Ë
    tPêjG  ã                   óX  — U d Z ddlZddlZddlmZ ddlmZ ddlm	Z	 ddl
mZmZmZ ddlmZmZmZ ddlmZmZ dd	lmZmZmZmZmZmZmZmZ ee e eee¬
«      «      f   Zee e eee¬
«      «      f   Z dZ!ee"d<   ee e eee!¬
«      «      f   Z# e$ddh«      Z%ee$e&      e"d<   dZ'ee"d<    e$h d£«      Z(ee$e&      e"d<   de&dee&e&e)z  e*z  f   de&fd„Z+dee&e&e)z  e*z  f   dee&e&e)z  e*z  f   fd„Z,de&dee&e&e)z  e*z  f   fd„Z-de&de&dz  fd„Z.de&de&de&fd„Z/ G d„ d e«      Z0y)!u  Assemble DATABASE_URL (+ optional DATABASE_URL_READ_REPLICA) from env.

The CLI (`proxy_cli.py`) assembles ``DATABASE_URL`` from discrete
``DATABASE_*`` env vars before Prisma initializes. The componentized
entrypoints (gateway / backend / migrations) bypass the CLI by uvicorn'ing
the app directly, so they call ``DatabaseURLSettings.from_env().apply_to_env()``
to do the same thing before importing ``proxy_server``.

The env var names this module reads are exactly the ones emitted by the
``helm/litellm`` chart's ``litellm.serverEnv`` block
(``helm/litellm/templates/_helpers.tpl``). Both auth styles and both
endpoints are covered:

  * Token auth (``IAM_TOKEN_DB_AUTH`` truthy for AWS RDS IAM, or
    ``AZURE_POSTGRESQL_AUTH`` truthy for Azure Database for PostgreSQL with
    Microsoft Entra ID): mint a short-lived token and embed it as the
    password. The writer URL is always (re)written because the token is
    freshly minted on every startup. The chart omits ``DATABASE_PASSWORD``
    in this mode. Enabling both toggles is a startup error.
  * Password auth: build a percent-encoded URL from ``DATABASE_PASSWORD``.
    The chart emits the discrete ``DATABASE_*`` fields (never a
    pre-assembled URL), so URL-reserved characters in the password survive
    instead of corrupting the URL. A pre-existing ``DATABASE_URL`` â€” e.g.
    one an operator pinned via ``extraEnv`` â€” is left untouched and wins.

The read replica is opt-in via ``DATABASE_HOST_READ_REPLICA`` and never
clobbers a pre-existing ``DATABASE_URL_READ_REPLICA``, so a token-auth writer
can run alongside a password-auth reader (or a precomputed reader URL). Reader
token auth is gated on the same global toggle as the writer: the chart only
emits the reader token env vars when the writer also uses token auth.
Reader-side fields fall back to the writer's user / name / schema / port /
password when their ``*_READ_REPLICA`` counterpart is unset, and to the
writer's connection params (pool size, timeouts, pgbouncer mode) for the
ones the reader URL does not pin itself.
é    N)ÚMapping)Úpartial)ÚMappingProxyType)Ú	AnnotatedÚFinalÚcast)ÚAliasChoicesÚBeforeValidatorÚField)ÚBaseSettingsÚSettingsConfigDict)ÚAZURE_POSTGRESQL_AUTH_ENV_VARÚDEFAULT_POSTGRES_PORTÚIAM_TOKEN_DB_AUTH_ENV_VARÚDatabaseTokenAuthÚIAMEndpointÚbuild_database_token_authÚmint_database_tokenÚtoken_auth_flag_enabled)Úenv_varÚ$DATABASE_DISABLE_PREPARED_STATEMENTSÚ#DISABLE_PREPARED_STATEMENTS_ENV_VARÚ
postgresqlÚpostgresÚSUPPORTED_DB_SCHEMESz<missing scheme>Ú_MISSING_SCHEME>   Ú	pgbouncerÚpool_timeoutÚsocket_timeoutÚconnect_timeoutÚconnection_limitÚCONNECTION_PARAM_KEYSÚurlÚparamsÚreturnc                 ó¼  ‡— t         j                  j                  | «      }t        t         j                  j	                  |j
                  d¬«      «      }t        d„ |D «       «      Št        ˆfd„|j                  «       D «       «      }|s| S t         j                  j                  ||z   «      }t         j                  j                  |j                  |¬«      «      S )a  Return ``url`` with the ``params`` it does not already carry appended.

