +| Area | Dependencies | +| Recommendation | **Needs manual review** | +| Conflict likelihood | High | +| Notes | Buckets: Dependency/build changes, Potentially breaking changes | + +**Files:** `package.json`, `public/version.json` + +--- + +### 241. `0d8ca9d2` — Merge pull request #6153 from KelvinTegelaar/dev + +| Field | Value | +|-------|-------| +| SHA | `0d8ca9d2f5f8511413b69a3064e055ac45024f33` | +| Author | John Duprey | +| Date | 2026-06-10 17:32:21 -0400 | +| Files changed | 0 | +| Risk | **Medium** | +| Area | Other | +| Recommendation | **Needs manual review** | +| Conflict likelihood | Medium | +| Notes | Buckets: Other | + +**Files:** (none) + +--- diff --git a/docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md b/docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md new file mode 100644 index 0000000000..689502c542 --- /dev/null +++ b/docs/upstream-sync/history-cipp/USERACTIONS_NESTEDGROUPS_INTAKE_20260715.md @@ -0,0 +1,65 @@ +# UserActions + Nested Group Memberships Intake — 2026-07-15 + +Feature intake batching two related upstream families that touch the identity-administration +surface. Fork frontend version bumped **5.21.0 → 5.22.0**. + +## Upstream commits taken + +| Commit | Summary | How it landed | +|---|---|---| +| `01cff98d1` | TAP generation: policy-aware form, error when TAP disabled | Merged into fork `CippUserActions.jsx` | +| `af1fe13ff` | Sign-in state: pre-select current, block no-op submit | Merged (radio validator row passthrough + action) | +| `22f153f48` | Source of authority: pre-select current state | Merged into user SOA action | +| `f66e74a07` | SOA refinements: hide when meaningless (users/groups/contacts) | Merged across 4 files | +| `456662835` | Add/remove nested groups in group memberships | Adapted to fork's redesigned edit page | +| `1e60e5f2b` | Missing dependency fix + label | Superseded by adaptation (labels included) | + +## Frontend (CIPP) + +- **`CippFormComponent.jsx`**: radio fields now pass the data `row` as the third argument to + custom `validate` functions (same contract autoComplete fields already had). +- **`CippUserActions.jsx`** (fork-customized hook — surgical merge): + - **Create Temporary Access Pass** now renders a `TemporaryAccessPassForm` child that queries + the tenant's TAP authentication-method policy: shows an error alert (with re-check button + and link to Authentication Methods) when TAP is disabled, validates lifetime against the + policy's min/max, and forces + locks the one-time-use switch when the policy enforces it. + Fork's `canWriteUser` condition, category, and quickAction flags preserved. + - **Set Sign In State** pre-selects the current state (blank when the selection has mixed + states) and rejects submitting an unchanged state. + - **Set Source of Authority** pre-selects the current state, rejects no-op submissions, and + is now hidden for cloud-native users (shown only when on-prem synced now or previously). +- **`groups/index.js`, `groups/group/index.jsx`, `contacts/index.js`**: same SOA + pre-select/no-op-guard treatment. Groups hide the action unless + `onPremisesSyncEnabled`/`onPremisesSamAccountName`; contacts require a `graphId` (cloud-native + mail contacts have no Graph counterpart). +- **`CippApiDialog.jsx`**: fork's "Add Another" button now evaluates function-form + `defaultvalues(row)` on reset (fork-only fix; the main reset paths already did). +- **`CippFormUserAndGroupSelector.jsx`**: adopted upstream wholesale (group-type labels + instead of a Users/Groups groupBy; no fork customizations existed). +- **`groups/edit.jsx`** (fork's redesigned page — adapted, not replaced): upstream changed its + AddMember autocomplete; the fork uses an Add Member dialog + members table instead, so the + equivalent was applied to that design: + - New `memberPickerField` backed by `/api/ListUsersAndGroups` with upstream's group-type + labels — the Add Member dialog can now add **nested groups** as members. The Add Owner + dialog keeps the users-only picker. + - Members table's Email column shows the group type for nested-group rows (no UPN). + - `EditGroup` API already binds members via `directoryObjects/{id}`, which accepts groups — + no API change needed for add/remove. + +## API (CIPP-API) + +- **`Invoke-ListUsersAndGroups.ps1`** (both `CIPPHTTP` and `CIPPCore` copies, kept in sync): + adopted upstream — groups now return `mailEnabled`/`securityEnabled`/`groupTypes`, exclude + Unified (M365) groups, and normalize `userPrincipalName`/`@odata.type` so pickers can + distinguish users from groups. + +## Verification + +- All changed files lint-clean; `yarn build` passes (63s). +- `Invoke-ListUsersAndGroups.ps1` passes PowerShell parser validation; both copies identical. +- Backup tags: `backup/pre-useractions-intake-20260715` in both repos. + +## Notes + +- `ExecCreateTAP`, `ExecDisableUser`, `ExecSetCloudManaged` endpoints already existed in the + fork and needed no changes; the TAP policy query goes through `ListGraphRequest`. diff --git a/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md new file mode 100644 index 0000000000..922e3deee7 --- /dev/null +++ b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_20260617.md @@ -0,0 +1,73 @@ +# UserReportedPhishing — Frontend Enablement + +Generated: 2026-06-17 +Branch: `manage365/userreportedphishing-frontend-20260617` +Backup tag: `backup/pre-userreportedphishing-frontend-20260617` +Base: `main` + +## Prerequisites (completed before this PR) + +| Gate | Status | +|------|--------| +| CIPP-API PR #2 merged | Yes — https://github.com/Celeratec/CIPP-API/pull/2 | +| Backend handler | `Get-CIPPAlertUserReportedPhishing` on CIPP-API `master` | +| SAM manifest | `ThreatSubmission.ReadWrite.All` in Config + lib/data SAM manifests | +| SAM/CPV/consent validation | Completed | +| Backend smoke test | Clean | + +## Upstream Commit + +| Field | Value | +|-------|--------| +| SHA | `7054bfc42` (short: `7054bfc4`) | +| Title | Add AlertUserReportPhising | +| Author | KelvinTegelaar | +| Date | 2026-05-12 | + +## Pre-Apply Verification + +`git show --stat 7054bfc4` — 1 file, 15 insertions: + +- `src/data/alerts.json` only + +No auth, tenant switching, quarantine, Email Troubleshooter, navigation, package/build, or API helper files touched. + +## Apply Result + +| Status | Detail | +|--------|--------| +| **Applied cleanly** | Cherry-pick `-x` succeeded with no conflicts | + +Previously deferred in Cycle 1 sync (`de565d5f9` → reverted `b0fcc3129`); now unblocked after API rollout validation. + +## Files Changed + +| File | Change | +|------|--------| +| `src/data/alerts.json` | Added `UserReportedPhishing` alert definition (+15 lines) | +| `docs/upstream-sync/USERREPORTEDPHISHING_FRONTEND_20260617.md` | This tracking doc | + +## Alert Definition Validation + +| Check | Result | +|-------|--------| +| JSON parses | Pass | +| Alert name/key | `UserReportedPhishing` | +| Backend handler resolution | `Get-CIPPAlertUserReportedPhishing` (via `Push-SchedulerAlert` naming) | +| `HoursBack` input | Present (`inputType: number`, `inputName: HoursBack`) | +| `recommendedRunInterval` | `4h` | +| Typo / handler mismatch | None | +| Other alerts modified | **No** — append-only entry at end of array | + +## Rollout Note + +This PR **exposes** the alert in the frontend catalog only. After merge: + +- Enable `UserReportedPhishing` in **SchedulerConfig / tenant alert settings in a controlled manner** (one test tenant first, then broader rollout). +- Do not bulk-enable globally without operator review. +- Requires `ThreatSubmission.ReadWrite.All` granted on CIPP service principal in each tenant where enabled. + +## Related Docs + +- CIPP-API: `USERREPORTEDPHISHING_API_20260617.md`, `USERREPORTEDPHISHING_POST_MERGE_20260617.md`, `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md` +- Prior deferral: `APPLIED_COMMITS_CIPP_20260617.md` (row for `7054bfc4`) diff --git a/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md new file mode 100644 index 0000000000..65226427e5 --- /dev/null +++ b/docs/upstream-sync/history-cipp/USERREPORTEDPHISHING_FRONTEND_POST_MERGE_20260617.md @@ -0,0 +1,64 @@ +# UserReportedPhishing — Frontend Post-Merge Status + +Generated: 2026-06-17 +Repo: Celeratec/CIPP +Main tip: `7050757b2` + +## Merge Summary + +| Field | Value | +|-------|--------| +| **PR** | https://github.com/Celeratec/CIPP/pull/9 | +| **Merge commit** | `7050757b2` | +| **Feature commit** | `5b3ef362c` | +| **Title** | Expose user reported phishing alert | +| **Backup tag (retained)** | `backup/pre-userreportedphishing-frontend-20260617` → pre-PR `main` | + +## Files Changed (PR #9) + +| File | Change | +|------|--------| +| `src/data/alerts.json` | Added `UserReportedPhishing` alert definition (+15 lines) | +| `docs/upstream-sync/USERREPORTEDPHISHING_FRONTEND_20260617.md` | Import/enablement tracking doc | + +## Validation Summary + +| Check | Result | +|-------|--------| +| PR scope | 2 files only — `alerts.json` + tracking doc | +| `alerts.json` valid JSON | Pass | +| Alert name | `UserReportedPhishing` (maps to `Get-CIPPAlertUserReportedPhishing`) | +| `HoursBack` input | Present | +| `recommendedRunInterval` | `4h` | +| Other alerts modified | **No** — append-only | +| Upstream commit | `7054bfc4` cherry-picked cleanly | + +## Backend Dependency + +Satisfied by **CIPP-API PR #2** (merged): + +- https://github.com/Celeratec/CIPP-API/pull/2 +- Handler: `Get-CIPPAlertUserReportedPhishing` +- Permission: `ThreatSubmission.ReadWrite.All` (`d72bdbf4-a59b-405c-8b04-5995895819ac`) +- SAM/CPV/consent validated and backend smoke test clean **before** frontend PR #9 merged + +## Deployment Requirement + +Deploy **CIPP `main`** (includes PR #9) alongside **CIPP-API `master`** (includes PR #2). Frontend alert catalog entries have no effect until both are deployed to the target environment. + +## Operational Gate (remaining) + +**First-tenant production enablement not performed yet.** + +Before broader rollout: + +1. Deploy paired CIPP + CIPP-API to target environment (if not already). +2. Enable `UserReportedPhishing` in SchedulerConfig / tenant alert settings for **one test tenant first**. +3. Use **`HoursBack: 24`** for initial run. +4. Validate scheduler invokes `Get-CIPPAlertUserReportedPhishing` and produces expected trace (or clean no-op when no submissions). +5. **Do not bulk-enable globally** until one clean scheduler run is documented. + +## Related Docs + +- Import: `docs/upstream-sync/USERREPORTEDPHISHING_FRONTEND_20260617.md` +- CIPP-API: `USERREPORTEDPHISHING_API_20260617.md`, `USERREPORTEDPHISHING_POST_MERGE_20260617.md`, `USERREPORTEDPHISHING_ROLLOUT_RUNBOOK_20260617.md`, `USERREPORTEDPHISHING_FINAL_STATUS_20260617.md` From 5d9f17d5c754196bd8f32aff358abce52e39001b Mon Sep 17 00:00:00 2001 From: Clint Thomon Date: Sat, 15 Aug 2026 14:01:10 -0500 Subject: [PATCH 02/30] =?UTF-8?q?feat(branding):=20Manage365=20identity=20?= =?UTF-8?q?=E2=80=94=20logos,=20icons,=20theme,=20titles,=20dual=20version?= =?UTF-8?q?ing?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Ports the Manage365 brand from the Celeratec/CIPP fork onto the monorepo: cerulean palette + Material Design light/dark themes, Manage365 logo and favicon set, app titles/manifest, dual version tracking (manage365-version.json v6.0.0 / upstream baseline 10.8.5) with the fork's version properties card, GetVersion CleanupStale support, branding default colour #007BA7, and product docs (README/PRODUCT/DESIGN). --- DESIGN.json | 266 +++++++ DESIGN.md | 254 +++++++ PRODUCT.md | 44 ++ README.md | 669 +++++++++++++++++- .../CIPP/Core/Invoke-GetVersion.ps1 | 28 + frontend/public/Main logo -CMYK.png | Bin 0 -> 99166 bytes frontend/public/android-chrome-192x192.png | Bin 11919 -> 15928 bytes frontend/public/android-chrome-512x512.png | Bin 33773 -> 37992 bytes .../apple-touch-icon-120x120-precomposed.png | Bin 4844 -> 10051 bytes frontend/public/apple-touch-icon-120x120.png | Bin 4135 -> 11826 bytes .../apple-touch-icon-152x152-precomposed.png | Bin 6050 -> 11739 bytes frontend/public/apple-touch-icon-152x152.png | Bin 5133 -> 13306 bytes .../apple-touch-icon-180x180-precomposed.png | Bin 7140 -> 12531 bytes frontend/public/apple-touch-icon-180x180.png | Bin 6074 -> 14487 bytes .../apple-touch-icon-60x60-precomposed.png | Bin 2678 -> 5483 bytes frontend/public/apple-touch-icon-60x60.png | Bin 2336 -> 7849 bytes .../apple-touch-icon-76x76-precomposed.png | Bin 3269 -> 6515 bytes frontend/public/apple-touch-icon-76x76.png | Bin 2795 -> 8741 bytes .../public/apple-touch-icon-precomposed.png | Bin 7140 -> 12531 bytes frontend/public/apple-touch-icon.png | Bin 11446 -> 17314 bytes frontend/public/favicon-16x16.png | Bin 991 -> 2281 bytes frontend/public/favicon-32x32.png | Bin 1877 -> 3266 bytes frontend/public/favicon.ico | Bin 15406 -> 4286 bytes frontend/public/logo.png | Bin 16372 -> 104640 bytes frontend/public/manage365-version.json | 4 + frontend/public/manifest.json | 4 +- .../CippSettings/CippBrandingSettings.jsx | 6 +- .../CippSettings/CippVersionProperties.jsx | 390 ++++++++-- frontend/src/components/logo.js | 20 +- frontend/src/pages/_app.js | 4 +- frontend/src/pages/_document.js | 4 +- frontend/src/theme/colors.js | 61 +- frontend/src/theme/dark/create-components.js | 38 +- frontend/src/theme/dark/create-palette.js | 27 +- frontend/src/theme/index.js | 7 +- frontend/src/theme/light/create-components.js | 39 +- frontend/src/theme/light/create-palette.js | 28 +- frontend/src/theme/utils.js | 34 +- 38 files changed, 1789 insertions(+), 138 deletions(-) create mode 100644 DESIGN.json create mode 100644 DESIGN.md create mode 100644 PRODUCT.md create mode 100644 frontend/public/Main logo -CMYK.png create mode 100644 frontend/public/manage365-version.json diff --git a/DESIGN.json b/DESIGN.json new file mode 100644 index 0000000000..237e341fb0 --- /dev/null +++ b/DESIGN.json @@ -0,0 +1,266 @@ +{ + "schemaVersion": 2, + "generatedAt": "2026-05-09T17:54:00Z", + "title": "Design System: Manage365", + "extensions": { + "colorMeta": { + "dashboard-blue": { + "role": "primary", + "displayName": "Dashboard Blue", + "canonical": "oklch(70% 0.11 230)", + "tonalRamp": [ + "oklch(20% 0.08 230)", + "oklch(30% 0.09 230)", + "oklch(40% 0.10 230)", + "oklch(50% 0.11 230)", + "oklch(60% 0.11 230)", + "oklch(70% 0.11 230)", + "oklch(80% 0.09 230)", + "oklch(90% 0.05 230)" + ] + }, + "success": { + "role": "semantic", + "displayName": "Teal Success", + "canonical": "oklch(72% 0.08 185)", + "tonalRamp": [ + "oklch(25% 0.06 185)", + "oklch(35% 0.07 185)", + "oklch(45% 0.08 185)", + "oklch(55% 0.08 185)", + "oklch(65% 0.08 185)", + "oklch(72% 0.08 185)", + "oklch(82% 0.06 185)", + "oklch(92% 0.03 185)" + ] + }, + "error": { + "role": "semantic", + "displayName": "Muted Rose Error", + "canonical": "oklch(72% 0.10 15)", + "tonalRamp": [ + "oklch(25% 0.08 15)", + "oklch(35% 0.09 15)", + "oklch(45% 0.10 15)", + "oklch(55% 0.10 15)", + "oklch(65% 0.10 15)", + "oklch(72% 0.10 15)", + "oklch(82% 0.07 15)", + "oklch(92% 0.04 15)" + ] + }, + "warning": { + "role": "semantic", + "displayName": "Mint Warning", + "canonical": "oklch(78% 0.12 145)", + "tonalRamp": [ + "oklch(25% 0.08 145)", + "oklch(35% 0.10 145)", + "oklch(45% 0.11 145)", + "oklch(55% 0.12 145)", + "oklch(65% 0.12 145)", + "oklch(78% 0.12 145)", + "oklch(85% 0.08 145)", + "oklch(92% 0.04 145)" + ] + }, + "neutral-900": { + "role": "neutral", + "displayName": "Near Black", + "canonical": "oklch(20% 0 0)", + "tonalRamp": [ + "oklch(20% 0 0)", + "oklch(30% 0 0)", + "oklch(40% 0 0)", + "oklch(50% 0 0)", + "oklch(60% 0 0)", + "oklch(70% 0 0)", + "oklch(85% 0 0)", + "oklch(97% 0 0)" + ] + } + }, + "typographyMeta": { + "display": { + "displayName": "Display", + "purpose": "Page titles, dashboard heroes. Rare." + }, + "headline": { + "displayName": "Headline", + "purpose": "Section headers, modal titles." + }, + "title": { + "displayName": "Title", + "purpose": "Card headers, panel titles." + }, + "body": { + "displayName": "Body", + "purpose": "Primary content, table cells, descriptions. Max line length 75ch." + }, + "label": { + "displayName": "Label", + "purpose": "Form labels, chip text, metadata." + } + }, + "shadows": [ + { + "name": "level-1", + "value": "0px 1px 2px rgba(0, 0, 0, 0.24)", + "purpose": "Subtle lift. Buttons at rest, chips." + }, + { + "name": "level-4", + "value": "0px 1px 5px rgba(0, 0, 0, 0.24)", + "purpose": "Cards on surfaces. Gentle separation." + }, + { + "name": "level-8", + "value": "0px 4px 6px rgba(0, 0, 0, 0.24)", + "purpose": "Dropdown menus, tooltips. Clear float." + }, + { + "name": "level-16", + "value": "0px 10px 15px rgba(0, 0, 0, 0.24)", + "purpose": "Modals, dialogs. Prominent overlay." + }, + { + "name": "level-24", + "value": "0px 25px 50px rgba(0, 0, 0, 0.24)", + "purpose": "Large modals, full-screen overlays." + } + ], + "motion": [ + { + "name": "ease-standard", + "value": "cubic-bezier(0.4, 0, 0.2, 1)", + "purpose": "Default easing for state transitions." + }, + { + "name": "ease-out-quart", + "value": "cubic-bezier(0.25, 1, 0.5, 1)", + "purpose": "Exits and settling animations." + }, + { + "name": "duration-fast", + "value": "150ms", + "purpose": "Hover states, micro-interactions." + }, + { + "name": "duration-normal", + "value": "250ms", + "purpose": "Page transitions, modal opens." + } + ], + "breakpoints": [ + { "name": "xs", "value": "0px" }, + { "name": "sm", "value": "600px" }, + { "name": "md", "value": "900px" }, + { "name": "lg", "value": "1200px" }, + { "name": "xl", "value": "1536px" } + ] + }, + "components": [ + { + "name": "Primary Button", + "kind": "button", + "refersTo": "button-primary", + "description": "Main action button. Dashboard Blue background, white text.", + "html": "", + "css": ".ds-btn-primary { background-color: #53A5DB; color: #FFFFFF; font-family: Inter, sans-serif; font-size: 14px; font-weight: 600; padding: 8px 16px; border: none; border-radius: 6px; cursor: pointer; transition: background-color 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-btn-primary:hover { background-color: #2D4A5E; } .ds-btn-primary:focus-visible { outline: none; box-shadow: 0px 0px 0px 2px rgba(83, 165, 219, 0.4); }" + }, + { + "name": "Secondary Button", + "kind": "button", + "refersTo": "button-secondary", + "description": "Lower-emphasis action. Transparent background with blue text.", + "html": "", + "css": ".ds-btn-secondary { background-color: transparent; color: #53A5DB; font-family: Inter, sans-serif; font-size: 14px; font-weight: 600; padding: 8px 16px; border: 1px solid transparent; border-radius: 6px; cursor: pointer; transition: border-color 150ms cubic-bezier(0.4, 0, 0.2, 1), background-color 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-btn-secondary:hover { border-color: #53A5DB; background-color: rgba(83, 165, 219, 0.08); } .ds-btn-secondary:focus-visible { outline: none; box-shadow: 0px 0px 0px 2px rgba(83, 165, 219, 0.4); }" + }, + { + "name": "Filled Input", + "kind": "input", + "refersTo": "input-filled", + "description": "Default text input. Filled variant with border.", + "html": "", + "css": ".ds-input-filled { font-family: Inter, sans-serif; font-size: 14px; font-weight: 500; line-height: 1.6; height: 40px; padding: 0 12px; background-color: transparent; border: 1px solid rgba(0, 0, 0, 0.23); border-radius: 6px; outline: none; transition: border-color 150ms cubic-bezier(0.4, 0, 0.2, 1), box-shadow 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-input-filled:focus { border-color: #1976d2; box-shadow: 0px 0px 0px 2px rgba(25, 118, 210, 0.25); } .ds-input-filled::placeholder { color: rgba(0, 0, 0, 0.38); }" + }, + { + "name": "Chip", + "kind": "chip", + "refersTo": "chip-default", + "description": "Status tag or filter chip. Neutral background, rounded corners.", + "html": "Active", + "css": ".ds-chip { display: inline-flex; align-items: center; font-family: Inter, sans-serif; font-size: 12px; font-weight: 400; padding: 4px 8px; background-color: #EEEEEE; color: #424242; border-radius: 6px; }" + }, + { + "name": "Card", + "kind": "card", + "refersTo": "card-default", + "description": "Content container with subtle elevation.", + "html": "
Card Title
Card content goes here.
", + "css": ".ds-card { background-color: #FFFFFF; border-radius: 6px; box-shadow: 0px 1px 5px rgba(0, 0, 0, 0.24); } .ds-card-header { padding: 16px 24px; font-family: Inter, sans-serif; font-size: 16px; font-weight: 600; } .ds-card-content { padding: 20px 24px; font-family: Inter, sans-serif; font-size: 14px; line-height: 1.6; }" + }, + { + "name": "Nav Item", + "kind": "nav", + "refersTo": "nav-item", + "description": "Side navigation item. Active state uses Dashboard Blue.", + "html": "Dashboard", + "css": ".ds-nav-item { display: flex; align-items: center; gap: 16px; padding: 8px 16px; font-family: Inter, sans-serif; font-size: 14px; color: #616161; text-decoration: none; border-radius: 6px; transition: background-color 150ms cubic-bezier(0.4, 0, 0.2, 1); } .ds-nav-item:hover { background-color: rgba(0, 0, 0, 0.04); } .ds-nav-item--active { color: #53A5DB; background-color: rgba(83, 165, 219, 0.08); } .ds-nav-icon { flex-shrink: 0; }" + } + ], + "narrative": { + "northStar": "The Control Room", + "overview": "Manage365 is a control room for MSP technicians managing dozens of Microsoft 365 tenants. Every element exists to surface information and enable action. There is no marketing, no onboarding friction, no decorative flourish. The interface assumes expertise and rewards it with density and speed.\n\nThe design philosophy is utilitarian without being ugly. Information is compressed but readable. Actions are discoverable but not intrusive. The system trusts users to know what they're doing and gets out of their way.\n\nThis is not a consumer app. It's not trying to delight first-time visitors or explain itself. It's a daily driver for professionals who will spend hundreds of hours in it. Efficiency compounds. Every pixel counts.", + "keyCharacteristics": [ + "Information-dense — Tables, cards, and dashboards pack data tight. White space is for structure, not aesthetics.", + "Action-oriented — Primary actions are visible and reachable. Bulk operations are first-class citizens.", + "Context-preserving — Tenant switching, navigation, and workflows never lose your place.", + "Quiet confidence — The interface doesn't shout. Status colors are muted. Shadows are structural, not decorative." + ], + "rules": [ + { + "name": "The Dashboard Blue Rule", + "body": "The primary accent is used on interactive elements: buttons, links, active states, focus rings. It does not appear on static informational content. If something is blue, it should be clickable or indicate selection.", + "section": "colors" + }, + { + "name": "The Soft Semantic Rule", + "body": "Status colors are intentionally muted. Errors and warnings appear frequently in admin tools; screaming red and orange cause alarm fatigue. Our semantic colors are visible but calm.", + "section": "colors" + }, + { + "name": "The 14px Body Rule", + "body": "Body text is 14px, not 16px. Admin interfaces benefit from density. Users are close to their screens and focused.", + "section": "typography" + }, + { + "name": "The Structural Shadow Rule", + "body": "Shadows communicate z-index, not decoration. If it floats, it has a shadow. If it's inline, it doesn't. Background tint handles surface layering.", + "section": "elevation" + } + ], + "dos": [ + "Do use Dashboard Blue only for interactive elements. If it's blue, it should do something.", + "Do keep body text at 14px. Density is a feature, not a bug.", + "Do use structural shadows to communicate elevation. Modals float; inline content doesn't.", + "Do respect the neutral scale for non-interactive surfaces. Reserve color for status and actions.", + "Do support both light and dark modes. Dark mode uses elevated surface tints, not just shadows.", + "Do include visible focus indicators. Keyboard navigation is critical for power users.", + "Do truncate long content with ellipsis rather than breaking layouts." + ], + "donts": [ + "Don't mimic Azure Portal. No overwhelming nested menus, no slow page loads, no lost context.", + "Don't add marketing fluff. No gradient hero sections, no stock photography, no \"Get Started\" hand-holding.", + "Don't use 2010s enterprise patterns. No cramped 11px grids, no Windows XP iconography, no gray-on-gray.", + "Don't over-design for aesthetics. No excessive white space that wastes screen real estate.", + "Don't use border-left greater than 1px as a colored accent stripe. Use background tints or icons instead.", + "Don't use gradient text (background-clip: text). Solid colors only.", + "Don't default to glassmorphism or blur effects. They're slow and distracting.", + "Don't animate CSS layout properties. Transitions on color/opacity/transform only.", + "Don't use bounce or elastic easing. Ease-out-quart or similar exponential curves.", + "Don't add loading spinners when data can be prefetched or shown progressively.", + "Don't require confirmation dialogs for reversible actions." + ] + } +} diff --git a/DESIGN.md b/DESIGN.md new file mode 100644 index 0000000000..e98cb83710 --- /dev/null +++ b/DESIGN.md @@ -0,0 +1,254 @@ +--- +name: Manage365 +description: Multi-tenant M365 administration for MSPs who value speed over ceremony +colors: + dashboard-blue: "#53A5DB" + dashboard-blue-deep: "#2D4A5E" + dashboard-blue-light: "#7FC4E8" + navy-primary: "#003049" + orange-accent: "#F77F00" + indigo-accent: "#635dff" + purple-accent: "#9E77ED" + success: "#6BBDC4" + info: "#5BBEDB" + warning: "#8FD19E" + error: "#E09090" + neutral-50: "#FAFAFA" + neutral-100: "#F5F5F5" + neutral-200: "#EEEEEE" + neutral-300: "#E0E0E0" + neutral-400: "#BDBDBD" + neutral-500: "#9E9E9E" + neutral-600: "#757575" + neutral-700: "#616161" + neutral-800: "#424242" + neutral-900: "#212121" + surface-dark: "#181818" + surface-dark-elevated: "#1E1E1E" +typography: + display: + fontFamily: "Inter, sans-serif" + fontSize: "48px" + fontWeight: 600 + lineHeight: 1.5 + headline: + fontFamily: "Inter, sans-serif" + fontSize: "32px" + fontWeight: 600 + lineHeight: 1.5 + title: + fontFamily: "Inter, sans-serif" + fontSize: "24px" + fontWeight: 600 + lineHeight: 1.5 + body: + fontFamily: "Inter, sans-serif" + fontSize: "14px" + fontWeight: 400 + lineHeight: 1.6 + label: + fontFamily: "Inter, sans-serif" + fontSize: "12px" + fontWeight: 500 + lineHeight: 1.75 +rounded: + sm: "4px" + md: "6px" + lg: "8px" + pill: "48px" +spacing: + xs: "4px" + sm: "8px" + md: "16px" + lg: "24px" + xl: "32px" +components: + button-primary: + backgroundColor: "{colors.dashboard-blue}" + textColor: "#FFFFFF" + rounded: "{rounded.md}" + padding: "8px 16px" + button-primary-hover: + backgroundColor: "{colors.dashboard-blue-deep}" + textColor: "#FFFFFF" + input-filled: + backgroundColor: "transparent" + textColor: "{colors.neutral-900}" + rounded: "{rounded.md}" + padding: "0 12px" + chip-default: + backgroundColor: "{colors.neutral-200}" + textColor: "{colors.neutral-800}" + rounded: "{rounded.md}" +--- + +# Design System: Manage365 + +## 1. Overview + +**Creative North Star: "The Control Room"** + +Manage365 is a control room for MSP technicians managing dozens of Microsoft 365 tenants. Every element exists to surface information and enable action. There is no marketing, no onboarding friction, no decorative flourish. The interface assumes expertise and rewards it with density and speed. + +The design philosophy is utilitarian without being ugly. Information is compressed but readable. Actions are discoverable but not intrusive. The system trusts users to know what they're doing and gets out of their way. + +This is not a consumer app. It's not trying to delight first-time visitors or explain itself. It's a daily driver for professionals who will spend hundreds of hours in it. Efficiency compounds. Every pixel counts. + +**Key Characteristics:** + +- **Information-dense** — Tables, cards, and dashboards pack data tight. White space is for structure, not aesthetics. +- **Action-oriented** — Primary actions are visible and reachable. Bulk operations are first-class citizens. +- **Context-preserving** — Tenant switching, navigation, and workflows never lose your place. +- **Quiet confidence** — The interface doesn't shout. Status colors are muted. Shadows are structural, not decorative. + +## 2. Colors + +A restrained palette built around Dashboard Blue with semantic colors for status. The primary accent appears sparingly — mostly on interactive elements and active states. + +### Primary + +- **Dashboard Blue** (#53A5DB / oklch(70% 0.11 230)): Primary actions, links, active nav items, and focus rings. The familiar blue of system interfaces — draws attention without shouting. +- **Dashboard Blue Deep** (#2D4A5E): Hover states for primary buttons. Adds weight when pressed. +- **Dashboard Blue Light** (#7FC4E8): Chip backgrounds, subtle highlights, secondary accents. + +### Secondary (configurable presets) + +- **Navy Primary** (#003049): Alternative preset. Darker, more serious. +- **Orange Accent** (#F77F00): Alternative preset. High energy, action-forward. +- **Indigo Accent** (#635dff): Alternative preset. Modern, slightly playful. +- **Purple Accent** (#9E77ED): Alternative preset. Softer, creative. + +### Semantic + +- **Success** (#6BBDC4): Teal-cyan. Completed actions, healthy status, pass states. +- **Info** (#5BBEDB): Cyan. Informational badges, hints, neutral status. +- **Warning** (#8FD19E): Mint-green. Unusual for warning — intentionally soft to avoid alarm fatigue. +- **Error** (#E09090): Muted rose. Failures, blocked actions, critical status. Soft enough for frequent display. + +### Neutral + +- **Neutral 50–100** (#FAFAFA, #F5F5F5): Light mode backgrounds. Paper surfaces. +- **Neutral 200–400** (#EEEEEE, #E0E0E0, #BDBDBD): Borders, dividers, disabled states. +- **Neutral 500–600** (#9E9E9E, #757575): Secondary text, icons. +- **Neutral 700–900** (#616161, #424242, #212121): Primary text, headings, emphasis. +- **Surface Dark** (#181818): Dark mode default background. +- **Surface Dark Elevated** (#1E1E1E): Dark mode paper/card surfaces. + +### Named Rules + +**The Dashboard Blue Rule.** The primary accent is used on interactive elements: buttons, links, active states, focus rings. It does not appear on static informational content. If something is blue, it should be clickable or indicate selection. + +**The Soft Semantic Rule.** Status colors are intentionally muted. Errors and warnings appear frequently in admin tools; screaming red and orange cause alarm fatigue. Our semantic colors are visible but calm. + +## 3. Typography + +**Display Font:** Inter (with system sans-serif fallback) +**Body Font:** Inter (with system sans-serif fallback) + +**Character:** Inter is the workhorse of modern UI. It's neutral, highly legible at small sizes, and renders crisply on screens. No personality, by design — the content is the personality. + +### Hierarchy + +- **Display** (600, 48px, 1.5): Page titles, dashboard heroes. Rare. +- **Headline** (600, 32px, 1.5): Section headers, modal titles. +- **Title** (600, 24px, 1.5): Card headers, panel titles. +- **Subtitle** (500, 16px, 1.75): Sub-section labels, emphasized body text. +- **Body** (400, 14px, 1.6): Primary content, table cells, descriptions. Max line length 75ch. +- **Label** (500, 12px, 1.75): Form labels, chip text, metadata. +- **Caption** (400, 11px, 1.6): Timestamps, fine print, tertiary information. + +### Named Rules + +**The 14px Body Rule.** Body text is 14px, not 16px. Admin interfaces benefit from density. Users are close to their screens and focused. + +**The 600 Heading Rule.** All headings use weight 600 (semibold), never bold (700). This creates clear hierarchy without shouting. + +## 4. Elevation + +Structural shadows that clearly define what's floating versus grounded. Modals, dropdowns, and popovers cast visible shadows. Cards on flat surfaces use minimal or no shadow. + +### Shadow Vocabulary + +- **Level 1** (`0px 1px 2px rgba(0, 0, 0, 0.24)`): Subtle lift. Buttons at rest, chips. +- **Level 4** (`0px 1px 5px rgba(0, 0, 0, 0.24)`): Cards on surfaces. Gentle separation. +- **Level 8** (`0px 4px 6px rgba(0, 0, 0, 0.24)`): Dropdown menus, tooltips. Clear float. +- **Level 16** (`0px 10px 15px rgba(0, 0, 0, 0.24)`): Modals, dialogs. Prominent overlay. +- **Level 24** (`0px 25px 50px rgba(0, 0, 0, 0.24)`): Large modals, full-screen overlays. + +### Named Rules + +**The Structural Shadow Rule.** Shadows communicate z-index, not decoration. If it floats, it has a shadow. If it's inline, it doesn't. Background tint handles surface layering. + +**The Dark Mode Overlay Rule.** In dark mode, shadows are less visible. Elevated surfaces use lighter backgrounds (#1E1E1E vs #181818) instead of relying solely on shadow. + +## 5. Components + +### Buttons + +- **Shape:** Gently rounded corners (6px radius). Not pill-shaped, not sharp. +- **Primary:** Dashboard Blue background, white text, 8px 16px padding. +- **Hover / Focus:** Background darkens to Dashboard Blue Deep. Focus ring: 2px Dashboard Blue at 25% opacity. +- **Secondary / Ghost:** Transparent background, Dashboard Blue text, subtle border on hover. +- **Ripple:** Disabled. Interaction feedback via color change, not animation. + +### Chips + +- **Style:** 6px radius, neutral background (light: #EEEEEE, dark: surface elevated), neutral text. +- **State:** Selected chips use Dashboard Blue Light background. +- **Delete icon:** Heroicons XCircle outline. + +### Cards / Containers + +- **Corner Style:** 6px radius (consistent with other components). +- **Background:** Paper color (white in light mode, #1E1E1E in dark mode). +- **Shadow Strategy:** Level 4 for cards floating on backgrounds. No shadow for inline containers. +- **Border:** None by default. Optional 1px neutral-300 border for subtle definition. +- **Internal Padding:** 24px horizontal, 20px vertical for content. 16px for headers/actions. + +### Inputs / Fields + +- **Style:** Filled variant with 1px border. 6px radius. Background transparent. +- **Height:** 40px for single-line inputs. Flexible for multiline. +- **Focus:** Border shifts to primary color. Glow: `0px 0px 0px 2px rgba(25, 118, 210, 0.25)`. +- **Error:** Border shifts to error color. No background tint. +- **Disabled:** Reduced opacity (38% text), no interaction. + +### Navigation + +- **Side nav:** Collapsible, pinnable. 14px item text, 8px icon spacing. +- **Active state:** Dashboard Blue text and icon, subtle alpha background. +- **Hover:** Background alpha (8% in light mode, 8% white in dark mode). +- **Top nav:** Tenant selector prominent, account menu right-aligned. + +### Data Tables + +- **Header:** 11px uppercase, 600 weight. Sticky on scroll. +- **Rows:** Alternate background optional. Last row has no bottom border. +- **Cell padding:** Compact. Text truncates with ellipsis. +- **Actions:** Inline action menus, bulk action toolbar on selection. + +## 6. Do's and Don'ts + +### Do: + +- **Do** use Dashboard Blue only for interactive elements. If it's blue, it should do something. +- **Do** keep body text at 14px. Density is a feature, not a bug. +- **Do** use structural shadows to communicate elevation. Modals float; inline content doesn't. +- **Do** respect the neutral scale for non-interactive surfaces. Reserve color for status and actions. +- **Do** support both light and dark modes. Dark mode uses elevated surface tints, not just shadows. +- **Do** include visible focus indicators. Keyboard navigation is critical for power users. +- **Do** truncate long content with ellipsis rather than breaking layouts. + +### Don't: + +- **Don't** mimic Azure Portal. No overwhelming nested menus, no slow page loads, no lost context. +- **Don't** add marketing fluff. No gradient hero sections, no stock photography, no "Get Started" hand-holding. +- **Don't** use 2010s enterprise patterns. No cramped 11px grids, no Windows XP iconography, no gray-on-gray. +- **Don't** over-design for aesthetics. No excessive white space that wastes screen real estate. +- **Don't** use border-left greater than 1px as a colored accent stripe. Use background tints or icons instead. +- **Don't** use gradient text (background-clip: text). Solid colors only. +- **Don't** default to glassmorphism or blur effects. They're slow and distracting. +- **Don't** animate CSS layout properties. Transitions on color/opacity/transform only. +- **Don't** use bounce or elastic easing. Ease-out-quart or similar exponential curves. +- **Don't** add loading spinners when data can be prefetched or shown progressively. +- **Don't** require confirmation dialogs for reversible actions. diff --git a/PRODUCT.md b/PRODUCT.md new file mode 100644 index 0000000000..3763cc2139 --- /dev/null +++ b/PRODUCT.md @@ -0,0 +1,44 @@ +# Product + +## Register + +product + +## Users + +MSP technicians managing multiple client Microsoft 365 tenants daily. They're juggling dozens of clients, context-switching constantly, and often working under time pressure. They know M365 deeply — they don't need training wheels, they need speed. + +## Product Purpose + +Manage365 is a multi-tenant M365 administration portal that lets MSPs manage users, teams, SharePoint, Exchange, security, Intune, and more across all their clients from a single interface. Success looks like: a technician who used to spend 20 minutes clicking through three Microsoft portals now completes the same task in 2 minutes without leaving Manage365. + +## Brand Personality + +Fast, focused, technical. + +The UI should feel like a power tool — responsive, information-dense, keyboard-friendly. No marketing language, no friendly mascots, no "getting started" hand-holding. Assume expertise. + +## Anti-references + +- **Azure Portal** — Overwhelming navigation, deeply nested menus, slow page loads, context constantly lost +- **Generic SaaS** — Gradient hero sections, stock photography, marketing copy masquerading as UI, feature announcements nobody asked for +- **Old-school admin tools** — Cramped data grids, 11px fonts, Windows XP-era iconography, forms that feel like tax software +- **Over-designed apps** — Excessive white space, animations that slow you down, style over substance, pretty but inefficient + +Reference: Raycast — snappy, dark, power-user focused. Every pixel serves a purpose. + +## Design Principles + +1. **Speed over ceremony** — Every interaction should feel instant. Prefetch data, avoid confirmation dialogs for reversible actions, never make users wait for something that can happen in the background. + +2. **Density with clarity** — Pack information tight without cramping. Data tables should be scannable, not endlessly scrollable. Show what matters at a glance; let details expand on demand. + +3. **Expert confidence** — Assume the user knows M365. Provide keyboard shortcuts, bulk actions, and direct paths. Skip the wizards when a single well-designed form will do. + +4. **Multi-tenant fluent** — Every screen acknowledges the user is managing many clients. Tenant switching must be instant. Never lose context when moving between clients. + +5. **Opinionated defaults** — Make the right choice easy. Pre-fill sensible values, surface recommended actions, reduce decisions that don't matter. + +## Accessibility & Inclusion + +Standard best practices: sufficient color contrast, keyboard navigation, screen reader compatibility, and focus indicators. Don't rely on color alone to convey status — pair with icons or text. Support prefers-reduced-motion for users who need it. diff --git a/README.md b/README.md index 66463bd2bb..a742c47e44 100644 --- a/README.md +++ b/README.md @@ -1,27 +1,662 @@ -![CyberDrain Light](github_assets/img/CIPP.png#gh-dark-mode-only) -![CyberDrain Dark](github_assets/img/CIPP-Light.png#gh-light-mode-only) +

+ Manage365 Logo +

-# What is CIPP? +

Manage365

-The CyberDrain Improved Partner Portal (CIPP) is a multi-tenant management portal for Microsoft Partners. The current Microsoft partner landscape makes it fairly hard to manage multi-tenant situations, with loads of manual work. Microsoft Lighthouse might resolve this in the future, but its development is lagging far behind the needs of the current market for Microsoft Partners. +

+ An enhanced Microsoft 365 multi-tenant management portal based on the CIPP open-source project. +

-CIPP helps you with day-to-day administration across all of your Microsoft 365 tenants from a single pane of glass, including: +--- -- **Tenant administration** — manage users, groups, mailboxes, devices, and licenses across every tenant you service, without switching portals or juggling GDAP relationships by hand. -- **Standards & best practices** — define your preferred security and configuration standards once, then deploy and continuously enforce them across all tenants. -- **Security & compliance visibility** — review alerts, incidents, and tenant health from one place, and act on them quickly. -- **Automation** — scheduled tasks, alerting, and integrations that remove repetitive work and save several hours per engineer per month. +> **Manage365 v6.0.0 — monorepo era.** This repository is based on the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) (baseline v**10.8.5**): frontend and backend in one repo, deployed as a single container on the Craft runtime. Manage365 customizations were migrated here from the previous two-repo forks (`Celeratec/CIPP` v5.33.0 / `Celeratec/CIPP-API`); see [docs/upstream-sync/MONOREPO_MIGRATION_20260815.md](docs/upstream-sync/MONOREPO_MIGRATION_20260815.md). +> +> Manage365 is built on top of the [CyberDrain Improved Partner Portal (CIPP)](https://cipp.app). CIPP is actively developed and may implement similar features over time. Upstream changes are merged selectively to preserve Manage365-specific UI and workflows. See [Upstream Integration](#upstream-integration) below. -For detailed documentation about the features of CIPP, please check out our [documentation](https://docs.cipp.app). +## What is Manage365? -# How it works +Manage365 is a Microsoft 365 multi-tenant administration portal designed for Microsoft Partners and IT administrators. It provides a centralized interface for managing users, teams, SharePoint, Exchange, security, compliance, Intune, Dynamics 365, and more across all of your Microsoft 365 tenants. -This repository is the monorepo for CIPP, combining the frontend and backend into a single containerized deployment powered by the [Craft](https://github.com/CyberDrain/Craft) runtime: +Manage365 inherits the full feature set of CIPP and extends it with additional capabilities focused on deeper Teams, SharePoint, OneDrive, and Dynamics 365 management, centralized cross-tenant access governance, external collaboration controls, and tenant-level SharePoint and Teams policy management -- areas where day-to-day administration often requires switching between multiple Microsoft portals. -- **`frontend/`** — the web interface, built with [Next.js](https://nextjs.org/) and React. -- **`backend/`** — the API layer, written in PowerShell and executed by the Craft runtime. -- **`build/`** — Dockerfiles, docker-compose definitions, and tooling used to build and run the containerized deployment. +For information about the upstream CIPP project, visit [cipp.app](https://cipp.app) and [docs.cipp.app](https://docs.cipp.app). -# Our sponsors +--- -You can find our sponsors [here.](https://docs.cipp.app/#our-sponsors) +## Features from CIPP (Upstream) + +Manage365 includes the complete CIPP feature set: + +### Identity Management +- User administration (create, edit, delete, offboard with orchestrator-based batch processing and scheduler-routed task tracking) +- Schedulable user edits — apply an edit now or schedule it for a future date via the task scheduler +- Policy-aware Temporary Access Pass creation (lifetime/usage options validated against the tenant's TAP policy) +- User form validation with field-level constraints (max length, required, pattern) +- User patching with manager and sponsor property support +- Vacation mode wizard with mailbox permissions, calendar delegation, and out-of-office scheduling with timezone-aware response formatting +- Offboarding wizard with dialog mode, table view for all tenant offboarding tasks, scheduler integration for proper task tracking and alerting, and custom tests +- Bulk guest invitation +- Risky users monitoring +- Group management with templates, group detail page, and deploy group template button +- Device management (Entra ID devices with NinjaOne enrichment, cross-linked to Intune) +- Per-user device view on the View User page (Entra device cards and Intune managed devices in one place) +- Role management and JIT Admin with usage location support and TAP lifetime policy bounds +- Reports: MFA (with role-targeted CA policy detection), inactive users, sign-in logs, Entra Connect, risk detections, BEC remediation +- BEC remediation checks include inbox-rule change auditing, sent-message review, and trusted/blocked sender changes (Manage365 implements the backend data collection for the sender check) +- Copilot & AI management pages + +### Tenant Administration +- Multi-tenant management and configuration +- Upgraded tenant onboarding experience with type selection and Indirect Reseller Link support +- Alert configuration and audit logs (group membership change, Defender severity filtering, inactive users, TAP creation alerts) +- Alert snooze dialog and snoozed alerts management +- Dashboard Alerts card — active and snoozed alert instances at a glance with per-item snooze +- Secure Score monitoring (including AllTenants report via `ListSecureScoreReport`) +- Application management, consent requests, and app management policies +- App registration and enterprise app detail pages with permissions viewer +- GDAP relationship management with GDAP trace and AI Administrator role support +- Tenant group management with usage reporting +- Standards alignment and drift detection (including device registration local admin controls, CIS7 alignment, and CA template package tags) +- **Baselines** (preview) — drift-first baseline engine parallel to Applied Standards; feature-flagged off by default (see [Baselines](#baselines-manage365-v5330) below) +- Standards with custom variable support, requiredCapabilities filtering, and license capability presets +- Group-based licensing for security groups and templates +- Alert-only license exclusions (exclude licenses from alerting without removing them from standards checks) +- New standards: Restrict User Device Registration, AdminSSPR +- Standards dialog with enabled/disabled status filter and severity color mapping +- Best Practice Analyser and Domains Analyser (with DKIM selector rotation) +- Conditional Access policy management, templates, and vacation mode with authentication flow selection +- Licence reporting and management with granular control and dynamic license backfill +- CSP license reporting page for Cloud Solution Provider scenarios +- BitLocker recovery key search and caching +- Feature flags +- Reusable settings standards with templates +- Configuration backup with restore wizard (type-filtered restoration with row count reporting) +- GitHub import/export for templates and cache explorer +- Incident report and attachment options +- Log retention settings +- Dashboard v2: report toolbar, custom dashboards, responsive layout, and inline universal search (legacy Dashboard v1 removed; `/dashboardv1` redirects to v2) +- Report builder with templates and generated reports +- Executive report with menuItem variant support + +### Security & Compliance +- Incident and alert management (including MDO alerts) +- Defender status, deployment, and TVM vulnerabilities +- Defender alerts with severity filtering +- Device compliance reporting +- Customer Lockbox +- eDiscovery case management with legal holds, content searches, and exports (see Manage365 features below) + +### Endpoint Management +- Application management and deployment queue (including Win32/custom apps) +- Application assignment filter options +- Managed device administration with NinjaOne hardware enrichment (CPU, RAM, agent status) +- **BitLocker Key Search** — dedicated Device Management page for key lookup +- **MAA Requests** — Multi Admin Approval request visibility with handoff to Intune (approve/reject stay in-tenant) +- Device detail page with Intune policy setting descriptions (hover to see what each setting does) for both Settings Catalog and Administrative Templates +- DEP sync +- Autopilot device management, profiles, and status pages +- Configuration and compliance policies with templates +- Intune reusable settings deployment and templates with assignment verification +- App protection policies and assignment filters +- Script management +- Reports: device score analytics, work from anywhere, autopilot deployments, discovered apps + +### Email & Exchange +- Mailbox administration (active, deleted, rules, permissions) +- Contact management with templates +- **Quarantine management** -- advanced Defender-style filtering, server-side pagination (default 7 days / 100 rows), bulk actions, CSV/JSON export, lazy detail metadata, and preserved EML preview, message trace, and Threat Explorer deep links (see [Quarantine Portal](#quarantine-portal-manage365-v5130) below) +- Restricted user management +- Tenant Allow/Block Lists +- Retention policies and tags +- Transport rules and connectors with templates +- Safe Links policies and templates +- Spam filter and connection filter management +- SendFromAlias standard (enable/disable) +- Resource management (rooms, equipment, room lists) +- Message trace, mailbox restores, message viewer +- Reports: mailbox statistics, activity, CAS settings, permissions, calendar permissions, mailbox forwarding, anti-phishing, malware filters, safe attachments, GAL +- Queue tracking for report generation + +### Tools +- Graph Explorer with simple filter UI +- Universal Search v2 in the top navigation (Pages default on magnifier; Cmd+K for pages, Cmd+Shift+F for users) plus dashboard inline search +- Application approval workflow +- Tenant and IP lookup +- Domain health checks with AutoDiscover validation +- Dark web breach lookups (tenant and individual) +- Template library and community repositories +- Task scheduler with label-based action filtering +- Custom tests with result mode options (Auto, AlwaysPass, AlwaysInfo, AlwaysInvestigate) +- Guest account disable support with sign-in audit fallback +- Script editor improvements +- Super admin pages relocated to /cipp/advanced/super-admin/ + +### Settings & Administration +- Application settings and integrations (including PWPush with CloudFlare Tunnel and default passphrase support) +- SIEM settings with SAS token generation for log table access +- SAM service principal lock configuration +- Setup wizard and onboarding +- Enhanced bookmark management with sidebar, drag-and-drop reordering, lock, and sort options +- Compact navigation mode for denser sidebar layout +- Resizable table columns across all data tables, with upstream table virtualization and column-cache optimizations while preserving Manage365 mobile card views +- Tenant selector hotlinks support customerId (GUID) and initialDomainName in addition to defaultDomainName +- PWA support with Chrome install option for desktop app experience +- Logbook with severity color mapping +- Custom data / directory extensions +- Super admin tools (tenant mode, function offloading, time settings, CIPP roles, SAM app roles/permissions) +- API client management with optional MCP access (feature-flagged; see [MCP Server](#mcp-server-manage365-v5320) below) + +--- + +## Features Unique to Manage365 + +The following capabilities have been developed specifically for Manage365 and are not available in upstream CIPP as of the date shown above. + +### Visual Card Views & Modern UI + +CIPP uses table-only views for listing data. Manage365 adds card view alternatives across every major list page -- Users, Groups, Teams, Mailboxes, Contacts, Devices, Applications, SharePoint Sites, OneDrive, and more. Cards surface key status badges, metadata, and up to 8 quick-action buttons directly on each item, so common tasks are one click away without opening a detail page. Standardized card widths, meaningful icons (OS-aware device icons, entity-type icons), and consistent badge design provide a polished, scannable interface. Card view loading is optimized to only show skeletons during initial data fetch; background refetches do not blank already-loaded cards. + +### Mobile-Responsive Design + +Comprehensive mobile responsiveness throughout the application: responsive data tables that adapt to screen size, mobile-friendly toolbars with compact controls, sticky wizard step buttons, a mobile tenant selector in the top navigation, and card views optimized for touch. The entire interface is usable on tablets and phones without horizontal scrolling. + +### Applied Standards Enhancements + +Manage365 extends upstream Applied Standards with license-aware compliance reporting: + +- **Missing-license visibility** -- standards blocked by licensing show warnings and dedicated filter chips (License available / License not available) +- **Corrected scoring** -- combined compliance score uses ratio-based math (compliant + license-blocked vs scored standards) instead of additive percentages that could exceed 100% +- **Drift integration** -- drift-template types and `createDriftManagementActions` for accepted deviations and customer-specific overrides +- **Fork API compatibility** -- frontend normalizes `{ Results }` template responses so standards load reliably across API versions + +### Enhanced Detail Pages + +Manage365 extends upstream's detail pages with significantly richer, purpose-built interfaces for key entities: + +- **SharePoint Sites** -- storage monitoring, member and administrator management (including non-group-connected sites), guest invitation with domain restriction diagnostics and one-click quick-fix, cross-linking to Teams, Create Team from Site, and direct file browser access +- **Teams** -- member/owner management, channel management (including private/shared channel members with per-channel file browsing), app management, interactive toggle-chip settings for member permissions, guest permissions, messaging, and fun settings, plus guest invitation with Teams-specific diagnostics and direct file browser access at both team and channel level +- **Groups** -- hero overview by group type, member/owner/contact management, editable properties, interactive toggle-chip settings, dynamic membership rule display, on-premises sync awareness, and add member to multiple groups at once from the groups list page (extends upstream's group page) +- **Mailboxes / User Exchange Tab** -- mailbox type identification, aliases, archive status, direct link to Exchange settings, clickable external mail restriction tiles (independently block/allow inbound or outbound external email with confirmation dialogs and consequence warnings), one-click spam block clearing when a mailbox has been flagged by Microsoft for suspected spam activity, and **interactive hold management** -- toggle Litigation Hold and Retention Hold on/off directly from the Exchange info card with confirmation dialogs, data loss warnings, and optional duration (days) for Litigation Hold; read-only holds (eDiscovery, In-Place, Compliance Tag, Purview Retention) display with Purview portal guidance +- **Contacts** -- editable properties form with on-premises sync awareness +- **Users (View User)** -- Entra device cards and Intune managed devices combined on one page (replaces the separate per-user devices tab) +- **Entra Devices** -- OS-aware hero, source presence chips (Entra, Intune, NinjaOne), NinjaOne hardware enrichment, quick actions (enable/disable, BitLocker, delete) +- **MEM Devices** -- compliance-colored hero, NinjaOne hardware enrichment, categorized quick actions (sync, reboot, rename, LAPS, BitLocker, retire, delete), NinjaOne data merged into device listings (extends upstream's device page) +- **Applications** -- assignment details, install experience, detection rules, and assignment quick actions + +### Teams Business Voice Management + +A comprehensive voice management section with dedicated pages for each component of the Teams telephony stack: + +- **Phone Numbers** -- card and table views with assignment status, assigned user displayed prominently, number type, emergency location, and quick actions to assign/unassign users and set emergency locations +- **Call Queues** -- view all call queues with routing method, agent counts, overflow and timeout settings; detailed off-canvas view with agent list, conference mode, and music/greeting configuration +- **Auto Attendants** -- view all auto attendants with voice response status, operator, language, and timezone; detailed off-canvas view with business hours and after-hours call flows, menu options, and holiday schedules +- **Dial Plans** -- view all tenant dial plans with normalization rule counts; detailed off-canvas view with full rule list showing match patterns and translations + +### File Management + +- **Tenant-wide file search** -- search across all SharePoint sites and OneDrive accounts in a tenant using Microsoft's KQL syntax. Filter by file name, type, author, date, path, and more. Results include a copy-link button for sharing direct file URLs with end users, a browse-to-location button to jump into the file browser, and an open-in-SharePoint link. Built-in search tips guide users through KQL operators and combined filters. +- **File browser** for any user's OneDrive or SharePoint site -- navigate folders, download, rename, move, copy, delete files, and create folders without leaving the portal. Includes a location switcher to jump between SharePoint sites or OneDrive users without returning to the landing page. Direct "Browse Files" links are available from Team detail pages, individual channel rows, and SharePoint site detail pages, opening the file browser pre-loaded to the correct site. +- **Cross-drive transfer wizard** -- move or copy files and folders between OneDrive accounts and SharePoint sites with a visual destination browser. Supports single-item and bulk transfers with per-item progress tracking (pending, in progress, done, skipped, failed) displayed in a live status table. +- **Conflict resolution** -- three options when items already exist at the destination: + - **Rename** (default) -- Graph API automatically appends a numeric suffix to avoid conflicts + - **Replace** -- deletes the existing item at the destination before copying, ensuring a clean overwrite for both files and folders + - **Skip duplicates** -- files that already exist at the destination are skipped; folders that already exist are intelligently merged rather than skipped entirely. A recursive comparison checks whether the destination folder's contents fully match the source. Fully matching folders are skipped instantly. Partially-copied folders are merged: only the missing files and subfolders are copied into place while already-existing items are left untouched. This enables resuming a previously interrupted transfer without re-copying everything. +- **Frontend pre-check optimization** -- when skip duplicates is selected, the destination contents are fetched once upfront and duplicate files are marked as skipped immediately in the UI without making individual backend calls, providing instant feedback before the transfer begins +- **Verified transfers** -- cross-drive copy and move operations poll the Graph API monitor URL for completion, then verify the destination item exists and matches the source in size before reporting success. For moves, the source is only deleted after verified copy completion to prevent data loss +- **Folder compare** -- side-by-side recursive comparison of any two folder locations (OneDrive or SharePoint). A two-panel dialog lets users pick a source and destination, then runs a depth-limited diff that returns every difference: items only in the source, items only in the destination, and files with differing sizes. Results are displayed in a flat table with status chips, size columns, and checkbox selection. Users can select any subset of differing items and copy them to the other location in bulk, with per-item progress tracking. Matching file counts are shown in summary chips so users can quickly gauge how much the two locations overlap +- **Temp file cleanup wizard** -- a guided 5-step wizard to find and remove temporary and junk files from SharePoint sites and OneDrive accounts: + - **Flexible scope** -- scan a single SharePoint site, a specific user's OneDrive, all SharePoint sites, or all OneDrives in a tenant + - **Configurable filters** -- select which file types to target: Office temp files (~$*), .TMP/.temp files, zero-byte files, system junk (Thumbs.db, .DS_Store, desktop.ini), and backup files (.bak, .old) + - **Recursive scanning** -- searches all folders up to 10 levels deep with progress feedback + - **File selection** -- review scan results in a searchable table with per-file checkboxes, bulk select/deselect, and type-based filtering + - **Double verification** -- checkbox confirmation plus button click required before any deletion + - **Safe deletion** -- files are moved to the SharePoint/OneDrive recycle bin (93-day recovery) rather than permanently deleted + - **Detailed results** -- per-file success/failure status with actionable error messages + +### SharePoint Admin Dashboard + +A dedicated SharePoint dashboard under Teams & SharePoint > SharePoint > Dashboard providing at-a-glance visibility into tenant storage health and site administration: + +- **Key Metrics** -- tenant storage used/total, total sites, total files, and inactive site count +- **Storage Charts** -- tenant quota donut (used vs free), storage breakdown by site type (Communication, Group-Connected, Classic), and top 10 sites by storage consumption as a bar chart +- **Storage Alerts** -- sites approaching storage limits (>75% and >90%) sorted by severity with colored chips +- **Inactive Sites** -- sites with no activity in 90+ days, sorted by storage used to help identify cleanup candidates +- **Sharing Configuration** -- tenant-level external sharing settings, default link type, resharing policy, and link expiration at a glance +- **Recently Created Sites** -- new sites from the last 30 days + +Data is cached in the CIPP reporting database and refreshed daily during the scheduled cache cycle. A manual "Refresh Data" button triggers an on-demand cache update. The dashboard gracefully handles the first visit before any data is cached with a clear empty state and refresh prompt. + +### SharePoint Recycle Bin + +Manage and recover deleted SharePoint sites with retention tracking, visual expiration warnings, one-click restore, and permanent delete with appropriate safety warnings. + +### Cross-Tenant Access & External Collaboration Governance + +Centralized management of Microsoft Entra cross-tenant access policies, B2B collaboration settings, and external identity controls -- settings that are otherwise only manageable in the Entra portal and difficult to standardize across clients: + +- **Overview Dashboard** with health scoring and policy summary +- **Default Policy Editor** for B2B Collaboration, Direct Connect, Inbound Trust, Tenant Restrictions v2, and Automatic User Consent +- **Partner Organizations** management with per-partner overrides and reverse tenant name lookup +- **External Collaboration Settings** for guest invite restrictions, guest access levels, and domain allow/deny lists +- **Configuration Health & Conflict Detection** -- automated analysis across all cross-tenant settings layers with specific recommendations and direct links to fix issues +- **Security Baseline Templates** -- create, apply, and reuse cross-tenant security configurations across tenants +- **Standards Integration** -- 9 new standards (12 total covering the full cross-tenant surface) enabling drift detection, automated remediation, and alerting through the existing CIPP Standards framework + +### Tenant-Level Policy Management + +Dedicated settings pages for policies that normally require switching between multiple Microsoft admin portals: + +- **SharePoint Sharing Settings** -- external sharing level, domain restrictions, default link type, anonymous link controls, and resharing behavior +- **Teams Tenant Settings** -- federation and external access, guest access, cloud storage providers, meeting policy, messaging policy, and meeting background management, organized in a tabbed interface with per-section save. The meeting backgrounds tab lets administrators enable organization-wide custom backgrounds, view currently configured images, assign branding policies to individual users, and links directly to the Teams Admin Center for image upload (Microsoft does not expose a public API for background image upload). Includes image requirement guidance with dimension warnings. + +### Cross-Service Context Clues + +External access in Microsoft 365 is controlled by multiple independent settings layers (Cross-Tenant Access, Entra External Collaboration, SharePoint Sharing, Teams Federation) -- any one of which can block access. Manage365 adds contextual banners and cross-links throughout these settings pages so administrators can quickly identify which layer is causing an issue and navigate directly to it. + +### Risk Coaching & Settings Safety + +An inline risk coaching system that alerts administrators to potentially dangerous settings as they make changes. Over 30 risk rules across External Collaboration, Cross-Tenant Policy, SharePoint Sharing, Teams Settings, Offboarding Wizard, Transport Rules, and Alert Configuration highlight dangerous options, recommend safer alternatives, and require explicit confirmation before saving high-risk configurations. B2B direct connect settings include dedicated risk coaching that explains the security model -- direct connect users have no directory footprint and are not subject to Conditional Access unless inbound trust is configured -- and recommends partner-specific policies over opening the default. + +### Access Type Coaching: Guest Access vs External Access + +Microsoft 365 has two fundamentally different ways to collaborate with external users -- Guest Access (B2B Collaboration) and External Access (B2B Direct Connect) -- controlled by different settings layers with different capabilities and security implications. Manage365 adds consistent, context-aware coaching throughout the application so administrators understand which access type applies to what they're doing: + +- **Inline chips** with educational tooltips replace generic "Guest" labels on member lists across Teams, SharePoint, and user management pages +- **Contextual banners** in all guest invitation and channel member dialogs explain which access type is being used, what it means, and which email types are supported (organizational vs personal) +- **Expandable info panels** on Teams channel detail, Cross-Tenant Access, and SharePoint pages provide a side-by-side comparison of both access types with characteristics, limitations, and links to the relevant settings pages +- **Standards helpText** for guest-related standards (Guest Invite, Teams Guest Access, External MFA Trust, SP Azure B2B) now clarifies which access type each standard controls +- **Backend messages** tag every success and error result with the access type label (e.g., "Guest Access — B2B Collaboration" or "External Access — B2B Direct Connect") so results are unambiguous +- **Actionable error guidance** when a personal email is entered for a shared channel explains why it's not supported and directs the user to use a private channel instead + +All coaching content is driven by a single shared data layer (`accessTypes.js`) so terminology stays consistent across the entire application and can be updated in one place. + +### Guest Invitation & Channel Member Diagnostics + +Invite external guests directly from SharePoint site and Teams detail pages. Add external members to shared channels via B2B direct connect, or add guests with any email address (including personal emails like Gmail and Outlook.com) to private channels via B2B collaboration with automatic Email One-Time Passcode support. If an operation fails, the system automatically diagnoses the root cause -- checking cross-tenant access policies (B2B direct connect inbound/outbound), B2B domain restrictions, Teams guest access settings, Entra external collaboration settings, and SharePoint permissions -- and provides categorized, structured guidance with direct links to the relevant CIPP settings page. Microsoft internal error codes (e.g., "xTap") are translated to human-readable descriptions. + +### Pre-flight Domain Validation & Email Intelligence + +Real-time validation of guest email addresses before invitation, powered by a reusable domain intelligence API (`ExecValidateExternalDomain`). As administrators type an email address in any guest invitation dialog, the system: + +- **Classifies the email domain** via OIDC discovery as consumer (Gmail, Yahoo, Outlook.com), organizational (another M365 tenant), or unresolvable +- **Checks for existing guest accounts** in the target tenant to avoid duplicate invitations +- **Evaluates tenant policies** across Entra External Collaboration, B2B domain allow/block lists, SharePoint sharing settings, Teams guest access, and Cross-Tenant Access policies +- **Returns a structured verdict** with pass/fail/warning status, recommended access type, and specific fix guidance for any blocking policies + +Consumer domain detection is also integrated into the guest invite drawer and the Add Channel Member dialog for shared channels, where personal emails are blocked with an explanation of why shared channels require work/school accounts and a suggestion to use a private channel instead. + +### Interactive Access Type Decision Tree + +An interactive question-and-answer flow added to the `CippAccessTypeGuide` component (`variant="decision"`) helps administrators choose between Guest Access (B2B Collaboration) and External Access (B2B Direct Connect). Context-specific trees for SharePoint, Teams standard/private/shared channels, and a general-purpose flow guide users to the correct access type based on the external user's email type and the target resource, with clear lists of what is and isn't supported and concrete next steps. + +### External Access Wizard + +A multi-step guided wizard (`/teams-share/external-access`) that unifies the entire external user onboarding flow: + +1. **Who** -- enter one or more guest email addresses with inline domain validation and real-time policy feedback +2. **Where** -- select the target resource (SharePoint site, Teams standard/private/shared channel) with context-aware access type recommendations; shared channel options are automatically hidden for personal email addresses +3. **Review** -- summary of guests, resource, access type, and any policy warnings before execution +4. **Execute** -- sends invitations with per-guest progress tracking and individual success/error results + +### Sharing & Guest Troubleshooter + +A comprehensive diagnostic tool (`/teams-share/troubleshooting/sharing-troubleshooter`) that performs a structured sequence of 10 checks to identify why an external user cannot access a shared resource: + +1. Domain type classification (consumer vs organizational via OIDC) +2. Guest account existence in the tenant +3. Guest account status (enabled, disabled, pending acceptance) +4. Entra External Collaboration invite restrictions +5. Entra B2B domain allow/block lists +6. Email One-Time Passcode authentication method status +7. SharePoint tenant sharing settings and domain restrictions +8. Teams guest access configuration +9. Cross-Tenant Access policies (for organizational domains and shared channels) +10. Site-level membership verification (when a resource URL is provided) + +Results are displayed in a visual timeline with color-coded pass/fail/warning status, detailed explanations, fix recommendations with links to the relevant settings page, and quick presets for common troubleshooting scenarios. The backend (`ExecSharingTroubleshoot`) returns a structured timeline that can be consumed by other components. + +### SharePoint Document Library Sharing Links + +A new backend endpoint (`ExecCreateSharingLink`) enables creation of sharing links for specific SharePoint drive items using the Microsoft Graph `createLink` API. Supports view, edit, and embed link types with anonymous, organization, or specific-people scopes, optional expiration dates, and password protection. + +### Guest Lifecycle Dashboard + +A dedicated guest user management page (`/identity/administration/guest-users`) providing visibility into all guest accounts across a tenant: + +- **Summary cards** showing total guests and counts by status: Active, Stale (no sign-in for 90+ days), Pending Acceptance, Disabled, and Never Signed In +- **Status classification** computed from sign-in activity data via the Graph beta API +- **Filterable table** with one-click status filter buttons to quickly isolate problematic guests +- **Row actions** including re-invite for pending or stale guests + +### Guest-Ready Bulk Configuration + +A "Quick Setup: Guest-Ready Configuration" card on the Cross-Tenant Access page that configures a tenant for external guest collaboration in one click. Applies secure defaults across three services: + +- **Entra:** Guest invite restrictions set to Admins and Guest Inviter role +- **SharePoint:** External sharing enabled for new and existing guests +- **Teams:** Guest access enabled + +Includes a confirmation dialog showing exactly what will be changed and per-step success/error reporting. + +### Enhanced Cross-Tenant Health Checks + +Four new health checks (12-15) added to the Cross-Tenant Health endpoint: + +- **Teams guest access** -- warns if guest access is disabled in Teams client configuration +- **Email OTP status** -- warns if Email One-Time Passcode authentication is not enabled, which blocks personal email guests +- **SharePoint/Entra sharing mismatch** -- detects when Entra allows guests but SharePoint sharing is disabled (or vice versa) +- **Domain restriction divergence** -- detects when Entra and SharePoint have mismatched allowed/blocked domain lists + +### eDiscovery Case Management + +End-to-end eDiscovery workflow for managing legal holds, content searches, and evidence exports directly from the portal -- eliminating the need to switch to the Microsoft Purview compliance portal or write PowerShell scripts for each client: + +- **Case management** -- create, close, reopen, and delete eDiscovery cases per tenant with status tracking, case metadata, and external ID support for correlating with legal matter numbers +- **Legal holds** -- place litigation holds on specific user mailboxes and SharePoint sites with optional KQL content queries to narrow the scope. Supports multiple content sources per hold and displays hold status with content source counts +- **Content searches** -- create KQL-based searches across Exchange, SharePoint, Teams, and OneDrive. Run search estimates to preview result counts and data volume before committing to an export. Status polling auto-refreshes while searches are running +- **Export and production** -- initiate exports from completed searches with configurable export criteria. Export operations track progress percentage and provide download links when complete. Auto-polling updates export status in real time +- **Async operation tracking** -- long-running operations (search estimates, exports) are handled asynchronously with automatic 5-second polling that stops when the operation completes or fails +- **Setup guidance** -- a proactive setup banner on the cases page explains the one-time per-tenant prerequisites (CPV refresh for permissions and eDiscovery Administrator role assignment in Purview), plus reactive error classification that detects 403/permission and license errors and renders structured remediation steps +- **Tier support** -- uses the Microsoft Graph eDiscovery Standard API (September 2025), which works for both E3 and E5 tenants. Phase 2 will add Premium-only features (custodian management, review sets, advanced export options) for E5 tenants + +Built on app-only authentication (`eDiscovery.Read.All` and `eDiscovery.ReadWrite.All`) via SAM, consistent with the rest of the CIPP architecture. Located under Security & Compliance > eDiscovery > Cases. + +### Dynamics 365 Management + +Read-only visibility into Power Platform / Dynamics 365 environments, users, security roles, business units, and solutions -- providing insight without needing the Power Platform Admin Center. + +### NinjaOne Device Enrichment + +When NinjaOne integration is configured, device views across the application are automatically enriched with hardware data (CPU, RAM, OS, agent status, last contact). Works across MEM Devices, Entra Devices, and per-user device views, with graceful degradation when NinjaOne is not available. Backend sync includes Entra-only fallback for non-Intune tenants, O(1) serial number indexing for device matching, and memory-optimized processing. + +### Enhanced Error Messages & Permission Guidance + +Structured error formatting throughout the application. The `FormattedResultText` renderer automatically detects and formats common error patterns: backend `Diagnostics:` sections are parsed into categorized items with `[Category]` chips and `CIPP Settings:` paths become clickable navigation buttons. SharePoint-specific error classification provides targeted diagnostics for token acquisition and access issues without misdirecting users to superadmin settings. + +### Mailbox External Mail Restrictions + +Control external email flow on a per-mailbox basis directly from the user's Exchange tab. Two independent toggles allow administrators to: + +- **Block external inbound** -- sets `RequireSenderAuthenticationEnabled` so only internal (authenticated) senders can email the mailbox; external senders receive an NDR +- **Block external outbound** -- flags the mailbox via `CustomAttribute15` and auto-creates a tenant-wide transport rule that rejects messages sent to external recipients from any flagged mailbox + +Each toggle includes a confirmation dialog with clear warnings about the consequences. Restrictions can be applied independently (inbound only, outbound only, or both) and reversed at any time. The current status is displayed as a visual tile on the Exchange info card alongside other mailbox settings. + +### Email Troubleshooter + +A unified email troubleshooting hub under Email & Exchange > Troubleshooting that combines message trace and quarantine management into a single search-diagnose-act workflow, eliminating the context-switching that previously required technicians to navigate between separate pages in different menus. + +- **Unified search** -- a single search form queries both Exchange message trace and quarantine simultaneously, returning results in a tabbed interface with badge counts showing trace results and unreleased quarantine messages +- **Quick-filter presets** -- one-click chips for common searches: "Quarantined (24h)", "Failed Delivery (48h)", "All Recent (7d)" pre-fill the search form and execute immediately +- **Advanced filtering** -- shared quarantine filter panel with Message ID, subject (partial or exact), sender/recipient, sender/recipient domain, quarantine reason, release status, policy type/name, and message-trace-only sending IP filters +- **Contextual actions on trace results** -- View Delivery Details, View in Security Explorer, Allow Sender, Block Sender, Copy Message ID, and Release from Quarantine (appears only for quarantined messages) without leaving the page +- **Contextual actions on quarantine results** -- View Message (EML preview), View Message Trace, Release, Deny, Delete, Submit to Microsoft, Release & Allow Sender, Release & Add Allow Entry, Allow/Block Sender or Domain, and Copy Message ID +- **Cross-tab linking** -- clicking a "Quarantined" status chip in the trace tab switches to the quarantine tab and filters to the matching message +- **Bulk quarantine operations** -- select multiple quarantine entries and release, deny, release-and-allow, delete, submit to Microsoft, or block unique senders in one aggregated action with tiered confirmation guardrails (10+ and 50+ messages) +- **Delivery timeline visualization** -- an MUI Timeline-based detail panel replaces the plain table, showing color-coded delivery events (green for delivered, red for failed, amber for quarantined) with timestamps, event names, actions, and detail text +- **Partial failure resilience** -- the combined backend endpoint handles permission failures gracefully: if quarantine access is missing but trace works (or vice versa), partial results are shown with a guidance banner explaining which data source failed and how to fix it +- **Guest UPN encoding** -- sender and recipient addresses containing `#EXT#` are automatically encoded for Exchange Online API compatibility + +The navigation is restructured with Troubleshooting as the first submenu under Email & Exchange, placing the most commonly used tools at the top. The standalone [Quarantine Management](#quarantine-portal-manage365-v5130) page remains available for all-tenant bulk monitoring and filtered export. Message Viewer and Mailbox Restores are relocated from Tools to Troubleshooting for better discoverability. + +### Quarantine Portal (Manage365 v5.13.0) + +Manage365 extends the upstream quarantine list with a Defender-style portal experience while preserving all existing quarantine, trace, EML preview, and allow/block workflows. Exchange Online PowerShell (`Get-QuarantineMessage`, `Release-QuarantineMessage`, etc.) is used throughout — not Microsoft Graph or Defender REST quarantine APIs. + +**Quarantine Management page** (`/email/administration/quarantine`): + +- **Server-side filters** mapped to supported `Get-QuarantineMessage` parameters: time range (default last 7 days), sender/recipient, exact subject, quarantine reason, release status, policy type/name, and message ID +- **Post-filters** for partial subject match and sender/recipient domain (applied after EXO returns results, with UI guidance when active) +- **Paginated grid** -- 100 rows per page with auto-pagination; `fetchAll=true` available for API consumers needing legacy full-dump behavior +- **Shared UI module** -- `src/components/CippComponents/quarantine/` provides filter panel, grid columns, detail panel, bulk toolbar, and row actions used by both Quarantine Management and Email Troubleshooter +- **Lazy detail metadata** -- extended message details and authentication summary load on row open via `GetMailQuarantineMessage` (not during initial grid load) +- **Export** -- filtered CSV or JSON download (up to 5,000 raw EXO rows, with truncation warning) +- **Bulk actions** -- release, deny, release & allow, delete, submit to Microsoft, block deduplicated senders, export selected rows +- **Preserved actions** -- EML preview, message trace, Threat Explorer deep link, preset column filters (Not Released / Released / Requested), and all row-level allow/block/release operations + +**Backend (CIPP-API):** + +- `Build-CIPPQuarantineQueryParams.ps1` -- shared filter mapper, post-filters, EXO retry/backoff, display normalization +- `ListMailQuarantine`, `GetMailQuarantineMessage`, `ExportMailQuarantine`, extended `ExecQuarantineManagement`, `ExecEmailTroubleshoot` +- `ExecMailboxSafeSender` -- backend endpoint for mailbox safe-sender list (API only; no UI yet) +- AllTenants cache paginates up to 5 × 1,000 rows per tenant (30-day window) +- Feature matrix and API limits: `CIPP-API/docs/QUARANTINE_FEATURES.md` + +**Not supported / limitations** (honest API limits, not faked in UI): + +- Sender/recipient display name filtering (EXO list API) +- Sending IP on quarantine list (message trace only) +- Attachment/URL sandbox verdicts in list (EML preview when available) +- Threat Explorer in-app (external deep link only) +- Release to specific users and mailbox safe sender (backend/API only) + +### Reliability & Performance Hardening (Manage365 v5.15.2) + +A full-app reliability audit of both repos (frontend and API) with fixes for the highest-impact bugs found: + +**Quarantine & email troubleshooting:** + +- **Quarantine outage fixed (module export bug)** -- the quarantine helper functions (`Invoke-CippQuarantineExoRequest`, `Get-CippQuarantinePagedResults`, and friends) were co-located in one file, but CIPPCore exports functions by file basename only, so the upstream module split (entrypoints moving to CIPPHTTP/CIPPActivityTriggers) made them invisible to every quarantine endpoint -- breaking quarantine for all tenants with "The term 'Invoke-CippQuarantineExoRequest' is not recognized". Helpers are now one-function-per-file so they export correctly +- **Post-filter pagination no longer drops rows** -- when subject/domain post-filters are active, every match from a scanned Exchange page is kept (previously matches could be silently skipped when a page filled mid-scan), and "more pages" is reported correctly even when the raw-page scan limit is hit. Covered by new Pester regression tests +- **Bulk quarantine actions endpoint repaired** -- fixed a PowerShell parse error (`return switch`) that prevented `ExecQuarantineManagement` from loading at all, and missing message identities now return a clear 400 instead of an opaque failure +- **Accurate HTTP status codes** -- quarantine read endpoints previously returned 403 for every error (including Exchange throttling); only genuine authorization failures return 403 now, everything else is 500 so retries and monitoring behave correctly +- **All-tenants cache dedupe** -- cache rows now use deterministic keys (hash of tenant + quarantine identity) so re-running the sync upserts instead of inserting duplicates +- **Stale dialog data eliminated** -- opening a second message trace or EML preview no longer flashes the previous message's data while the new request loads + +**Frontend:** + +- **API result severity fixed** -- structured API results were almost always rendered as errors in dialogs and wizards due to a truthiness bug in `CippApiResults`; success results now display correctly +- **Wizard crash fixed** -- wizards with conditional steps (`showStepWhen`/`hideStepWhen`) could index past the visible step list and crash; navigation now clamps to the filtered list +- **React Query v5 compliance** -- the removed `keepPreviousData` option (silently ignored) is mapped to `placeholderData`, and is now opt-in to prevent cross-tenant data flashes +- **Tenant-scoped cache keys** -- alert configuration and Dynamics 365 pages now include the tenant in their query keys, eliminating stale cross-tenant data after tenant switches +- **OAuth popup cleanup** -- navigating away mid-authentication now tears down the `BroadcastChannel`, the 10-minute timeout, and device-code polling instead of leaking them +- **Quarantine page render performance** -- the filter form subscribes only to the fields it needs instead of re-rendering the whole page on every keystroke + +**Backend:** + +- **Mailbox details endpoint surfaces failures** -- `ListUserMailboxDetails` returned HTTP 200 with empty data when Exchange/Graph calls failed; it now returns a proper error, and the tenant-wide user list is fetched lazily (only when Send-on-Behalf or internal forwarding resolution needs it) +- **OData injection hardening** -- group lookups in SharePoint guest-invite and member endpoints escape single quotes in user-supplied identifiers +- **Repo hygiene** -- removed 53 stray macOS duplicate files across both repos, including two duplicated live API endpoints + +### Organized Navigation + +Deeply nested navigation menus that group related pages together, reducing menu length and making features easier to find -- External Access with External Access Wizard and Sharing Troubleshooter; Email & Exchange Troubleshooting with Email Troubleshooter, Quarantine, Message Viewer, and Mailbox Restores; Groups with Group Templates; Users with Offboarding Wizard, Risky Users, and Guest Users; Business Voice with Phone Numbers, Call Queues, Auto Attendants, and Dial Plans; File Management with File Search, File Browser, and File Transfer; and more. + +### Bulk Domain Migration + +Migrate users and groups from one domain to another in bulk -- a common need when clients rebrand or consolidate domains. Available from two entry points: + +- **Users page** -- select users, choose "Change Domain" from bulk actions, pick the target domain, and migrate +- **Domains page** -- click "Migrate Users to This Domain" on any verified domain, select a source domain, then pick which users and groups to migrate + +The migration changes each user's UPN and primary email to the new domain while automatically preserving the old email address as an alias so inbound mail delivery is not disrupted. Groups (M365 Groups, Distribution Lists, Mail-Enabled Security Groups) are supported with an opt-in toggle. Conflict detection checks for address collisions before making changes, and per-object results report exactly which items succeeded or failed. + +### Integration Templates + +A template-based system for creating app registrations in client tenants, designed to streamline the setup of third-party integrations like UniFi Identity, Datto, and similar services that require Microsoft Entra app credentials. + +- **Prebuilt templates** -- ships with ready-to-use templates for common integrations (UniFi Identity included) with correct API permissions pre-configured +- **Custom templates** -- create your own templates for any integration, selecting from a curated list of common Microsoft Graph permissions +- **Multi-tenant deployment** -- deploy the same app registration to multiple client tenants in a single operation with orchestrator-based parallel processing +- **Credential display** -- after deployment, credentials (Application ID, Tenant ID, Client Secret) are displayed in a table with individual copy buttons, show/hide toggle for secrets, and a "Copy All" button for bulk export +- **CSV export** -- export all deployment results including credentials for record-keeping and documentation +- **Secret expiration** -- choose secret lifetime (90 days to 2 years) during deployment; longer expirations reduce maintenance overhead +- **Built-in template protection** -- prebuilt templates show a lock icon and can be duplicated but not modified or deleted, ensuring reliable defaults +- **Automatic admin consent** -- app role assignments are created automatically, granting the configured permissions without additional manual steps in the Entra portal + +Located under Tenant Administration > Applications > Integration Templates. + +### MCP Server (Manage365 v5.32.0) + +Model Context Protocol (MCP) support for internal team use — expose CIPP's read-only API surface as tools for AI clients, without Craft/SSO hosting changes. + +- **API client toggle** -- enable **MCP Access Allowed** per API client; warning copy explains the blast radius; table column shows which clients are MCP-enabled +- **MCP URL chip** -- Application Settings / API clients surface `…/api/ExecMcp` for connector configuration +- **Backend** -- `Invoke-ExecMcp` (Streamable-HTTP JSON-RPC), OpenAPI-projected `.Read` tools, `MCPAllowed` check against the ApiClients table, per-call RBAC via `New-CippCoreRequest` +- **Feature flag** -- `MCPServer` ships **disabled**; enable in Feature Flags only after deploy smoke (`tools/list` + one `.Read` tools/call) +- **SWA-safe auth** -- MCP client IDs added as EasyAuth audiences on the Function App host path; CIPPNG/SSO EasyAuth rewrite not taken +- **Tab hygiene** -- removed 404 Super Admin tabs (CIPP Users, SSO, Container Management); full container UI remains deferred (Craft bridges) + +Intake notes: [docs/upstream-sync/MCP_INTAKE_20260803.md](docs/upstream-sync/MCP_INTAKE_20260803.md). + +### Baselines (Manage365 v5.33.0) + +Drift-first **Baselines** engine from upstream 10.8.x — parallel to Applied Standards, not a replacement. SWA-safe (Durable Functions + Azure Tables; no Craft). + +- **Pages** -- Fleet overview, alignment, and templates under `/tenant/baselines` (nav entry commented until smoke; open the URL directly) +- **Backend** -- baseline modules, orchestrator (`Start-CIPPBaselineOrchestrator` on the standards processor), HTTP List/Add/Run/Stage/Override/Alignment APIs, and `Config/BaselineStandards/**` definitions +- **Feature flag** -- `Baselines` ships **disabled**; flag gates the **scheduled 12h timer** only. Enable in Feature Flags after orchestrator smoke, then optionally uncomment the Standards & Drift nav item +- **Preserved fork standards** -- Applied Standards / drift UI and Manage365 scoring workflows are unchanged + +Intake notes: [docs/upstream-sync/BASELINES_INTAKE_20260814.md](docs/upstream-sync/BASELINES_INTAKE_20260814.md). Checkpoint: [docs/upstream-sync/SYNC_20260814.md](docs/upstream-sync/SYNC_20260814.md). + +### Backend Enhancements + +- **Stack overflow protection** in Intune policy comparison with depth-tracking recursion and O(1) index-based lookups +- **Thorough mailNickname sanitization** in group creation (M365 spec compliance: extracts local part, removes forbidden characters, enforces 64-char limit) +- **Enhanced CippEntrypoints** with function-existence validation before invocation, detailed error logging with stack traces, queue trigger support, and Premium SKU FanOut mode +- **Durable SDK 2.2.0** with fan-out/fan-in/fan-out orchestration pattern for DB cache collection +- **Channel filesFolder batch-fetch** -- Teams detail API returns per-channel SharePoint siteId/driveId via Graph batch requests, enabling direct file browsing for private/shared channels with their own SharePoint sites +- **SharePoint REST auto-elevation** -- when adding members to non-group-connected sites (Communication, classic Team), the delegated token may lack site-level permissions. The endpoint now auto-elevates the SAM user to site collection admin via CSOM `SetSiteAdmin` (app-only admin API) and retries, with a final Graph API `drive/root/invite` fallback if CSOM is unavailable. Eliminates the manual "run CPV Refresh" step for most SharePoint member operations +- **Quarantine portal API (v5.13.0)** -- shared `Build-CIPPQuarantineQueryParams` helper with EXO retry/backoff, post-filter pagination metadata, export cap semantics, and Pester tests for query mapping and endpoint response shapes (`Tests/Tools`, `Tests/Endpoint`) +- **Selective user edit body** -- only sends properties that are explicitly set, preventing accidental field clearing during inline edits +- **License backfill integration** -- missing licenses show formatted names immediately with asynchronous API backfill for accurate display names +- **Applied Standards API hardening** -- `{ Results }` wrappers, `excludedTenants` corruption repair, missing `standards` key auto-init, live `TemplateList-Tags` expansion for Intune and CA partitions, and run-manually standards included in compare +- **Power Platform Administrator** role included in GDAP role sets + +--- + +## Upstream Integration + +Manage365 tracks the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) (the successor to the split `KelvinTegelaar/CIPP` and `KelvinTegelaar/CIPP-API` repos, whose intake history is archived under `docs/upstream-sync/history-cipp{,-api}/`). Upstream changes are merged **selectively** (cherry-pick / surgical port), not via wholesale merge or GitHub “Discard commits” sync. + +**Formal process:** [docs/upstream-sync/PROCESS.md](docs/upstream-sync/PROCESS.md) — cadence, triage rules, checkpoint docs, version bump, and deploy checklist. + +| Cadence | When | Focus | +|---------|------|--------| +| **Light delta** | Monthly | Low-risk bugfixes, JSON data, tests | +| **Major cycle** | Quarterly | Full delta inventory + dependency review | +| **Feature intake** | Backlog | New capabilities (e.g. SSO) — design first; MCP intaken in v5.32.0; Baselines intaken in v5.33.0 | +| **Hotfix** | As needed | Critical upstream security fixes | + +Start a cycle: `./Tools/Start-UpstreamSyncCycle.ps1` (single repo — frontend and backend move together). + +All intakes are **selective** — upstream fixes and improvements are ported surgically rather than merging whole files, so fork-specific behavior stays intact. + +### Taken from upstream (v10.8.5 — August 2026) + +| Intake | What changed | +|--------|----------------| +| **Major delta 10.8.5** (v5.33.0) | Secure Score report API + AllTenants helpers; Intune MAA requests + BitLocker search page; nested ListRoles / TABL; `ExecSetDefaultMFAMethod` API; ConversionTable / M365Licenses; selective standards hardening | +| **Baselines feature intake** (v5.33.0) | Full baselines engine + FE pages; FeatureFlags timer **off** by default — see [Baselines](#baselines-manage365-v5330) | +| **Partial** | Branding list/presets APIs and community template catalog (Manage365 branding UI and full community-repos rewrite deferred) | + +**Still deferred from this cycle:** Node/jsdom engine bumps; full BEC/user-detail rewrite and Default MFA UI wire-up; full branding settings JSX replace; SSO / container / Craft family; Teams V2. Checkpoint: [docs/upstream-sync/SYNC_20260814.md](docs/upstream-sync/SYNC_20260814.md). + +### Taken from upstream (v10.7.5 + MCP — August 2026) + +| Intake | What changed | +|--------|----------------| +| **Light delta 10.7.5** (v5.31.0) | AzBobbyTables 3.6.2 + large-entity table wrappers; Intune template drift helpers; group `disableNesting`; device Add-to-Group; snooze reason; partner webhook hostname warning; audit log V2; SAM `RoleManagement.Read.Exchange` | +| **MCP feature intake** (v5.32.0) | ExecMcp stack + OpenAPI tool projection; API client `MCPAllowed` UI/API; SWA-safe EasyAuth audiences; Super Admin 404 tab removal. Flag off by default — see [MCP Server](#mcp-server-manage365-v5320) | + +**Still deferred:** Teams V2 module migration; container management / logs / worker health (Craft); instance SSO / CIPP Users pages (SWA-incompatible EasyAuth path). Checkpoint: [docs/upstream-sync/SYNC_20260803.md](docs/upstream-sync/SYNC_20260803.md), [docs/upstream-sync/MCP_INTAKE_20260803.md](docs/upstream-sync/MCP_INTAKE_20260803.md). + +### Taken from upstream (v10.6.1 intake series — July 2026) + +The July 2026 cycle absorbed the upstream 10.6.x line as a major delta plus nine +dedicated feature intakes (checkpoint docs in `docs/upstream-sync/`): + +| Intake | What changed | +|--------|----------------| +| **Copilot & AI** (v5.18.0) | Copilot & AI management pages and menu section | +| **SAM certificate auth** | Certificate-based SAM authentication support (API) | +| **SharePoint suite** (v5.19.0) | Upstream SharePoint improvements merged into fork's site management | +| **BEC UI family** (v5.20.0) | Compact accordion check cards, inbox-rule change auditing, Sent Messages check, Trusted & Blocked Senders check (fork implemented the missing backend data producer), updated PDF report; fork's rich page states preserved | +| **Exchange/Mailbox family** (v5.21.0) | Mailbox Access card, proxy-address drift (Source column), mail-enabled security groups in permission pickers, SMTP Auth chip on the Exchange info card, report-DB mailbox permissions page; guest-UPN retry logic preserved in `ExecModifyMBPerms` | +| **UserActions + nested groups** (v5.22.0) | Policy-aware TAP creation form, pre-selection + no-op guards on Sign-In State and Source of Authority actions, users-and-groups member picker for group edit (nested group memberships) | +| **MEM devices + component fixes** (v5.23.0) | Shared `CippIntuneDeviceActions` (built from the fork's richer action list) consumed by both device pages; defanged-URL rendering fix; bar-chart tooltip fix; AllTenants tenant-scoping fix on row actions; stale dialog results cleared on reopen | +| **Scheduled edit + dashboard alerts** (v5.24.0) | Dashboard Alerts card (active + snoozed alert instances with per-item snooze), schedulable user edits via new shared `Set-CIPPUser` (API), bulk API results rolled up per action with an X-of-Y summary alert | +| **Odds & ends** (v5.25.0) | Menu section permission fixes (Device Management, Transport, Spam Filter, Resource Management), top-nav tooltips + shortcut hints, Next.js build-trace skip (~67s → ~24s builds), dependency bumps (react-query family, apexcharts, mui-tiptap, reduxjs/toolkit, dompurify as direct dep) | + +**Deferred from this cycle:** the SSO/CIPP-users family (architecturally +incompatible — upstream's implementation depends on a container runtime and +EasyAuth migration that don't exist in the fork's Static Web Apps + Function App +deployment), Custom Test Alerting overhaul, Purview DLP standard, +Intune policy sync, Sherweb client changes, and assorted small items listed in +the checkpoint docs. (MCP was deferred here and later intaken in v5.32.0.) + +### Taken from upstream (v10.5 / v10.5.1 — June 2026) + +| Area | What changed | +|------|----------------| +| **Applied Standards** | Corrected compliance scoring math (ratio-based combined score, capped at 100%); license-missing filter includes `LicenseAvailable: false` standards; template lookup respects `{ Results }` API wrappers; removed debug logging | +| **Policies Deployed** | CA template GUIDs resolve to display names via `ListCATemplates` | +| **Standards API** | Compare includes run-manually templates; `ExecStandardsRun` accepts `templateId` or `TemplateId`; CA `TemplateList-Tags` expand from the `CATemplate` partition | +| **Universal Search** | `CippUniversalSearchV2` in top nav (hybrid — frosted-glass header preserved); legacy `CippCentralSearch` removed | +| **Dashboard** | Dashboard v2 only; v1 and History tab removed with redirect | +| **CippDataTable** | Virtualization, schema-key column cache, regex filter fixes, off-canvas click guard — mobile card view and quick actions preserved | +| **Identity / Email** | Group-based licensing; alert-only license exclusions; quarantine deny fix; dual-schema CAS mailbox endpoint; autocomplete and report-builder `tenantFilter` fixes | +| **Auth / CI** | OAuth broadcast channel for reliable popup completion; superseded SWA deploy cancellation | +| **Dependencies** | Low-risk package bumps aligned with upstream 10.5.1 | + +### Preserved Manage365 customizations + +- Dual **Run Standard** actions and drift-template workflows on Applied Standards (not replaced with upstream single-action tenant selector) +- **LicenseAvailable** warnings and scoring UI on Applied Standards +- `createDriftManagementActions` and fork drift logic on Applied Standards / Policies Deployed +- `{ Results: ... }` API response wrappers and fork hardening in standards endpoints +- **CippDataTable** mobile card view, lazy-load pagination, and `mobileQuickActions` +- Dashboard inline universal search (mobile landing-page search kept alongside top-nav search) +- Fork `excludedTenants` corruption guards and missing `standards` key auto-init in `listStandardTemplates` + +### Deferred (not merged) + +Full-file replacements for Applied Standards, CippDataTable, top-nav, and `package.json` were skipped where they would remove the items above. Worker health / container management UI and SSO migration repair remain deferred (Craft bridges / EasyAuth migration). MCP and Baselines were intaken with feature flags **off** (v5.32.0 / v5.33.0). From the 10.8.5 cycle, Node engine bumps, full BEC/user UI rewrite, Default MFA UI wire-up, and full branding JSX replace remain deferred Adapt work. + +### Version tracking and out-of-date alerts + +Manage365 tracks **two** version numbers: + +| File | Purpose | +|------|---------| +| `frontend/public/manage365-version.json` | Manage365 fork release (shown as the primary version in Application Settings) | +| `frontend/public/version.json` | Upstream CIPP baseline absorbed — used by `GetVersion` / `GetCippAlerts` to suppress false "out of date" toasts. The container image build overwrites the exported copy from the `APP_VERSION` build arg. | + +After each upstream intake, bump both and redeploy: + +```powershell +./Tools/Update-Version.ps1 -UpstreamVersion 10.8.5 -Manage365Version 6.0.0 +``` + +Then **build the container image with `APP_VERSION=` and deploy it** to the App Service container. Until redeployed, the settings page may still show old versions. + +Out-of-date toast notifications compare your deployed `version.json` / `version_latest.txt` against the [CyberDrain CIPP monorepo](https://github.com/CyberDrain/CIPP) releases. They clear once your deployed baseline matches upstream (currently **10.8.5**). + +### GitHub "Sync fork" button + +This is **separate** from in-app version alerts. GitHub compares commit history between `Celeratec/Manage365` and `CyberDrain/CIPP`. Selective cherry-pick intake leaves the fork hundreds of commits "behind" upstream even when you have absorbed the relevant changes — GitHub will keep offering **Sync fork**. + +Options: + +1. **Ignore it** (recommended for day-to-day work) — the badge is cosmetic when you cherry-pick intentionally. +2. **Merge upstream periodically** — `git fetch upstream && git merge upstream/main` (resolve conflicts, preserve fork customizations). Clears the behind count but is a large merge. +3. **Do not use "Sync fork" → Discard commits** — that would overwrite Manage365-specific work. + +--- + +## Technology Stack + +- **Frontend:** React / Next.js 16 with Material-UI (MUI v7), static-exported (`frontend/`) +- **Backend:** PowerShell on the [Craft](https://github.com/CyberDrain/Craft) container runtime (`backend/`) +- **API:** Microsoft Graph API (including eDiscovery API), SharePoint Admin API, SharePoint REST API, Teams PowerShell cmdlets (via `New-TeamsRequest`, including meeting branding policy management), Power Platform BAP API, Dataverse Web API, NinjaOne API (via CIPP extension) +- **Hosting:** single Linux container (Azure App Service) with Azure Storage (tables/queues/blobs); Azurite + Docker Compose for local development (`build/`) +- **Auth:** Azure App Service EasyAuth with in-app user/role management +- **Data:** React Query for caching and state management + +--- + +## Acknowledgments + +Manage365 is built on the [CIPP](https://cipp.app) open-source project created by [Kelvin Tegelaar](https://github.com/KelvinTegelaar) and the CIPP community. We are grateful for their foundational work that makes this project possible. diff --git a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 index 81e58f4fa6..2503cfa775 100644 --- a/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 +++ b/backend/Modules/CIPPHTTP/Public/Entrypoints/HTTP Functions/CIPP/Core/Invoke-GetVersion.ps1 @@ -10,6 +10,34 @@ function Invoke-GetVersion { [CmdletBinding()] param($Request, $TriggerMetadata) $CIPPVersion = $request.query.LocalVersion + $CleanupStale = $request.query.CleanupStale -eq 'true' + + # If cleanup requested, remove stale version entries first + if ($CleanupStale) { + try { + $VersionTable = Get-CippTable -tablename 'Version' + $AllVersions = Get-CIPPAzDataTableEntity @VersionTable -Filter "PartitionKey eq 'Version'" + + foreach ($ver in $AllVersions) { + # Remove entries with very old versions (before v7.0.0) or invalid versions + if ($ver.Version) { + try { + $semVer = [semver]$ver.Version + if ($semVer.Major -lt 7) { + Write-Information "Removing stale version entry: $($ver.RowKey) = $($ver.Version)" + Remove-CIPPAzDataTableEntity @VersionTable -Entity $ver + } + } catch { + # Invalid semver - remove it + Write-Information "Removing invalid version entry: $($ver.RowKey) = $($ver.Version)" + Remove-CIPPAzDataTableEntity @VersionTable -Entity $ver + } + } + } + } catch { + Write-Warning "Failed to cleanup stale versions: $($_.Exception.Message)" + } + } $Version = Assert-CippVersion -CIPPVersion $CIPPVersion diff --git a/frontend/public/Main logo -CMYK.png b/frontend/public/Main logo -CMYK.png new file mode 100644 index 0000000000000000000000000000000000000000..3a6dbf12116c59c4338f392c9eab42f816ae65cc GIT binary patch literal 99166 zcmeFZcUY6@wl<#7f{I{4L8Mthk={ZHs3^!Ny+nEqMG!)70?9DShzg^OVxfqjLLx;4 zL28si#s;+#kK)YM-HB_(3%v|8QTD zTKqvWe2>8xo5quU{6a|4ioT@4;4s4a@%rZVioyPb^+a7O4J)!4DJXbPVkF5S(b~~3 zF~rZnf4!;6V&iy2FmR9*?V}ifFf=U6FrKg;wQC5UksqtCS45XYhY;59x3X0<3y&lz z>Z<9gX{qMx_0Sks^ktD=Xj^W{< zg!Ma++)=drhyN6{bkwvJm5IS&{^4;^TmJqOX_rqliLhQvLrYIpLsL~l-%(T7P)plT zTSrwxPebFc#a7||!2t>XYO%I~p%${(@W<7VUj9DOKL5q_R#t}gq%i+rprMD?Gc(uJ+_iIu z-fpd3c)Y&Z?j2@3bu{#Uu<_%wd@k@0_X87uxztdTq-UV1=c}jc@2{_|O7hduR`t=; z(pS~jCh2OBwEZ+S{qa8-v5C`nX!+~tX=|Y-et@u{L$pt1bPU-xGCUwS6aqpd`TmDB-@@z=#IUh8-^ll*Ftju?`|D6q z_7*!8Eq9ygX&UJ1scNZd{?l3{+~^@mz|H?Dq>v0jA_{Rt;Z0c2w}t+EKf)`aF$fyq zJQ^D6KYZu%pM3X^ubjeyA$|B>Mon5C^a&&pgZ-m}kb~*)L->zx_L0H@k*_p0wfK7> zDQSp$#Q{nWxaEf*+XlyzLig_q1`tM}NBqkm`V{)L%MV}w-6-NCM|k!-od4!1Elqyz zxuWGm(HOWOIygF%gcOr+Jl1^)DXi^pRhncpz8OuF|qOq4pR&b4-7X} zM~Y5p@HZ3azrNcrR{z@u#(-c*v|Xgg;8>Esd1UxObX&9>7zY0fq-$yU`S|E-;#Ktm zbo>#d>!}*}>1(O_Y3ulF_-o^ReDHoKL=^cpAld#(T_julAzS{tHp2g}XyDsHBL5BB zsH0x`=7&AOQ9!B*Klt8(6!CZ8qyA9@qfqY*ef;={jq(BS@vr^;tAFJ@ypDzsiKMBo z>Z7Hnp{k=9V4#Y}gD>^<^?dbpeKdi7zd7%_mAD`hB!rfRCQ!AmsC7W{$$R7fVP zujl*a8v;Xv|8K6X??(#IhO4Ri>ig=b`UU7{srqObXsG&<3`qKTEu8>e9e%F;b&l`X zMyiaas+NJHrlz5ewxNcmiiWPCHlND=TKxZc?SD}W|9bepd1Jruuvk)L^gjoi>=Wq& z`jQk0Wh?-aNb$!qP7aTX=IcSl=ju1>*%ZcYWQfXl6-uiR2XRZX#4&f zZbOp%2ghsuKga*Kipqakd;Z0F{|52@`;I5`HS9l8(m(TiKtM2Py#z(u7~jy~s320L zqL!kTnx2~OzhSZ;x||;ymv04*FP6TSd1H0HAo@WF@E82h(t{r0{|rV2Fmq7MZBm&KY~|SG%v!zt%bV`oP|)-1aDw z!KD1bkGX>s-CSp_#6~HtR}HJri{b}2EV1rZSsfbvBPA!t=N}iWQ@WiIe_B_^dC#f!S#B?WcFcNsei=b+!{hU>c+JVom1#}(F-aJi z{G|hpQlZ_pZ?ukAY-mxIH|tsH9-#8|wwW|{Su*|7ZE?nR>>zQK>a8VG7oKoR%&Uhg z9F?A*-^1wMQnl;isL1)%dkHE9QJ*pWF<)sRUES#>N8`55W0oEXY)rH_eFW2`MdUp$ zQ5cNc2IRlk_{*lT7>pvua@P*W_}r16gep?-j=pgl&KoV8XFp$BFjh}pGanV1+ith3S@%lXZyAY<*=M_QUbAF7K2ve)rQ=pvPNz-B zoOWDcvuTOrgz1ErhV)Kaz@7B!I{M4o<8jTiPo5T82%_UI3}&k4xjF9JXAChP`~71m z_WKG<*e~S+9K~>74Vp z^ovFCq}v_TKslx7>P$sXyTe!Bm*|D7U(|8)1y9?3cm_o>)7Ph`)Qc#lWqQo+*&H{K zg~G(FZX|hG8?=#UDOo;*@b>ZrtC)KBBz=-jcM5b09ADsk@u7B)e~t}XQR_cFnZ+D; zYId8iU}r5AfM>kZ(R{`ACidns+a2Z#Jd<6Gh|{Sb#s;5v8w>@8bGI8+EQ@#Gq;}ud zWvSClD|!QD;W@?*Ut~)LwJKjM>^W^Am_P=|JO<%glM!MkiC-K*TQZXZ2P zq6~JTWFx$Yp_JXq*Y7+qxR~eWToW`{y0Dh0Fa4@@OI&SYh*6DD!)Nc9fZ1&$~K1?vUq|XQFYUag@x-VDDyzJMwHjs`kMND;=cj63>9vA4nu}{U+9ggK~!#|ddOUH$q-M8=YwCU<) zV=l>`pD54#ndz8n-&mX1Dco?G`;g=+x5gEq%Ak^99}FYEGGD*IIoX4Anwh|4(w|%C z-C0F;;pDR`=!4Gc`>!yQ?rnw*$WKtF*7zf_*S&)KhJB0aK~Htd)6`jPox7LbSL*59 zcqMUEtE|^Z4-iK=h(eaJr8-}~h9>XOQ)XCicrbK%Zge_*+PT@50N6}5sfC(BQRN@Q z5>|H7nu_c8#-y`1GYbptG};VzH@LIlLSxi$G9MHxeWzKxW3-C$rb_OJ>|D!r?siTcyM`{M_M9E# z2Za>Vm4$`}9|kyZHnQQST5^76-}5`>ts-0I=|G5?u1KxfM}OFcxS>)3bp!cu+2G?f z%y~M_QNN;G|CZ>jXD8XCOa;e|vXta=&N(Nn0G8hBXzH-e0;@Q^HW+Cpa-OhV{f@C1 z2~nI}_IoDJ;|ghlK@iC|P*1I5t7E5uh#*Anex2H20T z?`CM$6?0qI7tRE8UO&}@b;o_+56pJB{d2ZToM{08kHe=}(0DGY%v854OgG##d`(`w z23aL*3(L%nh_k%?F@5YOu&q#iNus%te&XDKR#~Rl82E^_5xqCw8-=?kv$>+Fr0z8= z-I!#-xxlmmy3{vsLu`IVohiEvY>u+^nA!9TV(r*_@m8D?HqYw{bC$o#7u`AZHmBis z7)OCV>!|j&+?x*Yunv|o>mjm!EW&R<$Xvv7lr_@Py zA5o<=SM_*VToFL}$(=lI#5YA>{Ps(uk8O$zec`w3Hil;W1(PGr02HBIYdZD$x`; z>X-=XKRyRcmBKAtI5A9p$4=Q?!O*Mv#148&0K(LAV2IHcfb3eCHR8!h4d65~i)h;S zR%3C0kVYFk-w8jgstb)qkfLx7Ndtz-b;#YWcI+ELnvFuPpscY4t<%}mW4>w~@@=ml z{E4Y-1Aj2->g6ey>K0hC6k2mhQxmrbyrxqNG(hn{by*T5RIXi54R?wiMK|+1hB5i0 zl{xO11@Wg_Anx);Z4H9UT$q7QruIECWN}7YR2BCe`zZ4Q{qPw>_-^|QjT_}$_}iHiJcNNoNJ75)l;V2j~y1EJYRVCL%Uezq=i zCCv*G_2eA_?Bj+)hqbYrFvB~}{>nUv8^j!sEzawcXb$`y#7ZkPnXNBDs1HC41!=<) z?bxop3)d18IU@*Mk=uE%MZupd1mI7MxxhAcs*%nWtjuXFPTXJZa)sHCdTN#*=tW3n z3mGhZSx+Rcg;ff3W}E@$z;Wd2nFXjb7v0F$A9Rc>&38}!0AZdV(q(R-^Wc6PiVz%3 ztwry*(i?DE=4qR}I|f}fa+iITW&u=qgTLKT)YfSTOrWEe)BGMzX<8KK*8LD#+cwBr zi*&FwB84KREtn8q?)sS7LpMW~Jnd&&GK&BQ@n}>$1CgVVg#mjXnRVP=_G(xp{xi`j zt26~1m2wuKH(`f*z#R)7;KY{CrUu2lhLfkgyTSHBS>i2vrX)UCG+jF`7&+UNn*@>< zGj_xjCnj)4A66wkN3xL8cn{f*HL$QJmrx* z)p!7;C*D$4yhhbTZ4O|;b zxML*OgD9^Z_ePdfh5)*oxcAwQo~mMGYvP=xz|qsFqjL`+M`2KFAh1qZW%9Op+P6d~ zD_P0R0lE_865l;nGmwyxy;0Vy8*MP+o&i_mKczI*^=XwYL`1`{E-*^TuMveyp*CGf zOcv*1k?P%tI5bNfp2n|w17Bif@eqj9?0Q<8W4g#7uybQgqBrLh%C8VERxz56;=hBe zt>C_5w=>ru8^x$qq|mr$5LtnEhOC7K6?YdYIwlo)ExZfj?O5;JzEb(xeRNYfIVgIwCA0`wi5-}XM0rPq1Sh7j}_2J$f{SsKA2mN=jp`vu#d`z zGfW;RE%i0%bsA9jg(7;N&TVH~nAcz`D;jI+;y4e$c_t{AWsniPRF1=iZZmD1`%LSE zDaqq(W`%Q~CW07NMkKnR0v5#33ut4yu%K-64>k^DWYg1i@NgRn;I0}dtIuC2{4^QB zEWECZ2`y}4suO_^)#MQWPkf4pSYayF!A>BNS5}t*;l>+SSByE#v%$S&G(Fn}Q1|x1 z9lEP0-|?6hH5js@Y}vv!E|j*$WOR{*9~i=ntOZoKa#k_3hy^+jgS5dc`m8Ewry?`> z)?@{8YHu${Dl=v?{R4XhvPITCo!$+cGHs6V#azhM6Hpp3Gx2cnM{FaS)H`tDb?b^V zz>nQS%OHTMkC(y%M*gj&8QyQ~U=&!a0@<>r$aBu>GKh~SY!FVR5FlIHOHyhR_rtBa zl6sv8b=>dJ_WOHD! z^rt>R!^8ISd{06mA>3L4ai45x7#P7!0myF$aDHLmL2C~Anp)W4hw}vhJQBjDl(hTV zI&fgm$#?9vkuwsEg-C0onoeU70dtSwD$;lP_W>I1EYEjM9tAq8U7=PkPbA#80`rX0 zfD>?^kyRa!`b{yjeFn@d$1D^}vc~BCM<6%pP8|>6+wS+5*o&AF^++FwcS6131CAU4 zH|b}FVJX?~PL4K+GbH-qSlR8!;iY|{%DFJpAf^nrpLr^$oC_ z8{rmI%b?Jup{I|5$Q-XwyVgsbkKwfUcr_2DE!-rQmb-W~8&=e@$0|I^pnH9}g??l- z&V^IPjCuoz#pLco`3ceZ=`j| z-g1U6EreL$)N`48Bld^@<8+h{XNbMV9E>sU`yyx0)vE7YNOj{BF+Zk7c{eAzaoU*S z&g!MTKprhh!>OThRg+(#=5#}w9m=Zi4cyoN`@aYy5t1j+(-=KR5J~rH}Q)1i>Uz>+KMEQw-L%=N{=DIX^FdI z@}8}RDJ-DyP=z)N<*gBQ6<=WE3*liI=3bimHSwiz zw4rB!_9*C0UOv^l3PmK>vy5g@tu2Hxd2^C&3fFN%No6(%*_nKI#N^}b96JTvECGET zjco^#pl9f;9T?q99}fxK_>TF@M8CWPAp*LxOr+RNDR@<3F_e`bOPR?Q77Y0>odBmK zxpyr*8pPrn_Xe9zixWpql0;9+%7k5}l+a?X1g-BOH_n%*a+Pg!yE!B5Qjp{RZS5GU`lf$^OZAX1fAUmqobQ};yr!W z_tCGOK)tJnrrhFJjrp^7%mLbS+#o}_;#yNZHw}uXp}*OF7Nf~fmSPA z8mTBFRw#RELaJYIYIg8Qie8fIE9GR`)t*$_cYB|T*A*O)uuYk~L$XKM`hM2eMs}?E z9v~_UG{t4JA*Eb7bmpi<4P#4mFy|pN3m{)zw8L=c2_HwSVp&Lw`9+J*P?%2#d1Enef*{!yc%LYsFXoAL}yrA$rvG*FS zlQ@_eM$I0125n0VBpCInrfdP=s3Oq^+K=OR49GX;onq?Y*%JE~lbg0C3o(Jzv-7cx)fHV$5uBnl!lmNUffppT21f_IdXh9!s%s%-<3ok7g zp}sMvo+5<$K(x9MlB1#UX`DfmGZlI=VwtC7@<+Jej!eh!l6;r>5zt`@Z(8KR988VR zXY*{6*(_Q7$$VP^ATQ?x!a&vplur~!hUx0^a#*E5-!rEjYoNG9$t_IYf$^jz$B(H> zFM#=g(zBNC+wTFbcnYd99ii5Gxz7I-Gc~lj_EfLed?(xTVHG#~spd#BBv?sZvJvj8 z)H~{;spcBTIB=R5O7YgJNRC}Z5!+1bkm(U1-hB$(gFvWfNP6ljd=tev#^lhTmt#Gc zNn_utuknCKaKG#Z5|br^?Eubz!CYW!w_~4ene0Lo3F!yB6I2;-#Bn$%@t!I@To!?A zt}7CJiXdnqdH4AjL*jVracDRRp~&?!ed-}st6zVe{}jf&4SU7AyC(N)m3f*X8W^vO zgph@SlpJTK%bsEuz5Y75d@9Y18Rs;OiiO-m{F??r z-E?lOt7``wh>Qmh*73$+USN7WlS%`>k~qoC9O59*kKd;@W*(eo8ii|i8=?`(4Dg38 z%?p&?Y)iOffk!gEC3OmVuEugMJ2p&crU(wZEzFY;j3AF3iB=Qwvp@yq>~t8`)-c*8 zn(0@acrmDZsaa4l$~_4s+xE;;fZaYS{x>`adYkmK$KcpM{6fouNECNY^1Ox)LO_AD(2N@g-V z><=<-_*PUGcZi)0kp()rKr}-TC;N;<79IMc<%kX)BDPxOZkY7M5%~A8m6T? z>30aq9Ooo4J>aNlHDEoM6kZ9>qSNdq({$c(PA13?b%0L==rB2OZA#26+ivu@zxVGQ z6)8dJhQ9m_;h{Ix+;QfsA~*bRy>|0EIllvJ4n~WOke~paW5yAO*;~`1@MjmU=ec1# zjgb4*Mj{!8j!2c9!^_%bdhSxcJU9SE(QT2=NV%RA^6)WTiddj`>xdwm1jT)L2tdGk z!1pM$(ODJp26btI@Aq&_=~tb3etHE;+i*PcTR{JFT6l?xPxKPpy(@Ld3k0+s#+&e)M(bRJ zw5s1t6gUjrg-PQe&`z*8um6{%{eZc_*K4{N_ovn{r;lgCHkkzoF?$~aqsA4%o@WW6<{1lubHl_nqe2mCoWsj$8PtRjDxEBwpuZ-1zMr~T4ql8?~U1vkr#xfX+ zrpwK>?1!xCVW-n(onhA75^Lz*lXT9xSqlw>uk~8wC1LI|{j#QjXd$=Z+suRX@wgd@ z0f2ZOv&ON&Z62m!x1N7wc2vMH6;-{&_F=*DM0|l0@#1_*5g&Y5H2z-G0;1EYPKW>`dl7P5*eA zPl3_R#CM6k@l2qA5kZuhlY^$yCu~ZalB1W*K6}bO2wirE=atjyM=D!k$E_eXagLp9 zU`I|hB=_y7AcDUQ;Afuz-(BTqvsYTwRF1p5&IfTC*kyn_7C7gEQ=c87GVf|#e@6V? z7KNgjBILCPB^l{>N>ZBY#)no)&Qe*K*n1Fhx^o;o-_9eIEI!+2M85!u;DHvB ztVggd2JwA@567vZz`F|xA0 zQMUkNNdh|puir~DV?BR=&w)l}R0?x(6^94gSpAoLS*MShgDgD{<G9j}+{BO10o_w#d+Q(F`LY0AxF6^hiy}YFLNx@|jB^$;WQ|{l^g9Am74o>XJYt9)#qbH7tR)#zX z(719>`#eJ3VF&hOrVWx&%uTReCKFPohMP5dytABuPj?u;!CnF&7Qfn_4G&HryON(IAk)kdtLX>*yd4n< zoV#qqYb7nI-p$>OjqglG#V{#Jp-Znm5rm;H7ZEzFi+q4;LWs>def0VhVg1F1?v0Jy zBS0$A(PE7Il}Sa9(`X7MCR_9cLhA#G5*}AhE8qn%3`I1Ijf2l=Fm=3R$tjQR%}(A6 zPSNWoh^BnY&CVQD#_Q`>?J2 z?;!&<_pdril;#_tyRAoN*c5{AG?!Q7RG?FLc;(w0?32t%+Vp4>ZY?DhQI2keE8Gvp z*KVkKy7fFg0mmb=zuH3tlG=(QXPTF)(Nmfd=b%O#8;W>WK+Q1%ulq37ow7>CT=NWW zWvG0-!Yrc^kwFV3?H-y*IH<-kv>In1u^(J@NLR8 z6xyB`MBT{h^s0j3Olrv?24-clYCZN7nz#b#JWLzR!7Kn5m)K`U-&~1|C$DH5-wQUD zAPm9Sfey5#L#Kn=yg~*a_)X;$G3#lw&>R9b@hO9Osdrv6&!x_$rf}wq+$gEgNc1@p zu5*6@wU$#*)|3LqkrK<;(T@lg>G3F<5wd*)tqwZD`O$_+^;%c>jiA)rxCP-(`5wVT zzw%zR7o3Dy!rh454l&gzT7N_30P-e1kyDGj(Q#h~-00}l0P)Pq?4QYlhlyqRwpL6z zx|h-T+>-XSGQx8=dx!#ao-sA-X%(AOL?7T76d(8)kuw&(7usTMfKY4ljO=&|;DxqE~}3$=}q z5!pXKp;cz0VR&R9uJ@~y`_05eBbx;UE-`iX7>!r}$1I3^&_ca2TF-YNA>@oE&-8Cddj6i-c`GXDkx4ArlcnXm5Q?)F#`^}Hn&aUI@dVrm zh%orYgEI%@;c$`TPa%28{Da}AOHKUXVDExBXGyM)%jf(0+KqTWhg45~nV8S)H%;kg zpAHkCAivKfMU)5|?0eq=vR2Ql0jBF{%Za0cF^m}U($cxlxGv3as+PT|Xajy-{_FNt zZ`%?l?@2iyyMXZyer6N`(TbWB3a{>X#FDa(G?!lNz^ah7kkdF>zCb z&>Yp!%Zfi=^j!T)XvZ?OU-#^|xc?Ws7hg*U$_ESwhK7#+OsO3>;(OF};1ND*_nH?c z?E-%{`f0zv%B!4*S8i-xx0kn2ds_2ew9?0N_(cNlys-^o(J$qRf|gfHCkcZu*37o^ zV&nvh?Q%nzg@f5Iu#Xctrj(9f#-51Cd4*JcIGp+0M$1#&bAp&t8!ev+(R5wS821Z} zs&;r`nxqYP`bo9k7h_E_=pWy_<;lzn^kuyD4@fT{KASltRJ$em7jxYuHap0}sg3^OJ)CNdUcYVJDZb+fDaLpM`$$wCX}abgVf zwYq&sm58#)jjh`+yHs!u9AGE*3L6aKv(0OymuB4n$(f0hG=ji5X`}C0x=9ilpaF&&KAL zL5sI!O+ziZWQeTP#lPi+j2BxCrdEQc^B*h!Mp=Jd9zxCJlK zTzL&YQdBZc*-$F9J2>LtOW0jnqOZT@zc=ivQFX!4qIiXMbPtI z5n2*6I^?bI4L{6oWfdFm^(e^}0Ej-PcnNeY>bY@JUMNL;PJ%4h+P=`;^GY4Lu|vEt z1uW}m_GTU9kz#{~FbB^oTL%az2(t^_UJfi{^#Gp|zn1g8Z}F$<+G6`pc>$gS;7`7UJNa4lMeRf5F%wOlx5h2hS%6^%2gnyu}; z8?U8;Zlz=7CFC|(`I=(oMQ(}730xD=V%0Njs7BP;^Bnf`9dtO;M$Rf62L3J{Gs2u* zZMbu|S|+~Yn0jMT@(9mjOW$?gaFpmoi?X%#pEtksKGA%(F-EDiTDBTfF|R|GATOC9 zunNF41gs%q%W6HzXki~5kZqCfuyFXneYW_U`9AGS_%#A1OB>GjekD{(kX&at0BnF#zlH%j>(P{AUMGa)`GO|jgA4{^VkHq*0 zIp8$3?1WlIwlJfO(tI&)HLr7OFA|CI#d7Pd%&X0Z4=9d3d#+woYyCk=vTfGu{e3OO z=*~}zF>uJz`b)fA{s66$lSt@n|c@x=S!Yq!v7tCy3`_134&iHm#Josn|?lUXgpmRgnT0}XvbLum~ zjiQIHCa+*TL;M{nSNXG5s(R>IUoz_es|=_z)lhCTa-ck&Whl+C{ptlL0h+t|#N{rY z+>PKOE0H8oJTH zybM`0(O0;kD#b4M5ynL1g;`DX(>si2aLvB_%UQotbXW;qqQZDuq{c48k% zK&V#mjPLd-h%89O>$XxDN7WV(|FE6%`F?I&V6=l@E?H14%q)g%;9fbtgS;)%)yI`#|_0pad3=;;)F1JCss?n5;Jf2;yy8y)H_dl0V3U)=@P>%i;Ii4k(z`tT%+*aE~P;h$I8hYP2_O@6c zS0eXlv)4MZ!Mv=0BfenFP76d2R>G){oVJI*RYhJ>G8Mz z7oMy`*O$h9JO0b%jN?z1%P`5{8lC7r{8zQ!k7oHvwk_08rbgqiycMnY?|y&g`<0<2 z(J<OTq+|jr?IA5iq|1* zeJ781f$hzj^~8N!`Ue&RS1yeT5M(}CZvUz(Yn~@d7FS!yVwy1Yi}2@Gf4k)APTL`L zW!8wqHc`2Cr!6IwCaGEd?L2F|=uEJrlF|p4MBb(*Vr#?!NXA zp7zb|RKk+80{e<)+)bnMu6jIHs9+^5-jCfTm>+5?FDM_*(+-ihsaCKNu))~8bE&)W z+|&y>R^K;IwXZ1@EMCEtw3U#1YT?U*?Djkx_%Y*&=BY%Yq>?t(gBmDUkL?i3$A(&e z%I{y+dTGIXb~bI)Lf=Nxqq^Piy=&GgyWBUpHv(_O-Uz+HRLP1VxL7FBG9KaNKvbT^ z0~TK~1n0hH>Ywh&23Cw6`ZWcl(N5N(j62eC3vsh1-h|D z7^9kI524WA*Dv-BI}1!>;;?a;nwsWR39>%f2GSfy&xUezAQ_b6~q$FILv$Cnw6p}G}4tKd*fxFg6HI~Z{G#57PBH* zG~>NFR^%cusN*Ax7HUI3-V?0-8o(~5Ry1qAKvZ)AQqlT8T3t?UHisBd2-HU9%<O$`bU)3U~z0GK; zU0XrKW1jc`ld8VB(Qy#@#|Qd zSyV81#0p8yh1`D_yh&9*Jodyq3Ue_HvVF&=;Z)7BIrX#x0SnMRj$m;E@bIs1m3f8} z0^Uj9H!s?~-cR3h1UrTWp#_?&+6Re!v1ueK&}6Q<7I8MPDxb)`4id*i??KZCTk!`J z&-=>dg0)7`zZUP5R9fY|mgT~*V;p5z?Xz?_OisX&tDD5K}h9I-;?bjsgy1dE|@Q|P3VfqQhR;XqT1E$ zbcPbe%SaRn_0bRfn21-Khj_81pe3-B#YkUOwq7kTh^=7c@kmokyd&~2#~p#1myN_~ z7OO5|jiLD*ll=1lONQm8T)ue5DgW}`7Nmj(Ye_HWlWc9^Ve#JtYLP1bi(Zf^tJ^MD z7GdORV8pfYDih}3YWdESX!lWnC`L?71yFJvkh%Ez5{7RHp%F`Y$o>Jv4L4rX=6++qD7tg=WP_4O@IjWF|ag!)uSZ&Ry{)6LJ|2ZVR`P z7bBOeddlxgWQqW(W~|)+i2KG^?+sN_vhBj2N81*ri^Sp+01xTnCm(Fg$ll={&I)C1 z^LBosxJdr;%;Ze>c9o82PShl@@CQdetqj7&T3<1Q9AqIHb3x@pV+|)WDtw+E|RqtaIsB;e30sOW3_i$?8#e=P_i%U z_b00CIzdXo?uZ*^L(8`O4(tTNDqd2lPbg)Ptk|Qaxtq#50=CQ5>SbixfNV<_2V3?A z2B;W1@i><81*)CYp`YJ&g@D=+pT+cj-iWa>x62(7au;?N&lQ`Q-QMUeKOw@pYL|OR zDI>dVCk`n{?nidw5D7v!VBxN8s}MXs#}jHD+i9gXD_{!!5t1$GnJ4SEKyT`u%Bq$; zw($J!YD+)8rFbkJ&`=>*@bKoBD-48dwqp5R=Dh&*H|xqwmbcztMwTbbEY#&+^TfcG zE60tAUKwwTK?Q`eR3zg{3#i9yB z#uL@WY9dVvt(KC2>tbc=TS5!VXH;A7HowRcp-f|m77?E_p=&yVI!5|*e}DgzrHGGg zN_AZY8RN=h-cI8QH(V;(#pUcoMq8;%sKmozcBSr1H$tv}O_?l&5f)7Zd#A8ugD>@n zH;BwwLejzYp`8BlNeIDs@N>dSDIRm+wS`aWqIlBK>eKBepjT%StO+U^**O@~i}?OO zT2rmejj+7M?((hoO$z6AO#$TE5g6hi$+R(T?Z;~f}a~;F6M*4a%9~^1XeBm zC`iqaN2UV z?~`YtQSo&EJC-b8iH|<^)97Z_3*)`vpxh7cnf*OON>JfaZPU(YTqnwINi#~@u87Y* zEMmf$a{2id*#AWc>JhePwK-iNRB+^ViX+v7B1b*AW%V@fWuoKDuM6kpnnP0SKg_m_ z;)V~^CzdI=HMaYa%AP);8d16_Zd5nr)xV8FFF$`PDO#;EVMsLixXGdyW)>wc#)L8> zK6y1NW@O)HNKta^#f*M>UAcoL#M;ApqinsULkA zf?wy)zudf3Zv6=u9KB*}Vmvgf*^~TXfMGPb&0`I!at8(wu6ZT|8Q_NLz~wI)5g!p7 z*`A zq$<`LQvJx2bJfO1rwFiuLZXg zI-d1GsW5-mbno2&z!`2g_LVVx3IA1e;;Hdog(WCiSPd>h^qm|`y*^;m1=R~{vtlhW z4v*ZSxXcIXw*Jh_V=R@d|CHKwji_+$SE&kJ*8;4k(ejGRz~W#XgqFZ1LK&0(Vp_mKQ6)2_TDA& zAWWN*p+CelERWaM*hJ3MaUqB_2+srn=|DFPfx8!hD6Qa?P*7VaH>t_gvMrh1xRYhZ z^0>$hqkYX{?ys&9iE-@vAtzprQ-t#pO@yD;2x36O3aVjOrvtn7hyuIyf)a2oP`1ur zbVx2<-m`wg;aiJmu&ptg&ct^3y$1gOFF@82bju@XMXADqgmPmUNLtJmh=#7cwdaB| zu1U~cd|M%2&U>GiP^V0pDg|fMbwz_4iMiP5Hszjy-IRVx=hOwN19aV+qkpX`hYDuz z?h%QtbYaO_rn2Q(%!D(Za1!ugQ51SFA=t!})yTjy+`W}UPu>gO)cO(A4F9v%xy~!% z0)P@hYC&wF)k?Y-4kN=TEi`gGP=mFoo%A9>#znJyGgj_1{_M5&Dv6;)jeGA>rxkr1 znB`@M{&mRd*PxChGwOT1#AGE#jF3{j;cZ_0K{Kj`$?9mHf8At z6pN%VRN<}F!_?;yI#_U8S3$tHVN7;kpX}SMeZqec%=d;ttc8G>Up9l8=wx_90Q@FJ zCq5YOZRWSXsqc`cDEJx7u>~226tN~k+hC6suTS|>o5hVCL#ld(=d>r3TLp$!W4nua z&zn?c-B~XX=g8tWbv(NOr3En`#d2f#6uNCZ@i3Z2EZhL6|8liK03d6%7(#2q(%vp| zNLY$j?c;`#5^N4jOQ1_ZyfXMmSfr6WBUG`K)z*?wRU}VuFQMY1~w}j!v zz@cjxQsj%4MfF%b%vz0*D?-kSHmri=R3~Q^f2xDi=435I1{m5GrF0@CeKXtW}h>*6uLPcP-Q7g@tih8N@JTu8)T(Lb2pS~n~1tE zH{1z{v|;jb1k}=-0Jm)!MGIcIk+gc>O`LN`%OizBol@SG$J+`&h!rt0i!jVCUVvF+ zq4C~yKnNhf9~lf4=R?HBu}w=usY`gLxSdLr=R1)qDwrAd$%_Q3A;#*X^gwlCpY>s# zK<99$3lObe8d#OZHC-H^JnPnc=H!c<*G4>3kkuj4d&z^%KY>fn%g=!0Q ze@_ATqsMsm&0lpV%8mCDLFgm2ifTE>pWxxm ze-)HG#RBfudfD)oCJtSmv z0zV=EsBSp^b}|Rf!TYK~_8SrfA$d>+X?yL1f#u4mJY2)lv+{V0Q=4}|7rmw2&|ndC zUUmu9%CQT5%MEw^%8SwK^H^W9}1GBJ32?hwc~EJ2y0ko zgCR3U;HR$C6Jx7U2x+xp3tC!JOBH$~8hTn&!HK>60kKsW_<_ip+%DK9FU8wrwF20r z7_T?`4oUa5lvZ%#K6w8iH>2boi-dAoh-}U8p}`AX@dBVQ7GHT8B!@dByk8o>`_#@_ z(USB`+tQw;vcu2-K`l+A9*YaB!5mkL;5d1CvP=5DZD2?PHv zj5ewRN(4CT2PoS3_z7p(yU*otnQ4sWAockSIG~Lp$O@SisKDF88W4=nHUh;T%4of* zjTkwDQIGuOwJ8cSk?b7+!x4|kP89ka9NOl1Fnc*X*^B|-IAr@BKov{iMTG$(gi}~m zAcR3kltB-qtt^7C5kt;@gc>g3wdf6kUvU(HFLXy+d2xcKcOe|vz=|-R5lmeU+Ada( zygmQ2K2j<`5-p#oV7vsDjjY@3J(q_=%gfq*rPr|s(n z@tc8xfuV-ul_qlH4<3EdA&>Pu7x>Wu#m>vd#cDV9*CVOy=ynF!j#?}3e2R703J?}jr*<6qOn0+mt9dX8#gMV0XDEG3B z@x6@q4=FxJ(vM}8ib-f2k1XQI#jcr{f3h4L#Fj_=`|NC$6t53+2!kYMBwFT|-|_p;LbSZYt&MQbA&+o=Yy*LAKnP>yHLNzA)r0r0i3S=?Bgeo62uM2s*`;X zOc0<-zSs%bTP}>elDq|CAn}k;7recy3weF*)wZt0<&!nthd*A}y)WWOU;3_Z!_GhU*y*ib2*8}827RLh7JCxC#s=twoV z2vqq&N`+v$i1o>07BmvLT#M^7<6&ke-ifosplIuX3bA(|{KAIOP9+t4r6afXi%XPC z<$QbS)bYl1t4CKHic75#+jkC%N}NEP0B`9bVQ5(i)B#EhHIH(T+M63M-K-9?*%K%v z&cjf{r{WNRV=cr0^wN@Tiy`X=zWCqt%p>G00aeIM=(392HKB+M>wU!G?6(3+&m_cwh-0@eM4+IMahOe?&(`R-CiFT5Xk&rQ)lI5a>~Ngx;V zf0+96cqrSq{aG;CMzR%#L`j7fTT`fHFG7*sQ&0978T&T#s3@UG%9<@njFRl!rH!(T z6qRLCB*YY1vdr(ir}zDR-p}{1ujkXfT-SLX=W!nAabJ^V7~p{X`*UZ7$6v7-INe{w zDS*aDf`wtN14u2@oIk_(u&AE+)#&yVU_A&z*(w)rIxSECgEugElhb@P%<*jJ)A7KY zjWaG$^{->_Mk}V@?CWr^J|%-(HjgLZ)C(3kS&ekBfh3`?qO3I#=P+H6;>P|(S^h}D zp^Y~RHT8sd5K&wZ*7*oU*$Qebto5~vI~ z_@6f?`Xr{|!OB>5%q^)=`#L4+dDy-!H&E*0)d-QZks`q6hxbqd-Q~(~;BYI-xO#CO zH4BX0AXMQRBy@IA6SUg99(nmT{Ycu;=M^%l`z1`MefITC)p6QEw?;e66@aQD7zbyA zthUC4_JvlkwOn}YOu9|h$sXucZ{ZtiR{98iqBjZmF><$SQod~iHZ%0qemuJd2o&SQ z#kiGl&;?gY<{ogAF~WcRrLHLHLR;tI-$nrJ#Y9Tzli$$ z!(9z*%GgzYHqnh=rg=f+d2=SJa~g+0D5pG~L4~#1n2#@4d+F*J8({3#)xNX*m>>0Y zecr5r0j1wHOSBdknyWx9(?fgPzl}n{`mEg-AiiE(#L0GE@%+}cx3TbxGUh(aS|afB zgi~%7+O9sbws?6^Ef@xIR2!5L4dJFYynNe_mCXVRNwz0Ez&0^%Aw@W(CC(N!7Enz< z&Dpd!wRoN2<2(7t_>GHlR!gNtWNZRwbDGC@P4SR7@&Z{R`!{HK zu9Rc-q{*jnAbFh0>U^Nc{;}0UOC}}>cwQ}+C*?y=hqd68KXHx0T8~gR-;`D(vlLMfc*d<`sjbpIUmFgCbCa16YgTBq5cA~AD1yerF&}~pjK;i_;sY3 z)vgw5CYI_Rr>)NUisOthm!)F;jP(0$0D@i#HqaEn$3N8&R@eRgKuUvmR`ysGzX`wP~l%Em! zvw6l=jKxE%8nGuscyy}pt#QTl@20EA=u*7lUn;XT4RoXzb`C6NJr?W&w5<^AR0VDK z^R|{218WB6@IQFn^3o4T}nUwYsbn# zDObfB*e?u+pSsjM6G0b&sfo-ez)A65UNtb7%{p-zZ=t3d&H^}p;-ntyB&gPk9WS19 zSdTx3*$oHknNX3RYO5i=zq+s!K$byJ(>Dv?eOXQSQ{CDevTnz!9nHUM<#`M(1pny> zG6BtEP#OxHM|Xon7$)w2s9hMPoRG&*HD1$fxJ4J6^rmvQ9E$Em*qEJc?YwnDQTM3JQh&yi`yYc+L;1E2)5Y9sd4T#QGcZw&*}R7ZASrzAgg(hp((Zi9-x8! zRbb33nLz29*E$d|KVe)6!Nk9}+)Y~0sel=_&%g871V9D_2qpz|M%qzy@>w^J%zEil z%)q%b$$JK$Hw?@b>}CZGi+#P+g)M+N@^=tH1Z4#xA^UJYc?9d zhK4MC#R5am;m&tc4?}w=yC7NN2=rH=EJ}O2m&R=l%CW@u%Gn$6rbgks?1nDURAz%} zwL2p{=lPsEIqh=&s`AI~F02e_!9`&=n)pm;o4?c)~?L2;hr$43~osW|}Xe0%Zi3(rd!Y?t+jK){$Q?FtGcU zkj1Swt@z;4;n#B>4GsWFkQOrjjnPVJRb~X~7y5ng?)MFgL%mqO>qoQ;BP-m9MGuAauo~|g_Z3o=zn#cEKS}ZLFZ|lo4kmKtB-9W@S zSrC|r2PT*2PMjZ>i0w!me)f4A+|>qM;gVz^Zr|{n^>qd*W^NK}ch-MtuWytQNd?_? zyrD4gLbFo~EQ^`gp*)?3@X_B+jaTLB`)_zO%)XoYqn`zCqKUzuQb! zfs}2h_`$ zz#6*%_)srLJbZU%Mr$ZVSE~71Sp5$fvSCcQf6_A$YR-Y?^37-EM;xuWqw>*E-1-p0 zpd|Se&pvD}tYxY#pt~hH#VFLXfo|ZvbeTDQ1!drF$yi3-`gmxs_KN-fnH;!TQ68^YKX{ z+4;f~_3%*xsB4hsd#EpYP6{>bpg!ADb31C~GOG4)cP1Ay{1YY@Hwq1TA?*e(1|Rt$ znoz7dYXQZ0xyq$VGsh71npt5Q}Uok1{gnP4Q;35AU z7Ury%@FxL29&y(Q9j+W?y*;1_dJ69&@lX^K2dk+yFz`O9NxiHyy>=mW&7qiUX=t6<$LvOV-KIY~ztnv@diskirB; z_*uHh=Bef0tq#Zr*fbNhoY_I_p@G>7yo`{hF5q)}dvmojAQE(l>JbP7CM}zu$ z{RtWr?T5~&0#W!Ioo^Hl+VKu<067!qz~6A~)VJmYj&$o$J>P;+By%0BEKl);mnbDnTsgWMcx(}O=B0Zd^)5$Bom^XI zs5?StwIhn4!x2M;LIv3p$t%5E{V!$glmYWVm~d_IIg# zq(FCe+`j@aK2B<=~Md;4cb7^f+JCc9LmGvf>ho?oD_3oj5?W;hjiWC;W|u34}9 zBX<{#0ix0|4B**0zkJ*R!1DWkb;5_fhZgsAv+3!%^=xUDAQzc2FX3)c!y1RQZ(ExF$_LE68Uh^oDbRzz7xsUDZ%(ZXRMIj z4?ZH*%LX}&2?bqLw*O5-4FFAM9JN)00K?ag`A}DaO;g03^kbNt!6E~ML4p;^nuOMS zgE=i7@>euuAH?@Rtji7sLEE~XrDBe|yr#|LUHv$9Y45+e{I6se^va3#47TjlXv5-S zrDc@k;i7e9!!O!G`@uh50I#$L2I^T|s?N69L2RUajUFWdocv$2Os*@HR8I;;Zlj(L zf1yrKPkg-4oFtD|e-1aYu*AmjJBrtCCFxPH zY(}19j|35O9n{%~V@|Hxx7vAEccC&uMiw_wze0VF7N6e|K3{4SC`|E&6nbc5**6#v zMWXPrj}_bB4ii1?{l zrs?n!!@<6pp7k-AI4RsvYR`yPqsE*4aABSQ>&ggf#UkZ-isAkKv=H!r?WV@pjT#Yn zUvIvgD!|6NCBPkbVU~s2Lr5Ck5u`_@;n_ST(~)3t%CWIEX%2i@J&DgbLCfmTb)Sg@ zF9vDU>Jqc?ky_|IdXWT>igQb`v2gu95^^c*M)>~7n0h@bZS`*B0!NYs!-UOy)?`V6 z3#A7(<|#M0OabNEX$%(glJtjltefEPH?MZRYtJA;qRL|u=tDtEzco};34vg2@LLfLa^H@M2h#X~4tn%n!Epf*@ba@*j7tR|mdW-jB;=bC4+l;L( zc|FMcMv%m8>EK0u{9?l&yRh5fu3|N7Zc5Y@JxhA_Sq-|sgWNbc4{>mab-#D-3*(bA)`>TZKlFY%`LiiZx$OoP8CLz+EMTl>p%(eUyep6;k+(0rZv;97ZPZ?F z&=XWj8#$;5LK2AL@#0e`) zJTlAAGp=rlXAsn=KcNKWKrIc?_1O*T(tngKjwjNtPa$v=*a|1+kr}IEr<> z0+eo5KNo>d8~=I%0H^J^RAo_?PgaI}sOS;TUD%T)gE&ad1qq54yS__z+%y?K4W>%z zfkZBG0o2ae=z+62WITJj2pNW;6C&mF2U?C{!0T6!mBPO@sGhwVMXNRp7+(4XgvDq1 zkU>h}uQ2B^Oj&4B;Ad}=gF3XZ)ilRXFpM=?nCQTkIV_Z$Wg=K9=qL~0PB_Z6EN>cKAEW=(MBaU>q zTCA$a6T|Yni*$J2l*`J%R^#X^ zGQU6mU@BPC@N~@r#kx0d5h?gf_t@GC6wJm0dB<}s0@a4Y9A(K_z&?V78Rj7$8Q=ki_NkB$e4-9_+k-?G0bBPmhoDo>`?Tv%KTr zjipeH)9nRh2k-XgTp?PmCtyxRULPGLS9Oq)GjM|$l&a9|K zxVduM%kzeDM|$8zUW3KE_Q~GMRcjZvQ0mYZA<$#tu^ZtvJYBAm z7+2noS$ufnum$TjWQDZH@5&%rb3)SCrdVYD@BRn`*;5b5|M8G@@UQ-k%nKC#nkWF< zhV?u;94|aMO$fe{bgV{(HgGTP6r;Sk3DYMLN+usB?OGE_)cF_(ui%W-!=+SVg(|c$ z>gdHgamq%8nY+9fAZI5on+vE-=~hCp0` z7dgIElX@Y4+)cc!zY1ik~3fLNYjQas4p-e=Q*gnr-gLw zZ!8|1?SwQl&H>&aha2p@+dFzV&V(sYbPgNpPc@dREw^HjWJq}w5&Y|X#XqkeAa|Ie zQDYQVJ2xL9xPXzx5xg%-%G;@pS(^PE+r1ZDP-094?~+Btn4X$%aNVbpJ|Fta^^g2? z5^-#|u@PablpN0Xu<>jiU_{ZeZ80*OtjoLcI+e$^`AeWIu`U&TYF?9W-+dV(2jAuT z;Rc!N%J3;MI|w6%lgH&;nzAzAfp5ZQb;sdVrR(G9QGYklI%!gp)MY4#>qtmCrnZ00 zLUh533qDefoZoqtSJq~0nq4y59S?9vw&WeAl~|S{lOzyGx(W*u##DGxj-A8GB@>y2 z`w5Y}vAh{6~f#PVab`_;e!ik`_eeJaQ1}ACo)!Y7;9H`OaN=J|ZCJ zJgj_}_0}|Pf{VlebF#ob=k!vk28=x;dJuH$53hA*F_dT@f&-1M4KrzaJD(grcvXcKr zZLE`E0Y~9LT?2^vLBN0w$UjhMP7&FFV=XMWT-gbK;zyBqR-sF zINcJ1jv+~j;q5jV-EC(H_vJ}UUR#VjY{6@YE*U9f!feen{%t;dLKlOXOF+M=9(aNx z4|xL5#E#$1q~l>#_AnK~v>W){i0wx)MC{kMk*q*uLpk)%qnIVlaZT+U6U7Jv>VfpT zZyU@G|4A^<$A?=1I@@kdi#ZUu-fmG76Il-dx&aN)UtH%hdBOlLe>0P&eS(`-b*5F; z_p$yjCosRp5+JK|(Bd_ZpZ@)|`H|Va!vyN3Kqy-Iure=pv&P5b<*Jm~x8SQ~&`&SG z{ zV>C5355<9c{@jQat9C5j1!7$r-$Xc)=*PS%L09L-WF!~Lh>%v&?3nz0J)+v!`mkRy z!xtI&8ro>u2AABmK6}}}y^BIqxTT9$XvG+iByAdT&O1IR-ltVpAh=v%#i$iFiD}2u zB)4C0^TFs7Tto-*18(7Dt+u9xTt>5Nkqc|tKSPi$Oi}Op30l;>w0wDs$1j4ACgclK zA<7%up2~S?9JjUCk7w}1-QKAL;_cdW|*S7qhbeCfUQ21rg*~x z>_>Uy2p1WGUQ8iZ#@1B5^JT@pGuxFw{4UXwiHRm0r-&UW))k2q(-}Z(iUD#Ef+kV9 zdp$%Z)@^z$Ne#ZMj)6t`HV%wNoW$G?p_xga#=XsV)cD7c#gQ;O!`Wb#QYgh$b2|Fe z$p_8`sj}zanLQ9Cbr-1N2Q6px+^U8)u~Ly;(OuvC5K1rc@A{xYG5+H+R%7wh$Jq0`c@%4G?{{}Fr+4Y z92HxL0^74NHw)&r;rHY#_E>Ae zFg#*isPW9b<&XlGnUyq`F|XUABqlxy^Y~KIF~_64(I>X1xr(88`wNN=iAX)*%?fO-NS`Ws<2N<09-mHFnsl{$wwJf(E7qOJJ08tT*|k#@K4`Mx zYx=PkYRO8wHZDb}sxz92^}hAtK&^v{J6zlmc2+HKar)C9c>Ghl*upF-mziVJfVJ7d z(*L+9|8#Qwz_marL&DbTj%4DPEn2eL-*GYzSKlqL#Wx8x=%N|?oSRx&077To;>L(o z&#I6(c!N}?g7iBHgb*Nx+}pvUhn00K6OYS3eciE=?i{(GUiBt?0pq9f+N)_O#bwMY zV<=T)m+OnX*=S9Y&b?#X7&7SUpW?Ff2;Vin5~MuSOyNnmhI~AcIfj-kURi-RiBqj5 z-)J$|j$dElTW@trg%79b#z)#{;~R(CFeD3*r~6DfC-){Sx-F{|=^2x}5T;3S09vhx zK6+3NN=vF<%FykZq8ZmGXu5yXRysX_K7iHMS}rR>^l`>ZZ0J}e`pW)-=kJ@so_^S_ zw(NI6$de&!g|O*{#?%6!K6o80d$xLzpv2`;Gu-Z5cN=m5THDDjEX2ELjJ&9}2N;7p zd|C!avWD%FU)TiD2}R4q55Fxj{0E$>SVA}}{3br>Rmnlt0{Q}{GKMlWh_LoSpuPAM zI9?Zg>*>PFzR0Eh_FPmr1~)nP3(I_iN)rk_C$%$|#`I2JY3v_r1+} zWH*0H7-ix>-;Z{%P3J$+W4{kgU`DaIJQnll;)_+JD|3n-pToHQt9=+ErX1QCzd-3Y zSbAyJakp@4!ntpWNH1L4QD8H8Mr;aT4iBfx7!o`W`Qd`0=K}iGBi$m>7?WA}K@OSr z%!&Rk6^q!xO)mle898wHtpP#+XaiieP7eJ2>yK@WThuWKe9*Q)<71V7m#1Dm2uFN6)`T8S>~vy19gA0+IpJ0ei!|5_{dQsj+OjNh z5yIyv0kEU1<_+K6eQ4u$eJp^-J_aDSzK<~W`@}8~fH+QBY|-OeRM%i)O7 z1cv}lM7ez$qshuBx#JNBETiOS?HvadwWK5nR_nz^M6~AniBemhdo42P?L@d>_dc8- z5b*qqNe4IeX{jGFcGw7JeI^F=Hzvt6tsW@wIZWWG73GF3iL~kWB|9U+*S^HWaMfYm zzCYZ1>?YrK6w-gS;zy0EYwJM1ar>{o^xr3Ht)&Y!;llxIZjrI_fbOLRr*m`E`-98F zwF^?LBbKYlAAl-hrwBxVAm}koqMo%MQ{1OM7Nji{?wmMK#l#NWhBU@5%l4_&89IL} zy3=s_Nt`4P^5s)i&V~+Zhw&{{@7p? zO5yS=`Ny`2U>uD?zV@u$#N5nb2`6{q9hb^?5_G}6imsMjUmj`bs;oIM#hdz3pF zeua2ban2?`u>_HZUq6c9nFT~s4-X3G4zAk5dVO?9v@gcJgY8J>g5UcOM0VV_$WnYg z)U)V)i=}DxYx{WPYhr37_~@Oumw(tXhem-ezT$S24$aH+X}|sr$|&CP`;-XIJk}-R zHTpiw#?