    Params the operator pinned on the URL win, so a hand-tuned replica URL keeps
    its values. Returns the URL untouched when there is nothing to add, leaving
    its existing encoding alone.
    T)Úkeep_blank_valuesc              3   ó&   K  — | ]	  \  }}|–— Œ y ­w©N© )Ú.0ÚkeyÚ_s      úe/home/oem/CyberBrain26-unified/.venv/lib/python3.12/site-packages/litellm/proxy/db/db_url_settings.pyú	<genexpr>z+add_missing_query_params.<locals>.<genexpr>c   s   è ø€ Ò9¡f c¨1œcÑ9ùs   ‚c              3   óH   •K  — | ]  \  }}|‰vsŒ|t        |«      f–— Œ y ­wr)   )Ústr)r+   r,   ÚvalueÚpinneds      €r.   r/   z+add_missing_query_params.<locals>.<genexpr>d   s'   øè ø€ Òe±:°3¸ÐSVÐ^dÒSd˜c¤3 u£:Ô.Ñeùs   ƒ"�")Úquery)ÚurllibÚparseÚurlsplitÚtupleÚ	parse_qslr4   Ú	frozensetÚitemsÚ	urlencodeÚ
urlunsplitÚ_replace)r#   r$   ÚparsedÚexistingÚ	additionsr4   r3   s         @r.   Úadd_missing_query_paramsrB   Z   s£   ø€ ô —L‘L×)Ñ)¨#Ó.€FÜœFŸL™L×2Ñ2°6·<±<ÐSWÐ2ÓXÓY€HÜÑ9°Ô9Ó9€FÜÓeÀÇÁÃÔeÓe€IÙØˆ
Ü—<‘<×)Ñ)¨(°YÑ*>Ó?€EÜ�<‰<×"Ñ" 6§?¡?¸ ?Ó#?Ó@Ð@ó    c                 óz   — t        | j                  «       D ��ci c]  \  }}|t        v sŒ||“Œ c}}«      S c c}}w )zGReturn the subset of ``params`` the read replica is allowed to inherit.)r   r;   r"   )r$   r,   r2   s      r.   Úreader_shareable_paramsrE   k   s1   € ä¸&¿,¹,».×i©J¨C°ÈCÔShÒLh˜S %™ZÓiÓjÐjùÓis   ™7
ª7
c           
      óæ   — t        t        t        j                  j	                  t        j                  j                  | «      j                  «      D ��ci c]  \  }}||“Œ
 c}}«      «      S c c}}w )zEReturn the connection params on ``url`` that the read replica shares.)rE   r   r5   r6   r9   r7   r4   )r#   r,   r2   s      r.   Úconnection_params_from_urlrG   p   sR   € ä"Ü´v·|±|×7MÑ7MÌfÏlÉl×NcÑNcÐdgÓNh×NnÑNnÓ7o×p©¨¨e˜#˜u™*ÓpÓqóð ùÛps   ÁA-Údatabase_urlc                 ó–   — t         j                  j                  | «      j                  j	                  «       }|t
        v ry|xs t        S )ab  Return the connection URL scheme when it is not PostgreSQL, else None.

    A `sqlite://` / `mysql://` URL can never connect against the
    postgresql-only datasource, but the resulting Prisma failure is opaque and
    version-dependent (a confusing migration error, or a startup that never
    binds). Callers use this to reject the URL up front with an actionable
    error instead.