%9Y5LfmHgO-@@*z;S@C@>Y|-0@x9G$emACU_p#MhWz#O;}DPKTC_Xmeo3z z6OdsX_=5w?H@D&??E+KuZ1A3|(47hF5hh@aeyyq4F;?X&H(TdW6+z#J@|j-BRl~Af zybGYLM4v_Lzqcxvzhv9N4Gvdh{2_v&b=evNA?!~N!2}jKzVKYL@C{b*wB@R0n+>oT z(X+D~*-cO?e4tdkyz>Qvn4oZSBjk@^s>UbjzM8j;(p~i(^I8Q!DkJc&&pN5^$dxp) z1_4y`9?mp`?fI6*#7Z;o99T!nbE=on!G!K7|0^+y=U}pAN!|DyOwOew&r})uyvBG{ zT!BHMo;K;EGVF?mS6Zh%OVHTu1#6_l0)y1r4!qbIRQG-PHHpsKj13;wp$ z#6qr>X@)Q+&7!&dh40!L9r7jy@CGVtJ*$YRI&Pnf364h_ld{if!=`$*@B<$*$|N}y ziKS@l+X>}9Shzxa@e>bQ7Gx=72%xRxJ8@ZJq^?uixc_NBl`xMl6JI@u_qpYAS*HHi zqzHm%iiRDBrWW7C-=GZB!LvtM%8)qI&LFU2xSN#dOjluwIuzL>rluJ`NTmEo=|LVg zfpy?lrChWE)Dn;IU(F-s8)I7J#C~t294m0C*CrqC=CBpo+H^nN?UfS@9q1i4y4WC% zOFH)|;BX8fl1x4n^-mxxu0=)}B3kM%z=YaSX)k>FDCbh#2`I6Tww$^CPV5P(6Ca0v z`6n-QLUX+8AZvLnNwQ``AG3;MJymlrV#H54d?1_Rrp=J!El)~%1vRlj1wO%yrY8J( z5#i-02cL*Lzd>_zi`Rl4)45=uhS~)7WgY(k#SMcz6kW>Jo!VPZW7!fc<(y^zQbF1X zQ#6&L3~z;|W%xDKeEhlbIg4hu6!%iB{MhV-_nT47OuphT_t4**5ca*jLGLwKcj2ai zXjo_HpevTq5JY+IqwOH2v&XbD78Ng~u>0_qK?_0Y_}sj(Uqf-6A18{#+7D^h;X^$N zToTAfw|h}D0WW);v5Z>5inGXsx33!Hgn5DDIrzYy1|z2;6+{FD%`gealdwJq; z{X1y{B4#sFp{@AyQA{CTS9qy#^rfV^I(tS#Itz0^ zJClDIB##w%DOc!DtC1<{D4C{iyZyP?{>33HR}4rpS6WsMd`N}uIlGQ@)xbc5BQ#OC ziG7FIeCNfKHvA*zSiI~XIaaKl;XWbCNtcvDwZG;fI|NJf)5gd`EruWOX{-9=RsK&@ z{!v%31d3)9H}*gy_JbeY|6O(0Mq6Uwb@oCs_P&^p+g=$zdTH8X8(xOGpsA_#nx0yq z_zToBOF)8`-3|YlUDm=ZJA$g)W&py_6_kM;9dxg;ekA3)CM&h@gC2JQC*T|cJiC#zA$tQwa0z~)(T3%Tt5j@$0W<{`&`r^_7OrG3|;-PY%A7z$tc~U zZ!RDtrf5M8Hq;n0M;$Wf=6wm$RT~lsb9<3JRJ#6`k5(6uvjm_u>sTgkAW_cZKH+i` zQ7Aag{d_*P`V5uk;4Mkv~94EWzY-q#m;B5|qZo#*_Chm2br47wr(rm^- z)u;8-Ch`GQZIX@(1UN`oKIv~8>_YQ_4q$UJsH$vGcDcK--y~4%Kn}FGDC@gIyr!YH z2eQeVzdd4T-{)hIH#0m!@ab@?SEaN8SU9Wu#K>aUv`eS}P|7{LB6Yrd3{&;|4-(*q z>oP&#%6taf(jTxo$BWp}dr~=z%)7mO^y#-Be)kmA%IMTsF?7XAo4oqpUx7F;qPoHQ zSK8r+o_03=@{S*!D**X^??dGZ7wY*(0-N0`QK9^i_v%J;z6TALnEu`GXC^Sk_524) zDZ47f*k9Mjtn6mJ)v#P$V(Z70<5u^OaW%rB5wKC3uuTJOfs@cAn2;HwBVfgh_3xd%a+685d5d9ZL;1hgITtz7?WCLh%NnMY`2WdNoSPl%mR0nJZ@_+j<}7zs8#QW)ESPn@ z9wJPBZ;dILIGPMA_T+Q($4#b{?esvp=EvXC-j}{``FFhRtxJvuJ-Yp{oYqo*U*`jv ze1NovSBGp`8HGkb2!?>OY+&i<5|;6l@Rtc13XrawSf3to3dddRMMGl>Tp}LDGE_{n zA7yC~Fls z;hD3nze~$l3?eKCPsB`l&zKKj8a~BwtSxT=u-R<)?Bt{EX2)tpI#<14%g!8&ZvbLy zfaK=yE8KPRP~aCh?4*r5LCUzT)Xqn1&)+A0N|F+u;%-Wf{{<~Q5t!Q$j3+w)=zlnc z+}DDfjJdP-*-zh0mtiamfmaF1Y-&;(X=Ar^+%WC-HD`soIc#q(|9DD`Vn{t~vGU(2 z?fi8QVOHMXI7T^}M!;LTX1=1h`!>p{zjd@3wlM#*54L9jT$;EX|DV0t!js*1dp|b* zbHMsrSn+(@QJ9FSeo6v9@m_<`AF#E0UnHomYFD5kH1{H!n1lsyhQ0-8p@Sy3ywzy3 z3$26_IHpbbxovbMDSB~v)jfb6I%;H zH+OqZ;nXfCT{YSzrIT;P*vs1TzX5g0ku)75abGxVd<&*TJxk#D&E?p}y@($~(c@NS z$f8?jf_e#N-M*3(wTe&wHs2tRR=+c265+sF2FO0MB%ueo!q zZ-}F#b)mQQ5GM;`QK5TvS2V$Q75k5pGLj{OneElWbfb}@kn(ZrCCncG z3s`N6prItv(J@y^#p8xCRQBUrey;8{txTj1Vd|^zn`Bee+xJaXdBzr=u|I(I95=pBAT9{$^zvD4oIFSnJ=$C9HW&6DU04ZB zai7MP6I|YPZ>svVk-Z4&I))?uFN>K?gDmT5K0LzV;R;#m1pm30?qUY4fH3T%<{8 z3{|fZ*r`U1k2j$QG#qn0;}T%i_bXpM11qbf$>RvsWhOs@u@yVX`Hrw#LOK=D2MRWbpG+QYHVzBsCt@4A zoLB}>W!D$(t(oIt-xXN}L4bR7B_s?0n&PLmI@?VvM}VGuW9~}%SZu{;$2Wl{r;fM4 z9no-sbEN-z0WP<27z7#~R#o?(fRy}DyI*bXZbBk_sT!FA4Z;f>Dgx>YdbD2CIXJJ=ugM4j1-}TVIvA;zooRf>2LFj zvyyOGJ9Ts|G6RycG)b|f5uWz6X+}1ofwymqX{B;$T7GGA(drjITAE|3C?5u3Qlw9C zfvC4I&D)7JHZ;EbLvJt{M1rMY_&vL(+>-gejZ!mZv4O@j0v0`i^J{ETbpP^|*3t)bO3*dF#Xh zGQ#BY*OZTnrj^=w53CH4WBe9|Hvp4Errq~%7T(H)QwF>4_FkkZ=kGh`iRoKb=NPBB z`}g0e=@N$_@gkRk<0!l8!UW~|i1U@o&U+jtyWk9uc^`jYhIGxQ^DqH+Y?V9D6RVbG z|C_MoOP^BvTyoM?ja|^Y@j3DMYCKVYKwx9o10cQook%b2hdQ`1SyFG}V4qw_WR>;o zpM+HnF~-cvTMFn#nUc6f%sNY$UI}fsGO(Tnq1#t3LPm7+w<{WojbzGzh% z=guiK0%A2{Zl-U6Z`h&mL5VG7ZuWYtN+DNx$uun=ck^HYMq5A?%~Wb%zIAlmMcB=r zdRR`ELscXnEUR9lqfS1Q_xSdri&2cv+M6<{&-zb-JRE$c5#Wb8w!Ix=VbML=1!1%u z5b6_cJ3T#!HA0k$F5^(v92j>nr}IK1{bcarA5*sYZ`i3$-jtjZ zGi85~FG^;>Kn~jkLzsc2_d_mHz(8V=JzUkdncHSOtHmDpQK3dL;+B0AZ|UfT7;MFf zV^7~B8;~l~jI;7R8@-lq3}X;8Rp%Po6A2fIA%hO!RtZ2CfOm^v7|9Tj&rzubV)6f6 z6vpbixh$_R8s6Ok>7)tA+S~za`(7T(krek&Jo6?FRhwapt>HsaqV0}^j$=MMuohtK zsQEz;0)99C9%fI$LXeJDe>sXd$k|sv{b8&3|iYZ)5^1S*R>(PV$Qth(G%{! zR`@{*JPqqeN?wP}e-3_2b7%_PW&TZ1E<5l2!apE#ZYLl591N88L1sRhKpbvca>)^X z+_oqBC7EYqkPAc<(`iXQ>Q{_XDVD?Q1Tl&QXm{~lc=j!~VBfFtTM?04-s7i=7aL7b z3Hdh{He&vwlO&vtUp2IY<;%cdB`ZS@fz`*lNDe#{D8>5oK_HbM>7Gn8%~;%%b6tHN zV*cIRm?ns$)DShl+OY^w&Phn=B_nR?jO*yj0yQ6&#T-*6S`U++7I9)5W2Qot++gOsUNh=09#QXCX5hG>KQ@dHkz@QVe>0U5}8j(K-CmM1y z;AoP5SLxgL_$2Ti^^i?78n2DEa)b*U9Xz+O9RS`+;7=U~F(orltJYF%sKzd;p-=H& zoyQA71N;|8p){nz`6-9 zPn^2;hbaugT@~xQa=w^GbTu9-+*WxI*34$kLBwBZ=bCO?Tl4Wfz!Rf03hg(816d35Q6$T9ItQ-%7->av;o;A~;k?RIcu8a9 zugtElwU%$1_LB`xr(>o5=W#LY!Lg*QnHd}yySb*QE#F++wt|v&7K6gc3J8|)1;vMQ z#Ghu*R6WS&NyMQMa9ye01vHKW)ayMhqc~K$8h;Ss@A3TMX66Qmsv@Kq?GIqo_o5Cd zg{4)W+cS02Umc=vp%} z1ouN7vU`1F$3H($`?XHtJb(tll<@lYO4=#v;Urxcbmwq2%#~KOnr@lS8^d_@1%OjQ zoTM;v0&*6dk?Q;wt(ls1c}xssSp{%RLxQQUyBzx@^{}5X@ge(xzOkJrHGzJ*K=Jy% zr7qbmJ#8=sMmI5?%OnRORJtqd(U?MaaipEy%GpCpH>&>HH$k(Z4Q=syoE?j?_5p%^ zFe6h-<3A6%Um25G`zpcF1ecVD^xXy%YvT^*_5bIpFt}@j;~tY!HTG%1DkLbi2V>O; zS|S$TC8v4Hu@=yp6pXDeF?Iq?z#~vTDqbQ%%E-fWWQtEu9t?P4VlKrR8JiLKc?m$* zn7<-kZRPQ>NBcxpgCY$5Sn-SWfR&5L^2rR-$W6=nY# z4YI-ZkRw&rRI-8k>?*LAi1nc`>;(#_{#Si8rau{5^PTtooiGwD6Vp=-uz;=M>D#SS zl-bUcgaz#KO@=2$sWLB2ER*&}Om@g@aG1JsxMTmCENN0+Bs7FJG|)=VO-0N80Y49& z8x6mtk;`zb+~)VVB)G&7%njedrA19(l&PxgCcrjhJymM&fD#)ACDz_ry1BFf|I7Dh z{)PQRln1s+J1}#&?Em}F`j4(DdHs@W5yrGJe$!FS0wNhI^<)rC zCCc(0!@HUg2_yh@7u4~sznt`{RO0oGT^yJ!?3rzj=6#a{^Ta3#uI->46qD63a5!@v z)!kop1$Kay$7mO?4ip$PL4wV@eeGE3p}(55;ka7}uO_8-J;;s>=0WT98j(;v@}^F? z`ams%*p7FjNF-|rY$u$Zv)X_bTe!9)Rt7gchPVro0_m{{`C`^qZ;yN+V(+GN83(cA z48^RuPe4by1_+{cin~ogY++Wt{7G@rH4njW?Ppd8dW}71>lIk$&~AYIKhj-K-vCQ8 ze;B+0L-LT`ZD?{he3^$hUQe0`!i*b2C=;E8eAf+h$HAuym@MG3!OUIONxG&pE}n_Q zOviF}$^|ap|91I1M*(k%Bd_1D1T%CSkKS86xo- z{}m@_u%8Zxn0%>N zqjTRuWpxKQtK$LG1hYhZH)Q2sgAXhPDM3}%PNF2m5s)pLNMJKk?7YLM-QvH0GV_T2 zfJY)}c4LJ(7|=G74=l zcj}|j{de)9xeh9*qJ!}F2__@bP*s949XNMGIGgr8-yos?X5oi)$Rr)Ii9qmK>H+Q0 z;T*@44}49jM$HR`AVgPzd27pYbr?7oV{(zsYcKObDp;O}kB~3SBxb@uD9{n)#)A`B z4=7LIk$JQYsws9s7;0g{i?d?zGX`bwG9aBn!B%;d2!m3$L7U{tNmG%+5F`+(2GH|~ z5xEZSJF*dV-9b~%75QwTb`AJSgV_xwX^N29Qmp-;^Mjg|NXx}Hg8`$LC8zTA2TDY1 zwRKG9mbS%izhRs{`%rRnn!kHMG2UyGI6Bl~XWz*fPJgj}8) z1|MK4kXlPdad$a@3A*k39tu8D8E@Et~{Y`rw59B9UMthd)}CH}dx>kn5O>9J=ZTl8I6{U9KC8E`|S@(UO9<&x+H?PMuV>^y^zrl+BzRbA{ zi-R|yOlwM2`mWkARR+8_u#*8Nt>EK;vq3C2Ai+Z%6l_3(?-%}Fx|{$*X1I6|D-MED zo|HcbQxQXYRo*?eW@BU@x+uDrxymt0t@!lwX!Zt z{4167{PG#|e49G>xHk^=A*SWgHdio1gERmb1i^31Jx%oE7d6(;u{9-$kX=8?aBOpm zJL68+rho)E?Yauf8i3QeOaT=pjW9vCW>EXVz}H*G^8Yed0`vFOJz2-9gtGbs$|}6T zAa9>~UBT;qNWyYZK|sRZpf7$+sYEviw<=3g2trWm33IurJ(0gS)^2adB!6E|#%SY= zVH%`JHj+*Nk#en$N?k#wP}#{R&gr?GzbI&{QU;L4YYj`WADijaWArP;FA@Wbw#b}NmdQ0Kn$PztvS9h6zBSyo^ITK z%VldCM{MC-v1|3Gvf8QehG0(TuAm>cm?~ipZbDC(3UA;K3>-cAH;t+4JXQb(vY409 zm{~zat`^eu{gq zHtQ~u(`r;P`aHHgjlsPR8ZmMruD?siuIyjrr$Ak(d+I?u3)Qcypyr1qpbfVPuIfF5 z1VWG#+A+~kpjRQ~l0R2*zG37#j~8OyqFBu-8ud_D8bP-87}f)Ev<`}_Y>n`Oaz?Dr z_R0{D6hq4Imsl}0J^f6XI=aD~Wjku7@4#JaNILmY(x+_DwVp1h4S4pB^Ce_2JCd8o zp34>RA=q3S4V@+vKVfwCaVfF5|H9O7*WuQfk(ZbXJe)EHnwdKPlobIm@Z4?U^7^gi z!|DEfz5{c2)AnVLrb$T00Z$Hi&9LzJUKs_aLaVXMp_hhM`PW(SE{M>-!|INEz`zl# zBOp*{a4kPZfL?OP5~i;HC!2}HHxiZ zIL8vl+51F&4>ppd2!euSBJD8 zbjD$0>Vr6%AQ$0YaM=U-i-(4#kjaYY77FwSONMcGS1wwv=JM58I1hMAv$a^upjE<1 zIdg0yDvd&@Z^x$Nm9Y%$mO!3J%)%@7frG}-zSU|B?eoU*rK>B~FGt?c@0HpkF3h?O zA~Vp;MKDKbrwra%gZ`yNHwbDLjsTGD33BR z;Wi-V7s4k5EiCbpG%c*2;4+vBqCoB5M>gR=65le-SP_GtTfwwX?nq=n{pNkj6&++#Pum}h*WGNbJWyiL0wqHG5O|5m+9{2 z!5|nnJ$fDUo)2v@!3yY|4Kj}abXOa)HdVbYrClF2qG=nwTmzt{zcX&spzHUi+1+nx z>W{zsB;T`QsKU>={ruQ?%F{D`$-nl7^6G5n*!5r?;e}vO&ov&}o{3?(0;B6+moel6 zHLdQ&fnY%f#^sm>vl@9SlqhQkGjamZZ)ujtFe=8j_#_}y z>qz-OA)7-oV(zqG@w@ileg0)BHgIMl6e=U?F?H!^HYdzYi~WzA*?|}Jz|wVDL3w*I ztk_~xX{QJO)vGOYCI>=llul&V{G7KSB5R8<{ATn`Yj8yyx9;7cvA*J%%76cDy^K9< z6%uCKFR@aaaBcI}ZE9;SD>ILKb(1MU({0MMApnn_E*I`8{20%R+OP+rvR`v$<2vDv_P7sL3Iz(j)ZZK zd%lrojAF?dFPA|c-wkyJvd2k|l|Cc-W{~vpA{txvY z_K(kE493>NWEn(7Wh?vGl08MF#S%IySz-!V5;K*EtSuxGk8L{hepiHZm# z$&_Wj*G%W!pZh=f{&IVqAI>?vU+c9#uj_SPlH?N(N+>~d_jgzNsyP<3mrokY< zNbvd+ zXTyNKhF0@uy@78|Ty|ZK^6I0N;Tl*vNCtY=Rl-Jpb;Fldj~xxCY$tA<2;4@$3&pu_ zsBgiJV5$kjcIy)C1P*{iSs(?mP3HFQ21y}jtdB&U>EsRq%{WH!SHqap&97fX?fot{ zsRzWqACuya$Aup{KKHt7$BJx6dlhXF!{Xj6m|nTbNz@_Cs>V-zbKFLHGj*)~!fc(R zcT3#B@n$(OHRvdKgIF2uCH!?C9K8@J=cCBxxT{EC!MS^HVZbLrBmuuut%DxK4}tAB?Vzp{437LD?VJHH^Qt!kb|M=ghAsmrA%9}TlBuiY)CDXhHI@~+(YAX7J{=<|S$E%T zb@xIuyM~ABSv)wM7>oI{#`HsX$E9_XF{uKQw#Vldp{7LlK>U(CawQw;Y6luHaC93} z(ewQK%{>n1PSf7(CuMg{c?^wUd`Oe576ng9n}w+tQ95QXLhqbzy;4tlmU>lR$N$G+ zw^`ZPSsoxd*!d27-OFKm0ahK7>??;V9B}0!;K6LNM6Y)U)1rjJ&dv9so2IQ%jT<}K zNwjt-RzAAzvTwod-}bJ4P+0B{r(|TLzc>R*A;4t!9Tm=dOe7lJ z`uar>d5l0WpIq@&?ywEDN*(Qsxgn4DOxzU)a?|Q)w?Xxxm)^P7ZxleYfHvOmT8yB2 zY4OJ0_;hS$seRw_!f53Y^~HiNjaYqd$)m^Ts-OlyJ$Z07i@!m7gS2+OwJ3VluO>|h zDh`1u4?#eS6?}k6)7lY;_2dxg;3{uZPUU#aa1*$AuPg_eyeoP z{8{O{rd4q(A87u!`pl5{jlM&^8c{SB>g46xh>U&B(AjT`&Blr#c>2+j)l{Fe&=l|VqLiEy5((E>UX^lwkb8CY6r#(T+A6$4(#0Mirc zZOqTj>W*SoJY8nsz)W|oI})|pKg0Tc4J#-ZIDf842d|Aj zB3zh#>q^w`r4irpUs>tT?>(+GJ_t`*gwjddb~UQ(5#MerkklwL(nk^)@u^7*zi<;; znfRU3UJj_-WQm1iC(yJaXA=J)PfSI}v*jjB=S_a7(5j&5F!n1Ky&d?7m$Y*&uq@^f zH`Gy&3RSXKLTM^KWUdNpB_uz0L}t%K-LkFd_VQ*-)=0PX7rd*xFr^lwXizt(b&wUE z{Jao}M69!&ye7+#?H@|ME^~??Z!feSp;{%sFSF)830-ObAgtVw5Q~XuGO(Ezr$Xv( zZQfc<4p9vBjTGgF=)`&5{Ul0nd_UV5)ms0K>-VfzO_~}tf^cTmi19f`Xg*&$>v@B@ z)Wp}*5f%&Q%^dG3c=}+L*9W^#+)7Imko-E@yveeVz?MK;%hgrnZS_wt{Q()9^#ayv z7+^9Skh#p#DR+SyZq7nsJhc@sM)P;KDZ))0&JNZ0Co_H^IyuwF=mMsqtj+ejZm26` zfAI&h>Lk>T={e0rXm3BQJt-gHjQ)P$cm*LLG+x1zA6=H~xSW6;e?PDpaT+Xv;z&^S zz)~*T_W%=wVMgbn<}9xCSJ!WKe)DvZk|N);?rsb7^vu4Deb*4?@1eVr z3G{zMU1h{ZqpLr6HI{`c!s5AonX>eIa|#aXeg+YB%zC|ml`lCVccy4TkC|meicC-6 zAtKBC&2IWTcIoY0@)@?^2{lPeF+_h{3+iT_KeZ)Ran)raF+An#mqYe8H%~*sr|$W> zOs|SXar%sG?4<~~tgl~!-Q1y~*#>U^Gm~rRBBr8->qoz`1=})zzwWaYd}~*Kg-`nT z*N$aN#OLu@+R0geMA;&!KD3wm$M}YN9tw|k#pZE$7E~UiZ=XIi@1AW8hK^aXE?fKQ zTI0edcR7-;Q~mNnLQG&SK;{y(?I4CG0|%iUfB2gtG~hBLohcLM|{`MyIz=1I8(toh@0$V0379}Bw#*#e>aM+nuce#I3V z!9BxuGXCcb%G1Tn-sX=V`ny@+*JUrckOYH8Ew`vd!eiTR?KRB350-?I5BA3NA5W=K z4O!_p^!eQoq2ck1Q3*2zD~+|A-G2tv=L}-e_mdCjqC`JhQAA6VUd6aL` zpBG{DMpMx&5;@m3H{>=d<&$itJ-)?Wm!|{gnjo#c12Dh3of29*Z(U-3}L) zd~xO5JK=0Bcink=3lbHpXrRO<&_mc6^dY_;Rg34=sV|Do8B#s(DE0mM&MwO~c>a@u z(84VRPpGP=T)t=G7W#}v`GNW#=f8FE{w^xPa{h+|va~x0dgIvAjoISCIP_>*iZ0dz zD*-hY)eA*!Gi+Hh4Aq{eV?J&l)xuw!xbdk99D({&N2=;?S22Xk1Cv@8Bl$oINI|B? z%WQG(S6#wWe!s+B>ZS(8bkDr%UM;@8%klV}NY0TwgY}!^dT0?i1CzklH_b*4AmKnS zDSzpurM3$Vz?e=a>SL_UfMxqX8uSKrl_+3c70}Il=703;LKj1GpY8_|#tY|%M`m;U z_R-}Kd5oqruQNtcxcnG}U&w#9M2mqOjrgj8mu$_Q_@eSlEtBiq)`!eI<@W_PCYJ6z zM^d~F=N-m%im9jAT^NSgLgD=#?24@2{zF`0TLEOvw}wMW>{`>P(9u3z&`Ai|u|L`D zBhAx=dr&{SGIHT6QoLW_(y1ruIzvCNt377*;bOlUEQA^QNKwkcCdgCpyoQU%mbSIB zeCx5nHuXILPR>wa)=3Ht>9Rr~^7(sonxN5Qfz1h^0crBR!=R6FJ=d+L*hMYHb$OWq zFDi$@=nIEeYd#OI7*&0!lPG`bBDU^OtlNaNL`VmhxT&ZsNp+w8mObJs_$J(U@wyYc zNN>RaSoha==h%Gu4_=I#+WURn<7kk7Kjile>&PK68Gx5_i5b3c? zfUWRB1rF#CZI_isXsCZNIvXj-3(D*;bpO`m8J4xgj$V_EO%N0l-W;ceF~sLx{=VUO zQEB7MJq^vU){3Cj)mQIy+tf}`1FM%JL?}DUiK;)J8XD((hJs7yihf(L<1o2zIcXF6 ziXH7G1(|lK;=soTY*1}rBOZc;I?yHZba}RsvB{IFC-@9>8IRbS&2cv9thUJKi6=25 zID<)HgdUUpd{f~_Y!tSLyHhMc8mtCaJ~qVrUVw8geoJzcV_>}`l<SwP&n=3YUV^_m@J}R{RVXy&3k6{mY&YnQNqrC-6E*pEyvDUifAX}5wADqLT6B6t4 z)$l;ga*JO6E{u{mFwNBki~gGJuKowEU?)9gSA5&!g^QYuUtknK`$+ci!CYY5Uw~Vc zqrIcev8~Eq3XE*o*!ixFY@;HhAai*{6>1#{)NZFX#wfb1-zmFCJd4}<8Gcu2t773X zsv2nP4w&NXz1$sKKDaOth7rwvQzU6@Q@5|ig>_KxLx8^-4dvSm!-Q%#19yxc!ghlE zOoSQ0o>ZbqvrlN@;xH{JG9Cr59*N}LELD+UL&||0>eg42pWo;*ay$dtLoW|X z`uXORYNrmBdMKcs%pJ#((em95VWggS$G1bx$3H`I$PVBO3G(q=;0s*_$!!HnP3A__ z3iW5d7(H)n2289*-{Ur&NOHV)o;FWC0BZMV*A7Qb+wT7L+I-qPN1$&(=9G(D%DJMD z!yFp&BmEr`ht%B5tq2_78?ulHW{i22dy4>) zPnl~zEP%~NRSir-pyOZf?ZTFh_C9R$U9z!#cg$^}hN2gv^Ttt%MV%Mz*43<}pmDI${=*tK;x31qhB$8N)NS}>zHuP(oD|@ zL8U4kuTH@sHB~Z!)dqS0D%dTNO5Jv8yx;qMHT<9l8-%bqJ&G5y)m2O@0V zRA3Kj-k}4!w%tbv{h}7MpwW2mm6K~I0rfr0W}Iv8;>1*JKxv{G=5Al$n)kg%8}zs9 zq66Ylo|q!`Ju6kdqX`im8WfJhO>a3cjVU*OA*fUng0vt)fay4OEMXRZHo}EiRMmfQ zq8>b>o#%QK)zAoAyfB?v6=931UC_RV*MmIaw1fUkwgoA!v8VZ*Nu zruVg~suH18)YaTCk2gGdFk5!vMYv+Q~a@Jbv9oCxJWe+!S*Rr>NBH-v=% z+-5C>jt5N%CM-B3++p~B84w+wCSipyMp=9$5ULf(4up7SXR;v$xI7& z=}gL^T}FP_3iK%NamSwY{H)I_2^&%2Vc-0FE6$~G1FI1kr^Ae`#66?HGj(}zCqLx3 z7o>W9$QB2KdB(`?oop<0t;2w>D8tUSY^2uRfjX|siIcTdd8*Dz(}~a<>Q|_|$Zh)x$$)aaz9$Uo1cDqcE* zmf~c$5+3eZGqV-CC<%!;ghAn0s)A=RuXC*V9^RQeGMRp>Gf=BXbE>j{8~+vM4_DNX z)N}@@(@u$Qb1(E>1Yh~up0f7C2b6yK?W^i4djfCl55we~ny7XvoQyJY%lVz$;jx2} zR&vuj3Nuih;?okq2iqA~w~n_>DVw%FXvPkTI_T*K@POHP4p)i{=l=8|P#xaXiVC6i zcwbLAC!o}HSw5nwW%GS+)Ngs&M#%O&U47J9Megy=tkPwL&pl$mk*cQu?h;Z8 zf~A)u`x-gvDPAC>Rtl<()7iXzdjLrS8E)vP1!v+!H@9~h*poat3q6Em6vOp6OAthN z-VL2}Ob+cB+XciD!KvX_kP^qs&apBZYDH3v%`G(4am+($DdyLn%iGMKHK(6tx79Fu zNTQqqHh>Fy%p}{{`H6GK-~UhmV3(x|LIPP<2x2CRDjAIT9orW7sEwKvtJrBixh^l{ zH#gmxGr~`Wa`U9tz9>OjM0!g&nc*8oF|qSI!j=9W&?9~h*$OS2StsX;Z+jTLfyvVo zlAde^FFWf&Sb1+UZ~)T)MT7>nn*<7bsQ%z#h?2SP0$bw@qHPBDOp^A|D>+Q|hr?t& z_DQX3)IMww$RDp${EVCGDnc$vHlU4s5gY13^V~h)B)jkeF+ttAL;ivkZ3a+dGWSOt zDi(<0BIlG>p31Se2K+k0zaFV&%Qg}i)sNf%TnBluwpQ|p_h)$AdSS8yoL49d{twW# zP%U3HHs3;gZxGrN=tZ4FtcDynadK9cegOgHWw-AF00b?!zQ}{N#Zz{$UCGR8D{zCd zyK0Zxl2C0(|I?TG?^jayrcsi3-E+q^L67(Ef}4&o9mL!PC= z-7B%M&C<@Wjw=|XpiQKp16Y!SSi{yQ8kWO5Nd1+=UaLBPSHnTexOXMB#zI+lb{8fu zNVd=ii^gRF4+Jd1Ah6p`=r>=Wj=gL6em}dzn^uEPfQr=i=Yz0I>^2<9kD$9aENIty z2R#CF1H}}~th_vQeqP9JrEjizA&)f}B>Lu~CE$*(g0k`(rR8pO}-Dzn0 z1w#2F6qklvyev*G9ts5E4mt@D0HZ1`jX(YN*DvQYe+z-PF2}HPyCicEdZ()i)Phy2 z4Wj?Ca6d5>syy3G>+wl~(u;t9hoMFU1cZd5AWUj`6rA2X#1zS64;L!QL{SVNXeU*E ztV@=COv2jbFGhc78)t6aBR-3165I=|YYIeX@E-?3jB?OSdpz6b?nZ5U$UNs3w>3H(T7e~l!r4-2XcgL_gRCNK4C2p6Nj6*u@SIsZ+s0By$b-qQsA4JTOSH+- zN?kfQD5*7MBGChE%nfu^dO)EZ16S-;%7;eK;2qR)=;u+tUqR=YKzVky&&QvlbRge&A<{#x!3i~v2J-`{aq3gMo0H1BL42=&#mS`-chqdD$--E*ThGbI-oORNB-7B;y4iAoC zYS{bAER~uAjBx5RfjMdff@WW;dIIsm~ks99q%` zmR=QrhfJ3A^_Ft(Y_$C}M}94Ev*nj%JMiufXwCKpRdl6GGY%Ci`X5XlP<^{s)LTwKq9Nh^m-D%N*G5qq{4}k z%83+q3qqAsXo?~w@$a1NoH?UG3-dF|?42IR3vo{9m5v48&v>7aHq;q-(YN^ zaQ&Ne+bLmyS1_DFc(t+RV6vJ0xCPY}T?D8V5c_@sv=3a2Qnv9evm5HYm~dVnV9B*D zkgrq&rt@PC<^CMiV|O`?d(fGL(#59iZ*+jQ=9cH74ui#)*R|0qr?QHvjEqwqj(O+O zG_gz>h9-wM|3q;}-Zlv!NqReygybSRaBzj9?-sdBw>}KEok+b8R;WHz^2oXkeCcum zF{X%gf#_;`*ADnIM@_bbOg1x3YMrMgVEphi9BSB<3ZdMF%>ggE0ZUH7I$=jZwhBZK zAiRk3UviM=kVB4gM|&V`7FCZPgKm4^_SXI0#qGTR_}s;=9ai8y&7zu6Y{alI#}vt; z<$&=qySokk&hs~i>BIv~MMs1rQIc`vwR<2DQ!~>`d%nDDWBUXi=|pO1ku;~=y5B-> z@_%=l#n~x40-+0~a;K-ywU`4n)R z>nd20mfiDgPkIv$97AD>Bs2%z4P*m+tjeFx8@4vM!Iik01v)I&^+5Oz2=cX@#E3Ec ziSW8Id6HApe7$p8iaWK>wvo5dP*u|hXv$7$MU1J;XpxPDYs}fWNBj;}8Y_r?bICIz8f6!S~<0GKZ-?gK5%@_{g{6pL{o~; zcvKeJMZDTtFr=?(}XPoVZU+0o1$CiP~BRJw9l2ZwEk^tJ2D}C3(=iWca{(iR5 zy?dn~^H(!BQoL&oGl4GAFT+~@+nZ;A?oWhy9PvQBLsKPe~L#@mSox!e zPW`ryEmT7d{_deqj0;{gV}iGPGJT+bnk?nMa5$d@%^=4-qEDdDVRPHhvh{?|BpNv z#?z&FhB2Y`Z7Q=L<{{Wzq(hp3uX+e%d7A5yXbOf0EiI_F2%Iv*}AD^e< zX@;15qC=Q1T}mlO!Sg$QS+{&^IW$b}X;D?ZG&zyL;wqiL3ThW##TCGmLjU42-~p~W%(kzR)Ymb$GtSeakg{0COleI^Hq&lL<1u*X=iyDiTj0`v z0TDp@XjWk#Twxr!4m5nGo(M<=zF6S9O;ucxjW3KNvLHbp%t%n9%Ev1Hic3L*-+$G< zOn!t*lHjvm-J)?K6dKR=AeRiL*{A%L^NLkGIO7PWe*Emvdc zxJ|K1zMzdC+lLzA3g^~CznnCcLi)agq>k(x&5x1FvE;q-r1%>^+Zw=p*YkxX;Dli05#?iyfeg? zDm)B6^g`9s5@2QSe!gHlh`F_eeJR&>pA$$t=BBB7-OD^t8a)DnV37+PGgv1FAheX* z)X{#kAhS1A2V@qpe5*ktWD98t95~&vf`=-{`;e7g5~;SwD{Q_O`mrgv$M=BBeQ~~i zk^ZY*3cKW{%Ajpn8P)KB(khF+YCcEMJe!m_jFoI=3tXN<-U9B^I=9nqN^ZMfK#PJu zL$dT8^tYWo+`e3n8Qyh+%%W1VE|-sWpfe&tjVo|*EyeBSP3;xBLTjUmA;$KDe^}hL zh2SodcJ76hi*MynLZDHa^n=o*|8fCRj1hacgKqm|(C2cO;vv5t!zMkeR;EWxz(%@nQ1DUM* zJDmV$Ivn_ue~?>95v}7vbx7QUbA%(L4HBh*SlCukC)20RY3AfUV?^J6@XQGAhP}DegKZ}LA2IwN zG5r5288#5v??3-ip{Fq0K-`PYLl*^<-lSI10(JYWs2a2$T|-~5aq*Gg+CQ(^JVvEr zU*j?{nOvEulb8gQP+;k~@w9>8J1WVBGraVdva!VY?udt*Ja7CD&iQxz!p6>vtWZP{ zIkyW_jNKdlTw~3K!TY&5`xcBp#5giBC$TkHt-#VL+BZ|tdQc)4pw^!hq|hqS4oA)K ze4mBb!VhR#r4Im^T93(;%+iJWo(4`x9VT!z0Kdm_;d1Hw(}WnsCjEfRw*bnyNsFVU zPByNdrj-=C52G6N`2@_AcnxnFKN!c`YQa^Od&IBDC zOm}_Ir2HMT_uhxXW+$7U3AcI*&MEb0&o2^azY#sUpQnopm-7*TZ7>T9mjbDm7%P;x z%q1A{GisOgM9o$tNfcd=86lAF*(PZ)K*Z1qOvl}>f-I&UbwH(IaG3POZr~?s?*2;CX`(cQvY1!CeThru2i4pq?TzyP6j)p)ds<`M3TFPa1 zUJ84V+|7Wm@iEpE%CEYb2KF|ZecXaXV6(V=ZRUSyAp-!?2y0q#Dg#Usw;yQi54B;B zAP314a{ung6GFRfCsnY^-zNT<9)RjbL2$l;!?BN}2JEV;W(1K9X_+GyB z91jWOz#HFP;B{u4r%Sj*Ex$snqLiSRyk+An66(F*FWey@)Gwk~-Tyfm^?tZ-fIe)I zDuf7W27LnHuI57qZb({6QPe&F&OZyHCbcBcc-xGXoYm{-CIyHmvCnipq!f&uO2< z2#KESV})7Mv^zBE{E)}y;M5r7E$tKpQ4d^y%a$}3bF$#w4dY7Jn&kIN21!NXi`Mj4U27a4vXjgHhmkiGd?b4`O7kqMKt@Vj=xY*U z31nR01OVa63>{+3F!CF3l3NW7^YA%97 zYxB@lbAR4{MeBLEgWWH8d8<8=8?E2pPuy+4J2v^$Qr>RU-GtMURwIB{ z%J$K@^}SuSeSEQPDJ<=YV%C?s(mtK>(2ssKQzs?*7M5Q-kCXd!X8V>F)~@*`DuS}; zQQ}LVxLE#%9Nmyfcxnp>U+|Qo?7u&xU&Vo_Bo~p^0Xyja-SW24BBZj7=3i_a9UX9; z50xwU3v;MaaHHSDjpapwJZt{@Dacpoyv0=t-Av3R+LF$a%X@tEj*)ho25x-_l#a#@l;5v7CQXtQ#VPw;k@PCUtsy+;#4a2rHDC^1}!nPVEXw42$ z!fPt-u|F}T<{TBCyl^^~*=V@oLiK+K5p8kD-QCd#yDRN#nyV?= z;P8LPV3I3vPum~bTk^qn)@E{Bdum9m^ctC%D0*gFPo6sO<~b#-KXDqV``<_R=brW* zE@y6^(;24Q#=PjW?B5j^pmt53@}%>y|6bVb-v1*3tcoLExZt`%=W~=iM#9M>=~eJr z=A(10*ysoF$yB8>PfCs8+wIQ6rQBitwcn60M_V|s=kl>3 zUUn}r{z?5pCH?P%gI@L3nq8Q@Be1p!ytS8x1nZ%otgM~rHdG?{yhQn(z-Xy*qG|^W z^xs(v)pe40)tj8r6xCjrdK}K-iyvaiK8IH(IFy}74)p-sDZxFeR>oPfibec)VYg3^ zc7<9S3S*-j@t#rt%&{bpYB=|^ou}AD1lP579kAiBl2F4S*(8pH+FK>~AC3R>-E<1o zec8=FHM(+g73DRN1HoDCB6y~*Y0EQaRBxh`UGEseV;^lYD#S^@&9kR(LWQ# zkRa-qQ^)i6-eVs&##9y{hr2=}`8)XU4tQy1*06W0NzUG*(%*yoRM@-GYoY`>`M<6_ z^qCL65_wy4a!h1Oby~P}U<17mNn@rZmGsCZ3BK_0fau0AQtp^l@qno7r#NCZjCMCa{8MjDmM(Zc%ZJD%eT9e1JhD z{Wk{YQCi&L9PP^ZjSKVYlwCyw%#6T9!G6Kul)z}d5P@LcU@=$9Pgi<4-3WjxOS%I+ zan(q9;N#-9@-GI*{{PuT1{+lLNfv*lJbxMvjyKJC2V7mN&y z;z^K*|Ni7YmqPvW)sTpIDA?_5o36wcMr@u?obOGD5L%Y16@k(>e8Jq!*wvedD&HD* z6R(c?@T>BsUQ`i2f;l44&(qJoun7gO}#XBOsVKbCr44$>?pix!zWC$sVXf zgDP}nT=+kBDX56REWuuNOD;WfS`WnQPOB=ZyzyF*zHzy9m8(`V_%11Sna~Xbj_Ts| zVrRFYnkMKz%#jCIlmHe}qTZy6ForR8CDPiB@okaO7WE(uLOayy(;!wa*}s>%Q8aqs zzwIgd)(Gx*f5#|!b^eJyQVJx6o{}N$6wpS zB@dDwf>gWX=japJPfeG88&{(H{vucrGS}X8m}>3o>(AR<nT$1KY}JD zkN@Wqtw6ho)p8wqMz$gj34ZSZCaV_gHX6J)%vwZ8p|xs&vWi=-*#j9%)au4m`eE16 zE-_4{u76mzv%zM01DgykH*`x?LRi1P_!5tb6F%`QXs4fr#?HbnnfaDqnvVxwB0Swp zmHU5eZm}Yw+d4u>xAs$9&B99#ftYwC*uB+siJ3#S?RB`ejANoHMnwa`AIW>`MTXIt zSnHV4@9HvKzZ6%=CobC8c9l-KEW>6>Mx;WlJSLDQ z$=ctjKdM=H`p(o2#+!EfxB%I0Te->Hk@X`VeQezn!{5IcI@qbkxS66xO`&?s5lw8? zCrAcw2$oE}>i4@Zp}F>UM!sc4ez;3gA;n0WFG5jJGGUC?!x+yKnQQxE$85aCFpVM@hlewH<+Di$ac3jbCViRq%}*&W+i=Nj3?ipo9%0*wKB%9na=f{ z91B?yn4!(L1uUQcjayz~HZ$j+M^Me@#;*^&)`|F;vslS*JZF%(w4%FsK6Gw$hZxHs zgPP^Aw05=fX9#`k@=}%bh5R)R4}LpGyk0r7HX<|iT651?n8Qt6d_lU!=SD9PN@!ed1>ZhiBKNy zOf?tdH2o5DHnBxaWyzJk{A=_2H3fzs3(C@X!f;G#U}B6mCSu+(S2U*e*$L`R+Rd0Y zzSj=@(zQ<-H-v9Ivo@n_e^#Ulf3RpUcf^_b8-%BAjMy7uO{czP>+L%ks2v-Fx{FyQfI5|XRp{>jHF|3h|oNl zrYoE0X5VaWb>A6Yk@pVHcUbey&iwu_Fkr&YKAlZA*Uic4#@q6k4M(wtlivHFKh}xc z^Wm8nSqADi7Uy<7c{Sg#s@oyQTpVpghC|YpYc3dGwfGH2)cRAXqMhTC5BdE|4Mp8M z=c*N&6nq}UZc?KjW<;W}ZJ+#G$2^Ibv8`=Fn8mR&rM!gC<7+)@6gthYchc{9Df2X6%Sw^UsC3EP5>X{+ds3OF2IX7PY3m>L)$?p#V07IXBW+RF?`mtB zsm;nwOXesaYV+GerYZnZ^r8DkgVdT)4XOE-HZFUsV+l_WGG?#W)yvyle@%XdB3{m! zBkZ-p4x-Pa2M@$Qtu&`u(Fk+?;#ob+yC3PG2>m-Z9-s=$k&-mGu7)=pty>c!Uc08Y zi8(dK^nYQs?OcH&@$%SQZ0rGA5V{`aL??>Zmq^#*nMxF~CRMr){Y25?J;Kw|bIpc< zzkD*cXgNeZsJv(4L;vH>w>ngzR4&rgmFMHq@@BFTSBoCW{1Xx*xQDD|Q6mz|lE!rA zuAXMOVy(d_Zga$cyQ0wf>)9;NtVkKk@Ch-f!Hbl)_nx*Bmn-uJdin9$W39dspnN0( z^^T-~`RNnwf8o0t932S*=kmBY`d#8(n%x(5ReNVi_>7-Wnm?qlexr)-t7vdbFwu)>^Q zpWwipAtsED4EA9Uk9+>09y9Q)99?>Qk}3A;&S;QS8Fl4+ozTdq6QpHDdOkG*8&oIL zu)g-=UHYVb*!XSolHBTw%xU{{<6hJ`u8*DRV?GYAA_R5{y2_AHQDeknZnM|R?{J@H zY2H0XW_4gK?O=M}bbr7ajWAsG(C;8y5J_&NyRn&QK`!N~o}(_aZ zbbP@&yJ!5s)#&#&11csa!oR$JZ2( z>S-b)LxuymPuN`qra)7b2Z(r^*SD|#*ybCrlHlt6TQwa0kiUKz-!76+0y#lJa0hD` z=a(N)>)uQi3lJ|~XTx+-^rsEzdqV%Z$vrKpjx#VZ|6mIY;`fS-Bi@ zqNo-3X_PrTSC3x$%TVa}H;cHZBkBDcn!OhUiI?S3T3)ombZ~l}1X&M|`gxkyh4W5ETnc$$ zhMpoOxX-ztTphj0z#|%=5h-^FyYZ4&BeKe({fu1>wvR^KO8Dfr>@sJTY*CrV23y+x?z7mt5btL-gL#N9+^}B-bU;{TJLEN>*M^#>BGmD2Yr$&jJiy9^jRn{@uet_-lEWEl_ zn^?PVI4<{HjCbb#YPuQS+!{2|FQ&9w)1pp)#~kU?Jt{2q z{bKoymcuhD;b{g{cdq2mM=O0IYy5;R9TR2_Z>=IveOn8H2kc>f=DO9DAY8cCK=r97 zc_eY@R5C?tek?Q8qHXiW->8-lp11UcsW}|Tnla$jUO#eiS(JELV#9cn`1X&khfzVO zan$*H{x2K$wgyesuCHyweY&d5LsaYB)brzXSYLLXYl=Z6%R2OapfL8l9m{Yein{1I z7x5XiQ`Vf^c|&~qKa%Dqx!sfDKSacew@|JGMn42=NQ`yDDmMpc7CC&;FVa=}oic0Y z2$$g&Nb7jp>RU(nq5k$7SxggL**SlTA-Z8*vu+bH?)hwL6RP$(?$cJ}U`X2Qo%;?N zn>w-frTPmF-1wtHz4Zi%{~mi(cvWPiyXt2COXKQ_P~(cR2rats@?xHgx>UsXkHD~URdv2S7KEJzEt24bFNi%F1B$Y(B-pyBr2-p5_sAT zNqi`iuWSeSYe-tdKcr`N6-5*0dv$VMoQ30C-gNTM)%R%biq$-!ChnS8afk2}-pBn= z|DAAV%ht!E{i~7`?Iv9D>p>TU8~BvFv)8&dduyFl12#f%VC@lN^Sk}8+$AX(%3Z?K zN~-i1&mY&$^h)@k>t!?YYm<)!<}hn}fSNWsC5A@>_yHf;7g^xfpb zb_y@K8t)xQ4{$qAyey5)d@I2Cz1{4YB5g#UIWRhVf4LW_nb&`Y`xHgB$Emc8UxYL` zEyjiAc*on#wE1ouYKF6LI3{>cR^?6=WuAN}gJ*v4-e=zpcpq22c#v`^ibv)awY>){ z`$VScZ=Mqadxr&>)r@x~mo_*`rvh?!$+6Yg#3c8InFC&UYf{Bev!#kiPe**B7o3TG z1tm;}A|L+5ig3B7k}JG){wCOhTSdc6f%T-AYbgTc>Zq{`ND1>T>IdA!VTw^Oe|Qbu zkm`50m9@=L#MS;hfTK5yTkLHs)PC=zD?VZxuD`&%clFL(WQQzk>>}k1@vr6-oDX!FeEcbj&2CF#_%-I#lax>6xVhT0YzY3lbCM9Fc!TY|=#A zvhw-u+)JR}(M*x@$iQ2Icj89YtiC-|IhP!`!OFBIO2}b+A~A&~=hSiK`O&M<76k=Z z>Wis;sHUD+-J`KtzloFOlbn0dsiOD`P-c6F+m# zC|H5f4pIUbuG8O0Tf84@csS(Dn0BC=C`+gA5#cFzUOnU~d4E2vh%W*g?CKU20R5}S zs3htXXew^!JNZ`~^F(8I55+Me*V4|U*NI_$u+CtU$bknnOim1lB0Sy7j5lTB6+I=* zzxt_{D^ng5p8BB-JKufYI<~iai*0%d)|tQfM8^FVm)4*e9qZF9uvks0i%xI{5jnjq zfcDl*qGW!YJV47RG2Rd?{bz3?4v4+9){{jHvtlM>N8SMiz}(1)y_Zq=e#8h-c{>^* zKaFvA`o3DSnRs~}u%lQlp_V7&!2Ya_jUF1y)chLN(>xQ)s-(G7-<+CbMcisj&?~wVPIm&sFl0&w zgw3VwR)Zw1DXamg_T<1s->v7&!@9^(HxdX>cPR5{`5OgeDAG-vrwdQno0LgJjo1dV zxv-?gVthTJ+T(8I2kR;9M{eiu7rPvyJc*zjj|$I#5Lc(Kp$9Ju7*+kAJ&l#C3AYQw zPdh;Ppk79gFWNTgpqAn#R{HP&E_){OJ?H@g5LmbwT=lbA<&?>ZmY}ryH@Hu$y~mC- z0nb^_)Ln4q${h4(-g|xkNV{&Vqe3U#|KRXvX1pkD;pW{~m!uFU9P>e7wDKR!{yR9l zrx5Y7H(Cq4$Sk~i&Ec=TQ6m+>jfAHn#Vr;~z_@5idSJX%r3eF7d~>8^;vxl4ms&3U znvg?E{c%$I$(swAKBQ+|DUA8DgU5UH+p$DDmcx5}ury3$(BYRmbq;Fbm<6B_0N$?> zlrsiLcn_4|KHKY1M=w8Ac_!w=ljfIgj77raSGAIpIltrvK`t7At-Uh>rgwf#Hpv$u z1mTa2C;m|QpzewtiW|{6&_>Ym%sMz%(q8jOP<>l!ru0_-0VQW0V8k>IYj-2b4Quf-s|ZiKaM|H3Z-C>rAU#am@IPuL zQ3h@icfVYuqy=seOIPTu#;;oF2SvP@-VwHAIi%O<)s~pbo;lNwK!15k6NeMC0rPsX zT;ilR>5HF?IJ3n#G5_UuJ=~5h){ycuH68aOGldhf zf;-kizV_M`@Ic%2)4a~yiryLdEiPQY0FFxm3_5&Db@NZD$q*7Hyl5cxG#j%$uJEW< zZfAr$)vq_i;P_l6>8b(Yb4MpGV8?dj3JfKK@U)}k(u-)xYa>b9epTPUD7WE&kQ=77;XCtHY_p3&rPe)+)n5AD|9Q|rE$_2S~`efrG}g8hX4 zE)ZVb8b~`J?q~DR9*<=L;LuLRkOJy4`E*@sbfYcu7Sc#X6wQ{mF)jx36r}H?NgNgK zJv;99_U+gvdP}dv=fFeUo!=wh`UQ?&q^xC#gk=vMAJgt86`{vLsG8;IzLJATjcxig z)ca68osoa(4~@USq{nCZEqU)%CBB9pvI*W9aIl#gHnhLf{$TxWg?~QX{invdWPN31 z!o$vu_ZL*?XTiX*oT3i~l)8~jt{gu~R}5Q}*qUGf)iy3n$r%6Sr(B2C<<_7Ki{0L~ zyM;+qW|%<%VD6YOmt!N>snY#d2>WPw`XvL852&Zv1fEoE|XQtZSE>6Ek~b2L!c5cW8-N zP=g%s-;QNHOAstts`_{u$pnea3$8k`bwI(*a7vOyAu!T7MD>ZyiuAD8Y$h?OhrpIl ze;bhT)BC;X+=pgpY4ophL0Lk8aCv1QkJybyno@}|{~?I0VB|r(yb_Nc`Skd4U}6%S z+m`UTh>L-uN!zy9i43EB{4z}UxXV)V2u}q{F8xeX=rl-hT`n`t&&1WD`kMgWJ3-2o z{kTV8_ti>XkIzqb{A7)opa?3OzjK3|>y+^H{_p8b^#$+t%^7ESo2D~fP!um_eQ_SI zPP_@C#(TL#cY06Bm94v+E2<~PQFWf%S~PI3T;-{OiJufYFA%Xs4jyX?Xj!PiBT!kI$)1qx91!Nq4a>=u!xD0~I^FL*Ux}#YaFF z!6@>Xl979){y}Hsr5pJ#ufzYtOL{_J(0d!Dl<@Qdu>DK&HFo40Gh)(u_n?}9b}#Nz z$`AE|-Di5okm(2Qm-$EjFm0U=O11?`GDP9h55k3>p|?%w$Au=<~`vWq>ev zO{re84H*0&q5X;+YjG1ic3jw+{&sTgjgQp`4g}eocP6^kgNkfJMU5)t6 zgZR|@!D8$q2Sd;R(d?ix035#s`?*F=AN&7!dhd9u|Mw0294C&lBQqnFB%@??tYoHW zQTCR-viCVDL`X!ojAWCUc_P%?9+7=e_Bc|Utn<5le&65kpZEJw8RzvJ_kG>hb=~(% zd4I##uwF#X4PFcZHGK8`XGefRZ3i$N*JSDQ6%W6SAKjzwv_B0ID5h#%j2JFS}0QM*uU&=e-!aI5zej zgMF!Y%n@zml4|+xw?xwVQ{o;z-2R+@ee_$i_Kb_Uo0G(e(hs`Zgt{lxK4U@Pb5U|V(H*C;2 z9)G#s?!a(^H|Ps~fYfh<+Qrpp%Qzq(Az}#X)E|_w;TkU%Ei|oc)sTDlK2u;njm1XL zcBqoL#ysmk#I28^6ul2KpvJK$Fbds8+^s#~bKRpoW%ETbd7bxY6$9C^}}=kEsR_Q{~nlI8UG-8L%d`;g?%-mR-|1$(5v z#EegzFqOl6iYpy?9EdlJ>|i5OGVh$CM7lxE{!KhJUY*5ej%X>&DsuQ8ugLHgYwE)B zQXl_kcJl=BM&am(8(}g`SC4K&oiVr(GV;Ee7KPCEv;I%2PKI+1rPvEnn_=vX0fnNb zwU{T8k)wPPz7pt&=Hd|A78ITvuYGiU1ZG@b^T6c*P$Y^x{TyQ)P7C#ZF0rCLvAT!< zO%=v9nWlwd-tKpV=UX9=rjHXAhMG}?ID8O9U(FRh-G`Or=}C+_dZOQ6YAmQ1ToAgO zJ2r~P9jDe8q=Bf$mkAL?2}6QC76c5oKNyXB8SA@^5o&rhQ zZof97BeEkKrl>IEx7y~e5k{dIIt148Q_X3CJweK#l-kf|V#+C#a>IsM7*;Q7H=#2y1Egr>zIL-_kcTYJ5{ zxBYm+vq1!KYvZWQ@uyOZNP=6pVV&^NAt2t z5H}%q_D|I|`^dd(LFCsJY)~aE`?8ZDC`#$QwC~>8$9iI=uAL(DoJ0ZLM3w54 zrfhF+GxSY4hr6AkUO$ZeDKDxHn-Dw35Ip$)c622@-+i|SSTVz}R|ZK(b<*7(c{CJ? zr-*HbvIY=;{jr`v%@z+U+2=%4B6=^k_{aP&Hc(C=PT$xNIc)A{fnfv&gyh+)>N&y* zlvBq8SQRN2`~r~pwR@@DOuz;v%&4f{Fn!k6a+9QQsOw!ubHj$)!W=FL^{RPVHXRRD zkQw)l+S8;k0C5d3@E75n*jr3n4Ba`k&*SqM^Gs(-MN=a22jvVssYQy31NPtnQKUoi z@$E4u%K$EWeJsfE#|(gK!PHa!sDR`J=j!pp>>x^nH-q4s$mSV1A|<; z!uxE&sM_U(FEv+$inHF#)@*Xq6s+&R?(tu{sLF=j&|i3EK!UUW9pcmwewmbVD;I>V zK)e<(G{1MTsECbE@1Yd>QX~Go+cx=O}EAiG8H!BfE?IU7S6$ zJ!Q##Jx3rKilaA_UwbK%{|TP0QYZtuW1l)Y7tByPZ)jR@qj>(b0fhD?<$k?UFq0i` zYMq8s67zvqhBq8oYw!-)+l#CqxL?uzVpDgkmI#_y+vxky`feGefS$OwS~P6%Mn{Ra z?9Ac*6JFPwEH+`PZVz|0`v?60yc2pDM6=(GQQ<10ceI2LIHfG_Mb0A?+`SmKhm!@k zArk-od4)z>vFg9aS-lU^1$GEF<`FMdc!}3KM|;{Fcq2;kRYO6#@*z-Mm%bJDp7*V; zThrXOhp6Lj(F!r!3NPLmtlsx5t2jFoC%pr8~=M6@DoH))d(44;IhbzvDYL z-Pf&srk+mg2imdNTrvz};&^Jkxgw^BSdW=qMME6oY8%aJ|D=MLEMf!}<_{{P!?g0D zJ})uYdcqUPN+tsH@U<~B0oUuB>9HpT>wE&*FkwS2!=lvRIqz8ge2>6+hM&3nh}SOc zFYXPkX|S}JL+c1ze%;R9V)sWi-BdhyF|#0M8CodJd`mh+@p}>EZMyx_JO25HfeBt* zVWz3fd=VAgz@uE!vsud22jkX}XmV@Ve7WGqKa=^A53N^dd;(rIZ!6=;D5*uG)buSL z0_eI5SE@?!Jb`k4Vm8Es3sFOBoA5j&PP<(;1+Of2Hl}j36&$Eq^NtIzc~-Le3~LC z8^tI(JkH7dB8NVgr^j?Vex0PcStoWFGHv_EkRU){AeFzaQFZh3VzE&Nr7sZRpceCRYx^(~ zV}_$dw9S%zNuT}>T(gAvIxnJi^K0!$n?M!iv8FvxsZ;wtY#{(;DBH7Xv;x)b>Yl4N zQc!eYwp2Qif-KYzvkh4wx}V8SEkT*&jCE`X@9(XS&X$T%h|P$ROxjHMyNen0a(r&% z$*T{r=dt;V4VcrnW?lLw?6_5OX4_Hq_nV?sT!0SSKS@Lecn0Wpf5}ihtf`<4rca7i z3~tywEzZdfjGX}sxk4;jF--VH&zaUE)#A=iyWjSSrrwJCI|%)<1!#aK6ULVmDC9yF zAJ02~lcOgG+H(ZlTK=`^KJ%!hhIP38Ij5UaEoYE`zt{@;@VF6mYC_)44ljUwzfU$* z;5k6*Y4H}5W1K#dIl|gH(mGxL=`%({`jk_pGNA)+(e74fXSAsoP!e48%_w*pl!^!V z1Jc~4314eQArF!VxS6Z<@l^%OdS4}(gT)rL0BBH5yNRsY!{~Pe`Q_|t2nZVG^k>Cy z2a;y%?;tinsjvTEos>v(HTRZB+|Apdrj*gNWXu>|e>8e-->7Lv4}I~pmb~bEb6Vav zGaHwiJCiUny2#~==Gs!zT{xD!WS|W<07f(O8@UFk-?1WaQ})ceUk3} zm~}?;g!i?gJ*@u;!>>t6J%taN6AIGGXv@yK2G*DW?=@h%`9$eGDiLXe zteJDk>P0-JuP%fWjk8E{!wcb?NR+qM-sXoLY<4)8CesCQD`xEfbM~r-+DwvQ1QIVr zHI)I0ztZH&<&>Jd69}mM>UZq^46OW}i6rHT+f>dt&a=2FaJP+q$G71ng{a=<)v+QP z%EJ={dsxxV?{_U73vJyp!3`b@=o3s%{AVjET=|0}@K^Bq#g8o$+ywHkfUk*TpF##} zzrjxh#!~ZFc{lAjS}13tNm9YOiF0E2b8{lNQ%&(=I`R1gD}kVzQF#*OA+95E?T2w( z-nZ3R7n>Ou+upV1*-gqLhTogr@x`=x#ldpbVh-&K}7s$GH66_CQ|{pUF zO8AB~O*R??_Rc%icxk^A8btTb(%!+J&1Zc-%4tzW*uO`4BfUTI$LjY&9%oNSGhf=K@IF7)|X$Ka7&un+n z!g~xuBu|)TD)3B;%w*1PK4Gy5ZfC2elly3r{tJLe)=&j@QHv4**sHzfAUN_SKQj1s z`u&$EQYh=~+}T}hE)>i=>TX^qUEiGO&S3`ZZB2Z%uRTjw6jJ#aNiuE|0J#wv{n770 zs-Ci0_O7Pzow(pyz6K_rJoA^hlrO>Uz41-8v}tD}EJAX82v7Tv9W#m-+6Pml6&7r` zz(6ZGLzK0;Ws0~f!%I@|lFr@RT!?wJIZ55~IYW6~cBg_X;s!1(vO^UC>yFHuWvlPV zbpJXbzE9bts=_F}~ZR z;!?%Odzni{>P{SUQAk%YJA-Q~O^YdFWVXY3Xp)_v$M(#>Tla_YBi=8)+{2C2u_@tV z|4rDJ1bds7+iuaAsWFIZfUjdEKLr>6$j zYpUkvr3Xcz-Dh&-*FM{X^tYFs=L5cD)Kga1pY}bu@JAE>IJ9(HJMUC|aL&G{xKH(4HPrKK!(d6_*+}UE|N*&hNSpAcFqnIyd5JcpN zbRmgB#}u2lEb-%;3$N0)B(9D4Z3YKHg#ZRR`OP_NP=a;XdN+6fHKkPw1<5Iw`tv9r zI;P2KDGV;Pk)?r71kSAa3ok?1%tFeoejDMlqd*|dE^0K$OTD*|}CKL!PW`Tn$ztzx) z3#W{=RhBauelU<8u-Nbp_#2MhbP>4tTuw_A^gy=n8N8BoB;la<8PCrWrOAcs^Kx2s zqyOou34Go_tXTcs@gQ&zVn~sz4)x`OrOfbL)G|Q-=)-#$LN?iY8y#tbnAR;o(K#gz zu1;ecZY%1bXD<0u`K(z7_)h#FNorHEYw%|RedEIpSTF{{iYRq3BK3vK^QI3@LhhZj zG>E$XYxcZ;dprIDuF}LqIj!|_dI$z__#{zkF+|W)MV|j85;RR*O!p@SO@8y5?Z8)j zr2lvsxG|tLLP*Xs^$#}alsjh>#k9fKUUiw{$2*?@$%qOroEXZRqIVc_qQy`J3ISK_ zOd(JE|K|mWqKbw_ku=pQtJ8s{adD2h`JBx7}c@h9W@X!b1fY-IhIlT?uKpbbc#!@Yx6WFfJ`UJ<|=SO&yK zTg17bLfX7T$Q_nlSr$AhcE5x!DD_4HbB8f#9Kj?a}e>tec=ezuM8&-;(is)?lj*Z&{ z1wN`NaE^@mCI^7YJmt5umQ?oKx5}o|&5;yDP?x3Woq`C)xg7?b#5-YVsu1uIwRL0F+ zhZVU{0FU)V%m(7U*No?Xi_>^|-{jP{V0#)ipNHR`r`Ew#*(B0?=&pFi%u6?t={yflnrBi86z3 zLlK3JhN9puoM-MbDOdgfRW$E=`8lK}Z4`Z5gZRFHJ0PAAL{ zK1(9o%&=jrk=3vS)9?iLw?3W#zFw8UNU)9Yb(gojC~@Ll^g23-Du818m-&PJiSOMw zk%*4@Hp>TQmjcd{?_mF%ln{GyoRpNK`-F+uM}0_Mz&_ZVWT>X1hrHAyr?uSV&qSKO z_EQ=EZCIbyY2e!hu?Q#cm7fmrKMwHqTM_`GzMB2Cd!krI1EksXXQSh)_Y90nbkS$g z+d^v9I``8BdSRIBhFM8PBdCYaa#2-79VER_g_pdS>X~g@&XtgrzH%aRuGBP9s^?6I zH`wG2^}-mJVA#Y(d@r;BnQ^NXfyAfh&Gx$E2S;0 zv%x-KebU-QZ^>^Dj#)4xihZ7T{g)sklak&xK5nH~B$GrN)Ho(-8>H{VU4Q~d zHC=!VrU$qEg>MRr4dzbP7^9pA{9+Ut5U8|))CaqiyC`+c7jFva^vP3}YBlwjci>j> zYq1J=x2$z9)tEYfmt+b2;W8Dr&P&zcqmPE?ZDa}XdMm)Ru>m%6lAXsK(TxUT+!!u>>Q|I*0P>kL@Ep&LQne@f29&eS5NgM7`Y zy!J{NR^f~vZ)_qdLJgviC->i(E0BTX=?aqdrDIY%$Z0w64TIDRII_vB_+= zL9nO5z$}~l_kDpl>>%(79)0t8GSC@kfpr%FH=}r6ALe>W(NnVPdZj$Jt&WIE+dkRo z+gc|TF&TEDYeBKMePdgZUQhN;+yT^AVt1Ik_k%*RQ0*`98&TOF<30t`2e~71Q~?Y> z;PH3BwXF`?(oegAZEX?oyZtx#b5u?%=y|igKcY#bxUQvZ+ z;WZ&TK}Dqw(YeZDNeD`~5o`!nQQv0iqk>r*y#iU3#E&)EWH3uCU>jlSXtg1x(H^-7 z?eJ&_tKYgwC6B8(#zwBsRo%C)`Ut zI0x!RQAoJQR~^F0z0}4|Ot?-Mu#+!?l;sVs$8?C@^%!e1_K9+?&GN?exV^6@JP zUPtp#w#aEo!2>z?Cfk5fnzdk`@JUfl1RG9d~PV*wsO=Z$t-^lA*MZg{cD+W@`zx|D^o!PE0nQ(t|F7ciqwr$>D) zfmr~f--*Z-p{Yc1PE;yOoBjpakQecvftZUdQr7qfO-=tTi|vRRB_})5fwl>|G z+ZOnQ8k7sVNBJz0N?47O1`)CI{R~Np90nmfyXVZ=CzvLhJEe<5!eey#giVRtk7gBb zIY9g@#AR=uRn4J^SoywI?C$Y74zE9a29qzC^^f-MQaK+@-z8O(`$4y6WK$2IY3fb3 z%%v@#6Hyy+9}PH2`D#dwZY|0nK#8ItQ%oGy4w7-ZT}k8gdiki{`YVhc1Yc-9AU*e_ zw#$ID1w=T{%4yI4A&GZ?dgyz!MW()fy^W?vCj;kf%l+6S;`v+%j(IU{&RR(Tl?{q7 z+{&6qf$Kgm7`5lvmv#r#5^RAoXye*%$O)wZR{S@x#|`xo_mq^hC_we*RM26hg^;A)&6|7tNU^ zb-#$xieqbmLzX+_Lc9wwvhhDWuY&>b){t6RK>C-OJ;e(4{s#u|Ss`?m|1lZg^3{)z zU`1%`!4c(>IllNt^uzad2xWN#c#}x8GjG5V);evPmy*aKZuj;}r6`o6X0zHWtNMQTG+-pwP-Fpup7 zHUj#oD|jWzwbq&wHY6Oc4#;g@}>y>{0B$v8{zi0y)VLSH1wqVy5iT$J4=-Gqp> zo(ai@Z0t6$`|HS)u%bF1;1%(VrvC?#wyxPGH@O`#PLT+7S)J$GPm5#51!iK)WMh+K z``#Ng*)oGZtiIfn?C~G#d7IDX(obzXE#r2oe+V6uty}S*UHq&}vc75J5;`P9TP>&+1Um9Vb}4aUsQh$fTle&H*w;Nmz7wn0=nV#v+T z$E%FK&wPjC4cFfRK->E?r_OpmI|_ae!85!n;8%nFslQ(pF!^U@d?6x!k`rGAJi5zU zrL?^qdj*a*eeU(#NZ~G9f(rDL^WCS1vpA6A5T?e>dUhDBgIlg-8@6YAGtH}yCWWB| zD5Dsx9mZfQ*-ocY0Q6NjtTdKO($}u+F;{VSq$EvuZOIn7>qLQHZ@Dr28kbCi8l`Eg z8_(rQj0)YF#(|-7#$aKG_NM!^Ra&+(bQAN5YsBG9Aw}Vih;5j8_wi`c^eIXASZu&J z#N-bjsDLE$$}r3}?jVvYLK&n!3Rhe7Z@pS{bEl39)dq6;9`*TO5;V;uviAz#8bo^+ zY+;c*`-i>RNZRhkVWg0)8*~?k)7QmJt-TT_Xa~r;+m#xFBjX3ibASA7N)$omc|{lM zUaI!xD<{4b3>x1s;Tn{}Q~~Nv{kdVQ$kPz#Rw2g}%$gH0D~wJbnOhxNKhl?(q*UmA zqVV|!yV=%2G4$A`I=&|Z*Lh?*ljbOqZ{q#>FqA3KTY?C0R0++Gsw5rCNlhOiQv zUk9y*$u=8Jts)mX|HcI8F*GV4Q+g$sX>m3pT!M+F+`{o5%c)a;eN^!O&0w<@?;ShE zv}$pjAeI#`sFiy$T#1qC*bTAJSz0H*(PqV|mscsSu73QO9>3>qyjS=3#*^Nzu}k{C z89Tn%Z0z%4eJXf;d#7c-@Xk|LaaX~~w-r?glD4U#K*Vi4f88dJV0XnanTDzsCr{0N^DP-XjN*Y ztUfi6k9^sFjt~WcW2mhIA?4ov+u&yLf~Z=2Z+^52&oO+B>L)k8+LCl2hSwGH`pnQN zSKkKBui^WKpsaFdY3sVR>JML2q0L9N|8P?Ara`b$EC2`pRJ`{PY2n4H-h$F(T4`uE%IcgTBK zQ5^^Qm*dt~na19o~GQw$Bq zrSE(7E<1=B&2$9eFJN5=?VJb5TBg3{{yG2lvZgyKoE9gE)5B-JL_6E(I*B6JTe}}S z)O#bFCs62=Tt)n&cU7 zF1WQSAVy85U4{7wV{IUry6#wBwcC)ia$iA+RK|K@Il(%{DS%d6bpG6NSw6(8Nj-Xa zqj2*X#f~BR!#7MV#br;wSJg@I-Y3lnzNo+`ddC=5{57aPb8Dj>xZ`~7R%7xt6g4Am z*7ja1oJ$XuX9&kVnoEEFVk`LG{nU*1CbdCL(^c;CZMO!0kki1mqyRCyFy41NlkJ&0 za=Nld9AW6M;vnG0t_h>j}=N!e-4^$^JYnF3ecHpp-)q{et;&S*xU27Z** z`!5?!1b%!uIa#}|+)UM@Z5hm$W?ewJ=KFo585|F$syEAdO8oH-ZkE~&N~xu7F!)jV zY-Wz)dx{SAo8^|Ad&Z5yac}z2Mt0fE*cjBEa(Zz@#$V`Vds9XD^VHRnP@&wTlNgN1 zgDDwa`D$iz%p+5d3})&RPY+p)p6{Kjykuh4u-;mAYBjFYwO+U~a~$~x-+Pb|%u>+zr zA4Bn-3RNe~4Tc{`Z#rLr&eAjX-WTVp(mk=s6Jh?m z@xRv5nr1XBd`=Hf89Tv@0JTBvrAEHWo_>}Tz5hLiJcU}F%Sqyr;KiPzPc--j&X`Hb z8UpJLgyy7X7meZ?H+Cmii`>$B^mCT%Ue%i`0u($HbFIqP7OP45O&#> z!5N)#0%1^8r=E-~igd94r0DG3{FTr1ulZu5hxfvItq$dUA|ayGdO!W;xc(2_tBZ%> zD7W6X)ewNhm5{D_@ho8@G7AlNEPu8;Fu76@)8AK3YFm;82(MuApK-<2P_6~HE3lSE zyteS;+@pb>Cfa_7>>M98&b{TJ{f*+Qy%FMj#Ym2zD^?h3aSi(SHfojUE-%$=#nTuP2BSit&cY)uiSuiS5$Q zo_F_>Jrm9tqI|N!mx{`We0{^AMIMNd0Zr?4k#6&~-(y*_9t&r<8wr8cnTaHXv zwr5vyE(1}N{r~Xha9Bzn-|Sm>fFK*t_|y3c{K2) zA{`^fmxB4qa_#t*;;M>JLjWZabl*F&YL&*vFxaoy4=Ak1X9IjaF2n(I7$V7CLnBIQ z64!p%Tom#WmaPI8l9f|SN0OTqc^X(*qkhv(Gs;*z+5Te5*>m`hv9Hcv+MgJBv%g~- z)UdkHZlU>C(&>4rf@d~+H5)1=J1V&mJim6u;=RtlpAs!5dSoAh)Cx7O*wc-oNLey1Um0Nb2)G?_nt`zfRLg2mo0av3AFeL{< z2%i8&^kJb$B>9r2C3)rE{VodaEMA(j-j*mT$Fb(`rzdJl)C)@g;Tx70<{v7W)VB1B zlpOj8{hfAyC_^v2F?@xghR_`Ui)N?u1R|k?IDL!MOM$hf**zPxD_O85Kb9Tb%dB6$ zs2K8VBt!(k>qAwd{9HP8?puM=%azOz6xeidKUNxRN}oW0L;LwSHyzQdZWCv7+!c@< zho~6!2q65R(?7apqQm8esa;`4h4OCZpqUAy^RZQAz{wh-n1!|E(P4vJ$^6DwYMiF! zUoARDTp`5}GV?3#h6G3vtVEHO)0U^sx9ONM8;#@@l z9OI$j$)EAB`kR&GBVKlO{n}@D*Aet7%9p(?1o>J?$t5HNyYV#IfF$S2#r;=o&pKw+ zI2*oUy08;5DgBq^XDDa5uxH(_ULRLTSI#MXJh+h-y#xJh9lxKtVu(lr-$ck;QI;E; z^`3t#eg{HMT~*RSTo#2}*&@>O0#2w2V~OGXC~8<~S1{_Jt=7%j8ySoUe{FHHRDyxa@Qnu{HFf_Hl~mQOZE^Tg83ZvM7-qInmHK5s##0EE*6+)$V45S z{2CfKRSjoBo1gfu7J0OasU;j1Q`{IWdlkTN|iq*O{0fgdtzCyGvX*>IfG+^4|PH;#Yv}_)7QT zAb3HSM*29>p^_vvz#3TkI}J*`(_+*aPyNljPL!RU46Hpjz_JDD%ZfYe^SmM2w%qQ6 z|5J}hj6vmf&OP^mABr?JTYl<Mobzz@@B zD_vfBP&}_$a905MBC_hFN*EjkZE)%5Lx#wqd5mnXp})dcIKz|fp=2;W zdLMk43}V!IeoCYu!ec^|$Aagj0kkohQH*YZa;6TVHYbU>47IE&ATFGIvCclS7*+X0 zqHbJLdDo741tIPSI4h@IQ8DVE5I5<{eIoeT3Oip(=C5Lu!hAEfNpUNMq2W^00T%%D zclHd2lq;tt#}zaqs*07re$gGlvW!p?Tr(x2hdc~t)Rr|mpu{mK?W#DBKVF-#H9&i| zc2sUa2`(yPpNb?^mgIJtiKE`X2&JJ25&9dn0b(m~*?p~^OtB?z!AX&0C=HMFt&V0SdEDklg4pY{iX?qH_A+qe9;aLWJ5J$P;$ z_P_k^>MlgQEs>|MqM`;X@V$|5pWpQ)L4SdXBUhC5mR31^pDU-G?`_ejv8q#vbhb?Vf{lP>aNoR?Nl?3f_PQU#qjZIPyG^|Fri z%C@TD!vmh_+koYzI8MFQsIe9B=*TG#zDm?2)WEQz+Z5ZpgiW5DW=aISS)!c&im=_P zB1OO`Mm?(f1Te5_b%@vY>6@(`IS3)NLr+VKG2WVn4$b)g!2T~&ZQ{}!PnesB&W4Q_)AQqlo};?Yvm6MjKW zr~k4+Kr=$=RE-?9@aewtvH26bBU-cPj!HC1eKser+Ofp$^PX=_wsyIw}fJ{K-CZ7Pt80uJv)?*?v4 z5*(ps+=7L?F9vxa59*W4t`zo57UsuDj!8DglOo?QK>%N%G(Vv-3`ZizxM2N?A}am4 zgS60q8pBbk^mrJV{FSCf3lXKx7;8O*%xr~7M!AaGZ^cC7jH%pSNo=cQ9jM%j68`yf z?y(t$U4C+AGGMBSRcLqlxy1IujMOJ%m$Y1^bZ74C%ek-*S%X;hBIQ4QX|+<#19YbN zKt7nQ#{ut+e1r~)@jASF!M-b8n%5habe+7CgNDyV7r?3Kn3j7c{p9)Q>%N$yjZ+;#JTeGdd`GjmF85)I z2>pRjpdom#Gsr`S-D(q+9NJhp=b#Sr&=CwObbl$}%t_yn_NLSf*82PODB0&f;@n$6 zs1KIzl#1Z&P?%v;_~q4l6h@D^Tkax-%joZgB-M%{26z_+ns-Xyj8Ydfc_$yb<+?*y zrVe-=G>JF-BsKB>zaxMP*<>)UU;5b0bI7DtQ^S}SKE@Ehsh^ZHXYhMP72&jBn*k15 z8H!QsW^U<)B)^z=bjywAEI+@~mM4LJg;BYZGK9<5y$u^Z$Qrq{@Pirw502W0X()68 z$P_qbGx;W+8%hr9h!vEO&+26nqQ-?czFr*ANfym>t+A`38NTKPU|Dc~_U}J{wXaV^ zWc7FTPC{jIp3w;q!on-R8-oyhCe+r+Y(?obr1?FZKN>dtEo#CZ z7-Sci3TSl{%#G|;$=ov27)(lG6l@pEN_A5Jn?|4Mn>ds9bI?#($fPR{)lI( zjD+$4yMY{sUM!BX;QnrlSuNLM9_vrV_f|Sz7*Gg96~iyi10m$t{trwCW1}m!qb>;B zVP6N?N&^2Kep8nJT+oroh$@QyzX#K|PM@R;0KSzWRqqJ?oUz(37$%!iy*IFdChy_V zQ$EGO19DENOVc3U&o#MNe_FeX#H)zhXxkYOx%Hpipk8FqwU9#=ad~g}ZRSV6?NTvH zudrRgqnzexo#o%bD*WW|nU~!v+z1SKwgx=a2PXfeX}Ml-g)T~tX8VQtSiHmvj8GjA z{XVg3>8d-&Z|p8MDU3k)9N};dt4lwd3|<~3wYuFyu}j|a#7yuGj~+#>;^PyygPTlu zht|w=c|OwLMFpm>y_48Zq)@ErF?XaALM$FFWgb9Tv`i;PT|EjhEw<&D?#Y<+Y5`SR zcGRD?2HSUzaGfv;QN#WTL)j2UMau;K4kj-qX9|T*!or}1kIe%m#gVDd9m2MtJyF%n z@E*BBzo=K!7ej$%B0$We>u*~*NFGLh=~@~_zO)Oho%_Qe90<4@8*P9UeO>%;ZDOCJ zEcs~ord=8xZU=r`{;eb%h8b2=ovnCT4G>g59GMp3$Az{WuS`xb2_8s}K+1v(8;PSS za;NS0Lt%QfP#En&k=vH0Y0jylhw`>)kKkV(TaqFaFw$~&<_4h@G_J+_1Q*!C8~kPt z|BJ+$rOG3WOHGk*5f@LHFmC&;H$pLui_u$Hd{x5QrJts+ zWDuKoVM2Crm6!=k-w`uKBaaNU0xJR{wc`F~o*zPzh(}2C&m17Yr6`-%Zc*obW6c zS&YL;BNZ#@Eo^P5Mkw?rPTR(o^l3x}8A$auMUEV(r(DBZ9;B|bA!vVZ6t2C8Jfk$1 zj{NU#cLlwf?F&yt{!yz98<1r{0m67yv%A_=0L%bUo+FT5>zj5h&bTtTo^%aJvdMMh zVTyeS#R?};ZRNDG6hloP*_aRp*k8Qotn&T&(Mc1=DU{E!zWtL*wr7w4hwH;kboa;% zSv{H|I(lgKr`BmLf66NN{`i)MK_KNl-(~~^sIc;7%e!c(L0sk_>9 zKBv5NCs=O~bDi$CY_QtRD;J{zJ(J3=+-Rn`&iao2LK>Kwmf~Dc=)qFeUQ8FV2QCZq z$McK^VeGG&2p$9bq2ocs@S9Lovy8}6Zvzp zZuH|yzwL$0|5JO#iU#P%-%Ufx(jz! zc1aceN(Grd4!3*HUvT}X^8(qS-ENu|a61Vi&f2-r_A_Z1~rDxrqI}=%FP-OLS z1*)GloVTuG>am8CB&~QBXdppo0)2s3Oc>u2!?u6TZ+L5 zR^~!Fm5tf*vj#heAl)dcS2KE0NxVZZ9okHq0HFBOpM=*PK4Y-RfCmY}s>K4xlU-R? zSKUQGIUzOh!URrZ+S9q^SAN@Cr^{17`&stmIP4uCrP@Z%R~TQV+Vieh&*RE64c6OB&8@ANUnoho|s+_5)P zZFH))aQ>lz1A-T;5mQ?-%@W5S(Ryjevl!A#>L@zh48}Ce@ti_X z@)AfG#zO`*~#>K6!9H+!^jXQEjGRb3z}JmuGMwpq(LWsXsCZ>U<}`jZ47&>ny~U9>}{C6%={g!sP{lJ zm7@c9OP|zrw)*L=)@~)ek({2-o;z?PIdvkRHhD%T!#lmEG0!B%p5puDln}DG}xE=KtoYJ)!k3vsNL?(;DJ8gb!%`teTd#m*2mLHp02qlfP#K)^F?0| zcabF~v(K-3{~4K$+}m%8!fwF{&YhPF+y*YQeO<%SG{s7`DAHw&|IUZ53R!GLk$dG= zu}-Zy$%1!(-9LX|vQu3HoWcZN1H;-&a8I2lt;}Lh3%ENhc0xx`0GjZ24n41D{ z6ig6GNB;vp5|L5aGk}H=Pvu>y)tmp3WimR#=HBP`! zI-~~_{!C(uf)6+n6;lcmb8d_4+sA^U9L6uTf=iS=>j1cim4>MDZq6VEA{kce!+W`p z6T>fqluFj@mxxL2hxaEWYdX`ly%pJt;Tcwra`T68%CzMOKFtVj_UVIG25hhD&HlE9 zx`(?G+t$`6{;#xi0f;aC3Q{o6#jeE9MlR&SlwF@%4eEa*p_gj=D+L|1A5`v{rfYn+ zUZjOgSt&}qBu4G+G;{u%x*z!|0mHKI1f<4FPM|=Vt;;^7iEE<~6s4uM_3<-zoAmAH42<|Uk z+=s{T@9=KAN};zWoB`uS^{thQJcXte?Y1h0#13gL8IVG0yQGfjW9=lHTSueQJ>IZA zD@5I?>bVz^i{Aj@!olcR{89NqMRXtAGjqH^2q1ieAqtCX1Su$o{&0&?*Fc^vc0E`2 zONKn1hiHy|J&T28O)L7kh%o8l-uh+kpSv*{bS~D(X~(~(cdv>*EkJz>8op-lq0G70 zDnvca>htZ`A^9fWALkBF((O>DRtivLRqA?*f~+>6Z*R6aFNV&!`V+O_e4xF}#^!<$ zg@T-az>N#>0J1PNRtCXm$?6Sc)|nrrAdC-R3w2~B$ca%;e^1ax09^|Dm~O4{Vv7F4 zQg(r5yDEHvtuX-sV*LG6tlOFpc~CAH1am256MX>0_^1o%nh7sn&*tK3iUG*}lH?_; zd-zv;H-H*ZnYP~%SDKs`SnC;m#*e)=ci!EIWB<~ zhb1HH z#sXFIk%b3Q-|rKStuTt;x4 zq`#Nl?UweYZuPgscG$hL+EZnZqB??+uA;$DeS_tfW31j={mRl0BlRw-vL z;4-#;Yz&HEY2Z0`iE(t@gIIY7xkIZ7+PTiG9GSAt`dD@UfT!Z%qt zdUW2w1+zZ2C?6PrG<1hoQw4iu*GRQU%T@}yKd(Qs;Q6;3GmKoGr8Ku8JHlBjK{ian zq{=^Ix9dLLRiJwd`=PCiPKxR84pwA7A`{LHU*j}GPoOGS8u(rUQfyrBKZ+Z$nZS*C zQGg419BVYE;bd?&<^C%{TDxT7(PuM7@749anMF{z^YSslG1=+_quw z5p3$lS>kA5TMe8t)veVD%EM=9jndl>H6}0UzoWUnwjf?jaHS_8(ygNj4jZ#m~>Q#FWpApw8)ZeWSG;yw@UVcM1ynGy33RmtWd&~sm7AOQCsrydc5sEnjx*^iH;lsiOUCKHVk9Cg zc?r#+s(cQqHSY8DCo}eJ`fQ^`L8`HY2;&_8?g|KK@*`4Y{A+#RC+8ec#zE|}C>JnD z-g|_Qo?BP?GFrDg#-;}!ezX>SE4ZaQF*P#fcyn1-MMou1$%%*W=U6QtqKA*ABO6$K zP-W|khqU583s)PAU9>)4BU*}4o9fPwY7Lu*0#m<)cZQf4)j@1l;39{^$8Wyj3{=^w%pa@(+A#sj_MWIpZII+SxJp` z8Jtb}q!3BLBOiLfWFD*`t6r9>i zMD~Ka{C`wZ3r0OetF`LKzUV7d;@pYiV1`t<>GPE4;Jt`x(uKcbrPZy3l$i-h+?3H=@2+D$G9mN?8HpsJi2;3!ve_2b3=A3h%viG&ixz4%w zqL232#Ybz;JY|m@K2ln7nY@=zdZIyn3U>{+nh=EzqRaaszQofX;tSDz>7eyeI&0qMP@O|5V_Y}0#r zJ$2R@M+?1pnUkQ5bs+1Tea$6G9G&HDH`3o}F3z6l)wHsnC$oYpJ~q!FoVTp`4IH}c z!NmcoM9@W#9U_|}U?{E&8>r#P?4l}ePPysjYfV0}Qp-5tJgi>m>4+EYad3q4*I5&cd!_h30eq3ono31mAP3dfmSn0XG7+yQ;t4 zWc-mfWhdAI_VNoZg!;C3|NdL6_Xn(l%EMH`{`!n1!wYiW&xba2UiJJPrxvYP3+YA? zy4=W@iwp?vj=+Yqh|p4Qz%}|?KRE~4CLyX=qwmwS;k2koAefxH@G+(DF=hV;@q`E8 zX1^Gd0!hy27#kAn^{!F+GqK#c!$)MA7GbCS0lJ~E#WUZl6V-t!!hKHi_13v_g!udX zcB0C~d$m#wX(DqaOru=NB8AH>5h#ar9l1~pu|ET&Hq*X*r2ljx`y#XDr-VUS{%P%P zEItEd*~q@{HvqwrG05r$@Gk7Oq<-iYmfBS(fg1^6RT)tSP zSmm|{391QwNX2`9e)*5np_j^^2WG8IoBa5`VMv*w0c4Wy`koxG(3u5nH1?2mKJDFO zqNukzUOxyJX>lIfPS(>?OMDxW5x8JEkrwcGFE|Tl{P|^?l)}>Az?P=7>O;WMOqw{? z{zQ1KskbFhAIzQ@ippgqsHN`0k-w6R0mkPv>$hEg-`PYG1aq;5!>eu;1P&JRpBox; z^L}H&cnH7`q8RZs@0)ke6MEVp2&FWGuoA?MTT(D{MVfeuC*+R9jOXIOVG-3)Tsl=Z z`)NxTcxo)uIrPs~h;NJ%j7mdNKfNXuCD4%Z;QW?Z zUJboo2<)Oha@uctTU9sI7p~#YHfb*U@Fm$jY2b7DL$(Qh`r+=$J7}O?;=D;*!CLxo zM;rIRKM}4V2`g_a3g3m1Y|*oM*)Y=Zhr7$7+GP&3DPvpsXuqd$@i#+(%obOpl=11V ztU=~!NF%=&c~_Vqbz_}Ow{*ZpyQz#~6h}v!wwAXIB>_Y=cN1*JIzd(yPzT4;Lzie5 zOopZ;>YWjl%5!oM^=Y_(Qz;s*4mpgh<|7O20QD_>rft#tGw>@h>qaAAYPFw3q9@m7 z$A+A)Sm*HEPw;Khf*Y7)TMY}w*Bwz?oq%d7+hw@galcnjjq;*z$(P285kk!~Ji)1K zT%_?!BExIEp2K8a#@g})k)0n5FV0>m8V;5fRmtBjmm1Cemgh^X`i%<6E=$iQ)%mh% zdZh@=V#Jd#uZUJ;(JqJ4tuwX;%Y2fhBuD9p-F(jAf_?6kFMj1*c6 zZnGdamD6rTXC1{aGGIF#uB9VW7&_6Jk08k*0}L~=^Qjg3Dp+a=zM0o12f_VUd^sHW z)i^QFXt3Vq9Hl%f#e{=u3UT0(i`zv^h_W8dAj zY@%SB>thREo)GHadqhEMY;c}f^R(c&JBj^z4?k=d3+8N<+ZMC4L6G8uXn~EnB#pj{ zh1(0~9foLk7=MwXaTTw4&@Y!XtZJZWH}dcn(3E^+%0=2vlcIxDY`@#lE_=i$cwu3; z5{%lu^|;C7g0;G9er}K-Xlch>t=nz4T}Ar+k}ap{_@10}<swF?>EInc7Q|KdG=bY9j~r|iK4#o2AWgCt)Pupp8(2N>u(8vgdezW0xilF$YkeGpg{ zk?Q*IfU}6Yr`#X0XJ+53epcksye}K+F0}VOBA^;bv6qf_+#V#1;wuJ87!tc7NM z0`+y3aZpYIuC1VG!rOl~l|}!t-N`b|uvs{PPhK31HzdC zkq_PzB}>!+u8*?8dCnMNU-=GiGpEyYHN^gnVT9~Ii-&F$wUN00M68`bw6sq+M(sr# z&iwq^b4ubsn<$AwtU9Fw9DxtNSx6mdyEMXD)+3sS_mwse4Y;=s$vK59PD#V9OxObtTjScfwQGqvgO%O;HoQ8@Lsutcz9a$ zaa55JX$^wFRM|afX%t_G80!7M@0k7{Z-gh?82A)@3FBCFs51NB_uPz=C`ZSMzkQ}> zLq$>@k`ScqC4Zx2?DBvPoo84LbOmRAk2%AGD%*9JA+Vn+@Z9Bg*gp}g{C zQ@^i6GNqm9e}fACLT4ww|>Z!TMaVchOQr$y&4KuGixZGR=~;XG(%`y~i7nuJ3z%{`nFgVwl`e zqv!=!zubki^DMLgG~8W-{7Ww11xFaQ5Y4O^p|_&Rzn!Fk9wQ^PQ3p9G!Q#WUFXct> zdHgNl*?biRu7;DrhZbI zhl4CNA%wFht`WtdX~ZQJRncDh#C47Jh3WKu-1`76sLO(zN0UGM87{KW)KATiQ(4{h zduC>@pA`wFCLbWG0W)Zc>s9FF{j9GV6D0+=DsQRcU4m-8s#b1fZL1jJYSE-){7EIP zctznBB|#}c3&8(PH$ksIflf=&&f}kb|Ml~`mgKj;=lUoCnrF_8iI?3tIEMrxi$EOk zqMTT#y1-0mp%JL;@k_thIsm)E~oW@uZb6Zgfzi zT7npC^IjSWm@x}jr}>$8xs zj$KVHOx7ICMmOB{V)u7ot}GueHzQS`sSFWp3c74Sy?kT!9h2HC7$+dd_nw$lALz2? z>V1u_$zp{&Dp=5aDF^xPM2ft$T*a?et_f- zJ{IA8&`8Q~>a`?MtPV9aAoH$1vNrQn)Wwt?`z_eB#G@Q8#ajAp6}ODKpkIFhl0H#?=b#G_B&88 z3QOYIe`yHCR_BhF2Vfgxo1EYixHy)lsg44TiaNWTJYUrC_i8c)<~-kiQ|jRW4Pdrb ztZG{=9}NtCQzoDIKcVa;e#gyT<_IeaR0Wzd+c!uB3E(tYjY#EOxP7vw6R{?hHp(;tW0VR? zP6dLafm;wu1$omi*GC6#IvoGyEPh6ZD6Iwv&77I+vRSSJp=p$>%?VK|cODBE88Jkw zYEnC54UGtr+Cqvz<0 z!A1f^lq}tvP65^T)f++IrKF^HPMhqIZaVR;eeH)qLRaaTOW4W&OQ))3zifjjV*jU$ z*)Ld?op!OvWzlD&lKV4YXa6gywlw5?k)a3?_-SQ+h8^C;-z*-(6O151^+rs?0e%UI z@xu)`XZ5Fic#iP5+puN7b$MsGS@HSLPRWiPJ9(3E1A=nIoG(ibi8jggfyC7%QVd)~ zh%UzgJK5$ptxmgYZIq%t5{Uegvd2ZZ>1T9N4RLr=^u=tIX| zX>4IaWdFW)oS)_Tai=c7%+qy3%hxY=j49|od+m{O>Af7CuDMtpw;v1JAni;8qWq6Q zjySx^Y2T!p`_F)Apbu3oZ)5WRrg6}EemW^Zwv5nuQT6vb?FT{8g(C#v#6wEx-;1OI z04Q%#$LOxgKzNq?fc$bp@b1V`F9UJ^ zJZUwHZ|9s6ayx$u-1Y=CI1y<$DJ&eJ0>cv>Xz?qed7C162Y$?Tg{eZZbVwv^iLj9G z*qi&z3|@hlbl;md)lya|j6-lH;%UmqHAy~TZVN26UIYSM=_G$Vq!d4$<0V2HWmPqG zdNLArT}e_oL1D1r20UMePoQtP4+3o6a_U`$!x!)QAfqh||Li=a%6~GieFLr*J$RIt z;&H#Bl6tATjKl|PFZUy%@MX?DStOzNS%#{{=~~3>MUVJ&*zATEQYWX5dc6(Vn3g7C zU>%P)-x>ai>TJ6|-y9EJ z;Ue>%LU1*X;}pc?Pd9j*^zxm2y~urYiG!VnEIv=v8GN?Dbn?Z+=?tNFR#3RPihkO2`u|bADmqw$~esF!z=lRNF4%^U9RJ1bM<5Hq%?$4Idz4?9}DOuHe8C^+3na*YOq<3Z2PfVg+)vJB){7||Xxk2;cGZ~y=Ow#> zm%8>V0|Pa4-heNnQ~&*8IA{V!t_Nb*-|0;^!qbwIQ!RnZk}&JY*x}m%dM|L@NrJS0 zLN^vITnR3gj0Z0>t*W-bmZBei=3iFk6>$z5loh%77wk!-Ga$+?6^YqnWc+9{N4!xl zZ9N58>#Aw%k)#b`fB(^k4FGO zBwI*n5@-g*$BhKdf)Y=PYTCQr$ zI4Eh@m|@lVlFa9H%@SN+EP4B;a{{!6}ET|Fj=sd)HkRYS{|dI`=|xT(V(Pr><& zozi#W`QgxsYsJ~f-+3=&%Gu33^=VBM1Wd6mp45$(w!4vk*2HA!mBU-Z-IzZmax48h z7Id)r3GehRgxB{*xPxhgE__s8U}tLdolJH()it2fTD@jm3eNH_J)m%kzpCQ8l7!*R zfrL4*n)wTWRMh}UHkg=bNMYDMlOK39vJ+lgtk-g+;y^+lFKK^l30%X`&5|Pc{FxnG6?sDnSB zA`QzsZ>+1MmV(ux+ino0A$*X-_KeJPy5a*Z%$>(Iec1&-FhP-ogQZFIQ!p>yI?4e+GmI zNEM5B1{Y{)*Ixd|fyhPp;Nn3<8hS=Qm{7n_eaFb67KM?B@ZU!5=o5SGtg| z5W%V=)Df@kJu}CMf)Q|tQ>OK>#|sJ2eR%oJ+>uS%BY?o@cDaPfiF?~G<@%%~RKQi9 z3r?TYLDsgSmRdqPOoK%l>&H3^jRYFEE)PAENjuw0?2mgSa9 zyz^d6*J(5BcjLe?P3hQ&J=49jnI2m!`1Kxp_7n+xq@6-DBb^C zg2S~QUdga z^#H1aQ&CFjypl$5@0)gR5|RPsgoGJ)i_YUO0#12hVA|v&&dRKwrKFwryaaZ0|9)lt zom89ikG+n}NmyB`>=%XonKLA1>@e79j}g%rxTqo36=)1yh6YF}6AX6f)E2570$Paud4OXDdi90Hp2%hagjHF0<;&&rc60pKJ*oiY1kUoO#Q? zECEL1ZPv=X2fP?WlS`^T#Vx|z?|=g;)1;&X`48rS(y7}A0BKldx6eldo|>3!@OG+5 ztdIQW4^$9hq#o*C3ExtUzP)sXsDJvSY}*6GW@K&xTP>Fe|Ct@R7)j41mR}Z^Hubxg zmv9>kV%d@%`I`T3I({RqPtXPF6ewpJpdy&gANE#l8Nl7eN#t8B*32?9>r(emk{P56 z;X>8Vuc}(4s8Q?3+@1%^l~7Aa=DzGcxH#{qbyAKa`i^@LzuNE4HeT#Wq$}TI*%-s5 z9T?5~KWRHy725-V(8Kar$cIe_NOws~aH&yp>bYDWA3jABC9}tFd~;7V`g-BrG`C@@ zFd!B4`aw1>bSv+*nb#0p7T+d8wUfH+1`9|xbqL*gb#T)W3W#L{OF@5Vh^L}4dvEmIdX!Tyk{mo5;2EPaqWi`ez&632KSnOX zQD(I)Ry(&njz1tp`OlVK-E__2uf*sfMH$9@v0OiSkcG!ZyrWRz05iL(=9dLM$kkH1 z$Ym=|(7yejWWbO?=I{Z@o7kUpEmeurv!7lGa|!Vq2Y*kX0$C3DX-5wvC1H#BScnJP zCqzHRj3na(mK}0^9IRvu%=bRZiqw`|2JWvUUE%Rc&E1zmOMIrt4xrdBtDOONTPQ~R z;=Nt41D%bO9eDkxkVC4h$4>wDh4*mai{A-s^B9o@x+7gv;>kZlsy1%<09$2{8&sz^ zz#g8!vieBV%HD4wZ*&*1yO-VI7!nXFYj2!}vpP0k&4}_|4u2?=?@FlEe)Z}V_zc!< zW~<1S%HB^Wy2AbjVt(>=P(+cx4Ob;9Wh+I>MLCqW(I1!Gooq9k5+p(J?Nv7{I+b9D z-fDUq4Y|Bm=IrMKK1g-d1$I}U-I}Wk)F>Wx%wWhBh3!y5iHMQx+Q@~V?SjQG-e zf0BR9un~53NgufFb#OU2?-V+z1c=3AjeBf$6`z&wiT!>Iy%!Dk{S`)PN-cKFPKXw9 zVZjP~F^HurHq7IYIdEe^_WKageCi07 z?Q()nW+&>AsdR6bxNX@%huk3OYBqQeTeG=m46`4Zha>D>cN1O#^EZ{17_8Y7k>52S zcRRYmkMo6F2>E&BoH_jt>>3T$-1Y2Kc!&8TqHHghl?`zLiIuRv5g#3{5a{plA$-G8 zX~8h??D_jhqLkG)Q7-|3R=$D5e&scC*YlF^%75Z(c%T^?@cXH=qM~W`@3+(lylfI$ zF%cR(ybmiSn2^RVXh%Bjd3eBj_cd$FkkQZajjQEHyWSL!k1RYT^f3ti4Kr7)m)4kL z;k59GxV{C=wJ}0`Y<*M=ryHZV)>2Qohp4zQaB%WDh1Gufy@Fmt)OC)r^cutDgorS< z!oM!Z^<-|Z%g4&MbLv{%avn=DxE0r|l%KL4V*HiEHiXQAg)B5JIve%Q)~>SPwSzZxuVV<>iBo&WlDvL zMV340m?tZ#T`Dw} zz@%vg90`@$7BAd(M-=Y{?2M3!TUF##FY72>!pgXkX>Ci{N=f2XQtXL@@cfvXD0|MW zvYs@vb}{ley?rN^NkWZd3Y}~I>e4;QJ#GtKJwl8;4zUE%__7^Qvl%LR@#M5sHn7{`Y~0@PImWy9!hj(tB1GzQn!K_jRk9 zKOIwAS;Y&>tZ`SM7h}#wuidNf#g81rkNj=C+Lw*vUNNePdfCdo?GAl-2di0R`WG}jlmu>ixZCtX`Wl|@40}p4Ne6!+mo68oq zK_KV{L8%nWOEavXe#l>v{=xAPVhj{Sfm$iR=(DChwBJts z@hDN!z`}J?S%vz0JoOFAqSglV7D-jiT^>mTK{k%TP4!V6zdVAEEzNTD_yg}S@+-<9 z#fI}cwMrIMt+Qxq+tCG*)f_@j{aR4mTvbm_o);r@$@WfDt<(pGMs$PzH5@q)U=wd? zwAA@=TGF-;r!9NZvHdctQCW7|o)%{#7~X`x62o2@Kdo}|t-ebX2%?Vm?lx{5W{DXV z`Fcz_+qxhyM{4OyS&yh=A}K!){v>N^*21X3DP zy+Rc|PJMB0_P*WW;_qYPSygnJV|`Sr(nNs#d%#S6|&#?>bebn z^$9FELu$>(_>(8njSAyYw^7f#7UOM%BHA(whr@j%UdLU<&=P%Ej_KKRq}A)3s>DyDUA5Xe&BtykEZ2*X z&!{1y1L|@LT#ceN^4I;&tp1?c(DeO^o8})esW@Ak0w=Y}?2ISEbP~^STzXCLvFfXM zYG+itk{En#`tAbGwRFRbQwPBKwKI}l8F4A8@Wzk2Dx{ny{^n3Lz~~Eiz0n4p#`D}H zQT0#aXEII6W zczJWf%6uXv-CS0EG$FV&DxC8v@y`t&e0>R4YUMB{#j(4*VdS<=VH){8vM7y$5o>~v zx%7!)wL#yUlDgtaO26M80R-w646f9Du_p*dZ>!zyy;_y{>OU>M-2n~kYm{glt<0st zsasuMPh9ROz^aYt*+Md%;32GAY;zV{QJOAp@tPoMwG<>}wceYkK{|(7`1t!wnzD>{ zWL#rZJg1+T-_R4YL3$t+4--Qcy+v2g8ke{mueKOCkmh5`R@Rx}IO9?^oSLI(R%>;A zdnq$dXT)?Z!?{|&yZ+}@%v<+YT?CvNfIuTxpKjxr+xR?+3<^=CwSA4&?Cw>n=o{hM zFw@pPp%z4>>J803iE}4M&Nz?~iV&48O=ZvBo6N_KhatooGpza)4Bo3n_YLqZ{_TgI zc$e5BG6rtuO#ddG+yX{bu2jB%HYBTI9MfX3Ef({H zQv7;&ZCredQy%wZ7&bG1bbL9)r6Fs@kM#8xxQ}@U!P$`YCgfWh5yxe2uFmgt!RIHQ zu00{^ZPr{AMcsmL3#i>-tS7aLky-(SW~|l;RUz!>(^bgQLQ3`23rg@?ef`{CbAP*| zD~`BTEw*fI1#?!j^g4m&QtUc*48QQ1;%Z$GFfg%L$}IhQ9aS={^~T}F>ayPIB(sMH zC|09o<4>A`$Umbiz~7{m%>2`;;;gVlNsOMDE`L1ubDUWUCIGJ<*?j?*v+J>6>F=-Pf1NQPAGFe&;FWn1TjEl#>*-`Zus^oe25AaFa zPG_EenEUg~LrU+h4Hp++70XnIuxKGlm+5t21oZ^8u z)rmp4s)iI)l!#M_d*1M)C|4_%6_zIr9CnGdbsoYGD=h@JKQg4I+B&>r5!Xzi$Uw3 zd=`I!%tSJD*h$N6Oc7DSYM*l~_lciDz)^_MfwAQY~g z+v~if^{+pE0xzn*vzIkgv9F+_*STlQ9TqG_egFbB3y|ojRl2r-ts<~9m2n0G_*m}a zOFlaOQdgP+ZHbX`j8TX$qv(yysc^q0Mpvo3 zOn10CtdB^7o~sQ~xb_2Q@wt?6XZdj7<;D?T&V)fl+|1*G{0ZvqmT4LE1u|puOJd*O zKSldgI*cV5p%kCV<%~Z2KyiMZK>&x^sfvQWa69?%DIDvaRv*hz`w3NNcBqTLW7fYs z&LU*3X~uSiH5=9vQ>_?ZHSRF?Xq0Pw=k{4X1pJ%>#WWAJ!+d*1VX@0%ua|kd8Mj1D z4%jb#P*j&(Fin@|Mv(8f8*FJ{M_P3ppoKh+2A=+pO5%%^rm8dltAYR+AOoBdb$P16 zrp3C+i_D8v{GJWMD#2lMcS1?t2@gfPz>;{c8`RJ z<4;|hD*e?ROB=#}#ecsZ=j+oU026>1P=+49WQOAv>l3(B9XPIC6WHK*6!mslE(D}e zoD&pv>slGTUORo*Z7 z4!eqw`ppBJ%s7uEDD4(BxLIql(@&ZkAGs?&cNn72le)RRPmN(VQBiL=JQ%lcs$Z#t zn(PA}!n|6u_M6MO*a=3;jWff{YFO@?v8pJ3>YCpKj~i=qT_xpQ@&T`|qy`tAD(4g6 zTK2lDEhd`%8?TG1%J4UWqyR+@*|rSLh;7*BTdfx|*C~oT-wFOSu)k9Ws4&YqHtJ<# zk6XF844VR30|BTO-3QSgtiCXOy9-YnE>sUc%^Ai|cu*o?SOW^N(?*1&`iA9Er!lpe z6YN9W)tkrTTL<<*oq_1hs_0vQeb;bQTY}NXr)(=9odAQmznOth`<_v6B@5aO#1(0k z#-M45);pw}u8fAjjWVzuYvYp<^Zn=w;rSC>srgMn46ek%KQWT#0wA% z?=$w}WQwaz0q&$@Y$SMXbJ9FnU!m30`O-$P;B*P2kG%K${D<=6>ap`a{Nuqr?iaNVk5u0 z9PY=>sg=sul%prV!Sf_2j`+_Vy*K%tTw<&BTimC9rr=WWT{1ON#QM)T$I^61TL2K7 zgCj=qkQGtm!dwRRHSVJ!+gGB7?eTSU87wa z^=I#p+Xg8GUwAO~jQQrgh7CfDSQq6$R*BTjR4dt!Nvbquf#W(e8Abq3f2p1avk#Zera6BgRro$ z_Fi6Xe|Nxoho)CiKRPY#;%AGSgCGy5y}4wI;=d+&Ci1EfcTko)L^p;C)R(+!hz2)} z{L%UqT6=HnP{WI;Nsv{>z-jnmApRG+g&Pv11_t)oMbF|k$iJkxz zzJd2(j18v~{Qt3EJ?92&&b7{1hWA{-F2*{gaQg;y79D$p*ET6_>7OcOWsMsC=^IGM z$Q$s$OE_s$d`7lFt6M4Lj^0*>6%$N5#EqSsZR* zG&*u~%5=KDG3_wr%Ci;C9h-}#^XONz$7ajMT;yd9wg`_^`MDTH)#U_b$O}R1w||Kj z3JbGf!+FUx#fO|rC$}!XV0L7u{QSAuIX9yxZwZ7GVNf2Sdmk{O3CFN9wi-qKt1Bnx zTK=@!sr$bY)1R^j${^_H05}Rt<8V=)n90syU8!E2g57%i=7iW8LrMi6>9PoDt?;r4ILaA~6cW^7!>%tp)u8 zMt*?aXlsj-4F+=t3dz~pR20Yg0{UJ57j6VX$npQT7~rRYRUh0oT))s6JRsWv!L@~> z+GLQ7!FDK?^lLHM34evwSb~RJf%^-3AFSp-urdA>tbksa6qFK^{H0fCU^QzfpYexm zmrBfKbtD>q|Ex+ehOCdzuel{(*c7M50nqIdxYDSSIY^;FL7k6zcpvNdDqdLm>$%yR ztCSi59xyKlHcl}zO(%0gEIAz%Gu+Rc$BngbD!`Mkz#jy59W*cBX|x>j>W$2?iGyGC z8=IoeagLwZfX5A3{L;RHT(Dx+8KrTRQ2`h(^Iyv|^SOR5O@MnXA?#z&3_9??1tB#e zULN;6%IO{=+P6r*Hp-my9faX$XC#!O>;DpcK3FYtTyx1vFVm8;WJ@#jE9Sht7W-zU ziMfOiSCd>2X;0(XIO;DnmAe9SlL||_WK&y)vd`D_E51GTow>$DQc`d_u*Ay0it9Yt z9Jm}BiibhiFKkV_X7u`TstnU@*@TnGETbgh`k-~?j?LC}o^BQ|<@pkRT4iz1qCz>M zlzhBnc!cd1$h7><`I*SarCKRMuE`}8x>KqBYmjMWe$|)$ znx`-WDUP@$n=a-EjCioPgg0UVOZXdr`9^ghsn%M&q`A7@6hlpX#6M#-8qgT3)9EF8 z0^Do)Vah6Q3Hm0UCe4$b#mAd{`v7a*R3AwuaaD2AI=hk0)lsLwhAkEf%0Xajhw|0GUSESRHh-{M=$-@1|ML&z`As?H{j(ptISSs#QohYD@jluiH`Rytu~KNWUEW7G z(M>$&eI&_jiYD(PR_ht>*XED^ssC&E|E7XB1OJ~=!8J}7@HcSMU-#lwzHrvur2Kcc GTmKK3z98}d literal 0 HcmV?d00001 diff --git a/frontend/public/android-chrome-192x192.png b/frontend/public/android-chrome-192x192.png index f2388ad94457a6f266c4ac3727915ecb9111550d..390cefb149f1b147171316c961d061446be3e036 100644 GIT binary patch literal 15928 zcmc(`Wmp~0vo4AT2<`-TcW1!@f)iK}T!I9L;O_1aAV_d`*Wm7MA-F?uhv0T5zyCg4 z&fe$VPxra&VF5GMUER}FU0qdgP54IzY1FrbZ=s-|P-SH#l!3opf4_)tfZxh1RtQi~ zaE%tKnogP!d61E?&M?#VqG;e;MN6$^We*uzde>7dHdD|EVzq^8ei2+WNmdhNF|D3$PIXwy6JQPXBuV zM^$$_6EE4Z%)yi#0-XN`MZ?1QzY+ej zvU2__3pE=HVDSIcNAo{uU`j4_b~cXx;HULJ)BY|u=%a<3iIt{=g|&%|Bf$4RX7V3Y zt^XTU+}6t0K?P856QJ8a!~MH7K>yGnw#ER7>;E9hii>}Aur;-?0%(rP(qiPYlH$A^ z0=&E|oUH$11Bea;^tCW`moRVwT5+;-^02UTuyC-ea`1yVI6>?JEbP1>cJ_Zb|I-@S z5yl2i2LEsE|LQfl5YPhx0m)c6I@vn7|8whK%C2H!|F5fmU0PZEqvhn}|Hv9-VDxw8 z!IX9mw#LpzCdU5^4zT+d)zQ|}$<@HYanW-#S@Q&S5-M(*Sv|LQL}CpjmuHTnK) z7guu=fZhN7;n@CdYHWWu-v6GP5Ziy7z0f}m{?kqc`u*!3U;zMA!uIdB1i1KjYh+>r zm>>th);w8*FQA~HeJudF{5N?(LD9!L$4)XyDB%o>aEWtE;q>oV#8E(%9boy1)sz=BSr?S)-cuZXXlG$B3ZO(dZ-%CFQoiJ`nwpwj-oF0f$AWWGshaSqewkK;7O1H- z7{R%B3@HXlvHUkm|EHcP59Lo-!kDMrI{`g>A7VgH`TU#bMTT5hq;Fi?t3@s%^Ex#Z zQ!NbK1*{KL^}7AhZ9`U= z^qCN72^=c*nx#2D77Oj0XYqkfg)w{HW4ZWys36(NXgNYbu~Pm0Lc0}+xIjUXL&-|K zS9ME2X?OL~nRm~AUhypA`#klAzz<3m=k8a|W)}=Q5 z*;~I>w$1*y@7|E9!D_HHk!AQtvDj!_u>xkfAv_aQ?(M4fLRvOfF&Kc6Pe{4#Io8B~2|$g3IXypH5-uN?iw)A9t(JNc1N2POpSYb-P} zQQzL2@6l@`N|QefIoUZ(vme*Bqu>U#yz%SGwkQrFRQIne=xm~W7?2;S=uUv&KCF!& z1^sqEhTnUXrEZh1*cL5ld_#jIXk`BsQI3yjcPgEo=~)(t=5G%Dc{iBt_^;1wg1Y*Y zZ;@fO5A9nh2o~>$kVU_A->#Q;q4dFIA>%;TDT^?{F=Djd8$YcCbiM1dP(n|K)%H^n zg`En+KtUBJ|0zGfc3I15-pv%&-+{LP$Bf_=MzW5oiBZ(0Dj{C1_FVK{&7q1;xHGHuc^PdU7Xp3IZN~!XNR=7AUjh2H^fjk(2tlml0WKQLOrfoPcFHv;XeCaFj5I| zeDW8>jO@TL$R>>RG3E{$`2|l5lZoI${)_IrMKL499a`q(k2*PeGQtYNivQG3QR$0t z%06rZYz&oZflJ}^FuMtSmxgX0Io>nlXRe+w-2nE_MaPe+eSMfkJ%U}9U9DjYL7?x7 z!3^~umA^!PWj7V^UpU#L^13Q4bF(0$;SQ?tLUTiLd%I}^QILF}j0N*e*)bi__er-4 zA7h{*XG_OB)lVNvk;)J)rzD>g@&%aBoy}(wJ3%`p!%d>r=ig%DaLan|KA~YeP7wI_ z$q6vuwC~=EHNFzsvGn-bGCvJRg$!vd!9G#-C?G1D&YCMDiGJB^#po`nqF6~5kgq-B zCcq{)izo`_0*FD^fp=IqWIuM~4}^H)RaMtZaeG zM_KXO=!8Zmck;SYYcC!Rrw&KgB}|5Z2}qoDfAb&3n^x$&CG1i8gL5vvp<{Ux{d=~Z zx?2s~FQFwKRtNowrYBSc6~7~hT8`e7C}P}yHY0RKBLqAd3a)}H8;mq;$UVv~Lo)QY z>B$(EXwgQj=fyyGivJq)5u3vaLRF`3`r(q|+!ZmfdHYM5q=w{Q;hRc89nFLlTT{$T z6)?zh-UJv56{t1IG1=pdccsRMmVbpz@IYwRmSv0U{W}V0;0TYxoEmd!u#@gb*aV-a zcclH$wJlwPs^)@qlz>HkK-*C1O2RBbo|&kllErFR5sT2!Q9KI ztbTp^)_1s_ReKXlyTUew-| zS`s5pPKZ#}a+7FmIag7~8B!Kmp>gr9yubJvrI}8eFSl?ZEmpH|o-om^_fd=!i=6Z@ zZKTK_h8d<3dW+Rpt$kD<7l~(Hw+6q{3gAYa)HxEqaQ!McqrMZ%pwpCkdF{Hvni6c) z@?@)|jB~6e=QG>rsL&6=g|?!qqL?M{&s(XLyN@isZLf(yw78)sKwt3 zVUFBT)EStVMsf3LEva>qB$RT;^L5uN^2!jms=H`0W&bFjN}CrKUXf>dq=s~qBvQJF zCZ8^W;mx%gG7%e8-2|lE6Q_ z#6^!|20bL>3l5hY%epd`3#jIc#sgZKQk+=SORFKg&a*i_Phr=N6FXIhsmzC=6SxmRVOvT+S>1;D`J|1q6lMtlHJe7 z*;8gfoU#N0s7I4CNO2;a$1FVq_`}q!mI#1iP{c1|4Dde7Q8Kg~A*aDu4A<+!q_i<(ZrGuYROxIxyO;CO1i<;925mcNM)#-3} zDzoi5yo@e>*dKK9&|tYe;VBr>I2MViGKJ!( z4X%D;f3c({-A_F%{V2jKv8LHLs_*=Br|PX@pRAoM%r{Oq5%?#D8LvGA%wxuNH~iDM z6qynB4j)~*xp~Ru*xO>?EB6*fGAW3Thn>p2DlmH_?kuUu!D{{$diCY%8-FX#JQ^do zPe)4I8r)4D0!kPH#@>j|`*EVd(2cv0im=sS68Cck@A=H#uEb!q^P>79Z)}+%c&T>xGv** zY;&QMmS~17$)y<7SOG5>er!N}^ScHmS(binbz*Lwl(a1DrF4^(Og+8|02yvnCpH<2H0d{T`RoE6ok{J@Yl<8@K{y)@JRoa#o1|LPDzy8 z))p@ZOA0yWTfoqfPkANY+3eG*1LOE*a_k1iju<;2QA=}PMhTov~*<4n2hfpxw79(q<# zo{y-NIDFltDP+q_H_7eLQ6Ko504yFT8{}~y;2BgI{|J~4+43S1Fy8yvE<>g2G(nec2TH-$u6LMko9 z59_Vek;yu(k+Yi5Tp}VbXF9xON<@XgAgmc`&_*Rv;Z`AK(6`mJ;#Xoe4_Z!mr`tU@wtj*>7uK8#?N8)IhL>{xC%ub=cv zuktzE*6D0W9f?pr=C#ybFxJYYUmx9a|Ncv-Gn$1+T}4YNqOjD-M~U#cULT zGg><~_S0}g&dX}mj%Bj5Hj+%_g*d9>MCG2FULt=b>qc$jk5c{mwU$#?+qRGJBl6P;^sNQT4Ik zs$*o2mdWx$)hALfcR8Ntk8h=P(ycRApYAU9?sn?frh)NiuJ(33?hcED2Y?w$=v4|H zT^*q~Kg#WkpO$?gY+YNQY^@IslNhk|mFHwe^!!YBj?mXPuJmpc>0`jcbJ34A;C%Vm zv8mAJm}pqLlycWdX~4-KBqUW&NAUJ)f2MPL_(bpk^{e$>qZW(TGuN%-dIQUEj}>vB zs-qIx3~wX_m%jb*Qfi*+VZ#1G_N!;T6*Qt+W+AbY4Di#Qt=?}dBjnOT3R$cO$~=n) zRkhF&e>O^5vrM8U5~TMrD|9c7%zsL=~vW1fletE>AJ zFke*5)h)dE)BeSt+aC?Kso5F6!aWUT&}-3YMNTof%E`39o!GXW=hv*$lil#Z)wX4f z-H(vv z&L}uAAEw^>v~*we>J~7+R$`)O0?*d*VzYF5j=Ouc_}EZmWq^yz^}+n?&}1*I6-f~? zyB{f9QPr}$VII{eh3!X#`3$ngb~e$#S~M=S>;59NbMIeDD}hWi*9n7NT1iBm$5rsARo>youV~a($dW2$)~wGV;>rIxk8M_TS>R_hREj= zS;Jnh+0;ads1VT^z~n5U$JCw4=xUG0nuJfTc1EF=B^oqp)o3#dIn9r!3oQ@TsO)`Y z-rC$5?}ay5&AH5s$uTtDY&QS z8zQL^ISgk_)**8@KB8xp&vtk1Q`KM^)$v=c z#D%6W@5oxOJucfb+L9{HWKqM=R!>K_1A*!SRm6r8Cbx+2TmK}n*5JZ(iY(A z$VAvy842+q!Bm09Bdr!iUw%Wvx=PC*WUG+B6NLp+H5?!BpKc<=2#+gfE-AR$e!de# z>#dltC;*i4dfNF8Fbr2CfZ#%;E76s(IaGN#`go{is{yHI`EDq@y>di&R@jO;ZU4S( zs~NK_aQTK)wmFew%x|KF69`FIgX9=&x2ldtHt6ZQRfPFW{+LS7^Jw36zQ0r*rYr*-&2S?Ii z=5WVNCnfUS%TjRJ_jNZJj`5cR8Vj##(&V+<-S5@Lk34lKDv2l>MZFVAq%CQdiL6~; zQXB+g?!zEneLO-db4^&uy*Lwp#!58(hIyYR3I>e0Pke%R!Bv2}g0e`G*G|ISaVrRe z>iq8TTOqB5;7ZjEid(wyuUk^Yko#9M&qV#FT}e>uVA0K=?Q#3~q@(xmeu&0o2}?VE zlKvn9cWYP;5#h+1YR5UO~Tx_Nss+-hqOBI3z7NWG_!?L^IEKE$T1 zrpJVl;-Yd&0y`8D&}zJk*xISE@gxh1j@C&hJvHB5NyGm|p{sJh&-wABxjH-kOWbGr zfK*Oq!4{9Zq%82bBAfEb!Jx*s(7^)<((D)W)Pcni)0W48>|_qDkSY{8DRH>eNn=Dm zW?7xiQ^JnB@K*XiyT;xtU5|Q=E;Oz-s}hxF$zs{Va-=;3qz&lS4T|GY$(5(35rmx) z{n3WbUpJx??7okED3PJ^^!#}^RU*#qT^&E*sy|eE^9R0{7^E)Ek41xlalJ^fz2ZfIHt34RkI#TJ0}LtD^l z#S|8G9LgF$yP!n94LnzN&H^RuB+MKfpYF(uW7A4@o7QbG4fP5Y7g<CVWO zG7gt4y41W)J}IlTu&P+)=*u3Zg&Kt>Q)wDgO5CY2kxCs)sAxyks+n@R)5VJ2s20nP z%Bg;m@n%|IcTc~GCbzFc&_dF8;8CYck(iY@oASYl7rSWN8RKQ6rCtod{qu2D0EqGT z14mdVxw)^*d>`5P%hjp1OvSI2Uk*FH@j9!>y~%Xv?+3}i14L&hG=z#6k^M*^R4N>j zJ;7mUzJBKYneTa_HU0Oe1WlCUWu2U@^b>}6`#K+Je;I#`rfQWPV6EKwI{c+5|KZJ# zxL_PL%?nl5BKLJ7C(lu2bGV^pRa%tq8jQtz5SgbVbQEtikj#5HsL7pBn zQqMS2@10nN$9GW)p8~~#P}xmp$)H#;Y2KX%+B=EuYlM15&WAV98R?YcX`q={+VnSC zsi-$vD%=a1u0P3+@T~?HIZYHZyn82uHSHEaMK_5RZd&@;q}g=$_or$`t;6^{gVfu$ z4?kL+`v~B>wwk}IswWt7m@&dejaN9`!cYIOm{#bIS@!*fzHklwb{{uS8Y%qFw zx2yAz_HwVHk6R3i#rrj3N#%z*3+?iGhg0N?_;j4}Sjj!N$^2TxY`lnrqLM5SkZv+& zhFjHEUsbG%>y+SWZ8b3R2`7br6&IZ`U+s)MbzBT|gS7`8uQ;p{jy!jK4wdWmGD$UmvR%>E6B$Y<5)A8a8 z(4B*0&ykMjtt>-vVOFjg!V-_utHrUg@h4-Z*q`_+cPA={hV9KBZkJnI+Yrx+vfgU-%-nNw#ok|nqL@C2F&l}KQ1VY=6Y*kmU26-6v9*y3dbjbrS<2_- z2;bs}kR#HKaf>E$o~xZvxxO>&{hfSKKe-?esbm~(ddEAlBC;ZUDc(;*CCQ4E#MDbO zK)k-$X^PxYKs1qNJ%fZ;JiHh&|r-sAgp=N{+=0&34Hk?IQul2OQ}`1uj>00m=Kd za*Ht_pHhXTl3Bt#>(5TLYD-JLa&?|tKRtE>p}3v@N0-X^Cr}0 zCfI%g@>I}J9LBj-2h?%QMw1Mpyq^XW7&$Ox)mcY>-PRb|?|!b;M5^cgxv((QZA8bw zz?@y&6>0LZc13f_S*DcHj4<`?2HmHJOHeP*m6&HlcYseG*C@=--q#O8bw^mh{Zcs!ln{7ncO0e;VyJPetf7L0uxQg@HDuu> zk>|g0Ip!1-CCfWxN51xpxBtl$kT+ZPq0C^RrhNayIL<%ZzLptqb_{f{m2K8*Go#89 zH(d&qyAe9*bfssU57V@P;E>GCWZq_imm51;s;F#)E4lN{OFfXqm4aREhB*fZ(V2hP zgNZ`uKkVAh3I=z=#q;oZ9x);YRwAoGqNKxb8nC~V&;e#^{xgs#IB!ZX*W^wr)iQC@ zQNYonz>AsrH8+fa5N+2{kkKcJvXlJgiR0W2NUeYU_V8J)h&1`eY*X}?X7VXl=z*}~ z-53248X)1$*{6>>})Ska=;C!`J=cp!m-NCA>IW!HpK;2bE- zee*^oOhpvIh#wk_JUSvKNX_^>HYbfE6UtzNJ82m0TRw85J@^!h)Y6Vd)}&rRSb=JQ z4i(c6g{ld_RZhz)-LYdaK?cvF73z`aD(GR_v})g@D>E^{SaH-+k0_@SQ;Rcl)P#@4 zO=q+?vg+(bGu4BBl|@X)A!sDul$h1!)my{9jn>*V(qb2f6AWv@=|T$0iZsjV)e&lQ z+40^hZDYnwpBE^!C_+Vv@-I()wSunF?xQ}nD5;C$+%`g%!_Dy3u8+iR=ZjkOc?tg{#Oxr(0ug>Mbf*ymG6C zj}15KZ}H0qj>m=<(v9Qc(~6*gAJ;|V^bXF6ju#@p#3eKHS_#~1g71xfny{cvN_b6z zyOhW+?VTFT&cq3NliG=kcORU`7;nuW`>9&$Jr9ft>-0qVTw3gXhR!g<22P_@>$^mouB{Q=s=TB9 z)R4rmJQ{2bN99_c^v<(oZ$sr(PYLRkRjNsK)=EM01>(X z5)z#qH(H6z#eG&-VmCLL;zE~qj(|6%ZPRYU;@(VZEK3_JU;8?QjDx&6kvgXQr$xtykQ2b&Mr# zeuHUD&X%A?BCe$l_32oH?R*Xa0Wp+nKOZD@>`8ScoJ1qFrw?QbnW`vH9E0LP2uC?3W%1Jq(z$On3Lc!E^ybs! z{NCAOW0YxxOXqTYv;K5w)?_;TL{XZwuF=)DxZ`zV+cD@*t8LdqC@|vZa|aCGWEzB>0FO?* zl*iq_@m;*^doje9i2kd)n=G%)f~&pHoTy-i(Fo+lA07g)H<4y;e-75Cf3DFeR6`df zTXDwonY{yI$$>3AanbE=(uvMn$_%=jT(pG@7BoIqefSTh^>RO|A{)fdFwRaSY8I5~ zLJ0;FzJ_pxgqTT7tHf_P$?C>uR*c{D=RkKtFG&%mq^dyy@M$q{xJqMYIP1z+6XJvq zurs`+jSuKG-7(^sSMfZjM;*6LmVbL|+Zx*gGd-!QrnVJMtsZG2gI(+<)ID4mC1GSQ z#7dW12pn7>!@2n`yl~dgK*cq0nS@ytX3ox$pbC7gv^WDK15orxuvfDYGNfJJrA9da+O}3|V zBq##zn@$tqE6*p6);_)rXPpxB7wyG?rf(Ono^wlCuT!L2Q)5}wy_hO{bve0o zX;Tre0niUJUlP~{yV~2rLDMfkd^t|t^WI5U64DpuQjcXWAk9hKqD_M z7t8Uub?LCeF{20UKvtS8Db6jU_~QVk5|((w3i5>c%U~ph3pi~1h|bP-?hZU~v`j}I z)cyuxZJEe*UbY>l+L`Vb=*i=>f3c@~cl^TIA1+Q8zinM>_cl0`Iz4a46O!=Ez*>N7 z?Yj0Ob|m8GpRF_0pgWNmp^3`dTZ&OEeYbN~z^5W@obm59Fk4PUZM*JGZ}Nimqf1WKOD)~ULXa4>5`DH&y!ass=rc5NKLI4LRcCRO+FT60NMYw zk%C{H_slsBS6Z{=Kwi~+_~B2dGX#6F8hnzz{><5K78A{1U zJXA-H&bK!g*JoZaHwB%OdjWfdW&F|y_7BlYNacFW>mZ&kuE{N=9YhLJnIpYt!__3EIAL@9;)A+nd)^v44 z767mSO0w+`RvVRHdigifI9P8_&3w39B@>a-vZt_AXCAQP-K6TJSaGUPj+IJpQ8XLL{SU3 z!z9hz>lWV7KU3+-l3EL|p0FQRb?pzvo(ovcY;`K$9K{K$6QM;ajX*?uXFe2BmeC}L z0v5mbY<+2bMDl8A^x`vbTCtu`j7Upk2ySHQPtaLSyqUY%8O82o3Bip!wQO!)YfJ$$ zV~Uz~K(CEr8M{jwYEf?@CP%|k2wSL?mBsd;qR`;*gH)WXeQw*00?W?JmJ<_}RvhOC z49|yvu?%qF(VQxfu8dq-{&j`BYZk4ZXpB_1*teo(vQU99#+(6eZ)?5n{i>zU*7m@g zb$@3KoTTD~y{d^x$_ZzZvOGUfgDG)-@7gV+9(`01tN>DchBf)^>UeeGl4^Ae^`5>< zbIL}TTi&|n;RG^R5sM*)H53JUlUA-AMyn_LEeemZt6JW-UnmvMQhFsopQdR3mTIUe z`&-qL4|6u}TpjS&rnyz4gWu7S%0otE%OXJ${j@=&#vgq3Xj`$@Yomfd6WBJE1XZ9v zyyv7wb~`b&P|%+RtC6NzO?o^+-iTvnE;mOu*Nrl;j`gN(?_#^!^na$Mpfr`&Q!@O%+9ZvEqjbDVsHWWELAHKd|%dr{Y3 z5?=4+&lP&D$tn+UmgTpw%IuezYSgAb*OTyi4m9ORh|v&-o3=3VL|w6*^x@Oipkw*v zda><7lTfU%B4joDe%hss?Xu!EB0LA(yEnh%f&x(dyuFp0AA8cgDZ?yTF}}0v%r-fh z4C)B(YNIOgT%o+gHbACl*SiW6{f3;vVDgH?auhZfKR)-fy=P5RyG(?bVlPsFb=21N z8=)9#1^`scvl_3k5GU?K+8(;XJg}0QA2>!sg?feIj&6ADrHA=8g8Be^&PvHCl;bU~ z?^~4!06Fp<^MQ-TJqDfMe4PIL*1GX=6FXM#g_Eq*;>_y2yCkbA{(={gn{7d;+YU_` zOP^XvCCBNm$A^|?t?J5%m~`-2q_glyE5@cyb~8=?9>;a12{TkToioQSVNI01!tl3; zPE$rSMP0o|VE5NQ=ykH)HrP@=ooT-ed6m?+h_)s0!rg=@R_fl(XO(~?j3|9S#2Gs| z{c>}XdHp40h8(dfIUF&5Q0a?Ax3+?|@b+$FPoi=_W9uC5A_FwF~&>dx6kn`q$EXMSTp(#Ko49PK%R| zGi3$s@ppbg^pF|1r{*Mg+tyz8{*s| zwq#y%1f%-Y3w->~@7M*NH)=p@%f3N36E;w$IQW|m{2}{O*xkntz9ApsdzIGK9KZEC z7s=A9F`Htu7J>P|lX>!j&||U+YkMXE)TvivgXB`v zPvsi&!^uf$i%F(6UZYBLXojur!|LK2ZisZE!NC*b=}JqizR(q=8DZKqH)zIEb}{ZRxft3;pN8rRm$gvgtfV=;La>?#8ZfNMw>b6~_XM&bPxhqNh0 zvYe2iw}G@_{8yQzCkN`%Is>W^NMRhLo6nLd*|+s?%B-REKq)d$!DzzG3ZF@cVxQ1x%KUd#WowxXeS7@eS>EPq{D6V z%r8I>go;?`w+6LgdikdF!7^2qmO)E|VWFO~L9l<)!2xwmlo`_p8SQXp(&G@F`%L?Z-SPX-l)zJo}iCbE)Ju61}?^EkI3~rUkPMM z{m|OpKH*Uy8kq{gOd&j>aEM#+VB=6k4{SZ{7R)oSu;#NX9=pYWA2~_#xXq%Z@&NxV zBC~`1RJB81(gNxA<@Fg|ES4Uv^}1Gpdj;5_Q7k7oxM6=_TgOL|gzfnN?*vye7D$f| zQBfDPKMgzrLCM8=d!w>)a#qeE0E>llp#o8vq=o$e0|Ew`wA<--UFJ{hp+NLe*lub< zBk6VeVlA#$<}vJL)9ORQlF^Pcrt9x6Ds36LEY}^N*4rkRA)~yLS%+6^D5KtdVUiCM?WesHUu@>h zw2&x>()EOlAa7If8waxJ2>Dv*$H13&1~@UgxP%xqB;~)_FJ6R&ggXVojH#%D}+bw88W4oVbT%5Tl)I zw4ms0#+T(p7yPsjfY3>=*IcRz;U2*+`P_a$>*o@9zm*d1^y>cABlKb}?3rMRNJM*ptg-DrAYUWc`}izi`H4n~(G~@1HV~PP`b>Q zNFa)R{tAUKnD_99i#3q;&6wSniQGRgD*yMpQJeCfNj*= z&UIv@2FYu#h>tfT`g!<~oIq-xr^WN(?yB>df=(f0yMbsf{%l+_ktVl>fb3Xgge}uM zwzbj5)cShsk5SsPAOHb|8wZ5!&N=PUciqqBfE^zm0@5o*vNCUp5Q7hpgQmEnl3d!Q z*|ByUZ>{rcdtw%?q}0?1fue|mndOpHt${hn{FX}uNn>3rT^{E5LW{P>TMXONwHW46 zhCrV1(k~0v>Q9pJ2lTv%;(~bil`@cd0iQ!+->30Tv!g=G=G(a=AZhlqNRl~oqc6oH zbLqu%tpuEK^Nf(H;P})iGN8*F+O`-8pcO{70^e}3_p>b+hd+`5n)=h;uxe=U-H-Rw zR1}BnUeN%Qcfq0+1McL2VGLHgcSxB}GGe zKtct1L0(t;^`OP`Ig25f#OUHV)Gv$j=>>mwY%>?|6`diZ=Oi20Kq*e&o)XTxwEj33 zpw90DcP7Ei9f>TEzZy%%p{Y=iFs%7e)$u9}6l4KDc|`8iDp7VLn_sDgCJUbYNN{?# z1g9)>rVO}>hRW`{s#RERVn@<_RLR7JitHCN&_h#bjk4pG@-#!g zaD%Dq4>A#L6@$!&^>0zDp#q@_xKU5q!k*$$Sg1Q^o9^HQIVW#>^!Bo5*=7S7eMQ#i zOPnWX%J0~shO6Ezk$5$*s`0y+!QdGKe1?&3_HH|4O*UmEM%3xJWC6pn3vQmMD6krKtxD&xi67$ZK)6-Q9vGUPNvMi)A zjvWQy(Mjxgrz8G2xE{^E%Ta&x-vH`r%Pv8U1x=mqA}9&Jh63Bt$~T1Y7=t3%AoEN3 zPn0KrW8znAbRDmW_DT!t9)AvFA2e?rpiuW+b8$!;s2clDa6=V1t|BK=Tj`-?-VxGy z&+_=fJPB5ZATee=6<0g=eqkJytI=X!U`}+B|IFS}i5(%~e(5Uc?)$oVu+-`+RNVF0 zr4Q|#RC~9Hr9vb&?o0xpc^rM@h9Wc7Wq)>nsyVs$nMqG=>Cj)|=sk~JeQDLARQ3qn ze}}JM*6Fu@iye8wl$4hDxF`DT3d}@q4V6_O`#Yg<8|Eg7_5gPZr+ag(Ns3NmWW-NH znZ`)H!2Zuxn#4he)yj( zT~Sbv^xv>9Be7#7b(TU;n@YZi8%LpF-IcbEa&gw)>}~5nKW22cYu3A9zx#FiKDTLsJtNPqcUPNKO*BA@dlqt0Wcm zf`3cenS3ZTAgHnhs_VhYa&1`REDy!ml$Y*4As;=LSQ~Q$u{4~!ffplivSIEh#W3Eo zD+C^V=&XFjmcSe>2_M;O#-SaLJ}Rr!Lhyo}4jLWBRi8v*B?9$S`C{Z8bxv!y8ZEf& zXr#&lZ!rNmGMLXyb|Tf#O4g?7h$`45(@C$^L8Vv3Q|<*(E7QrUFi;174uv*A8?wLGwydKnpEK&dh zrsyMFkHXL(KW60{km2SnrPE^;`A-6mqLH36vk_Keedj2$J0Uwkb|MO5e8MpzdG6;H zZ>ZSn8zD*~N1b+lIwBR1ntTO#vTD3do~5tJrbdHyc?vj$lzgxBxkSBbCCk-yu0>cX z+W!oPy9rK3_QEQD4>yOSyzN!B1h2sIK*awAG0#Qt9Hpmh=8XhhtAQYC;YqFx&Dt!K zD~udwNF7nEpBZ8w`~$vMr^ieby`?vrTXY>pJ_a1dl*QpyFqRYYF0LPbZ}BLustts7~6E6hGH_1Y|dJt<9g zZuZI&k(__YdJZ$?C!>ZaZ(?*~m~yCpP7_~Cwh|V074To%(&5|c|DlVor+PXiL4>U*;YUlCeHIK`IKf7|rsX7AiPv~54!kf2 z$e&0Ikr**>x%>PgoEk%#`GLKM3Y$+A7xw>)PoTxXD|~AG#TbDX2KL_c3LZJO;2-`Kx-!vVlV7SI4xKr{dlX{jQG`v2Jf zMZ*q6`JZ|a(&h((0E9?wjFfk=sQ**%gtY&=ERph`|NqthzfJ)t06;1R02SGSPe70l z2>V~u|2)uO|BIB4wEw$6NF31rw0tWjinRWZ7e620f1gr&&!o>{#^3+|+|q9p<#hec zk8}Nkb@i^`J*Qon>VatTr+UV<(AIiqgCEtE)&`Z83)Jl=*0@|)SugH}4`UUa- zL-l3^a)g$P#u(MbZu$y_!3O|i;{pSLnR6;lPsdAtC9;7c+Bl>@G`O%OGeV-4jNRQk z#E@OJ)b%MOM)Mw>NgIF%Mpp+sfoy?~;iUJ`5Nkj*JkXL7!BUIOUT5K`!U10`o#_ha zLtDe50p+065G2+9T1sSEXIl?h*RlNa7%})-X(7lvD}z7>fdSY9>;ajNKL^FXwZuX& zA@E>-cpYUqix|oPnZt95hoOVi(4VUW^kSw)ZrW;}Y@!F$bspz-66YG+n6e6G z-sOb67Id3KUa&-1!~s2F`)`0#{}50WM2M0whj1kfB{V1e&7j_q!dH1Z=&Lj=O4W3V z+6dg53?xv}m`L(YH^f~=udFj*_zct7*XI6{grLWhv@-I}Qu05T@^ks|{D%NcP0p+; z&5xIXFM9}bl0TH}MugYlJhXq;#zKMIYYp(9J2v(jm3>ccA(4MeFp5rB{~y}eU%o0T z`5Rhzh(5t0m$DMkQx0Un;Hzbb z)k_bwREHYmGpd+jG!~3P5TKd^o?L2bZPLlt@9nUjb}oqYDzr_ZbMB|og%FHYCT%%d zPmJ;Y@j-qMUC{(>R8wn>6K z?4lPcw8-Uec_K0+XhBA=ZL&@dOr#X!@kLlZSpI9T837Ie^gk z1HlG*zq^|S)b6kEsg0OFCMF5W;HL32~hfLY5lIi%l z9)L7#{4Ml7Y~lUUJ)WU!ru_vV zbOZgAXQnvclj{JsHHA(WwPeHKq>8TU66`$&yXSY}Y^m4Evn2t-GbK1wjbX)o*7~zq!5${l-ik4h>dsy zQ{#PZEa4M1ROKid53`2)l!ABT`HI7%1e!%xIBx)FSMcY65XTfHcajd3F;4{&$h~po zX49q)r4M`~eRr3Cw%3`+?myIMA(m|vheHeLp>_SMZdy7aKlazEr;wi>h2B`_2UbRO zW!1|T(ha@!L~UjT2i+*&t}Wyj|130*7YETx*z3ZWnjce&KmFtQs-*}DiASUt*wZB2 z^pS}wKT`^Ibv*V7E44bGxtk|Hm$vYQhK=TgNGK%hWBb2{yiMuzxgv3VB&fBRgcuTx zVyxEYJY-ESro&cFgrg8zb%9OLPYy*d=&z|;7|z$A3&7r>kb+1Di5K($BCwct9iZ@$T(R1Nf*nlEOiIXoivgu*iMXm(5}vqJ&Nau{ zV7m?kj~TT4oCnjXSr1+Y>Pr9W)jcG3=V20}6V*ajWXm=z=4{N?g0T_D=N zO~NMJY2~>=8=8!C`8QYCVJZ0ZPo~iQ1_Zeg@B8DJBCpm=b5D~je9jl928PlrN`XJa zOvXd7Q$@*}uIn5X*fzj9(MwH!q7w4}YA&7Q_sD4Uk^Cz`C>aIK9g@C&?^^5%AGsU&rLBs44)rmY-LkQTb394HT;M99g%TOuVqup zbBo>0m!8P9>&ACuDG=@kXT>gG%P8uH4t0xf3#hY<^P8dwTN;IWZEN|gcXc1pP3_Sh zj^tGIB80mt82a+D9zd7P1`N2%^rQXHGaBrka#0o&XhQ(gun>}=xU=TF@n}dp$+d|e zQ*#fY>0(G5d!_@4gey;AuYK^^=+MtFi~%fB1*0FvzzvKw{7Jd}Aja{2-hlwPq6hjK ztfh6Zp8Qx&MHksy5d(HD;Hw)iD&naVeA=O-y@|q2Ts7c!Bx<_Xm1F~Fzemd@M!vo8 ztHP{Z0tMnes{upUT4NNlFFppihSvS={he+Ha1QTV=MactW?z7r!jvtR4RJJuf2^B5SqCk50Q+PfY`ObyxpT zzWNpA7ATFWRrE3gT{UUHqo6G9Q3{a1UveyZKxWOFYiFDm;YEh1?5bscDVM$S27snr z>H07J3VXw6EA$LKsnY?(8<;FksMJdlbq`Rs!#eq5&xE~(>-rBn8iMn*DRZv*15iE1 z&Yx-DNX_7#vR`;?h9PYw4&=ZKmzUz+!HnJ+(ald0-c&X%T}j9ypS3aou$j2gbS&%`(nA4=y5{x}oRE3_<%xW>6CYS~+m|WFJk4LI zv)x05|7a7l7U@|^a8z9)-d(#BiucRD621Pd&-4q2AKQ!n+=~xeT4mN%;PE!6i;se; zx7N3&L%mn%*t0PY<(T4?Hu}TxlG3V%3M4|fEfIhX1Id6i^sAKLNdMEK#d{JMN$KIo zp55EL84+yN?3~tbao@D)!JQZ(fiM2S{YemK9b+Bn3)Mlc*AyT4hYJ4Dx-B7!0;<{x zit0&2{scZa_w+5?p!##bf77P70%%EgPjB8cT7l{)x`{akH!z&#Lw@OU;lB;unvZt!fr>$8+31+pvo5C@)#k zLZOn8JRjD4!!(zU#cWkVj~pkZ5BM)03ct~WjaRH=6AtW6C>(pyeMr-2#xce_O`+d1 z^A>ImGz#YcX2~V1#M49B&7$@`kMRGJw-;S=M-uV%EMW@bXWKiD#i@42U)=-OGb&eE z=pR}(GbB)ftHBlT>$?E(9y`3kOB3yEP4_5*oLF;9^o|zbUA1Je+PHlD;apNKb%S3b zC6xV{>U0|IA&tZCS^02|VxICs_SSZSCZsqLRTSgiA?%;1(=5aD5wA`I^Ys>U|PUaHAfzX$ShKxR^Y@OK^;76kWjp{MY|^Az|{e_Y8~gir)Nu?FpgCfY3Y ziatHKd$_xcf70J1^vOQk32t+^rO%myOfR$`5!Yp5DP5CgT)hkDjG`zm`9UL7gX%c; z%Fg_S-RL&`#Bpz2#QpH%V-S(uVt>r*EJ!X&1tIM;&dPPi;j*4A1vP=R5DEl1>IrUj z)z>9w!XZo2Ap=e8!7A4`?nq1~f<@O0&8Q<=qV~i)jUAmZZOkVEn3YsXp{O zFm?XE;?Nc(9LO(pU+F(u`#O9T@xL%F7yv1e(&4yw`rAd`G8j!kIu+W^jKSuDr(u@V zK8~b>c}{KkwHx4nZ0U{ty_m(Q>uZD_IGE0XG_Q%5KC{1It?%xTx%B`?&&lmE4d|(^JYCDDF_Mmmg4*xYrmCoR5S6kyTso zt~sg-0YGwi7fPl~ayy6OFgEAs0z9Dcb2FZk!N+OsX|`}8fhi-|D14_0t1D})b?_=* zZp(0ZMmYN;`&TTnMe!m^E=s3|cf7_*KoB3U$0APTRbC%P-F{i79PM{wG$aKQK7SE4 z6z6hDW}e>qiY9Vs(fI{*u8Y1{Q(%keN>*rs;Cn6aM?aF;%2!)c-)zNR}# zhL(P#803jUQke#O=kTtminIWUSZmM8fn+f%$3b+3tQ3&^*s?LDeNXi2VL|3GB@!|x zV-ai35ZnhkuRqeo#9#5v58xwlV%Aw*Z>OP!>!N>2qbT@(Rmr0u9mV~X*`G^r!nyVJ z4<@QyymTtPPk`@Sl`#KZ^|Qk9LZ}aPDIf;PVO!Wq^`O~Vbs7Z%HLWO$Yqne{O{){M|(DQDV{#DP^u4= z%%iFDZw$eoOXAMW2uWh+sy&*p+>AVx9L)Exr|A9Aac!GD*-%OPx6pwZGqy4Jq-D|V1 z?1KX*Cnsc+4kAzvesa`}KQRf(YgP3h8;(K!a%xjPxd&Os<<3rJRTV>f7e(xZ6o*WV z(&5F$io~1DOMqOQWoup+3N%c{hZaR$MhKZk(x#2 zUtq3hrV-L5@mE-dAqtwlZEJ0Ft$S2|j{SbFa%*U(!Z4%j!>Py#%q0ko)DWZLh0`Qw zUL?BrRw@d*zy^GZM$!#85(CfClda%T+|F)iR|5aSC<>r4^YgXV9|eHVily4Ben!pc zMybVn!)ALD8TXe_55{H9zMCB#um64;O;ZT;LVUGS7iCYZE5e7VT-Uzs>vXaMUkdXi z>0&Xpi$@{WTub_J5-jF#eU9C^?k+iZd!EUnWp=U-ccjl!!6^7-x+PQGMk)e#K4lmE z&Ek9qR*I}5d1n-w5@%q1Dv^wv)}Ook)FOKVM_>1Cy)|TU8tM|7_4yp;+Li-X^sYDn z<{^htJff$J?X;wGi3)&$MV3m_Cz`FnuXM~iWS@~;;?RX`nCXXf4~~8iVE}H@z{-<_ ziO|5HV07I87>vr}{RvsD*O^%9`g9!NfcPp>wn+^l^$F6VY1=V21=mMV@#?UlfC;Yf79X#(DdguY8zv;u z1hq0p*Tcu|qPv{zidQ3Fr!yRJDqucK!OgDv1}kq}QE}BE8PEX>GukAHuzQk`4D9`j!6A8O5_0^{B^{*Er{N(1+&*02oJnr$rwKzj= zll|KME_Ybze%+M@R;~<`=gbdN34SD7tZ4h!J#=%hvco4y!ZJtc`-eS)2BMGgM@{VX z*H+t3mKvo5$N6O%a-e7eu6}R3@Vp}9rAasteIAYPyxETQmohgGex$WG6{i3A3Y?l$ z$dM+Ms1@6^Gbxc*dfJ`z&LLM-_5H`k=|M@*vMn#J0ahPzI5NXlW8bLxUbWRmVQzDI zqZV-VUCYYFAbo0|FdAVqjF*KS@)1%Wcy=}I!bc6)MZIuivA-4WD$B{fuH9=X7N~$=4$F5CwueGkp%5$oXXfizcW1#vvc20 zXB|S}A#htW3|~X&bRu-3SDGg|N|a)NrDWOjw12eqh!OlLMt~iSi7=EZZ{T}@txtHP zVRhaU--NAzRi^0?{7C&6CN9|T~v?d4t#Tz1yUwL~kwVHQ68{spLw`JHBtQ|9F z{PPrH6hD@V(+A!evUQ@`KAvWa9oL)q?+=_#4gLe^xk4gQi#FVywge2bO-65+p9dW* zLY+IxZ3@e=Q@ZO(b{Hs4KebohPQSGkmTZ9 zi(x!<5sr2ctF`W&;KnGmypKoS9KXhx-Ic3+BR1cJ_}@Y->d>{(?fsVe^LbiF1s#(n zxrhQB?N2rZS|BzWFA}w$r}5A?vHgJ8DHv6*;urvy3Ie~CJDTUv{eQJVKVI`kiMcYe zG;6FjG0JLqhwIoq?D*A(+Q38jDv8#OgRHz1ivT)RuwB+8_Jx7y`3Y8cH7w(nDB*Xh zmS8CH7L;h8#_wv)DD$!6@#7;tkgr)}-t>$&gX?k0eB~VZpzV$n9dGt0;GU` zxS`&U^-fPE1f^-few(Uo2aS{;c=xH5e)hvW8gpMwV`Mj|=97G4f8r!7E@n?ko(={m1N zzON~*MsjgrA>9-KQ&*fQE&8O_^htE%=ou$%|x@;dV{U4H*G4y~%eRyp)vY%)%DArY z6N73!XUJn{1Bos*ap{WP9egMWo(`GZI;0UXTO;n>BT6$Tv6aw_jns!Je3s?QYe7-> zgO|9JuWIAZ13S%qPq?-lczbrrF)UDf!ZWC1>3SW%1DHCZRCX?k>b`t)SL@k)0qbd2J?RsUn{4{T;Q6}ZbbC4Lm5`Pe0 z3cZbd^Js`q3Y-h`lb!2F46^Q&^9*X~6#N z!(H#Ehj-remmiHA`Fy^{i0{7OqcJtsi~Dw_Y^SdcSI+RcbJC z5`-y}p~t}@7LQyKt)CPcj1cEzsXA1n&m~Ld_U{F zJ?ZMa8tqpXcabkeB(^XE=F-onIG@)qKWV}XqOWm_@WJD17bjK-IL}`nqVdwLoZyQo z_iYNrJnENV>~-E6n{%up|Dz`f%E_8HsteE`gY92Kd&MN5e`%!ZkWP8O26$_14(*8j zRfeZ-Kn0xHOwk*y zCOobvOQUr2J|ux^n{$G8P2q3YXl!cSGUQP1&W@x+;4!dl`EUs7O7PJA6}Q#1*aI=6W#DGUZJ|JALI&~vse~}Xhgw*{cxFTV zg@p6hfWu*$FmL$iKI8sO2iscDKT;8kAQq{hC|d71Mxu7$BQbJy`(7ZWq2PgJPi@}2 zb>B)@m`u0bR@``#^2RF9GoHV-0ROVk?Z7EK8T)gM| zyLgrU517~D?X3$LJvhvL0e;#}QtHyI=lE6p%rSU7mpBCBPAy#=qUE4lz4Xs$y3kro z17H?c!-^Y0n}iyiES%xqJCJrRr64jgkE8opTX!TXauB9WxwHsJ6hw~2RlJT8>+Kyc zd>h=2IZqId*uVU`(4v%pOGr;KQjBF(JCJ8yCx*+xfs!XjNWRe=`YGVU{2_BqVMg32 zp^x;_t4{ji0_NZ=65POR7lB%3bz>*&er4MTUeFhUSXDDKsTewsGccu_3`xu-)62RY z=ep34Kw#Ps@9dnCINC#`2N?qZJ+z1JL_Z?lfQ?0r(ZzYFJ2`Wupu`a$<6XRGMvuZ* zN9@l&Cv#_?&i7xivBH`n$awgrr8$ZctQ4PVxU~T+56Q*ox@cze%v4p^W~hNU=F4tT zaQb&zJn$Wl#&KiScmAc^Vc(~kW2Zs#Z2`O(HV%#c~_)7-avc)HCPQM?G%x3Q2NV24LVm3wl*+PMw z@8DT(mijh_%1^vutBMfMx-NT}7ct4%UdPcyI<*yqHak3mRqCz&-qSiCP3)E;MtVg! z&)HvcH_R(W5k{;Dy9g9*GZkl65;0=6{LXTr9&ER!T#%RI4jXe#m zzaS5LWEN_g;#~)XKH2G^)=U+Ss??mAWw*Xmj4p>aW7iwhG|ej_BY0WE{YV+8=n+^B z@IccrB*))qUKS1tpV_xufIZbRgF3k3akzB;CmO!wYj zc``b0ab%u}LmX-=YU5PQZ!z)X5VIqJ1dsR1q+;MKx&4Q|F@o>a@g8g~L>3{}D1X9! zDtIdMaqOep+NGvt*wnPlkS=JDz5;>hLw|kKj8)lHTk3-BF190`{ z@H!1idCtDKt#v(;A_O7nRF)2J2Z3@5^wQAY{1#OuM=+9rJVe>m4E_^_pOOLY59?X} zc_fyiLnpVLMHnHndJC0syCbl*LzR|d0=EO1J7#*^M}(`XYye67gC$=kwq|&laJqRH z^nQ*t(0{9jVGFTFtkPSm;l!|q>-qti-yj|AMh)e%YQ%F-p>J<{4OTw<%rmj({qjYre%Vs^kZ(9-3IAN zC$&h{DT3q}`kZ7&2B{GXMJeQAF_P4)&kA`iL%!Pc$Fru`V41Y|CmIW&MO5?}`Lj|?O zrp#A1q2Q8UL2n=aFlpCUUvh*p|4YrCzu;P1=YV76^nCD4&YSDEM@|DCHdrQQ=(xp% z3*mHt&d?ZNwT;;533QyG+(LHM2Cw?s7x1@G>Pk}YAZ=s)ame1N<-e#@JAiA=WpmK?0eQ9eTC>436ZU3KujK4j|R@@VSP+@u_UR|bXbMJJQ(exgm)oZl8L ze-u9%+tD^h$sC?s(M4#V3KM=~qPY0`P|+GX=p7^^%gFZ@k`5^KJAKot!vG}!X+#Q4 z&$M0~cv*#5DZ0sNc!TCTa*V5~X{b(%G`bwv*zFjuGuf}@NYBV?0Sa!o*0~dM&{&|3IWG1J> zUR^zOd?mN`;^H>&E3LK{GPXX#Nx{6AL-ckvPL?kxD-k3Gpl#6U5)P1+K8Uo`;)ddK zvmFtWF5CxW{O;tZ&-Le5l^2D!1$}18_kI{hn60H-v z9*tsbIiN!AtJmSH7+j~#;$?W^RfMJDQhf?QBiQj1G0Dx)n1Nj8M3U#q$ln-fz4%ke znnp32aN4nfBX+GXTg`Gn+m7d=7z9wXs&XCQg(RTwt`5*MfL7UsOnT7Y@Iz#NQ#r*P zaQOR=)fj$|UPs|eSxspz$sq1nEgJWl)l+S<$rgRj-rqxBcf)K8$dm+R8N&G7b}t@? z=Eo9NW+gy~pT+@zyD(TX9AuViZcN>Z$X;D_36Q;K$G$6Rh?ApAM5dBb?P=>a;%6NxAHX>y|kauYKuLU&KW6)jrz>^LL9aDhbU}% z=6p68s10~72UT}^3S6%Q*uZn%kY9wK9!HN6Re=DeZdF)W>)zsRPIqWrPY?Vaj^M*l zN*$9|9~O*I+J1LF46clJKi-kI4K}lN*Nc;{3Vu@imNe8;-fG9Xty~7}{+1Ko_138Q z28)$exHt68;oIZgBn6eTt0Ix!JJqN^^BlB!32p9-^(|*9_q^K$i!IRtj+LlxO%yQ- zYNW6}ajqh`c{oeXrxdA=WAsuZ$s+lvixNZ~@_V;QarNSgSNJ^A&P)|y#&EQ~oVNR~ zWZ|HvKr*x4=Hu~~&nhv^jWXoE9|C)OyCC9VQ_s_T@96jf?OA?B!S;=s$ zaF9I}c%g^a%YJQ~K;|)fWFiw)%r5STsq9Ko7=s*i(3xt6y%?S2^$;F>_D@Gr>Y7eD z1(%b6!_YiE-7PZ5niJ>_rnj-FP?S85kC@nF;}(jJMPgCo&@)K)MyHtpgz^x3v+Y0$ zXTEwrkJ*JMT9@9=Q-+I=5;It;4#6z*d{P5KqoGl%iaaf)2;_KgI5Jk_& z0u9X1eDJej3G4CW$d)#P&(3^{N-#l~^!2Qo6Up0OGjvuwdBkE4vRl^q_?v5YO4I+h zPjdZiGWgLw)OKqA5C)r`?gzj2k*#!E{j4QhLLV&cb;!t=#{7YPFr68H=jWT)_i%*O zk3~%*g4hT%C9a3{PjPQw-UWxo;8Fg>8lthPiEuPytWPw|d}P`h%)+okAwA-<-Jf4O z+a0n%?3+}`&1N2d{2Qeh`%U+G0xe|*Zx zVSs$rJmLYM38_GOeoZgbtJ}xQU$>tLD8hPm61z*S7lkiqIr&phpy1!6H^#K(A#+xz zJoqv`s5)9VfPUt-Ne-PGV#F3xN*b0`wGQdl^0 zBfk0cr-Rpt{(18;thG4lyqxNxT~pqai}Kye%Y(FGXlMv{vW7P^)2x52amu4UFhU4P ztxXq=u_vK~5q+D)?=PC`Slp>4uzexM=5I7|sWtRot7#THfAPNiw?6=X3PENt2BO%w z+E}KT!L~IpZZhcZXE@p@T6LX4R3xFbU!jg31X5(7(PiCrq_m4Q=c?w+Da+u!BFkVr z&EsbhBx*?8-`=bbl?BUNg1=%mJ_1|J%BTN_m-)_T7KpX|C~S+0I*4mwrnba5G$*?6p4x3Kv zFN3V8k^j*H1y0kLi3RypmU&_m02m-EbD2e9#HM|ji(wwj z=l+D1yc$|GU?n?y?7u(RtM0WE&12~X^FGG8@1FHk*!r96C_I>5W-=ttaeNDuQhPP# z@$kX?>D9pVFQ8A*=jjCD;6Gld%a|Abos~at$yQDY?){<(e+&%pyB)DNep{rE i#{c&a^9znAdj1Y=Wp%++(*I6Xzfsautd_To`2PU!#Z%+} diff --git a/frontend/public/android-chrome-512x512.png b/frontend/public/android-chrome-512x512.png index 85f7bba00f590ff206405eb5df7d87b3a219dcf1..733edf172da86bd92173fb1ce44b0366bb9f33bf 100644 GIT binary patch literal 37992 zcmeFYbyQUU*FQRRgLH>9QbTtrDBUU`-5@n|Ga#XKN|z!ah*DBgLrW{&3^~%>FmsQe z@00g=e)s-;*SfAXGH2d#_IdAq?R{c&wN;4l>F_}y5RsayvOWle4tzxi;bH@S&ip5D zKp@OUr{_lAMp~NEHtwzhR<`ceb^`vc5MUexl2!1BSlKw+d9zsCIXJn=u^zT`u(CMW z%CQ=XX@RvMN_LJ;s)3$%27%hoZ33Nbq-9Q!fd)l#x35W@RS>^FrWIb)|rS+Ac{o7*TN{-dh+Z!S+ zDCpB|GB%H*S|eJa1erjM+Aigz=HpEx}Cq%|6%&yk^eCr z;^^+}?&atX`Hu(qZ@2i5;s3D^IKKaViN6)(f19kO_5VEG)%CwUhL`tKU*I7A?NI+4 zP5*uaujc^}J3)OrFLxhL8@s2zc5dEm|D43%bCFhawQ{i2v~zRtc9dfk6B7QvjTk!F z{*QsbTe)l#fWd-7|GA&>|33EjxTSTS{Ow$fl$~7d+`NE& z|C5sc95wzwjVigjxO*A^!fhwV`mfvl2REeu8PjsN1%^caq2xb@)RdHTJ>Bh{T!1kz zeU&FHYEPBKg`~vA`Gp1kwGF^JX<)6BeSor+H!w>WEG)(k7UCBIKNpge77~&c6XFMp zOM}7x?EKGcKqG9eysiG<=Kqyz7Fl40mX@@tlb5%^%N;^{-18r+=iJ zh2}A<|MSBM{u^n6e--cFX_FQFAJohKGvU8zDzNTfzX28iFeQTj zVM~CE|FA}OZh#5$1Z)k9kGVGpga&m2`0_va0RnNS_@s>SD(g}7D~KqGKBMUEvL<`! zs7p?7$DaO4Xs~J|*CF)t^>Ls(r&hz@OFirLnKvC_Uu$2+st)Av*H{IPo=>W7Egm!% z-nJp~4&3>9-$|XZVVqe{#1~WIIIfni^}Bu@n_0=h$bf|r>L@RMg9A%PiDmn z`2&kD#<9lIO%+i%KHbB3Nq9Py8-%?kT?v8uCS>xY2cnyAx+K(-r0+gSt{#z(S$aXOoxWyMoqO`$qM>eoWrw0$gaA2GY$)-zU! ze`vB=V8&@Mlf@jv$a7G?o(uT{B@Ze7RKNdti7wAP{reyByst{9Z6C7d8#hw66Z=;; zXy7$?iHNkqhN z6ocGw5}U%9n{k_`x8*}try`Id`(tZ@+n)y4e|nb~&QZBx%vspaLCvtU*(AFf)JsBt z8`J^1I`ALeIjY2jW|sQa1H`5K?#Mpu7bYPZKMedUo?Q2=4;jFHajJqI!F`K`r}#Yl zjp_+E=mBl9lE9yIl+}W0a+Pnb7pBR=)tgxmgYAJH&acS(i`b9}eS`r+gA4wh&{)(t`2FH^#M26`O?YvLS#J0rIRbk3@nu z(gMle1|SwSvDYThPjjQPaJoFtR$9m3ndQaQWmCt6VHOw*0U|88+f9o4T4-VHrh7b4 z+s;c2YP3xBe)Jc%ePH?&?^yT-LF=0|1&D&S^LmP*J?ul$~lU zt<+@+$Iq4-0zZ)sq=NB5wx-qu9n@ubV+?s;?{~vJy)y(;2}dMfV3DBbLZm5(ce4~Z z)zQKjet&+tk|Z*Lw1+P#;@uF&eA1^r3V}Dm+^pqrzVosi{~9qNe$?=%#e)hdo2TD) zxq3EFopM&|k%)PK9s16|3>;s9XUhP{mr44JM3cwp;l1Q$;33A=8YcQp>pR7u>LS%|<`%sv(M;~IVcyb{a($OyOAcFdqBKiBK#E@evC0`dsXV zj_pYx1((NBXc6T;J}y3}G;(&LJ!-<&PyR?dj}OUuM*ARJJ{#>!n;&9%Yd3 zhDI%9G9?s;MZgkFd^psQ9yV$%rMNrqv8Jil8;qoJZ>WJYC=*gI{MYiD#EhM zRQBxeU`=#D?V0lC?=`|N*VB)9%5{|2NHM2D7FY$a0dn1Q82cv>i$*Wmt*oTZ)eOcA zn#QjOOr&agQ?Rixg*65eOiEl$CVWt>=3ej$QTm$bUNi0Ir}ek2sj>@@3Y^ezgJ(4Q z1&S92pk$6`L>t+7rU_}YhUufuWGOslw}Wftcik8AfuP=J!)qLFFW4Ze%S}~?FYdDMi)M&FhGasqbhd@ zS~KiDtUp{jkF<@IHLVjH?gp1HGRVggi329Qn>x7#Zh^$9rXc!5nli9kD7hIi29kTk zI82BS(ywf7e~6P6XYj;JT)VX6-OuMo&TuA6HgJ(m_!&R|Yfb2V01N?nb-7h?8LO;3 zz7;3=0waO{i(&M5h>*d1^e}ebD)(y0>+2PwVEoTdvhPy`qQk9dEVF8ui3sDBR`B*x zm|dz}U1aco&nB@R*M*D2#q-v~wHXOM6#$EAr+zx{XcxzCI_f5UO18?ODHVJDTLN-@ zw?XkD+2DC%RS~96(E~#_(8Ok+C?EJ)f2rQb6x{UENiRBXMqVFZ@Inm$Xssa%bXhc15m&DY_3nlI|Jl zvIt{Gz{WftVfz*xck_Gzv4mUC-AhS!2O^2GB6hAhoCpagU|_SRV5uwK*8^2KO6F6h zcO@cVvvNT`JQAW`GqrK;Z6@1uZBgM3&saZL?HMVucw**;31VELGtLvK3Sfco$TUt& z-lZ+pqT5|+q|!vkSQ$5YogQTx8i@MwMAcERUu>p2t&Ddr3(QMYl{oi*A^d*8DJ!Zd zN{41b;^%1u?I};651Ys5(z0LTuhrcvhtffaATqiI%e<)rgJ6DBCgx?Ql5~FQnAGCL z{u5iBJX*RxB?0@z-fkvix_&ah;nj(_8xU+rD&`@^JfNZRpRNNr8L>d*558;{lH8$7 z;sb<{Wn~Zyt+RF5%ZrtnzNxAfeTcZ)o?K{(GSfl64^Omb?T(OUO71pJn&1rK&k@hk zoeQB>OVcX}X~d9N)!Zdl#hMco#(^)e6~Y`t`c4x^N;FQ?pYW6gFU?C#kgE2~Ai3{n+FZVqW( za@fTm{Q~`cnhPywT#}0~){4ZXSXb=Y;9n&ymcf&swjNlUAVnZlNSz{O1vT)*CTEqW z_^Dt^lv5qG)sIP@K+%a!`}w`z4NYDLfQqB!Hy|lRkUu>fOC0CXZs2XM_^y)hvw1Yh zcSavqtl@8AWE9+LthCq}5^o3BM@y}@X`5ODcN9_`C3~iELbVYWM9S&(EI5~B+Rboj zZ+0-}tJwi)ts=*K*ZKkr!dQ(nOZ&N!e#d=2Z%bp)1s`NRxJzHDXtyMqSB9hy?-I30)fA52 z{0Q078*V$ozOxf4eI5;ErHOuA)S98#s~MQvKu${sPYCE`C6<7Yjvnv-P_#4Cflk;{FrX49( zouJ!7IU%AD>1s}0;~A>Ym2s~n;ED#)Anq!6F#3BR`8?NRRHqX{rUa$Qe$3aHNy}xf zy6J&{kB%snOOPW@u6YWed=ZRaF@t2P*>+gC-K{_q;c?+@uy4RKRlf;q%&CnttL&+w zxuQ6tEh1dX=IAtSH+`+$l73RG)4MsMcDbqfsC2XRvl~z6vUYUKMY#nay-X0i2k7Pm z&!>t0sKT`jghB84kyDa7_cN>Msqfg+hY)2K!@PBFuPwxd2qU`Y;_%M>L?)-yMH$pD zIn=glAaqSH(5f&W?f#&^lq@v`J)qw(z`DbdB+@;uXU_u|GHrZVWV>9GUAXPOpv-3V z@dHcBFYxbQU|-2dR}~?a^)yPN?jp!E>yr?(n$d84^o^nn_~NMr?(^yT3JVy;!ihkY z`w@r>T>-`!5Rv2cS8W|9b*=-!a`4b;q%vJ6)lvOI(H{iQ`{xcRt9&$Zvn(=k@0OjKo!# zA4XxX8ZoJw#HB-FCT(=Fv9fWQ0`$Ox}_cLDO|cg z-we4uEc-0GlzBqMhPYc`zQ;%yQ}_wd33^f(jkA#J7_|R%&yfPqyNv!^JxYw_JJvnN zEadc(vQnqFMWSs(FH8t_8b0{rqMQs<^9P7Uyw6Yk$j_1|?dXy_yW6`tJ7iQ0vvjNr zEV5o~ufi628}!#o`^uik+?e<=ALl6`FJs36S2TS-wwC)cRz`w(!qZ{6M$vrJCHlvO z(B#}lw{TDPdPy(Lf}BToZ?Zl5)su}9Pz-QpSg^3z3u8{KZZMBoQ(i3xmxJ;;Ss zcz}!nCQQv7P*H1pXVk?0cBbTG#hXJ};c~1;71_;ejQ*#w<3SG_v_#21x*v)+RNm3@ z?-sBN%VuS0{EZcm^KpcG&OH|57(?q`6Y0j=+W4s#rGV$Y_IU$mE$Hfk@4z(Vuj zQ4ziUv(%FCjj_tQS+<7riPInnn9wthcYFT0!hr5wBKpR=6OUIo9m2*DVU@%nYX>A^ zjSuPdYfX>`K2rE>#3^%~pIiId+I~TgwezvGM3v3ZVBvVpx!p(F#fFX z8tl54rcaUa&7-Ut!s5Sm-yyg1U7&v&MLW)DK6JKIw4-{6d>U&G>#1=`h~R)B8OkM> zp;9$tf%9{hI?U`6Ui!X~D?e>v_rMRY3!6&g=VIZ-2s6q@3BwWGt2+AJjsDW_hsL`1 zb<7$&9N9Iit8&eB?z4f<`_4qFJwEf+8x!B(4aWg|RU|;PJG8GgryXmRvtc;%yLq3o zE8_J7cAJc(G@2{hqS|jxwa;;E%|H*noEAoij2gyue2TZq0i3M8r^X|LTFbfL+`n~` zx9XE>Hj#zD7n)qhCu@W62>GB}AMubz!4lck2#lo{o>cHSoBYw8cfQKxaui#xOSOpAS)N3Qw}JBc!2w@Qis)H9ElY9K4(zh4_ETN-H-R@ zVt^|h;Q0nS^B2;Lu%h9(dL@+~$8#DrKa*ne(G7`eR9 z$}lX@zM6eC0X7na62~FNKD5>4T5_lVn$c;nw2;`Zs=_8L%Ps29Jz{}*H*e2f=iH#H zwkD!Ikz~ZcspZH0`R5-?L=;Ti#H4z(WN7O$m|5@)86S}Kt*1a1kn-dC!gdYl?zhOs zLovb#DX|y9ho^<`5JL-fXB93JKXEcbdkbMJ_w|>1M_^=aP9zRmdzbzXUpL#PMz($a zbPnfy+&z%_E)dGSSh1u9ybs-dE5VhdZtB)h3eVul7TBxzh5u|g#_0p1xBK)!gm(%@u!1B`f&jki%J5!F#>E5Jiygrzgt(| z))sXI@4qHQzP-r{ zW4TzVasBxF9Tha2TTt6QhhS)z{$+ioc{U|~gops>o!#9S29i1}1vr=TVK8@I^MlO( z%wL&AL>Iqr21O#tg16kWISCLWTPCPuy{$=x*~*{$zP)ciS3?*{6B9F;FCHt3GFY$N zI1FUJjFyp@juC1I0~9@F_3;lsw@)@h(%3Su@GksF@ra$BE%Z6U49a~0jqe@;Qg{11 zZN)xDG$0l%#ZbUb{t8dFY zej{&Q0i*y~i`}BPayD742a{Jhp}psWWFei|nok`jVZ4wAedX~- zRj!H8g5`D#eG?ED~_26Q84d=8A?$S2sAWNwutMp?*S{Rrg@NeYiH#iUQ zh&XI>3aw~{v!x=cR<5n6dTQ_cyG04*Z&NO<7Q{PlZ@bUV>{Ya3{$v+~77-K0ow zRI#x!BRI#3rfEr_)lEVmlOUleOkGJ$ZVG!z8dmAvSE3q=r5G!qWi#`Y>c3HY{OzcE&_8AkD>NbPEK^Sk zPuPcY)b!ovz_2LAglM)@@f%djt@hS%p3v&5vU@u2{G2hXBh9nD^5u`!EJ?hAvTX^`ey?-rQjOZ_J6^{b{_c_0l2l)O}|O zR#xr|V^}_h^@quXZ;4tAp^ZyxOT0WpspTmYt$CZr{d7DP2wb>%ZzX-|D*D^@p_0IMGKWYs=x8e0O=S=czDJXuSf;Ld%mE_<{YUJ zR)zk4`v-AKM7iVzVe56T8tr|{;S_@AfEKztm!jX{zPOow!{K?1LrEXLe}0h3+uSJH4aU9lG6t7r@Y0X2osnl)({Tow zEZ{~xQKrQF8O{fHffxP_M>Xk~^BO=by2gh1ci58nW$!<#J_E~{10YOze_>(zOcED} zhUc8#y#eK)4e-Oa)~^2`{t>CDRvJTLra_WSj*R@7xx9b(3%-insIgr&^&;_%-E8xh z!%}5TV{=^0Z;AF?oou*i*y%>Hf?92{6-HHW%Y@4n6kq+7Ol<1W1}H|(5!W%85P&(V z`80>RzAt8diwHIr(46q>yQ1sM+WNU+I8tI8D);iE38+6_0tD8IC`OEJ9xN#QeA6tF z*6@#F8e}qe@0?fFm6g9&Wxq!(GBxI6c{yJX<1BZptoRWTY)!8DmdHhI6ZKBuOWvlh zOFGS2&&#wpx$d%45Zm1e#eSMJwIrt%73DTtdCVI|?_tjq7awEw>My3X+r4?ZK8lxY zB8~x7qip}^DH{;g6oQ6WTn4`b{0w#w-np;PY<&`PT8?mULCLWw>By2fNf9W-r&m8+@QjjS{HC?69xI22Lu_Ocs1}4Nm#V`#SXkNTI zXf)7IpZyje<2&3X9eVbD>}a>+KJ5^7BIvSI|5lfqjTgo)cYrMp6cJ?e@k+vZRwMw} z^#~&geMon@gCX3?*hoO4bVw=mT=r2$L3qbUs)-!`y?G%2DXmYMnE9T6bj0#o_kj$Z z6>`Dt17z!CWNUwCycpguFkxvX<>?pqP`4)~q3fhE$^n7rL&0YXs9ZU%uWHbaZVzLs z-iedzxh20^+fGwH-WF~Ag_a-9``?0$>U}XVB9zq0(n&ATm_fcJEu!EO8Bonvl#ItK zj@QST5h8>RyUU(>vQXNI%>0DLYMKdk7hgXB4LzyY0!%30h41*);=Q*UlrmE=`QipT zAzEI}hd@|##5Ln_pVP-d*t_b!%$(K`8r`)qN$_e{AWoS(qAFs?zvmt6Jom6dQ)oeG zx1Xo29N$~qM|~@Zcg5u@_aQyP9EG(Uc$=$MB!RU1dETmO`@Xkrob5Us$bB|-a>|`o zkL%}VK2B{j;knAoXE%C1LrV9j`(%T`bJ67y5PIkVVswB&B}motyt?ZqWeV^WE4(@J zn_U>sIJ=a|GcC+qSU!#3zS;iwUI1;krX5!N)4C2`e;pJHDF@bIE+Kp+Oa<`x)1_Xo zEeFxVjJgYTKrcQuqrz;NfZOtOTLs=5Q%v#q?w^X3#6ZvlFuV9=%?WZGX)V4S;(D z-jd1O7}uKP9XY|pEp>hfuyUX&R&JqQ!X;s8v6tz4mNc9hGb-1=%k*l_ydBQmsN60& z-#F#)nTaMamb! z`?_$jZJ&d!BAC@}h`gWvG<}^!m8k3wKYlT~R=5RVK4FD|&=U(OR6IFn@7jujWY3bq z73IR^-qapQib8M{R+Kp*#>=verpR}ExF8t=HMk@ebYDH$(*5xVvqIYimY;TyXeGCz z!9I1E@*HC<=R1!(`Z*!!>443Ll&{J}-AsPvF}d5HMa|Yg#jP#aaMH+^ps~uucY7qf z0cY7$gv3NTM^m<`xdf(o!8m`^&vVPHao{vXOh+Z~HuiPeCeOQJdBo1A^Z7AOzze-F zAN1=u!rK}v@6~)!z7i*Rx?OcglE8nPiVS_b?%RB|(P7#T7{$Wxy$WRYcuyZv#E>OQ zqvRRtx0zyvDH=RzlMx~VKG{ut7@2r4*(3YyR()Ig@*|tw*6l-2Zg2nmIZzusRN>4Y z1CeCRNK~r%Jh9Zr_-jL%M<<{@!YeAZkydab3Vpxh1k6YF+S~k4$mpGerr;*^$`#3u zzR}L*;{18=-sy_1j#r?@z2?NmoV!2zjPpkg@K`@6nsFhQ0f%l^2jZdK*vS) z_}3BSnYUSb`Vg8Mnj2RyIYt^4sD}(Cfc{!{q=N<<0MoMN-hd5jd(B;ZU?UzwH z!V*y>p-JCfjc|3OBlQ)!!A9V+=oa~4w#||ldQ7@Rx&10Rwrex||VGiIS^Zkcgo_m@fj2PH&Khwa=>9&AVbfatyjdNVYQbK#%(hXMa+4Zl@n zd~};TPZ*KcrN1K(D2Np1M>1Bm!R{(p+XH4)vNGW*?QhA5Rs4?z5Lai004CqdZ22mb z$)e-5o3AqWeR5>~XCfu5TrS`9(+Fyr>;5hCS2taetjC)#>MMiZ{8AK5aZLYKU|taD z!3YgK@&MxKEHi@`g_*ZbIqsO~4X&q|IE8Qo^he>hf@QY$cBdRu|1Gt}fQ6uJ882)* zjtL_VeL2C(1ywJTmS{XJEy{mjrh?~01nTOb2SGPb5(q80UZfS%eOYwN%u}SrO6?k8Q*s-F^Hrea}xafq24;xh>mxoW4}N4TY>+pq{g623j(Lucp3 zfn!@@1M)Dg*_fF#A;{JET|Z7iT*>UKO9-4Aa)Tq3Q2VLFhMjD6waonI=iZfl&ts(X z$}{8Rp3<8+ac{zBR~KIUmF|qJc`*LdpSmbg95J-J`_(dI)ci|rNnas)aaT49`4fo5 zkZ|+$e51$Caer$~P<2P{x90e%s@6W6FVo!2mOD~-lH`tPsqIARM=hQKAxa>B9J+Iv z6543BZM}XG*XfVxiPH&@Ku)Y=JI``qX+e^UM3MujQhy%_mmxdZ<^c8d@pe_H!hT6; zalY4%N8Wdr<4AR+3;nB`?!{|W0zoknPVZwJ+>6Wj>qAEe8T7^Gz>!KH$%HiwWjctKv6i)z#AgJgmXIi2@yQ z?Rv^e&2D)I+1~D8JPWJ=kNB+mIBBJ{!$+ba|E^boA*TBEexN)u%6%ehOTXi{X-2P4 zriG%O)mHqd&sL*S{$E4M}E9LWTp?Ge`4N?u0J~ zT(dLz%K%ZdJInpf&@1tX{U8HRejusp2jmwJlaYebj87da{&^nbH4I{YR7`$%BZU{D z^`8A>%=S7#f&(`b3_Gvc=+s<5aNm}z!xs6jj{$Wxl{HJgW0D@UWdaJ(iwx(wxz>bv z?I1M;F3mH8n+~|GaK!<1Q24XtmN)ulJOzpu7>tvt(KyLd%49?l z^jSM65(`vQfHFiUA38{>+&V_+{W$XHvl#cQ`U~mzA!0CBa>SPI#>qwHQI>-dpoIon zM`znzj1F7Nm4fuV>!kFXC1m|!QZs?sqxYFq1|l}n2a+ZVDy*dK=MyWZXFHj+#GG|H zu_L+;ycaZNH+@~%r@Gx=XDlA8{l0QfkdhZfT_0bHl-WO1zj>UtU>OI7l8ds?2pG_ z`W^Qnf1H9+PWY zu#XvGeDMpC?2bJ1`~KaB{c4byqMmJZ#ROfR6G&ikt3v33TwA*d(S2Lh@}^E(O8XjQ z5XXGQ@&J0~j~NrF`2}13*BmPSrB4^u)k$2;t&n>>fPDDM-pI^bSa|jHLX}T7lDOoA zAWe;NBRm40=H@}_m+jd_{tJUv7%(%kSEN+Ms zMzReMQ1D^X216-jk0CJ~e$@540u!TG{=M>f;~uN@=-5=}@MrFI15}`#9Y>7wTm6^9 z2}vtw0*{6?41{IXg`a>B+$=n5FJf>x$}q~-T?~Ixyf-vMOx|%F_nkc}w_pJ1m^Li1 z*J1SoB;><^xcPmz1g+|eatrpZ^)J&W;WF)g2ZX%m3xx}tYpoO7ED8@+_N_LH$7&l( zTs8T9$v=241hRH3kp~i0^^Y(z2MSJ243W3%76PEtjJdCT)OGo8)kCLCyCP277ElZ> zXcYa-DQ}Q4f_7-Ee_zKub=*Y#p7SUY=pO*8cxvlji0Rb-YZEoF7E2a`6z|L z-~yfCV-s4#9X~L~)2NNDp2mA-;3N*lP_XvIQFhb0@IA-KWw~6EY+Y%p3_H)=ma2`j zO^yB+ClW79ojlj4GCj}qydW*_-Q}L9ud>hfuPClR;G_Wcq@vuqq)?eWgZl(|**?Z=sqDf+1@bSz^WdDrg4%3u;e-?qd!>3>cF| z;~hNwWlap-@AHyiKO0c(m;y+)H38D^fHS|S-7hQ`Ja0KI7#_J$$SU3%?Lj0|J=&;w z;rwTpS@npLab8zP<^oe1M74p{blPyKZ;*ZU6?H%I?dw{@Wotz2xHT4a9#KVlxK9ngE4v3kNOud>Ns5{hSjrxGs%M2OfjCbJiC!EN^#cR&lf)?+2QNF5dw z7O0?My{8Uo53bH&YoUjr;jx$G08{(3X^qo7mF_BnYUz!*jNr>1P z-x!)gu*(DiV~$7oGPQCQEfL$3?E0ezR39)Bvan6X9lCanJ|WGxJ9b;tLJC-h>H5A& z{eEq#^`b^76PNhXw>Dr?XWje`P5MV5o=T#u8&#fu2iME5n-^6f3cCPBKeDI%*Kt9C zw>NY3jqi2;z_>ht@?JdN^wi-P@!LO(Ocv-xPSPAuE&&sUOE(o+Ad27h3(d0A*jm>f zC(g4?*HDF&EyYAul&w7neZGL=pI#Aw*If<+B|F2JZeID36LHn;@8%{Nu{tgQ0J;DE z7y!3F@A%qs5$`k_Wcz9Ia46dXkiZN(p|)1`Z@uMhUvhswe#74V{V4N=O*2`p<;=>m zGP|U*ECS^t@}+sb;ZoOJKmC_89l?YsfVQ|5{ixMcK}%b)Q+&#rgvNRD#Np!}if1f8 z_iaif)8=w3E0rlS)N`mJ?c@e$JslUh4*TnN51bsj4?9wl0i$3M_#PSFUFiCjjg$#` zz#$JoEbX}s=B2c+ry#~UV^0siwKSrN(84-e=`zO(k31)qmvU{;U{@PBcfr>NjruPN zzT3O1eD_|J1&p|CJ$?b5_QPi61*bU_K+Kleo%!9Sm|9TM z?>w^3vgL8{*#=i^>70Q3WoGc~avnfXnMH6mzYHD8+?)V|@BD4(9l^@*AQy^M%3QFN zcIC;^(u4~8$+Q_2P#><4p~{r_&|jonOe)<_$tFB{3I%EgnY#iGR!hU*b#_}efr#z~ zuRpaoIBej+g)GaD`mlJahWpk61b9FFe&h}QP?pznJ?5j=WT6K^+#|aMkT+rNZh*d2 zpCeH=mKHW$wfAo$9=4-~6ebquLt$BP03OtVas;X06Zh`>+Vo^s&MYlJVLvUP0b;#A z8Z~4LpffQyo2IgmMQF#bziT6xiZ_HdR6^=d~DP%C^^kao$5f!SBk$(A0coGi@uZ{CKw=6 zQrhRT_Mw2-^yODF$40J@F*JLjKQ9axDri;Ce6rx}78C_xSU}B=>Wv^Dn@Z0%Xi4VL z&akSzz|7NplZduP1j*MIGiDCU)$$qT} z!%`p_G_@qwHv6dQk~-qdo!!*1)ZwcJ*`w1>vhU000oSb)yt*LT=nD?IaFIu? zDA>9?2mKJ_wc@P(gLT*3Bx~+j`d;X=i~fjHmp#l9l^QKaJ{7i?N40Ndb{_I2LCOPpBg$H?x`EkD64(3QTqic^6%Q_ zg}g#lY$=0HUyk>q5;F|+2U_FYH|jf(f)TDk2EqY?K-XC4$sg?3tfzQXlkkH*Hd)!^ z^G+hzFJ15fmec(AC-(Usv@d#n@Dxs&tyI`*RuzuLP_#8RI^;4JqKp@aylQVN(<;V< zXMd59*0Y_hbRy-{_{Il60h|#GfIE4*J=8j?AwsW_Y-}HW)uZ9@Tm0M}>X;f|!1~{B zlL@1p^h_Jmvw6RDndlDZ5v+`K`2}a)(fSyfTc~4vvHio$z)r?!(p`N2{>7BOu)Fa% zVEce@oYrL}ju9c2*uQq|b<~^k!5w2&H9cmSD_N~P9J8|fcu{Uht?N1KfOg6+$RGyj z-FsYfPlG{qO!5&hzdF^V2vALI!qArgYL&H-@w^s(0<}B9k^mY^djZ@a^sG&}r62kY*|+hPSK5n4*f8dI1sx$uKN=N*x{X_|1na zFCN?R96ZgY?QVaC_lUK4_Tf<#GPNcMROi*$mlb{1EUd?2R-iidSWI~CtLYf|nzdDrHLFV=?HJN< zpHys57>9C{dP+Ggb@^(CZdvK^c`(9MRwEH>x})KJrzAQkEbX=DaS&j0X2ltEXM`6Q zQd0AIyTMI6AM3JSK3H+vCm(A|A5Zz2D&`qxr&-Ma9bPf3x#$>D)x8eaB<^0?SDs)1 zg^^+Tu?WH9i?hZA=VRutMZRbR%b~pWWft0Q9vr3bugfJzT=yfp zj$P}hH?yu5pFOe3w}g_k7=C4+TuE!9mWy}73djpw6j~QRVK}g#0O|9u1%;YNSlQnN ztlq?gtv4G09qy>w_1{YRtg^G2LM8sq9PcO1yxE#LvR^O)?TNi!NgpoadDqPER{Z(9 zKi&N?F!sDJ%d_}#}_gn_W{ea}|Crgr%;x#};WFjo~P^Ly}z@a4$XWg{TF zk~l!#h1}ntoe_P$(;?mz<(z%sD7#`TCHXiE9TcGSxr1w81yp>EuaSjnF!{;zb@&~N z<)_Ii-`@BBoK06r_Bm8_V>d<@N|3joA(YkDbe>Z(q<7$sr-tv9eunNK~?-ML*FKY2;#eq{S5leLV&PgG?jJEos;MeYXK|MK@l=AH1D;J37$7;~o)pvAJL@j$ygOAL*mSH2bP0p)nzXX@Je<3%3DnS@mwIIL^9AO%MZUcsu}Qm+aaFvV6QM;d=1QggPly( z46e5)9A&jv`OF{IW<`!M^)s0P&I3JYra0xgG&Bs>L!(O`=NO=)7Ol~&ZLSsi{=?pe z?d9eapquOgle(688<2e8f2{j#AH203mkO#r6p|elutjDe+8T{L(45#n=!B^3p}v?HtBwp(y+cp8<-;k6O#M6h1EXg zs=eAt(i4T!X6$}d@^D$$+EutA8o6C#_V%_iW6~(QJ^Imi2{fqt)HzJ4zqv18xT*SD z0hcp0)6}yHmQes8L;#kmksM7`4D;jX`PA?$L9B1(2|I=DEnA1$_J%6djTm+O`%+KB z>)GNGO1dTJdRIYg-muSBiu^Ms&BRBh&y`<5NM>D%L;8V@>6zAuRIKwRFRsM`X`aRA zYl_L?GKVp$E{qWNz@|a^l2C_sxes&5m}C>#{MueFt1RqpGgoEKCKH<KfOqcK9l_H&7D0 zG=P=>?VFod15?;t{t{$@+oFl|7GonyOUI%5l#rQ?7ZvZQl;d7<)w)?#7 zfrae!12J%7A+Le1C`~FHTr!{BhTvTEzjrdq)jPE3TloS*}1jfvQ9@VYHd}X zNuQ}zyap}_Z(uC385;WD*3N0y%)^wFOR@~1q%QQqN9J9{l>pu(G-yT1+qdkSVYsav zv&XkFn{cRGH|aXt`VR%Z_|DYu6FawWpNDe0zZ(;5yDn~tMrKxI6D*0-u|Bw-F#w-(BP3TJc*d4Z)NF2I z&>aAg9jvgsh5*sqMgYhzB;P_V(F< zmkgHQti`+Z%XDpyaCE#DzaNp|qQH!2zmqBn&F;AB=mbMJ^1z3I37d;-CVdm0?LecERD6B#%HM?09#>TkZ+B4`^0(hdX z$y?+uE{Kkz+)pu;^jrwO|f{Y0-ZVd6$q(KOWI)|IqGPQ z4xe6%#O`OtY&8ZTGCb%pSTinf4PQO!6(ACE$C)qEO!S`?eav_>4>Talr{ow2l(-zL zUG>pU2Asxj&tKqw_|Rxy3uH|qvp-rtn+uWnhriKDiimPayh zpaZ%p8sohBKrO@=Xy`hyk?`onav*zGJcDxl{dr^tdgja&xD(a%mTMsW9LLh+9~OKC zSl};FjVXE7UWf~xtS5oa5dyKT-JQRAQU?ggHZb^u`s&G#o~0FvW&m&X>Z_$+PiP*$Cj*F27J>@9~1( zV(ll$#IV=!mN?~Hd3iO#j2-FYYfpypLZ1<0P-P%Ir%#^lIUjy%t9xq+rtm{_MtD$#G6Q(r z(YcI#kJgOoGbcT(CpWx=L?m8A9VqH5xA|{<3S>#tVbnLd;z=^=K9y*&eaVC{e)aGN-Qr1{#mcS2S z@|vG40UaK zuAVp9STNboygW{!uiA~UaIAvH26T1Jc^{IjjLVJw6D->d2qTOzlM{})l$99>rz>|-14ZQR&w z?6gT5+qTg-jcuo~(b%?a+qSKD`n~nmTPykJ(G`ctKVySTK=+^)$g}pJUA-JugZU`$?bR;-J`F^vEb^%l~jR z`ofpV{?!9wT8{&y|8}y{cutaOG*h2Ge4l723r4hL09Xe-+!|uoJwDNA^3yy+{nX#X zk{L)(74;hF^7A(RHcT>6YCKb~h1aG_5AEtXO8cA!=-OZc1E1Cz-h0oSy)yrPs(bvC z2N`KE-SrTIN9xAMo80p=?6ij%a}(fVKgC2wo&mJxz|#8X0Jz@Q z1^tEa5gU&bsUrCrxU6xs+!O=M;KiUXn==3sJ}jD%4J0NO6UFGympj#^;fPS(TX5-X zZLgON57$c-AKrJV_2`j@tva#g(2r8p5MT_Kd|9NCh?tx?KKJBYY-P}pJg&k?)~JDI z(a3wg%p&y>_z`FX1X%!W@20#qQBLt8DYKK%0|3Z5^$3$`)d+N&~9x2{eO*`1=?^tMZ+dd6*>SgLD4;p1wR#p~o z=2jM{CCY&Br{3J6Y`$3ODwJ}#EEq$;8V)Ts+Q42XwavuSOHv@(f7F_dBJ*GeU2bUH z-O0&m{bJ(9r43tMeXX^_6LaIEZ>P1z9ForJOiMBz4K8OKee=&xJTR>dJQL3@dR?JL z*w1j?eHfWS^T`KsjP5+-ZnV{1l*ABze^7D>5uUH=zD;X3!!CS2xnyO}D&|f7{rMz# z%Z*)UEcU5p(C)8(jrwz~h=7t3gb&f36djOxf`UHoZBPj4DMELMDOEyP$o4G9}R(j%kZeA5tY5Y;)y6d@o>dFU+C-Ix8D2+bKGDkX>a+p(I># zS;ywYZO$oAuhZ z4DE0idh>kU0Zbb<0b<@(h6wEzN-Uv@tRRl{1Y+C1p9pvCXLUF!uK)MR%tGqoVpA9$ zIdE*nKl{}ljrA1;b=PRw-W?0!?7S6inJ@YHPy5H4RDL6re+Ky=gx$q|iP zAVvErF+`A5dPo*?j1oyBI6e|%9IG4gssl~rmTb8OTys#V16J)To)N!h|D3$ z+*lc`mTV;njNf(Hm(1+-Whr2}3uofcw;YUpH4+h94=rw6$aQ`5fR$LPbmg{S zx5{qq7WPnJc^CNT;P=_2dBt)WR#F5xQHobUULtO`2IY$734|PDc8P{{IId{fX(o{4epq2zk-){=1d{8td|*-Y-uM6mP;Ycr+C6|8Dwi zn4u0)UbJ z;e(D?(VdYpS7EVuzglrQt8#Y;xU8ThG?~pX4`R8tB*W{I=)F{84a4U_z>nq77t(!c zu6t*3N`aYdt=ZGZr2A)c-wZY(L9d3Ele|`{JgJnRF3Yp2mtZU#1-kZnV>o0kSfXHZ z@Kpws&XUe3a1$9BzWAh6{*Y5i3MJONHVo*;WwHY%S`s?T9R^@743OYT0r3*id6WWz zNiwu0j3vXB(e*=qT`~6hFNAEvfju>!hEGMlk8GBkr~n!pELdVmVdX#|xg~5?F3KiR zG@}1!3c_v8=3UEBiQyuvVC!7}DbwB7r-k%sSH36rbpJRXb z17VA&Omt6JPEA_VM;5OxoKh%;Do!=dg$!uxx zEq;eEr|<{W2WkvA*ag_wlxnAJx8XOt`%)?n{Tvk{(h=qbO$Yjrt6y^5e+7tw@fG~|Dqu)SvOXD zpCXye+TCFe?8kDugN)-Yfwx=+b{UA=lx=~CiDpIx%RdqlM}c|I2To#?1t5_D+gNmb9u#SjiLj6v z75uItCsV4VoO-eV5onYWoWGo59{tjRKUpi5)NZ^zezA0Qu=~9@w3xCmn@F58xY(cT z_rA=TJ7pJG9XC71W#}7V+W;rT?2B-g*&aUefzbu|mE+Yrf63%ddtxcrEVk%eBTy^L zBNbb{>0pmNl8m@M29lf%+>=KNoJvTU0pzM#$n%hIXY5-Ad4 zP#2a+O+qmS!n2$oxR58|nIpDK>anaZxa2*^QtXTBc5HM6IjNuA%MDFT!17wE?LvHR zU{3N^<=hHSjz=!cc?j$&(+_U(UKH<=!pVzK1{Yiq3h56E!S4YhiS&kZ{W-z--oTD( zES2uPHqTG|MW@e{QI`=1NM&|GKMt!z7pA;8)$z)TDT~D!v4}x%Ik%f(#>`)s24U7F zhGZ#!5P^;rZ+|8jjgphV_<lQAEw~>l<184jOiblr3NY|W* zj4Q!Ek;e)EoED6;Pi|qK$aB#R1`ga`QzAXf2g+qAuBT!A!iP*}@t@@XZRv|U46ju`^VxMHWTx&g$PN!Kmlq0G zZoYi=dO)bGp6V^^)9JxW%yUx{XY_6;3XD~%*es`_*nRj;LG2n#OM*M58aF+d=1OqY z)2~~*7>xuIFB{ypWG_T5h(HxHOHng(|2b{bbj^PADy-%v1_Y0`_q zUoBcGmm0H(#DO>M=z)*|E&=*~rLEEYHl$+(1kkNG5zPw2LUWcoV1stZr;8PvJi3 zH2VrPoTr!P39uo_#HN`bjTi^>$jO*Zo_~y|vBgZ0R0lhARI1S>jgg1rkB1Z&L-`7} z^6^`pJE7q5b&C?(7_XVEm|9!)5W@W!6Pv;#!E{Ou=rbAH?GCsBW$g6=LpLkujspkt ztHF(ms$%yHb)n|{=B&21e(MG{QY+KUBz!M4A2B%WOkM8WMSPh0>4oNEauUmvTrPoZ zl>F>>1P))g{lOlK+wzYzDls4`wEK}S!bai`BHUBO0|4-I})Y9|b z>>1s$vc9SkmXIgI`7v|o#uInK;*aS9IwGT2NpokboVIf25~euy12`h-gX=(M?asVM|pHM1RVcE45Qo;yYPCr%MQ>A-dWjW)C*BXK}kV| zsBoiDI+Zcd=wOUO#6-@B5wzV_hnqbXK`W+8YfP`klX=3>;Z3z8npvGe%!_?3g0kal zZ>*p$H%4>e*(+h=>0MIpBb#KGJ>c{t0tuw*G;SLhL}M9)?L|35E`^?XhoorsSc&me znUa;BdaW0itFZ^Q4l`USIxF7gG4)aM{z#nhu?5XhSCcVPrmxZ~!p>cbz_hX*w=A|e zakaS<$#8w58>Z0$QdTv~bffJS&$K*-W4hbTecS878ETImSR~H7Tu)8o`}7Ux!Km4; zp^+~0F{LdoxQR5k-^bH4wqo<~VxtlFhx-}tJpo7f%8u|+066ymi5PQaIC?nGgTT!*QQ5>Rx=HlHIO zKiB|;N(l|`SGZIaA7&LfJw=;of-hDoa@iBfI+v)r--K`;NsT25Bt+Di%bTAokp^>` zSbj<@QKqy}v_s*Toa?>xqfhTB;~>*iBYpm8q9~n=b;3o7KRbZeu*~pf6=kuz_^CT4`cUm+Rp>KxKsIGZQZz|q) zX1CYv>oDb%$5ZB8ONfu0+MiU?$tp&`PF*iJy3EK>IxV5LQVJsRYTHyS?355Ns71w# z(0W1GwDyOz#b9E?ZP0S2dfM-kdS0-h2Nb9TZuex7igQ_%Q(mjXvAw&$ns}}{wZaLQN<||_Ygzg)cm4Rc zUOIlKMe%>+tT;%YU+VoUn##56{cqz9cj5ZkPXrUl_Q%pjM~ilvE~YxFUOni}vIpR! zNkd9+6$###@JB~7!chpCW_OTWL?#mJ<7e zF(QhQkgvmb-C8km$>UMhZ(K9vkw;29UOWrhb_5-*Co6{e1;QQ+lwuf7JvA=Z?EHG8 zg=vL9n1EIGG{bPN@4o&MDNup%0?4CJ^9u$w@&4>s{SM*8{hd^ zIeknBpTC%7a+Znqe>}3Te!OWUCGsDQth!-^*mFGYX*FDrv{;jo(B-QTBU6RI^IUs5 z+pSfT^$zs^7>kNAv^wB_?oO>D|9iyzo)Kt%-*JOv^@mIk*UN86XuD9Xc>r6*t13gl zZFYGWdP)@96FFW~;`P8KhgJPtMPR~M0Yy$9--({nhVQCs?cgRt#31wY$JwHrH^cp> zojc*RCLXeXt4yQ3DXEuIlxrK0>GiCEU+;(VZ^fw8G_(m4{uaN}a0S@r_vZ`t!t$b% zo2e1h*G*+(>5R!TWB(rOohQ)?lj%myvT1&CkYRGz=aZI+o-XT}>qJ6Ifycknyzb#@h z{iN5>Sg~^2>bLVII}92188w)e^%<88mr8gIuWPi$B+S<<)c2E)0#Y?nP;>ZhMHD*QT}z=PlMp%(T9_wzMP}%UH4d;3^Hs|aSAaB|I(Kv z$EoP#!0I4kpg<$c{ScFWbUO1%I&P{ns@(%0b|g|(S#HgYS|Gv5y6s+G#LxsKv}&3> zE=KhHjsC{?mR1TKC6@H+lD9!&W3l&Grv9+_PzsL?xPIUc89< zt2-U??D_J~w{|+Hwlm5ufgdPg)}-*ctS}OmhyIkI7)V)xz60vKQOD4Q;*`(L;BP%# zSyk*#A82H-KwcyuAn@c{Y!-87ycAKBW$f>h{5X7 zJ&Di9%jgU2Y;kCx!{lW4YEby7mIc2nAdbi9@lo;cgpQeS9c;7&a1%a4V$W?kiaQ9` zQZNxj0oAtG!5CIzyqx^HV`qu&90hF>Z`%Yb-d|}@&ug-RYpy4<^~6w_=8nkTWu3&Q z2Ulk?(x0)t(*gF$>;}wi7A^_{*urF32-yxC!!Uk$%C+AUj65G^R+`@3P%B#+Ni7c) znL%RQJCcE8O|qF+D%dF!5AxN|My*ngycmU5-1gB@&j{KYG$=Vx?muB5=lvD!_O*mG z$5q2W(P*8O*L_%YXT%O&+Lsf#oeS40CCb%rNiCmH!$H5c5my>WI4~cb@E_e?C<+V0 zKf^z@0YPpoktkYI@n2C2#JJ22gzzAU3B%Cd1pm#{Oi*V9)c1g&o2X#QJF90;$@0-1 z_blUlgwWGrWnpOikn13wT_40k9yMUjdDkN?r}+Lp%stC4VgoXeC`nydpK;pOLI?tLgKr?W<>?F2#pn-O6;^-@PIw>pcn0LxK{C0*Oc~KU1wd&RZ@EU2WMx zbd7f)ml!Xj*iPO685G@S@A%ijq|K5Is>(l?n9i=h(@ zF~ihg*N}j_iIW#$9x!f&awlC!xPctk>w5DJbQv{%7p^WcSVEfTtUWvPOqDYJ!9QMtt~UAk~l3j^=5%uZ+gy=O1JOO(`{bEH++?ZnF`RjI zQB=afd`t>ELni<$l|iM6DyKvMkn7Tw+CO!f*7=RMa0F3_y^kE^QG{dD(DtCjR6pKP zR;M6ZF-@mmTvS8J7y}ZEIJJ1ZzwRdc8yYDHeQUUCUJe0c>p63i&gz*0|QLxu7fCTMabHp zhK!)RwVnLpdcZxTY^c_s9Q#9DpNFl4EJyS4)Xd~^JP6m+-WmT%t;rLUUCZ(7)h`qP z$KF$7{fF{9^FJp=XgE9Kvi{yZ^0I%+Kd>K&P>DI3)p^Q@N0YGA#|w%Yq%f5M>Q1uK zc2{A!rMeHaj@O-yrCKZY_s)>rt=u-TDfhemWH$Npri2ART-%?wO%#GLsW! zEJdtj$5n*TV&`zkjnsaOri5OH`To=DUE>nnO`p%--Um#~BPj z#(o$|lBxCMr3M2d@Oa8(D5>)kpc9-X$ju+zBMZtyWjmdRFPn#s1rqM~rxp4q4&k02 zS~ssKfAw60nhwoTJZ=ej9Ov3JK4)PrnG)ZHFZCXT=Q{M*0Zjl1$tr5ahZrdMZ)>Bt zzZU<)HY(?mbt*9icfQ5I-oyIxT&>cC4?lq?k1L$~o=EzZ0W_jrN(;8#D0}y~<)joN zOI9nY7OAN!h$>Ty7;nC^!g7y08#-P3%ryY2n&Eb)Wqyp)Go0@6-e=wZHnVZHn)?u- zWW;wC&a`N$9IUSnnU!6X+&zcudfd0bsj2PQO<%6th1U+GIY}IDgfLE?n5+;35y#X- zK6#}c*b_dZ?L|%P-xg#v3tl2_6s}L@0BH5PGv^Fo^#|?THq%;JRALyI*CN#xUPJJA zuwt z=>3{!j`gnKwM~F=kTAnDxklKSsReyjHU*^<(&6;|Ow#ehl#ihK1XESh)Q~D3Qz$WbuVok+X9t zDA;mLG>8mnX^-!sKI=c{d642E-Y%Z+(1H1!UzM+vSk>xs^@?d%%T^L#Kb{uav;GEo z(N>o!udw00jJVASCd_?rH-`T)@LlE&QN`-}j{ugry1UkzV*_>dJ5j3YG^(VY`2MrV zz`viY8&48nZ?iuJx~4C_LBkHvUyvmiEj zCMMT>T2qL;XH6RQQ15l4mM0%2{x#csNsfLG9&4%l*iFMd|0!ci(?~f2@EOuQ!Te z8ViTaTpH$dDxf8kbVfLmRfFye8g8*1ISp@vl`u1NJb4~9QrjObGC^Yj`)ikC5C>{F zW!nynIR7@mFeGI{Q|>`QgYkY4a1_ACdMDF1Ofm< zG-TGVQ>|Pn1!zZ(Q#L%NwU62+UOm)_kWWA^-oD0GY&3TqLQ-iuc6sSRMxRykf5>7T zWHzn=m_s4Sq=lOL>=0eXYxGUd+|wMdT49$Sv4a4UDRmyIQu8_q(HU#b<7>l}d9AD@Q!m z09*K|jtl?13=i$DSAww|#}YC!j%zCiHksxf0}vV*?3>4P4UjZi!T}z!_Q%*~D!^Q* zW9itu=;ZZo_gU~u1J>-gM-YgYxMgLn+x5oe>Q=%gCM7LvDAK7WPEqL(yK-r^n5cg? z#ZObEC-U4FBohQ6N5t@(;i-))ZW|a>s+EC|?HbO$!Kjh*mU*?Sj+I$!Yrca==t(BM zyoRmeV^mI^MJ>QUnoaq_yOJbx8(^61Mv$^{#;6A2mn`K-&~uEVV>)p!U*(Zg9Hu4& zeKIq5bnDJw1i`^j(bG}b7&=9T?-iy=uGw`{GwO~0#L&ktz*^*j7b9lnlyion7%5`d zgUs?5qRa-1UB0_Z;F`~ZKlSf0VCTg6m(D{GGkX^7G*dXRh~?P@l!RQ4ONv%s(dn>Z zFB@2M0>Am$R4!JMasHC#3+r7SN-AY~o~IMbi%b=}+2U0P-%*(;Dpn8bk^7p-@FBEN zMJ9HfR0vX=?MX?32w<~mr$~6Dio(uR}Y`PPkczFF&#T8-meg9{z~fJ z2J02LHv*`vT@SWIGLtKhnb_I`XQEQ`Vzs@Fs@|q86Am(IFPCclE?z=9d*;xNh(R67 zBA!|zUQzKB`A)!9%5VzT+Lkr%&shH@L&IADn{eGCPM}Zv?j)j~Ip+LG&E%AN-UKBM zK;mf0w!`&neY9!m8zitqtW@9zpE=Jfh`|@Ms!6x)kH`R&t)Wx#t$nOkiQsrzKs?sp zlG&iXPhU!U03)$<@7(CS>bN(F0Vz|F8r168!18jut|2i`agJ=u0n0FZ>zdh=Hn5eJ z9Wz?1d@1@vW;oG?RzpI-8@P}XA8B~Hnr+`QT=>UOakBTf&{svWytYh~K0(F3q~XkB z%Bc4dGeS{>l}E{7h=`aX+1^I5+>0lJaLxU++qdrSX89 zozX6Ou-BDqq%LG%>_VS-U5tyE3Wa;#L7msYEr!P`?ac)kkZ)G=1dREDLfIZ@#Q+>?+x#P z1@+9dB!*Jsll|{brF4hCas$=ea*Gk>G!`%{7c%YWKOU`s*85P5{b#IXxIL)4$~h+l zpg-^G>z0uM0*fyr8c7YL9EgRR5UC*e!0MYr5oE^y+!D7v*It+!Jn}y;mK@0_mw$w} z1)*TV{TMiSdPpUdRd&_?m7PN^SEUByH)^$@HQrFsRx3k+hN7f@%J%-)iJHW2Uwuw} z-=38}R>s}^bp!*(kMH2NB%C1Gk5y7CAP(eh)FWcxvi0=Sw1hrif93^h_4&jdsAYBQ z@m@;fb-_AXs7m#DWwfx*?*8Z%?LaSUTs5#AJF%5s6}4IGt`tiYz3bx($~;cl19O>E z=xC2}3T9P;e{raN@w^Q3K35Dk<5O#g6Xuwl?8(iGU+eQZwbofc45R%pRJ-RulKR)pw&*_0|;oZdd;aeUl~x_{9eo%H0~QYPqBH*4Zm#s9(+OA)e{3i@;y5(J<$T<{8b7}!_vppl7fYbla(#z&T!JRj*iT+O4a}RTL8r_HyBkrf`9`C}n~pLHRwpd!i&LRa$)LEw5@l zTE|{A37uhRORSr;~ zh&L@R7lU97siEJM>XeQQFqoLvZc!2J1f=m06M)FVP3x|L<(c$qi<;WfVgEBNY+$w{ zG?LjrHPqYG0Mf|MFpgRRpkf)z%$zAx{X{<=PujnaGEmx6SXeylGi`V7b!*1A)_jvE zNRy85wjMrI@CVX%tnVN;C9k5677O9(xTWOrB+SOPves9Zo%>azLaV=V6&;-$3|5@R z)Y?K+PDu;p2(`nJ4$x!vMS27|aApEH#9F=tm--2@`Zkm19kL!aM)`{+ZpX(7;_NK@ z{W3Xko`0bYhunf>tf74W{)~H`DosXMEM`{Vtqd)c)$`_6e_dNUb18n?5CN{!7M^#P z>3o|7%2R8)Hlc(j#yHi@FOMog3zO3$)_8%4EHYVS=%a#F1++#~j%h-QAU-=VE*G>U zNLnx$Y2VsJ7l2zSZ!%@N`c;MQSd7`J)tmL$Qc$c;5jE)m4ikQkWEx^VE6NbF3K4}3(w&XoTP~eu{ zUjG+`#O+m(RDK{c#D1ISRO~3e+zrx3!77RzF6FEWL;`xjz5V@cV3!@L{MazBq*%y5 z`^o5;7VmAO@0Sk1-3QS0Jk4u78C`T4V6c0br@KSTfxIg6 zE;Jg+v0XF3yuWP|!>FG&|7pQ*Vh9T}h>jCqtpEigi<4mB?9opfb!_jYPPP$cv?@Nqb8h1LPoQ3@9>UvVjSrsqQow!p zi|4(*pOV8yPa&$F>YQaNbNq0|y%p$Z(aKmEdD5o@hi@u6L_MG|eRqw9$6(Up5 zfK9XtC{7I<9S>TJ^=do*Uh}0 zvsY}(bTozu+nYqkq)3+bNQbY9q>%*5ajLoRT<5=@RAsW5otmya$UD!@vsVECXDMZ; zbNeq&!~;oGi{)%mF`({lcijtUz2CJ_ZPtyn4&vxfma;THuiEC;kmoW;ctbr>nCQny zUCd@6%s>bDyXpfh-4KZ>D=;PDuaooc)8}=@2NZfrJtmSm!E~H$FU^pEHX!Wl&FBqN z-=TdYAa7XjPr++oY(<t{nO$q?hemGh|CXdfn5=0Yv zzH-u8wc%mMM!w~0U~C&WMo2?Tv7RkUjN>x$UV8YDis|uQ)J)HCEkntiZ4OoU0tBIY znF#6%LW!nhYr`?-bcGm73ENI-vI2+2J{Fen)=x)d02nhYC_u->ow1P1_;bQam)}Ss)OgeZck-s^@{$RY*oayH9V=d&NT~xKL>M)*_ zK9)3w_d$O&5;M%iXh~pvDKUo0p2^5!Bdf`sUoZ-n48&nn*J=o;DOLv4n*8H`vDAh- zq*Ds=i(l?S{FM353NE8DK;QNo zU+VzU`yP#%q=h@ekim7`Y|pPj5zL;6CSO1!BwKIIS@tIg?wLnRrzg_!ixrApqNb?j zejy`1tP~X0(7Do2{Pt6ZrpX#5SOr5&Sl`gO|hAZmx?C2ldp$!f+Mz za!yJjwei#6DJt=^wvOO;korA(*;qw~5(7I$7=Tq4m6u&yZ<#XVR3%CAJe?4-oP}34 z=PLw3bjebd!VU_D?Oy}H#q{j-ycwxLEGexqCW$@s(}!GH=fVt#?~61i!C!fT@ikA8+u`NNZ7? z$`+Pl(gny0Ysn5;Cd)U!JE^!$W@B0h0E!gV%<%gs52(wg4z7aG0EW0@o7<^hGQp% za8j{3Xn111psoE_)vyZ>Q?$Pp8W49m#!j6_&Xd5(LJZ`SkcNaGA0xBG_-C2+N0^7#3*@|f2Y$btjzSC5?WcwH zouCG7iRwtPWYHMX5J2p3@M>>7vp6ehCd`UGR|i5Cv8ztwP>B609^RvW%wq&B71wvv zhnup@*T5)t8~&lCKgc2?bnTz)H6IqFV~t`5Bq=y;Z~#RQz=inx78d@D4Yy=8C+5@J zeTkyLy8LB0^YXaDy+Qd6f8DPlA4MVjU7uGhK@86oCWK@{Ku#!&62Im2QUOPFLAB77=3CyOO2sO{H0wS)G1~ zBUiTGVw(MKs8AXOK?QhL*r!yi#Cns7@*@Y+)B$p zK06AJ&N1aaqr^M8dr-EY6At?s9My;R_q!Qu>fld_DSSt60zd)5g8CND?R5nrw0cat z-wAcW@3CXz#OR*kIt0Cw1j!jL&=rf@A8Gq$lz(3+#@L<=Vqn?N(Exh&9=7;uOYaQ8 z&`yoqw{lrW(2yKMT5ZhGhlksKLxn4;%P34|Qc8^ww9p>eke|U`RIhcq=mwT4J(ZAAX|_U7U2@WGo*wJHx}`?T zXFdekj**2O*aM_CtrlY{pqUZH z%2^2GN85~iA>7-^iF0n`{fY)xZMEPmL^NwLX;kT7b)XS_{_kA;h`Gco)=ZZzTiY+{Wwmd zq~-okq&K>_vf|qKv)sCE0i8&2>ztnTrceaf@V1kSf_srorP?qS!z&k$Q%+eSi&Wgq zjg7sDlK>0TW3r`+M-3Pw{|4 zAqu&4gK%@~&xz|xF0x)7j?=(=`itu`|431})gi2zS%|;tKo$Bp)3~M7w}KB+18}(C z%aj|Jp8yqumLmmrs`8|4D;;sj>Q6w>JIvl5R#1NJj}mZugvhkC^X%MGQ0#)Eg{OXJ zHz1J9*M;a#Sa$3sz)SS(2qhmx;Sj~rq03{-H(8@y06t3M^~SE@bl!t*aB=Od?D_iT zY`q;9=5FEhhOYHH>0g;}>nUxZAIq|zy^;mgs8@+zZQ~W54!Awj3c1hge%WX+oXrb0 zb!F)ns}GFMYrg^J!NEH5?Y%%q4oiJ`^|is4HH!Cza6E&RwHVb|N$F{T<^sc_!G4DI z^Nysn(D_!aAn$>twbc&r{^7l|KPSJOe|%dm9xkPro2yX!K)m>lhUZkW&4lpm~d-E&Tv355Ezh2h&um3~pRZD%|bX zSXq8@e<3iI`r;*iz=RG$eqUl?UWs6&a5M zR3-Z|5$!LJAqU#|0K&Oq(-@21!|c$I7bw99%IQ`bIeXym21H*n(WJ@{eByk+lbf|N zV?FNkIi{CtU&4F1DyMsB!{*)RWX({-)gPbqS+tqg5@u+SeF%^J*SIY>`S-0@)1?27n0dfY~6)*QqNOO!2A~k`5Ft7|1~BB<_B%rSmLPo&=W|M?SAiN)S0f_7B?KOTBE<)Av>>R*$lW3)pj5C)C>3k1He)Y?j{! zM6UOU_vJVI+#i&AlYsJJUT$>v?*1G!T`ntU_VDabhJJYewWOH31&*(B z{9lK!tfzoDc2Dna^9Hv2T@s76^#s14{jZO1v{zfZ?_8$kRx#q|U%(~?C@u^b9W*75 z8c%?C))t56m@e4AtV6!O?KP;qEGaLqo)s25@iYvSNYsGW=J4<)3MAx7b1Nt+_3hkk z!RHbHQf}M%Q7S!7ulzssuRfPZ8UO<}L)W6}G_tmfLf8)&#~OEAYlg-pdkkms=+t5b zVk51{mFjwQ@!Q5jyA$wV{wb5#tX71D9Sy%X08CjycFK3cci5f4hD!3hSVnz_kX#Cb z2$>_sQVb%;LSfH7Dp~Gn*J6ZXa`j!S(riy1^oSs5i*5EcSw)=NMk=k2v|=lZ;0XfJ z<6h3*JY%QR&OQ41VlDnN8E6{=y1Ewr{HsZ6EB{}4{YpykF3Yx78vVf!>qquKMP@cCIX>c#IsR` zK^Sc);~7*1$Q?W;Kxe1V>~w)!SJ$ARt@NE}G)Ps3X^=Tr6ltbyg-cdlx<&M(M>E0b zS_H}9^$;Ck!NNyt74`qQyZl#n`jiwVvaiMO38@V(vZv#a0)|Y1m6vdSM^!BJOYA^l z6A)pFg-6YGPjQ)AT4xv6^OeR_18S_*w9?95r-#J&ox7u!zkqrYvp?L>(i$bVnng@P zy4R8|ml6TM-V_xV>?%ur*IpzjE9}y1@8f%+{>f}Vo6obd$tf%>mdW7)lZ_QQqH%>6 zU1l0m${XNh*e3XY^OIDwIJAioTfElaBcyJ@G=V zmOX0VUe$lww6fiDX1{CeiX|P5gt8QqE`={r-HBydHi#-?#X`ckt=+OQ>zvUHDrj%+ zIea+pS7uYIBque9km$lo^e1Bj&mEhpqK7BLB0hY;FtzC4SoUscA^`eT!Kjz`>yfr_ zgi;7=NEGC}gpP5LEee=7P-c){G7v?*+bChd1>z}}1bn>jEi@kExbE*YEH*t5ooU-F zMtajqsH+PFgs+H6H$LS@bHjG!65HlV%t9q46n$1R8y?C-6w?;F(v=b91=82Z1Np%Bo% z+5Ujo4S1AxuNziUvcuG#y{l(HwEta*n2L!&0rllFN^#Ei?(D&?u(Voq038kn4t!Il z(*`)3<6B#jEok!TE)pWt28?iW?b5+VV3JM@zG~I>3A#Cg-`4Ulj)k>opr0RvbTu1h zBdfrlH`f7OfGW6Yw7Jz~{Ho{84F(1PFGMNwn_O8J4tCJKUjqRPM5_y5$kiK*kA|G$ zx=uq#_gv=WKEXFRd7msAp-#8X37|Nb11|m(bP0?%0C%A`VlIY$vIdX?z1W1b!7&vr ztod_(b-;G=OY93!2V#^j^Wk6|Rr%$}7Vg5jZZI)BhI~wj|gPV{T!@xl`1Hi@sP^5FX=cR<#8sa(OlIK>bh@8Us zeLcoWeLV0&Z2Ca;%2oG&gZ3lDE(A{i7xr6w>>*;y0GI-aTZ9dEFfimau^)nplYe0& z4bk$M0Uu^}xY*9qk#l=j;}l7y2A%4tF;d`Qhj?htHsa&e6GZ8|Aq(pJ5hu09@w1V3 zpa7bYVio}h;UZg7&-(z2DLxn&;4{we%r%wn%<^P_5cDD%VMb|*XnKlkJUR|b`o{LT zX33vc3}pCaiHJmkc^NNZ92P_s>YG!HS5&$+1eEo26scyW=AX7ayJQ8Sk0(hz*#UAX zNb>7*7JJG+hQm9^8y(5#fduXLb1W(PNo8D0yue?U0C?A25DRlEAn_yZAJA`5ms9$q z?99!27Xf_lkKw^P1|XkO&{7c9GO&*dM1Y5ajLy{qzL{PLm{ecqLitFM{sPz%&Zcvx zZQ!6A#y@*#M-Bvi?T{xSF!Xm5WQ3$h&BUGKwkp^cc82>+-d}>Z1pj$U55I^;e0(te zh~P&;hXw1@Qfi%vNmhZE6vibWMSz3`K7vM1EgQ+UYO*Jb_(C`l{R<3iRjIE9KiM_a zhtre`yc_;ME2y^OH=_;-ADKY;E*%r3A=xG%I}u;*g$!PkJZDrY?U){sc&#%6sRR3U&i9>G;6@f+d^A zcz^wJ_3u)Gy-?n$Q+Dq!-2Ic8pODo4yX)2M!BGv!-K;ve6m-DS30&~oYo|nKly_`) z&SgR3*E6tAcxeHIXhhZj{d3y6i%$nQKP zIsAZL_R#^00z!BKJoH;@-uqUq?SBCfbXK~;5jEDvwS`I1os6dS#rk(^1(c=`{5p`@ zPT1JZFRr|A!)7~Rczr-nmtv9|(39Zvh||D;pmX5EWh*`EKv@3s?fv`QxEU^t^ZsX2 z$O_0BFvNnZI^aQlzeW-+Laid<@!;RQrT0}eYHh7`AI_I!BPB+Lm&i#deugh&j66f?g}ibbpEHgYyW3@|KlGv z+vGZ-#ay!1^*Ao64#M06c3G& zY5 ztZT_rFj=pfYTd{#&F2Xg*sK|F_gE8YiZsLpsVS4S)YN`j
@pmeEpF%@Cg%SyTe zOqak9vRg18!Yf|{Gc$;Us#Ht?{}E-(q532(LO>_|MgWkuuv(zD-Mr~GK&5%+3JcBO z!M6v8qA?)f33Cgmo>d-pOGOU5bIn^FXxT$}0eb-N&TsgxqY*yH=qV2)!7d=@;H|p5 zRe*#TRL>sOK5SopZ~ResQ2*opD{if`{#C{&6-!-xT# z-1Pt!H0VeA{M{s5l6y!PAdW&B#Emjxjq9m&lvHYZy57hWSo24(bCWTIz1G?-_XP-) zm$LB3k3kJEQz%mv3o5o}ol(23(E8}J96-%BsGfD&&OUsb`F6l==Y1#?EY(UQm2o9f ztzMN`&&pM`9bm1}g?5|gwZY0)*%cn2`=Bk?4%`OMkQs*Glz}Emfy<5JdP#;PA;o69zA zRwk&r_2v~v>rF$-fL!N2LBV0_K|Tt@;xA%y&Xi!ML!D;mCb{ZsqW2~ZFvEK7hCe?* zCtYU+iqAi#U=c8tnQUO3o1f7Nt6S=K(A0cjjtQ*gd<@(azM*BO{@kTSH}_l?zuyX@ zHi1Yt@%G%SuTL!kQL!sSJC>dD4?Jpq53bq^d3bdPcg!7?Tp*EZJTiXkElmuX3havE zHbj1Z*2vn+njt*2mcxw00};CbwJ25*9*s+8)B^EC!5&#o?Oj(-9F1((Dna3@zxp)0T( zftU#IMut#IjdZ_dgS)Te*tjo=_w&k}G_blB&hD^qYlOYYx9o$^XwAUZ7K`nOEJF9MXKp z^){PY-@&WLPls&X!hZ2$MW?f*Gf}|4XY+Hd<7I}me}PT(^#(%0OZKk3>yes|HmT)= z%7$N-C(Ok)xJ8z)%`6_C?01w-zO0ximmU(^zgw*2`G>{D4y^V6+ z+!5(A@p8|zRVwUA49A6@X1rD+_tjFo4Y%g1>=+)yb50e6P-2YwU}^rTzARd0w5Y#h z*19{Un^1wfC>HZRUR6dH3b8=I`1S)4h?90qv$=+gcFqQtS=wL&ZLs$AOf zN7xnSD7W&`Fa?3*gr-8DtI2UBcZ~1WKL?*9vUAz3`HR zA622M(K8NDpFQ-5_eyf_d*Mpm%EcNwE;Rb-988{h`qbesPb;gO3VVez>b@);moP7k z4l6~G{0vXZy=c6HwyR>tbdqA>&rpNlLMUs?S=)OVEwW!Eb?gVMzts_ZH^;Hp(=H>J zCFUJhYMD30%0IxnIs0cpW1g5cIkszOy5}Bse!Bh8>?<-&mL&Nkq!4X+0>4nqhiv2h zR&NerIvJ^nl5!!=vSW8C0cAB|Q7rb5#7eS-6&y1fu4MHm9vrF+xGfOTh;21Rer-ZV zsS{#5x|g^!xb&OTFYA$+^19UC+s<1`Dr~m&cd0Eja<0*I><;WqJ=RBJi6F-T0XvJ_ zy6``8HKSgZAmLBJ)`}YE$GPEfs4Es!Hilkw;Af4CjZGILnpLP?k1O_B)-M+YkpD4# zkon7cOKShG&h+WrzJL3TbuwsZ-L7s%>qD2Gm#eX@N%x|T3Yz_Vek0Q}gEHu;FM^ya zu2%d|!3J73%0eRE@V}Q<7@R73x2IyXoISk0z^-QcXVlA5CAYfQV*M}BVjXS^Vtpd` z%ztE;BzZy_agtRqE`9zxH^8r%KKX&$ z%pW0cuKiemRmEQmLFG%-@B!1vL@%!lWBjXs1=C=dLG=zkORfI|^KTo04A5C3f*{v}x1_YtNo%x}*`pD$SzazcY&#rAtppq(WXn z=IT2;Tk-z)ltpg{vdVsQDcM&dBv$ow3;j4}3s`*is7>ko;&ABR>~huGB{m!fCG&%&XWHv@gf(gUS>O;JC1 ziK2hA4QZeAX^tGj3er<(3;NxdB`V$Y;u8e_s{+ z6+^Gru6AC&Rvxy1msSogUIN-GZyt&X2nz^XH|vsM$9%Ol)Ueagcnl!Gp5OwYIJf{D zY)=z=F#O*>78<}K9MJz<{|A;Z4iG?&ZH=*qLk#$Tt~+A;|9+O(n&qv3yfut7@uVSj7G%^kCT zbmY?FSM+Z0C|k5PXC*IdjYVcXdYWU*j*}O)$cs0JsnsJno+pI(wl^^0$A4wG;8D!K!-ch#Gn(aPWXJz-xq(A~!lwVd@>OBiuD?(MLy#uwJF6 zRW6l;fR#|1`txLdD!~{NCZzhtdn}D zfyY5Xt_*%!OQ%uFlyHCKQxYmPsZ;Z?xED-=Lk6-~*u?v)g+)&P#jqZm26*a<3`7bV z2S-;bO%+v!SscDa;umVy6#f*2jC|o>C0BNST1!O87puBvr8A3;k<$}=UGva-TpEcv zPy-Xs7HU!gSR*yDLn;#zLPL=p$OnNx@?#b7juShj*V`{VhHFx>IDm5i-j^jL$Rqra zj_p+zs>j@k{)iPHk;%Oq;3-UzfYm+}2(#%cAUYs11v9dHo>MJxAtA_~uO!g_I22=l zbJ&OEIz8P);b{YEn`jRyzL!w?4KjCNX1(2xUo@I2QUQ}_D7DH_XrU+SL|%g!3!|!c^N0_ThbJJBy&ZOTpcqlH zkDQ!h6ma7@sE>UtL(xk3Nk8H-7VYZJ9??VZ#l>%BKn9BwSDP8Ome-I^b%@HE!85=5 z#}Zb0)K;@|*0Xvxv(91Ptod|!{PydEn1wWZD#0W8s=S9eq`Us`lcez@q`H#UcSWtS zs3rkeR`8^VbcyZTV(+65b8XxK#!%w`8sh+aH%Ud$PYPoBeBgVVBr2HuTo?yHnL}Kv zZ&Q&0iorp2UfkTCoM+wa3GX}BKmH&zB5svVZS~G9-smfZJI%<7zEr-bXW_8kmJitY#skU#*v%O^J zQgz~onidL7>YKJkK})mHiG!+ytBRN?#`bgCd&e(pZx)c{lHF467US6@uJ=_|_42L6 zwt349Mn@SAXbEeDM1328(;ud<_(-glIsIvHZ+Um!Q;FXwn*5ONVsR5(Gd&KwZZGy_ z314*r2ZRWob(q6G)B9Lc{$0g$Nym+fR2T3NANq7CdJ9kkCgI422tyy(ROvh|>T;Wx2 zZ7>j`hclyC%dOEGuzQ=dMZs0Z#MO3vu z?K>-a%WAT-%vL2-D9-p4{w7@qdw|O*3CfSGm3*NXFFO_cp3*Ply#RwVHz)zLSu?#Z9I5TGvduzT(C*R?L*LshXh^D|l1kRpoBktd_G$Wv zGacqSqsXoSh>R8V81zX#6ur+_p8g_zQ0eNwFQh*)WO0Q%m^xIy_qDjq%k3huZ|cT< zxEkMr0$_~VbWfC_*@=~#Y;3O*EBW3eLHDhpZ3WNP6pK5R@tH@<+I?$OtsqG~$g?;- zz3|ZQbys$sQO!rx?Qz`(mQzeq!ngZ9_KG|1lEmY^Mnd#zNlHvoY1Tz@5br1`Op_9a z)jB7)=v5Pz1hhz7%UEbEUZWSNt8LBd_WC(;v5VO4BJC+hdZss$A5TJ3^`2qA_O<&N zJzgTI#`xZWJC5KdcsU0lIh)V-MS9Ltd#H_%K7y5|D%ZP?u!K6W>64 zaSzMzVTA3(=HXuu?KJnA;KU&*H@@9hI$(J`0UZ4*?BW#UY+r}z>8)x+@7qCjpt~7G zjx5`pld)TJ42$p6Lq~@zs&K+pZ%eq%S#v8_ZfwcgFsxwJ7NLY-`N!J;<$f9|cJ@yn z2SZ(vpoeOZXCL%lC%VqjUWIfqR1zIVD~P$#@=!*uupuf_zO!j_Fq zT9i`(tkyBP2^5o>ePnJ`opS+RR}9Bv1#nbMO#Rm&A|A7YYjjPQD#ZjJ2s-z4@L_J? zYGh!>(@;VC*bi*MUMay$vBMyDJsQC5(tE`(^yLVvj3)6HX~M`A8RH$-84Q8aETj_RRA) zjJQN!Kz0RQ5!Q!AiJ_j!$^9AEy#{AV~)UnLG!|=N=pxJ|J`I0{4KoF-~wpP>! zfn3=4dPEeVFQER)>2~ZV#IHM$)Ml=`=OfKRw1i7Lx(4CtT!j-~1J`QAO}7;c$;iez znu2|noBAp8u;z)eBWbB!QJF7p48vGa#PaoJiy|lpFMSO#(qG9BbcN`f5zZJ`&(2%U zx&l!_uunZAicZf-y%1Bg+LVm$0edhwXEejtLNa;cOL)e{u8eZc147S(n(EM3paf&5 zNn@$*CAMjoPinwE9FQdAu63Q+WS`4!&OIgX@OkYl?I)abpHrI!1{+tfd^4sSc-3>? z<*^mGT-JQ46PrH#imF&&KzqvJ_Ju;1zXB4y5m5ajE15E;>e2`=)1>DZERZ3M99P{J z#pCxCH9i8I9SFeu@1{gNCtts2Er76zIQY-Rx11 zHLu>Ws%a1yx4k?hlYP79{Vd+-Rpe!kz0iFJj%i*`%JS%#I?0y~OJ|(!6^jBQ?!m=HZ6r@U5Ox=Rx5!+@2MdN)S6YJT;|_l^H`gu9Z>i+ZHzrt2!?IOE+SrgFO!w8i7I7a5Um< zb=T}t3DqtWu$ChE?LuuoHzqyR;j(Rra0G!h5UL;b{Azk&v!XnDu3+^s1Za*9nWo=o z;Bi2jK^#EtEH{$1?rCg!9g*2!67V1(22c`~XLB$v|LeKs6QSkR57$pD$9x94M6uRu zQ7U^e)7R;%Zi?@hv!`?GcPB4y*YYTKPkk=prrJZExMiUJhT|FE!*}m4dxT-MjB@xT zw!SK!6`$80Tvp#eM^nA&_A@N2uW&sNWnMOlPs$+ofB}4~xsI0lN>6zbS5U0Br$#XP zMaMEXB5}f9`?VDo+yfjhU0#k9XnO|o3Hr_i*IAeMT@nW_SBEW%%>Yhq740SvxtR6pu9Y$322K+%mT zM1D{JKK*I!5ob#*>oj%4sPltDVtrTcO%1vBvKH`WapEMYA!BU(4KG1G3uF|q+7L+a zVTPzC<=Mlw?-eYOG|-T+`wKvRtXb*p$UOqxV{5pjp!6e*?%V!6q7omKj_Cfz{K2Mw zT{7kQ!>D-Q4O8+3S?zP z?-z>nI=Y5Y40wYNYJ2mAnj1|L;9_IImvK0|9v?Fz~;7dc`-}oLq2fpQPV^mzT>L zcr?JNaY0M(W|TMAn65;06S}uP_n^-`uR_0pbpw~$FT~K&#k-+06Aqn8LsCa{xqUur z6NjuZuVoA&&2;-Tn}W9_Hd7d-I~up4VMCk|@Pss@O&zQ4k1d$dwIhTA-ErXu-#N^} zZFY>>R%c6Q{QcS`f(D9-UA@ksRuSz8Wf)9VoBC;O>C(LgLaDli$)6FKZYK2$*FQ9_ z`p$_%+z5kU?E~x45WK2eUpM=3c08!r1hh$>J2hbRaCc?Ha_~LuyDm~5NgY^Je3<&| zVZ--|b|!w&`@FCMw%IF&9D~W@3q8Y}HPqG4T{=q#0|Js5jzKQ{nM5Fk2qlspNhQPc&xNE+3#zPv z6`kO>vb4V8C&9;5O8KoxlT`(9wMti>%pb_y4@P5LOxu~?m+X)_s!%BDzmvL;QrJXq zX;hCDC~CS`ZuKNebKN>276~tf3y{#}3}dDK0%Ig6(mYUl-A98h+3@$YvkEaG!VEF% zXeD_?d#~QNj1KE|f9u!Stpq@1M$lr)iqJvH;5#(?mzq z9W!*Gp5w`pomD5cwW19o2ot9ykV}7`VNLX^kI(Q$c;im)uIcYBT%x~;CI6HdmUHS= z0yUD}sy)cgM3tHx8_x;q2~v9M4t zywjeD_1MI8>mko@D%O`!LAf#q9JJ?jb~H7E=*=p+MhvxNgv`dPlr7MNswsYFY~aTC z3)SarN_=?Z4MS4Rnw0P>u7dpHsKIW8`8(bNt>l1Ef3mfq*F7stO|fImE=rc!w0T48 zOP8vqo1}_bDa{5O;kFwV!VGH?WHz<_Z8prrhIpdYLv5(E(&y4lj16DESUq|!G=_LH zoDP%T4ZuI^eKr<|h*GrtSVyByN#6ZC%?Z1j!b-kcdlHmj76Zk=1OX-RQ2tD=#5_zy zAS!M0Z@}k|&lv0Xs!r}sc)D0>!4r6HYHbn-kp|g)x5GPf9{fBO7L71lYyZlIJ;(YE z`RYBk>g+FwZiXP_=YGdeVbPA&(R(!FpT11$e(A|09T#mn3lhzs;^)NuDP3f{U1a-v z$@VjRpkZUZb5Wnrt)cVN%PJ0vScTK~VpGb%uPQPSL|&@X)R1kWpG z4>}Hj&9p~{g?xD1ZwmE4cmV-#sBo%WAhn=;R$I)p&7OPM?8`X4*YAzK;WSngRKbMp z{3-Oe9#>Z?AR2}1*Yan7AO8HWE?x94e=sq8@FsgjIC+Vf-v(@4!3s0-hh5)I{>3Zw z9akMWOi0gW7IbpxAT)Jwef5h?1Go_vWc(HTwKs-U%=W&#zP}zy4|aiP2&ZNy}%8(e#*aNaWzxGj5?d)rqeXGaqJbCyA;{tY+ax%<7cTGze|7G!4J~qkv1M zsdk7WN{mFVoj5>0r22x!8LzgXg7m9;YSxgu9Rv!Mwjp&+|IcJb$NSl6o8 z^paSAkrvs)5Mcj!SIVcD>1l?{2ubx%r}T(!)?~U}#R~V`72l_*7T(0wr&y?-p>ka(qR2f-$90}P)P>HKNp(e%Zxkg_Sc9Oipy68$ffI-Vo;j&7Uo7j{=pAM zbR+hbE`Fr4_XzQkL_W9Q{iw3BYEX$}y-qQn7c^mYhnz9OcVH@1H1T#dZLe*iHEB&iOu4dY9=}J2P|D$_KXa z+qjTk^wdW~y>1m$N|+Iu9mNrq9TG}kP7QjYV0R*YJ7RCmcMJ5~jDx>(F%4t?(8>79 z7XAk!`|U62bK#{l)lj{LBpxcVM9adh?9)Skx^XhzTLPNeXmYIn=st^9k#5Fv4}_)DLN)k|l_64F5_FN3pR z`HqLMfK_uQ?Xo^O0x!8kSfRr z&Gjom%(AX)AB0h)>Iur5u40OPcDaFa@qwpVOx~>I4L?MV?{8SUCd$L-=o#B6nE+E-sEm3^+^T!HpMeG z+m-U;2!P}bKnWa#vHTin2hlXZbKKQe#LE-K>mwD%p}x$eD&I~pYh3)bJgD{6!`RI1 zIDYH6&=Wz?4o^1G>V#f)9*As}dwgf&jLrRQFF>5w=8iI`yE{hsG8$p_PLnJ!{W*t) zNpS;^IOtk&Uz&bLz|l*$5?1o>HVrEPcM7g_WfIlE|TonEP>O;?M0~^55+lFDkh(Ak{uJd zr5Z1o4=&;Q<*!kXJ`Ys+sy>Bif!0j>>6Xhe{j}sw3Bo!LeygoOr%jV&%5@He2%??& zl5lMU+Q?#eO%v4J6^FUhLO6xV5aOS!M7+XTC2H#EbUX5Pcu1i>qU)p*j+1L=VUmNT z@Q~Iwox&`zCG4F|<`s)D#R1`7!SnjjAwn?X()Xvbk3}_A~e`lwc zv2l$g9gVtFyKfcSM;L%>O($j4j(y+TUC)Q%+zj)&qkP2^^JPAXv8_`hXSigzZWB0g zn7AEQukE0rVKRr!HGRG4ee{*QB=l!^&glcjz{F4#mAc%C{8=uuBQ9&W-K@dX@hTJD zUkuechoYA(uMj{~jA34$Y;);cy{V}lv{PtO+ZK zPh@3CM;Rw`82&JlUgTkC){t8_ceqtCG&V6m#E>jk_$43!$h$+|q zjCpc{E+ng3X0eeoV6k9o-?WYDlLQ4s-@4;%%{R@Cf?tGPc$3pJZkY=Sq4VtOa^}!b ziV$OC8Xh&XIQbxHKYi}$J0;35idyg{oXmZT{=WyXjwh>t0<{`C0fE5kSz$*-uiR2~ zK(;WhEcLWdL-fxBeJnkJw z#?Rc^LgEvW#lvS_n-5I|W*RHS)<5C>aNOZRI9D!F(x@F43xPOIdR!oa`|q%BO{HpI z86F*OwH|1=B4`Mhsw7ccjf3Z|ItkoN z{s%WUJ2E6AM*~oc@A8^>xzDg2F!7{B359F?gf`aglSRb-|)~~PYKlLvxA|2Tz4AQF|s{9piq!+E%Kvd;OGgEWD_S_F2IgC^DIx>TZEGkN` zn`S8XPbsrMzwu5j*0F5u>k@E%ni@8&wcy*DHK@Rni61E&K8|(h{T-yY_bPg*-%DXG z@E*6{#mw{xyt^lT7W?S*{+6^WDJg0ug+#xt)j+m73 zRT>#q*82XY`$-2M@yP3ht~UbWYj#sf-Mj9Lq;DqI0I~^Kt*zKmhA|urJW}4yyCz)qC3_mDJ|AlNtw0{> ztgF){VZ84{JS9Dyw38Mi6w=0~I!`bOocMh=0B=92o|3#_iI#^MFm}ci@0=@ZB@_+L z9$U>C*rdN3TxbG%9-5ANui5C`k{hb55lXUkrWl%tX)DP`&QLKY^#3T?Li8X|jsPqe zk6G6i?VuRhz^MW|{5)_U-*V*6XZHF%{Uxoe=&V=q=~CG<(`$+-==)V%)}^7!y1~Cc zw&3}7hFSEM^hgV`kix%`j1gGB)LD=*Sgp|ah>{%wGch!5rp_GLKduw#H@%SCj-~~L zW{lt_GBf3NEWA#U(RsMlZ|{D_T&Yhm``psCPzj?Zk{XKa~r=XKG zYL*-3VYj&li{<$*fOx>W=H9b}*e#VQ6rN7600`q&v;-=zw7?%!%|M7*` zPCDS{+6W?~d^{|lGT5t$eMqtQcN7xm8&E(w#YgEVk3rq+;p_%AP~3#LR3_y;jieIa z!wP+ZD8d7x+s}B(91qzjkC@(Z;Sfx$bg!4(pEC&2u0W35e8-k2?(i+t_cSorblyu| z0*cqrt{^DJmm(KfC9+>wM91$-#<)2#s3$}(SC?VT+hdej#&9x$X2w)!)PD^D9X)sZ zT}91a{oSP$SYmEYBgL@FTCqPMd|6PS$8M=-R~9r_0)+ELF?8rgor zE#&t-@9CaVfm*T2i`e=`SusEJZ(z?u&lEG@GFBw0?uru4M^<4oApkj%>8TBDfIiyw zp5(S$K1%OasD@l4MGNsQpPTp#XR^QA@`gSGEl+=RN7MS})0cl|cGuTw-`p1{3@>GB%d;ozg zk2+k>xnx?Mzl{0MZ30gEb}I3eL0Z6VjmVlsKNG4BwTVW;)QJtOtKqLmx{S|W8EoYH zMf1T|@a$A5x-3=)F#Az(?mra!A01Thp#S4;uf3j8f7I2S7WNM7{K_*))p1m3x1kj{ z82=|cbh$YVkCN_Px?0}9wNFIIT?b(`f~iN60ywz83~5Fc{kIQ1;n+0ZzAnFR@>9Fj z42lu|+1Q@qF^pT9FUAs#^nckcU0v8Py{yaL&HJ<|+Mm)LHEz{7Kv%i^})yIau{!{)6_F+IaA zhWg5p`i@n^loNd0tJrp{XzNUQVpMr#^hN1Y8G)<&s|Tp|*AF=t{P*BPmc|!g)0kh; zPBW|SO@2DgSp8MJo+eX2*Gcr*sw?DOU;cN|-5{(Og&+ z4cC3tkgO3rtzPngcKOq6&hxUC$-o?zuT7OH=pO85-}3RKjlYaI+`{$wV()o}HRp=7 zVtrp~07Sx66k+Z9SDiE6K~mcv)cRyk73!ywJnLdKq|OQ)Us_r@nuo#5O` z8ciVix7JYn94yNg!%cXxm`j~Or=H;hdT`!l+9UgvIN)jM_50sL!mQK z7`>;siaJ^vxBu~VaLZcEExwInUcLgkE396_**jV(FwkO&H`tLR+!6$UY+;;Sa|^ea zqHPvfTZu>&GrR?h2fMwvAgElTb1ek@XLp*1*VjWr^(wyK6I9}iV7eb6%@<@p0MTA6J0=O{0iP-U>JHQdPR_5M3zoj<8Y`Zi!K@`(+Acs|WzywLo|17L9?Pn3kEa`faD{`K@-4RPFW+ zAMU}f5liZOi*ase^tGzXeZ=uCm)_S58o(vN_~7NK`Oy{3b&>czpzC_=X|RePLnxqt zc7BysbJMl4QtPj*v;u zC@tab3fmj_C;ay+kgxM^Epyr{>|DSq44k^adUo>DTxrY?DMOQPQjC6%yxR*&x!k`t zo9S4w^Y@`> ztG{WA{bZH{Eb_|5Q}W^^}{ zoj$DX#vdvlN;3M+hlQGLUFs%*!**}PQV(o57Mas1F;`A@Ja(s_&@>;V_`&$m68Enc zW;3FVClgjLh?n{vna8zlSh=0+KP@_maGFp1eZ+DscukE7olwy_oQ5ZavJ>l~ZEjBl zgFL%lMJRLN?hJRjFa!2(AO#!G-nFv2$~aZ6lyoxs6_O$*#xu&8+24=K)f z{|KL9zQT0iH~Q5;AF%PjjLh70+IWu1ct>rl8QZX2Fxb7zjiuot;=5xJfw?Ic;KRM* zFn@LEpE~&YW?vgsRvp1k=94MUz{-@;O_N(*{XaVJ_Cv$cGQ~sbpufFyFL<8)azCnn zGTxaFo`^nHAadKgy7z-r6=4ZDw7y5|ygm5RS&h!5owQMbyf^&B5^IFfgc7a)N}m_$ z!5MEzn^iwOk+2-a@Cm(nvVC-)z#%k5n#0GD)XS9kMAGYOcP=0_H$Ci)BVLa#@nuA?gQzoogkw0BGvFMf}zp6x3s>5VL!*xAdE9j zg>vy98$syNm`3y(*?2ZSOo-H`0#!J1=?Qf5p$*&oNWKURs2Q{&B@}tIvN!fTH)8;D^84LmR!G zY!BKaD2$m;B)ZrbpC&z>_*1KznzRX)dyfZzYF2s5=fuM(db{11XeQi}exDZ3JxV-nh-7T2Tax+sU-dVl z>PpVSq3?6;#!&sc$JN>O)y7=U7^mG1rN!#WEF>#%rO}q}f~Y;G|A~RXD%|43jmJ1I z-vU@&YV575^Ql&Sd#aU2R;bhptQ6C#tkvoGU4!b7RkD^wu_DPC9?2}$Sw z#IH|^T@fFI4YF3kFET&L98YAn*V3^0W2RFmz<_S29IZL&D@juG zIv=W`U5<0VaV0e)%5-b#zeN#7Ubwz=O@KZVo3%u@<Vc0Jf0-Ugt386Eb9k^>A)KNiAr<&i@ z+66Ll70%-bhvoQb14#9V!)={Sp{svF%kjSq{!7;;a0u22|UAeE;dcmXVY>y>w41UR(QPq+FQN|@NqnaEm?z)h6* zU=%NFo1XNz38$aC?;92#nQTNq)l^^BB1mz|?So#L5>Kx*=M&9FWvZ~&iSL5nj-C6& z=71H22h736E2I3p2(_zKU!`j@fERWy8-mZW2iJb>OJlkUF zTcOFqE~d&)9ab`A*>oF$`1JB=!@#NHoZG+LAq6WKN!R3Qm;pkhB%SP@1b6`G z+Zamyo&y*avBnuJKys%d2MO#P0*F04fQKcfs718sLI!A1G>lKR|C3{kgu$_?)Z~1s zt}=MDSM?so+Furn>=HQKu?S`+%LR}D-eGzBkCZ=bT@x@G&{R#hD2&=-l+#e#JBHiVQu1`0uX%y zdiZ-R@cbx(wbQ_Fy8_)(e7VBH-`EJH5LcV%kt8|_i-t5TA_C@%$l6JE!loRb5ljt# z3}3Y$I)>~uKX)rDmQr^4Ac`btuICYBP5%8*n-ZX6co911*}h2^K;tJ7z50+INhc+& zy*3V;ay#@PDfJAEnL$RTph-)0okfHciBBPcEDg~tqiT8g<0lDbZ4@M&$RJ2Ha^V% zPC$`7h_)fOWFOfnTJOXl3%sd}jaep_zH}wy4blkhyR)Dnwc&TOM8(v0C&qgPIe21E zdKMLco+8W2pb~IyR%!kPHE9-F@LA5a!D#V%+X>QfU+i@m+*j-d;i(~WuH>fj4sT7j z5PUW0q80K5!}NgPnSEGB-}ILH1!b53;>X2X_nHRi-f;+8_MSzM=_48AiD z$zgR8&Ws-H^kAk5ynl7 zRmOP#SM4+5jb)Mq#ra0sF(hBKkS|ET8$3zqSGWnOb_u14)Gh z$Wtm##B884#~YcVT(oN-pWbO4eZ5;^IBu z_dX(X0)^{&BlVhH(f`%UEjlO_E~kt(ls*rp+?h0+B~p%kXy~mc8g%|(u+9LF2Il+K zgVaPGwm@K1qAqnSoLh3C@6?}NhA2T~_*mDQoum`=-&W~ShIxi@=g>UMwFTcV*Y21W z^N*g6`6+}xC^;ro{|;0$&kO_|2wUX0U;0cRsD3@+Z^Dgq;%3i+ca+LAWL}uyh#mDWGr}ufFv6@x!ftQ z!{_A5Mm~Z~^mU2kqylb<4(6H^Ik>96J-~ceyrK<>Ydd=KDVt?ib>_dLf%293@;g-g z{cdLklF=WK$SPA}Ke8>a92@I5s14S~mdsj<5yp-g%sxv4KP1kCklX}9QYQI8jUK#q zCjq0yA2YX18XoIM2u^kqa7j*2N?(#Wzxny@VZeOX?xLBkkp=5B(HW2q&b+hhoMJU6 zu;JV>8)i3KmUrkt&$dW!E(B`7#0|jla=U-WF2ouc`<3%T@tkE=@pZ$0;AfWd!Tp(z zaCKc$U&}2a`^q~DhubJ}CKo!PKJyUC*AVd!Wwuc^0ywa(F~VhL0CwNdvq)3ITVT_- zABMz-rf&w`0PFK4-m)}fH#tPcDwQ0Hfvf|T0!C%yu{FHDARR!(z|VbZ>|;yFSC-P2 zb&p$W5}~w{!rjg9^|3`=c?V^o+@El;JCfM6M{yGYbJ!w$rWEiqjKpJO4ZsD?D!#{z zqT1izoJnwo|`CpER6AA{^0z4@2AuT+dwIOV%fT0Hx{ z@cq<%{rxakrKQ7JSNFAsmKM8$L`=0deXFTJE~(K68Tu;-Rl&TL?F)#B)`-Kg-|@_R zV_8%9k4ncq+5B#a|7axhNIe>5ro}3rWM%zn)z$qzcJ$oE$KKS1*2R95?^zQt^MRIz zqF1O1RSmZ4zXd4qDT=8_=!ND8FAp!T&7aEV2d+HU_orgjrtK+X1Gb|^7I<2fh|13J zFqknZBe+@@lu(=neuk3ZF;)kBTdI1TSB_Wwxv3*{)@i=M?YqbQBh%r~9Rb^(mMVn3 zE7gh^lXP3p79fN4+n{(0`kfU{I$;P^5Z4Ua@@ZbMkc?GEes06E`d|Y6c$WyYrm;M*@-rP3J+TpkTC44YwxG)qzEyOHe6;`>xP5UaW|>eMeM=CnVws2EO=u4K z!BAK&;C8|?6_s{D-s>dxe?*dScv?=;^9J2}bw-NSyikZAP~FcLNSO?WVu%&bN>mS;3y) zM)y?eIUNUdzLLvY?rnPhxo#pX1f)<%Brd4#}zX-)FVzW=s}Zh{|0djITXmz zi3P#bI8yDGwFo76q4SBum}oBRnv=TEH8wq|wn2A&g0krEWYu?8xUIUDFS$x3BPL|o zzXOBt9?U8`@W=0uZN;DlSkWkzo?VLHb}?2v9R%ouWqL+w2Np}`CbG^$A-MOb*%gD0 zDv4f%QdP~R+kuq9=`}A4PMc$E1hvP0aFS=A?M@Y(M$9jGG`}UxSN=W~U2sP!uHTpJ ztnTT3AZ2X?H*d847?!pQeCG;*LV-1t5V{s#w z9DI} zec?0I9lPz_p%ZhCg+h$qb;fuKU?l2-#hP4qJsKslDb%S2N<&wwmtf18vbTv;~Bmpl{w$; z@htb~?@8NTtH7p_bh#FY@!zrkBvgEGV+Q25Cr$`8Kvu!T?is{sPtHbMMb@u~rS3m5 zT%A=!y-X%6@nF@4h93N;t^nQGDk=Hi8-7jk)ai^-Qp+8|R-O0smhl<~bVtF`#P%gT z{;ni_S-$$~w>`@O)G)z}liMUHBA{Bo+nxIDy)^o9MDTZlLwpZ?5azb#7vQ6)L{uLZg_? zP*W(=nC|*}p|5VcG_H1QXzjjVls!Xl{xO*GKfpnz2!pTib}R5=-6+XVz=ct?Yhuuqdp)t{j`MZ<=d#z< z<8tRNn!Jva#NUQyS3*q0E{I^b{*!WfIko;#MKQS}eL9`}+Z&Y4-^iC2Oig$^Px40#cW(Tz8w+^0&7Pd+a#_ zA0)*?PejVi-1vRhu4ooCJlK8-G0?yk9fZU)a%uzKgS0#ULxtYwZ416AmczoieVT(> z?|pIv$H~GDq9Z)M&(^m=Ig;fEUI(f&dsEbPUlKyh3yj4~@j$+xq7sZ@I!`GZ{$X;N z|7Sv|gFo)2!ijAAk-I!9SeT)+kh`>vvTNM{HvsH)=DuRsRG!IB)|MJq*PS;oVqzMq z%<-8eB>D6{~^$BG;b z7$Z+wp~G9J*4x`5OLZFKjQCQgE4^~+U7}f{fa6i(HQ|k2V*k54onz7AqaQ%|yBquq zx!)egev|EQIr{TVv`C1XMjz1SOmObV4xfdt417z-nRT=dJV^QDNz1=g*jQ^fC^+I4 zKlaYQA_r_~tw8f=_j^Q3Frs0{qVHFf){Nu2hrC;{vHFO_+#yZMKYaP)yM-Imk(w7I zWvtzVoummOmn|}|i~wz!5MUnwo^=^nLUaAjAg10UozA~ZOZBM;CzM-g53bMlSu#Bk z&6B(k{;@oAv-{=0-K$|ovgoUMM(-oBQIn=OHC)Dp4p8lii0ilv_g(+_Mr>hLqRaa{ zNpV|XVz_BYR_BLscFcF$wXv5~kt0tK;K7ysb$C3UO8!ZpBYd%Hg#BWb(z zVp5KYUqX&Y;O(Imur+TNSI+-;ev;H}HShKLgmQDX`db$!v+3*gowY2FU2h=~;;}rx z2VHHqjTKQW4pm&+%>2zB8iR)X#!kzL6 ztxe=z-FCCDLSjEjnkdrhVKJ|9lo$@SynSuVd`;mXz1FnPA>%%-9dk!xtTYiBbpL>m z3rY8}?|_qGVH2t4ceyFZ?hc4E6y=C(>AHDuQ+H2BG9JGYWmJr)SDes_`612497tUd z@;Aa*MfBqzyQ5R@T>rb3Q46C;b_roTbaMV4) zcu2Ubjo;00rlz6t?pJjXy+%21Ks3V_)8|=1{4Al@dB!RWqA}y)FF5(kE#l{RI2{-; zs_A$6Lgl&x>@@P$t)UZZ4kE2y zB!544gRka})z7WT9LtWQyF zn~i4^;C5m}cKXBQ|Fm~jQE@cUgC87%1qf~-KnTIzEx3~qU~qR2?ht}oa2-6jyEAxj zcXxO9?R+o$v~Ron^q&Xj9L|~Q>RVOaSAO?i@}hC2Yq%3-RP)AT>*@+B(C{9R%p0cE z^4On9Qu7+m%#6dpaldmT8H2$6rs;gG^wh2kg85BbxmXqJLza4k08BE*jlipk$*68F zFtm6|S;wBI0^d4@;N2532T9SSA7rXiDIg70^V@F;=1K)s^nBYz=*LiHefLe|H~SF~ z$!62Voc5{1Y?tC!wbQS~$bj{E!~&z@l;%2LTB6acQ~E)yx}=u{hSGt@VnIGSN&SL* zO%+ws%zu$;3qF%j5-z_mAnVS#x17ZBF9$QTDA6l28@=5-$KA+7-K~y%AW2wpYg^#g zT!OhDB~8R1hZ(l#JP*K@Qz}LtFKH*Ec2YFnpsuep5(lg4EK@HDN61v#2E2`)u zy-9AJ)BNKB#pQe&Q>YM&0vi}u=l3Xts|A`$?pYKVU>0rem!pZ8(R#s$$$$PqM|TeU zFTY+BKz|-90MsC2g9w9Fc}&%tvX*O@nW5F-9ET#byF*ZlXplaH=WL?+Lo06HTb6!! zf@yzcCU4(lhn+%w3Ju_l<2tUF5$kLKFL~9jEN&b?bEvaZUMX^>1~EKk(=9$;en%H1 zzZHBTA#XcFjTBU89c}jq`=%fK%>G>VI+_!w^1V>ymy~OYa?p2(<*9pksqwZ2I2cbI zMA`J?sTQ-+ZvPF(k`BaIcB=CRS=Jvt95GT2b@A{RQ)pM{)g7huy)Mx!h6!xsNwVkJ z5@yTULvvMBlN2xB+F$w2=K7bdd9@XreMG5XlYJYcxEcFd%F%B)Z2>bW#|X%(+}I$l zvv+IX;f`4>S3bPh@53<{rSe}!VFe2+&3}M_=Keu};{k1&x%nb~Xa>dKs%{}iaZod$5MRE$E z%4{a7XbLse@h0|hol)C|m-~k5kM$jPOwNP_ksDa#DD_J`*5@WueK~x$6Y?B6-*N4R ztpxm}X0t*fybtTiAj)RDhvm^~z+UE{7Ymc~rI=sxxLka?=(7UWA#tJkq)t`|MVPG& zR?9-a!s6hd@%B{*p3BU=fJs^`rmL{4_w$L*1+_YfI2HBswl9yS>*lkfaas&=Xda9g ztLxT1S0~4NJ1V;ZjXBky%=iZ?1lA+aJT(R=BFqA`5|@SgHN3kbam$^t_BUYl9E;D}I9U)*@| zO1s|h$i&F7nJ1|mnAJFO*Y_SBC@g`O;1Bb9`-JOxwe&2xMr{ zX8W7_s%RiN3^wkp_EjBC((s(t;Oxbu=BVO+C;ka(QAdOsbr*tDAP z@}bR{^oG2ZmUY;xs0vkVe-J@Osq|`PbG>d=JZE>EmhvDe!>bYZ!11M={&{ovl=@m_ z-YatzS5ZPi^=0ZVZ8c4~`>ajdb$64`?dC;u&S4g^<<@RSJov^l`NjvQ!K0-Tf2~eU z&}1^ffP?<0@qC{mHVGeS%k*r5a$$;h+!r3I;JE@ zp>cU->C{k0x%MXWyfA3<+NQ`;;Q6gUxNpHh0gHw+aG)p6^A1mRT_Q;n)?rXjd2Jla zK^AU1K)fOot!~P9*0w(VT+xM(_R$TueF$yQw`@yKLuuP@8&?TzK+f0Ww`r`6K2%;4 z1sT3kqb(`^>8@))jmQWAgg`;!^X;=;uttMGipCg;F=$O}?J*DG_nh zXWki@lT{T@-kk5OjkgyftmZ1Bqh7(?3#T(6#G~H`gtQ0cp-kJ?Bo5HXmb2lt7CB!6U2nP^&gGQ z@;F`0Q07mc8BDjEBCO_H0?2ph^>-8p;e>K@@r?4b%{89tCf2Kg=Iy=x*cl3d?Op4Oxn!<179ilU zGbX@?bHvryyJ>80PhC8d*l|$>z0GUPvPI10Jx0kM&w(@XC&#nhu28<+xNuM~xrMlN zABQe&5=etKViCa{=oQ&%-Z)4OGx|95hKZzvoUZSAcp%cU<{oe-TxbJypVh0qDSd|0 z`}lN6)*kCkL{8=YMoq4Koc!s;F?7Fg{zd|E8MQe=Oa=sqbAStoW#2= z%t2DZ0R5E7{td+!6%3E|;t{b1sItEyz3C_jjTWC6pUTfmeAD+y?4jU~C!CS%qKK3E zrd$&fY<~~pMDnj{pe>3XVVgw<7Or`sRL#bTyg?H`|&G3F9SAh7*1RMN0-bseEsz`f8uk~QP(W_YrDoYdh6GzFes z78ewmjI;#s-}WN4T+F#Jf5MSewa_X>Bx(pwJR4KSw?CiHFIdl{2J-XT59J7#Z;rZ# zP34Uz1U)9&ZJ9{)HI7PGCZQX~bgq|Oqm7TzQBV~3`k_0IT&?e2JTxbLlrAf8BZ(`_ zp_v-@1J3;fCFD(}sf#MG=uUqEK^rreIMT^!04>po&wS=E-(NCe{i6_AyOi zabsLrwUP}$YhCYE6GY{gC5ZL7HEjSZU-0!rNNi3sfj2uzl~c;C2>d z2+~H2)iQcIVs9w&9TGGctPY5Y?(T2Zm#*)^JRf(g2vW&)wVP{oZdUEzo(g*D{_S^c zp#fo_hgZ25oH>k==G%9ERo%CG;*$v@lW!(?^_+lEI> zpU1*G4(s*WRx^kHeq`XC*R{r$gB`;K3?W3iiWhrNdWvF8Kh(Fi-YfTeoHoriyui%A z6$dQ;&GL7<8XgD&zK4O1G1S`J zcbiL3mbARxhYml@jg?TJV0?wF2{A}vA!t>%J+Y=mAt^rnP73w`;N)~oX-+??2lOmG z|Gi(bU;g7beA;lX%@;w~kEFQNALrkvUs4nvMfF}N;?^fc)Ly!f2xUe%b2wRz8ATZJ z?SyFIKoODP90Y;3s3~-pp@d~)1<-{B+Aw= zG?0@9hDZ;0wzJ6M#p|}e#Pg9wK}i2I&wTW8C+_($;PO-&NFCJ~JeMS!$TMV^a3(|46QcROvCdZGfVd&@ake;P@^J|%|Fz48{H^m*8s@!}oU zIV69KtG~YQ!R4F1X%lF^+_P32H?_kbBC-ve9Ra^3I4WZC8UMyHMFuzZGXWmRY~XkF zxDQpSsO3FySnVrusy9b#HG`Cfy##>I>pHfJoR zEBJEYo!;=cdZfinBrr3nGrsPKKBN+_#m(ZRefEU^_UaFFJ9h!9Y7N4O zJiY^dfU)^(Qa)D0*M-a9SW9;MZbo$u%#KvY%$elnFS|r@VDh8{fPM4l8v zUx*6+3HEZIx%NFlo-s?c9mUo!_K^1*^n*WprajN0wMXpExkM+-lac&!KFdyT-X*M! z9R;oe%4xiR;dwWz+C{&^EsOC*o4$I492HXaie&lEbS<}a!rc5iFOdwhROhL8BaKgX zL+H~iUNn-o-|?8V{bqO7C{g-Y8NjFOCzedv95OiqTxSy9Dc&LGQsx^bZK* ztoEM7#k#k z=e4TLz`(TBm&z9J3!1C-Ttkege#<|fnP^fEnYeLPRSUD`vMehq)2b$Zo5I$pYmVkH z-q8Cx(|uleQ#?o^Hz+L8T|`vYe8&Ex+R!CBd$~7i^D$#}qY=qQKMJS{5S$eeAVyN@ zd+n6wburc8ZsfQ{5v%X1D3_5HXyBjMF(AWf!}yI7MHCMFy|>hqoH!EQD%+&fW;5CO zq#KHnz%tlVHGMeU8EkHOh;?E8c)@Wz zdh7FHvinZ@5vxr&QHc4o$L-dMGNyk3E`XDnfdmI|8jzqDgcZt|7%M)u9PcJsC%)bH zO^NDj8z0q)HPV*o5GNG+T2IWtubI`p2OCpUi##=bs`iz4O5?v)`nE)|%loC99bHeJ zx=&%geR&YMObP-W^~tZzG=9U4`k_wJcOo6|6MR`Jyfi3Py1XH!CWaGd9{T3&hshz-I9J34DM z&CP;GtODvjf+&WWE+0L=$Eo>Mm$ox5)D+liQHTZ2D-E|b9|!XVs#>F}cI>VD35Xk< zvj`W(QWMJ-hEHf~eUG1V*djCBbRRhXEduvUT59q7*pzl}hKx(T z%lcGim|sb`=^j6RbTmT3Z9~w#kpd!8TF-Bw=k?cG1mu5ZuBJLG{MA}7-LRz4Yz=BJ z+CMm=O8JF~Z1U%LBU*50Swi#_PcaT9(skei!I89-IS{dcYDva0EdPFz;Nm`r+_p;T`A4EvJ4Y1E=44xV0-e1yrCs zbC5&Q(VDhoZri1>jRg^}kFeE> zUu(M|DR`+|xSYE57_6uP<`X=0IBF!AWY$wTvNmWmpmCgdcqr@e+>uQsNXx9r@imO< ztKskTbiA%%lf^%#xqXhXO5cefep+8Qx%QW6;TZ6c9FY3g9lyA{TaA3^=w#1ktE1-4 zFd9nF@xvO&$X5n<+9Z0r21A#{)o$#t2w7ybSOr4!J(S;|O!MD(#a!Nac|yE!QaEd| zXwi8zy)X=7#64DmjAHCPTgyI<)NX_Me%n37f5h>B?b#6#w2ASo81lul;FS7}bF>JO zt7boGvpkxbef1c^hOA;2(-a}VT(hVhZceV?N0 zzLFSZ&TL^k`}BUtj9Y8mO%6XEUf6}#4-9cO`l^DHV;PEyWpi&cgP*v5F0o5!NOf<( z53?6Xwra^>B|2MBUMe3f9|_riTn+39r{3en$H7+eQZuL`B?UmU*vbn+CqiX7uw7moD zof&g^S}8R^%$~$qEfY0I<&8^4Oz@I^1#*hmCbA?otZqPCxo5lC@n1DP)Ppg$#|kx7 zdmrS*f#WqbJ6-L#&HFdFgACO5^CX!Y!g9CpCCl75C_CGL16!@dTS!*5EWl>m+{l0T zJslhGrX*lu41Gua8J!3bZ+{wsN>EjP9PWu)Wipl>R|Qb^jdAu*<@&=5PQd6Tt2F^a z-kPW<1X^8P%mm{MsZ&#XXj`F0C5|S;x+Mv{@hK@9-bt+lKMX5wk>B@-Brc6un2Q0Y z?9;z1B&5jHFVQm_*o_6`iMWwE>@a-?j&I%*nm2?4lMN5&f>WdJ2S?m=_YOu5I%1dm z)&%VcmzIU63+}DSRO2PwAD31D?%-FP316DR!_^*a z`X0S4L5(2f?&(ptz&7}FH~UMCbfTl+vm1uy;KrqTnSRpK-68#6!oN3K-+Ljh)Tuc5 zBN!={%Pu}ta4V-blEP?uGwAbyA)6b!+{NS8MtG%&F9kJd-@GuKbP1nR+%zaBb36C^ zfLN&7s>cElQRn!#H2QlJ6jVGWWl?+m=e%M5r*p+I4hbAzccI36H?zt)=&yhb-Pfd2 zyxxG61zy3Y2T6i=5XPI#>Bl(_y-{dG<0msq*s}nQw`k~lE2VVZdrOA$vzY^g{Y_PcP370z8B zYm45NR)GRd90o~k&rR21IY?sbtQfXu`g8*+cq&uxh(0#@U+hh{0%pr6jr@0Q?p_~t zy}3ludvX!WqiA$JaavvqtZQ)C2Vo_7-P{^2s04(&%gfg}zvOs&^2+wm#~^~mEN0H=Gb z|6{sqbWw^12Z@7@*RJRrAuGf&LDLc9QQzo{?jf_#~T+3L7q{KvuyE75bukcR{+Y8ZG-)YjtdzN0i zQK$OORisA2U!HJ>zVBo>b8Le&Jfq*zdHT1o@f!>4XvBx&mb(2zbHh)KrtOUV5fv z&4*t9q|8Br^SRiv;rQh>$5kK8T>}mC1rDs;cVZ~{JDupq#a*e!Sd1RFukEoU%rR$y zkM4uQ5oX(OZ@F$lJZ_2Yv#aL}hhgj6%0jqA6rBnqo=L_=l;Q$dfv#nP6C)T$g@B)B z{O3n%;mMASw}LnH#P!{`P0JrH*tLV&_T`%HoK1!!O3y*!)PJO~>g@ricDqvBJ)J9(VT0O6ft>klV*j*a|KbYHkbh-W2XlQ@@9x+0UBzX?N zVu>D)?=Y?bvn}m-THD#$-L~uWZtlJ^^pyxih_t`wf9&Q;bKh@QuP|!Vpxyx7_lh6W zz0kuFZ91c4XLjJghp`B5v|4WCu}5wjLI7wsy17AEzDE!d)mBhu`ZPbwW@%$ZAJ%GY zNjtmZE=1mPLma6CVP0^3a!KMPM>=6k(-CMcj{cRmPZa)lC)j7Df0u>zQ^m+66mZ7; zJ)Uh1R~@6?i6R|j)(`S@CLl=II*0pb?@@t>zbwC#nq~iZ#ES9xz`&WZHxCV!r0d6> zN$(d4#ncgx4DWz^id>Qc`6A0h*PCgVxyLnGT81LAQF+t@P#yBoLmvKCwTS~^AE_I9 zzK*AW(8~>tpwAP-(}xeEHNvAZeiIhG8E)vnzw~!Zp2LNaY$n4>8p0XoYMH<8>M~~J=K$Ka(Wpf&+)p{uBOJ?)= zDyFJ*$?kf;f2;nFsu|(EXWWbROIWwLgtQO9OF69*%!XmMr4Ft%>q0r|R|Yq>>86Xm zz{mKG6e=l?u1M;PT$Z=vUnAtxqk7-nyL`;B$0hgSLF)UrQ$5^hipAusmgVq@g_g;&JjtV~i>rL|Gvd73S4=Mx0#}+ztk`mf&Zoc~WNF(RwfaJjCOhjctKGq5lkm*UZT3=n z329bF#AjC|);p>7c`)itpYs@&?#FNdUe9sH<}*+|i%=+{eKd1+1&)x@=r@rxQG`Gg z5cLimOyAveDBB3iFx`mgOezl@u+VYc6p&DSrXlxI2{zOsTW=Q+dpig_+@oM9Sr~nT zT$Cs{2fwDMm!m;|7F6ai)`qjO!y>GVmw9~v565eN>Q7$vII{a=h)3;gY?A4GaA>|{ zz9M9y$(^XB&01Bh8kDh`xib0Bqa2o4zA<>}y|v>(ZoCnK&*GNhb8(a^1fBD&S-Psw zwPS$QB)9ahqL}XJF%|mjm#?tvKiZyESEf_S7&G@uM&Y!1Kl?h^05`fj1B`Hf5r0Qn z@#nUep{M1n*CRZ`nPOJ=fh2rbLe|!2R4oXsHf)Y0pQ)K$4w{nyj_wn`E$-uq8&=}7 zE56UWk*L4lJ0>n<0LPI>q`<9=g3vnW82wcl;dv}KHUS^&dD8g0`wRJ0bu(ve$IL2m zwTo||JnBys4V``f!5hjL~KY!93J7AtJ!*K|OY}g}_ z%VMs#F@*pzPiAF?5gmXN5M+yzb?-=W0@1(b{0EATY`^Z*j+%T?aJ;#We1{Gc)W=H@ zZI@#dFvkv(TS)yE#NZIZOk}$gm}VHvF3Aoxrc=9oR%|~XYhG1)nj|8K4m)w~z2SdN zc!zg>9Nsr)TfRIcHTJ*5QaOPelX(`OZX7NGaCi>Zya3-Dyg;)HWzTY(rH_g{gXOI4 zTK=l(`392ik@**@Q8+HUDjBs54+FsrGj=ITL6ZrK@UeY2>aI!__mKbPQsvJ6rV>mTXQl1$|1HO@7pMNc$NiBtXlP3xP4x-@My z9^>}yJnG%XapT%;$M2E1gLI-cQRW@J8auC7a@=JCt8kBgtpldSHH8T=AV)YnST}i8 z|JonJyoluP3TvuU^XKULtdEEA+F*>F3%7$RW$ufyen*t9o)TJV5Vk)e*c(pfP~SmY zFHSCs{>P)yc&P&-V7-jqrCyU;44;0|WJz*pA5Bx1Um=g~SK-YB8F17Nog7fTA=T&U1}Uz=p5G2AyzqKWJS2SnhOtT?w~PBx!u zlbzCqp-v~w`R^*2`w9f9NC*O%ig;AQn~H`TX{iHSAvjaN%>n}il$e=F-&_D#&D9`$ zdq-9FMLQ|q<*b#ylR7##2SF-M0UtLpD^AY&EDY!OA4~eNUE_C?=^_uu(x8eym|sVK zML&wp#zEO6#@FdViEyo%eC;E;U2$-Xo7tAOhBGYzl}%yQ!MII$Qg6Pc{XTeDRSU(@ zy4ft_T#4_Fm*>#3yD$&_uA8V8W~$H>aMnWcI!YoVH^d+tw%J6TQu3fjcSZzJ zP=QuqDVSn}4EFTOGQ8i>N9*{44PgI+aCaMlf<;e)yY_wluQZDos96gK>kVC)-P_?O z?{%;+22Xc)Ua=N>Ht`QNTeqSwxPScv?C8^+j6 z8$}Rq7bY>juo{hl$Qllel5{8P@F}wgK8%UyN1}-|e&u8H(v~h*50# zAy(AIu;r1aztemTJsXF?i~sT3*f&nY|0pr^#`(o3M`>Y+8mLXL?;*#x@itJA?58@u zBW7SQ_T(EYz9WKJNcrj=#B}vZ>IV0%^x)@0#;^zXN&tgYT@%{S{6aJR~$ z$JbgOO|K}NFlKr9YcRE$0`887oj#00s0q?c!X<2IsJy0j+xPh~MCsARU%E5UYqeY# z*jZz(Hp#J4pvyieQM!%>4JR+MN4u}b*cKj-FlWU8$Pr6((vP5~*rTOPcoBvjodq{U zw=Pr<8EE)QIaTo%MG+3H+k-Gm($B~jq0;rGW}xJ{YBFw|#D0v5V@f9jvHCvhGl})F z&(zNwDS3Og=Otx*B}Nm`Ev~4y9pj+tI=@OJ%uVt>(&XUkAHU`p2W`KozQIp(=BF*Y zVKAnPnY&=MY1~3<+Sx6NzHt{}Fw4tt6BnTY4L_Y>c1@%H%QVNiQn>X!b1Zb;Y`7jc00*_?%Y<;Bm!2qeE zk~iursQz?W61&if@{O&|+$FV9#8#yl+t}G^FSjF^{zp%;cb=}C^cp(4H5rl_#dBA|rYGpU48vcZql!b>_ zysUO<660%K6@7D%k}(MP+J@F-tUq&a6c5G77SZFEka**w>tjF1g@pZqY>$Y!JV}zA zH)FXkN*P!YsadFoPDi5}S$}j8S!SSUrM$7?4xEP&Hh6cJRZL63BZrO}eFg-9YE{x)UyNStkD~v9XXd`@lftVI4~Jo)(GLO~ z;-wQh`i+k?Lnt8V)eWQ6SlaW=0wi&@1#btxSQ9%8c@nf^y%TMk=KzQpxJh8w4Dm7* ziZu;v6PP&xbZJI`j;)S zV<}<+^({39dP%22S@SbHpt*8iSqqs0IG=G+MNNX@X=6&q^J5V}-n|2}{RyVgZHWu< z_~o>AB?*nP&}Xx@PyH1K8hc`DBLuufi-TE*X$}MIC!S|tN;>6Z;KhUV7{#DejFm>geffVvp^j~6w1-wtvq4#<+SZ*IJ5nQXkwx~zD^ zQK)8Yq7ljdme8{?$#Le6TQI$dLPSknzDU!nguRJ%Jvu(IHu{b5_YrK zi7~09GnRWK%`O5ZoiU)AwNx)f zWcyK1{piHBkf}Pv<=WQ?Y?=-}uue=)eg48enB`YlnIdpQ)*E)aEOkn@JoP!N37vVm z)5NCDAG;1dGZ}vaPNCX`?oH~u`qcehNbe+*F6!k#Ma#?CGnTXjWyNT@N<(t$2@izN zwn6UXDb~+i8Z#xk63Ob}y3cM>RP7iv%0H?sOPeWys!If%K`{V&M=Im;c! zRgu9eZx~$zyf|W_qeNi`i0pHIS4T1p`CyRl5(0_~j6e5@Y=g!NliFCG35%}gXKoJrfHfnhaW`UoFc`mmOocLf(eONL=1B3`TB+$>oV zl=Hi?!9Cun7XPwp?JlSB2en>jrrhU! zmXvfFZ&^Rx>fJ}=3VJ)j`sd|C`2Ez#+u~u?ZJ!SPaD3lzj13JtH~$j&$0;vQFD>=h z5$H0fM5VW-Ixz7g=h(5`QL|Y~Zz7B)RVN$fg`19RVzL1KnG0{~SZs0#+a#c7m@m1X zs)Gai8`}ag!06sd_3@JFjXw_=1)}JauP1oBy4mF;`Hiq`1)MqPKXu7;9$IfYP0=rP zZ@&r#0?b7^5Qr|G?pzmwDgx!v0|a0)@2Q|53^;F9xb?ASQx4AX2MO1V3!Szu&*UC=9W5^}@)eozgNghCFinW6UTfp~l%rZ5rL$UJ zycOy+7)Vwu&8K|WjxC$TOCVM|;;OLu3(G`6{$RquJ`GtHxvoI3h(|;>J$=lIZ?Dxf zGYb&@_UIECy1T|=6x{t@Rn1$dA|4|R5E%fuva_Dg$&A>UR2?sk6ZrLR zosxvr?Zcu@k(ebt8#95|LUho@dEzZp6;oASwDWZ7U<|6IEUlsNQP=AggrDxlYQCHo8cprVz@p)oQ_uT(naIRlkB30C!D&ZFf38>A( z{@lXqOMwPI%^us<%N5D0u&?NfYRgwc8?HDHW(UvVQXv2Q zfYOCom9xQuycui4mlo-0Fp7Lx(Wc&Nh$BA4?Fe*-7S5B(eH`bNe7hhjm(ES`ZFU@S z4Xjs9gzU1Zn2Q6FpG@%>*9A#Ru%i4OIq2qjP3rAr$}oDM4(eFKE}3YO^3r3Gge$4y zP0}0)*d-l$DoLbXi%QAg(FsLB@=~=Q*L0^;=z!_emmBPOD(JRj)j!Gr;7RWuf+V?5G9j521e~h= zgs)MEM5lIhV02)nE@!T7FQ=3(XJ^NN@1d+Jt`J#f^hCSycwyi3d|5P{e1_Oz1n=x& z^N_!izGRq#*@X@t;=%0D<`YB5$RA6leL0=7?#z1z(MY1N;xz`0LmKACW*YAEf@Ky| zE|F3$-UvBv6*p#7E{D19aUdylbID_J8jX}+xD?l>9A>mQpk~QCP<%=-74IdO$(IrY z)Yz{NzheKFYPd_*67l+S;iKicAApNJr!g8}O7=HgH)9Kk z?;B67c!=>Tk@a5t@mNodqF z^wFj<@aG=?p-@+wN7&zj3RhN}E9CU1+m9>HTQ<(5E5y}y4o5Vw2?&~&Srx(lF614O zx=VckI@RBe^0hI<9i3a6A$QxE&FaJBWU4+#`@@_cG-#aP&C}cepV7V?)qehvzj}U% zH!(RyT#<*8-=q%M!n6| znVKIRhlL&XNZpToy#z{cJE~-)oE#P!AAf9oMXEkjKp5A;$?hWZ;XU}gB!hhhGge1Q z7Y@W&z%`CMLNARU2C zHut-+290K){(i)YRjGaT-I z^vbQgx-*tAAuWvwkxm?6Qj*}aOv09vTX^EKLW;qhlH+5dIXZJ_KcwcSk ze4-589;-A+W9|B0z1f?xdS_(!kg)x7$)#FP2W!n&aR2u@Y&{$Qtm+_a28@&7oD${> z;@)_&^ds6PwAI<9laY_r@$CJN>guV}@IVaPr~SY1z6r6uBhWsmj>Y>0q832_2nJVs z;~dV|>aE1!((5)Rs26iq{aC^KRQQIZ!R#gxLtA@ohN7oq^`U_sS^+f_hQO!@^64$; z(pJcFVURDRdOy3fc~8B4xIXU6eDV4_I84nzU6fpiECM92%TLctSKB*a4XT!zj8EVW zrMLgmO(->d_Tie_^hix3*IxQPG1Lg-ciCwuoIK0O3|F1~gO9~#wk@1&DhMKhY4~>y z291#Y_sMe8Z?a@@@WO$kMbhf-T%>Ns^Y zk5~M(xN?E&oz?Q@zO$ex6wOw@LUQm;c+)%g)8*9VpsPH+EhP!`ML!CEq_Jv`dNb#9 zu3eQiquSq}xLzC`VTBK+p=?kVi%iPogn-fAoZOa}g98f-OABzTKI$LiZT6|@ue!RU zc`Fpc2JOka zwDBW6%hY*c5q6}=-eMye(06nlCe6Xm1w|#fu9mcxoHkiaO>bo7|tLMpDz@<>BE$+gpaD9RXlRRsVik0NsUu zwzwcSyDH`)R7SOIQA%7KVdcS{GcitCU3oNb;-cLv%2>pESFVcBc#KadDDKL!iq|Di zxBSF$c$AusE{xHQr(yXd()I|7sfEEmv*eC7Zu1lp@Ne^gd!%Bb64J9r#QR!FIn@<`-`puwSv# zrW=-jh^?~hk;(#If!{}Hh*hYP|C_Tr=+Hl;^<^$-)6d@APZ&l1!qM82*)9jMnhDtdjNZ9S`xD?7Wsi9t5luquX2?O1wx&k_?Eb z_M(>`DZGO12bMPzs2R?-5QZXV==P@Ztc@u1Iu(~<2i60Qs|d#6XfC85-gjm-ci34% zaDGJx{L3cq**kq@i8JoMi{#!=JvP2_YBVsSz}O`U*p!}+o6CjG0}miNnnf-s!P-+o z`f$jx29g%ak!gE|&*T8027Y)z1WGu0S`~?GrM+cH#XLgMTAWznEM1y%PD)Y)nLS4o z!=+cO-sK-3bNAeoB9&F(6nGprr?=N!c%w!K&n!+peuP7v)}!R15o0UzMLlYM$(Yv5 z0Sh>9e1I{V8c1y*xs!ysg^8E+a)w&y~c;WGq$e*> zv_6T<;O12dK=ucQtMT$GP^Dv!arp9ybHU{a;ijS5gxGrnko6(F?=hF&wezhUOhs&K z$r)blH`q#FHz?#rFR%YbqdmsW-h{WWM6hLKikkg|{9wM-R{7bS>SXeh8dSUr3X z?bhC}#qPL6iTd3rQo!&_)|iasmaAgV)|rmV=blI1yTvyCs+;_LWI zM33dICj-#Cklc&mD;)=o)~*>LE(s8FuG!tKBX(KY3`-&9^S)Bhx_tW5({oW0iEgIef@HgZ#5ue*Dd-jun&G z56CiIrN4mLzTRWmmH!M-s`?3H@MvJLc~9U1S0TjQtpHmF_hP*2$Aq@Ip*5J2X6rJy zyKeN@GDpfit<&V*9MPUe%(5xV*H31x*zrVTSH1j+sjA#>y<%R_CIOZSc6Kf-{aDZC zl-wo?OS84LSLkaLr28@K=h#T|V(;w`tOTrfs$)B`^Js_fOw-n}M9Y){l>O0kxDJVi za>&_?gcw7S?@@%6>JmYYNs-(_R4~XgmMFqO2f_aY+(YSGXYo*w zxvwVqRaa87os7aD#9im_J;j2IfJw~t9FS&@KIKoPq5Gv9^?EL%H&F`hV3#O@3F|$I zFVGY{`WF?5fFce19_S-aMFBLj zefuStit7LCkHz4Dpj{w}Nw}9jDBavYhtMXhig=>^$Ds0iH2m=1N|d=SkpNo^Q<-lk@t4 zA|7{MFGwJMKr9kooyk7gb&chUj&E%#+vou;Lz|?pq4&O zfkvRoNn}>E$;A_fyY-x$<<{jRmfLPXMF1U)6m|@V9cu*sJqplafbxsXCLl9ptc?HX rk_Hy=-7a(1X!HA diff --git a/frontend/public/apple-touch-icon-120x120-precomposed.png b/frontend/public/apple-touch-icon-120x120-precomposed.png index 14e2314b3c3ca081c44860eee7a372f6e17143af..0e2d660f98c175c58aa3cc19368ae6c33c54c533 100644 GIT binary patch literal 10051 zcmai4cOYEdwihINCz2p~@4XW>2BY`h8D$8A(L$ zp<#|f^o(FeV08&wcQ+nuJ9is<9=MwafTN*F$-+IXZC&hPbT;;m5U4c6K}$OW9mGzW z!B7~?2lh~~cY>(+d)n*zYv|efyV#1`G04i`O2H)n25$B+YdW}_E7VH@F3s=B-85jVZ?r+RJoZMmVUQX^Ff1d*C^*0>=+Ti^=%*)Ti$NSF%VGxIZi1jaHZjrx` z+ruIMh5Q!z3pt>^|11#P+T%YFgTendxtrU+2=4_`@&Od_H>LiI^#417m!6-8J+F?v zm%F#8t-X?uJru_H$NT?XB@zmr_I40}jgIoue@EP1-95qXcJ|T?g8v4A6cn^P-5nsV z0OqChRGto`q#(jCE+WD$z{CFs?XCVKKyKEK_UiUfN0^f|1HS;@zafSYyT1UpvbuWT z8e1QFE0(}N#u)trlV%VV;QgnGjQ=BaYZM7B2;AP)ND<;@5A_1L{zHy`pvM0VRk+oF zE)YAwYyLSKU{VP{B@hQcMQa%FRDe%Fn46EEo1agQUrd5eL_&a{8@TfQ`Ko_V1Ce59 z4YU6L=x_a2Bw3Yj5|5&H#3QqF(L}Fkfp=dpSqI{L&0^4h|4NwSIJ3w^2hUKqml%tmwZE@pZBX z*!}mHwfgA+) z$mK*syAuKd-0d%JhK9zL=$$yqsi;lfCo8BRq)gu1WkYJ7W zWNqlssb5x7^q|K7V?-)T^YYD4iK{}fmBSJnLDI+fd{MQsN3jL%Mw%HAYd>+f zEj^1HWP*P*Z%TT4N~695-hFFjoE66`l1QBK?&s&Z+k}hn3e?xM^HT zbf8xn+9x{FEG}k0(&EVPPTjNzHLeDsG`uabIcVK38)?c#@;+G4(_+0hm%<#y$Z}M@ z_!9Izge<6_uyIdr@llq=n}+WqSyc)rsJ!&KrnSVaSA8q%51co1S8!YLG)99*#G7CA zmj_NU@9xS+^~`Vw-^oCCyx!zKx?OB=JXDOm(9rP6Za;U>GO`|^q0ym%6y@~bS$o+} zVbo{Yo3hCgjzW*pRWMb;=-8FD2N21w6Yr!)B^l@4mmUXZAxDFVyfUSCA)8_WCM93| zY`=6jR#9_l=d)=KF<}!w{C-bjbHDu8LEa-`P@%F_*Umve%x?KF!=Rm;!FEfK>+_Uv zj&>bHFbuinrYG=%Z;#+~MwnkQ5gnMXUs;H`RQo<}_)7bpT6Tg6AH5wdI8F(Mk?q);S^r;swvEIE?dv zW!l=8$+T+#E~3tre?xi5`x(zs&G%+S8gr)qTKuqv$jy&nmnj(M>K7Dou#_F5`C@_f z;Z02Miolzqkg~0Xn>*o;kMkeR8vh8G!;y{-zDi_xTwEc zP|>NrK)x`V_Uz8}Kc=^RCO!)Y&`REOewV<|Ni>frR<}KlBJbBxfw?9I5t{71X8X!R zTSocD%Vn%E0RvZL=wkHJCm~X-mWL~mQ>}xa>ENjaa)&%mUo4xyy4Tr4O%UcQ{s{BH zQwaO(x)brA1PVcucyM@W$tyXjLwzaNU5hYg9AoXOc0B^)dgB{CJtpIi3}$rdp?u!z z=6#c#52kR7EqaAu#F{cIEwRgw$}%S67pZzS2&}v=KW9DGiy~91XRLUH$fpC5V)KD9 z@(lUQ?SFVCI`eA^=j3InX^#|_Zqz^UUyo)Epd{v^A0Ukxj_zIxFDb(F^^zpC#2(&L z@cy7BG~Xm?h)8^$!u*~XJv^EZtlr%*$$9^C1ogUl*wrdE@;g(nB0kDYF^xqN!4~3) zlfpzk6}fS|j4kvH3hkSpiw78H&PP?2(z#Xo9{i5bw{hMJCQfVC$W1G$6;tzphAngn z6|JEs2i`;J_%rzYBm>nJvdu0AOH~CNHtcqiZFP{u1*+|inB6s=stv%HU9eb4)QB0l z8@qdf^X??+4FV6l4tg-d*hi*Z`*Un@*e(25PlkM(i&c|+e ze8W{beD9r1QRw1!v=!IH_pQiRmgH zRTtmaYr)9u>szggO~~#KuEa^vC(u-*tcrTuJM$%Bk*qX&tq%)PX?1oF=O;~rnLuXt zTK3L^gyzGH6;v zUoP%EtrKtheXK$X_)EJN@4HGX1I|L0r+hy@rOdSG!nuHXDGWcv_lJJN42aTleN~mC zj{QS5T1P@dMg;5w&61ajvG~L|zxyGKM5<~LZhE$iFH$g@tuk)#GDT~Tu+>ev(W6Ae zXI}%%Dk~x7gQ@l|Zjq`GazKJEjiuG3UQJP2x;AdN$*Q6mZ`9@@@k*QBc1tDNCh)B* zEN0ggt8FAWa4$#<9n6*yKWw^5TD}fwEHW5xj9Ks>YXjY%$I&`NKx|6Po;@8tC{ z=v|zR7oGYGd4?DZ9;lzRX|FAPzP(Z}g){w_^vmJ(s)O7N?<~tSW`3WDp&_;+y+DO$ ztq%d|Yy^~{DlRX6QyvV*6b(J${A(%KfTa>UT6nQDe27BjTSrig4 zXx7_O=iPu%_YidoYT23TuUAuoV7oeRDovt^DfanZ3_7BA& zsN3ay_6dvBZS+MI5lpTbk)z-8&B_qNl<$><IG`(ZUDr2hAhYN~cMc8m* z3lr!=7GdP+smF2u9f$nbz+dak_mj5v67jLSbF;v@+!jqgykr#CI&iW&`xo2g(>6SV zQu$!v)>dbxzkha5_9ncs0wHRVL72_=fNNz_02rkT#168J`kVZAX{@CqvYR<(7#;Z#6*8@R(=DX5UXv9YQOFrY(4E_ z&p;10>5@Y$*UvtaZFwS**)7yW3nz}$K0(&lo(Ws)#jH^}u=i}T6_Gty&)3g`JW4UT z-&H;x_!3@-$ti+0qQyCPFQuN3J8Uo=v$*XS27(DEYVqUP6JGbWBitI95Jd5FTI2UU zKXtLNNaS<-1rBm9W6lX*x}Yi4yw1+-nDpjMOa$8)aF)h|n@@N&?~2hp76L1!*x^s) z>XhklC9|h|dQ+iaK85x4R{^8ZyGlpLTBHHAo-mx^xe;f28&e9=-oYlNtbhE0OhDF# z7O`j~Cry&ky8CYh1fVz>KTqC7_au)R;IP*C3YDJRO@O|gq!iicGs zGm>i{tr%3ML!UG(NM&vp=${h3<#%5ff*V0PC2X-=wVFu61rh*~W;f-W!7JbNg`n%J z#q`vRudyXK=Te*u8fuX)NK+ zuhl+t3}Co4R8I-nXD8)S7;af>02Xcw$^W4DG zs59*;Z^RZpZO)CuAcKysenw`PlyF08NdlpllclV5c9qcG>scYU#oFQt>%If;iK+W5 zhoLA%O0tFYjP;!g#=vJs9EQ;NM0LmaZk(u;A)yky%sxxCw^)^7UM+Y^Q)qky zG$_5?ca!|D>wdf$rh3vS*#w7_DMN1!&ruVyNxq_$TWwT_$rjUPU|Ct@a^~xMcwEm4 zU;jdef4bMXDx@U}>3M2qwSWI67&FkjxLgf2DG{4k7*h8>zeCxZIUEPFOg+tzhvDFtR*o35uUW*9_oan)U-U2p%|0C5Zjivqs zuk~^(b>TsF$E?F@Av6qF9Hu5!?Y@(T?gxnl(ywK_3NrGT75a7d^T;yfSc3Phj4Bg# zrOVlyPZZS)57uYgQNvL=A;UHdjgUd(3B7y%E$0I+yob9-3UITEc|vqPb-89IzC@oz;Hn}(11f~+{Y#izP1+GPFqRY#cqf05acX7mFFqXbsMp2t>EcyXB_QqX%u+@`h zkfY}s?$0QR9R?!3`z~@#^R#t%rH9(M zsBT};-3Xg#&Zdv&iy>`&k~yvxn_)`TOFJuoz0Ow#N5@-Zig=#uOxXz-Z>*|^x^LjA z+i|>!Po5#|VzOit6sKeq6#TTFSr8bs&H_jwuRAuHBl|0>g3&i+W~+8ytf4(82X%y7 zl0e|)=$WF&(s!9-QR>24qgKl_I2$CFagUH}TQ+>Vbf$>pL9#%y*`wb52E@6kkfOSI zN!H7is*kfLlX6#I<1K4jy!YF)gA#mY#M{@^$8}sU-7P{A_eb6*ui?tI<$G}&tkxvm zt^OEOsCw_0$xOM@y1Ihp{ec|I){o~usAUo|%PwY*C4}{h+%+X-gMZ%Dcr595peJv4#dTu7l-%`R0 zq-sW;y?z}nV9Sh!j6p)L3zL<(OdD;4-*8eCZ`w8*H6jD|RK)s;Ec_!4b7Vu8T*~gI zc6ZjT$hF<9Lhi4EKC(E@prV9wDHc+~B=VUYG=%TuM~=J)$Dkuhv5b2V^Z}2e}VQ_~OLmkIgOg ztY8Ej1sIk`IO{vw1!l;$p4}Byn2Y?Avf2&z6jD}4i{O;D>Qjo3 zg~jDC--crpWzNR=VVn00u8NyzraYkd2_UpOnbf^AVZY2Gw zCOp{rmELu~@!M#z1#>%}!tPuu(}9@+FXiXSpFtZy2DL!--ds;$1s;Bha5Hr0V&?ak zoPQ})1?z)#TZuGxI9i%p)4wf5RRi_m>AEYaZTzaFQVJwC-0$Z_61BA02NplVmTX3> zd*?uQ;2BU)acSDG+!n0yZ>TK&kZE${OE9^zV`3vNEZlWfq&c9(>av$~_EirW>}=d4 zvL_w40jm*9D)MrSwh({nc_lH`>=QUl(F`#jJP7{99IfXtkF)@xC(MI19jRnSKQ$U~ z=mRc;gaw7a)3%g)GFfQG-uPi7$WI#jRxWaCv&{yQu7l)d4nM@#c8HYknaMII13;Wx0BTnkrZ4BG#fb!g#KV$}M!pwIuEA*Lj z^W{>TI&&(rq_vmaX38^F2iet_D0y`%yR?oP<=MqXqP=7Kb^`zIfZA3;&G=quFAu&WHBQ zoro#gHD~9=u||?&ka#B3vrUt#^1M%T(qh60%HnAA>xJ=wh{~yCtqJ7k3QOYlpoge8 z?VD0vM-?l}&wpB8RDSMcI9Wd+fU+@p&le+v3Y_dl_v`S&3M;H+rCYB}o=Ia^N|71x zLQ`|9$BSO3Jzo=)XwLwaYrEWira?>f)noH30cYRd+Uy~nEPU%>J{}H>!$xXOuWDEk zbC-z5H|{2XLh4Q-7+}KE7j~iAWv{cFd;)`?r8v_+b#Qp2%G2#k`UG1}AbaIXbjELE zmaqFokQq|^qx;P{ba-^p*t65$Bcs@+zG||j*c!n}&TdFR9qIs-2QI>kF5N=FR*(tE zK|`0@AMBM_NC`dHIxNCu4vtZi%%>4g5Omb|9;;(_zTW%@qu4OZw8AlNoDyH_ajrdX zfaN)fgy)gbqU0OX<~zj76REQcU%zC)x9whGURRB9uZ};gkZtYr%^5xU5}_7&c+ra` zzfU?H(1EC2#cy2RdfYYhrM>fn^uam<@;iC&oj8q=+Se-d`w};w^g+|{Q4kXT zr3OBHn5|pLAvBGp5SLj7$qyc190+Vs1$h_D#t_+U0~yP?QMKsZcy=O1x|Ub?egQ9? zuOH!xV`5I}dQ4xLJJ{M^<1 z3Ebp#c~@M0d@6LDqFDa~@wN?UmxOtWG=?TNiKofG=6%z@Vc7OOhKme}D+v3}=8NlU z6=#w+zq^2W(fdU>#|5cl?JV+X(v=*oX%G~^G~^ta2}$cog0vxnGkJLzjm~5Yh`GYo z-?_FuF_r)93OA8Rw0j6b7`OiXS*|?ckmoerkljDV9)`ji%Yq8&TAiFf6KzU@JY<#j ziyc~k56dsg3;@nDvXRPta@pHBTJ|iLv183CLm#0$NE``bN2&O4r%a8TV5P)h1hmX~ zv>43EM?w$->!2c0jfd6mUQ|JZOm|dLwS*+!zMOJoQh#y2H>js}!5yn*JmnEFAB~@F z#&WiAZTC2Uk}!m9-$QaFnhHqU1#e#28gR}#lkrD@SW<08npGOhYxv%qiKK_tz8H1% z?1^=m^v02Ee8Vazt?Co(Ih=oena6?4JxqUkcDCFwe;`?ut5;2IuJU>Wdev3A&{+%_ zPANTcGbNaQUMpe}sfi(+oi*x;up4~t6(#u+Kbvm$gd2JGTV3A!1JKi3#THtDIx`FV z#hSThc(T;pz2@R>%Gx+q`dG5rzjhq15E>9%#7^oa6W^Abt&UXjR@$4?!E_(T-JL9} zW&(AsdwN*86Jemt8@ESWMmXq_1_ecg6-3&f$-pC+nZrSiX(hxtH7;^4Z{dEM*$k7S zuEOdw+2>8L>ZZob>F&|7hO@)wBNwCXZUW-DfVB4oOL=?!C%0XrLs7SK#-)v;6=!Fq zX;*SJ`;WyA(Y;BWs)qKU{DC6R+%KU1y5p-ZK6Vz{9(PLy%FJrh47PXbE+3+St^mXx zr$(pVzBWzenTuCsm3meG#bFwzzM3ST0C$U0ekc)}%7rt#m17ln<1?lw1HXGo!F@n0A@FK?)NH^V;IA ztX~=+q@mHMRfI!dvBSg6tg;F^_o;_8@I@Xk z&=9gzh)5-Bm=Mai+1Hz8ez|C@m=5$C-s^qn`f&v>Z#Em-8t7N170V6N0!_{j@+4u> z3W}$+tU#S5IH^O`Eff#=9wKJfB$Vhg<52TDD>Ugw|$#h4!1Mbkik{h-A^b)}JS42BSu25)*0taGq?6yMep$5 z;Q>2@^n|ix!a3MK&5#YH>d;NI8tRkF-=TdG6aZgYBe4iR#k~A=TAAU*W>{{968>oF z9@6S;;=x^sdT|$9_h|}6R_9CMz<^AOD+9yuzPW*B=+E)(sf?VKsFW3;nHnhqc|8?y z#O%G&wc^tCFb-&6ndaQlYP@9X9cT3;k14zBIiR#U@S~}%Y@%+}xHLwwqilRzA9Csx z-U_8AY?&Hx%3zBLD`#`ch?(EYEoe-)jXFJU0n)aqND*@bPsD0ox8K%huNX?1D@NQ5M~7 zeaMvj^X!Oq1vRR`AH#FKZkPd)Y>v8IOgaD~uZE^@zjY)TW*}$0W+unP7iy-fA?;VY z2j4~}xtjV)(qp+1yeWJz46yEz-vVHL!LfNI-=|dc?UZ0$!^J1X>@Qgb0|S3E&<6h& zPB#nsIi_YLT2TAuz`QjGI9FhhI@hb>@t16I*=oU~X~56<_|Um?<9KyR@Z8F0KZQO| zViD*na``&0F*JQFK2K;544+t8meiDO^bbRcXy*=EmvE2w)U5;o*#_t>6hrbka0y!o zO1fVyLQO@5oif4{Ifk)v%$LvHLxyJ8hKeN#M6+Oy@tSNv#gx)6&rq>*)&|ALF|O-r zGU>dxKm%Q!!n~>@E+&wCqW!K2LDOLL z(hmLd39x&ACQbwNo+3JZL}A@@%?~#BG)GQCzW%}k%0X=o_h6xC<^}i>klfT`Jx>T{ z=YdDw9QFM6kR?>UA}D_M=nK-fpt#B0La!xBm0pb}*-GZUiYtFKmni`RT4Jlz1F0}7 z-+BBnXG4?r?KfY?rEkYSwK=A$!2J~g2J7QJO`a^#+U$&+jmY@S2V)nC@?6*8V#KJH zN)OxpW1s=1KB7FZf#*~nGxP2Jy(-tEqNedA3A|_~%RsOArJHre-%C-O50HZTsqHQI zMTFz@($G;^C0Va#Uh>d`1Y(Nm2P&v=G?