    A schemeless value (e.g. a malformed DSN like ``user:pass@host/db``) yields
    the ``_MISSING_SCHEME`` placeholder rather than the raw URL, so callers that
    log the return value never echo embedded credentials.
    N)r5   r6   r7   ÚschemeÚlowerr   r   )rH   rJ   s     r.   Úunsupported_db_schemerL   w   s>   € ô —L‘L×)Ñ)¨,Ó7×>Ñ>×DÑDÓF€FØÔ%Ñ%ØØÒ$”_Ð$rC   r   rJ   c                 ó   — | › d|› d�S )z@Operator-facing message naming the offending env var and scheme.z uses unsupported scheme 'zí'. LiteLLM's database features (virtual keys, store_model_in_db, spend tracking) require PostgreSQL; use a 'postgresql://' connection string. SQLite and other engines are not supported. See https://docs.litellm.ai/docs/proxy/virtual_keysr*   )r   rJ   s     r.   Úunsupported_db_scheme_messagerN   Š   s   € ð ˆ)Ð-¨f¨Xð 6>ð 	>ðrC   c                   óT  — e Zd ZU dZ edd¬«      Z ede¬«      Ze	e
d<    ede¬«      Zee
d<    ede¬«      Zee
d<    ed	d
¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    eed¬«      Zee
d<    ed	 edd«      ¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d<    ed	d¬«      Zed	z  e
d <    ed	 ed!d"«      ¬«      Zed	z  e
d#<    ed	d$¬«      Z ed	z  e
d%<    ed	d&¬«      Z!ed	z  e
d'<    ed	d(¬«      Z"ed	z  e
d)<   e#d9d+„«       Z$d*e%d	z  fd,„Z&d*ed	z  fd-„Z'd*ed	z  fd.„Z(e)d/ed0ed	z  d1ed2ed3ed4ed	z  d*efd5„«       Z*d:d6„Z+d*e,fd7„Z-d*e,fd8„Z.y	);ÚDatabaseURLSettingsa&  Discrete ``DATABASE_*`` env vars, loaded once at process start.

    Field names are internal; ``validation_alias`` pins each one to the exact
    env var the helm chart emits. ``DATABASE_USER`` doubles as
    ``DATABASE_USERNAME`` for parity with ``construct_database_url_from_env_vars``.
    FÚignore)Úcase_sensitiveÚextra)ÚdefaultÚvalidation_aliasÚiam_token_db_authÚazure_postgresql_authÚdisable_prepared_statementsNÚDATABASE_URLrH   Ú
DIRECT_URLÚ
direct_urlÚDATABASE_HOSTÚdatabase_hostÚDATABASE_PORTÚdatabase_portÚDATABASE_USERÚDATABASE_USERNAMEÚdatabase_userÚDATABASE_NAMEÚdatabase_nameÚDATABASE_SCHEMAÚdatabase_schemaÚDATABASE_PASSWORDÚdatabase_passwordÚDATABASE_URL_READ_REPLICAÚdatabase_url_read_replicaÚDATABASE_HOST_READ_REPLICAÚdatabase_host_read_replicaÚDATABASE_PORT_READ_REPLICAÚdatabase_port_read_replicaÚDATABASE_USER_READ_REPLICAÚDATABASE_USERNAME_READ_REPLICAÚdatabase_user_read_replicaÚDATABASE_NAME_READ_REPLICAÚdatabase_name_read_replicaÚDATABASE_SCHEMA_READ_REPLICAÚdatabase_schema_read_replicaÚDATABASE_PASSWORD_READ_REPLICAÚdatabase_password_read_replicar%   c                 ó   —  | «       S )z:Load the settings from ``os.environ`` (read at call time).r*   )Úclss    r.   Úfrom_envzDatabaseURLSettings.from_env¾   s   € ñ ‹uˆrC   c                 óD   — t        | j                  | j                  ¬«      S )zÄThe token strategy the toggles ask for, or ``None`` for password auth.

        Raises ``RuntimeError`` when both toggles are on, since the password can only
        come from one source.
        )rV   rW   )r   rV   rW   )Úselfs    r.   Ú
token_authzDatabaseURLSettings.token_authÃ   s#   € ô )Ø"×4Ñ4Ø"&×"<Ñ"<ô
ð 	
rC   c           	      ó"  — | j                  «       }|�ùt        d„ d| j                  fd| j                  fd| j                  ffD «       «      }|r7t        |j                  › ddj                  |«      › d|j                  › d	�«      ‚t        t        t        | j                  «      | j                  t        t        | j                  «      t        t        | j                  «      | j                  ¬
«      }|j                  t        ||«      «      S | j                   ry| j                  rk| j                  r_| j                  rS| j#                  | j                  | j$                  | j                  | j                  | j                  | j                  ¬«      S y)u.  Return the writer URL to set, or ``None`` to leave it as-is.