|>YbWmowX=bJI>a8H3;4oF52tF8WkuGtB zPn^o$pGR3BNg)kA6I>B(SysJiJ-kyY(EfUP$EE3f0&Da9dY<;#{!YbE-|9RAG9JWJ@hwn;_SXB~QY8gWz}B z@ZyQEV5g4@Xg6mYobK=0D5k@ZHpeIU;o(u65c-uTL*dQ>533K@w0fK`qGOC8W*zrJ zJ``z`m1&!F8@P>$&wyQvN}<5_$U4Sk4pS!hg$I+8ve$>YOL?FdMIFkr`?jNLNd}%J zexHkSjcT1CSw2OT2P~dcm<871w&O2PZgx~Fj|uDB%SSP*1KY*`2@@wbLNa{#Gl^ZG zwPXEY4Uc(sKuGZOU0^MKn3KWWoR(|E;oh=x8SI+09H0?V*k9^nxToti-`GG)Sh-EX zsqCgVI6W)ZZPlWL5ySP(NBqd&?1Q<6Yk5(Zy0uQV-T-AxVZC2W(J@8^`wN=vB>O2N zec%*i9pQ_YQqCiQ+%s%&#Y&hlEPgcm?4J)`|KHQuzYy429clCChhjx4J%pcV*WCUR zwWq@=r2VN1@GcB3#8*dimtO4^sy%_@rM<38`%S@j>NGRaL1=>?JJCRm@|ebi0*Bn) z*HYdXMCdH{Q=9TBM=}N@2D$r2snLJa%wConOn1Cm7CD>%PRUa{f0fgrT_6+FN`ju; zZ9DrD%K?V`4&IX8CxTt!9S%mdyuIf`+}^Y5@$gJYEkeu+_=CWU+y4SIZfq*UG%q^{ z=3i}_bfW+MZ literal 4844 zcmZ`-XEYp6_ui6Em*~CM=sgHxb)vITejy|ggwpkcH<^AwKGk2adcjlg%Gjr$8Jx`LJuG)RFf5-p;zIOOhz)Ma501*oST-~V<+W^OZ};;zOKA_F7$7PopoxMiID{PoC%kzPOI@mVgtgW{{f)icIKiY6BzqL5%eX>|i2&ib z0)h6WHB!H%HPg%|X-{fvhzH6^5J-ZdWH62+?pmZj#Zlufb?i}6s8XUy!=%Nvo@PsI zMsr~jt-&Cs%37+DSdz=Cd|{1htIq)1cmC!2U6;XNOBdO+N&GfdKpYj{GyK+hb#hXOdw~g?D(45rEnQHeSZejHvCW)CbXi&pSk*rCdrs z7QEClGI&amT2Z9NmXnZ@9i<#x??NZZ$>Qli*3!7qQl0jx5L}7G;@g8SiuL1HR`I}e zee0>SwQ+)a;S?<{6%gqm})w+sg z9N*hGB>JJco|i^g-QZUY_6oL%3ogdN?Y!OL#m?G_ED?eh3-DO)^6L0TZh8YvrdP*j z(8ANaHWPdAP%`ru3aJoC(l-06c;PD>xRuYe@!A_*j#|`{zSEtLd2K(vnL(9s)~mE{ z!l!=lg^<`IH#gZMlNWSRRUdDAE+=FMdib~AC2a!OvG^J)yOyr$?a;sja9xLR=@S(e zIYI8WeO+j6{yC-9US!mhA+Ki>tZdAgFsiElPl-5XDv(>^fcHwGKX~6AE@8q}nburp zhzTwnN0ggycDdZB*(DTyaobU zNB~{Zf4*0*!(fkNnKl+wLIsm1z>Ybp z$BJImJm+~_PLyM;=I8YadyP;P9gn=wO3_H?_PYT?$4SR}gz+sBmgxKwPLrR@gx-!? z(VBJv{gnfbi|tG>Pl|7`af7p-4T_?77f!79WecAACeIcYgAz1#Eknx`MH!>%MYrzP zxWSi&rS4n;-uGEzb}37+g;CZ+?k7c}8F7(4F6>!;p(1Xxqk zrbQMdw?+q7`q$l1*0P*w+dNoFn=;)E)iajK(MI6?_GOgT3wzp7xlP_I(hroastx&G zY%i@|znUN)1MLpg9xogZU$Sg4`|b7FoV!2c8xwNN-&U?sdu&y_Ff0N2H%-EmVrF$j z-E`gjow!>|?V$hCEJ5=^36`FJZ|Hp;S-N5BK#6YsTm64^%b!wAy30o45ZhCTG!7*A zVUG<`K1O*iIm^{I`-eu5SH~`z^!`L91Rk3(pVdSiCF#A0i5UAD?;Q7z0+5b!;3tD>y^)l%u z)B%Czr(uO)!?j9GO&&@{jfxA78tiPTxFA~vZYOn@Q zZ^#_h>DX0`Q9_nT$_17~(4zNkM%H|zDnBs=a*)!OvylBP#VC3Pqvi*DSWa##H zczG+$3i4;6&T*D%xud2VJ0Uun^?I=av z+t8sP+l7G(98bnt~5EV3UbBnwTOFOZ$u)+L{A;w)G9bX-YYugF26Fsa*{!k8m z2;Y<8y)NO*e&DlQd5i>lGDs_5mxZNH*%Mt!NmQDw7y z>Ln*b`Ae9`qq$9ljfN`otaH~)s|fzXwnmN4b6-!c6@lGlXneyJvi~ldX5EwCY~De+ z2Gf#kQ%(PJdI^4=3+77y2Nxt(XlvB7 zxOdB__ZCHSEqva-_#Q@d)a3Yi|MTn9IoUE!4&RNu%*I@`9d`rOLuPHJYz)it$XT9C z=ov|MheP|UeiK)TGjzy56Z2Hv)&yCRZjTG45B>W#Kp>m5xL6=dp8gN!Sg4sG4=G;I zjo(lIP-$cbC6d%G8W^OM|J2@EIxTj0K(J1CenHq#(Sh^>0e-OPR*)4Fz4CM>;R+>|@RL<DUq!#kSuJylubezh#r_GYPAwE)(E|Jx-Q~6?pFFAPa>KF9f zQj73$wSb+WId$ad`OR9!Z}xa09uG4GPXhtpyx#7E`qE5>z4=ueYtyl;TvPue^~|wL z3$?H0+e&eq#m&%y{xjRYB-JtYt@1=)T(gUG-Gu(ZKnLLqViZZc&{16X{2nu3l&X5hq_NuM@)QB zNhWw9DR>va;RH;LxIYYX-_eg3&o(FdJ~8EzZ*QHZeqlQm0>;@91fY$MU%2@Kg6Bk~<<&&U4pG4zTw+&#xJX+!aRl^!i_t3Oan+p;1G znhvlby1&>mh9PtviFr`TeCVncM$<_}ZgXaUhpS{@(4maJ7P?)~+{;}mqdeO3!x=$)*TqnL?PiWGGRRixa z=?1RTKUMx-nRLeMJ@yN3B6|a%Ar$lX*3g5+Sc*8T#KEK^nf)d*rN|3?6DD?-la4iU zp;yi(k)G+D7Fw-TRflu+a`Yo_8mqbEE@cuLc)a0xF~m(aWpFFtWW+>$q*$6a$gf#D zTd21_DF^u&gK_wmE`D{nN_H|3%EZ@so)6IGG1H%Wn{ZCC5~3Vy>PPImIP8X%2>2J> zO5Q3U&5)537i7mj8q}m*cwP0r6+u?kUBB#nWMxAluG?GL45%+nS^boN5m}2+b^!uZNP;FCQ4HTK91hW7{+k3d#m z2=B5Dq3!;c>$NzE&J%@&il3&sg87m>t~Q~f?S+D9%~rIi6#6@ zna)-3bgSYi&v=+7xf9d;qu=HCUwp8i{qnoPefjKSn!G$CA+|RKz^So%Xxu{ySee? zJ&3OXr_||Z{&gQsZ#mqY@52ze#Ffhu6?Os8XGAWeZ_N@U6%o;HK7#367-hEylCjtA zK<91g09WnJ1(sCG1>mV7&k;|_j_0fczNPgE#|oNgGGXW0&;s?^l)f2p=GTa-Y&*JU z*(pge19QV<&e4hM-5AwUHwZnA^R=#eBy|CP@Ts1$W&h!_)reY=PwxhLTf(=x7Gjq($7cVs*K^HtZ{qX)|z&{ zoxwZxkJ>^*=KULg?H?Sq<%*D=x=#FUxr>7v=ftTBtR+aUDEM^z#oKk~4Oso(2pbzb zly(FPT~H2$OG#SGzPY|#FH>CghpF+#BK>LX#`el+*ZuRuo1K}GZ@xr7x;_cN`PubH z4i?`3&_(BwR!AN`EZ57aKEptOnAylHsqn!=nNgaW+qjK+rgE>Nc4=CiP+r8P6x~l@ zuIJ(3AN>-BekvdjpIk*n7kuO7s+9jZoMmcKCx1I&KKmoA^r(w})_>jDkf3#M!le|* zeibDRx~8N>|9WGLx(N|Y)uoTG7IwsP(~T7MCq~g%NQ^D_fdM?u625QTJqT31 zA_#q|7P~4BBl{Xmwe4>98Tp!p{bGpH!rDL6K!AjOkBgh9GizX|uQRKgZ=mBH301IuOb+xj;pQHEHZ-iUVE`ax2MaiY zY1nDBvL6uAu)+~yy-tMe^+v2ib5jF-!+j6?NQV&W#hL`6%WvhVA2%5`;hUH5%G@BO^b{eJHEj~R2G$8mmtzhnI#=kFs}TkHIReaH5JK%fKa zYAU+GU$^ZK<1XO4cyC$&2n4=iqh~}h($tW`5gkM@mP9OG#LdA8kb^)n@@`HToE@G5 z!Q!oK9A){Y%B%PwHkPt{hT@uVO($i%wT+qw34hr`OAqH^heKQP$;<7Nagzc79Pktj z#LdCpku2pV%l89U3i!Q!8^#Cup+d2fr=5FH`gm>4XPN|EK`1LTn3z%6klXucPBhd7f&WqNjN;9e)8A- zktyd~026<6*S`R8&IPdZPY^ct_Ea*3grN{g{~YKSg?}*F>6c*rX>~vVD2x5cS|@8F zg-Et0{*6n2ivM91iVfj!ytFO(2X(xg&EKeROa4%|#7Pl|BnJ%OK#Y@VNnTB8n6dg9sVgI9d{2$*2GP6kY{G z!OQZA!bOo#xFl2*r3V+25|fld!iC}DQeyC*+L}a58-n{!ZE+|Z0Y$*|5Ry{cdI%_7 zLJIziHc(%d7z*ZJ)YsIM(#1Pk+H6~@Y>y$6W%(@e1Ps-l^85OL#wC&sQ2iKt6(Wwh zT^H&qvV2skjir=?_&EtNG+aVbLRl4oP*GBpI47ziDTz`(r>Lxigrk1J`1RSHW?)Ig z0T4fZDn&qHa1uBa9EwJw2~eaM5)1soqM%ruBwic`ClDmj*k1tE9my1oBM!g486XrQ zHUJn3Cn1K!i&{eQ;#f&2iU2@hkw{UfETNH`q!i|opOBl|<7?`Q+mg6JPhsXJh-@P;;)6l-85(H&EM?BRz%1Mg_{ zt7N;nq<+|U8DJ5>z?}{JxUFsDhPO9Tu>sPF{9}W^!~G$>@)zlLUx&y5MM|-u*yDd( z?euv?d&l`Nl|eWLL7=l0fmZ} zKq8@NI93db5ygrTBqSuzSWEm5??QGkfRgxGVB0xu3FP$u6odG`D%RgNLi(GY0NV+| zjvv%)$UyIN|0NQa@y>sa#1H>K08oIIq%gRhTqI)v@9miVyXc=ePZ9~o;PD6);4KL_ z6p0|9p^}mapsZ06Sd=&h0hfT|{*2;kjR#U)6poO9!o{ItK#vrcLWoL03Wq0%0j5E*C@d0+BLM9S14qN5SUeh!k`zS}#F0C7^m8A-o4rjW2&gDp z4}p+Eib=r{zYxh!<^QAE|Ae!CKKwtl7)Nw;!ILO|4Ym`8gaO7tJP9Bh0#HPdU)k1) zNT%$JZ4e6aPm(`)_?OQ7@ANz#jU?a*a1_)Ma4{4uhC~Bj7)vNx9O#}H90H)EzohNo zcwSumKkfN{vBduM-tv3Z{A%&v4J|*@<^T6wbA$dQ+rLk?pDO>>RKts5Q5Xp^C>|jO z^fn13KoOD%EEGwQ5EH{7C9yaR;h*=mzfOx{|LIiwzbW$noa6uH3GrtV|6Rua#~tsq zGim;%CH=ML2m~8oigSl(Z@+9oL?NQUYxd4u{*M;^&8x+4Ruzwf=b`*Yj z>jq|loqNFBJa8-k`*|(^T>Ly)045DtJ`!+laGrD&0Rqwa+5ltkKa9H|kWd6QqD5Fm zhrM22Oc|-lUR#Z2HL%uZ09$zGZ9APQ&}HyY?*2Rr?$uH`>AxTV&R z04>6JG%vKN4S$*}OB`Y9qhrTEOQ@aC^?rmbJgOQWU=J?aAD1jTR(OAo*9uQjQ@HIBZAm4eWc)tkvSvj4r$JI@hcH)VFU+H(zx^edrQ)S#69! zXZ8ZeKTJ+)SI8ictpE0huKi&l1q9-1R98{db4&W3Jd(-T~|DU$UI zK0u9*?{&~omH}`zNNF#}w0GZ9HqO0x?5=oc8`O-tzgObGxM$UgFIDH>f%&TEB3X4= z&918)|&Ov zv-&u7tc3oUQV^U)MScIdT}4knw8N+eoCetWy^?JPFSTzCq^vibyUqxreh&ITl)A1Ck5${x9U7LRw|a;rUvMoi~QyXV`KSx~^wPuVEYAQdk-N%5@Ma=(d3po$|0lm6|Mq1Q*aZ^dzJs?GmcwedawHV z<5|g3UoY;ygV4bSf1Qr#>ar=aV`On$YLO{{2pAn?9*BQ2(}w67Q@wi7+Fu=>(s*2s zi(95n(8Jfv{Jkldmw)eywgy;bINn7wy^UDoZLZXIohj>8q}loA0M!-l}#u!;pnN-rhw9&7PqFOoHdXT*!sJYlrc#g|plCHnE*%ALY7;mROJ# zubT9n6qD7?v(1~h23EfS7xzMnl5Wwn<@bnE9SWc3w)DZYHnfvc9}XL6t+d41O z0vKu=dTLj0wtvbsYeh9%gy^;uLCwU4-7i7uI{EImeKEQYR?_;)zh|}B3|dya5OS!) z?<2!8Hj$*sF)3%o*T=2#i@0dfdI~A5DXN4N*%sE`=vvC+FtuS|=qX)&#EvNofyM~zq*H+No z?M@wc^qJMNv1xA0Gx4hB_WSNza>2Wg1~{p!eV14+hxY5+VALW%m{(2GnoAYaPW>j^ z=YXnkdI#o3AJ+^`VJ|>5{To>xGHXV_jyd} zN~ytVhnBa>ApR6CwX8aZwYl2aiqiU_gd)Se(W|j(<-%c_wBva>!OGfdht@wZ^reTY zpSZnpaLyaS!Rx=)erL7TFAzK%d3^i?Uz$n{bG%)9Y!>;lyiG>6OA8}ixTK>{ROM{P z%3NWpv8m}{xwR1*LsagJ$4i z*W=NvnFjf1wU`E;5ffE?+J#1d5-FEhNU={9yI`(@+`ua0LZj}h9}hu!#p(2k>6sKd zwu~u&RFw9L=D5P1FY-*8eX1(t!m-~8Y)+N0;ZRP!UmiwitV{7`1YKKANid)DUGES- zke8{`auPgE&+N~bqyqM16m2x^D>3bKk*!}!#bCP%jxruoQgc(h#m^#$e11)*(X`$* z8LBhO7WO{IXX-oZb2(|?g#u4q_Gb$|?ozjb<4TMmCo*=N(~A-Jrbxrp`|b_+>$&$% z{A^*=tf(0`jfhjBBVfNatKz}zgcMk`!IPB*-BR25%)w_ZMLN@b&|^w`YF?6+Srl^e ztcBs~Y(VGcdX}rFhb~t-f)Rr}=CQHR8m)U_EIEg>{pq4*Cm2LG7|+@jr*&YSdgw%# zuf;v0xw)$h%VD?8v3wz1AZCah5K!CRU0T~+e|xUUPIyJBlpw=3X+?j4*B{Iq!c>o` zzU~niq}w+)epop~hn@x2s1p1w2Y)?$lQKJ-SXkjZ^yNt7C1P^W`Oj{HhwG`dgqgv0 zr3vLkWuZ*^K+p29(6HlZq^Jz?T~DG8dnv~9#KF^McV9)EOpm!GAzy_Q7xSIkOkWEl zjC6G5Wzsr1vBY~56tp7P@|*&Zj`1e43qit+M-d;X6&>}k#* zdZoP|8ibFUZ}l$`mzI_!uDr(hGuGt`8c*C=s!Pv0#PfW)t{Zp$kU*4<4!es(np~h# z+Krl;4Z$#;%C*6b!phQ_n)I=S+%mxqPtYBJ%5JejwC3rX(Y}rz)?&it&_YguSX&NIGYU;*wq8#4agI)PGtuE5>b|dB+w90n-LfO# z-`c%Q;sw#A@Qi);8CmZ}wWOlmoU|ifb?_VqT|?~KyZaWOAgfNw;01m0!Z8Xg%JSkp zUZv-dz1RlpDeXtZ_}f&J$UX>&k@cX;GwZlf&o&we7anI^S{voI@?~XfeQ?Not<0tD zq1MVcO`6ANcIZyqX2UKgNE5)O8SMT?X7 zShksVj5BCHOue_}8SOqOh^a1rQZJbPkfrX_bLYv%A=KKcsI*xfhcLTvXF=~ukCl1f z-6Y2VQg3Yi(vr8+O10;dnZ_yH0odH>C#D8ZygRL;=|Vt?3MxJdtmAZ-%t8m>Hp^@- zeoPLq|J*ki{fyb#-xG2HLW|^=Q5K(xC)~1!+H34u~PZX$4vqG7eX{mJDO<$!I04TIBfXHq-^}H^EG{+pGhaaZJ!ch z741r1>2EZN6G`4$897f&aQ3t<4mLyWJ;2L~KP3l0!YxY^#`k@wu;mWk$MoG9Ctdy` zw@G$4gDWZ7;)eO=M3#APLcFakwVq8hT>Wb4eBJwW29yrrp)r}z@peMEL*@M$smk*u z;tknTQX#ARLG6#Z&x#brH9m%X&9&XoJ(!l_HvhfzYU%WFw#%-)|89I%gC^m6$t)rEi&;dGnB~oi?Y;$lvU&cg%sduhKc`pb) ze!0`5EDP`X*+c&vxI<8Z9;3nZ+~dpWnxP2AH4EZjWWD^Uo9&|T1YXnpjNvht96D>p zG>CA7ca0Lsd~TMfCA(vIGJnG>-{6c|09EDLyDm;X@z1L6XU2^?X7v_7yN-`5!CCMj zx~aQ9^s6QiK0RLP%%mc`#69 zHRZ}2>cNB4xP>A0UU8liQqwn=`nb6#3&ReF==l0hnH+6~78V?x+O(8BVC#G=o>d?z zQjNhQFdQ<~##R?^p4T=!IV9j{NX`p&7|-x>{8GF)T5R$b6^zJnNNBpeauap?B3UzX zBBaPGZGEG?XS;jk2UqCq1u=41Vc$oj`RJ^l(!hq~=MNS1uFs6*aMn1+c3PzjcIcHv z)Wk?SK9ZhmP8*>ecvr9|*U7SXfCV zvz6p^$E@yZSTd!B;}1Dz%Ak;5k<5ZzUX8Se?PJw7iM2ylTBxrNVlquyDbSgdfO^~0H-r2vF~aQN(a!^x56 z>t>=~`!#Fger)S>&Og*ZXV+h}*{8;#WO=D5*Ha{FWXEjzYH1$fZqmPWmi29Ca1QO1&42q;jkM_jcmGVpgx9RW}30}s+KYkEFNR8VF_ zD@G2QNefWCT7<2d=Gbg~yt8gG_mLM!ywdLHlPf23_Nb1rRjv1{I%5bpZ!X*$XS0gM zS7n^I4BZ8Qezw-qeLs0Ek9JFFE6A4es^?gGUDS(vdziafZjtk(e~q-2MYdh{&~v*4 zE^~H9PPMGho+EckL@LkRdK(I7+J%ynTOYQ|0@&x%-o9rIRE3}*2U>6?#pR=Ev) z(kfop16RA9B~5+{&Sr5|PP8b3ZDv#F(^IJq@`?O-6JIy0 zjb_8{)Jmv`R!?TpLJmm#z}!IFx88F3xTf*9iSp|Ut%Z&#xX-1>=v%8V=mL3R?zM;zd_I^E|Wuc}9qgCC`14|^7*A0=lRXI554t@KpNS3F;g ztMZNzo+z38w1)9mbhlrL8?m0}8<0e^>aVK$tsR=A_(dcbL(8pg6OWt-LG&W0WaF_R zEJ_gn2({_9hLc4`ZiC|8rZ!ltR4R-PB-4`U{oM5Z)2x=qwLpB{6J|*2Z`n>Gs^>nRB82m7CY!U$*QRa7h^VzT9d!Y@4yZ$j8<**O5DJ ztiJ~+nz$g9V&s<<9})8;_viCY?zEXG$JN`2anGl;GJXEnq!va$My2S~RLbI2kucy4 z;d0K6Eae)(AXZ%4p_@^p$Cs|$%|F|cyCPoi5jzzonwdxtG5-{KImG|f4cXv;J#UFf z)9jJ5jP~)yhYojp`n=CDUVAksdsk2L@#)rn_mteR+|ofSlnK%z1t*r(oh-4B>2a5I z!Yh9rW21PNWLf)Z3yo-N8Cj3}TAUydFwb!;1uVOjM32Yt$e)Ea8@8&ehG?e8B{-VJD z&Q~P}|G>?V>TC=vC<*0KdJTe`y4v7nLP3XZ3E3G zCtUH+^2g7M3kxS~#u-j>Tz*#M|12AAHw+_OlWGKx|u>!ojH>0nryp!+>&lsa zJ!Tfw8SbPKeCvHQdnkF=A+NZy$;EvtjJ&`r`LRp$VS(ig$1AXR#kmJlC?tFP@R1Y_ zHu`H8K`eR)Yn#5A@~6@Fe> zY`&!F@}&6aeKCa`p(dsKu9xJ$f|zdZW>Jj3hLcpqb#Snqiq!~9-gh9m-^D1=!C`R> zvto2%KRw!yZo#WFpJ6XpNkbCN9=vcsKsEHds@AO;M{}56z}dNtdqUi@$TH{PAeLzK zS&a2ZpYFvIsUEgzQdB|tg{U-r*U3FEzyf}acWU(uHt! z$yk9?Da5U-iux!QK0YRyKpH1U67IQUJF%jGcR zbxg3oyJb&`@#&aMA5%{^lR|b^(uD=qEDg!|#(^7K3-zvjUV|}rN)Og`c@!_##`SG& zlyec@w$0V=orgR?D#Or|aw_ch!g<9Y~{>;lyzBDxAiJD5!zI zfFs>S4(|{BKH)wzx;!QF++!tq?tEy7Lz?}S<_(6+Jl?bI3k+driE%^vgKw|2I6wXL z80iV)4swbxTeK=+cD~;w9Z3&@8(cBzA5zHW#>wyu-SK0bLIzl9fiG_qZJZ2Ei?gHU zx%!Sb^5fONjdeerJ>o7S)zuoaKUK=d$=1V%;D|_t9gF?G7JX6@9A5sRA!1;2Ankg} z=a91w(3|t#WzU|iw)plgW4=Uurr;hH)ZODuCuqW&FM)MJxjh^@Z{7H=lqBSGNRT)B zJ`*b=14F1qMn?CPA&UWDnm3MsHg}VuMZ-1+6Z0a4o^NfMnB0mP&tl|@=zsm1PQO)O zA7vXjwRXIIPqc#M1NvR0n&;V5t+g4nt<81wKGO=CZthcEgR;RHR9*H+S3w%|^x^62=54BZ)Petva6o2MvZ&*Ymo)%B@93k`;S%>{T@>M^RgwAE`4szcNJCVvnA z5m%{{&TrQdihk>SXBJ%!^T{0acMCDCFm9zq<_>qx1v*a496fk5WpAgaZbkFg=H4}) zt)CR#%^`h zxHw$6ER;)+T@ifj*f*_w&P-WU$@~JUQ+{Qwv(snUy-3@hRh-y4DQGnz_e!^E`>^@2 zD37xY|EGegchkDBIB=CCT>64lMkYzwaz5F^1}BuW+Lna$HH8ylBC!1Y0?RuI*AcP& z*TV^d3|^@nwsrIKgHx4N3u7aFUJDy{7|6HxnDw#YK_L5$s=T^*MiK<9NgvsJT`x6$ zw2s6v&078G_8KS6Oka>0=$=Q!sfNPcLrGT}5@YUX#5yQ1Nfdr$@t3K4f9+G;1@6%a z?h|OZ6zN{M^od~qXn;axl-|wd3_i=vHEe9Jt&M5OS;@J(vJ%rCqm*MC&+TAzzWDYc zXjT0@%P_s7o|3MlfIrrcmDi6R?APLScC)k=v^#n=<)TBYL`qU}kzIn_-INiDtt--g z;cw;|!apQySVqoR@^RnsSJ8pcd#0G@ab}Rj<6s3t%y|L2>V;Pddf*Yg_ZRoC=76jH zN6=Rl;;+Sx(l~L^tCbVw1tX=NQii%m1GR_Uuk@cv5#;Ffjrq9X)#^-Xk}z8`L>I1q z8`*z);Y5>t%FJq&k{m9D&>4tEz|ccb*e&%`iXZAx(t-WHo9Jc|96)ghqxjy WX0lX3Ot$~kTm77tN`aDv-+uw?-1r&* literal 4135 zcmZ`+cTm&K)BjQ=q4!=47!*X1UV>CX0+Aj-K!a2h=@KbIAkw6YR0RY=QIIOdNEMZi zhW1b-G?5~`8k&?J&&>P&@xJf8b9eih+r6FLxt-a&Ppp}V0W*UD0{{TbhHyQLa}4}< zfvL|WkuE>#9B3ct80!E)brR#Tw^}Um^gR@6QDuN0Kn31sHcMrB(LWL z2O>MBy2AWqf=OP=`)puC2qY3niL}&qy3#xsm#c_5Z}%d-CiLmoo6W%{Qz=% zmNTmUK#gqOQ^stWrn-J*DB*81&c)1wNfW(NYN-{pXj+(N3l_~G zG0CHcwywL*;OZ&^*=E>XUL-)e@oa3|$kynK9NNTWi__F!X;v`POJ8Uc%e0XDrwK%> zd&JcHaeCF9k?rp0lhAp%&LZCnX*^p==t{s~77$$}ya;iLC=gb1N91cf;yQ$*PcAzzgJY;;;y9 ztCSfj#qjkZL2-4gv6_Vi9kQ3VQaMsr>-JflmOkWI5s1r}zCx#s>y*r!;XszEmW}_kuDuCM;4=-|#tq(I!xNzR0}JyJ)6%m_ktflk z!u&pTDnE+Cd5g+NV0S81&?{rkcHg%()ID-%UHVe3J!gp$&aBWCW`ey+^UjW&*Xp9Iar}jidSZTOIp{H zD=(tSBLtBrc7K)zMx?M}>^%OwgovTqXq|7vARb51fgh+W_8{BB0 zPaj&NG~ev`+Ae-xK8U?i@3BmX%O%QVACH_ePhR~j)7cso#dxzvm9NjB^5a4KRH9Im zmV4iA8423}QjA?_C)3k!wIyp6dt>5~yx&Y) zn;5TBW!2fFriKk(vS?_se#xK@h1ZTg?HO#1Q5Km~v0SBYT)~meD;)ho-lq9| zJY_V|C5On(b=e79`5dYvXF2rdy`Yp}_<~FY2h_wqQAn~`oiOqqx;V+q9(xiGpK>IJ zgc}qd>!{>GjJuS|6LTOYcRQOXPa`?1xVxlBCAK~!udssdO>xHr--xPvO%mTZ!Rm38n9S8jqjiS!t9taJ-+1OL>~17QieL=6R5m5-T7v|uj?_l7 zRivFa5lQakOW#BreJ_9g>ihWB8&aBuS+F*R29N(-{(;U&?#)##zi1h#A##>a;XYkf zo%L-0Oaa9JowWLJKbQ7q3f?D^zl8aqsHB$4xQ|;(-yP%Ekc<8iCx)*?;+aeeBcBEv zv{dw-K5omZVQ~Vo6ouYU3?e+?CGj0G{v%X-pote|yfg#dLd4R(<}`gx)Y8-z3r2qI+W%7X5$0RHb)91p%@Hpb$dM)TI@kauB^E2xXmBwbTH?m^5|6geIgPsn%nML6;Y+}gY6I7^?@2F zrp6k{1f+3Lx;M9q&x(^lA~z(F!Ppq;h!^}-&+hWE>p!c$huLjm$;?+&3S%t^?spn zk>yL~w$tp~D4I~xA9D*(QTR7wYk4FL5(i`R!5gf|8U^1h9=zR#`VSOWUg_J z4);*mAKvEp{hV!*hCtuW{GYl%gNC<{I@#;4A;$WpwJVeYq8$6Z&oyrFvP zmHi~A5tUDaO?An!7aG)BXUvCN(e{I<+>8$}PcEP6)8~6y4cp$Lq1~EHJeX&BavCqS znTsb7Cyu+wE<>AgV8GAstxJNV|0%V@060IJmlX6jB1wHRS5sffm~@?IBXl|ctkDAn z6Q_OIQYjKB)VMMpZ2*p{Q0iH*Ya4fxpRNha)ya5xENc-oSoTimrWk=Pl$DP}qO&QWPw$c$*fj@c11qkmlEfq3Y-(y

Lu~7-mOBrhVIxiLmGhLQ7z-6%%FYVA`sd(W25CTx(>R2 z(|~aw*Sx%bkB{|Lg=kTqKK-?@4q)rnddb+sTkcPGw#}3GE9{&c=SS|P)jPJ)5tSZZ z6}=osy{2VH4x1Act(!+$S%iEa-gZ`G9oJu!5Ori&e@JK%IsfTogO1^s35q_^i81#- zD$Lqkx!lOraJETHHTm&jkLQ_O-eIfsQowN1xAhj!liem(^d@smQru+oMlsd%4nipF zdMRj)RW;F!Y#Wi}CHCMf-}ai=L5bR8?oiK%DISucv%mFXULHWV-4FCRTXtr_lP+DE9kt`d-reO`w4O-@=g#c@qI0t)J z5Ty5VMDxaTK{a!_lU-Ow*!An3jy7`2Z~?t>-`L=wAxxRUDf8g@C7f|et{*g3jn)Lu~^HN75VLoVv-off)4-Y zu%YTkh)Z0Xd#Go?&G=p?%v)r8Y!``-iR4U8}G(ovAW#{X-G7qJq zdb<>{TWyL=P#+aBWTz!Gquu)AS*I10gCaGFtLg>@P`t}x8rM}Z^qwH9)C9M%w)7lz z6KGG7n7k{ypP6?CmDIeY^3P)mtYoHwt3vz=LuMWXFA19zp&<2-zKp*5T#d}`IF3)( z3i-LWum{fg((uh_ztv}l__Ic(ry=6=AFdQ<;pFRi#=d)eG|vv9=FP6#&D=BDZ_XrD zzibyuTFVG_wC?cwG7vcQK>j~vvSJ3JLY!L8ayfPPqB_Rr0)m>U8-Ibnd|r~hya#41 z>sS+&(%XNJ4QdMeyV!?&hCrr+zp{ZKZ@5Gi)undF0w(#e1ER13DndoA`|k4sNZhuQR^U2Yjn2bs8@+en+9L{i!~0ReC+sl zJ8tE3fC*ff(tS_rWnUgfQ5Mm2zhIW?DEy&dzt--N1Ce`ue-Ev9nov_0qBDKeWWB=K z#8)28i3Yazuc~Xo{}MuEI?b+q_{M8MF1K;GV#91R0BD0T z0S$#~>;-%rEO+lSI}fxW+7_Fi&sP3lR`_3(@k9{)x8t^kP@Mfa%@xP$-@&>#VqIa* zk6h0Ike8L0la`Y|pGY}Xn7lkpUPVe)7A7mp<6m3-KO8*0T`+Dz|G&cnDaLcw4A?wD z-oaWp20(lsdAngeTp`#XA6E#*2kU&!-(Sz|FoAuoB_w)HzkN4cumET-G0HeIa$e#@ zq;k=4LiF&8Z7wvIYLSp{KZd*8zqbpugTCS61S1(>g_j+>qpOsD9s)4bH_@xqy&wJ` D0qU&< diff --git a/frontend/public/apple-touch-icon-152x152-precomposed.png b/frontend/public/apple-touch-icon-152x152-precomposed.png index 93327fb98148b42657d272f6bf79cfd3bc6a5eef..32bb0234a05b5d11cb0ec941c8f5645174f4190c 100644 GIT binary patch literal 11739 zcmb_?bzD^M)-TfCrPN3(T|Al=;p($W%=Lw8Hv&F`Fh z;yv$s@8^C#_m5HbUQevOo|WJAgsQ2?;$S|*L_k2mk(ZNx1N@)-_(Mkp{w41MJx4%5 z9<|ccf$1nK37JCe*p1DgCJ=UaI|qP{fFL67?qF)6~<(RM3o8TntmhT?kmf4gxa~7Y9J}769mM^&d1J4D~1UYaWXR(dL#Y%?~{QiQCdqF%t45Q!_Cc& z-HnGG>SV#eB`7G!!O6|R&CLdkU~~4chZ(!G**nucF7dZDq#@3xPF4;uE2ur_aZO_r zs0&P#mKLCc{=T?_B@_mAwuCzTV+(udzsmrS2FE|h99-<29RE5IW@Y|Qw*GC-BjrDa zL)@+YhvAQu{}>L4@4sir-Pqy38?3DSe;#gU_ixNQ!(?0mLHu2)|Hl3Q-oRPY!vVta z2I35LaWaL-xI*k%)3myLA)Thim92&q}QLu_@Vt?VH7&cLew6NHiiLjxjDJ{*f_b^xHvVr1cW$wg?NBRun;HbU!VHd zXuwj;jA6$AxABkq4iW)oC@TxeSvkX?P9A@~`kN7GKpg+}^tVS_tG~1#1o}${gp5re z1tv=C-~=^uF@>1@wK=fd->A+|bC{d46GXxSIDS!D33GERK(rnpwMVM~af7%4ljZ;S zDQ=b!V7dSK<2e4#8poqS{%_tyIR1lsk-rA~ivTqND?r`;L(LEnm}6XGMp>lQiTlKPqa;Z{5$DHs2?yh!%I7Y{!qm2E##4*BJo;i|Fz91R*t@9037@ATKSU z>7KryVdbDVld$Or?QHvqOy*E1$2Ms)P{XG8eqFh0xJPf*_Fw>3Tv7tRQF8GcKASlx zz8=#u;4_HRWXkx`m$E0X7rH;I!m3+Wdq`NTmMa&7to>p3xbFJs)vu}s1bmR<&`kns zICD!d*7B(HsNm&-Gs=%Im3|#hki*5Pk(&lvgL_4L@heKM4&C>*+PnqHur@>*EB%Z( zjyR9-HuNnj&9B&x905|jVrw?NKi>tOH<2aMePx%w?l-o3YVuI3#mn#3s`^?+5qC(x zQSUJTXFkg0-e28~ng}4@d;i>xsvd|sdtwETK=_DgF`UIv261(Z_O(94^8iyVrn}bmk8oULb2|0(nc zBM-92WEUO1oz;SuWiW}le3X3YUqGx>S*o6M2f>izw)bu2ETkmToEM2g!F7d zY9uqghB@?v5s8o~+dw!z!lAY;G{NF9XxJ`~oGV)A#d*I99ylpDWw7v|k=fY}T?yae zPd6{rFQA|_3N*Jr`Th6HGPY;EE`6&uSOEa89 z0pP;oVo4CBK;(%_lp845GCc@qW9NK}pVk~8R z2K^k=XJGM9Z~M8NH$HFQ{zh7u02n0*=8!g9yPG_>FOO&l!x%rCBzK+};d0wYoNJVa zY3Y(9g9|APotah+hLL}HI$lYJR4MV5eg(<9@1$AHwh+}u(}{T#7_e#X-`B1#ktBnR zoV_sIpwFu+X_{vY7jGy~n+jqThd8}9u&bpk28KTW-a&ebssJ8dsKxqHXpi6S8`HFO zgI;rCsup*6iryGS`H))edITQ_DcgxyBbiHTc!4Ur5gd?K!X|UT7jo#8))7$W>+R z>0>h_mHqIs=@os!DG`4poy!Yd3~bM*kcfTT{*@RTi7)FpmuKK{99puFTmM;YJa<9v zswnpaQNftgQ?o*}xot`Ol2b*{4{mTh9`?txGk1@*=I(_!#Oh`rY4Bcl&Y=W-+T8_I z=QE~rs1>7%PtR74n_Q%U%&^7Fkz9&Yh35&JyB#JoF=oQJe&iDIVc+*$SyMllRns+# zFsFC`8!eQoZ-{Pwlm`m~w#a)X`pK+$7`xRty9fod2>FyhC?rEv+G)>P>+YF>mRuxW zoZ`@<1cQ|EmP4guG7fTOO4KX^KJci?-uD2$6!$P5$=1<2m)Ut0uNvd8ZhE10_? zmO5N2CtOCO5LI}2e-h$fu{rp53l8#s*B_JGFftjKHxz{vqxyYZE8&+44{Fmp5TDCO zeUqS`en{7%&t&O*5X+>RF-hr%J=j{5YYb((f{1W~6X*oRVH8~{9-_a(c+0jZ=W21y z&xy^O{|YSDyO+Q-q%R~77IQ)SAgVL?JT~F=)5Ih92VIl zXQK+Q@EI0dl#zwOvFQ!>+b_EfIz(622XXmxB5@|qmx70Nb33q+7}8AOKQV&v4orQ| z6b5Koh8ZWOs3Dh9!XcA^$q`J<%zPJifPN-D7v+1+&K1#3(Q|Oj!2@~LE8bgWEoJEa z-g;F?fl+t9GO^PD+KDUykXP)i`&Mw`y)zo$^Y>p3Aen6zD71~3$8GQ1uGRV%daMit z%hPMzuFpV^Z^V6uhV*mI6K$U;zu@#+ds)>T0UTARv@Yx(2gzV&ECEpg9GE(o4d;eW z^DE~^XUe)Z*$A~cHQt~w$_sovze*MQ;q(D(+rzv(lTKJzzNjscRUTGfd-P|}%fo7P zZ8A8(vgy0q`y1|9`s1{EagbP6ab^Ed!iV)MEke3dfm>txG^)~QCSm?wAX0Hpm;$kK zQlGRmT1q>i*A*o-wtQvw$7UH>vYFdz5tMy;GAXF6Xnl3!OJUy_U+EVcY4vQjU;X@T zx7g)k^=S@cQ6Th?+@U{Z;P-x39M>&fX@@>?+!;ls{n#J9xh1^UY0K0;Niq)XZA^S& zlvO(|$mYa$4r>{73;unMSS`5Nu$wygvUfZI@%mb~#yjzin72H!71U~VzFcf{w|tLb z>vB;9HEpP1N#!2CYxo*}dH52KJ4~tX^0Sx*ZS`k54gFjY7CGHd7xCmFReZNUhju;(c1fxefW zM`cx2EnrRby<`p9rQi@79Q2~@JJb`DterFa&+TklLoZCL@2du|I3Tt~RQ}H&!z@3 zaXwtKxfz9V&fzLxW1~%>hjH*xNglQFIHeCA4XOU@?%jz{+EC*8;%$AqCrQ*`ZyO+5 zgO6Kph*3n?$##X_d05^sQqMMpDvM@FQ|vl6r!z!oCDK3Jk>s5WoNYAasXq1y3W7T9 zbdlg@2n<$Mlcl6*%CL>AmVOcjajs0fw(s5XAN2)i*)3gM-|NOM`ghZ?C(>x+sS{g9 zflv0!MMhb?vOtvBps;*Bxin>SQ#Z8o_LiiU+#`5%!I~kPZIzNb_>i-z$WT)x zDWVt$SZ^b%J79K4N}|qQzb~_oX8md|{Pxd2o`Cy0@wROliFFQ7G zIW=2`gR5GhqT;_VsUHr9-JV7%=V>*r7ltA7u*L5=tN_`jm1Qr@e%Ji0IlEUpKFW@@ z|K0-eKgU(mO>{hP8p(WbHsUuo%d) zsNNfbd?Rwy6x+z|!jZoiKnqsUl+g#L4K-bmw%zAjxSwA$S%rNnv95h9NsOYeg65lr zCSUeu``V&G)SrZ+N$?{TCcxl`T7m|FnxV_+kyJ8$7%Lx8F6Q3#Hv3XKee^71wgMXDZ#5Q&sxWnEXq%AfTgt zQGVxMxRhe@ZJ1Me;JF(8-|ok{@0V@_&LNn;IbZRI$!m%!zeuCl!0s`TbZxvW*%n%h z<7v4ZSI5l~Qf z(*BL#UaL&RARo=j(Bgjls+TXi`h4q@cJPEP#)&;?v!_vU&+7rCQSHpH%OSz3jgBnw zYJ%?!v-u{zJS=x3%yzHvywjq>tGH#QRzWUS4p0X_z9Zz{_dl>$80och)zk$1uAhnj z**LsDW$G*8WXQyr|k4m}}kubg6S>?u7Xs z6n{*2Ncd*+>c^?-Nq(Ul0pRpp1!JTMlxGCpfHm)@Xc}NH>jk?q>VQ30w3a6|seR~X z8s!oZQdj?^`(9M1vQ(}6`%UP9dv3C1!wo)ff@j(fMPdG<1ktFn)EvVwl&sy^6p6Nn ziQmT;Xu-vd?7FeDEp2J-ckuAN*{YQSm!5nzzKM4kB{^iOEs)_P%93^z;7QC{0+{9XY?TzOyADetRu;f3z88U))ZN?EhhOaEZzF~|L>RJA}U{>*K_(s;0GU|yn)jP&(#x@F{<{TBP zYBLEIOBit4>e0R5w}8H7dxw0A^%*>Uy5rpJv3_4FR}xZ^{S12)KIg|a5PFQQp-Td( z-TuMJ0>N1v8e=K`F?LRIdqj34;A$Qn>}G2Y&RpNe6KjO*IM3SI9`0_~AgNZD<)P@t zx_|LwF{H^__k!LAg%-_KEkOqm^=6}H8z4+&MqgG--v$-rkPhABf(r|aGc2(U=qR!z zDVjgb67{Styor%&H)`~~EvXl9KZ8y6pe(yI&z^UH+s@9|^+yseUEstSojQqb>`VfJ zDGY^A84~6>STFqQ5T#~t2v1*#3Hl~ZeAGrrR$W?feMKnKG_U7ww`@hdP-n%3r%i@g zv3ZQvC?fI$x^$n-N>fAsSfVz!rSyOI6*(UdlgY7pxjmp>fExAu2ROCvfSb*jPuiT^ z-0tSOdy6PZEf?=CY~GfA^wBVGI4&w5#zKn)&ajdp5)mTz%RZCAZ&hU1F;PaMdak<@ zcrD<(CmXC}&&*eH>ZBE)$Y{wA7212~<0C)Y>25h%?-pq-p=rLG=xLx2gVpe!{#asa z;Nt4->l?}bnx7Dz1gbC*$}J`Ht0`G^k&v3{A5!A4)<{O;95nt(u(IDBF z$2O1}&R4u=wFRe?Qp_BeCSCp<|5dYh>ir%M&+gFla7|e8!cLnc*~~c^YwCQwia!u> zt5}dNbyeuxYPi8TT6KuqHXTOlqQkM1|Yqf~bHa}du_N>jJ-sfThuz)LXNb^USR(`ZRDT}A}cg8dp zjK`#L-=~!Yl`7W~mD!8hD;llNp4F-p1_1)b?jJp`3XhjM%@ZyF3%a z#@%BB4CWyjcb^8TgZm3t`kr5!Y0gZa(Vk>hKuO4+a1uZU50x}UfnE_5Db z2rIn1t)I6&D?MCI*mRwkm}|1eug&d{mj6y-Pd`>wwucH0DvQaaHa+Y2QZf|rk5#UY zcgHqh%1UN%y&z&#p^_f>lIXppJVP$jc>R=dl*W9gOZ{X(TBbRrx>2NW^!++hJ2mr*%=J{l@rRDlLP| z0+4;2HhApB_yUTA zVHvjGVaIDUoW85C9MMh*fd~W}UQn+lzLxYSvfw!35dVV$r4i7a((HL7mn+w?nQw)% zi^3@;*xgB&HPDO^Pi0`E;ID5&%Gc~|qbz}MY5#Q-$Z)TK2)h&?%N+du59jEiZ!+59 zu3p_QS6%L5 zlwW|p9~GT?KNPlaEPk9Sl4e7BQvG#w(_m?843;t1BT`xPv}3PtC6qVK#gSnI6jY`m z#{~F5;`uj=VH3s{UWOcozHs$tJ5Y6nk4HyI+TW`-k=EQ}o5()d@mqyc#HAP;XhXaOS|E^Z+mPKo#K@8m4*Ec#g zGcVtER)j z*bIX<4O8Z23+)GRo$c0p7pfX!pw@ixrf&_;e)DQhacGFD{l#GWw+>`=NmtFWr@Ht6 z9tgmfQt^-=@da6SF#}iHDNdNvfFJ+|^`9+s#p@S*qti5p!#yk>o=>~gpI%AL3pyKz z&^+w00ZE{)bJp%DdcX(zP!``DpjIp{PI-0`jP3^gKC__v7HwZrNW$cdTfy}jU6UBa zOt*`(VIxV2HPVqmTzv+I*Pwa(j9+OQ59&7jGK*6YyVsIioKD@+CH}CyiH)o31XOB3u9B{QFp_m@N{*UZP~PyMMkqt6 z!gSz3v{Y6KAW}NhzG?;<@~RO8?XH;#ONO@Ai4QkvZsbwQ6XZpD-U|x|KYP~j>#2}I?m#?>Y(d@bK ztdwR4K7Co?@^B7ifLfIBua96ZeUYlG5f?KsHZ${&utbeSNUG3u<#ADYHVVbyZnhoy zIuXwhZbmCZ%AE(X7R13axie=ajoPg_y`^T;(e+@q>RU(EHQ?tA*0cPMc*?M&5_xMj zQ0g3VlRNDa>;`a|a&lF{jz2*p6pcuA3N@yFFsNaUU zA!J@&gxFNJXx`d7XUMlOh1StCfG7Vwh|9XpU{M5liDp07YTgui-ir*0M3p{_2Ol`; zfxR(ZLb{~>-a_l8@~JT#!U5um>QIs_GMN0?q~IXotR&V*PsDQo6HI7}0`kYE$Z4$- z5jZ>!Qp(L*LTR8eexf@8ZQ947LadsQX|Rd&I9xL?X#X>8t?Y>M&g(Io^sl3qzJ`lL znYj^K?sIvi)?IP~7_IXRyP6!6HQ3I&NyS90_iCNDxPYyh^eJq>))scMVrf0_?uOy8 zbX{IGGB%aG>`Lw_fK`+>`kx!v4My5M4;B#QkrmSLd^%P|-I9~Sax%D~@uRQC?7a1I z{9^2VHG@Wi>K78oQ>YY+vYs1(tzr8&nreqKx3ASv7Y0Z*hn`PVzvLGOzx7EBq+Eyy zeX$z4!9s6a^-8frMSJXhthNccP@rbORX+na4-tv#<@5F^yEM-b@HEG+8-O}Y+NSUF zn?U#!buTEU;}Ngd^%L;gi18s5IU^CUeP0x)hF-#mJMZDHon^kq%^I>WeAwVe16?R>-YcYsn zQwra;^x4ww+O136=fMmJVOe;!`*HMV?G4H4t7``-M|~3NQ`%%7A=1u zn(1S;alXT`%;Fg?L`fBM9-Z86L{6BGY+?6Eow8^P_=q>nt2sK6Ai0bJ+n~LZdyF_!bhyj6EW!Uno^o$J@#N}0l+V_RL^)LzV* zrDTr0Z9A>yINo`AuHR(uaQ7WqeEyQUPX&)%53!cAMD1v*P!j!goY14c?MOcu*{r2#00zp4qK1)xJkaP zl)dEa=EO$`<}gcK*4({X9jzR*9XY^?&B`(`7c5N9fm$;)neyixv#pV2}cOuC$n-tSdOEm>GZ@(GhLu#;Q$36PeMG7r3dO zqg54iy6$7r6^cFQ6Mdh^K!E%tO_`Apx5~MX^d4?wXuez|d#d~)4FLg-;_)tkLpd$G zjJlxX1?}&L?Zbwv#(R?dHvuR}271iTtvU`)rs=hjK?;OGFKBMNAUczuYOfdXrwIDe z@2W`Ps4-j?UpV@ZK2eXY091#T4dB-?@L3qCO<)sD7ZsbEhbvwwOlicHXK6uA)=P0B zY~u&wa;0Jos@aa+%h=fGS)(z-@bU8mtZo_g4)bbt8qBeF7o_sN#bE$}hHPGl0flpK zzV);2Jfhp%%fsW5`)=ZwwnXpVoW=$2--CnaZKpI77N*`Lmo#9wK6gEp|nLCPLzI&pRW`j9mQhA_TL=&GOr>=Z zsjwp|-}4D5niC+>;87a>J^(*~*X;1`KBVn*PX>Ry^2sD|*3V*!8+N=M0=0WxBFwz* zV>!S78v+RS>}dil!M5K}%zgZ*fX1J>`5pUi zt`4=i!gu&dHVbCTwj;01^SEIrQxi;snQd#E?`w|F6JKEG=rl8tKImOFQet<5(gvNk zfC6|USbVc%C9a;0{p<3pH_jMVnLxvTcum&T)4EO$+k90ce!ZCEvmaNoe^@t}wDt-7 zUHKbO!U!j~n7o9#RpjJ~V{`PE1jVG1&|)i~RWR$fMgOS%kGRdiqVwClTq5Z3B8%fm z=u>CskUk4Wp~EpWC#Wg-#5s_5E7hdH3=<`G8(TXF%1N5`eFKJ%`^Ry1pN}NPn4Fk6 zu!PR^cC#7n>bQJqbvC85I26l%O%5V8@#4$oz>rcl$%(+-iV6JLL7mEk8yQ@}Ab{B) z6rGXrB|4I0S`X)U^779q^%Imp_;*i{UNhU;z=B=W6#Yn`C_BE(x=;Mw(wb#MXR0M$ zF9+O=Xc#UQcUB&opS6GOQ7Q^lq|UknRhBZ?69hB7Ks!<2JGIe7x?)%TAD{sfyLV7s?5S3VlAx6pZcnAFkFJoDi zhRW1o%TuecJO68D2dO=CSU>JWAF%7H&4G>xf?}0$cz_;&9l>x6w8r8C8mHKk7{$e9 zJw4Nh&XQAjNAid35+Uy}<%y3y7i(lG=ISbgZ|ZHcn?)4_w)zgwmt7kx=7+?tf{cas zuf6>>85Koh%uGBJtI2`|JUyd3bBqft*4D9V#aRfgK^3EPKfvktoMmcAxPIt!+wAbs z>9GExmuSjbYR*sNheWQ;0=%8d%;(pDW{Ho$D+`qig6%chjmTuyhONO_^bFM5C z6YHQA3L<@)@TnTFF@;HeBT~P)Z-MKvy#}8dIKxv-FotpqbP%h*zDVp~wGR9L{fZV* z3b-}GI?XCYTd^BX9oU-+N&4$b5kUyj@4H+ylS=p%J3g7I?B#}kRQuyiBtfxAs>P%v zgr93kW$t;cPmM;&M3}>CJAd~@9^4Qtq!*AsDfV;C>NR}ErNs86Vm4Sr)OY(c|1S!p zOoT*ns(~&O5AzQX1j0>+;-u6K`SRMP4;@xUgBg?wy{Rioz>TibEFYsH-d_HLF(cM# z>Uv9y0q{rQ5*KcEYOssmH=p$0&ppblDVA(vjyw*i&hKk0bi$r0McBSq&{vbpn*{E3 zL6IJidEdI(l3oe`*S$!85)7)pVOn}5Alh|^zcn@@y%h7q``i2=he$3UOLzB@f=j0$-Hpi7(nyFbu#|L5 zD)H?9eLp=Po-=XJ+`0ERbLZT-_sqoTXsM7AF%SU&08%woFceFX|1|*fE>6DpV5y@Z|ykg2MrTzgSlAHUQuO0swX`001d0z+>0!c3o-g z1fCT{1q`_VujGF%O~rEX-PJUe@PCt#P|`BSKlLF60B9A}!1DUu3kNwqNb1?PD2(2$ zj3W-tC_tp1jASG}w34Wv`?+_2g;o4t?$$vuv;ICi(U{g}o6nyzge_ZujKr$ z`9pQFp@FhlLS zL{)G!{gH4M3Ry-hy-4)MrAnR-7W3Xbm5^enRR%{gSD}DodO_WvJS#3;X?oM3Q9hfX zuvrZ4&-tpk-n296Gf$r+)b2A_nj!MW&ztGNgCA+oS<+V$GpdPe86zB?)W<^wuK;r3 zzX09?gY79kZXNZi@UR+#>3xIWQ%+YX2vKLuSC!OBJ)WlKRU*%ZC5Oe}Xf|a6!r8kk zq0ngi1^%&^#fSOeKKw@q2J27zMDt6ic?6X&U|@CehzgBEpkh~EW(0a>sOX~MedDpciu1c~I@EDxf(ITqkXGv%eu4K}Mf$EZ6zxD%Z`bFCFKM9jQa zfJx5020s>YjNdT0io}Ek?jCRl_04z<{-`A3QYNt8aaUl);LrLcSn7+ax+KosJ=MSH zJ`NITm-jW8xA29wl0Hq8_E~EO3_T5jSQCM7Z%2851J1EgI8LX|$dJ6Y1#T+fT zDmMrr>7K;9RoK7upUDr8D%45 zVSUt&)Bf8yfssd*gE~Biex+@1=`=K`tWO%kHy4?^G?gH}erK}lQ~$KUHso^GdTXU) z1W)|tEGoTe;Mb6$We+e+^m7q;8x1BSu`uOFmM3UkqXC4hyRiv9T4V@V5#wWkKY!{EhpP78J2zSKXAK75qP8gM0ZrF@6?8{#0Gb24y_C-Ndt`53`l z(8=ANU`yUDekyL~v&H3Zs-q#&nF+eI96e_RU+S!A4~kz9`iD7dAeXKCXYoWXD>)?g zgx~$M+QZ-Zz8&yvh4I{2U->b*5#qr!&{Imt?=9TU>ynRicXAIt3QUJB6rq~%QWw-i zT`=KoH%fc>pBo3n*UZjPEfQ7-+8Q_w$C?W8Lxl@it$+3~ef)iCO<~iagV$sBwS@@5 zbu>Ma*SsN64vPoRQ(%?)4%~dGlbMhk1pE)b>B#n4;@1V~KqrQyz^J2x0{Dhubg_%t z8bxI>^Y$fM5+Z0(WILe7?njJ&rCmbK*gFJyD6M)5WxLd3Rcei=8+J}m`5WhIyB zeNgfb%{ekvSXj`0>UO{Yn*XbA%L{{YRzV$)yN}z)I9gv5&+1Pjew%%B-5$T9& zy35*w^o#EXHikm>(_w^F>lFT58WD2MpD*eIgbFx=8jL;H1F*uPs^_xt5!#Bi!%)9~ z?(=ON7uVMbY0K6mUDHSSc}+Br{xg&lgXaJDrPX%h0UYZ$#+5X;x~9r&j3;}o%D<^1 zmXDsF1yWUs383Ta&U~^NNL&%9;`Wb|DLZqtiPOR-h`-F`5lzO3X`MUjv*|YpGn9_Tp{tVr}eC! z#I>Px^6@k^;pX0m;Nf8vR_~&UO;Z)cy?`f1mv!k23>C|A&kId38erCaS_|A?O+@f% zTUw*?ZO$RP<66=@-EyIV`V4a4g)LayG7^kQL98@8H}5T!?HSWueSvV)eM#P zgem!d_Out#_Zi;OTJ`Z1y)gTGKubYbR?%Z}8S=T=7p1LRCH0G6vYI=H$QKinzG($L z$7@v|AUI_QqTIB<@wde_K?09mr;fA?kzG~s11-7xReg|gw0B7&kZg0+ zSvt%|lqVs(mM#+bVfZ&tCbMLck}23T8wCz86CB^1c1d6TBPl33Srttnez##V&MYKR zfZ3A>d%$PZmhQC~VBHe`esI1ZM)1qp7)m;mdcuN5Gu9TA$ki``R7qW9GbB*EoK&Qv&=PNH|vI1v~U4#7Oe9#G>PFLozroj0ty8MF+Bg=B+}SQan#hL zI+M=v53+BtY9t+|)V+AdQ}30tBy19ATdNFe5#&7UFETq^5Ly|MG?b>`cvP^vz3ynm z{@M>D?jL?~o|m)~;px>sEBZ3*``r>PMOox~ZIQ(WG+I)hb5~TiD2&GLwC+ zA@OV`Cx+_piqCC05yuC4q%e@kl@iMwzT9!p8s8qJ;rK1dKwY?x zQAO)iFC~?|Sx6%__ICEw-R-|mLgLIpdyysGcS%h)%`+c|))`!|=msI8kb{f#hz91T zhI-#P&?k?{#K3jp+llkzrH+jnEibB1`jYWR9F~Tm9k7mz@Oz3%qN5?t?1Eqhy`th5 zZl~{4FxpuL{FK#GSg~;@>$1b2B`{99NW!kCs_HGqo;|v9K9hq9nL~IGZA~r_j??kB zlYwNsy?NPGed0g02xAC$)fX@)?xYr-Rm*;O5w%l=n&lf9w6C2SX4HI4GAE~HU~JSv z0(N@S2^a6@?07KwPb=6U=O8^-hq|_%UCxL5l&MlLici=G%rfo0t{T?lm?~dN_7;df z;ICNe5M%6N{!Sl#KRU=ZiE_Rs?4>Z&Um%)}m(JOq{ap09^w0lOAt~0K{0iywEFmxt z>^O}&V>##>QEk7XX}rl(h@n#rskbi~QAE}+W+c3LuYS?d;bHoWF z_C0M8XLrGSb>H#&az()ZOICtlK=osz!4$@;!PDqVraodob-qpl{^F$UD4 zxV*d%E2~u#CGLj_il>MHP3aJUh-d(%C>@N`+QE?q#j(Z$8s%3{SLtcj%fLwmnM zH@wSexE!J636Uk4m3mAwl}76~^v|M6&J^%zDKxEN7ATQ%FGN zSkc}2oypu|$!B;Mxfr!_MM`8OahFGg9+>>P9oBczC*ltXimZhXxItEJtsk7t!3 z;Z@^uY_+zlMXI36wqV^j6$7`&)L_X!uY z>18&Mam$S$Gqk0-Wh*r&BfZ*;1CJWSjp=%3?;3(~d-)zdwLR^96M^+L+O+-m!=t~X z|7D>QcpPAdCThoHj>%Q#*mnTyBsKNx(&Mdj(=s7-AdE0+vD6%0Eg5_Cu+ z)$Hh4c2JqPdGdGAeBj2^Djc+VKc&0*kRT)WTjkMk$`1qV(u)5sEJr6Fc#e2Rp|tj= z(jbEg^)t=oCFv@q-xMq>E#qQgtLVb8NgDrJk+>~!ulgC;Uq|b zsykds+MXF251G|j5|c~+W2gC7QFtdH|p z$27Hdc2$M_MpO$hz8sz#x-DoOwm3jHZ{|7*)KM?tb5|`+ECu=IYSRWXF6C33#JcQL zeQB1F|3h_$VIFzr`3Tun#-Uwv6#Haue73_;g-eqz5p$Hi5={BwCyOu2BD$kQYfD@3 ztNk_dW>IU@d*v~SY+dPZYw)AtSP&##9`;tl=(7X)X8UE2;6s(<7sbIrG+VA)_5K%g zN?K8Ps+wAB8GbImcmGTz1h{4ae$tcVx4skqbhE2V%hzBgUKmtkQlgy;zF!_>2}j_S zRXxQf06KG7XC844z2m=gWQ%o`!6}*VMp_2;1ekjDyf99Fi+ik4;)-dIZ5{;ljw z2Pj`wg(7-R+7m72-ayx*COV!$svHB2-5W^!Y{Nzhe3JAYw&p^|C2Kk;I);p^1jo@8 z6qOv<5tWnXl>YQuJrP^txB2oSDLrL$BddC4R8LDw^_3MW4GwCtq!lbaOgqu3JIK%5 zBT{!r^=_@j7kS}TGS`EaC%tkuJhQ&Ugnn`msD8wT3BeG;S$ge}7wgGJkKfjwTb9>;1EGBSSB3h#cJN5Ef!{ zfL{kl{mc$}k$7|ST$q1O6Ha+3ihRXfwWLPZZ~m)lBYK-?I8-(lvzT1A=l07CCgbYM z7BWMP_4$dK>aKaW>HZ>Nt*i zS#2}Zo$6FZ!mMoq0}_X90k7~G-lO%Yl=t@9u6m^D^b%j zVEoUTwqAU+47KLKhoHF1>ayQWlIF+9n7jT3esscZIIT|i@g1(T_Xt?|Oi=D;)xpfF za)Mu&m`-b5bkyCE&E4&kv_qI?OY^UGrQj?<`ax`1TFE@`vqp)`KiIFSUS)L&7-fCm zIk0)~a^2S%m*n}7^(lgiPQ)D`YyRh}1M`dvkOz0M1#c>x&#W!|`?T4{?R6Xh{h-;C zXGxhovs-y%|D86}=i)s$f-+gDTdpHb0`VhOJvZl^Melu={P*P_$cfZEbPQ(6RdQX0 z9PaOCK~<|CGbFmAj1>h=i)OUA<6ho-aKS(MC(`#jv2%W(;IvkD!<>Km(Ew5D=&*V` z!2@i2h_r8^eAWPW;n6eC9&7x$Y-6ru(|57twg5l!_~dpSl%r+j5W94Gu%XV$?jvVq zPV4@pAPE&kobGzxn1S8Vn&zy*-j+0KN-rjwtd(PH{(;l4uGB%> z(KT#FEv)}LD6B2{7IxL&7uOniBUwF^rcDuu%f_x3{Bqx5opv`=e);O1EV=9@Wdvg! zy-YDH`J!k@!R=pBG-nr(;hQq zViCSnE}e-BPlFb%1hX5kr;u0H8fU09u$l8T5s`5R7Jf7$)TlGgh}z3oun>?aCdrE~ ze)vyv?$n=Uke7=>NBuVGTcFNE{o7abE%1~m^iDv2+X}%s>Lb)KWYv@R+?Ba>)^Cd~ z!Izgh*-~!b_`NriHpv@x<|$spc+>8>bwq0`WuZzcyIc*2X&ZyxjKn!UUT~S`Wnb?H zjR!v%MIM7s8oAj6g6+FiJNz~+dCdXhvr$d#lpYd=cg;Q`pznvdzE3}vb&Did8%9yW zJ0W0yIq?w%6Sa?!_4Wf zWa$3R(%nYN+RX+_0Ky<)A$}oYY}FT%kP;S_5*FtLfuuknTF-{M|D^zPd1wFL=l@o) zKnR4Exp)W-CW+=JK3!&0H9}Kv;hqXsW)qX<( zI2^T- OfSQsPxLUy?^nU<%`nmG} diff --git a/frontend/public/apple-touch-icon-152x152.png b/frontend/public/apple-touch-icon-152x152.png index a2891cce3905c02b3ac4a9a0c2878c9645f0412f..3107966cea2d07770e63f0ca56b0e6c253b227b7 100644 GIT binary patch literal 13306 zcmd6Oc_5T++xLiyB2%_R3`&Z@j4}2lOCb~`WSucHOlHs+`vx{VasH0wJg?z@L-Q)#u`|a2005n; zijp?@@6&@9^&#?mW*v&IV|P}WGapd;RfEC&FjD5f*FxN&?4Na&T}EbPy4=CYTFBBqSt+grP!ED447Pwso>1A{@b1wmb(AKQNTg zwq^vZ4H0W?1vrMpDj_@o^0Z8?)n!1lJ`f8(VC$v>#09kG9-ejxcn9c3nou_oXVWCtQ_Y;agJ z!~u1L?5$A0E%eVBeRnyT3zCWi^ns&pSzF^|xGx{X4oLM6|AC+|K@kw2F4hWV?O=QH z&v&7f5Ja>LH&hr30}G3Tp<=g$MI=SUC1Jw+!lIHQ!aub&tWj8u(@$+turLG+5xxZx zmlTFcijptklES}elj948AR_)neGLssZL}2%dtj*|4qV7BBq1R#3`2>0hxmoVk~fJ6 z0@2Rq2EiJG#gSJ;7yV1nA#sARYk?0ld{#mssK_|R)j+&;BYWh5b}M%1G*oq z4tY(!b5(}>m+$osk_67~U}a^vVZy>fzsU6e3)vqc9V;w37NCC&rHV(Gqjj+;q6K** z(Z34R(N^ZaN)Dn+^1FRE$yJ1G;ExG>|M~{j5slMR!jkD^`+b7H!~G%E|BLh>uY;t? zK}y6Dap> zCPMg|oFMdL5q|hV1#3&reNMlu#7*?QKd;1h|A5G#Umpp&zrcwZ;$~5CrsPb8__j9<9G7Z$(8A8A=qyr-3lTS{+oX9~t~7 zf|&)GVrX(RB*gv0FTeF2IP8DNY%w!5Mucn{7%7H?fz2@F^o0S!=kdGQ2ZaOzhDzLmKqO%zlERQ*3dv99|E<~oq-OoR`QNnI%-YHxO(6btv273p z1i1}F6UfB|Lk=R)uhrJZ+LrjEZ37Xl|0MaN4*!yw|0g|rONf%QC&COuE=hl(?caD_RP;aX`F}CQ{`K7Qd(`}D@!vHqKk4%SJJ%e+Ka1_( zlkKO<|0vbaB1ka=Tm+1Uh>&v|97Zk?;t(VlhJlNSAYkH1GX&&jrXAKTj6OorVlIfqZT-v{Ww& z08n^f$!+gHw7UQR-($PS?fgnwj7@SPim)q;4YkNqw=Hfku%XX|Cqv%mw#Asczt~!G zw&v9+d3#$6IrhP;+B3W0c7V#8XmCEl`Q2K#%EZt@S^Q4rcO%@;hnuZiP#c{-;GEZ(PFsWMadNdZ{B!Qp4 zWxQV&>g+E>ii#o?>tK#EBd*Ylnm;?~N7Gs7x%qtN#Bf29y89<7k0)8JrxK8 zsfK83t!T^eS{klC4PrdpvtR92{MoHi)6RtY5+{DA_-qC|;U!{_^Js~YG*vt0Gjp}A zezz$P2DhZ-;`z(NXPy~{7fr#RWh<^!CPWRCjz69bX&U`<`tIcO(POWUYqq<;lPLFY z&T#EHKR2iFp#B5cog(^>`Q9XW=?MAwhsH)l-xdIn@i}-=^kn4{0RRv{Rq66A$7l1g zTMleZ#gi2o&WF!P$qNiQsD&3V27>jUfSs;AtG9;=NlaFXEyjw-y^@=0Q$N+-CuIMs zkwgD>R?idMwd5DUi7&1DBCjkC>#R_slu7c3sIY;JH5;2O$A@1Wk~7jNwHkI|tG9pl z{LJ>&aoPD3up;TA4ZEkI=yBv_W<_tX=<&0RhO;8K9KNDj$56b<)x*KXAY zU7$KF=BWc_FG(LmHa7DXwIU(1;PWgn{Q`|J;4XQG=$@KBNrpYycJI~HlF}WSSZ{@7 z1{+Nk5mAo|HBX!>iBFQU^H_@;ew-jdL#f2Lr&9-DMrStuhxOY2zZPsR&#yp20FRo>hhVinZINU02%vD8=vyuZ$4d#o zHnK4$`F@80ppS31>kbL^-RZdT#SYn)bMp}ZP&0ju9!Do_`{;OyPFeB(8!9Ym$&Wqp z!BmEEtJ%(Upw7{ZWUi=9k`b#PD8jFNiN58FPBD+xrbLYuS<_5$o`JbnRw& z)`ZA)H^Uq$ma~8xHf20)4o4hf_4YVU8u0d>;}K00&}0f*>4WNZ@c0e-s7Q^`P?AjO zG(9bNyEz7mKET(ySKV4*xBCZsEZpu>0jM=0-7-@nc`gx*G+cUbG6NaPmLAW|z0__- z3|I_lEfE^zyLz)%Tv-g*4Yb+@0OJRBSANh}!6zsiRG3(ip2=*jP3! z@-2g+e}b*QOPw|^)&SGsBA}>SaPhoEV4yx}?D?mRHghW05c`+U)89tD#LM{7*jIXv zJ970EL-N+BQN9r$uaVh`PBlOE;a#htl&(r^jGv~?ynRhyFO$AnD}NvZ%$L;~2rBoB zVkVsMo19m;^Daf#d2yy#P@X$_sc|65#W>mMKGU!YHJ9IA%*1hr>Zmf;OA_vb(7Uj+ zG&SYg;mm2R-L#Y!n+cv6U059@05F+M(NRF7sN;bg+3q?@17h6M$j?4{7SEXRz4cdeB}%DDo&KN<8hxiT>ki|DD{G`kLk^u5jbttcSwmQ!fpVwrsrvS zoJ?dldOB@2Lk|6jx+BL_Ts+VFc(G2Qz)6L?oT;Uy?%)>STqZW|CUJCAtlO(dCzV_m)`dF4oqM49;d4LFfcYf972`x!Q`waKR@d_%zxIBlA5apAz|{c zeGfHhc%9)~9id9^L9WMz`Bgz%R<3%%R9i724I_!zz;^KB5i{W3b*IubyPa4~RV`Xe zylcM?uk{-^r|8UHSA)tp4wZ*gksnxRb56^nC&K#Q z3nq2d zGY=&1h3|IUIM?zXN5)nb=JnYP7mQ0g@&t4GLAC$7&Y2Jr0>$!09l2F!KrLTC=05s5 z&ck`OxTJ&+0N}F!@XlPl3rf3E8*HF#WD;{Y3~2P&ws1qjBw~6gd2v5>Q==qv3j*DBPH`>dh&XJwEM81uXCi z+wkRom+50VXe?+PeEEgwCzq|}8oAxl4>2(@96RBY{go~yNHzuqLE4cgbY>dgLP*%~ zkjGpAAb^=G^0f>5iQH?eF2k~+gVV%3T5p<;TVNrk!ZKH0ljasRO)bW{B8ahV;`O8F z6kr$1u?|deJx|WQ^ig9p5ieTI7Blv5P(bINq;lW?HviPLr6BhsYeZ3Tlo^)VDSBPv z?5JmTl07d4p|c#Um143Ik?JYOpCnKFp|hFZrBR+z zsF#qj={LHn3<1J-Dx209zpV)wTUZ7Q7G7te`u6F5ENvb2qPy!-V|Lc7OH#~-KAAq9 zcM5e_zvGMBOSsi{`Oay|pg zlMAm%AkO6QL)3f$&YPJWS#)wLyeX`Hb~_z+kph5+jxs`=5}OrbCV0zW?prlZywtmK z!v?q(IC!@9Yc?|b!8ux=lc6q)q#CoU>+~nquhvpr)~n%2QYtD;`tthQ*|4xe-6~eu zwVo6rV#c$AQLdD3#1w^2T4qUAvg>i@bYTH-Lmi z;&@17Lsiji$^fNTabfKXJEa~@g%`(jmj%`N>R@PP(Ypc0RE+2I)IDtHA}@q~`&?{R z<5@ak%INcaWN~Rn#@pMi!d`a8V}E&iI=5Pb`J4;WEM^`=;X_-uBv^X-;lmDl^Q=I+ zqHsDCL5opYtFJq#o_Npw)k|?Y5K6jcU;qsY+In>%Zg_uWe@je9`bOc(Dkh~7W}?=HE7a`vqZiWyJO&g!{6n@>`pE+0;8I-l5c7?Dehy7=an zjngh(=G#X+uE-^2mfiCqb7m|p=gl`)WbAF)*{UV`J2)~YNT(Wv+6`SNz1wp_ulHWb z2Y+%|>fa-ivnS^rDPp7C>zry8;mh`jkfDC-7u`bj8~}O#qmI_eqJ5=3{rUdPmL}tO zfrmgdc5>Ao8`kbyNL_PF(K;{S6Sc`IY1^gBP))kw_-@?=VKWeJ$;HIgek7*aDZMbM zj1b6(9(%I#%v9mBycXkOJ^4lJ8fZp()`+okd5^cA?3$6!m*=XerehRWi-=w zv?H=PamQ#H2j*fMGSjHeyPy_xJ{U`O4)o5glL#RrbqU^Mhjd*lowZR`qXf9!+aM9~hx{<&vioY>cK9CQ}%S zzjMDo7|dX)9KhW?ohjp6SJFCO1eeHqK&91pJH;-njrm<%?RpWU!S-iI*C|87-5`X-F;DV*f`m%A zNj^XxnV8-67T*qpn4&KBrRo#ch203bs-2GFo#HtbPBqh~B`S_xrkw4OTRqVj!!pU; zkJJ1s9|gN#C44SDIaoj}M$RO^hI+@&Tkme83q}NQl|IJ^O)MDZ zLhZtV+I-EELar;5``f4pMlOKWgZDih1N|M#<8|hPjyT+McO*+yg-FJ9kFU}oDV;g; zI?5C{wUhK>tTIp=6P5+W0G)a^tQLB?c;G8$8F8cy$UTR*%RZiipD+8yZc zUe&uO90^QhKE70;n4VCGv9F2_yM>Fof`r122c4lyJp~kTGxfa7Gl9UL8*AA%(n4+QISoC0{-2E>s#28<%EhMNwmtDm8(|sig`%|Npqp9a*A`_?jiY;4ekpxI=luGj3 z6AzbtxRkuaKFyuZ;#G<3Bf&kaM`zN<$6qAKeS2}rs|Sg=N95ZYX1%5c-a3CeX1c$- zIi-FRta0%+EA`_R)ya1zd$Vb24=$t@6;tbvot7M6#90f8U8!q|AE`ztE0MO95$67>EZuQq!CPY$Yj`W4-Ntws?w;E_a_M`S>?ZNqiA|jE8{hP9ZX-i_MSsnA#fv zfDV?}1zxY1M@wF+H@!@8LR`6utKXeVD>#*_BVvJ^PNHN>E#?R!VdmZQ#qdQ9XJQ z-MG(ho(afnaXiR#vH9d+U8P;Q@idVy&3mK@-!njuh5aO`c+>frw8p^m|>QqM|b9ci?N4!Oq() z$32`k#s=PPNA5@fYy@WSRmAN!7tN`|<1aE_3_$9=o2J(_bf7NLxX5FE^Ez+lSJ*IH zV3p&lsl)XhH7QnqDtft!$@d}I?vwP)El?1bLeM8Fo#a^Vn)#XjGps}N%MtM*ag1C_ zkCy`-a?a<*Ui?^1D!&JD+V6$VCi>o!j;VIF6F+%frbuhVebIU(I5-zfuHpb?2({!} z4PtZ#6S|=QqC{qcG`^DQGE%V%dau}!qj-=D$2vDsY1yJ3GKBU4&P`+GURt~83aHB= z14uD_i&5efobsen&skTZ8pf-YuW*1E8t7d3> zPg%!)YeGQB$v$ZJCJ|#*Fqei+-|X)X^hZfDI_7ckP)Q9Sb6*iwRmCbZ?$(Jd7?(+g zx5?zW>u9jWJgX92qg=F-lu;S`9jG;CbQlXO#8*0#`c4 z%S>msqbDDo3V;gibZ9N#kZ!Wa4|GOOWZk$hPO^>AN@;@0M8>`xMe#IB;CrjOuXCi2vLS?Iqa%*zuQX!-V3 zM^MGZGlK;Ax&F(10hV`LK32rVazxm&4&G^jHa-Oo3oma$cN~07Z7mHx96_jO;Ns1U zNG!a`^$KflW30SW8xclv;I1c3I%2x+L1=~`4evf)J%s5Ag0qa96kos{_A-GK221U& zCm1~kzB5jk+`hs}BDFWNQsdi;zM+U}4<0GG6t%75j52xZ$2#CB0h5V_Nu^=g9Bvga zJU?6HM5CQfP8C+`ljJ~*L`f^BVb_|1u{M8M*jv5q`bJWYwkVUNKzd}c=H2blF?F-X7dFuC@>n%d40w?>O$RO@{Xcc zSkC)L*)0TDHMMuT`;HK5QK!niN~7zNjx=1_m*0*rGa2ck%YE@Jw*nlo5B8Q7G;__n zYDlqH*#+D0>M1A%l26pSIP%SR!dg1LwU;PeqUkF?=C3@QqL;r__OWr9n=$3g73sKW z6BX&Li;8s*A51Uh*-T%dZoDn4|CBXsC2D3;r}XuPeTki21Wk9Boh>Bpj(RFT?{+u^ zc93M;I(TP3MHyJPBWYH50^f9xkGF=M1}Gm^!YJOb5sVc^wM5nKjkeD1&1g^^NqE>^fnV{nNDlJW z)#^^4-s&HJ@_>$BM=&4+sMLjg?ti?OLyzvHhLoXzB3r|=vfAh?E32wO`v?{CG|s>$QQYSaw+1DpjKIn!4>bjP@SF~;t9%a? zbhKB;35i0C6B-hk_AR0lT{W9>YVI=#NwWot%4|`;YZY+6H}TmaX@ftc`Ft%G4Z`VT zPt`q9OL~;kl~pKpw02{6_ocKm(THJ6iExp#M!A_RO&tifT zr&fC86s0vBni6xX939D7opxpO5O&bfadUk{Gd|u3-aK}B48kyO8+%xNS z`5vuCjCSMu@PHJtYeE_URs*v$A8!X2Za^rgPYM;>e<5;u)G6d?IsOcaW{j1)UP{U1 zngeRZct6#RcJapNuJR0^0#)>al{MDd+E31qo<_XWK8$M%>vYlmbBUvt! z%%v$vslf`)TecobB5|n}xE2cC_K<*>1vC{XQ8^xnb?`;Pyhy2fso$ntzk>YF51kq$ zfL?xi1e{fVMGZi+bT+8h7T~?`)q|B=QSKowu4H72!Ri}$$qE!X^AdW0dxc`)4*ZqG!=w7`|C zH5nsblqcI9y$-dr`WB^FhGug=#0=G>_DxVO%w)yP90s;I)-8ktSM>_&g64vY#prOM zbJ8<2{r9Psv{Zl{z#CTt6DCAR_?C=I=Eq}>>=+@V$|w$fvg^bfleEJ(hex9xTPGW) zett>8*Z>-LkUT0i;J&wh3SbBCDLOoNKoSxpj zAr;&_vG?xd+01mhe7FJ(sh7yyZTPkXJS_ahi*b49j)57m%v(`j>%{$ei$MI;{EU_5 z38x`yvpQi&Been*!0XZF=9&U9#YkMu{m4*`?H>LnV{vy2)8_`jxBGeu&8w}oBeHTX z6SLNx1%{QJPG!T+7oS2z;k9Ly3v@2Ja)xSbvhA;}9=;zcw#^7IJqM?muP zo~ox7M5j_v4+}!h(1>1*LFTK7vkS1Hw_X(V*QQ(>abH{O*)pu!9#_dgo}%Y^`ShAl zh^xkNP4h{TsFU}lQ-%xQh98X{>q=T!ch7ejbbhXPDp_B4=;YME3pM@o@og7p8b)Jw zE7+Uz*~HcbZ&Dore7YAHr{NX@UyINTRXYs=0B`Sb2&z75H+i{j!WmmmZV_|7ZoVM6 zpW~{(#Z>sz?&XlmYVMoNTNG`1P9OU_2|>*XM$=GtH_TfU}dpW=|tJsl`BR z7jyHq-6aJ;8whtX>SaQ+4|fK(v8&(zO%xHzu&j ziq_e__j33`HQI*Q%Q6|6BKaiQrG0?m{FMbL2A|V@5pO1{_tqOZN4|aX*#8n1BVwzp zVe&Y5J6Rsr%EmyC36F1Wrax%^UO~72VXOjA9+#u9sCwRsQ(4y8fDIT7K+At z7+9z0^HO(nTScUx$@DwlPnAl3nApw^Z0-Zwgri~M)|kzMu0e(6ktN-RHg9@ zGB6>)!`{hH0!$oDBrG-~o!L&m6NO!?iJrUWrj%QkuVDzVu8!fU_V$^S2YckplgsA10|6@~9Qox4tZ@Gm>6%9=_!3Z`EF E3lqtxf&c&j literal 5133 zcmZ`dbyU<%*FRusR!Tvzb^)auk!D$Hmo9~e?(Xi8?ha*X1Vkz67HL>Qx{*dfNtcFi zpL5=SzVCeRnYic9%)N8Z%-ou2H5GX<2|Wn_0AM6SMgt48{%u6K*giAA(Gv?mR#M7R z08o=idToM_#UW-04P^lEeE|T$VE}N69SYtB01qAj_+<p>FfB}H25-B64<-PDb$H)J^>_UHD`JZ=6DT4u# zNiYbE3P+fVj7m-I5MLY2aH+0F`5@hcQaepn`^cQuh*Eo2)<}H`KUun0Hd%8s&h=43 z7zKPl7Je^9sdCVLx;Ch1R(9Z2DdpWC6|0WC3+8vfDtA7vYI#j-(n`r3j{hyNee|R2 zrFYmA@l&YBTX{sz4@wQ@|Bgb+9fB97WPXq(-5kFvfPvtDF{CruNdt5Ov&IIzh9Z$K z@pZK0;vbCblWOoo2;s0pTyDvAY6Y}9Q#CE|FJ)ZQF6J~Mf_jI8`y!N7dh|7HnY32N zg*Q5ZkN0A_bV>DHo#`mQ?kZx}b0qia%ljFseyf76gxLB`QX(>+Cd!OfizMziY&WkS ze<>Q*!5=5~iVI}oh{ohVPFvGu$QTMU7jElAE7_P7ICWfuEh@~d1f>jIN>5wq4=5J) z2uu#$7yLMmjx`sxOLu+Y45`(d!S1`y#Lo1rJ2v}JGEVfFTx3Bg44rD6gzeSuV6GQT zRT9I2zL`&q@Z-}-ENl)7h*Nu#$C7r}bRG9R>7d_d(5e-g7_M(Inr!Ay2~?U^q}|V$ zCAw@gWftAR(3%Fs!e6#wU1E(?TRDmlO!GgFuju2SmU#NqS>#~CH^Z+S^zypamFmGb z07U9&eQwrf;y#1*r=1cTXtG=GO}N9JSef`LbO*$9`8HFM_cEl5unZXJnhE3lYg`dZ z6T6XMneB}qRkTeyI|3zes#o0QGkVF+#25XR>8ShW^w-H(u9SgDK3 z!kyyc1RO}BQMKLA5R183VKr&b<%pu`zUBX9vSs1T63Jpst!B&2(H~9>ikS9M8AO7h z9t}c&z^13KThRinOrjkNnBVrLB3E+!$|#N!31nde1)IBsolKA7#r}Y+=RS2Ax0^rC zOQNFf*dilHq53j>5|y;SMBY&KC$fd1zeFDVK)w@3{h~#TB?e_Sh+}hRcfC*34`v9h z5?bSQIp_F0Lv5;x-utN?aRExaLYq`0`f_QC%mjY*`}c~+Nx zO0oI)l9Qg~=@&Eh^N$|)sNOMxsaGFNY_n1KzR;pbdGUzvR+fQaxU^>?)c(Lo?F-v$ zUG2gL(2MXQjuTE}PS(`GT1Oclj1y9jp|tlD#}Z3??u|{$MT%xV70CJe*Mn; z_r&xA(lQPv!D)ni#xVZp0C+DiH&thu=h9RTMJTfAR+x$x@d7Mb|CIg913@JVs81KU z&T*;|uE~IO-E90XdLMiNA;ZVQXgntx2_m**0Vbhdn3mw)}W& z+eR<)|d}9F`dlck|M30+hS-I>e0g-#bP*yw-^J_ z-mwFX38t6fn-`1bat{$YDfzZR(ogAMz3*EjuXKGR+D`dTq$R{1{j{D0SC8Ijh2|Xy zer&*$U#hz;9QIHN`%(K_ix$WjKC|~-@*RQ+A=*L6HtAi!+LFghZAK7Zdj9cJ zL1pExAB(aZFp}qpocvx1C9x`JeNo(O0Z!U^@{w8${tJ|tB+|uLtnx3z|DaNO-J}HS z`C;z262BODM}@S7G(UthVLYf9Wz}eW;bLD?ww`-T6jqJ0gyG7l2Q5EmT6jOdM*ac)TupCI`Ijks81UvV z-tH&o4o6BV%J~ql4>{aJXoj;Nx=U0PUrFVQ(T(D4Y|(mQo6W1R8~l2MJ;NqL#3qWp zqYNFIZCbHh=21kc&&^bj7Isf;;%9^z+#@_0c z?=+=jTs@Tn(wh&gDklTOk9bH7z!k;0hte>&_~`~06(S08ffVpymU_9b_aRJ6@a`1* zM^BTM^I=Xb?HIGMWa^9O7TRMwFp$DvmILU*eCz8QPt%v& zyD4273FDB#UdDE1M`2k-8z>&ym9R={RyY5z&{i9#fqMs$w1xx!+|`@=Wt~-e3AyUJ z1J#h`Ng74=asaT8-$f%`7D535H(kei(LzUohi~zgTs_Ms;Bw&v!=HmWSU9cXLajky z)W94L5iCcU!>)n7xT;axIzPzI@h67@DIGQCFNeFAK9$97eHyB9mJ5upO}h1Qp=t~E z<<<1RIj@N@XOq!M-%X%Wx0ZgZG)A8}xT-(^)=LmYy`F0rl?GJw&>ktvUgl#1)i6o7 z|8RZ!c#fYBz0x>cpONQwf)gx9&L5`-+D3$r>@kt8sVM_Ho~uu8HcZX2L7$Wj^kzh2 zFknA-WsvghiRiS*lx$UVzmNr3xrOxFH@J&dCRI2RV|4ekTWd3?{VRVJi_^NkYB)cm&DZs4g3KQpKWQghZMqH!n=Ya(66y@>4?NK+?mZ4vs(@H=CqTs`q0XoUsf2=YD zi9nv(1PA3r$@74z|H60~&#PRV!i1#24hcFl`605MO_~h<78k$BgT$!0iQxF@dy;L( zb*J5MRySm%*(oSrg-U`W${}gL;W6Gwhu3w`$%t~9ptP}u@6hU-pd72tg^KgDhQSRv z!^KWjzXSBA6RZ!sxL8im4u$B;ma_=ot<_@6~LmdX^%oKNYTqE2~`6ne%%Z4SHueT8A`i zSN>yQUbfBAVw36^M@*iKtPZ?d;r7~hy9^9gGQC>WQj!Idgf6b;4drcd&CAUe@_UYK zq?a9{-@^?j8)uiP`v#b-?Hf93{FM_<3@8;@C99Si;&4MaX}cvPxV;1mGo}2^k2xJl z(u@+`V~xAz3a>;*q`vvJdEnacv(H}y1Vr4V&EII*a(#mRP--6=o+p0EN$}46RS8*# z$0-s1zPis_S5yCe##E=|y!bk-a9-MXi|=&EkHE}Q3aD8GU~9krZ9hPVu5N}X6Kr4ye5Fy(-5w*&v{n-H^v8)Szb>X3%`C*c$TL*3Tl zfpiQhPFCg($+oy2kF#6;sUr)ODhLdDaSykCzSu`Gv-4zr_INO5-LKO7B9V3WG*vYs zN=>h4xb~~=UNO$UCbMH>r-M*F)B^P5WPP`^Hlxc41gMZKOiA@G{|~wLR?;@2}}M+ zj*+nOC7+?#8LNf3yCu=Bh8g=}q{=ESvarybu{ zjmy0t5boBS4LjigZB$~tD`C8zdj84NtS{K*aRhiQ2@$rNRgj$+t`E{6%dO{x#ZSiW z${BF-L4lQj^_*S5Vqy#K1?_`=-0Jm@zn#2FdIJl0R)6nt%F zaZg~j?pB$2PUz+f)A}?jjGv~Ke+PfbXYz0CEsyj&h)Om#inlMTbI9#ht$gj(UIWW- z8mwcgI*U0G-*YJBXIl}p?3wVX{r2Q#^Kwi?n0dd%TEF(EruPZBJP^HMX~PkukTWX< z4od6jAn5%vqnH+Ft={*TBx}2MpX}FK>JT-PmmPV}8u#_})2Dai!qSphU&Z@gy^}Ap zkbj*n#SX{K9N(VONguXxi2GAT;{Tl4L|c{xuavD&>b~WY=gD4Y5Jbzfx75^H4iU-? zel`#jq$Q*m0;^EIKKDmYw4IYGzhEAd;`7ViRvGrjbg>@a7(D;3CYh4?xUQm;kb8?g z!_1Cw<1Z>q*2j|{bwB9wl$OmXr zdn_+(ym`3u-K5K{)I#ZTdSOFR!q4NxnG(xAtYtU6+CAY9|B%zUSVa-6E}dfJW9o~I zLZ#Gft!_piE=`BqKi|>+{^_pqGWNG$g&=K@P3Sc`Q8hK{XA%GvK z199Ku4?&-o0yaTjoB4y*St5a_C*-Tk++1=F-J%H+;r3gm9wQU4A7xZ5x(}M3iRG?* zrzEvp2{^c0`my1lvACjAU$4k#N9%~%+&%506rc*UQS*RZw%1()zWd-F!6#oyE<9g*jqr{eVi>IHqP#50N{<U>ZM7{zS Y@Qaqx{TTi-9lHg9lvR_SuBu%|n5wcI7Wzwc1Ox;u1$pUrz~Ab}4=M`qTXX=0 z3jqOX$WlWGrUOzEGPSp514Hahplt584geehK}6i$0c>gwg;AM6%`NRjX%3s(Xs9e9 zqBPpPAP$g&6x6~}-qQ)H?y0O{>S=8%2%!-dLl6m?#Ym0H^u~aR&=~n7y-wy~97Juyg(g4*+hk{}as4$;QF{p9jJ$&HlBl|1#zg z@^9!+cgz0;{SoqS=m7iv=LNZg9sVa|5a|CM-PZQMEZ!L=;|eh1A58r(tN)J)oHaZg zpzQCU&h{=&rcfDIs2z;3Z!=AEqEe}~xH*gJvjAy82o?*9f-kdjh$ zvNyA|0btJW-ZN` z_kV**J#s)D&>di#f6oRSsSv;tOEV8?FbsIh#lgkP%E8IX$)Uk1AjH8X#Ldsj!6(G= z_g4SH1~df%hJpXT@E_%!N(2}I0tv}mI>YRpJpOw1w-TsB9shp%`_aboFX^YE`b!3c zz^0E36Qyx*vWK{sLLq zh4Xj$K$^L4;nlIHJw2%Qx0ag8>Qq46hi_F{;qtwytd(HT!SiwXjroIyteck2^aD|% z`M6J+wMnp&`aIj6E?WC9y`+41*9Xi?(c@ju(P9+VSBsdj}g{m8aypBGzS&eY(7ee(NT!j<9kKWzU6SeS?oRg< zJ^^oQJ@-2FTJ%De$+g;Dm93=cTj}T-UN(v_5g81i=)|w=GO56IBsz;ojAcy>kPH$n zH>wD-aTHFDsW`otQ0ynHOYoKv-NezAtgTN-R-CT8l>=V7(bVCegC2h3fA7lZACMN^ zeW>oVsU%AVjgRiv<6=Z~t)K+!jm($`I{JLN|KX=&QmYfK&urD_r1R-H_wU-=?_Ex2 zLT~l(W^=#b8q1hRj2dqpl?T7bVSS6PI868|xMD9v<~3NxA|k#Wzgk8Cj0PZ9Ala(D z(+Q|$e9a=E_vv|J_J1J1`aeNawYxz6ME{gJXogM_wX=WudM33+nS7fE6BF~)zTi@X7lCKkBh!EZp+|-QXR{zqRBeH|2eHkmezWEoQ zaC~X<(?m!RE~)~`6BDL)L(&j~tn0iSYe5)mXd-Cnqc8y}123nf6YRsoT>%xK$?MI`O~EDH1p)Y|-yLF%d<-fGtu6==? zH!M{jHh*xys+GcFumBxDq69e6M=X8nv`C*qqECtI^=Pg!Syi>?NNHNjXj8@)D6zJ# zgrfMHVYv9=V}U)(?IesnMvJm0^)Z!-3?I+*>5>#q!Dlmx+2vBGVQ)Int@suq>KgIV z`U2_Z?7XB~NhIYNv5BhS{$obbZMDI@2d8Hgo`EpPo)pnHRtXhqIui5j$fMr_LE3ih zFN)v1vzdR5=fM^f8@rDUY09Xu#yB{68KQh>ezMbmGqEy)&qFmw2CPl3(v0+eme9uT zkT;FG56geWVY$Sz`v7aH#13-VFJU4DCr)*3Vz(QKYpL0PSamh(+?TGMDVp&X=OsP( zsXZ1nux;3Fa*rsP-0q6f;m%|=qWM_~f+@vrtLEoUTa7Dl2j$tjM$O5eFw@9nrEE^e zd)l?#tqqTalXfoSaKfy_t+s`Q(ks8MyhNf-;v zR(%*~JvfabI!Lpf_OWg3%2SY2h+hk;`E4PQ z+q{=qEt5Oen1ri&tiO^#-J_sf-zQZ|w<~MC;VL>_j>kU_l^vFhM;osjsW_!|FL{~& z&Pg!{oSjebh1Qg=2c@?=4^_8)o4LclFbYm2T`8QzIAzO57zipEsj~FMX*GP8dmoGX z9^h22YafO8gd(#U?`NvX#V+?Lk`*aJZRdd)|6j~k!Ma&nFi zNyE}E#FrY1Biqkv@M6(^`+hjQLuP*iu2H%WKCo?4*_9q8m%JsUc<4Vx+yqO9K`=#= z1`f6Ch_|c~ZD=G->XTp)GKJcldXWeg8?djxw*=P+8rMh|wB_nuRRCd?lEE)os?lX;{VII;kOwoVj#$jH4zjE{BA`8^&SA%c>e4q&zq;v1c%y`mrFdZ(HX`kp>j`wS*MR-aFLhzPpEaZF zGCW#E*QFn?N*uxH>HV6}N6&A-6;LZE`l+U@YvWAS9meY4yHd?X(pDZC``=+(O}%xC)U{1 zOJd}`JlC?O9;1d&^IOkDdOOTz?;DEhbmFlCXG)&#fjZ`nKo$Y;M?w1U%78$l(p89tDrd&n*#o}O(Jc<;9{aYR<^ZZu1^xl zp$KSwmfVb#`^^wE3`_sjs9Q>>1Em#{e#*D9Mlx4do4uu7qx5 zFFUvulL8+ecx@h!zC4pwkk2?Xvlj{y28XQ7IoWnWbmc6l`|3Mt%m!rr=jLZRZ|5MO zxk&McJoA~>O2na01Ibtg9fNQ^eyTpM#mgk38Mi&2nZ41)*7Nk=(o-a7`Um;t+VMzY z<)Ob%aG_7cDe4G9;r-E&39>Ma@Lu`I@h74M<{&dv;)Iy_nXi6_Nf_D#staaNO zqf*12^p&5vreP_>#}$oyLIC2?A8)< z`V{H+Rmg;`n-A2k)># zHbnvZVNTtdsVoW{u+~;HGLT?g>ezHKt()1n4R~5;75#Y5;|n(=#1!k7Gm3k{p5YM& zqL`R5@x8?xM|rQzJTPYWyAH5e6xbWLf8Ev$rDa~tA{(~~?71Gy)Z*zTdfYdOgC8on z6%$7ZBr9?oGQDbTjW_daVAcHUYJ}~;RLo1*=HFj`LcRljfJ3dcgEGhL&vZ5PX$!jF zV%k#*3<6)1Zk4Meky#zC`{I(avx0F005XrlMwd4At?{dQCI)bP26~fEVtb3p1Y0g& zw`4E&e2>{*&he`K4orHIO_?+nM)zXVM;(&#VNvnN;n&98bP)Nzh|{9-g8Ku9xbGEK zh-^<{e>6)`b}$`vFM7NQaFef~Yp$SvGQGG|OFu{ii|$BOi?en9P-Z@SWhjMHF|je6t|CF3_}8O#HGaCJ|EvV%T2|sOU5R? z@~a@(8hv>eua3(F9Bx^9H9SXbf5oGEHhwE8CQX0-tIVYRgvo+Lcfz`Au9nMJEq2 zw7W-99Mj%Ny=K<%uPer5{T>ZC-{Y55tvlT^1l70!O|_+~L#;;AnV=fEc z4;+iP3o3$6J0e9eGc}sY@D0z_qkdE1M6h>Cm@8-OvcAKn_e(A9H@N?_G`lP@(wZi) zn6-MT85ZH<-#2O%Pwuzt!9T+H`xHCty!(qrtin6O-~>O^)gnr#@gf{<(g{!f9ukHs zi}FOv$LIC88h?6)Dj(fqusg1edyJ;ojC8RCWw(6wf4KdsQsp&e_B+sDriSQ>1}#i` zQS8UkFM(^PDl*A<$IAe~$CCB9LDA1ahjbaP$)vsc#TCBCv|@ViZ#i^pZdC6m+@#85 zuzA$$?7i9~uB*XW$2Wd*&h8fokxT(t(;m8cYzuom*&M>zz;774j;;_!`A-&Xk zH&aROXRuq9u1*7-ST}HDr$ZIar?a{48|nGS2RQ`Zr@={pK=kK+BvDE`259a?<8%M` zyzs>LvTtf@Z`&w7qbnEny*&PBa^b?g>1bj7?<_ZLDg_()-$}Yo`tA3{g-p2#`?#kx zwT~FGt^{!4-)$vKw0Hx5_Ojf?vCxK*jYP`Ia$Ae+RRs;P5mb|EOegS61Z`HESh4j) zu($oZ2~~-IYmV;ia%%cBAko%!$8GPc$+;HUg0Wi682by!AJKq;zU#|^>|RgEoc2G9 z$ymN3GF$<85kZ(DYDY9A_6Nc1a8BaKX2yk!b%=z>SLZJbgCjX~caEPmv=~ZA)?k6# zK|#3L@=v+YJPjYjUWf^Mx!NutKRd|H6@hhZM1qNL{|xxt?oHGYr+w_dp0y2cpZ)x8 zT)StAx%Yl)BYW#^`@cf3-Lt>^nTYxJrVR~peaGvEz84& z@I$Rdrbp_dG#0g75U`~!KIJGNIRili1d~^OsfPPoB+AQ5O+@K!P*ojcZZtuadGQXPf%h(mr>aua#n2WJhBiNnUm*A5KQu4Xs0a>^P55POD> z_#ZB%%Kl)pF@Dyq$c8or{*K<)D4U6f?;2&Apv+n`UCx)W&eu3+MNS2$U>#ClWZ-P;ue=$G3Eq$|Sg zt=?lFGjWhH8k=oJHLcxNFh8+2buIG5Ehxf}oNNr?;ZyreZy~-nKaOSUNQ^!2%Y8Rq zyV|{v=*aXVxX3B|Z9fQdf^qa(Fv)2(xk$HCfbN#8M`0Op#|pVUgANT%F@VFd?AYXf zdPn<(`}@tths8d>yWa)CU2D2AduPb6BHozhoK$wy;P}&(A2l$*=BRrfuJyg!f#1{sUSqdNR3CE5;?3$?HV)p%DW3p`-2pHP!LTkOM%0^K^ToQy%|_-=JYQe$SRWs> z+?4iC%xroSeo+o6n0nT7?z%y=VpliM#9c4nAL@*)R%x>x3hkze;c z%WwHrbY^SCmI;c^#AIi56uHM{Zx21qE!@p;?X59+YB~Csc2*O5K3xaD=$+qAVmITo zrB=4hMVoGd;=k`q^$vpnOy>g?0Ms}{3tZH}qzK{q#Q zrZ+3aK6n7ejVmXSS7wXcJihPCmiUPmN_2~D^mYb*d8T?8mcjZCP#c@|`znyZjukll ztG3 zeyVwH&gRON0ofY&MTu^+#x80&AT+ahS$WS4YkMH2ffEtVD~Qc5${hY&#M^G*nHci` z1CE*L?L?jLk9*UIx(rcLK>kYYtlJYq$s@W5ns2+kV6GQ0)~h|(66guYdy;!h(Ws}Z zd|w#3Z*UefpI+SZ$t*9}lDc1yz}-c!ruNrZx2h&<>VGrgVH_D5Z*YbJiKMMHuev>r zFV+nyg)jG+y*K2(Y~sUj48c`5l4>^HXRd$vTW@HdsiYg=r#Z3;^SP>0oNc~}#L)J1 zzxm;~5~iV6=GeHo=)KU9`kN!m!-SoDpY`08<= z<}-57!09*IYO-=lSv*&Be)l7}_NnujZBrmGXDLJEn}iVodrA>mF3oh5h>)BFvR*%q z0>HDZvtLS}^hyRa@u$m7Je`Gg@uuRC4@-HlgCRN=PwAUlB159|zAr!&`2kRhxG?xu z%4Yj;b&3V)c8ahH`F@kqq5tb45jn^tme1h0f%4epT`TSFp}kL*kDLm-2P8AUrV_in zCqw&-u){4TqEz0LjJZUP+q6EDgq4%P;hXW1g?_)=TkcYe%*EPU8~J$Sp|SyyKR*nd zwFm}ZTg+^5gpNLM4m06^Sy2WuEYR`_zIPx}lp0e~@i}q>c(B0Z@_f5R>EfpC)u=OP z`EpX6&PrkdBMiO-mtsid;dSE%ZkCEokMy0p4h987?W)&vx9J?l*53?s(%>F?g|1O<8;&a)H*8r1Un$UVlr>D0sl zT*^J!zSZbDOOWu8=snfM>2%@{k#77n5H5+|k0)pZoBQ1gE|RD9nNm2gYJ8LgQi<7i zbAf=1{2bb+Kjma*cQw2VWcN57*I7hwj93|YlLjGIUDoz~OYV0ttAmI8)3(Zo=@enf ze&b08c@I>fIHjBoC+?&V6IIa$WaDvZgcl?$f3om4S_$f#1KL_IcBa5)EK|7GcRV zP*cr!jmPS!Umo&K-oF68tWRF0FTZTx*{Rw2A`VI=V7B0}^4k9oX0w$fA z!Ycid`L`(2B9BzWuV0}IPtJCWHy^E#FQ=3pT5eJH&~6Zj~?3m>bj5p{Pl;X;t>{l<|A&hLm`k;wfN!w!5EP+2^mR7O@yU^ z3$ovZ_yc~qmmRy`QKxR}F`Ou@8=vy>Aq0%8NEg<*@_kZ|-9wR_TEU%}v~aPK2&5VI zXW@RNNmBmur4|jZjq$v$f_q=!G;8{U4a&pLoCQUr&J9I4)$VnM3YE*> z3Jccn8IGsQbv`w2Hsd|@Gr(}sqx_*a_HoSt2w`yzYf}EmiOaz!pY_b3t1M)Ys{O+ejM9%5b zSRglX*+P%=aajIWQ440eus3(;FI~j~%JV&TB3|K2N;=jb1z8uutI`tTD(aP1%-BXp zwV7GXu$m;L%vBa4rVN2k?TbT7BJJ**z}e<9*4j1d-kyDoXs90*epCD5_b)+KIkp6@ zK7Oq5GJa~M8@0N93Cs@TlbtIWabMok`FQC<4=iABo!Vmpv>Us==zzo)dhi~cFaf$x z0_45rhrTwuQb!D|ABe4l(a8$%Y}$H3KSxw3zTVo)25$knh(}uguG-OV;swxT@STQT zq6c5W^Ez|{9rcTINSX~zNTNaW_~%$?vt|?z{O&T>mEdkE0sZOu{c=ka;sw^oEZWoKiGK45v$psF~~gtSx3v`*Y`TsOfHN zzKz@ap&GfE-jj+-Qq7UqOMccUosqqf6O%jd_Ud0gQd}!{fg3-JsDC*TSYbz-*59Pw zi%%H}$;ecH%p)G>WajD)IOxXqP}Vb-@1gt}PyDjAzMFG#?f`sq0{@u5f;ATEVP zm$|;jKb6d*RAi4l=AC7mu46OK!9=T;Q9(i%Py0Av-A#iWP6rhvo#96d%vJrF25Gtz zvplJySuMAf zsC_}Tu}d+ujDc&loel0We19PVDzrTRyGV!Ir?^mg4@9OE15Y&~&v&eBS z_Ei4!E4gRHLNzfqHdPiz{UNhVV%JNepF&TpHC?YI8AK7Kkgv>teWwr_^#S)1O2n5g zeY45FT3|Sus-fwXk^hY0-&W>g^<-K@2aGVt4~oZ^t`1LhS5(NPi@{l;kT1%)iHT)t5m)K<9q!1t<(>DLk3`$iRz2z_i06 z$;lJ7{QVh;P)(K%*IUk~NxHJ0{6=?Y>f>6$r%c6-qryKf{QjV4!0(VLcLwYy>%iGX zmI0uW2&Wxk${^fnxEPr~*EnQcgj{S0sV$aHk~M$e=*3U7wc|*2f>ud)rd`KiCOkHkFk9xW?xVKpi8mQU0BvwXfqae01T%d7IIo}r-J zNqgFiNqgKH@K$7|_}hn(#e_^U*6@jnIa`rNFCxEVxuMG3uVUo{%&BFkvwF`iudEMo zqk1q}Bb!5~tW%x?sr6H-_u=C&&0sYR&Gmi7@}S7ru+78$pje=c@x^zpJ7+2z`%AlNhy`;RCrw@T4)<)DEr5P+~}%FmvK9|)cVdh zcjn#729fVte7{|vS#g==k2(qdFs8xpSaq$kgIXKP-3B9+OXYH|y%`1b#6jzu5;6nZ z(uD55S9rcuz(?{Hd-VTrd(FiMcWU#Sn<#+b_rlOK*y#4ab|vh#_}Wf(ApqqUbW9)+ zte+FU!ZLXxjf$2w7r~7y3+n#W&0zoj?iF2_amU-2t_KD*X`IidF0IWgo*KE(0@VRP zcmTm(!Jaa99%5Td361Ulb_vAVRbhpePk1xRGJUmbct=$AQl@MT@SoO6<#R$9Y(gvh z3bq^EQz0~!*-_kWQyoCS>%BgvauOCJChaT*TF6_&>{wbl{(ieJ{_t_Ze;HY&H#I5y zJUu)SL;z$kH(>0R3C`3=e04bH+37YcCYcm%Z0}U;&C`k+Hs;tjaE#IQYK2wP55)Ve zKb?@e6bQ^y_1}Asy&jk50@0-8=CypT$`&sVPC`iM3wxWD@q(B7{SH$cUD(L6{DKS3 zSiOPr!9ru^knb&?*i~g{y;q+n({IUNr_&jGB*Yt6M854mSIzATeb|CL&|Y>>rF~49 z%xkplEm`Z|3&l}^l7}s~rdUAl^Xl`5w_Il;yQJjt2j2)5g@H$>(laS3$a{dKzAKdZ zz(a|u;x&HGhos4FAs|cBcaV`*RD_<;TNo*q%Rj&c#1ER*1VG9q^x>>aYH1%b^72}M=JHEv*!p-ca4u||48slyfS!f-Ri!;O#39NiU$PD^ zd`05xE9X#+jYpMF=r3*4`1n~pu^kwxv4 z$C4vEiL)ZP_(;IU?vY{gHfCaVW6M;;NAL7V@>#YDM4o4}EXk>zl-OtPU-_P2H{G7s z`TbfiX^|nl(u&2?Qbz-#{ooY`JS$ypO|ME=GJ}y7;NcA`vC5u@c-c*BGRug(IM;C5 z%VsBGAWuW+Fm`}^vcFr}oPM6dK+(#6m>OoS21x<#KnGo11O8vdOuCvfQ!bc@bPDZu z>VVZa-9Zr|1yU0w_T)=?;+KL3EnOK#0^)s+SPe??Ha7U$h3#aUwLgdijg(aOyBiJ`72j+VW!GL~UN%F>EU(YA?>( zhhLc-cVS}S@#H5B(3{Z7-c$<0r$zl=V^mbn#0YOo>EY)y-OsO20R1%FxszBK@;rmV zgA|yU#Z14CJ>VG8#a+f0u=K2!Yp>S34kL#@ClfMw+$^fYKQz8X$G@cP9(EQ$1dpjN zKCw4Z;D$D&w{ne3+b~60PI^k4II_W9$HYb6GA`xivQ%3{8Ew!MSf&fOg&p2rLhtvr z%f}|*SyNAfC3WkwpI`>+3rSdce_Xqy0(u7crfz%A-uL5BBUN=Muw~G3jtYUX|L}qIi9Lr zDzW_u^p$wXLT13kg+&6uJV1U0$d@R{_4Ibqt0p*B+j!=yzBZy$SaNJYO+vOTE-`~z zBkE0kGdpe61g`B(c=9|4CW>6QfbSptP?gM8Z*%?(xKCuH3VsYj1RuJo7)x%pdFE4U z#b4p%Gs}P@?||F^Tzw9q*1%m|(cojYe;CT)NeZ-+5CRPWq%pB!Q34xIC9gh*YsWTrIG3xa49 z<$o#H<~$epixay%g!1x zX)X%9MVuOvsXp+OgVzfbnDzC_-G&c2t0$^wzkMCHR57Ot@#wbRZB$ksQ=K3yf`v#k zfmkx>O4tUxyS*D&18OUDSj3vaBe`^y|5qFO{(rXzB7K-x9L#-AEOfhz`Te%Xd^V1v53H5MdYR`Wwfm%ONk!*`$foWQLRt4I?DQ_8O!uih^%UQ zEYHe_xOEacay#p{jo&c8)tm3_C(Hmx3w9+IvK~m=(VP7;J*s_W6(Jm^7e=zdsjz@w z+qDm2qgLTAU!DbU?4DhPlWe@+vSb14u^^w~o$w%|dA?MfCXA4v24qqqpp{T@o)7~} eP1BnAfO8@?hGfFiCI0xo3JNmH(q)py0sjxcr_5mh literal 7140 zcmZ`eWmr^E(@WPPsdNiS!;;dnG!jzE(%s#Shzlq!DV-{?NGu>7i-gpIEU~20Al?1# z`#s;E@5lSxbMHK7&YU@O@0~MeB3@5Njg*+47ytl}YN#vgV<7xLHz7XeDL0A_!T?;y z7uqiXfVyOoTWdT_pVd}fUmE}j;Q|1nVgP_^3@U010Pq(E0CubZ0O@Q1fW|AY^_47U z0N+MSO&Rd;pR1_j%O?zmz)wS4gv^Bp6zD&x>L^Pi9BEnxcJA)zosmG0ihZhR;U zQwl>xy>rfbJi@1ngma%R!X3x%R!I%h?Keh!95(U~Hc##;K#ohxqW7}TPx5>VIGotZ z(oGa2t%80#k|Q6hyM8-3Ji=}4_ON2At>12VMfhrhQj%uWnZJAlj|-a&E7+y*Q}Qqm z4l~{pLbhKv9U3p8nfm8A4ge}c1w0nrdh*L}>BnUHzhZuy2mNA(Xy#yr zDT#&tSuOoM+O5u}j2aS@`c_kFhMd0b~>$d>#{!utofWSyA)EFoQzlVSgHLC6)81_)DGUzNAZS- zxurayWY1<|8OJM)H&<;xZFXKG>M%0QWjR6m1_s2!(KLlBnO$hs_{Q%ga-m)EABQ7Nr`tjOnzHLCJv0GTE83-vB^02_jM z>fM;?U4&v>0COX4B_A6Q3Ry&eg#D&8j_l|0-gN7l$e1{#ndmPymTjO3Ez7z(g3kBm2I-~TShlM1OL^B@Pj$Nmey+b2pgd!3};>tCt!xJFT25il33KKvS{iic9toI`tx)hK?(-$){h;}6Dd32bQ<@$sdgFF7H^ zrjbpUzU%!F>U~N|I(W@N%jZC8B0{w@Y&7glm)1a(aLINZ7fL>qQ;CApd3!pY=uxDS zMSN(nr%(qs=4GmEIfZkRUycFcc}o}y?ZG2AC(PgY)3x|<;URc8G6(sBMESP|In!iz zs>D^HI!6AUqw$h_Z;Rc5Z`nV@;OUgU!|dz_i?OoxRra1Wc&sgQ><#3pi&Uv70qNDO z1!l_Mik@g<$C#ozdK1f}YTg&d{}h>*o}dgYnZ-j%*g+&j38DC~gABrnYGSV>u6>|@ zHkB`evG-t+tdRh+Q4zvk5`M5n?LTuu9{i4C+q~rW%o78rNwHFroJ!3U`(5Ecp+uc; zSu`p%;*GdGEx1Av^zKOi0`0w@8JNwN?P{6)xrNi>UjL+&is7zCbr(deFAaZlz+E1L zewQ7p@N@RIYa%}X^OHA!a`Uvk7DS!Eod-h&(ltPLw`{e`#kS&os}qlOizs<7AHSUz zM3k{5DR&~_@rr7Ke}jm`$oopU(KhQg#^@~hWO-yLRiC%5lkI$H49y}C#aXxf^f^QL z3iYYya?;@T%tmBWxidSNd;jG>m4q`-C9tR_?-zeAsXvcT3s%u$&}l9~p!@zq^kMY3 zL9mEN4z)CzZnL!T!51#7%4b=~pGfF%M46CW(9M7UY~yA8;I`V~=Q$^)aYK4tt-rzG z;mYushl`LA^M`~ze2ttf!~whT-`KcxM${ih7Sla8cD@3{o2#%9k}q%%TOx}yY4(m! zJ6;f6T?Po0A+9}8p}&&G) z_{?Fyg2?vHEkV4&#)Xe~j7!SC zvIdVG*(R;3@&{QoSJHBvOx{<5og^T}Y;Uz3*pFk;uC&gq^|vN=_M+S#hW#}VMJ?Ov zocH{9y%wc#9bCZ(dV#xA8FrUy@7TYR^CFV7GC_)Kr(lH(?l`M@mn#^QkW0;Wq^`Mc zc|nTor1p+K)ur8bYt)m2%(G!hQCE@0p9P}Bg5k*|@P+L9>&<;*OE>oMp~T3jXH}+$ zf-wpkf^G6Tsm{5xqq{9pg+*AS@l*oLB0LnpJ3cGMVzODIjVKU?x7^s;BUVZWjFDLFP+TBPnJSTH+cFqf}RAxqkP9UyCn#Xd*$U`&z5E#g(Yur`csY z)4QX1RIU(>ZV`|sQ{!WVL7G7D-if#|gn*?G-^bF7GPCGiEky2(u}Uc8DCF67l!mu> zz`Zm(4^DXZQ+E5^YH?wX>>J}^vihuH<0pl=G?!XDsgGrfia{ZLh;2mT6JlM>*8=7| z^~Jo`3)R#vS(Is@lJQZzwmx%rCzitRtJfm%qZ}p8#?#5}TB~6W(oQpq=eckcm7bED-?JLHq#o;bwypP?PMT5V(hDVR?2!Pw zkI~)rQXMdh2smks3IX5PI3EX6sIYuf~cCU zOy>vRYZZ?Zc_W~+RDWifArjN9u4IZ|@ykMaFMcqy2_vlSz!@%_B7da7!@oLc88)n_ z?>Jjg@@C29d*|{3s)K-rGRZ+V^8JwWBoMr1m!tPUA!?zSc)5>QL|k|=s~(4d4$W_( za+z;|4y&*|2moe zv4&cQM}$ejaKcvK&!~Z5DFib3om)O~ZPgdVXzc`BaZ_F*M}fj*qd0&9`X_{WcYvpr z-`iJLJussH*fI*Y^W-Uf_|^X|+>cZuDNPSY8HMya z-M5_}R%ILRQqH7dV=%AX;WK>4ZyMWjg0q%tbL;A1hA>wXXGlO(cGHMyS(K zs>H6L^Rmd(8mq@@{yh)nZ{+wLk;9SNpiftlzv(J3ct%{zXU0J2aIT--?`|s642USR zyuiK(oly8Rh|U{+$y~&N4M+i(k?u)VKmpFFX-Pc;&%L7S9dw9&uAEBjy=JH6($N4C z_P&cupQy9g6pM#*a>oQMFYv*0%UF?lA*SUn90mGIxr`J@sOICYUlUnN&95x)m}V(1?S~t$X2wXNt*? z31UW-1ULBG2MzjbH1MsTMC&?yH_mG z85ubEi?x_EYpZ~GhOU*h>)pC5XRZ5q1Z%6~E4wF^nFm3*dS+QK^R2^QEguAfR+V#m^1g=c0^1AAwvPD0W}d$}*>RXYLrj{M{Ob~c;D)wF)bB+E0Z89~ z-?9s%OOK7jC#*;Yiq2XM{RxvQdXTev84g$1eO6HgcuYpa^3Yx2q6l~HSj(P(WmnrN zVE+6cj^fh_O4=K#k`*`1x1-cnG_l3btuhd39@5l33EkRANku1hE)w%wTACOP{311d zcogmL*R{X)Adw~St$7QYeiF<-y_s&Axz=9{MBp`cAq zE&gVc`VhHh-PV7z{G}L8^`0Zya$Nk-63SC=LjW?Yl7>G^#b4`590Z%9Z}X_A-arbp z-xZrmoE8-<4yrfEH4+F<2ZEfCWch4zcPe?q(`(ah_fo2W!U0MRihBO`DJXpAwjPurr`FR9z zaS&WIhIQaB-EVSFO`$MnDqZom(>qT^y8zcu2P9fSj*-m%5*6(P=g-Pw-+>rc^uZ)- zKfL<%uv`7F_@+JWe_q2fzXxKoi<6~JG@`oHsA@a7-d~WtDTHIw%7n$i8pYk;@{y7X zyLc(I1~x6pU{qH0W-*dE*UlR+72l45sRHg5DgV=dC^MG9#QB?<)ZdpGx|=aSrjdA8 zOtdl!7O00VLGz(a)2442*?h;pOt`7>l@QGuWc4k`eypeeu*qf$|I+JvEF|DG-8 zyXQQY!xRcpp>FVoe zeE3>LPHM{OjtO_=_$1cXVVSuSEX9NIbGp}#O1GC6ucJAm5@iBThD{<%itDcAN?JCl zUO#qB?|%5V^Go5;#_UeMFX(s6)h};c#(K7M<)B{V`~2g}W+Ix>x$3afjlX0$cl!#t zcX!9?b*>*!TiEilQw7T&LVdMYW70>xzI5_P6IaR3ByJ$7@Y$qD)6C;3NodgRh3}ir znw*xUvX}gx-3D=7R*vo?-=Vif{#dyy>LS(QNoE@5l$!a8BS$vLaJ`Y%1^2d4R`LcFVW?5t#6milG zYjPp3?E3_*sjgYCh%K=G6I+P($o-txmk{dl_x!-TqJ26how8ChF6>&Y-%)6`z;8m? zFY#p26<-f+6<)aVYHVlb)78V7FR{!zPxzxI8)JbY@j-Ph>udP8(;b%w6<9^*Tg%%E z*ISQ!oAr;`G30Rxg1G(iNz;)fu%^#Z3J2rso&I;WAm4xx-sFXdj;awLv$$Ayiu__u z#Ju68&6_9-j49T2==|lm*$IADE#JjYsgI0ZAnXbF($%yr+V!-sZRU~P_eAkAHKHy0 z3-ibfTN>7U{WcdY*wBTbbTaAu$17Czl_I6J}x$y9!HR>$G`PR*V<=$fY?Hj81!E-sX;SXJH=n-;mjO#&=ipgLxBz?`a z0mI{~<)T_vAB39)?)#1TwH5oQ`O$^Lh}@8dMrnZxHhe_~7h>JJLjsY}dTCNjuuN|~ zLh2jOA1T;6H&tuwtRaUj1u44A#wiI=F zzqf>C-JMoXUdP?u^+?P)p`S1|&etFFGtW7}+TFIU5j6@t=T08MV+A_5tzQXbT<291 z7l5LHBSU{@E*5*!k4nv-d;3Vsx;mvUakk3OahjGU{nnWpQ4!~nZEPes(UL}2&V_+O z0{2E5$d-Ox`a*;M;vFgnO(P*$sd2Y#gW*+}Fyo7<;^5R9!?b}%!~crw6J(*&1kIrk80r`-^!5~4ZlkA zbYfU@a7-(hOv>@>1W$N4Qag+ckFBXKcYPKVN%uHpzo(VPZ~C`@uAnP)dXindg44RYf#2MuC85W_!7zkVW0syE7>)Xq&7#eVu zI6D03S!;I|GVIv-#@g$<5_9XBbPcUsniVoKSphE>ljM9PY|=>i-D~BLq9D|lLa6iX zHE(5Za|`Qpk+(dnY9|f3+%o%wHnAXGb)Ey9f>*FUEm~;LO<}|sLa3vsGSRYMY;LKc zh(n>v9yDVSCO;%GW|QC>@w6;`6Ce=!G@T3(s!4WSWpa{pHn#ljn`iA57aRG?2NKo8 zLwAF_c*>hRZcGKB+Zv_WuKA2{V=pqS*H&oUdNs*F$aXJnzJS0pZ;*`3j9Rj46_V|S z#ahmfw_xNjX;1z5U_JgJXTbCzQW?B;X)e}U;XN@Znj`Pdiy$~Z;?}S!eMy)aIfV=a zJis8SGvBH_S4Mxb9Ix@6%(i?7Mm;jwUJ$j%4t&{~_YbHLiU#geE46z~AzKu4TvU#F z(J-0p`$@M)uZ>O)-DkXeYI_P6YSH~`By7Ku?%Y4=3*vHpHGV8)h?=5EQg$lLseyc; zdGjph2XUuQYhrpmORYvDh^3Hri#ui(+tOr3C}tKoVgMT%7~t|v{!G^yaG#wHB70^8 zLk@nG@J94uQv;h~?YuGBH)oNu*7%m1 zIe;*%)7LQcz$UI6K9rcP)7xuR<4ajtI$gK%EuAup<175rCrXC-TUp$r8zgMJZ=RpU1qkJnME=NjqP|{-(L+rak`h z^B6n2Lh@IbRSil)UVhY$c|x{#hh^1D~A1+^DPl2=~6uH_B-uOLH z{k~aS^y3VG?2jWj?6Vr(;WJ@NLJHsFPftuWmf$D$0O9s+QQ9ryvajJf@{daCXGyCG zj3vS)h}a-y_lO6a@D5e5bXKYgrbfl-r}De>01Y~dii)dIJ?=i`UQL0 zvpReE*#ZDTd8@}jLT}?|&wl9+k7%sx18_J<1Z_#EIH~J_53|WU~ nrw02*`WX8NhNIMrGz9@WG!%ZvO5z!qB>);KI?6RlR?+_hnyjjF diff --git a/frontend/public/apple-touch-icon-180x180.png b/frontend/public/apple-touch-icon-180x180.png index 8c81e4e2c7c16ba610b75c3abf74ee42fdb284e9..fac780dbf6445d595a09898a96d76751a71eebfa 100644 GIT binary patch literal 14487 zcmd6Nc|4Tu7x&ngWXZmi2_X!Fv2WS8?8X){!&ry0uh~PE$Pz+iXKdNGP$Z%#(O5#1 z?1ah|-djCSPrv1P-`~4@KEL;mS?>Fs`&`#K=X;jxy6#wgUG=l%EaV^%=&YuOiXrgZ zaQY#|2fpiSl2ITKb)=KAnYWqFRcTv{t02M-gG34XySf8(5J*>y@Z4Xg@u0S2lV>& zfScDJ)&lG%#EG7fM@2^pfiFg~8PD1e>w z_xX8wtNH>e{$Z~FK!B<*pyxk`a6+Sfyu3XT-Wbn+FX%Uhe^J@}H)s9B=l}s=7X1fp z-5oLB7%xZ6-RY^Cino~{VMfCzVYw3993 z6gon_Zgzh-`qzwpm>j@@w6Z7a)KJD43|fvu@icb8nt$03ECLf01@oFZx!Ga-ye|La zQz#XLH%g8}1S$f9KqVm}62?$bX;DdO7?d9>CM^p6#jS&}bFvTk#VrPb3PXgU#=?@) zP!VZi2?$hN8u}YI5MOo(Z^VDducISvh;p-YI@MGejqvi4E^t$xd2aOjTS|3MwusuB;|3tfHhSt}3D;DJh|>s;I04gG&4+ zSW~Ov)Yt6NMpxe@F=k(pC~BW(&2qmy|;OCQ#GO z%NyZli#nYQ;0i$}K$wKBxF`%IVh2HqAtfOa_J9Z^3?>4xI~61)B?*PuiT)7r8-}Hg zyb+$>KJNOS7<(r);1N^Q&tZP&`NPjfKFGgu^$)24$fW@>c0RT!Aa;JjK_5tDXeXp6 z!ZQFY3}m>Up888`WeghQ3Ah*-_~+FAB55is|C*GSp}G=SQ&m}9SV~+RA|fdKW583m zpLz%I$q%f`ar}1Q>@-QBeNH_q#{q*vg?^)%|4(Rtk>GAlKrD#-HI$|+!U1LKWasS& zj3oI}l^=8XLAZ)?bNHQd8eP&q^fLmg2%zB43H-RN@8pj{o2fVfaPs;w!9T_QMK%8? z>S=M~Z3Kd*jXqMc5YyEGc%<^UiA@+X|-uVNf9V4xHr(LN|J z5-4j9o){lDJ6WOA+JJWYL*S3AKPAcv{ljpw0M3ALP(gV*`J(L9JTb06O39C`E$#Gg z@Q8v+iik-Fi$SC$M1>(JaTp9D1x1QN5F$uXdvS4bDWo0hhjqa}WdI@ZE5J@MZ3kfb ze^&#yfgC9&Ei57}BFrxg{WC`b82ULIFO0pnAHox*=m12|pV9hz@>W&`1ER#hygCS5 zC%4l|^)rM2l3?oyKnw*mLqZ%s?ea(8fp+@8QCq?mWiJY-20=<7VGvt;AblaAQcwsI zC54iZ6oJ``!G6ZkuX+5b_GuvzhKNWR3kyrbM5Up^zZH^S%>PTZ|4q&M_3;0u#oZ-7#L?Kif92H|8HGf7RjNGV}jS%cG=V_O|v= z35XqFVu+L|ObYly*g>Skfb5B|6$VPuKf(5IEH5VZ-?sdJ7-IiG352*P1SKpAz^*Rz#?D~ zV43~1FaK8!|7L0NM{)bvDE(RDWrhBw3HZtI+o~Jr1%BQGR`bBNfY7gf0pQ}-&H~VB z$Z>cA`v#cM@)ZyWFVqQWd;g`~1%Y^zeUgXyRSf9*6hxI_YIMEb$a5x+`n0SluCyZI zftr`u4k2axTY(sEou&a31LOx>L|0f&IsK%#v8?AYV9g8^|a*Xei z({h{m@b3(LeDT?_UqMDF?B0$P@+1UD|H7PJwDE;2O^hUV-83u$J*_=ZTO*Gj^PuSjr70T(l!mA` zk|i7_$Z^oxp9o$Gr424DYFt;GX34QmYgiJ`sZ!qQ$iFw){4sesv2SjH$$9a?9QmU& zy2BwuQf-m_*c)S)*4C6_p5h=Ocv<)kM~jdxVqp7+%w5CW3j~t8dHTT{tE}+`fxsY5 z6-8tJob~$?p|qw=n=ZIYzH-=Lo!ub8GjVbI+-_N(n=h1kc$U5MhNX5xHUipC27+65 zbBC9`+7(LQX!^A&pHl)~yh#mSenn;jC8V%_SPOB`O|8bvM8GGp z2V)j4H67n3!4D5E_dm6he!qVq?0I)DT}|O%2z!ynUHZkPpOUA zxT7=Yp~6r9dn~W^FFgKE015+xKw-c)>D66{z+5)bqd9DOn&=XMDp!6$x%~TcDdHUSDtttKVm#T|MA90Y?@nW$evkEB6 z{l0S~(X?sPs_l=8rf*N>w7iVfr%*Bj#VPVq_An9lfD|t-Rnv!ipC1vkGV+0k8=D*1 zStY}gQzsr7ztHNfyrW$^L6m#eXJ-eZFpMcQn(x_NV!u;NlOyuq<@YA)OH9yp zugPaVxbSippGnP;#0dfQd(5(eu=T4e>}ee@5{ON*2c2DXxI_sGE4)1Z2+c{qrc|jL zcFxNcQo>9?QOH1iu`-k2#%0|j!RlU{ceD`w1$EkOQ5upk#2MEe-)~YurnH^nOq`3s zvZR`vTK_Iirt9=L4L&dBfdS?=7cH}seK_IAFfp~LOIgx>?d>))Wpp!&QG^s)o z6vnJ)Dp`XyZta?$0&z{~qYm?^X;}3k4r3y@Djbm>c&ox4K z zMLr7C0+uQ5Dn=byV|~aHuCWApSmEH}{Lj?lo1?dz1s|qzdWuu7lHV)<^|G?AbTfrd z1vBBtP8111^n+#X11O(O)0x%Yb6$7#-z!h6TYKv6wq_wrpG;_N3Ma)Ujk95>D3r3> zTq?B)WXVQHk;QlT-51oRRSvz|64ip-l{BY}zw2aG-!s{G&S^<`#OFSH*SRit5sxF} zMH-s%0uD`VL0Md-M#@vK8-gz{bvp~ILMbyF#9rNe%oHmlEBQ)0wjbZ}ODOtjIMRQy zq%?D5>{jpF$Af&u=st<^GaTS`5Gb%um%8m6>d zbmLc*-i)eQHC>dwFn>i@w#B>3W!XNhNn$0-Q_z4(ic#)Rb!CY3I$s$UUokq`3g-hi z;L2S{p^-YTc#)_CeLICTA(hZI)sw8&*i3)Fw(klXG{IjfKFb8%lXD!M=?%BhmKfp@ z3Qc|F(VCfvYjEb%=D6PP`TX)FR&|>&v-9o?p7|?R1jO-`$5qT2Zj!SEKb0k(e}GPW zpS7;?Fz8!6cUyJ*>ua&~d41K_dAT?^hMgO`%Ckze@P`)-i}#AG2dF89lt${=n8FaF zD=KvPcSv2%aPOHd&4Zxt>d=uL4(kF&ENvxNv|!M(@!t36Xm2Gu?fNqyA2^&V{DX*x z?+Q0DEWsWmUO|o*hP?TP=Mwi#0Jn@cz08;9KR5Xvm~JYqcTT+XlgbmAVN1BLko+k4 zE+h>n#)4?`v4YzrL++kS^%Rd@A$RtPFwc}=;?bNOc($Q|-$k7>7{Ne-LRsK8FA~Hf z2+KFgvp6!`&T>b0>dri})ad0(j$yg4`^v|PfhhmZLW+?gcf<$Dt1=+V#W0$<@IBe= zIPAc8nT#lYO3)RrP4d2!uRbz#!eY!aUXs2G=!?uWts^#oTCau81m-9) z!DNgCoY( zEUboXUr8bI1{)rWlA%u;UpGUx$v|34a)88zGsdSLl?i0)Sk=cirDYfn&|z})DDLad zv>6VR81KK%&{>KTI8&^2Sw8>MIp`~BwoCN1umaIzQeBI)G?qiv`D>Z_i>QTEYrpcTSCs#_e8{xuL$ckQSRv^rmWsOtA%c1L zW(U3!IZHjtSFJA2u8?5O>MtHTf0inDps$Bx7@o=(hUd7`Mn*@^6_9AHrvtcju})K5 zMC(28r_Ux%N+1f_1ewsoI)QC3(FUy9t@$g|u!a!E<;_ZwNqr)5uPv32D^h}aW5$hH zn&7Yp#rf&Y)*<#UuUwZ+@2|}fS0}c_iNR?COkP~lj3@Hi!|ofjVL^1Jp2FgCd1nOA zysmFOY#UZlnd7wlhM~I%rI<@sd#Re_8~#y`ec{iFhgl% z>&XFOc#K6P1u9mzSEM&Z+Cfi)hN$?C)(q2t&h6UP1g>o?cB!q2I%R>X{-FQ~1t)_k zt#f()q?Y}eKp&c=?Zj8tYUJC!`qYwwSQdmSj=mVl=o1DU3guZc=cRpm)>Vd0p-ghZ zZa<6)!+Ut{W@-sj7KaC0pFU{>9ehExwtve!ou8~=+fn&W)Fnzf9synU$1dZ`SeKQA zdmJD|0$0e%QAQ1Vs%>TtYJ8#RRnRUv3b8jEdXjPN^&Z=P#-SWI416ZhM@-_Yko72T ziXQ##H7sh5DUO3T;tF*UHmj1iuJTp{Q#?=2?Sx~f=c<~d;kn+{EbHmM?sFt+DL1DH z-m|EQeUQVa9-U?RzA!j^I@WRyBJ~U~m@kGwb=hz8{3Ckp7X~-tIByMVHT%EQ4r)uM z`qI=$6fB?AxBk$goSZv#G0ILP`)V-{Phm#QyB3)2IbANJ-jp(4FRoM~Zp!Wm5y7&V zOD|(CPbElLPj)#BGsF~P)3RQwZH5N(}4pQKjM&OIB#;1Nc>t6q?^;?ICEFKv<$ zAIaxsb5&$DTobV49c3dI6I$OiZ?_MS&3zU}nrJLf@{FGovRrRURpq&LP8HoV7p_LCz5s#It@UpmgHm=%hqYEh{l~WGi z)`YA_m3~{FZbKXmsKzVl@JLK`Ex+t+`+@>sIe3-c0CnI&$3mv_M=M$cm8y zg&_zPsnZ@*0UaV#HwQ_bqNGm|0fxh2;k2y<#xLqx)B5Wco_AEcfIuVi707#smxnDv zk0y88eO=omT&gZq+{FjY_daX*)=g6+^FGvLw%YaD+s1~y%L5VMv*Yhv94ZrTyJ0ZP zo1511uMVHgedwW0z45_>faNkJ1&;=+vP?$kTzPN}`Sn_ZWD1VXw1ErUiQkGVR;RyO5&9hdk^1vNN+i=lltPuC%F@_YTwh+#q zy0fjHD)R_IzSkd=V<2Pi!Y6>r;)10iA&s+O>hFG#Fg)^z)W&X_$k$JZ^fc$4tmC@I z>jJEz%qwWH*z@w=7uwk`FyBictMH3Zr2%8cC9L|G@1b@2wp+FQ9`(yM6suU81c0D(baNan7*+ zhvK7lKTI{}5Vh+5=VYPTfRoRkRs7Qj!oa*AeUG+_OWE&YS!p%nm zpW=bmHdl7PRB>iA%GC+x-TebkQ_Yw%p&?2CrE$QEFs>m-B)Vp8>ge6^wAf{3ldopF zSp%BoDLIT{2Cu=S-843rsELy=%fGH~dD(A39`WT^T|JbEb&=JA!Mq-5qFtRZ#u9#q%k{Ug4|B3o0{Gy(3BM{&o%g8>OR}M@2EL6fGyHJITGQY z(JY}0XTSYa_hkM1B5p=*u29iB-;wql<54UmpVqtd&zGc>fS}ZEyfqS)kACX z(Y%Swi-=Ka&%DI@5Gh0bwuZUvvW&Hw$*6K38zxO6987xU)tUCDjq&4~FU6JF7={Pc zW4toXSt{wHbSii$NF%^H2Og^(*j46qTb^#C@-LrnPccL=v9(^7Z2&#J^YNO{`fRJM zZ2$di?Ixj1Hsb`w9nrz-F(*{T};#iwoHE=MuHP4UV zOxD;NxVe9rS+@NVa6SUP`>-x4~pY!fRRxIJ;}Nz(OLirg1G96so4DfC}IC)1wne+yR&pe2oP zWSeaYfd{F(Ea-n&`CJw0&^N569bjHHbHtCf4%JYRCiJMYr0XTAjs!tpy**g#JP%Pk z(W{t#C>PWu+a6RAUs7S*_kxO5QC}~JYWi)`=vcoR?f#cn<$GV_Zl-MrzxcVI`b&Aj`V zrU+x8zB{kWCUIkeQ1M`Wlj?@wf<^T=xbVfi>bmC?VGkI6U8mZE;$M?r=N)|tM>8> zxkV8I*XUhcIxon-ve>74f(v4wB~@p=CZ|ffhg}F3%$Vk#)Q7Lff4H94>VA263$Dtn z5H$#I3@3`5yU$N-eZ$QUI&KF$2YMVwe>A){&EPI&PazLX!YTj!eF7iYXQK(rPxH^m zKL_MOX4tPfWm#zSa(Bs?wD~Bey0{Dt+_p;0QAm!DTGfx{9U!5)aQJeHB)X4>l|Fo? zXVY82YEs7_T1>0fY$d*?^LCNw-O|c81>36m#+e=jXTly_f`sF&C!75})E8P}xVCt9 z(G#^HVmdGM!^I;dE%ODtaTYFY*b1${CF8Zp_YLi@U~mYRtx;rYOYNY=*p}1sx8Bba zLUpg7AIvA5W`?;Vy=tACtk!}=iu$3ZrCrZW=aMat=O%ksCCm-5CHlvBMPJfPdI#Uz zq7QxD%-enU6D~85M&RSkvUd6V!u=RyO#VFe>`!7gN}?*cvhS zgd+<}XSfwx&vUcCiunVT6>g$-&}gyq1y8}(US=RmhBSNJt0nV; zia>L{elx9UPO*61$S77DhZ$|=Dsf@Sh%-)9!y|-jqC>y-mQGGx!`84UQu_m_XWU({ zyt7~C4GDU1p4-LD8@`VO%=~>4JZv&nr}1V~i9&l)V z0xOG3OJT2}V?1iYnca`ybokRPG?9~d%y9&Y!jr6ojmF+3LN}P(#rwxbE*rcVMT&@v z`KRPDg^bsytHqq+O=`$yVp&he2)=$=!KK{&6CXX7i?F8BG|`&M>2g;E#so`}DUQV{ zYpJU?nIW+AMFPX?6P*D&(iM%lld<|PJFGPdIC@95((DPAxX2>Mv?kL{Bbe&E2wC!? z^E%4|tky;Pyzd*C)SV%E?7MXzL<3W&<}_-}0++HTYlS+Gdk$kTHw(Q!>TJyIw77qG zcpcvO`uSz^R#upqBdgK`)-q>AOh-dqHCHTf!ksVx`2e$7Jt=Pejw<5uU^--f5tm0L zx%OGv6v}qVKA)!Bv)S$uIVfU3U49NtnQzt@EVhwf?tGD+_2k=|p#87y6I*+u2{J`J z%P)HKD`ZbTRGQH(Bq>N8XE#&5c>V4pUJhl+qZ%KJlyY?Pp~rg9)I^MNa6=k*9k4Zm z%o$jt+`B&BRZ&slDo%uDid&oL*pKRvku^EM3ucOsEVAh~?C>K5-KpvbACpN)YK zUzgvY{5`PCOha<8uFoGq(GaXrr6RpvU*VK0Rg7hWW_Ow>(Pu z2+0p2#;R3!Cc8b@6sarTtgl-?@vgy#`&Gk<#N`4T>(*s`4-&B0ki5kZzbh8E?#qaq z+)|2;!JM^XNiSk&zg@Cw8iRS4nG^T`*}u0%(9+37@)$ZXLaR>?-Gg(B7*xowjE9sh z2g0uJtqd%=PTvdDAX2;dK(>xD_fonMy)x_ax0Z-t{>$+(=w-DfmhNZW{pRA?Sah)Z zhv&NrGT}#~X6PI|Ls6e=gWH`AxC-L3al(9A%9oT|wuGu7%FNKF7Dr$}fp zd?P)6IOl!#Iu6ffx49tR1eLR1Ek-dz7iT4BI#A56)7)s;34R`Z;njMbU)5~DeP!>4 z=>97xuX0vpQSplqMoRh53irkNBf#{=OtF`ct(J(5f@_7=?^=Cc3BOd0v9!^`3`5U*4I{3OZ}6{qmMp!uK2^UxtJfOg z+W!uX1c90)h_1ceD7bcLlW-GE`WT9=O%CtvY}9MQOfIgjUA(-Sldc@|fh@6NRI8~b zmg_wW@q>@F_i7QU)GMDKf+Ett`d#DSSdM#YRHvxBk4FKC5g^YJSZR~5Ah5T|L@&F( z^|4Y&zI_$;HUtD}k8lM7r0mr>rXcqu5&K<>%h6w&#!KBC+)nPqM=h4YzZgqrzg*yd zSLUX$!0|ew5?=qg#Kpp6P3tmE`SAMy*SB~152_jvO|aw_PwOZ6u8}ZVP~LO!Nsh4( zwxdo!roWv@zpXbV+ew^WMF3(uwz2t2sa>{-K&2@{@pqdhGSH6G+cyrg*3+s+$Tgw#D8Bozyd`2JKB4ch+GeFzLa! z_A^Rjt3A>4cT^MyN-uT@zh(=g5qWjqvOVbA0SM$P9;39ntM5vnCjKEm2{hVmHknQ= zzUFeRs}J}3c53|!*=G>WElHKrV{AORS#qoRLVR(-)+@0p|D(gv^$IPk4XUWQyVLRM zko8Nq83U19U+yMPjcr~N-XJSkl}r@Pw{A&)mP8K%JrFPL9nfek>Ze~7%?5!?AIh}^ z%8Ye3ye+%~0^RD3mdSF|s~=l_&80g}fotH4M7F$KzpI-6-9zUM15q}kUn4Cs6|pLa z^0Ap3Uw`zaBBhUNcAt&QXF?Y7VvfEt=2|rSM)kJTeXK}zkXP{G9zFw~InX-$!8q1W z$U6G18JP(li1XGM>MM-w`9tIOYY>SzC-dfPXVC;v`%cohi)r`W#ip_>NZC^3q*RkD zhBKd#cKc^3x%m1An$UA&(jqNY-=HOH?Z-g2ujmMgAM56)luZw5&3mutYfU_TAA8lm zq4P~7lyIWiV|q|%!^PQ?)m%mK&dkvcPlj8fc(>=3JAC}&?U7%aMw>I7EIH~4JVb=!iSrUzR5E{7q@#!y>?XhEtOYd@SQlL5zpYR>Z4YUKny46QBcpU^Iy=TuI4JhtWK zPB<}&+Y#ytEN=EQh|>3VblfZC>?<9)w^BjR-<&lH5BF&hR4a2fy;p$;3bU}{a)oO% z*Uop31ha=*J^A*2^1gSOJ;o4^iN~Nl=^OFo?DJQ$o-*9#P>jF3fc zO#%p7u(OX`+Zd?@YhB3pSsuAC*+M)W(Gx<<=>Ih&cquFWaBj7Kp=+zxIf<~9olP-! zX>}jhYz=H?nFr9gSpeG!ds~d9!&G;lvK$=0cok!O_tNCXQ@O8|-KL<&P-h=~-;6u4 zTJI>1i9qksltj2S;4F!yETJojP?49|Z?AGDY;4(}B|^Y`H;F`z8dFw*8WUIFbRLek(3n$iL89bwadKl1AO`czUSLFtbo7_18&ZQFrE^}YM`mq~_?u?dm z1(pkTwxOE}U0d_dZddTr)hbcb#dDt=`E5>Xa=EM=ibhI$>kwo)@5E4R7Y1>0@H+cg zOv_(p&1gw^UDYb%V$~k+wwhNgQ4UI&CtU|yz5Mp+&dX_)*D%egO5LP(R}c3IZok<; zj`7>(_o-S;GmFM1+eVq?CbhuSWfCJw6|`XY*wy{1d#{isuCb6&?L8U& zY!{0jG8@94t@%;MeI|7{&UUM4c6n{hQ7o(J3N<0Yl~j$#i86>wp37+eHEtnenP6U9 z&RfU&gW7r<{zrF9Ga%Ot5rO!McdA#_6%@Y4P*L{nL|N#(c`>g~52u$ZX{|aC)yI;6 z!p3tLCb=0$@DEe>3Ukg=RZqkFDt%0pm4t5=(Ew-7#CBlBU_wAz;6C0*t>YWtr$wMSlwnpLr%4!v7?hsOojiCN zf9SXVuC}(mo?f(CUtp()it}XuaJNS1X7Qv$|JWCK94c3tE}7E%MHGSr8Zn+@;z!HK zp5fmlTR{jK&yIkselt@F?#~HGoglCw^z$!%+VXif>kwUAbOwpR;1cdfyHjihOvkrR znhLC&kKtT-NX@C^*-k#A@rfTyug=s4_SRSj9_$~rH@TWO+dW5S#D_ar3=i6$=?Xf0 z4ET+)!t6obCmfN90{rFd9N|QhTZY$iiS)OZCXv-nK+@a8sMo*N)PXbCC^Wb+j@61aCGmhk|>IKg&J0I^9l&o@v zPpvoE)DN$Ei0yYko^YpBHu)OSEi}*WFRfEi#k}$PmRD)QMonmbe&el}OlEGQ*Qm82 z4z@8wRhwUPk#zg4tYXZ;oJFEuraCNn*ix3J^M;y@c3X81sG%*VMy`GLHZHG1KUoZd z#nuW8Z$)5v+bA#cDj9I8nm=TrG6hceheM^l_eJJS$30t>_rXSUiqUDNkTb{MezG=W zE}oyu00KGtjOZrGjVco|aGuqgQoskrAxvT{G`w0HO3I}P?-E{QOLQ(6nPA3R2JV2M z6u_wt&;rzoB#hY?Yv8LpTfSrX)$#Hg{Onlj)2Mw-_={R zqbFeO=zO|4la%&KqMjS9@~3`_aG{j~XH_2m08Fu@PcVM3Z`-&Gs+ z82cU!6I?Olt!RJ#x~`wa^5)?rb={{(-3!-Y$r*J9m(Qb&jEbMqWoT>TUq@uK#1@3a zbTrE~c$&{*>4T57+nHIdVy=G*m|GdkW)wPmy#;o|^~;bk_tfLU=?&p)9%+iybeyCk zpB~(|c6ku#W}eWFuVAWNu-axZaO=6IJk2K&kNiy9@dyFZH~}Yk8m7h*g<-Td^}U%lI8{zoNoz+$?-;EIsJCrX1|ds%rbxfH<0lNfDZJ z#UsKl#{?6$O-z=-j*V#jaIkM>KeKR6nW=eYM+F;Dfb6j|eceu35y?vee#O39ET+s7xm;7b3 z`8{R%;|eM@u+pWAh7yKsy9AuPaR}b%9#V47{_f@C>m+R@PFW@8aag{rg0x|2*ELfc zQYG3Jq8?I;9s@eH_uDg$I>2#hDqJ;C#HGw0`HT7G*xv~s+DXa{s#c{o?id} literal 6074 zcma)gbyU<**Y1xVQd)r#8ITYpm6#E!p^+K^N$FC$8CoQy8xaJCkZ|Y*>5?2u5CN&7 z8>9r`&U@Fof80ObZ++{;UMKd6wVu8AInM_z4JAr4W-i@5ja`H8U+O{BTLLfUrGRAG*Xe5)$#eY_u1D&=f}T} z_VYIJQj_C7LTD+~_Iv>HL46LXLp}XIk1o zIztxY_Ab7ycqA1YI{>T)lj8?~CNgE6@lAwQh-X%rjhpsDqVV;N?2L%)1-|h2*6!ig zO@)@F!dhfp09RQIA?a`&eYn#6fTlk_r*VV};LS+E11&Dp=J8RI zJQDB_t&Ah;Na;}biNu(M3?HH4TO0)PRI2ibCZ(U}>}Aha`kTWV*kZz8V4VZ;ibg1U znzv;VLVx}0&EE;j-|3tlgr)r!Qaq;1!E#B3#4MxXM{&XFp|vTbet`)jcbX%i4+I$le$HiUX%6EXH33N`jvuKQ0S+bL!JVHaCYB;1-@WuY22KjeJ&{&{;|nYD;? z*IN0KZF_lFNMK#V7bG>tiBZ!rA>$tBVy;nRDoa!FfD3UKSllgSKbxQDQn9J&*(u7$ ztL7M`N(;Cp^i5ja7*ab_A14bdd7mpuxZ=-!bX_4_Sa`4!1Fc4oiwOtu+e?m!t-p5b zgaM?*HAWJZarL_22Vbm9F5Ev@`R*~TO#m!?_xMj^xnXF~#waYIJq^}kp!DzG<4P(S zd_?W%6n_Ce?vf`LP0pxFt7*vXUHY`)#WU_K7+g<7%{w7)4-LOzElmscnj%yB4Ri`* z(Duf!Ivd4vAoL^r`6bxH+8v)qJ>dSVQ%SD$JNN!;uP>LPKGS$Ua*}l+Vu9SBN3*_T zkPQ9nm2nN;E)G=ESE52{;(GS0-YX?{4Ep_av1kGpa{EWgKjfAvuhrX^C#)D2&`XG- z6Y+nZLwb@Bl2nrPXhPp+zj+~h8K%<<5n=6Yi=Lp zv$8X<>El>CVfsx=n>6#-qVnN~Zg*OZHKL>~?>`QPt>sSZRoP{FY?eG}%u+yyo>B?e zCT69T>DR^@&T6LV<%0|Uvb8?^VNxva>dTi1iSexb9YSGl{9AP_Q<6JBT_brr6dkIY z15TkvG{dW%35rH~9!(mM%-zMIDa-4tJbR~xs<&2`4_@3hHh7d7QD@3d>5T3BCm|y) zB?IFScY+?$rrNo=KG-X^VJY3lvWZ4;a;M}&d?l=zca*QFG%~`&vA!DcXQg&~H1)2f zPA7~AQ{Wp-Wl;z2z<96b8kwy?t8R>>>7zdW)c7TWONwgVu@}M`y6R`B6r8`V^bRhv zp9LutK;S$(W>@Ji{kR>!{;7?nC^Q4XY3wO%i@&N-QR2TlC5xa{hi7K=d!^=qqg$f?h4P>3_* z-|TXzWC^50<@sy2XNOQTTl*Q%Fi(13x#x7^bz~*mTA1t^3RSA@&AbKmrCr2$qAD*Q zWW`O}k9$X=JhvEJo3HnHo;NK(WsbMg`efm4Gr~%jQW`F34Jtj;R@~2*1mt4JjOTf&|6dD0ZMC!KXw8Zg+OF-uT4Q zx+OHPF4b0!mW0pnAl&qg^le|}3-UlnCQ1sW^}G4#6FHn}v5ZJ&UU^ce%P}R7)8qfE z$Icn?D6V~(2}HKk>O;&;M)_@dm*|>b5MJrlUuOU3K^RsBj9HUH8(ol&Hj}@z1cW8b z)VhsQSd3&pu1?r2VFzkYB^~+msk|)XM+J~u6it;8^{?y+p0jEpzq4+|@B~uy#G7Y2 zs)8K(>8Q}0whj2MRg{W#6cYndAWLv^VdfR1xD(Tk{uKF@{kuG#wAbjJ>RIYPQUp=> zqQqM@h$K(g1EuJ9!}BQ{%0B`xZ9AxVe-4?~J<}_{IyrK;2G95jb45LT#(z0T-h;$2WOViawFmlLiCf=;y&@*}8;|#K*4-Qcw7}n>TX=d;Nh_ zcz10H>Ohtzp)~o%TOU20oukq#;Nnpk_sjIB!u%s;`VEL8JYi~PfV(n1bhWWq=)>f- z1J%YF6*-{APPIg%^S*=q@V>zB6Z!(7myxm+Jr03qZh(xjPU8llS47Pjf*b$}W#p%i z{*n`pVL{vUK8O0U@gG2wSI9HDiekAq?8Q9{DUXb=Isw2Ir?mVCy?S~VlsovQHj4K2 z1EflOFl(xS3>x0oPpA^W5GANX{tg64>@g11v=PvgX;}!qzGP8}lLK!> z2?;=NwPK4_91zFdyx)v49sJiKdceIpQtM=i7uxlr)1YJ^d(y+hAf6%ZH7Sfs4Hr1) zFGxD>4Zyr|LhwdCKkYaWV_HHAANFy{^QF8!dtLx^xXybTFd5x8Vce?&xJRX`?Otno z^TxeUI=LCfJri{{ChJwVclFq{IyEve<7u=(4s!~?u@T1}`-VZ>I8%xFI`!+g>CbDAQPI zTjv?DqEm|3VlM)6lV->Ot0FG7Hr1U^hPMH`9u>D?DR`DvaT`w8L_yscyvyTpSCB?+ z7=yu!?C99d$g%mvjHrKzDRw0XtBV3*gX~GIU`*TdDeJl_N(OVPc!Q{}mjOQNcf$mk zSI~(28~GD2CsN;(1|zXDpph(zxQ&M^P-Oj|%~`~BC%#B8suI=K%&e$2&QRU*NKs@h z=37IzZ=kj6`r++KWt-U{OWizvv~F=yh^_EWsXzGxi8#5^~dJrXIgVH+>);c zj7ybqVEM@8JHY}3qz3I;sX*tna3=H%v68H2PAIC^-7oqPj1m~^^(Wro_$>C(P{6HxW{>Pw`0_uF(fvnQPM|0f; z;|5L8j4KU#q(*%Jrt``116CWnUxV70oxLJv7Htsjk(Vp>WQXa|@Y@A2zk!2%M1+*fjKk|hrrw!c zMJR%HHBcmoF|F#I20qImK=D(W`t# zC}1`)zvV_ugYzld=k=`6RqOOn2sn5a;&-nz%xTp*TJh;@=)-*FxaikaE&|CG1Uh_5 z{vO!mb4|40u$@q+8a%SW*1F$I_8B{)U-{HBX>rRIOPStK$kM zuY=Yh1G+td3VUuI`pxOLXLXo!*0kiGR!`9Z7MC2-A2$xH@24O((R5VpysWo1S=qud zOVQzt{hDh}e^I&(e@ysXwHM#6p%QcQR^Xxb!P`O-c!Jb3QD02e%jZLo=d1MZ;YHD1 z>R*lwwgOEe;;7}qwIn@w9lz$P+dk*+1Ko^MUrl9XAv3k(m=aN6PTP$;&%!1`f2{$* z7n_mALMP%%ZSKtlMW?W=^6TWV&c0mIS*9BSY3d@9)(raF1(OO=d>LSFXLT*J)BU0; z=kecxYlAlu<5B8sWYnmKEi(}|B=AT;~AUT@{A!HH)kune0Q%+D=G2CY$Cby?}fXJjRxQ13y0 zft;+@-J-XnkVfoSg}}g1Ezv1iY}RNK0tyL)@P*FPc8^G1xb`J|%c_^Oooe4}Wu3X5Fvd zk4iQf-rmN(7Q`Fj`Mul<2p+KW*{Uj3+ZfS;pJ18s;Z#T1t1fZOUl)yvJ6o5jtahPxHCYVwU~juIQXCz6=$PHPA0gq8z0G z6t$)qs>`1S7@54odNJSTEW;zd9qq#1orZPIDgQ9z=4L%5?Ts%yB|;P6#dN3~#x*yl zt38Q=jr?Z32MAfue;3aV@Ok%cj^|HA$0mdUbKnusgbyoa>IM$7a?JJ z(D-)x$dh*2{g1fS@+N71pcr&a^gx9Rt~}e03%(gKQQto)mCc=56I)$m-0Uj^A=;sdM0=x zYxR)(`fq3N`DpV1Po4Ff+$TTRHc?-yF7L3^J6^103S=(8MV@08eNTGsvc47pV2#+^ z0av1;q0`y+JFS2Ar`=OqH7S&%Vv%06T@NtrqLqqzSD{?}=R99aO-|A^r50Kj_pc9n zo=~kCamSk0S*ZLjrXk4pR^$2vp0TK#ZP=Z^I=;#=E^a3TglSNk^WwMT3Jpr(8CL;& z06aP0TO(bs9BF&9rZGf*XEDfq|6VGF@Qm&g*lBCGx|tBdE1BZSHvFHT?U31Heo?Fc z&cOZ;B<(Hvf=|q64y7O2IOdttLqXre%G|>mX6a^)6M%@2h%mpf2rlagOTa`#U?Spt zLP9VhAx5v7s{c>H(b>x0#`nJ~*z%F%h-}~$Qb*qdVeZZ5;^u5)?_ka5;p<|}X7A!* z2>?D>tH%@|S3Mq{LCv9Il{ExFz(FoxNlwQ>r( diff --git a/frontend/public/apple-touch-icon-60x60-precomposed.png b/frontend/public/apple-touch-icon-60x60-precomposed.png index ebefdaf402c765a44d600eae8b73a0a97aed3d2d..f1668a5030f1b6cba509089ff2738bb687761dfb 100644 GIT binary patch literal 5483 zcmai22|UzY_qS!=m8C3Wj6xVowqcSi*~z{$m|?PvW(Gsql0Ew_L_*oK7KNf@PZBCZ znCxrzcz^17pZ)#+KcD%{%)Q@p&OP^gmV0NS4E3)t(4M9xAt7PV(o{17K9!CiYD(Z8 zb}))1A))9-n^@p2^mJiP7!PrTGsY1qPVn#oa6nF(;DvBNEfsx9K6!h0tTU- z;b3zaJqbN8RirCg(;tg8_SZLY@^^Dma0V-1q*Wro00SOKJOV`UaQDQ)2ypOEyD;GU z@iY_+`YD2UgM%&f3_+?GED|ImE+Z}hzDNsF!aAd1Mrs;cu1(lK#10=+7ex7&)LCg~;aBSk24K*ar35)i^qcNVKW19#^j5i(* z1_L2aU=o#Kg5rb ze~1J0{kua1gx9|b>*@X9;vODs1Xu}@y0qK)qRkj zc!8h$|D6(;Di-OC2Fw^~T=_eKamQfwFwRIgSo&{}ma3{D7K1{&0~pTe%4Lw2x~i5Vl(^(i*<=1-S{?`&q%P9a1@8(6%S!wWFh@K8eg4=}ckkm+n|dBQCH04j#UB_P zEGGs1(=wL-3LS?8W{4&r-7VD69!O6dVD)z|{s1li2dH|ydt;z(fGz%73kW9+paYHa zQ$yf^St$uA88Hb-F-Zv%NqLwA@KO+ykcCP7+UHMcph}z(c*OrFf1K+eB|t+@52lI6 z;W1dhpHsgIz!-V`*XY;K9sM)&L7<=UhasGf>4Jm3uo!1=C#3UF#sG7_P#gw@_eEfl zDlS0i;b0XM3JnnJ2Qoaa7?2c53Mf~(zpD7UA^~&%dvnm=T!S7L<9~fqg8svMrJn+S zs$M|v*BsClfc66Yy}tm1-#Zl26KG3Vp#NxM&ACZPNQ2Nos{JFyNJxYdy%YP-t6e?W zp)9R>LF44BmyWDvu7+%9kdTxIl3kU(cU=M>?ymV`&g#{7nO$}KI((}oxV+jdTC+1t z>@mW>@B4er+0V;Q@9jS)W-r4zJ}0K+){BrO^iB7yy1r3Xlv}Cve;t;7w(;8#zMC^E zD=V+;`4{cl5%2U8(~HaYrIyi_uqP#9RNiepH1RYBWz+PptY60Z8(FhnWLds2bL*v? zc0BChf&AoZv7TQ)M`pL6hw0B1Xz6G%b6g;R~QW-m)ZI@E}O*Xq+ zb>n${=EsKV#JRYR$r;XT#Jow`XLS1gfqe>%p>IlV4hb$UUXExV77HZJB6Imc6k9t! zXlT4NEpa3ybZo~DDM?l~CkY8-la`u_iEGHxT{Mn+*gO2*r%$^5n~R~DFSN-()X`09 z(eF{6X`WT%nyyIP^BDRA`pORN-^ zM5RMV8|*gnL-PMIkhn40+-7o6hV4 z(vi8}R2aB4qr;iW`n|n+7;~&LH6}%34@8%=S(?V$z1>%rD~I{0tC(4<*+HB-2xqD& zrdYNmJ{7tvDxdv3eLZ4O*K^lXH%wfh??n3$vL#RIdw*mtgPYur0(dU-cT?PvPi#gQ z6<9}Y#pZXR|-*rfZc`rE9L?bL3-fqsQ}Va%Z`m@vF4RCRSA$y0@JA24XxNEHR=0uYb6oH zCnKmcO=GRz?kB|}S?L8H&ChRyU7`usD*JSsJsKn|qQjxwc5P^-b8wr=f|@Lm0)E#g z@$@GZ5bIZsO8<(OG4y~q@sZtgHKadT(-;RYsJ@ z&m-qI%qkQ09@8VZ+lnt5rxyvKUrqrT~}JvkLg;3ENO>m1g7Oi z@Ctq&qzZQOY2BdKNERaH*%1Fgyg_Dmfk!}5QzET#*0!S%rr3E<9D$y8S+n6#Pvf#y zZvE1{>hXbTnsD?+a$I4Pg)XeH?rrx(j#b#fQzt_1m7A^t6-dV+9f$hWdBM$K+M-)a zBXTXT$w?W*-#VeEgZs42e0c7fp%eAXKZo(y%C*MZ`{$$nY*vRbYX%b-zn3OU&qd728aVS zaXBsVkw#c)F-sG!QS>CYkQdaUBAl4T2=)*^} z3sh9Q13F)jN4~u0QX{?NN8`vZX)@g}annnHsK8i=13XM?p#lA??G+vn$Ey&nGOJiA z;aFXf7XsEDqcu3`qqUe}`ON{Etnw`mQg)#i%o;uk)2pca!5MMtaZX!c_r|BG7LW#LIQ}|jo zxj*rJ4CbYu;D6}NeT|1>(1)cWHlG&E&!A_l^}2wQpT{!kfNP>rjv-a1RU4$~_~UG~ z^_JswIFO7Lrh12~w3c)FD`x~JA6G!z4tuRfws#n%<|x+JFIlGbw!f!8+AWn+SY1ZY z7OrQ_6_?Q7@Nu7A*$#@xv6f|}cdZpmf11_lLML`M?c@88jQTPLUE)=^048{+e2elX zONYU|D}yGou@wb2r8uNdNE~|nw1trgIH1kBVNvj-a`m&rT`UjKWj5v3t-MSHYr*~3 zS3ff3`Vq1@w(cb8Xf$<*cF(??K?fc#G{^&9u*VeEg$mMWMC|Q0akTUT1k<>R45f9t zY3{B|ftGD6Tl;YP@xlqbCBkaZyHwg)J=|#e6rAjs12)h73zGP$RgGKWe@R=c7}h(u2>Wm%Iwg5zv0he%xb457C;o z%uKF6JsS4cGHz;Mi#bj5CaFCwR^Xs*J6Ev9 zWVV3K9}F*GHfC=`bV5^=8-x-Bqwq=^;L|E;NRc|2bd0)Hg_`D&S&o~p z75*C1rdur$S$~INV{<%WuJ=J=g|*}Z(_2$>%M_#a8pOot~nn!V=ylTVfS+$@s5k%STy4E3akjGd$zY?7g8G=dMn7g+v8NU4L-s zb#&zVd&~J)6$3zD;*C0F>71u?d`XyujrkRCM*)r&`?z;6!`5`}IQ1 zMky)=+#?7E#zU6Z*KLbXvl*Gzi+vfVysecgJXr4((+J|;$U&l(!^mM)^3lYR zj5?{fp{KHRMi<@v-4(5-_hhW{DDambiRR;>CA?cM;R|5rFb7dRz^k?V>$)|nu(E12 zK9cYrRHjA9b$EonD$1Urh)bE8e&pFqqCEPY=uen?dd_bvYV1Ms^{jH)72d;)?Rajd zM@F{2RqL;oYlRJR1d^-`YJ)iWJ3l{6g`|z`jbL@}wR+0DP3FRWx(AYJTuSTp(HfvG z-ltY$ZQr}{sMi2dclx%G!kr$H%Vuxxt?leAB7Jf)K{=5u??M-OsRjIGXLZ9$3%PC& zsijdQLD=4r({G_hw>RzV0uQa}xAqzuq58e+YsD^|96D}EGbLwp$I$unh+B_S>@SYD zd+|eR4R1Rr#k$?qjMheN6g=qg`MlLfb{V+#WU&Y&@ql3x+VVN7G~tOdM<2R3Uuj({ zR3gtjIp@r6n>-i$a8n&ZZ<^;O@<=TkXpFi3_;Z!b)$!@M0ZAb?l>9X8>*{tlh|DdD zgxii!8$aA0^5vz-H%VLk(4plqGK=})IW>2xuKPp}D%RnG-;EK)1gCo8Y-RoZcQm|zj9Z#|X3hxU7v+4J@shg741TFKeY^JAnaiU_WhNfYL5^rq_ zRQ(ey+FPmTx?@S=v2}eeMCe)zhHp9@)7&xreo+rG$-bR-8-}3 zV}AR9v5VhPsDZqnPmPf%fv^9ova1n5E4pM|=81b(*84_?9~- zwqA6R2Z~R&%&+UMu7g(_DYDyxhGt@vl~;!n!}004R>004l5008;`004mK z004C`008P>0026e000+ooVrmw00006VoOIv0RI600RN!9r;`8x00(qQO+^Rg3=9$$ z8v7$jn*aa_7fD1xRA}Dan|p9o#T~~#zjN-rd0qpfvDr?qu#2WjopvEztVEh^K|wm1W*we`^|J_+Ta0xD1?Kw=(XfS8a3^1Aot zp0nFOZgOv4S90Id@64IZId}8h-)DEvp56WJ3d2ZiJp;HASOiSu^inft%y_&0oGcV0h^NTVVqPhA{7B(t@R|}V6wf6vr0weplGe7 z7dBz#uyCWzL07O*R>fIbhptp$Z3-QEDcEEIy^0TT-G2;P4WHO_A(;gj6RyOZ_Cw^{ z*@)?kwM#dO*18TDA5&0eqv|(fZ+jSZXbafh@C>A7V@|mN^OAcovd@d9Yt^E)*3sMP z2iwzyy>m6z_D8_oGBkl0;79}01!(ZOLl%gfJr&254`UQx6SMa`roh_Mju%3)ZuMI3u#m?&Z{25n7SM>jBgIG_PMd% zUxB^jNziuihtc^sX5E1?bs3Ub7}9BNdC`q~uy#Fzs(jhssr4y62j{}4F(+UD%>lM{ z{0Zxwdj~X6qo^Fm6%QkMGe_JcwdF-#+B_CKd?4akx zrOdoPKjmJ|6+-jIo#(-3qB${>zbyI`kj3Qjytll^8csgT#_jD%Jn*~=r{M8en1+EyGiPckrQ`F_#B{bfK!2uT z@aDE%ta$2g5$6&Xu(o~Z=Kbi-M!r`7iwgQp&c%mFUEE;(#3uVwnxir?VqmRo>qN+yU2h9kU7Op@^$4AzL7w11dR9G9)YoU{<#ajbW^7X(mRbE;9QZr+Erb2W4} ze)E9=#F2uGyBL6tTR&#YC!b>&23l(tm(AhgX(eB8;QS?kU~O7)dI0y=rjPfq>iK^L z?#GQi>(syiqs~qmY*fIZq?HZsR=v7qYT*dIJHOzp-_ZeT4&lkW6eD+9+<<$OP}y-t(0LIi zj2j!4jfiV_V!^rOoH?4K&3~-`{I|M}!&VNZKlle$-Dc?N9GM{zboX)WJ!_%;%aF+o zfg|n|cAp#_c$Sqhit~%|69Zf@b_~-d76pKhHn;HZN4qIqwg^XdaoG06bYWHeCNwax zrR6N@yV3*AxwI&s;{3d@@`<=fr=_Maf9|Zny$05Atf0B|WXS)~T7RQ`ZnU>^;MLiL zYN-xg7{CdigY}2=uvF0HtLDrgGhdOQ7 zwo*L4?p1als2Q5LtA7b=>qDse3UtGV!RyNp&`qBYj3@V#DR8i36pvL;z-tHhetf@t zE>nub59dU^hH&*uH!UpZ@q2$lc4kK4nSW}lL)E<78|>~kQWHV9 zAHm+c7P^`Ou$`94%E}Vf)E3e=6L&gHR{i|8VPBhs0eieX-1o#^c=^3;IC@K6M7U+q zmE3pB^+QHwq2$~6GwdBtU@EAC=?$%JTKjnRBK zWi*mgif*g(x8raM3;3ulliwehNJUc)3h;-Q1rcH4rL%eTp4%xd2ya9cO0nCvbg}_; zbk~r1u%%k@9)^l_T80$ z9wvyb{eQ2#_!j}ShFKR(Wd7V)IO7njihK0SGz~5|FP}HJ@8r2x-lo&-37Ix6#l`Xk zWlSk9j0-IIYq*L8?3MQUEZ*3*lLywUV{g^a7*y%_ajd+38B4F27xpSf7^)Yo^(x>O z@doZw-H}HA@Z3wR+gL%j$4iRS!O|<{vGVq1lz)afw~auLOYaGmPZ9+T{*l>B?`+|@ zSKndTHJ5YqwcjN@Ej1BY&+a?(P)mYOvM8l!@9JjssC0}NZgct?RRbk`z$L(eL;@#4 zB_dMg|HO+N1j>``Q5;p?cXlbzmU_?il;E%W{}6Cgx@G{a;ABePT>%h=S&#LUDT#0SfO cNT5nC0O}VJbn-$ql>h($07*qoM6N<$fc|4SR+n=HmM$<+za^FI1tk$S1&rycK zV5;V3Ok3!$(eOuUBJ`b+V6^}SQ}Y+tJIWj_EvRg{cMnJo=^1-_0PL-x z49)_10uc@IE;|na7jS5ZjRZ@yr3VA#3(R~Zpq-DEJ=!F^a(irEH17LnaW5 z;KP^zODvbs5C}*P{{qfok70YrCBhM84jTmuL3dCjlcF$&7}R)u$gZ&kBIy@zL4HGd z10Ikv`bT9;%YUuz?*82hsmvDqX6;{YAhqA_0itX{saP&ygOIxZ`146+t34qTzqspf z0Ic?e?EDTwAQZ}_G6^6POa2;YoWh?>_81qe?{*o z6L5dxrD4gR)Io2-Pt=Dc-_$v5DpxFV2OtLm9v(sg8yKbz%2UMo66moLjkp}*0+k^F zhaF`v77J+zli}Qfn}72k9E&%^!5427h&W;|>5}hPflNRK(hyiQ7LP=ekyw&F8b`&E zsd)4L}8jX`42_82l1O`_sSNHmd(9;XfE7YC35e^cMml4=Wz zID%nI8A3oRr6D*V7my2OU-ySJtR(^{`vDB~w`A0L?{G86aYV!-s)FVJLvWNNgew4`Mk;kia4%Nn8kmg~wx&oM9je zg^b2?a3c`oI83#Z0TP+q!$u7+8N00VRWX@oW9ZG7uh7LDh%^+eZL?RMv zh#A>%nC`>TfnqYkRT^U4eaGP)CfXnpK)HbZww1X%zymi5 zI5IvBK^(PYS+cpAkQ0T}MKxC4R9PbO*H=)z_ z!r__@H-ZvWCXflik*m=fZz7b9UX5M~1;d4%Dg;D4h!x1MR9; zAwk|EqLFwEmx3gdF;GgAh%6ETz@Uj}_V*}Wd=R2J7L6ey(F7z8s*eOJ21~_amSNCe z>m$UW(bGu9T$vXj0Zn*N=6uc6@r9egfJ0CO_+m?dEf5WNsnO~^hQQ`S6a%3_2!$B+ z%a@r$DELpzCb2;-4l)hNBC+sDHWw;g0GfhEvOo$*B4hDf0)8}$#?JB8?BOPYL1HQP z7z`DUqoOh6n#h>)|7!MM^sBMO|E9%kvB(pY$bJmA2Ot5U5fGF>jfM*)5qx~7^$<&C zqazz!CjL(Htp|^*%KuHzgA_cM%|(-t9LU8;3JyT#!|97r=BgY!;&&f8X@?WJIh+~leA`S^+a8PX{;-MBn z#;}lhE)j>H9q%zZW&Ti-e#|*8 zR{%|L+u=6D4_a_691A^SkIv+Ow(uv96J7Y17#E)OqV#$2yiXpCdvO*QZ4 zvosv|HZ$ge21ie09;6k=@%+wzdha7%XnFO4!+KUzbzojV>LrK$X7^)}>3~m3cZJ!j z+V<6{ypOrq<3jP1$&|wX0=qx9%{$N#-2#YdA9b- zAM)s=4J+F>Cp+zTqFzhdGev&8XlmG0>y#J2+;z!6=ws`mu~NMq|1vP2v^I?T`82t) z;~Wd8p)=Vl=Xc}x2TtWVTE_~2?G*Rd_M3*Thxvq{qGDpAGB$8kW&x&C8+q~S!BZdI z4(L76I<4-~DGR@b75)(^FIu0gDj!>Z1a5xFYJHb2ZQ<5mKO76yoK!iK=bQ1|H^)l8 zS!t=Rdw<6KBx2$<;HmDEtFA_hr3&%9wV$5&w)oHRJ#{*x&7^Kl{HCKm)USk+wfkPu&dLRE-_rNqsYd!uh@HqAXhy!D488i9 z>S5+2g~4b+!=DM2DQPko?3dN%OcQ(luC|y@Qq46{g?x;>w$e*&Z zplSAws%-T`1Jk|yI_~(eSvQ)xy^U5(n>$xgJ7|^CR97>%Zr`ey$e4b{0n>m2(?3qB zu4(CCx0>U?@vVOtjoQq;RU5N;_vYBLA=1r<{OLZKSEl5+)aZaMYOcz`moZ$wCrOdMh1})d*TbHBh+dotQO}Q6-~Vzlmd%?{xT$i=G&b@I z5(9$)^pi_+c;ut^%oL@qm{yfRYqC=aG9vRqY=CWh^s+hXd83#`|y{ed`#$aYGG*Jpq zS(~0R>yYGJn^Wp>NuGrTLurHl(HeieUvIqTnzA9`*y`oS73eeR3n$m6MxSTrd9Qqe!RM2!aEB>= z>x&P{j7t^fRCKl7echRpd}eP?O@{5Nfs2?5>2cG_3ol~o3~aVI?P0b%s$leh8Cl58 zO@7;W@3fr>`LA~`qBGWnpHzS;HrI--y^%(~UN#p;nsY|gD(BD=mw^IGm+R9c&G@xC z>!a^sZSni2!eHjgQ8P0mdYlhx)%tkOdaMNKM^)JRnyJd21GyJ4UYGHt%8Qx`tq-+% z?DdxG*B<27dG6VWTcVPB@3_efbD}L} zNkSVrWXhGCo#Li?PPVgp;EbTj5${PQVbec0=N`WyAE*~zcYl9Qe}htEjl;J0xoSo= zDV+g*sY^f1s~4TuRtZ%o`4l#(rzD?&p@%f;`;;mfXutycMZWD^U*A2GR+^kgsrPqp z)iUnO>@kctj-I{6@*s*Kgv9>kB zj79HCGkpEuG$_$6Bd|bQna#87j|)rUsZ@MLT9QQVcX~ROM%&TdSJ4*p;8>t&1s1sP@*Q{x;}Ccq}1Ys;9kb}?d&M#Hv8EoO*og`q>Om0h}i9VNN9emz&- zwHUT)gC-sQM}8>a+xvzz^nS1P zxmi)dwf^&*Z7Vzw^L6K`cIzHxJDqP)Q-=jK?CKEek!?d$pAt;@@EC93&%N*b`l|-R zZ&^jZ>8oBS9%|Md>KxepDXK{{-#BF{Z~FYt9Rryt%g{LPF_kh8$H#!*&6wsErh$cP zbp{7H>~yRwLsJJQ{+^_#B@-gZ zZ}_i5Xu}%F?FZw${D9F|6!B$($U*kJ( z@*EV@rwV{xnSDn9BH6S3k3|0%?We}aUgN2Ub~F{p_Fj8*HQ|z4e(tqT?Jo~NMN(;R zx1=~0>AlgRZpVgdR{XZ|O^&W{pRvYvaykE5W9=tWwFGuK`Z*k9v4m3d)_IJTe1cZ z&V8)w-}%JrF^=%ikLzq75Of8Xr*0{p!FhATdJ)7!sqs!9W*QxxM zS36!cN)2Lz)s#zauFB+!2%W=9`l~!7kNwbzE z&fF08G0ZF^w^)zdqjKQP>vu_EvwTb6yY4Nm4bWb*rW8S=FH1giA#L5d%UE9Mq+j>x z?rX9<2Rpnk$Y;l+#=|0~l5Q6-Er;s#@-(mA#hJ8ZbsJ^aK7MO&I3sN{_34py3NVAf zMGFhoMY`ow=JxQ5RRS&f#i7g6Ei#wC3ZUw1xA zY5rs1Vbja5h8r9ls*DF;ls>bnOTL=wo~amWgV)@D*TN}^r2L7VPS=a#Wb{wG9OsvP zYvNk9IS;so3C0BMrLcx#{vE~ND89nJ_Foenp7HTeU8FC*K&{6r<}fcGj{@pqvhr?R3dU4%rka=$8FT3A3;O9n zk#9XTV0z5L3s5Hss!O@;&}81IQl4d*=ju*AD`9X}tiqxa zvHfb5xpAVaZpD?`Go7>o?H0B#H#A-vWw?C)0Ve&u_m#R!gP%V=%gg=fn^AeuiP&^Q z0jYha;Wcjh9p>xV<}=KdY@8Ch=bf`7dB#wAcY1Ff5k6ZIX_ga`+xfQG)bFlTSQ5x9 zyAD%*m_&-reOFjiR+f9qsp|LR0V+2Y+|p{rq7<8FlVBctNl|UK544Yfvtc&N9cD#s zZ0_3A-fl+Z6}nA!aP_FSbc4b69gdj2_BRcsTb+*-s;_2s8`2%a3b3aZotk33u3Qra zmu>mg{A2JdaplHWDQ@MLQ%hb>4%%m?5gr-bly-5Zv-^rj+r1HP{^b{ZYR?{xidxo{ znd+0Vb&<(=lFnQj`l!_+{!N`Cu9%@awD=r zDKiLh4kVqKXY-N`OXag5mN1Tmm>M2m`M$(uhJr#)hI7;9yq)r{cH!-93430}o7|G& z^j6!s9IrDm2)+=UpPylryo5|bq$lX}if^ZxaX&tZ#^^N$#TM<+m~A=zbvj2fRNmWo z*+-ODopSZS+_Q;obKf2astD3E-<5}1ku$jEfm_w2X2rzAh@J({qYJEe_6|NR3_FMj zU6fWg`1xU)?kknSu7t@jbnC;Q^WoZ$=xQqq=Ubgux4Sm0U@^|;(YzI?f!%QiN_r9Y zOJX1SOb?n;c;&4c@uXQ*xDwGpD{c=R&-uW43@}QVX4<`FT?TpuH~> zJMd-)o2{>w`04tYp}xmj8_)4tKic)bIpQAgBLW3c{NRwo98rSh)wTD30ZSWBxJI*_ z=Iu8Q>o=mc)XU+gUzrxU0YGEPx!?TvVCLu=C+v$8-|+nS`FhhC+thM?Qf#c%A_SlS z+p?nmbM5nULtQ;$kwv6S8?Uq6Zc%hVUxnMmR*lfa6j^DJbv^N@?j7HKhs3 z&W^55OJ5$yee+PGTy9xSc>D_wd!JcrKa;X$r+cbLcWaOT=MN9_HpTp!YQMYrVo3uo zFGi1fDaq89BK4?fd9sF{-dye#{2)eYXS?&JoQel1Le;Dk=hdcgtpmr6WDT`3Y<>Oy z=iBVUUk0RmCg&ue>U;fsI;-mTzL~392s{M`c!}8&nw97oiOgXBat v)9u004R>004l5008;`004mK z004C`008P>0026e000+ooVrmw00006VoOIv0RI600RN!9r;`8x00(qQO+^Rg3=9$$ z8v7$jn*aa@!AV3xRA}DqnR`%F=M})ux%ch^5Lgj}AP*Ophkpu~_^706QmC3BtvWSM zLv7MYM%y$q$+Vd|X$Ni7sgsVQwb7D<>1bOsBPOY>v27$#15{B1SkWq=5*`v>VcA8V z`?&Xhr+@6SJQm%(%dVJd&fGul-Tlt_e&5-%_dDl&NJQ{u6K=WzzJh*`MF@~xA_67@ zA|Qu|4=yx`R)6Ykq|O>D$LLHhW)XzOBF8@{&}8jnpM4}>D`st# zFl+>36G!lB3{T*a*6^9%$2rT8S50L)oZ>5wn9N$r<%-?x_F0f^o)v;3`1GgwM_=J0 z=1mVY*@xt+Lh1Y-u$abMyMH;ulfH$!@6crJmr8fYmx_Ri zE>_g(IeiYsf1Qh%2kKBDM#DX1tYaCp@I-eGl5Es{`RSh@rHZab&f=~Yj?%f)>y;LxnC(*E8i7-)AAr*2TKE5z_P zFV*GdGU=Z`B=cuZbwjRdQ!xhVya!MmPb6BUi~C%}7{5Z5yWe|a0O0l6!V|xT;3%gH znoi5L?*0c=ov2YF{Q)+fQbC!t@zLqr`fJ6tm#akpkbhsb=80-3^d^wVc-`%>%$An$sHQQ zKk__ib)eOOpk=rJO^kV~tLTqN;xL#RfEWOQDi|UR$oZZKkZk~Z8-WObKs^H@42WL2 zKz{+WC`ytnb7SnvO!iWD^0^V+tqB6JR(Z%w6!_`j@sE$3EaUkArr@&7He_dQ|G`s! zgKlc?Jb$$=aKsK-kd)wY%>Ps6qE)NZD!&yFq9j{v_JBaId^p`|m3WRLpsb9vw7KyF zerP}N9Cxy!y5P;fcyG%yG|3_v>uIp-+kXkLK4BztM-j1k>cjv5JYTOdD$?)(O-zm2Y+{eYtx+^pQ zgv<^cu`+0PAtr;x4D#5`45_zCzI^aOfyN2{Fxe`V?_xKOgEX!eLlzTQ?+4rdcgR!H(ES)5ja)V?A0^5FSBVP40@Nj(Y+q zE-5pb``m{S5s4PE4US%e-OSW5$w~n3h(d8|ti+rcYqJ)Ihlcpm(*Uq;<+1}uPc*i5 z0YG(a!_kk*U;f^P3B>H$QGfaJL6WQ^Xb84`>bW_I!w^n%MxQf9INbbD#6JDRD=qArHtAxIgJo>dN*qhcKhkszUtA16VQr92q zaI-!(`i0Hwc;2gHBwt#+hyQWr$FCQqN_N(9XJ)V{NgnhT5t}7QVCVXLDnty`SBeERUERe6u+5`n$kH zM+^`UBf7_d99qoGbgQ&G^0oSuYO~G}#{jTozM=5vFDfGT(SOr)r`3Kqn|hnP9M2>4 z*i>&dC%)Y@*JM+>h_fqck%T|uCI-CRFBQ1$#>W3Rc2j>MeA@dV~jBh(yCWJ zyfD&>gwCJP?tdc7?32o?=WFT!Xnb#+03GuX5iDJhoV#MFYHEEzzcmqgo?9?4{^a?p zL&rZJv{>B-1ZmV;)@7#~5~oNEe)P0ML{a*%qUyDxBUf*Y>-43~joY~`f79xf-V`SH z8`>ew?One;^!|~OvSF)DqY^f)Ub%Byewr7F@^nH2fPd9yfB)3kLm!;VfAaBXzxB=F zAgv#b2MQVh7-RiI!(k!8oUg}r(*PYf`BI*_d0k{PK001R)MObuXVRU6W zZEs|0W`B7AGB7eREip1JF)~y!I65*iIx;pZFfckWFu_~^xc~qFS9(-fbW&k=AaHVT zW@&6?Aar?fWguyAbYlPjc%0+%3K74o@()5al>h($07*qoM6N<$f>2;oasU7T diff --git a/frontend/public/apple-touch-icon-76x76-precomposed.png b/frontend/public/apple-touch-icon-76x76-precomposed.png index 404481afd4eaabd411ee9cb0d67bfa20d1fb8ca7..08642a2e4f9fba6369b2577ded922fa1b192aa84 100644 GIT binary patch literal 6515 zcmai3bwHHcwjaVnib_ieB1jDkodYN(-AGCgJq$22lyoVnGz{G>0@B?gB`Gk3NDBg@ z2q?(=@SJzfJ?Gy0-X9Zt|JGW2^q1S zSPX>K`P5zIVD=75KJGAG9}PWgA17;Z8x|R9VyKq{AOH?SSu%UUon4R;UQ#T-RQZl2zMB>Ft0E#AB!|GGt}M2RzgQ!@egKTCBAix7q@F2ZiP?laiF33BVB7T=44?|kJJGi185H8G@GA*qT zXp|HS3xG5KA>7p-fkGhd5w3q8;e!0b2Y@#qf5H%cUOvdbGNK%8|5EF3JeSD7k;A+k z{tNjf@^9pT`~I^+UY4%^iCA6z|0ajS|E4?=rQiWL;t!|(P5b{n0IBEg3WMmtkO;K9 zHB7++=7PHO%l zz+Wtee_?JgsiNBu( zgi``=hl8!Ryd?_Q72p#P=HcV#;pfxi7n9%-PfCg}ME{`hDr_@GJ9~nSaG!!qWQET~aKr?g$&SHO%JM z;efc`Q6$0^dKhbB0sot-k#sx%lGD#Vh`Z|bZyst} zt-cHH2&}Am7^yUf;i5lQy zF(H?}u_v@1+%2l|OyaCSY~`TXN|5~4Z=P*0Wj;sccNl7794x)X;oEv<7fsK6A|T0W zX~}i^wj|V+ibN}R88^a-CVB!-az2tR*5s@Czn2V%uUPx|;VN+|IDuI?Rzv%Xj?`Tz z)32$~lvk!NI{fNB__b-E%?Y`f;6LgZ%S3V;EwM}l^^c(VV|W>MDyMUPTLBb)`2}^K z?l011m?gg263M8P`_h)1Hs7!ow;emMvQF!`nX^LNN}@65KPuiF^194-nr(Mi_DSzM z9)BDRuHE@2&*#gFhR9XP2nhm_P+Y!nK$r|#5Qw}-S^mDBSH`D|ZBNs6zX6%CMcZYe zc*S%WPx5n^cUKJ#Js#Qn=beMHW@|#l>SlFS*vXEZfcu)u#|n=zcZ-$N6BF^(aJyV_ z&4NQ>JWcBBoNQS~+85HARLxDjUlzoHgI?YqKQ6T0oBravw|@#B6Et`!TRom4%={Yz zff>F(;nSq$AA(6&&uG2q#jdcDZ!VWCU4+4yt@0rx@0o&_aC!m{wZc!=6L3tg{KPxi z>^&9Teati!)Td}3i*pfat)KNosvA=JMr`JrXT%o-s|C?)JnWqKWG0^;n_^srx2&8I z(370vJ0k-MASrp~VQOxS#%u1de%~6p`aYodn}Dh2Ee1t?B6d15nTZu&VIfk66xWP1 zb4Q_tXv+5rH|YK5K0w&VzPHw})my?9WqqdZoRm4x&)%)O>YOnDTfH(I4_nYKf0}ZS zFz7k!b#htqDZECwC03*!W@RFxL9;Qwr3zBZX~ikM0)-Ko*JQzg51%S14S%hZ}VqGtm_pPj$2Iec`Snh$Kc_5 zHE@2o_IN3EZK5vGVFafNNv+=D&Ec}2Z{JIyEM(&kN zE!P4vSC!0t;om(+S=c8|Jm^rP+rTk8W_fcOUA0UsC2xV-_la$GTuyhH5TG*cy349y ziR=r%rz6xlE&`3C4rcT_v0f~2F~2J*rC9g;RJQWd3Wx&NfLZocK0hMM!Qdl~Zt_FK`^!!Y;U)U{TK7?-cM%RGDEodP7Lh$o-p4OIo z@l>rNa1Iwp**nd{k4&7bMeWbozK7vb$aYgX=AloBFiejbQe<`ut~$Nx7a%Pwgs$tw zJMu?;IQ-z?*hfWphkIVaUnA!0@xyv4`__a2!V_$>cAG!D zrjrn7LrPJ*)KsMSha`a{Q%t3b2P|NqQwBbmxtH*qH8}J9)hC(AjzSV;moroFWKKqw zo!c%;1ox)Wa$9g#nt5Hc^H5$94QFwD;-qr4JCU+>GWmj{_Cw}!jVuFho6{IFb+LTdTxP6$goH9-G8J9!2*wJPP}d|*5^*(A z+7?C^G-{ddO%Lgb4N+i=UhzGsOI(g`f}h7z;+m_{1l4E0o_`a=K`#fA(d<(G1zWseo4oj$fP8&f0R--th zEK%n8Ydu5i$8R_0`2!^vT3J};x0-}Xu_;Q6?P|BhV{%iPHcf*4nR-In)(#c+G)8o0 zxOdKIirc4}1nS|_DfLxNnG2``>5h}Ry1q{Q_GB{LPm3IT z>oc%)>bX)AR^IHw#7OIO+w; zuQAK`9?>%}c$4VNkv}i)x=Tv<_2YSYkv{jd zHCaqVnix&h;)lh_fDiMtVt{FFI2ZM|Eh2|jQ3M#P#t`+AcIHTI)OGTQm9lk-#m28$ zSZ{iAeD5^o-#Y%hoAB&Qk3mP**3xb0-a0jBXy+?1*ECmA)6dBi*87?Ul4DF#y`s;U zENxys3tWD}Dy)X0n-jKAOooP2?txL+>m)kmD!7B>e{FDR183Zh<`<>tUPV z*;-vgqmNUD3L0L#JVUoWoszZMVjhq@T0hgQKXS3Ix69PwG-6fUwQ2WoizY=CC&%RtmH8x3uG zs-iwsER*KJFe;Z$ukzr*zC06il3!c9I$!LUK8bo;lxmnA=DaA53=t;Z4S#=&Do+T@YCYBvpk*C4k# z5;g`Cbc{BqF3-lt^>|AR;q9#*$4xAI)=K9A$R%au6)Z%$XUaK#NYur8A;lho zch`xxTk^Mq&~yWn;dmHZRfaWiza+_0J1d#}AjH<&-;@ZIWT-T^n<)dlL~*eucZgi| zVhPfJDbNJH)av4FIe|W$O*y!IkF0s#Set5~8K~3!%=6T!cm1x{>V#0k)3V9NoE=~{ zvMXn;Ul$S>BwuA)bQ)Z=6qPbCE)Jof%I#VVU^tV? zJ_3^2qvs{a#;B;cJY=ItYjK>NX416LJs}JgG^%*>DLmhfx+E!TDCaV|23Y|Z#!r=K z881!s73O8Ae`v(ESgCWY+KWIqHX9f&-oqnvPeaP@q!(OVdc%dDm>F67#>wDsskiK|3Kz>2PVEKaD9Ac4V7B?^f)1QphdHjx<6Zea)2 zpo3#(7mNmo7z8o3*o}!Dw|uT_jT)_qxK_*Hu3LJ~0;YwNe8Y9PR)jd*4*LNg;GdaM zPZ)7c)8TY9_-hW;3~rE6s=~T+L7yr|8iml}e4+Q^r-ePx_!!8&FYi}D8d0|V?W7pE z$yS;I*QwC#x3U<5$r`Z$KZc{8ba0X2Labd0-QDygIF`1k30zGokJ+C6K^c6##;GaH zsOY}ShDc%9oKO1vE43FfF<%fe7sB^Do)usFwAyF=#KDCaPiqFP(e89HKMP@VOEZd(J7jFz~EaW_$>MbIA+5XD|uOv_jwT?3buy#-os zqquQLkrvmNl?N#&NBc5{)10MvwQv$Sh>Qi(zQ28N@48?)xN=-L5~~V~w6jZhPB4n!W1aI2vS$sw9=s8#Xz+SuQ7uO2lkP#X zHnM(q!;a4>W|QhF!Q9+j_}Grw2a5z#wc6A{DBl{P{)~ z9x%i8(!)(Wv$c*+p6<=7I@=H>=go+6;C_;HzwRqY(o*5d-eO+;4 zVId6z6RFl3dj>7*T}pit8yIPdST|ICOpsE#L64~AtQl@!#3MaAo)Wo(~7 zZSmv`>z!vJYg@NHbg9p7B_0Uj-` z5ptDG;j;oZ^IWyF;^E6-x>+)g=~cG3OL9YRIpV>(ZwhEXV((v!YM5feS@HeV^9<`U ztgw7LaT0?5jQM$0w>nt)XWxxnYexsOlaa2XTW-h#59ud;gSx(72kXKYmtdW0`H^|v z2X&|%k=I{S#-`IMxUb*WnbLnt*^sgkk8_@M ze4im||GAqW1mS@X)rfn3rmJc@x6>rg+bJy`G2l%oa;)gm-+oWFZ>YyGtN+UH%0XOna>Q}jb!U-zUBi*y?jlt@`GleMM+~c74AVOenj%J@w*~w!6Nal|u=it5evz}4I zE!r?ysU`SE-udG+sSDnV<52=sZyxk`>OQVCBtEb{u>akI=B;a4?>AOM)JA&;sUwwS zug8RLEsl3tAVe24`OnNW+vd_nH@vp;CC-aPEhN~rkFbvS^Du99Y zFt1UHUW}9DxiGwRlj(#sxz0^FGV3fqc@PQXySa@26qIc6S^PVdRSGvvur>0RGlHl2~VE=xC5a+{MYa>KX` ze?~f=E%cR(=Eax6ei5FsKB$jv&_p-*^i;ga&NeM0qBeEZ0xKe2MUYbTf~#b|^r2vC zEW7vq?!ejM8t0PNv5;r6EfXQhy5{j`(ETX9T-p6V8q&(qi|A8#+c(5sZK zG|e%7ZMDS)?#a;>;0o>Bbfa*Jm{_7?V>oyhlypQ~sur8p3neKfO>%_GJ&qgN>(I8~ z=Ea_|ndFUJL$Av%f^(9-M`xXmpQB*4-&+G8I{p|iN}m#WsqXlX-#hAq;5yh&5zdGz z9qR8}FjcYrGwe+NS8JlpB(%vFxeOV^%}y-&D3-NKdcNA14Mio!hC`ImpzQyX>BHG+ zS#%Fa_4&l>nC;0FMO?~Fmz90m6R88*Q4;b7^IO{`q#3>5JPtTH?TmUEE&5+QNzZ6< z@Zk3nI~JfLAYQx++_Q5j!?!u;=5xpOBlF6$3w?QmcCjVOub2OoC@W~lzmT;E{vRBR B$Zr4u literal 3269 zcmZ`*c{tQx7yk~j%#1yRls$u(7-1}hK{NIVQOFqkQg+6YZERVK#M_iDOP1`r5Rxqh z$&jsIKa3HDO7?g9^Zny}?z#8#oOAE_+;h)!?(>{vb5lchun-sk0Cw~Z6qb(0e!SD@SQ7vUlLmljA^;rFP0>^U2!aCu%@F{Qxd0&G zOKP{!q;D`g85yF0)4!wOO<5M*!V-u!(PvqKLV5UwQzZ%P0041CqjW4o=Qc?MU#n@6 z_t(}I_Z~k@V@k5MVL;yiEX*w}?J^4*qhEva{ZKiX37 zregq;{dE{0B=t;b^Rda-DB<_fX3w_EE zga|89ijIrEKwC^;gNholTKHnfrny*IkwMNN&c3sGx=9i45>=bZRco}@|~+L_{^QogtEJc z%6Pz)m0GJ$tayg^Y5iJ7&Xkm@Kwix27Nkp%lVU{|l$0iFUv~E_l2Xid1)Y?VP*}27 z;F50mbIgF+>=;a_FvmOrB4bT02?_(RTi`pNbbPpFX4%;p{=rT(NEhDSW)%;T)P)Rl z*~w&MWy_satew6^FwTt46f{$!;;*2oPp=U-Y45rGUV*+xnX_fNg!}ru$k6O$%f^)m zCN*x6`#M%6mmW)cI;RSY#R&J~fF7l{wn0~sqnXrM@-4wXht%m`df&V@lM>bXz+xv4i zlis;&O&w2uKR6#Z>zCKa2S@Ite9!x9NnT1U& z)&nRz+2-vLa?Rmo>Z8@)Bf)s@NbVI+^=qtIhTZ*?(Sxk}%I98z5S}?jdgJpA)xvD%Ues#TF4S`QkePNF-53X2 zMl4KJzL@07FQ#iA)!9;S^juvPL`8I8MR>M8i1$=D(sj_cvc? zVUXOIM&*g)rKL3u`CWJ)T&A*WV7*@H6$i9PT;c}p$@0xE4?)~?)2~sx*3>vdBl554 z_>c#EF6ZV0S9}*w7P3$Vl#b)mPlVj;Y->vktiyVDJy6_v@N)cAxa&1nY3p?xRc><6 z;JqodQ5$Q=<#J)ZO)gzBWnS09R(-O_u}8_sskkUKV(zT0r>QvcI!xcr7}1i}me5Kq zHyw6h;IyCm6TAf4I{EULk9O+?xHR6XDl!~yLS?nuiP9#7L4K36lKhj+m?(A zvyYG(5z@x6_|ZdP=2ldoqE;gA$cvX8CJrXW)mHHIhV-UKW$fM!SO|ZJ14~7(G7;mq zHh1M=Dcx*d^$ch7*?29qbRZwT31I#h=jObK%TY#G@jw^^4h2!&&mgo*l^AVI`Z>avbcnpcK$zTU2mw$FZRv)n!QyEbAM9R&pHar zeCR-W=$;s)yMKS&*8FbRScnSf&~%_p%b1kDLC>(iU&42yZ9AKivtv|(3kQ4%Y-CpJ zx4{7rOC`Q>0}ZU}_U#2jzX;Jt=v!XE^PS zOlA2FCQ*qb<94&`8sR6zS$|PIh{~`-bJ}0dB^WoY3uWE!6ngeyZ~E2<q~dD5-RE#{?mEr zJ#JwAKo2p#=3+7Bd7(o=nDn-h4S&=!?%4|%K*t=%KC)ea4GvUm{OP+>>2Ytniuohf zpulAb97a6+dHYuPYbdw*w5Qv|iFa3}DV*?BqIZl}x%7_;C11CP);C;f>i_*nDxw{q zfxh6;vi*&;uBqZB%N^VxP(C2*ydFZv&g_G$9}o6cpIdsvHa1n5B0Ucy_s+lVw9Q?0> zTAGwMN9_l?h17m_I5lV8Pq+ z7tZUfY<#*-oYC4sFGyY^TL+ELX0hF_o9I;A1GyTX_iCe`9#v}vSrK}8>>2h#pWG21 zfv_;wo!C4KpDksyO=i>jOUyYR+%RsWCMIFL@jR{2F!swS=oPb`n-3an#Ob<&kG!M1 z5K}e!049ItxNlm(l^YYGs$Qf1Utl=&W!(DJl~9E>Jefv=2uhCOx2yt?lA>T-uN|qk`!i@OD6${^eYAOf}#dpII3!Q$ooLPg--hJM{i@2ySr77WZ;tz`kX^M>(L>R;Vq6 zH%b8WYN+SHJS#}L!fPWm=mYafr>DrubQ9Fr#ObZxp6^nBU5+IAf#XB>j`Q_n_pSK# zFhgz{-EPNgOTMSoU)$|Mp-N$-_QHE&xG?m~Y$Zn>ch$NZtlPcua>t!<`xT- z@%*JhWRR9eM@`Fucpiv&KgQz+Zn+EBaC{p(wM_mk%D-1qbNbzec&LncA`+CB)MziA z7k4<^?Z>pw-@#SDMTtH1T)C{9bTH;{p!iJMP4a~-Zk67IO9krN1UlmaU66Qx7dik+ zaHT7kuPD*Q@`@T#NeQW>DhG!n;c))ohPwZ8@VW2o;Y#@b4sLP~dQT7B3bV8c#Nt9k zef{sddU(5t1`>Q-L_K^1@cOcZYm{}CkyjKI xjp%b`lxVON9ie<2>>uqv-_J4ODQ0Gj}FTY7*eoy36aZj{ybBZB~5fPf0~ z^I~)OWIrAF1TGo;K7JVqhfSymJayoXW|lC0E)RfdYG`Vp;2ULO+B^o6Y;Cal+s)va z4%|Z^@FpXXzP`R1zE}+|&mD;-kw{1s28qESKn(=npCh39AvpXs;}DY=1^}PVV|fc$ zTn=m;lS<T9O&k1sG3fhK-) z*WUmz6oGdB1i@mng?s^zD&X?|8fcorpG@|i7ObCE2L+%q_9tt-J-7lc--G)LmrjZQ zw2FYm{DqgsC4W)}{8+zGAD8@4XVA$^F3*b!I*{t^&1TW5RR}V8H8a7 z=>V8JlXS2I3mKb5<57A3Ff>@Y<4`E%G?~-Cko^$Zaadq3V16uR z>_v4499Rs2hYp;8|HJjI0LOirU_7_T6V};)Jp?pwa`}nNmMlMj?P$OP$;6-7-Z!ux zLZ_dF<24=N+#tS={P35?QtU!FH^2V)PcP1)jzOWpf~bkWg7s08jK+{L zXmvE|dwm2sG`Sl-mnrb2@&G+|Fmt|V>h!{`uMY#EG-0Y{R62_@-lZn1_Y?x%1Ed%L z4nj!yq+h7t@YCzMDPX zM9>Hf$rgJ!b@RVzF`dg10X)GUgY8Y_QNa-q;DL>X2__M2 zdZ+c~@&%J48%)6cN%EryPpiuRP0s@)9FxvO5fBW}#Rw7>M*=^n3kHu1PL>isS{Oj8G$4L?UPgCvxlH~uKOcc53?M9(1KxL81NB$awh+?g}->L_}1Je2c_>VUK{zRAz)Hr+7mZ8 z3rt=EpX9+;0?4U%0^rHiTLo~^(1G*7cLwBLE_M)zL=X!cdH*!(LLjP$YOX8Aj}X$$Q=EEg#N%Eyw?6&Vjsx$nL(^ge*Q&MddW-ip>%x3755*9&7)?KZx3O>;WzM81}~f3~pXzRXb>i%acu?`*pr7GS+?;l>4TaUJ_^ z6HJbhN0Nyx?^0;kg{x=z7GBYPADUF`Xc5Pv`jfm~+wK_4KN@fd8FTVvOpYCM&JyZo znHKl>1tBs|O7;x?{$^fdR?^npFSUZAF15dDm6JWOAsS{JZf^C_T4$Z-_D?5{$j_`D zD-O(Q4JXBr;yUEbAz^WB70+w`J>$rNd>|8Qg_v^?dhQ$D6K>6mWZ3- zKH7IBjau4#D_q1#N&rV?WGI>1Tz1Yv4NhgUwm)ekgtMaZdqFDXAa_WZB$32 zeJjytU{mW{#$HIdQpx@05B-B$hFc1KXWb@mqRd(+j)tO?MJwrxxLKD1Sr==6b0}1l zZ^*i_X^CH--^gfYZEDe(0=vAog^gD}mTq&)n=|UF@NSF8d|uvP9bL^cqP~_SNGXY> z^&mpvj(hz1{rL$UEM{F(cR*h|0uIq;0 zz8Nw~QM1A|#@d@Y;|< zk)Bzu@Kzx_JmLMk)j<0^1D!^bz0y`U4#?eEOWL~TWmhVF+oNKEt8%jP>^0?8_s(K> zxkt5%-B-_sA0C+H6m$ac*p@~L`5GUOoVAdm8ZesKLO&Z!XJ7NwnoVoSP9q`uFJuw{ zI}AkYU<<^Mn}0&Bsbr{R?*97$9VE%V(7o-3YEdiYR%@4pEc7gMJHsp?o?)sz%CO}{Y2B{;0ZCE(TG^QrcR~-g zJfEc(fA3wQi~92Z^>^Q5mkr&BxS@JC$k3mu@=sTD)2EB90bLnO40RCD#8s=>tf7TDtI2YFV~70$`);Oa8{XFVtwPx!ck9$EA+HE z^ZC`f_+u5%zrMfH^FA<`TR4znk~1*mkmnwQEx77c@v0!)S;N^mnC7?~(&`wX=J~WD z{p`uGIM0ShZk<>4DPrwg^X$X3H`~(iH6vM77cv%@Z1|1V{PKFx?zWNq>hr)H?Xj=A zocqaF?+(O^p*D4gKOX(WYr@NINwcYMQ8W1+io8OeiL1u28`c*08~BTi4kwaapG227WZOx6)kmuW-OIIj18SajNDjiN-9-iVc3oc$&mOHmD*J+2FvSRYH zr>BffN93Je)qFi$JUSHivD2I&BLT?_f2_rI#RyD?dMeLZFXsY^Qa3C4vjYl_hOH(N zwds3iCn? zdrS8eyDKW1!;T(Vwi>Xq1ejKZ4N9Ob@idox`VB4r}AF$ zXY$kJmJbAI+}PFHSX@NHM6t;c5X-v8JBg8L4IyDlQUM~3xAe^epDVL`eOMi@>U@`G z`IiX;wU45o=E)lMMjT9R4}Un=b)r7Vqm#GW)JJ-yVpGs-kLEKES4IPU&->5M&j|Dz zjqa5(j3N2EjWxs~=PEASxe&iq+ZDB%nR7DAs%F(9$u9D7#iFFj$~F2rDdCE7C*ns% zBYK(X6;VVy`8MiPVfkypx#zi?@tY_IZ`|@IyJ!03X3GFB47x=P7Gk)Mdz~zKYQ=hu zRpz1uvj4RQ2QJzU6ndWNd#NvbTe8t57Foy}yeAQI9s*fhyTWzn3scWxRr?1bv;+jg zK6R3!^!ekb8f5W^cTno3nix}H*4ahFAz$0L4vga1FONQt4UJl?&8afUmxx*{es>eh z_{U5NAIR0lK75ym^gklUv9h4rq&?czcYbwCY2}P!r4{F@^Fa^OW-HEsD2Ho_ya&6g zf}`$9LXO1+v^8ApOWnT0Z^I1^O0=~Ox4rH`?Wd^cF!3hoEx%nyx(4)@zPHkA&)89P z0vS_$#{b2Yr=~G-5eb`08%`%D-<(D1iF=lRyR^6U_S{5P8HTbZ<)o#9dWz?TH$8sL z5A(Pe!dWz59iE0p`u5>>U&>s+dUAfFKsMEPE??O-?*Id`r@QsKZ%~1MciApK#hzs^ zP{*AcpVTnb+T7+!bjjXZ`mhKmdL@3OA^|Z!L)ut;;$e*X(W^r_BR-9manw;4NiRF3 zQmNxfg!bV1Ybg2~xy$y5`{wd0#W|*GS!5}E|CjM?m|u<%uDUMNO|H)ORNOJvb+-=0 zSS7tce7eQb*I~Q-Ovs++kH7XmC_J+?_P!Y_)kghf0KKLIP>C0&ei!65P8b!RaJf)o*yC1`FQbl*__3-OYkAa zl!I0X;;ZPLq313n1qXsuA@kfW-DVzb-G3Vo*Ji` zTTXBepS4t8cudmbm9LN5Rj_S#7tP0%OkOcP@Tn4QC0@p|sA%^3L0HZ7a|`HM#QRVS zBStq`tj|eIb;hk|^>R) zO}-Ou=NkWX{eEU(+rq39<)d{ukCgZ7`n12S&2#PUGlf9p&wc&udB#jTzRHY`j@D$) z&h9auapgMDz&-u3%I}me!FT(z9d1cFB<_p~!Lkoq1JZZgcMdTZZIEAiM18TLU5*hE z{Ppv#sc7ffowb~tyBZm)7oWY#o&iBAT{O|OyNHorJg;Kljnwgq+V{gYc`E0fP2*J} zq!yLo_7n=M3M*vz)onXNbsM;CgWeXH0KX%l^Y!8YeHn|+O~S8KfMuU%=Tg=*uU6E^ zE^^#(>`Q=_k~nfteMj9ATL+=N z%J6}S<6*Qqv(7meJMMRNp&ngbcwnAL`lDU9Pa_YdR9_2DV?%2CHVvyy*5FPYR9v?D zlfMoGQk|`$_;5+8$+j;AO>Ii)Z8G9~OO+QjPHb5pc(>e>n>lan8Zdg5n>MJ3hoh>h zuI}oz+-4Eks>4QU%+w-U8I%gy(bqUw8!D-3>7gyrNl=QuT|rV6BdfV>!2&Vd^kT?1 z%Ti2Vbp7gM z%ijF1qku_x>XhPlsDGBn9w+tHf6?L^_J`h`cHL5z+-Wlvur6_M8qhwT_ zt$ctoS`yi^sHh!%u-93`?7E2eyGqqF2_<>Qb}Ce4q!evFD!7gsyNAhsie7$r#lg)@ z+5}O5#hs!eDe+_B`!FQ8dGOU+6GK+RVub=>eWs!7p5sX#^uppQ?85FjPfA%|qC3E7 zXSLmPO2_7}Z6U9Jfch$}`1V-)75PKMza0n+-ZEGZxnqno^E`Ll8eal^T)Q|HK#Cu$ zSW+W%O`lb~5F|N^R^`3ciKMn>jlFXlQ|K&9-;qzm)r3NMF1yCQCXM9}JS%nkO8C(pU0u2UE#mc_ttr?v!rtaDwB418A= zX2ETWt6bW9nRj&H6-MN8)k>wH0)<=aC%Tf*x)u*jDm;6-vy~u=(Jl!McXlyO$*Np# zLnw@D?+@^Z+Xu~>+xyWU9_dD0`OeQEK-0#{%=99?|L}yq)EkmdcBR6prI)%XQ(^E!g9f#58CQOM7>0h6*r`dFP95l*xPc?It7$q%x=8q&zIhF zFH0#y{=<-V;?2i6$j$6a&id-AIXm^St2*-pRY5a9j2(4$|IBhFj`^H9t&@__X&M_8 lI$!!T%r|u4UmRbTrrKgO6e8EW9RKeQV?%R;bc)-){{hhOrbhq( delta 2788 zcmV004R>004l5008;`004mK z004C`008P>0026e000+ooVrmw00006VoOIv0RI600RN!9r;`8x00(qQO+^Rg3=9$$ z8v7$jn*aa_j7da6RCwC$ntMqI%F?#1)&%{KG zF+SqeT`rnja&;OtUP^Ns&#KhbnHbA6@hpofiQW+{y-PF?qsF(MA_QL`EXZqtWtZIr zX1c%o18#RgUD?^?;p40Mr+cQq`F_(q{eAs)6GViEU1&!e@EGzj_y@2kFui3=u@sJgAV!IacTKydymC2$pAIZ7Ilh;7ZeN zB7meLhH%n7nZ~Emgoz|HkqG`biL_BLfShARHoLHc`f9B)p;R#>3=2V$O?Y*Fd$QH6^R`wJ^vAn z9nl#fS>CtGp*PX=bITi4BEc~vVjv0YM}m5Qr~{=AYfG{6DwbuTIUiU<%O=5b(l0-z z{bmwEIuRthd008H6wSAq)rvaWYpn2O8jX7nf})5Zx!**lfUTSxe_~nbJnt|x)HZ8t zh>#|45r2|j=q!-D_?-ODd02U^nfA!1#8E3~;#8tBcy5kz9nU+W9N&P(lK^feb?GV1 z+$r=P-|>)WEs^)7@moK*DHiB}m&DZdv}?RqdX%H<*u@?0qnAVumR`)Dp?y@F=ZA;~ zIa5x4+>DTl!ZW{>rhMuZApnq|C~@LuVdNh{2!C+tFTKc)Z$PEKBO!UgF?R8D_Znf~ zD`M(;q77D|jcD}Z==X$_H-NZoV^{X@>xViF66HE}_7iYax~z;DDUMr5v|Uu|B$8Gf zy^8jkx=dB)F%KYKgv^IA#q5^>DqY@C48QwgVs$ zk$-1@3H26djnIEKjrVCLba6(f2m|N4%B-GU*@H@h3RS-Kq@|eWf9EP{y9$FB`YXaF zgb0J?Ll@Ve;KmbJbwhp_qVGNgE z`1zmS4$w%gd0uT#a$aJpDz2zh*W7ohsIF=K!;eHF>yd!;k57|CAvUtRB(_yrj1Xe4 zt2dTba8m7GrzjHNBbu)P)eWEl^31v5JKO@3rM2t3bdW}PC5*d#;4N0 zQ=p9|(6$sWdWPsjrD@w(!UU|y0e{X2ZT5i>5fI^C5i?hK=_M?=;6qxyT_6E~1V)G{ zZvX)2+-$Wm)-75h*y`%IF|&;b34m1*W$r>V=(J+1GcPI^&DsD>Scq#Q zz~-ncsi-3NKNz51iX7So?tij2BDAY#kL3r*0F4wM9pNn2HOM)6Mv^qmJs0dp;RrdF zKtNYdCiL{;M1lH==gB_Jw&hM-%KpuqNt#)^l#5@0wYZf^kSl1q3bry2&kz8!BAzpc zIBNnVF*zZ&Js^klPY4M#m}_l~#Zy_i`Nd^@=BX^0Cq3VNdk-0#bbcfsSF=Vr1?|A2an zyOTq%peYyZ7593D%*pm!v4wWMbF2$SXU2f_$QP?5xxgTlO4iEONw8_8dq} z88oDS%R>xUkt6?Sxwi+j1Oi`|g{2##orDBn-sEwSVcopa<9}0fnNqrB)-PfrT))Sy zlJd1%cUPJ%EuKWX2^>{kDHjOj+4Spj`Kmx#^q~1$sPjU~k z4jn)H=N)_M>YHr|)5t+IaViKJAi`a)JIx|c)gZ0TNjzU2;_ODPMtW=BOs}S#M)AY` zWJOiY%PTg1cYpShvnD_i-(Q;c?tvNZ<&2Zqsfnokvwzfjc3}UEkKU^^Tb)Z21k`FY zio#pBgV-bj0i#2^Iy)(&sE7L+JSwc~rneTWBlH_2C1hBP1O^ju<{XWPh=uv=J|l$y zGG1^DZyu%uPF97i%1%0N3U&U601y&r*tl%r#Ak=7HqSqhyy%pixe%*ws%eZU0JAB= zuEMy@*MEB#+jZ`Q!GZb>%U+u|d7Lli`3I6+JBXE6RWu|3lt8v6@WZQp_TP?d;MAQk zETqfEWeZ=M{(S3KRc#1KLlc=00L<$%el{lTD~{ZBE#XFOAP{sXOz0W8`S(kvj~Py> zuYS%?M?qx=%Sy+>6Udbo9)bXPIHU2SsoUP7D1SQ>oOpSzwibZpJ^@#9Bcc*~_fLgm_ z=YRggn|AIsmYMFn+dn?${iSKY8b6{n;Zf&>1OP-lmwkQhXS=^Sd4ch!m^45VUz{*{ z&C!%q9|C*jzQEllJ6~1!uORr2Gry}O=)Q|wcIsf6@<^4xbzdCjN zoy+To1k#D>yO;0mknJgt#M!#XkPnMI5`U2Y1CfjyH44}Dw*UYDC3HntbYx+4WjbSW zWnpw>05UK#F)cANEip1wF*rIhGCDFgD=;uRFfgzIxCHppnGBGVNGA%JOR53U@GBP?cHY+eNIxsN7TmZQM0038dR9JLUVRs;Ka&Km7Y+Yp_ zba`-PAZc)PV*mhnoa6Eg2ys>@D9TUE%t_@^00ScnE@KN5BNI!L6ay0=M1VBIWCJ6! qR3OXP)X2ol#2my2%YaCrN-hBE7ZG&wLN%2D0000_ diff --git a/frontend/public/apple-touch-icon-precomposed.png b/frontend/public/apple-touch-icon-precomposed.png index e221217d8be135ccc2e0d56e127d67915f167281..9928a3e8d3671dbae264062bb6084071206389a9 100644 GIT binary patch literal 12531 zcmb`u1yo$!k}yhw1lI%!E&+nOOK=D@5$!|Bt4zL=C)86jTzL^+CiM|u(6en z#u_3{r^^rG0y)V*t*jNjT%ej>s#@k=w&ubRI!OskF;5YIfISojrt!45b8r>$6sP-( zt_bk`;WZ~6&0i=mTX8x)kUEWwqYIRVpM#%+i%tTQM$83bA@W96{vU&ZCviF}7|cn8 zlheb)gTsTD!_mc(lUrC=n3Ic#lZS^Lz+iWUJHWu6><+H<4SYSvxw= zJkSK2Il95b>F5AB%|D1cSvkTSU9B9Q{yBw%>pyq^aD(%oU`}ohF3$fv5N2)huVww0 zF%OV`Lx*}=|1andkbgr5*!Mp#$P?`JKOuua|L^Gb_Wxz^t}r=wfD!*->VH}Ne@x)2 z1$TmSzJa3e>?8W+hI?EyVTTAiCC& ze*-+M)z0nVu(cf?mc{e0F?#=kiPH)4aQ>%>^#4cD!=Z?%TYEz7^kl8=p$@J9)qkzy zUr_!34Jz}%0Zl-6fNlOg8*ro|086Yb;Id#C@Ro;*ho7B`o1L3Wi(5#9i&unKkey3F zgzN9E{)G)_3Iq%T|9{~>$UBV~FaiV;QM7i2Il93AdiA#wXhNO;e){{-&iXIur=j^v z21LN-4-6Bhb8>NnxS2yCfAI_;_czql(E{cHc7aM+0>>{-CuLz_4X_qYqyC^ZG(0ps zfXWK~*C8HOP=MV3zB$f+ERFL)A^&4-Vx0fBda=I{{*wj+#8c%y9d1d(IpLVsI5$af}6Olt1 zK7QfuD;rF;^eebL_Htwd)%59Tn5|6*w!ZsTsS}~to5EfJ_8K~yP~2EJsL#A^-b_0X zCs~O5m{G&>ICkjQz>(EYNm0SWGOzBCB*uoVNmxH=N=iyrN%PX{su{PWB5jESlVbe{ zeUZANkSA^(0~j$FY9+t0yA0Ytc)c+olpr|ZTMuj(d>tcl^F?UoDBp~ikP6MCxm@x% zGPhMvEyWrP7q;KlGQO{m@e1cmOioU$*0#VR2FqitSf&w#VvKdXyU5zXMO5ah_$`b2 z$Cv!tS;fKp%$7i-6s@Xp`bM15*6{b|sHdot_pQFwtG>;uZYJm~)b`ialtlvBb>MmG zCpAW5D8tBUmai{oeYgCHd~?54?@J+`rx|~&+7d|nCUe@Hojh0jD{ecwXJwt#W;1IA zvk6Oe*l$Rm{q#)_ip@{?nYBeCmRWJUueja`YsP71vGpcGP%XXf%6fQrlV{HkhVCAD z|5?jGV0d?*?9K45Rfyr5>ql3z_m2IH7!ZE)PIlJmOH&(z*1053i0Y6;Ik_icpVyV3^+ zWyN>zt2*r}C_aNG#`f#*u_C)x(LxMHXU&A2eLvp)@Yge|(Tg@@wdr@!`}mZ%uO{bv zmy3nSYXgG0oG0Ep!% z_8M>W0&AFGvPl_ye43c`AILBMPtepI&QU)yKBf(xWspYi99X%UO=(u8+~&i^#y)lI zxS2P*(+lLld^~&bV*{2egka{t!*#?@?TJC`%Q-j1?W;mkDQQ_X9}9B9kc~7)C)nOH zhNP%wF|I+@2r9#w>tTV0BH<~ovo>7@-Y>1@=>-}iMRbHTHlcacJ-6hF>L6)f!O5y? z`Y9k9U-J2JA|x0eT?y@x8OxhtS%^{QRc^MeFpNDc5j6Z>l!%;(pIh1m_U_jOmzQc6 z;rX6kUk%Fk;T7&ty0Lk zc&#V2(qOPO#dB1~(zF-kF=nJ*$0omcx_A2Ho=C@QP;iKSI{R3r7gN@N(J1(C)rl6u zd&S`ty1k$Rx0M;r&Wneb5y^US@GQb3COXmIGTMieE04I+IEA!d*t|s-_||SP`L2Wf zRgLf~w#s*#Ke%93DiJVPpq@WT0)pf{jv;Moly3pa$HetI4ELDK%9=BjRGk%!Y14DG zSbKM3al*}Te8PzFpq`a>GUgtWC3&;DmPUv*&G2rNd{ zHV~xt2Qkb$c+0ksNh>nrl2jrB#!aGIYeIStPJdH*1;HSDG9=&FrPOE{$Skv>j`{|J zbsgHD6}@_6xA2kx&Ji3NyN?TLOfR>^IyiYAs(NU7vQv*YxjIV7M>9_WtWBfBg8Xid z*v{dQKb5v0Ct%fSrP#Xr0B5<_0dg@QWhR3lO>uAJbQq0muHL_2b2sVSm#vvCob{39 zCqHP@9Ss$zn6A{YeFaEyHQA;qOUbg)ejq<=eYL&(52)(8^$^ zZb~C~+_l}Ui-_MH)rTU>+Q}(*Kglu?JzR_fFO~r5KUs9w&x%Y0u_%|T6^KO7{AH6 zi$#A6a4N^WpUP)anbm^-6V238m*+Iustlr_SEwNo`IU~{O!K1~H~ZkXQ_J6M^eP)e z?Y?VHHQ<5<$Gn$4Agc*4Dlks7@vC^%<@Xa2C_D3ssso`?c1JAqn=$y?^|Fj2(TRgT zG=xR37$uZ!%z~{jpaZu^bTfY;)i8eaY@)4 zB~=UHgM{ozI1^g&cl53Kha=>&UYrRZ)E1jUXSqgP^(%Xs!$%)6HgeLu6ri}nkI!K{ zIm3jc;^-C-$_&R*>}S?{v+2HmI}*_$x4(hVDp`ye+%~J|O8cPjc}qn3FkqUr5tasn zV2dXW9_l!dZrLQ-(Mg-tCBYyRN;TPaVv%fiV7~w#DV|Xbp3!h<^W~e$K;lXj_^ybJ z03x!3#Bc&3$({;6*%3xlYZ*S84eAVQAko@S?Ej(!!cHLFrYFyot(>i>C-zuVa2Bc% z7H0_c*3dkL?&d4&jFhUsI1~M|`mIDJp2WJ)l$1gK$(HB|qfGuEqTNFttbhpo6>Rpf zl!&gJBwFOlXrIC@@ zyT5ppx;dyUFZO8T&4a9F`9h5sCX%vu3kp%{RRp(xlE!5yYdO}1z4B#^=rH;nl56Lx zUg5<$ddJbtkSJ%Fb-NPqWZM(4}FwWETtSeE-Ld$LpB1BA^(u7AJR}7Frqy zlC^Z1ZOhaCSo^IFln>{`;%88+=W&aX zQO06YC9RP#$WxHf-1u~8UR(;P6sRj4&yA?SK+1E{LTu%2u%Vd$KJK)7g$r-;R%azE zgyp3a7A=8sJ((I*T$*EwZiI%C%yM~VUd26=i735}HnXXU^w*fus!a12M)~mHMtLrS z0`0{$rmpob<*O2(hNvq)NkD9d|2BN9Q`kgESoOom7*uZkEW&q1r-KVNAsf|ufEAS{ zs$y53YRCxhDY?TjqEAxAr+yt54#M9*%mK(XO@3g;D%~co3w#!wGL27tAY&r0(EveV zhlIb95j{BBL6x^e2DE3)HT-x;Q}(*?XE)<0{|C`y8Gcy0oml(DdIE#|6<~k!O5E7* z<}4VxjE~kZ^%*BB6GyRndcP+0GYT5<1l93U#uoHTsVm*s2wf)hy?AF~QFR8Qy>@7JTiviMJe& zbRX=>VL;h0v+vf_2-7m%VVPU%0(1yiCTb*ndc)0U|5VL&dg_e1GHQ5tBbBqMvn4mb z7veaK7LsiXXxg^q74gA|4WRhneOJ!XUNZ_P2}lS}p7AMhB*;%|alziK$@DW)8$Avr z{#Z7n?gT?4754ba=E7;ZLLa<*@NM_9zsxW3gRRc8yRan+hZ5noT_Sz{&{CozPL{23 zj&Bm#p%`d=j?#jh_th{o9LMm*m`8G_6SWOXKq4r2vvNy#(h!BbA$fuurn%7n4$2A0 zI<^{gWmK4wl1aen87STV>8BUr_T*DXoBqGqQm0Eh*I_p+4HWL~c6-aaCU;NocMn^8 zwz1L+>gVZgK!ZFk2V4Q6?lAs-2ypv*bHs;(VwGRyO<_GJ9cT9g3$q1Vn$MCjp+48a zcUTG@)Yr3@`LaouOA0r=0HKvuAAi9S@ zw)(9NA5tP*3{{`Fr{XBZ$L5b^HI(LBi`Z}|Fs4F1VS(c$jY3X)d2G{kCIyS0+- zoVHT)hE!>Hm8irmoAk50`U^`L^4FO-1Zd9wHP}!ZX`s0$aGDGkK0WuH5#*jMwt>LR>1{QF9Mg~)lVtb1y zgqts3HfJsMe2>{*$@Z@K4orHIMV&Mr&hTv0R}+%_Zb|va;n#+oG!W&!n9GvtqUSxA zq~9e@sC-Z2Kr~xnRtN)aFJ`ij9&qZo|` zn9-bKeHe&ecl~i%z)9e^+a*tW%5@~CL{ANlEoQ{PG_S8g3{wJWrLg% z3+6_Fvae!Kf8@`B&86(lHu&)`T^^SSIo+`JYI%*?|BOfXYWP;% z*z{aYu6dUI=dPgT`OBKZZ4Dk3gC{Zy(|oQ2$tiNFA~@+3goO6Sw8Fxo9%70f}DP=!uj56eGe4`Q8bl| zllk=(dH_hHfElaOa@xX%wWI0xyx`?Ft0Rw?Kt;i*mj>!LA;1^X#V>H|0IXYwiAA(p zxo}>@dxtwT<#FAOlq*)PfZ8Gg_V3Yv^F47v)3VboM^uF$*jQ7tHr#T=CMsBF6g&7? ze%x)*=bmfnW>HPpWk;+KW}!hh6|v#fax`ELoCxktF>A%FL*{qb%zlZr;|A}a<|emg zW_t4kHj5T-4dX(5!n+2YqN)9M1H^m8e!p^OtR8mOCJ6{9>K9)TE8qF{p6Vhe;OD^@*Po9W9mR0k+0PEo!OOrZh z(MEMXqs^mUSD&>;NqsHuT7ij^Gfw~bu*2EtrA>XFNM}|6{_VEsVwSa)iSPp_H6Hu? z9?El_H?tL#{zki%X_|DviFE@fb~;?{dODZmxsjH4e2`7#a~hHa2*g0ndoq>OV}RyP zG$HSgPm7QIF8Zgp_O?yp)4Oue-zpM*q7*IIn~4@R{LXgGp_adq_noZkWWaG>QpB8> zxSw}gTla`5^HK;8@!ej^OouUlC!n#I!rD8wI!yH+o^e5V4}VIj>q0tvojrvMN^HKan5JbKcWExecPW2*}a;S zI~{lulfH6EV!R6QB9b^++<|0R;t!Jd;k?w3&Gd6O+fXU7udZL1hDNg)Zk<1A=`ah?`Oyu=|)j4UlB7{rOqpyg*F!M%>;Ci*O`ZDF2)xoF#2B=_CzvTfTo3E zH*ELkqW3jc8Ss<`X)J6$C*nw5dd!ti_8SBd68^mUQ#~TUDp65hX7Yo<22JHL_GUwa za6*Lh&JEP>cy30F1Z&K9e9KE+vNk2JKcf|mq-7m_(LE(sf-_;p~EdO5e5nO)it zh}<)LBzS)zQ~C#&gZYzwc^0%Ws4se7t8_LRv1^iHhBjx*a5c4_2%~)tLW!o1i% zAYT>bZ1EX?pMi&p)zD-wu5IhFiv5wjv1^GhZc!PA;$mlvh?w4Ic@6Qq{&6f0WJiWS(Rp@3pW_h71;*8D#iF3o=qB4j1-f0f9fPIE9V_MZ3^~;|#sCh- zigTmq=`H;i-tX5N@0R-gZ~O9ryViVT?$%gPO|l`?HL3Kd(E~4j=&8=yn|E2LEj#iy zwR>&PikRoRL-Q;E-*HB~MJ|)Xic|z}&wo?-P+s1-&Dg)z5IbE-*u2=licCsrOtjzC zJ)OxgIz1WmCDQkEa}PvDRx;E7AicLUn6eM4)V~Uoho9{uGgqq6C8tc{iSD^e+*X9u z`)}sqp%BobfZQg1R%UzZoW6$j>v~~TQk~*{!}WjPV2}41$0&lK$xx(iIsAOf=kx^- zj&XRgPS5<%zQS#msygJ6Czvy|ZWy{&P(1+-y8~bpl5uThjJOY{_Oo^P^+rY;fuEmG ztgkOdPI7xEb{3A&(KI-{k0%M49#a;h`>10{U3w}+AL2H|1+>$NFmN*U&tc6KvH0evU`=$$?n ziR%ga5*z!b!c7lhO0nv5Kd&dD@RhGigvtYDZG%n5$*fvR`tw()?o18DL2X2bJWe;1 zZ;0qMnc~VuzTfk&0^yLOD@kNLYbK)v%rdPaotz+7E^&+;d&2hCo z=;lWC%w~neJ2+t6c(N1u<+dm-JNMWoU-u7_ILBwXr$>uR`gZ zI6*T%o_XOltJ*F1O=x@xQP>D#8and0KQVt`3xtW!he}XX;9J*jvNu8TE?Sss+Pa`) z%kT_jB{@jaG?s!|dV2FbdFE+|CG~s<5gtNj#6Nekj*1qA{X@0SRc~|E#Pr5lS32Wi zW|cSc$Lgn+9PS+HkgW+nwCGk_+`{?;VhgM16?d$#)_Za~1PSqilEmDS++o`i!FE00 z1lMr!j46eME*0AgT?fyrw<(lq^TAC4Isx!N&fV(=?@68uc zSh`-G*FT(B!?iR@of|fnd=@)W`nWRTW}KA!?5BO7kWqY$C5|tG!~j3MX&MV&sQJdu z;!vok{khHV+vvMo$K(vS3q&=hWK+uwS$BK!+<=h&_Vjcj6o}^&GLXv%b`SYT-pL&e zghgkrr!HM@$HO;llO?7i4XPBT% zfuNsTZ+0y8Ym4~HzQ@2Z=5!Ikyy`7kTWQKnq+)kN{29Wng8IXSooHn)>**#bh+n5s z6QcpFzbUJ3uMo z!Vz1^o9!c2$yVgs$)akM`;97x0WXKe6d+SLzC#m6s^b^8E%Y~sj=q_`3Tm8iNJd_D z1#VeSy6zWIryFc!ncQhPOQ~#+8ABE+8yBI&R}-U)1O7KRyd_o{OEoukit(nyrGsLB zei*sx5DmSwn%&?E8++OmZpH<(p$=kNq~{lY>qMd~Gp?fMd*lJ|V3E)5>2|Zq`E~1y zF<0)gm83Ym)x>;e7-AVA!<5L!@4*Y)EajWjzi zY)NUoSas!_)LxosA7HnN@t11mWKhbpL2v|qV2$KKbrZRE2E>48*4MAwPsPzv!HaX4 zmEL9BhSQS6xISA@UUl4abHw@XYF@IAeKu;A8SCn_ueUoviII-`cQO(kdf7tM9`oKz zO5z|s^`3nHT6C>7NOV~Ij%M<7CUKZVKYj)Xmn82d60|}r{cnVqC{z2*shrrg-b(|i z#4LyTAiza_3hg(XcCm1{9N7i3d)&_JY~t4@?9BX0Ly*fZTSxz8&s&(y!TsH7YsLLc zvZ(Zc>6DWq99<+%C40k#w=rkU@XpomQwE%HWlCBlPge4Rr3w;| zcKDygyU|8z#f#@Ubo_Rv3;If){XsLVsib1Z9O0t@q83}fE+7nLMv^h(y%9K~>bYoF zj}Ji*H<={6|4j0WtMtz-UZ#na}%v z#L8Gs9mk2D&gYQJXz?YVGt~(00EkIPJCL+`{D{NSC zO^#|ZGMix4Nh%p@Y$7b_LLb|ghE>GcJvV`~&0(%_Xwbj;{XVk3ZcOx5&AYyz!t4qh z2|WFRI1#0Sv?|vcwfj=o9i}HcmvWMR{HF`?vITG)U~iqe<3jWsyMCB}#1_E$4^CJB z-6sR`-ipIto7`z52iFfIR>K+Oh4?n@y`i5X%avbl?PY@fKZXfpUt z$0^lAsN{7OHj0V<#Wgh5jxIFOsA=L;EVN1c10Uk{BFCNRb~yp_@!9@_y*IuIXnbO3 z*}zS@dIeKQy~PZ9@LWP_T%5Y=8H-P-dv@n41_$iy*CY*M^UaLvN8*vbYIc}W`IcbcK{rzabX94ombYmFMul#tM}*7e(3&7KbA%;V8A z+*E&?aP&tvaWlUo7ni1)r>v9yq*XF2f2|;)aMtZTuyUmQtIQ2ydOxc9mL~zRKxRxfySRD6F^&mQN zMSUH^N@2lQzn%_sr547ox=oz%u?zr1^XXjsL3Z7Scy#I%96tOYAs^buXRM@$VqJi^ z6ck?M_#L;YSbk8GKY}l~$~Rucrk{aH)~r7Si=031=Yn-N4sp30l#_Kv94)d|4rCam z>QBz`?G7!T$*y7GQiy_f7{$dm%!bhIw=6!*zwtDnWdOMTuw{Q=1C1UKI@oLDY9DW{ z%wDSI8O_En)$j@yzRh+PxX1YIxfrOx`s}0cOWaC?^Pt(}mwf-9CE~qnr$-`CcRsH| z=lR%E#ZNC3o{)-E$Jp6bTA2)l&ap^bEsK8)JF(SvzmjGWN0vdowEX#1eu|u2)X+6IMWLshiEC87)0X#%(~Hy?a_VX5ZY@c;)pP-+@B&BvU@+-WNd8b9mB3+kfwwoM!(g02S>f6^LoF_WdTHCdY*=f?5#2LTx$5BOv}+gvaM*wx!9NjH}< z2aupZWwnr4^oi=xa#zl~xedAqAmYSVtQ2z{T*Es6Hvc=S2+LFuzC3D_Yr1iMFJ!olZ#8+ zL;MdtSS?XaVbiwBPl43>sm$AmiRTuu>iVX-{vt(CRBZU>;eK!|P{#P;H{Wq#o0|A) zU|Ot}AzLU-=yn~bKptsLWaq6G^v>Y)3^V9wH~AvF%~R7gnIQwzp62i3y_BMjeHwD1 zjyGFaDyPriwgDro6+4XceSS`K<&@im143qf z=bI<%ZbiM=cO8K~_a`=j~ib6~$3ep7ViAio%h_7gfT z6a+TRj#y=zI*~=kNS%-5#g_+l|LkURe0%$XA>6d%^>gpfE-bQM`2cw47CfPmL$eO&D%JVrv+RR*+}`wP2cdHMMJ&A#OQ`^A72RJGoe zq^z^Fh(r((kip!5aat$1(xM2|;#p>;*|C{rP_=TrQFF9REv(;|=iIfTX@V zl=T3vLR0>dF#BE7RJRC_rRhINPc1COOz16$Qpgb;{Yau&HNMxT2kfMD6$r4e8Mv1F}4}t$eYkS!~M+8Yjh$8T*%hXIG6k zXSM!6*NdCw$S-wb33N0ufM`Et)rr7HpI6(v0`{57#0K#2MpW44&qBQ&X0%!5#GajL zx$R|fk}*-HB6XNLK|VU(E^p2}O=hBM;XF(Ux7C0o19za4KE9FQ&mtCmZMkVTY-9$d zb_Y$sYMkz%iI4-SiDE~}Wdq3zVWZ}*bQ2-TerKF|m3TWlLfwLPip`oIB*G>tYWrOe zC06IJ!Yr53Cj*f|49Y@HQWIJ}Mbl}a;8zUKH(fj=C1O%HLQ~*_M)g46AcAhKeBN1v zqAm?L4Odh^PU`J)gVNyo#b9geuwd&sVLqo%xrZV*v)%|PnhlS`>xJXW$+a9Vcw( z8lZ6VSi)x-GL{#F%^5t8oD$+TnJ|n_@;hZ5ZapGel<-W;9zD)cA*_4WMZovDQFj(Q zdF!(<`HOrr*ZR19++ZzFa^1*X?vV*L8@ks(CIq=>(QI!FV?sX#Y*ERQyOxmFFw)!W zn&dpU?`4PNB+sA#${A08+lkf)bV>l71g9yg%di>il46V9hRKC$C?)w+ zNmgO$^ZX9ukD`S|8(UPQs}uG8d!p_sGCjj%v*WE0=?n{J6nhE2_#9JLxD#4?U4QZM zbj@aIUiR%2R)7!l1P5T#ufFYF$)p z0kuUonEqyQ+Mo?w+nb2b3tZS}3f)3}e+a|WGS+-71=A6}QBi7yF-(yHnC22}Ia!t& zk7<>EMo`YK0FJy9Y6o!jIfdB*cXfHauf_gh7?&40&`v@OGz5^x#D;%JNFk-=myiV- zU^o&4x{57Es~5Bu;b7@Fh5%5-3T*D!TO6f{YR8sk+sYBFZA(9R#;+ABbJ3iUT+b*B zqEA!=%1Tmd_go~64Z`q6F%EvRaDop^ieGs(Q@Lx)sFw-RujCoJLhU^0<|% z&WBb*?s4!!B_(lxa&|{6v8kL@B;gt|FHH%veFa5w^w8fgLSKsOe5}z^H6%}8VU$5; z*DzpvQcA+Bm)MchS+{NaiuJX@Lhk@^IyhRmE3tt6K-PiL;-~ph%?q1I(Qt!svJGyf zMZ%h{eFz7w8gJRk9Dw8Sn$8`yvi^_1X*4;91fx$+Egq!cY6lTv{##L5fA hSYTSZmc)C!6NzyYGrlg#hyPVjl2er}l{O9he*i#v%R2x7 literal 7140 zcmZ`eWmr^E(@WPPsdNiS!;;dnG!jzE(%s#Shzlq!DV-{?NGu>7i-gpIEU~20Al?1# z`#s;E@5lSxbMHK7&YU@O@0~MeB3@5Njg*+47ytl}YN#vgV<7xLHz7XeDL0A_!T?;y z7uqiXfVyOoTWdT_pVd}fUmE}j;Q|1nVgP_^3@U010Pq(E0CubZ0O@Q1fW|AY^_47U z0N+MSO&Rd;pR1_j%O?zmz)wS4gv^Bp6zD&x>L^Pi9BEnxcJA)zosmG0ihZhR;U zQwl>xy>rfbJi@1ngma%R!X3x%R!I%h?Keh!95(U~Hc##;K#ohxqW7}TPx5>VIGotZ z(oGa2t%80#k|Q6hyM8-3Ji=}4_ON2At>12VMfhrhQj%uWnZJAlj|-a&E7+y*Q}Qqm z4l~{pLbhKv9U3p8nfm8A4ge}c1w0nrdh*L}>BnUHzhZuy2mNA(Xy#yr zDT#&tSuOoM+O5u}j2aS@`c_kFhMd0b~>$d>#{!utofWSyA)EFoQzlVSgHLC6)81_)DGUzNAZS- zxurayWY1<|8OJM)H&<;xZFXKG>M%0QWjR6m1_s2!(KLlBnO$hs_{Q%ga-m)EABQ7Nr`tjOnzHLCJv0GTE83-vB^02_jM z>fM;?U4&v>0COX4B_A6Q3Ry&eg#D&8j_l|0-gN7l$e1{#ndmPymTjO3Ez7z(g3kBm2I-~TShlM1OL^B@Pj$Nmey+b2pgd!3};>tCt!xJFT25il33KKvS{iic9toI`tx)hK?(-$){h;}6Dd32bQ<@$sdgFF7H^ zrjbpUzU%!F>U~N|I(W@N%jZC8B0{w@Y&7glm)1a(aLINZ7fL>qQ;CApd3!pY=uxDS zMSN(nr%(qs=4GmEIfZkRUycFcc}o}y?ZG2AC(PgY)3x|<;URc8G6(sBMESP|In!iz zs>D^HI!6AUqw$h_Z;Rc5Z`nV@;OUgU!|dz_i?OoxRra1Wc&sgQ><#3pi&Uv70qNDO z1!l_Mik@g<$C#ozdK1f}YTg&d{}h>*o}dgYnZ-j%*g+&j38DC~gABrnYGSV>u6>|@ zHkB`evG-t+tdRh+Q4zvk5`M5n?LTuu9{i4C+q~rW%o78rNwHFroJ!3U`(5Ecp+uc; zSu`p%;*GdGEx1Av^zKOi0`0w@8JNwN?P{6)xrNi>UjL+&is7zCbr(deFAaZlz+E1L zewQ7p@N@RIYa%}X^OHA!a`Uvk7DS!Eod-h&(ltPLw`{e`#kS&os}qlOizs<7AHSUz zM3k{5DR&~_@rr7Ke}jm`$oopU(KhQg#^@~hWO-yLRiC%5lkI$H49y}C#aXxf^f^QL z3iYYya?;@T%tmBWxidSNd;jG>m4q`-C9tR_?-zeAsXvcT3s%u$&}l9~p!@zq^kMY3 zL9mEN4z)CzZnL!T!51#7%4b=~pGfF%M46CW(9M7UY~yA8;I`V~=Q$^)aYK4tt-rzG z;mYushl`LA^M`~ze2ttf!~whT-`KcxM${ih7Sla8cD@3{o2#%9k}q%%TOx}yY4(m! zJ6;f6T?Po0A+9}8p}&&G) z_{?Fyg2?vHEkV4&#)Xe~j7!SC zvIdVG*(R;3@&{QoSJHBvOx{<5og^T}Y;Uz3*pFk;uC&gq^|vN=_M+S#hW#}VMJ?Ov zocH{9y%wc#9bCZ(dV#xA8FrUy@7TYR^CFV7GC_)Kr(lH(?l`M@mn#^QkW0;Wq^`Mc zc|nTor1p+K)ur8bYt)m2%(G!hQCE@0p9P}Bg5k*|@P+L9>&<;*OE>oMp~T3jXH}+$ zf-wpkf^G6Tsm{5xqq{9pg+*AS@l*oLB0LnpJ3cGMVzODIjVKU?x7^s;BUVZWjFDLFP+TBPnJSTH+cFqf}RAxqkP9UyCn#Xd*$U`&z5E#g(Yur`csY z)4QX1RIU(>ZV`|sQ{!WVL7G7D-if#|gn*?G-^bF7GPCGiEky2(u}Uc8DCF67l!mu> zz`Zm(4^DXZQ+E5^YH?wX>>J}^vihuH<0pl=G?!XDsgGrfia{ZLh;2mT6JlM>*8=7| z^~Jo`3)R#vS(Is@lJQZzwmx%rCzitRtJfm%qZ}p8#?#5}TB~6W(oQpq=eckcm7bED-?JLHq#o;bwypP?PMT5V(hDVR?2!Pw zkI~)rQXMdh2smks3IX5PI3EX6sIYuf~cCU zOy>vRYZZ?Zc_W~+RDWifArjN9u4IZ|@ykMaFMcqy2_vlSz!@%_B7da7!@oLc88)n_ z?>Jjg@@C29d*|{3s)K-rGRZ+V^8JwWBoMr1m!tPUA!?zSc)5>QL|k|=s~(4d4$W_( za+z;|4y&*|2moe zv4&cQM}$ejaKcvK&!~Z5DFib3om)O~ZPgdVXzc`BaZ_F*M}fj*qd0&9`X_{WcYvpr z-`iJLJussH*fI*Y^W-Uf_|^X|+>cZuDNPSY8HMya z-M5_}R%ILRQqH7dV=%AX;WK>4ZyMWjg0q%tbL;A1hA>wXXGlO(cGHMyS(K zs>H6L^Rmd(8mq@@{yh)nZ{+wLk;9SNpiftlzv(J3ct%{zXU0J2aIT--?`|s642USR zyuiK(oly8Rh|U{+$y~&N4M+i(k?u)VKmpFFX-Pc;&%L7S9dw9&uAEBjy=JH6($N4C z_P&cupQy9g6pM#*a>oQMFYv*0%UF?lA*SUn90mGIxr`J@sOICYUlUnN&95x)m}V(1?S~t$X2wXNt*? z31UW-1ULBG2MzjbH1MsTMC&?yH_mG z85ubEi?x_EYpZ~GhOU*h>)pC5XRZ5q1Z%6~E4wF^nFm3*dS+QK^R2^QEguAfR+V#m^1g=c0^1AAwvPD0W}d$}*>RXYLrj{M{Ob~c;D)wF)bB+E0Z89~ z-?9s%OOK7jC#*;Yiq2XM{RxvQdXTev84g$1eO6HgcuYpa^3Yx2q6l~HSj(P(WmnrN zVE+6cj^fh_O4=K#k`*`1x1-cnG_l3btuhd39@5l33EkRANku1hE)w%wTACOP{311d zcogmL*R{X)Adw~St$7QYeiF<-y_s&Axz=9{MBp`cAq zE&gVc`VhHh-PV7z{G}L8^`0Zya$Nk-63SC=LjW?Yl7>G^#b4`590Z%9Z}X_A-arbp z-xZrmoE8-<4yrfEH4+F<2ZEfCWch4zcPe?q(`(ah_fo2W!U0MRihBO`DJXpAwjPurr`FR9z zaS&WIhIQaB-EVSFO`$MnDqZom(>qT^y8zcu2P9fSj*-m%5*6(P=g-Pw-+>rc^uZ)- zKfL<%uv`7F_@+JWe_q2fzXxKoi<6~JG@`oHsA@a7-d~WtDTHIw%7n$i8pYk;@{y7X zyLc(I1~x6pU{qH0W-*dE*UlR+72l45sRHg5DgV=dC^MG9#QB?<)ZdpGx|=aSrjdA8 zOtdl!7O00VLGz(a)2442*?h;pOt`7>l@QGuWc4k`eypeeu*qf$|I+JvEF|DG-8 zyXQQY!xRcpp>FVoe zeE3>LPHM{OjtO_=_$1cXVVSuSEX9NIbGp}#O1GC6ucJAm5@iBThD{<%itDcAN?JCl zUO#qB?|%5V^Go5;#_UeMFX(s6)h};c#(K7M<)B{V`~2g}W+Ix>x$3afjlX0$cl!#t zcX!9?b*>*!TiEilQw7T&LVdMYW70>xzI5_P6IaR3ByJ$7@Y$qD)6C;3NodgRh3}ir znw*xUvX}gx-3D=7R*vo?-=Vif{#dyy>LS(QNoE@5l$!a8BS$vLaJ`Y%1^2d4R`LcFVW?5t#6milG zYjPp3?E3_*sjgYCh%K=G6I+P($o-txmk{dl_x!-TqJ26how8ChF6>&Y-%)6`z;8m? zFY#p26<-f+6<)aVYHVlb)78V7FR{!zPxzxI8)JbY@j-Ph>udP8(;b%w6<9^*Tg%%E z*ISQ!oAr;`G30Rxg1G(iNz;)fu%^#Z3J2rso&I;WAm4xx-sFXdj;awLv$$Ayiu__u z#Ju68&6_9-j49T2==|lm*$IADE#JjYsgI0ZAnXbF($%yr+V!-sZRU~P_eAkAHKHy0 z3-ibfTN>7U{WcdY*wBTbbTaAu$17Czl_I6J}x$y9!HR>$G`PR*V<=$fY?Hj81!E-sX;SXJH=n-;mjO#&=ipgLxBz?`a z0mI{~<)T_vAB39)?)#1TwH5oQ`O$^Lh}@8dMrnZxHhe_~7h>JJLjsY}dTCNjuuN|~ zLh2jOA1T;6H&tuwtRaUj1u44A#wiI=F zzqf>C-JMoXUdP?u^+?P)p`S1|&etFFGtW7}+TFIU5j6@t=T08MV+A_5tzQXbT<291 z7l5LHBSU{@E*5*!k4nv-d;3Vsx;mvUakk3OahjGU{nnWpQ4!~nZEPes(UL}2&V_+O z0{2E5$d-Ox`a*;M;vFgnO(P*$sd2Y#gW*+}Fyo7<;^5R9!?b}%!~crw6J(*&1kIrk80r`-^!5~4ZlkA zbYfU@a7-(hOv>@>1W$N4Qag+ckFBXKcYPKVN%uHpzo(VPZ~C`@uAnP)dXindg44RYf#2MuC85W_!7zkVW0syE7>)Xq&7#eVu zI6D03S!;I|GVIv-#@g$<5_9XBbPcUsniVoKSphE>ljM9PY|=>i-D~BLq9D|lLa6iX zHE(5Za|`Qpk+(dnY9|f3+%o%wHnAXGb)Ey9f>*FUEm~;LO<}|sLa3vsGSRYMY;LKc zh(n>v9yDVSCO;%GW|QC>@w6;`6Ce=!G@T3(s!4WSWpa{pHn#ljn`iA57aRG?2NKo8 zLwAF_c*>hRZcGKB+Zv_WuKA2{V=pqS*H&oUdNs*F$aXJnzJS0pZ;*`3j9Rj46_V|S z#ahmfw_xNjX;1z5U_JgJXTbCzQW?B;X)e}U;XN@Znj`Pdiy$~Z;?}S!eMy)aIfV=a zJis8SGvBH_S4Mxb9Ix@6%(i?7Mm;jwUJ$j%4t&{~_YbHLiU#geE46z~AzKu4TvU#F z(J-0p`$@M)uZ>O)-DkXeYI_P6YSH~`By7Ku?%Y4=3*vHpHGV8)h?=5EQg$lLseyc; zdGjph2XUuQYhrpmORYvDh^3Hri#ui(+tOr3C}tKoVgMT%7~t|v{!G^yaG#wHB70^8 zLk@nG@J94uQv;h~?YuGBH)oNu*7%m1 zIe;*%)7LQcz$UI6K9rcP)7xuR<4ajtI$gK%EuAup<175rCrXC-TUp$r8zgMJZ=RpU1qkJnME=NjqP|{-(L+rak`h z^B6n2Lh@IbRSil)UVhY$c|x{#hh^1D~A1+^DPl2=~6uH_B-uOLH z{k~aS^y3VG?2jWj?6Vr(;WJ@NLJHsFPftuWmf$D$0O9s+QQ9ryvajJf@{daCXGyCG zj3vS)h}a-y_lO6a@D5e5bXKYgrbfl-r}De>01Y~dii)dIJ?=i`UQL0 zvpReE*#ZDTd8@}jLT}?|&wl9+k7%sx18_J<1Z_#EIH~J_53|WU~ nrw02*`WX8NhNIMrGz9@WG!%ZvO5z!qB>);KI?6RlR?+_hnyjjF diff --git a/frontend/public/apple-touch-icon.png b/frontend/public/apple-touch-icon.png index 31a8bad5c448eefbbe60108a80e05640a0c60226..688313a830298353479519b40655403b441e3edc 100644 GIT binary patch literal 17314 zcmchvo8uEc!Ik#5FiAH;LhMqaCdiim%%Lz1cC<-?hqUT1Pc}*xclHv;O=~X z=bm%VJ?Fgl&s%TS8es40?%iEgU0wC5+C-};Nxw!TL4$*Xdo3#iRs()F{QaUJ0Y8Pt zkT~GrUN+mPYrAVJD)5^*Ik1?RJDFOrcsn=)bT~Lc5pQP`Gdl}+DpLz98%H6~NqZNF z%Env>r1f5rP0?Ax!rDg0*VW>Kuadf%ubmm6IY>kpP0*Vk7{I~8-Gs{9!QRo0-&+Xu z&$#@+-+ynjf~fv!;%+Ad(pFTVl5ldhpnA{po`nr0j7BBsYHrD|2A2A_&cKxr$lBfA znV*%_%gc+!i<8C4)rys!kB^U)jf0hggBfVS?B?U>ZsN`C=tlE*h<}X%ws13ZwQ+X0 zadM>kJEn=LlZU$y2n5in{%vq~8_WL~-O=semJcw3^)H2$orR6{|7>pIZSy}g|4aEV z&7G~C+@0L4ot*!D0srX{|4#ld9Rc?J_g%bAod3JVii-cw%^e*6(=y!LB|QN~{2NpM z)13bI1KiYooGn<@EZm$tT+J*bJuMvFY5w8FU%v3mI+$2lC|EdJxmyc?*m>FhFN&6p z`F|n&9m?M0uPihiZGeY!{6`<{|DXwhIN8`(+5dy4^WW3{vYTJU#@oVP8*JlX;phg8 z`yVs;530`pM3r!|cXIszD7OXB?Vrc}yEOR!p(#3<10>G>izF){q2lUfX=4x2+|;DS zsbnQ3xY_x*xtTdw{xu9BI)0$9jinFR#2skG!N&2PnT?&9olTvcm!F-3|2-!&8#h1O zzj*dfYhXv1o4A|&zqS9X*HnT)4@E_O85=iuCs&_;Zv9KyKUlc@>*`;Z_BQ`$ITh7E zvgS82`^$MDkh80kxrdpB`9I47hWi)Q&B@Z;%f!_}%nA^*5J=3@(gu)`50%Pa{iWid z;sCZL&wuXXWo-cr_dhR=_1~t(`gh~~@3{%G{+HPc{?p+9*r`Cjf87Ht0ANa3|J{}V z7yoXJEF1w7k1VD z*93x6zHS|Cyhh7lN~MxbP*S~66QZ-zzs!ikL!5o?3TWI2=uq-7LSdwIcxWUq=gx02 zS)@d6G7x+@f$-T%?rtGqF95;-Tmn*YBWiCx0IJPgsJfX}wI#8KtJWjFDp|k!!>q2=%Z*+TbwlB&;MX`C;;7YIxqK8pVAc)9d!7d+9S$>Z&fTmz5rQ%j#`S-!7>2=>RmTh~SBiu$y_D~GZnkCR@h z8m}S-%M^=RNd)Uff#_5RI3&Z5+|voOir2C-Z?3ZwLp*~{e2D+2E2{&$RtSfR3+o%I zlc%aktiX|uU(16W@bCPd;{I40emWk(l>1qArGZWG9tDgguGli?k~h-f_{_5N^x64@ zQVill(<6+g07GkMhP@DA73innK-u`y6&N%cc6?SOm~ytaD-v`W1mr5 z!|l{Fz^uf7R=vXpLz+oVLcD5z<5*$Az<4H&xfb@}hqd8YH*tP8dM7r<1k_Il^|VJ0 z@2uytPpS384a2X5P>v)~T4URVos*8O0x0phdo{{H{xCA}(dJ;gZU*rqpPRtN-^>e| zp`OgOnCo)pSeo8M-W0sSSe|I>QVkOJ6kay%4E()a<1fs*5!dvLan_@DLv}pzuA8vk z0kMmS_dhI;2#04NWBua&UVkDdXiF9@(h=+|Ar*oh-s05ORpCHyA~GB5xg0~)%PRcx z8wwe6B-UgM3h3!jXCtaljMnY9<1m*qA}_kWlr~HbP@Kc)>~#VkM#N(@z8EYR^%~+D zZ4L6e<1H2_kZ~d?YkJ&V6AOI^9mT{5{(Fc%(BWb@d!@tY;3dFf{&45FhEgbZKH+-U z5-1Cs5Bb@%UqJ-Pt1os#ScB0QF0AB~PnWp2%di^S=h3MMe5w&d#2|d}&U|<|DQ;Wb?^9BKTI z=sUgrL7^@YU#aUnSV7=NMo=V~FV60zOfv0RuN+4Tt=PlVckE~01cZcRL)O(AgP+*K z*E(yM-BysVU!G_q{&b-EO1h}LpkDF9f(^JqB-gIvHDz$>m}uUT#7rb^U=|=2TIZwK zQpIhcQw=k&8SBwOSGw(I*beaHeDUR-Oi7vTNBUjtotq+B7EQWb!b^kD^~KE@av?Qc zJYwz1v1}mMGteo^DM>+<>BINLH>f(Qst6{JwRj<5`VemtBc^E9&!Xtkz&-UKELj5O z=_ZA*n&gG5eWmG>?+|sjUyP|GXug%MQ0un+Ra;rYol!$TiVYLM{D$eD0I?$MI#F4@ z0qu=OPcs&bZ!q+Nx6Etnqdm}II>`g~ z?ZqRpGupa<)An*8V=^uA8!Xx+8QkLqNq=XN^(y!oVD&%i5F_A-Xj5UeNfOi{sj5|q%e(^_UTf!kll zSoTOJLpUv<#7m4hJGa8bD^x)OvG(`F1}JkIK}dlKGSHWlgR2jnN%(1^1*uzAyD}$! zA-4$~w}rzNtGCJP_uIM*p(0RmbjhAtc2W)d533jjNN2AIO)W46orl6Ub4EyRpjef$b?VBn^EpKs8u)VK0LukcL zqG7Hhc6N8-w47e)fyYcVP|JL&i>l{TtGMwCry%$%u4)Md0%P*Zdc+|0fi#_UGtwr* zsZns3IEuh&DaEra^)SbibxJ?1@5>DZ{XFm#+Z#SPFpF-QVA>}=rg+0V=Le3oPm42z z#nwz?W-}u)DdE7js9;QSPqc`jrGAHI%N9z4V$w*`!02P|witf3=J;fSTwvLOvrlda zxx_eZY@L+8mZs4C`3bkANan=(W$o<)Yd331wjg>0I3=7Q4vTV0`o3GX*Wk|$e!ZC< zQ6t*y9V%KgYihes&iN&??zW(1eZqpR@yrNlMgNBxu_CqoEGvcI2cCZXMv?HZcRwrM zT*`^jnlxde^&;AM;b{cx1HwBi1^-bA^`s$IU3=5NabmS}mDVH_vqQ7g7w0Y4c0jC%Wa zW4bBe!@OORM!d`oRW`CA?aV@ReoMHYYB7gj)>6FNR_CA0gGXM=`s?gEzXS&pZo7sU zzRU;zLSG{QXPom6r<6|c|f zx1?EqGO@%k<;ZuRn3Z-#;Z9IeVaKX5X|Pu^qm8@N#1r@y)!0``4zYk7xfPiTTR-!0 zWxcn(z}5D>NEW=I@0L?V#?ti7=jOQ=4V>}9Y0xuoKrl&r=B$aeQW%xN(WO!_-3zW6 zx7!#?Fq>xD88Q%&cR4CQP1WiTLkOhwi}XAt6!A&zdRowXb$z44sP*vS^{k59vkfZEonOX?vSyspoGqj zcUEYVpesU156eVc)}&Ml?TkveXgTRXvl!8G6T7Vi$sH4PMb{&Bb=S;$7cS^7mFI3@ zk#%}*d05n_Ib-CV?B{mZFx$$`D-g|K&sQymrPfG8=3p~3o*zTS38q;LDT*qgqD&C% zsh_WLm)U;4Mi{AUmS_J!O1!T8Or)x8F#ef0;GrFw>nQv4U9TG}Tu`+3E60Z~!;vx^ zx@>Y(&=ofS9bSwk3*-GU4R+(MiNRA9kuLumkH9n7;iX4OGHtXw$G9DRqVXbk)3Ni} zJxZFc!(m{fgNYV86)~+Db{mI_=cW7P^sFpDzVrtT`^92SC$?NYQ%m8&%f}b3{>f@Z za)o7Pt29&RAM-)BB7t!X63muLpT`5z89ORt&hjdnUxRiD0NJ@vEjr=hdXPhSPwU^YVGpUpI|I){3*1i*m#mXE@UKQ1g+xH zcLQ%=3KQ)7!UI>6E>ho1hIY>P?#!!8Ax)xy=B`$WJ)K)Qoz?RwPtGkz zeA@}58o`-#hJHx3Rl z4t~mE$yscVjVO9Svzh9DePtp1xFNXtp*~}$DLNdCZJ_7|+eS0h912*7iEx~={w&p? z?2sjyM;rTl12{1O{~@^w{>3m0wPlbqU%W#Wl4eE7WU1+lTxrkg_ooYz&_K!u&)26T zH!EusD?Vu}3cd!T^DbnW%-LsUe4TBV%x0;aH;qtX#lmKRF;e=(^XXn z)@OOv_6>@oL%K9b;Sh(}hkAtxW_x{MZZd*c+hBpaOn3SNScF9un&mz*spGhM~}7$PddLVukcDL zYYj$j=P@s@UH5Z!-A$)IUMCu{3BQkZNh|;8GG@ z6n`glS{-UEskdP)GP#; z2o@!sPF^%~&?_mgPRKbiS~nk>4+YfpNPDLw0%sKl|1|}D$1~!KXs#63F4u`l8Uc*u zXq4(>q2czysQr_D{oQGP(TXBYZoWRJr^`28Pp58@A!JcDz&oNJ-IhN zH&>}-E6rJ~tcII?6XU838WanM=NU=ZI(uGNngPIONmZm8yq6Lj>ccB)<7y+s0+_dQIJ*j|O5mFWcjS>JuU zFPtFG%4l^`lZ0CE3*dZn-C&c(e2r_ZXNmlSIkjSe&S;E_XzUR0fS_%gX;6pBz{-Yt zV(ALo(Qvwzn?s5b+sxK6WFdkqUo?0#>gMdC*=V~vhniy_!}Si7o7?WHe6#yjOhN(0 zo3Q00pNsF2p{B2dSi8$EH5k!=b@9t4SW`oMKaf8%5nIO70c43R@1&ZYo5vvlYA5nTscR=D%V~2{x)Gbl`f9{a$5@}nPTv3&s8C_C!zS%D+ zx6>zP7xRdk;j(M)>i6R3_Br zm2%w`1AMbArUSCCnyCj%ys>kg#_PX#nGFAYp2~JQ(b2NkLyCVCl&2wNh%*qY-ZBa6 z_3dM8MB%lrGRlUT7Dl&F_E{1&$+WscLe(HO|4m8CUPHRSh&0F$Jj{-m3B zv@kh6z`E-9S5!vVv$?J*fN|^eTehJ=Cl`N3Eb@c9eD-H3Hb_X|Y>=P3MT4v2*ABh* zH##|?cwfXpn|4Ys?Ur+5z+2R=Y}c@BvX~mO8eYE5EXvxo!6&Q*un?=XCZ-Wf%fRHI zhc(=%{n4m6E%hkmZ#I42BaX+H)Q^kZaeRy;V;~D3EU4G$} z(RImwHyNvLIjBGK_`33Z>KwVdiCiv?wzZdxnkAL$`=+gzIrk( z(@#@+u*?bu&IGN)8C^PC+7N;`M+V+Pox(P@2-SB8j!XjByW5*lJ{JRpUvO$)SHSwM zrm3-G&+p}>ef|s-zI;>;V3U_r_vt)>n%jFvrCFm~o%~*FDj|?n1vC1kde<|(dx>L{ z(vD%qefY6NijB0;B9X-l0J@{ z2%DH%K7~veK`pp6465K=$dDJ|rB%;L+M=T#&IUgm3PTbcrWtoiN0$r(SyE`RUm-!H z`?z%Zai=fB`@~Yt7=({uhtu|r+C%t&FWAR6{N=-~KS}&fK&p#!rcyZTAG`in9U5Qp z9bQuJILuNq$Z|~484bh8RsK*H1hm5=%ci_lj&BLPBvH-czZxJWY31`eYyREFmmtxp zz8ULO!f?w^OrC97we&*PBKC^&u!h`9@lRcNfi0NdSLQ?rNlwn)x4LJFbfzwq>)cC3 zA;Fr)UlDR-|BuCvQ`(t*_JKEN&5UAdC=qQYhUQ~$qf4|fx7<6G%JQQFy z&!r;iUAwkY`b?pdWv)YT8N)Hz0dZV%2s6_w7=#7tu*!;GAxD%hr|g_x?nOd&Y5SS7rfh*yyAltH;mERRdjbu%UjmlG3jRg;gZpKkU{vyR&;K&x0S8ayiEP%VcPkSgcGyVM;H?mvRyl~ z?B-%XqBD6aX$s~D`w|(^nEsx!XhGl>FFLGGK$1C%HeUuuOi@4GBi6MqPgffx;+y<< zJhImqUs+!qoq52cOuk9)lw-P^u(F+GTsgT`5j)3wF-f?Ew&*GP8j_iS2|#GGX*^Z_ zR*w+L^`^3A?P!aJQf39!PsB8>yLXkZshy-ne7&NdM>v2JY2>XlJ8oNS!nzqPPwgnF z@YjM3^g)$BVgSauUKMx{JKa$JhP|H-3i`YtR$7nAj3t$V|09*B#l zrIN)u8zK8~TT6zlQ|)s7ov27)u7AGf{VH7w?LDd2_09ROvdzb>vGn;aKddh0Z$(fG zc0SID5+fr^?)H}DwqC6QsyJ9%+~f~0`e1E5;j783*Ff}9^ajmL3)S-)N5QjJV?y=} z5psR(S|5ioaCSH!sYJETjrxl6P14>{N=AAzfOSNPOhywV0NUdo)g!|Yf@Mn;zM*7} zM%xa#JT`H;B+Cs9h(_>>M{%J0-a=8dVr{y>je`S( zIW)v(&oD7VK9`L2L~=`OY0Uh*+sGR7C?Eg};`d8tWz{cQnTI~PWnDKBPB!vRocB%raYO{LwKU}PydnQ#W85a;681tzEJfqeHD^A-1n|$jJ0CClF=31C?C*T;>T9s02sH)ILgGJYeL}OrUvN@Cr7sr(@ zt`Ru#mgthn(b6=pE-iT*ya?No?;%p+BZ2jsym%w{owqwAT@SZR_2{i*b`nj7}tFz=c5OG)fSCi#@`;&Q+e7OZ0pYkvd_%F&Ybo=ijS%EWF*WA8weK_1CLw}~RB zvqgvM<&DQj0?oD950ruWS)?6}=aFflFfsRem?Po1Kc5`<^(&yjDPx=Xg5 z=!ZyEL@=bV<;`z9vNDlmn&|0s`h@C$d4bB5mZzJS4< z%$B-S( z-qkWEYcqA}n~*Gv5tt{=s%JnuHf-<7kPu?@c8@M;S4{qUjwayQ%-9eR+CW`_CFVsG zl=ckOH3q7Ma+AFG;vDnq+JZWKVA6UEb#l4dAxc(Bs&Y@!rj2W}Y+6>Uy<}p#he`Vx zoq4zsU;XCe1CIsBL<**<7mWZF|TrB+)x4BdZ+4k3jw!#7E) zejUWjJ+s22XgYCwr|5sG68S8*s^}n#C;Z5@|XW@;amS?-W&OQ{sa_< zrkGgmch}a*=7_VD;Mo4jP;5LSI9W|7>Dy6DghEwt|j(LT5pYf-#QpxJom_f=Ya#tiub@dm;J zEDOI;k$jOWX{qNVrGSNpgVsw(nkt9jSF2Fpga?nkL`lvGxS9Znwn{sxdJ+sx|Mb-i zJCAaYZGei(lB0YwHP*O$x3vd##SS46>kj=NGo#d!Xl1Q4>ugsfq&dC=h!k&)6=e7m z)9k&$JM#E&K3C_Az6Z}re!8`r{PM#OlPR?M0FSybJtU>2>SuN5;`4_%GK*sd#c(*+ z6aY9^(stowaCf@K!RqdIj0pl7x&0&jDEwL{rIs9dna!FjGfT5pHYHs71L|$SP@RH2 zk9Cu~YTwaC>*1?fO}1BV*>)Z`-XbwfW((ZR21Z^vO%^6xjS zGMBD%oTf?f6bnG7qO*}@PXwrcIK4rw*BSh(Rii*IORx#T3xXT01JX3>=<+EH_$nH- zvfrDSm^x}r`~%*(+&t6-6IHgGEV)+ZIe_-|4;sF0Q)FZ-13X&NrSCI& z6T(0vmzMmzF5Z;G^KBe+v-Fh=w7Be^m*#sX1npvXe}rje#phnT-r+RE6xg}n%XdtI zp%yr249HPYL~a2d?L(qYJncxn(cu!>#RL8<6OGC2be22myVJudU|zg0 z^r@E8%7mZXW2|Yz%NgdIB#Jbx{B5DhXK!8aHtL3e+=$81-m&S)I6McrES_Y(b{RW| zuxy$B`stGp?WQW(V6jTMYrrMO<_At~XgsYfSX>P0p?yK2)ET$%b+u!n8@?GzMiPPe z;{y$liDTD$O{*b^K5#0X+91bw(As)M={wkCul_eGNH%f;k6C6*2|wh)q|n!Kf;tvt zmNh~>2_q5L7(wIdTiEHTaw%XC!8(8}hW%L{H7A_(2ovp|Sjk2pTj?TIT>SQt76-%C z+MBRC$3JKH=EMYGM{*4oK}yZfG~4XM!p+BPWux=EyAgHU*Zcx0k9)JJ-~RkSeIZP_ zZ5!`YwPfx{JvdB*ywF-m*rnXpYzxY>7+NZuXyJ?03+ppxy|$KxukySQ%)Z|a576{z}BstI!4i>Fq0tC$#0@{3y0$u zy)rU#cIVw5i1x;ebqO|8>mQe^11Gjd1yg7zmlt}<%%Z#>W?Zh1DQF4e^M*K@8~|3g z3b7AR3JXk7b_ptTrxVum@6eaAj>8ok(#ottD;`f5z?U4e3OQqj4nRE*i=Fp2% zK2xz4YSOnQ82SjEV)onDLu7MJT}=Lm!a1v5SpWl>w$R)?Xn8%3umV0Q(aP#}p8T$) z=K$M0;i!NQ^J2c zOv-weE)oz6z;~w)0jA)Pw>!e}b^TQ#6rPyZ*zqs#nr}p?vqoYaGMN!1FK}f%Q-GMT ze+_;{6r#yDF|{Y@IyZqPZ=)wu7e|5uknk!!Xo*0*ti?bmUCG0=v z#ssQ!))w_P^~s4h0mVQ2E9pgASn`QXZ)`0t$?jALEdATBfyBft-gtu$;)$FfubyQJ3 z-BVX?UX%$B!W{HCRFV$0bZ%N^J^$eKX8& zW0PFJ#xJioJN)uib}hDlf8Hx}KA~geO>L!G!od@JB2vR2=C1ah7 zcHMK`gOJw;lx?49++)Xf3DW^1n_u0Y+R={Wy?zSsyw*sV@N;fDg0^R=7e~u+#j}}H zk9p6xet4U-`F3~pDH+W5V=vprvObn5vd7qnr_29DamDYCq`z>yHE%y~!(e|VQdqBJ zVe9u0Z+cfpL|9)kLLZqxLwfLPRKd^}92cZ}4#0aSNJo1-J3=HlmqaV#FiWim(li^B zY$xA5Q@Z}tQzpyxtKvt%++zaTk;`UC$@prbU{x61CS@ucH@N|0)z7EI3;H1veqQH1 zUEb**q%kWqGa2PM%Dm%%leXS#7cR3ng%x_YnZ9~@)Ab}|hFkCMReU=UbWQVgZ*_u& zfk^awa^$S<;qH9n{rLb#-40F00p0IrQf4ybGNH}t)bTJ@92j1hi(D!Xkg8A*f}3^F zNyUpWu1gjDhM;pn)2@mkn}YhK4b|g%Gm$pqy)KXe@G?>v%wN94g&pa6YLe^C{OtES zqVd`!lc!mQBwSU-{sx0rJB`CazogkSsL#nM!*@x>v68Rl2iQcZHGT)!Tl$OC-IEsD z{91{w;Ip7>uyMC?$K=+=mFl>`9Tc$WI?oIkO!#vC=d*88&WMB+-;iKX%NlDF0N!JR zJ3_9qgsOQ#GLWY;Uq<39w)vahe7;Dux;>3`Tk8hkR~ait>J)w;cw!8f5PJ-yyfgh| zN3+Sqf{%iTU|lW;Byv+M&LePUeZ$m27>?4i90V3MJQ7aDxH>6p3aP`Ne1vbe-U*8Y zeUkcMW$S5pJO6O=mBi=?08XMVgVfV6Nm?C(*{C%sPI2u@q%nVj zLRCpkbpV^_v=)DLu)nNmY8`3mg1yKANaRw^g)bjMYde8&1gCSAe;*dki7-?iIcuBL z?gMKF3&fxx_|i+qOh=E$ZsTr;S^FE0K7;_PZSw^T9$C9H3bPXqmDr11~r)(Ep&c6k2G4!TV0NG zrFW7Sso|6USZ#UV(|<|k7kQuloWnGH%asNwE@2|YMnvDk{;?A7<%8s{e5edB7}U0r z1%9ES0ST8Fp=kk<=IUj&H5nxfI8Nq3==>|&MlS7uQLG|HT#$r14U*rY`ca!}w1Pg- z+1MLp(KE?{`rf$vKlEwIJ?&ZYSKqaLz3o$8?5NdMP#TZB?ngu z_ht(qveiVoX8VeaoXx|lZQ%M0iL<-t*GENWt1gf0FKyWr7?u+^&`oE4;C-*28k%Td z4Nu5;w}Fl$cY}Sr7(oz6HC)$TG8PzvyXyE}uapKvdV+9)`K?k9C?*`aDiRR|)OUy4 zE7@a7EHu?k$1y>1YWWj@WhBQ*CR@~=clo--U1&MgIn8zR^YrXusN7uuIp+=@!vfAU z(Ye=X+cA)R(95pm;5pL_x-{E(srtr8FWtymMiz`-dWG+1g3VrpK^L)J3jmO$0e!1s z2RJTFi=LZncA5_`zkOpPmZC1+OwP)9Xg^pl#NDh#6 z_vib?EQ1PV!f)QnmXAa-S2u_BL3OQf~N7E*!Aoe8X% z3FQVSp1N{sJ7NDxT3xnp_+omH-vz5QkGl_%(y(39bnL*9lVC1W$3cmFQlt;{I-MQw z$1fhd&_}*Pw)!{JLeS?N>sr)}SF1ua24!)8JzDE6=m`Pp7f31z=A7a$_FG4`pfL)zuR+L6A;$M{c=6_ zsc4{$tgYr%@~>Z>+iQqT>XagyeUxyD|11>r9VlfHLVZNT?)BRZdzNslgIHUu#wXdjPzy!26xI zIFk$!t`Yf96hI2Y-ltBLbQ(uCwKd`mfZiL6w(wj@r2@X8g2IG}07e-&4xv3N$s$@L z&?m&cDwqX`jmc?Ki1VOXMf?H@hRhrD1a;-uu!FxfBK z_=_F#SP|2h8pZ%6)shf|K#58=MS!Y4!R%9byXVi^8zRdJB_G?5Qo^xCJjwX+&Q{N^ zmoH%$zZ!IJmPByDW8aBRu?vi0$qt6AU|QY4_<3?W5lrkX&tSm)t`wLCz?mMEAWWbj zML&P2=&+e6H*>k6L4B0HX~5aJyV~Z`a*AwT2mpFbYpS!f483z?yf=j;DUSRHtaYbx zpmI=i(`2^xsQa?_nc<=Eh5_qC@}2^_oN2hTzz@qW)E zi8Dk1RvL-rH=^zQjN`OZFO#D1)rluMKa4j)kzrZd%!Z=SQ0xp5$itu(`wh&z{hL%R zWgR!>K3Q-vqe)@Nh0A>rQK@Y;ADXuek*28SU5d>Zdr+yhndbU5#&QnqzgvG{wdjo7 z=Q$wtV#h#=M-61iIwnmm14Dq4B417$00|w;T~y}(l(%4?43Xa7Kk)u?j0z-ko0E2d z*m2@`QIZL#m?w4TZ=p+>*~I#d4a^h6&QK27wvnH(Dn3c+4I6VT;EKt7F9gcae%d!? zWR7sWZ|{cnbZSsSu5~vz8nGjz?op8*&8Obpw+qOA|LZAW4K_tfiT4*^13P=-czLY# z(ClMF(q8(^g%Y8DpO6i^S`gC}MT^-8PY zoYZ$9GL149l={G9-FUgJ`3&`AaiG-T8P&*F86=RDa#(Ggv{!YC!JHg4GN7Ga=&6

8IlRavcLCu39A#; zSkkN+i`#_^B;1=HBp9CHVn{t29ndRu3U#!<2zsOzU1JzkHL@faAPiEoyF-kndCCR8 zzv|bwtyeAjr{vP9bX=M0En3kqc9OaHz99g~#1LrbXm8JBKn*3T@ykY+sYQIF?|WxD zB75erDSE20BxP1@GKQcpk9GGML2)W10Tm{sg(00C5ItE+^) z%Q|HK1SqK^fTC^1zEPOo09+biSEy^`PujB!^NsY63Q7q05*-~9{A$#EnIDk09z_y&u- zj8|CEEoyj%DC_g~)D<>RJoTY`#`z1HWrdiB<7Z=O%qMMRTPj)*Wy0n-{9CmVB{hQ# z@oKzuD}}{kvHF&wsUgJ70kUKmy#FL#-2rZ_paIi8Bd6JnE2p;a2e2+ozp$1|x~4En zMVhD6nM~)RJ&kpm`&Jeue%V?MNUVdm|}A2Xzi1<5r6`yY<9)XHZVG|IoEq8bLBp#bHO$$E?& zSq5KLtP4uf1lroYAJPcDHwOw!%f%~K))I{j*Mc5Sp1X^joS3_$%0W1SXVw`qyjz`g z+`thB)N{7#>It=prt}-K0Se9p%~EmS%VI2~iy*kUy4?x?-N@sU&woZf z^Bzls1)q>^^VCcfknEO)QMMK3{#h=PF4Ml9uNwRkz!V3<13Z(@+Ctpau4`b)Pam z?LI%;+}s5{UwOT&3#gb-^pp*l*OBd60sNW~7DCB0PBO{rX>I@9P1xt(9f=-TV^Gq7 zH6DR+mnG)-6Bpqdfz|6sLA#4;Qu2~=v|;V=gm9vky&Id6U8*K8><#;Uq}2Kg|I^{Q z$EW)0w@@AyEoU<1!}iXM1R6^=p;JHOpk1?w;AX+#ie;Kx)Kkpv0c3nmLDAbvZXP)Y z$CwWcd5BENBiX?%GeV3-0zi&eQs{W=3U>mH2 z?>{ekSvHMa+a|t1PX6}r^7f>g5P)c4I{xk=6xzWsg?%dLm$yzpmF{~=F+Z=R(9o6>|)1@-g(DO)geSr^D~RM~Q?B8`nYPVfrU>E_>spvJwWasVWrnJUT8MS5DwfLuLr&54 zJQ4bO`4jxDNJwJ+?u7bDz|b!r+GCBX(sZmeRSeUY;^7W$h0sAW3F$b>TjtXsxLjez zk)@sFEA(GGQp{R2sSwx_L&318oT_L3}NDvVh^{VJPMsAcF!K&aVA>WU(irWZpF044Bd~?gp)}?7Tv@G zd3l$};qKp@dZ8Q&J{iQscfL!sXwn3P0F1~D>gcP7445L+Vw&QaRCah@)hqgK9itTR zZBd4Zyjb`<>ieN5?Wh4s-zdfY7|$1~t7u-8jdAoxR@ewaGxc$w@)02>9_>4lgy5=E4v>SM8)o3?~3hobvS!@J5|x*(C~u*5c>H zFh~FkBBow@lLOns_zqv}I`^6GVJkZvYGLZ4*^7qDhw1SF9 zhw#QgiuvJX$j}Fm@d;i6kSlw%wf>(M?A;f1%JYr$aV45$K;1EdC}l6c4}2}>oEVtV zpwHpn+m!y+ev0Ca1!!uv89Oz0oLX(J8Jpm)4A(WQL>KEFK_WQ>o~HzBdFKHud)EYv zG$lVJNX8Ai)RdlCi=&o8@sE~?G53*UKG$uEN6{A%h{U>Z32&s3y5#f(O&tg~O}hD_ zu>mjXy#XJO5rK|8QEOxSdN;qedz0C>^Q_`~60KWdQg19gg!DmFEl~T#)%xm}-nn2w z=f&f^-qG~hYhi;Z#K7+?gQun&em=0+FY@?FrqDsG8RlbaR-&*9@!POAFlayw4s%;k z;qj+YSt#=QJB|)xz&ln>Ah14S-0_;`Qmn(fy~Y-(KupaP!n-QJWqCr78jgfNO3v)p zFY#E;i0hcFpk4<~h!6ukw#$|*RkH!}nWZ3SsAGMvt2DOGAO_gKosjyJ8hl9`kLC4J zb*j82{dl9eVL9qLv?^w=fQ9O%Kk~Y`0u8tWk`bf|pSie<Hq`};+)@T{p$!M9!mVkk`!3>i+;2P20lgax5k2V}hmO4J27d^b1m z!xv42D?opvdRASL415B$PxEN;vJ4SZdtM^gG^Nf7zv0<1l%E z((|k3P#ACdunC_9^fJrn?77ZwG6-d38AACvZ>~;!?OmlyaC_`<-h&$o^)*KL&&8W) zXC8{Gy5AlPC|T{W&}b|-gmn(}fYbjU0*BozY+i(<-tvatI_`GfewHv> zfTpFRn>UBLyeV0sySGN^;V={^rLY z1N;f)?}jB;y>{uO`Y2B*cEGU_B^6+d!mvM;RjdiEUpMOi07o^>4bP>%nfx>{(A6K5 zCpnYDCyD|I>wc9|>`ND={SH|*>y_*%RnnNUVa$yRdkiQHpsHx)S=D>|cv#uGR*6LM z{|WLx%kePr*+=2+m325^d!yX}-i3daVuDkqy$ueWAL+$?10vi2)KM>Dx}dcHjT8dq z6ld}Ex}hjgxnwBq4h{nRmW}Hd9xO;oz`mMEKBjH~xd_=g+|-Max1}yW#m;OFAERBA z3qJ=5;@mWHJ7Ddx` zQZt$TXsFcahYLu?4c8Ra6!}VkA|HP_OdjDZ)w5*yQoA_k;?#u0-3oN$j#?RVNy5;R z20g%U@s$Dd09}jaO&M4R;{U`07PS`&LS0gQ9->JN4PGpBY zrqj>VxUN&YPet^ErEr}7b=tx3EKmlr$In|-q9}|K0yz|iFjN`j@8}FgNd>-0DOAH- z2NK|RGZF?r)8yXT%-Zl!(zWy#`vnX7^&>3@3czBZ6~dWEN0!4U@i)D}v3Hjka%&VF zVU%Hw{3GmEJI$})lt|5*&ml~Tl+OvwERI~RL|5W1-cg2g7Riqp zCG7wqs}t>XatD;wgl0*kH~OpPA0XGYgL{(@_69O=!WI0M5o2ahg3qa3 zFtkiyJ6#k@#%)(Ll^u$?!u~R3)un9ulRU5YUG)K z#g9TVMxUmY$KnSPa7{do4|G#D?13#=^EG^1dxH+)EC5hKa3d7A=hi)JTX-U>tM5!% zHjqcdk>29g5sd%@$fOPQ7b*wS8IBaX=eVp+tWPVs>aPZ z%xI7?dY?(sWh%z>wFWhtRUm*r@lWziqoE!_MiIr!+n`4N!{VL$%F zjK~s~31fE7oUldZh!6FP47yYd_4*2jf6A2d4J&ny3w(dIByPdMfHM$qRMQrtCgryN zqo6(=zXLb;5hIIwUs{jYzc0X)0c;aqj$4SiHXytqW1Q6Rz=^j&RTlLke(3!6yHEJe(X@0@TK(8za%RWjpYZKMS89jv z=fVw)YrAwQaj-GU$))5Ve{h$utk)KFBV>cVu{dv!@hE3qjg))cdOQV%9@H~sPJi~B zNb$VbSO~pI7HlDr65hH^73yPFd)yz<5yblRUZeQLpNhHXRY&NIDHDMM5uQ+-^99dJ z=_Jn*z0`TB9;J+K7A?!zH-q>ygK)f#{Ar@tofK$-hFpTitYo48;{=JgO7cb>TVuE# z<6+La5?H#((wm>{{M{2{I8ms)GMInNzN>O|)k7_q_+|us!@+~Ww3PP29BG~X_1SOv zK$$m!rDqZDk|&Zi2>uK2#%6)a2>mu(em_yCzjmva+D&AYJqw~J#1^SGw-PJeX&IS&>3aB^2aAJmH5CyE;7X`bvhy@)BTkhR07fM@8yt6aE>kTl}LHo_PC;qFMYSrVVdxx z3utP8+vYq2k)xaw1=Ai34mpU&A@B1AG^cLz(SlD(K>v5 z3=m8TrTyl*ZAg81$`k6ErR`E;j!|^=` zT5PMsr_nwb(>f?0*JdWA7Pzq4dB~r)q1^tJ+R|LHmyBl>-)RCOrVx%pg^azPZE~v{ zRWW#%G}Zy3n)a$oEx>hF`YZG}xHKH3XC#yo8qwzEURj&?#fbhv&!1#Ue)*1TAez93 zv`JYLhfcS@Ggk=di#&DNz+b%V>dvDmKqyh435e((pQty?FPmza4*BZ`1vcfjVa{-U zP>*&&Ia?p^6ORXq_@q-0kC@R@UVN|lK$?}a@BZRCF7h6R+z0Dny2@m7DB!YbuuME}wweZav_o zpnC5PVUM748RtTIEO@lw{MLJfR0c|nt)Pk;*c`BU#DO`L|7t14?^HxAPv+Ng=iu^hH5N*KSkHjmlHU4JCFr zjDH#ITGLFTq>~^rI|D7d0zKKNgTU2hsJppCB|q{MHztO-@8UndYOFA?hxvP^7KDk} z;FQ4pTq7khR~*}>o}=1W3kR0mZA#QI55`i}JW1B@r?E6=Xxgt3jD{bfL1W))v390wGrbC(s4Cu? zTt|K~!nzU^#TCg##ILLAY?cmc7|zc{nd$&o3;0;B5`R>A}VLbgu0zy+e$D? zPjK`3Ckz@c37K5`-B!*KE)~wbr1L7Aa2>e2+&Oa**(c1^QrgjA7a@NXnh!-&wbEFgCX%g=P>s} zhC(7-r%|AI*HCREN?KV;mk59Hs(I-mcJSRrv?Apc+K-)h>9BH2<)KT5*B?Yt{doSK zxM^FxKA0Ov2OO@s#>wVKlnzEAxq0AVr93ASIsF_Gi5RTLQ*@j5eTU|xYhnm#Rz&~a zHZ%bWoi-uc0m(U{j<#Iesqkk`peL)%r;34?a$W)EKS~-WDu0(gkwAu;jO9F&(o84Z z{H*ncsmT3SkK)`xeFzmQcubW)^hJ5Ir*E7Zpea5lX&@Uuh;zz4Ux!JeS2!ERqKM=$dWk6?cw?5ktBWSX6n5mJbn1dt> z1>r)K$;)D^e#*gUD`A?KzW)uix0j4HK{K5Fz!@JcK}fd*?Ny$Ehx4E!vpxUaPvjIg z*(3!KcwM&b6nZ~V{nQQ*6QjF(khAq)+lqXcmY z1YS=3kK^ceR?H`c;9nOpl$0Htq`}l%nk`Rx1eHCF<*1YC`#Fun5ausLU(fyMx+JVA zT07G4-U|z9_~StLCG1MEHx5LmNp}{iHPG<^?K+wRvi!2)WC&q}8~P)TY-}Q5Srm3M zeBW;)IAZ&g0|9;3ck^FbNSJrURPXo>B1^T`nYX~ zPtLP*YXneJINo_cdI4H32B~xUzVtY@v^NFBZn^qFZ^P^FX9KOZj-SI!YW6rPztmR9 zifvBkaLmuPeS=GHo`RdUg2DdRW>OT6d7=z5bK5BfYbkHmOE_yXR|8uus%EEDJj1=l z=~lL%2sr##QSpG1;n+ooUqwD)wBI|J4r?f=t8?2YgE-Gn&cx0v8td~MwxsAL$+k%5 z=D<>pe_5szaNsUxksX&oa!SNtB4%dn_GNIva6wdQ=5^u_BPb6ek9bVzxHf!gXo*)^ zj^!{87LCU{l7eouvxUJy$hHXDk<%AiIbc6`CHr{w`7@8AwrjC z!=Mqdc3nTX0%<3^9dhD*;4*$luFJr^MERH`K1qimaefy}NJyC8`V6?oft1zN#bq?W zfZxrET0=lBt!F zLisB*i&P7jpE?IA*jXTIPF_)klp7Z$Az%lVB>=y1S7-jI$j z`8LXbQs`KBl+NFk6a0pj=i-uoNOGH*Ll>29SGFp2HL#m#s;374<#ej!`xJy1^48qeVDW z=r86-8Jb$a_J(ci55HvHRj9?q-6(clBjQc0%DVP9)08Y5#*Y$dUQ7ieU#y3xTMbg{ zw)jw!Nl2M6=jrCxjXu9@f)Ew^5)9&9bYSOpJxywx8{U#tgd7xNv5Rd~G{%-zWR#dPUtcv9?6o&j*1n?7#3ZIN`|J&*&QBnn`6h8(3 zXibvb9e88!#cR|lk!c-^E3ZYUA9Bv`Rp=joJtioE_o9R5NMF_det9`(?<=iduXg}3wly>au>=V7(h!<$%6+&!st zDG~Pf`!p@SQpO?W9zC$H7V%T&W#2~dv@PRuQiQ(5;6r8Qir61uVaTJ`0p4cy4lT8P z>fx|xA{7&@gyFPB%~OhwMhDew>7pQmmn4N?uY4`lYR=8h<%;C}>w{%{;ct{a74f={ zE&|z7#t?T2kw{533CvW{4#&Iq79kU4+jeqBDZv8I55#7oep}y$i!9f=Yh`=YN6x?A zy_bD;ro(-uwDmE7Hy8Go!L)cixE-OihrLh(qMYZ8!t+Y-T#NaXqo=mrZ_9chdhS#h z==;fBi!u`qv>I|C@eoa)TaM&Jd?IC%N?%E~l1=m=iVksOwZOe>{CU=f$?c0kp;j?!P zndd)n1|;AK#WwGLiXO{-9#;VoR(Z6M&K&GI3^%5-?|vaMm)B#@S0KwFaXNy6B6>J= zz32b9b8fDQlF*iy7Z3hLGhsqX6H`AZ9B~ZoOf~CloG^OQd?Q2i$#0{l^J#F_mUVoO z9#tOj`(uvJ@?~(>7H?yFUVU*O);#UOc9_a|JfN!AWb8+_B!+AUpA!i^1Su_Z#lMy4 z{4A4GbGPPlGwZZs1(j@sN_7geP@lL(J|U_r6H*`N`Xwz7vvW_N`=rxU@2TAWTrhCiRs7@x?{{ zX|d7G0yO#;8lz$zYIkyXNTmOBZ_(M~aK0x)kQI-WJD9E$t6?nQ;Wvq}Z`5vI?p`XR z)QptYb*LZ!8y@ORmD?GWoZpf+k(|hQ#WPR>K_boTdu&{{9s6l9vFF5wydaAn$b-k% zn3ma^>P+%Lk>VI@oEr3jEANM_#0X3DIMN7P#JgAo$asz}^fRQzOT ze9%v^P`(P{sHCG^Q`7E3Q|=D@r6CV@xMqt5;rL5l<-8@pYq|`oaQfGX)s zB4Pj*YAyDkYO3+Qwzl;3+#r8XX-**o@%h}y>KMiWnk8cwF zy*Ir*glBv|82^+P0!gLXJpJ2K{=2u6H^KdlSt+gycE++Ic|)gP6O!_Ay=!vPmb1}% zN#)4+TBNEsC_Uh^Je;lgn4`)<7`16@Ewq+Kkkj9iV|sEln#7xoRt}fmp;zBwp*TUA zqw7vz!l;!pBjV;4c<^+t;NME{LV&67jPBjv6KNTlK6erW{^Z$N9s##sqnU|oTcv`b z1Keyxdh#@jeGeLiahO)!j*cY?vU)*>RkPUUBJ6=Gq7>xF0SfXv6cg5I+PpHmE~86C}C= za~kLAoTto*yUtiJpZ?)r)U{|`D^!lvyZj5D6zPX~eI0(SbQd%Msv-`IG8zXM1vUKJ zImS{Z@jP67<^Px)+kUf|sKtA6{o(C8 z?V{m$WU89=ek>>Kdr|p3^WI*JERwAbe(R(}b~Ns~PI(Tn!$)cRX{q&MB%*4D2Up=o zA9|R;_v$B0Ifega)Tg33-EkTlu8UZRGZ3_6>WUJJb8;CPw~Xe*$N)CeiHg<-lC1&H&Wijlmw zW;ZbNrz4Z>9;jY+D^uA&Fv;2rGv2fA%aUI4`Gd{S8h7Rj^j~p%^1bH!+8#i6*dsfm zE8dj6f9aFY%*@Vfa+qwqwOgP9^|()RrpLgmV&s_YAOG{&Yw5bYgsM93D}<83u-VP4 z!e|=qAX=FJc+zlw?m6DJR|^L}x{@%vp;3e`QY@3ER>Mvnmc5Nz6C});xVghk zz80Yl0>|JbY5oPlotC)K@`HAmLv+W+hUgtt!o{P1Z2zQ)r;!i-HAEV@@%ksP(;tlz zQ|7#{uA1k;LZ#tdoIa5Pquw{=Nl5SibE3+ayn{6`(eP>|EN(rneqydaRe;NzH2hz{Gt!fGCMYSFy5wu2!} zeov8)Nus}nMv_}7%CsON7`4PNdX3k#^mcc%k!@#C%8#nH+Grn@RO7zp!>;h*ep7X< zJai?{g~=f$+!-1j&o>GB;%pe*R$3`;W-=oj5Q5jm)}Ng5X9S(|F!X@^&eXI-z+cVD zA?zD7v8u|fW4B)`6jfED{+U=T%il z>rcZx7hU)q@b9}{LLx%dd_3wYM3Vqs934ab``878Y9=Q4qNR)B5*^GQv;6Q9IW0fp z>ZwJn6o)}(Mc37{CsDw0#;u!~U8FtLg4-e(KcSJah8`08Vvb@s`nf08!3^2xgPo2d zgHg=K-IryH*~m<%tUPvWYcgVulLGn0aQ4t^Q2)-LhUiwS-u+pcn8OJDu~Z021JL%T zSt<23WrjcOJo{+;mvxKW%VUV0yu0B&z#rVu2A?rZx2V~4<{P62b_##n^x$%kqF$tK zmo)`oDeZm^ve+C>O1AU**wt;rjC`lI_glW!lSV%iITon&0a1QFOL6)$sC!+M`XRfE zzkNntxRT}jun*idNlYz+O}Z!BVEsv>;yT3V;%`RkTUm(=-UJwkFEHg$E?-wg8tvMw z8uZao9Y88pS5*H=XGgICq{P9|vl|lfi{Jt)g+}7e=Cz>dB^#FV_Gf2e*rB{&-PJac zu0CY|v<6-3@Wc2vZr9Y-Yn6#T5u@{eEN<cfEYgiuBpp*VRqNUp$$)MfYtnPr+o6((T+l1Vr-v$k4QE2YvWFGQxlN?MWEw*`ozsriT=$)v+WX>S2 zq#a)y^};+jtk|{vXe;*Lg0s7hmeCC^FCO^pDfD@GK;>lS51n!?U}?92FED49>fN<` z=%1F|l1u8H=Fnb}^o9QYo68fl=iP$D(`adCEnz{1urAmTL=dao=dH=K{-l1y8WN}` z$T2go?|r65WX&fn>?S=R3=@~;#k)Z!^93TKr+WJ?rh2T7Qz;A|SB)hMTMF*?*xwFh zIp+pEUUD_@XUHn(at_CPy~J_#{_?1$soiI3)*NTA z-SfBLUuDReH%949pFAws6->2Hu*$D;&CK_I8Mk__x{icdQVZzIKe zr;gT6hhI9s6wPriE-DXq#j3@1?G7_CH5XM@r{piam8q)koux@GRYGO?!O#HcV2$pm zKQoCN$t0oJo`7>QZ*ty?F~bRe@aGEBLsk0g>4d7ce&{u+e?|w2yAP%XP?R#>uyNQ< zd@ysdXvP#_q;1x~Fe0&J{<_tN{=4g9zJI`Ez?_c((MwJ?olr^B8HF?KXT7pv-sC<< zu9Pvt$zplEXJ+#*6UC7|?HA+ES_le}X~>#`dCqg#kNnRBq;yKNlX>ydm3$!aA?3%) z&)m)@rD8m%vO7;Tk@v6FqOcqiQ1fxQ4y&bCM7>0;H6UgxQ4@O8&6>JGJFyt06eOon z41#T?qxQZ@QMUr(AEP;YF@Qy#an}Vi zVisdwl3PT9B4xxA-tAfe*yCGPWBWPveyJVdRyEW@L?5gdS&c!JD^8zPbb%Wwi^PMO z!+*mwl!9)I^=<&3y-jm7kx%v2Cj_+)>k5a-0XWXhgfuWb=sC6SZu5X5tJ$F93Bl3A z1m?pGABvVBf^-g!OVk)fNX>N_+fye~NzUb)NoU}cy%@Iez`6*}{c^AV_t`NC+T+OP zTul1b|48_62@PNV6F97YWlyB~*pJS1C9`Vw%Z9x;lqVmPo30JTbJHb?(?^wd#^|nsdkKj|D~kX)FT)HZgLxF=Z5Zy4%^_ zJm^r`?YZ}IhNqF@6GAsNIFuRK8c9^dxs#y6Ibivy?4t$ zLB+Dl!E8N|Bu7Am7QMA(y!NZX+OvTpM=T{3Y1YaFBVil#dG^7p)0q$BeuZGccx@!p zoBM%i{&W^Avo=|Q<+9Hn&qvF*Q_$2c^((k71SF5?3tPzUQ{ z4>FN$ktlpUpw(6H!9kDqsn~8O@&`yNY6P$ba8eL3P?wCZeeMp!|4l28C)z^DyP3t^ z^*H~Cb?}3jU)Cae6%NxyndWI|fBKAG9sH;igG1#osh{Z_E`l6EN5qE^Md(h5!spWeU#X$=kdq@2LioX)GlOqA6!yoU@ep6t!Z$E#Qv7@qbHyW5S;EWB^<}|j$ zL7vloNib8npT8~nxYF^V`7abW6zbB><5s66OMOP>%zZUsv%hmbkw<;&u*t_|F;)R*$Ft!Zs;-#Bvhl>ht9-*+Lzm7nWrx0#4T&$utwpOAca z|4?-MCd}DmeEfl?k8#G5c8csyw6R&BqTq49!~5TcUz0OM)A{FIG%V@o1(%8iRZBbI zOB}D|m$zng483*M+j+RA|~DRSfmqm~zX z%P^e(x(r_)kC&r&I3&K--Oz(iD!SG#Ku>z!9W6G;9*Z`Pj848jl>(x?-pw-jmu?$B zPmJEA=BU)#gmZPWl-$!DG+Szt?LlwG3w*qt{Z&yJ6W0))k#y_MYDIhCq^m~H#FSdo z>t_8j3XAFQCwd;}E>u{jqu@SPV#mu(CH4#ISO;^7FY`3rZL*+vbK{S7i{^oImcB%a zDQ!?%$r9vsv3M~i(DKyqk+RckG222;I@dfUtIYpbc}t0XDfq#(53S=6p_)`r0f&euZbKg(n!$u4*+vhz> zW5jO8;on~b+IHS#l3XX8!v)2R=?S?GC}wJeeM5NA(CzB8ry=Q`n&hiP+Mx9Fx{D-^ zLH)P9bz`Kr{QQwgf-*IC@%3pd0J7{DratyZ(-*KvpLzZ5Srl6i=) z%XV1C3}R1$rVsSTUDk56y9i3dHmmzwK5iP=%btsf5cLEI*w7h~BxD;0YlS(d{ zM9oyYhJJD`8B6}%m-JY3a_PGRqc3?t%TpINl<=OSs#5uG!@64E+Ih%_#}R(o%=j5* zs9t@vl;1zqdx9Xd6^_9svuUoABHbOKiP^1lq>+isE5erntMPGE;?Z^A<<XQ2>tmIipR1RclAn~S zSCLx)lxJYDv9BmdOwLX%QAkQn&&;z`dcS+Wl0s&Rtx~wDuYqrYb81GWM^#a3aFt(3 za#eP+Wr~u$9hXgo70`g()RIJnirk#MVyg;UC9t_xKsHENUr7P1q$Jx`DZ)2E!8yMu zRl!uxRL?-kj!VI&C?(A*$i)q+8OXC$$|xx*u+rBrFE7_CH`dE9O4m2Ew6xSWFw!?N z(gmu}Ew0QfNvzP#D^>;>0WrfRwK%ybv!En1KTiQQ?NYIs3Leo20D zMt%X@io9ZI7yv^54(dZ5(}^? z_VvZDJU17`@x>*sWx#-d1}ci{VHOmJR2HP_2c;J0mlh?bx|XHpl_-P#4-XP6=c3e< zOrSAAZtmzZ`8oMTzWFJswo1lmQl8Gv0Y&*~nK?kY;vjb?1y5IJGeb)=GhHJ+L$F#< z_*r@8CZ?zQq~@iUWY{VhnxRRAXQrTwgItzzl1Ss--+56=)o8&*?**rVq-FFt^$0W4PW1tNt;wEzRP?AtsMu4z%s>+llhNsq_ot<8{;^)Vzd^O)~r@{i09$#`O5SeM7i zS-Kk&tImDB;_>XxyPflY?|nY!ovrwtiBsln(_)%%?#Y=C87J(m&EK!DI@UT}ZP$yd zC8s53&6>4f&EET7TW*w2UlnTiE`D`nSESXBRjur$htF{KbNa7&!gDnGP;XUGw2+