        Raises ``RuntimeError`` (naming the offending vars) when token auth is
        enabled but a required field is missing â€” the proxy cannot recover
        from this and a clear startup error beats a Prisma connect failure.
        Nc              3   ó*   K  — | ]  \  }}|s|–— Œ y ­wr)   r*   ©r+   ÚenvÚvals      r.   r/   z7DatabaseURLSettings.build_writer_url.<locals>.<genexpr>×   s!   è ø€ ò #á�C˜ñ
 ô ñ#ùó   ‚r\   r`   rc   z2 is enabled but required DB env var(s) are unset: ú, zE. Set them so the writer DATABASE_URL can be assembled with a minted ú.©ÚhostÚportÚuserÚnameÚschema©r‰   Úpasswordr‡   rˆ   rŠ   r‹   )r}   r8   r]   rb   rd   ÚRuntimeErrorr   ÚjoinÚlabelr   r   r1   r_   rf   Ú	build_urlr   rH   Ú_password_urlrh   )r|   ÚauthÚmissingÚendpoints       r.   Úbuild_writer_urlz$DatabaseURLSettings.build_writer_urlÎ   s„  € ð —o‘oÓ'ˆØÐÜ"ñ #ð % d×&8Ñ&8Ð9Ø$ d×&8Ñ&8Ð9Ø$ d×&8Ñ&8Ð9ð!ô#ó ˆGñ Ü"Ø—|‘|�nð %"Ø"&§)¡)¨GÓ"4Ð!5ð 6CØCGÇ:Á:À,ÈaðQóð ô
 *Üœ#˜t×1Ñ1Ó2Ø×'Ñ'Üœ#˜t×1Ñ1Ó2Üœ#˜t×1Ñ1Ó2Ø×+Ñ+ôˆHð ×%Ñ%Ô&9¸$ÀÓ&IÓJÐJð ×ÒØØ×Ò $×"4Ò"4¸×9KÒ9KØ×%Ñ%Ø×'Ñ'Ø×/Ñ/Ø×'Ñ'Ø×'Ñ'Ø×'Ñ'Ø×+Ñ+ð &ó ð ð rC   c           	      óÄ  — | j                   sy| j                  ry| j                   }| j                  xs | j                  }| j                  xs | j
                  }| j                  xs | j                  }| j                  xs | j                  }| j                  xs | j                  }| j                  «       }|�‹t        d„ d|fd|ffD «       «      }|r*t        |j                  › ddj!                  |«      › d�«      ‚t#        ||t%        t&        |«      t%        t&        |«      |¬«      }	|	j)                  t+        ||	«      «      S |r|r| j-                  ||||||¬	«      S y)
züReturn the read-replica URL to set, or ``None`` to leave it as-is.

        Opt-in via ``DATABASE_HOST_READ_REPLICA``; never clobbers a
        pre-existing ``DATABASE_URL_READ_REPLICA``. Reader fields fall back
        to the writer's values.
        Nc              3   ó*   K  — | ]  \  }}|s|–— Œ y ­wr)   r*   r€   s      r.   r/   z7DatabaseURLSettings.build_reader_url.<locals>.<genexpr>  s!   è ø€ ò #á�C˜ñ ô ñ#ùrƒ   zDATABASE_USER[_READ_REPLICA]zDATABASE_NAME[_READ_REPLICA]zU is enabled and DATABASE_HOST_READ_REPLICA is set, but the reader could not resolve: r„   z` (no *_READ_REPLICA value and no writer fallback). Set the reader fields or the writer defaults.r†   rŒ   )rl   rj   rn   r_   rq   rb   rs   rd   ru   rf   rw   rh   r}   r8   rŽ   r   r�   r   r   r1   r‘   r   r’   )
r|   r‡   rˆ   r‰   rŠ   r‹   r�   r“   r”   r•   s
             r.   Úbuild_reader_urlz$DatabaseURLSettings.build_reader_urlý   s‚  € ð ×.Ò.ØØ×)Ò)Øà×5Ñ5ˆØ×5Ñ5ÒK¸×9KÑ9KˆØ×5Ñ5ÒK¸×9KÑ9KˆØ×5Ñ5ÒK¸×9KÑ9KˆØ×9Ñ9ÒQ¸T×=QÑ=QˆØ×=Ñ=ÒWÀ×AWÑAWˆà—o‘oÓ'ˆØÐÜ"ñ #ð 4°TÐ:Ø3°TÐ:ð!ô#ó ˆGñ Ü"Ø—|‘|�nð %Aà—y‘y Ó)Ð*ð + ð óð ô *ØØÜœ#˜t“_Üœ#˜t“_ØôˆHð ×%Ñ%Ô&9¸$ÀÓ&IÓJÐJá‘DØ×%Ñ%ØØ!ØØØØð &ó ð ð rC   r‰   r�   r‡   rˆ   rŠ   r‹   c           
      ó¾   — t         j                  j                  } || «      } ||«      }|rd|› d ||«      › d|› d|› d|› �
}	nd|› d|› d|› d|› �}	|r|	d|› �z  }	|	S )zÐPercent-encode credentials into a ``postgresql://`` URL.