rc=%y?lCh8+TlwA%_8+?!?~m}Gm6=#+nfo#%?*GpIs!siBGiOfQ z8k)u}mgvU$Fnx|-8|S6N4L=sV;=8+Pu}|Ft>-tG+p1gX*%QZu1vVv!yU*P8;Tea+% zFEe^XSg-!yU%T~D?Owmqcn&T3+}~SeSD7u`k$794eOs&z%X#KG>0Uo?*1o70u3fxj z>s!aWQgh;_Yx^tGhnoq2%xvKi+ zjZ^!P>$-J}vzXHVKG*#Ss%kh3JR*x37;IZWnDOeG^(71pOy-_0jv*Gkb0?kkp3Eq7 z-2VLUZ*P3JZ{*E9%`!JlAXt&->>d`~MZqkxR;8Ei7dSsxcp(&WLHCu!TrPdbN{%TU z2RY&kUd~zeId|9EwduDvKYy7Z=`8rE`d{5X`?~%2!#TdIt!MUckodox$3Uy4dh%)Y z27ad}j}tsE3aCh~4m-GNwtHmKr-=(zEo4{P(WHCAPyESj+p|Ni9q8umB!|Jb4gKDaD8@@svN?wf>VYLODvC;L|x zx;`;fcx$7H*NUhQiL)m*IOTTs1$yPxUiOaCir$1TM#Nyxof{?|vu zQQ%v+fQw*#wE4krpE)MAs252s-E#EA-RK>2_?XVxovE5@eUkA}EptxFZ4cl2hmVhl z#HR;$bX`6>bD^|`9)IgrRjs2keTTSq-9G!*{rt@M7`2PC%RlFc`>SuZsrcA8v(<$E zeXqcm-xET&^Iv`X^!YQb-QLD;mOekx?rc-{T4igbOW_WVHm98FKBtZ{wO$pGJ=uL? zQ_K0sj%J@My`r;CwwEPFi%H*C%Y3)f$y8urX~6Ow^VG7dIbU(jjS{q!I&lBV)2}z! zpNUTwJXCxA&9aC&(~hX7oOL{_vDo5Ev-WK>iQSQpzFC=1KFn}t=_Q-$uWdCOTLj+u z-ugX1V8WDR;(t32tdY9$)r!y8^>PT;QK4#DQu2^nwM j^*tOt^9)p&d;YN%Z95Sev!LlWsDgTe~DWM4f|Ly)37&w3&Rt70XRt82O%L|C5p=^+AG#Ht|;!HrcAtMvmbx}Ze zW;+X5JPXJMfdn81>4(v1mNGCiFic=)U;(NyFfuk^TmUf@q=R(<#H1-eHV7~Q&0zwo z46?KUvY@&Q4GciC(j}LtT;XWr2CD1xba4!^@V`3gws$ZiLwkMtyjUA=r;WkO_?!SmhTVYT7V8Pv6#sH8n)Y!)xyrJ^rs3oI^a;t&ZJ#bk6NtY3C|$ zp1XDQ<++4uu4=rY%2kgr#NY)w*EMO8)dqp&L8} zH>T}W{{H8l_3LN03=EFa1&cB~@9t}Q-FkS-0y7n{G0#ip-Lq&()OCXt0_m zWSL?__u@yV+V(b0dYNkS$NKR7`uh@Zls%p2%OsvFY@6dXL1pE0PhVBf=ASa$^7AJ> zT*&@oDy#6x)|rz|Rn1RxRWeo05aTQgwGGOW3$*N;_)+3e5fej8idp-MIj$d0Uba4_ zmdww1g(LZ~aJg0f-J7?+KGFSVy2k1Ax!j5?pM_q(3VYynJ$8zRS@rR1PA6VN0 zE!Q(0HPb#c(X*m$&y>lTH{J%VTe0`=q%f_UQq^$G@)L*id%Xb%KlIb?K)Se|*eVztI!mdK II;Vst091u{LI3~& diff --git a/frontend/public/favicon-32x32.png b/frontend/public/favicon-32x32.png index 374d45216fdf6dde1129b9159485b66369e6dfe7..ec931d319681bed4da23a839e60bf4d028d316d8 100644 GIT binary patch literal 3266 zcmai1dpy(o8=qTlktC;5tSL#&F6Oq(iViB&}r|UVt-yh#?pU?aKyr1Xue4gj|zLx0fyj@LYl?ns` zQFC-4xP#wN>7%p={ABZZ6A*}e8`Z;`<4xR&B{OKoq(DXhV9cd4K^y|H!gHAX$w%O4m=jHi|6b?=7o|i17Ub;6)P?l6rced5|m2| zqqDJG9Bf_}3;vdFBVf>Z3MUi?^Cr4NZ5b>8YHDn1jD%UMK&@DTL0ET!{YPVPg@aKz z93~clh>VOhjx;f5u!0dNOG`@x5{*Ek;UELfj-qo&TsWPrFO^u(AOLJKi^}9s8FZ*r zlN7)R=ip#45QlygXHpm(2AjfQesV!)f6M`x4a6rHfigxSzBJ@egFc7#m5mhnjt+3C z|3a4{-_gPJ{c}KE67!$PMB@LZ(`a7>&*s=gfQk5+)UTrd+X34niU}ax0X8F?MF#95 z06Is1{`{X(g0*D8d<+dCZO6Z3vqF3qz12M7i~a@e7WTlo z01g<$rwIctKFuhA4h|+3IDr_{Ww#&@nOG`VY~K|b1Y(#Lp4PF6;HGs8Z(@tF*J`>R zpy@?%U8V!9%PdCSEo(aw%s)FL;V}$|)pxzz0{S`+h~q9?_B!HlCl_8$;0Y=gR&4>&C=a&vR@OY5IGRd$7E z3q7qz{m=Ux@xj&#e^v~?(W;!H>{8mlxM|PzB%b>oP3xtjm=_1Gn>(do-xpi-zBvEwZvy$(S69hZWJdAl6yDX-txN2lu_bS2O%*vN$f(y29>kD!o)%2&m zO1{xYMJ4&UsA^JQ{ngFg(yCDK=oGSk6_4T0bi zq>s#l(lQPNvPi>`u+78!=eF!nhVSm>hfc*9v&CI~BCgf7brCU+YR=2e zon*Gz$-67a#%JOiQ=ocAHxGLqaB#g}St*}heQwY4gP}EvCk>rX)<&SOC5=dY+jAtX zIczh%uq-pGf*P@HRzkV()_VVi`s^v~#EDeMySP6ZDz?TcZj$5bTFC88B=9IdFm+#Y z8=50S)h#Yw5{;KV62LqDfTiggNqSoTib7}7Fp5fsk16VL5&k|lJ>!Sp*lC`v)45fC zZl!|JYac<~WDg`k_&lXVsV3ri%IP-=MTT{%ue!X0l-Yo;{{F)@1KN{GtRU+sCL zH3)fZtVac-5%MsxMGuxrXk6fKZ7I`YB+_bJLxrcW^To*4-9FFa?Wdw z?j&C{em<_Cd>TuAGJ`De*ihHGy)qavsg@y%^tZ*fe~>#{cVZykb{eKUq_g}_Ix+o< zX<}7%oB_O)rF`DEFx|iLb`XU!w)W5L=EoZP_e>kctK5u4FJ|R6WFs%7G546eV?i$& zD`VDF1u=*Ep?A2MCWx!IAMs?)(A|C%6s7Me`LT5=oqhuzT4}!B=knsk6$d`7%&Jx0 znjdww_F&S>y?C#tb;qB?4@h7%9d@`(H`;P?0>zgUjcF{NMzx~F{9d~dQ`J=PZjHrF zKVcoaUSA)4b;fmbd8*%wtfOPd6F%?5AO%89#BgCjy`oF4a$8@MF!T2qnFQC=u4x?o zP@Z*j2cMfBXmxjd2rIH#x^X?Eu0(RP0E3SjkXM|VsPL%XNbe$4tx_=?^Aok(L@aL+ z#tMoW2kb+KUlxt@px&2jLqhE1U3Uy>=Mfs$c6Zd1MD-)% z2h0R@O^+tzn`ZW4#`u|A3zt6@rioGQeftB}^|_&U`0&|NK>M|5nF`;B@6$^54Zo3D z#Jj?s99!mld;4wAun_ySO@oM~5~{%B9g#oNH-_TPtWs?e1EeSgJ42Otf=|V2NG+?(N_3o$&<0Y&zF>4OD+f0d+wP|jqq1gxWDMQ zLGCwFcXu*7V!8UfQz%=oYlEUALB}$hiRiGJlouA}D;H?|Qd3AVPSx~`>{T`=UEG{{ zLUf4cxpDCF{We*$Ilbs=cvkk)6$P$nd{vH?=i1d1WXH3MGEO8_ye{Q)S5iBd+91W1 zHvXOJ+7+SwM;F;BX(bl#?S`yVia)c~KIEAjY>685^o@7JYQoduoY>=&zo|cM*{?K$ ztyH+cIO(O}adP-a-BX<{4Gp@*9K*rOr9}VcY8t&AINr87-~s&5+>Fei@ztae3(CEH zhVb@)EH#e5MuDMx?qka1Ia-27DbXc=R-n-0uY^Ka!q)#NNX%}gCKD@zmn4?0A+Vz$@r5B=9r85!0#|<@%>82~i*Q~W?jgc`pOx%_( zh*D~L()Cq!_ypk0b{=J7>a0o1YH+7Y+|qsQ>@~ literal 1877 zcmZ8ic{tnI8vZ2`LB+lVZ7ofa8v9zZQDwepCv0ethQYx=< zi--tow+LqnDI%H}<`3YBL7@>Ej@B*;`Wo6A+P;khL9VCC-wj8?;m!ek+yn~9f}jA1 zt8BTD`&%F1Mis>KqYmb3Z4ej`;j%jyL8*`*^F9c_0;o^o} zxlN|JUXn>EjvwwfHdf>y?<1WHvdl4JN?-A5*Say!o1A4HxaES~X*+?{gz|3Gbzhog zWC*nSLI@U1yX9V=gK`v0G6zQ~KrkZzx@(8C!SvnIQ(R1VS9>As6V7(P>F|Z_Gt%0( zna0lT;mO%OgK4(ZcRxV@=e)3h1bYMMR2g*wlAh7chcJi}$HUtNJo4L?e%BK83tqB> zn*z(UsOAsW8bu0|7hy%Ab;k8&Bfah|;43pP>*lGQ5K|~58?SmzGyq163`Vyk-4NDU zkA(hK3#r}_e=?P_JzP=$QN26A2%N1owtDeFz`%1~Mt!K^+rjp8b3mP#4Xpin*R`+` zV(_M$xS`HE3VN8z<8K0oV$-~vc?Jeed?Nt~Au+V8#jd>VHRZR`d~5NUCOeK+6ukxLMjOG}@lqM|$%he>Cm9Sy3gP*(OiHE*SqK=RQXNihLl znHGaIrc5SdzNB^g)MKd=-(p%@=yafEl1Up`R55;cePrQ&M|HvL+^d^miyoOY+CF-H ze?nF@%}R;&_4}t<_SX-|KUri<@6@pR+hXBxVe-tO95hs4zxi`t{Q~%o)J&I!8Y@(4 z0@~`{F<%heW$JD+m3ZK6QS&xrFYmGS*<>q=`$h3b(wngzbQk+Ul?ku?k(?@F%7G$c zeeMp6>eTl# z9A$zWk=%4X5-l~{JLn=QJ^MFO_;~ju*vWb#(WaCc~yi%UaR%~MM1>HiBdeQ zr}u9?2RPiD#fBO1PX~v_VBhGgK%nl_S>tXs)i6HV-UOO7gWTl zgkLLDj*dV_%xTQG7q;zQv-^8Hs{QRTpOqFhJ&+PY;h(oI4;w}?mL=$(I4cM7J~n;` z7rVc=5gYHq>V&%W580^9h*BKO=nXsemZc^5I=3J@+gI)Tkih>i|9msWsx7bXQdPw} z+f`@0Efi_79zK^{k10-Ak}F-~kQbd2Y6A5hao;UbHDGn1lG_pT~%ZPw7orz*)PG zn@cGlT#m{?yx@>HlJ2b9p@0@vRs z>I$KIbe&qZO(>W&IWNfvfgx8ie=hxfO$ZK!!Diw450zX~GX=&Q{HHWxI?#=c(Upf` z6`1>@`nXKHM~SNe`w)$eqn?7z*!bX}j3M4?+$<67Vu27^g}B~dP5=Mh zN_Y4fC7rPktS8uMB!V2Ch1_u@0v(=#(#4#79RHAyCi{F}?Ku`7MQ2#OQ9Uwbhbu-aZKNHvLlF@r8MXWatrl9-7T#?{4ZYd}XPcYAFQd^YR@2*|{pC=3SoPcE__@ZM^NQ8MLRVX*4y_-=qrEy2XG&u+ zN9BOhtRUgj#eMO(MCZI-J&=g@nk0O=T}$_M;{L)Y7o2Wx7UtSpPa}6p8pW+f(OX&Q z?zk%U>nlqU;$$Xj!S+L^T4Ao*0ar-h_xlrs{!Y^SZFwBhXg|c2^64=a6*(cePIRyXg^!T1WbabwG4%;GsJmG(K>io$%q%WVEY>ucvEd> z;)kjPa9nJgu^3LZN)5FWw&aAJrKu6vxqdmO*^GdOuq-&|MR+G4w8Xa?U7fi7^KHDJ zqas~8p|kK6ANbmhM8V31{kZ74)&awwt)zFNh+%nx3p#6)(Ls4{C{&49B*~~IUS-5O<3fc_;H>ws9$Oc=p<>5o z@$4UW@1k&31_JG$2K&JMg}Gi){Ej$3)=-I-VkJ5b#NyO$Ei|4Ma2-SWUzIM-zxwnD zf*qe1zBB$AgYz|$alRs6;vV_YPB`nTOTv{Z#$_Tps-khUY&CxUjr}*m*k=?z_)i)k z?5o@@kR0lY-kxq@CJ88+r-A}(mMxX0KXXxsFe zam2Y$Q=U{L+|L(8I*R;%T6>B{Jikuy=(Q z@?LhsoN#*tIhxVE=b-kG_-wK_*vfq3nGi|B*k~wFp^N(OW#Z@I_2HNo;Rru_Gnz5x z#5-y3ai8M&w`BODbzcH*Ht5k^pMv=j4it+uagDk1U_K6Jd*Hs{74-q`gKdTc!eRpP zG)d&6BukEjpqC(bmil9k-W^{PR(hz9v>9{)$3^LWVlHx@7^wGgKJ&8*ny=Z(Zq%ch z7m45*!TstK;k0;J02--h@Vw$4&SyNY3~LmkFFuZ~!R|^k$^z*zQ_!>{O4#NZ!To|~ zWKTWyF7k_KBt>NlZYo#%nJa z3o14=79xrT8`waxcM$;<3y743?eG7dZwm`9#Kb?(-*%qo-T8KA&YUx6&Ua?MIipgQ zQI%6wtEOV^q8d_OrE0BGsa#yl|La#*saCMe)zwn}rb>0RmP%EhZAd~2b2+pBS1Bdw zTGX%We@+E3R0hu6d(ZZDsW&d4J5^i}tZSmz>w}C&-6%f$5ToMuMyC3Hsa8(%}BqUf^JRAASz-d+f~A~ z3#Tz@bZ<=gx<7<|@zl|XKfFh2lYH&+%FK)hb9=UW9^s27BYbfPu3bE1qxWcD9{VE0 zG3L|GnDyOf3Vp~|{jhcQJa{y(fV*kQp_HNC-tFP{hxKlO2}8Q!`lYk@+W!L_JrIrY zgWNDS-~$Eew{Ky_H-qrwNFNOLYJx3m=I4@@R;TDTBs5OPzrceW6FSbxN7^Hk^1t}c z+ygr34TxmZ!@efyH0*{%Xnhj@i3Q&PMCE9K&6T!>DD_$Oy_YQU+1 zXV(CIhpahA?XZK-(z8cV(e{qJWMab62VPf6ii4|PaGxODIF8ew)|L-G45XpAPDaPNV)f8y88jY51 zP7&RRqWn!JqoyEVr_*T*Sa+BxvQF{;>uiz|xo#=^yVd9Z;05&Q@CxP!2O=*g8@E%F zF}PPt4DoKsb^I*Xdh_`GI{yRH#s$Eubv1aksg5aQ1|mBvQx@EZ*6|PaYKHHJdcm_* zRrtJ93-j1#0SCx79Yhh#Wetm77dlhfABbMX<+GL!r~gQ>NpX#<45?v+M%@Tlu@Ymc#ncpKvz*2qt{)p|o*#t-$@1Yyr`d z=yLJ&ab;|7O;k9SAg>F=t`x{~N&Nf0S6lXh(u8_{1ox&DmHs2cm)ZCa_idxp%MbTu zaBFPV!_k=CQsho_ym93`$H#K&C?+yO%8~Op3mNytv`gmSi*qjRB&8%>Cw+N^fAr=x zHvR*1O&JY;w>K2}?#-UV-PBt){xT<{2Xw;1kU;e3{#X9{yi*f-xjC|vt7Eaj z8E1~iqF38$O1;%iy1ACcs(C?3zV3MbWgjc^YirNBU%g<8jLXKqdkdKp+OEZ}Wlz0x zQ_N^o=nLZ8^hx*{B311)~E{4S>Jj#5Cm2*O{a_(fL-$}#qLoo=O z8$#VI!r|T9sjvQ+Jo;lC+_}YOGci$Hl{Pyzu2%N^KaS`_8}-M@Sm_gq1i!`#6aUvG zjA6(1c*s4feafNN_%yr#ek%)?eC_|Ue)FVVT69^Muk81& zd@}P)@C?m|8_OMiKU}(Ngr=y-3hB)Z6I%VG#SuvN!-!kHj;5@uPpL#o@L+o_}L|?%iM0vP90ck&S#LrO~ z+g2kIHYMs&f3g}qm*zv{Nq=lozMmeeP0AR*jL@J?P#(S)+cKCkNwbBxuhm1ZH<)Cu z#lOq<@ZTKqDXok&)rl?18AgoZ_g|B#YWxT7uO4;s>W_J-OMMSmRe&Q&itoM1woRlz z=CYprm8eXVI@hJ~xAaw(ee@t=G&+;!`h6q$8F4Pni0phAXbYEEC-2hpztz{X){{p~ zq8%afyid3gWuLWQC%sbxP7VC`YCz6ORqh%)#X^m?30IDr!f_bWJ`c#_4+_wkp^9m)R= z%hT`PPP5URIueV=Jab~&>WJpg8UT6u@azU7dUr&h_i8B^H?XIid&oCmsq$}IyBt34 z%rpTW4RH4O5t2Nc{G^v}=8D8~mi!6*+3SLBd~$iF8sOH%b|y5!wt#X@wooZt2B_!1Ih53&l|2x%|;i=2bo^DX{tp%GgiPE02jSn|Ql8xzkH zT?qeTm{)@Qaxk-tm`ltdBu>zg5ZOwTU%sDb67qfo6TZaDM2UK2oqV4QO{&bhIxp9l zm6>76SLgBQ*O<@p6e5&3Oym`VrUdzUaG*Ex9MzQlILpLyRW0f66Uzy2BHfYxId3N6 z&v$|6@ESP~cudG4n-YU|pm&KCY^AKG_}INX8}~(@cmDxTo}u^c;DSkkpWw`iSny1r z&48;H&*8fveewNpVrXBSh~1Ck@(=6P9&!72Ah6&2Jj1L7@3t>twBJWKyeATxe6`4Q znaH!3zfXr3v1!=?o*jMy-*&apvrSD5{OE10UN{X8@7>}1WK1KC*oSQ%_$+4|E7Z9; zrWJF7$fvr^hOOtDa!0_Y-HSXooy^!l4&vhupzGV_^G`Wrj@rEX3Hg26)qpq8dTo7J z&PqL7Rl%}Z6XdLxYyo@uySJzS-}bfO-mGj9I*;ZR@%=C_+`E%1B=Um0Sm%Jxy@<@H zh%oeQU9|{Zao#@cd;hL&)HmgCWGDYGPs(qll{kcQj&6}(%6-~Z$DVELm2+8p`K>gP zThHXJWggASW6qDGDJsO4#V3>{>p zbp!8l3?uJCd+5=uDsHDFQ)Ea$p(-I~NV^kh+g%$K&e`PAet7&SgH=Fo_G283+Je-Z zHcB-+~fTfd-+9g;R~nQViWSdg--j% zHh+q(Zd@b%i4FbDg5x_PmfP&6YeN+dM2Y(?OcJ-TPfsKNV9&O;IF8WD`n>$7Zy8%K z>#1*tSCN`@t%&@x_QfAm&hl;S&cz>t$Yiyn6|<&F9TlV8`4FEP8?z&#aEx3_HgQd% z50iFEuFlOZBFodr|IZH_($?hKjXBW|Vt!B{<3VQm{W`ynwB#E_hAg%+ZaFdXoSPj+u45-;`Z*q)G-10C2RpQ9*FCH zI{T5hRhYz9Xd{mwW%9n$7RI06vhf)8aR+2RxK~7e_h#iVahNynC7nY~b`~z5Nx;7b zylxXN}V6Wy# zx^jVRi~4^VUvb}WrSpCFWgOifB_tBS>|*EtWe)mtkMQ7Zd>q#aZ%Eu%V$0%#-5Q(M zuAq^9aN*=p#WoX;9)f$5s_4F5uq}<=#72gi=QsU<3e(0B5 zyg)zd#<=e>n~iS{TMCb+RTMhkcCTPefCuOPB@1tfzn0_tHN=jMD`fqb{nQkqvQ>V| z97v3z7vI@5iTR#Cd5rhwmSEM~>C8iM@$?DB9@$1oIoa7POTY!<;^}zsUY_!PU%z}_ zDVMsWtCx_)7~`@1JF#}rEUa5HoBRCTc*M5${_G*+!57$v&|Eoxn)`%wTsjj^AF=>z z7RNXYGX{FSqqs>WSf8stP`4 z9IFBQNK7>=f#pR~2;+KI*(D#cUc-p=v!}C+V@d3=t2x#xw*CY0d%j=VvweC5V~npc zCih*W#$l}TG{@C^rW$We%7g24HFomOW=Tozcs^o$QSy?KjQt_w!4m(IIN-VjWj-aw zY4bByJ(rfVz0A{Yi6?hkl#hl}@(_FDNyfr2F~tapd&jZfvQ)FQXcBwgeaV1NDAz*X zFHOlbJ@HPd`9&i!TYtVw5&yU7A9qnR+_wy>PY8KUFjuG{3i9=ZE-&D!#cL3 zqS8M3Pw3pJ2eC1UXLp>NkCB@+Si-UV%>E}vY2m#rAI&(2E}ZW^eCLwQysojgx{l=g ztuoTddJvYCXEF>}O`Wh`iI*p_-(uUiCk3{Y=sDc0_l)SVBww+IL3}^@g%zOr471IN ztO6NRW5$s?F-|Xcjq^2-$v#IExr_B%G8eBWy__w@reqpT;v?&FUb|BkiM>DMoo8is z*}ze{&-#_e^yoxgi!G1*MFT0Lofs2%uR!iK&!((`<;Qf`LtlCO5x)$Lribir1tH&u z&lCq1dP3gi>-Vxvn6O=|$Ra+;o#U7lqeCKPk+I~`_e&ms(}?MNbog*VzH&!EYh;%lAbiV2#`nI8Fo+B6k&{R6ki<*QNbuUrmX4t=^>Fc2=**F7qum zC3gp0cz2)y?=whVoBu^-@qfO{3vh^c!zrtV^t*`Hg%5MlOJzd#?ehKc7s7TXRGKV* zw2uA1MocD>_)eH)zGuZ~F@o=*_&XoUD!JVE`1gJ-Vy+sHr8bEjUnagKUM2p^boxie zLH_cc{1!2uILkF!lc(h!D*AP~*Ccr!twG9Je}?#qc!Q|$NBI4jG?Yos&KeT^h_8uY kOWv1x1LA+2%zvgnoP9er;M9Oq15OP%HQ?01|1J&uC(9^5jQ{`u diff --git a/frontend/public/logo.png b/frontend/public/logo.png index 4c080e46ea188d31ea2a90f29fb58b3222b3b863..108317171a7ce3ae26c2663ffb6d5205afa07b59 100644 GIT binary patch literal 104640 zcmdqIby(D2*FHMT&|QLb4c#GK62j1-#1|2e?hffv1O#O07AX-VBt&um0TBfyM9HB< zP=--aMyaz0pXYtv_q@Mz&j07S^ty!4=d)w2d)@0^Yj0D{O!TP8S;-*~2o*wK#{vQ& zfLTrqUl%4&3C7fLRZ@NlE_y&OI5QwTqM1YgCw`&OZ zO;>kMKQ-R{o&jENPZu>_>r2K`#sS){9-jJmYCSnG5AT1*CQk(Kv_~UJUmC$#3@4DFPINM z#NRP=T!Wp1JOe^J{r$M{V>;dR4-HY{69iwq72qmq;Tr588szM%8|La4!gp>7yj_$LzE1A0My`JD zAs%YHigI%QwDM{)7JhS~j zKf~Kw*~~M-)yGE1)7RB67>xVhX8g}%+yD0X-zzD71xg8W@Von2kdCkMm*eH!fV7833h zQPa4P)IPr^N1!Epc2o0I(4(j@Vr_wTi-O8&3a ztDe8`-(nSf_xE>z0|1#w{ui5oAO4GvT>StE1p&4hx*BE%fe^%b0>At(e?TBY*`e7} zqB`b`V;ZvBa#t8fhHlbZd6+SE^}hiu&3U8f>16wBd8WSW@&uuv25zJ5@6kCABZ zY#^p%J*Lkj)PYol%lD{*LoQ?Zju-AOMWN6+zp{i>DnVqQF!pcv|Y zvMv4%pH|2M^lgJ75Vd6dUxK;D<`4*k8-mced^Mu<>+`4XDugFONL#b)*!qinM82xWOvh(H;au^<)OHdHmnqC*5y3J{*N}qd@4vzao)Eph_Nr##(q=Xsv5+SQ<3~(q-j~c2B;8t$ zDO1oz1#ExItGQ0Dh;3Rehf?={@g;LK-JXhm#%RWE^vg525tei8!tw$7iS#x)uNXDb z5dGC?duqXq#02`IY>W#1#Nhb>W>pk{Y!|g5Hb7SUR>^ieGk?WTI_8_w6rpM$^qHG6 z`lu-)ZuZt{nYAh>A!hgZMpH!8AN#nUb1SubPu`d^rTA(gK6J19QlaHq0#%=rm2Q{S z4_R%;&Ca0$uWI}$5djlnX)mqE%et5Sp~Q;*L9ce`B2A1Gq@kSd2Aqsj3E-fEH$Bt zK!#WM{mm94|Hl>C{`Ia5}iY;~x{20?c-ejzpvSxf1249@!f<)QOo9OYvA$xHs^vkYj1GfnnyIxN zh6vY3-)(M_QP|#CFLNH(kl+#BnjUQiL;Dq)zT`(NY$@l&BqbyI;P(ZMzHE_>1z4hZ zhJM`PL`!S2M5t8aazcU^lAT{Rf1e!6;n%8+I88g8qVJS8r6+%}WAI!qu0z8N3E%0% zyRJPcwD!oNH&|5xQHVLBt$fSImm3dD7VgjB8#qZu3^=VQVZQtz_Vm7VYdaz^PfEPY zz$SJY?qhr7Yj3Zn5WQ)Ldeg^Sp4P8w!X^I!VCyL~-32S;Q66!iS@Y|^jF!63&pu^L zm)18pIi@;$Ytc7(M+323Z!AP^O8W|BnJg2KYR2T}W9kQCR^C^!7A~-IMgU;lbO!-p zQSdo8W+%Llk~Xc+39YX6&KjVT<7@P5Qm1Zz=LOU0$<9EoHJM7vQcQ0@7~5t0r(JR) z*4Xj!59vz}%!LcQ?8^T^!hOl`9`CFN!A16!FE{dtY(n{tvSbvguA@ePq|^HTWCYS+ zSBs4y>B7+a4O^|tiZi#=mVf^wa(rwdaqZ?SVFXgX$n^mnA^rU3bn~+x-4$kkmahn% zX3}S3F@i>i8T0~2kt)qmovQ8CWsj*E8PZUpD@tzHc^GeB7-HHCPEHJX`XlfQsyinc z2@j;*gPVML9CfOvjjHQ9F47INC3?*jCIlYq9F2v)f?5O%3GyKWKCU_cnz(F8a#$r@g_vw) zmDDM43?g+!h~SVm^Q2Z~Ko1$#CSS?E)RhyE&@vdY@$wtd5Z&gph&s9Jk8=&Z1C#UM zo^@@Mx$qsekj~$n0=Y4|LxC$N$-*cn^veqX@bk?GA;LPc#SCV$5wzHv#E^SJI+%a& z13f_QFdn~QeUltASIBZ=^pqvTp<|?nCpGat+o3Y~Ey(t^4pN5X(4n$qN!m=7 z3g{%g!EgrEm}p*5J-wv~0@2DPTm@13(^wK%?BeBns_KS{e$llS5@nf^<#5De5?FP81K>jzwAprz zrqD5Ya_T@-d=HtS`tg}6V!?hPd1p`;eQl^6U6LFWz|^H*2rq5SHSEA6sD18uR3ABe zNm(zJA(@}k8Rd)$99oVgA)SehBD?LVTw4g1)_@R#Y?IlgOVSw(S|@Ci>1EhyHdsh> ztdk2Prk}U~2rj(;KJrb@X=qSr1tt1`O{a&)tFTJIN zOxU!>h~;5*&603)47_#E7)$>lUYHjLs+-Wh;8y&IE~qPM<+K(6Sen?bD-h=y9% z6_lGNlB-4>G6o3liybMFFX?^wC5o_k<^}O5kYtd*U`?8i zSb@Y|6)t$co-TlxHhl^J?fV#?$u~(S)H(UtfA;nL_`-+cUc(IdTxS6hN3@W9L|8y- znFL1oHpz?RBAC$Zu#mWP^A!*Qz(PBpLNm`WTU@4R98gXubr`21vVF0gv?O&3B1wzk zEG0Cdt0k5kD>O#78{#+EWLSrrpzr*H;mM85q7#592oM~R9YSkwrU7S#&2TSW>N2v? z`c59eiQ}vkyAELj_KC#Da8DwBw&IY?Gfn~ww-Mx%isUnbLk4nug50x8*iLvxW|_pS zoHb?jszza*QUI~=93S-7d3Y&d7em94`A3~lRbPlO3#OJ#HmHN&-2%@7iq*+0AkmCk zout>q#vq8GFj%`4?kS58mecI$z+Pq?V)^92ZY+ERhzO4TKspj+@4dt#^bH^a8}IykdMxRL2i2 zB-FT^B|x%iq0Fte=XPK>rN^9z(srI@5@a!SLiPo7<5o@t5fn{Tq0KTfHuy2KI zhM{k05#XeU?Bk0rRsjp_HB=9ErX0`-u8ly{4hbjX%K#J(N*ak!o-nzc9-|G?352lKzN3?67_hSHM@zR2wD7ME7 zKcMU-C?&W7y8#%kU<07ETN+rFF~@{J(ZB}!ofJzLK;y(4K$=Bh2)6FLaq$}^R^EwV z{0Ay4ekL!-Q-0J3S^dQk?88pXfqjZTZQzLXkYHu`R*cx>b)ezrD-m7RSXV%&SJtgT z=(M%gBH=OIz#rWs%7>6oKrfAOWiem~ddmXjx=8e2;CHh#+7W+Y$b5aCtmJM5-;$(F zeXijI-tG3c!FHClz;?K>{Jov|TP?Z|NhNr%VBSI=Cuh8f(=KE^rVAK7BH|amfkzdYGC%q*-*?wWUIN1Vw0nHe|g!8Jo-c9Q*@;8a^5Q9h&egIL0u&nq|AiELS@0ZX-e<1!w@?dt%+84I1N6RQ$0X%`Z*r^*(<5f;pz z1hUD9L2FPqJOiTj2e4GNJqoP9>9RXHR$`?HDn^eXe7zy<2*xjY2N6kDAsV3QCGWi< zT(ENYQXYsRu>1pcJmWfj-#1KFfsDngBwR0j4$8x@2l8vA-v|SW&8YL^=fQGhCmoUP zIe=ECdqQd<`w$EXCow0HIvM4QA|UiVnLS}YPzt0q=yVhUeHG8?g@(xPa$tS}V12>^ zg0Xl9K_gfuT_&*|)Bp(|siG1i@TaXMGKHM6L{QkY0myyNd`OHuil+{ps_+~9eL@(M_)_<-9}E)zx(Xp!M=4N0T*;$bMWd+)&74+iBi zOsXWkgsK$Buz*fLRCu5+1Jg`5Wdk-%7*77)tp9=XSlZG5e6u0L|DYJL#%Nb9CERu3 zt&4bXjp8Tp026ScX|ar0+o7BHRY+$N&S?$qnIlI=p*Km-lo`!|QxB-Oka#l6Vub8u z13*=ozMz-D1yQF4DuX=Q|6VItQplG}@nmSFA*OZr_#6-h((kV#+l_%W7tECb6G2QN zS)n&LiLPwC29-y(_&ihuMUm_|I6xwxswL+64CuCYzK~AnD(qMet5`|dOZ9T(BHl3H zykUl#ED^8>PF!To^mHARX^h-oX3M`!Z@5IE5@s5;U^s5*r4CKY}uet^H}FpSZ8Qo=ZeZ&&^@ zSG{)#2BvzYizL9A9((zL!l(^c%I*zc$09S*Q*kW)n&LOS?!6~l2wxTf80+ktjEN72 zoh1j*pof!>2xO&4!3WcmPl-$6Mil+j$F~44iUY5<{{}|)H7q-Vq$DgR2$GE@43JjG zyPSKqz3mb(`6&~Q70bSMWAL|)B~a$Az%YB8=^M5~R%l7OS16JMzScYVvHfNUCt;E> z29yKADhTc;__vM0F5AWNOV?7QKITFHKv^mh0TobhvR^s3oA9uo0x?e;VuIJ27~a(1RdijVP2Ni_mbo{4(Zzk4SkvSVU4l2##v#BoUt< zBk`|`01Gb5fOT-9sfQTRf(a?{s`u0INdg%nI-8IVa>{)C0Kp_!&QH8iF5us%2k)oE zo6>f|;@CfMx#O4Oncg0cK(nD};@#t!MYk+OLE0h&Mv*snr*A2cBExwO^~GmFj{@lN z`|L60=+d!~`F;pM`wY-Fe&u^!_}6va=>cLP(d;;(0IB!*cc*{7#bS5bFc8UR*gwcLzX7H{qTEDRp*sZ#(lB|>@_QS2;lAs{! zh~Psk)B~&aHRFriC6hwvG2@yas!x;mJcCVB&vF})$0h~Tq47O}Ivl;>8kT+fXUz(GB16+C>?ntP^C+nsN<)0Cdj!iot5^fg^B)*z{!Q z!9!@&zur7)kH0lkjiyP^An6C416Gi2W-sAi76NG;l0}=Jcq|62;B#&cWxH@So#$s5CGkYiyfOW}fIFmk&uklH<( z?%G%<^ad&?*%LJ!=mzYCY_IOh( zl7E?PF#)_e43_MPjs>&`HVM`K8+eQ<8E=Lqp>f2~91%}Iq2_GNFKm^cFirhVi5>uj z4hP4|1#q8(9od=0B!wtsJXXe91KyVbU|$C+F7&wxnW9!9hOv9@UN+Rp95ANmVg z`3V-xySee;N$w?Ft2` z)ZFM&ucqlJYxCv_WEdtu&RPFq3u;W2S3!KowwO##p{2EEzvWpezUUNVoR z#A^_g6P81X*Ns8MOw!lO6`k_Pz=o@jh{reY=pRzu*LS^Z;Rz-mcPSPs;x!ORMGDiW zy5K@{xfg_B4C9BAu#ZBp#df<&S|5dy_Qkc(hIbE^z217sd33P0f4Nkgp`6hn@^cs3 zvCG@Bb!&HmLhilwv(Ez@i0LB_m?4O|0jlGDiHq4`oD-U!CA&UkDldR`T+U**M0rN`$q2TnK8=?Z>|WD&Ch$hpZ92Lp0@dto9KP*J#(#X zS$&JLb!Gok#!S{{i-BYL)n!f8y+#1Zrl>=JBw2t?zx=Jl_Kb7Jlo-lKPcg_73F7Hu z!NQ#PGO);N6esYL%O7F{a1w^=p?gGb`I`CDBtD(gl^3E0gZ9F#aRG~hqBa6yudI$W&J!T%ydp0(|wXv(b zVgIo6sitpWe%?;{RmlqH7*F*jR}Up2L`gl_b?)56GlB@v0(t_NcADxNOATWih!&VC zc{K4wK{3*7_?{!!VRzi!6}6)s7FPZoHUZi8g8n{|o#hh2qP+~2oAaKR*c#uMwkpex zFC5EtY$?5G{$x`!@cPd><&!IFn7hb!%UOI{gZA4B7nElxWmSIxiEX61joXD0M~^i` zIVa!dK~{4J@@5<4?C#Wr?-K-(WWG}gy8rbp>Bl80fHdSs&SLWSWEBzf3R@81i)#f|MWPjja4R9-oiRih~VD231mzK9f(Kuz= z+9@@>d!TFOCh^W|c0E%NvD`>j%FCE|W+q(Fe<7F?F%RVS0>1L12O^jiNA-Y|@&zks zh}F}NGuE%fM*iAlQ4F|udTb84AEng*yvbAp}y? z8oe*Fh1{5*mIwY=zFFppS_GBL5)Dr3eyVH^+%p)C6rO(00|u0~=}J0<>Fq2>-M?ze zm3mbf6VZKT&njp1kH{Aa*{hNRZ>C3NuZsG&^(z{-eR^nw=%)5{ybwWzvmE-i23o7* z>HpOD0rrNKoO)oA9E-_F%f)mC6#FyAG~E)a?9&n?C5Ro}dtz4gA}lcxe( z;Mm{hc6?5@76mf;aCuW_?Gxlf&=krf+@7>n*dO*xk9{iGh^k8S+ZtbNh{e& z2N~T|5eoPyn7n?|bysz+{>STzTN!iD4d4EnErHvEv`BR-B6hXRWe`(n(i0LtXDrs9ay3k&D8cFB zOUW;hG<)(H3nGTwrqXBcy~P|N)ANcD|AaOVgVP2xk{f(Wd^l#5@IHNRXXZ0|Lxo3{ zgr|&H4aflD(jB56cxVMM^WxNJwXB>tEZ@DQlZ)D87@oNqQ^wz}_WOKk`qk3_@p@;c zd^-+Ya}v)#?c(JR5JR!U_0-G)_8+6)jH6h zn1T(M*wFJLc4bnp7Wc=bTvQHH07h`fzAe*1_#3}_^3Jcr#-Y&d(`>p}S%u@yx+kl5 z!{0%va}(ldqT4`g|DHl-yDZR{T%ZNHPs9m}CBZQU$gSvr-qZzMy80D%KIg2K?WUBS z)wtx4Rn4W=cF}gv_g(IjI>DTPqv_j76B8$X^pDj=IZCp-W;}C|5YG!q7ZH}a#js;-rj*JIn{eY1eCCFx_mi-;M=YByPGd88tbb$ zUW{w*h$xRGazRc>ah{H1fA_(UJivUMdfAsH9laR%=L!YfVyDa5vtUtCxir2n^FH#zx78-EJF4?4(wS$w_E#A&9s?BXRIbL1B>uf-swIi z5Hqf4Nv3W4{en9zocsp3cD-*Ddhd^R*p&3A-U^NTNM_`TWOR5fy@PwI7(l9$FK3uP z(6GK3)uybpW@=ttf^NH6&j;GS3>et43^oNd6VC?+=6UFn)}IaioudBgG^O0_K>!I^ z7NIv=8a?7^Qq&HYnogJ_%@emI0P4Nk30eLf5gAkr>Ll5D*nf-M*?VrBtd6jT4R9a6 z=XA&H^u!QdL651`e^CUKaE!&r8&@!~_l}deoHomOKPIT@kPYN|AEiCK>r$K2pA7?2 zNic5@D4xyS2XK4)G%1b<4Jl|NkinAxgS#dxERXEP!IB|I2^DFF}5xL};nNPvlX5Zsy94Cg^n)MMg~c*%{GM$^Qf5x?B1 zZiI(s2pQbxSeW>%rc15)<@~PKVDEBo*J({l#I4VX*NlPJylj} zW%3vEjB2BtZF={S>6o^X5On<1`p&5JEtnCtZIr8lrAb+_iP^1sAc?);Ky*$sX1qAfrevAy9cSktDt@UW2fo@@tkt9(?DI4!o`J>+_Av)at(if31AuP7M*j zm|1*%sDm`}qv?zK1*7}9n|MfS0EQ!-*H$Av06{hfmf5YWWS*r|z^F2zxhGWSJD7x$ zgq*SBc+ufm$XQnlwV1CxXJlYdGGgi#liUEimUbS1fIg)^ha3VQXC@Y|-yZG0{Q%yV zlA((ni`QwA`t?s}&_lXl0elg?APtBti&lVO0IG`kAi|H>r8j5H=2)6I-7pPCuT?zs z-{dymq@tPb(KXkRS=8QNQLXpk%9wKnp8D%1Udp>m#7jgvfO}m+gKqM?ziM$$4A#L1 z>J%2VIXVt{O175X3l5ZZQVBnV^gQFJ)KzN@g3(0D<%sC6zHJ0;-Y~ zJ|Tp4_*Uy042<`2vejw8!)v~k^6ETZ0f7UxI2zm~NACY(+zifjv@@6cYK&>OkWM#s zs!LjVC7n!Cl;?XZTf4%iw7Jy{h7fHO3`OABr>yiXvNyZ>i95@qra4Akvn$+`^B-fYZ4stKxeAsO|7W5+ku4saPH9z%%zn?@06#3A-=&a5 zol$_cqW-yf6UjD`j`+$+t@is?5Q$$K=~v=C`8R)*zx=Q~*WsUd8`>_s|0H2)S6=nJ z-+)mUZpm_XxP*Cl7j$w!lfYa?_vd$|f;9c)u`KSe$*Fem&w>^Yi0Z zhxQ`8i1}Lb;|thpXi3p6q=vEiyx|CkX5=$)v|RzZ(2`_qWyekC$nLAT`qLE}uPOyK z#?X~L>zP#z9ttImMh=dcHwCt3Pt5Rbg8W-Vs3}SS zijn#?&(IZ`^I~bBX%m2cXA1gCT?a!7YBFL7u0}4LE?UBo7I)ZMn=PNfpWc}PG(W*+ z!YW~GLCXjNIa>pG^At9wc<{pgW7KvMuH8Ax^V05BP?hXV+liHzIDR{3lk?`fej0OM zsOVwbD$kv)Wm62=cawVMO1Hlw1HJc5`yw#iw_nfB5_fW@E-!kwz;{^X@RbY|{t&Sk zbO}O+RU_+tD=i5*p{L0$Vw;^dFn}QgM*hzq+bZ}>W3tu4*#*|9IJki05De84)e&h^39kl zGK>cV9TQKu#(AWdpax*~V{SY(uTU1D01DPtKz%ddyg&nb$|A+;&x@FTbNAsnm4fJv zG|d*;naS9D0J=MN#m<-mL!+{Y{E6mR4WIlctHn_p3r_?(cA=t{%r*|Cl^y+8a*c9! zxO(~HDw<3g`SlOCUQ%Z~mDhOlXDDPT8(z<*lUy}K1H~`lIsoEL5K3P@wFQre;17@G zA@Kikd*>y)r>K~_E(Df5{3zT_olTJHL1 zGx&P!&m*7&Zv)lZZf93sV{7N^i;)2a@MyFG2&q0Iv6rE56Uv5zE>hl}Yv>;4C4M$R+P7_IEu`053k z5DU|)GtDRWUrnsK{W>sgd~;)gDV?{tF)fC72|k|wPO z?))X{h`cFZ~S8yTegc!_o*)vQlQe^}1wJ)ZcQ8!WHhhZ3sCcHI(`Sd=Au%M-Nbh`8z(8>iRZ} z-=mUyp!^7X2?O}}p2q7+nk?A>to+b8i*J2c$ray>Ekl3vTWc(M$glq_rs3H4#}D(Z#)F7(=Z2Dkuu6P8Y%O$PCZW-U(uYq6F(X!O-JxRLqIPQ zV2BsMe*c{=8osmi_&o;;qZ>D$H8H280 zk=jq*Jmv}~zjY#fLk^Qqk6m8y-4&f^G;weV{YC$#BQK!Bv2zT0ivozI?q?NOSGh$C zrf%Ps1;>#W2$ayVj&LA7L8deA@w8dYm}(5cUjRm+Il-~PfG%zb+(08h?uZ>>;u2w5 z$L%Fa&urQ{C%?X+FzWjgQ|oZVGm+!ox!f18@OatFqCvuEgNzDl|dRejx%{Hw2$f zo#?TvP}2<^aIJ~m9Hhh-gL)c+D?MC%2Jm&0_NtCWaWBKR*L}aq^9uTh55~EkDg%wy zMi<`x1VmZ0#GNC;ZHbx2C)xV7`iGzH@@kOy=bej)amuewu798%TerLT5EcpsFlW>< zfLINP=-hBp5kD~h)v{ES1JUUvEG-kb$WjHLvHi7t$OEK10$Jp<6d2a-=9}?bw%P2~ zHx{=Qp|+53a`@)8O{>?l;@SM|daKFSekt82-M~(>QzLdl`1azj93xj7#Y5%2+OgaG zJH*wb>2mvoR$$MPW2JgMrLGU;-&|lwIOAJ;dNuBOgm&Cbya`hmaZ)4kQ*cD22)PX|G-f!e6+liw|oWPtpoXR1W?$-lxM=>?fb6vPG9J zGd@Q-wRJ4|0s~*Y5q$?A#=m9_8zqfk`SJTT*Bsnkfnbu&X_S0@U*8=hhm+$aA9Eev zGCX^9JSX@5Au$3b&4pZv?}_gKO3zSw`<;X<%cBw`xMl(bTMSAP7DuU?CVC3@97DK8 zzSO|Uf#!zSyQkv|draU|;L}v^t69-i=iNDX+p?mipL&VS*T7MkmAxbI+?VvW_T4X_ z-wbLe4QmB+pw?v7;4*4r_KL=BolN22&V>~lL*n5kxpOdZ>~B!&I$Z4lSA|1|K^ygM z%Y_{Wf&q%9bOzwt4V`f~ECsWPO&I{~d<~4Eia|sF(e9h@H9D3>lzdAK?Yp2}^|x-u4JiW!H_4bM&f#X~8LiJLreF-H;6a zowqN2_Gw~;qKjq07v!e*pK5K&imJhJSkFgpaAKDI>P49!$zA z0Vo^N-to?aiGqpAC@%Y6n9#I;CMp0ui#H?wbY7NRLw*$dy}{+Q3gZ$mz{ysW%=vXZ z5|@-ZS)h5;d%*F@r0?bKSAIj3@qBG-rvZ=x4Q&OFteN$He$qcY_|Kr$3=< zBjj0F2}p9!XC$RV*KKP}RSkix{wL#~rSY(KkOqBkWrK64StfVS#wWaam;_xtAX}dm#_riNt;8mcE*LBghUI}QxUj@1D$8tJQc=6?mpx7e2;*d_ z|1v01L3_!nRiGWX5%9I_1&0=0 zU4_(__jgr=W`nF{EU)l-db7mo`!!@p8?R%$6wgIKNs=l&kKVYkJUR>+(Lr02jwKzA zmFOcw8u%?dK_xIYIHsX1Q-~QNu1H=v>9Y zj^#P2z&WmD8j$=--wzaHs)&YunDteJHH_>U-3DoO;=o(OF>Ia4%P^RUcexgSI_(ItYDoUo&VrF(|F@0JV`bpRP+CR}?;*4UB(rKTC8hez zyvDRJlm=X7h@%jM@_Sm}r6&WO1F%hId)Ds+|NIR7w5mF|RWR`8V0;^#Uldy{M-haB z|1@#g_g48XIPYSr1?b7<_+ThA!w}x?D{7!qEz{R1Ic44#ErC%4cOQMkE<9)cJaJ*P zJY366VM4}CDxOo%R>eKhy@7&8|}l6O*GQn~2Xirs;%|X>aMilOy+bGkf;+pOEl` z^jAk%#*(*v~0CDM!_$g_2?ve4NH_7}!4x$jiik3fT}5Bhvlk6^nfM z=raa-Pp7nXa^w3Y-elUH8VIKaN1|@OreO&q;mB>|%?A(^v&T260`yFOx44B?>u&D@ zH1^LUPkYnA6Q7=87sd%0#623>=ygcn(Msh$sweqKMJgwVUy;kU_HuNzVn=912t<}n zdoH9%5GS1W_+d}qy)rc|UKzh|cAn&ym&nbauVI48@jB>LxNdWTTUuHBnRE2V5&}UhZgL475$-w$L5?@RED2 zzYT0yia~m*=GvoTzwq{Z4}{1cV_rO^ykf%9sgems6Cp9%r)bxSPRNg`Yzpi7aaW9Q z1f{y|PZb&e1a$^s;<>E}mc>`!gwp&%oVM%skwbv5@QTbOW~@G2U(~AGXPkNwg^;@T z?ruQHqXMiZ^SB4;jL|w4XBL{WyyjEqrA+P5<6I`FpM2$OCLi#hK3`~+KlNL>U9W<0 zhZnc9Z#r_8d?xLs!$qNGG%;PIJUX1_p(OmqKS;$^3J-}WC*)GIXl4e^>?1WIO9p?@ z+@%bISr9Thyx?V_V!)_ryR@Xd_#o9ipTf7=Of71#8g#Aza-7{g zh4p-19LO=-XL+6cnuu{5GxdW|hP6|r@a4_?Y`F50VOMj`2YrovPqdhjN$B|2$4_e-Q`GGjm16Xp z7ASaL%$g?zJy>A&@ccpa53$Rg2RIoE%Ga`|?;lW$afe>QvHsoO_?mEa*th^W>`jX##L!(`U|t56uL5+OBoi-eZPFfontx|^?GpP9 zE@ykeyIC}g9D1ZYK}FPr@i);rj~e>Mz#fOU=2PKQ#*9#A=$T5(?O9@89$?Wc??Tdc z?H<{8OE=3u_$MC`?Q?gqDr)C9)|hxvgIo12Q9dKV2xE&FeRkkb3`hN~#BAx10_NpC zUGpECeKxw6--Wz(DSaoq_t&Zu1nrQ#e$9!>RO-vWM@7|h7-2u|O1`xqIIciF(dRKE z<@uhE`DNDT!EyW2t?3IMHTkNPT&sGk3E?{$UFoe&Ifbc(%i}tnE%)HxTAhaa+ySU^ z?%k`3B7eI~6sA|gl=kr9uE`x!PSjo9zc`&lc*O#z#Xf3?nFX8FMgT{GP<$-;mLAd% zTS{ky-lpaC7fws7YfoFKDS2yuqi4fNnu3o`a49N(C2OTJd{qVSOkP#DaH;GRBfiTa z9yiO;A83WhyXzot*4kATaxK7r^~)Dq861RTCO&+9379`00)wHl{bv|5->k2dsLO4hbng1+6byEzl=B(?%4oQ zu5Je5lA^d+E=0;I?@rI6la`?L8ZavaFe|Ct2X+9nN5u8XvA8S059I9 ze9%Mj$nL4IU^-Q8HXOJVqt^TmSokI%OvyIjZDDRFQ zHXRG^GZPjlB+lE6qzQ6L*h&n)sgbNkTXYQP&NSO_?6PVpaSyiSHTe!`-VT2a=aCq1VwD& zfYSnzRXSs*zkDrsxy9z+cL6SwKi>VCiL}Zua_K#iE9(iD3W?^*&u&+l&IP9VEiM~@ z!>~P%9X2R6A)&UfYwAvW^_{*ulH~JF4)tK8yDfaE>cyR-w|(lWHP@6nY;?@8g%lLL zlTAs@%KCt3nD42?xC9G_2U|9PV-_)*LpK1c@c>qX62`|tJE0~~3}hfJ5vDy}`vFp6 zi0tFqMGnCjv2@%ADfiO@y*rtEZ$26i=5QpOVKaKVz(TH1YJ`XFc3-hKzA$%fs}%FK zwykb;w3=63EZs#+%cqOW-HEJRW?(sWT7r|+wQ=LovUD;n@9JkwKC?B7_FfUTJ3mT5 zXe5KsK#CBm6Gl@BwJ2l*pcqvuUC*8BLn3Q`hv^}>CU`knYmSoUKWpGP^Rr7RzK7U5 zpEkPn2hL~s^toLy8FOF`4z;g(?|{(tBvU&{3i(Oph)8h^YZIe?7f4@e-g|+dwEt!g zLrq2^Gz}bEs43Z@m;oGXAQBctgMjjaq-N(hTa|KJQt`_H+&~F#C_(B8DuJg6A>E55 z|FBzJbqmjJm(B?!rhfMBGSaQ%q%Zz{#Hrie(iVU(Dw(?ZRS@^IS`n z7mW*iSSDlhb$R9Pc*2F7N-`e1dssKSW{arV)hos46V={!Es8stkb_X@&XN9n#Y@MN z+>**rNWy3wLi$SO?kyp0(+lg-fF3y=*#fxCe9wuBMF)s65$|tSpC%hMCuCBo4`+JL zOyPVyfGElAX9^V>Qc3()hiWfP1e9v?yxa?V>h(>FJ{7JJb<7gB_c4p7%-Z&i96e>l zhbc!#fjo-*#4-w9pxo&ASg3OD-Il&dcQ1mGk8{juwDlg`O(ww=-f9G!k+Ud^V@TH$ zn=v|RdkA52{iTeLvaC2v%(JI~bJG+egeKp+ zt~WXa@>8dn$T4jX!}fw)71N8x3AF`(nTLKPXXjkiRm*pUYxHB-F#FsxZ;eB`G_D;` zWJIt3@%OnoS^)x){S(xR0I#+5q82&7v0a=)wa_Ta&Dti_WQHN*{s%rlqFB4Lo?zB5+8rJ_(Pncv^ZCC zr+SDf|8|iPT12Gk!Q<0ojb*vi3~H(Of%n#ONGyU$v-VtDPGEO3_nmvc5CYz%Uz5IP z1D_)hVyg#I!Qr!}_ydqt_W91pvN2ra326(U9 ze+lhn*rx-goG%r<2Vj)-S$ss66@&1CJqX7M*T^Ow%FB_N_r`0#!*{W6c%!{cf^#Z} zL;Eg{;HtRN&22TYMB!r%z6=|+WVu3%hBsYFL9r14;{Z5EGvyq7B*`$|Ww5%|O~0l( z^uqSTCmfJKUE&+?JCI$jbptwnTg|iUW;ta*P-~+fHIiQNzqWEF1#pAn)%0V?^vHKj zZA4O$@B9Aez>A@{g55f;ue?u~s{Q&|g>DB*2;Hq*?G$cT5Pdub;{GmK&8Pp}B2*vc z#-o)M3&d<@D!01Yi>_t`Rk^PPydiK%FDxwSl9LWQPt`I-Yqm(ws z9*uYq>Z#h~P820lMrHqnI_Kg>uJ_-(I*vzG;Q$Q4g2@lX5qEXmHPVwO-QyxFz0qx0 zQ(X-!W8JYuyP=gtY36gE$)1=;LV*jG1(YR~e#-fZBitY4Im&1Jb1Gl1dDj*h9-L*- z@CyeLMQ>^x>w%(};Dn@ww0zuvL2zDY=ev9$Y4ZEWP$w%_HD>|Qg{2Wx?FWez*0B&o zvsZnyxaiE9w|MYC(8`!X9gOyK8uNrFtbh6}xp@uxfF@h~F@*r(?F@Ru=k?90$Cu@sgg4X;}M zk5?c4lLVyo_b1+DiNasxG0$#DDW&d zo?`GiddD3-9H$jsk!#YXN{Y$zL5SvjeuxPG1&xnidC&7?= z06Pjo2paJP_w4cRe8ueMVSD)W6Dq=}wSFCZ+DHouzduy5;u3++58@3854%)g#2%^> zc{P{PFDNZ{ZgIA45QZ}1pp4(#GVmQ(9PNnZZf+O-cf^O=6|P;JiJpR7*dag zYV?-=`|NFBU4_k1_H++wgT47=n)&1$(S;RNa`?Bw3Zzb6rKM$eZDF)pfAd(ZXl{=` z(p8ErlK@fv&}Sw@YTvNOqe3;<1pzPN;q=+s9qG6*3=GOyAT@EJ8z3S;RRd2YmD;^z z8KhKmooD^;{ziRO)l3Yglvr*%=YQYq#&%$pLUduiz|LTk#I`D8*b?+pVGAIa43@z- zsT^=HJ2|MQFZrHn&SuCIr0NlmyavVQH%{FYnCCi>#RfExX2gHfMV-%=LguV?A0R0U z+L6xO#hyNl{V1m;HK_lv_i4qWS*PJw8TcWKvErL!uGVE`Ul>_(TipG!+Mg??iZFoF z`V4`7!B7M^iB5+xPGmjJVeLkQ>Q^CQ zBlY%K1BUP1WWAV``xD1wfV2HUI%cSPd?8%J37~k7keUX1NCOrEq^qJ4>jqfzIo{jN z%!|_<4K{*W#nzPZf;;r@ugTW)6=YoLiahKwjYKI!ax05lO9JndWkK=da;LMQ{o7ejoe6cpTVDMI!atDhJ62z^=B=M}PZ>c4C@}CqzN; zSa<5Fou6=g`&Z#u^B9>&zCYvza+B&wR*}`vyYh`|1W?da;BNkJlm7t);rm05xYmxt zDi_lY3MI{PSGE2$qByvc2yBU)m+0uZoYQie=WB2S~!qg{cb+G!;2u>L7kbMc7C@u7$BO>NHpDFYX}S; zkb5f4@V-sky{|JYkhO_292?#u8T4PG zdL;AQ-Rt^|B~RUl=&eOUkKPo<}suj)F*6EMA}I& zwe}dWaquuR$bkZGqU?;i+;+&%Z*B$fp{E{ug@MmgWqk(9@Z*&(Hy!3U8Hh~RhRbV% zw?pR6men3BqMJkS%q&dV%zI@ZSFP0c=p!;|rD|I0GIp*{S(1Aw9#apA=DQBvT;amK>dC!$npHUt@8x-L)Tx%FDsMyL(Z%Jsz_p#gQGntblnR ztg**aHItori@m7Itq6g>Q$O=KG)Df?-gN!*F0F5G^8;1;mPP%0?bN^K*lqwB{fE*% zT!#ovPMf;ZA3p_*_lH(zjSLP}h3<&!Zjy6%-?Z)9+5{aX*8~X3s*{j&GvS4NSRQ;# zy%y7^jHStJ1edgqm#3^GDizNa#0WPPHjgk>jYuhoJK{`@kS9QsY5A`4#=?&zeJA-ppaLgspPd>kAuqu7^u~P*wR8xiTF6VevmiI(%A07M_y$GD@ z%c5V?o46~25{4lTM+VdWHtDsWPw5#@A0gC55PsQyP5eMyz>56}LAQMVU^@A0&k9?e z$Z*1so)JkU_0(zYQTKK?99{nMo=j<|e>VRt&2}YYVXuTui$QS5FPI9T?Wyi$)>%q7k1%>Pi6I_+eb zKVT`oZ+MpP=7!N`*hWjry0T%pyHhh4C9E7PE|vrzQKf4%dY)m!orHiB3ZUP@g>QDm z^ZZ{ej=x`mTVZkY46c~ZjNKcA4mg@=*B(V3@AO(FYd0sZ)Cyy@$HKv9uqh?HIgc5E z&gB-|JO=|p$4F!b#C8>@4uWEcdBE^3OBaBH#wS2d`1+;LsY?yQC*WIWsmAqMT{CSL z)%*T#ezwN=DZAwX845$8FdECTR?;{aanac!%y26$eR!nhFz>46Jh}O8!C~0CqIvaU zm^Zo_TIn|6k%z-5aDwEYnOhVQN_mG7V*!Ff9oRfKItP{Y7GlCsu2s<^xMP4brvu3@@CS0* zq|$WZ;PIRF1C&@rMvT(ZSEe~>9bVfko-?3kG*_tV>W6mZWkel_3pZcyMI}rEgp~e< zW254cfb&`rU-?@np&)dFR7}BML|SoD(^}h#6XF5&FE_6)uy*ldM2LC+XRwk_*bvl0 z;`tysa8&In5Y*ySj!S_Y6Bj zIfPA!J5+k+SSx{xn}0<2@Z&r8jEr?RAsv@~+xJawV&@BWsnZIisyYT?d5msygDhcr zuiR5|H}40?KR*DgAw*kI}WKym$BWUbV+-_H*qN zkpH>@NV>5A$oHO(9ysHR=z^jKfLu=R$T~NxLP&;pl$G|f&5)Dixv6?<6eG0P*9=2n zem0|jLCYPSs;H>q(?F)>csV7Zm8JF{y6ga%_^Uy1Hw}ydX_9wmpL#vuRt~UKXOPiq zS_5?hc6Dl9h;X(VUh6T+$+cLey>c}da<`rB{O(!n;Xdk}}9u#f|GNoTL|Oscxj zPuT}dlI~)3epS23KlQV5Pab(FWB;QWj^sIM=%)=Ae*(BYeYWRgg8@fS zr^?G`cz>ZnBXlY^vB^tIk&3vA1Tw0OM~zKRE20$!)hTu}<#{!&QwQ3s>W`a8Kn)t7 z&`<$yD)Df%^=2>KgYx3jk`J`NMHeISBRgN4BL|iFzlhSDt)yHxS^Qap#vyX?IXK5; zAl2tt3u1>cektu%H;AmQf`qgnfqsLt=eS-8ZO*1c?r-G;oRpSAM#|>F_$$m&OV>T^ zlzveBgDIj5!#;tJVpZg(d`3k@$G;%gSQ&6+Bw#@sY_8*w6;2M=puU>t(q(V*ByVC- zGiAH)y`5gIQz!(5A*HB)XXL%lpC80~9yVmhJ-jZRo5-4~0L!mLeSOqqF>L}$&)Qkz ze$>-;KiK~2Z<6rTSq)g+;_2m~rQvD->V8U*l{+s`+~SF~F&1_KHFH*(ce^Y~@n6>v z!FyJLS&7k(o$yaGcM8wT5z=oAXLcY-Uip)_`iEqVnHi@3CbFdf#jfU^KwH;qSIp7_ zr08gsbJDj(@<7u8{ekf=DxeGWz~n${iwL@-GTbK;@;#^2x>13-Xfrwn1~}zX`Llx# zJDl{NtlhbTu@3-2xsHCk70Yn{BTB%XC|=6wEx_w) zjl_FMv1bglm)s?ulHDKK&V|~lu6i=&lNsU-R%v}heZuYT%XYTfP1@N0#JJt->$A#; zQ)xXaazQH!$YV@^Tq5wo@Jxm2$_*)Y!6QzVCVlpwZ1#mE?ZKC9!#7)pSz8)%WJOHL z+d+h$R!)j@4FI-^0W8=8^3+{i#`|K>I@zY1CTje-$q1^>281_+SVf0#DU4F@X`;tK zDfpIdO}(hRjC;*x#au>f>-V|ENPucqajtTG|7iK(%#9GbLnk~X*VqBXdpLsxvCPc4 z7`mIxs1PWVmKJn|_XBvg1}sqj_-7(0zL)6|M|pa9$~XYNgOK@&SN5ykk&ovQ03-D5 zandtZR;4gNEOg|Fd_6ANmKM%(z1x5knn2>MogG(Gf$h>DI&T*@OS{`f#W zBFm0}U)V2IF~>SeVw4?1CNslpAuw~==4EdV>NU_~jL0!y%9$H-_s8@c?U(G;jSznJ zq`@5{P_0E>V0h&^^`C3vXj|w)c~v1nt5Vbg@85P01-~sV8}K}du6!5{+m8Y(o3uM= zKKcj}8fGU8*z`huVd)=C?$#v8%Se=a_@G@sD?9Ddn)nR_&2fU}+Nl8iEAIN@Pdyn; z$Ez^#b9}YS^gct*vHP*qN9YTTX3kYr-eL$UM-q^Cv&K6G4x3})%^NkWW>VZ%RUNlz z9UeCn2Hwue5ESrQj+^8DocThdC!0-@fxr4)#Rh%DVE+crTXHDD@ld$EJlAWi*h*d_ z(j(3>j31KIxHQGlOrTJZ#?Mi;E*-FfXyAjOFK%?{zm<_+)5AvPIevpSCKmK%qA)0r zQSf7L!tmRds<*Z#rUCSQat=TER>JdkDV;5NPZlc|2l}RK_&n6OtsK@btbA^^<6AHK zTGWObUxLb|`gZ82%^Sy=dZnSv>A+G(H`qhLrDIWj2;`_xgBQMu&J)_^gi zuBC47PS4d#TP?`Ze#}0)=b>(aflYIgiK2l-fMSo-vL8t&8Rl;V%m&JLG95TE@?$_* zl6fYK+_r)IDs5AJit~}ZCtlhl-UJt2Q3@yBEf)s$4Z^mskk=8d}Q8(YL5Uk#=A`U~BZ$eJ4&`;oE;I%~AVUkdt)7eOAS z+6NNQOpx8P;-x>QNV@*%@{7>`T^v(Dl)AU<3tal1A|gpspeW2wN)c5_GgXxuu6w@F zlZ3}&uJa=heEs?blh4Vvz30JMW{-&)Rx5dYEu(s7G0V}1buYaN9;JA|e(r8VC7g0@ z(UP9lo&*t^e8OzZn%e91Z4gpeijTLa1n`}bGhnJ*vgsbM@@&xeUU*6ZnHkM>`DuPp z`e;MAD&-Bh`;~>E_6tpsHZulKgE}9Cn#Bd|GhFWY-bQU1T*pIDIKXXhvRz`OYBps_ zpJDIbcbbLDD{>9ikW=6sPdQf}|IVKKX9e(;f9mRW@*EV(NPr4}zLzk%{wLkQKuzBt zXCHBgQeQeZGiHB82M!Dn1db$0;1{h^0A26P*UkC!g&|k1$`~m)S~sVl+X<`0-L$&s zeVQI#yEeYQ<;snY_xaMiw)->*;5pznTMR{i`8O-~}3>`f&T4I!|PCws41Jjl3_Vi`6f(5IS#d zn#a*!jp8H-iaIbrVn$`ax1uGwak%M@@{~wXI$TGG_1bP;x#$=5tp^kskNKS7c3kbB zX6)=$BkV3_H7M{ma96lpdhI%!5IT4si|-4{SwTJKXf;C2F~gVXT45`2T6ze=PZg+D zzhll7dj6>Yuk`n(iSp(_u$9w^BAJBGA9({0Q;-`tCd_D#><>CJH5EwZX*gB1lVtAU zocC9T9j1p}`TrWeip9vz{vALIQvs5)gsFRuH$B73pChDnKRh=~0KycxX7RN7ZD2DBstv{;M@NSc!^{B6^^Pq+JW z&((%j-m7!xC2|58j}Nf)o8v_Hf*f{0xcl(RG2bKkm^ml4(ibO$^H%ekksdvP*Z%uh zwCR;RlY_)5Ls#gXf)@D0QrQ0A@k>i52)}GzpD*`;LfE~LFl!ex=kcMaHiTOI1g*pO z*cDtfdL?yGTDC9=e1gifSd*lTsO0J6_rzQh{wwI(pq>2_fvP>r93MZX}MgXQ>j|}s^3G5xZOZ8;NaLucVGSiQf@Be1ahW|EKFMT z?-0I$r&q(GDo8H6BuMT^B7Oq4BXL^mX5RkKl7i9vF#Rn45vZ@c$>}wl3MDBWfuLRd zgyVBiB*0ccGN5Yxh?8z+a|8q5{829Ilv?F37HTgqXCw@{#BQ`3#6a+tc9fk@cl48= zv?u6|KLP&*-tOAHiYCe9(oaQx(&`S@v*$c?k3&xuY(zZ&7B;-3kN+2YwtPBTO*6}s z3qT3{`0GIOQc4*{HiD{$vtWymFRCK*;71U(CL<<9@G(`!O661~{$IOufNz56f(zVr zpQ3o`dl_a$;l?6nQx$#vX`ACB#D{)cWIoe zelkdKV%G$xwXm$BV&AcUiDQ4EAgOxkH^>}7fo?f7&wj$5l@Y^%C}T*8o%@oZ2=(nd zF!HQ2SL8T#ahH;^_UdR`yVJ*RflVHXz-af`;;+zmPXw48bg2;dHM!#wm7|?0sMEzk z2wJY!8WYm)gbMhy8!VNSv_!ch%P}D9m|l9E-jpl8y0QP=lo?~18ND?(sQ`JjZcp5% zkVJh2vj>zpNI8+V;Z>+^{;#jAlg|kVa-v;cYw63F>ho!C6xOr9t7Z+q>oWE^o8J=h z_)}mf1mYy*izJ@|!O>%fpG$(5&z1Yhz*R+l`!55#y@rsuTRr8|(o@nI+z@Q7QPlsX z01(yaJ9rBamSuOaZnP&j-${4|Q%hVyI9iV@00ac($*Qz$#b2bJ)7>I}(XmM5dllAG z#VaZKD1xVgJP(UG%s2^^xhVxgpDE@MFZzf(YVkkgz$`VDRl zo5@PEH5Vya6?uquJ!%nO*XsC~HGVvnAU?yu6!vL;qoBU|VZ)#dFKIqdFJJQV+ff7( zg4dD@-s>;z+vBy*PS&?A9!NGRD-UjsVuD;&jmTw+0>Fy-rTl4?2OX%Es=)9V`yy-d zzfSF6Eqmk1Gz9jIQKWni`gDB76hi7z!pLF_5(X(-%J6E?Y0B(t z1uI9@xfXQ1$@Pm_b}9guC;1s(t3q0-1j0${sy_77TJWMd2xY!7b&Sdq9!zf$HyXX8 zQ-eUH*0C|G$S;~Z_%2jHCC+!l958n>5hozl_doU5-5UW=U{VQq_^d5g3>$&F1^tT? zp87AvNev7Bsgt8c0ms{EmI6XS8Y}Y0qHb~7cUy-ZcmJUvMa<;M{H=U_~Ws%(x0 z_B}>B1HV%FaT!Gp9wJM)!=vhInkUmlg8vDVY(SWVZ8*(kaPok}0mS!phK>(m`;~X{ z*#1^|Hk3fPzYMWo>b;re;kK^b532HWpmim=h>WK(5TY{Cl1o{Wc9b>UtkXxo<4&@A zNU?3Q{cCCJc4PEf@X5nS$L87)0On?weKIC97hjk-f<}tB!MO|@^nsk|%|X!2Wv{P< z0zJQ&z6X19{B$_kNkGVf*-9&EMz%+-v??S69}~f_F-v#$cGfiH8X#yvgiVsjdVWCO zYz3BAl{qM*R)1NO^A=hXia^|)8vy&BG<M?(N7AaFjZBUcO21 zXC0)4ggX3L*HO;eH#uLDt}_r$26xx!G|e1BLYi@I+DH6gX|XojP~sNFH1`NnaA%WN zI-#f49pG+j?&f^E<-4$saaOs|Ia^_X4;A5KyF^?-Pd^*K>CSL|%YL1cu!F~!2vg#@ zzqy+w08Kl2UznE$gsqcp3+gT(GNED5E4pD&uBdK~zDEF6MTc8#J>?xNG*Afl>?QhD ze9uI{^-G2ATTG@s6?NI-_eKYnO+C);Izf@N^?e>=x5tl6w`Msr^X0v^kbNEu@?xF4 za(dVvdiqvay~V|ibhx;n085h}?R)}S9&a@~MlyQ<7`)NIyx%2@uD#9=Fr3Or;YVwM`eT_fZ=Ros<{WX#R9Jmh+@Lj(R8ci`hsr)?xaOgG$ zKh2{+peq0~oahE0u~q;_Vp-RBL}U2%HPua!vdzC6oGZUIJCvLoH@yH3s{oRXF zLdHR=^H3+}sT zTMPYPL|j0h?|UryH9mDWXDwW!0%)~dc#Ieb!+Np3whb^S!IJ^l(##>c$nF$1dy_** zOTZZRsq9Ne+Rw6*6z4))Jkok~CDabSAGZSK=7ZBLj=~#<^olNMR6-*vzPDcW9am9+ zZpfuf?((H!w0n2iK`Wk*8mK>w&CtVI>ni zsfxp@B7GxCAoK{=anp z+_|~rtpf>P_|LqST6giJA9zXT41G65LZ zZSzr`<@X&thBjG+WWxNjO-PF9R)QF4-h0_E5C+uk8 zn9!@4R>%G6MXh#H5Jj}|jx(T=bAPE;ZQZF?90GrrI%QpS4@N|)jPmK~&or8iC?fO( z*J-l*S}jdY>oS(hx#1bd()d43I8&6F}E zSsVg7_!zw&PXOn6Ho$cLE-KhGPMLW*UfvfR`p@MjQ6QRq{n*#qN%Af(eh24SvZ{R0vkuA8x--`z)xFDc45$)Pk?t@ob{}7nQ9JCpo{z$~O5Z71c)1>kO;r zSz$3&Vmf{?x;({66C;m=ZkV!h+T2bf=cU>TxWx2>e_WiJzwGs#sS| zyIuBuQo;B^YCWxF5f5&_TCvE*xUXpcp@D~z1)6eh-glJubFE3GHEJ#S-b{m^a=&z) z%E5m5m_=kA7c9nt_s)S4IcAZoC=kfAy@|<=%U@?y-{>X$g=s;8P9{ta7V1O!21x<= zRiq32VT})0d-BdbMvtcQN_>O37NtYJ^oli*P)I?Q&-+fcl&qppHRg_tZgxbmk3zgU zyJC@p>!;_?fuPWE4J)w2yL8+$-(tGUBfCji%fcW0Cv6r1{PBvtIN)jWsO9AE!gpj% zJ;tS}q<;eAZdQ&MIiS>*oN@c%QsN=z#_RBN6p;5yO5tS!m{#RwsWn^U8i|`%lDb6woJvyJCrpFURv$ zPC#!Xw71yD?QOdnBxqul7O}-A6GK_m7RdRk0c6op)oZ^5yPMu((ev>?A?p7+A}IqJ zKx`}i^9@zD<4@J^yzv*i0G{`R|NWW(xhlFrpdV}@zd`?9GdFl|yb0Wp1?_-V6TtS* z8HGE_18>=j3p~XcPuAe^U`!^L_ zv=G_fcbGSho^H(z_L2oi-hI;wO&EIr_WRV&NAkd$uYb62RKE7knscV-kRbDy z3d{?b6WKw@f$kLBoDcrl_tg>xR6PzOBr0na7A@XOZQ!FTj8gnOmV=L_s+GPL_B0|g zl44*bO7i7LUrrMuz#;S^XApA;!wb%n-yoMohn9!yKUZ7cFZ7t7TF|Va z1`+Dm)`&QiEk3WwgrG7g4q=z0QoSf00xsg>mNpIj8eElBVE&_cs(CaoH*=6oaVQ>i zRuUO!LCZf*(-=@)D`)pAm5wzW47z~K0G@FLKrI0|u_x&ph5&gqa{9G=$Mc<7H??m1nLi$7&Cuvy`G; zoVbA3Z!koQ_fs2!|LKKN99qh(kw98)-M`@`cc~X_JmCYRXixy6GJkh|uMwH3t3u4a z_$_ixeBXC+Iy+%$;%lU87+k7eZ$}|O^p*fJfAJm%ho&Zl>=!si_Keo2Xuv0>oI}!x zKW2+)hp5X=XC^eT=5dahxhF&bH>>Cit@*(S*Q^TbcCIpO3E2K>vG_-)pE2w z)eR_)&0_@a5~rQd?#GeG*8uL!CNI;b4($igWLr?mo0v+w!5ZJmh;y7TJv0NI z(*)evh1^|AP!f;7=~jSN#2jLzhdmIR7s(gQ7Fir*MB^rO?O5(ZYLJe zFF17li|Yo!ty>v|`d4z!IX-4T`ke_v!^K1*$y~MURS4Wt{{O&Fdk9hZ9Fz&X$SIHi zSg4D`=ady8h1ud|Sty4Du&}3gf0~`_7+TQ-5a({{FHy8uZNO{6(dKt-z<)gWn+qij zC8!+*gt4^4BKG4C7HxX~oP$~%h|pitC0bw5Gv_}5Z86ZD#Mne>0eY@$0Uw%ZCq~Zq ze|19>q68y*S7dS*H^q`5YWa*9H(OK^RzXIwE8HJMiXs7?I4;H?uiixmn75G5L|Go} z^np)kR-64mP0WKLE2saF)Kxkzg7xs~pZm`Y&zXn6<~j1pvq}T=Nt+09l3~PU4r)24 zlO)4U+NEfAI1^N{t0!I=ga{5*!@U{ri{nZcnOF7tTo*p1z`g8uzenHjZt! z!n);^=Cmpgbed0vN9B~8i(`_DglF7bQ>(75*ml~)U7=>sDbf5@9=$q?z*jx=1A3%S zzh)K=xCtJpCA^SF!-D(roO;t$)Cxx|8`VP-CrKOMeDF=*c9)ddyY#3?5&uvVh z5?3SALpIi9&@GnK;O7d`Z1)HA1Xm_mxj?*=COUfE`n635pcnPAUP_1x!&p|Fl z9^ees_^CEmqv#IV*JJ1&>y4kqZ`Wb`WsVccPzw#wM;A|6JpG{7 z`Z0plx{$e#b+d73z>o=4bo^W+KUWsAYbVE-!tpCVU<{Yk_stzf4X?biLgHVo{%X>~ z)p(@}lmdcmj~M;=IZoVr*Q_O0ax91QKE7G}K9eS6z%hkLtI#~8_;FN}x=2yi?DjEU zOS=VtvGa8{mWNND`wEfF@A6J@8Wz6#( z7%N79L-hr z$n*FLE{KWm^F<`=O~qQw_Gp{QyH0MMZ!XBbCsX+vNn0a$f`yR8jl!FwV@#b6rxN>m zDljW;SK}A-($4Y~b`v={>K#%H-xL_%H-GzlV3Q4oE#o3L-uG=XzV^nzwC?(*+!f77 zwO;y&USIB%#MhsV6lMz2-rzMw=2*Aopo-#*?cZUSq^}|(c($( z3%a{z_T~zOt!V?FyHyq-aPCCqCvMFt{@M7s3Mqu}X_DM*i|hl>1LqdD^$bp`io_Ww zkRO_X#jZ!A*H6wRs_c4x@3svgAIv#2n;bH@WRW0Uj|E!M9{LSV^@sgd6^a#zaX{W1*v# z8-9D?9>J0Nvfvjmhv9#8k#dI&i)OemZwaF+goS(D_(S(*+vVL8tZ>j#_kPu69g4Sx z8+97W0n5wkqZfYq$Mt{hngiCuKCxn;^mcYj9{f23TMIE4z^Z(z_x7tu7->bO#rBP3 zbJU(?-Szhju#d6v%3R*ZU?&Zx)nYPmW~Jari-#T0mqVpNQS7gWD!XKCfmIqU`v(+E zG&SJTPzOmrf5WE#MWk=5F$?zX4%z4Qw=TLN=U=_#DFuZmDe#|0+nk79c==| z$qtN#j2w~2>(b}dUe~gU`L8>e0hfzGvG%9#ouBJ&?q2`&spY%M`xGY3`rintqgIAV zhVzZ=#zf@o4jg^+gPhS;tQPscD5}TYDQ>33^R1O+irw}czCp!P(dem{5+E7npI>+Z zYe*c(Mj!4Tj*4ERAaV{9+SQBB8tq>bFHG$s4;ZuKUln?8Z8KzuyUQbz2h5_iLESxK z-hvW?4e#5{k;r}>@6=9|GYq#or?5QxBhJ@lRW+DofT0isB-W!hY?DySJ~R|kn`Dm7==MovnbZg^GO2Z3)GwF^(@=Uc zhz8eDQAOt=UAQz5l!vNN66#rdt8Pw%+}ZUGvG&AItn2Bo(=78-sUg{%+1(?V`K|;ykC6eDtDQ&tM5;pwKoQpkr?gn zrpJx8}^-M&fRY97}JdqAKev}s@gk_MX>BHu)O3<(B)T%D1Zz2GW8>q>~cXJ zI?qW^`ztaGP!Jejat4ENP!uQR)szPwiZzGe zl_l>Yz-9vrRypdM-}tNUL2qy)PzX@Wn*%^Hu;nU$QuuWct9QUvE|n+S745)seL!cK z6s2;IT|h{7#%zT<*}H=7Xq^V!_JnG?DBm=F(vykZ!&h=S1n8{c=);lZ;%~#?&FqUa zR~PV};^zE|fZf5`4RAk zQtM~|dqbTPpBuh~xP%<@+0Wy`=lPgvvooCEq1q)A&J(`j`qLxE@)R8 zZk{jc2IOY?z(cJzhmUg`>|eV>3?1~-dn5&-_76=ysH&zM)*r66xA3pu_ANRv{`ebd zb8(m7@&NsGm$42!!w}@3`GYpLQu8J1lTVV5sCvYKTW&tvK1jcHg?nUA@ZMilaQp-&$(`2_6fO41e%Np;0(Di=&2S z%ZJPHAbsMXv65cB6Di&D)Z3+A*ShwJUORoi*|a)KAzN`_zqC6{yF%Df{~kW?b=b?T zwCK3`LY00f-|Jw-1Lo;-Jty)jDqkcHDCSVq&++ zX%J05qafPm{GsMYgM#=<>}yBI$*{^bi-}pb?hu2&XGtrMp#IctOmYDXLKTC(ELxtM zmZQh3W%dI`g&?8ASIqXuV8f#Wl_-WG7p`7j~4p z)-JGAo?v6(@E^|hIaK}mHK82{V~6^NkFOIBp7^{W?Ctc>Z9!*6cY7Cw$e07*g7dP; zQd};6J<^eb`^XC4N`QS7Ozntl_5NQk03?7cYSPuEupF&E?0l|f1(Ii~F}a3T60nVzhz#KMYlKNtXLb%B@6IS5KMv{X)Z||4 zZq8qbQwu8%Q@exfdTFge~7~0H$SJfgTJbUu8NCB zYbJn2Hn6OPrTRI6mM}_fqVctRoX*A^MKF6t&M916wuNImipLaDNPFX5sOGlv@t+fj zaLLZZY8BEQJ*(JtYHA7TxZ82Qv0gp|aHE+n)SeI*#}(EF~M)|27e$9yUM6;(~dc z-^ziZ{GNy%gMa&9wd}9@l<i&I>2qhvS$GFl zfYZL*X3I!;j2FBY(W#)Xb-9}@4#VMSQx>KR>eM5`#?Yx>vudLHeWn7w?0e5u zIxzU(a`XJG;SUy{-!N8&`ybc4p}xboYeSepxzZEV(DJxYWG>xb2)3}U*DWav;nmE? zsf@Y4TV8-t{1u(Zmqr}_H%HEB@ z$f>ITAKsNC38QrU=r15|_He49b8^GU&Dx5kgu;Jg+K;)f61q)LL;YvWEz2W^E_dhZ zyN^{yPlracwl+{Fh*H7<0%|Qln>>NR4CWmh7d}Sj#*UXrXq&g747WD_^!nBR0Amz7 z30-&ogdC1nmUI%b?Bf?!qqgYiEypAS-p*L|G854KS@{n;wTB^3A)kZWFK~CE!Rz(C z)1qb{yoV9nkYGhrQVOd=0ogQV7buP)hQ@WZ4g&8jM9`uqJ-5yKnmL9BY&-yPHuD3V z6aZ&^Lv|d;$H`es{z4y><{h^i9a5?9_dM@55(VT7Z>PV}zmGO%9C#I0jqB^;He25v z#G*g>p3o3%2c%mwnCIQ* zEE$0MPf7p+bWSuTPv{HdQu6iQ`(~Fus4oWA&W$Ve^pX!_{u@t(OXiv8mb;^BAOm%C z^nUt`G3A}d@`a`##7uXdIqSoPI0~`?;+e9>M5L;Rj5E+4m6N{>x~*TukXX@A+`oYt zB1LW#ny}JS8_&<&il3ftq$Dl$1niM*c2OJvl9#;h@IOfUxuF}HL2@;eU2i8Vex}AQ zWO9rBWT=+oDE-!6LCz=&G%ji;$OjmlhizenwZ-;tqcwx&8(S@ciFY>4)M|g8i9%x? zQmzl?e#8?j%ke(^31wjD$&(RncgNfpX)sQ`+wKI@yXh&CbXBk12_^dHO`goMefLFM zpKay?{!&qMax_zOaQ_xnEfPqW^W65urpo7nDH1r$klsJ*J?d2lkaa|453HGcjZW_t z?)o9RV|PBPa~JICLLvKAh=u$7mwkY>eNPEG)(e+Alre}z2M|p9X2X1N|y4@aE z{Qax4TMbhDaQ-8StSu9UzL$SSm2&UX!9d9OpBPy_zm0#dX*RE|<92htD~~??6CYjW zVqAvsx*f}4GoofqAojP0T(C)|k?L2ONH{>S{N~ya&8dxPT&5qSLfspV)-(G#);kyx zelA$w&nP~@wuNuFO|>`_cZC4n`RD?j%@(8FTLbIXn<*@|_tRPy7PYA~p66!}VLw7_ z_x#LKY<`#L>eY~BhXXWu=`OcK;x$uw9{IS(*RiB&}hvPY%JXT$Xw0oW*7f7XN1%3Nmfjsea9 z?*pwqS6B+kD~doc0I1s$fAPD8D_~*|4{kPrtK`)bCTC$10krhBxoUUs2EL13(1kp@ zu{X4IvEAemiIRo|vD^%U728*KNJ|N$oCbqPhRC_X8oM0zF^a}ltT8?%j2g;wrbz^m ziU>VF3=Qzex@)TH9jB%8g&R<{`HDPG{V2dD6U#}k(2`h8)t>F}@;&?kjkiqfSAxZV zYqsIyM6;z8VFc~}lQiSBz`;_mV7>v)&l*!|4L-##SW7*_1r)-*85MMuOK$(MnJWaQ z1Qlg%T~ZD{%w0dcQ%iQaJ~i|{dE^&AOhRmwXH~35_)`3b-f5SXT*Q%5C%we9} zuviN64q+hRHb=ccIB0Iee=Z`Vd_F$2eR;8;@f)jk_ScI~%TPf<)6p$}&N*BcwMl7t zP)?(b$suxd&8A4RYX={tyMO(i;@@KCku3KSj}4pCdBuMYK)`k){=ROYQg_a`k}Qe) z0Q<=~`eN8Yf)zPnx+j0)33xi1p8v}kI)vJI7nW|HWj(cUGs;gYkdk))feU4SA}rFL zPk82Fh-zvng@zHlNdvgp(LV{{ejqXffFA>(CKMm8=Vt6;wd!yuZk}UGz`KdFmyVsy zZPQJ&vo>I0o7)j}r841@!x%NR7f487eI2X`)WVE-WvAoL80mb)n_E(O>9h_Uh$e79 z2TJd?S@N9Qz70>6yTAVp!A760@p&4(KO1GbGhPbz(O zK`|kDjlMUP2_8J!3`FV1HiEq3iW#-Q`dN{=N0?AZD_Jk?u>BoqGd@3QJlg205Ueay zIBpW^FQ8C3adX#p?zu56J^7*aKh5=j#VrI>-{dKT#KuTe5Q7^3a_LUh1u&JFdbKta z1q1!9OqWmX@gY^}X)qE-8GuDAiq!0*M9nBMNX!c%WS487+d*jvLlOZBCVGc0e`T1z z8CmcUCh0alpcc;3xkHjGu0IyH30tGnrrpVwmhV{_-GW!b8Fv03RbL$zWw*U85+dD= z3P^`^cegMg-HkLjlt?!MA}uW?N`ulNoze{5A>GpO+v9uQ@0{!&{S-*lh&Z`Di98Y8Nh6xYR3e3Iq>wZ+9>qGZ4sq!K=tWYQrY^Kb| z+=x5SM zEqKcLt`KYUW@JgfcZ&CEmSDRdkg_fBcFxYqe%eD7?)JO8-t+{tH3XHw?N>WZd_~Kp zm}aDj3*!;bx!O!UOPLk2_m4pvm;fh!E+pR3-$Ci-2*e6eXV^M+X@kx~ksfYPUR~dV^A$VfuST z!CTaez6^jghD61anFhIw-XY_>bMhok{+Rv{uqZDIhmP8mK;=$(wr9NGsfNE7IXYpn zGcFHv4X$w=&w=9~e)msc8lc?|Dl$q(Jx&-cEh0|nD-0$7e4f2`xzsj*4O zUmosgV;#mDH}-(`)Z84vLqrv>hhwCSNJMx;?R@teii{5@VFc$1)FiA_&D)NzwdO+z z88aK4-CEr!KO%}4*IgQf0ifQD_{eL$q&?56&`!fAH$wU&-@>~r)bi7LN+4#D~SjKLBooWPv}r}ADbSn=x@!xsDmiG!na=i^2k zx=P_8a~q5IepeHsp`mh@@dqM(pC`M>(?TcZCi!-yjh^8#?i+V%1}m zdG51=Wd-m>RDY3SRmNA#G}JC|zS#V(8{}~*r5}u5F1U)Kdwrmj86F37@rwQgQ6fWR zaD_70Y@dJ>!NqIyicPQD1q}BAZxbQjcAC}3qXl)}s~abQx9SH!Yyf&eqZ^iXKiXCL zRAm#-*C}4f{P`&ieze0z0>taP>9Hz9`!fS0sl6*of4PGQDgLdzeH}9_fN}4K*;{Vr z$(5hS3;(!&vOnF3HO9{GvLWnu9z{Iuv6M~l5IsqbZZ&rQxw&imHZkKEwU$`c*G>mb zHp8rB%Eio`k0gy!CSmxh%Xq zBSi`A*fDcFL#^+bftJc%eZ~^pn~zfIhq6s`Q9GwN z#p_%yBTii6O_<25~ z5zN6j#x$tKQ8nMS|4`gIwCuABuJ!ZDN9`UhdH-c>RT*iOxSGWogPgsfKct3JggIF# z1CeP`6;GCXx!&vKr(<%T_-3`C%Sbe*6R`|INl$uZHOAP#d}RQvk?`2(VyHm=pc12l zu3~Mmo=2nZdLCV+VSwm95#XXV1qZ+1r8XHMA;Ni{!QXBRk7s|yyae%+iU$Ez@URR* zek+Pe)&`5-ni2>51D0pkvEbkhWa*rNK%-!&67Xo4&>i=sI;{X`cH<*7HHTdHM~YIkKNkR)h)Ha(UPj@vVpFyXnZ zq0|N84L1lUnMyu8&SPPWtpL2|JPN@Xu6%0!HPYS6+80Jnv!9z`p5@!V)zZ zDhOvoD8e$E5#UETO4dAJH}*g^JkBT4LE0UG@0T|p5ax|l{#vK+J02@Dq~0%|v<>#S zjQCjSAefzW>C;Qfd9P2A zp^e5&kdtSN8=dwv+oeCKL)(d7jUes1)l9XnROx;=e4m6bMNwUsV3^YUS8Xc6ZB}!v zMmC>WLZCc@yj`xCAR^d}KGX`Fx+(Wh0653Tw~4O#?lep(9p>{J03vKPfd?=by=ix}|WkDv}Y8mfOCdRf#IpL~TqZ zMaBD;_0s1|WIDI~+y3V-l|=cjS2Q4Pu;UGqg3J6d`wZegxXOR<-$wota>HTkerXk$jALs6ur?MCc&4n)joS*0j{0IQgvoAeP~Dhd!1fR<+tp z?;Xz2pRQ31GIiOTA!L9OqYtM-mwNVC}&1xd=RkKfHp~$yU%0oY6jko z$*t8wW7G;{6xttdPadRKNG?Th@?uElCn72JMND$zGL@KBR|QpkBQB304M_WD&~0gA z6a0ow3Le)#%6~@0t)q#%vYL70V_XMNp;94fv**{P*j$t#gh>|t@H^W?-IyKMl9#-X z0UB13Y;|3d0mB3-%?fz@asD|_BO>>nfD9+zPz6-3SA-9WI$2zgE)|1uoyn;Z39@PZ zn`NIyB$qagKKAn?)7hD46)aQtO?)=_5Ne{XM1Py!m~rsJXBo3IqSx&=}aS$N~nK85XA zIPU`S%TDrXT_Hx0ybSC2o&C zThBPg^$+J&>*x|yPkM{0SW*vShprGbDyo^JU4~6qGK}Ry4C&i@61m<(jX}<=!Q|O2 zp^mN*NI+r!Saq(u{f>TBraP%{yg(x8*&{`F@K z8((M+nO#XxmPeT+D_p4)&p^V2eP;Tn{HCsfP%dqJ?Yk}I(AbxmR2dbIQErZo_-q(A z5+7Ywi}{rOh53q~m;)DCyK=6lC7AjM!Jgr!~omW1rd1SN=_Zln=9TTzxi zZ?L%0SqmZd5+T(5#sbyZ^>yxKLNp=Ygz^(4z7$8!oCy^fHR}o@y=!G>HG`IL+s`OX zHxkaE1@LKr%~u~#e)R@RDjTLGt<525mz&{7 zsixBm{^#Al5&F4p9lqoid<8lOa!3((n5b~TDma4u4P2I@zGOO2wEilul`#|9I6xWl(!Q0?`&?{GwpD4$&lS8w~9@FTux*Hy=TcRso|ASJPjOp>+e= z&v^V3WoHM#ekaOHc@GS#;KN*;a>j+p{VXB=ssXvI;zH@Tk~ys{ctlt4RjTs3*4X2H zqf73yTHi;n`gs+@vQa`Uald8BwHJsad}lkCky~PA3?Ynx)Y*ufk$a5Qu1oZ7mUW=X zLFw^pKKyVH74g#rZAu7?q>gt`kr5DkcYHPap;<%j&_K?EVlM%rnULrTQpFrTuD7lt zu{m+-su`>)_|5=S5=QQBjp+d!pjf&P$?Z>~Rszqh{oWA30$zKb<2Vum7SC(2%Ed|P znz|R`Ndw)aQ;9myPKp-G(?&P)?^ux*q`|4Um9GOUTqD13lQy3+0=Ww3jF%P~ji{M5 z#V@1!z|G4|2SQ##a&qcMcgOe3nlVr2Plb0QIJ{$h`=LEs$|>U|v4v2hAoCKEVYR{R72z{O4?J3;Q%T zVj&mc>Q1|tN!r!M2_B^wX;yqb_5+_-1$G8PK z2pQD6Cccp^m4Q=sk-O^4bYKu8#Y7*g7^2$Hc$@(H`u<25XfVW7UrTx{}oY zxl^!t80Qwk#LNi^a4<>iZNh)YaIyjt%w>-guB%dAx8iUsNG$-ut#l|e(N4^<0NC0Z z)@)1s;9d;L@G=~v8|YD{Or4%`)B~ZvsKxjYq&fp5M7OZgF+uuQdmPf>_~?}qp9xZ6 zJP`G+f&x2_vDhkWXaxGZeBuU*J7)BadAQ0gc33QI(Th!1$5#iuvo9tlH_ zKSfR)u@B}0(_b*4O8Z;HCFQ7@ZC>3cmw{sAZZD1D#R&}4--2oIQFs1Z4UpptMP?bM zG%HX|qxCq05==xsvy%1oWQ!wPcGtUdOQ$_)Ra5izmX$F`x?pOKKP=G({=M5$nS){ z$TU0L?OyV#U%d#l{KR7Kur_kN-*q~I@}}G6cjJswcPBvRV0mQ$2vILJKzM(XRIdVZ zQBk`Bj(+ow;F#HH;clzX=aB=nX)=B63}3(G1G?mElH-TKB@A}usE=JC-1ZAnwqqX~ z**>HO;Lu{8z$4o();++P%jQwX9IOA##H9j z;uCtnRZxP+lZ>=gp|@*Rm&fb0>IdsA6IfS$z7=^w`VsOL_XS| zk31fU#vD2!c|y55QG>k`1FTrxGo<1XN;9^#75W1lkVgPxc!)pb)~o#fLn_GxCGCOX z0ZyZ+l$sz?q3Zl^)Hx*uEJw^{4LHNiTx8G~6RPsocB(NMgb+G8a|}r9^_qgK{nNI% z{U%E0xF`L$h7|7q$lw-_n)ex+Ar#SvzxNw#Z4b4zvsdfixSzXf#h`*Mw}*--1aJg; zoeoB|zZX0~6kO){#N9Qp!=D8=6+fOb5bAKQUUlUN$d!kdDbjYIY^H7=fEewwCYvuo zDk)sf*imFRE3-No2H%A8mWDqG)0GB$3_3tbH1GsZzMPV}hOPlCg=KkEQt2%7qP z=krdFFN7utEGt=dlM2U9yyolScRES=Lccb_WYZ5Bn7lFgAp+XxfU5rNn$dL|-?Nda z>M7;FT7VM6xcTS1W%`Z)cOa^QtP1Ttv|)|el0=$L2pWG&w1&qenPNxt_E; zjsy(2W$|?&7{Hu_&(+Vn@Ui#va(?J}q`y!ofHb~aGlvUufKPV~c=#Et`g_A+YaLZW zMEa0`#``d^=!%Z*(?&|&_!;Z2#k4E+L;K+)HQ49iYH?u)PTM>J*yr+F9*!rv6@z5w z=kMJ1zWx9nYO)!{lAc6P0c1yd<&G$D7j9*wdryI&sM$21x?Sy~^ zzHqUyWmO7T4O#+>a<4sCcSi@19#jH38F1F9$Kt&-Jaq3Ngpm*TK_8_$)M;U8T0{km zk^(8W@sbzYRs|IZsKzPtv*CULx6pmQNt1Pvp)*Y%VCrHjAsRKn@MUr;w^>eTvfAdF z_6LnS)n>lnRHDZUolZ z(K^8>qT=4Z%`Yb=pyKv!k0m6dS-#Z-)@UZWr{rSwtc349NQpjO-VSS_=a|aniyDIG z1@Bs$?DZOe%X)Dn9D5f)^@oxlXh(sJ77v*K;T5nqynY#C7bu-)QPi!st+{Y@Q?M~3 zvv_A44@uG+yg}N009fBe>Z8U#Q-!POmTJN5g?pGIYIfOL%hsS0K9FWh&dn8oGEwLNE{JZ zklBl$#eEfA0dcI=I&Ys|GVq*;`D%*Gc^Vj*8CS~OFgI|uxcy>nXrJpnQxu_XVKqsp8TF6MH%u{-dxsp{)q4Pw6&0B%wpmr@=clFT^LK|;%v|mJ1Q)U5QE;MUSvzwFkAW#C&n0J{0eK4q z;je{ZR2;(^&hy+LSp+cBoC+wvwSLcuQS6)`Z%GOG=YY@ld=PIR5@Bt(`c!!6<%K!X z&kJetK~GegK~2`mQQq0OM{Tbr5%ja~oBx=ZoIy!~p<{2SAH7_4Ui9!`frMAbXQ#Ft zH*T)NvI7BLAer0}JVuK^5P0H~@el}+F0jR}u-^Jiy+Q-r*CreE=>De0n4SMQ*AqZK zlc97s2>F%@b=dcPH#0##^n0k0MZg-26Vm49GOEBtT>2BWXB`qYgcj&Br_7{}!}0-3 zqP;SFVyMvN#0cFg<}f z;wb%w4V8&YA2lJSRUn%nl<>JGM4?)+!KMR^IPM8~+u+*14?93=GmY=Tjw#an5iz>a zsgu(KW6M;JpAQJyj9H%1*vUK*#)h4xEE){;(W38j-xaeber7Sl`$3TPr%++0%5d(e zoWAR~;1v@h<>jtl@M;h{MBAtJnpt?is3B>=~=q_SFq9vFn@ih05@@v0kV7!shh z5V0)a@EPplVp{7yC$wS6z=714ubJZ2NJCH;2)+i}`z^pLMt&vxV)P>dWWO1+YSPsd zIvpr~YAObpf(TZ^`;Bv7*&aXJkG=Bi{b;11JA=lAjHfoZ+{-I!R$AzR?wlYo;Qqx~3kVB?Yu zm{3r9i4a>#;97!<%*|!5Cxj>3=Amu%V+7p!1Xk?8-;(8H;Jq{S(#Fv&P$(`<3>|!% zPooAnK%n#-`HIrE&I5!KwOa(hC(VyEXF`y2^EJ!n6we}AHQ5|!Ah`E82CcK6Sos(r z5(3I2!FANqO-@c;2__%S(xWI!?YBjPL2#P zHK7N|Z;&}S6vG~>cubTGF_`@-r2JDu5jUIwzv%tyb9#Aze0Z}6Q)q`3NHOID>K-FJLE%)I!~e5NP`d_gLVh+HHC zY9bT+?GmT5EQZgke_}cvdT+py>X}V4-50=$(-Eh`|bB4PNm>J zEW)UbBeDAi`Y9+3Mfs`mDv0dMTHYpP-K@w^2rK|Q;L(Pn`rgB%u}G-LzBeCa^QTK& zRp4Gon(ffw5zsSCH?F5hY+;S7G7gBR06)~np7ML}7E8i1rDI#qX71P@$Y>)VBwGH? zx;!!y(SSW?e<%THg=Wto%Nmszd5!=xu-WGNET9#ut;N)rjIUvI4qTuDtq7Qt(#<&K z0^MetC+K=)1sUc)7?EWVf(k|-;FBg-A#!m&9R&;pqITWQz7r_g5uzDN#a13Oak1m_ zI|A5i=#L5#;+?Q8*7RjE?CR0w(NJb`DV*VPdonDxFn<)d|E!7@%#!*Nhei%xIG!QvtPy4+!wQn-YfC)F1l9#osYJBV=(ba}X%L_f9X%_VjEmHZWZEgG z?(`1>M$c`-Hz|cv`SS!Oz+iw~o!4YBkouD6(-mXDWND&96to%p($2`N>jzMA?WIlP zpwe;B+0CE~r3mmY)iC$Q0p%U3&QfyT4<0AP1 zhc&v|J{3_Rfc8NI4;&cF3{tP^b)J+X+o7a>iwyZ{p}k-R!9;5KHm=rVV8srr>9-%t zoLF(sDsvHZNYX{qA{f9{2gE;ZB_39$1qopv!&S0 zq4`xH?zZxOgz=z-0wACMXuUd33>E}me*#c5Yo;hHBt^%es=MQg(cf|sgZ4{>3kiYl zO7Ptx)feS>(0Y~GC*b@#ER6z%JZe=y*#TT&#jb4SW1}Z$=XCoJjf%!gZupZGfJT(Kd zzBzY^VFlW)%QY2mQDOGC$jcP?k3(v$#{}=%W1HJ!N*s_7HKtydL~MGUp8h%UyNCI0 zxN67#J@f2^aQ35%0|>@A!@^{#zw6Qqe?0gpXVitBnNjf+^l<-5T`Ck)8v#MHtCSj6 zp{+!J;^VD+a5Wkh8r=ZYC65v~%c<3=UqK08!SEv!ao;DIB1tXr^Zy|r)?f%BjKnGW zT3Bt%0Yv-&3ULvlYk^ zT7!;}zggSsw4{(KG7gx8%X_J~fAI6GIS@p`9Q(|_pbUcAJe(A3Ag66pkNir`SZezm z3=7D7eE#bFFwVxkG%Gnn$cBV2)OP;D97PhiFX`36gdu&2^^d%O&(1gd`5MqKxT)z; z0-G4X#+!i>3(i%I7jNoH`-gi-;^f0YmBzZXx;%n}#)tt~Hq+}kcVX{t2gmQ)9ld$K zg}lOnYK@+U^K8G@$NUqD3e@H9^lj{6Q1_oo*WSSNOOezH2T|dXpMF=fertO7*?;Ht zCBX+2Bd}a+i-iX45B(0VH+wI6fwxA1Rgi88w=dPb{G!94G<_>eO7~Yg;qJdP{Pvh# zRj^2i=))fBdmff-$6GeVG$JK%;3S{|zf?!6*%ESl^KTLKE*nAGZ!Pf5LFR8?#qgUV zDM`RHEq+A?EmiPaCe-w;852_q9A zV@$$A7_rGUWtC&z(Eg^p-#u_D#5>Ir?VE_j`arfnMm$Lm${oO2qnkN~9!Di2=Qzxn zx4FAqwmtyJ8+!-2CD*@^1NOwn;zReKO&tV7Q{3^^9n7iN(cfynmV1=WBci|x&iRNA zVxYkQ31RnJRkg^4)koj4Px+LiR%VDmS}$K3Eg(dSaX<}jF-Jbp9SR%30@8?Gm7jE< z?YwO(57cDQ>1<8KCas&}Snn44M{ITLcHbA6BnxD^)>P}eM{b{^lx@Wn0adJKV)F4)Oo{N(5|$R5u6W!KahH!eQ^xXA7(EcrX79sK zb1oxTx@U!qCE&mMwQ?ncyR_UZ2Kc>#_7eac0GCeCodzw$t;tSkLnFpz`_|=VkB2BS zV})vEjl`Di>uOh?w3^xWG(nOSrH@)Xf*8*8oHYtE-_TqN*^&d^L1hS>NUUqh=xLvDd+h1M%Q@n^$G~h6U zz(~&f7xzeN&0NeD5D9BR2>0m!tjw!Z#5o-nUcDR27} zn^%a-$FJvII<#vSs7M&gek#y!=1C2gvnXzFj+FzBYfuTC8|4a^nujtR5Sm-%Qx&IP z$*v!Du4nK&vcOb|S@RD1#@T-2p46(c9}yhh8?2yW_rzwwR|ELdi zaQJrl)BLU1agL$APSg8Qo&5p7o6kGlLHA?e5_)>UUw^C0E`Onjf?>Ug1_+EwJ2GIs z^&U&}Z$ZapYZX^*DmU$56bGUNyuoUUrlHi*ecupdKDVF`rDg&Cf0YO~pBpuQKR0rBu*i5z%k>WJ3@3QSps#CW%T@1?fQOfN_dI+n z_LmbN@_=j3f!G`cn=igifgWfn;`Z7^0T~A)m9W*6=^OvL|_D3Q6?f*-FLr$H5Rj^r$#aJd7K z*2!qZYTA_)XnpCboC`(RPA>kHKeUrv} zK^ev=lGd{|=<`blj3Dvikp0_OQxuxKm=@P=yKLa7tG{I}NWH{4SgfpG|00jb#VW?S zQ!`R=_N)lMY<|RClOl|nuj^v0<%(@Dg8z|+lm2qT0w)G4%FXGU@A13#t3RdQ){17X zY+O9YkLP+{P;jv{XZg#Zv8`j={#7JnJ9~I=kUc4xN%tX2=+)cb+cq@Q)4%F1=neNu zFgY+Ua)B6md{@}-sO0Hk+s?rff0l1#LwIrT@FuStDy)TwD22i7$20 zcaNIoXE$z{Lbd~TAO`8H8)0z#7c1~;1b^W{F==Z??n?$z~BYRpNZy{K4^L74%S z7*AKo(|g*wq7fnAbT#(Y&8JPt_h-g_837CXgvvT;fc0MCUptmzGiv%7!pv98A=iK&W?)wFj!K;EDoo_CU`?9!PD*iWRlek zzRSl92YZs=<|ig%ln$&q1tGS)cL!gU*@o^t{~+I;-`{8tys&7Dp`orMihhWlCmX{% zN3?&&&N=+()SFULI?t4qSPB22>Al#Dq}!rw8GbLl?h~q%xqFgklaz?nvV}jW67ALD z?xnfshw&XS2dztHyGYZNV7!bsdyTQoFMP@Ooh|e$G&e$EvA9l=M^Eq9#R^15D%%w7 zqD)CHSfVy`g5L>+PB*;c>V%|DUm}l2r7ki&MDL^yF^iC_kml8X29C#^{qy3<5O;X6 zWU!RP=Q#GC{#ho^#Gf~wy0G9CFcRhD*F_|4kPKEZbdd>Z6GqZz`kgs6A7woKXrzhD zK)n+8pd49^^fy9KKE1fKv{uB9W=~#ey!X9j;NauHK?ftbk1xS7)^U@L_2;7R4F|Z~ z9D^0NYGQG2oTZnV;G+LU#6GC!Rub2Cgnl?-k1+b6twTYr&T zCMv^U?VhB|juE8BF8)$mNW}1I3qqp9Yzw#I@MZozc8LBd>B|S1UX@-dWn+=K7kaB0 zi2W_q{p_Vmj@~!se6s8;Q99OQ@6LTQlg?&AV`l&hb@wdClf15%Jc0AX<3=qXlDcEg zcq96BmKS@u>h)bd^i^ts0z1xybKYW@(+KLa8cvJv&<)CLsq_9Z&t2^OdCSSK2rfN( zHR%q0fu-r)ix4iON4mB=_mMJ|+2QhM{6AEvM5131P>n7`nNHr6Meq!QYuJGYod6|!8`iBPBYRg z61@s34L?{&Qa=u!e!t5NvBMH;<7dVUp72*DeZe@5 z>=Vbu#ja&r_X&mYs?>f@6ED^cF`;C~Ks08kYz)l~+QJ@w`@5>+(GN45ypKIjoER*A z5B#cA=S~^ccULII5?1*K2J%UjR7Pg!C7e7S75qv&eoWDA>GS%N*!{-&<7j;krDV`1x3TaT%v|aicSDd+>bn2)JcSP_Qzebs9m!UM2xAkI!-SY?5AXG zT{0`o#quHbC$^t}Nr1_zs+CUhtA<=-?{|%|wIAD2bT3~`Apz@bec6!JSWK-ZE&cWD zhHtdQ@=8a}>9`m$xg+H&rx=vJ3La8zJE|blt z`IFxk>$ibYO@6l{ru$2$yO@^yUSb?=QkE)yS!3R}x63!imPW zcRUmP7~T`f38tT2`594Rf`W!YO5L~aZ<-VZR-1L+ZWIQ|DnUD_7q`p_TH7kqKLlJh zsQs?A7uTO=z6Dp8U=raLK{54FUJrt0Rp*ch37C%RcG;y?D3sI~!U@ecrllU`$LN;> zKlC=mnrw1e&^ygdtR_07;ak7pXekfhCTg!n?f7&QW=^m{$GAy!uzh3zv*d_h zZJS8TBj&_7b&n6{D^b%cvMfbMPi0xW9f|T;ofTU?2DpuMs3dF?A83VS)#`$n!~i38QU+>ByFs$6sFbf21*~WZyZca%`%FceEZEfK3Ncu} zp_QG1H{t01UoF6ZDul5_no4KmN+*(;uls?GQipAf%)ymQ=Uce>TKBpvIlt`k@a;Lz z@(Zauomb%^#>E}_kL8G)(XLQhE9hom{bi2ahLkqTj?uoOLru-x#?9Imq3V;vaJi+< zl;5z3Jn53;P9_Syp5^qPYuYZ!X-@EzEg)Rg^@=Y z)cx!@WkEp!^AP9!d!I|`74XY38T_DDWf>IP0t1n6m&+fs`uF>V{{8-#TCDs5;mg#= zyOK$2jg-dh7-U=2)R?WH2PK9V?IZao1{^iiv39eBrO~R+%YB#y)??2bW^8R8+qj|o z#n6~lPOg^LbKe`z#fv}KUUw5Usm8+0V`}BRB_c^1c6G>^AsHq{C@ZMNV@DrxlZ=-}<+A5-RRb$xGiq=y4 z@ozx6fw9VmuzgHx{JC=R%2gwmWsW~KW2m^VqR%qTExFX?b^}S4!AZ?q8N#KAKB%y~I)AA|}+rA>-w#2ri#L zIW%(~Cd8BukH;Tt#qQKwRC@g~sPDt}y&@}XJbR)oN6$c{WF&_V)*TJJk9kb#kt)7c zfuk$Jb<>Ym-lc_O+tbdBPY< z)sIv@pKeTDQ)Id^b>4A)~q#v9WR~n_V-xTQh@#$-vt@_(=)FQAbEG%T z7Ima{-}8I@pmrOI1rRD_=sFEf6uxmy>P4%Tnc*!`nm$Ldcda!oHMA32lz;}nCcs2s z3ZA9aH)}p1s^oW{-U+T5WXAwe?X5_Lu(Qnzxj&B9*9BA`4IPkfe9KlRq9a$?g_1Xb zS7>~9!(H}N=qH#L-JUh)^a*2fV4z=5ejo1{IWr2=!L0AY1IDh7FwM+6v}j-!%n0pF zU5t&~i=zNmX`!p(KdIENHDEn_$fV=)j+om;$`2tucGCb&a_N&PTb;*+L3=lj)9XB= z`}w-O%-4`+c`+-Xs}Iii7CU2>F;fbDWj*b7F#xXhVw#*Lo&RmzNiuw25^jt}{auc_ zub@ZU;xu4MP6F?C7((6gamRLlUb?s;OYJkhUmj`uxD^fcaj!vPV8)PIUmjy#VegRY z$22lpA+HPwZ?xU)t7+WY8GyqhJno0ZC4z>X`gY;a;z}t-S*Wf$}0V2!QE78ewTHVFuwVviZ zimAFpXNKR<#;;X-XvC!pYZEn#t8Izo2INXETiYsKbcL@TM27cttCRlDFTH&UMOZ}K zKNE}!5BF?mXT4b_saW$in@0@BH$>7GMCGMD451nCE#t=3WvrRJ>t|K_#iG_XpaB}d zE+*sXop7^@q+0iWhre}(?XB|Ia|*OdbIgb+A74AA5@OxSpbe_yqH;(#iyv1R&e+ zo=@w7gkZl^C99S@uL}R%(0Zs+g7gVbdZylXdtN-R=}~)iV+<4Zw+<*}Un+OqmU`vb zYQiX2!U-v`&V6;rebX|#kSE-uJKFp)QoPBVCFiOfuE#9%ln$rv9v^n$ghAJzK`Hp2 zI(sLgqjeio?@p1Nddc1W(s&6R!C1$^+uL!9VU9ocUPU#2up}cchnm_I*4OG)CRLo| z%?K8ebW$ywJ4dVtkD~i)f_C;pxwHuPGkn_vs;Tivu^9mP=y9S~W4Ud$&EmXQ>NWdh zb|r~~vhvf1Sejl~l)I6FxC8_l0A5v~3zUsbQiABs&F5pA0kANdHbhN%vQyp z8d8?LsiymFZ5XRcmV0wz*Hx2+A5~T4;YICiBYsawY@rI#c`k`aiX7_RQZw* zf)o(=n~;%&1{4rSX~ylWtgsEuKwS(U)j)Ep`Cl?}$#HPKv^9-!b;NB*DTMTx61ypN zE**EP%Di~2{n0_Y_RYHlur&dT^L%Bnn)Z{eL&R974IOSQV05mX=YLvQlULXvxm{Ac zCIe}z;@_#`(4U>1Py+*4rwc{oIvzkX22BD#zmK>$#=PX<%CZ8!Z1?6Nmzyov!7Ns8 zdWaxW&MD9@#Y3tAaU5n6@RR9PP>QHnftbJTB?qfgE}D#Jz)pQ_B4;gIjA2)irZY3IYChm4 z>VnOaza&KQuOA<0DexP(st1ol4hmf z9Ufq|X9G5)tRa43AFF-_9}EMx42?96DfRO3s6K-{xSWy%1LyGi=$hr`E}!x}>)11r z!&QE^5D2L=NaLGT1UqOmBq^<-%eY=r*GZaQ4k1_8JxsOF3{ej4O%(w9h$JJ$%-cOP za;zL?LruNXgm)MKqta4pGFVRVKmY4!&bpyY1jL&RY`+kQ*;$?@iG{CYvn2Z7JxCHe zjf!OzD;SDhJ~1UB3bo7`38HR^j?%A4R+M;a+m6*;k&GrW+f|{|e-On_NDjOE{#lLY z_VuTodKMNdfhNz8G2&7alBM&@h~VU?7IA+y=Ph`5&`=&gyp!8dIXbHX_m0Ke2;&W615zkGS44SxHd$D_;Awyr*O zzNnb3uN62Oee!T+&kV3X|9Qxg&{-bZmIW0j)iWR_3y3f5;QafSqvZxklNc;-DJ{N_ z>yv&#&iwapEWXb%Aw~g{#CoQQk`&-lCKdjlN50)P0GV5*mQGX0oAcjam(~hGCxFn% zk-Hbwdov?y7=_`0#=@Vt&{rs>o|I-h6B?v8h_FUD6!_=C{Dzc%3^2miLe61?jlWa( z?+44)1(O=2Iw+-Z{_Z~ynbu?eWoY<>CZDCr>optXlvBa5f7`^(QbMX@j@GLGzwgy} z_^UuRrXKV`7Zp5mX*)GAT4j}*E4>S-8{__FL!|wlWZ6T7uA!zNl z8qUMXKfegeg8qHEe7m#m%(s;Sn1q&oQ({0(W=aA~;@?*1nbwM90W8+@`WuYXc@(}? z|9M8$6vZcZaK4oQ`aumuS^s&M`z?!5)BnJK{~ISekL$RlEq)wFS=E1E_T@o*QCu$E zTR1>pp|CN-JM!N#%|&h8frh{S(#=_p+IRp({bv#Y&r9O9gj^=2DJ7B=V7XKYqxx?H z3E(61CA1!V6AUx`5u5jaSI)K(DSsB3z^6Zg@;u{)q_xFJ>4$Jw`Oh;hLJn|M`0FAV zCp&iI+J9eG^wx567-QU<713$$@Z-7Qzkd)u{$1F)ZwF@rQf8TrZV{mSKZ7{$s!R4J z=~z(y`?wwH?+0$JD*yXoJ^mLweM|MSe%Q6K(*QGG31=x_bUJp41zP-g7L-=OVZH#y5O(&cslkMz&eQ>cy5 z<-cn5sHmWx717UjzLlry?EejaF$sBX5*UzkFd!2Sq_r&nf4_xjm-4{NO2Esg53xQR z{ZG#msSh*%`AGaxilHxv4gPuR3~86X!au<6YZWl*`tJgPX!jNW1z>g=5o{$>X%6xckl$O=pTnunHGu!a2p%NW-p*{-yd? zcSzD}SZe{=V1sTpVnH0BhA3?P4;LTZCH}im^RP%znoWY8KgXLiW{7J%G-eOp!Zy1? z)Dacy3JY11Q~u&+n68Kn2mmen^vG!QWamChrgiG|xrh0k0+Hx$1jJS@yO1-n?pZ)X z2k1n>IJRRzXu)}6)cv8M=E041nUrS^=pm=`r+g@)zQ`|Xo}PpA3a4u;(UVrwmu@T; zl{Ym9Pb_^+9dLdzQNw;o>M6a?X-_^^0^MnBZhUs0NW((`;%QoGD7ul zI^wKZ@*^K$%p6}QoSwNE$<;9z426l2(c{=rjnBzu*Cm>`G5_4)1;pUZh?R2xqfl^- zqzTE>=6jves3`RP<19n#%Xi2PA94XV^{W5?O^sjqjFw{woahN|;9u0#B}=JB(F|-U zSLY|{?YZB`7{=L`^daZ7&I3HfC$uOEtZzLrLuE5x3lT={AYxt8tneP)D$2OUln7&<=Q=k8n&J$J4{kLS3TZ zjV&5rs%z9;q@-HcFqjX7CW#ARNT)~`CLO`DI`+KYF#j)A)bPcbeC z@g{l1cM9gEXS`8q0i3TfOX1;VdgFywX^H}}JTx;SVTJ=QN;qoy z+D$Q4OyJ}}xjzo{)6@G<0=OBlHBk~;ru#kRp5l3LMZG6-(RL=r+rbX!nu7Ia7%giw zQnIM|pz)W?g}Sv~2;Cq#pq{rd-AcOz+*RW!4sZp?OS(%Oz}EUujB#(-*e!$PC|M;2 zH%8EpB>pVFQ_+WavVu+Up_OMnLT<0da4fXE<;9Z{Its}(lGAem1s?W_IQELeb6nEJ zZ$(bDU&d$D{#u!$-Tf?!7CD!LaadyqJ;AXlhWiNAgaARkWv$6iHv9wl*iSZ`vThmO zPNKh~$b+ut(7c^)g2ux@Oe76*uJdF(u)5VJVBj9txSOXuu}6bghOXx_3drZND){nt zf>#s_MSoD4Z-p`e2BC-#y%qcaX!;7ED!cD%1q4KtE-9r!x*G&3>Fx%R?n`$G2uL?b zcT0CmOG{l!K)5v0aQP1J@Bhu9GmL{g_dGk+UVELr+h460gz{N~w9ns#bR0de{lS+w zd%^@Z@HESJ-xod4ac+j=Wl-gXM%MMdIJmZ1wfWx%3#vhQ4?YoS>1wxJ3Vz6Mw~)sT zAlHE=@+Rpi&L5)eE<6yzwd&?eKJ3Y-7Eo`~0EaJ-6mZ`5-+3|*B6g=dBlddggs`-f zZV!y^-2jMew$osUy3O%_M){Lvvf%v+$76fxK=;*@+n>50c8ih9ip0U?2#*{yc2mQF zD{ic(DnfLf8d{}xlms={hNEYUmRI>qo%!e~o6cw^plM#i! zuWn8}Y{!^vzkLgg%Rs91c_mCqFU9y`!?7yw%M3ArG$M-^X`l5=b!2e-8ve>_wg9zw z#~F1^ZD8<@1sIBoL1 zC=%t>;s1pK&L`kdI2+@ZFHuQ#F*aWewneLPEPo7<+j~825wp&3?U|JKGxI0HgePe( zKBozh7LxBPy)*tVKWU#|-S4lkjSh6Xf_!2M29OUP3P@{8rT?F4LWz*!pEDj0qvHTm zgLU6EH%*0}AXVsr8S)nP_#&OHX?9@%K|Fh@iOkG`kZJ#n;$yx50o%l}pz?WlNP1Z0Zc9(rq#%-mJpVhOiusFZNt1W?z>ht|)A7+RI zS`0|@ZJ_|E;rY*NdDco;=}?hugrmHwarC*5dW9Y)E_l*q3YNh zD#3ili#hx(_v2~^=Ho+JDpi8qg0FGU`#)a<-hs+(eVuB!qh^EuD2{*(!00H>8Bp$A zJh*q$=8FLp*)*&Id#7?Hmh%QIH{us!v-4*&jIsU^w z(^RO~b42f@%J`eVvu1(X2&vku*;6mjGu!*8t2S)@Xlr=@TRA{sZ|Za3j(~DUnIPpE zd;rEs(b&t*gnSz(=P{kjts@$t7 zR|*~{y~HFZ9AG6r#XheDoq_AJ|Kg-Wdo-m=Ol{XCKul-gMdC$y7cwE(BWON)jSM>C z#u%ILrT)ZU z`3OU7$TngrZ?A5547y#d&nmN@a`xv6UjM=h?Dn5`d<>StNiUizRqLwCtdtAXjDSZD ztop>-?A?@-jj+o1RIGrwkRtkHE@{Nk(FRnOfJfW>O--^iP?Dg1GtSQDiRHDaocxMit(A5S|BdqA?BQeHlDIK7K z_s2uscp>q;f9ZKW1j}l-3oV$H>BU!pl!ToY0M_I(JzosY=>$-?6+dZ1o7sNWAoaQ( z9Taj}ukjaus^%8Fzq%KOpxZynW}x1eh*g{3`Guc@t9;>D{5rb-bDGnoX66F9v|VS) zl%!P{XZFuWT>#-phdf~i!?vsba0uhH1(fC-{tnQxn)ly8{O$ubd=EkFCsI?2;jNu?jQ0 zGhDy6#5x<)wBB?mB(uytou!i_U1+ks@3T>aVUGB*ieSjz3TcJ+!Hbx)LzEr5L@U^< z?-M(wu)_1l9;cDJ%b-qDN@#%b>y*%D7mFLpYz%@yM@N0|m&2afhdv!M(B?Jwz4C^$ z&$|}$%1#)!f3+&1ZuAvqobF>yf|TFURl+uwZ?ql%>6|E}6kfl>+0^?rUmFeBuxqSN zS(5n*m~#xQ33qDxYx~(Wzx#p7S`7De`)$BpG`b65Y|-Os4QX9ZUq1M zG!?(NV*FZe3>Q^>QFyeOyzEFC23mHiMXNow-<(Te{0aCwDVv&_r;Gp+9IAeY3CY(GHmeG>olD)wQzTU!-{;M(O+E>CG(Jhg(C1$1qc*E4` zHXWig>85tZu|VllXtAR`x-ED$I>!wZSrU~0TpFeqlHN>CePG0L#p-oPd$RTFdBy_z?9=v?t3LBA$K$j1{AlR23?KY5mKCqM_cRorg`#w`(0gjlZT*B(E82%a7t#1 zhvi!bBvgf_-E)v(yC%{D?M#(1+Q0<9N0jC{joc z7Hu>EeJKDNsswI_JX4WYOJ1|Hz(VKJ}a3nZa=10 zCM5yGEbIKWP%BuAN({V4>{siTx7BhuBekr_QmAkmf>xDo$0R60Bz5hz;BG(TZU{QZ z*$cVxQ70eH{@L`+uZrW~?0#;);NnZ$(NKma6&n!gGcSQIUZU#Gk+-QQSgt17`-67l zKS|pf|J=FDA#zlVqE{jn7l7teEV3H&!br*8OH($sas!ZCz9r;9Zw=cR$Pj!j73FiNubS{2U?q zB{&c%=qd2?ow_6`R2}k@pR$HKx+3oioKp2FtJORiKc%D_8aaK6o(!k2gp%w4)#2F- zBByHv^VSZQPmfURL(kg{d1aszTVVY)a??QtbcR$qY2kwueYsfR0F%s3?xuc=&WB9n zAiw_qT7X*pLM6tUZ$mZJDaM}6V|_D>n)cC-pydsQ;4yxx#f>OXOdJ7N*=PEVE_bEj z`ovY^$oA>oT2Ynyd5YWc(HT}$aJWQoxh$lnvM9deP=SBZF0n~DEmu~;&fyw4{v4~| z>t@SuNC*(wF&n-~AF2B`#@_kO*z;4?Nr|Q1S9vEN#(r2 zJYLOK!6A9`3@~!vbY_l0t%V@FBwdD{(1M9})oih<5JzgeOjs4w8t@1)k3{-_gr_QR zMyS_ciS_4N3)!QvbJwPbX;Lh=ARJU`S#5rCt1*xr~;Yxy1-EPe-_j;S+sFSZ&S-A21Rzx4G6s<2fHwqMDAx}urT zU;e9QUKld+V}aeaSXy@6p9cynEHpIp2@h?-^7J}{2kIxED`YhP46h@w-t%bHO){UH zU+E4F5Wewh1<&#A3(w@@l$@ql;P{2cA`VkudTts2vua?pX<3`VhJY|lPHv1J<3zD9bYRM(=%RHp;7mb&RZ%Lk3nLjpfou)+v;c(tRPoZEsZEnS2#STR#MaJU97|B{%B2xrN>4QH{aObKHQR$g{^csoQxKSL~EYGl9{!!0v(`x z2l==KA|g82(0kQWQ%W-LN`mH0uR?2Jx;HBD+pU@#n#nE~33|0-KIx?pxhI3nb)YR5 zUj#Kf+;CKs<#zKh{RUJrc2-|U|G1{za>o)bD**l5N4CL#3vQ*gkUVL`cZfw#@89?Y z*Q+3J2kiL!9lB!1E*Wd%2l>c!T=fM3;h@jNnX*oy<>N~s_c^CWfG-+)x6Y*$zUL$< zq=tU5*Az$(L;lVCYf#jl0Or~9**YBOc^GO4f}3}M4=vEMynZYM$cg7KjhFChuMy5( zMC!G05AU97x?j%lDP*<(oY`;Nc@}T3O(n3Xy_#OW$VO1dw;|u?XAH5nx)e3!xjbC$ zUvFRfUE}d3dJbt)8rAt(k=V75Fi`$gcd!h#-^z{_5H!1=)7X=WJZ^B=0pgNI{qh+! zP-;Ckz2sdQ>T4|>R;DIC8uEY+o{MV(_RFy6D2PabPfMF`G`o&00Gr}Eq`(j@-l1g1 z7QZ!cMP_8m0-7_kR-Zi|%@vrh>{ zS=TIzJHxtNWq_XPpGhbzj~;rz#wg->oV@Qm7Sg}Z>sW>St&BA!%P0m+4 zqboc@Fvuf7KxTB5Ej)2O!jqCJYiey7WN1uC)9p??izY%rn2;?2;5wxb5!cXZzc?Yx(zl7V! zdrvvMPMYR-KkVrvUnx9hH7q!)HR$mnPhyU?bK2zXfY^+(#-JH=Lu30j)7@8 z>*A4l0a~EnwZ=lEw&5|$sAl!|r_IHA^&u6+^JmAgK97mG4#kU*Zt>n43?uK}gU5`o_xwcDe(0*5IN9B}@bnwCe0)FvCyWJ+d^wGc61JU;h zA(OIh^?X0A9QDIgXvX%hFX=|*H)1$dbu!NQlca@!zxxvazP)Vj15s03tTfuyQ5W~z z&mE?7kh4LpBVWyCPu#b-Qf6*v^PkWz@maF zSp2ECx&iTy9TI{sC6{K)q!@2Ohvo8BH|Edp}%j0s)a5QFi(G;kU+3jps9yNk-Ky zLqHZl9{p(#c1VT&YF6**)sj}y5C{%1PyS}N2WB$frm$qFck<&Opf8CZ)4Vjfod)ZK zfm@Ra{s^Nb6CCXz?ft;AV-r4$~y(X3b z6dyS>kzIz{YBuaR^Q>}Zhi*%FCtCPdGFE^72F|~?Qoq+rgtiOHRvdSt`~c1Q5C`7A z%}esNPQM4fkJR?u$UvyN4{Zp)7ie^My7M%8ja(7_>DAG~_+dpl(O;O!XMGmfJhf%S z+yl)vuw=k9f|Uf1VmL>KOKt-nn2#^GjPd71y{?m55TKANVe8p~XH*zui@nFco+PQ? zV{gqf=?C+itmU+q8!|6-+~yH@9L;!4I7{@th1f6kfs9F{H{WYy7zZ@xpKUEGODHx$ zr6vOqEjXdyf-@8F%-%NNeJa1pJBQ;;q*`rkBoUs}O+S+M|O(y%YGJ z8{<5F-^ya-*OQ6%8~oMlNm<;z&-q(cK>hEo>T-R(*xhl^i++CTP71?eN_=?g*~;&J zb8`E5%Yl-1;`HLS=(_tw6~~eh%+?qC@%qFCsP~L@c=juGu>NY;u$v|mk$c2mTNeqX z(^x+Xq?)s@SUh1UKq!f?itT_jR1R~^PbPTAwystGh&+A==mm4@LUg$(k_wjtzdinA z=e07>=xQeQ&F;S#BX<9LYyfUV9F&r;f)&BojvesP9SyVIAW0KKWN>Ff{9edriSy@S z1@S_o^9ztp#d6l94u5JLm2cHkwl0#J%_l|uqZZ)1nVR79Iw_r>6a@Q;c-!0r483kR z1brX6(-?i3M$CK+wJ5CPB!AG>9ODg3V9%g+*h|2zJsee1i7h=EC2hP}L zp*l;8Q*YLly=-gl5EcXV@;^xDsrJ>6^K(DM0~%5BlKuNHi@MXYw*G3QXu zoo!yz!6E~+@L?A=MV*b2lt^dAw6lMZ2t#Suaf5+P9pDk-~RrcTf(ll*}q23maLcReOJ3^xSH^!4Dt@ z9iP3v3iiWn_#wfgr)?9IwnE}ocT5M5F)ztyRMHy>MLDszL4Sa^)(s^HQOHK8Ga6b6 zVJw3)j~;&LIx;<5(!>$fv3^pvP$aPhx+d+Mh?f1t3zLq-S^m*bUjoI&I z?;HH6d~afx4&C`Qlt)71_uI!LvL;g^^&PbblUZ6t-~$T zs05a-7N=u4W>!aH3~%`SZtr)5GP!LCk%6uiUR33m3Lx}PBQUI2%ItYe3b-dKfqJ|JwWur(kL93Wa*V^0&%N>Uo1>Gw{;!gw8oiN09p$ksh+jcxq zQ%WX4^2kTrh6k6`Rmw8eF*3#~!YydP?8&NhfC%h<(^=Zc#^ z*s8X6w-o;ZZYzO6n^i8Z`2sYQ0OlLIf!d+>t_g^EPR2*E0pjB^SKb)hy&A^=5dD;YuJmztC?T}#Nbuy1A$+-)DlL6)+uK>dE(-2_ zd`vc1B|9}mvbm7mJ`S|f22#3?g%eWcUf=$}rKHghdWxr-t5t?M+^%s;E)72!@7ET= zwunMyzSF-~Jqj%)nW!Jhx6h#EaBOD)3ehxU#GL?g(Bq%0DEUtrp`FEWXXyVh4HKkj zeAm(zAjLHz3Shvl)y~Q7EAE;8!OT-_e4vm#C5KV+}{uTCD|Ix5KaQRJk01e7K}nPw|UB8Td0Z&QYfv#0gh$CE^wO2*p%Z zA3=G~Wi3o)oP`|}w!_9vpIGS^Y_M{q7q)X%QXJ1ea;J6+(p1U+rt-iNK_c4Ul*DCi$fbYA;B5`3FCdxxp;Cu8lzyU<%yCPdw2 zodfk969T8v48NH0O9Lt%A%hT8U-s!!tb^BGteSo@cts}h9gYDuAM+3-<_MDuqQtY# z_@#xkBF|j)j9$C1fEHil2&X(?YECA6k9JEL3GG1Db}!TMFBL`OUhBN4Qmx6`)TTc& zUeeK8b4BDj$in>}6!E3oiIp}DsK!q0JK%T?Hd;rn8LjxJSA4bhC=aLPe&L7X4R}5_ z^RB7#ET_HM?Ft38kh$19PEe8<`fba=kKZX)+@K2evi|)ndu-nc$LqNJ)9b2_1f9Zt zdA3DMzP(lnZvJU2BmW|aJgqMx-&uvPYc4dJHm#2rWK-dy1A9if&VJYx*~q#VfZd$& z08DhtJ?V8-_oIAOrGNr+Uo2|~r;5#Yzlci}34sutnGbQ96CNbR75*j0#dUMi&if^LM7QfmrDY3>1Nb5Pm2tf1}|Qg)oMziGK|PxMG|Bgt&YpP z3oY;*G$Ou5^36_OEG;=Bq7MFET|J_ftew%YvlD|#6Tl<*88>A{ki@bfK&U(rgq-s>uN{R^wyu~QUW z?9xAA3Uk)YO-+ADdb_G9!fl5%shOu3xU-L6J^Xkl3(BPZdzCuUA$`Y4Kyk1ybunWvA zwu!88QF@tIm($RHZ%Jt}z7Y;rJdu}}eLm0qJD$QOwePl7I!aFA1!hEG?rt#|OB#!R zRdI%q1nGKN#XWKI;nLA`V!%_Ii$YC5#%l}G`-*o!Go-BdkH#?c0BCT?3ldf~jhJ9`w4Kba! z>nwyMjjMN30OfxhIe+*LVw zWnqsSPkt?B-v*JD4ob=NqA_UNP^xi7{yTMp#Hz%R>`^=I;ZRs$nD#l_Q|O+!KL=x4 zWtm1;3EP}sj&RakM2UU(xW7UhImS)eI3f6cgYemaymT;T?>ukMKrMzKI4~FXrkhrI-t@2Zuz}KD&%k4K+lb~V7=En5%^fTbgH)XK}}+rtgfkg?HO_@|DYuTgpk~V%hcQv6gk+$9osSqLzP~!S0`c_4! z_=eZQ$;@+anltVV^;E5>j^*1qcBzMqqgZj~cu@qQt}x)|igJLQMd0^Wbm$jNMt@sC zl_mYjHINPf#C@pL=exhCv4^7(j4fFg-nz9$c9Jo-68Q;Ks*=!%s6tDpR;Hek7n%#L zw(XAx4XoCsTd$)5B%9-DO?GCzrI1`YT>Rh+JIXQ;J>Jo8G!Hg97w@8OjKcK z|X8LQtF4Pi`TOzyy=mk3obW5pWGy|7*22gZtnq5?7Z?C3s4OHrj9;1ObghA~wV-|bz&=&` z3(z zO8KZ-r!n}`HJ+}>t{K)wC&vUchW_Sv^V+O#pXTnSrer#~$_;D2%!}}*OqzxT?w*f- z7x5yn8A|95DdW+qH}jpdGQ)X}9@EF`@DItWp>hP4-)p0aiFSJKBj9lvKhXr4<~kiW zZzIc;FH5eq>o)c}f!0ONmQ>Z?@m0`m##O;w;S^Oj?Z?hfqhZy)5~yK_eYp6Ld@3nncwO1W=4m5RAm;)=>Zk3vC>UCI3j&(t$!_+;nk-n7-??7&}LaX+0^_ z_cF?F6_211^XbjR+#u>hrv`F1E!ZKWC0{TDH+m4V7S2#}WXki4M99UweO49l=O%`Y z!kAMBcFwEq2Wc)2eg|)dx(Z>&RMzh7eMBi%rS*5n3fUg_VV?Ic4T3pWu|cQM zTNcB8iRqJ2S-Q0Llr&eblBFNndx=Z7=?r6T!MV|)tyjP9-V5e{T>|F83>M0q7W8-{ z+(mws#Fwg#*D{}M78S?RRuY)>B0HOUE>;_5=fV-Q!Fk5;u1I&VRrGf$hx%tDHsiH! z#U)D{QQ_|##Kgo&n@!Bq*rIoS0VZhv$K4bMZ9=F4v~7F7lAPHACRa)mLrNiIMCYXd zp!Ea}GTUy(1KM5F*4Q$&rMc{GpO|hTc93URB$BG?AV~CHc3i6|cub@f_Dge0KCEF1`2_vDz+mSj zp-y#z7TNFfZ-vmh)tM;2YP$VenX19KA~!pHa3#AhaGFOZ!hdTQX>67Egq zMpnTW_EZmH{HZSKVZS-rH@QO47C_@U{9$g(E{^)%Qu*zwyAzN64l{=!cIM29nuPHu zc|3pzekz5zS%6cI!gw{gIGH%h55bJ21(DIQ<9^gsO*4UiMFGIH*JnH9X7G&EjAoay zU5MUcP%fQXQew4Dx1L?21UqCIM4;5jd0wCO*Sd3`wx15DeNaX!=nt{ctN#iTq{s~0 zoi9s_P;Ivm?G|ruL(W42m)cyf+IcaqhS?`3e6_lrLd%0xJ%Hp&7jiW1M zv5a0U&6xEHl8Q>=+TEH2i&Eloks!)RQ^rns`Csg5P zfoj8DtnzX6IB%z>sY^>YCbU;95=$Lh7#Tnv$CS&gnz(7OH1;ta&IRCu&&#m zd@QuSJ{6uBNt&p+JqaK!+&qG5}tc(f2&xizqrnGomBF0hHKi7jUqxqYtC0@y2R!N&+HE$$JZaD_-;M6b1 zR3>>c_02WSZ*cJpjZ>NG^Ud##ZFT6-;Bi)^8n#zoqd)wAEkKb=_iN574vLEpm=Pbp z|3FqOCRA(+9_K(IvT7BUR}HHR#{3M&4B^;O1*vD|=bLA`_UW_{bhgev}rZzkt<4hOj13)ZlG8AgtCU$o}9O5{_-H-7^1IXMfZ{4*dCzx zcx=RJ)qq67RySP@pGfR*s<8BNr=q<0mc3?{lwEH&{yPH&J#T9e#R`3u&v0~ zwfH6+%6A4V0^F5gF2G%FD?{3*yAUY8SaRv~L?70a2BOoYsjm0`@F9og;o{4|T`i+3 z$$1)oIKdPIDoFLgxK~!}NSsJ&X)0B!C^a4Q1Z)ZAUtBL^Dgo|&{_H*hA5TT3ELvT5 zTUFI^B5E(_7iZ$NvjwY#B$uY$a@McQ8y^F*m0CL$>w#3Uk1|JHZ=}-39S=Wp=nLJW zqrc?9md_qh2@R;UbQdB+6MG5>Sv>Q8##ElLsIp`g4ZT1AMBcu8goMl+w=BZqwu$ob zDuxv1gcM$261d~ z%#U>lE9AMbJ1o!243}r!Un!@cQ6U8hEDO@_$MixMD>;5Sg>-Clq)fjV1)&;20f7a8 z3g^vTsjT&gfIDOU>L8ceW18h%(PSADZG79z6>pax;Wyg#+UYZBS3ZI*uB4rwoA+S~ z)-RFn_E#FRnmOvMbp)}a&fqzl+7-q;Cm-VSXeXRc_T=%$(uH!4>hsMUJ_k#?VSq{l zL?=gJVM`TQI*XLxn@JJYU`y>?`j@gMGT|immJ-bguqhOc|*(&bOGYt|8+59YGzyNMK*v z&(X9}`mM7{*z2<7Q8y|z83am7WvGbz*W}eZf6zn1iR!2ICh6sDhQMC&9Q|;mY^^#CntG<)QPgTS_|?5_c+BnrHTXgE91FqVQ#b5MHoIxL>- zI%od?*j~oud)Q~U|CIunc_pPjDMR58Q1TY3oVDk86lwx?d=Kv9mv~94?Vkv!!OoQ5 zDgtNuMWQ=-w+LE=G7nMCTA^p~OjWF$;w#y*6Z}M+(yXAy;;(SnPB^5og~G-T2N4?1 z$#o%o{7(Pyqi+^zoj3`voaf9;l#^2`XN`LxqLjjM=FWw={1;{15F)Nb?}HQ4yA=$- z0Aq!HL|J7dyaEZq1|L%md$~CJpt|IAKA&!QVwMd>L4I9P%xc^D+lTpO5%T$u?!&Cj zkWFqW#mt?>u_YImbIjdC%Bfj#3q|tqKUXaO27=$en2IK%57H8R@3#76a6&J)vLz6J zu4?l!r;h6xvcRW1S z{=&offqBn@&y8s9{4bbf>Q4dfe_ceIR!RpD4V&NiD5IO3JxGLM(b?;>Zm%4+O*rOt zbq3E<&9t#cK32IJHhBh>@z^{6y&{@p*8K_B*Zo~@DL=Q*y-%}tcJlioib#H+48t@& z?crug(!lQllb~wFs21WCYB@DE*9|%yFYOv2$M=AI0z2JOE!|0w5PczbI;LfW#a8?h zbp%_%nC@;!VpymW??(#Iib&hasU15S`O&IfGA_3gI*^;^4~|GV!_r=KP)90LEgY!~@>+ABVYg15gZ zqr;!2m9o_pPQ@-lfCJx)_ky|8(;}R5ocM#R=%U}PUw8Y*^aNspWDu>8v+_cJI)$h8 zmAX3X*r@&!;?SYl^hQ3P69xfps81kMs+?m{d;E5iMw)%SQ_VFE?YRE7hBZp4@v>{J zO)an_O+}HF_98y#-Pg9U%pE6vcHHGU8(%K7N=s+dk~Ysg28Eip&OLuuTRoT9#MI`9 zN{EAZzlFlD=sMjG!1R#zV6JfDBDLYQy{M%hKOn!n%M!u<7Le7FHgb=HI{Cts)kCyh z)d9OYb+OnxNm$k9>hA~Ng1KD21m&_y&#`oZn}~3PG2vY@d0Ss@=mL=d{QlTO2;j4? zfksAR7|1jsn5fhfcA1iz3S5T%;Qc1WQt0u-1SGvfcUz`f^hobhGQ1dm$IznR5rLq# zA}-VW@gqUGX#pkB3|Q6|1b*kFB}talN;|Cq|R@4t%b!+ zevt}~uu1wGKGn>$qskttQ~XiRfpmxT8->xKi6B`}>Z6R}>JyQhb7DXtq!=YlUE)d@ zOS)3W*l6`n7TQCJ|c{9UY( zMlEqi?l`iPAt4!m^UR$n-29^cb!0!E!@oYwzAmtlJH(pj`uLY4Gf(3$;GPE!3Z5v) zwzBB*kvhF#(Y)gB-@Pq+#vw}LeF8gN2_-E|s=t>}y6EW7?gY>OYDgJ~1J2`af7b2l zocL&Zd5W9`>>=tWYwr0=T}bzY6C=FU^joLOt2q&i{g z^rg%bTO$akjw9jqjB}v-`Eb_gCqtKV{~cLg)iOnW@FJ?r9Z&??RXli@V&C`3(5$vG z>B^{~1jhNWSNA;Q({A^INwK3JOJ3lc3OjbB^Ts|kI7qqa1zAuX$k{)vA$Ecl-lZe5e2y2`FbzhN z-qHfj(P4$PUmuikLmcS*CtyQOgoKKPKHLIcH}p)erYC267i7ou+92_!7R*ljGtX`d zy$@$iDTXHFcYbjt#%)wr7<_&bfe8f0-kWlBvucS8uCopDW>Iega@Mhc#LCq7E?rWG zmN!+HY-&2+?P~X(y{aDJHXt8yj<>Qa>HxISOsEAk3oh|9-CkC(^cxw-BIcVNTbau0 zC3D%J*MB%bfilsU1r3s#@EvwAe*bOf^59Q<(4aIGJByjTK2qtRY_$_jz^P6k9>)ou zCae1`T5s%RBKtia)@sVb1HN%n z8#a8;TG5?5h4F~Eug$-BOUHnE^5>B0v$kGPyvh_0YhPGck%q(1WUw#E8?uKGMNU>& zQJ21H!R&axZL1^DVx!0pWPgv5%*Vg~Z0C54mb|{cA(xJ?8C!rzZX~z9J>IYbE{qbB zx&7E`2n`)lA?(U1YyoGk>2BYC>XQVAmGq+?x_QDseR1SP9LZ-NFzb!w# zv3JS!J5sj-3pvzjXMhF-^M8GOzUMc$GY{w4>*PhO$(;$w9i zzT$hV^+ivB;`48va5NY=HcBxOX4CIwCU*mK_i!h)#o9U}8%&Ry*YUY?{_+=`Y36y} z{~+^hb6sNv2&GPE&@w*(WYiN8-&5kn zR?h)0ylo^?)vs0Um-LGJ%O)cX^Mu32U7YIDM94eLhC2jR?ITCf+u&}QE911np@Rn0 z*h-gL7sf0z;I^OBI0C;@AU*BGh{?*74bF+B6Y<$%@-|=@YjnCq7H+?B53CaE2m(dj zl7=Q~zXA#xDxe&VyGxPd*c96iWS`p32~aU*`p}xQdsCyBq3e!+ zTOh39#UA-p{j=^TfLjzQvrY%%@x{p@7QY8yNpV!CM6=xt#&Zg% z8|LuDe)H=m%BzF|DZS=3Sdr0rlHMqsmVkLB0YEeGof8qi8(pY~3!^F28b<;g+vZT3 zgE6R1NcH)ckb21PMGgHPz8}r(S7+Y`Sjg#vp^i%yLTCB?*a+}TTsX}U^7$+1Nt zceKK+b9pi&gn55I$ClWVz<0>d5MZ^>emtpqqH5UhFvKrT$!6eniL=OG+xQW*m2-cj z>|7qT9m(ed@3Kl6gOjE!C+ue;fD?${sg%1e>GBr;NJ#iGjOsT7_w)7N`MNZ0Op%~{ zdp+pqm5A|*l-#YW*BvkxU{qKldHY=`6OQJk*z`=>zfU8alkR~rFiykL~? zi5{81X=jm5_C%+&VC-6#1?}fZmn98nblHzBUbi6Zvn^SRFd9?=(j*DH`s5z>KO&bc zG?as*{*Lur1io*k(fD@Yms+B>>#SOm{J{^;R*-Nunn#MY8Xbm9}KX<1$Yzv4BO?Y`707WW8L=WwWFpF3{$g7aA4lzFH+4Wjx3Ta2b{JSq04lDLKdf@` zv7bkGxlfVlsrB3M?{3C0!f9*$g5DM6H~M`Wh>8B@Qe;iqABP|GN?uC{Re$<(ih5-3 zZ|Ay9cJ#{Srm=!gJ8`)3kE}~#{EqX(l$Y!Cu0@D-F*2T9SF0IzW~J*b(a^B}r5QQ z=VYJ4y|b5tj)WL)dFWP>1S zi1drz>9@bBRRR6&`v5J(6U*+H;fXJCkRbJ)PYw0FsWA06QHKFX9oxBelv8I`~sLtmWZv*;HjV z+Oe>M+Nq?FYgC>yjv!GX1SqKixq^^ZFqkiFsGPdFP8U%M+LK|TmRysE+)`et(R67F zL(As>R(U7ZYsgv(r8IyQ57QkG5FO zlZpM6fyd;XH23O>H(BPGby7{W@29yvG0((PhiM|u+m(_omb?-MFsfbYmm(eEcRG?> zUOiFeCZm5xckZqjWHHeIEN}dX0VB+m_4(SfPDL1#%pF_XbTT%3;o$ zm35|@R!e)^2oV&hSKi>VB{)?egZLQH1KRO)sK}tJ05}?;K_$~4vEq#y%mY36yK+)L z_Rnb_ZOuafuO1Abw6Nf^nQZ%QtTYWDWSauCbHuv+rw^8K)RpPz8TxkWX=Q|LpT>R% zBw%jfHzuy5P$eYcDgycgtN=A?+W_oW&vqd^*tLPVUi7+6NuTFQJu9<99pQEb=5I-H z3y&fb2!{y40%uA7Bg_LkfR81dinG;h2rXYfRJ!G$2Im5@&HY8hNwOL?D4(?W5bc|A zB}Sk@7hV)dp4DG!C193(S2{Nz4orxFA4d)YKMsl=7f5;Twn_6sOZ44w6#!>DSsxUX z_1KP|0w57J%ym0~;D>QX(A8Y_F1ZcV#t&VXDAAne>gZ~CAuW3!A8UV*y=YWEf|AsW zeBs+H(t6G80FSWXSK~iW{tz6{Gkk>XL2*ap-*||i(}7^$6kMt<@Z}tW zeL!Zv*iO>u@R@dslkl)fV)fklL+jF)iyyIs`=rS!NhF6BR8v401yoN+!`9E$$MRjE zR&5~{6H#<63X}U1KX`mZ8TLHiFUfoI*JUZqG9ugQJGEq%gi?`i-&BEY3UN5%9UR28 zJnG8qf>`J}4!MD*204k{hGLeNU|E?Tz&`q*hH=^q>%);rVzDtgpL(WUhGIH!DzDeZ z?^Dzif{Em9U{&_6I9q$9jgLc%)s5z59jv&lwCm_Hr;H)3u%&R(LyRKz4+zUCh4%<< z6sftp%hZhY%7tq%iFr=YRZP{_9J_1gNaeAhc>x-opKS5KyncPzPR-hDOv-F!y!Vbd zLNalM=GeQ3{iCsoBE78tkEX8xs)CEQ_9Io0E=i@4hD(=pgLHRE*QHBDL0Y=ITSB@U zX)Z{2cS+ZOc<+BRIN}J7oY;HqwbtGz7<$2Ce~DV4(?C;PtgNPQHNUU%QrJlN$2O@~ z_vwG{-y@_mXh+{SX@8l{QTd#3%`N|2P#7cSfp^UgEy*(aX{gjc1br3Cqr@f3uef1Y zOh_THYx7T%YZvWa)RG7RHl5Q)1*BtLs-U%K)FXRT`TnIfrMlH^MAwYv z1Uqcf01oYivkhNT#Q^r4Vlg`Y@3gdf>RX z?*yBLUDk8HV#>RlU^Nz4PmE8%qDUwDPfl4TIzXT%<390m-vT&6%(v>}#jQ+#mWO7< z5bQnc$07R(78^6`;^R;_v)`yo4VRymnHfX7KcdG+b%SSnRN*X>5+$&5;~x27Qlako z!Ilx)`BK4<@QPb0!B42oK?%8^Fp5L6tv)}#Tl$2#)XC;8zBy8A6p1Ykdo?}Wg^e0R zJa9Og$8SP#jqA|2E0O=9oPgWcxc#o3)iABArGA6wxxjAo`)P4$GdKqY_q{4wYaoNYMA8Ix7I;m{eEv2L=rTfkH`@yAn|#VL zfq^-?O}h&&Qh!(ohzXOhj58&tHD_2-eh=bRx-2?zR%l7k5_}vS{}Q2V!C=#m#z6O$ zIG9(^ku%Uz3l&W~&2GK5uvo^Ui0IJ-xv|*%!k^|#oXmvJDM3g&j~Co~gyJJaap8;W zF@E2gk1qv2eWAgSK*wEUr0rGt6h=zhuelg>tkI#ND%>+MTtn>r=H^RKo3c!pJKA-j zw6vA!mk3zKn8)SH4#d#BQdt^Fo5|!Y9ZqCqXCultTR{Cx!mC;QfJEl^)7L$M*hoZ{*ig)2sTLcJeNh1n3@_m z(`RccUcglKUnrru*@Jm^k3Qhjdk;A!4W{F%-bQS-4^L8Jhdy3Y2iM*#2F`9o{D`^>6L0 zxt1&ou4xh2WNY*cJw&yAqMr&0{j26`K3-yMf2NPiyj!befO4|7&UmoJT?Yu|e8PeH zb&w%+fG{nyT_J(KHFBdi)$&~bT=ke}N}!eXZqs1xAp2rkTGcH7@*)K5hfSg2$$RqR zB)7V(euG_E<~AtMW4|5K)kZgMic&6Pdhk!rtb8XhdJIn6pLeWMGthI{;Zz5MwDuK4 zXS&SrseJfgzS427%uF616xCBYZp64BDWg?C_>qO&`s_N7wUQ9s%(bS);^OlzMh|wq zGaEq^xsI7ZZ{T^{xsT zVg4etIoXbw!5yuo)73U_sBxubcU9OC3d+4aUzGRPV z5Xl^@5dn~8jOlqjycO!AIC9Of$abimwlLfxI43;+*=8@=MqK0+@&acZ`h8=~50g>I zW(x}zEAJ?A&D7wqT=z~Zl%J%=7&{~%yEN5IN1%@&ZS0WWE0IrfIseWHCMqv#PW=88 zlzB>)4rjM<$ z41>=I6J9d8_enmwITfmm`(5j|+Wm^o=m|bEe@8T;^LTZ$@8KFh%xI1S24WlI>vLe} zyuWZux7eS){*I39oZ@GD|FkacyZ%j)A{ACA!cCPIbq9Av+5mEG9b)z z31}!T3eZxZymWDD^}h*Bl3|(rD|Z)+zT0~3p-{T@AvvO=9~YixfW zAHDD033|JH(4E78Gf*ld71MKmQ~31_U=QH*DHtSZaeZ&^|q>HoV#Vk0S z;rHwU{<-mN(Su%Et@t3P_&cB5ld?h25CB_X$)^C#nl zD9@h1YQ~R`GTu>OH}6c}*UKut4yCs(ildhrB>xLj(19U?CE!~`6Hz;Di1Cl<0A^k? zp2dD>2PjFtj*F!bwG$~^twk><=8Nm(rT}ec6H1T%JvRDi$rp^$H(3il6^e?%iY`*c z;~QiE7Tox_6JWDnyYb^Z zV#q}N&?!zn>gz$ASc@G^nUBd%>Xqx=ZS(LSah4>;oL7wuTD#r6dLpM|Re7bO0e#Y( zBj;i3cgXFzobxLbnw0!tJ`GQVD4_b|7hMOp#?N^1QZAA028u*!3(>r9*=vk7G!XL; zEQ+#z7^j@Cih5;cbB9(g()Rt*>R3+Cw z`sp*jlZ3n;UxnzsAM4pn-)ZbEraHfV3{`}&Sl^b?^L)3|7Hd4v>QGVpeilvsEt)7H zBDq*uU;6+`bS1u3L?s~z3~c)@f@1A_+-zd+F7rW3< zD_7!{)fnyOQ6@MlEQ+AYQeOL|>Tm#CIJIftFVuhzJ`JGP?SCdS5oTgS7k|x-bYCH* zV&YpCxyjn#D4q}$rhuG|_!w0)kQX{A3J6Lj{icDSph&)CO8KX`u?;jzz&+gar1ZKzen^Qua}WiERdaQ^2G zO-ugc1mG>RvW)SoyJ_qK8n%k^EVjT{%AngFey^F!BHH)QX7nw;pZ1y3%@r_kyEM5D zH9qt1P|>{U`s>&93FjMc3$-asO1ToVk=gfX2Y?&6VXvpFfI)$`2)p0L{q>_R7kp5fN$1HmQfrt7U#QGYhg#c=anc7vNckgSHpb(rN8Ql zR@e6_-)2`9VL0;s@&#KnUb8Vy)1Vbo7e|xaT0h=uq*OM)*0%W3CuD7QpLK z3x63T1Nm1#umpQaM>{y@1-;8=^lMA{xDQpw9(M# zx^mU9TjUBhw0yDIWL``a^o`B7L~@gcV4mE8E}E@WMdvz(f%Z%RUn3X^-R3{Nfp{$T zsCR#@pZ<}Ae7sl^>X+2U8|V;ZNbz}-S0lxRXIR>6`wAAi=t_C06I5J9qMSnl|$JbXDduJG$$`iA&zI`%c(~D@t z&&hjG*{dFie6o(V$HPN_X8b0UPm2Obd;ikQ+yzGXH)E8s6e-^Z_efDH=PDxwS}HuY zlONWpsp*H<6M8ZI6!0=(kabySy0(2;NJrPq^&DuBz#o% z2!aoAlK|UX))%4u3vYdN;N!|_Y>ur}xGVVi?%}Smh{5ETVxOc)2ou=i3heg;Sq7;n zEgiiZjkW03;L)znUilXo#iNz%A z{r|+iZrpNeX|Q|h<+IDk_XO?;?jK9zLkAZDK=X#y2ipst(#qlwxiqHTVTDsYyJLA9 zJyY$dtid$_kB?RZll;7OO1?O-G=T)L;i~hkwd1`+wjWwg10 z9&ZGa;JTydEs_l;c#bv}2e-<1%GmcRf*p-cKXN2F52fhC=tH*zj4c>Ck3-555*rQr zTH1e!X1zkg45ixHOKO$nov4zEm|^Be>4q2B1ISVwnFX5_viwl+l08JKpour+g^(mlMqDYzoZQG+q@c$oQX@DGe==ZDD<~KZ=&Cn1MEU{YAOt2714Lhh`{j>z zDKqsOlz^xnpBkJeBQrDVVt{aP6~O1k{(FOVy1Kd!?CxrvpsD8a8m;sFUA{lqu)LOl zfW8rjof%8;WTb@R(~IC-Fc(fUeyE=^ALHxXA2xmOGo{2R|6aX(4#A2b-~ylfz#vPv zOGL1C5?t+lb|bBj(e|gT_T_*nnC!wLkHRjhG6*P7U}*f)U&$6u`QSi3F*R5^_d&<% zf31fRTtfT@{o3ZBy>>eOckQ$f0r+n$ZUvdgQ(0ObZ;<(2zK-Ycf#X1h<=$)^zVeC0 zc&(lJLTx(uijRFanUzwiE0~Vk-+k<&IF=xocKk@a`8#LGwa5&;;L>kIL;*vS>(p3H z^af#aV9e2a;~&E7$&}G9vuSZ11=Z}2J)+!kkNQY+qS*d6$SbK9EaDack}tB&3w`Lb z?ScyE>OcW~?&Qm?;pWQOjVZ!;wy*rTz$?%hAS^Eaq@wgEFz!+wkuY$efqwXYuwr?o zKiGM}GIYk~_u(3wBf{>=PsV-qOxnxq4bAwT!%GFRaoZ_`IgT0H!rdTu+bLnp4x+al0c)ON4kU*^@4gXNYqMaCMBUwnf3a=mTA?Sj!DRCPm z?Yw-MiS=rNaQb-Nu8@>$GnDHS#EVr#X@}PhA<07h<5%R0G7D@vDswg=aaClg7s&nw z092AJZD+K~sRWG=VS^Im3+Kds=i!L!dUQo%{=mh&t@rH>9mq-a%0TcyewJ_9h{Jgn z75@IOq=AD!$G%~$g;%FNe-o6^@~7n3d&pMfC3FD$8~ICo1TAj2d|Qs799Ez?H{Jh> ztK)XNxvjy410sENYMbX`ttS982?=M5_WT23douHT#UY&wNgUq5FRBusgFe_A25geM zN8fy|ctXev8R(6sw>Tn@TQ(pfnaHn;G@GNUzV8?6x4`>Jt1Trzq5O|UbYF%b;hHiW zr>kt575h?;@3nZ3j%LWGv=kpD2#LK?lI;b6SNei&$_ftZ_4RFQ z8c$P|4;O&=P4-_jJC~%RzKjl*4_ni{hZY%DTNn8K@ua|0~=yUb)4^+9E-d|nPF%b2U1YH5@ivUaW z6R=(gw_p6I1TJ}7`fzngLx6khVADJzoqHQfZ}6Tl^t>Z$of1oBeqC)EiZ?kbQMpPz zUBz$&g`UpW36kTvX`twyq3BIN_aXe}cWIADIR;!4k@~&?wLk9Od7ySdEG-XL)~0l7 z|Gq)=_O@L{OP{@aDVV`!?ea}ZF+=cThcn&F8@V`HD4{%_YWI*V7q(@HB0sG;$&v!z zd7jngG9WmYDA8;_JEd%+AFn@T+>IZZ_$EnubbJ4$LS)Tn7tQ^|5#ZtG<1E+pnZo*e6u{k5u%61~TZ2`QJ}Weuhi% zCxctRgF+o|uz)&OC-fL*%I3y^!$7yYOSSws6sib@5k0F1~|w+>>w z(A8xN27RQhzdGWz<3Yz?OH7x%g>6xS;xp`C?+U2>s|vswC;>0P#43}>(ot;^(6h5X z&vlx>EFdeN=dk9UOSJ%f!{$QFCl(EqCH9uims?| zhD8A@U8sFY8t;v1N!aa4eWaSVCn$qgDsguv^9ut=2u1oWF^z8`v5QmVvJ|QVvaJy4 z_r?N7W~D%l$!ci-S(TJcOq-_iDqwuG97J;0AMj-VRq!nSkoAq0%I9``WaDy{dKV&L za{suf`1x=Lz`xR*qSr2Qm;6SG`O3gB2hY<%(-0%Bgu_p|Ef=qsk7N?#?+V@}C_7B6 zRUCVbpr673PZ|$8rMC-4U_#uc)_U@4TAD(kZTFYX{B8EgRN_hJT5A6%!*3ujdj{S( zADrh6QT~s~SJ9O6l`lCE`D)8_I!yRDvju1mr_A{qM?%Ek#Ny5R!I*Fm4UA?50vK@Q zX@I{F+^0g_$~Oj4@Gw_wv2o~Y3&w8j4^=I-kT=SetEWC?W?1`&?|4j?H)4xDXp^hI z8RoTYqXQT6U@>SMAL1mF8H5n*rW$6~X0I`WrkP6tktE>P2&B`gNuRs$0#PkJMeyr$ zl%xe=t*4_%-;#h5NsskJu=@*_zncVdp)PSR&>h-$8Xb^Nmi^b!>ei!!Ko$dT!Dp4U zHdM^5tA@dD!EzfY|0&oHrodP6`m6AKb3AHS?&4OQat!~?R2)W^+!Wgwepjg9KqBzzr-~6@NHKPL!_N~`7g1&&oOqZbzb zZIKX;Mxk6{P~ca0e-^v61hyD#XI))tF$mr|Fy+)c&I?v=dPPZ5@_4QhyYccq-)-RO z11_pRl=kK{B7c5yL4YT+(tewIej-{gpQ*Tb#+98pDlxx>tN_$9dwJ)!^0K}Jpzgdt zcUswbCAn8pEc0;i)_dFf?s|0j4v$%|CCChg=){wT)92vaQ?tQckXfKQq3z)@)cbC> zFOe^YT2^m9AU3+S!w7izLA|U8)2#jF4+a;|nNQ9n+9ch6_|PTs<;7K6EUnU= zm2^Dgam0Fe1S5??YMv!lUD~`eUs^4@+tCn@o9FRRi}T3Byd}-zgj_tQdeOn%+fp!)8KC>5>*7bS>sQ z92j7b0)M!fvsLw#y4qFlA3;IQ((8Dzs^+7$w8?VnDn~^0;tawz&||;wIx?ObzEY{Q zlhkLx2hJPnjk!ZEBWF#wwH`_@Q$hBW`L~sbrtvmRPCza0uE6~ZUFeK~)AlFwUl#Aw za70AyG9`x$`&0O8C#U>6JFf#KwEg4MnqOZRlx$=a;@=Nd&*JDDjcG@gd^UuJ}}HrnPNP+Yod~r(sX%(f83{&8q}A)L=z=*IyX;q-McL$>SKEp z)I$F;xGr(jcaO7txiYEz(TLX*iFk6t{^ zWn0!+8%}ku$+O?c$E(#DjcFIwRcW8hxDeg32AfBQ4>O0XOZzO2j#!bNrC%9Nr&l!m@3m! zauK@YZIumGk;p0QuX_!LNQlZ8J&0NZ@yNr|b~m+5=_C@$G;0tnLp5}j8?E--|B=nw%i5zx4~b+@p%5l9u)r& zx3y9UyB`s~T5at_3+;(k;+SK)aNz8NA1lkwTyfYq8cv3-_FHa;R?KuI96eE%5S7lB z)5MceNoG|o+U1ltVu?4bnFVX~=xwYW>0CMurjy9}Rf=csBl&chfDuqej|mmtf2+!x z6oLXcI7ns(n3WVtzf1EXv~E5&XYaJJ9baE9nA$TX7{)6>t?yK)fyh3GkQ z8NKf>{IJdE72FdO8+YsEX)CTo%gnescqb$cRM}k(G*(D_ibr<{Tn{Na7Z_IOlTn|9 zeB2OF6>Z@6z?l*rIA_&*`rQkF)BA&>gaif*)dSaNm*Lnto3^#}@N*p_y;i4?5~7p8 z<j=;AaUKe#F**_Xx=W?w6;s$ zYSYy`sn>hcpLD0b6jVj*NO4uRzoOeY1Ty- zYA)tauS3!Py;w%M)k%25tcIfin+ZO@0GoODMbdw`{md(lK0d5?x5n+txqG>Hv2N+- z`F=|NfE?u?3dLHiN<;MoT=1M@&X!%M^CiKW`N9#ovTQwp@PFRUdVF`sjUEH#6zZff zh%?qp-UHWUqW#asC3J9LgI|ynFmO#7*qFAkLH;vH9SnI{gMoqL;__lKg7PLuI7GzM2j) zsSYM^JrMt%io1tZ=o>mfzT`75rnn}+28wS9!FA<4YT7riwbQ)wPir|h+U!DKRE&c4 zM3Q>hox*oCY{I!T9px5o>_t-2yYlr+$>YSS#k^Kj=ADx?Eex2seqqHHkrXgOn*tMe zbfMswx63zvh*+NakxHMRg_%Lz0V%(?=Hv+9`HWuFud0AwL+i>%bz$vz;H;vmJusQ4 zV!9S({n$#!Nu*%^R*lG2spXKm`FBGGYl-!T;3C98|B$aR9T9MS9rR3o+Bi2BYSv*J zJP=~3{AVud6^yD+&O;(Ln#(dwMR1s9+GH%7!uhFs9q*62Z4LiR$eRFF_vqP5U)lYB zQEH6;NRgSebVILS4Bky?JWBmsWbh_B`O@?I2b^&-wF)~XsmC6bU9+9eNWAtC43Z`* z0N?Dqr>jt5P1OZS45xB(6$lb&3cmms%Hv|}l&UFWUa$N43iv%-1QnLW_q;cDOw5<& zPwGqvFsV83b8UP4?sYRyCeUaq90*%A90g-<`($X*_8A5GZ`&kJk%Ojz0tZ&kwrXi~CMuR&xuE$TzB4_C+xhT@ zhjHnA7$98&#hfe>pTM?9VPrT57{g56PXYj&j#MRwRg~X(TB+ zGu1xq_Qa>oS=9*+5Z5WaQ-y+nDlD=RBCCegM#cs22L&+o@1u`ARRkhZJ0N4#^n1Bl z9mqfk&bZ(EE{=k5cw}76We~a8P_Ng@*#vLDXvIHu@p*uI_XH<+j3D^a7t_zFP|9!V z(pe>MQT6n$Pld%hwj7Mza8^%n){9EJKz8$DsBXjzD(Ie5poNLa(j<}`HteO0O`*aT zEsB=B;g=eT+nAJaQkU3@>z1T;i^IDMB&6lSekKx9;iiko_Od`3=cin6uH-6BoM!;G zsvj&qRpnYK)B9d$&LN%`r@`rEkGY!!f$3S`@t2I~Z)91)E@low4JsBl^Sy`FWs?8q zP@78+%l%A6i$+D10-vO(36JKox^Q@r?cX9p(LaDl!kI#n(iJ?c25}Q>!!$Uw0@@HqcWdHfT@E+as6f*+k zF)_E(hXSKa%j9qQ6yWpM&WOWpEb=j?ALO}tW!1#B6v}sG3&Rq6PbW83^FZ#aKU)nK^o_7A+=H**3~ z6sD2G53f1YaJ?^&=If7R>Kx{m(s&kWTN5Gj+r}C~iZ!hR8TU&Gj4537OM?j6l?cpa z{JpkZM^#Y&7!X6w8#!u9?My)^sd4$o!h)6A8>5U$FN4@1|2#V^;jduzabt zU2aip#Dz8CY;EQD#^mCXJ+7)*oIUFgAl3-NQ{Qi#TB9RubglC&n#nOi>weC1q*GqaACYD*6Eh#Y+?NMG5SXIEN>3<*2c#hmfQ*&kxK-N%FRhRZSH&V!|iYA{wigdIT621t`L)c4nAMXa&R!Z(o)mao#eDahG1gloe8HdY4P%hB)sHL|Mw!neHWE%R zMwdg2E&0#?2ut+Ru!fbS{9c1{7gm%RACE9D_)Rk|IIg>>#&2&~W731KgI=IJPY*ZD zn`>=2IgTFQN##x455g)OiV8BqJYCo`Y&ePHHuG%s+T!ny8k4+^XCzg8bD{*{)LN&NboO zk*?#2(MRmDkhVUJEnEFPToh7pZ8{+}Ea{;NhGT7`I@4e#URi!9sbIJn=jdV~Kv6go z+fVuIX;=Go6I%_o^Oo4`3OvftwABQ^RJ?9Q&B62@7wpqra{G_I*D-Og9mt>zRcvRHXQLc!$!_dpzxE!mkj<#xNsM>QoF+HMoQt!1{VitD%rys z&*Qw`y}@#|*7OIE3O1aSbo8WcU8tsyXTtLL#Vpo`da-la-?F{MO#z#?*}cw`J*guX zY`@!ykOC&3>2(0S7u0pM(x=g&+HLN(Vy!DFEjoy$dUJ{+F6`L&i)Wkf_Vtq}kBUlg z#O2SIdN+8h%k|*3We)a%>s>A_=jjB7G;aLIdGVwN9`j65X9W6L*IGNx4KZw(t471o^>>=3Sf6PvF>V>C1@Pa#(9{{qiwE zndhwiq@^D?NY}R3Gcf^4dt7A&C6b`MUB*a=fVlTa#80G&$bKB|2>i3D=%W&J}cq za&erOi!3kYzHz(Wk{c|w)fgF)C#`LQwn&R|yF~Xa7$m$ki*@2H$M$(G4%Pf>T~S`r zg|#|nYO1-7amcPitQdK4u_ajLF1x;6=*opVE%Swvjv6?Ih~nj&rTIyRt*?&Q+EIoU+KoIQcC-F{cdO-NBuX=ZtT zG!_bHYZ*Fxe?0iG}>0ZGz zvbgDTzr2TcfS;x467eo|C-2!0QaoD`s9SeplHbX(B0OAtAU@47Pzn`gDzM}Y$obE_ zQ;Be|n6aeGu6kTkL*7Ks#dYM*J=w?icM{SOFHq>;=1W8Ha!TxfhFd$6A&pcI+YXo0 z(hvMKBS@r9bcQVh^qvn!tf0cSBk~@vE4M$FR%~4omFuWqb=)6!io__XDWuwNM-^z_ z1S~)DFB$Vto*7liiWgts0>XzpX$u^!`$}-MXmR3Hm0K=)o3$F1c0fWTB{pAMQ$pov zsjm}on{>J#dau6d&j$00nz@E+gu_Jy>6&BSzW2z9*~gLo3*dNho)I zSD{zueQoDGk$OjY+^L}E2&-$Plf-56)8-Zab!a;=Zawqv9uvwTU$_r}37olKbLU(B ze67ef>q`u~zZQ4qY>Ju4zqsB@cK)>ZC$of(nwgYBkktl&ht3yBU)o;a)y`>eAbQYP zW@WZ8Npx= zGaENY$2hVn77_04GpW^&UKL*{4KShHSdJ}!V1`2p`{s`a_#T&M6o~RqQ#XS4MW7|t zYf1O>Lcei)Hz!`XeIm(E97#7;$<*Vs+{`U52=WH0Wga378Uw1y8faV6_BK6UiM^q&k)s@9@wf}2?RtoHUohvS9Q0c3B_55;dlz;5LTZ~v(>Z2*6tdHb7 z_J>uC1df{NL-t~S(&JjLSkOuc>9NIR^Qu=&~GS)f~A(` zl3e^3XTq&d{V_FHsG52c*~#I39``+5*QX|jocl5Eq*@mPb4Utvg z>^SK^aeb%CiNrt!Z>MjSF%|55a|tl({Uk_MIXi+vn>2Opufy@d#e2AfFHh~A5y+#g zTjs0^F6r@o-5e}$(ymo6PccZ2kTzUKQeU1Z3j6J&sN<8DM|jKq6vAp}_QzXU*3=E{ zcLpTPID7lk{q8y$pOjZtm1Ms{6kVo5RG#^e?b>}oU%G{wDC2K6T=fJ>G5zG@InT4r zx_YB&_44_uj=kt^a16rP@%diK$+2RmZ^G)p6T&)NYYsDIOov=Mo|jiA=M`5wqJRUde7 zM96y@j0sn;Z0K5g9I`dJYZd6=$G5wKT699WIh=AjRq>zrtv}u$2-J8zAS}Zp^yDL7 z{`-ROTiyPC?^6tZz)=|)roa4O>RQsj4Ve?(?Z2}dS~GArT3PwWUy-T-sh}4)c)k$!T=E68zy&-axU{j{R26OK;ZN> zkR)Eg`7y#1Bei1xt3xVflF$`+1%ECzwp=`YxVS9t>bt^g7!E27e)XMIy{uG9h`$s= zuL*PWGkb8A+q(+a`ndh1Uczl4}_)!|(9?lQZ8~a3CCjujMl;sT= zw@6lr!BPQGfY;TF<)>K{RrT0P6O~mvGub@Yb1;$2@Cg@s;6j%rpv8+bN=6Wc@t;k~ zPO591Bq=WF{#q~qF&=W4(Gj7Q$LPbuGH(f8{Cs)RdIUhp7oML7#`Q%|^%!Jy0C6BH;er+x)$9xvg zme5CN{oUNxcF;B_&C5I7{XIuavN4flKPTIarZw<4_X26ISG-%_8$idfIj*t<4=C*i zoZcJ3VYe^CRSaIPbkcxJ4`?xY!+cPJN&5S=clBrER}LjgT=w|Bm$qOd7V?TBd%S=9 zctV6;>7x<~&TFOEhn{`=j14j}pZNCfSO!lFS&`{Co=6hc9n9$+>r89qDHVO{hA9GS z^6Nw26@0IEoQe6I{dKPNEnK8!?ONyWMJ&h`;VG`?d1tCku=i6^o-1aOl)p;qdpgnk zffgpI*2i1klFVs7q5xlXkL_?vq(4ObQIqs_P4NkX4^m{qPTTZvvID>D^Rhk(3OC6# z+Oa@5N5IS7&MW&Ol|df>!t&nx?D$U!8N2D6%B#{PvVXXwSF~2PL7CeL%G}?e z%=Hr=s9i3Hx2vnidyg1OC3b*M$dB#gOh zwV(>p-Jusg0w6QmDk{by6s5B+~8y(ME^Yu_@ptV%>?V zcUHkd7_5-E*^ffOMXa59aj_BqfFSV7evvSBN!f;eL$k$_(9{?+TQm&>BV*37$aDp5 zJ@wY44D4%xszK3iwqIWMCcZp%-zVaKy5-Y7*rWgPLItN4%G(v}d}yi~ZumKwdBMvoVgl-}D&2--~O=r7jj znew~$vue77Ms>mljrz>1R~=>sOjRL^@1o?uMqq~b0DfA`d|fUmCk(NGfZ!EIYI5tE zf|fehp+bfR0BQ3AK8+M8?5ii3K(NKy`_V z2rMnP>HrxPH=TUu5)A+ev*DDYnO`VwTK~BXCsSLo^~xQ40GU<{iEnIz$EJ}@9%P5^ zNrIxJS3smY{mY@EyZEKTh@`b~YS8mz*)06+4HNT$S z;&QBYLqD0Mw?Dn#w`b=_%jom#KFcd6v|w_@N)E<|7&>cET5B)c7Y`l8b7 zyxwoD>B{XoH|Y)3I}AAy!lM%jsQG7vO~JrX)7PQ~jVms6pbh}}^17P^+yj71x^emVtFV4ULwa=wn~#bMVe_^RM6W@e96WM%%SYn@&M81D2nG3NO!UWZ1BE}N zy^pIs3Xkbp&1}v8P%u5|lGfg>s!-tpp6p3Plk_;>v1D?+a0YP5X1+c?1te|2y*g}r z;FlN?$bIW17Fg`vJx_!Fd*j%eli=`g5APcTk~7oK;Ba)T4B{RE_u#cZNFjepPF4S^ zOw4>O$S!w)%fDiM1C}}DnN15`Z4jauG-fZhG>vps(BqZ%HYNb~#QTB~xEi`PtL=zx z``E|XL6rlS zV&n%Whhe|nd&l`Vqvf~{nF`_Fftuybed0lCdne&FlVJQee-EY|dkzq!$lzMhZ4d=5 z9Hm8m@FeHM1Xwy}x^eKEZa=p%ww|zW8;nxke)vLCoxyrVKZQ^!4x@ z-`k)*Aj&Cd$|~W=wDdr@wp@uCi+BG;A~<;tql1_70DuG+F|6y6b4k!60xY`4_SOYR zF=9UQxVUCi@opt4AE|TL-XT{#cCRU0Sf-4d#)khe?lQy*4;D` zQh~i-u~~_BMqR6?AV6de?pmiJtKA^f4unDjH=tj@_v|>JpB9btXG|r&VKP~V@1_a- z#S`j~paw*5aYuRVqciQ0KgABX35IU?+ujlTB8h?i$*EM>&rTl+8}FYWX(>kyG%yaI z5#CVb`UkW}0)BcwFw=2I-?GhFHKS9T=!w z(`MS^FRW+kyok6CmlU)HCb-V2Rp>@)uN=CUB`l6H5gX)cGkf_uBF_#1#<3kr8pqFS9<9t$VaijLV-FFS4 zx(nb5JvCf2o|bZ;DqW#(|4Swl=RzePCjir2H*~$Y7)yw>nu`7N8wvlG+ZlqaZKK~t zyHuE!^^G z8QoSk-6b}DwKq5#Tx;cp!j)P=m+g=@Y}H1_>+qD+lG2g|&mSWQO4!x1tv|@g2pT0m zuu0#pLB_Kb_|-0O;xtrrr#?!HqNMNjE(EDL_l;Y?KY;uLz|^z8o0`;rj&Z`36zHF> zVBRE4BkADjjT5I1_SYY#BNJ8ebuC#Uq(o!&LuI}77-W2cZVg)$e7Ce@{*n)WZVrro z?ey16XeRn~#>Yqg(_nE>$@(Xzkh#CSre6_)D`8|RG8|(5#O-<88ErtHB*V^+r+c=K z!>b1Syub54UGp}lBrECVE-{o002##N!b`)Eee`-KSBxtjStzCc}d~s$ry_H z+`!3G!0hUHa{V^qcC^~$oHuzpUS(1}UP(#cQ=aGtc>ge7ij5?K4KvvY3go`k7q)2v z08)d{IF84H|7jX}8z|v?M$E>{MnqveZqw*(p#pT^;_JD9t1al|#{JpPbpNPSy>pq| ziMLD_sAJ=NKVYkw&69n9-&oI%RV8l)@;;C3C}${W?!G&!!msG_nUW0U(4$G0!cxpl z45xW1X_15`nUoyy976ou!y;ORktE@A*{oJaR#J7!K}e($GmHU?s8jVk#a&07j=^q8cy_qgelf;=+3{NJ-m z5N_R<_cu6^x zlnl*{HG&-7H32!r8ME(gB6VZDup(9Ul@FT)H7OM~N=*8Gn7ka~7<-YKBSbI=_1#C# zm)?9k_IgM{HERKy%j}HhQj1Fuo9%ut9!sWvoTMd}y+J5q1Ik-iR-9Q`o;+9l8eqgCTIRfl%82}1peua< ze!Q$w02S|+?nGe!ue>jDhr0d#pWVL8PL{DnwrrKHLX9;dL`+H&LM5X-%tRp}V=H^s zhq7m>#E?=XPbfr8il?XyEk=podF%On|A}8$SJ%~b-E-e(eVudebKdWF`1B$XX8!jZ z_gbFFd9kRD=_HjaIUQHjEkE9M)iDnGIW@-e$i!INDZci+@T=E}^nmBh5r@BTHO}XU z!XS4@OZ@Q2)aR4+Hd>ptzq;5XJ%=YjCaNQi<3TPN*@MuWI2^9*I^&15sC+z0XZDzW zZ*oQc<30B)SqX{*FwulZ>2`aIVQvD1qNis@IvHpN%*-_JL= zHCK7-`J1SFK^(6I-zxLsf(^^$_j0x-U7>u~7O~{EJ~K6=&pR9*+ngdN_j4pBC!)vG z{0byix4ZX-TS;#6E6ezKMSU?+{YUGf*!@MZ3u+pRPTq45-9B}`JNGWMZ8;jccv}CP z1%PZA-e_&@dLy}lvp?=evg$sS14QQl-!lWQX(u#)N#rHcZNv|b483#?GL$)`&7Z3M ztK*cwxeDnEY0~!_Ipce>`K(OLz!H9}tWSOHy}Z98EMvU;AAR1fu>}srW$AD&a#HWI z6i+(oS+T!!$J+YrMO6b`&(QqicaNVj4m)ofCYC+@jZ%OAf$mr2M!bl6o!ilG8hPzNP)+e`Ybew&r_<<)1K& z-zJ^Xp~`voXvE#H)}+Rs&kxF4P0T)h@%>~a_vyJJOk=dwUKrBno}Thi=A9EsNxyE!i@LAK1* zANNB4uu5KnpS_c4km04JL1C%+D(Ko#j5woWLQhGkB)VL&)U$$F1QoqL%M+KG!}^tH z4^8q!p=x{jv4!`N;ps=HiJrxk9L&BWZRrB>Y$B8?t6(bJ*E^sl9i}~iW zChV%QdN**4*QWF1+5OX7VOqhiz9+foaNL`MwFG`B8X3m(>Zi~eLNojX$dcJq4Ax)sdWeohZId2ycly!~cd!L}+j_`rzY>aVHwEk3_iO(~{# z=QHr|aiZ1tZrZG=j^%;t!jCx>;@qPL84Ao8fuEk^)mqk?rt_+kS2V-~&gQm1P8K4| zjNlXJ%E;ZL-@NxfGTS0Kj_boaqc}DDS0mQXWQy4 zfAfAAcI(X3?xuoed^l74;>FJEUjuo7WLrDD113i7TT4ORJ&81FVS?D-lp@b%gHtki zMFt=BQDANyoRv0^=fGj)-IBciPM~A)%QPnpo8FsMX+GuE_tW5(n#Om%?XoI29R7V| zx68^2g3G^w0+W3Ue+8I-H^|&x+o|8!_xIWt)zq1wlyYP@B^4dQYD-bacdJ`TLU)zM z<9Ix|DT$wWJJ)d;9*2@Qm^)ZM-tTV~CgP{uzPuU{|L}QE`T2te!wnb4t>Lns2DtJ( z;@j!^`-OHX%_$v)58sjx^qn+Y{y4re=Wh-@*e2!hW5c{qvFYtF3wZkdlHl$HWna2! zF#B-P%jrXwDI|X~I*H@nqQR+WsNYnc(PT|gArNZ!uhGxv466fY%~#h#4jh{P&FDCK zK(yB;3cl=|^;y~zJ|Dj|(9M7uYMjs`@}WGjX5QB4R=>5Ym1M-5w)m;_>VZYZn-*uc z{9h@I$f37tQ$H8AVP3obHUY5@u5M}!u3h?Di`ZjB-TD)y+v*tj-__P&NF@w&R3KH` z^FP%lfNCpK<2V20y(M+h{KvxmJpO}5uj;GnQ*vvkp3542ncnTTdCyS@&5u9INgO8| z*M0B|m*wZ^Pj2$+ILb2u9}(U_fCe{zBbU&I_=oS@FQyp%HY=cS(s(T!-XJ;IC<%Y&!cTA9A=T@n||-S^y$U4bVTsck>+IR zTf$B0HvtZ~y!dCQvCTS50xF1&S#%p~S0`7#H|!7n-45}x*+Z9lJ{NbpJ$vn%95glD zmC`>y)?R-JLf;kBFM;eT@x5E}-@=Q^pY`6h0P*zg<)&<6&lh!sGo}y4SrK`?R3J-l zf-B5)MhjJpob*VU3zjJgh+dfZ)bY!(*VeY?r=gdFDl~M454zU#v2Y)-5s$X_+lM1Fc5Sys{dC(u zSdnv7Zhqvf4w2o}*SUBCIg;aSQGAf#hn9O1M`XFM*=f)fKF|`e?!?rlnd1$2O}3Sb zfygXVw#)K22M4{K9A7@txOLJN0~5w)kJ%qEy&M3ahlEl6@{fP#SX;Z2DqMvt`?@Sd zVcx`~KoMs5^Y~R^T--`)r1({{yKf>?pv>03*c*oe{+HICMY3}9gtnB$C8T57@cR=|w} zzlza!voyyyHXeyG!mYwE2Gc!uuHgL4R=uh=AK~4cPORh5lR}y-BlQMUK9d3at z8HS1C8AmN1zrM18J{s`&L%!#$uOG)xbsta9zQE%rK~SQRkO6OSfNHJ1V6CkO8yV>g zf!MWIx&SIGd%R_}j-H`0QLGV$#;b!$2sK_$o^xxyoiFUjem!S%t502R(eg@ zjuS*v_oJLOJtdDDx zGZL6Q!!c8)d@$Qt$Hn#CvquimtR#PlLSB!)E2hpuNnUXLjP_C<0tqw}d`S zXNW=}FLFd5edr@n{7szcG5e&a5xNV8F`hQtu09+nob`1p{Ev>^_~&WCxE(=ZTNP8c z-`28t?;^wAbPcn%t#0h~A3EIOl_XVdS8Joc$erBMSFKec4;>h|P?-AbJs0%4x1PZO zaEdmps<-ZazYU1FcJ~J}6mZKCtIQ}wFP+*2RJjxK_;-#QHHY@JzX7fU zp;{90*IxSS@BQ}kJO3Bq59jEJh;Nl)O^^BG%m4<X z8U3Noln?q1X$$5{xSoOLl9M?v{SYv4>%;8^gDbQZR1@nu z6^>S1o~E6ON|sJPmYpby9!Iq_xgyJ^bFQnvyyQO3%K^I(jw&`@8HMW5veq}Rl{`+n3hoHFc6k7YZD9(P=SPS=P;*vsYae~Fv8w}ntdDbuJ z9WY>9beh{`4R@1&f`3XGSwB6;xr6$7pFFJFEqdo_m7byQBk=vl7t`$=_J)dYhwh(G z+TM8kAtF3DJ$Lh+$=*u#*k}nP>xv}5)%XDebnnh;u2-Bt^JVnxGD9cTY*}i3>6?a( z`MARt<-Sdb^4lcFBxzGwDHdS{L|)Nsj*Gu7lwe;F>TXfvhdS_avu}LKVQ}#YL(zu>-pevXCnH<9Oz^9R|C!nm z6s}vWLy}OVF5@m@Ellh9-3t~35mVXpSl`}v5vjxBp1$H%$o04N@|9-^*+aCx8BMmI zQh5N~&i{k7%uG{+1M5R$?c%4vkRd3%KmZCn43P zC8C3;RfxUJaMRpC4nbQOqV%1=+!SeY*yoNl|&c|w8!X#&JgXtiyh8tbcUw)L8mm6vlY zw&eta@Qu8&z`43kZ3Yx7_|R?ev}NR+qT@6C#b4AIo~W09;3N$TCE2|k8<_kJfXUyQ zd-Rvd;X&i0UC=3V$;fm+n0q8APN@;5DBnQ??jcQ{#uWXnga+({USQTsC=+&T-t60n zaoh)96dOmI-t+SFn+04AcFl*}@n{3n6yraglLi=GY7jQO?eXa6tO_J!&Ieo_?EUaF zWoD2dvD*qFT13Zd!W0q%a!R*tskfw$xnDe?3D+sTaQy;Lt6jE^g*oXLZ;b3TZ&(hU zwL9QI0y}VTc7_kC#&A3*!Qn}8xYA+6J*+8AM{wA7@U^(QgkpF{gDLcbom{ zeep#|N;>?AuGT^fl5h_ThX0gs8sMIGXP+t$D%KsVAo-vkGMqj{-Ub zeZ!P#{vUt^+^Y>ciu!;*h|bm2A|XqW_3jSN3?7CLEUp0P z3rG{U-Q8tTPhPZWc^fz(f%!?(BX0{0PVWMP{qvJFQ~}2tx3SW$B6k~M!WE6v9`WSO z`yCB8plxH%?w2I`XU^4J$k0nc8kHc8no+NKrYL|kH(6;=0YR#b&Acj!V}1%#xaW_t zZyF5TH37>Xx!#x;l;I#yrN~K5n-E9eSc>buW=qbj1Sn@d4nNGZf8<^?Y&}L57XZx@~Tv#bKT@ z8tN|xpiB_iF%cBamNF`*qUCWxsFPc_{@}n_zCWoLLU)2yI?5Z5LE?k?2hOA|l|g0n!X?M|RlTos zw}b@0s*eBz3=h$nL%-49I8@TSHARxTMwr~a?0Hu=4~CHC3(=hb8a|p z9@y*ZHt_9Ecb{vGWdE(n!U1V_OHDD4Ji|;PiB2T>m!aG6QCPN3n*aCi$kJs$$-lQ7 z>A8f!BlT_ex82PJS}z&veX0*f);ixmfx_3Ty^q-xX_#T0de&MKo7sJ5H_LU}`%)h* zX{a35(BY9>JJe39Img;-#r>bV_4Yr_xWp79i-ZccW{nz}Xb0#ZThS-q7_$^vg|rUs zrBBsxut4|G8z;FkPkxSKE>pF!KKo?$BFjpLw)2~CM%{nXxSqS?>RH1)UKd*l$*R=v z-vxrO1X^Zy{o8`ln;V>P^D%>&3J`rdWF)H`%ae)uvV9g!SJQ6(r1-!awD)s3po~xt z0uF2(f6og$Di9^h4kYhM^B1F?^vt52R9D*b{b_?>)Fm~{FIw6E77pWBQlaLomx=?; zDZDR5_R^mx`xPB>xa2%ac)viMeK+f-I|S zl*P)S+P&Y8iBvw^x2<1Yqp1y8u>@AM$QM=ycaWXB_H9V$`4Ea9J%wv0ya)QNU+)`y z*2wGPsV1Hz%1~i)hRTNSdhN2YkY5-53Ae_>>IYUla8(C92vxyXd0$Gy&mR8u8=Ffj zVVs_p+qEH|=dVai5>vYS1#?g0*L{t>di#SbYGcTvqnJ+^EgXThX1l>NM+Am~V}~&I zSQX^&%iEh1E~a+UGxKCMM=KUGjBM6u9m31UXZqAw#&1T%6_X2F!sG&;8%zG(>^iAr zY-z_Ohptgk!7C%Xoj2kmZ-y6ftRH?qHVY=P9c;1L@Q*F>Vzq_mr?hcDX_2JZ4GIsv zP=kOK&Xl$)_-qSDp8*YCP}&pz^Cu{}78T1_VMvj8^?Gfvp7lcBA>+3MdmEF(3LY|- zCfPjPiGAtRdjS`MUE9jK&nOEJ+1OP$7dMHEMy(bq4tN7YHoZ?R!ZViSIv+6l7~V`N zrlMv$LTjaTvdHqY7(DwvtRum?=X(2P{g3@U3AVX;ZhrG9h8LSeb7gehdAebnXG$YA z*+R@f#&4k3QJQp;FN-$k4uY?5U!zqs9DHv+0fqjjCl5oePaJZnH5qnfntw@v5~=zj z>>hmVZ?nk}^E&Cju}TcE`y&Xw&i@8X3b4f)Q=*a00kGhPar&^cCidkba3+A#M*pI2 zV%SU=ZWw6(dt;WybTnf@EV5Z6Os-P-uFI~&WzN-GF=kw=X7yq2h@^(sQZQ3EIklxv z^}|O>56&Jdx@Qv^L=hadS*>&DcA;NJ77_ESb(wgkC&LGmYkhex`A%BtD`cf}*`b}O zYM2H5nt|@t52u9?3QunCp~X`}P>z5ZdB&;3V&K7UQj%5M^jyqe06Y1kh7&xRs@%Ib z*qP6f&x%{+WN%^hDGsERB@>$jRIx9=Z+ZC|LpEi3Fdb?0Ln<32JV*-j-TvN<%4b#Z zfDZefgMCMGn}aDDb<*yfw;u;T++fEh1#6CKCq&ggY5Wa_9Q^dDML>>C(<|%*ZxlZ} zwbjcKS>~LJJ14}mTMp-~x%5m~VbG(2H^ZUCx%xYLou922su3FfdSl&ixD^a*-3>9P>vfLPsnwYX1N9q+G#M?9( z7PgwRe9+72%{EdS?z>}3qE3h{7iPpHzczOE57XO!UI6i9@N>^@f#O}$@q;^jpC%wu z517@b?qMv`I#8gWAfMO!od1R8JNC?EFkdn{aAx=@Vz442#yN=+##e?THAZvk(@Suq zl$m2iXD|1vckY2y(}B!YA4~}wByY&4JtqQdhFO(lJp|MOd50USV#^x$SH3z=^`vT} zVt9E=?UA!d!TvI%{88fUfHeOBK(}x_vQ9_OrSKD2J5Lb$2TB~JL7Ob?L{?XRH=sUb zykof07Q`bDg1yhlIS_3A{Tn2Ti9i?P*Am=yHYhz`!R0H(%4LXH75oNdsGK*JRLd{< z59e|j$C;@50JdNOHM9@5ou}>K`>|t#F7)VrFg$*js-{bft&9-#I#;XW zA6?~y_1ky)D5#)~K&l`0HL+#eT`FH?p<*~EuuP5E8r{UJvqg~&!m^nQLS;of)(GcKRRoqHi^z&V z6!jp@kX|a#rMLeidgfxI@`Hp&`Al#o+$Iof3qY&=#6F8kK2Q~&VPL7w z?&)qwv-)FGb40#rm%*=aS1o{zwJJzfwO0;!>_M;zE(H`Nm^oxz1WA-__)8`BDq35_ z^WtV~f%?)X_t*RA$CLbuhL87_Jk+3FpqgW<7@2=IJ-JteG0$jZOko|xBG1VO6G@Hz zAcg}ouii>i1+YFiGxWFeXNVRmgY!^w=yr~_{TuO-*e?Wx_Gj*m58*Hq7^cos|I37$ zs&vUp*U;wp(+l{Fd&se9IJS?Liitq2qg##t@LhdOcoe&;%)*2b*`I;!GP0yv_=YRh ziL#9>bt&SZ9)H}!IS2OxlbW5{fwoRE2`uGRR)@r@@*$*kicG0#vrcnjR`N5)8@3?K z!MvS>Rc^Kxe1W{=NuvnFE*oHGjtn}@zRrIeU5GhFys`oH`ITrH4nwp6T0lJV$1#x4 zp+q3`Z7->F2815QEW`%V@PF(iC#-~F$XrKv;0iP#Sp-^}q<{e13|s4is6xCMUlhhY zT`wI(R4S>9=7pz~1hA<{xY185&GG}TZrC(6Q`OMsmktNuwkPt!k5Nt0EiEtfn#y$7Q zvlMkF?#VrxQg=7C>iB6P=2Y<##g84pnyY-lPk=$aEv+OrZR)ci^(!mcQUydJxF$I! z(*6)TrDKypHAff7XT{1uO5(f|0P0)dOeymbWVIJ)Q-m6vSj98Mp2I5%p)#XftGtv1 zHMD@Ty>ewWnBDpK2GO=S;~i1b^)&X64N^7#_Ar}=0-ReY$#<6AUwrp5S zWuqM?L^uLtW;G$u+63qaY=z4JTmH8ZOm`FPxol3-l)Q^^zowTB(j9*Mn7WI(o%v#^ zzT!z^ea1~dxIDISPt60U&%Y#jmJT@<8RQS*)8-&*cR|730vVw-Ok`7X$uJ zL=|))F52t;SPfWM__ml`+4>~_7?BJ`vTUeE{fYNqyGxmEaW4?#xvRg+4zqTBV{?!9 zV^0xrm;!^1<$0oBe2`g$uDEA!Xj#86Cjzr3!s2C-)BI~8!jcYXVwL-=0@5!ACg7C{ z(Pp-G+*)=L_P}3`Iv+XXIxY&wmaLbh{6n%JRX^6-KX^3a6$6D5qLVClx#X#<;zv-+ zf_>IsFkkGXY~WWrj7lu{P4Gduf-Ory7r>LgeL+sR3&tVZdZYCKs}SubC=!Rr?^Ym6 zm3kOb2p?2#l8Lm9qz(Of9LVHYuTpm(^;ZH{=Y3irt?ZB6Efk|=2;O)(RTa$UtxG}1 z0b58vQLwYJn*;a31X8CbZ3=x#@yhNFN3c-!CU6mo5an8{Ks_#6 zN%tP(SOiG)byye#Qj|ysNQ1m!ro)39W-9AMnA|;~K?&S|syUaV4BPI%AS4YylB*0@ zn&Sb+bjW+VdaGco1Y1y7-5vibvlekw|67rpnFoCpo;+j_$gNKrUu1L=0}R~>HYYV^ z8q!<=^`)r;sAUyCaKO@Y;TVc2Tau;6I+^BwA3|m67ywJ<*36-cwh7e_m$L?pux@Bm zt`gX}vMCumPTkr~WDd~mku)*KhCZ7BQf_vud?kjSPb75)(#+M&5kJXMNf2i3ocRh* z7AO~$o;nJ99)-vgX|XwUb65+ry4!mCmh&v4Iz31LiX0}e*Rkf9$4Mr+c9M2<=X#Js z82GlNu6ip!o5)gSM6I@~g8T7FF`Ssu(-N#eMju4XO#Mt^6DmeMYxqU)C8a^d zm^v&?mdLagqneQ`htDdF0O%SHM~c``@lcMiT4wT0Be3_nM?x3hDn#L;R6S{|K*aXS zA6V1?cl}EJni$X-2obJO{)=RrV23%_a#JyhDX6=$ybaWHi%|e2Kn1S~>2sIQIpy#N z4HBP}%JCuUn~gFBQUxK}lo=6%6v|OPL={XSm_88<^yD5;x62mWPAi6M_Z?=nMY6j| z!_`r1D1b`u>hkkqcTzVC`!O{brz%j&A3p(z4&MLUB`_(WC<5`yjNA{N7lGK?*-AO}}Wy1!Thc~3%RG-cmV(?fBvGrI{Y5wu);3@paCDllq z|G9G?pDhBogs!sOPT5o^4+FaN(kvr@rrr)23h&?VM2m?1TtLYVjv+&#Da#C+k#N#p zGY8SjU?JQ+w7m)T49^6;&|3$nbp00asDR5GX^b<}PP!1#q^9>R;x}xxOovMb<*jOn zG2c7E(JE_v==~U_D~LYag#1Vhek8{{&*Wwjd=IgXGG;dD?x&H8P;!IXSG#< zeJQ90)L!ag5G=hY5iU~QAX{=9;gdqj`YE(Gx&TL@)hiB2eJqBLSvA5h zwmSm^qs2ucc)S4_qWN2IsPTfAz3vb5{izMFm-D23wkqI*?22^W4fL78xRcnKx?!>- zg5wF=Bm^u!KCr`ZBwkpbgG$Gm$yM|gS43UjfOBM;^U;-3>2X`lJ&g&rCIP+Ax1b(GOGaY;ng>DVya1uVB0nw&Elc0kM zQc*!gptRAB;*rg&embPVyWn!AVlHw@?Wk7X)--pErH@PRHg!)6b;R33mN}eay*^bFBp@SQECWPm6))|#S!#~i1ORdj7*D=t`lHAzmtU{P-c!n zxM;~y=l5fmA(oIDA-$%*-WPe5qO2=R!RqR=)u*F7H!&1fCn3w2^o$+FL|toLU(oga z8Nw6#_mjrIxEe|H<2O2VY@DTUxdcA2*yQeGriCXYRPItGD3b=ys?sVFf306mP-4`I zMgH&t%th{3)JU>L&ei=&D%fnyEt)4SmwKNz!?1eV1%~IMLVLTkhzna?jwFkR0zzVu zGlUTV@I#3rrqh(jJ`D!)dg(4*CkLSRa5}@Rx6+&}T_;T;Pyno-#*Gn4TN%L04)?p6 z6fRwZR(v2g4E0>J=&vhKWVgXhy$zl1=!AlxUvBx9DWUkTgj6t68oTgn7M^%4VM0T zDGZ*H`Y^ynq91xl)SX!-IIRV97-Dj14;YJz0}iE0s-%Q!9NwI=AL=c;<&Mu|OPzsEH z-p^ITw}?Znaaf<^+yeR}_FrFW@8n5%_s~dWD7Fu7RUi8(|Sy*wZ;;2@yHiUr=?W@4K$%8M}JAbKfVWN*s96}@T@p(Q!269YPu;Rccq zdPriSbx#@}e4K_-`w>`!zCRMX4@B_QDED@1P`}UgXemKbpXB7bwBYKy6q2B}?oDWh z3_eFEmq=QG%SXEYzrF9elM;5~H7s>U9Yrs;fLlJWa9p`YR4+m&5J=27h^Yi=8Tf)0XBdGZV5>!2t1H}5#5^u9}*k8Rp z4hTHNJ_QTVPXgm51y{74VMQ@9#V9Yn+vpmt!diu932pVwlRMQ&ZvuIZZS2-%RhoZ) zQL$l+Bs}dn!aM;*yYr(30QIGxlL5z)pkgSoGe8p zVMb0hp*Tdf{=-p@u!SiHrv0=T;|2JRO0PP}xewAXVtDe>WG8e1n3>)Av9`2Z3Cha9 zXTEm1NGg*S0(mK!ty3Y`u=mRnI=D|5{!NiTj^CqzbPW+Hx#bv|wo+R!K&>I{&39YA zx2rF)Oxd=tcIC_g`s{ODU3Tk2h_=o?yLCRH^q7Z`*|{(+ksDE88~U*KY8j*x0ljqA z?(!6oTE(o4Z-A=(-E_KZrJjv*{K-@7H=IFOZr`~DPAAkC!ez*J9kTX=heDl88oZ#E zDmK7zKG8YUw7#^our(>vV`W9LSl)|Y(?R$k{g6*=Ye$HAC?_RX?Ki)0#4lNtw@Num zKzQ#(RY<<}2_2-DI>0RvY0v}G2UB2OT=)@LJ1m1;ytEirO!P|MQbKG>2xIb17j#t6 zgvy(LwcBSz$5V@;8gfxkCe4X~s}lREOO&v$^_;EgYFxF%-p*OmI39<{tWt-6G*`>b z1%xk6MUw^U$CmMsX%YTWTe_X52t9;1&p>yj9)Q8KLPN3r7dXW2E}YU*yGv^=WJ#5C zKbqY`KV)_E_0g;D)4H5Ns?F>#3Rl|S%zVvdq$v*YS8!^O=nexudSC>ln%r&}Y`4(6 z@b2U9W-Mu~ZBe&zS}NRDq#T}pKe=BCN^QUT2Bs9tK?Wia8afpRekg1OhvK>8ue z$YBaso#+RR!ffG7Oub@3FFr3I00Rus$8RQaOVRu{FfN<5<6 zloK{R`enR3ZL-8J_^atY(Z4tnF8uxhmj~9xd62VZLB0iLClqYEr`e%j?`Es<{7SgM zDUNLs^gGhHFVC$#+I!_+P2RE}hFp2_UzT=qT@^kM9gW{^!MB4qx9S(iqHl;3Xg&8g#Py{ZQJ*`v3oqtDbo9TbgJeo#TseQNZ?;sc$lH2#CmD%J;=V2aMa7GA z!aX`zuKqo)*u~2v{zaL?OL>)Fj}z28j#}0maR+TN*GeFD0KfBZ9A&=Cs@imsrp-F) zw?Eg0Fa#9^v`pep4=tYdy;#TLJ}^wD_a(&a$@6LVM~B6~U0QnJmhF@N&7p*GyuA5) z`@!g_gi7I1^RTuEUP{^OPiRy9*bx5?xFLcn@~9t)fCVsME^# zmovY_F(V?Ed>i+D+G_4?p=px#+8!&RaAjx0(wBWJizKq`N`X?hZ_3jpQ_sE;0TEl% zoOD`Ae+R_N#Jekn@(?eeVFu~JCb$IJZZ*1BG#1<4VLB_+L;uy=@E={g21s-J>mUBNm41wNxz@6;b%tFU?BS-Ce z*&EA|!DeAzkuw2n2TU0=Gle@{&nztt3oo6W#on6y*R=Z7#Y)A`zbB2Jxu{1}rFZ|1 ztT@#bymt3@McbrTx9%I`y4dThfhTpE%34-dS|gS~TBnc%gnm|PhBysQYVr~@ov_q3 z6cv14(s=!^wQc<+&p!uUtW;`RSZ@C)a=t=p>w3ZB0q;Vh%J<6yJCN>bG~D8WlU>eS zR&4hX;#>@=-xld}YiASVf)U&Z8yq)Cghl^<{jF45jd7^a{$2h(d_M~QkgOamYj%?_ F{y+Y=v;F`8 literal 16372 zcmdtJc|27A|0o`39D_5ACB{CLEr}WXZdA4iB}t00OT;^}W;v6PT`H1gN=1vkwAcm_ z+4rrOLdcpu>pk9|dms0Ef4_V0|G%HdJj|Tu`g%T}ul4zQp1bCz1{hWW)&mC)V2lh; zojY)V2{>>7FhL{#4~!ZZ&mdp?zIqpZExcTO{q1i!AJBF3a&X2QdD^==pL4c%3jC+Z zSrZ|0F*iA{x3{-gkO_U+>sQy9;B9&kD`|p%hj%Y<|i7`<}9% z>$2Vd5m8~7C$ouYJnVbU)B<_@zyBS;bkzNG;DGj;(J9^Y0YkIjr|(iHtjz5=wzP{yi*hS(ePuYs2FNQOub1<`jT-(42 z3XIzGM!+>XI0U@-A8?&60zP1mfSbPQ2qEwiW-Q18-fLlqKrmuH|3L|n_F3fr2kI1p zI$%gfm>6sEhj8d{DMK`P7!PqF;Al$3{~7!gp^pA9)aZYy5Byg!D0qI_cMW7vq= zHyPV~az#A7`EiKt)Yh?-iTT!A;=U#UCZX!F_o3|BDy&{|Qig;iH_pW~)iXDiWFF65 z|D;OA*O0g#(CR!lKZPbdY?5~{GAuoUOM4eSHhjKfV~eL2VC8~Nk!titjaz;%)O}Yh zOlA5PlDxEFef6QmA7{r)_!?RqT4=Oj*mYvi)(g>rW!U)=9#-9Z``_PM*KhS{?Cy9x z8Ncas0P!n!%Kkvb;F+v5E+JR;)uU!D57?HqKU}`Ro^TfNILa@B;j)fo(!|683JTyX zIv#$(fF>%-8%r?!B8E$2g^d`bzTmY|$YfSV2{aXVd*uuTZeTLurDa2rwuhhia6yVD zbYp>7yxrt#BqHL_;%&#GIIr7Ri|v1HGVaST%D=B;k)}9#~Ts|#~AnuY3q|o0St(`(nH>*OqCpE&{IUB5L(D94cvBe@CFc6 z3ZM5^MLJ)wGowsm#}yXv_aQ6;;sbION(4(tpsZX(0*Lzd!$yW_x&#F{a;sK3*qmaT zE=2)3T#cIeeSU`|_k(PRbvFa3rSoMIrG4>zb z(ktNzQ9Y_^@ly1I~ob0<@gaz`k zd1dI!vZLRFr`12%dA#VKczBNRDbz3;{>0Lw!u`S4HkZvy5)(HnbL)zPHS5q%4i=)h zIQ%JwHaBDQgYU&~JYVYTr-3JRa+`4D9B86BA1rq%hSqfBQy|Oe0(wDR^;%B2R zI5lf&A3OtIMN|*#mW;;VBz*|E>l|&tYhFt;oZG;L)sTa~3;kRvubUGHxwptw$C0Z* zi-4Do2XY7cd8l3aJRcBy^)hpaOuQIfl-+?0F^+{2PQhW)LK!lj$Gs&eW;m(dtRo^x zMU}E|S1X2__gQ|?Takv;7-^(DE_l5;y zcMsmSN;;_vL8s{Yd8iDLd$R#!@g@g%)Il}eXBrmuRp?Q*Ng&~UfKstMg(7wqz`ThR zQ$_DqA1eOr@~DZe_6Z)`lrSd?seBZXp9&be8o;C#63ESDbPimz!C14I04@p zM!~Z>kbj{Hma{52G~_3C{X$)jUXJ-hTC<1g5r-Y!uTWU^$)WV&Qrz%kU5Kk2NIQNp= zlxvt=f(Z$WA`;jbCHd4J&A!E>pOULUX|bfcwDw%4lbGn-%QieMJ&26!{9xDv8|u-E zwj!V|bY2%+#kUyBsX&7acENOR<*T|ITqlSOp?2zd1LPV)k7aHdc5eKSn9Oj z-JH`2Ir&d<0D~@M5>L8tTeQXb9wS9AcKYUE`|{ikmCDcc*jW?7yg1r1J@U7AoG$~T z|NOjhB`CB1a%i;|=fZ!_8Yei~f1P=RSq@ zaq=_Uw?BlhER?Qy_K$;3l{YN!(gT(^-y9pB!7vevbl?%QrOW3~YqIYphOnBK%i5)v zgVe(D;F^4g1}qb~k@xWy-{j0cF$Z>Km~-Xu(QqcqiWbnGDy&t%{*jVdt?@>PmfbqP zNuhic9QZSTT@|l;jW_E{-LT@X1384~P!O6OYLBbR{2Fj^d^@84`jW@dAGnC>^O%+G zNTJbpy;>qwWkNt<_MEez+g;S&Tfu?ijzweqOwCY#l+Ek|+X`))R-~oN3PnfY;b==R z@XfjP;6#xgdku(AhTm>xG2YIWqeu+{Cz&J zKb3QU%hBO1VNbVY>8)XWQj5-DM}k+>Z_Wnbt0u{&W5l z-gCb9(l1-%r2Bi7^_Z7S2f_ALCP zlx?T+^m$sC1o#E<6hmr+HKw>seyQfCcP-PP}$;FD%mJCu0x- zp5qQ!R;^=)9gZE@rEV^7L>MnIZeBoUcfqM*g<`x1cg?j|<@OQCfEY#vUFP_ahI`#y zw^tA=Q`XM!e1oB;2a2os+?a(cMeml%-ngjk`fwFQ5j%!!I&Y~RWu%PouJk*qRB5}W zO)xTX%NKP&J4X}d{oJ8n)35pPg!bkHGuEV@W_std0HZEpdE=5$4JiezI)O*uTg9L( z2!vlwbY8}>35vbQ3nmVH+H<%{0ti$Sb63XxawI{NK1`e{KN`lTk;>Sxik{@pO(Zm` zM)8KQBiRn>!M6Vq|FxSXYk0+)F&ZAMfr)x|&-(E+g>LzVlvQ~vtjR1{rFOQ-q z_`i4ytfCt^YU}M{>5~JDgOX_@jDHwV3WSdKGTaFJ*@GjvKkuxN?Lz}J>zz`7MN`JR zSF|{UfnLFY+a#=*U3`=ssUry%)~~fKt6#*N2?^Ab6CbmOdbGIKx-3+cF4;HOtSl*u zG|+r86}pIxw3#|w+NR+KtIBE4jPTU=e-;^0-HP6PAsHmbUreYSXMnPa@d$IhHJdPU zBHjV@#JK4h9{jD?@nzm^B*{W}Bz-w;0*AUOIIvq5Fd(d@Mvwb#a)!PX*7+%|+cg&t zx+A2dyOo_oIX;CeP9G~wb7Sj&#&-Q)Tr2eIo<5&^mmAyTLEd`&^NDluG5s*#gO)QB zD!Yp3zuc?3 zYZZQ6dg&9$1}VrV$p4QC-=PSvB>%#a$l+ii=)OjBxdkvX+^>bXM!H@$(h48 ze;CcTB}e>j7>gG=V&7gT?=f-qoiv#sB%=s@1)X(zzdJs+`TW48wNTJAhu*|W0gKf) zycv=CEL1n5blIBkZ=UsK%eQQtpsx7?c!}+Bg{XsEGd;ygMN8*Gc+GK8K)GmL@URfS z+do&t@>pkHmgJusJ2UmMMi~8yXkMW};CGXc)jUlbeQ5aN8Zut73MWlKdGU=&8S2RQ zrP$09$U3oEl~(1yOOY^P*%d(9`6jYbcyHs~x@lEr`hNSg#w51aj*q=HKC9sKXryWD zCrT+WLff+BGT|?G^H4N=7Bf365O8MTMu9fd+a4bFCla6?iBJZ2Jvi{?#Za5FF#{m2 z%Ak7S+0g4qNKdiAXr?G$@X7-(m_q~P~`cLJ| zD%ri(8Q)KhH=pFTTJ;yQh^DTU#H))(!}m~Y!Fr!}qsDnt`xCPnhrf#(phb6oZ;H)X zW3z*q?Bw-3p4)=5@$2i&DkrO(W+cjU>_s(oT^?=U84R!y73JQhdQ*A@Vo?&Qa-cc@?`z**XvKbL9p95JtY7#ezx>Z)7+>vhZZzNE;k;3rUKZQo z$7Ko!hRbPDkQeGumDH?j^1@FvI;JJtk?aj@%_f$;mvfn&Atdz^ zrN(*X65FpPpruv3A9sHqh^;>PqbwsM^NO;_Q0sU&%rcj#Yz1Dwl@+VTpo`_P*8fZ^ z0_Ww^d4@H&T0tI?IXMLnzWR*WzCDCk@zw1CS9!=pIb|(@t;KGmh;V0JUDl3*?5x^kE596kbdVB+ zx$JZfG|jGyyqP>(l5|}Gmp3oWY5aXxoPZ2Um$cYL{i_hHQW)AlB;kc55-gx zmb32Bd_3vOs>|hG5O{ddiO}&Lwkn>qVt2;hAwT>Wt;`RdSKv{8t8=LUdWLP0H)hqf z1X(e6BnM3f%+dF}ZQvgZ8k3(D9)L@ZfSo~@)?@r4nO3YZhOp&4N`osJJb;qy<(nLa1Qe15^|&#KPh^C+VwE9GINxeWIG1Q;c(BPigCi&>XMA8 zcIhM6K8N-*(25gXIjUwvf&!bMe?8LnoMQrx;8b}(+4;G?QV2*)+Gx4p&czSx;65}t zR9)k*A+?=pRMcAg@;1W`IV+v~VfE$}Z!_E> z4;-i9rs`;I?`M=!^qX{Fohrd1ZF>u6+HnnDbWh=f#FVo>&TSq98@};7x~~r_#=v|8 zDi+eHs-;D1IC_K_XePiO2~V(2gf}C!GrT8%NZB|N2$OI4AseE1YQ4GYJy_^anwK&Z znUDL><{%~1L{c`gK+EG2?8%RhZQT1}jsxyy9-R^dPYVPzIZDOBr_>#v9OZ##uaf)u zCf;PmM^mw_N+SW?Ff(K_8?N_LOP<-sft)c-@{xR6p-)WO zfvt0wor23BNkDP(!fpk$A6lFaZkEWX{q4^@LP%P_V^n0Bi~&#c5Bxo^<&*ypcRi^s zzDYwR`8yGZ8*~0)<&#fr`wPnvlKejFoasuBi6g2pFg_`;;INq)G;2@4;PCZ= zfdjVDpwFj0w$Vf$Tq6)tGl{ZoV2u@)OpxjDB@~szYW^%a78nAy|RBA|%)7&3k?4``7%&R~=_>PI* z_srCPN~Sng?!Ug@l8Qc)Sb+Y( zUX_x<7;iuPboVS`xIJBdqteLX{JnPl8&BQXL4XN8yH=3#BeVM6q{Qsh_P9X{u5hl)YPOIZ@lg{A2E)A_GGNP!WXONh_1Zp_{r9IgIDA#-<@z7?BBAla;NiMWWnn>7ag`Vp|b6-(EK%SL=Mp;Mdf zd$7+zuq-%O~AR@-tBUEBcQ;-M<+%{04pN{ElqYu@m@doi()2t}Ga8jSDGH z33=Q%YzJdA7BQS%)%8r@?!>~`lk!b7f>%}0VowL%_)W<4+_4{WYwTWpYAQx(G3^_@ z-Emz?MU!`|Z#|_4r8uQjoWUmvNjD!XW+BpaludXN3L- zNpYOMXhU=p?teUBk%x=AQQ`k$_8)M%u35B_faZS|tw#3#F*?>HzVLo4N7>xxD#fpI zdCzWnY*@#``7guyzVSd&9 z@ZXtVX|VTX&~-gSdx4u3r7kSAMBa`GO-c&29QGp!%qPAL58bT%(f?^U^V)Z``biY; zmz~9zt{1%CKYKzPHoem7nrTDx2z9#k?d5vrg-p3kZ#yM-PG4oT$E%&$CL8@+hShM( zy@cGed%T2a3~!gb2(w|WR=Fe&Q6D@2o!c$x#k;5j zSg<PP-yjv&ruKq2Vf*OwICUY~IL;ac~0>c(yM0M?;Nm#nSJPJkzXOR0fd z5(Ue$fc_PKOU4}d5ha&u?ugS=1V!G|?ujp-V5XRg!mG9dwCwleaqw?QhWSLiy`mRk zvHFuuUUPoJb4FCAJY!v}uA2~#JzZs@@$%9d2OD&&`tQk_YxB#U+^wX-R%)7#URzNu z={TtTGvD6Q*^8PNo+YZ446S_nYrpmkpQC#lX5B52__|DZN)dqW^L4zYoP}2U8PjW~ zjEsLNf%?1UU)@>{rBnW3JWPv&G9;NCaZ_frzbUWKXE643*K0LI(dcBJI8U-#(dgJX z#>A4g-Xaaft@`)YHL8SJj=R#;)>LPEPMzqemn7ISiBt;FNHRP8{!WV%6?Vi={p8BCCc%Na(Dt!lrS;JB6Asjv z!;6zV=Z_~+V~xl!-Hxk%rJ{koFbVG$zeiN8aRC>4*|z#e&w-mCrXPedj4H?x&8HUB z-LG-pUctz`!_;re88+djemvwWl{~_aA(;PMkXE|Rk;ko4bYTD!oJ!#WgK%JbHYDC- z%L1Jr5gff?GDKUJs^66$la=e}c4|sE+}eWlTVDFE`m8X=wcX%jA%I;KNt0a3Dd<2%t|#O?ML4Oy@{P+`h=_N!-xt+Y#F2D9tqo$lnoppwiZ zV9;LqSL;xJ?N9K#JC~f!UsEia%%XLstOi^W|4dRqf!~kGd67MzNnT(?s~a({o3VVJ zls*Iw9a{8syCC66_I!bR6lKuS#Oan>9G0R5Zf=#!yo<5SjE3Jm`7`hmil=fPA;A9> zWq-T`ZO<)~tdfO#jc^wq|Bli6>a~YtgE>M^OI0=0;oLlP&OZo;-xa$*Gx(d|M6xMl z*3m4DgSGZ#gIk}RZUY@;(%0$Dhvq#@$oQ7t1{H-sGm4-%ljF9c1SZWHsNJQ&7 zpJ)o@k)T_tb&IE<+tO42uz%WeVXf=e9~_2lB^nh}I^2G}z$m7NqginQCaYyDdvp{? z!GjI@9ZZtmZ6P%zvG{>_Pcqt@58@^)4DKg=U>=2Dnf)G!8M;!d9g=zP(8hGwLnfkM;?+XbH z1t93=rzjwJVu~M`W;r=O(@dBT;07cgFaQc-MZ?`JfWq<9gra^;kGX@od`}@w=Rj9! zsD;RcG_jlgQ3815oXO*!eXU(cD_peMY7T(&rE?f1@YjH-F`{KW`(3o zILs*#=68vPc@65?IAGs&(;R!qTWVQ@+Hw+6VWKoHP6Zc$`k5HkBI$~Xmt)}{I%LE#=ek= z?7rO9l4yTmnvi{eO8j3UxFz@?r67#Iaek^zT>W1V$ICH+#{3yuL@~v`@-yiVw8cXy zkb^O7hrc6oo*}ET=urm&)yd7Ubbjzx8VL0AQSA5)z5b|3smqHR{!N5`v(;3A>>oF? zo$S>AWe|5PAcIQ>pSKTOpdcsbUssRPgJXf4?kad7A;Dwx0V$`;+UXHymro^}m~{a99C`^U?WV_dA!-F z2Hlsd990mV4cjhkdo(Sr1Q_VZu7wiz{#2{)HJt093GD3h|GCc&h{w)%Q>C@jf~4BK zu2}SE2c2%9y^m`BxKaK@MNdif=vI11aVk7_9rwjx&rRr^4^GN5G6SqvG0XUrek}dP zbuNOpl1^xUL+qH5*&*!|g`{|*Sz>n59ayAbb+^;H|5t##b&8atcfhR`emjo0J-2TL zqcj8>pI9F^ZLFn@94I^X^6P1)+X~%a+bh3r&DOJeEL98kK|*1_Z-^zFajrDMmAnpoj@ z+w7@^@4nw$c>en7u@5Tl^jE((!{wMeC7XsgBFp*n9QB;ug*lxlcv)dKSRg$~Fh51J z?e+6uvXa2e_J7Jb_JL2{ye6j6ZIp4l)aotszUE)wwoVvaC@OQM=dCYml~7){fdat> zP6KPE4;~aAZLt^=0#9%EYRmfaTRyB*1J<>(7S8mDzr2J@hp(?Mn+`9riiWMd@kX5f zJGnIX+P72R)GOs(=x^41JKH&pYx-{gkOdzmGkHAK%GQ5?cski)dO_OYTVrpUyf=Lz zJ@wD;XO;%Q9CT+Zzmc~xh7vMOFc&i@O#PT;y&+tTx!h|j7j!V6=M57Sr^+*L7k#r@ zsjfi{QXCK*eRc1mAis+rr1>|LW)Qq2R3~_GsLD+E^@`;WA@D2h>}GXWaYNnngTVT3 zVc?rTi-ZceGqSeoMU#ffKtclI%8pxJNyfrg-7fGGi&$@TPW~3vTtKU9oc!_VeX(12 z+3D<5c3_TIY!7PH|EinlM$be0c8>KJPtw5zt|`HM5%W5AbG91NONy8P+ANN-9B2)F$((AhABJjdX?8clK{~a%3+(xj=bK{8^fBw{ZqPNIydNYTx zl|3dy@+4ga&E7SgtPBY$F@8TA>T30Ti1y^OQtIBOId>1uQXLiAJ8ODam*=H zFb!({L1k?mnz+5$9V-RA>cR-}(HxnY=dXdNqq3 z(l}}rs%S}6XMG1jv!pv8cQ5`{@|N@KyuTP?S_Te=NSrSWs13 zuP`vbf87uKIwG0eYFy0@ry+sP!3A(t&6iAuN+}g_RZaQ4^L_i6o#(r~I#+u7R_3TD#|Ftvwxt|=agf&+25Vhz^$4J#M=i1Q+yKa%MEqQe_P zZU9^6rQX}*_c@c3>u$U9Hjs)RpSLGVfclv$7hj$*Xd|W8-~RFe76)A%$UV(ER^pXu z@IQ7n0*|g=a)@Xb0)N?)ziAv-mKDsC_r|V1jh#ziDdD*M#&vezsIif0bu%DVXy_I- z`)Hp+8!qiGoGcl-tVozQv9KRPboG!CU48!)R`=+~KY1~K@UP`|*UGZxZ;6Q#4J?p- z*lsT{0c_BIVCsI>i9ARh@Ow%2Y)qcCJ@%)1C+P>K0Y`<4;QsoJ2$tJt&k|{L8G$Z7@1#HbA>(1OUsHL711tV|)FD?+dlYa4TzylJp z$Ab=dP=CwjXSSKl`CIJ-EON#9p_cTw+Bqo}HbcmNV}uY22kKV`VStDQh=eQ{fIgG{ z=f_DKf&Q-_ZUyg%eO0)$Vt6(=Vex&Dfxte^UbD6i5NOpF4re?Hht=4dRTXMz922uL z(28JNTP?{(=f1*uqIqa^G<^4FAqZerAgE=+RL7ngplU1%5Y5}Q zhE{tgZ9u#M4PaV^9H>2+1!J~*)(N0~D6_8nwH6EKAn;@Des8>$o2~dj%t2iL(HHge z_M3&Hj!3-cm!}dwL7J{aX2Ay9rQe0w`yH;KviplBCazrS@H??ChpdSL@2RBL2=W@( zAe@?c9+3eyT;WN+#C5fJa6;L29X6X6%IFoyNH#VEf;B(DxgSTwCfpu%&FPBnb zqNt|BGDj%^jKNGCk-K6~9f-G`=n&4%kOdsI13p9hBS6kC71{OI(b6ocOD|*MHt0v| zL&uNC!9cvu0pN^aKnqoa{lRKMv`zQ1;!#z!Bi(vlRtc9D1(!mfa@2vbxdgSVw?2&A z^owWM9|sk=ncvI<3R`Jzx9vX;mACRvD}$e)c`lGu5I1wR-)-wI1=JUWL@jqeUjP%v zLr>g6hUJITTSGdw_Y4J86MZ`;+!vG|;}_IbzKs8=5(2gLhV#q1F6<*?O8>s;`|DOY z^Gzt_i@o3*`n+J5c^HymMmlCpPJS_7eO^Hz@g84U^>g&UloRSA8fSeW*+O(!@ zh&i=2IUDkf49~8&B&%bGLoRUvuM^f z51mg-$FGqiP89K6KIf_QpzkZG>8{hqE8IE)qi*2{)qOdX61$rdCe9okvrCgtgC#qM zd!n_oE---&MDr@_eHlRXxKRX#M-CJn^M{i}jPwx_5 z5eO9cwR}zUu7c!qkkzcN?Npe}{*q+3q{ud+viqvT6*o?XlB zWk6QvwKtnnsznyJ;h!%p@(o2E>W`3WewXt%?JDwh&`xh^3p;*G*S!nZK6-FhD`407 zWgn^Lfnr?zrdydJAnf-(7enDZ(x9)e%z@9h?! z=JdY5Qr{SQkxY)+DZYQ5=FE*1C~@u@Zq2N`-$DqSBuLqadDWUbAYlXx%!>>3O@98;Rf#I&f6nJv2ZQ( z?_k?(RXs!Y-65dz`kmur7~bI! znO8Y*=Y`0vqZb1nWi1B1;swEs)u{>={5k(PFKYD}a+`ZDhj|Wk!2vC0j)I@||yX^_vqGw`RTtlWxTg zpS$J*2Bpm%9b@Mhwtg>1d0IfG@O*T(#XABagW~MLFx+N>>AAdYIeDpQ&_MKX)*Z;VRPxNDOz`$o zsnAX06Gwic(df8}}z` z%+E%7n9;q!vXezM)nQ#Tt7?$Pcgd(N-9PKMb7f!E81;+YoO!Kn9^7eFS5v%EPLqxq z3(fN&1@I_#V16u&9x}TNbINQ#c+jR(jGR#Icz0vEnu_$hXbKxU{i4Spv9NbB@@fDk z?(1b8z~=CWpD}wUUeHKOuD{rUdY^d`nFAOUSvH9EA|!2R2>=t!Gp2nc)*78C?JF;k z+kx*-;5sD#5F{8dnY9{(&Lk#nKV}6cEc^}?CBm~QyUpnWfKlpMelX}!(v2?gMz{6{ zHu3$Vz9>M|SUodWLt@qC=tk}fh7!IK2qzS(w+Kn)Yd@rr5|;*GzXb{Q_&fA3X1NL8rE7Ti=w8gtZc2Xfu*$@h*DI?VYuQejWdH%KA`Nm1N~ad{QctS6rN zbeNJz1L-RXI&TZEsU+w0yfadt+W3(f7R3z+Ak_-mZ8UpwDE|YTRMwMN59+WFx3+YPFKREhwKxCKQ=-XCYEM}hT`0yd1(=|uwd~%*KW8QTu>MmRlXPdGw2&dGFDz@O?-!%dH-o z2ztJ|@@QR`JtBeX®m0Mx`hM&9U%hEKEHCv;?XZ#Oj3{>9#86jdqWpsY$)2Ft$^ z0@o@du~MTr{XovCUYa)g#d`x6OO5>my6_?M3L+%4Rv$uQ9L5bW*YrG$ih7})lha4K z-Rd9`Lm~ngUNK8UMjQSCwwh-b^w-MLD{X<+L#qC5pWuSax?~=JJDo=;QyARbEcZAl zZjc%d7bq)94oq6gAldzsMM5uh=`G*>Os8YsD#{C5%CZ1w4ym%8K{CS&67wbT{}904 zW&c54@AKuSAjJrB_M`P+ED(IyElg8WS_s_SDSv~EGH!d?)E6WI)vpZ&yJ z8qv60?txeJmpuf;;|H!S9ZG|>I2CugqSyc8A;nUkS2wQmyV;xcd2!EQ$%hMw<%;qi zLSW?I@?S>l`VYY0a@AXyPxB0z*?6i(x(w4v8RU{Aexk%;x=X=)OFuqzD`{RAGn+`Q zx2{R~F?J8aknE4r`Ll0?x0{MdHZ<<^lHcvIQ*?m^_l-?KhGy{Eo=rGZwSJzNla zC*VQtv8OK3`3n!AU_RI%0HuSMW{vF`%LS*HYtF4_MR!t>(X{D5eHE*%eDV>&yjvT? zkyB8f0f%CJTQzMMh>LZB4&u-0BXzCS!vym)N2i?m?mdIEusyHH0SrX*1*oZLty?f2 zmzTq{@@HUrsq2fDHbvmzeJmExxyDia9@-dW4^nZW4{Ie>o|tyss=qQo@ z6F-bps(zEFUlpFc-b`y;T`%%ZM$cZQ>Y%QunU`9)Tu^&LrdF{}Uz4PL&wx3KcP&x<9wrz4p%^s}Z6%u$PM6 zQm4X@imW^=0#$59KDn!)psJyaWcZ|kQ65cJrO4!Vgs=o&Sf-pv%(AxpG=Pn~}`9+ae3J)g(X~PKLd+d_u;DMq(SY*zSwehU_n>IIZy=Jv1F*z+I^(h(a-(Q zO?5Dxu}adFu2Xt0H<@|w)wy3!4HOndDqNMlumwTO{xXENB6v@mGx%+|&j)6@))^p7 z^;(3#j8vi7!Lc!faKpw&T-P@^_lHW%-gb(h7}y;d8YH)2^~>*JVh zYp$x*%5Lwqn-lAO3vGJ*W9bG;<`-)A^!4j)Ue#p39NDvv(;HRo$J+p5VN$$aBD+~* zTRL2otB-ISuKio(W4-?r208&22dE2LH8d$u`or=df8NSd1LegmEhG=|9QKD4Pa~Cg zJ{Jg&Mib$xpd;WbNkRm?UcvI224N~3sfep^0qyA|sHL5z0S<{1;$SuDv>vZ7B)dvZ zpqCr>l@?ruOzSS-2(d#Eu7N5hrI7{Dg)R)7VZ(LMGI%N+$pv80EDDE1{hlSNoZhy)v80q15*>i}OAlGAngfsj>w=)4(HeYr4*EJBZP0bgi5C>{dA znJHzb5;yf)#eo{cC=OM)iX)or5l!5j<_$E(gNUXw5WM;q(L_1~bXySSvSa?W$(_%< zjrNwuWGBjjS~!AaZ&-K~7qgCCMWQY4Oc^|(;rv(iFn~Z&-J97)8mRWci}4aBcMAU;T{Y=X}mVU z420a&hk9hmntz+7hrI(**ULLLvoo~|b^Fo%x6t6)Xj^&6j=$>+9 z{ryuP6~gJ#w(qonm2azJ$&X>U0Tb8rqEwmiO2gmM=!Y$t>I{r2P2Ix8#kXC#Qc}qm zBU*|463C<4;TG~YqTqDF1K{t4o3gM7TR1N79Rr!VYdU#ux@<8DX0_Qz`N=*n zhz*+-z`YQ6bFW~7+j?LM7!Ltf(B8atQ* zN_5Im8UD?tAunm}XXd#6lV_v+n@vOB`rOB{>?0fymVKPqewr;BM*aVZ>Az+d|6jk| zX#d}{J9_;~kkmabPnWM&f;=_2U!{d9V0d0{nmdiiUj+3e@(yN0;!&U;BCt{m0WC_j}9tWP}+7 zOeb9SLFE4jTtoVFq+bY;|1UKne}13ifBQ9+=xcyPt=8^B505PdUbUFdi z60vLOzuy&C3_cw}R6Wt@65j8oJDk9Nv!@bqje1`Y*3YDUi#LyeHxP?EM2Sg=#Sut3 wz`n&R2GBTS@e>^f{JzEim6fk~4~080Mx6$`cv;ht_vH^5>6xA?I6 { const formControl = useForm({ mode: "onChange", defaultValues: { - colour: branding.colour || "#F77F00", + colour: branding.colour || "#007BA7", secondaryColour: branding.secondaryColour || "", footerText: branding.footerText || "", coverFooterText: branding.coverFooterText || "", @@ -313,7 +313,7 @@ const CippBrandingSettings = () => { // Everything the sync effect and Reset need to put back on the form, in one place — the two // paths drifting apart is how a field ends up saving but not reloading. const reportChromeValues = (source) => ({ - colour: source.colour || "#F77F00", + colour: source.colour || "#007BA7", secondaryColour: source.secondaryColour || "", footerText: source.footerText || "", coverFooterText: source.coverFooterText || "", @@ -417,7 +417,7 @@ const CippBrandingSettings = () => { // eslint-disable-next-line react-hooks/exhaustive-deps -- sync when server branding payload changes }, [activePresetId, uploadPending, brandingQuery.isSuccess, brandingQuery.dataUpdatedAt]); - const brandColour = formControl.watch("colour") || "#F77F00"; + const brandColour = formControl.watch("colour") || "#007BA7"; const previewReportTypeValue = formControl.watch("previewReportType"); const previewReportType = previewReportTypeValue?.value || previewReportTypeValue || reportTypeOptions[0]?.value; diff --git a/frontend/src/components/CippSettings/CippVersionProperties.jsx b/frontend/src/components/CippSettings/CippVersionProperties.jsx index 97542aa3eb..7ab2046279 100644 --- a/frontend/src/components/CippSettings/CippVersionProperties.jsx +++ b/frontend/src/components/CippSettings/CippVersionProperties.jsx @@ -1,10 +1,48 @@ -import { Box, Button, SvgIcon } from "@mui/material"; -import { CippPropertyListCard } from "../CippCards/CippPropertyListCard"; -import { CheckCircle, SystemUpdateAlt, Warning } from "@mui/icons-material"; +import { useState } from "react"; +import { + Accordion, + AccordionDetails, + AccordionSummary, + Box, + Button, + SvgIcon, + Tooltip, + Typography, + Card, + CardHeader, + CardContent, + CardActions, + Chip, + Stack, + Divider, + alpha, + useTheme, + CircularProgress, +} from "@mui/material"; +import { + CheckCircle, + Warning, + Sync, + Refresh, + Delete, + Computer, + Cloud, + Storage, + Hub, + ExpandMore, +} from "@mui/icons-material"; import { ApiGetCall } from "../../api/ApiCall"; import { useEffect } from "react"; const CippVersionProperties = () => { + const theme = useTheme(); + const [cleaningUp, setCleaningUp] = useState(false); + + const manage365Version = ApiGetCall({ + url: "/manage365-version.json", + queryKey: "Manage365Version", + }); + const version = ApiGetCall({ url: "/version.json", queryKey: "LocalVersion", @@ -23,58 +61,330 @@ const CippVersionProperties = () => { } }, [version, cippVersion]); - const CippVersionComponent = (version, availableVersion, outOfDate) => { + // Cleanup stale versions and refresh + const handleCleanupAndRefresh = async () => { + setCleaningUp(true); + try { + // Call API with cleanup flag + await fetch( + `/api/GetVersion?LocalVersion=${encodeURIComponent(version?.data?.version ?? "")}&CleanupStale=true` + ); + // Refetch to get updated data + await cippVersion.refetch(); + } catch (error) { + console.error("Failed to cleanup stale versions:", error); + } finally { + setCleaningUp(false); + } + }; + + // Version badge component + const VersionBadge = ({ version, latestVersion, isOutOfDate, label, icon }) => { + const isUpToDate = !isOutOfDate; + + return ( + + + + {icon} + + + + {label} + + + {version ? `v${version}` : "Unknown"} + + + + + {isOutOfDate && ( + + )} + + {isUpToDate ? : } + + + + ); + }; + + // Backend app version row + const BackendVersionRow = ({ app, isLast }) => { + const isOutOfSync = app?.OutOfSync; + return ( - - - {outOfDate === true ? : } - - v{version}{" "} - {outOfDate === true ? `(v${availableVersion} is available)` : ""} + + + + + + + {app.FriendlyName || app.Name} + + + + + v{app?.Version || "?"} + + {isOutOfSync ? ( + + + + + + ) : ( + + + + + + )} + ); }; + + const backendVersions = cippVersion?.data?.BackendVersions || []; + return ( - + + ) : null + } + /> + + + + {/* Manage365 Fork Version */} + + + + + + + + Manage365 + + + {manage365Version?.data?.version + ? `v${manage365Version.data.version}${ + manage365Version.data.upstreamBaseline + ? ` (upstream baseline v${manage365Version.data.upstreamBaseline})` + : "" + }` + : "Unknown"} + + + + } + label="Fork" + size="small" + color="info" + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem" }} + /> + + + {/* Upstream CIPP section */} + + Upstream CIPP + + + {/* Frontend Version */} + } + /> + + {/* Backend Version */} + } + /> + + {/* Backend Function Apps -- collapsible, auto-expands when out of sync */} + {backendVersions.length > 0 && (() => { + const outOfSyncCount = backendVersions.filter((app) => app.OutOfSync).length; + const hasOutOfSync = outOfSyncCount > 0; + + return ( + + } + sx={{ + minHeight: 44, + px: 1.5, + bgcolor: hasOutOfSync + ? alpha(theme.palette.warning.main, 0.06) + : "transparent", + "& .MuiAccordionSummary-content": { my: 0.75 }, + }} + > + + + Function Apps ({backendVersions.length}) + + {hasOutOfSync ? ( + } + label={`${outOfSyncCount} out of sync`} + size="small" + color="warning" + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem", ml: "auto" }} + /> + ) : ( + } + label="All in sync" + size="small" + color="success" + variant="outlined" + sx={{ height: 22, fontSize: "0.7rem", ml: "auto" }} + /> + )} + + + + {backendVersions.map((app, index) => ( + + ))} + + + ); + })()} + + + + - } - title="Version" - isFetching={cippVersion.isFetching} - cardSx={{ display: "flex", flexDirection: "column", height: "100%", width: "100%" }} - propertyItems={[ - { - label: "Frontend", - value: CippVersionComponent( - version?.data?.version, - cippVersion?.data?.RemoteCIPPVersion, - cippVersion?.data?.OutOfDateCIPP - ), - }, - { - label: "Backend", - value: CippVersionComponent( - cippVersion?.data?.LocalCIPPAPIVersion, - cippVersion?.data?.RemoteCIPPAPIVersion, - cippVersion?.data?.OutOfDateCIPPAPI - ), - }, - ]} - /> + + + + + ); }; diff --git a/frontend/src/components/logo.js b/frontend/src/components/logo.js index d74abd69e2..edb5ab4722 100644 --- a/frontend/src/components/logo.js +++ b/frontend/src/components/logo.js @@ -1,14 +1,22 @@ import PropTypes from "prop-types"; export const Logo = (props) => { - const i = - "data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAABQMAAANMCAMAAADfR0vrAAAAGXRFWHRTb2Z0d2FyZQBBZG9iZSBJbWFnZVJlYWR5ccllPAAAAGZQTFRF////ADBJ9H8ggJikQGR3v8vSED1U7/L0/vfx9Ycu+r+Qn7G7z9jdMFdrYH6N/N/H959YIEpg3+Xo9Y88+8+r/efV9pdK+K90cIuZ/u/jj6SvUHGCr77G+sed+beC96dm/Ne5////SKgs+gAAACJ0Uk5T////////////////////////////////////////////AA3Qw3EAAD72SURBVHja7N3pkuK4EoZhVYExYLMZih0K7v8mT1VPz3T36VqwLaUypff7cyJmJuIUtvQ4tVh2d2I47vNwcQh5qBNxCZIQ75FwAQnBwPzkQ0NCMBD6wJAQDAQ/KCQEA9EPCQnBQPRDQkIwEP6AkGAggT8gJBhI4A8HCQYS/ANCgoEE/3CQYCDBPxgkGEjwDwcJBhL8w0GCgQQAYZBgIMncPxwkGEiyBxAGCQaSzAGEQYKBJHMAYZBgIMkcQBgkGEgyBxAGCQaSzAFEQYKBAEhgkGAgAsIgIRgIgChICAYiIAwSgoEAiIKEYCACwiAhGAiAKEgIBiIgDBKCgQCIgoRgIAKiICEYiIAoSAgGIiAMEoKBCIiChGAgAKIgIRiIgChICAYiIAoSgoEIiIKEYCACoiAhGIiAKEgIBiIgChKCgRkL+LL4kenf2fzzb1CQEAxMicDxYrGZTq/L5XL7/GjWb//19YeKYxAkBAMtCrhYXKa75fK5f9453CxeUJAQDDQg4MubfV7o+yuT5e7NwjEKEoKBGgUcv+O3fg6fNwpvLyhIMJBoEfBNv+ty8iyb7W66OKAgwUASlcDDbfq6fo6WyTJiSUizIxiYtYDj21S8+PsUwgMKEgxEQMFF30vM6u/D3TSvlwUKEgxEQJHy71lpllPxZWNaIMHAjAgc367bZ+XZXm8oSDAQAf3HgH+/1YMoSDAQAT1ufNY7/v1soeR1cwBBgoEQ6GEAvNlNnk1mfV2gIMFABOxVAF62z5bzVg6OUZBgIAR2nAFcPyeQ5eUAggQDEbAtgFZHwB8uFoswSMckGJgKgUkBKMcgPZNgYAoCJgigGIP0TYKBxgVMFsCfDIZeIqFzEgw0TOBLGosgX+f1hoIEAyHwg2OwjG+DabFh5voCggQDEfDPMfDrc04JOyamhxIMtEXg4Tp5zi67BQgSDETAt2yWz3lmfRmDIMHAzAnMsgT8NTO4e0FBgoEZC3hbPuee5QYECQbmSeD4sn4mb0Pi6RgFCQZmR+BhN4G//9ZHDiBIMDArARevwPfnkHgBggQDsyFwswW9D7YMoiDBwBwIHG+YBvxkYnADggQDkxdwyjTgF3tlAiyP0F0JBuohEAFRkGBgvgQeEDCOgvRYgoEaBNzhWywF6bIEA2MTOL5iW0QF6bMEA6MSyDwgChIMREASc6cM3ZZgYCQCLwioQkH6LcHAGASyI1rNG3R0XIKB4gQueCuuX14PKEgw0CyBB44H7J/rGAQJBpoUcMyGQD9LxBcQJBhokEAWg/0tjixAkGCgMQIXLIUonRak+xIMDE8gE4He43HPNB2YYGBYAsdTyAowIL6BIMFAEwTeGAZrHxDThQkGBhPwwJdCAr5EDIIEA5UTyItxQbNdgCDBQMUEvvBaiJUt0/RigoHeCeSMQEtrI+paGq5goHUC2RIotTYyNoQglSoG5kKguSJw+WcszWNObuoR5NQvDMyNQO0bYtbL5W46nd4Wi8VXO0zGb/9+8fbf7ZbLNaVgdPywEAOtEKi2CFwu39176Tq6X2ym1+WWUjC6fkiIgboJ1DcTuF5epwtvJw2M3yx8XSZZCtriDwkxUCWBuorA7etb4Rem240Xl6uieUM/p8kY5A8IMVAXgS9aisDJcrp5Cd/vDovpq5KffI3siFMRPMLAuG14qoS/20Gy3411QLh9iWWIUxZQwsBI7fgQf8Fge90c4vS7w+0afZLwEsMPpzPAhIHyLXkTeXZsOV3E7niLaVwHfSyNJOAfDmJgDALjfjBEgX8qHJwsxORwJoJPGCjVniMekLC9LrT1vNs12uWYirjhLAWjMFCgRV9i1T27zVhnxztsIp2duByHRsPZC0xhYNg2PY7T3bfTF90977Zb2xwPpwUgDmJgaAKjbAp8vRwsdLyX69rieDg5AGEQAwMSGGE9+FXrCPjDUfFla288nCCAMIiBYQiUXw82BeBPBqfC1eD6xbMVLqFgFgb6bNzS+6INAhhnULzxKYVLLKiFgd5a90J0HLy1MQf4+RKJ5NXa+YLCJRngwkAv7VtyS8z6ejDf8cYbwf3T27EPJly6wS4M7NvAJacCX2+JdLzDVawYnPSdFEwZQBTEQA8Eik0Fri/jlHqeWDE42TgCgxgYisAXqXpmt0iu44kVg1eQQ0EMDETgRqgEnB6S7HjjjUwV/ToGORjEwBAEyhyZv0x5MLd4NbEygoIkUQMNrIYkOAj+vyGxxGaZyQvCoSAG+iZQYBw3uR4y6HjjaXgFPX15EwVJUgb2Ww1ZC0wDZjOE24S/miwPoyAGeiUweOmyzqvThldwB28wiIHeDNwgoPfcliCIghgIgbkK+GOROLCCLA+jIAb6IXCHgKEU3IIgCmJg5gSu8568DzsvuGaPDAhiYF8Cw343ZM3yZVAF2SiIghjYl8CQozXe7/+RkPsFQRAFMVAtgZMp01U/r/KUjYIoiIEqDQxJ4A4Bf+WwA0EUxEB9BAZ8OWR5oK/9uUS8BEEUxEBtBAabp1ov6Gd/L45MQBAEMTALAicXOpnstCAIomC+BiokkInAz6cFQw2Ip1xbFMzUQH0EbhkGf5VboClYXh4GQQxUQSDD4G8HxNeEERwv3nKbfpDN+79ZHFAQAxMnkC9dPHLtt2khuFhsptPl8tFh/vrtP31DcbF4AUEMTI1AVoMfzGWSAoIvi+l12c/z7XI3vcTFEOxMG6iMwCtFYNy1Eal5iPHicl16nddcv1l4ewFBDJQyMAiBrIXELwXDb5E53KbLcBvr18vp5gUFMdAmgWzO0FAKbgLzJ/IV+e1uuhiDIAaGI3AcoCFvOb1ERykYCMGXy279LJr162WBghgYhsAtRWDCpeAmgH+vk+c42V43BxDEQM8GBiCQ5eDupaByBA+baP7917p2Qg6injUD9RDIcnCfIsv7/fB3qOrtun7WERkHYc+WgV3vs/fR1+QGZL1yVYngePP6rCvb6w0FMbA/gd5P8lxSBPYutybaEDxcts8q83o5gCAG9jLQO4EshviouXwX5+txigD+LAenLyCIgZ0J9D0Dz5cdPcX3uYKdvzusHMCfze76goK5G9jx7m44IEFrFp7Hw9s05gCjMIh+Bgzs2s+Mvp3KeFjk/ITFbvJsKeEYhL9UDfT8hhzftdU9Hr62HAOvn+1lG2iJBP+0G9ix0PBLIOvB2teHW+yVXrw+W83rDQXzM7AjgduIVQZ5rFL3e48e1GFssgT8bUByPYAgBj4Qr0/6CZ8xCzMp6HXv0kOzFQdjs4AfD0o2IJiTgd3uqNeXEdgSY2NScPLtfEXA774LF4PTAwjmYqCCXTFMBVqZFPxmm+Bm/ZxQdgsQxMDPJ5ri7rogbe7VWuZeWZ8GlBgSY2AyBB581hZMBYaeFPS5MvLZu4zj6eQ5waw3YxBM3MDonWrCUYHhswv9yEpUwH8mBscgiIEBl4RZDbG2MvLB4nDCAvpXEANTINBjh9qyGiITj2tY/3+GTOICelcQA+0TePM4ww6BYisj/qD68/iES/IC+lYQA60b6LEzsSBsE8FrqrthhBTEQNsEelwP4ZgYq8vD/66LLLbPGWVyAcHUDIy8xMieGLMI/rMuclg+Z5b1BgQx0NvB0Xw5KQKC3hb012M3vj5nmOUCBRMysNOkUsAdFsTQRsHXPJZCPvrlBxBMxcBOhcQaAkEw8/haHMFAkwa+QiAIkvUNBFMwMOZk4BYC4+WCYR6mBQ8gmKWBviYDeTkkajYQ5mNADILWDYw4GQiBIJhAtgsQNG1gxMlACATBNHIdY2BeBm4gEATJH2sjCxA0a2CHm+Xp2FQIBEFKwUwRtG7gFgJBkPxVCr6AoEkDO9ypKQSCIPkgUxA0aGCH+7Tws6EAAtknmN4C8QEEMzDQz7YY3g5RFd4Y8bVXcAOCxgzscJOuEAiC5NP0PQ8dA9UbeINAECRfjYdfQNCQgR1Gwl62xfANTX15RS8l42EM1D0S9tJTODVaYcZb9PI2HsbAdA28QSAIksDrwxiY+kj4CjdKEZyAl7fx8AIE0zRwF32cQALmBQT9ZQOC+g1sf2d87I7eQo1iBKFLyaQgBuo00MfuaN6QUx3emvOY5RgEdRvY/rZ42B09OeCM6kxN4PJ/0bqY02enIAZqNNDHQIm90dqjc6/0ZLm8TqeLxeKL0urw9q9v0+lUkYkTENRsYPub4qFlsStGf3QVVevl9LLoIMnLYjO9xsewz3ZpDFRnoIezRdgVY2GHzFqNfrf+w4bD4jJdxvxFIKjWwPaNqf++iVeAYYfMQ9XT63Thd+3srSpcRvpZUxBMxcD+L8mxJGwkt5j+ba+bUOtmh1sUCHcYqNLA9g9SloRZHA4+/L3egj8nD5vrFgQxsIOB/adUOCuGxeEvx78bsYfk+CbrIAgqNDBCZTBFFkPrIlvxAlD8J952ckslr2MQtG5g/wUR1kNM5TCRBDDWrtHDRerQxM5z4RiYzIII6yGsiygD8L9ycAKCGBh+QYSz81kX+ahZXFW0CxEGQVCVgfILIrwfYi/L4JNkNz0/VoDBLQYaNrD3GyIcGWhxXSSoCuupsq1S403oucEdCKoxULwzMBloMos8SsDflkimaxDEwBAzQ0wGMiX45yyg3t3yi51CBDEw+r6Yvnf+giZMCf4aBF90jwqCFoMgaNPAvk9GdgYyJfhLQAurY5twO8Q3IKjAQOlZoTWTgUwJ/szyZuV3L3UhiIFRDezbGnhN2HKuPgW01BQOoSYGX0AwtoHSlQDHptrONksBAyo4AUFrBvacIOZLmsbj6UDVtcVd8mEU7DY5hIHRCNxEqfyJnlxyFTCYglsQNGVgzzKQA7Psp/fywGRqeFksxOpItx0yGGiyDGQknED6bpDZGT8/fOF/v+AUA80Y2PcTY4yEU0ivY7S2CewLuHjfJnkDQSsGThkJkz6nR07SeEdo7HtasNPiMAbGKAMnjIRJj3awS2Z//GKrYF0EA82VgYyE8x4Nr5PaHu95QNzpDVIMNFYGMhLOezSc2v0/+F0hvmBg8mXgGjlyHg1vExwF+C0FM58SdBmUgbwnnFT3ZxDguxTs8r4IBsoa2O8FAY7Pz3g0vH3hWRBmShADRQ3stTdwksaK4OI2nb4u/83rdLrIdaGnzVfXrwkfl/ayjToliIGSBPZ7RcT+h+QWl9ePnwLb3SVHCB/+6vok7VkQn3sFXzJG0KVeBi6N9/fLN0O/yesmu6NhHzxBZpn8hdl4WxrZZjwl6FIvAy0XSuPLY8OdbW4MvqyzXQwJNR6+YqBiA7fCt1bNELjN5P8ur8Xv8TLzcfB/F8Lbp4gX2SKo38BFngsim7YzANtNVgp+s2X0dcyFCL5BBgOFysBeG6EuuQho+nzQbsPALxrG+pbRhbh5mhTssEEGA0UMfMnwDZFN11WgdVYj4s8uk+mTUsMtEQU4RgsDRcrAnfAch+4C5/u10ENOvf+jKdNtfuvk4y2j4YQNPOS2L2bc9xuSeR0QMd7sfgNg/Xo5uAzjaWXkioEaDew142uwP3g4Ln2b3b7pxftLNJfFYuyyjZ/t0ossEXTKh8J9pjoMvijsZ5Hv4ggIisyfY2BwA/vsj7a3L2bs6zCQ1zEo5BYvj89pjggqN3Cb08TYi79D4bacnJ1dNh7azeSAgQntjzZXBm58nos5AUEQFFlGxMCwBu4ymhTbPPvNBhRAUGCTIAaq3RizzpxAEARBlkXsGzjNR4Dd8zMIEgUITjFQk4HrbMrAzfMzCBINz9LW8+gYGJDAWzbdPwyBIAiCEttqMTCcga+5lIGhCOTj8iAo0GgwMJiBh1wKoJdJMAMnB1DILP0PUGi9PwYDFa6ImCoDx+vncNnyxkh2CPZuTwsMtL8iYqoMXD6HDF9Xzi69xxWZFYJ6DVxkUgZOn8OGdZHsspBuMxio7h0RS93+JTCBTAlmmIvwRmkMDGLgOI83hYNOBto9SZb0y45CMAEDe+wXsXRgzPQ5fDhOML91kS2FoEYD213VbRZl4IsAgYyGM8xhQiFo3cAemwMtrYQuJQzs8tVEYjw3CkHrBvYYIx6yaagBvxNBrOcqWghioH8D11mUgWshA1kWyTD9pgS3+RSCTieBL1nUPJvnZwpBEmqueSLZZDDQt4FXsedXDmUghWCWuYg2GQxUMxQ2tD9argykEMwySwpBVQYKDYUn2UzYUAiSbzLuNRreYWBMA7tvcze0P3rxLBn2CGaYm2STwUCvBk5y6Oo7UQOviMBoOGiTwUCfBHZ/fBnaDTwWJdDUJAHxlV6vi7R84QoDdQyF2RjzaW6IkGF6rQ1nsk9apYGdV4UtHRz4Kmwgh6lmmT4Lb1sMjGVg91VhQyekCA+FGQxnml4rbwsMNLdB2tCKiPRQmMFwptnJjR0wMP5Q2NL5KK/iBrIynGV6bRIcY6CxobClSmcibuAWD7JMn2N6LxgYpQy85DDj9fIsHz6zmWfWYs9NDPRk4DaHwd4mgoFMCOaZPm3tBQMjGDgWul92Z6ozeI+Q+MxWahIZA/0YuMlivmsZwUDOTcg0PfbHtJxfwkAvQ+FXmfnbyIlAoK1PzxMdT9wbBho6L8HSySiHGAY+gwGFYNgtghjow8DOt+s1k0bJQapEshAcY6C0gZ1fEtlYapMXDCQ2nrnt+hUGxtwZY2r32zSKgRcwoBAMO77CwIg7Y2x9RzyOgWyOoRBkMKzewE0WQ+EoW2MwMOesGQxbMXCXxVA4koEcIZhvNgyGrRi4zmIoHMlANklTCDIYjmFgmyv4ksdQGAOJnSnoGwZKGnjJYyiMgUQ6Y6EpFAzsaWDXF+WsnY2HgUQ6nafaJxgoaWDXF+UuGIiB5Mt03x6zwEAD04EHDEzsgEXiPTIHc2JgnOlAcyeivEYxkP2BWafzZHu7mSYMjDIdaK7A4T0RYmhV5ICB6ncH3jCQ94VJsFWRDQZKGdj5VD1zrXETxUDOjck7N5HdMRgY42XhV3OtMc75gS8wkHe6jrMmGChl4DWbMd44ioEgkHmuIk9PDOxh4FZiylZHYhDIR9Zzz4vITDIG9jAwl50xLs4GwVcQYDAs0HQwsLuBC4kZW+ujErbGEPlmN8FAmTKw64aRjcHGGGNhmGVhBsMSE4IYKL9DemywMcb4uCYEkDUTgqoNXOY01b8WJ5ATE0jnwfAOAzUvidg8CWDHdCCRT9dt0msM1GzgLavGyA5p0icTgQknDJQ28GCzMUoTuKb/k+6T7jcMFCDQ5dW3pY/P4vBA4rpvSJhioF4DrX4w8sZQmMin64aEhHdJ2zdwY7U1ThgKE/l03JCwxEAJA9d51Teyr4pwdiDp0+wmGChh4DL4vUliVJLPRnKiaA4GAwUI7PaunOGdv5LnJuzo/ORHxhio2MBOTyjDO38lD1I90PnJP9lioF4DOz2hLB8EsKQMJEYmBNutqWFgRwO7PKEmllvjgjKQGJkQXGKgiIGX3AqcJWUgkU63tbhXDBQxcJzXUFiuEKQMJL+yDj/vjoEdCexwmIr1T2TInB7DiTHkt7yGn3fHwM4Gti7TN8ab41jiZZE1ewNJvymntvtLMbCzgW3romWe7ZEz9InwhGDbnoaBnQ1sWRclcA5A+GURPidH/kyH/RcXDJQysN3CfQrHQR0mjISJ+sFH10aEgWFXCdL4ZviNkTDRPgvde3MVBra5Pw8X6pNEdnyEPT+GNWHSd9rd2+aq/Azs+JB6cPvSJJlDQbdMBhLVhaDXPfYY+H1eJnkR+LD6HbJlMpB8kHZHNPkfcWHgd8sE26wIfFT9LocrQiDpP/YIc/4uBn5ZGH27k32b1ttfgRCc8A0R0r/FBdyFi4Gf5zLJ6xtpNwgkotloGUxg4Kfj4S/2Dm8XOTdJCCQ+ctXTjNI1sOeFWXyi4HqTZJO8TSCQSGanqRlh4CdzFru/Xdglu+XX85wgBBIPCAo2Iwz8pBicLn/RsLzeUl7nfNmyKYbomoDZij5JMfCzjBc/kv45oGN/5yfsIJA88Nj9Zmfqq3gzwsDcM/VEIB9UJ489dr9aGVnfYvxJGJh5Fj4mBddMBZJHc/hsVnAyjTaWwMC8H8yvvQm8Mg4mrRT84MG7vkRtRRiYdXpukllzVhZp3eZ2f0wMLqfxRxJJGEjLCjFH891WhilFIOnU6haX6Y/ctDxEMTDr0UnXAfGOj2iSdIKBOWexREBCMDDrWrDlWb8TBCQoiIFpzdBcHj9bdbthHpCAIAYml5frIwyur2wIJCiIgakyePl6avD1AoAEBTEw7Swuu48gXO7wj6CgWgO5bZ4zXiymv7JYMAFIQBADCSEoiIGEEBDEQEIICmIgIQQEMZAQgoIYSAgBQQwkhKAgBhJCQBADCSEgKGMg94kQYkFBB4GEkIwRdAhICMkYQQeBhJCMEXQQSAjJWEGHgISQjBF0EEgIyRhBZ57AsnjLcfBX3v9xSSvJJe+3+6M2UHNpgna98/9f8+PbP2xMIeiMEtgU1WAwHK6evstqOBwMzmiYKn3n92Yw+rIJjN6bQFFwsbzRVw3mw+F3/e70xmFtAUFnTcCmGOwfoO/vzIaDin6QkH5V23YwGu6PtIB++r3h17rbnWvdCDpDBBbH/fCpZ1Zvt6ShMdtOXc1nnVvAbH5kfNyp951WnS/6cF81ahF0Nghsqv3syVtGpwH1gFX/jqdR/xYwpAG08m8w7H/NV6dADx81Bmpv9R88ms40bmM5z1f+GsDpyIDgofLDY/dbzatSnYJOt4Beb8BH5QDDIjNzUdXJ+/1f7bn/X/e/48x/pwvw7FFgYKACcD97Cp7R/Myasf4EABAGv3vqHEP1v5l3BqMbGGbYM3qSyqmCQdVzgGHbwmrPoPiDDngK2udmnvtcZANtAxiTwYHMjxu2ngPX9HdVAqOBmYKnoFBjGDw0Bh6swv8l80IHgk4fgfVeGsCft+SMgeoMLAdCjWE0bzDwv7pbqMutjqUCBJ0yAsPNQWgcFGHgN+XIXPL2DwsMfL/5Q8Fr7vPRE81Ar82gmD9FzrDCQC0GNuKtYVVlb6CogJ4fPZEM9Lr5YfakIKNBg4EK/q4myvMwooIaDJQX0KuCUQz01wKawehJS+Y1Bkb+u8pozSGagvENbE6xepwnBWMY6E/A+ZOqCE0NYeBna8ExH4iRFIxtYDmw3+PkDUxVwPfMKgyM9XfVw8g3f1XkZ+A59jjs1ERC0MUnMF4FHr0cwEB19ci/f1qdl4HNUMFF35dREHSxCdRYA/6n4BkDxf+uYqXj5u/LjAw86piMHx1jIOjiEqhZQIF5QQz8K3s1935U5WKgiiLw5xRULY+gi0lgqWgtOMqgCAP/fyZwpureN1kYeFbVC/vX31IG+rjplX4B3zMvMVDo7zpqaxGD9A0stQ3F+i9IyRjo4ZYXsycjGQ0wUOLvKjVuD6gTN7BW2A17l4ISBnoYBs+fDCXUXgkMVN4b33JM2sDzKMX+JmBgNsPgXzk1GBj27yq0NgmpWcEYBg609re9IIIuBoGK1qEeHxAfMTDk31UpvvXnRA3UPBibNWIIuggEHkdPFhNgaggD/43uqZF9kgaWqmfke25NCmpgjkXgx9PJGOjt79I+Ozxr0jOw0b4oORdC0EkTaLQIDFMKYqCBguSfqqRIzcBaf0fs9+TRamB5erKdIwZ6/7vKWX53PrqBtYVaZFRrNLDnnsDRk/V4XSXEQDMEBt0rL29gbaQnVgIIOkkC908JxOcqIQbaIfBtaFYmY2BtphiZh0fQyRFop7F/kz0G+vu7LLWKVZ2IgbWh8dipDI2gEyMwgXGwn7laDPzt77L1YBzVSRhYm+qKPcpv/wb2Ww9+Sii+xsMYaG2jVJWAgbWxaqRH+a3JQFuvBz88s4yBPf8ue82iMm+gvTmpUVgEnQiBzewptZxKDOz9d1lcJLN+iNDeYF8Mi6CTILAePaUXH5OCmRtos1nMbRto8qJ3f3HOp4E9bm6VIoFeJsgzN9Bo5qYNNJqACAoYeEz1tvT/4AQGgiAGxkbQBSdwzn3BQBDEwFidzZeBLAgH6QwYCIIYGBtBF5jAGZ0BA7nvGOgj5zAIhjUweQJ7dgYMNJsBBoqn6yqkDwMh8CtgSgxkZIaBdhF0ENg3Pd5nxEAQxMDYCAY0sB5lcmO6I4iBllNgoHhWZRQDITAYghiYY1GCgfJ9rZ+BXV8RHuV0YzAwSwQbDBTP0IyBmcwF/ps5BlKUYKDivtbHQAgMeGMwMMuiBAN75egZQQeBERHEwEwHABjYJ5UBAzMksNvTCQMzLUowsNc8bO0VQReiDDxleWcqDMwxBQaKp9MOmY4GclJMm9QYmGNR0mCgeGY+C8EABu6z7Q01BubYH0sMFM/eI4LOO4EVvQEDs8ocA03MPIkZmHX3GWJgjjlioIFB16cIOs8E1qOs78weA3NMjYEmpiBaG9hpV8yKEh0Ds8uqxEATUxASBg4p0TEww5ww0MSUYEsDWRIOX6JjYMb9EQP71huNHwS9GlhxX9qV6BiYc3/EwL71RmADWQ8RKAkwMOf+iIF9M/CCoEcDs18PaT8liIFZ90cM7Js6pIG8JSxREmBg1v0RA1WMhv0ZeOSOtC4JMJDRMAbKVt8PG9hhMpD78SsFBtIfMdDIaNj5mgyccTt+5dE9sxiYVBoMNFB9BzOQnYF/ZI+BGWaIgRZHw84PgXSaTqNhDEwrFQaKp/3OzDAGluwM7FSiY2Bi/bHEQAPVdxAD2RbTrUTHwDznQDDQZ84BDGx9987ch7/TYGCGqTFQPCsFBjIS7goPBjIww0CZMdfnCDoPZSBrwl1LdAxMLhUGiqf1soh3A+kwn5ToJQYyMMNAgcx7FYKufxnI7ujOJToGMjDDQA+p4xrIreteomNggne9xEDxDPsUgq4vgQ0LIt1LdAykEMRAHyliGjjn+n+aGQbmmAYD1ReCXxlIb/E3KDoyH0j5j4HqC8G+Bg65+p9kXzoMpBDEQCVjrmAG8hWlz9hpFDV7DLRQCGJgr5x9Gdj2vvEJkQ+zOqtq9hhooRDEwEgzgv0M5Pz8DycCOUufQhADlc8IfmYgLwr76AClw8DMn4IlBtopBHsZyF374E7U+i4gBkpngIF2CsE+BlIG/j0RWGls9hhooRDEQNkZiI8N5Kb1nQgsHQaSp07Hx9Cd+qbphqCjDPT3HGqUNnsMlB8QYKB89uIGcs/+yKxQ2+wxUD5nDNQ+A/GRgZSBPS5/p7MzMTDZnDBQ/QxEbwN5ReS3DLodmISBTE5hYLQZiN4G8orIL2M6nhSCgUxOYaDPFD0NpAzs+PApnMNA8v+zIxgon07bYzobyIExP5v60TkMlC+93zMf7H/8r86Z6So1A0c/LvZ+MP/xvzr/xlLQwBr9/hnxlA4DJYvu06AqPph6KM5vXVPXn3pKxsC3h825+LuhN0U1OCn7mtCxl4HtbhjHR/9oHLVzGChVhpwGxTdPnLqaK5qmbhIwcDU/ftfGi+NJTyE+kzOQjTFPj5+QhYEervX+0VnX5ngyWZMoNHB4fPQZXw+01IN1ewQ7GsihWS1OyMLA3gC2K6nKSgWDM9MGzqp20zzNUUUJvu9hYLv7pWoWYDScD6rit3FSUxTVYD8Mek/mpcNAkcy7rLs3AwU9sjZr4GjfZbtXrWCGbCVloJ4VkeHg/PndKovjKUxXGBbOYaBItd1176Wroiu4N2rgqur6gC8H0SfJ2g+GuxmoY0VktX9kQq6pvE/ZrirnMFBEwF7VdmwFVyYN7Ne6oyu4FzJQwYrIaN8C/LNXtAelw0CR5tz7QkdWsLZn4Kj38z2ygqvOBhp7R2TY9k6Vla8pzFPjHAZK/NU+LnQZVZa9OQP3Pp7vTdQlqVrEwNirbvNO2/IKH3/2rHAOAyXqkbOna9xE3Dq9MmbgrPZ00c8RS8HWg+EuBpaRBWyiPZ9GlXMYKJFT6e8qR9zI1ZgycODvmpfx6qRVRwPtDIX7rcgWvYqCfekwUCRHr5e5nln4HbENXNVeL3oVrRSsBQyMOBTuX4h1vzXDxjkMNNgb36qSWBsZZnYMPPl+wEd78hzDG1javk8dq/RV4RwGysBR+r/SscbDpRUD9/6veazx8DC8gdGGwr6myTtM2I6OzmGg0HxvkEsdaWhWGTGwCnLR5+ofPO8IOjtD4Zm3sWjTtkqflw4D7RYk/wzNRspBj2jgqAh00ePUS+fgBo4S6ButHlDDOlALwUCpgiQagisLBo6CNfA4CM5DG3hOom88Pj+0OgdrIBgoSGAkBBv9BgYkMA6Cq9AG7tMo1h+8N6NB6TBQ55KeCQSP6g0MSmAcBFvNmnUwcJbIbXpoZWTeBG0fGCixHBIVwZN6A8+BL3qEJfmqvYGt1hOSeVJ93yGGReDmgYEdvbBTlIy0G1gFv+jyq8PzsAZWqRD47U8ZhW8dGPh7ZqVL5Yp3GZfFMXAe/prLDx1XYQ2cJ0PgNwgO0umRNgwcNQLdUX5nV6XawKHENZf/+lAT1MBVOgR+1exOIh0SAwXnpX72R+kGPNds4KgUuei15rbU2sAmra7xSVU7K0SaBgb+lr3MJRfvjzPNBgq1c/F1kfbnZ2meDgw7KVd+NFUxOgq1DAzsQIW5/ljqNXAvdtGFD3EchjRQejowwm6JfekwUDy1S7U/FmoNlHvuuEZ4SjCkgcJLPOGXCv+/sB02cg0DA3+tQAle9UbnT5M3sBC86EfFj9R2BgqfmzUSqA7+WChcnZ3DQHkDVyle9n+X17QauBe96LLVdxXOQOHOITEx99vC/WjgHAbGMLCQve4rjb5LGzgqRa95rdf3dgbK3ieRzUu/DoGYlw4Doxh4Er7usud+KDWwEr7oc7V0tJsOFN1hOhKamvunSh/WzmFgHAMb6QsvOjArVBq4kr7mojulR+EMFB1ESI1M3+fIV5VzGBjJwLn4hRf9gZVKA8+ptvZ/UoYysEzzQTUYDUqHgdEMbOSv/FDfszzFeaZ4hWARysAizQdV2TiHgdEMnEe48oU+bmQNrNJt7q2XU1sZeEz7QYWBUQyM8gQSLARXCg1cxbjmksPIfSgDJc+QLjAwDwNPUS695EufCg2MMv0tuTQ8DGXgUOdvwEDLBkZ62Aku79XqDBzFmf8W3CPYptBttSwsOKl5xsA8DFylfe0fV17SwHmkiy74qm0oA9PvGRgobeAg0rVvtP1ESQPrSBe9UvkTlS4LHzEwEwNjrckLTuzstRk4i3XNBVdFijAGCr5iVGJgHgZG646CNclQm4HxKoyTxt+o823hk8PAPAyM1x3LfA1sMnjwDMIYKLe0fcbATAyM1x0FB8PKDIxXews+eE5hDBRrNCOHgXkYGLE7Cu74V2bg3mXw4BmGMXCm0HAMNG1gzO4ot1ut1mVgkcODZxbGQLGbVGFgJgZGnfRYqUJHzkCXxYPHuIElBmZiYNTLP1clvZiBcV/BGpluWmKEzxwG5mFg3DstNi4bqDJwEPWii+2OCbIPXKxn7DEwEwPj3uk6TwOLHNp8oJ8p1jPOGJiJgZEnfvM0MO5MU2HaQLGb1GBgJgbWca+/1EaNoabuFflV/NL081XqJuWyOxADnyJf/3mOBsY+lU5qUWRg2cAhBmZi4CyP66/LwEHkiz60/DulVnT2GJiJgbGfdqqslzIw9pFMe8sGDjN5UGFgkcmdFlsY1mRgkUejD3NO7DCTm4SBuRjocjQw9oqj1Al8Q8sG1hiYiYEFBsobGPuaFxio/yZhYDYGDjFQPI1lA0cYiIFJDctyNDD+rgvLBgr97SsMzMVAh4EYiIEabxIG5mKgprXYbAwcYSAGYiAGRvtb4p9PLFR8zzAQA9UbuMJA+b9lkIuBTxiIgeoNHGIgBmKgymIdAzEQAzEwnoEDDMRADMRADMRADMRADGQ+EAMxEAMxEAMxEAMxEAMxEAMTM3CEgRiIgRiYsYHskY7wt7BHGgMxEAP/yz4/A3lXzoCBnJmAgTkOyzgzwcAP5ewsDPQbzs7CQFs/lDNUMVB+iIiBiXWvBgMN9AwMzOVOP2GgeDhLHwMxUM8+jRwN5JtKBgzk25oYmFZJwrc1I/zOIN/W5BvrGJjW/DzfWI8Q099YH2TSMzBQlQ0JlCRDTX9M7OJ7iIEsDGOgljs9z9HA2CXGCAMNzNpioNSdruNe/1mOBkZ+B0Fqa8xTZXoGucLATAyMfKefNJUkYiVGmcc6VGH6r99jYCYG7vPojroMPGcxBxvGwFrqr59hYCYGxr3TxzwNjLsoIrUk0mKe5a5w6JDNhGD2BsYdl51UlSRiBsZdFJFaEmmx3qbSwAoDMzHwnEV31GVg1NX4+sm2gVLLaNl8XhMD91l0x1qXgTEfPGLzD7MwBooN5SMvXWGg2I1e5dAdn5wuA2M+eMQMGYYxcC92lyoMzMPAmFO/s1wNjPjgKcV+5CmMgQONPwADTRt4zKA7DpX1rohb0yux3zgIY+BZ7i41GJiHgbMMuqM6A+PtjjlpfLjedXaNAQbmYWC8p53cUHivzcBog2G52rvNFuk2BroM7hIGChsY62nXaPuJggZGGwwfVf7EVgaO5H5ChYF5GLhK+9o/XpJIGjiPdNHlau82myDvOjfH5PG+HAY+RdutttJWkkgaOIqz+azW+Wi969wck8dXRTDwKdarW5XgL1RXmMZajp/rbFWtDDwm3zUwUNzAOKsigqOylUIDo8xACE7BttoHfr9r7RtyM4LVsMbAeAbGmJwq9D3NRQ2MMt8uOYw8hjKwFH1Uic1ZrN76YYmBsQyMUQgKzmw/uvIta2CEQrAUXFJtNZXWykDJiWS5XRM/Gt9ogIGxDJQvBDUOaGQNjFAIiv7AMpiBJ9Hb1Ig+nlYFBsYxUL4QlCwDHy1JhA0ULwQlZwOfRq6VgXetlAsti/xarBo2GBjFQOn1r0r016nsW/JLw3O1Lequd1FE5jb98ZP2JQZGMFB4j2ApOqUzU2qg8B5B2Ta1D2dgKXyfaun+MKowMIKBqzLBy/4zJ6UGCk/DzkR/WxXOQOFf8jQL3jf+qtBnBQaKGyj61nCt86eJGyj6GsJR9qfVAQ2cJ/as+ug4sFODgeKpU61IHpZG3kDB6rsZyf40F9DASvo+HWPcmkGJgcKZlYk9eP5LqdZAwUP1hZ87w7YGtkGwEb9PISfoys9uzarCwET7o/Rvmzm9BoqtRQ1UN6aWBsrukv6xShFwlPTFyH5YYGCK/bGUbsBzzQaOmiSfO63a0r21gfOndBD8+v3FeYOBqTzsfmUo/bMqzQbKHFFXjqR/VhPUwCqdzvHdTwn/+hwGSk8J7sV/Va3aQIkNMuVM+ke1egemvYHNUyoIPqD56oyBameyA91z323X6TZQ4D2EuW7Y/zFQ8w7BYAg+1h3CnqqFgbJFSYTfddJuYPDDE/bKf1IHA/cx7pP/1zcerghCvj6HgaII1iP5X3RUb2DgrZkRJs/ancHRwcBI/eMY7eE0OmJgEgjGILAFMNEMDLoYFYPAdtOBHQx0o0i9w2M9VrY7AyzYqVoYKIhgFAJXTr+BT6MiKQJbTgd2MXAe6U7NvD2u6tZzmoFO1cJAOQSLkfJfM4h40SvbD/le04E/Dbyrp93npGDVpTcEeX0OAwMX/NFbbWXDwEAIRiqXyuAGlvHulI/TDMpTXIEx8NuCPwCC+yf13TGqgSHK73IYqf20I7CLgcIH6ntenzh2HxL5P1ULA2Xmp8pYTXbmrBjo/8lTryL9koGAgVXUW9WrfxT9djf6PlULA300Y729sdVuhsgG+n7yHKP9kLqbgVYGwz96dOd7VfQuzkd+pwUxUGIRKiIutSEDvW6FLeMNFtt9LKqjgdFWhvspWHiZnvB6qhYGBpz16LwJIFJ3jG+gv01g1Sii5CIGnqPfrFnV8pFVHr2Nhzy+PoeBoadfy33Mn7A3ZqCnRflmGPMnnFsS+J+BJrZJ/1EnzB//rWV10tdQMPD769x7QHyM21JrcwZ6mO0p4w4TR07GwL2O2zV/pBqsj6cADQUDDShYreL+9Stnz8C+sz3lIHKBNBcysNbSR55m++rzh21TDE6B7oifU7UwMJyCZWwB285MDdRc81XnWrDZRx8inoUMdLMnTZmdBoOiKH7RVxSDwSnwpISPlUsMfOSv7/K4qfcK5mtqowa+D7G6THqfTwr+8tYE/jLQ0BZBLem/lQADH2vX+3Y9sjmqeEavnFkD3wuLY9PyqbNS0SnFDCxHEOhh/wYGPuzJ/PzgE6c+ahmkDEwb+M7g4NFnz1kHgK1r7z4GRt8iqKVrFhgoNygenL8pTYrjSdHDubFu4Ptj/jQovn74lOfBUFGHbE/gbwa2Q7DBv3/S6/U5DGzdJ4f7QfH3g6cuqsFJ1yR166s+UHvRV8PBsfi7wCqK436obEB4FDTQDeHv3yFPiYERLPyVlc4/sUrGwF8W/orSybBG0sAz+P3XHysMJH+1ijI5Aw2Mylw/A1siuOKK/0KmwEDyZ+YOA8Vz7kBgDwPZHvNHi28wkPyeGgPlB+tO1kAKwT+HPl2mBTEw3aGBw0DxDHobeOee9XoInTGQ/JsKA+VTdiGwj4Hsk/7LmhoDSZdRGQZ6mZBy0gZy0z64CyUGkqdOHwOgO/VN7cFACkEP04IYSNqOyjAwQjO/+zCQu/bhKKjAQMYDDgPFc45hIIXgx+Q0GJh5GgyULz6cFwPbIsgewY/z6KlaGEgZiIGeUnUksKeB7BH8bFqwwsCMU2OgnTLw/w1siyBvDX+Wh76KhoFpToY4DNReBvozkONjPs8Dp2phYJIpMNBQGfiXgW0RrLn6n2eAgZSBGKi8DOxtIAdKfzUexkDKQAxUXgb2N5D9MT06AwYmmLnDQEtl4N8GtkbwyA34bEKQ+cAc02Cg+jLQs4HKvjVsqjNgIGUgBnrIuQeBHxjYGkGWRT7OwGFgfhmVGCieoYtsoNtzEz4qz0sM5MmHgRIp+hD4kYHtl0V4W6RjeY6BOT75MDD29IN/A+kyH+TkMDDDdP7EIAZ2n35o/BvIaFjqvmBg7hNTGBhh+uEewkBGw/+fo8PADFNjoPz0gwthIKNhIXUwMK3sHQaKp+hJoC8DGQ13mqHAwLQqkhIDxXNyYQzsgCA7pVuPhDEwsZwdBoqXG2VfAv0ZWPPecHtzMDDvigQDxcqN9gZ2QJBz9duOhDEw09uOgfGa9kcvhXgzkFO02g+JMDDrigQDIzx3HjewA4IlU4I/MncYSEWCgUZGwl4NZErwR2YlBlKRYKDS504bA7sgyBeW3vpC7TCQCRAMtDIS9mwgt7HlC6MYmEpODgN197UuBnZC8MRkIAZmmH67ozFQ6rlzFzAw93WRmcPAHFM4DLTw3GlrYCcEm6zXRdpOUGBgGhk4DBRP7YnALw3shGDNbcHAzDJ0GCieLtsxhQzM+X2RymFgjtV/iYEWJgM/fR/k7h3BbD+2uXcYyGQgBmqdDBQ0MNeX5uYOAxmUYaBI6V37I/AbA0Hw8cxKDOTRh4E6Z516GNgRwRkEYiD3HQPVzDp9QWAgA/PbJthtXhwDzd/3xmGgdIZeCfzWQBAMNz+BgfZTOwy0UXr3MBAEwxGIgVnOS2FghM52lzcwKwS7EoiBxjNwGGik9O5lIAgGIxADbWfuMNBI6X3vZyAIhiIQA01n6DAwAQJDGpgJgj0IxEDL8bcrBgNDl969DQTBQARiIARiYGwCHzMQBMMQiIEQiIECE7AxDXRl4gdLr2qHgRCIgYYJfNDA7gim/e5w356AgRCIgZEJfNTAHgju070pw9JhIARioGoCvRnYA8GKm4KBEIiBSgmUMNCd0/zGyMBhIARioHUCHzewD4L1Kr17MqocBva9hhAo3xhGeRHo1cA+CKa3R2ZVOwzs/XcdIVC8MQws9sV9QALbGNgHwdSWh4emPqOj1kCDzWIeikAxAw0WJFVIAlsZ2AvBpFZG9raavV4DzSE4d866ga5cQWAUAxOaFBydHQb6+rtsFSVHl4CBrjY1J9jnVSz/BvZDsBymQeDM3PHpmg20NDIbVS4JA00hOAtNYEsD7ybuso1xMAb+83fZQXBUu0QMNIRgn5n3exADeyJofzw8KhwG+v27rCAYbEE4goFmEOwz/3oPZGBPBK2foXAqHQb6/rtsIDh3LiEDjSDYa/IhmIE9ETT90oj3+SAMNLNzqnJpGWhhTNZvE+5drYGuMbs0MmwcBob5u+ZJ90aVBuovv/sNuu4BDeyNoDuaLAVDLApioI3lslPp0jNQ+0aNfvuQ7kEN7I+gxVnBk+HjkgwYqHkP/ejoXIoGqi6/e1be98AG9kfQnY0tEK8Ky83egoF6J+lntUvVQKf2he2+ryQGN9ADgqWlo1VHA9vN3oSBWuenBs6la6ArVD55er+JdQ9voAcEXW1mbeTUOAyU+LsUPhelisBYBrpG4ZOn97zTXcJAHwgaGRDPCvPN3oqB+jZOiRWB0QzU9+Tp/zr+XcbAu5/brn6FeJXCK6JmDFRWlQx7F4F3AwYqe/LsS2ECuxvoB8FS956I0aB0GCj6d+lpED42Q5kwUNM+DQ+jrrucgX4QdM08WwEx8MN5YiWl4N7Dzb/bMFBNKehlF5KkgZ4Q1KpgeAExUO8MybD20xuNGKijFPTx2Ony0sc9PoIaFZQQEAM/aw+xtwz42Q56N2Tg2z2PvULpZ/vFXdhAbwi6Zq9qXnYlIiAG6twy4Gkd7G7LwMj197BwkQjsaaA/BF05ULNTZlY5oWCgvg7payfA3ZyBEcdjngTs+MbHXQuCzlUqdk2fCucwMP7fVUZR0NteqLtBA2PNQvgSsOsLH3dFCLp6HnlIvBo0zmFgoeLvKsXLkqG3EcDdpoFvt15cwXntohLY30C/CLoyZjF4OjvZYOB3EySSz8S5vxHA3ayBbzdf8tEz2jcuMoEeDLz7hqGJMzM4OzbOYaAqA98UPAo1hpHPEcDdsoHv84JCj55ZVbroBPow8O7fhnovzOBqX7sIqYYi2ds18H2NWGBk4HcEcDduoMyjZzSvA130CAbeQ/AgyGAkABVHlYHvO6eCtgXfI4C7fQN/DImDFoMnz5sv7pENvIfpifVRoAIYRhgCY2DrMfo5VI9c7X3f/3saBr7PzZ+CAVg6NQR6MvAeqjOW53nAEmA1P5eAZ8LAMAyGmAO+J2NgGAZH/gF0Pd/0uN91K/g2EqpCOLiaVxSApgx8/7v2M58NIMQD8J6Ugb7LkNk+yNaLuw4D70E7ZXkeDP1VAcM9/pk00NcTcXU6BpoCvidn4D+zUqeRB/+qUuaiRzPwHrxnNm8QrnrzdywwzrCB/z4Re7SAc7gH4D1NA384WM07F+Gj4aAo5S56PAPvQv2zGpw69IDVcD8oqP6SMPDfJ+KpXaecnQbnsC3gnrCB/3a+lmXIcB6SPx8EejXwLtpNi8FgPvx2gLwavtlXFWx+Sc7AnxIWx/dm8PX/zVs/rCSef/fkDfxZEr71vdNw9nXl99bvzkUZ45pHNVBWwf9GRsVbqsGfqd7/YYxF3zjXIFsDf38oFm8e/p7j+z8SvfWZGPhn1/u749Vxr3lkA1MAoO89wcAoBiq489kZqPSiRzbwnj2BGJilgXcMNEqgfwNzVjCZ34+BvnojBqonMISB97wJxMAMDbxjoFUBwxh4z5pADMzPwDsG2iUwjIE5KpjUb8dAX70RA9UTGMrAe74EYmBmBt4x0DSBwQy85yogBmZm4B0DTQsY0MCcFLxjYK4GeuwEGBiHwJAG3rMUEANzMvCOgeYJDGpgHgreMTBbA+8YaF7A0Aamr2CaPxkDffVGDFRPYHAD79kRiIGZGHjHwBQEFDAwZQWT/b0Y6Ks3YqB6AiUMvGclIAZmYeAdAxMRUMbANBW8Y2C2BgZp+RgYh0AhA9NTMO2fioG+eiMGahdQzsC0FEz9h2Kgr96IgeoJFDTwnoeAGJi2geEaPQZGEVDUwEQUzOFXYqCv3oiB2gUUNjABH/KQHgN99UYMVE+gtIHGhcil2sVAX50RA7ULGMFAw0bkM+LHQF+dEQO1CxjFQKNK5DTriYG+OiMGahcwkoEGochr5QcDfXVGDNQuYDwDbVGR2+o3BvrqjBioXcCYBtrBIr8dQBjoqzNioHYB4xpogossd0FioK/OiIHaBYxtoHoxMt0JjoG+OiMGKgdQg4GK0cj3bRgM9NUZMVC7gDoMVMlG1m8EYqCTb9kYGAkjHQZqkyP3t6JzNzBKs87dwHj03PUkkZuBgcYNjNSmszYwqjt3VUnhXmCgZQPjNeh8DYyNzl1dsr0Xei5srgZGbcyZGqigXxjvrfiHgZobAAbq73UugR4LgBiotQFgoP5O51LptvCHgQpbAAbq73Yupa6Lf+kaGKYlaGq8Cg0MctH19Yv0OjD6pWqg14agrtkqNdDnRVfaL1LtxuiXqIH9G4LSBqvZwP6dT3O/SL4/Y1+KBnZpBsrbqXoDzVz0TAx85KagXvIGfvvzDD2rzRio/qLnaCDBQPvjFZMGJtEvoAEDMRADMZBgIAZiIAYSDMRADMRAgoEYiIEYSDAQAzEQAwkGYiAGYiDBQAzEQAwkGIiBGIiBBAMxEAMxkGAgBmIgBhIMxEAMxECCgRiIgRhIMBADMRADCQZiIAZiIMFADMRADCQYiIEYiIEEAzEQAzGQYCAGYiAGEgzEQAzEQIKBGIiBGEgwEAMxEAMJBmIgBmIgwUAMxEAMJBiIgRiIgQQDMRADMZBgIAZiIAYSDMRADMRAgoEYiIEYSDAQAzEQAwkGYiAGYiDBQAzEQAwkGIiBGIiBBAMxEAMxkGAgBmIgBhIMxEAMxECCgRiIgRhIMBADMRADCQZiIAZiIMFADMRADMRADMRADMRADMRADMRADMRADMRADMRADMRADMRAaMBADMRADCQYiIEYiIEEAzEQAzGQYCAGYiAGEgzEQAzEQIKBGIiBGEgwEAMxEAMJBmIgBmIgwUAMxEAMJBiIgRiIgQQDMRADMZBgIAZiIAYSDMRADMRAgoEYiIEYSDAQAzEQAwkGYiAGYiDBQAzEQAwkGIiBGIiBBAMxEAMxkGAgBmIgBhIMxEAMxECCgRiIgRhIMBADMRADCQZiIAZiIMFADMRADCQYiIEYiIEEAzEQAzGQiPfHeiiSPQb+lkrmolcYiIEYaDFccy46BhIM5Jpz0TGQYCDXnIuOgQQDueZcdAwkGMg156JjIMFArjkXHQMJBnLNuegYSDCQa46BGEgwkGuOgRhIMJBrjoEYSDCQa46BGEgwkGuOgRiIgXRHrjkGYiAG0h255hiIgRhId+SaYyAGYiDdkWuOgQQD6Y5ccwwkGEh35JpjIMFAuiPXHAMJBtIdueYYSDCQ7oiBGEgwkO6IgRhIMJDuiIEYSDCQ7oiBGEjoj3RHDMRAQn+kO2IgBhL6I90RAzGQ0B/pjhiIgYT+SHfEQAwk9Ee6IwZiIKE/0h0xEAMJ/REDuegYSOiPGMhFx0BCf8RALjoGEvojBnLRMZDQHzGQi46BhP6IgVx0DCT0RwzkomMgoT9iIBcdAwn9EQO56BhI6I8YyEUXy/8EGADjoOkG0hYKmgAAAABJRU5ErkJggg=="; - if (!i.includes("LsS2ECuxvo")) { - throw "LsS2ECuxvo"; - } - return Logo; + const { height = 40 } = props; + + return ( + Manage365 Logo + ); }; Logo.propTypes = { color: PropTypes.oneOf(["black", "primary", "white"]), + height: PropTypes.oneOfType([PropTypes.number, PropTypes.string]), }; diff --git a/frontend/src/pages/_app.js b/frontend/src/pages/_app.js index c0d6d5e0da..52683e617c 100644 --- a/frontend/src/pages/_app.js +++ b/frontend/src/pages/_app.js @@ -270,7 +270,7 @@ const App = (props) => { return ( - CIPP + Manage365 @@ -281,7 +281,7 @@ const App = (props) => { {(settings) => { // Create theme even while initializing to avoid blank screen const theme = createTheme({ - colorPreset: 'orange', + colorPreset: 'cerulean', direction: settings.direction || 'ltr', paletteMode: settings.currentTheme?.value !== 'browser' diff --git a/frontend/src/pages/_document.js b/frontend/src/pages/_document.js index 95f09bc14b..44305b90b8 100644 --- a/frontend/src/pages/_document.js +++ b/frontend/src/pages/_document.js @@ -20,14 +20,14 @@ class CustomDocument extends Document {