        Parity with ``construct_database_url_from_env_vars`` in
        ``proxy/utils.py``; ``password`` may be empty for a passwordless URL.
        zpostgresql://ú:ú@ú/z?schema=)r5   r6   Ú
quote_plus)
r‰   r�   r‡   rˆ   rŠ   r‹   ÚquoteÚuser_pÚname_pr#   s
             r.   r’   z!DatabaseURLSettings._password_url6  sˆ   € ô —|‘|×.Ñ.ˆÙ˜d›ˆÙ˜d›ˆÙØ! & ¨©5°«?Ð*;¸1¸T¸FÀ!ÀDÀ6ÈÈ6È(ÐS‰Cà! & ¨¨4¨&°°$°°q¸¸ÐAˆCÙØ�X˜f˜XÐ&Ñ&ˆCØˆ
rC   c                 ó°   — d| j                   fd| j                  fd| j                  ffD ]*  \  }}|sŒ	t        |«      }|€Œt	        t        ||«      «      ‚ y)aÚ  Reject an operator-pinned non-PostgreSQL writer / direct / reader URL.

        The componentized entrypoints (gateway / backend / migrations) call
        ``apply_to_env`` and then hand the URL straight to Prisma, bypassing
        the CLI's own guard. A pinned URL flows through untouched, so validate
        the same three vars the CLI guard checks (DATABASE_URL, DIRECT_URL, and
        the read replica) rather than letting Prisma stall on an unusable scheme.
        rY   rZ   ri   N)rH   r[   rj   rL   rŽ   rN   )r|   r   r#   Ú
bad_schemes       r.   Ú_raise_for_unsupported_schemez1DatabaseURLSettings._raise_for_unsupported_schemeP  sn   € ð ˜T×.Ñ.Ð/Ø˜4Ÿ?™?Ð+Ø(¨$×*HÑ*HÐIð
ò 		W‰LˆG�Sñ
 ØÜ.¨sÓ3ˆJØÑ%Ü"Ô#@ÀÈ*Ó#UÓVÐVñ		WrC   c                 óÜ   — | j                  «       }|€y|t        j                  d<   | j                  rdt        j                  t        <   | j
                  rdt        j                  t        <   y)a^  Write just the assembled writer URL into ``os.environ``.

        Split out because the CLI shares this minting path but resolves the read
        replica separately, so it must not pick up reader behavior on the way. The
        CLI runs its own scheme guard over the pinned URLs, so unlike
        ``apply_to_env`` this does not repeat it.
        FrY   ÚTrueT)r–   ÚosÚenvironrV   r   rW   r   )r|   Ú
writer_urls     r.   Úapply_writer_url_to_envz+DatabaseURLSettings.apply_writer_url_to_envd  s^   € ð !×1Ñ1Ó3ˆ
ØÐØØ%/Œ�
‰
�>Ñ"ð ×!Ò!Ø4:ŒB�J‰JÔ0Ñ1Ø×%Ò%Ø8>ŒB�J‰JÔ4Ñ5ØrC   c           	      óÈ  — | j                  «        | j                  «       }| j                  rQdD ]L  }t        j                  j                  |«      }|sŒ%t        |t        ddi«      «      t        j                  |<   ŒN | j                  «       xs | j                  }|�Dt        |t        t        j                  j                  dd«      «      «      t        j                  d<   |S )u  Write the assembled URL(s) into ``os.environ``.

        Returns True iff this call set ``DATABASE_URL`` (token mint, or
        password auth that assembled a fresh URL). False means there was
        nothing to do â€” an operator-pinned URL, or no discrete fields.
        )rY   rZ   r   ÚtruerY   Ú ri   )r¤   rª   rX   r§   r¨   ÚgetrB   r   r™   rj   rG   )r|   Úwrote_writerr   r#   Ú
reader_urls        r.   Úapply_to_envz DatabaseURLSettings.apply_to_envx  sÈ   € ð 	×*Ñ*Ô,Ø"×:Ñ:Ó<ˆð
 ×+Ò+Ø9ò q�Ü—j‘j—n‘n WÓ-�ÚÜ*BÀ3ÔHXÐZeÐgmÐYnÓHoÓ*p”B—J‘J˜wÒ'ðqð !×1Ñ1Ó3ÒU°t×7UÑ7Uˆ
ØÐ!Ü6NØÜ*¬2¯:©:¯>©>¸.È"Ó+MÓNó7ŒB�J‰JÐ2Ñ3ð
 ÐrC   )r%   rP   )r%   N)/Ú__name__Ú
__module__Ú__qualname__Ú__doc__r   Úmodel_configr   r   rV   ÚIamTokenAuthFlagÚ__annotations__r   rW   ÚAzureTokenAuthFlagr   rX   ÚDisablePreparedStatementsFlagrH   r1   r[   r]   r   r_   r	   rb   rd   rf   rh   rj   rl   rn   rq   rs   ru   rw   Úclassmethodrz   r   r}   r–   r™   Ústaticmethodr’   r¤   Úboolrª   r±   r*   rC   r.   rP   rP   •   sˆ  … ññ &°UÀ(ÔK€Lá*/¸ÐPiÔ*jÐÐ'ÓjÙ05¸eÐVsÔ0tÐÐ-ÓtÙAFØÐ(KôBÐÐ!>ó ñ
  %¨TÀNÔS€L�#˜‘*ÓSÙ"¨4À,ÔO€J��d‘
ÓOÙ %¨dÀ_Ô U€M�3˜‘:ÓUÙÐ'<ÈÔ_€M�3Ó_Ù %ØÙ% oÐ7JÓKô!€M�3˜‘:ó ñ !&¨dÀ_Ô U€M�3˜‘:ÓUÙ"'°ÐGXÔ"Y€O�S˜4‘ZÓYÙ$)°$ÐI\Ô$]Ð�s˜T‘zÓ]ñ -2¸$ÐQlÔ,mÐ˜s T™zÓmÙ-2¸4ÐRnÔ-oÐ  d¡
ÓoÙ-2¸4ÐRnÔ-oÐ  d¡
ÓoÙ-2ØÙ%Ð&BÐDdÓeô.Ð  d¡
ó ñ .3¸4ÐRnÔ-oÐ  d¡
ÓoÙ/4¸TÐTrÔ/sÐ  #¨¡*ÓsÙ16¸tÐVvÔ1wÐ" C¨$¡JÓwàòó ðð	
Ð-°Ñ4ó 	
ð- #¨¡*ó -ð^7 #¨¡*ó 7ðr ðàðð ˜‘*ðð ð	ð
 ðð ðð �d‘
ðð 
òó ðó2Wð(¨ó ð(˜dô rC   rP   )1rµ   r§   Úurllib.parser5   Úcollections.abcr   Ú	functoolsr   Útypesr   Útypingr   r   r   Úpydanticr	   r
   r   Úpydantic_settingsr   r   Úlitellm.proxy.db.token_authr   r   r   r   r   r   r   r   r½   r·   r¹   r   r¸   rº   r:   r   r1   r   r"   ÚintÚfloatrB   rE   rG   rL   rN   rP   r*   rC   r.   ú<module>rÈ      sÎ  ðò"óH 
Û Ý #Ý Ý "ß )Ñ )ç 9Ñ 9ß >÷	÷ 	ó 	ð ˜T¡?±7Ð;RÐ\uÔ3vÓ#wÐwÑxÐ ØØ‰/™'Ð"9ÐC`ÔaÓ
bÐbñÐ ð .TÐ # UÓ SØ )Ø‰/™'Ð"9ÐCfÔgÓ
hÐhñ!Ð ñ /8¸ÀzÐ8RÓ.SÐ �e˜I c™NÑ+Ó SØ+€�Ó +ñ 09òó0Ð �u˜Y s™^Ñ,ó ðA #ð A¨w°s¸CÀ#¹IÈÑ<MÐ7MÑ/Nð AÐSVó Að"k G¨C°°s±¸UÑ1BÐ,BÑ$Cð kÈÐPSÐUXÐ[^ÑU^ÐafÑUfÐPfÑHgó kð
 Cð ¨G°C¸¸s¹ÀUÑ9JÐ4JÑ,Kó ð%¨ð %°°d±
ó %ð&¨3ð ¸ð Àó ô@˜,õ @rC   